npm - okengine - Versions diffs - 0.14.1 → 0.15.2 - Mend

okengine 0.14.1 → 0.15.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (205) hide show

package/package.json +3 -4
package/site/content/docs/elements/ai.mdx +2 -1
package/site/content/docs/elements/channel.mdx +1 -0
package/site/content/docs/elements/clock.mdx +3 -0
package/site/content/docs/elements/flow.mdx +3 -0
package/site/content/docs/elements/gate.mdx +25 -22
package/site/content/docs/elements/signal.mdx +4 -4
package/site/content/docs/elements/store.mdx +86 -27
package/site/content/docs/elements/vault.mdx +1 -0
package/site/content/docs/get-started/basic-usage.mdx +22 -13
package/site/content/docs/get-started/index.mdx +5 -0
package/site/content/docs/get-started/introduction.mdx +11 -3
package/site/content/docs/get-started/meta.json +1 -1
package/site/content/docs/get-started/project-structure.mdx +932 -0
package/site/content/docs/reference/cli.md +13 -10
package/site/content/docs/reference/client.mdx +25 -21
package/site/content/docs/reference/security.md +1 -1
package/src/auth/bindings.ts +14 -5
package/src/auth/cross-plane.ts +10 -3
package/src/cli/ai-setup/ai-setup.test.ts +62 -0
package/src/cli/ai-setup/apply.ts +32 -1
package/src/cli/attach-host-console.test.ts +3 -2
package/src/cli/attach-host-console.ts +3 -0
package/src/cli/build.test.ts +4 -2
package/src/cli/db-seed.ts +48 -15
package/src/cli/db.test.ts +104 -0
package/src/cli/db.ts +122 -10
package/src/cli/dev-controls.test.ts +20 -0
package/src/cli/dev-controls.ts +13 -0
package/src/cli/dev.test.ts +15 -4
package/src/cli/dev.ts +102 -29
package/src/cli/ensure-drizzle-config.ts +2 -1
package/src/cli/tui/DevLive.tsx +12 -2
package/src/cli/tui/keys.test.ts +2 -1
package/src/cli/tui/keys.ts +3 -2
package/src/compiler/aot.test.ts +1 -1
package/src/compiler/extract.test.ts +409 -33
package/src/compiler/extract.ts +318 -67
package/src/compiler/flow-path.test.ts +96 -0
package/src/compiler/flow-path.ts +173 -0
package/src/compiler/generate-adopt.test.ts +112 -3
package/src/compiler/generate-adopt.ts +280 -26
package/src/compiler/schema-from-ast.ts +609 -0
package/src/console/server/bind.ts +2 -2
package/src/console/server/console.test.ts +3 -0
package/src/console/server/flows.ts +120 -40
package/src/console/server/invoke-user-flow.test.ts +3 -1
package/src/console/server/invoke-user-flow.ts +17 -2
package/src/console/server/iso-at.test.ts +9 -0
package/src/console/server/iso-at.ts +11 -0
package/src/console/server/security-headers.ts +6 -3
package/src/console/server/spa-proxy.test.ts +1 -0
package/src/console/server/sql-catalog.ts +147 -7
package/src/console/server/sql-rls.test.ts +16 -0
package/src/console/server/state.ts +8 -0
package/src/console/server/store.test.ts +7 -4
package/src/console/server/store.ts +142 -58
package/src/console/ui-next/dist/assets/agent-disclosure-C0X1fbWF.js +1 -0
package/src/console/ui-next/dist/assets/{cache-glyph-BanhLsEY.js → cache-glyph-F1FI122b.js} +1 -1
package/src/console/ui-next/dist/assets/{call-pii-button-bqkxMrJH.js → call-pii-button-DEDCl_j3.js} +1 -1
package/src/console/ui-next/dist/assets/collapsible-LPqGvfoz.js +1 -0
package/src/console/ui-next/dist/assets/{confirm-sheet-DDCRmG62.js → confirm-sheet-3ptDzXbz.js} +1 -1
package/src/console/ui-next/dist/assets/{duration-tone-oiRxPVsZ.js → duration-tone-sC3lGABz.js} +1 -1
package/src/console/ui-next/dist/assets/{explorer-empty-HjTnVQoR.js → explorer-empty-BvYrygyO.js} +1 -1
package/src/console/ui-next/dist/assets/flows-page-Dluo1Bd7.js +1 -0
package/src/console/ui-next/dist/assets/{highlighted-json-CvDPvveV.js → highlighted-json-CS_O8L-r.js} +1 -1
package/src/console/ui-next/dist/assets/http-method--sWDdXSB.js +1 -0
package/src/console/ui-next/dist/assets/index-Ca3HZMVq.js +66 -0
package/src/console/ui-next/dist/assets/index-UtTDRQpS.css +2 -0
package/src/console/ui-next/dist/assets/{link-DF7SZ9Ek.js → link-COeyggt-.js} +1 -1
package/src/console/ui-next/dist/assets/{observability-page-BEZDzyYh.js → observability-page-HK9-BO8z.js} +2 -2
package/src/console/ui-next/dist/assets/react-D8E3mtu1.js +1 -0
package/src/console/ui-next/dist/assets/replica-lag-DBIFFf7d.js +18 -0
package/src/console/ui-next/dist/assets/sheet-form-Dnwa5oOR.js +1 -0
package/src/console/ui-next/dist/assets/shortcut-keys-CoqwEIi0.js +1 -0
package/src/console/ui-next/dist/assets/skeleton-BHcfDYcb.js +1 -0
package/src/console/ui-next/dist/assets/store-page-BSohH3wM.js +41 -0
package/src/console/ui-next/dist/assets/trace-detail-sheet-CFIGRnnA.js +2 -0
package/src/console/ui-next/dist/assets/tree-expand-toggle-BgLl34w7.js +54 -0
package/src/console/ui-next/dist/assets/units-page-B0cFE76A.js +1 -0
package/src/console/ui-next/dist/assets/{use-vault-list-Cl79j_ku.js → use-vault-list-BLbZhzyF.js} +1 -1
package/src/console/ui-next/dist/assets/vault-page-B1SbYe10.js +2 -0
package/src/console/ui-next/dist/index.html +6 -6
package/src/console/ui-next/src/client.ts +35 -7
package/src/console/ui-next/src/components/motion/table/index.tsx +16 -0
package/src/console/ui-next/src/components/motion/table/types.ts +4 -0
package/src/console/ui-next/src/components/ui/kbd.tsx +2 -2
package/src/console/ui-next/src/features/flows/traces/http-method.ts +19 -0
package/src/console/ui-next/src/features/flows/traces/trace-detail.test.ts +19 -1
package/src/console/ui-next/src/features/flows/traces/traces-pane.tsx +10 -3
package/src/console/ui-next/src/features/store/detail/browse-section.tsx +45 -1
package/src/console/ui-next/src/features/store/detail/resource-panel.tsx +78 -16
package/src/console/ui-next/src/features/store/detail/store-row-detail-sheet.tsx +155 -14
package/src/console/ui-next/src/features/store/explorer/store-tree.tsx +33 -133
package/src/console/ui-next/src/features/store/files/file-preview.tsx +4 -1
package/src/console/ui-next/src/features/store/grid/rls-policy-sheet.tsx +326 -165
package/src/console/ui-next/src/features/store/grid/sql-insert-sheet.tsx +6 -0
package/src/console/ui-next/src/features/store/grid/store-data-grid.tsx +50 -3
package/src/console/ui-next/src/features/store/lib/files-meta.test.ts +3 -0
package/src/console/ui-next/src/features/store/lib/files-meta.ts +12 -0
package/src/console/ui-next/src/features/store/lib/query-defaults.test.ts +25 -0
package/src/console/ui-next/src/features/store/lib/query-defaults.ts +85 -3
package/src/console/ui-next/src/features/store/lib/query-gate.ts +30 -4
package/src/console/ui-next/src/features/store/lib/rls-policy.test.ts +139 -0
package/src/console/ui-next/src/features/store/lib/rls-policy.ts +223 -21
package/src/console/ui-next/src/features/store/lib/schema-graph.ts +4 -0
package/src/console/ui-next/src/features/store/lib/sql-catalog.test.ts +24 -0
package/src/console/ui-next/src/features/store/lib/sql-catalog.ts +19 -0
package/src/console/ui-next/src/features/store/lib/store-tree.test.ts +6 -0
package/src/console/ui-next/src/features/store/lib/store-tree.ts +13 -0
package/src/console/ui-next/src/features/store/query/query-console.tsx +48 -14
package/src/console/ui-next/src/features/store/query/query-gate-menu.tsx +19 -20
package/src/console/ui-next/src/features/store/query/query-gate-parts.tsx +2 -1
package/src/console/ui-next/src/features/store/query/query-results.tsx +110 -83
package/src/console/ui-next/src/features/store/schema/schema-table-node.tsx +17 -0
package/src/console/ui-next/src/features/units/call/call-api-panel.tsx +112 -72
package/src/console/ui-next/src/features/units/lib/contract-input.test.ts +206 -1
package/src/console/ui-next/src/features/units/lib/contract-input.ts +55 -0
package/src/console/ui-next/src/features/vault/lib/types.ts +1 -1
package/src/docker/compose-health.test.ts +27 -0
package/src/docker/compose-health.ts +19 -3
package/src/docker/docker.test.ts +3 -0
package/src/docker/recipes/pgdog.ts +2 -0
package/src/drivers/clock-postgres.ts +13 -9
package/src/drivers/instances-postgres.ts +4 -6
package/src/drivers/journal-postgres.ts +13 -9
package/src/drivers/pg-rls.test.ts +87 -0
package/src/drivers/pg-rls.ts +233 -7
package/src/drivers/pglite.ts +26 -3
package/src/drivers/postgres.test.ts +23 -0
package/src/drivers/postgres.ts +133 -9
package/src/drivers/types.ts +10 -0
package/src/elements/clock/declare.ts +26 -1
package/src/elements/gate/boot.ts +5 -5
package/src/elements/gate/declare.ts +36 -4
package/src/elements/gate/flatten.ts +1 -1
package/src/elements/gate/runtime.ts +1 -1
package/src/elements/store/declare.ts +9 -6
package/src/elements/store/emit-drizzle.ts +44 -8
package/src/elements/store/resource.test.ts +1 -1
package/src/elements/store/rls-identity.test.ts +95 -0
package/src/elements/store/rls-identity.ts +116 -0
package/src/elements/store/runtime.ts +4 -0
package/src/elements/store/schema-decl.test.ts +37 -0
package/src/elements/store/schema-decl.ts +161 -0
package/src/elements/store/seed.ts +1 -1
package/src/elements/store/sql-condition.test.ts +12 -0
package/src/elements/store/sql-condition.ts +26 -2
package/src/elements/store/sql-rls-isolation.test.ts +165 -0
package/src/elements/store/sql-rls-stamp.test.ts +117 -0
package/src/elements/store/sql-session.ts +81 -3
package/src/elements/store/upsert-app.test.ts +1 -1
package/src/elements/store.ts +14 -0
package/src/http.ts +20 -3
package/src/index.ts +10 -1
package/src/kernel/adopt-barrel-fresh.test.ts +1 -1
package/src/kernel/adopt-routes.ts +30 -2
package/src/kernel/app.ts +131 -14
package/src/kernel/auto-cache.test.ts +8 -8
package/src/kernel/auto-registry.test.ts +49 -9
package/src/kernel/boot.test.ts +4 -4
package/src/kernel/boot.ts +2 -2
package/src/kernel/effects-stamping.test.ts +3 -3
package/src/kernel/element-registries.ts +12 -5
package/src/kernel/errors.ts +24 -0
package/src/kernel/flow-units.ts +64 -0
package/src/kernel/flow.ts +29 -17
package/src/kernel/fx.ts +23 -0
package/src/kernel/horizontal-child.ts +4 -4
package/src/kernel/http-path-pending.ts +20 -0
package/src/kernel/http-resource.ts +4 -0
package/src/kernel/http-stream.test.ts +4 -4
package/src/kernel/pipeline.test.ts +2 -2
package/src/kernel/plugin-elements.test.ts +1 -1
package/src/kernel/plugin-needs.test.ts +1 -1
package/src/kernel/ready.test.ts +2 -2
package/src/kernel/resource-mount.test.ts +14 -0
package/src/kernel/run-duration.test.ts +2 -2
package/src/kernel/stamp-http.test.ts +79 -0
package/src/kernel/stamp-http.ts +75 -0
package/src/kernel/triggers.ts +52 -27
package/src/manifest/types.ts +13 -0
package/src/release/measure.ts +2 -2
package/src/runtime/json-code-block.test.ts +2 -2
package/src/runtime/serve.test.ts +4 -4
package/src/term.test.ts +52 -4
package/src/term.ts +125 -17
package/src/test/reset-element-registries.ts +8 -3
package/src/cli/ask-seed.test.ts +0 -96
package/src/cli/ask-seed.ts +0 -82
package/src/console/ui-next/dist/assets/collapsible-DYb0xU8C.js +0 -1
package/src/console/ui-next/dist/assets/flows-page-DxDsOd4f.js +0 -1
package/src/console/ui-next/dist/assets/http-method-CJCBYL2j.js +0 -1
package/src/console/ui-next/dist/assets/index-Ce6WKWKM.js +0 -66
package/src/console/ui-next/dist/assets/index-D4Ldtj79.css +0 -2
package/src/console/ui-next/dist/assets/query-gate-parts-1m8m1iNp.js +0 -2
package/src/console/ui-next/dist/assets/react-B1ML8gxg.js +0 -1
package/src/console/ui-next/dist/assets/replica-lag-C8_BRt2x.js +0 -18
package/src/console/ui-next/dist/assets/sheet-form-D-ata7jy.js +0 -1
package/src/console/ui-next/dist/assets/shortcut-keys-DO4IsVqv.js +0 -1
package/src/console/ui-next/dist/assets/skeleton-CL_X0GCj.js +0 -1
package/src/console/ui-next/dist/assets/store-page-v3LXdYpr.js +0 -45
package/src/console/ui-next/dist/assets/trace-detail-sheet-DFLFfUUX.js +0 -2
package/src/console/ui-next/dist/assets/units-page-C0gW6Kdo.js +0 -1
package/src/console/ui-next/dist/assets/vault-page-DuKzqwzW.js +0 -2

package/src/console/ui-next/dist/index.html CHANGED Viewed

@@ -37,18 +37,18 @@
         } catch (e) {}
       })();
     </script>
-    <script type="module" crossorigin src="/assets/index-Ce6WKWKM.js"></script>
+    <script type="module" crossorigin src="/assets/index-Ca3HZMVq.js"></script>
     <link rel="modulepreload" crossorigin href="/assets/rolldown-runtime-hePW80VL.js">
     <link rel="modulepreload" crossorigin href="/assets/react-dom-Bph1y7z7.js">
     <link rel="modulepreload" crossorigin href="/assets/xyflow-D7n4g6go.js">
-    <link rel="modulepreload" crossorigin href="/assets/shortcut-keys-DO4IsVqv.js">
-    <link rel="modulepreload" crossorigin href="/assets/link-DF7SZ9Ek.js">
-    <link rel="modulepreload" crossorigin href="/assets/skeleton-CL_X0GCj.js">
-    <link rel="modulepreload" crossorigin href="/assets/react-B1ML8gxg.js">
+    <link rel="modulepreload" crossorigin href="/assets/shortcut-keys-CoqwEIi0.js">
+    <link rel="modulepreload" crossorigin href="/assets/link-COeyggt-.js">
+    <link rel="modulepreload" crossorigin href="/assets/skeleton-BHcfDYcb.js">
+    <link rel="modulepreload" crossorigin href="/assets/react-D8E3mtu1.js">
     <link rel="modulepreload" crossorigin href="/assets/preload-helper-oH4irX4C.js">
     <link rel="modulepreload" crossorigin href="/assets/shortcut-Cgzuv4k1.js">
     <link rel="stylesheet" crossorigin href="/assets/xyflow-DZ0Ws1xk.css">
-    <link rel="stylesheet" crossorigin href="/assets/index-D4Ldtj79.css">
+    <link rel="stylesheet" crossorigin href="/assets/index-UtTDRQpS.css">
   </head>
   <body>
     <div id="root"></div>

package/src/console/ui-next/src/client.ts CHANGED Viewed

@@ -446,7 +446,7 @@ export type TracesReplayResult = {
   readonly ok: true;
   readonly rootId: string;
   readonly dryRun: boolean;
-  readonly at: number;
+  readonly at: string;
   readonly flow: string;
 };
@@ -506,6 +506,11 @@ export type FlowsInvokeResult = {
   readonly flowId: string;
   readonly asUserId: string;
   readonly asGate?: string | null;
+  readonly rls?: {
+    readonly gate: string | null;
+    readonly userId: string;
+    readonly applied: boolean;
+  };
   readonly trigger: string;
   readonly response: unknown;
   /** True when classified PII keys were redacted. */
@@ -674,7 +679,7 @@ export type ClockRunNowResult = {
   readonly ok: true;
   readonly name: string;
   readonly ran: boolean;
-  readonly at: number;
+  readonly at: string;
 };
 /**
@@ -721,6 +726,8 @@ export type StoreListChild = {
   readonly columnDescriptions: Readonly<Record<string, string>>;
   /** Live RLS when the engine reported `pg_class.relrowsecurity`. */
   readonly rls?: boolean;
+  /** Live + declared RLS policy count when the child is a SQL table. */
+  readonly rlsPolicyCount?: number;
 };
 /** One store row from `GET /console/store` (matches server `StoreListOut`). */
@@ -772,6 +779,8 @@ export type StoreQueryInput = {
   readonly topK?: number;
   /** When true, SQL browse returns PII cleartext (audited). Default masks. */
   readonly revealPii?: boolean;
+  readonly asGate?: string;
+  readonly asUserId?: string;
 };
 /** Success payload from `QUERY /console/store/query` (matches server `StoreQueryOut`). */
@@ -793,6 +802,11 @@ export type StoreQueryResult = {
   }>;
   readonly masked: boolean;
   readonly routedRole?: "primary" | "replica";
+  readonly rls?: {
+    readonly gate: string | null;
+    readonly userId: string;
+    readonly applied: boolean;
+  };
 };
 /**
@@ -822,7 +836,7 @@ export type StoreRevealInput = {
 export type StoreRevealResult = {
   readonly ok: true;
   readonly value: unknown;
-  readonly at: number;
+  readonly at: string;
 };
 /**
@@ -851,6 +865,8 @@ export type StoreEditInput = {
   readonly confirmation?: string;
   readonly reason?: string;
   readonly commit?: boolean;
+  readonly asGate?: string;
+  readonly asUserId?: string;
 };
 /** Success payload from `POST /console/store/edit` (matches server). */
@@ -863,7 +879,12 @@ export type StoreEditResult = {
     readonly kind: "send" | "ask";
     readonly resource: string;
   }>;
-  readonly at: number;
+  readonly at: string;
+  readonly rls?: {
+    readonly gate: string | null;
+    readonly userId: string;
+    readonly applied: boolean;
+  };
 };
 /**
@@ -907,7 +928,7 @@ export type StoreDeleteInput = {
 export type StoreDeleteResult = {
   readonly ok: true;
   readonly deleted: number;
-  readonly at: number;
+  readonly at: string;
 };
 /**
@@ -934,6 +955,7 @@ export type StoreSqlInput = {
   readonly revealPii?: boolean;
   /** View rows as this Gate (`oke.gate` on postgres / pglite). */
   readonly asGate?: string;
+  readonly asUserId?: string;
 };
 /** Success payload from `POST /console/store/sql` (matches server `StoreSqlOut`). */
@@ -942,7 +964,13 @@ export type StoreSqlResult = {
   readonly masked: boolean;
   readonly routedRole: "primary" | "replica";
   readonly asGate: string | null;
+  readonly asUserId: string | null;
   readonly gateApplied: boolean;
+  readonly rls?: {
+    readonly gate: string | null;
+    readonly userId: string;
+    readonly applied: boolean;
+  };
 };
 /**
@@ -1267,7 +1295,7 @@ export type VaultWriteResult = {
   readonly ok: true;
   readonly name: string;
   readonly fingerprint: string | null;
-  readonly at: number;
+  readonly at: string;
 };
 /**
@@ -1331,7 +1359,7 @@ export type VaultRotateMasterResult = {
   readonly kekVersion: number;
   readonly remaining: number;
   readonly masterKey: string | null;
-  readonly at: number;
+  readonly at: string;
 };
 /**

package/src/console/ui-next/src/components/motion/table/index.tsx CHANGED Viewed

@@ -61,6 +61,8 @@ export function Table<T>({
   onInsertColumn,
   onDeleteColumn,
   onRowDoubleClick,
+  onRowContextMenu,
+  onViewportContextMenu,
   cellRange = null,
   onCellRangeChange,
   onCellActivate,
@@ -192,6 +194,13 @@ export function Table<T>({
         onPointerMove={cellSelect.onScrollerPointerMove}
         onPointerUp={cellSelect.onPointerUp}
         onPointerCancel={cellSelect.onPointerUp}
+        onContextMenu={(event) => {
+          if (!onViewportContextMenu) return;
+          const target = event.target;
+          if (target instanceof Element && target.closest("[data-slot='table-row']")) return;
+          event.preventDefault();
+          onViewportContextMenu();
+        }}
         className={cn("overflow-auto", onCellRangeChange ? "select-none" : undefined)}
         style={{ height }}
       >
@@ -273,12 +282,19 @@ export function Table<T>({
                       ref={(el) => {
                         rowRefs.current[entry.id] = el;
                       }}
+                      data-slot="table-row"
                       data-selected={isSelected}
                       style={{ height: rowHeight }}
                       onPointerEnter={
                         hasRowMenu ? () => activateRow(entry.id, vItem.index) : undefined
                       }
                       onPointerLeave={hasRowMenu ? deactivateRow : undefined}
+                      onContextMenu={(event) => {
+                        if (!onRowContextMenu) return;
+                        event.preventDefault();
+                        event.stopPropagation();
+                        onRowContextMenu(entry.row, entry.id);
+                      }}
                       onDoubleClick={(e) => {
                         if (!onRowDoubleClick) return;
                         const target = e.target;

package/src/console/ui-next/src/components/motion/table/types.ts CHANGED Viewed

@@ -78,6 +78,10 @@ export interface TableProps<T> {
   readonly onDeleteColumn?: (columnKey: string, index: number) => void;
   /** Double-click a body row. */
   readonly onRowDoubleClick?: (row: T, id: string) => void;
+  /** Two-finger / right-click a body row (caller should `preventDefault`). */
+  readonly onRowContextMenu?: (row: T, id: string) => void;
+  /** Two-finger / right-click empty viewport (not a row). */
+  readonly onViewportContextMenu?: () => void;
   /** Controlled cell range (visible row index × column index). */
   readonly cellRange?: CellRange | null;
   /** Enables drag / Shift+click cell-range selection. */

package/src/console/ui-next/src/components/ui/kbd.tsx CHANGED Viewed

@@ -1,5 +1,5 @@
 /**
- * Keyboard key — shadcn Kbd. Tooltip content uses the inverted ink.
+ * Keyboard key — shadcn Kbd. Buttons inherit ink; tooltips invert.
  */
 import type { ComponentProps, JSX } from "react";
@@ -15,7 +15,7 @@ function Kbd({ className, ...props }: ComponentProps<"kbd">): JSX.Element {
     <kbd
       data-slot="kbd"
       className={cn(
-        "pointer-events-none inline-flex h-5 w-fit min-w-5 items-center justify-center gap-1 rounded-none bg-muted px-1 font-sans text-xs font-medium text-muted-foreground select-none in-data-[slot=tooltip-content]:bg-background/20 in-data-[slot=tooltip-content]:text-background dark:in-data-[slot=tooltip-content]:bg-background/10 [&_svg:not([class*='size-'])]:size-3",
+        "pointer-events-none inline-flex h-5 w-fit min-w-5 items-center justify-center gap-1 rounded-none bg-muted px-1 font-sans text-xs font-medium text-muted-foreground select-none in-[.bg-primary]:bg-primary-foreground/20 in-[.bg-primary]:text-primary-foreground in-data-[slot=tooltip-content]:bg-background/20 in-data-[slot=tooltip-content]:text-background dark:in-data-[slot=tooltip-content]:bg-background/10 [&_svg:not([class*='size-'])]:size-3",
         className,
       )}
       {...props}

package/src/console/ui-next/src/features/flows/traces/http-method.ts CHANGED Viewed

@@ -18,6 +18,25 @@ import type { ElementHugeIcon } from "@/lib/element-icons.ts";
 /** Known HTTP methods from Manifest `HttpTrigger.method`. */
 export type HttpMethod = "GET" | "POST" | "PUT" | "PATCH" | "DELETE" | "HEAD" | "OPTIONS" | "QUERY";
+/**
+ * Whether the verb carries a JSON request body on the wire.
+ *
+ * Matches the HTTP compiler (`GET` / `HEAD` / `DELETE` are path-or-query
+ * only) and the typed client (`GET` / `HEAD` leftover fields → query).
+ *
+ * @param method - HTTP method string (case-insensitive) or null
+ */
+export function httpMethodHasBody(method: string | null | undefined): boolean {
+  switch ((method ?? "").toUpperCase()) {
+    case "GET":
+    case "HEAD":
+    case "DELETE":
+      return false;
+    default:
+      return true;
+  }
+}
 /**
  * Units-tree display rank: GET → POST → QUERY → PATCH/PUT → DELETE.
  *

package/src/console/ui-next/src/features/flows/traces/trace-detail.test.ts CHANGED Viewed

@@ -8,6 +8,7 @@ import { ELEMENT_ICONS } from "@/lib/element-icons.ts";
 import { EDGE_STROKE } from "../graph/flow-graph-theme.ts";
 import {
   httpMethodBadgeClass,
+  httpMethodHasBody,
   httpMethodIcon,
   httpMethodRailClass,
   httpMethodSortRank,
@@ -110,6 +111,23 @@ describe("effectKindIcon", () => {
   });
 });
+describe("httpMethodHasBody", () => {
+  test("GET, HEAD, and DELETE are path/query only", () => {
+    expect(httpMethodHasBody("GET")).toBe(false);
+    expect(httpMethodHasBody("HEAD")).toBe(false);
+    expect(httpMethodHasBody("DELETE")).toBe(false);
+    expect(httpMethodHasBody("get")).toBe(false);
+  });
+  test("POST, PUT, PATCH, QUERY, and OPTIONS carry JSON", () => {
+    expect(httpMethodHasBody("POST")).toBe(true);
+    expect(httpMethodHasBody("PUT")).toBe(true);
+    expect(httpMethodHasBody("PATCH")).toBe(true);
+    expect(httpMethodHasBody("QUERY")).toBe(true);
+    expect(httpMethodHasBody("OPTIONS")).toBe(true);
+  });
+});
 describe("httpMethodBadgeClass", () => {
   test("assigns distinct accents per method", () => {
     expect(httpMethodBadgeClass("GET")).toContain("emerald");
@@ -352,7 +370,7 @@ describe("Sheet Replay path", () => {
           ok: true as const,
           rootId: run.id,
           dryRun: false,
-          at: 1,
+          at: "2026-08-21T09:36:51.525Z",
           flow: run.flow,
         },
         error: null,

package/src/console/ui-next/src/features/flows/traces/traces-pane.tsx CHANGED Viewed

@@ -15,6 +15,7 @@ import {
   EXPLORER_STRIP_TOKEN_IDLE_CLASS,
   EXPLORER_TOOLBAR_CLASS,
 } from "@/components/explorer/explorer-chrome.ts";
+import { AgentDisclosure } from "@/components/agents/agent-disclosure.tsx";
 import { ExplorerSearch } from "@/components/explorer/explorer-search.tsx";
 import {
   Empty,
@@ -236,10 +237,16 @@ export function TracesPane({
         ) : null}
       </div>
-      {runs.length > 0 && advancedOpen ? (
-        <div id="traces-advanced-panel">
+      {runs.length > 0 ? (
+        <AgentDisclosure
+          id="traces-advanced-panel"
+          role="region"
+          aria-label="Advanced filters"
+          open={advancedOpen}
+          className="shrink-0"
+        >
           <AdvancedFilters query={filters.advanced} runs={runs} onChange={setAdvanced} />
-        </div>
+        </AgentDisclosure>
       ) : null}
       <div className="flex min-h-0 flex-1 flex-col overflow-y-auto">

package/src/console/ui-next/src/features/store/detail/browse-section.tsx CHANGED Viewed

@@ -55,6 +55,7 @@ import { ToolbarTip } from "@/components/ui/toolbar-tip.tsx";
 import { buildStoreGridModel, type StoreGridRow } from "../lib/grid-model.ts";
 import { parseIndexQuery } from "../lib/index-query.ts";
 import { childCatalogKind, groupSqlChildren, isSqlCatalogChild } from "../lib/sql-catalog.ts";
+import { QueryGateMenu } from "../query/query-gate-menu.tsx";
 import { TouchedByLists } from "./touched-by-section.tsx";
 /** Browse page sizes offered in the Rows select. */
@@ -116,6 +117,10 @@ export function BrowseSection({
   const [indexOpen, setIndexOpen] = useState(false);
   const [triggerOpen, setTriggerOpen] = useState(false);
   const [insertOpen, setInsertOpen] = useState(false);
+  const [rlsAs, setRlsAs] = useState<{ asGate: string | null; asUserId: string | null }>({
+    asGate: null,
+    asUserId: null,
+  });
   const debouncedIndexText = useDebouncedValue(indexText, INDEX_SEARCH_DEBOUNCE_MS);
   const indexQuery = useMemo(() => parseIndexQuery(debouncedIndexText), [debouncedIndexText]);
@@ -133,8 +138,25 @@ export function BrowseSection({
         : {}),
       ...(store.facet === "index" && indexQuery.kind === "text" ? { q: indexQuery.q, topK } : {}),
       ...(store.facet === "sql" && !piiMasked ? { revealPii: true } : {}),
+      ...(store.facet === "sql" && !isSqlCatalogChild(child) && rlsAs.asGate
+        ? { asGate: rlsAs.asGate }
+        : {}),
+      ...(store.facet === "sql" && !isSqlCatalogChild(child) && rlsAs.asUserId
+        ? { asUserId: rlsAs.asUserId }
+        : {}),
     };
-  }, [store.ref, store.facet, child.name, tenant, tenantReady, limit, indexQuery, topK, piiMasked]);
+  }, [
+    store.ref,
+    store.facet,
+    child,
+    tenant,
+    tenantReady,
+    limit,
+    indexQuery,
+    topK,
+    piiMasked,
+    rlsAs,
+  ]);
   const browse = useStoreQuery(queryInput, tenantReady);
   const deleteMutation = useStoreDelete();
@@ -191,6 +213,8 @@ export function BrowseSection({
               c.key === "with_check" ||
               c.key === "command" ||
               c.key === "permissive",
+            ...(c.key === "origin" ? { label: "Origin" } : {}),
+            ...(c.key === "code" ? { label: "Code" } : {}),
           })),
       };
     }
@@ -269,6 +293,9 @@ export function BrowseSection({
   const toolbarExtras = (
     <>
+      {store.facet === "sql" && !isSqlCatalogChild(child) ? (
+        <QueryGateMenu manifest={manifest} value={rlsAs} onChange={setRlsAs} />
+      ) : null}
       <Tooltip>
         <TooltipTrigger
           render={(props) => (
@@ -576,9 +603,26 @@ export function BrowseSection({
             }
             insertOpen={insertOpen}
             onInsertOpenChange={setInsertOpen}
+            asGate={rlsAs.asGate}
+            asUserId={rlsAs.asUserId}
             onDeleteRows={
               authReadOnly || extensionCatalog ? undefined : (rows) => setDeleting(rows)
             }
+            onViewportContextMenu={
+              store.ref === "sql:oke_console"
+                ? undefined
+                : policyCatalog
+                  ? () => setPolicyOpen(true)
+                  : functionCatalog
+                    ? () => setFunctionOpen(true)
+                    : indexCatalog
+                      ? () => setIndexOpen(true)
+                      : triggerCatalog
+                        ? () => setTriggerOpen(true)
+                        : store.facet === "sql" && !isSqlCatalogChild(child)
+                          ? () => setInsertOpen(true)
+                          : undefined
+            }
           />
         </div>
       ) : null}

package/src/console/ui-next/src/features/store/detail/resource-panel.tsx CHANGED Viewed

@@ -9,6 +9,8 @@ import {
   CheckmarkCircle02Icon,
   Folder01Icon,
   SecurityCheckIcon,
+  ShieldEnergyIcon,
+  ShieldOff,
   Timer01Icon,
 } from "@hugeicons/core-free-icons";
 import { HugeiconsIcon } from "@hugeicons/react";
@@ -24,8 +26,13 @@ import { formatDuration } from "@/features/flows/traces/format-duration.ts";
 import { cn } from "@/lib/utils";
 import { filesDriverLabel, filesDriverOrigin } from "../lib/files-origin.ts";
 import { latestReplicaLagFromRuns } from "../lib/replica-lag.ts";
-import { isSqlCatalogChild, storeChildLabel } from "../lib/sql-catalog.ts";
-import { STORE_FACET_SPECS } from "../lib/store-tree.ts";
+import {
+  isSqlCatalogChild,
+  storeChildLabel,
+  storeChildRlsPolicyCount,
+  storeChildShowsRls,
+} from "../lib/sql-catalog.ts";
+import { resourceHeaderChildRef, STORE_FACET_SPECS } from "../lib/store-tree.ts";
 import { BrowseSection } from "./browse-section.tsx";
 /** Props for {@link ResourcePanel}. */
@@ -77,7 +84,12 @@ export function ResourcePanel({
   const lagTone = lagMs != null ? durationTone(lagMs) : null;
   const files = store.facet === "files";
-  const showStatus = Boolean(drift || lagMs !== null || store.contentAddressed || piiCount > 0);
+  const showsRls = storeChildShowsRls(child);
+  const rlsOn = child.rls === true;
+  const rlsCount = storeChildRlsPolicyCount(child, manifest, store.name);
+  const showStatus = Boolean(
+    drift || lagMs !== null || store.contentAddressed || piiCount > 0 || showsRls,
+  );
   return (
     <div className="flex h-full min-h-0 flex-col overflow-hidden" data-slot="resource-panel">
@@ -124,18 +136,7 @@ export function ResourcePanel({
                 <CopyInlineButton value={child.effectRef} label="Copy effect ref" />
               </>
             ) : (
-              <>
-                <span className="shrink-0 font-mono text-[11px] leading-none text-muted-foreground">
-                  {store.ref}
-                </span>
-                <span aria-hidden className="text-border">
-                  ·
-                </span>
-                <code className="min-w-0 truncate font-mono text-[11px] leading-none text-foreground/70">
-                  {child.effectRef}
-                </code>
-                <CopyInlineButton value={child.effectRef} label="Copy effect ref" />
-              </>
+              <ResourceRefSubtitle storeRef={store.ref} effectRef={child.effectRef} />
             )}
           </>
         }
@@ -154,6 +155,30 @@ export function ResourcePanel({
                 </StatusChip>
               ) : null}
               {store.contentAddressed ? <StatusChip>content-addressed</StatusChip> : null}
+              {showsRls ? (
+                <StatusChip
+                  tone={rlsOn ? "emerald" : "neutral"}
+                  icon={
+                    <HugeiconsIcon
+                      icon={rlsOn ? ShieldEnergyIcon : ShieldOff}
+                      className="size-3"
+                      aria-hidden
+                    />
+                  }
+                  title={
+                    rlsOn
+                      ? rlsCount > 0
+                        ? `Row-level security enabled · ${rlsCount} ${rlsCount === 1 ? "policy" : "policies"}`
+                        : "Row-level security enabled"
+                      : "Row-level security disabled"
+                  }
+                  role="status"
+                  data-slot="resource-rls"
+                  data-rls={rlsOn ? "on" : "off"}
+                >
+                  {rlsOn && rlsCount > 0 ? `${rlsCount} RLS` : "RLS"}
+                </StatusChip>
+              ) : null}
               {piiCount > 0 ? (
                 <StatusChip
                   tone={piiMasked ? "sky" : "amber"}
@@ -233,6 +258,34 @@ export function ResourcePanel({
   );
 }
+function ResourceRefSubtitle({
+  storeRef,
+  effectRef,
+}: {
+  readonly storeRef: string;
+  readonly effectRef: string;
+}): JSX.Element {
+  const childRef = resourceHeaderChildRef(storeRef, effectRef);
+  return (
+    <>
+      <span className="shrink-0 font-mono text-[11px] leading-none text-muted-foreground">
+        {storeRef}
+      </span>
+      {childRef ? (
+        <>
+          <span aria-hidden className="text-border">
+            ·
+          </span>
+          <code className="min-w-0 truncate font-mono text-[11px] leading-none text-foreground/70">
+            {childRef}
+          </code>
+        </>
+      ) : null}
+      <CopyInlineButton value={effectRef} label="Copy effect ref" />
+    </>
+  );
+}
 type ChipTone = "neutral" | "emerald" | "amber" | "sky";
 const CHIP_TONES: Record<ChipTone, string> = {
@@ -251,6 +304,7 @@ interface StatusChipProps {
   readonly role?: string;
   readonly "data-slot"?: string;
   readonly "data-drifted"?: string;
+  readonly "data-rls"?: string;
   readonly pressed?: boolean;
   readonly onClick?: () => void;
   readonly ariaLabel?: string;
@@ -270,6 +324,7 @@ function StatusChip({
   role,
   "data-slot": dataSlot,
   "data-drifted": dataDrifted,
+  "data-rls": dataRls,
   pressed,
   onClick,
   ariaLabel,
@@ -290,13 +345,20 @@ function StatusChip({
       aria-label={ariaLabel}
       data-slot={dataSlot}
       data-drifted={dataDrifted}
+      data-rls={dataRls}
       onClick={onClick}
     >
       {icon}
       {children}
     </button>
   ) : (
-    <span className={className} role={role} data-slot={dataSlot} data-drifted={dataDrifted}>
+    <span
+      className={className}
+      role={role}
+      data-slot={dataSlot}
+      data-drifted={dataDrifted}
+      data-rls={dataRls}
+    >
       {icon}
       {children}
     </span>