@guard-rail/core 0.9.1 → 0.10.0

package/dist/core/validate.js

@@ -0,0 +1,118 @@
+const OVERRIDE_TYPES = ["text", "link", "image", "button"];
+const LIMITS = {
+  pathKey: 200,
+  text: 2e4,
+  url: 2048,
+  alt: 1e3,
+  dimension: 2e4
+};
+const CONTROL_CHARS = /[\u0000-\u001f\u007f]/;
+const SCHEME = /^([a-z][a-z0-9+.\-]*):/i;
+const LINK_SCHEMES = ["http", "https", "mailto", "tel"];
+const IMAGE_SCHEMES = ["http", "https"];
+function allowedUrl(raw, schemes) {
+  if (typeof raw !== "string") return null;
+  const value = raw.trim();
+  if (!value || value.length > LIMITS.url || CONTROL_CHARS.test(value)) return null;
+  const scheme = value.replace(/\s/g, "").match(SCHEME)?.[1]?.toLowerCase();
+  if (scheme && !schemes.includes(scheme)) return null;
+  return value;
+}
+function safeHref(raw) {
+  return allowedUrl(raw, LINK_SCHEMES);
+}
+function safeImageSrc(raw) {
+  return allowedUrl(raw, IMAGE_SCHEMES);
+}
+function validPathKey(raw) {
+  if (typeof raw !== "string") return null;
+  const key = raw.trim();
+  return key && key.length <= LIMITS.pathKey && !CONTROL_CHARS.test(key) ? key : null;
+}
+function validateOverrideValue(input) {
+  if (!input || typeof input !== "object" || Array.isArray(input)) {
+    return { ok: false, error: "Invalid value." };
+  }
+  const v = input;
+  if (typeof v.type !== "string" || !OVERRIDE_TYPES.includes(v.type)) {
+    return { ok: false, error: `Unknown field type "${String(v.type)}".` };
+  }
+  const out = { type: v.type };
+  if (v.text !== void 0) {
+    if (typeof v.text !== "string" || v.text.length > LIMITS.text) {
+      return { ok: false, error: `Text must be a string under ${LIMITS.text} characters.` };
+    }
+    out.text = v.text;
+  }
+  if (v.alt !== void 0) {
+    if (typeof v.alt !== "string" || v.alt.length > LIMITS.alt) {
+      return { ok: false, error: `Alt text must be under ${LIMITS.alt} characters.` };
+    }
+    out.alt = v.alt;
+  }
+  if (v.href !== void 0 && v.href !== "") {
+    const href = safeHref(v.href);
+    if (href === null) {
+      return {
+        ok: false,
+        error: "That link isn't allowed. Use a path like /about, or an http(s), mailto or tel address."
+      };
+    }
+    out.href = href;
+  } else if (v.href === "") {
+    out.href = "";
+  }
+  if (v.src !== void 0 && v.src !== "") {
+    const src = safeImageSrc(v.src);
+    if (src === null) {
+      return { ok: false, error: "That image address isn't allowed. Use a path or an http(s) URL." };
+    }
+    out.src = src;
+  } else if (v.src === "") {
+    out.src = "";
+  }
+  for (const key of ["width", "height"]) {
+    const n = v[key];
+    if (n === void 0) continue;
+    if (typeof n !== "number" || !Number.isFinite(n) || n <= 0 || n > LIMITS.dimension) {
+      return { ok: false, error: `Image ${key} is out of range.` };
+    }
+    out[key] = Math.round(n);
+  }
+  return { ok: true, value: out };
+}
+const EMAIL_PATTERN = /^[^@\s]+@[^@\s]+\.[^@\s]+$/;
+function cleanEmail(raw) {
+  if (typeof raw !== "string") return null;
+  const email = raw.trim().toLowerCase();
+  return email.length <= 254 && !CONTROL_CHARS.test(email) && EMAIL_PATTERN.test(email) ? email : null;
+}
+function isRole(raw) {
+  return raw === "admin" || raw === "editor";
+}
+function validId(raw) {
+  return typeof raw === "string" && raw.length > 0 && raw.length <= LIMITS.pathKey && !CONTROL_CHARS.test(raw) ? raw : null;
+}
+function validIdList(raw, max = 1e3) {
+  if (!Array.isArray(raw) || raw.length > max) return null;
+  const out = [];
+  for (const item of raw) {
+    const id = validId(item);
+    if (id === null) return null;
+    out.push(id);
+  }
+  return out;
+}
+export {
+  LIMITS,
+  OVERRIDE_TYPES,
+  cleanEmail,
+  isRole,
+  safeHref,
+  safeImageSrc,
+  validId,
+  validIdList,
+  validPathKey,
+  validateOverrideValue
+};
+//# sourceMappingURL=validate.js.map

package/dist/core/validate.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/core/validate.ts"],"sourcesContent":["import type { GRRole, OverrideType, OverrideValue } from \"./types\";\n\n/**\n * Checks on field values before they are stored and again before they are\n * rendered. Pure and dependency-free, so the same rules run on the server (what\n * may be written) and in the renderer (what rows already in the table may do).\n *\n * Why it matters: an editor types these, a visitor's browser then acts on them.\n * A link whose href is `javascript:...` is a script that runs for whoever\n * clicks it, so a low-privilege editor account must not be able to store one.\n */\n\nexport const OVERRIDE_TYPES: readonly OverrideType[] = [\"text\", \"link\", \"image\", \"button\"];\n\nexport const LIMITS = {\n  pathKey: 200,\n  text: 20_000,\n  url: 2_048,\n  alt: 1_000,\n  dimension: 20_000,\n} as const;\n\nconst CONTROL_CHARS = /[\\u0000-\\u001f\\u007f]/;\nconst SCHEME = /^([a-z][a-z0-9+.\\-]*):/i;\n\nconst LINK_SCHEMES = [\"http\", \"https\", \"mailto\", \"tel\"];\nconst IMAGE_SCHEMES = [\"http\", \"https\"];\n\nfunction allowedUrl(raw: unknown, schemes: readonly string[]): string | null {\n  if (typeof raw !== \"string\") return null;\n  const value = raw.trim();\n  if (!value || value.length > LIMITS.url || CONTROL_CHARS.test(value)) return null;\n  // A browser ignores whitespace inside a scheme (\"java\\tscript:\"), so look for\n  // one with it removed. Control characters are already refused above.\n  const scheme = value.replace(/\\s/g, \"\").match(SCHEME)?.[1]?.toLowerCase();\n  if (scheme && !schemes.includes(scheme)) return null;\n  return value;\n}\n\n/** The link, if it is a relative path, an anchor, or http(s)/mailto/tel; otherwise null. */\nexport function safeHref(raw: unknown): string | null {\n  return allowedUrl(raw, LINK_SCHEMES);\n}\n\n/** The image address, if it is relative or http(s); otherwise null. */\nexport function safeImageSrc(raw: unknown): string | null {\n  return allowedUrl(raw, IMAGE_SCHEMES);\n}\n\nexport function validPathKey(raw: unknown): string | null {\n  if (typeof raw !== \"string\") return null;\n  const key = raw.trim();\n  return key && key.length <= LIMITS.pathKey && !CONTROL_CHARS.test(key) ? key : null;\n}\n\ntype Checked = { ok: true; value: OverrideValue } | { ok: false; error: string };\n\n/**\n * Validates a value from the browser and returns a clean copy: only known\n * fields, only the right shapes, bounded sizes. Anything else is an error, not\n * silently dropped, so a bad write fails visibly.\n */\nexport function validateOverrideValue(input: unknown): Checked {\n  if (!input || typeof input !== \"object\" || Array.isArray(input)) {\n    return { ok: false, error: \"Invalid value.\" };\n  }\n  const v = input as Record<string, unknown>;\n  if (typeof v.type !== \"string\" || !OVERRIDE_TYPES.includes(v.type as OverrideType)) {\n    return { ok: false, error: `Unknown field type \"${String(v.type)}\".` };\n  }\n  const out: OverrideValue = { type: v.type as OverrideType };\n\n  if (v.text !== undefined) {\n    if (typeof v.text !== \"string\" || v.text.length > LIMITS.text) {\n      return { ok: false, error: `Text must be a string under ${LIMITS.text} characters.` };\n    }\n    out.text = v.text;\n  }\n  if (v.alt !== undefined) {\n    if (typeof v.alt !== \"string\" || v.alt.length > LIMITS.alt) {\n      return { ok: false, error: `Alt text must be under ${LIMITS.alt} characters.` };\n    }\n    out.alt = v.alt;\n  }\n  if (v.href !== undefined && v.href !== \"\") {\n    const href = safeHref(v.href);\n    if (href === null) {\n      return {\n        ok: false,\n        error: \"That link isn't allowed. Use a path like /about, or an http(s), mailto or tel address.\",\n      };\n    }\n    out.href = href;\n  } else if (v.href === \"\") {\n    out.href = \"\";\n  }\n  if (v.src !== undefined && v.src !== \"\") {\n    const src = safeImageSrc(v.src);\n    if (src === null) {\n      return { ok: false, error: \"That image address isn't allowed. Use a path or an http(s) URL.\" };\n    }\n    out.src = src;\n  } else if (v.src === \"\") {\n    out.src = \"\";\n  }\n  for (const key of [\"width\", \"height\"] as const) {\n    const n = v[key];\n    if (n === undefined) continue;\n    if (typeof n !== \"number\" || !Number.isFinite(n) || n <= 0 || n > LIMITS.dimension) {\n      return { ok: false, error: `Image ${key} is out of range.` };\n    }\n    out[key] = Math.round(n);\n  }\n  return { ok: true, value: out };\n}\n\nconst EMAIL_PATTERN = /^[^@\\s]+@[^@\\s]+\\.[^@\\s]+$/;\n\n/** A normalized (trimmed, lower-cased) address, or null if it isn't a plausible one. RFC 5321 caps an address at 254 characters. */\nexport function cleanEmail(raw: unknown): string | null {\n  if (typeof raw !== \"string\") return null;\n  const email = raw.trim().toLowerCase();\n  return email.length <= 254 && !CONTROL_CHARS.test(email) && EMAIL_PATTERN.test(email) ? email : null;\n}\n\nexport function isRole(raw: unknown): raw is GRRole {\n  return raw === \"admin\" || raw === \"editor\";\n}\n\n/** An identifier from the browser (a repeater or item id): a bounded string without control characters. */\nexport function validId(raw: unknown): string | null {\n  return typeof raw === \"string\" && raw.length > 0 && raw.length <= LIMITS.pathKey && !CONTROL_CHARS.test(raw)\n    ? raw\n    : null;\n}\n\n/** A list of ids: an array of valid ids, no longer than `max`. */\nexport function validIdList(raw: unknown, max = 1_000): string[] | null {\n  if (!Array.isArray(raw) || raw.length > max) return null;\n  const out: string[] = [];\n  for (const item of raw) {\n    const id = validId(item);\n    if (id === null) return null;\n    out.push(id);\n  }\n  return out;\n}\n"],"mappings":"AAYO,MAAM,iBAA0C,CAAC,QAAQ,QAAQ,SAAS,QAAQ;AAElF,MAAM,SAAS;AAAA,EACpB,SAAS;AAAA,EACT,MAAM;AAAA,EACN,KAAK;AAAA,EACL,KAAK;AAAA,EACL,WAAW;AACb;AAEA,MAAM,gBAAgB;AACtB,MAAM,SAAS;AAEf,MAAM,eAAe,CAAC,QAAQ,SAAS,UAAU,KAAK;AACtD,MAAM,gBAAgB,CAAC,QAAQ,OAAO;AAEtC,SAAS,WAAW,KAAc,SAA2C;AAC3E,MAAI,OAAO,QAAQ,SAAU,QAAO;AACpC,QAAM,QAAQ,IAAI,KAAK;AACvB,MAAI,CAAC,SAAS,MAAM,SAAS,OAAO,OAAO,cAAc,KAAK,KAAK,EAAG,QAAO;AAG7E,QAAM,SAAS,MAAM,QAAQ,OAAO,EAAE,EAAE,MAAM,MAAM,IAAI,CAAC,GAAG,YAAY;AACxE,MAAI,UAAU,CAAC,QAAQ,SAAS,MAAM,EAAG,QAAO;AAChD,SAAO;AACT;AAGO,SAAS,SAAS,KAA6B;AACpD,SAAO,WAAW,KAAK,YAAY;AACrC;AAGO,SAAS,aAAa,KAA6B;AACxD,SAAO,WAAW,KAAK,aAAa;AACtC;AAEO,SAAS,aAAa,KAA6B;AACxD,MAAI,OAAO,QAAQ,SAAU,QAAO;AACpC,QAAM,MAAM,IAAI,KAAK;AACrB,SAAO,OAAO,IAAI,UAAU,OAAO,WAAW,CAAC,cAAc,KAAK,GAAG,IAAI,MAAM;AACjF;AASO,SAAS,sBAAsB,OAAyB;AAC7D,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAAG;AAC/D,WAAO,EAAE,IAAI,OAAO,OAAO,iBAAiB;AAAA,EAC9C;AACA,QAAM,IAAI;AACV,MAAI,OAAO,EAAE,SAAS,YAAY,CAAC,eAAe,SAAS,EAAE,IAAoB,GAAG;AAClF,WAAO,EAAE,IAAI,OAAO,OAAO,uBAAuB,OAAO,EAAE,IAAI,CAAC,KAAK;AAAA,EACvE;AACA,QAAM,MAAqB,EAAE,MAAM,EAAE,KAAqB;AAE1D,MAAI,EAAE,SAAS,QAAW;AACxB,QAAI,OAAO,EAAE,SAAS,YAAY,EAAE,KAAK,SAAS,OAAO,MAAM;AAC7D,aAAO,EAAE,IAAI,OAAO,OAAO,+BAA+B,OAAO,IAAI,eAAe;AAAA,IACtF;AACA,QAAI,OAAO,EAAE;AAAA,EACf;AACA,MAAI,EAAE,QAAQ,QAAW;AACvB,QAAI,OAAO,EAAE,QAAQ,YAAY,EAAE,IAAI,SAAS,OAAO,KAAK;AAC1D,aAAO,EAAE,IAAI,OAAO,OAAO,0BAA0B,OAAO,GAAG,eAAe;AAAA,IAChF;AACA,QAAI,MAAM,EAAE;AAAA,EACd;AACA,MAAI,EAAE,SAAS,UAAa,EAAE,SAAS,IAAI;AACzC,UAAM,OAAO,SAAS,EAAE,IAAI;AAC5B,QAAI,SAAS,MAAM;AACjB,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,MACT;AAAA,IACF;AACA,QAAI,OAAO;AAAA,EACb,WAAW,EAAE,SAAS,IAAI;AACxB,QAAI,OAAO;AAAA,EACb;AACA,MAAI,EAAE,QAAQ,UAAa,EAAE,QAAQ,IAAI;AACvC,UAAM,MAAM,aAAa,EAAE,GAAG;AAC9B,QAAI,QAAQ,MAAM;AAChB,aAAO,EAAE,IAAI,OAAO,OAAO,kEAAkE;AAAA,IAC/F;AACA,QAAI,MAAM;AAAA,EACZ,WAAW,EAAE,QAAQ,IAAI;AACvB,QAAI,MAAM;AAAA,EACZ;AACA,aAAW,OAAO,CAAC,SAAS,QAAQ,GAAY;AAC9C,UAAM,IAAI,EAAE,GAAG;AACf,QAAI,MAAM,OAAW;AACrB,QAAI,OAAO,MAAM,YAAY,CAAC,OAAO,SAAS,CAAC,KAAK,KAAK,KAAK,IAAI,OAAO,WAAW;AAClF,aAAO,EAAE,IAAI,OAAO,OAAO,SAAS,GAAG,oBAAoB;AAAA,IAC7D;AACA,QAAI,GAAG,IAAI,KAAK,MAAM,CAAC;AAAA,EACzB;AACA,SAAO,EAAE,IAAI,MAAM,OAAO,IAAI;AAChC;AAEA,MAAM,gBAAgB;AAGf,SAAS,WAAW,KAA6B;AACtD,MAAI,OAAO,QAAQ,SAAU,QAAO;AACpC,QAAM,QAAQ,IAAI,KAAK,EAAE,YAAY;AACrC,SAAO,MAAM,UAAU,OAAO,CAAC,cAAc,KAAK,KAAK,KAAK,cAAc,KAAK,KAAK,IAAI,QAAQ;AAClG;AAEO,SAAS,OAAO,KAA6B;AAClD,SAAO,QAAQ,WAAW,QAAQ;AACpC;AAGO,SAAS,QAAQ,KAA6B;AACnD,SAAO,OAAO,QAAQ,YAAY,IAAI,SAAS,KAAK,IAAI,UAAU,OAAO,WAAW,CAAC,cAAc,KAAK,GAAG,IACvG,MACA;AACN;AAGO,SAAS,YAAY,KAAc,MAAM,KAAwB;AACtE,MAAI,CAAC,MAAM,QAAQ,GAAG,KAAK,IAAI,SAAS,IAAK,QAAO;AACpD,QAAM,MAAgB,CAAC;AACvB,aAAW,QAAQ,KAAK;AACtB,UAAM,KAAK,QAAQ,IAAI;AACvB,QAAI,OAAO,KAAM,QAAO;AACxB,QAAI,KAAK,EAAE;AAAA,EACb;AACA,SAAO;AACT;","names":[]}

package/dist/index.client.d.ts

@@ -5,7 +5,7 @@ export { addRepeaterItem, removeRepeaterItem, reorderRepeaterItems } from './ser
 export { GRepeaterProps, RepeaterItemProps } from './react/Repeater/index.js';
 export { ResendEmailOptions, ResendInviteContent, ResendInviteOptions, ResendInviteTemplateEvent, ResendResetTemplateEvent } from './email/resend.js';
 export { ActionState, GRAsset, GRMember, GRRepeaterItem, GRRole, GRState, GRViewer, HTMLKeys, OverrideRow, OverrideType, OverrideValue, PolymorphicProps, SetPasswordState } from './core/types.js';
-export { AuthRedirectParams, AuthResult, GRAuthAdapter, GRConfig, GRDBAdapter, GRInviteEvent, GRMembershipAdapter, GRPasswordResetEvent, GRPrefetch, GRRepeaterAdapter, GRSession, GRStorageAdapter, GRStorageRow, GRUploadTarget } from './core/adapter-types.js';
+export { AuthRedirectParams, AuthResult, GRAuthAdapter, GRConfig, GRDBAdapter, GRInviteEvent, GRMembershipAdapter, GRPasswordResetEvent, GRPrefetch, GRRateLimitHit, GRRateLimitName, GRRateLimiter, GRRepeaterAdapter, GRSession, GRStorageAdapter, GRStorageRow, GRUploadTarget } from './core/adapter-types.js';
 import 'react/jsx-runtime';
 import 'react';
 

package/dist/index.client.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.client.ts"],"sourcesContent":["// Client-graph entry. `import ... from \"@guard-rail/core\"` resolves here from a\n// Client Component (see \"exports\" in package.json) and to ./index from a\n// Server Component, so an app uses one import path everywhere.\n//\n// Nothing server-only may be imported here — this is bundled for the browser.\n// Server Actions are fine: a \"use server\" module is replaced by references in\n// the client bundle, which is what lets an app build its own team/repeater UI\n// in a Client Component.\n\nexport { GRail } from \"./react/GRail/universal\";\nexport { useGRail } from \"./react/Provider\";\n\nexport {\n  listTeam,\n  inviteMember,\n  updateMemberRole,\n  removeMember,\n  createAssetUpload,\n  listAssets,\n  setPasswordAction,\n  skipSetPasswordAction,\n  forgotPasswordAction,\n  sendPasswordResetAction,\n  setFieldValue,\n} from \"./server/actions\";\nexport {\n  addRepeaterItem,\n  removeRepeaterItem,\n  reorderRepeaterItems,\n} from \"./server/repeaterActions\";\n\n/**\n * Stand-ins for the server-only exports, so importing one from a Client\n * Component fails with an explanation instead of an undefined-is-not-a-function\n * deep in a render. Also what a tool that doesn't set the \"react-server\"\n * condition (a test runner, a plain Node script) gets from the package root —\n * `@guard-rail/core/server` is the explicit path to the real ones there.\n */\nfunction serverOnly(name: string, hint: string) {\n  return (..._args: unknown[]): never => {\n    throw new Error(\n      `Guardrail: ${name} only works in a Server Component. ${hint} ` +\n        `(If this isn't a Client Component, your tooling may not set the ` +\n        `\"react-server\" condition — import from \"@guard-rail/core/server\" instead.)`,\n    );\n  };\n}\n\nexport const withGuardrail = serverOnly(\n  \"withGuardrail()\",\n  \"Call it in your root layout, which is a Server Component.\",\n);\nexport const configureGuardrail = serverOnly(\n  \"configureGuardrail()\",\n  \"Configuration is applied by withGuardrail() in your root layout.\",\n);\nexport const GRepeater = serverOnly(\n  \"<GRepeater>\",\n  \"Render it in a Server Component and pass it into this one as children or a prop.\",\n);\nexport const listRepeaterItems = serverOnly(\n  \"listRepeaterItems()\",\n  \"Read repeater items in a Server Component and pass them down.\",\n);\nexport const getRepeaterItemBySlug = serverOnly(\n  \"getRepeaterItemBySlug()\",\n  \"Resolve the item in a Server Component (your [slug]/page.tsx) and pass it down.\",\n);\nexport const getFieldValue = serverOnly(\n  \"getFieldValue()\",\n  \"Read the value in a Server Component and pass it down as a prop.\",\n);\nexport const isAdmin = serverOnly(\n  \"isAdmin()\",\n  \"Call it inside your own Server Action to authorize it; in a Client Component, read useGRail().role to decide what to show.\",\n);\nexport const isEditor = serverOnly(\n  \"isEditor()\",\n  \"Call it inside your own Server Action to authorize it; in a Client Component, read useGRail().role to decide what to show.\",\n);\nexport const canEdit = serverOnly(\n  \"canEdit()\",\n  \"Call it in a Server Component; in a Client Component, read `canEdit` from useGRail().\",\n);\nexport const resendInvite = serverOnly(\n  \"resendInvite()\",\n  \"Pass it as onInvite in withGuardrail(), which runs in your root layout.\",\n);\nexport const resendEmails = serverOnly(\n  \"resendEmails()\",\n  \"Spread it into withGuardrail(), which runs in your root layout.\",\n);\nexport const consoleEmails = serverOnly(\n  \"consoleEmails()\",\n  \"Spread it into withGuardrail(), which runs in your root layout.\",\n);\n\nexport type { GRepeaterProps, RepeaterItemProps } from \"./react/Repeater\";\nexport type {\n  ResendInviteOptions,\n  ResendEmailOptions,\n  ResendInviteContent,\n  ResendInviteTemplateEvent,\n  ResendResetTemplateEvent,\n} from \"./email/resend\";\nexport type {\n  GRState,\n  GRRole,\n  GRMember,\n  GRViewer,\n  GRAsset,\n  GRRepeaterItem,\n  ActionState,\n  SetPasswordState,\n  OverrideRow,\n  OverrideValue,\n  OverrideType,\n  PolymorphicProps,\n  HTMLKeys,\n} from \"./core/types\";\nexport type {\n  GRConfig,\n  GRPrefetch,\n  GRMembershipAdapter,\n  GRInviteEvent,\n  GRStorageAdapter,\n  GRUploadTarget,\n  GRRepeaterAdapter,\n  GRDBAdapter,\n  GRAuthAdapter,\n  GRSession,\n  GRStorageRow,\n  AuthResult,\n  AuthRedirectParams,\n  GRPasswordResetEvent,\n} from \"./core/adapter-types\";\n"],"mappings":"AASA,SAAS,aAAa;AACtB,SAAS,gBAAgB;AAEzB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AASP,SAAS,WAAW,MAAc,MAAc;AAC9C,SAAO,IAAI,UAA4B;AACrC,UAAM,IAAI;AAAA,MACR,cAAc,IAAI,sCAAsC,IAAI;AAAA,IAG9D;AAAA,EACF;AACF;AAEO,MAAM,gBAAgB;AAAA,EAC3B;AAAA,EACA;AACF;AACO,MAAM,qBAAqB;AAAA,EAChC;AAAA,EACA;AACF;AACO,MAAM,YAAY;AAAA,EACvB;AAAA,EACA;AACF;AACO,MAAM,oBAAoB;AAAA,EAC/B;AAAA,EACA;AACF;AACO,MAAM,wBAAwB;AAAA,EACnC;AAAA,EACA;AACF;AACO,MAAM,gBAAgB;AAAA,EAC3B;AAAA,EACA;AACF;AACO,MAAM,UAAU;AAAA,EACrB;AAAA,EACA;AACF;AACO,MAAM,WAAW;AAAA,EACtB;AAAA,EACA;AACF;AACO,MAAM,UAAU;AAAA,EACrB;AAAA,EACA;AACF;AACO,MAAM,eAAe;AAAA,EAC1B;AAAA,EACA;AACF;AACO,MAAM,eAAe;AAAA,EAC1B;AAAA,EACA;AACF;AACO,MAAM,gBAAgB;AAAA,EAC3B;AAAA,EACA;AACF;","names":[]}
+{"version":3,"sources":["../src/index.client.ts"],"sourcesContent":["// Client-graph entry. `import ... from \"@guard-rail/core\"` resolves here from a\n// Client Component (see \"exports\" in package.json) and to ./index from a\n// Server Component, so an app uses one import path everywhere.\n//\n// Nothing server-only may be imported here — this is bundled for the browser.\n// Server Actions are fine: a \"use server\" module is replaced by references in\n// the client bundle, which is what lets an app build its own team/repeater UI\n// in a Client Component.\n\nexport { GRail } from \"./react/GRail/universal\";\nexport { useGRail } from \"./react/Provider\";\n\nexport {\n  listTeam,\n  inviteMember,\n  updateMemberRole,\n  removeMember,\n  createAssetUpload,\n  listAssets,\n  setPasswordAction,\n  skipSetPasswordAction,\n  forgotPasswordAction,\n  sendPasswordResetAction,\n  setFieldValue,\n} from \"./server/actions\";\nexport {\n  addRepeaterItem,\n  removeRepeaterItem,\n  reorderRepeaterItems,\n} from \"./server/repeaterActions\";\n\n/**\n * Stand-ins for the server-only exports, so importing one from a Client\n * Component fails with an explanation instead of an undefined-is-not-a-function\n * deep in a render. Also what a tool that doesn't set the \"react-server\"\n * condition (a test runner, a plain Node script) gets from the package root —\n * `@guard-rail/core/server` is the explicit path to the real ones there.\n */\nfunction serverOnly(name: string, hint: string) {\n  return (..._args: unknown[]): never => {\n    throw new Error(\n      `Guardrail: ${name} only works in a Server Component. ${hint} ` +\n        `(If this isn't a Client Component, your tooling may not set the ` +\n        `\"react-server\" condition — import from \"@guard-rail/core/server\" instead.)`,\n    );\n  };\n}\n\nexport const withGuardrail = serverOnly(\n  \"withGuardrail()\",\n  \"Call it in your root layout, which is a Server Component.\",\n);\nexport const configureGuardrail = serverOnly(\n  \"configureGuardrail()\",\n  \"Configuration is applied by withGuardrail() in your root layout.\",\n);\nexport const GRepeater = serverOnly(\n  \"<GRepeater>\",\n  \"Render it in a Server Component and pass it into this one as children or a prop.\",\n);\nexport const listRepeaterItems = serverOnly(\n  \"listRepeaterItems()\",\n  \"Read repeater items in a Server Component and pass them down.\",\n);\nexport const getRepeaterItemBySlug = serverOnly(\n  \"getRepeaterItemBySlug()\",\n  \"Resolve the item in a Server Component (your [slug]/page.tsx) and pass it down.\",\n);\nexport const getFieldValue = serverOnly(\n  \"getFieldValue()\",\n  \"Read the value in a Server Component and pass it down as a prop.\",\n);\nexport const isAdmin = serverOnly(\n  \"isAdmin()\",\n  \"Call it inside your own Server Action to authorize it; in a Client Component, read useGRail().role to decide what to show.\",\n);\nexport const isEditor = serverOnly(\n  \"isEditor()\",\n  \"Call it inside your own Server Action to authorize it; in a Client Component, read useGRail().role to decide what to show.\",\n);\nexport const canEdit = serverOnly(\n  \"canEdit()\",\n  \"Call it in a Server Component; in a Client Component, read `canEdit` from useGRail().\",\n);\nexport const resendInvite = serverOnly(\n  \"resendInvite()\",\n  \"Pass it as onInvite in withGuardrail(), which runs in your root layout.\",\n);\nexport const resendEmails = serverOnly(\n  \"resendEmails()\",\n  \"Spread it into withGuardrail(), which runs in your root layout.\",\n);\nexport const consoleEmails = serverOnly(\n  \"consoleEmails()\",\n  \"Spread it into withGuardrail(), which runs in your root layout.\",\n);\n\nexport type { GRepeaterProps, RepeaterItemProps } from \"./react/Repeater\";\nexport type {\n  ResendInviteOptions,\n  ResendEmailOptions,\n  ResendInviteContent,\n  ResendInviteTemplateEvent,\n  ResendResetTemplateEvent,\n} from \"./email/resend\";\nexport type {\n  GRState,\n  GRRole,\n  GRMember,\n  GRViewer,\n  GRAsset,\n  GRRepeaterItem,\n  ActionState,\n  SetPasswordState,\n  OverrideRow,\n  OverrideValue,\n  OverrideType,\n  PolymorphicProps,\n  HTMLKeys,\n} from \"./core/types\";\nexport type {\n  GRConfig,\n  GRPrefetch,\n  GRMembershipAdapter,\n  GRInviteEvent,\n  GRStorageAdapter,\n  GRUploadTarget,\n  GRRepeaterAdapter,\n  GRDBAdapter,\n  GRAuthAdapter,\n  GRSession,\n  GRStorageRow,\n  AuthResult,\n  AuthRedirectParams,\n  GRPasswordResetEvent,\n  GRRateLimiter,\n  GRRateLimitHit,\n  GRRateLimitName,\n} from \"./core/adapter-types\";\n"],"mappings":"AASA,SAAS,aAAa;AACtB,SAAS,gBAAgB;AAEzB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AASP,SAAS,WAAW,MAAc,MAAc;AAC9C,SAAO,IAAI,UAA4B;AACrC,UAAM,IAAI;AAAA,MACR,cAAc,IAAI,sCAAsC,IAAI;AAAA,IAG9D;AAAA,EACF;AACF;AAEO,MAAM,gBAAgB;AAAA,EAC3B;AAAA,EACA;AACF;AACO,MAAM,qBAAqB;AAAA,EAChC;AAAA,EACA;AACF;AACO,MAAM,YAAY;AAAA,EACvB;AAAA,EACA;AACF;AACO,MAAM,oBAAoB;AAAA,EAC/B;AAAA,EACA;AACF;AACO,MAAM,wBAAwB;AAAA,EACnC;AAAA,EACA;AACF;AACO,MAAM,gBAAgB;AAAA,EAC3B;AAAA,EACA;AACF;AACO,MAAM,UAAU;AAAA,EACrB;AAAA,EACA;AACF;AACO,MAAM,WAAW;AAAA,EACtB;AAAA,EACA;AACF;AACO,MAAM,UAAU;AAAA,EACrB;AAAA,EACA;AACF;AACO,MAAM,eAAe;AAAA,EAC1B;AAAA,EACA;AACF;AACO,MAAM,eAAe;AAAA,EAC1B;AAAA,EACA;AACF;AACO,MAAM,gBAAgB;AAAA,EAC3B;AAAA,EACA;AACF;","names":[]}

package/dist/index.d.ts

@@ -11,6 +11,6 @@ export { consoleEmails } from './email/console.js';
 export { addRepeaterItem, removeRepeaterItem, reorderRepeaterItems } from './server/repeaterActions.js';
 export { useGRail } from './react/Provider.js';
 export { ActionState, GRAsset, GRMember, GRRepeaterItem, GRRole, GRState, GRViewer, HTMLKeys, OverrideRow, OverrideType, OverrideValue, PolymorphicProps, SetPasswordState } from './core/types.js';
-export { AuthRedirectParams, AuthResult, GRAuthAdapter, GRConfig, GRDBAdapter, GRInviteEvent, GRMembershipAdapter, GRPasswordResetEvent, GRPrefetch, GRRepeaterAdapter, GRSession, GRStorageAdapter, GRStorageRow, GRUploadTarget } from './core/adapter-types.js';
+export { AuthRedirectParams, AuthResult, GRAuthAdapter, GRConfig, GRDBAdapter, GRInviteEvent, GRMembershipAdapter, GRPasswordResetEvent, GRPrefetch, GRRateLimitHit, GRRateLimitName, GRRateLimiter, GRRepeaterAdapter, GRSession, GRStorageAdapter, GRStorageRow, GRUploadTarget } from './core/adapter-types.js';
 import 'react/jsx-runtime';
 import 'react';

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"sourcesContent":["// Server-safe entry. Client components are reached through the files that\n// carry their own \"use client\" directive, so importing this from a Server\n// Component does not pull the editor into the client bundle.\nexport { withGuardrail } from \"./server/wrapper\";\n\n// Team management and the set-password step, exported so an app can build\n// its own UI instead of using the bundled drawer / sign-in bar.\nexport {\n  listTeam,\n  inviteMember,\n  updateMemberRole,\n  removeMember,\n  createAssetUpload,\n  listAssets,\n  setPasswordAction,\n  skipSetPasswordAction,\n  forgotPasswordAction,\n  sendPasswordResetAction,\n  setFieldValue,\n} from \"./server/actions\";\nexport { GRail } from \"./react/GRail\";\nexport { GRepeater } from \"./react/Repeater\";\nexport type { GRepeaterProps, RepeaterItemProps } from \"./react/Repeater\";\nexport { configureGuardrail } from \"./core/config\";\nexport {\n  listRepeaterItems,\n  getRepeaterItemBySlug,\n} from \"./server/repeaterData\";\nexport { getFieldValue } from \"./server/fieldData\";\n// Role / edit-mode checks for a custom admin UI and the Server Actions behind\n// it. Plain server functions, not actions — see access.ts for why.\nexport { isAdmin, isEditor, canEdit } from \"./server/access\";\n// Invite delivery through Resend, as an onInvite handler — see email/resend.ts.\nexport { resendInvite, resendEmails } from \"./email/resend\";\nexport { consoleEmails } from \"./email/console\";\nexport type {\n  ResendInviteOptions,\n  ResendEmailOptions,\n  ResendInviteContent,\n  ResendInviteTemplateEvent,\n  ResendResetTemplateEvent,\n} from \"./email/resend\";\n// Mutations, exported so an app can build its own add/remove/reorder UI\n// instead of the bundled chrome — same rationale as the team actions above.\nexport {\n  addRepeaterItem,\n  removeRepeaterItem,\n  reorderRepeaterItems,\n} from \"./server/repeaterActions\";\nexport { useGRail } from \"./react/Provider\";\n\nexport type {\n  GRState,\n  GRRole,\n  GRMember,\n  GRViewer,\n  GRAsset,\n  GRRepeaterItem,\n  ActionState,\n  SetPasswordState,\n  OverrideRow,\n  OverrideValue,\n  OverrideType,\n  PolymorphicProps,\n  HTMLKeys,\n} from \"./core/types\";\nexport type {\n  GRConfig,\n  GRPrefetch,\n  GRMembershipAdapter,\n  GRInviteEvent,\n  GRStorageAdapter,\n  GRUploadTarget,\n  GRRepeaterAdapter,\n  GRDBAdapter,\n  GRAuthAdapter,\n  GRSession,\n  GRStorageRow,\n  AuthResult,\n  AuthRedirectParams,\n  GRPasswordResetEvent,\n} from \"./core/adapter-types\";\n"],"mappings":"AAGA,SAAS,qBAAqB;AAI9B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,aAAa;AACtB,SAAS,iBAAiB;AAE1B,SAAS,0BAA0B;AACnC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,qBAAqB;AAG9B,SAAS,SAAS,UAAU,eAAe;AAE3C,SAAS,cAAc,oBAAoB;AAC3C,SAAS,qBAAqB;AAU9B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,gBAAgB;","names":[]}
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["// Server-safe entry. Client components are reached through the files that\n// carry their own \"use client\" directive, so importing this from a Server\n// Component does not pull the editor into the client bundle.\nexport { withGuardrail } from \"./server/wrapper\";\n\n// Team management and the set-password step, exported so an app can build\n// its own UI instead of using the bundled drawer / sign-in bar.\nexport {\n  listTeam,\n  inviteMember,\n  updateMemberRole,\n  removeMember,\n  createAssetUpload,\n  listAssets,\n  setPasswordAction,\n  skipSetPasswordAction,\n  forgotPasswordAction,\n  sendPasswordResetAction,\n  setFieldValue,\n} from \"./server/actions\";\nexport { GRail } from \"./react/GRail\";\nexport { GRepeater } from \"./react/Repeater\";\nexport type { GRepeaterProps, RepeaterItemProps } from \"./react/Repeater\";\nexport { configureGuardrail } from \"./core/config\";\nexport {\n  listRepeaterItems,\n  getRepeaterItemBySlug,\n} from \"./server/repeaterData\";\nexport { getFieldValue } from \"./server/fieldData\";\n// Role / edit-mode checks for a custom admin UI and the Server Actions behind\n// it. Plain server functions, not actions — see access.ts for why.\nexport { isAdmin, isEditor, canEdit } from \"./server/access\";\n// Invite delivery through Resend, as an onInvite handler — see email/resend.ts.\nexport { resendInvite, resendEmails } from \"./email/resend\";\nexport { consoleEmails } from \"./email/console\";\nexport type {\n  ResendInviteOptions,\n  ResendEmailOptions,\n  ResendInviteContent,\n  ResendInviteTemplateEvent,\n  ResendResetTemplateEvent,\n} from \"./email/resend\";\n// Mutations, exported so an app can build its own add/remove/reorder UI\n// instead of the bundled chrome — same rationale as the team actions above.\nexport {\n  addRepeaterItem,\n  removeRepeaterItem,\n  reorderRepeaterItems,\n} from \"./server/repeaterActions\";\nexport { useGRail } from \"./react/Provider\";\n\nexport type {\n  GRState,\n  GRRole,\n  GRMember,\n  GRViewer,\n  GRAsset,\n  GRRepeaterItem,\n  ActionState,\n  SetPasswordState,\n  OverrideRow,\n  OverrideValue,\n  OverrideType,\n  PolymorphicProps,\n  HTMLKeys,\n} from \"./core/types\";\nexport type {\n  GRConfig,\n  GRPrefetch,\n  GRMembershipAdapter,\n  GRInviteEvent,\n  GRStorageAdapter,\n  GRUploadTarget,\n  GRRepeaterAdapter,\n  GRDBAdapter,\n  GRAuthAdapter,\n  GRSession,\n  GRStorageRow,\n  AuthResult,\n  AuthRedirectParams,\n  GRPasswordResetEvent,\n  GRRateLimiter,\n  GRRateLimitHit,\n  GRRateLimitName,\n} from \"./core/adapter-types\";\n"],"mappings":"AAGA,SAAS,qBAAqB;AAI9B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,aAAa;AACtB,SAAS,iBAAiB;AAE1B,SAAS,0BAA0B;AACnC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,qBAAqB;AAG9B,SAAS,SAAS,UAAU,eAAe;AAE3C,SAAS,cAAc,oBAAoB;AAC3C,SAAS,qBAAqB;AAU9B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,gBAAgB;","names":[]}

package/dist/react/AuthRedirectSync.js

@@ -6,29 +6,35 @@ function AuthRedirectSync() {
   const searchParams = useSearchParams();
   const handled = useRef(false);
   useEffect(() => {
-    if (handled.current) return;
-    const rawHash = window.location.hash.startsWith("#") ? window.location.hash.slice(1) : window.location.hash;
-    const hasHashTokens = /(?:^|&)access_token=/.test(rawHash);
-    const code = searchParams.get("code") ?? void 0;
-    const tokenHash = searchParams.get("token_hash") ?? void 0;
-    const type = searchParams.get("type") ?? void 0;
-    if (!hasHashTokens && !code && !tokenHash) return;
-    handled.current = true;
-    const params = {
-      ...hasHashTokens ? { hash: rawHash } : {},
-      ...code ? { code } : {},
-      ...tokenHash ? { tokenHash } : {},
-      ...type ? { type } : {}
+    const check = () => {
+      if (handled.current) return;
+      const rawHash = window.location.hash.startsWith("#") ? window.location.hash.slice(1) : window.location.hash;
+      const hasHashTokens = /(?:^|&)access_token=/.test(rawHash);
+      const hashParams = new URLSearchParams(rawHash);
+      const code = searchParams.get("code") ?? void 0;
+      const tokenHash = hashParams.get("token_hash") ?? searchParams.get("token_hash") ?? void 0;
+      const type = hashParams.get("type") ?? searchParams.get("type") ?? void 0;
+      if (!hasHashTokens && !code && !tokenHash) return;
+      handled.current = true;
+      const params = {
+        ...hasHashTokens ? { hash: rawHash } : {},
+        ...code ? { code } : {},
+        ...tokenHash ? { tokenHash } : {},
+        ...type ? { type } : {}
+      };
+      completeAuthRedirectAction(params).then((res) => {
+        const url = new URL(window.location.href);
+        url.hash = "";
+        url.searchParams.delete("code");
+        url.searchParams.delete("token_hash");
+        url.searchParams.delete("type");
+        window.history.replaceState(null, "", url.toString());
+        window.location.reload();
+      });
     };
-    completeAuthRedirectAction(params).then((res) => {
-      const url = new URL(window.location.href);
-      url.hash = "";
-      url.searchParams.delete("code");
-      url.searchParams.delete("token_hash");
-      url.searchParams.delete("type");
-      window.history.replaceState(null, "", url.toString());
-      window.location.reload();
-    });
+    check();
+    window.addEventListener("hashchange", check);
+    return () => window.removeEventListener("hashchange", check);
   }, [searchParams]);
   return null;
 }

package/dist/react/AuthRedirectSync.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/react/AuthRedirectSync.tsx"],"sourcesContent":["\"use client\";\n\nimport { useEffect, useRef } from \"react\";\nimport { useSearchParams } from \"next/navigation\";\nimport { completeAuthRedirectAction } from \"../server/actions\";\n\n/**\n * Notices a session that arrived via a redirect link — an invite, magic\n * link, or password-recovery email — and hands whatever it found to\n * completeAuthRedirectAction, which defers to the auth adapter's own\n * completeAuthRedirect for the actual exchange. Deliberately generic: this\n * file has no idea what a Supabase token looks like, only that a hash\n * carrying `access_token=` or a `code`/`token_hash` query param might be one.\n *\n * Has to run client-side and unconditionally (not gated behind edit mode,\n * unlike EditSyncer) — an invite link redirects to the site's plain URL, not\n * necessarily one with ?edit=true, and hash-based tokens never reach the\n * server on their own; only the browser ever sees window.location.hash.\n *\n * Mirrors the community-documented pattern for this exact problem, just\n * generalized across whichever redirect style a provider's own email\n * templates happen to produce, rather than requiring one specific route.\n */\nexport function AuthRedirectSync() {\n  const searchParams = useSearchParams();\n  const handled = useRef(false);\n\n  useEffect(() => {\n    if (handled.current) return;\n\n    const rawHash = window.location.hash.startsWith(\"#\")\n      ? window.location.hash.slice(1)\n      : window.location.hash;\n    // The one thing worth checking before assuming this hash is ours: every\n    // normal page load has an empty hash, and this runs on all of them.\n    const hasHashTokens = /(?:^|&)access_token=/.test(rawHash);\n\n    const code = searchParams.get(\"code\") ?? undefined;\n    const tokenHash = searchParams.get(\"token_hash\") ?? undefined;\n    const type = searchParams.get(\"type\") ?? undefined;\n\n    if (!hasHashTokens && !code && !tokenHash) return;\n    handled.current = true;\n\n    const params = {\n      ...(hasHashTokens ? { hash: rawHash } : {}),\n      ...(code ? { code } : {}),\n      ...(tokenHash ? { tokenHash } : {}),\n      ...(type ? { type } : {}),\n    };\n\n    completeAuthRedirectAction(params).then((res) => {\n      // Stripped either way — a token that failed to exchange (already used,\n      // expired) has no business lingering in the address bar or history\n      // either.\n      const url = new URL(window.location.href);\n      url.hash = \"\";\n      url.searchParams.delete(\"code\");\n      url.searchParams.delete(\"token_hash\");\n      url.searchParams.delete(\"type\");\n      window.history.replaceState(null, \"\", url.toString());\n\n      // A full reload, not router.refresh(): the session was just set via\n      // cookies a Server Action wrote, and the current page's React tree\n      // (including this component) was built from the pre-session render —\n      // simplest to just start over. On failure the action set a cookie\n      // explaining it, and a reload is what shows that, rather than leaving the\n      // person on a page where nothing visibly happened.\n      window.location.reload();\n    });\n  }, [searchParams]);\n\n  return null;\n}\n"],"mappings":";AAEA,SAAS,WAAW,cAAc;AAClC,SAAS,uBAAuB;AAChC,SAAS,kCAAkC;AAmBpC,SAAS,mBAAmB;AACjC,QAAM,eAAe,gBAAgB;AACrC,QAAM,UAAU,OAAO,KAAK;AAE5B,YAAU,MAAM;AACd,QAAI,QAAQ,QAAS;AAErB,UAAM,UAAU,OAAO,SAAS,KAAK,WAAW,GAAG,IAC/C,OAAO,SAAS,KAAK,MAAM,CAAC,IAC5B,OAAO,SAAS;AAGpB,UAAM,gBAAgB,uBAAuB,KAAK,OAAO;AAEzD,UAAM,OAAO,aAAa,IAAI,MAAM,KAAK;AACzC,UAAM,YAAY,aAAa,IAAI,YAAY,KAAK;AACpD,UAAM,OAAO,aAAa,IAAI,MAAM,KAAK;AAEzC,QAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,UAAW;AAC3C,YAAQ,UAAU;AAElB,UAAM,SAAS;AAAA,MACb,GAAI,gBAAgB,EAAE,MAAM,QAAQ,IAAI,CAAC;AAAA,MACzC,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;AAAA,MACvB,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;AAAA,MACjC,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;AAAA,IACzB;AAEA,+BAA2B,MAAM,EAAE,KAAK,CAAC,QAAQ;AAI/C,YAAM,MAAM,IAAI,IAAI,OAAO,SAAS,IAAI;AACxC,UAAI,OAAO;AACX,UAAI,aAAa,OAAO,MAAM;AAC9B,UAAI,aAAa,OAAO,YAAY;AACpC,UAAI,aAAa,OAAO,MAAM;AAC9B,aAAO,QAAQ,aAAa,MAAM,IAAI,IAAI,SAAS,CAAC;AAQpD,aAAO,SAAS,OAAO;AAAA,IACzB,CAAC;AAAA,EACH,GAAG,CAAC,YAAY,CAAC;AAEjB,SAAO;AACT;","names":[]}
+{"version":3,"sources":["../../src/react/AuthRedirectSync.tsx"],"sourcesContent":["\"use client\";\n\nimport { useEffect, useRef } from \"react\";\nimport { useSearchParams } from \"next/navigation\";\nimport { completeAuthRedirectAction } from \"../server/actions\";\n\n/**\n * Notices a session that arrived via a redirect link — an invite, magic\n * link, or password-recovery email — and hands whatever it found to\n * completeAuthRedirectAction, which defers to the auth adapter's own\n * completeAuthRedirect for the actual exchange. Deliberately generic: this\n * file has no idea what a Supabase token looks like, only that a hash\n * carrying `access_token=` or a `code`/`token_hash` query param might be one.\n *\n * Has to run client-side and unconditionally (not gated behind edit mode,\n * unlike EditSyncer) — an invite link redirects to the site's plain URL, not\n * necessarily one with ?edit=true, and hash-based tokens never reach the\n * server on their own; only the browser ever sees window.location.hash.\n *\n * Mirrors the community-documented pattern for this exact problem, just\n * generalized across whichever redirect style a provider's own email\n * templates happen to produce, rather than requiring one specific route.\n */\nexport function AuthRedirectSync() {\n  const searchParams = useSearchParams();\n  const handled = useRef(false);\n\n  useEffect(() => {\n    const check = () => {\n      if (handled.current) return;\n\n      const rawHash = window.location.hash.startsWith(\"#\")\n        ? window.location.hash.slice(1)\n        : window.location.hash;\n      // The one thing worth checking before assuming this hash is ours: every\n      // normal page load has an empty hash, and this runs on all of them.\n      const hasHashTokens = /(?:^|&)access_token=/.test(rawHash);\n\n      // Links Guardrail mints carry token_hash/type in the fragment; the query\n      // string is still read for links emailed before that change.\n      const hashParams = new URLSearchParams(rawHash);\n      const code = searchParams.get(\"code\") ?? undefined;\n      const tokenHash =\n        hashParams.get(\"token_hash\") ?? searchParams.get(\"token_hash\") ?? undefined;\n      const type = hashParams.get(\"type\") ?? searchParams.get(\"type\") ?? undefined;\n\n      if (!hasHashTokens && !code && !tokenHash) return;\n      handled.current = true;\n\n      const params = {\n        ...(hasHashTokens ? { hash: rawHash } : {}),\n        ...(code ? { code } : {}),\n        ...(tokenHash ? { tokenHash } : {}),\n        ...(type ? { type } : {}),\n      };\n\n      completeAuthRedirectAction(params).then((res) => {\n        // Stripped either way — a token that failed to exchange (already used,\n        // expired) has no business lingering in the address bar or history\n        // either.\n        const url = new URL(window.location.href);\n        url.hash = \"\";\n        url.searchParams.delete(\"code\");\n        url.searchParams.delete(\"token_hash\");\n        url.searchParams.delete(\"type\");\n        window.history.replaceState(null, \"\", url.toString());\n\n        // A full reload, not router.refresh(): the session was just set via\n        // cookies a Server Action wrote, and the current page's React tree\n        // (including this component) was built from the pre-session render —\n        // simplest to just start over. On failure the action set a cookie\n        // explaining it, and a reload is what shows that, rather than leaving the\n        // person on a page where nothing visibly happened.\n        window.location.reload();\n      });\n    };\n\n    check();\n    // A link pasted into a tab that already has the site open changes only the\n    // fragment, which is not a page load.\n    window.addEventListener(\"hashchange\", check);\n    return () => window.removeEventListener(\"hashchange\", check);\n  }, [searchParams]);\n\n  return null;\n}\n"],"mappings":";AAEA,SAAS,WAAW,cAAc;AAClC,SAAS,uBAAuB;AAChC,SAAS,kCAAkC;AAmBpC,SAAS,mBAAmB;AACjC,QAAM,eAAe,gBAAgB;AACrC,QAAM,UAAU,OAAO,KAAK;AAE5B,YAAU,MAAM;AACd,UAAM,QAAQ,MAAM;AAClB,UAAI,QAAQ,QAAS;AAErB,YAAM,UAAU,OAAO,SAAS,KAAK,WAAW,GAAG,IAC/C,OAAO,SAAS,KAAK,MAAM,CAAC,IAC5B,OAAO,SAAS;AAGpB,YAAM,gBAAgB,uBAAuB,KAAK,OAAO;AAIzD,YAAM,aAAa,IAAI,gBAAgB,OAAO;AAC9C,YAAM,OAAO,aAAa,IAAI,MAAM,KAAK;AACzC,YAAM,YACJ,WAAW,IAAI,YAAY,KAAK,aAAa,IAAI,YAAY,KAAK;AACpE,YAAM,OAAO,WAAW,IAAI,MAAM,KAAK,aAAa,IAAI,MAAM,KAAK;AAEnE,UAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,UAAW;AAC3C,cAAQ,UAAU;AAElB,YAAM,SAAS;AAAA,QACb,GAAI,gBAAgB,EAAE,MAAM,QAAQ,IAAI,CAAC;AAAA,QACzC,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;AAAA,QACvB,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;AAAA,QACjC,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;AAAA,MACzB;AAEA,iCAA2B,MAAM,EAAE,KAAK,CAAC,QAAQ;AAI/C,cAAM,MAAM,IAAI,IAAI,OAAO,SAAS,IAAI;AACxC,YAAI,OAAO;AACX,YAAI,aAAa,OAAO,MAAM;AAC9B,YAAI,aAAa,OAAO,YAAY;AACpC,YAAI,aAAa,OAAO,MAAM;AAC9B,eAAO,QAAQ,aAAa,MAAM,IAAI,IAAI,SAAS,CAAC;AAQpD,eAAO,SAAS,OAAO;AAAA,MACzB,CAAC;AAAA,IACH;AAEA,UAAM;AAGN,WAAO,iBAAiB,cAAc,KAAK;AAC3C,WAAO,MAAM,OAAO,oBAAoB,cAAc,KAAK;AAAA,EAC7D,GAAG,CAAC,YAAY,CAAC;AAEjB,SAAO;AACT;","names":[]}

package/dist/react/GRail/render.js

@@ -2,6 +2,7 @@ import { jsx } from "react/jsx-runtime";
 import React from "react";
 import NextImage from "next/image";
 import NextLink from "next/link";
+import { safeHref, safeImageSrc } from "../../core/validate";
 function intrinsicSize(override, width, height) {
   const { width: nw, height: nh } = override;
   if (nw && nh) {
@@ -22,7 +23,7 @@ function GRailRender({ as, override, children, ref, ...rest }) {
       type: _overrideType,
       ...imgRest
     } = rest;
-    const src = override.src || propSrc || "";
+    const src = safeImageSrc(override.src) || propSrc || "";
     const alt = override.alt ?? propAlt ?? "";
     if (!src) return null;
     const imgRef = ref;
@@ -53,7 +54,7 @@ function GRailRender({ as, override, children, ref, ...rest }) {
       {
         ref,
         ...linkRest,
-        href: override.href || propHref || "#",
+        href: safeHref(override.href) || propHref || "#",
         children: override.text || children
       }
     );

package/dist/react/GRail/render.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/react/GRail/render.tsx"],"sourcesContent":["import React from \"react\";\nimport NextImage from \"next/image\";\nimport NextLink from \"next/link\";\nimport type { HTMLKeys, OverrideValue } from \"../../core/types\";\n\ninterface RenderProps {\n  as?: HTMLKeys;\n  override: OverrideValue;\n  children?: React.ReactNode;\n  /** Forwarded to the rendered element so the editor can measure it. */\n  ref?: React.Ref<HTMLElement>;\n  [key: string]: unknown;\n}\n\n/**\n * The developer's width/height set the layout; the image's own proportions set\n * the shape. Keeping the developer's width and deriving height from the stored\n * natural size means a differently shaped replacement neither breaks the\n * layout nor gets stretched.\n */\nfunction intrinsicSize(override: OverrideValue, width?: number, height?: number) {\n  const { width: nw, height: nh } = override;\n  if (nw && nh) {\n    if (width) return { width, height: Math.round((width * nh) / nw) };\n    if (height) return { width: Math.round((height * nw) / nh), height };\n    return { width: nw, height: nh };\n  }\n  return { width: width || 500, height: height || 500 };\n}\n\n/**\n * Renders a resolved value as plain markup. Shared by the anonymous SSR path\n * and the editor, so what an editor sees matches what ships.\n *\n * Resolved props are applied *after* the spread. The developer's original\n * src/href are still in `rest`, and spreading them last silently masked every\n * saved image and link override.\n */\nexport function GRailRender({ as, override, children, ref, ...rest }: RenderProps) {\n  if (override.type === \"image\") {\n    const {\n      width,\n      height,\n      fill,\n      src: propSrc,\n      alt: propAlt,\n      type: _overrideType,\n      ...imgRest\n    } = rest as Record<string, any>;\n    const src = override.src || propSrc || \"\";\n    const alt = override.alt ?? propAlt ?? \"\";\n    if (!src) return null;\n\n    const imgRef = ref as React.Ref<HTMLImageElement>;\n    if (fill) {\n      return <NextImage ref={imgRef} {...imgRest} src={src} alt={alt} fill />;\n    }\n\n    const size = intrinsicSize(\n      override,\n      Number(width) || undefined,\n      Number(height) || undefined,\n    );\n    return (\n      <NextImage\n        ref={imgRef}\n        {...imgRest}\n        src={src}\n        alt={alt}\n        width={size.width}\n        height={size.height}\n      />\n    );\n  }\n\n  if (override.type === \"link\") {\n    const { href: propHref, type: _overrideType, ...linkRest } =\n      rest as Record<string, any>;\n    return (\n      <NextLink\n        ref={ref as React.Ref<HTMLAnchorElement>}\n        {...linkRest}\n        href={override.href || propHref || \"#\"}\n      >\n        {override.text || children}\n      </NextLink>\n    );\n  }\n\n  const Component = (as || \"span\") as React.ElementType;\n  return (\n    <Component ref={ref} {...rest}>\n      {override.text || children}\n    </Component>\n  );\n}\n"],"mappings":"AAuDa;AAvDb,OAAO,WAAW;AAClB,OAAO,eAAe;AACtB,OAAO,cAAc;AAkBrB,SAAS,cAAc,UAAyB,OAAgB,QAAiB;AAC/E,QAAM,EAAE,OAAO,IAAI,QAAQ,GAAG,IAAI;AAClC,MAAI,MAAM,IAAI;AACZ,QAAI,MAAO,QAAO,EAAE,OAAO,QAAQ,KAAK,MAAO,QAAQ,KAAM,EAAE,EAAE;AACjE,QAAI,OAAQ,QAAO,EAAE,OAAO,KAAK,MAAO,SAAS,KAAM,EAAE,GAAG,OAAO;AACnE,WAAO,EAAE,OAAO,IAAI,QAAQ,GAAG;AAAA,EACjC;AACA,SAAO,EAAE,OAAO,SAAS,KAAK,QAAQ,UAAU,IAAI;AACtD;AAUO,SAAS,YAAY,EAAE,IAAI,UAAU,UAAU,KAAK,GAAG,KAAK,GAAgB;AACjF,MAAI,SAAS,SAAS,SAAS;AAC7B,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA,KAAK;AAAA,MACL,KAAK;AAAA,MACL,MAAM;AAAA,MACN,GAAG;AAAA,IACL,IAAI;AACJ,UAAM,MAAM,SAAS,OAAO,WAAW;AACvC,UAAM,MAAM,SAAS,OAAO,WAAW;AACvC,QAAI,CAAC,IAAK,QAAO;AAEjB,UAAM,SAAS;AACf,QAAI,MAAM;AACR,aAAO,oBAAC,aAAU,KAAK,QAAS,GAAG,SAAS,KAAU,KAAU,MAAI,MAAC;AAAA,IACvE;AAEA,UAAM,OAAO;AAAA,MACX;AAAA,MACA,OAAO,KAAK,KAAK;AAAA,MACjB,OAAO,MAAM,KAAK;AAAA,IACpB;AACA,WACE;AAAA,MAAC;AAAA;AAAA,QACC,KAAK;AAAA,QACJ,GAAG;AAAA,QACJ;AAAA,QACA;AAAA,QACA,OAAO,KAAK;AAAA,QACZ,QAAQ,KAAK;AAAA;AAAA,IACf;AAAA,EAEJ;AAEA,MAAI,SAAS,SAAS,QAAQ;AAC5B,UAAM,EAAE,MAAM,UAAU,MAAM,eAAe,GAAG,SAAS,IACvD;AACF,WACE;AAAA,MAAC;AAAA;AAAA,QACC;AAAA,QACC,GAAG;AAAA,QACJ,MAAM,SAAS,QAAQ,YAAY;AAAA,QAElC,mBAAS,QAAQ;AAAA;AAAA,IACpB;AAAA,EAEJ;AAEA,QAAM,YAAa,MAAM;AACzB,SACE,oBAAC,aAAU,KAAW,GAAG,MACtB,mBAAS,QAAQ,UACpB;AAEJ;","names":[]}
+{"version":3,"sources":["../../../src/react/GRail/render.tsx"],"sourcesContent":["import React from \"react\";\nimport NextImage from \"next/image\";\nimport NextLink from \"next/link\";\nimport type { HTMLKeys, OverrideValue } from \"../../core/types\";\nimport { safeHref, safeImageSrc } from \"../../core/validate\";\n\ninterface RenderProps {\n  as?: HTMLKeys;\n  override: OverrideValue;\n  children?: React.ReactNode;\n  /** Forwarded to the rendered element so the editor can measure it. */\n  ref?: React.Ref<HTMLElement>;\n  [key: string]: unknown;\n}\n\n/**\n * The developer's width/height set the layout; the image's own proportions set\n * the shape. Keeping the developer's width and deriving height from the stored\n * natural size means a differently shaped replacement neither breaks the\n * layout nor gets stretched.\n */\nfunction intrinsicSize(override: OverrideValue, width?: number, height?: number) {\n  const { width: nw, height: nh } = override;\n  if (nw && nh) {\n    if (width) return { width, height: Math.round((width * nh) / nw) };\n    if (height) return { width: Math.round((height * nw) / nh), height };\n    return { width: nw, height: nh };\n  }\n  return { width: width || 500, height: height || 500 };\n}\n\n/**\n * Renders a resolved value as plain markup. Shared by the anonymous SSR path\n * and the editor, so what an editor sees matches what ships.\n *\n * Resolved props are applied *after* the spread. The developer's original\n * src/href are still in `rest`, and spreading them last silently masked every\n * saved image and link override.\n */\nexport function GRailRender({ as, override, children, ref, ...rest }: RenderProps) {\n  if (override.type === \"image\") {\n    const {\n      width,\n      height,\n      fill,\n      src: propSrc,\n      alt: propAlt,\n      type: _overrideType,\n      ...imgRest\n    } = rest as Record<string, any>;\n    // Rows written before values were validated may hold anything; only\n    // http(s) and relative addresses are rendered.\n    const src = safeImageSrc(override.src) || propSrc || \"\";\n    const alt = override.alt ?? propAlt ?? \"\";\n    if (!src) return null;\n\n    const imgRef = ref as React.Ref<HTMLImageElement>;\n    if (fill) {\n      return <NextImage ref={imgRef} {...imgRest} src={src} alt={alt} fill />;\n    }\n\n    const size = intrinsicSize(\n      override,\n      Number(width) || undefined,\n      Number(height) || undefined,\n    );\n    return (\n      <NextImage\n        ref={imgRef}\n        {...imgRest}\n        src={src}\n        alt={alt}\n        width={size.width}\n        height={size.height}\n      />\n    );\n  }\n\n  if (override.type === \"link\") {\n    const { href: propHref, type: _overrideType, ...linkRest } =\n      rest as Record<string, any>;\n    return (\n      <NextLink\n        ref={ref as React.Ref<HTMLAnchorElement>}\n        {...linkRest}\n        href={safeHref(override.href) || propHref || \"#\"}\n      >\n        {override.text || children}\n      </NextLink>\n    );\n  }\n\n  const Component = (as || \"span\") as React.ElementType;\n  return (\n    <Component ref={ref} {...rest}>\n      {override.text || children}\n    </Component>\n  );\n}\n"],"mappings":"AA0Da;AA1Db,OAAO,WAAW;AAClB,OAAO,eAAe;AACtB,OAAO,cAAc;AAErB,SAAS,UAAU,oBAAoB;AAiBvC,SAAS,cAAc,UAAyB,OAAgB,QAAiB;AAC/E,QAAM,EAAE,OAAO,IAAI,QAAQ,GAAG,IAAI;AAClC,MAAI,MAAM,IAAI;AACZ,QAAI,MAAO,QAAO,EAAE,OAAO,QAAQ,KAAK,MAAO,QAAQ,KAAM,EAAE,EAAE;AACjE,QAAI,OAAQ,QAAO,EAAE,OAAO,KAAK,MAAO,SAAS,KAAM,EAAE,GAAG,OAAO;AACnE,WAAO,EAAE,OAAO,IAAI,QAAQ,GAAG;AAAA,EACjC;AACA,SAAO,EAAE,OAAO,SAAS,KAAK,QAAQ,UAAU,IAAI;AACtD;AAUO,SAAS,YAAY,EAAE,IAAI,UAAU,UAAU,KAAK,GAAG,KAAK,GAAgB;AACjF,MAAI,SAAS,SAAS,SAAS;AAC7B,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA,KAAK;AAAA,MACL,KAAK;AAAA,MACL,MAAM;AAAA,MACN,GAAG;AAAA,IACL,IAAI;AAGJ,UAAM,MAAM,aAAa,SAAS,GAAG,KAAK,WAAW;AACrD,UAAM,MAAM,SAAS,OAAO,WAAW;AACvC,QAAI,CAAC,IAAK,QAAO;AAEjB,UAAM,SAAS;AACf,QAAI,MAAM;AACR,aAAO,oBAAC,aAAU,KAAK,QAAS,GAAG,SAAS,KAAU,KAAU,MAAI,MAAC;AAAA,IACvE;AAEA,UAAM,OAAO;AAAA,MACX;AAAA,MACA,OAAO,KAAK,KAAK;AAAA,MACjB,OAAO,MAAM,KAAK;AAAA,IACpB;AACA,WACE;AAAA,MAAC;AAAA;AAAA,QACC,KAAK;AAAA,QACJ,GAAG;AAAA,QACJ;AAAA,QACA;AAAA,QACA,OAAO,KAAK;AAAA,QACZ,QAAQ,KAAK;AAAA;AAAA,IACf;AAAA,EAEJ;AAEA,MAAI,SAAS,SAAS,QAAQ;AAC5B,UAAM,EAAE,MAAM,UAAU,MAAM,eAAe,GAAG,SAAS,IACvD;AACF,WACE;AAAA,MAAC;AAAA;AAAA,QACC;AAAA,QACC,GAAG;AAAA,QACJ,MAAM,SAAS,SAAS,IAAI,KAAK,YAAY;AAAA,QAE5C,mBAAS,QAAQ;AAAA;AAAA,IACpB;AAAA,EAEJ;AAEA,QAAM,YAAa,MAAM;AACzB,SACE,oBAAC,aAAU,KAAW,GAAG,MACtB,mBAAS,QAAQ,UACpB;AAEJ;","names":[]}

package/dist/server/actions.js

@@ -8,10 +8,13 @@ import {
   getMembers,
   getPasswordResetHandler,
   getStorage,
-  resolveSiteId
+  resolveSiteId,
+  resolveSiteUrl
 } from "../core/config";
 import { getCachedViewer } from "./session";
 import { requireRole } from "./access";
+import { rateLimited } from "./rateLimit";
+import { cleanEmail, isRole, validateOverrideValue, validPathKey } from "../core/validate";
 import { rethrowIfBailout } from "../core/bailout";
 import {
   GR_AUTH_ERROR_TTL_SECONDS,
@@ -22,21 +25,20 @@ const DENIED = { success: false, error: "Unauthorized." };
 async function saveOverride(row) {
   const viewer = await requireRole(["admin", "editor"]);
   if (!viewer) return DENIED;
-  return writeOverride(row.pathKey, row.value);
+  return writeOverride(row?.pathKey, row?.value);
 }
-const OVERRIDE_TYPES = ["text", "link", "image", "button"];
 async function setFieldValue(id, value) {
   const viewer = await requireRole(["admin", "editor"]);
   if (!viewer) return DENIED;
-  const pathKey = id.trim();
-  if (!pathKey) return { success: false, error: "A field id is required." };
   const normalized = typeof value === "string" ? { type: "text", text: value } : value;
-  if (!OVERRIDE_TYPES.includes(normalized.type)) {
-    return { success: false, error: `Unknown field type "${normalized.type}".` };
-  }
-  return writeOverride(pathKey, normalized);
+  return writeOverride(id, normalized);
 }
-async function writeOverride(pathKey, value) {
+async function writeOverride(rawPathKey, rawValue) {
+  const pathKey = validPathKey(rawPathKey);
+  if (!pathKey) return { success: false, error: "A valid field id is required." };
+  const checked = validateOverrideValue(rawValue);
+  if (!checked.ok) return { success: false, error: checked.error };
+  const value = checked.value;
   const rowToSend = {
     pathKey,
     siteId: await resolveSiteId(),
@@ -60,6 +62,8 @@ const MAX_UPLOAD_BYTES = 10 * 1024 * 1024;
 async function createAssetUpload(file) {
   const viewer = await requireRole(["admin", "editor"]);
   if (!viewer) return { success: false, error: "Unauthorized." };
+  const slow = await rateLimited("upload", viewer.userId);
+  if (slow) return { success: false, error: slow };
   const storage = getStorage();
   if (!storage) {
     return { success: false, error: "No storage adapter is configured." };
@@ -95,10 +99,9 @@ async function listTeam() {
 async function inviteMember(email, role) {
   const viewer = await requireRole(["admin"]);
   if (!viewer) return DENIED;
-  const normalized = email.toLowerCase().trim();
-  if (!/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(normalized)) {
-    return { success: false, error: "Enter a valid email address." };
-  }
+  const normalized = cleanEmail(email);
+  if (!normalized) return { success: false, error: "Enter a valid email address." };
+  if (!isRole(role)) return { success: false, error: "Choose admin or editor." };
   const siteId = await resolveSiteId();
   const members = getMembers();
   const existing = await members.getMember(siteId, { email: normalized });
@@ -116,7 +119,14 @@ async function inviteMember(email, role) {
   }
   const auth = getAuth();
   const onInvite = getInviteHandler();
-  const origin = await requestOrigin();
+  const slow = await rateLimited("invite", viewer.userId);
+  if (slow) return { success: false, error: `Invite saved, but not sent. ${slow}` };
+  const where = await linkOrigin();
+  if ("error" in where) {
+    revalidatePath("/", "layout");
+    return { success: false, error: `Invite saved, but ${where.error}` };
+  }
+  const origin = where.origin;
   const made = auth.createInviteLink ? await auth.createInviteLink(normalized, { origin }) : null;
   if (made && !made.success) {
     revalidatePath("/", "layout");
@@ -155,11 +165,12 @@ const ALREADY_HAS_ACCOUNT = (email) => `${email} already has an account, so they
 async function updateMemberRole(email, role) {
   const viewer = await requireRole(["admin"]);
   if (!viewer) return DENIED;
+  const targetEmail = cleanEmail(email);
+  if (!targetEmail) return { success: false, error: "No such member." };
+  if (!isRole(role)) return { success: false, error: "Choose admin or editor." };
   const siteId = await resolveSiteId();
   const members = getMembers();
-  const target = await members.getMember(siteId, {
-    email: email.toLowerCase().trim()
-  });
+  const target = await members.getMember(siteId, { email: targetEmail });
   if (!target) return { success: false, error: "No such member." };
   if (target.role === "admin" && role !== "admin") {
     const guard = await wouldStrandSite(siteId, target.email);
@@ -177,9 +188,10 @@ async function updateMemberRole(email, role) {
 async function removeMember(email) {
   const viewer = await requireRole(["admin"]);
   if (!viewer) return DENIED;
+  const normalized = cleanEmail(email);
+  if (!normalized) return { success: false, error: "No such member." };
   const siteId = await resolveSiteId();
   const members = getMembers();
-  const normalized = email.toLowerCase().trim();
   const guard = await wouldStrandSite(siteId, normalized);
   if (guard) return guard;
   const res = await members.removeMember(siteId, normalized);
@@ -189,7 +201,6 @@ async function removeMember(email) {
 const RESET_COOLDOWN_MS = 6e4;
 const lastResetAt = /* @__PURE__ */ new Map();
 const RESET_MIN_DURATION_MS = 600;
-const EMAIL_PATTERN = /^[^@\s]+@[^@\s]+\.[^@\s]+$/;
 async function dispatchPasswordReset(email, requestedBy) {
   const auth = getAuth();
   const handler = getPasswordResetHandler();
@@ -205,7 +216,9 @@ async function dispatchPasswordReset(email, requestedBy) {
       error: "this site has no onPasswordReset handler \u2014 add resendEmails() (or your own) to withGuardrail()."
     };
   }
-  const made = await auth.createPasswordResetLink(email, { origin: await requestOrigin() });
+  const where = await linkOrigin();
+  if ("error" in where) return { success: false, error: where.error };
+  const made = await auth.createPasswordResetLink(email, { origin: where.origin });
   if (!made.success) return { success: false, error: made.error };
   try {
     await handler({ email, siteId: await resolveSiteId(), link: made.link, requestedBy });
@@ -217,10 +230,10 @@ async function dispatchPasswordReset(email, requestedBy) {
 }
 async function forgotPasswordAction(email) {
   const started = Date.now();
-  const normalized = String(email ?? "").toLowerCase().trim();
-  if (!EMAIL_PATTERN.test(normalized)) {
-    return { success: false, error: "Enter a valid email address." };
-  }
+  const normalized = cleanEmail(email);
+  if (!normalized) return { success: false, error: "Enter a valid email address." };
+  const slow = await rateLimited("forgot-password", normalized);
+  if (slow) return { success: false, error: slow };
   try {
     const siteId = await resolveSiteId();
     const key = `${siteId}:${normalized}`;
@@ -248,19 +261,24 @@ async function forgotPasswordAction(email) {
 async function sendPasswordResetAction(email) {
   const viewer = await requireRole(["admin"]);
   if (!viewer) return DENIED;
-  const normalized = String(email ?? "").toLowerCase().trim();
+  const normalized = cleanEmail(email);
+  if (!normalized) return { success: false, error: "No such member." };
   const target = await getMembers().getMember(await resolveSiteId(), { email: normalized });
   if (!target) return { success: false, error: "No such member." };
+  const slow = await rateLimited("password-reset", viewer.userId);
+  if (slow) return { success: false, error: slow };
   const res = await dispatchPasswordReset(normalized, viewer.email ?? viewer.userId);
   return res.success ? { success: true, notice: `Password reset email sent to ${normalized}.` } : { success: false, error: `The reset email couldn't be sent: ${res.error}` };
 }
-async function requestOrigin() {
+const SITE_URL_MISSING = "siteUrl isn't set, so sign-in links can't be built safely \u2014 set GUARDRAIL_SITE_URL (or siteUrl in withGuardrail()) to this site's public address.";
+async function linkOrigin() {
+  const configured = await resolveSiteUrl();
+  if (configured) return { origin: configured };
+  if (process.env.NODE_ENV === "production") return { error: SITE_URL_MISSING };
   const h = await headers();
-  const origin = h.get("origin");
-  if (origin) return origin;
-  const host = h.get("x-forwarded-host") ?? h.get("host") ?? "localhost";
+  const host = h.get("host") ?? "localhost";
   const proto = h.get("x-forwarded-proto") ?? (host.startsWith("localhost") ? "http" : "https");
-  return `${proto}://${host}`;
+  return { origin: `${proto}://${host}` };
 }
 async function wouldStrandSite(siteId, email) {
   const members = getMembers();
@@ -285,6 +303,8 @@ async function loginAction(_prev, formData) {
       email
     };
   }
+  const slow = await rateLimited("login", cleanEmail(email) ?? email.trim().toLowerCase().slice(0, 254));
+  if (slow) return { success: false, error: slow, email };
   const result = await auth.authenticate(email, password);
   if (!result.success) {
     return { success: false, error: result.error, email };
@@ -305,6 +325,7 @@ async function logoutAction() {
 async function completeAuthRedirectAction(params) {
   const auth = getAuth();
   if (!auth.completeAuthRedirect) return { success: false };
+  if (await rateLimited("auth-link")) return { success: false, error: "Too many attempts." };
   const res = await auth.completeAuthRedirect(params);
   const cookieStore = await cookies();
   if (res.success) {