// scratchpad-access — the SINGLE source of truth for who's allowed.
// Mark this module server-only so it can never be bundled to the client.

const OPERATOR_EMAILS = new Set([
  "you@example.com",
  // …operator accounts
])

// Open in local dev; allowlisted operators only in production.
function scratchpadAllowed(email):
  if (not running in production) return true
  return email is present AND OPERATOR_EMAILS has email.trim().lowercased()

// render booleans; NEVER the values themselves
env = {
  xai:       is XAI_API_KEY set?,
  firecrawl: is FIRECRAWL_API_KEY set?,
}

// each controlled section keeps its live state in one object…
config = { radius: 12, accent: "#7c3aed", density: "compact" }

// …and a button serializes THAT object, verbatim, to the clipboard:
onCopy: copyToClipboard(JSON.stringify(config, null, 2))
// -> the user pastes it to an agent: "apply this to <Card>"  → agent writes it in.

// --- scratchpad-access module (server-only) -------------------------
mark-server-only

const OPERATOR_EMAILS = new Set([ "you@example.com" ])

function scratchpadAllowed(email):
  if (not production) return true
  return email present AND OPERATOR_EMAILS has email.trim().lowercased()

// --- the scratchpad page (server-rendered, always-fresh) ------------
configure route: always-fresh / no-cache

function ScratchpadPage(request):
  user = <existing identity helper>()          // reuse the app's auth
  if (not scratchpadAllowed(user.email)):
    return redirect("/") or 404                 // gate BEFORE any data

  sections = [
    // { id, label, node } — one per thing you're eyeballing/fiddling with.
    // Append here to add a section. Each node imports the REAL component/lib.
    // { id: "og", label: "OG · default", node: <VisualPreview .../> },
    // { id: "env", label: "Config",      node: <ReadinessPanel  .../> },
  ]
  activeId = sections.find(s => s.id == request.query.tab)?.id ?? sections[0]?.id

  return SectionSwitcher(sections, activeId)     // sidenav/tabs; shows active node

// --- dev-only entry link (renders nothing in production) ------------
function DevLinks():
  if (production) return nothing
  return <pinned corner strip linking to /scratchpad>