@cat-factory/app 0.110.3 → 0.111.0

package/app/composables/useUnsavedGuard.ts

@@ -0,0 +1,66 @@
+import { watch } from 'vue'
+import type { Ref } from 'vue'
+
+/**
+ * Guard a content-heavy modal against silently discarding unsaved input when the user
+ * dismisses it (Escape, backdrop click, or a Cancel button). Wire it into a controlled
+ * `UModal` whose `open` is a store-backed writable computed: route the setter's close and
+ * the Cancel button through `requestClose()` instead of closing directly.
+ *
+ * `snapshot()` returns a serialisable view of the user-facing form state. The baseline is
+ * captured every time the modal opens, so register this AFTER the component's own reset
+ * watcher — it then snapshots the *seeded* form (a prefill or an existing edit is the
+ * clean baseline, not a spurious change). A close request only prompts when the current
+ * snapshot diverges from that baseline; when nothing changed — or a submit is in flight —
+ * the close proceeds immediately, so the common path is unchanged.
+ *
+ * Keep `snapshot()` to stable, user-owned values: exclude fields mutated by async loads
+ * (they would read as dirty the instant a background fetch settles) and prefer stable ids
+ * over objects that a best-effort resolve rewrites in place.
+ */
+export function useUnsavedGuard(opts: {
+  /** The modal's open state (the writable computed's underlying getter). */
+  open: Ref<boolean>
+  /** A serialisable view of the current form state. */
+  snapshot: () => unknown
+  /** Actually close the modal (the store close action). */
+  close: () => void
+  /** True while a submit is in flight — a close is then a no-op (the submit closes itself). */
+  saving?: () => boolean
+}) {
+  const { confirm } = useConfirm()
+  const { t } = useI18n()
+
+  let baseline = serialize(opts.snapshot())
+  watch(opts.open, (isOpen) => {
+    if (isOpen) baseline = serialize(opts.snapshot())
+  })
+
+  function isDirty(): boolean {
+    return serialize(opts.snapshot()) !== baseline
+  }
+
+  async function requestClose(): Promise<void> {
+    // A submit in flight closes itself on success — don't interrupt it or prompt.
+    if (opts.saving?.()) return
+    if (!isDirty()) {
+      opts.close()
+      return
+    }
+    const discard = await confirm({
+      title: t('common.discard.title'),
+      description: t('common.discard.body'),
+      confirmLabel: t('common.discard.confirm'),
+      cancelLabel: t('common.discard.keep'),
+      variant: 'destructive',
+      icon: 'i-lucide-triangle-alert',
+    })
+    if (discard) opts.close()
+  }
+
+  return { requestClose, isDirty }
+}
+
+function serialize(value: unknown): string {
+  return JSON.stringify(value ?? null)
+}

package/app/stores/testSecrets.ts

@@ -0,0 +1,89 @@
+import { defineStore } from 'pinia'
+import { ref } from 'vue'
+import type { TestSecretRef, UpsertServiceTestSecretsInput } from '~/types/testSecrets'
+import { useWorkspaceStore } from '~/stores/workspace'
+import { apiErrorStatus } from '~/composables/api/errors'
+
+/**
+ * A service frame's SENSITIVE test secrets (a third-party token a Tester needs to
+ * exercise an integration). Sealed on the backend and delivered to the container out of
+ * band; the store only ever holds the non-secret refs (key + description) — values are
+ * write-only and never read back. Loaded on demand per service frame (the inspector
+ * panel), not from the snapshot, since the secrets never leave the server.
+ */
+export const useTestSecretsStore = defineStore('testSecrets', () => {
+  const api = useApi()
+
+  // Per service-frame block id → the configured secret refs (key + description).
+  const byBlock = ref<Record<string, TestSecretRef[]>>({})
+  const loading = ref(false)
+  // Mirrors the backend's opt-in gate (the controller 503s when ENCRYPTION_KEY is absent):
+  // `null` until first probed, then `true`/`false`. The inspector panel hides itself when
+  // this is false, so a deployment with no sealed-secret store doesn't surface a dead control.
+  const available = ref<boolean | null>(null)
+  const inFlight = new Map<string, Promise<void>>()
+
+  /** Force a refresh of one block's configured secret refs (used after a save/clear). */
+  async function load(blockId: string) {
+    const ws = useWorkspaceStore()
+    loading.value = true
+    try {
+      const view = await api.getServiceTestSecrets(ws.requireId(), blockId)
+      byBlock.value[blockId] = view.entries
+      available.value = true
+    } catch (err) {
+      if (apiErrorStatus(err) === 503) {
+        // A definitive 503 means the store is unconfigured (no encryption key on the
+        // backend): hide the UI entry point and stop probing.
+        available.value = false
+        byBlock.value[blockId] = []
+      }
+      // Any other failure (transient 5xx / network) is left untouched: it must not hide an
+      // already-available panel nor cache a false "unavailable". `available` stays `null`
+      // when never probed, so `ensureLoaded` remains retryable on the next open.
+    } finally {
+      loading.value = false
+    }
+  }
+
+  /**
+   * Load one block's refs once and share the result, coalescing concurrent callers for the
+   * SAME block. `load()` forces a refresh.
+   */
+  async function ensureLoaded(blockId: string) {
+    // Store known-unconfigured (a definitive 503) is a deployment-level fact — don't re-probe
+    // per service frame; the panel is hidden anyway.
+    if (available.value === false) return
+    if (byBlock.value[blockId] !== undefined) return
+    if (!inFlight.has(blockId)) {
+      inFlight.set(
+        blockId,
+        load(blockId).finally(() => inFlight.delete(blockId)),
+      )
+    }
+    return inFlight.get(blockId)
+  }
+
+  /** The configured refs for a block (empty until loaded). */
+  function entriesForBlock(blockId: string): TestSecretRef[] {
+    return byBlock.value[blockId] ?? []
+  }
+
+  /** Replace a service frame's full secret set (values write-only); empty set clears it. */
+  async function save(blockId: string, input: UpsertServiceTestSecretsInput) {
+    const ws = useWorkspaceStore()
+    const view = await api.setServiceTestSecrets(ws.requireId(), blockId, input)
+    byBlock.value[blockId] = view.entries
+    available.value = true
+    return view
+  }
+
+  /** Remove all of a service frame's secrets. */
+  async function clear(blockId: string) {
+    const ws = useWorkspaceStore()
+    await api.deleteServiceTestSecrets(ws.requireId(), blockId)
+    byBlock.value[blockId] = []
+  }
+
+  return { byBlock, loading, available, load, ensureLoaded, entriesForBlock, save, clear }
+})

package/app/types/testSecrets.ts

@@ -0,0 +1,15 @@
+// Sensitive per-service test-secret shapes (SEALED, write-only). A Tester needs these
+// to exercise a third-party integration (e.g. a Stripe API key). Sealed at rest on the
+// backend and injected into the Tester container OUT OF BAND — never rendered into a
+// prompt or the telemetry snapshot. The view returns only the configured keys +
+// descriptions (`TestSecretRef`); values are write-only and never read back.
+//
+// All wire shapes are sourced from @cat-factory/contracts (single source of truth).
+// See docs/initiatives/tester-environment-access.md (Slice C).
+
+export type {
+  TestSecretRef,
+  TestSecretEntry,
+  ServiceTestSecretsView,
+  UpsertServiceTestSecretsInput,
+} from '@cat-factory/contracts'

package/i18n/locales/de.json

@@ -973,6 +973,27 @@
       "clearFailed": "Zuordnung konnte nicht geleert werden",
       "configNoun": "die Release-Health-Konfiguration"
     },
+    "testSecrets": {
+      "title": "Test-Anmeldedaten (sensibel)",
+      "sectionHint": "Sensible Anmeldedaten, die der Tester benötigt, um ein von diesem Dienst genutztes Drittsystem anzusprechen, z. B. den API-Schlüssel eines Zahlungsanbieters. Sie werden verschlüsselt gespeichert und dem Tester als Umgebungsvariablen übergeben; sie erscheinen nie in Prompts oder Protokollen.",
+      "warning": "Dies sind echte, sensible Geheimnisse. Sie werden verschlüsselt gespeichert und dem Tester als Umgebungsvariablen übergeben, niemals in einem Prompt oder der Telemetrie des Laufs. Gib keine Produktionsdaten ein, die du nicht rotieren kannst.",
+      "replaceNote": "Beim Speichern wird der gesamte Satz für diesen Dienst ersetzt. Nimm jede Anmeldung auf, die du behalten möchtest, und gib ihren Wert erneut ein; alles Ausgelassene wird entfernt.",
+      "key": "Variablenname",
+      "keyInvalid": "Verwende Buchstaben, Ziffern und Unterstriche und beginne nicht mit einer Ziffer.",
+      "description": "Beschreibung",
+      "descriptionPlaceholder": "Wofür diese Anmeldung dient",
+      "value": "Wert",
+      "valuePlaceholder": "Geheimer Wert",
+      "addRow": "Anmeldung hinzufügen",
+      "removeRow": "Anmeldung entfernen",
+      "save": "Anmeldedaten speichern",
+      "clear": "Alle löschen",
+      "savedToast": "Test-Anmeldedaten gespeichert",
+      "saveFailed": "Test-Anmeldedaten konnten nicht gespeichert werden",
+      "clearFailed": "Test-Anmeldedaten konnten nicht gelöscht werden",
+      "configNoun": "die sensiblen Test-Anmeldedaten",
+      "duplicateKey": "Jeder Variablenname muss eindeutig sein."
+    },
     "testConfig": {
       "title": "Testinfrastruktur",
       "hint": "Wie eine Testumgebung für diesen Service aufgesetzt wird, wenn eine Pipeline ihn ausführen muss: keine Infrastruktur, eine Docker-Compose-Datei, Kubernetes-Manifeste oder ein benutzerdefinierter Manifesttyp.",
@@ -1217,7 +1238,8 @@
     "decision": {
       "title": "Entscheidung erforderlich",
       "agentOnBlock": "{agent} auf {block}",
-      "visualizationHint": "Dies ist eine Visualisierung. Jede Wahl setzt einfach die Pipeline fort."
+      "visualizationHint": "Dies ist eine Visualisierung. Jede Wahl setzt einfach die Pipeline fort.",
+      "resolveFailed": "Entscheidung konnte nicht gespeichert werden"
     },
     "stepRestart": {
       "restartFromStep": "Pipeline ab diesem Schritt neu starten",
@@ -3656,7 +3678,13 @@
     "undo": "Rückgängig",
     "back": "Zurück",
     "next": "Weiter",
-    "done": "Fertig"
+    "done": "Fertig",
+    "discard": {
+      "title": "Änderungen verwerfen?",
+      "body": "Du hast Änderungen vorgenommen, die noch nicht gespeichert wurden. Schließen und verlieren?",
+      "confirm": "Verwerfen",
+      "keep": "Weiter bearbeiten"
+    }
   },
   "clarification": {
     "answerPlaceholder": "Ihre Antwort",

package/i18n/locales/en.json

@@ -74,7 +74,13 @@
     "undo": "Undo",
     "back": "Back",
     "next": "Next",
-    "done": "Done"
+    "done": "Done",
+    "discard": {
+      "title": "Discard your changes?",
+      "body": "You've made changes that haven't been saved. Close this and lose them?",
+      "confirm": "Discard",
+      "keep": "Keep editing"
+    }
   },
   "clarification": {
     "answerPlaceholder": "Your answer",
@@ -717,6 +723,27 @@
       "clearFailed": "Could not clear the mapping",
       "configNoun": "the release health configuration"
     },
+    "testSecrets": {
+      "title": "Test credentials (sensitive)",
+      "sectionHint": "Sensitive credentials the Tester needs to exercise a third-party system this service depends on, e.g. a payment provider's API key. They are encrypted at rest and injected into the Tester's environment as variables; they are never shown in prompts or logs.",
+      "warning": "These are real, sensitive secrets. They are encrypted at rest and passed to the Tester as environment variables, never put in a prompt or the run's telemetry. Don't enter production credentials you can't rotate.",
+      "replaceNote": "Saving replaces the entire set for this service. Include every credential you want to keep and re-enter its value; anything left out is removed.",
+      "key": "Variable name",
+      "keyInvalid": "Use letters, digits and underscores, and don't start with a digit.",
+      "description": "Description",
+      "descriptionPlaceholder": "What this credential is for",
+      "value": "Value",
+      "valuePlaceholder": "Secret value",
+      "addRow": "Add credential",
+      "removeRow": "Remove credential",
+      "save": "Save credentials",
+      "clear": "Clear all",
+      "savedToast": "Test credentials saved",
+      "saveFailed": "Could not save the test credentials",
+      "clearFailed": "Could not clear the test credentials",
+      "configNoun": "the sensitive test credentials",
+      "duplicateKey": "Each variable name must be unique."
+    },
     "testConfig": {
       "title": "Test infrastructure",
       "hint": "How a test environment is stood up for this service when a pipeline needs to run it: no infrastructure, a Docker Compose file, Kubernetes manifests, or a custom manifest type.",
@@ -961,7 +988,8 @@
     "decision": {
       "title": "Decision required",
       "agentOnBlock": "{agent} on {block}",
-      "visualizationHint": "This is a visualization. Any choice simply resumes the pipeline."
+      "visualizationHint": "This is a visualization. Any choice simply resumes the pipeline.",
+      "resolveFailed": "Couldn't record your decision"
     },
     "stepRestart": {
       "restartFromStep": "Restart pipeline from this step",

package/i18n/locales/es.json

@@ -65,7 +65,13 @@
     "undo": "Deshacer",
     "back": "Atrás",
     "next": "Siguiente",
-    "done": "Listo"
+    "done": "Listo",
+    "discard": {
+      "title": "¿Descartar los cambios?",
+      "body": "Has hecho cambios que no se han guardado. ¿Cerrar y perderlos?",
+      "confirm": "Descartar",
+      "keep": "Seguir editando"
+    }
   },
   "clarification": {
     "answerPlaceholder": "Tu respuesta",
@@ -663,6 +669,27 @@
       "clearFailed": "No se pudo limpiar la asignación",
       "configNoun": "la configuración de salud de la versión"
     },
+    "testSecrets": {
+      "title": "Credenciales de prueba (sensibles)",
+      "sectionHint": "Credenciales sensibles que el Tester necesita para usar un sistema de terceros del que depende este servicio, p. ej. la clave de API de una pasarela de pago. Se almacenan cifradas y se inyectan en el entorno del Tester como variables; nunca se muestran en prompts ni en registros.",
+      "warning": "Son secretos reales y sensibles. Se almacenan cifrados y se pasan al Tester como variables de entorno, nunca en un prompt ni en la telemetría de la ejecución. No introduzcas credenciales de producción que no puedas rotar.",
+      "replaceNote": "Al guardar se reemplaza el conjunto completo de este servicio. Incluye cada credencial que quieras conservar y vuelve a introducir su valor; lo que se omita se elimina.",
+      "key": "Nombre de variable",
+      "keyInvalid": "Usa letras, dígitos y guiones bajos, y no empieces por un dígito.",
+      "description": "Descripción",
+      "descriptionPlaceholder": "Para qué sirve esta credencial",
+      "value": "Valor",
+      "valuePlaceholder": "Valor secreto",
+      "addRow": "Añadir credencial",
+      "removeRow": "Eliminar credencial",
+      "save": "Guardar credenciales",
+      "clear": "Borrar todo",
+      "savedToast": "Credenciales de prueba guardadas",
+      "saveFailed": "No se pudieron guardar las credenciales de prueba",
+      "clearFailed": "No se pudieron borrar las credenciales de prueba",
+      "configNoun": "las credenciales de prueba sensibles",
+      "duplicateKey": "Cada nombre de variable debe ser único."
+    },
     "testConfig": {
       "title": "Infraestructura de pruebas",
       "hint": "Cómo se levanta un entorno de prueba para este servicio cuando un pipeline necesita ejecutarlo: sin infraestructura, un archivo de Docker Compose, manifiestos de Kubernetes o un tipo de manifiesto personalizado.",
@@ -907,7 +934,8 @@
     "decision": {
       "title": "Se requiere una decisión",
       "agentOnBlock": "{agent} en {block}",
-      "visualizationHint": "Esto es una visualización. Cualquier elección simplemente reanuda el pipeline."
+      "visualizationHint": "Esto es una visualización. Cualquier elección simplemente reanuda el pipeline.",
+      "resolveFailed": "No se pudo registrar tu decisión"
     },
     "stepRestart": {
       "restartFromStep": "Reiniciar el pipeline desde este paso",

package/i18n/locales/fr.json

@@ -65,7 +65,13 @@
     "undo": "Annuler",
     "back": "Retour",
     "next": "Suivant",
-    "done": "Terminé"
+    "done": "Terminé",
+    "discard": {
+      "title": "Ignorer vos modifications ?",
+      "body": "Vous avez effectué des modifications non enregistrées. Fermer et les perdre ?",
+      "confirm": "Ignorer",
+      "keep": "Continuer l'édition"
+    }
   },
   "clarification": {
     "answerPlaceholder": "Votre réponse",
@@ -663,6 +669,27 @@
       "clearFailed": "Impossible d'effacer le mappage",
       "configNoun": "la configuration de santé de la version"
     },
+    "testSecrets": {
+      "title": "Identifiants de test (sensibles)",
+      "sectionHint": "Identifiants sensibles dont le Testeur a besoin pour solliciter un système tiers utilisé par ce service, par exemple la clé d'API d'un prestataire de paiement. Ils sont chiffrés au repos et injectés dans l'environnement du Testeur sous forme de variables ; ils n'apparaissent jamais dans les prompts ni les journaux.",
+      "warning": "Ce sont de vrais secrets sensibles. Ils sont chiffrés au repos et transmis au Testeur comme variables d'environnement, jamais dans un prompt ni dans la télémétrie de l'exécution. N'entrez pas d'identifiants de production que vous ne pouvez pas renouveler.",
+      "replaceNote": "L'enregistrement remplace l'ensemble complet pour ce service. Incluez chaque identifiant à conserver et saisissez à nouveau sa valeur ; tout ce qui est omis est supprimé.",
+      "key": "Nom de variable",
+      "keyInvalid": "Utilisez des lettres, des chiffres et des tirets bas, et ne commencez pas par un chiffre.",
+      "description": "Description",
+      "descriptionPlaceholder": "À quoi sert cet identifiant",
+      "value": "Valeur",
+      "valuePlaceholder": "Valeur secrète",
+      "addRow": "Ajouter un identifiant",
+      "removeRow": "Supprimer l'identifiant",
+      "save": "Enregistrer les identifiants",
+      "clear": "Tout effacer",
+      "savedToast": "Identifiants de test enregistrés",
+      "saveFailed": "Impossible d'enregistrer les identifiants de test",
+      "clearFailed": "Impossible d'effacer les identifiants de test",
+      "configNoun": "les identifiants de test sensibles",
+      "duplicateKey": "Chaque nom de variable doit être unique."
+    },
     "testConfig": {
       "title": "Infrastructure de test",
       "hint": "Comment un environnement de test est mis en place pour ce service quand un pipeline doit l'exécuter : sans infrastructure, un fichier Docker Compose, des manifestes Kubernetes ou un type de manifeste personnalisé.",
@@ -907,7 +934,8 @@
     "decision": {
       "title": "Décision requise",
       "agentOnBlock": "{agent} sur {block}",
-      "visualizationHint": "Ceci est une visualisation. Tout choix reprend simplement le pipeline."
+      "visualizationHint": "Ceci est une visualisation. Tout choix reprend simplement le pipeline.",
+      "resolveFailed": "Impossible d'enregistrer votre décision"
     },
     "stepRestart": {
       "restartFromStep": "Redémarrer le pipeline à partir de cette étape",

package/i18n/locales/he.json

@@ -65,7 +65,13 @@
     "undo": "בטל",
     "back": "חזרה",
     "next": "הבא",
-    "done": "סיום"
+    "done": "סיום",
+    "discard": {
+      "title": "לבטל את השינויים?",
+      "body": "ביצעת שינויים שלא נשמרו. לסגור ולאבד אותם?",
+      "confirm": "לבטל",
+      "keep": "להמשיך לערוך"
+    }
   },
   "clarification": {
     "answerPlaceholder": "התשובה שלך",
@@ -663,6 +669,27 @@
       "clearFailed": "לא ניתן לנקות את המיפוי",
       "configNoun": "תצורת בריאות הגרסה"
     },
+    "testSecrets": {
+      "title": "פרטי גישה לבדיקה (רגישים)",
+      "sectionHint": "פרטי גישה רגישים שהבודק זקוק להם כדי לתקשר עם מערכת צד-שלישי שהשירות הזה תלוי בה, למשל מפתח API של ספק תשלומים. הם מאוחסנים מוצפנים ומוזרקים לסביבת הבודק כמשתני סביבה; הם לעולם אינם מוצגים בהנחיות או ביומנים.",
+      "warning": "אלה סודות אמיתיים ורגישים. הם מאוחסנים מוצפנים ומועברים לבודק כמשתני סביבה, לעולם לא בהנחיה או בטלמטריה של הריצה. אל תזינו פרטי גישה של סביבת ייצור שאינכם יכולים להחליף.",
+      "replaceNote": "שמירה מחליפה את כל הקבוצה של השירות הזה. כללו כל פרט גישה שברצונכם לשמור והזינו מחדש את ערכו; כל מה שיושמט יימחק.",
+      "key": "שם משתנה",
+      "keyInvalid": "השתמשו באותיות, ספרות וקו תחתון, ואל תתחילו בספרה.",
+      "description": "תיאור",
+      "descriptionPlaceholder": "למה משמש פרט הגישה הזה",
+      "value": "ערך",
+      "valuePlaceholder": "ערך סודי",
+      "addRow": "הוספת פרט גישה",
+      "removeRow": "הסרת פרט גישה",
+      "save": "שמירת פרטי הגישה",
+      "clear": "ניקוי הכול",
+      "savedToast": "פרטי הגישה לבדיקה נשמרו",
+      "saveFailed": "לא ניתן לשמור את פרטי הגישה לבדיקה",
+      "clearFailed": "לא ניתן לנקות את פרטי הגישה לבדיקה",
+      "configNoun": "פרטי הגישה הרגישים לבדיקה",
+      "duplicateKey": "כל שם משתנה חייב להיות ייחודי."
+    },
     "testConfig": {
       "title": "תשתית בדיקות",
       "hint": "כיצד מוקמת סביבת בדיקה לשירות זה כאשר פייפליין צריך להריץ אותו: ללא תשתית, קובץ Docker Compose, מניפסטים של Kubernetes או סוג מניפסט מותאם אישית.",
@@ -907,7 +934,8 @@
     "decision": {
       "title": "נדרשת החלטה",
       "agentOnBlock": "{agent} על {block}",
-      "visualizationHint": "זוהי הצגה חזותית. כל בחירה פשוט ממשיכה את הצינור."
+      "visualizationHint": "זוהי הצגה חזותית. כל בחירה פשוט ממשיכה את הצינור.",
+      "resolveFailed": "לא ניתן היה לשמור את ההחלטה שלך"
     },
     "stepRestart": {
       "restartFromStep": "הפעל מחדש את הצינור משלב זה",

package/i18n/locales/it.json

@@ -973,6 +973,27 @@
       "clearFailed": "Impossibile cancellare il mapping",
       "configNoun": "la configurazione dello stato di rilascio"
     },
+    "testSecrets": {
+      "title": "Credenziali di test (sensibili)",
+      "sectionHint": "Credenziali sensibili di cui il Tester ha bisogno per interagire con un sistema di terze parti da cui dipende questo servizio, ad esempio la chiave API di un fornitore di pagamenti. Sono cifrate a riposo e iniettate nell'ambiente del Tester come variabili; non compaiono mai nei prompt né nei log.",
+      "warning": "Sono segreti reali e sensibili. Vengono cifrati a riposo e passati al Tester come variabili d'ambiente, mai in un prompt o nella telemetria dell'esecuzione. Non inserire credenziali di produzione che non puoi ruotare.",
+      "replaceNote": "Il salvataggio sostituisce l'intero insieme per questo servizio. Includi ogni credenziale che vuoi mantenere e reinserisci il suo valore; tutto ciò che viene omesso viene rimosso.",
+      "key": "Nome variabile",
+      "keyInvalid": "Usa lettere, cifre e trattini bassi e non iniziare con una cifra.",
+      "description": "Descrizione",
+      "descriptionPlaceholder": "A cosa serve questa credenziale",
+      "value": "Valore",
+      "valuePlaceholder": "Valore segreto",
+      "addRow": "Aggiungi credenziale",
+      "removeRow": "Rimuovi credenziale",
+      "save": "Salva credenziali",
+      "clear": "Cancella tutto",
+      "savedToast": "Credenziali di test salvate",
+      "saveFailed": "Impossibile salvare le credenziali di test",
+      "clearFailed": "Impossibile cancellare le credenziali di test",
+      "configNoun": "le credenziali di test sensibili",
+      "duplicateKey": "Ogni nome di variabile deve essere univoco."
+    },
     "testConfig": {
       "title": "Infrastruttura di test",
       "hint": "Come viene predisposto un ambiente di test per questo servizio quando una pipeline deve eseguirlo: nessuna infrastruttura, un file Docker Compose, manifest Kubernetes, o un tipo di manifest personalizzato.",
@@ -1217,7 +1238,8 @@
     "decision": {
       "title": "Decisione richiesta",
       "agentOnBlock": "{agent} su {block}",
-      "visualizationHint": "Questa e' una visualizzazione. Qualsiasi scelta riprende semplicemente la pipeline."
+      "visualizationHint": "Questa e' una visualizzazione. Qualsiasi scelta riprende semplicemente la pipeline.",
+      "resolveFailed": "Impossibile registrare la tua decisione"
     },
     "stepRestart": {
       "restartFromStep": "Riavvia la pipeline da questo passaggio",
@@ -3656,7 +3678,13 @@
     "undo": "Annulla",
     "back": "Indietro",
     "next": "Avanti",
-    "done": "Fatto"
+    "done": "Fatto",
+    "discard": {
+      "title": "Ignorare le modifiche?",
+      "body": "Hai apportato modifiche non salvate. Chiudere e perderle?",
+      "confirm": "Ignora",
+      "keep": "Continua a modificare"
+    }
   },
   "clarification": {
     "answerPlaceholder": "La tua risposta",

package/i18n/locales/ja.json

@@ -65,7 +65,13 @@
     "undo": "元に戻す",
     "back": "戻る",
     "next": "次へ",
-    "done": "完了"
+    "done": "完了",
+    "discard": {
+      "title": "変更を破棄しますか？",
+      "body": "保存されていない変更があります。閉じて破棄しますか？",
+      "confirm": "破棄",
+      "keep": "編集を続ける"
+    }
   },
   "clarification": {
     "answerPlaceholder": "回答を入力",
@@ -663,6 +669,27 @@
       "clearFailed": "マッピングをクリアできませんでした",
       "configNoun": "リリースヘルス設定"
     },
+    "testSecrets": {
+      "title": "テスト用認証情報（機密）",
+      "sectionHint": "このサービスが依存するサードパーティのシステム（例：決済プロバイダーの API キー）をテスターが操作するために必要な、機密性の高い認証情報です。保存時に暗号化され、環境変数としてテスターの環境に注入されます。プロンプトやログには決して表示されません。",
+      "warning": "これらは実際の機密情報です。保存時に暗号化され、環境変数としてテスターに渡されます。プロンプトや実行のテレメトリーには一切含まれません。ローテーションできない本番用の認証情報は入力しないでください。",
+      "replaceNote": "保存すると、このサービスのセット全体が置き換えられます。残しておきたい認証情報はすべて含め、その値を再入力してください。省略したものは削除されます。",
+      "key": "変数名",
+      "keyInvalid": "英字・数字・アンダースコアを使用し、数字で始めないでください。",
+      "description": "説明",
+      "descriptionPlaceholder": "この認証情報の用途",
+      "value": "値",
+      "valuePlaceholder": "秘密の値",
+      "addRow": "認証情報を追加",
+      "removeRow": "認証情報を削除",
+      "save": "認証情報を保存",
+      "clear": "すべて消去",
+      "savedToast": "テスト用認証情報を保存しました",
+      "saveFailed": "テスト用認証情報を保存できませんでした",
+      "clearFailed": "テスト用認証情報を消去できませんでした",
+      "configNoun": "機密のテスト用認証情報",
+      "duplicateKey": "変数名はそれぞれ一意である必要があります。"
+    },
     "testConfig": {
       "title": "テストインフラ",
       "hint": "パイプラインがこのサービスを実行する必要があるときに、テスト環境をどう立ち上げるか: インフラなし、Docker Compose ファイル、Kubernetes マニフェスト、またはカスタムマニフェストタイプ。",
@@ -907,7 +934,8 @@
     "decision": {
       "title": "判断が必要",
       "agentOnBlock": "{block} の {agent}",
-      "visualizationHint": "これは可視化です。どの選択でもパイプラインを再開するだけです。"
+      "visualizationHint": "これは可視化です。どの選択でもパイプラインを再開するだけです。",
+      "resolveFailed": "決定を記録できませんでした"
     },
     "stepRestart": {
       "restartFromStep": "このステップからパイプラインを再開",

package/i18n/locales/pl.json

@@ -65,7 +65,13 @@
     "undo": "Cofnij",
     "back": "Wstecz",
     "next": "Dalej",
-    "done": "Gotowe"
+    "done": "Gotowe",
+    "discard": {
+      "title": "Odrzucić zmiany?",
+      "body": "Masz niezapisane zmiany. Zamknąć i je utracić?",
+      "confirm": "Odrzuć",
+      "keep": "Kontynuuj edycję"
+    }
   },
   "clarification": {
     "answerPlaceholder": "Twoja odpowiedź",
@@ -663,6 +669,27 @@
       "clearFailed": "Nie udało się wyczyścić mapowania",
       "configNoun": "konfigurację kondycji wydania"
     },
+    "testSecrets": {
+      "title": "Poświadczenia testowe (wrażliwe)",
+      "sectionHint": "Wrażliwe poświadczenia potrzebne Testerowi do korzystania z zewnętrznego systemu, od którego zależy ta usługa, np. klucz API dostawcy płatności. Są przechowywane w postaci zaszyfrowanej i wstrzykiwane do środowiska Testera jako zmienne; nigdy nie pojawiają się w promptach ani w logach.",
+      "warning": "To prawdziwe, wrażliwe sekrety. Są przechowywane w postaci zaszyfrowanej i przekazywane Testerowi jako zmienne środowiskowe, nigdy w promptcie ani w telemetrii przebiegu. Nie wprowadzaj poświadczeń produkcyjnych, których nie możesz zmienić.",
+      "replaceNote": "Zapis zastępuje cały zestaw dla tej usługi. Uwzględnij każde poświadczenie, które chcesz zachować, i ponownie wprowadź jego wartość; wszystko pominięte zostanie usunięte.",
+      "key": "Nazwa zmiennej",
+      "keyInvalid": "Używaj liter, cyfr i podkreśleń i nie zaczynaj od cyfry.",
+      "description": "Opis",
+      "descriptionPlaceholder": "Do czego służy to poświadczenie",
+      "value": "Wartość",
+      "valuePlaceholder": "Tajna wartość",
+      "addRow": "Dodaj poświadczenie",
+      "removeRow": "Usuń poświadczenie",
+      "save": "Zapisz poświadczenia",
+      "clear": "Wyczyść wszystko",
+      "savedToast": "Zapisano poświadczenia testowe",
+      "saveFailed": "Nie udało się zapisać poświadczeń testowych",
+      "clearFailed": "Nie udało się wyczyścić poświadczeń testowych",
+      "configNoun": "wrażliwe poświadczenia testowe",
+      "duplicateKey": "Każda nazwa zmiennej musi być unikalna."
+    },
     "testConfig": {
       "title": "Infrastruktura testowa",
       "hint": "Jak stawiane jest środowisko testowe dla tej usługi, gdy potok musi ją uruchomić: bez infrastruktury, plik Docker Compose, manifesty Kubernetes lub niestandardowy typ manifestu.",
@@ -907,7 +934,8 @@
     "decision": {
       "title": "Wymagana decyzja",
       "agentOnBlock": "{agent} na {block}",
-      "visualizationHint": "To jest wizualizacja. Każdy wybór po prostu wznawia potok."
+      "visualizationHint": "To jest wizualizacja. Każdy wybór po prostu wznawia potok.",
+      "resolveFailed": "Nie udało się zapisać decyzji"
     },
     "stepRestart": {
       "restartFromStep": "Uruchom ponownie potok od tego kroku",