@cosmicdrift/kumiko-bundled-features 0.205.0 → 0.207.0

package/src/inbound-mail-foundation/__tests__/inbound-mail-foundation.integration.test.ts

@@ -323,11 +323,11 @@ describe("scenario 2b: ingest-message — Thread-Rollup selbstkorrigierend statt
   });
 });
 
-describe("scenario 2c: ingest-message — concurrent thread-rollup race (issue #1229)", () => {
+describe("scenario 2c: ingest-message — concurrent thread-rollup race (issue #1229, closed by #2155)", () => {
   // Probabilistic — looped per house convention (mehrere Durchläufe, z.B.
-  // 20x): the version-conflict race between two step-5 thread-rollup
-  // appends only fires on genuine transaction-timing interleaving, which
-  // a single run can't force deterministically.
+  // 20x): whether a concurrent thread-rollup commit lands inside the
+  // step-5 critical section depends on real transaction-timing
+  // interleaving, which a single run can't force deterministically.
   const ITERATIONS = 20;
   const CONCURRENCY = 3;
 
@@ -352,10 +352,10 @@ describe("scenario 2c: ingest-message — concurrent thread-rollup race (issue #
         ),
       );
 
-      // No writer's transaction fails with a 500 from the thread-rollup
-      // version conflict — each of the CONCURRENCY distinct messages is
-      // its own aggregate, so step 4 never races; only step 5 (shared
-      // threadAggId) does, and the bounded retry loop must absorb it.
+      // No writer's transaction fails with a 500 — each of the CONCURRENCY
+      // distinct messages is its own aggregate, so step 4 never races; step
+      // 5 (shared threadAggId) is serialized by the pg_advisory_xact_lock,
+      // so there's nothing here for the bounded retry loop to absorb.
       for (const res of responses) {
         expect(res.status).toBe(200);
         const body = (await res.json()) as { isSuccess: boolean; data: { duplicate: boolean } };
@@ -366,8 +366,9 @@ describe("scenario 2c: ingest-message — concurrent thread-rollup race (issue #
       const threadAggId = mailThreadAggregateId(admin.tenantId, `mid:${rootMessageIdHeader}`);
       const threadRows = await selectMany(db, mailThreadsProjectionTable, { id: threadAggId });
       expect(threadRows).toHaveLength(1);
-      // Every message's contribution landed — no drift from a silently
-      // stale-read-and-succeed append (the bug the retry loop replaces).
+      // Every message's contribution landed — the advisory lock closes the
+      // TOCTOU gap between countWhere and append that used to let a stale
+      // messageCount succeed without ever surfacing as a version conflict.
       expect(threadRows[0]?.["messageCount"]).toBe(CONCURRENCY);
     }
   });

package/src/inbound-mail-foundation/handlers/ingest-message.write.ts

@@ -25,6 +25,7 @@ import {
   configuredPiiSubjectKms,
   encryptPiiFieldValues,
 } from "@cosmicdrift/kumiko-framework/crypto";
+import { acquireNamespacedAdvisoryLock } from "@cosmicdrift/kumiko-framework/db";
 import type { WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { Temporal } from "temporal-polyfill";
@@ -101,6 +102,10 @@ function buildThreadKey(p: IngestMessagePayload, effectiveMessageIdHeader: strin
 }
 
 const THREAD_ROLLUP_MAX_ATTEMPTS = 5;
+// pg_advisory_xact_lock namespace (int4) for the step-5 thread-rollup lock
+// — 'inbm' as ASCII, keeps it disjoint from the framework's other fixed
+// single-int advisory-lock keys (schema bootstrap, es-ops boot).
+const THREAD_ROLLUP_LOCK_NAMESPACE = 0x696e626d;
 export const ingestMessageHandler: WriteHandlerDef = {
   name: "ingest-message",
   schema: ingestMessageSchema,
@@ -230,35 +235,23 @@ export const ingestMessageHandler: WriteHandlerDef = {
     //    encrypted once up front (constant across retries, doesn't
     //    depend on the thread's prior state).
     //
-    //    messageCount deliberately does NOT come from a previously loaded
-    //    threadEvents snapshot (previousCount+1): two concurrent ingests
-    //    on the same thread (Watch-Push vs. Poll-Reconciliation overlap,
-    //    or two different messages of the same thread arriving at once)
-    //    can both read the same stream version before either commits.
-    //    tryAppendEvent's fresh version-read at append time makes the
-    //    loser's append fail with a VersionConflictError ONLY when the
-    //    other TX's commit lands between this reload and the append's own
-    //    version check — so we retry: reload the thread stream, recompute
-    //    the live row-count and lastMessageAt, and append again. If the
-    //    other TX instead commits in the gap between the countWhere below
-    //    and the append's version-read, the version check sees the
-    //    already-bumped stream and appends without conflict — but with the
-    //    stale row-count this countWhere captured before the concurrent
-    //    insert. That write still lands (messageCount can undercount by
-    //    one round), it is not eliminated by this retry loop; the next
-    //    ingest on the thread re-counts and self-corrects. Unlike step 4,
-    //    a lost version-conflict race here must NOT be treated as a no-op
+    //    messageCount is a live COUNT, not previousCount+1, so two
+    //    concurrent ingests on the same thread (Watch-Push vs.
+    //    Poll-Reconciliation overlap, or two different messages of the
+    //    same thread arriving at once) converge on the true count.
+    //    acquireNamespacedAdvisoryLock below (issue #2155) serializes this whole
+    //    countWhere+append section per threadAggId — transaction-scoped,
+    //    so it survives tryAppendEvent's inner SAVEPOINT and releases at
+    //    the enclosing TX's commit/rollback. Without it, a concurrent
+    //    commit landing between countWhere and tryAppendEvent's own fresh
+    //    version-read makes the append succeed with a stale count instead
+    //    of a VersionConflictError, so the retry loop below never sees it
+    //    as a conflict to retry (#1229's original gap). Unlike step 4, a
+    //    lost version-conflict race here must NOT be treated as a no-op
     //    duplicate — skipping would leave this message's contribution to
     //    messageCount/lastMessageAt out of the thread forever. Exhausting
     //    all attempts throws, rolling back the whole TX (including the
-    //    step-4 message append) for a clean re-ingest on the next poll —
-    //    never return success with a stale snapshot.
-    //
-    //    A true race-free read+append (e.g. SELECT ... FOR UPDATE or an
-    //    advisory lock on threadAggId) would close the countWhere→append
-    //    gap above and is deliberately not part of this fix — two writers
-    //    (watch + poll) make self-correcting drift an acceptable trade for
-    //    now.
+    //    step-4 message append) for a clean re-ingest.
     // ---------------------------------------------------------------
     const threadPlainPii = { tenantId, subject: payload.subject };
     const encryptedThreadFields = piiKms
@@ -274,6 +267,8 @@ export const ingestMessageHandler: WriteHandlerDef = {
         )
       : threadPlainPii;
 
+    await acquireNamespacedAdvisoryLock(ctx.db.raw, THREAD_ROLLUP_LOCK_NAMESPACE, threadAggId);
+
     let threadAppendOk = false;
     for (let attempt = 1; attempt <= THREAD_ROLLUP_MAX_ATTEMPTS && !threadAppendOk; attempt++) {
       const threadEvents = await ctx.loadAggregate(threadAggId);

package/src/jobs/i18n.ts

@@ -1,70 +1,92 @@
 // @runtime client
 // Server + client i18n for jobs operator screens.
 
-type LocalizedString = { readonly de: string; readonly en: string };
+type LocalizedString = { readonly de: string; readonly en: string; readonly es: string };
 
 export const JOBS_I18N: Readonly<Record<string, LocalizedString>> = {
-  "screen:job-runs.title": { de: "Job-Läufe", en: "Job runs" },
-  "screen:job-run-detail.title": { de: "Job-Lauf", en: "Job run" },
-  "jobs:nav.jobRuns": { de: "Jobs", en: "Jobs" },
-  "jobs.runs.title": { de: "Job-Läufe", en: "Job runs" },
-  "jobs.runs.loading": { de: "Lade Läufe…", en: "Loading runs…" },
-  "jobs.runs.empty": { de: "Keine Job-Läufe.", en: "No job runs." },
-  "jobs.runs.open": { de: "Details", en: "Details" },
-  "jobs.runs.filter.status": { de: "Status", en: "Status" },
-  "jobs.runs.filter.all": { de: "Alle", en: "All" },
-  "jobs.runs.filter.completed": { de: "Abgeschlossen", en: "Completed" },
-  "jobs.runs.filter.failed": { de: "Fehlgeschlagen", en: "Failed" },
-  "jobs.runs.filter.running": { de: "Läuft", en: "Running" },
-  "jobs.runs.filter.queued": { de: "Wartend", en: "Queued" },
-  "jobs.runs.col.job": { de: "Job", en: "Job" },
-  "jobs.runs.col.status": { de: "Status", en: "Status" },
-  "jobs.runs.col.started": { de: "Gestartet", en: "Started" },
-  "jobs.runs.col.duration": { de: "Dauer (ms)", en: "Duration (ms)" },
-  "jobs.detail.loading": { de: "Lade Details…", en: "Loading details…" },
-  "jobs.detail.missing": { de: "Lauf nicht gefunden.", en: "Run not found." },
-  "jobs.detail.field.job": { de: "Job", en: "Job" },
-  "jobs.detail.field.status": { de: "Status", en: "Status" },
-  "jobs.detail.field.id": { de: "Run-ID", en: "Run ID" },
-  "jobs.detail.field.started": { de: "Gestartet", en: "Started" },
-  "jobs.detail.field.finished": { de: "Beendet", en: "Finished" },
-  "jobs.detail.field.duration": { de: "Dauer (ms)", en: "Duration (ms)" },
-  "jobs.detail.field.error": { de: "Fehler", en: "Error" },
-  "jobs.detail.logs": { de: "Logs", en: "Logs" },
-  "jobs.detail.logs.empty": { de: "Keine Log-Zeilen.", en: "No log lines." },
-  "jobs.detail.retry": { de: "Erneut ausführen", en: "Retry" },
-  "jobs.detail.retrying": { de: "Wird erneut gestartet…", en: "Retrying…" },
-  "jobs.trigger.title": { de: "Job starten", en: "Run a job" },
+  "screen:job-runs.title": { de: "Job-Läufe", en: "Job runs", es: "Ejecuciones de trabajos" },
+  "screen:job-run-detail.title": { de: "Job-Lauf", en: "Job run", es: "Ejecución de trabajo" },
+  "jobs:nav.jobRuns": { de: "Jobs", en: "Jobs", es: "Trabajos" },
+  "jobs.runs.title": { de: "Job-Läufe", en: "Job runs", es: "Ejecuciones de trabajos" },
+  "jobs.runs.loading": { de: "Lade Läufe…", en: "Loading runs…", es: "Cargando ejecuciones…" },
+  "jobs.runs.empty": {
+    de: "Keine Job-Läufe.",
+    en: "No job runs.",
+    es: "No hay ejecuciones de trabajos.",
+  },
+  "jobs.runs.open": { de: "Details", en: "Details", es: "Detalles" },
+  "jobs.runs.filter.status": { de: "Status", en: "Status", es: "Estado" },
+  "jobs.runs.filter.all": { de: "Alle", en: "All", es: "Todos" },
+  "jobs.runs.filter.completed": { de: "Abgeschlossen", en: "Completed", es: "Completado" },
+  "jobs.runs.filter.failed": { de: "Fehlgeschlagen", en: "Failed", es: "Fallido" },
+  "jobs.runs.filter.running": { de: "Läuft", en: "Running", es: "En curso" },
+  "jobs.runs.filter.queued": { de: "Wartend", en: "Queued", es: "En cola" },
+  "jobs.runs.col.job": { de: "Job", en: "Job", es: "Trabajo" },
+  "jobs.runs.col.status": { de: "Status", en: "Status", es: "Estado" },
+  "jobs.runs.col.started": { de: "Gestartet", en: "Started", es: "Iniciado" },
+  "jobs.runs.col.duration": { de: "Dauer (ms)", en: "Duration (ms)", es: "Duración (ms)" },
+  "jobs.detail.loading": { de: "Lade Details…", en: "Loading details…", es: "Cargando detalles…" },
+  "jobs.detail.missing": {
+    de: "Lauf nicht gefunden.",
+    en: "Run not found.",
+    es: "Ejecución no encontrada.",
+  },
+  "jobs.detail.field.job": { de: "Job", en: "Job", es: "Trabajo" },
+  "jobs.detail.field.status": { de: "Status", en: "Status", es: "Estado" },
+  "jobs.detail.field.id": { de: "Run-ID", en: "Run ID", es: "ID de ejecución" },
+  "jobs.detail.field.started": { de: "Gestartet", en: "Started", es: "Iniciado" },
+  "jobs.detail.field.finished": { de: "Beendet", en: "Finished", es: "Finalizado" },
+  "jobs.detail.field.duration": { de: "Dauer (ms)", en: "Duration (ms)", es: "Duración (ms)" },
+  "jobs.detail.field.error": { de: "Fehler", en: "Error", es: "Error" },
+  "jobs.detail.logs": { de: "Logs", en: "Logs", es: "Registros" },
+  "jobs.detail.logs.empty": {
+    de: "Keine Log-Zeilen.",
+    en: "No log lines.",
+    es: "No hay líneas de registro.",
+  },
+  "jobs.detail.retry": { de: "Erneut ausführen", en: "Retry", es: "Reintentar" },
+  "jobs.detail.retrying": { de: "Wird erneut gestartet…", en: "Retrying…", es: "Reintentando…" },
+  "jobs.trigger.title": { de: "Job starten", en: "Run a job", es: "Ejecutar un trabajo" },
   "jobs.trigger.explainer": {
     de: "Nur manuell startbare Jobs. Nach dem Start erscheint der Lauf in der Historie unten.",
     en: "Only manually triggerable jobs. After starting, the run appears in the history below.",
+    es: "Solo trabajos que se pueden iniciar manualmente. Tras iniciarlo, la ejecución aparece en el historial de abajo.",
   },
-  "jobs.trigger.job": { de: "Job", en: "Job" },
-  "jobs.trigger.payload": { de: "Payload (JSON)", en: "Payload (JSON)" },
-  "jobs.trigger.payload.hint": { de: "Schema-Hinweis", en: "Schema hint" },
+  "jobs.trigger.job": { de: "Job", en: "Job", es: "Trabajo" },
+  "jobs.trigger.payload": { de: "Payload (JSON)", en: "Payload (JSON)", es: "Payload (JSON)" },
+  "jobs.trigger.payload.hint": { de: "Schema-Hinweis", en: "Schema hint", es: "Pista de esquema" },
   "jobs.trigger.payload.invalidJson": {
     de: "Payload ist kein gültiges JSON-Objekt.",
     en: "Payload is not a valid JSON object.",
+    es: "El payload no es un objeto JSON válido.",
   },
-  "jobs.trigger.submit": { de: "Starten", en: "Run" },
-  "jobs.trigger.submitting": { de: "Wird gestartet…", en: "Starting…" },
-  "jobs.trigger.success": { de: "Job gestartet.", en: "Job started." },
+  "jobs.trigger.submit": { de: "Starten", en: "Run", es: "Ejecutar" },
+  "jobs.trigger.submitting": { de: "Wird gestartet…", en: "Starting…", es: "Iniciando…" },
+  "jobs.trigger.success": { de: "Job gestartet.", en: "Job started.", es: "Trabajo iniciado." },
   "jobs.trigger.empty": {
     de: "Keine manuell startbaren Jobs registriert.",
     en: "No manually triggerable jobs are registered.",
+    es: "No hay trabajos registrados que se puedan iniciar manualmente.",
   },
   "jobs.trigger.perTenant": {
     de: "Läuft einmal pro aktivem Tenant.",
     en: "Runs once per active tenant.",
+    es: "Se ejecuta una vez por cada organización activa.",
+  },
+  "jobs.errors.unknownJob": {
+    de: "Unbekannter Job.",
+    en: "Unknown job.",
+    es: "Trabajo desconocido.",
   },
-  "jobs.errors.unknownJob": { de: "Unbekannter Job.", en: "Unknown job." },
   "jobs.errors.notManual": {
     de: "Dieser Job ist nicht manuell startbar.",
     en: "This job cannot be triggered manually.",
+    es: "Este trabajo no se puede iniciar manualmente.",
   },
-  "jobs.errors.notFound": { de: "Nicht gefunden.", en: "Not found." },
+  "jobs.errors.notFound": { de: "Nicht gefunden.", en: "Not found.", es: "No encontrado." },
   "jobs.errors.onlyFailedCanRetry": {
     de: "Nur fehlgeschlagene Läufe können erneut gestartet werden.",
     en: "Only failed runs can be retried.",
+    es: "Solo se pueden reintentar las ejecuciones fallidas.",
   },
 };

package/src/jobs/web/i18n.ts

@@ -2,7 +2,7 @@
 import type { TranslationsByLocale } from "@cosmicdrift/kumiko-renderer";
 import { JOBS_I18N } from "../i18n";
 
-const LOCALES = ["de", "en"] as const;
+const LOCALES = ["de", "en", "es"] as const;
 
 export const defaultTranslations: TranslationsByLocale = Object.fromEntries(
   LOCALES.map((locale) => [

package/src/managed-pages/i18n.ts

@@ -11,56 +11,96 @@
 // registriert. Die zwei customCss-Keys werden unconditional geliefert (schaden
 // bei allowCustomCss:false nicht, sind aber Pflicht für Consumer die es aktivieren).
 
-type LocalizedString = { readonly de: string; readonly en: string };
+type LocalizedString = { readonly de: string; readonly en: string; readonly es: string };
 
 export const MANAGED_PAGES_I18N: Readonly<Record<string, LocalizedString>> = {
   // Screen-Titel (global/unpräfixiert — screenTitleKey = screen:<id>.title)
-  "screen:page-list.title": { de: "Seiten", en: "Pages" },
-  "screen:page-edit.title": { de: "Seite bearbeiten", en: "Edit page" },
-  "screen:branding-settings.title": { de: "Branding", en: "Branding" },
+  "screen:page-list.title": { de: "Seiten", en: "Pages", es: "Páginas" },
+  "screen:page-edit.title": { de: "Seite bearbeiten", en: "Edit page", es: "Editar página" },
+  "screen:branding-settings.title": { de: "Branding", en: "Branding", es: "Marca" },
 
   // Page-Entity Feld-Labels (managed-pages:entity:page:field:*)
-  "managed-pages:entity:page:field:slug": { de: "Slug", en: "Slug" },
-  "managed-pages:entity:page:field:lang": { de: "Sprache", en: "Language" },
-  "managed-pages:entity:page:field:title": { de: "Titel", en: "Title" },
-  "managed-pages:entity:page:field:published": { de: "Veröffentlicht", en: "Published" },
+  "managed-pages:entity:page:field:slug": { de: "Slug", en: "Slug", es: "Slug" },
+  "managed-pages:entity:page:field:lang": { de: "Sprache", en: "Language", es: "Idioma" },
+  "managed-pages:entity:page:field:title": { de: "Titel", en: "Title", es: "Título" },
+  "managed-pages:entity:page:field:published": {
+    de: "Veröffentlicht",
+    en: "Published",
+    es: "Publicado",
+  },
   "managed-pages:entity:page:field:published:option:true": {
     de: "Veröffentlicht",
     en: "Published",
+    es: "Publicado",
+  },
+  "managed-pages:entity:page:field:published:option:false": {
+    de: "Entwurf",
+    en: "Draft",
+    es: "Borrador",
+  },
+  "managed-pages:entity:page:field:description": {
+    de: "Beschreibung",
+    en: "Description",
+    es: "Descripción",
   },
-  "managed-pages:entity:page:field:published:option:false": { de: "Entwurf", en: "Draft" },
-  "managed-pages:entity:page:field:description": { de: "Beschreibung", en: "Description" },
-  "managed-pages:entity:page:field:ogImage": { de: "OG-Bild", en: "OG image" },
-  "managed-pages:entity:page:field:body": { de: "Inhalt", en: "Content" },
+  "managed-pages:entity:page:field:ogImage": { de: "OG-Bild", en: "OG image", es: "Imagen OG" },
+  "managed-pages:entity:page:field:body": { de: "Inhalt", en: "Content", es: "Contenido" },
 
   // Config-Edit Feld-Labels (managed-pages:entity:__config-edit__:field:*, camelCase Form-Keys)
-  "managed-pages:entity:__config-edit__:field:title": { de: "Website-Titel", en: "Site title" },
+  "managed-pages:entity:__config-edit__:field:title": {
+    de: "Website-Titel",
+    en: "Site title",
+    es: "Título del sitio",
+  },
   "managed-pages:entity:__config-edit__:field:description": {
     de: "Beschreibung",
     en: "Description",
+    es: "Descripción",
+  },
+  "managed-pages:entity:__config-edit__:field:siteUrl": {
+    de: "Website-URL",
+    en: "Site URL",
+    es: "URL del sitio",
   },
-  "managed-pages:entity:__config-edit__:field:siteUrl": { de: "Website-URL", en: "Site URL" },
   "managed-pages:entity:__config-edit__:field:accentColor": {
     de: "Akzentfarbe",
     en: "Accent color",
+    es: "Color de acento",
+  },
+  "managed-pages:entity:__config-edit__:field:logoUrl": {
+    de: "Logo-URL",
+    en: "Logo URL",
+    es: "URL del logo",
+  },
+  "managed-pages:entity:__config-edit__:field:layoutPreset": {
+    de: "Layout",
+    en: "Layout",
+    es: "Diseño",
   },
-  "managed-pages:entity:__config-edit__:field:logoUrl": { de: "Logo-URL", en: "Logo URL" },
-  "managed-pages:entity:__config-edit__:field:layoutPreset": { de: "Layout", en: "Layout" },
 
   // Section-Header
-  "managed-pages:section.meta": { de: "Metadaten", en: "Metadata" },
-  "managed-pages:section.body": { de: "Inhalt", en: "Content" },
-  "managed-pages:branding.section.identity": { de: "Identität", en: "Identity" },
+  "managed-pages:section.meta": { de: "Metadaten", en: "Metadata", es: "Metadatos" },
+  "managed-pages:section.body": { de: "Inhalt", en: "Content", es: "Contenido" },
+  "managed-pages:branding.section.identity": { de: "Identität", en: "Identity", es: "Identidad" },
 
   // Row-Actions + Confirm (pageListScreen)
-  "managed-pages:actions.edit": { de: "Bearbeiten", en: "Edit" },
-  "managed-pages:actions.delete": { de: "Löschen", en: "Delete" },
+  "managed-pages:actions.edit": { de: "Bearbeiten", en: "Edit", es: "Editar" },
+  "managed-pages:actions.delete": { de: "Löschen", en: "Delete", es: "Eliminar" },
   "managed-pages:confirms.page-delete": {
     de: "Diese Seite wirklich löschen?",
     en: "Delete this page?",
+    es: "¿Seguro que quieres eliminar esta página?",
   },
 
   // Nur bei allowCustomCss:true im Screen — unconditional geliefert
-  "managed-pages:entity:__config-edit__:field:customCss": { de: "Eigenes CSS", en: "Custom CSS" },
-  "managed-pages:branding.section.custom-css": { de: "Eigenes CSS", en: "Custom CSS" },
+  "managed-pages:entity:__config-edit__:field:customCss": {
+    de: "Eigenes CSS",
+    en: "Custom CSS",
+    es: "CSS personalizado",
+  },
+  "managed-pages:branding.section.custom-css": {
+    de: "Eigenes CSS",
+    en: "Custom CSS",
+    es: "CSS personalizado",
+  },
 };

package/src/managed-pages/web/i18n.ts

@@ -12,7 +12,7 @@
 import type { TranslationsByLocale } from "@cosmicdrift/kumiko-renderer";
 import { MANAGED_PAGES_I18N } from "../i18n";
 
-const LOCALES = ["de", "en"] as const;
+const LOCALES = ["de", "en", "es"] as const;
 
 export const defaultTranslations: TranslationsByLocale = Object.fromEntries(
   LOCALES.map((locale) => [

package/src/notes-history/i18n.ts

@@ -1,3 +1,3 @@
-type LocalizedString = { readonly de: string; readonly en: string };
+type LocalizedString = { readonly de: string; readonly en: string; readonly es: string };
 
 export const NOTES_HISTORY_FEATURE_I18N: Readonly<Record<string, LocalizedString>> = {};

package/src/notes-history/web/i18n.ts

@@ -23,4 +23,12 @@ export const defaultTranslations: TranslationsByLocale = {
     "notesHistory.section.add": "Add note",
     "notesHistory.section.meta": "{author} · {date}",
   },
+  es: {
+    "notesHistory.section.createMode": "Guarda primero la entrada para poder añadir notas.",
+    "notesHistory.section.loading": "Cargando…",
+    "notesHistory.section.empty": "Aún no hay notas.",
+    "notesHistory.section.working": "Guardando…",
+    "notesHistory.section.add": "Añadir nota",
+    "notesHistory.section.meta": "{author} · {date}",
+  },
 };

package/src/personal-access-tokens/i18n.ts

@@ -1,5 +1,9 @@
-type LocalizedString = { readonly de: string; readonly en: string };
+type LocalizedString = { readonly de: string; readonly en: string; readonly es: string };
 
 export const PAT_FEATURE_I18N: Readonly<Record<string, LocalizedString>> = {
-  "screen:api-tokens.title": { de: "Personal Access Tokens", en: "Personal Access Tokens" },
+  "screen:api-tokens.title": {
+    de: "Personal Access Tokens",
+    en: "Personal Access Tokens",
+    es: "Tokens de acceso personal",
+  },
 };

package/src/personal-access-tokens/web/i18n.ts

@@ -74,4 +74,39 @@ export const defaultTranslations: TranslationsByLocale = {
     "pat.list.created": "Created {date}",
     "pat.error.generic": "Action failed.",
   },
+  es: {
+    "pat.title": "Tokens de acceso personal",
+    "pat.create.title": "Crear un token nuevo",
+    "pat.create.subtitle": "Elige los permisos y una caducidad. El token solo se muestra una vez.",
+    "pat.create.name": "Nombre",
+    "pat.create.namePlaceholder": "p. ej. automatización de CLI",
+    "pat.create.scopes": "Acceso por ámbito",
+    "pat.level.none": "Sin acceso",
+    "pat.level.read": "Lectura",
+    "pat.level.write": "Lectura y escritura",
+    "pat.create.expiry": "Válido hasta",
+    "pat.create.submit": "Crear token",
+    "pat.create.needName": "Indica un nombre.",
+    "pat.create.needScope": "Selecciona al menos un permiso.",
+    "pat.create.needPassword": "Introduce tu contraseña para confirmar.",
+    "pat.create.currentPassword": "Contraseña (para confirmar)",
+    "pat.create.mfaCode": "Código 2FA (si está activado)",
+    "pat.create.mfaCodePlaceholder": "Código de 6 dígitos",
+    "pat.expiry.30d": "30 días",
+    "pat.expiry.90d": "90 días",
+    "pat.expiry.1y": "1 año",
+    "pat.expiry.never": "Sin caducidad",
+    "pat.created.hint": "Copia este token ahora — por seguridad solo se muestra esta vez.",
+    "pat.created.copy": "Copiar",
+    "pat.created.copied": "Copiado ✓",
+    "pat.created.dismiss": "Listo",
+    "pat.list.title": "Tus tokens",
+    "pat.list.empty": "Todavía no hay tokens.",
+    "pat.list.revoke": "Revocar",
+    "pat.list.revoked": "Revocado",
+    "pat.list.validUntil": "Válido hasta {date}",
+    "pat.list.neverExpires": "Sin caducidad",
+    "pat.list.created": "Creado el {date}",
+    "pat.error.generic": "La acción ha fallado.",
+  },
 };

package/src/sessions/i18n.ts

@@ -1,23 +1,27 @@
 // @runtime client
 // Server + client i18n for the sessions operator screens.
 
-type LocalizedString = { readonly de: string; readonly en: string };
+type LocalizedString = { readonly de: string; readonly en: string; readonly es: string };
 
 export const SESSIONS_I18N: Readonly<Record<string, LocalizedString>> = {
-  "screen:session-list.title": { de: "Sitzungen", en: "Sessions" },
-  "screen:session-detail.title": { de: "Sitzung", en: "Session" },
-  "sessions:nav.sessionList": { de: "Sitzungen", en: "Sessions" },
-  "sessions.list.col.id": { de: "ID", en: "ID" },
-  "sessions.list.col.userId": { de: "User-ID", en: "User ID" },
-  "sessions.list.col.createdAt": { de: "Erstellt", en: "Created" },
-  "sessions.list.col.expiresAt": { de: "Läuft ab", en: "Expires" },
-  "sessions.list.col.revokedAt": { de: "Widerrufen", en: "Revoked" },
-  "sessions.list.action.open": { de: "Details", en: "Details" },
-  "sessions.detail.field.id": { de: "ID", en: "ID" },
-  "sessions.detail.field.userId": { de: "User-ID", en: "User ID" },
-  "sessions.detail.field.createdAt": { de: "Erstellt", en: "Created" },
-  "sessions.detail.field.expiresAt": { de: "Läuft ab", en: "Expires" },
-  "sessions.detail.field.revokedAt": { de: "Widerrufen", en: "Revoked" },
-  "sessions.detail.field.ip": { de: "IP-Adresse", en: "IP address" },
-  "sessions.detail.field.userAgent": { de: "User-Agent", en: "User agent" },
+  "screen:session-list.title": { de: "Sitzungen", en: "Sessions", es: "Sesiones" },
+  "screen:session-detail.title": { de: "Sitzung", en: "Session", es: "Sesión" },
+  "sessions:nav.sessionList": { de: "Sitzungen", en: "Sessions", es: "Sesiones" },
+  "sessions.list.col.id": { de: "ID", en: "ID", es: "ID" },
+  "sessions.list.col.userId": { de: "User-ID", en: "User ID", es: "ID de usuario" },
+  "sessions.list.col.createdAt": { de: "Erstellt", en: "Created", es: "Creado" },
+  "sessions.list.col.expiresAt": { de: "Läuft ab", en: "Expires", es: "Caduca" },
+  "sessions.list.col.revokedAt": { de: "Widerrufen", en: "Revoked", es: "Revocado" },
+  "sessions.list.action.open": { de: "Details", en: "Details", es: "Detalles" },
+  "sessions.detail.field.id": { de: "ID", en: "ID", es: "ID" },
+  "sessions.detail.field.userId": { de: "User-ID", en: "User ID", es: "ID de usuario" },
+  "sessions.detail.field.createdAt": { de: "Erstellt", en: "Created", es: "Creado" },
+  "sessions.detail.field.expiresAt": { de: "Läuft ab", en: "Expires", es: "Caduca" },
+  "sessions.detail.field.revokedAt": { de: "Widerrufen", en: "Revoked", es: "Revocado" },
+  "sessions.detail.field.ip": { de: "IP-Adresse", en: "IP address", es: "Dirección IP" },
+  "sessions.detail.field.userAgent": {
+    de: "User-Agent",
+    en: "User agent",
+    es: "Agente de usuario",
+  },
 };

package/src/tags/i18n.ts

@@ -1,5 +1,5 @@
-type LocalizedString = { readonly de: string; readonly en: string };
+type LocalizedString = { readonly de: string; readonly en: string; readonly es: string };
 
 export const TAGS_FEATURE_I18N: Readonly<Record<string, LocalizedString>> = {
-  "screen:tag-list.title": { de: "Tags", en: "Tags" },
+  "screen:tag-list.title": { de: "Tags", en: "Tags", es: "Etiquetas" },
 };

package/src/tags/web/i18n.ts

@@ -57,4 +57,29 @@ export const defaultTranslations: TranslationsByLocale = {
     "tags.filter.label": "Filter by tag",
     "tags.filter.clear": "Clear",
   },
+  es: {
+    "tags.section.createMode": "Guarda primero la entrada para añadir etiquetas.",
+    "tags.section.loading": "Cargando…",
+    "tags.section.empty": "No se encontraron etiquetas.",
+    "tags.section.working": "Guardando…",
+    "tags.section.none": "Sin etiquetas",
+    "tags.section.edit": "Editar etiquetas",
+    "tags.manage.newLabel": "Nueva etiqueta",
+    "tags.manage.namePlaceholder": "Nombre de la etiqueta",
+    "tags.manage.scopeLabel": "Ámbito (tipo de entidad, vacío = global)",
+    "tags.manage.scopePlaceholder": "p. ej. nota (vacío = en todas partes)",
+    "tags.manage.create": "Crear etiqueta",
+    "tags.manage.edit": "Editar",
+    "tags.manage.save": "Guardar",
+    "tags.manage.cancel": "Cancelar",
+    "tags.manage.delete": "Eliminar",
+    "tags.manage.toggle": "Alternar etiqueta",
+    "tags.manage.usage": "{count}×",
+    "tags.manage.deleteConfirmTitle": "¿Eliminar la etiqueta «{name}»?",
+    "tags.manage.deleteConfirmDesc": "Se quitará de {count} objetos. Esto no se puede deshacer.",
+    "tags.picker.title": "Etiquetas",
+    "tags.picker.done": "Listo",
+    "tags.filter.label": "Filtrar por etiqueta",
+    "tags.filter.clear": "Quitar filtro",
+  },
 };

package/src/template-resolver/web/i18n.ts

@@ -36,4 +36,18 @@ export const defaultTranslations: TranslationsByLocale = {
     "template-resolver.editor.readOnly":
       "Read-only — TenantAdmin or SystemAdmin role required to make changes.",
   },
+  es: {
+    "template-resolver.editor.titleLabel": "Título",
+    "template-resolver.editor.contentLabel": "Contenido",
+    "template-resolver.editor.save": "Guardar",
+    "template-resolver.editor.saving": "Guardando…",
+    "template-resolver.editor.created": "Creado.",
+    "template-resolver.editor.saved": "Guardado.",
+    "template-resolver.editor.saveFailed": "Error al guardar.",
+    "template-resolver.editor.networkError": "Error de red al guardar.",
+    "template-resolver.editor.loading": "Cargando versión actual…",
+    "template-resolver.editor.loadFailed": "No se pudo cargar el bloque",
+    "template-resolver.editor.readOnly":
+      "Solo lectura — se requiere el rol TenantAdmin o SystemAdmin para hacer cambios.",
+  },
 };