@flowdular/sdk 0.2.4 → 0.3.1

package/modules/audit/src/settings.ts

@@ -0,0 +1,69 @@
+import {
+	defineModuleSettings,
+	PLATFORM_SETTINGS_TENANT,
+	type ModuleSettingsRuntime,
+} from '@flowdular/sdk/kernel';
+
+export const AUDIT_MODULE_ID = 'audit.core';
+
+export const AUDIT_MODULE_SETTINGS = defineModuleSettings({
+	moduleId: AUDIT_MODULE_ID,
+	settings: {
+		sweepIntervalMinutes: {
+			type: 'number',
+			defaultValue: 60,
+			min: 5,
+			max: 1_440,
+			visibility: 'private',
+			client: false,
+			scope: 'platform',
+			labelKey: 'audit.settings.sweepIntervalMinutes.label',
+			label: 'Retention sweep interval (minutes)',
+			descriptionKey: 'audit.settings.sweepIntervalMinutes.description',
+			/* The loop arms its interval once, in the platform's start hook, so a
+			   value edited while it runs reaches it at the next start. The
+			   description says so rather than leaving an operator watching a
+			   cadence that did not change. */
+			description:
+				'How often the retention sweep looks for classes whose period has passed. A new value applies the next time the platform starts.',
+		},
+		sweepBatchSize: {
+			type: 'number',
+			defaultValue: 500,
+			min: 50,
+			max: 5_000,
+			visibility: 'private',
+			client: false,
+			scope: 'platform',
+			labelKey: 'audit.settings.sweepBatchSize.label',
+			label: 'Retention sweep batch size',
+			descriptionKey: 'audit.settings.sweepBatchSize.description',
+			description:
+				'Rows the owning module removes per call, per class, until fewer than this come back.',
+		},
+	},
+});
+
+const DEFAULTS = AUDIT_MODULE_SETTINGS.settings;
+
+/* A setting read must never take the sweep down, so every accessor falls back
+   to the declared default when the runtime has not registered it yet. */
+function value(
+	settings: ModuleSettingsRuntime,
+	key: keyof typeof DEFAULTS,
+	fallback: number,
+): number {
+	try {
+		return settings.get<number>(PLATFORM_SETTINGS_TENANT, AUDIT_MODULE_ID, key);
+	} catch {
+		return fallback;
+	}
+}
+
+export function auditSweepIntervalMs(settings: ModuleSettingsRuntime): number {
+	return value(settings, 'sweepIntervalMinutes', 60) * 60_000;
+}
+
+export function auditSweepBatchSize(settings: ModuleSettingsRuntime): number {
+	return value(settings, 'sweepBatchSize', 500);
+}

package/modules/audit/translations/en.json

@@ -0,0 +1,210 @@
+{
+	"module.name": "Audit and Data Lifecycle Core",
+	"navigation.dataClasses": "Data classes",
+	"navigation.dataClassesDescription": "What this workspace holds and how long each class is kept.",
+	"navigation.sweeps": "Retention sweeps",
+	"navigation.sweepsDescription": "Every retention pass, what it removed and why it was refused.",
+	"navigation.exports": "Exports",
+	"navigation.exportsDescription": "The archives an operator took of this workspace.",
+	"common.administration": "Administration",
+	"common.refresh": "Refresh",
+	"common.refreshing": "Refreshing…",
+	"common.saving": "Saving…",
+	"common.close": "Close",
+	"common.actions": "Actions",
+	"common.filters": "Filters",
+	"common.messages": "Messages",
+	"common.accessDenied": "Access denied",
+	"common.never": "Never",
+	"common.none": "None",
+	"common.yes": "Yes",
+	"common.no": "No",
+	"retention.kept": "Kept until deleted",
+	"retention.days": "{days} days",
+	"retention.defaultKept": "Default: kept until deleted",
+	"retention.defaultDays": "Default: {days} days",
+	"retention.mode.default": "Follow the module default",
+	"retention.mode.days": "Keep for a number of days",
+	"retention.mode.none": "Keep until a person deletes",
+	"reason.BACKUP_MANIFEST_MISSING": "No backup manifest is recorded for this deployment.",
+	"reason.LEGAL_HOLD": "A legal hold covers this class.",
+	"reason.OWNER_SWEEP_FAILED": "The owning module could not remove the rows.",
+	"reason.BATCH_CAP_REACHED": "The pass reached its batch limit and continues at the next interval.",
+	"dataClasses.title": "Data classes",
+	"dataClasses.description": "Every class a composed module declared, the period this workspace keeps it for, and when the sweep last ran.",
+	"dataClasses.denied": "You need the audit registry permission to see what this workspace holds.",
+	"dataClasses.holdNothing": "These modules hold no data class: {modules}.",
+	"dataClasses.note": "Removal happens inside the owning module. audit.core never reads another module's tables.",
+	"dataClasses.table.title": "Declared classes",
+	"dataClasses.table.caption": "Data classes of this workspace",
+	"dataClasses.table.count": "{count} classes",
+	"dataClasses.table.loading": "Loading data classes…",
+	"dataClasses.column.classId": "Class",
+	"dataClasses.column.moduleId": "Module",
+	"dataClasses.column.retention": "Retention",
+	"dataClasses.column.defaultRetention": "Module default",
+	"dataClasses.column.exportable": "Exportable",
+	"dataClasses.column.lastSweptAt": "Last swept",
+	"dataClasses.search.label": "Search data classes",
+	"dataClasses.search.placeholder": "Class id or label",
+	"dataClasses.filter.module": "Module",
+	"dataClasses.filter.allModules": "All modules",
+	"dataClasses.empty.title": "No data classes yet",
+	"dataClasses.empty.hint": "Classes appear as soon as a composed module declares them.",
+	"dataClasses.emptyFiltered.title": "No class matches",
+	"dataClasses.emptyFiltered.hint": "Clear the search or the module filter.",
+	"dataClasses.action.setRetention": "Set retention",
+	"dataClasses.action.save": "Save period",
+	"dataClasses.form.title": "Retention period",
+	"dataClasses.form.mode": "Period",
+	"dataClasses.form.modeHelp": "The module default applies until this workspace sets its own.",
+	"dataClasses.form.notSweepable": "This class declares no sweep operation, so it is kept until a person deletes it.",
+	"dataClasses.form.days": "Days",
+	"dataClasses.form.daysHelp": "1 to 36500 days. Zero is refused.",
+	"dataClasses.form.daysInvalid": "Enter a whole number of days between 1 and 36500.",
+	"dataClasses.form.constraint": "Changing a period is recorded in the audit trail.",
+	"dataClasses.notice.saved": "Retention period saved.",
+	"dataClasses.error.load": "Could not load the data class registry.",
+	"dataClasses.error.save": "Could not save the retention period.",
+	"sweeps.title": "Retention sweeps",
+	"sweeps.description": "One row per retention pass over one class, with the cutoff it used and how many rows the owning module removed.",
+	"sweeps.denied": "You need the audit registry permission to see the sweep ledger.",
+	"sweeps.note": "A refusal stands until the deployment answers it; the next pass does not repeat it.",
+	"sweeps.table.title": "Sweep ledger",
+	"sweeps.table.caption": "Retention sweeps of this workspace",
+	"sweeps.table.count": "{count} sweeps",
+	"sweeps.table.loading": "Loading sweeps…",
+	"sweeps.column.occurredAt": "When",
+	"sweeps.column.dataClass": "Data class",
+	"sweeps.column.cutoff": "Cutoff",
+	"sweeps.column.removed": "Removed",
+	"sweeps.column.status": "Status",
+	"sweeps.column.reason": "Reason",
+	"sweeps.status.completed": "Completed",
+	"sweeps.status.partial": "Partial",
+	"sweeps.status.refused": "Refused",
+	"sweeps.search.label": "Search sweeps",
+	"sweeps.search.placeholder": "Class id",
+	"sweeps.filter.status": "Status",
+	"sweeps.filter.allStatuses": "All statuses",
+	"sweeps.empty.title": "No sweep has run yet",
+	"sweeps.empty.hint": "A pass appears once a class has a period and its first interval passed.",
+	"sweeps.emptyFiltered.title": "No sweep matches",
+	"sweeps.emptyFiltered.hint": "Clear the search or the status filter.",
+	"sweeps.error.load": "Could not load the sweep ledger.",
+	"exports.title": "Exports",
+	"exports.description": "Every archive an operator took of this workspace, with the digest of the file that was written.",
+	"exports.denied": "You need the audit registry permission to see the export history.",
+	"exports.note": "An export is produced by the operator command; a download from this screen waits for file storage.",
+	"exports.table.title": "Export history",
+	"exports.table.caption": "Exports of this workspace",
+	"exports.table.count": "{count} exports",
+	"exports.table.loading": "Loading exports…",
+	"exports.column.startedAt": "Started and finished",
+	"exports.column.status": "Status",
+	"exports.column.classes": "Classes",
+	"exports.column.rows": "Rows",
+	"exports.column.archiveDigest": "Archive digest",
+	"exports.column.requestedBy": "Requested by",
+	"exports.status.started": "Running",
+	"exports.status.completed": "Completed",
+	"exports.status.failed": "Failed",
+	"exports.search.label": "Search exports",
+	"exports.search.placeholder": "Operator",
+	"exports.filter.status": "Status",
+	"exports.filter.allStatuses": "All statuses",
+	"exports.empty.title": "No export yet",
+	"exports.empty.hint": "An operator takes one with the audit export command.",
+	"exports.emptyFiltered.title": "No export matches",
+	"exports.emptyFiltered.hint": "Clear the search or the status filter.",
+	"exports.error.load": "Could not load the export history.",
+	"pagination.label": "Pages",
+	"pagination.previous": "Previous",
+	"pagination.next": "Next",
+	"pagination.size": "Rows per page",
+	"pagination.summary": "Page {page} of {pages}, rows {from} to {to} of {total}",
+	"settings.sweepIntervalMinutes.label": "Retention sweep interval (minutes)",
+	"settings.sweepIntervalMinutes.description": "How often the retention sweep looks for classes whose period has passed. A new value applies the next time the platform starts.",
+	"settings.sweepBatchSize.label": "Retention sweep batch size",
+	"settings.sweepBatchSize.description": "Rows the owning module removes per call, per class, until fewer than this come back.",
+	"error.request": "The audit operation failed.",
+	"error.code.DATA_CLASS_NOT_FOUND": "No composed module declares this data class.",
+	"error.code.DATA_CLASS_NOT_SWEEPABLE": "This class declares no sweep operation, so it can only be kept until a person deletes it.",
+	"error.code.INVALID_INPUT": "The value sent is outside what this field accepts.",
+	"error.code.CSRF_REJECTED": "Your session could not be verified. Reload the page and try again.",
+	"navigation.holds": "Legal holds",
+	"navigation.holdsDescription": "What this workspace may not remove, and why.",
+	"reason.HOLD_ACTIVE": "A legal hold covers this class.",
+	"reason.SEGMENT_NOT_SEALED": "These events are in no segment file yet; seal the chain before retention may remove them.",
+	"holds.title": "Legal holds",
+	"holds.description": "Every standing instruction not to remove data, what it covers, who placed it and why.",
+	"holds.denied": "You need the audit registry permission to see the legal holds of this workspace.",
+	"holds.note": "While a hold stands the retention sweep and erasure refuse for everything it covers, and say so in the ledger.",
+	"holds.table.title": "Holds",
+	"holds.table.caption": "Legal holds of this workspace",
+	"holds.table.count": "{count} holds",
+	"holds.table.loading": "Loading legal holds…",
+	"holds.column.placedAt": "Placed",
+	"holds.column.scope": "Covers",
+	"holds.column.reason": "Reason",
+	"holds.column.placedBy": "Placed by",
+	"holds.column.status": "Status",
+	"holds.status.active": "Active",
+	"holds.status.lifted": "Lifted",
+	"holds.scope.account": "One account",
+	"holds.scope.workspace": "The whole workspace",
+	"holds.scope.data-class": "One data class",
+	"holds.scope.date-range": "A date range",
+	"holds.scope.wholeWorkspace": "Everything this workspace holds",
+	"holds.search.label": "Search legal holds",
+	"holds.search.placeholder": "Reason, account or class",
+	"holds.filter.status": "Status",
+	"holds.filter.allStatuses": "All statuses",
+	"holds.filter.scope": "Scope",
+	"holds.filter.allScopes": "All scopes",
+	"holds.empty.title": "No legal hold",
+	"holds.empty.hint": "Place one when data has to stay while a matter is open.",
+	"holds.emptyFiltered.title": "No hold matches",
+	"holds.emptyFiltered.hint": "Clear the search or the filters.",
+	"holds.action.place": "Place a hold",
+	"holds.action.lift": "Lift",
+	"holds.form.placeTitle": "Place a legal hold",
+	"holds.form.placeSubtitle": "Nothing it covers is removed until it is lifted.",
+	"holds.form.liftTitle": "Lift this legal hold",
+	"holds.form.scope": "Scope",
+	"holds.form.scopeHelp": "Pick what the hold is about; the fields below narrow it further.",
+	"holds.form.account": "Account",
+	"holds.form.accountHelp": "Required for an account hold; optional as a narrowing on any other.",
+	"holds.form.class": "Data class",
+	"holds.form.classHelp": "Required for a data class hold, for example agents.core.runs.",
+	"holds.form.from": "From",
+	"holds.form.to": "To",
+	"holds.form.reason": "Reason",
+	"holds.form.reasonHelp": "Why the data has to stay. Up to 400 characters, recorded in the audit trail.",
+	"holds.form.liftReason": "Reason for lifting",
+	"holds.form.liftReasonHelp": "Why the data may be removed again. Recorded in the audit trail.",
+	"holds.form.constraint": "Placing a hold is recorded in the audit trail.",
+	"holds.form.liftConstraint": "Lifting a hold is recorded in the audit trail.",
+	"holds.form.reasonInvalid": "Enter a reason of 1 to 400 characters.",
+	"holds.form.accountRequired": "An account hold needs the account it covers.",
+	"holds.form.classRequired": "A data class hold needs the class it covers.",
+	"holds.form.rangeRequired": "A date range hold needs both ends of the range.",
+	"holds.notice.placed": "Legal hold placed.",
+	"holds.notice.lifted": "Legal hold lifted.",
+	"holds.error.load": "Could not load the legal holds.",
+	"holds.error.place": "Could not place the legal hold.",
+	"holds.error.lift": "Could not lift the legal hold.",
+	"error.code.HOLD_ACTIVE": "A legal hold covers this data, so it cannot be removed.",
+	"error.code.HOLD_NOT_FOUND": "This workspace holds no such legal hold.",
+	"error.code.HOLD_SCOPE_INVALID": "The scope of the hold is incomplete or contradicts itself.",
+	"error.code.HOLD_LIMIT_REACHED": "This workspace already carries the maximum number of active holds.",
+	"error.code.SEGMENT_NOT_SEALED": "These audit events are in no segment file yet, so retention may not remove them.",
+	"holds.column.accountId": "Account",
+	"holds.column.classId": "Data class",
+	"reason.ERASURE_REQUEST_EXPIRED": "No running platform answered this erasure request within 24 hours.",
+	"error.code.FORBIDDEN": "Your account does not hold the permission this needs.",
+	"error.code.UNAUTHENTICATED": "Your session has ended. Sign in again.",
+	"error.code.TOKEN_MUTATION_DENIED": "An API token cannot make this change; use a signed-in session.",
+	"error.code.SUBJECT_KEY_DESTROYED": "The audit data key of this subject was destroyed, so nothing may name the subject again.",
+	"error.code.ERASURE_REQUEST_EXPIRED": "No running platform answered this erasure request within 24 hours."
+}

package/modules/audit/translations/pl.json

@@ -0,0 +1,210 @@
+{
+	"module.name": "Audyt i cykl życia danych",
+	"navigation.dataClasses": "Klasy danych",
+	"navigation.dataClassesDescription": "Co przechowuje ten obszar roboczy i jak długo trzymana jest każda klasa.",
+	"navigation.sweeps": "Przebiegi retencji",
+	"navigation.sweepsDescription": "Każdy przebieg retencji, co usunął i dlaczego został odrzucony.",
+	"navigation.exports": "Eksporty",
+	"navigation.exportsDescription": "Archiwa tego obszaru roboczego pobrane przez operatora.",
+	"common.administration": "Administracja",
+	"common.refresh": "Odśwież",
+	"common.refreshing": "Odświeżanie…",
+	"common.saving": "Zapisywanie…",
+	"common.close": "Zamknij",
+	"common.actions": "Akcje",
+	"common.filters": "Filtry",
+	"common.messages": "Komunikaty",
+	"common.accessDenied": "Brak dostępu",
+	"common.never": "Nigdy",
+	"common.none": "Brak",
+	"common.yes": "Tak",
+	"common.no": "Nie",
+	"retention.kept": "Przechowywane do usunięcia",
+	"retention.days": "{days} dni",
+	"retention.defaultKept": "Domyślnie: przechowywane do usunięcia",
+	"retention.defaultDays": "Domyślnie: {days} dni",
+	"retention.mode.default": "Zgodnie z domyślną wartością modułu",
+	"retention.mode.days": "Przechowuj przez określoną liczbę dni",
+	"retention.mode.none": "Przechowuj do usunięcia przez człowieka",
+	"reason.BACKUP_MANIFEST_MISSING": "To wdrożenie nie ma zapisanego manifestu kopii zapasowej.",
+	"reason.LEGAL_HOLD": "Tę klasę obejmuje blokada prawna.",
+	"reason.OWNER_SWEEP_FAILED": "Moduł właściciela nie zdołał usunąć wierszy.",
+	"reason.BATCH_CAP_REACHED": "Przebieg osiągnął limit partii i będzie kontynuowany w następnym interwale.",
+	"dataClasses.title": "Klasy danych",
+	"dataClasses.description": "Każda klasa zadeklarowana przez złożony moduł, okres przechowywania w tym obszarze roboczym i data ostatniego przebiegu.",
+	"dataClasses.denied": "Potrzebujesz uprawnienia do rejestru audytu, aby zobaczyć, co przechowuje ten obszar roboczy.",
+	"dataClasses.holdNothing": "Te moduły nie przechowują żadnej klasy danych: {modules}.",
+	"dataClasses.note": "Usuwanie odbywa się wewnątrz modułu właściciela. audit.core nigdy nie czyta tabel innego modułu.",
+	"dataClasses.table.title": "Zadeklarowane klasy",
+	"dataClasses.table.caption": "Klasy danych tego obszaru roboczego",
+	"dataClasses.table.count": "Liczba klas: {count}",
+	"dataClasses.table.loading": "Wczytywanie klas danych…",
+	"dataClasses.column.classId": "Klasa",
+	"dataClasses.column.moduleId": "Moduł",
+	"dataClasses.column.retention": "Retencja",
+	"dataClasses.column.defaultRetention": "Domyślna modułu",
+	"dataClasses.column.exportable": "Eksportowalna",
+	"dataClasses.column.lastSweptAt": "Ostatni przebieg",
+	"dataClasses.search.label": "Szukaj klas danych",
+	"dataClasses.search.placeholder": "Identyfikator lub nazwa klasy",
+	"dataClasses.filter.module": "Moduł",
+	"dataClasses.filter.allModules": "Wszystkie moduły",
+	"dataClasses.empty.title": "Brak klas danych",
+	"dataClasses.empty.hint": "Klasy pojawią się, gdy złożony moduł je zadeklaruje.",
+	"dataClasses.emptyFiltered.title": "Brak pasujących klas",
+	"dataClasses.emptyFiltered.hint": "Wyczyść wyszukiwanie lub filtr modułu.",
+	"dataClasses.action.setRetention": "Ustaw retencję",
+	"dataClasses.action.save": "Zapisz okres",
+	"dataClasses.form.title": "Okres retencji",
+	"dataClasses.form.mode": "Okres",
+	"dataClasses.form.modeHelp": "Domyślna wartość modułu obowiązuje, dopóki obszar roboczy nie ustawi własnej.",
+	"dataClasses.form.notSweepable": "Ta klasa nie deklaruje operacji czyszczenia, więc jest przechowywana do usunięcia przez człowieka.",
+	"dataClasses.form.days": "Dni",
+	"dataClasses.form.daysHelp": "Od 1 do 36500 dni. Zero jest odrzucane.",
+	"dataClasses.form.daysInvalid": "Podaj całkowitą liczbę dni od 1 do 36500.",
+	"dataClasses.form.constraint": "Zmiana okresu jest zapisywana w rejestrze audytu.",
+	"dataClasses.notice.saved": "Okres retencji zapisany.",
+	"dataClasses.error.load": "Nie udało się wczytać rejestru klas danych.",
+	"dataClasses.error.save": "Nie udało się zapisać okresu retencji.",
+	"sweeps.title": "Przebiegi retencji",
+	"sweeps.description": "Jeden wiersz na przebieg retencji jednej klasy, z użytą granicą czasu i liczbą wierszy usuniętych przez moduł właściciela.",
+	"sweeps.denied": "Potrzebujesz uprawnienia do rejestru audytu, aby zobaczyć rejestr przebiegów.",
+	"sweeps.note": "Odrzucenie obowiązuje, dopóki wdrożenie go nie rozwiąże; następny przebieg go nie powtarza.",
+	"sweeps.table.title": "Rejestr przebiegów",
+	"sweeps.table.caption": "Przebiegi retencji tego obszaru roboczego",
+	"sweeps.table.count": "Liczba przebiegów: {count}",
+	"sweeps.table.loading": "Wczytywanie przebiegów…",
+	"sweeps.column.occurredAt": "Kiedy",
+	"sweeps.column.dataClass": "Klasa danych",
+	"sweeps.column.cutoff": "Granica czasu",
+	"sweeps.column.removed": "Usunięto",
+	"sweeps.column.status": "Status",
+	"sweeps.column.reason": "Powód",
+	"sweeps.status.completed": "Zakończony",
+	"sweeps.status.partial": "Częściowy",
+	"sweeps.status.refused": "Odrzucony",
+	"sweeps.search.label": "Szukaj przebiegów",
+	"sweeps.search.placeholder": "Identyfikator klasy",
+	"sweeps.filter.status": "Status",
+	"sweeps.filter.allStatuses": "Wszystkie statusy",
+	"sweeps.empty.title": "Żaden przebieg jeszcze nie ruszył",
+	"sweeps.empty.hint": "Przebieg pojawi się, gdy klasa ma okres i minie jej pierwszy interwał.",
+	"sweeps.emptyFiltered.title": "Brak pasujących przebiegów",
+	"sweeps.emptyFiltered.hint": "Wyczyść wyszukiwanie lub filtr statusu.",
+	"sweeps.error.load": "Nie udało się wczytać rejestru przebiegów.",
+	"exports.title": "Eksporty",
+	"exports.description": "Każde archiwum tego obszaru roboczego pobrane przez operatora, wraz ze skrótem zapisanego pliku.",
+	"exports.denied": "Potrzebujesz uprawnienia do rejestru audytu, aby zobaczyć historię eksportów.",
+	"exports.note": "Eksport powstaje przez polecenie operatora; pobieranie z tego ekranu czeka na magazyn plików.",
+	"exports.table.title": "Historia eksportów",
+	"exports.table.caption": "Eksporty tego obszaru roboczego",
+	"exports.table.count": "Liczba eksportów: {count}",
+	"exports.table.loading": "Wczytywanie eksportów…",
+	"exports.column.startedAt": "Rozpoczęcie i zakończenie",
+	"exports.column.status": "Status",
+	"exports.column.classes": "Klasy",
+	"exports.column.rows": "Wiersze",
+	"exports.column.archiveDigest": "Skrót archiwum",
+	"exports.column.requestedBy": "Zlecone przez",
+	"exports.status.started": "W toku",
+	"exports.status.completed": "Zakończony",
+	"exports.status.failed": "Nieudany",
+	"exports.search.label": "Szukaj eksportów",
+	"exports.search.placeholder": "Operator",
+	"exports.filter.status": "Status",
+	"exports.filter.allStatuses": "Wszystkie statusy",
+	"exports.empty.title": "Brak eksportów",
+	"exports.empty.hint": "Operator wykonuje eksport poleceniem audit export.",
+	"exports.emptyFiltered.title": "Brak pasujących eksportów",
+	"exports.emptyFiltered.hint": "Wyczyść wyszukiwanie lub filtr statusu.",
+	"exports.error.load": "Nie udało się wczytać historii eksportów.",
+	"pagination.label": "Strony",
+	"pagination.previous": "Poprzednia",
+	"pagination.next": "Następna",
+	"pagination.size": "Wierszy na stronę",
+	"pagination.summary": "Strona {page} z {pages}, wiersze od {from} do {to} z {total}",
+	"settings.sweepIntervalMinutes.label": "Interwał przebiegu retencji (minuty)",
+	"settings.sweepIntervalMinutes.description": "Jak często czyszczenie retencyjne szuka klas, których okres minął. Nowa wartość obowiązuje przy następnym starcie platformy.",
+	"settings.sweepBatchSize.label": "Rozmiar partii przebiegu retencji",
+	"settings.sweepBatchSize.description": "Liczba wierszy usuwanych przez moduł właściciela w jednym wywołaniu, na klasę, aż wróci mniej niż tyle.",
+	"error.request": "Operacja audytu nie powiodła się.",
+	"error.code.DATA_CLASS_NOT_FOUND": "Żaden złożony moduł nie deklaruje tej klasy danych.",
+	"error.code.DATA_CLASS_NOT_SWEEPABLE": "Ta klasa nie deklaruje operacji czyszczenia, więc może być tylko przechowywana do usunięcia przez człowieka.",
+	"error.code.INVALID_INPUT": "Przesłana wartość wykracza poza to, co przyjmuje to pole.",
+	"error.code.CSRF_REJECTED": "Nie udało się zweryfikować sesji. Odśwież stronę i spróbuj ponownie.",
+	"navigation.holds": "Blokady prawne",
+	"navigation.holdsDescription": "Czego ten obszar roboczy nie może usunąć i dlaczego.",
+	"reason.HOLD_ACTIVE": "Tę klasę obejmuje blokada prawna.",
+	"reason.SEGMENT_NOT_SEALED": "Te zdarzenia nie trafiły jeszcze do żadnego pliku segmentu; zapieczętuj łańcuch, zanim retencja będzie mogła je usunąć.",
+	"holds.title": "Blokady prawne",
+	"holds.description": "Każde trwałe polecenie nieusuwania danych, jego zakres, kto je nałożył i dlaczego.",
+	"holds.denied": "Aby zobaczyć blokady prawne tego obszaru roboczego, potrzebujesz uprawnienia do rejestru audytu.",
+	"holds.note": "Dopóki blokada obowiązuje, przebieg retencji i usunięcie danych są odmawiane dla wszystkiego, co obejmuje, i zapisują to w rejestrze.",
+	"holds.table.title": "Blokady",
+	"holds.table.caption": "Blokady prawne tego obszaru roboczego",
+	"holds.table.count": "Blokady: {count}",
+	"holds.table.loading": "Wczytywanie blokad prawnych…",
+	"holds.column.placedAt": "Nałożono",
+	"holds.column.scope": "Obejmuje",
+	"holds.column.reason": "Powód",
+	"holds.column.placedBy": "Nałożył",
+	"holds.column.status": "Status",
+	"holds.status.active": "Aktywna",
+	"holds.status.lifted": "Zdjęta",
+	"holds.scope.account": "Jedno konto",
+	"holds.scope.workspace": "Cały obszar roboczy",
+	"holds.scope.data-class": "Jedna klasa danych",
+	"holds.scope.date-range": "Zakres dat",
+	"holds.scope.wholeWorkspace": "Wszystko, co przechowuje ten obszar roboczy",
+	"holds.search.label": "Szukaj blokad prawnych",
+	"holds.search.placeholder": "Powód, konto lub klasa",
+	"holds.filter.status": "Status",
+	"holds.filter.allStatuses": "Wszystkie statusy",
+	"holds.filter.scope": "Zakres",
+	"holds.filter.allScopes": "Wszystkie zakresy",
+	"holds.empty.title": "Brak blokad prawnych",
+	"holds.empty.hint": "Nałóż blokadę, gdy dane muszą pozostać na czas trwania sprawy.",
+	"holds.emptyFiltered.title": "Żadna blokada nie pasuje",
+	"holds.emptyFiltered.hint": "Wyczyść wyszukiwanie lub filtry.",
+	"holds.action.place": "Nałóż blokadę",
+	"holds.action.lift": "Zdejmij",
+	"holds.form.placeTitle": "Nałóż blokadę prawną",
+	"holds.form.placeSubtitle": "Nic, co obejmuje, nie zostanie usunięte, dopóki jej nie zdejmiesz.",
+	"holds.form.liftTitle": "Zdejmij tę blokadę prawną",
+	"holds.form.scope": "Zakres",
+	"holds.form.scopeHelp": "Wybierz, czego dotyczy blokada; pola poniżej zawężają ją dalej.",
+	"holds.form.account": "Konto",
+	"holds.form.accountHelp": "Wymagane dla blokady konta; opcjonalne jako zawężenie każdej innej.",
+	"holds.form.class": "Klasa danych",
+	"holds.form.classHelp": "Wymagane dla blokady klasy danych, na przykład agents.core.runs.",
+	"holds.form.from": "Od",
+	"holds.form.to": "Do",
+	"holds.form.reason": "Powód",
+	"holds.form.reasonHelp": "Dlaczego dane muszą pozostać. Do 400 znaków, zapisywane w dzienniku audytu.",
+	"holds.form.liftReason": "Powód zdjęcia",
+	"holds.form.liftReasonHelp": "Dlaczego dane mogą znów być usuwane. Zapisywane w dzienniku audytu.",
+	"holds.form.constraint": "Nałożenie blokady jest zapisywane w dzienniku audytu.",
+	"holds.form.liftConstraint": "Zdjęcie blokady jest zapisywane w dzienniku audytu.",
+	"holds.form.reasonInvalid": "Podaj powód o długości od 1 do 400 znaków.",
+	"holds.form.accountRequired": "Blokada konta wymaga wskazania konta, które obejmuje.",
+	"holds.form.classRequired": "Blokada klasy danych wymaga wskazania klasy, którą obejmuje.",
+	"holds.form.rangeRequired": "Blokada zakresu dat wymaga obu końców zakresu.",
+	"holds.notice.placed": "Blokada prawna nałożona.",
+	"holds.notice.lifted": "Blokada prawna zdjęta.",
+	"holds.error.load": "Nie udało się wczytać blokad prawnych.",
+	"holds.error.place": "Nie udało się nałożyć blokady prawnej.",
+	"holds.error.lift": "Nie udało się zdjąć blokady prawnej.",
+	"error.code.HOLD_ACTIVE": "Te dane obejmuje blokada prawna, więc nie można ich usunąć.",
+	"error.code.HOLD_NOT_FOUND": "Ten obszar roboczy nie ma takiej blokady prawnej.",
+	"error.code.HOLD_SCOPE_INVALID": "Zakres blokady jest niepełny albo wewnętrznie sprzeczny.",
+	"error.code.HOLD_LIMIT_REACHED": "Ten obszar roboczy osiągnął już maksymalną liczbę aktywnych blokad.",
+	"error.code.SEGMENT_NOT_SEALED": "Te zdarzenia audytu nie trafiły jeszcze do pliku segmentu, więc retencja nie może ich usunąć.",
+	"holds.column.accountId": "Konto",
+	"holds.column.classId": "Klasa danych",
+	"reason.ERASURE_REQUEST_EXPIRED": "Żadna działająca platforma nie odpowiedziała na to żądanie usunięcia w ciągu 24 godzin.",
+	"error.code.FORBIDDEN": "Twoje konto nie ma uprawnienia wymaganego do tej operacji.",
+	"error.code.UNAUTHENTICATED": "Sesja wygasła. Zaloguj się ponownie.",
+	"error.code.TOKEN_MUTATION_DENIED": "Token API nie może wykonać tej zmiany; użyj zalogowanej sesji.",
+	"error.code.SUBJECT_KEY_DESTROYED": "Klucz danych audytu tego podmiotu został zniszczony, więc nic nie może go ponownie nazwać.",
+	"error.code.ERASURE_REQUEST_EXPIRED": "Żadna działająca platforma nie odpowiedziała na to żądanie usunięcia w ciągu 24 godzin."
+}

package/modules/auth/README.md

@@ -15,26 +15,34 @@
 
 ## Routes
 
-| Method | Route                         | Purpose                                  |
-| ------ | ----------------------------- | ---------------------------------------- |
-| GET    | `/api/auth/config`            | Public sign-in configuration             |
-| GET    | `/api/auth/session`           | Resolve the current session              |
-| POST   | `/api/auth/sign-up`           | Create a tenant owner account            |
-| POST   | `/api/auth/sign-in`           | Create a new session                     |
-| POST   | `/api/auth/switch-tenant`     | Rotate into another membership           |
-| POST   | `/api/auth/sign-out`          | Revoke the current session               |
-| POST   | `/api/auth/password`          | Change the own password                  |
-| POST   | `/api/auth/workspace`         | Rename the active workspace              |
-| GET    | `/api/auth/api-tokens`        | List tenant API tokens                   |
-| POST   | `/api/auth/api-tokens`        | Issue an API token                       |
-| POST   | `/api/auth/api-tokens/revoke` | Revoke an API token                      |
-| GET    | `/api/auth/roles`             | Tenant roles and grantable scopes        |
-| POST   | `/api/auth/roles`             | Create a custom role                     |
-| POST   | `/api/auth/roles/update`      | Change a custom role                     |
-| POST   | `/api/auth/roles/delete`      | Delete an unused custom role             |
-| GET    | `/api/auth/audit`             | Page through the tenant audit trail      |
-| GET    | `/api/auth/sessions`          | List the own sessions                    |
-| POST   | `/api/auth/sessions/revoke`   | End an own session, or all of a member's |
+| Method | Route                               | Purpose                                   |
+| ------ | ----------------------------------- | ----------------------------------------- |
+| GET    | `/api/auth/config`                  | Public sign-in configuration              |
+| GET    | `/api/auth/session`                 | Resolve the current session               |
+| POST   | `/api/auth/sign-up`                 | Create a tenant owner account             |
+| POST   | `/api/auth/sign-in`                 | Create a new session                      |
+| POST   | `/api/auth/switch-tenant`           | Rotate into another membership            |
+| POST   | `/api/auth/sign-out`                | Revoke the current session                |
+| POST   | `/api/auth/password`                | Change the own password                   |
+| POST   | `/api/auth/workspace`               | Rename the active workspace               |
+| GET    | `/api/auth/api-tokens`              | List tenant API tokens                    |
+| POST   | `/api/auth/api-tokens`              | Issue an API token                        |
+| POST   | `/api/auth/api-tokens/revoke`       | Revoke an API token                       |
+| GET    | `/api/auth/roles`                   | Tenant roles and grantable scopes         |
+| POST   | `/api/auth/roles`                   | Create a custom role                      |
+| POST   | `/api/auth/roles/update`            | Change a custom role                      |
+| POST   | `/api/auth/roles/delete`            | Delete an unused custom role              |
+| GET    | `/api/auth/audit`                   | Page through the tenant audit trail       |
+| GET    | `/api/auth/sessions`                | List the own sessions                     |
+| POST   | `/api/auth/sessions/revoke`         | End an own session, or all of a member's  |
+| GET    | `/api/auth/providers`               | Workspace and platform identity providers |
+| POST   | `/api/auth/providers`               | Create a workspace identity provider      |
+| POST   | `/api/auth/providers/update`        | Change a workspace identity provider      |
+| POST   | `/api/auth/providers/enable`        | Offer it on the sign-in screen            |
+| POST   | `/api/auth/providers/disable`       | Stop offering it                          |
+| POST   | `/api/auth/providers/rotate-secret` | Replace its client secret                 |
+| POST   | `/api/auth/providers/delete`        | Delete a disabled provider                |
+| POST   | `/api/auth/memberships/status`      | Disable or re-enable one membership       |
 
 `GET /api/settings` and `POST /api/settings/update` are served by system.core;
 auth.core owns the store and appends the `settings.updated` audit row through
@@ -48,6 +56,42 @@ API tokens are machine credentials for clients that cannot hold a browser sessio
 
 A client presents it as `Authorization: Bearer clat_...`. The authentication middleware resolves it only when no session cookie is present, and the effective scopes are the intersection of the token's recorded scopes with the membership's current scopes. Session-guarded mutations reject tokens with `TOKEN_MUTATION_DENIED`, so a token can read platform data and prove sandbox authority but cannot drive CSRF-protected writes. Revocation, expiry, and scope removal take effect on the next request.
 
+## Identity providers
+
+A workspace adds OIDC providers of its own in Administration, Identity
+providers, behind `auth.providers.read` and `auth.providers.manage`. The issuer
+is verified through its discovery document when it is saved, the endpoints that
+document publishes are stored with it, and the client secret is sealed with the
+deployment authentication key (`FD_AUTH_MFA_KEY`) under a provider-specific
+context. Nothing returns the secret afterwards: administrators see its
+fingerprint, and `pnpm flowdular auth secrets-rotate` re-seals provider secrets
+beside the enrolled TOTP factors.
+
+Sign-in is routed by workspace. `GET /api/auth/config?workspace=<slug>` answers
+with the password form, that workspace's enabled providers and the platform
+providers from `FD_AUTH_OIDC_PROVIDERS`. A workspace provider starts at
+`/api/auth/oidc/<workspace>/<key>/start`; the signed state cookie binds both,
+and a callback whose state names another workspace is refused. A platform
+provider keeps its own `/api/auth/oidc/<id>/start` route and keeps binding
+identities without a workspace.
+
+Just-in-time provisioning is off per provider. Turned on, it takes a non-empty
+list of allowed e-mail domains and the role a new member receives (`member` by
+default). A verified address inside those domains creates or reuses the account,
+creates an active membership with the role's scopes and an `auth.member.provisioned`
+audit row. Without it, an external sign-in needs an existing membership; an
+address outside the domains is refused before anything is written.
+
+## Membership status
+
+Every membership carries its own status. `POST /api/auth/memberships/status`
+(`users.members.manage`, session and CSRF required) disables or re-enables the
+membership of the acting workspace: disabling revokes that workspace's sessions
+and API tokens for the account, refuses its sign-in and tenant switch, and
+leaves the person's other workspaces untouched. Re-enabling restores sign-in;
+the revoked tokens stay revoked. The account status column stays what it was,
+the deployment operator's platform-level block.
+
 ## Configuration
 
 | Variable                       | Default                                                             |
@@ -158,10 +202,10 @@ The command mints that token itself rather than going through
 `requestPasswordReset` or `createTenantInvitation`. Both of those hand their
 token to the injected `AuthMailDelivery` adapter and to nobody else:
 `createTenantInvitation` refuses with `MAIL_NOT_CONFIGURED` when none is
-composed, and `requestPasswordReset` returns silently. The only adapter that
-ships is in-memory and its flag is refused in production, so an operator
-standing at a shell on the server is the delivery channel, and the terminal is
-the one channel that always exists.
+composed, and `requestPasswordReset` answers generically while the server logs
+that the message was not delivered. A deployment that configures no transport
+still has an operator standing at a shell on the server as its delivery channel,
+and the terminal is the one channel that always exists.
 
 `--password-env` takes the **name** of an environment variable, never the
 password. A password passed as a flag value lands in shell history and in the
@@ -196,8 +240,8 @@ pnpm flowdular setup quick --apply --confirm reset-local-auth
 
 The command resets only the workspace's local embedded database, and refuses to run when a PostgreSQL server is configured. It creates:
 
-- `admin@example.com` / `Admin!23456789`, an owner of Operations Demo and Finance Demo.
-- `user@example.com` / `User!234567890`, a reduced-scope member of Operations Demo.
+- `admin@example.com` / `Owner!23456789`, an owner of Operations Demo and Finance Demo.
+- `user@example.com` / `Member!2345678`, a reduced-scope member of Operations Demo.
 
 The application shell exposes the active tenant selector. Switching it rotates the session cookie and reloads the target membership's role and scopes. All seed values are public development defaults. The command refuses a configured PostgreSQL server and non-development environments. `auth greenfield` remains the module-owned equivalent of `setup quick`.
 
@@ -210,6 +254,10 @@ tenant invitations, TOTP MFA, and OIDC use injected deployment configuration:
 `FD_AUTH_MFA_KEY` is a 32-byte AES key encoded as 64 hexadecimal characters
 or base64url, `FD_AUTH_PUBLIC_ORIGIN` is the public HTTPS origin, and
 `FD_AUTH_OIDC_PROVIDERS` is a JSON list of configured OIDC endpoints and
-credentials. Email delivery is injected through `AuthMailDelivery`; local-only
-evidence can use `FD_AUTH_DEVELOPMENT_MAIL=true`, which keeps messages in
-memory and never logs or exposes raw tokens.
+credentials, which every workspace is offered read-only. Email delivery is
+injected through `AuthMailDelivery` and selected
+by `FD_AUTH_MAIL_TRANSPORT`: `smtp` relays through `FD_AUTH_SMTP_URL` and
+`FD_AUTH_MAIL_FROM`, while `development` (also reached by the older
+`FD_AUTH_DEVELOPMENT_MAIL=true`) keeps messages in memory and is refused in
+production. No transport logs or exposes a raw token, an address, or the relay
+credentials.