@opengeni/react 3.3.2 → 3.4.1-canary.38960406141001

package/dist/chunk-ZQV5W7YC.js

@@ -0,0 +1,809 @@
+"use client";
+import {
+  usePortalTokenStyle
+} from "./chunk-XEA5BCMA.js";
+
+// src/hooks/use-connect.ts
+import { useMemo, useSyncExternalStore } from "react";
+function useConnect(controller) {
+  const snapshot = useSyncExternalStore(
+    controller.subscribe,
+    controller.getSnapshot,
+    controller.getSnapshot
+  );
+  const actions = useMemo(
+    () => ({
+      begin: controller.begin.bind(controller),
+      recover: controller.recover.bind(controller),
+      refresh: controller.refresh.bind(controller),
+      waitForAction: controller.waitForAction.bind(controller),
+      advance: controller.advance.bind(controller),
+      cancel: controller.cancel.bind(controller)
+    }),
+    [controller]
+  );
+  return useMemo(() => ({ ...snapshot, ...actions }), [snapshot, actions]);
+}
+
+// src/session-capability-policy.ts
+function sessionCapabilityTools(item) {
+  const serverId = item.kind === "mcp" ? item.runtime?.mcpServerId : void 0;
+  return serverId && !item.tools.some((tool) => tool.kind === "mcp" && tool.id === serverId) ? [...item.tools, { kind: "mcp", id: serverId }] : item.tools;
+}
+async function attachSessionCapability(client, workspaceId, sessionId, item, stillCurrent = () => true) {
+  const tools = sessionCapabilityTools(item);
+  if (item.kind === "skill" || tools.length === 0) return;
+  if (!stillCurrent()) throw new Error("Connection setup was interrupted.");
+  const session = await client.getSession(workspaceId, sessionId);
+  if (!stillCurrent()) throw new Error("Connection setup was interrupted.");
+  const request = capabilityToolPolicyUpdate(session, item);
+  if (request) await client.updateSessionToolPolicy(workspaceId, sessionId, request);
+}
+function capabilityToolPolicyUpdate(session, item) {
+  const tools = sessionCapabilityTools(item);
+  if (item.kind === "skill" || tools.length === 0) return null;
+  let existing = session.tools.filter(
+    (tool) => !session.effectiveToolPolicy?.mandatoryIds?.includes(tool.id)
+  );
+  if (session.toolPolicy.mode === "workspace_default") {
+    const policy = session.effectiveToolPolicy;
+    if (!policy || policy.idsTruncated)
+      throw new Error(
+        "Connected, but the full session tool selection could not be read. Review the Tools picker before continuing."
+      );
+    existing = policy.effectiveIds.filter((id) => !policy.mandatoryIds.includes(id)).map(
+      (id) => session.tools.find((tool) => tool.kind === "mcp" && tool.id === id) ?? {
+        kind: "mcp",
+        id,
+        optional: true
+      }
+    );
+  }
+  const additions = tools.filter(
+    (tool) => !session.effectiveToolPolicy?.mandatoryIds.includes(tool.id) && !existing.some((current) => current.kind === tool.kind && current.id === tool.id)
+  );
+  const recommended = Array.isArray(item.metadata?.firstPartyMcpTools) ? item.metadata.firstPartyMcpTools.filter(
+    (name) => typeof name === "string"
+  ) : [];
+  const firstParty = [.../* @__PURE__ */ new Set([...session.firstPartyMcpTools, ...recommended])];
+  if (additions.length === 0 && firstParty.length === session.firstPartyMcpTools.length)
+    return null;
+  return {
+    mode: "explicit",
+    tools: [...existing, ...additions],
+    firstPartyMcpTools: firstParty,
+    expectedVersion: session.toolPolicyVersion
+  };
+}
+async function prepareSessionCapabilityAccess(client, workspaceId, sessionId, item, stillCurrent = () => true) {
+  const sessions = [];
+  if (item.kind === "skill" || sessionCapabilityTools(item).length === 0)
+    return { workspaceId, sessionId, capabilityId: item.id, sessions };
+  const visited = /* @__PURE__ */ new Set();
+  let id = sessionId;
+  while (id) {
+    if (!stillCurrent()) throw new Error("Connection setup was interrupted.");
+    if (visited.has(id)) throw new Error("The parent chat chain could not be verified.");
+    visited.add(id);
+    const session = await client.getSession(workspaceId, id);
+    if (!stillCurrent()) throw new Error("Connection setup was interrupted.");
+    const request = capabilityToolPolicyUpdate(session, item);
+    sessions.push({
+      id,
+      title: session.title ?? null,
+      parentSessionId: session.parentSessionId ?? null,
+      toolPolicyVersion: session.toolPolicyVersion,
+      request
+    });
+    if (!request) break;
+    id = session.parentSessionId ?? null;
+  }
+  return { workspaceId, sessionId, capabilityId: item.id, sessions: sessions.reverse() };
+}
+async function applySessionCapabilityAccess(client, plan, stillCurrent = () => true) {
+  for (const reviewed of plan.sessions) {
+    if (!stillCurrent()) throw new Error("Connection setup was interrupted.");
+    const current = await client.getSession(plan.workspaceId, reviewed.id);
+    if (!stillCurrent()) throw new Error("Connection setup was interrupted.");
+    if (current.toolPolicyVersion !== reviewed.toolPolicyVersion || (current.parentSessionId ?? null) !== reviewed.parentSessionId)
+      throw new Error("Chat access changed. Click Add tools to review the current choices again.");
+  }
+  for (const reviewed of plan.sessions) {
+    if (!stillCurrent()) throw new Error("Connection setup was interrupted.");
+    if (reviewed.request) {
+      const updated = await client.updateSessionToolPolicy(
+        plan.workspaceId,
+        reviewed.id,
+        reviewed.request
+      );
+      if (reviewed.request.mode === "explicit" && reviewed.request.firstPartyMcpTools.some(
+        (tool) => !updated.firstPartyMcpTools.includes(tool)
+      ))
+        throw new Error(
+          "This chat's capabilities do not allow these tools. Review its capability settings before adding tools again."
+        );
+    }
+  }
+}
+async function completeSessionCapabilityOAuth(client, workspaceId, sessionId, capabilityId) {
+  if (!capabilityId)
+    throw new Error(
+      "The authorized integration could not be identified. Review its connection card to finish setup."
+    );
+  const connected = (await client.listCapabilities(workspaceId)).items.find(
+    (item) => item.id === capabilityId
+  );
+  if (!connected?.enabled)
+    throw new Error("The connection was authorized, but enabling its tools could not be verified.");
+  await attachSessionCapability(client, workspaceId, sessionId, connected);
+}
+
+// src/components/session-capability-frame.tsx
+import { CheckIcon, InfoIcon, ShieldCheckIcon, XIcon } from "lucide-react";
+import { Dialog } from "radix-ui";
+import { useRef, useState } from "react";
+import { Fragment, jsx, jsxs } from "react/jsx-runtime";
+function Mark({ src, name }) {
+  const [failed, setFailed] = useState(null);
+  return /* @__PURE__ */ jsx("span", { className: "og-session-capability-logo", "aria-hidden": true, children: src && failed !== src ? /* @__PURE__ */ jsx("img", { src, alt: "", loading: "lazy", decoding: "async", onError: () => setFailed(src) }) : name.trim().slice(0, 2).toUpperCase() });
+}
+function SessionCapabilityFrame({
+  name,
+  subtitle,
+  logo,
+  typeLabel,
+  description,
+  skill,
+  expanded,
+  complete,
+  completeLabel,
+  actionLabel,
+  opensDialog = true,
+  note,
+  onOpen,
+  onClose,
+  busy = false,
+  opener,
+  cardRef,
+  children,
+  dialogOnly = false,
+  actionUnavailable,
+  details,
+  inlineSetup
+}) {
+  const localOpener = useRef(null);
+  const localCard = useRef(null);
+  const buttonRef = opener ?? localOpener;
+  const sectionRef = cardRef ?? localCard;
+  const portalStyle = usePortalTokenStyle(sectionRef.current);
+  const identity = /* @__PURE__ */ jsxs(Fragment, { children: [
+    /* @__PURE__ */ jsx(Mark, { src: logo, name }),
+    /* @__PURE__ */ jsxs("div", { className: "og-session-capability-identity", children: [
+      /* @__PURE__ */ jsx("h3", { children: name }),
+      /* @__PURE__ */ jsx("span", { children: subtitle })
+    ] }),
+    /* @__PURE__ */ jsx("span", { className: "og-session-capability-type", children: typeLabel })
+  ] });
+  return /* @__PURE__ */ jsxs("div", { className: "og-session-capability", children: [
+    /* @__PURE__ */ jsxs(
+      "section",
+      {
+        hidden: dialogOnly,
+        style: dialogOnly ? { display: "none" } : void 0,
+        ref: sectionRef,
+        tabIndex: -1,
+        "aria-label": `${name} setup`,
+        "data-state": complete ? "complete" : expanded ? "setup" : "suggested",
+        className: "og-session-capability-shell",
+        children: [
+          /* @__PURE__ */ jsxs("div", { className: "og-session-capability-header", children: [
+            identity,
+            complete ? /* @__PURE__ */ jsx(CheckIcon, { size: 16, "aria-hidden": true }) : null
+          ] }),
+          complete ? /* @__PURE__ */ jsx("p", { role: "status", className: "og-session-capability-copy", children: completeLabel ?? (skill ? "Installed \xB7 Workspace" : "Connected \xB7 Available in this conversation") }) : /* @__PURE__ */ jsxs(Fragment, { children: [
+            /* @__PURE__ */ jsx("p", { className: "og-session-capability-copy", children: description }),
+            inlineSetup ? /* @__PURE__ */ jsx("div", { className: "og-session-capability-setup", children: inlineSetup }) : actionUnavailable ? /* @__PURE__ */ jsx("div", { className: "og-session-capability-actions", "data-unavailable": "", children: /* @__PURE__ */ jsxs("span", { role: "note", children: [
+              /* @__PURE__ */ jsx(InfoIcon, { size: 13, "aria-hidden": true }),
+              actionUnavailable
+            ] }) }) : /* @__PURE__ */ jsxs("div", { className: "og-session-capability-actions", children: [
+              /* @__PURE__ */ jsxs("span", { children: [
+                /* @__PURE__ */ jsx(ShieldCheckIcon, { size: 13, "aria-hidden": true }),
+                skill ? "Guidance only \xB7 no account access" : "You choose what to authorize"
+              ] }),
+              /* @__PURE__ */ jsx(
+                "button",
+                {
+                  ref: buttonRef,
+                  type: "button",
+                  onClick: onOpen,
+                  disabled: busy,
+                  "aria-haspopup": opensDialog ? "dialog" : void 0,
+                  "aria-expanded": opensDialog ? expanded : void 0,
+                  children: actionLabel
+                }
+              )
+            ] })
+          ] }),
+          details
+        ]
+      }
+    ),
+    !complete && !dialogOnly && note ? /* @__PURE__ */ jsx("p", { className: "og-session-capability-note", children: note }) : null,
+    /* @__PURE__ */ jsx(
+      Dialog.Root,
+      {
+        open: expanded && !complete,
+        onOpenChange: (open) => {
+          if (!open && !busy) onClose();
+        },
+        children: /* @__PURE__ */ jsxs(Dialog.Portal, { children: [
+          /* @__PURE__ */ jsx(Dialog.Overlay, { className: "og-root og-session-capability-overlay", style: portalStyle }),
+          /* @__PURE__ */ jsxs(
+            Dialog.Content,
+            {
+              className: "og-root og-session-capability-dialog",
+              style: portalStyle,
+              onEscapeKeyDown: (event) => {
+                if (busy) event.preventDefault();
+              },
+              onInteractOutside: (event) => {
+                if (busy) event.preventDefault();
+              },
+              onCloseAutoFocus: (event) => {
+                event.preventDefault();
+                const target = buttonRef.current?.isConnected ? buttonRef.current : sectionRef.current;
+                if (target?.isConnected) target.focus();
+              },
+              children: [
+                /* @__PURE__ */ jsxs("div", { className: "og-session-capability-dialog-header", children: [
+                  /* @__PURE__ */ jsx(Mark, { src: logo, name }),
+                  /* @__PURE__ */ jsxs("div", { children: [
+                    /* @__PURE__ */ jsx(Dialog.Title, { children: name }),
+                    /* @__PURE__ */ jsxs(Dialog.Description, { children: [
+                      typeLabel,
+                      subtitle ? ` \xB7 ${subtitle}` : ""
+                    ] })
+                  ] }),
+                  !busy ? /* @__PURE__ */ jsx(Dialog.Close, { "aria-label": "Close connection setup", children: /* @__PURE__ */ jsx(XIcon, { size: 18 }) }) : null
+                ] }),
+                /* @__PURE__ */ jsx("div", { className: "og-session-capability-dialog-body", children })
+              ]
+            }
+          )
+        ] })
+      }
+    )
+  ] });
+}
+
+// src/components/session-mcp-capability-card.tsx
+import {
+  authorizeConnectAttempt,
+  ConnectPopupClosedError,
+  ConnectController,
+  createBrowserConnectNavigation,
+  reserveBrowserConnectNavigation
+} from "@opengeni/connect";
+import { useEffect, useRef as useRef2, useState as useState2 } from "react";
+
+// src/mcp-connection-status.ts
+function matchingActiveMcpConnections(item, connections) {
+  return matchingMcpConnections(item, connections).filter((entry) => entry.status === "active");
+}
+function matchingMcpConnections(item, connections) {
+  const ref = item.connectionRef;
+  if (!item.enabled || !ref) return [];
+  return connections.filter(
+    (entry) => entry.status !== "revoked" && entry.kind === "oauth2" && entry.metadata.mcpUrl === (item.mcpUrl ?? item.endpointUrl) && (ref.subjectScope !== "subject" ? entry.id === ref.connectionId && entry.subjectId === null : entry.subjectId !== null)
+  );
+}
+function mcpConnectionDiscoveryState(item, connections) {
+  const matching = matchingMcpConnections(item, connections);
+  const active = matching.filter((entry) => entry.status === "active");
+  if (active.length === 1) return { status: "added", label: "Connected" };
+  if (matching.length > 0) return { status: "attention", label: "Review connection" };
+  return { status: "available", label: "Connect" };
+}
+
+// src/components/session-mcp-capability-card.tsx
+import { Fragment as Fragment2, jsx as jsx2, jsxs as jsxs2 } from "react/jsx-runtime";
+function SessionMcpCapabilityCard(props) {
+  return /* @__PURE__ */ jsx2(McpConnectionCard, { ...props });
+}
+function McpConnectionCard(props) {
+  const [client, setClient] = useState2(props.client);
+  const [generation, setGeneration] = useState2(0);
+  if (client !== props.client) {
+    setClient(props.client);
+    setGeneration(generation + 1);
+  }
+  return /* @__PURE__ */ jsx2(
+    ScopedCard,
+    {
+      ...props
+    },
+    `${generation}:${props.workspaceId}:${props.sessionId}:${props.capabilityId}`
+  );
+}
+function ScopedCard({
+  client,
+  workspaceId,
+  sessionId,
+  capabilityId,
+  name,
+  rationale = "",
+  returnUrl,
+  onConfigured,
+  dialogOnly = false,
+  onClose,
+  personalOnly = false,
+  connectLabel,
+  dialogSubtitle,
+  description: hostDescription,
+  logoSrc,
+  ownershipCopy
+}) {
+  const [controller] = useState2(
+    () => new ConnectController(client.connectTransport(), workspaceId)
+  );
+  const view = useConnect(controller);
+  const [item, setItem] = useState2(null);
+  const [logo, setLogo] = useState2(null);
+  const [expanded, setExpanded] = useState2(dialogOnly);
+  const [complete, setComplete] = useState2(false);
+  const [connected, setConnected] = useState2(false);
+  const [waiting, setWaiting] = useState2(false);
+  const [reconciling, setReconciling] = useState2(false);
+  const [busy, setBusy] = useState2(false);
+  const [error, setError] = useState2(null);
+  const [notice, setNotice] = useState2(null);
+  const [retryFresh, setRetryFresh] = useState2(false);
+  const [ownership, setOwnership] = useState2(
+    personalOnly ? "personal" : "workspace"
+  );
+  const lifetime = useRef2(null);
+  const authorization = useRef2(null);
+  const operation = useRef2(null);
+  const reservedPopup = useRef2(null);
+  const startKey = useRef2(crypto.randomUUID());
+  const advanceKey = useRef2(crypto.randomUUID());
+  const startInput = useRef2(null);
+  const storageKey = sessionId ? `opengeni:session-connect:${workspaceId}:${sessionId}:${capabilityId}` : `opengeni:workspace-connect:${workspaceId}:${capabilityId}`;
+  const current = () => !!lifetime.current && !lifetime.current.signal.aborted;
+  async function load(active = current) {
+    const invocation = lifetime.current;
+    const [catalog, session] = await Promise.all([
+      client.listCapabilities(workspaceId),
+      sessionId ? client.getSession(workspaceId, sessionId) : Promise.resolve(null)
+    ]);
+    if (!invocation || invocation.signal.aborted || lifetime.current !== invocation || !active())
+      return null;
+    let resolved = catalog.items.find((entry) => entry.id === capabilityId);
+    if (resolved?.kind === "mcp" && !resolved.enabled && !resolved.authKind) {
+      const endpoint = resolved.mcpUrl ?? resolved.endpointUrl;
+      if (endpoint) {
+        const inspected = await client.inspectMcpAuthentication(workspaceId, endpoint);
+        if (invocation.signal.aborted || lifetime.current !== invocation || !active()) return null;
+        if (inspected.kind === "oauth2") resolved = { ...resolved, authKind: "oauth2" };
+        else if (inspected.kind === "unknown")
+          throw new Error(inspected.message ?? "Could not determine how to sign in. Try again.");
+      }
+    }
+    if (!resolved || resolved.kind !== "mcp" || resolved.authKind !== "oauth2")
+      throw new Error(
+        "This recommendation is not an available OAuth MCP integration. Review the current connection catalog."
+      );
+    setItem(resolved);
+    if (resolved.connectionRef)
+      setOwnership(resolved.connectionRef.subjectScope === "subject" ? "personal" : "workspace");
+    else if (!item && (personalOnly || resolved.metadata?.defaultConnectionOwnership === "personal"))
+      setOwnership("personal");
+    let accountReady = false;
+    if (resolved.enabled && resolved.connectionRef) {
+      const connections = resolved.connectionRef.subjectScope === "subject" ? await client.listOwnConnectionAccounts(workspaceId) : await client.listConnections(workspaceId);
+      if (invocation.signal.aborted || lifetime.current !== invocation || !active()) return null;
+      const matches = matchingActiveMcpConnections(resolved, connections);
+      accountReady = matches.length === 1;
+    }
+    if (invocation.signal.aborted || lifetime.current !== invocation || !active()) return null;
+    const selected = session?.toolPolicy.mode === "workspace_default" ? session.effectiveToolPolicy?.selectedIds : session?.tools.filter((tool) => tool.kind === "mcp").map((tool) => tool.id);
+    setConnected(accountReady);
+    setComplete(
+      accountReady && !!selected && sessionCapabilityTools(resolved).every((tool) => selected.includes(tool.id))
+    );
+    return resolved;
+  }
+  useEffect(() => {
+    const abort = new AbortController();
+    lifetime.current = abort;
+    if (dialogOnly) setBusy(true);
+    void (async () => {
+      await load();
+      if (abort.signal.aborted || !dialogOnly) return;
+      await recoverSavedAttempt();
+    })().catch((failure) => {
+      if (!abort.signal.aborted)
+        setError(
+          failure instanceof Error ? failure.message : "Couldn't load connection details."
+        );
+    }).finally(() => {
+      if (!abort.signal.aborted && dialogOnly) setBusy(false);
+    });
+    return () => {
+      abort.abort();
+    };
+  }, [client, workspaceId, sessionId, capabilityId, dialogOnly]);
+  useEffect(() => {
+    const path = item?.logoAssetPath;
+    setLogo(null);
+    if (!path?.startsWith("catalog-assets/")) return;
+    const abort = new AbortController();
+    let objectUrl = null;
+    void client.downloadCatalogAsset(path, { signal: abort.signal }).then((blob) => {
+      if (abort.signal.aborted || !blob.type.startsWith("image/") || blob.size > 2e6)
+        return;
+      objectUrl = URL.createObjectURL(blob);
+      setLogo(objectUrl);
+    }).catch(() => {
+    });
+    return () => {
+      abort.abort();
+      if (objectUrl) URL.revokeObjectURL(objectUrl);
+    };
+  }, [client, item?.logoAssetPath]);
+  async function run(action) {
+    if (operation.current || !current()) return;
+    const pending = new AbortController();
+    operation.current = pending;
+    const active = () => current() && operation.current === pending && !pending.signal.aborted;
+    setBusy(true);
+    setError(null);
+    setNotice(null);
+    setRetryFresh(false);
+    try {
+      await action(active);
+    } catch (failure) {
+      if (active()) {
+        if (failure instanceof ConnectPopupClosedError) setNotice(failure.message);
+        else
+          setError(
+            failure instanceof Error ? failure.message : "Connection setup could not finish. Try again."
+          );
+      }
+    } finally {
+      if (operation.current === pending) {
+        operation.current = null;
+        if (current()) setBusy(false);
+      }
+    }
+  }
+  function remember(attemptId) {
+    try {
+      sessionStorage.setItem(storageKey, attemptId);
+    } catch {
+    }
+  }
+  async function reconcile(attempt, active = current) {
+    if (!active()) return;
+    if (attempt.state !== "complete" || !attempt.account || !attempt.credentialsCommitted) return;
+    const resolved = await load(active);
+    if (!resolved || !active()) return;
+    const connection = (await client.listConnections(workspaceId)).find(
+      (entry) => entry.id === attempt.account.id
+    );
+    if (!active()) return;
+    if (!connection || connection.status !== "active" || connection.kind !== "oauth2" || connection.metadata.mcpUrl !== (resolved.mcpUrl ?? resolved.endpointUrl) || connection.subjectId !== null !== (attempt.ownership === "personal"))
+      throw new Error(
+        "The authorized account does not match this integration. Review its connection settings."
+      );
+    const previous = resolved.connectionRef;
+    if (resolved.enabled && previous?.subjectScope !== "subject" && previous?.connectionId && previous.connectionId !== connection.id)
+      throw new Error(
+        "This integration's selected account changed during setup. Review it before continuing."
+      );
+    await client.enableCapability(workspaceId, capabilityId, {
+      connectionRef: attempt.ownership === "personal" ? { providerDomain: connection.providerDomain, kind: "oauth2", subjectScope: "subject" } : {
+        providerDomain: connection.providerDomain,
+        kind: "oauth2",
+        subjectScope: "workspace",
+        connectionId: connection.id
+      }
+    });
+    if (!active()) return;
+    const enabled = await load(active);
+    if (enabled && active()) {
+      await finishConnection(enabled, active);
+    }
+    if (!active()) return;
+    try {
+      sessionStorage.removeItem(storageKey);
+    } catch {
+    }
+  }
+  async function open() {
+    setExpanded(true);
+    await run(async (active) => {
+      await load(active);
+      if (!active()) return;
+      await recoverSavedAttempt(active);
+    });
+  }
+  async function recoverSavedAttempt(active = current) {
+    let saved = null;
+    try {
+      saved = sessionStorage.getItem(storageKey);
+    } catch {
+    }
+    if (saved) {
+      const attempt = await controller.recover(saved);
+      if (!active()) return;
+      if (["failed", "expired", "cancelled"].includes(attempt.state)) setRetryFresh(true);
+      if (attempt.state === "complete") setReconciling(true);
+      try {
+        await reconcile(attempt, active);
+      } finally {
+        if (active()) setReconciling(false);
+      }
+    }
+  }
+  async function begin(fresh = false) {
+    await run(async (active) => {
+      if (fresh || view.attempt && ["failed", "expired", "cancelled"].includes(view.attempt.state)) {
+        startKey.current = crypto.randomUUID();
+        advanceKey.current = crypto.randomUUID();
+      }
+      const reserved = reserveBrowserConnectNavigation(window);
+      reservedPopup.current = reserved.close;
+      try {
+        const resolved = await load(active);
+        if (!resolved || !active()) return;
+        if (resolved.connectionRef && ownership !== (resolved.connectionRef.subjectScope === "subject" ? "personal" : "workspace"))
+          throw new Error(
+            "The connection ownership changed. Review the current account before continuing."
+          );
+        const mcpUrl = resolved.mcpUrl ?? resolved.endpointUrl;
+        if (!mcpUrl)
+          throw new Error(
+            "The current catalog has no authorization endpoint for this integration."
+          );
+        let reconnectAccountId = resolved.connectionRef?.connectionId ?? void 0;
+        if (resolved.connectionRef?.subjectScope === "subject") {
+          const connections = (await client.listConnections(workspaceId)).filter(
+            (entry) => entry.subjectId !== null && entry.kind === "oauth2" && entry.metadata.mcpUrl === mcpUrl
+          );
+          if (!active()) return;
+          if (connections.length > 1)
+            throw new Error(
+              "More than one personal account matches. Choose the account in connection settings before reconnecting."
+            );
+          reconnectAccountId = connections[0]?.id;
+        }
+        const input = JSON.stringify({ ownership, returnUrl, reconnectAccountId, mcpUrl });
+        if (startInput.current !== null && startInput.current !== input) {
+          startKey.current = crypto.randomUUID();
+          advanceKey.current = crypto.randomUUID();
+        }
+        startInput.current = input;
+        let attempt = await controller.begin({
+          providerId: "mcp-oauth",
+          ownership,
+          returnUrl,
+          idempotencyKey: startKey.current,
+          ...reconnectAccountId ? { reconnectAccountId } : {}
+        });
+        if (!active()) return;
+        remember(attempt.id);
+        if (attempt.state === "credential_input")
+          attempt = await controller.advance(
+            { type: "credentials", values: { mcpUrl } },
+            advanceKey.current
+          );
+        if (!active()) return;
+        if (attempt.nextAction.type === "authorize")
+          await performAuthorization(attempt, reserved.navigation, active);
+        else await reconcile(attempt, active);
+      } finally {
+        if (reservedPopup.current === reserved.close) reservedPopup.current = null;
+        reserved.close();
+      }
+    });
+  }
+  async function performAuthorization(attempt, navigation, active) {
+    if (!active()) return;
+    const pending = new AbortController();
+    authorization.current = pending;
+    const abortOnUnmount = () => pending.abort(lifetime.current?.signal.reason);
+    lifetime.current.signal.addEventListener("abort", abortOnUnmount, { once: true });
+    setWaiting(true);
+    try {
+      const result = await authorizeConnectAttempt(controller.transport, attempt, navigation, {
+        mode: "popup",
+        signal: pending.signal
+      });
+      if (!active() || !result) return;
+      setWaiting(false);
+      setReconciling(true);
+      await reconcile(result, active);
+      if (!active()) return;
+      if (result.state === "cancelled") {
+        setNotice("Sign-in was cancelled. You can try connecting again.");
+        setRetryFresh(true);
+        return;
+      }
+      if (result.state !== "complete") {
+        if (["failed", "expired"].includes(result.state)) setRetryFresh(true);
+        throw new Error("Sign-in did not finish. You can try connecting again.");
+      }
+    } finally {
+      lifetime.current?.signal.removeEventListener("abort", abortOnUnmount);
+      if (authorization.current === pending) authorization.current = null;
+      if (active()) {
+        setReconciling(false);
+        setWaiting(false);
+      }
+    }
+  }
+  function authorize(attempt) {
+    return run(
+      (active) => performAuthorization(attempt, createBrowserConnectNavigation(window), active)
+    );
+  }
+  async function finishConnection(capability, active = current) {
+    if (!sessionId) {
+      await onConfigured?.();
+      if (!active()) return;
+      setComplete(true);
+      setExpanded(false);
+      onClose?.();
+      return;
+    }
+    if (capability.connectionRef && capability.connectionRef.subjectScope !== "subject") {
+      const selected = (await client.listConnections(workspaceId)).find(
+        (entry) => entry.id === capability.connectionRef?.connectionId
+      );
+      if (!active()) return;
+      if (!selected || selected.status !== "active")
+        throw new Error("This account needs reconnection before it can be used here.");
+    }
+    if (capability.connectionRef?.subjectScope === "subject") {
+      const accounts = await client.listOwnConnectionAccounts(workspaceId);
+      if (!active()) return;
+      if (matchingActiveMcpConnections(capability, accounts).length === 0)
+        throw new Error("Your account needs reconnection before it can be used here.");
+    }
+    if (!active()) return;
+    await attachSessionCapability(client, workspaceId, sessionId, capability, active);
+    if (!active()) return;
+    await onConfigured?.();
+    if (!active()) return;
+    setComplete(true);
+    setExpanded(false);
+  }
+  async function useHere() {
+    await run(async (active) => {
+      if (item) await finishConnection(item, active);
+    });
+  }
+  function close() {
+    const pending = operation.current;
+    if (pending) {
+      operation.current = null;
+      pending.abort(new ConnectPopupClosedError());
+      authorization.current?.abort(new ConnectPopupClosedError());
+      authorization.current = null;
+      reservedPopup.current?.();
+      setBusy(false);
+      setWaiting(false);
+      setReconciling(false);
+    }
+    setExpanded(false);
+    onClose?.();
+  }
+  return /* @__PURE__ */ jsx2(
+    SessionCapabilityFrame,
+    {
+      name: item?.name ?? name,
+      subtitle: dialogSubtitle !== void 0 ? "" : item?.providerDomain ?? "",
+      logo: logo ?? logoSrc ?? null,
+      typeLabel: dialogSubtitle ?? "MCP server",
+      description: hostDescription || item?.description || rationale,
+      skill: false,
+      expanded,
+      complete,
+      actionLabel: connected ? sessionId ? "Use in this conversation" : "Connected" : `Connect ${item?.name ?? name}`,
+      note: sessionId ? "Review access before signing in. You'll return to this conversation after authorization." : "Review access before signing in. You'll return here after authorization.",
+      onOpen: () => void open(),
+      onClose: close,
+      dialogOnly,
+      children: /* @__PURE__ */ jsxs2("div", { className: "og-session-capability-setup", children: [
+        error ? /* @__PURE__ */ jsx2("p", { role: "alert", children: error }) : null,
+        notice ? /* @__PURE__ */ jsx2("p", { role: "status", className: "og-session-capability-notice", children: notice }) : null,
+        !item ? /* @__PURE__ */ jsxs2(Fragment2, { children: [
+          /* @__PURE__ */ jsx2("p", { role: "status", children: busy ? "Loading connection details\u2026" : "Connection details are unavailable." }),
+          /* @__PURE__ */ jsx2("button", { disabled: busy, onClick: () => void open(), children: "Retry" })
+        ] }) : /* @__PURE__ */ jsxs2(Fragment2, { children: [
+          /* @__PURE__ */ jsx2("p", { children: hostDescription || item.description || rationale }),
+          busy ? /* @__PURE__ */ jsxs2(Fragment2, { children: [
+            /* @__PURE__ */ jsx2("p", { role: "status", className: "og-session-capability-progress", children: waiting ? `Finish signing in with ${item.name} in the opened window. This will close automatically when you\u2019re connected.` : reconciling ? "Finishing your connection\u2026" : "Preparing your connection\u2026" }),
+            waiting ? /* @__PURE__ */ jsx2(
+              "button",
+              {
+                type: "button",
+                className: "og-session-capability-stop",
+                onClick: () => authorization.current?.abort(new ConnectPopupClosedError()),
+                children: "Stop waiting"
+              }
+            ) : null
+          ] }) : !connected ? /* @__PURE__ */ jsxs2(Fragment2, { children: [
+            !item.connectionRef && !personalOnly ? /* @__PURE__ */ jsxs2("fieldset", { disabled: busy, children: [
+              /* @__PURE__ */ jsx2("legend", { children: ownershipCopy?.legend ?? "Who can use this connection?" }),
+              /* @__PURE__ */ jsxs2("label", { children: [
+                /* @__PURE__ */ jsx2(
+                  "input",
+                  {
+                    type: "radio",
+                    name: `${capabilityId}-ownership`,
+                    checked: ownership === "workspace",
+                    onChange: () => setOwnership("workspace")
+                  }
+                ),
+                "Everyone in this workspace"
+              ] }),
+              /* @__PURE__ */ jsxs2("label", { children: [
+                /* @__PURE__ */ jsx2(
+                  "input",
+                  {
+                    type: "radio",
+                    name: `${capabilityId}-ownership`,
+                    checked: ownership === "personal",
+                    onChange: () => setOwnership("personal")
+                  }
+                ),
+                "Only me"
+              ] })
+            ] }) : null,
+            /* @__PURE__ */ jsx2("p", { className: "og-session-capability-scope", children: personalOnly && ownership === "personal" ? "Connects your own account. Only work you start can use it." : ownershipCopy ? ownership === "workspace" ? ownershipCopy.workspace : ownershipCopy.personal : ownership === "workspace" ? sessionId ? "This connection will be available to your workspace and used in this conversation." : "This connection will be available to your workspace." : "This connection belongs to you. Your messages can use it; other participants use their own accounts." }),
+            /* @__PURE__ */ jsx2(
+              "button",
+              {
+                className: "og-session-capability-primary",
+                onClick: () => {
+                  if (notice || retryFresh) void begin(true);
+                  else if (view.attempt?.nextAction.type === "authorize" && view.attempt.ownership === ownership)
+                    void authorize(view.attempt);
+                  else void begin();
+                },
+                children: retryFresh || (error || notice) && view.attempt?.nextAction.type === "authorize" ? "Try signing in again" : connectLabel ?? `Continue to ${item.name}`
+              }
+            )
+          ] }) : null,
+          connected && !busy ? /* @__PURE__ */ jsxs2(Fragment2, { children: [
+            /* @__PURE__ */ jsx2("p", { className: "og-session-capability-scope", children: sessionId ? "Your account is connected. Enable it for this conversation to finish." : "Your account is connected." }),
+            /* @__PURE__ */ jsx2(
+              "button",
+              {
+                className: "og-session-capability-primary",
+                disabled: busy || view.busy,
+                onClick: () => void useHere(),
+                children: sessionId ? "Use in this conversation" : "Done"
+              }
+            )
+          ] }) : null
+        ] })
+      ] })
+    }
+  );
+}
+
+export {
+  useConnect,
+  attachSessionCapability,
+  prepareSessionCapabilityAccess,
+  applySessionCapabilityAccess,
+  completeSessionCapabilityOAuth,
+  SessionCapabilityFrame,
+  mcpConnectionDiscoveryState,
+  SessionMcpCapabilityCard,
+  McpConnectionCard
+};
+//# sourceMappingURL=chunk-ZQV5W7YC.js.map