@lunora/studio 0.0.0 → 1.0.0-alpha.1

package/dist/packem_shared/SecurityAdvisorPanel-Cdm2IxLW.js

@@ -0,0 +1,79 @@
+import { useLunora } from '@lunora/react';
+import { useState, useEffect } from 'react';
+import { useT } from './createStudioI18n-CgvlmDkN.js';
+import { ADMIN_FUNCTIONS } from './ADMIN_FUNCTION_PREFIX-DmBqMZ-z.js';
+import { f as fireAndForget, c as callOptions, e as errorMessage, a as adminRef } from './internal-BBZYexre.js';
+import { A as AdvisorView } from './advisor-view-DBlzJi6C.js';
+import { jsxDEV } from 'react/jsx-dev-runtime';
+
+const GET_SECURITY_AUDIT = adminRef(ADMIN_FUNCTIONS.getSecurityAudit);
+const findingTitle = (t, finding) => ({
+  "admin-token-weak": t("Weak admin token"),
+  "auth-secret-weak": t("Weak auth secret"),
+  "cookies-insecure": t("Session cookies are not Secure"),
+  "cors-wildcard-credentials": t("Wildcard CORS with credentials"),
+  "csrf-disabled": t("CSRF/origin guard is off"),
+  "dev-args-unredacted": t("Request log keeps un-redacted args"),
+  "security-headers-disabled": t("Security headers are off"),
+  "ws-gate-open": t("Live admin subscriptions are ungated")
+})[finding.kind];
+const findingEntity = (finding) => ({
+  "admin-token-weak": "LUNORA_ADMIN_TOKEN",
+  "auth-secret-weak": "AUTH_SECRET",
+  "cookies-insecure": "BETTER_AUTH_URL",
+  "cors-wildcard-credentials": "LUNORA_ALLOWED_ORIGINS",
+  "csrf-disabled": "LUNORA_SECURITY_CSRF",
+  "dev-args-unredacted": "request log",
+  "security-headers-disabled": "LUNORA_SECURITY_HEADERS",
+  "ws-gate-open": "LUNORA_WS_BEARER"
+})[finding.kind];
+const findingDetail = (t, finding) => ({
+  "admin-token-weak": t("Your admin token is {length} characters — use at least {min} for a brute-force-resistant secret.", {
+    length: finding.detail?.["length"],
+    min: finding.detail?.["min"]
+  }),
+  "auth-secret-weak": t("Your auth secret is {length} characters — use at least {min} (e.g. `openssl rand -hex 32`) to sign sessions safely.", {
+    length: finding.detail?.["length"],
+    min: finding.detail?.["min"]
+  }),
+  "cookies-insecure": t("BETTER_AUTH_URL is a plaintext http:// origin, so session cookies cannot be Secure and ride in cleartext. Serve auth over https:// in production."),
+  "cors-wildcard-credentials": t("LUNORA_ALLOWED_ORIGINS includes a wildcard while credentials are allowed — browsers reject this and it defeats the allowlist. Name explicit origins instead of *."),
+  "csrf-disabled": t("LUNORA_SECURITY_CSRF is off, so cross-origin state-changing cookie requests are not blocked. Re-enable it in production to keep mutations un-forgeable."),
+  "dev-args-unredacted": t("This worker reports a development environment, so the request log stores raw args and identity. Confirm it isn't a mislabeled production deploy."),
+  "security-headers-disabled": t("LUNORA_SECURITY_HEADERS is off, so HSTS, CSP, nosniff, and frame-options are not applied. Re-enable the baseline headers in production."),
+  "ws-gate-open": t("LUNORA_WS_BEARER is unset, so the WebSocket upgrade gate is open: live admin subscriptions need no credential. Set it to gate them like the HTTP admin RPCs.")
+})[finding.kind];
+const SecurityAdvisorPanel = () => {
+  const client = useLunora();
+  const t = useT();
+  const [findings, setFindings] = useState(null);
+  const [error, setError] = useState(null);
+  const refresh = async () => {
+    try {
+      const result = await client.query(GET_SECURITY_AUDIT, {}, callOptions(""));
+      setFindings(Array.isArray(result.findings) ? result.findings : []);
+      setError(null);
+    } catch (error_) {
+      setError(errorMessage(error_));
+    }
+  };
+  useEffect(() => {
+    fireAndForget(refresh());
+  }, [refresh]);
+  const rows = findings === null ? null : findings.map((finding) => {
+    return {
+      description: findingDetail(t, finding),
+      entity: findingEntity(finding),
+      issueType: findingTitle(t, finding),
+      key: finding.kind,
+      level: finding.level
+    };
+  });
+  return /* @__PURE__ */ jsxDEV(AdvisorView, {
+    error,
+    rows,
+    testId: "lunora-security-advisor"
+  }, void 0, false);
+};
+
+export { SecurityAdvisorPanel as default };

package/dist/packem_shared/SettingsPanel-D3WF2mBU.js

@@ -0,0 +1,176 @@
+import { useLunora } from '@lunora/react';
+import { useState, useCallback, useEffect, useMemo } from 'react';
+import { B as Badge } from './badge-B2PKA1-5.js';
+import { C as Card, a as CardContent } from './card-DURq3ElK.js';
+import { T as Table, a as TableHeader, b as TableRow, c as TableHead, d as TableBody, e as TableCell } from './table-_RzNvy3R.js';
+import { useT } from './createStudioI18n-CgvlmDkN.js';
+import { ADMIN_FUNCTIONS } from './ADMIN_FUNCTION_PREFIX-DmBqMZ-z.js';
+import { b as CLOUDFLARE_WORKERS_URL } from './cf-links-BZfRdxSE.js';
+import { c as callOptions, e as errorMessage, f as fireAndForget, a as adminRef } from './internal-BBZYexre.js';
+import { jsxDEV } from 'react/jsx-dev-runtime';
+
+const GET_SETTINGS = adminRef(ADMIN_FUNCTIONS.getSettings);
+const KIND_VARIANT = {
+  binding: "outline",
+  secret: "destructive",
+  var: "secondary"
+};
+const SettingsPanel = ({
+  initialShardKey
+}) => {
+  const client = useLunora();
+  const t = useT();
+  const [result, setResult] = useState(null);
+  const [error, setError] = useState(null);
+  const [loading, setLoading] = useState(false);
+  const refresh = useCallback(async () => {
+    setLoading(true);
+    setError(null);
+    try {
+      const settings = await client.query(GET_SETTINGS, {}, callOptions(initialShardKey ?? ""));
+      setResult(settings);
+    } catch (error_) {
+      setResult(null);
+      setError(errorMessage(error_));
+    } finally {
+      setLoading(false);
+    }
+  }, [client, initialShardKey]);
+  useEffect(() => {
+    fireAndForget(refresh());
+  }, [refresh]);
+  const deployRows = useMemo(() => {
+    const deploy = result?.deploy;
+    if (deploy === void 0) {
+      return [];
+    }
+    const rows = [];
+    if (deploy.workerUrl !== void 0) {
+      rows.push({
+        label: t("URL"),
+        value: deploy.workerUrl
+      });
+    }
+    if (deploy.environment !== void 0) {
+      rows.push({
+        label: t("Environment"),
+        value: deploy.environment
+      });
+    }
+    if (deploy.deploymentId !== void 0) {
+      rows.push({
+        label: t("Deployment"),
+        value: deploy.deploymentId
+      });
+    }
+    if (deploy.versionTag !== void 0) {
+      rows.push({
+        label: t("Version"),
+        value: deploy.versionTag
+      });
+    }
+    return rows;
+  }, [result, t]);
+  const settings_0 = result?.settings ?? [];
+  return /* @__PURE__ */ jsxDEV("div", {
+    className: "flex flex-col gap-4",
+    "data-testid": "lunora-settings",
+    children: [/* @__PURE__ */ jsxDEV("div", {
+      className: "flex flex-wrap items-center gap-3",
+      children: /* @__PURE__ */ jsxDEV("a", {
+        className: "text-sm text-primary underline-offset-4 hover:underline",
+        "data-testid": "set-cf-link",
+        href: CLOUDFLARE_WORKERS_URL,
+        rel: "noreferrer",
+        target: "_blank",
+        children: t("Open in Cloudflare")
+      }, void 0, false)
+    }, void 0, false), /* @__PURE__ */ jsxDEV("p", {
+      className: "text-sm text-muted-foreground",
+      "data-testid": "set-readonly-note",
+      children: t("View-only — values are masked. Edit vars, secrets, and bindings in wrangler or the Cloudflare dashboard.")
+    }, void 0, false), error !== null && /* @__PURE__ */ jsxDEV("p", {
+      className: "text-sm text-destructive",
+      "data-testid": "set-error",
+      role: "alert",
+      children: error
+    }, void 0, false), deployRows.length > 0 && /* @__PURE__ */ jsxDEV(Card, {
+      className: "py-0",
+      "data-testid": "set-deploy",
+      children: [/* @__PURE__ */ jsxDEV("header", {
+        className: "border-b border-border px-4 py-3",
+        children: /* @__PURE__ */ jsxDEV("span", {
+          className: "font-mono text-[11px] tracking-wide text-muted-foreground uppercase",
+          children: t("Deployment")
+        }, void 0, false)
+      }, void 0, false), /* @__PURE__ */ jsxDEV(CardContent, {
+        className: "py-3",
+        children: /* @__PURE__ */ jsxDEV("dl", {
+          className: "grid grid-cols-[8rem_minmax(0,1fr)] gap-x-4 gap-y-1 text-sm",
+          children: deployRows.map((row) => /* @__PURE__ */ jsxDEV("div", {
+            className: "contents",
+            "data-testid": "set-deploy-row",
+            children: [/* @__PURE__ */ jsxDEV("dt", {
+              className: "text-muted-foreground",
+              children: row.label
+            }, void 0, false), /* @__PURE__ */ jsxDEV("dd", {
+              className: "truncate font-mono text-xs",
+              title: row.value,
+              children: row.value
+            }, void 0, false)]
+          }, row.label, true))
+        }, void 0, false)
+      }, void 0, false)]
+    }, void 0, true), /* @__PURE__ */ jsxDEV(Card, {
+      className: "py-0",
+      children: [/* @__PURE__ */ jsxDEV("header", {
+        className: "border-b border-border px-4 py-3",
+        children: /* @__PURE__ */ jsxDEV("span", {
+          className: "font-mono text-[11px] tracking-wide text-muted-foreground uppercase",
+          children: t("Environment & bindings")
+        }, void 0, false)
+      }, void 0, false), error === null && !loading && settings_0.length === 0 && /* @__PURE__ */ jsxDEV("p", {
+        className: "px-4 py-8 text-center text-sm text-muted-foreground",
+        "data-testid": "set-empty",
+        children: t("No environment variables or bindings.")
+      }, void 0, false), settings_0.length > 0 && /* @__PURE__ */ jsxDEV(CardContent, {
+        className: "px-0 py-0",
+        children: /* @__PURE__ */ jsxDEV(Table, {
+          "data-testid": "set-table",
+          children: [/* @__PURE__ */ jsxDEV(TableHeader, {
+            children: /* @__PURE__ */ jsxDEV(TableRow, {
+              children: [/* @__PURE__ */ jsxDEV(TableHead, {
+                children: t("name")
+              }, void 0, false), /* @__PURE__ */ jsxDEV(TableHead, {
+                children: t("kind")
+              }, void 0, false), /* @__PURE__ */ jsxDEV(TableHead, {
+                children: t("value")
+              }, void 0, false)]
+            }, void 0, true)
+          }, void 0, false), /* @__PURE__ */ jsxDEV(TableBody, {
+            children: settings_0.map((entry) => /* @__PURE__ */ jsxDEV(TableRow, {
+              "data-testid": "set-row",
+              children: [/* @__PURE__ */ jsxDEV(TableCell, {
+                className: "font-mono text-xs font-medium",
+                children: entry.name
+              }, void 0, false), /* @__PURE__ */ jsxDEV(TableCell, {
+                children: /* @__PURE__ */ jsxDEV(Badge, {
+                  variant: KIND_VARIANT[entry.kind],
+                  children: entry.bindingType ?? entry.kind
+                }, void 0, false)
+              }, void 0, false), /* @__PURE__ */ jsxDEV(TableCell, {
+                className: "max-w-[28ch] truncate font-mono text-xs text-muted-foreground",
+                children: entry.value ?? /* @__PURE__ */ jsxDEV("span", {
+                  className: "text-muted-foreground",
+                  children: "—"
+                }, void 0, false)
+              }, void 0, false)]
+            }, entry.name, true))
+          }, void 0, false)]
+        }, void 0, true)
+      }, void 0, false)]
+    }, void 0, true)]
+  }, void 0, true);
+};
+
+export { SettingsPanel };

package/dist/packem_shared/ShardInput-DNCsT1KW.js

@@ -0,0 +1,107 @@
+import { c } from 'react/compiler-runtime';
+import { useId, useState } from 'react';
+import { useT } from './createStudioI18n-CgvlmDkN.js';
+import { l as loadRecentShards } from './shard-history-DyebH1R5.js';
+import { I as Input } from './input-XH4r1Pt1.js';
+import { jsxDEV, Fragment } from 'react/jsx-dev-runtime';
+
+const ShardInput = (t0) => {
+  const $ = c(21);
+  const {
+    id,
+    onChange,
+    testId,
+    value
+  } = t0;
+  const t = useT();
+  const listId = useId();
+  const [recents] = useState(_temp);
+  let t1;
+  if ($[0] !== onChange) {
+    t1 = (event) => {
+      onChange(event.target.value);
+    };
+    $[0] = onChange;
+    $[1] = t1;
+  } else {
+    t1 = $[1];
+  }
+  const onInputChange = t1;
+  let t2;
+  if ($[2] !== t) {
+    t2 = t("Shard key");
+    $[2] = t;
+    $[3] = t2;
+  } else {
+    t2 = $[3];
+  }
+  const t3 = recents.length > 0 ? listId : void 0;
+  let t4;
+  if ($[4] !== t) {
+    t4 = t("shard key (optional)");
+    $[4] = t;
+    $[5] = t4;
+  } else {
+    t4 = $[5];
+  }
+  let t5;
+  if ($[6] !== id || $[7] !== onInputChange || $[8] !== t2 || $[9] !== t3 || $[10] !== t4 || $[11] !== testId || $[12] !== value) {
+    t5 = /* @__PURE__ */ jsxDEV(Input, {
+      "aria-label": t2,
+      className: "h-8 w-48",
+      "data-testid": testId,
+      id,
+      list: t3,
+      onChange: onInputChange,
+      placeholder: t4,
+      value
+    }, void 0, false);
+    $[6] = id;
+    $[7] = onInputChange;
+    $[8] = t2;
+    $[9] = t3;
+    $[10] = t4;
+    $[11] = testId;
+    $[12] = value;
+    $[13] = t5;
+  } else {
+    t5 = $[13];
+  }
+  let t6;
+  if ($[14] !== listId || $[15] !== recents || $[16] !== testId) {
+    t6 = recents.length > 0 && /* @__PURE__ */ jsxDEV("datalist", {
+      "data-testid": `${testId}-recents`,
+      id: listId,
+      children: recents.map(_temp2)
+    }, void 0, false);
+    $[14] = listId;
+    $[15] = recents;
+    $[16] = testId;
+    $[17] = t6;
+  } else {
+    t6 = $[17];
+  }
+  let t7;
+  if ($[18] !== t5 || $[19] !== t6) {
+    t7 = /* @__PURE__ */ jsxDEV(Fragment, {
+      children: [t5, t6]
+    }, void 0, true);
+    $[18] = t5;
+    $[19] = t6;
+    $[20] = t7;
+  } else {
+    t7 = $[20];
+  }
+  return t7;
+};
+function _temp() {
+  return loadRecentShards();
+}
+function _temp2(shard) {
+  return /* @__PURE__ */ jsxDEV("option", {
+    "aria-label": shard,
+    value: shard
+  }, shard, false);
+}
+
+export { ShardInput };

package/dist/packem_shared/SqlEditorPanel-BuQ7f2Hs.js

@@ -0,0 +1,13 @@
+import 'react/compiler-runtime';
+import '@lunora/react';
+import 'react';
+export { S as SqlEditorPanel } from './sql-editor-panel-CW2y2x9h.js';
+import './ShardInput-DNCsT1KW.js';
+import './table-_RzNvy3R.js';
+import './createStudioI18n-CgvlmDkN.js';
+import './ADMIN_FUNCTION_PREFIX-DmBqMZ-z.js';
+import './internal-BBZYexre.js';
+import './shard-history-DyebH1R5.js';
+import './data-grid-CCh2Couo.js';
+import './grid-features-DTjG6Sex.js';
+import 'react/jsx-dev-runtime';

package/dist/packem_shared/Studio-D36od9Oz.js

@@ -0,0 +1,33 @@
+import 'react/compiler-runtime';
+import '@tanstack/react-router';
+import 'react';
+export { S as Studio } from './studio-BDVd7rIV.js';
+import './ErrorBoundary-BzAApI7J.js';
+import './badge-B2PKA1-5.js';
+import './input-XH4r1Pt1.js';
+import './reference-view-BCKIoai7.js';
+import './InsightsPanel-DaZPnSgt.js';
+import './SecurityAdvisorPanel-Cdm2IxLW.js';
+import './ApiTab-DURGU15e.js';
+import './TableEditor-DIVDk3vT.js';
+import './ExportImportPanel-WO34fJxy.js';
+import './MigrationsPanel-DQdPY9io.js';
+import './PitrPanel-BbBkQR6t.js';
+import './FunctionRunner-j0Rd5m9t.js';
+import './FunctionStatsPanel-DboBl-XL.js';
+import './HomePanel-bdOCNA-p.js';
+import './AuditPanel-BC59Nhst.js';
+import './LogsPanel-CWdqAGpQ.js';
+import './MailPanel-D_EGtDnS.js';
+import './HealthPanel-DOIgbUtx.js';
+import './MetricsPanel-E4Gv6wTO.js';
+import './SchemaViewer-D8XGnp-X.js';
+import './SettingsPanel-D3WF2mBU.js';
+import './sql-editor-panel-CW2y2x9h.js';
+import './FileBrowser-Zcr-Qgxo.js';
+import './createStudioI18n-CgvlmDkN.js';
+import './StudioI18nProvider-Dcajsznk.js';
+import './internal-BBZYexre.js';
+import './utils-B05Dmz_H.js';
+import './CommandPalette-Dx_CoB9i.js';
+import 'react/jsx-dev-runtime';