@cat-factory/app 0.171.0 → 0.172.0

package/app/components/layout/DefaultTestEnvBanner.vue

@@ -0,0 +1,117 @@
+<script setup lang="ts">
+// Convenience prompt to pick the board's DEFAULT test-environment provisioning mechanism — the
+// provision type suggested for every newly added service. Fires on a workspace that has recorded
+// no choice, which covers all three cases the product asked for with ONE condition rather than
+// three: a board created by hand, the board the SPA creates implicitly on first launch, and an
+// older board that predates the setting. All of them simply have `defaultProvisionType == null`.
+//
+// The nag ends the moment a decision is RECORDED, including `infraless` ("services stand up no
+// environment") — that is a real answer, not an absence. See the contracts block comment on
+// `defaultProvisionType` for why the field is nullable rather than defaulted.
+//
+// Positioning/stacking against the sibling advisory banners is owned by the shared click-through
+// column in `pages/index.vue`; this renders only its card and re-enables pointer events on it.
+import { computed } from 'vue'
+import {
+  defaultProvisioningConfigUrl,
+  needsDefaultProvisioningChoice,
+} from '~/utils/defaultProvisioning'
+
+const { t } = useI18n()
+const ui = useUiStore()
+const workspace = useWorkspaceStore()
+const settingsStore = useWorkspaceSettingsStore()
+const { canManageSettings } = useWorkspaceAccess()
+
+// Only prompt someone who can actually answer. A member/viewer cannot write workspace settings
+// (the endpoint is `settings.manage`-gated), so for them this would be an un-actionable nag
+// pointing at a screen that would refuse their save.
+const show = computed(
+  () =>
+    workspace.ready &&
+    canManageSettings.value &&
+    needsDefaultProvisioningChoice(settingsStore.settings) &&
+    !ui.defaultProvisionDismissed,
+)
+
+// A real, copyable link to the configuration screen — so this can be handed to whoever owns the
+// board's infrastructure instead of being described. Clicking it opens the screen in place
+// (no reload); the `href` is what makes middle-click, "copy link address" and open-in-new-tab
+// work, and the ui store consumes the same param on load so a pasted link lands on the section.
+const configUrl = computed(() => defaultProvisioningConfigUrl())
+
+function openConfig(event: MouseEvent) {
+  // Leave the modified clicks (new tab / new window / download) to the browser.
+  if (event.metaKey || event.ctrlKey || event.shiftKey || event.altKey || event.button !== 0) return
+  event.preventDefault()
+  ui.openDefaultProvisionSettings()
+}
+</script>
+
+<template>
+  <Transition name="fade">
+    <div
+      v-if="show"
+      class="pointer-events-auto w-full max-w-3xl rounded-2xl border border-sky-500/50 bg-sky-950/90 p-4 shadow-xl backdrop-blur"
+      role="status"
+      aria-live="polite"
+      data-testid="default-test-env-banner"
+    >
+      <div class="flex items-start gap-3">
+        <UIcon name="i-lucide-flask-conical" class="mt-0.5 h-7 w-7 shrink-0 text-sky-400" />
+        <div class="min-w-0 flex-1">
+          <div class="flex items-start justify-between gap-3">
+            <h2 class="text-sm font-semibold text-sky-100">
+              {{ t('layout.defaultTestEnvBanner.title') }}
+            </h2>
+            <UButton
+              color="neutral"
+              variant="ghost"
+              size="xs"
+              icon="i-lucide-x"
+              :aria-label="t('common.close')"
+              data-testid="default-test-env-dismiss"
+              @click="ui.dismissDefaultProvision()"
+            />
+          </div>
+          <p class="mt-1 text-[13px] text-sky-200/90">
+            {{ t('layout.defaultTestEnvBanner.body') }}
+          </p>
+          <div class="mt-3 flex flex-wrap items-center gap-x-3 gap-y-2">
+            <UButton
+              :to="configUrl"
+              size="sm"
+              color="info"
+              variant="solid"
+              icon="i-lucide-settings"
+              data-testid="default-test-env-configure"
+              @click="openConfig"
+            >
+              {{ t('layout.defaultTestEnvBanner.action') }}
+            </UButton>
+            <!-- The URL itself, shown so it can be read and copied, not just clicked. -->
+            <a
+              :href="configUrl"
+              class="min-w-0 truncate font-mono text-[11px] text-sky-300/80 underline decoration-dotted underline-offset-2 hover:text-sky-200"
+              data-testid="default-test-env-url"
+              @click="openConfig"
+            >
+              {{ configUrl }}
+            </a>
+          </div>
+        </div>
+      </div>
+    </div>
+  </Transition>
+</template>
+
+<style scoped>
+.fade-enter-active,
+.fade-leave-active {
+  transition: opacity 0.2s ease;
+}
+.fade-enter-from,
+.fade-leave-to {
+  opacity: 0;
+}
+</style>

package/app/components/settings/DefaultProvisionTypeSection.vue

@@ -0,0 +1,176 @@
+<script setup lang="ts">
+// The workspace's DEFAULT test-environment provisioning mechanism — the provision type stamped
+// onto every newly added service frame so the operator declares it once per board instead of
+// once per service. Lives at the top of the Infrastructure window's "Test environments" tab,
+// above the per-type handler configurator, because it answers the question that comes FIRST:
+// what do this board's services produce, before you configure how each type is handled.
+//
+// This is a SUGGESTION for new services, never a run-time override: the engine still reads only
+// a service's own `provisioning`, so saving a different default here never changes what an
+// existing service provisions (each stays editable in its inspector).
+//
+// The section opens on the workspace's recorded choice, or — with nothing recorded — on the first
+// REGISTERED custom provider when the deployment brought one. All of that precedence lives in
+// `utils/defaultProvisioning.ts` so it is unit-tested and shared with the banner that nags about
+// the unset state. Nothing is persisted until the operator saves.
+import { computed, ref, watch } from 'vue'
+import type { ProvisionType } from '@cat-factory/contracts'
+import {
+  canSaveDefaultProvisioning,
+  suggestDefaultProvisioning,
+  type DefaultProvisioningSelection,
+} from '~/utils/defaultProvisioning'
+
+const { t } = useI18n()
+const infra = useInfraConfigStore()
+const settingsStore = useWorkspaceSettingsStore()
+const toast = useToast()
+
+onMounted(() => {
+  void infra.ensureLoaded()
+})
+
+// The saved state, and the (unsaved) edit state seeded from it. Re-seeded whenever the saved
+// choice or the custom-type catalog changes — the catalog arrives asynchronously, so without the
+// second dependency a board whose only sensible answer is a registered provider would open unset
+// and never pick it up.
+const selection = ref<DefaultProvisioningSelection>({ type: null, manifestId: null })
+watch(
+  [() => settingsStore.settings, () => infra.customTypes],
+  ([settings, customTypes]) => {
+    selection.value = suggestDefaultProvisioning(settings, customTypes)
+  },
+  { immediate: true, deep: true },
+)
+
+// Whether what's on screen differs from what's stored — drives both the Save button and the
+// "this is only a suggestion so far" hint, so a preselected-but-unsaved custom provider can
+// never read as already configured.
+const dirty = computed(
+  () =>
+    selection.value.type !== settingsStore.settings.defaultProvisionType ||
+    (selection.value.manifestId ?? null) !==
+      (settingsStore.settings.defaultProvisionManifestId ?? null),
+)
+const unset = computed(() => settingsStore.settings.defaultProvisionType == null)
+const canSave = computed(() => canSaveDefaultProvisioning(selection.value) && dirty.value)
+
+const PROVISION_TYPES = computed<{ value: ProvisionType; label: string }[]>(() => [
+  { value: 'infraless', label: t('inspector.testConfig.provisionTypes.infraless') },
+  { value: 'docker-compose', label: t('inspector.testConfig.provisionTypes.docker-compose') },
+  { value: 'kubernetes', label: t('inspector.testConfig.provisionTypes.kubernetes') },
+  { value: 'cloudflare', label: t('inspector.testConfig.provisionTypes.cloudflare') },
+  { value: 'custom', label: t('inspector.testConfig.provisionTypes.custom') },
+])
+
+const customTypeItems = computed(() =>
+  infra.customTypes.map((c) => ({ label: `${c.label} (${c.manifestId})`, value: c.manifestId })),
+)
+
+function setType(type: ProvisionType) {
+  // Switching away from `custom` drops the pinned id, matching the server's normalisation — a
+  // retained id would silently reappear on switching back.
+  selection.value =
+    type === 'custom'
+      ? { type, manifestId: selection.value.manifestId ?? infra.customTypes[0]?.manifestId ?? null }
+      : { type, manifestId: null }
+}
+
+function setManifestId(manifestId: string) {
+  selection.value = { type: 'custom', manifestId: manifestId || null }
+}
+
+const saving = ref(false)
+async function save() {
+  if (!canSave.value || saving.value) return
+  saving.value = true
+  try {
+    await settingsStore.update({
+      defaultProvisionType: selection.value.type,
+      defaultProvisionManifestId: selection.value.manifestId,
+    })
+    toast.add({ title: t('settings.defaultProvision.saved'), color: 'success' })
+  } catch (e) {
+    toast.add({
+      title: t('settings.defaultProvision.saveFailed'),
+      description: e instanceof Error ? e.message : undefined,
+      color: 'error',
+    })
+  } finally {
+    saving.value = false
+  }
+}
+</script>
+
+<template>
+  <section class="space-y-3" data-testid="default-provision-section">
+    <div>
+      <h3 class="text-sm font-semibold text-slate-200">
+        {{ t('settings.defaultProvision.title') }}
+      </h3>
+      <p class="mt-1 text-[11px] leading-snug text-slate-500">
+        {{ t('settings.defaultProvision.hint') }}
+      </p>
+    </div>
+
+    <div class="flex flex-wrap gap-1">
+      <UButton
+        v-for="p in PROVISION_TYPES"
+        :key="p.value"
+        :color="selection.type === p.value ? 'primary' : 'neutral'"
+        :variant="selection.type === p.value ? 'soft' : 'ghost'"
+        size="xs"
+        :data-testid="`default-provision-type-${p.value}`"
+        @click="setType(p.value)"
+      >
+        {{ p.label }}
+      </UButton>
+    </div>
+
+    <div v-if="selection.type === 'custom'" class="space-y-1">
+      <label class="text-[11px] text-slate-400">
+        {{ t('inspector.testConfig.customManifestId') }}
+      </label>
+      <USelect
+        v-if="customTypeItems.length"
+        :model-value="selection.manifestId ?? ''"
+        :items="customTypeItems"
+        size="xs"
+        class="w-full"
+        data-testid="default-provision-manifest-id"
+        :placeholder="t('inspector.testConfig.customManifestIdPlaceholder')"
+        @update:model-value="(v: string) => setManifestId(v)"
+      />
+      <p v-else class="text-[11px] leading-snug text-amber-300/80">
+        {{ t('inspector.testConfig.customNoTypes') }}
+      </p>
+    </div>
+
+    <!-- A preselected suggestion must never read as already configured: say so explicitly while
+         the workspace still has nothing stored. -->
+    <p
+      v-if="unset && selection.type"
+      class="text-[11px] leading-snug text-amber-300/80"
+      data-testid="default-provision-suggestion-hint"
+    >
+      {{ t('settings.defaultProvision.suggestionHint') }}
+    </p>
+
+    <div class="flex items-center gap-2">
+      <UButton
+        size="xs"
+        color="primary"
+        icon="i-lucide-check"
+        :loading="saving"
+        :disabled="!canSave"
+        data-testid="default-provision-save"
+        @click="save"
+      >
+        {{ t('settings.defaultProvision.save') }}
+      </UButton>
+      <span v-if="!unset && !dirty" class="text-[11px] text-slate-500">
+        {{ t('settings.defaultProvision.savedState') }}
+      </span>
+    </div>
+  </section>
+</template>

package/app/components/settings/InfrastructureWindow.vue

@@ -13,6 +13,7 @@ import { computed, ref, watch } from 'vue'
 import type { ProviderConnectionKind } from '~/types/providerConnections'
 import InfrastructureBackendPicker from '~/components/settings/InfrastructureBackendPicker.vue'
 import InfraHandlersConfigurator from '~/components/settings/InfraHandlersConfigurator.vue'
+import DefaultProvisionTypeSection from '~/components/settings/DefaultProvisionTypeSection.vue'
 import LocalContainerPoolSettings from '~/components/settings/LocalContainerPoolSettings.vue'
 import SharedStacksPanel from '~/components/settings/SharedStacksPanel.vue'
 
@@ -131,10 +132,16 @@ watch([tabs, () => store.loaded], () => {
           </template>
           <template #environment>
             <div class="space-y-4">
+              <!-- What this board's services PRODUCE by default. Comes first because it is the
+                   question the per-type handlers below answer "how" for, and because a board that
+                   has never chosen is the one the setup banner deep-links straight to here. -->
+              <DefaultProvisionTypeSection />
               <!-- The Tester's environment is driven by each SERVICE's declared provision type
                    (the "what/where"); the workspace configures HOW each type is handled here —
                    the engine + connection per provision type, plus the custom-type catalog. -->
-              <InfraHandlersConfigurator />
+              <div class="border-t border-slate-800 pt-4">
+                <InfraHandlersConfigurator />
+              </div>
             </div>
           </template>
           <template #shared-stacks>

package/app/pages/index.vue

@@ -9,6 +9,7 @@ import GitHubPatBanner from '~/components/layout/GitHubPatBanner.vue'
 import AiProvidersBanner from '~/components/layout/AiProvidersBanner.vue'
 import ProviderConfigBanner from '~/components/layout/ProviderConfigBanner.vue'
 import InfraSetupBanner from '~/components/layout/InfraSetupBanner.vue'
+import DefaultTestEnvBanner from '~/components/layout/DefaultTestEnvBanner.vue'
 // Always-mounted, fast-path surfaces (opened frequently during a run / board edits, or
 // store-driven so they must react from anywhere — kept eager for snappy open/close).
 import PipelineBuilder from '~/components/pipeline/PipelineBuilder.vue'
@@ -155,6 +156,9 @@ onMounted(() => {
   // Honour a `cat-factory k3s` CLI hand-off (`?infraSetup=local-k3s&…`): open the Infrastructure
   // window pre-seeded with the provisioned connection so the user only pastes the token + saves.
   ui.consumeK3sSetupDeepLink()
+  // Honour the setup banner's shareable link (`?settings=default-test-env`): open the
+  // Infrastructure window on the default test-environment provisioning section.
+  ui.consumeDefaultProvisionDeepLink()
 })
 
 // Per-session guards so each AI-onboarding dialog auto-opens at most once (later opens are
@@ -179,6 +183,9 @@ watch(
       ui.resetAiOnboarding()
       // Infra-setup banner session dismissals are per-workspace too — clear them on switch.
       ui.resetInfraSetupDismissals()
+      // Same for the default test-environment prompt: each board records its own choice, so a
+      // dismissal on one must not hide the (independent) prompt for another.
+      ui.resetDefaultProvisionDismissal()
       // A different board has its own pipeline library, so re-arm the once-per-session advisory.
       ui.pipelineHealthSeen = false
     }
@@ -312,7 +319,10 @@ watch(
          - AI-readiness (no usable model source, or default preset uses unavailable models).
          - Infrastructure provider (env/runner-pool wired but missing mandatory config).
          - Infra-setup (this deployment needs an executor / test env / storage the operator hasn't
-           defined yet, so a class of agents can't run). -->
+           defined yet, so a class of agents can't run).
+         - Default test environment (this BOARD has never chosen the provisioning mechanism its
+           new services should default to). Last in the column: it asks for a convenience default,
+           so it yields to the prompts about things that are outright broken. -->
     <div
       v-if="workspace.ready && !needsGitHubInstall && !githubProbePending"
       class="pointer-events-none absolute inset-x-0 top-0 z-40 flex flex-col items-center gap-2 px-4 pt-4"
@@ -320,6 +330,7 @@ watch(
       <AiProvidersBanner />
       <ProviderConfigBanner />
       <InfraSetupBanner />
+      <DefaultTestEnvBanner />
     </div>
 
     <!-- Resolving whether the GitHub App is installed, before we decide what to show. -->

package/app/stores/ui/modals.ts

@@ -1,6 +1,10 @@
 import { ref } from 'vue'
 import type { DocumentSourceKind, InfraSetupArea, TaskSourceKind } from '~/types/domain'
 import type { PendingContext } from '~/composables/useContextLinking'
+import {
+  DEFAULT_PROVISION_DEEP_LINK_PARAM,
+  DEFAULT_PROVISION_DEEP_LINK_VALUE,
+} from '~/utils/defaultProvisioning'
 
 /** Values used to seed the add-task form when it is opened from another surface. */
 export interface AddTaskPrefill {
@@ -761,6 +765,29 @@ function createInfraModals(resetHubReturn: ResetHubReturn) {
     const qs = params.toString()
     history.replaceState(null, '', window.location.pathname + (qs ? `?${qs}` : ''))
   }
+  // Open the Infrastructure window straight at the default test-environment provisioning
+  // mechanism (the section at the top of the Test-environments tab). Distinct from
+  // `openProviderConnection('environment')` only in intent today, but it is the target of a
+  // SHAREABLE deep link (see `consumeDefaultProvisionDeepLink`), so it gets its own entry point
+  // rather than leaving the banner and the URL to duplicate the tab choice independently.
+  function openDefaultProvisionSettings() {
+    resetHubReturn()
+    infrastructureTab.value = 'environment'
+    infrastructureOpen.value = true
+  }
+  // Capture the `?settings=default-test-env` deep link on app load — the URL the setup banner
+  // shows, so an operator can send "go configure this" to a teammate rather than describing
+  // where the screen lives. Strips the param afterwards (mirroring the k3s hand-off above) so a
+  // reload doesn't re-open the window and the link isn't left in history. No-op when absent.
+  function consumeDefaultProvisionDeepLink() {
+    if (typeof window === 'undefined') return
+    const params = new URLSearchParams(window.location.search)
+    if (params.get(DEFAULT_PROVISION_DEEP_LINK_PARAM) !== DEFAULT_PROVISION_DEEP_LINK_VALUE) return
+    openDefaultProvisionSettings()
+    params.delete(DEFAULT_PROVISION_DEEP_LINK_PARAM)
+    const qs = params.toString()
+    history.replaceState(null, '', window.location.pathname + (qs ? `?${qs}` : ''))
+  }
   // Launch the environment setup wizard, optionally preselecting the service frame it targets
   // (the inspector nudge passes the frame; the navbar entry opens it with the pick step active).
   function openEnvironmentSetup(frameId: string | null = null) {
@@ -781,6 +808,8 @@ function createInfraModals(resetHubReturn: ResetHubReturn) {
     consumeK3sSetupDeepLink,
     environmentWizardOpen,
     environmentWizardFrameId,
+    openDefaultProvisionSettings,
+    consumeDefaultProvisionDeepLink,
     openProviderConnection,
     closeProviderConnection,
     openEnvironmentSetup,
@@ -815,6 +844,20 @@ function createAiOnboardingModals() {
     infraSetupSessionDismissed.value = []
   }
 
+  // Default-test-environment banner: a single per-SESSION dismissal, cleared on workspace switch
+  // like the flags above. There is deliberately no PERMANENT dismissal here (unlike the
+  // infra-setup areas): the prompt asks for a DECISION, and every answer — including `infraless`
+  // ("services stand up no environment") — is recordable in one click, so "silence this forever
+  // without answering" would only ever produce a board nobody can tell apart from an unconfigured
+  // one. Dismissing hides it until the next load.
+  const defaultProvisionDismissed = ref(false)
+  function dismissDefaultProvision() {
+    defaultProvisionDismissed.value = true
+  }
+  function resetDefaultProvisionDismissal() {
+    defaultProvisionDismissed.value = false
+  }
+
   function openAiProviderSetup() {
     aiProviderSetupOpen.value = true
   }
@@ -857,6 +900,9 @@ function createAiOnboardingModals() {
     infraSetupSessionDismissed,
     dismissInfraSetupForSession,
     resetInfraSetupDismissals,
+    defaultProvisionDismissed,
+    dismissDefaultProvision,
+    resetDefaultProvisionDismissal,
     openAiProviderSetup,
     closeAiProviderSetup,
     openAiPresetMismatch,

package/app/stores/workspaceSettings.ts

@@ -20,6 +20,11 @@ const DEFAULTS: WorkspaceSettings = {
   reviewFrictionBlockStuckMinutes: null,
   spendCurrency: null,
   spendMonthlyLimit: null,
+  // Null means the operator has never chosen a default test-environment provisioning mechanism,
+  // which is what the setup banner nags about. Defaulting it to a type here would silence that
+  // banner on every board before the snapshot even lands.
+  defaultProvisionType: null,
+  defaultProvisionManifestId: null,
 }
 
 /**

package/app/utils/defaultProvisioning.spec.ts

@@ -0,0 +1,100 @@
+import { describe, expect, it } from 'vitest'
+import type { CustomManifestType } from '@cat-factory/contracts'
+import {
+  canSaveDefaultProvisioning,
+  needsDefaultProvisioningChoice,
+  suggestDefaultProvisioning,
+} from './defaultProvisioning'
+
+function customType(
+  manifestId: string,
+  source: CustomManifestType['source'] = 'registered',
+): CustomManifestType {
+  return { manifestId, label: manifestId, source }
+}
+
+describe('needsDefaultProvisioningChoice', () => {
+  it('an unset default still owes a decision', () => {
+    expect(needsDefaultProvisioningChoice({ defaultProvisionType: null })).toBe(true)
+  })
+
+  it('an explicit infraless is a decision, not an absence', () => {
+    // The case that separates "nobody chose" from "we chose no environments" — get this wrong
+    // and a workspace that deliberately runs infraless is nagged forever.
+    expect(needsDefaultProvisioningChoice({ defaultProvisionType: 'infraless' })).toBe(false)
+  })
+
+  it('any recorded type settles it', () => {
+    expect(needsDefaultProvisioningChoice({ defaultProvisionType: 'kubernetes' })).toBe(false)
+  })
+})
+
+describe('suggestDefaultProvisioning', () => {
+  const unset = { defaultProvisionType: null, defaultProvisionManifestId: null }
+
+  it('opens on the recorded choice rather than re-suggesting over it', () => {
+    expect(
+      suggestDefaultProvisioning(
+        { defaultProvisionType: 'kubernetes', defaultProvisionManifestId: null },
+        [customType('acme-preview')],
+      ),
+    ).toEqual({ type: 'kubernetes', manifestId: null })
+  })
+
+  it('round-trips a recorded custom choice with its manifest id', () => {
+    expect(
+      suggestDefaultProvisioning(
+        { defaultProvisionType: 'custom', defaultProvisionManifestId: 'acme-preview' },
+        [customType('acme-preview'), customType('other')],
+      ),
+    ).toEqual({ type: 'custom', manifestId: 'acme-preview' })
+  })
+
+  it('suggests the first registered custom provider when nothing is selected', () => {
+    expect(
+      suggestDefaultProvisioning(unset, [customType('acme-preview'), customType('acme-legacy')]),
+    ).toEqual({ type: 'custom', manifestId: 'acme-preview' })
+  })
+
+  it('prefers a registered provider over a hand-authored workspace type', () => {
+    // A registered type is a deployment-level integration; a workspace row is one someone typed
+    // into the UI. Order in the catalog must not decide which one we recommend.
+    expect(
+      suggestDefaultProvisioning(unset, [
+        customType('typed-by-hand', 'workspace'),
+        customType('acme-preview', 'registered'),
+      ]),
+    ).toEqual({ type: 'custom', manifestId: 'acme-preview' })
+  })
+
+  it('falls back to a workspace-defined type when no provider is registered', () => {
+    expect(suggestDefaultProvisioning(unset, [customType('typed-by-hand', 'workspace')])).toEqual({
+      type: 'custom',
+      manifestId: 'typed-by-hand',
+    })
+  })
+
+  it('suggests nothing when there are no custom providers at all', () => {
+    // Deliberately does NOT guess a built-in: the picker offering `kubernetes` says nothing
+    // about whether this workspace's services actually use it.
+    expect(suggestDefaultProvisioning(unset, [])).toEqual({ type: null, manifestId: null })
+  })
+})
+
+describe('canSaveDefaultProvisioning', () => {
+  it('refuses an empty selection', () => {
+    expect(canSaveDefaultProvisioning({ type: null, manifestId: null })).toBe(false)
+  })
+
+  it('refuses custom with no manifest id, mirroring the server rule', () => {
+    expect(canSaveDefaultProvisioning({ type: 'custom', manifestId: null })).toBe(false)
+  })
+
+  it('accepts custom once a manifest type is named', () => {
+    expect(canSaveDefaultProvisioning({ type: 'custom', manifestId: 'acme-preview' })).toBe(true)
+  })
+
+  it('accepts a built-in type, including infraless', () => {
+    expect(canSaveDefaultProvisioning({ type: 'infraless', manifestId: null })).toBe(true)
+  })
+})

package/app/utils/defaultProvisioning.ts

@@ -0,0 +1,99 @@
+import type { CustomManifestType, ProvisionType, WorkspaceSettings } from '@cat-factory/contracts'
+
+/**
+ * The workspace-level default test-environment provisioning mechanism: what the SPA nags about
+ * when it is unset, and what the config section preselects when the operator first opens it.
+ *
+ * Pure so both consumers — the banner's visibility and the section's initial selection — agree
+ * on the same notion of "nothing chosen yet" without either re-deriving it.
+ */
+
+/**
+ * The query param that deep-links straight to the default-provisioning config section
+ * (`?settings=default-test-env`). Defined here — beside the logic both ends share — so the
+ * banner that BUILDS the URL and the ui store that CONSUMES it can never drift; a mismatch
+ * would produce a link that silently opens nothing.
+ */
+export const DEFAULT_PROVISION_DEEP_LINK_PARAM = 'settings'
+export const DEFAULT_PROVISION_DEEP_LINK_VALUE = 'default-test-env'
+
+/**
+ * The shareable absolute URL for the config screen. Built from the CURRENT location (rather
+ * than a configured base) so it is correct for whatever origin/path this SPA is actually served
+ * from — a deployment mounted under a sub-path included. Returns just the query string when
+ * there is no `window` (SSR is off, but the util stays callable in a unit test).
+ */
+export function defaultProvisioningConfigUrl(location?: {
+  origin: string
+  pathname: string
+}): string {
+  const query = `?${DEFAULT_PROVISION_DEEP_LINK_PARAM}=${DEFAULT_PROVISION_DEEP_LINK_VALUE}`
+  const loc = location ?? (typeof window === 'undefined' ? undefined : window.location)
+  return loc ? `${loc.origin}${loc.pathname}${query}` : query
+}
+
+/** The section's editable selection: a provision type plus, for `custom`, the pinned manifest id. */
+export interface DefaultProvisioningSelection {
+  type: ProvisionType | null
+  manifestId: string | null
+}
+
+/**
+ * Whether the workspace still owes a decision. `null` means the operator has never chosen —
+ * distinct from an explicit `infraless` ("services stand up no environment"), which is a real
+ * choice and silences the prompt. See the contracts block comment on `defaultProvisionType`.
+ */
+export function needsDefaultProvisioningChoice(
+  settings: Pick<WorkspaceSettings, 'defaultProvisionType'>,
+): boolean {
+  return settings.defaultProvisionType == null
+}
+
+/**
+ * The selection the config section opens on.
+ *
+ * A recorded choice always wins — the section is an editor for it, not a recommender that
+ * overrides what the workspace already decided.
+ *
+ * With nothing recorded, a deployment that has REGISTERED custom providers is telling us it
+ * brought its own environment tooling, and that tooling is almost always what its services
+ * should use — so the first one is preselected rather than making the operator discover the
+ * `custom` tab and then pick from a list only they can interpret. `registered` (code-defined,
+ * shipped by the deployment) is preferred over `workspace` (a row somebody typed into the UI):
+ * only the former is evidence of a deliberate platform-level integration. Falling back to the
+ * first workspace-defined type keeps the suggestion useful on a board whose only custom type
+ * was authored by hand.
+ *
+ * With no custom providers at all there is nothing to suggest, so the section opens UNSET and
+ * the operator picks from the built-in types. It deliberately does not guess a built-in: unlike
+ * a registered custom provider, the presence of `kubernetes` in the picker says nothing about
+ * whether this workspace's services use it.
+ *
+ * Nothing here is persisted — this is the form's initial value, and the operator still saves.
+ */
+export function suggestDefaultProvisioning(
+  settings: Pick<WorkspaceSettings, 'defaultProvisionType' | 'defaultProvisionManifestId'>,
+  customTypes: readonly CustomManifestType[],
+): DefaultProvisioningSelection {
+  if (settings.defaultProvisionType != null) {
+    return {
+      type: settings.defaultProvisionType,
+      manifestId: settings.defaultProvisionManifestId,
+    }
+  }
+  const suggested =
+    customTypes.find((t) => t.source === 'registered') ?? customTypes[0] ?? undefined
+  return suggested
+    ? { type: 'custom', manifestId: suggested.manifestId }
+    : { type: null, manifestId: null }
+}
+
+/**
+ * Whether a selection can be saved. Mirrors the server's cross-field rule so the button
+ * disables instead of round-tripping to a 422: `custom` must name the manifest type it uses,
+ * and there is nothing to save until a type is picked.
+ */
+export function canSaveDefaultProvisioning(selection: DefaultProvisioningSelection): boolean {
+  if (selection.type == null) return false
+  return selection.type !== 'custom' || !!selection.manifestId
+}

package/i18n/locales/de.json

@@ -934,6 +934,15 @@
       },
       "saved": "Modellzugriffsrichtlinie gespeichert",
       "saveFailed": "Modellzugriffsrichtlinie konnte nicht gespeichert werden"
+    },
+    "defaultProvision": {
+      "title": "Standard für neue Services",
+      "hint": "Der Bereitstellungsmechanismus, der für jeden künftig hinzugefügten Service vorgeschlagen wird. Bereits vorhandene Services bleiben unverändert, und jeder Service kann davon abweichen.",
+      "suggestionHint": "Das ist bislang nur ein Vorschlag. Speichern Sie ihn, um ihn als Standard des Boards zu hinterlegen.",
+      "save": "Standard speichern",
+      "saved": "Standard-Testumgebung gespeichert.",
+      "savedState": "Gespeichert.",
+      "saveFailed": "Die Standard-Testumgebung konnte nicht gespeichert werden."
     }
   },
   "inspector": {
@@ -2156,6 +2165,11 @@
         "add": "Mitglied konnte nicht hinzugefügt werden",
         "remove": "Mitglied konnte nicht entfernt werden"
       }
+    },
+    "defaultTestEnvBanner": {
+      "title": "Standard-Testumgebung wählen",
+      "body": "Für dieses Board ist noch nicht festgelegt, wie seine Services eine Testumgebung erhalten. Wählen Sie einen Standard, dann startet jeder künftig hinzugefügte Service damit, statt einzeln eingerichtet zu werden. Pro Service lässt sich das weiterhin ändern.",
+      "action": "Standard wählen"
     }
   },
   "board": {

package/i18n/locales/en.json

@@ -2190,6 +2190,11 @@
         "add": "Could not add member",
         "remove": "Could not remove member"
       }
+    },
+    "defaultTestEnvBanner": {
+      "title": "Pick a default test environment",
+      "body": "This board hasn't chosen how its services get a test environment. Pick a default and every service you add from now on starts with it, instead of being set up one at a time. You can still change it per service.",
+      "action": "Choose default"
     }
   },
   "settings": {
@@ -3139,6 +3144,15 @@
       },
       "saved": "Model access policy saved",
       "saveFailed": "Could not save the model access policy"
+    },
+    "defaultProvision": {
+      "title": "Default for new services",
+      "hint": "The provisioning mechanism suggested for every service you add from now on. It does not change services that already exist, and each service can override it.",
+      "suggestionHint": "This is a suggestion so far. Save it to record it as the board's default.",
+      "save": "Save default",
+      "saved": "Default test environment saved.",
+      "savedState": "Saved.",
+      "saveFailed": "Could not save the default test environment."
     }
   },
   "providers": {

package/i18n/locales/es.json

@@ -2121,6 +2121,11 @@
         "add": "No se pudo añadir el miembro",
         "remove": "No se pudo quitar el miembro"
       }
+    },
+    "defaultTestEnvBanner": {
+      "title": "Elige un entorno de pruebas predeterminado",
+      "body": "Este tablero aún no ha definido cómo obtienen un entorno de pruebas sus servicios. Elige un valor predeterminado y todos los servicios que añadas a partir de ahora empezarán con él, en lugar de configurarse uno a uno. Podrás cambiarlo en cada servicio.",
+      "action": "Elegir predeterminado"
     }
   },
   "settings": {
@@ -3046,6 +3051,15 @@
       },
       "saved": "Política de acceso a modelos guardada",
       "saveFailed": "No se pudo guardar la política de acceso a modelos"
+    },
+    "defaultProvision": {
+      "title": "Predeterminado para servicios nuevos",
+      "hint": "El mecanismo de aprovisionamiento que se sugerirá para cada servicio que añadas a partir de ahora. No modifica los servicios ya existentes y cada servicio puede sustituirlo.",
+      "suggestionHint": "Por ahora es solo una sugerencia. Guárdala para registrarla como predeterminado del tablero.",
+      "save": "Guardar predeterminado",
+      "saved": "Entorno de pruebas predeterminado guardado.",
+      "savedState": "Guardado.",
+      "saveFailed": "No se ha podido guardar el entorno de pruebas predeterminado."
     }
   },
   "providers": {

package/i18n/locales/fr.json

@@ -2121,6 +2121,11 @@
         "add": "Impossible d'ajouter le membre",
         "remove": "Impossible de retirer le membre"
       }
+    },
+    "defaultTestEnvBanner": {
+      "title": "Choisissez un environnement de test par défaut",
+      "body": "Ce tableau n'a pas encore défini comment ses services obtiennent un environnement de test. Choisissez une valeur par défaut et chaque service ajouté ensuite démarrera avec elle, au lieu d'être configuré un par un. Vous pourrez toujours la modifier service par service.",
+      "action": "Choisir la valeur par défaut"
     }
   },
   "settings": {
@@ -3046,6 +3051,15 @@
       },
       "saved": "Politique d'accès aux modèles enregistrée",
       "saveFailed": "Impossible d'enregistrer la politique d'accès aux modèles"
+    },
+    "defaultProvision": {
+      "title": "Valeur par défaut pour les nouveaux services",
+      "hint": "Le mécanisme de provisionnement suggéré pour chaque service ajouté à partir de maintenant. Il ne modifie pas les services existants et chaque service peut le remplacer.",
+      "suggestionHint": "Ce n'est qu'une suggestion pour l'instant. Enregistrez-la pour en faire la valeur par défaut du tableau.",
+      "save": "Enregistrer la valeur par défaut",
+      "saved": "Environnement de test par défaut enregistré.",
+      "savedState": "Enregistré.",
+      "saveFailed": "Impossible d'enregistrer l'environnement de test par défaut."
     }
   },
   "providers": {

package/i18n/locales/he.json

@@ -2121,6 +2121,11 @@
         "add": "לא ניתן להוסיף את החבר",
         "remove": "לא ניתן להסיר את החבר"
       }
+    },
+    "defaultTestEnvBanner": {
+      "title": "בחרו סביבת בדיקות ברירת מחדל",
+      "body": "בלוח הזה עדיין לא נקבע כיצד השירותים שלו מקבלים סביבת בדיקות. בחרו ברירת מחדל, וכל שירות שתוסיפו מכאן ואילך יתחיל איתה במקום להיות מוגדר אחד אחד. תמיד אפשר לשנות זאת עבור שירות מסוים.",
+      "action": "בחירת ברירת מחדל"
     }
   },
   "settings": {
@@ -3057,6 +3062,15 @@
       },
       "saved": "מדיניות הגישה למודלים נשמרה",
       "saveFailed": "לא ניתן היה לשמור את מדיניות הגישה למודלים"
+    },
+    "defaultProvision": {
+      "title": "ברירת מחדל לשירותים חדשים",
+      "hint": "מנגנון ההקצאה שיוצע לכל שירות שתוסיפו מכאן ואילך. הוא אינו משנה שירותים קיימים, וכל שירות יכול לעקוף אותו.",
+      "suggestionHint": "בשלב זה זו הצעה בלבד. שמרו אותה כדי לקבוע אותה כברירת המחדל של הלוח.",
+      "save": "שמירת ברירת מחדל",
+      "saved": "סביבת הבדיקות שנקבעה כברירת מחדל נשמרה.",
+      "savedState": "נשמר.",
+      "saveFailed": "לא ניתן היה לשמור את סביבת הבדיקות שנקבעה כברירת מחדל."
     }
   },
   "providers": {

package/i18n/locales/it.json

@@ -934,6 +934,15 @@
       },
       "saved": "Policy di accesso ai modelli salvata",
       "saveFailed": "Impossibile salvare la policy di accesso ai modelli"
+    },
+    "defaultProvision": {
+      "title": "Predefinito per i nuovi servizi",
+      "hint": "Il meccanismo di provisioning suggerito per ogni servizio che aggiungerai d'ora in poi. Non modifica i servizi già esistenti e ogni servizio può sostituirlo.",
+      "suggestionHint": "Per ora è solo un suggerimento. Salvalo per registrarlo come predefinito della board.",
+      "save": "Salva predefinito",
+      "saved": "Ambiente di test predefinito salvato.",
+      "savedState": "Salvato.",
+      "saveFailed": "Impossibile salvare l'ambiente di test predefinito."
     }
   },
   "inspector": {
@@ -2156,6 +2165,11 @@
         "add": "Impossibile aggiungere il membro",
         "remove": "Impossibile rimuovere il membro"
       }
+    },
+    "defaultTestEnvBanner": {
+      "title": "Scegli un ambiente di test predefinito",
+      "body": "Questa board non ha ancora stabilito come i suoi servizi ottengono un ambiente di test. Scegli un valore predefinito e ogni servizio che aggiungerai partirà con quello, invece di essere configurato uno alla volta. Potrai comunque cambiarlo per singolo servizio.",
+      "action": "Scegli predefinito"
     }
   },
   "board": {

package/i18n/locales/ja.json

@@ -2121,6 +2121,11 @@
         "add": "メンバーを追加できませんでした",
         "remove": "メンバーを削除できませんでした"
       }
+    },
+    "defaultTestEnvBanner": {
+      "title": "既定のテスト環境を選択してください",
+      "body": "このボードでは、サービスがテスト環境をどのように用意するかがまだ決まっていません。既定を選ぶと、以降に追加するサービスは個別に設定しなくてもその設定で始まります。サービスごとの変更も引き続き可能です。",
+      "action": "既定を選択"
     }
   },
   "settings": {
@@ -3058,6 +3063,15 @@
       },
       "saved": "モデルアクセスポリシーを保存しました",
       "saveFailed": "モデルアクセスポリシーを保存できませんでした"
+    },
+    "defaultProvision": {
+      "title": "新規サービスの既定",
+      "hint": "以降に追加するサービスに提案されるプロビジョニング方式です。既存のサービスは変更されず、サービスごとに上書きできます。",
+      "suggestionHint": "現時点では提案にすぎません。保存するとボードの既定として記録されます。",
+      "save": "既定を保存",
+      "saved": "既定のテスト環境を保存しました。",
+      "savedState": "保存済み。",
+      "saveFailed": "既定のテスト環境を保存できませんでした。"
     }
   },
   "providers": {

package/i18n/locales/pl.json

@@ -2121,6 +2121,11 @@
         "add": "Nie udało się dodać członka",
         "remove": "Nie udało się usunąć członka"
       }
+    },
+    "defaultTestEnvBanner": {
+      "title": "Wybierz domyślne środowisko testowe",
+      "body": "Ta tablica nie ma jeszcze ustalonego sposobu, w jaki jej usługi otrzymują środowisko testowe. Wybierz wartość domyślną, a każda kolejno dodawana usługa będzie od niej startować, zamiast być konfigurowana pojedynczo. Nadal możesz to zmienić dla poszczególnej usługi.",
+      "action": "Wybierz domyślne"
     }
   },
   "settings": {
@@ -3046,6 +3051,15 @@
       },
       "saved": "Zapisano politykę dostępu do modeli",
       "saveFailed": "Nie udało się zapisać polityki dostępu do modeli"
+    },
+    "defaultProvision": {
+      "title": "Domyślne dla nowych usług",
+      "hint": "Mechanizm udostępniania sugerowany dla każdej usługi dodanej od teraz. Nie zmienia już istniejących usług, a każda usługa może go nadpisać.",
+      "suggestionHint": "To na razie tylko sugestia. Zapisz ją, aby zapisać jako domyślną dla tablicy.",
+      "save": "Zapisz domyślne",
+      "saved": "Zapisano domyślne środowisko testowe.",
+      "savedState": "Zapisano.",
+      "saveFailed": "Nie udało się zapisać domyślnego środowiska testowego."
     }
   },
   "providers": {

package/i18n/locales/tr.json

@@ -2121,6 +2121,11 @@
         "add": "Üye eklenemedi",
         "remove": "Üye kaldırılamadı"
       }
+    },
+    "defaultTestEnvBanner": {
+      "title": "Varsayılan test ortamı seçin",
+      "body": "Bu pano, servislerinin test ortamını nasıl edineceğini henüz belirlemedi. Bir varsayılan seçin; bundan sonra eklediğiniz her servis tek tek kurulmak yerine bununla başlasın. Servis bazında yine değiştirebilirsiniz.",
+      "action": "Varsayılanı seç"
     }
   },
   "settings": {
@@ -3058,6 +3063,15 @@
       },
       "saved": "Model erişim politikası kaydedildi",
       "saveFailed": "Model erişim politikası kaydedilemedi"
+    },
+    "defaultProvision": {
+      "title": "Yeni servisler için varsayılan",
+      "hint": "Bundan sonra ekleyeceğiniz her servis için önerilecek sağlama mekanizması. Mevcut servisleri değiştirmez ve her servis bunu geçersiz kılabilir.",
+      "suggestionHint": "Bu şimdilik yalnızca bir öneri. Panonun varsayılanı olarak kaydetmek için kaydedin.",
+      "save": "Varsayılanı kaydet",
+      "saved": "Varsayılan test ortamı kaydedildi.",
+      "savedState": "Kaydedildi.",
+      "saveFailed": "Varsayılan test ortamı kaydedilemedi."
     }
   },
   "providers": {

package/i18n/locales/uk.json

@@ -2121,6 +2121,11 @@
         "add": "Не вдалося додати учасника",
         "remove": "Не вдалося вилучити учасника"
       }
+    },
+    "defaultTestEnvBanner": {
+      "title": "Оберіть типове тестове середовище",
+      "body": "Ця дошка ще не визначила, як її сервіси отримують тестове середовище. Оберіть типове значення, і кожен доданий надалі сервіс починатиме з нього, замість налаштування по одному. Для окремого сервісу це завжди можна змінити.",
+      "action": "Обрати типове"
     }
   },
   "settings": {
@@ -3046,6 +3051,15 @@
       },
       "saved": "Політику доступу до моделей збережено",
       "saveFailed": "Не вдалося зберегти політику доступу до моделей"
+    },
+    "defaultProvision": {
+      "title": "Типове для нових сервісів",
+      "hint": "Механізм розгортання, який пропонуватиметься для кожного сервісу, доданого відтепер. Він не змінює вже наявні сервіси, і кожен сервіс може його перевизначити.",
+      "suggestionHint": "Наразі це лише пропозиція. Збережіть її, щоб записати як типове значення дошки.",
+      "save": "Зберегти типове",
+      "saved": "Типове тестове середовище збережено.",
+      "savedState": "Збережено.",
+      "saveFailed": "Не вдалося зберегти типове тестове середовище."
     }
   },
   "providers": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cat-factory/app",
-  "version": "0.171.0",
+  "version": "0.172.0",
   "description": "Reusable Nuxt layer for the Agent Architecture Board SPA (components, stores, composables, pages). Consume it from a thin deployment app via `extends: ['@cat-factory/app']` and point it at your backend with NUXT_PUBLIC_API_BASE. See deploy/frontend for an example.",
   "repository": {
     "type": "git",
@@ -40,7 +40,7 @@
     "valibot": "^1.4.2",
     "vue": "3.5.40",
     "wretch": "^3.0.9",
-    "@cat-factory/contracts": "0.183.0"
+    "@cat-factory/contracts": "0.184.0"
   },
   "devDependencies": {
     "@toad-contracts/testing": "0.3.2",