@realiizlabs/admin 0.11.1 → 0.13.0

package/dist/members-nhbRSYyr.d.cts

@@ -0,0 +1,106 @@
+import { SupabaseClient } from '@supabase/supabase-js';
+
+/**
+ * Types for the identity layer. All config arrives as arguments — never env.
+ */
+/**
+ * Either cookie-store shape a host can hand us:
+ *  - @supabase/ssr's CookieMethodsServer: { getAll, setAll }
+ *  - Next's `await cookies()` store:      { getAll, set }
+ * `setAll` is preferred when present; otherwise each cookie goes through `set`.
+ */
+interface CookieStore {
+    getAll(): {
+        name: string;
+        value: string;
+    }[] | Promise<{
+        name: string;
+        value: string;
+    }[]>;
+    setAll?(cookies: {
+        name: string;
+        value: string;
+        options?: Record<string, unknown>;
+    }[]): void | Promise<void>;
+    set?(name: string, value: string, options?: Record<string, unknown>): unknown;
+}
+/** Enough to read the signed-in user with the anon key + their cookies. */
+interface IdentityContext {
+    url: string;
+    anonKey: string;
+    cookies: CookieStore;
+}
+/** Server-only. The service-role key bypasses RLS; the module checks roles in code first. */
+interface ServiceContext {
+    url: string;
+    serviceRoleKey: string;
+}
+type SiteRole = "staff" | "owner" | "editor";
+declare const ROLE_RANK: Record<SiteRole, number>;
+interface IdentityUser {
+    id: string;
+    email: string | null;
+}
+interface SiteMembership {
+    userId: string;
+    siteId: string;
+    role: "owner" | "editor";
+}
+
+/**
+ * createIdentityClient — a Supabase client bound to the request's cookies.
+ *
+ * Built per request from arguments. A Next 16 route does:
+ *
+ *   const store = await cookies();
+ *   const client = createIdentityClient({ url, anonKey, cookies: store });
+ *
+ * No `next` import here. The CookieStore interface accepts either shape a
+ * host might hand us: @supabase/ssr's { getAll, setAll }, or Next's
+ * cookies() store, which has { getAll, set } — the session cookies are
+ * written through whichever exists. (Observed 2026-09-08: with only setAll
+ * supported, Next's store silently wrote nothing and every sign-in bounced.)
+ */
+
+type IdentityClient = SupabaseClient;
+declare function createIdentityClient(ctx: IdentityContext): IdentityClient;
+
+/**
+ * Per-site branding — the Business tab. Reads and writes public.sites through
+ * the signed-in user's client, so RLS decides who may (members read; owners
+ * and staff write). Nothing here needs the service role.
+ */
+
+interface SiteBranding {
+    name: string;
+    logoUrl: string | null;
+    faviconUrl: string | null;
+    businessEmail: string | null;
+    businessPhone: string | null;
+}
+type BrandingPatch = Partial<SiteBranding> & {
+    name: string;
+};
+declare function getSiteBranding(client: IdentityClient, siteId: string): Promise<SiteBranding | null>;
+/** Upsert the row. RLS refuses anyone but the site's owners or staff. */
+declare function updateSiteBranding(client: IdentityClient, siteId: string, patch: BrandingPatch): Promise<void>;
+
+/**
+ * The Team roster — public.site_members(site_id), a SECURITY DEFINER function
+ * that returns rows only to that site's owners or staff (editors get a 42501).
+ * Read with the signed-in user's client; writes are in service.ts.
+ */
+
+interface SiteMember {
+    userId: string;
+    email: string;
+    name: string | null;
+    avatarUrl: string | null;
+    role: "owner" | "editor";
+    /** "invited" until the person has signed in once. */
+    status: "invited" | "active";
+    invitedAt: string;
+}
+declare function listSiteMembers(client: IdentityClient, siteId: string): Promise<SiteMember[]>;
+
+export { type BrandingPatch as B, type CookieStore as C, type IdentityClient as I, ROLE_RANK as R, type ServiceContext as S, type IdentityUser as a, type IdentityContext as b, type SiteBranding as c, type SiteMember as d, type SiteMembership as e, type SiteRole as f, createIdentityClient as g, getSiteBranding as h, listSiteMembers as l, updateSiteBranding as u };

package/dist/members-nhbRSYyr.d.ts

@@ -0,0 +1,106 @@
+import { SupabaseClient } from '@supabase/supabase-js';
+
+/**
+ * Types for the identity layer. All config arrives as arguments — never env.
+ */
+/**
+ * Either cookie-store shape a host can hand us:
+ *  - @supabase/ssr's CookieMethodsServer: { getAll, setAll }
+ *  - Next's `await cookies()` store:      { getAll, set }
+ * `setAll` is preferred when present; otherwise each cookie goes through `set`.
+ */
+interface CookieStore {
+    getAll(): {
+        name: string;
+        value: string;
+    }[] | Promise<{
+        name: string;
+        value: string;
+    }[]>;
+    setAll?(cookies: {
+        name: string;
+        value: string;
+        options?: Record<string, unknown>;
+    }[]): void | Promise<void>;
+    set?(name: string, value: string, options?: Record<string, unknown>): unknown;
+}
+/** Enough to read the signed-in user with the anon key + their cookies. */
+interface IdentityContext {
+    url: string;
+    anonKey: string;
+    cookies: CookieStore;
+}
+/** Server-only. The service-role key bypasses RLS; the module checks roles in code first. */
+interface ServiceContext {
+    url: string;
+    serviceRoleKey: string;
+}
+type SiteRole = "staff" | "owner" | "editor";
+declare const ROLE_RANK: Record<SiteRole, number>;
+interface IdentityUser {
+    id: string;
+    email: string | null;
+}
+interface SiteMembership {
+    userId: string;
+    siteId: string;
+    role: "owner" | "editor";
+}
+
+/**
+ * createIdentityClient — a Supabase client bound to the request's cookies.
+ *
+ * Built per request from arguments. A Next 16 route does:
+ *
+ *   const store = await cookies();
+ *   const client = createIdentityClient({ url, anonKey, cookies: store });
+ *
+ * No `next` import here. The CookieStore interface accepts either shape a
+ * host might hand us: @supabase/ssr's { getAll, setAll }, or Next's
+ * cookies() store, which has { getAll, set } — the session cookies are
+ * written through whichever exists. (Observed 2026-09-08: with only setAll
+ * supported, Next's store silently wrote nothing and every sign-in bounced.)
+ */
+
+type IdentityClient = SupabaseClient;
+declare function createIdentityClient(ctx: IdentityContext): IdentityClient;
+
+/**
+ * Per-site branding — the Business tab. Reads and writes public.sites through
+ * the signed-in user's client, so RLS decides who may (members read; owners
+ * and staff write). Nothing here needs the service role.
+ */
+
+interface SiteBranding {
+    name: string;
+    logoUrl: string | null;
+    faviconUrl: string | null;
+    businessEmail: string | null;
+    businessPhone: string | null;
+}
+type BrandingPatch = Partial<SiteBranding> & {
+    name: string;
+};
+declare function getSiteBranding(client: IdentityClient, siteId: string): Promise<SiteBranding | null>;
+/** Upsert the row. RLS refuses anyone but the site's owners or staff. */
+declare function updateSiteBranding(client: IdentityClient, siteId: string, patch: BrandingPatch): Promise<void>;
+
+/**
+ * The Team roster — public.site_members(site_id), a SECURITY DEFINER function
+ * that returns rows only to that site's owners or staff (editors get a 42501).
+ * Read with the signed-in user's client; writes are in service.ts.
+ */
+
+interface SiteMember {
+    userId: string;
+    email: string;
+    name: string | null;
+    avatarUrl: string | null;
+    role: "owner" | "editor";
+    /** "invited" until the person has signed in once. */
+    status: "invited" | "active";
+    invitedAt: string;
+}
+declare function listSiteMembers(client: IdentityClient, siteId: string): Promise<SiteMember[]>;
+
+export { type BrandingPatch as B, type CookieStore as C, type IdentityClient as I, ROLE_RANK as R, type ServiceContext as S, type IdentityUser as a, type IdentityContext as b, type SiteBranding as c, type SiteMember as d, type SiteMembership as e, type SiteRole as f, createIdentityClient as g, getSiteBranding as h, listSiteMembers as l, updateSiteBranding as u };

package/dist/roles-BjWuj2_v.d.cts

@@ -0,0 +1,25 @@
+import { f as SiteRole, I as IdentityClient, a as IdentityUser } from './members-nhbRSYyr.cjs';
+
+/**
+ * Role resolution and the request gate.
+ *
+ * Two selects on the caller's OWN rows — both permitted by RLS with the anon
+ * key, so this never needs the service role. Staff wins over any site role.
+ */
+
+declare function getSiteRole(client: IdentityClient, siteId: string, userId?: string): Promise<SiteRole | null>;
+declare function roleAtLeast(actual: SiteRole | null, minimum: SiteRole): boolean;
+interface RequireOptions {
+    /** Default "editor" — any member of the site. */
+    minimumRole?: SiteRole;
+}
+/**
+ * The gate. Throws UnauthenticatedError (→ sign in) or ForbiddenError (→ 403);
+ * otherwise returns the user and their effective role for this site.
+ */
+declare function requireSiteUser(client: IdentityClient, siteId: string, opts?: RequireOptions): Promise<{
+    user: IdentityUser;
+    role: SiteRole;
+}>;
+
+export { type RequireOptions as R, roleAtLeast as a, getSiteRole as g, requireSiteUser as r };

package/dist/roles-Dnwj-DAm.d.ts

@@ -0,0 +1,25 @@
+import { f as SiteRole, I as IdentityClient, a as IdentityUser } from './members-nhbRSYyr.js';
+
+/**
+ * Role resolution and the request gate.
+ *
+ * Two selects on the caller's OWN rows — both permitted by RLS with the anon
+ * key, so this never needs the service role. Staff wins over any site role.
+ */
+
+declare function getSiteRole(client: IdentityClient, siteId: string, userId?: string): Promise<SiteRole | null>;
+declare function roleAtLeast(actual: SiteRole | null, minimum: SiteRole): boolean;
+interface RequireOptions {
+    /** Default "editor" — any member of the site. */
+    minimumRole?: SiteRole;
+}
+/**
+ * The gate. Throws UnauthenticatedError (→ sign in) or ForbiddenError (→ 403);
+ * otherwise returns the user and their effective role for this site.
+ */
+declare function requireSiteUser(client: IdentityClient, siteId: string, opts?: RequireOptions): Promise<{
+    user: IdentityUser;
+    role: SiteRole;
+}>;
+
+export { type RequireOptions as R, roleAtLeast as a, getSiteRole as g, requireSiteUser as r };

package/dist/shell/index.cjs

@@ -355,11 +355,12 @@ var SHELL_CSS = `
   .rz-btn:hover .rz-arrow, a:hover .rz-arrow { transform: translate(2px, -2px); }
   .rz-btn:hover .rz-arrow--fwd, a:hover .rz-arrow--fwd { transform: translateX(4px); }
 }
-.rz-card { background: var(--surface-1); border: 1px solid var(--border); border-radius: 8px; padding: 18px 20px; }
+.rz-card { display: flex; flex-direction: column; background: var(--surface-1); border: 1px solid var(--border); border-radius: 8px; padding: 18px 20px; }
 .rz-card--narrow { max-width: 760px; }
 .rz-card__title { font-size: .9375rem; font-weight: 600; margin-bottom: .35rem; }
 .rz-card__meta { color: var(--text-muted); font-size: .8rem; }
-.rz-card__actions { display: flex; gap: .5rem; margin-top: .9rem; flex-wrap: wrap; }
+.rz-card__actions { display: flex; gap: .5rem; margin-top: auto; padding-top: .9rem; flex-wrap: wrap; }
+.rz-card__note { margin-top: .5rem; }
 .rz-grid { display: grid; gap: 14px; grid-template-columns: repeat(auto-fill, minmax(240px, 1fr)); }
 .rz-pagehead { display: flex; align-items: flex-end; justify-content: space-between; gap: 16px; margin-bottom: 20px; flex-wrap: wrap; }
 .rz-pagehead__eyebrow { font-family: var(--rz-font-mono); font-size: .6875rem; text-transform: uppercase; letter-spacing: .08em; color: var(--text-muted); margin-bottom: .3rem; }
@@ -583,10 +584,11 @@ function OutboundArrow() {
     /* @__PURE__ */ jsxRuntime.jsx("path", { d: "M7 7h10v10" })
   ] });
 }
-function Card({ title, meta, children, actions, className }) {
+function Card({ title, meta, note, children, actions, className }) {
   return /* @__PURE__ */ jsxRuntime.jsxs("div", { className: ["rz-card", className].filter(Boolean).join(" "), children: [
     title && /* @__PURE__ */ jsxRuntime.jsx("div", { className: "rz-card__title", children: title }),
     meta && /* @__PURE__ */ jsxRuntime.jsx("div", { className: "rz-card__meta", children: meta }),
+    note && /* @__PURE__ */ jsxRuntime.jsx("div", { className: "rz-card__note", children: note }),
     children,
     actions && /* @__PURE__ */ jsxRuntime.jsx("div", { className: "rz-card__actions", children: actions })
   ] });