@h-ai/cli 0.1.0-alpha9 → 1.0.0-beta.2

package/templates/apps/fullstack/packages/{{projectName}}-serv/tests/security.test.ts.hbs

@@ -0,0 +1,183 @@
+/** 真实 HTTP、IAM 与持久化验证示例职责及可选再鉴别，不替代浏览器加密验收。 */
+import { once } from 'node:events'
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import path from 'node:path'
+import { apiContract } from '@h-ai/api-contract'
+import { audit } from '@h-ai/audit'
+import { cache } from '@h-ai/cache'
+import { iam } from '@h-ai/iam'
+import { reldb } from '@h-ai/reldb'
+import { serv } from '@h-ai/serv'
+import { storage } from '@h-ai/storage'
+import { AdminUserSchema, {{fullstack.contractExportName}} } from '{{fullstack.contractPackageName}}'
+import { afterAll, beforeAll, expect, it } from 'vitest'
+import { initBusinessSettings } from '../src/server/business-settings.js'
+import { createServerProcedures } from '../src/server/procedures/index.js'
+import { APP_DUTIES, seedAppDuties } from '../src/server/security-roles.js'
+
+type Duty = keyof typeof APP_DUTIES
+const actors = new Map<Duty, { token: string, password: string }>()
+const invitations = new Map<string, string>()
+let deliveryUnknown = false
+let directory = ''
+let server: ReturnType<typeof serv.listen> | undefined
+let base = ''
+
+beforeAll(async () => {
+  directory = await mkdtemp(path.join(tmpdir(), 'hai-app-security-'))
+  expect((await reldb.init({ type: 'sqlite', database: ':memory:' })).success).toBe(true)
+  expect((await cache.init({ type: 'memory' })).success).toBe(true)
+  expect((await storage.init({ type: 'local', root: directory })).success).toBe(true)
+  expect((await audit.init({ storage, backup: { enabled: true } })).success).toBe(true)
+  expect((await iam.init({
+    initialCredentials: { enabled: true },
+    passwordReset: { enabled: true, mode: 'email' },
+    reauthentication: { enabled: true, operations: ['iam.users.create', 'iam.users.invite', 'iam.users.resetPassword', 'audit.backup', 'business.settings.update'] },
+    onPasswordResetRequest: async (user, token) => {
+      invitations.set(user.username, token)
+      if (deliveryUnknown)
+        throw new Error('Notification delivery outcome is unknown')
+    },
+  })).success).toBe(true)
+  expect((await seedAppDuties()).success).toBe(true)
+  expect((await initBusinessSettings()).success).toBe(true)
+  for (const code of Object.keys(APP_DUTIES) as Duty[]) {
+    const password = `Example-${code}-123!`
+    const user = await iam.user.createUser({ username: code, password })
+    const role = await iam.authz.getRoleByCode(code)
+    if (!user.success || !role.success || !role.data)
+      throw new Error('Missing security actor fixture')
+    expect((await iam.authz.syncRoles(user.data.user.id, [role.data.id])).success).toBe(true)
+    const signedIn = await iam.auth.login({ identifier: code, password })
+    if (!signedIn.success)
+      throw new Error(signedIn.error.message)
+    actors.set(code, { token: signedIn.data.tokens.accessToken, password })
+  }
+  const app = serv.createApp({
+    contract: {{fullstack.contractExportName}},
+    procedures: createServerProcedures({ app: { name: 'Security fixture', version: 'test', env: 'test', defaultLocale: 'en-US', supportedLocales: ['en-US'], startedAt: new Date().toISOString(), frontends: ['web'] } }),
+    iam,
+    http: { openapi: false, docs: false, rpc: false },
+  })
+  server = serv.listen(app, { host: '127.0.0.1', port: 0 })
+  if (!server.server.listening)
+    await once(server.server, 'listening')
+  const address = server.server.address()
+  if (!address || typeof address === 'string')
+    throw new Error('Missing security server address')
+  base = `http://127.0.0.1:${address.port}/api/v1`
+}, 30000)
+
+afterAll(async () => {
+  try {
+    await server?.close()
+    await iam.close()
+    await audit.close()
+    await storage.close()
+    await cache.close()
+    await reldb.close()
+  }
+  finally {
+    if (directory)
+      await rm(directory, { recursive: true, force: true })
+  }
+})
+
+function actor(code: Duty) {
+  const value = actors.get(code)
+  if (!value)
+    throw new Error('Missing security actor')
+  return value
+}
+
+async function proof(code: Duty, operation: string) {
+  const value = actor(code)
+  const result = await iam.auth.reauthenticate(value.token, value.password, operation)
+  if (!result.success)
+    throw new Error(result.error.message)
+  return result.data.ticket
+}
+
+function post(code: Duty, route: string, input: object = {}, ticket?: string) {
+  return fetch(`${base}${route}`, { method: 'POST', headers: { 'content-type': 'application/json', 'authorization': `Bearer ${actor(code).token}`, ...(ticket ? { 'x-hai-reauthentication': ticket } : {}) }, body: JSON.stringify(input) })
+}
+
+it('系统、审计、配置与业务职责的直接 HTTP 请求各有边界', async () => {
+  expect(await (await post('audit_admin', '/admin/users/list')).json()).toMatchObject({ success: false, error: { httpStatus: 403 } })
+  expect(await (await post('admin', '/admin/audit/list')).json()).toMatchObject({ success: false, error: { httpStatus: 403 } })
+  expect(await (await post('admin', '/admin/configuration/update', { notice: 'Rejected' })).json()).toMatchObject({ success: false, error: { httpStatus: 403 } })
+  expect(await (await post('business_operator', '/admin/users/list')).json()).toMatchObject({ success: false, error: { httpStatus: 403 } })
+  const ticket = await proof('config_admin', 'business.settings.update')
+  expect(await (await post('config_admin', '/admin/configuration/update', { notice: 'Authorized public notice' }, ticket)).json()).toMatchObject({ success: true })
+  const info = await fetch(`${base}/app/info`, { method: 'POST' })
+  expect(await info.json()).toMatchObject({ success: true, data: { notice: 'Authorized public notice' } })
+})
+
+it('再鉴别按用途单次使用，临时账号状态变化立即阻止旧会话', async () => {
+  const input = { username: 'temporary-member', password: 'Temporary-example-123!', role: 'user', accountType: 'temporary', accountExpiresAt: new Date(Date.now() + 3600000).toISOString() }
+  expect(await (await post('admin', '/admin/users/create', input)).json()).toMatchObject({ success: false, error: { code: 'hai:iam:027' } })
+  const ticket = await proof('admin', 'iam.users.create')
+  const response = await post('admin', '/admin/users/create', input, ticket)
+  const created = apiContract.haiResultSchema(AdminUserSchema).parse(await response.json())
+  expect(created.success).toBe(true)
+  if (!created.success)
+    return
+  expect(created.data.accountType).toBe('temporary')
+  expect(await (await post('admin', '/admin/users/create', { ...input, username: 'replayed-member' }, ticket)).json()).toMatchObject({ success: false })
+  const login = await iam.auth.login({ identifier: input.username, password: input.password })
+  if (!login.success)
+    throw new Error(login.error.message)
+  expect(await (await post('admin', '/admin/users/update', { id: created.data.id, accountStatus: 'dormant' })).json()).toMatchObject({ success: true })
+  expect((await iam.auth.verifyToken(login.data.tokens.accessToken)).success).toBe(false)
+  expect((await iam.session.refresh(login.data.tokens.refreshToken)).success).toBe(false)
+})
+
+it('设密邀请可完成，投递未知时保留账号；系统管理员可创建其他职责账号', async () => {
+  const createdDuty = await post('admin', '/admin/users/create', { username: 'managed-auditor', password: 'Example-123!', role: 'audit_admin' }, await proof('admin', 'iam.users.create'))
+  expect(await createdDuty.json()).toMatchObject({ success: true, data: { roles: ['audit_admin'] } })
+  const invite = await post('admin', '/admin/users/invite', { username: 'invited-member', email: 'member@example.test' }, await proof('admin', 'iam.users.invite'))
+  expect(await invite.json()).toMatchObject({ success: true })
+  const token = invitations.get('invited-member')
+  expect(token).toBeTruthy()
+  expect((await iam.user.confirmPasswordReset(token!, 'Invited-example-123!')).success).toBe(true)
+  expect((await iam.auth.login({ identifier: 'invited-member', password: 'Invited-example-123!' })).success).toBe(true)
+  deliveryUnknown = true
+  try {
+    const unknown = await post('admin', '/admin/users/invite', { username: 'delivery-unknown-member', email: 'unknown@example.test' }, await proof('admin', 'iam.users.invite'))
+    expect(await unknown.json()).toMatchObject({ success: false, error: { code: 'hai:iam:028' } })
+    const found = await iam.user.listUsers({ search: 'delivery-unknown-member' })
+    expect(found).toMatchObject({ success: true, data: { total: 1 } })
+  }
+  finally { deliveryUnknown = false }
+})
+
+it('只有审计职责可手动备份且私有归档可验证', async () => {
+  const id = crypto.randomUUID()
+  expect(await (await post('admin', '/admin/audit/backup', { id })).json()).toMatchObject({ success: false, error: { httpStatus: 403 } })
+  const result = await post('audit_admin', '/admin/audit/backup', { id }, await proof('audit_admin', 'audit.backup'))
+  const body: unknown = await result.json()
+  expect(body).toMatchObject({ success: true, data: { id, key: expect.stringContaining('hai-private/audit-backups/'), sha256: expect.stringMatching(/^[a-f\d]{64}$/) } })
+  const verified = await audit.backup.verify(`hai-private/audit-backups/${id}.jsonl`)
+  expect(verified.success).toBe(true)
+})
+
+it.each(['admin', 'audit_admin', 'config_admin', 'business_operator', 'user'] as const)('系统管理员统一管理 %s 的资料、生命周期、角色和密码', async (role) => {
+  const username = `managed-${role}`
+  const created = apiContract.haiResultSchema(AdminUserSchema).parse(await (await post('admin', '/admin/users/create', { username, password: 'Managed-example-123!', role }, await proof('admin', 'iam.users.create'))).json())
+  expect(created).toMatchObject({ success: true, data: { roles: [role], accountStatus: 'active' } })
+  if (!created.success)
+    throw new Error('Managed account fixture failed')
+  const input = { id: created.data.id, displayName: 'Managed profile', accountStatus: 'dormant', role: 'user' }
+  expect(await (await post('admin', '/admin/users/update', input)).json()).toMatchObject({ success: true, data: { displayName: 'Managed profile', roles: ['user'], accountStatus: 'dormant' } })
+  const reset = { id: created.data.id, newPassword: 'Reset-example-456!' }
+  expect(await (await post('admin', '/admin/users/reset-password', reset)).json()).toMatchObject({ success: false, error: { code: 'hai:iam:027' } })
+  const ticket = await proof('admin', 'iam.users.resetPassword')
+  expect(await (await post('admin', '/admin/users/reset-password', reset, ticket)).json()).toMatchObject({ success: true, data: { reset: true } })
+  expect(await (await post('admin', '/admin/users/reset-password', reset, ticket)).json()).toMatchObject({ success: false })
+  expect(await iam.user.getUser(created.data.id)).toMatchObject({ success: true, data: { accountStatus: 'dormant' } })
+  expect(await iam.auth.login({ identifier: username, password: reset.newPassword })).toMatchObject({ success: false, error: { code: 'hai:iam:002' } })
+  expect(await (await post('admin', '/admin/users/update', { id: created.data.id, accountStatus: 'active' })).json()).toMatchObject({ success: true })
+  expect((await iam.auth.login({ identifier: username, password: reset.newPassword })).success).toBe(true)
+  expect(await (await post('audit_admin', '/admin/users/reset-password', reset)).json()).toMatchObject({ success: false, error: { httpStatus: 403 } })
+})

package/templates/apps/fullstack/packages/{{projectName}}-serv/tsconfig.json.hbs

@@ -0,0 +1,10 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "rootDir": ".",
+    "types": ["node"],
+    "outDir": "./dist"
+  },
+  "include": ["src/**/*", "tests/**/*"],
+  "exclude": ["node_modules", "dist"]
+}

package/templates/apps/fullstack/packages/{{projectName}}-serv/tsup.config.ts.hbs

@@ -0,0 +1,18 @@
+import { writeFile } from 'node:fs/promises'
+import { fileURLToPath } from 'node:url'
+import { defineConfig } from 'tsup'
+import { resolveBuildMetadata } from '../../scripts/build-metadata.js'
+
+const buildMetadata = resolveBuildMetadata(fileURLToPath(new URL('.', import.meta.url)))
+
+export default defineConfig({
+  define: { __HAI_BUILD_METADATA__: JSON.stringify(buildMetadata) },
+  async onSuccess() {
+    await writeFile(new URL('./dist/build-metadata.json', import.meta.url), JSON.stringify(buildMetadata))
+  },
+  entry: ['src/index.ts'],
+  format: ['esm'],
+  dts: { compilerOptions: { ignoreDeprecations: '6.0' } },
+  sourcemap: true,
+  clean: true,
+})

package/templates/apps/fullstack/packages/{{projectName}}-serv/vitest.config.ts.hbs

@@ -0,0 +1,12 @@
+import { fileURLToPath } from 'node:url'
+import { defineConfig } from 'vitest/config'
+import { resolveBuildMetadata } from '../../scripts/build-metadata.js'
+
+export default defineConfig({
+  define: { __HAI_BUILD_METADATA__: JSON.stringify(resolveBuildMetadata(fileURLToPath(new URL('.', import.meta.url)))) },
+  test: {
+    globals: true,
+    environment: 'node',
+    include: ['tests/**/*.test.ts'],
+  },
+})

package/templates/apps/fullstack/packages/{{projectName}}-shared/.gitignore.hbs

@@ -0,0 +1,10 @@
+node_modules
+.turbo
+src/lib/paraglide
+
+# 构建器生成的安装输入快照
+**/images/dependencies/
+
+# 项目本地缓存
+**/.pnpm-store/
+**/.cache/

package/templates/apps/fullstack/packages/{{projectName}}-shared/README.md.hbs

@@ -0,0 +1,97 @@
+# {{fullstack.sharedPackageName}}
+
+## Introduction
+
+Shared mini administration workspace for **{{projectName}}**. Web, Capacitor App and Tauri desktop use the same `AdminWorkspace`, responsive `AppShell`, typed API client and management store.
+
+## Core features
+
+- Shared management pages, forms, navigation and application state.
+- Typed encrypted API client and platform-specific token storage.
+- Themes, language preferences, onboarding and help.
+
+## Getting started
+
+### Behavior and configuration
+
+The behavior below describes the initial example. Roles, permissions, workflows, limits, preferences and audit policies can change with the user's requirements. Update conflicting implementation, tests and guidance together; preserve the applicable public API contracts and server security checks.
+
+- Administrators manage users, upload user avatars, assign the built-in administrator/user roles, edit role descriptions and query audit logs.
+- By default, ordinary users update their own profile, avatar, language, appearance and password. The server enforces the actual business permissions on every request.
+- The workspace uses the available window width. Tables scroll within their own area; settings panels form two columns on large screens and stack on phones.
+- `ManagementStore` owns API calls and business state; components render the state and forward user interactions.
+- Application name, version, environment and default locale come from the backend `app.info` contract, which reads `core` configuration. Do not duplicate these values in translations or frontend constants.
+- Requests, token refresh and JSON responses use the same `@h-ai/api-client` + `@h-ai/crypto` transport. Avatar uploads use encrypted JSON and validate PNG/JPEG/WebP content, with a 512 KiB limit.
+- Read metadata through the same initialized `managementApi.app.info()` client; inspect `success` before using `data`.
+
+Vite development and preview servers read the workspace root environment files and proxy /api to the backend. Builds do not load deployment environment files. Web containers receive their public API address at startup; native apps follow the platform configuration below.
+
+An origin-only API base uses `/api/v1`. For a custom service `http.apiPrefix`, include that path in `PUBLIC_API_BASE` or the runtime API base; the client preserves the configured path and restricts avatar URLs to its matching resource prefix.
+
+### Configurable security and duties
+
+System administrators manage accounts and roles, auditors query/export private audit archives, configuration staff maintain the public notice, and business operators process feedback. Basic members retain self-serv access. Navigation and server permissions follow the same application-owned duties. Management forms support temporary account expiry and active/dormant/closed states; optional invitations use one-time password setup notifications. `ReauthenticationDialog` collects confirmation for configured operations through the service layer, and proofs are passed only to the corresponding API call. Audit pages expose category/outcome/severity filters, sorting, seven-day statistics and private backup receipts. Page-exit revocation is optional and best effort; combine it with server idle/absolute deadlines.
+
+### Authentication and preferences
+
+Web and browser previews keep access tokens in memory and refresh tokens in the server's httpOnly Cookie. Requests include credentials; reload restores the session through the encrypted refresh flow. Never store authentication tokens in localStorage.
+
+Capacitor native uses `createCapacitorTokenStorage()` and the trusted native token channel. Set its public API address in the App's `public/runtime-config.js` before compiling and syncing native assets. Tauri uses memory token storage and requires a new login after restart; set process `PUBLIC_API_BASE` before launching the installed application, and its Rust host injects the address. Both send `clientName` and `X-HAI-Token-Transport: body`; the service verifies the trusted native origin before returning a refresh token in JSON. Capacitor requires explicit API configuration. The Tauri host defaults to http://localhost:3000/api/v1 when PUBLIC_API_BASE is absent; configure the actual service address for installed applications. A configured address does not prove connectivity.
+
+Language and theme preferences are saved in IAM user metadata, restored after login and synchronized with the shared/host Paraglide runtimes and `core.i18n`. The small reactive theme store delegates DOM updates and safe appearance caching to `@h-ai/ui/theme` (`applyTheme` / `getSavedTheme`); the framework uses the `theme` localStorage key. Appearance selectors live in personal settings and save through the authenticated profile contract.
+
+### Onboarding and help
+
+AdminWorkspace mounts the shared `@h-ai/ui/guide` controller and GuideHost after authentication. AppShell includes a help button; first-use invitations offer start, later and dismiss. Web stores preferences in Cookies, while App/Desktop use localStorage, scoped by the current user and tour version. Help articles link to the overview and profile tours.
+
+Extend `src/lib/stores/guide-store.ts` and the shared Chinese/English/Japanese messages, then add stable data-guide attributes to existing components. Navigation uses the same ManagementStore. Keep business text as i18n callbacks and preserve the host's locale/scope binding. Browser tests cover completion, reload, replay, settings navigation and mobile help.
+
+### i18n and themes
+
+Shared page copy belongs in `messages/{zh-CN,en-US,ja-JP}.json`. Frontend-specific copy belongs in each app's own messages directory. Keep `baseLocale` and `locales` aligned across all enabled projects, then run root `pnpm i18n:compile`; do not edit generated Paraglide files.
+
+All frontend and shared projects load the installed message-format plugin from the workspace root `node_modules`, matching the scaffold's hoisted dependency layout. Compilation uses the workspace dependency version and does not fetch a plugin from a CDN.
+
+The scaffold theme configuration determines the themes compiled into frontend CSS. Personal settings offer only those available themes. Customize the common layout in `src/lib/components/AppShell.svelte`, the management pages in adjacent components, and business behavior in `src/lib/stores/management-store.svelte.ts`.
+
+### Validation
+
+Run root `pnpm typecheck`, `pnpm lint`, `pnpm build`, `pnpm test` and `pnpm test:e2e`. Shared API tests exercise real transport key exchange, encrypted request/response handling, configured core metadata and credential forwarding. Root browser tests cover administrator and ordinary-user workflows, avatar rendering, persisted preferences, password/session invalidation and narrow-screen layout. All selected Web/App/Desktop previews also exercise login, tours, help and profile navigation. Clean screenshots, reports, temporary projects, containers and helper processes in finally/teardown, including failure paths. These browser checks do not replace native-shell or miniapp device acceptance.
+
+### IAM configuration
+
+The service's `config/_iam.yml` controls login methods, registration, password reset, agreements and `ui` branding. Email and SMS use providers/templates in `_reach.yml` or custom callbacks. `AuthPanel` uses the public configuration and framework auth actions to manage tokens, resend countdowns and errors. Memory cache is for local development and explicit tests. Production requires supported shared database/cache backends even with one instance, write routing and a shared managed transport key ring and registry as described in the project README.
+
+Authentication defaults to a split layout. Set `ui.variant`, `title`, `subtitle`, `brandTitle`, `brandText`, `logoUrl` and `illustrationUrl` to customize login and registration. Without a `brandTitle`, the displayed application name comes from `app.info` and follows `core` configuration.
+
+LDAP and Reach are optional. Install ldapts in the IAM service workspace only when using its default LDAP client, then enable login.ldap and set connection settings. Custom onOtpSendEmail/onOtpSendSms/onPasswordResetRequest callbacks work without Reach and must reject on delivery failure. Their third context argument supplies expiresAt/idempotencyKey; senders durably deduplicate that key, and errors/timeouts mean unknown delivery with no automatic resend. Agreements open in a Modal. LoginForm/RegisterForm support header/extraFields/footer snippets; AuthPanel forwards loginHeader/loginFields/loginFooter and registerHeader/registerFields/registerFooter. See the generated hai-iam/hai-ui skills for configuration and examples.
+
+Agreements accept Markdown text or a URL. Markdown takes precedence and opens in a safely rendered dialog.
+
+See `.agents/skills/hai-iam/reference.md` in the generated application for the complete contract.
+
+### Operation feedback
+
+Operation results use the shared `toast` queue from the lightweight `@h-ai/ui/toast` entry. `AdminWorkspace` mounts one `ToastContainer` for Web, App and Desktop: notifications float at the bottom right by default, use UI-owned semantic colors for information, success, warning and error, with a soft tinted background, a narrow color border and a distinct icon, close automatically or manually, and appear one at a time in FIFO order. Waiting notifications do not expire before being shown. Set `position` in `toast.add` for any of the six supported positions. Field validation and persistent business state stay inline.
+
+### Form layouts
+
+The user editor uses `FormLayout columns={2} labelPosition="left"`. Personal settings fill the available width and use two columns on wide screens, with stacked labels and a single avatar editor. Narrow containers automatically stack cards, fields and labels. UI controls and CRUD forms show client validation on blur, update errors while correcting input and validate untouched fields on submit. Field errors follow the current UI language. The management store syncs locale through the lightweight `@h-ai/ui/i18n` entry, without loading components or tour CSS. Configure `colSpan` on FormField to override automatic spans for textareas, uploads and multiple choices.
+
+## 界面设计与验收
+
+共享管理界面的 Web/App/Desktop 使用同一套 UI 组件和状态。设计、实现、审查分别参考根目录 `.agents/skills/hai-ui-design/`、`hai-ui/`、`hai-ui-review/`；正常、加载、空态、错误恢复、键盘、语言/主题和窄容器均按实际场景验收。组件的筛选、排序和分页仍由业务数据回调接入。
+
+## 反馈现场与交付检查
+
+feedback.init(config, { collectEvidence }) 支持等待业务 text/data 与文本/ZIP/GZIP 附件；_feedback.yml 提供业务采集超时和 Webhook URL/签名密钥/请求超时。密钥仅放服务端私有环境。Webhook 持久重试，详情展示状态并允许管理员重试。
+
+反馈的 console/disabled/reach 独立选择；SDK getView/ratio/saveDraft 与 createFeedbackReview 统一预览、标注、保存及轮询。退出身份清理草稿和观察器。宿主生命周期由 core.module.createRuntime 处理，框架表升级前备份停旧写入并运行各模块 dryRun 预检。
+
+## Development and testing
+
+Run root `pnpm typecheck`, `pnpm lint`, `pnpm build`, `pnpm test` and `pnpm test:e2e`. Browser checks cover shared workflows; test native shells on their target platforms separately.
+
+## License
+
+Apache-2.0

package/templates/apps/fullstack/packages/{{projectName}}-shared/messages/en-US.json.hbs

@@ -0,0 +1,164 @@
+{{! @skipIfEmpty }}
+{
+  "$schema": "https://inlang.com/schema/inlang-message-format",
+  "settings_title": "Personal settings",
+  "settings_language": "Language",
+  "settings_theme": "Theme",
+  "theme_high_contrast": "High contrast",
+  "theme_formal": "Formal",
+  "home_refresh": "Refresh",
+  "home_loading": "Loading…",
+  "home_error": "Unable to reach the API service",
+  "business_settings_title": "Business configuration",
+  "business_notice_label": "Public business notice",
+  "business_notice_hint": "All users can read this notice. Do not include sensitive information.",
+  "security_sensitive_operations": "Sensitive operations",
+  "security_action_cancelled": "Sensitive action cancelled.",
+  "account_type": "Account type",
+  "account_permanent": "Permanent",
+  "account_temporary": "Temporary",
+  "account_state": "Account state",
+  "account_active": "Active",
+  "account_dormant": "Dormant",
+  "account_closed": "Closed",
+  "account_expires": "Expires at",
+  "account_last_login": "Last login",
+  "invitation_title": "Invite user to set password",
+  "invitation_hint": "Send a one-time password setup link without displaying or sharing an initial password.",
+  "invitation_send": "Send invitation",
+  "invitation_check_existing": "Check the user list and delivery records before retrying; the account may already exist.",
+  "invitation_default_role": "Default business operator",
+  "invitation_phone": "Phone number",
+  "audit_category": "Category",
+  "audit_outcome": "Outcome",
+  "audit_severity": "Severity",
+  "audit_category_system": "System events",
+  "audit_category_business": "Business events",
+  "audit_success": "Success",
+  "audit_failure": "Failure",
+  "audit_denied": "Denied",
+  "audit_info": "Info",
+  "audit_warning": "Warning",
+  "audit_error": "Error",
+  "audit_critical": "Critical",
+  "audit_all": "All",
+  "audit_backup_run": "Back up audit records",
+  "audit_backup_private_hint": "Archive saved to private server storage. Retrieve and verify it using the archive key.",
+  "audit_backup_retry_hint": "Retry verifies the same archive ID. Avoid starting duplicate jobs with different IDs.",
+  "audit_stats_hint": "Last 7 days grouped by action, filtered by category, outcome, severity and resource.",
+  "audit_advanced_filters": "Classification, sorting and statistics",
+  "audit_sort_direction": "Sort direction",
+  "audit_request_id": "Request ID",
+  "audit_trace_id": "Trace ID",
+  "audit_scope": "Business scope",
+  "audit_actor_snapshot": "Event identity snapshot",
+  "audit_asc": "Ascending",
+  "audit_desc": "Descending",
+  "audit_sort": "Sort by",
+  "nav_users": "Users",
+  "nav_roles": "Roles",
+  "nav_audit": "Audit logs",
+  "nav_feedback": "Feedback",
+  "feedback_logs": "Logs and requests",
+  "feedback_export_pending": "The feedback bundle is still being generated. Please retry shortly.",
+  "navigation": "Main navigation",
+  "open_menu": "Open navigation",
+  "close_menu": "Close navigation",
+  "logout": "Sign out",
+  "login_title": "Sign in",
+  "login_description": "Sign in to manage your account and workspace",
+  "login_invalid": "The account or password is incorrect. Please try again.",
+  "session_expired": "Your session has expired. Please sign in again.",
+  "saved": "Changes saved",
+  "save": "Save",
+  "edit": "Edit",
+  "delete": "Delete",
+  "cancel": "Cancel",
+  "search": "Search",
+  "details": "Details",
+  "created_at": "Created at",
+  "all_statuses": "All statuses",
+  "operation_failed": "The operation could not be completed. Please try again.",
+  "network_error": "Connection failed. Check your network and try again.",
+  "forbidden": "You do not have permission to perform this operation.",
+  "conflict": "This account already exists or the change conflicts with the current data.",
+  "validation_failed": "Check the information entered and try again.",
+  "settings_description": "Manage your profile, preferences and account security",
+  "profile_title": "Profile",
+  "preferences_title": "Preferences",
+  "preferences_description": "Your language and appearance preferences follow your account across devices.",
+  "password_title": "Change password",
+  "password_rules": "Choose a different password.",
+  "password_changed": "Password updated. Please sign in with your new password.",
+  "password_current_required": "Enter your current password before changing it.",
+  "password_confirmation_mismatch": "The new passwords do not match. Enter the same password in both fields.",
+  "avatar_hint": "Upload a PNG, JPEG or WebP image, up to 512 KB.",
+  "avatar_invalid": "Choose a PNG, JPEG or WebP image no larger than 512 KB.",
+  "avatar_saved": "Avatar updated",
+  "avatar_upload": "Upload avatar",
+  "users_description": "Create accounts, assign roles and manage access",
+  "users_search": "Search username, name or email",
+  "user_account": "Account",
+  "user_username": "Username",
+  "user_display_name": "Display name",
+  "user_email": "Email",
+  "user_password": "Initial password",
+  "user_role": "Role",
+  "user_create": "Add user",
+  "initial_password_rules": "Use at least {min} characters.",
+  "users_empty": "No matching accounts. Try another search or create a user.",
+  "user_edit": "Edit user",
+  "user_deleted": "User deleted",
+  "user_delete_title": "Delete user",
+  "user_delete_confirm": "Delete {name}? This permanently removes the account and its access.",
+  "roles_description": "Separate permissions by responsibility. Assign roles from user management.",
+  "role_admin": "System administrator",
+  "role_audit": "Audit administrator",
+  "role_config": "Configuration administrator",
+  "role_audit_capabilities": "Read, aggregate and back up audit records without account or business configuration management.",
+  "role_config_capabilities": "Manage business configuration without account or audit administration.",
+  "role_operator": "Business operator",
+  "role_operator_capabilities": "Use business workflows without account, audit or configuration administration.",
+  "role_user": "User",
+  "role_admin_capabilities": "Manage system accounts and roles without audit or business configuration access.",
+  "role_user_capabilities": "Update personal profile, avatar, language, appearance and password.",
+  "role_members": "{count} members",
+  "role_edit": "Edit description",
+  "role_description": "Description",
+  "audit_description": "Review account and administration activity",
+  "audit_actor": "Actor",
+  "audit_action": "Action",
+  "audit_resource": "Resource",
+  "audit_resource_id": "Resource ID",
+  "audit_ip": "IP address",
+  "audit_start": "From",
+  "audit_end": "To",
+  "audit_action_placeholder": "All actions",
+  "audit_resource_placeholder": "All resources",
+  "audit_system": "System",
+  "audit_details": "Audit log details",
+  "audit_date_invalid": "The end date must be on or after the start date.",
+  "api_not_configured": "The service connection is not configured. Please contact your administrator.",
+  "guide_overview_title": "Explore your admin workspace",
+  "guide_overview_description": "A few short steps introduce the workspace, personal settings and help. Leave at any time and replay tours from the help center.",
+  "guide_content_title": "Workspace",
+  "guide_content_description": "The current page appears here. Use navigation to switch features. Available actions depend on your permissions.",
+  "guide_theme_title": "Appearance",
+  "guide_theme_description": "Switch between light and dark appearances here. More themes are available in settings.",
+  "guide_profile_title": "Your profile",
+  "guide_profile_description": "Use your avatar to access your profile and settings, including personal information and passwords.",
+  "guide_help_title": "Help center",
+  "guide_help_description": "Search instructions here whenever you need help, or replay a product tour.",
+  "guide_profile_tour_title": "Set up your profile",
+  "guide_profile_tour_description": "Find your personal information, preferences and password settings. This tour explains actions without submitting changes.",
+  "guide_profile_form_description": "View or edit your profile, choose an avatar and save your changes. Uploaded files must meet the format and size requirements shown on the page.",
+  "guide_preferences_description": "Save your preferred language and theme. The interface and help content follow your selection.",
+  "guide_password_title": "Change password",
+  "guide_password_description": "Enter your current password, new password and confirmation. Check the password rules before submitting.",
+  "guide_overview_article": "## Getting started\n\n- Open features through navigation. Menus and actions depend on your current permissions.\n- The workspace contains lists, details or settings. Follow the page instructions and check information before submitting.\n- Use your avatar to access your profile and settings.\n- Search instructions or replay tours through the help button.\n\n## First-use tour\n\n“Remind me later” pauses reminders for one day. “Do not remind me” saves your preference. Completed tours no longer prompt automatically and remain available for manual replay.",
+  "guide_profile_article": "## Profile and preferences\n\nOpen your profile to view or update personal information and your avatar. Check the file requirements, save changes and read the result message. Appearance and language can be adjusted in settings.\n\n## Password\n\nChanging a password requires the current password, new password and confirmation. Follow the displayed password rules and check the result after submitting.\n\n“Start tour” opens the relevant page. Tours never save forms or change your account automatically.",
+  "user_password_reset": "Reset password",
+  "user_password_reset_hint": "Set a new password for {name}. Existing sessions will end and account status stays the same. Deliver the new password through a secure channel.",
+  "user_password_reset_done": "Password reset and existing sessions ended. Deliver the new password securely.",
+  "user_password_reset_initial_hint": "Initial password change is required: the user must choose their own password at the next sign-in."
+}