@cat-factory/app 0.77.0 → 0.78.0

package/app/components/layout/IntegrationsHub.vue

@@ -20,6 +20,7 @@ const documents = useDocumentsStore()
 const tasks = useTasksStore()
 const tracker = useTrackerStore()
 const releaseHealth = useReleaseHealthStore()
+const packageRegistries = usePackageRegistriesStore()
 const userSecrets = useUserSecretsStore()
 const apiKeys = useApiKeysStore()
 const workspace = useWorkspaceStore()
@@ -49,6 +50,7 @@ watch(
     if (isOpen) {
       query.value = ''
       void releaseHealth.ensureLoaded().catch(() => {})
+      void packageRegistries.ensureLoaded().catch(() => {})
       void userSecrets.load().catch(() => {})
       // Drives the OpenRouter row's "Key connected" badge.
       if (workspace.workspaceId) void apiKeys.load(workspace.workspaceId).catch(() => {})
@@ -256,6 +258,27 @@ const groups = computed<IntegrationGroup[]>(() => {
     })
   }
 
+  // --- Development (private package registries) -------------------------------
+  // Gated like observability: hidden until a probe confirms the module is wired
+  // (`available === true`), so an unconfigured backend doesn't show a dead row.
+  if (packageRegistries.available) {
+    const hasEntries = packageRegistries.entries.length > 0
+    out.push({
+      title: t('layout.integrationsHub.groups.development'),
+      items: [
+        {
+          key: 'package-registries',
+          icon: 'i-lucide-package',
+          label: t('layout.integrationsHub.items.packageRegistries.label'),
+          description: t('layout.integrationsHub.items.packageRegistries.description'),
+          status: hasEntries ? t('layout.integrationsHub.status.connected') : undefined,
+          connected: hasEntries,
+          onClick: () => go(ui.openPackageRegistries),
+        },
+      ],
+    })
+  }
+
   // NOTE: Infrastructure (agent-container execution + Tester environments + the local-mode
   // warm pool/checkout) is no longer listed here — it moved to its OWN top-level navbar menu
   // (SideBar → "Infrastructure" → the tabbed Infrastructure window). See `ui.openInfrastructure`.

package/app/components/panels/AgentStepDetail.vue

@@ -7,6 +7,8 @@ import StepRestartControl from '~/components/panels/StepRestartControl.vue'
 import StepMetadataCard from '~/components/panels/StepMetadataCard.vue'
 import StepTestReport from '~/components/panels/StepTestReport.vue'
 import EnvironmentStatusPanel from '~/components/environments/EnvironmentStatusPanel.vue'
+import FrontendBindingsResolved from '~/components/panels/inspector/FrontendBindingsResolved.vue'
+import { UI_TESTER_AGENT_KIND } from '@cat-factory/contracts'
 import ProvisioningLogsDrawer from '~/components/provisioning/ProvisioningLogsDrawer.vue'
 import IterationCapPrompt from '~/components/pipeline/IterationCapPrompt.vue'
 import { useStepTimer } from '~/composables/useStepTimer'
@@ -58,6 +60,24 @@ const testPhase = computed(() => step.value?.test ?? null)
 // coder consume it), so the panel shows its spinning-up/running/shutdown/errored state.
 const stepEnvironment = computed(() => step.value?.environment ?? null)
 
+// For a frontend UI-test step (`tester-ui`): the enclosing `frontend` frame's backend-binding
+// config, so the detail can project how each env var resolved (live URL | mocked) — rendered from
+// the FROZEN bindings the engine stamped on the run (`instance.frontendBindings`), so a finished
+// run shows what it actually drove against rather than re-resolving against current live state.
+const frontendFrame = computed(() => (block.value ? board.serviceOf(block.value) : undefined))
+const isFrontendFrame = computed(() => frontendFrame.value?.type === 'frontend')
+const frontendConfig = computed(() =>
+  step.value?.agentKind === UI_TESTER_AGENT_KIND && isFrontendFrame.value
+    ? (frontendFrame.value!.frontendConfig ?? null)
+    : null,
+)
+// The frozen start-time resolution the tester ran against (absent for a non-frontend / pre-6b run).
+const frontendBindings = computed(() => instance.value?.frontendBindings ?? [])
+// The run-start advisories the engine stamped on the run (duplicate env vars / partially-mocked
+// services) are a whole-RUN fact, so surface them on ANY step detail of a frontend-frame run, not
+// only the `tester-ui` step — a duplicate-env-var note shouldn't be invisible from the coder step.
+const runNotes = computed(() => (isFrontendFrame.value ? (instance.value?.notes ?? []) : []))
+
 // The run's infrastructure attempts (container/runner/env spin-up + tear-down), behind
 // a toggle. This is the surface that makes the per-run `container` log rows + the
 // executionId filter visible — most useful when the run failed to start a container.
@@ -345,6 +365,27 @@ async function copyOutput() {
                    errored + the exact error), when this step runs against one -->
               <EnvironmentStatusPanel v-if="stepEnvironment" :environment="stepEnvironment" />
 
+              <!-- frontend UI-test: how the frame's backend bindings resolved (env var →
+                   live URL | mocked) + the run-start advisories (duplicate env vars /
+                   partially-mocked services) the engine stamped on the run. Rendered from the
+                   FROZEN start-time bindings so a finished run shows what it actually drove
+                   against, not a live re-resolution. -->
+              <FrontendBindingsResolved
+                v-if="frontendConfig"
+                :config="frontendConfig"
+                :resolved="frontendBindings"
+              />
+              <ul v-if="runNotes.length" class="space-y-1" data-testid="run-notes">
+                <li
+                  v-for="(note, i) in runNotes"
+                  :key="i"
+                  class="flex items-start gap-1.5 text-[11px] leading-snug text-amber-300/80"
+                >
+                  <UIcon name="i-lucide-info" class="mt-0.5 h-3.5 w-3.5 shrink-0" />
+                  <span>{{ note }}</span>
+                </li>
+              </ul>
+
               <!-- this run's infrastructure attempts (container/runner/env spin-up +
                    tear-down): the surface for the per-run container log rows + the exact
                    provider error, behind a toggle (most useful on a failed-to-start run) -->

package/app/components/panels/inspector/FrontendBindingsResolved.vue

@@ -0,0 +1,111 @@
+<script setup lang="ts">
+import { computed, onMounted } from 'vue'
+import {
+  duplicateBindingEnvVars,
+  resolveFrontendBindings,
+  type FrontendBackendBinding,
+  type FrontendConfig,
+  type ResolvedFrontendBinding,
+} from '@cat-factory/contracts'
+
+// The resolution of a frontend frame's backend bindings — each env var → a bound service's live
+// ephemeral URL, or WireMock. Two modes, same view:
+//   - **Live** (frame inspector, `resolved` omitted): resolves against the workspace's CURRENT env
+//     handles (fetched once via the environments store), so the operator sees how a run would
+//     resolve RIGHT NOW. Feeds the SAME pure helpers the backend uses so it can't drift.
+//   - **Projected** (`tester-ui` run/step detail, `resolved` provided): renders the FROZEN
+//     start-time bindings the engine stamped on the run, so a finished run shows what it ACTUALLY
+//     drove against — truthful even after the underlying envs are torn down (no live re-read).
+// Also surfaces the duplicate-env-var misconfiguration in live mode (projected mode leaves that to
+// the run-start note, which owns the frozen advisory).
+const props = defineProps<{ config: FrontendConfig; resolved?: ResolvedFrontendBinding[] }>()
+
+const environments = useEnvironmentsStore()
+const board = useBoardStore()
+const { t } = useI18n()
+
+const projected = computed(() => props.resolved !== undefined)
+
+// Live mode refreshes the env handles when this view opens so a just-provisioned service shows as
+// live; a projected snapshot needs no live read.
+onMounted(() => {
+  if (!projected.value) void environments.load()
+})
+
+// The duplicate advisory is config-derived; in projected mode the run-start note owns it (frozen
+// at start), so don't re-derive it here against a possibly-since-edited config.
+const duplicates = computed(() => (projected.value ? [] : duplicateBindingEnvVars(props.config)))
+
+// Each resolved binding + the display metadata a bare {envVar, serviceUrl} can't carry: whether
+// a mocked upstream was a `mock` source or a `service` with no live env, and the bound service's
+// title. Joined off the LAST config binding per envVar (matching `resolveFrontendBindings`'
+// last-wins dedup), so the extra labels stay in step with the canonical resolution.
+const rows = computed(() => {
+  const resolved =
+    props.resolved ??
+    resolveFrontendBindings(props.config, environments.liveServiceEnvUrls(props.config))
+  const lastByEnvVar = new Map<string, FrontendBackendBinding>()
+  for (const b of props.config.backendBindings) {
+    const key = b.envVar.trim()
+    if (key) lastByEnvVar.set(key, b)
+  }
+  return resolved.map((r) => {
+    const source = lastByEnvVar.get(r.envVar)?.source
+    const serviceFrameId = source?.kind === 'service' ? source.serviceBlockId : undefined
+    return {
+      envVar: r.envVar,
+      serviceUrl: r.serviceUrl,
+      kind: r.serviceUrl ? 'live' : source?.kind === 'service' ? 'service-offline' : 'mock',
+      serviceTitle: serviceFrameId
+        ? (board.getBlock(serviceFrameId)?.title ?? serviceFrameId)
+        : undefined,
+    } as const
+  })
+})
+</script>
+
+<template>
+  <div v-if="rows.length || duplicates.length" class="space-y-1.5" data-testid="frontend-resolved">
+    <div class="text-[11px] font-semibold uppercase tracking-wide text-slate-500">
+      {{ t('inspector.frontendConfig.resolved.title') }}
+    </div>
+
+    <p
+      v-if="duplicates.length"
+      class="text-[11px] leading-snug text-amber-300/80"
+      data-testid="frontend-resolved-duplicates"
+    >
+      {{ t('inspector.frontendConfig.resolved.duplicateWarning', { vars: duplicates.join(', ') }) }}
+    </p>
+
+    <ul v-if="rows.length" class="space-y-0.5">
+      <li
+        v-for="row in rows"
+        :key="row.envVar"
+        class="flex items-baseline gap-1.5 text-[11px] leading-snug"
+        data-testid="frontend-resolved-row"
+      >
+        <span
+          class="mt-1 h-1.5 w-1.5 shrink-0 rounded-full"
+          :class="{
+            'bg-emerald-400': row.kind === 'live',
+            'bg-amber-400': row.kind === 'service-offline',
+            'bg-slate-500': row.kind === 'mock',
+          }"
+        />
+        <span class="font-mono text-slate-300">{{ row.envVar }}</span>
+        <span class="text-slate-600">→</span>
+        <template v-if="row.kind === 'live'">
+          <span class="truncate font-mono text-emerald-300/90">{{ row.serviceUrl }}</span>
+          <span v-if="row.serviceTitle" class="text-slate-500">({{ row.serviceTitle }})</span>
+        </template>
+        <span v-else-if="row.kind === 'service-offline'" class="text-amber-300/80">
+          {{ t('inspector.frontendConfig.resolved.serviceOffline', { service: row.serviceTitle }) }}
+        </span>
+        <span v-else class="text-slate-500">
+          {{ t('inspector.frontendConfig.resolved.mock') }}
+        </span>
+      </li>
+    </ul>
+  </div>
+</template>

package/app/components/panels/inspector/FrontendConfig.vue

@@ -10,6 +10,7 @@ import type {
   FrontendServeMode,
   PreviewStatus,
 } from '~/types/domain'
+import FrontendBindingsResolved from '~/components/panels/inspector/FrontendBindingsResolved.vue'
 
 // Frontend-frame (`type: 'frontend'`) configuration: how to build, serve, and mock this
 // frontend for a self-contained UI test (+ an optional browsable preview on local/node),
@@ -625,6 +626,13 @@ onUnmounted(() => preview.stopPolling(props.block.id))
         <div v-else class="text-[11px] text-slate-500">
           {{ t('inspector.frontendConfig.bindings.empty') }}
         </div>
+
+        <!-- How the bindings resolve RIGHT NOW: each env var → a bound service's live ephemeral
+             URL, or WireMock — plus the duplicate-env-var warning. The same view a UI-test run
+             would resolve against (shared helpers), so what you see is what a run will drive. -->
+        <div class="border-t border-slate-800/60 pt-2">
+          <FrontendBindingsResolved :config="config" />
+        </div>
       </div>
     </div>
 

package/app/components/settings/PackageRegistriesPanel.vue

@@ -0,0 +1,222 @@
+<script setup lang="ts">
+// Private package registries — the workspace's npm-registry entries (npm private
+// orgs, GitHub Packages) that agent containers use to resolve private dependencies
+// on checkout. Tokens are write-only: the list renders from the redacted summary
+// (vendor + scopes + token tail) and an entry is edited by deleting + re-adding.
+// Opened from the Integrations hub.
+import { computed, reactive, ref, watch } from 'vue'
+import type { PackageRegistryVendor } from '~/types/packageRegistries'
+import IntegrationBackTitle from '~/components/layout/IntegrationBackTitle.vue'
+
+const { t } = useI18n()
+const ui = useUiStore()
+const store = usePackageRegistriesStore()
+const toast = useToast()
+const { confirmAction, toastDone } = useConfirmAction()
+
+const open = computed({
+  get: () => ui.packageRegistriesOpen,
+  set: (v: boolean) => (v ? ui.openPackageRegistries() : ui.closePackageRegistries()),
+})
+const back = useIntegrationBack(open)
+
+// The registry vendors a workspace can connect. Fixed set — the host derives from the
+// vendor server-side, so it renders read-only here. Vendor names stay verbatim.
+const VENDORS: { value: PackageRegistryVendor; label: string; host: string }[] = [
+  { value: 'npmjs', label: 'npm (npmjs.com)', host: 'registry.npmjs.org' },
+  { value: 'github-packages', label: 'GitHub Packages', host: 'npm.pkg.github.com' },
+]
+
+const form = reactive({
+  vendor: 'npmjs' as PackageRegistryVendor,
+  scopes: '',
+  token: '',
+})
+const busy = ref(false)
+
+const vendorHost = computed(() => VENDORS.find((v) => v.value === form.vendor)?.host ?? '')
+
+function vendorLabel(vendor: PackageRegistryVendor): string {
+  return VENDORS.find((v) => v.value === vendor)?.label ?? vendor
+}
+
+/** Parse the comma/space-separated scopes input into `@org` entries. */
+const parsedScopes = computed(() =>
+  form.scopes
+    .split(/[\s,]+/)
+    .map((s) => s.trim())
+    .filter(Boolean)
+    .map((s) => (s.startsWith('@') ? s : `@${s}`)),
+)
+
+function notifyError(title: string, e: unknown) {
+  toast.add({
+    title,
+    description: e instanceof Error ? e.message : String(e),
+    icon: 'i-lucide-triangle-alert',
+    color: 'error',
+  })
+}
+
+watch(
+  open,
+  async (isOpen) => {
+    if (!isOpen) return
+    try {
+      await store.ensureLoaded()
+    } catch (e) {
+      notifyError(t('settings.packageRegistries.toast.loadFailed'), e)
+    }
+  },
+  { immediate: true },
+)
+
+async function addEntry() {
+  busy.value = true
+  try {
+    await store.add({
+      ecosystem: 'npm',
+      vendor: form.vendor,
+      scopes: parsedScopes.value,
+      token: form.token.trim(),
+    })
+    form.scopes = ''
+    form.token = ''
+    toast.add({
+      title: t('settings.packageRegistries.toast.added'),
+      icon: 'i-lucide-check',
+      color: 'success',
+    })
+  } catch (e) {
+    notifyError(t('settings.packageRegistries.toast.addFailed'), e)
+  } finally {
+    busy.value = false
+  }
+}
+
+async function removeEntry(entryId: string) {
+  const noun = t('settings.packageRegistries.entryNoun')
+  if (!(await confirmAction('remove', noun))) return
+  busy.value = true
+  try {
+    await store.remove(entryId)
+    toastDone('remove', noun)
+  } catch (e) {
+    notifyError(t('settings.packageRegistries.toast.removeFailed'), e)
+  } finally {
+    busy.value = false
+  }
+}
+</script>
+
+<template>
+  <UModal
+    v-model:open="open"
+    :title="t('settings.packageRegistries.title')"
+    :ui="{ content: 'max-w-lg' }"
+  >
+    <template #title>
+      <IntegrationBackTitle :title="t('settings.packageRegistries.title')" @back="back" />
+    </template>
+    <template #body>
+      <div class="space-y-4" data-testid="package-registries-panel">
+        <p class="text-sm text-slate-400">
+          {{ t('settings.packageRegistries.intro') }}
+        </p>
+
+        <section
+          v-if="store.entries.length"
+          class="space-y-2 rounded-lg border border-slate-700 p-3"
+        >
+          <h3 class="text-sm font-semibold">
+            {{ t('settings.packageRegistries.list.heading') }}
+          </h3>
+          <div
+            v-for="entry in store.entries"
+            :key="entry.id"
+            class="flex items-center justify-between gap-2 rounded-md border border-slate-800 px-3 py-2"
+          >
+            <div class="min-w-0 space-y-1">
+              <div class="flex items-center gap-2">
+                <span class="text-sm font-medium">{{ vendorLabel(entry.vendor) }}</span>
+                <span class="text-[11px] text-slate-500">
+                  {{ t('settings.packageRegistries.list.tokenTail', { tail: entry.tokenTail }) }}
+                </span>
+              </div>
+              <div class="flex flex-wrap gap-1">
+                <UBadge
+                  v-for="scope in entry.scopes"
+                  :key="scope"
+                  color="neutral"
+                  variant="soft"
+                  size="sm"
+                >
+                  {{ scope }}
+                </UBadge>
+              </div>
+            </div>
+            <UButton
+              color="error"
+              variant="ghost"
+              icon="i-lucide-trash-2"
+              size="sm"
+              :loading="busy"
+              :data-testid="`package-registry-delete-${entry.id}`"
+              :aria-label="t('settings.packageRegistries.list.remove')"
+              @click="removeEntry(entry.id)"
+            />
+          </div>
+        </section>
+
+        <section class="space-y-3 rounded-lg border border-slate-700 p-3">
+          <h3 class="text-sm font-semibold">
+            {{ t('settings.packageRegistries.add.heading') }}
+          </h3>
+
+          <UFormField :label="t('settings.packageRegistries.add.vendor')">
+            <USelect
+              v-model="form.vendor"
+              :items="VENDORS"
+              value-key="value"
+              class="w-full"
+              data-testid="package-registry-vendor"
+            />
+          </UFormField>
+          <p class="text-[11px] text-slate-500">
+            {{ t('settings.packageRegistries.add.host', { host: vendorHost }) }}
+          </p>
+
+          <UFormField
+            :label="t('settings.packageRegistries.add.scopes')"
+            :help="t('settings.packageRegistries.add.scopesHelp')"
+          >
+            <UInput
+              v-model="form.scopes"
+              placeholder="@my-org, @my-other-org"
+              class="w-full"
+              data-testid="package-registry-scopes"
+            />
+          </UFormField>
+
+          <UFormField :label="t('settings.packageRegistries.add.token')">
+            <UInput
+              v-model="form.token"
+              type="password"
+              class="w-full"
+              data-testid="package-registry-token"
+            />
+          </UFormField>
+
+          <UButton
+            :loading="busy"
+            :disabled="!parsedScopes.length || !form.token.trim()"
+            data-testid="package-registry-save"
+            @click="addEntry"
+          >
+            {{ t('settings.packageRegistries.add.save') }}
+          </UButton>
+        </section>
+      </div>
+    </template>
+  </UModal>
+</template>

package/app/composables/api/environments.ts

@@ -0,0 +1,10 @@
+import { listEnvironmentsContract } from '@cat-factory/contracts'
+import type { ApiContext } from './context'
+
+/** Ephemeral environments: the workspace's live env handles (used to resolve frontend bindings). */
+export function environmentsApi({ send, ws }: ApiContext) {
+  return {
+    listEnvironments: (workspaceId: string) =>
+      send(listEnvironmentsContract, { pathPrefix: ws(workspaceId) }),
+  }
+}

package/app/composables/api/packageRegistries.ts

@@ -0,0 +1,24 @@
+import {
+  addPackageRegistryContract,
+  deletePackageRegistryContract,
+  listPackageRegistriesContract,
+} from '@cat-factory/contracts'
+import type { AddPackageRegistryInput } from '~/types/packageRegistries'
+import type { ApiContext } from './context'
+
+/** Private package registries: the workspace's entries agent containers install with. */
+export function packageRegistriesApi({ send, ws }: ApiContext) {
+  return {
+    listPackageRegistries: (workspaceId: string) =>
+      send(listPackageRegistriesContract, { pathPrefix: ws(workspaceId) }),
+
+    addPackageRegistry: (workspaceId: string, body: AddPackageRegistryInput) =>
+      send(addPackageRegistryContract, { pathPrefix: ws(workspaceId), body }),
+
+    deletePackageRegistry: (workspaceId: string, entryId: string) =>
+      send(deletePackageRegistryContract, {
+        pathPrefix: ws(workspaceId),
+        pathParams: { entryId },
+      }),
+  }
+}

package/app/composables/useApi.ts

@@ -18,11 +18,13 @@ import { kaizenApi } from './api/kaizen'
 import { localSettingsApi } from './api/localSettings'
 import { modelsApi } from './api/models'
 import { notificationsApi } from './api/notifications'
+import { packageRegistriesApi } from './api/packageRegistries'
 import { presetsApi } from './api/presets'
 import { providerConnectionsApi } from './api/providerConnections'
 import { provisioningLogsApi } from './api/provisioningLogs'
 import { recurringApi } from './api/recurring'
 import { previewApi } from './api/preview'
+import { environmentsApi } from './api/environments'
 import { releaseHealthApi } from './api/releaseHealth'
 import { sandboxApi } from './api/sandbox'
 import { reviewsApi } from './api/reviews'
@@ -112,7 +114,9 @@ export function useApi() {
     ...infraHandlersApi(ctx),
     ...provisioningLogsApi(ctx),
     ...releaseHealthApi(ctx),
+    ...packageRegistriesApi(ctx),
     ...previewApi(ctx),
+    ...environmentsApi(ctx),
     ...recurringApi(ctx),
     ...sandboxApi(ctx),
     ...githubApi(ctx),

package/app/pages/index.vue

@@ -85,6 +85,9 @@ const AccountSettingsPanel = defineAsyncComponent(
 const ObservabilityConnectionPanel = defineAsyncComponent(
   () => import('~/components/settings/ObservabilityConnectionPanel.vue'),
 )
+const PackageRegistriesPanel = defineAsyncComponent(
+  () => import('~/components/settings/PackageRegistriesPanel.vue'),
+)
 const InfrastructureWindow = defineAsyncComponent(
   () => import('~/components/settings/InfrastructureWindow.vue'),
 )
@@ -356,6 +359,7 @@ watch(
       <WorkspaceSettingsPanel v-if="ui.workspaceSettingsOpen" />
       <AccountSettingsPanel v-if="ui.accountSettingsOpen" />
       <ObservabilityConnectionPanel v-if="ui.observabilityConnectionOpen" />
+      <PackageRegistriesPanel v-if="ui.packageRegistriesOpen" />
       <InfrastructureWindow v-if="ui.infrastructureOpen" />
       <ModelConfigurationPanel v-if="ui.modelConfigOpen" />
       <LocalModelEndpointsPanel v-if="ui.localModelsOpen" />

package/app/stores/environments.ts

@@ -0,0 +1,52 @@
+import { defineStore } from 'pinia'
+import { ref } from 'vue'
+import {
+  boundServiceFrameIds,
+  indexLiveServiceEnvUrls,
+  type FrontendConfig,
+} from '@cat-factory/contracts'
+import type { EnvironmentHandle } from '~/types/domain'
+import { useWorkspaceStore } from '~/stores/workspace'
+
+/**
+ * The workspace's live ephemeral-environment handles, fetched on demand from
+ * `GET /workspaces/:ws/environments`. Used to resolve a `frontend` frame's backend bindings to
+ * their live service URLs (the SPA mirror of the backend's `AgentContextBuilder` resolution) — so
+ * the inspector and the run/step detail can show each `envVar → live URL | mocked` the SAME way a
+ * UI-test run would. Kept as a thin, load-on-open cache (no snapshot delivery, no self-poll):
+ * the callers refresh it when the frontend inspector / a UI-test step detail opens.
+ */
+export const useEnvironmentsStore = defineStore('environments', () => {
+  const api = useApi()
+
+  /** The last-fetched env handles for the current workspace. */
+  const handles = ref<EnvironmentHandle[]>([])
+  /** A load is in flight (drives an optional spinner). */
+  const loading = ref(false)
+
+  /** (Re)load the workspace's environment handles; failures leave the last-known list. */
+  async function load(): Promise<void> {
+    const ws = useWorkspaceStore()
+    loading.value = true
+    try {
+      handles.value = await api.listEnvironments(ws.requireId())
+    } catch {
+      // Transient: keep the last-known handles rather than blanking the resolved view.
+    } finally {
+      loading.value = false
+    }
+  }
+
+  /**
+   * The live `serviceFrameId → url` map for exactly the service FRAMES a frontend config binds —
+   * the same newest-wins, ready-with-URL indexing the backend applies (`indexLiveServiceEnvUrls`),
+   * so the SPA's resolved-binding view can't drift from what a run would resolve.
+   */
+  function liveServiceEnvUrls(
+    config: Pick<FrontendConfig, 'backendBindings'>,
+  ): Map<string, string> {
+    return indexLiveServiceEnvUrls(handles.value, boundServiceFrameIds(config))
+  }
+
+  return { handles, loading, load, liveServiceEnvUrls }
+})

package/app/stores/packageRegistries.ts

@@ -0,0 +1,66 @@
+import { defineStore } from 'pinia'
+import { ref } from 'vue'
+import type { AddPackageRegistryInput, PackageRegistryEntryView } from '~/types/packageRegistries'
+import { useWorkspaceStore } from '~/stores/workspace'
+import { apiErrorStatus } from '~/composables/api/errors'
+
+/**
+ * The workspace's private package-registry entries (npm private orgs, GitHub
+ * Packages) that agent containers install with. Tokens are write-only — the store
+ * only ever holds the redacted summary views. Loaded on demand (the registries
+ * panel + the Integrations hub badge), not from the snapshot.
+ */
+export const usePackageRegistriesStore = defineStore('packageRegistries', () => {
+  const api = useApi()
+
+  const entries = ref<PackageRegistryEntryView[]>([])
+  const loading = ref(false)
+  // Mirrors the backend's opt-in gate (the module 503s when the encryption key is
+  // absent): `null` until first probed, then `true`/`false`. The hub hides its
+  // registries entry point when this is false.
+  const available = ref<boolean | null>(null)
+  let inFlight: Promise<void> | null = null
+
+  /** Force a refresh of the entry list (used after an add/remove). */
+  async function load() {
+    const ws = useWorkspaceStore()
+    loading.value = true
+    try {
+      entries.value = (await api.listPackageRegistries(ws.requireId())).entries
+      available.value = true
+    } catch (err) {
+      if (apiErrorStatus(err) === 503) {
+        // A definitive 503 means the integration is unconfigured (no encryption key on
+        // the backend): hide the UI entry points and stop probing.
+        available.value = false
+        entries.value = []
+      }
+      // Any other failure (transient 5xx / network) is left untouched: it must not hide
+      // an already-available panel nor cache a false "unavailable". `available` stays
+      // `null` when never probed, so `ensureLoaded` remains retryable on the next open.
+    } finally {
+      loading.value = false
+    }
+  }
+
+  /** Load once and share the result (coalescing concurrent callers); `load()` refreshes. */
+  async function ensureLoaded() {
+    if (available.value !== null) return
+    if (!inFlight) inFlight = load().finally(() => (inFlight = null))
+    return inFlight
+  }
+
+  async function add(input: AddPackageRegistryInput) {
+    const ws = useWorkspaceStore()
+    entries.value = (await api.addPackageRegistry(ws.requireId(), input)).entries
+    available.value = true
+  }
+
+  async function remove(entryId: string) {
+    const ws = useWorkspaceStore()
+    await api.deletePackageRegistry(ws.requireId(), entryId)
+    entries.value = entries.value.filter((entry) => entry.id !== entryId)
+  }
+
+  return { entries, loading, available, load, ensureLoaded, add, remove }
+})

package/app/stores/ui.ts

@@ -153,6 +153,9 @@ export const useUiStore = defineStore('ui', () => {
   // today, pluggable). NB: distinct from `observabilityInstanceId` below, which is the
   // LLM per-call observability panel.
   const observabilityConnectionOpen = ref(false)
+  // Private package registries: the workspace's npm/GitHub-Packages entries agent
+  // containers install with. Opened from the Integrations hub.
+  const packageRegistriesOpen = ref(false)
   // The single tabbed Infrastructure window — a TOP-LEVEL navbar destination (no longer
   // reached via the Integrations hub). Two topical tabs: "Agent containers" (the execution
   // backend + self-hosted runner pool, plus the local-mode warm pool/checkout) and "Test
@@ -561,6 +564,13 @@ export const useUiStore = defineStore('ui', () => {
   function closeObservabilityConnection() {
     observabilityConnectionOpen.value = false
   }
+  function openPackageRegistries() {
+    resetHubReturn()
+    packageRegistriesOpen.value = true
+  }
+  function closePackageRegistries() {
+    packageRegistriesOpen.value = false
+  }
   // Top-level navbar entry into the Infrastructure window. No hub-return marker (it isn't
   // reached from the Integrations hub), so the window shows no "Back to Integrations" control.
   function openInfrastructure(tab: 'environment' | 'runner-pool' = 'runner-pool') {
@@ -791,6 +801,7 @@ export const useUiStore = defineStore('ui', () => {
     accountSettingsTab,
     accountSettingsScrollTarget,
     observabilityConnectionOpen,
+    packageRegistriesOpen,
     infrastructureOpen,
     infrastructureTab,
     openInfrastructure,
@@ -880,6 +891,8 @@ export const useUiStore = defineStore('ui', () => {
     setAccountSettingsTab,
     openObservabilityConnection,
     closeObservabilityConnection,
+    openPackageRegistries,
+    closePackageRegistries,
     openProviderConnection,
     closeProviderConnection,
     k3sSetupPrefill,

package/app/types/domain.ts

@@ -33,6 +33,8 @@ export type {
   FrontendConfig,
   FrontendBackendBinding,
   FrontendBackendSource,
+  ResolvedFrontendBinding,
+  EnvironmentHandle,
   ServiceConnection,
   FrontendBranch,
   FrontendPackageManager,

package/app/types/packageRegistries.ts

@@ -0,0 +1,13 @@
+// Private package-registry settings shapes. Per-workspace registry entries (npm
+// private orgs, GitHub Packages) whose tokens are write-only — the list view only
+// ever carries the non-secret summary (vendor + scopes + token tail).
+//
+// All wire shapes are sourced from @cat-factory/contracts (single source of truth).
+
+export type {
+  PackageEcosystem,
+  PackageRegistryVendor,
+  AddPackageRegistryInput,
+  PackageRegistryEntryView,
+  PackageRegistryListView,
+} from '@cat-factory/contracts'

package/i18n/locales/en.json

@@ -544,6 +544,12 @@
           "failed": "Failed",
           "stopped": "Not running"
         }
+      },
+      "resolved": {
+        "title": "Resolves to",
+        "duplicateWarning": "Used on more than one binding, so only the last applies: {vars}.",
+        "serviceOffline": "{service}: no live environment (mocked)",
+        "mock": "Mock (WireMock)"
       }
     },
     "serviceConnections": {
@@ -1491,6 +1497,7 @@
         "documents": "Documents",
         "taskTrackers": "Task trackers",
         "observability": "Observability",
+        "development": "Development",
         "personal": "Personal (only you)"
       },
       "items": {
@@ -1528,6 +1535,10 @@
           "label": "Post-release health",
           "description": "Watch monitors and SLOs after a release ships (Datadog)."
         },
+        "packageRegistries": {
+          "label": "Private package registries",
+          "description": "npm and GitHub Packages tokens agents use to install private dependencies."
+        },
         "githubPat": {
           "label": "My GitHub token",
           "description": "A personal access token used for runs you start (pushes, PRs, CI, merge)."
@@ -2025,6 +2036,31 @@
       "connectionNoun": "the observability connection",
       "incidentNoun": "the incident provider"
     },
+    "packageRegistries": {
+      "title": "Private package registries",
+      "intro": "Connect the private registries your repositories install from. Agents receive them when they check out a repository, so private dependencies resolve during installs. Tokens are write-only: to change one, remove the entry and add it again.",
+      "entryNoun": "registry entry",
+      "list": {
+        "heading": "Connected registries",
+        "tokenTail": "token …{tail}",
+        "remove": "Remove entry"
+      },
+      "add": {
+        "heading": "Add a registry",
+        "vendor": "Registry",
+        "host": "The token is sent only to {host}.",
+        "scopes": "Package scopes",
+        "scopesHelp": "Comma-separated npm scopes",
+        "token": "Access token",
+        "save": "Add registry"
+      },
+      "toast": {
+        "loadFailed": "Could not load package registries",
+        "added": "Registry added",
+        "addFailed": "Could not add the registry",
+        "removeFailed": "Could not remove the registry entry"
+      }
+    },
     "localMode": {
       "title": "Local mode",
       "intro": "Tuning for the local container runner, stored on this machine's deployment (it replaced the {poolVars} / {harnessVars} env vars). Saving resizes the warm pool live, no restart needed; in-flight runs keep the container they already hold.",

package/i18n/locales/es.json

@@ -501,6 +501,12 @@
           "failed": "Error",
           "stopped": "No iniciada"
         }
+      },
+      "resolved": {
+        "title": "Se resuelve a",
+        "duplicateWarning": "Usado en más de un binding, por lo que solo se aplica el último: {vars}.",
+        "serviceOffline": "{service}: sin entorno activo (simulado)",
+        "mock": "Mock (WireMock)"
       }
     },
     "serviceConnections": {
@@ -1438,6 +1444,7 @@
         "documents": "Documentos",
         "taskTrackers": "Rastreadores de tareas",
         "observability": "Observabilidad",
+        "development": "Desarrollo",
         "personal": "Personal (solo tú)"
       },
       "items": {
@@ -1475,6 +1482,10 @@
           "label": "Salud posterior al lanzamiento",
           "description": "Vigila los monitores y SLO después de publicar una versión (Datadog)."
         },
+        "packageRegistries": {
+          "label": "Registros privados de paquetes",
+          "description": "Tokens de npm y GitHub Packages que los agentes usan para instalar dependencias privadas."
+        },
         "githubPat": {
           "label": "Mi token de GitHub",
           "description": "Un token de acceso personal usado para las ejecuciones que inicias (pushes, PR, CI, fusión)."
@@ -1854,6 +1865,31 @@
       "connectionNoun": "la conexión de observabilidad",
       "incidentNoun": "el proveedor de incidencias"
     },
+    "packageRegistries": {
+      "title": "Registros privados de paquetes",
+      "intro": "Conecta los registros privados desde los que instalan tus repositorios. Los agentes los reciben al hacer checkout de un repositorio, de modo que las dependencias privadas se resuelven durante la instalación. Los tokens son de solo escritura: para cambiar uno, elimina la entrada y vuelve a agregarla.",
+      "entryNoun": "entrada de registro",
+      "list": {
+        "heading": "Registros conectados",
+        "tokenTail": "token …{tail}",
+        "remove": "Eliminar entrada"
+      },
+      "add": {
+        "heading": "Agregar un registro",
+        "vendor": "Registro",
+        "host": "El token solo se envía a {host}.",
+        "scopes": "Ámbitos de paquetes",
+        "scopesHelp": "Ámbitos de npm separados por comas",
+        "token": "Token de acceso",
+        "save": "Agregar registro"
+      },
+      "toast": {
+        "loadFailed": "No se pudieron cargar los registros de paquetes",
+        "added": "Registro agregado",
+        "addFailed": "No se pudo agregar el registro",
+        "removeFailed": "No se pudo eliminar la entrada del registro"
+      }
+    },
     "localMode": {
       "title": "Modo local",
       "intro": "Ajustes del ejecutor de contenedores local, almacenados en el despliegue de esta máquina (reemplazó las variables de entorno {poolVars} / {harnessVars}). Guardar redimensiona el grupo en caliente en vivo, sin necesidad de reiniciar; las ejecuciones en curso conservan el contenedor que ya tienen.",

package/i18n/locales/fr.json

@@ -501,6 +501,12 @@
           "failed": "Échec",
           "stopped": "Non démarré"
         }
+      },
+      "resolved": {
+        "title": "Résolution actuelle",
+        "duplicateWarning": "Utilisé sur plusieurs liaisons, seule la dernière s'applique : {vars}.",
+        "serviceOffline": "{service} : aucun environnement actif (simulé)",
+        "mock": "Mock (WireMock)"
       }
     },
     "serviceConnections": {
@@ -1438,6 +1444,7 @@
         "documents": "Documents",
         "taskTrackers": "Outils de suivi des tâches",
         "observability": "Observabilité",
+        "development": "Développement",
         "personal": "Personnel (vous uniquement)"
       },
       "items": {
@@ -1475,6 +1482,10 @@
           "label": "Santé après publication",
           "description": "Surveillez les moniteurs et les SLO après la publication d'une version (Datadog)."
         },
+        "packageRegistries": {
+          "label": "Registres de paquets privés",
+          "description": "Jetons npm et GitHub Packages que les agents utilisent pour installer les dépendances privées."
+        },
         "githubPat": {
           "label": "Mon jeton GitHub",
           "description": "Un jeton d'accès personnel utilisé pour les exécutions que vous lancez (pushes, PR, CI, fusion)."
@@ -1854,6 +1865,31 @@
       "connectionNoun": "la connexion d’observabilité",
       "incidentNoun": "le fournisseur d’incidents"
     },
+    "packageRegistries": {
+      "title": "Registres de paquets privés",
+      "intro": "Connectez les registres privés depuis lesquels vos dépôts installent leurs dépendances. Les agents les reçoivent lors du checkout d'un dépôt, afin que les dépendances privées se résolvent pendant l'installation. Les jetons sont en écriture seule : pour en changer un, supprimez l'entrée puis ajoutez-la de nouveau.",
+      "entryNoun": "entrée de registre",
+      "list": {
+        "heading": "Registres connectés",
+        "tokenTail": "jeton …{tail}",
+        "remove": "Supprimer l'entrée"
+      },
+      "add": {
+        "heading": "Ajouter un registre",
+        "vendor": "Registre",
+        "host": "Le jeton n'est envoyé qu'à {host}.",
+        "scopes": "Portées de paquets",
+        "scopesHelp": "Portées npm séparées par des virgules",
+        "token": "Jeton d'accès",
+        "save": "Ajouter le registre"
+      },
+      "toast": {
+        "loadFailed": "Impossible de charger les registres de paquets",
+        "added": "Registre ajouté",
+        "addFailed": "Impossible d'ajouter le registre",
+        "removeFailed": "Impossible de supprimer l'entrée du registre"
+      }
+    },
     "localMode": {
       "title": "Mode local",
       "intro": "Réglage de l'exécuteur de conteneurs local, stocké sur le déploiement de cette machine (il a remplacé les variables d'environnement {poolVars} / {harnessVars}). L'enregistrement redimensionne le pool à chaud en direct, sans redémarrage nécessaire; les exécutions en cours conservent le conteneur qu'elles détiennent déjà.",

package/i18n/locales/he.json

@@ -501,6 +501,12 @@
           "failed": "נכשל",
           "stopped": "לא פועל"
         }
+      },
+      "resolved": {
+        "title": "מתפרש כעת אל",
+        "duplicateWarning": "בשימוש ביותר מקישור אחד, ולכן רק האחרון חל: {vars}.",
+        "serviceOffline": "{service}: אין סביבה פעילה (מדומה)",
+        "mock": "Mock (WireMock)"
       }
     },
     "serviceConnections": {
@@ -1438,6 +1444,7 @@
         "documents": "מסמכים",
         "taskTrackers": "עוקבי משימות",
         "observability": "תצפיתיות",
+        "development": "פיתוח",
         "personal": "אישי (רק אתה)"
       },
       "items": {
@@ -1475,6 +1482,10 @@
           "label": "בריאות לאחר שחרור",
           "description": "עקוב אחר מוניטורים ו-SLO לאחר שחרור גרסה (Datadog)."
         },
+        "packageRegistries": {
+          "label": "מאגרי חבילות פרטיים",
+          "description": "אסימוני npm ו-GitHub Packages שסוכנים משתמשים בהם להתקנת תלויות פרטיות."
+        },
         "githubPat": {
           "label": "אסימון ה-GitHub שלי",
           "description": "אסימון גישה אישי המשמש להרצות שאתה מתחיל (דחיפות, PR, CI, מיזוג)."
@@ -1974,6 +1985,31 @@
       "connectionNoun": "חיבור התצפיתיות",
       "incidentNoun": "ספק התקריות"
     },
+    "packageRegistries": {
+      "title": "מאגרי חבילות פרטיים",
+      "intro": "חברו את המאגרים הפרטיים שמהם הריפוזיטוריים שלכם מתקינים. הסוכנים מקבלים אותם בעת משיכת ריפוזיטורי, כך שתלויות פרטיות נפתרות בזמן ההתקנה. האסימונים הם לכתיבה בלבד: כדי לשנות אסימון, הסירו את הרשומה והוסיפו אותה מחדש.",
+      "entryNoun": "רשומת מאגר",
+      "list": {
+        "heading": "מאגרים מחוברים",
+        "tokenTail": "אסימון …{tail}",
+        "remove": "הסרת רשומה"
+      },
+      "add": {
+        "heading": "הוספת מאגר",
+        "vendor": "מאגר",
+        "host": "האסימון נשלח רק אל {host}.",
+        "scopes": "היקפי חבילות",
+        "scopesHelp": "היקפי npm מופרדים בפסיקים",
+        "token": "אסימון גישה",
+        "save": "הוספת מאגר"
+      },
+      "toast": {
+        "loadFailed": "טעינת מאגרי החבילות נכשלה",
+        "added": "המאגר נוסף",
+        "addFailed": "הוספת המאגר נכשלה",
+        "removeFailed": "הסרת רשומת המאגר נכשלה"
+      }
+    },
     "localMode": {
       "title": "מצב מקומי",
       "intro": "כוונון עבור מריץ הקונטיינרים המקומי, נשמר בפריסה של מכונה זו (הוא החליף את משתני הסביבה {poolVars} / {harnessVars}). שמירה משנה את גודל המאגר החם בזמן אמת, ללא צורך באתחול מחדש; הרצות פעילות שומרות את הקונטיינר שהן כבר מחזיקות.",

package/i18n/locales/ja.json

@@ -501,6 +501,12 @@
           "failed": "失敗",
           "stopped": "停止中"
         }
+      },
+      "resolved": {
+        "title": "現在の解決先",
+        "duplicateWarning": "複数のバインディングで使用されているため、最後のもののみが適用されます: {vars}。",
+        "serviceOffline": "{service}: 稼働環境なし（モック）",
+        "mock": "モック (WireMock)"
       }
     },
     "serviceConnections": {
@@ -1438,6 +1444,7 @@
         "documents": "ドキュメント",
         "taskTrackers": "タスクトラッカー",
         "observability": "オブザーバビリティ",
+        "development": "開発",
         "personal": "個人（あなたのみ）"
       },
       "items": {
@@ -1475,6 +1482,10 @@
           "label": "リリース後のヘルス",
           "description": "リリース後にモニターと SLO を監視します (Datadog)。"
         },
+        "packageRegistries": {
+          "label": "プライベートパッケージレジストリ",
+          "description": "エージェントがプライベート依存関係のインストールに使う npm と GitHub Packages のトークン。"
+        },
         "githubPat": {
           "label": "マイ GitHub トークン",
           "description": "自分が開始した実行 (push、PR、CI、マージ) に使用するパーソナルアクセストークン。"
@@ -1976,6 +1987,31 @@
       "connectionNoun": "オブザーバビリティ接続",
       "incidentNoun": "インシデントプロバイダー"
     },
+    "packageRegistries": {
+      "title": "プライベートパッケージレジストリ",
+      "intro": "リポジトリが依存関係をインストールするプライベートレジストリを接続します。エージェントはリポジトリのチェックアウト時にこれらを受け取り、インストール時にプライベート依存関係を解決できます。トークンは書き込み専用です。変更するにはエントリを削除してから追加し直してください。",
+      "entryNoun": "レジストリエントリ",
+      "list": {
+        "heading": "接続済みのレジストリ",
+        "tokenTail": "トークン …{tail}",
+        "remove": "エントリを削除"
+      },
+      "add": {
+        "heading": "レジストリを追加",
+        "vendor": "レジストリ",
+        "host": "トークンは {host} にのみ送信されます。",
+        "scopes": "パッケージスコープ",
+        "scopesHelp": "カンマ区切りの npm スコープ",
+        "token": "アクセストークン",
+        "save": "レジストリを追加"
+      },
+      "toast": {
+        "loadFailed": "パッケージレジストリを読み込めませんでした",
+        "added": "レジストリを追加しました",
+        "addFailed": "レジストリを追加できませんでした",
+        "removeFailed": "レジストリエントリを削除できませんでした"
+      }
+    },
     "localMode": {
       "title": "ローカルモード",
       "intro": "ローカルコンテナランナーの調整設定で、このマシンのデプロイに保存されます ({poolVars} / {harnessVars} 環境変数を置き換えました)。保存するとウォームプールがライブでサイズ変更され、再起動は不要です。実行中のランは、すでに保持しているコンテナをそのまま使います。",

package/i18n/locales/pl.json

@@ -501,6 +501,12 @@
           "failed": "Błąd",
           "stopped": "Nie uruchomiono"
         }
+      },
+      "resolved": {
+        "title": "Rozwiązuje się na",
+        "duplicateWarning": "Użyte w więcej niż jednym powiązaniu, więc obowiązuje tylko ostatnie: {vars}.",
+        "serviceOffline": "{service}: brak działającego środowiska (zamockowane)",
+        "mock": "Mock (WireMock)"
       }
     },
     "serviceConnections": {
@@ -1438,6 +1444,7 @@
         "documents": "Dokumenty",
         "taskTrackers": "Narzędzia do śledzenia zadań",
         "observability": "Obserwowalność",
+        "development": "Programowanie",
         "personal": "Osobiste (tylko Ty)"
       },
       "items": {
@@ -1475,6 +1482,10 @@
           "label": "Kondycja po wydaniu",
           "description": "Obserwuj monitory i SLO po wdrożeniu wydania (Datadog)."
         },
+        "packageRegistries": {
+          "label": "Prywatne rejestry pakietów",
+          "description": "Tokeny npm i GitHub Packages, których agenci używają do instalowania prywatnych zależności."
+        },
         "githubPat": {
           "label": "Mój token GitHub",
           "description": "Osobisty token dostępu używany do uruchomień, które rozpoczynasz (pushe, PR-y, CI, scalanie)."
@@ -1854,6 +1865,31 @@
       "connectionNoun": "połączenie obserwowalności",
       "incidentNoun": "dostawcę incydentów"
     },
+    "packageRegistries": {
+      "title": "Prywatne rejestry pakietów",
+      "intro": "Połącz prywatne rejestry, z których instalują Twoje repozytoria. Agenci otrzymują je przy pobieraniu repozytorium, dzięki czemu prywatne zależności rozwiązują się podczas instalacji. Tokeny są tylko do zapisu: aby zmienić token, usuń wpis i dodaj go ponownie.",
+      "entryNoun": "wpis rejestru",
+      "list": {
+        "heading": "Połączone rejestry",
+        "tokenTail": "token …{tail}",
+        "remove": "Usuń wpis"
+      },
+      "add": {
+        "heading": "Dodaj rejestr",
+        "vendor": "Rejestr",
+        "host": "Token jest wysyłany tylko do {host}.",
+        "scopes": "Zakresy pakietów",
+        "scopesHelp": "Zakresy npm oddzielone przecinkami",
+        "token": "Token dostępu",
+        "save": "Dodaj rejestr"
+      },
+      "toast": {
+        "loadFailed": "Nie udało się wczytać rejestrów pakietów",
+        "added": "Rejestr dodany",
+        "addFailed": "Nie udało się dodać rejestru",
+        "removeFailed": "Nie udało się usunąć wpisu rejestru"
+      }
+    },
     "localMode": {
       "title": "Tryb lokalny",
       "intro": "Strojenie lokalnego uruchamiacza kontenerów, przechowywane we wdrożeniu tej maszyny (zastąpiło zmienne środowiskowe {poolVars} / {harnessVars}). Zapisanie zmienia rozmiar ciepłej puli na żywo, bez potrzeby restartu; trwające uruchomienia zachowują kontener, który już mają.",

package/i18n/locales/tr.json

@@ -501,6 +501,12 @@
           "failed": "Başarısız",
           "stopped": "Başlatılmadı"
         }
+      },
+      "resolved": {
+        "title": "Şu anda çözümleniyor",
+        "duplicateWarning": "Birden fazla bağlamada kullanılıyor, bu yüzden yalnızca sonuncusu geçerli: {vars}.",
+        "serviceOffline": "{service}: çalışan ortam yok (taklit ediliyor)",
+        "mock": "Mock (WireMock)"
       }
     },
     "serviceConnections": {
@@ -1438,6 +1444,7 @@
         "documents": "Belgeler",
         "taskTrackers": "Görev izleyiciler",
         "observability": "Gözlemlenebilirlik",
+        "development": "Geliştirme",
         "personal": "Kişisel (yalnızca siz)"
       },
       "items": {
@@ -1475,6 +1482,10 @@
           "label": "Sürüm sonrası sağlık",
           "description": "Bir sürüm yayınlandıktan sonra monitörleri ve SLO'ları izleyin (Datadog)."
         },
+        "packageRegistries": {
+          "label": "Özel paket kayıt defterleri",
+          "description": "Aracıların özel bağımlılıkları yüklemek için kullandığı npm ve GitHub Packages token'ları."
+        },
         "githubPat": {
           "label": "GitHub token'ım",
           "description": "Başlattığınız çalıştırmalar için kullanılan kişisel erişim token'ı (push'lar, PR'lar, CI, birleştirme)."
@@ -1976,6 +1987,31 @@
       "connectionNoun": "gözlemlenebilirlik bağlantısı",
       "incidentNoun": "olay sağlayıcısı"
     },
+    "packageRegistries": {
+      "title": "Özel paket kayıt defterleri",
+      "intro": "Depolarınızın yükleme yaptığı özel kayıt defterlerini bağlayın. Aracılar bir depoyu çekerken bunları alır, böylece özel bağımlılıklar yükleme sırasında çözülür. Token'lar yalnızca yazılırdır: birini değiştirmek için girdiyi silin ve yeniden ekleyin.",
+      "entryNoun": "kayıt defteri girdisi",
+      "list": {
+        "heading": "Bağlı kayıt defterleri",
+        "tokenTail": "token …{tail}",
+        "remove": "Girdiyi kaldır"
+      },
+      "add": {
+        "heading": "Kayıt defteri ekle",
+        "vendor": "Kayıt defteri",
+        "host": "Token yalnızca {host} adresine gönderilir.",
+        "scopes": "Paket kapsamları",
+        "scopesHelp": "Virgülle ayrılmış npm kapsamları",
+        "token": "Erişim token'ı",
+        "save": "Kayıt defteri ekle"
+      },
+      "toast": {
+        "loadFailed": "Paket kayıt defterleri yüklenemedi",
+        "added": "Kayıt defteri eklendi",
+        "addFailed": "Kayıt defteri eklenemedi",
+        "removeFailed": "Kayıt defteri girdisi kaldırılamadı"
+      }
+    },
     "localMode": {
       "title": "Yerel mod",
       "intro": "Yerel konteyner çalıştırıcısı için ayarlar, bu makinenin dağıtımında saklanır ({poolVars} / {harnessVars} ortam değişkenlerinin yerini aldı). Kaydetmek sıcak havuzu anında yeniden boyutlandırır, yeniden başlatma gerekmez; devam eden çalıştırmalar zaten tuttukları konteyneri korur.",

package/i18n/locales/uk.json

@@ -501,6 +501,12 @@
           "failed": "Помилка",
           "stopped": "Не запущено"
         }
+      },
+      "resolved": {
+        "title": "Розв'язується як",
+        "duplicateWarning": "Використано в кількох прив'язках, тож застосовується лише остання: {vars}.",
+        "serviceOffline": "{service}: немає активного середовища (мок)",
+        "mock": "Mock (WireMock)"
       }
     },
     "serviceConnections": {
@@ -1438,6 +1444,7 @@
         "documents": "Документи",
         "taskTrackers": "Трекери завдань",
         "observability": "Спостережуваність",
+        "development": "Розробка",
         "personal": "Особисте (лише ви)"
       },
       "items": {
@@ -1475,6 +1482,10 @@
           "label": "Стан після випуску",
           "description": "Стежте за моніторами й SLO після випуску версії (Datadog)."
         },
+        "packageRegistries": {
+          "label": "Приватні реєстри пакетів",
+          "description": "Токени npm і GitHub Packages, які агенти використовують для встановлення приватних залежностей."
+        },
         "githubPat": {
           "label": "Мій токен GitHub",
           "description": "Особистий токен доступу, який використовується для запусків, що ви розпочинаєте (pushes, PR-и, CI, злиття)."
@@ -1854,6 +1865,31 @@
       "connectionNoun": "з’єднання спостережуваності",
       "incidentNoun": "постачальника інцидентів"
     },
+    "packageRegistries": {
+      "title": "Приватні реєстри пакетів",
+      "intro": "Підключіть приватні реєстри, з яких встановлюють ваші репозиторії. Агенти отримують їх під час отримання репозиторію, тож приватні залежності розв'язуються під час встановлення. Токени доступні лише для запису: щоб змінити токен, видаліть запис і додайте його знову.",
+      "entryNoun": "запис реєстру",
+      "list": {
+        "heading": "Підключені реєстри",
+        "tokenTail": "токен …{tail}",
+        "remove": "Видалити запис"
+      },
+      "add": {
+        "heading": "Додати реєстр",
+        "vendor": "Реєстр",
+        "host": "Токен надсилається лише до {host}.",
+        "scopes": "Скоупи пакетів",
+        "scopesHelp": "Скоупи npm через кому",
+        "token": "Токен доступу",
+        "save": "Додати реєстр"
+      },
+      "toast": {
+        "loadFailed": "Не вдалося завантажити реєстри пакетів",
+        "added": "Реєстр додано",
+        "addFailed": "Не вдалося додати реєстр",
+        "removeFailed": "Не вдалося видалити запис реєстру"
+      }
+    },
     "localMode": {
       "title": "Локальний режим",
       "intro": "Налаштування локального запускача контейнерів, збережене на розгортанні цієї машини (воно замінило змінні середовища {poolVars} / {harnessVars}). Збереження змінює розмір теплого пулу наживо, без потреби в перезапуску; поточні запуски зберігають контейнер, який вони вже утримують.",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cat-factory/app",
-  "version": "0.77.0",
+  "version": "0.78.0",
   "description": "Reusable Nuxt layer for the Agent Architecture Board SPA (components, stores, composables, pages). Consume it from a thin deployment app via `extends: ['@cat-factory/app']` and point it at your backend with NUXT_PUBLIC_API_BASE. See deploy/frontend for an example.",
   "repository": {
     "type": "git",
@@ -34,7 +34,7 @@
     "valibot": "^1.4.2",
     "vue": "^3.5.39",
     "wretch": "^3.0.9",
-    "@cat-factory/contracts": "0.83.0"
+    "@cat-factory/contracts": "0.84.0"
   },
   "devDependencies": {
     "@toad-contracts/testing": "0.3.2",