[antoinetoussaint-byte]

The shared datasource panel now offers the providers returned by the host catalog. Removing a provider removes its connect form; refusing one leaves it visible with the catalog's exact reason. Provider field keys, labels, help and required flags come from its descriptor, and the adapter uses the SDK's message descriptors to encode each AddSource config oneof.

Fixes #1238. This is the self-contained frontend delivery, independent of #1235's provider implementation; neither overlapping branch was modified.

Classification: fix at the owning SaaS UI client and panel. Reuses DatasourceService.GetDatasourceCatalog, AddSource, generated SDK descriptors, existing transport/auth bindings, layout primitives, loading timing, collection reads and installation completion. It adds no provider-field table, backend registry, admission rule or generated contract. Credentials are typed transient call inputs, cleared before submission and excluded from mutation caches and error rendering. Existing exports remain compatible; both new client methods are optional and no panel prop is required.

The follow-up removes the provider enum check from the catalog adapter. Installation support requires the descriptor's credential mode and matching SDK setup operations for its connector key. Catalog admission also gates installation-return redemption, not just rendering: a removed or refused provider cannot be redeemed or offered through that path. Tests cover removal while the return form is open as well as removal/refusal before it mounts.

Merged main's #1239 validation-library migration, preserving its schema changes and combining both sets of registry consumer assertions. UI packages are co-versioned at 0.13.1; the host derives its shared version from the package.

The Immutable module package failure was TestEveryWorkspaceGroupReadIsDeclared, not a version assertion. Its literal-accessor scan interpreted the DOM form helper's read("secret") and read("collection") as workspace configuration reads. Renaming that helper to fieldValue makes its actual responsibility explicit. No workspace read was removed, no dependency was fabricated, and no gate, exclusion or baseline was changed.

Documentation: packages/saas-ui/README.md describes catalog behavior, compatibility, credential handling, installation-return admission and wire-schema limits; ui-inventory.json registers the component and its admitting/refusing preview stories (both under module/services/frontend/code/).

Validation on the updated branch:

• codefly ci run --changed-file module/services/frontend/code/packages/saas-ui/src/datasources/catalog.ts --phase lint,compile,test: all three phases passed, including all 4,912 frontend tests and architecture/token/preview guards.
• GOWORK=off go test ./... in module/tools, package validation, declared generators without drift, and declared conformance suites passed. The Python suite used its declared test dependencies in an isolated environment. Two canonical archive builds produced identical tar, checksum and metadata files.
• npm run test:published-plugin-contract passed, including the fresh registry consumer's declarations, exports, rendering, styles, shared plugin context, schema validation, both unchanged panel-prop shapes, and a legacy injected client with neither new method.
• Naming (including manual review of added strings), boundaries, workspace integrity and kit-version checks passed. Author and committer use the requested no-reply identity.

Limits: no live external-provider connection or browser visual qualification was run. The separate older test-published-ui.mjs still fails during fresh installation because unconstrained peers select @hookform/resolvers@6 with conflicting optional effect dependencies; the gate’s registry harness uses its existing lockfile-derived resolution and passes. This PR does not make a refused host provider admissible; additional wire fields require a compatible SDK and are never silently dropped. No release or publication was performed. Landing uses the merge queue.