@kortix/ui 0.14.8 → 0.14.9

package/dist/customize/connectors/detail/connector-status.d.ts

@@ -1,16 +1,29 @@
 import type { AdminConnector } from '@kortix/sdk';
 import { type ConnectorSetupStatus } from '../../sections/connector-connection-form.js';
-/** The four states a connector shows as a dot + word, on both detail pages. */
-export type ConnectorStatusTone = 'working' | 'pending' | 'error' | 'setup';
+/**
+ * The three states a connector shows, everywhere it shows one (the list card,
+ * the connector header, the app page): Connected, Needs account, Error. A
+ * sign-in still to finish and a missing credential are both "Needs account":
+ * adding or signing in an account is the fix in either case.
+ */
+export type ConnectorStatusTone = 'connected' | 'account' | 'error';
 export declare const STATUS_DOT: Record<ConnectorStatusTone, string>;
 /** The `connectorPages` key of each state's word. */
 export declare const STATUS_WORD: {
-    readonly working: "statusWorking";
-    readonly pending: "statusPending";
+    readonly connected: "statusConnected";
+    readonly account: "statusNeedsAccount";
     readonly error: "statusError";
-    readonly setup: "statusNeedsSetup";
 };
-export declare function connectorStatusTone(connector: Pick<AdminConnector, 'authorizationStrategy' | 'authSecret' | 'secretSet' | 'status'> & Partial<Pick<AdminConnector, 'provider' | 'lastError'>>): ConnectorStatusTone;
+/** The server's derived state (`state` on the connector). `disabled` reads as an error. */
+export type ConnectorDerivedState = 'needs_account' | 'connected' | 'error';
+export declare function connectorDerivedState(connector: object): ConnectorDerivedState | null;
+/**
+ * The server's `state` when it sends one. An older API: the same rule from the
+ * fields, where zero accounts (once loaded) is Needs account.
+ */
+export declare function connectorStatusTone(connector: Pick<AdminConnector, 'authorizationStrategy' | 'authSecret' | 'secretSet' | 'status'> & Partial<Pick<AdminConnector, 'provider' | 'lastError'>>, 
+/** The accounts the caller can see, once loaded. */
+accountCount?: number): ConnectorStatusTone;
 /**
  * Agents can use the connector now: it is signed in, it runs on per-person
  * accounts, or it needs no sign-in and has an account to run as.

package/dist/customize/connectors/detail/connector-status.js

@@ -1,23 +1,47 @@
 import { connectorSetupStatus, } from '../../sections/connector-connection-form.js';
 import { providerLabel } from '../provider-label.js';
 export const STATUS_DOT = {
-    working: 'bg-kortix-green',
-    pending: 'bg-kortix-blue',
+    connected: 'bg-kortix-green',
+    account: 'bg-kortix-orange',
     error: 'bg-kortix-red',
-    setup: 'bg-kortix-orange',
 };
 /** The `connectorPages` key of each state's word. */
 export const STATUS_WORD = {
-    working: 'statusWorking',
-    pending: 'statusPending',
+    connected: 'statusConnected',
+    account: 'statusNeedsAccount',
     error: 'statusError',
-    setup: 'statusNeedsSetup',
 };
-export function connectorStatusTone(connector) {
+export function connectorDerivedState(connector) {
+    const state = connector.state;
+    if (state === 'disabled')
+        return 'error';
+    return state === 'needs_account' || state === 'connected' || state === 'error' ? state : null;
+}
+/**
+ * The server's `state` when it sends one. An older API: the same rule from the
+ * fields, where zero accounts (once loaded) is Needs account.
+ */
+export function connectorStatusTone(connector, 
+/** The accounts the caller can see, once loaded. */
+accountCount) {
+    const state = connectorDerivedState(connector);
+    if (state === 'error')
+        return 'error';
+    if (state === 'needs_account')
+        return 'account';
+    // A channel or computer has no accounts to count. Anything else with zero
+    // loaded accounts has nothing to run as, whatever else it reports.
+    const counted = connector.provider !== 'channel' && connector.provider !== 'computer';
+    if (counted && accountCount === 0)
+        return 'account';
+    if (state === 'connected')
+        return 'connected';
     const status = connectorSetupStatus(connector);
-    if (status === 'pending')
-        return 'pending';
-    return status === 'error' ? 'error' : status === 'needs_setup' ? 'setup' : 'working';
+    if (status === 'error')
+        return 'error';
+    if (status === 'pending' || status === 'needs_setup')
+        return 'account';
+    return 'connected';
 }
 /**
  * Agents can use the connector now: it is signed in, it runs on per-person

package/dist/customize/connectors/detail/connector-tabs.d.ts

@@ -1,5 +1,5 @@
 import type { AdminConnector } from '@kortix/sdk';
-export type ConnectorTab = 'accounts' | 'tools' | 'triggers' | 'settings';
+export type ConnectorTab = 'accounts' | 'tools' | 'agents' | 'triggers' | 'settings';
 /**
  * Tab order never changes. A tab that does not apply is absent; the ones that
  * remain keep their positions, so the surface does not reshape per connector.
@@ -17,6 +17,9 @@ export declare const CONNECTOR_TAB_LABEL_KEY: Record<ConnectorTab, string>;
  * - Tools and Settings mutate project state, so they are writer-only. Accounts
  *   stays for readers: it is how they see whether the connector works, and how
  *   they connect their own account.
+ * - Agents lists which agents can use the connector and their rule set. It
+ *   shows for readers too (read-only), except on a channel or the computer:
+ *   those reach every agent and have no kortix.yaml entry to grant.
  * - Triggers lists the app event triggers on this connector. It shows only when
  *   the connector's app has events (`hasEvents`), and for readers too: it is a
  *   list, and its New button is gated on its own permission.

package/dist/customize/connectors/detail/connector-tabs.js

@@ -2,11 +2,12 @@
  * Tab order never changes. A tab that does not apply is absent; the ones that
  * remain keep their positions, so the surface does not reshape per connector.
  */
-export const CONNECTOR_TABS = ['accounts', 'tools', 'triggers', 'settings'];
+export const CONNECTOR_TABS = ['accounts', 'tools', 'agents', 'triggers', 'settings'];
 /** `hardcodedUi.i18nComplete` key of each tab's label. */
 export const CONNECTOR_TAB_LABEL_KEY = {
     accounts: 'text8a7c8b67fe8b',
-    tools: 'textea93d6a262ec',
+    tools: 'text9d2b6f0c41ae',
+    agents: 'text279b44d2ab4b',
     triggers: 'texte62f2148a64d',
     settings: 'text74a883a037bc',
 };
@@ -20,6 +21,9 @@ export const CONNECTOR_TAB_LABEL_KEY = {
  * - Tools and Settings mutate project state, so they are writer-only. Accounts
  *   stays for readers: it is how they see whether the connector works, and how
  *   they connect their own account.
+ * - Agents lists which agents can use the connector and their rule set. It
+ *   shows for readers too (read-only), except on a channel or the computer:
+ *   those reach every agent and have no kortix.yaml entry to grant.
  * - Triggers lists the app event triggers on this connector. It shows only when
  *   the connector's app has events (`hasEvents`), and for readers too: it is a
  *   list, and its New button is gated on its own permission.
@@ -31,6 +35,8 @@ export function connectorTabs(connector, caps) {
     present.add('accounts');
     if (caps.canWrite)
         present.add('tools');
+    if (connector.provider !== 'channel' && connector.provider !== 'computer')
+        present.add('agents');
     if (caps.hasEvents)
         present.add('triggers');
     if (caps.canWrite && connector.provider !== 'computer')

package/dist/customize/connectors/detail/connector-tools.d.ts

@@ -14,9 +14,9 @@ interface ConnectorToolsProps {
  * Three things make this readable to someone who is not going to study a
  * policy engine:
  *
- * 1. **Two groups, not three.** `groupToolsByRisk` folds `destructive` into
- *    writes. The only question a reader is equipped to answer before granting
- *    access is "can this look at my data, or change it".
+ * 1. **Read, write, unclassified.** `groupToolsByRisk` folds `destructive`
+ *    into writes, and a tool nobody classified gets its own group instead of
+ *    passing for a write.
  * 2. **Default is a state, not a value.** A tool the platform allows by
  *    default renders with NO segment lit and a `Hint` naming the default.
  *    Lighting Allow would claim a choice nobody made.

package/dist/customize/connectors/detail/connector-tools.js

@@ -1,12 +1,13 @@
 'use client';
 import { jsxs as _jsxs, jsx as _jsx } from "react/jsx-runtime";
 import { ConnectorAdvancedTools } from './connector-advanced-tools.js';
+import { ConnectorPolicySetBar } from './connector-policy-sets.js';
 import { useLocalizedUiCatalog } from '../../../i18n/ui-catalog/use-localized-ui-catalog.js';
 import { useTranslations } from '../../../i18n/index.js';
 import { getConnectorPolicies, setConnectorPolicies, setConnectorSensitive, } from '@kortix/sdk';
 import { CaretDownIcon, CaretRightIcon, LockIcon, MagnifyingGlassIcon, WrenchIcon, } from '@phosphor-icons/react';
 import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query';
-import { useMemo, useState } from 'react';
+import { useCallback, useMemo, useState } from 'react';
 import { Button } from '../../../primitives/button.js';
 import { ConfirmDialog } from '../../../primitives/confirm-dialog.js';
 import { CountBadge } from '../../../primitives/count-badge.js';
@@ -15,19 +16,24 @@ import { DropdownMenu, DropdownMenuContent, DropdownMenuItem, DropdownMenuTrigge
 import { InfoBanner } from '../../../primitives/info-banner.js';
 import { InputGroupSearch, InputGroupSearchClear, InputGroupSearchIcon, InputGroupSearchInput, } from '../../../primitives/input-group.js';
 import { Skeleton } from '../../../primitives/skeleton.js';
+import { cn } from '../../../internal/lib/utils.js';
 import { errorToast, successToast } from '../../../primitives/toast.js';
 import { EmptyState } from '../../../primitives/empty-state.js';
 import { ErrorState } from '../../../primitives/error-state.js';
+import Hint from '../../../primitives/hint.js';
+import { Switch } from '../../../primitives/switch.js';
 import { filterActions, groupToolsByRisk, toolRowText, } from '../tools/tool-groups.js';
-import { applyBulkPolicy, isLockedByProject, isPatternRule, orderPolicyRules, previewEffective, toolChoice, } from '../tools/tool-policy.js';
+import { applyBulkPolicy, connectorDefaultAction, inheritedAction, isAdvancedRule, isLockedByProject, orderPolicyRules, previewEffective, summarizeToolDecisions, toolChoice, } from '../tools/tool-policy.js';
+import { connectorPoliciesKey, supportsPolicySets } from '../tools/policy-sets.js';
 import { ToolPolicyControl } from '../tools/tool-policy-control.js';
 import { POLICY_CHOICE_LABEL, POLICY_SEGMENTS, } from '../tools/tool-policy-labels.js';
 import { CatalogNoMatch } from '../../shared/catalog/catalog-empty-state.js';
+import { UiLink as Link } from '../../../providers/ui-provider.js';
+import { rulesHref } from '../connector-routes.js';
 /** Below this many tools the search field is clutter; above it the list is
  *  unusable without one. */
 const SEARCH_THRESHOLD = 6;
 const POLICY_QUERY_STALE_MS = 5_000;
-const LOCKED_REASON = 'A project rule already decides this tool. Change it under Global rules on the Connectors page.';
 /**
  * Tools — what this connector is allowed to do, as a per-tool decision instead
  * of a dropdown and a save button.
@@ -35,9 +41,9 @@ const LOCKED_REASON = 'A project rule already decides this tool. Change it under
  * Three things make this readable to someone who is not going to study a
  * policy engine:
  *
- * 1. **Two groups, not three.** `groupToolsByRisk` folds `destructive` into
- *    writes. The only question a reader is equipped to answer before granting
- *    access is "can this look at my data, or change it".
+ * 1. **Read, write, unclassified.** `groupToolsByRisk` folds `destructive`
+ *    into writes, and a tool nobody classified gets its own group instead of
+ *    passing for a write.
  * 2. **Default is a state, not a value.** A tool the platform allows by
  *    default renders with NO segment lit and a `Hint` naming the default.
  *    Lighting Allow would claim a choice nobody made.
@@ -56,21 +62,37 @@ const LOCKED_REASON = 'A project rule already decides this tool. Change it under
  */
 export function ConnectorTools({ projectId, connector, displayName, canWrite, onChanged, }) {
     const t = useTranslations('connectorPages');
+    const tSets = useTranslations('connectorPolicySets');
     const tI18nComplete = useTranslations('hardcodedUi.i18nComplete');
     const policySegments = useLocalizedUiCatalog(POLICY_SEGMENTS);
     const queryClient = useQueryClient();
     const slug = connector.slug;
-    const queryKey = useMemo(() => ['connector-policies', projectId, slug], [projectId, slug]);
+    // Null edits the base rules; a name edits that policy set's rules. The
+    // query key carries it, so each list caches on its own.
+    const [policySet, setPolicySet] = useState(null);
+    const onPolicySet = useCallback((next) => setPolicySet(next), []);
+    const scope = policySet ? 'set' : 'base';
+    const showSets = supportsPolicySets(connector.provider);
+    const queryKey = useMemo(() => connectorPoliciesKey(projectId, slug, policySet), [projectId, slug, policySet]);
     // Reading policies is admin-gated on the server (`resolveAdmin`,
     // connectors/router.ts:1193), so a reader would get a 403 and a permanent
     // skeleton. `connectorTabs` already hides this tab from them; the guard
     // below keeps that true if it ever stops doing so.
     const policiesQuery = useQuery({
         queryKey,
-        queryFn: () => getConnectorPolicies(projectId, slug),
+        queryFn: () => getConnectorPolicies(projectId, slug, { policySet: policySet ?? undefined }),
         staleTime: POLICY_QUERY_STALE_MS,
         enabled: canWrite,
     });
+    // In a set, Inherit names what the base rules decide. Same key and fetch as
+    // the base view and the rule-set strip: one cached request.
+    const baseQuery = useQuery({
+        queryKey: connectorPoliciesKey(projectId, slug, null),
+        queryFn: () => getConnectorPolicies(projectId, slug, { policySet: undefined }),
+        staleTime: POLICY_QUERY_STALE_MS,
+        enabled: canWrite && scope === 'set',
+    });
+    const baseEffective = useMemo(() => baseQuery.data?.effective ?? [], [baseQuery.data]);
     const policies = useMemo(() => policiesQuery.data?.policies ?? [], [policiesQuery.data]);
     const effective = useMemo(() => policiesQuery.data?.effective ?? [], [policiesQuery.data]);
     const toolPaths = useMemo(() => new Set(connector.actions.map((action) => action.path)), [connector.actions]);
@@ -79,14 +101,30 @@ export function ConnectorTools({ projectId, connector, displayName, canWrite, on
     // connector no longer reports — belongs to the Advanced editor, where it
     // stays visible and editable instead of being silently dropped on the next
     // save.
-    const toolRules = useMemo(() => policies.filter((rule) => !isPatternRule(rule.match) && toolPaths.has(rule.match)), [policies, toolPaths]);
-    const advancedRules = useMemo(() => policies.filter((rule) => isPatternRule(rule.match) || !toolPaths.has(rule.match)), [policies, toolPaths]);
+    const toolRules = useMemo(() => policies.filter((rule) => !isAdvancedRule(rule) && toolPaths.has(rule.match)), [policies, toolPaths]);
+    const advancedRules = useMemo(() => policies.filter((rule) => isAdvancedRule(rule) || !toolPaths.has(rule.match)), [policies, toolPaths]);
+    const sensitive = connector.sensitive === true;
+    const defaultMode = policiesQuery.data?.default_mode;
+    const fallback = useCallback((action) => connectorDefaultAction(sensitive, defaultMode, action.risk), [sensitive, defaultMode]);
+    const summary = useMemo(() => summarizeToolDecisions(connector.actions, policies, effective, scope, fallback), [connector.actions, policies, effective, scope, fallback]);
+    // The first word of a name is the app: `LINEAR_ARCHIVE_ISSUE` reads
+    // "Archive issue" on the Linear page.
+    const appNames = useMemo(() => [slug, connector.name, displayName, slug.split('-')[0] ?? ''], [slug, connector.name, displayName]);
     const [query, setQuery] = useState('');
-    const matches = useMemo(() => filterActions(connector.actions, query), [connector.actions, query]);
-    const groups = useMemo(() => groupToolsByRisk(matches, tI18nComplete), [matches, tI18nComplete]);
+    const [onlyChanged, setOnlyChanged] = useState(false);
+    const matches = useMemo(() => {
+        const found = filterActions(connector.actions, query);
+        if (!onlyChanged)
+            return found;
+        return found.filter((action) => toolChoice(action.path, policies, effective, scope) !== 'default' &&
+            !isLockedByProject(action.path, effective));
+    }, [connector.actions, query, onlyChanged, policies, effective, scope]);
+    const groups = useMemo(() => groupToolsByRisk(matches, tI18nComplete, appNames), [matches, tI18nComplete, appNames]);
     const projectLockedCount = useMemo(() => effective.filter((entry) => entry.source === 'project').length, [effective]);
     const writePolicies = useMutation({
-        mutationFn: (write) => setConnectorPolicies(projectId, slug, orderPolicyRules(write.rules)),
+        mutationFn: (write) => setConnectorPolicies(projectId, slug, orderPolicyRules(write.rules), {
+            policySet: policySet ?? undefined,
+        }),
         onMutate: async (write) => {
             await queryClient.cancelQueries({ queryKey });
             const previous = queryClient.getQueryData(queryKey);
@@ -95,7 +133,7 @@ export function ConnectorTools({ projectId, connector, displayName, canWrite, on
                     ...old,
                     policies: orderPolicyRules(write.rules),
                     effective: write.paths && write.choice
-                        ? previewEffective(old.effective ?? [], write.paths, write.choice)
+                        ? previewEffective(old.effective ?? [], write.paths, write.choice, scope)
                         : old.effective,
                 }
                 : old);
@@ -145,33 +183,76 @@ export function ConnectorTools({ projectId, connector, displayName, canWrite, on
         return (_jsxs("p", { className: "text-muted-foreground text-sm text-pretty", children: [tI18nComplete.raw('textdb7d057a2f68'), " ", displayName, ' ', tI18nComplete.raw('text24984f203fd7')] }));
     }
     const hasTools = connector.actions.length > 0;
-    return (_jsxs("div", { className: "space-y-5", children: [hasTools ? (_jsxs("div", { className: "flex flex-wrap items-center justify-between gap-3", children: [_jsx("p", { className: "text-muted-foreground min-w-0 text-sm text-pretty", children: describeDefault(connector.sensitive === true, policiesQuery.data?.default_mode) }), connector.actions.length > SEARCH_THRESHOLD ? (_jsxs(InputGroupSearch, { className: "w-full sm:max-w-64", children: [_jsx(InputGroupSearchIcon, { children: _jsx(MagnifyingGlassIcon, {}) }), _jsx(InputGroupSearchInput, { placeholder: tI18nComplete.raw('textfbd165231fa1'), value: query, onChange: (event) => setQuery(event.target.value), variant: "popover", size: "sm" }), _jsx(InputGroupSearchClear, { onClick: () => setQuery('') })] })) : null] })) : null, projectLockedCount > 0 ? (_jsx(InfoBanner, { tone: "warning", icon: LockIcon, title: tI18nComplete('textd3d900c89bd0', {
+    const choiceLabel = (choice) => choice === 'default' && scope === 'set' ? tSets('inherit') : POLICY_CHOICE_LABEL[choice];
+    const decisionWord = (action) => action === 'block'
+        ? t('toolsDecisionBlocked')
+        : action === 'require_approval'
+            ? t('toolsDecisionAsks')
+            : t('toolsDecisionRuns');
+    const inheritLabel = (path, choice, action) => {
+        const resolved = decisionWord(inheritedAction(path, choice, effective, baseEffective, scope, fallback(action)));
+        return scope === 'set'
+            ? t('toolsInheritAs', { action: resolved })
+            : t('toolsDefaultAs', { action: resolved });
+    };
+    // What decides a tool left on Default/Inherit, named the way the page names
+    // it: the base rules, the sensitive flag, or the project's default mode.
+    const decidedBy = (path) => {
+        const entry = (scope === 'set' ? baseEffective : effective).find((e) => e.path === path);
+        if (scope === 'set' && entry?.source !== 'risk_default' && entry?.source !== 'allow_all') {
+            return t('toolsFromBase');
+        }
+        if (entry?.source === 'connector')
+            return t('toolsFromBase');
+        if (sensitive)
+            return t('toolsFromSensitive');
+        return t('toolsFromDefault');
+    };
+    const summaryParts = [
+        t('toolsSummaryTotal', { count: summary.total }),
+        summary.block > 0 ? t('toolsSummaryBlocked', { count: summary.block }) : null,
+        summary.ask > 0 ? t('toolsSummaryAsk', { count: summary.ask }) : null,
+        summary.run > 0 ? t('toolsSummaryRun', { count: summary.run }) : null,
+    ].filter(Boolean);
+    return (_jsxs("div", { className: "space-y-5", children: [showSets ? (_jsx(ConnectorPolicySetBar, { projectId: projectId, slug: slug, canWrite: canWrite, value: policySet, onChange: onPolicySet })) : null, hasTools && policiesQuery.data ? (_jsxs("div", { className: "flex flex-wrap items-center justify-between gap-3", children: [_jsx("p", { className: "text-muted-foreground min-w-0 text-sm tabular-nums", children: summaryParts.join(' · ') }), _jsxs("div", { className: "flex w-full flex-wrap items-center gap-3 sm:w-auto", children: [connector.actions.length > SEARCH_THRESHOLD ? (_jsxs(InputGroupSearch, { className: "w-full sm:w-56", children: [_jsx(InputGroupSearchIcon, { children: _jsx(MagnifyingGlassIcon, {}) }), _jsx(InputGroupSearchInput, { placeholder: tI18nComplete.raw('textfbd165231fa1'), value: query, onChange: (event) => setQuery(event.target.value), size: "sm" }), _jsx(InputGroupSearchClear, { onClick: () => setQuery('') })] })) : null, _jsx(Switch, { label: t('toolsOnlyChanged'), checked: onlyChanged, onCheckedChange: setOnlyChanged, className: "px-0 py-0" })] })] })) : null, projectLockedCount > 0 ? (_jsxs(InfoBanner, { tone: "warning", icon: LockIcon, title: tI18nComplete('textd3d900c89bd0', {
                     value0: projectLockedCount,
                     value1: projectLockedCount === 1
                         ? tI18nComplete.raw('text86ca67d2851a')
                         : tI18nComplete.raw('textd50ab26e1621'),
-                }), children: tI18nComplete.raw('textf7d6d7f585c5') })) : null, policiesQuery.isPending ? (_jsx("div", { className: "space-y-2", children: [0, 1, 2].map((row) => (_jsx(Skeleton, { className: "h-14 rounded-md" }, row))) })) : policiesQuery.isError ? (_jsx(ErrorState, { size: "sm", title: tI18nComplete.raw('textff6065190563'), description: policiesQuery.error instanceof Error
+                }), children: [t('toolsProjectLockedBody'), ' ', _jsx(Link, { href: rulesHref(projectId), className: "text-foreground underline underline-offset-4", children: t('toolsOpenRules') })] })) : null, policiesQuery.isPending ? (_jsx("div", { className: "space-y-2", children: [0, 1, 2].map((row) => (_jsx(Skeleton, { className: "h-14 rounded-md" }, row))) })) : policiesQuery.isError ? (_jsx(ErrorState, { size: "sm", title: tI18nComplete.raw('textff6065190563'), description: policiesQuery.error instanceof Error
                     ? policiesQuery.error.message
                     : tI18nComplete.raw('texta47c08d35337'), action: _jsx(Button, { variant: "outline", size: "sm", onClick: () => void policiesQuery.refetch(), children: tI18nComplete.raw('text942087cc2d41') }) })) : !hasTools ? (
             // The connector exists but has reported no tools — a failed or pending
             // sync. That is a different statement from "nothing matched your
             // search", and it must not render as a blank panel.
-            _jsx(EmptyState, { icon: WrenchIcon, size: "sm", title: tI18nComplete.raw('text99dd86336467'), description: t('toolsEmptyBody', { name: displayName }) })) : groups.length === 0 ? (
+            _jsx(EmptyState, { icon: WrenchIcon, size: "sm", title: tI18nComplete.raw('text99dd86336467'), description: t('toolsEmptyBody', { name: displayName }) })) : groups.length === 0 && onlyChanged && !query.trim() ? (_jsx("p", { className: "text-muted-foreground py-6 text-center text-sm text-pretty", children: scope === 'set' ? t('toolsNoneChangedSet') : t('toolsNoneChangedBase') })) : groups.length === 0 ? (
             // The same line the four catalogs render, from the same component.
             // What was searched is unambiguous here — the box above says "Search
             // 19 tools" — so a second wording for one outcome bought nothing.
-            _jsx(CatalogNoMatch, { query: query })) : (_jsx("div", { className: "space-y-2", children: groups.map((group) => (_jsxs(Disclosure, { variant: "outline", className: "overflow-hidden", defaultOpen: true, children: [_jsxs("div", { className: "flex items-center gap-2 pr-2", children: [_jsx(DisclosureTrigger, { variant: "outline", children: _jsxs(Button, { variant: "popover", className: "flex min-w-0 flex-1 items-center justify-start rounded-none", children: [_jsx(CaretRightIcon, { className: "text-muted-foreground size-3.5 shrink-0 transition-transform duration-(--duration-normal) ease-out group-data-[state=open]:rotate-90 motion-reduce:transition-none" }), _jsx("span", { className: "truncate text-sm font-medium", children: group.label }), _jsx(CountBadge, { count: group.actions.length })] }) }), _jsxs(DropdownMenu, { children: [_jsx(DropdownMenuTrigger, { asChild: true, children: _jsxs(Button, { size: "sm", variant: "ghost", className: "shrink-0", disabled: frozen || busy || bulkPathsFor(group).length === 0, children: [tI18nComplete.raw('textd9d0b4384a58'), _jsx(CaretDownIcon, { className: "size-3.5 shrink-0" })] }) }), _jsx(DropdownMenuContent, { align: "end", className: "min-w-32", children: policySegments.map((segment) => (_jsx(DropdownMenuItem, { onSelect: () => setBulk({ group, choice: segment.choice }), children: segment.label }, segment.choice))) })] })] }), _jsx(DisclosureContent, { variant: "outline", contentClassName: "border-border border-t", children: _jsx("ul", { className: "divide-border/60 divide-y px-4", children: group.actions.map((action) => {
+            _jsx(CatalogNoMatch, { query: query })) : (_jsx("div", { className: "space-y-2", children: groups.map((group) => (_jsxs(Disclosure, { variant: "outline", className: "overflow-hidden", defaultOpen: true, children: [_jsxs("div", { className: "flex items-center gap-2 pr-2", children: [_jsx(DisclosureTrigger, { variant: "outline", children: _jsxs(Button, { variant: "popover", className: "flex min-w-0 flex-1 items-center justify-start rounded-none", children: [_jsx(CaretRightIcon, { className: "text-muted-foreground size-3.5 shrink-0 transition-transform duration-(--duration-normal) ease-out group-data-[state=open]:rotate-90 motion-reduce:transition-none" }), _jsx("span", { className: "truncate text-sm font-medium", children: group.label }), _jsx(CountBadge, { count: group.actions.length })] }) }), _jsxs(DropdownMenu, { children: [_jsx(DropdownMenuTrigger, { asChild: true, children: _jsxs(Button, { size: "sm", variant: "ghost", className: "shrink-0", disabled: frozen || busy || bulkPathsFor(group).length === 0, children: [tI18nComplete.raw('textd9d0b4384a58'), _jsx(CaretDownIcon, { className: "size-3.5 shrink-0" })] }) }), _jsx(DropdownMenuContent, { align: "end", className: "min-w-32", children: policySegments.map((segment) => (_jsx(DropdownMenuItem, { onSelect: () => setBulk({ group, choice: segment.choice }), children: segment.choice === 'default' ? choiceLabel('default') : segment.label }, segment.choice))) })] })] }), _jsx(DisclosureContent, { variant: "outline", contentClassName: "border-border border-t", children: _jsx("ul", { className: "divide-border/60 divide-y px-4", children: group.actions.map((action) => {
                                     const locked = isLockedByProject(action.path, effective);
-                                    const row = toolRowText(action);
-                                    return (_jsxs("li", { className: "flex flex-wrap items-start gap-x-4 gap-y-2 py-3", children: [_jsxs("div", { className: "min-w-0 flex-1 basis-48 space-y-0.5", children: [_jsx("p", { className: "text-foreground text-sm font-medium wrap-break-word", children: row.title }), row.description ? (_jsx("p", { className: "text-muted-foreground line-clamp-2 text-xs text-pretty", children: row.description })) : null] }), _jsx(ToolPolicyControl, { label: tI18nComplete('textb34f1e3c1569', {
+                                    const row = toolRowText(action, appNames);
+                                    const choice = toolChoice(action.path, policies, effective, scope);
+                                    const changed = choice !== 'default' && !locked;
+                                    return (_jsxs("li", { className: "flex flex-wrap items-center gap-x-4 gap-y-2 py-2.5", children: [_jsxs("div", { className: "flex min-w-0 flex-1 basis-56 items-start gap-2", children: [_jsx("span", { className: "flex h-5 shrink-0 items-center", children: _jsx("span", { className: cn('size-1.5 rounded-full', changed && 'bg-foreground'), children: changed ? _jsx("span", { className: "sr-only", children: t('toolsChanged') }) : null }) }), _jsxs("div", { className: "min-w-0 flex-1", children: [_jsxs("div", { className: "flex flex-wrap items-baseline gap-x-2", children: [_jsx("p", { className: "text-foreground min-w-0 text-sm font-medium wrap-break-word", children: row.title }), row.path ? (_jsx("code", { className: "text-muted-foreground max-w-full truncate font-mono text-xs", children: row.path })) : null] }), choice === 'default' && !locked ? (_jsx("p", { className: "text-muted-foreground text-xs", children: decidedBy(action.path) })) : null, row.description ? (_jsx(Hint, { label: row.description, side: "bottom", children: _jsx("p", { className: "text-muted-foreground truncate text-xs", children: row.description }) })) : null] })] }), _jsx(ToolPolicyControl, { label: tI18nComplete('textb34f1e3c1569', {
                                                     value0: row.path ?? row.title,
-                                                }), value: toolChoice(action.path, policies, effective), onChange: (next) => setToolPolicy(action.path, next), disabled: frozen || busy, lockedReason: locked ? LOCKED_REASON : undefined, defaultHint: describeToolDefault(connector.sensitive === true, policiesQuery.data?.default_mode, action.risk) })] }, action.path));
-                                }) }) })] }, group.key))) })), _jsx(ConnectorAdvancedTools, { connector: connector, advancedRules: advancedRules, toolRules: toolRules, loaded: !!policiesQuery.data, frozen: frozen, busy: busy, saving: writePolicies.isPending, sensitivePending: sensitiveMutation.isPending, onSave: (rules) => writePolicies.mutate({ rules }), onSensitive: (next) => sensitiveMutation.mutate(next) }), _jsx(ConfirmDialog, { open: bulk !== null, onOpenChange: (open) => {
+                                                }), value: choice, onChange: (next) => setToolPolicy(action.path, next), disabled: frozen || busy, lockedReason: locked ? t('toolsLockedByProject') : undefined, defaultLabel: inheritLabel(action.path, choice, action) })] }, action.path));
+                                }) }) })] }, group.key))) })), _jsx(ConnectorAdvancedTools, { connector: connector, showSensitive: scope === 'base', advancedRules: advancedRules, toolRules: toolRules, loaded: !!policiesQuery.data, frozen: frozen, busy: busy, saving: writePolicies.isPending, sensitivePending: sensitiveMutation.isPending, onSave: (rules) => writePolicies.mutate({ rules }), onSensitive: (next) => sensitiveMutation.mutate(next) }, policySet ?? 'base'), _jsx(ConfirmDialog, { open: bulk !== null, onOpenChange: (open) => {
                     if (!open)
                         setBulk(null);
-                }, title: bulk ? bulkConfirmTitle(bulkPaths.length, bulk.choice) : '', description: bulk ? bulkConfirmDescription(bulk.group.label, bulk.choice) : '', confirmLabel: bulk
+                }, title: bulk
+                    ? bulk.choice === 'default' && scope === 'set'
+                        ? tSets('bulkInheritTitle', { count: bulkPaths.length })
+                        : bulkConfirmTitle(bulkPaths.length, bulk.choice)
+                    : '', description: bulk
+                    ? bulk.choice === 'default' && scope === 'set'
+                        ? tSets('bulkInheritBody', { group: bulk.group.label })
+                        : bulkConfirmDescription(bulk.group.label, bulk.choice)
+                    : '', confirmLabel: bulk
                     ? bulk.choice === 'default'
-                        ? tI18nComplete.raw('text1707565fd3f0')
+                        ? scope === 'set'
+                            ? tSets('inherit')
+                            : tI18nComplete.raw('text1707565fd3f0')
                         : tI18nComplete('text41ffc5e14073', { value0: POLICY_CHOICE_LABEL[bulk.choice] })
                     : 'Confirm', isPending: writePolicies.isPending, onConfirm: () => {
                     if (!bulk)
@@ -198,27 +279,3 @@ function bulkConfirmDescription(groupLabel, choice) {
         ? `Deletes the per-tool rule for every tool listed under ${groupLabel} right now, so each one follows the connector default again. ${tail}`
         : `Every tool listed under ${groupLabel} right now is set to ${POLICY_CHOICE_LABEL[choice]}. ${tail}`;
 }
-/**
- * What happens to a tool nobody has decided on — read off the server's own
- * answer, never guessed. `sensitive` beats `default_mode` at the gate
- * (`resolveEffectiveAction`, connectors/policy.ts:362), so it is stated first.
- */
-function describeDefault(sensitive, defaultMode) {
-    if (sensitive) {
-        return 'Every tool asks for approval before it runs, including reads. Set a tool below to change that.';
-    }
-    if (defaultMode === 'allow_all') {
-        return 'Every tool runs without asking unless you decide otherwise below.';
-    }
-    return 'Reads run without asking; writes and deletes ask first. Decide any tool below.';
-}
-/** The same answer for one row, so an unlit control still says what it does. */
-function describeToolDefault(sensitive, defaultMode, risk) {
-    if (sensitive)
-        return 'Following the connector default — asks before it runs.';
-    if (defaultMode === 'allow_all')
-        return 'Following the connector default — runs without asking.';
-    return risk === 'read'
-        ? 'Following the connector default — runs without asking.'
-        : 'Following the connector default — asks before it runs.';
-}

package/dist/customize/connectors/detail/email-inboxes.d.ts

@@ -0,0 +1,43 @@
+import { type EmailInbox } from '../../../internal/hooks/channels/use-email-inboxes.js';
+import type { EmailSenderPolicy } from '../../../internal/hooks/channels/use-channels-installations.js';
+/** The one connector profile every inbox is an account on. */
+export declare const EMAIL_CONNECTOR_SLUG = "kortix_email";
+/** "Kortix managed" or "Your Resend account": where an inbox lives. */
+export declare function EmailInboxHome({ inbox }: {
+    inbox: Pick<EmailInbox, 'managed'>;
+}): import("react").JSX.Element;
+/** The sender policy in the editor's shape, whatever casing the wire used. */
+export declare function inboxSenderPolicy(inbox: Pick<EmailInbox, 'sender_policy'> | null | undefined): EmailSenderPolicy;
+/**
+ * "Add inbox": the account's name and who can use it (`AddAccountFields`, the
+ * same fields every connector's Add account asks), then the inbox itself
+ * (`EmailConnectForm`). Picked people get the account shared with them after
+ * it exists, exactly like `useAddAccount`.
+ */
+export declare function AddEmailInboxDialog({ projectId, open, onOpenChange, existing, onAdded, }: {
+    projectId: string;
+    open: boolean;
+    onOpenChange: (open: boolean) => void;
+    /** The profile's accounts, for a free name and the "already used" check. */
+    existing: ReadonlyArray<{
+        label: string;
+        owner_type: string;
+    }>;
+    onAdded: (inbox: EmailInbox) => void;
+}): import("react").JSX.Element;
+/** "Who can email" for one inbox: anyone, or only the listed senders. */
+export declare function EmailSenderPolicyDialog({ projectId, inbox, open, onOpenChange, }: {
+    projectId: string;
+    inbox: EmailInbox | null;
+    open: boolean;
+    onOpenChange: (open: boolean) => void;
+}): import("react").JSX.Element;
+/**
+ * The Email hero (Channels tab, the Email page): the pitch until a first inbox
+ * exists, then how many inboxes there are, their addresses, and Manage (the
+ * connector page with the account list) or Add another inbox. Like ComputerHero.
+ */
+export declare function EmailHero({ projectId, canWrite }: {
+    projectId: string;
+    canWrite: boolean;
+}): import("react").JSX.Element;