@rebasepro/studio 0.22.0 → 0.24.0

package/dist/components/RLSEditor/policyRules.d.ts

@@ -0,0 +1,49 @@
+import type { PolicyExpression, PostgresPolicy, SecurityRule, SecurityRuleBase } from "@rebasepro/types";
+/**
+ * The security-rule fields a {@link PostgresPolicy} describes, and the ones an
+ * edit carries over from the rule it changes.
+ *
+ * Wider than any one `SecurityRule` variant on purpose: an edit starts from the
+ * rule as written and deletes and assigns the fields that changed one at a
+ * time, and the variants are exclusive about which fields go together.
+ */
+export type PolicyRule = SecurityRuleBase & {
+    using?: string;
+    withCheck?: string;
+    ownerField?: string;
+    access?: "public";
+    condition?: PolicyExpression;
+    check?: PolicyExpression;
+};
+/** Why an edited policy could not be written back to a rule. */
+export type PolicyEditRefusal = 
+/** Rebase adds it (the admin baseline, tenancy); no declared rule holds it. */
+"generated"
+/** It exists only in the database. */
+ | "not_declared"
+/** Its rule covers several operations, and the policy is one of them. */
+ | "several_operations";
+export type PolicyEdit = {
+    ok: true;
+    rules: PolicyRule[];
+} | {
+    ok: false;
+    reason: PolicyEditRefusal;
+};
+/**
+ * Write an edit of one policy back to the declared rule it compiles from.
+ *
+ * The rule is found by the policy names it compiles to, not by `rule.name`:
+ * an unnamed rule's policy is `<table>_<op>_<hash>`, and a rule over several
+ * operations names each `<name>_<op>`. Matching on `name` missed both, saved
+ * the rules unchanged and reported success.
+ *
+ * A rule over several operations is refused rather than split: taking one
+ * operation out renames every policy the rule compiles to.
+ *
+ * @param declared  The collection's `securityRules`, as written.
+ * @param effective Every rule the generator compiles for the table — the
+ *                  declared ones plus what Rebase adds — to tell a generated
+ *                  policy from one that exists only in the database.
+ */
+export declare function applyPolicyEdit(declared: readonly SecurityRule[], effective: readonly SecurityRule[], tableName: string, original: PostgresPolicy, edited: Partial<PostgresPolicy>): PolicyEdit;

package/dist/components/SQLEditor/MonacoEditor.d.ts

@@ -1,5 +1,17 @@
 import React from "react";
+/**
+ * What a host can ask of the editor outside its own key bindings.
+ *
+ * The toolbar's buttons need the selection that Cmd+Enter already reads: a
+ * button that runs the whole buffer while the shortcut beside it runs only the
+ * highlighted statement is two answers to one question.
+ */
+export interface MonacoEditorHandle {
+    /** The selected text, trimmed — `undefined` when nothing is selected. */
+    getSelectedText: () => string | undefined;
+}
 export type MonacoEditorProps = {
+    ref?: React.Ref<MonacoEditorHandle>;
     value: string;
     onChange: (value: string | undefined) => void;
     onRun?: (selectedText?: string) => void;
@@ -15,4 +27,4 @@ export type MonacoEditorProps = {
         }[];
     }[]>;
 };
-export declare const MonacoEditor: ({ value, onChange, onRun, className, readOnly, autoFocus, schemas }: MonacoEditorProps) => React.JSX.Element;
+export declare const MonacoEditor: ({ ref, value, onChange, onRun, className, readOnly, autoFocus, schemas }: MonacoEditorProps) => React.JSX.Element;

package/dist/components/SchemaVisualizer/schema-visualizer.utils.d.ts

@@ -25,7 +25,6 @@ export declare const getLayoutedElements: (nodes: Node[], edges: Edge[]) => {
     nodes: Node[];
     edges: Edge[];
 };
-export declare const getTypeLabel: (type: string) => string;
 export interface RelationEdgeData {
     cardinality: "one" | "many";
     direction: "owning" | "inverse";

package/dist/components/SchemaVisualizer/useSchemaGraph.d.ts

@@ -3,6 +3,12 @@ import type { AdminCollection } from "@rebasepro/cms-types";
 export interface ColumnInfo {
     name: string;
     type: string;
+    /**
+     * The type the collection declares — `string`, `number`, `date`… — or
+     * `FK` for a relation's key. Not the database's column type: the diagram
+     * is drawn from the collections, and a property's column type depends on
+     * more than its `type` (`columnType`, `isId`, integer validation).
+     */
     typeLabel: string;
     isPrimaryKey: boolean;
     isForeignKey: boolean;

package/dist/components/load-failure.d.ts

@@ -35,7 +35,7 @@
 export type LoadFailureKind = 
 /** The project's own rules, or the caller's own role, said no. Not an error. */
 "denied"
-/** We could not reach or read the source. */
+/** We could not reach or read the source — including a session the server no longer accepts. */
  | "unavailable";
 export interface LoadFailure {
     kind: LoadFailureKind;

package/dist/components/useRunAsUsers.d.ts

@@ -0,0 +1,25 @@
+import { type SelectableUser } from "@rebasepro/app";
+export interface RunAsUsers {
+    /** The signed-in user first, then the users the latest search found. */
+    users: SelectableUser[];
+    /** The signed-in user, the picker's "self" row. */
+    currentUser: SelectableUser | null;
+    loading: boolean;
+    /** Search the project's users on the server. */
+    onSearchTextChange: (searchText: string) => void;
+    /**
+     * How many users the latest search matched on the server, set only when
+     * that is more than the one page listed — so the picker can say so rather
+     * than present the page as everyone.
+     */
+    totalCount?: number;
+}
+/**
+ * The users a "Run as" picker offers.
+ *
+ * The signed-in user, and — for an administrator, the only caller the server
+ * lets run a request as someone else — the project's users, searched on the
+ * server. Disabled accounts are left out: nothing can run as them, and the
+ * server refuses them.
+ */
+export declare function useRunAsUsers(): RunAsUsers;

package/dist/index.es.js

@@ -550,17 +550,17 @@ function SyntaxHighlightedSnippet() {
 }
 //#endregion
 //#region src/components/RebaseStudio.tsx
-var SQLEditor = lazyChunk(() => import("./SQLEditor-sdtoZv5F.js").then((m) => ({ default: m.SQLEditor })));
-var JSEditor = lazyChunk(() => import("./JSEditor-qiuwmcvk.js").then((m) => ({ default: m.JSEditor })));
-var RLSEditor = lazyChunk(() => import("./RLSEditor-B-qrgdHy.js").then((m) => ({ default: m.RLSEditor })));
-var StorageView = lazyChunk(() => import("./StorageView-C52dSZNf.js").then((m) => ({ default: m.StorageView })));
-var CronJobsView = lazyChunk(() => import("./CronJobsView-JwRjQCde.js").then((m) => ({ default: m.CronJobsView })));
-var SchemaVisualizer = lazyChunk(() => import("./SchemaVisualizer-DtDzIUNy.js").then((m) => ({ default: m.SchemaVisualizer })));
-var BranchesView = lazyChunk(() => import("./BranchesView-D6Sz1a5f.js").then((m) => ({ default: m.BranchesView })));
-var BackupsView = lazyChunk(() => import("./BackupsView-DYTAD6aW.js").then((m) => ({ default: m.BackupsView })));
-var ApiExplorer = lazyChunk(() => import("./ApiExplorer-D-jLWAaY.js").then((m) => ({ default: m.ApiExplorer })));
-var LogsExplorer = lazyChunk(() => import("./LogsExplorer-Xq8K4oo6.js").then((m) => ({ default: m.LogsExplorer })));
-var ApiKeysView = lazyChunk(() => import("./ApiKeysView-OfJLH2x7.js").then((m) => ({ default: m.ApiKeysView })));
+var SQLEditor = lazyChunk(() => import("./SQLEditor-1An7w0j6.js").then((m) => ({ default: m.SQLEditor })));
+var JSEditor = lazyChunk(() => import("./JSEditor-B59pwg4c.js").then((m) => ({ default: m.JSEditor })));
+var RLSEditor = lazyChunk(() => import("./RLSEditor-BlLLV6xs.js").then((m) => ({ default: m.RLSEditor })));
+var StorageView = lazyChunk(() => import("./StorageView-CbsHuCBf.js").then((m) => ({ default: m.StorageView })));
+var CronJobsView = lazyChunk(() => import("./CronJobsView-TDErHTuK.js").then((m) => ({ default: m.CronJobsView })));
+var SchemaVisualizer = lazyChunk(() => import("./SchemaVisualizer-DCLVfA5t.js").then((m) => ({ default: m.SchemaVisualizer })));
+var BranchesView = lazyChunk(() => import("./BranchesView-DP1a87E-.js").then((m) => ({ default: m.BranchesView })));
+var BackupsView = lazyChunk(() => import("./BackupsView-DmSMzAbT.js").then((m) => ({ default: m.BackupsView })));
+var ApiExplorer = lazyChunk(() => import("./ApiExplorer-CCtczj3F.js").then((m) => ({ default: m.ApiExplorer })));
+var LogsExplorer = lazyChunk(() => import("./LogsExplorer-BKM4yfP8.js").then((m) => ({ default: m.LogsExplorer })));
+var ApiKeysView = lazyChunk(() => import("./ApiKeysView-B66TdzhH.js").then((m) => ({ default: m.ApiKeysView })));
 /**
 * Declarative component to configure the Studio in Rebase.
 * Renders nothing — purely registers config into the RebaseRegistry.

package/dist/{load-failure-C6OMJSGC.js → load-failure-Bd8lFIO7.js}

@@ -15,7 +15,7 @@ function statusOf(err) {
 function classifyLoadFailure(err) {
 	const detail = err instanceof Error ? err.message : String(err);
 	const status = statusOf(err);
-	return status === 403 || status === 401 || /\bnot authori[sz]ed\b|\bforbidden\b|\bpermission denied\b/i.test(detail) ? {
+	return (status !== null ? status === 403 : /\bnot authori[sz]ed\b|\bforbidden\b|\bpermission denied\b/i.test(detail)) ? {
 		kind: "denied",
 		detail,
 		retryable: false
@@ -28,4 +28,4 @@ function classifyLoadFailure(err) {
 //#endregion
 export { classifyLoadFailure as t };
 
-//# sourceMappingURL=load-failure-C6OMJSGC.js.map
+//# sourceMappingURL=load-failure-Bd8lFIO7.js.map

package/dist/load-failure-Bd8lFIO7.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"load-failure-Bd8lFIO7.js","names":[],"sources":["../src/components/load-failure.ts"],"sourcesContent":["/**\n * Why a Studio listing failed — and whether it is the platform's fault.\n *\n * ## Why this is a function\n *\n * The storage pane rendered one view for every failure: a red card titled\n * **\"Error loading storage\"** with whatever string came back underneath.\n *\n * On 2026-08-27 a customer opened the Files tab of a healthy project and read\n * \"Error loading storage — Not authorized for this object\". Nothing was broken.\n * That project's own `storageAuthorize` hook refuses an unscoped listing on\n * purpose — its comment says a `list` that is not scoped to a team \"is precisely\n * the enumeration this exists to stop\" — and the Files tab always opens at the\n * bucket root. The console took a policy working exactly as written and\n * presented it as a fault in the platform, which sends the reader hunting for a\n * problem that does not exist.\n *\n * A refusal and a failure need different words, a different colour, and a\n * different next step: one is \"your rule said no\", the other is \"we could not\n * ask\". Retry is an affordance for the second and noise on the first.\n *\n * ## Why it is shared\n *\n * Storage was the only pane that had learned this. Backups, Cron Jobs, API Keys\n * and Branches each caught the error, opened a snackbar that is gone in four\n * seconds, and left their list empty — so a reader who looked away, or arrived\n * after the toast, was told \"No backups found yet\" about a database that has\n * backups and an account that may not list them. One classifier and one view, so\n * the next pane inherits the distinction instead of rediscovering it.\n *\n * The view that renders one of these is `load-failure-view.tsx`. It is a\n * separate file so that this classifier — the part with the rules in it — can\n * be tested without dragging in `@rebasepro/app` and, behind it, react-router.\n */\n\nexport type LoadFailureKind =\n    /** The project's own rules, or the caller's own role, said no. Not an error. */\n    | \"denied\"\n    /** We could not reach or read the source — including a session the server no longer accepts. */\n    | \"unavailable\";\n\nexport interface LoadFailure {\n    kind: LoadFailureKind;\n    /** The message as the server gave it, never re-worded. */\n    detail: string;\n    /** Offering retry against a standing policy teaches people the button does nothing. */\n    retryable: boolean;\n}\n\n/** HTTP status carried by whatever the SDK threw, if it carries one. */\nfunction statusOf(err: unknown): number | null {\n    if (typeof err !== \"object\" || err === null) return null;\n    for (const key of [\"status\", \"statusCode\", \"code\"]) {\n        const v = (err as Record<string, unknown>)[key];\n        if (typeof v === \"number\" && v >= 100 && v < 600) return v;\n    }\n    return null;\n}\n\nexport function classifyLoadFailure(err: unknown): LoadFailure {\n    const detail = err instanceof Error ? err.message : String(err);\n    const status = statusOf(err);\n\n    // 403 is the rule's answer, and the only status that is. A 401 is the\n    // session — expired, revoked, signed out elsewhere — and says nothing about\n    // what the caller's role may do; a 5xx is the platform, even when its\n    // message says \"permission denied\" (a missing GRANT is answered that way).\n    // Both are failures to read, with Retry.\n    //\n    // The message match is only for an error that carries no status at all: an\n    // SDK that flattens an error to a string is how a refusal reached the\n    // screen unclassified.\n    const denied = status !== null\n        ? status === 403\n        : /\\bnot authori[sz]ed\\b|\\bforbidden\\b|\\bpermission denied\\b/i.test(detail);\n\n    return denied\n        ? { kind: \"denied\", detail, retryable: false }\n        : { kind: \"unavailable\", detail, retryable: true };\n}\n"],"mappings":";;AAkDA,SAAS,SAAS,KAA6B;CAC3C,IAAI,OAAO,QAAQ,YAAY,QAAQ,MAAM,OAAO;CACpD,KAAK,MAAM,OAAO;EAAC;EAAU;EAAc;CAAM,GAAG;EAChD,MAAM,IAAK,IAAgC;EAC3C,IAAI,OAAO,MAAM,YAAY,KAAK,OAAO,IAAI,KAAK,OAAO;CAC7D;CACA,OAAO;AACX;AAEA,SAAgB,oBAAoB,KAA2B;CAC3D,MAAM,SAAS,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;CAC9D,MAAM,SAAS,SAAS,GAAG;CAe3B,QAJe,WAAW,OACpB,WAAW,MACX,6DAA6D,KAAK,MAAM,KAGxE;EAAE,MAAM;EAAU;EAAQ,WAAW;CAAM,IAC3C;EAAE,MAAM;EAAe;EAAQ,WAAW;CAAK;AACzD"}

package/dist/useRunAsUsers-CLaAtXt6.js

@@ -0,0 +1,122 @@
+import { UserSelectPopover, useRebaseClient, useRebaseContext } from "@rebasepro/app";
+import { useEffect, useMemo, useState } from "react";
+import { Button, KeyRoundIcon, Typography, iconSize } from "@rebasepro/ui";
+import { Fragment, jsx, jsxs } from "react/jsx-runtime";
+import { hasAdminRole } from "@rebasepro/types";
+//#region src/components/AuthSimulationSelector.tsx
+function AuthSimulationSelector({ authMode, setAuthMode, selectedUser, setSelectedUser, users, loading, onUserSearchTextChange, userTotalCount, currentUser }) {
+	return /* @__PURE__ */ jsxs("div", {
+		className: "flex flex-wrap items-center gap-3",
+		children: [
+			/* @__PURE__ */ jsx(KeyRoundIcon, {
+				size: iconSize.small,
+				className: "text-text-secondary dark:text-text-secondary-dark"
+			}),
+			/* @__PURE__ */ jsx(Typography, {
+				variant: "caption",
+				className: "text-text-secondary dark:text-text-secondary-dark text-xs font-medium",
+				children: "Auth:"
+			}),
+			/* @__PURE__ */ jsx(Button, {
+				size: "small",
+				variant: authMode === "jwt" ? "outlined" : "outlined",
+				color: authMode === "jwt" ? "primary" : "neutral",
+				onClick: () => setAuthMode("jwt"),
+				className: "rounded-full !px-3 !py-1 !text-xs",
+				children: "JWT Token"
+			}),
+			/* @__PURE__ */ jsx(Button, {
+				size: "small",
+				variant: authMode === "none" ? "outlined" : "outlined",
+				color: authMode === "none" ? "error" : "neutral",
+				onClick: () => setAuthMode("none"),
+				className: "rounded-full !px-3 !py-1 !text-xs",
+				children: "No Auth"
+			}),
+			authMode === "jwt" && /* @__PURE__ */ jsxs(Fragment, { children: [
+				/* @__PURE__ */ jsx("div", { className: "w-px h-4 bg-hairline-strong mx-1" }),
+				/* @__PURE__ */ jsx(Typography, {
+					variant: "caption",
+					className: "text-text-secondary dark:text-text-secondary-dark text-xs font-medium",
+					children: "Run as:"
+				}),
+				/* @__PURE__ */ jsx(UserSelectPopover, {
+					selectedUser,
+					onUserSelected: setSelectedUser,
+					users,
+					loading,
+					onSearchTextChange: onUserSearchTextChange,
+					totalCount: userTotalCount,
+					currentUser
+				})
+			] })
+		]
+	});
+}
+//#endregion
+//#region src/components/useRunAsUsers.ts
+/** How many users one search of a "Run as" picker lists. */
+var USER_PAGE_SIZE = 50;
+/** The fields a picker row shows, copied off an account or the signed-in user. */
+function toSelectableUser(user) {
+	return {
+		uid: user.uid,
+		displayName: user.displayName,
+		email: user.email,
+		photoURL: user.photoURL,
+		roles: user.roles
+	};
+}
+/**
+* The users a "Run as" picker offers.
+*
+* The signed-in user, and — for an administrator, the only caller the server
+* lets run a request as someone else — the project's users, searched on the
+* server. Disabled accounts are left out: nothing can run as them, and the
+* server refuses them.
+*/
+function useRunAsUsers() {
+	const signedIn = useRebaseContext().authController?.user;
+	const client = useRebaseClient();
+	const adminApi = hasAdminRole(signedIn?.roles) ? client?.admin : void 0;
+	const [search, setSearch] = useState("");
+	const [listed, setListed] = useState([]);
+	const [totalCount, setTotalCount] = useState(void 0);
+	const [loading, setLoading] = useState(false);
+	useEffect(() => {
+		if (!adminApi) return;
+		let cancelled = false;
+		setLoading(true);
+		adminApi.listUsersPaginated({
+			search: search || void 0,
+			limit: USER_PAGE_SIZE
+		}).then(({ users, total }) => {
+			if (cancelled) return;
+			setListed(users.filter((u) => !u.disabled).map(toSelectableUser));
+			setTotalCount(total > users.length ? total : void 0);
+		}).catch((err) => {
+			console.warn("Could not list users for the \"Run as\" picker", err);
+			if (!cancelled) {
+				setListed([]);
+				setTotalCount(void 0);
+			}
+		}).finally(() => {
+			if (!cancelled) setLoading(false);
+		});
+		return () => {
+			cancelled = true;
+		};
+	}, [adminApi, search]);
+	const currentUser = useMemo(() => signedIn ? toSelectableUser(signedIn) : null, [signedIn]);
+	return {
+		users: useMemo(() => [...currentUser ? [currentUser] : [], ...listed.filter((u) => u.uid !== currentUser?.uid)], [currentUser, listed]),
+		currentUser,
+		loading,
+		onSearchTextChange: setSearch,
+		totalCount
+	};
+}
+//#endregion
+export { AuthSimulationSelector as n, useRunAsUsers as t };
+
+//# sourceMappingURL=useRunAsUsers-CLaAtXt6.js.map

package/dist/useRunAsUsers-CLaAtXt6.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"useRunAsUsers-CLaAtXt6.js","names":[],"sources":["../src/components/AuthSimulationSelector.tsx","../src/components/useRunAsUsers.ts"],"sourcesContent":["import React from \"react\";\nimport { Button, cls, iconSize, KeyRoundIcon, Typography } from \"@rebasepro/ui\";\nimport { UserSelectPopover, SelectableUser } from \"@rebasepro/app\";\n\nexport interface AuthSimulationSelectorProps {\n    authMode: \"jwt\" | \"none\";\n    setAuthMode: (mode: \"jwt\" | \"none\") => void;\n    selectedUser: SelectableUser | null;\n    setSelectedUser: (user: SelectableUser | null) => void;\n    users: SelectableUser[];\n    loading?: boolean;\n    /** For a caller that searches `users` on the server — see `UserSelectPopover`. */\n    onUserSearchTextChange?: (searchText: string) => void;\n    /** How many users that search matched, when `users` is only its first page — see `UserSelectPopover`. */\n    userTotalCount?: number;\n    currentUser: SelectableUser | null;\n}\n\nexport function AuthSimulationSelector({\n    authMode,\n    setAuthMode,\n    selectedUser,\n    setSelectedUser,\n    users,\n    loading,\n    onUserSearchTextChange,\n    userTotalCount,\n    currentUser\n}: AuthSimulationSelectorProps) {\n    return (\n        <div className=\"flex flex-wrap items-center gap-3\">\n            <KeyRoundIcon size={iconSize.small} className=\"text-text-secondary dark:text-text-secondary-dark\" />\n            <Typography\n                variant=\"caption\"\n                className=\"text-text-secondary dark:text-text-secondary-dark text-xs font-medium\"\n            >\n                Auth:\n            </Typography>\n            <Button\n                size=\"small\"\n                variant={authMode === \"jwt\" ? \"outlined\" : \"outlined\"}\n                color={authMode === \"jwt\" ? \"primary\" : \"neutral\"}\n                onClick={() => setAuthMode(\"jwt\")}\n                className=\"rounded-full !px-3 !py-1 !text-xs\"\n            >\n                JWT Token\n            </Button>\n            <Button\n                size=\"small\"\n                variant={authMode === \"none\" ? \"outlined\" : \"outlined\"}\n                color={authMode === \"none\" ? \"error\" : \"neutral\"}\n                onClick={() => setAuthMode(\"none\")}\n                className=\"rounded-full !px-3 !py-1 !text-xs\"\n            >\n                No Auth\n            </Button>\n\n            {authMode === \"jwt\" && (\n                <>\n                    <div className=\"w-px h-4 bg-hairline-strong mx-1\" />\n                    <Typography\n                        variant=\"caption\"\n                        className=\"text-text-secondary dark:text-text-secondary-dark text-xs font-medium\"\n                    >\n                        Run as:\n                    </Typography>\n                    <UserSelectPopover\n                        selectedUser={selectedUser}\n                        onUserSelected={setSelectedUser}\n                        users={users}\n                        loading={loading}\n                        onSearchTextChange={onUserSearchTextChange}\n                        totalCount={userTotalCount}\n                        currentUser={currentUser}\n                    />\n                </>\n            )}\n        </div>\n    );\n}\n","import { useEffect, useMemo, useState } from \"react\";\nimport { useRebaseClient, useRebaseContext, type SelectableUser } from \"@rebasepro/app\";\nimport { hasAdminRole, type RebaseClient } from \"@rebasepro/types\";\n\n/** How many users one search of a \"Run as\" picker lists. */\nconst USER_PAGE_SIZE = 50;\n\n/** The fields a picker row shows, copied off an account or the signed-in user. */\nfunction toSelectableUser(user: SelectableUser): SelectableUser {\n    return {\n        uid: user.uid,\n        displayName: user.displayName,\n        email: user.email,\n        photoURL: user.photoURL,\n        roles: user.roles\n    };\n}\n\nexport interface RunAsUsers {\n    /** The signed-in user first, then the users the latest search found. */\n    users: SelectableUser[];\n    /** The signed-in user, the picker's \"self\" row. */\n    currentUser: SelectableUser | null;\n    loading: boolean;\n    /** Search the project's users on the server. */\n    onSearchTextChange: (searchText: string) => void;\n    /**\n     * How many users the latest search matched on the server, set only when\n     * that is more than the one page listed — so the picker can say so rather\n     * than present the page as everyone.\n     */\n    totalCount?: number;\n}\n\n/**\n * The users a \"Run as\" picker offers.\n *\n * The signed-in user, and — for an administrator, the only caller the server\n * lets run a request as someone else — the project's users, searched on the\n * server. Disabled accounts are left out: nothing can run as them, and the\n * server refuses them.\n */\nexport function useRunAsUsers(): RunAsUsers {\n    const signedIn = useRebaseContext().authController?.user;\n    const client = useRebaseClient<RebaseClient>();\n    const adminApi = hasAdminRole(signedIn?.roles) ? client?.admin : undefined;\n\n    const [search, setSearch] = useState(\"\");\n    const [listed, setListed] = useState<SelectableUser[]>([]);\n    const [totalCount, setTotalCount] = useState<number | undefined>(undefined);\n    const [loading, setLoading] = useState(false);\n\n    useEffect(() => {\n        if (!adminApi) return;\n        let cancelled = false;\n        setLoading(true);\n        adminApi.listUsersPaginated({ search: search || undefined, limit: USER_PAGE_SIZE })\n            .then(({ users, total }) => {\n                if (cancelled) return;\n                setListed(users.filter((u) => !u.disabled).map(toSelectableUser));\n                setTotalCount(total > users.length ? total : undefined);\n            })\n            .catch((err: unknown) => {\n                console.warn(\"Could not list users for the \\\"Run as\\\" picker\", err);\n                if (!cancelled) {\n                    setListed([]);\n                    setTotalCount(undefined);\n                }\n            })\n            .finally(() => {\n                if (!cancelled) setLoading(false);\n            });\n        return () => {\n            cancelled = true;\n        };\n    }, [adminApi, search]);\n\n    const currentUser = useMemo((): SelectableUser | null => (signedIn ? toSelectableUser(signedIn) : null), [signedIn]);\n\n    const users = useMemo(\n        () => [...(currentUser ? [currentUser] : []), ...listed.filter((u) => u.uid !== currentUser?.uid)],\n        [currentUser, listed]\n    );\n\n    return { users, currentUser, loading, onSearchTextChange: setSearch, totalCount };\n}\n"],"mappings":";;;;;;AAkBA,SAAgB,uBAAuB,EACnC,UACA,aACA,cACA,iBACA,OACA,SACA,wBACA,gBACA,eAC4B;CAC5B,OACI,qBAAC,OAAD;EAAK,WAAU;YAAf;GACI,oBAAC,cAAD;IAAc,MAAM,SAAS;IAAO,WAAU;GAAqD,CAAA;GACnG,oBAAC,YAAD;IACI,SAAQ;IACR,WAAU;cACb;GAEW,CAAA;GACZ,oBAAC,QAAD;IACI,MAAK;IACL,SAAS,aAAa,QAAQ,aAAa;IAC3C,OAAO,aAAa,QAAQ,YAAY;IACxC,eAAe,YAAY,KAAK;IAChC,WAAU;cACb;GAEO,CAAA;GACR,oBAAC,QAAD;IACI,MAAK;IACL,SAAS,aAAa,SAAS,aAAa;IAC5C,OAAO,aAAa,SAAS,UAAU;IACvC,eAAe,YAAY,MAAM;IACjC,WAAU;cACb;GAEO,CAAA;GAEP,aAAa,SACV,qBAAA,UAAA,EAAA,UAAA;IACI,oBAAC,OAAD,EAAK,WAAU,mCAAoC,CAAA;IACnD,oBAAC,YAAD;KACI,SAAQ;KACR,WAAU;eACb;IAEW,CAAA;IACZ,oBAAC,mBAAD;KACkB;KACd,gBAAgB;KACT;KACE;KACT,oBAAoB;KACpB,YAAY;KACC;IAChB,CAAA;GACH,EAAA,CAAA;EAEL;;AAEb;;;;AC1EA,IAAM,iBAAiB;;AAGvB,SAAS,iBAAiB,MAAsC;CAC5D,OAAO;EACH,KAAK,KAAK;EACV,aAAa,KAAK;EAClB,OAAO,KAAK;EACZ,UAAU,KAAK;EACf,OAAO,KAAK;CAChB;AACJ;;;;;;;;;AA0BA,SAAgB,gBAA4B;CACxC,MAAM,WAAW,iBAAiB,CAAC,CAAC,gBAAgB;CACpD,MAAM,SAAS,gBAA8B;CAC7C,MAAM,WAAW,aAAa,UAAU,KAAK,IAAI,QAAQ,QAAQ,KAAA;CAEjE,MAAM,CAAC,QAAQ,aAAa,SAAS,EAAE;CACvC,MAAM,CAAC,QAAQ,aAAa,SAA2B,CAAC,CAAC;CACzD,MAAM,CAAC,YAAY,iBAAiB,SAA6B,KAAA,CAAS;CAC1E,MAAM,CAAC,SAAS,cAAc,SAAS,KAAK;CAE5C,gBAAgB;EACZ,IAAI,CAAC,UAAU;EACf,IAAI,YAAY;EAChB,WAAW,IAAI;EACf,SAAS,mBAAmB;GAAE,QAAQ,UAAU,KAAA;GAAW,OAAO;EAAe,CAAC,CAAC,CAC9E,MAAM,EAAE,OAAO,YAAY;GACxB,IAAI,WAAW;GACf,UAAU,MAAM,QAAQ,MAAM,CAAC,EAAE,QAAQ,CAAC,CAAC,IAAI,gBAAgB,CAAC;GAChE,cAAc,QAAQ,MAAM,SAAS,QAAQ,KAAA,CAAS;EAC1D,CAAC,CAAC,CACD,OAAO,QAAiB;GACrB,QAAQ,KAAK,kDAAkD,GAAG;GAClE,IAAI,CAAC,WAAW;IACZ,UAAU,CAAC,CAAC;IACZ,cAAc,KAAA,CAAS;GAC3B;EACJ,CAAC,CAAC,CACD,cAAc;GACX,IAAI,CAAC,WAAW,WAAW,KAAK;EACpC,CAAC;EACL,aAAa;GACT,YAAY;EAChB;CACJ,GAAG,CAAC,UAAU,MAAM,CAAC;CAErB,MAAM,cAAc,cAAsC,WAAW,iBAAiB,QAAQ,IAAI,MAAO,CAAC,QAAQ,CAAC;CAOnH,OAAO;EAAE,OALK,cACJ,CAAC,GAAI,cAAc,CAAC,WAAW,IAAI,CAAC,GAAI,GAAG,OAAO,QAAQ,MAAM,EAAE,QAAQ,aAAa,GAAG,CAAC,GACjG,CAAC,aAAa,MAAM,CAGf;EAAO;EAAa;EAAS,oBAAoB;EAAW;CAAW;AACpF"}

package/dist/utils/sql_utils.d.ts

@@ -1,52 +1,142 @@
-import type { TableInfo } from "../components/SQLEditor/sql_editor_types.js";
+import type { AdminCollection } from "@rebasepro/cms-types";
+import type { SqlScriptResult } from "@rebasepro/types";
+/**
+ * The `EXPLAIN` for one statement, or `null` when `sqlText` is not exactly one.
+ *
+ * Never `ANALYZE`: that executes the statement to time it, so explaining a
+ * `DELETE` deleted the rows — without the confirmation "Run" asks for.
+ *
+ * And never more than one statement. Sent as one simple query, `EXPLAIN (…)
+ * SELECT 1; DELETE …` explains the SELECT and *runs* the DELETE. Text the
+ * parser cannot read is still explained, as long as no `;` could be hiding a
+ * second statement in it.
+ */
+export declare function buildExplainSql(sqlText: string): string | null;
+/**
+ * Whether the console's automatic `LIMIT` may be appended to `sqlText`: one
+ * top-level SELECT that has no limit of its own.
+ *
+ * Decided on the parsed statement, not the text. A search for the word SELECT
+ * also found it inside `INSERT INTO … SELECT` and `CREATE TABLE … AS SELECT`,
+ * which then copied a thousand rows and reported success, and at the start of
+ * a script whose last statement the appended `LIMIT` turned into a syntax
+ * error. Text the parser cannot read is left as written.
+ */
+export declare function acceptsAutoLimit(sqlText: string): boolean;
+/**
+ * Whether "Run" asks before running `sqlText`: a statement in it deletes or
+ * updates without a WHERE of its own, drops or truncates.
+ *
+ * Decided per parsed statement, not on the text. A search of the text for the
+ * word WHERE found it in another statement or in a comment, so `DELETE FROM
+ * posts; SELECT * FROM posts WHERE id = 1` deleted every post without asking.
+ * Text the parser cannot read is confirmed whenever it names a destructive
+ * command.
+ */
+export declare function needsDestructiveConfirmation(sqlText: string): boolean;
 /**
- * A table extracted from a SQL query's FROM/JOIN clauses.
+ * A table as SQL: `"schema"."table"` when a schema is given, a bare `"table"`
+ * otherwise.
  */
-export interface ExtractedTable {
-    name: string;
-    alias?: string;
+export declare function quoteTableName(tableName: string, schemaName?: string): string;
+/** An identifier as SQL, whatever it holds: double-quoted, with `"` doubled. */
+export declare function quoteIdentifier(identifier: string): string;
+/** What the console knows about a result: its columns, and the tables they came from. */
+export type ResultProvenance = Pick<SqlScriptResult, "columns" | "tables">;
+/**
+ * The stored cell a result cell is, and the key that finds its row.
+ */
+export interface CellEditTarget {
+    schema: string;
+    table: string;
+    /** The table column the edited value is written to. */
+    column: string;
+    /** Each primary key column of the table, and the result column holding its value for the row. */
+    key: {
+        column: string;
+        resultColumn: string;
+    }[];
 }
 /**
- * A collection matched to a table in a SQL query.
+ * Why a cell cannot be edited: a translation key of the console's, and its
+ * parameters.
+ */
+export interface CellEditRefusal {
+    key: "studio_sql_edit_unreadable_query" | "studio_sql_edit_not_a_select" | "studio_sql_edit_duplicate_column" | "studio_sql_edit_computed_column" | "studio_sql_edit_not_a_table" | "studio_sql_edit_inherited_table" | "studio_sql_edit_no_primary_key" | "studio_sql_edit_key_missing" | "studio_sql_edit_table_read_twice";
+    params: Record<string, string>;
+}
+export type CellEditResolution = {
+    target: CellEditTarget;
+    refusal?: undefined;
+} | {
+    target?: undefined;
+    refusal: CellEditRefusal;
+};
+/**
+ * Which stored cell an edit of the result column `resultColumn` writes, and
+ * how its row is found again — or why no edit is safe.
+ *
+ * Decided on what the database reported, not on the query's text. Each
+ * column of the result says which table column it was read from, or that it
+ * was computed; a cell is editable only when it was read from a column of a
+ * table, every column of that table's primary key was read too, and each of
+ * them is the only column of the result with its name — a row holds one value
+ * per name.
+ *
+ * The text was the only evidence before, and it was wrong twice over. For
+ * `SELECT p.id, a.name FROM posts p JOIN authors a …` it took the post's `id`
+ * for the author's key and updated whichever author shared the post's id.
+ * For `SELECT id, lower(email) AS name FROM users` it wrote the edited text
+ * to `users.name`.
+ *
+ * The database reports a table, not which mention of it: in a self-join both
+ * sides are `authors`, and a key from one with a value from the other finds
+ * the wrong row. So the query is still read, for one thing — the table must
+ * be read once, and nothing it is read through may be read twice.
+ */
+export declare function resolveCellEdit(sqlText: string, provenance: ResultProvenance, resultColumn: string): CellEditResolution;
+/**
+ * A collection whose records a query's rows can be opened as.
  */
 export interface ResolvedQueryCollection {
-    /** DB table name from the SQL AST (e.g. "blog_posts") */
+    /** The table, as the database named it. */
     tableName: string;
-    /** SQL alias if present (e.g. "bp") */
-    tableAlias?: string;
+    schemaName: string;
     /** The matched collection */
     collection: AdminCollection;
-    /** Columns from this table that are present in the result set */
-    columns: string[];
-    /** The result column name that holds the primary key for this table (e.g. "id", "author_id") */
-    pkColumn?: string;
+    /** The result column that holds the table's primary key. */
+    pkColumn: string;
 }
 /**
- * Extract all tables referenced in a SQL query's FROM and JOIN clauses.
- * Returns an empty array for non-SELECT queries or parse failures.
+ * The collections a result's rows can be opened as: those whose table one of
+ * the result's columns was read from, with the table's (single-column) primary
+ * key read too, under a name no other column of the result has.
+ *
+ * Matched on the provenance the database reported. A text match took the
+ * result's `id` for every table of a join: `SELECT p.id, a.name FROM posts p
+ * JOIN authors a …` offered to open the author whose id was the post's.
  */
-export declare function extractTablesFromQuery(sqlString: string): ExtractedTable[];
-import type { AdminCollection } from "@rebasepro/cms-types";
+export declare function resolveQueryCollections(provenance: ResultProvenance, collections: AdminCollection[]): ResolvedQueryCollection[];
 /**
- * Resolve which collections are referenced by a SQL query.
+ * The console's "Format SQL": runs of whitespace become one space, a comma is
+ * followed by one, and an `=` standing alone gets one on each side — in the
+ * code only.
  *
- * Parses the SQL, extracts table names, and matches each against
- * registered collections via `collection.table` (falling back to
- * snake_case of `collection.slug`).
+ * A literal, a quoted identifier and a comment are copied as they are: their
+ * text is data, and rewriting `'a,b'` to `'a, b'` changes the value the next
+ * Run writes. A line comment keeps the line break that ends it, or it would
+ * swallow the code after it. `>=`, `<=`, `!=`, `:=` and `=>` are operators of
+ * their own and are left whole.
+ */
+export declare function formatSql(sqlText: string): string;
+/**
+ * `sqlText` with the console's automatic `LIMIT` on it, or `null` when it
+ * takes none (see {@link acceptsAutoLimit}).
  *
- * For each matched collection, determines which result columns
- * belong to that table using the database schema information.
+ * The limit goes straight after the statement's last token — before a
+ * trailing comment, which would otherwise swallow it, and in place of a
+ * trailing `;`. A query that computes an aggregate is limited like any other:
+ * the limit applies to the rows it returns, so a `count(*)` still counts every
+ * row, and a window `count(*) OVER ()` is no longer a way past the cap.
  */
-export declare function resolveQueryCollections(sqlString: string, schemas: Record<string, TableInfo[]>, collections: AdminCollection[], resultColumns?: string[]): ResolvedQueryCollection[];
-export interface PKMapping {
-    /** The actual column name in the database table */
-    dbColumn: string;
-    /** The column name as it appears in the query result set (may be aliased) */
-    resultColumn: string;
-}
-export interface TableAndPKResult {
-    tableName?: string;
-    primaryKeys?: PKMapping[];
-    error?: string;
-}
-export declare function determineTableAndPK(sqlString: string, columnKey: string, schemas: Record<string, TableInfo[]>): TableAndPKResult;
+export declare function withAutoLimit(sqlText: string, limit: number): string | null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rebasepro/studio",
-  "version": "0.22.0",
+  "version": "0.24.0",
   "description": "Rebase Studio — the SQL editor, schema visualiser, RLS policy editor and API explorer.",
   "keywords": [
     "rebase",
@@ -35,19 +35,19 @@
     "pgsql-ast-parser": "12.0.2",
     "prism-react-renderer": "^2.4.1",
     "react-dropzone": "^19.1.1",
-    "@rebasepro/cms-types": "0.22.0",
-    "@rebasepro/client": "0.22.0",
-    "@rebasepro/app": "0.22.0",
-    "@rebasepro/common": "0.22.0",
-    "@rebasepro/utils": "0.22.0",
-    "@rebasepro/ui": "0.22.0",
-    "@rebasepro/types": "0.22.0"
+    "@rebasepro/cms-types": "0.24.0",
+    "@rebasepro/app": "0.24.0",
+    "@rebasepro/client": "0.24.0",
+    "@rebasepro/ui": "0.24.0",
+    "@rebasepro/utils": "0.24.0",
+    "@rebasepro/common": "0.24.0",
+    "@rebasepro/types": "0.24.0"
   },
   "peerDependencies": {
     "react": "^19.2.7",
     "react-dom": "^19.2.7",
     "react-router": "^8.3.0",
-    "@rebasepro/cms": "0.22.0"
+    "@rebasepro/cms": "0.24.0"
   },
   "peerDependenciesMeta": {
     "@rebasepro/cms": {