@cat-factory/app 0.288.1 → 0.289.0

package/app/stores/foundationalServices.ts

@@ -13,6 +13,7 @@ import type {
   UpdateFoundationalServiceInput,
 } from '~/types/domain'
 import { useSingleFlightProbe } from '~/composables/useSingleFlightProbe'
+import { createServiceCatalogState } from '~/stores/serviceCatalogConnection'
 import { useWorkspaceStore } from '~/stores/workspace'
 
 /**
@@ -88,6 +89,17 @@ function foundationalServicesSetup(
     return requireOwnerId()
   }
 
+  // The workspace's connected developer portal, in its own factory (`./serviceCatalogConnection`):
+  // one connection with one store behind it, where everything else here is the catalog's tiers,
+  // suppressions and repo sources. `reloadCatalog` is a THUNK so it can name `reload`, declared
+  // further down.
+  const portal = createServiceCatalogState({
+    api,
+    requireWorkspaceId,
+    isWorkspaceTier: hasResolved,
+    reloadCatalog: () => reload(),
+  })
+
   /** Probe the feature + load this owner's tier, sources and (ws) the merged catalog. */
   async function runProbe() {
     const id = resolveOwnerId()
@@ -115,6 +127,7 @@ function foundationalServicesSetup(
       sources.value = []
       sourceChanges.value = {}
       sourcesAvailable.value = false
+      portal.reset()
       return
     }
     // Repo sources need the GitHub integration; a 503 here hides only the linking UI — the
@@ -126,6 +139,9 @@ function foundationalServicesSetup(
       sources.value = []
       sourcesAvailable.value = false
     }
+    // The portal connection is its own gate again (the service-catalog encryption key), and it is
+    // workspace-only. See `createServiceCatalogState`, which owns that half.
+    await portal.load(id)
   }
   // Single-flight the probe keyed on the owner id, so a panel-open fan-out loads once per owner.
   const { probe, ensureProbed } = useSingleFlightProbe(runProbe, () => resolveOwnerId())
@@ -243,6 +259,8 @@ function foundationalServicesSetup(
     suppressions,
     sources,
     sourceChanges,
+    serviceCatalog: portal.serviceCatalog,
+    serviceCatalogAvailable: portal.serviceCatalogAvailable,
     contractBodies,
     inheritedCount,
     probe,
@@ -257,6 +275,10 @@ function foundationalServicesSetup(
     unlinkSource,
     syncSource,
     checkSource,
+    connectServiceCatalog: portal.connect,
+    disconnectServiceCatalog: portal.disconnect,
+    probeServiceCatalog: portal.probe,
+    importServiceCatalog: portal.importNow,
   }
 }
 

package/app/stores/observability.ts

@@ -153,6 +153,12 @@ export const useObservabilityStore = defineStore('observability', () => {
       // HTTP call at a time and files it. Only a harness CLI's step-level remainder is spend-only,
       // and that arrives through the stored row, never here.
       spendOnly: false,
+      // The live event is the COMPACT wire shape, which carries no gateway report: the cost a
+      // gateway states and the upstream it routed to arrive with the stored row. Null rather than
+      // 0, because absent and free are different facts everywhere else on this type and a
+      // placeholder zero here would render this run's live rows as free until the panel reloads.
+      reportedCostUsd: null,
+      upstreamProvider: null,
       promptText: '',
       promptPrefixCount: 0,
       promptHash: '',

package/app/stores/serviceCatalogConnection.spec.ts

@@ -0,0 +1,116 @@
+import { describe, expect, it } from 'vitest'
+import type {
+  ConnectServiceCatalogInput,
+  ServiceCatalogConnection,
+  ServiceCatalogSyncResult,
+} from '~/types/domain'
+import { createServiceCatalogState } from '~/stores/serviceCatalogConnection'
+
+// The half of the service-catalog store worth pinning is the SPLIT between connecting and the
+// first import. They fail differently, they have different remedies, and the panel presents them
+// under different titles.
+
+const connection: ServiceCatalogConnection = {
+  provider: 'backstage',
+  baseUrl: 'https://backstage.example.com',
+  authMode: 'static-token',
+  entityFilter: ['kind=component'],
+  includeApis: true,
+  maxServices: 200,
+  lastSyncedAt: null,
+  lastSyncStatus: null,
+  lastSyncMessage: null,
+  connectedAt: 1,
+}
+
+const result: ServiceCatalogSyncResult = {
+  upserted: 1,
+  tombstoned: 0,
+  unchanged: 0,
+  contracts: 1,
+  coverage: 'complete',
+  skippedServices: 0,
+  skippedConflicts: 0,
+  skippedApis: 0,
+  status: 'ok',
+}
+
+const input: ConnectServiceCatalogInput = {
+  baseUrl: 'https://backstage.example.com',
+  auth: { mode: 'static-token', token: 't' },
+}
+
+function build(overrides: { syncServiceCatalog?: () => Promise<ServiceCatalogSyncResult> } = {}) {
+  const calls: string[] = []
+  const state = createServiceCatalogState({
+    api: {
+      getServiceCatalog: async () => {
+        calls.push('get')
+        return connection
+      },
+      connectServiceCatalog: async () => {
+        calls.push('connect')
+        return connection
+      },
+      disconnectServiceCatalog: async () => {
+        calls.push('disconnect')
+        return null
+      },
+      probeServiceCatalog: async () => ({ ok: true }),
+      syncServiceCatalog: async () => {
+        calls.push('sync')
+        return overrides.syncServiceCatalog ? await overrides.syncServiceCatalog() : result
+      },
+    },
+    requireWorkspaceId: () => 'ws-1',
+    isWorkspaceTier: true,
+    reloadCatalog: async () => {
+      calls.push('reload')
+    },
+  })
+  return { state, calls }
+}
+
+describe('createServiceCatalogState', () => {
+  it('settles connect() on the CONNECT alone, so an import failure is not a connect failure', async () => {
+    // The connection is stored by the time an import runs, so rejecting here would tell the
+    // operator the connection failed while the panel renders it connected, and would bury the
+    // remedy the real failure names under a title saying the opposite.
+    const { state, calls } = build()
+
+    await expect(state.connect(input)).resolves.toEqual(connection)
+
+    expect(calls).toEqual(['connect'])
+    expect(state.serviceCatalog.value).toEqual(connection)
+  })
+
+  it('re-reads the connection after an import, for the verdict the import stamped there', async () => {
+    const { state, calls } = build()
+
+    await expect(state.importNow()).resolves.toEqual(result)
+
+    // The stamped verdict is the only thing that tells a human the estate they are looking at is a
+    // PREFIX of the portal's.
+    expect(calls).toEqual(['sync', 'get', 'reload'])
+  })
+
+  it('propagates an import failure to its own caller', async () => {
+    const { state } = build({
+      syncServiceCatalog: async () => {
+        throw new Error('service catalog unauthorized')
+      },
+    })
+
+    await expect(state.importNow()).rejects.toThrow('service catalog unauthorized')
+  })
+
+  it('clears the connection on disconnect and reloads the catalog views it tombstoned', async () => {
+    const { state, calls } = build()
+    await state.connect(input)
+
+    await state.disconnect()
+
+    expect(state.serviceCatalog.value).toBeNull()
+    expect(calls).toEqual(['connect', 'disconnect', 'reload'])
+  })
+})

package/app/stores/serviceCatalogConnection.ts

@@ -0,0 +1,131 @@
+import { ref } from 'vue'
+import type {
+  ConnectServiceCatalogInput,
+  ServiceCatalogConnection,
+  ServiceCatalogSyncResult,
+} from '~/types/domain'
+
+/**
+ * The SERVICE CATALOG half of the foundational-services store: the workspace's connected developer
+ * portal, and the four actions over it.
+ *
+ * A separate factory rather than more of `foundationalServicesSetup`, which had reached its
+ * per-function line budget. The seam is the feature's own: this is one connection with one store
+ * behind it, where everything else in that setup is the catalog's tiers, its suppressions and its
+ * repo sources.
+ *
+ * It is WORKSPACE-only. The portal credential rides the workspace-keyed secret delegation, so the
+ * backend serves this connection at no other scope, and the account-tier store gets the same state
+ * declared and permanently unavailable rather than a shape that pretends otherwise.
+ */
+export interface ServiceCatalogStateDependencies {
+  /** The workspace-scoped API calls, narrowed to the five this half makes. */
+  api: {
+    getServiceCatalog: (workspaceId: string) => Promise<ServiceCatalogConnection | null>
+    connectServiceCatalog: (
+      workspaceId: string,
+      body: ConnectServiceCatalogInput,
+    ) => Promise<ServiceCatalogConnection>
+    // The contract's 204 sends no body, which the generated client surfaces as `null` rather than
+    // `void`; declaring the narrower shape here would refuse the real client.
+    disconnectServiceCatalog: (workspaceId: string) => Promise<unknown>
+    probeServiceCatalog: (
+      workspaceId: string,
+      body: ConnectServiceCatalogInput,
+    ) => Promise<{ ok: boolean; message?: string }>
+    syncServiceCatalog: (workspaceId: string) => Promise<ServiceCatalogSyncResult>
+  }
+  /** Throws unless this store is the workspace tier; the caller's own guard. */
+  requireWorkspaceId: () => string
+  /** False on the account tier, where there is no connection to read. */
+  isWorkspaceTier: boolean
+  /** Reload the catalog views a connect / disconnect / import changed. */
+  reloadCatalog: () => Promise<void>
+}
+
+export function createServiceCatalogState(deps: ServiceCatalogStateDependencies) {
+  const { api, requireWorkspaceId, isWorkspaceTier, reloadCatalog } = deps
+
+  /** The connection, or null when the workspace has none. */
+  const serviceCatalog = ref<ServiceCatalogConnection | null>(null)
+  /**
+   * false when the deployment configured no service-catalog encryption key: the catalog itself
+   * works (contracts can be uploaded), and only the portal-import surface 503s. The finer gate,
+   * exactly as `sourcesAvailable` is for the GitHub half.
+   */
+  const serviceCatalogAvailable = ref(true)
+
+  /**
+   * Read the connection as part of the store's probe.
+   *
+   * Its own `try` rather than part of the probe's: a 503 here hides only the import panel, and the
+   * catalog read that ran before it already succeeded, so folding the two would report a configured
+   * catalog as absent because its optional portal half is not wired.
+   */
+  async function load(workspaceId: string): Promise<void> {
+    if (!isWorkspaceTier) {
+      serviceCatalogAvailable.value = false
+      return
+    }
+    try {
+      serviceCatalog.value = await api.getServiceCatalog(workspaceId)
+      serviceCatalogAvailable.value = true
+    } catch {
+      serviceCatalog.value = null
+      serviceCatalogAvailable.value = false
+    }
+  }
+
+  /** Clear both views, for a probe whose whole catalog read failed. */
+  function reset(): void {
+    serviceCatalog.value = null
+    serviceCatalogAvailable.value = false
+  }
+
+  /**
+   * Store the connection. The first import is the CALLER's next step, not part of this promise.
+   *
+   * A connection that shows nothing reads as a broken one, so an import does follow immediately
+   * (the same reason a linked repo source syncs on link). What it must not do is settle this
+   * promise: by the time the import runs the connection is already stored, so folding an import
+   * failure in here would reject a call that succeeded, and the panel would show a "could not
+   * connect" toast beside the connection it just made, hiding the remedy the real failure names.
+   */
+  async function connect(input: ConnectServiceCatalogInput) {
+    serviceCatalog.value = await api.connectServiceCatalog(requireWorkspaceId(), input)
+    return serviceCatalog.value
+  }
+
+  async function disconnect(): Promise<void> {
+    await api.disconnectServiceCatalog(requireWorkspaceId())
+    serviceCatalog.value = null
+    // Disconnecting TOMBSTONES what the portal produced, so both catalog views are now wrong.
+    await reloadCatalog()
+  }
+
+  function probe(input: ConnectServiceCatalogInput) {
+    return api.probeServiceCatalog(requireWorkspaceId(), input)
+  }
+
+  /** Import now, then refresh both catalog views. */
+  async function importNow(): Promise<ServiceCatalogSyncResult> {
+    const id = requireWorkspaceId()
+    const result = await api.syncServiceCatalog(id)
+    // The connection is re-read too: the import stamps its verdict there, and that verdict is the
+    // only thing that tells a human the estate they are looking at is a PREFIX of the portal's.
+    const [connection] = await Promise.all([api.getServiceCatalog(id), reloadCatalog()])
+    serviceCatalog.value = connection
+    return result
+  }
+
+  return {
+    serviceCatalog,
+    serviceCatalogAvailable,
+    load,
+    reset,
+    connect,
+    disconnect,
+    probe,
+    importNow,
+  }
+}

package/app/types/foundationalServices.ts

@@ -31,3 +31,17 @@ export type {
   UpdateFoundationalServiceInput,
   UploadApiContract,
 } from '@cat-factory/contracts'
+
+// The SERVICE CATALOG connection: the developer portal (Backstage) whose services are imported
+// into the catalog above as `workspace`-tier rows. Beside the catalog types rather than in a file
+// of its own, because everything it produces IS that catalog.
+export type {
+  ConnectServiceCatalogInput,
+  ServiceCatalogAuth,
+  ServiceCatalogAuthMode,
+  ServiceCatalogConnection,
+  ServiceCatalogCoverage,
+  ServiceCatalogProvider,
+  ServiceCatalogSyncResult,
+  ServiceCatalogSyncStatus,
+} from '@cat-factory/contracts'

package/app/utils/serviceCatalog.spec.ts

@@ -0,0 +1,51 @@
+import { describe, expect, it } from 'vitest'
+import { missingI18nKeys } from '../../test/i18nKeys'
+import {
+  SERVICE_CATALOG_AUTH_KEYS,
+  SERVICE_CATALOG_AUTH_ORDER,
+  SERVICE_CATALOG_STATUS_COLORS,
+  SERVICE_CATALOG_STATUS_KEYS,
+  serviceCatalogStatusKey,
+} from './serviceCatalog'
+
+describe('service-catalog i18n keys', () => {
+  // The gap `test/i18nKeys.ts` exists for: the exhaustive `Record` proves every union member has an
+  // entry, and nothing proves the entry still names a key that exists. Deleting one would otherwise
+  // read as a clean removal, with the badge rendering its own key path at runtime.
+  it('every auth-mode key resolves in the base catalog', () => {
+    expect(missingI18nKeys(Object.values(SERVICE_CATALOG_AUTH_KEYS))).toEqual([])
+  })
+
+  it('every status key resolves, the never-imported case included', () => {
+    expect(
+      missingI18nKeys([
+        ...Object.values(SERVICE_CATALOG_STATUS_KEYS),
+        serviceCatalogStatusKey(null),
+      ]),
+    ).toEqual([])
+  })
+})
+
+describe('serviceCatalogStatusKey', () => {
+  it('keeps "never imported" apart from a failure', () => {
+    // Collapsing them would tell an operator their portal is broken the moment they connect it.
+    expect(serviceCatalogStatusKey(null)).not.toBe(SERVICE_CATALOG_STATUS_KEYS.failed)
+  })
+})
+
+describe('SERVICE_CATALOG_AUTH_ORDER', () => {
+  it('offers exactly the modes the label map knows, once each', () => {
+    // A relation over the two, not a pinned count: a new auth mode adds a member to the union, and
+    // this fails until the form offers it and the label map names it.
+    expect([...SERVICE_CATALOG_AUTH_ORDER].sort()).toEqual(
+      Object.keys(SERVICE_CATALOG_AUTH_KEYS).sort(),
+    )
+  })
+})
+
+describe('SERVICE_CATALOG_STATUS_COLORS', () => {
+  it('renders a PARTIAL import as a warning rather than a success', () => {
+    expect(SERVICE_CATALOG_STATUS_COLORS.partial).toBe('warning')
+    expect(SERVICE_CATALOG_STATUS_COLORS.ok).toBe('success')
+  })
+})

package/app/utils/serviceCatalog.ts

@@ -0,0 +1,68 @@
+import type { ServiceCatalogAuthMode, ServiceCatalogSyncStatus } from '~/types/domain'
+
+// The SERVICE CATALOG connection's two closed vocabularies → their i18n keys, in ONE place each.
+//
+// Here rather than inline in `ServiceCatalogConnection.vue` for the reason `utils/vcs.ts` holds the
+// per-provider constants: an exhaustive `Record` over a wire union is the drift guard, and it only
+// guards if there is exactly one of it. A second copy in a template would keep rendering while this
+// one gained a member.
+//
+// Both are also the case the typed-message-key guard cannot see: the keys are reached through a
+// lookup rather than written out at the call site, so nothing proves the entry still names a key
+// that exists. `serviceCatalog.spec.ts` asserts every value against the base catalog, which is the
+// convention `test/i18nKeys.ts` exists for.
+
+/**
+ * The label for one authentication mode.
+ *
+ * The keys are camelCase where the wire values are kebab-case, because a vue-i18n path segment is
+ * read as a nested lookup and a hyphen in one reads fine but breaks the moment anyone writes the
+ * literal form.
+ */
+export const SERVICE_CATALOG_AUTH_KEYS: Record<ServiceCatalogAuthMode, string> = {
+  none: 'serviceCatalog.auth.none',
+  'static-token': 'serviceCatalog.auth.staticToken',
+  'legacy-shared-secret': 'serviceCatalog.auth.legacySharedSecret',
+  'oauth2-client-credentials': 'serviceCatalog.auth.oauth2',
+  basic: 'serviceCatalog.auth.basic',
+  headers: 'serviceCatalog.auth.headers',
+}
+
+/**
+ * The label for what the last import concluded.
+ *
+ * `never` is NOT a member of the wire union and has its own key beside these: "no import has run"
+ * is a null `lastSyncStatus` rather than a status value, and collapsing it into `failed` would tell
+ * an operator their portal is broken the moment they connect it.
+ */
+export const SERVICE_CATALOG_STATUS_KEYS: Record<ServiceCatalogSyncStatus, string> = {
+  ok: 'serviceCatalog.status.ok',
+  partial: 'serviceCatalog.status.partial',
+  failed: 'serviceCatalog.status.failed',
+}
+
+/** The key for a connection's last verdict, including the "never imported" case. */
+export function serviceCatalogStatusKey(status: ServiceCatalogSyncStatus | null): string {
+  return status ? SERVICE_CATALOG_STATUS_KEYS[status] : 'serviceCatalog.status.never'
+}
+
+/**
+ * The badge colour for one verdict. `partial` is a WARNING rather than a success, which is the
+ * whole point of the three-value status: a truncated import holds real services and not all of
+ * them, and a green badge over it is how a prefix of an estate comes to read as the estate.
+ */
+export const SERVICE_CATALOG_STATUS_COLORS = {
+  ok: 'success',
+  partial: 'warning',
+  failed: 'error',
+} as const satisfies Record<ServiceCatalogSyncStatus, string>
+
+/** The modes offered in the connect form, in the order an operator is most likely to want them. */
+export const SERVICE_CATALOG_AUTH_ORDER: readonly ServiceCatalogAuthMode[] = [
+  'static-token',
+  'legacy-shared-secret',
+  'oauth2-client-credentials',
+  'basic',
+  'headers',
+  'none',
+]

package/i18n/locales/de.json

@@ -1021,6 +1021,7 @@
       "context": "{value} Ktx",
       "contextThousands": "{value}K Ktx",
       "price": "{input}/{output} pro Mtok",
+      "retiresOn": "Auslauf am {date}",
       "toast": {
         "connected": "OpenRouter-Schlüssel verbunden",
         "connectFailed": "Schlüssel konnte nicht verbunden werden",
@@ -3843,6 +3844,8 @@
       "cacheRead": "{tokens} aus dem Cache gelesen",
       "cacheWrite": "{tokens} in den Cache geschrieben",
       "total": "gesamt {duration}",
+      "viaUpstream": "über {upstream}",
+      "reportedCost": "abgerechnet {cost}",
       "prompt": "Prompt",
       "promptPrefixOmitted": "(nur neue Nachrichten: {count} frühere ausgelassen)",
       "response": "Antwort",
@@ -5231,7 +5234,8 @@
     },
     "tab": {
       "catalog": "Katalog",
-      "sources": "Repo-Quellen"
+      "sources": "Repo-Quellen",
+      "portal": "Entwicklerportal"
     },
     "panel": {
       "title": "Basisdienste",
@@ -5245,7 +5249,10 @@
     "format": {
       "openapi": "OpenAPI",
       "toadContract": "toad-contracts",
-      "lokaliseApiContract": "lokalise/api-contract"
+      "lokaliseApiContract": "lokalise/api-contract",
+      "asyncapi": "AsyncAPI",
+      "graphql": "GraphQL",
+      "grpc": "gRPC"
     },
     "contracts": {
       "omitted": "+{count} weitere nicht aufgeführt",
@@ -5923,7 +5930,11 @@
         "binary_generators_unreachable": "Die generativen Integrationen dieser Installation konnten gerade nicht gelesen werden, deshalb wurde der Lauf nicht gestartet. Es ist nichts falsch konfiguriert und keine Änderung nötig: versuchen Sie es erneut, sobald die Verbindung wieder steht.",
         "foundational_builtins_unreachable": "Die integrierten Basisdienste dieser Installation konnten gerade nicht gelesen werden. Es ist nichts falsch konfiguriert und keine Änderung nötig: versuchen Sie es erneut, sobald die Verbindung wieder steht.",
         "connection_credentials_unreadable": "Die gespeicherten Zugangsdaten dieser Verbindung konnten nicht gelesen werden. Wenn diese Installation den Dienst mit dem zugehörigen Schlüssel erreicht, verbinden Sie die Quelle neu, um sie zu ersetzen; andernfalls versuchen Sie es erneut, sobald diese Verbindung wiederhergestellt ist.",
-        "vcs_capability_unsupported": "Der mit diesem Workspace verbundene Quellcode-Anbieter bietet diesen Vorgang nicht an. Es ist nichts falsch konfiguriert und eine Einrichtung hilft hier nicht: Für diesen Anbieter ist der Vorgang nicht verfügbar."
+        "vcs_capability_unsupported": "Der mit diesem Workspace verbundene Quellcode-Anbieter bietet diesen Vorgang nicht an. Es ist nichts falsch konfiguriert und eine Einrichtung hilft hier nicht: Für diesen Anbieter ist der Vorgang nicht verfügbar.",
+        "service_catalog_unreachable": "Das Entwicklerportal dieses Boards hat nicht geantwortet oder eine Antwort geliefert, die diese Plattform nicht lesen kann. Hier ist nichts falsch konfiguriert und keine Änderung hilft: versuche es erneut, sobald das Portal erreichbar ist.",
+        "service_catalog_unauthorized": "Das Entwicklerportal hat die gespeicherte Zugangsdaten abgelehnt. Sie wurden wahrscheinlich rotiert oder widerrufen: öffne die Servicekatalog-Einstellungen und trage aktuelle ein.",
+        "service_catalog_filter_missing": "Der Entitätsfilter dieser Verbindung konnte nicht gelesen werden, es gibt also nichts zu importieren. Speichere die Servicekatalog-Verbindung erneut, um ihn wiederherzustellen.",
+        "service_catalog_response_too_large": "Das Entwicklerportal hat mit mehr Daten geantwortet, als diese Plattform in einer Antwort aufnimmt. Öffne die Servicekatalog-Einstellungen und senke das Service-Limit oder deaktiviere den Import von Schnittstellendefinitionen, und importiere dann erneut."
       }
     },
     "action": {
@@ -8098,5 +8109,79 @@
       "title": "Nichts zu vergleichen"
     },
     "loadFailed": "Die erzeugten Kandidaten konnten nicht geladen werden."
+  },
+  "serviceCatalog": {
+    "unavailable": "Der Import eines Servicekatalogs ist für diese Installation nicht konfiguriert.",
+    "intro": "Verweise die Plattform auf das Entwicklerportal, das deine Organisation bereits betreibt: Ihre Services werden in den Katalog oben importiert, mit Identität, Verantwortlichkeit und den API-Definitionen, die jeder Service veröffentlicht. Agenten, die Fehler einordnen oder untersuchen, lesen sie, um zu bestimmen, zu welchem Service eine Aufgabe gehört.",
+    "summary": "Filter: {filter} · höchstens {max} Services",
+    "form": {
+      "connect": "Portal verbinden",
+      "replace": "Verbindung ersetzen"
+    },
+    "field": {
+      "baseUrl": "Portal-URL",
+      "authMode": "Authentifizierung",
+      "token": "Service-Token",
+      "sharedSecret": "Gemeinsames Geheimnis",
+      "tokenUrl": "Token-Endpunkt",
+      "clientId": "Client-ID",
+      "clientSecret": "Client-Secret",
+      "scope": "Scope (optional)",
+      "audience": "Audience (optional)",
+      "username": "Benutzername",
+      "password": "Passwort",
+      "headerName": "Header-Name",
+      "headerValue": "Header-Wert",
+      "secondHeaderName": "Zweiter Header-Name (optional)",
+      "secondHeaderValue": "Zweiter Header-Wert",
+      "entityFilter": "Entitätsfilter",
+      "maxServices": "Maximale Anzahl Services",
+      "includeApis": "API-Definitionen der Services mitimportieren"
+    },
+    "help": {
+      "baseUrl": "Die Basis-URL deiner Backstage-Instanz. Ein privater oder interner Host ist nur zulässig, wenn die Installation ihn erlaubt.",
+      "token": "Ein Service-zu-Service-Token aus der External-Access-Konfiguration von Backstage.",
+      "sharedSecret": "Ein base64-Geheimnis aus `backend.auth.keys`. Die Plattform signiert damit pro Anfrage ein kurzlebiges Token.",
+      "headers": "Für ein Gateway, das über eigene Header authentifiziert, etwa ein Cloudflare-Access-Service-Token.",
+      "entityFilter": "Ein `key=value`-Ausdruck pro Zeile; alle müssen zutreffen. Standard ist `kind=component`. Grenze ihn auf die Services ein, die als gemeinsame Fähigkeiten angeboten werden sollen.",
+      "maxServices": "Ein Import, der dieses Limit erreicht, wird als Auszug des Portals gemeldet, nicht als dessen Gesamtheit."
+    },
+    "auth": {
+      "none": "Keine",
+      "staticToken": "Statisches Service-Token",
+      "legacySharedSecret": "Gemeinsames Geheimnis (Legacy-Token)",
+      "oauth2": "OAuth2 Client Credentials",
+      "basic": "HTTP Basic",
+      "headers": "Eigene Header"
+    },
+    "status": {
+      "ok": "Importiert",
+      "partial": "Teilweise importiert",
+      "failed": "Import fehlgeschlagen",
+      "never": "Nie importiert"
+    },
+    "action": {
+      "connect": "Verbinden",
+      "replace": "Ersetzen",
+      "probe": "Verbindung testen",
+      "import": "Jetzt importieren",
+      "disconnect": "Trennen"
+    },
+    "disconnect": {
+      "title": "Servicekatalog trennen?",
+      "body": "Die von diesem Portal importierten Services werden aus dem Katalog zurückgezogen. Manuell registrierte oder hochgeladene Einträge bleiben unberührt.",
+      "confirm": "Trennen"
+    },
+    "toast": {
+      "connected": "Servicekatalog verbunden",
+      "connectFailed": "Servicekatalog konnte nicht verbunden werden",
+      "probeOk": "Das Portal hat geantwortet",
+      "probeFailed": "Das Portal war nicht erreichbar",
+      "imported": "Servicekatalog importiert",
+      "importedDetail": "{upserted} aktualisiert, {unchanged} unverändert, {tombstoned} zurückgezogen",
+      "importFailed": "Servicekatalog konnte nicht importiert werden",
+      "disconnected": "Servicekatalog getrennt",
+      "disconnectFailed": "Servicekatalog konnte nicht getrennt werden"
+    }
   }
 }