@burdenoff/fluidgrids-fe-sdk 2026.1113.11 → 2026.1114.1

package/dist/{SettingsPage-DpBhx95x.js → SettingsPage-CmIa107C.js}

@@ -6,22 +6,22 @@ import { n as useManagedAiPolicyAuthority } from "./ManagedAiPolicyAuthorityCont
 import { c as budgetInputValue, d as withBudgetMode, f as EffectBadge, m as useActionPolicies, n as checkCodecServerUrl, p as effectLabel, s as BUDGET_DIMENSIONS, u as withBudgetLimit } from "./codec-client-CAYl6j46.js";
 import { i as isAutonomyLevel, o as useAutonomyLevelCopy, t as AUTONOMY_LEVELS } from "./run-mode-Du-fvjtE.js";
 import { n as getFluidGridsClient } from "./client-Ctl4jmY3.js";
-import { o as throwIfResultError, t as describeOperationError } from "./errors-xPZ-IbQd.js";
+import { o as throwIfResultError, r as isForbiddenError, t as describeOperationError } from "./errors-xPZ-IbQd.js";
 import { d as useFluidGridsFlag, m as usePhaseCFlags, t as FLUIDGRIDS_FLAGS, u as useDurableParityEnabled } from "./feature-flags-B_b8PJ6Z.js";
+import { QI as WorkflowSecuritySeverity, XI as WorkflowSearchAttributeType, ZI as WorkflowSecurityCheck } from "./graphql-types-D82O-0XY.js";
 import { M as saveCodecServerSettings, _ as fetchPauseRules, a as createPauseRule, c as deletePauseRule, f as fetchArchiveSettings, g as fetchCodecServerSettings, j as saveArchiveSettings, l as deleteSearchAttribute, o as createSearchAttribute, r as clearArchiveSettings, x as fetchSearchAttributes } from "./api-CEnNq15C.js";
 import { i as NativeSelect, o as StatusPill, t as FieldError, u as useResource } from "./shared-C0LCTtyh.js";
-import { XI as WorkflowSearchAttributeType } from "./graphql-types-D82O-0XY.js";
-import { A as useFlowStore } from "./node-operation-selection-bFx9s45-.js";
-import { Tt as useSaveStatusStore, Yt as findSaveConflict } from "./FluidGridsProvider-Dxehlm-2.js";
-import { a as useLogStreamDestinations, i as useLogStreamDestinationActions } from "./useObservability-CBFLQBQO.js";
+import { A as useFlowStore } from "./node-operation-selection-DHbtGNrG.js";
+import { Tt as useSaveStatusStore, Yt as findSaveConflict } from "./FluidGridsProvider-CPLfIarV.js";
+import { a as useLogStreamDestinations, i as useLogStreamDestinationActions } from "./useObservability-BSLLLev9.js";
 import { n as useConnections } from "./useConnections-BlB0gbOB.js";
-import { Nt as useUpdateWorkflowDefinitionMutation, Rt as useWorkflowDefinitionQuery, Vt as useWorkflowDefinitionsQuery, n as useAgentDefinitions } from "./useAgentDefinitions-akQ6WwzD.js";
+import { Nt as useUpdateWorkflowDefinitionMutation, Rt as useWorkflowDefinitionQuery, Vt as useWorkflowDefinitionsQuery, n as useAgentDefinitions } from "./useAgentDefinitions-Bs_ci53W.js";
 import { a as formToInput$2, i as emptyAgentForm, n as agentToForm, o as grantDays, r as describeRule, t as AgentFormError } from "./agent-form-D0uLvzx4.js";
 import { r as getFluidGridsConfig } from "./config-X97zrIvn.js";
 import { n as getGlobalStoreClient } from "./global-client-DP_Wxe5t.js";
 import { t as FluidGridsDocsLink } from "./FluidGridsDocsLink-JxkBpOeb.js";
 import { useCallback, useEffect, useLayoutEffect, useMemo, useRef, useState } from "react";
-import { useNavigate, useParams } from "react-router";
+import { Link, useNavigate, useParams } from "react-router";
 import { Icon } from "@iconify/react";
 import { cn } from "@burdenoff/fe-libs/utils";
 import { Fragment as Fragment$1, jsx, jsxs } from "react/jsx-runtime";
@@ -712,6 +712,264 @@ const WorkflowNotificationSettingsDocument = {
 	}]
 };
 
+// src/generated/documents/wspace/WorkspaceSecurityReportDocument.ts
+const WorkspaceSecurityReportDocument = {
+	"kind": "Document",
+	"definitions": [{
+		"kind": "OperationDefinition",
+		"operation": "query",
+		"name": {
+			"kind": "Name",
+			"value": "WorkspaceSecurityReport"
+		},
+		"variableDefinitions": [{
+			"kind": "VariableDefinition",
+			"variable": {
+				"kind": "Variable",
+				"name": {
+					"kind": "Name",
+					"value": "input"
+				}
+			},
+			"type": {
+				"kind": "NamedType",
+				"name": {
+					"kind": "Name",
+					"value": "WorkspaceSecurityReportInput"
+				}
+			},
+			"directives": []
+		}],
+		"directives": [],
+		"selectionSet": {
+			"kind": "SelectionSet",
+			"selections": [{
+				"kind": "Field",
+				"name": {
+					"kind": "Name",
+					"value": "workspaceSecurityReport"
+				},
+				"arguments": [{
+					"kind": "Argument",
+					"name": {
+						"kind": "Name",
+						"value": "input"
+					},
+					"value": {
+						"kind": "Variable",
+						"name": {
+							"kind": "Name",
+							"value": "input"
+						}
+					}
+				}],
+				"directives": [],
+				"selectionSet": {
+					"kind": "SelectionSet",
+					"selections": [
+						{
+							"kind": "Field",
+							"name": {
+								"kind": "Name",
+								"value": "generatedAt"
+							},
+							"arguments": [],
+							"directives": []
+						},
+						{
+							"kind": "Field",
+							"name": {
+								"kind": "Name",
+								"value": "checks"
+							},
+							"arguments": [],
+							"directives": []
+						},
+						{
+							"kind": "Field",
+							"name": {
+								"kind": "Name",
+								"value": "workflowsScanned"
+							},
+							"arguments": [],
+							"directives": []
+						},
+						{
+							"kind": "Field",
+							"name": {
+								"kind": "Name",
+								"value": "truncated"
+							},
+							"arguments": [],
+							"directives": []
+						},
+						{
+							"kind": "Field",
+							"name": {
+								"kind": "Name",
+								"value": "notes"
+							},
+							"arguments": [],
+							"directives": []
+						},
+						{
+							"kind": "Field",
+							"name": {
+								"kind": "Name",
+								"value": "counts"
+							},
+							"arguments": [],
+							"directives": [],
+							"selectionSet": {
+								"kind": "SelectionSet",
+								"selections": [{
+									"kind": "Field",
+									"name": {
+										"kind": "Name",
+										"value": "check"
+									},
+									"arguments": [],
+									"directives": []
+								}, {
+									"kind": "Field",
+									"name": {
+										"kind": "Name",
+										"value": "count"
+									},
+									"arguments": [],
+									"directives": []
+								}]
+							}
+						},
+						{
+							"kind": "Field",
+							"name": {
+								"kind": "Name",
+								"value": "findings"
+							},
+							"arguments": [],
+							"directives": [],
+							"selectionSet": {
+								"kind": "SelectionSet",
+								"selections": [
+									{
+										"kind": "Field",
+										"name": {
+											"kind": "Name",
+											"value": "check"
+										},
+										"arguments": [],
+										"directives": []
+									},
+									{
+										"kind": "Field",
+										"name": {
+											"kind": "Name",
+											"value": "severity"
+										},
+										"arguments": [],
+										"directives": []
+									},
+									{
+										"kind": "Field",
+										"name": {
+											"kind": "Name",
+											"value": "workflowKey"
+										},
+										"arguments": [],
+										"directives": []
+									},
+									{
+										"kind": "Field",
+										"name": {
+											"kind": "Name",
+											"value": "workflowName"
+										},
+										"arguments": [],
+										"directives": []
+									},
+									{
+										"kind": "Field",
+										"name": {
+											"kind": "Name",
+											"value": "version"
+										},
+										"arguments": [],
+										"directives": []
+									},
+									{
+										"kind": "Field",
+										"name": {
+											"kind": "Name",
+											"value": "active"
+										},
+										"arguments": [],
+										"directives": []
+									},
+									{
+										"kind": "Field",
+										"name": {
+											"kind": "Name",
+											"value": "nodeId"
+										},
+										"arguments": [],
+										"directives": []
+									},
+									{
+										"kind": "Field",
+										"name": {
+											"kind": "Name",
+											"value": "nodeType"
+										},
+										"arguments": [],
+										"directives": []
+									},
+									{
+										"kind": "Field",
+										"name": {
+											"kind": "Name",
+											"value": "nodeLabel"
+										},
+										"arguments": [],
+										"directives": []
+									},
+									{
+										"kind": "Field",
+										"name": {
+											"kind": "Name",
+											"value": "message"
+										},
+										"arguments": [],
+										"directives": []
+									},
+									{
+										"kind": "Field",
+										"name": {
+											"kind": "Name",
+											"value": "connectionId"
+										},
+										"arguments": [],
+										"directives": []
+									},
+									{
+										"kind": "Field",
+										"name": {
+											"kind": "Name",
+											"value": "latestVersion"
+										},
+										"arguments": [],
+										"directives": []
+									}
+								]
+							}
+						}
+					]
+				}
+			}]
+		}
+	}]
+};
+
 // src/modules/action-policies/utils/policy-form.ts
 const POLICY_EFFECTS = [
 	"REQUIRE_APPROVAL",
@@ -3108,6 +3366,555 @@ function WorkflowNotificationsTab({ workflowKey }) {
 	});
 }
 
+// src/modules/settings/hooks/useWorkspaceSecurityReport.ts
+/**
+* The workspace security report (BOFF-9747) for Settings → Security report.
+*
+* `workspaceSecurityReport` is computed on demand from the stored workflow
+* definitions and is for workspace admins only: the gateway answers anyone
+* else with FORBIDDEN, which the hook reports as `forbidden` rather than as a
+* load failure, so the screen can say who may see the report.
+*/
+async function fetchWorkspaceSecurityReport() {
+	const result = await getFluidGridsClient().query({
+		query: WorkspaceSecurityReportDocument,
+		variables: {},
+		fetchPolicy: "network-only"
+	});
+	throwIfResultError(result);
+	const report = result.data?.workspaceSecurityReport;
+	if (!report) throw new Error("The security report did not come back.");
+	return report;
+}
+const LOADING = {
+	report: null,
+	error: null,
+	forbidden: false,
+	loading: true
+};
+function useWorkspaceSecurityReport() {
+	const [state, setState] = useState(LOADING);
+	const [generation, setGeneration] = useState(0);
+	useEffect(() => {
+		let cancelled = false;
+		const load = async () => {
+			try {
+				const report = await fetchWorkspaceSecurityReport();
+				if (!cancelled) setState({
+					report,
+					error: null,
+					forbidden: false,
+					loading: false
+				});
+			} catch (err) {
+				if (!cancelled) setState((current) => ({
+					report: current.report,
+					error: err instanceof Error ? err : new Error(String(err)),
+					forbidden: isForbiddenError(err),
+					loading: false
+				}));
+			}
+		};
+		load();
+		return () => {
+			cancelled = true;
+		};
+	}, [generation]);
+	const refresh = useCallback(() => {
+		setState((current) => ({
+			...current,
+			error: null,
+			loading: true
+		}));
+		setGeneration((value) => value + 1);
+	}, []);
+	return {
+		...state,
+		refresh
+	};
+}
+
+// src/modules/settings/utils/security-report.ts
+/** Every check the service runs, in the order the screen lists them. */
+const SECURITY_CHECKS = [
+	"PUBLIC_TRIGGER_WITHOUT_AUTH",
+	"CODE_EXECUTION",
+	"HTTP_TO_PRIVATE_ADDRESS",
+	"SQL_WITH_EXPRESSIONS",
+	"OUTDATED_STORE_NODE"
+];
+/** Severities, most serious first. */
+const SECURITY_SEVERITIES = [
+	"HIGH",
+	"MEDIUM",
+	"LOW"
+];
+/** The filter value that keeps every check or severity. */
+const ALL = "ALL";
+const CHECK_SET = new Set(SECURITY_CHECKS);
+const SEVERITY_SET = new Set(SECURITY_SEVERITIES);
+/** A select's value as a check filter; anything unknown keeps every check. */
+function toCheckFilter(value) {
+	return SECURITY_CHECKS.find((check) => check === value) ?? "ALL";
+}
+/** A select's value as a severity filter; anything unknown keeps every severity. */
+function toSeverityFilter(value) {
+	return SECURITY_SEVERITIES.find((severity) => severity === value) ?? "ALL";
+}
+/**
+* One row per known check, in screen order, with the service's count (taken
+* before the findings list is cut, so it can be larger than the findings
+* shown). Checks that did not run show 0 and `ran: false`.
+*/
+function summarizeChecks(report) {
+	const ran = new Set(report.checks);
+	const counts = /* @__PURE__ */ new Map();
+	for (const entry of report.counts) counts.set(entry.check, entry.count);
+	return SECURITY_CHECKS.map((check) => ({
+		check,
+		count: counts.get(check) ?? 0,
+		ran: ran.has(check)
+	}));
+}
+/** The findings that match both filters, in the service's order (most severe first). */
+function filterFindings(findings, filter) {
+	return findings.filter((finding) => (filter.check === "ALL" || finding.check === filter.check) && (filter.severity === "ALL" || finding.severity === filter.severity));
+}
+/** The badge tone for a severity; an unknown value reads as neutral. */
+function severityTone(severity) {
+	if (!SEVERITY_SET.has(severity)) return "neutral";
+	if (severity === String("HIGH")) return "danger";
+	if (severity === String("MEDIUM")) return "warning";
+	return "neutral";
+}
+/** True for a check this SDK knows a label for. */
+function isKnownCheck(check) {
+	return CHECK_SET.has(check);
+}
+/**
+* Where a finding opens: the builder on the finding's workflow version. The
+* builder has no node deep link, so the node is named in the row instead.
+* Relative to the Settings page, like its "Back to Workflows" link.
+*/
+function findingBuilderPath(finding) {
+	return `../workflow/${encodeURIComponent(finding.workflowKey)}/${encodeURIComponent(finding.version)}`;
+}
+/** The node's name for a row: its label, else its id. */
+function findingNodeName(finding) {
+	const label = finding.nodeLabel?.trim();
+	return label ? label : finding.nodeId;
+}
+/** A stable key for a finding row. */
+function findingKey(finding) {
+	return [
+		finding.check,
+		finding.workflowKey,
+		finding.version,
+		finding.nodeId,
+		finding.connectionId ?? ""
+	].join("|");
+}
+/**
+* One unique key per finding row. Two findings with the same check, workflow,
+* version, node and connection would collide on {@link findingKey}; later
+* repeats get a `#n` suffix so React keys stay unique.
+*/
+function uniqueFindingKeys(findings) {
+	const seen = /* @__PURE__ */ new Map();
+	return findings.map((finding) => {
+		const key = findingKey(finding);
+		const count = seen.get(key) ?? 0;
+		seen.set(key, count + 1);
+		return count === 0 ? key : `${key}#${count}`;
+	});
+}
+
+// src/modules/settings/utils/security-report-labels.ts
+const TONE_CLASSES$1 = {
+	danger: "bg-status-error-bg-subtle text-status-error-text border-status-error-border",
+	warning: "bg-status-warning-bg-subtle text-status-warning-text border-status-warning-border",
+	neutral: "bg-surface text-text-secondary border-border-default"
+};
+function checkLabel(tr, check) {
+	if (!isKnownCheck(check)) return check;
+	return {
+		["PUBLIC_TRIGGER_WITHOUT_AUTH"]: tr("fluidgrids.settings.securityReport.check.publicTrigger", "Public trigger without auth"),
+		["CODE_EXECUTION"]: tr("fluidgrids.settings.securityReport.check.codeExecution", "Code execution"),
+		["HTTP_TO_PRIVATE_ADDRESS"]: tr("fluidgrids.settings.securityReport.check.httpPrivate", "HTTP to a private address"),
+		["SQL_WITH_EXPRESSIONS"]: tr("fluidgrids.settings.securityReport.check.sqlExpressions", "SQL built from expressions"),
+		["OUTDATED_STORE_NODE"]: tr("fluidgrids.settings.securityReport.check.outdatedNode", "Outdated Node Store node")
+	}[check];
+}
+function severityLabel(tr, severity) {
+	return {
+		["HIGH"]: tr("fluidgrids.settings.securityReport.severity.high", "High"),
+		["MEDIUM"]: tr("fluidgrids.settings.securityReport.severity.medium", "Medium"),
+		["LOW"]: tr("fluidgrids.settings.securityReport.severity.low", "Low")
+	}[severity];
+}
+
+// src/modules/settings/components/SecurityReportParts.tsx
+/**
+* Sections of Settings → Security report (BOFF-9747), split out of
+* SecurityReportTab so each part stays small.
+*/
+function SeverityBadge({ severity, label }) {
+	return /* @__PURE__ */ jsx(Badge, {
+		variant: "outline",
+		className: cn("text-xs", TONE_CLASSES$1[severityTone(severity)]),
+		children: label
+	});
+}
+function FindingRow({ finding, tr }) {
+	return /* @__PURE__ */ jsxs("tr", {
+		className: "border-t border-border-default align-top",
+		"data-testid": "security-report-finding",
+		"data-check": finding.check,
+		"data-severity": finding.severity,
+		children: [
+			/* @__PURE__ */ jsx("td", {
+				className: "px-3 py-2",
+				children: /* @__PURE__ */ jsx(SeverityBadge, {
+					severity: finding.severity,
+					label: severityLabel(tr, finding.severity)
+				})
+			}),
+			/* @__PURE__ */ jsx("td", {
+				className: "px-3 py-2 text-text-primary",
+				children: checkLabel(tr, finding.check)
+			}),
+			/* @__PURE__ */ jsxs("td", {
+				className: "px-3 py-2",
+				children: [/* @__PURE__ */ jsx(Link, {
+					to: findingBuilderPath(finding),
+					className: "font-medium text-text-primary underline-offset-2 hover:underline",
+					"data-testid": "security-report-finding-link",
+					children: finding.workflowName || finding.workflowKey
+				}), /* @__PURE__ */ jsxs("div", {
+					className: "text-xs text-text-muted",
+					children: [
+						tr("fluidgrids.settings.securityReport.versionLabel", "Version"),
+						" ",
+						finding.version,
+						finding.active ? ` · ${tr("fluidgrids.settings.securityReport.activeLabel", "Active")}` : ` · ${tr("fluidgrids.settings.securityReport.draftLabel", "Draft")}`
+					]
+				})]
+			}),
+			/* @__PURE__ */ jsxs("td", {
+				className: "px-3 py-2",
+				children: [/* @__PURE__ */ jsx("div", {
+					className: "text-text-primary",
+					children: findingNodeName(finding)
+				}), /* @__PURE__ */ jsx("div", {
+					className: "text-xs text-text-muted",
+					children: finding.nodeType
+				})]
+			}),
+			/* @__PURE__ */ jsxs("td", {
+				className: "px-3 py-2 text-text-secondary",
+				children: [finding.message, finding.latestVersion ? /* @__PURE__ */ jsx("div", {
+					className: "text-xs text-text-muted",
+					children: tr("fluidgrids.settings.securityReport.latestVersion", "Newest version: {{version}}", { version: finding.latestVersion })
+				}) : null]
+			})
+		]
+	});
+}
+function ReportForbidden({ tr }) {
+	return /* @__PURE__ */ jsxs("div", {
+		className: "flex items-center gap-2 rounded-lg border border-border-default bg-surface p-3",
+		"data-testid": "security-report-forbidden",
+		role: "note",
+		children: [/* @__PURE__ */ jsx(Icon, {
+			icon: "mdi:shield-lock-outline",
+			width: 18,
+			className: "shrink-0 text-text-secondary"
+		}), /* @__PURE__ */ jsx("p", {
+			className: "text-sm text-text-secondary",
+			children: tr("fluidgrids.settings.securityReport.adminsOnly", "Only workspace admins can see this report.")
+		})]
+	});
+}
+function ReportLoadFailed({ tr, error, onRetry }) {
+	return /* @__PURE__ */ jsxs("div", {
+		className: "space-y-3 rounded-lg border border-status-error-border bg-status-error-bg-subtle p-3",
+		"data-testid": "security-report-error",
+		role: "alert",
+		children: [/* @__PURE__ */ jsxs("p", {
+			className: "text-sm text-status-error-text",
+			children: [
+				tr("fluidgrids.settings.securityReport.loadFailed", "Could not load the security report."),
+				" ",
+				error.message
+			]
+		}), /* @__PURE__ */ jsx(Button$1, {
+			variant: "outline",
+			size: "sm",
+			onClick: onRetry,
+			children: tr("fluidgrids.settings.securityReport.retry", "Try again")
+		})]
+	});
+}
+function ReportLoading({ tr }) {
+	return /* @__PURE__ */ jsx("p", {
+		className: "text-sm text-text-secondary",
+		"data-testid": "security-report-loading",
+		children: tr("fluidgrids.settings.securityReport.loading", "Checking the workspace's workflows…")
+	});
+}
+function ReportHeader({ tr, report, loading, onRefresh }) {
+	return /* @__PURE__ */ jsxs("div", {
+		className: "flex flex-col gap-3 sm:flex-row sm:items-start sm:justify-between",
+		children: [/* @__PURE__ */ jsxs("div", {
+			className: "flex items-start gap-2",
+			children: [/* @__PURE__ */ jsx(Icon, {
+				icon: "mdi:shield-search",
+				width: 18,
+				className: "mt-0.5 shrink-0 text-text-secondary"
+			}), /* @__PURE__ */ jsxs("div", { children: [/* @__PURE__ */ jsx("p", {
+				className: "text-sm text-text-secondary",
+				children: tr("fluidgrids.settings.securityReport.intro", "Risky workflows of this workspace, checked from their saved definitions. Only workspace admins see this report.")
+			}), /* @__PURE__ */ jsx("p", {
+				className: "mt-1 text-xs text-text-muted",
+				"data-testid": "security-report-meta",
+				children: tr("fluidgrids.settings.securityReport.meta", "{{count}} workflows checked · {{time}}", {
+					count: report.workflowsScanned,
+					time: new Date(report.generatedAt).toLocaleString()
+				})
+			})] })]
+		}), /* @__PURE__ */ jsxs(Button$1, {
+			variant: "outline",
+			size: "sm",
+			onClick: onRefresh,
+			disabled: loading,
+			"data-testid": "security-report-refresh",
+			children: [/* @__PURE__ */ jsx(Icon, {
+				icon: "mdi:refresh",
+				className: "mr-2",
+				width: 16
+			}), tr("fluidgrids.settings.securityReport.refresh", "Run again")]
+		})]
+	});
+}
+function ReportTruncatedNote({ tr }) {
+	return /* @__PURE__ */ jsxs("div", {
+		className: "flex items-start gap-2 rounded-lg border border-status-warning-border bg-status-warning-bg-subtle p-3",
+		"data-testid": "security-report-truncated",
+		role: "note",
+		children: [/* @__PURE__ */ jsx(Icon, {
+			icon: "mdi:alert-outline",
+			width: 18,
+			className: "mt-0.5 shrink-0 text-status-warning-text"
+		}), /* @__PURE__ */ jsx("p", {
+			className: "text-sm text-status-warning-text",
+			children: tr("fluidgrids.settings.securityReport.truncated", "This report is incomplete: some workflows or findings were left out because the report is bounded. Counts still include them.")
+		})]
+	});
+}
+function CheckSummary({ tr, summary, check, onCheck }) {
+	return /* @__PURE__ */ jsx("div", {
+		className: "grid grid-cols-1 gap-3 sm:grid-cols-2 lg:grid-cols-5",
+		"data-testid": "security-report-summary",
+		children: summary.map((entry) => /* @__PURE__ */ jsxs("button", {
+			type: "button",
+			onClick: () => onCheck(check === entry.check ? "ALL" : toCheckFilter(entry.check)),
+			"aria-pressed": check === entry.check,
+			className: cn("rounded-lg border bg-surface p-3 text-left", check === entry.check ? "border-border-strong" : "border-border-default"),
+			"data-testid": `security-report-count-${entry.check}`,
+			children: [/* @__PURE__ */ jsx("div", {
+				className: "text-2xl font-semibold text-text-primary",
+				children: entry.ran ? entry.count : "–"
+			}), /* @__PURE__ */ jsx("div", {
+				className: "text-xs text-text-secondary",
+				children: checkLabel(tr, entry.check)
+			})]
+		}, entry.check))
+	});
+}
+function ReportFilters({ tr, check, severity, onCheck, onSeverity }) {
+	const allLabel = tr("fluidgrids.settings.securityReport.filterAll", "All");
+	return /* @__PURE__ */ jsxs("div", {
+		className: "flex flex-col gap-3 sm:flex-row",
+		children: [/* @__PURE__ */ jsxs(Select, {
+			value: check,
+			onValueChange: (value) => onCheck(toCheckFilter(value)),
+			children: [/* @__PURE__ */ jsx(SelectTrigger, {
+				className: "w-full bg-surface border-border-default sm:w-[260px]",
+				"aria-label": tr("fluidgrids.settings.securityReport.checkFilter", "Check"),
+				"data-testid": "security-report-check-filter",
+				children: /* @__PURE__ */ jsx(SelectValue, {})
+			}), /* @__PURE__ */ jsxs(SelectContent, { children: [/* @__PURE__ */ jsx(SelectItem, {
+				value: "ALL",
+				children: allLabel
+			}), SECURITY_CHECKS.map((value) => /* @__PURE__ */ jsx(SelectItem, {
+				value,
+				children: checkLabel(tr, value)
+			}, value))] })]
+		}), /* @__PURE__ */ jsxs(Select, {
+			value: severity,
+			onValueChange: (value) => onSeverity(toSeverityFilter(value)),
+			children: [/* @__PURE__ */ jsx(SelectTrigger, {
+				className: "w-full bg-surface border-border-default sm:w-[180px]",
+				"aria-label": tr("fluidgrids.settings.securityReport.severityFilter", "Severity"),
+				"data-testid": "security-report-severity-filter",
+				children: /* @__PURE__ */ jsx(SelectValue, {})
+			}), /* @__PURE__ */ jsxs(SelectContent, { children: [/* @__PURE__ */ jsx(SelectItem, {
+				value: "ALL",
+				children: allLabel
+			}), SECURITY_SEVERITIES.map((value) => /* @__PURE__ */ jsx(SelectItem, {
+				value,
+				children: severityLabel(tr, value)
+			}, value))] })]
+		})]
+	});
+}
+function FindingsTable({ tr, findings, hasAnyFindings }) {
+	if (findings.length === 0) return /* @__PURE__ */ jsxs("div", {
+		className: "flex items-center gap-2 rounded-lg border border-border-default bg-surface-sunken p-4",
+		"data-testid": "security-report-empty",
+		children: [/* @__PURE__ */ jsx(Icon, {
+			icon: "mdi:shield-check-outline",
+			width: 18,
+			className: "shrink-0 text-text-secondary"
+		}), /* @__PURE__ */ jsx("p", {
+			className: "text-sm text-text-secondary",
+			children: !hasAnyFindings ? tr("fluidgrids.settings.securityReport.noFindings", "No risky workflows found.") : tr("fluidgrids.settings.securityReport.noMatches", "No findings match these filters.")
+		})]
+	});
+	const rowKeys = uniqueFindingKeys(findings);
+	return /* @__PURE__ */ jsx("div", {
+		className: "overflow-x-auto rounded-lg border border-border-default bg-surface",
+		children: /* @__PURE__ */ jsxs("table", {
+			className: "w-full min-w-[720px] text-sm",
+			"data-testid": "security-report-table",
+			children: [/* @__PURE__ */ jsx("thead", {
+				className: "bg-surface-sunken text-left text-xs text-text-muted",
+				children: /* @__PURE__ */ jsxs("tr", { children: [
+					/* @__PURE__ */ jsx("th", {
+						className: "px-3 py-2 font-medium",
+						children: tr("fluidgrids.settings.securityReport.severityColumn", "Severity")
+					}),
+					/* @__PURE__ */ jsx("th", {
+						className: "px-3 py-2 font-medium",
+						children: tr("fluidgrids.settings.securityReport.checkColumn", "Check")
+					}),
+					/* @__PURE__ */ jsx("th", {
+						className: "px-3 py-2 font-medium",
+						children: tr("fluidgrids.settings.securityReport.workflowColumn", "Workflow")
+					}),
+					/* @__PURE__ */ jsx("th", {
+						className: "px-3 py-2 font-medium",
+						children: tr("fluidgrids.settings.securityReport.nodeColumn", "Node")
+					}),
+					/* @__PURE__ */ jsx("th", {
+						className: "px-3 py-2 font-medium",
+						children: tr("fluidgrids.settings.securityReport.detailsColumn", "What to do")
+					})
+				] })
+			}), /* @__PURE__ */ jsx("tbody", { children: findings.map((finding, index) => /* @__PURE__ */ jsx(FindingRow, {
+				finding,
+				tr
+			}, rowKeys[index])) })]
+		})
+	});
+}
+function ReportNotes({ tr, notes }) {
+	if (notes.length === 0) return null;
+	return /* @__PURE__ */ jsxs("div", {
+		"data-testid": "security-report-notes",
+		children: [/* @__PURE__ */ jsx("h3", {
+			className: "mb-1 text-sm font-semibold text-text-primary",
+			children: tr("fluidgrids.settings.securityReport.notesTitle", "About this report")
+		}), /* @__PURE__ */ jsx("ul", {
+			className: "list-disc space-y-1 pl-5 text-xs text-text-secondary",
+			children: [...new Set(notes)].map((note) => /* @__PURE__ */ jsx("li", { children: note }, note))
+		})]
+	});
+}
+function ReportRefreshFailed({ tr, error }) {
+	return /* @__PURE__ */ jsxs("p", {
+		className: "text-sm text-status-error-text",
+		"data-testid": "security-report-refresh-failed",
+		role: "alert",
+		children: [
+			tr("fluidgrids.settings.securityReport.refreshFailed", "Could not run the report again. This is the last report."),
+			" ",
+			error.message
+		]
+	});
+}
+
+// src/modules/settings/components/SecurityReportTab.tsx
+/**
+* Settings → Security report (BOFF-9747): the workspace's risky workflows, the
+* FluidGrids counterpart of `n8n audit`. Public triggers without auth, code
+* execution, HTTP calls to private addresses, SQL built from expressions and
+* outdated Node Store nodes, computed on demand by `workspaceSecurityReport`.
+*
+* Workspace admins only: anyone else sees a short note, not an error.
+*/
+function SecurityReportTab() {
+	const tr = useTr();
+	const { report, loading, error, forbidden, refresh } = useWorkspaceSecurityReport();
+	const [check, setCheck] = useState("ALL");
+	const [severity, setSeverity] = useState("ALL");
+	const summary = useMemo(() => report ? summarizeChecks(report) : [], [report]);
+	const findings = useMemo(() => report ? filterFindings(report.findings, {
+		check,
+		severity
+	}) : [], [
+		report,
+		check,
+		severity
+	]);
+	if (forbidden) return /* @__PURE__ */ jsx(ReportForbidden, { tr });
+	if (error && !report) return /* @__PURE__ */ jsx(ReportLoadFailed, {
+		tr,
+		error,
+		onRetry: refresh
+	});
+	if (!report) return /* @__PURE__ */ jsx(ReportLoading, { tr });
+	return /* @__PURE__ */ jsxs("div", {
+		className: "space-y-6",
+		"data-testid": "security-report",
+		children: [
+			/* @__PURE__ */ jsx(ReportHeader, {
+				tr,
+				report,
+				loading,
+				onRefresh: refresh
+			}),
+			error ? /* @__PURE__ */ jsx(ReportRefreshFailed, {
+				tr,
+				error
+			}) : null,
+			report.truncated ? /* @__PURE__ */ jsx(ReportTruncatedNote, { tr }) : null,
+			/* @__PURE__ */ jsx(CheckSummary, {
+				tr,
+				summary,
+				check,
+				onCheck: setCheck
+			}),
+			/* @__PURE__ */ jsx(ReportFilters, {
+				tr,
+				check,
+				severity,
+				onCheck: setCheck,
+				onSeverity: setSeverity
+			}),
+			/* @__PURE__ */ jsx(FindingsTable, {
+				tr,
+				findings,
+				hasAnyFindings: report.findings.length > 0
+			}),
+			/* @__PURE__ */ jsx(ReportNotes, {
+				tr,
+				notes: report.notes
+			})
+		]
+	});
+}
+
 // src/modules/settings/components/RunControlTab.tsx
 /**
 * Settings → Run control (BOFF-9906, Phase C): the workspace's activity pause
@@ -6697,6 +7504,15 @@ function SettingsPage({ workflowKey: workflowKeyProp } = {}) {
 								width: 16
 							}), tr("fluidgrids.settings.page.mcpTab", "MCP")]
 						}),
+						/* @__PURE__ */ jsxs(TabsTrigger, {
+							value: "security-report",
+							className: "gap-1.5",
+							"data-testid": "fluidgrids-settings-security-report-tab",
+							children: [/* @__PURE__ */ jsx(Icon, {
+								icon: "mdi:shield-search",
+								width: 16
+							}), tr("fluidgrids.settings.page.securityReportTab", "Security report")]
+						}),
 						/* @__PURE__ */ jsxs(TabsTrigger, {
 							value: "notifications",
 							className: "gap-1.5",
@@ -6755,6 +7571,10 @@ function SettingsPage({ workflowKey: workflowKeyProp } = {}) {
 					value: "mcp",
 					children: /* @__PURE__ */ jsx(McpGatewayTab, { workflowKey })
 				}),
+				/* @__PURE__ */ jsx(TabsContent, {
+					value: "security-report",
+					children: /* @__PURE__ */ jsx(SecurityReportTab, {})
+				}),
 				/* @__PURE__ */ jsx(TabsContent, {
 					value: "notifications",
 					children: /* @__PURE__ */ jsx(WorkflowNotificationsTab, { workflowKey })
@@ -6772,4 +7592,4 @@ function SettingsPage({ workflowKey: workflowKeyProp } = {}) {
 	});
 }
 
-export { DurableHistoryCapsDocument as a, UpdateDurableHistoryCapsDocument as c, ManagedAiWorkspacePolicyDocument as i, SettingsPage_exports as n, UpdateWorkflowNotificationSettingsDocument as o, WorkflowNotificationSettingsDocument as r, UpdateManagedAiWorkspacePolicyDocument as s, SettingsPage as t };
+export { ManagedAiWorkspacePolicyDocument as a, UpdateManagedAiWorkspacePolicyDocument as c, WorkflowNotificationSettingsDocument as i, UpdateDurableHistoryCapsDocument as l, SettingsPage_exports as n, DurableHistoryCapsDocument as o, WorkspaceSecurityReportDocument as r, UpdateWorkflowNotificationSettingsDocument as s, SettingsPage as t };