@meetreeve/ui 0.8.1 → 0.10.0

package/dist/index.d.mts

@@ -599,9 +599,115 @@ declare function ContextSwitcher({ items, activeRefId, onSelect, footer, placeho
  * is the whole backend round-trip (list/connect/disconnect), injected as
  * `client` (Matt's decision, 2026-07-25): Reeve passes one built on its own
  * fetch client; a tenant clone passes ~10 lines of its own.
+ *
+ * Ownership & sharing (DEV-5654 / CD-5): a personal/org kind toggle at
+ * connect time, owner attribution on connected tiles, a shared-with-me
+ * section, and a manage-sharing panel over the CD-2 grants API. Everything
+ * is data-driven from the CD-4 ownership axes the entry carries; the
+ * package has no auth deps and must never hardcode a role check. The
+ * sharing surface only renders when the injected client provides the
+ * optional grant methods, so a pre-CD-5 client keeps working unchanged.
  */
 type ConnectableTransport = "composio" | "native";
 type ConnectableCapability = "read" | "write" | "readwrite";
+type ConnectionKind = "personal" | "org";
+type ConnectorGranteeType = "user" | "role";
+/** An RBAC role a grant can target, injected via the entry data (CD-2). */
+interface ConnectorRoleOption {
+    id: string;
+    name: string;
+}
+/**
+ * Whether this entry may be connected org-wide, and with which role options
+ * the sharing UI can grant. Always supplied by the server through the entry
+ * data (CD-4) — never inferred client-side from who the viewer is.
+ */
+interface OrgConnectPolicy {
+    permitted: boolean;
+    /** Human-readable reason shown on the disabled org option. */
+    reason?: string | null;
+    /** Role options offered by manage-sharing's "role" grantee type. */
+    role_options?: ConnectorRoleOption[];
+}
+/** One live grant on a connection, as the CD-2 grants API reports it. */
+interface ConnectorGrant {
+    id: string;
+    grantee_type: ConnectorGranteeType;
+    grantee_id: string;
+    /** Display name when the server resolves one; falls back to grantee_id. */
+    grantee_name?: string | null;
+}
+interface ConnectorGrantInput {
+    granteeType: ConnectorGranteeType;
+    granteeId: string;
+}
+/**
+ * One credential input on the paste path (DEV-7849 / G1). Data-driven per
+ * provider exactly like the legacy cockpit modal's `fieldDefs` prop, which
+ * this shape is lifted from (src/components/connectors/dual-auth-modal.tsx)
+ * — the package renders `label`/`placeholder` generically and never knows
+ * which provider it is rendering.
+ */
+interface ConnectorCredentialField {
+    key: string;
+    label: string;
+    placeholder?: string | null;
+    /** Input type; "password" masks the value. Defaults to "text". */
+    type?: "text" | "password" | "url";
+    /** Only an explicit `false` makes a field optional. */
+    required?: boolean;
+    /** Prefilled value the form starts from (e.g. PostHog's default host);
+     *  submitted as-is when the customer doesn't change it. */
+    defaultValue?: string | null;
+}
+/** One numbered step of a setup guide; `copyable` is a literal to paste. */
+interface ConnectorGuideStep {
+    text: string;
+    copyable?: string | null;
+}
+/**
+ * A fully-rendered setup guide as the server returns it (SG-1). The backend
+ * refuses to render a guide it cannot fully ground, so this is never a
+ * partially interpolated guide — see `hasUngroundedPlaceholder` for what
+ * happens if one ever arrives anyway.
+ */
+interface ConnectorSetupGuide {
+    prerequisites: string[];
+    steps: ConnectorGuideStep[];
+    verify: string;
+    scope_note: string;
+}
+/**
+ * The result of testing a credential WITHOUT storing it (DEV-7852 / G4).
+ *
+ * `valid` is deliberately tri-state and mirrors the server's own semantics
+ * (`TestCredentialsResponse`): true/false for a provider with a live
+ * verifier, null for one that has none. null is NOT a pass — the UI says so
+ * in words rather than showing a green check it cannot justify.
+ */
+interface ConnectorCredentialTestResult {
+    valid: boolean | null;
+    /** The account the verifier resolved, shown on success. */
+    account_name?: string | null;
+    /**
+     * Why the test failed. Already redacted server-side (the repo's
+     * no-raw-error-passthrough invariant) — the picker renders it verbatim and
+     * never composes its own message out of an upstream envelope.
+     */
+    error?: string | null;
+    /**
+     * Failure reasons keyed by credential field key. For a multi-field
+     * credential bundle a bare "invalid credentials" is close to useless, so
+     * anything that can be attributed to one field is rendered on that field.
+     */
+    field_errors?: Record<string, string> | null;
+    /**
+     * What the stored credential would actually be able to do, as read back
+     * from the verifier — e.g. "reporting only, this token cannot publish".
+     * Absent when the verifier reports no permission set.
+     */
+    permissions_note?: string | null;
+}
 interface ConnectableEntry {
     slug: string;
     name: string;
@@ -614,19 +720,80 @@ interface ConnectableEntry {
         status: "connected" | "not_connected";
         connected_account_id: string | null;
         since: string | null;
+        /**
+         * Ownership axes (DEV-5654 / CD-5, from the CD-4 list endpoint). All
+         * optional so a pre-CD-4 payload keeps rendering exactly as before:
+         * absent fields mean no owner attribution, no shared-with-me grouping,
+         * and no manage-sharing affordance.
+         */
+        kind?: ConnectionKind | null;
+        owner?: {
+            id: string;
+            name: string;
+        } | null;
+        /** Set when the viewer sees this connection through a grant. */
+        shared_by?: {
+            id: string;
+            name: string;
+        } | null;
+        /** true = the viewer owns this connection (enables manage-sharing). */
+        owned_by_viewer?: boolean;
     };
     /** true = tenant has a live connection but the entry left the allowlist. */
     deprecated: boolean;
+    /** Org-connect permission + role options for this entry (CD-4). */
+    org_connect?: OrgConnectPolicy | null;
+    /**
+     * Fully-rendered setup guide for this entry, or null/absent when the
+     * server has none for it (DEV-7849 / G1). Absent is the NORMAL state
+     * while the guide registry fills in (G2/G3), never an error.
+     */
+    guide?: ConnectorSetupGuide | null;
+    /**
+     * Credential fields for the bring-your-own-credential path (DEV-7849).
+     * Absent or empty = this entry has no paste path and only the OAuth
+     * connect button renders, exactly as before.
+     */
+    credential_fields?: ConnectorCredentialField[] | null;
 }
 interface ConnectorPickerClient {
     listConnectable(opts: {
         purpose?: string;
     }): Promise<ConnectableEntry[]>;
-    /** composio -> open the returned connect_url; native may resolve with none. */
-    connect(entry: ConnectableEntry): Promise<{
+    /**
+     * composio -> open the returned connect_url; native may resolve with none.
+     * `opts.kind` is additive (DEV-5654): a pre-CD-5 client declaring only
+     * `connect(entry)` still satisfies this signature and simply ignores it.
+     */
+    connect(entry: ConnectableEntry, opts?: {
+        kind: ConnectionKind;
+    }): Promise<{
         connect_url?: string;
     }>;
     disconnect(entry: ConnectableEntry): Promise<void>;
+    /**
+     * Sharing over the CD-2 grants API (DEV-5654) — all three optional. The
+     * manage-sharing UI renders only when every one of them is provided;
+     * otherwise the picker behaves exactly as it did before CD-5.
+     */
+    listGrants?(entry: ConnectableEntry): Promise<ConnectorGrant[]>;
+    grant?(entry: ConnectableEntry, input: ConnectorGrantInput): Promise<void>;
+    revokeGrant?(entry: ConnectableEntry, grantId: string): Promise<void>;
+    /**
+     * Store a pasted credential (DEV-7849 / G1). Optional, same posture as the
+     * grant methods: the credential form renders only when the injected client
+     * provides this, so a pre-G1 client keeps working unchanged. Rejecting
+     * with an Error surfaces that message on the form.
+     */
+    submitCredentials?(entry: ConnectableEntry, values: Record<string, string>, opts?: {
+        kind: ConnectionKind;
+    }): Promise<void>;
+    /**
+     * Validate a credential without storing it (DEV-7852 / G4). Optional for
+     * the same reason `submitCredentials` is: a client that cannot test simply
+     * gets the G1 form with no Test action and no test gate.
+     */
+    testCredentials?(entry: ConnectableEntry, values: Record<string, string>): Promise<ConnectorCredentialTestResult>;
 }
 /**
  * Structurally identical to the app's own `DnaLens` (src/lib/dna-lens.ts) —
@@ -651,4 +818,4 @@ interface ConnectorPickerProps {
 }
 declare function ConnectorPicker({ client, purpose, lens, layout, onConnected, }: ConnectorPickerProps): react.JSX.Element | null;
 
-export { type AppRungItem, AppSidebar, type AppSidebarBrand, type AppSidebarModuleDef, type AppSidebarProps, type AppSidebarTopItem, type Brand, BrandGlyph, type BrandGlyphProps, type ConnectableCapability, type ConnectableEntry, type ConnectableTransport, ConnectorPicker, type ConnectorPickerClient, type ConnectorPickerLens, type ConnectorPickerProps, type ContextOrgGroup, ContextSwitcher, type ContextSwitcherItem, type ContextSwitcherProps, type FallbackModuleDef, Flyout, type FlyoutChild, type FlyoutProps, GLYPH_CANVAS_FILL, type GroupRungItem, type HeaderNavItem, LOCKUP_GAP, LOCKUP_ROW, MARK_CAP_RATIO, MARK_WEIGHT, REEVE_ACCENT, ResponsiveHeader, type ResponsiveHeaderProps, type RungItem, type SidebarLadder, type SidebarLadderParsed, type SidebarRung, type UseLadderRungOptions, WORDMARK_WEIGHT, deriveFallbackLadder, faviconUrl, groupByOrg, reconcileLadder, resolveLadder, useLadderRung, useResponsivePlaceholder, zSidebarLadder };
+export { type AppRungItem, AppSidebar, type AppSidebarBrand, type AppSidebarModuleDef, type AppSidebarProps, type AppSidebarTopItem, type Brand, BrandGlyph, type BrandGlyphProps, type ConnectableCapability, type ConnectableEntry, type ConnectableTransport, type ConnectionKind, type ConnectorCredentialField, type ConnectorCredentialTestResult, type ConnectorGrant, type ConnectorGrantInput, type ConnectorGranteeType, type ConnectorGuideStep, ConnectorPicker, type ConnectorPickerClient, type ConnectorPickerLens, type ConnectorPickerProps, type ConnectorRoleOption, type ConnectorSetupGuide, type ContextOrgGroup, ContextSwitcher, type ContextSwitcherItem, type ContextSwitcherProps, type FallbackModuleDef, Flyout, type FlyoutChild, type FlyoutProps, GLYPH_CANVAS_FILL, type GroupRungItem, type HeaderNavItem, LOCKUP_GAP, LOCKUP_ROW, MARK_CAP_RATIO, MARK_WEIGHT, type OrgConnectPolicy, REEVE_ACCENT, ResponsiveHeader, type ResponsiveHeaderProps, type RungItem, type SidebarLadder, type SidebarLadderParsed, type SidebarRung, type UseLadderRungOptions, WORDMARK_WEIGHT, deriveFallbackLadder, faviconUrl, groupByOrg, reconcileLadder, resolveLadder, useLadderRung, useResponsivePlaceholder, zSidebarLadder };

package/dist/index.d.ts

@@ -599,9 +599,115 @@ declare function ContextSwitcher({ items, activeRefId, onSelect, footer, placeho
  * is the whole backend round-trip (list/connect/disconnect), injected as
  * `client` (Matt's decision, 2026-07-25): Reeve passes one built on its own
  * fetch client; a tenant clone passes ~10 lines of its own.
+ *
+ * Ownership & sharing (DEV-5654 / CD-5): a personal/org kind toggle at
+ * connect time, owner attribution on connected tiles, a shared-with-me
+ * section, and a manage-sharing panel over the CD-2 grants API. Everything
+ * is data-driven from the CD-4 ownership axes the entry carries; the
+ * package has no auth deps and must never hardcode a role check. The
+ * sharing surface only renders when the injected client provides the
+ * optional grant methods, so a pre-CD-5 client keeps working unchanged.
  */
 type ConnectableTransport = "composio" | "native";
 type ConnectableCapability = "read" | "write" | "readwrite";
+type ConnectionKind = "personal" | "org";
+type ConnectorGranteeType = "user" | "role";
+/** An RBAC role a grant can target, injected via the entry data (CD-2). */
+interface ConnectorRoleOption {
+    id: string;
+    name: string;
+}
+/**
+ * Whether this entry may be connected org-wide, and with which role options
+ * the sharing UI can grant. Always supplied by the server through the entry
+ * data (CD-4) — never inferred client-side from who the viewer is.
+ */
+interface OrgConnectPolicy {
+    permitted: boolean;
+    /** Human-readable reason shown on the disabled org option. */
+    reason?: string | null;
+    /** Role options offered by manage-sharing's "role" grantee type. */
+    role_options?: ConnectorRoleOption[];
+}
+/** One live grant on a connection, as the CD-2 grants API reports it. */
+interface ConnectorGrant {
+    id: string;
+    grantee_type: ConnectorGranteeType;
+    grantee_id: string;
+    /** Display name when the server resolves one; falls back to grantee_id. */
+    grantee_name?: string | null;
+}
+interface ConnectorGrantInput {
+    granteeType: ConnectorGranteeType;
+    granteeId: string;
+}
+/**
+ * One credential input on the paste path (DEV-7849 / G1). Data-driven per
+ * provider exactly like the legacy cockpit modal's `fieldDefs` prop, which
+ * this shape is lifted from (src/components/connectors/dual-auth-modal.tsx)
+ * — the package renders `label`/`placeholder` generically and never knows
+ * which provider it is rendering.
+ */
+interface ConnectorCredentialField {
+    key: string;
+    label: string;
+    placeholder?: string | null;
+    /** Input type; "password" masks the value. Defaults to "text". */
+    type?: "text" | "password" | "url";
+    /** Only an explicit `false` makes a field optional. */
+    required?: boolean;
+    /** Prefilled value the form starts from (e.g. PostHog's default host);
+     *  submitted as-is when the customer doesn't change it. */
+    defaultValue?: string | null;
+}
+/** One numbered step of a setup guide; `copyable` is a literal to paste. */
+interface ConnectorGuideStep {
+    text: string;
+    copyable?: string | null;
+}
+/**
+ * A fully-rendered setup guide as the server returns it (SG-1). The backend
+ * refuses to render a guide it cannot fully ground, so this is never a
+ * partially interpolated guide — see `hasUngroundedPlaceholder` for what
+ * happens if one ever arrives anyway.
+ */
+interface ConnectorSetupGuide {
+    prerequisites: string[];
+    steps: ConnectorGuideStep[];
+    verify: string;
+    scope_note: string;
+}
+/**
+ * The result of testing a credential WITHOUT storing it (DEV-7852 / G4).
+ *
+ * `valid` is deliberately tri-state and mirrors the server's own semantics
+ * (`TestCredentialsResponse`): true/false for a provider with a live
+ * verifier, null for one that has none. null is NOT a pass — the UI says so
+ * in words rather than showing a green check it cannot justify.
+ */
+interface ConnectorCredentialTestResult {
+    valid: boolean | null;
+    /** The account the verifier resolved, shown on success. */
+    account_name?: string | null;
+    /**
+     * Why the test failed. Already redacted server-side (the repo's
+     * no-raw-error-passthrough invariant) — the picker renders it verbatim and
+     * never composes its own message out of an upstream envelope.
+     */
+    error?: string | null;
+    /**
+     * Failure reasons keyed by credential field key. For a multi-field
+     * credential bundle a bare "invalid credentials" is close to useless, so
+     * anything that can be attributed to one field is rendered on that field.
+     */
+    field_errors?: Record<string, string> | null;
+    /**
+     * What the stored credential would actually be able to do, as read back
+     * from the verifier — e.g. "reporting only, this token cannot publish".
+     * Absent when the verifier reports no permission set.
+     */
+    permissions_note?: string | null;
+}
 interface ConnectableEntry {
     slug: string;
     name: string;
@@ -614,19 +720,80 @@ interface ConnectableEntry {
         status: "connected" | "not_connected";
         connected_account_id: string | null;
         since: string | null;
+        /**
+         * Ownership axes (DEV-5654 / CD-5, from the CD-4 list endpoint). All
+         * optional so a pre-CD-4 payload keeps rendering exactly as before:
+         * absent fields mean no owner attribution, no shared-with-me grouping,
+         * and no manage-sharing affordance.
+         */
+        kind?: ConnectionKind | null;
+        owner?: {
+            id: string;
+            name: string;
+        } | null;
+        /** Set when the viewer sees this connection through a grant. */
+        shared_by?: {
+            id: string;
+            name: string;
+        } | null;
+        /** true = the viewer owns this connection (enables manage-sharing). */
+        owned_by_viewer?: boolean;
     };
     /** true = tenant has a live connection but the entry left the allowlist. */
     deprecated: boolean;
+    /** Org-connect permission + role options for this entry (CD-4). */
+    org_connect?: OrgConnectPolicy | null;
+    /**
+     * Fully-rendered setup guide for this entry, or null/absent when the
+     * server has none for it (DEV-7849 / G1). Absent is the NORMAL state
+     * while the guide registry fills in (G2/G3), never an error.
+     */
+    guide?: ConnectorSetupGuide | null;
+    /**
+     * Credential fields for the bring-your-own-credential path (DEV-7849).
+     * Absent or empty = this entry has no paste path and only the OAuth
+     * connect button renders, exactly as before.
+     */
+    credential_fields?: ConnectorCredentialField[] | null;
 }
 interface ConnectorPickerClient {
     listConnectable(opts: {
         purpose?: string;
     }): Promise<ConnectableEntry[]>;
-    /** composio -> open the returned connect_url; native may resolve with none. */
-    connect(entry: ConnectableEntry): Promise<{
+    /**
+     * composio -> open the returned connect_url; native may resolve with none.
+     * `opts.kind` is additive (DEV-5654): a pre-CD-5 client declaring only
+     * `connect(entry)` still satisfies this signature and simply ignores it.
+     */
+    connect(entry: ConnectableEntry, opts?: {
+        kind: ConnectionKind;
+    }): Promise<{
         connect_url?: string;
     }>;
     disconnect(entry: ConnectableEntry): Promise<void>;
+    /**
+     * Sharing over the CD-2 grants API (DEV-5654) — all three optional. The
+     * manage-sharing UI renders only when every one of them is provided;
+     * otherwise the picker behaves exactly as it did before CD-5.
+     */
+    listGrants?(entry: ConnectableEntry): Promise<ConnectorGrant[]>;
+    grant?(entry: ConnectableEntry, input: ConnectorGrantInput): Promise<void>;
+    revokeGrant?(entry: ConnectableEntry, grantId: string): Promise<void>;
+    /**
+     * Store a pasted credential (DEV-7849 / G1). Optional, same posture as the
+     * grant methods: the credential form renders only when the injected client
+     * provides this, so a pre-G1 client keeps working unchanged. Rejecting
+     * with an Error surfaces that message on the form.
+     */
+    submitCredentials?(entry: ConnectableEntry, values: Record<string, string>, opts?: {
+        kind: ConnectionKind;
+    }): Promise<void>;
+    /**
+     * Validate a credential without storing it (DEV-7852 / G4). Optional for
+     * the same reason `submitCredentials` is: a client that cannot test simply
+     * gets the G1 form with no Test action and no test gate.
+     */
+    testCredentials?(entry: ConnectableEntry, values: Record<string, string>): Promise<ConnectorCredentialTestResult>;
 }
 /**
  * Structurally identical to the app's own `DnaLens` (src/lib/dna-lens.ts) —
@@ -651,4 +818,4 @@ interface ConnectorPickerProps {
 }
 declare function ConnectorPicker({ client, purpose, lens, layout, onConnected, }: ConnectorPickerProps): react.JSX.Element | null;
 
-export { type AppRungItem, AppSidebar, type AppSidebarBrand, type AppSidebarModuleDef, type AppSidebarProps, type AppSidebarTopItem, type Brand, BrandGlyph, type BrandGlyphProps, type ConnectableCapability, type ConnectableEntry, type ConnectableTransport, ConnectorPicker, type ConnectorPickerClient, type ConnectorPickerLens, type ConnectorPickerProps, type ContextOrgGroup, ContextSwitcher, type ContextSwitcherItem, type ContextSwitcherProps, type FallbackModuleDef, Flyout, type FlyoutChild, type FlyoutProps, GLYPH_CANVAS_FILL, type GroupRungItem, type HeaderNavItem, LOCKUP_GAP, LOCKUP_ROW, MARK_CAP_RATIO, MARK_WEIGHT, REEVE_ACCENT, ResponsiveHeader, type ResponsiveHeaderProps, type RungItem, type SidebarLadder, type SidebarLadderParsed, type SidebarRung, type UseLadderRungOptions, WORDMARK_WEIGHT, deriveFallbackLadder, faviconUrl, groupByOrg, reconcileLadder, resolveLadder, useLadderRung, useResponsivePlaceholder, zSidebarLadder };
+export { type AppRungItem, AppSidebar, type AppSidebarBrand, type AppSidebarModuleDef, type AppSidebarProps, type AppSidebarTopItem, type Brand, BrandGlyph, type BrandGlyphProps, type ConnectableCapability, type ConnectableEntry, type ConnectableTransport, type ConnectionKind, type ConnectorCredentialField, type ConnectorCredentialTestResult, type ConnectorGrant, type ConnectorGrantInput, type ConnectorGranteeType, type ConnectorGuideStep, ConnectorPicker, type ConnectorPickerClient, type ConnectorPickerLens, type ConnectorPickerProps, type ConnectorRoleOption, type ConnectorSetupGuide, type ContextOrgGroup, ContextSwitcher, type ContextSwitcherItem, type ContextSwitcherProps, type FallbackModuleDef, Flyout, type FlyoutChild, type FlyoutProps, GLYPH_CANVAS_FILL, type GroupRungItem, type HeaderNavItem, LOCKUP_GAP, LOCKUP_ROW, MARK_CAP_RATIO, MARK_WEIGHT, type OrgConnectPolicy, REEVE_ACCENT, ResponsiveHeader, type ResponsiveHeaderProps, type RungItem, type SidebarLadder, type SidebarLadderParsed, type SidebarRung, type UseLadderRungOptions, WORDMARK_WEIGHT, deriveFallbackLadder, faviconUrl, groupByOrg, reconcileLadder, resolveLadder, useLadderRung, useResponsivePlaceholder, zSidebarLadder };