@wildo-ai/saas-frontend-lib 1.1.4 → 1.1.5

package/dist/esm/components/settings/AppPage_AppearanceSettings.labels.js.map

@@ -1 +1 @@
-{"version":3,"file":"AppPage_AppearanceSettings.labels.js","sourceRoot":"","sources":["../../../../src/components/settings/AppPage_AppearanceSettings.labels.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,SAAS,EAET,uBAAuB,GACxB,MAAM,qCAAqC,CAAC;AAE7C,+EAA+E;AAC/E,6EAA6E;AAC7E,kFAAkF;AAClF,+EAA+E;AAC/E,0EAA0E;AAC1E,EAAE;AACF,2EAA2E;AAC3E,8EAA8E;AAC9E,4EAA4E;AAC5E,gFAAgF;AAChF,6CAA6C;AAC7C,MAAM,CAAC,MAAM,kCAAkC,GAA0B;IACvE,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,wLAAwL,EAAE;IAChP,EAAE,GAAG,EAAE,iBAAiB,EAAE,IAAI,EAAE,SAAS,CAAC,WAAW,EAAE,OAAO,EAAE,gFAAgF,EAAE;IAClJ,8EAA8E;IAC9E,6EAA6E;IAC7E,sCAAsC;IACtC,EAAE,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,uHAAuH,EAAE;IAChL,EAAE,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,gJAAgJ,EAAE;IACvM,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,+IAA+I,EAAE;IACrM,EAAE,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,wJAAwJ,EAAE;CACjN,CAAC;AAEF,uBAAuB,CAAC,qBAAqB,CAAC,+BAA+B,EAAE,kCAAkC,CAAC,CAAC","sourcesContent":["import {\n  FrontendComponentType,\n  LabelKind,\n  type LabellingUnitaryDef,\n  registerComponentLabels,\n} from '@wildo-ai/presets-components-models';\n\n// Companion-only label metadata for the Appearance settings panel: keys + kind\n// + per-key purpose. Statically scanned by the dev companion to generate the\n// `components.APP_LAYOUTS_APPEARANCE_SETTINGS.*` bundle; NOT imported at runtime,\n// so it never ships in the browser bundle. Keep in lock-step with the keys the\n// component reads via `tComponent(APP_LAYOUTS_APPEARANCE_SETTINGS, ...)`.\n//\n// The per-option DESCRIPTIONS were removed rather than reworded. They read\n// \"Always use the light theme.\" under a label reading \"Light\" — a restatement\n// with no information in it, occupying the place where information belongs.\n// Each option now renders a preview of the theme it selects, which is the thing\n// a description could only ever approximate.\nexport const AppLayoutsAppearanceSettingsLabels: LabellingUnitaryDef[] = [\n  { ref: 'pageTitle', kind: LabelKind.HEADING, purpose: 'Heading for the Appearance panel — the plain area name only (\"Appearance\"); the enclosing dialog already says \"Settings\", so repeating it here says the word three times on one screen' },\n  { ref: 'pageDescription', kind: LabelKind.DESCRIPTION, purpose: 'Sub-heading explaining the Appearance panel customizes the local look-and-feel' },\n  // Rendered only as the radio group's accessible name (`aria-label`), never as\n  // visible text: the panel heading above it already titles the section, and a\n  // second visible heading repeated it.\n  { ref: 'themeHeading', kind: LabelKind.LABEL, purpose: 'Accessible name for the theme selector radio group, announced by screen readers in place of a visible section heading' },\n  { ref: 'themeLight', kind: LabelKind.LABEL, purpose: 'Name of the option that always uses the light theme; sits under a rendered preview of that theme, so it must be the bare name and nothing more' },\n  { ref: 'themeDark', kind: LabelKind.LABEL, purpose: 'Name of the option that always uses the dark theme; sits under a rendered preview of that theme, so it must be the bare name and nothing more' },\n  { ref: 'themeSystem', kind: LabelKind.LABEL, purpose: 'Name of the option that follows the operating-system color scheme; sits under a split light/dark preview, so it must be the bare name and nothing more' },\n];\n\nregisterComponentLabels(FrontendComponentType.APP_LAYOUTS_APPEARANCE_SETTINGS, AppLayoutsAppearanceSettingsLabels);\n"]}
+{"version":3,"file":"AppPage_AppearanceSettings.labels.js","sourceRoot":"","sources":["../../../../../src/components/settings/AppPage_AppearanceSettings.labels.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,SAAS,EAET,uBAAuB,GACxB,MAAM,qCAAqC,CAAC;AAE7C,+EAA+E;AAC/E,6EAA6E;AAC7E,kFAAkF;AAClF,+EAA+E;AAC/E,0EAA0E;AAC1E,EAAE;AACF,2EAA2E;AAC3E,8EAA8E;AAC9E,4EAA4E;AAC5E,gFAAgF;AAChF,6CAA6C;AAC7C,MAAM,CAAC,MAAM,kCAAkC,GAA0B;IACvE,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,wLAAwL,EAAE;IAChP,EAAE,GAAG,EAAE,iBAAiB,EAAE,IAAI,EAAE,SAAS,CAAC,WAAW,EAAE,OAAO,EAAE,gFAAgF,EAAE;IAClJ,8EAA8E;IAC9E,6EAA6E;IAC7E,sCAAsC;IACtC,EAAE,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,uHAAuH,EAAE;IAChL,EAAE,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,gJAAgJ,EAAE;IACvM,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,+IAA+I,EAAE;IACrM,EAAE,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,wJAAwJ,EAAE;CACjN,CAAC;AAEF,uBAAuB,CAAC,qBAAqB,CAAC,+BAA+B,EAAE,kCAAkC,CAAC,CAAC","sourcesContent":["import {\n  FrontendComponentType,\n  LabelKind,\n  type LabellingUnitaryDef,\n  registerComponentLabels,\n} from '@wildo-ai/presets-components-models';\n\n// Companion-only label metadata for the Appearance settings panel: keys + kind\n// + per-key purpose. Statically scanned by the dev companion to generate the\n// `components.APP_LAYOUTS_APPEARANCE_SETTINGS.*` bundle; NOT imported at runtime,\n// so it never ships in the browser bundle. Keep in lock-step with the keys the\n// component reads via `tComponent(APP_LAYOUTS_APPEARANCE_SETTINGS, ...)`.\n//\n// The per-option DESCRIPTIONS were removed rather than reworded. They read\n// \"Always use the light theme.\" under a label reading \"Light\" — a restatement\n// with no information in it, occupying the place where information belongs.\n// Each option now renders a preview of the theme it selects, which is the thing\n// a description could only ever approximate.\nexport const AppLayoutsAppearanceSettingsLabels: LabellingUnitaryDef[] = [\n  { ref: 'pageTitle', kind: LabelKind.HEADING, purpose: 'Heading for the Appearance panel — the plain area name only (\"Appearance\"); the enclosing dialog already says \"Settings\", so repeating it here says the word three times on one screen' },\n  { ref: 'pageDescription', kind: LabelKind.DESCRIPTION, purpose: 'Sub-heading explaining the Appearance panel customizes the local look-and-feel' },\n  // Rendered only as the radio group's accessible name (`aria-label`), never as\n  // visible text: the panel heading above it already titles the section, and a\n  // second visible heading repeated it.\n  { ref: 'themeHeading', kind: LabelKind.LABEL, purpose: 'Accessible name for the theme selector radio group, announced by screen readers in place of a visible section heading' },\n  { ref: 'themeLight', kind: LabelKind.LABEL, purpose: 'Name of the option that always uses the light theme; sits under a rendered preview of that theme, so it must be the bare name and nothing more' },\n  { ref: 'themeDark', kind: LabelKind.LABEL, purpose: 'Name of the option that always uses the dark theme; sits under a rendered preview of that theme, so it must be the bare name and nothing more' },\n  { ref: 'themeSystem', kind: LabelKind.LABEL, purpose: 'Name of the option that follows the operating-system color scheme; sits under a split light/dark preview, so it must be the bare name and nothing more' },\n];\n\nregisterComponentLabels(FrontendComponentType.APP_LAYOUTS_APPEARANCE_SETTINGS, AppLayoutsAppearanceSettingsLabels);\n"]}

package/dist/esm/components/settings/AppPage_BillingSettings.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AppPage_BillingSettings.d.ts","sourceRoot":"","sources":["../../../../src/components/settings/AppPage_BillingSettings.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,KAAsB,MAAM,OAAO,CAAC;AAY3C,eAAO,MAAM,uBAAuB,EAAE,KAAK,CAAC,EA2F3C,CAAC"}
+{"version":3,"file":"AppPage_BillingSettings.d.ts","sourceRoot":"","sources":["../../../../../src/components/settings/AppPage_BillingSettings.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,KAAsB,MAAM,OAAO,CAAC;AAY3C,eAAO,MAAM,uBAAuB,EAAE,KAAK,CAAC,EA2F3C,CAAC"}

package/dist/esm/components/settings/AppPage_BillingSettings.js.map

@@ -1 +1 @@
-{"version":3,"file":"AppPage_BillingSettings.js","sourceRoot":"","sources":["../../../../src/components/settings/AppPage_BillingSettings.tsx"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAc,EAAE,WAAW,EAAE,MAAM,OAAO,CAAC;AAC3C,OAAO,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAC5E,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,8CAA8C,CAAC;AACxG,OAAO,EAAE,IAAI,EAAE,MAAM,gDAAgD,CAAC;AACtE,OAAO,EAAE,kBAAkB,EAAE,MAAM,oEAAoE,CAAC;AACxG,OAAO,EAAE,iBAAiB,EAAE,MAAM,4DAA4D,CAAC;AAC/F,OAAO,EAAE,YAAY,EAAE,MAAM,8DAA8D,CAAC;AAC5F,OAAO,EAAE,cAAc,EAAE,MAAM,gEAAgE,CAAC;AAChG,OAAO,EAAE,cAAc,EAAE,MAAM,gEAAgE,CAAC;AAChG,OAAO,EAAE,cAAc,EAAE,MAAM,6CAA6C,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,MAAM,uCAAuC,CAAC;AAEhE,MAAM,CAAC,MAAM,uBAAuB,GAAa,GAAG,EAAE;IACpD,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;IACjC,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,EAAE,SAAS,EAAE,qBAAqB,CAAC,4BAA4B,EAAE,CAAC,CAAC;IAE3G,MAAM,CAAC,GAAG,WAAW,CACnB,CAAC,GAAW,EAAE,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,4BAA4B,EAAE,GAAG,CAAC,EACpF,CAAC,UAAU,CAAC,CACb,CAAC;IAEF,oEAAoE;IACpE,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,8EAA8E;IAC9E,yEAAyE;IACzE,4EAA4E;IAC5E,8BAA8B;IAC9B,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC;QACxB,OAAO,CACL,MAAC,IAAI,eACH,KAAC,UAAU,cACT,KAAC,SAAS,cAAE,CAAC,CAAC,eAAe,CAAC,GAAa,GAChC,EACb,KAAC,WAAW,cACV,KAAC,IAAI,IAAC,SAAS,EAAC,+BAA+B,YAAE,CAAC,CAAC,qBAAqB,CAAC,GAAQ,GACrE,IACT,CACR,CAAC;IACJ,CAAC;IAED,OAAO,CACL,eAAK,SAAS,EAAC,2BAA2B,aACxC,eAAK,SAAS,EAAC,2BAA2B,aAGxC,aAAI,SAAS,EAAC,wCAAwC,YAAE,CAAC,CAAC,WAAW,CAAC,GAAM,EAC5E,KAAC,IAAI,IAAC,SAAS,EAAC,+BAA+B,YAAE,CAAC,CAAC,iBAAiB,CAAC,GAAQ,IACzE,EAEN,eAAK,SAAS,EAAC,+BAA+B,aAC5C,MAAC,IAAI,eACH,KAAC,UAAU,cACT,KAAC,SAAS,cAAE,CAAC,CAAC,qBAAqB,CAAC,GAAa,GACtC,EACb,KAAC,WAAW,cAGV,KAAC,kBAAkB,KAAG,GACV,IACT,EAEP,MAAC,IAAI,eACH,KAAC,UAAU,cACT,KAAC,SAAS,cAAE,CAAC,CAAC,eAAe,CAAC,GAAa,GAChC,EACb,MAAC,WAAW,IAAC,SAAS,EAAC,iBAAiB,aACtC,KAAC,IAAI,IAAC,SAAS,EAAC,+BAA+B,YAAE,CAAC,CAAC,mBAAmB,CAAC,GAAQ,EAC/E,KAAC,iBAAiB,KAAG,IACT,IACT,IACH,EAEN,MAAC,IAAI,eACH,KAAC,UAAU,cACT,KAAC,SAAS,cAAE,CAAC,CAAC,cAAc,CAAC,GAAa,GAC/B,EACb,KAAC,WAAW,cAGV,KAAC,YAAY,KAAG,GACJ,IACT,EAEP,MAAC,IAAI,eACH,KAAC,UAAU,cACT,KAAC,SAAS,cAAE,CAAC,CAAC,cAAc,CAAC,GAAa,GAC/B,EACb,KAAC,WAAW,cACV,KAAC,cAAc,KAAG,GACN,IACT,EAEP,MAAC,IAAI,eACH,KAAC,UAAU,cACT,KAAC,SAAS,cAAE,CAAC,CAAC,iBAAiB,CAAC,GAAa,GAClC,EACb,KAAC,WAAW,cACV,KAAC,cAAc,KAAG,GACN,IACT,IACH,CACP,CAAC;AACJ,CAAC,CAAC","sourcesContent":["/**\n * AppPage_BillingSettings — the Settings Hub \"Billing\" panel: THE billing home.\n *\n * A bespoke `ENGINE_PANEL` (not a resource surface) composing the shared billing\n * widgets over the aggregated `BillingContext` state (`GET_STATE`): subscription\n * status, provider portal link, plan catalog + checkout, metered usage / credit\n * pools, and invoice history. Every widget self-hydrates from `useBillingSafe()`\n * (plan-name i18n, provider display name, safe checkout/portal execution), so\n * this panel is pure composition — it passes NO data props.\n *\n * Why bespoke rather than `RESOURCE_OPERATION` sub-tabs (the previous shape):\n * the billing child resources (subscriptions, invoice refs, usage records) are\n * routed UNDER the billing account (`REQUIRES_CONTEXT` on the\n * `BillingAccounts → children` edges), so an org-scoped generic panel cannot\n * build their URLs (`FRONTEND_RESOURCE_NO_ENDPOINT_AVAILABLE`). The aggregated\n * billing state IS org-addressable and auto-creates the billing account, which\n * makes it the correct settings-surface data source.\n *\n * i18n follows the framework convention (same shape as\n * `AppPage_InvitationsSettings`): `useI18n({ component })` requests this\n * component's label namespace, the panel gates rendering on `isReady` so it\n * never flashes raw key paths, and a thin `t(key)` reads each label. Copy is\n * owned by the labelling pipeline (sibling `.labels.ts`) — no hardcoded\n * fallback strings here.\n */\nimport React, { useCallback } from 'react';\nimport { FrontendComponentType } from '@wildo-ai/presets-components-models';\nimport { Card, CardContent, CardHeader, CardTitle } from '~wildo-frontend-lib/components/sections/card';\nimport { Text } from '~wildo-frontend-lib/components/typography/text';\nimport { SubscriptionStatus } from '~wildo-frontend-lib/components/billing/billing-subscription-status';\nimport { BillingPortalLink } from '~wildo-frontend-lib/components/billing/billing-portal-link';\nimport { PricingTable } from '~wildo-frontend-lib/components/billing/billing-pricing-table';\nimport { UsageDashboard } from '~wildo-frontend-lib/components/billing/billing-usage-dashboard';\nimport { InvoiceHistory } from '~wildo-frontend-lib/components/billing/billing-invoice-history';\nimport { useBillingSafe } from '~wildo-frontend-lib/core/billing/useBilling';\nimport { useI18n } from '~wildo-frontend-lib/core/i18n/useI18n';\n\nexport const AppPage_BillingSettings: React.FC = () => {\n  const billing = useBillingSafe();\n  const { tComponent, isReady } = useI18n({ component: FrontendComponentType.APP_LAYOUTS_BILLING_SETTINGS });\n\n  const t = useCallback(\n    (key: string) => tComponent(FrontendComponentType.APP_LAYOUTS_BILLING_SETTINGS, key),\n    [tComponent],\n  );\n\n  // Gate on label readiness so the panel never flashes raw key paths.\n  if (!isReady) return null;\n\n  // The section itself is capability-gated (`billingEnabled`), so this state is\n  // only reachable when the hub config and the runtime capability disagree\n  // (e.g. billing flipped off between config loads). Render an honest message\n  // rather than an empty panel.\n  if (!billing?.isEnabled) {\n    return (\n      <Card>\n        <CardHeader>\n          <CardTitle>{t('disabledTitle')}</CardTitle>\n        </CardHeader>\n        <CardContent>\n          <Text className=\"text-sm text-muted-foreground\">{t('disabledDescription')}</Text>\n        </CardContent>\n      </Card>\n    );\n  }\n\n  return (\n    <div className=\"flex flex-col gap-section\">\n      <div className=\"flex flex-col gap-item-xs\">\n        {/* `h3`, not `h2`: the Settings Hub header owns the `h2` for this dialog,\n            so a panel heading is one level below it. */}\n        <h3 className=\"text-base font-semibold tracking-tight\">{t('pageTitle')}</h3>\n        <Text className=\"text-sm text-muted-foreground\">{t('pageDescription')}</Text>\n      </div>\n\n      <div className=\"grid gap-group lg:grid-cols-2\">\n        <Card>\n          <CardHeader>\n            <CardTitle>{t('subscriptionHeading')}</CardTitle>\n          </CardHeader>\n          <CardContent>\n            {/* Self-hydrates: status/plan/period from the subscription, plan name\n                via billing-product i18n, manage action = safe customer portal. */}\n            <SubscriptionStatus />\n          </CardContent>\n        </Card>\n\n        <Card>\n          <CardHeader>\n            <CardTitle>{t('manageHeading')}</CardTitle>\n          </CardHeader>\n          <CardContent className=\"space-y-item-sm\">\n            <Text className=\"text-sm text-muted-foreground\">{t('manageDescription')}</Text>\n            <BillingPortalLink />\n          </CardContent>\n        </Card>\n      </div>\n\n      <Card>\n        <CardHeader>\n          <CardTitle>{t('plansHeading')}</CardTitle>\n        </CardHeader>\n        <CardContent>\n          {/* Self-hydrates: public active PLAN products scoped to the current\n              billing scope; select = checkout (no subscription) / portal (active). */}\n          <PricingTable />\n        </CardContent>\n      </Card>\n\n      <Card>\n        <CardHeader>\n          <CardTitle>{t('usageHeading')}</CardTitle>\n        </CardHeader>\n        <CardContent>\n          <UsageDashboard />\n        </CardContent>\n      </Card>\n\n      <Card>\n        <CardHeader>\n          <CardTitle>{t('invoicesHeading')}</CardTitle>\n        </CardHeader>\n        <CardContent>\n          <InvoiceHistory />\n        </CardContent>\n      </Card>\n    </div>\n  );\n};\n"]}
+{"version":3,"file":"AppPage_BillingSettings.js","sourceRoot":"","sources":["../../../../../src/components/settings/AppPage_BillingSettings.tsx"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAc,EAAE,WAAW,EAAE,MAAM,OAAO,CAAC;AAC3C,OAAO,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAC5E,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,8CAA8C,CAAC;AACxG,OAAO,EAAE,IAAI,EAAE,MAAM,gDAAgD,CAAC;AACtE,OAAO,EAAE,kBAAkB,EAAE,MAAM,oEAAoE,CAAC;AACxG,OAAO,EAAE,iBAAiB,EAAE,MAAM,4DAA4D,CAAC;AAC/F,OAAO,EAAE,YAAY,EAAE,MAAM,8DAA8D,CAAC;AAC5F,OAAO,EAAE,cAAc,EAAE,MAAM,gEAAgE,CAAC;AAChG,OAAO,EAAE,cAAc,EAAE,MAAM,gEAAgE,CAAC;AAChG,OAAO,EAAE,cAAc,EAAE,MAAM,6CAA6C,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,MAAM,uCAAuC,CAAC;AAEhE,MAAM,CAAC,MAAM,uBAAuB,GAAa,GAAG,EAAE;IACpD,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;IACjC,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,EAAE,SAAS,EAAE,qBAAqB,CAAC,4BAA4B,EAAE,CAAC,CAAC;IAE3G,MAAM,CAAC,GAAG,WAAW,CACnB,CAAC,GAAW,EAAE,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,4BAA4B,EAAE,GAAG,CAAC,EACpF,CAAC,UAAU,CAAC,CACb,CAAC;IAEF,oEAAoE;IACpE,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,8EAA8E;IAC9E,yEAAyE;IACzE,4EAA4E;IAC5E,8BAA8B;IAC9B,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC;QACxB,OAAO,CACL,MAAC,IAAI,eACH,KAAC,UAAU,cACT,KAAC,SAAS,cAAE,CAAC,CAAC,eAAe,CAAC,GAAa,GAChC,EACb,KAAC,WAAW,cACV,KAAC,IAAI,IAAC,SAAS,EAAC,+BAA+B,YAAE,CAAC,CAAC,qBAAqB,CAAC,GAAQ,GACrE,IACT,CACR,CAAC;IACJ,CAAC;IAED,OAAO,CACL,eAAK,SAAS,EAAC,2BAA2B,aACxC,eAAK,SAAS,EAAC,2BAA2B,aAGxC,aAAI,SAAS,EAAC,wCAAwC,YAAE,CAAC,CAAC,WAAW,CAAC,GAAM,EAC5E,KAAC,IAAI,IAAC,SAAS,EAAC,+BAA+B,YAAE,CAAC,CAAC,iBAAiB,CAAC,GAAQ,IACzE,EAEN,eAAK,SAAS,EAAC,+BAA+B,aAC5C,MAAC,IAAI,eACH,KAAC,UAAU,cACT,KAAC,SAAS,cAAE,CAAC,CAAC,qBAAqB,CAAC,GAAa,GACtC,EACb,KAAC,WAAW,cAGV,KAAC,kBAAkB,KAAG,GACV,IACT,EAEP,MAAC,IAAI,eACH,KAAC,UAAU,cACT,KAAC,SAAS,cAAE,CAAC,CAAC,eAAe,CAAC,GAAa,GAChC,EACb,MAAC,WAAW,IAAC,SAAS,EAAC,iBAAiB,aACtC,KAAC,IAAI,IAAC,SAAS,EAAC,+BAA+B,YAAE,CAAC,CAAC,mBAAmB,CAAC,GAAQ,EAC/E,KAAC,iBAAiB,KAAG,IACT,IACT,IACH,EAEN,MAAC,IAAI,eACH,KAAC,UAAU,cACT,KAAC,SAAS,cAAE,CAAC,CAAC,cAAc,CAAC,GAAa,GAC/B,EACb,KAAC,WAAW,cAGV,KAAC,YAAY,KAAG,GACJ,IACT,EAEP,MAAC,IAAI,eACH,KAAC,UAAU,cACT,KAAC,SAAS,cAAE,CAAC,CAAC,cAAc,CAAC,GAAa,GAC/B,EACb,KAAC,WAAW,cACV,KAAC,cAAc,KAAG,GACN,IACT,EAEP,MAAC,IAAI,eACH,KAAC,UAAU,cACT,KAAC,SAAS,cAAE,CAAC,CAAC,iBAAiB,CAAC,GAAa,GAClC,EACb,KAAC,WAAW,cACV,KAAC,cAAc,KAAG,GACN,IACT,IACH,CACP,CAAC;AACJ,CAAC,CAAC","sourcesContent":["/**\n * AppPage_BillingSettings — the Settings Hub \"Billing\" panel: THE billing home.\n *\n * A bespoke `ENGINE_PANEL` (not a resource surface) composing the shared billing\n * widgets over the aggregated `BillingContext` state (`GET_STATE`): subscription\n * status, provider portal link, plan catalog + checkout, metered usage / credit\n * pools, and invoice history. Every widget self-hydrates from `useBillingSafe()`\n * (plan-name i18n, provider display name, safe checkout/portal execution), so\n * this panel is pure composition — it passes NO data props.\n *\n * Why bespoke rather than `RESOURCE_OPERATION` sub-tabs (the previous shape):\n * the billing child resources (subscriptions, invoice refs, usage records) are\n * routed UNDER the billing account (`REQUIRES_CONTEXT` on the\n * `BillingAccounts → children` edges), so an org-scoped generic panel cannot\n * build their URLs (`FRONTEND_RESOURCE_NO_ENDPOINT_AVAILABLE`). The aggregated\n * billing state IS org-addressable and auto-creates the billing account, which\n * makes it the correct settings-surface data source.\n *\n * i18n follows the framework convention (same shape as\n * `AppPage_InvitationsSettings`): `useI18n({ component })` requests this\n * component's label namespace, the panel gates rendering on `isReady` so it\n * never flashes raw key paths, and a thin `t(key)` reads each label. Copy is\n * owned by the labelling pipeline (sibling `.labels.ts`) — no hardcoded\n * fallback strings here.\n */\nimport React, { useCallback } from 'react';\nimport { FrontendComponentType } from '@wildo-ai/presets-components-models';\nimport { Card, CardContent, CardHeader, CardTitle } from '~wildo-frontend-lib/components/sections/card';\nimport { Text } from '~wildo-frontend-lib/components/typography/text';\nimport { SubscriptionStatus } from '~wildo-frontend-lib/components/billing/billing-subscription-status';\nimport { BillingPortalLink } from '~wildo-frontend-lib/components/billing/billing-portal-link';\nimport { PricingTable } from '~wildo-frontend-lib/components/billing/billing-pricing-table';\nimport { UsageDashboard } from '~wildo-frontend-lib/components/billing/billing-usage-dashboard';\nimport { InvoiceHistory } from '~wildo-frontend-lib/components/billing/billing-invoice-history';\nimport { useBillingSafe } from '~wildo-frontend-lib/core/billing/useBilling';\nimport { useI18n } from '~wildo-frontend-lib/core/i18n/useI18n';\n\nexport const AppPage_BillingSettings: React.FC = () => {\n  const billing = useBillingSafe();\n  const { tComponent, isReady } = useI18n({ component: FrontendComponentType.APP_LAYOUTS_BILLING_SETTINGS });\n\n  const t = useCallback(\n    (key: string) => tComponent(FrontendComponentType.APP_LAYOUTS_BILLING_SETTINGS, key),\n    [tComponent],\n  );\n\n  // Gate on label readiness so the panel never flashes raw key paths.\n  if (!isReady) return null;\n\n  // The section itself is capability-gated (`billingEnabled`), so this state is\n  // only reachable when the hub config and the runtime capability disagree\n  // (e.g. billing flipped off between config loads). Render an honest message\n  // rather than an empty panel.\n  if (!billing?.isEnabled) {\n    return (\n      <Card>\n        <CardHeader>\n          <CardTitle>{t('disabledTitle')}</CardTitle>\n        </CardHeader>\n        <CardContent>\n          <Text className=\"text-sm text-muted-foreground\">{t('disabledDescription')}</Text>\n        </CardContent>\n      </Card>\n    );\n  }\n\n  return (\n    <div className=\"flex flex-col gap-section\">\n      <div className=\"flex flex-col gap-item-xs\">\n        {/* `h3`, not `h2`: the Settings Hub header owns the `h2` for this dialog,\n            so a panel heading is one level below it. */}\n        <h3 className=\"text-base font-semibold tracking-tight\">{t('pageTitle')}</h3>\n        <Text className=\"text-sm text-muted-foreground\">{t('pageDescription')}</Text>\n      </div>\n\n      <div className=\"grid gap-group lg:grid-cols-2\">\n        <Card>\n          <CardHeader>\n            <CardTitle>{t('subscriptionHeading')}</CardTitle>\n          </CardHeader>\n          <CardContent>\n            {/* Self-hydrates: status/plan/period from the subscription, plan name\n                via billing-product i18n, manage action = safe customer portal. */}\n            <SubscriptionStatus />\n          </CardContent>\n        </Card>\n\n        <Card>\n          <CardHeader>\n            <CardTitle>{t('manageHeading')}</CardTitle>\n          </CardHeader>\n          <CardContent className=\"space-y-item-sm\">\n            <Text className=\"text-sm text-muted-foreground\">{t('manageDescription')}</Text>\n            <BillingPortalLink />\n          </CardContent>\n        </Card>\n      </div>\n\n      <Card>\n        <CardHeader>\n          <CardTitle>{t('plansHeading')}</CardTitle>\n        </CardHeader>\n        <CardContent>\n          {/* Self-hydrates: public active PLAN products scoped to the current\n              billing scope; select = checkout (no subscription) / portal (active). */}\n          <PricingTable />\n        </CardContent>\n      </Card>\n\n      <Card>\n        <CardHeader>\n          <CardTitle>{t('usageHeading')}</CardTitle>\n        </CardHeader>\n        <CardContent>\n          <UsageDashboard />\n        </CardContent>\n      </Card>\n\n      <Card>\n        <CardHeader>\n          <CardTitle>{t('invoicesHeading')}</CardTitle>\n        </CardHeader>\n        <CardContent>\n          <InvoiceHistory />\n        </CardContent>\n      </Card>\n    </div>\n  );\n};\n"]}

package/dist/esm/components/settings/AppPage_BillingSettings.labels.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AppPage_BillingSettings.labels.d.ts","sourceRoot":"","sources":["../../../../src/components/settings/AppPage_BillingSettings.labels.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,mBAAmB,EAEzB,MAAM,qCAAqC,CAAC;AAQ7C,eAAO,MAAM,+BAA+B,EAAE,mBAAmB,EAWhE,CAAC"}
+{"version":3,"file":"AppPage_BillingSettings.labels.d.ts","sourceRoot":"","sources":["../../../../../src/components/settings/AppPage_BillingSettings.labels.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,mBAAmB,EAEzB,MAAM,qCAAqC,CAAC;AAQ7C,eAAO,MAAM,+BAA+B,EAAE,mBAAmB,EAWhE,CAAC"}

package/dist/esm/components/settings/AppPage_BillingSettings.labels.js.map

@@ -1 +1 @@
-{"version":3,"file":"AppPage_BillingSettings.labels.js","sourceRoot":"","sources":["../../../../src/components/settings/AppPage_BillingSettings.labels.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,SAAS,EAET,uBAAuB,GACxB,MAAM,qCAAqC,CAAC;AAE7C,0EAA0E;AAC1E,0EAA0E;AAC1E,4EAA4E;AAC5E,8EAA8E;AAC9E,2EAA2E;AAC3E,2BAA2B;AAC3B,MAAM,CAAC,MAAM,+BAA+B,GAA0B;IACpE,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,6DAA6D,EAAE;IACrH,EAAE,GAAG,EAAE,iBAAiB,EAAE,IAAI,EAAE,SAAS,CAAC,WAAW,EAAE,OAAO,EAAE,oGAAoG,EAAE;IACtK,EAAE,GAAG,EAAE,qBAAqB,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,0DAA0D,EAAE;IAC5H,EAAE,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,gFAAgF,EAAE;IAC5I,EAAE,GAAG,EAAE,mBAAmB,EAAE,IAAI,EAAE,SAAS,CAAC,WAAW,EAAE,OAAO,EAAE,mGAAmG,EAAE;IACvK,EAAE,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,uDAAuD,EAAE;IAClH,EAAE,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,+DAA+D,EAAE;IAC1H,EAAE,GAAG,EAAE,iBAAiB,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,4CAA4C,EAAE;IAC1G,EAAE,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,mEAAmE,EAAE;IAC/H,EAAE,GAAG,EAAE,qBAAqB,EAAE,IAAI,EAAE,SAAS,CAAC,WAAW,EAAE,OAAO,EAAE,kEAAkE,EAAE;CACzI,CAAC;AAEF,uBAAuB,CAAC,qBAAqB,CAAC,4BAA4B,EAAE,+BAA+B,CAAC,CAAC","sourcesContent":["import {\n  FrontendComponentType,\n  LabelKind,\n  type LabellingUnitaryDef,\n  registerComponentLabels,\n} from '@wildo-ai/presets-components-models';\n\n// Companion-only label metadata for the Settings Hub \"Billing\" panel (the\n// billing home). Statically scanned by the dev companion; NOT imported at\n// runtime, so it never ships in the browser bundle. The billing WIDGETS the\n// panel composes own their own label namespaces (subscription status, pricing\n// table, usage dashboard, invoice history, portal link) — only the panel's\n// framing copy lives here.\nexport const AppLayoutsBillingSettingsLabels: LabellingUnitaryDef[] = [\n  { ref: 'pageTitle', kind: LabelKind.HEADING, purpose: 'Page title of the billing settings panel (the billing home)' },\n  { ref: 'pageDescription', kind: LabelKind.DESCRIPTION, purpose: 'One-sentence framing under the billing page title: manage the plan, monitor usage, review invoices' },\n  { ref: 'subscriptionHeading', kind: LabelKind.HEADING, purpose: 'Card heading over the current subscription status widget' },\n  { ref: 'manageHeading', kind: LabelKind.HEADING, purpose: 'Card heading over the billing-provider portal link (payment methods, renewals)' },\n  { ref: 'manageDescription', kind: LabelKind.DESCRIPTION, purpose: 'Explains that the provider portal is where payment details, renewals and plan changes are managed' },\n  { ref: 'plansHeading', kind: LabelKind.HEADING, purpose: 'Card heading over the plan comparison / pricing table' },\n  { ref: 'usageHeading', kind: LabelKind.HEADING, purpose: 'Card heading over the metered usage and credit-pool dashboard' },\n  { ref: 'invoicesHeading', kind: LabelKind.HEADING, purpose: 'Card heading over the invoice history list' },\n  { ref: 'disabledTitle', kind: LabelKind.HEADING, purpose: 'Heading shown when billing is not enabled for the current runtime' },\n  { ref: 'disabledDescription', kind: LabelKind.DESCRIPTION, purpose: 'Explains that billing is currently disabled for this application' },\n];\n\nregisterComponentLabels(FrontendComponentType.APP_LAYOUTS_BILLING_SETTINGS, AppLayoutsBillingSettingsLabels);\n"]}
+{"version":3,"file":"AppPage_BillingSettings.labels.js","sourceRoot":"","sources":["../../../../../src/components/settings/AppPage_BillingSettings.labels.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,SAAS,EAET,uBAAuB,GACxB,MAAM,qCAAqC,CAAC;AAE7C,0EAA0E;AAC1E,0EAA0E;AAC1E,4EAA4E;AAC5E,8EAA8E;AAC9E,2EAA2E;AAC3E,2BAA2B;AAC3B,MAAM,CAAC,MAAM,+BAA+B,GAA0B;IACpE,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,6DAA6D,EAAE;IACrH,EAAE,GAAG,EAAE,iBAAiB,EAAE,IAAI,EAAE,SAAS,CAAC,WAAW,EAAE,OAAO,EAAE,oGAAoG,EAAE;IACtK,EAAE,GAAG,EAAE,qBAAqB,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,0DAA0D,EAAE;IAC5H,EAAE,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,gFAAgF,EAAE;IAC5I,EAAE,GAAG,EAAE,mBAAmB,EAAE,IAAI,EAAE,SAAS,CAAC,WAAW,EAAE,OAAO,EAAE,mGAAmG,EAAE;IACvK,EAAE,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,uDAAuD,EAAE;IAClH,EAAE,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,+DAA+D,EAAE;IAC1H,EAAE,GAAG,EAAE,iBAAiB,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,4CAA4C,EAAE;IAC1G,EAAE,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,mEAAmE,EAAE;IAC/H,EAAE,GAAG,EAAE,qBAAqB,EAAE,IAAI,EAAE,SAAS,CAAC,WAAW,EAAE,OAAO,EAAE,kEAAkE,EAAE;CACzI,CAAC;AAEF,uBAAuB,CAAC,qBAAqB,CAAC,4BAA4B,EAAE,+BAA+B,CAAC,CAAC","sourcesContent":["import {\n  FrontendComponentType,\n  LabelKind,\n  type LabellingUnitaryDef,\n  registerComponentLabels,\n} from '@wildo-ai/presets-components-models';\n\n// Companion-only label metadata for the Settings Hub \"Billing\" panel (the\n// billing home). Statically scanned by the dev companion; NOT imported at\n// runtime, so it never ships in the browser bundle. The billing WIDGETS the\n// panel composes own their own label namespaces (subscription status, pricing\n// table, usage dashboard, invoice history, portal link) — only the panel's\n// framing copy lives here.\nexport const AppLayoutsBillingSettingsLabels: LabellingUnitaryDef[] = [\n  { ref: 'pageTitle', kind: LabelKind.HEADING, purpose: 'Page title of the billing settings panel (the billing home)' },\n  { ref: 'pageDescription', kind: LabelKind.DESCRIPTION, purpose: 'One-sentence framing under the billing page title: manage the plan, monitor usage, review invoices' },\n  { ref: 'subscriptionHeading', kind: LabelKind.HEADING, purpose: 'Card heading over the current subscription status widget' },\n  { ref: 'manageHeading', kind: LabelKind.HEADING, purpose: 'Card heading over the billing-provider portal link (payment methods, renewals)' },\n  { ref: 'manageDescription', kind: LabelKind.DESCRIPTION, purpose: 'Explains that the provider portal is where payment details, renewals and plan changes are managed' },\n  { ref: 'plansHeading', kind: LabelKind.HEADING, purpose: 'Card heading over the plan comparison / pricing table' },\n  { ref: 'usageHeading', kind: LabelKind.HEADING, purpose: 'Card heading over the metered usage and credit-pool dashboard' },\n  { ref: 'invoicesHeading', kind: LabelKind.HEADING, purpose: 'Card heading over the invoice history list' },\n  { ref: 'disabledTitle', kind: LabelKind.HEADING, purpose: 'Heading shown when billing is not enabled for the current runtime' },\n  { ref: 'disabledDescription', kind: LabelKind.DESCRIPTION, purpose: 'Explains that billing is currently disabled for this application' },\n];\n\nregisterComponentLabels(FrontendComponentType.APP_LAYOUTS_BILLING_SETTINGS, AppLayoutsBillingSettingsLabels);\n"]}

package/dist/esm/components/settings/AppPage_ConnectedAccountsSettings.d.ts

@@ -13,6 +13,11 @@
  * from that provider's own secrets contract. Both were free text until this panel existed, which is
  * how somebody ends up typing `secretSlug` into a box and storing a grant in a slot nothing reads.
  *
+ * So this panel is the ONLY place the application offers to add a credential. The list beside it hides
+ * its resource CREATE (`actionVisibility: HIDDEN`, no empty-state call to action) — for a while it kept
+ * the free-text form as a second door, and a slot the provider does not declare was refused with a
+ * message naming the valid ones that the form then reduced to a generic toast (#1040).
+ *
  * ## The flow follows the AUTH METHOD
  *
  * A connect surface cannot be one form. A vendor with an authorization flow gets the consent round
@@ -73,23 +78,18 @@ export declare const admissibleDelegationsForScope: (provider: ConnectableProvid
 /**
  * The target the start leg is given — assembled here so the shape is TESTABLE, not inlined.
  *
- * `ExternalProvider_ConnectionTargetSchema` refines two fields the panel cannot leave to be
- * inferred, and it refuses in BOTH directions:
- *
- * - a `USER`-delegated call MUST name `actingForUserId` — "a delegated call acts FOR someone, and
- *   the user it acts for is what makes it permissible";
- * - a `SERVICE` call MUST NOT, because naming a person there "reads as delegation the runtime will
- *   not perform, which is worse than an error: the call succeeds as the wrong identity".
+ * `ExternalProvider_ConnectionTargetSchema` decides `actingForUserId`, and it refuses in BOTH
+ * directions, through the one predicate `connectionTargetNamesActingUser`:
  *
- * The panel sent neither until 2026-09-10, so every `USER`-delegated connect answered
- * `400 VALIDATION_FAILED` — and that refusal names no field, so the screen could only report a
- * generic failure. It was invisible because the shape that WORKS is `SERVICE`-delegated: `USER` at
- * ORGANIZATION scope is what 75 of the harvested vendors declare, `asana` among them, and it is
- * exactly the half nobody had driven.
+ * - an APPLICATION × USER call MUST name the person the application's identity impersonates;
+ * - every other shape MUST NOT. For ORGANIZATION × USER — what 75 of the harvested vendors declare,
+ *   `asana` among them — the person is whoever LINKS the account: one member lends their own vendor
+ *   account to the whole organization (decision on wildo-ai/wildo-ai#18), so the grant, not the
+ *   call, fixes who it acts as. A USER-owned connection already names its person in `ownerId`.
  *
- * `actingForUserId` is the SIGNED-IN person and is independent of `ownerId`: a tenant-owned
- * connection acting for one of its members carries the organization in `ownerId` and the person
- * here. At USER scope the two coincide, which is why one field cannot serve both.
+ * History worth keeping: the panel once sent no `actingForUserId` at all, then (2026-09-10) sent the
+ * signed-in person for every USER delegation. The second fixed the connect and hid that the spend
+ * path refused the same shape, so a grant could be connected that nothing could use.
  *
  * `ownerId` is omitted for APPLICATION, which the schema likewise refuses — "an application-owned
  * connection has exactly one instance, so an ownerId here names something that does not exist".
@@ -108,6 +108,16 @@ export declare const buildConnectionTarget: (input: {
     ownerId?: string;
     actingForUserId?: string;
 };
+/**
+ * The scopes a connection will REQUEST, as a person reads them before consenting (#991 review F12).
+ *
+ * A declared scope can carry a placeholder — Dataverse's `{hostUrl}/.default`, Outlook's `{accessMode}` —
+ * and shown raw the list promised the literal brace. So a placeholder the person has ANSWERED below is
+ * replaced by that answer, exactly as the start route resolves it, and one not yet answered is replaced
+ * by the authored `pendingLabel`. Every other scope stays VERBATIM: it is the vendor's own token and the
+ * string its consent screen is about to show, and no text is invented for it.
+ */
+export declare const describeRequestedScopes: (scopes: readonly string[], answers: Readonly<Record<string, string>>, pendingLabel: string) => string[];
 export interface ConnectedAccountsSettingsProps {
     /**
      * WHOSE account is being connected.

package/dist/esm/components/settings/AppPage_ConnectedAccountsSettings.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AppPage_ConnectedAccountsSettings.d.ts","sourceRoot":"","sources":["../../../../src/components/settings/AppPage_ConnectedAccountsSettings.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,OAAO,KAA4D,MAAM,OAAO,CAAC;AAIjF,OAAO,EACL,0CAA0C,EAC1C,sCAAsC,EACvC,MAAM,sCAAsC,CAAC;AAS9C,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,mFAAmF,CAAC;AAS3F;;;;;;;;;GASG;AACH,eAAO,MAAM,uBAAuB,GAClC,WAAW,SAAS,uBAAuB,EAAE,EAC7C,YAAY,sCAAsC,KACjD,uBAAuB,EAExB,CAAC;AAEH;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,6BAA6B,GACxC,UAAU,uBAAuB,EACjC,YAAY,sCAAsC,KACjD,0CAA0C,EAY5C,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,eAAO,MAAM,qBAAqB,GAAI,OAAO;IAC3C,UAAU,EAAE,sCAAsC,CAAC;IACnD,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,UAAU,EAAE,0CAA0C,CAAC;IACvD,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B,KAAG;IACF,UAAU,EAAE,sCAAsC,CAAC;IACnD,UAAU,EAAE,0CAA0C,CAAC;IACvD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;CAUzB,CAAC;AA0CH,MAAM,WAAW,8BAA8B;IAC7C;;;;;OAKG;IACH,UAAU,EAAE,sCAAsC,CAAC;CACpD;AAED,eAAO,MAAM,iCAAiC,EAAE,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,8BAA8B,CAAC,CAia/F,CAAC"}
+{"version":3,"file":"AppPage_ConnectedAccountsSettings.d.ts","sourceRoot":"","sources":["../../../../../src/components/settings/AppPage_ConnectedAccountsSettings.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,OAAO,KAA4D,MAAM,OAAO,CAAC;AAIjF,OAAO,EACL,0CAA0C,EAC1C,sCAAsC,EAIvC,MAAM,sCAAsC,CAAC;AAU9C,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,mFAAmF,CAAC;AAa3F;;;;;;;;;GASG;AACH,eAAO,MAAM,uBAAuB,GAClC,WAAW,SAAS,uBAAuB,EAAE,EAC7C,YAAY,sCAAsC,KACjD,uBAAuB,EAExB,CAAC;AAEH;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,6BAA6B,GACxC,UAAU,uBAAuB,EACjC,YAAY,sCAAsC,KACjD,0CAA0C,EAY5C,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,qBAAqB,GAAI,OAAO;IAC3C,UAAU,EAAE,sCAAsC,CAAC;IACnD,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,UAAU,EAAE,0CAA0C,CAAC;IACvD,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B,KAAG;IACF,UAAU,EAAE,sCAAsC,CAAC;IACnD,UAAU,EAAE,0CAA0C,CAAC;IACvD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;CAUzB,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB,GAClC,QAAQ,SAAS,MAAM,EAAE,EACzB,SAAS,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EACzC,cAAc,MAAM,KACnB,MAAM,EAKP,CAAC;AA0CH,MAAM,WAAW,8BAA8B;IAC7C;;;;;OAKG;IACH,UAAU,EAAE,sCAAsC,CAAC;CACpD;AAED,eAAO,MAAM,iCAAiC,EAAE,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,8BAA8B,CAAC,CA0hB/F,CAAC"}

package/dist/esm/components/settings/AppPage_ConnectedAccountsSettings.js

@@ -14,6 +14,11 @@ import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-run
  * from that provider's own secrets contract. Both were free text until this panel existed, which is
  * how somebody ends up typing `secretSlug` into a box and storing a grant in a slot nothing reads.
  *
+ * So this panel is the ONLY place the application offers to add a credential. The list beside it hides
+ * its resource CREATE (`actionVisibility: HIDDEN`, no empty-state call to action) — for a while it kept
+ * the free-text form as a second door, and a slot the provider does not declare was refused with a
+ * message naming the valid ones that the form then reduced to a generic toast (#1040).
+ *
  * ## The flow follows the AUTH METHOD
  *
  * A connect surface cannot be one form. A vendor with an authorization flow gets the consent round
@@ -41,10 +46,11 @@ import { useCallback, useEffect, useMemo, useRef, useState } from 'react';
 import { z } from 'zod';
 import { ButtonSize, FrontendComponentType } from '@wildo-ai/presets-components-models';
 import { isWildoBackendError, ProviderAuthMethod, ProviderConnectabilityBlocker } from '@wildo-ai/saas-models';
-import { ExternalProvider_Connection_DelegationMode, ExternalProvider_Connection_OwnerScope, } from '@wildo-ai/external-connectors-models';
+import { ExternalProvider_Connection_DelegationMode, ExternalProvider_Connection_OwnerScope, ProviderOAuth2EndpointPlaceholderPosition, connectionLendsMemberAccountToOrganization, connectionTargetNamesActingUser, } from '@wildo-ai/external-connectors-models';
 import { Card, CardContent, CardHeader, CardTitle } from '../../components/sections/card.js';
 import { Button, ButtonVariants_Variant } from '../../components/actions/button.js';
 import { InputRoot } from '../../components/form/controls/input.js';
+import { Checkbox } from '../../components/form/controls/boolean/checkbox.js';
 import { Select } from '../../components/form/controls/enum/select.js';
 import { Text } from '../../components/typography/text.js';
 import { Alert, AlertDescription } from '../../components/overlays/containers/alert.js';
@@ -56,6 +62,10 @@ const COMPONENT = FrontendComponentType.APP_LAYOUTS_CONNECTED_ACCOUNTS_SETTINGS;
 const PROVIDER_REF_SCHEMA = z.string().min(1);
 /** The chooser's own shape. Its OPTIONS are the provider's declared delegations, never this. */
 const DELEGATION_SCHEMA = z.string().min(1);
+/** The organization-wide-use acknowledgement's shape: a statement a person either makes or does not. */
+const ACKNOWLEDGEMENT_SCHEMA = z.boolean();
+/** A host chosen from the provider's declared values — never empty once chosen. */
+const CONNECTION_PARAMETER_SCHEMA = z.string().min(1);
 /**
  * The providers connectable AT THIS SCOPE.
  *
@@ -104,23 +114,18 @@ export const admissibleDelegationsForScope = (provider, ownerScope) => {
 /**
  * The target the start leg is given — assembled here so the shape is TESTABLE, not inlined.
  *
- * `ExternalProvider_ConnectionTargetSchema` refines two fields the panel cannot leave to be
- * inferred, and it refuses in BOTH directions:
- *
- * - a `USER`-delegated call MUST name `actingForUserId` — "a delegated call acts FOR someone, and
- *   the user it acts for is what makes it permissible";
- * - a `SERVICE` call MUST NOT, because naming a person there "reads as delegation the runtime will
- *   not perform, which is worse than an error: the call succeeds as the wrong identity".
+ * `ExternalProvider_ConnectionTargetSchema` decides `actingForUserId`, and it refuses in BOTH
+ * directions, through the one predicate `connectionTargetNamesActingUser`:
  *
- * The panel sent neither until 2026-09-10, so every `USER`-delegated connect answered
- * `400 VALIDATION_FAILED` — and that refusal names no field, so the screen could only report a
- * generic failure. It was invisible because the shape that WORKS is `SERVICE`-delegated: `USER` at
- * ORGANIZATION scope is what 75 of the harvested vendors declare, `asana` among them, and it is
- * exactly the half nobody had driven.
+ * - an APPLICATION × USER call MUST name the person the application's identity impersonates;
+ * - every other shape MUST NOT. For ORGANIZATION × USER — what 75 of the harvested vendors declare,
+ *   `asana` among them — the person is whoever LINKS the account: one member lends their own vendor
+ *   account to the whole organization (decision on wildo-ai/wildo-ai#18), so the grant, not the
+ *   call, fixes who it acts as. A USER-owned connection already names its person in `ownerId`.
  *
- * `actingForUserId` is the SIGNED-IN person and is independent of `ownerId`: a tenant-owned
- * connection acting for one of its members carries the organization in `ownerId` and the person
- * here. At USER scope the two coincide, which is why one field cannot serve both.
+ * History worth keeping: the panel once sent no `actingForUserId` at all, then (2026-09-10) sent the
+ * signed-in person for every USER delegation. The second fixed the connect and hid that the spend
+ * path refused the same shape, so a grant could be connected that nothing could use.
  *
  * `ownerId` is omitted for APPLICATION, which the schema likewise refuses — "an application-owned
  * connection has exactly one instance, so an ownerId here names something that does not exist".
@@ -134,10 +139,26 @@ export const buildConnectionTarget = (input) => ({
     ...(input.ownerScope === ExternalProvider_Connection_OwnerScope.APPLICATION || input.ownerId === null
         ? {}
         : { ownerId: input.ownerId }),
-    ...(input.delegation === ExternalProvider_Connection_DelegationMode.USER && input.signedInUserId !== null
+    ...(connectionTargetNamesActingUser(input) && input.signedInUserId !== null
         ? { actingForUserId: input.signedInUserId }
         : {}),
 });
+/**
+ * The scopes a connection will REQUEST, as a person reads them before consenting (#991 review F12).
+ *
+ * A declared scope can carry a placeholder — Dataverse's `{hostUrl}/.default`, Outlook's `{accessMode}` —
+ * and shown raw the list promised the literal brace. So a placeholder the person has ANSWERED below is
+ * replaced by that answer, exactly as the start route resolves it, and one not yet answered is replaced
+ * by the authored `pendingLabel`. Every other scope stays VERBATIM: it is the vendor's own token and the
+ * string its consent screen is about to show, and no text is invented for it.
+ */
+export const describeRequestedScopes = (scopes, answers, pendingLabel) => scopes.map((scope) => {
+    const placeholder = /^\{([A-Za-z_][A-Za-z0-9_]*)\}/.exec(scope);
+    if (placeholder === null)
+        return scope;
+    const answer = (Object.hasOwn(answers, placeholder[1]) ? answers[placeholder[1]] : undefined)?.trim() ?? '';
+    return answer === '' ? pendingLabel : `${answer}${scope.slice(placeholder[0].length)}`;
+});
 /**
  * What the callback left in the URL on its way back. Read once — see the panel's mount.
  *
@@ -196,6 +217,8 @@ ownerScope = ExternalProvider_Connection_OwnerScope.USER, }) => {
     const [busy, setBusy] = useState(false);
     /** Set ONLY when the provider declares both delegations for this scope — otherwise derived. */
     const [delegationChoice, setDelegationChoice] = useState('');
+    /** The linking member's acknowledgement for a connection that lends their account to the organization. */
+    const [organizationWideUseAcknowledged, setOrganizationWideUseAcknowledged] = useState(false);
     /** Answers keyed by the slug the PROVIDER declared — never by a name somebody typed. */
     const [answers, setAnswers] = useState({});
     const [outcome, setOutcome] = useState(readReturnOutcome);
@@ -268,6 +291,19 @@ ownerScope = ExternalProvider_Connection_OwnerScope.USER, }) => {
         return () => { cancelled = true; };
     }, [t]);
     const available = useMemo(() => selectProvidersForScope(providers, ownerScope), [providers, ownerScope]);
+    /*
+     * WHICH disconnect notice is true here. `undefined` from an older backend counts as "cannot be
+     * told", which is the safe direction: it sends the person to check at the vendor, where the worst
+     * outcome is a wasted look rather than a belief that access ended when it did not.
+     */
+    const disconnectNoticeRef = useMemo(() => {
+        if (available.length === 0)
+            return 'disconnectNotice';
+        const told = available.filter((provider) => provider.revocationTellsVendor === true).length;
+        if (told === 0)
+            return 'disconnectNotice';
+        return told === available.length ? 'disconnectRevokesNotice' : 'disconnectMixedNotice';
+    }, [available]);
     /**
      * EVERY declared provider still missing part of its configuration — not just the selected one.
      *
@@ -292,6 +328,9 @@ ownerScope = ExternalProvider_Connection_OwnerScope.USER, }) => {
         setSelectedRef(ref);
         setAnswers({});
         setDelegationChoice('');
+        // An acknowledgement is about ONE provider's account; carrying it to the next would be consent to
+        // something the person has not read.
+        setOrganizationWideUseAcknowledged(false);
         setError(null);
     }, []);
     /**
@@ -306,6 +345,12 @@ ownerScope = ExternalProvider_Connection_OwnerScope.USER, }) => {
         ? delegations[0]
         : delegations.find((candidate) => candidate === delegationChoice);
     const [savedNotice, setSavedNotice] = useState(null);
+    /**
+     * Whether connecting lends the signed-in member's OWN account to the whole organization — and so
+     * owes their acknowledgement before the connect may run. Same predicate the connect leg enforces.
+     */
+    const lendsAccountToOrganization = delegation !== undefined
+        && connectionLendsMemberAccountToOrganization({ ownerScope, delegation });
     /**
      * The two acts behind one button, branching on the provider's own auth method.
      *
@@ -326,7 +371,11 @@ ownerScope = ExternalProvider_Connection_OwnerScope.USER, }) => {
         const target = buildConnectionTarget({ ownerScope, ownerId, delegation, signedInUserId: user?._id ?? null });
         try {
             if (selected.authMethods?.includes(ProviderAuthMethod.OAUTH2_AUTHORIZATION_CODE) ?? false) {
-                const { authorizeUrl } = await getManualCallsHttpClient().startProviderConnection(selected.providerRef, { target, connectionParameters: answers });
+                const { authorizeUrl } = await getManualCallsHttpClient().startProviderConnection(selected.providerRef, {
+                    target,
+                    connectionParameters: answers,
+                    ...(lendsAccountToOrganization ? { acknowledgesOrganizationWideUse: organizationWideUseAcknowledged } : {}),
+                });
                 // The browser leaves. No state is set afterwards: this component is about to be unmounted by
                 // a navigation, and a `setState` here would be a React warning on the way out.
                 window.location.href = authorizeUrl;
@@ -337,7 +386,17 @@ ownerScope = ExternalProvider_Connection_OwnerScope.USER, }) => {
             // thing for the screen to do.
             const declared = new Set((selected.credentialFields ?? []).map((field) => field.slug));
             const values = Object.fromEntries(Object.entries(answers).filter(([slug, value]) => declared.has(slug) && value.trim() !== ''));
-            await getManualCallsHttpClient().storeProviderCredential(selected.providerRef, { target, values });
+            // The REST base URL's own answers, apart from the credential (#1097) — which subdomain, which
+            // workspace host. Not secrets; the route admits each against the provider's host allowance
+            // before anything is written, and refuses a missing one by name.
+            const asked = new Set(selected.connectionParameters ?? []);
+            const connectionParameters = Object.fromEntries(Object.entries(answers).filter(([name, value]) => asked.has(name) && value.trim() !== ''));
+            await getManualCallsHttpClient().storeProviderCredential(selected.providerRef, {
+                target,
+                values,
+                ...(Object.keys(connectionParameters).length === 0 ? {} : { connectionParameters }),
+                ...(lendsAccountToOrganization ? { acknowledgesOrganizationWideUse: organizationWideUseAcknowledged } : {}),
+            });
             // The typed values are cleared once stored. They are secrets, and a form that keeps them
             // on screen after they have been sealed is holding them for no reason.
             setAnswers({});
@@ -350,7 +409,7 @@ ownerScope = ExternalProvider_Connection_OwnerScope.USER, }) => {
             setError(t('errorGeneric'));
             setBusy(false);
         }
-    }, [answers, delegation, ownerId, ownerScope, selected, t, user?._id]);
+    }, [answers, delegation, lendsAccountToOrganization, organizationWideUseAcknowledged, ownerId, ownerScope, selected, t, user?._id]);
     if (!isReady)
         return null;
     const providerOptions = available.map((provider) => ({
@@ -362,25 +421,47 @@ ownerScope = ExternalProvider_Connection_OwnerScope.USER, }) => {
     const oauth2 = selected?.authMethods?.includes(ProviderAuthMethod.OAUTH2_AUTHORIZATION_CODE) ?? false;
     const missing = selected?.missingRegistration ?? [];
     const parameters = selected?.connectionParameters ?? [];
+    const parameterChoices = selected?.connectionParameterChoices ?? {};
     const credentialFields = selected?.credentialFields ?? [];
     /** What the authorization will REQUEST — rendered before the button, never only after consent. */
     const scopes = selected?.scopes ?? [];
-    const unanswered = (oauth2 ? parameters : credentialFields.filter((f) => f.required).map((f) => f.slug))
+    // Every asked connection parameter is required on BOTH paths (#1097): a base-URL placeholder is a hole
+    // in the address every call dials, exactly as an endpoint placeholder is a hole in the vendor's URLs.
+    const unanswered = [...parameters, ...(oauth2 ? [] : credentialFields.filter((f) => f.required).map((f) => f.slug))]
         .some((key) => (answers[key] ?? '').trim() === '');
     return (_jsxs("div", { className: "flex flex-col gap-section", children: [_jsxs("div", { className: "flex flex-col gap-item-xs", children: [_jsx("h3", { className: "text-base font-semibold tracking-tight", children: t('pageTitle') }), _jsx(Text, { className: "text-sm text-muted-foreground", children: t('pageDescription') })] }), outcome.connected !== undefined && (_jsx(Alert, { children: _jsx(AlertDescription, { children: t('connectedNotice') }) })), outcome.connectionError === 'declined' && (_jsx(Alert, { children: _jsx(AlertDescription, { children: t('declinedNotice') }) })), outcome.connectionError !== undefined && outcome.connectionError !== 'declined' && (_jsx(Alert, { variant: "destructive", children: _jsx(AlertDescription, { children: t('failedNotice') }) })), savedNotice && _jsx(Alert, { children: _jsx(AlertDescription, { children: savedNotice }) }), error && _jsx(Alert, { variant: "destructive", children: _jsx(AlertDescription, { children: error }) }), configurationGaps.length > 0 && (_jsx(Alert, { variant: "destructive", children: _jsx(AlertDescription, { children: _jsxs("div", { className: "flex flex-col gap-item-xs", children: [_jsx(Text, { className: "text-sm font-medium", children: t('configurationGapsHeading') }), _jsx(Text, { className: "text-xs", children: t('configurationGapsDescription') }), _jsx("ul", { className: "list-disc pl-4", children: configurationGaps.map((gap) => (_jsxs("li", { className: "text-xs", children: [gap.providerRef, ': ', gap.envVarNames.join(', ')] }, gap.providerRef))) })] }) }) })), _jsxs(Card, { children: [_jsx(CardHeader, { children: _jsx(CardTitle, { children: t('chooseProviderHeading') }) }), _jsxs(CardContent, { className: "flex flex-col gap-group", children: [loading ? (_jsx(Text, { className: "text-sm text-muted-foreground", children: t('loading') })) : providerOptions.length === 0 ? (_jsx(Text, { className: "text-sm text-muted-foreground", children: t('empty') })) : (_jsxs(_Fragment, { children: [_jsx(Select, { name: "providerRef", schema: PROVIDER_REF_SCHEMA, options: providerOptions, value: selectedRef, placeholder: t('choosePlaceholder'), onChange: chooseProvider }), selected !== undefined && (_jsxs("div", { className: "flex flex-col gap-group", children: [missing.length > 0 && (_jsx(Alert, { variant: "destructive", children: _jsxs(AlertDescription, { children: [t('notRegisteredNotice'), ' ', missing.map((slot) => slot.envVarName).join(', ')] }) })), !oauth2 && missing.length === 0 && (_jsx(Text, { className: "text-xs text-muted-foreground", children: t('pastedCredentialNotice') })), delegations.length > 1 && (_jsxs("div", { className: "flex flex-col gap-item-xs", children: [_jsx(Text, { className: "text-sm font-medium", children: t('delegationHeading') }), _jsx(Text, { className: "text-xs text-muted-foreground", children: t('delegationDescription') }), _jsx(Select, { name: "delegation", schema: DELEGATION_SCHEMA, options: delegations.map((mode) => ({
                                                             value: mode,
                                                             label: t(mode === ExternalProvider_Connection_DelegationMode.SERVICE
                                                                 ? 'delegationServiceOption'
                                                                 : 'delegationUserOption'),
-                                                        })), value: delegationChoice, placeholder: t('delegationPlaceholder'), onChange: setDelegationChoice })] })), oauth2 && scopes.length > 0 && (_jsxs(Text, { className: "text-xs text-muted-foreground", children: [t('scopesPrefix'), ' ', scopes.join(', ')] })), (oauth2 ? parameters.length > 0 : credentialFields.length > 0) && (_jsxs("div", { className: "flex flex-col gap-item-xs", children: [_jsx(Text, { className: "text-sm font-medium", children: t('parametersHeading') }), _jsx(Text, { className: "text-xs text-muted-foreground", children: t('parametersDescription') })] })), (oauth2
-                                                ? parameters.map((name) => ({ key: name, label: name, description: undefined }))
-                                                : credentialFields.map((field) => ({ key: field.slug, label: field.slug, description: field.description }))).map((field) => (_jsxs("div", { className: "flex flex-col gap-item-xs", children: [_jsx(Text, { className: "text-sm font-medium", children: field.label }), field.description !== undefined && (_jsx(Text, { className: "text-xs text-muted-foreground", children: field.description })), _jsx(InputRoot, { "aria-label": field.label, 
-                                                        // A credential is typed into a password field; a connection parameter — which
-                                                        // cloud, which directory — is not a secret and is shown.
-                                                        type: oauth2 ? 'text' : 'password', value: answers[field.key] ?? '', onChange: (event) => setAnswers((previous) => ({ ...previous, [field.key]: event.target.value })) })] }, field.key))), _jsx("div", { className: "flex justify-end", children: _jsx(Button, { size: ButtonSize.SM, variant: ButtonVariants_Variant.DEFAULT, disabled: busy
+                                                        })), value: delegationChoice, placeholder: t('delegationPlaceholder'), onChange: (mode) => {
+                                                            setDelegationChoice(mode);
+                                                            // An acknowledgement given for one delegation is not consent to another:
+                                                            // switching away and back must ask again.
+                                                            setOrganizationWideUseAcknowledged(false);
+                                                        } })] })), oauth2 && scopes.length > 0 && (_jsxs(Text, { className: "text-xs text-muted-foreground", children: [t('scopesPrefix'), ' ', describeRequestedScopes(scopes, answers, t('scopeChosenBelow')).join(', ')] })), (parameters.length > 0 || (!oauth2 && credentialFields.length > 0)) && (_jsxs("div", { className: "flex flex-col gap-item-xs", children: [_jsx(Text, { className: "text-sm font-medium", children: t('parametersHeading') }), _jsx(Text, { className: "text-xs text-muted-foreground", children: t('parametersDescription') })] })), [
+                                                // The credential itself, for a typed one: a secret, so a password field.
+                                                ...(oauth2 ? [] : credentialFields.map((field) => ({ key: field.slug, label: field.slug, description: field.description, choices: undefined, secret: true }))),
+                                                // The placeholders — the endpoints' for an authorization flow, the REST base URL's for
+                                                // a typed credential (#1097): which cloud, which subdomain. Not secrets, and shown.
+                                                ...parameters.map((name) => ({ key: name, label: name, description: undefined, choices: parameterChoices[name], secret: false })),
+                                            ].map((field) => (_jsxs("div", { className: "flex flex-col gap-item-xs", children: [_jsx(Text, { className: "text-sm font-medium", children: field.label }), field.description !== undefined && (_jsx(Text, { className: "text-xs text-muted-foreground", children: field.description })), field.choices !== undefined && (field.choices.hostSuffixes ?? []).length === 0 ? (_jsx(Select, { name: field.key, schema: CONNECTION_PARAMETER_SCHEMA, options: field.choices.values.map((value) => ({ value, label: value })), value: answers[field.key] ?? '', onChange: (value) => setAnswers((previous) => ({ ...previous, [field.key]: value })) })) : (_jsxs(_Fragment, { children: [field.choices !== undefined && (_jsxs(Text, { className: "text-xs text-muted-foreground", children: [t('parameterAdmittedHostsPrefix'), ' ', [
+                                                                        ...field.choices.values,
+                                                                        ...(field.choices.hostSuffixes ?? []).map((suffix) => (field.choices?.position === ProviderOAuth2EndpointPlaceholderPosition.ORIGIN
+                                                                            ? `https://*${suffix}`
+                                                                            : `*${suffix}`)),
+                                                                    ].join(', ')] })), _jsx(InputRoot, { "aria-label": field.label, 
+                                                                // A credential is typed into a password field; a connection parameter — which
+                                                                // cloud, which directory — is not a secret and is shown.
+                                                                type: field.secret ? 'password' : 'text', value: answers[field.key] ?? '', onChange: (event) => setAnswers((previous) => ({ ...previous, [field.key]: event.target.value })) })] }))] }, field.key))), lendsAccountToOrganization && (_jsxs("div", { className: "flex items-start gap-item-xs", children: [_jsx(Checkbox, { name: "organizationWideUseAcknowledged", schema: ACKNOWLEDGEMENT_SCHEMA, checked: organizationWideUseAcknowledged, onCheckedChange: setOrganizationWideUseAcknowledged, "aria-describedby": "organization-wide-use-description" }), _jsxs("div", { className: "flex flex-col gap-item-xs", children: [_jsx(Text, { className: "text-sm font-medium", children: t('organizationWideUseAcknowledgement') }), _jsx(Text, { id: "organization-wide-use-description", className: "text-xs text-muted-foreground", children: t('organizationWideUseDescription') })] })] })), _jsx("div", { className: "flex justify-end", children: _jsx(Button, { size: ButtonSize.SM, variant: ButtonVariants_Variant.DEFAULT, disabled: busy
                                                         || ownerId === null
-                                                        || selected.notConnectableBecause === ProviderConnectabilityBlocker.APPLICATION_NOT_REGISTERED
+                                                        // Any blocker except NO_AUTHORIZATION_FLOW, which is the typed-credential path this
+                                                        // same button serves. An endpoint the provider cannot resolve (#623) refuses on
+                                                        // press whatever is typed, so the button must not invite the press.
+                                                        || (selected.notConnectableBecause !== undefined
+                                                            && selected.notConnectableBecause !== ProviderConnectabilityBlocker.NO_AUTHORIZATION_FLOW)
                                                         || unanswered
-                                                        || delegation === undefined, onClick: handleConnect, children: busy ? t('connectingButton') : t('connectButton') }) })] }))] })), _jsx(Text, { className: "text-xs text-muted-foreground", children: t('disconnectNotice') })] })] })] }));
+                                                        || delegation === undefined
+                                                        || (lendsAccountToOrganization && !organizationWideUseAcknowledged), onClick: handleConnect, children: busy ? t('connectingButton') : t('connectButton') }) })] }))] })), _jsx(Text, { className: "text-xs text-muted-foreground", children: t(disconnectNoticeRef) })] })] })] }));
 };
 //# sourceMappingURL=AppPage_ConnectedAccountsSettings.js.map