@guard-rail/core 0.9.1 → 0.11.0

package/dist/core/validate.js

@@ -0,0 +1,118 @@
+const OVERRIDE_TYPES = ["text", "link", "image", "button"];
+const LIMITS = {
+  pathKey: 200,
+  text: 2e4,
+  url: 2048,
+  alt: 1e3,
+  dimension: 2e4
+};
+const CONTROL_CHARS = /[\u0000-\u001f\u007f]/;
+const SCHEME = /^([a-z][a-z0-9+.\-]*):/i;
+const LINK_SCHEMES = ["http", "https", "mailto", "tel"];
+const IMAGE_SCHEMES = ["http", "https"];
+function allowedUrl(raw, schemes) {
+  if (typeof raw !== "string") return null;
+  const value = raw.trim();
+  if (!value || value.length > LIMITS.url || CONTROL_CHARS.test(value)) return null;
+  const scheme = value.replace(/\s/g, "").match(SCHEME)?.[1]?.toLowerCase();
+  if (scheme && !schemes.includes(scheme)) return null;
+  return value;
+}
+function safeHref(raw) {
+  return allowedUrl(raw, LINK_SCHEMES);
+}
+function safeImageSrc(raw) {
+  return allowedUrl(raw, IMAGE_SCHEMES);
+}
+function validPathKey(raw) {
+  if (typeof raw !== "string") return null;
+  const key = raw.trim();
+  return key && key.length <= LIMITS.pathKey && !CONTROL_CHARS.test(key) ? key : null;
+}
+function validateOverrideValue(input) {
+  if (!input || typeof input !== "object" || Array.isArray(input)) {
+    return { ok: false, error: "Invalid value." };
+  }
+  const v = input;
+  if (typeof v.type !== "string" || !OVERRIDE_TYPES.includes(v.type)) {
+    return { ok: false, error: `Unknown field type "${String(v.type)}".` };
+  }
+  const out = { type: v.type };
+  if (v.text !== void 0) {
+    if (typeof v.text !== "string" || v.text.length > LIMITS.text) {
+      return { ok: false, error: `Text must be a string under ${LIMITS.text} characters.` };
+    }
+    out.text = v.text;
+  }
+  if (v.alt !== void 0) {
+    if (typeof v.alt !== "string" || v.alt.length > LIMITS.alt) {
+      return { ok: false, error: `Alt text must be under ${LIMITS.alt} characters.` };
+    }
+    out.alt = v.alt;
+  }
+  if (v.href !== void 0 && v.href !== "") {
+    const href = safeHref(v.href);
+    if (href === null) {
+      return {
+        ok: false,
+        error: "That link isn't allowed. Use a path like /about, or an http(s), mailto or tel address."
+      };
+    }
+    out.href = href;
+  } else if (v.href === "") {
+    out.href = "";
+  }
+  if (v.src !== void 0 && v.src !== "") {
+    const src = safeImageSrc(v.src);
+    if (src === null) {
+      return { ok: false, error: "That image address isn't allowed. Use a path or an http(s) URL." };
+    }
+    out.src = src;
+  } else if (v.src === "") {
+    out.src = "";
+  }
+  for (const key of ["width", "height"]) {
+    const n = v[key];
+    if (n === void 0) continue;
+    if (typeof n !== "number" || !Number.isFinite(n) || n <= 0 || n > LIMITS.dimension) {
+      return { ok: false, error: `Image ${key} is out of range.` };
+    }
+    out[key] = Math.round(n);
+  }
+  return { ok: true, value: out };
+}
+const EMAIL_PATTERN = /^[^@\s]+@[^@\s]+\.[^@\s]+$/;
+function cleanEmail(raw) {
+  if (typeof raw !== "string") return null;
+  const email = raw.trim().toLowerCase();
+  return email.length <= 254 && !CONTROL_CHARS.test(email) && EMAIL_PATTERN.test(email) ? email : null;
+}
+function isRole(raw) {
+  return raw === "admin" || raw === "editor";
+}
+function validId(raw) {
+  return typeof raw === "string" && raw.length > 0 && raw.length <= LIMITS.pathKey && !CONTROL_CHARS.test(raw) ? raw : null;
+}
+function validIdList(raw, max = 1e3) {
+  if (!Array.isArray(raw) || raw.length > max) return null;
+  const out = [];
+  for (const item of raw) {
+    const id = validId(item);
+    if (id === null) return null;
+    out.push(id);
+  }
+  return out;
+}
+export {
+  LIMITS,
+  OVERRIDE_TYPES,
+  cleanEmail,
+  isRole,
+  safeHref,
+  safeImageSrc,
+  validId,
+  validIdList,
+  validPathKey,
+  validateOverrideValue
+};
+//# sourceMappingURL=validate.js.map

package/dist/core/validate.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/core/validate.ts"],"sourcesContent":["import type { GRRole, OverrideType, OverrideValue } from \"./types\";\n\n/**\n * Checks on field values before they are stored and again before they are\n * rendered. Pure and dependency-free, so the same rules run on the server (what\n * may be written) and in the renderer (what rows already in the table may do).\n *\n * Why it matters: an editor types these, a visitor's browser then acts on them.\n * A link whose href is `javascript:...` is a script that runs for whoever\n * clicks it, so a low-privilege editor account must not be able to store one.\n */\n\nexport const OVERRIDE_TYPES: readonly OverrideType[] = [\"text\", \"link\", \"image\", \"button\"];\n\nexport const LIMITS = {\n  pathKey: 200,\n  text: 20_000,\n  url: 2_048,\n  alt: 1_000,\n  dimension: 20_000,\n} as const;\n\nconst CONTROL_CHARS = /[\\u0000-\\u001f\\u007f]/;\nconst SCHEME = /^([a-z][a-z0-9+.\\-]*):/i;\n\nconst LINK_SCHEMES = [\"http\", \"https\", \"mailto\", \"tel\"];\nconst IMAGE_SCHEMES = [\"http\", \"https\"];\n\nfunction allowedUrl(raw: unknown, schemes: readonly string[]): string | null {\n  if (typeof raw !== \"string\") return null;\n  const value = raw.trim();\n  if (!value || value.length > LIMITS.url || CONTROL_CHARS.test(value)) return null;\n  // A browser ignores whitespace inside a scheme (\"java\\tscript:\"), so look for\n  // one with it removed. Control characters are already refused above.\n  const scheme = value.replace(/\\s/g, \"\").match(SCHEME)?.[1]?.toLowerCase();\n  if (scheme && !schemes.includes(scheme)) return null;\n  return value;\n}\n\n/** The link, if it is a relative path, an anchor, or http(s)/mailto/tel; otherwise null. */\nexport function safeHref(raw: unknown): string | null {\n  return allowedUrl(raw, LINK_SCHEMES);\n}\n\n/** The image address, if it is relative or http(s); otherwise null. */\nexport function safeImageSrc(raw: unknown): string | null {\n  return allowedUrl(raw, IMAGE_SCHEMES);\n}\n\nexport function validPathKey(raw: unknown): string | null {\n  if (typeof raw !== \"string\") return null;\n  const key = raw.trim();\n  return key && key.length <= LIMITS.pathKey && !CONTROL_CHARS.test(key) ? key : null;\n}\n\ntype Checked = { ok: true; value: OverrideValue } | { ok: false; error: string };\n\n/**\n * Validates a value from the browser and returns a clean copy: only known\n * fields, only the right shapes, bounded sizes. Anything else is an error, not\n * silently dropped, so a bad write fails visibly.\n */\nexport function validateOverrideValue(input: unknown): Checked {\n  if (!input || typeof input !== \"object\" || Array.isArray(input)) {\n    return { ok: false, error: \"Invalid value.\" };\n  }\n  const v = input as Record<string, unknown>;\n  if (typeof v.type !== \"string\" || !OVERRIDE_TYPES.includes(v.type as OverrideType)) {\n    return { ok: false, error: `Unknown field type \"${String(v.type)}\".` };\n  }\n  const out: OverrideValue = { type: v.type as OverrideType };\n\n  if (v.text !== undefined) {\n    if (typeof v.text !== \"string\" || v.text.length > LIMITS.text) {\n      return { ok: false, error: `Text must be a string under ${LIMITS.text} characters.` };\n    }\n    out.text = v.text;\n  }\n  if (v.alt !== undefined) {\n    if (typeof v.alt !== \"string\" || v.alt.length > LIMITS.alt) {\n      return { ok: false, error: `Alt text must be under ${LIMITS.alt} characters.` };\n    }\n    out.alt = v.alt;\n  }\n  if (v.href !== undefined && v.href !== \"\") {\n    const href = safeHref(v.href);\n    if (href === null) {\n      return {\n        ok: false,\n        error: \"That link isn't allowed. Use a path like /about, or an http(s), mailto or tel address.\",\n      };\n    }\n    out.href = href;\n  } else if (v.href === \"\") {\n    out.href = \"\";\n  }\n  if (v.src !== undefined && v.src !== \"\") {\n    const src = safeImageSrc(v.src);\n    if (src === null) {\n      return { ok: false, error: \"That image address isn't allowed. Use a path or an http(s) URL.\" };\n    }\n    out.src = src;\n  } else if (v.src === \"\") {\n    out.src = \"\";\n  }\n  for (const key of [\"width\", \"height\"] as const) {\n    const n = v[key];\n    if (n === undefined) continue;\n    if (typeof n !== \"number\" || !Number.isFinite(n) || n <= 0 || n > LIMITS.dimension) {\n      return { ok: false, error: `Image ${key} is out of range.` };\n    }\n    out[key] = Math.round(n);\n  }\n  return { ok: true, value: out };\n}\n\nconst EMAIL_PATTERN = /^[^@\\s]+@[^@\\s]+\\.[^@\\s]+$/;\n\n/** A normalized (trimmed, lower-cased) address, or null if it isn't a plausible one. RFC 5321 caps an address at 254 characters. */\nexport function cleanEmail(raw: unknown): string | null {\n  if (typeof raw !== \"string\") return null;\n  const email = raw.trim().toLowerCase();\n  return email.length <= 254 && !CONTROL_CHARS.test(email) && EMAIL_PATTERN.test(email) ? email : null;\n}\n\nexport function isRole(raw: unknown): raw is GRRole {\n  return raw === \"admin\" || raw === \"editor\";\n}\n\n/** An identifier from the browser (a repeater or item id): a bounded string without control characters. */\nexport function validId(raw: unknown): string | null {\n  return typeof raw === \"string\" && raw.length > 0 && raw.length <= LIMITS.pathKey && !CONTROL_CHARS.test(raw)\n    ? raw\n    : null;\n}\n\n/** A list of ids: an array of valid ids, no longer than `max`. */\nexport function validIdList(raw: unknown, max = 1_000): string[] | null {\n  if (!Array.isArray(raw) || raw.length > max) return null;\n  const out: string[] = [];\n  for (const item of raw) {\n    const id = validId(item);\n    if (id === null) return null;\n    out.push(id);\n  }\n  return out;\n}\n"],"mappings":"AAYO,MAAM,iBAA0C,CAAC,QAAQ,QAAQ,SAAS,QAAQ;AAElF,MAAM,SAAS;AAAA,EACpB,SAAS;AAAA,EACT,MAAM;AAAA,EACN,KAAK;AAAA,EACL,KAAK;AAAA,EACL,WAAW;AACb;AAEA,MAAM,gBAAgB;AACtB,MAAM,SAAS;AAEf,MAAM,eAAe,CAAC,QAAQ,SAAS,UAAU,KAAK;AACtD,MAAM,gBAAgB,CAAC,QAAQ,OAAO;AAEtC,SAAS,WAAW,KAAc,SAA2C;AAC3E,MAAI,OAAO,QAAQ,SAAU,QAAO;AACpC,QAAM,QAAQ,IAAI,KAAK;AACvB,MAAI,CAAC,SAAS,MAAM,SAAS,OAAO,OAAO,cAAc,KAAK,KAAK,EAAG,QAAO;AAG7E,QAAM,SAAS,MAAM,QAAQ,OAAO,EAAE,EAAE,MAAM,MAAM,IAAI,CAAC,GAAG,YAAY;AACxE,MAAI,UAAU,CAAC,QAAQ,SAAS,MAAM,EAAG,QAAO;AAChD,SAAO;AACT;AAGO,SAAS,SAAS,KAA6B;AACpD,SAAO,WAAW,KAAK,YAAY;AACrC;AAGO,SAAS,aAAa,KAA6B;AACxD,SAAO,WAAW,KAAK,aAAa;AACtC;AAEO,SAAS,aAAa,KAA6B;AACxD,MAAI,OAAO,QAAQ,SAAU,QAAO;AACpC,QAAM,MAAM,IAAI,KAAK;AACrB,SAAO,OAAO,IAAI,UAAU,OAAO,WAAW,CAAC,cAAc,KAAK,GAAG,IAAI,MAAM;AACjF;AASO,SAAS,sBAAsB,OAAyB;AAC7D,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAAG;AAC/D,WAAO,EAAE,IAAI,OAAO,OAAO,iBAAiB;AAAA,EAC9C;AACA,QAAM,IAAI;AACV,MAAI,OAAO,EAAE,SAAS,YAAY,CAAC,eAAe,SAAS,EAAE,IAAoB,GAAG;AAClF,WAAO,EAAE,IAAI,OAAO,OAAO,uBAAuB,OAAO,EAAE,IAAI,CAAC,KAAK;AAAA,EACvE;AACA,QAAM,MAAqB,EAAE,MAAM,EAAE,KAAqB;AAE1D,MAAI,EAAE,SAAS,QAAW;AACxB,QAAI,OAAO,EAAE,SAAS,YAAY,EAAE,KAAK,SAAS,OAAO,MAAM;AAC7D,aAAO,EAAE,IAAI,OAAO,OAAO,+BAA+B,OAAO,IAAI,eAAe;AAAA,IACtF;AACA,QAAI,OAAO,EAAE;AAAA,EACf;AACA,MAAI,EAAE,QAAQ,QAAW;AACvB,QAAI,OAAO,EAAE,QAAQ,YAAY,EAAE,IAAI,SAAS,OAAO,KAAK;AAC1D,aAAO,EAAE,IAAI,OAAO,OAAO,0BAA0B,OAAO,GAAG,eAAe;AAAA,IAChF;AACA,QAAI,MAAM,EAAE;AAAA,EACd;AACA,MAAI,EAAE,SAAS,UAAa,EAAE,SAAS,IAAI;AACzC,UAAM,OAAO,SAAS,EAAE,IAAI;AAC5B,QAAI,SAAS,MAAM;AACjB,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,MACT;AAAA,IACF;AACA,QAAI,OAAO;AAAA,EACb,WAAW,EAAE,SAAS,IAAI;AACxB,QAAI,OAAO;AAAA,EACb;AACA,MAAI,EAAE,QAAQ,UAAa,EAAE,QAAQ,IAAI;AACvC,UAAM,MAAM,aAAa,EAAE,GAAG;AAC9B,QAAI,QAAQ,MAAM;AAChB,aAAO,EAAE,IAAI,OAAO,OAAO,kEAAkE;AAAA,IAC/F;AACA,QAAI,MAAM;AAAA,EACZ,WAAW,EAAE,QAAQ,IAAI;AACvB,QAAI,MAAM;AAAA,EACZ;AACA,aAAW,OAAO,CAAC,SAAS,QAAQ,GAAY;AAC9C,UAAM,IAAI,EAAE,GAAG;AACf,QAAI,MAAM,OAAW;AACrB,QAAI,OAAO,MAAM,YAAY,CAAC,OAAO,SAAS,CAAC,KAAK,KAAK,KAAK,IAAI,OAAO,WAAW;AAClF,aAAO,EAAE,IAAI,OAAO,OAAO,SAAS,GAAG,oBAAoB;AAAA,IAC7D;AACA,QAAI,GAAG,IAAI,KAAK,MAAM,CAAC;AAAA,EACzB;AACA,SAAO,EAAE,IAAI,MAAM,OAAO,IAAI;AAChC;AAEA,MAAM,gBAAgB;AAGf,SAAS,WAAW,KAA6B;AACtD,MAAI,OAAO,QAAQ,SAAU,QAAO;AACpC,QAAM,QAAQ,IAAI,KAAK,EAAE,YAAY;AACrC,SAAO,MAAM,UAAU,OAAO,CAAC,cAAc,KAAK,KAAK,KAAK,cAAc,KAAK,KAAK,IAAI,QAAQ;AAClG;AAEO,SAAS,OAAO,KAA6B;AAClD,SAAO,QAAQ,WAAW,QAAQ;AACpC;AAGO,SAAS,QAAQ,KAA6B;AACnD,SAAO,OAAO,QAAQ,YAAY,IAAI,SAAS,KAAK,IAAI,UAAU,OAAO,WAAW,CAAC,cAAc,KAAK,GAAG,IACvG,MACA;AACN;AAGO,SAAS,YAAY,KAAc,MAAM,KAAwB;AACtE,MAAI,CAAC,MAAM,QAAQ,GAAG,KAAK,IAAI,SAAS,IAAK,QAAO;AACpD,QAAM,MAAgB,CAAC;AACvB,aAAW,QAAQ,KAAK;AACtB,UAAM,KAAK,QAAQ,IAAI;AACvB,QAAI,OAAO,KAAM,QAAO;AACxB,QAAI,KAAK,EAAE;AAAA,EACb;AACA,SAAO;AACT;","names":[]}

package/dist/index.client.d.ts

@@ -1,11 +1,12 @@
 export { GRail } from './react/GRail/universal.js';
 export { useGRail } from './react/Provider.js';
+export { GRCspDirectives, GRCspOptions, cspString, guardrailCspDirectives } from './core/csp.js';
 export { createAssetUpload, forgotPasswordAction, inviteMember, listAssets, listTeam, removeMember, sendPasswordResetAction, setFieldValue, setPasswordAction, skipSetPasswordAction, updateMemberRole } from './server/actions.js';
 export { addRepeaterItem, removeRepeaterItem, reorderRepeaterItems } from './server/repeaterActions.js';
 export { GRepeaterProps, RepeaterItemProps } from './react/Repeater/index.js';
 export { ResendEmailOptions, ResendInviteContent, ResendInviteOptions, ResendInviteTemplateEvent, ResendResetTemplateEvent } from './email/resend.js';
 export { ActionState, GRAsset, GRMember, GRRepeaterItem, GRRole, GRState, GRViewer, HTMLKeys, OverrideRow, OverrideType, OverrideValue, PolymorphicProps, SetPasswordState } from './core/types.js';
-export { AuthRedirectParams, AuthResult, GRAuthAdapter, GRConfig, GRDBAdapter, GRInviteEvent, GRMembershipAdapter, GRPasswordResetEvent, GRPrefetch, GRRepeaterAdapter, GRSession, GRStorageAdapter, GRStorageRow, GRUploadTarget } from './core/adapter-types.js';
+export { AuthRedirectParams, AuthResult, GRAuthAdapter, GRConfig, GRDBAdapter, GRInviteEvent, GRMembershipAdapter, GRPasswordResetEvent, GRPrefetch, GRRateLimitHit, GRRateLimitName, GRRateLimiter, GRRepeaterAdapter, GRSession, GRStorageAdapter, GRStorageRow, GRUploadTarget } from './core/adapter-types.js';
 import 'react/jsx-runtime';
 import 'react';
 

package/dist/index.client.js

@@ -1,5 +1,6 @@
 import { GRail } from "./react/GRail/universal";
 import { useGRail } from "./react/Provider";
+import { guardrailCspDirectives, cspString } from "./core/csp";
 import {
   listTeam,
   inviteMember,
@@ -81,9 +82,11 @@ export {
   configureGuardrail,
   consoleEmails,
   createAssetUpload,
+  cspString,
   forgotPasswordAction,
   getFieldValue,
   getRepeaterItemBySlug,
+  guardrailCspDirectives,
   inviteMember,
   isAdmin,
   isEditor,

package/dist/index.client.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.client.ts"],"sourcesContent":["// Client-graph entry. `import ... from \"@guard-rail/core\"` resolves here from a\n// Client Component (see \"exports\" in package.json) and to ./index from a\n// Server Component, so an app uses one import path everywhere.\n//\n// Nothing server-only may be imported here — this is bundled for the browser.\n// Server Actions are fine: a \"use server\" module is replaced by references in\n// the client bundle, which is what lets an app build its own team/repeater UI\n// in a Client Component.\n\nexport { GRail } from \"./react/GRail/universal\";\nexport { useGRail } from \"./react/Provider\";\n\nexport {\n  listTeam,\n  inviteMember,\n  updateMemberRole,\n  removeMember,\n  createAssetUpload,\n  listAssets,\n  setPasswordAction,\n  skipSetPasswordAction,\n  forgotPasswordAction,\n  sendPasswordResetAction,\n  setFieldValue,\n} from \"./server/actions\";\nexport {\n  addRepeaterItem,\n  removeRepeaterItem,\n  reorderRepeaterItems,\n} from \"./server/repeaterActions\";\n\n/**\n * Stand-ins for the server-only exports, so importing one from a Client\n * Component fails with an explanation instead of an undefined-is-not-a-function\n * deep in a render. Also what a tool that doesn't set the \"react-server\"\n * condition (a test runner, a plain Node script) gets from the package root —\n * `@guard-rail/core/server` is the explicit path to the real ones there.\n */\nfunction serverOnly(name: string, hint: string) {\n  return (..._args: unknown[]): never => {\n    throw new Error(\n      `Guardrail: ${name} only works in a Server Component. ${hint} ` +\n        `(If this isn't a Client Component, your tooling may not set the ` +\n        `\"react-server\" condition — import from \"@guard-rail/core/server\" instead.)`,\n    );\n  };\n}\n\nexport const withGuardrail = serverOnly(\n  \"withGuardrail()\",\n  \"Call it in your root layout, which is a Server Component.\",\n);\nexport const configureGuardrail = serverOnly(\n  \"configureGuardrail()\",\n  \"Configuration is applied by withGuardrail() in your root layout.\",\n);\nexport const GRepeater = serverOnly(\n  \"<GRepeater>\",\n  \"Render it in a Server Component and pass it into this one as children or a prop.\",\n);\nexport const listRepeaterItems = serverOnly(\n  \"listRepeaterItems()\",\n  \"Read repeater items in a Server Component and pass them down.\",\n);\nexport const getRepeaterItemBySlug = serverOnly(\n  \"getRepeaterItemBySlug()\",\n  \"Resolve the item in a Server Component (your [slug]/page.tsx) and pass it down.\",\n);\nexport const getFieldValue = serverOnly(\n  \"getFieldValue()\",\n  \"Read the value in a Server Component and pass it down as a prop.\",\n);\nexport const isAdmin = serverOnly(\n  \"isAdmin()\",\n  \"Call it inside your own Server Action to authorize it; in a Client Component, read useGRail().role to decide what to show.\",\n);\nexport const isEditor = serverOnly(\n  \"isEditor()\",\n  \"Call it inside your own Server Action to authorize it; in a Client Component, read useGRail().role to decide what to show.\",\n);\nexport const canEdit = serverOnly(\n  \"canEdit()\",\n  \"Call it in a Server Component; in a Client Component, read `canEdit` from useGRail().\",\n);\nexport const resendInvite = serverOnly(\n  \"resendInvite()\",\n  \"Pass it as onInvite in withGuardrail(), which runs in your root layout.\",\n);\nexport const resendEmails = serverOnly(\n  \"resendEmails()\",\n  \"Spread it into withGuardrail(), which runs in your root layout.\",\n);\nexport const consoleEmails = serverOnly(\n  \"consoleEmails()\",\n  \"Spread it into withGuardrail(), which runs in your root layout.\",\n);\n\nexport type { GRepeaterProps, RepeaterItemProps } from \"./react/Repeater\";\nexport type {\n  ResendInviteOptions,\n  ResendEmailOptions,\n  ResendInviteContent,\n  ResendInviteTemplateEvent,\n  ResendResetTemplateEvent,\n} from \"./email/resend\";\nexport type {\n  GRState,\n  GRRole,\n  GRMember,\n  GRViewer,\n  GRAsset,\n  GRRepeaterItem,\n  ActionState,\n  SetPasswordState,\n  OverrideRow,\n  OverrideValue,\n  OverrideType,\n  PolymorphicProps,\n  HTMLKeys,\n} from \"./core/types\";\nexport type {\n  GRConfig,\n  GRPrefetch,\n  GRMembershipAdapter,\n  GRInviteEvent,\n  GRStorageAdapter,\n  GRUploadTarget,\n  GRRepeaterAdapter,\n  GRDBAdapter,\n  GRAuthAdapter,\n  GRSession,\n  GRStorageRow,\n  AuthResult,\n  AuthRedirectParams,\n  GRPasswordResetEvent,\n} from \"./core/adapter-types\";\n"],"mappings":"AASA,SAAS,aAAa;AACtB,SAAS,gBAAgB;AAEzB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AASP,SAAS,WAAW,MAAc,MAAc;AAC9C,SAAO,IAAI,UAA4B;AACrC,UAAM,IAAI;AAAA,MACR,cAAc,IAAI,sCAAsC,IAAI;AAAA,IAG9D;AAAA,EACF;AACF;AAEO,MAAM,gBAAgB;AAAA,EAC3B;AAAA,EACA;AACF;AACO,MAAM,qBAAqB;AAAA,EAChC;AAAA,EACA;AACF;AACO,MAAM,YAAY;AAAA,EACvB;AAAA,EACA;AACF;AACO,MAAM,oBAAoB;AAAA,EAC/B;AAAA,EACA;AACF;AACO,MAAM,wBAAwB;AAAA,EACnC;AAAA,EACA;AACF;AACO,MAAM,gBAAgB;AAAA,EAC3B;AAAA,EACA;AACF;AACO,MAAM,UAAU;AAAA,EACrB;AAAA,EACA;AACF;AACO,MAAM,WAAW;AAAA,EACtB;AAAA,EACA;AACF;AACO,MAAM,UAAU;AAAA,EACrB;AAAA,EACA;AACF;AACO,MAAM,eAAe;AAAA,EAC1B;AAAA,EACA;AACF;AACO,MAAM,eAAe;AAAA,EAC1B;AAAA,EACA;AACF;AACO,MAAM,gBAAgB;AAAA,EAC3B;AAAA,EACA;AACF;","names":[]}
+{"version":3,"sources":["../src/index.client.ts"],"sourcesContent":["// Client-graph entry. `import ... from \"@guard-rail/core\"` resolves here from a\n// Client Component (see \"exports\" in package.json) and to ./index from a\n// Server Component, so an app uses one import path everywhere.\n//\n// Nothing server-only may be imported here — this is bundled for the browser.\n// Server Actions are fine: a \"use server\" module is replaced by references in\n// the client bundle, which is what lets an app build its own team/repeater UI\n// in a Client Component.\n\nexport { GRail } from \"./react/GRail/universal\";\nexport { useGRail } from \"./react/Provider\";\n// What a strict Content-Security-Policy has to allow for the editing chrome.\nexport { guardrailCspDirectives, cspString } from \"./core/csp\";\nexport type { GRCspDirectives, GRCspOptions } from \"./core/csp\";\n\nexport {\n  listTeam,\n  inviteMember,\n  updateMemberRole,\n  removeMember,\n  createAssetUpload,\n  listAssets,\n  setPasswordAction,\n  skipSetPasswordAction,\n  forgotPasswordAction,\n  sendPasswordResetAction,\n  setFieldValue,\n} from \"./server/actions\";\nexport {\n  addRepeaterItem,\n  removeRepeaterItem,\n  reorderRepeaterItems,\n} from \"./server/repeaterActions\";\n\n/**\n * Stand-ins for the server-only exports, so importing one from a Client\n * Component fails with an explanation instead of an undefined-is-not-a-function\n * deep in a render. Also what a tool that doesn't set the \"react-server\"\n * condition (a test runner, a plain Node script) gets from the package root —\n * `@guard-rail/core/server` is the explicit path to the real ones there.\n */\nfunction serverOnly(name: string, hint: string) {\n  return (..._args: unknown[]): never => {\n    throw new Error(\n      `Guardrail: ${name} only works in a Server Component. ${hint} ` +\n        `(If this isn't a Client Component, your tooling may not set the ` +\n        `\"react-server\" condition — import from \"@guard-rail/core/server\" instead.)`,\n    );\n  };\n}\n\nexport const withGuardrail = serverOnly(\n  \"withGuardrail()\",\n  \"Call it in your root layout, which is a Server Component.\",\n);\nexport const configureGuardrail = serverOnly(\n  \"configureGuardrail()\",\n  \"Configuration is applied by withGuardrail() in your root layout.\",\n);\nexport const GRepeater = serverOnly(\n  \"<GRepeater>\",\n  \"Render it in a Server Component and pass it into this one as children or a prop.\",\n);\nexport const listRepeaterItems = serverOnly(\n  \"listRepeaterItems()\",\n  \"Read repeater items in a Server Component and pass them down.\",\n);\nexport const getRepeaterItemBySlug = serverOnly(\n  \"getRepeaterItemBySlug()\",\n  \"Resolve the item in a Server Component (your [slug]/page.tsx) and pass it down.\",\n);\nexport const getFieldValue = serverOnly(\n  \"getFieldValue()\",\n  \"Read the value in a Server Component and pass it down as a prop.\",\n);\nexport const isAdmin = serverOnly(\n  \"isAdmin()\",\n  \"Call it inside your own Server Action to authorize it; in a Client Component, read useGRail().role to decide what to show.\",\n);\nexport const isEditor = serverOnly(\n  \"isEditor()\",\n  \"Call it inside your own Server Action to authorize it; in a Client Component, read useGRail().role to decide what to show.\",\n);\nexport const canEdit = serverOnly(\n  \"canEdit()\",\n  \"Call it in a Server Component; in a Client Component, read `canEdit` from useGRail().\",\n);\nexport const resendInvite = serverOnly(\n  \"resendInvite()\",\n  \"Pass it as onInvite in withGuardrail(), which runs in your root layout.\",\n);\nexport const resendEmails = serverOnly(\n  \"resendEmails()\",\n  \"Spread it into withGuardrail(), which runs in your root layout.\",\n);\nexport const consoleEmails = serverOnly(\n  \"consoleEmails()\",\n  \"Spread it into withGuardrail(), which runs in your root layout.\",\n);\n\nexport type { GRepeaterProps, RepeaterItemProps } from \"./react/Repeater\";\nexport type {\n  ResendInviteOptions,\n  ResendEmailOptions,\n  ResendInviteContent,\n  ResendInviteTemplateEvent,\n  ResendResetTemplateEvent,\n} from \"./email/resend\";\nexport type {\n  GRState,\n  GRRole,\n  GRMember,\n  GRViewer,\n  GRAsset,\n  GRRepeaterItem,\n  ActionState,\n  SetPasswordState,\n  OverrideRow,\n  OverrideValue,\n  OverrideType,\n  PolymorphicProps,\n  HTMLKeys,\n} from \"./core/types\";\nexport type {\n  GRConfig,\n  GRPrefetch,\n  GRMembershipAdapter,\n  GRInviteEvent,\n  GRStorageAdapter,\n  GRUploadTarget,\n  GRRepeaterAdapter,\n  GRDBAdapter,\n  GRAuthAdapter,\n  GRSession,\n  GRStorageRow,\n  AuthResult,\n  AuthRedirectParams,\n  GRPasswordResetEvent,\n  GRRateLimiter,\n  GRRateLimitHit,\n  GRRateLimitName,\n} from \"./core/adapter-types\";\n"],"mappings":"AASA,SAAS,aAAa;AACtB,SAAS,gBAAgB;AAEzB,SAAS,wBAAwB,iBAAiB;AAGlD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AASP,SAAS,WAAW,MAAc,MAAc;AAC9C,SAAO,IAAI,UAA4B;AACrC,UAAM,IAAI;AAAA,MACR,cAAc,IAAI,sCAAsC,IAAI;AAAA,IAG9D;AAAA,EACF;AACF;AAEO,MAAM,gBAAgB;AAAA,EAC3B;AAAA,EACA;AACF;AACO,MAAM,qBAAqB;AAAA,EAChC;AAAA,EACA;AACF;AACO,MAAM,YAAY;AAAA,EACvB;AAAA,EACA;AACF;AACO,MAAM,oBAAoB;AAAA,EAC/B;AAAA,EACA;AACF;AACO,MAAM,wBAAwB;AAAA,EACnC;AAAA,EACA;AACF;AACO,MAAM,gBAAgB;AAAA,EAC3B;AAAA,EACA;AACF;AACO,MAAM,UAAU;AAAA,EACrB;AAAA,EACA;AACF;AACO,MAAM,WAAW;AAAA,EACtB;AAAA,EACA;AACF;AACO,MAAM,UAAU;AAAA,EACrB;AAAA,EACA;AACF;AACO,MAAM,eAAe;AAAA,EAC1B;AAAA,EACA;AACF;AACO,MAAM,eAAe;AAAA,EAC1B;AAAA,EACA;AACF;AACO,MAAM,gBAAgB;AAAA,EAC3B;AAAA,EACA;AACF;","names":[]}

package/dist/index.d.ts

@@ -10,7 +10,8 @@ export { ResendEmailOptions, ResendInviteContent, ResendInviteOptions, ResendInv
 export { consoleEmails } from './email/console.js';
 export { addRepeaterItem, removeRepeaterItem, reorderRepeaterItems } from './server/repeaterActions.js';
 export { useGRail } from './react/Provider.js';
+export { GRCspDirectives, GRCspOptions, cspString, guardrailCspDirectives } from './core/csp.js';
 export { ActionState, GRAsset, GRMember, GRRepeaterItem, GRRole, GRState, GRViewer, HTMLKeys, OverrideRow, OverrideType, OverrideValue, PolymorphicProps, SetPasswordState } from './core/types.js';
-export { AuthRedirectParams, AuthResult, GRAuthAdapter, GRConfig, GRDBAdapter, GRInviteEvent, GRMembershipAdapter, GRPasswordResetEvent, GRPrefetch, GRRepeaterAdapter, GRSession, GRStorageAdapter, GRStorageRow, GRUploadTarget } from './core/adapter-types.js';
+export { AuthRedirectParams, AuthResult, GRAuthAdapter, GRConfig, GRDBAdapter, GRInviteEvent, GRMembershipAdapter, GRPasswordResetEvent, GRPrefetch, GRRateLimitHit, GRRateLimitName, GRRateLimiter, GRRepeaterAdapter, GRSession, GRStorageAdapter, GRStorageRow, GRUploadTarget } from './core/adapter-types.js';
 import 'react/jsx-runtime';
 import 'react';

package/dist/index.js

@@ -29,6 +29,7 @@ import {
   reorderRepeaterItems
 } from "./server/repeaterActions";
 import { useGRail } from "./react/Provider";
+import { guardrailCspDirectives, cspString } from "./core/csp";
 export {
   GRail,
   GRepeater,
@@ -37,9 +38,11 @@ export {
   configureGuardrail,
   consoleEmails,
   createAssetUpload,
+  cspString,
   forgotPasswordAction,
   getFieldValue,
   getRepeaterItemBySlug,
+  guardrailCspDirectives,
   inviteMember,
   isAdmin,
   isEditor,

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"sourcesContent":["// Server-safe entry. Client components are reached through the files that\n// carry their own \"use client\" directive, so importing this from a Server\n// Component does not pull the editor into the client bundle.\nexport { withGuardrail } from \"./server/wrapper\";\n\n// Team management and the set-password step, exported so an app can build\n// its own UI instead of using the bundled drawer / sign-in bar.\nexport {\n  listTeam,\n  inviteMember,\n  updateMemberRole,\n  removeMember,\n  createAssetUpload,\n  listAssets,\n  setPasswordAction,\n  skipSetPasswordAction,\n  forgotPasswordAction,\n  sendPasswordResetAction,\n  setFieldValue,\n} from \"./server/actions\";\nexport { GRail } from \"./react/GRail\";\nexport { GRepeater } from \"./react/Repeater\";\nexport type { GRepeaterProps, RepeaterItemProps } from \"./react/Repeater\";\nexport { configureGuardrail } from \"./core/config\";\nexport {\n  listRepeaterItems,\n  getRepeaterItemBySlug,\n} from \"./server/repeaterData\";\nexport { getFieldValue } from \"./server/fieldData\";\n// Role / edit-mode checks for a custom admin UI and the Server Actions behind\n// it. Plain server functions, not actions — see access.ts for why.\nexport { isAdmin, isEditor, canEdit } from \"./server/access\";\n// Invite delivery through Resend, as an onInvite handler — see email/resend.ts.\nexport { resendInvite, resendEmails } from \"./email/resend\";\nexport { consoleEmails } from \"./email/console\";\nexport type {\n  ResendInviteOptions,\n  ResendEmailOptions,\n  ResendInviteContent,\n  ResendInviteTemplateEvent,\n  ResendResetTemplateEvent,\n} from \"./email/resend\";\n// Mutations, exported so an app can build its own add/remove/reorder UI\n// instead of the bundled chrome — same rationale as the team actions above.\nexport {\n  addRepeaterItem,\n  removeRepeaterItem,\n  reorderRepeaterItems,\n} from \"./server/repeaterActions\";\nexport { useGRail } from \"./react/Provider\";\n\nexport type {\n  GRState,\n  GRRole,\n  GRMember,\n  GRViewer,\n  GRAsset,\n  GRRepeaterItem,\n  ActionState,\n  SetPasswordState,\n  OverrideRow,\n  OverrideValue,\n  OverrideType,\n  PolymorphicProps,\n  HTMLKeys,\n} from \"./core/types\";\nexport type {\n  GRConfig,\n  GRPrefetch,\n  GRMembershipAdapter,\n  GRInviteEvent,\n  GRStorageAdapter,\n  GRUploadTarget,\n  GRRepeaterAdapter,\n  GRDBAdapter,\n  GRAuthAdapter,\n  GRSession,\n  GRStorageRow,\n  AuthResult,\n  AuthRedirectParams,\n  GRPasswordResetEvent,\n} from \"./core/adapter-types\";\n"],"mappings":"AAGA,SAAS,qBAAqB;AAI9B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,aAAa;AACtB,SAAS,iBAAiB;AAE1B,SAAS,0BAA0B;AACnC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,qBAAqB;AAG9B,SAAS,SAAS,UAAU,eAAe;AAE3C,SAAS,cAAc,oBAAoB;AAC3C,SAAS,qBAAqB;AAU9B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,gBAAgB;","names":[]}
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["// Server-safe entry. Client components are reached through the files that\n// carry their own \"use client\" directive, so importing this from a Server\n// Component does not pull the editor into the client bundle.\nexport { withGuardrail } from \"./server/wrapper\";\n\n// Team management and the set-password step, exported so an app can build\n// its own UI instead of using the bundled drawer / sign-in bar.\nexport {\n  listTeam,\n  inviteMember,\n  updateMemberRole,\n  removeMember,\n  createAssetUpload,\n  listAssets,\n  setPasswordAction,\n  skipSetPasswordAction,\n  forgotPasswordAction,\n  sendPasswordResetAction,\n  setFieldValue,\n} from \"./server/actions\";\nexport { GRail } from \"./react/GRail\";\nexport { GRepeater } from \"./react/Repeater\";\nexport type { GRepeaterProps, RepeaterItemProps } from \"./react/Repeater\";\nexport { configureGuardrail } from \"./core/config\";\nexport {\n  listRepeaterItems,\n  getRepeaterItemBySlug,\n} from \"./server/repeaterData\";\nexport { getFieldValue } from \"./server/fieldData\";\n// Role / edit-mode checks for a custom admin UI and the Server Actions behind\n// it. Plain server functions, not actions — see access.ts for why.\nexport { isAdmin, isEditor, canEdit } from \"./server/access\";\n// Invite delivery through Resend, as an onInvite handler — see email/resend.ts.\nexport { resendInvite, resendEmails } from \"./email/resend\";\nexport { consoleEmails } from \"./email/console\";\nexport type {\n  ResendInviteOptions,\n  ResendEmailOptions,\n  ResendInviteContent,\n  ResendInviteTemplateEvent,\n  ResendResetTemplateEvent,\n} from \"./email/resend\";\n// Mutations, exported so an app can build its own add/remove/reorder UI\n// instead of the bundled chrome — same rationale as the team actions above.\nexport {\n  addRepeaterItem,\n  removeRepeaterItem,\n  reorderRepeaterItems,\n} from \"./server/repeaterActions\";\nexport { useGRail } from \"./react/Provider\";\n// What a strict Content-Security-Policy has to allow for the editing chrome.\nexport { guardrailCspDirectives, cspString } from \"./core/csp\";\nexport type { GRCspDirectives, GRCspOptions } from \"./core/csp\";\n\nexport type {\n  GRState,\n  GRRole,\n  GRMember,\n  GRViewer,\n  GRAsset,\n  GRRepeaterItem,\n  ActionState,\n  SetPasswordState,\n  OverrideRow,\n  OverrideValue,\n  OverrideType,\n  PolymorphicProps,\n  HTMLKeys,\n} from \"./core/types\";\nexport type {\n  GRConfig,\n  GRPrefetch,\n  GRMembershipAdapter,\n  GRInviteEvent,\n  GRStorageAdapter,\n  GRUploadTarget,\n  GRRepeaterAdapter,\n  GRDBAdapter,\n  GRAuthAdapter,\n  GRSession,\n  GRStorageRow,\n  AuthResult,\n  AuthRedirectParams,\n  GRPasswordResetEvent,\n  GRRateLimiter,\n  GRRateLimitHit,\n  GRRateLimitName,\n} from \"./core/adapter-types\";\n"],"mappings":"AAGA,SAAS,qBAAqB;AAI9B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,aAAa;AACtB,SAAS,iBAAiB;AAE1B,SAAS,0BAA0B;AACnC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,qBAAqB;AAG9B,SAAS,SAAS,UAAU,eAAe;AAE3C,SAAS,cAAc,oBAAoB;AAC3C,SAAS,qBAAqB;AAU9B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,gBAAgB;AAEzB,SAAS,wBAAwB,iBAAiB;","names":[]}

package/dist/react/Admin.d.ts

@@ -2,9 +2,11 @@ import * as react_jsx_runtime from 'react/jsx-runtime';
 import React__default from 'react';
 
 /**
- * Owns the theme stylesheet so every piece of chrome — the sign-in bar, the
- * toolbar, and the field popups portaled to <body> — picks up the same
- * light/dark variables from one place.
+ * Imports the chrome's stylesheet (guardrail.css), which also defines the
+ * light/dark theme variables, so every piece of chrome — the sign-in bar, the
+ * toolbar, and the field popups portaled to <body> — picks them up from one
+ * place. A stylesheet rather than inline styles so the chrome works under a
+ * strict Content-Security-Policy.
  */
 declare function GRailAdmin(props: {
     toolbarExtra?: React__default.ReactNode;

package/dist/react/Admin.js

@@ -7,16 +7,13 @@ import { useGRail } from "./Provider";
 import { TeamDrawer } from "./Team";
 import { AuthDrawer } from "./AuthDrawer";
 import { CloseIcon, LogOutIcon, PeopleIcon } from "./Icons";
-import { S, THEME_CSS, v } from "./styles";
+import "./guardrail.css";
 import { GR_COOKIES, GR_EDIT_MODE_OFF_TTL_SECONDS } from "../core/defs";
 const initialState = { email: "", password: "" };
 function GRailAdmin(props) {
   const { isEditMode } = useGRail();
   if (!isEditMode) return null;
-  return /* @__PURE__ */ jsxs(Fragment, { children: [
-    /* @__PURE__ */ jsx("style", { href: "guardrail-theme", precedence: "default", children: THEME_CSS }),
-    /* @__PURE__ */ jsx(AdminBody, { ...props })
-  ] });
+  return /* @__PURE__ */ jsx(AdminBody, { ...props });
 }
 function AdminBody({ toolbarExtra }) {
   const { isAuth, isEditMode, needsPassword, authError, role, auth } = useGRail();
@@ -60,17 +57,17 @@ function AdminBody({ toolbarExtra }) {
   if (!isAuth) {
     if (!auth.password) {
       return /* @__PURE__ */ jsxs(Fragment, { children: [
-        /* @__PURE__ */ jsx("div", { "data-guardrail": true, style: S.banner, children: /* @__PURE__ */ jsxs("div", { style: S.bannerForm, children: [
-          /* @__PURE__ */ jsxs("div", { style: S.brandStack, children: [
-            /* @__PURE__ */ jsx("span", { style: S.brand, children: "Guardrail" }),
-            !auth.signInUrl && /* @__PURE__ */ jsx("span", { style: { fontSize: 12, color: v("muted") }, children: "No sign-in method is configured for this site." })
+        /* @__PURE__ */ jsx("div", { "data-guardrail": true, className: "gr-banner", children: /* @__PURE__ */ jsxs("div", { className: "gr-banner-form", children: [
+          /* @__PURE__ */ jsxs("div", { className: "gr-brand-stack", children: [
+            /* @__PURE__ */ jsx("span", { className: "gr-brand", children: "Guardrail" }),
+            !auth.signInUrl && /* @__PURE__ */ jsx("span", { className: "gr-fs-12 gr-text-muted", children: "No sign-in method is configured for this site." })
           ] }),
-          auth.signInUrl && /* @__PURE__ */ jsx("a", { href: auth.signInUrl, style: { ...S.primaryBtn, textDecoration: "none" }, children: "Sign in" }),
+          auth.signInUrl && /* @__PURE__ */ jsx("a", { href: auth.signInUrl, className: "gr-primary-btn gr-no-underline", children: "Sign in" }),
           /* @__PURE__ */ jsx(
             "button",
             {
               type: "button",
-              style: { ...S.iconBtn, color: v("muted") },
+              className: "gr-icon-btn gr-text-muted",
               onClick: exitEditMode,
               title: "Not editing? Dismiss",
               "aria-label": "Dismiss",
@@ -82,10 +79,10 @@ function AdminBody({ toolbarExtra }) {
       ] });
     }
     return /* @__PURE__ */ jsxs(Fragment, { children: [
-      /* @__PURE__ */ jsx("div", { "data-guardrail": true, style: S.banner, children: /* @__PURE__ */ jsxs("form", { action: formAction, style: S.bannerForm, children: [
-        /* @__PURE__ */ jsxs("div", { style: S.brandStack, children: [
-          /* @__PURE__ */ jsx("span", { style: S.brand, children: "Guardrail" }),
-          formState.error && /* @__PURE__ */ jsx("span", { style: S.error, children: formState.error })
+      /* @__PURE__ */ jsx("div", { "data-guardrail": true, className: "gr-banner", children: /* @__PURE__ */ jsxs("form", { action: formAction, className: "gr-banner-form", children: [
+        /* @__PURE__ */ jsxs("div", { className: "gr-brand-stack", children: [
+          /* @__PURE__ */ jsx("span", { className: "gr-brand", children: "Guardrail" }),
+          formState.error && /* @__PURE__ */ jsx("span", { className: "gr-error", children: formState.error })
         ] }),
         /* @__PURE__ */ jsx(
           "input",
@@ -96,7 +93,7 @@ function AdminBody({ toolbarExtra }) {
             placeholder: "Email",
             defaultValue: formState.email,
             required: true,
-            style: S.input
+            className: "gr-input"
           }
         ),
         /* @__PURE__ */ jsx(
@@ -107,25 +104,16 @@ function AdminBody({ toolbarExtra }) {
             autoComplete: "current-password",
             placeholder: "Password",
             required: true,
-            style: S.input
+            className: "gr-input"
           }
         ),
-        /* @__PURE__ */ jsx("button", { type: "submit", disabled: isPending, style: S.primaryBtn, children: isPending ? "Authenticating\u2026" : "Sign In" }),
+        /* @__PURE__ */ jsx("button", { type: "submit", disabled: isPending, className: "gr-primary-btn", children: isPending ? "Authenticating\u2026" : "Sign In" }),
         /* @__PURE__ */ jsx(
           "button",
           {
             type: "button",
             onClick: () => setForgotOpen(true),
-            style: {
-              background: "none",
-              border: "none",
-              cursor: "pointer",
-              color: v("muted"),
-              fontSize: 12,
-              textDecoration: "underline",
-              padding: "0 4px",
-              whiteSpace: "nowrap"
-            },
+            className: "gr-text-btn",
             children: "Forgot password?"
           }
         ),
@@ -133,7 +121,7 @@ function AdminBody({ toolbarExtra }) {
           "button",
           {
             type: "button",
-            style: { ...S.iconBtn, color: v("muted") },
+            className: "gr-icon-btn gr-text-muted",
             onClick: exitEditMode,
             title: "Not editing? Dismiss",
             "aria-label": "Dismiss",
@@ -147,13 +135,13 @@ function AdminBody({ toolbarExtra }) {
   if (needsPassword) return /* @__PURE__ */ jsx(AuthDrawer, { mode: "set-password" });
   if (!role) {
     return /* @__PURE__ */ jsxs(Fragment, { children: [
-      /* @__PURE__ */ jsxs("div", { "data-guardrail": true, style: S.toolbar, children: [
-        /* @__PURE__ */ jsx("span", { style: S.toolbarLabel, children: "No access to this site" }),
-        /* @__PURE__ */ jsx("span", { style: S.divider }),
+      /* @__PURE__ */ jsxs("div", { "data-guardrail": true, className: "gr-toolbar", children: [
+        /* @__PURE__ */ jsx("span", { className: "gr-toolbar-label", children: "No access to this site" }),
+        /* @__PURE__ */ jsx("span", { className: "gr-divider" }),
         /* @__PURE__ */ jsx(
           "button",
           {
-            style: { ...S.iconBtn, color: v("muted") },
+            className: "gr-icon-btn gr-text-muted",
             onClick: signOut,
             title: "Sign out",
             "aria-label": "Sign out",
@@ -167,14 +155,14 @@ function AdminBody({ toolbarExtra }) {
   return /* @__PURE__ */ jsxs(Fragment, { children: [
     linkErrorDrawer,
     teamOpen && /* @__PURE__ */ jsx(TeamDrawer, { onClose: () => setTeamOpen(false) }),
-    /* @__PURE__ */ jsxs("div", { "data-guardrail": true, style: S.toolbar, children: [
-      /* @__PURE__ */ jsx("span", { style: S.dot }),
-      /* @__PURE__ */ jsx("span", { style: S.toolbarLabel, children: "Edit Mode" }),
-      /* @__PURE__ */ jsx("span", { style: S.divider }),
+    /* @__PURE__ */ jsxs("div", { "data-guardrail": true, className: "gr-toolbar", children: [
+      /* @__PURE__ */ jsx("span", { className: "gr-dot" }),
+      /* @__PURE__ */ jsx("span", { className: "gr-toolbar-label", children: "Edit Mode" }),
+      /* @__PURE__ */ jsx("span", { className: "gr-divider" }),
       /* @__PURE__ */ jsx(
         "button",
         {
-          style: { ...S.iconBtn, color: v("muted"), width: 24, height: 24 },
+          className: "gr-icon-btn gr-text-muted gr-size-24",
           onClick: () => setTeamOpen(true),
           title: "Team",
           "aria-label": "Team",
@@ -182,14 +170,14 @@ function AdminBody({ toolbarExtra }) {
         }
       ),
       toolbarExtra && /* @__PURE__ */ jsxs(Fragment, { children: [
-        /* @__PURE__ */ jsx("span", { style: S.divider }),
+        /* @__PURE__ */ jsx("span", { className: "gr-divider" }),
         toolbarExtra
       ] }),
-      /* @__PURE__ */ jsx("span", { style: S.divider }),
+      /* @__PURE__ */ jsx("span", { className: "gr-divider" }),
       /* @__PURE__ */ jsx(
         "button",
         {
-          style: { ...S.iconBtn, color: v("muted") },
+          className: "gr-icon-btn gr-text-muted",
           onClick: exitEditMode,
           title: "Exit edit mode",
           "aria-label": "Exit edit mode",

package/dist/react/Admin.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/react/Admin.tsx"],"sourcesContent":["\"use client\";\n\nimport React, { useActionState, useEffect, useState } from \"react\";\nimport { usePathname, useRouter } from \"next/navigation\";\nimport { loginAction, logoutAction } from \"../server/actions\";\nimport { useGRail } from \"./Provider\";\nimport { TeamDrawer } from \"./Team\";\nimport { AuthDrawer } from \"./AuthDrawer\";\nimport { CloseIcon, LogOutIcon, PeopleIcon } from \"./Icons\";\nimport { S, THEME_CSS, v } from \"./styles\";\nimport { GR_COOKIES, GR_EDIT_MODE_OFF_TTL_SECONDS } from \"../core/defs\";\nimport type { ActionState } from \"../core/types\";\n\nconst initialState: ActionState = { email: \"\", password: \"\" };\n\n/**\n * Owns the theme stylesheet so every piece of chrome — the sign-in bar, the\n * toolbar, and the field popups portaled to <body> — picks up the same\n * light/dark variables from one place.\n */\nexport function GRailAdmin(props: { toolbarExtra?: React.ReactNode }) {\n  const { isEditMode } = useGRail();\n  if (!isEditMode) return null;\n  return (\n    <>\n      {/*\n        precedence + href make React hoist this into <head> and dedupe it.\n        Required, not cosmetic: this whole component renders as a sibling of\n        <html> (withGuardrail can't reach inside the app's own layout), and\n        React 19 rejects a bare <style> anywhere outside the main document.\n      */}\n      <style href=\"guardrail-theme\" precedence=\"default\">\n        {THEME_CSS}\n      </style>\n      <AdminBody {...props} />\n    </>\n  );\n}\n\nfunction AdminBody({ toolbarExtra }: { toolbarExtra?: React.ReactNode }) {\n  const { isAuth, isEditMode, needsPassword, authError, role, auth } = useGRail();\n  const [teamOpen, setTeamOpen] = useState(false);\n  const [forgotOpen, setForgotOpen] = useState(false);\n  const [errorDismissed, setErrorDismissed] = useState(false);\n  const [formState, formAction, isPending] = useActionState(\n    loginAction,\n    initialState,\n  );\n  const router = useRouter();\n  const pathname = usePathname();\n\n  useEffect(() => {\n    if (formState.success) router.refresh();\n  }, [formState.success, router]);\n\n  // The message for an emailed link that didn't work. The cookie behind it is\n  // read on the server, so dismissing clears it there too (and refreshes), but\n  // hides it right away without waiting for that.\n  const dismissAuthError = () => {\n    document.cookie = `${GR_COOKIES.AUTH_ERROR}=; path=/; max-age=0; SameSite=Lax`;\n    setErrorDismissed(true);\n    router.refresh();\n  };\n  const linkErrorDrawer =\n    authError && !errorDismissed ? (\n      <AuthDrawer\n        mode=\"forgot\"\n        title=\"That link didn't work\"\n        message={\n          authError === \"expired\"\n            ? \"It has expired or was already used. Links work once. Enter your email to get a new one.\"\n            : \"We couldn't complete it. Enter your email to get a new link.\"\n        }\n        onClose={dismissAuthError}\n      />\n    ) : null;\n\n  // Ends the editing session, not the sign-in: the overlay goes away and the\n  // person's session stays, so ?edit=true brings it straight back with no\n  // credentials. The sign-in form only returns once the session itself is\n  // gone (expired, or ended elsewhere). Explicit \"false\" rather than deleting\n  // the cookie: with a live session, deleting it would leave edit mode on —\n  // see resolveEditMode. router.replace drops ?edit=true from the URL (a bare\n  // refresh would leave it there), and refresh re-renders without chrome.\n  //\n  // Also what the sign-in bar's dismiss button does, for someone who was never\n  // authenticated and doesn't want to be here at all.\n  const exitEditMode = () => {\n    document.cookie = `${GR_COOKIES.EDIT_MODE}=false; path=/; max-age=${GR_EDIT_MODE_OFF_TTL_SECONDS}; SameSite=Lax`;\n    router.replace(pathname);\n    router.refresh();\n  };\n\n  // A real sign-out, kept only for the \"no access\" bar below: someone on the\n  // wrong account has no other way to switch to the right one. logoutAction()\n  // clears the edit-mode cookie itself — a client-side navigation right after\n  // it used to race Next's own post-action route refresh and lose.\n  const signOut = async () => {\n    await logoutAction();\n    router.replace(pathname);\n    router.refresh();\n  };\n\n  // No intent signalled — render nothing at all.\n  if (!isEditMode) return null;\n\n  if (!isAuth) {\n    // The adapter cannot take a password here, so hand sign-in off rather than\n    // showing a form that could never succeed.\n    if (!auth.password) {\n      return (\n        <>\n          <div data-guardrail style={S.banner}>\n            <div style={S.bannerForm}>\n              <div style={S.brandStack}>\n                <span style={S.brand}>Guardrail</span>\n                {!auth.signInUrl && (\n                  <span style={{ fontSize: 12, color: v(\"muted\") }}>\n                    No sign-in method is configured for this site.\n                  </span>\n                )}\n              </div>\n              {auth.signInUrl && (\n                <a href={auth.signInUrl} style={{ ...S.primaryBtn, textDecoration: \"none\" }}>\n                  Sign in\n                </a>\n              )}\n              <button\n                type=\"button\"\n                style={{ ...S.iconBtn, color: v(\"muted\") }}\n                onClick={exitEditMode}\n                title=\"Not editing? Dismiss\"\n                aria-label=\"Dismiss\"\n              >\n                <CloseIcon />\n              </button>\n            </div>\n          </div>\n          {linkErrorDrawer}\n        </>\n      );\n    }\n\n    return (\n      <>\n        <div data-guardrail style={S.banner}>\n          <form action={formAction} style={S.bannerForm}>\n            <div style={S.brandStack}>\n              <span style={S.brand}>Guardrail</span>\n              {formState.error && <span style={S.error}>{formState.error}</span>}\n            </div>\n            <input\n              name=\"email\"\n              type=\"email\"\n              autoComplete=\"email\"\n              placeholder=\"Email\"\n              defaultValue={formState.email}\n              required\n              style={S.input}\n            />\n            <input\n              name=\"password\"\n              type=\"password\"\n              autoComplete=\"current-password\"\n              placeholder=\"Password\"\n              required\n              style={S.input}\n            />\n            <button type=\"submit\" disabled={isPending} style={S.primaryBtn}>\n              {isPending ? \"Authenticating…\" : \"Sign In\"}\n            </button>\n            <button\n              type=\"button\"\n              onClick={() => setForgotOpen(true)}\n              style={{\n                background: \"none\",\n                border: \"none\",\n                cursor: \"pointer\",\n                color: v(\"muted\"),\n                fontSize: 12,\n                textDecoration: \"underline\",\n                padding: \"0 4px\",\n                whiteSpace: \"nowrap\",\n              }}\n            >\n              Forgot password?\n            </button>\n            <button\n              type=\"button\"\n              style={{ ...S.iconBtn, color: v(\"muted\") }}\n              onClick={exitEditMode}\n              title=\"Not editing? Dismiss\"\n              aria-label=\"Dismiss\"\n            >\n              <CloseIcon />\n            </button>\n          </form>\n        </div>\n        {linkErrorDrawer ??\n          (forgotOpen && <AuthDrawer mode=\"forgot\" onClose={() => setForgotOpen(false)} />)}\n      </>\n    );\n  }\n\n  // An invite or password-reset link just completed: they're signed in, but must\n  // choose a password before anything else. Ahead of the role check below —\n  // getCachedViewer() already claims a pending invite as a side effect of\n  // resolving them, so the role is normally set by now; this is purely about the\n  // password. Not skippable: a password is the only way back in once this\n  // session ends, so the overlay and toolbar wait until one exists.\n  if (needsPassword) return <AuthDrawer mode=\"set-password\" />;\n\n  // Signed in, but holds no role on this site.\n  if (!role) {\n    return (\n      <>\n        <div data-guardrail style={S.toolbar}>\n          <span style={S.toolbarLabel}>No access to this site</span>\n          <span style={S.divider} />\n          <button\n            style={{ ...S.iconBtn, color: v(\"muted\") }}\n            onClick={signOut}\n            title=\"Sign out\"\n            aria-label=\"Sign out\"\n          >\n            <LogOutIcon />\n          </button>\n        </div>\n        {linkErrorDrawer}\n      </>\n    );\n  }\n\n  return (\n    <>\n      {linkErrorDrawer}\n      {teamOpen && <TeamDrawer onClose={() => setTeamOpen(false)} />}\n      <div data-guardrail style={S.toolbar}>\n        <span style={S.dot} />\n        <span style={S.toolbarLabel}>Edit Mode</span>\n        <span style={S.divider} />\n        <button\n          style={{ ...S.iconBtn, color: v(\"muted\"), width: 24, height: 24 }}\n          onClick={() => setTeamOpen(true)}\n          title=\"Team\"\n          aria-label=\"Team\"\n        >\n          <PeopleIcon />\n        </button>\n\n        {toolbarExtra && (\n          <>\n            <span style={S.divider} />\n            {toolbarExtra}\n          </>\n        )}\n\n        <span style={S.divider} />\n        <button\n          style={{ ...S.iconBtn, color: v(\"muted\") }}\n          onClick={exitEditMode}\n          title=\"Exit edit mode\"\n          aria-label=\"Exit edit mode\"\n        >\n          <LogOutIcon />\n        </button>\n      </div>\n    </>\n  );\n}\n"],"mappings":";AAwBI,mBAOE,KAPF;AAtBJ,OAAO,SAAS,gBAAgB,WAAW,gBAAgB;AAC3D,SAAS,aAAa,iBAAiB;AACvC,SAAS,aAAa,oBAAoB;AAC1C,SAAS,gBAAgB;AACzB,SAAS,kBAAkB;AAC3B,SAAS,kBAAkB;AAC3B,SAAS,WAAW,YAAY,kBAAkB;AAClD,SAAS,GAAG,WAAW,SAAS;AAChC,SAAS,YAAY,oCAAoC;AAGzD,MAAM,eAA4B,EAAE,OAAO,IAAI,UAAU,GAAG;AAOrD,SAAS,WAAW,OAA2C;AACpE,QAAM,EAAE,WAAW,IAAI,SAAS;AAChC,MAAI,CAAC,WAAY,QAAO;AACxB,SACE,iCAOE;AAAA,wBAAC,WAAM,MAAK,mBAAkB,YAAW,WACtC,qBACH;AAAA,IACA,oBAAC,aAAW,GAAG,OAAO;AAAA,KACxB;AAEJ;AAEA,SAAS,UAAU,EAAE,aAAa,GAAuC;AACvE,QAAM,EAAE,QAAQ,YAAY,eAAe,WAAW,MAAM,KAAK,IAAI,SAAS;AAC9E,QAAM,CAAC,UAAU,WAAW,IAAI,SAAS,KAAK;AAC9C,QAAM,CAAC,YAAY,aAAa,IAAI,SAAS,KAAK;AAClD,QAAM,CAAC,gBAAgB,iBAAiB,IAAI,SAAS,KAAK;AAC1D,QAAM,CAAC,WAAW,YAAY,SAAS,IAAI;AAAA,IACzC;AAAA,IACA;AAAA,EACF;AACA,QAAM,SAAS,UAAU;AACzB,QAAM,WAAW,YAAY;AAE7B,YAAU,MAAM;AACd,QAAI,UAAU,QAAS,QAAO,QAAQ;AAAA,EACxC,GAAG,CAAC,UAAU,SAAS,MAAM,CAAC;AAK9B,QAAM,mBAAmB,MAAM;AAC7B,aAAS,SAAS,GAAG,WAAW,UAAU;AAC1C,sBAAkB,IAAI;AACtB,WAAO,QAAQ;AAAA,EACjB;AACA,QAAM,kBACJ,aAAa,CAAC,iBACZ;AAAA,IAAC;AAAA;AAAA,MACC,MAAK;AAAA,MACL,OAAM;AAAA,MACN,SACE,cAAc,YACV,4FACA;AAAA,MAEN,SAAS;AAAA;AAAA,EACX,IACE;AAYN,QAAM,eAAe,MAAM;AACzB,aAAS,SAAS,GAAG,WAAW,SAAS,2BAA2B,4BAA4B;AAChG,WAAO,QAAQ,QAAQ;AACvB,WAAO,QAAQ;AAAA,EACjB;AAMA,QAAM,UAAU,YAAY;AAC1B,UAAM,aAAa;AACnB,WAAO,QAAQ,QAAQ;AACvB,WAAO,QAAQ;AAAA,EACjB;AAGA,MAAI,CAAC,WAAY,QAAO;AAExB,MAAI,CAAC,QAAQ;AAGX,QAAI,CAAC,KAAK,UAAU;AAClB,aACE,iCACE;AAAA,4BAAC,SAAI,kBAAc,MAAC,OAAO,EAAE,QAC3B,+BAAC,SAAI,OAAO,EAAE,YACZ;AAAA,+BAAC,SAAI,OAAO,EAAE,YACZ;AAAA,gCAAC,UAAK,OAAO,EAAE,OAAO,uBAAS;AAAA,YAC9B,CAAC,KAAK,aACL,oBAAC,UAAK,OAAO,EAAE,UAAU,IAAI,OAAO,EAAE,OAAO,EAAE,GAAG,4DAElD;AAAA,aAEJ;AAAA,UACC,KAAK,aACJ,oBAAC,OAAE,MAAM,KAAK,WAAW,OAAO,EAAE,GAAG,EAAE,YAAY,gBAAgB,OAAO,GAAG,qBAE7E;AAAA,UAEF;AAAA,YAAC;AAAA;AAAA,cACC,MAAK;AAAA,cACL,OAAO,EAAE,GAAG,EAAE,SAAS,OAAO,EAAE,OAAO,EAAE;AAAA,cACzC,SAAS;AAAA,cACT,OAAM;AAAA,cACN,cAAW;AAAA,cAEX,8BAAC,aAAU;AAAA;AAAA,UACb;AAAA,WACF,GACF;AAAA,QACC;AAAA,SACH;AAAA,IAEJ;AAEA,WACE,iCACE;AAAA,0BAAC,SAAI,kBAAc,MAAC,OAAO,EAAE,QAC3B,+BAAC,UAAK,QAAQ,YAAY,OAAO,EAAE,YACjC;AAAA,6BAAC,SAAI,OAAO,EAAE,YACZ;AAAA,8BAAC,UAAK,OAAO,EAAE,OAAO,uBAAS;AAAA,UAC9B,UAAU,SAAS,oBAAC,UAAK,OAAO,EAAE,OAAQ,oBAAU,OAAM;AAAA,WAC7D;AAAA,QACA;AAAA,UAAC;AAAA;AAAA,YACC,MAAK;AAAA,YACL,MAAK;AAAA,YACL,cAAa;AAAA,YACb,aAAY;AAAA,YACZ,cAAc,UAAU;AAAA,YACxB,UAAQ;AAAA,YACR,OAAO,EAAE;AAAA;AAAA,QACX;AAAA,QACA;AAAA,UAAC;AAAA;AAAA,YACC,MAAK;AAAA,YACL,MAAK;AAAA,YACL,cAAa;AAAA,YACb,aAAY;AAAA,YACZ,UAAQ;AAAA,YACR,OAAO,EAAE;AAAA;AAAA,QACX;AAAA,QACA,oBAAC,YAAO,MAAK,UAAS,UAAU,WAAW,OAAO,EAAE,YACjD,sBAAY,yBAAoB,WACnC;AAAA,QACA;AAAA,UAAC;AAAA;AAAA,YACC,MAAK;AAAA,YACL,SAAS,MAAM,cAAc,IAAI;AAAA,YACjC,OAAO;AAAA,cACL,YAAY;AAAA,cACZ,QAAQ;AAAA,cACR,QAAQ;AAAA,cACR,OAAO,EAAE,OAAO;AAAA,cAChB,UAAU;AAAA,cACV,gBAAgB;AAAA,cAChB,SAAS;AAAA,cACT,YAAY;AAAA,YACd;AAAA,YACD;AAAA;AAAA,QAED;AAAA,QACA;AAAA,UAAC;AAAA;AAAA,YACC,MAAK;AAAA,YACL,OAAO,EAAE,GAAG,EAAE,SAAS,OAAO,EAAE,OAAO,EAAE;AAAA,YACzC,SAAS;AAAA,YACT,OAAM;AAAA,YACN,cAAW;AAAA,YAEX,8BAAC,aAAU;AAAA;AAAA,QACb;AAAA,SACF,GACF;AAAA,MACC,oBACE,cAAc,oBAAC,cAAW,MAAK,UAAS,SAAS,MAAM,cAAc,KAAK,GAAG;AAAA,OAClF;AAAA,EAEJ;AAQA,MAAI,cAAe,QAAO,oBAAC,cAAW,MAAK,gBAAe;AAG1D,MAAI,CAAC,MAAM;AACT,WACE,iCACE;AAAA,2BAAC,SAAI,kBAAc,MAAC,OAAO,EAAE,SAC3B;AAAA,4BAAC,UAAK,OAAO,EAAE,cAAc,oCAAsB;AAAA,QACnD,oBAAC,UAAK,OAAO,EAAE,SAAS;AAAA,QACxB;AAAA,UAAC;AAAA;AAAA,YACC,OAAO,EAAE,GAAG,EAAE,SAAS,OAAO,EAAE,OAAO,EAAE;AAAA,YACzC,SAAS;AAAA,YACT,OAAM;AAAA,YACN,cAAW;AAAA,YAEX,8BAAC,cAAW;AAAA;AAAA,QACd;AAAA,SACF;AAAA,MACC;AAAA,OACH;AAAA,EAEJ;AAEA,SACE,iCACG;AAAA;AAAA,IACA,YAAY,oBAAC,cAAW,SAAS,MAAM,YAAY,KAAK,GAAG;AAAA,IAC5D,qBAAC,SAAI,kBAAc,MAAC,OAAO,EAAE,SAC3B;AAAA,0BAAC,UAAK,OAAO,EAAE,KAAK;AAAA,MACpB,oBAAC,UAAK,OAAO,EAAE,cAAc,uBAAS;AAAA,MACtC,oBAAC,UAAK,OAAO,EAAE,SAAS;AAAA,MACxB;AAAA,QAAC;AAAA;AAAA,UACC,OAAO,EAAE,GAAG,EAAE,SAAS,OAAO,EAAE,OAAO,GAAG,OAAO,IAAI,QAAQ,GAAG;AAAA,UAChE,SAAS,MAAM,YAAY,IAAI;AAAA,UAC/B,OAAM;AAAA,UACN,cAAW;AAAA,UAEX,8BAAC,cAAW;AAAA;AAAA,MACd;AAAA,MAEC,gBACC,iCACE;AAAA,4BAAC,UAAK,OAAO,EAAE,SAAS;AAAA,QACvB;AAAA,SACH;AAAA,MAGF,oBAAC,UAAK,OAAO,EAAE,SAAS;AAAA,MACxB;AAAA,QAAC;AAAA;AAAA,UACC,OAAO,EAAE,GAAG,EAAE,SAAS,OAAO,EAAE,OAAO,EAAE;AAAA,UACzC,SAAS;AAAA,UACT,OAAM;AAAA,UACN,cAAW;AAAA,UAEX,8BAAC,cAAW;AAAA;AAAA,MACd;AAAA,OACF;AAAA,KACF;AAEJ;","names":[]}
+{"version":3,"sources":["../../src/react/Admin.tsx"],"sourcesContent":["\"use client\";\n\nimport React, { useActionState, useEffect, useState } from \"react\";\nimport { usePathname, useRouter } from \"next/navigation\";\nimport { loginAction, logoutAction } from \"../server/actions\";\nimport { useGRail } from \"./Provider\";\nimport { TeamDrawer } from \"./Team\";\nimport { AuthDrawer } from \"./AuthDrawer\";\nimport { CloseIcon, LogOutIcon, PeopleIcon } from \"./Icons\";\nimport \"./guardrail.css\";\nimport { GR_COOKIES, GR_EDIT_MODE_OFF_TTL_SECONDS } from \"../core/defs\";\nimport type { ActionState } from \"../core/types\";\n\nconst initialState: ActionState = { email: \"\", password: \"\" };\n\n/**\n * Imports the chrome's stylesheet (guardrail.css), which also defines the\n * light/dark theme variables, so every piece of chrome — the sign-in bar, the\n * toolbar, and the field popups portaled to <body> — picks them up from one\n * place. A stylesheet rather than inline styles so the chrome works under a\n * strict Content-Security-Policy.\n */\nexport function GRailAdmin(props: { toolbarExtra?: React.ReactNode }) {\n  const { isEditMode } = useGRail();\n  if (!isEditMode) return null;\n  return <AdminBody {...props} />;\n}\n\nfunction AdminBody({ toolbarExtra }: { toolbarExtra?: React.ReactNode }) {\n  const { isAuth, isEditMode, needsPassword, authError, role, auth } = useGRail();\n  const [teamOpen, setTeamOpen] = useState(false);\n  const [forgotOpen, setForgotOpen] = useState(false);\n  const [errorDismissed, setErrorDismissed] = useState(false);\n  const [formState, formAction, isPending] = useActionState(\n    loginAction,\n    initialState,\n  );\n  const router = useRouter();\n  const pathname = usePathname();\n\n  useEffect(() => {\n    if (formState.success) router.refresh();\n  }, [formState.success, router]);\n\n  // The message for an emailed link that didn't work. The cookie behind it is\n  // read on the server, so dismissing clears it there too (and refreshes), but\n  // hides it right away without waiting for that.\n  const dismissAuthError = () => {\n    document.cookie = `${GR_COOKIES.AUTH_ERROR}=; path=/; max-age=0; SameSite=Lax`;\n    setErrorDismissed(true);\n    router.refresh();\n  };\n  const linkErrorDrawer =\n    authError && !errorDismissed ? (\n      <AuthDrawer\n        mode=\"forgot\"\n        title=\"That link didn't work\"\n        message={\n          authError === \"expired\"\n            ? \"It has expired or was already used. Links work once. Enter your email to get a new one.\"\n            : \"We couldn't complete it. Enter your email to get a new link.\"\n        }\n        onClose={dismissAuthError}\n      />\n    ) : null;\n\n  // Ends the editing session, not the sign-in: the overlay goes away and the\n  // person's session stays, so ?edit=true brings it straight back with no\n  // credentials. The sign-in form only returns once the session itself is\n  // gone (expired, or ended elsewhere). Explicit \"false\" rather than deleting\n  // the cookie: with a live session, deleting it would leave edit mode on —\n  // see resolveEditMode. router.replace drops ?edit=true from the URL (a bare\n  // refresh would leave it there), and refresh re-renders without chrome.\n  //\n  // Also what the sign-in bar's dismiss button does, for someone who was never\n  // authenticated and doesn't want to be here at all.\n  const exitEditMode = () => {\n    document.cookie = `${GR_COOKIES.EDIT_MODE}=false; path=/; max-age=${GR_EDIT_MODE_OFF_TTL_SECONDS}; SameSite=Lax`;\n    router.replace(pathname);\n    router.refresh();\n  };\n\n  // A real sign-out, kept only for the \"no access\" bar below: someone on the\n  // wrong account has no other way to switch to the right one. logoutAction()\n  // clears the edit-mode cookie itself — a client-side navigation right after\n  // it used to race Next's own post-action route refresh and lose.\n  const signOut = async () => {\n    await logoutAction();\n    router.replace(pathname);\n    router.refresh();\n  };\n\n  // No intent signalled — render nothing at all.\n  if (!isEditMode) return null;\n\n  if (!isAuth) {\n    // The adapter cannot take a password here, so hand sign-in off rather than\n    // showing a form that could never succeed.\n    if (!auth.password) {\n      return (\n        <>\n          <div data-guardrail className=\"gr-banner\">\n            <div className=\"gr-banner-form\">\n              <div className=\"gr-brand-stack\">\n                <span className=\"gr-brand\">Guardrail</span>\n                {!auth.signInUrl && (\n                  <span className=\"gr-fs-12 gr-text-muted\">\n                    No sign-in method is configured for this site.\n                  </span>\n                )}\n              </div>\n              {auth.signInUrl && (\n                <a href={auth.signInUrl} className=\"gr-primary-btn gr-no-underline\">\n                  Sign in\n                </a>\n              )}\n              <button\n                type=\"button\"\n                className=\"gr-icon-btn gr-text-muted\"\n                onClick={exitEditMode}\n                title=\"Not editing? Dismiss\"\n                aria-label=\"Dismiss\"\n              >\n                <CloseIcon />\n              </button>\n            </div>\n          </div>\n          {linkErrorDrawer}\n        </>\n      );\n    }\n\n    return (\n      <>\n        <div data-guardrail className=\"gr-banner\">\n          <form action={formAction} className=\"gr-banner-form\">\n            <div className=\"gr-brand-stack\">\n              <span className=\"gr-brand\">Guardrail</span>\n              {formState.error && <span className=\"gr-error\">{formState.error}</span>}\n            </div>\n            <input\n              name=\"email\"\n              type=\"email\"\n              autoComplete=\"email\"\n              placeholder=\"Email\"\n              defaultValue={formState.email}\n              required\n              className=\"gr-input\"\n            />\n            <input\n              name=\"password\"\n              type=\"password\"\n              autoComplete=\"current-password\"\n              placeholder=\"Password\"\n              required\n              className=\"gr-input\"\n            />\n            <button type=\"submit\" disabled={isPending} className=\"gr-primary-btn\">\n              {isPending ? \"Authenticating…\" : \"Sign In\"}\n            </button>\n            <button\n              type=\"button\"\n              onClick={() => setForgotOpen(true)}\n              className=\"gr-text-btn\"\n            >\n              Forgot password?\n            </button>\n            <button\n              type=\"button\"\n              className=\"gr-icon-btn gr-text-muted\"\n              onClick={exitEditMode}\n              title=\"Not editing? Dismiss\"\n              aria-label=\"Dismiss\"\n            >\n              <CloseIcon />\n            </button>\n          </form>\n        </div>\n        {linkErrorDrawer ??\n          (forgotOpen && <AuthDrawer mode=\"forgot\" onClose={() => setForgotOpen(false)} />)}\n      </>\n    );\n  }\n\n  // An invite or password-reset link just completed: they're signed in, but must\n  // choose a password before anything else. Ahead of the role check below —\n  // getCachedViewer() already claims a pending invite as a side effect of\n  // resolving them, so the role is normally set by now; this is purely about the\n  // password. Not skippable: a password is the only way back in once this\n  // session ends, so the overlay and toolbar wait until one exists.\n  if (needsPassword) return <AuthDrawer mode=\"set-password\" />;\n\n  // Signed in, but holds no role on this site.\n  if (!role) {\n    return (\n      <>\n        <div data-guardrail className=\"gr-toolbar\">\n          <span className=\"gr-toolbar-label\">No access to this site</span>\n          <span className=\"gr-divider\" />\n          <button\n            className=\"gr-icon-btn gr-text-muted\"\n            onClick={signOut}\n            title=\"Sign out\"\n            aria-label=\"Sign out\"\n          >\n            <LogOutIcon />\n          </button>\n        </div>\n        {linkErrorDrawer}\n      </>\n    );\n  }\n\n  return (\n    <>\n      {linkErrorDrawer}\n      {teamOpen && <TeamDrawer onClose={() => setTeamOpen(false)} />}\n      <div data-guardrail className=\"gr-toolbar\">\n        <span className=\"gr-dot\" />\n        <span className=\"gr-toolbar-label\">Edit Mode</span>\n        <span className=\"gr-divider\" />\n        <button\n          className=\"gr-icon-btn gr-text-muted gr-size-24\"\n          onClick={() => setTeamOpen(true)}\n          title=\"Team\"\n          aria-label=\"Team\"\n        >\n          <PeopleIcon />\n        </button>\n\n        {toolbarExtra && (\n          <>\n            <span className=\"gr-divider\" />\n            {toolbarExtra}\n          </>\n        )}\n\n        <span className=\"gr-divider\" />\n        <button\n          className=\"gr-icon-btn gr-text-muted\"\n          onClick={exitEditMode}\n          title=\"Exit edit mode\"\n          aria-label=\"Exit edit mode\"\n        >\n          <LogOutIcon />\n        </button>\n      </div>\n    </>\n  );\n}\n"],"mappings":";AAyBS,SA2ED,UA3EC,KA8EK,YA9EL;AAvBT,OAAO,SAAS,gBAAgB,WAAW,gBAAgB;AAC3D,SAAS,aAAa,iBAAiB;AACvC,SAAS,aAAa,oBAAoB;AAC1C,SAAS,gBAAgB;AACzB,SAAS,kBAAkB;AAC3B,SAAS,kBAAkB;AAC3B,SAAS,WAAW,YAAY,kBAAkB;AAClD,OAAO;AACP,SAAS,YAAY,oCAAoC;AAGzD,MAAM,eAA4B,EAAE,OAAO,IAAI,UAAU,GAAG;AASrD,SAAS,WAAW,OAA2C;AACpE,QAAM,EAAE,WAAW,IAAI,SAAS;AAChC,MAAI,CAAC,WAAY,QAAO;AACxB,SAAO,oBAAC,aAAW,GAAG,OAAO;AAC/B;AAEA,SAAS,UAAU,EAAE,aAAa,GAAuC;AACvE,QAAM,EAAE,QAAQ,YAAY,eAAe,WAAW,MAAM,KAAK,IAAI,SAAS;AAC9E,QAAM,CAAC,UAAU,WAAW,IAAI,SAAS,KAAK;AAC9C,QAAM,CAAC,YAAY,aAAa,IAAI,SAAS,KAAK;AAClD,QAAM,CAAC,gBAAgB,iBAAiB,IAAI,SAAS,KAAK;AAC1D,QAAM,CAAC,WAAW,YAAY,SAAS,IAAI;AAAA,IACzC;AAAA,IACA;AAAA,EACF;AACA,QAAM,SAAS,UAAU;AACzB,QAAM,WAAW,YAAY;AAE7B,YAAU,MAAM;AACd,QAAI,UAAU,QAAS,QAAO,QAAQ;AAAA,EACxC,GAAG,CAAC,UAAU,SAAS,MAAM,CAAC;AAK9B,QAAM,mBAAmB,MAAM;AAC7B,aAAS,SAAS,GAAG,WAAW,UAAU;AAC1C,sBAAkB,IAAI;AACtB,WAAO,QAAQ;AAAA,EACjB;AACA,QAAM,kBACJ,aAAa,CAAC,iBACZ;AAAA,IAAC;AAAA;AAAA,MACC,MAAK;AAAA,MACL,OAAM;AAAA,MACN,SACE,cAAc,YACV,4FACA;AAAA,MAEN,SAAS;AAAA;AAAA,EACX,IACE;AAYN,QAAM,eAAe,MAAM;AACzB,aAAS,SAAS,GAAG,WAAW,SAAS,2BAA2B,4BAA4B;AAChG,WAAO,QAAQ,QAAQ;AACvB,WAAO,QAAQ;AAAA,EACjB;AAMA,QAAM,UAAU,YAAY;AAC1B,UAAM,aAAa;AACnB,WAAO,QAAQ,QAAQ;AACvB,WAAO,QAAQ;AAAA,EACjB;AAGA,MAAI,CAAC,WAAY,QAAO;AAExB,MAAI,CAAC,QAAQ;AAGX,QAAI,CAAC,KAAK,UAAU;AAClB,aACE,iCACE;AAAA,4BAAC,SAAI,kBAAc,MAAC,WAAU,aAC5B,+BAAC,SAAI,WAAU,kBACb;AAAA,+BAAC,SAAI,WAAU,kBACb;AAAA,gCAAC,UAAK,WAAU,YAAW,uBAAS;AAAA,YACnC,CAAC,KAAK,aACL,oBAAC,UAAK,WAAU,0BAAyB,4DAEzC;AAAA,aAEJ;AAAA,UACC,KAAK,aACJ,oBAAC,OAAE,MAAM,KAAK,WAAW,WAAU,kCAAiC,qBAEpE;AAAA,UAEF;AAAA,YAAC;AAAA;AAAA,cACC,MAAK;AAAA,cACL,WAAU;AAAA,cACV,SAAS;AAAA,cACT,OAAM;AAAA,cACN,cAAW;AAAA,cAEX,8BAAC,aAAU;AAAA;AAAA,UACb;AAAA,WACF,GACF;AAAA,QACC;AAAA,SACH;AAAA,IAEJ;AAEA,WACE,iCACE;AAAA,0BAAC,SAAI,kBAAc,MAAC,WAAU,aAC5B,+BAAC,UAAK,QAAQ,YAAY,WAAU,kBAClC;AAAA,6BAAC,SAAI,WAAU,kBACb;AAAA,8BAAC,UAAK,WAAU,YAAW,uBAAS;AAAA,UACnC,UAAU,SAAS,oBAAC,UAAK,WAAU,YAAY,oBAAU,OAAM;AAAA,WAClE;AAAA,QACA;AAAA,UAAC;AAAA;AAAA,YACC,MAAK;AAAA,YACL,MAAK;AAAA,YACL,cAAa;AAAA,YACb,aAAY;AAAA,YACZ,cAAc,UAAU;AAAA,YACxB,UAAQ;AAAA,YACR,WAAU;AAAA;AAAA,QACZ;AAAA,QACA;AAAA,UAAC;AAAA;AAAA,YACC,MAAK;AAAA,YACL,MAAK;AAAA,YACL,cAAa;AAAA,YACb,aAAY;AAAA,YACZ,UAAQ;AAAA,YACR,WAAU;AAAA;AAAA,QACZ;AAAA,QACA,oBAAC,YAAO,MAAK,UAAS,UAAU,WAAW,WAAU,kBAClD,sBAAY,yBAAoB,WACnC;AAAA,QACA;AAAA,UAAC;AAAA;AAAA,YACC,MAAK;AAAA,YACL,SAAS,MAAM,cAAc,IAAI;AAAA,YACjC,WAAU;AAAA,YACX;AAAA;AAAA,QAED;AAAA,QACA;AAAA,UAAC;AAAA;AAAA,YACC,MAAK;AAAA,YACL,WAAU;AAAA,YACV,SAAS;AAAA,YACT,OAAM;AAAA,YACN,cAAW;AAAA,YAEX,8BAAC,aAAU;AAAA;AAAA,QACb;AAAA,SACF,GACF;AAAA,MACC,oBACE,cAAc,oBAAC,cAAW,MAAK,UAAS,SAAS,MAAM,cAAc,KAAK,GAAG;AAAA,OAClF;AAAA,EAEJ;AAQA,MAAI,cAAe,QAAO,oBAAC,cAAW,MAAK,gBAAe;AAG1D,MAAI,CAAC,MAAM;AACT,WACE,iCACE;AAAA,2BAAC,SAAI,kBAAc,MAAC,WAAU,cAC5B;AAAA,4BAAC,UAAK,WAAU,oBAAmB,oCAAsB;AAAA,QACzD,oBAAC,UAAK,WAAU,cAAa;AAAA,QAC7B;AAAA,UAAC;AAAA;AAAA,YACC,WAAU;AAAA,YACV,SAAS;AAAA,YACT,OAAM;AAAA,YACN,cAAW;AAAA,YAEX,8BAAC,cAAW;AAAA;AAAA,QACd;AAAA,SACF;AAAA,MACC;AAAA,OACH;AAAA,EAEJ;AAEA,SACE,iCACG;AAAA;AAAA,IACA,YAAY,oBAAC,cAAW,SAAS,MAAM,YAAY,KAAK,GAAG;AAAA,IAC5D,qBAAC,SAAI,kBAAc,MAAC,WAAU,cAC5B;AAAA,0BAAC,UAAK,WAAU,UAAS;AAAA,MACzB,oBAAC,UAAK,WAAU,oBAAmB,uBAAS;AAAA,MAC5C,oBAAC,UAAK,WAAU,cAAa;AAAA,MAC7B;AAAA,QAAC;AAAA;AAAA,UACC,WAAU;AAAA,UACV,SAAS,MAAM,YAAY,IAAI;AAAA,UAC/B,OAAM;AAAA,UACN,cAAW;AAAA,UAEX,8BAAC,cAAW;AAAA;AAAA,MACd;AAAA,MAEC,gBACC,iCACE;AAAA,4BAAC,UAAK,WAAU,cAAa;AAAA,QAC5B;AAAA,SACH;AAAA,MAGF,oBAAC,UAAK,WAAU,cAAa;AAAA,MAC7B;AAAA,QAAC;AAAA;AAAA,UACC,WAAU;AAAA,UACV,SAAS;AAAA,UACT,OAAM;AAAA,UACN,cAAW;AAAA,UAEX,8BAAC,cAAW;AAAA;AAAA,MACd;AAAA,OACF;AAAA,KACF;AAEJ;","names":[]}