@datalayer/core 1.1.60 → 1.2.10

package/lib/views/mcp/RunDetail.js

@@ -0,0 +1,186 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { useState } from 'react';
+import { Button, Heading, Label, Link, Spinner, Text, Textarea, RelativeTime, } from '@primer/react';
+import { Box } from '@datalayer/primer-addons';
+import { useNavigate } from 'react-router-dom';
+import { McpErrorBlankslate } from '../../components/mcp/index.js';
+import { useAnswerTask, useCancelTask, useRunTrace, useTask, useTaskEvents, } from '../../hooks/useMcp.js';
+import { TraceTimelineSection } from './TraceTimeline.js';
+/** How a run's status is drawn. Shared with the runs list. */
+export const RUN_STATUS_LOOK = {
+    working: { label: 'Working', variant: 'success' },
+    input_required: { label: 'Waiting on you', variant: 'attention' },
+    completed: { label: 'Completed', variant: 'secondary' },
+    failed: { label: 'Failed', variant: 'danger' },
+    cancelled: { label: 'Cancelled', variant: 'secondary' },
+};
+/** Whether the run has stopped for good. */
+export const isRunOver = (status) => status === 'completed' || status === 'failed' || status === 'cancelled';
+/**
+ * Everything the run has printed, as text.
+ *
+ * Two shapes reach here and both are the run's output: the streamed
+ * `outputs`, and the `result` a finished tool returned. A cancelled run has
+ * the first and usually the second — the partial output is promoted to the
+ * result when it stops — so they are concatenated rather than chosen
+ * between, and de-duplicated by text so a promoted partial is not printed
+ * twice.
+ */
+export const outputTextOf = (task) => {
+    const lines = [];
+    for (const output of task.outputs ?? []) {
+        if (output.text) {
+            lines.push(output.text);
+        }
+    }
+    const result = task.result;
+    if (result && typeof result === 'object') {
+        for (const part of result.content ?? []) {
+            const text = part.text;
+            if (typeof text === 'string') {
+                lines.push(text);
+            }
+        }
+    }
+    const seen = new Set();
+    return lines
+        .filter(line => {
+        if (seen.has(line)) {
+            return false;
+        }
+        seen.add(line);
+        return true;
+    })
+        .join('');
+};
+/**
+ * A run for the documentation to draw: cancelled mid-flight, holding the
+ * lines it printed before it stopped.
+ *
+ * Cancelled rather than completed on purpose. It is the state that shows
+ * both halves of what this view is for — the output a run keeps when it is
+ * stopped, and the reason it stopped — and it is the one a reader is most
+ * likely to be looking at when they open the documentation.
+ */
+export const SAMPLE_RUN = {
+    uid: 'tsk_0980147b852244d098b04efd',
+    status: 'cancelled',
+    statusMessage: 'cancelled by the client',
+    tool: 'execute_cell',
+    notebookUid: '01KW96PZYRVKZXT8FS644GFD0D',
+    cellId: 'fdcac494',
+    initiatingUser: '01JV1VE1T5VG22Z05F6EFBMW8E',
+    createdAt: '2026-09-07T12:00:00Z',
+    lastUpdatedAt: '2026-09-07T12:00:22Z',
+    outputs: [
+        {
+            index: 0,
+            outputType: 'stream',
+            text: 'tick 0\ntick 1\ntick 2\ntick 3\ntick 4\ntick 5\n',
+        },
+    ],
+    result: {
+        content: [{ type: 'text', text: 'tick 6\ntick 7\nKeyboardInterrupt\n' }],
+    },
+};
+/**
+ * The spans that run left behind, for the documentation to draw.
+ *
+ * The shape is the one a reader needs to recognise: the gateway's twenty-two
+ * seconds are almost entirely the sandbox's, and the durable step between
+ * them explains the gap. A timeline drawn from an empty trace would teach
+ * nobody what the timeline is for.
+ */
+export const SAMPLE_TRACE = (() => {
+    const at = (second, millisecond = 0) => new Date(Date.UTC(2026, 8, 7, 12, 0, second, millisecond)).toISOString();
+    const span = (id, name, service, from, to) => ({
+        trace_id: '4f7a1c9d2b8e40a5b6c3d1e0f9a8b7c6',
+        span_id: id,
+        span_name: name,
+        service_name: service,
+        kind: 'SPAN_KIND_INTERNAL',
+        start_time: from,
+        end_time: to,
+        duration_ms: Date.parse(to) - Date.parse(from),
+    });
+    return [
+        {
+            span: span('01', 'mcp.tools/call execute_cell', 'jupyter-mcp-server', at(0), at(22)),
+            children: [
+                {
+                    span: span('02', 'mcp.authorize', 'jupyter-mcp-server', at(0), at(0, 4)),
+                    children: [],
+                },
+                {
+                    span: span('03', 'durable.workflow.start', 'datalayer-durable', at(0, 120), at(0, 480)),
+                    children: [
+                        {
+                            span: span('04', 'durable.step.execute', 'datalayer-durable', at(0, 500), at(22)),
+                            children: [
+                                {
+                                    span: span('05', 'runtimes.kernel.execute', 'datalayer-runtimes', at(1, 200), at(21, 900)),
+                                    children: [],
+                                },
+                            ],
+                        },
+                    ],
+                },
+            ],
+        },
+    ];
+})();
+export const RunDetail = ({ taskUid, errorState, routes, mock = false, }) => {
+    const navigate = useNavigate();
+    const run = useTask(mock ? undefined : taskUid);
+    const cancel = useCancelTask();
+    const answer = useAnswerTask();
+    // Asked for whatever the run's own trace holds; the hook itself stops
+    // polling when the run reaches a terminal state, and asks for nothing at
+    // all in `mock`.
+    const trace = useRunTrace(mock ? undefined : taskUid, { enabled: !mock });
+    const [reply, setReply] = useState('');
+    // Live while it runs, and it ends itself when the run is over. Never for
+    // the documentation's copy: it names a run that does not exist.
+    useTaskEvents(taskUid, {
+        enabled: !mock && Boolean(run.data) && !isRunOver(run.data.status),
+    });
+    if (!mock && run.isError) {
+        return (_jsx(McpErrorBlankslate, { state: errorState(run.error, 'Run'), onRetry: () => run.refetch() }));
+    }
+    if (!mock && (run.isLoading || !run.data)) {
+        return (_jsx(Box, { sx: { display: 'flex', justifyContent: 'center', p: 4 }, children: _jsx(Spinner, {}) }));
+    }
+    const task = mock ? SAMPLE_RUN : run.data;
+    const look = RUN_STATUS_LOOK[task.status];
+    const over = isRunOver(task.status);
+    const output = outputTextOf(task);
+    return (_jsxs(Box, { sx: { display: 'grid', gap: 3, minWidth: 0 }, children: [_jsxs(Box, { children: [_jsx(Link, { href: routes.runs, onClick: event => {
+                            event.preventDefault();
+                            navigate(routes.runs);
+                        }, sx: { fontSize: 0 }, children: "All runs" }), _jsx(Heading, { as: "h2", sx: { fontSize: 3, mt: 1, mb: 1 }, children: task.tool || 'Run' }), _jsxs(Box, { sx: {
+                            display: 'flex',
+                            gap: 2,
+                            alignItems: 'center',
+                            flexWrap: 'wrap',
+                        }, children: [_jsx(Label, { size: "small", variant: look.variant, children: look.label }), _jsx(Text, { sx: { fontFamily: 'mono', fontSize: 0, color: 'fg.muted' }, children: task.uid }), _jsxs(Text, { sx: { fontSize: 0, color: 'fg.muted' }, children: ["updated ", _jsx(RelativeTime, { datetime: task.lastUpdatedAt })] })] }), task.statusMessage && (_jsx(Text, { as: "p", sx: { fontSize: 1, color: 'fg.muted', mt: 2 }, children: task.statusMessage }))] }), task.status === 'input_required' && (_jsxs(Box, { sx: {
+                    borderWidth: 1,
+                    borderStyle: 'solid',
+                    borderColor: 'attention.emphasis',
+                    borderRadius: 2,
+                    p: 3,
+                    display: 'grid',
+                    gap: 2,
+                }, children: [_jsx(Heading, { as: "h3", sx: { fontSize: 1 }, children: "This run is waiting on you" }), _jsx(Textarea, { "aria-label": "Your answer", value: reply, onChange: event => setReply(event.target.value), placeholder: "Your answer", rows: 3 }), _jsx(Box, { children: _jsx(Button, { variant: "primary", disabled: !reply.trim() || answer.isPending, onClick: () => answer.mutate({ taskUid: task.uid, input: { answer: reply } }, { onSuccess: () => setReply('') }), children: answer.isPending ? 'Answering…' : 'Answer' }) })] })), _jsxs(Box, { children: [_jsx(Heading, { as: "h3", sx: { fontSize: 1, mb: 2 }, children: "Output" }), output ? (_jsx(Box, { as: "pre", sx: {
+                            fontFamily: 'mono',
+                            fontSize: 0,
+                            whiteSpace: 'pre-wrap',
+                            overflowX: 'auto',
+                            bg: 'canvas.subtle',
+                            borderRadius: 2,
+                            p: 3,
+                            m: 0,
+                        }, children: output })) : (_jsx(Text, { sx: { fontSize: 0, color: 'fg.muted' }, children: over
+                            ? 'This run printed nothing.'
+                            : 'Nothing printed yet. Output appears here as it arrives.' }))] }), task.error && (_jsxs(Box, { children: [_jsx(Heading, { as: "h3", sx: { fontSize: 1, mb: 2 }, children: "Why it failed" }), _jsx(Text, { sx: { fontFamily: 'mono', fontSize: 0, color: 'danger.fg' }, children: task.error })] })), _jsx(TraceTimelineSection, { tree: mock ? SAMPLE_TRACE : (trace.data?.tree ?? []), traceId: mock ? SAMPLE_TRACE[0].span.trace_id : trace.data?.traceId, live: !over }), !over && (_jsxs(Box, { children: [_jsx(Button, { variant: "danger", disabled: cancel.isPending, onClick: () => cancel.mutate(task.uid), children: cancel.isPending ? 'Cancelling…' : 'Cancel this run' }), _jsx(Text, { as: "p", sx: { fontSize: 0, color: 'fg.muted', mt: 2 }, children: "Cancelling interrupts the work itself, so the sandbox stops being billed for it. What it has already printed is kept." })] }))] }));
+};
+export default RunDetail;

package/lib/views/mcp/ScimProvisioning.d.ts

@@ -0,0 +1,54 @@
+/**
+ * The directory's other half: who exists, and who has left.
+ *
+ * The identity provider above signs people in. It can only ever act on
+ * somebody who *arrives* — which makes it useless for the thing an
+ * organization actually needs from a directory, because the person who left
+ * is exactly the person who does not turn up. That is what SCIM is for, and
+ * why this sits under the same page rather than somewhere else.
+ *
+ * **The status line is the point of this view, not the table.** A table of
+ * tokens looks almost identical in three quite different situations: a live
+ * integration; one whose every token has been revoked; and one configured
+ * months ago that has never once been called. In the last two, nobody is
+ * being deprovisioned — and an administrator reading rows would have to
+ * notice an empty "last used" column to know it. So the state is computed
+ * (`scimStatus`) and said in a sentence, in the colour that matches.
+ *
+ * **The secret is shown once.** Only a SHA-256 of it is stored, so there is
+ * no call that could show it again and this view offers none. The dialog
+ * says so before the value, not after it.
+ *
+ * @module views/mcp/ScimProvisioning
+ */
+import type { JSX } from 'react';
+import { scimStatus } from '../../api/iam/scimTokens';
+import type { McpErrorStateFn } from './types';
+export interface ScimProvisioningProps {
+    errorState: McpErrorStateFn;
+    orgUid: string;
+    /**
+     * Read-only for anybody who is not an owner. A SCIM token *is* the
+     * organization's provisioning authority — whoever holds one can remove
+     * anybody from it.
+     */
+    readOnly?: boolean;
+    showTitle?: boolean;
+}
+/**
+ * What the status line says, and how alarming it looks.
+ *
+ * Exported because these sentences *are* the feature. The table below them
+ * is nearly identical in all four states, and the whole reason this view
+ * exists is that "a SCIM token is configured" and "people are actually being
+ * removed" are different facts. A message that reassured in a state where
+ * nobody is being deprovisioned would be worse than no view at all, so it is
+ * held by a test rather than by care taken while writing it.
+ */
+export declare const SCIM_STATUS_MESSAGES: Record<ReturnType<typeof scimStatus>['state'], {
+    variant: 'default' | 'success' | 'warning';
+    heading: string;
+    body: string;
+}>;
+export declare const ScimProvisioning: ({ errorState, orgUid, readOnly, showTitle, }: ScimProvisioningProps) => JSX.Element;
+export default ScimProvisioning;

package/lib/views/mcp/ScimProvisioning.js

@@ -0,0 +1,173 @@
+import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
+import { useMemo, useRef, useState } from 'react';
+import { ActionList, ActionMenu, Button, Flash, FormControl, Heading, IconButton, Label, Spinner, Text, TextInput, } from '@primer/react';
+import { Blankslate, DataTable, Dialog, Table, } from '@primer/react/experimental';
+import { Box } from '@datalayer/primer-addons';
+import { KebabHorizontalIcon, PeopleIcon } from '@primer/octicons-react';
+import { McpErrorBlankslate } from '../../components/mcp/index.js';
+import { useCoreStore } from '../../state/index.js';
+import { useToast } from '../../hooks/index.js';
+import { useCreateScimToken, useRevokeScimToken, useRotateScimToken, useScimTokens, } from '../../hooks/useMcp.js';
+import { scimBaseUrl, scimStatus } from '../../api/iam/scimTokens.js';
+import { timeAgo } from './format.js';
+/**
+ * What the status line says, and how alarming it looks.
+ *
+ * Exported because these sentences *are* the feature. The table below them
+ * is nearly identical in all four states, and the whole reason this view
+ * exists is that "a SCIM token is configured" and "people are actually being
+ * removed" are different facts. A message that reassured in a state where
+ * nobody is being deprovisioned would be worse than no view at all, so it is
+ * held by a test rather than by care taken while writing it.
+ */
+export const SCIM_STATUS_MESSAGES = {
+    none: {
+        variant: 'default',
+        heading: 'No directory is provisioning into this organization',
+        body: 'People are added and removed by hand. Issue a token to let the ' +
+            'directory do it — and, more importantly, to have it remove people ' +
+            'when they leave.',
+    },
+    revoked: {
+        variant: 'warning',
+        heading: 'Every SCIM token is revoked — nobody is being deprovisioned',
+        body: 'The directory can no longer reach this organization. Anybody it ' +
+            'removes stays a member here until somebody does it by hand. Rotate a ' +
+            'token, or issue a new one, and reconfigure the directory with it.',
+    },
+    'never-used': {
+        variant: 'warning',
+        heading: 'A token exists and the directory has never used it',
+        body: 'Nothing has been provisioned or deprovisioned through it. Either the ' +
+            'directory has not been configured with it yet, or it was configured ' +
+            'with a token that has since been rotated.',
+    },
+    active: {
+        variant: 'success',
+        heading: 'The directory is provisioning into this organization',
+        body: 'People it adds become members; people it removes lose their ' +
+            'membership and, with it, every agent grant this organization gave ' +
+            'them.',
+    },
+};
+export const ScimProvisioning = ({ errorState, orgUid, readOnly = false, showTitle = true, }) => {
+    const { enqueueToast } = useToast();
+    const iamUrl = useCoreStore(state => state.configuration.iamUrl);
+    const tokens = useScimTokens(orgUid);
+    const create = useCreateScimToken(orgUid);
+    const rotate = useRotateScimToken(orgUid);
+    const revoke = useRevokeScimToken(orgUid);
+    const [creating, setCreating] = useState(false);
+    const [name, setName] = useState('');
+    /** The one moment a secret exists in this process. Cleared on close. */
+    const [secret, setSecret] = useState('');
+    // Primer's Dialog wants a non-nullable `RefObject<HTMLElement>`. React
+    // 19's `useRef(null)` is nullable, and this ref only ever reaches Dialog,
+    // so narrow it once here — the same way `IdentityProviders` does.
+    const returnFocusRef = useRef(null);
+    const rows = useMemo(() => (tokens.data ?? []).map(entry => ({ ...entry, id: entry.uid })), [tokens.data]);
+    const status = useMemo(() => scimStatus(tokens.data ?? []), [tokens.data]);
+    const closeSecret = () => setSecret('');
+    const openCreate = () => {
+        setName('');
+        setCreating(true);
+    };
+    const submitCreate = async () => {
+        try {
+            const minted = await create.mutateAsync(name.trim() || 'SCIM');
+            setCreating(false);
+            // Straight into the one dialog that will ever hold it.
+            setSecret(minted.secret);
+        }
+        catch (error) {
+            enqueueToast(error instanceof Error
+                ? error.message
+                : 'The token could not be created.', { variant: 'error' });
+        }
+    };
+    const doRotate = async (uid) => {
+        try {
+            const minted = await rotate.mutateAsync(uid);
+            setSecret(minted.secret);
+        }
+        catch (error) {
+            enqueueToast(error instanceof Error
+                ? error.message
+                : 'The token could not be rotated.', { variant: 'error' });
+        }
+    };
+    const doRevoke = async (uid) => {
+        try {
+            await revoke.mutateAsync(uid);
+            enqueueToast('SCIM token revoked.', { variant: 'success' });
+        }
+        catch (error) {
+            enqueueToast(error instanceof Error
+                ? error.message
+                : 'The token could not be revoked.', { variant: 'error' });
+        }
+    };
+    const columns = [
+        {
+            header: 'Name',
+            field: 'name',
+            rowHeader: true,
+            renderCell: row => (_jsxs(Box, { sx: { display: 'grid', gap: 1 }, children: [_jsx(Text, { sx: { fontWeight: 'semibold' }, children: row.name || 'SCIM' }), row.revoked && (_jsx(Label, { variant: "danger", size: "small", children: "Revoked" }))] })),
+        },
+        {
+            header: 'Last used',
+            field: 'lastUsedAt',
+            renderCell: row => row.revoked ? (_jsx(Text, { sx: { color: 'fg.muted' }, children: "\u2014" })) : row.lastUsedAt ? (_jsx(Text, { children: timeAgo(row.lastUsedAt) })) : (
+            // Said rather than left blank. An empty cell reads as "no data
+            // yet"; this is the difference between a working integration and
+            // one nobody ever pointed a directory at.
+            _jsx(Text, { sx: { color: 'attention.fg' }, children: "Never" })),
+        },
+        {
+            header: 'Secret rotated',
+            field: 'rotatedAt',
+            renderCell: row => _jsx(Text, { children: timeAgo(row.rotatedAt) || '—' }),
+        },
+        ...(readOnly
+            ? []
+            : [
+                {
+                    header: '',
+                    field: 'uid',
+                    renderCell: (row) => (_jsxs(ActionMenu, { children: [_jsx(ActionMenu.Anchor, { children: _jsx(IconButton, { icon: KebabHorizontalIcon, "aria-label": `Actions for ${row.name || 'this token'}`, variant: "invisible" }) }), _jsx(ActionMenu.Overlay, { width: "medium", children: _jsxs(ActionList, { children: [_jsxs(ActionList.Item, { disabled: row.revoked, onSelect: () => void doRotate(row.uid), children: ["Rotate secret", _jsx(ActionList.Description, { variant: "block", children: "The old secret stops at once. The directory must be reconfigured with the new one." })] }), _jsxs(ActionList.Item, { variant: "danger", disabled: row.revoked, onSelect: () => void doRevoke(row.uid), children: ["Revoke", _jsx(ActionList.Description, { variant: "block", children: "Provisioning through it stops. The rows it wrote stay readable." })] })] }) })] })),
+                },
+            ]),
+    ];
+    if (tokens.isError) {
+        return (_jsx(McpErrorBlankslate, { state: errorState(tokens.error, 'SCIM provisioning'), onRetry: () => tokens.refetch() }));
+    }
+    const shown = SCIM_STATUS_MESSAGES[status.state];
+    return (_jsxs(Box, { sx: { display: 'grid', gap: 3, minWidth: 0 }, children: [showTitle && (_jsxs(Box, { sx: {
+                    display: 'flex',
+                    alignItems: 'start',
+                    justifyContent: 'space-between',
+                    gap: 3,
+                }, children: [_jsxs(Box, { children: [_jsx(Heading, { as: "h2", sx: { fontSize: 3, mb: 1 }, children: "Directory provisioning" }), _jsx(Text, { as: "p", sx: { color: 'fg.muted', fontSize: 1, m: 0 }, children: "Over SCIM. Sign-in can only act on somebody who turns up; this is what removes the person who does not." })] }), !readOnly && (_jsx(Button, { variant: "primary", ref: returnFocusRef, onClick: openCreate, children: "New SCIM token" }))] })), tokens.isPending && !tokens.data ? (_jsx(Box, { sx: { display: 'flex', justifyContent: 'center', py: 5 }, children: _jsx(Spinner, {}) })) : (_jsxs(_Fragment, { children: [_jsxs(Flash, { variant: shown.variant, children: [_jsx(Text, { as: "p", sx: { fontWeight: 'semibold', m: 0 }, children: shown.heading }), _jsx(Text, { as: "p", sx: { fontSize: 1, mt: 1, mb: 0 }, children: shown.body }), status.lastUsedAt && (_jsxs(Text, { as: "p", sx: { fontSize: 1, mt: 1, mb: 0, color: 'fg.muted' }, children: ["Last provisioning call ", timeAgo(status.lastUsedAt), "."] }))] }), rows.length > 0 ? (_jsxs(_Fragment, { children: [_jsxs(Table.Container, { children: [_jsx(Table.Title, { as: "h3", id: "scim-tokens", children: "SCIM tokens" }), _jsx(Table.Subtitle, { as: "p", id: "scim-tokens-subtitle", children: "A revoked token is kept rather than deleted, so the provisioning it did stays attributable." }), _jsx(DataTable, { "aria-labelledby": "scim-tokens", "aria-describedby": "scim-tokens-subtitle", data: rows, columns: columns })] }), _jsxs(Box, { sx: {
+                                    border: '1px solid',
+                                    borderColor: 'border.default',
+                                    borderRadius: 2,
+                                    p: 3,
+                                    display: 'grid',
+                                    gap: 2,
+                                }, children: [_jsx(Text, { sx: { fontWeight: 'semibold', fontSize: 1 }, children: "What to give the directory" }), _jsxs(FormControl, { children: [_jsx(FormControl.Label, { children: "SCIM base URL" }), _jsx(TextInput, { block: true, readOnly: true, value: scimBaseUrl(iamUrl), "aria-describedby": "scim-base-url-note" }), _jsxs(FormControl.Caption, { id: "scim-base-url-note", children: ["Okta and Entra append ", _jsx("code", { children: "/Users" }), " themselves. Use the token as a bearer credential; the token is what says which organization is being provisioned, so nothing else names this one."] })] }), _jsxs(Text, { as: "p", sx: { fontSize: 0, color: 'fg.muted', m: 0 }, children: ["Groups are not provisioned over SCIM \u2014 this server answers them ", _jsx("code", { children: "501" }), " saying so. Roles come from the sign-in token\u2019s groups claim and the provider\u2019s role mappings, above; a second source of the same fact would eventually disagree with the first."] })] })] })) : (_jsxs(Blankslate, { border: true, spacious: true, children: [_jsx(Blankslate.Visual, { children: _jsx(PeopleIcon, { size: "medium" }) }), _jsx(Blankslate.Heading, { children: "No SCIM token" }), _jsx(Blankslate.Description, { children: _jsx(Text, { sx: { textAlign: 'center' }, children: "Issue one to let this organization\u2019s directory add people when they join and \u2014 the part sign-in cannot do \u2014 remove them when they leave." }) }), !readOnly && (_jsx(Button, { size: "small", onClick: openCreate, children: "New SCIM token" }))] }))] })), creating && (_jsx(Dialog, { title: "New SCIM token", onClose: () => setCreating(false), returnFocusRef: returnFocusRef, footerButtons: [
+                    {
+                        buttonType: 'default',
+                        content: 'Cancel',
+                        onClick: () => setCreating(false),
+                    },
+                    {
+                        buttonType: 'primary',
+                        content: 'Issue token',
+                        onClick: () => void submitCreate(),
+                        disabled: create.isPending,
+                    },
+                ], children: _jsxs(FormControl, { children: [_jsx(FormControl.Label, { children: "Name" }), _jsx(TextInput, { block: true, autoFocus: true, value: name, placeholder: "Okta", onChange: event => setName(event.target.value) }), _jsx(FormControl.Caption, { children: "Whatever tells this directory from another. Only for your own reading \u2014 it is not part of the credential." })] }) })), secret && (_jsx(Dialog, { title: "Copy this token now", onClose: closeSecret, footerButtons: [
+                    { buttonType: 'primary', content: 'Done', onClick: closeSecret },
+                ], children: _jsxs(Box, { sx: { display: 'grid', gap: 2 }, children: [_jsx(Flash, { variant: "warning", children: "This is the only time this token is shown. Only a hash of it is stored, so it cannot be shown again \u2014 if it is lost, rotate." }), _jsx(TextInput, { block: true, readOnly: true, value: secret, "aria-label": "SCIM token", sx: { fontFamily: 'mono' }, onFocus: event => event.target.select() }), _jsxs(Text, { as: "p", sx: { fontSize: 0, color: 'fg.muted', m: 0 }, children: ["Give it to the directory as a bearer token, with the base URL", ' ', _jsx("code", { children: scimBaseUrl(iamUrl) }), "."] })] }) }))] }));
+};
+export default ScimProvisioning;

package/lib/views/mcp/ServiceAgents.d.ts

@@ -0,0 +1,46 @@
+/**
+ * The organization's service agents: principals rather than proxies.
+ *
+ * The Agents page next door lists *grants* — somebody's authority narrowed
+ * to one client, dying with their account. This page lists the other kind:
+ * an agent that belongs to the organization, holds its own key, spends
+ * under its own name and outlives whoever set it up. An organization whose
+ * nightly pipeline runs on an engineer's grant loses the pipeline when the
+ * engineer leaves, and its spend shows against somebody who was asleep.
+ *
+ * Three things this page has to get right, all of them about the key:
+ *
+ * **It is shown once**, in the dialog that creates or rotates it, and the
+ * dialog says so before it says anything else. IAM stores a hash and cannot
+ * show it again, so somebody who does not read that sentence stores nothing
+ * and rotates an hour later.
+ *
+ * **Rotating breaks the old key immediately.** There is no grace period, by
+ * design, so the confirmation says what will stop rather than asking a
+ * yes/no about a word.
+ *
+ * **Revoking does not remove the row.** Its audit rows name it, and a uid
+ * that resolves to nothing makes a year-old row unreadable. Revoked is a
+ * state in the table, never a reason to hide it.
+ *
+ * @module views/mcp/ServiceAgents
+ */
+import type { JSX } from 'react';
+import type { McpErrorStateFn } from './types';
+export interface ServiceAgentsProps {
+    /** The application's words for a failed request. */
+    errorState: McpErrorStateFn;
+    /** The organization whose agents these are. */
+    orgUid: string;
+    /**
+     * Read-only for anybody who is not an owner. Members may *see* the list —
+     * an agent spending their organization's budget is one they will ask
+     * about — and IAM refuses their writes either way; this only keeps the
+     * page from offering an action that would be refused.
+     */
+    readOnly?: boolean;
+    /** Drawn without its heading, when the page around it carries one. */
+    showTitle?: boolean;
+}
+export declare const ServiceAgents: ({ errorState, orgUid, readOnly, showTitle, }: ServiceAgentsProps) => JSX.Element;
+export default ServiceAgents;