@meith/i18n 0.33.4 → 0.35.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@meith/i18n",
-  "version": "0.33.4",
+  "version": "0.35.0",
   "description": "The message catalog and the locale-aware formatters: ICU messages, plural categories, locale negotiation, and the registry themes and plugins add their own catalogs to.",
   "license": "MIT",
   "repository": {

package/src/catalogs/en.json

@@ -242,6 +242,59 @@
   "adminAttachments.ready": "Ready",
   "adminAttachments.status": "Status",
   "adminAttachments.stored": "Stored",
+  "adminBackups.backToSystem": "System health",
+  "adminBackups.bundles.download": "Download",
+  "adminBackups.bundles.empty": "No bundles yet. Take one now, or turn on the schedule.",
+  "adminBackups.bundles.local": "on the server, {size}",
+  "adminBackups.bundles.offSite": "off-site, {size}",
+  "adminBackups.bundles.restoreHint": "To restore, deploy a fresh, empty board and pick the bundle on its installer — the operations guide walks through it. A download is your copy off the machine.",
+  "adminBackups.bundles.title": "Bundles",
+  "adminBackups.confirm.delete": "Delete this bundle from the server and from the off-site destination? There is no undo; a restore point deleted is gone.",
+  "adminBackups.destination.fromBoard": "Configured in the board settings.",
+  "adminBackups.destination.fromEnvironment": "Configured in the environment (BACKUP_S3_* or BACKUP_WEBDAV_*), which wins over the board settings.",
+  "adminBackups.destination.listFailed": "The destination could not be listed: {error}",
+  "adminBackups.destination.none": "Bundles stay on this server. A ring on the server protects against a bad upgrade or a deleted forum, not against losing the server: name a bucket in the board settings and every bundle is shipped there too.",
+  "adminBackups.destination.shipsTo": "Every bundle is also shipped to {destination}.",
+  "adminBackups.destination.title": "Off-site destination",
+  "adminBackups.destination.unusable": "A destination is configured but cannot be used.",
+  "adminBackups.lede": "A bundle is the database dump and, when the settings say so, the uploads — everything a fresh deployment needs to become this board again. Bundles live in the backup directory on the server and, with a destination configured, in a bucket off it.",
+  "adminBackups.now.hint": "Queues a bundle for the scheduler, which picks it up within a minute and runs it beside the board without stopping it. A large board takes a few minutes; this screen shows the run once it starts.",
+  "adminBackups.now.queued": "A backup is queued and starts on the next tick.",
+  "adminBackups.now.running": "A backup has been running since {since}.",
+  "adminBackups.now.title": "Back up now",
+  "adminBackups.plan.beforeUpgrade": "Before a migration:",
+  "adminBackups.plan.change": "Change the schedule, retention, uploads and destination in the board settings.",
+  "adminBackups.plan.next": "next at {time}",
+  "adminBackups.plan.off": "no bundle is taken",
+  "adminBackups.plan.on": "a bundle is taken first",
+  "adminBackups.plan.retention": "Retention:",
+  "adminBackups.plan.ring": "Backup directory:",
+  "adminBackups.plan.schedule": "Schedule:",
+  "adminBackups.plan.title": "Schedule and retention",
+  "adminBackups.plan.uploads": "Uploads:",
+  "adminBackups.plan.uploadsIncluded": "included in every bundle",
+  "adminBackups.plan.uploadsSkipped": "not in the bundle",
+  "adminBackups.reauth": "Downloading a bundle asks for a fresh password. Sign out of the control panel, sign in again, and try the download within fifteen minutes.",
+  "adminBackups.retention.count": "the newest {count, plural, one {# bundle} other {# bundles}}",
+  "adminBackups.retention.countAndDays": "the newest {count, plural, one {# bundle} other {# bundles}}, none older than {days, plural, one {# day} other {# days}}",
+  "adminBackups.run.done": "done",
+  "adminBackups.run.failed": "failed",
+  "adminBackups.run.incomplete": "done, incomplete",
+  "adminBackups.run.queued": "queued",
+  "adminBackups.run.running": "running",
+  "adminBackups.runs.empty": "Nothing has run yet.",
+  "adminBackups.runs.shipped": "shipped off-site",
+  "adminBackups.runs.skipped": "{count, plural, one {# object skipped} other {# objects skipped}}",
+  "adminBackups.runs.title": "Recent runs",
+  "adminBackups.sample": "This board is running on in-memory sample data, so there is nothing to back up.",
+  "adminBackups.schedule.daily": "every day at {time} UTC",
+  "adminBackups.schedule.off": "no automatic backups",
+  "adminBackups.schedule.weekly": "every {weekday} at {time} UTC",
+  "adminBackups.serverless": "This deployment runs on serverless functions, which have no database client tools and no disk of their own, so backups cannot run from here. Take them with the operator CLI from any machine that holds the project’s variables — the deployment guide shows the command — and they will appear below once they reach the off-site destination.",
+  "adminBackups.trigger.cli": "from the CLI",
+  "adminBackups.trigger.manual": "requested from the panel",
+  "adminBackups.trigger.schedule": "scheduled",
+  "adminBackups.trigger.upgrade": "before a migration",
   "adminBanFilter.addFilter": "Add filter",
   "adminBanFilter.added": "Filter added.",
   "adminBanFilter.confirm.remove": "Remove this ban filter? Registrations it currently blocks will be allowed again.",
@@ -570,6 +623,7 @@
   "adminNav.admin-security.title": "Sign-in activity",
   "adminNav.admin-settings.blurb": "Every setting this build has, grouped and searchable.",
   "adminNav.admin-settings.title": "Board settings",
+  "adminNav.admin-system-backups.title": "Backups",
   "adminNav.admin-system.blurb": "Scheduled tasks, the search index, caches, and the build.",
   "adminNav.admin-system.title": "System",
   "adminNav.admin-themes.blurb": "Installed themes, their tokens, and this board’s overrides.",
@@ -622,6 +676,13 @@
   "adminNavigation.tree.placed": "{name} placed {where}, {order}.",
   "adminNavigation.tree.where.topLevel": "at the top level",
   "adminNavigation.tree.where.under": "under {parent}",
+  "adminPanel.backup.already": "A backup is already queued or running.",
+  "adminPanel.backup.delete": "Delete",
+  "adminPanel.backup.deleted": "Deleted {name}.",
+  "adminPanel.backup.now": "Back up now",
+  "adminPanel.backup.queued": "Queued. The scheduler starts it within a minute; reload this page to follow it.",
+  "adminPanel.backup.reachable": "The destination answered and holds {count, plural, one {# bundle} other {# bundles}}.",
+  "adminPanel.backup.test": "Test the destination",
   "adminPanel.badge.formats": "PNG, JPEG, WebP or SVG, up to {maxKib} KiB. The contents decide the format, not the file name.",
   "adminPanel.badge.labelSr": "{label} badge",
   "adminPanel.badge.noBadge": "No badge",
@@ -781,6 +842,7 @@
   "adminSecurity.member": "member {id}",
   "adminSecurity.noAccount": "no account named",
   "adminSettings.advancedShown": " Advanced settings are shown.",
+  "adminSettings.backupFromEnvironment": "The off-site destination is set in the environment (BACKUP_S3_* or BACKUP_WEBDAV_*), which wins over the destination fields below: they are stored but not used until those variables go away.",
   "adminSettings.configureMail": "configure mail",
   "adminSettings.configureMailEnd": ", which takes effect without a redeploy and has a button to prove it works.",
   "adminSettings.environmentAddressAfterUrl": ", from ",
@@ -853,6 +915,8 @@
   "adminSystem.task.authEventsPrune.title": "Prune sign-in activity",
   "adminSystem.task.avatarsSweep.description": "Marks avatar uploads whose re-encode never finished, so the member is told to try again rather than left looking at a spinner that is not there. Separate from the attachment sweep because it acts on users rather than on the object ledger, and because an operator asking why an avatar is stuck should not have to read a task about attachments. Purely corrective, and safe to run twice.",
   "adminSystem.task.avatarsSweep.title": "Fail unfinished avatar uploads",
+  "adminSystem.task.backupRun.description": "Runs the backup an administrator asked for, or the one the schedule says is due, one at a time: the database dump, the uploads when the settings include them, a bundle in the backup directory, a copy at the off-site destination, and the pruning of whatever the retention rules no longer keep. Checks every minute and does nothing most of the time. The worker runs it in a lane of its own, because a dump of a large board takes minutes and the outbox should not wait for it.",
+  "adminSystem.task.backupRun.title": "Take due backups",
   "adminSystem.task.bansExpire.description": "Lifts bans whose expiry has passed, restoring each user to the group they held when banned. Acts on outstanding state rather than on what expired since the last run, so a skipped day costs a delay and nothing else, and a doubled tick lifts nothing twice.",
   "adminSystem.task.bansExpire.title": "Expire temporary bans",
   "adminSystem.task.boardDigestSend.description": "Sends the recap a member opted into after they have been away long enough to count as lapsed, and only once their own cadence — weekly or monthly — is due. Content is fetched per recipient through the same permission filter as the rest of the board, so a digest never names a thread its reader could not open. Hourly, for the same reason the subscription digest is: a due check is a query that finds nobody most of the time.",
@@ -901,6 +965,7 @@
   "adminSystem.taskStatus.healthy": "healthy",
   "adminSystem.taskStatus.late": "late",
   "adminSystem.taskStatus.never-run": "never run",
+  "adminSystem.taskStatus.running": "running",
   "adminSystem.taskStatus.stale": "stale",
   "adminSystem.tasksFailing": "{count, plural, one {# task is failing repeatedly — running, and losing. The log below says why.} other {# tasks are failing repeatedly — running, and losing. The log below says why.}}",
   "adminSystem.tasksOverdue": "{count, plural, one {# task is overdue by several of its own intervals.} other {# tasks are overdue by several of their own intervals.}}",
@@ -1791,6 +1856,7 @@
   "error.app.account-longer-exists": "That account no longer exists.",
   "error.app.account-longer-post": "Your account can no longer post.",
   "error.app.attach-files-forum": "You may not attach files in this forum.",
+  "error.app.backups-not-on-this-deployment": "Backups cannot run on this deployment; take them with the operator CLI instead.",
   "error.app.ban-lasts-whole-number-days": "A ban lasts a whole number of days, or is permanent.",
   "error.app.board-accept-avatar-uploads": "This board cannot accept avatar uploads.",
   "error.app.board-accept-file-attachments": "This board cannot accept file attachments.",
@@ -1889,11 +1955,15 @@
   "error.app.navigation-address-path-or-web-address": "Give a path on this board, starting with /, or a full http(s) web address.",
   "error.app.navigation-audience-unknown": "Choose who the item is shown to.",
   "error.app.navigation-item-go-further-direction": "That item cannot go any further in that direction.",
+  "error.app.no-off-site-destination": "No off-site destination is configured.",
+  "error.app.no-such-bundle": "No bundle by that name is on the server or at the off-site destination.",
+  "error.app.not-a-backup-bundle-name": "That is not the name of a backup bundle.",
   "error.app.password-right": "That password is not right.",
   "error.app.poll-exist": "That poll does not exist.",
   "error.app.post-exist": "That post does not exist.",
   "error.app.rating": "That is not a rating.",
   "error.app.reach-control-panel": "You cannot reach the control panel.",
+  "error.app.restore-needs-empty-board": "This board already has members, so the installer will not restore over it.",
   "error.app.restore-post": "You cannot restore that post.",
   "error.app.say-why-member-shown-reason": "Say why. The member is shown this reason.",
   "error.app.select-at-least-one-item": "Select at least one item.",
@@ -2197,6 +2267,28 @@
   "install.password.label": "Your password",
   "install.raced.inFlight": "Another install is already running against this database. Wait for it to finish, then reload this page.",
   "install.raced.sealed": "Another install sealed the board while this one was running. Nothing here was kept.",
+  "install.restore.confirm": "I have the same AUTH_SECRET this board ran with. Without it, every member’s authenticator-app enrolment and every sealed credential in the backup is lost.",
+  "install.restore.doneDetail": "{bundle}, taken by version {version}, is the board again: {posts, plural, one {# post} other {# posts}}.",
+  "install.restore.doneTitle": "Restored",
+  "install.restore.hint": "A bundle taken by another deployment of this board — the nightly one, or the one you took before the server died — becomes this board again. It replaces the empty schema the migrator just wrote, applies any migrations the bundle predates, and puts the uploads back. Nothing here can be overwritten: a board with members refuses to restore.",
+  "install.restore.idleNote": "Takes seconds for a small board and minutes for a large one. When it finishes, the installer is gone and the board is back.",
+  "install.restore.migrated": "{count, plural, one {# migration the bundle predates was} other {# migrations the bundle predates were}} applied on top.",
+
+  "install.restore.next": "Restart the web and worker containers so nothing holds a connection from before the restore, then sign in with an account from the restored board.",
+  "install.restore.noUploads": "The bundle carried no uploads. If they lived in an object store, point this deployment at the same bucket; otherwise posts will have broken images.",
+  "install.restore.noneAnywhere": "No bundles in the backup directory, and none at {destination}.",
+  "install.restore.noneLocal": "No bundles in the backup directory, and no off-site destination in the environment to fetch one from. Put a bundle in the directory, or set the BACKUP_S3_* or BACKUP_WEBDAV_* variables and reload.",
+  "install.restore.notRestored": "The restore did not finish.",
+  "install.restore.offSite": "at the off-site destination",
+  "install.restore.onServer": "on this server",
+  "install.restore.pendingNote": "Restoring the dump. A large board takes minutes — do not reload.",
+  "install.restore.pick": "Which bundle",
+  "install.restore.restoring": "Restoring…",
+  "install.restore.signIn": "Sign in",
+  "install.restore.skipped": "The backup that made this bundle could not read {count, plural, one {# object} other {# objects}}, so posts referring to them have broken images.",
+  "install.restore.submit": "Restore this bundle",
+  "install.restore.takenAt": "Taken {time}",
+  "install.restore.title": "Or restore a backup",
   "install.schema.missing": "The database does not have every table this board needs. Migrations run before the board serves anything — as `meith migrate` in the deploy build command, or from the container entrypoint. Run that against this database and reload this page.",
   "install.step.admin.detail": "Argon2id, the same registration path a member uses, then promoted.",
   "install.step.admin.title": "Create the administrator",
@@ -2286,6 +2378,19 @@
   "installPreflight.tickSecret.setTitle": "TICK_SECRET is set",
   "installPreflight.warning.one": "You can install without resolving that. Nothing will fail at the time — which is what makes it worth reading.",
   "installPreflight.warning.other": "You can install without resolving those. Nothing will fail at the time — which is what makes them worth reading.",
+  "installRestore.alreadyInstalled": "This board is already installed; the installer has nothing left to do.",
+  "installRestore.busy": "Another install or restore is running on this board. Wait for it and reload.",
+  "installRestore.confirmFirst": "Confirm that you hold the AUTH_SECRET the board ran with before restoring.",
+  "installRestore.failed": "The restore stopped: {error}",
+
+  "installRestore.pickOne": "Pick a bundle to restore.",
+  "installUnlock.button": "Unlock the installer",
+  "installUnlock.incorrect": "That does not match the AUTH_SECRET this board runs with.",
+  "installUnlock.label": "AUTH_SECRET",
+  "installUnlock.lede": "Only the operator who deployed this board holds its AUTH_SECRET. Paste it to prove you are that operator before choosing the administrator account or restoring a backup.",
+  "installUnlock.pending": "Checking…",
+  "installUnlock.required": "Unlock the installer with the board's AUTH_SECRET first.",
+  "installUnlock.title": "Prove you deployed this board",
   "legal.page.privacy.footer": "Privacy",
   "legal.page.privacy.title": "Privacy policy",
   "legal.page.rules.footer": "Rules & FAQ",
@@ -2598,6 +2703,7 @@
   "page.awaiting-activation": "Awaiting activation",
   "page.awaiting-processing": "Awaiting processing",
   "page.back-their-profile": "Back to their profile",
+  "page.backups": "Backups",
   "page.ban-filters": "Ban filters",
   "page.before-installing": "Before installing",
   "page.before-press-it": "Before you press it:",
@@ -2965,6 +3071,47 @@
   "setting.antispam.search_per_hour.label": "Searches per hour",
   "setting.antispam.upload_per_hour.description": "Attachments and avatars. 0 disables the limit.",
   "setting.antispam.upload_per_hour.label": "Uploads per hour",
+  "setting.backup.before_upgrade.description": "Take a bundle before the migrator applies a pending schema migration, so a new release always has a restore point in front of it. The bundle lands in the backup directory and ships off-site like any other. The upgrade is refused if that backup fails — a migration is forward-only, and the backup is the only way back. Needs the migrate container to mount the backup directory, which the shipped compose files do.",
+  "setting.backup.before_upgrade.label": "Back up before migrating",
+  "setting.backup.destination.description": "Where every bundle is also shipped, so a backup survives the server. \"None\" keeps bundles on this machine only. An S3-compatible bucket takes the bucket fields below; a WebDAV folder — Nextcloud, ownCloud, a Hetzner Storage Box — takes the WebDAV fields. Setting BACKUP_S3_* or BACKUP_WEBDAV_* in the environment overrides this whole group and makes its fields inert.",
+  "setting.backup.destination.label": "Off-site destination",
+  "setting.backup.keep.description": "How many of the newest bundles survive a run, in the backup directory and at the off-site destination alike. Pruning happens only after a new bundle is safely written, so a run that fails never eats the good ones. Each bundle that carries the uploads is roughly the size of the board, so this is also the disk knob.",
+  "setting.backup.keep.label": "Backups to keep",
+  "setting.backup.keep_days.description": "Bundles older than this many days are pruned as well, however few remain — except the newest, which always survives. 0 keeps a bundle until the count above pushes it out.",
+  "setting.backup.keep_days.label": "Days to keep a backup",
+  "setting.backup.s3_access_key_id.description": "A credential with write and list on that bucket alone — nothing wider. It ships bundles, lists them, and prunes the oldest.",
+  "setting.backup.s3_access_key_id.label": "Access key id",
+  "setting.backup.s3_bucket.description": "An S3-compatible bucket every bundle is also shipped to — Backblaze B2, Cloudflare R2, Hetzner, Scaleway, MinIO on a machine you trust. A bucket of its own, never the one the uploads live in: a backup of the uploads should not sit where losing the uploads loses it. Read when the destination above is the bucket.",
+  "setting.backup.s3_bucket.label": "Off-site bucket",
+  "setting.backup.s3_endpoint.description": "The API address for anything that is not AWS itself — R2, MinIO, Spaces. Leave empty for AWS. Switches the client to path-style addressing, the way S3_ENDPOINT does for the uploads.",
+  "setting.backup.s3_endpoint.label": "Endpoint",
+  "setting.backup.s3_prefix.description": "A folder inside the bucket, so one bucket can hold several boards. Left empty, bundles sit at the root.",
+  "setting.backup.s3_prefix.label": "Key prefix",
+  "setting.backup.s3_region.description": "The bucket’s region, or \"auto\" for a provider that ignores it, such as R2.",
+  "setting.backup.s3_region.label": "Bucket region",
+  "setting.backup.s3_secret_access_key.description": "Stored on the board, sealed under AUTH_SECRET: the database row holds ciphertext, and a copy of the database alone cannot read it. The seal is also why AUTH_SECRET has to survive a restore for the destination to.",
+  "setting.backup.s3_secret_access_key.label": "Secret access key",
+  "setting.backup.schedule.description": "How often the board takes a backup of itself without being asked. Each run bundles the database dump and, by default, the uploads into one file in the backup directory, ships it to the off-site destination below when one is configured, and prunes the oldest bundles under the retention rules. A failed run is reported on the System screen and notified to administrators the way any failing task is.",
+  "setting.backup.schedule.label": "Automatic backups",
+  "setting.backup.time.description": "When the automatic backup starts, as a 24-hour clock in UTC — 02:00 is two in the morning UTC, whatever the server or your browser thinks the local time is. Pick the quietest hour the board has; the dump reads every table while it runs.",
+  "setting.backup.time.label": "Time of day",
+  "setting.backup.uploads.description": "Whether a bundle carries the avatars, attachments and board images. \"Automatic\" includes them when they live on the local disk or a Vercel Blob store, where the bundle is the only copy, and leaves an S3 bucket alone, because a bucket has a backup story of its own. A bundle without the uploads restores a board whose posts have broken images.",
+  "setting.backup.uploads.label": "Uploads in the bundle",
+  "setting.backup.webdav_password.description": "Stored on the board, sealed under AUTH_SECRET the way the bucket secret is: the database row holds ciphertext, and a copy of the database alone cannot read it.",
+  "setting.backup.webdav_password.label": "WebDAV password",
+  "setting.backup.webdav_url.description": "The full address of a folder that already exists, such as https://cloud.example/remote.php/dav/files/backups/board/ on Nextcloud. Bundles are written into it and the oldest pruned from it; the folder itself is never created or removed.",
+  "setting.backup.webdav_url.label": "WebDAV folder address",
+  "setting.backup.webdav_username.description": "The account the bundles are written as. Nextcloud and ownCloud let you make an app password for one purpose; use that rather than the account password.",
+  "setting.backup.webdav_username.label": "WebDAV username",
+  "setting.backup.weekday.description": "Which day a weekly backup runs on. Ignored unless the schedule is weekly.",
+  "setting.backup.weekday.label": "Day of the week",
+  "setting.backup.weekday.option.0": "Sunday",
+  "setting.backup.weekday.option.1": "Monday",
+  "setting.backup.weekday.option.2": "Tuesday",
+  "setting.backup.weekday.option.3": "Wednesday",
+  "setting.backup.weekday.option.4": "Thursday",
+  "setting.backup.weekday.option.5": "Friday",
+  "setting.backup.weekday.option.6": "Saturday",
   "setting.board.description.description": "Used as the default meta description for the board index.",
   "setting.board.description.label": "Board description",
   "setting.board.digest_lapsed_days.description": "A member whose board activity digest is switched on only receives one once their last visit is at least this many days ago — a member who drops in daily should not be told what they already saw. Their own chosen cadence, weekly or monthly, decides how often after that.",
@@ -3026,6 +3173,7 @@
   "setting.federation.passkeys_enabled.description": "Lets a member add a passkey from their account security page and sign in with it afterwards — a fingerprint, a face, or a security key, with no password to phish. Nothing leaves this board: the passkey is created against your own address and no third party is involved. A member who has one keeps their password unless they clear it themselves.",
   "setting.federation.passkeys_enabled.label": "Allow passkeys",
   "setting.group.antispam": "Anti-spam",
+  "setting.group.backup": "Backups",
   "setting.group.board": "Board",
   "setting.group.display": "Display",
   "setting.group.federation": "Sign-in providers",