@lunora/studio 1.0.0-alpha.4 → 1.0.0-alpha.41

package/dist/packem_chunks/permissions-panel.js

@@ -0,0 +1,805 @@
+import { useState, useRef, useEffect } from 'react';
+import { C as Card, b as CardHeader, c as CardTitle, d as CardDescription, a as CardContent } from '../packem_shared/card-DURq3ElK.js';
+import { useT } from '../packem_shared/DEFAULT_LOCALE-CiX4W7Kr.js';
+import { c } from 'react/compiler-runtime';
+import { E as ErrorAlert } from '../packem_shared/error-alert-CXjqyGw9.js';
+import { L as LiveError } from '../packem_shared/live-status-FZ0psC1z.js';
+import { B as Badge } from '../packem_shared/badge-B2PKA1-5.js';
+import { B as Button } from '../packem_shared/button-BhsN2uZH.js';
+import { E as EmptyState } from '../packem_shared/empty-state-DY_oe0k6.js';
+import { T as Table, a as TableHeader, b as TableRow, c as TableHead, d as TableBody, e as TableCell } from '../packem_shared/table-DsCa9Qp9.js';
+import { u as useAdminQuery } from '../packem_shared/use-admin-query-CfHYWx5n.js';
+import { ADMIN_FUNCTIONS } from '../packem_shared/ADMIN_FUNCTIONS-BHHJi3Gb.js';
+import { jsxDEV } from 'react/jsx-dev-runtime';
+import { useLunora } from '@lunora/react';
+import { ShardInput } from '../packem_shared/ShardInput-gx_DZXXn.js';
+import { I as Input } from '../packem_shared/input-XH4r1Pt1.js';
+import { L as Label } from '../packem_shared/label-D8ykjn5J.js';
+import { T as Textarea } from '../packem_shared/textarea-D3gaCU_-.js';
+import { c as callOptions, a as adminRef, e as errorMessage, f as fireAndForget } from '../packem_shared/internal-CYcbqMjX.js';
+
+const OPERATIONS = ["read", "insert", "update", "delete"];
+const operationLabel = (t, operation) => ({
+  delete: t("Delete"),
+  insert: t("Insert"),
+  read: t("Read"),
+  update: t("Update")
+})[operation];
+const uncoveredTables = (advisories) => {
+  const set = /* @__PURE__ */ new Set();
+  for (const advisory of advisories?.advisories ?? []) {
+    if (advisory.name === "rls_uncovered_table") {
+      const {
+        table
+      } = advisory.metadata;
+      if (typeof table === "string" && table !== "") {
+        set.add(table);
+      }
+    }
+  }
+  return set;
+};
+const buildRows = (policies, maskColumns, uncovered) => {
+  const byTable = /* @__PURE__ */ new Map();
+  const ensure = (table) => {
+    const existing = byTable.get(table);
+    if (existing !== void 0) {
+      return existing;
+    }
+    const row = {
+      cells: {
+        delete: {},
+        insert: {},
+        read: {},
+        update: {}
+      },
+      maskedColumns: [],
+      table,
+      uncovered: uncovered.has(table)
+    };
+    byTable.set(table, row);
+    return row;
+  };
+  for (const policy of policies) {
+    ensure(policy.table).cells[policy.on] = {
+      procedure: policy.procedure
+    };
+  }
+  for (const column of maskColumns) {
+    const row = ensure(column.table);
+    if (!row.maskedColumns.includes(column.column)) {
+      row.maskedColumns.push(column.column);
+    }
+  }
+  for (const table of uncovered) {
+    ensure(table);
+  }
+  return [...byTable.values()].toSorted((a, b) => a.table.localeCompare(b.table));
+};
+const PermissionsMatrix = (t0) => {
+  const $ = c(17);
+  let t1;
+  if ($[0] !== t0) {
+    t1 = t0 === void 0 ? {} : t0;
+    $[0] = t0;
+    $[1] = t1;
+  } else {
+    t1 = $[1];
+  }
+  const {
+    onProbe
+  } = t1;
+  const t = useT();
+  let t2;
+  let t3;
+  if ($[2] === /* @__PURE__ */ Symbol.for("react.memo_cache_sentinel")) {
+    t2 = {};
+    t3 = {
+      live: true
+    };
+    $[2] = t2;
+    $[3] = t3;
+  } else {
+    t2 = $[2];
+    t3 = $[3];
+  }
+  const policiesQuery = useAdminQuery(ADMIN_FUNCTIONS.rlsPolicies, t2, t3);
+  let t4;
+  if ($[4] === /* @__PURE__ */ Symbol.for("react.memo_cache_sentinel")) {
+    t4 = {};
+    $[4] = t4;
+  } else {
+    t4 = $[4];
+  }
+  const masksQuery = useAdminQuery(ADMIN_FUNCTIONS.maskPolicies, t4);
+  let t5;
+  if ($[5] === /* @__PURE__ */ Symbol.for("react.memo_cache_sentinel")) {
+    t5 = {};
+    $[5] = t5;
+  } else {
+    t5 = $[5];
+  }
+  const advisoriesQuery = useAdminQuery(ADMIN_FUNCTIONS.getAdvisories, t5);
+  let t6;
+  if ($[6] !== advisoriesQuery.data || $[7] !== masksQuery.data || $[8] !== onProbe || $[9] !== policiesQuery || $[10] !== t) {
+    let policies = null;
+    if (policiesQuery.data !== void 0) {
+      policies = Array.isArray(policiesQuery.data.policies) ? policiesQuery.data.policies : [];
+    }
+    const maskColumns = Array.isArray(masksQuery.data?.columns) ? masksQuery.data.columns : [];
+    const advisories = advisoriesQuery.data ?? null;
+    const {
+      error,
+      errorSource,
+      liveError
+    } = policiesQuery;
+    const rows = policies === null ? [] : buildRows(policies, maskColumns, uncoveredTables(advisories));
+    let t7;
+    if ($[12] !== liveError) {
+      t7 = /* @__PURE__ */ jsxDEV("div", {
+        className: "flex items-center justify-end",
+        children: /* @__PURE__ */ jsxDEV(LiveError, {
+          message: liveError,
+          prefix: "pm"
+        }, void 0, false)
+      }, void 0, false);
+      $[12] = liveError;
+      $[13] = t7;
+    } else {
+      t7 = $[13];
+    }
+    let t8;
+    if ($[14] !== error || $[15] !== errorSource) {
+      t8 = error !== null && /* @__PURE__ */ jsxDEV(ErrorAlert, {
+        error: errorSource,
+        testId: "pm-error"
+      }, void 0, false);
+      $[14] = error;
+      $[15] = errorSource;
+      $[16] = t8;
+    } else {
+      t8 = $[16];
+    }
+    t6 = /* @__PURE__ */ jsxDEV("div", {
+      className: "flex flex-col gap-3",
+      "data-testid": "lunora-permissions-matrix",
+      children: [t7, t8, policies !== null && rows.length === 0 ? /* @__PURE__ */ jsxDEV(EmptyState, {
+        description: t("Add a `definePolicy` and wire it through `.use(rls(...))` to populate this matrix."),
+        testId: "pm-empty",
+        title: t("No policy")
+      }, void 0, false) : /* @__PURE__ */ jsxDEV(Table, {
+        "data-testid": "pm-table",
+        children: [/* @__PURE__ */ jsxDEV(TableHeader, {
+          children: /* @__PURE__ */ jsxDEV(TableRow, {
+            children: [/* @__PURE__ */ jsxDEV(TableHead, {
+              children: t("Table")
+            }, void 0, false), OPERATIONS.map((operation) => /* @__PURE__ */ jsxDEV(TableHead, {
+              children: operationLabel(t, operation)
+            }, operation, false)), /* @__PURE__ */ jsxDEV(TableHead, {
+              children: t("Masked columns")
+            }, void 0, false)]
+          }, void 0, true)
+        }, void 0, false), /* @__PURE__ */ jsxDEV(TableBody, {
+          children: rows.map((row) => /* @__PURE__ */ jsxDEV(TableRow, {
+            "data-testid": `pm-row-${row.table}`,
+            children: [/* @__PURE__ */ jsxDEV(TableCell, {
+              className: "font-mono text-xs",
+              children: /* @__PURE__ */ jsxDEV("span", {
+                className: "flex items-center gap-1.5",
+                children: [row.table, row.uncovered && /* @__PURE__ */ jsxDEV(Badge, {
+                  "data-testid": `pm-uncovered-${row.table}`,
+                  title: t("Uncovered — reachable without a policy"),
+                  variant: "destructive",
+                  children: t("Uncovered — reachable without a policy")
+                }, void 0, false)]
+              }, void 0, true)
+            }, void 0, false), OPERATIONS.map((operation_0) => {
+              const cell = row.cells[operation_0];
+              return /* @__PURE__ */ jsxDEV(TableCell, {
+                "data-testid": `pm-cell-${row.table}-${operation_0}`,
+                children: cell.procedure === void 0 ? /* @__PURE__ */ jsxDEV("span", {
+                  className: "text-xs text-muted-foreground",
+                  children: t("No policy")
+                }, void 0, false) : /* @__PURE__ */ jsxDEV("span", {
+                  className: "flex flex-col gap-1",
+                  children: [/* @__PURE__ */ jsxDEV(Badge, {
+                    variant: "secondary",
+                    children: t("Covered by {procedure}", {
+                      procedure: cell.procedure
+                    })
+                  }, void 0, false), onProbe !== void 0 && /* @__PURE__ */ jsxDEV(Button, {
+                    className: "h-auto justify-start p-0 text-[11px]",
+                    "data-testid": `pm-probe-${row.table}-${operation_0}`,
+                    onClick: () => {
+                      onProbe(row.table, operation_0, cell.procedure ?? "");
+                    },
+                    size: "xs",
+                    type: "button",
+                    variant: "ghost",
+                    children: t("Probe this")
+                  }, void 0, false)]
+                }, void 0, true)
+              }, operation_0, false);
+            }), /* @__PURE__ */ jsxDEV(TableCell, {
+              children: row.maskedColumns.length === 0 ? /* @__PURE__ */ jsxDEV("span", {
+                "aria-hidden": "true",
+                className: "text-muted-foreground",
+                children: "—"
+              }, void 0, false) : /* @__PURE__ */ jsxDEV("span", {
+                className: "flex flex-wrap gap-1",
+                children: row.maskedColumns.map(_temp)
+              }, void 0, false)
+            }, void 0, false)]
+          }, row.table, true))
+        }, void 0, false)]
+      }, void 0, true)]
+    }, void 0, true);
+    $[6] = advisoriesQuery.data;
+    $[7] = masksQuery.data;
+    $[8] = onProbe;
+    $[9] = policiesQuery;
+    $[10] = t;
+    $[11] = t6;
+  } else {
+    t6 = $[11];
+  }
+  return t6;
+};
+function _temp(column) {
+  return /* @__PURE__ */ jsxDEV(Badge, {
+    variant: "outline",
+    children: column
+  }, column, false);
+}
+
+const RUN_AS = adminRef(ADMIN_FUNCTIONS.runAs);
+const useRunAsProbe = () => {
+  const client = useLunora();
+  return async ({
+    args,
+    functionPath,
+    shardKey = "",
+    userId
+  }) => {
+    const reference = RUN_AS;
+    try {
+      const value = await client.query(reference, {
+        args,
+        functionPath,
+        userId
+      }, callOptions(shardKey));
+      return {
+        kind: "allowed",
+        value
+      };
+    } catch (error) {
+      return {
+        kind: "denied",
+        message: error instanceof Error ? error.message : String(error)
+      };
+    }
+  };
+};
+
+const formatValue = (value) => value === void 0 ? "undefined" : JSON.stringify(value, null, 2);
+const PermissionsPlayground = ({
+  functions: functionsProp,
+  prefill,
+  runAsIdentity = false
+} = {}) => {
+  const client = useLunora();
+  const t = useT();
+  const probe = useRunAsProbe();
+  const [discovered, setDiscovered] = useState(null);
+  const [discoverError, setDiscoverError] = useState(null);
+  const functions = functionsProp ?? discovered ?? [];
+  const [selectedPath, setSelectedPath] = useState("");
+  const [argsText, setArgsText] = useState("{}");
+  const [shardKey, setShardKey] = useState("");
+  const [runAsUserId, setRunAsUserId] = useState("");
+  const [running, setRunning] = useState(false);
+  const [outcome, setOutcome] = useState(null);
+  const [argsError, setArgsError] = useState(null);
+  const appliedNonce = useRef(-1);
+  useEffect(() => {
+    if (functionsProp !== void 0) {
+      return void 0;
+    }
+    let cancelled = false;
+    client.listFunctions().then((list) => {
+      if (!cancelled) {
+        setDiscovered(list);
+      }
+      return list;
+    }).catch((error_) => {
+      if (!cancelled) {
+        setDiscoverError(errorMessage(error_));
+      }
+    });
+    return () => {
+      cancelled = true;
+    };
+  }, [client, functionsProp]);
+  useEffect(() => {
+    if (prefill === void 0 || appliedNonce.current === prefill.nonce) {
+      return;
+    }
+    appliedNonce.current = prefill.nonce;
+    const target = prefill.functionPath;
+    queueMicrotask(() => {
+      setSelectedPath(target);
+      setOutcome(null);
+    });
+  }, [prefill]);
+  const effectivePath = selectedPath === "" ? functions[0]?.path ?? "" : selectedPath;
+  const run = async () => {
+    if (effectivePath === "") {
+      return;
+    }
+    let parsedArgs;
+    try {
+      parsedArgs = argsText.trim() === "" ? {} : JSON.parse(argsText);
+    } catch (parseError) {
+      setArgsError(t("Invalid JSON args: {message}", {
+        message: parseError.message
+      }));
+      setOutcome(null);
+      return;
+    }
+    setArgsError(null);
+    setRunning(true);
+    try {
+      const result = await probe({
+        args: parsedArgs,
+        functionPath: effectivePath,
+        shardKey: shardKey.trim(),
+        userId: runAsUserId.trim()
+      });
+      setOutcome(result);
+    } finally {
+      setRunning(false);
+    }
+  };
+  const runOnce = () => {
+    fireAndForget(run());
+  };
+  const onSelectChange = (event) => {
+    setSelectedPath(event.target.value);
+  };
+  const onArgsChange = (event_0) => {
+    setArgsText(event_0.target.value);
+  };
+  const onUserIdChange = (event_1) => {
+    setRunAsUserId(event_1.target.value);
+  };
+  return /* @__PURE__ */ jsxDEV("div", {
+    className: "flex flex-col gap-3",
+    "data-testid": "lunora-permissions-playground",
+    children: [discoverError !== null && /* @__PURE__ */ jsxDEV("p", {
+      className: "text-sm text-destructive",
+      "data-testid": "pp-discover-error",
+      role: "alert",
+      children: discoverError
+    }, void 0, false), !runAsIdentity && /* @__PURE__ */ jsxDEV(EmptyState, {
+      description: t("Dev only: runs the selected function as this user over the admin gate so you can test auth and RLS."),
+      testId: "pp-gate",
+      title: t("Set `runAsIdentity` to forge an identity and probe access.")
+    }, void 0, false), /* @__PURE__ */ jsxDEV("div", {
+      className: "flex flex-col gap-3 rounded-md border border-border p-3",
+      children: [/* @__PURE__ */ jsxDEV("div", {
+        className: "flex flex-col gap-1.5",
+        children: [/* @__PURE__ */ jsxDEV(Label, {
+          htmlFor: "pp-function",
+          children: t("Function")
+        }, void 0, false), /* @__PURE__ */ jsxDEV("select", {
+          "aria-label": t("Function"),
+          className: "flex h-9 w-full rounded-md border border-input bg-transparent px-3 py-1 text-sm shadow-xs outline-none focus-visible:border-ring focus-visible:ring-[3px] focus-visible:ring-ring/50",
+          "data-testid": "pp-function",
+          id: "pp-function",
+          onChange: onSelectChange,
+          value: effectivePath,
+          children: functions.map((descriptor) => /* @__PURE__ */ jsxDEV("option", {
+            value: descriptor.path,
+            children: [descriptor.path, " (", descriptor.kind, ")"]
+          }, descriptor.path, true))
+        }, void 0, false)]
+      }, void 0, true), /* @__PURE__ */ jsxDEV("div", {
+        className: "flex flex-col gap-1.5",
+        children: [/* @__PURE__ */ jsxDEV(Label, {
+          htmlFor: "pp-args",
+          children: t("Arguments")
+        }, void 0, false), /* @__PURE__ */ jsxDEV(Textarea, {
+          "aria-label": t("Arguments"),
+          className: "font-mono text-xs",
+          "data-testid": "pp-args",
+          id: "pp-args",
+          onChange: onArgsChange,
+          value: argsText
+        }, void 0, false)]
+      }, void 0, true), /* @__PURE__ */ jsxDEV(ShardInput, {
+        onChange: setShardKey,
+        testId: "pp-shard",
+        value: shardKey
+      }, void 0, false), /* @__PURE__ */ jsxDEV("div", {
+        className: "flex flex-col gap-1.5",
+        children: [/* @__PURE__ */ jsxDEV(Label, {
+          htmlFor: "pp-user",
+          children: t("Run as (userId)")
+        }, void 0, false), /* @__PURE__ */ jsxDEV(Input, {
+          "aria-label": t("Identity (userId) to run as"),
+          className: "font-mono text-xs",
+          "data-testid": "pp-user",
+          id: "pp-user",
+          onChange: onUserIdChange,
+          placeholder: t("Leave empty to run as admin"),
+          value: runAsUserId
+        }, void 0, false)]
+      }, void 0, true), /* @__PURE__ */ jsxDEV("div", {
+        className: "flex items-center gap-2",
+        children: [/* @__PURE__ */ jsxDEV(Button, {
+          "data-testid": "pp-run",
+          disabled: !runAsIdentity || running || effectivePath === "",
+          onClick: runOnce,
+          type: "button",
+          children: running ? t("Probing…") : t("Run probe")
+        }, void 0, false), runAsUserId.trim() !== "" && /* @__PURE__ */ jsxDEV(Badge, {
+          "data-testid": "pp-as-badge",
+          variant: "secondary",
+          children: t("as {userId}", {
+            userId: runAsUserId.trim()
+          })
+        }, void 0, false)]
+      }, void 0, true)]
+    }, void 0, true), argsError !== null && /* @__PURE__ */ jsxDEV("p", {
+      className: "text-sm text-destructive",
+      "data-testid": "pp-args-error",
+      role: "alert",
+      children: argsError
+    }, void 0, false), outcome !== null && outcome.kind === "allowed" && /* @__PURE__ */ jsxDEV("div", {
+      className: "flex flex-col gap-2",
+      "data-testid": "pp-outcome-allowed",
+      children: [/* @__PURE__ */ jsxDEV(Badge, {
+        variant: "secondary",
+        children: t("Allowed")
+      }, void 0, false), /* @__PURE__ */ jsxDEV("pre", {
+        className: "overflow-auto rounded-md border border-border bg-muted/50 p-3 font-mono text-xs",
+        "data-testid": "pp-result",
+        children: formatValue(outcome.value)
+      }, void 0, false)]
+    }, void 0, true), outcome !== null && outcome.kind === "denied" && /* @__PURE__ */ jsxDEV("div", {
+      className: "flex flex-col gap-2",
+      "data-testid": "pp-outcome-denied",
+      children: [/* @__PURE__ */ jsxDEV(Badge, {
+        variant: "destructive",
+        children: t("Denied")
+      }, void 0, false), /* @__PURE__ */ jsxDEV("pre", {
+        className: "overflow-auto rounded-md border border-border bg-muted/50 p-3 font-mono text-xs text-destructive",
+        "data-testid": "pp-denied",
+        role: "alert",
+        children: outcome.message
+      }, void 0, false)]
+    }, void 0, true)]
+  }, void 0, true);
+};
+
+const POLICY_SCAFFOLD_ENDPOINT = "/__lunora/policy-scaffold";
+const FAILURE_MESSAGES = {
+  "already-wired": "That procedure already has an rls(...) policy wired in.",
+  "file-exists": "A policy file with that name already exists — pick another name or edit it by hand.",
+  "invalid-identifier": "Name, table, and policy-set must be plain identifiers (letters, digits, _ or $).",
+  "unknown-procedure": "No exported procedure was found at that file path.",
+  "unsupported-procedure-shape": "That procedure uses the bare query({…}) form — convert it to the builder form (c.use(…).query(…)) before wiring RLS."
+};
+const applyPolicyScaffold = async (request) => {
+  const response = await fetch(POLICY_SCAFFOLD_ENDPOINT, {
+    body: JSON.stringify(request),
+    headers: {
+      "Content-Type": "application/json"
+    },
+    method: "POST"
+  });
+  const body = await response.json();
+  if (body.needsManualEdit === true) {
+    return {
+      kind: "needs-manual-edit",
+      message: body.message ?? "This change must be made by hand."
+    };
+  }
+  if (response.ok) {
+    return {
+      diagnostics: body.diagnostics ?? [],
+      kind: "ok",
+      label: body.fileName ?? body.exportName ?? ""
+    };
+  }
+  const token = body.error;
+  const message = token === void 0 ? `policy scaffold failed (${String(response.status)})` : FAILURE_MESSAGES[token] ?? token;
+  return {
+    kind: "error",
+    message
+  };
+};
+
+const EMPTY_FORM = {
+  exportName: "",
+  filePath: "",
+  policyName: "",
+  policies: "",
+  tableName: ""
+};
+const PolicyScaffolder = () => {
+  const t = useT();
+  const [mode, setMode] = useState(null);
+  const [busy, setBusy] = useState(false);
+  const [result, setResult] = useState(null);
+  const [form, setForm] = useState(EMPTY_FORM);
+  const onFieldChange = (event) => {
+    const field = event.target.name;
+    const {
+      value
+    } = event.target;
+    setForm((previous) => {
+      return {
+        ...previous,
+        [field]: value
+      };
+    });
+  };
+  const reset = () => {
+    setMode(null);
+    setForm(EMPTY_FORM);
+  };
+  const submit = async (request) => {
+    setBusy(true);
+    setResult(null);
+    try {
+      const outcome = await applyPolicyScaffold(request);
+      setResult(outcome);
+      if (outcome.kind === "ok") {
+        reset();
+      }
+    } catch (error) {
+      setResult({
+        kind: "error",
+        message: error instanceof Error ? error.message : String(error)
+      });
+    } finally {
+      setBusy(false);
+    }
+  };
+  const onSubmitScaffold = () => {
+    fireAndForget(submit({
+      kind: "scaffoldPolicy",
+      name: form.policyName.trim(),
+      table: form.tableName.trim()
+    }));
+  };
+  const onSubmitWire = () => {
+    fireAndForget(submit({
+      exportName: form.exportName.trim(),
+      filePath: form.filePath.trim(),
+      kind: "wireRls",
+      policies: form.policies.trim()
+    }));
+  };
+  const openScaffold = () => {
+    setResult(null);
+    setMode("scaffold");
+  };
+  const openWire = () => {
+    setResult(null);
+    setMode("wire");
+  };
+  return /* @__PURE__ */ jsxDEV(Card, {
+    "data-testid": "policy-scaffolder",
+    size: "sm",
+    children: [/* @__PURE__ */ jsxDEV(CardHeader, {
+      children: [/* @__PURE__ */ jsxDEV(CardTitle, {
+        children: t("Scaffold access rules")
+      }, void 0, false), /* @__PURE__ */ jsxDEV(CardDescription, {
+        children: t("Writes a new deny-by-default policy file under lunora/, or wires one into a procedure, then reruns codegen. Local dev only.")
+      }, void 0, false)]
+    }, void 0, true), /* @__PURE__ */ jsxDEV(CardContent, {
+      children: [/* @__PURE__ */ jsxDEV("div", {
+        className: "flex flex-wrap gap-2",
+        children: [/* @__PURE__ */ jsxDEV(Button, {
+          "data-testid": "policy-scaffolder-new",
+          onClick: openScaffold,
+          size: "xs",
+          type: "button",
+          variant: mode === "scaffold" ? "default" : "outline",
+          children: t("New policy file")
+        }, void 0, false), /* @__PURE__ */ jsxDEV(Button, {
+          "data-testid": "policy-scaffolder-wire",
+          onClick: openWire,
+          size: "xs",
+          type: "button",
+          variant: mode === "wire" ? "default" : "outline",
+          children: t("Wire into a procedure")
+        }, void 0, false)]
+      }, void 0, true), mode === "scaffold" && /* @__PURE__ */ jsxDEV("div", {
+        className: "mt-3 flex flex-wrap items-end gap-2",
+        "data-testid": "policy-scaffolder-new-form",
+        children: [/* @__PURE__ */ jsxDEV("div", {
+          className: "flex flex-col gap-1 text-xs",
+          children: [/* @__PURE__ */ jsxDEV(Label, {
+            htmlFor: "policy-scaffolder-name",
+            children: t("Policy name")
+          }, void 0, false), /* @__PURE__ */ jsxDEV(Input, {
+            "data-testid": "policy-scaffolder-name",
+            id: "policy-scaffolder-name",
+            name: "policyName",
+            onChange: onFieldChange,
+            value: form.policyName
+          }, void 0, false)]
+        }, void 0, true), /* @__PURE__ */ jsxDEV("div", {
+          className: "flex flex-col gap-1 text-xs",
+          children: [/* @__PURE__ */ jsxDEV(Label, {
+            htmlFor: "policy-scaffolder-table",
+            children: t("Table name")
+          }, void 0, false), /* @__PURE__ */ jsxDEV(Input, {
+            "data-testid": "policy-scaffolder-table",
+            id: "policy-scaffolder-table",
+            name: "tableName",
+            onChange: onFieldChange,
+            value: form.tableName
+          }, void 0, false)]
+        }, void 0, true), /* @__PURE__ */ jsxDEV(Button, {
+          "data-testid": "policy-scaffolder-create",
+          disabled: busy || form.policyName.trim() === "" || form.tableName.trim() === "",
+          onClick: onSubmitScaffold,
+          size: "xs",
+          type: "button",
+          children: busy ? t("Creating…") : t("Create policy file")
+        }, void 0, false), /* @__PURE__ */ jsxDEV(Button, {
+          onClick: reset,
+          size: "xs",
+          type: "button",
+          variant: "ghost",
+          children: t("Cancel")
+        }, void 0, false)]
+      }, void 0, true), mode === "wire" && /* @__PURE__ */ jsxDEV("div", {
+        className: "mt-3 flex flex-wrap items-end gap-2",
+        "data-testid": "policy-scaffolder-wire-form",
+        children: [/* @__PURE__ */ jsxDEV("div", {
+          className: "flex flex-col gap-1 text-xs",
+          children: [/* @__PURE__ */ jsxDEV(Label, {
+            htmlFor: "policy-scaffolder-file",
+            children: t("Procedure file path")
+          }, void 0, false), /* @__PURE__ */ jsxDEV(Input, {
+            "data-testid": "policy-scaffolder-file",
+            id: "policy-scaffolder-file",
+            name: "filePath",
+            onChange: onFieldChange,
+            value: form.filePath
+          }, void 0, false)]
+        }, void 0, true), /* @__PURE__ */ jsxDEV("div", {
+          className: "flex flex-col gap-1 text-xs",
+          children: [/* @__PURE__ */ jsxDEV(Label, {
+            htmlFor: "policy-scaffolder-export",
+            children: t("Exported procedure")
+          }, void 0, false), /* @__PURE__ */ jsxDEV(Input, {
+            "data-testid": "policy-scaffolder-export",
+            id: "policy-scaffolder-export",
+            name: "exportName",
+            onChange: onFieldChange,
+            value: form.exportName
+          }, void 0, false)]
+        }, void 0, true), /* @__PURE__ */ jsxDEV("div", {
+          className: "flex flex-col gap-1 text-xs",
+          children: [/* @__PURE__ */ jsxDEV(Label, {
+            htmlFor: "policy-scaffolder-policies",
+            children: t("Policy set identifier")
+          }, void 0, false), /* @__PURE__ */ jsxDEV(Input, {
+            "data-testid": "policy-scaffolder-policies",
+            id: "policy-scaffolder-policies",
+            name: "policies",
+            onChange: onFieldChange,
+            value: form.policies
+          }, void 0, false)]
+        }, void 0, true), /* @__PURE__ */ jsxDEV(Button, {
+          "data-testid": "policy-scaffolder-apply",
+          disabled: busy || form.filePath.trim() === "" || form.exportName.trim() === "" || form.policies.trim() === "",
+          onClick: onSubmitWire,
+          size: "xs",
+          type: "button",
+          children: busy ? t("Wiring…") : t("Wire RLS")
+        }, void 0, false), /* @__PURE__ */ jsxDEV(Button, {
+          onClick: reset,
+          size: "xs",
+          type: "button",
+          variant: "ghost",
+          children: t("Cancel")
+        }, void 0, false)]
+      }, void 0, true), result?.kind === "error" && /* @__PURE__ */ jsxDEV("p", {
+        className: "mt-3 text-sm text-destructive",
+        "data-testid": "policy-scaffolder-error",
+        role: "alert",
+        children: result.message
+      }, void 0, false), result?.kind === "needs-manual-edit" && /* @__PURE__ */ jsxDEV("p", {
+        className: "mt-3 text-sm text-amber-600 dark:text-amber-500",
+        "data-testid": "policy-scaffolder-manual",
+        role: "alert",
+        children: t("This change must be made by hand — the scaffolder only adds new, deny-by-default rules.")
+      }, void 0, false), result?.kind === "ok" && /* @__PURE__ */ jsxDEV("div", {
+        className: "mt-3 flex flex-col gap-1",
+        "data-testid": "policy-scaffolder-ok",
+        children: [/* @__PURE__ */ jsxDEV("p", {
+          className: "text-sm text-emerald-600 dark:text-emerald-500",
+          children: t("Scaffolded {label} and reran codegen. Fill in the `when` predicates before relying on it.", {
+            label: result.label
+          })
+        }, void 0, false), result.diagnostics.length > 0 && /* @__PURE__ */ jsxDEV("ul", {
+          className: "flex flex-col gap-0.5",
+          "data-testid": "policy-scaffolder-diagnostics",
+          children: result.diagnostics.map((diagnostic) => /* @__PURE__ */ jsxDEV("li", {
+            className: "font-mono text-[11px] text-destructive",
+            children: diagnostic
+          }, diagnostic, false))
+        }, void 0, false)]
+      }, void 0, true)]
+    }, void 0, true)]
+  }, void 0, true);
+};
+
+const PermissionsPanel = ({
+  functions,
+  runAsIdentity = false,
+  schemaEditable = false
+} = {}) => {
+  const t = useT();
+  const [prefill, setPrefill] = useState(void 0);
+  const onProbe = (_table, _operation, procedure) => {
+    if (procedure !== "") {
+      setPrefill((previous) => {
+        return {
+          functionPath: procedure,
+          nonce: (previous?.nonce ?? 0) + 1
+        };
+      });
+    }
+  };
+  return /* @__PURE__ */ jsxDEV("div", {
+    className: "flex flex-col gap-8",
+    "data-testid": "lunora-permissions",
+    children: [/* @__PURE__ */ jsxDEV("section", {
+      className: "flex flex-col gap-3",
+      children: [/* @__PURE__ */ jsxDEV("header", {
+        className: "border-b border-border px-4 py-3",
+        children: /* @__PURE__ */ jsxDEV("span", {
+          className: "font-mono text-[11px] tracking-wide text-muted-foreground uppercase",
+          children: t("Permissions")
+        }, void 0, false)
+      }, void 0, false), /* @__PURE__ */ jsxDEV(PermissionsMatrix, {
+        onProbe
+      }, void 0, false)]
+    }, void 0, true), /* @__PURE__ */ jsxDEV("section", {
+      className: "flex flex-col gap-3",
+      children: /* @__PURE__ */ jsxDEV(Card, {
+        className: "gap-0 py-0",
+        children: [/* @__PURE__ */ jsxDEV("header", {
+          className: "border-b border-border px-4 py-3",
+          children: /* @__PURE__ */ jsxDEV("span", {
+            className: "font-mono text-[11px] tracking-wide text-muted-foreground uppercase",
+            children: t("Probe")
+          }, void 0, false)
+        }, void 0, false), /* @__PURE__ */ jsxDEV(CardContent, {
+          className: "px-4 py-4",
+          children: [/* @__PURE__ */ jsxDEV("p", {
+            className: "mb-3 text-sm text-muted-foreground",
+            children: t("Pick a function and an identity, then run it to see the access outcome.")
+          }, void 0, false), /* @__PURE__ */ jsxDEV(PermissionsPlayground, {
+            functions,
+            prefill,
+            runAsIdentity
+          }, void 0, false)]
+        }, void 0, true)]
+      }, void 0, true)
+    }, void 0, false), schemaEditable && /* @__PURE__ */ jsxDEV("section", {
+      className: "flex flex-col gap-2",
+      children: /* @__PURE__ */ jsxDEV(PolicyScaffolder, {}, void 0, false)
+    }, void 0, false)]
+  }, void 0, true);
+};
+
+export { PermissionsPanel };