@rebasepro/studio 0.17.3 → 0.18.0

package/dist/{RLSEditor-CBX4uD66.js → RLSEditor-Sa1D34ny.js}

@@ -1,5 +1,5 @@
 import { t as MonacoEditor } from "./MonacoEditor-D0_QljcX.js";
-import { ErrorView, useApiBase, useApiConfig, useRebaseContext, useSnackbarController, useStudioCapabilities, useStudioCollectionRegistry, useTranslation } from "@rebasepro/app";
+import { ConfirmationDialog, ErrorView, useApiBase, useApiConfig, useRebaseContext, useSnackbarController, useStudioCapabilities, useStudioCollectionRegistry, useStudioSchemaEditing, useTranslation } from "@rebasepro/app";
 import { useCallback, useEffect, useMemo, useState } from "react";
 import { Alert, AlertTriangleIcon, Button, Chip, CircularProgress, DatabaseIcon, Dialog, DialogActions, DialogContent, DialogTitle, HelpCircleIcon, IconButton, KeyIcon, Link2Icon, LockIcon, MultiSelect, MultiSelectItem, Paper, RefreshCwIcon, ResizablePanels, Select, SelectItem, ShieldIcon, Tab, Tabs, TextField, Tooltip, Trash2Icon, Typography, cls, defaultBorderMixin, iconSize } from "@rebasepro/ui";
 import { Fragment, jsx, jsxs } from "react/jsx-runtime";
@@ -711,6 +711,55 @@ async function saveSecurityRulesToCodebase(options) {
 	throw new Error(message ?? `Failed to save policy (HTTP ${response.status}).`);
 }
 //#endregion
+//#region src/components/RLSEditor/saveRules.ts
+/**
+* Where a collection's security rules go when the RLS editor saves them.
+*
+* There are two doors onto one file. The collection editor's save is planned,
+* shown as SQL, confirmed, and applied to the database. The RLS editor's save
+* POSTed the rules to `/schema-editor/collection/save` and stopped there: the
+* source changed, nothing said what the change implied, and the database was
+* left to a later `db push`. A policy declared and not enforced is the worst
+* outcome this editor can produce, and it was the default one.
+*
+* So a mapped-table write goes through the admin's plan/apply flow when there
+* is one. Studio cannot call `useLiveSchemaEditing` — `@rebasepro/cms` is a
+* *peer* of `@rebasepro/studio`, which has to run without it — so it arrives
+* over the Studio bridge as {@link StudioSchemaEditing}, and `available` is
+* false in the hosted console, where there is no source to edit and the direct
+* write is the only thing there is.
+*
+* A separate module from the component for the same reason `saveSecurityRules`
+* is: the decision can be asserted without a database and a rendered editor.
+*/
+async function saveRules(schemaEditing, transport, collectionId, securityRules) {
+	if (schemaEditing.available) {
+		await schemaEditing.updateCollection(collectionId, { securityRules });
+		return;
+	}
+	await saveSecurityRulesToCodebase({
+		apiBase: transport.apiBase,
+		collectionId,
+		securityRules,
+		getAuthToken: transport.getAuthToken
+	});
+}
+/**
+* Was this rejection the person closing the plan dialog?
+*
+* Closing it is an answer, not a failure, and a caller that treats every
+* rejection as an error reports someone's own choice back to them in red — as
+* the collection editor once did, with "Error persisting collection: The schema
+* change was not applied."
+*
+* Matched by name rather than `instanceof`: `SchemaChangeCancelled` is declared
+* in `@rebasepro/cms`, which this package cannot import, and two copies of a
+* class in one bundle make `instanceof` silently false anyway.
+*/
+function isCancellation(err) {
+	return err instanceof Error && err.name === "SchemaChangeCancelled";
+}
+//#endregion
 //#region src/components/RLSEditor/RLSEditor.tsx
 function classifyTableClient(tableName, schemaName, junctionTableNames, isMappedToCollection) {
 	if (REBASE_INTERNAL_SCHEMAS.includes(schemaName) || REBASE_INTERNAL_PREFIXES.some((prefix) => tableName.startsWith(prefix))) return "internal";
@@ -809,12 +858,85 @@ var RLSEditor = ({ apiUrl = "" }) => {
 	const { codebase: hasCodebase } = useStudioCapabilities();
 	const apiConfig = useApiConfig();
 	const apiBase = useApiBase() ?? `${apiUrl.replace(/\/+$/, "")}/api`;
-	const saveSecurityRules = useCallback((collectionId, securityRules) => saveSecurityRulesToCodebase({
+	const schemaEditing = useStudioSchemaEditing();
+	/** Through the plan/apply dialog when there is one — see `saveRules`. */
+	const saveSecurityRules = useCallback((collectionId, securityRules) => saveRules(schemaEditing, {
 		apiBase,
-		collectionId,
-		securityRules,
 		getAuthToken: apiConfig?.getAuthToken
-	}), [apiBase, apiConfig]);
+	}, collectionId, securityRules), [
+		apiBase,
+		apiConfig,
+		schemaEditing
+	]);
+	/** Closing the plan dialog is an answer, not a failure — see `saveRules`. */
+	const reportSaveFailure = useCallback((e) => {
+		if (isCancellation(e)) return;
+		snackbarController.open({
+			type: "error",
+			message: e instanceof Error ? e.message : String(e)
+		});
+	}, [snackbarController]);
+	const [editingPolicy, setEditingPolicy] = useState(null);
+	/**
+	* The two destructive actions used `window.confirm`, which is the browser's
+	* dialog and not this app's: it cannot be styled, cannot be translated, and
+	* is suppressed outright in a sandboxed iframe — where the click then did
+	* the thing silently, with no confirmation at all.
+	*/
+	const [confirmToggleRls, setConfirmToggleRls] = useState(null);
+	const [confirmDropPolicy, setConfirmDropPolicy] = useState(null);
+	const [confirming, setConfirming] = useState(false);
+	const applyToggleRls = useCallback(async () => {
+		if (!confirmToggleRls) return;
+		const { table, schema, enabled } = confirmToggleRls;
+		const action = enabled ? "DISABLE" : "ENABLE";
+		setConfirming(true);
+		try {
+			await databaseAdmin.executeSql(`ALTER TABLE ${sanitizeSqlIdentifier(schema)}.${sanitizeSqlIdentifier(table)} ${action} ROW LEVEL SECURITY`);
+			snackbarController.open({
+				type: "success",
+				message: `RLS ${action.toLowerCase()}d on ${table}`
+			});
+			setConfirmToggleRls(null);
+			fetchRLSData();
+		} catch (e) {
+			snackbarController.open({
+				type: "error",
+				message: e instanceof Error ? e.message : String(e)
+			});
+		} finally {
+			setConfirming(false);
+		}
+	}, [
+		confirmToggleRls,
+		databaseAdmin,
+		snackbarController
+	]);
+	const applyDropPolicy = useCallback(async () => {
+		if (!confirmDropPolicy) return;
+		const { policyName, table, schema } = confirmDropPolicy;
+		setConfirming(true);
+		try {
+			await databaseAdmin.executeSql(`DROP POLICY ${sanitizeSqlIdentifier(policyName)} ON ${sanitizeSqlIdentifier(schema)}.${sanitizeSqlIdentifier(table)}`);
+			snackbarController.open({
+				type: "success",
+				message: `Policy "${policyName}" dropped`
+			});
+			setConfirmDropPolicy(null);
+			fetchRLSData();
+		} catch (e) {
+			snackbarController.open({
+				type: "error",
+				message: e instanceof Error ? e.message : String(e)
+			});
+		} finally {
+			setConfirming(false);
+		}
+	}, [
+		confirmDropPolicy,
+		databaseAdmin,
+		snackbarController
+	]);
 	const { t } = useTranslation();
 	const [isLoading, setIsLoading] = useState(true);
 	const [error, setError] = useState(null);
@@ -822,7 +944,6 @@ var RLSEditor = ({ apiUrl = "" }) => {
 	const [selectedTable, setSelectedTable] = useState(null);
 	const [activeTab, setActiveTab] = useState(0);
 	const [junctionTableNames, setJunctionTableNames] = useState(/* @__PURE__ */ new Set());
-	const [editingPolicy, setEditingPolicy] = useState(null);
 	/**
 	* Native PostgreSQL roles, for the policy editor's `TO` list.
 	*
@@ -1052,372 +1173,382 @@ var RLSEditor = ({ apiUrl = "" }) => {
 			})]
 		});
 	};
-	return /* @__PURE__ */ jsx("div", {
+	return /* @__PURE__ */ jsxs("div", {
 		className: "flex h-full w-full bg-white dark:bg-surface-950 overflow-hidden text-text-primary dark:text-text-primary-dark",
-		children: /* @__PURE__ */ jsx(ResizablePanels, {
-			orientation: "horizontal",
-			panelSizePercent: sidebarSize,
-			onPanelSizeChange: setSidebarSize,
-			minPanelSizePx: 220,
-			firstPanel: /* @__PURE__ */ jsxs("div", {
-				className: cls("flex flex-col h-full w-full bg-white dark:bg-surface-950 border-r", defaultBorderMixin),
-				children: [/* @__PURE__ */ jsxs(Tabs, {
-					value: sidebarTab,
-					onValueChange: (v) => setSidebarTab(v),
-					variant: "boxy",
-					className: "border-b border-surface-200 dark:border-surface-950",
-					children: [/* @__PURE__ */ jsx(Tab, {
-						value: "tables",
-						children: "Tables"
-					}), /* @__PURE__ */ jsx(Tab, {
-						value: "info",
-						children: "Info"
-					})]
-				}), /* @__PURE__ */ jsxs("div", {
-					className: "flex-grow overflow-hidden relative",
-					children: [sidebarTab === "tables" && /* @__PURE__ */ jsxs("div", {
-						className: "flex flex-col h-full",
-						children: [/* @__PURE__ */ jsxs("div", {
-							className: cls("flex items-center justify-between px-3 py-2 border-b bg-surface-50 dark:bg-surface-900 min-h-[48px]", defaultBorderMixin),
-							children: [/* @__PURE__ */ jsx(Typography, {
-								variant: "caption",
-								className: "font-semibold uppercase tracking-wider text-text-disabled dark:text-text-disabled-dark",
-								children: t("studio_schema_tables")
-							}), /* @__PURE__ */ jsx(IconButton, {
-								size: "small",
-								onClick: fetchRLSData,
-								title: "Refresh",
-								children: /* @__PURE__ */ jsx(RefreshCwIcon, { size: iconSize.smallest })
-							})]
-						}), /* @__PURE__ */ jsx("div", {
-							className: "flex-grow overflow-y-auto no-scrollbar p-1",
-							children: isLoading && tables.length === 0 ? /* @__PURE__ */ jsx("div", {
-								className: "flex justify-center p-4",
-								children: /* @__PURE__ */ jsx(CircularProgress, { size: "small" })
-							}) : tables.length === 0 ? /* @__PURE__ */ jsx("div", {
-								className: "p-4 text-center",
-								children: /* @__PURE__ */ jsx(Typography, {
+		children: [
+			/* @__PURE__ */ jsx(ResizablePanels, {
+				orientation: "horizontal",
+				panelSizePercent: sidebarSize,
+				onPanelSizeChange: setSidebarSize,
+				minPanelSizePx: 220,
+				firstPanel: /* @__PURE__ */ jsxs("div", {
+					className: cls("flex flex-col h-full w-full bg-white dark:bg-surface-950 border-r", defaultBorderMixin),
+					children: [/* @__PURE__ */ jsxs(Tabs, {
+						value: sidebarTab,
+						onValueChange: (v) => setSidebarTab(v),
+						variant: "boxy",
+						className: "border-b border-surface-200 dark:border-surface-950",
+						children: [/* @__PURE__ */ jsx(Tab, {
+							value: "tables",
+							children: "Tables"
+						}), /* @__PURE__ */ jsx(Tab, {
+							value: "info",
+							children: "Info"
+						})]
+					}), /* @__PURE__ */ jsxs("div", {
+						className: "flex-grow overflow-hidden relative",
+						children: [sidebarTab === "tables" && /* @__PURE__ */ jsxs("div", {
+							className: "flex flex-col h-full",
+							children: [/* @__PURE__ */ jsxs("div", {
+								className: cls("flex items-center justify-between px-3 py-2 border-b bg-surface-50 dark:bg-surface-900 min-h-[48px]", defaultBorderMixin),
+								children: [/* @__PURE__ */ jsx(Typography, {
 									variant: "caption",
-									className: "text-text-disabled dark:text-text-disabled-dark italic",
-									children: t("studio_rls_no_tables")
-								})
-							}) : /* @__PURE__ */ jsxs(Fragment, { children: [
-								categorizedTables.collection.length > 0 && /* @__PURE__ */ jsx(SidebarSection, {
-									title: "Schema Collections",
-									icon: /* @__PURE__ */ jsx(DatabaseIcon, {
-										size: 12,
-										className: "text-primary dark:text-primary-light"
-									}),
-									expanded: expandedSections.collection ?? true,
-									onToggle: () => setExpandedSections((prev) => ({
-										...prev,
-										collection: !(prev.collection ?? true)
-									})),
-									children: categorizedTables.collection.map((table) => /* @__PURE__ */ jsx(SidebarTableRow, {
-										table,
-										isSelected: selectedTable === `${table.schemaName}.${table.tableName}`,
-										onSelect: () => setSelectedTable(`${table.schemaName}.${table.tableName}`),
-										t
-									}, `${table.schemaName}.${table.tableName}`))
-								}),
-								(categorizedTables.other.length > 0 || categorizedTables.junction.length > 0) && /* @__PURE__ */ jsxs(SidebarSection, {
-									title: "Other Tables",
-									icon: /* @__PURE__ */ jsx(AlertTriangleIcon, {
-										size: 12,
-										className: "text-yellow-500 dark:text-yellow-400"
+									className: "font-semibold uppercase tracking-wider text-text-disabled dark:text-text-disabled-dark",
+									children: t("studio_schema_tables")
+								}), /* @__PURE__ */ jsx(IconButton, {
+									size: "small",
+									onClick: fetchRLSData,
+									title: "Refresh",
+									children: /* @__PURE__ */ jsx(RefreshCwIcon, { size: iconSize.smallest })
+								})]
+							}), /* @__PURE__ */ jsx("div", {
+								className: "flex-grow overflow-y-auto no-scrollbar p-1",
+								children: isLoading && tables.length === 0 ? /* @__PURE__ */ jsx("div", {
+									className: "flex justify-center p-4",
+									children: /* @__PURE__ */ jsx(CircularProgress, { size: "small" })
+								}) : tables.length === 0 ? /* @__PURE__ */ jsx("div", {
+									className: "p-4 text-center",
+									children: /* @__PURE__ */ jsx(Typography, {
+										variant: "caption",
+										className: "text-text-disabled dark:text-text-disabled-dark italic",
+										children: t("studio_rls_no_tables")
+									})
+								}) : /* @__PURE__ */ jsxs(Fragment, { children: [
+									categorizedTables.collection.length > 0 && /* @__PURE__ */ jsx(SidebarSection, {
+										title: "Schema Collections",
+										icon: /* @__PURE__ */ jsx(DatabaseIcon, {
+											size: 12,
+											className: "text-primary dark:text-primary-light"
+										}),
+										expanded: expandedSections.collection ?? true,
+										onToggle: () => setExpandedSections((prev) => ({
+											...prev,
+											collection: !(prev.collection ?? true)
+										})),
+										children: categorizedTables.collection.map((table) => /* @__PURE__ */ jsx(SidebarTableRow, {
+											table,
+											isSelected: selectedTable === `${table.schemaName}.${table.tableName}`,
+											onSelect: () => setSelectedTable(`${table.schemaName}.${table.tableName}`),
+											t
+										}, `${table.schemaName}.${table.tableName}`))
 									}),
-									expanded: expandedSections.other ?? true,
-									onToggle: () => setExpandedSections((prev) => ({
-										...prev,
-										other: !(prev.other ?? true)
-									})),
-									children: [categorizedTables.other.map((table) => /* @__PURE__ */ jsx(SidebarTableRow, {
-										table,
-										isSelected: selectedTable === `${table.schemaName}.${table.tableName}`,
-										onSelect: () => setSelectedTable(`${table.schemaName}.${table.tableName}`),
-										t
-									}, `${table.schemaName}.${table.tableName}`)), categorizedTables.junction.map((table) => /* @__PURE__ */ jsx(SidebarTableRow, {
-										table,
-										isSelected: selectedTable === `${table.schemaName}.${table.tableName}`,
-										onSelect: () => setSelectedTable(`${table.schemaName}.${table.tableName}`),
-										badge: "Junction",
-										dimmed: true,
-										t
-									}, `${table.schemaName}.${table.tableName}`))]
-								}),
-								categorizedTables.internal.length > 0 && /* @__PURE__ */ jsx(SidebarSection, {
-									title: "Rebase Internal",
-									icon: /* @__PURE__ */ jsx(LockIcon, {
-										size: 12,
-										className: "text-text-disabled dark:text-text-disabled-dark"
+									(categorizedTables.other.length > 0 || categorizedTables.junction.length > 0) && /* @__PURE__ */ jsxs(SidebarSection, {
+										title: "Other Tables",
+										icon: /* @__PURE__ */ jsx(AlertTriangleIcon, {
+											size: 12,
+											className: "text-yellow-500 dark:text-yellow-400"
+										}),
+										expanded: expandedSections.other ?? true,
+										onToggle: () => setExpandedSections((prev) => ({
+											...prev,
+											other: !(prev.other ?? true)
+										})),
+										children: [categorizedTables.other.map((table) => /* @__PURE__ */ jsx(SidebarTableRow, {
+											table,
+											isSelected: selectedTable === `${table.schemaName}.${table.tableName}`,
+											onSelect: () => setSelectedTable(`${table.schemaName}.${table.tableName}`),
+											t
+										}, `${table.schemaName}.${table.tableName}`)), categorizedTables.junction.map((table) => /* @__PURE__ */ jsx(SidebarTableRow, {
+											table,
+											isSelected: selectedTable === `${table.schemaName}.${table.tableName}`,
+											onSelect: () => setSelectedTable(`${table.schemaName}.${table.tableName}`),
+											badge: "Junction",
+											dimmed: true,
+											t
+										}, `${table.schemaName}.${table.tableName}`))]
 									}),
-									expanded: expandedSections.internal ?? false,
-									onToggle: () => setExpandedSections((prev) => ({
-										...prev,
-										internal: !(prev.internal ?? false)
-									})),
-									count: categorizedTables.internal.length,
-									children: categorizedTables.internal.map((table) => /* @__PURE__ */ jsx(SidebarTableRow, {
-										table,
-										isSelected: selectedTable === `${table.schemaName}.${table.tableName}`,
-										onSelect: () => setSelectedTable(`${table.schemaName}.${table.tableName}`),
-										dimmed: true,
-										t
-									}, `${table.schemaName}.${table.tableName}`))
+									categorizedTables.internal.length > 0 && /* @__PURE__ */ jsx(SidebarSection, {
+										title: "Rebase Internal",
+										icon: /* @__PURE__ */ jsx(LockIcon, {
+											size: 12,
+											className: "text-text-disabled dark:text-text-disabled-dark"
+										}),
+										expanded: expandedSections.internal ?? false,
+										onToggle: () => setExpandedSections((prev) => ({
+											...prev,
+											internal: !(prev.internal ?? false)
+										})),
+										count: categorizedTables.internal.length,
+										children: categorizedTables.internal.map((table) => /* @__PURE__ */ jsx(SidebarTableRow, {
+											table,
+											isSelected: selectedTable === `${table.schemaName}.${table.tableName}`,
+											onSelect: () => setSelectedTable(`${table.schemaName}.${table.tableName}`),
+											dimmed: true,
+											t
+										}, `${table.schemaName}.${table.tableName}`))
+									})
+								] })
+							})]
+						}), sidebarTab === "info" && /* @__PURE__ */ jsxs("div", {
+							className: "flex flex-col h-full",
+							children: [/* @__PURE__ */ jsx("div", {
+								className: cls("flex items-center justify-between px-3 py-2 border-b bg-surface-50 dark:bg-surface-900 min-h-[48px]", defaultBorderMixin),
+								children: /* @__PURE__ */ jsx(Typography, {
+									variant: "caption",
+									className: "font-semibold uppercase tracking-wider text-text-disabled dark:text-text-disabled-dark",
+									children: "Overview"
 								})
-							] })
-						})]
-					}), sidebarTab === "info" && /* @__PURE__ */ jsxs("div", {
-						className: "flex flex-col h-full",
-						children: [/* @__PURE__ */ jsx("div", {
-							className: cls("flex items-center justify-between px-3 py-2 border-b bg-surface-50 dark:bg-surface-900 min-h-[48px]", defaultBorderMixin),
-							children: /* @__PURE__ */ jsx(Typography, {
-								variant: "caption",
-								className: "font-semibold uppercase tracking-wider text-text-disabled dark:text-text-disabled-dark",
-								children: "Overview"
-							})
-						}), /* @__PURE__ */ jsxs("div", {
-							className: "flex-grow overflow-y-auto p-3 space-y-3 no-scrollbar",
-							children: [
-								/* @__PURE__ */ jsxs("div", {
-									className: cls("p-3 rounded-lg border bg-white dark:bg-surface-900", defaultBorderMixin),
-									children: [/* @__PURE__ */ jsxs("div", {
-										className: "flex items-center gap-2 mb-2",
-										children: [/* @__PURE__ */ jsx(ShieldIcon, {
-											size: iconSize.smallest,
-											className: "text-primary"
-										}), /* @__PURE__ */ jsx(Typography, {
-											variant: "body2",
-											className: "font-semibold text-[13px]",
-											children: "RLS Studio"
-										})]
-									}), /* @__PURE__ */ jsx(Typography, {
-										variant: "caption",
-										className: "text-text-secondary dark:text-text-secondary-dark text-[11px] leading-relaxed block",
-										children: "Manage Row Level Security policies for your PostgreSQL tables. Enable RLS and create fine-grained access policies."
-									})]
-								}),
-								/* @__PURE__ */ jsxs("div", {
-									className: "space-y-2",
-									children: [
-										/* @__PURE__ */ jsxs("div", {
-											className: cls("p-2.5 rounded border bg-white dark:bg-surface-900 flex items-center justify-between", defaultBorderMixin),
-											children: [/* @__PURE__ */ jsx(Typography, {
-												variant: "caption",
-												className: "text-text-secondary dark:text-text-secondary-dark text-[11px]",
-												children: "Total tables"
+							}), /* @__PURE__ */ jsxs("div", {
+								className: "flex-grow overflow-y-auto p-3 space-y-3 no-scrollbar",
+								children: [
+									/* @__PURE__ */ jsxs("div", {
+										className: cls("p-3 rounded-lg border bg-white dark:bg-surface-900", defaultBorderMixin),
+										children: [/* @__PURE__ */ jsxs("div", {
+											className: "flex items-center gap-2 mb-2",
+											children: [/* @__PURE__ */ jsx(ShieldIcon, {
+												size: iconSize.smallest,
+												className: "text-primary"
 											}), /* @__PURE__ */ jsx(Typography, {
 												variant: "body2",
-												className: "font-mono text-[13px] font-medium",
-												children: rlsStats.total
+												className: "font-semibold text-[13px]",
+												children: "RLS Studio"
 											})]
-										}),
-										/* @__PURE__ */ jsxs("div", {
-											className: cls("p-2.5 rounded border bg-white dark:bg-surface-900 flex items-center justify-between", defaultBorderMixin),
-											children: [/* @__PURE__ */ jsx(Typography, {
-												variant: "caption",
-												className: "text-text-secondary dark:text-text-secondary-dark text-[11px]",
-												children: "RLS enabled"
-											}), /* @__PURE__ */ jsxs("div", {
-												className: "flex items-center gap-1.5",
-												children: [/* @__PURE__ */ jsx("div", { className: "w-1.5 h-1.5 rounded-full bg-green-500" }), /* @__PURE__ */ jsx(Typography, {
+										}), /* @__PURE__ */ jsx(Typography, {
+											variant: "caption",
+											className: "text-text-secondary dark:text-text-secondary-dark text-[11px] leading-relaxed block",
+											children: "Manage Row Level Security policies for your PostgreSQL tables. Enable RLS and create fine-grained access policies."
+										})]
+									}),
+									/* @__PURE__ */ jsxs("div", {
+										className: "space-y-2",
+										children: [
+											/* @__PURE__ */ jsxs("div", {
+												className: cls("p-2.5 rounded border bg-white dark:bg-surface-900 flex items-center justify-between", defaultBorderMixin),
+												children: [/* @__PURE__ */ jsx(Typography, {
+													variant: "caption",
+													className: "text-text-secondary dark:text-text-secondary-dark text-[11px]",
+													children: "Total tables"
+												}), /* @__PURE__ */ jsx(Typography, {
 													variant: "body2",
 													className: "font-mono text-[13px] font-medium",
-													children: rlsStats.enabled
+													children: rlsStats.total
 												})]
-											})]
-										}),
-										/* @__PURE__ */ jsxs("div", {
-											className: cls("p-2.5 rounded border bg-white dark:bg-surface-900 flex items-center justify-between", defaultBorderMixin),
-											children: [/* @__PURE__ */ jsx(Typography, {
-												variant: "caption",
-												className: "text-text-secondary dark:text-text-secondary-dark text-[11px]",
-												children: "Tables with policies"
-											}), /* @__PURE__ */ jsx(Typography, {
-												variant: "body2",
-												className: "font-mono text-[13px] font-medium",
-												children: rlsStats.withPolicies
-											})]
-										}),
-										/* @__PURE__ */ jsxs("div", {
-											className: cls("p-2.5 rounded border bg-white dark:bg-surface-900 flex items-center justify-between", defaultBorderMixin),
-											children: [/* @__PURE__ */ jsx(Typography, {
-												variant: "caption",
-												className: "text-text-secondary dark:text-text-secondary-dark text-[11px]",
-												children: "Total policies"
-											}), /* @__PURE__ */ jsx(Typography, {
-												variant: "body2",
-												className: "font-mono text-[13px] font-medium",
-												children: rlsStats.totalPolicies
-											})]
-										})
-									]
-								}),
-								rlsStats.total - rlsStats.enabled > 0 && /* @__PURE__ */ jsxs("div", {
-									className: cls("p-2.5 rounded border border-yellow-200 dark:border-yellow-900/50 bg-yellow-50 dark:bg-yellow-900/20 flex items-start gap-2", defaultBorderMixin),
-									children: [/* @__PURE__ */ jsx(AlertTriangleIcon, {
-										size: 14,
-										className: "text-yellow-600 dark:text-yellow-500 mt-0.5 shrink-0"
-									}), /* @__PURE__ */ jsxs("div", { children: [/* @__PURE__ */ jsxs(Typography, {
-										variant: "caption",
-										className: "text-yellow-800 dark:text-yellow-400 text-[11px] font-semibold block",
-										children: [
-											rlsStats.total - rlsStats.enabled,
-											" table",
-											rlsStats.total - rlsStats.enabled > 1 ? "s" : "",
-											" without RLS"
-										]
-									}), /* @__PURE__ */ jsx(Typography, {
-										variant: "caption",
-										className: "text-yellow-700 dark:text-yellow-600 text-[10px] block mt-0.5",
-										children: "These tables have no row-level access control. If auth enforcement is disabled, data may be publicly accessible."
-									})] })]
-								}),
-								rlsStats.enabled > 0 && rlsStats.enabled - rlsStats.withPolicies > 0 && /* @__PURE__ */ jsxs("div", {
-									className: cls("p-2.5 rounded border border-blue-200 dark:border-blue-900/50 bg-blue-50 dark:bg-blue-900/20 flex items-start gap-2", defaultBorderMixin),
-									children: [/* @__PURE__ */ jsx(ShieldIcon, {
-										size: 14,
-										className: "text-blue-600 dark:text-blue-400 mt-0.5 shrink-0"
-									}), /* @__PURE__ */ jsxs("div", { children: [/* @__PURE__ */ jsxs(Typography, {
-										variant: "caption",
-										className: "text-blue-800 dark:text-blue-300 text-[11px] font-semibold block",
-										children: [
-											rlsStats.enabled - rlsStats.withPolicies,
-											" table",
-											rlsStats.enabled - rlsStats.withPolicies > 1 ? "s" : "",
-											" with RLS but no policies"
+											}),
+											/* @__PURE__ */ jsxs("div", {
+												className: cls("p-2.5 rounded border bg-white dark:bg-surface-900 flex items-center justify-between", defaultBorderMixin),
+												children: [/* @__PURE__ */ jsx(Typography, {
+													variant: "caption",
+													className: "text-text-secondary dark:text-text-secondary-dark text-[11px]",
+													children: "RLS enabled"
+												}), /* @__PURE__ */ jsxs("div", {
+													className: "flex items-center gap-1.5",
+													children: [/* @__PURE__ */ jsx("div", { className: "w-1.5 h-1.5 rounded-full bg-green-500" }), /* @__PURE__ */ jsx(Typography, {
+														variant: "body2",
+														className: "font-mono text-[13px] font-medium",
+														children: rlsStats.enabled
+													})]
+												})]
+											}),
+											/* @__PURE__ */ jsxs("div", {
+												className: cls("p-2.5 rounded border bg-white dark:bg-surface-900 flex items-center justify-between", defaultBorderMixin),
+												children: [/* @__PURE__ */ jsx(Typography, {
+													variant: "caption",
+													className: "text-text-secondary dark:text-text-secondary-dark text-[11px]",
+													children: "Tables with policies"
+												}), /* @__PURE__ */ jsx(Typography, {
+													variant: "body2",
+													className: "font-mono text-[13px] font-medium",
+													children: rlsStats.withPolicies
+												})]
+											}),
+											/* @__PURE__ */ jsxs("div", {
+												className: cls("p-2.5 rounded border bg-white dark:bg-surface-900 flex items-center justify-between", defaultBorderMixin),
+												children: [/* @__PURE__ */ jsx(Typography, {
+													variant: "caption",
+													className: "text-text-secondary dark:text-text-secondary-dark text-[11px]",
+													children: "Total policies"
+												}), /* @__PURE__ */ jsx(Typography, {
+													variant: "body2",
+													className: "font-mono text-[13px] font-medium",
+													children: rlsStats.totalPolicies
+												})]
+											})
 										]
-									}), /* @__PURE__ */ jsx(Typography, {
-										variant: "caption",
-										className: "text-blue-700 dark:text-blue-500 text-[10px] block mt-0.5",
-										children: "RLS is enabled but no permissive policies exist. All access is denied by default (Postgres deny-all)."
-									})] })]
-								})
-							]
+									}),
+									rlsStats.total - rlsStats.enabled > 0 && /* @__PURE__ */ jsxs("div", {
+										className: cls("p-2.5 rounded border border-yellow-200 dark:border-yellow-900/50 bg-yellow-50 dark:bg-yellow-900/20 flex items-start gap-2", defaultBorderMixin),
+										children: [/* @__PURE__ */ jsx(AlertTriangleIcon, {
+											size: 14,
+											className: "text-yellow-600 dark:text-yellow-500 mt-0.5 shrink-0"
+										}), /* @__PURE__ */ jsxs("div", { children: [/* @__PURE__ */ jsxs(Typography, {
+											variant: "caption",
+											className: "text-yellow-800 dark:text-yellow-400 text-[11px] font-semibold block",
+											children: [
+												rlsStats.total - rlsStats.enabled,
+												" table",
+												rlsStats.total - rlsStats.enabled > 1 ? "s" : "",
+												" without RLS"
+											]
+										}), /* @__PURE__ */ jsx(Typography, {
+											variant: "caption",
+											className: "text-yellow-700 dark:text-yellow-600 text-[10px] block mt-0.5",
+											children: "These tables have no row-level access control. If auth enforcement is disabled, data may be publicly accessible."
+										})] })]
+									}),
+									rlsStats.enabled > 0 && rlsStats.enabled - rlsStats.withPolicies > 0 && /* @__PURE__ */ jsxs("div", {
+										className: cls("p-2.5 rounded border border-blue-200 dark:border-blue-900/50 bg-blue-50 dark:bg-blue-900/20 flex items-start gap-2", defaultBorderMixin),
+										children: [/* @__PURE__ */ jsx(ShieldIcon, {
+											size: 14,
+											className: "text-blue-600 dark:text-blue-400 mt-0.5 shrink-0"
+										}), /* @__PURE__ */ jsxs("div", { children: [/* @__PURE__ */ jsxs(Typography, {
+											variant: "caption",
+											className: "text-blue-800 dark:text-blue-300 text-[11px] font-semibold block",
+											children: [
+												rlsStats.enabled - rlsStats.withPolicies,
+												" table",
+												rlsStats.enabled - rlsStats.withPolicies > 1 ? "s" : "",
+												" with RLS but no policies"
+											]
+										}), /* @__PURE__ */ jsx(Typography, {
+											variant: "caption",
+											className: "text-blue-700 dark:text-blue-500 text-[10px] block mt-0.5",
+											children: "RLS is enabled but no permissive policies exist. All access is denied by default (Postgres deny-all)."
+										})] })]
+									})
+								]
+							})]
 						})]
 					})]
-				})]
-			}),
-			secondPanel: /* @__PURE__ */ jsxs("div", {
-				className: "flex-grow flex flex-col min-w-0 h-full w-full bg-white dark:bg-surface-950",
-				children: [/* @__PURE__ */ jsxs("div", {
-					className: cls("flex items-center justify-between pr-2 border-b bg-white dark:bg-surface-950 min-h-[46px]", defaultBorderMixin),
+				}),
+				secondPanel: /* @__PURE__ */ jsxs("div", {
+					className: "flex-grow flex flex-col min-w-0 h-full w-full bg-white dark:bg-surface-950",
 					children: [/* @__PURE__ */ jsxs("div", {
-						className: "flex items-center flex-grow overflow-hidden px-4",
-						children: [/* @__PURE__ */ jsx(Typography, {
-							variant: "subtitle2",
-							className: "font-mono text-text-secondary dark:text-text-secondary-dark truncate",
-							children: activeTableData ? `${activeTableData.schemaName}.${activeTableData.tableName}` : t("studio_rls_select_table")
-						}), activeTableData && /* @__PURE__ */ jsx("div", {
-							className: "ml-3",
-							children: activeTableData.rlsEnabled ? /* @__PURE__ */ jsx(Chip, {
-								size: "smallest",
-								className: "bg-green-100 text-green-800 dark:bg-green-900/30 dark:text-green-400 border-green-200 dark:border-green-800",
-								children: t("studio_rls_enabled")
-							}) : /* @__PURE__ */ jsx(Chip, {
-								size: "smallest",
-								className: "bg-yellow-100 text-yellow-800 dark:bg-yellow-900/30 dark:text-yellow-400 border-yellow-200 dark:border-yellow-800",
-								children: t("studio_rls_disabled")
-							})
-						})]
-					}), /* @__PURE__ */ jsx("div", {
-						className: "flex shrink-0 items-center justify-end gap-1.5",
-						children: activeTableData && /* @__PURE__ */ jsxs(Fragment, { children: [
-							/* @__PURE__ */ jsx(Button, {
-								variant: "text",
-								size: "small",
-								onClick: async () => {
-									const table = activeTableData.tableName;
-									const qualifiedTable = `${sanitizeSqlIdentifier(activeTableData.schemaName)}.${sanitizeSqlIdentifier(table)}`;
-									const action = activeTableData.rlsEnabled ? "DISABLE" : "ENABLE";
-									if (!confirm(`Are you sure you want to ${action.toLowerCase()} Row Level Security on "${table}"?`)) return;
-									try {
-										await databaseAdmin.executeSql(`ALTER TABLE ${qualifiedTable} ${action} ROW LEVEL SECURITY`);
-										snackbarController.open({
-											type: "success",
-											message: `RLS ${action.toLowerCase()}d on ${table}`
-										});
-										fetchRLSData();
-									} catch (e) {
-										snackbarController.open({
-											type: "error",
-											message: e instanceof Error ? e.message : String(e)
-										});
-									}
-								},
-								children: activeTableData.rlsEnabled ? t("studio_rls_disable_rls") : t("studio_rls_enable_rls")
-							}),
-							/* @__PURE__ */ jsx("div", { className: "h-4 w-px bg-surface-200 dark:bg-surface-950 mx-1" }),
-							/* @__PURE__ */ jsx(Button, {
-								variant: "text",
-								size: "small",
-								onClick: fetchRLSData,
-								startIcon: /* @__PURE__ */ jsx(RefreshCwIcon, { size: iconSize.smallest }),
-								children: "Refresh"
-							}),
-							/* @__PURE__ */ jsx("div", { className: "h-4 w-px bg-surface-200 dark:bg-surface-950 mx-1" }),
-							/* @__PURE__ */ jsx(Button, {
-								size: "small",
-								color: "primary",
-								onClick: () => setEditingPolicy("new"),
-								children: t("studio_rls_create_policy")
-							})
-						] })
-					})]
-				}), isLoading && !activeTableData ? /* @__PURE__ */ jsx("div", {
-					className: "flex-grow flex items-center justify-center h-full",
-					children: /* @__PURE__ */ jsx(CircularProgress, { size: "small" })
-				}) : error ? /* @__PURE__ */ jsx("div", {
-					className: "p-6 h-full flex items-center justify-center",
-					children: /* @__PURE__ */ jsx(ErrorView, {
-						title: t("studio_rls_error"),
-						error,
-						onRetry: fetchRLSData
-					})
-				}) : !activeTableData ? /* @__PURE__ */ jsx("div", {
-					className: "flex-grow flex items-center justify-center text-text-disabled h-full",
-					children: /* @__PURE__ */ jsxs("div", {
-						className: "text-center",
-						children: [/* @__PURE__ */ jsx("svg", {
-							className: "w-12 h-12 mx-auto mb-4 opacity-50",
-							fill: "none",
-							stroke: "currentColor",
-							viewBox: "0 0 24 24",
-							children: /* @__PURE__ */ jsx("path", {
-								strokeLinecap: "round",
-								strokeLinejoin: "round",
-								strokeWidth: 1,
-								d: "M12 15v2m-6 4h12a2 2 0 002-2v-6a2 2 0 00-2-2H6a2 2 0 00-2 2v6a2 2 0 002 2zm10-10V7a4 4 0 00-8 0v4h8z"
-							})
-						}), /* @__PURE__ */ jsx(Typography, {
-							variant: "body2",
-							children: t("studio_rls_select_table")
+						className: cls("flex items-center justify-between pr-2 border-b bg-white dark:bg-surface-950 min-h-[46px]", defaultBorderMixin),
+						children: [/* @__PURE__ */ jsxs("div", {
+							className: "flex items-center flex-grow overflow-hidden px-4",
+							children: [/* @__PURE__ */ jsx(Typography, {
+								variant: "subtitle2",
+								className: "font-mono text-text-secondary dark:text-text-secondary-dark truncate",
+								children: activeTableData ? `${activeTableData.schemaName}.${activeTableData.tableName}` : t("studio_rls_select_table")
+							}), activeTableData && /* @__PURE__ */ jsx("div", {
+								className: "ml-3",
+								children: activeTableData.rlsEnabled ? /* @__PURE__ */ jsx(Chip, {
+									size: "smallest",
+									className: "bg-green-100 text-green-800 dark:bg-green-900/30 dark:text-green-400 border-green-200 dark:border-green-800",
+									children: t("studio_rls_enabled")
+								}) : /* @__PURE__ */ jsx(Chip, {
+									size: "smallest",
+									className: "bg-yellow-100 text-yellow-800 dark:bg-yellow-900/30 dark:text-yellow-400 border-yellow-200 dark:border-yellow-800",
+									children: t("studio_rls_disabled")
+								})
+							})]
+						}), /* @__PURE__ */ jsx("div", {
+							className: "flex shrink-0 items-center justify-end gap-1.5",
+							children: activeTableData && /* @__PURE__ */ jsxs(Fragment, { children: [
+								/* @__PURE__ */ jsx(Button, {
+									variant: "text",
+									size: "small",
+									onClick: () => setConfirmToggleRls({
+										table: activeTableData.tableName,
+										schema: activeTableData.schemaName,
+										enabled: activeTableData.rlsEnabled
+									}),
+									children: activeTableData.rlsEnabled ? t("studio_rls_disable_rls") : t("studio_rls_enable_rls")
+								}),
+								/* @__PURE__ */ jsx("div", { className: "h-4 w-px bg-surface-200 dark:bg-surface-950 mx-1" }),
+								/* @__PURE__ */ jsx(Button, {
+									variant: "text",
+									size: "small",
+									onClick: fetchRLSData,
+									startIcon: /* @__PURE__ */ jsx(RefreshCwIcon, { size: iconSize.smallest }),
+									children: "Refresh"
+								}),
+								/* @__PURE__ */ jsx("div", { className: "h-4 w-px bg-surface-200 dark:bg-surface-950 mx-1" }),
+								/* @__PURE__ */ jsx(Button, {
+									size: "small",
+									color: "primary",
+									onClick: () => setEditingPolicy("new"),
+									children: t("studio_rls_create_policy")
+								})
+							] })
 						})]
-					})
-				}) : editingPolicy ? /* @__PURE__ */ jsx(PolicyEditor, {
-					policy: editingPolicy === "new" ? void 0 : editingPolicy,
-					schema: activeTableData.schemaName,
-					table: activeTableData.tableName,
-					roleOptions: pgRoleOptions,
-					onSave: async (newPolicy) => {
-						if (activeCollection && hasCodebase) {
-							const rule = {
-								name: newPolicy.policyname,
-								operation: newPolicy.cmd?.toLowerCase(),
-								mode: newPolicy.permissive?.toLowerCase(),
-								using: newPolicy.qual || void 0,
-								withCheck: newPolicy.with_check || void 0,
-								...newPolicy.roles && !(newPolicy.roles.length === 1 && newPolicy.roles[0] === "public") ? { pgRoles: newPolicy.roles } : {}
-							};
-							const existingRules = (isPostgresCollectionConfig(activeCollection) ? activeCollection.securityRules : void 0) || [];
-							let newRules;
-							if (editingPolicy === "new") newRules = [...existingRules, rule];
-							else newRules = existingRules.map((r) => r.name === editingPolicy.policyname ? rule : r);
-							try {
-								await saveSecurityRules(activeCollection.id || activeCollection.path || activeCollection.alias || activeTableData.tableName, newRules);
+					}), isLoading && !activeTableData ? /* @__PURE__ */ jsx("div", {
+						className: "flex-grow flex items-center justify-center h-full",
+						children: /* @__PURE__ */ jsx(CircularProgress, { size: "small" })
+					}) : error ? /* @__PURE__ */ jsx("div", {
+						className: "p-6 h-full flex items-center justify-center",
+						children: /* @__PURE__ */ jsx(ErrorView, {
+							title: t("studio_rls_error"),
+							error,
+							onRetry: fetchRLSData
+						})
+					}) : !activeTableData ? /* @__PURE__ */ jsx("div", {
+						className: "flex-grow flex items-center justify-center text-text-disabled h-full",
+						children: /* @__PURE__ */ jsxs("div", {
+							className: "text-center",
+							children: [/* @__PURE__ */ jsx("svg", {
+								className: "w-12 h-12 mx-auto mb-4 opacity-50",
+								fill: "none",
+								stroke: "currentColor",
+								viewBox: "0 0 24 24",
+								children: /* @__PURE__ */ jsx("path", {
+									strokeLinecap: "round",
+									strokeLinejoin: "round",
+									strokeWidth: 1,
+									d: "M12 15v2m-6 4h12a2 2 0 002-2v-6a2 2 0 00-2-2H6a2 2 0 00-2 2v6a2 2 0 002 2zm10-10V7a4 4 0 00-8 0v4h8z"
+								})
+							}), /* @__PURE__ */ jsx(Typography, {
+								variant: "body2",
+								children: t("studio_rls_select_table")
+							})]
+						})
+					}) : editingPolicy ? /* @__PURE__ */ jsx(PolicyEditor, {
+						policy: editingPolicy === "new" ? void 0 : editingPolicy,
+						schema: activeTableData.schemaName,
+						table: activeTableData.tableName,
+						roleOptions: pgRoleOptions,
+						onSave: async (newPolicy) => {
+							if (activeCollection && hasCodebase) {
+								const rule = {
+									name: newPolicy.policyname,
+									operation: newPolicy.cmd?.toLowerCase(),
+									mode: newPolicy.permissive?.toLowerCase(),
+									using: newPolicy.qual || void 0,
+									withCheck: newPolicy.with_check || void 0,
+									...newPolicy.roles && !(newPolicy.roles.length === 1 && newPolicy.roles[0] === "public") ? { pgRoles: newPolicy.roles } : {}
+								};
+								const existingRules = (isPostgresCollectionConfig(activeCollection) ? activeCollection.securityRules : void 0) || [];
+								let newRules;
+								if (editingPolicy === "new") newRules = [...existingRules, rule];
+								else newRules = existingRules.map((r) => r.name === editingPolicy.policyname ? rule : r);
+								try {
+									await saveSecurityRules(activeCollection.id || activeCollection.path || activeCollection.alias || activeTableData.tableName, newRules);
+									snackbarController.open({
+										type: "success",
+										message: "Policy saved successfully"
+									});
+									setEditingPolicy(null);
+									fetchRLSData();
+								} catch (e) {
+									reportSaveFailure(e);
+								}
+							} else try {
+								const qualifiedTable = `${sanitizeSqlIdentifier(activeTableData.schemaName)}.${sanitizeSqlIdentifier(activeTableData.tableName)}`;
+								const policyName = sanitizeSqlIdentifier(newPolicy.policyname || "unnamed_policy");
+								const cmd = newPolicy.cmd || "ALL";
+								const permissive = (newPolicy.permissive || "PERMISSIVE") === "PERMISSIVE" ? "PERMISSIVE" : "RESTRICTIVE";
+								const roles = newPolicy.roles && newPolicy.roles.length > 0 ? newPolicy.roles.map((r) => sanitizeSqlIdentifier(r)).join(", ") : "public";
+								if (editingPolicy !== "new") await databaseAdmin.executeSql(`DROP POLICY IF EXISTS ${policyName} ON ${qualifiedTable}`);
+								let sql = `CREATE POLICY ${policyName} ON ${qualifiedTable}`;
+								sql += ` AS ${permissive}`;
+								sql += ` FOR ${cmd}`;
+								sql += ` TO ${roles}`;
+								if (newPolicy.qual) sql += ` USING (${newPolicy.qual})`;
+								if (newPolicy.with_check) sql += ` WITH CHECK (${newPolicy.with_check})`;
+								await databaseAdmin.executeSql(sql);
 								snackbarController.open({
 									type: "success",
-									message: "Policy saved successfully"
+									message: `Policy "${newPolicy.policyname}" applied to the database`
 								});
 								setEditingPolicy(null);
 								fetchRLSData();
@@ -1427,286 +1558,264 @@ var RLSEditor = ({ apiUrl = "" }) => {
 									message: e instanceof Error ? e.message : String(e)
 								});
 							}
-						} else try {
-							const qualifiedTable = `${sanitizeSqlIdentifier(activeTableData.schemaName)}.${sanitizeSqlIdentifier(activeTableData.tableName)}`;
-							const policyName = sanitizeSqlIdentifier(newPolicy.policyname || "unnamed_policy");
-							const cmd = newPolicy.cmd || "ALL";
-							const permissive = (newPolicy.permissive || "PERMISSIVE") === "PERMISSIVE" ? "PERMISSIVE" : "RESTRICTIVE";
-							const roles = newPolicy.roles && newPolicy.roles.length > 0 ? newPolicy.roles.map((r) => sanitizeSqlIdentifier(r)).join(", ") : "public";
-							if (editingPolicy !== "new") await databaseAdmin.executeSql(`DROP POLICY IF EXISTS ${policyName} ON ${qualifiedTable}`);
-							let sql = `CREATE POLICY ${policyName} ON ${qualifiedTable}`;
-							sql += ` AS ${permissive}`;
-							sql += ` FOR ${cmd}`;
-							sql += ` TO ${roles}`;
-							if (newPolicy.qual) sql += ` USING (${newPolicy.qual})`;
-							if (newPolicy.with_check) sql += ` WITH CHECK (${newPolicy.with_check})`;
-							await databaseAdmin.executeSql(sql);
-							snackbarController.open({
-								type: "success",
-								message: `Policy "${newPolicy.policyname}" applied to the database`
-							});
-							setEditingPolicy(null);
-							fetchRLSData();
-						} catch (e) {
-							snackbarController.open({
-								type: "error",
-								message: e instanceof Error ? e.message : String(e)
-							});
-						}
-					},
-					onCancel: () => setEditingPolicy(null)
-				}) : /* @__PURE__ */ jsx("div", {
-					className: "flex-grow flex flex-col overflow-hidden",
-					children: /* @__PURE__ */ jsx("div", {
-						className: "p-6 pt-4 flex-grow overflow-auto bg-surface-50 dark:bg-surface-900",
-						children: /* @__PURE__ */ jsxs("div", {
-							className: "max-w-4xl mx-auto flex flex-col gap-6",
-							children: [
-								activeTableData && activeTableCategory === "internal" && /* @__PURE__ */ jsx(Alert, {
-									color: "info",
-									children: /* @__PURE__ */ jsxs("div", {
-										className: "flex items-start gap-2",
-										children: [/* @__PURE__ */ jsx(LockIcon, {
-											size: 16,
-											className: "shrink-0 mt-0.5"
-										}), /* @__PURE__ */ jsxs("div", { children: [/* @__PURE__ */ jsx(Typography, {
-											variant: "body2",
-											className: "mb-1 font-semibold",
-											children: "Rebase System Table"
-										}), /* @__PURE__ */ jsx(Typography, {
-											variant: "caption",
-											className: "opacity-80",
-											children: "This table is managed internally by Rebase. Its security policies are configured automatically. Editing policies on system tables is an advanced operation."
-										})] })]
-									})
-								}),
-								activeTableData && activeTableCategory === "junction" && /* @__PURE__ */ jsx(Alert, {
-									color: "info",
-									children: /* @__PURE__ */ jsxs("div", {
-										className: "flex items-start gap-2",
-										children: [/* @__PURE__ */ jsx(Link2Icon, {
-											size: 16,
-											className: "shrink-0 mt-0.5"
-										}), /* @__PURE__ */ jsxs("div", { children: [/* @__PURE__ */ jsx(Typography, {
-											variant: "body2",
-											className: "mb-1 font-semibold",
-											children: "Junction Table"
-										}), /* @__PURE__ */ jsx(Typography, {
-											variant: "caption",
-											className: "opacity-80",
-											children: "This is an auto-generated junction table for a many-to-many relation. Rebase derives its policies: rows are readable when both related rows are, and writable following the declaring collection's update rules (plus the server/admin baseline). You can still add RLS policies directly to broaden access."
-										})] })]
-									})
-								}),
-								activeTableData && activeTableCategory === "other" && /* @__PURE__ */ jsx(Alert, {
-									color: "warning",
-									children: /* @__PURE__ */ jsxs("div", {
-										className: "flex items-start gap-2",
-										children: [/* @__PURE__ */ jsx(AlertTriangleIcon, {
-											size: 16,
-											className: "shrink-0 mt-0.5"
-										}), /* @__PURE__ */ jsxs("div", { children: [/* @__PURE__ */ jsx(Typography, {
-											variant: "body2",
-											className: "mb-1 font-semibold",
-											children: "Unmapped Table"
-										}), /* @__PURE__ */ jsx(Typography, {
-											variant: "caption",
-											className: "opacity-80",
-											children: "This table exists in the database but isn't mapped to a collection definition. Import it into a Schema configuration file to manage security policies visually."
-										})] })]
-									})
-								}),
-								activeTableData && !activeTableData.rlsEnabled && /* @__PURE__ */ jsxs("div", {
-									className: cls("p-4 sm:p-5 bg-yellow-50 dark:bg-yellow-900/20 border border-yellow-200 dark:border-yellow-900/50 rounded-lg flex flex-col sm:flex-row gap-4 items-start sm:items-center justify-between", defaultBorderMixin),
-									children: [/* @__PURE__ */ jsxs("div", {
-										className: "flex gap-3 items-start",
-										children: [/* @__PURE__ */ jsx("div", {
-											className: "mt-1 bg-yellow-100 dark:bg-yellow-900/50 p-1.5 rounded-md shrink-0 flex items-center justify-center",
-											children: /* @__PURE__ */ jsx(AlertTriangleIcon, { size: iconSize.smallest })
-										}), /* @__PURE__ */ jsxs("div", { children: [/* @__PURE__ */ jsx(Typography, {
-											variant: "subtitle2",
-											className: "text-yellow-800 dark:text-yellow-500",
-											children: "Row Level Security (RLS) is disabled"
-										}), /* @__PURE__ */ jsx(Typography, {
-											variant: "body2",
-											className: "text-yellow-700 dark:text-yellow-600/90 mt-1 max-w-2xl",
-											children: "Your table is completely readable and writable by anyone with access privileges. Enable RLS to create policies that restrict access to specific rows."
-										})] })]
-									}), /* @__PURE__ */ jsx(Button, {
-										size: "medium",
-										variant: "filled",
-										color: "neutral",
-										onClick: () => setEditingPolicy("new"),
-										className: "shrink-0 whitespace-nowrap",
-										disabled: !activeCollection,
-										children: t("studio_rls_create_policy")
-									})]
-								}),
-								activeTableData && mergedPolicies && mergedPolicies.length > 0 && /* @__PURE__ */ jsxs("div", {
-									className: "flex flex-col gap-3",
-									children: [/* @__PURE__ */ jsx(Typography, {
-										variant: "subtitle2",
-										className: "text-text-secondary dark:text-text-secondary-dark uppercase tracking-wider mb-1",
-										children: t("studio_rls_policies")
-									}), mergedPolicies.map((policy) => /* @__PURE__ */ jsxs(Paper, {
-										className: cls("p-3 sm:px-4 sm:py-3 flex flex-col sm:flex-row sm:items-center justify-between gap-4 border rounded-lg", defaultBorderMixin),
+						},
+						onCancel: () => setEditingPolicy(null)
+					}) : /* @__PURE__ */ jsx("div", {
+						className: "flex-grow flex flex-col overflow-hidden",
+						children: /* @__PURE__ */ jsx("div", {
+							className: "p-6 pt-4 flex-grow overflow-auto bg-surface-50 dark:bg-surface-900",
+							children: /* @__PURE__ */ jsxs("div", {
+								className: "max-w-4xl mx-auto flex flex-col gap-6",
+								children: [
+									activeTableData && activeTableCategory === "internal" && /* @__PURE__ */ jsx(Alert, {
+										color: "info",
+										children: /* @__PURE__ */ jsxs("div", {
+											className: "flex items-start gap-2",
+											children: [/* @__PURE__ */ jsx(LockIcon, {
+												size: 16,
+												className: "shrink-0 mt-0.5"
+											}), /* @__PURE__ */ jsxs("div", { children: [/* @__PURE__ */ jsx(Typography, {
+												variant: "body2",
+												className: "mb-1 font-semibold",
+												children: "Rebase System Table"
+											}), /* @__PURE__ */ jsx(Typography, {
+												variant: "caption",
+												className: "opacity-80",
+												children: "This table is managed internally by Rebase. Its security policies are configured automatically. Editing policies on system tables is an advanced operation."
+											})] })]
+										})
+									}),
+									activeTableData && activeTableCategory === "junction" && /* @__PURE__ */ jsx(Alert, {
+										color: "info",
+										children: /* @__PURE__ */ jsxs("div", {
+											className: "flex items-start gap-2",
+											children: [/* @__PURE__ */ jsx(Link2Icon, {
+												size: 16,
+												className: "shrink-0 mt-0.5"
+											}), /* @__PURE__ */ jsxs("div", { children: [/* @__PURE__ */ jsx(Typography, {
+												variant: "body2",
+												className: "mb-1 font-semibold",
+												children: "Junction Table"
+											}), /* @__PURE__ */ jsx(Typography, {
+												variant: "caption",
+												className: "opacity-80",
+												children: "This is an auto-generated junction table for a many-to-many relation. Rebase derives its policies: rows are readable when both related rows are, and writable following the declaring collection's update rules (plus the server/admin baseline). You can still add RLS policies directly to broaden access."
+											})] })]
+										})
+									}),
+									activeTableData && activeTableCategory === "other" && /* @__PURE__ */ jsx(Alert, {
+										color: "warning",
+										children: /* @__PURE__ */ jsxs("div", {
+											className: "flex items-start gap-2",
+											children: [/* @__PURE__ */ jsx(AlertTriangleIcon, {
+												size: 16,
+												className: "shrink-0 mt-0.5"
+											}), /* @__PURE__ */ jsxs("div", { children: [/* @__PURE__ */ jsx(Typography, {
+												variant: "body2",
+												className: "mb-1 font-semibold",
+												children: "Unmapped Table"
+											}), /* @__PURE__ */ jsx(Typography, {
+												variant: "caption",
+												className: "opacity-80",
+												children: "This table exists in the database but isn't mapped to a collection definition. Import it into a Schema configuration file to manage security policies visually."
+											})] })]
+										})
+									}),
+									activeTableData && !activeTableData.rlsEnabled && /* @__PURE__ */ jsxs("div", {
+										className: cls("p-4 sm:p-5 bg-yellow-50 dark:bg-yellow-900/20 border border-yellow-200 dark:border-yellow-900/50 rounded-lg flex flex-col sm:flex-row gap-4 items-start sm:items-center justify-between", defaultBorderMixin),
 										children: [/* @__PURE__ */ jsxs("div", {
-											className: "flex flex-col gap-2 min-w-0",
+											className: "flex gap-3 items-start",
+											children: [/* @__PURE__ */ jsx("div", {
+												className: "mt-1 bg-yellow-100 dark:bg-yellow-900/50 p-1.5 rounded-md shrink-0 flex items-center justify-center",
+												children: /* @__PURE__ */ jsx(AlertTriangleIcon, { size: iconSize.smallest })
+											}), /* @__PURE__ */ jsxs("div", { children: [/* @__PURE__ */ jsx(Typography, {
+												variant: "subtitle2",
+												className: "text-yellow-800 dark:text-yellow-500",
+												children: "Row Level Security (RLS) is disabled"
+											}), /* @__PURE__ */ jsx(Typography, {
+												variant: "body2",
+												className: "text-yellow-700 dark:text-yellow-600/90 mt-1 max-w-2xl",
+												children: "Your table is completely readable and writable by anyone with access privileges. Enable RLS to create policies that restrict access to specific rows."
+											})] })]
+										}), /* @__PURE__ */ jsx(Button, {
+											size: "medium",
+											variant: "filled",
+											color: "neutral",
+											onClick: () => setEditingPolicy("new"),
+											className: "shrink-0 whitespace-nowrap",
+											disabled: !activeCollection,
+											children: t("studio_rls_create_policy")
+										})]
+									}),
+									activeTableData && mergedPolicies && mergedPolicies.length > 0 && /* @__PURE__ */ jsxs("div", {
+										className: "flex flex-col gap-3",
+										children: [/* @__PURE__ */ jsx(Typography, {
+											variant: "subtitle2",
+											className: "text-text-secondary dark:text-text-secondary-dark uppercase tracking-wider mb-1",
+											children: t("studio_rls_policies")
+										}), mergedPolicies.map((policy) => /* @__PURE__ */ jsxs(Paper, {
+											className: cls("p-3 sm:px-4 sm:py-3 flex flex-col sm:flex-row sm:items-center justify-between gap-4 border rounded-lg", defaultBorderMixin),
 											children: [/* @__PURE__ */ jsxs("div", {
-												className: "flex items-center gap-2",
-												children: [
-													/* @__PURE__ */ jsx(KeyIcon, {
-														size: iconSize.smallest,
-														className: "text-text-secondary dark:text-text-secondary-dark shrink-0"
-													}),
-													/* @__PURE__ */ jsx(Typography, {
-														variant: "body2",
-														className: "truncate",
-														children: policy.policyname
-													}),
-													policy.status === "code_only" && /* @__PURE__ */ jsx(Tooltip, {
-														title: "This policy is defined in your code but hasn't been applied to the database yet.",
-														children: /* @__PURE__ */ jsx("div", {
-															className: "px-1.5 py-0.5 rounded text-[10px] uppercase bg-primary/10 text-primary border border-primary/20 shrink-0",
-															children: "Unapplied"
+												className: "flex flex-col gap-2 min-w-0",
+												children: [/* @__PURE__ */ jsxs("div", {
+													className: "flex items-center gap-2",
+													children: [
+														/* @__PURE__ */ jsx(KeyIcon, {
+															size: iconSize.smallest,
+															className: "text-text-secondary dark:text-text-secondary-dark shrink-0"
+														}),
+														/* @__PURE__ */ jsx(Typography, {
+															variant: "body2",
+															className: "truncate",
+															children: policy.policyname
+														}),
+														policy.status === "code_only" && /* @__PURE__ */ jsx(Tooltip, {
+															title: t("studio_rls_unapplied_tooltip"),
+															children: /* @__PURE__ */ jsx("div", {
+																className: "px-1.5 py-0.5 rounded text-[10px] uppercase bg-primary/10 text-primary border border-primary/20 shrink-0",
+																children: t("studio_rls_unapplied")
+															})
+														}),
+														policy.status === "live" && hasCodebase && /* @__PURE__ */ jsx(Tooltip, {
+															title: "This policy is live in the database but missing from your codebase schema.",
+															children: /* @__PURE__ */ jsx("div", {
+																className: "px-1.5 py-0.5 rounded text-[10px] uppercase bg-orange-500/10 text-orange-600 border border-orange-500/20 shrink-0",
+																children: "DB Only"
+															})
 														})
-													}),
-													policy.status === "live" && hasCodebase && /* @__PURE__ */ jsx(Tooltip, {
-														title: "This policy is live in the database but missing from your codebase schema.",
-														children: /* @__PURE__ */ jsx("div", {
-															className: "px-1.5 py-0.5 rounded text-[10px] uppercase bg-orange-500/10 text-orange-600 border border-orange-500/20 shrink-0",
-															children: "DB Only"
-														})
-													})
-												]
+													]
+												}), /* @__PURE__ */ jsxs("div", {
+													className: "flex flex-wrap gap-1.5 text-sm",
+													children: [renderPolicyTag("Action", policy.cmd), renderPolicyTag("Roles", Array.isArray(policy.roles) ? policy.roles.join(", ") : policy.roles)]
+												})]
 											}), /* @__PURE__ */ jsxs("div", {
-												className: "flex flex-wrap gap-1.5 text-sm",
-												children: [renderPolicyTag("Action", policy.cmd), renderPolicyTag("Roles", Array.isArray(policy.roles) ? policy.roles.join(", ") : policy.roles)]
-											})]
-										}), /* @__PURE__ */ jsxs("div", {
-											className: "flex gap-2 shrink-0 items-center",
-											children: [
-												policy.status === "live" && activeCollection && hasCodebase && /* @__PURE__ */ jsx(Button, {
-													size: "small",
-													variant: "outlined",
-													color: "primary",
-													onClick: async () => {
-														const rule = {
-															name: policy.policyname,
-															operation: policy.cmd?.toLowerCase(),
-															mode: policy.permissive?.toLowerCase(),
-															using: policy.qual || void 0,
-															withCheck: policy.with_check || void 0,
-															roles: policy.roles
-														};
-														const newRules = [...(isPostgresCollectionConfig(activeCollection) ? activeCollection.securityRules : void 0) || [], rule];
-														try {
-															await saveSecurityRules(activeCollection.id || activeCollection.path || activeCollection.alias || activeTableData.tableName, newRules);
-															snackbarController.open({
-																type: "success",
-																message: "Policy imported successfully"
-															});
-															fetchRLSData();
-														} catch (e) {
-															snackbarController.open({
-																type: "error",
-																message: e instanceof Error ? e.message : String(e)
-															});
-														}
-													},
-													children: "Import to codebase"
-												}),
-												/* @__PURE__ */ jsx(Button, {
-													size: "small",
-													variant: "text",
-													color: "primary",
-													onClick: () => setEditingPolicy(policy),
-													children: t("studio_rls_edit")
-												}),
-												policy.status !== "code_only" && /* @__PURE__ */ jsx(Tooltip, {
-													title: t("studio_rls_delete"),
-													asChild: true,
-													children: /* @__PURE__ */ jsx(IconButton, {
+												className: "flex gap-2 shrink-0 items-center",
+												children: [
+													policy.status === "live" && activeCollection && hasCodebase && /* @__PURE__ */ jsx(Button, {
 														size: "small",
+														variant: "outlined",
+														color: "primary",
 														onClick: async () => {
-															const table = activeTableData.tableName;
-															const qualifiedTable = `${sanitizeSqlIdentifier(activeTableData.schemaName)}.${sanitizeSqlIdentifier(table)}`;
-															if (!confirm(`Drop policy "${policy.policyname}" from table "${table}"?`)) return;
+															const rule = {
+																name: policy.policyname,
+																operation: policy.cmd?.toLowerCase(),
+																mode: policy.permissive?.toLowerCase(),
+																using: policy.qual || void 0,
+																withCheck: policy.with_check || void 0,
+																roles: policy.roles
+															};
+															const newRules = [...(isPostgresCollectionConfig(activeCollection) ? activeCollection.securityRules : void 0) || [], rule];
 															try {
-																await databaseAdmin.executeSql(`DROP POLICY ${sanitizeSqlIdentifier(policy.policyname)} ON ${qualifiedTable}`);
+																await saveSecurityRules(activeCollection.id || activeCollection.path || activeCollection.alias || activeTableData.tableName, newRules);
 																snackbarController.open({
 																	type: "success",
-																	message: `Policy "${policy.policyname}" dropped`
+																	message: "Policy imported successfully"
 																});
 																fetchRLSData();
 															} catch (e) {
-																snackbarController.open({
-																	type: "error",
-																	message: e instanceof Error ? e.message : String(e)
-																});
+																reportSaveFailure(e);
 															}
 														},
-														children: /* @__PURE__ */ jsx(Trash2Icon, { size: iconSize.smallest })
+														children: "Import to codebase"
+													}),
+													/* @__PURE__ */ jsx(Button, {
+														size: "small",
+														variant: "text",
+														color: "primary",
+														onClick: () => setEditingPolicy(policy),
+														children: t("studio_rls_edit")
+													}),
+													policy.status !== "code_only" && /* @__PURE__ */ jsx(Tooltip, {
+														title: t("studio_rls_delete"),
+														asChild: true,
+														children: /* @__PURE__ */ jsx(IconButton, {
+															size: "small",
+															onClick: () => setConfirmDropPolicy({
+																policyName: policy.policyname,
+																table: activeTableData.tableName,
+																schema: activeTableData.schemaName
+															}),
+															children: /* @__PURE__ */ jsx(Trash2Icon, { size: iconSize.smallest })
+														})
 													})
-												})
-											]
-										})]
-									}, policy.policyname))]
-								}),
-								activeTableData && mergedPolicies.length === 0 && activeTableData.rlsEnabled && /* @__PURE__ */ jsxs("div", {
-									className: "flex flex-col items-center justify-center py-12 text-center",
-									children: [
-										/* @__PURE__ */ jsx(ShieldIcon, {
-											size: 40,
-											className: "text-surface-300 dark:text-surface-600 mb-4"
-										}),
-										/* @__PURE__ */ jsx(Typography, {
-											variant: "subtitle2",
-											className: "text-text-secondary dark:text-text-secondary-dark mb-2",
-											children: "No policies defined"
-										}),
-										/* @__PURE__ */ jsx(Typography, {
-											variant: "caption",
-											className: "text-text-disabled dark:text-text-disabled-dark max-w-sm mb-4",
-											children: "RLS is enabled on this table but no policies exist. All access is denied by default (Postgres deny-all). Create a policy to allow specific access."
-										}),
-										/* @__PURE__ */ jsx(Button, {
-											size: "small",
-											variant: "filled",
-											color: "primary",
-											onClick: () => setEditingPolicy("new"),
-											children: t("studio_rls_create_policy")
-										})
-									]
-								}),
-								activeTableData && mergedPolicies.length === 0 && !activeTableData.rlsEnabled && activeCollection && /* @__PURE__ */ jsxs("div", {
-									className: "flex flex-col items-center justify-center py-12 text-center",
-									children: [
-										/* @__PURE__ */ jsx(AlertTriangleIcon, {
-											size: 40,
-											className: "text-yellow-400 dark:text-yellow-600 mb-4"
-										}),
-										/* @__PURE__ */ jsx(Typography, {
-											variant: "subtitle2",
-											className: "text-text-secondary dark:text-text-secondary-dark mb-2",
-											children: "No access control"
-										}),
-										/* @__PURE__ */ jsx(Typography, {
-											variant: "caption",
-											className: "text-text-disabled dark:text-text-disabled-dark max-w-sm",
-											children: "This table has neither RLS nor policies. Enable RLS and create policies to restrict row-level access."
-										})
-									]
-								})
-							]
+												]
+											})]
+										}, policy.policyname))]
+									}),
+									activeTableData && mergedPolicies.length === 0 && activeTableData.rlsEnabled && /* @__PURE__ */ jsxs("div", {
+										className: "flex flex-col items-center justify-center py-12 text-center",
+										children: [
+											/* @__PURE__ */ jsx(ShieldIcon, {
+												size: 40,
+												className: "text-surface-300 dark:text-surface-600 mb-4"
+											}),
+											/* @__PURE__ */ jsx(Typography, {
+												variant: "subtitle2",
+												className: "text-text-secondary dark:text-text-secondary-dark mb-2",
+												children: "No policies defined"
+											}),
+											/* @__PURE__ */ jsx(Typography, {
+												variant: "caption",
+												className: "text-text-disabled dark:text-text-disabled-dark max-w-sm mb-4",
+												children: "RLS is enabled on this table but no policies exist. All access is denied by default (Postgres deny-all). Create a policy to allow specific access."
+											}),
+											/* @__PURE__ */ jsx(Button, {
+												size: "small",
+												variant: "filled",
+												color: "primary",
+												onClick: () => setEditingPolicy("new"),
+												children: t("studio_rls_create_policy")
+											})
+										]
+									}),
+									activeTableData && mergedPolicies.length === 0 && !activeTableData.rlsEnabled && activeCollection && /* @__PURE__ */ jsxs("div", {
+										className: "flex flex-col items-center justify-center py-12 text-center",
+										children: [
+											/* @__PURE__ */ jsx(AlertTriangleIcon, {
+												size: 40,
+												className: "text-yellow-400 dark:text-yellow-600 mb-4"
+											}),
+											/* @__PURE__ */ jsx(Typography, {
+												variant: "subtitle2",
+												className: "text-text-secondary dark:text-text-secondary-dark mb-2",
+												children: "No access control"
+											}),
+											/* @__PURE__ */ jsx(Typography, {
+												variant: "caption",
+												className: "text-text-disabled dark:text-text-disabled-dark max-w-sm",
+												children: "This table has neither RLS nor policies. Enable RLS and create policies to restrict row-level access."
+											})
+										]
+									})
+								]
+							})
 						})
-					})
-				})]
+					})]
+				})
+			}),
+			/* @__PURE__ */ jsx(ConfirmationDialog, {
+				open: confirmToggleRls !== null,
+				loading: confirming,
+				onAccept: applyToggleRls,
+				onCancel: () => setConfirmToggleRls(null),
+				title: confirmToggleRls?.enabled ? t("studio_rls_disable_confirm_title") : t("studio_rls_enable_confirm_title"),
+				body: confirmToggleRls?.enabled ? t("studio_rls_disable_confirm_body", { table: confirmToggleRls?.table ?? "" }) : t("studio_rls_enable_confirm_body", { table: confirmToggleRls?.table ?? "" })
+			}),
+			/* @__PURE__ */ jsx(ConfirmationDialog, {
+				open: confirmDropPolicy !== null,
+				loading: confirming,
+				onAccept: applyDropPolicy,
+				onCancel: () => setConfirmDropPolicy(null),
+				title: t("studio_rls_drop_policy_title"),
+				body: t("studio_rls_drop_policy_body", {
+					policy: confirmDropPolicy?.policyName ?? "",
+					table: confirmDropPolicy?.table ?? ""
+				})
 			})
-		})
+		]
 	});
 };
 //#endregion
 export { RLSEditor };
 
-//# sourceMappingURL=RLSEditor-CBX4uD66.js.map
+//# sourceMappingURL=RLSEditor-Sa1D34ny.js.map