@hachej/boring-mcp 0.0.0

package/dist/front/index.js

@@ -0,0 +1,638 @@
+"use client";
+
+// src/front/index.tsx
+import { useEffect, useState } from "react";
+import { definePlugin } from "@hachej/boring-workspace/plugin";
+
+// src/shared/index.ts
+var BORING_MCP_PLUGIN_ID = "boring-mcp";
+var BORING_MCP_SOURCES_TAB_PANEL_ID = "boring-mcp.sources.tab";
+var BORING_MCP_SOURCES_PANEL_ID = "boring-mcp.sources.panel";
+var MCP_ERROR_CODES = {
+  SOURCE_NOT_FOUND: "MCP_SOURCE_NOT_FOUND",
+  SOURCE_FORBIDDEN: "MCP_SOURCE_FORBIDDEN",
+  SOURCE_UNAVAILABLE: "MCP_SOURCE_UNAVAILABLE",
+  PROVIDER_CONFIG_INVALID: "MCP_PROVIDER_CONFIG_INVALID",
+  PROVIDER_TIMEOUT: "MCP_PROVIDER_TIMEOUT",
+  PROVIDER_ERROR: "MCP_PROVIDER_ERROR",
+  TOOL_NOT_FOUND: "MCP_TOOL_NOT_FOUND",
+  TOOL_NOT_ALLOWED: "MCP_TOOL_NOT_ALLOWED",
+  PROVIDER_TOOL_DRIFT: "MCP_PROVIDER_TOOL_DRIFT",
+  RESOURCE_LIMIT_EXCEEDED: "MCP_RESOURCE_LIMIT_EXCEEDED",
+  SECRET_LEAK_GUARD: "MCP_SECRET_LEAK_GUARD",
+  INPUT_INVALID: "MCP_INPUT_INVALID",
+  RESOURCE_URI_INVALID: "MCP_RESOURCE_URI_INVALID"
+};
+function toMcpSourceDto(source) {
+  return {
+    id: source.id,
+    provider: source.provider,
+    displayName: source.displayName,
+    status: source.status,
+    ownerKind: source.ownerKind,
+    credentialProvider: source.credentialProvider,
+    scopes: source.scopes,
+    providerAccountLabel: source.providerAccountLabel,
+    lastVerifiedAt: source.lastVerifiedAt,
+    createdAt: source.createdAt,
+    updatedAt: source.updatedAt
+  };
+}
+var McpError = class extends Error {
+  code;
+  details;
+  constructor(code, message, details) {
+    super(message);
+    this.name = "McpError";
+    this.code = code;
+    this.details = details;
+  }
+};
+var NOTION_MCP_TEMPLATE = {
+  id: "notion",
+  displayName: "Notion",
+  readOnlyDefault: true,
+  allowedTools: ["NOTION_SEARCH_NOTION_PAGE", "NOTION_GET_PAGE_MARKDOWN", "NOTION_RETRIEVE_PAGE"],
+  deniedTools: ["create_*", "update_*", "delete_*", "publish_*", "admin_*"],
+  allowedResourceUriPrefixes: ["notion:", "notion://"]
+};
+var AIRTABLE_MCP_TEMPLATE = {
+  id: "airtable",
+  displayName: "Airtable",
+  readOnlyDefault: true,
+  allowedTools: ["ping", "list_bases", "list_workspaces", "list_tables_for_base", "get_table_schema", "search_records"],
+  deniedTools: ["create_*", "update_*", "delete_*", "publish_*", "admin_*"],
+  allowedResourceUriPrefixes: ["airtable:", "airtable://"]
+};
+var DEFAULT_MCP_PROVIDER_TEMPLATES = [NOTION_MCP_TEMPLATE, AIRTABLE_MCP_TEMPLATE];
+function getMcpProviderTemplate(provider, templates = DEFAULT_MCP_PROVIDER_TEMPLATES) {
+  return templates.find((template) => template.id === provider);
+}
+var MCP_TOOL_NAME_PATTERN = /^[A-Za-z0-9_.:-]{1,128}$/;
+function validateMcpToolName(toolName) {
+  if (!MCP_TOOL_NAME_PATTERN.test(toolName)) {
+    throw new McpError(MCP_ERROR_CODES.INPUT_INVALID, "Invalid MCP tool name");
+  }
+}
+function wildcardMatch(pattern, value) {
+  if (!pattern.includes("*")) return pattern === value;
+  const escaped = pattern.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*");
+  return new RegExp(`^${escaped}$`, "i").test(value);
+}
+function classifyMcpTool(template, toolName) {
+  validateMcpToolName(toolName);
+  if (template.deniedTools.some((pattern) => wildcardMatch(pattern, toolName))) {
+    return { allowed: false, risk: "write", reason: "Tool matches a denied write/admin pattern" };
+  }
+  if (template.allowedTools.some((pattern) => wildcardMatch(pattern, toolName))) {
+    return { allowed: true, risk: "read", reason: "Tool is on the read-only allowlist" };
+  }
+  return { allowed: false, risk: "unknown", reason: "Tool is not on the read-only allowlist" };
+}
+function classifyMcpTools(template, tools) {
+  return tools.map((tool) => ({ ...tool, decision: classifyMcpTool(template, tool.name) }));
+}
+function assertMcpToolAllowed(template, toolName) {
+  const decision = classifyMcpTool(template, toolName);
+  if (!decision.allowed) throw new McpError(MCP_ERROR_CODES.TOOL_NOT_ALLOWED, decision.reason);
+}
+var REDACTION = "[REDACTED_MCP_SECRET]";
+var SECRET_KEY_PATTERN = /(api[_-]?key|access[_-]?token|refresh[_-]?token|id[_-]?token|oauth[_-]?token|authorization|cookie|client[_-]?secret|session[_-]?headers?|mcp[_-]?session|x-composio-mcp-session)/i;
+var SECRET_VALUE_PATTERN = /(Bearer\s+[A-Za-z0-9._~+\/-]{12,}|sk-[A-Za-z0-9_-]{12,}|(?:x-api-key|api[_-]?key|access[_-]?token|refresh[_-]?token|id[_-]?token|oauth[_-]?token|code|client[_-]?secret|session[_-]?headers?|mcp[_-]?session|x-composio-mcp-session)\s*[:=]\s*[^\s,&,}]+)/gi;
+function redactMcpSecrets(value) {
+  if (typeof value === "string") return value.replace(SECRET_VALUE_PATTERN, REDACTION);
+  if (Array.isArray(value)) return value.map(redactMcpSecrets);
+  if (!value || typeof value !== "object") return value;
+  return Object.fromEntries(Object.entries(value).map(([key, nested]) => [key, SECRET_KEY_PATTERN.test(key) ? REDACTION : redactMcpSecrets(nested)]));
+}
+function containsMcpSecret(value) {
+  const redacted = redactMcpSecrets(value);
+  return JSON.stringify(redacted) !== JSON.stringify(value);
+}
+function hasMcpCanaryText(value, canaries) {
+  return canaries.some((canary) => canary.trim() && value.includes(canary));
+}
+function containsMcpCanary(value, canaries) {
+  if (typeof value === "string") return hasMcpCanaryText(value, canaries);
+  if (Array.isArray(value)) return value.some((item) => containsMcpCanary(item, canaries));
+  if (!value || typeof value !== "object") return false;
+  return Object.entries(value).some(([key, nested]) => hasMcpCanaryText(key, canaries) || containsMcpCanary(nested, canaries));
+}
+function containsMcpSecretOrCanary(value, canaries) {
+  return containsMcpSecret(value) || containsMcpCanary(value, canaries);
+}
+function doctorMcpSource(source, templates = DEFAULT_MCP_PROVIDER_TEMPLATES) {
+  const issues = [];
+  if (!getMcpProviderTemplate(source.provider, templates)) {
+    issues.push({ level: "error", code: MCP_ERROR_CODES.PROVIDER_CONFIG_INVALID, message: "Unknown MCP provider template" });
+  }
+  if (source.status !== "connected") {
+    issues.push({ level: "warning", code: MCP_ERROR_CODES.SOURCE_UNAVAILABLE, message: "MCP source is not connected" });
+  }
+  return { ok: issues.every((issue) => issue.level !== "error"), sourceId: source.id, issues };
+}
+var McpAccessFacade = class {
+  constructor(params) {
+    this.params = params;
+  }
+  params;
+  async listSources(actor) {
+    return (await this.params.store.listSources(actor)).filter((source) => this.canAccessSource(actor, source));
+  }
+  async probeSource(actor, sourceId) {
+    const source = await this.requireAccessibleSource(actor, sourceId);
+    this.requireConnectedSource(source);
+    const template = this.requireTemplate(source);
+    const [tools, resources] = await Promise.all([
+      this.params.transport.listTools(source),
+      this.params.transport.listResources(source)
+    ]);
+    return {
+      sourceId: source.id,
+      provider: source.provider,
+      tools: classifyMcpTools(template, tools),
+      resources
+    };
+  }
+  async requireAccessibleSource(actor, sourceId) {
+    const source = await this.params.store.getSource(sourceId);
+    if (!source || source.workspaceId !== actor.workspaceId) {
+      throw new McpError(MCP_ERROR_CODES.SOURCE_NOT_FOUND, "MCP source not found");
+    }
+    if (!this.canAccessSource(actor, source)) throw new McpError(MCP_ERROR_CODES.SOURCE_NOT_FOUND, "MCP source not found");
+    return source;
+  }
+  canAccessSource(actor, source) {
+    if (source.workspaceId !== actor.workspaceId) return false;
+    return this.params.accessPolicy?.canAccessSource(actor, source) ?? (source.ownerKind === "user" && source.userId === actor.userId);
+  }
+  requireConnectedSource(source) {
+    if (source.status !== "connected") throw new McpError(MCP_ERROR_CODES.SOURCE_UNAVAILABLE, "MCP source is not connected");
+  }
+  requireTemplate(source) {
+    const template = getMcpProviderTemplate(source.provider, this.params.templates);
+    if (!template) throw new McpError(MCP_ERROR_CODES.PROVIDER_CONFIG_INVALID, "Unknown MCP provider");
+    return template;
+  }
+};
+
+// src/front/index.tsx
+import { jsx, jsxs } from "react/jsx-runtime";
+function cx(...classes) {
+  return classes.filter(Boolean).join(" ");
+}
+function resolveProviders(options) {
+  const providers = options.providers ?? DEFAULT_MCP_PROVIDER_TEMPLATES;
+  const enabled = new Set(options.enabledProviderIds ?? providers.map((provider) => provider.id));
+  return providers.filter((provider) => enabled.has(provider.id));
+}
+function findSourceStatus(provider, statuses = []) {
+  const matches = statuses.filter((status) => status.source.provider === provider.id);
+  return matches.find((status) => status.source.status === "connected") ?? matches.find((status) => status.source.status !== "revoked") ?? matches[0];
+}
+function providerSetupState(provider, options) {
+  return options.providerSetup?.find((setup) => setup.providerId === provider.id);
+}
+function actionErrorMessage(error) {
+  return error instanceof Error && error.message ? error.message : "MCP action failed. Please try again.";
+}
+function upsertSourceStatus(statuses, next) {
+  if (!next) return [...statuses];
+  const index = statuses.findIndex((status) => status.source.id === next.source.id);
+  if (index === -1) return [...statuses, next];
+  return statuses.map((status, itemIndex) => itemIndex === index ? next : status);
+}
+function resolveSourceApiWorkspaceId(sourceApi) {
+  const workspaceId = sourceApi.workspaceId ?? sourceApi.resolveWorkspaceId?.();
+  if (!workspaceId) throw new Error("Open a workspace before connecting MCP.");
+  return workspaceId;
+}
+function sourceApiUrl(sourceApi, path) {
+  const base = sourceApi.baseUrl?.replace(/\/$/, "") ?? "";
+  return `${base}${path}`;
+}
+async function readSourceApiJson(response) {
+  const payload = await response.json().catch(() => void 0);
+  if (!response.ok) {
+    const message = payload && typeof payload === "object" && "message" in payload && typeof payload.message === "string" ? payload.message : "MCP API request failed.";
+    throw new Error(message);
+  }
+  return payload;
+}
+async function sourceApiRequest(sourceApi, path, body) {
+  const workspaceId = resolveSourceApiWorkspaceId(sourceApi);
+  const response = await fetch(sourceApiUrl(sourceApi, path), {
+    method: body ? "POST" : "GET",
+    credentials: "same-origin",
+    headers: {
+      "content-type": "application/json",
+      "x-boring-workspace-id": workspaceId
+    },
+    body: body ? JSON.stringify(body) : void 0
+  });
+  return readSourceApiJson(response);
+}
+function defaultOpenConnectUrl(url) {
+  if (typeof window === "undefined") return;
+  window.open(url, "_blank", "noopener,noreferrer");
+}
+function openPendingConnectWindow(sourceApi) {
+  if (sourceApi.openConnectUrl || typeof window === "undefined") return void 0;
+  const popup = window.open("about:blank", "_blank");
+  if (!popup) throw new Error("Popup blocked. Allow popups for this site and try connecting again.");
+  try {
+    popup.opener = null;
+  } catch {
+  }
+  return popup;
+}
+function navigatePendingConnectWindow(popup, url) {
+  if (!popup) {
+    if (url) defaultOpenConnectUrl(url);
+    return;
+  }
+  if (!url) {
+    popup.close();
+    return;
+  }
+  popup.location.href = url;
+}
+function createBrowserSourceActions(sourceApi) {
+  return {
+    async onConnect(providerId) {
+      const popup = openPendingConnectWindow(sourceApi);
+      try {
+        const result = await sourceApiRequest(sourceApi, "/api/v1/boring-mcp/connect", { provider: providerId });
+        if (sourceApi.openConnectUrl && result.connectUrl) sourceApi.openConnectUrl(result.connectUrl);
+        else navigatePendingConnectWindow(popup, result.connectUrl);
+        return result.status;
+      } catch (error) {
+        popup?.close();
+        throw error;
+      }
+    },
+    async onRefreshStatus(sourceId) {
+      const result = await sourceApiRequest(sourceApi, "/api/v1/boring-mcp/refresh", { sourceId });
+      return result.status;
+    },
+    async onDisconnect(sourceId) {
+      const result = await sourceApiRequest(sourceApi, "/api/v1/boring-mcp/disconnect", { sourceId });
+      return result.status;
+    },
+    async onListTools(sourceId, _providerId, refresh) {
+      const result = await sourceApiRequest(sourceApi, "/api/v1/boring-mcp/tools", { sourceId, refresh: refresh === true });
+      return result.tools;
+    }
+  };
+}
+function statusLabel(status) {
+  switch (status) {
+    case "connected":
+      return "Connected";
+    case "expired":
+      return "Expired";
+    case "error":
+      return "Needs attention";
+    case "revoked":
+      return "Disconnected";
+    case "unconfigured":
+      return "Not connected";
+    default:
+      return "Not connected";
+  }
+}
+function statusBadgeClass(status) {
+  switch (status) {
+    case "connected":
+      return "border-accent/40 bg-accent/10 text-foreground";
+    case "expired":
+    case "error":
+      return "border-amber-500/35 bg-amber-500/10 text-foreground";
+    default:
+      return "border-border/70 bg-muted/50 text-muted-foreground";
+  }
+}
+function McpIcon({ className }) {
+  return /* @__PURE__ */ jsxs("svg", { className, viewBox: "0 0 24 24", fill: "none", stroke: "currentColor", strokeWidth: "1.75", strokeLinecap: "round", strokeLinejoin: "round", "aria-hidden": "true", children: [
+    /* @__PURE__ */ jsx("path", { d: "M7 8h10" }),
+    /* @__PURE__ */ jsx("path", { d: "M7 12h10" }),
+    /* @__PURE__ */ jsx("path", { d: "M7 16h6" }),
+    /* @__PURE__ */ jsx("rect", { x: "4", y: "4", width: "16", height: "16", rx: "4" })
+  ] });
+}
+function RefreshIcon({ className }) {
+  return /* @__PURE__ */ jsxs("svg", { className, viewBox: "0 0 24 24", fill: "none", stroke: "currentColor", strokeWidth: "1.75", strokeLinecap: "round", strokeLinejoin: "round", "aria-hidden": "true", children: [
+    /* @__PURE__ */ jsx("path", { d: "M20 11a8.1 8.1 0 0 0-15.5-2M4 5v4h4" }),
+    /* @__PURE__ */ jsx("path", { d: "M4 13a8.1 8.1 0 0 0 15.5 2m.5 4v-4h-4" })
+  ] });
+}
+function ChevronIcon({ open }) {
+  return /* @__PURE__ */ jsx("svg", { className: cx("h-3.5 w-3.5 shrink-0 text-muted-foreground transition-transform", open && "rotate-90"), viewBox: "0 0 24 24", fill: "none", stroke: "currentColor", strokeWidth: "2", strokeLinecap: "round", strokeLinejoin: "round", "aria-hidden": "true", children: /* @__PURE__ */ jsx("path", { d: "m9 18 6-6-6-6" }) });
+}
+function XIcon() {
+  return /* @__PURE__ */ jsxs("svg", { className: "size-3", viewBox: "0 0 24 24", fill: "none", stroke: "currentColor", strokeWidth: "1.75", strokeLinecap: "round", strokeLinejoin: "round", "aria-hidden": "true", children: [
+    /* @__PURE__ */ jsx("path", { d: "M18 6 6 18" }),
+    /* @__PURE__ */ jsx("path", { d: "m6 6 12 12" })
+  ] });
+}
+function ActionButton({ children, disabled, tone = "secondary", onClick, title }) {
+  return /* @__PURE__ */ jsx(
+    "button",
+    {
+      type: "button",
+      disabled,
+      title,
+      className: cx(
+        "rounded-lg border px-2.5 py-1 text-[11px] font-medium transition-colors disabled:cursor-not-allowed disabled:opacity-50",
+        tone === "primary" && "border-accent/60 bg-accent text-accent-foreground hover:bg-accent/90",
+        tone === "danger" && "border-destructive/30 bg-card/70 text-muted-foreground hover:border-destructive/50 hover:text-destructive",
+        tone === "secondary" && "border-border/70 bg-card/70 text-muted-foreground hover:border-border hover:text-foreground"
+      ),
+      onClick: (event) => {
+        event.stopPropagation();
+        onClick?.();
+      },
+      children
+    }
+  );
+}
+function ProviderRow({ provider, providerSetup, connectionUnavailableMessage, sourceStatus, actions, pending, expanded, tools, toolsPending, toolsError, runAction, onToggle, onLoadTools }) {
+  const source = sourceStatus?.source;
+  const setupEnabled = providerSetup?.enabled ?? true;
+  const status = source?.status;
+  const sourceId = source?.id;
+  const connectLabel = status === "expired" || status === "error" ? "Reconnect" : "Connect";
+  const showConnect = status !== "connected";
+  const connectBlockedByStatus = Boolean(sourceStatus && !sourceStatus.connectable);
+  const connectUnavailable = !setupEnabled || !actions.onConnect || connectBlockedByStatus;
+  const connectDisabled = connectUnavailable || pending === `${provider.id}:connect`;
+  const refreshDisabled = !sourceId || !actions.onRefreshStatus || pending === `${provider.id}:refresh`;
+  const disconnectDisabled = !sourceId || !sourceStatus?.canDisconnect || !actions.onDisconnect || pending === `${provider.id}:disconnect`;
+  const unavailableMessage = connectBlockedByStatus ? "This MCP cannot start a new connection in its current state. Refresh status or disconnect first." : providerSetup?.message ?? connectionUnavailableMessage ?? "Ask an admin to wire this app's MCP backend.";
+  const fallbackTools = provider.allowedTools.map((toolName) => ({
+    sourceId: sourceId ?? `template:${provider.id}`,
+    provider: provider.id,
+    toolName,
+    displayName: toolName.replace(/[_:.-]+/g, " ").replace(/\b\w/g, (char) => char.toUpperCase()),
+    summary: "Available after this MCP is connected.",
+    inputSchema: {},
+    risk: "read",
+    enabled: status === "connected",
+    blockedReasons: status === "connected" ? [] : ["Connect this MCP to discover the live tool schema."],
+    schemaHash: "template",
+    nativeRef: { provider: provider.id, action: toolName }
+  }));
+  const visibleTools = tools ?? fallbackTools;
+  return /* @__PURE__ */ jsxs("li", { className: "rounded-xl border border-border/60 bg-card/70 px-3 py-2.5 transition-colors hover:border-border hover:bg-muted/50", children: [
+    /* @__PURE__ */ jsxs("div", { className: "flex items-start justify-between gap-3", children: [
+      /* @__PURE__ */ jsxs(
+        "button",
+        {
+          type: "button",
+          className: "flex min-w-0 flex-1 items-start gap-2 text-left",
+          "aria-expanded": expanded,
+          "aria-label": `${provider.displayName} MCP`,
+          onClick: () => onToggle(provider, sourceStatus),
+          children: [
+            /* @__PURE__ */ jsx(ChevronIcon, { open: expanded }),
+            /* @__PURE__ */ jsxs("div", { className: "min-w-0", children: [
+              /* @__PURE__ */ jsxs("div", { className: "flex min-w-0 flex-wrap items-center gap-2", children: [
+                /* @__PURE__ */ jsx("div", { className: "truncate text-sm font-medium text-foreground", children: provider.displayName }),
+                /* @__PURE__ */ jsx("span", { className: cx("rounded border px-1.5 py-0.5 text-[10px] font-medium", statusBadgeClass(status)), children: statusLabel(status) })
+              ] }),
+              /* @__PURE__ */ jsx("div", { className: "mt-1 truncate text-xs text-muted-foreground", children: source?.providerAccountLabel ? `Account: ${source.providerAccountLabel}` : source ? "Account connected through server-owned MCP credentials" : "No account connected yet." }),
+              source?.lastVerifiedAt ? /* @__PURE__ */ jsxs("div", { className: "mt-0.5 truncate text-[11px] text-muted-foreground/80", children: [
+                "Last verified: ",
+                source.lastVerifiedAt
+              ] }) : null
+            ] })
+          ]
+        }
+      ),
+      /* @__PURE__ */ jsxs("div", { className: "flex shrink-0 flex-wrap justify-end gap-1.5", children: [
+        showConnect ? /* @__PURE__ */ jsx(
+          ActionButton,
+          {
+            tone: "primary",
+            disabled: connectDisabled,
+            title: connectUnavailable && showConnect ? unavailableMessage : void 0,
+            onClick: () => actions.onConnect && runAction(`${provider.id}:connect`, () => actions.onConnect?.(provider.id)),
+            children: !setupEnabled || !actions.onConnect ? "Admin setup required" : connectLabel
+          }
+        ) : null,
+        sourceId ? /* @__PURE__ */ jsx(
+          ActionButton,
+          {
+            disabled: refreshDisabled,
+            onClick: () => actions.onRefreshStatus && runAction(`${provider.id}:refresh`, () => actions.onRefreshStatus?.(sourceId, provider.id)),
+            children: "Refresh status"
+          }
+        ) : null,
+        sourceId && sourceStatus?.canDisconnect ? /* @__PURE__ */ jsx(
+          ActionButton,
+          {
+            tone: "danger",
+            disabled: disconnectDisabled,
+            onClick: () => actions.onDisconnect && runAction(`${provider.id}:disconnect`, () => actions.onDisconnect?.(sourceId, provider.id)),
+            children: "Disconnect"
+          }
+        ) : null
+      ] })
+    ] }),
+    expanded ? /* @__PURE__ */ jsxs("div", { className: "mt-3 border-t border-border/50 pt-3", children: [
+      connectUnavailable && showConnect ? /* @__PURE__ */ jsx("div", { className: "mb-3 text-xs text-muted-foreground", children: unavailableMessage }) : null,
+      /* @__PURE__ */ jsxs("div", { className: "mb-2 flex items-center justify-between gap-2", children: [
+        /* @__PURE__ */ jsxs("div", { children: [
+          /* @__PURE__ */ jsx("div", { className: "text-xs font-medium text-foreground", children: "Tools" }),
+          /* @__PURE__ */ jsx("p", { className: "text-[11px] text-muted-foreground", children: status === "connected" ? "Live tool catalog exposed through governed read-only MCP." : "Tools that become available after connecting this MCP." })
+        ] }),
+        sourceId && status === "connected" && actions.onListTools ? /* @__PURE__ */ jsxs(
+          "button",
+          {
+            type: "button",
+            className: "inline-flex items-center gap-1 rounded-lg border border-border/70 bg-card/70 px-2 py-1 text-[11px] font-medium text-muted-foreground hover:border-border hover:text-foreground disabled:opacity-50",
+            disabled: toolsPending,
+            onClick: (event) => {
+              event.stopPropagation();
+              onLoadTools(sourceId, provider.id, true);
+            },
+            children: [
+              /* @__PURE__ */ jsx(RefreshIcon, { className: cx("h-3 w-3", toolsPending && "animate-spin") }),
+              "Refresh tools"
+            ]
+          }
+        ) : null
+      ] }),
+      toolsError ? /* @__PURE__ */ jsx("div", { role: "alert", className: "mb-2 rounded-lg border border-destructive/30 bg-destructive/8 px-3 py-2 text-xs text-destructive", children: toolsError }) : null,
+      toolsPending && !tools ? /* @__PURE__ */ jsx("div", { className: "rounded-lg border border-border/60 bg-muted/30 px-3 py-2 text-xs text-muted-foreground", children: "Loading tools\u2026" }) : visibleTools.length === 0 ? /* @__PURE__ */ jsx("div", { className: "rounded-lg border border-border/60 bg-muted/30 px-3 py-2 text-xs text-muted-foreground", children: "No tools returned for this MCP yet." }) : /* @__PURE__ */ jsx("ul", { role: "list", className: "grid gap-1.5", children: visibleTools.map((tool) => /* @__PURE__ */ jsx("li", { className: "rounded-lg border border-border/60 bg-background/60 px-2.5 py-2", children: /* @__PURE__ */ jsxs("div", { className: "flex items-start justify-between gap-2", children: [
+        /* @__PURE__ */ jsxs("div", { className: "min-w-0", children: [
+          /* @__PURE__ */ jsx("div", { className: "truncate text-xs font-medium text-foreground", children: tool.toolName }),
+          /* @__PURE__ */ jsx("p", { className: "mt-0.5 line-clamp-2 text-[11px] leading-4 text-muted-foreground", children: tool.summary || tool.description || "MCP tool" })
+        ] }),
+        /* @__PURE__ */ jsx("span", { className: cx("shrink-0 rounded px-1.5 py-0.5 text-[10px] font-medium", tool.enabled ? "bg-accent/10 text-foreground" : "bg-muted text-muted-foreground"), children: tool.enabled ? "enabled" : "blocked" })
+      ] }) }, `${tool.sourceId}:${tool.toolName}`)) })
+    ] }) : null
+  ] });
+}
+function BoringMcpSourcesPanel({ options }) {
+  const providers = resolveProviders(options);
+  const sourceApi = options.sourceApi?.enabled ? options.sourceApi : void 0;
+  const browserActions = sourceApi ? createBrowserSourceActions(sourceApi) : {};
+  const actions = { ...browserActions, ...options.sourceActions ?? {} };
+  const [sourceStatuses, setSourceStatuses] = useState(options.sourceStatuses ?? []);
+  const [pending, setPending] = useState();
+  const [actionError, setActionError] = useState();
+  const [expandedProviderId, setExpandedProviderId] = useState();
+  const [toolsBySourceId, setToolsBySourceId] = useState({});
+  const [toolsPendingSourceId, setToolsPendingSourceId] = useState();
+  const [toolsErrors, setToolsErrors] = useState({});
+  useEffect(() => {
+    setSourceStatuses(options.sourceStatuses ?? []);
+  }, [options.sourceStatuses]);
+  useEffect(() => {
+    if (!sourceApi) return;
+    let cancelled = false;
+    void (async () => {
+      try {
+        const result = await sourceApiRequest(sourceApi, "/api/v1/boring-mcp/sources");
+        if (!cancelled) setSourceStatuses(result.sourceStatuses);
+      } catch (error) {
+        if (!cancelled) setActionError(actionErrorMessage(error));
+      }
+    })();
+    return () => {
+      cancelled = true;
+    };
+  }, [sourceApi?.enabled, sourceApi?.baseUrl, sourceApi?.workspaceId, sourceApi?.resolveWorkspaceId]);
+  const loadTools = (sourceId, providerId, refresh = false) => {
+    if (!actions.onListTools) return;
+    if (!refresh && toolsBySourceId[sourceId]) return;
+    setToolsPendingSourceId(sourceId);
+    setToolsErrors((current) => ({ ...current, [sourceId]: "" }));
+    void (async () => {
+      try {
+        const tools = await actions.onListTools?.(sourceId, providerId, refresh);
+        setToolsBySourceId((current) => ({ ...current, [sourceId]: tools ?? [] }));
+      } catch (error) {
+        setToolsErrors((current) => ({ ...current, [sourceId]: actionErrorMessage(error) }));
+      } finally {
+        setToolsPendingSourceId((current) => current === sourceId ? void 0 : current);
+      }
+    })();
+  };
+  const runAction = (key, action) => {
+    setPending(key);
+    setActionError(void 0);
+    void (async () => {
+      try {
+        const result = await action();
+        setSourceStatuses((current) => upsertSourceStatus(current, result));
+      } catch (error) {
+        setActionError(actionErrorMessage(error));
+      } finally {
+        setPending((current) => current === key ? void 0 : current);
+      }
+    })();
+  };
+  const toggleProvider = (provider, sourceStatus) => {
+    const next = expandedProviderId === provider.id ? void 0 : provider.id;
+    setExpandedProviderId(next);
+    if (next && sourceStatus?.source.status === "connected" && sourceStatus.source.id) {
+      actions.onViewTools?.(sourceStatus.source.id, provider.id);
+      loadTools(sourceStatus.source.id, provider.id, false);
+    }
+  };
+  return /* @__PURE__ */ jsxs("div", { className: "boring-scrollbar-discreet min-h-0 flex-1 overflow-y-auto p-4", children: [
+    actionError ? /* @__PURE__ */ jsx("div", { role: "alert", "aria-live": "polite", className: "mb-4 rounded-lg border border-destructive/30 bg-destructive/8 px-3 py-2 text-sm text-destructive", children: actionError }) : null,
+    providers.length === 0 ? /* @__PURE__ */ jsx("div", { className: "flex h-full min-h-[180px] items-center justify-center text-center text-sm text-muted-foreground", children: /* @__PURE__ */ jsxs("div", { children: [
+      /* @__PURE__ */ jsx("div", { className: "font-medium text-foreground/80", children: "No MCP providers enabled" }),
+      /* @__PURE__ */ jsx("p", { className: "mt-1 max-w-xs", children: "Enable a provider template to connect MCP tools." })
+    ] }) }) : /* @__PURE__ */ jsx("ul", { role: "list", className: "grid gap-2", children: providers.map((provider) => {
+      const sourceStatus = findSourceStatus(provider, sourceStatuses);
+      const sourceId = sourceStatus?.source.id;
+      return /* @__PURE__ */ jsx(
+        ProviderRow,
+        {
+          provider,
+          providerSetup: providerSetupState(provider, options),
+          connectionUnavailableMessage: options.connectionUnavailableMessage,
+          sourceStatus,
+          actions,
+          pending,
+          expanded: expandedProviderId === provider.id,
+          tools: sourceId ? toolsBySourceId[sourceId] : void 0,
+          toolsPending: sourceId ? toolsPendingSourceId === sourceId : false,
+          toolsError: sourceId ? toolsErrors[sourceId] : void 0,
+          runAction,
+          onToggle: toggleProvider,
+          onLoadTools: loadTools
+        },
+        provider.id
+      );
+    }) })
+  ] });
+}
+function BoringMcpSourcesOverlay({ options = {}, onClose, headerInsetStart = false, headerInsetEnd = false }) {
+  return /* @__PURE__ */ jsxs("div", { "data-boring-workspace-part": "boring-mcp-sources-overlay", className: "flex h-full min-h-0 flex-col bg-background", children: [
+    /* @__PURE__ */ jsxs("header", { className: cx(
+      "flex h-12 shrink-0 items-center justify-between border-b border-border/60",
+      headerInsetStart ? "pl-12" : "pl-4",
+      headerInsetEnd ? "pr-16" : "pr-4"
+    ), children: [
+      /* @__PURE__ */ jsxs("div", { className: "flex min-w-0 items-center gap-2", children: [
+        /* @__PURE__ */ jsx("span", { className: "grid size-7 place-items-center rounded-lg bg-foreground/[0.06] text-muted-foreground", children: /* @__PURE__ */ jsx(McpIcon, { className: "h-4 w-4" }) }),
+        /* @__PURE__ */ jsxs("div", { className: "min-w-0", children: [
+          /* @__PURE__ */ jsx("h2", { className: "truncate text-sm font-semibold tracking-tight text-foreground", children: options.tabTitle ?? options.label ?? "MCP" }),
+          /* @__PURE__ */ jsx("p", { className: "truncate text-xs text-muted-foreground", children: "Connected MCP providers and governed tools" })
+        ] })
+      ] }),
+      onClose ? /* @__PURE__ */ jsx("div", { className: "flex shrink-0 items-center gap-0.5", children: /* @__PURE__ */ jsx(
+        "button",
+        {
+          type: "button",
+          onClick: onClose,
+          "aria-label": "Close MCP",
+          title: "Close",
+          className: "inline-flex size-6 items-center justify-center rounded-md text-muted-foreground transition-colors hover:bg-muted hover:text-foreground",
+          children: /* @__PURE__ */ jsx(XIcon, {})
+        }
+      ) }) : null
+    ] }),
+    /* @__PURE__ */ jsx(BoringMcpSourcesPanel, { options })
+  ] });
+}
+function createBoringMcpPlugin(options = {}) {
+  return definePlugin({
+    id: BORING_MCP_PLUGIN_ID,
+    label: options.label ?? "MCP"
+  });
+}
+var boringMcpPlugin = createBoringMcpPlugin();
+var front_default = boringMcpPlugin;
+export {
+  AIRTABLE_MCP_TEMPLATE,
+  BORING_MCP_PLUGIN_ID,
+  BORING_MCP_SOURCES_PANEL_ID,
+  BORING_MCP_SOURCES_TAB_PANEL_ID,
+  BoringMcpSourcesOverlay,
+  BoringMcpSourcesPanel,
+  DEFAULT_MCP_PROVIDER_TEMPLATES,
+  MCP_ERROR_CODES,
+  MCP_TOOL_NAME_PATTERN,
+  McpAccessFacade,
+  McpError,
+  NOTION_MCP_TEMPLATE,
+  assertMcpToolAllowed,
+  classifyMcpTool,
+  classifyMcpTools,
+  containsMcpCanary,
+  containsMcpSecret,
+  containsMcpSecretOrCanary,
+  createBoringMcpPlugin,
+  front_default as default,
+  doctorMcpSource,
+  getMcpProviderTemplate,
+  redactMcpSecrets,
+  toMcpSourceDto,
+  validateMcpToolName
+};