@cat-factory/app 0.130.0 → 0.131.0

package/app/components/layout/BoardSwitcher.vue

@@ -96,7 +96,9 @@ const boardItems = computed<DropdownMenuItem[][]>(() => [
     // Badge a board the caller only reaches as a read-only viewer (a restricted board
     // they're not a member/admin of), so the switcher shows why it's read-only.
     label: w.viewerRole === 'viewer' ? `${w.name} · ${t('access.viewerBadge')}` : w.name,
-    icon: 'i-lucide-layout-dashboard',
+    // A restricted board (limited to an explicit roster) gets a lock glyph so an admin who
+    // manages membership can see at a glance which boards are scoped vs open to the account.
+    icon: w.accessMode === 'restricted' ? 'i-lucide-lock' : 'i-lucide-layout-dashboard',
     trailingIcon: w.id === workspace.workspaceId ? 'i-lucide-check' : undefined,
     onSelect: () => void switchBoard(w.id),
   })),

package/app/components/layout/WorkspaceMembersSettings.vue

@@ -0,0 +1,256 @@
+<script setup lang="ts">
+import { computed, onMounted, ref, watch } from 'vue'
+import { apiErrorEnvelope } from '~/composables/api/errors'
+import type { WorkspaceAccessMode, WorkspaceRole } from '~/types/domain'
+
+// Workspace-membership management (workspace-rbac initiative, slice 9). The tier BELOW
+// account tenancy: an account admin restricts a board to an explicit member list (with
+// per-member workspace roles), while an unrestricted (`account`) board keeps the legacy
+// "every account member sees it" behaviour. Every mutation here requires `members.manage`
+// server-side, so the hosting Members tab only renders for a workspace admin.
+//
+// The add picker is sourced from the OWNING account's roster — a contractor joins the
+// account first (the account invitation flow), then gets scoped to a board here.
+const props = defineProps<{ workspaceId: string }>()
+
+const workspace = useWorkspaceStore()
+const members = useWorkspaceMembersStore()
+const accounts = useAccountsStore()
+const auth = useAuthStore()
+const toast = useToast()
+const { t } = useI18n()
+const { confirmAction, toastDone } = useConfirmAction()
+
+const busy = ref(false)
+
+const ROLE_ITEMS = computed<{ label: string; value: WorkspaceRole }[]>(() => [
+  { label: t('layout.workspaceMembers.roles.admin'), value: 'admin' },
+  { label: t('layout.workspaceMembers.roles.member'), value: 'member' },
+  { label: t('layout.workspaceMembers.roles.viewer'), value: 'viewer' },
+])
+
+/** The active board's row (carries `accountId` + `accessMode`). */
+const board = computed(() => workspace.workspaces.find((w) => w.id === props.workspaceId) ?? null)
+/** The owning account id — the source of the add-member picker roster. */
+const accountId = computed(() => board.value?.accountId ?? null)
+/** Whether the board is limited to its explicit roster (vs every account member). */
+const restricted = computed(() => (board.value?.accessMode ?? 'account') === 'restricted')
+/**
+ * True once THIS board's roster is the committed one — the store guards a slow/superseded
+ * load so switching boards never renders the previous board's members. Until then the
+ * roster + picker show a loading state rather than stale rows.
+ */
+const rosterReady = computed(() => members.loadedFor === props.workspaceId)
+
+/**
+ * Account members not already on the board — the add picker's options. The service
+ * rejects a non-account-member, so the picker never offers one; already-scoped members
+ * are filtered out so the list only offers genuine additions.
+ */
+const candidates = computed(() => {
+  const existing = new Set(members.members.map((m) => m.userId))
+  return accounts.members
+    .filter((m) => !existing.has(m.userId))
+    .map((m) => ({ label: m.name || m.email || m.userId, value: m.userId }))
+})
+
+const addUserId = ref<string | undefined>(undefined)
+const addRole = ref<WorkspaceRole>('member')
+
+function notifyError(title: string, e: unknown) {
+  toast.add({
+    title,
+    description: apiErrorEnvelope(e)?.message ?? (e instanceof Error ? e.message : String(e)),
+    icon: 'i-lucide-triangle-alert',
+    color: 'error',
+  })
+}
+
+async function loadAll(workspaceId: string) {
+  try {
+    const jobs: Promise<unknown>[] = [members.load(workspaceId)]
+    // The picker needs the owning account's roster; a legacy board with no account (the
+    // service auto-heals it on the first write) simply shows no picker candidates.
+    if (accountId.value) jobs.push(accounts.loadRoster(accountId.value))
+    await Promise.all(jobs)
+  } catch (e) {
+    notifyError(t('layout.workspaceMembers.errors.load'), e)
+  }
+}
+
+onMounted(() => void loadAll(props.workspaceId))
+watch(
+  () => props.workspaceId,
+  (id) => {
+    if (id) void loadAll(id)
+  },
+)
+
+async function setAccessMode(next: boolean) {
+  const mode: WorkspaceAccessMode = next ? 'restricted' : 'account'
+  busy.value = true
+  try {
+    await members.setAccessMode(props.workspaceId, mode)
+  } catch (e) {
+    notifyError(t('layout.workspaceMembers.errors.accessMode'), e)
+  } finally {
+    busy.value = false
+  }
+}
+
+async function updateRole(userId: string, role: WorkspaceRole) {
+  busy.value = true
+  try {
+    await members.setRole(props.workspaceId, userId, role)
+  } catch (e) {
+    notifyError(t('layout.workspaceMembers.errors.setRole'), e)
+  } finally {
+    busy.value = false
+  }
+}
+
+async function addMember() {
+  const userId = addUserId.value
+  if (!userId) return
+  busy.value = true
+  try {
+    await members.add(props.workspaceId, userId, addRole.value)
+    addUserId.value = undefined
+    addRole.value = 'member'
+    toast.add({ title: t('layout.workspaceMembers.add.added'), icon: 'i-lucide-user-plus' })
+  } catch (e) {
+    notifyError(t('layout.workspaceMembers.errors.add'), e)
+  } finally {
+    busy.value = false
+  }
+}
+
+async function removeMember(userId: string, name: string) {
+  if (!(await confirmAction('remove', name))) return
+  busy.value = true
+  try {
+    await members.remove(props.workspaceId, userId)
+    toastDone('remove', name)
+  } catch (e) {
+    notifyError(t('layout.workspaceMembers.errors.remove'), e)
+  } finally {
+    busy.value = false
+  }
+}
+
+/** Label a member by their display details; badges the signed-in caller as "you". */
+function memberLabel(userId: string, name?: string | null, email?: string | null): string {
+  const base = name || email || userId
+  return userId === auth.user?.id ? t('layout.workspaceMembers.you', { name: base }) : base
+}
+</script>
+
+<template>
+  <div class="space-y-6 text-sm" data-testid="workspace-members-settings">
+    <!-- access mode -->
+    <section class="rounded-md border border-slate-800 bg-slate-800/40 p-4">
+      <div class="flex items-start justify-between gap-4">
+        <div>
+          <h3 class="mb-1 font-semibold text-white">
+            {{ t('layout.workspaceMembers.accessMode.title') }}
+          </h3>
+          <p class="text-slate-400">
+            {{
+              restricted
+                ? t('layout.workspaceMembers.accessMode.restrictedHint')
+                : t('layout.workspaceMembers.accessMode.accountHint')
+            }}
+          </p>
+        </div>
+        <label class="flex shrink-0 items-center gap-2">
+          <USwitch
+            :model-value="restricted"
+            :disabled="busy"
+            size="sm"
+            data-testid="workspace-restrict-toggle"
+            @update:model-value="setAccessMode"
+          />
+          <span class="text-xs text-slate-300">
+            {{ t('layout.workspaceMembers.accessMode.restrictToggle') }}
+          </span>
+        </label>
+      </div>
+    </section>
+
+    <!-- roster -->
+    <section>
+      <h3 class="mb-2 font-semibold text-white">{{ t('layout.workspaceMembers.roster.title') }}</h3>
+      <p v-if="!rosterReady" class="text-slate-500">{{ t('common.loading') }}</p>
+      <ul v-else class="space-y-1" data-testid="workspace-members-roster">
+        <li
+          v-for="m in members.members"
+          :key="m.userId"
+          class="flex items-center justify-between gap-2 rounded-md bg-slate-800/40 px-2 py-1"
+          data-testid="workspace-member-row"
+        >
+          <span class="truncate">{{ memberLabel(m.userId, m.name, m.email) }}</span>
+          <span class="flex shrink-0 items-center gap-2">
+            <USelect
+              :model-value="m.role"
+              :items="ROLE_ITEMS"
+              value-key="value"
+              size="xs"
+              class="w-32"
+              :disabled="busy"
+              data-testid="workspace-member-role"
+              @update:model-value="(r: WorkspaceRole) => updateRole(m.userId, r)"
+            />
+            <UButton
+              size="xs"
+              color="error"
+              variant="ghost"
+              icon="i-lucide-user-minus"
+              :disabled="busy"
+              :aria-label="t('layout.workspaceMembers.roster.remove')"
+              data-testid="workspace-member-remove"
+              @click="removeMember(m.userId, memberLabel(m.userId, m.name, m.email))"
+            />
+          </span>
+        </li>
+        <li v-if="members.members.length === 0" class="text-slate-500">
+          {{ t('layout.workspaceMembers.roster.empty') }}
+        </li>
+      </ul>
+    </section>
+
+    <!-- add member -->
+    <section>
+      <h3 class="mb-2 font-semibold text-white">{{ t('layout.workspaceMembers.add.title') }}</h3>
+      <p v-if="!accountId" class="text-slate-500">
+        {{ t('layout.workspaceMembers.add.noAccount') }}
+      </p>
+      <template v-else>
+        <form class="flex gap-2" @submit.prevent="addMember">
+          <USelect
+            v-model="addUserId"
+            :items="candidates"
+            value-key="value"
+            :placeholder="t('layout.workspaceMembers.add.selectMember')"
+            :disabled="candidates.length === 0"
+            class="flex-1"
+            data-testid="workspace-member-add-select"
+          />
+          <USelect v-model="addRole" :items="ROLE_ITEMS" value-key="value" class="w-32" />
+          <UButton
+            type="submit"
+            color="primary"
+            icon="i-lucide-user-plus"
+            :loading="busy"
+            :disabled="!addUserId"
+            data-testid="workspace-member-add-submit"
+          >
+            {{ t('layout.workspaceMembers.add.submit') }}
+          </UButton>
+        </form>
+        <p v-if="candidates.length === 0" class="mt-2 text-slate-500">
+          {{ t('layout.workspaceMembers.add.allAdded') }}
+        </p>
+      </template>
+    </section>
+  </div>
+</template>

package/app/components/settings/WorkspaceSettingsPanel.vue

@@ -14,11 +14,14 @@ import IssueTrackerPanel from '~/components/settings/IssueTrackerPanel.vue'
 import ServiceFragmentDefaultsPanel from '~/components/settings/ServiceFragmentDefaultsPanel.vue'
 import BudgetSettings from '~/components/settings/BudgetSettings.vue'
 import UsageSettings from '~/components/settings/UsageSettings.vue'
+import WorkspaceMembersSettings from '~/components/layout/WorkspaceMembersSettings.vue'
 import IntegrationBackTitle from '~/components/layout/IntegrationBackTitle.vue'
 
 const { t, te } = useI18n()
 const ui = useUiStore()
 const store = useWorkspaceSettingsStore()
+const workspace = useWorkspaceStore()
+const access = useWorkspaceAccess()
 const toast = useToast()
 
 const open = computed({
@@ -71,6 +74,18 @@ const tabs = computed(() => [
     icon: 'i-lucide-book-open-check',
     slot: 'fragments',
   },
+  // Roster + access-mode management is `members.manage` (workspace admins only). Hidden
+  // for everyone else — the backend 403s the writes and the tab has nothing to read.
+  ...(access.canManageMembers.value
+    ? [
+        {
+          value: 'members',
+          label: t('settings.workspaceSettings.tabs.members'),
+          icon: 'i-lucide-users',
+          slot: 'members',
+        },
+      ]
+    : []),
 ])
 
 // Tab strip styling: the labels must always fit (never truncate) and the strip must never
@@ -359,6 +374,11 @@ async function save() {
         <template #fragments>
           <ServiceFragmentDefaultsPanel />
         </template>
+
+        <!-- Members (workspace RBAC roster + access mode; admins only) -->
+        <template v-if="access.canManageMembers.value && workspace.workspaceId" #members>
+          <WorkspaceMembersSettings :workspace-id="workspace.workspaceId" />
+        </template>
       </UTabs>
     </template>
   </UModal>

package/app/composables/api/workspaces.ts

@@ -1,13 +1,22 @@
 import {
+  addWorkspaceMemberContract,
   createWorkspaceContract,
   deleteWorkspaceContract,
   getWorkspaceContract,
   getWorkspaceSettingsContract,
+  listWorkspaceMembersContract,
   listWorkspacesContract,
+  removeWorkspaceMemberContract,
+  setWorkspaceAccessModeContract,
+  setWorkspaceMemberRoleContract,
   updateWorkspaceContract,
   updateWorkspaceSettingsContract,
 } from '@cat-factory/contracts'
-import type { UpdateWorkspaceSettingsInput } from '~/types/domain'
+import type {
+  UpdateWorkspaceSettingsInput,
+  WorkspaceAccessMode,
+  WorkspaceRole,
+} from '~/types/domain'
 import type { ApiContext } from './context'
 
 /** Workspace CRUD + the full snapshot read. */
@@ -38,5 +47,26 @@ export function workspacesApi({ send, ws }: ApiContext) {
 
     updateWorkspaceSettings: (workspaceId: string, body: UpdateWorkspaceSettingsInput) =>
       send(updateWorkspaceSettingsContract, { pathPrefix: ws(workspaceId), body }),
+
+    // ---- workspace membership (RBAC roster + access-mode) -----------------
+    // The roster read is open to any resolved role; every write requires `members.manage`
+    // (the backend gates it — the SPA only shows this surface to workspace admins).
+    listWorkspaceMembers: (workspaceId: string) =>
+      send(listWorkspaceMembersContract, { pathParams: { workspaceId } }),
+
+    addWorkspaceMember: (workspaceId: string, userId: string, role: WorkspaceRole) =>
+      send(addWorkspaceMemberContract, { pathParams: { workspaceId }, body: { userId, role } }),
+
+    setWorkspaceMemberRole: (workspaceId: string, userId: string, role: WorkspaceRole) =>
+      send(setWorkspaceMemberRoleContract, {
+        pathParams: { workspaceId, userId },
+        body: { role },
+      }),
+
+    removeWorkspaceMember: (workspaceId: string, userId: string) =>
+      send(removeWorkspaceMemberContract, { pathParams: { workspaceId, userId } }),
+
+    setWorkspaceAccessMode: (workspaceId: string, accessMode: WorkspaceAccessMode) =>
+      send(setWorkspaceAccessModeContract, { pathParams: { workspaceId }, body: { accessMode } }),
   }
 }

package/app/stores/workspaceMembers.spec.ts

@@ -0,0 +1,121 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { useWorkspaceMembersStore } from '~/stores/workspaceMembers'
+import { useWorkspaceStore } from '~/stores/workspace'
+import type { WorkspaceMember } from '~/types/domain'
+
+/** Minimal member view — only the fields the store passes through. */
+function member(over: Partial<WorkspaceMember> = {}): WorkspaceMember {
+  return {
+    workspaceId: 'ws1',
+    userId: 'usr_1',
+    role: 'member',
+    createdAt: 1,
+    addedBy: null,
+    ...over,
+  }
+}
+
+describe('workspaceMembers store', () => {
+  beforeEach(() => {
+    // The store patches the board-list row on an access-mode flip; seed one restricted-capable row.
+    const workspace = useWorkspaceStore()
+    workspace.workspaces = [
+      { id: 'ws1', name: 'Board', accountId: 'acc1', accessMode: 'account', viewerRole: 'admin' },
+    ] as never
+  })
+
+  it('load replaces the roster and records which board it belongs to', async () => {
+    vi.stubGlobal('useApi', () => ({
+      listWorkspaceMembers: () =>
+        Promise.resolve([member({ userId: 'a' }), member({ userId: 'b' })]),
+    }))
+
+    const store = useWorkspaceMembersStore()
+    await store.load('ws1')
+
+    expect(store.members.map((m) => m.userId)).toEqual(['a', 'b'])
+    expect(store.loadedFor).toBe('ws1')
+  })
+
+  it('load is monotonic — a superseded slow fetch cannot clobber a newer board', async () => {
+    // Two loads in flight; the OLDER-issued one (wsA) resolves LAST. It must be dropped so
+    // the switcher never renders the previous board's roster over the current one.
+    const resolvers = new Map<string, (v: WorkspaceMember[]) => void>()
+    vi.stubGlobal('useApi', () => ({
+      listWorkspaceMembers: (ws: string) =>
+        new Promise<WorkspaceMember[]>((resolve) => resolvers.set(ws, resolve)),
+    }))
+
+    const store = useWorkspaceMembersStore()
+    const first = store.load('wsA') // slow, issued first
+    const second = store.load('wsB') // newer, issued second
+
+    resolvers.get('wsB')?.([member({ userId: 'b', workspaceId: 'wsB' })])
+    await second
+    resolvers.get('wsA')?.([member({ userId: 'a', workspaceId: 'wsA' })])
+    await first
+
+    expect(store.members.map((m) => m.userId)).toEqual(['b'])
+    expect(store.loadedFor).toBe('wsB')
+  })
+
+  it('add upserts the returned member', async () => {
+    vi.stubGlobal('useApi', () => ({
+      listWorkspaceMembers: () => Promise.resolve([member({ userId: 'a' })]),
+      addWorkspaceMember: (_ws: string, userId: string, role: WorkspaceMember['role']) =>
+        Promise.resolve(member({ userId, role })),
+    }))
+
+    const store = useWorkspaceMembersStore()
+    await store.load('ws1')
+    await store.add('ws1', 'b', 'viewer')
+
+    expect(store.members.map((m) => m.userId)).toEqual(['a', 'b'])
+    expect(store.members.find((m) => m.userId === 'b')?.role).toBe('viewer')
+  })
+
+  it('setRole replaces the member in place', async () => {
+    vi.stubGlobal('useApi', () => ({
+      listWorkspaceMembers: () => Promise.resolve([member({ userId: 'a', role: 'member' })]),
+      setWorkspaceMemberRole: (_ws: string, userId: string, role: WorkspaceMember['role']) =>
+        Promise.resolve(member({ userId, role })),
+    }))
+
+    const store = useWorkspaceMembersStore()
+    await store.load('ws1')
+    await store.setRole('ws1', 'a', 'admin')
+
+    expect(store.members).toHaveLength(1)
+    expect(store.members[0]?.role).toBe('admin')
+  })
+
+  it('remove drops the member from the roster', async () => {
+    vi.stubGlobal('useApi', () => ({
+      listWorkspaceMembers: () =>
+        Promise.resolve([member({ userId: 'a' }), member({ userId: 'b' })]),
+      removeWorkspaceMember: () => Promise.resolve(),
+    }))
+
+    const store = useWorkspaceMembersStore()
+    await store.load('ws1')
+    await store.remove('ws1', 'a')
+
+    expect(store.members.map((m) => m.userId)).toEqual(['b'])
+  })
+
+  it('setAccessMode patches the board-list row in place, preserving the viewerRole annotation', async () => {
+    vi.stubGlobal('useApi', () => ({
+      setWorkspaceAccessMode: (workspaceId: string, accessMode: string) =>
+        // The single-workspace response carries no `viewerRole` (that's a list annotation).
+        Promise.resolve({ id: workspaceId, name: 'Board', accountId: 'acc1', accessMode }),
+    }))
+
+    const store = useWorkspaceMembersStore()
+    await store.setAccessMode('ws1', 'restricted')
+
+    const row = useWorkspaceStore().workspaces.find((w) => w.id === 'ws1')
+    expect(row?.accessMode).toBe('restricted')
+    // The merge must not clobber the list-only badge.
+    expect(row?.viewerRole).toBe('admin')
+  })
+})

package/app/stores/workspaceMembers.ts

@@ -0,0 +1,74 @@
+import { defineStore } from 'pinia'
+import { ref } from 'vue'
+import { useUpsertList } from '~/composables/useUpsertList'
+import type { WorkspaceAccessMode, WorkspaceMember, WorkspaceRole } from '~/types/domain'
+import { useWorkspaceStore } from '~/stores/workspace'
+
+/**
+ * The active board's workspace-RBAC roster (member-management, slice 9). Owns the
+ * `workspace_members` list plus the board's access-mode flip, sitting BELOW the account
+ * tier: an account admin can restrict a board to an explicit member list, while an
+ * unrestricted (`account`) board keeps the legacy "every account member sees it" behaviour.
+ *
+ * Every write requires `members.manage` server-side, so the SPA only mounts this surface
+ * (the Members tab in workspace settings) when `useWorkspaceAccess().canManageMembers`.
+ * The list is loaded lazily when that panel opens — it is not part of the board snapshot.
+ */
+export const useWorkspaceMembersStore = defineStore('workspaceMembers', () => {
+  const api = useApi()
+
+  const { items: members, upsert: upsertMember } = useUpsertList<WorkspaceMember>({
+    key: (m) => m.userId,
+  })
+  /**
+   * The workspace id the currently-committed roster belongs to. The Members panel renders
+   * the roster only while this matches its own `workspaceId`, so switching boards never
+   * briefly shows the previous board's members before the new load resolves.
+   */
+  const loadedFor = ref<string | null>(null)
+  // Monotonic request token: only the latest-issued load() commits, so a slow, superseded
+  // fetch can't clobber a newer board's roster (the ordering hazard the coherence rules warn about).
+  let loadSeq = 0
+
+  /** Load the board's member roster (enriched with display details by the backend). */
+  async function load(workspaceId: string) {
+    const token = ++loadSeq
+    const roster = await api.listWorkspaceMembers(workspaceId)
+    if (token !== loadSeq) return // a newer load() superseded this one; drop the stale result
+    members.value = roster
+    loadedFor.value = workspaceId
+  }
+
+  /** Add an account member to the board at a workspace role (upsert). */
+  async function add(workspaceId: string, userId: string, role: WorkspaceRole) {
+    upsertMember(await api.addWorkspaceMember(workspaceId, userId, role))
+  }
+
+  /** Change an existing member's workspace role. */
+  async function setRole(workspaceId: string, userId: string, role: WorkspaceRole) {
+    upsertMember(await api.setWorkspaceMemberRole(workspaceId, userId, role))
+  }
+
+  /** Remove a member from the board. */
+  async function remove(workspaceId: string, userId: string) {
+    await api.removeWorkspaceMember(workspaceId, userId)
+    members.value = members.value.filter((m) => m.userId !== userId)
+  }
+
+  /**
+   * Flip the board's access mode. `restricted` limits it to the roster; `account` restores
+   * the legacy behaviour. Patches the board's list row in place so the switcher badge and
+   * `activeWorkspace.accessMode` reflect the flip without a re-fetch.
+   */
+  async function setAccessMode(workspaceId: string, accessMode: WorkspaceAccessMode) {
+    const updated = await api.setWorkspaceAccessMode(workspaceId, accessMode)
+    const workspace = useWorkspaceStore()
+    const row = workspace.workspaces.find((w) => w.id === workspaceId)
+    // Merge only the workspace fields (incl. `accessMode`), preserving the row's
+    // `viewerRole` list annotation, which the single-workspace response doesn't carry.
+    if (row) Object.assign(row, updated)
+    return updated
+  }
+
+  return { members, loadedFor, load, add, setRole, remove, setAccessMode }
+})

package/i18n/locales/de.json

@@ -709,7 +709,8 @@
         "budget": "Budget",
         "merge": "Risikorichtlinien",
         "tracker": "Issue-Tracker",
-        "fragments": "Dienst-Best-Practices"
+        "fragments": "Dienst-Best-Practices",
+        "members": "Mitglieder"
       },
       "waiting": {
         "heading": "Warten auf einen Menschen",
@@ -1978,6 +1979,40 @@
     },
     "accountSkills": {
       "intro": "Verknüpfe Repositorys, in denen dein Team Claude Skills erstellt (ein SKILL.md-Ordner plus Ressourcendateien). Synchronisierte Skills landen im Katalog dieses Kontos, der von allen Boards geteilt wird, und der Skill-Schritt einer Pipeline führt einen davon für eine Aufgabe aus."
+    },
+    "workspaceMembers": {
+      "you": "{name} (du)",
+      "roles": {
+        "admin": "Admin",
+        "member": "Mitglied",
+        "viewer": "Betrachter"
+      },
+      "accessMode": {
+        "title": "Board-Zugriff",
+        "accountHint": "Alle im zugehörigen Konto können dieses Board sehen.",
+        "restrictedHint": "Nur die unten aufgeführten Mitglieder können dieses Board sehen.",
+        "restrictToggle": "Auf Mitglieder beschränken"
+      },
+      "roster": {
+        "title": "Mitglieder",
+        "empty": "Noch keine Mitglieder.",
+        "remove": "Mitglied entfernen"
+      },
+      "add": {
+        "title": "Mitglied hinzufügen",
+        "selectMember": "Kontomitglied auswählen",
+        "submit": "Hinzufügen",
+        "added": "Mitglied hinzugefügt",
+        "allAdded": "Alle Kontomitglieder sind bereits auf diesem Board.",
+        "noAccount": "Dieses Board ist noch mit keinem Konto verknüpft."
+      },
+      "errors": {
+        "load": "Mitglieder konnten nicht geladen werden",
+        "accessMode": "Board-Zugriff konnte nicht geändert werden",
+        "setRole": "Mitgliedsrolle konnte nicht aktualisiert werden",
+        "add": "Mitglied konnte nicht hinzugefügt werden",
+        "remove": "Mitglied konnte nicht entfernt werden"
+      }
     }
   },
   "board": {

package/i18n/locales/en.json

@@ -1951,6 +1951,40 @@
     },
     "accountSkills": {
       "intro": "Link repos where your team authors Claude Skills (a SKILL.md folder plus resource files). Synced skills join this account's catalog, shared by every board, and a pipeline's Skill step runs one against a task."
+    },
+    "workspaceMembers": {
+      "you": "{name} (you)",
+      "roles": {
+        "admin": "Admin",
+        "member": "Member",
+        "viewer": "Viewer"
+      },
+      "accessMode": {
+        "title": "Board access",
+        "accountHint": "Everyone in the owning account can see this board.",
+        "restrictedHint": "Only the members listed below can see this board.",
+        "restrictToggle": "Restrict to members"
+      },
+      "roster": {
+        "title": "Members",
+        "empty": "No members yet.",
+        "remove": "Remove member"
+      },
+      "add": {
+        "title": "Add a member",
+        "selectMember": "Select an account member",
+        "submit": "Add",
+        "added": "Member added",
+        "allAdded": "Every account member is already on this board.",
+        "noAccount": "This board isn't linked to an account yet."
+      },
+      "errors": {
+        "load": "Could not load members",
+        "accessMode": "Could not change board access",
+        "setRole": "Could not update member role",
+        "add": "Could not add member",
+        "remove": "Could not remove member"
+      }
     }
   },
   "settings": {
@@ -2666,7 +2700,8 @@
         "budget": "Budget",
         "merge": "Risk policies",
         "tracker": "Issue tracker",
-        "fragments": "Service best practices"
+        "fragments": "Service best practices",
+        "members": "Members"
       },
       "waiting": {
         "heading": "Waiting for a human",

package/i18n/locales/es.json

@@ -1888,6 +1888,40 @@
     },
     "accountSkills": {
       "intro": "Vincula repositorios donde tu equipo crea Claude Skills (una carpeta SKILL.md más archivos de recursos). Las habilidades sincronizadas se añaden al catálogo de esta cuenta, compartido por todos los tableros, y el paso Skill de una tubería ejecuta una sobre una tarea."
+    },
+    "workspaceMembers": {
+      "you": "{name} (tú)",
+      "roles": {
+        "admin": "Administrador",
+        "member": "Miembro",
+        "viewer": "Observador"
+      },
+      "accessMode": {
+        "title": "Acceso al tablero",
+        "accountHint": "Todos los miembros de la cuenta propietaria pueden ver este tablero.",
+        "restrictedHint": "Solo los miembros que aparecen abajo pueden ver este tablero.",
+        "restrictToggle": "Restringir a miembros"
+      },
+      "roster": {
+        "title": "Miembros",
+        "empty": "Aún no hay miembros.",
+        "remove": "Quitar miembro"
+      },
+      "add": {
+        "title": "Añadir un miembro",
+        "selectMember": "Selecciona un miembro de la cuenta",
+        "submit": "Añadir",
+        "added": "Miembro añadido",
+        "allAdded": "Todos los miembros de la cuenta ya están en este tablero.",
+        "noAccount": "Este tablero aún no está vinculado a una cuenta."
+      },
+      "errors": {
+        "load": "No se pudieron cargar los miembros",
+        "accessMode": "No se pudo cambiar el acceso al tablero",
+        "setRole": "No se pudo actualizar el rol del miembro",
+        "add": "No se pudo añadir el miembro",
+        "remove": "No se pudo quitar el miembro"
+      }
     }
   },
   "settings": {
@@ -2478,7 +2512,8 @@
         "budget": "Presupuesto",
         "merge": "Políticas de riesgo",
         "tracker": "Gestor de incidencias",
-        "fragments": "Buenas prácticas del servicio"
+        "fragments": "Buenas prácticas del servicio",
+        "members": "Miembros"
       },
       "waiting": {
         "heading": "Esperando a una persona",

package/i18n/locales/fr.json

@@ -1888,6 +1888,40 @@
     },
     "accountSkills": {
       "intro": "Reliez les dépôts où votre équipe crée des Claude Skills (un dossier SKILL.md plus des fichiers de ressources). Les compétences synchronisées rejoignent le catalogue de ce compte, partagé par tous les tableaux, et l'étape Skill d'un pipeline en exécute une sur une tâche."
+    },
+    "workspaceMembers": {
+      "you": "{name} (vous)",
+      "roles": {
+        "admin": "Administrateur",
+        "member": "Membre",
+        "viewer": "Observateur"
+      },
+      "accessMode": {
+        "title": "Accès au tableau",
+        "accountHint": "Tous les membres du compte propriétaire peuvent voir ce tableau.",
+        "restrictedHint": "Seuls les membres listés ci-dessous peuvent voir ce tableau.",
+        "restrictToggle": "Limiter aux membres"
+      },
+      "roster": {
+        "title": "Membres",
+        "empty": "Aucun membre pour l'instant.",
+        "remove": "Retirer le membre"
+      },
+      "add": {
+        "title": "Ajouter un membre",
+        "selectMember": "Sélectionner un membre du compte",
+        "submit": "Ajouter",
+        "added": "Membre ajouté",
+        "allAdded": "Tous les membres du compte sont déjà sur ce tableau.",
+        "noAccount": "Ce tableau n'est pas encore lié à un compte."
+      },
+      "errors": {
+        "load": "Impossible de charger les membres",
+        "accessMode": "Impossible de modifier l'accès au tableau",
+        "setRole": "Impossible de mettre à jour le rôle du membre",
+        "add": "Impossible d'ajouter le membre",
+        "remove": "Impossible de retirer le membre"
+      }
     }
   },
   "settings": {
@@ -2478,7 +2512,8 @@
         "budget": "Budget",
         "merge": "Politiques de risque",
         "tracker": "Suivi des tickets",
-        "fragments": "Bonnes pratiques du service"
+        "fragments": "Bonnes pratiques du service",
+        "members": "Membres"
       },
       "waiting": {
         "heading": "En attente d'un humain",

package/i18n/locales/he.json

@@ -1888,6 +1888,40 @@
     },
     "accountSkills": {
       "intro": "קישור מאגרים שבהם הצוות שלך יוצרת Claude Skills (תיקיית SKILL.md בתוספת קבצי משאבים). כישורים מסונכרנים מתווספים לקטלוג של חשבון זה, המשותף לכל הלוחות, ושלב ה-Skill של צינור מריץ אחד מהם על משימה."
+    },
+    "workspaceMembers": {
+      "you": "{name} (אתה)",
+      "roles": {
+        "admin": "מנהל",
+        "member": "חבר",
+        "viewer": "צופה"
+      },
+      "accessMode": {
+        "title": "גישה ללוח",
+        "accountHint": "כל מי שבחשבון הבעלים יכול לראות את הלוח הזה.",
+        "restrictedHint": "רק החברים המופיעים למטה יכולים לראות את הלוח הזה.",
+        "restrictToggle": "הגבל לחברים"
+      },
+      "roster": {
+        "title": "חברים",
+        "empty": "אין חברים עדיין.",
+        "remove": "הסר חבר"
+      },
+      "add": {
+        "title": "הוסף חבר",
+        "selectMember": "בחר חבר חשבון",
+        "submit": "הוסף",
+        "added": "החבר נוסף",
+        "allAdded": "כל חברי החשבון כבר נמצאים בלוח הזה.",
+        "noAccount": "הלוח הזה עדיין לא מקושר לחשבון."
+      },
+      "errors": {
+        "load": "לא ניתן לטעון את החברים",
+        "accessMode": "לא ניתן לשנות את הגישה ללוח",
+        "setRole": "לא ניתן לעדכן את תפקיד החבר",
+        "add": "לא ניתן להוסיף את החבר",
+        "remove": "לא ניתן להסיר את החבר"
+      }
     }
   },
   "settings": {
@@ -2599,7 +2633,8 @@
         "budget": "תקציב",
         "merge": "מדיניות סיכון",
         "tracker": "מעקב כרטיסים",
-        "fragments": "שיטות עבודה מומלצות לשירות"
+        "fragments": "שיטות עבודה מומלצות לשירות",
+        "members": "חברים"
       },
       "waiting": {
         "heading": "ממתין לאדם",

package/i18n/locales/it.json

@@ -709,7 +709,8 @@
         "budget": "Budget",
         "merge": "Criteri di rischio",
         "tracker": "Tracker degli issue",
-        "fragments": "Best practice dei servizi"
+        "fragments": "Best practice dei servizi",
+        "members": "Membri"
       },
       "waiting": {
         "heading": "In attesa di un umano",
@@ -1978,6 +1979,40 @@
     },
     "accountSkills": {
       "intro": "Collega i repository dove il tuo team crea le Claude Skills (una cartella SKILL.md più file di risorse). Le competenze sincronizzate entrano nel catalogo di questo account, condiviso da tutte le board, e il passo Skill di una pipeline ne esegue una su un'attività."
+    },
+    "workspaceMembers": {
+      "you": "{name} (tu)",
+      "roles": {
+        "admin": "Amministratore",
+        "member": "Membro",
+        "viewer": "Osservatore"
+      },
+      "accessMode": {
+        "title": "Accesso alla board",
+        "accountHint": "Tutti i membri dell'account proprietario possono vedere questa board.",
+        "restrictedHint": "Solo i membri elencati di seguito possono vedere questa board.",
+        "restrictToggle": "Limita ai membri"
+      },
+      "roster": {
+        "title": "Membri",
+        "empty": "Ancora nessun membro.",
+        "remove": "Rimuovi membro"
+      },
+      "add": {
+        "title": "Aggiungi un membro",
+        "selectMember": "Seleziona un membro dell'account",
+        "submit": "Aggiungi",
+        "added": "Membro aggiunto",
+        "allAdded": "Tutti i membri dell'account sono già su questa board.",
+        "noAccount": "Questa board non è ancora collegata a un account."
+      },
+      "errors": {
+        "load": "Impossibile caricare i membri",
+        "accessMode": "Impossibile modificare l'accesso alla board",
+        "setRole": "Impossibile aggiornare il ruolo del membro",
+        "add": "Impossibile aggiungere il membro",
+        "remove": "Impossibile rimuovere il membro"
+      }
     }
   },
   "board": {

package/i18n/locales/ja.json

@@ -1888,6 +1888,40 @@
     },
     "accountSkills": {
       "intro": "チームが Claude Skills（SKILL.md フォルダーとリソースファイル）を作成しているリポジトリをリンクします。同期されたスキルはこのアカウントのカタログに追加され、すべてのボードで共有されます。パイプラインの Skill ステップがタスクに対してその 1 つを実行します。"
+    },
+    "workspaceMembers": {
+      "you": "{name}（あなた）",
+      "roles": {
+        "admin": "管理者",
+        "member": "メンバー",
+        "viewer": "閲覧者"
+      },
+      "accessMode": {
+        "title": "ボードのアクセス",
+        "accountHint": "所有アカウントの全員がこのボードを閲覧できます。",
+        "restrictedHint": "以下に表示されているメンバーのみがこのボードを閲覧できます。",
+        "restrictToggle": "メンバーに限定する"
+      },
+      "roster": {
+        "title": "メンバー",
+        "empty": "まだメンバーがいません。",
+        "remove": "メンバーを削除"
+      },
+      "add": {
+        "title": "メンバーを追加",
+        "selectMember": "アカウントメンバーを選択",
+        "submit": "追加",
+        "added": "メンバーを追加しました",
+        "allAdded": "アカウントの全メンバーがすでにこのボードにいます。",
+        "noAccount": "このボードはまだアカウントに紐づいていません。"
+      },
+      "errors": {
+        "load": "メンバーを読み込めませんでした",
+        "accessMode": "ボードのアクセスを変更できませんでした",
+        "setRole": "メンバーのロールを更新できませんでした",
+        "add": "メンバーを追加できませんでした",
+        "remove": "メンバーを削除できませんでした"
+      }
     }
   },
   "settings": {
@@ -2600,7 +2634,8 @@
         "budget": "予算",
         "merge": "リスクポリシー",
         "tracker": "課題トラッカー",
-        "fragments": "サービスのベストプラクティス"
+        "fragments": "サービスのベストプラクティス",
+        "members": "メンバー"
       },
       "waiting": {
         "heading": "人による対応待ち",

package/i18n/locales/pl.json

@@ -1888,6 +1888,40 @@
     },
     "accountSkills": {
       "intro": "Połącz repozytoria, w których Twój zespół tworzy Claude Skills (folder SKILL.md wraz z plikami zasobów). Zsynchronizowane umiejętności trafiają do katalogu tego konta, współdzielonego przez wszystkie tablice, a krok Skill w potoku uruchamia jedną z nich dla zadania."
+    },
+    "workspaceMembers": {
+      "you": "{name} (Ty)",
+      "roles": {
+        "admin": "Administrator",
+        "member": "Członek",
+        "viewer": "Obserwator"
+      },
+      "accessMode": {
+        "title": "Dostęp do tablicy",
+        "accountHint": "Każdy w koncie właściciela może zobaczyć tę tablicę.",
+        "restrictedHint": "Tylko członkowie wymienieni poniżej mogą zobaczyć tę tablicę.",
+        "restrictToggle": "Ogranicz do członków"
+      },
+      "roster": {
+        "title": "Członkowie",
+        "empty": "Brak członków.",
+        "remove": "Usuń członka"
+      },
+      "add": {
+        "title": "Dodaj członka",
+        "selectMember": "Wybierz członka konta",
+        "submit": "Dodaj",
+        "added": "Dodano członka",
+        "allAdded": "Wszyscy członkowie konta są już na tej tablicy.",
+        "noAccount": "Ta tablica nie jest jeszcze powiązana z kontem."
+      },
+      "errors": {
+        "load": "Nie udało się wczytać członków",
+        "accessMode": "Nie udało się zmienić dostępu do tablicy",
+        "setRole": "Nie udało się zaktualizować roli członka",
+        "add": "Nie udało się dodać członka",
+        "remove": "Nie udało się usunąć członka"
+      }
     }
   },
   "settings": {
@@ -2478,7 +2512,8 @@
         "budget": "Budżet",
         "merge": "Zasady ryzyka",
         "tracker": "System zgłoszeń",
-        "fragments": "Dobre praktyki usługi"
+        "fragments": "Dobre praktyki usługi",
+        "members": "Członkowie"
       },
       "waiting": {
         "heading": "Oczekiwanie na człowieka",

package/i18n/locales/tr.json

@@ -1888,6 +1888,40 @@
     },
     "accountSkills": {
       "intro": "Ekibinizin Claude Skills oluşturduğu depoları bağlayın (bir SKILL.md klasörü artı kaynak dosyaları). Senkronize edilen beceriler bu hesabın kataloguna eklenir, tüm panolarca paylaşılır ve bir hattın Skill adımı bir görev için bunlardan birini çalıştırır."
+    },
+    "workspaceMembers": {
+      "you": "{name} (sen)",
+      "roles": {
+        "admin": "Yönetici",
+        "member": "Üye",
+        "viewer": "İzleyici"
+      },
+      "accessMode": {
+        "title": "Pano erişimi",
+        "accountHint": "Sahip hesaptaki herkes bu panoyu görebilir.",
+        "restrictedHint": "Bu panoyu yalnızca aşağıda listelenen üyeler görebilir.",
+        "restrictToggle": "Üyelerle sınırla"
+      },
+      "roster": {
+        "title": "Üyeler",
+        "empty": "Henüz üye yok.",
+        "remove": "Üyeyi kaldır"
+      },
+      "add": {
+        "title": "Üye ekle",
+        "selectMember": "Bir hesap üyesi seç",
+        "submit": "Ekle",
+        "added": "Üye eklendi",
+        "allAdded": "Hesabın tüm üyeleri zaten bu panoda.",
+        "noAccount": "Bu pano henüz bir hesaba bağlı değil."
+      },
+      "errors": {
+        "load": "Üyeler yüklenemedi",
+        "accessMode": "Pano erişimi değiştirilemedi",
+        "setRole": "Üye rolü güncellenemedi",
+        "add": "Üye eklenemedi",
+        "remove": "Üye kaldırılamadı"
+      }
     }
   },
   "settings": {
@@ -2600,7 +2634,8 @@
         "budget": "Bütçe",
         "merge": "Risk ilkeleri",
         "tracker": "Sorun takipçisi",
-        "fragments": "Servis en iyi uygulamaları"
+        "fragments": "Servis en iyi uygulamaları",
+        "members": "Üyeler"
       },
       "waiting": {
         "heading": "Bir kişi bekleniyor",

package/i18n/locales/uk.json

@@ -1888,6 +1888,40 @@
     },
     "accountSkills": {
       "intro": "Пов'яжіть репозиторії, де ваша команда створює Claude Skills (папка SKILL.md разом із файлами ресурсів). Синхронізовані навички потрапляють до каталогу цього облікового запису, спільного для всіх дошок, а крок Skill конвеєра виконує одну з них для завдання."
+    },
+    "workspaceMembers": {
+      "you": "{name} (ви)",
+      "roles": {
+        "admin": "Адміністратор",
+        "member": "Учасник",
+        "viewer": "Глядач"
+      },
+      "accessMode": {
+        "title": "Доступ до дошки",
+        "accountHint": "Усі в обліковому записі-власнику можуть бачити цю дошку.",
+        "restrictedHint": "Цю дошку можуть бачити лише перелічені нижче учасники.",
+        "restrictToggle": "Обмежити учасниками"
+      },
+      "roster": {
+        "title": "Учасники",
+        "empty": "Ще немає учасників.",
+        "remove": "Вилучити учасника"
+      },
+      "add": {
+        "title": "Додати учасника",
+        "selectMember": "Виберіть учасника облікового запису",
+        "submit": "Додати",
+        "added": "Учасника додано",
+        "allAdded": "Усі учасники облікового запису вже на цій дошці.",
+        "noAccount": "Ця дошка ще не пов'язана з обліковим записом."
+      },
+      "errors": {
+        "load": "Не вдалося завантажити учасників",
+        "accessMode": "Не вдалося змінити доступ до дошки",
+        "setRole": "Не вдалося оновити роль учасника",
+        "add": "Не вдалося додати учасника",
+        "remove": "Не вдалося вилучити учасника"
+      }
     }
   },
   "settings": {
@@ -2478,7 +2512,8 @@
         "budget": "Бюджет",
         "merge": "Політики ризику",
         "tracker": "Трекер задач",
-        "fragments": "Найкращі практики сервісу"
+        "fragments": "Найкращі практики сервісу",
+        "members": "Учасники"
       },
       "waiting": {
         "heading": "Очікування на людину",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cat-factory/app",
-  "version": "0.130.0",
+  "version": "0.131.0",
   "description": "Reusable Nuxt layer for the Agent Architecture Board SPA (components, stores, composables, pages). Consume it from a thin deployment app via `extends: ['@cat-factory/app']` and point it at your backend with NUXT_PUBLIC_API_BASE. See deploy/frontend for an example.",
   "repository": {
     "type": "git",