@opengeni/react 4.0.2 → 5.0.2-canary.0

package/dist/connect.js

@@ -0,0 +1,831 @@
+import "./chunk-IWIDV7SB.js";
+import {
+  copyTextToClipboard
+} from "./chunk-JVYQRRC4.js";
+
+// src/connect.ts
+import { useMemo, useSyncExternalStore } from "react";
+
+// src/connect-setup.tsx
+import { useState } from "react";
+import { Fragment, jsx, jsxs } from "react/jsx-runtime";
+var setupStatus = {
+  ready: "Ready to connect",
+  requires_user_action: "Authorize your account",
+  credential_input: "Enter connection details",
+  provider_wait: "Waiting for authorization",
+  account_selection: "Choose an account",
+  resource_selection: "Choose resources",
+  preview: "Review available operations",
+  installing: "Installing selected operations\u2026",
+  connected_but_incomplete: "Account connected \u2014 finish setup",
+  complete: "Connection ready",
+  cancelled: "Setup cancelled",
+  expired: "Setup expired",
+  failed: "Setup could not finish",
+  uncertain: "Setup outcome needs checking"
+};
+function deviceVerificationUrl(action) {
+  if (action.type !== "wait" || !action.verificationUrl) return null;
+  try {
+    const url = new URL(action.verificationUrl);
+    return url.protocol === "https:" && !url.username && !url.password ? action.verificationUrl : null;
+  } catch {
+    return null;
+  }
+}
+function ConnectSetup(props) {
+  const [scope, setScope] = useState(props.controller);
+  const [generation, setGeneration] = useState(0);
+  if (scope !== props.controller) {
+    setScope(props.controller);
+    setGeneration(generation + 1);
+  }
+  return /* @__PURE__ */ jsx(ScopedSetup, { ...props }, generation);
+}
+function ScopedSetup({ controller, onAuthorize, onBrowseResources, className }) {
+  const view = useConnect(controller);
+  const [localError, setLocalError] = useState(false);
+  const invoke = (operation) => {
+    setLocalError(false);
+    try {
+      void Promise.resolve(operation()).catch(() => setLocalError(true));
+    } catch {
+      setLocalError(true);
+    }
+  };
+  const attempt = view.attempt;
+  if (!attempt)
+    return /* @__PURE__ */ jsx("section", { className, "aria-label": "Connection setup", children: /* @__PURE__ */ jsx("p", { role: "status", children: "Choose a connection to begin." }) });
+  const action = attempt.nextAction;
+  const verificationUrl = deviceVerificationUrl(action);
+  const terminal = ["complete", "cancelled", "expired"].includes(attempt.state);
+  const submit = (event) => {
+    event.preventDefault();
+    const form = event.currentTarget;
+    const data = new FormData(form);
+    if (view.busy) return;
+    const key = crypto.randomUUID();
+    if (action.type === "credentials") {
+      const values = Object.fromEntries(
+        action.fields.map((field, i) => [field.name, String(data.get(`field-${i}`) ?? "")])
+      );
+      form.reset();
+      invoke(() => view.advance({ type: "credentials", values }, key));
+    } else if (action.type === "select_account") {
+      const accountId = String(data.get("account") ?? "");
+      if (action.accounts.some((account) => account.id === accountId && account.status !== "disabled"))
+        invoke(() => view.advance({ type: "account", accountId }, key));
+    } else if (action.type === "select_resources") {
+      if (action.cursor) return;
+      const resourceIds = data.getAll("resource").map(String);
+      invoke(() => view.advance({ type: "resources", resourceIds }, key));
+    } else if (action.type === "preview") {
+      const operationIds = data.getAll("operation").map(String);
+      invoke(
+        () => view.advance(
+          {
+            type: "install",
+            previewId: action.previewId,
+            contentHash: action.contentHash,
+            operationIds
+          },
+          key
+        )
+      );
+    }
+  };
+  return /* @__PURE__ */ jsxs("section", { className, "aria-label": "Connection setup", "aria-busy": view.busy, children: [
+    /* @__PURE__ */ jsxs("p", { children: [
+      "Ownership: ",
+      attempt.ownership === "personal" ? "Personal" : "Workspace"
+    ] }),
+    /* @__PURE__ */ jsx("p", { role: "status", children: setupStatus[attempt.state] }),
+    attempt.account && /* @__PURE__ */ jsxs("p", { children: [
+      "Account: ",
+      attempt.account.label
+    ] }),
+    (localError || view.error || attempt.error) && /* @__PURE__ */ jsx("p", { role: "alert", children: attempt.error?.code === "source_changed" ? "The integration source changed. Review the new operations before installing." : "Connection setup could not continue. Refresh its status before trying again." }),
+    !terminal && /* @__PURE__ */ jsx("form", { onSubmit: submit, autoComplete: "off", children: /* @__PURE__ */ jsxs("fieldset", { disabled: view.busy, children: [
+      /* @__PURE__ */ jsx("legend", { children: "Connection details" }),
+      attempt.state === "connected_but_incomplete" && action.type === "none" && /* @__PURE__ */ jsx(
+        "button",
+        {
+          type: "button",
+          onClick: () => invoke(() => view.advance({ type: "retry" }, crypto.randomUUID())),
+          children: "Review integration operations"
+        }
+      ),
+      action.type === "credentials" && action.fields.map((field, i) => /* @__PURE__ */ jsxs("label", { children: [
+        field.label,
+        field.options ? /* @__PURE__ */ jsxs("select", { name: `field-${i}`, required: field.required, defaultValue: "", children: [
+          /* @__PURE__ */ jsx("option", { value: "", children: field.required ? "Choose an option" : "No account (public service)" }),
+          field.options.map((option) => /* @__PURE__ */ jsx("option", { value: option.value, children: option.label }, option.value))
+        ] }) : /* @__PURE__ */ jsx(
+          "input",
+          {
+            name: `field-${i}`,
+            type: field.secret ? "password" : "text",
+            required: field.required,
+            autoComplete: "off"
+          }
+        )
+      ] }, field.name)),
+      action.type === "select_account" && /* @__PURE__ */ jsxs("label", { children: [
+        "Account",
+        /* @__PURE__ */ jsxs("select", { name: "account", required: true, defaultValue: "", children: [
+          /* @__PURE__ */ jsx("option", { value: "", disabled: true, children: "Choose an account" }),
+          action.accounts.map((account) => /* @__PURE__ */ jsxs(
+            "option",
+            {
+              value: account.id,
+              disabled: account.status === "disabled",
+              children: [
+                account.label,
+                " \u2014 ",
+                account.id,
+                " (",
+                account.ownership,
+                ")"
+              ]
+            },
+            account.id
+          ))
+        ] })
+      ] }),
+      action.type === "select_resources" && action.resources.map((resource) => /* @__PURE__ */ jsxs("label", { children: [
+        /* @__PURE__ */ jsx("input", { type: "checkbox", name: "resource", value: resource.id }),
+        resource.label,
+        " (",
+        resource.kind,
+        ")"
+      ] }, resource.id)),
+      action.type === "select_resources" && action.cursor && /* @__PURE__ */ jsxs(Fragment, { children: [
+        /* @__PURE__ */ jsx("p", { children: "More resources are available. Review all pages before submitting a selection." }),
+        onBrowseResources && /* @__PURE__ */ jsx(
+          "button",
+          {
+            type: "button",
+            onClick: () => invoke(() => onBrowseResources(structuredClone(attempt))),
+            children: "Browse all resources"
+          }
+        )
+      ] }),
+      action.type === "preview" && /* @__PURE__ */ jsxs(Fragment, { children: [
+        /* @__PURE__ */ jsx("p", { children: "Select the operations to install." }),
+        action.operations.map((operation) => /* @__PURE__ */ jsxs("label", { children: [
+          /* @__PURE__ */ jsx("input", { type: "checkbox", name: "operation", value: operation.id }),
+          operation.label,
+          " (",
+          operation.kind,
+          ")"
+        ] }, operation.id))
+      ] }),
+      ["credentials", "select_account", "select_resources", "preview"].includes(
+        action.type
+      ) && /* @__PURE__ */ jsx(
+        "button",
+        {
+          type: "submit",
+          disabled: action.type === "select_resources" && Boolean(action.cursor),
+          children: action.type === "preview" ? "Install selected operations" : "Continue"
+        }
+      ),
+      action.type === "authorize" && /* @__PURE__ */ jsx(
+        "button",
+        {
+          type: "button",
+          onClick: () => invoke(() => onAuthorize(structuredClone(attempt))),
+          children: "Authorize connection"
+        }
+      ),
+      action.type === "wait" && /* @__PURE__ */ jsxs(Fragment, { children: [
+        action.userCode && /* @__PURE__ */ jsxs("p", { children: [
+          "Verification code: ",
+          /* @__PURE__ */ jsx("code", { children: action.userCode })
+        ] }),
+        /* @__PURE__ */ jsx("p", { children: "Complete provider authorization, then check the connection status." }),
+        verificationUrl && /* @__PURE__ */ jsx("a", { href: verificationUrl, target: "_blank", rel: "noopener noreferrer", children: "Open provider verification page (new tab)" })
+      ] }),
+      /* @__PURE__ */ jsx("button", { type: "button", onClick: () => invoke(() => view.refresh()), children: "Check status" }),
+      /* @__PURE__ */ jsx("button", { type: "button", onClick: () => invoke(() => view.cancel(crypto.randomUUID())), children: "Cancel setup" })
+    ] }) }, `${attempt.id}:${attempt.revision}`)
+  ] });
+}
+
+// src/connect-chooser.tsx
+import { useEffect, useState as useState2 } from "react";
+import { jsx as jsx2, jsxs as jsxs2 } from "react/jsx-runtime";
+function ConnectChooser(props) {
+  const [scope, setScope] = useState2(props.controller);
+  const [generation, setGeneration] = useState2(0);
+  if (scope !== props.controller) {
+    setScope(props.controller);
+    setGeneration(generation + 1);
+  }
+  return /* @__PURE__ */ jsx2(ScopedChooser, { ...props }, generation);
+}
+function ScopedChooser({ controller, returnUrl, className }) {
+  const view = useConnect(controller);
+  const [catalog, setCatalog] = useState2(null);
+  const [failed, setFailed] = useState2(false);
+  const [load, setLoad] = useState2(0);
+  const [providerId, setProviderId] = useState2("");
+  const [ownership, setOwnership] = useState2("");
+  useEffect(() => {
+    const abort = new AbortController();
+    setCatalog(null);
+    setFailed(false);
+    setProviderId("");
+    setOwnership("");
+    void Promise.resolve().then(() => {
+      abort.signal.throwIfAborted();
+      return controller.transport.catalog(controller.workspaceId, { signal: abort.signal });
+    }).then((providers) => {
+      if (!abort.signal.aborted) setCatalog(structuredClone(providers));
+    }).catch(() => {
+      if (!abort.signal.aborted) setFailed(true);
+    });
+    return () => abort.abort();
+  }, [controller, load]);
+  const provider = catalog?.find((entry) => entry.id === providerId);
+  const canBegin = provider?.readiness === "available" && (ownership === "personal" || ownership === "workspace") && provider.ownership.includes(ownership);
+  const submit = (event) => {
+    event.preventDefault();
+    if (!canBegin || view.busy || ownership !== "personal" && ownership !== "workspace") return;
+    setFailed(false);
+    try {
+      void controller.begin({ providerId, ownership, returnUrl, idempotencyKey: crypto.randomUUID() }).catch(() => setFailed(true));
+    } catch {
+      setFailed(true);
+    }
+  };
+  return /* @__PURE__ */ jsxs2(
+    "section",
+    {
+      className,
+      "aria-label": "Choose a connection",
+      "aria-busy": view.busy || !catalog && !failed,
+      children: [
+        failed && /* @__PURE__ */ jsx2("p", { role: "alert", children: "Connections could not be loaded or started. Check setup status before retrying." }),
+        !catalog && !failed && /* @__PURE__ */ jsx2("p", { role: "status", children: "Loading connections\u2026" }),
+        catalog?.length === 0 && /* @__PURE__ */ jsx2("p", { role: "status", children: "No connections are available." }),
+        Boolean(catalog?.length) && /* @__PURE__ */ jsx2("form", { onSubmit: submit, children: /* @__PURE__ */ jsxs2("fieldset", { disabled: view.busy, children: [
+          /* @__PURE__ */ jsx2("legend", { children: "Provider and ownership" }),
+          /* @__PURE__ */ jsxs2("label", { children: [
+            "Provider",
+            /* @__PURE__ */ jsxs2(
+              "select",
+              {
+                required: true,
+                value: providerId,
+                onChange: (event) => {
+                  setProviderId(event.target.value);
+                  setOwnership("");
+                },
+                children: [
+                  /* @__PURE__ */ jsx2("option", { value: "", disabled: true, children: "Choose a provider" }),
+                  catalog.map((entry) => /* @__PURE__ */ jsxs2(
+                    "option",
+                    {
+                      value: entry.id,
+                      disabled: entry.readiness !== "available" || entry.ownership.length === 0,
+                      children: [
+                        entry.label,
+                        " \u2014 ",
+                        entry.id,
+                        " (",
+                        entry.readiness.replaceAll("_", " "),
+                        ")"
+                      ]
+                    },
+                    entry.id
+                  ))
+                ]
+              }
+            )
+          ] }),
+          provider && /* @__PURE__ */ jsxs2("label", { children: [
+            "Ownership",
+            /* @__PURE__ */ jsxs2(
+              "select",
+              {
+                required: true,
+                value: ownership,
+                onChange: (event) => setOwnership(event.target.value),
+                children: [
+                  /* @__PURE__ */ jsx2("option", { value: "", disabled: true, children: "Choose ownership" }),
+                  provider.ownership.map((choice) => /* @__PURE__ */ jsx2("option", { value: choice, children: choice === "personal" ? "Personal \u2014 owned by you" : "Workspace \u2014 shared connection" }, choice))
+                ]
+              }
+            )
+          ] }),
+          /* @__PURE__ */ jsx2("button", { type: "submit", disabled: !canBegin, children: "Start setup" })
+        ] }) }),
+        /* @__PURE__ */ jsx2("button", { type: "button", disabled: view.busy, onClick: () => setLoad(load + 1), children: "Reload providers" })
+      ]
+    }
+  );
+}
+
+// src/connect-accounts.tsx
+import { useEffect as useEffect2, useRef, useState as useState3 } from "react";
+import { jsx as jsx3, jsxs as jsxs3 } from "react/jsx-runtime";
+function ConnectAccounts(props) {
+  const [scope, setScope] = useState3(props.controller);
+  const [generation, setGeneration] = useState3(0);
+  if (scope !== props.controller) {
+    setScope(props.controller);
+    setGeneration(generation + 1);
+  }
+  return /* @__PURE__ */ jsx3(ScopedAccounts, { ...props }, generation);
+}
+function ScopedAccounts({ controller, className, returnUrl }) {
+  const view = useConnect(controller);
+  const [accounts, setAccounts] = useState3(null);
+  const [selected, setSelected] = useState3(null);
+  const [busy, setBusy] = useState3(false);
+  const [error, setError] = useState3(false);
+  const [reload, setReload] = useState3(0);
+  const mutation = useRef(null);
+  useEffect2(() => () => mutation.current?.abort(), []);
+  useEffect2(() => {
+    const abort = new AbortController();
+    setAccounts(null);
+    setSelected(null);
+    setError(false);
+    void Promise.resolve().then(() => {
+      abort.signal.throwIfAborted();
+      return controller.transport.accounts(controller.workspaceId, { signal: abort.signal });
+    }).then((result) => {
+      if (!abort.signal.aborted) setAccounts(structuredClone(result));
+    }).catch(() => {
+      if (!abort.signal.aborted) setError(true);
+    });
+    return () => abort.abort();
+  }, [controller, reload]);
+  const disconnect = async (account) => {
+    const expectedVersion = account.version;
+    if (mutation.current || view.busy || expectedVersion === void 0 || !Number.isSafeInteger(expectedVersion) || expectedVersion < 1)
+      return;
+    const abort = new AbortController();
+    mutation.current = abort;
+    setBusy(true);
+    setError(false);
+    try {
+      await controller.transport.disconnect(controller.workspaceId, account.id, {
+        expectedVersion,
+        signal: abort.signal
+      });
+      if (!abort.signal.aborted) setReload((value) => value + 1);
+    } catch {
+      if (!abort.signal.aborted) {
+        setAccounts(null);
+        setError(true);
+      }
+    } finally {
+      if (!abort.signal.aborted) {
+        mutation.current = null;
+        setBusy(false);
+        setSelected(null);
+      }
+    }
+  };
+  const reconnect = async (account) => {
+    if (!returnUrl || mutation.current || view.busy) return;
+    setError(false);
+    try {
+      await controller.begin({
+        providerId: account.providerId,
+        ownership: account.ownership,
+        reconnectAccountId: account.id,
+        returnUrl,
+        idempotencyKey: crypto.randomUUID()
+      });
+    } catch {
+      setError(true);
+    }
+  };
+  return /* @__PURE__ */ jsxs3(
+    "section",
+    {
+      className,
+      "aria-label": "Connected accounts",
+      "aria-busy": busy || view.busy || !accounts && !error,
+      children: [
+        error && /* @__PURE__ */ jsx3("p", { role: "alert", children: "Account state could not be confirmed. Reload before trying again." }),
+        !accounts && !error && /* @__PURE__ */ jsx3("p", { role: "status", children: "Loading accounts\u2026" }),
+        accounts?.length === 0 && /* @__PURE__ */ jsx3("p", { role: "status", children: "No connected accounts." }),
+        accounts && accounts.length > 0 && /* @__PURE__ */ jsx3("ul", { children: accounts.map((account) => /* @__PURE__ */ jsxs3("li", { children: [
+          /* @__PURE__ */ jsxs3("span", { children: [
+            account.label,
+            " \u2014 ",
+            account.providerId,
+            " \u2014 ",
+            account.ownership,
+            " \u2014",
+            " ",
+            account.status.replaceAll("_", " ")
+          ] }),
+          returnUrl && /* @__PURE__ */ jsxs3(
+            "button",
+            {
+              type: "button",
+              disabled: busy || view.busy || account.status === "disabled",
+              onClick: () => void reconnect(account),
+              children: [
+                "Reconnect ",
+                account.label
+              ]
+            }
+          ),
+          selected === `${account.providerId}:${account.id}` ? /* @__PURE__ */ jsxs3("div", { role: "group", "aria-label": `Disconnect ${account.label}`, children: [
+            /* @__PURE__ */ jsx3("p", { children: "This removes local OpenGeni access. It does not revoke consent at the provider." }),
+            /* @__PURE__ */ jsx3(
+              "button",
+              {
+                type: "button",
+                disabled: busy || view.busy,
+                onClick: () => void disconnect(account),
+                children: "Confirm disconnect"
+              }
+            ),
+            /* @__PURE__ */ jsx3("button", { type: "button", disabled: busy, onClick: () => setSelected(null), children: "Keep account" })
+          ] }) : /* @__PURE__ */ jsxs3(
+            "button",
+            {
+              type: "button",
+              disabled: busy || view.busy || account.status === "disabled" || !Number.isSafeInteger(account.version) || account.version < 1,
+              onClick: () => setSelected(`${account.providerId}:${account.id}`),
+              children: [
+                "Disconnect ",
+                account.label
+              ]
+            }
+          )
+        ] }, `${account.providerId}:${account.id}`)) }),
+        /* @__PURE__ */ jsx3("button", { type: "button", disabled: busy, onClick: () => setReload((value) => value + 1), children: "Reload accounts" })
+      ]
+    }
+  );
+}
+
+// src/connect-panel.tsx
+import { jsx as jsx4, jsxs as jsxs4 } from "react/jsx-runtime";
+function ConnectPanel({
+  returnUrl,
+  title = "Connections",
+  showAccounts = true,
+  className,
+  ...setup
+}) {
+  return /* @__PURE__ */ jsxs4("div", { className: ["og-connect", className].filter(Boolean).join(" "), children: [
+    /* @__PURE__ */ jsx4("h2", { children: title }),
+    /* @__PURE__ */ jsx4(ConnectChooser, { controller: setup.controller, returnUrl }),
+    /* @__PURE__ */ jsx4(ConnectSetup, { ...setup }),
+    showAccounts && /* @__PURE__ */ jsx4(ConnectAccounts, { controller: setup.controller, returnUrl })
+  ] });
+}
+
+// src/device-authorization.tsx
+import { useEffect as useEffect3, useRef as useRef2, useState as useState4 } from "react";
+import { jsx as jsx5, jsxs as jsxs5 } from "react/jsx-runtime";
+function DeviceAuthorization(props) {
+  const [copied, setCopied] = useState4(false);
+  const [copyError, setCopyError] = useState4(false);
+  const generation = useRef2(0);
+  const timer = useRef2(null);
+  useEffect3(() => {
+    generation.current++;
+    setCopied(false);
+    setCopyError(false);
+    return () => {
+      generation.current++;
+      if (timer.current) clearTimeout(timer.current);
+    };
+  }, [props.userCode]);
+  async function copy() {
+    const revision = ++generation.current;
+    if (timer.current) clearTimeout(timer.current);
+    setCopied(false);
+    setCopyError(false);
+    try {
+      const clipboard = props.loadClipboard ? await props.loadClipboard() : { copyTextToClipboard };
+      if (revision !== generation.current) return;
+      const success = await clipboard.copyTextToClipboard(props.userCode);
+      if (revision !== generation.current) return;
+      setCopied(success);
+      setCopyError(!success);
+      props.onCopyResult?.(success);
+      if (success)
+        timer.current = setTimeout(() => {
+          if (revision === generation.current) setCopied(false);
+        }, 1600);
+    } catch {
+      if (revision !== generation.current) return;
+      setCopyError(true);
+      props.onCopyResult?.(false);
+    }
+  }
+  let href;
+  try {
+    const url = new URL(props.verificationUri);
+    if (["https:", "http:"].includes(url.protocol) && !url.username && !url.password)
+      href = props.verificationUri;
+  } catch {
+  }
+  return /* @__PURE__ */ jsxs5("section", { className: `og-connect ${props.className ?? ""}`, "aria-label": "Device authorization", children: [
+    /* @__PURE__ */ jsx5("p", { children: props.description ?? `Enter this code at ${props.providerLabel ?? "the provider"}.` }),
+    /* @__PURE__ */ jsxs5("div", { style: { display: "flex", flexWrap: "wrap", gap: "0.5rem", alignItems: "center" }, children: [
+      /* @__PURE__ */ jsx5("code", { ...props.codeAttributes, style: { overflowWrap: "anywhere" }, children: props.userCode }),
+      /* @__PURE__ */ jsx5(
+        "button",
+        {
+          type: "button",
+          "aria-label": copied ? "Code copied" : "Copy code",
+          onClick: () => void copy(),
+          children: copied ? "Copied" : "Copy code"
+        }
+      ),
+      href ? /* @__PURE__ */ jsxs5("a", { href, target: "_blank", rel: "noopener noreferrer", children: [
+        "Open ",
+        props.providerLabel ?? "auth page"
+      ] }) : /* @__PURE__ */ jsx5("span", { role: "alert", children: "Authorization address unavailable." })
+    ] }),
+    copyError ? /* @__PURE__ */ jsx5("p", { role: "alert", children: "Couldn't copy the code. Copy it manually instead." }) : null,
+    /* @__PURE__ */ jsx5("p", { role: "status", children: "Waiting for authorization\u2026" })
+  ] });
+}
+
+// src/identity-link-consent.tsx
+import { useEffect as useEffect4, useRef as useRef3, useState as useState5 } from "react";
+import { Fragment as Fragment2, jsx as jsx6, jsxs as jsxs6 } from "react/jsx-runtime";
+function IdentityLinkConsent({
+  client,
+  workspaceId,
+  linkId,
+  challenge,
+  className,
+  onComplete
+}) {
+  const [link, setLink] = useState5(null);
+  const [preview, setPreview] = useState5(null);
+  const [selected, setSelected] = useState5([]);
+  const [busy, setBusy] = useState5(false);
+  const [error, setError] = useState5(false);
+  const [retry, setRetry] = useState5(0);
+  const generation = useRef3(0);
+  useEffect4(() => {
+    const current = ++generation.current;
+    setLink(null);
+    setPreview(null);
+    setSelected([]);
+    setBusy(true);
+    setError(false);
+    void client.previewIdentityLink(workspaceId, linkId, challenge).then(
+      (result) => {
+        if (generation.current !== current) return;
+        setPreview(result);
+        setLink(result.link);
+        setSelected(result.link.permissions);
+      },
+      () => {
+        if (generation.current === current) setError(true);
+      }
+    ).finally(() => {
+      if (generation.current === current) setBusy(false);
+    });
+    return () => {
+      generation.current++;
+    };
+  }, [client, workspaceId, linkId, challenge, retry]);
+  async function mutate(revoke) {
+    if (!link || busy) return;
+    const current = generation.current;
+    setBusy(true);
+    setError(false);
+    try {
+      const result = revoke ? await client.revokeIdentityLink(workspaceId, linkId, link.revision) : await client.confirmIdentityLink(workspaceId, linkId, {
+        challenge,
+        expectedRevision: link.revision,
+        permissions: selected
+      });
+      if (generation.current !== current) return;
+      setLink(result);
+      onComplete?.(result);
+    } catch {
+      if (generation.current === current) setError(true);
+    } finally {
+      if (generation.current === current) setBusy(false);
+    }
+  }
+  return /* @__PURE__ */ jsxs6(
+    "section",
+    {
+      className: ["og-connect og-identity-link", className].filter(Boolean).join(" "),
+      "aria-label": "Link your account",
+      "aria-busy": busy,
+      children: [
+        /* @__PURE__ */ jsx6("h2", { children: "Link your OpenGeni account" }),
+        /* @__PURE__ */ jsx6("p", { children: "Only continue if you started this request in a product you trust. Linking lets that product act as your account with the permissions you select. It does not merge accounts or move existing work." }),
+        preview && /* @__PURE__ */ jsxs6("dl", { children: [
+          /* @__PURE__ */ jsx6("dt", { children: "Organization" }),
+          /* @__PURE__ */ jsx6("dd", { children: preview.organizationId }),
+          /* @__PURE__ */ jsx6("dt", { children: "Product user" }),
+          /* @__PURE__ */ jsxs6("dd", { children: [
+            preview.externalIdentity.externalId,
+            " (",
+            preview.externalIdentity.source,
+            ")"
+          ] }),
+          /* @__PURE__ */ jsx6("dt", { children: "Your OpenGeni identity" }),
+          /* @__PURE__ */ jsx6("dd", { children: preview.nativeSubjectId })
+        ] }),
+        error && /* @__PURE__ */ jsxs6("div", { role: "alert", children: [
+          "This request could not be completed. It may have expired, changed, or require you to sign in to the right organization.",
+          !link && /* @__PURE__ */ jsx6("button", { type: "button", disabled: busy, onClick: () => setRetry((value) => value + 1), children: "Try again" })
+        ] }),
+        !link && busy && /* @__PURE__ */ jsx6("p", { role: "status", children: "Loading the account-link request\u2026" }),
+        link?.status === "pending" && /* @__PURE__ */ jsxs6(Fragment2, { children: [
+          /* @__PURE__ */ jsxs6("p", { children: [
+            link.expiresAt ? `Access ends ${new Date(link.expiresAt).toLocaleString()}.` : "Access lasts until you or the product revoke this link.",
+            " ",
+            "Your current permissions still apply."
+          ] }),
+          /* @__PURE__ */ jsxs6("fieldset", { disabled: busy, children: [
+            /* @__PURE__ */ jsx6("legend", { children: "Allow these permissions" }),
+            link.permissions.map((permission) => /* @__PURE__ */ jsxs6("label", { children: [
+              /* @__PURE__ */ jsx6(
+                "input",
+                {
+                  type: "checkbox",
+                  checked: selected.includes(permission),
+                  onChange: (event) => setSelected(
+                    (values) => event.target.checked ? [...values, permission] : values.filter((value) => value !== permission)
+                  )
+                }
+              ),
+              /* @__PURE__ */ jsx6("span", { children: permission.replaceAll(":", " \xB7 ") })
+            ] }, permission))
+          ] }),
+          /* @__PURE__ */ jsx6(
+            "button",
+            {
+              type: "button",
+              disabled: busy || selected.length === 0,
+              onClick: () => void mutate(false),
+              children: busy ? "Saving\u2026" : "Allow selected access"
+            }
+          ),
+          /* @__PURE__ */ jsx6("p", { children: "You can close this page without granting access." })
+        ] }),
+        link?.status === "active" && /* @__PURE__ */ jsxs6(Fragment2, { children: [
+          /* @__PURE__ */ jsx6("p", { role: "status", children: "Account linked. Return to your product to continue." }),
+          /* @__PURE__ */ jsx6("button", { type: "button", disabled: busy, onClick: () => void mutate(true), children: "Revoke this link" })
+        ] }),
+        link?.status === "revoked" && /* @__PURE__ */ jsx6("p", { role: "status", children: "Link revoked. Your OpenGeni account and existing work are unchanged." }),
+        link?.status === "expired" && /* @__PURE__ */ jsx6("p", { role: "status", children: "This request has expired. Start a new request from your product." })
+      ]
+    }
+  );
+}
+
+// src/identity-link-accounts.tsx
+import { useEffect as useEffect5, useRef as useRef4, useState as useState6 } from "react";
+import { jsx as jsx7, jsxs as jsxs7 } from "react/jsx-runtime";
+function IdentityLinkAccounts({
+  client,
+  workspaceId
+}) {
+  const [links, setLinks] = useState6([]);
+  const [cursor, setCursor] = useState6(null);
+  const [busy, setBusy] = useState6(true);
+  const [error, setError] = useState6(false);
+  const [revision, setRevision] = useState6(0);
+  const generation = useRef4(0);
+  const inFlight = useRef4(false);
+  useEffect5(() => {
+    const current = ++generation.current;
+    inFlight.current = true;
+    setLinks([]);
+    setCursor(null);
+    setBusy(true);
+    setError(false);
+    void client.listIdentityLinks(workspaceId).then(
+      (page) => {
+        if (current !== generation.current) return;
+        setLinks(page.links);
+        setCursor(page.nextCursor);
+      },
+      () => {
+        if (current === generation.current) setError(true);
+      }
+    ).finally(() => {
+      if (current === generation.current) {
+        inFlight.current = false;
+        setBusy(false);
+      }
+    });
+    return () => {
+      generation.current++;
+    };
+  }, [client, workspaceId, revision]);
+  async function act(link) {
+    if (inFlight.current || !link && !cursor) return;
+    const current = generation.current;
+    inFlight.current = true;
+    setBusy(true);
+    setError(false);
+    try {
+      if (link) {
+        const updated = await client.revokeIdentityLink(workspaceId, link.id, link.revision);
+        if (current === generation.current)
+          setLinks(
+            (values) => values.map((value) => value.id === updated.id ? { ...value, ...updated } : value)
+          );
+      } else {
+        const page = await client.listIdentityLinks(workspaceId, cursor);
+        if (current === generation.current) {
+          setLinks((values) => [
+            ...new Map([...values, ...page.links].map((value) => [value.id, value])).values()
+          ]);
+          setCursor(page.nextCursor);
+        }
+      }
+    } catch {
+      if (current === generation.current) setError(true);
+    } finally {
+      if (current === generation.current) {
+        inFlight.current = false;
+        setBusy(false);
+      }
+    }
+  }
+  return /* @__PURE__ */ jsxs7(
+    "section",
+    {
+      className: "og-connect og-identity-link",
+      "aria-label": "Linked product access",
+      "aria-busy": busy,
+      children: [
+        /* @__PURE__ */ jsx7("h2", { children: "Linked product access" }),
+        /* @__PURE__ */ jsx7("p", { children: "Manage products allowed to act as your account in this organization. Revoking a link stops future linked access; it does not delete your work or undo an operation already started." }),
+        error && /* @__PURE__ */ jsxs7("div", { role: "alert", children: [
+          "Could not update account links. Reload to see current access.",
+          /* @__PURE__ */ jsx7("button", { type: "button", disabled: busy, onClick: () => setRevision((value) => value + 1), children: "Reload links" })
+        ] }),
+        busy && /* @__PURE__ */ jsx7("p", { role: "status", children: "Loading account links\u2026" }),
+        !busy && !error && links.length === 0 && /* @__PURE__ */ jsx7("p", { children: "No products have linked access to this account." }),
+        /* @__PURE__ */ jsx7("ul", { children: links.map((link) => /* @__PURE__ */ jsxs7("li", { children: [
+          /* @__PURE__ */ jsxs7("p", { children: [
+            link.externalIdentity?.source || "Product identity",
+            " ",
+            /* @__PURE__ */ jsx7("code", { children: link.externalIdentity?.externalId ?? link.externalIdentityId })
+          ] }),
+          /* @__PURE__ */ jsxs7("p", { children: [
+            "Status: ",
+            link.status,
+            ".",
+            " ",
+            link.expiresAt ? `Expires ${new Date(link.expiresAt).toLocaleString()}.` : "No automatic expiry."
+          ] }),
+          /* @__PURE__ */ jsx7("p", { children: link.permissions.join(", ") }),
+          (link.status === "active" || link.status === "pending") && /* @__PURE__ */ jsx7("button", { type: "button", disabled: busy, onClick: () => void act(link), children: "Revoke access" })
+        ] }, link.id)) }),
+        cursor && /* @__PURE__ */ jsx7("button", { type: "button", disabled: busy, onClick: () => void act(), children: "Load more links" })
+      ]
+    }
+  );
+}
+
+// src/connect.ts
+function useConnect(controller) {
+  const snapshot = useSyncExternalStore(
+    controller.subscribe,
+    controller.getSnapshot,
+    controller.getSnapshot
+  );
+  const actions = useMemo(
+    () => ({
+      begin: controller.begin.bind(controller),
+      recover: controller.recover.bind(controller),
+      refresh: controller.refresh.bind(controller),
+      waitForAction: controller.waitForAction.bind(controller),
+      advance: controller.advance.bind(controller),
+      cancel: controller.cancel.bind(controller)
+    }),
+    [controller]
+  );
+  return useMemo(() => ({ ...snapshot, ...actions }), [snapshot, actions]);
+}
+export {
+  ConnectAccounts,
+  ConnectChooser,
+  ConnectPanel,
+  ConnectSetup,
+  DeviceAuthorization,
+  IdentityLinkAccounts,
+  IdentityLinkConsent,
+  useConnect
+};
+//# sourceMappingURL=connect.js.map