@cat-factory/app 0.129.0 → 0.131.0

package/app/stores/workspace.ts

@@ -4,7 +4,8 @@ import type {
   BudgetCaps,
   InfraSetup,
   SpendStatus,
-  Workspace,
+  WorkspaceAccess,
+  WorkspaceListItem,
   WorkspaceSnapshot,
 } from '~/types/domain'
 import { useAccountsStore } from '~/stores/accounts'
@@ -53,8 +54,12 @@ export const useWorkspaceStore = defineStore(
 
     /** Active workspace id (persisted so a reload reopens the same board). */
     const workspaceId = ref<string | null>(null)
-    /** Every board visible to the user, across the accounts they belong to. */
-    const workspaces = ref<Workspace[]>([])
+    /**
+     * Every board visible to the user, across the accounts they belong to. Each row is
+     * annotated by `GET /workspaces` with the caller's effective workspace-RBAC role
+     * (`viewerRole`) so a restricted board can be badged in the switcher.
+     */
+    const workspaces = ref<WorkspaceListItem[]>([])
     /** True once the initial snapshot has been loaded and stores hydrated. */
     const ready = ref(false)
     /** Set when bootstrap fails so the UI can show a retry. */
@@ -73,6 +78,14 @@ export const useWorkspaceStore = defineStore(
      * doesn't compute it (⇒ no banner).
      */
     const infraSetup = ref<InfraSetup | null>(null)
+    /**
+     * The signed-in caller's resolved workspace-RBAC access to the ACTIVE board — their
+     * effective role + the permission set it grants, from the auth gate's resolution
+     * (attached to the snapshot with zero extra reads). Null on an older backend OR in
+     * dev-open (auth disabled) — `useWorkspaceAccess()` then allows everything (backend
+     * parity). Consumers MUST go through `useWorkspaceAccess()`, never read this directly.
+     */
+    const access = ref<WorkspaceAccess | null>(null)
 
     /** The boards belonging to the active account (all boards when auth is off). */
     const accountWorkspaces = computed(() => {
@@ -118,10 +131,16 @@ export const useWorkspaceStore = defineStore(
       budgetCaps.value = snapshot.budgetCaps ?? null
       useUserSettingsStore().hydrate(snapshot.userSettings ?? null)
       infraSetup.value = snapshot.infraSetup ?? null
-      // Keep the board list in step (e.g. a freshly created board, or a rename).
-      const i = workspaces.value.findIndex((w) => w.id === snapshot.workspace.id)
-      if (i >= 0) workspaces.value[i] = snapshot.workspace
-      else workspaces.value.unshift(snapshot.workspace)
+      access.value = snapshot.access ?? null
+      // Keep the board list in step (e.g. a freshly created board, or a rename). The
+      // snapshot's `workspace` carries no `viewerRole` (that's a `GET /workspaces` list
+      // annotation), so preserve any existing badge rather than clobbering it to absent.
+      const existingRow = workspaces.value.find((w) => w.id === snapshot.workspace.id)
+      if (existingRow) {
+        Object.assign(existingRow, snapshot.workspace)
+      } else {
+        workspaces.value.unshift(snapshot.workspace)
+      }
       useBoardStore().hydrate(snapshot.blocks, boardSince)
       useBoardStore().hydrateArchived(snapshot.archivedServices ?? [])
       usePipelinesStore().hydrate(snapshot.pipelines, snapshot.pipelineCatalogVersions)
@@ -337,6 +356,7 @@ export const useWorkspaceStore = defineStore(
       userSpend,
       budgetCaps,
       infraSetup,
+      access,
       init,
       switchTo,
       selectAccount,

package/app/stores/workspaceMembers.spec.ts

@@ -0,0 +1,121 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { useWorkspaceMembersStore } from '~/stores/workspaceMembers'
+import { useWorkspaceStore } from '~/stores/workspace'
+import type { WorkspaceMember } from '~/types/domain'
+
+/** Minimal member view — only the fields the store passes through. */
+function member(over: Partial<WorkspaceMember> = {}): WorkspaceMember {
+  return {
+    workspaceId: 'ws1',
+    userId: 'usr_1',
+    role: 'member',
+    createdAt: 1,
+    addedBy: null,
+    ...over,
+  }
+}
+
+describe('workspaceMembers store', () => {
+  beforeEach(() => {
+    // The store patches the board-list row on an access-mode flip; seed one restricted-capable row.
+    const workspace = useWorkspaceStore()
+    workspace.workspaces = [
+      { id: 'ws1', name: 'Board', accountId: 'acc1', accessMode: 'account', viewerRole: 'admin' },
+    ] as never
+  })
+
+  it('load replaces the roster and records which board it belongs to', async () => {
+    vi.stubGlobal('useApi', () => ({
+      listWorkspaceMembers: () =>
+        Promise.resolve([member({ userId: 'a' }), member({ userId: 'b' })]),
+    }))
+
+    const store = useWorkspaceMembersStore()
+    await store.load('ws1')
+
+    expect(store.members.map((m) => m.userId)).toEqual(['a', 'b'])
+    expect(store.loadedFor).toBe('ws1')
+  })
+
+  it('load is monotonic — a superseded slow fetch cannot clobber a newer board', async () => {
+    // Two loads in flight; the OLDER-issued one (wsA) resolves LAST. It must be dropped so
+    // the switcher never renders the previous board's roster over the current one.
+    const resolvers = new Map<string, (v: WorkspaceMember[]) => void>()
+    vi.stubGlobal('useApi', () => ({
+      listWorkspaceMembers: (ws: string) =>
+        new Promise<WorkspaceMember[]>((resolve) => resolvers.set(ws, resolve)),
+    }))
+
+    const store = useWorkspaceMembersStore()
+    const first = store.load('wsA') // slow, issued first
+    const second = store.load('wsB') // newer, issued second
+
+    resolvers.get('wsB')?.([member({ userId: 'b', workspaceId: 'wsB' })])
+    await second
+    resolvers.get('wsA')?.([member({ userId: 'a', workspaceId: 'wsA' })])
+    await first
+
+    expect(store.members.map((m) => m.userId)).toEqual(['b'])
+    expect(store.loadedFor).toBe('wsB')
+  })
+
+  it('add upserts the returned member', async () => {
+    vi.stubGlobal('useApi', () => ({
+      listWorkspaceMembers: () => Promise.resolve([member({ userId: 'a' })]),
+      addWorkspaceMember: (_ws: string, userId: string, role: WorkspaceMember['role']) =>
+        Promise.resolve(member({ userId, role })),
+    }))
+
+    const store = useWorkspaceMembersStore()
+    await store.load('ws1')
+    await store.add('ws1', 'b', 'viewer')
+
+    expect(store.members.map((m) => m.userId)).toEqual(['a', 'b'])
+    expect(store.members.find((m) => m.userId === 'b')?.role).toBe('viewer')
+  })
+
+  it('setRole replaces the member in place', async () => {
+    vi.stubGlobal('useApi', () => ({
+      listWorkspaceMembers: () => Promise.resolve([member({ userId: 'a', role: 'member' })]),
+      setWorkspaceMemberRole: (_ws: string, userId: string, role: WorkspaceMember['role']) =>
+        Promise.resolve(member({ userId, role })),
+    }))
+
+    const store = useWorkspaceMembersStore()
+    await store.load('ws1')
+    await store.setRole('ws1', 'a', 'admin')
+
+    expect(store.members).toHaveLength(1)
+    expect(store.members[0]?.role).toBe('admin')
+  })
+
+  it('remove drops the member from the roster', async () => {
+    vi.stubGlobal('useApi', () => ({
+      listWorkspaceMembers: () =>
+        Promise.resolve([member({ userId: 'a' }), member({ userId: 'b' })]),
+      removeWorkspaceMember: () => Promise.resolve(),
+    }))
+
+    const store = useWorkspaceMembersStore()
+    await store.load('ws1')
+    await store.remove('ws1', 'a')
+
+    expect(store.members.map((m) => m.userId)).toEqual(['b'])
+  })
+
+  it('setAccessMode patches the board-list row in place, preserving the viewerRole annotation', async () => {
+    vi.stubGlobal('useApi', () => ({
+      setWorkspaceAccessMode: (workspaceId: string, accessMode: string) =>
+        // The single-workspace response carries no `viewerRole` (that's a list annotation).
+        Promise.resolve({ id: workspaceId, name: 'Board', accountId: 'acc1', accessMode }),
+    }))
+
+    const store = useWorkspaceMembersStore()
+    await store.setAccessMode('ws1', 'restricted')
+
+    const row = useWorkspaceStore().workspaces.find((w) => w.id === 'ws1')
+    expect(row?.accessMode).toBe('restricted')
+    // The merge must not clobber the list-only badge.
+    expect(row?.viewerRole).toBe('admin')
+  })
+})

package/app/stores/workspaceMembers.ts

@@ -0,0 +1,74 @@
+import { defineStore } from 'pinia'
+import { ref } from 'vue'
+import { useUpsertList } from '~/composables/useUpsertList'
+import type { WorkspaceAccessMode, WorkspaceMember, WorkspaceRole } from '~/types/domain'
+import { useWorkspaceStore } from '~/stores/workspace'
+
+/**
+ * The active board's workspace-RBAC roster (member-management, slice 9). Owns the
+ * `workspace_members` list plus the board's access-mode flip, sitting BELOW the account
+ * tier: an account admin can restrict a board to an explicit member list, while an
+ * unrestricted (`account`) board keeps the legacy "every account member sees it" behaviour.
+ *
+ * Every write requires `members.manage` server-side, so the SPA only mounts this surface
+ * (the Members tab in workspace settings) when `useWorkspaceAccess().canManageMembers`.
+ * The list is loaded lazily when that panel opens — it is not part of the board snapshot.
+ */
+export const useWorkspaceMembersStore = defineStore('workspaceMembers', () => {
+  const api = useApi()
+
+  const { items: members, upsert: upsertMember } = useUpsertList<WorkspaceMember>({
+    key: (m) => m.userId,
+  })
+  /**
+   * The workspace id the currently-committed roster belongs to. The Members panel renders
+   * the roster only while this matches its own `workspaceId`, so switching boards never
+   * briefly shows the previous board's members before the new load resolves.
+   */
+  const loadedFor = ref<string | null>(null)
+  // Monotonic request token: only the latest-issued load() commits, so a slow, superseded
+  // fetch can't clobber a newer board's roster (the ordering hazard the coherence rules warn about).
+  let loadSeq = 0
+
+  /** Load the board's member roster (enriched with display details by the backend). */
+  async function load(workspaceId: string) {
+    const token = ++loadSeq
+    const roster = await api.listWorkspaceMembers(workspaceId)
+    if (token !== loadSeq) return // a newer load() superseded this one; drop the stale result
+    members.value = roster
+    loadedFor.value = workspaceId
+  }
+
+  /** Add an account member to the board at a workspace role (upsert). */
+  async function add(workspaceId: string, userId: string, role: WorkspaceRole) {
+    upsertMember(await api.addWorkspaceMember(workspaceId, userId, role))
+  }
+
+  /** Change an existing member's workspace role. */
+  async function setRole(workspaceId: string, userId: string, role: WorkspaceRole) {
+    upsertMember(await api.setWorkspaceMemberRole(workspaceId, userId, role))
+  }
+
+  /** Remove a member from the board. */
+  async function remove(workspaceId: string, userId: string) {
+    await api.removeWorkspaceMember(workspaceId, userId)
+    members.value = members.value.filter((m) => m.userId !== userId)
+  }
+
+  /**
+   * Flip the board's access mode. `restricted` limits it to the roster; `account` restores
+   * the legacy behaviour. Patches the board's list row in place so the switcher badge and
+   * `activeWorkspace.accessMode` reflect the flip without a re-fetch.
+   */
+  async function setAccessMode(workspaceId: string, accessMode: WorkspaceAccessMode) {
+    const updated = await api.setWorkspaceAccessMode(workspaceId, accessMode)
+    const workspace = useWorkspaceStore()
+    const row = workspace.workspaces.find((w) => w.id === workspaceId)
+    // Merge only the workspace fields (incl. `accessMode`), preserving the row's
+    // `viewerRole` list annotation, which the single-workspace response doesn't carry.
+    if (row) Object.assign(row, updated)
+    return updated
+  }
+
+  return { members, loadedFor, load, add, setRole, remove, setAccessMode }
+})

package/app/types/domain.ts

@@ -63,7 +63,13 @@ export type {
   SpendStatus,
   BudgetCaps,
   Workspace,
+  WorkspaceListItem,
   WorkspaceSnapshot,
+  WorkspaceRole,
+  WorkspacePermission,
+  WorkspaceAccessMode,
+  WorkspaceAccess,
+  WorkspaceMember,
   TaskLimitMode,
   WorkspaceSettings,
   UpdateWorkspaceSettingsInput,

package/i18n/locales/de.json

@@ -709,7 +709,8 @@
         "budget": "Budget",
         "merge": "Risikorichtlinien",
         "tracker": "Issue-Tracker",
-        "fragments": "Dienst-Best-Practices"
+        "fragments": "Dienst-Best-Practices",
+        "members": "Mitglieder"
       },
       "waiting": {
         "heading": "Warten auf einen Menschen",
@@ -1978,6 +1979,40 @@
     },
     "accountSkills": {
       "intro": "Verknüpfe Repositorys, in denen dein Team Claude Skills erstellt (ein SKILL.md-Ordner plus Ressourcendateien). Synchronisierte Skills landen im Katalog dieses Kontos, der von allen Boards geteilt wird, und der Skill-Schritt einer Pipeline führt einen davon für eine Aufgabe aus."
+    },
+    "workspaceMembers": {
+      "you": "{name} (du)",
+      "roles": {
+        "admin": "Admin",
+        "member": "Mitglied",
+        "viewer": "Betrachter"
+      },
+      "accessMode": {
+        "title": "Board-Zugriff",
+        "accountHint": "Alle im zugehörigen Konto können dieses Board sehen.",
+        "restrictedHint": "Nur die unten aufgeführten Mitglieder können dieses Board sehen.",
+        "restrictToggle": "Auf Mitglieder beschränken"
+      },
+      "roster": {
+        "title": "Mitglieder",
+        "empty": "Noch keine Mitglieder.",
+        "remove": "Mitglied entfernen"
+      },
+      "add": {
+        "title": "Mitglied hinzufügen",
+        "selectMember": "Kontomitglied auswählen",
+        "submit": "Hinzufügen",
+        "added": "Mitglied hinzugefügt",
+        "allAdded": "Alle Kontomitglieder sind bereits auf diesem Board.",
+        "noAccount": "Dieses Board ist noch mit keinem Konto verknüpft."
+      },
+      "errors": {
+        "load": "Mitglieder konnten nicht geladen werden",
+        "accessMode": "Board-Zugriff konnte nicht geändert werden",
+        "setRole": "Mitgliedsrolle konnte nicht aktualisiert werden",
+        "add": "Mitglied konnte nicht hinzugefügt werden",
+        "remove": "Mitglied konnte nicht entfernt werden"
+      }
     }
   },
   "board": {
@@ -3899,6 +3934,11 @@
       "keep": "Weiter bearbeiten"
     }
   },
+  "access": {
+    "noBoardWrite": "Nur-Lese-Zugriff: Sie können dieses Board ansehen, aber nicht bearbeiten.",
+    "noRunExecute": "Nur-Lese-Zugriff: Sie können Ausführungen ansehen, aber nicht starten oder steuern.",
+    "viewerBadge": "Betrachter"
+  },
   "clarification": {
     "answerPlaceholder": "Ihre Antwort",
     "notRelevant": "Nicht relevant",

package/i18n/locales/en.json

@@ -83,6 +83,14 @@
       "keep": "Keep editing"
     }
   },
+  "access": {
+    "noBoardWrite": "Read-only access: you can view this board but can't edit it.",
+    "noRunExecute": "Read-only access: you can view runs but can't start or control them.",
+    "viewerBadge": "Viewer",
+    "@viewerBadge": {
+      "description": "Short badge label on a board the caller can only view (read-only workspace role). Localize as the noun for a read-only observer."
+    }
+  },
   "clarification": {
     "answerPlaceholder": "Your answer",
     "notRelevant": "Not relevant",
@@ -1943,6 +1951,40 @@
     },
     "accountSkills": {
       "intro": "Link repos where your team authors Claude Skills (a SKILL.md folder plus resource files). Synced skills join this account's catalog, shared by every board, and a pipeline's Skill step runs one against a task."
+    },
+    "workspaceMembers": {
+      "you": "{name} (you)",
+      "roles": {
+        "admin": "Admin",
+        "member": "Member",
+        "viewer": "Viewer"
+      },
+      "accessMode": {
+        "title": "Board access",
+        "accountHint": "Everyone in the owning account can see this board.",
+        "restrictedHint": "Only the members listed below can see this board.",
+        "restrictToggle": "Restrict to members"
+      },
+      "roster": {
+        "title": "Members",
+        "empty": "No members yet.",
+        "remove": "Remove member"
+      },
+      "add": {
+        "title": "Add a member",
+        "selectMember": "Select an account member",
+        "submit": "Add",
+        "added": "Member added",
+        "allAdded": "Every account member is already on this board.",
+        "noAccount": "This board isn't linked to an account yet."
+      },
+      "errors": {
+        "load": "Could not load members",
+        "accessMode": "Could not change board access",
+        "setRole": "Could not update member role",
+        "add": "Could not add member",
+        "remove": "Could not remove member"
+      }
     }
   },
   "settings": {
@@ -2658,7 +2700,8 @@
         "budget": "Budget",
         "merge": "Risk policies",
         "tracker": "Issue tracker",
-        "fragments": "Service best practices"
+        "fragments": "Service best practices",
+        "members": "Members"
       },
       "waiting": {
         "heading": "Waiting for a human",

package/i18n/locales/es.json

@@ -74,6 +74,11 @@
       "keep": "Seguir editando"
     }
   },
+  "access": {
+    "noBoardWrite": "Acceso de solo lectura: puedes ver este tablero pero no editarlo.",
+    "noRunExecute": "Acceso de solo lectura: puedes ver las ejecuciones pero no iniciarlas ni controlarlas.",
+    "viewerBadge": "Observador"
+  },
   "clarification": {
     "answerPlaceholder": "Tu respuesta",
     "notRelevant": "No relevante",
@@ -1883,6 +1888,40 @@
     },
     "accountSkills": {
       "intro": "Vincula repositorios donde tu equipo crea Claude Skills (una carpeta SKILL.md más archivos de recursos). Las habilidades sincronizadas se añaden al catálogo de esta cuenta, compartido por todos los tableros, y el paso Skill de una tubería ejecuta una sobre una tarea."
+    },
+    "workspaceMembers": {
+      "you": "{name} (tú)",
+      "roles": {
+        "admin": "Administrador",
+        "member": "Miembro",
+        "viewer": "Observador"
+      },
+      "accessMode": {
+        "title": "Acceso al tablero",
+        "accountHint": "Todos los miembros de la cuenta propietaria pueden ver este tablero.",
+        "restrictedHint": "Solo los miembros que aparecen abajo pueden ver este tablero.",
+        "restrictToggle": "Restringir a miembros"
+      },
+      "roster": {
+        "title": "Miembros",
+        "empty": "Aún no hay miembros.",
+        "remove": "Quitar miembro"
+      },
+      "add": {
+        "title": "Añadir un miembro",
+        "selectMember": "Selecciona un miembro de la cuenta",
+        "submit": "Añadir",
+        "added": "Miembro añadido",
+        "allAdded": "Todos los miembros de la cuenta ya están en este tablero.",
+        "noAccount": "Este tablero aún no está vinculado a una cuenta."
+      },
+      "errors": {
+        "load": "No se pudieron cargar los miembros",
+        "accessMode": "No se pudo cambiar el acceso al tablero",
+        "setRole": "No se pudo actualizar el rol del miembro",
+        "add": "No se pudo añadir el miembro",
+        "remove": "No se pudo quitar el miembro"
+      }
     }
   },
   "settings": {
@@ -2473,7 +2512,8 @@
         "budget": "Presupuesto",
         "merge": "Políticas de riesgo",
         "tracker": "Gestor de incidencias",
-        "fragments": "Buenas prácticas del servicio"
+        "fragments": "Buenas prácticas del servicio",
+        "members": "Miembros"
       },
       "waiting": {
         "heading": "Esperando a una persona",

package/i18n/locales/fr.json

@@ -74,6 +74,11 @@
       "keep": "Continuer l'édition"
     }
   },
+  "access": {
+    "noBoardWrite": "Accès en lecture seule : vous pouvez consulter ce tableau mais pas le modifier.",
+    "noRunExecute": "Accès en lecture seule : vous pouvez consulter les exécutions mais pas les lancer ni les contrôler.",
+    "viewerBadge": "Observateur"
+  },
   "clarification": {
     "answerPlaceholder": "Votre réponse",
     "notRelevant": "Non pertinent",
@@ -1883,6 +1888,40 @@
     },
     "accountSkills": {
       "intro": "Reliez les dépôts où votre équipe crée des Claude Skills (un dossier SKILL.md plus des fichiers de ressources). Les compétences synchronisées rejoignent le catalogue de ce compte, partagé par tous les tableaux, et l'étape Skill d'un pipeline en exécute une sur une tâche."
+    },
+    "workspaceMembers": {
+      "you": "{name} (vous)",
+      "roles": {
+        "admin": "Administrateur",
+        "member": "Membre",
+        "viewer": "Observateur"
+      },
+      "accessMode": {
+        "title": "Accès au tableau",
+        "accountHint": "Tous les membres du compte propriétaire peuvent voir ce tableau.",
+        "restrictedHint": "Seuls les membres listés ci-dessous peuvent voir ce tableau.",
+        "restrictToggle": "Limiter aux membres"
+      },
+      "roster": {
+        "title": "Membres",
+        "empty": "Aucun membre pour l'instant.",
+        "remove": "Retirer le membre"
+      },
+      "add": {
+        "title": "Ajouter un membre",
+        "selectMember": "Sélectionner un membre du compte",
+        "submit": "Ajouter",
+        "added": "Membre ajouté",
+        "allAdded": "Tous les membres du compte sont déjà sur ce tableau.",
+        "noAccount": "Ce tableau n'est pas encore lié à un compte."
+      },
+      "errors": {
+        "load": "Impossible de charger les membres",
+        "accessMode": "Impossible de modifier l'accès au tableau",
+        "setRole": "Impossible de mettre à jour le rôle du membre",
+        "add": "Impossible d'ajouter le membre",
+        "remove": "Impossible de retirer le membre"
+      }
     }
   },
   "settings": {
@@ -2473,7 +2512,8 @@
         "budget": "Budget",
         "merge": "Politiques de risque",
         "tracker": "Suivi des tickets",
-        "fragments": "Bonnes pratiques du service"
+        "fragments": "Bonnes pratiques du service",
+        "members": "Membres"
       },
       "waiting": {
         "heading": "En attente d'un humain",

package/i18n/locales/he.json

@@ -74,6 +74,11 @@
       "keep": "להמשיך לערוך"
     }
   },
+  "access": {
+    "noBoardWrite": "גישת קריאה בלבד: אפשר לצפות בלוח הזה אך לא לערוך אותו.",
+    "noRunExecute": "גישת קריאה בלבד: אפשר לצפות בהרצות אך לא להפעיל או לשלוט בהן.",
+    "viewerBadge": "צופה"
+  },
   "clarification": {
     "answerPlaceholder": "התשובה שלך",
     "notRelevant": "לא רלוונטי",
@@ -1883,6 +1888,40 @@
     },
     "accountSkills": {
       "intro": "קישור מאגרים שבהם הצוות שלך יוצרת Claude Skills (תיקיית SKILL.md בתוספת קבצי משאבים). כישורים מסונכרנים מתווספים לקטלוג של חשבון זה, המשותף לכל הלוחות, ושלב ה-Skill של צינור מריץ אחד מהם על משימה."
+    },
+    "workspaceMembers": {
+      "you": "{name} (אתה)",
+      "roles": {
+        "admin": "מנהל",
+        "member": "חבר",
+        "viewer": "צופה"
+      },
+      "accessMode": {
+        "title": "גישה ללוח",
+        "accountHint": "כל מי שבחשבון הבעלים יכול לראות את הלוח הזה.",
+        "restrictedHint": "רק החברים המופיעים למטה יכולים לראות את הלוח הזה.",
+        "restrictToggle": "הגבל לחברים"
+      },
+      "roster": {
+        "title": "חברים",
+        "empty": "אין חברים עדיין.",
+        "remove": "הסר חבר"
+      },
+      "add": {
+        "title": "הוסף חבר",
+        "selectMember": "בחר חבר חשבון",
+        "submit": "הוסף",
+        "added": "החבר נוסף",
+        "allAdded": "כל חברי החשבון כבר נמצאים בלוח הזה.",
+        "noAccount": "הלוח הזה עדיין לא מקושר לחשבון."
+      },
+      "errors": {
+        "load": "לא ניתן לטעון את החברים",
+        "accessMode": "לא ניתן לשנות את הגישה ללוח",
+        "setRole": "לא ניתן לעדכן את תפקיד החבר",
+        "add": "לא ניתן להוסיף את החבר",
+        "remove": "לא ניתן להסיר את החבר"
+      }
     }
   },
   "settings": {
@@ -2594,7 +2633,8 @@
         "budget": "תקציב",
         "merge": "מדיניות סיכון",
         "tracker": "מעקב כרטיסים",
-        "fragments": "שיטות עבודה מומלצות לשירות"
+        "fragments": "שיטות עבודה מומלצות לשירות",
+        "members": "חברים"
       },
       "waiting": {
         "heading": "ממתין לאדם",

package/i18n/locales/it.json

@@ -709,7 +709,8 @@
         "budget": "Budget",
         "merge": "Criteri di rischio",
         "tracker": "Tracker degli issue",
-        "fragments": "Best practice dei servizi"
+        "fragments": "Best practice dei servizi",
+        "members": "Membri"
       },
       "waiting": {
         "heading": "In attesa di un umano",
@@ -1978,6 +1979,40 @@
     },
     "accountSkills": {
       "intro": "Collega i repository dove il tuo team crea le Claude Skills (una cartella SKILL.md più file di risorse). Le competenze sincronizzate entrano nel catalogo di questo account, condiviso da tutte le board, e il passo Skill di una pipeline ne esegue una su un'attività."
+    },
+    "workspaceMembers": {
+      "you": "{name} (tu)",
+      "roles": {
+        "admin": "Amministratore",
+        "member": "Membro",
+        "viewer": "Osservatore"
+      },
+      "accessMode": {
+        "title": "Accesso alla board",
+        "accountHint": "Tutti i membri dell'account proprietario possono vedere questa board.",
+        "restrictedHint": "Solo i membri elencati di seguito possono vedere questa board.",
+        "restrictToggle": "Limita ai membri"
+      },
+      "roster": {
+        "title": "Membri",
+        "empty": "Ancora nessun membro.",
+        "remove": "Rimuovi membro"
+      },
+      "add": {
+        "title": "Aggiungi un membro",
+        "selectMember": "Seleziona un membro dell'account",
+        "submit": "Aggiungi",
+        "added": "Membro aggiunto",
+        "allAdded": "Tutti i membri dell'account sono già su questa board.",
+        "noAccount": "Questa board non è ancora collegata a un account."
+      },
+      "errors": {
+        "load": "Impossibile caricare i membri",
+        "accessMode": "Impossibile modificare l'accesso alla board",
+        "setRole": "Impossibile aggiornare il ruolo del membro",
+        "add": "Impossibile aggiungere il membro",
+        "remove": "Impossibile rimuovere il membro"
+      }
     }
   },
   "board": {
@@ -3899,6 +3934,11 @@
       "keep": "Continua a modificare"
     }
   },
+  "access": {
+    "noBoardWrite": "Accesso in sola lettura: puoi visualizzare questa board ma non modificarla.",
+    "noRunExecute": "Accesso in sola lettura: puoi visualizzare le esecuzioni ma non avviarle né controllarle.",
+    "viewerBadge": "Osservatore"
+  },
   "clarification": {
     "answerPlaceholder": "La tua risposta",
     "notRelevant": "Non pertinente",