@lunora/studio 1.0.0-alpha.59 → 1.0.0-alpha.60

package/dist/packem_chunks/permissions-panel.js

@@ -1,805 +1 @@
-import { useState, useRef, useEffect } from 'react';
-import { C as Card, c as CardHeader, b as CardTitle, d as CardDescription, a as CardContent } from '../packem_shared/card-F2vH_aj2.js';
-import { useT } from '../packem_shared/DEFAULT_LOCALE-CiX4W7Kr.js';
-import { c } from 'react/compiler-runtime';
-import { E as ErrorAlert } from '../packem_shared/error-alert-D9uIFJUS.js';
-import { L as LiveError } from '../packem_shared/live-status-FZ0psC1z.js';
-import { B as Badge } from '../packem_shared/badge-B2PKA1-5.js';
-import { B as Button } from '../packem_shared/button-BhsN2uZH.js';
-import { E as EmptyState } from '../packem_shared/empty-state-DY_oe0k6.js';
-import { T as Table, a as TableHeader, b as TableRow, c as TableHead, d as TableBody, e as TableCell } from '../packem_shared/table-DsCa9Qp9.js';
-import { u as useAdminQuery } from '../packem_shared/use-admin-query-C7JNuQp-.js';
-import { ADMIN_FUNCTIONS } from '../packem_shared/ADMIN_FUNCTIONS-P2UzJscH.js';
-import { jsxDEV } from 'react/jsx-dev-runtime';
-import { useLunora } from '@lunora/react';
-import { ShardInput } from '../packem_shared/ShardInput-CZnpHILL.js';
-import { I as Input } from '../packem_shared/input-XH4r1Pt1.js';
-import { L as Label } from '../packem_shared/label-D8ykjn5J.js';
-import { T as Textarea } from '../packem_shared/textarea-D3gaCU_-.js';
-import { c as callOptions, a as adminRef, e as errorMessage, f as fireAndForget } from '../packem_shared/internal-DzHCc2Rq.js';
-
-const OPERATIONS = ["read", "insert", "update", "delete"];
-const operationLabel = (t, operation) => ({
-  delete: t("Delete"),
-  insert: t("Insert"),
-  read: t("Read"),
-  update: t("Update")
-})[operation];
-const uncoveredTables = (advisories) => {
-  const set = /* @__PURE__ */ new Set();
-  for (const advisory of advisories?.advisories ?? []) {
-    if (advisory.name === "rls_uncovered_table") {
-      const {
-        table
-      } = advisory.metadata;
-      if (typeof table === "string" && table !== "") {
-        set.add(table);
-      }
-    }
-  }
-  return set;
-};
-const buildRows = (policies, maskColumns, uncovered) => {
-  const byTable = /* @__PURE__ */ new Map();
-  const ensure = (table) => {
-    const existing = byTable.get(table);
-    if (existing !== void 0) {
-      return existing;
-    }
-    const row = {
-      cells: {
-        delete: {},
-        insert: {},
-        read: {},
-        update: {}
-      },
-      maskedColumns: [],
-      table,
-      uncovered: uncovered.has(table)
-    };
-    byTable.set(table, row);
-    return row;
-  };
-  for (const policy of policies) {
-    ensure(policy.table).cells[policy.on] = {
-      procedure: policy.procedure
-    };
-  }
-  for (const column of maskColumns) {
-    const row = ensure(column.table);
-    if (!row.maskedColumns.includes(column.column)) {
-      row.maskedColumns.push(column.column);
-    }
-  }
-  for (const table of uncovered) {
-    ensure(table);
-  }
-  return [...byTable.values()].toSorted((a, b) => a.table.localeCompare(b.table));
-};
-const PermissionsMatrix = (t0) => {
-  const $ = c(17);
-  let t1;
-  if ($[0] !== t0) {
-    t1 = t0 === void 0 ? {} : t0;
-    $[0] = t0;
-    $[1] = t1;
-  } else {
-    t1 = $[1];
-  }
-  const {
-    onProbe
-  } = t1;
-  const t = useT();
-  let t2;
-  let t3;
-  if ($[2] === /* @__PURE__ */ Symbol.for("react.memo_cache_sentinel")) {
-    t2 = {};
-    t3 = {
-      live: true
-    };
-    $[2] = t2;
-    $[3] = t3;
-  } else {
-    t2 = $[2];
-    t3 = $[3];
-  }
-  const policiesQuery = useAdminQuery(ADMIN_FUNCTIONS.rlsPolicies, t2, t3);
-  let t4;
-  if ($[4] === /* @__PURE__ */ Symbol.for("react.memo_cache_sentinel")) {
-    t4 = {};
-    $[4] = t4;
-  } else {
-    t4 = $[4];
-  }
-  const masksQuery = useAdminQuery(ADMIN_FUNCTIONS.maskPolicies, t4);
-  let t5;
-  if ($[5] === /* @__PURE__ */ Symbol.for("react.memo_cache_sentinel")) {
-    t5 = {};
-    $[5] = t5;
-  } else {
-    t5 = $[5];
-  }
-  const advisoriesQuery = useAdminQuery(ADMIN_FUNCTIONS.getAdvisories, t5);
-  let t6;
-  if ($[6] !== advisoriesQuery.data || $[7] !== masksQuery.data || $[8] !== onProbe || $[9] !== policiesQuery || $[10] !== t) {
-    let policies = null;
-    if (policiesQuery.data !== void 0) {
-      policies = Array.isArray(policiesQuery.data.policies) ? policiesQuery.data.policies : [];
-    }
-    const maskColumns = Array.isArray(masksQuery.data?.columns) ? masksQuery.data.columns : [];
-    const advisories = advisoriesQuery.data ?? null;
-    const {
-      error,
-      errorSource,
-      liveError
-    } = policiesQuery;
-    const rows = policies === null ? [] : buildRows(policies, maskColumns, uncoveredTables(advisories));
-    let t7;
-    if ($[12] !== liveError) {
-      t7 = /* @__PURE__ */ jsxDEV("div", {
-        className: "flex items-center justify-end",
-        children: /* @__PURE__ */ jsxDEV(LiveError, {
-          message: liveError,
-          prefix: "pm"
-        }, void 0, false)
-      }, void 0, false);
-      $[12] = liveError;
-      $[13] = t7;
-    } else {
-      t7 = $[13];
-    }
-    let t8;
-    if ($[14] !== error || $[15] !== errorSource) {
-      t8 = error !== null && /* @__PURE__ */ jsxDEV(ErrorAlert, {
-        error: errorSource,
-        testId: "pm-error"
-      }, void 0, false);
-      $[14] = error;
-      $[15] = errorSource;
-      $[16] = t8;
-    } else {
-      t8 = $[16];
-    }
-    t6 = /* @__PURE__ */ jsxDEV("div", {
-      className: "flex flex-col gap-3",
-      "data-testid": "lunora-permissions-matrix",
-      children: [t7, t8, policies !== null && rows.length === 0 ? /* @__PURE__ */ jsxDEV(EmptyState, {
-        description: t("Add a `definePolicy` and wire it through `.use(rls(...))` to populate this matrix."),
-        testId: "pm-empty",
-        title: t("No policy")
-      }, void 0, false) : /* @__PURE__ */ jsxDEV(Table, {
-        "data-testid": "pm-table",
-        children: [/* @__PURE__ */ jsxDEV(TableHeader, {
-          children: /* @__PURE__ */ jsxDEV(TableRow, {
-            children: [/* @__PURE__ */ jsxDEV(TableHead, {
-              children: t("Table")
-            }, void 0, false), OPERATIONS.map((operation) => /* @__PURE__ */ jsxDEV(TableHead, {
-              children: operationLabel(t, operation)
-            }, operation, false)), /* @__PURE__ */ jsxDEV(TableHead, {
-              children: t("Masked columns")
-            }, void 0, false)]
-          }, void 0, true)
-        }, void 0, false), /* @__PURE__ */ jsxDEV(TableBody, {
-          children: rows.map((row) => /* @__PURE__ */ jsxDEV(TableRow, {
-            "data-testid": `pm-row-${row.table}`,
-            children: [/* @__PURE__ */ jsxDEV(TableCell, {
-              className: "font-mono text-xs",
-              children: /* @__PURE__ */ jsxDEV("span", {
-                className: "flex items-center gap-1.5",
-                children: [row.table, row.uncovered && /* @__PURE__ */ jsxDEV(Badge, {
-                  "data-testid": `pm-uncovered-${row.table}`,
-                  title: t("Uncovered — reachable without a policy"),
-                  variant: "destructive",
-                  children: t("Uncovered — reachable without a policy")
-                }, void 0, false)]
-              }, void 0, true)
-            }, void 0, false), OPERATIONS.map((operation_0) => {
-              const cell = row.cells[operation_0];
-              return /* @__PURE__ */ jsxDEV(TableCell, {
-                "data-testid": `pm-cell-${row.table}-${operation_0}`,
-                children: cell.procedure === void 0 ? /* @__PURE__ */ jsxDEV("span", {
-                  className: "text-xs text-muted-foreground",
-                  children: t("No policy")
-                }, void 0, false) : /* @__PURE__ */ jsxDEV("span", {
-                  className: "flex flex-col gap-1",
-                  children: [/* @__PURE__ */ jsxDEV(Badge, {
-                    variant: "secondary",
-                    children: t("Covered by {procedure}", {
-                      procedure: cell.procedure
-                    })
-                  }, void 0, false), onProbe !== void 0 && /* @__PURE__ */ jsxDEV(Button, {
-                    className: "h-auto justify-start p-0 text-[11px]",
-                    "data-testid": `pm-probe-${row.table}-${operation_0}`,
-                    onClick: () => {
-                      onProbe(row.table, operation_0, cell.procedure ?? "");
-                    },
-                    size: "xs",
-                    type: "button",
-                    variant: "ghost",
-                    children: t("Probe this")
-                  }, void 0, false)]
-                }, void 0, true)
-              }, operation_0, false);
-            }), /* @__PURE__ */ jsxDEV(TableCell, {
-              children: row.maskedColumns.length === 0 ? /* @__PURE__ */ jsxDEV("span", {
-                "aria-hidden": "true",
-                className: "text-muted-foreground",
-                children: "—"
-              }, void 0, false) : /* @__PURE__ */ jsxDEV("span", {
-                className: "flex flex-wrap gap-1",
-                children: row.maskedColumns.map(_temp)
-              }, void 0, false)
-            }, void 0, false)]
-          }, row.table, true))
-        }, void 0, false)]
-      }, void 0, true)]
-    }, void 0, true);
-    $[6] = advisoriesQuery.data;
-    $[7] = masksQuery.data;
-    $[8] = onProbe;
-    $[9] = policiesQuery;
-    $[10] = t;
-    $[11] = t6;
-  } else {
-    t6 = $[11];
-  }
-  return t6;
-};
-function _temp(column) {
-  return /* @__PURE__ */ jsxDEV(Badge, {
-    variant: "outline",
-    children: column
-  }, column, false);
-}
-
-const RUN_AS = adminRef(ADMIN_FUNCTIONS.runAs);
-const useRunAsProbe = () => {
-  const client = useLunora();
-  return async ({
-    args,
-    functionPath,
-    shardKey = "",
-    userId
-  }) => {
-    const reference = RUN_AS;
-    try {
-      const value = await client.query(reference, {
-        args,
-        functionPath,
-        userId
-      }, callOptions(shardKey));
-      return {
-        kind: "allowed",
-        value
-      };
-    } catch (error) {
-      return {
-        kind: "denied",
-        message: error instanceof Error ? error.message : String(error)
-      };
-    }
-  };
-};
-
-const formatValue = (value) => value === void 0 ? "undefined" : JSON.stringify(value, null, 2);
-const PermissionsPlayground = ({
-  functions: functionsProp,
-  prefill,
-  runAsIdentity = false
-} = {}) => {
-  const client = useLunora();
-  const t = useT();
-  const probe = useRunAsProbe();
-  const [discovered, setDiscovered] = useState(null);
-  const [discoverError, setDiscoverError] = useState(null);
-  const functions = functionsProp ?? discovered ?? [];
-  const [selectedPath, setSelectedPath] = useState("");
-  const [argsText, setArgsText] = useState("{}");
-  const [shardKey, setShardKey] = useState("");
-  const [runAsUserId, setRunAsUserId] = useState("");
-  const [running, setRunning] = useState(false);
-  const [outcome, setOutcome] = useState(null);
-  const [argsError, setArgsError] = useState(null);
-  const appliedNonce = useRef(-1);
-  useEffect(() => {
-    if (functionsProp !== void 0) {
-      return void 0;
-    }
-    let cancelled = false;
-    client.listFunctions().then((list) => {
-      if (!cancelled) {
-        setDiscovered(list);
-      }
-      return list;
-    }).catch((error_) => {
-      if (!cancelled) {
-        setDiscoverError(errorMessage(error_));
-      }
-    });
-    return () => {
-      cancelled = true;
-    };
-  }, [client, functionsProp]);
-  useEffect(() => {
-    if (prefill === void 0 || appliedNonce.current === prefill.nonce) {
-      return;
-    }
-    appliedNonce.current = prefill.nonce;
-    const target = prefill.functionPath;
-    queueMicrotask(() => {
-      setSelectedPath(target);
-      setOutcome(null);
-    });
-  }, [prefill]);
-  const effectivePath = selectedPath === "" ? functions[0]?.path ?? "" : selectedPath;
-  const run = async () => {
-    if (effectivePath === "") {
-      return;
-    }
-    let parsedArgs;
-    try {
-      parsedArgs = argsText.trim() === "" ? {} : JSON.parse(argsText);
-    } catch (parseError) {
-      setArgsError(t("Invalid JSON args: {message}", {
-        message: parseError.message
-      }));
-      setOutcome(null);
-      return;
-    }
-    setArgsError(null);
-    setRunning(true);
-    try {
-      const result = await probe({
-        args: parsedArgs,
-        functionPath: effectivePath,
-        shardKey: shardKey.trim(),
-        userId: runAsUserId.trim()
-      });
-      setOutcome(result);
-    } finally {
-      setRunning(false);
-    }
-  };
-  const runOnce = () => {
-    fireAndForget(run());
-  };
-  const onSelectChange = (event) => {
-    setSelectedPath(event.target.value);
-  };
-  const onArgsChange = (event_0) => {
-    setArgsText(event_0.target.value);
-  };
-  const onUserIdChange = (event_1) => {
-    setRunAsUserId(event_1.target.value);
-  };
-  return /* @__PURE__ */ jsxDEV("div", {
-    className: "flex flex-col gap-3",
-    "data-testid": "lunora-permissions-playground",
-    children: [discoverError !== null && /* @__PURE__ */ jsxDEV("p", {
-      className: "text-sm text-destructive",
-      "data-testid": "pp-discover-error",
-      role: "alert",
-      children: discoverError
-    }, void 0, false), !runAsIdentity && /* @__PURE__ */ jsxDEV(EmptyState, {
-      description: t("Dev only: runs the selected function as this user over the admin gate so you can test auth and RLS."),
-      testId: "pp-gate",
-      title: t("Set `runAsIdentity` to forge an identity and probe access.")
-    }, void 0, false), /* @__PURE__ */ jsxDEV("div", {
-      className: "flex flex-col gap-3 rounded-md border border-border p-3",
-      children: [/* @__PURE__ */ jsxDEV("div", {
-        className: "flex flex-col gap-1.5",
-        children: [/* @__PURE__ */ jsxDEV(Label, {
-          htmlFor: "pp-function",
-          children: t("Function")
-        }, void 0, false), /* @__PURE__ */ jsxDEV("select", {
-          "aria-label": t("Function"),
-          className: "flex h-9 w-full rounded-md border border-input bg-transparent px-3 py-1 text-sm shadow-xs outline-none focus-visible:border-ring focus-visible:ring-[3px] focus-visible:ring-ring/50",
-          "data-testid": "pp-function",
-          id: "pp-function",
-          onChange: onSelectChange,
-          value: effectivePath,
-          children: functions.map((descriptor) => /* @__PURE__ */ jsxDEV("option", {
-            value: descriptor.path,
-            children: [descriptor.path, " (", descriptor.kind, ")"]
-          }, descriptor.path, true))
-        }, void 0, false)]
-      }, void 0, true), /* @__PURE__ */ jsxDEV("div", {
-        className: "flex flex-col gap-1.5",
-        children: [/* @__PURE__ */ jsxDEV(Label, {
-          htmlFor: "pp-args",
-          children: t("Arguments")
-        }, void 0, false), /* @__PURE__ */ jsxDEV(Textarea, {
-          "aria-label": t("Arguments"),
-          className: "font-mono text-xs",
-          "data-testid": "pp-args",
-          id: "pp-args",
-          onChange: onArgsChange,
-          value: argsText
-        }, void 0, false)]
-      }, void 0, true), /* @__PURE__ */ jsxDEV(ShardInput, {
-        onChange: setShardKey,
-        testId: "pp-shard",
-        value: shardKey
-      }, void 0, false), /* @__PURE__ */ jsxDEV("div", {
-        className: "flex flex-col gap-1.5",
-        children: [/* @__PURE__ */ jsxDEV(Label, {
-          htmlFor: "pp-user",
-          children: t("Run as (userId)")
-        }, void 0, false), /* @__PURE__ */ jsxDEV(Input, {
-          "aria-label": t("Identity (userId) to run as"),
-          className: "font-mono text-xs",
-          "data-testid": "pp-user",
-          id: "pp-user",
-          onChange: onUserIdChange,
-          placeholder: t("Leave empty to run as admin"),
-          value: runAsUserId
-        }, void 0, false)]
-      }, void 0, true), /* @__PURE__ */ jsxDEV("div", {
-        className: "flex items-center gap-2",
-        children: [/* @__PURE__ */ jsxDEV(Button, {
-          "data-testid": "pp-run",
-          disabled: !runAsIdentity || running || effectivePath === "",
-          onClick: runOnce,
-          type: "button",
-          children: running ? t("Probing…") : t("Run probe")
-        }, void 0, false), runAsUserId.trim() !== "" && /* @__PURE__ */ jsxDEV(Badge, {
-          "data-testid": "pp-as-badge",
-          variant: "secondary",
-          children: t("as {userId}", {
-            userId: runAsUserId.trim()
-          })
-        }, void 0, false)]
-      }, void 0, true)]
-    }, void 0, true), argsError !== null && /* @__PURE__ */ jsxDEV("p", {
-      className: "text-sm text-destructive",
-      "data-testid": "pp-args-error",
-      role: "alert",
-      children: argsError
-    }, void 0, false), outcome !== null && outcome.kind === "allowed" && /* @__PURE__ */ jsxDEV("div", {
-      className: "flex flex-col gap-2",
-      "data-testid": "pp-outcome-allowed",
-      children: [/* @__PURE__ */ jsxDEV(Badge, {
-        variant: "secondary",
-        children: t("Allowed")
-      }, void 0, false), /* @__PURE__ */ jsxDEV("pre", {
-        className: "overflow-auto rounded-md border border-border bg-muted/50 p-3 font-mono text-xs",
-        "data-testid": "pp-result",
-        children: formatValue(outcome.value)
-      }, void 0, false)]
-    }, void 0, true), outcome !== null && outcome.kind === "denied" && /* @__PURE__ */ jsxDEV("div", {
-      className: "flex flex-col gap-2",
-      "data-testid": "pp-outcome-denied",
-      children: [/* @__PURE__ */ jsxDEV(Badge, {
-        variant: "destructive",
-        children: t("Denied")
-      }, void 0, false), /* @__PURE__ */ jsxDEV("pre", {
-        className: "overflow-auto rounded-md border border-border bg-muted/50 p-3 font-mono text-xs text-destructive",
-        "data-testid": "pp-denied",
-        role: "alert",
-        children: outcome.message
-      }, void 0, false)]
-    }, void 0, true)]
-  }, void 0, true);
-};
-
-const POLICY_SCAFFOLD_ENDPOINT = "/__lunora/policy-scaffold";
-const FAILURE_MESSAGES = {
-  "already-wired": "That procedure already has an rls(...) policy wired in.",
-  "file-exists": "A policy file with that name already exists — pick another name or edit it by hand.",
-  "invalid-identifier": "Name, table, and policy-set must be plain identifiers (letters, digits, _ or $).",
-  "unknown-procedure": "No exported procedure was found at that file path.",
-  "unsupported-procedure-shape": "That procedure uses the bare query({…}) form — convert it to the builder form (c.use(…).query(…)) before wiring RLS."
-};
-const applyPolicyScaffold = async (request) => {
-  const response = await fetch(POLICY_SCAFFOLD_ENDPOINT, {
-    body: JSON.stringify(request),
-    headers: {
-      "Content-Type": "application/json"
-    },
-    method: "POST"
-  });
-  const body = await response.json();
-  if (body.needsManualEdit === true) {
-    return {
-      kind: "needs-manual-edit",
-      message: body.message ?? "This change must be made by hand."
-    };
-  }
-  if (response.ok) {
-    return {
-      diagnostics: body.diagnostics ?? [],
-      kind: "ok",
-      label: body.fileName ?? body.exportName ?? ""
-    };
-  }
-  const token = body.error;
-  const message = token === void 0 ? `policy scaffold failed (${String(response.status)})` : FAILURE_MESSAGES[token] ?? token;
-  return {
-    kind: "error",
-    message
-  };
-};
-
-const EMPTY_FORM = {
-  exportName: "",
-  filePath: "",
-  policyName: "",
-  policies: "",
-  tableName: ""
-};
-const PolicyScaffolder = () => {
-  const t = useT();
-  const [mode, setMode] = useState(null);
-  const [busy, setBusy] = useState(false);
-  const [result, setResult] = useState(null);
-  const [form, setForm] = useState(EMPTY_FORM);
-  const onFieldChange = (event) => {
-    const field = event.target.name;
-    const {
-      value
-    } = event.target;
-    setForm((previous) => {
-      return {
-        ...previous,
-        [field]: value
-      };
-    });
-  };
-  const reset = () => {
-    setMode(null);
-    setForm(EMPTY_FORM);
-  };
-  const submit = async (request) => {
-    setBusy(true);
-    setResult(null);
-    try {
-      const outcome = await applyPolicyScaffold(request);
-      setResult(outcome);
-      if (outcome.kind === "ok") {
-        reset();
-      }
-    } catch (error) {
-      setResult({
-        kind: "error",
-        message: error instanceof Error ? error.message : String(error)
-      });
-    } finally {
-      setBusy(false);
-    }
-  };
-  const onSubmitScaffold = () => {
-    fireAndForget(submit({
-      kind: "scaffoldPolicy",
-      name: form.policyName.trim(),
-      table: form.tableName.trim()
-    }));
-  };
-  const onSubmitWire = () => {
-    fireAndForget(submit({
-      exportName: form.exportName.trim(),
-      filePath: form.filePath.trim(),
-      kind: "wireRls",
-      policies: form.policies.trim()
-    }));
-  };
-  const openScaffold = () => {
-    setResult(null);
-    setMode("scaffold");
-  };
-  const openWire = () => {
-    setResult(null);
-    setMode("wire");
-  };
-  return /* @__PURE__ */ jsxDEV(Card, {
-    "data-testid": "policy-scaffolder",
-    size: "sm",
-    children: [/* @__PURE__ */ jsxDEV(CardHeader, {
-      children: [/* @__PURE__ */ jsxDEV(CardTitle, {
-        children: t("Scaffold access rules")
-      }, void 0, false), /* @__PURE__ */ jsxDEV(CardDescription, {
-        children: t("Writes a new deny-by-default policy file under lunora/, or wires one into a procedure, then reruns codegen. Local dev only.")
-      }, void 0, false)]
-    }, void 0, true), /* @__PURE__ */ jsxDEV(CardContent, {
-      children: [/* @__PURE__ */ jsxDEV("div", {
-        className: "flex flex-wrap gap-2",
-        children: [/* @__PURE__ */ jsxDEV(Button, {
-          "data-testid": "policy-scaffolder-new",
-          onClick: openScaffold,
-          size: "xs",
-          type: "button",
-          variant: mode === "scaffold" ? "default" : "outline",
-          children: t("New policy file")
-        }, void 0, false), /* @__PURE__ */ jsxDEV(Button, {
-          "data-testid": "policy-scaffolder-wire",
-          onClick: openWire,
-          size: "xs",
-          type: "button",
-          variant: mode === "wire" ? "default" : "outline",
-          children: t("Wire into a procedure")
-        }, void 0, false)]
-      }, void 0, true), mode === "scaffold" && /* @__PURE__ */ jsxDEV("div", {
-        className: "mt-3 flex flex-wrap items-end gap-2",
-        "data-testid": "policy-scaffolder-new-form",
-        children: [/* @__PURE__ */ jsxDEV("div", {
-          className: "flex flex-col gap-1 text-xs",
-          children: [/* @__PURE__ */ jsxDEV(Label, {
-            htmlFor: "policy-scaffolder-name",
-            children: t("Policy name")
-          }, void 0, false), /* @__PURE__ */ jsxDEV(Input, {
-            "data-testid": "policy-scaffolder-name",
-            id: "policy-scaffolder-name",
-            name: "policyName",
-            onChange: onFieldChange,
-            value: form.policyName
-          }, void 0, false)]
-        }, void 0, true), /* @__PURE__ */ jsxDEV("div", {
-          className: "flex flex-col gap-1 text-xs",
-          children: [/* @__PURE__ */ jsxDEV(Label, {
-            htmlFor: "policy-scaffolder-table",
-            children: t("Table name")
-          }, void 0, false), /* @__PURE__ */ jsxDEV(Input, {
-            "data-testid": "policy-scaffolder-table",
-            id: "policy-scaffolder-table",
-            name: "tableName",
-            onChange: onFieldChange,
-            value: form.tableName
-          }, void 0, false)]
-        }, void 0, true), /* @__PURE__ */ jsxDEV(Button, {
-          "data-testid": "policy-scaffolder-create",
-          disabled: busy || form.policyName.trim() === "" || form.tableName.trim() === "",
-          onClick: onSubmitScaffold,
-          size: "xs",
-          type: "button",
-          children: busy ? t("Creating…") : t("Create policy file")
-        }, void 0, false), /* @__PURE__ */ jsxDEV(Button, {
-          onClick: reset,
-          size: "xs",
-          type: "button",
-          variant: "ghost",
-          children: t("Cancel")
-        }, void 0, false)]
-      }, void 0, true), mode === "wire" && /* @__PURE__ */ jsxDEV("div", {
-        className: "mt-3 flex flex-wrap items-end gap-2",
-        "data-testid": "policy-scaffolder-wire-form",
-        children: [/* @__PURE__ */ jsxDEV("div", {
-          className: "flex flex-col gap-1 text-xs",
-          children: [/* @__PURE__ */ jsxDEV(Label, {
-            htmlFor: "policy-scaffolder-file",
-            children: t("Procedure file path")
-          }, void 0, false), /* @__PURE__ */ jsxDEV(Input, {
-            "data-testid": "policy-scaffolder-file",
-            id: "policy-scaffolder-file",
-            name: "filePath",
-            onChange: onFieldChange,
-            value: form.filePath
-          }, void 0, false)]
-        }, void 0, true), /* @__PURE__ */ jsxDEV("div", {
-          className: "flex flex-col gap-1 text-xs",
-          children: [/* @__PURE__ */ jsxDEV(Label, {
-            htmlFor: "policy-scaffolder-export",
-            children: t("Exported procedure")
-          }, void 0, false), /* @__PURE__ */ jsxDEV(Input, {
-            "data-testid": "policy-scaffolder-export",
-            id: "policy-scaffolder-export",
-            name: "exportName",
-            onChange: onFieldChange,
-            value: form.exportName
-          }, void 0, false)]
-        }, void 0, true), /* @__PURE__ */ jsxDEV("div", {
-          className: "flex flex-col gap-1 text-xs",
-          children: [/* @__PURE__ */ jsxDEV(Label, {
-            htmlFor: "policy-scaffolder-policies",
-            children: t("Policy set identifier")
-          }, void 0, false), /* @__PURE__ */ jsxDEV(Input, {
-            "data-testid": "policy-scaffolder-policies",
-            id: "policy-scaffolder-policies",
-            name: "policies",
-            onChange: onFieldChange,
-            value: form.policies
-          }, void 0, false)]
-        }, void 0, true), /* @__PURE__ */ jsxDEV(Button, {
-          "data-testid": "policy-scaffolder-apply",
-          disabled: busy || form.filePath.trim() === "" || form.exportName.trim() === "" || form.policies.trim() === "",
-          onClick: onSubmitWire,
-          size: "xs",
-          type: "button",
-          children: busy ? t("Wiring…") : t("Wire RLS")
-        }, void 0, false), /* @__PURE__ */ jsxDEV(Button, {
-          onClick: reset,
-          size: "xs",
-          type: "button",
-          variant: "ghost",
-          children: t("Cancel")
-        }, void 0, false)]
-      }, void 0, true), result?.kind === "error" && /* @__PURE__ */ jsxDEV("p", {
-        className: "mt-3 text-sm text-destructive",
-        "data-testid": "policy-scaffolder-error",
-        role: "alert",
-        children: result.message
-      }, void 0, false), result?.kind === "needs-manual-edit" && /* @__PURE__ */ jsxDEV("p", {
-        className: "mt-3 text-sm text-amber-600 dark:text-amber-500",
-        "data-testid": "policy-scaffolder-manual",
-        role: "alert",
-        children: t("This change must be made by hand — the scaffolder only adds new, deny-by-default rules.")
-      }, void 0, false), result?.kind === "ok" && /* @__PURE__ */ jsxDEV("div", {
-        className: "mt-3 flex flex-col gap-1",
-        "data-testid": "policy-scaffolder-ok",
-        children: [/* @__PURE__ */ jsxDEV("p", {
-          className: "text-sm text-emerald-600 dark:text-emerald-500",
-          children: t("Scaffolded {label} and reran codegen. Fill in the `when` predicates before relying on it.", {
-            label: result.label
-          })
-        }, void 0, false), result.diagnostics.length > 0 && /* @__PURE__ */ jsxDEV("ul", {
-          className: "flex flex-col gap-0.5",
-          "data-testid": "policy-scaffolder-diagnostics",
-          children: result.diagnostics.map((diagnostic) => /* @__PURE__ */ jsxDEV("li", {
-            className: "font-mono text-[11px] text-destructive",
-            children: diagnostic
-          }, diagnostic, false))
-        }, void 0, false)]
-      }, void 0, true)]
-    }, void 0, true)]
-  }, void 0, true);
-};
-
-const PermissionsPanel = ({
-  functions,
-  runAsIdentity = false,
-  schemaEditable = false
-} = {}) => {
-  const t = useT();
-  const [prefill, setPrefill] = useState(void 0);
-  const onProbe = (_table, _operation, procedure) => {
-    if (procedure !== "") {
-      setPrefill((previous) => {
-        return {
-          functionPath: procedure,
-          nonce: (previous?.nonce ?? 0) + 1
-        };
-      });
-    }
-  };
-  return /* @__PURE__ */ jsxDEV("div", {
-    className: "flex flex-col gap-8",
-    "data-testid": "lunora-permissions",
-    children: [/* @__PURE__ */ jsxDEV("section", {
-      className: "flex flex-col gap-3",
-      children: [/* @__PURE__ */ jsxDEV("header", {
-        className: "border-b border-border px-4 py-3",
-        children: /* @__PURE__ */ jsxDEV("span", {
-          className: "font-mono text-[11px] tracking-wide text-muted-foreground uppercase",
-          children: t("Permissions")
-        }, void 0, false)
-      }, void 0, false), /* @__PURE__ */ jsxDEV(PermissionsMatrix, {
-        onProbe
-      }, void 0, false)]
-    }, void 0, true), /* @__PURE__ */ jsxDEV("section", {
-      className: "flex flex-col gap-3",
-      children: /* @__PURE__ */ jsxDEV(Card, {
-        className: "gap-0 py-0",
-        children: [/* @__PURE__ */ jsxDEV("header", {
-          className: "border-b border-border px-4 py-3",
-          children: /* @__PURE__ */ jsxDEV("span", {
-            className: "font-mono text-[11px] tracking-wide text-muted-foreground uppercase",
-            children: t("Probe")
-          }, void 0, false)
-        }, void 0, false), /* @__PURE__ */ jsxDEV(CardContent, {
-          className: "px-4 py-4",
-          children: [/* @__PURE__ */ jsxDEV("p", {
-            className: "mb-3 text-sm text-muted-foreground",
-            children: t("Pick a function and an identity, then run it to see the access outcome.")
-          }, void 0, false), /* @__PURE__ */ jsxDEV(PermissionsPlayground, {
-            functions,
-            prefill,
-            runAsIdentity
-          }, void 0, false)]
-        }, void 0, true)]
-      }, void 0, true)
-    }, void 0, false), schemaEditable && /* @__PURE__ */ jsxDEV("section", {
-      className: "flex flex-col gap-2",
-      children: /* @__PURE__ */ jsxDEV(PolicyScaffolder, {}, void 0, false)
-    }, void 0, false)]
-  }, void 0, true);
-};
-
-export { PermissionsPanel };
+import{useState as u,useRef as te,useEffect as J}from"react";import{c as G,n as ae,f as re,m as le,u as H}from"../packem_shared/card-CIDGUN6K.js";import{useT as z}from"../packem_shared/DEFAULT_LOCALE-BZ4NojpD.js";import{c as ie}from"react/compiler-runtime";import{E as se}from"../packem_shared/error-alert-B59DnrDI.js";import{L as oe}from"../packem_shared/live-status-CGW2JHf_.js";import{g as T}from"../packem_shared/badge-BbuuAio7.js";import{u as P}from"../packem_shared/button-BkCrNcAs.js";import{E as Y}from"../packem_shared/empty-state-Cg7t_8qu.js";import{n as ne,d as de,m as U,p as M,f as ce,u as O}from"../packem_shared/table-DdJBrClo.js";import{K as j}from"../packem_shared/use-admin-query-Di3fLE8H.js";import{ADMIN_FUNCTIONS as R}from"../packem_shared/ADMIN_FUNCTIONS-BYNSbBVE.js";import{jsx as e,jsxs as i}from"react/jsx-runtime";import{useLunora as B}from"@lunora/react";import{ShardInput as pe}from"../packem_shared/ShardInput-BVn2iCU0.js";import{u as E}from"../packem_shared/input-JHu63lTv.js";import{p as C}from"../packem_shared/label-6uP1obNF.js";import{l as me}from"../packem_shared/textarea-Bu2-jKAs.js";import{c as fe,a as ue,e as he,f as q}from"../packem_shared/internal-AtZ4bTal.js";const W=["read","insert","update","delete"],xe=(a,t)=>({delete:a("Delete"),insert:a("Insert"),read:a("Read"),update:a("Update")})[t],ye=a=>{const t=new Set;for(const o of a?.advisories??[])if(o.name==="rls_uncovered_table"){const{table:s}=o.metadata;typeof s=="string"&&s!==""&&t.add(s)}return t},ge=(a,t,o)=>{const s=new Map,r=l=>{const d=s.get(l);if(d!==void 0)return d;const n={cells:{delete:{},insert:{},read:{},update:{}},maskedColumns:[],table:l,uncovered:o.has(l)};return s.set(l,n),n};for(const l of a)r(l.table).cells[l.on]={procedure:l.procedure};for(const l of t){const d=r(l.table);d.maskedColumns.includes(l.column)||d.maskedColumns.push(l.column)}for(const l of o)r(l);return[...s.values()].toSorted((l,d)=>l.table.localeCompare(d.table))},be=a=>{const t=ie(17);let o;t[0]!==a?(o=a===void 0?{}:a,t[0]=a,t[1]=o):o=t[1];const{onProbe:s}=o,r=z();let l,d;t[2]===Symbol.for("react.memo_cache_sentinel")?(l={},d={live:!0},t[2]=l,t[3]=d):(l=t[2],d=t[3]);const n=j(R.rlsPolicies,l,d);let y;t[4]===Symbol.for("react.memo_cache_sentinel")?(y={},t[4]=y):y=t[4];const f=j(R.maskPolicies,y);let h;t[5]===Symbol.for("react.memo_cache_sentinel")?(h={},t[5]=h):h=t[5];const v=j(R.getAdvisories,h);let N;if(t[6]!==v.data||t[7]!==f.data||t[8]!==s||t[9]!==n||t[10]!==r){let b=null;n.data!==void 0&&(b=Array.isArray(n.data.policies)?n.data.policies:[]);const _=Array.isArray(f.data?.columns)?f.data.columns:[],A=v.data??null,{error:x,errorSource:m,liveError:S}=n,I=b===null?[]:ge(b,_,ye(A));let $;t[12]!==S?($=e("div",{className:"flex items-center justify-end",children:e(oe,{message:S,prefix:"pm"})}),t[12]=S,t[13]=$):$=t[13];let g;t[14]!==x||t[15]!==m?(g=x!==null&&e(se,{error:m,testId:"pm-error"}),t[14]=x,t[15]=m,t[16]=g):g=t[16],N=i("div",{className:"flex flex-col gap-3","data-testid":"lunora-permissions-matrix",children:[$,g,b!==null&&I.length===0?e(Y,{description:r("Add a `definePolicy` and wire it through `.use(rls(...))` to populate this matrix."),testId:"pm-empty",title:r("No policy")}):i(ne,{"data-testid":"pm-table",children:[e(de,{children:i(U,{children:[e(M,{children:r("Table")}),W.map(p=>e(M,{children:xe(r,p)},p)),e(M,{children:r("Masked columns")})]})}),e(ce,{children:I.map(p=>i(U,{"data-testid":`pm-row-${p.table}`,children:[e(O,{className:"font-mono text-xs",children:i("span",{className:"flex items-center gap-1.5",children:[p.table,p.uncovered&&e(T,{"data-testid":`pm-uncovered-${p.table}`,title:r("Uncovered — reachable without a policy"),variant:"destructive",children:r("Uncovered — reachable without a policy")})]})}),W.map(w=>{const F=p.cells[w];return e(O,{"data-testid":`pm-cell-${p.table}-${w}`,children:F.procedure===void 0?e("span",{className:"text-xs text-muted-foreground",children:r("No policy")}):i("span",{className:"flex flex-col gap-1",children:[e(T,{variant:"secondary",children:r("Covered by {procedure}",{procedure:F.procedure})}),s!==void 0&&e(P,{className:"h-auto justify-start p-0 text-[11px]","data-testid":`pm-probe-${p.table}-${w}`,onClick:()=>{s(p.table,w,F.procedure??"")},size:"xs",type:"button",variant:"ghost",children:r("Probe this")})]})},w)}),e(O,{children:p.maskedColumns.length===0?e("span",{"aria-hidden":"true",className:"text-muted-foreground",children:"—"}):e("span",{className:"flex flex-wrap gap-1",children:p.maskedColumns.map(ve)})})]},p.table))})]})]}),t[6]=v.data,t[7]=f.data,t[8]=s,t[9]=n,t[10]=r,t[11]=N}else N=t[11];return N};function ve(a){return e(T,{variant:"outline",children:a},a)}const Ne=ue(R.runAs),we=()=>{const a=B();return async({args:t,functionPath:o,shardKey:s="",userId:r})=>{const l=Ne;try{return{kind:"allowed",value:await a.query(l,{args:t,functionPath:o,userId:r},fe(s))}}catch(d){return{kind:"denied",message:d instanceof Error?d.message:String(d)}}}},ke=a=>a===void 0?"undefined":JSON.stringify(a,null,2),Pe=({functions:a,prefill:t,runAsIdentity:o=!1}={})=>{const s=B(),r=z(),l=we(),[d,n]=u(null),[y,f]=u(null),h=a??d??[],[v,N]=u(""),[b,_]=u("{}"),[A,x]=u(""),[m,S]=u(""),[I,$]=u(!1),[g,p]=u(null),[w,F]=u(null),D=te(-1);J(()=>{if(a!==void 0)return;let c=!1;return s.listFunctions().then(k=>(c||n(k),k)).catch(k=>{c||f(he(k))}),()=>{c=!0}},[s,a]),J(()=>{if(t===void 0||D.current===t.nonce)return;D.current=t.nonce;const c=t.functionPath;queueMicrotask(()=>{N(c),p(null)})},[t]);const L=v===""?h[0]?.path??"":v,Q=async()=>{if(L==="")return;let c;try{c=b.trim()===""?{}:JSON.parse(b)}catch(k){F(r("Invalid JSON args: {message}",{message:k.message})),p(null);return}F(null),$(!0);try{const k=await l({args:c,functionPath:L,shardKey:A.trim(),userId:m.trim()});p(k)}finally{$(!1)}},V=()=>{q(Q())},X=c=>{N(c.target.value)},Z=c=>{_(c.target.value)},ee=c=>{S(c.target.value)};return i("div",{className:"flex flex-col gap-3","data-testid":"lunora-permissions-playground",children:[y!==null&&e("p",{className:"text-sm text-destructive","data-testid":"pp-discover-error",role:"alert",children:y}),!o&&e(Y,{description:r("Dev only: runs the selected function as this user over the admin gate so you can test auth and RLS."),testId:"pp-gate",title:r("Set `runAsIdentity` to forge an identity and probe access.")}),i("div",{className:"flex flex-col gap-3 rounded-md border border-border p-3",children:[i("div",{className:"flex flex-col gap-1.5",children:[e(C,{htmlFor:"pp-function",children:r("Function")}),e("select",{"aria-label":r("Function"),className:"flex h-9 w-full rounded-md border border-input bg-transparent px-3 py-1 text-sm shadow-xs outline-none focus-visible:border-ring focus-visible:ring-[3px] focus-visible:ring-ring/50","data-testid":"pp-function",id:"pp-function",onChange:X,value:L,children:h.map(c=>i("option",{value:c.path,children:[c.path," (",c.kind,")"]},c.path))})]}),i("div",{className:"flex flex-col gap-1.5",children:[e(C,{htmlFor:"pp-args",children:r("Arguments")}),e(me,{"aria-label":r("Arguments"),className:"font-mono text-xs","data-testid":"pp-args",id:"pp-args",onChange:Z,value:b})]}),e(pe,{onChange:x,testId:"pp-shard",value:A}),i("div",{className:"flex flex-col gap-1.5",children:[e(C,{htmlFor:"pp-user",children:r("Run as (userId)")}),e(E,{"aria-label":r("Identity (userId) to run as"),className:"font-mono text-xs","data-testid":"pp-user",id:"pp-user",onChange:ee,placeholder:r("Leave empty to run as admin"),value:m})]}),i("div",{className:"flex items-center gap-2",children:[e(P,{"data-testid":"pp-run",disabled:!o||I||L==="",onClick:V,type:"button",children:r(I?"Probing…":"Run probe")}),m.trim()!==""&&e(T,{"data-testid":"pp-as-badge",variant:"secondary",children:r("as {userId}",{userId:m.trim()})})]})]}),w!==null&&e("p",{className:"text-sm text-destructive","data-testid":"pp-args-error",role:"alert",children:w}),g!==null&&g.kind==="allowed"&&i("div",{className:"flex flex-col gap-2","data-testid":"pp-outcome-allowed",children:[e(T,{variant:"secondary",children:r("Allowed")}),e("pre",{className:"overflow-auto rounded-md border border-border bg-muted/50 p-3 font-mono text-xs","data-testid":"pp-result",children:ke(g.value)})]}),g!==null&&g.kind==="denied"&&i("div",{className:"flex flex-col gap-2","data-testid":"pp-outcome-denied",children:[e(T,{variant:"destructive",children:r("Denied")}),e("pre",{className:"overflow-auto rounded-md border border-border bg-muted/50 p-3 font-mono text-xs text-destructive","data-testid":"pp-denied",role:"alert",children:g.message})]})]})},Ce="/__lunora/policy-scaffold",Se={"already-wired":"That procedure already has an rls(...) policy wired in.","file-exists":"A policy file with that name already exists — pick another name or edit it by hand.","invalid-identifier":"Name, table, and policy-set must be plain identifiers (letters, digits, _ or $).","unknown-procedure":"No exported procedure was found at that file path.","unsupported-procedure-shape":"That procedure uses the bare query({…}) form — convert it to the builder form (c.use(…).query(…)) before wiring RLS."},Ie=async a=>{const t=await fetch(Ce,{body:JSON.stringify(a),headers:{"Content-Type":"application/json"},method:"POST"}),o=await t.json();if(o.needsManualEdit===!0)return{kind:"needs-manual-edit",message:o.message??"This change must be made by hand."};if(t.ok)return{diagnostics:o.diagnostics??[],kind:"ok",label:o.fileName??o.exportName??""};const s=o.error;return{kind:"error",message:s===void 0?`policy scaffold failed (${String(t.status)})`:Se[s]??s}},K={exportName:"",filePath:"",policyName:"",policies:"",tableName:""},$e=()=>{const a=z(),[t,o]=u(null),[s,r]=u(!1),[l,d]=u(null),[n,y]=u(K),f=x=>{const m=x.target.name,{value:S}=x.target;y(I=>({...I,[m]:S}))},h=()=>{o(null),y(K)},v=async x=>{r(!0),d(null);try{const m=await Ie(x);d(m),m.kind==="ok"&&h()}catch(m){d({kind:"error",message:m instanceof Error?m.message:String(m)})}finally{r(!1)}},N=()=>{q(v({kind:"scaffoldPolicy",name:n.policyName.trim(),table:n.tableName.trim()}))},b=()=>{q(v({exportName:n.exportName.trim(),filePath:n.filePath.trim(),kind:"wireRls",policies:n.policies.trim()}))},_=()=>{d(null),o("scaffold")},A=()=>{d(null),o("wire")};return i(G,{"data-testid":"policy-scaffolder",size:"sm",children:[i(ae,{children:[e(re,{children:a("Scaffold access rules")}),e(le,{children:a("Writes a new deny-by-default policy file under lunora/, or wires one into a procedure, then reruns codegen. Local dev only.")})]}),i(H,{children:[i("div",{className:"flex flex-wrap gap-2",children:[e(P,{"data-testid":"policy-scaffolder-new",onClick:_,size:"xs",type:"button",variant:t==="scaffold"?"default":"outline",children:a("New policy file")}),e(P,{"data-testid":"policy-scaffolder-wire",onClick:A,size:"xs",type:"button",variant:t==="wire"?"default":"outline",children:a("Wire into a procedure")})]}),t==="scaffold"&&i("div",{className:"mt-3 flex flex-wrap items-end gap-2","data-testid":"policy-scaffolder-new-form",children:[i("div",{className:"flex flex-col gap-1 text-xs",children:[e(C,{htmlFor:"policy-scaffolder-name",children:a("Policy name")}),e(E,{"data-testid":"policy-scaffolder-name",id:"policy-scaffolder-name",name:"policyName",onChange:f,value:n.policyName})]}),i("div",{className:"flex flex-col gap-1 text-xs",children:[e(C,{htmlFor:"policy-scaffolder-table",children:a("Table name")}),e(E,{"data-testid":"policy-scaffolder-table",id:"policy-scaffolder-table",name:"tableName",onChange:f,value:n.tableName})]}),e(P,{"data-testid":"policy-scaffolder-create",disabled:s||n.policyName.trim()===""||n.tableName.trim()==="",onClick:N,size:"xs",type:"button",children:a(s?"Creating…":"Create policy file")}),e(P,{onClick:h,size:"xs",type:"button",variant:"ghost",children:a("Cancel")})]}),t==="wire"&&i("div",{className:"mt-3 flex flex-wrap items-end gap-2","data-testid":"policy-scaffolder-wire-form",children:[i("div",{className:"flex flex-col gap-1 text-xs",children:[e(C,{htmlFor:"policy-scaffolder-file",children:a("Procedure file path")}),e(E,{"data-testid":"policy-scaffolder-file",id:"policy-scaffolder-file",name:"filePath",onChange:f,value:n.filePath})]}),i("div",{className:"flex flex-col gap-1 text-xs",children:[e(C,{htmlFor:"policy-scaffolder-export",children:a("Exported procedure")}),e(E,{"data-testid":"policy-scaffolder-export",id:"policy-scaffolder-export",name:"exportName",onChange:f,value:n.exportName})]}),i("div",{className:"flex flex-col gap-1 text-xs",children:[e(C,{htmlFor:"policy-scaffolder-policies",children:a("Policy set identifier")}),e(E,{"data-testid":"policy-scaffolder-policies",id:"policy-scaffolder-policies",name:"policies",onChange:f,value:n.policies})]}),e(P,{"data-testid":"policy-scaffolder-apply",disabled:s||n.filePath.trim()===""||n.exportName.trim()===""||n.policies.trim()==="",onClick:b,size:"xs",type:"button",children:a(s?"Wiring…":"Wire RLS")}),e(P,{onClick:h,size:"xs",type:"button",variant:"ghost",children:a("Cancel")})]}),l?.kind==="error"&&e("p",{className:"mt-3 text-sm text-destructive","data-testid":"policy-scaffolder-error",role:"alert",children:l.message}),l?.kind==="needs-manual-edit"&&e("p",{className:"mt-3 text-sm text-amber-600 dark:text-amber-500","data-testid":"policy-scaffolder-manual",role:"alert",children:a("This change must be made by hand — the scaffolder only adds new, deny-by-default rules.")}),l?.kind==="ok"&&i("div",{className:"mt-3 flex flex-col gap-1","data-testid":"policy-scaffolder-ok",children:[e("p",{className:"text-sm text-emerald-600 dark:text-emerald-500",children:a("Scaffolded {label} and reran codegen. Fill in the `when` predicates before relying on it.",{label:l.label})}),l.diagnostics.length>0&&e("ul",{className:"flex flex-col gap-0.5","data-testid":"policy-scaffolder-diagnostics",children:l.diagnostics.map(x=>e("li",{className:"font-mono text-[11px] text-destructive",children:x},x))})]})]})]})},Ye=({functions:a,runAsIdentity:t=!1,schemaEditable:o=!1}={})=>{const s=z(),[r,l]=u(void 0),d=(n,y,f)=>{f!==""&&l(h=>({functionPath:f,nonce:(h?.nonce??0)+1}))};return i("div",{className:"flex flex-col gap-8","data-testid":"lunora-permissions",children:[i("section",{className:"flex flex-col gap-3",children:[e("header",{className:"border-b border-border px-4 py-3",children:e("span",{className:"font-mono text-[11px] tracking-wide text-muted-foreground uppercase",children:s("Permissions")})}),e(be,{onProbe:d})]}),e("section",{className:"flex flex-col gap-3",children:i(G,{className:"gap-0 py-0",children:[e("header",{className:"border-b border-border px-4 py-3",children:e("span",{className:"font-mono text-[11px] tracking-wide text-muted-foreground uppercase",children:s("Probe")})}),i(H,{className:"px-4 py-4",children:[e("p",{className:"mb-3 text-sm text-muted-foreground",children:s("Pick a function and an identity, then run it to see the access outcome.")}),e(Pe,{functions:a,prefill:r,runAsIdentity:t})]})]})}),o&&e("section",{className:"flex flex-col gap-2",children:e($e,{})})]})};export{Ye as PermissionsPanel};