@cat-factory/app 0.110.4 → 0.111.0

package/app/components/panels/InspectorPanel.vue

@@ -8,6 +8,7 @@ import TaskAgentConfig from '~/components/panels/inspector/TaskAgentConfig.vue'
 import ServiceTestConfig from '~/components/panels/inspector/ServiceTestConfig.vue'
 import ServiceFragments from '~/components/panels/inspector/ServiceFragments.vue'
 import ServiceReleaseHealthConfig from '~/components/panels/inspector/ServiceReleaseHealthConfig.vue'
+import ServiceTestSecrets from '~/components/panels/inspector/ServiceTestSecrets.vue'
 import FrontendConfig from '~/components/panels/inspector/FrontendConfig.vue'
 import ServiceConnections from '~/components/panels/inspector/ServiceConnections.vue'
 import ContainerSummary from '~/components/panels/inspector/ContainerSummary.vue'
@@ -496,6 +497,9 @@ const showOriginalDescription = ref(false)
       <!-- service (frame): test infra + provisioning configuration -->
       <ServiceTestConfig v-if="isFrame" :key="`test-config-${block.id}`" :block="block" />
 
+      <!-- service (frame): SENSITIVE test credentials (sealed, injected out of band) -->
+      <ServiceTestSecrets v-if="isFrame" :key="`test-secrets-${block.id}`" :block="block" />
+
       <!-- service (frame): best-practice fragments for code-aware agents -->
       <ServiceFragments v-if="isFrame" :key="`fragments-${block.id}`" :block="block" />
 

package/app/components/panels/inspector/ServiceTestSecrets.vue

@@ -0,0 +1,264 @@
+<script setup lang="ts">
+import { computed, reactive, ref, watch } from 'vue'
+import type { Block } from '~/types/domain'
+import InspectorSection from '~/components/panels/inspector/InspectorSection.vue'
+import SecretInput from '~/components/common/SecretInput.vue'
+
+// Per-service (frame) SENSITIVE test credentials: a genuinely secret token a Tester needs
+// to exercise a third-party integration (e.g. a Stripe API key). Unlike the non-sensitive
+// pools, these are SEALED at rest and injected into the Tester container OUT OF BAND — never
+// rendered into a prompt or the telemetry snapshot. Keyed by THIS frame's block id.
+//
+// The backend stores the WHOLE set and values are write-only (never read back), so this is a
+// full-set replace editor: saving persists exactly the rows below and drops anything omitted.
+// The list prefills from the configured keys/descriptions; every value must be (re-)entered,
+// and Save stays disabled until each row has one — so an existing secret can never be blanked
+// by accident. Hidden entirely when the backend store is unconfigured (no ENCRYPTION_KEY).
+const props = defineProps<{ block: Block }>()
+
+const store = useTestSecretsStore()
+const toast = useToast()
+const { t } = useI18n()
+const { confirmAction, toastDone } = useConfirmAction()
+
+const busy = ref(false)
+
+interface DraftRow {
+  key: string
+  description: string
+  value: string
+}
+const draft = reactive<{ rows: DraftRow[] }>({ rows: [] })
+
+const configured = computed(() => store.entriesForBlock(props.block.id))
+const available = computed(() => store.available !== false)
+
+const blankRow = (): DraftRow => ({ key: '', description: '', value: '' })
+
+// Load this frame's configured refs once, then (re)hydrate the editor from them. Runs again
+// after a save/clear (the store refs change) so the just-typed secret values don't linger in
+// the form — the persisted set is re-shown with empty value fields to re-enter.
+onMounted(() => {
+  store.ensureLoaded(props.block.id).catch(() => {})
+})
+watch(
+  configured,
+  (entries) => {
+    draft.rows = entries.length
+      ? entries.map((e) => ({ key: e.key, description: e.description, value: '' }))
+      : [blankRow()]
+  },
+  { immediate: true },
+)
+
+// A valid POSIX env-var name (mirrors the contract's testSecretKeySchema regex + max length).
+// The reserved/toolchain-name rejection lives server-side and surfaces as a save error — we
+// don't duplicate the harness's reserved-name list here.
+const KEY_RE = /^[A-Za-z_][A-Za-z0-9_]*$/
+const KEY_MAX = 128
+function keyValid(key: string): boolean {
+  const k = key.trim()
+  return KEY_RE.test(k) && k.length <= KEY_MAX
+}
+
+// Keys that appear more than once (trimmed) — flagged inline and block saving.
+const duplicateKeys = computed(() => {
+  const seen = new Map<string, number>()
+  for (const r of draft.rows) {
+    const k = r.key.trim()
+    if (k) seen.set(k, (seen.get(k) ?? 0) + 1)
+  }
+  return new Set([...seen.entries()].filter(([, n]) => n > 1).map(([k]) => k))
+})
+
+function rowComplete(r: DraftRow): boolean {
+  return keyValid(r.key) && r.value.trim().length > 0
+}
+
+const canSave = computed(
+  () =>
+    !busy.value &&
+    draft.rows.length > 0 &&
+    draft.rows.every(rowComplete) &&
+    duplicateKeys.value.size === 0,
+)
+
+function addRow() {
+  draft.rows.push(blankRow())
+}
+function removeRow(index: number) {
+  draft.rows.splice(index, 1)
+}
+
+function notifyError(title: string, e: unknown) {
+  toast.add({
+    title,
+    description: e instanceof Error ? e.message : String(e),
+    icon: 'i-lucide-triangle-alert',
+    color: 'error',
+  })
+}
+
+async function save() {
+  busy.value = true
+  try {
+    await store.save(props.block.id, {
+      entries: draft.rows.map((r) => ({
+        key: r.key.trim(),
+        description: r.description.trim(),
+        value: r.value,
+      })),
+    })
+    toast.add({
+      title: t('inspector.testSecrets.savedToast'),
+      icon: 'i-lucide-check',
+      color: 'success',
+    })
+  } catch (e) {
+    notifyError(t('inspector.testSecrets.saveFailed'), e)
+  } finally {
+    busy.value = false
+  }
+}
+
+async function clearAll() {
+  const noun = t('inspector.testSecrets.configNoun')
+  if (!(await confirmAction('clear', noun))) return
+  busy.value = true
+  try {
+    await store.clear(props.block.id)
+    toastDone('clear', noun)
+  } catch (e) {
+    notifyError(t('inspector.testSecrets.clearFailed'), e)
+  } finally {
+    busy.value = false
+  }
+}
+</script>
+
+<template>
+  <InspectorSection
+    v-if="available"
+    :title="t('inspector.testSecrets.title')"
+    :hint="t('inspector.testSecrets.sectionHint')"
+    :count="configured.length"
+    warning
+    default-open
+    data-testid="service-test-secrets"
+  >
+    <template #actions>
+      <UButton
+        v-if="configured.length"
+        color="error"
+        variant="ghost"
+        size="xs"
+        icon="i-lucide-trash-2"
+        :loading="busy"
+        data-testid="test-secrets-clear"
+        @click="clearAll"
+      >
+        {{ t('inspector.testSecrets.clear') }}
+      </UButton>
+    </template>
+
+    <!-- These are REAL secrets: an unmistakable sensitivity + replace-all warning. -->
+    <div
+      class="flex items-start gap-2 rounded-md border border-amber-500/40 bg-amber-500/10 px-2.5 py-2 text-[11px] leading-snug text-amber-200"
+    >
+      <UIcon name="i-lucide-shield-alert" class="mt-0.5 h-4 w-4 shrink-0 text-amber-400" />
+      <span>{{ t('inspector.testSecrets.warning') }}</span>
+    </div>
+
+    <p class="text-[11px] leading-snug text-slate-500">
+      {{ t('inspector.testSecrets.replaceNote') }}
+    </p>
+
+    <div class="space-y-3">
+      <div
+        v-for="(row, index) in draft.rows"
+        :key="index"
+        class="space-y-2 rounded-md border border-slate-800 p-2.5"
+        :data-testid="`test-secret-row-${index}`"
+      >
+        <div class="flex items-start gap-2">
+          <UFormField
+            :label="t('inspector.testSecrets.key')"
+            :error="
+              row.key.trim() && !keyValid(row.key)
+                ? t('inspector.testSecrets.keyInvalid')
+                : undefined
+            "
+            class="flex-1"
+          >
+            <UInput
+              v-model="row.key"
+              placeholder="STRIPE_API_KEY"
+              size="sm"
+              class="w-full font-mono"
+              :data-testid="`test-secret-key-${index}`"
+            />
+          </UFormField>
+          <UButton
+            color="error"
+            variant="ghost"
+            size="xs"
+            icon="i-lucide-x"
+            class="mt-5 shrink-0"
+            :aria-label="t('inspector.testSecrets.removeRow')"
+            :data-testid="`test-secret-remove-${index}`"
+            @click="removeRow(index)"
+          />
+        </div>
+
+        <UFormField :label="t('inspector.testSecrets.description')">
+          <UInput
+            v-model="row.description"
+            :placeholder="t('inspector.testSecrets.descriptionPlaceholder')"
+            size="sm"
+            class="w-full"
+            :data-testid="`test-secret-description-${index}`"
+          />
+        </UFormField>
+
+        <UFormField :label="t('inspector.testSecrets.value')">
+          <SecretInput
+            v-model="row.value"
+            :placeholder="t('inspector.testSecrets.valuePlaceholder')"
+            size="sm"
+            class="w-full"
+            :data-testid="`test-secret-value-${index}`"
+          />
+        </UFormField>
+      </div>
+
+      <p v-if="duplicateKeys.size" class="text-[11px] text-error-400">
+        {{ t('inspector.testSecrets.duplicateKey') }}
+      </p>
+
+      <div class="flex items-center justify-between gap-2">
+        <UButton
+          color="neutral"
+          variant="soft"
+          size="xs"
+          icon="i-lucide-plus"
+          data-testid="test-secret-add"
+          @click="addRow"
+        >
+          {{ t('inspector.testSecrets.addRow') }}
+        </UButton>
+        <UButton
+          color="primary"
+          variant="soft"
+          size="xs"
+          icon="i-lucide-save"
+          :loading="busy"
+          :disabled="!canSave"
+          data-testid="test-secrets-save"
+          @click="save"
+        >
+          {{ t('inspector.testSecrets.save') }}
+        </UButton>
+      </div>
+    </div>
+  </InspectorSection>
+</template>

package/app/composables/api/testSecrets.ts

@@ -0,0 +1,36 @@
+import {
+  deleteServiceTestSecretsContract,
+  getServiceTestSecretsContract,
+  setServiceTestSecretsContract,
+} from '@cat-factory/contracts'
+import type { UpsertServiceTestSecretsInput } from '~/types/testSecrets'
+import type { ApiContext } from './context'
+
+/**
+ * Sensitive per-service test secrets (SEALED, write-only). The GET view returns only the
+ * configured keys + descriptions; the PUT replaces the whole set (values write-only) and
+ * an empty set clears it. Keyed by the service-frame block. See TestSecretsController.
+ */
+export function testSecretsApi({ send, ws }: ApiContext) {
+  return {
+    getServiceTestSecrets: (workspaceId: string, blockId: string) =>
+      send(getServiceTestSecretsContract, { pathPrefix: ws(workspaceId), pathParams: { blockId } }),
+
+    setServiceTestSecrets: (
+      workspaceId: string,
+      blockId: string,
+      body: UpsertServiceTestSecretsInput,
+    ) =>
+      send(setServiceTestSecretsContract, {
+        pathPrefix: ws(workspaceId),
+        pathParams: { blockId },
+        body,
+      }),
+
+    deleteServiceTestSecrets: (workspaceId: string, blockId: string) =>
+      send(deleteServiceTestSecretsContract, {
+        pathPrefix: ws(workspaceId),
+        pathParams: { blockId },
+      }),
+  }
+}

package/app/composables/useApi.ts

@@ -35,6 +35,7 @@ import { reviewsApi } from './api/reviews'
 import { slackApi } from './api/slack'
 import { specApi } from './api/spec'
 import { tasksApi } from './api/tasks'
+import { testSecretsApi } from './api/testSecrets'
 import { userSecretsApi } from './api/userSecrets'
 import { userSettingsApi } from './api/userSettings'
 import { workspacesApi } from './api/workspaces'
@@ -123,6 +124,7 @@ export function useApi() {
     ...docInterviewApi(ctx),
     ...provisioningLogsApi(ctx),
     ...releaseHealthApi(ctx),
+    ...testSecretsApi(ctx),
     ...packageRegistriesApi(ctx),
     ...previewApi(ctx),
     ...environmentsApi(ctx),

package/app/stores/testSecrets.ts

@@ -0,0 +1,89 @@
+import { defineStore } from 'pinia'
+import { ref } from 'vue'
+import type { TestSecretRef, UpsertServiceTestSecretsInput } from '~/types/testSecrets'
+import { useWorkspaceStore } from '~/stores/workspace'
+import { apiErrorStatus } from '~/composables/api/errors'
+
+/**
+ * A service frame's SENSITIVE test secrets (a third-party token a Tester needs to
+ * exercise an integration). Sealed on the backend and delivered to the container out of
+ * band; the store only ever holds the non-secret refs (key + description) — values are
+ * write-only and never read back. Loaded on demand per service frame (the inspector
+ * panel), not from the snapshot, since the secrets never leave the server.
+ */
+export const useTestSecretsStore = defineStore('testSecrets', () => {
+  const api = useApi()
+
+  // Per service-frame block id → the configured secret refs (key + description).
+  const byBlock = ref<Record<string, TestSecretRef[]>>({})
+  const loading = ref(false)
+  // Mirrors the backend's opt-in gate (the controller 503s when ENCRYPTION_KEY is absent):
+  // `null` until first probed, then `true`/`false`. The inspector panel hides itself when
+  // this is false, so a deployment with no sealed-secret store doesn't surface a dead control.
+  const available = ref<boolean | null>(null)
+  const inFlight = new Map<string, Promise<void>>()
+
+  /** Force a refresh of one block's configured secret refs (used after a save/clear). */
+  async function load(blockId: string) {
+    const ws = useWorkspaceStore()
+    loading.value = true
+    try {
+      const view = await api.getServiceTestSecrets(ws.requireId(), blockId)
+      byBlock.value[blockId] = view.entries
+      available.value = true
+    } catch (err) {
+      if (apiErrorStatus(err) === 503) {
+        // A definitive 503 means the store is unconfigured (no encryption key on the
+        // backend): hide the UI entry point and stop probing.
+        available.value = false
+        byBlock.value[blockId] = []
+      }
+      // Any other failure (transient 5xx / network) is left untouched: it must not hide an
+      // already-available panel nor cache a false "unavailable". `available` stays `null`
+      // when never probed, so `ensureLoaded` remains retryable on the next open.
+    } finally {
+      loading.value = false
+    }
+  }
+
+  /**
+   * Load one block's refs once and share the result, coalescing concurrent callers for the
+   * SAME block. `load()` forces a refresh.
+   */
+  async function ensureLoaded(blockId: string) {
+    // Store known-unconfigured (a definitive 503) is a deployment-level fact — don't re-probe
+    // per service frame; the panel is hidden anyway.
+    if (available.value === false) return
+    if (byBlock.value[blockId] !== undefined) return
+    if (!inFlight.has(blockId)) {
+      inFlight.set(
+        blockId,
+        load(blockId).finally(() => inFlight.delete(blockId)),
+      )
+    }
+    return inFlight.get(blockId)
+  }
+
+  /** The configured refs for a block (empty until loaded). */
+  function entriesForBlock(blockId: string): TestSecretRef[] {
+    return byBlock.value[blockId] ?? []
+  }
+
+  /** Replace a service frame's full secret set (values write-only); empty set clears it. */
+  async function save(blockId: string, input: UpsertServiceTestSecretsInput) {
+    const ws = useWorkspaceStore()
+    const view = await api.setServiceTestSecrets(ws.requireId(), blockId, input)
+    byBlock.value[blockId] = view.entries
+    available.value = true
+    return view
+  }
+
+  /** Remove all of a service frame's secrets. */
+  async function clear(blockId: string) {
+    const ws = useWorkspaceStore()
+    await api.deleteServiceTestSecrets(ws.requireId(), blockId)
+    byBlock.value[blockId] = []
+  }
+
+  return { byBlock, loading, available, load, ensureLoaded, entriesForBlock, save, clear }
+})

package/app/types/testSecrets.ts

@@ -0,0 +1,15 @@
+// Sensitive per-service test-secret shapes (SEALED, write-only). A Tester needs these
+// to exercise a third-party integration (e.g. a Stripe API key). Sealed at rest on the
+// backend and injected into the Tester container OUT OF BAND — never rendered into a
+// prompt or the telemetry snapshot. The view returns only the configured keys +
+// descriptions (`TestSecretRef`); values are write-only and never read back.
+//
+// All wire shapes are sourced from @cat-factory/contracts (single source of truth).
+// See docs/initiatives/tester-environment-access.md (Slice C).
+
+export type {
+  TestSecretRef,
+  TestSecretEntry,
+  ServiceTestSecretsView,
+  UpsertServiceTestSecretsInput,
+} from '@cat-factory/contracts'

package/i18n/locales/de.json

@@ -973,6 +973,27 @@
       "clearFailed": "Zuordnung konnte nicht geleert werden",
       "configNoun": "die Release-Health-Konfiguration"
     },
+    "testSecrets": {
+      "title": "Test-Anmeldedaten (sensibel)",
+      "sectionHint": "Sensible Anmeldedaten, die der Tester benötigt, um ein von diesem Dienst genutztes Drittsystem anzusprechen, z. B. den API-Schlüssel eines Zahlungsanbieters. Sie werden verschlüsselt gespeichert und dem Tester als Umgebungsvariablen übergeben; sie erscheinen nie in Prompts oder Protokollen.",
+      "warning": "Dies sind echte, sensible Geheimnisse. Sie werden verschlüsselt gespeichert und dem Tester als Umgebungsvariablen übergeben, niemals in einem Prompt oder der Telemetrie des Laufs. Gib keine Produktionsdaten ein, die du nicht rotieren kannst.",
+      "replaceNote": "Beim Speichern wird der gesamte Satz für diesen Dienst ersetzt. Nimm jede Anmeldung auf, die du behalten möchtest, und gib ihren Wert erneut ein; alles Ausgelassene wird entfernt.",
+      "key": "Variablenname",
+      "keyInvalid": "Verwende Buchstaben, Ziffern und Unterstriche und beginne nicht mit einer Ziffer.",
+      "description": "Beschreibung",
+      "descriptionPlaceholder": "Wofür diese Anmeldung dient",
+      "value": "Wert",
+      "valuePlaceholder": "Geheimer Wert",
+      "addRow": "Anmeldung hinzufügen",
+      "removeRow": "Anmeldung entfernen",
+      "save": "Anmeldedaten speichern",
+      "clear": "Alle löschen",
+      "savedToast": "Test-Anmeldedaten gespeichert",
+      "saveFailed": "Test-Anmeldedaten konnten nicht gespeichert werden",
+      "clearFailed": "Test-Anmeldedaten konnten nicht gelöscht werden",
+      "configNoun": "die sensiblen Test-Anmeldedaten",
+      "duplicateKey": "Jeder Variablenname muss eindeutig sein."
+    },
     "testConfig": {
       "title": "Testinfrastruktur",
       "hint": "Wie eine Testumgebung für diesen Service aufgesetzt wird, wenn eine Pipeline ihn ausführen muss: keine Infrastruktur, eine Docker-Compose-Datei, Kubernetes-Manifeste oder ein benutzerdefinierter Manifesttyp.",

package/i18n/locales/en.json

@@ -723,6 +723,27 @@
       "clearFailed": "Could not clear the mapping",
       "configNoun": "the release health configuration"
     },
+    "testSecrets": {
+      "title": "Test credentials (sensitive)",
+      "sectionHint": "Sensitive credentials the Tester needs to exercise a third-party system this service depends on, e.g. a payment provider's API key. They are encrypted at rest and injected into the Tester's environment as variables; they are never shown in prompts or logs.",
+      "warning": "These are real, sensitive secrets. They are encrypted at rest and passed to the Tester as environment variables, never put in a prompt or the run's telemetry. Don't enter production credentials you can't rotate.",
+      "replaceNote": "Saving replaces the entire set for this service. Include every credential you want to keep and re-enter its value; anything left out is removed.",
+      "key": "Variable name",
+      "keyInvalid": "Use letters, digits and underscores, and don't start with a digit.",
+      "description": "Description",
+      "descriptionPlaceholder": "What this credential is for",
+      "value": "Value",
+      "valuePlaceholder": "Secret value",
+      "addRow": "Add credential",
+      "removeRow": "Remove credential",
+      "save": "Save credentials",
+      "clear": "Clear all",
+      "savedToast": "Test credentials saved",
+      "saveFailed": "Could not save the test credentials",
+      "clearFailed": "Could not clear the test credentials",
+      "configNoun": "the sensitive test credentials",
+      "duplicateKey": "Each variable name must be unique."
+    },
     "testConfig": {
       "title": "Test infrastructure",
       "hint": "How a test environment is stood up for this service when a pipeline needs to run it: no infrastructure, a Docker Compose file, Kubernetes manifests, or a custom manifest type.",

package/i18n/locales/es.json

@@ -669,6 +669,27 @@
       "clearFailed": "No se pudo limpiar la asignación",
       "configNoun": "la configuración de salud de la versión"
     },
+    "testSecrets": {
+      "title": "Credenciales de prueba (sensibles)",
+      "sectionHint": "Credenciales sensibles que el Tester necesita para usar un sistema de terceros del que depende este servicio, p. ej. la clave de API de una pasarela de pago. Se almacenan cifradas y se inyectan en el entorno del Tester como variables; nunca se muestran en prompts ni en registros.",
+      "warning": "Son secretos reales y sensibles. Se almacenan cifrados y se pasan al Tester como variables de entorno, nunca en un prompt ni en la telemetría de la ejecución. No introduzcas credenciales de producción que no puedas rotar.",
+      "replaceNote": "Al guardar se reemplaza el conjunto completo de este servicio. Incluye cada credencial que quieras conservar y vuelve a introducir su valor; lo que se omita se elimina.",
+      "key": "Nombre de variable",
+      "keyInvalid": "Usa letras, dígitos y guiones bajos, y no empieces por un dígito.",
+      "description": "Descripción",
+      "descriptionPlaceholder": "Para qué sirve esta credencial",
+      "value": "Valor",
+      "valuePlaceholder": "Valor secreto",
+      "addRow": "Añadir credencial",
+      "removeRow": "Eliminar credencial",
+      "save": "Guardar credenciales",
+      "clear": "Borrar todo",
+      "savedToast": "Credenciales de prueba guardadas",
+      "saveFailed": "No se pudieron guardar las credenciales de prueba",
+      "clearFailed": "No se pudieron borrar las credenciales de prueba",
+      "configNoun": "las credenciales de prueba sensibles",
+      "duplicateKey": "Cada nombre de variable debe ser único."
+    },
     "testConfig": {
       "title": "Infraestructura de pruebas",
       "hint": "Cómo se levanta un entorno de prueba para este servicio cuando un pipeline necesita ejecutarlo: sin infraestructura, un archivo de Docker Compose, manifiestos de Kubernetes o un tipo de manifiesto personalizado.",

package/i18n/locales/fr.json

@@ -669,6 +669,27 @@
       "clearFailed": "Impossible d'effacer le mappage",
       "configNoun": "la configuration de santé de la version"
     },
+    "testSecrets": {
+      "title": "Identifiants de test (sensibles)",
+      "sectionHint": "Identifiants sensibles dont le Testeur a besoin pour solliciter un système tiers utilisé par ce service, par exemple la clé d'API d'un prestataire de paiement. Ils sont chiffrés au repos et injectés dans l'environnement du Testeur sous forme de variables ; ils n'apparaissent jamais dans les prompts ni les journaux.",
+      "warning": "Ce sont de vrais secrets sensibles. Ils sont chiffrés au repos et transmis au Testeur comme variables d'environnement, jamais dans un prompt ni dans la télémétrie de l'exécution. N'entrez pas d'identifiants de production que vous ne pouvez pas renouveler.",
+      "replaceNote": "L'enregistrement remplace l'ensemble complet pour ce service. Incluez chaque identifiant à conserver et saisissez à nouveau sa valeur ; tout ce qui est omis est supprimé.",
+      "key": "Nom de variable",
+      "keyInvalid": "Utilisez des lettres, des chiffres et des tirets bas, et ne commencez pas par un chiffre.",
+      "description": "Description",
+      "descriptionPlaceholder": "À quoi sert cet identifiant",
+      "value": "Valeur",
+      "valuePlaceholder": "Valeur secrète",
+      "addRow": "Ajouter un identifiant",
+      "removeRow": "Supprimer l'identifiant",
+      "save": "Enregistrer les identifiants",
+      "clear": "Tout effacer",
+      "savedToast": "Identifiants de test enregistrés",
+      "saveFailed": "Impossible d'enregistrer les identifiants de test",
+      "clearFailed": "Impossible d'effacer les identifiants de test",
+      "configNoun": "les identifiants de test sensibles",
+      "duplicateKey": "Chaque nom de variable doit être unique."
+    },
     "testConfig": {
       "title": "Infrastructure de test",
       "hint": "Comment un environnement de test est mis en place pour ce service quand un pipeline doit l'exécuter : sans infrastructure, un fichier Docker Compose, des manifestes Kubernetes ou un type de manifeste personnalisé.",

package/i18n/locales/he.json

@@ -669,6 +669,27 @@
       "clearFailed": "לא ניתן לנקות את המיפוי",
       "configNoun": "תצורת בריאות הגרסה"
     },
+    "testSecrets": {
+      "title": "פרטי גישה לבדיקה (רגישים)",
+      "sectionHint": "פרטי גישה רגישים שהבודק זקוק להם כדי לתקשר עם מערכת צד-שלישי שהשירות הזה תלוי בה, למשל מפתח API של ספק תשלומים. הם מאוחסנים מוצפנים ומוזרקים לסביבת הבודק כמשתני סביבה; הם לעולם אינם מוצגים בהנחיות או ביומנים.",
+      "warning": "אלה סודות אמיתיים ורגישים. הם מאוחסנים מוצפנים ומועברים לבודק כמשתני סביבה, לעולם לא בהנחיה או בטלמטריה של הריצה. אל תזינו פרטי גישה של סביבת ייצור שאינכם יכולים להחליף.",
+      "replaceNote": "שמירה מחליפה את כל הקבוצה של השירות הזה. כללו כל פרט גישה שברצונכם לשמור והזינו מחדש את ערכו; כל מה שיושמט יימחק.",
+      "key": "שם משתנה",
+      "keyInvalid": "השתמשו באותיות, ספרות וקו תחתון, ואל תתחילו בספרה.",
+      "description": "תיאור",
+      "descriptionPlaceholder": "למה משמש פרט הגישה הזה",
+      "value": "ערך",
+      "valuePlaceholder": "ערך סודי",
+      "addRow": "הוספת פרט גישה",
+      "removeRow": "הסרת פרט גישה",
+      "save": "שמירת פרטי הגישה",
+      "clear": "ניקוי הכול",
+      "savedToast": "פרטי הגישה לבדיקה נשמרו",
+      "saveFailed": "לא ניתן לשמור את פרטי הגישה לבדיקה",
+      "clearFailed": "לא ניתן לנקות את פרטי הגישה לבדיקה",
+      "configNoun": "פרטי הגישה הרגישים לבדיקה",
+      "duplicateKey": "כל שם משתנה חייב להיות ייחודי."
+    },
     "testConfig": {
       "title": "תשתית בדיקות",
       "hint": "כיצד מוקמת סביבת בדיקה לשירות זה כאשר פייפליין צריך להריץ אותו: ללא תשתית, קובץ Docker Compose, מניפסטים של Kubernetes או סוג מניפסט מותאם אישית.",

package/i18n/locales/it.json

@@ -973,6 +973,27 @@
       "clearFailed": "Impossibile cancellare il mapping",
       "configNoun": "la configurazione dello stato di rilascio"
     },
+    "testSecrets": {
+      "title": "Credenziali di test (sensibili)",
+      "sectionHint": "Credenziali sensibili di cui il Tester ha bisogno per interagire con un sistema di terze parti da cui dipende questo servizio, ad esempio la chiave API di un fornitore di pagamenti. Sono cifrate a riposo e iniettate nell'ambiente del Tester come variabili; non compaiono mai nei prompt né nei log.",
+      "warning": "Sono segreti reali e sensibili. Vengono cifrati a riposo e passati al Tester come variabili d'ambiente, mai in un prompt o nella telemetria dell'esecuzione. Non inserire credenziali di produzione che non puoi ruotare.",
+      "replaceNote": "Il salvataggio sostituisce l'intero insieme per questo servizio. Includi ogni credenziale che vuoi mantenere e reinserisci il suo valore; tutto ciò che viene omesso viene rimosso.",
+      "key": "Nome variabile",
+      "keyInvalid": "Usa lettere, cifre e trattini bassi e non iniziare con una cifra.",
+      "description": "Descrizione",
+      "descriptionPlaceholder": "A cosa serve questa credenziale",
+      "value": "Valore",
+      "valuePlaceholder": "Valore segreto",
+      "addRow": "Aggiungi credenziale",
+      "removeRow": "Rimuovi credenziale",
+      "save": "Salva credenziali",
+      "clear": "Cancella tutto",
+      "savedToast": "Credenziali di test salvate",
+      "saveFailed": "Impossibile salvare le credenziali di test",
+      "clearFailed": "Impossibile cancellare le credenziali di test",
+      "configNoun": "le credenziali di test sensibili",
+      "duplicateKey": "Ogni nome di variabile deve essere univoco."
+    },
     "testConfig": {
       "title": "Infrastruttura di test",
       "hint": "Come viene predisposto un ambiente di test per questo servizio quando una pipeline deve eseguirlo: nessuna infrastruttura, un file Docker Compose, manifest Kubernetes, o un tipo di manifest personalizzato.",

package/i18n/locales/ja.json

@@ -669,6 +669,27 @@
       "clearFailed": "マッピングをクリアできませんでした",
       "configNoun": "リリースヘルス設定"
     },
+    "testSecrets": {
+      "title": "テスト用認証情報（機密）",
+      "sectionHint": "このサービスが依存するサードパーティのシステム（例：決済プロバイダーの API キー）をテスターが操作するために必要な、機密性の高い認証情報です。保存時に暗号化され、環境変数としてテスターの環境に注入されます。プロンプトやログには決して表示されません。",
+      "warning": "これらは実際の機密情報です。保存時に暗号化され、環境変数としてテスターに渡されます。プロンプトや実行のテレメトリーには一切含まれません。ローテーションできない本番用の認証情報は入力しないでください。",
+      "replaceNote": "保存すると、このサービスのセット全体が置き換えられます。残しておきたい認証情報はすべて含め、その値を再入力してください。省略したものは削除されます。",
+      "key": "変数名",
+      "keyInvalid": "英字・数字・アンダースコアを使用し、数字で始めないでください。",
+      "description": "説明",
+      "descriptionPlaceholder": "この認証情報の用途",
+      "value": "値",
+      "valuePlaceholder": "秘密の値",
+      "addRow": "認証情報を追加",
+      "removeRow": "認証情報を削除",
+      "save": "認証情報を保存",
+      "clear": "すべて消去",
+      "savedToast": "テスト用認証情報を保存しました",
+      "saveFailed": "テスト用認証情報を保存できませんでした",
+      "clearFailed": "テスト用認証情報を消去できませんでした",
+      "configNoun": "機密のテスト用認証情報",
+      "duplicateKey": "変数名はそれぞれ一意である必要があります。"
+    },
     "testConfig": {
       "title": "テストインフラ",
       "hint": "パイプラインがこのサービスを実行する必要があるときに、テスト環境をどう立ち上げるか: インフラなし、Docker Compose ファイル、Kubernetes マニフェスト、またはカスタムマニフェストタイプ。",

package/i18n/locales/pl.json

@@ -669,6 +669,27 @@
       "clearFailed": "Nie udało się wyczyścić mapowania",
       "configNoun": "konfigurację kondycji wydania"
     },
+    "testSecrets": {
+      "title": "Poświadczenia testowe (wrażliwe)",
+      "sectionHint": "Wrażliwe poświadczenia potrzebne Testerowi do korzystania z zewnętrznego systemu, od którego zależy ta usługa, np. klucz API dostawcy płatności. Są przechowywane w postaci zaszyfrowanej i wstrzykiwane do środowiska Testera jako zmienne; nigdy nie pojawiają się w promptach ani w logach.",
+      "warning": "To prawdziwe, wrażliwe sekrety. Są przechowywane w postaci zaszyfrowanej i przekazywane Testerowi jako zmienne środowiskowe, nigdy w promptcie ani w telemetrii przebiegu. Nie wprowadzaj poświadczeń produkcyjnych, których nie możesz zmienić.",
+      "replaceNote": "Zapis zastępuje cały zestaw dla tej usługi. Uwzględnij każde poświadczenie, które chcesz zachować, i ponownie wprowadź jego wartość; wszystko pominięte zostanie usunięte.",
+      "key": "Nazwa zmiennej",
+      "keyInvalid": "Używaj liter, cyfr i podkreśleń i nie zaczynaj od cyfry.",
+      "description": "Opis",
+      "descriptionPlaceholder": "Do czego służy to poświadczenie",
+      "value": "Wartość",
+      "valuePlaceholder": "Tajna wartość",
+      "addRow": "Dodaj poświadczenie",
+      "removeRow": "Usuń poświadczenie",
+      "save": "Zapisz poświadczenia",
+      "clear": "Wyczyść wszystko",
+      "savedToast": "Zapisano poświadczenia testowe",
+      "saveFailed": "Nie udało się zapisać poświadczeń testowych",
+      "clearFailed": "Nie udało się wyczyścić poświadczeń testowych",
+      "configNoun": "wrażliwe poświadczenia testowe",
+      "duplicateKey": "Każda nazwa zmiennej musi być unikalna."
+    },
     "testConfig": {
       "title": "Infrastruktura testowa",
       "hint": "Jak stawiane jest środowisko testowe dla tej usługi, gdy potok musi ją uruchomić: bez infrastruktury, plik Docker Compose, manifesty Kubernetes lub niestandardowy typ manifestu.",

package/i18n/locales/tr.json

@@ -669,6 +669,27 @@
       "clearFailed": "Eşleme temizlenemedi",
       "configNoun": "sürüm sağlığı yapılandırması"
     },
+    "testSecrets": {
+      "title": "Test kimlik bilgileri (hassas)",
+      "sectionHint": "Test Aracısının, bu hizmetin bağlı olduğu bir üçüncü taraf sistemi kullanması için gereken hassas kimlik bilgileri; örneğin bir ödeme sağlayıcısının API anahtarı. Bekleme sırasında şifrelenir ve Test Aracısının ortamına değişken olarak enjekte edilir; istemlerde veya günlüklerde asla gösterilmez.",
+      "warning": "Bunlar gerçek, hassas sırlardır. Bekleme sırasında şifrelenir ve Test Aracısına ortam değişkenleri olarak iletilir; asla bir isteme ya da çalıştırma telemetrisine konmaz. Değiştiremeyeceğiniz üretim kimlik bilgilerini girmeyin.",
+      "replaceNote": "Kaydetmek, bu hizmete ait kümenin tamamını değiştirir. Tutmak istediğiniz her kimlik bilgisini ekleyin ve değerini yeniden girin; dışarıda bırakılan her şey kaldırılır.",
+      "key": "Değişken adı",
+      "keyInvalid": "Harf, rakam ve alt çizgi kullanın ve rakamla başlamayın.",
+      "description": "Açıklama",
+      "descriptionPlaceholder": "Bu kimlik bilgisi ne için",
+      "value": "Değer",
+      "valuePlaceholder": "Gizli değer",
+      "addRow": "Kimlik bilgisi ekle",
+      "removeRow": "Kimlik bilgisini kaldır",
+      "save": "Kimlik bilgilerini kaydet",
+      "clear": "Tümünü temizle",
+      "savedToast": "Test kimlik bilgileri kaydedildi",
+      "saveFailed": "Test kimlik bilgileri kaydedilemedi",
+      "clearFailed": "Test kimlik bilgileri temizlenemedi",
+      "configNoun": "hassas test kimlik bilgileri",
+      "duplicateKey": "Her değişken adı benzersiz olmalıdır."
+    },
     "testConfig": {
       "title": "Test altyapısı",
       "hint": "Bir pipeline bu servisi çalıştırmak istediğinde test ortamının nasıl kurulacağı: altyapısız, bir Docker Compose dosyası, Kubernetes manifestoları veya özel bir manifest türü.",

package/i18n/locales/uk.json

@@ -669,6 +669,27 @@
       "clearFailed": "Не вдалося очистити зіставлення",
       "configNoun": "конфігурацію стану випуску"
     },
+    "testSecrets": {
+      "title": "Тестові облікові дані (конфіденційні)",
+      "sectionHint": "Конфіденційні облікові дані, потрібні Тестувальнику для взаємодії зі сторонньою системою, від якої залежить цей сервіс, наприклад ключ API платіжного провайдера. Вони зберігаються в зашифрованому вигляді й додаються в середовище Тестувальника як змінні; вони ніколи не показуються в підказках чи журналах.",
+      "warning": "Це справжні конфіденційні секрети. Вони зберігаються зашифрованими й передаються Тестувальнику як змінні середовища, ніколи в підказці чи телеметрії запуску. Не вводьте робочі облікові дані, які ви не можете змінити.",
+      "replaceNote": "Збереження замінює весь набір для цього сервісу. Додайте кожні облікові дані, які хочете зберегти, і введіть їхнє значення знову; усе пропущене буде видалено.",
+      "key": "Назва змінної",
+      "keyInvalid": "Використовуйте літери, цифри та підкреслення й не починайте з цифри.",
+      "description": "Опис",
+      "descriptionPlaceholder": "Для чого ці облікові дані",
+      "value": "Значення",
+      "valuePlaceholder": "Секретне значення",
+      "addRow": "Додати облікові дані",
+      "removeRow": "Видалити облікові дані",
+      "save": "Зберегти облікові дані",
+      "clear": "Очистити все",
+      "savedToast": "Тестові облікові дані збережено",
+      "saveFailed": "Не вдалося зберегти тестові облікові дані",
+      "clearFailed": "Не вдалося очистити тестові облікові дані",
+      "configNoun": "конфіденційні тестові облікові дані",
+      "duplicateKey": "Кожна назва змінної має бути унікальною."
+    },
     "testConfig": {
       "title": "Тестова інфраструктура",
       "hint": "Як розгортається тестове середовище для цього сервісу, коли конвеєру потрібно його запустити: без інфраструктури, файл Docker Compose, маніфести Kubernetes або власний тип маніфесту.",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cat-factory/app",
-  "version": "0.110.4",
+  "version": "0.111.0",
   "description": "Reusable Nuxt layer for the Agent Architecture Board SPA (components, stores, composables, pages). Consume it from a thin deployment app via `extends: ['@cat-factory/app']` and point it at your backend with NUXT_PUBLIC_API_BASE. See deploy/frontend for an example.",
   "repository": {
     "type": "git",