@object-ui/i18n 11.5.0 → 13.2.0

package/CHANGELOG.md

@@ -1,5 +1,74 @@
 # @object-ui/i18n
 
+## 13.2.0
+
+### Patch Changes
+
+- 53c40c2: feat: identity import — the stock ImportWizard now drives sys_user bulk import (framework#2782)
+
+  The Users list gets an Import entry for platform admins (gated on
+  `features.admin` from `/api/v1/auth/config` plus workspace-admin), wired to
+  the dedicated `POST /api/v1/auth/admin/import-users` pipeline instead of the
+  generic data import (which would bypass better-auth hashing and produce
+  accounts that can never sign in).
+
+  - **plugin-grid**: two generic, backend-agnostic ImportWizard slots —
+    `extraOptionsContent` (host-injected options on the preview step) and
+    `renderResultExtra` (host-rendered content on the result step).
+  - **app-shell**: identity import dataSource adapter — splits files into the
+    endpoint's ≤500-row batches (idempotent upsert makes re-runs safe), injects
+    the selected password policy, renumbers per-batch results onto the whole
+    file, and enriches rows with their sign-in identity. Password policy panel
+    (`none` default / `invite` / `temporary`) and a one-shot temporary-password
+    reveal with CSV download (client memory only — nothing is persisted).
+    Async-job/undo surfaces are hidden for identity import by design.
+  - **auth**: `AuthPublicConfig.features.admin` typing.
+  - **i18n**: en/zh strings for the identity import panels.
+
+## 13.1.0
+
+## 13.0.0
+
+### Minor Changes
+
+- 9e38270: feat(setup): "Connect an agent" page widget (`mcp:connect-agent`) — framework#2714 Phase 1, #2363
+
+  The interactive body for the plugin-carried Setup page shipped by
+  `@objectstack/mcp`: the environment's MCP URL (from `/discovery`), per-client
+  connect cards (claude.ai/Desktop, Claude Code incl. the official plugin,
+  Cursor one-click deeplink, VS Code, Codex CLI), the SKILL.md download
+  (`GET /api/v1/mcp/skill`), and show-once API-key minting for headless
+  callers via the existing `POST /api/v1/keys`. Renders a disabled empty state
+  when discovery doesn't advertise `routes.mcp` (deployment opted out).
+  Translations for all nine locales.
+
+## 12.1.0
+
+### Minor Changes
+
+- e1840bf: Signal the platform's preview stage in the UI.
+
+  The console top bar (`AppHeader`) now shows a small **Preview** chip next to the
+  product wordmark on every surface (home / app / orgs), so users always know the
+  whole platform is pre-GA. It's a new `PreviewBadge` component driven by a
+  `branding.stage` field in runtime-config (`'preview' | 'beta' | 'ga'`, exposed
+  via `getPlatformStage()`), which defaults to `'preview'` so the badge shows out
+  of the box. Operators flip the stage to `'ga'` at launch (`OS_PRODUCT_STAGE` /
+  `RuntimeConfigPlugin`) and the badge disappears with no code change; `'beta'`
+  renders a "Beta" chip instead. Labels are localized under `topbar.stage.*`.
+
+### Patch Changes
+
+- 6cbccf3: Localize form validation messages, toast client-side validation failures, and make native date/time picker icons legible in dark mode.
+
+  Record-form validation messages (required, min/max length, min/max value, pattern, email, URL) were hard-coded English even when the field label was localized — e.g. a Chinese "计划开始日期" field showed "计划开始日期 is required". `buildValidationRules` baked English strings, so the form renderer's `t(...)` fallback never applied. It now emits `required: true` and, for the other rules, a `messageKey` + `undefined` message (a field-authored `*_message` still wins and passes through verbatim); the form renderer fills the blanks via i18n (`validation.*` keys already exist in every locale), so messages track the label's language.
+
+  When client-side validation blocks a submit, the offending field's inline error can sit below the fold in a long modal/drawer form — the user clicks 创建 and sees nothing happen. The form renderer now also fires a `toast.error` naming the fields (`validation.formInvalid`, added to all 10 locales), mirroring the existing server-error toast so the feedback is visible regardless of scroll position.
+
+  Separately, native controls now declare `color-scheme` (`light` on `:root`, `dark` on `.dark`), so the webkit calendar-picker-indicator and other built-in glyphs render light-on-dark instead of vanishing against the dark input background.
+
+## 12.0.0
+
 ## 11.5.0
 
 ### Minor Changes

package/dist/locales/ar.d.ts

@@ -80,6 +80,7 @@ declare const ar: {
         email: string;
         url: string;
         pattern: string;
+        formInvalid: string;
         unique: string;
         type: string;
     };
@@ -1700,6 +1701,46 @@ declare const ar: {
             };
         };
     };
+    connectAgent: {
+        disabled: {
+            title: string;
+            body: string;
+        };
+        url: {
+            title: string;
+            body: string;
+            downloadSkill: string;
+            skillHint: string;
+        };
+        claude: {
+            body: string;
+            reachability: string;
+        };
+        claudeCode: {
+            body: string;
+            plugin: string;
+        };
+        cursor: {
+            addButton: string;
+            body: string;
+        };
+        vscode: {
+            body: string;
+        };
+        codex: {
+            body: string;
+        };
+        apiKey: {
+            title: string;
+            badge: string;
+            body: string;
+            namePlaceholder: string;
+            mint: string;
+            minting: string;
+            showOnce: string;
+            done: string;
+        };
+    };
     marketplace: {
         title: string;
         subtitle: string;

package/dist/locales/ar.js

@@ -80,6 +80,7 @@ const ar = {
         email: "يرجى إدخال بريد إلكتروني صالح",
         url: "يرجى إدخال رابط صالح",
         pattern: "صيغة {{field}} غير صالحة",
+        formInvalid: "يرجى التحقق من الحقول المميزة: {{fields}}",
         unique: "{{field}} يجب أن يكون فريداً",
         type: "{{field}} يجب أن يكون {{type}} صالحاً",
     },
@@ -1700,6 +1701,46 @@ const ar = {
             },
         },
     },
+    connectAgent: {
+        disabled: {
+            title: 'MCP معطّل في هذا النشر',
+            body: 'واجهة MCP متوقفة (OS_MCP_SERVER_ENABLED=false). اطلب من المشغّل إعادة تفعيلها.',
+        },
+        url: {
+            title: 'نقطة نهاية MCP لهذه البيئة',
+            body: 'أي عميل ذكاء اصطناعي يدعم MCP يتصل عبر هذا العنوان. الهوية ذاتية الخدمة: النشر هو خادم تفويض OAuth 2.1 الخاص به — تسجّل الدخول بهويتك، وكل استدعاء يخضع لصلاحياتك وأمان مستوى الصفوف.',
+            downloadSkill: 'تنزيل SKILL.md',
+            skillHint: 'مهارة الوكيل المحمولة: تعلّم أي وكيل داعم للمهارات كيفية العمل مع هذه البيئة.',
+        },
+        claude: {
+            body: 'الإعدادات ← الموصلات ← إضافة موصل مخصص، الصق هذا العنوان وسجّل الدخول عبر المتصفح.',
+            reachability: 'يتصل claude.ai (الويب) من خوادم Anthropic — يجب أن يكون النشر متاحًا عبر HTTPS عام. عملاء سطح المكتب والمحليون يصلون أيضًا إلى نشر الشبكات الداخلية.',
+        },
+        claudeCode: {
+            body: 'أمر واحد — يفتح تسجيل دخول OAuth تلقائيًا عند أول استخدام:',
+            plugin: 'أو ثبّت الإضافة الرسمية (تضيف مهارة ObjectStack وأمر /objectstack:connect الموجَّه):',
+        },
+        cursor: {
+            addButton: 'أضِف إلى Cursor',
+            body: 'استخدم زر النقرة الواحدة، أو أضف ما يلي إلى ‎.cursor/mcp.json:',
+        },
+        vscode: {
+            body: 'أضِف إلى ‎.vscode/mcp.json (أو عبر أمر MCP: Add Server):',
+        },
+        codex: {
+            body: 'أضِف إلى ‎~/.codex/config.toml. إذا كانت نسخة Codex لديك لا تدعم تدفق OAuth، فاستخدم ترويسة مفتاح API (انظر أدناه):',
+        },
+        apiKey: {
+            title: 'مفاتيح API',
+            badge: 'بدون واجهة',
+            body: 'للتكامل المستمر والسكربتات والوكلاء بلا متصفح. المفتاح يتصرف بهويتك — تعامل معه ككلمة مرور. يُعرض مرة واحدة فقط.',
+            namePlaceholder: 'اسم المفتاح (مثل ci-agent)',
+            mint: 'إنشاء مفتاح',
+            minting: 'جارٍ الإنشاء…',
+            showOnce: 'أُنشئ المفتاح «{{name}}» — انسخه الآن، لن يُعرض مجددًا:',
+            done: 'تم — إخفاء',
+        },
+    },
     marketplace: {
         title: "سوق التطبيقات",
         subtitle: "استعرض التطبيقات المعتمدة المنشورة في كتالوج ObjectStack. انقر على تطبيق لرؤية التفاصيل وتثبيته في أحد بيئاتك.",

package/dist/locales/de.d.ts

@@ -80,6 +80,7 @@ declare const de: {
         email: string;
         url: string;
         pattern: string;
+        formInvalid: string;
         unique: string;
         type: string;
     };
@@ -1700,6 +1701,46 @@ declare const de: {
             };
         };
     };
+    connectAgent: {
+        disabled: {
+            title: string;
+            body: string;
+        };
+        url: {
+            title: string;
+            body: string;
+            downloadSkill: string;
+            skillHint: string;
+        };
+        claude: {
+            body: string;
+            reachability: string;
+        };
+        claudeCode: {
+            body: string;
+            plugin: string;
+        };
+        cursor: {
+            addButton: string;
+            body: string;
+        };
+        vscode: {
+            body: string;
+        };
+        codex: {
+            body: string;
+        };
+        apiKey: {
+            title: string;
+            badge: string;
+            body: string;
+            namePlaceholder: string;
+            mint: string;
+            minting: string;
+            showOnce: string;
+            done: string;
+        };
+    };
     marketplace: {
         title: string;
         subtitle: string;

package/dist/locales/de.js

@@ -80,6 +80,7 @@ const de = {
         email: "Bitte geben Sie eine gültige E-Mail-Adresse ein",
         url: "Bitte geben Sie eine gültige URL ein",
         pattern: "{{field}} hat ein ungültiges Format",
+        formInvalid: "Bitte überprüfen Sie die markierten Felder: {{fields}}",
         unique: "{{field}} muss eindeutig sein",
         type: "{{field}} muss ein gültiger {{type}} sein",
     },
@@ -1700,6 +1701,46 @@ const de = {
             },
         },
     },
+    connectAgent: {
+        disabled: {
+            title: 'MCP ist auf dieser Bereitstellung deaktiviert',
+            body: 'Die MCP-Schnittstelle ist ausgeschaltet (OS_MCP_SERVER_ENABLED=false). Bitten Sie Ihren Betreiber, sie wieder zu aktivieren.',
+        },
+        url: {
+            title: 'MCP-Endpunkt dieser Umgebung',
+            body: 'Jeder MCP-fähige KI-Client verbindet sich über diese URL. Die Identität ist Self-Service: Die Bereitstellung ist ihr eigener OAuth-2.1-Autorisierungsserver — Sie melden sich als Sie selbst an, und jeder Aufruf unterliegt Ihren Berechtigungen und der Zeilensicherheit.',
+            downloadSkill: 'SKILL.md herunterladen',
+            skillHint: 'Die portable Agenten-Skill-Datei: erklärt jedem skill-fähigen Agenten die Arbeit mit dieser Umgebung.',
+        },
+        claude: {
+            body: 'Einstellungen → Connectors → Benutzerdefinierten Connector hinzufügen, dann diese URL einfügen und im Browser anmelden.',
+            reachability: 'claude.ai (Web) verbindet sich von Anthropic-Servern — die Bereitstellung muss über öffentliches HTTPS erreichbar sein. Claude Desktop und lokale Clients erreichen auch Intranet-Bereitstellungen.',
+        },
+        claudeCode: {
+            body: 'Ein Befehl — die OAuth-Anmeldung öffnet sich bei der ersten Nutzung automatisch:',
+            plugin: 'Oder das offizielle Plugin installieren (mit ObjectStack-Skill und geführtem /objectstack:connect):',
+        },
+        cursor: {
+            addButton: 'Zu Cursor hinzufügen',
+            body: 'Ein-Klick-Button verwenden oder Folgendes in .cursor/mcp.json eintragen:',
+        },
+        vscode: {
+            body: 'In .vscode/mcp.json eintragen (oder über den Befehl „MCP: Add Server“):',
+        },
+        codex: {
+            body: 'In ~/.codex/config.toml eintragen. Falls Ihre Codex-Version den OAuth-Flow nicht unterstützt, stattdessen einen API-Schlüssel-Header verwenden (siehe unten):',
+        },
+        apiKey: {
+            title: 'API-Schlüssel',
+            badge: 'headless',
+            body: 'Für CI, Skripte und Agenten ohne Browser. Der Schlüssel handelt als Sie — wie ein Passwort behandeln. Er wird nur EINMAL angezeigt.',
+            namePlaceholder: 'Schlüsselname (z. B. ci-agent)',
+            mint: 'Schlüssel erstellen',
+            minting: 'Wird erstellt…',
+            showOnce: 'Schlüssel „{{name}}“ erstellt — jetzt kopieren, er wird nicht erneut angezeigt:',
+            done: 'Fertig — ausblenden',
+        },
+    },
     marketplace: {
         title: "App-Marktplatz",
         subtitle: "Durchsuchen Sie genehmigte Apps, die im ObjectStack-Katalog veröffentlicht wurden. Klicken Sie auf eine App, um Details zu sehen und sie in eine Ihrer Umgebungen zu installieren.",

package/dist/locales/en.d.ts

@@ -83,6 +83,7 @@ declare const en: {
         readonly email: "Please enter a valid email address";
         readonly url: "Please enter a valid URL";
         readonly pattern: "{{field}} format is invalid";
+        readonly formInvalid: "Please check the highlighted fields: {{fields}}";
         readonly unique: "{{field}} must be unique";
         readonly type: "{{field}} must be a valid {{type}}";
     };
@@ -329,6 +330,10 @@ declare const en: {
                 readonly title: "No users yet";
                 readonly message: "User accounts are provisioned by the authentication provider, not created here. Invite teammates to your organization and they appear automatically on first sign-in (SSO just-in-time provisioning). App end-users arrive when they sign up through your app.";
             };
+            readonly betterAuthTeam: {
+                readonly title: "No teams yet";
+                readonly message: "Teams group members within an organization. Create one with “Create Team”, or they arrive through your auth provider’s organization and SSO provisioning flows.";
+            };
         };
         readonly showAll: "Show all";
         readonly pullToRefresh: "Pull to refresh";
@@ -481,6 +486,7 @@ declare const en: {
         readonly saveChanges: "Save changes";
         readonly saving: "Saving…";
         readonly editFieldsInline: "Edit fields";
+        readonly editInlineHint: "Double-click to edit";
         readonly lockedByApproval: "Locked for approval";
         readonly lockedTooltip: "This record has a pending approval request; editing is locked";
         readonly cancelApproval: "Recall approval";
@@ -1257,6 +1263,22 @@ declare const en: {
             readonly noAccessTitle: "Access denied";
             readonly noAccess: "You do not have permission to view this data.";
         };
+        readonly identityImport: {
+            readonly policyTitle: "Sign-in setup for imported users";
+            readonly policy: {
+                readonly none: "No password (recommended)";
+                readonly invite: "Send invitations";
+                readonly temporary: "Temporary passwords";
+            };
+            readonly policyHint: {
+                readonly none: "Users first sign in with a phone OTP, magic link, or password-reset link, then set their own password.";
+                readonly invite: "Each created user gets a set-your-password email (or an invitation SMS for phone-only rows). Requires a configured email/SMS service.";
+                readonly temporary: "For deployments without email/SMS: each created user gets a one-time password, shown ONCE on the result screen. First sign-in forces a change.";
+            };
+            readonly passwordsNote: "Temporary passwords — shown once, never stored. Save them now; each user must change theirs at first sign-in.";
+            readonly passwordsMore: "More entries omitted — use the download.";
+            readonly passwordsDownload: "Download CSV";
+        };
         readonly objectView: {
             readonly objectNotFound: "Object Not Found";
             readonly objectNotFoundDescription: "The object \"{{objectName}}\" does not exist in the current configuration.";
@@ -1673,6 +1695,11 @@ declare const en: {
             readonly disconnected: "Disconnected";
             readonly error: "Connection Error";
         };
+        readonly stage: {
+            readonly preview: "Preview";
+            readonly beta: "Beta";
+            readonly tooltip: "This platform is in preview — features may change.";
+        };
     };
     readonly home: {
         readonly title: "Home";
@@ -2052,6 +2079,46 @@ declare const en: {
             };
         };
     };
+    readonly connectAgent: {
+        readonly disabled: {
+            readonly title: "MCP is disabled on this deployment";
+            readonly body: "The MCP surface is off (OS_MCP_SERVER_ENABLED=false), so there is nothing to connect. Ask your operator to re-enable it.";
+        };
+        readonly url: {
+            readonly title: "This environment's MCP endpoint";
+            readonly body: "Any MCP-capable AI client connects with this URL. Identity is self-serve: the deployment is its own OAuth 2.1 authorization server, so interactive clients just open a browser login — you connect as yourself, and every call runs under your own permissions and row-level security.";
+            readonly downloadSkill: "Download SKILL.md";
+            readonly skillHint: "The portable agent skill: teaches any skills-capable agent how to work with this environment.";
+        };
+        readonly claude: {
+            readonly body: "Settings → Connectors → Add custom connector, then paste this URL. Sign in through the browser when prompted.";
+            readonly reachability: "claude.ai (web) connects from Anthropic's servers — the deployment must be reachable over public HTTPS. Claude Desktop and local clients also reach intranet deployments.";
+        };
+        readonly claudeCode: {
+            readonly body: "One command — the OAuth login opens automatically on first use:";
+            readonly plugin: "Or install the official plugin (adds the ObjectStack skill and a guided /objectstack:connect command):";
+        };
+        readonly cursor: {
+            readonly addButton: "Add to Cursor";
+            readonly body: "Use the one-click button, or add this to .cursor/mcp.json:";
+        };
+        readonly vscode: {
+            readonly body: "Add to .vscode/mcp.json (or via the MCP: Add Server command):";
+        };
+        readonly codex: {
+            readonly body: "Add to ~/.codex/config.toml. If your Codex version lacks the OAuth flow, use an API key header instead (see below):";
+        };
+        readonly apiKey: {
+            readonly title: "API keys";
+            readonly badge: "headless";
+            readonly body: "For CI, scripts, and agents without a browser. The key acts as you — treat it like a password. It is shown ONCE.";
+            readonly namePlaceholder: "Key name (e.g. ci-agent)";
+            readonly mint: "Create key";
+            readonly minting: "Creating…";
+            readonly showOnce: "Key \"{{name}}\" created — copy it now, it will not be shown again:";
+            readonly done: "Done — hide it";
+        };
+    };
     readonly marketplace: {
         readonly title: "App Marketplace";
         readonly subtitle: "Browse approved apps published to the ObjectStack catalog. Click an app to view details and install it into one of your environments.";
@@ -2134,6 +2201,15 @@ declare const en: {
             readonly localUnauthorized: "Sign in to this runtime first, then try again.";
             readonly localMarketplaceUnavailable: "This runtime has no OS_CLOUD_URL configured, so the marketplace catalog is unreachable.";
         };
+        readonly suggestedBindings: {
+            readonly promptEveryone: "This app suggests granting \"{{set}}\" to all signed-in users (the Everyone position).";
+            readonly promptGuest: "This app suggests granting \"{{set}}\" to unauthenticated visitors (the Guest position).";
+            readonly confirm: "Grant";
+            readonly confirming: "Granting…";
+            readonly dismiss: "Dismiss";
+            readonly confirmedToast: "\"{{set}}\" is now granted to {{anchor}}.";
+            readonly dismissedToast: "Suggestion for \"{{set}}\" dismissed.";
+        };
         readonly uninstall: {
             readonly confirm: "Uninstall {{manifestId}} v{{version}} from this runtime?\n\nThe cached manifest will be removed. The app will remain loaded in the running kernel until the next restart.";
             readonly successInList: "Removed {{manifestId}}. Restart the runtime to fully unload it from the running kernel.";

package/dist/locales/en.js

@@ -83,6 +83,7 @@ const en = {
         email: 'Please enter a valid email address',
         url: 'Please enter a valid URL',
         pattern: '{{field}} format is invalid',
+        formInvalid: 'Please check the highlighted fields: {{fields}}',
         unique: '{{field}} must be unique',
         type: '{{field}} must be a valid {{type}}',
     },
@@ -329,6 +330,10 @@ const en = {
                 title: 'No users yet',
                 message: 'User accounts are provisioned by the authentication provider, not created here. Invite teammates to your organization and they appear automatically on first sign-in (SSO just-in-time provisioning). App end-users arrive when they sign up through your app.',
             },
+            betterAuthTeam: {
+                title: 'No teams yet',
+                message: 'Teams group members within an organization. Create one with “Create Team”, or they arrive through your auth provider’s organization and SSO provisioning flows.',
+            },
         },
         showAll: 'Show all',
         pullToRefresh: 'Pull to refresh',
@@ -481,6 +486,7 @@ const en = {
         saveChanges: 'Save changes',
         saving: 'Saving…',
         editFieldsInline: 'Edit fields',
+        editInlineHint: 'Double-click to edit',
         lockedByApproval: 'Locked for approval',
         lockedTooltip: 'This record has a pending approval request; editing is locked',
         cancelApproval: 'Recall approval',
@@ -1273,6 +1279,22 @@ const en = {
             noAccessTitle: 'Access denied',
             noAccess: 'You do not have permission to view this data.',
         },
+        identityImport: {
+            policyTitle: 'Sign-in setup for imported users',
+            policy: {
+                none: 'No password (recommended)',
+                invite: 'Send invitations',
+                temporary: 'Temporary passwords',
+            },
+            policyHint: {
+                none: 'Users first sign in with a phone OTP, magic link, or password-reset link, then set their own password.',
+                invite: 'Each created user gets a set-your-password email (or an invitation SMS for phone-only rows). Requires a configured email/SMS service.',
+                temporary: 'For deployments without email/SMS: each created user gets a one-time password, shown ONCE on the result screen. First sign-in forces a change.',
+            },
+            passwordsNote: 'Temporary passwords — shown once, never stored. Save them now; each user must change theirs at first sign-in.',
+            passwordsMore: 'More entries omitted — use the download.',
+            passwordsDownload: 'Download CSV',
+        },
         objectView: {
             objectNotFound: 'Object Not Found',
             objectNotFoundDescription: 'The object "{{objectName}}" does not exist in the current configuration.',
@@ -1689,6 +1711,12 @@ const en = {
             disconnected: 'Disconnected',
             error: 'Connection Error',
         },
+        // Platform lifecycle chip shown next to the product wordmark (PreviewBadge).
+        stage: {
+            preview: 'Preview',
+            beta: 'Beta',
+            tooltip: 'This platform is in preview — features may change.',
+        },
     },
     home: {
         title: 'Home',
@@ -2071,6 +2099,46 @@ const en = {
             },
         },
     },
+    connectAgent: {
+        disabled: {
+            title: 'MCP is disabled on this deployment',
+            body: 'The MCP surface is off (OS_MCP_SERVER_ENABLED=false), so there is nothing to connect. Ask your operator to re-enable it.',
+        },
+        url: {
+            title: 'This environment\'s MCP endpoint',
+            body: 'Any MCP-capable AI client connects with this URL. Identity is self-serve: the deployment is its own OAuth 2.1 authorization server, so interactive clients just open a browser login — you connect as yourself, and every call runs under your own permissions and row-level security.',
+            downloadSkill: 'Download SKILL.md',
+            skillHint: 'The portable agent skill: teaches any skills-capable agent how to work with this environment.',
+        },
+        claude: {
+            body: 'Settings → Connectors → Add custom connector, then paste this URL. Sign in through the browser when prompted.',
+            reachability: 'claude.ai (web) connects from Anthropic\'s servers — the deployment must be reachable over public HTTPS. Claude Desktop and local clients also reach intranet deployments.',
+        },
+        claudeCode: {
+            body: 'One command — the OAuth login opens automatically on first use:',
+            plugin: 'Or install the official plugin (adds the ObjectStack skill and a guided /objectstack:connect command):',
+        },
+        cursor: {
+            addButton: 'Add to Cursor',
+            body: 'Use the one-click button, or add this to .cursor/mcp.json:',
+        },
+        vscode: {
+            body: 'Add to .vscode/mcp.json (or via the MCP: Add Server command):',
+        },
+        codex: {
+            body: 'Add to ~/.codex/config.toml. If your Codex version lacks the OAuth flow, use an API key header instead (see below):',
+        },
+        apiKey: {
+            title: 'API keys',
+            badge: 'headless',
+            body: 'For CI, scripts, and agents without a browser. The key acts as you — treat it like a password. It is shown ONCE.',
+            namePlaceholder: 'Key name (e.g. ci-agent)',
+            mint: 'Create key',
+            minting: 'Creating…',
+            showOnce: 'Key "{{name}}" created — copy it now, it will not be shown again:',
+            done: 'Done — hide it',
+        },
+    },
     marketplace: {
         title: 'App Marketplace',
         subtitle: 'Browse approved apps published to the ObjectStack catalog. Click an app to view details and install it into one of your environments.',
@@ -2153,6 +2221,18 @@ const en = {
             localUnauthorized: 'Sign in to this runtime first, then try again.',
             localMarketplaceUnavailable: 'This runtime has no OS_CLOUD_URL configured, so the marketplace catalog is unreachable.',
         },
+        // ADR-0090 D5/D9 — a package's isDefault permission set is an
+        // install-time suggestion to bind it to the everyone/guest position;
+        // the admin confirms here, the server never auto-binds.
+        suggestedBindings: {
+            promptEveryone: 'This app suggests granting "{{set}}" to all signed-in users (the Everyone position).',
+            promptGuest: 'This app suggests granting "{{set}}" to unauthenticated visitors (the Guest position).',
+            confirm: 'Grant',
+            confirming: 'Granting…',
+            dismiss: 'Dismiss',
+            confirmedToast: '"{{set}}" is now granted to {{anchor}}.',
+            dismissedToast: 'Suggestion for "{{set}}" dismissed.',
+        },
         uninstall: {
             confirm: 'Uninstall {{manifestId}} v{{version}} from this runtime?\n\nThe cached manifest will be removed. The app will remain loaded in the running kernel until the next restart.',
             successInList: 'Removed {{manifestId}}. Restart the runtime to fully unload it from the running kernel.',

package/dist/locales/es.d.ts

@@ -80,6 +80,7 @@ declare const es: {
         email: string;
         url: string;
         pattern: string;
+        formInvalid: string;
         unique: string;
         type: string;
     };
@@ -1700,6 +1701,46 @@ declare const es: {
             };
         };
     };
+    connectAgent: {
+        disabled: {
+            title: string;
+            body: string;
+        };
+        url: {
+            title: string;
+            body: string;
+            downloadSkill: string;
+            skillHint: string;
+        };
+        claude: {
+            body: string;
+            reachability: string;
+        };
+        claudeCode: {
+            body: string;
+            plugin: string;
+        };
+        cursor: {
+            addButton: string;
+            body: string;
+        };
+        vscode: {
+            body: string;
+        };
+        codex: {
+            body: string;
+        };
+        apiKey: {
+            title: string;
+            badge: string;
+            body: string;
+            namePlaceholder: string;
+            mint: string;
+            minting: string;
+            showOnce: string;
+            done: string;
+        };
+    };
     marketplace: {
         title: string;
         subtitle: string;

package/dist/locales/es.js

@@ -80,6 +80,7 @@ const es = {
         email: "Por favor, introduzca un correo electrónico válido",
         url: "Por favor, introduzca una URL válida",
         pattern: "El formato de {{field}} no es válido",
+        formInvalid: "Por favor, revise los campos resaltados: {{fields}}",
         unique: "{{field}} debe ser único",
         type: "{{field}} debe ser un {{type}} válido",
     },
@@ -1700,6 +1701,46 @@ const es = {
             },
         },
     },
+    connectAgent: {
+        disabled: {
+            title: 'MCP está deshabilitado en esta implementación',
+            body: 'La superficie MCP está apagada (OS_MCP_SERVER_ENABLED=false). Pida a su operador que la vuelva a habilitar.',
+        },
+        url: {
+            title: 'Endpoint MCP de este entorno',
+            body: 'Cualquier cliente de IA compatible con MCP se conecta con esta URL. La identidad es autoservicio: la implementación es su propio servidor de autorización OAuth 2.1 — inicia sesión como usted mismo y cada llamada corre bajo sus permisos y seguridad a nivel de fila.',
+            downloadSkill: 'Descargar SKILL.md',
+            skillHint: 'La skill portátil del agente: enseña a cualquier agente compatible cómo trabajar con este entorno.',
+        },
+        claude: {
+            body: 'Configuración → Conectores → Añadir conector personalizado, pegue esta URL e inicie sesión en el navegador.',
+            reachability: 'claude.ai (web) se conecta desde los servidores de Anthropic — la implementación debe ser accesible por HTTPS público. Claude Desktop y los clientes locales también alcanzan implementaciones de intranet.',
+        },
+        claudeCode: {
+            body: 'Un comando — el inicio de sesión OAuth se abre automáticamente en el primer uso:',
+            plugin: 'O instale el plugin oficial (añade la skill de ObjectStack y el comando guiado /objectstack:connect):',
+        },
+        cursor: {
+            addButton: 'Añadir a Cursor',
+            body: 'Use el botón de un clic o añada esto a .cursor/mcp.json:',
+        },
+        vscode: {
+            body: 'Añadir a .vscode/mcp.json (o mediante el comando MCP: Add Server):',
+        },
+        codex: {
+            body: 'Añadir a ~/.codex/config.toml. Si su versión de Codex no admite el flujo OAuth, use una cabecera de clave API (ver abajo):',
+        },
+        apiKey: {
+            title: 'Claves API',
+            badge: 'headless',
+            body: 'Para CI, scripts y agentes sin navegador. La clave actúa como usted — trátela como una contraseña. Se muestra UNA sola vez.',
+            namePlaceholder: 'Nombre de la clave (p. ej. ci-agent)',
+            mint: 'Crear clave',
+            minting: 'Creando…',
+            showOnce: 'Clave «{{name}}» creada — cópiela ahora, no se volverá a mostrar:',
+            done: 'Listo — ocultar',
+        },
+    },
     marketplace: {
         title: "Marketplace de aplicaciones",
         subtitle: "Explore aplicaciones aprobadas publicadas en el catálogo de ObjectStack. Haga clic en una aplicación para ver detalles e instalarla en uno de sus entornos.",