@cat-factory/app 0.128.0 → 0.130.0

package/app/components/visualConfirm/VisualConfirmationWindow.vue

@@ -19,6 +19,7 @@ const board = useBoardStore()
 const execution = useExecutionStore()
 const visualConfirm = useVisualConfirmStore()
 const { t } = useI18n()
+const access = useWorkspaceAccess()
 
 // Per-window blob cache; release the cached screenshot/reference object URLs when the window
 // goes away, so the (potentially large) blob bytes don't linger for the rest of the session.
@@ -351,7 +352,8 @@ const canApprove = computed(
                   color="warning"
                   icon="i-lucide-wrench"
                   :loading="busy"
-                  :disabled="busy || !hasFindings"
+                  :disabled="busy || !hasFindings || !access.canExecuteRuns.value"
+                  :title="access.canExecuteRuns.value ? undefined : t('access.noRunExecute')"
                   @click="submitFix"
                 >
                   {{ t('visualConfirm.requestFix.send') }}
@@ -430,7 +432,8 @@ const canApprove = computed(
               color="neutral"
               icon="i-lucide-refresh-cw"
               :loading="busy"
-              :disabled="busy || !awaitingHuman"
+              :disabled="busy || !awaitingHuman || !access.canExecuteRuns.value"
+              :title="access.canExecuteRuns.value ? undefined : t('access.noRunExecute')"
               @click="recapture"
             >
               {{ t('visualConfirm.recapture') }}
@@ -439,7 +442,8 @@ const canApprove = computed(
               color="primary"
               icon="i-lucide-circle-check"
               :loading="busy"
-              :disabled="!canApprove"
+              :disabled="!canApprove || !access.canExecuteRuns.value"
+              :title="access.canExecuteRuns.value ? undefined : t('access.noRunExecute')"
               @click="approve"
             >
               {{ t('visualConfirm.approve') }}

package/app/composables/useBlockDeletion.ts

@@ -18,6 +18,7 @@ export function useBlockDeletion() {
   const toast = useToast()
   const { confirm } = useConfirm()
   const { t } = useI18n()
+  const access = useWorkspaceAccess()
 
   /** A service is any top-level frame; only services are archivable. */
   function isService(block: Block): boolean {
@@ -37,6 +38,9 @@ export function useBlockDeletion() {
    */
   async function archiveBlock(block: Block | undefined | null): Promise<boolean> {
     if (!block || !isService(block)) return false
+    // Archiving is a `board.write` mutation — a read-only viewer's keyboard/inspector path
+    // no-ops (the inspector button is disabled for them; this guards the shortcut too).
+    if (!access.canWriteBoard.value) return false
     const ok = await confirm({
       title: t('panels.inspector.confirmArchive.title'),
       description: t('panels.inspector.confirmArchive.body', { name: block.title }),
@@ -94,6 +98,9 @@ export function useBlockDeletion() {
 
   async function deleteBlock(block: Block | undefined | null): Promise<boolean> {
     if (!block) return false
+    // Deletion is a `board.write` mutation — no-op for a read-only viewer (guards both the
+    // inspector Delete button and the global Delete-key shortcut, which share this path).
+    if (!access.canWriteBoard.value) return false
     // A service with unfinished work can't be deleted (the backend rejects it) — archive it
     // instead. Route straight to the archive flow so the user is never handed a dead-end error.
     if (isService(block) && unfinishedTaskCount(block) > 0) return archiveBlock(block)

package/app/composables/useBlockDrag.ts

@@ -18,6 +18,7 @@ const draggingId = ref<string | null>(null)
 export function useBlockDrag() {
   const board = useBoardStore()
   const ui = useUiStore()
+  const access = useWorkspaceAccess()
 
   function startDrag(
     block: Block,
@@ -25,6 +26,10 @@ export function useBlockDrag() {
     opts: { reparent?: boolean; clamp?: boolean } = {},
   ) {
     if (e.button !== 0) return
+    // Read-only viewers can pan/inspect but never move or reparent a block — the drag
+    // is a `board.write` mutation, so it no-ops for them (the SPA mirror of the backend
+    // member floor; the affordance itself is hidden/disabled at the button level too).
+    if (!access.canWriteBoard.value) return
     e.preventDefault()
     e.stopPropagation()
     const startX = e.clientX

package/app/composables/useFrameResize.ts

@@ -12,6 +12,7 @@ import type { Block } from '~/types/domain'
 export function useFrameResize() {
   const board = useBoardStore()
   const ui = useUiStore()
+  const access = useWorkspaceAccess()
   /** Id of the frame currently being resized, for cursor/handle styling. */
   const resizingId = ref<string | null>(null)
 
@@ -21,6 +22,9 @@ export function useFrameResize() {
    */
   function startResize(block: Block, e: PointerEvent, edge: 'e' | 's' | 'se') {
     if (e.button !== 0) return
+    // Resizing a frame persists its size — a `board.write` mutation, so a read-only
+    // viewer's resize no-ops (the grips are hidden for them at the component level).
+    if (!access.canWriteBoard.value) return
     e.preventDefault()
     e.stopPropagation()
     const startX = e.clientX

package/app/composables/useWorkspaceAccess.spec.ts

@@ -0,0 +1,102 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type { WorkspaceAccess } from '~/types/domain'
+import { useWorkspaceStore } from '~/stores/workspace'
+import { useWorkspaceAccess } from '~/composables/useWorkspaceAccess'
+
+// `useWorkspaceAccess` reads the active board's resolved `{ role, permissions }` off the
+// workspace store and answers "can the caller do X here". The store is real (a fresh Pinia
+// per test via test/setup.ts); the composable calls it through the Nuxt auto-import, so
+// expose it as a global. No API/i18n is touched by the composable.
+beforeEach(() => {
+  vi.stubGlobal('useWorkspaceStore', useWorkspaceStore)
+})
+
+/** Set the active board's access on the store, then build the composable over it. */
+function withAccess(access: WorkspaceAccess | null) {
+  useWorkspaceStore().access = access
+  return useWorkspaceAccess()
+}
+
+describe('useWorkspaceAccess', () => {
+  it('dev-open (no access resolved) allows everything — backend parity', () => {
+    const a = withAccess(null)
+    expect(a.role.value).toBeNull()
+    expect(a.permissions.value).toBeNull()
+    expect(a.can('board.write')).toBe(true)
+    expect(a.can('members.manage')).toBe(true)
+    expect(a.canWriteBoard.value).toBe(true)
+    expect(a.canExecuteRuns.value).toBe(true)
+    expect(a.canManageSettings.value).toBe(true)
+    // dev-open is NOT a viewer — it sees all, so isViewer is false and isMember/isAdmin true.
+    expect(a.isViewer.value).toBe(false)
+    expect(a.isMember.value).toBe(true)
+    expect(a.isAdmin.value).toBe(true)
+  })
+
+  it('viewer can only read', () => {
+    const a = withAccess({ role: 'viewer', permissions: ['workspace.read'] })
+    expect(a.role.value).toBe('viewer')
+    expect(a.can('workspace.read')).toBe(true)
+    expect(a.can('board.write')).toBe(false)
+    expect(a.can('runs.execute')).toBe(false)
+    expect(a.canWriteBoard.value).toBe(false)
+    expect(a.canExecuteRuns.value).toBe(false)
+    expect(a.isViewer.value).toBe(true)
+    expect(a.isMember.value).toBe(false)
+    expect(a.isAdmin.value).toBe(false)
+  })
+
+  it('member can write the board and execute runs but not manage', () => {
+    const a = withAccess({
+      role: 'member',
+      permissions: ['workspace.read', 'board.write', 'runs.execute'],
+    })
+    expect(a.canWriteBoard.value).toBe(true)
+    expect(a.canExecuteRuns.value).toBe(true)
+    expect(a.canManageSettings.value).toBe(false)
+    expect(a.canManageIntegrations.value).toBe(false)
+    expect(a.canManageSecrets.value).toBe(false)
+    expect(a.canManageMembers.value).toBe(false)
+    expect(a.isViewer.value).toBe(false)
+    expect(a.isMember.value).toBe(true)
+    expect(a.isAdmin.value).toBe(false)
+  })
+
+  it('admin holds every permission', () => {
+    const a = withAccess({
+      role: 'admin',
+      permissions: [
+        'workspace.read',
+        'board.write',
+        'runs.execute',
+        'settings.manage',
+        'integrations.manage',
+        'secrets.manage',
+        'members.manage',
+      ],
+    })
+    expect(a.canManageSettings.value).toBe(true)
+    expect(a.canManageIntegrations.value).toBe(true)
+    expect(a.canManageSecrets.value).toBe(true)
+    expect(a.canManageMembers.value).toBe(true)
+    expect(a.isAdmin.value).toBe(true)
+  })
+
+  it('can() reads the granted permission SET, not the role name', () => {
+    // A future upgrade-overlay/custom grant could carry a permission beyond the role's
+    // default set; `can()` must honour the array the backend actually sent.
+    const a = withAccess({ role: 'member', permissions: ['workspace.read', 'runs.execute'] })
+    expect(a.can('board.write')).toBe(false)
+    expect(a.can('runs.execute')).toBe(true)
+  })
+
+  it('reacts to a live access change (board switch / snapshot refresh)', () => {
+    const a = withAccess({ role: 'viewer', permissions: ['workspace.read'] })
+    expect(a.canWriteBoard.value).toBe(false)
+    useWorkspaceStore().access = {
+      role: 'member',
+      permissions: ['workspace.read', 'board.write', 'runs.execute'],
+    }
+    expect(a.canWriteBoard.value).toBe(true)
+  })
+})

package/app/composables/useWorkspaceAccess.ts

@@ -0,0 +1,84 @@
+import { computed } from 'vue'
+import type { WorkspacePermission, WorkspaceRole } from '~/types/domain'
+
+/**
+ * The signed-in caller's resolved workspace-RBAC access to the ACTIVE board — the
+ * central helper for gating _workspace-scoped_ affordances in the SPA (board editing,
+ * run controls, HITL actions, admin settings panels). It reads the `access` the auth
+ * gate resolved server-side and attached to the workspace snapshot (`{ role, permissions }`),
+ * so the frontend never re-derives the permission math — it consumes the same source of
+ * truth the backend enforces against.
+ *
+ * **Dev-open parity.** When auth is disabled the backend attaches no `access` (it resolves
+ * no access object and allows everything), so an absent snapshot access here means dev-open
+ * ⇒ `can()` returns `true` for every permission and `role` is `null`. This mirrors the
+ * backend's `requirePermission` "absent access with no user ⇒ allow" branch exactly, so the
+ * SPA never hides an affordance the backend would have permitted.
+ *
+ * This is deliberately distinct from the ACCOUNT-scoped admin checks
+ * (`accounts.activeAccount?.roles?.includes('admin')`), which stay account-scoped: this
+ * composable answers "what can you do inside THIS board", the account check answers "what
+ * can you do to the tenant".
+ */
+export function useWorkspaceAccess() {
+  const workspace = useWorkspaceStore()
+
+  /** The caller's effective role on the active board, or `null` in dev-open (auth off). */
+  const role = computed<WorkspaceRole | null>(() => workspace.access?.role ?? null)
+
+  /**
+   * The permission set the backend granted the caller, or `null` in dev-open. `can()`
+   * short-circuits to allow-all when this is null, so a null set is never a "deny".
+   */
+  const permissions = computed<ReadonlySet<WorkspacePermission> | null>(() =>
+    workspace.access ? new Set(workspace.access.permissions) : null,
+  )
+
+  /**
+   * Whether the caller holds `permission` on the active board. Absent access (dev-open)
+   * ⇒ `true` (backend-parity). Use this — never a raw role comparison — so a future
+   * custom-role model or an escape-hatch grant is honoured automatically.
+   */
+  function can(permission: WorkspacePermission): boolean {
+    const set = permissions.value
+    return set === null || set.has(permission)
+  }
+
+  /** Board mutation (blocks CRUD/move/reparent/archive, epics, initiatives, pipelines). */
+  const canWriteBoard = computed(() => can('board.write'))
+  /** Run lifecycle + all HITL windows (start/stop/merge, retry, decision approvals). */
+  const canExecuteRuns = computed(() => can('runs.execute'))
+  /** Board configuration (workspace settings, presets, risk/merge policies, observability). */
+  const canManageSettings = computed(() => can('settings.manage'))
+  /** Integration connections (GitHub/Slack/environments/runner-pool/sources, bootstrap). */
+  const canManageIntegrations = computed(() => can('integrations.manage'))
+  /** Secrets (vendor credentials, workspace + public API keys, test secrets). */
+  const canManageSecrets = computed(() => can('secrets.manage'))
+  /** Roster + access-mode flip (workspace member CRUD). */
+  const canManageMembers = computed(() => can('members.manage'))
+
+  /**
+   * A read-only viewer (resolved a role, but not `>= member`). Distinct from dev-open:
+   * `isViewer` is `false` when there is no access object at all, since dev-open sees all.
+   */
+  const isViewer = computed(() => role.value === 'viewer')
+  /** Resolved at least the member tier (or dev-open). */
+  const isMember = computed(() => role.value === null || role.value !== 'viewer')
+  /** A workspace admin (or dev-open). */
+  const isAdmin = computed(() => role.value === null || role.value === 'admin')
+
+  return {
+    role,
+    permissions,
+    can,
+    canWriteBoard,
+    canExecuteRuns,
+    canManageSettings,
+    canManageIntegrations,
+    canManageSecrets,
+    canManageMembers,
+    isViewer,
+    isMember,
+    isAdmin,
+  }
+}

package/app/stores/publicApiKeys.spec.ts

@@ -11,6 +11,7 @@ function key(over: Partial<PublicApiKey> = {}): PublicApiKey {
     workspaceId: 'ws1',
     label: 'CI',
     scope: 'write',
+    createdByUserId: null,
     createdAt: 1,
     lastUsedAt: null,
     revokedAt: null,

package/app/stores/workspace.spec.ts

@@ -216,4 +216,23 @@ describe('workspace store cold-open speculative snapshot', () => {
     expect(getWorkspace).toHaveBeenCalledWith('ws3')
     expect(useBoardStore().getBlock('f3')).toBeDefined()
   })
+
+  // Slice 8 (workspace-RBAC frontend): the resolved `access` the auth gate attaches to the
+  // snapshot must land on the store so `useWorkspaceAccess()` can gate affordances.
+  it('hydrates the resolved workspace access from the snapshot', async () => {
+    const snap = snapshot('ws1', [block('f1')]) as WorkspaceSnapshot
+    snap.access = { role: 'viewer', permissions: ['workspace.read'] }
+    const getWorkspace = vi.fn().mockResolvedValue(snap)
+    vi.stubGlobal('useApi', () => ({ getWorkspace }))
+
+    const ws = useWorkspaceStore()
+    await ws.switchTo('ws1')
+    expect(ws.access).toEqual({ role: 'viewer', permissions: ['workspace.read'] })
+
+    // A subsequent snapshot WITHOUT access (older backend / dev-open) clears it back to null.
+    const snap2 = snapshot('ws1', [block('f1')]) as WorkspaceSnapshot
+    getWorkspace.mockResolvedValue(snap2)
+    await ws.refresh()
+    expect(ws.access).toBeNull()
+  })
 })

package/app/stores/workspace.ts

@@ -4,7 +4,8 @@ import type {
   BudgetCaps,
   InfraSetup,
   SpendStatus,
-  Workspace,
+  WorkspaceAccess,
+  WorkspaceListItem,
   WorkspaceSnapshot,
 } from '~/types/domain'
 import { useAccountsStore } from '~/stores/accounts'
@@ -53,8 +54,12 @@ export const useWorkspaceStore = defineStore(
 
     /** Active workspace id (persisted so a reload reopens the same board). */
     const workspaceId = ref<string | null>(null)
-    /** Every board visible to the user, across the accounts they belong to. */
-    const workspaces = ref<Workspace[]>([])
+    /**
+     * Every board visible to the user, across the accounts they belong to. Each row is
+     * annotated by `GET /workspaces` with the caller's effective workspace-RBAC role
+     * (`viewerRole`) so a restricted board can be badged in the switcher.
+     */
+    const workspaces = ref<WorkspaceListItem[]>([])
     /** True once the initial snapshot has been loaded and stores hydrated. */
     const ready = ref(false)
     /** Set when bootstrap fails so the UI can show a retry. */
@@ -73,6 +78,14 @@ export const useWorkspaceStore = defineStore(
      * doesn't compute it (⇒ no banner).
      */
     const infraSetup = ref<InfraSetup | null>(null)
+    /**
+     * The signed-in caller's resolved workspace-RBAC access to the ACTIVE board — their
+     * effective role + the permission set it grants, from the auth gate's resolution
+     * (attached to the snapshot with zero extra reads). Null on an older backend OR in
+     * dev-open (auth disabled) — `useWorkspaceAccess()` then allows everything (backend
+     * parity). Consumers MUST go through `useWorkspaceAccess()`, never read this directly.
+     */
+    const access = ref<WorkspaceAccess | null>(null)
 
     /** The boards belonging to the active account (all boards when auth is off). */
     const accountWorkspaces = computed(() => {
@@ -118,10 +131,16 @@ export const useWorkspaceStore = defineStore(
       budgetCaps.value = snapshot.budgetCaps ?? null
       useUserSettingsStore().hydrate(snapshot.userSettings ?? null)
       infraSetup.value = snapshot.infraSetup ?? null
-      // Keep the board list in step (e.g. a freshly created board, or a rename).
-      const i = workspaces.value.findIndex((w) => w.id === snapshot.workspace.id)
-      if (i >= 0) workspaces.value[i] = snapshot.workspace
-      else workspaces.value.unshift(snapshot.workspace)
+      access.value = snapshot.access ?? null
+      // Keep the board list in step (e.g. a freshly created board, or a rename). The
+      // snapshot's `workspace` carries no `viewerRole` (that's a `GET /workspaces` list
+      // annotation), so preserve any existing badge rather than clobbering it to absent.
+      const existingRow = workspaces.value.find((w) => w.id === snapshot.workspace.id)
+      if (existingRow) {
+        Object.assign(existingRow, snapshot.workspace)
+      } else {
+        workspaces.value.unshift(snapshot.workspace)
+      }
       useBoardStore().hydrate(snapshot.blocks, boardSince)
       useBoardStore().hydrateArchived(snapshot.archivedServices ?? [])
       usePipelinesStore().hydrate(snapshot.pipelines, snapshot.pipelineCatalogVersions)
@@ -337,6 +356,7 @@ export const useWorkspaceStore = defineStore(
       userSpend,
       budgetCaps,
       infraSetup,
+      access,
       init,
       switchTo,
       selectAccount,

package/app/types/domain.ts

@@ -63,7 +63,13 @@ export type {
   SpendStatus,
   BudgetCaps,
   Workspace,
+  WorkspaceListItem,
   WorkspaceSnapshot,
+  WorkspaceRole,
+  WorkspacePermission,
+  WorkspaceAccessMode,
+  WorkspaceAccess,
+  WorkspaceMember,
   TaskLimitMode,
   WorkspaceSettings,
   UpdateWorkspaceSettingsInput,

package/i18n/locales/de.json

@@ -534,6 +534,8 @@
         "created": "Erstellt am {date}",
         "lastUsed": "zuletzt verwendet am {date}",
         "neverUsed": "nie verwendet",
+        "createdBy": "erstellt von {user}",
+        "createdByYou": "Ihnen",
         "revoke": "Token widerrufen"
       },
       "add": {
@@ -3897,6 +3899,11 @@
       "keep": "Weiter bearbeiten"
     }
   },
+  "access": {
+    "noBoardWrite": "Nur-Lese-Zugriff: Sie können dieses Board ansehen, aber nicht bearbeiten.",
+    "noRunExecute": "Nur-Lese-Zugriff: Sie können Ausführungen ansehen, aber nicht starten oder steuern.",
+    "viewerBadge": "Betrachter"
+  },
   "clarification": {
     "answerPlaceholder": "Ihre Antwort",
     "notRelevant": "Nicht relevant",

package/i18n/locales/en.json

@@ -83,6 +83,14 @@
       "keep": "Keep editing"
     }
   },
+  "access": {
+    "noBoardWrite": "Read-only access: you can view this board but can't edit it.",
+    "noRunExecute": "Read-only access: you can view runs but can't start or control them.",
+    "viewerBadge": "Viewer",
+    "@viewerBadge": {
+      "description": "Short badge label on a board the caller can only view (read-only workspace role). Localize as the noun for a read-only observer."
+    }
+  },
   "clarification": {
     "answerPlaceholder": "Your answer",
     "notRelevant": "Not relevant",
@@ -2483,6 +2491,8 @@
         "created": "Created {date}",
         "lastUsed": "last used {date}",
         "neverUsed": "never used",
+        "createdBy": "created by {user}",
+        "createdByYou": "you",
         "revoke": "Revoke token"
       },
       "add": {

package/i18n/locales/es.json

@@ -74,6 +74,11 @@
       "keep": "Seguir editando"
     }
   },
+  "access": {
+    "noBoardWrite": "Acceso de solo lectura: puedes ver este tablero pero no editarlo.",
+    "noRunExecute": "Acceso de solo lectura: puedes ver las ejecuciones pero no iniciarlas ni controlarlas.",
+    "viewerBadge": "Observador"
+  },
   "clarification": {
     "answerPlaceholder": "Tu respuesta",
     "notRelevant": "No relevante",
@@ -2298,6 +2303,8 @@
         "created": "Creado el {date}",
         "lastUsed": "usado por última vez el {date}",
         "neverUsed": "nunca usado",
+        "createdBy": "creado por {user}",
+        "createdByYou": "ti",
         "revoke": "Revocar token"
       },
       "add": {

package/i18n/locales/fr.json

@@ -74,6 +74,11 @@
       "keep": "Continuer l'édition"
     }
   },
+  "access": {
+    "noBoardWrite": "Accès en lecture seule : vous pouvez consulter ce tableau mais pas le modifier.",
+    "noRunExecute": "Accès en lecture seule : vous pouvez consulter les exécutions mais pas les lancer ni les contrôler.",
+    "viewerBadge": "Observateur"
+  },
   "clarification": {
     "answerPlaceholder": "Votre réponse",
     "notRelevant": "Non pertinent",
@@ -2298,6 +2303,8 @@
         "created": "Créé le {date}",
         "lastUsed": "dernière utilisation le {date}",
         "neverUsed": "jamais utilisé",
+        "createdBy": "créé par {user}",
+        "createdByYou": "vous",
         "revoke": "Révoquer le jeton"
       },
       "add": {

package/i18n/locales/he.json

@@ -74,6 +74,11 @@
       "keep": "להמשיך לערוך"
     }
   },
+  "access": {
+    "noBoardWrite": "גישת קריאה בלבד: אפשר לצפות בלוח הזה אך לא לערוך אותו.",
+    "noRunExecute": "גישת קריאה בלבד: אפשר לצפות בהרצות אך לא להפעיל או לשלוט בהן.",
+    "viewerBadge": "צופה"
+  },
   "clarification": {
     "answerPlaceholder": "התשובה שלך",
     "notRelevant": "לא רלוונטי",
@@ -2419,6 +2424,8 @@
         "created": "נוצר בתאריך {date}",
         "lastUsed": "שימוש אחרון בתאריך {date}",
         "neverUsed": "מעולם לא היה בשימוש",
+        "createdBy": "נוצר על ידי {user}",
+        "createdByYou": "אתה",
         "revoke": "בטל אסימון"
       },
       "add": {

package/i18n/locales/it.json

@@ -534,6 +534,8 @@
         "created": "Creato il {date}",
         "lastUsed": "ultimo utilizzo il {date}",
         "neverUsed": "mai utilizzato",
+        "createdBy": "creato da {user}",
+        "createdByYou": "te",
         "revoke": "Revoca token"
       },
       "add": {
@@ -3897,6 +3899,11 @@
       "keep": "Continua a modificare"
     }
   },
+  "access": {
+    "noBoardWrite": "Accesso in sola lettura: puoi visualizzare questa board ma non modificarla.",
+    "noRunExecute": "Accesso in sola lettura: puoi visualizzare le esecuzioni ma non avviarle né controllarle.",
+    "viewerBadge": "Osservatore"
+  },
   "clarification": {
     "answerPlaceholder": "La tua risposta",
     "notRelevant": "Non pertinente",

package/i18n/locales/ja.json

@@ -74,6 +74,11 @@
       "keep": "編集を続ける"
     }
   },
+  "access": {
+    "noBoardWrite": "読み取り専用アクセス: このボードは閲覧できますが編集はできません。",
+    "noRunExecute": "読み取り専用アクセス: 実行は閲覧できますが、開始や制御はできません。",
+    "viewerBadge": "閲覧者"
+  },
   "clarification": {
     "answerPlaceholder": "回答を入力",
     "notRelevant": "関連なし",
@@ -2420,6 +2425,8 @@
         "created": "{date} に作成",
         "lastUsed": "最終使用 {date}",
         "neverUsed": "未使用",
+        "createdBy": "作成者: {user}",
+        "createdByYou": "あなた",
         "revoke": "トークンを取り消す"
       },
       "add": {

package/i18n/locales/pl.json

@@ -74,6 +74,11 @@
       "keep": "Kontynuuj edycję"
     }
   },
+  "access": {
+    "noBoardWrite": "Dostęp tylko do odczytu: możesz przeglądać tę tablicę, ale nie możesz jej edytować.",
+    "noRunExecute": "Dostęp tylko do odczytu: możesz przeglądać uruchomienia, ale nie możesz ich uruchamiać ani nimi sterować.",
+    "viewerBadge": "Obserwator"
+  },
   "clarification": {
     "answerPlaceholder": "Twoja odpowiedź",
     "notRelevant": "Nieistotne",
@@ -2298,6 +2303,8 @@
         "created": "Utworzono {date}",
         "lastUsed": "ostatnio użyto {date}",
         "neverUsed": "nigdy nie użyto",
+        "createdBy": "utworzone przez {user}",
+        "createdByYou": "Ciebie",
         "revoke": "Unieważnij token"
       },
       "add": {

package/i18n/locales/tr.json

@@ -74,6 +74,11 @@
       "keep": "Düzenlemeye devam et"
     }
   },
+  "access": {
+    "noBoardWrite": "Salt okunur erişim: bu panoyu görüntüleyebilirsiniz ancak düzenleyemezsiniz.",
+    "noRunExecute": "Salt okunur erişim: çalıştırmaları görüntüleyebilirsiniz ancak başlatamaz veya denetleyemezsiniz.",
+    "viewerBadge": "İzleyici"
+  },
   "clarification": {
     "answerPlaceholder": "Yanıtınız",
     "notRelevant": "İlgili değil",
@@ -2420,6 +2425,8 @@
         "created": "{date} tarihinde oluşturuldu",
         "lastUsed": "son kullanım {date}",
         "neverUsed": "hiç kullanılmadı",
+        "createdBy": "oluşturan: {user}",
+        "createdByYou": "siz",
         "revoke": "Belirteci iptal et"
       },
       "add": {

package/i18n/locales/uk.json

@@ -74,6 +74,11 @@
       "keep": "Продовжити редагування"
     }
   },
+  "access": {
+    "noBoardWrite": "Доступ лише для перегляду: ви можете переглядати цю дошку, але не можете її редагувати.",
+    "noRunExecute": "Доступ лише для перегляду: ви можете переглядати запуски, але не можете їх запускати чи керувати ними.",
+    "viewerBadge": "Глядач"
+  },
   "clarification": {
     "answerPlaceholder": "Ваша відповідь",
     "notRelevant": "Не актуально",
@@ -2298,6 +2303,8 @@
         "created": "Створено {date}",
         "lastUsed": "востаннє використано {date}",
         "neverUsed": "ніколи не використовувався",
+        "createdBy": "створено {user}",
+        "createdByYou": "вами",
         "revoke": "Відкликати токен"
       },
       "add": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cat-factory/app",
-  "version": "0.128.0",
+  "version": "0.130.0",
   "description": "Reusable Nuxt layer for the Agent Architecture Board SPA (components, stores, composables, pages). Consume it from a thin deployment app via `extends: ['@cat-factory/app']` and point it at your backend with NUXT_PUBLIC_API_BASE. See deploy/frontend for an example.",
   "repository": {
     "type": "git",
@@ -34,7 +34,7 @@
     "valibot": "^1.4.2",
     "vue": "3.5.39",
     "wretch": "^3.0.9",
-    "@cat-factory/contracts": "0.147.0"
+    "@cat-factory/contracts": "0.147.1"
   },
   "devDependencies": {
     "@toad-contracts/testing": "0.3.2",