@guard-rail/core 0.9.0 → 0.9.1

package/README.md

@@ -25,7 +25,7 @@ pnpm add @guard-rail/core @supabase/ssr @supabase/supabase-js
 
 Set up the database:
 
-1. Run `npx guardrail-init-db --push`. It copies the package's migration(s)
+1. Run `pnpm exec guardrail-init-db --push`. It copies the package's migration(s)
    into your own project's `supabase/migrations/` (skipping any already
    there — safe to re-run after upgrading), runs `supabase init` if needed,
    adds `guardrail` to `config.toml`'s exposed schemas for local dev, and
@@ -273,6 +273,18 @@ accounts and links, and to check membership for "Forgot password?". The Resend
 key belongs in the site's server environment too; a *sending-only* key limited
 to your domain is plenty.
 
+**While developing,** you don't need a mail provider: `consoleEmails()` prints
+each invite and reset link to your terminal instead of sending it, so the whole
+flow can be tried locally. It refuses in production — a link is as good as a
+password for choosing one, so it doesn't belong in a log — and tells the admin
+what to configure instead:
+
+```ts
+...(process.env.GUARDRAIL_EMAIL_FROM
+  ? resendEmails({ from: process.env.GUARDRAIL_EMAIL_FROM, siteName: "My Site" })
+  : consoleEmails()),
+```
+
 **Your own wording or provider.** `render` and `renderReset` replace the default
 emails; any other provider just needs an `onInvite` and `onPasswordReset` — each
 receives the same event, including the `link`:
@@ -302,7 +314,7 @@ as letting anyone make themselves an admin. Seed the first admin with the
 bundled command instead of hand-writing SQL:
 
 ```bash
-SERVICE_KEY=... npx guardrail-seed-user --email=you@example.com --password=...
+SERVICE_KEY=... pnpm exec guardrail-seed-user --email=you@example.com --password=...
 ```
 
 `--site-id` defaults to `GUARDRAIL_SITE_ID` from your `.env.local` (and

package/dist/email/console.d.ts

@@ -0,0 +1,24 @@
+import { GRInviteEvent, GRPasswordResetEvent } from '../core/adapter-types.js';
+import 'react';
+import '../core/types.js';
+
+/**
+ * A stand-in for resendEmails() while you're developing: nothing is sent, and
+ * each invite or password-reset link is printed to the server's terminal
+ * instead, so the whole flow can be tried locally with no mail provider.
+ *
+ *   ...(process.env.GUARDRAIL_EMAIL_FROM
+ *     ? resendEmails({ from: process.env.GUARDRAIL_EMAIL_FROM, siteName: "My Site" })
+ *     : consoleEmails()),
+ *
+ * Refuses in production, with an error that reaches the admin who sent the
+ * invite. A link is as good as a password for choosing one, so it doesn't
+ * belong in a production log — a deployed site without email configured should
+ * say so rather than quietly writing them there.
+ */
+declare function consoleEmails(): {
+    onInvite: (event: GRInviteEvent) => void;
+    onPasswordReset: (event: GRPasswordResetEvent) => void;
+};
+
+export { consoleEmails };

package/dist/email/console.js

@@ -0,0 +1,30 @@
+function consoleEmails() {
+  const refuseInProduction = () => {
+    if (process.env.NODE_ENV === "production") {
+      throw new Error(
+        `no email provider is configured, so this can't be sent \u2014 set GUARDRAIL_EMAIL_FROM and RESEND_API_KEY (see the README's "Passwords, invites and resets").`
+      );
+    }
+  };
+  return {
+    onInvite: (event) => {
+      refuseInProduction();
+      const what = event.isNewUser === false ? `${event.email} already has an account \u2014 they'd be told they've been added` : `Invite for ${event.email} (${event.role})`;
+      console.log(`
+[guardrail] ${what}. Nothing was emailed (development only):
+  ${event.link ?? "(no link: this auth adapter can't create one)"}
+`);
+    },
+    onPasswordReset: (event) => {
+      refuseInProduction();
+      console.log(`
+[guardrail] Password reset for ${event.email}. Nothing was emailed (development only):
+  ${event.link}
+`);
+    }
+  };
+}
+export {
+  consoleEmails
+};
+//# sourceMappingURL=console.js.map

package/dist/email/console.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/email/console.ts"],"sourcesContent":["import type { GRInviteEvent, GRPasswordResetEvent } from \"../core/adapter-types\";\n\n/**\n * A stand-in for resendEmails() while you're developing: nothing is sent, and\n * each invite or password-reset link is printed to the server's terminal\n * instead, so the whole flow can be tried locally with no mail provider.\n *\n *   ...(process.env.GUARDRAIL_EMAIL_FROM\n *     ? resendEmails({ from: process.env.GUARDRAIL_EMAIL_FROM, siteName: \"My Site\" })\n *     : consoleEmails()),\n *\n * Refuses in production, with an error that reaches the admin who sent the\n * invite. A link is as good as a password for choosing one, so it doesn't\n * belong in a production log — a deployed site without email configured should\n * say so rather than quietly writing them there.\n */\nexport function consoleEmails() {\n  const refuseInProduction = () => {\n    if (process.env.NODE_ENV === \"production\") {\n      throw new Error(\n        \"no email provider is configured, so this can't be sent — set GUARDRAIL_EMAIL_FROM and RESEND_API_KEY (see the README's \\\"Passwords, invites and resets\\\").\",\n      );\n    }\n  };\n\n  return {\n    onInvite: (event: GRInviteEvent): void => {\n      refuseInProduction();\n      const what =\n        event.isNewUser === false\n          ? `${event.email} already has an account — they'd be told they've been added`\n          : `Invite for ${event.email} (${event.role})`;\n      console.log(`\\n[guardrail] ${what}. Nothing was emailed (development only):\\n  ${event.link ?? \"(no link: this auth adapter can't create one)\"}\\n`);\n    },\n    onPasswordReset: (event: GRPasswordResetEvent): void => {\n      refuseInProduction();\n      console.log(`\\n[guardrail] Password reset for ${event.email}. Nothing was emailed (development only):\\n  ${event.link}\\n`);\n    },\n  };\n}\n"],"mappings":"AAgBO,SAAS,gBAAgB;AAC9B,QAAM,qBAAqB,MAAM;AAC/B,QAAI,QAAQ,IAAI,aAAa,cAAc;AACzC,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,UAAU,CAAC,UAA+B;AACxC,yBAAmB;AACnB,YAAM,OACJ,MAAM,cAAc,QAChB,GAAG,MAAM,KAAK,qEACd,cAAc,MAAM,KAAK,KAAK,MAAM,IAAI;AAC9C,cAAQ,IAAI;AAAA,cAAiB,IAAI;AAAA,IAAgD,MAAM,QAAQ,+CAA+C;AAAA,CAAI;AAAA,IACpJ;AAAA,IACA,iBAAiB,CAAC,UAAsC;AACtD,yBAAmB;AACnB,cAAQ,IAAI;AAAA,iCAAoC,MAAM,KAAK;AAAA,IAAgD,MAAM,IAAI;AAAA,CAAI;AAAA,IAC3H;AAAA,EACF;AACF;","names":[]}

package/dist/index.client.d.ts

@@ -20,5 +20,6 @@ declare const isEditor: (..._args: unknown[]) => never;
 declare const canEdit: (..._args: unknown[]) => never;
 declare const resendInvite: (..._args: unknown[]) => never;
 declare const resendEmails: (..._args: unknown[]) => never;
+declare const consoleEmails: (..._args: unknown[]) => never;
 
-export { GRepeater, canEdit, configureGuardrail, getFieldValue, getRepeaterItemBySlug, isAdmin, isEditor, listRepeaterItems, resendEmails, resendInvite, withGuardrail };
+export { GRepeater, canEdit, configureGuardrail, consoleEmails, getFieldValue, getRepeaterItemBySlug, isAdmin, isEditor, listRepeaterItems, resendEmails, resendInvite, withGuardrail };

package/dist/index.client.js

@@ -69,12 +69,17 @@ const resendEmails = serverOnly(
   "resendEmails()",
   "Spread it into withGuardrail(), which runs in your root layout."
 );
+const consoleEmails = serverOnly(
+  "consoleEmails()",
+  "Spread it into withGuardrail(), which runs in your root layout."
+);
 export {
   GRail,
   GRepeater,
   addRepeaterItem,
   canEdit,
   configureGuardrail,
+  consoleEmails,
   createAssetUpload,
   forgotPasswordAction,
   getFieldValue,

package/dist/index.client.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.client.ts"],"sourcesContent":["// Client-graph entry. `import ... from \"@guard-rail/core\"` resolves here from a\n// Client Component (see \"exports\" in package.json) and to ./index from a\n// Server Component, so an app uses one import path everywhere.\n//\n// Nothing server-only may be imported here — this is bundled for the browser.\n// Server Actions are fine: a \"use server\" module is replaced by references in\n// the client bundle, which is what lets an app build its own team/repeater UI\n// in a Client Component.\n\nexport { GRail } from \"./react/GRail/universal\";\nexport { useGRail } from \"./react/Provider\";\n\nexport {\n  listTeam,\n  inviteMember,\n  updateMemberRole,\n  removeMember,\n  createAssetUpload,\n  listAssets,\n  setPasswordAction,\n  skipSetPasswordAction,\n  forgotPasswordAction,\n  sendPasswordResetAction,\n  setFieldValue,\n} from \"./server/actions\";\nexport {\n  addRepeaterItem,\n  removeRepeaterItem,\n  reorderRepeaterItems,\n} from \"./server/repeaterActions\";\n\n/**\n * Stand-ins for the server-only exports, so importing one from a Client\n * Component fails with an explanation instead of an undefined-is-not-a-function\n * deep in a render. Also what a tool that doesn't set the \"react-server\"\n * condition (a test runner, a plain Node script) gets from the package root —\n * `@guard-rail/core/server` is the explicit path to the real ones there.\n */\nfunction serverOnly(name: string, hint: string) {\n  return (..._args: unknown[]): never => {\n    throw new Error(\n      `Guardrail: ${name} only works in a Server Component. ${hint} ` +\n        `(If this isn't a Client Component, your tooling may not set the ` +\n        `\"react-server\" condition — import from \"@guard-rail/core/server\" instead.)`,\n    );\n  };\n}\n\nexport const withGuardrail = serverOnly(\n  \"withGuardrail()\",\n  \"Call it in your root layout, which is a Server Component.\",\n);\nexport const configureGuardrail = serverOnly(\n  \"configureGuardrail()\",\n  \"Configuration is applied by withGuardrail() in your root layout.\",\n);\nexport const GRepeater = serverOnly(\n  \"<GRepeater>\",\n  \"Render it in a Server Component and pass it into this one as children or a prop.\",\n);\nexport const listRepeaterItems = serverOnly(\n  \"listRepeaterItems()\",\n  \"Read repeater items in a Server Component and pass them down.\",\n);\nexport const getRepeaterItemBySlug = serverOnly(\n  \"getRepeaterItemBySlug()\",\n  \"Resolve the item in a Server Component (your [slug]/page.tsx) and pass it down.\",\n);\nexport const getFieldValue = serverOnly(\n  \"getFieldValue()\",\n  \"Read the value in a Server Component and pass it down as a prop.\",\n);\nexport const isAdmin = serverOnly(\n  \"isAdmin()\",\n  \"Call it inside your own Server Action to authorize it; in a Client Component, read useGRail().role to decide what to show.\",\n);\nexport const isEditor = serverOnly(\n  \"isEditor()\",\n  \"Call it inside your own Server Action to authorize it; in a Client Component, read useGRail().role to decide what to show.\",\n);\nexport const canEdit = serverOnly(\n  \"canEdit()\",\n  \"Call it in a Server Component; in a Client Component, read `canEdit` from useGRail().\",\n);\nexport const resendInvite = serverOnly(\n  \"resendInvite()\",\n  \"Pass it as onInvite in withGuardrail(), which runs in your root layout.\",\n);\nexport const resendEmails = serverOnly(\n  \"resendEmails()\",\n  \"Spread it into withGuardrail(), which runs in your root layout.\",\n);\n\nexport type { GRepeaterProps, RepeaterItemProps } from \"./react/Repeater\";\nexport type {\n  ResendInviteOptions,\n  ResendEmailOptions,\n  ResendInviteContent,\n  ResendInviteTemplateEvent,\n  ResendResetTemplateEvent,\n} from \"./email/resend\";\nexport type {\n  GRState,\n  GRRole,\n  GRMember,\n  GRViewer,\n  GRAsset,\n  GRRepeaterItem,\n  ActionState,\n  SetPasswordState,\n  OverrideRow,\n  OverrideValue,\n  OverrideType,\n  PolymorphicProps,\n  HTMLKeys,\n} from \"./core/types\";\nexport type {\n  GRConfig,\n  GRPrefetch,\n  GRMembershipAdapter,\n  GRInviteEvent,\n  GRStorageAdapter,\n  GRUploadTarget,\n  GRRepeaterAdapter,\n  GRDBAdapter,\n  GRAuthAdapter,\n  GRSession,\n  GRStorageRow,\n  AuthResult,\n  AuthRedirectParams,\n  GRPasswordResetEvent,\n} from \"./core/adapter-types\";\n"],"mappings":"AASA,SAAS,aAAa;AACtB,SAAS,gBAAgB;AAEzB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AASP,SAAS,WAAW,MAAc,MAAc;AAC9C,SAAO,IAAI,UAA4B;AACrC,UAAM,IAAI;AAAA,MACR,cAAc,IAAI,sCAAsC,IAAI;AAAA,IAG9D;AAAA,EACF;AACF;AAEO,MAAM,gBAAgB;AAAA,EAC3B;AAAA,EACA;AACF;AACO,MAAM,qBAAqB;AAAA,EAChC;AAAA,EACA;AACF;AACO,MAAM,YAAY;AAAA,EACvB;AAAA,EACA;AACF;AACO,MAAM,oBAAoB;AAAA,EAC/B;AAAA,EACA;AACF;AACO,MAAM,wBAAwB;AAAA,EACnC;AAAA,EACA;AACF;AACO,MAAM,gBAAgB;AAAA,EAC3B;AAAA,EACA;AACF;AACO,MAAM,UAAU;AAAA,EACrB;AAAA,EACA;AACF;AACO,MAAM,WAAW;AAAA,EACtB;AAAA,EACA;AACF;AACO,MAAM,UAAU;AAAA,EACrB;AAAA,EACA;AACF;AACO,MAAM,eAAe;AAAA,EAC1B;AAAA,EACA;AACF;AACO,MAAM,eAAe;AAAA,EAC1B;AAAA,EACA;AACF;","names":[]}
+{"version":3,"sources":["../src/index.client.ts"],"sourcesContent":["// Client-graph entry. `import ... from \"@guard-rail/core\"` resolves here from a\n// Client Component (see \"exports\" in package.json) and to ./index from a\n// Server Component, so an app uses one import path everywhere.\n//\n// Nothing server-only may be imported here — this is bundled for the browser.\n// Server Actions are fine: a \"use server\" module is replaced by references in\n// the client bundle, which is what lets an app build its own team/repeater UI\n// in a Client Component.\n\nexport { GRail } from \"./react/GRail/universal\";\nexport { useGRail } from \"./react/Provider\";\n\nexport {\n  listTeam,\n  inviteMember,\n  updateMemberRole,\n  removeMember,\n  createAssetUpload,\n  listAssets,\n  setPasswordAction,\n  skipSetPasswordAction,\n  forgotPasswordAction,\n  sendPasswordResetAction,\n  setFieldValue,\n} from \"./server/actions\";\nexport {\n  addRepeaterItem,\n  removeRepeaterItem,\n  reorderRepeaterItems,\n} from \"./server/repeaterActions\";\n\n/**\n * Stand-ins for the server-only exports, so importing one from a Client\n * Component fails with an explanation instead of an undefined-is-not-a-function\n * deep in a render. Also what a tool that doesn't set the \"react-server\"\n * condition (a test runner, a plain Node script) gets from the package root —\n * `@guard-rail/core/server` is the explicit path to the real ones there.\n */\nfunction serverOnly(name: string, hint: string) {\n  return (..._args: unknown[]): never => {\n    throw new Error(\n      `Guardrail: ${name} only works in a Server Component. ${hint} ` +\n        `(If this isn't a Client Component, your tooling may not set the ` +\n        `\"react-server\" condition — import from \"@guard-rail/core/server\" instead.)`,\n    );\n  };\n}\n\nexport const withGuardrail = serverOnly(\n  \"withGuardrail()\",\n  \"Call it in your root layout, which is a Server Component.\",\n);\nexport const configureGuardrail = serverOnly(\n  \"configureGuardrail()\",\n  \"Configuration is applied by withGuardrail() in your root layout.\",\n);\nexport const GRepeater = serverOnly(\n  \"<GRepeater>\",\n  \"Render it in a Server Component and pass it into this one as children or a prop.\",\n);\nexport const listRepeaterItems = serverOnly(\n  \"listRepeaterItems()\",\n  \"Read repeater items in a Server Component and pass them down.\",\n);\nexport const getRepeaterItemBySlug = serverOnly(\n  \"getRepeaterItemBySlug()\",\n  \"Resolve the item in a Server Component (your [slug]/page.tsx) and pass it down.\",\n);\nexport const getFieldValue = serverOnly(\n  \"getFieldValue()\",\n  \"Read the value in a Server Component and pass it down as a prop.\",\n);\nexport const isAdmin = serverOnly(\n  \"isAdmin()\",\n  \"Call it inside your own Server Action to authorize it; in a Client Component, read useGRail().role to decide what to show.\",\n);\nexport const isEditor = serverOnly(\n  \"isEditor()\",\n  \"Call it inside your own Server Action to authorize it; in a Client Component, read useGRail().role to decide what to show.\",\n);\nexport const canEdit = serverOnly(\n  \"canEdit()\",\n  \"Call it in a Server Component; in a Client Component, read `canEdit` from useGRail().\",\n);\nexport const resendInvite = serverOnly(\n  \"resendInvite()\",\n  \"Pass it as onInvite in withGuardrail(), which runs in your root layout.\",\n);\nexport const resendEmails = serverOnly(\n  \"resendEmails()\",\n  \"Spread it into withGuardrail(), which runs in your root layout.\",\n);\nexport const consoleEmails = serverOnly(\n  \"consoleEmails()\",\n  \"Spread it into withGuardrail(), which runs in your root layout.\",\n);\n\nexport type { GRepeaterProps, RepeaterItemProps } from \"./react/Repeater\";\nexport type {\n  ResendInviteOptions,\n  ResendEmailOptions,\n  ResendInviteContent,\n  ResendInviteTemplateEvent,\n  ResendResetTemplateEvent,\n} from \"./email/resend\";\nexport type {\n  GRState,\n  GRRole,\n  GRMember,\n  GRViewer,\n  GRAsset,\n  GRRepeaterItem,\n  ActionState,\n  SetPasswordState,\n  OverrideRow,\n  OverrideValue,\n  OverrideType,\n  PolymorphicProps,\n  HTMLKeys,\n} from \"./core/types\";\nexport type {\n  GRConfig,\n  GRPrefetch,\n  GRMembershipAdapter,\n  GRInviteEvent,\n  GRStorageAdapter,\n  GRUploadTarget,\n  GRRepeaterAdapter,\n  GRDBAdapter,\n  GRAuthAdapter,\n  GRSession,\n  GRStorageRow,\n  AuthResult,\n  AuthRedirectParams,\n  GRPasswordResetEvent,\n} from \"./core/adapter-types\";\n"],"mappings":"AASA,SAAS,aAAa;AACtB,SAAS,gBAAgB;AAEzB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AASP,SAAS,WAAW,MAAc,MAAc;AAC9C,SAAO,IAAI,UAA4B;AACrC,UAAM,IAAI;AAAA,MACR,cAAc,IAAI,sCAAsC,IAAI;AAAA,IAG9D;AAAA,EACF;AACF;AAEO,MAAM,gBAAgB;AAAA,EAC3B;AAAA,EACA;AACF;AACO,MAAM,qBAAqB;AAAA,EAChC;AAAA,EACA;AACF;AACO,MAAM,YAAY;AAAA,EACvB;AAAA,EACA;AACF;AACO,MAAM,oBAAoB;AAAA,EAC/B;AAAA,EACA;AACF;AACO,MAAM,wBAAwB;AAAA,EACnC;AAAA,EACA;AACF;AACO,MAAM,gBAAgB;AAAA,EAC3B;AAAA,EACA;AACF;AACO,MAAM,UAAU;AAAA,EACrB;AAAA,EACA;AACF;AACO,MAAM,WAAW;AAAA,EACtB;AAAA,EACA;AACF;AACO,MAAM,UAAU;AAAA,EACrB;AAAA,EACA;AACF;AACO,MAAM,eAAe;AAAA,EAC1B;AAAA,EACA;AACF;AACO,MAAM,eAAe;AAAA,EAC1B;AAAA,EACA;AACF;AACO,MAAM,gBAAgB;AAAA,EAC3B;AAAA,EACA;AACF;","names":[]}

package/dist/index.d.ts

@@ -7,6 +7,7 @@ export { getRepeaterItemBySlug, listRepeaterItems } from './server/repeaterData.
 export { getFieldValue } from './server/fieldData.js';
 export { canEdit, isAdmin, isEditor } from './server/access.js';
 export { ResendEmailOptions, ResendInviteContent, ResendInviteOptions, ResendInviteTemplateEvent, ResendResetTemplateEvent, resendEmails, resendInvite } from './email/resend.js';
+export { consoleEmails } from './email/console.js';
 export { addRepeaterItem, removeRepeaterItem, reorderRepeaterItems } from './server/repeaterActions.js';
 export { useGRail } from './react/Provider.js';
 export { ActionState, GRAsset, GRMember, GRRepeaterItem, GRRole, GRState, GRViewer, HTMLKeys, OverrideRow, OverrideType, OverrideValue, PolymorphicProps, SetPasswordState } from './core/types.js';

package/dist/index.js

@@ -22,6 +22,7 @@ import {
 import { getFieldValue } from "./server/fieldData";
 import { isAdmin, isEditor, canEdit } from "./server/access";
 import { resendInvite, resendEmails } from "./email/resend";
+import { consoleEmails } from "./email/console";
 import {
   addRepeaterItem,
   removeRepeaterItem,
@@ -34,6 +35,7 @@ export {
   addRepeaterItem,
   canEdit,
   configureGuardrail,
+  consoleEmails,
   createAssetUpload,
   forgotPasswordAction,
   getFieldValue,

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"sourcesContent":["// Server-safe entry. Client components are reached through the files that\n// carry their own \"use client\" directive, so importing this from a Server\n// Component does not pull the editor into the client bundle.\nexport { withGuardrail } from \"./server/wrapper\";\n\n// Team management and the set-password step, exported so an app can build\n// its own UI instead of using the bundled drawer / sign-in bar.\nexport {\n  listTeam,\n  inviteMember,\n  updateMemberRole,\n  removeMember,\n  createAssetUpload,\n  listAssets,\n  setPasswordAction,\n  skipSetPasswordAction,\n  forgotPasswordAction,\n  sendPasswordResetAction,\n  setFieldValue,\n} from \"./server/actions\";\nexport { GRail } from \"./react/GRail\";\nexport { GRepeater } from \"./react/Repeater\";\nexport type { GRepeaterProps, RepeaterItemProps } from \"./react/Repeater\";\nexport { configureGuardrail } from \"./core/config\";\nexport {\n  listRepeaterItems,\n  getRepeaterItemBySlug,\n} from \"./server/repeaterData\";\nexport { getFieldValue } from \"./server/fieldData\";\n// Role / edit-mode checks for a custom admin UI and the Server Actions behind\n// it. Plain server functions, not actions — see access.ts for why.\nexport { isAdmin, isEditor, canEdit } from \"./server/access\";\n// Invite delivery through Resend, as an onInvite handler — see email/resend.ts.\nexport { resendInvite, resendEmails } from \"./email/resend\";\nexport type {\n  ResendInviteOptions,\n  ResendEmailOptions,\n  ResendInviteContent,\n  ResendInviteTemplateEvent,\n  ResendResetTemplateEvent,\n} from \"./email/resend\";\n// Mutations, exported so an app can build its own add/remove/reorder UI\n// instead of the bundled chrome — same rationale as the team actions above.\nexport {\n  addRepeaterItem,\n  removeRepeaterItem,\n  reorderRepeaterItems,\n} from \"./server/repeaterActions\";\nexport { useGRail } from \"./react/Provider\";\n\nexport type {\n  GRState,\n  GRRole,\n  GRMember,\n  GRViewer,\n  GRAsset,\n  GRRepeaterItem,\n  ActionState,\n  SetPasswordState,\n  OverrideRow,\n  OverrideValue,\n  OverrideType,\n  PolymorphicProps,\n  HTMLKeys,\n} from \"./core/types\";\nexport type {\n  GRConfig,\n  GRPrefetch,\n  GRMembershipAdapter,\n  GRInviteEvent,\n  GRStorageAdapter,\n  GRUploadTarget,\n  GRRepeaterAdapter,\n  GRDBAdapter,\n  GRAuthAdapter,\n  GRSession,\n  GRStorageRow,\n  AuthResult,\n  AuthRedirectParams,\n  GRPasswordResetEvent,\n} from \"./core/adapter-types\";\n"],"mappings":"AAGA,SAAS,qBAAqB;AAI9B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,aAAa;AACtB,SAAS,iBAAiB;AAE1B,SAAS,0BAA0B;AACnC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,qBAAqB;AAG9B,SAAS,SAAS,UAAU,eAAe;AAE3C,SAAS,cAAc,oBAAoB;AAU3C;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,gBAAgB;","names":[]}
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["// Server-safe entry. Client components are reached through the files that\n// carry their own \"use client\" directive, so importing this from a Server\n// Component does not pull the editor into the client bundle.\nexport { withGuardrail } from \"./server/wrapper\";\n\n// Team management and the set-password step, exported so an app can build\n// its own UI instead of using the bundled drawer / sign-in bar.\nexport {\n  listTeam,\n  inviteMember,\n  updateMemberRole,\n  removeMember,\n  createAssetUpload,\n  listAssets,\n  setPasswordAction,\n  skipSetPasswordAction,\n  forgotPasswordAction,\n  sendPasswordResetAction,\n  setFieldValue,\n} from \"./server/actions\";\nexport { GRail } from \"./react/GRail\";\nexport { GRepeater } from \"./react/Repeater\";\nexport type { GRepeaterProps, RepeaterItemProps } from \"./react/Repeater\";\nexport { configureGuardrail } from \"./core/config\";\nexport {\n  listRepeaterItems,\n  getRepeaterItemBySlug,\n} from \"./server/repeaterData\";\nexport { getFieldValue } from \"./server/fieldData\";\n// Role / edit-mode checks for a custom admin UI and the Server Actions behind\n// it. Plain server functions, not actions — see access.ts for why.\nexport { isAdmin, isEditor, canEdit } from \"./server/access\";\n// Invite delivery through Resend, as an onInvite handler — see email/resend.ts.\nexport { resendInvite, resendEmails } from \"./email/resend\";\nexport { consoleEmails } from \"./email/console\";\nexport type {\n  ResendInviteOptions,\n  ResendEmailOptions,\n  ResendInviteContent,\n  ResendInviteTemplateEvent,\n  ResendResetTemplateEvent,\n} from \"./email/resend\";\n// Mutations, exported so an app can build its own add/remove/reorder UI\n// instead of the bundled chrome — same rationale as the team actions above.\nexport {\n  addRepeaterItem,\n  removeRepeaterItem,\n  reorderRepeaterItems,\n} from \"./server/repeaterActions\";\nexport { useGRail } from \"./react/Provider\";\n\nexport type {\n  GRState,\n  GRRole,\n  GRMember,\n  GRViewer,\n  GRAsset,\n  GRRepeaterItem,\n  ActionState,\n  SetPasswordState,\n  OverrideRow,\n  OverrideValue,\n  OverrideType,\n  PolymorphicProps,\n  HTMLKeys,\n} from \"./core/types\";\nexport type {\n  GRConfig,\n  GRPrefetch,\n  GRMembershipAdapter,\n  GRInviteEvent,\n  GRStorageAdapter,\n  GRUploadTarget,\n  GRRepeaterAdapter,\n  GRDBAdapter,\n  GRAuthAdapter,\n  GRSession,\n  GRStorageRow,\n  AuthResult,\n  AuthRedirectParams,\n  GRPasswordResetEvent,\n} from \"./core/adapter-types\";\n"],"mappings":"AAGA,SAAS,qBAAqB;AAI9B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,aAAa;AACtB,SAAS,iBAAiB;AAE1B,SAAS,0BAA0B;AACnC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,qBAAqB;AAG9B,SAAS,SAAS,UAAU,eAAe;AAE3C,SAAS,cAAc,oBAAoB;AAC3C,SAAS,qBAAqB;AAU9B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,gBAAgB;","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@guard-rail/core",
-  "version": "0.9.0",
+  "version": "0.9.1",
   "description": "Lightweight inline content editing for developer-owned Next.js sites.",
   "license": "ISC",
   "type": "module",
@@ -39,7 +39,7 @@
     "access": "public"
   },
   "peerDependencies": {
-    "@supabase/ssr": "^0.8.0",
+    "@supabase/ssr": ">=0.8.0 <1",
     "@supabase/supabase-js": "^2.0.0",
     "next": ">=15",
     "react": ">=19"

package/scripts/postinstall.mjs

@@ -30,7 +30,7 @@ Guardrail installed. Next steps:
 1. Set up the database (skip both if this Supabase project already has
    Guardrail applied for another site — see "Many sites, one Supabase
    project" in the README):
-     - npx guardrail-init-db --push
+     - pnpm exec guardrail-init-db --push
      - If that project is hosted (not local Docker), also add "guardrail"
        under Settings > API > Exposed schemas in the Supabase dashboard —
        config.toml only covers local dev.
@@ -42,7 +42,7 @@ Guardrail installed. Next steps:
    first admin on a site (needs the service_role key, not the anon key —
    Settings > API in the dashboard; pass it inline, don't store it):
 
-     SERVICE_KEY=... npx guardrail-seed-user \\
+     SERVICE_KEY=... pnpm exec guardrail-seed-user \\
        --email=you@example.com --password=... --site-id=my-site
 `);
 }