@lunora/studio 1.0.0-alpha.35 → 1.0.0-alpha.350

package/dist/packem_chunks/permissions-panel.js

@@ -1,805 +0,0 @@
-import { useState, useRef, useEffect } from 'react';
-import { C as Card, b as CardHeader, c as CardTitle, d as CardDescription, a as CardContent } from '../packem_shared/card-DURq3ElK.js';
-import { useT } from '../packem_shared/DEFAULT_LOCALE-CiX4W7Kr.js';
-import { c } from 'react/compiler-runtime';
-import { E as ErrorAlert } from '../packem_shared/error-alert-BBT6D22d.js';
-import { L as LiveError } from '../packem_shared/live-status-FZ0psC1z.js';
-import { B as Badge } from '../packem_shared/badge-B2PKA1-5.js';
-import { B as Button } from '../packem_shared/button-BhsN2uZH.js';
-import { E as EmptyState } from '../packem_shared/empty-state-DY_oe0k6.js';
-import { T as Table, a as TableHeader, b as TableRow, c as TableHead, d as TableBody, e as TableCell } from '../packem_shared/table-DsCa9Qp9.js';
-import { u as useAdminQuery } from '../packem_shared/use-admin-query-BHPKmPuj.js';
-import { ADMIN_FUNCTIONS } from '../packem_shared/ADMIN_FUNCTIONS-BHHJi3Gb.js';
-import { jsxDEV } from 'react/jsx-dev-runtime';
-import { useLunora } from '@lunora/react';
-import { ShardInput } from '../packem_shared/ShardInput-gx_DZXXn.js';
-import { I as Input } from '../packem_shared/input-XH4r1Pt1.js';
-import { L as Label } from '../packem_shared/label-D8ykjn5J.js';
-import { T as Textarea } from '../packem_shared/textarea-D3gaCU_-.js';
-import { c as callOptions, a as adminRef, e as errorMessage, f as fireAndForget } from '../packem_shared/internal-DTsYVn-g.js';
-
-const OPERATIONS = ["read", "insert", "update", "delete"];
-const operationLabel = (t, operation) => ({
-  delete: t("Delete"),
-  insert: t("Insert"),
-  read: t("Read"),
-  update: t("Update")
-})[operation];
-const uncoveredTables = (advisories) => {
-  const set = /* @__PURE__ */ new Set();
-  for (const advisory of advisories?.advisories ?? []) {
-    if (advisory.name === "rls_uncovered_table") {
-      const {
-        table
-      } = advisory.metadata;
-      if (typeof table === "string" && table !== "") {
-        set.add(table);
-      }
-    }
-  }
-  return set;
-};
-const buildRows = (policies, maskColumns, uncovered) => {
-  const byTable = /* @__PURE__ */ new Map();
-  const ensure = (table) => {
-    const existing = byTable.get(table);
-    if (existing !== void 0) {
-      return existing;
-    }
-    const row = {
-      cells: {
-        delete: {},
-        insert: {},
-        read: {},
-        update: {}
-      },
-      maskedColumns: [],
-      table,
-      uncovered: uncovered.has(table)
-    };
-    byTable.set(table, row);
-    return row;
-  };
-  for (const policy of policies) {
-    ensure(policy.table).cells[policy.on] = {
-      procedure: policy.procedure
-    };
-  }
-  for (const column of maskColumns) {
-    const row = ensure(column.table);
-    if (!row.maskedColumns.includes(column.column)) {
-      row.maskedColumns.push(column.column);
-    }
-  }
-  for (const table of uncovered) {
-    ensure(table);
-  }
-  return [...byTable.values()].toSorted((a, b) => a.table.localeCompare(b.table));
-};
-const PermissionsMatrix = (t0) => {
-  const $ = c(17);
-  let t1;
-  if ($[0] !== t0) {
-    t1 = t0 === void 0 ? {} : t0;
-    $[0] = t0;
-    $[1] = t1;
-  } else {
-    t1 = $[1];
-  }
-  const {
-    onProbe
-  } = t1;
-  const t = useT();
-  let t2;
-  let t3;
-  if ($[2] === /* @__PURE__ */ Symbol.for("react.memo_cache_sentinel")) {
-    t2 = {};
-    t3 = {
-      live: true
-    };
-    $[2] = t2;
-    $[3] = t3;
-  } else {
-    t2 = $[2];
-    t3 = $[3];
-  }
-  const policiesQuery = useAdminQuery(ADMIN_FUNCTIONS.rlsPolicies, t2, t3);
-  let t4;
-  if ($[4] === /* @__PURE__ */ Symbol.for("react.memo_cache_sentinel")) {
-    t4 = {};
-    $[4] = t4;
-  } else {
-    t4 = $[4];
-  }
-  const masksQuery = useAdminQuery(ADMIN_FUNCTIONS.maskPolicies, t4);
-  let t5;
-  if ($[5] === /* @__PURE__ */ Symbol.for("react.memo_cache_sentinel")) {
-    t5 = {};
-    $[5] = t5;
-  } else {
-    t5 = $[5];
-  }
-  const advisoriesQuery = useAdminQuery(ADMIN_FUNCTIONS.getAdvisories, t5);
-  let t6;
-  if ($[6] !== advisoriesQuery.data || $[7] !== masksQuery.data || $[8] !== onProbe || $[9] !== policiesQuery || $[10] !== t) {
-    let policies = null;
-    if (policiesQuery.data !== void 0) {
-      policies = Array.isArray(policiesQuery.data.policies) ? policiesQuery.data.policies : [];
-    }
-    const maskColumns = Array.isArray(masksQuery.data?.columns) ? masksQuery.data.columns : [];
-    const advisories = advisoriesQuery.data ?? null;
-    const {
-      error,
-      errorSource,
-      liveError
-    } = policiesQuery;
-    const rows = policies === null ? [] : buildRows(policies, maskColumns, uncoveredTables(advisories));
-    let t7;
-    if ($[12] !== liveError) {
-      t7 = /* @__PURE__ */ jsxDEV("div", {
-        className: "flex items-center justify-end",
-        children: /* @__PURE__ */ jsxDEV(LiveError, {
-          message: liveError,
-          prefix: "pm"
-        }, void 0, false)
-      }, void 0, false);
-      $[12] = liveError;
-      $[13] = t7;
-    } else {
-      t7 = $[13];
-    }
-    let t8;
-    if ($[14] !== error || $[15] !== errorSource) {
-      t8 = error !== null && /* @__PURE__ */ jsxDEV(ErrorAlert, {
-        error: errorSource,
-        testId: "pm-error"
-      }, void 0, false);
-      $[14] = error;
-      $[15] = errorSource;
-      $[16] = t8;
-    } else {
-      t8 = $[16];
-    }
-    t6 = /* @__PURE__ */ jsxDEV("div", {
-      className: "flex flex-col gap-3",
-      "data-testid": "lunora-permissions-matrix",
-      children: [t7, t8, policies !== null && rows.length === 0 ? /* @__PURE__ */ jsxDEV(EmptyState, {
-        description: t("Add a `definePolicy` and wire it through `.use(rls(...))` to populate this matrix."),
-        testId: "pm-empty",
-        title: t("No policy")
-      }, void 0, false) : /* @__PURE__ */ jsxDEV(Table, {
-        "data-testid": "pm-table",
-        children: [/* @__PURE__ */ jsxDEV(TableHeader, {
-          children: /* @__PURE__ */ jsxDEV(TableRow, {
-            children: [/* @__PURE__ */ jsxDEV(TableHead, {
-              children: t("Table")
-            }, void 0, false), OPERATIONS.map((operation) => /* @__PURE__ */ jsxDEV(TableHead, {
-              children: operationLabel(t, operation)
-            }, operation, false)), /* @__PURE__ */ jsxDEV(TableHead, {
-              children: t("Masked columns")
-            }, void 0, false)]
-          }, void 0, true)
-        }, void 0, false), /* @__PURE__ */ jsxDEV(TableBody, {
-          children: rows.map((row) => /* @__PURE__ */ jsxDEV(TableRow, {
-            "data-testid": `pm-row-${row.table}`,
-            children: [/* @__PURE__ */ jsxDEV(TableCell, {
-              className: "font-mono text-xs",
-              children: /* @__PURE__ */ jsxDEV("span", {
-                className: "flex items-center gap-1.5",
-                children: [row.table, row.uncovered && /* @__PURE__ */ jsxDEV(Badge, {
-                  "data-testid": `pm-uncovered-${row.table}`,
-                  title: t("Uncovered — reachable without a policy"),
-                  variant: "destructive",
-                  children: t("Uncovered — reachable without a policy")
-                }, void 0, false)]
-              }, void 0, true)
-            }, void 0, false), OPERATIONS.map((operation_0) => {
-              const cell = row.cells[operation_0];
-              return /* @__PURE__ */ jsxDEV(TableCell, {
-                "data-testid": `pm-cell-${row.table}-${operation_0}`,
-                children: cell.procedure === void 0 ? /* @__PURE__ */ jsxDEV("span", {
-                  className: "text-xs text-muted-foreground",
-                  children: t("No policy")
-                }, void 0, false) : /* @__PURE__ */ jsxDEV("span", {
-                  className: "flex flex-col gap-1",
-                  children: [/* @__PURE__ */ jsxDEV(Badge, {
-                    variant: "secondary",
-                    children: t("Covered by {procedure}", {
-                      procedure: cell.procedure
-                    })
-                  }, void 0, false), onProbe !== void 0 && /* @__PURE__ */ jsxDEV(Button, {
-                    className: "h-auto justify-start p-0 text-[11px]",
-                    "data-testid": `pm-probe-${row.table}-${operation_0}`,
-                    onClick: () => {
-                      onProbe(row.table, operation_0, cell.procedure ?? "");
-                    },
-                    size: "xs",
-                    type: "button",
-                    variant: "ghost",
-                    children: t("Probe this")
-                  }, void 0, false)]
-                }, void 0, true)
-              }, operation_0, false);
-            }), /* @__PURE__ */ jsxDEV(TableCell, {
-              children: row.maskedColumns.length === 0 ? /* @__PURE__ */ jsxDEV("span", {
-                "aria-hidden": "true",
-                className: "text-muted-foreground",
-                children: "—"
-              }, void 0, false) : /* @__PURE__ */ jsxDEV("span", {
-                className: "flex flex-wrap gap-1",
-                children: row.maskedColumns.map(_temp)
-              }, void 0, false)
-            }, void 0, false)]
-          }, row.table, true))
-        }, void 0, false)]
-      }, void 0, true)]
-    }, void 0, true);
-    $[6] = advisoriesQuery.data;
-    $[7] = masksQuery.data;
-    $[8] = onProbe;
-    $[9] = policiesQuery;
-    $[10] = t;
-    $[11] = t6;
-  } else {
-    t6 = $[11];
-  }
-  return t6;
-};
-function _temp(column) {
-  return /* @__PURE__ */ jsxDEV(Badge, {
-    variant: "outline",
-    children: column
-  }, column, false);
-}
-
-const RUN_AS = adminRef(ADMIN_FUNCTIONS.runAs);
-const useRunAsProbe = () => {
-  const client = useLunora();
-  return async ({
-    args,
-    functionPath,
-    shardKey = "",
-    userId
-  }) => {
-    const reference = RUN_AS;
-    try {
-      const value = await client.query(reference, {
-        args,
-        functionPath,
-        userId
-      }, callOptions(shardKey));
-      return {
-        kind: "allowed",
-        value
-      };
-    } catch (error) {
-      return {
-        kind: "denied",
-        message: error instanceof Error ? error.message : String(error)
-      };
-    }
-  };
-};
-
-const formatValue = (value) => value === void 0 ? "undefined" : JSON.stringify(value, null, 2);
-const PermissionsPlayground = ({
-  functions: functionsProp,
-  prefill,
-  runAsIdentity = false
-} = {}) => {
-  const client = useLunora();
-  const t = useT();
-  const probe = useRunAsProbe();
-  const [discovered, setDiscovered] = useState(null);
-  const [discoverError, setDiscoverError] = useState(null);
-  const functions = functionsProp ?? discovered ?? [];
-  const [selectedPath, setSelectedPath] = useState("");
-  const [argsText, setArgsText] = useState("{}");
-  const [shardKey, setShardKey] = useState("");
-  const [runAsUserId, setRunAsUserId] = useState("");
-  const [running, setRunning] = useState(false);
-  const [outcome, setOutcome] = useState(null);
-  const [argsError, setArgsError] = useState(null);
-  const appliedNonce = useRef(-1);
-  useEffect(() => {
-    if (functionsProp !== void 0) {
-      return void 0;
-    }
-    let cancelled = false;
-    client.listFunctions().then((list) => {
-      if (!cancelled) {
-        setDiscovered(list);
-      }
-      return list;
-    }).catch((error_) => {
-      if (!cancelled) {
-        setDiscoverError(errorMessage(error_));
-      }
-    });
-    return () => {
-      cancelled = true;
-    };
-  }, [client, functionsProp]);
-  useEffect(() => {
-    if (prefill === void 0 || appliedNonce.current === prefill.nonce) {
-      return;
-    }
-    appliedNonce.current = prefill.nonce;
-    const target = prefill.functionPath;
-    queueMicrotask(() => {
-      setSelectedPath(target);
-      setOutcome(null);
-    });
-  }, [prefill]);
-  const effectivePath = selectedPath === "" ? functions[0]?.path ?? "" : selectedPath;
-  const run = async () => {
-    if (effectivePath === "") {
-      return;
-    }
-    let parsedArgs;
-    try {
-      parsedArgs = argsText.trim() === "" ? {} : JSON.parse(argsText);
-    } catch (parseError) {
-      setArgsError(t("Invalid JSON args: {message}", {
-        message: parseError.message
-      }));
-      setOutcome(null);
-      return;
-    }
-    setArgsError(null);
-    setRunning(true);
-    try {
-      const result = await probe({
-        args: parsedArgs,
-        functionPath: effectivePath,
-        shardKey: shardKey.trim(),
-        userId: runAsUserId.trim()
-      });
-      setOutcome(result);
-    } finally {
-      setRunning(false);
-    }
-  };
-  const runOnce = () => {
-    fireAndForget(run());
-  };
-  const onSelectChange = (event) => {
-    setSelectedPath(event.target.value);
-  };
-  const onArgsChange = (event_0) => {
-    setArgsText(event_0.target.value);
-  };
-  const onUserIdChange = (event_1) => {
-    setRunAsUserId(event_1.target.value);
-  };
-  return /* @__PURE__ */ jsxDEV("div", {
-    className: "flex flex-col gap-3",
-    "data-testid": "lunora-permissions-playground",
-    children: [discoverError !== null && /* @__PURE__ */ jsxDEV("p", {
-      className: "text-sm text-destructive",
-      "data-testid": "pp-discover-error",
-      role: "alert",
-      children: discoverError
-    }, void 0, false), !runAsIdentity && /* @__PURE__ */ jsxDEV(EmptyState, {
-      description: t("Dev only: runs the selected function as this user over the admin gate so you can test auth and RLS."),
-      testId: "pp-gate",
-      title: t("Set `runAsIdentity` to forge an identity and probe access.")
-    }, void 0, false), /* @__PURE__ */ jsxDEV("div", {
-      className: "flex flex-col gap-3 rounded-md border border-border p-3",
-      children: [/* @__PURE__ */ jsxDEV("div", {
-        className: "flex flex-col gap-1.5",
-        children: [/* @__PURE__ */ jsxDEV(Label, {
-          htmlFor: "pp-function",
-          children: t("Function")
-        }, void 0, false), /* @__PURE__ */ jsxDEV("select", {
-          "aria-label": t("Function"),
-          className: "flex h-9 w-full rounded-md border border-input bg-transparent px-3 py-1 text-sm shadow-xs outline-none focus-visible:border-ring focus-visible:ring-[3px] focus-visible:ring-ring/50",
-          "data-testid": "pp-function",
-          id: "pp-function",
-          onChange: onSelectChange,
-          value: effectivePath,
-          children: functions.map((descriptor) => /* @__PURE__ */ jsxDEV("option", {
-            value: descriptor.path,
-            children: [descriptor.path, " (", descriptor.kind, ")"]
-          }, descriptor.path, true))
-        }, void 0, false)]
-      }, void 0, true), /* @__PURE__ */ jsxDEV("div", {
-        className: "flex flex-col gap-1.5",
-        children: [/* @__PURE__ */ jsxDEV(Label, {
-          htmlFor: "pp-args",
-          children: t("Arguments")
-        }, void 0, false), /* @__PURE__ */ jsxDEV(Textarea, {
-          "aria-label": t("Arguments"),
-          className: "font-mono text-xs",
-          "data-testid": "pp-args",
-          id: "pp-args",
-          onChange: onArgsChange,
-          value: argsText
-        }, void 0, false)]
-      }, void 0, true), /* @__PURE__ */ jsxDEV(ShardInput, {
-        onChange: setShardKey,
-        testId: "pp-shard",
-        value: shardKey
-      }, void 0, false), /* @__PURE__ */ jsxDEV("div", {
-        className: "flex flex-col gap-1.5",
-        children: [/* @__PURE__ */ jsxDEV(Label, {
-          htmlFor: "pp-user",
-          children: t("Run as (userId)")
-        }, void 0, false), /* @__PURE__ */ jsxDEV(Input, {
-          "aria-label": t("Identity (userId) to run as"),
-          className: "font-mono text-xs",
-          "data-testid": "pp-user",
-          id: "pp-user",
-          onChange: onUserIdChange,
-          placeholder: t("Leave empty to run as admin"),
-          value: runAsUserId
-        }, void 0, false)]
-      }, void 0, true), /* @__PURE__ */ jsxDEV("div", {
-        className: "flex items-center gap-2",
-        children: [/* @__PURE__ */ jsxDEV(Button, {
-          "data-testid": "pp-run",
-          disabled: !runAsIdentity || running || effectivePath === "",
-          onClick: runOnce,
-          type: "button",
-          children: running ? t("Probing…") : t("Run probe")
-        }, void 0, false), runAsUserId.trim() !== "" && /* @__PURE__ */ jsxDEV(Badge, {
-          "data-testid": "pp-as-badge",
-          variant: "secondary",
-          children: t("as {userId}", {
-            userId: runAsUserId.trim()
-          })
-        }, void 0, false)]
-      }, void 0, true)]
-    }, void 0, true), argsError !== null && /* @__PURE__ */ jsxDEV("p", {
-      className: "text-sm text-destructive",
-      "data-testid": "pp-args-error",
-      role: "alert",
-      children: argsError
-    }, void 0, false), outcome !== null && outcome.kind === "allowed" && /* @__PURE__ */ jsxDEV("div", {
-      className: "flex flex-col gap-2",
-      "data-testid": "pp-outcome-allowed",
-      children: [/* @__PURE__ */ jsxDEV(Badge, {
-        variant: "secondary",
-        children: t("Allowed")
-      }, void 0, false), /* @__PURE__ */ jsxDEV("pre", {
-        className: "overflow-auto rounded-md border border-border bg-muted/50 p-3 font-mono text-xs",
-        "data-testid": "pp-result",
-        children: formatValue(outcome.value)
-      }, void 0, false)]
-    }, void 0, true), outcome !== null && outcome.kind === "denied" && /* @__PURE__ */ jsxDEV("div", {
-      className: "flex flex-col gap-2",
-      "data-testid": "pp-outcome-denied",
-      children: [/* @__PURE__ */ jsxDEV(Badge, {
-        variant: "destructive",
-        children: t("Denied")
-      }, void 0, false), /* @__PURE__ */ jsxDEV("pre", {
-        className: "overflow-auto rounded-md border border-border bg-muted/50 p-3 font-mono text-xs text-destructive",
-        "data-testid": "pp-denied",
-        role: "alert",
-        children: outcome.message
-      }, void 0, false)]
-    }, void 0, true)]
-  }, void 0, true);
-};
-
-const POLICY_SCAFFOLD_ENDPOINT = "/__lunora/policy-scaffold";
-const FAILURE_MESSAGES = {
-  "already-wired": "That procedure already has an rls(...) policy wired in.",
-  "file-exists": "A policy file with that name already exists — pick another name or edit it by hand.",
-  "invalid-identifier": "Name, table, and policy-set must be plain identifiers (letters, digits, _ or $).",
-  "unknown-procedure": "No exported procedure was found at that file path.",
-  "unsupported-procedure-shape": "That procedure uses the bare query({…}) form — convert it to the builder form (c.use(…).query(…)) before wiring RLS."
-};
-const applyPolicyScaffold = async (request) => {
-  const response = await fetch(POLICY_SCAFFOLD_ENDPOINT, {
-    body: JSON.stringify(request),
-    headers: {
-      "Content-Type": "application/json"
-    },
-    method: "POST"
-  });
-  const body = await response.json();
-  if (body.needsManualEdit === true) {
-    return {
-      kind: "needs-manual-edit",
-      message: body.message ?? "This change must be made by hand."
-    };
-  }
-  if (response.ok) {
-    return {
-      diagnostics: body.diagnostics ?? [],
-      kind: "ok",
-      label: body.fileName ?? body.exportName ?? ""
-    };
-  }
-  const token = body.error;
-  const message = token === void 0 ? `policy scaffold failed (${String(response.status)})` : FAILURE_MESSAGES[token] ?? token;
-  return {
-    kind: "error",
-    message
-  };
-};
-
-const EMPTY_FORM = {
-  exportName: "",
-  filePath: "",
-  policyName: "",
-  policies: "",
-  tableName: ""
-};
-const PolicyScaffolder = () => {
-  const t = useT();
-  const [mode, setMode] = useState(null);
-  const [busy, setBusy] = useState(false);
-  const [result, setResult] = useState(null);
-  const [form, setForm] = useState(EMPTY_FORM);
-  const onFieldChange = (event) => {
-    const field = event.target.name;
-    const {
-      value
-    } = event.target;
-    setForm((previous) => {
-      return {
-        ...previous,
-        [field]: value
-      };
-    });
-  };
-  const reset = () => {
-    setMode(null);
-    setForm(EMPTY_FORM);
-  };
-  const submit = async (request) => {
-    setBusy(true);
-    setResult(null);
-    try {
-      const outcome = await applyPolicyScaffold(request);
-      setResult(outcome);
-      if (outcome.kind === "ok") {
-        reset();
-      }
-    } catch (error) {
-      setResult({
-        kind: "error",
-        message: error instanceof Error ? error.message : String(error)
-      });
-    } finally {
-      setBusy(false);
-    }
-  };
-  const onSubmitScaffold = () => {
-    fireAndForget(submit({
-      kind: "scaffoldPolicy",
-      name: form.policyName.trim(),
-      table: form.tableName.trim()
-    }));
-  };
-  const onSubmitWire = () => {
-    fireAndForget(submit({
-      exportName: form.exportName.trim(),
-      filePath: form.filePath.trim(),
-      kind: "wireRls",
-      policies: form.policies.trim()
-    }));
-  };
-  const openScaffold = () => {
-    setResult(null);
-    setMode("scaffold");
-  };
-  const openWire = () => {
-    setResult(null);
-    setMode("wire");
-  };
-  return /* @__PURE__ */ jsxDEV(Card, {
-    "data-testid": "policy-scaffolder",
-    size: "sm",
-    children: [/* @__PURE__ */ jsxDEV(CardHeader, {
-      children: [/* @__PURE__ */ jsxDEV(CardTitle, {
-        children: t("Scaffold access rules")
-      }, void 0, false), /* @__PURE__ */ jsxDEV(CardDescription, {
-        children: t("Writes a new deny-by-default policy file under lunora/, or wires one into a procedure, then reruns codegen. Local dev only.")
-      }, void 0, false)]
-    }, void 0, true), /* @__PURE__ */ jsxDEV(CardContent, {
-      children: [/* @__PURE__ */ jsxDEV("div", {
-        className: "flex flex-wrap gap-2",
-        children: [/* @__PURE__ */ jsxDEV(Button, {
-          "data-testid": "policy-scaffolder-new",
-          onClick: openScaffold,
-          size: "xs",
-          type: "button",
-          variant: mode === "scaffold" ? "default" : "outline",
-          children: t("New policy file")
-        }, void 0, false), /* @__PURE__ */ jsxDEV(Button, {
-          "data-testid": "policy-scaffolder-wire",
-          onClick: openWire,
-          size: "xs",
-          type: "button",
-          variant: mode === "wire" ? "default" : "outline",
-          children: t("Wire into a procedure")
-        }, void 0, false)]
-      }, void 0, true), mode === "scaffold" && /* @__PURE__ */ jsxDEV("div", {
-        className: "mt-3 flex flex-wrap items-end gap-2",
-        "data-testid": "policy-scaffolder-new-form",
-        children: [/* @__PURE__ */ jsxDEV("div", {
-          className: "flex flex-col gap-1 text-xs",
-          children: [/* @__PURE__ */ jsxDEV(Label, {
-            htmlFor: "policy-scaffolder-name",
-            children: t("Policy name")
-          }, void 0, false), /* @__PURE__ */ jsxDEV(Input, {
-            "data-testid": "policy-scaffolder-name",
-            id: "policy-scaffolder-name",
-            name: "policyName",
-            onChange: onFieldChange,
-            value: form.policyName
-          }, void 0, false)]
-        }, void 0, true), /* @__PURE__ */ jsxDEV("div", {
-          className: "flex flex-col gap-1 text-xs",
-          children: [/* @__PURE__ */ jsxDEV(Label, {
-            htmlFor: "policy-scaffolder-table",
-            children: t("Table name")
-          }, void 0, false), /* @__PURE__ */ jsxDEV(Input, {
-            "data-testid": "policy-scaffolder-table",
-            id: "policy-scaffolder-table",
-            name: "tableName",
-            onChange: onFieldChange,
-            value: form.tableName
-          }, void 0, false)]
-        }, void 0, true), /* @__PURE__ */ jsxDEV(Button, {
-          "data-testid": "policy-scaffolder-create",
-          disabled: busy || form.policyName.trim() === "" || form.tableName.trim() === "",
-          onClick: onSubmitScaffold,
-          size: "xs",
-          type: "button",
-          children: busy ? t("Creating…") : t("Create policy file")
-        }, void 0, false), /* @__PURE__ */ jsxDEV(Button, {
-          onClick: reset,
-          size: "xs",
-          type: "button",
-          variant: "ghost",
-          children: t("Cancel")
-        }, void 0, false)]
-      }, void 0, true), mode === "wire" && /* @__PURE__ */ jsxDEV("div", {
-        className: "mt-3 flex flex-wrap items-end gap-2",
-        "data-testid": "policy-scaffolder-wire-form",
-        children: [/* @__PURE__ */ jsxDEV("div", {
-          className: "flex flex-col gap-1 text-xs",
-          children: [/* @__PURE__ */ jsxDEV(Label, {
-            htmlFor: "policy-scaffolder-file",
-            children: t("Procedure file path")
-          }, void 0, false), /* @__PURE__ */ jsxDEV(Input, {
-            "data-testid": "policy-scaffolder-file",
-            id: "policy-scaffolder-file",
-            name: "filePath",
-            onChange: onFieldChange,
-            value: form.filePath
-          }, void 0, false)]
-        }, void 0, true), /* @__PURE__ */ jsxDEV("div", {
-          className: "flex flex-col gap-1 text-xs",
-          children: [/* @__PURE__ */ jsxDEV(Label, {
-            htmlFor: "policy-scaffolder-export",
-            children: t("Exported procedure")
-          }, void 0, false), /* @__PURE__ */ jsxDEV(Input, {
-            "data-testid": "policy-scaffolder-export",
-            id: "policy-scaffolder-export",
-            name: "exportName",
-            onChange: onFieldChange,
-            value: form.exportName
-          }, void 0, false)]
-        }, void 0, true), /* @__PURE__ */ jsxDEV("div", {
-          className: "flex flex-col gap-1 text-xs",
-          children: [/* @__PURE__ */ jsxDEV(Label, {
-            htmlFor: "policy-scaffolder-policies",
-            children: t("Policy set identifier")
-          }, void 0, false), /* @__PURE__ */ jsxDEV(Input, {
-            "data-testid": "policy-scaffolder-policies",
-            id: "policy-scaffolder-policies",
-            name: "policies",
-            onChange: onFieldChange,
-            value: form.policies
-          }, void 0, false)]
-        }, void 0, true), /* @__PURE__ */ jsxDEV(Button, {
-          "data-testid": "policy-scaffolder-apply",
-          disabled: busy || form.filePath.trim() === "" || form.exportName.trim() === "" || form.policies.trim() === "",
-          onClick: onSubmitWire,
-          size: "xs",
-          type: "button",
-          children: busy ? t("Wiring…") : t("Wire RLS")
-        }, void 0, false), /* @__PURE__ */ jsxDEV(Button, {
-          onClick: reset,
-          size: "xs",
-          type: "button",
-          variant: "ghost",
-          children: t("Cancel")
-        }, void 0, false)]
-      }, void 0, true), result?.kind === "error" && /* @__PURE__ */ jsxDEV("p", {
-        className: "mt-3 text-sm text-destructive",
-        "data-testid": "policy-scaffolder-error",
-        role: "alert",
-        children: result.message
-      }, void 0, false), result?.kind === "needs-manual-edit" && /* @__PURE__ */ jsxDEV("p", {
-        className: "mt-3 text-sm text-amber-600 dark:text-amber-500",
-        "data-testid": "policy-scaffolder-manual",
-        role: "alert",
-        children: t("This change must be made by hand — the scaffolder only adds new, deny-by-default rules.")
-      }, void 0, false), result?.kind === "ok" && /* @__PURE__ */ jsxDEV("div", {
-        className: "mt-3 flex flex-col gap-1",
-        "data-testid": "policy-scaffolder-ok",
-        children: [/* @__PURE__ */ jsxDEV("p", {
-          className: "text-sm text-emerald-600 dark:text-emerald-500",
-          children: t("Scaffolded {label} and reran codegen. Fill in the `when` predicates before relying on it.", {
-            label: result.label
-          })
-        }, void 0, false), result.diagnostics.length > 0 && /* @__PURE__ */ jsxDEV("ul", {
-          className: "flex flex-col gap-0.5",
-          "data-testid": "policy-scaffolder-diagnostics",
-          children: result.diagnostics.map((diagnostic) => /* @__PURE__ */ jsxDEV("li", {
-            className: "font-mono text-[11px] text-destructive",
-            children: diagnostic
-          }, diagnostic, false))
-        }, void 0, false)]
-      }, void 0, true)]
-    }, void 0, true)]
-  }, void 0, true);
-};
-
-const PermissionsPanel = ({
-  functions,
-  runAsIdentity = false,
-  schemaEditable = false
-} = {}) => {
-  const t = useT();
-  const [prefill, setPrefill] = useState(void 0);
-  const onProbe = (_table, _operation, procedure) => {
-    if (procedure !== "") {
-      setPrefill((previous) => {
-        return {
-          functionPath: procedure,
-          nonce: (previous?.nonce ?? 0) + 1
-        };
-      });
-    }
-  };
-  return /* @__PURE__ */ jsxDEV("div", {
-    className: "flex flex-col gap-8",
-    "data-testid": "lunora-permissions",
-    children: [/* @__PURE__ */ jsxDEV("section", {
-      className: "flex flex-col gap-3",
-      children: [/* @__PURE__ */ jsxDEV("header", {
-        className: "border-b border-border px-4 py-3",
-        children: /* @__PURE__ */ jsxDEV("span", {
-          className: "font-mono text-[11px] tracking-wide text-muted-foreground uppercase",
-          children: t("Permissions")
-        }, void 0, false)
-      }, void 0, false), /* @__PURE__ */ jsxDEV(PermissionsMatrix, {
-        onProbe
-      }, void 0, false)]
-    }, void 0, true), /* @__PURE__ */ jsxDEV("section", {
-      className: "flex flex-col gap-3",
-      children: /* @__PURE__ */ jsxDEV(Card, {
-        className: "gap-0 py-0",
-        children: [/* @__PURE__ */ jsxDEV("header", {
-          className: "border-b border-border px-4 py-3",
-          children: /* @__PURE__ */ jsxDEV("span", {
-            className: "font-mono text-[11px] tracking-wide text-muted-foreground uppercase",
-            children: t("Probe")
-          }, void 0, false)
-        }, void 0, false), /* @__PURE__ */ jsxDEV(CardContent, {
-          className: "px-4 py-4",
-          children: [/* @__PURE__ */ jsxDEV("p", {
-            className: "mb-3 text-sm text-muted-foreground",
-            children: t("Pick a function and an identity, then run it to see the access outcome.")
-          }, void 0, false), /* @__PURE__ */ jsxDEV(PermissionsPlayground, {
-            functions,
-            prefill,
-            runAsIdentity
-          }, void 0, false)]
-        }, void 0, true)]
-      }, void 0, true)
-    }, void 0, false), schemaEditable && /* @__PURE__ */ jsxDEV("section", {
-      className: "flex flex-col gap-2",
-      children: /* @__PURE__ */ jsxDEV(PolicyScaffolder, {}, void 0, false)
-    }, void 0, false)]
-  }, void 0, true);
-};
-
-export { PermissionsPanel };