@wildo-ai/presets-components 1.1.5 → 1.1.6

package/dist/esm/config/resources/security.resource-presets.js

@@ -1,27 +1,65 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-import { resourceUIBehavior, resourceUIBehaviorFrom, polymorphicResourceUIBehavior, polymorphicResourceUIBehaviorFrom, StandardIconReference, ResourceOperationActionScope, ActionVisibility, ResourceLayoutInlineEditDefault, CollectionDisplayMode, } from '@wildo-ai/saas-frontend-lib';
-import { DisplayField, DisplayLayout, FormField, FormLayout, ObjectScope, Section, SummaryLayout, useFormTemplateContext, useDisplayTemplateContext, ResourceLayoutPreset_Create_SamlWizard, ResourceLayoutPreset_Read_SsoSaml, SummaryFlow, SummaryMeta, SummaryTitle, } from '@wildo-ai/saas-frontend-lib';
-import { BadgeSemanticVariant, BooleanDisplayMode, BooleanEditMode, BooleanLabellingValue, SectionMode, DisplayChromeMode, EditChromeMode, EnumDisplayMode, ShowWhenOperator, StringDisplayMode, } from '@wildo-ai/zod-decorators';
-import { Key, ShieldCheck, Globe, Unlink, Fingerprint, UserCog, KeyRound, Radio, AlertTriangle, RotateCw, RefreshCw, PowerOff, Power, CalendarPlus, ChartColumn, Download, Trash2, PlugZap, Search, ShieldX, } from 'lucide-react';
-import { CoreResourceType as R, CoreResourceOperation as Op, ApiKeyStatus, OrgApiKeys_Operations, AuditLogs_Operations, SiemDeliveryDlq_Operations, SsoConnection_Operations, ScimTokens_Operations, orgApiKeysResourceConfiguration_InitializationFactory as orgApiKeysFactory, orgProviderCredentialsResourceConfiguration_InitializationFactory as orgProviderCredentialsFactory, OrganizationProviderCredentialSchema, userProviderCredentialsResourceConfiguration_InitializationFactory as userProviderCredentialsFactory, UserProviderCredentialSchema, ProviderCredentialValidationState, auditLogsResourceConfiguration_InitializationFactory as auditLogsFactory, applicationAuditLogsResourceConfiguration_InitializationFactory as applicationAuditLogsFactory, siemExportConfigPolymorphicFactories, siemDeliveryDlqPolymorphicFactories, ssoConfigPolymorphicFactories, SsoConfig_Operations, ssoConnectionPolymorphicFactories, scimProvisioningConfigPolymorphicFactories, scimTokensPolymorphicFactories, ApiKeyOrganizationSchema, AuditableEvent_BaseSchema, SiemExportConfigBaseSchema, SiemDeliveryDlqBaseSchema, SiemDeliveryDlqStatus, SsoConfigBaseSchema, SsoConnectionBaseSchema, ScimProvisioningConfigBaseSchema, ScimTokenBaseSchema, SsoProtocol, SIEMAuthMethod, } from '@wildo-ai/saas-models';
-import { addressable, notAddressable } from './resource.config.utils.js';
+/**
+ * Security & Compliance — Resource frontend presets
+ *
+ * Domain: ORG_API_KEYS, OAUTH_CLIENTS_ORGANIZATION, AUDIT_LOGS, SIEM (polymorphic),
+ * SSO_CONFIG (poly), SSO_CONNECTIONS (poly), SCIM_PROVISIONING (poly), SCIM_TOKENS (poly)
+ *
+ * SIEM layout JSX lives in this file next to `layout.refs` + `fields` so section chrome
+ * and primitive UI params stay co-located with the preset. Edit/display templates are
+ * inlined as arrow functions so `useFormTemplateContext` / `useDisplayTemplateContext`
+ * are immediately available for future conditional rendering. The scope-level CONFIGURATION records
+ * here — SIEM export, SSO config, SCIM provisioning — declare the full settings chrome
+ * (`display` + `summary` + `edit`), because each is reached as a READ inside the Settings Hub and is
+ * opened to confirm a value far more often than to change one; only sections that differ (e.g. the
+ * status toggle) set `chromeMode` explicitly. The COLLECTIONS beside them (SSO connections, the SIEM
+ * dead-letter queue, SCIM tokens) declare none on purpose: a list has no label/value rows for the
+ * treatment to apply to.
+ * Other resources here use field-level UI only until they need custom sections; enum badges use
+ * `showDescription: true` like billing.
+ */
+import React from 'react';
+import { resolveVocabularyWordKey } from '@wildo-ai/presets-components-models';
+import { resourceUIBehavior, resourceUIBehaviorFrom, polymorphicResourceUIBehavior, polymorphicResourceUIBehaviorFrom, StandardIconReference, ResourceOperationActionScope, ActionVisibility, ResourceLayoutInlineEditDefault, CollectionDisplayMode, useFlowsActorsSafe, unresolvedLabel, } from '@wildo-ai/saas-frontend-lib';
+import { DisplayField, DisplayLayout, FormField, FormLayout, ObjectScope, Section, SummaryLayout, useFormTemplateContext, useDisplayTemplateContext, ResourceLayoutPreset_Create_SamlWizard, ResourceLayoutPreset_Read_SsoSaml, SummaryFlow, SummaryMeta, SummaryTitle, ResourceHeaderTitle, } from '@wildo-ai/saas-frontend-lib';
+import { BadgeSemanticVariant, BooleanDisplayMode, BooleanEditMode, BooleanLabellingValue, SectionMode, DisplayChromeMode, EditChromeMode, EnumDisplayMode, ShowWhenOperator, StringDisplayMode, StringEditMode, } from '@wildo-ai/zod-decorators';
+import { Key, ShieldCheck, Globe, Unlink, Fingerprint, UserCog, KeyRound, Radio, AlertTriangle, RotateCw, RefreshCw, PowerOff, Power, CalendarPlus, ChartColumn, Download, Trash2, PlugZap, Search, ShieldX, Bot, } from 'lucide-react';
+import { CoreResourceType as R, CoreResourceOperation as Op, ApiKeyStatus, OrgApiKeys_Operations, AuditLogs_Operations, SiemDeliveryDlq_Operations, SsoConnection_Operations, ScimTokens_Operations, orgApiKeysResourceConfiguration_InitializationFactory as orgApiKeysFactory, orgOAuthClientsResourceConfiguration_InitializationFactory as orgOAuthClientsFactory, OAuthClientOrganizationSchema, OAuthClientStatus, OrgOAuthClients_Operations, orgProviderCredentialsResourceConfiguration_InitializationFactory as orgProviderCredentialsFactory, OrganizationProviderCredentialSchema, userProviderCredentialsResourceConfiguration_InitializationFactory as userProviderCredentialsFactory, UserProviderCredentialSchema, ProviderCredentialValidationState, auditLogsResourceConfiguration_InitializationFactory as auditLogsFactory, applicationAuditLogsResourceConfiguration_InitializationFactory as applicationAuditLogsFactory, siemExportConfigPolymorphicFactories, siemDeliveryDlqPolymorphicFactories, ssoConfigPolymorphicFactories, SsoConfig_Operations, ssoConnectionPolymorphicFactories, scimProvisioningConfigPolymorphicFactories, scimTokensPolymorphicFactories, ApiKeyOrganizationSchema, AuditableEvent_BaseSchema, AuditEventSeverity, SiemExportConfigBaseSchema, SiemDeliveryDlqBaseSchema, SiemDeliveryDlqStatus, SsoConfigBaseSchema, SsoConnectionBaseSchema, ScimProvisioningConfigBaseSchema, ScimTokenBaseSchema, SsoProtocol, SIEMAuthMethod, EngineOpenVocabulary, } from '@wildo-ai/saas-models';
+import { ApiKeyRotationWindowRows } from './api-key-rotation-window.js';
+import { addressable, notAddressable, ROW_VERB_ON_RESOURCE_WITHOUT_UPDATE } from './resource.config.utils.js';
+/*
+ * A registry — keys, connections, tokens — is comparable rows, so it renders as a TABLE with the headers written
+ * once, and cards stay one click away for a narrow screen. Named once because the admin lane restates each
+ * registry's LIST view and must not lose it.
+ */
+const REGISTRY_TABLE = {
+    displayMode: CollectionDisplayMode.TABLE,
+    userSwitchableDisplayMode: true,
+};
 // ── SIEM export config — field overrides (shared across polymorphic variants) ─
 const siemExportFieldOverrides = {
+    // Field descriptions are an EDIT aid — they say what to type. On the read pane, which an operator opens to
+    // confirm a value, they were a sentence under every row ("Controls whether event deliveries are sent." under
+    // "Enabled"), so `display` no longer asks for them; the form keeps them.
+    //
+    // On the card the value reads bare, and a bare checkmark says nothing about WHAT is true — so the summary
+    // renders the word ("Enabled" / "Disabled") instead of a label and a tick.
     enabled: (schema) => schema.shape.enabled.booleanUI({
         labellingValue: BooleanLabellingValue.ENABLED_DISABLED,
-        display: { displayMode: BooleanDisplayMode.CHECKMARK, showDescription: true },
+        display: { displayMode: BooleanDisplayMode.CHECKMARK },
+        summaryOverride: { displayMode: BooleanDisplayMode.RAW },
         edit: { editMode: BooleanEditMode.SWITCH, showDescription: true },
     }),
     webhookUrl: (schema) => schema.shape.webhookUrl.stringUI({
-        display: { displayMode: StringDisplayMode.COPY, showDescription: true },
+        display: { displayMode: StringDisplayMode.COPY },
         edit: { showDescription: true },
     }),
     authMethod: (schema) => schema.shape.authMethod.enumUI({
-        display: { displayMode: EnumDisplayMode.BADGE, showDescription: true },
+        display: { displayMode: EnumDisplayMode.BADGE },
         edit: { showDescription: true, tooltip: true },
     }),
     eventFormat: (schema) => schema.shape.eventFormat.enumUI({
-        display: { displayMode: EnumDisplayMode.BADGE, showDescription: true },
+        display: { displayMode: EnumDisplayMode.BADGE },
         edit: { showDescription: true },
     }),
     authCredential: (schema) => schema.shape.authCredential.showWhen({
@@ -31,26 +69,137 @@ const siemExportFieldOverrides = {
         conditions: { field: 'authMethod', value: SIEMAuthMethod.API_KEY_HEADER },
     }),
 };
+/*
+ * An API key is read to decide whether to rotate, extend or retire it. The header is its NAME and its STATUS
+ * badge, so neither is a row below it. `scope` is not rendered anywhere: the organization schema fixes it to one
+ * literal, so on this screen it can only ever say "organization" — it rendered as an empty "Scope: —" on every
+ * card. The first card has no heading (it would restate the header) and no read section carries a description.
+ *
+ * `access` is gone as a section: it held the roles and the description, and a heading over the one row that
+ * matters ("Access" above "Roles") was a heading per field. Both now sit in the first card, beside the prefix.
+ */
+function OrgApiKeyHeader() {
+    return (_jsxs("div", { className: "flex min-w-0 flex-wrap items-center gap-field", children: [_jsx(ResourceHeaderTitle, {}), _jsx(DisplayField, { name: "status", hideLabel: true, hideDescription: true, className: "w-auto" })] }));
+}
 function OrgApiKeyDisplayTemplate() {
-    return (_jsxs(DisplayLayout, { children: [_jsxs(Section, { name: "overview", appearance: SectionMode.CARD, children: [_jsx(DisplayField, { name: "name" }), _jsx(DisplayField, { name: "scope" }), _jsx(DisplayField, { name: "status" }), _jsx(DisplayField, { name: "keyPrefix" })] }), _jsxs(Section, { name: "access", children: [_jsx(DisplayField, { name: "roles" }), _jsx(DisplayField, { name: "description" })] }), _jsxs(Section, { name: "lifecycle", children: [_jsx(DisplayField, { name: "expiresAt" }), _jsx(DisplayField, { name: "lastUsedAt" }), _jsx(DisplayField, { name: "createdAt" })] })] }));
+    return (_jsxs(DisplayLayout, { children: [_jsxs(Section, { name: "overview", appearance: SectionMode.CARD, hideTitle: true, hideDescription: true, children: [_jsx(DisplayField, { name: "keyPrefix" }), _jsx(DisplayField, { name: "roles" }), _jsx(DisplayField, { name: "description" })] }), _jsxs(Section, { name: "lifecycle", hideDescription: true, children: [_jsx(DisplayField, { name: "expiresAt" }), _jsx(DisplayField, { name: "lastUsedAt" }), _jsx(DisplayField, { name: "createdAt" }), _jsx(ApiKeyRotationWindowRows, {})] })] }));
 }
+/*
+ * The CREATE form (this resource has no UPDATE: a key changes through its own verbs — rotate, deactivate,
+ * extend). One column, no headings: five fields do not need grouping, and a heading over two of them named
+ * the page. The name first and focused; the description is prose, so a textarea; status last, since a new key
+ * is active unless somebody deliberately says otherwise.
+ */
 function OrgApiKeyEditTemplate() {
-    return (_jsxs(FormLayout, { children: [_jsxs(Section, { name: "overview", appearance: SectionMode.CARD, children: [_jsx(FormField, { name: "name" }), _jsx(FormField, { name: "status" }), _jsx(FormField, { name: "expiresAt" })] }), _jsxs(Section, { name: "access", children: [_jsx(FormField, { name: "roles" }), _jsx(FormField, { name: "description" })] })] }));
+    return (_jsxs(FormLayout, { children: [_jsx(FormField, { name: "name", autoFocus: true }), _jsx(FormField, { name: "description" }), _jsx(FormField, { name: "roles" }), _jsx(FormField, { name: "expiresAt" }), _jsx(FormField, { name: "status" })] }));
+}
+/*
+ * The autonomous agents a client may run as are the ones the APPLICATION declares (#1611), and the backend refuses
+ * any other ref — so the binding field offers exactly those, read from `/flows-actors/frontend-info`, instead of a
+ * free-text list an administrator fills from memory (#1812). Until the declaration arrives, or where the flows-actors
+ * plane is absent, the choice is empty rather than free text: there is nothing it would be honest to accept.
+ *
+ * Values are the refs themselves. They are identifiers the application names, not a closed engine vocabulary with
+ * words in the label tree, so a ref is what an administrator sees — and what every audit row records.
+ */
+function DeclaredAutonomousAgentsFormField() {
+    const flowsActors = useFlowsActorsSafe();
+    // Asked for explicitly: the provider bootstraps the declaration only when the application configures a chat view,
+    // and an application with none (the scaffold, Wonder CRM) would otherwise offer an empty choice (#1812 review).
+    const requestAutonomousAgents = flowsActors?.requestAutonomousAgents;
+    React.useEffect(() => {
+        requestAutonomousAgents?.();
+    }, [requestAutonomousAgents]);
+    const declaredAutonomousAgentRefs = (flowsActors?.autonomousAgents ?? []).map((agent) => agent.ref);
+    return _jsx(FormField, { name: "autonomousAgentRefs", allowedValues: declaredAutonomousAgentRefs });
+}
+/*
+ * ONE flat form for every operation of an organization OAuth client, like an API key's. A field the operation does
+ * not accept hides itself, so CREATE shows the registration fields and `setAutonomousAgents` shows only the agent
+ * list (`autonomousAgentRefs` is excluded from CREATE: a client is registered first, then bound). Sections were
+ * rejected here: a section renders its heading whether or not anything under it survives, so the binding form would
+ * have carried "Access" and "Redirects" headings over nothing.
+ */
+function OrgOAuthClientEditTemplate() {
+    return (_jsxs(FormLayout, { children: [_jsx(FormField, { name: "name", autoFocus: true }), _jsx(FormField, { name: "description" }), _jsx(FormField, { name: "expiresAt" }), _jsx(FormField, { name: "allowedGrants" }), _jsx(FormField, { name: "allowedScopes" }), _jsx(FormField, { name: "roles" }), _jsx(FormField, { name: "tokenEndpointAuthMethod" }), _jsx(FormField, { name: "requiresConsent" }), _jsx(FormField, { name: "redirectUris" }), _jsx(FormField, { name: "postLogoutRedirectUris" }), _jsx(DeclaredAutonomousAgentsFormField, {})] }));
 }
+/*
+ * A card: the name, then the status as a badge and the key's visible prefix. The prefix keeps its label — a
+ * bare "wkprobeB" beside a badge reads as a second name, not as the first characters of the secret.
+ */
 function OrgApiKeySummaryTemplate() {
-    return (_jsxs(SummaryLayout, { children: [_jsx(SummaryTitle, { name: "name" }), _jsxs(SummaryMeta, { children: [_jsx(DisplayField, { name: "scope" }), _jsx(DisplayField, { name: "status" }), _jsx(DisplayField, { name: "keyPrefix" })] })] }));
+    return (_jsxs(SummaryLayout, { children: [_jsx(SummaryTitle, { name: "name" }), _jsxs(SummaryMeta, { children: [_jsx(DisplayField, { name: "status" }), _jsx(DisplayField, { name: "keyPrefix" })] })] }));
 }
+/*
+ * An audit event, read once for what happened and once for who did it. The header is its NAME — the event type
+ * and the instant, in the viewer's date-time format — so neither is a row below it, and the overview card has no
+ * heading of its own (it would restate the header). No read section carries a description: "Review all
+ * application activity" and "See who performed each action" were prompts, on a page that already shows it.
+ * Every actor row hides when empty — most events have one actor, and a column of dashes said nothing.
+ */
 function AuditLogDisplayTemplate() {
-    return (_jsxs(DisplayLayout, { children: [_jsxs(Section, { name: "overview", appearance: SectionMode.CARD, children: [_jsx(DisplayField, { name: "eventType" }), _jsx(DisplayField, { name: "eventCategory" }), _jsx(DisplayField, { name: "severity" }), _jsx(DisplayField, { name: "riskLevel" })] }), _jsxs(Section, { name: "actors", children: [_jsx(DisplayField, { name: "userId" }), _jsx(DisplayField, { name: "organizationId" })] }), _jsxs(Section, { name: "payload", children: [_jsx(DisplayField, { name: "eventData" }), _jsx(DisplayField, { name: "createdAt" })] })] }));
+    return (_jsxs(DisplayLayout, { children: [_jsxs(Section, { name: "overview", appearance: SectionMode.CARD, hideTitle: true, hideDescription: true, children: [_jsx(DisplayField, { name: "eventCategory" }), _jsx(DisplayField, { name: "severity" }), _jsx(DisplayField, { name: "riskLevel" })] }), _jsxs(Section, { name: "actors", appearance: SectionMode.CARD, hideDescription: true, children: [_jsx(DisplayField, { name: "actorKind" }), _jsx(DisplayField, { name: "userId" }), _jsx(DisplayField, { name: "agentActor" }), _jsx(DisplayField, { name: "delegatingClientId" }), _jsx(DisplayField, { name: "principalCredentialId" }), _jsx(DisplayField, { name: "actingViaServiceProviderRelationshipId" }), _jsx(DisplayField, { name: "providerOrganizationId" }), _jsx(DisplayField, { name: "organizationId" })] }), _jsx(Section, { name: "payload", appearance: SectionMode.CARD, chromeMode: DisplayChromeMode.HIDDEN, hideDescription: true, children: _jsx(DisplayField, { name: "eventData" }) })] }));
 }
+/*
+ * A card in a list grouped by DAY: the event type, then its severity as a badge and who acted, bare. The date is
+ * the group heading above it, so the card does not repeat it; the exact instant is the read page's name.
+ */
 function AuditLogSummaryTemplate() {
-    return (_jsxs(SummaryLayout, { children: [_jsx(SummaryTitle, { name: "eventType" }), _jsxs(SummaryMeta, { children: [_jsx(DisplayField, { name: "eventCategory" }), _jsx(DisplayField, { name: "severity" }), _jsx(DisplayField, { name: "createdAt" })] })] }));
+    return (_jsxs(SummaryLayout, { children: [_jsx(SummaryTitle, { name: "eventType" }), _jsxs(SummaryMeta, { children: [_jsx(DisplayField, { name: "severity" }), _jsx(DisplayField, { name: "eventCategory" }), _jsx(DisplayField, { name: "actorKind" })] })] }));
+}
+/**
+ * An audit event's name, shared by both audit doors: the WORD for its type (`system_enums.CoreAuditableEventType.<type>`,
+ * #1791) and the instant it happened, in the viewer's date-time format — many events share a day, so the time is part
+ * of the name. `eventType` used to be printed raw (`user_login`); an event type with no word still shows its value,
+ * which is a missing label looking missing. `eventType` is required on every event.
+ */
+function auditEventName({ currentObject, t, formatDateTime }) {
+    const wordKey = resolveVocabularyWordKey(EngineOpenVocabulary.CORE_AUDITABLE_EVENT_TYPE, currentObject.eventType);
+    const word = t(wordKey);
+    const type = word === wordKey ? unresolvedLabel(currentObject.eventType) : word;
+    return currentObject.createdAt ? `${type} — ${formatDateTime(currentObject.createdAt)}` : type;
+}
+/**
+ * Chrome and field decorators shared by both audit doors (tenant and application-wide): one object, one reading.
+ * Settings rows on the read page, bare values on a card, empty actor rows hidden, severity as a coloured badge.
+ */
+function auditLogPresentation(schemaShape) {
+    const hideWhenEmpty = { display: { hideWhenEmpty: true } };
+    return {
+        defaultChromeMode: { display: DisplayChromeMode.SETTINGS_ROW, summary: DisplayChromeMode.HIDDEN, edit: EditChromeMode.SETTINGS_ROW },
+        fields: {
+            severity: schemaShape.severity.enumUI({
+                display: { displayMode: EnumDisplayMode.BADGE },
+                values: {
+                    [AuditEventSeverity.INFO]: { color: BadgeSemanticVariant.SECONDARY },
+                    [AuditEventSeverity.WARNING]: { color: BadgeSemanticVariant.WARNING },
+                    [AuditEventSeverity.CRITICAL]: { color: BadgeSemanticVariant.DESTRUCTIVE },
+                },
+            }),
+            userId: schemaShape.userId.stringUI(hideWhenEmpty),
+            agentActor: schemaShape.agentActor.objectUI(hideWhenEmpty),
+            delegatingClientId: schemaShape.delegatingClientId.stringUI(hideWhenEmpty),
+            principalCredentialId: schemaShape.principalCredentialId.stringUI(hideWhenEmpty),
+            actingViaServiceProviderRelationshipId: schemaShape.actingViaServiceProviderRelationshipId.stringUI(hideWhenEmpty),
+            providerOrganizationId: schemaShape.providerOrganizationId.stringUI(hideWhenEmpty),
+            organizationId: schemaShape.organizationId.stringUI(hideWhenEmpty),
+        },
+    };
 }
 function SiemExportSummaryTemplate() {
     return (_jsx(SummaryLayout, { flow: SummaryFlow.ROW, children: _jsx(DisplayField, { name: "enabled" }) }));
 }
+/*
+ * A failed delivery is named by its failure reason and carries its status badge beside it, so the old
+ * `overview` card — which held exactly those two — is gone rather than repeating the header. What is left is
+ * the attempt record and the payload. The payload card's heading names the data, so the data itself carries no
+ * label (the audit trail's `payload` card, for the same reason).
+ */
+function SiemDlqHeader() {
+    return (_jsxs("div", { className: "flex min-w-0 flex-wrap items-center gap-field", children: [_jsx(ResourceHeaderTitle, {}), _jsx(DisplayField, { name: "status", hideLabel: true, hideDescription: true, className: "w-auto" })] }));
+}
 function SiemDlqDisplayTemplate() {
-    return (_jsxs(DisplayLayout, { children: [_jsxs(Section, { name: "overview", appearance: SectionMode.CARD, children: [_jsx(DisplayField, { name: "status" }), _jsx(DisplayField, { name: "failureReason" })] }), _jsxs(Section, { name: "delivery", children: [_jsx(DisplayField, { name: "eventId" }), _jsx(DisplayField, { name: "failureCount" }), _jsx(DisplayField, { name: "lastAttemptAt" }), _jsx(DisplayField, { name: "nextRetryAt" })] }), _jsx(Section, { name: "payload", children: _jsx(DisplayField, { name: "eventPayload" }) })] }));
+    return (_jsxs(DisplayLayout, { children: [_jsxs(Section, { name: "delivery", appearance: SectionMode.CARD, hideDescription: true, children: [_jsx(DisplayField, { name: "eventId" }), _jsx(DisplayField, { name: "failureCount" }), _jsx(DisplayField, { name: "lastAttemptAt" }), _jsx(DisplayField, { name: "nextRetryAt" })] }), _jsx(Section, { name: "payload", appearance: SectionMode.CARD, chromeMode: DisplayChromeMode.HIDDEN, hideDescription: true, children: _jsx(DisplayField, { name: "eventPayload" }) })] }));
 }
 function SiemDlqSummaryTemplate() {
     return (_jsxs(SummaryLayout, { children: [_jsx(SummaryTitle, { name: "failureReason" }), _jsx(SummaryMeta, { children: _jsx(DisplayField, { name: "status" }) })] }));
@@ -61,41 +210,200 @@ function SsoConfigDisplayTemplate() {
 function SsoConfigSummaryTemplate() {
     return (_jsx(SummaryLayout, { flow: SummaryFlow.ROW, children: _jsx(ObjectScope, { name: "enforcement", children: _jsx(DisplayField, { name: "requireSSO" }) }) }));
 }
+/*
+ * A connection is named by its display name and carries its protocol badge beside it, so neither is a row; the
+ * first card, which held both, keeps only what the header does not say and loses its heading. Only the section
+ * of the connection's OWN protocol renders: an OIDC connection showed a whole SAML section of empty rows (and
+ * the reverse), which read as unfinished configuration rather than as not applicable. No read section carries a
+ * description.
+ */
+function SsoConnectionHeader() {
+    return (_jsxs("div", { className: "flex min-w-0 flex-wrap items-center gap-field", children: [_jsx(ResourceHeaderTitle, {}), _jsx(DisplayField, { name: "protocol", hideLabel: true, hideDescription: true, className: "w-auto" })] }));
+}
 function SsoConnectionDisplayTemplate() {
-    return (_jsxs(DisplayLayout, { children: [_jsxs(Section, { name: "overview", appearance: SectionMode.CARD, children: [_jsx(DisplayField, { name: "displayName" }), _jsx(DisplayField, { name: "protocol" }), _jsx(DisplayField, { name: "enabled" }), _jsx(DisplayField, { name: "isDefault" }), _jsx(DisplayField, { name: "externalProviderId" })] }), _jsx(Section, { name: "oidc", children: _jsxs(ObjectScope, { name: "oidc", children: [_jsx(DisplayField, { name: "templateMode" }), _jsx(DisplayField, { name: "discoveryUrl" }), _jsx(DisplayField, { name: "issuer" }), _jsx(DisplayField, { name: "authorizationEndpoint" }), _jsx(DisplayField, { name: "tokenEndpoint" }), _jsx(DisplayField, { name: "userInfoEndpoint" }), _jsx(DisplayField, { name: "jwksUri" }), _jsx(DisplayField, { name: "endSessionEndpoint" }), _jsx(DisplayField, { name: "clientId" }), _jsx(DisplayField, { name: "scopes" }), _jsx(DisplayField, { name: "responseType" }), _jsx(DisplayField, { name: "responseMode" }), _jsx(DisplayField, { name: "pkceEnabled" }), _jsx(DisplayField, { name: "pkceMethod" }), _jsx(DisplayField, { name: "prompt" }), _jsx(DisplayField, { name: "acrValues" }), _jsx(DisplayField, { name: "maxAge" }), _jsx(DisplayField, { name: "claimsMapping" }), _jsx(DisplayField, { name: "auditSettings" })] }) }), _jsx(Section, { name: "saml", children: _jsxs(ObjectScope, { name: "saml", children: [_jsx(DisplayField, { name: "entityId" }), _jsx(DisplayField, { name: "ssoUrl" }), _jsx(DisplayField, { name: "sloUrl" }), _jsx(DisplayField, { name: "x509CertificatePem" }), _jsx(DisplayField, { name: "attributeMapping" }), _jsx(DisplayField, { name: "signRequests" }), _jsx(DisplayField, { name: "wantAssertionsSigned" }), _jsx(DisplayField, { name: "allowedClockDrift" }), _jsx(DisplayField, { name: "forceAuthn" }), _jsx(DisplayField, { name: "maxAuthAge" }), _jsx(DisplayField, { name: "nameIdFormat" }), _jsx(DisplayField, { name: "allowIdpInitiated" }), _jsx(DisplayField, { name: "auditSettings" })] }) }), _jsxs(Section, { name: "provisioning", children: [_jsx(DisplayField, { name: "autoCreateUsers" }), _jsx(DisplayField, { name: "autoVerifyEmail" }), _jsx(DisplayField, { name: "defaultRole" }), _jsx(DisplayField, { name: "allowedDomains" }), _jsx(DisplayField, { name: "roleMapping" }), _jsx(DisplayField, { name: "groupMapping" })] })] }));
+    const { data } = useDisplayTemplateContext();
+    const protocol = data?.protocol;
+    return (_jsxs(DisplayLayout, { children: [_jsxs(Section, { name: "overview", appearance: SectionMode.CARD, hideTitle: true, hideDescription: true, children: [_jsx(DisplayField, { name: "enabled" }), _jsx(DisplayField, { name: "isDefault" }), _jsx(DisplayField, { name: "externalProviderId" })] }), protocol !== SsoProtocol.SAML && (_jsx(Section, { name: "oidc", hideDescription: true, children: _jsxs(ObjectScope, { name: "oidc", children: [_jsx(DisplayField, { name: "templateMode" }), _jsx(DisplayField, { name: "discoveryUrl" }), _jsx(DisplayField, { name: "issuer" }), _jsx(DisplayField, { name: "authorizationEndpoint" }), _jsx(DisplayField, { name: "tokenEndpoint" }), _jsx(DisplayField, { name: "userInfoEndpoint" }), _jsx(DisplayField, { name: "jwksUri" }), _jsx(DisplayField, { name: "endSessionEndpoint" }), _jsx(DisplayField, { name: "clientId" }), _jsx(DisplayField, { name: "scopes" }), _jsx(DisplayField, { name: "responseType" }), _jsx(DisplayField, { name: "responseMode" }), _jsx(DisplayField, { name: "pkceEnabled" }), _jsx(DisplayField, { name: "pkceMethod" }), _jsx(DisplayField, { name: "prompt" }), _jsx(DisplayField, { name: "acrValues" }), _jsx(DisplayField, { name: "maxAge" }), _jsx(DisplayField, { name: "claimsMapping" })] }) })), protocol !== SsoProtocol.OIDC && (_jsx(Section, { name: "saml", hideDescription: true, children: _jsxs(ObjectScope, { name: "saml", children: [_jsx(DisplayField, { name: "entityId" }), _jsx(DisplayField, { name: "ssoUrl" }), _jsx(DisplayField, { name: "sloUrl" }), _jsx(DisplayField, { name: "x509CertificatePem" }), _jsx(DisplayField, { name: "attributeMapping" }), _jsx(DisplayField, { name: "signRequests" }), _jsx(DisplayField, { name: "wantAssertionsSigned" }), _jsx(DisplayField, { name: "allowedClockDrift" }), _jsx(DisplayField, { name: "forceAuthn" }), _jsx(DisplayField, { name: "maxAuthAge" }), _jsx(DisplayField, { name: "nameIdFormat" }), _jsx(DisplayField, { name: "allowIdpInitiated" })] }) })), _jsxs(Section, { name: "provisioning", hideDescription: true, children: [_jsx(DisplayField, { name: "autoCreateUsers" }), _jsx(DisplayField, { name: "defaultRole" }), _jsx(DisplayField, { name: "allowedDomains" }), _jsx(DisplayField, { name: "roleMapping" }), _jsx(DisplayField, { name: "groupMapping" })] })] }));
 }
+/* A card: the name, then the protocol badge and whether the connection is on — the latter as the word, see `enabled`. */
 function SsoConnectionSummaryTemplate() {
     return (_jsxs(SummaryLayout, { children: [_jsx(SummaryTitle, { name: "displayName" }), _jsxs(SummaryMeta, { children: [_jsx(DisplayField, { name: "protocol" }), _jsx(DisplayField, { name: "enabled" })] })] }));
 }
+/*
+ * The pane's header already names it ("SCIM provisioning"), so its groups carry no headings: the first card's
+ * was "Overview" — a name for the page, not for a part of it — the second's put "Attribute mapping" over a single
+ * row labelled "Attribute mapping", and the third's called two record timestamps "User lifecycle", which is what
+ * the FIRST card governs. No section carries a description on read.
+ */
 function ScimProvisioningDisplayTemplate() {
-    return (_jsxs(DisplayLayout, { children: [_jsxs(Section, { name: "overview", appearance: SectionMode.CARD, children: [_jsx(DisplayField, { name: "autoCreateUsers" }), _jsx(DisplayField, { name: "autoVerifyEmail" }), _jsx(DisplayField, { name: "autoDeactivateUsers" }), _jsx(DisplayField, { name: "defaultRole" })] }), _jsx(Section, { name: "mapping", children: _jsx(DisplayField, { name: "attributeMapping" }) }), _jsxs(Section, { name: "lifecycle", children: [_jsx(DisplayField, { name: "createdAt" }), _jsx(DisplayField, { name: "updatedAt" })] })] }));
+    return (_jsxs(DisplayLayout, { children: [_jsxs(Section, { name: "overview", appearance: SectionMode.CARD, hideTitle: true, hideDescription: true, children: [_jsx(DisplayField, { name: "autoCreateUsers" }), _jsx(DisplayField, { name: "autoVerifyEmail" }), _jsx(DisplayField, { name: "autoDeactivateUsers" }), _jsx(DisplayField, { name: "defaultRole" })] }), _jsx(Section, { name: "mapping", hideTitle: true, hideDescription: true, children: _jsx(DisplayField, { name: "attributeMapping" }) }), _jsxs(Section, { name: "lifecycle", hideTitle: true, hideDescription: true, children: [_jsx(DisplayField, { name: "createdAt" }), _jsx(DisplayField, { name: "updatedAt" })] })] }));
 }
 function ScimProvisioningSummaryTemplate() {
     return (_jsx(SummaryLayout, { flow: SummaryFlow.ROW, children: _jsx(DisplayField, { name: "autoCreateUsers" }) }));
 }
+/*
+ * A token is named by its display name (the header), so the first card keeps whether it is active and who
+ * created it, without a heading of its own. No section carries a description on read.
+ */
 function ScimTokenDisplayTemplate() {
-    return (_jsxs(DisplayLayout, { children: [_jsxs(Section, { name: "overview", appearance: SectionMode.CARD, children: [_jsx(DisplayField, { name: "displayName" }), _jsx(DisplayField, { name: "isActive" }), _jsx(DisplayField, { name: "createdByUserId" })] }), _jsxs(Section, { name: "lifecycle", children: [_jsx(DisplayField, { name: "lastUsedAt" }), _jsx(DisplayField, { name: "expiresAt" }), _jsx(DisplayField, { name: "createdAt" })] })] }));
+    return (_jsxs(DisplayLayout, { children: [_jsxs(Section, { name: "overview", appearance: SectionMode.CARD, hideTitle: true, hideDescription: true, children: [_jsx(DisplayField, { name: "isActive" }), _jsx(DisplayField, { name: "createdByUserId" })] }), _jsxs(Section, { name: "lifecycle", hideDescription: true, children: [_jsx(DisplayField, { name: "lastUsedAt" }), _jsx(DisplayField, { name: "expiresAt" }), _jsx(DisplayField, { name: "createdAt" })] })] }));
 }
 function ScimTokenSummaryTemplate() {
     return (_jsxs(SummaryLayout, { children: [_jsx(SummaryTitle, { name: "displayName" }), _jsx(SummaryMeta, { children: _jsx(DisplayField, { name: "isActive" }) })] }));
 }
+/*
+ * A stored third-party credential, at either owner scope (the tenant's, or a person's own). Its NAME is
+ * `provider · slot` and its validation state is the badge beside it, so neither the provider, the slot nor the
+ * state is a row: the card showed "asana · ASANA_API_KEY", then "Provider: asana", then "Secret key:
+ * ASANA_API_KEY" — the title, twice more.
+ *
+ * No `<Section>` anywhere, so no `layout.refs`: a section is a contract the specification has to document slot
+ * for slot, and a credential is a handful of facts that no heading would group better than the rows do. Every
+ * optional fact hides when empty — a credential nobody has validated or used yet is the ordinary case, and a
+ * column of dashes under it said nothing.
+ */
+function ProviderCredentialHeader() {
+    return (_jsxs("div", { className: "flex min-w-0 flex-wrap items-center gap-field", children: [_jsx(ResourceHeaderTitle, {}), _jsx(DisplayField, { name: "validationState", hideLabel: true, hideDescription: true, className: "w-auto" })] }));
+}
+/** `setByUserId` exists on the tenant's credential only: a person's own is, by construction, set by them. */
+function providerCredentialDisplayTemplate(includeSetBy) {
+    return function ProviderCredentialDisplayTemplate() {
+        return (_jsxs(DisplayLayout, { children: [_jsx(DisplayField, { name: "enabled" }), _jsx(DisplayField, { name: "description" }), _jsx(DisplayField, { name: "validationError" }), _jsx(DisplayField, { name: "lastValidatedAt" }), _jsx(DisplayField, { name: "lastUsedAt" }), _jsx(DisplayField, { name: "secretSetAt" }), includeSetBy && _jsx(DisplayField, { name: "setByUserId" }), _jsx(DisplayField, { name: "connectionFacts" }), _jsx(DisplayField, { name: "createdAt" })] }));
+    };
+}
+/*
+ * The form a person reaches from a credential's Edit action: replace the secret, switch it off, or note what
+ * it is for. The secret first and focused, since replacing it is why the form is usually opened. The provider
+ * and slot are not offered — they are the credential's identity and cannot change — except on the API's CREATE,
+ * which these screens hide (#1040) and which would otherwise have no way to name them.
+ */
+function ProviderCredentialEditTemplate() {
+    const { isExisting } = useFormTemplateContext();
+    return (_jsxs(FormLayout, { children: [!isExisting && _jsx(FormField, { name: "providerRef" }), !isExisting && _jsx(FormField, { name: "secretSlug" }), _jsx(FormField, { name: "secretValue", autoFocus: true }), _jsx(FormField, { name: "enabled" }), _jsx(FormField, { name: "description" })] }));
+}
+/* A card: the name (`provider · slot`), then the validation badge and whether the credential is on, as the word. */
+function ProviderCredentialSummaryTemplate() {
+    return (_jsx(SummaryLayout, { children: _jsxs(SummaryMeta, { children: [_jsx(DisplayField, { name: "validationState" }), _jsx(DisplayField, { name: "enabled" })] }) }));
+}
+/**
+ * Chrome and field decorators shared by both provider-credential scopes. Settings rows on read (a credential is
+ * inspected one fact at a time), bare values on a card, a stacked form. `enabled` reads as the word on a card —
+ * a bare checkmark there says nothing about WHAT is true.
+ */
+function providerCredentialPresentation(schemaShape) {
+    const hideWhenEmpty = { display: { hideWhenEmpty: true } };
+    return {
+        defaultChromeMode: { display: DisplayChromeMode.SETTINGS_ROW, summary: DisplayChromeMode.HIDDEN, edit: EditChromeMode.STACKED },
+        fields: {
+            enabled: schemaShape.enabled.booleanUI({
+                labellingValue: BooleanLabellingValue.ENABLED_DISABLED,
+                summaryOverride: { displayMode: BooleanDisplayMode.RAW },
+            }),
+            description: schemaShape.description.stringUI({
+                ...hideWhenEmpty,
+                edit: { editMode: StringEditMode.TEXTAREA },
+            }),
+            validationError: schemaShape.validationError.stringUI(hideWhenEmpty),
+            lastValidatedAt: schemaShape.lastValidatedAt.dateUI(hideWhenEmpty),
+            lastUsedAt: schemaShape.lastUsedAt.dateUI(hideWhenEmpty),
+            secretSetAt: schemaShape.secretSetAt.dateUI(hideWhenEmpty),
+            connectionFacts: schemaShape.connectionFacts.objectUI(hideWhenEmpty),
+        },
+    };
+}
 export function buildSecurityMainPresets() {
     return {
+        /**
+         * An organization's OAuth clients — the machine credentials it registers for itself, and the ones an autonomous
+         * agent runs as (#1611). Until #1812 they had no screen, so creating, rotating or ending a client — and binding an
+         * agent to one — was REST only.
+         *
+         * The application-scope preset (`application.resource-presets.tsx`) is the model, section for section, because the
+         * two are one credential type at two scopes. Two differences, each for the resource's own reason:
+         * - an `autonomousAgents` section: which agents this client runs is a grant of standing authority to act
+         *   unattended, so it is on the page rather than behind the action that changes it;
+         * - the Settings Hub chrome of an API key (stacked form, table registry), because this is where it sits — beside
+         *   API keys, in the organization's settings — rather than on the application's administration page.
+         *
+         * `EXPIRE` is the expiry sweep's (INTERNAL_CALL) and carries no view. The secret is never laid out: the hashes
+         * are backend-only, and `secretPrefix` is the part a person uses to tell which credential a log line names.
+         */
+        [R.OAUTH_CLIENTS_ORGANIZATION]: resourceUIBehavior(orgOAuthClientsFactory, OAuthClientOrganizationSchema, ({ schema, schemaShape, opsVariantResolver }) => ({
+            icon: KeyRound,
+            layout: {
+                refs: {
+                    sections: ['overview', 'access', 'redirects', 'autonomousAgents', 'lifecycle'],
+                },
+                defaultChromeMode: { display: DisplayChromeMode.SETTINGS_ROW, summary: DisplayChromeMode.HIDDEN, edit: EditChromeMode.STACKED },
+                // The identity line: the client's name (the page title) and its status beside it. Neither is repeated below.
+                header: () => (_jsxs("div", { className: "flex min-w-0 flex-wrap items-center gap-field", children: [_jsx(ResourceHeaderTitle, {}), _jsx(DisplayField, { name: "status", hideLabel: true, hideDescription: true, className: "w-auto" })] })),
+                display: () => (_jsxs(DisplayLayout, { children: [_jsxs(Section, { name: "overview", appearance: SectionMode.CARD, hideTitle: true, hideDescription: true, children: [_jsx(DisplayField, { name: "_id" }), _jsx(DisplayField, { name: "secretPrefix" }), _jsx(DisplayField, { name: "description" })] }), _jsxs(Section, { name: "access", appearance: SectionMode.CARD, hideDescription: true, children: [_jsx(DisplayField, { name: "allowedGrants" }), _jsx(DisplayField, { name: "allowedScopes" }), _jsx(DisplayField, { name: "roles" }), _jsx(DisplayField, { name: "tokenEndpointAuthMethod" }), _jsx(DisplayField, { name: "requiresConsent" })] }), _jsxs(Section, { name: "redirects", appearance: SectionMode.CARD, hideDescription: true, children: [_jsx(DisplayField, { name: "redirectUris" }), _jsx(DisplayField, { name: "postLogoutRedirectUris" })] }), _jsx(Section, { name: "autonomousAgents", appearance: SectionMode.CARD, children: _jsx(DisplayField, { name: "autonomousAgentRefs" }) }), _jsxs(Section, { name: "lifecycle", appearance: SectionMode.CARD, hideDescription: true, children: [_jsx(DisplayField, { name: "expiresAt" }), _jsx(DisplayField, { name: "lastUsedAt" }), _jsx(DisplayField, { name: "previousSecretPrefix" }), _jsx(DisplayField, { name: "previousSecretInvalidationDate" }), _jsx(DisplayField, { name: "createdAt" })] })] })),
+                summary: () => (_jsxs(SummaryLayout, { children: [_jsx(SummaryTitle, { name: "name" }), _jsxs(SummaryMeta, { children: [_jsx(DisplayField, { name: "status" }), _jsx(DisplayField, { name: "secretPrefix" }), _jsx(DisplayField, { name: "autonomousAgentRefs" })] })] })),
+                edit: OrgOAuthClientEditTemplate,
+            },
+            fields: {
+                // The application client's states and colours, because they mean the same things.
+                status: schemaShape.status.enumUI({
+                    display: { displayMode: EnumDisplayMode.BADGE },
+                    edit: { showDescription: true },
+                    values: {
+                        [OAuthClientStatus.ACTIVE]: { color: BadgeSemanticVariant.SUCCESS },
+                        [OAuthClientStatus.INACTIVE]: { color: BadgeSemanticVariant.SECONDARY },
+                        [OAuthClientStatus.EXPIRED]: { color: BadgeSemanticVariant.WARNING },
+                    },
+                }),
+                // The prefix keeps its label on a card — bare, it reads as a second name.
+                secretPrefix: schemaShape.secretPrefix.stringUI({ summaryOverride: { chromeMode: DisplayChromeMode.INLINE } }),
+                description: schemaShape.description.stringUI({
+                    display: { hideWhenEmpty: true },
+                    edit: { editMode: StringEditMode.TEXTAREA },
+                }),
+                postLogoutRedirectUris: schemaShape.postLogoutRedirectUris.arrayUI({ display: { hideWhenEmpty: true } }),
+                // On a card only when the client runs an agent: most clients run none, and "Autonomous agents: —" on every
+                // card said nothing.
+                autonomousAgentRefs: schemaShape.autonomousAgentRefs.arrayUI({
+                    summaryOverride: { chromeMode: DisplayChromeMode.INLINE, hideWhenEmpty: true },
+                }),
+                expiresAt: schemaShape.expiresAt.dateUI({ display: { hideWhenEmpty: true } }),
+                lastUsedAt: schemaShape.lastUsedAt.dateUI({ display: { hideWhenEmpty: true } }),
+                // The rotation window, shown only while the previous secret still authenticates.
+                previousSecretPrefix: schemaShape.previousSecretPrefix.stringUI({ display: { hideWhenEmpty: true, showDescription: true } }),
+                previousSecretInvalidationDate: schemaShape.previousSecretInvalidationDate.dateUI({ display: { hideWhenEmpty: true } }),
+            },
+            getFrontendResourceLabel: ({ currentObject }) => currentObject.name,
+            views: [
+                [Op.READ, notAddressable()],
+                [Op.LIST, addressable({ collectionDisplayConfig: REGISTRY_TABLE })],
+                // Creating a client returns its one-time `plainSecret` (`.isEphemeral()`), shown once by the reveal dialog.
+                [Op.CREATE, notAddressable()],
+                [Op.SEARCH, notAddressable()],
+                [Op.DELETE, notAddressable()],
+                [OrgOAuthClients_Operations.ROTATE, notAddressable({ iconOverride: RotateCw, ...ROW_VERB_ON_RESOURCE_WITHOUT_UPDATE })],
+                [OrgOAuthClients_Operations.REGENERATE, notAddressable({ iconOverride: RefreshCw, ...ROW_VERB_ON_RESOURCE_WITHOUT_UPDATE })],
+                [OrgOAuthClients_Operations.DEACTIVATE, notAddressable({ iconOverride: PowerOff, ...ROW_VERB_ON_RESOURCE_WITHOUT_UPDATE })],
+                [OrgOAuthClients_Operations.REACTIVATE, notAddressable({ iconOverride: Power, ...ROW_VERB_ON_RESOURCE_WITHOUT_UPDATE })],
+                [OrgOAuthClients_Operations.SET_AUTONOMOUS_AGENTS, notAddressable({ iconOverride: Bot, ...ROW_VERB_ON_RESOURCE_WITHOUT_UPDATE })],
+            ],
+        })),
         [R.ORG_API_KEYS]: resourceUIBehavior(orgApiKeysFactory, ApiKeyOrganizationSchema, ({ schema, schemaShape, opsVariantResolver }) => ({
             icon: Key,
             layout: {
                 refs: {
-                    sections: ['overview', 'access', 'lifecycle'],
+                    sections: ['overview', 'lifecycle'],
                 },
-                // Settings-page chrome (Settings Hub → API keys): label-left / value-right rows.
-                defaultChromeMode: { display: DisplayChromeMode.SETTINGS_ROW, summary: DisplayChromeMode.INLINE, edit: EditChromeMode.SETTINGS_ROW },
+                // Settings rows on the read page (Settings Hub → API keys), bare values on a card, and a stacked
+                // create form: a key is authored once — a name, what it is for, what it may do — not tuned row by row.
+                defaultChromeMode: { display: DisplayChromeMode.SETTINGS_ROW, summary: DisplayChromeMode.HIDDEN, edit: EditChromeMode.STACKED },
+                header: OrgApiKeyHeader,
                 display: OrgApiKeyDisplayTemplate,
                 summary: OrgApiKeySummaryTemplate,
                 edit: OrgApiKeyEditTemplate,
             },
             fields: {
+                // A badge with no sentence under it. "Determines whether the key can authenticate traffic." printed
+                // under every card's status is the field's EDIT help — the form keeps it.
                 status: schemaShape.status.enumUI({
-                    display: { displayMode: EnumDisplayMode.BADGE, showDescription: true },
+                    display: { displayMode: EnumDisplayMode.BADGE },
                     edit: { showDescription: true },
                     values: {
                         [ApiKeyStatus.ACTIVE]: { color: BadgeSemanticVariant.SUCCESS },
@@ -103,27 +411,35 @@ export function buildSecurityMainPresets() {
                         [ApiKeyStatus.EXPIRED]: { color: BadgeSemanticVariant.WARNING },
                     },
                 }),
+                // The one card value that keeps its label: bare, a prefix reads as a second name — see the summary.
+                keyPrefix: schemaShape.keyPrefix.stringUI({ summaryOverride: { chromeMode: DisplayChromeMode.INLINE } }),
+                description: schemaShape.description.stringUI({
+                    display: { hideWhenEmpty: true },
+                    edit: { editMode: StringEditMode.TEXTAREA },
+                }),
+                // A key with no expiry, or one never used, is ordinary — a dash on those rows said nothing.
+                expiresAt: schemaShape.expiresAt.dateUI({ display: { hideWhenEmpty: true } }),
+                lastUsedAt: schemaShape.lastUsedAt.dateUI({ display: { hideWhenEmpty: true } }),
+                // The rotation window, rendered only while the previous secret still authenticates (`ApiKeyRotationWindowRows`).
+                // The prefix row says what an empty end date means — after a regenerate the old secret has none and keeps
+                // working — so it carries its description; the end-date row hides itself when there is no date.
+                previousKeyPrefix: schemaShape.previousKeyPrefix.stringUI({ display: { hideWhenEmpty: true, showDescription: true } }),
+                previousKeyInvalidationDate: schemaShape.previousKeyInvalidationDate.dateUI({ display: { hideWhenEmpty: true } }),
             },
             getFrontendResourceLabel: ({ currentObject }) => currentObject.name,
             // The empty state's primary action is Create — surfaced because CREATE
             // declares a (non-addressable, overlay) view below. Creating a key returns
             // its one-time `plainKey` (`.isEphemeral()` on the CREATE response DTO) →
             // the ephemeral reveal dialog shows the secret exactly once.
-            emptyState: { primaryAction: Op.CREATE },
             views: [
                 [Op.READ, notAddressable()],
-                // A key registry: name, scope, created, last used. Comparable rows.
+                // A key registry: name, status, prefix, expiry, last use. Comparable rows.
                 // CARDS is the framework default and nothing had ever declared otherwise, so every
                 // collection in the product rendered as stacked cards — ~150px per row, four people to a
                 // viewport, with each field's help text and label repeated on every card. TABLE writes the
                 // headers once. `userSwitchableDisplayMode` keeps cards one click away rather than removing
                 // a rendering somebody may prefer on a narrow screen.
-                [Op.LIST, addressable({
-                        collectionDisplayConfig: {
-                            displayMode: CollectionDisplayMode.TABLE,
-                            userSwitchableDisplayMode: true,
-                        },
-                    })],
+                [Op.LIST, addressable({ collectionDisplayConfig: REGISTRY_TABLE })],
                 // CREATE has a view but is NOT URL-addressable — surface EMBEDDED; the create
                 // form opens as a drill-in within the Settings Hub panel, not a routed page.
                 // Its Create button still shows: action visibility is governed by the op
@@ -131,11 +447,11 @@ export function buildSecurityMainPresets() {
                 [Op.CREATE, notAddressable()],
                 [Op.SEARCH, notAddressable()],
                 [Op.DELETE, notAddressable()],
-                [OrgApiKeys_Operations.ROTATE, notAddressable({ iconOverride: RotateCw })],
-                [OrgApiKeys_Operations.REGENERATE, notAddressable({ iconOverride: RefreshCw })],
-                [OrgApiKeys_Operations.DEACTIVATE, notAddressable({ iconOverride: PowerOff })],
-                [OrgApiKeys_Operations.REACTIVATE, notAddressable({ iconOverride: Power })],
-                [OrgApiKeys_Operations.EXTEND_EXPIRY, notAddressable({ iconOverride: CalendarPlus })],
+                [OrgApiKeys_Operations.ROTATE, notAddressable({ iconOverride: RotateCw, ...ROW_VERB_ON_RESOURCE_WITHOUT_UPDATE })],
+                [OrgApiKeys_Operations.REGENERATE, notAddressable({ iconOverride: RefreshCw, ...ROW_VERB_ON_RESOURCE_WITHOUT_UPDATE })],
+                [OrgApiKeys_Operations.DEACTIVATE, notAddressable({ iconOverride: PowerOff, ...ROW_VERB_ON_RESOURCE_WITHOUT_UPDATE })],
+                [OrgApiKeys_Operations.REACTIVATE, notAddressable({ iconOverride: Power, ...ROW_VERB_ON_RESOURCE_WITHOUT_UPDATE })],
+                [OrgApiKeys_Operations.EXTEND_EXPIRY, notAddressable({ iconOverride: CalendarPlus, ...ROW_VERB_ON_RESOURCE_WITHOUT_UPDATE })],
                 [OrgApiKeys_Operations.USAGE_STATS, notAddressable({ iconOverride: ChartColumn })],
             ],
         })),
@@ -150,8 +466,8 @@ export function buildSecurityMainPresets() {
          * ## No layout refs, deliberately
          *
          * Declaring `layout.refs.sections` creates a contract the resource SPECIFICATION has to document
-         * slot for slot, validated at load; this resource has eight visible fields and no section would
-         * earn that coupling. Field-level UI is the whole surface until it needs one.
+         * slot for slot, validated at load; this resource has a handful of visible facts and no section would
+         * earn that coupling. Its templates, shared with the person-scope sibling, are flat rows under a header.
          *
          * ## What the administrator can see, and what they cannot
          *
@@ -161,9 +477,19 @@ export function buildSecurityMainPresets() {
          */
         [R.ORG_PROVIDER_CREDENTIALS]: resourceUIBehavior(orgProviderCredentialsFactory, OrganizationProviderCredentialSchema, ({ schemaShape }) => ({
             icon: KeyRound,
+            layout: {
+                defaultChromeMode: providerCredentialPresentation(schemaShape).defaultChromeMode,
+                header: ProviderCredentialHeader,
+                display: providerCredentialDisplayTemplate(true),
+                summary: ProviderCredentialSummaryTemplate,
+                edit: ProviderCredentialEditTemplate,
+            },
             fields: {
+                ...providerCredentialPresentation(schemaShape).fields,
+                // Absent for a credential the system stored rather than a person — a dash there said nothing.
+                setByUserId: schemaShape.setByUserId.stringUI({ display: { hideWhenEmpty: true } }),
                 validationState: schemaShape.validationState.enumUI({
-                    display: { displayMode: EnumDisplayMode.BADGE, showDescription: true },
+                    display: { displayMode: EnumDisplayMode.BADGE },
                     edit: { showDescription: true },
                     values: {
                         // UNVALIDATED is the honest default and is not a warning: storing a credential proves
@@ -192,13 +518,21 @@ export function buildSecurityMainPresets() {
         })),
         [R.USER_PROVIDER_CREDENTIALS]: resourceUIBehavior(userProviderCredentialsFactory, UserProviderCredentialSchema, ({ schemaShape }) => ({
             icon: KeyRound,
+            layout: {
+                defaultChromeMode: providerCredentialPresentation(schemaShape).defaultChromeMode,
+                header: ProviderCredentialHeader,
+                display: providerCredentialDisplayTemplate(false),
+                summary: ProviderCredentialSummaryTemplate,
+                edit: ProviderCredentialEditTemplate,
+            },
             fields: {
+                ...providerCredentialPresentation(schemaShape).fields,
                 // The same three states as the tenant's, coloured identically on purpose: a person reading
                 // their own connections and an administrator reading the tenant's are answering the same
                 // question, and two colour languages for one vocabulary is how a reader learns to distrust
                 // both. The WORDS come from the enum's i18n entry, authored once for every surface.
                 validationState: schemaShape.validationState.enumUI({
-                    display: { displayMode: EnumDisplayMode.BADGE, showDescription: true },
+                    display: { displayMode: EnumDisplayMode.BADGE },
                     edit: { showDescription: true },
                     values: {
                         // UNVALIDATED is the honest default and is not a warning: storing a credential proves
@@ -218,9 +552,9 @@ export function buildSecurityMainPresets() {
             // CREATE form took both as free text, so a value could be stored in a slot nothing reads, and the refusal naming
             // the valid slots never reached the person. The API's CREATE stays for callers that are not these screens.
             emptyState: { primaryAction: false },
-            // No `layout.refs`, matching the tenant sibling: this resource declares no layout sections in
-            // its specification, and a preset naming refs the layout does not declare fails the
-            // structural-slot validator at import time and crash-loops the companion.
+            // No `layout.refs`, matching the tenant sibling: the templates use no `<Section>`, this resource
+            // declares no layout sections in its specification, and a preset naming refs the specification does
+            // not document fails the structural-slot validator at import time and crash-loops the companion.
             views: [
                 [Op.READ, notAddressable()],
                 [Op.LIST, addressable()],
@@ -231,14 +565,17 @@ export function buildSecurityMainPresets() {
         })),
         [R.AUDIT_LOGS]: resourceUIBehavior(auditLogsFactory, AuditableEvent_BaseSchema, ({ schema, schemaShape, opsVariantResolver }) => ({
             icon: ShieldCheck,
-            getFrontendResourceLabel: ({ currentObject }) => `${currentObject.eventType ?? 'Audit Event'} — ${currentObject.createdAt?.toISOString?.() ?? ''}`,
+            // An audit event is named by its type's word and the instant it happened — see `auditEventName`.
+            getFrontendResourceLabel: auditEventName,
             layout: {
                 refs: {
                     sections: ['overview', 'actors', 'payload'],
                 },
+                defaultChromeMode: auditLogPresentation(schemaShape).defaultChromeMode,
                 display: AuditLogDisplayTemplate,
                 summary: AuditLogSummaryTemplate,
             },
+            fields: auditLogPresentation(schemaShape).fields,
             views: [
                 [Op.READ, notAddressable()],
                 // Audit-trail review dashboard: severity quick tabs (All/Info/Warning/…)
@@ -269,8 +606,8 @@ export function buildSecurityMainPresets() {
                 // `display` and `summary` joined `edit` on 2026-09-18. Only the form carried the settings
                 // treatment, so the READ an operator actually opens rendered with the stacked default while
                 // its own edit form used rows — the same record, two shapes, depending on which verb you
-                // reached it by.
-                defaultChromeMode: { display: DisplayChromeMode.SETTINGS_ROW, summary: DisplayChromeMode.INLINE, edit: EditChromeMode.SETTINGS_ROW },
+                // reached it by. The card is bare: its one value reads as the word ("Enabled"), see `enabled`.
+                defaultChromeMode: { display: DisplayChromeMode.SETTINGS_ROW, summary: DisplayChromeMode.HIDDEN, edit: EditChromeMode.SETTINGS_ROW },
                 // SIEM export configuration — a scope-level configuration record. A settings pane is a list of decisions an operator came to TAKE, so its
                 // writable fields are offered in place rather than behind a whole-pane edit mode. The set is
                 // DERIVED (not primary key, not excludeFromUpdate, not hidden, not opted out), so a field
@@ -283,12 +620,11 @@ export function buildSecurityMainPresets() {
                 // refuses to answer.
                 defaultEmptyValue: 'placeholder',
                 edit: () => {
-                    const { isExisting, operationType } = useFormTemplateContext();
-                    return (_jsxs(FormLayout, { children: [_jsx(Section, { name: "status", appearance: SectionMode.CARD, chromeMode: EditChromeMode.INLINE, children: _jsx(FormField, { name: "enabled" }) }), _jsx(Section, { name: "destination", appearance: SectionMode.CARD, children: _jsx(FormField, { name: "webhookUrl" }) }), _jsxs(Section, { name: "authentication", children: [_jsx(FormField, { name: "authMethod" }), _jsx(FormField, { name: "authCredential" }), _jsx(FormField, { name: "authHeaderName" })] }), _jsxs(Section, { name: "format", children: [_jsx(FormField, { name: "eventFormat" }), _jsxs(ObjectScope, { name: "eventFilter", children: [_jsx(FormField, { name: "categories" }), _jsx(FormField, { name: "severityMinimum" }), _jsx(FormField, { name: "specificEventTypes" })] }), _jsxs(ObjectScope, { name: "exportProjection", children: [_jsx(FormField, { name: "disclosedTiers" }), _jsx(FormField, { name: "disclosedEventDataClasses" })] })] }), _jsxs(Section, { name: "advanced", appearance: SectionMode.COLLAPSIBLE, defaultFocus: false, children: [_jsxs(ObjectScope, { name: "delivery", children: [_jsx(FormField, { name: "retryAttempts" }), _jsx(FormField, { name: "retryBackoffSeconds" }), _jsx(FormField, { name: "timeoutSeconds" })] }), _jsx(FormField, { name: "customHeaders" })] })] }));
+                    return (_jsxs(FormLayout, { children: [_jsx(Section, { name: "status", appearance: SectionMode.CARD, chromeMode: EditChromeMode.INLINE, hideTitle: true, children: _jsx(FormField, { name: "enabled" }) }), _jsx(Section, { name: "destination", appearance: SectionMode.CARD, hideTitle: true, children: _jsx(FormField, { name: "webhookUrl" }) }), _jsxs(Section, { name: "authentication", children: [_jsx(FormField, { name: "authMethod" }), _jsx(FormField, { name: "authCredential" }), _jsx(FormField, { name: "authHeaderName" })] }), _jsxs(Section, { name: "format", children: [_jsx(FormField, { name: "eventFormat" }), _jsxs(ObjectScope, { name: "eventFilter", children: [_jsx(FormField, { name: "categories" }), _jsx(FormField, { name: "severityMinimum" }), _jsx(FormField, { name: "specificEventTypes" })] }), _jsxs(ObjectScope, { name: "exportProjection", children: [_jsx(FormField, { name: "disclosedTiers" }), _jsx(FormField, { name: "disclosedEventDataClasses" })] })] }), _jsxs(Section, { name: "advanced", appearance: SectionMode.COLLAPSIBLE, defaultFocus: false, children: [_jsxs(ObjectScope, { name: "delivery", children: [_jsx(FormField, { name: "retryAttempts" }), _jsx(FormField, { name: "retryBackoffSeconds" }), _jsx(FormField, { name: "timeoutSeconds" })] }), _jsx(FormField, { name: "customHeaders" })] })] }));
                 },
                 display: () => {
                     const { data, isLoading } = useDisplayTemplateContext();
-                    return (_jsxs(DisplayLayout, { children: [_jsx(Section, { name: "status", appearance: SectionMode.CARD, children: _jsx(DisplayField, { name: "enabled" }) }), _jsx(Section, { name: "destination", appearance: SectionMode.CARD, children: _jsx(DisplayField, { name: "webhookUrl" }) }), _jsxs(Section, { name: "authentication", children: [_jsx(DisplayField, { name: "authMethod" }), _jsx(DisplayField, { name: "authCredential" }), _jsx(DisplayField, { name: "authHeaderName" })] }), _jsxs(Section, { name: "format", children: [_jsx(DisplayField, { name: "eventFormat" }), _jsxs(ObjectScope, { name: "eventFilter", children: [_jsx(DisplayField, { name: "categories" }), _jsx(DisplayField, { name: "severityMinimum" }), _jsx(DisplayField, { name: "specificEventTypes" })] }), _jsxs(ObjectScope, { name: "exportProjection", children: [_jsx(DisplayField, { name: "disclosedTiers" }), _jsx(DisplayField, { name: "disclosedEventDataClasses" })] })] }), _jsxs(Section, { name: "advanced", appearance: SectionMode.COLLAPSIBLE, defaultFocus: false, children: [_jsxs(ObjectScope, { name: "delivery", children: [_jsx(DisplayField, { name: "retryAttempts" }), _jsx(DisplayField, { name: "retryBackoffSeconds" }), _jsx(DisplayField, { name: "timeoutSeconds" })] }), _jsx(DisplayField, { name: "customHeaders" })] })] }));
+                    return (_jsxs(DisplayLayout, { children: [_jsx(Section, { name: "status", appearance: SectionMode.CARD, hideTitle: true, children: _jsx(DisplayField, { name: "enabled" }) }), _jsx(Section, { name: "destination", appearance: SectionMode.CARD, hideTitle: true, children: _jsx(DisplayField, { name: "webhookUrl" }) }), _jsxs(Section, { name: "authentication", hideDescription: true, children: [_jsx(DisplayField, { name: "authMethod" }), _jsx(DisplayField, { name: "authCredential" }), _jsx(DisplayField, { name: "authHeaderName" })] }), _jsxs(Section, { name: "format", hideDescription: true, children: [_jsx(DisplayField, { name: "eventFormat" }), _jsxs(ObjectScope, { name: "eventFilter", children: [_jsx(DisplayField, { name: "categories" }), _jsx(DisplayField, { name: "severityMinimum" }), _jsx(DisplayField, { name: "specificEventTypes" })] }), _jsxs(ObjectScope, { name: "exportProjection", children: [_jsx(DisplayField, { name: "disclosedTiers" }), _jsx(DisplayField, { name: "disclosedEventDataClasses" })] })] }), _jsxs(Section, { name: "advanced", appearance: SectionMode.COLLAPSIBLE, defaultFocus: false, hideDescription: true, children: [_jsxs(ObjectScope, { name: "delivery", children: [_jsx(DisplayField, { name: "retryAttempts" }), _jsx(DisplayField, { name: "retryBackoffSeconds" }), _jsx(DisplayField, { name: "timeoutSeconds" })] }), _jsx(DisplayField, { name: "customHeaders" })] })] }));
                 },
                 summary: SiemExportSummaryTemplate,
             },
@@ -319,15 +655,18 @@ export function buildSecurityMainPresets() {
             icon: AlertTriangle,
             layout: {
                 refs: {
-                    sections: ['overview', 'delivery', 'payload'],
+                    sections: ['delivery', 'payload'],
                 },
+                // Settings rows on read, bare values on a card: the card is the failure reason and its status badge.
+                defaultChromeMode: { display: DisplayChromeMode.SETTINGS_ROW, summary: DisplayChromeMode.HIDDEN, edit: EditChromeMode.SETTINGS_ROW },
+                header: SiemDlqHeader,
                 display: SiemDlqDisplayTemplate,
                 summary: SiemDlqSummaryTemplate,
             },
             fields: {
-                // Same billing-style visibility as ORG_API_KEYS / SSO protocol — list rows stay compact; descriptions come from schema metadata when present.
+                // A badge with no sentence under it on read; the enum's description is edit help.
                 status: schema.shape.status.enumUI({
-                    display: { displayMode: EnumDisplayMode.BADGE, showDescription: true },
+                    display: { displayMode: EnumDisplayMode.BADGE },
                     edit: { showDescription: true },
                     values: {
                         [SiemDeliveryDlqStatus.PENDING_RETRY]: { color: BadgeSemanticVariant.WARNING },
@@ -335,6 +674,8 @@ export function buildSecurityMainPresets() {
                         [SiemDeliveryDlqStatus.DELIVERED]: { color: BadgeSemanticVariant.SUCCESS },
                     },
                 }),
+                // Empty once the row is terminal (exhausted or delivered) — a dash there said nothing.
+                nextRetryAt: schema.shape.nextRetryAt.dateUI({ display: { hideWhenEmpty: true } }),
             },
             getFrontendResourceLabel: ({ currentObject }) => currentObject.failureReason,
             views: [
@@ -365,62 +706,84 @@ export function buildSecurityMainPresets() {
                 { parentResourceType: R.ORGANIZATIONS, resourceType: R.ORGANIZATION_SSO_CONFIG },
                 { parentResourceType: R.APPLICATION, resourceType: R.APPLICATION_SSO_CONFIG },
             ],
-        }, ssoConfigPolymorphicFactories[R.ORGANIZATION_SSO_CONFIG], SsoConfigBaseSchema, ({ schema, schemaShape, opsVariantResolver }) => ({
-            icon: StandardIconReference.LOCK,
-            layout: {
-                // Settings-page chrome (Settings Hub): label-left / value-right rows. A scope-level
-                // configuration record is READ far more often than it is edited — an operator opens it to
-                // confirm a value — so the DISPLAY side needs the row treatment at least as much as the form.
-                defaultChromeMode: { display: DisplayChromeMode.SETTINGS_ROW, summary: DisplayChromeMode.INLINE, edit: EditChromeMode.SETTINGS_ROW },
-                // SSO policy — a scope-level configuration record; every field here is a decision. A settings pane is a list of decisions an operator came to TAKE, so its
-                // writable fields are offered in place rather than behind a whole-pane edit mode. The set is
-                // DERIVED (not primary key, not excludeFromUpdate, not hidden, not opted out), so a field
-                // added to this schema tomorrow is covered without anyone remembering to decorate it.
-                defaultInlineEdit: ResourceLayoutInlineEditDefault.WRITABLE_FIELDS,
-                // And its empty rows say WHICH emptiness they are — "None yet" for a list with no members,
-                // "Not available" for a computed value, "No value" for a field awaiting input — instead of one
-                // em dash standing for all three. The surface policy's dash is right where a reader is scanning;
-                // on a settings row, which is read one at a time to decide something, it is an answer that
-                // refuses to answer.
-                defaultEmptyValue: 'placeholder',
-                // Seven groups of decisions — enforcement, domains, provisioning, session, audit,
-                // emergency access, OAuth restrictions — and thirty fields between them. Stacked, the pane
-                // is a scroll in which the thing you came to change is below the fold and the six you did
-                // not is what you read on the way. Vertical tabs is what a settings surface of this size
-                // does: one group at a time, all of them named and reachable in one click, and the rail
-                // doubles as the answer to "what else does SSO decide here".
-                //
-                // Declared on the LAYOUT rather than on the seven sections: the section grouping keys on
-                // `(mode, its mode-specific props)` over consecutive siblings, so per-section it is an
-                // agreement N authors must keep, and a member that slips renders a second rail rather than
-                // failing. It is also what lets the Settings Hub know the pane carries a rail of its own
-                // and give it the wider frame — a prop inside a React template cannot be read by anything
-                // that has to size the surface around it.
-                defaultDisplaySectionAppearance: SectionMode.VERTICAL_TABS,
-                refs: {
-                    sections: ['enforcement', 'domains', 'session', 'emergency', 'oauth'],
+        }, ssoConfigPolymorphicFactories[R.ORGANIZATION_SSO_CONFIG], SsoConfigBaseSchema, ({ schema, schemaShape, opsVariantResolver }) => {
+            /*
+             * The one sentence on this pane that is a warning rather than a restatement: each break-glass address is a
+             * standing way in with a password alone, so the list is kept short and reviewed. It belongs to the field it
+             * warns about, on the row an administrator edits in place and in the form — the pane's vertical tabs render
+             * no section description. Its words are the `whyItMatters` the SSO policy specification declares on this
+             * nested leaf (the labeller reads a nested field's spec under its dotted path). Without that declaration the
+             * generated description restated the label ("Break-glass accounts" under "Break-glass accounts").
+             * spec-cite: N/A — the quoted words are this application's own generated label, and "specification" is our
+             * SSO policy resource specification, not an external standard.
+             *
+             * Decorated here rather than through `fields`, whose keys are top-level: a decorator writes the nested
+             * declaration's own metadata in place, which is what `fields` relies on for top-level fields too.
+             */
+            schema.shape.emergencyAccess.shape.breakGlassAccounts.arrayUI({
+                display: { showDescription: true },
+                edit: { showDescription: true },
+            });
+            return {
+                icon: StandardIconReference.LOCK,
+                layout: {
+                    // Settings-page chrome (Settings Hub): label-left / value-right rows. A scope-level
+                    // configuration record is READ far more often than it is edited — an operator opens it to
+                    // confirm a value — so the DISPLAY side needs the row treatment at least as much as the form.
+                    // The card stays INLINE on purpose: it is ONE boolean (`enforcement.requireSSO`), and a bare checkmark
+                    // says nothing about what is required. The value is nested, so a field-level `summaryOverride` cannot
+                    // reach it — the layout default is the only place to keep its label.
+                    defaultChromeMode: { display: DisplayChromeMode.SETTINGS_ROW, summary: DisplayChromeMode.INLINE, edit: EditChromeMode.SETTINGS_ROW },
+                    // SSO policy — a scope-level configuration record; every field here is a decision. A settings pane is a list of decisions an operator came to TAKE, so its
+                    // writable fields are offered in place rather than behind a whole-pane edit mode. The set is
+                    // DERIVED (not primary key, not excludeFromUpdate, not hidden, not opted out), so a field
+                    // added to this schema tomorrow is covered without anyone remembering to decorate it.
+                    defaultInlineEdit: ResourceLayoutInlineEditDefault.WRITABLE_FIELDS,
+                    // And its empty rows say WHICH emptiness they are — "None yet" for a list with no members,
+                    // "Not available" for a computed value, "No value" for a field awaiting input — instead of one
+                    // em dash standing for all three. The surface policy's dash is right where a reader is scanning;
+                    // on a settings row, which is read one at a time to decide something, it is an answer that
+                    // refuses to answer.
+                    defaultEmptyValue: 'placeholder',
+                    // Seven groups of decisions — enforcement, domains, provisioning, session, audit,
+                    // emergency access, OAuth restrictions — and thirty fields between them. Stacked, the pane
+                    // is a scroll in which the thing you came to change is below the fold and the six you did
+                    // not is what you read on the way. Vertical tabs is what a settings surface of this size
+                    // does: one group at a time, all of them named and reachable in one click, and the rail
+                    // doubles as the answer to "what else does SSO decide here".
+                    //
+                    // Declared on the LAYOUT rather than on the seven sections: the section grouping keys on
+                    // `(mode, its mode-specific props)` over consecutive siblings, so per-section it is an
+                    // agreement N authors must keep, and a member that slips renders a second rail rather than
+                    // failing. It is also what lets the Settings Hub know the pane carries a rail of its own
+                    // and give it the wider frame — a prop inside a React template cannot be read by anything
+                    // that has to size the surface around it.
+                    defaultDisplaySectionAppearance: SectionMode.VERTICAL_TABS,
+                    refs: {
+                        sections: ['enforcement', 'domains', 'session', 'emergency', 'oauth'],
+                    },
+                    display: SsoConfigDisplayTemplate,
+                    summary: SsoConfigSummaryTemplate,
                 },
-                display: SsoConfigDisplayTemplate,
-                summary: SsoConfigSummaryTemplate,
-            },
-            views: [
-                [Op.READ, addressable()],
-                // The edit an administrator opens this pane to make, which until now nothing could save: the
-                // literal UPDATE was INTERNAL_CALL, so no route existed and the frontend's update resolution
-                // fell through to whichever custom verb below borrowed UPDATE semantics. Not addressable — it
-                // opens from the READ view, like SIEM export config's (#953).
-                [Op.UPDATE, notAddressable()],
-                // Domain ownership is the one publicly mutable part of this policy row (#424). The three
-                // actions live beside the `domains` section: claim returns a DNS record to copy, verify
-                // resolves it, revoke releases the domain for another scope to verify.
-                [SsoConfig_Operations.CLAIM_DOMAIN, notAddressable({ iconOverride: Globe })],
-                [SsoConfig_Operations.VERIFY_DOMAIN, notAddressable({ iconOverride: ShieldCheck })],
-                [SsoConfig_Operations.REVOKE_DOMAIN, notAddressable({ iconOverride: Unlink })],
-            ],
-            variantOverrides: {
-                [R.APPLICATION]: { views: [] },
-            },
-        })),
+                views: [
+                    [Op.READ, addressable()],
+                    // The edit an administrator opens this pane to make, which until now nothing could save: the
+                    // literal UPDATE was INTERNAL_CALL, so no route existed and the frontend's update resolution
+                    // fell through to whichever custom verb below borrowed UPDATE semantics. Not addressable — it
+                    // opens from the READ view, like SIEM export config's (#953).
+                    [Op.UPDATE, notAddressable()],
+                    // Domain ownership is the one publicly mutable part of this policy row (#424). The three
+                    // actions live beside the `domains` section: claim returns a DNS record to copy, verify
+                    // resolves it, revoke releases the domain for another scope to verify.
+                    [SsoConfig_Operations.CLAIM_DOMAIN, notAddressable({ iconOverride: Globe })],
+                    [SsoConfig_Operations.VERIFY_DOMAIN, notAddressable({ iconOverride: ShieldCheck })],
+                    [SsoConfig_Operations.REVOKE_DOMAIN, notAddressable({ iconOverride: Unlink })],
+                ],
+                variantOverrides: {
+                    [R.APPLICATION]: { views: [] },
+                },
+            };
+        }),
         ...polymorphicResourceUIBehavior({
             variants: [
                 { parentResourceType: R.ORGANIZATIONS, resourceType: R.ORGANIZATION_SSO_CONNECTIONS },
@@ -432,18 +795,30 @@ export function buildSecurityMainPresets() {
                 refs: {
                     sections: ['overview', 'oidc', 'saml', 'provisioning'],
                 },
+                // Settings rows on read, bare values on a card (the name, the protocol badge, on/off as the word).
+                defaultChromeMode: { display: DisplayChromeMode.SETTINGS_ROW, summary: DisplayChromeMode.HIDDEN, edit: EditChromeMode.SETTINGS_ROW },
+                header: SsoConnectionHeader,
                 display: SsoConnectionDisplayTemplate,
                 summary: SsoConnectionSummaryTemplate,
             },
             fields: {
+                // A badge with no sentence under it on read ("Selects the authentication protocol…" sat under every
+                // card); the enum's description is edit help.
                 protocol: schema.shape.protocol.enumUI({
-                    display: { displayMode: EnumDisplayMode.BADGE, showDescription: true },
+                    display: { displayMode: EnumDisplayMode.BADGE },
                     edit: { showDescription: true },
                     values: {
                         [SsoProtocol.OIDC]: { color: BadgeSemanticVariant.INFO },
                         [SsoProtocol.SAML]: { color: BadgeSemanticVariant.SECONDARY },
                     },
                 }),
+                // On a card the value reads bare, and a bare checkmark says nothing about WHAT is true — so the card
+                // says the word ("Enabled" / "Disabled"); the read page keeps the labelled row and its checkmark.
+                enabled: schema.shape.enabled.booleanUI({
+                    labellingValue: BooleanLabellingValue.ENABLED_DISABLED,
+                    summaryOverride: { displayMode: BooleanDisplayMode.RAW },
+                }),
+                externalProviderId: schema.shape.externalProviderId.stringUI({ display: { hideWhenEmpty: true } }),
             },
             getFrontendResourceLabel: ({ currentObject }) => currentObject.displayName,
             views: [
@@ -453,12 +828,7 @@ export function buildSecurityMainPresets() {
                 // viewport, with each field's help text and label repeated on every card. TABLE writes the
                 // headers once. `userSwitchableDisplayMode` keeps cards one click away rather than removing
                 // a rendering somebody may prefer on a narrow screen.
-                [Op.LIST, addressable({
-                        collectionDisplayConfig: {
-                            displayMode: CollectionDisplayMode.TABLE,
-                            userSwitchableDisplayMode: true,
-                        },
-                    })],
+                [Op.LIST, addressable({ collectionDisplayConfig: REGISTRY_TABLE })],
                 [SsoConnection_Operations.TEST_CONNECTION, addressable({
                         iconOverride: PlugZap,
                         customView: ResourceLayoutPreset_Read_SsoSaml,
@@ -483,7 +853,7 @@ export function buildSecurityMainPresets() {
                 // Settings-page chrome (Settings Hub): label-left / value-right rows. A scope-level
                 // configuration record is READ far more often than it is edited — an operator opens it to
                 // confirm a value — so the DISPLAY side needs the row treatment at least as much as the form.
-                defaultChromeMode: { display: DisplayChromeMode.SETTINGS_ROW, summary: DisplayChromeMode.INLINE, edit: EditChromeMode.SETTINGS_ROW },
+                defaultChromeMode: { display: DisplayChromeMode.SETTINGS_ROW, summary: DisplayChromeMode.HIDDEN, edit: EditChromeMode.SETTINGS_ROW },
                 // SCIM provisioning policy — a scope-level configuration record. A settings pane is a list of decisions an operator came to TAKE, so its
                 // writable fields are offered in place rather than behind a whole-pane edit mode. The set is
                 // DERIVED (not primary key, not excludeFromUpdate, not hidden, not opted out), so a field
@@ -501,6 +871,10 @@ export function buildSecurityMainPresets() {
                 display: ScimProvisioningDisplayTemplate,
                 summary: ScimProvisioningSummaryTemplate,
             },
+            fields: {
+                // The card's one value keeps its label: a bare checkmark says nothing about WHAT is switched on.
+                autoCreateUsers: schema.shape.autoCreateUsers.booleanUI({ summaryOverride: { chromeMode: DisplayChromeMode.INLINE } }),
+            },
             views: [
                 [Op.READ, addressable()],
                 // The four decisions on this row — create users, verify their email, deactivate on
@@ -524,9 +898,21 @@ export function buildSecurityMainPresets() {
                 refs: {
                     sections: ['overview', 'lifecycle'],
                 },
+                // Settings rows on read, bare values on a card (the name, then active or not as the word).
+                defaultChromeMode: { display: DisplayChromeMode.SETTINGS_ROW, summary: DisplayChromeMode.HIDDEN, edit: EditChromeMode.SETTINGS_ROW },
                 display: ScimTokenDisplayTemplate,
                 summary: ScimTokenSummaryTemplate,
             },
+            fields: {
+                // "Active: ✓" on the card becomes the word: a bare checkmark says nothing about what is true.
+                isActive: schema.shape.isActive.booleanUI({
+                    labellingValue: BooleanLabellingValue.ACTIVE_INACTIVE,
+                    summaryOverride: { displayMode: BooleanDisplayMode.RAW },
+                }),
+                // A token never used, or with no expiry, is ordinary — a dash on those rows said nothing.
+                lastUsedAt: schema.shape.lastUsedAt.dateUI({ display: { hideWhenEmpty: true } }),
+                expiresAt: schema.shape.expiresAt.dateUI({ display: { hideWhenEmpty: true } }),
+            },
             views: [
                 // A token registry: name, status, last used, expiry. Comparable rows.
                 // CARDS is the framework default and nothing had ever declared otherwise, so every
@@ -534,12 +920,7 @@ export function buildSecurityMainPresets() {
                 // viewport, with each field's help text and label repeated on every card. TABLE writes the
                 // headers once. `userSwitchableDisplayMode` keeps cards one click away rather than removing
                 // a rendering somebody may prefer on a narrow screen.
-                [Op.LIST, addressable({
-                        collectionDisplayConfig: {
-                            displayMode: CollectionDisplayMode.TABLE,
-                            userSwitchableDisplayMode: true,
-                        },
-                    })],
+                [Op.LIST, addressable({ collectionDisplayConfig: REGISTRY_TABLE })],
                 [ScimTokens_Operations.GENERATE_TOKEN, notAddressable({ iconOverride: KeyRound })],
                 [ScimTokens_Operations.REVOKE_TOKEN, notAddressable({ iconOverride: ShieldX })],
                 [ScimTokens_Operations.ROTATE_TOKEN, notAddressable({ iconOverride: RotateCw })],
@@ -569,14 +950,17 @@ export function buildSecurityAdminPresets(main) {
          */
         [R.APPLICATION_AUDIT_LOGS]: resourceUIBehavior(applicationAuditLogsFactory, AuditableEvent_BaseSchema, ({ schema, schemaShape, opsVariantResolver }) => ({
             icon: ShieldCheck,
-            getFrontendResourceLabel: ({ currentObject }) => `${currentObject.eventType ?? 'Audit Event'} — ${currentObject.createdAt?.toISOString?.() ?? ''}`,
+            // An audit event is named by its type's word and the instant it happened — see `auditEventName`.
+            getFrontendResourceLabel: auditEventName,
             layout: {
                 refs: {
                     sections: ['overview', 'actors', 'payload'],
                 },
+                defaultChromeMode: auditLogPresentation(schemaShape).defaultChromeMode,
                 display: AuditLogDisplayTemplate,
                 summary: AuditLogSummaryTemplate,
             },
+            fields: auditLogPresentation(schemaShape).fields,
             views: [
                 [Op.READ, notAddressable()],
                 // Same dashboard capabilities as the tenant door — `severity` is in this operation's own
@@ -689,8 +1073,9 @@ export function buildSecurityAdminPresets(main) {
             layout: base.layout,
             fields: base.fields,
             getFrontendResourceLabel: base.getFrontendResourceLabel,
+            // The main lane's registry TABLE, for the reason given on SCIM tokens below.
             views: [
-                [Op.LIST, addressable()],
+                [Op.LIST, addressable({ collectionDisplayConfig: REGISTRY_TABLE })],
                 [SsoConnection_Operations.TEST_CONNECTION, addressable({
                         iconOverride: PlugZap,
                         customView: ResourceLayoutPreset_Read_SsoSaml,
@@ -704,7 +1089,7 @@ export function buildSecurityAdminPresets(main) {
                 [R.ORGANIZATIONS]: {
                     views: [
                         [Op.READ, notAddressable()],
-                        [Op.LIST, notAddressable()],
+                        [Op.LIST, notAddressable({ collectionDisplayConfig: REGISTRY_TABLE })],
                     ],
                 },
             },
@@ -717,6 +1102,7 @@ export function buildSecurityAdminPresets(main) {
         }, scimProvisioningConfigPolymorphicFactories[R.ORGANIZATION_SCIM_PROVISIONING_CONFIG], main, ({ base }) => ({
             icon: base.icon,
             layout: base.layout,
+            fields: base.fields,
             views: [
                 [Op.READ, addressable()],
                 // The admin app's own edit door for the APP-scope row. The `main` preset above declares
@@ -738,9 +1124,12 @@ export function buildSecurityAdminPresets(main) {
         }, scimTokensPolymorphicFactories[R.ORGANIZATION_SCIM_TOKENS], main, ({ base }) => ({
             icon: base.icon,
             layout: base.layout,
+            fields: base.fields,
             getFrontendResourceLabel: base.getFrontendResourceLabel,
+            // The same registry TABLE the main lane declares: this lane REPLACES the main entry in an application
+            // that composes both scopes, so leaving it out rendered the inventory as stacked cards there.
             views: [
-                [Op.LIST, addressable()],
+                [Op.LIST, addressable({ collectionDisplayConfig: REGISTRY_TABLE })],
                 [ScimTokens_Operations.GENERATE_TOKEN, notAddressable({ iconOverride: KeyRound })],
                 [ScimTokens_Operations.REVOKE_TOKEN, notAddressable({ iconOverride: ShieldX })],
                 [ScimTokens_Operations.ROTATE_TOKEN, notAddressable({ iconOverride: RotateCw })],
@@ -749,28 +1138,67 @@ export function buildSecurityAdminPresets(main) {
                 [R.ORGANIZATIONS]: {
                     views: [
                         [Op.READ, notAddressable()],
-                        [Op.LIST, notAddressable()],
+                        [Op.LIST, notAddressable({ collectionDisplayConfig: REGISTRY_TABLE })],
                     ],
                 },
             },
         })),
+        /**
+         * The application operator's lane onto an organization's OAuth clients: every verb the main lane has, on its
+         * `admin` variant — except `setAutonomousAgents`, which has none. Binding an agent grants a credential standing
+         * authority to act unattended INSIDE a tenant, so only that tenant's own administrator may do it (#1611); the
+         * operator can still see what a client runs, and end the client.
+         *
+         * It ALSO carries the main lane's views. An application that serves tenants and operators from one frontend
+         * composes both lanes, and this entry REPLACES the main one there — so without the default-variant views the
+         * tenant administrator's own Settings pane (which runs the DEFAULT variants) would have no Create and no binding
+         * action at all. In a split operator-only deployment they are role-gated like everywhere else (the tenant
+         * lane's operations admit tenant roles only), but note the main LIST view is ADDRESSABLE: such a frontend
+         * registers an organization-scoped list route that an operator who is also a member of an organization can
+         * reach. No operator-only deployment exists yet; if one is built, mark the spread LIST not addressable here.
+         */
+        [R.OAUTH_CLIENTS_ORGANIZATION]: resourceUIBehaviorFrom(orgOAuthClientsFactory, main[R.OAUTH_CLIENTS_ORGANIZATION], ({ base, opsVariantResolver }) => ({
+            icon: base.icon,
+            layout: base.layout,
+            getFrontendResourceLabel: base.getFrontendResourceLabel,
+            fields: base.fields,
+            views: [
+                ...(base.views ?? []),
+                [opsVariantResolver(Op.READ, 'admin'), notAddressable()],
+                [opsVariantResolver(Op.LIST, 'admin'), notAddressable({ collectionDisplayConfig: REGISTRY_TABLE })],
+                [opsVariantResolver(Op.SEARCH, 'admin'), notAddressable()],
+                [opsVariantResolver(Op.CREATE, 'admin'), notAddressable()],
+                [opsVariantResolver(Op.DELETE, 'admin'), notAddressable()],
+                [opsVariantResolver(OrgOAuthClients_Operations.ROTATE, 'admin'), notAddressable({ iconOverride: RotateCw, ...ROW_VERB_ON_RESOURCE_WITHOUT_UPDATE })],
+                [opsVariantResolver(OrgOAuthClients_Operations.REGENERATE, 'admin'), notAddressable({ iconOverride: RefreshCw, ...ROW_VERB_ON_RESOURCE_WITHOUT_UPDATE })],
+                [opsVariantResolver(OrgOAuthClients_Operations.DEACTIVATE, 'admin'), notAddressable({ iconOverride: PowerOff, ...ROW_VERB_ON_RESOURCE_WITHOUT_UPDATE })],
+                [opsVariantResolver(OrgOAuthClients_Operations.REACTIVATE, 'admin'), notAddressable({ iconOverride: Power, ...ROW_VERB_ON_RESOURCE_WITHOUT_UPDATE })],
+            ],
+        })),
         [R.ORG_API_KEYS]: resourceUIBehaviorFrom(orgApiKeysFactory, main[R.ORG_API_KEYS], ({ base, opsVariantResolver }) => ({
             icon: base.icon,
             layout: base.layout,
             getFrontendResourceLabel: base.getFrontendResourceLabel,
             fields: base.fields,
             views: [
+                // The tenant administrator's own views, kept. In an application composing both lanes this entry replaces the
+                // main one, and the Settings pane runs the DEFAULT variants: with only the `admin` keys below, the organization's
+                // API keys rendered with no Create and no declared list shape (#1812 measured it beside the OAuth clients).
+                ...(base.views ?? []),
                 [opsVariantResolver(Op.READ, 'admin'), notAddressable()],
-                [opsVariantResolver(Op.LIST, 'admin'), notAddressable()],
+                // The registry TABLE and the action icons the main lane declares. This lane REPLACES the main entry in an
+                // application that composes both scopes, so without them the list rendered as stacked cards and every
+                // row action showed the missing-icon placeholder.
+                [opsVariantResolver(Op.LIST, 'admin'), notAddressable({ collectionDisplayConfig: REGISTRY_TABLE })],
                 [opsVariantResolver(Op.SEARCH, 'admin'), notAddressable()],
                 [opsVariantResolver(Op.CREATE, 'admin'), notAddressable()],
                 [opsVariantResolver(Op.DELETE, 'admin'), notAddressable()],
-                [opsVariantResolver(OrgApiKeys_Operations.ROTATE, 'admin'), notAddressable()],
-                [opsVariantResolver(OrgApiKeys_Operations.REGENERATE, 'admin'), notAddressable()],
-                [opsVariantResolver(OrgApiKeys_Operations.DEACTIVATE, 'admin'), notAddressable()],
-                [opsVariantResolver(OrgApiKeys_Operations.REACTIVATE, 'admin'), notAddressable()],
-                [opsVariantResolver(OrgApiKeys_Operations.EXTEND_EXPIRY, 'admin'), notAddressable()],
-                [opsVariantResolver(OrgApiKeys_Operations.USAGE_STATS, 'admin'), notAddressable()],
+                [opsVariantResolver(OrgApiKeys_Operations.ROTATE, 'admin'), notAddressable({ iconOverride: RotateCw, ...ROW_VERB_ON_RESOURCE_WITHOUT_UPDATE })],
+                [opsVariantResolver(OrgApiKeys_Operations.REGENERATE, 'admin'), notAddressable({ iconOverride: RefreshCw, ...ROW_VERB_ON_RESOURCE_WITHOUT_UPDATE })],
+                [opsVariantResolver(OrgApiKeys_Operations.DEACTIVATE, 'admin'), notAddressable({ iconOverride: PowerOff, ...ROW_VERB_ON_RESOURCE_WITHOUT_UPDATE })],
+                [opsVariantResolver(OrgApiKeys_Operations.REACTIVATE, 'admin'), notAddressable({ iconOverride: Power, ...ROW_VERB_ON_RESOURCE_WITHOUT_UPDATE })],
+                [opsVariantResolver(OrgApiKeys_Operations.EXTEND_EXPIRY, 'admin'), notAddressable({ iconOverride: CalendarPlus, ...ROW_VERB_ON_RESOURCE_WITHOUT_UPDATE })],
+                [opsVariantResolver(OrgApiKeys_Operations.USAGE_STATS, 'admin'), notAddressable({ iconOverride: ChartColumn })],
             ],
         })),
     };
@@ -779,6 +1207,8 @@ export const securityMainPresets = buildSecurityMainPresets();
 export const securityAdminPresets = buildSecurityAdminPresets(securityMainPresets);
 export const orgApiKeysMainResourceUIBehavior = securityMainPresets[R.ORG_API_KEYS];
 export const orgApiKeysAdminResourceUIBehavior = securityAdminPresets[R.ORG_API_KEYS];
+export const orgOAuthClientsMainResourceUIBehavior = securityMainPresets[R.OAUTH_CLIENTS_ORGANIZATION];
+export const orgOAuthClientsAdminResourceUIBehavior = securityAdminPresets[R.OAUTH_CLIENTS_ORGANIZATION];
 export const auditLogsMainResourceUIBehavior = securityMainPresets[R.AUDIT_LOGS];
 export const applicationAuditLogsAdminResourceUIBehavior = securityAdminPresets[R.APPLICATION_AUDIT_LOGS];
 //# sourceMappingURL=security.resource-presets.js.map