@cat-factory/app 0.120.0 → 0.121.0

package/app/components/layout/IntegrationsHub.vue

@@ -21,6 +21,7 @@ const tasks = useTasksStore()
 const tracker = useTrackerStore()
 const releaseHealth = useReleaseHealthStore()
 const packageRegistries = usePackageRegistriesStore()
+const publicApiKeys = usePublicApiKeysStore()
 const userSecrets = useUserSecretsStore()
 const apiKeys = useApiKeysStore()
 const workspace = useWorkspaceStore()
@@ -51,6 +52,7 @@ watch(
       query.value = ''
       void releaseHealth.ensureLoaded().catch(() => {})
       void packageRegistries.ensureLoaded().catch(() => {})
+      void publicApiKeys.ensureLoaded().catch(() => {})
       void userSecrets.load().catch(() => {})
       // Drives the OpenRouter row's "Key connected" badge.
       if (workspace.workspaceId) void apiKeys.load(workspace.workspaceId).catch(() => {})
@@ -269,26 +271,36 @@ const groups = computed<IntegrationGroup[]>(() => {
     })
   }
 
-  // --- Development (private package registries) -------------------------------
-  // Gated like observability: hidden until a probe confirms the module is wired
-  // (`available === true`), so an unconfigured backend doesn't show a dead row.
+  // --- Development (private package registries + API access tokens) -----------
+  // Each row is gated like observability: hidden until a probe confirms its module is
+  // wired (`available === true`), so an unconfigured backend doesn't show a dead row.
+  const development: IntegrationItem[] = []
   if (packageRegistries.available) {
     const hasEntries = packageRegistries.entries.length > 0
-    out.push({
-      title: t('layout.integrationsHub.groups.development'),
-      items: [
-        {
-          key: 'package-registries',
-          icon: 'i-lucide-package',
-          label: t('layout.integrationsHub.items.packageRegistries.label'),
-          description: t('layout.integrationsHub.items.packageRegistries.description'),
-          status: hasEntries ? t('layout.integrationsHub.status.connected') : undefined,
-          connected: hasEntries,
-          onClick: () => go(ui.openPackageRegistries),
-        },
-      ],
+    development.push({
+      key: 'package-registries',
+      icon: 'i-lucide-package',
+      label: t('layout.integrationsHub.items.packageRegistries.label'),
+      description: t('layout.integrationsHub.items.packageRegistries.description'),
+      status: hasEntries ? t('layout.integrationsHub.status.connected') : undefined,
+      connected: hasEntries,
+      onClick: () => go(ui.openPackageRegistries),
+    })
+  }
+  if (publicApiKeys.available) {
+    const hasKeys = publicApiKeys.keys.length > 0
+    development.push({
+      key: 'api-tokens',
+      icon: 'i-lucide-key-round',
+      label: t('layout.integrationsHub.items.apiTokens.label'),
+      description: t('layout.integrationsHub.items.apiTokens.description'),
+      status: hasKeys ? t('layout.integrationsHub.status.connected') : undefined,
+      connected: hasKeys,
+      onClick: () => go(ui.openApiTokens),
     })
   }
+  if (development.length)
+    out.push({ title: t('layout.integrationsHub.groups.development'), items: development })
 
   // NOTE: Infrastructure (agent-container execution + Tester environments + the local-mode
   // warm pool/checkout) is no longer listed here — it moved to its OWN top-level navbar menu

package/app/components/settings/ApiTokensPanel.vue

@@ -0,0 +1,205 @@
+<script setup lang="ts">
+// API access tokens — the workspace's inbound public-API keys external systems present to the
+// `/api/v1` surface (`Authorization: Bearer cf_live_…`). Keys are hashed one-way server-side,
+// so the raw secret is shown EXACTLY ONCE, on create; the list thereafter renders metadata
+// only (label + created / last-used). To rotate a token, revoke it and mint a new one.
+// Opened from the Integrations hub.
+import { computed, ref, watch } from 'vue'
+import type { PublicApiKey } from '~/types/publicApiKeys'
+import IntegrationBackTitle from '~/components/layout/IntegrationBackTitle.vue'
+import CopyButton from '~/components/common/CopyButton.vue'
+
+const { t, d } = useI18n()
+const ui = useUiStore()
+const store = usePublicApiKeysStore()
+const toast = useToast()
+const { confirmAction, toastDone } = useConfirmAction()
+
+const open = computed({
+  get: () => ui.apiTokensOpen,
+  set: (v: boolean) => (v ? ui.openApiTokens() : ui.closeApiTokens()),
+})
+const back = useIntegrationBack(open)
+
+const label = ref('')
+const busy = ref(false)
+// The full raw secret from the most recent create — surfaced once, then dismissed. Never
+// re-fetchable, so it lives only in this transient ref (not the store).
+const newSecret = ref<string | null>(null)
+
+function notifyError(title: string, e: unknown) {
+  toast.add({
+    title,
+    description: e instanceof Error ? e.message : String(e),
+    icon: 'i-lucide-triangle-alert',
+    color: 'error',
+  })
+}
+
+watch(
+  open,
+  async (isOpen) => {
+    if (!isOpen) {
+      // Never leave a revealed secret hanging around once the panel closes.
+      newSecret.value = null
+      return
+    }
+    try {
+      await store.ensureLoaded()
+    } catch (e) {
+      notifyError(t('settings.apiTokens.toast.loadFailed'), e)
+    }
+  },
+  { immediate: true },
+)
+
+async function createToken() {
+  const trimmed = label.value.trim()
+  if (!trimmed) return
+  busy.value = true
+  try {
+    const created = await store.create(trimmed)
+    newSecret.value = created.secret
+    label.value = ''
+    toast.add({
+      title: t('settings.apiTokens.toast.created'),
+      icon: 'i-lucide-check',
+      color: 'success',
+    })
+  } catch (e) {
+    notifyError(t('settings.apiTokens.toast.createFailed'), e)
+  } finally {
+    busy.value = false
+  }
+}
+
+function dismissSecret() {
+  newSecret.value = null
+}
+
+async function revokeToken(key: PublicApiKey) {
+  if (!(await confirmAction('revoke', key.label))) return
+  busy.value = true
+  try {
+    await store.revoke(key.id)
+    toastDone('revoke', key.label)
+  } catch (e) {
+    notifyError(t('settings.apiTokens.toast.revokeFailed'), e)
+  } finally {
+    busy.value = false
+  }
+}
+</script>
+
+<template>
+  <UModal v-model:open="open" :title="t('settings.apiTokens.title')" :ui="{ content: 'max-w-lg' }">
+    <template #title>
+      <IntegrationBackTitle :title="t('settings.apiTokens.title')" @back="back" />
+    </template>
+    <template #body>
+      <div class="space-y-4" data-testid="api-tokens-panel">
+        <p class="text-sm text-slate-400">
+          {{ t('settings.apiTokens.intro') }}
+        </p>
+
+        <!-- One-time secret reveal: shown once after create, dismissed by the user. The full
+             key is never recoverable, so it must be copied now. -->
+        <section
+          v-if="newSecret"
+          class="space-y-2 rounded-lg border border-primary-500/40 bg-primary-500/10 p-3"
+          data-testid="api-token-secret"
+        >
+          <div class="flex items-center gap-2 text-sm font-medium text-primary-200">
+            <UIcon name="i-lucide-key-round" class="h-4 w-4 shrink-0" />
+            <span>{{ t('settings.apiTokens.secret.heading') }}</span>
+          </div>
+          <p class="text-xs text-slate-300">{{ t('settings.apiTokens.secret.warning') }}</p>
+          <div
+            class="flex items-center gap-2 rounded-md border border-slate-700 bg-slate-950/60 px-3 py-2"
+          >
+            <code class="min-w-0 flex-1 truncate font-mono text-xs text-slate-100">{{
+              newSecret
+            }}</code>
+            <CopyButton :text="newSecret" :label="t('settings.apiTokens.secret.copy')" size="sm" />
+          </div>
+          <div class="flex justify-end">
+            <UButton
+              color="neutral"
+              variant="ghost"
+              size="xs"
+              data-testid="api-token-secret-dismiss"
+              @click="dismissSecret"
+            >
+              {{ t('settings.apiTokens.secret.done') }}
+            </UButton>
+          </div>
+        </section>
+
+        <section v-if="store.keys.length" class="space-y-2 rounded-lg border border-slate-700 p-3">
+          <h3 class="text-sm font-semibold">
+            {{ t('settings.apiTokens.list.heading') }}
+          </h3>
+          <div
+            v-for="key in store.keys"
+            :key="key.id"
+            class="flex items-center justify-between gap-2 rounded-md border border-slate-800 px-3 py-2"
+          >
+            <div class="min-w-0 space-y-0.5">
+              <div class="truncate text-sm font-medium">{{ key.label }}</div>
+              <div class="text-[11px] text-slate-500">
+                {{
+                  t('settings.apiTokens.list.created', {
+                    date: d(new Date(key.createdAt), 'short'),
+                  })
+                }}
+                <span aria-hidden="true"> · </span>
+                <template v-if="key.lastUsedAt">{{
+                  t('settings.apiTokens.list.lastUsed', {
+                    date: d(new Date(key.lastUsedAt), 'short'),
+                  })
+                }}</template>
+                <template v-else>{{ t('settings.apiTokens.list.neverUsed') }}</template>
+              </div>
+            </div>
+            <UButton
+              color="error"
+              variant="ghost"
+              icon="i-lucide-ban"
+              size="sm"
+              :loading="busy"
+              :data-testid="`api-token-revoke-${key.id}`"
+              :aria-label="t('settings.apiTokens.list.revoke')"
+              @click="revokeToken(key)"
+            />
+          </div>
+        </section>
+
+        <section class="space-y-3 rounded-lg border border-slate-700 p-3">
+          <h3 class="text-sm font-semibold">
+            {{ t('settings.apiTokens.add.heading') }}
+          </h3>
+          <UFormField
+            :label="t('settings.apiTokens.add.label')"
+            :help="t('settings.apiTokens.add.labelHelp')"
+          >
+            <UInput
+              v-model="label"
+              :placeholder="t('settings.apiTokens.add.labelPlaceholder')"
+              class="w-full"
+              data-testid="api-token-label"
+              @keyup.enter="createToken"
+            />
+          </UFormField>
+          <UButton
+            :loading="busy"
+            :disabled="!label.trim()"
+            data-testid="api-token-create"
+            @click="createToken"
+          >
+            {{ t('settings.apiTokens.add.create') }}
+          </UButton>
+        </section>
+      </div>
+    </template>
+  </UModal>
+</template>

package/app/composables/api/publicApiKeys.ts

@@ -0,0 +1,26 @@
+import {
+  createPublicApiKeyContract,
+  listPublicApiKeysContract,
+  revokePublicApiKeyContract,
+} from '@cat-factory/contracts'
+import type { CreatePublicApiKeyInput } from '~/types/publicApiKeys'
+import type { ApiContext } from './context'
+
+/**
+ * Inbound public-API keys ("API access tokens") a workspace mints for external systems to
+ * call the `/api/v1` surface. Management routes are session-authed under
+ * `/workspaces/:workspaceId`; the raw secret comes back only on create. See
+ * PublicApiKeyController.
+ */
+export function publicApiKeysApi({ send, ws }: ApiContext) {
+  return {
+    listPublicApiKeys: (workspaceId: string) =>
+      send(listPublicApiKeysContract, { pathPrefix: ws(workspaceId) }),
+
+    createPublicApiKey: (workspaceId: string, body: CreatePublicApiKeyInput) =>
+      send(createPublicApiKeyContract, { pathPrefix: ws(workspaceId), body }),
+
+    revokePublicApiKey: (workspaceId: string, id: string) =>
+      send(revokePublicApiKeyContract, { pathPrefix: ws(workspaceId), pathParams: { id } }),
+  }
+}

package/app/composables/useApi.ts

@@ -25,6 +25,7 @@ import { notificationsApi } from './api/notifications'
 import { packageRegistriesApi } from './api/packageRegistries'
 import { preflightsApi } from './api/preflights'
 import { presetsApi } from './api/presets'
+import { publicApiKeysApi } from './api/publicApiKeys'
 import { sharedStacksApi } from './api/sharedStacks'
 import { providerConnectionsApi } from './api/providerConnections'
 import { provisioningLogsApi } from './api/provisioningLogs'
@@ -121,6 +122,7 @@ export function useApi() {
     ...notificationsApi(ctx),
     ...presetsApi(ctx),
     ...preflightsApi(ctx),
+    ...publicApiKeysApi(ctx),
     ...sharedStacksApi(ctx),
     ...providerConnectionsApi(ctx),
     ...infraHandlersApi(ctx),

package/app/pages/index.vue

@@ -96,6 +96,9 @@ const ObservabilityConnectionPanel = defineAsyncComponent(
 const PackageRegistriesPanel = defineAsyncComponent(
   () => import('~/components/settings/PackageRegistriesPanel.vue'),
 )
+const ApiTokensPanel = defineAsyncComponent(
+  () => import('~/components/settings/ApiTokensPanel.vue'),
+)
 const InfrastructureWindow = defineAsyncComponent(
   () => import('~/components/settings/InfrastructureWindow.vue'),
 )
@@ -402,6 +405,7 @@ watch(
       <AccountSettingsPanel v-if="ui.accountSettingsOpen" />
       <ObservabilityConnectionPanel v-if="ui.observabilityConnectionOpen" />
       <PackageRegistriesPanel v-if="ui.packageRegistriesOpen" />
+      <ApiTokensPanel v-if="ui.apiTokensOpen" />
       <InfrastructureWindow v-if="ui.infrastructureOpen" />
       <EnvironmentSetupWizard v-if="ui.environmentWizardOpen" />
       <ModelConfigurationPanel v-if="ui.modelConfigOpen" />

package/app/stores/publicApiKeys.spec.ts

@@ -0,0 +1,105 @@
+import { describe, it, expect, beforeEach, vi } from 'vitest'
+import { usePublicApiKeysStore } from '~/stores/publicApiKeys'
+import { useWorkspaceStore } from '~/stores/workspace'
+import type { CreatedPublicApiKey, PublicApiKey } from '~/types/publicApiKeys'
+
+/** Minimal metadata-view factory — only the fields the store passes through. */
+function key(over: Partial<PublicApiKey> = {}): PublicApiKey {
+  return {
+    id: 'pak_1',
+    accountId: 'acc1',
+    workspaceId: 'ws1',
+    label: 'CI',
+    createdAt: 1,
+    lastUsedAt: null,
+    revokedAt: null,
+    ...over,
+  }
+}
+
+describe('publicApiKeys store', () => {
+  beforeEach(() => {
+    useWorkspaceStore().workspaceId = 'ws1'
+  })
+
+  it('load stores the key list and marks the feature available', async () => {
+    vi.stubGlobal('useApi', () => ({
+      listPublicApiKeys: () => Promise.resolve({ keys: [key()] }),
+    }))
+
+    const store = usePublicApiKeysStore()
+    await store.load()
+
+    expect(store.available).toBe(true)
+    expect(store.keys).toHaveLength(1)
+    expect(store.loading).toBe(false)
+  })
+
+  it('a definitive 503 latches the feature unavailable and clears the list', async () => {
+    vi.stubGlobal('useApi', () => ({
+      listPublicApiKeys: () => Promise.reject({ statusCode: 503 }),
+    }))
+
+    const store = usePublicApiKeysStore()
+    await store.load()
+
+    expect(store.available).toBe(false)
+    expect(store.keys).toEqual([])
+  })
+
+  it('a transient failure leaves `available` null so ensureLoaded stays retryable', async () => {
+    vi.stubGlobal('useApi', () => ({
+      listPublicApiKeys: () => Promise.reject({ statusCode: 500 }),
+    }))
+
+    const store = usePublicApiKeysStore()
+    await store.load()
+
+    // Never latched — a network/5xx blip must not hide an otherwise-available panel.
+    expect(store.available).toBeNull()
+  })
+
+  it('ensureLoaded coalesces concurrent callers into one request', async () => {
+    const list = vi.fn(() => Promise.resolve({ keys: [key()] }))
+    vi.stubGlobal('useApi', () => ({ listPublicApiKeys: list }))
+
+    const store = usePublicApiKeysStore()
+    await Promise.all([store.ensureLoaded(), store.ensureLoaded()])
+    // And once probed, it never re-fetches.
+    await store.ensureLoaded()
+
+    expect(list).toHaveBeenCalledTimes(1)
+  })
+
+  it('create prepends the new key (newest-first) and returns the one-time secret', async () => {
+    const created: CreatedPublicApiKey = {
+      key: key({ id: 'pak_new', label: 'deploy' }),
+      secret: 'cf_live_pak_new.abc',
+    }
+    vi.stubGlobal('useApi', () => ({
+      listPublicApiKeys: () => Promise.resolve({ keys: [key({ id: 'pak_old' })] }),
+      createPublicApiKey: () => Promise.resolve(created),
+    }))
+
+    const store = usePublicApiKeysStore()
+    await store.load()
+    const result = await store.create('deploy')
+
+    expect(result.secret).toBe('cf_live_pak_new.abc')
+    expect(store.keys.map((k) => k.id)).toEqual(['pak_new', 'pak_old'])
+    expect(store.available).toBe(true)
+  })
+
+  it('revoke drops the key from the list', async () => {
+    vi.stubGlobal('useApi', () => ({
+      listPublicApiKeys: () => Promise.resolve({ keys: [key({ id: 'a' }), key({ id: 'b' })] }),
+      revokePublicApiKey: () => Promise.resolve(),
+    }))
+
+    const store = usePublicApiKeysStore()
+    await store.load()
+    await store.revoke('a')
+
+    expect(store.keys.map((k) => k.id)).toEqual(['b'])
+  })
+})

package/app/stores/publicApiKeys.ts

@@ -0,0 +1,72 @@
+import { defineStore } from 'pinia'
+import { ref } from 'vue'
+import type { CreatedPublicApiKey, PublicApiKey } from '~/types/publicApiKeys'
+import { useWorkspaceStore } from '~/stores/workspace'
+import { apiErrorStatus } from '~/composables/api/errors'
+
+/**
+ * The workspace's inbound public-API keys ("API access tokens") external systems present
+ * to the `/api/v1` surface. Secrets are one-way hashed server-side and returned only once
+ * on create, so the store holds metadata-only views; the raw secret is surfaced by the
+ * caller from the `create()` result. Loaded on demand (the tokens panel + the Integrations
+ * hub badge), not from the snapshot.
+ */
+export const usePublicApiKeysStore = defineStore('publicApiKeys', () => {
+  const api = useApi()
+
+  const keys = ref<PublicApiKey[]>([])
+  const loading = ref(false)
+  // Mirrors the backend's opt-in gate (the module 503s when the encryption key is absent):
+  // `null` until first probed, then `true`/`false`. The hub hides its tokens entry point
+  // when this is false.
+  const available = ref<boolean | null>(null)
+  let inFlight: Promise<void> | null = null
+
+  /** Force a refresh of the key list (used after a create/revoke). */
+  async function load() {
+    const ws = useWorkspaceStore()
+    loading.value = true
+    try {
+      keys.value = (await api.listPublicApiKeys(ws.requireId())).keys
+      available.value = true
+    } catch (err) {
+      if (apiErrorStatus(err) === 503) {
+        // A definitive 503 means the feature is unconfigured (no encryption key on the
+        // backend): hide the UI entry points and stop probing.
+        available.value = false
+        keys.value = []
+      }
+      // Any other failure (transient 5xx / network) is left untouched: it must not hide an
+      // already-available panel nor cache a false "unavailable". `available` stays `null`
+      // when never probed, so `ensureLoaded` remains retryable on the next open.
+    } finally {
+      loading.value = false
+    }
+  }
+
+  /** Load once and share the result (coalescing concurrent callers); `load()` refreshes. */
+  async function ensureLoaded() {
+    if (available.value !== null) return
+    if (!inFlight) inFlight = load().finally(() => (inFlight = null))
+    return inFlight
+  }
+
+  /** Mint a key. Returns the created record PLUS the one-time raw secret (shown once). */
+  async function create(label: string): Promise<CreatedPublicApiKey> {
+    const ws = useWorkspaceStore()
+    const created = await api.createPublicApiKey(ws.requireId(), { label })
+    // Prepend: the backend lists newest-first, so the freshly minted key belongs at the
+    // top — matching the order a subsequent `load()` would produce.
+    keys.value = [created.key, ...keys.value]
+    available.value = true
+    return created
+  }
+
+  async function revoke(id: string) {
+    const ws = useWorkspaceStore()
+    await api.revokePublicApiKey(ws.requireId(), id)
+    keys.value = keys.value.filter((k) => k.id !== id)
+  }
+
+  return { keys, loading, available, load, ensureLoaded, create, revoke }
+})

package/app/stores/ui.ts

@@ -168,6 +168,9 @@ export const useUiStore = defineStore('ui', () => {
   // Private package registries: the workspace's npm/GitHub-Packages entries agent
   // containers install with. Opened from the Integrations hub.
   const packageRegistriesOpen = ref(false)
+  // API access tokens: the workspace's inbound public-API keys external systems present to
+  // the `/api/v1` surface. Opened from the Integrations hub.
+  const apiTokensOpen = ref(false)
   // The single tabbed Infrastructure window — a TOP-LEVEL navbar destination (no longer
   // reached via the Integrations hub). Two topical tabs: "Agent containers" (the execution
   // backend + self-hosted runner pool, plus the local-mode warm pool/checkout) and "Test
@@ -618,6 +621,13 @@ export const useUiStore = defineStore('ui', () => {
   function closePackageRegistries() {
     packageRegistriesOpen.value = false
   }
+  function openApiTokens() {
+    resetHubReturn()
+    apiTokensOpen.value = true
+  }
+  function closeApiTokens() {
+    apiTokensOpen.value = false
+  }
   // Top-level navbar entry into the Infrastructure window. No hub-return marker (it isn't
   // reached from the Integrations hub), so the window shows no "Back to Integrations" control.
   function openInfrastructure(tab: 'environment' | 'runner-pool' = 'runner-pool') {
@@ -923,6 +933,7 @@ export const useUiStore = defineStore('ui', () => {
     accountSettingsScrollTarget,
     observabilityConnectionOpen,
     packageRegistriesOpen,
+    apiTokensOpen,
     infrastructureOpen,
     infrastructureTab,
     openInfrastructure,
@@ -1021,6 +1032,8 @@ export const useUiStore = defineStore('ui', () => {
     closeObservabilityConnection,
     openPackageRegistries,
     closePackageRegistries,
+    openApiTokens,
+    closeApiTokens,
     openProviderConnection,
     closeProviderConnection,
     k3sSetupPrefill,

package/app/types/publicApiKeys.ts

@@ -0,0 +1,10 @@
+// Inbound public-API keys — the "API access tokens" external systems present to the
+// `/api/v1` surface (`Authorization: Bearer cf_live_…`). Workspace-scoped; the raw secret
+// is returned exactly once on create and never again, so the list only ever holds metadata.
+// Re-exported from the shared contracts package (the single source of truth).
+export type {
+  PublicApiKey,
+  PublicApiKeyListResult,
+  CreatePublicApiKeyInput,
+  CreatedPublicApiKey,
+} from '@cat-factory/contracts'

package/i18n/locales/de.json

@@ -519,6 +519,36 @@
         "removeFailed": "Der Registry-Eintrag konnte nicht entfernt werden"
       }
     },
+    "apiTokens": {
+      "title": "API-Zugriffstokens",
+      "intro": "Erstelle Tokens, die externe Systeme der cat-factory-API vorlegen. Jedes Token authentifiziert sich als dieser Arbeitsbereich an den /api/v1-Endpunkten. Das Geheimnis wird nur einmal bei der Erstellung angezeigt und kann nicht wiederhergestellt werden. Speichere es daher sofort.",
+      "secret": {
+        "heading": "Kopiere dein Token jetzt",
+        "warning": "Dies ist das einzige Mal, dass das vollständige Token angezeigt wird. Bewahre es sicher auf; es kann nicht wiederhergestellt werden.",
+        "copy": "Token kopieren",
+        "done": "Fertig"
+      },
+      "list": {
+        "heading": "Aktive Tokens",
+        "created": "Erstellt am {date}",
+        "lastUsed": "zuletzt verwendet am {date}",
+        "neverUsed": "nie verwendet",
+        "revoke": "Token widerrufen"
+      },
+      "add": {
+        "heading": "Token erstellen",
+        "label": "Bezeichnung",
+        "labelHelp": "Ein Name, um dieses Token später wiederzuerkennen.",
+        "labelPlaceholder": "z. B. CI-Pipeline",
+        "create": "Token erstellen"
+      },
+      "toast": {
+        "loadFailed": "API-Tokens konnten nicht geladen werden",
+        "created": "Token erstellt",
+        "createFailed": "Token konnte nicht erstellt werden",
+        "revokeFailed": "Token konnte nicht widerrufen werden"
+      }
+    },
     "sharedStacks": {
       "tab": "Gemeinsame Stacks",
       "intro": "Langlebige Compose-Infrastruktur (Datenbanken, Broker, Suche, Mail), die einmal pro Workspace hochgefahren und über Ausführungen und Pull Requests hinweg wiederverwendet wird. Eine Testumgebung verbindet sich mit dem verwalteten Netzwerk eines Stacks. Das Hochfahren eines Stacks läuft auf einem lokalen Docker-Deployment; auf anderen Backends kannst du die Definition dennoch verwalten.",
@@ -1916,6 +1946,10 @@
           "label": "Private Package-Registries",
           "description": "npm- und GitHub-Packages-Tokens, mit denen Agenten private Abhängigkeiten installieren."
         },
+        "apiTokens": {
+          "label": "API-Zugriffstokens",
+          "description": "Tokens, die externe Systeme vorlegen, um die cat-factory-API aufzurufen."
+        },
         "githubPat": {
           "label": "Mein GitHub-Token",
           "description": "Ein Personal Access Token, der für von Ihnen gestartete Läufe verwendet wird (Pushes, PRs, CI, Merge)."

package/i18n/locales/en.json

@@ -1859,6 +1859,10 @@
           "label": "Private package registries",
           "description": "npm and GitHub Packages tokens agents use to install private dependencies."
         },
+        "apiTokens": {
+          "label": "API access tokens",
+          "description": "Tokens external systems present to call the cat-factory API."
+        },
         "githubPat": {
           "label": "My GitHub token",
           "description": "A personal access token used for runs you start (pushes, PRs, CI, merge)."
@@ -2396,6 +2400,36 @@
         "removeFailed": "Could not remove the registry entry"
       }
     },
+    "apiTokens": {
+      "title": "API access tokens",
+      "intro": "Create tokens that external systems present to the cat-factory API. Each token authenticates as this workspace on the /api/v1 endpoints. The secret is shown only once, when you create it, and cannot be recovered, so store it right away.",
+      "secret": {
+        "heading": "Copy your token now",
+        "warning": "This is the only time the full token is shown. Store it somewhere safe; it cannot be recovered.",
+        "copy": "Copy token",
+        "done": "Done"
+      },
+      "list": {
+        "heading": "Active tokens",
+        "created": "Created {date}",
+        "lastUsed": "last used {date}",
+        "neverUsed": "never used",
+        "revoke": "Revoke token"
+      },
+      "add": {
+        "heading": "Create a token",
+        "label": "Label",
+        "labelHelp": "A name to recognize this token by later.",
+        "labelPlaceholder": "e.g. CI pipeline",
+        "create": "Create token"
+      },
+      "toast": {
+        "loadFailed": "Could not load API tokens",
+        "created": "Token created",
+        "createFailed": "Could not create the token",
+        "revokeFailed": "Could not revoke the token"
+      }
+    },
     "sharedStacks": {
       "tab": "Shared stacks",
       "intro": "Long-lived compose infrastructure (databases, brokers, search, mail) brought up once per workspace and reused across runs and pull requests. A test environment attaches to a stack's managed network. Bringing a stack up runs on a local Docker deployment; on other backends you can still manage the definition.",

package/i18n/locales/es.json

@@ -1792,6 +1792,10 @@
           "label": "Registros privados de paquetes",
           "description": "Tokens de npm y GitHub Packages que los agentes usan para instalar dependencias privadas."
         },
+        "apiTokens": {
+          "label": "Tokens de acceso a la API",
+          "description": "Tokens que los sistemas externos presentan para llamar a la API de cat-factory."
+        },
         "githubPat": {
           "label": "Mi token de GitHub",
           "description": "Un token de acceso personal usado para las ejecuciones que inicias (pushes, PR, CI, fusión)."
@@ -2211,6 +2215,36 @@
         "removeFailed": "No se pudo eliminar la entrada del registro"
       }
     },
+    "apiTokens": {
+      "title": "Tokens de acceso a la API",
+      "intro": "Crea tokens que los sistemas externos presentan a la API de cat-factory. Cada token se autentica como este espacio de trabajo en los endpoints /api/v1. El secreto se muestra una sola vez, al crearlo, y no se puede recuperar, así que guárdalo de inmediato.",
+      "secret": {
+        "heading": "Copia tu token ahora",
+        "warning": "Esta es la única vez que se muestra el token completo. Guárdalo en un lugar seguro; no se puede recuperar.",
+        "copy": "Copiar token",
+        "done": "Listo"
+      },
+      "list": {
+        "heading": "Tokens activos",
+        "created": "Creado el {date}",
+        "lastUsed": "usado por última vez el {date}",
+        "neverUsed": "nunca usado",
+        "revoke": "Revocar token"
+      },
+      "add": {
+        "heading": "Crear un token",
+        "label": "Etiqueta",
+        "labelHelp": "Un nombre para reconocer este token más adelante.",
+        "labelPlaceholder": "p. ej. pipeline de CI",
+        "create": "Crear token"
+      },
+      "toast": {
+        "loadFailed": "No se pudieron cargar los tokens de la API",
+        "created": "Token creado",
+        "createFailed": "No se pudo crear el token",
+        "revokeFailed": "No se pudo revocar el token"
+      }
+    },
     "sharedStacks": {
       "tab": "Stacks compartidos",
       "intro": "Infraestructura de Compose de larga duración (bases de datos, brokers, búsqueda, correo) que se levanta una vez por espacio de trabajo y se reutiliza en todas las ejecuciones y pull requests. Un entorno de pruebas se conecta a la red gestionada de un stack. Levantar un stack requiere un despliegue local de Docker; en otros backends puedes gestionar igualmente la definición.",

package/i18n/locales/fr.json

@@ -1792,6 +1792,10 @@
           "label": "Registres de paquets privés",
           "description": "Jetons npm et GitHub Packages que les agents utilisent pour installer les dépendances privées."
         },
+        "apiTokens": {
+          "label": "Jetons d'accès à l'API",
+          "description": "Jetons que les systèmes externes présentent pour appeler l'API cat-factory."
+        },
         "githubPat": {
           "label": "Mon jeton GitHub",
           "description": "Un jeton d'accès personnel utilisé pour les exécutions que vous lancez (pushes, PR, CI, fusion)."
@@ -2211,6 +2215,36 @@
         "removeFailed": "Impossible de supprimer l'entrée du registre"
       }
     },
+    "apiTokens": {
+      "title": "Jetons d'accès à l'API",
+      "intro": "Créez des jetons que les systèmes externes présentent à l'API cat-factory. Chaque jeton s'authentifie en tant que cet espace de travail sur les points de terminaison /api/v1. Le secret n'est affiché qu'une seule fois, à sa création, et ne peut pas être récupéré, alors conservez-le immédiatement.",
+      "secret": {
+        "heading": "Copiez votre jeton maintenant",
+        "warning": "C'est la seule fois où le jeton complet est affiché. Conservez-le en lieu sûr ; il ne peut pas être récupéré.",
+        "copy": "Copier le jeton",
+        "done": "Terminé"
+      },
+      "list": {
+        "heading": "Jetons actifs",
+        "created": "Créé le {date}",
+        "lastUsed": "dernière utilisation le {date}",
+        "neverUsed": "jamais utilisé",
+        "revoke": "Révoquer le jeton"
+      },
+      "add": {
+        "heading": "Créer un jeton",
+        "label": "Libellé",
+        "labelHelp": "Un nom pour reconnaître ce jeton plus tard.",
+        "labelPlaceholder": "ex. pipeline CI",
+        "create": "Créer le jeton"
+      },
+      "toast": {
+        "loadFailed": "Impossible de charger les jetons d'API",
+        "created": "Jeton créé",
+        "createFailed": "Impossible de créer le jeton",
+        "revokeFailed": "Impossible de révoquer le jeton"
+      }
+    },
     "sharedStacks": {
       "tab": "Stacks partagés",
       "intro": "Infrastructure Compose de longue durée (bases de données, brokers, recherche, e-mail) démarrée une fois par espace de travail et réutilisée pour toutes les exécutions et pull requests. Un environnement de test se connecte au réseau géré d'un stack. Démarrer un stack nécessite un déploiement Docker local ; sur les autres backends, vous pouvez tout de même gérer la définition.",

package/i18n/locales/he.json

@@ -1792,6 +1792,10 @@
           "label": "מאגרי חבילות פרטיים",
           "description": "אסימוני npm ו-GitHub Packages שסוכנים משתמשים בהם להתקנת תלויות פרטיות."
         },
+        "apiTokens": {
+          "label": "אסימוני גישה ל-API",
+          "description": "אסימונים שמערכות חיצוניות מציגות כדי לקרוא ל-API של cat-factory."
+        },
         "githubPat": {
           "label": "אסימון ה-GitHub שלי",
           "description": "אסימון גישה אישי המשמש להרצות שאתה מתחיל (דחיפות, PR, CI, מיזוג)."
@@ -2332,6 +2336,36 @@
         "removeFailed": "הסרת רשומת המאגר נכשלה"
       }
     },
+    "apiTokens": {
+      "title": "אסימוני גישה ל-API",
+      "intro": "צור אסימונים שמערכות חיצוניות מציגות ל-API של cat-factory. כל אסימון מאמת את עצמו כמרחב העבודה הזה בנקודות הקצה /api/v1. הסוד מוצג פעם אחת בלבד, בעת היצירה, ולא ניתן לשחזרו, לכן שמור אותו מיד.",
+      "secret": {
+        "heading": "העתק את האסימון שלך עכשיו",
+        "warning": "זו הפעם היחידה שבה מוצג האסימון המלא. שמור אותו במקום בטוח; לא ניתן לשחזרו.",
+        "copy": "העתק אסימון",
+        "done": "סיום"
+      },
+      "list": {
+        "heading": "אסימונים פעילים",
+        "created": "נוצר בתאריך {date}",
+        "lastUsed": "שימוש אחרון בתאריך {date}",
+        "neverUsed": "מעולם לא היה בשימוש",
+        "revoke": "בטל אסימון"
+      },
+      "add": {
+        "heading": "צור אסימון",
+        "label": "תווית",
+        "labelHelp": "שם שיעזור לך לזהות את האסימון הזה בהמשך.",
+        "labelPlaceholder": "לדוגמה, צינור CI",
+        "create": "צור אסימון"
+      },
+      "toast": {
+        "loadFailed": "לא ניתן לטעון את אסימוני ה-API",
+        "created": "האסימון נוצר",
+        "createFailed": "לא ניתן ליצור את האסימון",
+        "revokeFailed": "לא ניתן לבטל את האסימון"
+      }
+    },
     "sharedStacks": {
       "tab": "מקבצים משותפים",
       "intro": "תשתית Compose ארוכת-טווח (מסדי נתונים, ברוקרים, חיפוש, דואר) שמופעלת פעם אחת לכל סביבת עבודה ומשמשת מחדש בכל ההרצות ובקשות המשיכה. סביבת בדיקה מתחברת לרשת המנוהלת של מקבץ. הפעלת מקבץ מחייבת פריסת Docker מקומית; ב-backends אחרים עדיין ניתן לנהל את ההגדרה.",

package/i18n/locales/it.json

@@ -519,6 +519,36 @@
         "removeFailed": "Impossibile rimuovere la voce del registry"
       }
     },
+    "apiTokens": {
+      "title": "Token di accesso API",
+      "intro": "Crea token che i sistemi esterni presentano all'API di cat-factory. Ogni token si autentica come questo spazio di lavoro sugli endpoint /api/v1. Il segreto viene mostrato una sola volta, al momento della creazione, e non può essere recuperato, quindi conservalo subito.",
+      "secret": {
+        "heading": "Copia il tuo token ora",
+        "warning": "Questa è l'unica volta in cui viene mostrato il token completo. Conservalo in un luogo sicuro; non può essere recuperato.",
+        "copy": "Copia token",
+        "done": "Fatto"
+      },
+      "list": {
+        "heading": "Token attivi",
+        "created": "Creato il {date}",
+        "lastUsed": "ultimo utilizzo il {date}",
+        "neverUsed": "mai utilizzato",
+        "revoke": "Revoca token"
+      },
+      "add": {
+        "heading": "Crea un token",
+        "label": "Etichetta",
+        "labelHelp": "Un nome per riconoscere questo token in seguito.",
+        "labelPlaceholder": "es. pipeline CI",
+        "create": "Crea token"
+      },
+      "toast": {
+        "loadFailed": "Impossibile caricare i token API",
+        "created": "Token creato",
+        "createFailed": "Impossibile creare il token",
+        "revokeFailed": "Impossibile revocare il token"
+      }
+    },
     "sharedStacks": {
       "tab": "Stack condivisi",
       "intro": "Infrastruttura compose a lunga durata (database, broker, ricerca, mail) avviata una volta per workspace e riutilizzata tra run e pull request. Un ambiente di test si collega alla rete gestita di uno stack. L'avvio di uno stack viene eseguito su un deployment Docker locale; su altri backend puoi comunque gestire la definizione.",
@@ -1916,6 +1946,10 @@
           "label": "Registry di pacchetti privati",
           "description": "Token npm e GitHub Packages che gli agenti usano per installare dipendenze private."
         },
+        "apiTokens": {
+          "label": "Token di accesso API",
+          "description": "Token che i sistemi esterni presentano per chiamare l'API di cat-factory."
+        },
         "githubPat": {
           "label": "Il mio token GitHub",
           "description": "Un personal access token usato per le esecuzioni che avvii tu (push, PR, CI, merge)."

package/i18n/locales/ja.json

@@ -1792,6 +1792,10 @@
           "label": "プライベートパッケージレジストリ",
           "description": "エージェントがプライベート依存関係のインストールに使う npm と GitHub Packages のトークン。"
         },
+        "apiTokens": {
+          "label": "APIアクセストークン",
+          "description": "外部システムが cat-factory API を呼び出すために提示するトークン。"
+        },
         "githubPat": {
           "label": "マイ GitHub トークン",
           "description": "自分が開始した実行 (push、PR、CI、マージ) に使用するパーソナルアクセストークン。"
@@ -2333,6 +2337,36 @@
         "removeFailed": "レジストリエントリを削除できませんでした"
       }
     },
+    "apiTokens": {
+      "title": "APIアクセストークン",
+      "intro": "外部システムが cat-factory API に提示するトークンを作成します。各トークンは /api/v1 エンドポイントでこのワークスペースとして認証されます。シークレットは作成時に一度だけ表示され、復元できないため、すぐに保存してください。",
+      "secret": {
+        "heading": "今すぐトークンをコピーしてください",
+        "warning": "完全なトークンが表示されるのはこの一度だけです。安全な場所に保管してください。復元はできません。",
+        "copy": "トークンをコピー",
+        "done": "完了"
+      },
+      "list": {
+        "heading": "有効なトークン",
+        "created": "{date} に作成",
+        "lastUsed": "最終使用 {date}",
+        "neverUsed": "未使用",
+        "revoke": "トークンを取り消す"
+      },
+      "add": {
+        "heading": "トークンを作成",
+        "label": "ラベル",
+        "labelHelp": "後でこのトークンを識別するための名前。",
+        "labelPlaceholder": "例: CI パイプライン",
+        "create": "トークンを作成"
+      },
+      "toast": {
+        "loadFailed": "APIトークンを読み込めませんでした",
+        "created": "トークンを作成しました",
+        "createFailed": "トークンを作成できませんでした",
+        "revokeFailed": "トークンを取り消せませんでした"
+      }
+    },
     "sharedStacks": {
       "tab": "共有スタック",
       "intro": "ワークスペースごとに一度だけ起動され、すべての実行とプルリクエストで再利用される長期稼働の Compose インフラ（データベース、ブローカー、検索、メール）です。テスト環境はスタックのマネージドネットワークに接続します。スタックの起動にはローカルの Docker デプロイが必要です。他のバックエンドでも定義の管理は可能です。",

package/i18n/locales/pl.json

@@ -1792,6 +1792,10 @@
           "label": "Prywatne rejestry pakietów",
           "description": "Tokeny npm i GitHub Packages, których agenci używają do instalowania prywatnych zależności."
         },
+        "apiTokens": {
+          "label": "Tokeny dostępu do API",
+          "description": "Tokeny, które systemy zewnętrzne przedstawiają, aby wywołać API cat-factory."
+        },
         "githubPat": {
           "label": "Mój token GitHub",
           "description": "Osobisty token dostępu używany do uruchomień, które rozpoczynasz (pushe, PR-y, CI, scalanie)."
@@ -2211,6 +2215,36 @@
         "removeFailed": "Nie udało się usunąć wpisu rejestru"
       }
     },
+    "apiTokens": {
+      "title": "Tokeny dostępu do API",
+      "intro": "Twórz tokeny, które systemy zewnętrzne przedstawiają API cat-factory. Każdy token uwierzytelnia się jako ten obszar roboczy w punktach końcowych /api/v1. Sekret jest wyświetlany tylko raz, podczas tworzenia, i nie można go odzyskać, więc zapisz go od razu.",
+      "secret": {
+        "heading": "Skopiuj token teraz",
+        "warning": "To jedyny raz, gdy wyświetlany jest pełny token. Przechowuj go w bezpiecznym miejscu; nie można go odzyskać.",
+        "copy": "Kopiuj token",
+        "done": "Gotowe"
+      },
+      "list": {
+        "heading": "Aktywne tokeny",
+        "created": "Utworzono {date}",
+        "lastUsed": "ostatnio użyto {date}",
+        "neverUsed": "nigdy nie użyto",
+        "revoke": "Unieważnij token"
+      },
+      "add": {
+        "heading": "Utwórz token",
+        "label": "Etykieta",
+        "labelHelp": "Nazwa, po której później rozpoznasz ten token.",
+        "labelPlaceholder": "np. potok CI",
+        "create": "Utwórz token"
+      },
+      "toast": {
+        "loadFailed": "Nie udało się załadować tokenów API",
+        "created": "Token utworzony",
+        "createFailed": "Nie udało się utworzyć tokenu",
+        "revokeFailed": "Nie udało się unieważnić tokenu"
+      }
+    },
     "sharedStacks": {
       "tab": "Współdzielone stosy",
       "intro": "Długo działająca infrastruktura Compose (bazy danych, brokery, wyszukiwanie, poczta) uruchamiana raz na przestrzeń roboczą i wykorzystywana ponownie we wszystkich uruchomieniach i pull requestach. Środowisko testowe łączy się z zarządzaną siecią stosu. Uruchomienie stosu wymaga lokalnego wdrożenia Dockera; w innych backendach nadal możesz zarządzać definicją.",

package/i18n/locales/tr.json

@@ -1792,6 +1792,10 @@
           "label": "Özel paket kayıt defterleri",
           "description": "Aracıların özel bağımlılıkları yüklemek için kullandığı npm ve GitHub Packages token'ları."
         },
+        "apiTokens": {
+          "label": "API erişim belirteçleri",
+          "description": "Harici sistemlerin cat-factory API'sini çağırmak için sunduğu belirteçler."
+        },
         "githubPat": {
           "label": "GitHub token'ım",
           "description": "Başlattığınız çalıştırmalar için kullanılan kişisel erişim token'ı (push'lar, PR'lar, CI, birleştirme)."
@@ -2333,6 +2337,36 @@
         "removeFailed": "Kayıt defteri girdisi kaldırılamadı"
       }
     },
+    "apiTokens": {
+      "title": "API erişim belirteçleri",
+      "intro": "Harici sistemlerin cat-factory API'sine sunduğu belirteçler oluşturun. Her belirteç, /api/v1 uç noktalarında bu çalışma alanı olarak kimlik doğrular. Gizli anahtar yalnızca oluşturulduğunda bir kez gösterilir ve kurtarılamaz, bu yüzden onu hemen saklayın.",
+      "secret": {
+        "heading": "Belirtecinizi şimdi kopyalayın",
+        "warning": "Belirtecin tamamı yalnızca bu sefer gösterilir. Güvenli bir yerde saklayın; kurtarılamaz.",
+        "copy": "Belirteci kopyala",
+        "done": "Tamam"
+      },
+      "list": {
+        "heading": "Etkin belirteçler",
+        "created": "{date} tarihinde oluşturuldu",
+        "lastUsed": "son kullanım {date}",
+        "neverUsed": "hiç kullanılmadı",
+        "revoke": "Belirteci iptal et"
+      },
+      "add": {
+        "heading": "Belirteç oluştur",
+        "label": "Etiket",
+        "labelHelp": "Bu belirteci daha sonra tanımak için bir ad.",
+        "labelPlaceholder": "örn. CI hattı",
+        "create": "Belirteç oluştur"
+      },
+      "toast": {
+        "loadFailed": "API belirteçleri yüklenemedi",
+        "created": "Belirteç oluşturuldu",
+        "createFailed": "Belirteç oluşturulamadı",
+        "revokeFailed": "Belirteç iptal edilemedi"
+      }
+    },
     "sharedStacks": {
       "tab": "Paylaşılan yığınlar",
       "intro": "Çalışma alanı başına bir kez başlatılan ve tüm çalıştırmalar ile pull request'lerde yeniden kullanılan uzun ömürlü Compose altyapısı (veritabanları, aracılar, arama, posta). Bir test ortamı, yığının yönetilen ağına bağlanır. Bir yığını başlatmak yerel bir Docker dağıtımı gerektirir; diğer arka uçlarda tanımı yine de yönetebilirsiniz.",

package/i18n/locales/uk.json

@@ -1792,6 +1792,10 @@
           "label": "Приватні реєстри пакетів",
           "description": "Токени npm і GitHub Packages, які агенти використовують для встановлення приватних залежностей."
         },
+        "apiTokens": {
+          "label": "Токени доступу до API",
+          "description": "Токени, які зовнішні системи надають для виклику API cat-factory."
+        },
         "githubPat": {
           "label": "Мій токен GitHub",
           "description": "Особистий токен доступу, який використовується для запусків, що ви розпочинаєте (pushes, PR-и, CI, злиття)."
@@ -2211,6 +2215,36 @@
         "removeFailed": "Не вдалося видалити запис реєстру"
       }
     },
+    "apiTokens": {
+      "title": "Токени доступу до API",
+      "intro": "Створюйте токени, які зовнішні системи надають API cat-factory. Кожен токен автентифікується як цей робочий простір на кінцевих точках /api/v1. Секрет показується лише один раз, під час створення, і його не можна відновити, тож збережіть його одразу.",
+      "secret": {
+        "heading": "Скопіюйте токен зараз",
+        "warning": "Це єдиний раз, коли показується повний токен. Зберігайте його в безпечному місці; його не можна відновити.",
+        "copy": "Копіювати токен",
+        "done": "Готово"
+      },
+      "list": {
+        "heading": "Активні токени",
+        "created": "Створено {date}",
+        "lastUsed": "востаннє використано {date}",
+        "neverUsed": "ніколи не використовувався",
+        "revoke": "Відкликати токен"
+      },
+      "add": {
+        "heading": "Створити токен",
+        "label": "Мітка",
+        "labelHelp": "Назва, за якою ви пізніше впізнаєте цей токен.",
+        "labelPlaceholder": "напр. конвеєр CI",
+        "create": "Створити токен"
+      },
+      "toast": {
+        "loadFailed": "Не вдалося завантажити токени API",
+        "created": "Токен створено",
+        "createFailed": "Не вдалося створити токен",
+        "revokeFailed": "Не вдалося відкликати токен"
+      }
+    },
     "sharedStacks": {
       "tab": "Спільні стеки",
       "intro": "Довготривала інфраструктура Compose (бази даних, брокери, пошук, пошта), яку запускають один раз на робочий простір і повторно використовують у всіх запусках та pull request'ах. Тестове середовище під'єднується до керованої мережі стека. Запуск стека потребує локального розгортання Docker; на інших бекендах ви все одно можете керувати визначенням.",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cat-factory/app",
-  "version": "0.120.0",
+  "version": "0.121.0",
   "description": "Reusable Nuxt layer for the Agent Architecture Board SPA (components, stores, composables, pages). Consume it from a thin deployment app via `extends: ['@cat-factory/app']` and point it at your backend with NUXT_PUBLIC_API_BASE. See deploy/frontend for an example.",
   "repository": {
     "type": "git",