Phase2.5: Skill SetUp Process

src/app/api/admin/skills/pending/[id]/reject/route.ts

@@ -8,6 +8,7 @@ import {
 import { getPackageDef } from "@/lib/packages";
 import { listOrgUsers } from "@/lib/zitadel";
 import { sendSkillActivationRejectionEmail } from "@/lib/email";
+import { deletePackageSecrets } from "@/lib/openbao";
 
 /**
  * POST /api/admin/skills/pending/[id]/reject
@@ -79,6 +80,33 @@ export async function POST(
     );
   }
 
+  // Cleanup: if the package needed customer-provided secrets, the
+  // user submitted them BEFORE the gate fired (handleSubmitSecrets
+  // in PackageCard writes to OpenBao then PATCHes). Those secrets
+  // are now orphaned — the package never made it into spec, won't
+  // be re-attempted unless the user retries with fresh credentials.
+  // Best-effort delete: keep the OpenBao path clean, avoid stale
+  // creds lurking. Idempotent (404 is fine). Failure is logged but
+  // not propagated — the rejection itself already succeeded.
+  //
+  // We deliberately skip customProvisioning packages here. Those
+  // mint platform-side credentials via a dedicated endpoint and
+  // need symmetric deprovisioning (POST /[pkg.id] → DELETE
+  // /[pkg.id]). Calling deletePackageSecrets wouldn't revoke them
+  // — admin handles that path manually if the rejected request had
+  // already minted resources.
+  const def = getPackageDef(req.skillId);
+  if (def?.requiresSecrets && !def.customProvisioning) {
+    try {
+      await deletePackageSecrets(req.tenantName, req.skillId);
+    } catch (e) {
+      console.error(
+        `Failed to delete orphan secrets for ${req.tenantName}/${req.skillId} after reject:`,
+        e
+      );
+    }
+  }
+
   // Email the requester with the reason — best-effort.
   try {
     const orgUsers = await listOrgUsers(req.zitadelOrgId);

src/app/api/skills/requests/[id]/withdraw/route.ts

@@ -4,6 +4,8 @@ import {
   getSkillActivationRequestById,
   updateSkillActivationRequestStatus,
 } from "@/lib/db";
+import { getPackageDef } from "@/lib/packages";
+import { deletePackageSecrets } from "@/lib/openbao";
 
 /**
  * POST /api/skills/requests/[id]/withdraw
@@ -50,5 +52,23 @@ export async function POST(
       { status: 409 }
     );
   }
+
+  // Cleanup: same logic as reject — the user submitted secrets
+  // before the gate fired, and those are now orphaned in OpenBao.
+  // Best-effort delete; failure logged but not propagated. Skip
+  // customProvisioning packages (their deprovisioning is a
+  // separate, dedicated endpoint).
+  const def = getPackageDef(req.skillId);
+  if (def?.requiresSecrets && !def.customProvisioning) {
+    try {
+      await deletePackageSecrets(req.tenantName, req.skillId);
+    } catch (e) {
+      console.error(
+        `Failed to delete orphan secrets for ${req.tenantName}/${req.skillId} after withdraw:`,
+        e
+      );
+    }
+  }
+
   return NextResponse.json(updated);
 }

src/components/admin/billing/pricing-editor.tsx

@@ -34,6 +34,7 @@ export function PricingEditor({
   catalog,
 }: Props) {
   const t = useTranslations("adminBilling");
+  const tPackages = useTranslations("packages");
   const router = useRouter();
 
   // -- Platform pricing form ----------------------------------------------
@@ -78,12 +79,19 @@ export function PricingEditor({
     }
   };
 
-  // -- Skill pricing ------------------------------------------------------
+  // -- Package pricing ----------------------------------------------------
   // Server is authoritative — we don't keep an editable local copy of the
   // table; instead each action posts to the API and we router.refresh().
-  const [newSkillId, setNewSkillId] = useState(
-    catalog.find((c) => c.category === "skill")?.id ?? ""
-  );
+  //
+  // Naming carry-over: the underlying DB table is `skill_pricing` and the
+  // column is `skill_id`, dating from when only skills were priced. The
+  // model now applies to any PackageDef in the catalog regardless of
+  // category — core, channel, or skill. The state variable names below
+  // (newSkill*, addingSkill, etc.) retain the legacy "skill" prefix
+  // because renaming the entire surface for purely cosmetic reasons
+  // would create churn for no functional gain. Treat "skill" here as
+  // shorthand for "priced package".
+  const [newSkillId, setNewSkillId] = useState(catalog[0]?.id ?? "");
   const [newSkillPrice, setNewSkillPrice] = useState("0.10");
   const [newSkillSetupFee, setNewSkillSetupFee] = useState("0");
   const [addingSkill, setAddingSkill] = useState(false);
@@ -147,9 +155,16 @@ export function PricingEditor({
     }
   };
 
-  // Catalog filtered to skill-kind entries for the picker, but keeping
-  // existing pricing rows even if they reference non-skill packages.
-  const skillCatalogOptions = catalog.filter((c) => c.category === "skill");
+  // Pricing applies to any catalog entry regardless of category. Grouped
+  // dropdown sorts options by category for visual scanning — core,
+  // channel, and skill in a single picker.
+  const skillCatalogOptions = [...catalog].sort((a, b) => {
+    const order = { core: 0, channel: 1, skill: 2 } as Record<string, number>;
+    const ca = order[a.category] ?? 99;
+    const cb = order[b.category] ?? 99;
+    if (ca !== cb) return ca - cb;
+    return a.name.localeCompare(b.name);
+  });
   const catalogIndex = new Map(catalog.map((c) => [c.id, c]));
   const pricedIds = new Set(initialSkillPricing.map((s) => s.skillId));
 
@@ -260,7 +275,12 @@ export function PricingEditor({
                     <td className="py-2">
                       <div className="font-mono text-xs">{sp.skillId}</div>
                       {entry && (
-                        <div className="text-xs text-text-muted">{entry.name}</div>
+                        <div className="text-xs text-text-muted flex items-center gap-2">
+                          <span>{entry.name}</span>
+                          <span className="text-[10px] uppercase tracking-wider bg-surface-3 px-1.5 py-0.5 rounded">
+                            {entry.category}
+                          </span>
+                        </div>
                       )}
                     </td>
                     <td className="py-2 text-right">
@@ -311,13 +331,45 @@ export function PricingEditor({
               onChange={(e) => setNewSkillId(e.target.value)}
               className="mt-1 w-full px-3 py-2 rounded-md border border-border bg-surface-2 text-sm"
             >
-              {skillCatalogOptions
-                .filter((c) => !pricedIds.has(c.id))
-                .map((c) => (
-                  <option key={c.id} value={c.id}>
-                    {c.name} ({c.id})
-                  </option>
-                ))}
+              {(() => {
+                // Group available options by category for the picker.
+                // Already-priced packages are filtered out (admin
+                // edits those inline above).
+                const available = skillCatalogOptions.filter(
+                  (c) => !pricedIds.has(c.id)
+                );
+                const byCat = new Map<string, typeof available>();
+                for (const c of available) {
+                  if (!byCat.has(c.category)) byCat.set(c.category, []);
+                  byCat.get(c.category)!.push(c);
+                }
+                // Labels for the optgroups. Reuse the existing
+                // packages.categories.* scope which already has
+                // translations in all four locales.
+                const labels: Record<string, string> = {
+                  core: tPackages("categories.core"),
+                  channel: tPackages("categories.channels"),
+                  skill: tPackages("categories.skills"),
+                };
+                const order: Array<"core" | "channel" | "skill"> = [
+                  "core",
+                  "channel",
+                  "skill",
+                ];
+                return order.map((cat) => {
+                  const items = byCat.get(cat);
+                  if (!items || items.length === 0) return null;
+                  return (
+                    <optgroup key={cat} label={labels[cat] ?? cat}>
+                      {items.map((c) => (
+                        <option key={c.id} value={c.id}>
+                          {c.name} ({c.id})
+                        </option>
+                      ))}
+                    </optgroup>
+                  );
+                });
+              })()}
             </select>
           </label>
           <label className="w-28">

src/components/packages/package-card.tsx

@@ -240,11 +240,23 @@ export function PackageCard({
             <span className="text-[10px] text-text-muted">{t("packages.requiresApiKey")}</span>
           )}
           {/* Phase 2.5: pending or rejected request takes precedence
-              over the toggle. Approved/withdrawn never reach here. */}
+              over the toggle. Approved/withdrawn never reach here.
+              For packages that needed secrets, surface that they're
+              safely stored — the user might otherwise worry the
+              credentials they typed got lost when the activation
+              was deferred. */}
           {canEdit && activationRequest?.status === "pending" ? (
-            <div className="ml-auto flex items-center gap-2">
-              <span className="text-[10px] text-warning italic">
+            <div className="ml-auto flex flex-col items-end gap-1">
+              <span
+                className="text-[10px] text-warning italic"
+                title={pkg.requiresSecrets ? t("packages.credentialsSavedTip") : undefined}
+              >
                 {t("packages.manualReviewPending")}
+                {pkg.requiresSecrets && (
+                  <span className="text-text-muted ml-1 not-italic">
+                    · {t("packages.credentialsSaved")}
+                  </span>
+                )}
               </span>
               <button
                 onClick={withdrawRequest}

src/components/packages/skill-cost-dialog.tsx

@@ -70,15 +70,22 @@ export function SkillCostDialog({
             </div>
           )}
           {showDaily && (
+            /* Display reference monthly cost (daily × 30) plus the
+               actual daily rate as a sub-note. Billing is always
+               per UTC day enabled — partial months prorate to that
+               same daily rate, full months land at roughly the
+               figure shown (varies ±~3% by month length). */
             <div className="flex justify-between items-baseline">
               <div>
-                <div className="text-sm">{t("dailyPriceLabel")}</div>
+                <div className="text-sm">{t("monthlyPriceLabel")}</div>
                 <div className="text-xs text-text-muted">
-                  {t("dailyPriceNote")}
+                  {t("monthlyPriceNote", {
+                    daily: dailyPriceChf.toFixed(2),
+                  })}
                 </div>
               </div>
               <div className="text-sm font-mono">
-                CHF {dailyPriceChf.toFixed(2)} / {t("dayUnit")}
+                CHF {(dailyPriceChf * 30).toFixed(2)} / {t("monthUnit")}
               </div>
             </div>
           )}

src/lib/packages.ts

@@ -231,6 +231,7 @@ export const PACKAGE_CATALOG: PackageDef[] = [
   },
   {
     id: "gog",
+    requiresManualSetup: true,
     name: "Google Workspace (Gog)",
     descriptionKey: "packages.gog.description",
     requiresSecrets: true,

src/messages/de.json

@@ -287,7 +287,7 @@
       "clientSecretPlaceholder": "GOCSPX-…",
       "refreshTokenLabel": "Google OAuth Refresh-Token",
       "refreshTokenPlaceholder": "1//0g…",
-      "instructions": "Die Google-Workspace-Integration verwendet OAuth und erfordert derzeit manuelles Onboarding. Bitte eröffnen Sie ein Support-Ticket, um den Setup-Prozess zu starten — wir tauschen die Client-Zugangsdaten und ein Refresh-Token offline aus und aktivieren dann dieses Paket für Ihren Mandanten.",
+      "instructions": "Google Workspace nutzt OAuth. Erstellen Sie einen OAuth-Client in Ihrem Google-Cloud-Projekt, autorisieren Sie ihn mit den benötigten Scopes (Gmail, Kalender, Drive usw.) und fügen Sie die Zugangsdaten unten ein. Mit dem Absenden werden sie sicher gespeichert und Ihre Aktivierung zur Admin-Prüfung eingereiht — nach Genehmigung wird die Integration automatisch aktiviert.",
       "disclaimer": "Mit der Aktivierung der Google-Workspace-Integration autorisieren Sie PieCed, in Ihrem Namen auf Gmail, Kalender, Drive, Docs, Sheets und Kontakte zuzugreifen. Daten fliessen über die Google-APIs, vorbehaltlich der Google-Bedingungen."
     },
     "mail": {
@@ -315,7 +315,9 @@
     "manualReviewPending": "Manuelle Prüfung ausstehend",
     "withdraw": "Zurückziehen",
     "activationRejected": "Abgelehnt",
-    "tryAgain": "Erneut versuchen"
+    "tryAgain": "Erneut versuchen",
+    "credentialsSaved": "Zugangsdaten gespeichert",
+    "credentialsSavedTip": "Die eingegebenen Zugangsdaten sind sicher gespeichert und werden verwendet, sobald die Aktivierung vom Admin genehmigt wurde. Sie müssen sie nicht erneut eingeben."
   },
   "admin": {
     "title": "Plattform-Admin",
@@ -390,7 +392,7 @@
     "resumeRequestTooltip": "Reaktivierungsanfrage für einen bestehenden Tenant. Bei Genehmigung wird der Tenant wieder aktiviert; keine Provisionierung läuft.",
     "openclawTool": "OpenClaw-Versionen",
     "billingTool": "Abrechnung →",
-    "skillsQueueTool": "Skill-Warteschlange"
+    "skillsQueueTool": "Aktivierungs-Warteschlange"
   },
   "channelUsers": {
     "title": "Autorisierte Benutzer",
@@ -591,17 +593,17 @@
     "save": "Speichern",
     "saving": "Speichere…",
     "savedOk": "Gespeichert",
-    "skillPricingTitle": "Skill-Preise",
-    "skillPricingDesc": "Tagespreis pro Skill. Ein zu beliebigem Zeitpunkt an einem UTC-Tag aktivierter Skill zählt als ein abrechenbarer Tag.",
-    "skillCol": "Skill",
+    "skillPricingTitle": "Paket-Preise",
+    "skillPricingDesc": "Tagespreis und einmalige Einrichtungsgebühr für jedes Paket — Core, Kanal oder Skill. Die Preisgestaltung gilt für jeden Tenant, der das Paket aktiviert.",
+    "skillCol": "Paket",
     "dailyPriceCol": "Tagespreis",
     "actionsCol": "",
     "remove": "Entfernen",
-    "noSkillsPriced": "Noch keine Skills bepreist.",
-    "addSkillLabel": "Skill hinzufügen",
+    "noSkillsPriced": "Noch keine Pakete bepreist.",
+    "addSkillLabel": "Paket hinzufügen",
     "dailyPriceLabel": "Tagespreis",
     "add": "Hinzufügen",
-    "confirmDeleteSkillPrice": "Preis für {skill} entfernen?",
+    "confirmDeleteSkillPrice": "Preisgestaltung für {skill} entfernen? Bereits abgerechnete Zeiträume bleiben unberührt.",
     "clickToEdit": "Zum Bearbeiten klicken",
     "generateFormTitle": "Rechnung erstellen",
     "noOrgsToGenerate": "Keine Organisationen mit Tenants gefunden.",
@@ -667,17 +669,17 @@
     "intro": "Die Aktivierung von {skill} verursacht folgende Kosten:",
     "setupFeeLabel": "Einrichtungsgebühr",
     "setupFeeNote": "Einmalig, nur bei erster Aktivierung",
-    "dailyPriceLabel": "Tagespreis",
-    "dailyPriceNote": "Pro Kalendertag (UTC) berechnet, an dem der Skill aktiviert ist",
-    "dayUnit": "Tag",
+    "monthlyPriceLabel": "Monatspreis",
+    "monthlyPriceNote": "CHF {daily}/Tag aktiv; Teilmonate werden taggenau berechnet",
+    "monthUnit": "Monat",
     "disclaimer": "Diese Kosten erscheinen auf Ihrer nächsten Monatsrechnung. Mit der Bestätigung stimmen Sie ihnen zu.",
     "cancel": "Abbrechen",
     "confirm": "Bestätigen & aktivieren",
     "confirming": "Aktiviere…"
   },
   "adminSkills": {
-    "title": "Skill-Aktivierungs-Warteschlange",
-    "subtitle": "Kundenanfragen für Skills, die manuelle plattformseitige Einrichtung benötigen. Genehmigen, sobald die Konfiguration steht; ablehnen mit Grund, wenn die Aktivierung nicht möglich ist.",
+    "title": "Aktivierungs-Warteschlange",
+    "subtitle": "Kundenanfragen für Pakete, die manuelle plattformseitige Einrichtung benötigen. Genehmigen, sobald die Konfiguration steht; ablehnen mit Grund, wenn die Aktivierung nicht möglich ist.",
     "backToAdmin": "Zurück zur Verwaltung",
     "emptyQueue": "Keine ausstehenden Skill-Aktivierungsanfragen.",
     "requestedAtCol": "Angefragt",

src/messages/en.json

@@ -287,7 +287,7 @@
       "clientSecretPlaceholder": "GOCSPX-…",
       "refreshTokenLabel": "Google OAuth Refresh Token",
       "refreshTokenPlaceholder": "1//0g…",
-      "instructions": "Google Workspace integration uses OAuth and requires manual onboarding for now. Please open a support ticket to start the setup — we'll exchange the client credentials and a refresh token offline, then enable this package on your tenant.",
+      "instructions": "Google Workspace uses OAuth. Create an OAuth client in your Google Cloud project, authorize it with the scopes you need (Gmail, Calendar, Drive, etc.), then paste the credentials below. Submission stores them securely and queues your activation for admin review — once approved, the integration activates automatically.",
       "disclaimer": "By enabling Google Workspace integration you authorize PieCed to access Gmail, Calendar, Drive, Docs, Sheets, and Contacts on your behalf. Data flows through Google's APIs subject to Google's terms."
     },
     "mail": {
@@ -315,7 +315,9 @@
     "manualReviewPending": "Manual review pending",
     "withdraw": "Withdraw",
     "activationRejected": "Rejected",
-    "tryAgain": "Try again"
+    "tryAgain": "Try again",
+    "credentialsSaved": "credentials saved",
+    "credentialsSavedTip": "The credentials you entered are securely stored and will be used as soon as admin approves the activation. You don't need to re-enter them."
   },
   "admin": {
     "title": "Platform Admin",
@@ -390,7 +392,7 @@
     "resumeRequestTooltip": "Reactivation request for an existing tenant. Approving will un-suspend the tenant; no provisioning runs.",
     "openclawTool": "OpenClaw versions",
     "billingTool": "Billing →",
-    "skillsQueueTool": "Skills Queue"
+    "skillsQueueTool": "Activation Queue"
   },
   "channelUsers": {
     "title": "Authorized Users",
@@ -591,17 +593,17 @@
     "save": "Save",
     "saving": "Saving…",
     "savedOk": "Saved",
-    "skillPricingTitle": "Skill pricing",
-    "skillPricingDesc": "Per-skill daily price. A skill enabled at any point during a UTC day counts as one billable day.",
-    "skillCol": "Skill",
+    "skillPricingTitle": "Package pricing",
+    "skillPricingDesc": "Set per-day rate and one-time setup fee for any package — core, channel, or skill. Pricing applies to every tenant that enables the package.",
+    "skillCol": "Package",
     "dailyPriceCol": "Daily price",
     "actionsCol": "",
     "remove": "Remove",
-    "noSkillsPriced": "No skills are priced yet.",
-    "addSkillLabel": "Add skill",
+    "noSkillsPriced": "No packages priced yet.",
+    "addSkillLabel": "Add package",
     "dailyPriceLabel": "Daily price",
     "add": "Add",
-    "confirmDeleteSkillPrice": "Remove pricing for {skill}?",
+    "confirmDeleteSkillPrice": "Remove pricing for {skill}? Already-billed periods are unaffected.",
     "clickToEdit": "Click to edit",
     "generateFormTitle": "Generate invoice",
     "noOrgsToGenerate": "No organizations with tenants found.",
@@ -667,17 +669,17 @@
     "intro": "Activating {skill} will incur the following charges:",
     "setupFeeLabel": "Setup fee",
     "setupFeeNote": "One-time, charged on first activation only",
-    "dailyPriceLabel": "Daily price",
-    "dailyPriceNote": "Charged for each calendar day (UTC) the skill is enabled",
-    "dayUnit": "day",
+    "monthlyPriceLabel": "Monthly price",
+    "monthlyPriceNote": "CHF {daily}/day enabled; partial months prorated by day",
+    "monthUnit": "month",
     "disclaimer": "These charges appear on your next monthly invoice. By confirming you agree to incur them.",
     "cancel": "Cancel",
     "confirm": "Confirm & activate",
     "confirming": "Activating…"
   },
   "adminSkills": {
-    "title": "Skill activation queue",
-    "subtitle": "Customer requests to activate skills that need manual platform-side setup. Approve once configuration is in place; reject with a reason if the activation can't proceed.",
+    "title": "Activation queue",
+    "subtitle": "Customer requests to activate packages that need manual platform-side setup. Approve once configuration is in place; reject with a reason if the activation can't proceed.",
     "backToAdmin": "Back to Admin",
     "emptyQueue": "No pending skill activation requests.",
     "requestedAtCol": "Requested",

src/messages/fr.json

@@ -287,7 +287,7 @@
       "clientSecretPlaceholder": "GOCSPX-…",
       "refreshTokenLabel": "Jeton de rafraîchissement Google OAuth",
       "refreshTokenPlaceholder": "1//0g…",
-      "instructions": "L'intégration de Google Workspace utilise OAuth et nécessite actuellement une intégration manuelle. Veuillez ouvrir un ticket de support pour démarrer la configuration — nous échangerons hors ligne les identifiants client et un jeton de rafraîchissement, puis activerons ce package sur votre tenant.",
+      "instructions": "Google Workspace utilise OAuth. Créez un client OAuth dans votre projet Google Cloud, autorisez-le avec les scopes nécessaires (Gmail, Agenda, Drive, etc.), puis collez les identifiants ci-dessous. La soumission les stocke en sécurité et place votre activation dans la file de revue administrative — après approbation, l'intégration s'active automatiquement.",
       "disclaimer": "En activant l'intégration de Google Workspace, vous autorisez PieCed à accéder à Gmail, Agenda, Drive, Docs, Sheets et Contacts en votre nom. Les données transitent par les API de Google, soumises aux conditions de Google."
     },
     "mail": {
@@ -315,7 +315,9 @@
     "manualReviewPending": "Revue manuelle en attente",
     "withdraw": "Retirer",
     "activationRejected": "Refusée",
-    "tryAgain": "Réessayer"
+    "tryAgain": "Réessayer",
+    "credentialsSaved": "identifiants enregistrés",
+    "credentialsSavedTip": "Les identifiants saisis sont stockés en sécurité et seront utilisés dès l'approbation de l'activation par l'administrateur. Vous n'avez pas besoin de les ressaisir."
   },
   "admin": {
     "title": "Admin plateforme",
@@ -390,7 +392,7 @@
     "resumeRequestTooltip": "Demande de réactivation d'un locataire existant. L'approbation le réactivera ; aucun provisionnement ne s'exécute.",
     "openclawTool": "Versions OpenClaw",
     "billingTool": "Facturation →",
-    "skillsQueueTool": "File des skills"
+    "skillsQueueTool": "File d'activation"
   },
   "channelUsers": {
     "title": "Utilisateurs autorisés",
@@ -591,17 +593,17 @@
     "save": "Enregistrer",
     "saving": "Enregistrement…",
     "savedOk": "Enregistré",
-    "skillPricingTitle": "Tarifs des skills",
-    "skillPricingDesc": "Prix journalier par skill. Un skill activé à tout moment au cours d'une journée UTC compte comme un jour facturable.",
-    "skillCol": "Skill",
+    "skillPricingTitle": "Tarification des paquets",
+    "skillPricingDesc": "Tarif journalier et frais de configuration uniques pour chaque paquet — core, canal ou skill. La tarification s'applique à chaque tenant activant le paquet.",
+    "skillCol": "Paquet",
     "dailyPriceCol": "Prix/jour",
     "actionsCol": "",
     "remove": "Retirer",
-    "noSkillsPriced": "Aucun skill n'a encore de prix.",
-    "addSkillLabel": "Ajouter un skill",
+    "noSkillsPriced": "Aucun paquet tarifé.",
+    "addSkillLabel": "Ajouter un paquet",
     "dailyPriceLabel": "Prix/jour",
     "add": "Ajouter",
-    "confirmDeleteSkillPrice": "Retirer le prix pour {skill}?",
+    "confirmDeleteSkillPrice": "Supprimer la tarification de {skill} ? Les périodes déjà facturées ne sont pas affectées.",
     "clickToEdit": "Cliquer pour modifier",
     "generateFormTitle": "Générer une facture",
     "noOrgsToGenerate": "Aucune organisation avec tenants trouvée.",
@@ -667,17 +669,17 @@
     "intro": "L'activation de {skill} entraînera les frais suivants :",
     "setupFeeLabel": "Frais de configuration",
     "setupFeeNote": "Unique, facturé uniquement à la première activation",
-    "dailyPriceLabel": "Prix journalier",
-    "dailyPriceNote": "Facturé pour chaque jour calendaire (UTC) où le skill est activé",
-    "dayUnit": "jour",
+    "monthlyPriceLabel": "Prix mensuel",
+    "monthlyPriceNote": "CHF {daily}/jour actif ; mois partiels prorata journalier",
+    "monthUnit": "mois",
     "disclaimer": "Ces frais figureront sur votre prochaine facture mensuelle. En confirmant, vous acceptez de les engager.",
     "cancel": "Annuler",
     "confirm": "Confirmer & activer",
     "confirming": "Activation…"
   },
   "adminSkills": {
-    "title": "File d'activation des skills",
-    "subtitle": "Demandes clients d'activation de skills nécessitant une configuration manuelle côté plateforme. Approuver une fois la configuration en place ; refuser avec un motif si l'activation est impossible.",
+    "title": "File d'activation",
+    "subtitle": "Demandes clients d'activation de paquets nécessitant une configuration manuelle côté plateforme. Approuver une fois la configuration en place ; refuser avec un motif si l'activation est impossible.",
     "backToAdmin": "Retour à l'administration",
     "emptyQueue": "Aucune demande d'activation en attente.",
     "requestedAtCol": "Demandée le",

src/messages/it.json

@@ -287,7 +287,7 @@
       "clientSecretPlaceholder": "GOCSPX-…",
       "refreshTokenLabel": "Token di refresh Google OAuth",
       "refreshTokenPlaceholder": "1//0g…",
-      "instructions": "L'integrazione con Google Workspace utilizza OAuth e richiede attualmente un onboarding manuale. Apri un ticket di supporto per avviare la configurazione — scambieremo le credenziali del client e un token di refresh offline, quindi abiliteremo questo pacchetto sul tuo tenant.",
+      "instructions": "Google Workspace utilizza OAuth. Crea un client OAuth nel tuo progetto Google Cloud, autorizzalo con gli scope necessari (Gmail, Calendar, Drive, ecc.), quindi incolla le credenziali qui sotto. L'invio le memorizza in modo sicuro e mette in coda l'attivazione per la revisione amministrativa — dopo l'approvazione, l'integrazione si attiva automaticamente.",
       "disclaimer": "Abilitando l'integrazione con Google Workspace autorizzi PieCed ad accedere per tuo conto a Gmail, Calendar, Drive, Docs, Sheets e Contatti. I dati transitano attraverso le API di Google, soggetti ai termini di Google."
     },
     "mail": {
@@ -315,7 +315,9 @@
     "manualReviewPending": "Revisione manuale in attesa",
     "withdraw": "Ritira",
     "activationRejected": "Rifiutata",
-    "tryAgain": "Riprova"
+    "tryAgain": "Riprova",
+    "credentialsSaved": "credenziali salvate",
+    "credentialsSavedTip": "Le credenziali inserite sono memorizzate in modo sicuro e saranno utilizzate non appena l'attivazione viene approvata dall'amministratore. Non è necessario reinserirle."
   },
   "admin": {
     "title": "Admin piattaforma",
@@ -390,7 +392,7 @@
     "resumeRequestTooltip": "Richiesta di riattivazione di un tenant esistente. L'approvazione lo riattiverà; non viene eseguito alcun provisioning.",
     "openclawTool": "Versioni OpenClaw",
     "billingTool": "Fatturazione →",
-    "skillsQueueTool": "Coda skill"
+    "skillsQueueTool": "Coda di attivazione"
   },
   "channelUsers": {
     "title": "Utenti autorizzati",
@@ -591,17 +593,17 @@
     "save": "Salva",
     "saving": "Salvataggio…",
     "savedOk": "Salvato",
-    "skillPricingTitle": "Prezzi skill",
-    "skillPricingDesc": "Prezzo giornaliero per skill. Una skill attiva in qualsiasi momento di un giorno UTC conta come un giorno fatturabile.",
-    "skillCol": "Skill",
+    "skillPricingTitle": "Prezzi dei pacchetti",
+    "skillPricingDesc": "Tariffa giornaliera e spese di attivazione una tantum per qualsiasi pacchetto — core, canale o skill. La tariffazione si applica a ogni tenant che attiva il pacchetto.",
+    "skillCol": "Pacchetto",
     "dailyPriceCol": "Prezzo/giorno",
     "actionsCol": "",
     "remove": "Rimuovi",
-    "noSkillsPriced": "Nessuna skill ha ancora un prezzo.",
-    "addSkillLabel": "Aggiungi skill",
+    "noSkillsPriced": "Nessun pacchetto con prezzo.",
+    "addSkillLabel": "Aggiungi pacchetto",
     "dailyPriceLabel": "Prezzo/giorno",
     "add": "Aggiungi",
-    "confirmDeleteSkillPrice": "Rimuovere il prezzo per {skill}?",
+    "confirmDeleteSkillPrice": "Rimuovere la tariffazione per {skill}? I periodi già fatturati non sono influenzati.",
     "clickToEdit": "Clicca per modificare",
     "generateFormTitle": "Genera fattura",
     "noOrgsToGenerate": "Nessuna organizzazione con tenant trovata.",
@@ -667,17 +669,17 @@
     "intro": "L'attivazione di {skill} comporterà i seguenti costi:",
     "setupFeeLabel": "Spese di attivazione",
     "setupFeeNote": "Una tantum, addebitate solo alla prima attivazione",
-    "dailyPriceLabel": "Prezzo giornaliero",
-    "dailyPriceNote": "Addebitato per ogni giorno di calendario (UTC) in cui lo skill è attivato",
-    "dayUnit": "giorno",
+    "monthlyPriceLabel": "Prezzo mensile",
+    "monthlyPriceNote": "CHF {daily}/giorno attivo; mesi parziali calcolati al giorno",
+    "monthUnit": "mese",
     "disclaimer": "Questi costi appariranno sulla prossima fattura mensile. Confermando accetti di sostenerli.",
     "cancel": "Annulla",
     "confirm": "Conferma & attiva",
     "confirming": "Attivazione…"
   },
   "adminSkills": {
-    "title": "Coda di attivazione skill",
-    "subtitle": "Richieste dei clienti per attivare skill che richiedono configurazione manuale lato piattaforma. Approva quando la configurazione è pronta; rifiuta con motivazione se l'attivazione non è possibile.",
+    "title": "Coda di attivazione",
+    "subtitle": "Richieste dei clienti per attivare pacchetti che richiedono configurazione manuale lato piattaforma. Approva quando la configurazione è pronta; rifiuta con motivazione se l'attivazione non è possibile.",
     "backToAdmin": "Torna ad amministrazione",
     "emptyQueue": "Nessuna richiesta di attivazione skill in attesa.",
     "requestedAtCol": "Richiesta",