@sentry/junior 0.257.0 → 0.259.0

package/dist/service-account-BzhW7kXu.js

@@ -0,0 +1,661 @@
+import { m as logWarn, y as setSpanAttributes, z as isRecord } from "./logging-BStXN56b.js";
+import { c as fetchWithBoundedOAuthErrorBodies, i as resolvePluginHeaderEnvRefs } from "./registry-B_M_x_iS.js";
+import { i as MUTATION_LOCK_TTL_MS, o as fenceLock, r as getStateAdapter, s as withLock } from "./adapter-Bn0gFVSF.js";
+import { AsyncLocalStorage } from "node:async_hooks";
+import { randomUUID } from "node:crypto";
+import { UnauthorizedError, auth } from "@modelcontextprotocol/sdk/client/auth.js";
+import { Client } from "@modelcontextprotocol/sdk/client";
+import { StreamableHTTPClientTransport, StreamableHTTPError } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
+// src/chat/mcp/errors.ts
+/** Safe failure at an MCP network or OAuth boundary. */
+var McpProviderError = class extends Error {
+	phase;
+	provider;
+	missingSession;
+	resourceHost;
+	status;
+	constructor(details) {
+		super(`MCP provider ${details.phase.replace("_", " ")} failed`);
+		this.name = "McpProviderError";
+		this.phase = details.phase;
+		this.provider = details.provider;
+		this.missingSession = details.missingSession;
+		this.resourceHost = details.resourceHost;
+		this.status = details.status;
+	}
+};
+function providerStatus(error) {
+	if (!error || typeof error !== "object") return;
+	const value = error;
+	const status = typeof value.status === "number" ? value.status : typeof value.code === "number" ? value.code : void 0;
+	return status !== void 0 && status >= 100 && status <= 599 ? status : void 0;
+}
+/** Replace an external MCP failure without retaining its provider-controlled cause. */
+function toMcpProviderError(error, details) {
+	if (error instanceof McpProviderError) return error;
+	return new McpProviderError({
+		...details,
+		status: details.status ?? providerStatus(error)
+	});
+}
+/** Return safe MCP provider fields for logs and spans. */
+function getMcpProviderErrorAttributes(error) {
+	if (!(error instanceof McpProviderError)) return {};
+	return {
+		"app.credential.provider": error.provider,
+		"app.mcp.error.phase": error.phase,
+		...error.status !== void 0 ? { "http.response.status_code": error.status } : void 0,
+		...error.resourceHost ? { "server.address": error.resourceHost } : void 0
+	};
+}
+/** Thrown when an MCP failure should be returned as a model-visible tool error. */
+var McpToolError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "McpToolError";
+	}
+};
+/**
+* Thrown when a plugin uses only its service account and no Admin has
+* connected it. The model can tell the person to ask an Admin.
+*/
+var McpServiceAccountRequiredError = class extends McpToolError {
+	provider;
+	constructor(provider, displayName) {
+		super(`${displayName} is not available yet. Junior uses a shared ${displayName} account for everyone, and a Junior admin must connect it on the dashboard Admin page.`);
+		this.name = "McpServiceAccountRequiredError";
+		this.provider = provider;
+	}
+};
+/** Return the OpenTelemetry error.type value for MCP-aware tool failures. */
+function getMcpAwareErrorType(error, fallback) {
+	if (error instanceof McpToolError) return "tool_error";
+	if (error instanceof McpProviderError) return "mcp_provider_error";
+	return error instanceof Error ? error.name : fallback;
+}
+/** Return the display-safe error message for MCP-aware tool failures. */
+function getMcpAwareErrorMessage(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+/** Return an error message safe for logs and span attributes. */
+function getMcpAwareTelemetryMessage(error, _privacy) {
+	if (error instanceof McpToolError) return "MCP tool call failed";
+	if (error instanceof McpProviderError) return error.message;
+	return getMcpAwareErrorMessage(error);
+}
+// src/chat/mcp/client.ts
+const MCP_CLIENT_INFO = {
+	name: "junior-mcp-client",
+	version: "1.0.0"
+};
+const MCP_TOOLS_CALL_METHOD = "tools/call";
+function getDefaultPort(url) {
+	if (url.protocol === "https:") return 443;
+	if (url.protocol === "http:") return 80;
+}
+function getMcpNetworkAttributes(url) {
+	const port = url.port ? Number(url.port) : getDefaultPort(url);
+	return {
+		"server.address": url.hostname,
+		...port !== void 0 ? { "server.port": port } : void 0,
+		...url.protocol === "http:" || url.protocol === "https:" ? {
+			"network.protocol.name": "http",
+			"network.transport": "tcp"
+		} : void 0
+	};
+}
+var McpAuthorizationRequiredError = class extends Error {
+	provider;
+	constructor(provider, message) {
+		super(message);
+		this.name = "McpAuthorizationRequiredError";
+		this.provider = provider;
+	}
+};
+function isMissingSessionError(error) {
+	return error instanceof StreamableHTTPError && (error.code === 404 || /Session not found/i.test(error.message));
+}
+var PluginMcpClient = class {
+	client;
+	clientPromise;
+	lastAttemptedTransportSessionId;
+	providerStatusStore = new AsyncLocalStorage();
+	transport;
+	listedTools;
+	resourceHost;
+	plugin;
+	options;
+	constructor(plugin, options = {}) {
+		this.plugin = plugin;
+		this.options = options;
+		const url = plugin.manifest.mcp?.url;
+		this.resourceHost = url ? new URL(url).hostname : void 0;
+	}
+	async listTools() {
+		if (this.listedTools) return [...this.listedTools];
+		return await this.withSessionRecovery(async () => {
+			const client = await this.getClient();
+			const discovered = [];
+			const seen = /* @__PURE__ */ new Set();
+			let cursor;
+			do {
+				const result = await this.wrapAuth(() => client.listTools(cursor ? { cursor } : void 0), "list_tools");
+				await this.syncTransportSessionId();
+				for (const tool of result.tools) {
+					if (seen.has(tool.name)) continue;
+					seen.add(tool.name);
+					discovered.push(tool);
+				}
+				cursor = result.nextCursor;
+			} while (cursor);
+			this.listedTools = discovered.sort((left, right) => left.name.localeCompare(right.name));
+			return [...this.listedTools];
+		});
+	}
+	async callTool(name, args, signal) {
+		return await this.withSessionRecovery(async () => {
+			const client = await this.getClient();
+			const mcp = this.plugin.manifest.mcp;
+			if (mcp) {
+				const url = new URL(mcp.url);
+				setSpanAttributes({
+					"mcp.method.name": MCP_TOOLS_CALL_METHOD,
+					"gen_ai.operation.name": "execute_tool",
+					...this.transport?.sessionId ? { "mcp.session.id": this.transport.sessionId } : void 0,
+					...this.transport?.protocolVersion ? { "mcp.protocol.version": this.transport.protocolVersion } : void 0,
+					...getMcpNetworkAttributes(url)
+				});
+			}
+			const result = await this.wrapAuth(() => client.callTool({
+				name,
+				arguments: args ?? {}
+			}, void 0, signal ? { signal } : void 0), "call_tool");
+			await this.syncTransportSessionId();
+			return result;
+		});
+	}
+	async close() {
+		await this.disposeClient();
+	}
+	async withSessionRecovery(operation) {
+		try {
+			return await operation();
+		} catch (error) {
+			await this.syncTransportSessionId();
+			if (!await this.shouldResetMissingSession(error)) throw error;
+			await this.clearStoredTransportSessionId();
+			await this.cleanupClientAfterFailure();
+			return await operation();
+		}
+	}
+	async getClient() {
+		if (this.client) return this.client;
+		if (this.clientPromise) return await this.clientPromise;
+		const clientPromise = this.connectClient();
+		this.clientPromise = clientPromise;
+		try {
+			return await clientPromise;
+		} finally {
+			if (this.clientPromise === clientPromise) this.clientPromise = void 0;
+		}
+	}
+	async connectClient() {
+		const mcp = this.plugin.manifest.mcp;
+		if (!mcp) throw new Error(`Plugin "${this.plugin.manifest.name}" does not declare MCP config`);
+		const headers = mcp.headers ? resolvePluginHeaderEnvRefs(this.plugin.manifest.name, mcp.headers, "MCP header") : void 0;
+		const sessionId = await this.getStoredTransportSessionId();
+		this.lastAttemptedTransportSessionId = sessionId;
+		const transport = new StreamableHTTPClientTransport(new URL(mcp.url), {
+			...headers ? { requestInit: { headers } } : void 0,
+			fetch: fetchWithBoundedOAuthErrorBodies(this.options.fetch, (status) => {
+				const store = this.providerStatusStore.getStore();
+				if (store) store.status = status;
+			}),
+			...this.options.authProvider ? { authProvider: this.options.authProvider } : void 0,
+			...sessionId ? { sessionId } : void 0
+		});
+		const client = new Client(MCP_CLIENT_INFO, { capabilities: {} });
+		this.transport = transport;
+		try {
+			await this.wrapAuth(() => client.connect(transport), "connect");
+			this.client = client;
+			await this.syncTransportSessionId();
+			return client;
+		} catch (error) {
+			await this.syncTransportSessionId();
+			await this.cleanupClientAfterFailure();
+			throw error;
+		}
+	}
+	async wrapAuth(operation, phase) {
+		const store = {};
+		return await this.providerStatusStore.run(store, async () => {
+			try {
+				return await operation();
+			} catch (error) {
+				if (error instanceof McpAuthorizationRequiredError) throw error;
+				if (error instanceof UnauthorizedError) throw new McpAuthorizationRequiredError(this.plugin.manifest.name, `MCP authorization required for plugin "${this.plugin.manifest.name}"`);
+				throw toMcpProviderError(error, {
+					phase,
+					provider: this.plugin.manifest.name,
+					missingSession: isMissingSessionError(error) || void 0,
+					resourceHost: this.resourceHost,
+					status: store.status
+				});
+			}
+		});
+	}
+	async shouldResetMissingSession(error) {
+		if (!(error instanceof McpProviderError && error.missingSession || isMissingSessionError(error))) return false;
+		return Boolean(this.transport?.sessionId ?? this.lastAttemptedTransportSessionId ?? await this.getStoredTransportSessionId());
+	}
+	resetClientState() {
+		const transport = this.transport;
+		this.listedTools = void 0;
+		this.transport = void 0;
+		this.client = void 0;
+		this.clientPromise = void 0;
+		return transport;
+	}
+	async cleanupClientAfterFailure() {
+		const transport = this.resetClientState();
+		if (!transport) return;
+		try {
+			await transport.close();
+		} catch {}
+	}
+	async disposeClient() {
+		const transport = this.resetClientState();
+		if (transport) try {
+			await transport.close();
+		} catch (error) {
+			throw toMcpProviderError(error, {
+				phase: "close",
+				provider: this.plugin.manifest.name,
+				resourceHost: this.resourceHost
+			});
+		}
+	}
+	async getStoredTransportSessionId() {
+		return await this.options.authProvider?.getMcpServerSessionId?.();
+	}
+	async clearStoredTransportSessionId() {
+		const provider = this.options.authProvider;
+		this.lastAttemptedTransportSessionId = void 0;
+		await provider?.saveMcpServerSessionId?.(void 0);
+	}
+	async syncTransportSessionId() {
+		const provider = this.options.authProvider;
+		const sessionId = this.transport?.sessionId;
+		if (!provider?.saveMcpServerSessionId || !sessionId) return;
+		this.lastAttemptedTransportSessionId = sessionId;
+		await provider.saveMcpServerSessionId(sessionId);
+	}
+};
+// src/chat/mcp/service-account.ts
+/**
+* MCP service account credentials.
+*
+* This is the MCP surface of a plugin's service account. See
+* `@/chat/credentials/service-account` for the credential order and the
+* policy. An Admin connects the account from the dashboard Admin page, or
+* with `junior service-account connect <plugin>`. The credential stays on
+* the host. The sandbox and the model never get it.
+*/
+const SERVICE_ACCOUNT_KEY_PREFIX = "junior:mcp_service_account";
+const SIGN_IN_KEY_PREFIX = "junior:mcp_service_account_sign_in";
+const SIGN_IN_TTL_MS = 6e5;
+const UPDATE_LOCK_WAIT_MS = 5e3;
+function serviceAccountKey(provider) {
+	return `${SERVICE_ACCOUNT_KEY_PREFIX}:${provider}`;
+}
+function parseCredentials(value) {
+	if (typeof value !== "string") return;
+	try {
+		const parsed = JSON.parse(value);
+		if (!isRecord(parsed) || !isRecord(parsed.clientInformation) || !isRecord(parsed.tokens) || typeof parsed.connectedAtMs !== "number" || typeof parsed.redirectUrl !== "string") return;
+		return {
+			clientInformation: parsed.clientInformation,
+			connectedAtMs: parsed.connectedAtMs,
+			...typeof parsed.connectedBy === "string" ? { connectedBy: parsed.connectedBy } : void 0,
+			...isRecord(parsed.discoveryState) ? { discoveryState: parsed.discoveryState } : void 0,
+			redirectUrl: parsed.redirectUrl,
+			tokens: parsed.tokens
+		};
+	} catch {
+		return;
+	}
+}
+/** Read the connected service account for one plugin, if any. */
+async function getMcpServiceAccountCredentials(provider) {
+	return parseCredentials(await getStateAdapter().get(serviceAccountKey(provider)));
+}
+/** Save the service account for one plugin. It does not expire. */
+async function putMcpServiceAccountCredentials(provider, credentials) {
+	await getStateAdapter().set(serviceAccountKey(provider), JSON.stringify(credentials));
+}
+/** Remove the service account for one plugin. The provider grant stays until the provider revokes it. */
+async function deleteMcpServiceAccountCredentials(provider) {
+	await getStateAdapter().delete(serviceAccountKey(provider));
+}
+function clientMetadata(redirectUrl) {
+	return {
+		client_name: "Junior MCP Service Account",
+		redirect_uris: [redirectUrl],
+		grant_types: ["authorization_code", "refresh_token"],
+		response_types: ["code"],
+		token_endpoint_auth_method: "none"
+	};
+}
+function reconnectMessage(provider) {
+	return `The ${provider} service account is not authorized anymore. A Junior admin must run \`junior service-account connect ${provider}\`.`;
+}
+/**
+* Build the OAuth client provider for a connected service account.
+*
+* It refreshes tokens like a user connection but never starts a new sign-in.
+* Many turns share this account, so it reads the store on each request and
+* writes each change under a lock. When the provider rejects a refresh token
+* that another turn already replaced, it retries with the stored one. It
+* deletes the stored grant only when the provider rejected the stored token
+* itself, and then throws `McpAuthorizationRequiredError` so the tool manager
+* can fall back to Actor auth or report the missing account. A refresh that
+* fails for another reason, such as a network error, keeps the account.
+*/
+function createMcpServiceAccountClientProvider(provider, connected) {
+	let lastRefreshToken = connected.tokens.refresh_token;
+	let tokensRejected = false;
+	const withStoreLock = async (run) => {
+		const state = getStateAdapter();
+		const result = await withLock(state, `${serviceAccountKey(provider)}:update`, async (lock) => await run(() => fenceLock(state, lock)), {
+			ttlMs: MUTATION_LOCK_TTL_MS,
+			waitMs: UPDATE_LOCK_WAIT_MS
+		});
+		if (!result.acquired) throw new Error(`Timed out waiting to update the ${provider} service account`);
+		return result.value;
+	};
+	const update = async (patch) => {
+		await withStoreLock(async (fence) => {
+			const current = await getMcpServiceAccountCredentials(provider);
+			if (!current) throw new Error(reconnectMessage(provider));
+			await fence();
+			await putMcpServiceAccountCredentials(provider, {
+				...current,
+				...patch
+			});
+		});
+	};
+	return {
+		redirectUrl: connected.redirectUrl,
+		clientMetadata: clientMetadata(connected.redirectUrl),
+		clientInformation: async () => (await getMcpServiceAccountCredentials(provider))?.clientInformation,
+		saveClientInformation: async (clientInformation) => {
+			await update({ clientInformation });
+		},
+		tokens: async () => {
+			const tokens = (await getMcpServiceAccountCredentials(provider))?.tokens;
+			if (tokensRejected) {
+				if (!tokens || tokens.refresh_token === lastRefreshToken) return;
+				tokensRejected = false;
+			}
+			lastRefreshToken = tokens?.refresh_token;
+			return tokens;
+		},
+		saveTokens: async (tokens) => {
+			tokensRejected = false;
+			lastRefreshToken = tokens.refresh_token;
+			await update({ tokens });
+		},
+		discoveryState: async () => (await getMcpServiceAccountCredentials(provider))?.discoveryState,
+		saveDiscoveryState: async (discoveryState) => {
+			await update({ discoveryState });
+		},
+		invalidateCredentials: (scope) => {
+			if (scope === "all" || scope === "tokens") tokensRejected = true;
+		},
+		redirectToAuthorization: async () => {
+			if (!await withStoreLock(async (fence) => {
+				const stored = await getMcpServiceAccountCredentials(provider);
+				if (!stored) return true;
+				if (!tokensRejected && stored.tokens.refresh_token || stored.tokens.refresh_token !== lastRefreshToken) return false;
+				await fence();
+				await deleteMcpServiceAccountCredentials(provider);
+				logWarn("mcp.service_account.disconnected", { "app.plugin.name": provider });
+				return true;
+			})) throw new Error(`The ${provider} service account could not refresh its token. Try again later.`);
+			throw new McpAuthorizationRequiredError(provider, reconnectMessage(provider));
+		},
+		saveCodeVerifier: () => void 0,
+		codeVerifier: () => {
+			throw new Error(reconnectMessage(provider));
+		}
+	};
+}
+function signInKey(state) {
+	return `${SIGN_IN_KEY_PREFIX}:${state}`;
+}
+function parseSignIn(value) {
+	if (typeof value !== "string") return;
+	try {
+		const parsed = JSON.parse(value);
+		if (!isRecord(parsed) || !isRecord(parsed.clientInformation) || typeof parsed.codeVerifier !== "string" || typeof parsed.provider !== "string" || typeof parsed.redirectUrl !== "string") return;
+		return {
+			clientInformation: parsed.clientInformation,
+			codeVerifier: parsed.codeVerifier,
+			...isRecord(parsed.discoveryState) ? { discoveryState: parsed.discoveryState } : void 0,
+			provider: parsed.provider,
+			redirectUrl: parsed.redirectUrl,
+			...typeof parsed.startedBy === "string" ? { startedBy: parsed.startedBy } : void 0
+		};
+	} catch {
+		return;
+	}
+}
+/** Build an OAuth client provider that keeps sign-in state in memory. */
+function signInProvider(input) {
+	const captured = {
+		clientInformation: input.pending?.clientInformation,
+		codeVerifier: input.pending?.codeVerifier,
+		discoveryState: input.pending?.discoveryState
+	};
+	return {
+		captured,
+		provider: {
+			redirectUrl: input.redirectUrl,
+			clientMetadata: clientMetadata(input.redirectUrl),
+			...input.state ? { state: () => input.state } : void 0,
+			clientInformation: () => captured.clientInformation,
+			saveClientInformation: (next) => {
+				captured.clientInformation = next;
+			},
+			tokens: () => captured.tokens,
+			saveTokens: (next) => {
+				captured.tokens = next;
+			},
+			discoveryState: () => captured.discoveryState,
+			saveDiscoveryState: (next) => {
+				captured.discoveryState = next;
+			},
+			redirectToAuthorization: (url) => {
+				captured.authorizationUrl = url;
+			},
+			saveCodeVerifier: (next) => {
+				captured.codeVerifier = next;
+			},
+			codeVerifier: () => {
+				if (!captured.codeVerifier) throw new Error("Missing MCP OAuth code verifier");
+				return captured.codeVerifier;
+			}
+		}
+	};
+}
+function requireServiceAccountMcp(plugin) {
+	const mcp = plugin.manifest.mcp;
+	if (!mcp || !plugin.manifest.accounts?.serviceAccount) throw new Error(`Plugin "${plugin.manifest.name}" does not support a service account`);
+	return mcp;
+}
+/**
+* Start a service account sign-in and return the provider sign-in URL.
+*
+* The pending sign-in is single use and expires after a short time. Whoever
+* signs in decides which account Junior uses, so only Junior admins may start
+* it.
+*/
+async function startMcpServiceAccountSignIn(input) {
+	const mcp = requireServiceAccountMcp(input.plugin);
+	const provider = input.plugin.manifest.name;
+	const state = randomUUID();
+	const signIn = signInProvider({
+		redirectUrl: input.redirectUrl,
+		state
+	});
+	if (await auth(signIn.provider, { serverUrl: mcp.url }) !== "REDIRECT") throw new Error(`${provider} did not start an OAuth sign-in`);
+	const { authorizationUrl, clientInformation, codeVerifier, discoveryState } = signIn.captured;
+	if (!authorizationUrl || !clientInformation || !codeVerifier) throw new Error(`${provider} did not return an authorization URL`);
+	await getStateAdapter().set(signInKey(state), JSON.stringify({
+		clientInformation,
+		codeVerifier,
+		...discoveryState ? { discoveryState } : void 0,
+		provider,
+		redirectUrl: input.redirectUrl,
+		...input.startedBy ? { startedBy: input.startedBy } : void 0
+	}), SIGN_IN_TTL_MS);
+	return { authorizationUrl };
+}
+/**
+* Finish a service account sign-in from the OAuth callback parameters.
+*
+* It accepts only a pending sign-in for the same plugin that the same Admin
+* started. It then saves the grant as the plugin's service account.
+*/
+async function finishMcpServiceAccountSignIn(input) {
+	const mcp = requireServiceAccountMcp(input.plugin);
+	const provider = input.plugin.manifest.name;
+	const state = input.callback.get("state");
+	const pending = state ? parseSignIn(await getStateAdapter().get(signInKey(state))) : void 0;
+	if (!state || !pending || pending.provider !== provider || pending.startedBy !== input.connectedBy) return {
+		ok: false,
+		message: "This sign-in expired or did not start here. Start it again."
+	};
+	await getStateAdapter().delete(signInKey(state));
+	const error = input.callback.get("error");
+	if (error) return {
+		ok: false,
+		message: `${provider} did not finish the sign-in (${error}).`
+	};
+	const authorizationCode = input.callback.get("code");
+	if (!authorizationCode) return {
+		ok: false,
+		message: `${provider} did not return an authorization code.`
+	};
+	const signIn = signInProvider({
+		pending,
+		redirectUrl: pending.redirectUrl
+	});
+	await auth(signIn.provider, {
+		serverUrl: mcp.url,
+		authorizationCode
+	});
+	const { clientInformation, discoveryState, tokens } = signIn.captured;
+	if (!clientInformation || !tokens) throw new Error(`${provider} did not issue tokens`);
+	const credentials = {
+		clientInformation,
+		connectedAtMs: Date.now(),
+		...input.connectedBy ? { connectedBy: input.connectedBy } : void 0,
+		...discoveryState ? { discoveryState } : void 0,
+		redirectUrl: pending.redirectUrl,
+		tokens
+	};
+	await putMcpServiceAccountCredentials(provider, credentials);
+	return {
+		ok: true,
+		credentials
+	};
+}
+// src/chat/credentials/service-account.ts
+/**
+* Service accounts.
+*
+* A plugin's `accounts` block can allow an optional install-wide provider
+* account, often a bot, that Junior itself uses. By default, the credential
+* order for one request is:
+*
+* 1. The Actor's own connection, when it exists.
+* 2. The plugin's service account, when an Admin connected it and
+*    `accounts.service-account` lists what the request uses.
+* 3. Otherwise, the Actor must connect their own account.
+*
+* With `accounts.user-oauth: false`, Junior uses only the service account.
+* It ignores Actor connections, never asks an Actor to connect, and hides
+* what the account does not list. Until an Admin connects the account, the
+* plugin is not available.
+*
+* This module is the one place that decides which requests the service
+* account may serve. Each request surface asks it before it uses the shared
+* account. Today MCP tools are the only request kind.
+*
+* This module also owns the connect flow that the dashboard Admin page and
+* the `junior service-account` CLI share. Today MCP is the only surface that
+* stores a service account.
+*/
+/** Return whether the plugin's service account may serve this request. */
+function serviceAccountAllows(manifest, request) {
+	return manifest.accounts?.serviceAccount?.tools.includes(request.tool) ?? false;
+}
+/**
+* Return whether the plugin uses only its service account.
+*
+* Then no surface may fall back to an Actor's own connection or ask an
+* Actor to connect.
+*/
+function serviceAccountOnly(manifest) {
+	return manifest.accounts?.userOAuth === false;
+}
+/** Return the plugins whose `accounts` block allows a service account. */
+function serviceAccountPlugins(plugins) {
+	return plugins.filter((plugin) => plugin.manifest.accounts?.serviceAccount);
+}
+/** Read the service account status for one plugin. */
+async function getServiceAccountStatus(plugin) {
+	const { manifest } = plugin;
+	const serviceAccount = manifest.accounts?.serviceAccount;
+	if (!serviceAccount) throw new Error(`Plugin ${manifest.name} does not allow a service account`);
+	const credentials = await getMcpServiceAccountCredentials(manifest.name);
+	return {
+		provider: manifest.name,
+		displayName: manifest.displayName,
+		userOAuth: !serviceAccountOnly(manifest),
+		tools: serviceAccount.tools,
+		connected: Boolean(credentials),
+		...credentials ? { connectedAt: new Date(credentials.connectedAtMs).toISOString() } : void 0,
+		...credentials?.connectedBy ? { connectedBy: credentials.connectedBy } : void 0
+	};
+}
+/**
+* Start signing in to a plugin's provider as its service account.
+*
+* Whoever signs in decides which account Junior uses, so only Junior admins
+* may start it. `startedBy` binds the sign-in to that Admin.
+*/
+async function startServiceAccountSignIn(input) {
+	return await startMcpServiceAccountSignIn(input);
+}
+/**
+* Finish a sign-in from its OAuth callback and save the service account.
+*
+* A failure message is safe to show the Admin. Unexpected provider failures
+* throw.
+*/
+async function finishServiceAccountSignIn(input) {
+	const result = await finishMcpServiceAccountSignIn(input);
+	return result.ok ? { ok: true } : result;
+}
+/**
+* Remove a plugin's service account from Junior.
+*
+* The provider grant stays until someone revokes it in the provider.
+*/
+async function disconnectServiceAccount(plugin) {
+	await deleteMcpServiceAccountCredentials(plugin.manifest.name);
+}
+export { getMcpProviderErrorAttributes as _, serviceAccountOnly as a, createMcpServiceAccountClientProvider as c, PluginMcpClient as d, McpProviderError as f, getMcpAwareTelemetryMessage as g, getMcpAwareErrorType as h, serviceAccountAllows as i, getMcpServiceAccountCredentials as l, McpToolError as m, finishServiceAccountSignIn as n, serviceAccountPlugins as o, McpServiceAccountRequiredError as p, getServiceAccountStatus as r, startServiceAccountSignIn as s, disconnectServiceAccount as t, McpAuthorizationRequiredError as u, toMcpProviderError as v };