@rebasepro/app 0.25.0 → 0.26.0

package/README.md

@@ -58,7 +58,7 @@ This package is **framework-agnostic** in the sense that it doesn't depend on an
 | `useAuthSubscription` | Subscribe to auth state changes |
 | `usePermissions` | Check permissions for collections/actions |
 | `useAdminModeController` / `useBuildAdminModeController` | Admin mode toggle |
-| `useEffectiveRoleController` / `useBuildEffectiveRoleController` | Current user's effective role |
+| `useEffectiveRoleController` | The role Studio's navigation is listed for (`useBuildEffectiveRoleController` is deprecated: use Simulate access to test permissions) |
 
 ### Hooks — UI & State
 

package/dist/RlsSimulatorPanel-DOfmVgM3.js

@@ -0,0 +1,403 @@
+import { useApiBase, useApiConfig, useCanSimulateAccess, useRebaseClient, useRlsSimulation, useTranslation } from "./index.es.js";
+import { useCallback, useEffect, useState } from "react";
+import { Alert, Button, CircularProgress, EyeIcon, IconButton, KeyRoundIcon, Popover, ShieldIcon, Tab, Tabs, TextField, Typography, UserIcon, cls, iconSize } from "@rebasepro/ui";
+import { jsx, jsxs } from "react/jsx-runtime";
+//#region src/components/studio/RlsSimulatorPanel.tsx
+/**
+* The "Simulate access" pill and banner themselves. Loaded on demand by the
+* wrappers in `RlsSimulatorBar.tsx`: only an administrator ever sees them, so
+* nobody else downloads them before the login screen paints.
+*/
+/** How many users one search of the picker lists. */
+var USER_PAGE_SIZE = 20;
+/**
+* A request to the simulator's admin surface with the administrator's own
+* token — never through the simulated client, whose headers the admin routes
+* refuse.
+*/
+function useSimulatorRequest() {
+	const apiConfig = useApiConfig();
+	const apiBase = useApiBase();
+	return useCallback(async (path, init) => {
+		if (!apiBase) throw new Error("No API URL is configured.");
+		const token = await apiConfig?.getAuthToken?.();
+		const response = await fetch(`${apiBase}/admin/rls-simulator${path}`, {
+			method: init?.method ?? "GET",
+			headers: {
+				"Content-Type": "application/json",
+				...token ? { Authorization: `Bearer ${token}` } : {}
+			},
+			...init?.body !== void 0 ? { body: JSON.stringify(init.body) } : {}
+		});
+		const json = await response.json().catch(() => void 0);
+		if (!response.ok) {
+			const message = typeof json === "object" && json !== null && "error" in json && typeof json.error === "object" && json.error !== null && "message" in json.error && typeof json.error.message === "string" ? json.error.message : response.statusText;
+			throw new Error(message);
+		}
+		return json;
+	}, [apiBase, apiConfig]);
+}
+/** One choosable row of the popover's lists. */
+function ChoiceRow({ selected, onClick, icon, title, detail }) {
+	return /* @__PURE__ */ jsxs(Button, {
+		variant: "text",
+		size: "small",
+		fullWidth: true,
+		onClick,
+		className: cls("justify-start", { "bg-surface-active": selected }),
+		children: [
+			icon,
+			/* @__PURE__ */ jsx(Typography, {
+				variant: "body2",
+				noWrap: true,
+				className: "truncate",
+				children: title
+			}),
+			detail && /* @__PURE__ */ jsx(Typography, {
+				variant: "caption",
+				color: "secondary",
+				noWrap: true,
+				className: "truncate",
+				children: detail
+			})
+		]
+	});
+}
+/**
+* "Simulate access": the app bar pill that runs every data view as a role, a
+* user or a service key, so an administrator sees exactly the rows and fields
+* that identity's row-level security lets it read.
+*
+* Shown only to an administrator, and only when the data views ride a client
+* that can derive a simulated one. The server checks the first again on every
+* request: anyone else sending the simulation headers gets a 403.
+*
+* @group Components
+*/
+function RlsSimulatorBarPanel({ className, compact, side, align = "end", portalContainer }) {
+	const { t } = useTranslation();
+	const controller = useRlsSimulation();
+	const canSimulate = useCanSimulateAccess();
+	const request = useSimulatorRequest();
+	const client = useRebaseClient();
+	const [open, setOpen] = useState(false);
+	const [tab, setTab] = useState("role");
+	const [options, setOptions] = useState(null);
+	const [optionsError, setOptionsError] = useState(null);
+	const [role, setRole] = useState(null);
+	const [roleUserId, setRoleUserId] = useState("");
+	const [userSearch, setUserSearch] = useState("");
+	const [users, setUsers] = useState([]);
+	const [usersLoading, setUsersLoading] = useState(false);
+	const [usersError, setUsersError] = useState(null);
+	useEffect(() => {
+		if (!open || options) return;
+		let cancelled = false;
+		setOptionsError(null);
+		request("/options").then((loaded) => {
+			if (!cancelled) setOptions(loaded);
+		}).catch((error) => {
+			if (!cancelled) setOptionsError(error instanceof Error ? error.message : String(error));
+		});
+		return () => {
+			cancelled = true;
+		};
+	}, [
+		open,
+		options,
+		request
+	]);
+	const adminApi = client?.admin;
+	useEffect(() => {
+		if (!open || tab !== "user" || !adminApi) return;
+		let cancelled = false;
+		setUsersLoading(true);
+		const timer = setTimeout(() => {
+			adminApi.listUsersPaginated({
+				search: userSearch || void 0,
+				limit: USER_PAGE_SIZE
+			}).then(({ users: found }) => {
+				if (cancelled) return;
+				setUsersError(null);
+				setUsers(found.filter((user) => !user.disabled).map((user) => ({
+					uid: user.uid,
+					label: user.email ?? user.displayName ?? user.uid,
+					detail: user.roles?.length ? user.roles.join(", ") : void 0
+				})));
+			}).catch((error) => {
+				if (cancelled) return;
+				setUsers([]);
+				setUsersError(error instanceof Error ? error.message : String(error));
+			}).finally(() => {
+				if (!cancelled) setUsersLoading(false);
+			});
+		}, 250);
+		return () => {
+			cancelled = true;
+			clearTimeout(timer);
+		};
+	}, [
+		open,
+		tab,
+		userSearch,
+		adminApi
+	]);
+	const start = (simulation, label) => {
+		controller.setSimulation(simulation, label);
+		setOpen(false);
+	};
+	if (!canSimulate) return null;
+	const active = controller.simulation !== null;
+	return /* @__PURE__ */ jsx(Popover, {
+		trigger: compact ? /* @__PURE__ */ jsxs(IconButton, {
+			"aria-label": t("rls_simulate_access"),
+			className: cls("relative", className),
+			children: [/* @__PURE__ */ jsx(EyeIcon, { size: iconSize.small }), active && /* @__PURE__ */ jsx("span", {
+				"aria-hidden": true,
+				className: "absolute top-1 right-1 w-2 h-2 rounded-full bg-amber-500"
+			})]
+		}) : /* @__PURE__ */ jsxs(Button, {
+			variant: "outlined",
+			size: "small",
+			"aria-label": t("rls_simulate_access"),
+			className: cls("rounded-full whitespace-nowrap", className),
+			children: [active ? /* @__PURE__ */ jsx("span", {
+				"aria-hidden": true,
+				className: "w-2 h-2 rounded-full bg-amber-500"
+			}) : /* @__PURE__ */ jsx(EyeIcon, { size: iconSize.smallest }), t("rls_simulate_access")]
+		}),
+		open,
+		onOpenChange: setOpen,
+		side,
+		align,
+		portalContainer,
+		children: /* @__PURE__ */ jsxs("div", {
+			className: "flex flex-col gap-3 p-3 w-[22rem]",
+			children: [
+				/* @__PURE__ */ jsxs("div", {
+					className: "flex flex-col gap-1",
+					children: [/* @__PURE__ */ jsx(Typography, {
+						variant: "label",
+						children: t("rls_simulate_access")
+					}), /* @__PURE__ */ jsx(Typography, {
+						variant: "caption",
+						color: "secondary",
+						children: t("rls_simulate_access_description")
+					})]
+				}),
+				/* @__PURE__ */ jsxs(Tabs, {
+					value: tab,
+					onValueChange: (value) => setTab(value === "user" || value === "apiKey" ? value : "role"),
+					children: [
+						/* @__PURE__ */ jsx(Tab, {
+							value: "role",
+							children: t("rls_simulate_tab_role")
+						}),
+						/* @__PURE__ */ jsx(Tab, {
+							value: "user",
+							children: t("rls_simulate_tab_user")
+						}),
+						/* @__PURE__ */ jsx(Tab, {
+							value: "apiKey",
+							children: t("rls_simulate_tab_api_key")
+						})
+					]
+				}),
+				optionsError && /* @__PURE__ */ jsx(Alert, {
+					color: "error",
+					size: "small",
+					role: null,
+					children: t("rls_simulate_options_error", { message: optionsError })
+				}),
+				!options && !optionsError && tab !== "user" && /* @__PURE__ */ jsx("div", {
+					className: "flex justify-center p-2",
+					children: /* @__PURE__ */ jsx(CircularProgress, { size: "small" })
+				}),
+				tab === "role" && options && /* @__PURE__ */ jsxs("div", {
+					className: "flex flex-col gap-2",
+					children: [
+						/* @__PURE__ */ jsx("div", {
+							className: "flex flex-col max-h-60 overflow-auto",
+							children: options.roles.map((entry) => /* @__PURE__ */ jsx(ChoiceRow, {
+								selected: role === entry.id,
+								onClick: () => setRole(entry.id),
+								icon: /* @__PURE__ */ jsx(ShieldIcon, { size: iconSize.smallest }),
+								title: entry.id,
+								detail: entry.name !== entry.id ? entry.name : void 0
+							}, entry.id))
+						}),
+						/* @__PURE__ */ jsx(TextField, {
+							size: "small",
+							value: roleUserId,
+							placeholder: t("rls_simulate_user_id_optional"),
+							onChange: (event) => setRoleUserId(event.target.value)
+						}),
+						/* @__PURE__ */ jsx(Button, {
+							color: "primary",
+							size: "small",
+							disabled: !role,
+							onClick: () => {
+								if (!role) return;
+								const userId = roleUserId.trim();
+								start({
+									role,
+									...userId ? { userId } : {}
+								}, {
+									kind: "role",
+									role,
+									...userId ? { userId } : {}
+								});
+							},
+							children: t("rls_simulate_apply")
+						})
+					]
+				}),
+				tab === "user" && /* @__PURE__ */ jsxs("div", {
+					className: "flex flex-col gap-2",
+					children: [/* @__PURE__ */ jsx(TextField, {
+						size: "small",
+						value: userSearch,
+						placeholder: t("rls_simulate_search_users"),
+						onChange: (event) => setUserSearch(event.target.value)
+					}), /* @__PURE__ */ jsxs("div", {
+						className: "flex flex-col max-h-60 overflow-auto",
+						children: [
+							usersLoading && users.length === 0 && /* @__PURE__ */ jsx("div", {
+								className: "flex justify-center p-2",
+								children: /* @__PURE__ */ jsx(CircularProgress, { size: "small" })
+							}),
+							!usersLoading && usersError && /* @__PURE__ */ jsx(Alert, {
+								color: "error",
+								size: "small",
+								role: null,
+								children: t("rls_simulate_users_error", { message: usersError })
+							}),
+							!usersLoading && !usersError && users.length === 0 && /* @__PURE__ */ jsx(Typography, {
+								variant: "caption",
+								color: "secondary",
+								className: "p-2",
+								children: t("rls_simulate_no_users")
+							}),
+							users.map((user) => /* @__PURE__ */ jsx(ChoiceRow, {
+								selected: controller.simulation?.userId === user.uid && !controller.simulation.role,
+								onClick: () => start({ userId: user.uid }, {
+									kind: "user",
+									user: user.label
+								}),
+								icon: /* @__PURE__ */ jsx(UserIcon, { size: iconSize.smallest }),
+								title: user.label,
+								detail: user.detail
+							}, user.uid))
+						]
+					})]
+				}),
+				tab === "apiKey" && options && /* @__PURE__ */ jsxs("div", {
+					className: "flex flex-col max-h-60 overflow-auto",
+					children: [options.apiKeys.length === 0 && /* @__PURE__ */ jsx(Typography, {
+						variant: "caption",
+						color: "secondary",
+						className: "p-2",
+						children: t("rls_simulate_no_api_keys")
+					}), options.apiKeys.map((key) => /* @__PURE__ */ jsx(ChoiceRow, {
+						selected: controller.simulation?.apiKeyId === key.id,
+						onClick: () => start({ apiKeyId: key.id }, {
+							kind: "apiKey",
+							name: key.name,
+							keyPrefix: key.keyPrefix
+						}),
+						icon: /* @__PURE__ */ jsx(KeyRoundIcon, { size: iconSize.smallest }),
+						title: key.name,
+						detail: `${key.keyPrefix}…`
+					}, key.id))]
+				}),
+				active && /* @__PURE__ */ jsx(Button, {
+					variant: "text",
+					size: "small",
+					onClick: () => {
+						controller.setSimulation(null);
+						setOpen(false);
+					},
+					children: t("rls_simulate_stop")
+				})
+			]
+		})
+	});
+}
+/**
+* The banner every screen shows while access is simulated: who the data views
+* run as, how many collections show that identity nothing, how many fields its
+* roles cannot read — and the way out.
+*
+* @group Components
+*/
+function RlsSimulationBannerPanel({ className }) {
+	const { t } = useTranslation();
+	const { simulation, label, setSimulation } = useRlsSimulation();
+	const request = useSimulatorRequest();
+	const [summary, setSummary] = useState(null);
+	const [summaryError, setSummaryError] = useState(null);
+	useEffect(() => {
+		setSummary(null);
+		setSummaryError(null);
+		if (!simulation) return;
+		let cancelled = false;
+		request("/preview", {
+			method: "POST",
+			body: simulation
+		}).then(({ summary: loaded }) => {
+			if (!cancelled) setSummary(loaded);
+		}).catch((error) => {
+			console.warn("Could not preview the simulated access", error);
+			if (!cancelled) setSummaryError(error instanceof Error ? error.message : String(error));
+		});
+		return () => {
+			cancelled = true;
+		};
+	}, [simulation, request]);
+	if (!simulation) return null;
+	const title = (() => {
+		if (label?.kind === "apiKey") return t("rls_simulation_viewing_as_api_key", {
+			name: label.name,
+			prefix: label.keyPrefix
+		});
+		if (label?.kind === "user") return t("rls_simulation_viewing_as_user", { user: label.user });
+		if (simulation.role && simulation.userId) return t("rls_simulation_viewing_as_role_user", {
+			role: simulation.role,
+			user: simulation.userId
+		});
+		if (simulation.role) return t("rls_simulation_viewing_as_role", { role: simulation.role });
+		return t("rls_simulation_viewing_as_user", { user: simulation.userId ?? simulation.apiKeyId ?? "" });
+	})();
+	const counts = summary ? [summary.hiddenCollections === 1 ? t("rls_simulation_hidden_collections_one") : t("rls_simulation_hidden_collections", { count: String(summary.hiddenCollections) }), summary.maskedColumns === 1 ? t("rls_simulation_masked_columns_one") : t("rls_simulation_masked_columns", { count: String(summary.maskedColumns) })].join(", ") : summaryError !== null ? t("rls_simulation_count_failed", { message: summaryError }) : t("rls_simulation_counting");
+	return /* @__PURE__ */ jsx("div", {
+		role: "status",
+		"aria-live": "polite",
+		className,
+		children: /* @__PURE__ */ jsx(Alert, {
+			color: "warning",
+			size: "small",
+			role: null,
+			action: /* @__PURE__ */ jsx(Button, {
+				variant: "text",
+				size: "small",
+				onClick: () => setSimulation(null),
+				children: t("rls_simulate_stop")
+			}),
+			children: /* @__PURE__ */ jsxs("div", {
+				className: "flex flex-col gap-0.5",
+				children: [/* @__PURE__ */ jsx(Typography, {
+					variant: "label",
+					children: `${title} — ${counts}`
+				}), /* @__PURE__ */ jsx(Typography, {
+					variant: "body2",
+					color: "secondary",
+					children: t("rls_simulation_note")
+				})]
+			})
+		})
+	});
+}
+//#endregion
+export { RlsSimulationBannerPanel, RlsSimulatorBarPanel };
+
+//# sourceMappingURL=RlsSimulatorPanel-DOfmVgM3.js.map

package/dist/RlsSimulatorPanel-DOfmVgM3.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RlsSimulatorPanel-DOfmVgM3.js","names":[],"sources":["../src/components/studio/RlsSimulatorPanel.tsx"],"sourcesContent":["/**\n * The \"Simulate access\" pill and banner themselves. Loaded on demand by the\n * wrappers in `RlsSimulatorBar.tsx`: only an administrator ever sees them, so\n * nobody else downloads them before the login screen paints.\n */\nimport React, { useCallback, useEffect, useState } from \"react\";\nimport {\n    Alert,\n    Button,\n    CircularProgress,\n    cls,\n    EyeIcon,\n    IconButton,\n    iconSize,\n    KeyRoundIcon,\n    Popover,\n    ShieldIcon,\n    Tab,\n    Tabs,\n    TextField,\n    Typography,\n    UserIcon\n} from \"@rebasepro/ui\";\nimport type { AccessSimulation, RebaseClient } from \"@rebasepro/types\";\nimport { useRlsSimulation, type RlsSimulationLabel } from \"../../contexts/RlsSimulationContext\";\nimport { useApiBase, useApiConfig } from \"../../hooks/ApiConfigContext\";\nimport { useRebaseClient } from \"../../hooks/useRebaseClient\";\nimport { useTranslation } from \"../../hooks/useTranslation\";\nimport { useCanSimulateAccess, type RlsSimulatorBarProps } from \"./RlsSimulatorBar\";\n\n/** A role `GET /admin/rls-simulator/options` offers. */\ninterface SimulatorRole {\n    id: string;\n    name: string;\n}\n\n/** A live service key `GET /admin/rls-simulator/options` offers. */\ninterface SimulatorApiKey {\n    id: string;\n    name: string;\n    keyPrefix: string;\n}\n\ninterface SimulatorOptions {\n    roles: SimulatorRole[];\n    apiKeys: SimulatorApiKey[];\n}\n\n/** What `POST /admin/rls-simulator/preview` sums up. */\ninterface SimulationSummary {\n    hiddenCollections: number;\n    maskedColumns: number;\n}\n\ntype SimulatorTab = \"role\" | \"user\" | \"apiKey\";\n\n/** How many users one search of the picker lists. */\nconst USER_PAGE_SIZE = 20;\n\n/**\n * A request to the simulator's admin surface with the administrator's own\n * token — never through the simulated client, whose headers the admin routes\n * refuse.\n */\nfunction useSimulatorRequest() {\n    const apiConfig = useApiConfig();\n    const apiBase = useApiBase();\n    return useCallback(async <T, >(path: string, init?: { method?: string; body?: unknown }): Promise<T> => {\n        if (!apiBase) throw new Error(\"No API URL is configured.\");\n        const token = await apiConfig?.getAuthToken?.();\n        const response = await fetch(`${apiBase}/admin/rls-simulator${path}`, {\n            method: init?.method ?? \"GET\",\n            headers: {\n                \"Content-Type\": \"application/json\",\n                ...(token ? { Authorization: `Bearer ${token}` } : {})\n            },\n            ...(init?.body !== undefined ? { body: JSON.stringify(init.body) } : {})\n        });\n        const json: unknown = await response.json().catch(() => undefined);\n        if (!response.ok) {\n            const message = typeof json === \"object\" && json !== null && \"error\" in json\n                && typeof json.error === \"object\" && json.error !== null && \"message\" in json.error\n                && typeof json.error.message === \"string\"\n                ? json.error.message\n                : response.statusText;\n            throw new Error(message);\n        }\n        return json as T;\n    }, [apiBase, apiConfig]);\n}\n\n/** One choosable row of the popover's lists. */\nfunction ChoiceRow({ selected, onClick, icon, title, detail }: {\n    selected: boolean;\n    onClick: () => void;\n    icon: React.ReactNode;\n    title: string;\n    detail?: string;\n}) {\n    return (\n        <Button\n            variant=\"text\"\n            size=\"small\"\n            fullWidth\n            onClick={onClick}\n            className={cls(\"justify-start\", { \"bg-surface-active\": selected })}>\n            {icon}\n            <Typography variant=\"body2\" noWrap className=\"truncate\">{title}</Typography>\n            {detail && <Typography variant=\"caption\" color=\"secondary\" noWrap className=\"truncate\">{detail}</Typography>}\n        </Button>\n    );\n}\n\n/**\n * \"Simulate access\": the app bar pill that runs every data view as a role, a\n * user or a service key, so an administrator sees exactly the rows and fields\n * that identity's row-level security lets it read.\n *\n * Shown only to an administrator, and only when the data views ride a client\n * that can derive a simulated one. The server checks the first again on every\n * request: anyone else sending the simulation headers gets a 403.\n *\n * @group Components\n */\nexport function RlsSimulatorBarPanel({ className, compact, side, align = \"end\", portalContainer }: RlsSimulatorBarProps) {\n    const { t } = useTranslation();\n    const controller = useRlsSimulation();\n    const canSimulate = useCanSimulateAccess();\n    const request = useSimulatorRequest();\n    const client = useRebaseClient<RebaseClient>();\n\n    const [open, setOpen] = useState(false);\n    const [tab, setTab] = useState<SimulatorTab>(\"role\");\n    const [options, setOptions] = useState<SimulatorOptions | null>(null);\n    const [optionsError, setOptionsError] = useState<string | null>(null);\n    const [role, setRole] = useState<string | null>(null);\n    const [roleUserId, setRoleUserId] = useState(\"\");\n    const [userSearch, setUserSearch] = useState(\"\");\n    const [users, setUsers] = useState<Array<{ uid: string; label: string; detail?: string }>>([]);\n    const [usersLoading, setUsersLoading] = useState(false);\n    // A failed search is not a search that found no one.\n    const [usersError, setUsersError] = useState<string | null>(null);\n\n    useEffect(() => {\n        if (!open || options) return;\n        let cancelled = false;\n        // An error from an earlier open is about that request, not this one.\n        setOptionsError(null);\n        request<SimulatorOptions>(\"/options\")\n            .then((loaded) => {\n                if (!cancelled) setOptions(loaded);\n            })\n            .catch((error: unknown) => {\n                if (!cancelled) setOptionsError(error instanceof Error ? error.message : String(error));\n            });\n        return () => {\n            cancelled = true;\n        };\n    }, [open, options, request]);\n\n    const adminApi = client?.admin;\n    useEffect(() => {\n        if (!open || tab !== \"user\" || !adminApi) return;\n        let cancelled = false;\n        setUsersLoading(true);\n        const timer = setTimeout(() => {\n            adminApi.listUsersPaginated({ search: userSearch || undefined, limit: USER_PAGE_SIZE })\n                .then(({ users: found }) => {\n                    if (cancelled) return;\n                    setUsersError(null);\n                    setUsers(found.filter(user => !user.disabled).map(user => ({\n                        uid: user.uid,\n                        label: user.email ?? user.displayName ?? user.uid,\n                        detail: user.roles?.length ? user.roles.join(\", \") : undefined\n                    })));\n                })\n                .catch((error: unknown) => {\n                    if (cancelled) return;\n                    setUsers([]);\n                    setUsersError(error instanceof Error ? error.message : String(error));\n                })\n                .finally(() => {\n                    if (!cancelled) setUsersLoading(false);\n                });\n        }, 250);\n        return () => {\n            cancelled = true;\n            clearTimeout(timer);\n        };\n    }, [open, tab, userSearch, adminApi]);\n\n    const start = (simulation: AccessSimulation, label: RlsSimulationLabel) => {\n        controller.setSimulation(simulation, label);\n        setOpen(false);\n    };\n\n    if (!canSimulate) return null;\n\n    const active = controller.simulation !== null;\n\n    const trigger = compact ? (\n        <IconButton aria-label={t(\"rls_simulate_access\")} className={cls(\"relative\", className)}>\n            <EyeIcon size={iconSize.small}/>\n            {active && <span aria-hidden className=\"absolute top-1 right-1 w-2 h-2 rounded-full bg-amber-500\"/>}\n        </IconButton>\n    ) : (\n        <Button\n            variant=\"outlined\"\n            size=\"small\"\n            aria-label={t(\"rls_simulate_access\")}\n            className={cls(\"rounded-full whitespace-nowrap\", className)}>\n            {active\n                ? <span aria-hidden className=\"w-2 h-2 rounded-full bg-amber-500\"/>\n                : <EyeIcon size={iconSize.smallest}/>}\n            {t(\"rls_simulate_access\")}\n        </Button>\n    );\n\n    return (\n        <Popover trigger={trigger} open={open} onOpenChange={setOpen} side={side} align={align} portalContainer={portalContainer}>\n            <div className=\"flex flex-col gap-3 p-3 w-[22rem]\">\n                <div className=\"flex flex-col gap-1\">\n                    <Typography variant=\"label\">{t(\"rls_simulate_access\")}</Typography>\n                    <Typography variant=\"caption\" color=\"secondary\">{t(\"rls_simulate_access_description\")}</Typography>\n                </div>\n\n                <Tabs value={tab} onValueChange={(value) => setTab(value === \"user\" || value === \"apiKey\" ? value : \"role\")}>\n                    <Tab value=\"role\">{t(\"rls_simulate_tab_role\")}</Tab>\n                    <Tab value=\"user\">{t(\"rls_simulate_tab_user\")}</Tab>\n                    <Tab value=\"apiKey\">{t(\"rls_simulate_tab_api_key\")}</Tab>\n                </Tabs>\n\n                {optionsError && (\n                    <Alert color=\"error\" size=\"small\" role={null}>\n                        {t(\"rls_simulate_options_error\", { message: optionsError })}\n                    </Alert>\n                )}\n\n                {!options && !optionsError && tab !== \"user\" && (\n                    <div className=\"flex justify-center p-2\"><CircularProgress size=\"small\"/></div>\n                )}\n\n                {tab === \"role\" && options && (\n                    <div className=\"flex flex-col gap-2\">\n                        <div className=\"flex flex-col max-h-60 overflow-auto\">\n                            {options.roles.map(entry => (\n                                <ChoiceRow\n                                    key={entry.id}\n                                    selected={role === entry.id}\n                                    onClick={() => setRole(entry.id)}\n                                    icon={<ShieldIcon size={iconSize.smallest}/>}\n                                    title={entry.id}\n                                    detail={entry.name !== entry.id ? entry.name : undefined}/>\n                            ))}\n                        </div>\n                        <TextField\n                            size=\"small\"\n                            value={roleUserId}\n                            placeholder={t(\"rls_simulate_user_id_optional\")}\n                            onChange={(event) => setRoleUserId(event.target.value)}/>\n                        <Button\n                            color=\"primary\"\n                            size=\"small\"\n                            disabled={!role}\n                            onClick={() => {\n                                if (!role) return;\n                                const userId = roleUserId.trim();\n                                start(\n                                    { role, ...(userId ? { userId } : {}) },\n                                    { kind: \"role\", role, ...(userId ? { userId } : {}) }\n                                );\n                            }}>\n                            {t(\"rls_simulate_apply\")}\n                        </Button>\n                    </div>\n                )}\n\n                {tab === \"user\" && (\n                    <div className=\"flex flex-col gap-2\">\n                        <TextField\n                            size=\"small\"\n                            value={userSearch}\n                            placeholder={t(\"rls_simulate_search_users\")}\n                            onChange={(event) => setUserSearch(event.target.value)}/>\n                        <div className=\"flex flex-col max-h-60 overflow-auto\">\n                            {usersLoading && users.length === 0 && (\n                                <div className=\"flex justify-center p-2\"><CircularProgress size=\"small\"/></div>\n                            )}\n                            {!usersLoading && usersError && (\n                                <Alert color=\"error\" size=\"small\" role={null}>\n                                    {t(\"rls_simulate_users_error\", { message: usersError })}\n                                </Alert>\n                            )}\n                            {!usersLoading && !usersError && users.length === 0 && (\n                                <Typography variant=\"caption\" color=\"secondary\" className=\"p-2\">{t(\"rls_simulate_no_users\")}</Typography>\n                            )}\n                            {users.map(user => (\n                                <ChoiceRow\n                                    key={user.uid}\n                                    selected={controller.simulation?.userId === user.uid && !controller.simulation.role}\n                                    onClick={() => start({ userId: user.uid }, { kind: \"user\", user: user.label })}\n                                    icon={<UserIcon size={iconSize.smallest}/>}\n                                    title={user.label}\n                                    detail={user.detail}/>\n                            ))}\n                        </div>\n                    </div>\n                )}\n\n                {tab === \"apiKey\" && options && (\n                    <div className=\"flex flex-col max-h-60 overflow-auto\">\n                        {options.apiKeys.length === 0 && (\n                            <Typography variant=\"caption\" color=\"secondary\" className=\"p-2\">{t(\"rls_simulate_no_api_keys\")}</Typography>\n                        )}\n                        {options.apiKeys.map(key => (\n                            <ChoiceRow\n                                key={key.id}\n                                selected={controller.simulation?.apiKeyId === key.id}\n                                onClick={() => start({ apiKeyId: key.id }, { kind: \"apiKey\", name: key.name, keyPrefix: key.keyPrefix })}\n                                icon={<KeyRoundIcon size={iconSize.smallest}/>}\n                                title={key.name}\n                                detail={`${key.keyPrefix}…`}/>\n                        ))}\n                    </div>\n                )}\n\n                {active && (\n                    <Button\n                        variant=\"text\"\n                        size=\"small\"\n                        onClick={() => {\n                            controller.setSimulation(null);\n                            setOpen(false);\n                        }}>\n                        {t(\"rls_simulate_stop\")}\n                    </Button>\n                )}\n            </div>\n        </Popover>\n    );\n}\n\n/**\n * The banner every screen shows while access is simulated: who the data views\n * run as, how many collections show that identity nothing, how many fields its\n * roles cannot read — and the way out.\n *\n * @group Components\n */\nexport function RlsSimulationBannerPanel({ className }: { className?: string }) {\n    const { t } = useTranslation();\n    const { simulation, label, setSimulation } = useRlsSimulation();\n    const request = useSimulatorRequest();\n    const [summary, setSummary] = useState<SimulationSummary | null>(null);\n    // Why the count failed: without it the banner said \"Counting…\" for as long\n    // as the simulation ran.\n    const [summaryError, setSummaryError] = useState<string | null>(null);\n\n    useEffect(() => {\n        setSummary(null);\n        setSummaryError(null);\n        if (!simulation) return;\n        let cancelled = false;\n        request<{ summary: SimulationSummary }>(\"/preview\", { method: \"POST\", body: simulation })\n            .then(({ summary: loaded }) => {\n                if (!cancelled) setSummary(loaded);\n            })\n            .catch((error: unknown) => {\n                console.warn(\"Could not preview the simulated access\", error);\n                if (!cancelled) setSummaryError(error instanceof Error ? error.message : String(error));\n            });\n        return () => {\n            cancelled = true;\n        };\n    }, [simulation, request]);\n\n    if (!simulation) return null;\n\n    const title = (() => {\n        if (label?.kind === \"apiKey\") return t(\"rls_simulation_viewing_as_api_key\", { name: label.name, prefix: label.keyPrefix });\n        if (label?.kind === \"user\") return t(\"rls_simulation_viewing_as_user\", { user: label.user });\n        if (simulation.role && simulation.userId) {\n            return t(\"rls_simulation_viewing_as_role_user\", { role: simulation.role, user: simulation.userId });\n        }\n        if (simulation.role) return t(\"rls_simulation_viewing_as_role\", { role: simulation.role });\n        return t(\"rls_simulation_viewing_as_user\", { user: simulation.userId ?? simulation.apiKeyId ?? \"\" });\n    })();\n\n    const counts = summary\n        ? [\n            summary.hiddenCollections === 1\n                ? t(\"rls_simulation_hidden_collections_one\")\n                : t(\"rls_simulation_hidden_collections\", { count: String(summary.hiddenCollections) }),\n            summary.maskedColumns === 1\n                ? t(\"rls_simulation_masked_columns_one\")\n                : t(\"rls_simulation_masked_columns\", { count: String(summary.maskedColumns) })\n        ].join(\", \")\n        : summaryError !== null\n            ? t(\"rls_simulation_count_failed\", { message: summaryError })\n            : t(\"rls_simulation_counting\");\n\n    return (\n        <div role=\"status\" aria-live=\"polite\" className={className}>\n            <Alert\n                color=\"warning\"\n                size=\"small\"\n                role={null}\n                action={<Button variant=\"text\" size=\"small\" onClick={() => setSimulation(null)}>{t(\"rls_simulate_stop\")}</Button>}>\n                <div className=\"flex flex-col gap-0.5\">\n                    <Typography variant=\"label\">{`${title} — ${counts}`}</Typography>\n                    <Typography variant=\"body2\" color=\"secondary\">{t(\"rls_simulation_note\")}</Typography>\n                </div>\n            </Alert>\n        </div>\n    );\n}\n"],"mappings":";;;;;;;;;;;AAyDA,IAAM,iBAAiB;;;;;;AAOvB,SAAS,sBAAsB;CAC3B,MAAM,YAAY,aAAa;CAC/B,MAAM,UAAU,WAAW;CAC3B,OAAO,YAAY,OAAY,MAAc,SAA2D;EACpG,IAAI,CAAC,SAAS,MAAM,IAAI,MAAM,2BAA2B;EACzD,MAAM,QAAQ,MAAM,WAAW,eAAe;EAC9C,MAAM,WAAW,MAAM,MAAM,GAAG,QAAQ,sBAAsB,QAAQ;GAClE,QAAQ,MAAM,UAAU;GACxB,SAAS;IACL,gBAAgB;IAChB,GAAI,QAAQ,EAAE,eAAe,UAAU,QAAQ,IAAI,CAAC;GACxD;GACA,GAAI,MAAM,SAAS,KAAA,IAAY,EAAE,MAAM,KAAK,UAAU,KAAK,IAAI,EAAE,IAAI,CAAC;EAC1E,CAAC;EACD,MAAM,OAAgB,MAAM,SAAS,KAAK,CAAC,CAAC,YAAY,KAAA,CAAS;EACjE,IAAI,CAAC,SAAS,IAAI;GACd,MAAM,UAAU,OAAO,SAAS,YAAY,SAAS,QAAQ,WAAW,QACjE,OAAO,KAAK,UAAU,YAAY,KAAK,UAAU,QAAQ,aAAa,KAAK,SAC3E,OAAO,KAAK,MAAM,YAAY,WAC/B,KAAK,MAAM,UACX,SAAS;GACf,MAAM,IAAI,MAAM,OAAO;EAC3B;EACA,OAAO;CACX,GAAG,CAAC,SAAS,SAAS,CAAC;AAC3B;;AAGA,SAAS,UAAU,EAAE,UAAU,SAAS,MAAM,OAAO,UAMlD;CACC,OACI,qBAAC,QAAD;EACI,SAAQ;EACR,MAAK;EACL,WAAA;EACS;EACT,WAAW,IAAI,iBAAiB,EAAE,qBAAqB,SAAS,CAAC;YALrE;GAMK;GACD,oBAAC,YAAD;IAAY,SAAQ;IAAQ,QAAA;IAAO,WAAU;cAAY;GAAkB,CAAA;GAC1E,UAAU,oBAAC,YAAD;IAAY,SAAQ;IAAU,OAAM;IAAY,QAAA;IAAO,WAAU;cAAY;GAAmB,CAAA;EACvG;;AAEhB;;;;;;;;;;;;AAaA,SAAgB,qBAAqB,EAAE,WAAW,SAAS,MAAM,QAAQ,OAAO,mBAAyC;CACrH,MAAM,EAAE,MAAM,eAAe;CAC7B,MAAM,aAAa,iBAAiB;CACpC,MAAM,cAAc,qBAAqB;CACzC,MAAM,UAAU,oBAAoB;CACpC,MAAM,SAAS,gBAA8B;CAE7C,MAAM,CAAC,MAAM,WAAW,SAAS,KAAK;CACtC,MAAM,CAAC,KAAK,UAAU,SAAuB,MAAM;CACnD,MAAM,CAAC,SAAS,cAAc,SAAkC,IAAI;CACpE,MAAM,CAAC,cAAc,mBAAmB,SAAwB,IAAI;CACpE,MAAM,CAAC,MAAM,WAAW,SAAwB,IAAI;CACpD,MAAM,CAAC,YAAY,iBAAiB,SAAS,EAAE;CAC/C,MAAM,CAAC,YAAY,iBAAiB,SAAS,EAAE;CAC/C,MAAM,CAAC,OAAO,YAAY,SAAiE,CAAC,CAAC;CAC7F,MAAM,CAAC,cAAc,mBAAmB,SAAS,KAAK;CAEtD,MAAM,CAAC,YAAY,iBAAiB,SAAwB,IAAI;CAEhE,gBAAgB;EACZ,IAAI,CAAC,QAAQ,SAAS;EACtB,IAAI,YAAY;EAEhB,gBAAgB,IAAI;EACpB,QAA0B,UAAU,CAAC,CAChC,MAAM,WAAW;GACd,IAAI,CAAC,WAAW,WAAW,MAAM;EACrC,CAAC,CAAC,CACD,OAAO,UAAmB;GACvB,IAAI,CAAC,WAAW,gBAAgB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;EAC1F,CAAC;EACL,aAAa;GACT,YAAY;EAChB;CACJ,GAAG;EAAC;EAAM;EAAS;CAAO,CAAC;CAE3B,MAAM,WAAW,QAAQ;CACzB,gBAAgB;EACZ,IAAI,CAAC,QAAQ,QAAQ,UAAU,CAAC,UAAU;EAC1C,IAAI,YAAY;EAChB,gBAAgB,IAAI;EACpB,MAAM,QAAQ,iBAAiB;GAC3B,SAAS,mBAAmB;IAAE,QAAQ,cAAc,KAAA;IAAW,OAAO;GAAe,CAAC,CAAC,CAClF,MAAM,EAAE,OAAO,YAAY;IACxB,IAAI,WAAW;IACf,cAAc,IAAI;IAClB,SAAS,MAAM,QAAO,SAAQ,CAAC,KAAK,QAAQ,CAAC,CAAC,KAAI,UAAS;KACvD,KAAK,KAAK;KACV,OAAO,KAAK,SAAS,KAAK,eAAe,KAAK;KAC9C,QAAQ,KAAK,OAAO,SAAS,KAAK,MAAM,KAAK,IAAI,IAAI,KAAA;IACzD,EAAE,CAAC;GACP,CAAC,CAAC,CACD,OAAO,UAAmB;IACvB,IAAI,WAAW;IACf,SAAS,CAAC,CAAC;IACX,cAAc,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;GACxE,CAAC,CAAC,CACD,cAAc;IACX,IAAI,CAAC,WAAW,gBAAgB,KAAK;GACzC,CAAC;EACT,GAAG,GAAG;EACN,aAAa;GACT,YAAY;GACZ,aAAa,KAAK;EACtB;CACJ,GAAG;EAAC;EAAM;EAAK;EAAY;CAAQ,CAAC;CAEpC,MAAM,SAAS,YAA8B,UAA8B;EACvE,WAAW,cAAc,YAAY,KAAK;EAC1C,QAAQ,KAAK;CACjB;CAEA,IAAI,CAAC,aAAa,OAAO;CAEzB,MAAM,SAAS,WAAW,eAAe;CAoBzC,OACI,oBAAC,SAAD;EAAkB,SAnBN,UACZ,qBAAC,YAAD;GAAY,cAAY,EAAE,qBAAqB;GAAG,WAAW,IAAI,YAAY,SAAS;aAAtF,CACI,oBAAC,SAAD,EAAS,MAAM,SAAS,MAAO,CAAA,GAC9B,UAAU,oBAAC,QAAD;IAAM,eAAA;IAAY,WAAU;GAA2D,CAAA,CAC1F;OAEZ,qBAAC,QAAD;GACI,SAAQ;GACR,MAAK;GACL,cAAY,EAAE,qBAAqB;GACnC,WAAW,IAAI,kCAAkC,SAAS;aAJ9D,CAKK,SACK,oBAAC,QAAD;IAAM,eAAA;IAAY,WAAU;GAAoC,CAAA,IAChE,oBAAC,SAAD,EAAS,MAAM,SAAS,SAAU,CAAA,GACvC,EAAE,qBAAqB,CACpB;;EAIyB;EAAM,cAAc;EAAe;EAAa;EAAwB;YACrG,qBAAC,OAAD;GAAK,WAAU;aAAf;IACI,qBAAC,OAAD;KAAK,WAAU;eAAf,CACI,oBAAC,YAAD;MAAY,SAAQ;gBAAS,EAAE,qBAAqB;KAAc,CAAA,GAClE,oBAAC,YAAD;MAAY,SAAQ;MAAU,OAAM;gBAAa,EAAE,iCAAiC;KAAc,CAAA,CACjG;;IAEL,qBAAC,MAAD;KAAM,OAAO;KAAK,gBAAgB,UAAU,OAAO,UAAU,UAAU,UAAU,WAAW,QAAQ,MAAM;eAA1G;MACI,oBAAC,KAAD;OAAK,OAAM;iBAAQ,EAAE,uBAAuB;MAAO,CAAA;MACnD,oBAAC,KAAD;OAAK,OAAM;iBAAQ,EAAE,uBAAuB;MAAO,CAAA;MACnD,oBAAC,KAAD;OAAK,OAAM;iBAAU,EAAE,0BAA0B;MAAO,CAAA;KACtD;;IAEL,gBACG,oBAAC,OAAD;KAAO,OAAM;KAAQ,MAAK;KAAQ,MAAM;eACnC,EAAE,8BAA8B,EAAE,SAAS,aAAa,CAAC;IACvD,CAAA;IAGV,CAAC,WAAW,CAAC,gBAAgB,QAAQ,UAClC,oBAAC,OAAD;KAAK,WAAU;eAA0B,oBAAC,kBAAD,EAAkB,MAAK,QAAQ,CAAA;IAAM,CAAA;IAGjF,QAAQ,UAAU,WACf,qBAAC,OAAD;KAAK,WAAU;eAAf;MACI,oBAAC,OAAD;OAAK,WAAU;iBACV,QAAQ,MAAM,KAAI,UACf,oBAAC,WAAD;QAEI,UAAU,SAAS,MAAM;QACzB,eAAe,QAAQ,MAAM,EAAE;QAC/B,MAAM,oBAAC,YAAD,EAAY,MAAM,SAAS,SAAU,CAAA;QAC3C,OAAO,MAAM;QACb,QAAQ,MAAM,SAAS,MAAM,KAAK,MAAM,OAAO,KAAA;OAAW,GALrD,MAAM,EAK+C,CACjE;MACA,CAAA;MACL,oBAAC,WAAD;OACI,MAAK;OACL,OAAO;OACP,aAAa,EAAE,+BAA+B;OAC9C,WAAW,UAAU,cAAc,MAAM,OAAO,KAAK;MAAG,CAAA;MAC5D,oBAAC,QAAD;OACI,OAAM;OACN,MAAK;OACL,UAAU,CAAC;OACX,eAAe;QACX,IAAI,CAAC,MAAM;QACX,MAAM,SAAS,WAAW,KAAK;QAC/B,MACI;SAAE;SAAM,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;QAAG,GACtC;SAAE,MAAM;SAAQ;SAAM,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;QAAG,CACxD;OACJ;iBACC,EAAE,oBAAoB;MACnB,CAAA;KACP;;IAGR,QAAQ,UACL,qBAAC,OAAD;KAAK,WAAU;eAAf,CACI,oBAAC,WAAD;MACI,MAAK;MACL,OAAO;MACP,aAAa,EAAE,2BAA2B;MAC1C,WAAW,UAAU,cAAc,MAAM,OAAO,KAAK;KAAG,CAAA,GAC5D,qBAAC,OAAD;MAAK,WAAU;gBAAf;OACK,gBAAgB,MAAM,WAAW,KAC9B,oBAAC,OAAD;QAAK,WAAU;kBAA0B,oBAAC,kBAAD,EAAkB,MAAK,QAAQ,CAAA;OAAM,CAAA;OAEjF,CAAC,gBAAgB,cACd,oBAAC,OAAD;QAAO,OAAM;QAAQ,MAAK;QAAQ,MAAM;kBACnC,EAAE,4BAA4B,EAAE,SAAS,WAAW,CAAC;OACnD,CAAA;OAEV,CAAC,gBAAgB,CAAC,cAAc,MAAM,WAAW,KAC9C,oBAAC,YAAD;QAAY,SAAQ;QAAU,OAAM;QAAY,WAAU;kBAAO,EAAE,uBAAuB;OAAc,CAAA;OAE3G,MAAM,KAAI,SACP,oBAAC,WAAD;QAEI,UAAU,WAAW,YAAY,WAAW,KAAK,OAAO,CAAC,WAAW,WAAW;QAC/E,eAAe,MAAM,EAAE,QAAQ,KAAK,IAAI,GAAG;SAAE,MAAM;SAAQ,MAAM,KAAK;QAAM,CAAC;QAC7E,MAAM,oBAAC,UAAD,EAAU,MAAM,SAAS,SAAU,CAAA;QACzC,OAAO,KAAK;QACZ,QAAQ,KAAK;OAAQ,GALhB,KAAK,GAKW,CAC5B;MACA;OACJ;;IAGR,QAAQ,YAAY,WACjB,qBAAC,OAAD;KAAK,WAAU;eAAf,CACK,QAAQ,QAAQ,WAAW,KACxB,oBAAC,YAAD;MAAY,SAAQ;MAAU,OAAM;MAAY,WAAU;gBAAO,EAAE,0BAA0B;KAAc,CAAA,GAE9G,QAAQ,QAAQ,KAAI,QACjB,oBAAC,WAAD;MAEI,UAAU,WAAW,YAAY,aAAa,IAAI;MAClD,eAAe,MAAM,EAAE,UAAU,IAAI,GAAG,GAAG;OAAE,MAAM;OAAU,MAAM,IAAI;OAAM,WAAW,IAAI;MAAU,CAAC;MACvG,MAAM,oBAAC,cAAD,EAAc,MAAM,SAAS,SAAU,CAAA;MAC7C,OAAO,IAAI;MACX,QAAQ,GAAG,IAAI,UAAU;KAAI,GALxB,IAAI,EAKoB,CACpC,CACA;;IAGR,UACG,oBAAC,QAAD;KACI,SAAQ;KACR,MAAK;KACL,eAAe;MACX,WAAW,cAAc,IAAI;MAC7B,QAAQ,KAAK;KACjB;eACC,EAAE,mBAAmB;IAClB,CAAA;GAEX;;CACA,CAAA;AAEjB;;;;;;;;AASA,SAAgB,yBAAyB,EAAE,aAAqC;CAC5E,MAAM,EAAE,MAAM,eAAe;CAC7B,MAAM,EAAE,YAAY,OAAO,kBAAkB,iBAAiB;CAC9D,MAAM,UAAU,oBAAoB;CACpC,MAAM,CAAC,SAAS,cAAc,SAAmC,IAAI;CAGrE,MAAM,CAAC,cAAc,mBAAmB,SAAwB,IAAI;CAEpE,gBAAgB;EACZ,WAAW,IAAI;EACf,gBAAgB,IAAI;EACpB,IAAI,CAAC,YAAY;EACjB,IAAI,YAAY;EAChB,QAAwC,YAAY;GAAE,QAAQ;GAAQ,MAAM;EAAW,CAAC,CAAC,CACpF,MAAM,EAAE,SAAS,aAAa;GAC3B,IAAI,CAAC,WAAW,WAAW,MAAM;EACrC,CAAC,CAAC,CACD,OAAO,UAAmB;GACvB,QAAQ,KAAK,0CAA0C,KAAK;GAC5D,IAAI,CAAC,WAAW,gBAAgB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;EAC1F,CAAC;EACL,aAAa;GACT,YAAY;EAChB;CACJ,GAAG,CAAC,YAAY,OAAO,CAAC;CAExB,IAAI,CAAC,YAAY,OAAO;CAExB,MAAM,eAAe;EACjB,IAAI,OAAO,SAAS,UAAU,OAAO,EAAE,qCAAqC;GAAE,MAAM,MAAM;GAAM,QAAQ,MAAM;EAAU,CAAC;EACzH,IAAI,OAAO,SAAS,QAAQ,OAAO,EAAE,kCAAkC,EAAE,MAAM,MAAM,KAAK,CAAC;EAC3F,IAAI,WAAW,QAAQ,WAAW,QAC9B,OAAO,EAAE,uCAAuC;GAAE,MAAM,WAAW;GAAM,MAAM,WAAW;EAAO,CAAC;EAEtG,IAAI,WAAW,MAAM,OAAO,EAAE,kCAAkC,EAAE,MAAM,WAAW,KAAK,CAAC;EACzF,OAAO,EAAE,kCAAkC,EAAE,MAAM,WAAW,UAAU,WAAW,YAAY,GAAG,CAAC;CACvG,EAAA,CAAG;CAEH,MAAM,SAAS,UACT,CACE,QAAQ,sBAAsB,IACxB,EAAE,uCAAuC,IACzC,EAAE,qCAAqC,EAAE,OAAO,OAAO,QAAQ,iBAAiB,EAAE,CAAC,GACzF,QAAQ,kBAAkB,IACpB,EAAE,mCAAmC,IACrC,EAAE,iCAAiC,EAAE,OAAO,OAAO,QAAQ,aAAa,EAAE,CAAC,CACrF,CAAC,CAAC,KAAK,IAAI,IACT,iBAAiB,OACb,EAAE,+BAA+B,EAAE,SAAS,aAAa,CAAC,IAC1D,EAAE,yBAAyB;CAErC,OACI,oBAAC,OAAD;EAAK,MAAK;EAAS,aAAU;EAAoB;YAC7C,oBAAC,OAAD;GACI,OAAM;GACN,MAAK;GACL,MAAM;GACN,QAAQ,oBAAC,QAAD;IAAQ,SAAQ;IAAO,MAAK;IAAQ,eAAe,cAAc,IAAI;cAAI,EAAE,mBAAmB;GAAU,CAAA;aAChH,qBAAC,OAAD;IAAK,WAAU;cAAf,CACI,oBAAC,YAAD;KAAY,SAAQ;eAAS,GAAG,MAAM,KAAK;IAAqB,CAAA,GAChE,oBAAC,YAAD;KAAY,SAAQ;KAAQ,OAAM;eAAa,EAAE,qBAAqB;IAAc,CAAA,CACnF;;EACF,CAAA;CACN,CAAA;AAEb"}

package/dist/collections/form-layout.d.ts

@@ -4,13 +4,14 @@
  * Turns a collection into the shape the entity form renders: an ordered list of
  * sections holding grid-spanned fields, plus the metadata rail beside them.
  *
- * The reason this is a pure function rather than logic inside the form is that
- * the *defaults* are the interesting part. A collection that never writes an
- * `admin.form` block still has to get a two-column layout out of this once it is
- * long enough to need one — the flat run of full-width fields it produced before
- * was the single biggest cost in the form, and no amount of config would have fixed it for collections nobody
- * hand-tunes. Deriving it here means it is testable in isolation, which matters
- * because "what span does a date get" is exactly the kind of rule that rots.
+ * A field takes the full row unless its property sets `admin.span`, with one
+ * exception: two neighbouring fields whose editors are both small and of the
+ * same kind — two numbers, two switches, two dates, two short selects — share a
+ * row. Nothing wider is ever guessed. Pairing by type alone put Namespace beside
+ * Custom Domain and Git Branch beside Git Repository URL, values that sat
+ * together only because both were strings; a string's editor says nothing about
+ * how long its value is, so a free-text field is never paired. Nothing here
+ * looks at which property is the record's title either.
  */
 import type { AdminCollection, PropertySpan } from "@rebasepro/cms-types";
 import type { Property } from "@rebasepro/types";
@@ -21,10 +22,7 @@ export interface ResolvedFormField {
     span: PropertySpan;
     /** True for an `additionalFields` entry rather than a property. */
     additional: boolean;
-    /**
-     * The span was written on the property rather than derived from its type.
-     * Row filling leaves these alone: an author who wrote a width meant it.
-     */
+    /** The span was written on the property. Pairing leaves these alone. */
     spanExplicit?: boolean;
 }
 export interface ResolvedFormSection {
@@ -65,14 +63,6 @@ export interface ResolveFormLayoutParams<M extends Record<string, unknown>> {
      */
     status: "new" | "existing" | "copy";
 }
-/**
- * The span a property gets when nothing is declared.
- *
- * Deliberately coarse: three buckets, chosen by how much room the *editor*
- * needs, not by how important the field is. Importance is what `admin.form`
- * sections are for.
- */
-export declare function deriveSpan(property: Property, isTitleProperty: boolean): PropertySpan;
 /**
  * Can the user still type this id?
  *
@@ -92,17 +82,29 @@ export declare function isIdPropertyEditable(property: Property, status: "new" |
  * screen.
  */
 export declare function isAuditTimestamp(property: Property | undefined): boolean;
+/** What a field's editor is, for the purpose of sitting beside another one. */
+type PairKind = "number" | "switch" | "date" | "date_time" | "select";
+/**
+ * The kind of compact editor this property renders, or `undefined` when its
+ * editor needs the row — or when nothing about it says how long its value is.
+ *
+ * Deliberately narrow. A plain string is never compact: "Namespace" and "Git
+ * Branch" are both strings and nothing in the schema tells a 6-character branch
+ * from a 60-character URL. Neither is a relation, whose preview is the related
+ * record's own text. Only editors whose width is bounded by what they are —
+ * a number, a switch, a date picker, a select over short options — qualify.
+ */
+export declare function pairKind(property: Property): PairKind | undefined;
 /**
- * Close the trailing gap in each row.
+ * Put neighbouring fields of the same compact kind two to a row.
  *
- * Without this a section of half-width fields with an odd count leaves a hole —
- * `name | sku` then `brand | ␣␣` — a field stranded beside half a row of
- * nothing, which reads as a mistake rather than a layout. The remainder is
- * spread across the row's derived fields rather than dumped on the last one, so
- * a lone half-width field becomes full width and a pair grows evenly. Fields
- * with an explicit span are never resized.
+ * Greedy and in declaration order: a run of three numbers is a pair and a full
+ * row, never a pair with the third pulled out of order. A pair only starts at
+ * the beginning of a row — the grid flows, so a pair placed after an author's
+ * `span: 2` would split across two rows. Fields with a span the author wrote are
+ * left as written, and nothing is widened to close a gap they leave.
  */
-export declare function fillRows(fields: ResolvedFormField[]): ResolvedFormField[];
+export declare function pairCompactFields(fields: ResolvedFormField[], propertyOf: (key: string) => Property | undefined): ResolvedFormField[];
 /**
  * Resolve the layout for a collection's generated form.
  *
@@ -111,3 +113,4 @@ export declare function fillRows(fields: ResolvedFormField[]): ResolvedFormField
  * in the panel.
  */
 export declare function resolveFormLayout<M extends Record<string, unknown>>({ collection, fieldKeys, status }: ResolveFormLayoutParams<M>): ResolvedFormLayout;
+export {};

package/dist/components/LanguageToggle.d.ts

@@ -1,2 +1,11 @@
 import React from "react";
+/**
+ * A language's name in that language. One Rebase does not ship is named by
+ * the browser (`nl` → "Nederlands"), and by its code when the browser cannot.
+ */
+export declare function languageName(locale: string): string;
+/**
+ * The language menu: every language the admin can be shown in, which is the
+ * shipped ones plus any the app adds through `<Rebase translations>`.
+ */
 export declare function LanguageToggle(): React.JSX.Element;

package/dist/components/LoginView/index.d.ts

@@ -2,3 +2,10 @@ export { LoginView } from "./LoginView.js";
 export type { LoginViewProps } from "./LoginView.js";
 export { readEmailLinkAction } from "./email-link.js";
 export type { EmailLinkAction } from "./email-link.js";
+export { startOAuthRedirect, consumeOAuthCallback } from "./oauth-redirect-flow.js";
+export type { OAuthRedirectRequest, OAuthCallbackResult } from "./oauth-redirect-flow.js";
+export { readMfaRequired, canAnswerMfa, classifyMfaRefusal } from "./mfa-required.js";
+export type { PendingMfaSignIn } from "./mfa-required.js";
+export { authErrorMessage } from "./auth-error-message.js";
+export { appAddressOfEmailLink } from "./email-link.js";
+export { emailChangeErrorMessage } from "../email-change-message.js";

package/dist/components/index.d.ts

@@ -14,3 +14,4 @@ export * from "./LoginView/index.js";
 export * from "./RebaseAuth.js";
 export * from "./SchemaDriftBanner.js";
 export * from "./ConnectionLostBanner.js";
+export * from "./studio/RlsSimulatorBar.js";

package/dist/components/studio/RlsSimulatorBar.d.ts

@@ -0,0 +1,39 @@
+import React from "react";
+export interface RlsSimulatorBarProps {
+    className?: string;
+    /** An icon button instead of the pill — for a collapsed drawer rail. */
+    compact?: boolean;
+    side?: "top" | "right" | "bottom" | "left";
+    align?: "start" | "center" | "end";
+    /** Where the popover mounts — inside a floating drawer, so hovering it keeps the drawer open. */
+    portalContainer?: HTMLElement | null;
+}
+/**
+ * Whether the signed-in person may simulate access here: an administrator,
+ * with data views that ride a client able to derive a simulated one.
+ *
+ * @group Hooks and utilities
+ */
+export declare function useCanSimulateAccess(): boolean;
+/**
+ * "Simulate access": the app bar pill that runs every data view as a role, a
+ * user or a service key, so an administrator sees exactly the rows and fields
+ * that identity's row-level security lets it read.
+ *
+ * Shown only to an administrator, and only when the data views ride a client
+ * that can derive a simulated one. The server checks the first again on every
+ * request: anyone else sending the simulation headers gets a 403.
+ *
+ * @group Components
+ */
+export declare function RlsSimulatorBar(props: RlsSimulatorBarProps): React.JSX.Element | null;
+/**
+ * The banner every screen shows while access is simulated: who the data views
+ * run as, how many collections show that identity nothing, how many fields its
+ * roles cannot read — and the way out.
+ *
+ * @group Components
+ */
+export declare function RlsSimulationBanner({ className }: {
+    className?: string;
+}): React.JSX.Element | null;