@cat-factory/app 0.288.2 → 0.290.0

package/app/components/panels/ObservabilityPanel.vue

@@ -848,6 +848,13 @@ function exportJson() {
                       :title="c.model"
                     >
                       {{ c.provider }}:{{ c.model }}
+                      <!-- Which upstream a GATEWAY routed to. Without it every `openrouter` row
+                           reads alike, and an upstream having a bad day cannot be told from the
+                           gateway having one. Absent for a direct vendor, where `provider`
+                           already names who served the call. -->
+                      <span v-if="c.upstreamProvider" class="text-slate-600">
+                        {{ t('observability.call.viaUpstream', { upstream: c.upstreamProvider }) }}
+                      </span>
                     </span>
                     <div
                       class="ms-auto flex items-center gap-2.5 text-[11px] tabular-nums text-slate-400"
@@ -927,6 +934,18 @@ function exportJson() {
                       <span>{{
                         t('observability.call.total', { duration: formatMs(c.totalMs) })
                       }}</span>
+                      <!-- The one MEASURED cost on the row: what the gateway's own ledger says,
+                           in USD, against the derived estimate every other figure on this panel
+                           is. `!= null` and not truthiness: a reported 0 is a free route saying
+                           so, which is a different fact from a producer that reports nothing and
+                           must not be hidden as if it were. -->
+                      <span v-if="c.reportedCostUsd != null" class="text-slate-400">
+                        {{
+                          t('observability.call.reportedCost', {
+                            cost: formatCost(c.reportedCostUsd, 'USD'),
+                          })
+                        }}
+                      </span>
                     </div>
                     <div>
                       <div

package/app/components/providers/ApiKeysSection.vue

@@ -16,6 +16,7 @@
 //  - With `accountId`: manage ACCOUNT-wide keys (shared by every workspace in the
 //    account); admin-only, enforced server-side. Surfaced from account/team settings.
 import { computed, ref, watch } from 'vue'
+import { providerCachesPrompts } from '@cat-factory/contracts'
 import type { ApiKey, ApiKeyProvider } from '~/types/domain'
 import SecretInput from '~/components/common/SecretInput.vue'
 
@@ -48,18 +49,29 @@ interface ProviderMeta {
   label: string
   url: string
   steps: string[]
-  /**
-   * Whether this provider caches the re-sent prompt prefix. Connecting a key here
-   * upgrades its models to the caching `direct` flavour, so a long agentic run stops
-   * re-billing its whole growing prompt every turn. Mirrors the backend
-   * `providerCachePolicy`; the gateways are pass-through (no caching we rely on yet).
-   */
-  caches?: boolean
+}
+
+/**
+ * Whether connecting a key here upgrades its models to the caching flavour, so a long agentic
+ * run stops re-billing its whole growing prompt every turn.
+ *
+ * READ from the shared rule rather than kept as a flag beside each entry. A hand-kept copy was
+ * already stale: the backend answers per (provider, MODEL) for a gateway, so it now reports
+ * caching for several OpenRouter routes while a boolean here still said the gateways cache
+ * nothing. A per-provider question is the one this page can ask, and asking the same function
+ * the picker and the call paths ask is what keeps the three answers from diverging again.
+ *
+ * A GATEWAY therefore answers false here, honestly: whether an OpenRouter key caches depends on
+ * which model the run picks, which is a per-model badge in the picker rather than a promise this
+ * page can make about a key.
+ */
+function cachesPrompts(provider: ApiKeyProvider): boolean {
+  return providerCachesPrompts(provider)
 }
 
 // Provider metadata. Labels + step instructions resolve through i18n (reactive to the
 // locale), so each `t(...)` uses a literal key (kept tier-1 typed-key checkable); only the
-// `value`/`url`/`caches` differentiators stay inline.
+// `value`/`url` differentiators stay inline.
 /** Direct vendors: the key reaches that one vendor's own endpoint. */
 const DIRECT_PROVIDERS = computed<ProviderMeta[]>(() => [
   {
@@ -70,7 +82,6 @@ const DIRECT_PROVIDERS = computed<ProviderMeta[]>(() => [
       t('providers.apiKeys.providers.openai.step1'),
       t('providers.apiKeys.providers.openai.step2'),
     ],
-    caches: true,
   },
   {
     value: 'anthropic',
@@ -80,7 +91,6 @@ const DIRECT_PROVIDERS = computed<ProviderMeta[]>(() => [
       t('providers.apiKeys.providers.anthropic.step1'),
       t('providers.apiKeys.providers.anthropic.step2'),
     ],
-    caches: true,
   },
   {
     value: 'qwen',
@@ -90,7 +100,6 @@ const DIRECT_PROVIDERS = computed<ProviderMeta[]>(() => [
       t('providers.apiKeys.providers.qwen.step1'),
       t('providers.apiKeys.providers.qwen.step2'),
     ],
-    caches: true,
   },
   {
     value: 'deepseek',
@@ -100,7 +109,6 @@ const DIRECT_PROVIDERS = computed<ProviderMeta[]>(() => [
       t('providers.apiKeys.providers.deepseek.step1'),
       t('providers.apiKeys.providers.deepseek.step2'),
     ],
-    caches: true,
   },
   {
     value: 'moonshot',
@@ -116,7 +124,6 @@ const DIRECT_PROVIDERS = computed<ProviderMeta[]>(() => [
     label: t('providers.apiKeys.providers.xai.label'),
     url: 'https://console.x.ai/',
     steps: [t('providers.apiKeys.providers.xai.step1'), t('providers.apiKeys.providers.xai.step2')],
-    caches: true,
   },
 ])
 
@@ -334,7 +341,10 @@ async function remove(k: ApiKey) {
 
     <!-- caching capability: connecting a direct key that caches upgrades its models to
          the caching flavour, so long agentic runs stop re-billing the whole prompt. -->
-    <p v-if="selected.caches" class="flex items-center gap-1.5 text-[12px] text-emerald-400/90">
+    <p
+      v-if="cachesPrompts(selected.value)"
+      class="flex items-center gap-1.5 text-[12px] text-emerald-400/90"
+    >
       <UIcon name="i-lucide-zap" class="h-3.5 w-3.5 shrink-0" />
       {{ t('providers.apiKeys.cachingNote', { provider: selected.label }) }}
     </p>

package/app/components/provisioning/ProvisioningLogsDrawer.vue

@@ -96,6 +96,7 @@ const OPERATION_LABEL = computed<Record<ProvisioningOperation, string>>(() => ({
   teardown: t('provisioning.operation.teardown'),
   'teardown-verify': t('provisioning.operation.teardown-verify'),
   status: t('provisioning.operation.status'),
+  remediate: t('provisioning.operation.remediate'),
   dispatch: t('provisioning.operation.dispatch'),
   release: t('provisioning.operation.release'),
   'poll-failure': t('provisioning.operation.poll-failure'),

package/app/components/settings/OpenRouterCatalogPanel.vue

@@ -351,6 +351,14 @@ function manageKeys() {
               <span class="min-w-0 flex-1">
                 <span class="block truncate text-slate-200">{{ m.name }}</span>
                 <span class="block truncate font-mono text-[11px] text-slate-500">{{ m.id }}</span>
+                <!--
+                  A withdrawal date is the one fact about a model that fails SILENTLY: past it the
+                  route simply stops answering and the run falls through to whatever the picker
+                  offers next, so the moment to see it is while choosing.
+                -->
+                <span v-if="m.expirationDate" class="block truncate text-[11px] text-amber-400">{{
+                  t('settings.openRouterCatalog.retiresOn', { date: m.expirationDate })
+                }}</span>
               </span>
               <span class="shrink-0 text-end text-[11px] text-slate-500">
                 <span v-if="m.contextLength" class="block">{{

package/app/composables/api/foundationalServices.ts

@@ -1,6 +1,11 @@
 import {
+  connectServiceCatalogContract,
   createFoundationalServiceContract,
   deleteFoundationalServiceContract,
+  disconnectServiceCatalogContract,
+  getServiceCatalogContract,
+  probeServiceCatalogContract,
+  syncServiceCatalogContract,
   foundationalServiceSourceStatusContract,
   getFoundationalServiceContractsContract,
   linkFoundationalServiceSourceContract,
@@ -15,6 +20,7 @@ import {
   updateFoundationalServiceContract,
 } from '@cat-factory/contracts'
 import type {
+  ConnectServiceCatalogInput,
   CreateFoundationalServiceInput,
   FoundationalServiceOwnerKind,
   LinkFoundationalServiceSourceInput,
@@ -136,5 +142,23 @@ export function foundationalServicesApi({ send, ws, scope }: ApiContext) {
         pathPrefix: scope(kind, id),
         pathParams: { id: sourceId },
       }),
+
+    // ---- the SERVICE CATALOG connection (a developer portal) --------------
+    // Workspace-only, and not by omission: the portal credential rides the workspace-keyed secret
+    // delegation, so there is no account-scoped shape of this connection to serve.
+    getServiceCatalog: (workspaceId: string) =>
+      send(getServiceCatalogContract, { pathPrefix: ws(workspaceId) }),
+
+    connectServiceCatalog: (workspaceId: string, body: ConnectServiceCatalogInput) =>
+      send(connectServiceCatalogContract, { pathPrefix: ws(workspaceId), body }),
+
+    disconnectServiceCatalog: (workspaceId: string) =>
+      send(disconnectServiceCatalogContract, { pathPrefix: ws(workspaceId) }),
+
+    probeServiceCatalog: (workspaceId: string, body: ConnectServiceCatalogInput) =>
+      send(probeServiceCatalogContract, { pathPrefix: ws(workspaceId), body }),
+
+    syncServiceCatalog: (workspaceId: string) =>
+      send(syncServiceCatalogContract, { pathPrefix: ws(workspaceId) }),
   }
 }

package/app/composables/usePipelineErrorToast.ts

@@ -358,6 +358,11 @@ const UNAVAILABLE_DESCRIPTION_KEYS: Record<UnavailableReason, string> = {
   connection_credentials_unreadable:
     'errors.unavailable.description.connection_credentials_unreadable',
   vcs_capability_unsupported: 'errors.unavailable.description.vcs_capability_unsupported',
+  service_catalog_unreachable: 'errors.unavailable.description.service_catalog_unreachable',
+  service_catalog_unauthorized: 'errors.unavailable.description.service_catalog_unauthorized',
+  service_catalog_filter_missing: 'errors.unavailable.description.service_catalog_filter_missing',
+  service_catalog_response_too_large:
+    'errors.unavailable.description.service_catalog_response_too_large',
 }
 
 /**

package/app/stores/foundationalServices.ts

@@ -13,6 +13,7 @@ import type {
   UpdateFoundationalServiceInput,
 } from '~/types/domain'
 import { useSingleFlightProbe } from '~/composables/useSingleFlightProbe'
+import { createServiceCatalogState } from '~/stores/serviceCatalogConnection'
 import { useWorkspaceStore } from '~/stores/workspace'
 
 /**
@@ -88,6 +89,17 @@ function foundationalServicesSetup(
     return requireOwnerId()
   }
 
+  // The workspace's connected developer portal, in its own factory (`./serviceCatalogConnection`):
+  // one connection with one store behind it, where everything else here is the catalog's tiers,
+  // suppressions and repo sources. `reloadCatalog` is a THUNK so it can name `reload`, declared
+  // further down.
+  const portal = createServiceCatalogState({
+    api,
+    requireWorkspaceId,
+    isWorkspaceTier: hasResolved,
+    reloadCatalog: () => reload(),
+  })
+
   /** Probe the feature + load this owner's tier, sources and (ws) the merged catalog. */
   async function runProbe() {
     const id = resolveOwnerId()
@@ -115,6 +127,7 @@ function foundationalServicesSetup(
       sources.value = []
       sourceChanges.value = {}
       sourcesAvailable.value = false
+      portal.reset()
       return
     }
     // Repo sources need the GitHub integration; a 503 here hides only the linking UI — the
@@ -126,6 +139,9 @@ function foundationalServicesSetup(
       sources.value = []
       sourcesAvailable.value = false
     }
+    // The portal connection is its own gate again (the service-catalog encryption key), and it is
+    // workspace-only. See `createServiceCatalogState`, which owns that half.
+    await portal.load(id)
   }
   // Single-flight the probe keyed on the owner id, so a panel-open fan-out loads once per owner.
   const { probe, ensureProbed } = useSingleFlightProbe(runProbe, () => resolveOwnerId())
@@ -243,6 +259,8 @@ function foundationalServicesSetup(
     suppressions,
     sources,
     sourceChanges,
+    serviceCatalog: portal.serviceCatalog,
+    serviceCatalogAvailable: portal.serviceCatalogAvailable,
     contractBodies,
     inheritedCount,
     probe,
@@ -257,6 +275,10 @@ function foundationalServicesSetup(
     unlinkSource,
     syncSource,
     checkSource,
+    connectServiceCatalog: portal.connect,
+    disconnectServiceCatalog: portal.disconnect,
+    probeServiceCatalog: portal.probe,
+    importServiceCatalog: portal.importNow,
   }
 }
 

package/app/stores/observability.ts

@@ -153,6 +153,12 @@ export const useObservabilityStore = defineStore('observability', () => {
       // HTTP call at a time and files it. Only a harness CLI's step-level remainder is spend-only,
       // and that arrives through the stored row, never here.
       spendOnly: false,
+      // The live event is the COMPACT wire shape, which carries no gateway report: the cost a
+      // gateway states and the upstream it routed to arrive with the stored row. Null rather than
+      // 0, because absent and free are different facts everywhere else on this type and a
+      // placeholder zero here would render this run's live rows as free until the panel reloads.
+      reportedCostUsd: null,
+      upstreamProvider: null,
       promptText: '',
       promptPrefixCount: 0,
       promptHash: '',

package/app/stores/serviceCatalogConnection.spec.ts

@@ -0,0 +1,116 @@
+import { describe, expect, it } from 'vitest'
+import type {
+  ConnectServiceCatalogInput,
+  ServiceCatalogConnection,
+  ServiceCatalogSyncResult,
+} from '~/types/domain'
+import { createServiceCatalogState } from '~/stores/serviceCatalogConnection'
+
+// The half of the service-catalog store worth pinning is the SPLIT between connecting and the
+// first import. They fail differently, they have different remedies, and the panel presents them
+// under different titles.
+
+const connection: ServiceCatalogConnection = {
+  provider: 'backstage',
+  baseUrl: 'https://backstage.example.com',
+  authMode: 'static-token',
+  entityFilter: ['kind=component'],
+  includeApis: true,
+  maxServices: 200,
+  lastSyncedAt: null,
+  lastSyncStatus: null,
+  lastSyncMessage: null,
+  connectedAt: 1,
+}
+
+const result: ServiceCatalogSyncResult = {
+  upserted: 1,
+  tombstoned: 0,
+  unchanged: 0,
+  contracts: 1,
+  coverage: 'complete',
+  skippedServices: 0,
+  skippedConflicts: 0,
+  skippedApis: 0,
+  status: 'ok',
+}
+
+const input: ConnectServiceCatalogInput = {
+  baseUrl: 'https://backstage.example.com',
+  auth: { mode: 'static-token', token: 't' },
+}
+
+function build(overrides: { syncServiceCatalog?: () => Promise<ServiceCatalogSyncResult> } = {}) {
+  const calls: string[] = []
+  const state = createServiceCatalogState({
+    api: {
+      getServiceCatalog: async () => {
+        calls.push('get')
+        return connection
+      },
+      connectServiceCatalog: async () => {
+        calls.push('connect')
+        return connection
+      },
+      disconnectServiceCatalog: async () => {
+        calls.push('disconnect')
+        return null
+      },
+      probeServiceCatalog: async () => ({ ok: true }),
+      syncServiceCatalog: async () => {
+        calls.push('sync')
+        return overrides.syncServiceCatalog ? await overrides.syncServiceCatalog() : result
+      },
+    },
+    requireWorkspaceId: () => 'ws-1',
+    isWorkspaceTier: true,
+    reloadCatalog: async () => {
+      calls.push('reload')
+    },
+  })
+  return { state, calls }
+}
+
+describe('createServiceCatalogState', () => {
+  it('settles connect() on the CONNECT alone, so an import failure is not a connect failure', async () => {
+    // The connection is stored by the time an import runs, so rejecting here would tell the
+    // operator the connection failed while the panel renders it connected, and would bury the
+    // remedy the real failure names under a title saying the opposite.
+    const { state, calls } = build()
+
+    await expect(state.connect(input)).resolves.toEqual(connection)
+
+    expect(calls).toEqual(['connect'])
+    expect(state.serviceCatalog.value).toEqual(connection)
+  })
+
+  it('re-reads the connection after an import, for the verdict the import stamped there', async () => {
+    const { state, calls } = build()
+
+    await expect(state.importNow()).resolves.toEqual(result)
+
+    // The stamped verdict is the only thing that tells a human the estate they are looking at is a
+    // PREFIX of the portal's.
+    expect(calls).toEqual(['sync', 'get', 'reload'])
+  })
+
+  it('propagates an import failure to its own caller', async () => {
+    const { state } = build({
+      syncServiceCatalog: async () => {
+        throw new Error('service catalog unauthorized')
+      },
+    })
+
+    await expect(state.importNow()).rejects.toThrow('service catalog unauthorized')
+  })
+
+  it('clears the connection on disconnect and reloads the catalog views it tombstoned', async () => {
+    const { state, calls } = build()
+    await state.connect(input)
+
+    await state.disconnect()
+
+    expect(state.serviceCatalog.value).toBeNull()
+    expect(calls).toEqual(['connect', 'disconnect', 'reload'])
+  })
+})

package/app/stores/serviceCatalogConnection.ts

@@ -0,0 +1,131 @@
+import { ref } from 'vue'
+import type {
+  ConnectServiceCatalogInput,
+  ServiceCatalogConnection,
+  ServiceCatalogSyncResult,
+} from '~/types/domain'
+
+/**
+ * The SERVICE CATALOG half of the foundational-services store: the workspace's connected developer
+ * portal, and the four actions over it.
+ *
+ * A separate factory rather than more of `foundationalServicesSetup`, which had reached its
+ * per-function line budget. The seam is the feature's own: this is one connection with one store
+ * behind it, where everything else in that setup is the catalog's tiers, its suppressions and its
+ * repo sources.
+ *
+ * It is WORKSPACE-only. The portal credential rides the workspace-keyed secret delegation, so the
+ * backend serves this connection at no other scope, and the account-tier store gets the same state
+ * declared and permanently unavailable rather than a shape that pretends otherwise.
+ */
+export interface ServiceCatalogStateDependencies {
+  /** The workspace-scoped API calls, narrowed to the five this half makes. */
+  api: {
+    getServiceCatalog: (workspaceId: string) => Promise<ServiceCatalogConnection | null>
+    connectServiceCatalog: (
+      workspaceId: string,
+      body: ConnectServiceCatalogInput,
+    ) => Promise<ServiceCatalogConnection>
+    // The contract's 204 sends no body, which the generated client surfaces as `null` rather than
+    // `void`; declaring the narrower shape here would refuse the real client.
+    disconnectServiceCatalog: (workspaceId: string) => Promise<unknown>
+    probeServiceCatalog: (
+      workspaceId: string,
+      body: ConnectServiceCatalogInput,
+    ) => Promise<{ ok: boolean; message?: string }>
+    syncServiceCatalog: (workspaceId: string) => Promise<ServiceCatalogSyncResult>
+  }
+  /** Throws unless this store is the workspace tier; the caller's own guard. */
+  requireWorkspaceId: () => string
+  /** False on the account tier, where there is no connection to read. */
+  isWorkspaceTier: boolean
+  /** Reload the catalog views a connect / disconnect / import changed. */
+  reloadCatalog: () => Promise<void>
+}
+
+export function createServiceCatalogState(deps: ServiceCatalogStateDependencies) {
+  const { api, requireWorkspaceId, isWorkspaceTier, reloadCatalog } = deps
+
+  /** The connection, or null when the workspace has none. */
+  const serviceCatalog = ref<ServiceCatalogConnection | null>(null)
+  /**
+   * false when the deployment configured no service-catalog encryption key: the catalog itself
+   * works (contracts can be uploaded), and only the portal-import surface 503s. The finer gate,
+   * exactly as `sourcesAvailable` is for the GitHub half.
+   */
+  const serviceCatalogAvailable = ref(true)
+
+  /**
+   * Read the connection as part of the store's probe.
+   *
+   * Its own `try` rather than part of the probe's: a 503 here hides only the import panel, and the
+   * catalog read that ran before it already succeeded, so folding the two would report a configured
+   * catalog as absent because its optional portal half is not wired.
+   */
+  async function load(workspaceId: string): Promise<void> {
+    if (!isWorkspaceTier) {
+      serviceCatalogAvailable.value = false
+      return
+    }
+    try {
+      serviceCatalog.value = await api.getServiceCatalog(workspaceId)
+      serviceCatalogAvailable.value = true
+    } catch {
+      serviceCatalog.value = null
+      serviceCatalogAvailable.value = false
+    }
+  }
+
+  /** Clear both views, for a probe whose whole catalog read failed. */
+  function reset(): void {
+    serviceCatalog.value = null
+    serviceCatalogAvailable.value = false
+  }
+
+  /**
+   * Store the connection. The first import is the CALLER's next step, not part of this promise.
+   *
+   * A connection that shows nothing reads as a broken one, so an import does follow immediately
+   * (the same reason a linked repo source syncs on link). What it must not do is settle this
+   * promise: by the time the import runs the connection is already stored, so folding an import
+   * failure in here would reject a call that succeeded, and the panel would show a "could not
+   * connect" toast beside the connection it just made, hiding the remedy the real failure names.
+   */
+  async function connect(input: ConnectServiceCatalogInput) {
+    serviceCatalog.value = await api.connectServiceCatalog(requireWorkspaceId(), input)
+    return serviceCatalog.value
+  }
+
+  async function disconnect(): Promise<void> {
+    await api.disconnectServiceCatalog(requireWorkspaceId())
+    serviceCatalog.value = null
+    // Disconnecting TOMBSTONES what the portal produced, so both catalog views are now wrong.
+    await reloadCatalog()
+  }
+
+  function probe(input: ConnectServiceCatalogInput) {
+    return api.probeServiceCatalog(requireWorkspaceId(), input)
+  }
+
+  /** Import now, then refresh both catalog views. */
+  async function importNow(): Promise<ServiceCatalogSyncResult> {
+    const id = requireWorkspaceId()
+    const result = await api.syncServiceCatalog(id)
+    // The connection is re-read too: the import stamps its verdict there, and that verdict is the
+    // only thing that tells a human the estate they are looking at is a PREFIX of the portal's.
+    const [connection] = await Promise.all([api.getServiceCatalog(id), reloadCatalog()])
+    serviceCatalog.value = connection
+    return result
+  }
+
+  return {
+    serviceCatalog,
+    serviceCatalogAvailable,
+    load,
+    reset,
+    connect,
+    disconnect,
+    probe,
+    importNow,
+  }
+}

package/app/types/foundationalServices.ts

@@ -31,3 +31,17 @@ export type {
   UpdateFoundationalServiceInput,
   UploadApiContract,
 } from '@cat-factory/contracts'
+
+// The SERVICE CATALOG connection: the developer portal (Backstage) whose services are imported
+// into the catalog above as `workspace`-tier rows. Beside the catalog types rather than in a file
+// of its own, because everything it produces IS that catalog.
+export type {
+  ConnectServiceCatalogInput,
+  ServiceCatalogAuth,
+  ServiceCatalogAuthMode,
+  ServiceCatalogConnection,
+  ServiceCatalogCoverage,
+  ServiceCatalogProvider,
+  ServiceCatalogSyncResult,
+  ServiceCatalogSyncStatus,
+} from '@cat-factory/contracts'

package/app/utils/runOutcome.ts

@@ -26,6 +26,7 @@ export type {
   OutcomeDisposition,
   OutcomeEnvironment,
   OutcomeEnvironments,
+  OutcomeEnvironmentDetailKind,
   OutcomeEnvironmentOrigin,
   OutcomeEnvironmentState,
   OutcomePullRequest,

package/app/utils/serviceCatalog.spec.ts

@@ -0,0 +1,51 @@
+import { describe, expect, it } from 'vitest'
+import { missingI18nKeys } from '../../test/i18nKeys'
+import {
+  SERVICE_CATALOG_AUTH_KEYS,
+  SERVICE_CATALOG_AUTH_ORDER,
+  SERVICE_CATALOG_STATUS_COLORS,
+  SERVICE_CATALOG_STATUS_KEYS,
+  serviceCatalogStatusKey,
+} from './serviceCatalog'
+
+describe('service-catalog i18n keys', () => {
+  // The gap `test/i18nKeys.ts` exists for: the exhaustive `Record` proves every union member has an
+  // entry, and nothing proves the entry still names a key that exists. Deleting one would otherwise
+  // read as a clean removal, with the badge rendering its own key path at runtime.
+  it('every auth-mode key resolves in the base catalog', () => {
+    expect(missingI18nKeys(Object.values(SERVICE_CATALOG_AUTH_KEYS))).toEqual([])
+  })
+
+  it('every status key resolves, the never-imported case included', () => {
+    expect(
+      missingI18nKeys([
+        ...Object.values(SERVICE_CATALOG_STATUS_KEYS),
+        serviceCatalogStatusKey(null),
+      ]),
+    ).toEqual([])
+  })
+})
+
+describe('serviceCatalogStatusKey', () => {
+  it('keeps "never imported" apart from a failure', () => {
+    // Collapsing them would tell an operator their portal is broken the moment they connect it.
+    expect(serviceCatalogStatusKey(null)).not.toBe(SERVICE_CATALOG_STATUS_KEYS.failed)
+  })
+})
+
+describe('SERVICE_CATALOG_AUTH_ORDER', () => {
+  it('offers exactly the modes the label map knows, once each', () => {
+    // A relation over the two, not a pinned count: a new auth mode adds a member to the union, and
+    // this fails until the form offers it and the label map names it.
+    expect([...SERVICE_CATALOG_AUTH_ORDER].sort()).toEqual(
+      Object.keys(SERVICE_CATALOG_AUTH_KEYS).sort(),
+    )
+  })
+})
+
+describe('SERVICE_CATALOG_STATUS_COLORS', () => {
+  it('renders a PARTIAL import as a warning rather than a success', () => {
+    expect(SERVICE_CATALOG_STATUS_COLORS.partial).toBe('warning')
+    expect(SERVICE_CATALOG_STATUS_COLORS.ok).toBe('success')
+  })
+})