@guard-rail/core 0.9.1 → 0.11.0

package/dist/server/repeaterActions.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/server/repeaterActions.ts"],"sourcesContent":["\"use server\";\n\nimport { revalidatePath } from \"next/cache\";\nimport { getDB, getRepeaters, resolveSiteId } from \"../core/config\";\nimport { requireRole } from \"./access\";\nimport { rethrowIfBailout } from \"../core/bailout\";\nimport type { GRRepeaterItem } from \"../core/types\";\n\ntype Result = { success: boolean; error?: string };\n\nconst DENIED: Result = { success: false, error: \"Unauthorized.\" };\n\nexport async function addRepeaterItem(\n  repeaterId: string,\n  options?: { slug?: string },\n): Promise<\n  { success: true; item: GRRepeaterItem } | { success: false; error: string }\n> {\n  const viewer = await requireRole([\"admin\", \"editor\"]);\n  if (!viewer) return { success: false, error: \"Unauthorized.\" };\n\n  if (options?.slug !== undefined) {\n    const slug = options.slug.trim();\n    if (!/^[a-z0-9]+(-[a-z0-9]+)*$/.test(slug)) {\n      return {\n        success: false,\n        error: \"Use lowercase letters, numbers, and hyphens only.\",\n      };\n    }\n    options = { slug };\n  }\n\n  try {\n    const repeaters = getRepeaters();\n    const res = await repeaters.addItem(repeaterId, await resolveSiteId(), options);\n    if (res.success) revalidatePath(\"/\", \"layout\");\n    return res;\n  } catch (e) {\n    rethrowIfBailout(e);\n    console.error(\"Guardrail: addRepeaterItem failed\", e);\n    return { success: false, error: \"Could not add the item.\" };\n  }\n}\n\nexport async function removeRepeaterItem(\n  repeaterId: string,\n  itemId: string,\n): Promise<Result> {\n  const viewer = await requireRole([\"admin\", \"editor\"]);\n  if (!viewer) return DENIED;\n\n  try {\n    const siteId = await resolveSiteId();\n    const repeaters = getRepeaters();\n    const res = await repeaters.removeItem(repeaterId, siteId, itemId);\n    if (!res.success) return res;\n\n    // Best-effort: an adapter that can't do this cheaply just leaves the old\n    // field values behind, unreachable but harmless.\n    const db = getDB();\n    await db.deleteOverrides?.(`${repeaterId}.${itemId}.`, siteId);\n\n    revalidatePath(\"/\", \"layout\");\n    return { success: true };\n  } catch (e) {\n    rethrowIfBailout(e);\n    console.error(\"Guardrail: removeRepeaterItem failed\", e);\n    return { success: false, error: \"Could not remove the item.\" };\n  }\n}\n\nexport async function reorderRepeaterItems(\n  repeaterId: string,\n  orderedItemIds: string[],\n): Promise<Result> {\n  const viewer = await requireRole([\"admin\", \"editor\"]);\n  if (!viewer) return DENIED;\n\n  try {\n    const repeaters = getRepeaters();\n    const res = await repeaters.reorderItems(\n      repeaterId,\n      await resolveSiteId(),\n      orderedItemIds,\n    );\n    if (res.success) revalidatePath(\"/\", \"layout\");\n    return res;\n  } catch (e) {\n    rethrowIfBailout(e);\n    console.error(\"Guardrail: reorderRepeaterItems failed\", e);\n    return { success: false, error: \"Could not reorder the items.\" };\n  }\n}\n"],"mappings":";AAEA,SAAS,sBAAsB;AAC/B,SAAS,OAAO,cAAc,qBAAqB;AACnD,SAAS,mBAAmB;AAC5B,SAAS,wBAAwB;AAKjC,MAAM,SAAiB,EAAE,SAAS,OAAO,OAAO,gBAAgB;AAEhE,eAAsB,gBACpB,YACA,SAGA;AACA,QAAM,SAAS,MAAM,YAAY,CAAC,SAAS,QAAQ,CAAC;AACpD,MAAI,CAAC,OAAQ,QAAO,EAAE,SAAS,OAAO,OAAO,gBAAgB;AAE7D,MAAI,SAAS,SAAS,QAAW;AAC/B,UAAM,OAAO,QAAQ,KAAK,KAAK;AAC/B,QAAI,CAAC,2BAA2B,KAAK,IAAI,GAAG;AAC1C,aAAO;AAAA,QACL,SAAS;AAAA,QACT,OAAO;AAAA,MACT;AAAA,IACF;AACA,cAAU,EAAE,KAAK;AAAA,EACnB;AAEA,MAAI;AACF,UAAM,YAAY,aAAa;AAC/B,UAAM,MAAM,MAAM,UAAU,QAAQ,YAAY,MAAM,cAAc,GAAG,OAAO;AAC9E,QAAI,IAAI,QAAS,gBAAe,KAAK,QAAQ;AAC7C,WAAO;AAAA,EACT,SAAS,GAAG;AACV,qBAAiB,CAAC;AAClB,YAAQ,MAAM,qCAAqC,CAAC;AACpD,WAAO,EAAE,SAAS,OAAO,OAAO,0BAA0B;AAAA,EAC5D;AACF;AAEA,eAAsB,mBACpB,YACA,QACiB;AACjB,QAAM,SAAS,MAAM,YAAY,CAAC,SAAS,QAAQ,CAAC;AACpD,MAAI,CAAC,OAAQ,QAAO;AAEpB,MAAI;AACF,UAAM,SAAS,MAAM,cAAc;AACnC,UAAM,YAAY,aAAa;AAC/B,UAAM,MAAM,MAAM,UAAU,WAAW,YAAY,QAAQ,MAAM;AACjE,QAAI,CAAC,IAAI,QAAS,QAAO;AAIzB,UAAM,KAAK,MAAM;AACjB,UAAM,GAAG,kBAAkB,GAAG,UAAU,IAAI,MAAM,KAAK,MAAM;AAE7D,mBAAe,KAAK,QAAQ;AAC5B,WAAO,EAAE,SAAS,KAAK;AAAA,EACzB,SAAS,GAAG;AACV,qBAAiB,CAAC;AAClB,YAAQ,MAAM,wCAAwC,CAAC;AACvD,WAAO,EAAE,SAAS,OAAO,OAAO,6BAA6B;AAAA,EAC/D;AACF;AAEA,eAAsB,qBACpB,YACA,gBACiB;AACjB,QAAM,SAAS,MAAM,YAAY,CAAC,SAAS,QAAQ,CAAC;AACpD,MAAI,CAAC,OAAQ,QAAO;AAEpB,MAAI;AACF,UAAM,YAAY,aAAa;AAC/B,UAAM,MAAM,MAAM,UAAU;AAAA,MAC1B;AAAA,MACA,MAAM,cAAc;AAAA,MACpB;AAAA,IACF;AACA,QAAI,IAAI,QAAS,gBAAe,KAAK,QAAQ;AAC7C,WAAO;AAAA,EACT,SAAS,GAAG;AACV,qBAAiB,CAAC;AAClB,YAAQ,MAAM,0CAA0C,CAAC;AACzD,WAAO,EAAE,SAAS,OAAO,OAAO,+BAA+B;AAAA,EACjE;AACF;","names":[]}
+{"version":3,"sources":["../../src/server/repeaterActions.ts"],"sourcesContent":["\"use server\";\n\nimport { revalidatePath } from \"next/cache\";\nimport { getDB, getRepeaters, resolveSiteId } from \"../core/config\";\nimport { requireRole } from \"./access\";\nimport { validId, validIdList } from \"../core/validate\";\nimport { rethrowIfBailout } from \"../core/bailout\";\nimport type { GRRepeaterItem } from \"../core/types\";\n\ntype Result = { success: boolean; error?: string };\n\nconst DENIED: Result = { success: false, error: \"Unauthorized.\" };\n\nexport async function addRepeaterItem(\n  repeaterId: string,\n  options?: { slug?: string },\n): Promise<\n  { success: true; item: GRRepeaterItem } | { success: false; error: string }\n> {\n  const viewer = await requireRole([\"admin\", \"editor\"]);\n  if (!viewer) return { success: false, error: \"Unauthorized.\" };\n  if (!validId(repeaterId)) return { success: false, error: \"Invalid repeater.\" };\n\n  if (options?.slug !== undefined) {\n    if (typeof options.slug !== \"string\" || options.slug.length > 200) {\n      return { success: false, error: \"Use lowercase letters, numbers, and hyphens only.\" };\n    }\n    const slug = options.slug.trim();\n    if (!/^[a-z0-9]+(-[a-z0-9]+)*$/.test(slug)) {\n      return {\n        success: false,\n        error: \"Use lowercase letters, numbers, and hyphens only.\",\n      };\n    }\n    options = { slug };\n  }\n\n  try {\n    const repeaters = getRepeaters();\n    const res = await repeaters.addItem(repeaterId, await resolveSiteId(), options);\n    if (res.success) revalidatePath(\"/\", \"layout\");\n    return res;\n  } catch (e) {\n    rethrowIfBailout(e);\n    console.error(\"Guardrail: addRepeaterItem failed\", e);\n    return { success: false, error: \"Could not add the item.\" };\n  }\n}\n\nexport async function removeRepeaterItem(\n  repeaterId: string,\n  itemId: string,\n): Promise<Result> {\n  const viewer = await requireRole([\"admin\", \"editor\"]);\n  if (!viewer) return DENIED;\n  if (!validId(repeaterId) || !validId(itemId)) return { success: false, error: \"Invalid item.\" };\n\n  try {\n    const siteId = await resolveSiteId();\n    const repeaters = getRepeaters();\n    const res = await repeaters.removeItem(repeaterId, siteId, itemId);\n    if (!res.success) return res;\n\n    // Best-effort: an adapter that can't do this cheaply just leaves the old\n    // field values behind, unreachable but harmless.\n    const db = getDB();\n    await db.deleteOverrides?.(`${repeaterId}.${itemId}.`, siteId);\n\n    revalidatePath(\"/\", \"layout\");\n    return { success: true };\n  } catch (e) {\n    rethrowIfBailout(e);\n    console.error(\"Guardrail: removeRepeaterItem failed\", e);\n    return { success: false, error: \"Could not remove the item.\" };\n  }\n}\n\nexport async function reorderRepeaterItems(\n  repeaterId: string,\n  orderedItemIds: string[],\n): Promise<Result> {\n  const viewer = await requireRole([\"admin\", \"editor\"]);\n  if (!viewer) return DENIED;\n  const ids = validIdList(orderedItemIds);\n  if (!validId(repeaterId) || !ids) return { success: false, error: \"Invalid order.\" };\n\n  try {\n    const repeaters = getRepeaters();\n    const res = await repeaters.reorderItems(\n      repeaterId,\n      await resolveSiteId(),\n      ids,\n    );\n    if (res.success) revalidatePath(\"/\", \"layout\");\n    return res;\n  } catch (e) {\n    rethrowIfBailout(e);\n    console.error(\"Guardrail: reorderRepeaterItems failed\", e);\n    return { success: false, error: \"Could not reorder the items.\" };\n  }\n}\n"],"mappings":";AAEA,SAAS,sBAAsB;AAC/B,SAAS,OAAO,cAAc,qBAAqB;AACnD,SAAS,mBAAmB;AAC5B,SAAS,SAAS,mBAAmB;AACrC,SAAS,wBAAwB;AAKjC,MAAM,SAAiB,EAAE,SAAS,OAAO,OAAO,gBAAgB;AAEhE,eAAsB,gBACpB,YACA,SAGA;AACA,QAAM,SAAS,MAAM,YAAY,CAAC,SAAS,QAAQ,CAAC;AACpD,MAAI,CAAC,OAAQ,QAAO,EAAE,SAAS,OAAO,OAAO,gBAAgB;AAC7D,MAAI,CAAC,QAAQ,UAAU,EAAG,QAAO,EAAE,SAAS,OAAO,OAAO,oBAAoB;AAE9E,MAAI,SAAS,SAAS,QAAW;AAC/B,QAAI,OAAO,QAAQ,SAAS,YAAY,QAAQ,KAAK,SAAS,KAAK;AACjE,aAAO,EAAE,SAAS,OAAO,OAAO,oDAAoD;AAAA,IACtF;AACA,UAAM,OAAO,QAAQ,KAAK,KAAK;AAC/B,QAAI,CAAC,2BAA2B,KAAK,IAAI,GAAG;AAC1C,aAAO;AAAA,QACL,SAAS;AAAA,QACT,OAAO;AAAA,MACT;AAAA,IACF;AACA,cAAU,EAAE,KAAK;AAAA,EACnB;AAEA,MAAI;AACF,UAAM,YAAY,aAAa;AAC/B,UAAM,MAAM,MAAM,UAAU,QAAQ,YAAY,MAAM,cAAc,GAAG,OAAO;AAC9E,QAAI,IAAI,QAAS,gBAAe,KAAK,QAAQ;AAC7C,WAAO;AAAA,EACT,SAAS,GAAG;AACV,qBAAiB,CAAC;AAClB,YAAQ,MAAM,qCAAqC,CAAC;AACpD,WAAO,EAAE,SAAS,OAAO,OAAO,0BAA0B;AAAA,EAC5D;AACF;AAEA,eAAsB,mBACpB,YACA,QACiB;AACjB,QAAM,SAAS,MAAM,YAAY,CAAC,SAAS,QAAQ,CAAC;AACpD,MAAI,CAAC,OAAQ,QAAO;AACpB,MAAI,CAAC,QAAQ,UAAU,KAAK,CAAC,QAAQ,MAAM,EAAG,QAAO,EAAE,SAAS,OAAO,OAAO,gBAAgB;AAE9F,MAAI;AACF,UAAM,SAAS,MAAM,cAAc;AACnC,UAAM,YAAY,aAAa;AAC/B,UAAM,MAAM,MAAM,UAAU,WAAW,YAAY,QAAQ,MAAM;AACjE,QAAI,CAAC,IAAI,QAAS,QAAO;AAIzB,UAAM,KAAK,MAAM;AACjB,UAAM,GAAG,kBAAkB,GAAG,UAAU,IAAI,MAAM,KAAK,MAAM;AAE7D,mBAAe,KAAK,QAAQ;AAC5B,WAAO,EAAE,SAAS,KAAK;AAAA,EACzB,SAAS,GAAG;AACV,qBAAiB,CAAC;AAClB,YAAQ,MAAM,wCAAwC,CAAC;AACvD,WAAO,EAAE,SAAS,OAAO,OAAO,6BAA6B;AAAA,EAC/D;AACF;AAEA,eAAsB,qBACpB,YACA,gBACiB;AACjB,QAAM,SAAS,MAAM,YAAY,CAAC,SAAS,QAAQ,CAAC;AACpD,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,MAAM,YAAY,cAAc;AACtC,MAAI,CAAC,QAAQ,UAAU,KAAK,CAAC,IAAK,QAAO,EAAE,SAAS,OAAO,OAAO,iBAAiB;AAEnF,MAAI;AACF,UAAM,YAAY,aAAa;AAC/B,UAAM,MAAM,MAAM,UAAU;AAAA,MAC1B;AAAA,MACA,MAAM,cAAc;AAAA,MACpB;AAAA,IACF;AACA,QAAI,IAAI,QAAS,gBAAe,KAAK,QAAQ;AAC7C,WAAO;AAAA,EACT,SAAS,GAAG;AACV,qBAAiB,CAAC;AAClB,YAAQ,MAAM,0CAA0C,CAAC;AACzD,WAAO,EAAE,SAAS,OAAO,OAAO,+BAA+B;AAAA,EACjE;AACF;","names":[]}

package/dist/server/wrapper.js

@@ -5,17 +5,34 @@ import {
   configureGuardrail,
   getAuth,
   getStorage,
-  resolveSiteId
+  resolveSiteId,
+  resolveSiteUrl
 } from "../core/config";
 import { getCachedViewer } from "./session";
 import { resolveEditMode } from "./access";
 import { loadPreloadedContent } from "./loader";
 import { GRailProvider } from "../react/Provider";
 import { GRailAdmin } from "../react/Admin";
+let warnedSiteUrl = false;
+function warnIfSiteUrlMissing() {
+  if (warnedSiteUrl || process.env.NODE_ENV !== "production") return;
+  if (process.env.NEXT_PHASE === "phase-production-build") return;
+  warnedSiteUrl = true;
+  resolveSiteUrl().then(
+    (url) => {
+      if (url) return;
+      console.warn(
+        "Guardrail: no site URL is configured, so invite and password-reset emails will not be sent. Set GUARDRAIL_SITE_URL (or siteUrl in withGuardrail()) to this site's public address. Run `pnpm exec guardrail-doctor` to check the rest of your setup."
+      );
+    },
+    (e) => console.warn(`Guardrail: ${e instanceof Error ? e.message : e}`)
+  );
+}
 function withGuardrail(LayoutComponent, config) {
   configureGuardrail(config);
   return async function GuardrailLayout(props) {
     configureGuardrail(config);
+    warnIfSiteUrlMissing();
     const cookieStore = await cookies();
     const [viewer, content] = await Promise.all([
       getCachedViewer(),

package/dist/server/wrapper.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/server/wrapper.tsx"],"sourcesContent":["import React, { Suspense } from \"react\";\nimport { cookies } from \"next/headers\";\nimport {\n  configureGuardrail,\n  getAuth,\n  getStorage,\n  resolveSiteId,\n} from \"../core/config\";\nimport { getCachedViewer } from \"./session\";\nimport { resolveEditMode } from \"./access\";\nimport { loadPreloadedContent } from \"./loader\";\nimport type { GRConfig } from \"../core/adapter-types\";\nimport { GRailProvider } from \"../react/Provider\";\nimport { GRailAdmin } from \"../react/Admin\";\nimport type { GRState } from \"../core/types\";\n\n/**\n * Wraps a root layout so every route carries Guardrail's edit state and admin\n * chrome. Stays a Server Component: the provider below is the client boundary.\n */\nexport function withGuardrail<P extends object>(\n  LayoutComponent: React.ComponentType<P>,\n  config: GRConfig,\n) {\n  // Applied at module evaluation so the config is present as soon as anything\n  // imports the layout, and again per render because Next.js does not\n  // guarantee one shared module instance across its server contexts.\n  configureGuardrail(config);\n\n  return async function GuardrailLayout(props: P) {\n    configureGuardrail(config);\n\n    const cookieStore = await cookies();\n\n    // Verified against the auth provider, not inferred from a cookie. Loaded\n    // alongside the content preload: independent round trips, and the preload\n    // is shared with the page's own fields, so it costs them nothing extra.\n    const [viewer, content] = await Promise.all([\n      getCachedViewer(),\n      loadPreloadedContent(),\n    ]);\n\n    const auth = getAuth();\n\n    // The rule for what counts as \"in edit mode\" lives in resolveEditMode —\n    // shared with canEdit() so the layout and the server helper can't disagree.\n    const isAuth = viewer !== null;\n    const { isEditMode, needsPassword, authError } = resolveEditMode(viewer, cookieStore);\n    const role = viewer?.role ?? null;\n\n    const state: GRState = {\n      storage: getStorage() !== undefined,\n      auth: {\n        password: typeof auth.authenticate === \"function\",\n        ...(auth.signInUrl ? { signInUrl: auth.signInUrl } : {}),\n      },\n      isAuth,\n      isEditMode,\n      needsPassword,\n      ...(authError ? { authError } : {}),\n      siteId: await resolveSiteId(),\n      role,\n      canEdit: isEditMode && role !== null,\n      ...(viewer?.email ? { email: viewer.email } : {}),\n    };\n\n    return (\n      <GRailProvider state={state} content={content}>\n        <LayoutComponent {...props} />\n        <Suspense fallback={null}>\n          <GRailAdmin toolbarExtra={config.toolbarExtra} />\n        </Suspense>\n      </GRailProvider>\n    );\n  };\n}\n"],"mappings":"AAmEM,SACE,KADF;AAnEN,OAAO,SAAS,gBAAgB;AAChC,SAAS,eAAe;AACxB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,uBAAuB;AAChC,SAAS,uBAAuB;AAChC,SAAS,4BAA4B;AAErC,SAAS,qBAAqB;AAC9B,SAAS,kBAAkB;AAOpB,SAAS,cACd,iBACA,QACA;AAIA,qBAAmB,MAAM;AAEzB,SAAO,eAAe,gBAAgB,OAAU;AAC9C,uBAAmB,MAAM;AAEzB,UAAM,cAAc,MAAM,QAAQ;AAKlC,UAAM,CAAC,QAAQ,OAAO,IAAI,MAAM,QAAQ,IAAI;AAAA,MAC1C,gBAAgB;AAAA,MAChB,qBAAqB;AAAA,IACvB,CAAC;AAED,UAAM,OAAO,QAAQ;AAIrB,UAAM,SAAS,WAAW;AAC1B,UAAM,EAAE,YAAY,eAAe,UAAU,IAAI,gBAAgB,QAAQ,WAAW;AACpF,UAAM,OAAO,QAAQ,QAAQ;AAE7B,UAAM,QAAiB;AAAA,MACrB,SAAS,WAAW,MAAM;AAAA,MAC1B,MAAM;AAAA,QACJ,UAAU,OAAO,KAAK,iBAAiB;AAAA,QACvC,GAAI,KAAK,YAAY,EAAE,WAAW,KAAK,UAAU,IAAI,CAAC;AAAA,MACxD;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;AAAA,MACjC,QAAQ,MAAM,cAAc;AAAA,MAC5B;AAAA,MACA,SAAS,cAAc,SAAS;AAAA,MAChC,GAAI,QAAQ,QAAQ,EAAE,OAAO,OAAO,MAAM,IAAI,CAAC;AAAA,IACjD;AAEA,WACE,qBAAC,iBAAc,OAAc,SAC3B;AAAA,0BAAC,mBAAiB,GAAG,OAAO;AAAA,MAC5B,oBAAC,YAAS,UAAU,MAClB,8BAAC,cAAW,cAAc,OAAO,cAAc,GACjD;AAAA,OACF;AAAA,EAEJ;AACF;","names":[]}
+{"version":3,"sources":["../../src/server/wrapper.tsx"],"sourcesContent":["import React, { Suspense } from \"react\";\nimport { cookies } from \"next/headers\";\nimport {\n  configureGuardrail,\n  getAuth,\n  getStorage,\n  resolveSiteId,\n  resolveSiteUrl,\n} from \"../core/config\";\nimport { getCachedViewer } from \"./session\";\nimport { resolveEditMode } from \"./access\";\nimport { loadPreloadedContent } from \"./loader\";\nimport type { GRConfig } from \"../core/adapter-types\";\nimport { GRailProvider } from \"../react/Provider\";\nimport { GRailAdmin } from \"../react/Admin\";\nimport type { GRState } from \"../core/types\";\n\nlet warnedSiteUrl = false;\n\n/**\n * Production sends no invite or password-reset email without a site URL, and\n * \"Forgot password?\" is built never to reveal a failure to the person asking —\n * so a site upgraded without setting one just goes quiet. Say so, once, in the\n * server log where whoever deploys it will look.\n */\nfunction warnIfSiteUrlMissing(): void {\n  if (warnedSiteUrl || process.env.NODE_ENV !== \"production\") return;\n  // Not while `next build` is prerendering: the variable is often only set where\n  // the site runs, and a warning on every CI build is noise.\n  if (process.env.NEXT_PHASE === \"phase-production-build\") return;\n  warnedSiteUrl = true;\n  resolveSiteUrl().then(\n    (url) => {\n      if (url) return;\n      console.warn(\n        \"Guardrail: no site URL is configured, so invite and password-reset emails will not be sent. \" +\n          \"Set GUARDRAIL_SITE_URL (or siteUrl in withGuardrail()) to this site's public address. \" +\n          \"Run `pnpm exec guardrail-doctor` to check the rest of your setup.\",\n      );\n    },\n    (e) => console.warn(`Guardrail: ${e instanceof Error ? e.message : e}`),\n  );\n}\n\n/**\n * Wraps a root layout so every route carries Guardrail's edit state and admin\n * chrome. Stays a Server Component: the provider below is the client boundary.\n */\nexport function withGuardrail<P extends object>(\n  LayoutComponent: React.ComponentType<P>,\n  config: GRConfig,\n) {\n  // Applied at module evaluation so the config is present as soon as anything\n  // imports the layout, and again per render because Next.js does not\n  // guarantee one shared module instance across its server contexts.\n  configureGuardrail(config);\n\n  return async function GuardrailLayout(props: P) {\n    configureGuardrail(config);\n    warnIfSiteUrlMissing();\n\n    const cookieStore = await cookies();\n\n    // Verified against the auth provider, not inferred from a cookie. Loaded\n    // alongside the content preload: independent round trips, and the preload\n    // is shared with the page's own fields, so it costs them nothing extra.\n    const [viewer, content] = await Promise.all([\n      getCachedViewer(),\n      loadPreloadedContent(),\n    ]);\n\n    const auth = getAuth();\n\n    // The rule for what counts as \"in edit mode\" lives in resolveEditMode —\n    // shared with canEdit() so the layout and the server helper can't disagree.\n    const isAuth = viewer !== null;\n    const { isEditMode, needsPassword, authError } = resolveEditMode(viewer, cookieStore);\n    const role = viewer?.role ?? null;\n\n    const state: GRState = {\n      storage: getStorage() !== undefined,\n      auth: {\n        password: typeof auth.authenticate === \"function\",\n        ...(auth.signInUrl ? { signInUrl: auth.signInUrl } : {}),\n      },\n      isAuth,\n      isEditMode,\n      needsPassword,\n      ...(authError ? { authError } : {}),\n      siteId: await resolveSiteId(),\n      role,\n      canEdit: isEditMode && role !== null,\n      ...(viewer?.email ? { email: viewer.email } : {}),\n    };\n\n    return (\n      <GRailProvider state={state} content={content}>\n        <LayoutComponent {...props} />\n        <Suspense fallback={null}>\n          <GRailAdmin toolbarExtra={config.toolbarExtra} />\n        </Suspense>\n      </GRailProvider>\n    );\n  };\n}\n"],"mappings":"AAgGM,SACE,KADF;AAhGN,OAAO,SAAS,gBAAgB;AAChC,SAAS,eAAe;AACxB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,uBAAuB;AAChC,SAAS,uBAAuB;AAChC,SAAS,4BAA4B;AAErC,SAAS,qBAAqB;AAC9B,SAAS,kBAAkB;AAG3B,IAAI,gBAAgB;AAQpB,SAAS,uBAA6B;AACpC,MAAI,iBAAiB,QAAQ,IAAI,aAAa,aAAc;AAG5D,MAAI,QAAQ,IAAI,eAAe,yBAA0B;AACzD,kBAAgB;AAChB,iBAAe,EAAE;AAAA,IACf,CAAC,QAAQ;AACP,UAAI,IAAK;AACT,cAAQ;AAAA,QACN;AAAA,MAGF;AAAA,IACF;AAAA,IACA,CAAC,MAAM,QAAQ,KAAK,cAAc,aAAa,QAAQ,EAAE,UAAU,CAAC,EAAE;AAAA,EACxE;AACF;AAMO,SAAS,cACd,iBACA,QACA;AAIA,qBAAmB,MAAM;AAEzB,SAAO,eAAe,gBAAgB,OAAU;AAC9C,uBAAmB,MAAM;AACzB,yBAAqB;AAErB,UAAM,cAAc,MAAM,QAAQ;AAKlC,UAAM,CAAC,QAAQ,OAAO,IAAI,MAAM,QAAQ,IAAI;AAAA,MAC1C,gBAAgB;AAAA,MAChB,qBAAqB;AAAA,IACvB,CAAC;AAED,UAAM,OAAO,QAAQ;AAIrB,UAAM,SAAS,WAAW;AAC1B,UAAM,EAAE,YAAY,eAAe,UAAU,IAAI,gBAAgB,QAAQ,WAAW;AACpF,UAAM,OAAO,QAAQ,QAAQ;AAE7B,UAAM,QAAiB;AAAA,MACrB,SAAS,WAAW,MAAM;AAAA,MAC1B,MAAM;AAAA,QACJ,UAAU,OAAO,KAAK,iBAAiB;AAAA,QACvC,GAAI,KAAK,YAAY,EAAE,WAAW,KAAK,UAAU,IAAI,CAAC;AAAA,MACxD;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;AAAA,MACjC,QAAQ,MAAM,cAAc;AAAA,MAC5B;AAAA,MACA,SAAS,cAAc,SAAS;AAAA,MAChC,GAAI,QAAQ,QAAQ,EAAE,OAAO,OAAO,MAAM,IAAI,CAAC;AAAA,IACjD;AAEA,WACE,qBAAC,iBAAc,OAAc,SAC3B;AAAA,0BAAC,mBAAiB,GAAG,OAAO;AAAA,MAC5B,oBAAC,YAAS,UAAU,MAClB,8BAAC,cAAW,cAAc,OAAO,cAAc,GACjD;AAAA,OACF;AAAA,EAEJ;AACF;","names":[]}

package/package.json

@@ -1,10 +1,12 @@
 {
   "name": "@guard-rail/core",
-  "version": "0.9.1",
+  "version": "0.11.0",
   "description": "Lightweight inline content editing for developer-owned Next.js sites.",
   "license": "ISC",
   "type": "module",
-  "sideEffects": false,
+  "sideEffects": [
+    "**/*.css"
+  ],
   "types": "./dist/index.d.ts",
   "exports": {
     ".": {
@@ -20,6 +22,7 @@
       "types": "./dist/index.client.d.ts",
       "default": "./dist/index.client.js"
     },
+    "./styles.css": "./dist/react/guardrail.css",
     "./adapters/supabase": {
       "types": "./dist/adapters/supabase/index.d.ts",
       "default": "./dist/adapters/supabase/index.js"
@@ -28,12 +31,12 @@
   },
   "files": [
     "dist",
-    "supabase",
-    "scripts"
+    "supabase"
   ],
   "bin": {
     "guardrail-seed-user": "dist/cli/seed-user.js",
-    "guardrail-init-db": "dist/cli/init-db.js"
+    "guardrail-init-db": "dist/cli/init-db.js",
+    "guardrail-doctor": "dist/cli/doctor.js"
   },
   "publishConfig": {
     "access": "public"
@@ -41,7 +44,7 @@
   "peerDependencies": {
     "@supabase/ssr": ">=0.8.0 <1",
     "@supabase/supabase-js": "^2.0.0",
-    "next": ">=15",
+    "next": "^15.5.28 || >=16.4.1",
     "react": ">=19"
   },
   "peerDependenciesMeta": {
@@ -58,7 +61,7 @@
     "@types/node": "^25.1.0",
     "@types/react": "^19.2.10",
     "@types/react-dom": "^19.3.0",
-    "next": "16.1.6",
+    "next": "16.4.3",
     "react": "^19.2.4",
     "tsup": "^8.5.1",
     "typescript": "^5.9.3"
@@ -66,7 +69,6 @@
   "scripts": {
     "build": "tsup",
     "dev": "tsup --watch",
-    "typecheck": "tsc --noEmit",
-    "postinstall": "node scripts/postinstall.mjs"
+    "typecheck": "tsc --noEmit"
   }
 }

package/supabase/admin/check-grants.sql

@@ -0,0 +1,41 @@
+-- Read-only. Reports every Guardrail privilege that is MISSING or EXTRA, so an
+-- empty result means the schema matches what the migration grants.
+with expected(role, object, priv) as (values
+  -- schema
+  ('anon','schema guardrail','USAGE'), ('authenticated','schema guardrail','USAGE'), ('service_role','schema guardrail','USAGE'),
+  -- gr_content: public read; signed-in and service_role write
+  ('anon','gr_content','SELECT'),
+  ('authenticated','gr_content','SELECT'), ('authenticated','gr_content','INSERT'), ('authenticated','gr_content','UPDATE'), ('authenticated','gr_content','DELETE'),
+  ('service_role','gr_content','SELECT'), ('service_role','gr_content','INSERT'), ('service_role','gr_content','UPDATE'), ('service_role','gr_content','DELETE'),
+  -- gr_repeater_items: same shape
+  ('anon','gr_repeater_items','SELECT'),
+  ('authenticated','gr_repeater_items','SELECT'), ('authenticated','gr_repeater_items','INSERT'), ('authenticated','gr_repeater_items','UPDATE'), ('authenticated','gr_repeater_items','DELETE'),
+  ('service_role','gr_repeater_items','SELECT'), ('service_role','gr_repeater_items','INSERT'), ('service_role','gr_repeater_items','UPDATE'), ('service_role','gr_repeater_items','DELETE'),
+  -- gr_members: never readable by anon
+  ('authenticated','gr_members','SELECT'), ('authenticated','gr_members','INSERT'), ('authenticated','gr_members','UPDATE'), ('authenticated','gr_members','DELETE'),
+  ('service_role','gr_members','SELECT'), ('service_role','gr_members','INSERT'), ('service_role','gr_members','UPDATE'), ('service_role','gr_members','DELETE'),
+  -- functions
+  ('authenticated','fn gr_has_role','EXECUTE'), ('authenticated','fn gr_claim_invite','EXECUTE'), ('authenticated','fn gr_ensure_bucket','EXECUTE')
+),
+actual(role, object, priv) as (
+  select r.rolname, t.tbl, p.priv
+  from (values ('anon'),('authenticated'),('service_role')) r(rolname)
+  cross join (values ('gr_content'),('gr_members'),('gr_repeater_items')) t(tbl)
+  cross join (values ('SELECT'),('INSERT'),('UPDATE'),('DELETE')) p(priv)
+  where to_regclass('guardrail.'||t.tbl) is not null
+    and has_table_privilege(r.rolname, 'guardrail.'||t.tbl, p.priv)
+  union all
+  select r.rolname, 'schema guardrail', 'USAGE'
+  from (values ('anon'),('authenticated'),('service_role')) r(rolname)
+  where has_schema_privilege(r.rolname, 'guardrail', 'USAGE')
+  union all
+  select r.rolname, 'fn '||f.fn, 'EXECUTE'
+  from (values ('anon'),('authenticated'),('service_role')) r(rolname)
+  cross join (values ('gr_has_role(text,text[])','gr_has_role'),('gr_claim_invite(text)','gr_claim_invite'),('gr_ensure_bucket(text)','gr_ensure_bucket')) f(sig, fn)
+  where to_regprocedure('guardrail.'||f.sig) is not null
+    and has_function_privilege(r.rolname, 'guardrail.'||f.sig, 'EXECUTE')
+)
+select 'MISSING' as problem, role, object, priv from (select * from expected except select * from actual) m
+union all
+select 'EXTRA', role, object, priv from (select * from actual except select * from expected) x
+order by 1, 2, 3, 4;

package/supabase/migrations/20261028000000_require_confirmed_email.sql

@@ -0,0 +1,53 @@
+-- Identity by confirmed email only.
+--
+-- The init migration matched an invitation to a person by the `email` claim in
+-- their JWT. That claim is only as trustworthy as the project's signup
+-- settings: where an address can be registered without being confirmed, anyone
+-- could sign up as an invited admin's address and claim the invitation (or read
+-- the roster row addressed to it). This reads the address from auth.users
+-- instead, and only once Supabase has confirmed the person controls it.
+--
+-- Safe to re-run; changes no data.
+
+create or replace function guardrail.gr_confirmed_email()
+returns text
+language sql
+stable
+security definer
+set search_path = pg_temp
+as $$
+  select lower(u.email)
+    from auth.users u
+   where u.id = auth.uid()
+     and u.email_confirmed_at is not null;
+$$;
+
+revoke all on function guardrail.gr_confirmed_email() from public;
+grant execute on function guardrail.gr_confirmed_email() to authenticated;
+
+drop policy if exists "members read their own site roster" on guardrail.gr_members;
+create policy "members read their own site roster"
+  on guardrail.gr_members for select
+  to authenticated
+  using (
+    user_id = auth.uid()
+    or lower(email) = guardrail.gr_confirmed_email()
+    or guardrail.gr_has_role(site_id, array['admin', 'editor'])
+  );
+
+create or replace function guardrail.gr_claim_invite(target_site text)
+returns void
+language sql
+security definer
+set search_path = guardrail, pg_temp
+as $$
+  update guardrail.gr_members
+     set user_id = auth.uid(),
+         status  = 'active'
+   where site_id = target_site
+     and lower(email) = guardrail.gr_confirmed_email()
+     and status = 'pending';
+$$;
+
+revoke all on function guardrail.gr_claim_invite(text) from public;
+grant execute on function guardrail.gr_claim_invite(text) to authenticated;

package/supabase/migrations/20261028010000_rate_limits.sql

@@ -0,0 +1,67 @@
+-- Rate-limit counters, for the Supabase rate limiter that ships with
+-- @guard-rail/core (used automatically when the adapter has a service-role key).
+--
+-- One row per (limit, caller) bucket, fixed window. gr_rate_hit() counts an
+-- attempt and says whether it is still within the limit, in a single atomic
+-- statement, so concurrent requests can't both read "under the limit".
+--
+-- Callable by service_role only. It has to be: sign-in and "Forgot password?"
+-- happen with no session, and handing anyone (anon included) the ability to
+-- bump arbitrary counters would let them lock other people out. The table
+-- itself is unreachable through the Data API.
+
+create table if not exists guardrail.gr_rate_limits (
+  bucket       text primary key,
+  window_start timestamptz not null default now(),
+  expires_at   timestamptz not null,
+  hits         integer not null default 0
+);
+
+alter table guardrail.gr_rate_limits enable row level security;
+-- No policies on purpose: no role but the definer function (and service_role,
+-- which bypasses RLS) can read or write it.
+revoke all on guardrail.gr_rate_limits from public, anon, authenticated;
+grant select, insert, update, delete on guardrail.gr_rate_limits to service_role;
+
+create index if not exists gr_rate_limits_expires_idx on guardrail.gr_rate_limits (expires_at);
+
+create or replace function guardrail.gr_rate_hit(
+  p_name text,
+  p_key text,
+  p_limit integer,
+  p_window_seconds integer
+)
+returns table (allowed boolean, retry_after_seconds integer)
+language plpgsql
+security definer
+set search_path = guardrail, pg_temp
+as $$
+declare
+  v_bucket text := p_name || '|' || p_key;
+  v_window interval := make_interval(secs => p_window_seconds);
+  v_hits   integer;
+  v_expires timestamptz;
+begin
+  -- Start a fresh window if the old one has run out; otherwise count into it.
+  insert into guardrail.gr_rate_limits as t (bucket, window_start, expires_at, hits)
+  values (v_bucket, now(), now() + v_window, 1)
+  on conflict (bucket) do update
+     set window_start = case when t.expires_at <= now() then now() else t.window_start end,
+         expires_at   = case when t.expires_at <= now() then now() + v_window else t.expires_at end,
+         hits         = case when t.expires_at <= now() then 1 else t.hits + 1 end
+  returning t.hits, t.expires_at into v_hits, v_expires;
+
+  -- Housekeeping, on roughly 1 call in 50, so the table doesn't grow forever.
+  if random() < 0.02 then
+    delete from guardrail.gr_rate_limits where expires_at < now() - interval '1 hour';
+  end if;
+
+  return query select
+    v_hits <= p_limit,
+    case when v_hits <= p_limit then 0
+         else greatest(1, ceil(extract(epoch from (v_expires - now())))::integer) end;
+end;
+$$;
+
+revoke all on function guardrail.gr_rate_hit(text, text, integer, integer) from public, anon, authenticated;
+grant execute on function guardrail.gr_rate_hit(text, text, integer, integer) to service_role;

package/supabase/migrations/20261028020000_member_and_bucket_guards.sql

@@ -0,0 +1,96 @@
+-- Two guards that used to live only in application code.
+--
+-- Safe to re-run; changes no data.
+
+/* ------------------------------------------------------ last admin --- */
+-- "A site must keep at least one admin" was enforced by the Server Action, but
+-- an admin talking to the Data API directly could delete or demote the last one
+-- and leave the site with nobody able to manage it. This enforces it where the
+-- data is. It applies to signed-in users only: service_role, the SQL editor and
+-- migrations (no auth.uid()) can still do whatever maintenance they need.
+create or replace function guardrail.gr_keep_one_admin()
+returns trigger
+language plpgsql
+security definer
+set search_path = guardrail, pg_temp
+as $$
+begin
+  if auth.uid() is null then
+    return coalesce(new, old);
+  end if;
+
+  if old.role = 'admin' and old.status = 'active'
+     and (
+       tg_op = 'DELETE'
+       or new.role <> 'admin'
+       or new.status <> 'active'
+       or new.site_id is distinct from old.site_id
+     )
+     and not exists (
+       select 1
+         from guardrail.gr_members m
+        where m.site_id = old.site_id
+          and m.role    = 'admin'
+          and m.status  = 'active'
+          and m.email  <> old.email
+     )
+  then
+    raise exception 'A site must keep at least one active admin.'
+      using errcode = '23514';
+  end if;
+
+  return coalesce(new, old);
+end;
+$$;
+
+revoke all on function guardrail.gr_keep_one_admin() from public;
+
+drop trigger if exists gr_keep_one_admin on guardrail.gr_members;
+create trigger gr_keep_one_admin
+  before update or delete on guardrail.gr_members
+  for each row execute function guardrail.gr_keep_one_admin();
+
+/* ------------------------------------------------------ bucket cap --- */
+-- Any editor can call gr_ensure_bucket(), which meant they could create 'gr-'
+-- buckets without limit. Existing buckets are untouched and still resolve; only
+-- creating a new one past the cap is refused.
+create or replace function guardrail.gr_ensure_bucket(target_bucket text)
+returns void
+language plpgsql
+security definer
+set search_path = guardrail, pg_temp
+as $$
+begin
+  if target_bucket !~ '^gr-[a-z0-9][a-z0-9-]{0,50}$' then
+    raise exception 'Guardrail bucket names must start with gr- and use a-z, 0-9, hyphens: %',
+      target_bucket;
+  end if;
+
+  if not exists (
+    select 1 from guardrail.gr_members
+    where user_id = auth.uid()
+      and status  = 'active'
+      and role in ('admin', 'editor')
+  ) then
+    raise exception 'Only Guardrail editors can create media buckets';
+  end if;
+
+  if not exists (select 1 from storage.buckets where id = target_bucket)
+     and (select count(*) from storage.buckets where id like 'gr-%') >= 50 then
+    raise exception 'This project already has the maximum number of Guardrail media buckets (50).';
+  end if;
+
+  insert into storage.buckets (id, name, public, file_size_limit, allowed_mime_types)
+  values (
+    target_bucket,
+    target_bucket,
+    true,
+    10485760,
+    array['image/png', 'image/jpeg', 'image/webp', 'image/gif', 'image/avif']
+  )
+  on conflict (id) do nothing;
+end;
+$$;
+
+revoke all on function guardrail.gr_ensure_bucket(text) from public;
+grant execute on function guardrail.gr_ensure_bucket(text) to authenticated;