@camstack/system 1.2.437 → 1.2.439

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { Cr as BaseAddon, pi as EventCategory } from "../../dist-m5JkT8UN.mjs";
+import { Or as BaseAddon, yi as EventCategory } from "../../dist-yI6kF6r6.mjs";
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/snapshot/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CEAyXW3Q.js");
+const require_dist = require("../../dist-BOWdLjoK.js");
 const require_snapshot_courtesy = require("../../snapshot-courtesy-D_C5-nC0.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
@@ -1707,13 +1707,17 @@ var SnapshotAddon = class SnapshotAddon extends require_dist.BaseAddon {
 		return this.schema({ sections: [{
 			id: "snapshot-cache",
 			title: "Snapshot Cache",
+			titleKey: "server:globalSettings.s_snapshot-cache.title",
 			description: "Stale fallback when live capture fails. Per-device freshness is configured under Device → Snapshot → Max cache age.",
+			descriptionKey: "server:globalSettings.s_snapshot-cache.description",
 			columns: 1,
 			fields: [this.field({
 				type: "number",
 				key: "staleTtlMs",
 				label: "Stale fallback TTL (ms)",
+				labelKey: "server:globalSettings.s_snapshot-cache.staleTtlMs.label",
 				description: "If live capture fails, cached snapshot younger than this is still returned.",
+				descriptionKey: "server:globalSettings.s_snapshot-cache.staleTtlMs.description",
 				min: 0,
 				max: 36e5,
 				step: 1e3,
@@ -2322,6 +2326,7 @@ var SnapshotAddon = class SnapshotAddon extends require_dist.BaseAddon {
 		return { sections: [{
 			id: "snapshot-preferences",
 			title: "Snapshot",
+			titleKey: "server:deviceSettingsContribution.s_snapshot-preferences.title",
 			tab: "snapshot",
 			order: 60,
 			fields: [
@@ -2329,7 +2334,9 @@ var SnapshotAddon = class SnapshotAddon extends require_dist.BaseAddon {
 					type: "select",
 					key: "snapshotStreamId",
 					label: "Preferred stream",
+					labelKey: "server:deviceSettingsContribution.s_snapshot-preferences.snapshotStreamId.label",
 					description: "Stream used when grabbing a snapshot",
+					descriptionKey: "server:deviceSettingsContribution.s_snapshot-preferences.snapshotStreamId.description",
 					options: streamOptions,
 					required: true,
 					value: current.snapshotStreamId || "auto"
@@ -2338,6 +2345,7 @@ var SnapshotAddon = class SnapshotAddon extends require_dist.BaseAddon {
 					type: "number",
 					key: "snapshotMaxAgeS",
 					label: "Max cache age (s)",
+					labelKey: "server:deviceSettingsContribution.s_snapshot-preferences.snapshotMaxAgeS.label",
 					description: `Serve cached snapshot up to this age before re-capturing. Default ${defaultMaxAgeS}s for ${isBattery ? "battery cams (avoids gratuitous wake-ups)" : "non-battery cams (live-feel)"}. The UI refresh button always forces a fresh capture regardless of this value.`,
 					min: 0,
 					max: 24 * 3600,
@@ -2348,7 +2356,9 @@ var SnapshotAddon = class SnapshotAddon extends require_dist.BaseAddon {
 					type: "boolean",
 					key: "snapshotDebug",
 					label: "Debug logging",
+					labelKey: "server:deviceSettingsContribution.s_snapshot-preferences.snapshotDebug.label",
 					description: "Log stream selection and timing details for this device.",
+					descriptionKey: "server:deviceSettingsContribution.s_snapshot-preferences.snapshotDebug.description",
 					value: current.snapshotDebug ?? false
 				}
 			]

package/dist/builtins/snapshot/index.mjs

@@ -1,4 +1,4 @@
-import { $r as nodePin, Cr as BaseAddon, Kn as snapshotCapability, Qn as streamQualityLabel, Sr as errMsg, at as bareAddonId, hn as memoizePinnedFfmpeg, kt as deriveBatteryPresence, ot as batteryCapability, pi as EventCategory, s as BatteryStatusSchema, xr as DeviceType, yr as DeviceFeature } from "../../dist-m5JkT8UN.mjs";
+import { Dr as errMsg, Er as DeviceType, Mt as deriveBatteryPresence, Or as BaseAddon, Xn as snapshotCapability, ct as bareAddonId, ii as nodePin, lt as batteryCapability, rr as streamQualityLabel, s as BatteryStatusSchema, wr as DeviceFeature, yi as EventCategory, yn as memoizePinnedFfmpeg } from "../../dist-yI6kF6r6.mjs";
 import { i as renderCourtesyOverlayJpeg, n as courtesyCacheKey, r as renderCourtesyJpeg } from "../../snapshot-courtesy-CyFs1M3I.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";
@@ -1701,13 +1701,17 @@ var SnapshotAddon = class SnapshotAddon extends BaseAddon {
 		return this.schema({ sections: [{
 			id: "snapshot-cache",
 			title: "Snapshot Cache",
+			titleKey: "server:globalSettings.s_snapshot-cache.title",
 			description: "Stale fallback when live capture fails. Per-device freshness is configured under Device → Snapshot → Max cache age.",
+			descriptionKey: "server:globalSettings.s_snapshot-cache.description",
 			columns: 1,
 			fields: [this.field({
 				type: "number",
 				key: "staleTtlMs",
 				label: "Stale fallback TTL (ms)",
+				labelKey: "server:globalSettings.s_snapshot-cache.staleTtlMs.label",
 				description: "If live capture fails, cached snapshot younger than this is still returned.",
+				descriptionKey: "server:globalSettings.s_snapshot-cache.staleTtlMs.description",
 				min: 0,
 				max: 36e5,
 				step: 1e3,
@@ -2316,6 +2320,7 @@ var SnapshotAddon = class SnapshotAddon extends BaseAddon {
 		return { sections: [{
 			id: "snapshot-preferences",
 			title: "Snapshot",
+			titleKey: "server:deviceSettingsContribution.s_snapshot-preferences.title",
 			tab: "snapshot",
 			order: 60,
 			fields: [
@@ -2323,7 +2328,9 @@ var SnapshotAddon = class SnapshotAddon extends BaseAddon {
 					type: "select",
 					key: "snapshotStreamId",
 					label: "Preferred stream",
+					labelKey: "server:deviceSettingsContribution.s_snapshot-preferences.snapshotStreamId.label",
 					description: "Stream used when grabbing a snapshot",
+					descriptionKey: "server:deviceSettingsContribution.s_snapshot-preferences.snapshotStreamId.description",
 					options: streamOptions,
 					required: true,
 					value: current.snapshotStreamId || "auto"
@@ -2332,6 +2339,7 @@ var SnapshotAddon = class SnapshotAddon extends BaseAddon {
 					type: "number",
 					key: "snapshotMaxAgeS",
 					label: "Max cache age (s)",
+					labelKey: "server:deviceSettingsContribution.s_snapshot-preferences.snapshotMaxAgeS.label",
 					description: `Serve cached snapshot up to this age before re-capturing. Default ${defaultMaxAgeS}s for ${isBattery ? "battery cams (avoids gratuitous wake-ups)" : "non-battery cams (live-feel)"}. The UI refresh button always forces a fresh capture regardless of this value.`,
 					min: 0,
 					max: 24 * 3600,
@@ -2342,7 +2350,9 @@ var SnapshotAddon = class SnapshotAddon extends BaseAddon {
 					type: "boolean",
 					key: "snapshotDebug",
 					label: "Debug logging",
+					labelKey: "server:deviceSettingsContribution.s_snapshot-preferences.snapshotDebug.label",
 					description: "Log stream selection and timing details for this device.",
+					descriptionKey: "server:deviceSettingsContribution.s_snapshot-preferences.snapshotDebug.description",
 					value: current.snapshotDebug ?? false
 				}
 			]

package/dist/builtins/sqlite-storage/filesystem-storage.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CEAyXW3Q.js");
+const require_dist = require("../../dist-BOWdLjoK.js");
 let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 let node_path = require("node:path");
@@ -155,11 +155,14 @@ var FilesystemStorageProvider = class FilesystemStorageProvider {
 			configSchema: { sections: [{
 				id: "filesystem-storage",
 				title: "Filesystem",
+				titleKey: "server:providerInfo.s_filesystem-storage.title",
 				fields: [{
 					type: "text",
 					key: "basePath",
 					label: "Base path",
+					labelKey: "server:providerInfo.s_filesystem-storage.basePath.label",
 					description: "Absolute directory path where files are stored.",
+					descriptionKey: "server:providerInfo.s_filesystem-storage.basePath.description",
 					required: true
 				}]
 			}] }

package/dist/builtins/sqlite-storage/filesystem-storage.addon.mjs

@@ -1,4 +1,4 @@
-import { Cr as BaseAddon, Wt as filesystemBrowseCapability, Xn as storageProviderCapability } from "../../dist-m5JkT8UN.mjs";
+import { Or as BaseAddon, qt as filesystemBrowseCapability, tr as storageProviderCapability } from "../../dist-yI6kF6r6.mjs";
 import { randomUUID } from "node:crypto";
 import { mkdir, readdir, realpath, statfs } from "node:fs/promises";
 import * as path$1 from "node:path";
@@ -149,11 +149,14 @@ var FilesystemStorageProvider = class FilesystemStorageProvider {
 			configSchema: { sections: [{
 				id: "filesystem-storage",
 				title: "Filesystem",
+				titleKey: "server:providerInfo.s_filesystem-storage.title",
 				fields: [{
 					type: "text",
 					key: "basePath",
 					label: "Base path",
+					labelKey: "server:providerInfo.s_filesystem-storage.basePath.label",
 					description: "Absolute directory path where files are stored.",
+					descriptionKey: "server:providerInfo.s_filesystem-storage.basePath.description",
 					required: true
 				}]
 			}] }

package/dist/builtins/sqlite-storage/index.js

@@ -4,7 +4,7 @@ Object.defineProperties(exports, {
 });
 require("../../chunk-Cek0wNdY.js");
 const require_builtins_sqlite_storage_filesystem_storage_addon = require("./filesystem-storage.addon.js");
-const require_wal_maintenance = require("../../wal-maintenance-Ch79gy9S.js");
+const require_wal_maintenance = require("../../wal-maintenance-DEL_jeG0.js");
 const require_builtins_sqlite_storage_sqlite_settings_addon = require("./sqlite-settings.addon.js");
 //#region src/builtins/sqlite-storage/config-store.ts
 var ConfigStore = class {

package/dist/builtins/sqlite-storage/index.mjs

@@ -1,5 +1,5 @@
 import { FilesystemStorageAddon, t as FilesystemStorageProvider } from "./filesystem-storage.addon.mjs";
-import { A as SQLITE_PAGE_CACHE_CEILING_KIB, B as sqliteEngineStorm, D as SQLITE_JOURNAL_SIZE_LIMIT_BYTES, F as SQLITE_PROFILE_REPORT_FLOOR_MS, I as SQLITE_PROFILE_REPORT_INTERVAL_MS, L as SQLITE_PROFILE_TOP_N, M as sqliteMmapSizeFor, N as sqlitePageCacheKibFor, O as SQLITE_MMAP_CEILING_BYTES, P as SQLITE_ENGINE_STORM_WALL_SHARE, R as SQLITE_SLOW_CALL_MS, a as WalMaintenance, c as SqliteSettingsBackend, i as WAL_MAINTENANCE_INTERVAL_MS, j as SQLITE_PAGE_CACHE_FLOOR_KIB, k as SQLITE_MMAP_FLOOR_BYTES, n as WAL_HIGH_WATER_BYTES, r as WAL_IDLE_QUIET_MS, t as WAL_CHECKPOINT_BUSY_TIMEOUT_MS, z as SqliteOpProfiler } from "../../wal-maintenance-DvnVO5IK.mjs";
+import { A as SQLITE_PAGE_CACHE_CEILING_KIB, B as sqliteEngineStorm, D as SQLITE_JOURNAL_SIZE_LIMIT_BYTES, F as SQLITE_PROFILE_REPORT_FLOOR_MS, I as SQLITE_PROFILE_REPORT_INTERVAL_MS, L as SQLITE_PROFILE_TOP_N, M as sqliteMmapSizeFor, N as sqlitePageCacheKibFor, O as SQLITE_MMAP_CEILING_BYTES, P as SQLITE_ENGINE_STORM_WALL_SHARE, R as SQLITE_SLOW_CALL_MS, a as WalMaintenance, c as SqliteSettingsBackend, i as WAL_MAINTENANCE_INTERVAL_MS, j as SQLITE_PAGE_CACHE_FLOOR_KIB, k as SQLITE_MMAP_FLOOR_BYTES, n as WAL_HIGH_WATER_BYTES, r as WAL_IDLE_QUIET_MS, t as WAL_CHECKPOINT_BUSY_TIMEOUT_MS, z as SqliteOpProfiler } from "../../wal-maintenance-xsvdT5Go.mjs";
 import { SqliteSettingsAddon } from "./sqlite-settings.addon.mjs";
 //#region src/builtins/sqlite-storage/config-store.ts
 var ConfigStore = class {

package/dist/builtins/sqlite-storage/sqlite-settings.addon.js

@@ -3,9 +3,9 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CEAyXW3Q.js");
-const require_retired_settings_keys = require("../../retired-settings-keys-DNfV28R_.js");
-const require_wal_maintenance = require("../../wal-maintenance-Ch79gy9S.js");
+const require_dist = require("../../dist-BOWdLjoK.js");
+const require_retired_settings_keys = require("../../retired-settings-keys-CyQ7uvta.js");
+const require_wal_maintenance = require("../../wal-maintenance-DEL_jeG0.js");
 const require_sqlite_snapshot_protocol = require("../../sqlite-snapshot-protocol-B9OndqZv.js");
 const require_wal_checkpoint_policy = require("../../wal-checkpoint-policy-d2z2qPqx.js");
 let node_fs_promises = require("node:fs/promises");

package/dist/builtins/sqlite-storage/sqlite-settings.addon.mjs

@@ -1,6 +1,6 @@
-import { Cr as BaseAddon, Or as RUNTIME_DEFAULTS, Sr as errMsg, Tt as databaseSnapshotCapability, _ as DATABASE_SNAPSHOT_PARTIAL_SUFFIX, ar as vectorStoreCapability, at as bareAddonId, b as DATA_STORE_DATABASES, v as DATABASE_SNAPSHOT_SUFFIX, wt as dataStoreProviderCapability, y as DATABASE_SNAPSHOT_TIMEOUT_MS } from "../../dist-m5JkT8UN.mjs";
-import { r as retiredKeyStoreOf, t as purgeRetiredSettingsKeys } from "../../retired-settings-keys-C5qP9QIf.mjs";
-import { C as callControl, E as controlTargetOf, S as trustResult, T as callVector, _ as collectTransferables, a as WalMaintenance, c as SqliteSettingsBackend, d as CrossDatabaseTransactError, f as DatabaseBusyError, m as rehydrateError, o as createVectorIndex, p as DuplicatePlacementError, s as vectorProviderOf, u as CollectionPlacementError, v as isFileHostMessage, w as callData } from "../../wal-maintenance-DvnVO5IK.mjs";
+import { Dr as errMsg, Dt as dataStoreProviderCapability, Nr as RUNTIME_DEFAULTS, Or as BaseAddon, Ot as databaseSnapshotCapability, S as DATA_STORE_DATABASES, b as DATABASE_SNAPSHOT_SUFFIX, ct as bareAddonId, ur as vectorStoreCapability, x as DATABASE_SNAPSHOT_TIMEOUT_MS, y as DATABASE_SNAPSHOT_PARTIAL_SUFFIX } from "../../dist-yI6kF6r6.mjs";
+import { r as retiredKeyStoreOf, t as purgeRetiredSettingsKeys } from "../../retired-settings-keys-UsVtLOT0.mjs";
+import { C as callControl, E as controlTargetOf, S as trustResult, T as callVector, _ as collectTransferables, a as WalMaintenance, c as SqliteSettingsBackend, d as CrossDatabaseTransactError, f as DatabaseBusyError, m as rehydrateError, o as createVectorIndex, p as DuplicatePlacementError, s as vectorProviderOf, u as CollectionPlacementError, v as isFileHostMessage, w as callData } from "../../wal-maintenance-xsvdT5Go.mjs";
 import { r as isSnapshotWorkerMessage } from "../../sqlite-snapshot-protocol-2QaTouWV.mjs";
 import { a as isWorkerMessage, t as WAL_CHECKPOINT_LARGE_PASS_FRAMES } from "../../wal-checkpoint-policy-BahrTtyD.mjs";
 import { createRequire } from "node:module";

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CEAyXW3Q.js");
+const require_dist = require("../../dist-BOWdLjoK.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { $t as isLocationEnabled, Bt as evictionPolicyOfLocation, Cr as BaseAddon, Dr as REDACTED_SECRET, I as LegacyStorageLocationDefaultSchema, In as resolveLocationMode, J as StorageCleanupJobSchema, Jn as storageMigrationCapability, Jt as gbToBytes, Lr as collectSecretConfigKeys, Un as settingsStoreCapability, X as StorageLocationTypeSchema, Y as StorageLocationModeSchema, Z as StorageMigrationJobSchema, Zr as isSecretMarker, _n as modeMayWrite, ci as secretTreeFromPaths, fi as transformSecretWrite, mn as mayWriteToLocation, oi as resolveSecretMarkers, on as legacyModeOf, or as withLocationMode, pi as EventCategory, pn as mayReadLocation, qn as storageCapability, ti as parseJsonObject } from "../../dist-m5JkT8UN.mjs";
+import { $ as StorageLocationTypeSchema, $n as storageMigrationCapability, Bn as resolveLocationMode, Hr as collectSecretConfigKeys, Mr as REDACTED_SECRET, Or as BaseAddon, Q as StorageLocationModeSchema, Qn as storageCapability, Ut as evictionPolicyOfLocation, Z as StorageCleanupJobSchema, Zt as gbToBytes, _i as transformSecretWrite, _n as mayReadLocation, di as resolveSecretMarkers, dr as withLocationMode, et as StorageMigrationJobSchema, ni as isSecretMarker, oi as parseJsonObject, pi as secretTreeFromPaths, qn as settingsStoreCapability, rn as isLocationEnabled, un as legacyModeOf, vn as mayWriteToLocation, xn as modeMayWrite, yi as EventCategory, z as LegacyStorageLocationDefaultSchema } from "../../dist-yI6kF6r6.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";
 import { containsOrEquals, physicalRootOf } from "@camstack/types/node";

package/dist/builtins/system-config/system-config.addon.js

@@ -3,11 +3,11 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CEAyXW3Q.js");
+const require_dist = require("../../dist-BOWdLjoK.js");
 const require_safe_buffer$1 = require("../../safe-buffer-D3aoa-7X.js");
-const require_x509_es = require("../../x509.es-r7Ht1thA.js");
-const require_agent_https = require("../../agent-https-BZIwS4xF.js");
-const require_constants$8 = require("../../constants-CwRY32Nx.js");
+const require_x509_es = require("../../x509.es-C4cOo48M.js");
+const require_agent_https = require("../../agent-https-DlpTMDqA.js");
+const require_constants$8 = require("../../constants-BRsjQwi-.js");
 const require_src$1 = require("../../src-CnAqG6EF.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
@@ -88604,6 +88604,7 @@ var SystemConfigAddon = class extends require_dist.BaseAddon {
 				id: "system-config-server",
 				title: SECTION_TITLES["server"],
 				description: "The name of this server, and its connection settings (read-only, loaded from config.yaml at bootstrap).",
+				descriptionKey: "server:global.s_system-config-server.description",
 				columns: 2,
 				fields: [
 					{
@@ -88618,6 +88619,7 @@ var SystemConfigAddon = class extends require_dist.BaseAddon {
 						type: "info",
 						key: "server-restart-note",
 						label: "Restart required",
+						labelKey: "server:global.s_system-config-server.server-restart-note.label",
 						content: "Port, host and data path are read-only. Change them in config.yaml and restart.",
 						variant: "warning"
 					},
@@ -88625,21 +88627,27 @@ var SystemConfigAddon = class extends require_dist.BaseAddon {
 						type: "text",
 						key: "port",
 						label: "Port",
+						labelKey: "server:global.s_system-config-server.port.label",
 						description: "Listening port",
+						descriptionKey: "server:global.s_system-config-server.port.description",
 						disabled: true
 					},
 					{
 						type: "text",
 						key: "host",
 						label: "Host",
+						labelKey: "server:global.s_system-config-server.host.label",
 						description: "Bind address",
+						descriptionKey: "server:global.s_system-config-server.host.description",
 						disabled: true
 					},
 					{
 						type: "text",
 						key: "dataPath",
 						label: "Data Path",
+						labelKey: "server:global.s_system-config-server.dataPath.label",
 						description: "Root data directory",
+						descriptionKey: "server:global.s_system-config-server.dataPath.description",
 						disabled: true,
 						span: 2
 					}
@@ -88649,13 +88657,16 @@ var SystemConfigAddon = class extends require_dist.BaseAddon {
 				id: "system-config-auth",
 				title: SECTION_TITLES["auth"],
 				description: "Token and session settings.",
+				descriptionKey: "server:global.s_system-config-auth.description",
 				columns: 1,
 				fields: [
 					{
 						type: "text",
 						key: "tokenExpiry",
 						label: "Session lifetime",
+						labelKey: "server:global.s_system-config-auth.tokenExpiry.label",
 						description: "How long a sign-in lasts without being used, as a duration string (e.g. 7d, 30d). Every refresh starts it again, so a device in use stays signed in; one left unopened this long must sign in again. A bare number is rejected — it would be read as milliseconds. Applies from the next sign-in or refresh.",
+						descriptionKey: "server:global.s_system-config-auth.tokenExpiry.description",
 						placeholder: "30d",
 						default: "30d"
 					},
@@ -88663,7 +88674,9 @@ var SystemConfigAddon = class extends require_dist.BaseAddon {
 						type: "text",
 						key: "accessTokenExpiry",
 						label: "Access token lifetime",
+						labelKey: "server:global.s_system-config-auth.accessTokenExpiry.label",
 						description: "How long one access token lives before the app silently swaps it for a new one (e.g. 2h; between 5m and 24h, never longer than the session). Shorter limits how long a copied token is useful. Apps that predate refresh tokens get one token for the whole session instead.",
+						descriptionKey: "server:global.s_system-config-auth.accessTokenExpiry.description",
 						placeholder: "2h",
 						default: "2h"
 					},
@@ -88671,13 +88684,16 @@ var SystemConfigAddon = class extends require_dist.BaseAddon {
 						type: "tags",
 						key: "trustedProxies",
 						label: "Trusted reverse proxies",
+						labelKey: "server:global.s_system-config-auth.trustedProxies.label",
 						description: "Addresses or CIDR ranges (e.g. 192.168.1.2 or 10.0.0.0/24) of reverse proxies in front of the hub. Only a request whose direct sender is one of these — or this host itself, as with the Cloudflare tunnel — has its X-Forwarded-For / CF-Connecting-IP read as the real client address for rate limits. Leave empty unless a proxy on another host forwards to the hub.",
+						descriptionKey: "server:global.s_system-config-auth.trustedProxies.description",
 						creatable: true
 					},
 					{
 						type: "info",
 						key: "trustedNetworksWarning",
 						label: "Skipping two-factor authentication",
+						labelKey: "server:global.s_system-config-auth.trustedNetworksWarning.label",
 						variant: "danger",
 						content: "A sign-in made DIRECTLY from a network listed below skips the second factor (TOTP or passkey): anyone on that network who knows or guesses a password gets in with the password alone — including a compromised camera or a guest device. Requests that come through the Cloudflare tunnel, the public address or any reverse proxy never skip it, whatever address they claim. Every skip is recorded in the authentication audit log. Leave empty (the default) to always ask for the second factor."
 					},
@@ -88685,7 +88701,9 @@ var SystemConfigAddon = class extends require_dist.BaseAddon {
 						type: "tags",
 						key: "trustedNetworks",
 						label: "Trusted networks (skip the second factor)",
+						labelKey: "server:global.s_system-config-auth.trustedNetworks.label",
 						description: "Addresses or CIDR ranges, e.g. 192.168.1.0/24. Keep it as narrow as you can — a single trusted VLAN, not the whole LAN.",
+						descriptionKey: "server:global.s_system-config-auth.trustedNetworks.description",
 						creatable: true
 					}
 				]

package/dist/builtins/system-config/system-config.addon.mjs

@@ -1,9 +1,9 @@
 import { a as __toCommonJS, i as __require, n as __esmMin, o as __toESM, r as __exportAll, t as __commonJSMin } from "../../chunk-CNf5ZN-e.mjs";
-import { Br as customAction, Cr as BaseAddon, K as ServerNameSchema, Kr as hydrateSchema, Sr as errMsg, Vr as defineCustomActions, Wn as shortHostname } from "../../dist-m5JkT8UN.mjs";
+import { Dr as errMsg, Gr as customAction, Jn as shortHostname, Kr as defineCustomActions, Or as BaseAddon, Y as ServerNameSchema, Zr as hydrateSchema } from "../../dist-yI6kF6r6.mjs";
 import { t as require_safe_buffer } from "../../safe-buffer-B1OjL1I9.mjs";
-import { a as KeyUsagesExtension, c as Pkcs10CertificateRequestGenerator, d as X509Certificate$1, f as X509CertificateGenerator, g as backdatedNotBefore, i as KeyUsageFlags, n as BasicConstraintsExtension, o as PemConverter, p as cryptoProvider, r as ExtendedKeyUsageExtension, s as Pkcs10CertificateRequest, t as AuthorityKeyIdentifierExtension, u as SubjectKeyIdentifierExtension } from "../../x509.es-CDvj67p1.mjs";
-import { A as AgentHttpsNames, M as setProcessAgentHttpsNames, O as AGENT_HTTPS_NAMES_COLLECTION, d as isPrivateAddress, j as getProcessAgentHttpsNames, k as AGENT_HTTPS_NAMES_COLUMNS, u as isLocalOnlyHostname } from "../../agent-https-BPfHrI4c.mjs";
-import { a as MESH_CA_KEY_REF, c as SERVER_AUTH_OID, i as MESH_CA_FIELD, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY, r as MESH_CA_COMMON_NAME, s as MESH_CA_VALIDITY_DAYS, t as CLIENT_AUTH_OID } from "../../constants-Bc6trhoW.mjs";
+import { S as backdatedNotBefore, a as KeyUsageFlags, c as Pkcs10CertificateRequest, d as SubjectKeyIdentifierExtension, f as X509Certificate$1, l as Pkcs10CertificateRequestGenerator, m as cryptoProvider, n as BasicConstraintsExtension, o as KeyUsagesExtension, p as X509CertificateGenerator, r as ExtendedKeyUsageExtension, s as PemConverter, t as AuthorityKeyIdentifierExtension } from "../../x509.es-DK__ETIe.mjs";
+import { F as AGENT_HTTPS_NAMES_COLLECTION, I as AGENT_HTTPS_NAMES_COLUMNS, L as AgentHttpsNames, R as getProcessAgentHttpsNames, j as isLocalOnlyHostname, u as isPrivateAddress, z as setProcessAgentHttpsNames } from "../../agent-https-U0d4uvn2.mjs";
+import { a as MESH_CA_KEY_REF, c as SERVER_AUTH_OID, i as MESH_CA_FIELD, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY, r as MESH_CA_COMMON_NAME, s as MESH_CA_VALIDITY_DAYS, t as CLIENT_AUTH_OID } from "../../constants-B92BjObl.mjs";
 import { t as require_src } from "../../src-hG4grMU4.mjs";
 import { z } from "zod";
 import { X509Certificate, createHash, createPrivateKey, randomBytes, randomInt, sign, timingSafeEqual, verify, webcrypto } from "node:crypto";
@@ -88586,6 +88586,7 @@ var SystemConfigAddon = class extends BaseAddon {
 				id: "system-config-server",
 				title: SECTION_TITLES["server"],
 				description: "The name of this server, and its connection settings (read-only, loaded from config.yaml at bootstrap).",
+				descriptionKey: "server:global.s_system-config-server.description",
 				columns: 2,
 				fields: [
 					{
@@ -88600,6 +88601,7 @@ var SystemConfigAddon = class extends BaseAddon {
 						type: "info",
 						key: "server-restart-note",
 						label: "Restart required",
+						labelKey: "server:global.s_system-config-server.server-restart-note.label",
 						content: "Port, host and data path are read-only. Change them in config.yaml and restart.",
 						variant: "warning"
 					},
@@ -88607,21 +88609,27 @@ var SystemConfigAddon = class extends BaseAddon {
 						type: "text",
 						key: "port",
 						label: "Port",
+						labelKey: "server:global.s_system-config-server.port.label",
 						description: "Listening port",
+						descriptionKey: "server:global.s_system-config-server.port.description",
 						disabled: true
 					},
 					{
 						type: "text",
 						key: "host",
 						label: "Host",
+						labelKey: "server:global.s_system-config-server.host.label",
 						description: "Bind address",
+						descriptionKey: "server:global.s_system-config-server.host.description",
 						disabled: true
 					},
 					{
 						type: "text",
 						key: "dataPath",
 						label: "Data Path",
+						labelKey: "server:global.s_system-config-server.dataPath.label",
 						description: "Root data directory",
+						descriptionKey: "server:global.s_system-config-server.dataPath.description",
 						disabled: true,
 						span: 2
 					}
@@ -88631,13 +88639,16 @@ var SystemConfigAddon = class extends BaseAddon {
 				id: "system-config-auth",
 				title: SECTION_TITLES["auth"],
 				description: "Token and session settings.",
+				descriptionKey: "server:global.s_system-config-auth.description",
 				columns: 1,
 				fields: [
 					{
 						type: "text",
 						key: "tokenExpiry",
 						label: "Session lifetime",
+						labelKey: "server:global.s_system-config-auth.tokenExpiry.label",
 						description: "How long a sign-in lasts without being used, as a duration string (e.g. 7d, 30d). Every refresh starts it again, so a device in use stays signed in; one left unopened this long must sign in again. A bare number is rejected — it would be read as milliseconds. Applies from the next sign-in or refresh.",
+						descriptionKey: "server:global.s_system-config-auth.tokenExpiry.description",
 						placeholder: "30d",
 						default: "30d"
 					},
@@ -88645,7 +88656,9 @@ var SystemConfigAddon = class extends BaseAddon {
 						type: "text",
 						key: "accessTokenExpiry",
 						label: "Access token lifetime",
+						labelKey: "server:global.s_system-config-auth.accessTokenExpiry.label",
 						description: "How long one access token lives before the app silently swaps it for a new one (e.g. 2h; between 5m and 24h, never longer than the session). Shorter limits how long a copied token is useful. Apps that predate refresh tokens get one token for the whole session instead.",
+						descriptionKey: "server:global.s_system-config-auth.accessTokenExpiry.description",
 						placeholder: "2h",
 						default: "2h"
 					},
@@ -88653,13 +88666,16 @@ var SystemConfigAddon = class extends BaseAddon {
 						type: "tags",
 						key: "trustedProxies",
 						label: "Trusted reverse proxies",
+						labelKey: "server:global.s_system-config-auth.trustedProxies.label",
 						description: "Addresses or CIDR ranges (e.g. 192.168.1.2 or 10.0.0.0/24) of reverse proxies in front of the hub. Only a request whose direct sender is one of these — or this host itself, as with the Cloudflare tunnel — has its X-Forwarded-For / CF-Connecting-IP read as the real client address for rate limits. Leave empty unless a proxy on another host forwards to the hub.",
+						descriptionKey: "server:global.s_system-config-auth.trustedProxies.description",
 						creatable: true
 					},
 					{
 						type: "info",
 						key: "trustedNetworksWarning",
 						label: "Skipping two-factor authentication",
+						labelKey: "server:global.s_system-config-auth.trustedNetworksWarning.label",
 						variant: "danger",
 						content: "A sign-in made DIRECTLY from a network listed below skips the second factor (TOTP or passkey): anyone on that network who knows or guesses a password gets in with the password alone — including a compromised camera or a guest device. Requests that come through the Cloudflare tunnel, the public address or any reverse proxy never skip it, whatever address they claim. Every skip is recorded in the authentication audit log. Leave empty (the default) to always ask for the second factor."
 					},
@@ -88667,7 +88683,9 @@ var SystemConfigAddon = class extends BaseAddon {
 						type: "tags",
 						key: "trustedNetworks",
 						label: "Trusted networks (skip the second factor)",
+						labelKey: "server:global.s_system-config-auth.trustedNetworks.label",
 						description: "Addresses or CIDR ranges, e.g. 192.168.1.0/24. Keep it as narrow as you can — a single trusted VLAN, not the whole LAN.",
+						descriptionKey: "server:global.s_system-config-auth.trustedNetworks.description",
 						creatable: true
 					}
 				]

package/dist/builtins/winston-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CEAyXW3Q.js");
+const require_dist = require("../../dist-BOWdLjoK.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);
@@ -106,36 +106,45 @@ var WinstonLoggingAddon = class extends require_dist.BaseAddon {
 		return this.schema({ sections: [{
 			id: "winston-logging",
 			title: "Logging",
+			titleKey: "server:globalSettings.s_winston-logging.title",
 			description: "Global log verbosity + retention for rotated log files on this node.",
+			descriptionKey: "server:globalSettings.s_winston-logging.description",
 			columns: 2,
 			fields: [this.field({
 				type: "select",
 				key: "level",
 				label: "Log Level",
+				labelKey: "server:globalSettings.s_winston-logging.level.label",
 				default: "info",
 				options: [
 					{
 						value: "debug",
-						label: "Debug"
+						label: "Debug",
+						labelKey: "server:globalSettings.s_winston-logging.level.o_debug.label"
 					},
 					{
 						value: "info",
-						label: "Info"
+						label: "Info",
+						labelKey: "server:globalSettings.s_winston-logging.level.o_info.label"
 					},
 					{
 						value: "warn",
-						label: "Warn"
+						label: "Warn",
+						labelKey: "server:globalSettings.s_winston-logging.level.o_warn.label"
 					},
 					{
 						value: "error",
-						label: "Error"
+						label: "Error",
+						labelKey: "server:globalSettings.s_winston-logging.level.o_error.label"
 					}
 				]
 			}), this.field({
 				type: "number",
 				key: "retentionDays",
 				label: "Retention (days)",
+				labelKey: "server:globalSettings.s_winston-logging.retentionDays.label",
 				description: "Number of days to keep rotated log files before deletion",
+				descriptionKey: "server:globalSettings.s_winston-logging.retentionDays.description",
 				min: 1,
 				max: 365,
 				step: 1,

package/dist/builtins/winston-logging/index.mjs

@@ -1,4 +1,4 @@
-import { Cr as BaseAddon, un as logDestinationCapability } from "../../dist-m5JkT8UN.mjs";
+import { Or as BaseAddon, mn as logDestinationCapability } from "../../dist-yI6kF6r6.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 import * as path$1 from "node:path";
 import path from "node:path";
@@ -99,36 +99,45 @@ var WinstonLoggingAddon = class extends BaseAddon {
 		return this.schema({ sections: [{
 			id: "winston-logging",
 			title: "Logging",
+			titleKey: "server:globalSettings.s_winston-logging.title",
 			description: "Global log verbosity + retention for rotated log files on this node.",
+			descriptionKey: "server:globalSettings.s_winston-logging.description",
 			columns: 2,
 			fields: [this.field({
 				type: "select",
 				key: "level",
 				label: "Log Level",
+				labelKey: "server:globalSettings.s_winston-logging.level.label",
 				default: "info",
 				options: [
 					{
 						value: "debug",
-						label: "Debug"
+						label: "Debug",
+						labelKey: "server:globalSettings.s_winston-logging.level.o_debug.label"
 					},
 					{
 						value: "info",
-						label: "Info"
+						label: "Info",
+						labelKey: "server:globalSettings.s_winston-logging.level.o_info.label"
 					},
 					{
 						value: "warn",
-						label: "Warn"
+						label: "Warn",
+						labelKey: "server:globalSettings.s_winston-logging.level.o_warn.label"
 					},
 					{
 						value: "error",
-						label: "Error"
+						label: "Error",
+						labelKey: "server:globalSettings.s_winston-logging.level.o_error.label"
 					}
 				]
 			}), this.field({
 				type: "number",
 				key: "retentionDays",
 				label: "Retention (days)",
+				labelKey: "server:globalSettings.s_winston-logging.retentionDays.label",
 				description: "Number of days to keep rotated log files before deletion",
+				descriptionKey: "server:globalSettings.s_winston-logging.retentionDays.description",
 				min: 1,
 				max: 365,
 				step: 1,

package/dist/{composition-sources-BIT8IUKm.js → composition-sources-B4jC2FC7.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-CEAyXW3Q.js");
+const require_dist = require("./dist-BOWdLjoK.js");
 //#region src/builtins/core-blocks/composition-sources.ts
 /**
 * Describe what a composition reads and writes for SAVE-time validation

package/dist/{composition-sources-tpYR0f1x.mjs → composition-sources-BGOSCGWa.mjs}

@@ -1,4 +1,4 @@
-import { Sr as errMsg, hr as compositionSourceKey } from "./dist-m5JkT8UN.mjs";
+import { Dr as errMsg, br as compositionSourceKey } from "./dist-yI6kF6r6.mjs";
 //#region src/builtins/core-blocks/composition-sources.ts
 /**
 * Describe what a composition reads and writes for SAVE-time validation

package/dist/{constants-Bc6trhoW.mjs → constants-B92BjObl.mjs}

@@ -1,4 +1,4 @@
-import { Ir as buildSecretRef } from "./dist-m5JkT8UN.mjs";
+import { Vr as buildSecretRef } from "./dist-yI6kF6r6.mjs";
 /** `secret://system/global/meshCaKey` — EC P-256 PKCS#8 PEM of the hub mesh CA. */
 var MESH_CA_KEY_REF = buildSecretRef({
 	owner: "system",

package/dist/{constants-CwRY32Nx.js → constants-BRsjQwi-.js}

@@ -1,5 +1,5 @@
 /** `secret://system/global/meshCaKey` — EC P-256 PKCS#8 PEM of the hub mesh CA. */
-var MESH_CA_KEY_REF = require("./dist-CEAyXW3Q.js").buildSecretRef({
+var MESH_CA_KEY_REF = require("./dist-BOWdLjoK.js").buildSecretRef({
 	owner: "system",
 	scope: { kind: "global" },
 	fieldPath: "meshCaKey"

package/dist/{device-ca-BhdBByGD.mjs → device-ca-46BUsWD1.mjs}

@@ -1,5 +1,5 @@
-import { E as DEVICE_SAN_USER_PREFIX, Ir as buildSecretRef, T as DEVICE_SAN_CREDENTIAL_PREFIX } from "./dist-m5JkT8UN.mjs";
-import { a as KeyUsagesExtension, d as X509Certificate$1, f as X509CertificateGenerator, g as backdatedNotBefore, i as KeyUsageFlags, l as SubjectAlternativeNameExtension, n as BasicConstraintsExtension, o as PemConverter, p as cryptoProvider, r as ExtendedKeyUsageExtension, t as AuthorityKeyIdentifierExtension, u as SubjectKeyIdentifierExtension } from "./x509.es-CDvj67p1.mjs";
+import { D as DEVICE_SAN_CREDENTIAL_PREFIX, O as DEVICE_SAN_USER_PREFIX, Vr as buildSecretRef } from "./dist-yI6kF6r6.mjs";
+import { S as backdatedNotBefore, a as KeyUsageFlags, d as SubjectKeyIdentifierExtension, f as X509Certificate$1, m as cryptoProvider, n as BasicConstraintsExtension, o as KeyUsagesExtension, p as X509CertificateGenerator, r as ExtendedKeyUsageExtension, s as PemConverter, t as AuthorityKeyIdentifierExtension, u as SubjectAlternativeNameExtension } from "./x509.es-DK__ETIe.mjs";
 import { X509Certificate, createPublicKey, randomBytes, verify, webcrypto } from "node:crypto";
 //#region src/auth/jwt-signing-key.ts
 /**