@cat-factory/app 0.120.0 → 0.121.1

package/app/stores/publicApiKeys.spec.ts

@@ -0,0 +1,105 @@
+import { describe, it, expect, beforeEach, vi } from 'vitest'
+import { usePublicApiKeysStore } from '~/stores/publicApiKeys'
+import { useWorkspaceStore } from '~/stores/workspace'
+import type { CreatedPublicApiKey, PublicApiKey } from '~/types/publicApiKeys'
+
+/** Minimal metadata-view factory — only the fields the store passes through. */
+function key(over: Partial<PublicApiKey> = {}): PublicApiKey {
+  return {
+    id: 'pak_1',
+    accountId: 'acc1',
+    workspaceId: 'ws1',
+    label: 'CI',
+    createdAt: 1,
+    lastUsedAt: null,
+    revokedAt: null,
+    ...over,
+  }
+}
+
+describe('publicApiKeys store', () => {
+  beforeEach(() => {
+    useWorkspaceStore().workspaceId = 'ws1'
+  })
+
+  it('load stores the key list and marks the feature available', async () => {
+    vi.stubGlobal('useApi', () => ({
+      listPublicApiKeys: () => Promise.resolve({ keys: [key()] }),
+    }))
+
+    const store = usePublicApiKeysStore()
+    await store.load()
+
+    expect(store.available).toBe(true)
+    expect(store.keys).toHaveLength(1)
+    expect(store.loading).toBe(false)
+  })
+
+  it('a definitive 503 latches the feature unavailable and clears the list', async () => {
+    vi.stubGlobal('useApi', () => ({
+      listPublicApiKeys: () => Promise.reject({ statusCode: 503 }),
+    }))
+
+    const store = usePublicApiKeysStore()
+    await store.load()
+
+    expect(store.available).toBe(false)
+    expect(store.keys).toEqual([])
+  })
+
+  it('a transient failure leaves `available` null so ensureLoaded stays retryable', async () => {
+    vi.stubGlobal('useApi', () => ({
+      listPublicApiKeys: () => Promise.reject({ statusCode: 500 }),
+    }))
+
+    const store = usePublicApiKeysStore()
+    await store.load()
+
+    // Never latched — a network/5xx blip must not hide an otherwise-available panel.
+    expect(store.available).toBeNull()
+  })
+
+  it('ensureLoaded coalesces concurrent callers into one request', async () => {
+    const list = vi.fn(() => Promise.resolve({ keys: [key()] }))
+    vi.stubGlobal('useApi', () => ({ listPublicApiKeys: list }))
+
+    const store = usePublicApiKeysStore()
+    await Promise.all([store.ensureLoaded(), store.ensureLoaded()])
+    // And once probed, it never re-fetches.
+    await store.ensureLoaded()
+
+    expect(list).toHaveBeenCalledTimes(1)
+  })
+
+  it('create prepends the new key (newest-first) and returns the one-time secret', async () => {
+    const created: CreatedPublicApiKey = {
+      key: key({ id: 'pak_new', label: 'deploy' }),
+      secret: 'cf_live_pak_new.abc',
+    }
+    vi.stubGlobal('useApi', () => ({
+      listPublicApiKeys: () => Promise.resolve({ keys: [key({ id: 'pak_old' })] }),
+      createPublicApiKey: () => Promise.resolve(created),
+    }))
+
+    const store = usePublicApiKeysStore()
+    await store.load()
+    const result = await store.create('deploy')
+
+    expect(result.secret).toBe('cf_live_pak_new.abc')
+    expect(store.keys.map((k) => k.id)).toEqual(['pak_new', 'pak_old'])
+    expect(store.available).toBe(true)
+  })
+
+  it('revoke drops the key from the list', async () => {
+    vi.stubGlobal('useApi', () => ({
+      listPublicApiKeys: () => Promise.resolve({ keys: [key({ id: 'a' }), key({ id: 'b' })] }),
+      revokePublicApiKey: () => Promise.resolve(),
+    }))
+
+    const store = usePublicApiKeysStore()
+    await store.load()
+    await store.revoke('a')
+
+    expect(store.keys.map((k) => k.id)).toEqual(['b'])
+  })
+})

package/app/stores/publicApiKeys.ts

@@ -0,0 +1,72 @@
+import { defineStore } from 'pinia'
+import { ref } from 'vue'
+import type { CreatedPublicApiKey, PublicApiKey } from '~/types/publicApiKeys'
+import { useWorkspaceStore } from '~/stores/workspace'
+import { apiErrorStatus } from '~/composables/api/errors'
+
+/**
+ * The workspace's inbound public-API keys ("API access tokens") external systems present
+ * to the `/api/v1` surface. Secrets are one-way hashed server-side and returned only once
+ * on create, so the store holds metadata-only views; the raw secret is surfaced by the
+ * caller from the `create()` result. Loaded on demand (the tokens panel + the Integrations
+ * hub badge), not from the snapshot.
+ */
+export const usePublicApiKeysStore = defineStore('publicApiKeys', () => {
+  const api = useApi()
+
+  const keys = ref<PublicApiKey[]>([])
+  const loading = ref(false)
+  // Mirrors the backend's opt-in gate (the module 503s when the encryption key is absent):
+  // `null` until first probed, then `true`/`false`. The hub hides its tokens entry point
+  // when this is false.
+  const available = ref<boolean | null>(null)
+  let inFlight: Promise<void> | null = null
+
+  /** Force a refresh of the key list (used after a create/revoke). */
+  async function load() {
+    const ws = useWorkspaceStore()
+    loading.value = true
+    try {
+      keys.value = (await api.listPublicApiKeys(ws.requireId())).keys
+      available.value = true
+    } catch (err) {
+      if (apiErrorStatus(err) === 503) {
+        // A definitive 503 means the feature is unconfigured (no encryption key on the
+        // backend): hide the UI entry points and stop probing.
+        available.value = false
+        keys.value = []
+      }
+      // Any other failure (transient 5xx / network) is left untouched: it must not hide an
+      // already-available panel nor cache a false "unavailable". `available` stays `null`
+      // when never probed, so `ensureLoaded` remains retryable on the next open.
+    } finally {
+      loading.value = false
+    }
+  }
+
+  /** Load once and share the result (coalescing concurrent callers); `load()` refreshes. */
+  async function ensureLoaded() {
+    if (available.value !== null) return
+    if (!inFlight) inFlight = load().finally(() => (inFlight = null))
+    return inFlight
+  }
+
+  /** Mint a key. Returns the created record PLUS the one-time raw secret (shown once). */
+  async function create(label: string): Promise<CreatedPublicApiKey> {
+    const ws = useWorkspaceStore()
+    const created = await api.createPublicApiKey(ws.requireId(), { label })
+    // Prepend: the backend lists newest-first, so the freshly minted key belongs at the
+    // top — matching the order a subsequent `load()` would produce.
+    keys.value = [created.key, ...keys.value]
+    available.value = true
+    return created
+  }
+
+  async function revoke(id: string) {
+    const ws = useWorkspaceStore()
+    await api.revokePublicApiKey(ws.requireId(), id)
+    keys.value = keys.value.filter((k) => k.id !== id)
+  }
+
+  return { keys, loading, available, load, ensureLoaded, create, revoke }
+})

package/app/stores/releaseHealth.ts

@@ -10,6 +10,7 @@ import type {
   IncidentEnrichmentView,
   UpsertIncidentEnrichmentInput,
 } from '~/types/incidentEnrichment'
+import { useUpsertList } from '~/composables/useUpsertList'
 import { useWorkspaceStore } from '~/stores/workspace'
 
 /**
@@ -26,7 +27,11 @@ export const useReleaseHealthStore = defineStore('releaseHealth', () => {
     provider: null,
     summary: null,
   })
-  const configs = ref<ReleaseHealthConfig[]>([])
+  const {
+    items: configs,
+    upsert: upsertConfig,
+    remove: dropConfig,
+  } = useUpsertList<ReleaseHealthConfig>({ key: (c) => c.blockId })
   // Incident-enrichment (PagerDuty + incident.io) connection — write-only secrets, the
   // store only ever holds the presence summary. Wired alongside observability.
   const incident = ref<IncidentEnrichmentView>({ connected: false, summary: null })
@@ -91,16 +96,14 @@ export const useReleaseHealthStore = defineStore('releaseHealth', () => {
   async function saveConfig(blockId: string, input: UpsertReleaseHealthConfigInput) {
     const ws = useWorkspaceStore()
     const saved = await api.upsertReleaseHealthConfig(ws.requireId(), blockId, input)
-    const idx = configs.value.findIndex((c) => c.blockId === blockId)
-    if (idx >= 0) configs.value[idx] = saved
-    else configs.value.push(saved)
+    upsertConfig(saved)
     return saved
   }
 
   async function removeConfig(blockId: string) {
     const ws = useWorkspaceStore()
     await api.deleteReleaseHealthConfig(ws.requireId(), blockId)
-    configs.value = configs.value.filter((c) => c.blockId !== blockId)
+    dropConfig(blockId)
   }
 
   /** Load the incident-enrichment connection (separate opt-in gate from observability). */

package/app/stores/sharedStacks.ts

@@ -1,10 +1,10 @@
 import { defineStore } from 'pinia'
-import { ref } from 'vue'
 import type {
   DetectSharedStackInput,
   SharedStack,
   UpdateSharedStackInput,
 } from '~/types/sharedStacks'
+import { useUpsertList } from '~/composables/useUpsertList'
 import { useWorkspaceStore } from '~/stores/workspace'
 
 /**
@@ -19,18 +19,13 @@ import { useWorkspaceStore } from '~/stores/workspace'
  */
 export const useSharedStacksStore = defineStore('sharedStacks', () => {
   const api = useApi()
-  const stacks = ref<SharedStack[]>([])
+  const { items: stacks, upsert: patch } = useUpsertList<SharedStack>({ key: (s) => s.id })
 
   function hydrate(list: SharedStack[]) {
+    // Keep the snapshot sorted oldest-first; the helper's plain hydrate wouldn't sort.
     stacks.value = [...list].sort((a, b) => a.createdAt - b.createdAt)
   }
 
-  function patch(stack: SharedStack) {
-    const idx = stacks.value.findIndex((s) => s.id === stack.id)
-    if (idx >= 0) stacks.value[idx] = stack
-    else stacks.value.push(stack)
-  }
-
   async function create(input: Parameters<typeof api.createSharedStack>[1]) {
     const ws = useWorkspaceStore()
     const created = await api.createSharedStack(ws.requireId(), input)

package/app/stores/ui.ts

@@ -168,6 +168,9 @@ export const useUiStore = defineStore('ui', () => {
   // Private package registries: the workspace's npm/GitHub-Packages entries agent
   // containers install with. Opened from the Integrations hub.
   const packageRegistriesOpen = ref(false)
+  // API access tokens: the workspace's inbound public-API keys external systems present to
+  // the `/api/v1` surface. Opened from the Integrations hub.
+  const apiTokensOpen = ref(false)
   // The single tabbed Infrastructure window — a TOP-LEVEL navbar destination (no longer
   // reached via the Integrations hub). Two topical tabs: "Agent containers" (the execution
   // backend + self-hosted runner pool, plus the local-mode warm pool/checkout) and "Test
@@ -618,6 +621,13 @@ export const useUiStore = defineStore('ui', () => {
   function closePackageRegistries() {
     packageRegistriesOpen.value = false
   }
+  function openApiTokens() {
+    resetHubReturn()
+    apiTokensOpen.value = true
+  }
+  function closeApiTokens() {
+    apiTokensOpen.value = false
+  }
   // Top-level navbar entry into the Infrastructure window. No hub-return marker (it isn't
   // reached from the Integrations hub), so the window shows no "Back to Integrations" control.
   function openInfrastructure(tab: 'environment' | 'runner-pool' = 'runner-pool') {
@@ -923,6 +933,7 @@ export const useUiStore = defineStore('ui', () => {
     accountSettingsScrollTarget,
     observabilityConnectionOpen,
     packageRegistriesOpen,
+    apiTokensOpen,
     infrastructureOpen,
     infrastructureTab,
     openInfrastructure,
@@ -1021,6 +1032,8 @@ export const useUiStore = defineStore('ui', () => {
     closeObservabilityConnection,
     openPackageRegistries,
     closePackageRegistries,
+    openApiTokens,
+    closeApiTokens,
     openProviderConnection,
     closeProviderConnection,
     k3sSetupPrefill,

package/app/types/publicApiKeys.ts

@@ -0,0 +1,10 @@
+// Inbound public-API keys — the "API access tokens" external systems present to the
+// `/api/v1` surface (`Authorization: Bearer cf_live_…`). Workspace-scoped; the raw secret
+// is returned exactly once on create and never again, so the list only ever holds metadata.
+// Re-exported from the shared contracts package (the single source of truth).
+export type {
+  PublicApiKey,
+  PublicApiKeyListResult,
+  CreatePublicApiKeyInput,
+  CreatedPublicApiKey,
+} from '@cat-factory/contracts'

package/i18n/locales/de.json

@@ -519,6 +519,36 @@
         "removeFailed": "Der Registry-Eintrag konnte nicht entfernt werden"
       }
     },
+    "apiTokens": {
+      "title": "API-Zugriffstokens",
+      "intro": "Erstelle Tokens, die externe Systeme der cat-factory-API vorlegen. Jedes Token authentifiziert sich als dieser Arbeitsbereich an den /api/v1-Endpunkten. Das Geheimnis wird nur einmal bei der Erstellung angezeigt und kann nicht wiederhergestellt werden. Speichere es daher sofort.",
+      "secret": {
+        "heading": "Kopiere dein Token jetzt",
+        "warning": "Dies ist das einzige Mal, dass das vollständige Token angezeigt wird. Bewahre es sicher auf; es kann nicht wiederhergestellt werden.",
+        "copy": "Token kopieren",
+        "done": "Fertig"
+      },
+      "list": {
+        "heading": "Aktive Tokens",
+        "created": "Erstellt am {date}",
+        "lastUsed": "zuletzt verwendet am {date}",
+        "neverUsed": "nie verwendet",
+        "revoke": "Token widerrufen"
+      },
+      "add": {
+        "heading": "Token erstellen",
+        "label": "Bezeichnung",
+        "labelHelp": "Ein Name, um dieses Token später wiederzuerkennen.",
+        "labelPlaceholder": "z. B. CI-Pipeline",
+        "create": "Token erstellen"
+      },
+      "toast": {
+        "loadFailed": "API-Tokens konnten nicht geladen werden",
+        "created": "Token erstellt",
+        "createFailed": "Token konnte nicht erstellt werden",
+        "revokeFailed": "Token konnte nicht widerrufen werden"
+      }
+    },
     "sharedStacks": {
       "tab": "Gemeinsame Stacks",
       "intro": "Langlebige Compose-Infrastruktur (Datenbanken, Broker, Suche, Mail), die einmal pro Workspace hochgefahren und über Ausführungen und Pull Requests hinweg wiederverwendet wird. Eine Testumgebung verbindet sich mit dem verwalteten Netzwerk eines Stacks. Das Hochfahren eines Stacks läuft auf einem lokalen Docker-Deployment; auf anderen Backends kannst du die Definition dennoch verwalten.",
@@ -1916,6 +1946,10 @@
           "label": "Private Package-Registries",
           "description": "npm- und GitHub-Packages-Tokens, mit denen Agenten private Abhängigkeiten installieren."
         },
+        "apiTokens": {
+          "label": "API-Zugriffstokens",
+          "description": "Tokens, die externe Systeme vorlegen, um die cat-factory-API aufzurufen."
+        },
         "githubPat": {
           "label": "Mein GitHub-Token",
           "description": "Ein Personal Access Token, der für von Ihnen gestartete Läufe verwendet wird (Pushes, PRs, CI, Merge)."

package/i18n/locales/en.json

@@ -1859,6 +1859,10 @@
           "label": "Private package registries",
           "description": "npm and GitHub Packages tokens agents use to install private dependencies."
         },
+        "apiTokens": {
+          "label": "API access tokens",
+          "description": "Tokens external systems present to call the cat-factory API."
+        },
         "githubPat": {
           "label": "My GitHub token",
           "description": "A personal access token used for runs you start (pushes, PRs, CI, merge)."
@@ -2396,6 +2400,36 @@
         "removeFailed": "Could not remove the registry entry"
       }
     },
+    "apiTokens": {
+      "title": "API access tokens",
+      "intro": "Create tokens that external systems present to the cat-factory API. Each token authenticates as this workspace on the /api/v1 endpoints. The secret is shown only once, when you create it, and cannot be recovered, so store it right away.",
+      "secret": {
+        "heading": "Copy your token now",
+        "warning": "This is the only time the full token is shown. Store it somewhere safe; it cannot be recovered.",
+        "copy": "Copy token",
+        "done": "Done"
+      },
+      "list": {
+        "heading": "Active tokens",
+        "created": "Created {date}",
+        "lastUsed": "last used {date}",
+        "neverUsed": "never used",
+        "revoke": "Revoke token"
+      },
+      "add": {
+        "heading": "Create a token",
+        "label": "Label",
+        "labelHelp": "A name to recognize this token by later.",
+        "labelPlaceholder": "e.g. CI pipeline",
+        "create": "Create token"
+      },
+      "toast": {
+        "loadFailed": "Could not load API tokens",
+        "created": "Token created",
+        "createFailed": "Could not create the token",
+        "revokeFailed": "Could not revoke the token"
+      }
+    },
     "sharedStacks": {
       "tab": "Shared stacks",
       "intro": "Long-lived compose infrastructure (databases, brokers, search, mail) brought up once per workspace and reused across runs and pull requests. A test environment attaches to a stack's managed network. Bringing a stack up runs on a local Docker deployment; on other backends you can still manage the definition.",

package/i18n/locales/es.json

@@ -1792,6 +1792,10 @@
           "label": "Registros privados de paquetes",
           "description": "Tokens de npm y GitHub Packages que los agentes usan para instalar dependencias privadas."
         },
+        "apiTokens": {
+          "label": "Tokens de acceso a la API",
+          "description": "Tokens que los sistemas externos presentan para llamar a la API de cat-factory."
+        },
         "githubPat": {
           "label": "Mi token de GitHub",
           "description": "Un token de acceso personal usado para las ejecuciones que inicias (pushes, PR, CI, fusión)."
@@ -2211,6 +2215,36 @@
         "removeFailed": "No se pudo eliminar la entrada del registro"
       }
     },
+    "apiTokens": {
+      "title": "Tokens de acceso a la API",
+      "intro": "Crea tokens que los sistemas externos presentan a la API de cat-factory. Cada token se autentica como este espacio de trabajo en los endpoints /api/v1. El secreto se muestra una sola vez, al crearlo, y no se puede recuperar, así que guárdalo de inmediato.",
+      "secret": {
+        "heading": "Copia tu token ahora",
+        "warning": "Esta es la única vez que se muestra el token completo. Guárdalo en un lugar seguro; no se puede recuperar.",
+        "copy": "Copiar token",
+        "done": "Listo"
+      },
+      "list": {
+        "heading": "Tokens activos",
+        "created": "Creado el {date}",
+        "lastUsed": "usado por última vez el {date}",
+        "neverUsed": "nunca usado",
+        "revoke": "Revocar token"
+      },
+      "add": {
+        "heading": "Crear un token",
+        "label": "Etiqueta",
+        "labelHelp": "Un nombre para reconocer este token más adelante.",
+        "labelPlaceholder": "p. ej. pipeline de CI",
+        "create": "Crear token"
+      },
+      "toast": {
+        "loadFailed": "No se pudieron cargar los tokens de la API",
+        "created": "Token creado",
+        "createFailed": "No se pudo crear el token",
+        "revokeFailed": "No se pudo revocar el token"
+      }
+    },
     "sharedStacks": {
       "tab": "Stacks compartidos",
       "intro": "Infraestructura de Compose de larga duración (bases de datos, brokers, búsqueda, correo) que se levanta una vez por espacio de trabajo y se reutiliza en todas las ejecuciones y pull requests. Un entorno de pruebas se conecta a la red gestionada de un stack. Levantar un stack requiere un despliegue local de Docker; en otros backends puedes gestionar igualmente la definición.",

package/i18n/locales/fr.json

@@ -1792,6 +1792,10 @@
           "label": "Registres de paquets privés",
           "description": "Jetons npm et GitHub Packages que les agents utilisent pour installer les dépendances privées."
         },
+        "apiTokens": {
+          "label": "Jetons d'accès à l'API",
+          "description": "Jetons que les systèmes externes présentent pour appeler l'API cat-factory."
+        },
         "githubPat": {
           "label": "Mon jeton GitHub",
           "description": "Un jeton d'accès personnel utilisé pour les exécutions que vous lancez (pushes, PR, CI, fusion)."
@@ -2211,6 +2215,36 @@
         "removeFailed": "Impossible de supprimer l'entrée du registre"
       }
     },
+    "apiTokens": {
+      "title": "Jetons d'accès à l'API",
+      "intro": "Créez des jetons que les systèmes externes présentent à l'API cat-factory. Chaque jeton s'authentifie en tant que cet espace de travail sur les points de terminaison /api/v1. Le secret n'est affiché qu'une seule fois, à sa création, et ne peut pas être récupéré, alors conservez-le immédiatement.",
+      "secret": {
+        "heading": "Copiez votre jeton maintenant",
+        "warning": "C'est la seule fois où le jeton complet est affiché. Conservez-le en lieu sûr ; il ne peut pas être récupéré.",
+        "copy": "Copier le jeton",
+        "done": "Terminé"
+      },
+      "list": {
+        "heading": "Jetons actifs",
+        "created": "Créé le {date}",
+        "lastUsed": "dernière utilisation le {date}",
+        "neverUsed": "jamais utilisé",
+        "revoke": "Révoquer le jeton"
+      },
+      "add": {
+        "heading": "Créer un jeton",
+        "label": "Libellé",
+        "labelHelp": "Un nom pour reconnaître ce jeton plus tard.",
+        "labelPlaceholder": "ex. pipeline CI",
+        "create": "Créer le jeton"
+      },
+      "toast": {
+        "loadFailed": "Impossible de charger les jetons d'API",
+        "created": "Jeton créé",
+        "createFailed": "Impossible de créer le jeton",
+        "revokeFailed": "Impossible de révoquer le jeton"
+      }
+    },
     "sharedStacks": {
       "tab": "Stacks partagés",
       "intro": "Infrastructure Compose de longue durée (bases de données, brokers, recherche, e-mail) démarrée une fois par espace de travail et réutilisée pour toutes les exécutions et pull requests. Un environnement de test se connecte au réseau géré d'un stack. Démarrer un stack nécessite un déploiement Docker local ; sur les autres backends, vous pouvez tout de même gérer la définition.",

package/i18n/locales/he.json

@@ -1792,6 +1792,10 @@
           "label": "מאגרי חבילות פרטיים",
           "description": "אסימוני npm ו-GitHub Packages שסוכנים משתמשים בהם להתקנת תלויות פרטיות."
         },
+        "apiTokens": {
+          "label": "אסימוני גישה ל-API",
+          "description": "אסימונים שמערכות חיצוניות מציגות כדי לקרוא ל-API של cat-factory."
+        },
         "githubPat": {
           "label": "אסימון ה-GitHub שלי",
           "description": "אסימון גישה אישי המשמש להרצות שאתה מתחיל (דחיפות, PR, CI, מיזוג)."
@@ -2332,6 +2336,36 @@
         "removeFailed": "הסרת רשומת המאגר נכשלה"
       }
     },
+    "apiTokens": {
+      "title": "אסימוני גישה ל-API",
+      "intro": "צור אסימונים שמערכות חיצוניות מציגות ל-API של cat-factory. כל אסימון מאמת את עצמו כמרחב העבודה הזה בנקודות הקצה /api/v1. הסוד מוצג פעם אחת בלבד, בעת היצירה, ולא ניתן לשחזרו, לכן שמור אותו מיד.",
+      "secret": {
+        "heading": "העתק את האסימון שלך עכשיו",
+        "warning": "זו הפעם היחידה שבה מוצג האסימון המלא. שמור אותו במקום בטוח; לא ניתן לשחזרו.",
+        "copy": "העתק אסימון",
+        "done": "סיום"
+      },
+      "list": {
+        "heading": "אסימונים פעילים",
+        "created": "נוצר בתאריך {date}",
+        "lastUsed": "שימוש אחרון בתאריך {date}",
+        "neverUsed": "מעולם לא היה בשימוש",
+        "revoke": "בטל אסימון"
+      },
+      "add": {
+        "heading": "צור אסימון",
+        "label": "תווית",
+        "labelHelp": "שם שיעזור לך לזהות את האסימון הזה בהמשך.",
+        "labelPlaceholder": "לדוגמה, צינור CI",
+        "create": "צור אסימון"
+      },
+      "toast": {
+        "loadFailed": "לא ניתן לטעון את אסימוני ה-API",
+        "created": "האסימון נוצר",
+        "createFailed": "לא ניתן ליצור את האסימון",
+        "revokeFailed": "לא ניתן לבטל את האסימון"
+      }
+    },
     "sharedStacks": {
       "tab": "מקבצים משותפים",
       "intro": "תשתית Compose ארוכת-טווח (מסדי נתונים, ברוקרים, חיפוש, דואר) שמופעלת פעם אחת לכל סביבת עבודה ומשמשת מחדש בכל ההרצות ובקשות המשיכה. סביבת בדיקה מתחברת לרשת המנוהלת של מקבץ. הפעלת מקבץ מחייבת פריסת Docker מקומית; ב-backends אחרים עדיין ניתן לנהל את ההגדרה.",

package/i18n/locales/it.json

@@ -519,6 +519,36 @@
         "removeFailed": "Impossibile rimuovere la voce del registry"
       }
     },
+    "apiTokens": {
+      "title": "Token di accesso API",
+      "intro": "Crea token che i sistemi esterni presentano all'API di cat-factory. Ogni token si autentica come questo spazio di lavoro sugli endpoint /api/v1. Il segreto viene mostrato una sola volta, al momento della creazione, e non può essere recuperato, quindi conservalo subito.",
+      "secret": {
+        "heading": "Copia il tuo token ora",
+        "warning": "Questa è l'unica volta in cui viene mostrato il token completo. Conservalo in un luogo sicuro; non può essere recuperato.",
+        "copy": "Copia token",
+        "done": "Fatto"
+      },
+      "list": {
+        "heading": "Token attivi",
+        "created": "Creato il {date}",
+        "lastUsed": "ultimo utilizzo il {date}",
+        "neverUsed": "mai utilizzato",
+        "revoke": "Revoca token"
+      },
+      "add": {
+        "heading": "Crea un token",
+        "label": "Etichetta",
+        "labelHelp": "Un nome per riconoscere questo token in seguito.",
+        "labelPlaceholder": "es. pipeline CI",
+        "create": "Crea token"
+      },
+      "toast": {
+        "loadFailed": "Impossibile caricare i token API",
+        "created": "Token creato",
+        "createFailed": "Impossibile creare il token",
+        "revokeFailed": "Impossibile revocare il token"
+      }
+    },
     "sharedStacks": {
       "tab": "Stack condivisi",
       "intro": "Infrastruttura compose a lunga durata (database, broker, ricerca, mail) avviata una volta per workspace e riutilizzata tra run e pull request. Un ambiente di test si collega alla rete gestita di uno stack. L'avvio di uno stack viene eseguito su un deployment Docker locale; su altri backend puoi comunque gestire la definizione.",
@@ -1916,6 +1946,10 @@
           "label": "Registry di pacchetti privati",
           "description": "Token npm e GitHub Packages che gli agenti usano per installare dipendenze private."
         },
+        "apiTokens": {
+          "label": "Token di accesso API",
+          "description": "Token che i sistemi esterni presentano per chiamare l'API di cat-factory."
+        },
         "githubPat": {
           "label": "Il mio token GitHub",
           "description": "Un personal access token usato per le esecuzioni che avvii tu (push, PR, CI, merge)."

package/i18n/locales/ja.json

@@ -1792,6 +1792,10 @@
           "label": "プライベートパッケージレジストリ",
           "description": "エージェントがプライベート依存関係のインストールに使う npm と GitHub Packages のトークン。"
         },
+        "apiTokens": {
+          "label": "APIアクセストークン",
+          "description": "外部システムが cat-factory API を呼び出すために提示するトークン。"
+        },
         "githubPat": {
           "label": "マイ GitHub トークン",
           "description": "自分が開始した実行 (push、PR、CI、マージ) に使用するパーソナルアクセストークン。"
@@ -2333,6 +2337,36 @@
         "removeFailed": "レジストリエントリを削除できませんでした"
       }
     },
+    "apiTokens": {
+      "title": "APIアクセストークン",
+      "intro": "外部システムが cat-factory API に提示するトークンを作成します。各トークンは /api/v1 エンドポイントでこのワークスペースとして認証されます。シークレットは作成時に一度だけ表示され、復元できないため、すぐに保存してください。",
+      "secret": {
+        "heading": "今すぐトークンをコピーしてください",
+        "warning": "完全なトークンが表示されるのはこの一度だけです。安全な場所に保管してください。復元はできません。",
+        "copy": "トークンをコピー",
+        "done": "完了"
+      },
+      "list": {
+        "heading": "有効なトークン",
+        "created": "{date} に作成",
+        "lastUsed": "最終使用 {date}",
+        "neverUsed": "未使用",
+        "revoke": "トークンを取り消す"
+      },
+      "add": {
+        "heading": "トークンを作成",
+        "label": "ラベル",
+        "labelHelp": "後でこのトークンを識別するための名前。",
+        "labelPlaceholder": "例: CI パイプライン",
+        "create": "トークンを作成"
+      },
+      "toast": {
+        "loadFailed": "APIトークンを読み込めませんでした",
+        "created": "トークンを作成しました",
+        "createFailed": "トークンを作成できませんでした",
+        "revokeFailed": "トークンを取り消せませんでした"
+      }
+    },
     "sharedStacks": {
       "tab": "共有スタック",
       "intro": "ワークスペースごとに一度だけ起動され、すべての実行とプルリクエストで再利用される長期稼働の Compose インフラ（データベース、ブローカー、検索、メール）です。テスト環境はスタックのマネージドネットワークに接続します。スタックの起動にはローカルの Docker デプロイが必要です。他のバックエンドでも定義の管理は可能です。",