@camstack/system 1.2.437 → 1.2.438

package/dist/builtins/local-auth/local-auth.addon.mjs

@@ -1,8 +1,8 @@
 import { i as __require, o as __toESM, t as __commonJSMin } from "../../chunk-CNf5ZN-e.mjs";
-import { C as DEVICE_ENROLLMENT_TTL_MS, Cr as BaseAddon, G as ScopedTokenSchema, Kt as formatDeviceRevoker, Q as UserRecordSchema, a as ApiKeyRecordSchema, ct as buildDeviceEnrollmentLink, er as userManagementCapability, jt as deviceCredentialsCapability, lt as buildDeviceSignatureMessage, q as SsoBridgeClaimsSchema, rt as authProviderCapability, w as DEVICE_NONCE_TTL_MS } from "../../dist-m5JkT8UN.mjs";
+import { E as DEVICE_NONCE_TTL_MS, J as ScopedTokenSchema, Or as BaseAddon, Pt as deviceCredentialsCapability, T as DEVICE_ENROLLMENT_TTL_MS, X as SsoBridgeClaimsSchema, Yt as formatDeviceRevoker, a as ApiKeyRecordSchema, ar as userManagementCapability, dt as buildDeviceEnrollmentLink, ft as buildDeviceSignatureMessage, ot as authProviderCapability, tt as UserRecordSchema, vi as userError } from "../../dist-Dc8GKC5H.mjs";
 import { t as require_safe_buffer } from "../../safe-buffer-B1OjL1I9.mjs";
 import { t as require_ms } from "../../ms-CgH2OFlD.mjs";
-import { _ as setProcessJwtSigningKey, a as importDevicePublicKey, c as rebuildDeviceCaCertificate, d as JWT_SIGNING_KEY_REF, g as processJwtSigningKey, h as loadJwtSigningKey, i as generateDeviceCa, l as verifyDeviceLeaf, m as getProcessJwtSigningKeyState, n as DEVICE_CA_KEY_REF, o as issueDeviceLeaf, r as DEVICE_CA_SETTINGS_SECTION, s as loadDeviceCa, t as DEVICE_CA_FIELD, u as verifyDeviceSignature } from "../../device-ca-BhdBByGD.mjs";
+import { _ as setProcessJwtSigningKey, a as importDevicePublicKey, c as rebuildDeviceCaCertificate, d as JWT_SIGNING_KEY_REF, g as processJwtSigningKey, h as loadJwtSigningKey, i as generateDeviceCa, l as verifyDeviceLeaf, m as getProcessJwtSigningKeyState, n as DEVICE_CA_KEY_REF, o as issueDeviceLeaf, r as DEVICE_CA_SETTINGS_SECTION, s as loadDeviceCa, t as DEVICE_CA_FIELD, u as verifyDeviceSignature } from "../../device-ca-DvIZjXIl.mjs";
 import * as crypto$1 from "node:crypto";
 import { X509Certificate, createHash, randomUUID, timingSafeEqual } from "node:crypto";
 import nodeCrypto from "crypto";
@@ -7066,9 +7066,9 @@ var AdminTokenManager = class {
 	/** Mint a token for `createdBy`. Refuses an expiry in the past or past 90 days. */
 	async create(input) {
 		const at = this.now();
-		if (!(input.expiresAt > at) || input.expiresAt > at + 7776e6) throw new Error("An admin token must expire within 90 days");
+		if (!(input.expiresAt > at) || input.expiresAt > at + 7776e6) throw userError("system.admin-token-expiry-too-long", void 0, "An admin token must expire within 90 days");
 		const name = input.name.trim().slice(0, 80);
-		if (name.length === 0) throw new Error("An admin token needs a name");
+		if (name.length === 0) throw userError("system.admin-token-name-required", void 0, "An admin token needs a name");
 		const token = `${ADMIN_TOKEN_PREFIX}${crypto$1.randomBytes(32).toString("base64url")}`;
 		const stored = {
 			id: crypto$1.randomUUID(),
@@ -7457,7 +7457,7 @@ var DeviceCredentialManager = class {
 	/** A one-shot code for `userId` (admin path). Returned once; only its hash is kept. */
 	startEnrollment(input) {
 		this.prune();
-		if (this.pendingEnrollments.size >= MAX_PENDING) throw new Error("Too many pending device enrollments — try again shortly");
+		if (this.pendingEnrollments.size >= MAX_PENDING) throw userError("system.device-enrollment-busy", void 0, "Too many pending device enrollments — try again shortly");
 		const code = crypto$1.randomBytes(24).toString("base64url");
 		const expiresAt = this.now() + DEVICE_ENROLLMENT_TTL_MS;
 		this.pendingEnrollments.set(hash(code), {
@@ -8028,7 +8028,7 @@ var UserManager = class {
 		return this.storageAccess.getStore();
 	}
 	async create(input) {
-		if (await this.findByUsername(input.username)) throw new Error(`User with username "${input.username}" already exists`);
+		if (await this.findByUsername(input.username)) throw userError("system.user-exists", { username: String(input.username) }, `User with username "${input.username}" already exists`);
 		const passwordHash = await this.auth.hashPassword(input.password);
 		const now = Date.now();
 		const record = {
@@ -8080,7 +8080,7 @@ var UserManager = class {
 	}
 	async update(id, data) {
 		const existing = await this.findById(id);
-		if (!existing) throw new Error(`User with id "${id}" not found`);
+		if (!existing) throw userError("system.user-not-found", { id: String(id) }, `User with id "${id}" not found`);
 		await this.store.update.mutate({
 			collection: USERS_COLLECTION$1,
 			id,
@@ -8099,7 +8099,7 @@ var UserManager = class {
 	}
 	async resetPassword(id, newPassword) {
 		const existing = await this.findById(id);
-		if (!existing) throw new Error(`User with id "${id}" not found`);
+		if (!existing) throw userError("system.user-not-found", { id: String(id) }, `User with id "${id}" not found`);
 		const passwordHash = await this.auth.hashPassword(newPassword);
 		await this.store.update.mutate({
 			collection: USERS_COLLECTION$1,
@@ -11766,7 +11766,7 @@ var LocalAuthAddon = class extends BaseAddon {
 			},
 			confirmTotp: async (input) => {
 				if (!this.totpManager) throw new Error("TOTP management not available");
-				if (!await this.totpManager.confirm(input.userId, input.code)) throw new Error("TOTP confirmation failed — code did not match");
+				if (!await this.totpManager.confirm(input.userId, input.code)) throw userError("auth.totp-confirm-failed", void 0, "TOTP confirmation failed — code did not match");
 				return { success: true };
 			},
 			disableTotp: async (input) => {
@@ -11824,7 +11824,7 @@ var LocalAuthAddon = class extends BaseAddon {
 	/** The admin cap (`device-credentials`): list, enroll-by-QR, revoke, rename, settings. */
 	buildDeviceCredentialsProvider() {
 		const manager = () => {
-			if (this.deviceCredentials === null) throw new Error("Device credentials not available");
+			if (this.deviceCredentials === null) throw userError("device.credentials-unavailable", void 0, "Device credentials not available");
 			return this.deviceCredentials;
 		};
 		const hubOrigins = async () => {
@@ -11876,7 +11876,7 @@ var LocalAuthAddon = class extends BaseAddon {
 			},
 			revokeDeviceCredential: async (input) => {
 				const record = manager().get(input.id);
-				if (record === void 0) throw new Error(`Device credential not found: ${input.id}`);
+				if (record === void 0) throw userError("device.credential-not-found", { id: input.id }, `Device credential not found: ${input.id}`);
 				const revoked = await manager().revoke(input.id, formatDeviceRevoker({
 					kind: "admin",
 					userId: input.caller.userId
@@ -11947,7 +11947,7 @@ var LocalAuthAddon = class extends BaseAddon {
 			return this.loginSessions;
 		};
 		const devices = () => {
-			if (this.deviceCredentials === null) throw new Error("Device credentials not available");
+			if (this.deviceCredentials === null) throw userError("device.credentials-unavailable", void 0, "Device credentials not available");
 			return this.deviceCredentials;
 		};
 		return {

package/dist/builtins/local-network/local-network.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CEAyXW3Q.js");
+const require_dist = require("../../dist-GgG-7amw.js");
 const require_hub_mdns_ciao = require("../../hub-mdns-ciao-CBLvq2oj.js");
 let zod = require("zod");
 let node_net = require("node:net");
@@ -953,13 +953,16 @@ var LocalNetworkAddon = class extends require_dist.BaseAddon {
 		return this.schema({ sections: [{
 			id: "local-access",
 			title: "LAN HTTP",
+			titleKey: "server:globalSettings.s_local-access.title",
 			description: "Native apps on this Wi-Fi use http:// and skip the private certificate. The tunnel and this admin UI stay on HTTPS. Turn off once a publicly-trusted certificate covers the LAN name.",
+			descriptionKey: "server:globalSettings.s_local-access.description",
 			columns: 1,
 			fields: [
 				this.field({
 					type: "boolean",
 					key: "httpEnabled",
 					label: "Enable HTTP on the LAN",
+					labelKey: "server:globalSettings.s_local-access.httpEnabled.label",
 					style: "switch",
 					default: true
 				}),
@@ -967,7 +970,9 @@ var LocalNetworkAddon = class extends require_dist.BaseAddon {
 					type: "number",
 					key: "httpPort",
 					label: "HTTP port",
+					labelKey: "server:globalSettings.s_local-access.httpPort.label",
 					description: "Dedicated listener. Must not equal the HTTPS port (4443 by default).",
+					descriptionKey: "server:globalSettings.s_local-access.httpPort.description",
 					min: 1,
 					max: 65535,
 					step: 1,
@@ -981,7 +986,9 @@ var LocalNetworkAddon = class extends require_dist.BaseAddon {
 					type: "boolean",
 					key: "mdnsAdvertise",
 					label: "Announce this hub on the LAN (mDNS)",
+					labelKey: "server:globalSettings.s_local-access.mdnsAdvertise.label",
 					description: "Lets `camstack login` find the hub without an address. Advertises only the HTTPS address, never a secret. Needs UDP 5353 multicast to reach the LAN (host networking or a dedicated container IP).",
+					descriptionKey: "server:globalSettings.s_local-access.mdnsAdvertise.description",
 					style: "switch",
 					default: true
 				}),
@@ -989,7 +996,9 @@ var LocalNetworkAddon = class extends require_dist.BaseAddon {
 					type: "text",
 					key: "localHostname",
 					label: "Local hostname",
+					labelKey: "server:globalSettings.s_local-access.localHostname.label",
 					description: "Advertised to the viewer instead of the raw LAN IP, and added to the certificate SAN. Requires this name to resolve on the LAN (router DNS, mDNS, or a hosts file). Leave empty to keep using the IP.",
+					descriptionKey: "server:globalSettings.s_local-access.localHostname.description",
 					maxLength: 253,
 					placeholder: "camstack.lan"
 				})

package/dist/builtins/local-network/local-network.addon.mjs

@@ -1,4 +1,4 @@
-import { B as NetworkTunnelStartedDataSchema, Cr as BaseAddon, Fn as resolveHubAddressRoles, M as HUB_MDNS_SERVICE_TYPE, N as HUB_MDNS_TXT_KEYS, Qt as isDefaultAppConnectionEndpoint, Rn as resolveNotificationTapAddress, Yt as isAppLinkBase, cn as localNetworkCapability, jn as resolveAppConnections, l as CAMSTACK_APP_LINK_ORIGIN, mt as checkRoleAddress, nr as validateCustomAddress, pi as EventCategory, wn as pickAppLinkHub } from "../../dist-m5JkT8UN.mjs";
+import { $t as isAppLinkBase, F as HUB_MDNS_SERVICE_TYPE, Fn as resolveAppConnections, Hn as resolveNotificationTapAddress, I as HUB_MDNS_TXT_KEYS, On as pickAppLinkHub, Or as BaseAddon, U as NetworkTunnelStartedDataSchema, _t as checkRoleAddress, fn as localNetworkCapability, l as CAMSTACK_APP_LINK_ORIGIN, nn as isDefaultAppConnectionEndpoint, sr as validateCustomAddress, yi as EventCategory, zn as resolveHubAddressRoles } from "../../dist-Dc8GKC5H.mjs";
 import { C as DEFAULT_LAN_HTTP_PORT, O as readLanHttpState, T as applyLanHttp, a as storeUploadedCertificate, b as ensureTlsCert, d as servedHttpsLeafFingerprint, g as readTlsMode, h as readTlsAccessStatus, i as revertToGeneratedCertificate, m as readExtraSans, n as applyCertificateToListener, r as regenerateCertificate, t as createCiaoPublisher, v as writeExtraSans } from "../../hub-mdns-ciao-DMlQTdPU.mjs";
 import { z } from "zod";
 import { isIP } from "node:net";
@@ -950,13 +950,16 @@ var LocalNetworkAddon = class extends BaseAddon {
 		return this.schema({ sections: [{
 			id: "local-access",
 			title: "LAN HTTP",
+			titleKey: "server:globalSettings.s_local-access.title",
 			description: "Native apps on this Wi-Fi use http:// and skip the private certificate. The tunnel and this admin UI stay on HTTPS. Turn off once a publicly-trusted certificate covers the LAN name.",
+			descriptionKey: "server:globalSettings.s_local-access.description",
 			columns: 1,
 			fields: [
 				this.field({
 					type: "boolean",
 					key: "httpEnabled",
 					label: "Enable HTTP on the LAN",
+					labelKey: "server:globalSettings.s_local-access.httpEnabled.label",
 					style: "switch",
 					default: true
 				}),
@@ -964,7 +967,9 @@ var LocalNetworkAddon = class extends BaseAddon {
 					type: "number",
 					key: "httpPort",
 					label: "HTTP port",
+					labelKey: "server:globalSettings.s_local-access.httpPort.label",
 					description: "Dedicated listener. Must not equal the HTTPS port (4443 by default).",
+					descriptionKey: "server:globalSettings.s_local-access.httpPort.description",
 					min: 1,
 					max: 65535,
 					step: 1,
@@ -978,7 +983,9 @@ var LocalNetworkAddon = class extends BaseAddon {
 					type: "boolean",
 					key: "mdnsAdvertise",
 					label: "Announce this hub on the LAN (mDNS)",
+					labelKey: "server:globalSettings.s_local-access.mdnsAdvertise.label",
 					description: "Lets `camstack login` find the hub without an address. Advertises only the HTTPS address, never a secret. Needs UDP 5353 multicast to reach the LAN (host networking or a dedicated container IP).",
+					descriptionKey: "server:globalSettings.s_local-access.mdnsAdvertise.description",
 					style: "switch",
 					default: true
 				}),
@@ -986,7 +993,9 @@ var LocalNetworkAddon = class extends BaseAddon {
 					type: "text",
 					key: "localHostname",
 					label: "Local hostname",
+					labelKey: "server:globalSettings.s_local-access.localHostname.label",
 					description: "Advertised to the viewer instead of the raw LAN IP, and added to the certificate SAN. Requires this name to resolve on the LAN (router DNS, mDNS, or a hosts file). Leave empty to keep using the IP.",
+					descriptionKey: "server:globalSettings.s_local-access.localHostname.description",
 					maxLength: 253,
 					placeholder: "camstack.lan"
 				})

package/dist/builtins/loki-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CEAyXW3Q.js");
+const require_dist = require("../../dist-GgG-7amw.js");
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label
@@ -458,14 +458,18 @@ var LokiLoggingAddon = class extends require_dist.BaseAddon {
 		return this.schema({ sections: [{
 			id: "loki-logging",
 			title: "Loki",
+			titleKey: "server:globalSettings.s_loki-logging.title",
 			description: "Ship this node’s logs to a Grafana Loki instance. Independent of the rotated-file and console destinations. Turn it on or off with the Enable/Disable control on this destination — the same one every other destination uses.",
+			descriptionKey: "server:globalSettings.s_loki-logging.description",
 			columns: 2,
 			fields: [
 				this.field({
 					type: "text",
 					key: "url",
 					label: "Loki URL",
+					labelKey: "server:globalSettings.s_loki-logging.url.label",
 					description: "Base URL, e.g. http://loki:3100 — the /loki/api/v1/push path is added.",
+					descriptionKey: "server:globalSettings.s_loki-logging.url.description",
 					placeholder: "http://loki:3100",
 					default: ""
 				}),
@@ -473,23 +477,28 @@ var LokiLoggingAddon = class extends require_dist.BaseAddon {
 					type: "select",
 					key: "level",
 					label: "Minimum level",
+					labelKey: "server:globalSettings.s_loki-logging.level.label",
 					default: "info",
 					options: [
 						{
 							value: "debug",
-							label: "Debug"
+							label: "Debug",
+							labelKey: "server:globalSettings.s_loki-logging.level.o_debug.label"
 						},
 						{
 							value: "info",
-							label: "Info"
+							label: "Info",
+							labelKey: "server:globalSettings.s_loki-logging.level.o_info.label"
 						},
 						{
 							value: "warn",
-							label: "Warn"
+							label: "Warn",
+							labelKey: "server:globalSettings.s_loki-logging.level.o_warn.label"
 						},
 						{
 							value: "error",
-							label: "Error"
+							label: "Error",
+							labelKey: "server:globalSettings.s_loki-logging.level.o_error.label"
 						}
 					]
 				}),
@@ -497,14 +506,18 @@ var LokiLoggingAddon = class extends require_dist.BaseAddon {
 					type: "text",
 					key: "job",
 					label: "Job label",
+					labelKey: "server:globalSettings.s_loki-logging.job.label",
 					description: "The Loki `job` label. Keep it fixed — labels are indexed.",
+					descriptionKey: "server:globalSettings.s_loki-logging.job.description",
 					default: "camstack"
 				}),
 				this.field({
 					type: "text",
 					key: "extraLabels",
 					label: "Extra labels",
+					labelKey: "server:globalSettings.s_loki-logging.extraLabels.label",
 					description: "Static `key=value,key2=value2`. Low-cardinality only: per-entry values belong in the line body, and a high-cardinality label will bring Loki down.",
+					descriptionKey: "server:globalSettings.s_loki-logging.extraLabels.description",
 					placeholder: "env=home,site=garage",
 					default: ""
 				}),
@@ -512,27 +525,34 @@ var LokiLoggingAddon = class extends require_dist.BaseAddon {
 					type: "text",
 					key: "tenantId",
 					label: "Tenant ID",
+					labelKey: "server:globalSettings.s_loki-logging.tenantId.label",
 					description: "Sent as X-Scope-OrgID. Required by Grafana Cloud and multi-tenant Loki.",
+					descriptionKey: "server:globalSettings.s_loki-logging.tenantId.description",
 					default: ""
 				}),
 				this.field({
 					type: "text",
 					key: "username",
 					label: "Username",
+					labelKey: "server:globalSettings.s_loki-logging.username.label",
 					description: "HTTP basic auth. Leave empty for none.",
+					descriptionKey: "server:globalSettings.s_loki-logging.username.description",
 					default: ""
 				}),
 				this.field({
 					type: "password",
 					key: "password",
 					label: "Password",
+					labelKey: "server:globalSettings.s_loki-logging.password.label",
 					default: ""
 				}),
 				this.field({
 					type: "number",
 					key: "batchIntervalMs",
 					label: "Flush interval",
+					labelKey: "server:globalSettings.s_loki-logging.batchIntervalMs.label",
 					description: "How often a partial batch is pushed.",
+					descriptionKey: "server:globalSettings.s_loki-logging.batchIntervalMs.description",
 					min: 250,
 					max: 6e4,
 					step: 250,
@@ -543,7 +563,9 @@ var LokiLoggingAddon = class extends require_dist.BaseAddon {
 					type: "number",
 					key: "batchSize",
 					label: "Batch size",
+					labelKey: "server:globalSettings.s_loki-logging.batchSize.label",
 					description: "Push early once this many entries are queued.",
+					descriptionKey: "server:globalSettings.s_loki-logging.batchSize.description",
 					min: 1,
 					max: 5e3,
 					step: 10,
@@ -553,6 +575,7 @@ var LokiLoggingAddon = class extends require_dist.BaseAddon {
 					type: "number",
 					key: "timeoutMs",
 					label: "Request timeout",
+					labelKey: "server:globalSettings.s_loki-logging.timeoutMs.label",
 					min: 1e3,
 					max: 6e4,
 					step: 500,

package/dist/builtins/loki-logging/index.mjs

@@ -1,4 +1,4 @@
-import { Cr as BaseAddon, un as logDestinationCapability } from "../../dist-m5JkT8UN.mjs";
+import { Or as BaseAddon, mn as logDestinationCapability } from "../../dist-Dc8GKC5H.mjs";
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label
@@ -453,14 +453,18 @@ var LokiLoggingAddon = class extends BaseAddon {
 		return this.schema({ sections: [{
 			id: "loki-logging",
 			title: "Loki",
+			titleKey: "server:globalSettings.s_loki-logging.title",
 			description: "Ship this node’s logs to a Grafana Loki instance. Independent of the rotated-file and console destinations. Turn it on or off with the Enable/Disable control on this destination — the same one every other destination uses.",
+			descriptionKey: "server:globalSettings.s_loki-logging.description",
 			columns: 2,
 			fields: [
 				this.field({
 					type: "text",
 					key: "url",
 					label: "Loki URL",
+					labelKey: "server:globalSettings.s_loki-logging.url.label",
 					description: "Base URL, e.g. http://loki:3100 — the /loki/api/v1/push path is added.",
+					descriptionKey: "server:globalSettings.s_loki-logging.url.description",
 					placeholder: "http://loki:3100",
 					default: ""
 				}),
@@ -468,23 +472,28 @@ var LokiLoggingAddon = class extends BaseAddon {
 					type: "select",
 					key: "level",
 					label: "Minimum level",
+					labelKey: "server:globalSettings.s_loki-logging.level.label",
 					default: "info",
 					options: [
 						{
 							value: "debug",
-							label: "Debug"
+							label: "Debug",
+							labelKey: "server:globalSettings.s_loki-logging.level.o_debug.label"
 						},
 						{
 							value: "info",
-							label: "Info"
+							label: "Info",
+							labelKey: "server:globalSettings.s_loki-logging.level.o_info.label"
 						},
 						{
 							value: "warn",
-							label: "Warn"
+							label: "Warn",
+							labelKey: "server:globalSettings.s_loki-logging.level.o_warn.label"
 						},
 						{
 							value: "error",
-							label: "Error"
+							label: "Error",
+							labelKey: "server:globalSettings.s_loki-logging.level.o_error.label"
 						}
 					]
 				}),
@@ -492,14 +501,18 @@ var LokiLoggingAddon = class extends BaseAddon {
 					type: "text",
 					key: "job",
 					label: "Job label",
+					labelKey: "server:globalSettings.s_loki-logging.job.label",
 					description: "The Loki `job` label. Keep it fixed — labels are indexed.",
+					descriptionKey: "server:globalSettings.s_loki-logging.job.description",
 					default: "camstack"
 				}),
 				this.field({
 					type: "text",
 					key: "extraLabels",
 					label: "Extra labels",
+					labelKey: "server:globalSettings.s_loki-logging.extraLabels.label",
 					description: "Static `key=value,key2=value2`. Low-cardinality only: per-entry values belong in the line body, and a high-cardinality label will bring Loki down.",
+					descriptionKey: "server:globalSettings.s_loki-logging.extraLabels.description",
 					placeholder: "env=home,site=garage",
 					default: ""
 				}),
@@ -507,27 +520,34 @@ var LokiLoggingAddon = class extends BaseAddon {
 					type: "text",
 					key: "tenantId",
 					label: "Tenant ID",
+					labelKey: "server:globalSettings.s_loki-logging.tenantId.label",
 					description: "Sent as X-Scope-OrgID. Required by Grafana Cloud and multi-tenant Loki.",
+					descriptionKey: "server:globalSettings.s_loki-logging.tenantId.description",
 					default: ""
 				}),
 				this.field({
 					type: "text",
 					key: "username",
 					label: "Username",
+					labelKey: "server:globalSettings.s_loki-logging.username.label",
 					description: "HTTP basic auth. Leave empty for none.",
+					descriptionKey: "server:globalSettings.s_loki-logging.username.description",
 					default: ""
 				}),
 				this.field({
 					type: "password",
 					key: "password",
 					label: "Password",
+					labelKey: "server:globalSettings.s_loki-logging.password.label",
 					default: ""
 				}),
 				this.field({
 					type: "number",
 					key: "batchIntervalMs",
 					label: "Flush interval",
+					labelKey: "server:globalSettings.s_loki-logging.batchIntervalMs.label",
 					description: "How often a partial batch is pushed.",
+					descriptionKey: "server:globalSettings.s_loki-logging.batchIntervalMs.description",
 					min: 250,
 					max: 6e4,
 					step: 250,
@@ -538,7 +558,9 @@ var LokiLoggingAddon = class extends BaseAddon {
 					type: "number",
 					key: "batchSize",
 					label: "Batch size",
+					labelKey: "server:globalSettings.s_loki-logging.batchSize.label",
 					description: "Push early once this many entries are queued.",
+					descriptionKey: "server:globalSettings.s_loki-logging.batchSize.description",
 					min: 1,
 					max: 5e3,
 					step: 10,
@@ -548,6 +570,7 @@ var LokiLoggingAddon = class extends BaseAddon {
 					type: "number",
 					key: "timeoutMs",
 					label: "Request timeout",
+					labelKey: "server:globalSettings.s_loki-logging.timeoutMs.label",
 					min: 1e3,
 					max: 6e4,
 					step: 500,

package/dist/builtins/native-metrics/native-metrics.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CEAyXW3Q.js");
+const require_dist = require("../../dist-GgG-7amw.js");
 let node_fs_promises = require("node:fs/promises");
 let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);
@@ -3511,11 +3511,14 @@ var NativeMetricsAddon = class NativeMetricsAddon extends require_dist.BaseAddon
 		return this.schema({ sections: [{
 			id: "native-metrics-settings",
 			title: "System Metrics",
+			titleKey: "server:globalSettings.s_native-metrics-settings.title",
 			fields: [this.field({
 				type: "number",
 				key: "samplingIntervalMs",
 				label: "Sampling Interval",
+				labelKey: "server:globalSettings.s_native-metrics-settings.samplingIntervalMs.label",
 				description: "How often to collect system metrics",
+				descriptionKey: "server:globalSettings.s_native-metrics-settings.samplingIntervalMs.description",
 				min: 1e3,
 				max: 6e4,
 				step: 1e3,
@@ -3525,12 +3528,15 @@ var NativeMetricsAddon = class NativeMetricsAddon extends require_dist.BaseAddon
 		}, {
 			id: "native-metrics-load-series",
 			title: "Load history",
+			titleKey: "server:globalSettings.s_native-metrics-load-series.title",
 			fields: [
 				this.field({
 					type: "number",
 					key: "loadSeriesCadenceSec",
 					label: "Sampling cadence",
+					labelKey: "server:globalSettings.s_native-metrics-load-series.loadSeriesCadenceSec.label",
 					description: "How often every node reports its process tree. FIXED — a sample is emitted on every interval whether or not anything changed, so a gap in the chart means one thing only: nobody reported. Outside 5-60 s the value is refused.",
+					descriptionKey: "server:globalSettings.s_native-metrics-load-series.loadSeriesCadenceSec.description",
 					min: 5,
 					max: 60,
 					step: 1,
@@ -3541,7 +3547,9 @@ var NativeMetricsAddon = class NativeMetricsAddon extends require_dist.BaseAddon
 					type: "number",
 					key: "loadSeriesRetentionHours",
 					label: "Retention",
+					labelKey: "server:globalSettings.s_native-metrics-load-series.loadSeriesRetentionHours.label",
 					description: "How long the load history is kept on disk (the hub database, on the NVMe cache — never the recordings disk). This is the INTENTION; the row cap below is the guarantee.",
+					descriptionKey: "server:globalSettings.s_native-metrics-load-series.loadSeriesRetentionHours.description",
 					min: 1,
 					max: 72,
 					step: 1,
@@ -3552,6 +3560,7 @@ var NativeMetricsAddon = class NativeMetricsAddon extends require_dist.BaseAddon
 					type: "info",
 					key: "load-series-cost",
 					label: "What this configuration costs",
+					labelKey: "server:globalSettings.s_native-metrics-load-series.load-series-cost.label",
 					content: describeLoadSeriesCost(projection),
 					variant: projection.capBites ? "warning" : "info"
 				},
@@ -3559,6 +3568,7 @@ var NativeMetricsAddon = class NativeMetricsAddon extends require_dist.BaseAddon
 					type: "info",
 					key: "load-series-cap",
 					label: "Hard row cap",
+					labelKey: "server:globalSettings.s_native-metrics-load-series.load-series-cap.label",
 					content: `The table never exceeds ${this.loadConfig.maxRows.toLocaleString("en-US")} rows. When it would, the OLDEST samples are evicted and a warning is logged — so raising the retention can never turn into an incident, only into a shorter effective window.`,
 					variant: "info"
 				}

package/dist/builtins/native-metrics/native-metrics.addon.mjs

@@ -1,4 +1,4 @@
-import { Cr as BaseAddon, Gt as foldSnapshotByFunction, Mn as resolveBucketMs, Sr as errMsg, gn as metricsProviderCapability, kn as reducePoints, pi as EventCategory, zr as createEvent } from "../../dist-m5JkT8UN.mjs";
+import { Dr as errMsg, In as resolveBucketMs, Jt as foldSnapshotByFunction, Nn as reducePoints, Or as BaseAddon, Wr as createEvent, bn as metricsProviderCapability, yi as EventCategory } from "../../dist-Dc8GKC5H.mjs";
 import { access, readFile, readdir } from "node:fs/promises";
 import * as os$1 from "node:os";
 import { platform } from "node:os";
@@ -3506,11 +3506,14 @@ var NativeMetricsAddon = class NativeMetricsAddon extends BaseAddon {
 		return this.schema({ sections: [{
 			id: "native-metrics-settings",
 			title: "System Metrics",
+			titleKey: "server:globalSettings.s_native-metrics-settings.title",
 			fields: [this.field({
 				type: "number",
 				key: "samplingIntervalMs",
 				label: "Sampling Interval",
+				labelKey: "server:globalSettings.s_native-metrics-settings.samplingIntervalMs.label",
 				description: "How often to collect system metrics",
+				descriptionKey: "server:globalSettings.s_native-metrics-settings.samplingIntervalMs.description",
 				min: 1e3,
 				max: 6e4,
 				step: 1e3,
@@ -3520,12 +3523,15 @@ var NativeMetricsAddon = class NativeMetricsAddon extends BaseAddon {
 		}, {
 			id: "native-metrics-load-series",
 			title: "Load history",
+			titleKey: "server:globalSettings.s_native-metrics-load-series.title",
 			fields: [
 				this.field({
 					type: "number",
 					key: "loadSeriesCadenceSec",
 					label: "Sampling cadence",
+					labelKey: "server:globalSettings.s_native-metrics-load-series.loadSeriesCadenceSec.label",
 					description: "How often every node reports its process tree. FIXED — a sample is emitted on every interval whether or not anything changed, so a gap in the chart means one thing only: nobody reported. Outside 5-60 s the value is refused.",
+					descriptionKey: "server:globalSettings.s_native-metrics-load-series.loadSeriesCadenceSec.description",
 					min: 5,
 					max: 60,
 					step: 1,
@@ -3536,7 +3542,9 @@ var NativeMetricsAddon = class NativeMetricsAddon extends BaseAddon {
 					type: "number",
 					key: "loadSeriesRetentionHours",
 					label: "Retention",
+					labelKey: "server:globalSettings.s_native-metrics-load-series.loadSeriesRetentionHours.label",
 					description: "How long the load history is kept on disk (the hub database, on the NVMe cache — never the recordings disk). This is the INTENTION; the row cap below is the guarantee.",
+					descriptionKey: "server:globalSettings.s_native-metrics-load-series.loadSeriesRetentionHours.description",
 					min: 1,
 					max: 72,
 					step: 1,
@@ -3547,6 +3555,7 @@ var NativeMetricsAddon = class NativeMetricsAddon extends BaseAddon {
 					type: "info",
 					key: "load-series-cost",
 					label: "What this configuration costs",
+					labelKey: "server:globalSettings.s_native-metrics-load-series.load-series-cost.label",
 					content: describeLoadSeriesCost(projection),
 					variant: projection.capBites ? "warning" : "info"
 				},
@@ -3554,6 +3563,7 @@ var NativeMetricsAddon = class NativeMetricsAddon extends BaseAddon {
 					type: "info",
 					key: "load-series-cap",
 					label: "Hard row cap",
+					labelKey: "server:globalSettings.s_native-metrics-load-series.load-series-cap.label",
 					content: `The table never exceeds ${this.loadConfig.maxRows.toLocaleString("en-US")} rows. When it would, the OLDEST samples are evicted and a warning is logged — so raising the retention can never turn into an incident, only into a shorter effective window.`,
 					variant: "info"
 				}

package/dist/builtins/platform-probe/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CEAyXW3Q.js");
+const require_dist = require("../../dist-GgG-7amw.js");
 let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);
 let node_fs = require("node:fs");

package/dist/builtins/platform-probe/index.mjs

@@ -1,5 +1,5 @@
 import { o as __toESM, r as __exportAll } from "../../chunk-CNf5ZN-e.mjs";
-import { Cr as BaseAddon, En as platformProbeCapability, Hn as scoreRuntimes, It as enumerateInferenceDevices, Sr as errMsg, Ur as emitReadiness, pi as EventCategory } from "../../dist-m5JkT8UN.mjs";
+import { An as platformProbeCapability, Dr as errMsg, Jr as emitReadiness, Kn as scoreRuntimes, Or as BaseAddon, yi as EventCategory, zt as enumerateInferenceDevices } from "../../dist-Dc8GKC5H.mjs";
 import * as os$1 from "node:os";
 import * as fs from "node:fs";
 import { execFile } from "node:child_process";

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CEAyXW3Q.js");
+const require_dist = require("../../dist-GgG-7amw.js");
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { Cr as BaseAddon, pi as EventCategory } from "../../dist-m5JkT8UN.mjs";
+import { Or as BaseAddon, yi as EventCategory } from "../../dist-Dc8GKC5H.mjs";
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative