okengine 0.14.1 → 0.15.2

package/src/console/server/spa-proxy.test.ts

@@ -61,6 +61,7 @@ describe("serveConsole spaProxy", () => {
     expect(html.status).toBe(200);
     expect(html.headers.get("content-security-policy")).toBe(CONSOLE_VITE_DEV_CSP);
     expect(html.headers.get("content-security-policy")).toContain("unsafe-inline");
+    expect(html.headers.get("content-security-policy")).toContain("frame-src 'self' blob:");
     expect(await html.text()).toContain("vite-spa");
 
     const client = await server.fetch(

package/src/console/server/sql-catalog.ts

@@ -31,6 +31,8 @@ import {
   parseSqlPolicySpec,
   quotePgIdent,
   sqlPolicyRowId,
+  emitStoreSchemaPolicySource,
+  installOkeRlsHelpers,
 } from "../../drivers/pg-rls.ts";
 import type { ConsoleStoreChild, ConsoleWillNotFire } from "./store.ts";
 
@@ -117,18 +119,52 @@ export async function listSqlTableRls(sql: SqlStoreHandle): Promise<ReadonlyMap<
 }
 
 /**
- * Copy RLS flags onto SQL table children. Catalog folders are unchanged.
+ * Live RLS policy counts (`pg_policies`) keyed by table name.
+ *
+ * Counts in process — memory SQL has no `GROUP BY` / `COUNT(*)::int`.
+ *
+ * @param sql - Open SQL handle
+ */
+export async function listSqlTablePolicyCounts(
+  sql: SqlStoreHandle,
+): Promise<ReadonlyMap<string, number>> {
+  try {
+    const rows = await sql.raw(`SELECT * FROM pg_policies`);
+    const out = new Map<string, number>();
+    for (const row of rows) {
+      if (!isAppCatalogSchema(row)) continue;
+      const name = stringOrNull(row.tablename ?? row.table);
+      if (name === null) continue;
+      out.set(name, (out.get(name) ?? 0) + 1);
+    }
+    return out;
+  } catch {
+    return new Map();
+  }
+}
+
+/**
+ * Copy RLS flags and policy counts onto SQL table children. Catalog folders
+ * are unchanged.
  *
  * @param children - Store list children
  * @param rlsByTable - Table name → RLS enabled
+ * @param declared - Manifest RLS when live catalog is empty
+ * @param policyCounts - Table name → live + declared policy count
  */
 export function applySqlTableRls(
   children: readonly ConsoleStoreChild[],
   rlsByTable: ReadonlyMap<string, boolean>,
+  declared?: ReadonlyMap<string, boolean>,
+  policyCounts?: ReadonlyMap<string, number>,
 ): ConsoleStoreChild[] {
   return children.map((child) => {
     if (child.kind !== "table") return child;
-    return { ...child, rls: rlsByTable.get(child.name) ?? child.rls === true };
+    return {
+      ...child,
+      rls: rlsByTable.get(child.name) ?? declared?.get(child.name) ?? child.rls === true,
+      rlsPolicyCount: policyCounts?.get(child.name) ?? child.rlsPolicyCount ?? 0,
+    };
   });
 }
 
@@ -156,6 +192,9 @@ export async function listSqlCatalog(
   limit: number,
 ): Promise<readonly Record<string, unknown>[]> {
   const live = await tryLiveCatalog(sql, kind, limit);
+  if (kind === "policy") {
+    return overlayDeclaredPolicies(live ?? [], manifest, storeName).slice(0, limit);
+  }
   if (live) return live;
   if (kind === "index") return manifestIndexes(manifest, storeName).slice(0, limit);
   if (kind === "extension") return fallbackExtensions().slice(0, limit);
@@ -172,6 +211,11 @@ export async function createSqlPolicy(
   sql: SqlStoreHandle,
   patch: Readonly<Record<string, unknown>>,
 ): Promise<void> {
+  try {
+    await installOkeRlsHelpers((stmt) => sql.raw(stmt));
+  } catch {
+    // Memory / engines without CREATE FUNCTION — CREATE POLICY may still run.
+  }
   const spec = parseSqlPolicySpec(patch);
   if (patch.enableRls === true) {
     await sql.raw(buildRowSecuritySql(spec.table, true));
@@ -393,11 +437,13 @@ function catalogColumnDescriptions(kind: SqlCatalogKind): Readonly<Record<string
     return {
       name: "Policy",
       table: "Table",
+      origin: "Declared or live-only",
       command: "Command",
       roles: "Roles",
       permissive: "Permissive or restrictive",
       using: "USING expression",
       with_check: "WITH CHECK expression",
+      code: "Copy as code",
     };
   }
   return {
@@ -459,19 +505,113 @@ function isAppCatalogSchema(row: Record<string, unknown>): boolean {
 function projectPolicyRow(row: Record<string, unknown>): Record<string, unknown> {
   const name = stringOrNull(row.name ?? row.policyname) ?? "";
   const table = stringOrNull(row.table ?? row.tablename) ?? "";
+  const command = stringOrNull(row.command ?? row.cmd) ?? "ALL";
+  const roles = rolesText(row.roles);
+  const using = stringOrNull(row.using ?? row.qual);
+  const withCheck = stringOrNull(row.with_check);
+  const permissive = stringOrNull(row.permissive) ?? "PERMISSIVE";
   return {
     id: sqlPolicyRowId(table, name),
     name,
     table,
     schema: stringOrNull(row.schema ?? row.schemaname) ?? "public",
-    command: stringOrNull(row.command ?? row.cmd) ?? "ALL",
-    roles: rolesText(row.roles),
-    permissive: stringOrNull(row.permissive) ?? "PERMISSIVE",
-    using: stringOrNull(row.using ?? row.qual),
-    with_check: stringOrNull(row.with_check),
+    command,
+    roles,
+    permissive,
+    using,
+    with_check: withCheck,
+    origin: stringOrNull(row.origin) ?? "live",
+    code: policyCopyAsCode({
+      name,
+      table,
+      command,
+      roles,
+      permissive,
+      using,
+      withCheck,
+    }),
   };
 }
 
+function overlayDeclaredPolicies(
+  live: readonly Record<string, unknown>[],
+  manifest: Manifest | null,
+  storeName: string,
+): Record<string, unknown>[] {
+  const byId = new Map<string, Record<string, unknown>>();
+  for (const row of live) {
+    byId.set(String(row.id), { ...row, origin: "live" });
+  }
+  for (const row of declaredPoliciesFromManifest(manifest, storeName)) {
+    const existing = byId.get(row.id);
+    byId.set(row.id, existing ? { ...existing, ...row, origin: "declared" } : row);
+  }
+  return [...byId.values()];
+}
+
+function declaredPoliciesFromManifest(
+  manifest: Manifest | null,
+  storeName: string,
+): Array<Record<string, unknown> & { readonly id: string }> {
+  const tables = manifest?.stores?.[storeName]?.tables ?? {};
+  const out: Array<Record<string, unknown> & { readonly id: string }> = [];
+  for (const [table, spec] of Object.entries(tables)) {
+    for (const [name, policy] of Object.entries(spec.policies ?? {})) {
+      const command = (policy.for ?? "all").toUpperCase();
+      const roles = Array.isArray(policy.to) ? policy.to.join(", ") : (policy.to ?? "public");
+      const permissive = (policy.as ?? "permissive").toUpperCase();
+      out.push({
+        id: sqlPolicyRowId(table, name),
+        name,
+        table,
+        schema: "public",
+        command,
+        roles,
+        permissive,
+        using: policy.using ?? null,
+        with_check: policy.withCheck ?? null,
+        origin: "declared",
+        code: policyCopyAsCode({
+          name,
+          table,
+          command,
+          roles,
+          permissive,
+          using: policy.using,
+          withCheck: policy.withCheck,
+        }),
+      });
+    }
+  }
+  return out;
+}
+
+function policyCopyAsCode(input: {
+  readonly name: string;
+  readonly table: string;
+  readonly command: string;
+  readonly roles: string;
+  readonly permissive: string;
+  readonly using?: string | null;
+  readonly withCheck?: string | null;
+}): string {
+  try {
+    return emitStoreSchemaPolicySource(
+      parseSqlPolicySpec({
+        name: input.name,
+        table: input.table,
+        command: input.command,
+        behavior: input.permissive,
+        roles: input.roles,
+        using: input.using ?? "",
+        withCheck: input.withCheck ?? "",
+      }),
+    );
+  } catch {
+    return "";
+  }
+}
+
 function projectTriggerRow(row: Record<string, unknown>): Record<string, unknown> {
   const enabled = row.enabled;
   return {

package/src/console/server/sql-rls.test.ts

@@ -41,4 +41,20 @@ describe("applySqlTableRls", () => {
     const rows = [{ ...child("comments"), rls: false }];
     expect(applySqlTableRls(rows, new Map())[0]?.rls).toBe(false);
   });
+
+  test("Manifest declared RLS wins when live catalog is empty", () => {
+    const out = applySqlTableRls([child("bookings")], new Map(), new Map([["bookings", true]]));
+    expect(out[0]?.rls).toBe(true);
+  });
+
+  test("stamps policy counts on tables and leaves catalog folders alone", () => {
+    const out = applySqlTableRls(
+      [child("comments"), child("policies", "policy")],
+      new Map([["comments", true]]),
+      undefined,
+      new Map([["comments", 2]]),
+    );
+    expect(out.find((row) => row.name === "comments")?.rlsPolicyCount).toBe(2);
+    expect(out.find((row) => row.name === "policies")?.rlsPolicyCount).toBeUndefined();
+  });
 });

package/src/console/server/state.ts

@@ -267,13 +267,21 @@ export interface ConsoleState {
       readonly revealPii?: boolean;
       readonly tenant?: string;
       readonly asGate?: string;
+      readonly asUserId?: string;
+      readonly rls?: import("../../drivers/pg-rls.ts").RlsIdentity;
     },
   ) => Promise<{
     readonly rows: readonly Record<string, unknown>[];
     readonly masked: boolean;
     readonly routedRole: "primary" | "replica";
     readonly asGate: string | null;
+    readonly asUserId: string | null;
     readonly gateApplied: boolean;
+    readonly rls: {
+      readonly gate: string | null;
+      readonly userId: string;
+      readonly applied: boolean;
+    };
   }>;
   /** Engine-native pg_stat_statements + KPIs. */
   queryStoreSqlStats: (ref: ResourceRef) => Promise<import("./store-stats.ts").StoreSqlStatsResult>;

package/src/console/server/store.test.ts

@@ -578,10 +578,11 @@ describe("queryStore SQL catalog", () => {
       declaredFingerprint: "x",
       appliedFingerprint: "x",
     });
-    expect(
-      listedOn.stores.find((s) => s.ref === "sql:db")?.children.find((c) => c.name === "bookings")
-        ?.rls,
-    ).toBe(true);
+    const listedBookings = listedOn.stores
+      .find((s) => s.ref === "sql:db")
+      ?.children.find((c) => c.name === "bookings");
+    expect(listedBookings?.rls).toBe(true);
+    expect(listedBookings?.rlsPolicyCount).toBe(1);
 
     await editStore(
       runtime,
@@ -1097,7 +1098,9 @@ describe("runStoreSql", () => {
       asGate: "public",
     });
     expect(result.asGate).toBe("public");
+    expect(result.asUserId).toBeNull();
     expect(result.gateApplied).toBe(false);
+    expect(result.rls.applied).toBe(false);
     expect(result.rows).toHaveLength(1);
     await runtime.close();
   });

package/src/console/server/store.ts

@@ -29,6 +29,7 @@ import {
   type SqlStoreHandle,
   type StoreRuntime,
 } from "../../elements/store.ts";
+import { RLS_CONTEXT_DRIVERS, type RlsIdentity } from "../../drivers/pg-rls.ts";
 import { DryRunWriteIsolationError, withDryRun } from "../../kernel/dry-run.ts";
 import { addPiiFieldName, piiNameAliases, PII_MASK } from "../../elements/store/classify.ts";
 import { rankIndexHits } from "./index-search.ts";
@@ -54,6 +55,7 @@ import {
   dropSqlPolicy,
   applySqlTableRls,
   listSqlCatalog,
+  listSqlTablePolicyCounts,
   listSqlTableRls,
   setSqlExtension,
   setSqlRowSecurity,
@@ -107,6 +109,8 @@ export interface ConsoleStoreChild {
   readonly columnDescriptions: Readonly<Record<string, string>>;
   /** Live RLS (`pg_class.relrowsecurity`) when the engine can report it. */
   readonly rls?: boolean;
+  /** Live + declared RLS policy count when the child is a SQL table. */
+  readonly rlsPolicyCount?: number;
 }
 
 /** One row in `console.store.list`. */
@@ -183,6 +187,7 @@ export async function projectStoresList(options: ProjectStoresOptions): Promise<
       ref,
       facet,
       childrenOf(manifest!, name, facet, store),
+      store.tables,
     );
     const replicaLagMs = facet === "sql" ? latestReplicaLag(options.runs ?? [], children) : null;
 
@@ -291,14 +296,54 @@ async function withSqlTableRls(
   ref: ResourceRef,
   facet: StoreFacet,
   children: readonly ConsoleStoreChild[],
+  tables?: NonNullable<Manifest["stores"]>[string]["tables"],
 ): Promise<readonly ConsoleStoreChild[]> {
-  if (facet !== "sql" || runtime === null) return children;
+  const declared = declaredTableRls(tables);
+  const declaredCounts = declaredTablePolicyCounts(tables);
+  if (facet !== "sql" || runtime === null) {
+    return applySqlTableRls(children, new Map(), declared, declaredCounts);
+  }
   try {
     const sql = (await runtime.openRef(ref, { effects: { reads: [ref] } })) as SqlStoreHandle;
-    return applySqlTableRls(children, await listSqlTableRls(sql));
+    const policyCounts = mergePolicyCounts(await listSqlTablePolicyCounts(sql), declaredCounts);
+    return applySqlTableRls(children, await listSqlTableRls(sql), declared, policyCounts);
   } catch {
-    return children;
+    return applySqlTableRls(children, new Map(), declared, declaredCounts);
+  }
+}
+
+function declaredTableRls(
+  tables: NonNullable<Manifest["stores"]>[string]["tables"] | undefined,
+): ReadonlyMap<string, boolean> {
+  const out = new Map<string, boolean>();
+  for (const [name, table] of Object.entries(tables ?? {})) {
+    if (table.rls === true || Object.keys(table.policies ?? {}).length > 0) {
+      out.set(name, true);
+    }
+  }
+  return out;
+}
+
+function declaredTablePolicyCounts(
+  tables: NonNullable<Manifest["stores"]>[string]["tables"] | undefined,
+): ReadonlyMap<string, number> {
+  const out = new Map<string, number>();
+  for (const [name, table] of Object.entries(tables ?? {})) {
+    const n = Object.keys(table.policies ?? {}).length;
+    if (n > 0) out.set(name, n);
   }
+  return out;
+}
+
+function mergePolicyCounts(
+  live: ReadonlyMap<string, number>,
+  declared: ReadonlyMap<string, number>,
+): Map<string, number> {
+  const out = new Map(declared);
+  for (const [name, n] of live) {
+    out.set(name, Math.max(n, out.get(name) ?? 0));
+  }
+  return out;
 }
 
 function columnDescriptionsFor(
@@ -411,6 +456,9 @@ export interface StoreQueryInput {
   readonly q?: string;
   readonly topK?: number;
   readonly revealPii?: boolean;
+  readonly asGate?: string;
+  readonly asUserId?: string;
+  readonly rls?: RlsIdentity;
 }
 
 /** Query result shape. */
@@ -436,6 +484,11 @@ export interface StoreQueryResult {
   readonly facetDistribution?: Record<string, Record<string, number>>;
   readonly masked: boolean;
   readonly routedRole?: "primary" | "replica";
+  readonly rls?: {
+    readonly gate: string | null;
+    readonly userId: string;
+    readonly applied: boolean;
+  };
 }
 
 const KV_TTL_RE = /^(\d+)(ms|s|m|h|d)$/;
@@ -508,18 +561,27 @@ export async function queryStore(
 ): Promise<StoreQueryResult> {
   const [facet] = input.ref.split(":") as [StoreFacet, string];
   const effects: Effects = { reads: [input.ref] };
+  const catalog = input.child ? sqlCatalogKind(input.child) : null;
+  const rls = catalog ? undefined : input.rls;
   const handle = await runtime.openRef(input.ref, {
     effects,
     revealPii: input.revealPii === true,
+    ...(rls ? { rls } : {}),
   });
 
   if (facet === "sql") {
     const sql = handle as SqlStoreHandle;
     const table = input.child;
+    const stamped = rlsStamp(sql.driverId, rls);
     if (!table) {
-      return { facet, rows: [], masked: !input.revealPii, routedRole: sql.routedRole };
+      return {
+        facet,
+        rows: [],
+        masked: !input.revealPii,
+        routedRole: sql.routedRole,
+        ...(stamped ? { rls: stamped } : {}),
+      };
     }
-    const catalog = sqlCatalogKind(table);
     if (catalog) {
       const storeName = input.ref.split(":")[1] ?? "";
       const rows = await listSqlCatalog(sql, catalog, manifest, storeName, input.limit ?? 200);
@@ -540,6 +602,7 @@ export async function queryStore(
         rows,
         masked: !input.revealPii,
         routedRole: sql.routedRole,
+        ...(stamped ? { rls: stamped } : {}),
       };
     } catch {
       // Table may not exist yet — empty browse.
@@ -548,6 +611,7 @@ export async function queryStore(
         rows: [],
         masked: !input.revealPii,
         routedRole: sql.routedRole,
+        ...(stamped ? { rls: stamped } : {}),
       };
     }
   }
@@ -765,6 +829,9 @@ export interface StoreEditInput {
   readonly confirmation?: string;
   readonly reason?: string;
   readonly confirmed?: boolean;
+  readonly asGate?: string;
+  readonly asUserId?: string;
+  readonly rls?: RlsIdentity;
 }
 
 /** Result of a direct store edit (preview or applied). */
@@ -777,6 +844,11 @@ export interface StoreEditResult {
     readonly kind: "send" | "ask";
     readonly resource: string;
   }>;
+  readonly rls?: {
+    readonly gate: string | null;
+    readonly userId: string;
+    readonly applied: boolean;
+  };
 }
 
 /**
@@ -818,6 +890,15 @@ export async function editStore(
         willNotFire,
         applied: false,
         wouldHaveFired,
+        ...(input.rls
+          ? {
+              rls: {
+                gate: input.rls.gate,
+                userId: input.rls.userId,
+                applied: false,
+              },
+            }
+          : {}),
       };
     } catch (err) {
       await restoreEditTarget(runtime, snapshot);
@@ -828,7 +909,12 @@ export async function editStore(
     }
   }
 
-  await applyEdit(runtime, input, { revealPii: false, persistMeta: true }, manifest);
+  const appliedRls = await applyEdit(
+    runtime,
+    input,
+    { revealPii: false, persistMeta: true },
+    manifest,
+  );
   // Direct edit: invalidate cache for written resource (effects-derived).
   runtime.onWriteEffects({ writes: [effectRef] });
   void options.production;
@@ -838,6 +924,7 @@ export async function editStore(
     willNotFire,
     applied: true,
     wouldHaveFired: [],
+    ...(appliedRls ? { rls: appliedRls } : {}),
   };
 }
 
@@ -1125,11 +1212,14 @@ async function applyEdit(
   input: StoreEditInput,
   ctx: { readonly revealPii: boolean; readonly persistMeta?: boolean },
   manifest?: Manifest | null,
-): Promise<void> {
+): Promise<StoreEditResult["rls"] | undefined> {
   const [facet] = input.ref.split(":") as [StoreFacet, string];
+  const catalog = input.child ? sqlCatalogKind(input.child) : null;
+  const rls = catalog ? undefined : input.rls;
   const handle = await runtime.openRef(input.ref, {
     effects: { writes: [input.ref] },
     revealPii: ctx.revealPii,
+    ...(rls ? { rls } : {}),
   });
 
   if (facet === "files") {
@@ -1242,12 +1332,12 @@ async function applyEdit(
         `INSERT INTO "${table}" (${columns}) VALUES (${placeholders})`,
         sets.map((c) => input.patch[c]),
       );
-      return;
+      return rlsStamp(sql.driverId, rls);
     }
     const assignments = sets.map((c) => `"${c}" = ?`).join(", ");
     const params = [...sets.map((c) => input.patch[c]), id];
     await sql.raw(`UPDATE "${table}" SET ${assignments} WHERE "id" = ?`, params);
-    return;
+    return rlsStamp(sql.driverId, rls);
   }
 
   throw new Error(`direct edit not supported for facet ${facet}`);
@@ -1383,7 +1473,23 @@ export function isKnownConsoleSqlGate(manifest: Manifest | null, name: string):
   return gate.kind !== "rate" && !name.startsWith("rate:");
 }
 
-const GATE_CONTEXT_DRIVERS = new Set<SqlStoreHandle["driverId"]>(["postgres", "pglite"]);
+function rlsStamp(
+  driverId: string,
+  identity: RlsIdentity | undefined,
+):
+  | {
+      readonly gate: string | null;
+      readonly userId: string;
+      readonly applied: boolean;
+    }
+  | undefined {
+  if (!identity) return undefined;
+  return {
+    gate: identity.gate,
+    userId: identity.userId,
+    applied: RLS_CONTEXT_DRIVERS.has(driverId),
+  };
+}
 
 /** DML / DDL heads — keep in sync with `isSqlWrite` in the query console. */
 const STORE_SQL_WRITE_HEADS = new Set([
@@ -1434,72 +1540,50 @@ export async function runStoreSql(
     readonly allowWrite: boolean;
     readonly revealPii?: boolean;
     readonly tenant?: string;
-    /** View rows as this Gate (`oke.gate` GUC on postgres / pglite). */
+    /** View rows as this Gate (`oke.gate` on postgres / pglite). */
     readonly asGate?: string;
+    readonly asUserId?: string;
+    readonly rls?: RlsIdentity;
   },
 ): Promise<{
   readonly rows: readonly Record<string, unknown>[];
   readonly masked: boolean;
   readonly routedRole: "primary" | "replica";
   readonly asGate: string | null;
+  readonly asUserId: string | null;
   readonly gateApplied: boolean;
+  readonly rls: {
+    readonly gate: string | null;
+    readonly userId: string;
+    readonly applied: boolean;
+  };
 }> {
   const trimmed = sqlText.trim().replace(/;+\s*$/, "");
   const isWrite = isStoreSqlWrite(trimmed);
   if (isWrite && !options.allowWrite) {
     throw new Error("SQL console is read-only by default — write requires console:store.sql:write");
   }
+  const rls = options.rls;
   const handle = (await runtime.openRef(ref, {
     effects: isWrite ? { writes: [ref] } : { reads: [ref] },
     revealPii: options.revealPii === true,
+    ...(rls ? { rls } : {}),
   })) as SqlStoreHandle;
-  const asGate = options.asGate?.trim() || null;
-  let gateApplied = false;
-  try {
-    if (asGate) gateApplied = await applySqlGateContext(handle, asGate);
-    const rows = await handle.raw(trimmed);
-    if (gateApplied) await handle.raw("COMMIT");
-    return {
-      rows,
-      masked: !options.revealPii,
-      routedRole: handle.routedRole,
-      asGate,
-      gateApplied,
-    };
-  } catch (err) {
-    if (gateApplied) {
-      try {
-        await handle.raw("ROLLBACK");
-      } catch {
-        // Connection may already be idle after a failed SET.
-      }
-    }
-    throw err;
-  }
-}
-
-/**
- * Open a transaction and set `oke.gate` + `row_security` for RLS simulation.
- * No-op on memory SQL.
- *
- * @param handle - Open SQL handle
- * @param gate - Validated Gate name
- */
-async function applySqlGateContext(handle: SqlStoreHandle, gate: string): Promise<boolean> {
-  if (!GATE_CONTEXT_DRIVERS.has(handle.driverId)) return false;
-  try {
-    await handle.raw("BEGIN");
-    await handle.raw("SET LOCAL row_security = on");
-    await handle.raw("SELECT set_config('oke.gate', ?, true)", [gate]);
-    return true;
-  } catch {
-    try {
-      await handle.raw("ROLLBACK");
-    } catch {
-      // ignore
-    }
-    return false;
-  }
+  const stamped = rlsStamp(handle.driverId, rls) ?? {
+    gate: rls?.gate ?? options.asGate?.trim() ?? null,
+    userId: rls?.userId ?? options.asUserId?.trim() ?? "",
+    applied: false,
+  };
+  const rows = await handle.raw(trimmed);
+  return {
+    rows,
+    masked: !options.revealPii,
+    routedRole: handle.routedRole,
+    asGate: stamped.gate,
+    asUserId: stamped.userId.length > 0 ? stamped.userId : options.asUserId?.trim() || null,
+    gateApplied: stamped.applied,
+    rls: stamped,
+  };
 }
 
 /**

package/src/console/ui-next/dist/assets/agent-disclosure-C0X1fbWF.js

@@ -0,0 +1 @@
+import{wr as e}from"./shortcut-keys-CoqwEIi0.js";import{A as t}from"./xyflow-D7n4g6go.js";import{V as n,n as r,t as i}from"./react-D8E3mtu1.js";var a=t();function o({open:t,openHeight:o=`auto`,className:s,style:c,transition:l,...u}){let d=r()??!1;return(0,a.jsx)(i.div,{...u,"aria-hidden":!t,inert:!t||void 0,initial:!1,animate:d?{opacity:+!!t}:{opacity:+!!t,clipPath:t?`inset(0 0 0% 0)`:`inset(0 0 100% 0)`,y:t?0:-4},transition:l??{duration:d?0:t?.22:.14,ease:n},className:e(`overflow-hidden`,s),style:{...c,height:t?o:0,pointerEvents:t?void 0:`none`,transformOrigin:`top`}})}export{o as t};