@burdenoff/fe-libs 2026.1005.4 → 2026.1006.2

package/dist/connections/ConnectionFormTab.js

@@ -9,12 +9,12 @@ import { useState as l } from "react";
 import { AlertCircle as u, Copy as d, ExternalLink as f, Shield as p } from "lucide-react";
 import { jsx as m, jsxs as h } from "react/jsx-runtime";
 //#region src/connections/ConnectionFormTab.tsx
-var g = ({ api: g, provider: _, methods: v, method: y, flow: b, schema: x, name: S, onNameChange: C, description: w, onDescriptionChange: T, values: E, setValues: D, onMethodChange: O, storage: k, setStorage: A, scopeOptions: j, defaultScopes: M, scopeSelection: N, setScopeSelection: P, callbackUrl: F, requireVault: I, canCreateVault: L, errorMessage: R, busy: z, translate: B, fieldId: V }) => {
-	let [H, U] = l(!1);
+var g = ({ api: g, provider: _, methods: v, method: y, flow: b, schema: x, name: S, onNameChange: C, description: w, onDescriptionChange: T, values: E, setValues: D, onMethodChange: O, storage: k, setStorage: A, supportedStorageModes: j, scopeOptions: M, defaultScopes: N, scopeSelection: P, setScopeSelection: F, callbackUrl: I, requireVault: L, canCreateVault: R, errorMessage: z, busy: B, translate: V, fieldId: H }) => {
+	let [U, W] = l(!1);
 	return /* @__PURE__ */ h("div", {
 		className: "space-y-5",
 		children: [
-			R && /* @__PURE__ */ h("div", {
+			z && /* @__PURE__ */ h("div", {
 				role: "alert",
 				className: "flex items-start gap-2 rounded-md border border-status-error-border/20 bg-status-error-bg/10 px-3 py-2",
 				children: [/* @__PURE__ */ m(u, {
@@ -22,14 +22,14 @@ var g = ({ api: g, provider: _, methods: v, method: y, flow: b, schema: x, name:
 					className: "mt-0.5 flex-shrink-0 text-status-error-text"
 				}), /* @__PURE__ */ m("span", {
 					className: "text-sm text-status-error-text",
-					children: R
+					children: z
 				})]
 			}),
 			/* @__PURE__ */ h("div", { children: [/* @__PURE__ */ h("label", {
-				htmlFor: V("name"),
+				htmlFor: H("name"),
 				className: "mb-1.5 block text-sm font-medium text-text-primary",
 				children: [
-					B("integrations.addConnection.fields.connectionName", "Connection Name"),
+					V("integrations.addConnection.fields.connectionName", "Connection Name"),
 					" ",
 					/* @__PURE__ */ m("span", {
 						className: "text-status-error-text",
@@ -37,36 +37,37 @@ var g = ({ api: g, provider: _, methods: v, method: y, flow: b, schema: x, name:
 					})
 				]
 			}), /* @__PURE__ */ m("input", {
-				id: V("name"),
+				id: H("name"),
 				type: "text",
 				value: S,
 				onChange: (e) => C(e.target.value),
-				placeholder: B("integrations.addConnection.fields.connectionNamePlaceholder", "e.g., My {{provider}} Connection", { provider: _.name }),
-				disabled: z,
+				placeholder: V("integrations.addConnection.fields.connectionNamePlaceholder", "e.g., My {{provider}} Connection", { provider: _.name }),
+				disabled: B,
 				className: s
 			})] }),
 			/* @__PURE__ */ h("div", { children: [/* @__PURE__ */ m("label", {
-				htmlFor: V("description"),
+				htmlFor: H("description"),
 				className: "mb-1.5 block text-sm font-medium text-text-primary",
-				children: B("integrations.addConnection.fields.description", "Description")
+				children: V("integrations.addConnection.fields.description", "Description")
 			}), /* @__PURE__ */ m("input", {
-				id: V("description"),
+				id: H("description"),
 				type: "text",
 				value: w,
 				onChange: (e) => T(e.target.value),
-				placeholder: B("integrations.addConnection.fields.descriptionPlaceholder", "Optional description..."),
-				disabled: z,
+				placeholder: V("integrations.addConnection.fields.descriptionPlaceholder", "Optional description..."),
+				disabled: B,
 				className: s
 			})] }),
 			i(b, _) && /* @__PURE__ */ m(o, {
 				api: g,
 				value: k,
 				onChange: A,
+				supportedStorageModes: j,
 				authType: y?.authType ?? _.authType,
-				requireVault: I,
-				canCreateVault: L,
-				translate: B,
-				disabled: z
+				requireVault: L,
+				canCreateVault: R,
+				translate: V,
+				disabled: B
 			}),
 			/* @__PURE__ */ h("div", {
 				className: "space-y-3 rounded-md border border-border-subtle/50 bg-bg-surface p-4",
@@ -80,19 +81,19 @@ var g = ({ api: g, provider: _, methods: v, method: y, flow: b, schema: x, name:
 									size: 16,
 									className: "text-primary"
 								}),
-								B("integrations.addConnection.authentication.title", "Authentication"),
+								V("integrations.addConnection.authentication.title", "Authentication"),
 								v.length <= 1 && /* @__PURE__ */ h("span", {
 									className: "font-normal text-text-secondary",
-									children: ["· ", y?.displayName ?? a(_.authType, B)]
+									children: ["· ", y?.displayName ?? a(_.authType, V)]
 								})
 							]
 						}), /* @__PURE__ */ m(n, {
 							methods: v,
 							selectedKey: y?.key ?? null,
 							onSelect: O,
-							disabled: z,
-							idPrefix: V("auth-method"),
-							translate: B,
+							disabled: B,
+							idPrefix: H("auth-method"),
+							translate: V,
 							compact: !0
 						})]
 					}),
@@ -100,7 +101,7 @@ var g = ({ api: g, provider: _, methods: v, method: y, flow: b, schema: x, name:
 						className: "space-y-2",
 						children: /* @__PURE__ */ m(t, {
 							method: y,
-							translate: B
+							translate: V
 						})
 					}),
 					b === "fields" && !x && /* @__PURE__ */ h("div", {
@@ -110,20 +111,20 @@ var g = ({ api: g, provider: _, methods: v, method: y, flow: b, schema: x, name:
 							className: "flex-shrink-0 text-status-error-text"
 						}), /* @__PURE__ */ m("span", {
 							className: "text-sm text-status-error-text",
-							children: B("integrations.addConnection.authentication.noForm", "This authentication method does not declare a configuration form.")
+							children: V("integrations.addConnection.authentication.noForm", "This authentication method does not declare a configuration form.")
 						})]
 					}),
 					b === "fields" && x && /* @__PURE__ */ m("p", {
 						className: "text-xs text-text-secondary",
-						children: B("integrations.addConnection.authentication.secretsEncrypted", "Secret values are stored encrypted and never shown again.")
+						children: V("integrations.addConnection.authentication.secretsEncrypted", "Secret values are stored encrypted and never shown again.")
 					}),
 					b !== "minted" && x && /* @__PURE__ */ m(e, {
 						schema: x,
 						values: E,
 						onChange: D,
-						disabled: z,
-						idPrefix: V("credential"),
-						translate: B
+						disabled: B,
+						idPrefix: H("credential"),
+						translate: V
 					}),
 					b === "oauth2" && r(x) && /* @__PURE__ */ h("div", {
 						className: "space-y-1.5 rounded-md border border-border-subtle bg-bg-surface px-3 py-2",
@@ -131,30 +132,30 @@ var g = ({ api: g, provider: _, methods: v, method: y, flow: b, schema: x, name:
 							className: "flex items-center justify-between gap-2",
 							children: [/* @__PURE__ */ m("span", {
 								className: "text-xs font-medium text-text-primary",
-								children: B("integrations.addConnection.authentication.redirectUriLabel", "Redirect URL to register in your app")
+								children: V("integrations.addConnection.authentication.redirectUriLabel", "Redirect URL to register in your app")
 							}), /* @__PURE__ */ h("button", {
 								type: "button",
 								onClick: () => {
-									navigator.clipboard?.writeText(F).then(() => {
-										U(!0), window.setTimeout(() => U(!1), 2e3);
+									navigator.clipboard?.writeText(I).then(() => {
+										W(!0), window.setTimeout(() => W(!1), 2e3);
 									}).catch(() => void 0);
 								},
 								className: "inline-flex items-center gap-1 text-xs font-medium text-primary hover:underline",
-								children: [/* @__PURE__ */ m(d, { size: 12 }), H ? B("integrations.addConnection.authentication.copied", "Copied") : B("integrations.addConnection.authentication.copy", "Copy")]
+								children: [/* @__PURE__ */ m(d, { size: 12 }), U ? V("integrations.addConnection.authentication.copied", "Copied") : V("integrations.addConnection.authentication.copy", "Copy")]
 							})]
 						}), /* @__PURE__ */ m("code", {
 							"data-testid": "oauth-redirect-url",
 							className: "block break-all text-xs text-text-secondary",
-							children: F
+							children: I
 						})]
 					}),
 					b !== "fields" && /* @__PURE__ */ m(c, {
-						options: j,
-						defaultScopes: M,
-						selection: N,
-						onChange: P,
-						translate: B,
-						disabled: z
+						options: M,
+						defaultScopes: N,
+						selection: P,
+						onChange: F,
+						translate: V,
+						disabled: B
 					}),
 					b === "oauth2" && /* @__PURE__ */ h("div", {
 						className: "flex items-center gap-2 rounded-md border border-border-default bg-status-info-bg-subtle px-3 py-2",
@@ -163,7 +164,7 @@ var g = ({ api: g, provider: _, methods: v, method: y, flow: b, schema: x, name:
 							className: "flex-shrink-0 text-status-info-text"
 						}), /* @__PURE__ */ m("span", {
 							className: "text-xs text-status-info-text",
-							children: B("integrations.addConnection.authentication.oauthPopupInfo", "A popup window will open for {{provider}} sign-in", { provider: _.name })
+							children: V("integrations.addConnection.authentication.oauthPopupInfo", "A popup window will open for {{provider}} sign-in", { provider: _.name })
 						})]
 					}),
 					b === "minted" && /* @__PURE__ */ h("div", {
@@ -173,7 +174,7 @@ var g = ({ api: g, provider: _, methods: v, method: y, flow: b, schema: x, name:
 							className: "flex-shrink-0 text-status-info-text"
 						}), /* @__PURE__ */ m("span", {
 							className: "text-xs text-status-info-text",
-							children: B("integrations.addConnection.authentication.serviceAccount.description", "No credentials to enter — access is granted on your behalf and tokens are issued per use.")
+							children: V("integrations.addConnection.authentication.serviceAccount.description", "No credentials to enter — access is granted on your behalf and tokens are issued per use.")
 						})]
 					})
 				]

package/dist/connections/CredentialStorageSelector.d.ts

@@ -1,11 +1,13 @@
 import { FC } from 'react';
 import { Translator } from '../credentials/translate';
 import { ConnectionsApi } from './api';
-import { CredentialStorageState, ProviderAuthType } from './types';
+import { CredentialStorageMode, CredentialStorageState, ProviderAuthType } from './types';
 interface CredentialStorageSelectorProps {
     api: ConnectionsApi;
     value: CredentialStorageState;
     onChange: (update: (current: CredentialStorageState) => CredentialStorageState) => void;
+    /** Existing direct consumers omit this; the shared dialog always passes the provider policy. */
+    supportedStorageModes?: readonly CredentialStorageMode[];
     authType: ProviderAuthType;
     /** False lets the integrations service hold the secret when no vault is picked. */
     requireVault: boolean;

package/dist/connections/CredentialStorageSelector.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"CredentialStorageSelector.d.ts","sourceRoot":"","sources":["../../src/connections/CredentialStorageSelector.tsx"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAA2C,KAAK,EAAE,EAAE,MAAM,OAAO,CAAC;AAGzE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,OAAO,CAAC;AAE5C,OAAO,KAAK,EACV,sBAAsB,EACtB,gBAAgB,EAGjB,MAAM,SAAS,CAAC;AAEjB,UAAU,8BAA8B;IACtC,GAAG,EAAE,cAAc,CAAC;IACpB,KAAK,EAAE,sBAAsB,CAAC;IAC9B,QAAQ,EAAE,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,sBAAsB,KAAK,sBAAsB,KAAK,IAAI,CAAC;IACxF,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,mFAAmF;IACnF,YAAY,EAAE,OAAO,CAAC;IACtB,8EAA8E;IAC9E,cAAc,EAAE,OAAO,CAAC;IACxB,SAAS,EAAE,UAAU,CAAC;IACtB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAWD,eAAO,MAAM,yBAAyB,EAAE,EAAE,CAAC,8BAA8B,CAwUxE,CAAC"}
+{"version":3,"file":"CredentialStorageSelector.d.ts","sourceRoot":"","sources":["../../src/connections/CredentialStorageSelector.tsx"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAA2C,KAAK,EAAE,EAAE,MAAM,OAAO,CAAC;AAGzE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,OAAO,CAAC;AAE5C,OAAO,KAAK,EACV,qBAAqB,EACrB,sBAAsB,EACtB,gBAAgB,EAGjB,MAAM,SAAS,CAAC;AAEjB,UAAU,8BAA8B;IACtC,GAAG,EAAE,cAAc,CAAC;IACpB,KAAK,EAAE,sBAAsB,CAAC;IAC9B,QAAQ,EAAE,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,sBAAsB,KAAK,sBAAsB,KAAK,IAAI,CAAC;IACxF,gGAAgG;IAChG,qBAAqB,CAAC,EAAE,SAAS,qBAAqB,EAAE,CAAC;IACzD,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,mFAAmF;IACnF,YAAY,EAAE,OAAO,CAAC;IACtB,8EAA8E;IAC9E,cAAc,EAAE,OAAO,CAAC;IACxB,SAAS,EAAE,UAAU,CAAC;IACtB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAWD,eAAO,MAAM,yBAAyB,EAAE,EAAE,CAAC,8BAA8B,CA+WxE,CAAC"}

package/dist/connections/CredentialStorageSelector.js

@@ -3,57 +3,66 @@ import { useCallback as t, useEffect as n, useId as r, useState as i } from "rea
 import { AlertCircle as a, Database as o, FolderKey as s, KeyRound as c, Loader2 as l, Plus as u, X as d } from "lucide-react";
 import { Fragment as f, jsx as p, jsxs as m } from "react/jsx-runtime";
 //#region src/connections/CredentialStorageSelector.tsx
-var h = "w-full rounded-lg border border-border-subtle bg-bg-surface px-3 py-2.5 text-sm focus:outline-none focus:ring-2 focus:ring-primary/20 focus:border-primary disabled:opacity-60", g = `${h} scheme-normal dark:scheme-dark [&_option]:bg-bg-surface [&_option]:text-text-primary`, _ = ({ api: a, value: d, onChange: _, authType: y, requireVault: b, canCreateVault: x, translate: S, disabled: C }) => {
-	let [w, T] = i([]), [E, D] = i(!0), [O, k] = i([]), [A, j] = i(!1), [M, N] = i(!1), P = r(), F = t(async () => {
-		D(!0);
+var h = "w-full rounded-lg border border-border-subtle bg-bg-surface px-3 py-2.5 text-sm focus:outline-none focus:ring-2 focus:ring-primary/20 focus:border-primary disabled:opacity-60", g = `${h} scheme-normal dark:scheme-dark [&_option]:bg-bg-surface [&_option]:text-text-primary`, _ = ({ api: a, value: d, onChange: _, supportedStorageModes: y = ["managed", "existing"], authType: b, requireVault: x, canCreateVault: S, translate: C, disabled: w }) => {
+	let [T, E] = i([]), [D, O] = i(!0), [k, A] = i([]), [j, M] = i(!1), [N, P] = i(!1), F = r(), I = y.includes("managed"), L = y.includes("existing"), R = x || !I, z = t(async () => {
+		O(!0);
 		try {
-			T(await a.listVaults());
+			E(await a.listVaults());
 		} catch {
-			T([]);
+			E([]);
 		} finally {
-			D(!1);
+			O(!1);
 		}
 	}, [a]);
 	n(() => {
-		F();
-	}, [F]), n(() => {
-		if (d.mode !== "existing" || !d.vaultId) {
-			k([]);
+		z();
+	}, [z]), n(() => {
+		if (!L || d.mode !== "existing" || !d.vaultId) {
+			A([]), M(!1);
 			return;
 		}
 		let t = !1;
-		return j(!0), a.listVaultSecrets(d.vaultId).then((n) => {
-			t || k(e(n, y));
+		return M(!0), a.listVaultSecrets(d.vaultId).then((n) => {
+			t || A(e(n, b));
 		}).catch(() => {
-			t || k([]);
+			t || A([]);
 		}).finally(() => {
-			t || j(!1);
+			t || M(!1);
 		}), () => {
 			t = !0;
 		};
 	}, [
 		a,
-		y,
+		b,
+		L,
 		d.mode,
 		d.vaultId
 	]);
-	let I = async (e) => {
-		await F(), _((t) => ({
+	let B = async (e) => {
+		await z(), _((t) => ({
 			...t,
 			vaultId: e,
 			secretId: ""
-		})), N(!1);
-	}, L = `${P}-vault`, R = `${P}-managed-name`, z = `${P}-existing-secret`, B = b ? S("integrations.addConnection.credentialStorage.selectVault", "Select a vault") : S("integrations.addConnection.credentialStorage.noVault", "No vault — stored encrypted by the integrations service"), V = (e, t, n, r) => {
+		})), P(!1);
+	}, V = `${F}-vault`, H = `${F}-managed-name`, U = `${F}-existing-secret`, W = R ? C("integrations.addConnection.credentialStorage.selectVault", "Select a vault") : C("integrations.addConnection.credentialStorage.noVault", "No vault — stored encrypted by the integrations service");
+	if (!I && !L) return /* @__PURE__ */ p("div", {
+		role: "alert",
+		className: "rounded-md border border-border-default bg-status-error-bg-subtle px-3 py-2 text-sm text-status-error-text",
+		children: C("integrations.addConnection.credentialStorage.noCompatibleMode", "This authentication method has no compatible credential storage mode. Ask an administrator to correct its configuration.")
+	});
+	let G = (e, t, n, r) => {
 		let i = t, a = d.mode === e;
 		return /* @__PURE__ */ m("button", {
 			type: "button",
-			disabled: C,
+			disabled: w,
 			"aria-pressed": a,
-			onClick: () => _((t) => ({
-				...t,
-				mode: e,
-				...e === "managed" ? { secretId: "" } : {}
-			})),
+			onClick: () => {
+				y.includes(e) && _((t) => ({
+					...t,
+					mode: e,
+					...e === "managed" ? { secretId: "" } : {}
+				}));
+			},
 			className: `rounded-xl border px-4 py-3 text-left transition-colors disabled:opacity-60 ${a ? "border-primary bg-action-primary-bg/5" : "border-border-subtle hover:border-primary/40 hover:bg-accent/30"}`,
 			children: [/* @__PURE__ */ m("span", {
 				className: "flex items-center gap-2 text-sm font-medium text-text-primary",
@@ -75,45 +84,45 @@ var h = "w-full rounded-lg border border-border-subtle bg-bg-surface px-3 py-2.5
 				children: [/* @__PURE__ */ p(o, {
 					size: 16,
 					className: "text-primary"
-				}), S("integrations.addConnection.credentialStorage.title", "Credential Storage")]
+				}), C("integrations.addConnection.credentialStorage.title", "Credential Storage")]
 			}), /* @__PURE__ */ p("p", {
 				className: "mt-1 text-xs text-text-secondary",
-				children: b ? S("integrations.addConnection.credentialStorage.description", "Connections use vault-managed secrets by default. You can also reuse an existing compatible secret.") : S("integrations.addConnection.credentialStorage.optionalDescription", "Optional. Without a vault, the integrations service stores the credential encrypted. Pick a vault to manage it yourself, or reuse an existing secret.")
+				children: I && L ? R ? C("integrations.addConnection.credentialStorage.description", "Connections use vault-managed secrets by default. You can also reuse an existing compatible secret.") : C("integrations.addConnection.credentialStorage.optionalDescription", "Optional. Without a vault, the integrations service stores the credential encrypted. Pick a vault to manage it yourself, or reuse an existing secret.") : I ? R ? C("integrations.addConnection.credentialStorage.managedOnlyDescription", "Choose a vault to create a dedicated secret for this connection.") : C("integrations.addConnection.credentialStorage.managedOnlyOptionalDescription", "Without a vault, the integrations service stores the credential encrypted. You can choose a vault for a dedicated secret.") : C("integrations.addConnection.credentialStorage.existingOnlyDescription", "Choose a vault and an existing compatible secret.")
 			})] }),
 			/* @__PURE__ */ m("div", {
-				className: "grid grid-cols-1 gap-3 sm:grid-cols-2",
-				children: [V("managed", s, S("integrations.addConnection.credentialStorage.dedicatedSecret", "Dedicated secret"), S("integrations.addConnection.credentialStorage.dedicatedSecretDescription", "Create and own a vault secret for this connection.")), V("existing", c, S("integrations.addConnection.credentialStorage.existingSecret", "Existing secret"), S("integrations.addConnection.credentialStorage.existingSecretDescription", "Reference an already stored secret from the vault."))]
+				className: `grid grid-cols-1 gap-3 ${I && L ? "sm:grid-cols-2" : ""}`,
+				children: [I && G("managed", s, C("integrations.addConnection.credentialStorage.dedicatedSecret", "Dedicated secret"), C("integrations.addConnection.credentialStorage.dedicatedSecretDescription", "Create and own a vault secret for this connection.")), L && G("existing", c, C("integrations.addConnection.credentialStorage.existingSecret", "Existing secret"), C("integrations.addConnection.credentialStorage.existingSecretDescription", "Reference an already stored secret from the vault."))]
 			}),
 			/* @__PURE__ */ m("div", {
 				className: "space-y-2",
 				children: [/* @__PURE__ */ m("div", {
 					className: "flex items-center justify-between gap-2",
 					children: [/* @__PURE__ */ p("label", {
-						htmlFor: L,
+						htmlFor: V,
 						className: "block text-xs font-semibold uppercase tracking-wide text-text-primary",
-						children: S("integrations.addConnection.credentialStorage.vaultLabel", "Vault")
-					}), !M && x && /* @__PURE__ */ m("button", {
+						children: C("integrations.addConnection.credentialStorage.vaultLabel", "Vault")
+					}), !N && S && /* @__PURE__ */ m("button", {
 						type: "button",
-						disabled: C,
-						onClick: () => N(!0),
+						disabled: w,
+						onClick: () => P(!0),
 						className: "inline-flex items-center gap-1 text-xs font-medium text-primary hover:underline",
 						children: [
 							/* @__PURE__ */ p(u, { size: 13 }),
 							" ",
-							S("integrations.addConnection.credentialStorage.newVault", "New vault")
+							C("integrations.addConnection.credentialStorage.newVault", "New vault")
 						]
 					})]
-				}), M ? /* @__PURE__ */ p(v, {
+				}), N ? /* @__PURE__ */ p(v, {
 					api: a,
-					translate: S,
-					onCreated: (e) => void I(e),
-					onCancel: () => N(!1)
+					translate: C,
+					onCreated: (e) => void B(e),
+					onCancel: () => P(!1)
 				}) : /* @__PURE__ */ m(f, { children: [/* @__PURE__ */ m("div", {
 					className: "relative",
 					children: [/* @__PURE__ */ m("select", {
-						id: L,
+						id: V,
 						value: d.vaultId,
-						disabled: C,
+						disabled: w,
 						onChange: (e) => _((t) => ({
 							...t,
 							vaultId: e.target.value,
@@ -122,8 +131,8 @@ var h = "w-full rounded-lg border border-border-subtle bg-bg-surface px-3 py-2.5
 						className: g,
 						children: [/* @__PURE__ */ p("option", {
 							value: "",
-							children: B
-						}), w.map((e) => /* @__PURE__ */ m("option", {
+							children: W
+						}), T.map((e) => /* @__PURE__ */ m("option", {
 							value: e.id,
 							children: [
 								e.name,
@@ -132,75 +141,75 @@ var h = "w-full rounded-lg border border-border-subtle bg-bg-surface px-3 py-2.5
 								")"
 							]
 						}, e.id))]
-					}), E && /* @__PURE__ */ p(l, {
+					}), D && /* @__PURE__ */ p(l, {
 						size: 16,
 						className: "absolute right-3 top-3 animate-spin text-text-secondary"
 					})]
-				}), b && !E && w.length === 0 && (x ? /* @__PURE__ */ m("p", {
+				}), R && !D && T.length === 0 && (S ? /* @__PURE__ */ m("p", {
 					className: "text-xs text-text-secondary",
 					children: [
-						S("integrations.addConnection.credentialStorage.noVaults.canCreate", "No vaults yet. Create one to store this connection's credentials."),
+						C("integrations.addConnection.credentialStorage.noVaults.canCreate", "No vaults yet. Create one to store this connection's credentials."),
 						" ",
 						/* @__PURE__ */ p("button", {
 							type: "button",
-							onClick: () => N(!0),
+							onClick: () => P(!0),
 							className: "font-medium text-primary hover:underline",
-							children: S("integrations.addConnection.credentialStorage.noVaults.createOne", "Create one")
+							children: C("integrations.addConnection.credentialStorage.noVaults.createOne", "Create one")
 						})
 					]
 				}) : /* @__PURE__ */ p("p", {
 					className: "text-xs text-text-secondary",
-					children: S("integrations.addConnection.credentialStorage.noVaults.readOnly", "No vaults yet. Ask an administrator to create one — a connection needs a vault to store its credentials.")
+					children: C("integrations.addConnection.credentialStorage.noVaults.readOnly", "No vaults yet. Ask an administrator to create one — a connection needs a vault to store its credentials.")
 				}))] })]
 			}),
-			d.mode === "managed" ? d.vaultId ? /* @__PURE__ */ m("div", {
+			d.mode === "managed" || !L ? I && d.vaultId ? /* @__PURE__ */ m("div", {
 				className: "space-y-2",
 				children: [
 					/* @__PURE__ */ p("label", {
-						htmlFor: R,
+						htmlFor: H,
 						className: "block text-xs font-semibold uppercase tracking-wide text-text-primary",
-						children: S("integrations.addConnection.credentialStorage.managedSecretName", "Managed secret name")
+						children: C("integrations.addConnection.credentialStorage.managedSecretName", "Managed secret name")
 					}),
 					/* @__PURE__ */ p("input", {
-						id: R,
+						id: H,
 						type: "text",
 						value: d.managedSecretName,
-						disabled: C,
+						disabled: w,
 						onChange: (e) => _((t) => ({
 							...t,
 							managedSecretName: e.target.value
 						})),
-						placeholder: S("integrations.addConnection.credentialStorage.managedSecretPlaceholder", "Optional custom vault secret name"),
+						placeholder: C("integrations.addConnection.credentialStorage.managedSecretPlaceholder", "Optional custom vault secret name"),
 						className: h
 					}),
 					/* @__PURE__ */ p("p", {
 						className: "text-xs text-text-secondary",
-						children: S("integrations.addConnection.credentialStorage.managedSecretHint", "Leave empty to auto-generate a secret name from the connection and provider.")
+						children: C("integrations.addConnection.credentialStorage.managedSecretHint", "Leave empty to auto-generate a secret name from the connection and provider.")
 					})
 				]
 			}) : null : /* @__PURE__ */ m("div", {
 				className: "space-y-2",
 				children: [
 					/* @__PURE__ */ p("label", {
-						htmlFor: z,
+						htmlFor: U,
 						className: "block text-xs font-semibold uppercase tracking-wide text-text-primary",
-						children: S("integrations.addConnection.credentialStorage.existingSecretLabel", "Existing secret")
+						children: C("integrations.addConnection.credentialStorage.existingSecretLabel", "Existing secret")
 					}),
 					/* @__PURE__ */ m("div", {
 						className: "relative",
 						children: [/* @__PURE__ */ m("select", {
-							id: z,
+							id: U,
 							value: d.secretId,
 							onChange: (e) => _((t) => ({
 								...t,
 								secretId: e.target.value
 							})),
-							disabled: C || !d.vaultId,
+							disabled: w || !d.vaultId,
 							className: g,
 							children: [/* @__PURE__ */ p("option", {
 								value: "",
-								children: S("integrations.addConnection.credentialStorage.selectExistingSecret", "Select an existing secret")
-							}), O.map((e) => /* @__PURE__ */ m("option", {
+								children: C("integrations.addConnection.credentialStorage.selectExistingSecret", "Select an existing secret")
+							}), k.map((e) => /* @__PURE__ */ m("option", {
 								value: e.id,
 								children: [
 									e.name,
@@ -208,14 +217,14 @@ var h = "w-full rounded-lg border border-border-subtle bg-bg-surface px-3 py-2.5
 									e.type
 								]
 							}, e.id))]
-						}), A && /* @__PURE__ */ p(l, {
+						}), j && /* @__PURE__ */ p(l, {
 							size: 16,
 							className: "absolute right-3 top-3 animate-spin text-text-secondary"
 						})]
 					}),
 					/* @__PURE__ */ p("p", {
 						className: "text-xs text-text-secondary",
-						children: S("integrations.addConnection.credentialStorage.existingSecretHint", "For OAuth and basic auth, choose a structured credential secret created for integrations.")
+						children: C("integrations.addConnection.credentialStorage.existingSecretHint", "For OAuth and basic auth, choose a structured credential secret created for integrations.")
 					})
 				]
 			})

package/dist/connections/connectionFlow.d.ts

@@ -1,7 +1,7 @@
 import { Translator } from '../credentials/translate';
 import { AuthMethodFlow, FormSchema } from '../credentials/types';
 import { ConnectionRecord, ConnectionsApi, CreateConnectionInput } from './api';
-import { ConnectionAuthMethod, ConnectionProvider, CredentialStorageState, ProviderAuthType } from './types';
+import { ConnectionAuthMethod, ConnectionProvider, CredentialStorageMode, CredentialStorageState, ProviderAuthType } from './types';
 /** Providers whose methods were never backfilled fall back to their type. */
 export declare function flowForAuthType(authType: ProviderAuthType): AuthMethodFlow;
 /** The methods a user may pick: enabled ones, in display order. */
@@ -17,6 +17,9 @@ export declare function selectableMethods(provider: ConnectionProvider): Connect
 export declare function resolveMethod(provider: ConnectionProvider, selectedKey: string | null): ConnectionAuthMethod | null;
 export declare function resolveFlow(provider: ConnectionProvider, method: ConnectionAuthMethod | null): AuthMethodFlow;
 export declare function resolveSchema(provider: ConnectionProvider, method: ConnectionAuthMethod | null): FormSchema | null;
+export declare function supportedStorageModes(provider: ConnectionProvider, method: ConnectionAuthMethod | null): readonly CredentialStorageMode[];
+/** Keep a vault selection when changing methods, but never reuse a forbidden secret. */
+export declare function normalizeStorageMode(storage: CredentialStorageState, modes: readonly CredentialStorageMode[]): CredentialStorageState;
 /**
  * A method that asks for a client id is bring-your-own-app: the user must
  * register the callback URL in their provider app. Derived from the schema, not

package/dist/connections/connectionFlow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"connectionFlow.d.ts","sourceRoot":"","sources":["../../src/connections/connectionFlow.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACvE,OAAO,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,OAAO,CAAC;AACrF,OAAO,KAAK,EACV,oBAAoB,EACpB,kBAAkB,EAClB,sBAAsB,EACtB,gBAAgB,EACjB,MAAM,SAAS,CAAC;AAEjB,6EAA6E;AAC7E,wBAAgB,eAAe,CAAC,QAAQ,EAAE,gBAAgB,GAAG,cAAc,CAM1E;AAED,mEAAmE;AACnE,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,kBAAkB,GAAG,oBAAoB,EAAE,CAEtF;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,kBAAkB,EAC5B,WAAW,EAAE,MAAM,GAAG,IAAI,GACzB,oBAAoB,GAAG,IAAI,CAQ7B;AAED,wBAAgB,WAAW,CACzB,QAAQ,EAAE,kBAAkB,EAC5B,MAAM,EAAE,oBAAoB,GAAG,IAAI,GAClC,cAAc,CAEhB;AAED,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,kBAAkB,EAC5B,MAAM,EAAE,oBAAoB,GAAG,IAAI,GAClC,UAAU,GAAG,IAAI,CAEnB;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,GAAG,OAAO,CAEtE;AAED,0EAA0E;AAC1E,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,cAAc,EACpB,QAAQ,EAAE,kBAAkB,GAC3B,OAAO,CAET;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,MAAM,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,yEAAyE;IACzE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,OAAO,EAAE,sBAAsB,CAAC;IAChC;;;OAGG;IACH,YAAY,EAAE,OAAO,CAAC;IACtB,yEAAyE;IACzE,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACvC;AAED,wEAAwE;AACxE,wBAAgB,aAAa,CAAC,KAAK,EAAE,eAAe,EAAE,SAAS,EAAE,UAAU,GAAG,MAAM,GAAG,IAAI,CA4C1F;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,UAAU,GAAG,IAAI,EACzB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAWzB;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,eAAe,GAAG,qBAAqB,CA2B9E;AAED,6CAA6C;AAC7C,MAAM,MAAM,QAAQ,GAChB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,gBAAgB,CAAA;CAAE,GAC9C;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,UAAU,EAAE,gBAAgB,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzE;;;;GAIG;AACH,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,cAAc,EACnB,KAAK,EAAE,eAAe,EACtB,OAAO,EAAE;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,GAClD,OAAO,CAAC,QAAQ,CAAC,CAoCnB"}
+{"version":3,"file":"connectionFlow.d.ts","sourceRoot":"","sources":["../../src/connections/connectionFlow.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACvE,OAAO,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,OAAO,CAAC;AACrF,OAAO,KAAK,EACV,oBAAoB,EACpB,kBAAkB,EAClB,qBAAqB,EACrB,sBAAsB,EACtB,gBAAgB,EACjB,MAAM,SAAS,CAAC;AAEjB,6EAA6E;AAC7E,wBAAgB,eAAe,CAAC,QAAQ,EAAE,gBAAgB,GAAG,cAAc,CAM1E;AAED,mEAAmE;AACnE,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,kBAAkB,GAAG,oBAAoB,EAAE,CAEtF;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,kBAAkB,EAC5B,WAAW,EAAE,MAAM,GAAG,IAAI,GACzB,oBAAoB,GAAG,IAAI,CAQ7B;AAED,wBAAgB,WAAW,CACzB,QAAQ,EAAE,kBAAkB,EAC5B,MAAM,EAAE,oBAAoB,GAAG,IAAI,GAClC,cAAc,CAEhB;AAED,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,kBAAkB,EAC5B,MAAM,EAAE,oBAAoB,GAAG,IAAI,GAClC,UAAU,GAAG,IAAI,CAOnB;AAiCD,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,kBAAkB,EAC5B,MAAM,EAAE,oBAAoB,GAAG,IAAI,GAClC,SAAS,qBAAqB,EAAE,CAMlC;AAED,wFAAwF;AACxF,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,sBAAsB,EAC/B,KAAK,EAAE,SAAS,qBAAqB,EAAE,GACtC,sBAAsB,CAGxB;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,GAAG,OAAO,CAEtE;AAED,0EAA0E;AAC1E,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,cAAc,EACpB,QAAQ,EAAE,kBAAkB,GAC3B,OAAO,CAET;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,MAAM,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,yEAAyE;IACzE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,OAAO,EAAE,sBAAsB,CAAC;IAChC;;;OAGG;IACH,YAAY,EAAE,OAAO,CAAC;IACtB,yEAAyE;IACzE,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACvC;AAED,wEAAwE;AACxE,wBAAgB,aAAa,CAAC,KAAK,EAAE,eAAe,EAAE,SAAS,EAAE,UAAU,GAAG,MAAM,GAAG,IAAI,CAkD1F;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,UAAU,GAAG,IAAI,EACzB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAWzB;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,eAAe,GAAG,qBAAqB,CA2C9E;AAED,6CAA6C;AAC7C,MAAM,MAAM,QAAQ,GAChB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,gBAAgB,CAAA;CAAE,GAC9C;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,UAAU,EAAE,gBAAgB,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzE;;;;GAIG;AACH,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,cAAc,EACnB,KAAK,EAAE,eAAe,EACtB,OAAO,EAAE;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,GAClD,OAAO,CAAC,QAAQ,CAAC,CAoCnB"}