@camstack/system 1.2.436 → 1.2.438

package/dist/builtins/local-auth/local-auth.addon.mjs

@@ -1,8 +1,8 @@
 import { i as __require, o as __toESM, t as __commonJSMin } from "../../chunk-CNf5ZN-e.mjs";
-import { At as deviceCredentialsCapability, C as DEVICE_ENROLLMENT_TTL_MS, G as ScopedTokenSchema, Gt as formatDeviceRevoker, K as SsoBridgeClaimsSchema, Qn as userManagementCapability, Z as UserRecordSchema, a as ApiKeyRecordSchema, ct as buildDeviceSignatureMessage, nt as authProviderCapability, st as buildDeviceEnrollmentLink, w as DEVICE_NONCE_TTL_MS, xr as BaseAddon } from "../../dist-DjD2M79P.mjs";
+import { E as DEVICE_NONCE_TTL_MS, J as ScopedTokenSchema, Or as BaseAddon, Pt as deviceCredentialsCapability, T as DEVICE_ENROLLMENT_TTL_MS, X as SsoBridgeClaimsSchema, Yt as formatDeviceRevoker, a as ApiKeyRecordSchema, ar as userManagementCapability, dt as buildDeviceEnrollmentLink, ft as buildDeviceSignatureMessage, ot as authProviderCapability, tt as UserRecordSchema, vi as userError } from "../../dist-Dc8GKC5H.mjs";
 import { t as require_safe_buffer } from "../../safe-buffer-B1OjL1I9.mjs";
 import { t as require_ms } from "../../ms-CgH2OFlD.mjs";
-import { _ as setProcessJwtSigningKey, a as importDevicePublicKey, c as rebuildDeviceCaCertificate, d as JWT_SIGNING_KEY_REF, g as processJwtSigningKey, h as loadJwtSigningKey, i as generateDeviceCa, l as verifyDeviceLeaf, m as getProcessJwtSigningKeyState, n as DEVICE_CA_KEY_REF, o as issueDeviceLeaf, r as DEVICE_CA_SETTINGS_SECTION, s as loadDeviceCa, t as DEVICE_CA_FIELD, u as verifyDeviceSignature } from "../../device-ca-BNM5ai4t.mjs";
+import { _ as setProcessJwtSigningKey, a as importDevicePublicKey, c as rebuildDeviceCaCertificate, d as JWT_SIGNING_KEY_REF, g as processJwtSigningKey, h as loadJwtSigningKey, i as generateDeviceCa, l as verifyDeviceLeaf, m as getProcessJwtSigningKeyState, n as DEVICE_CA_KEY_REF, o as issueDeviceLeaf, r as DEVICE_CA_SETTINGS_SECTION, s as loadDeviceCa, t as DEVICE_CA_FIELD, u as verifyDeviceSignature } from "../../device-ca-DvIZjXIl.mjs";
 import * as crypto$1 from "node:crypto";
 import { X509Certificate, createHash, randomUUID, timingSafeEqual } from "node:crypto";
 import nodeCrypto from "crypto";
@@ -6448,6 +6448,33 @@ var ScopedTokenManager = class {
 	}
 };
 //#endregion
+//#region src/auth/session-revocation-bus.ts
+var BUS_KEY = Symbol.for("camstack.login-sessions.revocation-bus");
+function listeners() {
+	const existing = Reflect.get(globalThis, BUS_KEY);
+	if (existing instanceof Set) return existing;
+	const created = /* @__PURE__ */ new Set();
+	Reflect.set(globalThis, BUS_KEY, created);
+	return created;
+}
+/** Subscribe; returns the unsubscribe. */
+function onSessionsRevoked(listener) {
+	const set = listeners();
+	set.add(listener);
+	return () => {
+		set.delete(listener);
+	};
+}
+/** Announce an ended batch. A listener that throws never reaches the revoke. */
+function announceSessionsRevoked(event, onListenerError) {
+	if (event.sessionIds.length === 0 && !event.allOfUser) return;
+	for (const listener of [...listeners()]) try {
+		listener(event);
+	} catch (error) {
+		onListenerError?.(error);
+	}
+}
+//#endregion
 //#region src/auth/login-session-manager.ts
 /**
 * Login sessions — the server-side record behind every session token.
@@ -6797,6 +6824,7 @@ var LoginSessionManager = class {
 			revokedReason: reason
 		};
 		this.replace(session, updated);
+		this.announce([updated.id], session.userId, false, null, reason);
 		await this.persist(updated);
 		return true;
 	}
@@ -6820,6 +6848,7 @@ var LoginSessionManager = class {
 			this.replace(session, updated);
 			ended.push(updated);
 		}
+		this.announce(ended.map((s) => s.id), userId, true, options.exceptSessionId ?? null, options.reason);
 		await this.persistCutoff(userId, at);
 		for (const session of ended) await this.persist(session);
 		return ended.length;
@@ -6838,6 +6867,7 @@ var LoginSessionManager = class {
 			this.replace(session, updated);
 			ended.push(updated);
 		}
+		this.announce(ended.map((s) => s.id), null, false, null, reason);
 		for (const session of ended) await this.persist(session);
 		return ended.length;
 	}
@@ -6863,6 +6893,16 @@ var LoginSessionManager = class {
 		}
 		return dead.length;
 	}
+	/** Tell the hub which sessions just ended — right after the mirror, before the store write. */
+	announce(sessionIds, userId, allOfUser, exceptSessionId, reason) {
+		announceSessionsRevoked({
+			sessionIds,
+			userId,
+			allOfUser,
+			exceptSessionId,
+			reason
+		}, (error) => this.logger?.error("A session-revocation listener threw — the revoke stands", { meta: { error: error instanceof Error ? error.message : String(error) } }));
+	}
 	newRefreshToken() {
 		return `${REFRESH_TOKEN_PREFIX}${crypto$1.randomBytes(32).toString("base64url")}`;
 	}
@@ -7026,9 +7066,9 @@ var AdminTokenManager = class {
 	/** Mint a token for `createdBy`. Refuses an expiry in the past or past 90 days. */
 	async create(input) {
 		const at = this.now();
-		if (!(input.expiresAt > at) || input.expiresAt > at + 7776e6) throw new Error("An admin token must expire within 90 days");
+		if (!(input.expiresAt > at) || input.expiresAt > at + 7776e6) throw userError("system.admin-token-expiry-too-long", void 0, "An admin token must expire within 90 days");
 		const name = input.name.trim().slice(0, 80);
-		if (name.length === 0) throw new Error("An admin token needs a name");
+		if (name.length === 0) throw userError("system.admin-token-name-required", void 0, "An admin token needs a name");
 		const token = `${ADMIN_TOKEN_PREFIX}${crypto$1.randomBytes(32).toString("base64url")}`;
 		const stored = {
 			id: crypto$1.randomUUID(),
@@ -7417,7 +7457,7 @@ var DeviceCredentialManager = class {
 	/** A one-shot code for `userId` (admin path). Returned once; only its hash is kept. */
 	startEnrollment(input) {
 		this.prune();
-		if (this.pendingEnrollments.size >= MAX_PENDING) throw new Error("Too many pending device enrollments — try again shortly");
+		if (this.pendingEnrollments.size >= MAX_PENDING) throw userError("system.device-enrollment-busy", void 0, "Too many pending device enrollments — try again shortly");
 		const code = crypto$1.randomBytes(24).toString("base64url");
 		const expiresAt = this.now() + DEVICE_ENROLLMENT_TTL_MS;
 		this.pendingEnrollments.set(hash(code), {
@@ -7988,7 +8028,7 @@ var UserManager = class {
 		return this.storageAccess.getStore();
 	}
 	async create(input) {
-		if (await this.findByUsername(input.username)) throw new Error(`User with username "${input.username}" already exists`);
+		if (await this.findByUsername(input.username)) throw userError("system.user-exists", { username: String(input.username) }, `User with username "${input.username}" already exists`);
 		const passwordHash = await this.auth.hashPassword(input.password);
 		const now = Date.now();
 		const record = {
@@ -8040,7 +8080,7 @@ var UserManager = class {
 	}
 	async update(id, data) {
 		const existing = await this.findById(id);
-		if (!existing) throw new Error(`User with id "${id}" not found`);
+		if (!existing) throw userError("system.user-not-found", { id: String(id) }, `User with id "${id}" not found`);
 		await this.store.update.mutate({
 			collection: USERS_COLLECTION$1,
 			id,
@@ -8059,7 +8099,7 @@ var UserManager = class {
 	}
 	async resetPassword(id, newPassword) {
 		const existing = await this.findById(id);
-		if (!existing) throw new Error(`User with id "${id}" not found`);
+		if (!existing) throw userError("system.user-not-found", { id: String(id) }, `User with id "${id}" not found`);
 		const passwordHash = await this.auth.hashPassword(newPassword);
 		await this.store.update.mutate({
 			collection: USERS_COLLECTION$1,
@@ -11726,7 +11766,7 @@ var LocalAuthAddon = class extends BaseAddon {
 			},
 			confirmTotp: async (input) => {
 				if (!this.totpManager) throw new Error("TOTP management not available");
-				if (!await this.totpManager.confirm(input.userId, input.code)) throw new Error("TOTP confirmation failed — code did not match");
+				if (!await this.totpManager.confirm(input.userId, input.code)) throw userError("auth.totp-confirm-failed", void 0, "TOTP confirmation failed — code did not match");
 				return { success: true };
 			},
 			disableTotp: async (input) => {
@@ -11784,7 +11824,7 @@ var LocalAuthAddon = class extends BaseAddon {
 	/** The admin cap (`device-credentials`): list, enroll-by-QR, revoke, rename, settings. */
 	buildDeviceCredentialsProvider() {
 		const manager = () => {
-			if (this.deviceCredentials === null) throw new Error("Device credentials not available");
+			if (this.deviceCredentials === null) throw userError("device.credentials-unavailable", void 0, "Device credentials not available");
 			return this.deviceCredentials;
 		};
 		const hubOrigins = async () => {
@@ -11836,7 +11876,7 @@ var LocalAuthAddon = class extends BaseAddon {
 			},
 			revokeDeviceCredential: async (input) => {
 				const record = manager().get(input.id);
-				if (record === void 0) throw new Error(`Device credential not found: ${input.id}`);
+				if (record === void 0) throw userError("device.credential-not-found", { id: input.id }, `Device credential not found: ${input.id}`);
 				const revoked = await manager().revoke(input.id, formatDeviceRevoker({
 					kind: "admin",
 					userId: input.caller.userId
@@ -11907,7 +11947,7 @@ var LocalAuthAddon = class extends BaseAddon {
 			return this.loginSessions;
 		};
 		const devices = () => {
-			if (this.deviceCredentials === null) throw new Error("Device credentials not available");
+			if (this.deviceCredentials === null) throw userError("device.credentials-unavailable", void 0, "Device credentials not available");
 			return this.deviceCredentials;
 		};
 		return {
@@ -12061,4 +12101,4 @@ var LocalAuthAddon = class extends BaseAddon {
 	}
 };
 //#endregion
-export { LocalAuthAddon, LocalAuthAddon as default, AuthManager as _, attachUserManagementInternal as a, isSettingsReadUnavailable as b, DeviceCredentialManager as c, ADMIN_TOKEN_MAX_LIFETIME_MS as d, ADMIN_TOKEN_PREFIX as f, ScopedTokenManager as g, REFRESH_TOKEN_PREFIX as h, USER_MANAGEMENT_INTERNAL as i, PREVIOUS_LEAF_GRACE_MS as l, LoginSessionManager as m, FIRST_BOOT_ADMIN_USERNAME as n, getUserManagementInternal as o, AdminTokenManager as p, UserManager as r, AuthAuditLog as s, FIRST_BOOT_ADMIN_PASSWORD as t, DeviceCaStore as u, parseTokenExpiry as v, ApiKeyManager as x, SettingsReadUnavailableError as y };
+export { LocalAuthAddon, LocalAuthAddon as default, ApiKeyManager as S, ScopedTokenManager as _, attachUserManagementInternal as a, SettingsReadUnavailableError as b, DeviceCredentialManager as c, ADMIN_TOKEN_MAX_LIFETIME_MS as d, ADMIN_TOKEN_PREFIX as f, onSessionsRevoked as g, REFRESH_TOKEN_PREFIX as h, USER_MANAGEMENT_INTERNAL as i, PREVIOUS_LEAF_GRACE_MS as l, LoginSessionManager as m, FIRST_BOOT_ADMIN_USERNAME as n, getUserManagementInternal as o, AdminTokenManager as p, UserManager as r, AuthAuditLog as s, FIRST_BOOT_ADMIN_PASSWORD as t, DeviceCaStore as u, AuthManager as v, isSettingsReadUnavailable as x, parseTokenExpiry as y };

package/dist/builtins/local-network/local-network.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DVe0Nsp8.js");
+const require_dist = require("../../dist-GgG-7amw.js");
 const require_hub_mdns_ciao = require("../../hub-mdns-ciao-CBLvq2oj.js");
 let zod = require("zod");
 let node_net = require("node:net");
@@ -953,13 +953,16 @@ var LocalNetworkAddon = class extends require_dist.BaseAddon {
 		return this.schema({ sections: [{
 			id: "local-access",
 			title: "LAN HTTP",
+			titleKey: "server:globalSettings.s_local-access.title",
 			description: "Native apps on this Wi-Fi use http:// and skip the private certificate. The tunnel and this admin UI stay on HTTPS. Turn off once a publicly-trusted certificate covers the LAN name.",
+			descriptionKey: "server:globalSettings.s_local-access.description",
 			columns: 1,
 			fields: [
 				this.field({
 					type: "boolean",
 					key: "httpEnabled",
 					label: "Enable HTTP on the LAN",
+					labelKey: "server:globalSettings.s_local-access.httpEnabled.label",
 					style: "switch",
 					default: true
 				}),
@@ -967,7 +970,9 @@ var LocalNetworkAddon = class extends require_dist.BaseAddon {
 					type: "number",
 					key: "httpPort",
 					label: "HTTP port",
+					labelKey: "server:globalSettings.s_local-access.httpPort.label",
 					description: "Dedicated listener. Must not equal the HTTPS port (4443 by default).",
+					descriptionKey: "server:globalSettings.s_local-access.httpPort.description",
 					min: 1,
 					max: 65535,
 					step: 1,
@@ -981,7 +986,9 @@ var LocalNetworkAddon = class extends require_dist.BaseAddon {
 					type: "boolean",
 					key: "mdnsAdvertise",
 					label: "Announce this hub on the LAN (mDNS)",
+					labelKey: "server:globalSettings.s_local-access.mdnsAdvertise.label",
 					description: "Lets `camstack login` find the hub without an address. Advertises only the HTTPS address, never a secret. Needs UDP 5353 multicast to reach the LAN (host networking or a dedicated container IP).",
+					descriptionKey: "server:globalSettings.s_local-access.mdnsAdvertise.description",
 					style: "switch",
 					default: true
 				}),
@@ -989,7 +996,9 @@ var LocalNetworkAddon = class extends require_dist.BaseAddon {
 					type: "text",
 					key: "localHostname",
 					label: "Local hostname",
+					labelKey: "server:globalSettings.s_local-access.localHostname.label",
 					description: "Advertised to the viewer instead of the raw LAN IP, and added to the certificate SAN. Requires this name to resolve on the LAN (router DNS, mDNS, or a hosts file). Leave empty to keep using the IP.",
+					descriptionKey: "server:globalSettings.s_local-access.localHostname.description",
 					maxLength: 253,
 					placeholder: "camstack.lan"
 				})

package/dist/builtins/local-network/local-network.addon.mjs

@@ -1,8 +1,8 @@
-import { An as resolveAppConnections, B as NetworkTunnelStartedDataSchema, Cn as pickAppLinkHub, Jt as isAppLinkBase, Ln as resolveNotificationTapAddress, M as HUB_MDNS_SERVICE_TYPE, N as HUB_MDNS_TXT_KEYS, Pn as resolveHubAddressRoles, Zt as isDefaultAppConnectionEndpoint, di as EventCategory, er as validateCustomAddress, l as CAMSTACK_APP_LINK_ORIGIN, pt as checkRoleAddress, sn as localNetworkCapability, xr as BaseAddon } from "../../dist-DjD2M79P.mjs";
-import { C as DEFAULT_LAN_HTTP_PORT, O as readLanHttpState, T as applyLanHttp, a as storeUploadedCertificate, b as ensureTlsCert, d as servedHttpsLeafFingerprint, g as readTlsMode, h as readTlsAccessStatus, i as revertToGeneratedCertificate, m as readExtraSans, n as applyCertificateToListener, r as regenerateCertificate, t as createCiaoPublisher, v as writeExtraSans } from "../../hub-mdns-ciao-DJRwtlA8.mjs";
+import { $t as isAppLinkBase, F as HUB_MDNS_SERVICE_TYPE, Fn as resolveAppConnections, Hn as resolveNotificationTapAddress, I as HUB_MDNS_TXT_KEYS, On as pickAppLinkHub, Or as BaseAddon, U as NetworkTunnelStartedDataSchema, _t as checkRoleAddress, fn as localNetworkCapability, l as CAMSTACK_APP_LINK_ORIGIN, nn as isDefaultAppConnectionEndpoint, sr as validateCustomAddress, yi as EventCategory, zn as resolveHubAddressRoles } from "../../dist-Dc8GKC5H.mjs";
+import { C as DEFAULT_LAN_HTTP_PORT, O as readLanHttpState, T as applyLanHttp, a as storeUploadedCertificate, b as ensureTlsCert, d as servedHttpsLeafFingerprint, g as readTlsMode, h as readTlsAccessStatus, i as revertToGeneratedCertificate, m as readExtraSans, n as applyCertificateToListener, r as regenerateCertificate, t as createCiaoPublisher, v as writeExtraSans } from "../../hub-mdns-ciao-DMlQTdPU.mjs";
 import { z } from "zod";
 import { isIP } from "node:net";
-import * as os from "node:os";
+import * as os$1 from "node:os";
 import { readFileSync } from "node:fs";
 //#region src/builtins/local-network/address-book.ts
 /**
@@ -950,13 +950,16 @@ var LocalNetworkAddon = class extends BaseAddon {
 		return this.schema({ sections: [{
 			id: "local-access",
 			title: "LAN HTTP",
+			titleKey: "server:globalSettings.s_local-access.title",
 			description: "Native apps on this Wi-Fi use http:// and skip the private certificate. The tunnel and this admin UI stay on HTTPS. Turn off once a publicly-trusted certificate covers the LAN name.",
+			descriptionKey: "server:globalSettings.s_local-access.description",
 			columns: 1,
 			fields: [
 				this.field({
 					type: "boolean",
 					key: "httpEnabled",
 					label: "Enable HTTP on the LAN",
+					labelKey: "server:globalSettings.s_local-access.httpEnabled.label",
 					style: "switch",
 					default: true
 				}),
@@ -964,7 +967,9 @@ var LocalNetworkAddon = class extends BaseAddon {
 					type: "number",
 					key: "httpPort",
 					label: "HTTP port",
+					labelKey: "server:globalSettings.s_local-access.httpPort.label",
 					description: "Dedicated listener. Must not equal the HTTPS port (4443 by default).",
+					descriptionKey: "server:globalSettings.s_local-access.httpPort.description",
 					min: 1,
 					max: 65535,
 					step: 1,
@@ -978,7 +983,9 @@ var LocalNetworkAddon = class extends BaseAddon {
 					type: "boolean",
 					key: "mdnsAdvertise",
 					label: "Announce this hub on the LAN (mDNS)",
+					labelKey: "server:globalSettings.s_local-access.mdnsAdvertise.label",
 					description: "Lets `camstack login` find the hub without an address. Advertises only the HTTPS address, never a secret. Needs UDP 5353 multicast to reach the LAN (host networking or a dedicated container IP).",
+					descriptionKey: "server:globalSettings.s_local-access.mdnsAdvertise.description",
 					style: "switch",
 					default: true
 				}),
@@ -986,7 +993,9 @@ var LocalNetworkAddon = class extends BaseAddon {
 					type: "text",
 					key: "localHostname",
 					label: "Local hostname",
+					labelKey: "server:globalSettings.s_local-access.localHostname.label",
 					description: "Advertised to the viewer instead of the raw LAN IP, and added to the certificate SAN. Requires this name to resolve on the LAN (router DNS, mDNS, or a hosts file). Leave empty to keep using the IP.",
+					descriptionKey: "server:globalSettings.s_local-access.localHostname.description",
 					maxLength: 253,
 					placeholder: "camstack.lan"
 				})
@@ -1186,7 +1195,7 @@ var LocalNetworkAddon = class extends BaseAddon {
 		}
 	}
 	enumerate() {
-		return enumerateOsInterfaces(os.networkInterfaces(), readLinuxIpv6Flags());
+		return enumerateOsInterfaces(os$1.networkInterfaces(), readLinuxIpv6Flags());
 	}
 	/**
 	* Replace rotated IPv6 and drop addresses that no longer exist, without

package/dist/builtins/loki-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DVe0Nsp8.js");
+const require_dist = require("../../dist-GgG-7amw.js");
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label
@@ -458,14 +458,18 @@ var LokiLoggingAddon = class extends require_dist.BaseAddon {
 		return this.schema({ sections: [{
 			id: "loki-logging",
 			title: "Loki",
+			titleKey: "server:globalSettings.s_loki-logging.title",
 			description: "Ship this node’s logs to a Grafana Loki instance. Independent of the rotated-file and console destinations. Turn it on or off with the Enable/Disable control on this destination — the same one every other destination uses.",
+			descriptionKey: "server:globalSettings.s_loki-logging.description",
 			columns: 2,
 			fields: [
 				this.field({
 					type: "text",
 					key: "url",
 					label: "Loki URL",
+					labelKey: "server:globalSettings.s_loki-logging.url.label",
 					description: "Base URL, e.g. http://loki:3100 — the /loki/api/v1/push path is added.",
+					descriptionKey: "server:globalSettings.s_loki-logging.url.description",
 					placeholder: "http://loki:3100",
 					default: ""
 				}),
@@ -473,23 +477,28 @@ var LokiLoggingAddon = class extends require_dist.BaseAddon {
 					type: "select",
 					key: "level",
 					label: "Minimum level",
+					labelKey: "server:globalSettings.s_loki-logging.level.label",
 					default: "info",
 					options: [
 						{
 							value: "debug",
-							label: "Debug"
+							label: "Debug",
+							labelKey: "server:globalSettings.s_loki-logging.level.o_debug.label"
 						},
 						{
 							value: "info",
-							label: "Info"
+							label: "Info",
+							labelKey: "server:globalSettings.s_loki-logging.level.o_info.label"
 						},
 						{
 							value: "warn",
-							label: "Warn"
+							label: "Warn",
+							labelKey: "server:globalSettings.s_loki-logging.level.o_warn.label"
 						},
 						{
 							value: "error",
-							label: "Error"
+							label: "Error",
+							labelKey: "server:globalSettings.s_loki-logging.level.o_error.label"
 						}
 					]
 				}),
@@ -497,14 +506,18 @@ var LokiLoggingAddon = class extends require_dist.BaseAddon {
 					type: "text",
 					key: "job",
 					label: "Job label",
+					labelKey: "server:globalSettings.s_loki-logging.job.label",
 					description: "The Loki `job` label. Keep it fixed — labels are indexed.",
+					descriptionKey: "server:globalSettings.s_loki-logging.job.description",
 					default: "camstack"
 				}),
 				this.field({
 					type: "text",
 					key: "extraLabels",
 					label: "Extra labels",
+					labelKey: "server:globalSettings.s_loki-logging.extraLabels.label",
 					description: "Static `key=value,key2=value2`. Low-cardinality only: per-entry values belong in the line body, and a high-cardinality label will bring Loki down.",
+					descriptionKey: "server:globalSettings.s_loki-logging.extraLabels.description",
 					placeholder: "env=home,site=garage",
 					default: ""
 				}),
@@ -512,27 +525,34 @@ var LokiLoggingAddon = class extends require_dist.BaseAddon {
 					type: "text",
 					key: "tenantId",
 					label: "Tenant ID",
+					labelKey: "server:globalSettings.s_loki-logging.tenantId.label",
 					description: "Sent as X-Scope-OrgID. Required by Grafana Cloud and multi-tenant Loki.",
+					descriptionKey: "server:globalSettings.s_loki-logging.tenantId.description",
 					default: ""
 				}),
 				this.field({
 					type: "text",
 					key: "username",
 					label: "Username",
+					labelKey: "server:globalSettings.s_loki-logging.username.label",
 					description: "HTTP basic auth. Leave empty for none.",
+					descriptionKey: "server:globalSettings.s_loki-logging.username.description",
 					default: ""
 				}),
 				this.field({
 					type: "password",
 					key: "password",
 					label: "Password",
+					labelKey: "server:globalSettings.s_loki-logging.password.label",
 					default: ""
 				}),
 				this.field({
 					type: "number",
 					key: "batchIntervalMs",
 					label: "Flush interval",
+					labelKey: "server:globalSettings.s_loki-logging.batchIntervalMs.label",
 					description: "How often a partial batch is pushed.",
+					descriptionKey: "server:globalSettings.s_loki-logging.batchIntervalMs.description",
 					min: 250,
 					max: 6e4,
 					step: 250,
@@ -543,7 +563,9 @@ var LokiLoggingAddon = class extends require_dist.BaseAddon {
 					type: "number",
 					key: "batchSize",
 					label: "Batch size",
+					labelKey: "server:globalSettings.s_loki-logging.batchSize.label",
 					description: "Push early once this many entries are queued.",
+					descriptionKey: "server:globalSettings.s_loki-logging.batchSize.description",
 					min: 1,
 					max: 5e3,
 					step: 10,
@@ -553,6 +575,7 @@ var LokiLoggingAddon = class extends require_dist.BaseAddon {
 					type: "number",
 					key: "timeoutMs",
 					label: "Request timeout",
+					labelKey: "server:globalSettings.s_loki-logging.timeoutMs.label",
 					min: 1e3,
 					max: 6e4,
 					step: 500,

package/dist/builtins/loki-logging/index.mjs

@@ -1,4 +1,4 @@
-import { ln as logDestinationCapability, xr as BaseAddon } from "../../dist-DjD2M79P.mjs";
+import { Or as BaseAddon, mn as logDestinationCapability } from "../../dist-Dc8GKC5H.mjs";
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label
@@ -453,14 +453,18 @@ var LokiLoggingAddon = class extends BaseAddon {
 		return this.schema({ sections: [{
 			id: "loki-logging",
 			title: "Loki",
+			titleKey: "server:globalSettings.s_loki-logging.title",
 			description: "Ship this node’s logs to a Grafana Loki instance. Independent of the rotated-file and console destinations. Turn it on or off with the Enable/Disable control on this destination — the same one every other destination uses.",
+			descriptionKey: "server:globalSettings.s_loki-logging.description",
 			columns: 2,
 			fields: [
 				this.field({
 					type: "text",
 					key: "url",
 					label: "Loki URL",
+					labelKey: "server:globalSettings.s_loki-logging.url.label",
 					description: "Base URL, e.g. http://loki:3100 — the /loki/api/v1/push path is added.",
+					descriptionKey: "server:globalSettings.s_loki-logging.url.description",
 					placeholder: "http://loki:3100",
 					default: ""
 				}),
@@ -468,23 +472,28 @@ var LokiLoggingAddon = class extends BaseAddon {
 					type: "select",
 					key: "level",
 					label: "Minimum level",
+					labelKey: "server:globalSettings.s_loki-logging.level.label",
 					default: "info",
 					options: [
 						{
 							value: "debug",
-							label: "Debug"
+							label: "Debug",
+							labelKey: "server:globalSettings.s_loki-logging.level.o_debug.label"
 						},
 						{
 							value: "info",
-							label: "Info"
+							label: "Info",
+							labelKey: "server:globalSettings.s_loki-logging.level.o_info.label"
 						},
 						{
 							value: "warn",
-							label: "Warn"
+							label: "Warn",
+							labelKey: "server:globalSettings.s_loki-logging.level.o_warn.label"
 						},
 						{
 							value: "error",
-							label: "Error"
+							label: "Error",
+							labelKey: "server:globalSettings.s_loki-logging.level.o_error.label"
 						}
 					]
 				}),
@@ -492,14 +501,18 @@ var LokiLoggingAddon = class extends BaseAddon {
 					type: "text",
 					key: "job",
 					label: "Job label",
+					labelKey: "server:globalSettings.s_loki-logging.job.label",
 					description: "The Loki `job` label. Keep it fixed — labels are indexed.",
+					descriptionKey: "server:globalSettings.s_loki-logging.job.description",
 					default: "camstack"
 				}),
 				this.field({
 					type: "text",
 					key: "extraLabels",
 					label: "Extra labels",
+					labelKey: "server:globalSettings.s_loki-logging.extraLabels.label",
 					description: "Static `key=value,key2=value2`. Low-cardinality only: per-entry values belong in the line body, and a high-cardinality label will bring Loki down.",
+					descriptionKey: "server:globalSettings.s_loki-logging.extraLabels.description",
 					placeholder: "env=home,site=garage",
 					default: ""
 				}),
@@ -507,27 +520,34 @@ var LokiLoggingAddon = class extends BaseAddon {
 					type: "text",
 					key: "tenantId",
 					label: "Tenant ID",
+					labelKey: "server:globalSettings.s_loki-logging.tenantId.label",
 					description: "Sent as X-Scope-OrgID. Required by Grafana Cloud and multi-tenant Loki.",
+					descriptionKey: "server:globalSettings.s_loki-logging.tenantId.description",
 					default: ""
 				}),
 				this.field({
 					type: "text",
 					key: "username",
 					label: "Username",
+					labelKey: "server:globalSettings.s_loki-logging.username.label",
 					description: "HTTP basic auth. Leave empty for none.",
+					descriptionKey: "server:globalSettings.s_loki-logging.username.description",
 					default: ""
 				}),
 				this.field({
 					type: "password",
 					key: "password",
 					label: "Password",
+					labelKey: "server:globalSettings.s_loki-logging.password.label",
 					default: ""
 				}),
 				this.field({
 					type: "number",
 					key: "batchIntervalMs",
 					label: "Flush interval",
+					labelKey: "server:globalSettings.s_loki-logging.batchIntervalMs.label",
 					description: "How often a partial batch is pushed.",
+					descriptionKey: "server:globalSettings.s_loki-logging.batchIntervalMs.description",
 					min: 250,
 					max: 6e4,
 					step: 250,
@@ -538,7 +558,9 @@ var LokiLoggingAddon = class extends BaseAddon {
 					type: "number",
 					key: "batchSize",
 					label: "Batch size",
+					labelKey: "server:globalSettings.s_loki-logging.batchSize.label",
 					description: "Push early once this many entries are queued.",
+					descriptionKey: "server:globalSettings.s_loki-logging.batchSize.description",
 					min: 1,
 					max: 5e3,
 					step: 10,
@@ -548,6 +570,7 @@ var LokiLoggingAddon = class extends BaseAddon {
 					type: "number",
 					key: "timeoutMs",
 					label: "Request timeout",
+					labelKey: "server:globalSettings.s_loki-logging.timeoutMs.label",
 					min: 1e3,
 					max: 6e4,
 					step: 500,

package/dist/builtins/native-metrics/native-metrics.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DVe0Nsp8.js");
+const require_dist = require("../../dist-GgG-7amw.js");
 let node_fs_promises = require("node:fs/promises");
 let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);
@@ -3511,11 +3511,14 @@ var NativeMetricsAddon = class NativeMetricsAddon extends require_dist.BaseAddon
 		return this.schema({ sections: [{
 			id: "native-metrics-settings",
 			title: "System Metrics",
+			titleKey: "server:globalSettings.s_native-metrics-settings.title",
 			fields: [this.field({
 				type: "number",
 				key: "samplingIntervalMs",
 				label: "Sampling Interval",
+				labelKey: "server:globalSettings.s_native-metrics-settings.samplingIntervalMs.label",
 				description: "How often to collect system metrics",
+				descriptionKey: "server:globalSettings.s_native-metrics-settings.samplingIntervalMs.description",
 				min: 1e3,
 				max: 6e4,
 				step: 1e3,
@@ -3525,12 +3528,15 @@ var NativeMetricsAddon = class NativeMetricsAddon extends require_dist.BaseAddon
 		}, {
 			id: "native-metrics-load-series",
 			title: "Load history",
+			titleKey: "server:globalSettings.s_native-metrics-load-series.title",
 			fields: [
 				this.field({
 					type: "number",
 					key: "loadSeriesCadenceSec",
 					label: "Sampling cadence",
+					labelKey: "server:globalSettings.s_native-metrics-load-series.loadSeriesCadenceSec.label",
 					description: "How often every node reports its process tree. FIXED — a sample is emitted on every interval whether or not anything changed, so a gap in the chart means one thing only: nobody reported. Outside 5-60 s the value is refused.",
+					descriptionKey: "server:globalSettings.s_native-metrics-load-series.loadSeriesCadenceSec.description",
 					min: 5,
 					max: 60,
 					step: 1,
@@ -3541,7 +3547,9 @@ var NativeMetricsAddon = class NativeMetricsAddon extends require_dist.BaseAddon
 					type: "number",
 					key: "loadSeriesRetentionHours",
 					label: "Retention",
+					labelKey: "server:globalSettings.s_native-metrics-load-series.loadSeriesRetentionHours.label",
 					description: "How long the load history is kept on disk (the hub database, on the NVMe cache — never the recordings disk). This is the INTENTION; the row cap below is the guarantee.",
+					descriptionKey: "server:globalSettings.s_native-metrics-load-series.loadSeriesRetentionHours.description",
 					min: 1,
 					max: 72,
 					step: 1,
@@ -3552,6 +3560,7 @@ var NativeMetricsAddon = class NativeMetricsAddon extends require_dist.BaseAddon
 					type: "info",
 					key: "load-series-cost",
 					label: "What this configuration costs",
+					labelKey: "server:globalSettings.s_native-metrics-load-series.load-series-cost.label",
 					content: describeLoadSeriesCost(projection),
 					variant: projection.capBites ? "warning" : "info"
 				},
@@ -3559,6 +3568,7 @@ var NativeMetricsAddon = class NativeMetricsAddon extends require_dist.BaseAddon
 					type: "info",
 					key: "load-series-cap",
 					label: "Hard row cap",
+					labelKey: "server:globalSettings.s_native-metrics-load-series.load-series-cap.label",
 					content: `The table never exceeds ${this.loadConfig.maxRows.toLocaleString("en-US")} rows. When it would, the OLDEST samples are evicted and a warning is logged — so raising the retention can never turn into an incident, only into a shorter effective window.`,
 					variant: "info"
 				}