@objectstack/service-settings 8.0.0 → 9.0.0

package/README.md

@@ -2,7 +2,7 @@
 
 Settings service for ObjectStack. Implements ADR-0007: a generic
 namespace **manifest** mechanism + a single K/V table (`sys_setting`) +
-a resolver that layers `Env > Tenant > User > Default`.
+a resolver that layers `OS_* env > Tenant > User > Default`.
 
 ## What it gives you
 
@@ -26,9 +26,12 @@ a resolver that layers `Env > Tenant > User > Default`.
 
 ## Env override
 
-`process.env[NAMESPACE_KEY]` (uppercased) takes precedence over any
-stored value. Such fields are returned with `source: 'env', locked:
-true` and writes (service or REST) fail with HTTP 409.
+`process.env[OS_NAMESPACE_KEY]` (uppercased, with dots / hyphens converted
+to underscores) takes precedence over any stored value. For example,
+`mail.smtp_host` resolves from `OS_MAIL_SMTP_HOST`, and
+`feature_flags.ai_enabled` resolves from `OS_FEATURE_FLAGS_AI_ENABLED`.
+Such fields are returned with `source: 'env', locked: true` and writes
+(service or REST) fail with HTTP 409.
 
 ## Encryption
 

package/dist/index.cjs

@@ -82,7 +82,7 @@ var NoopCryptoAdapter = class {
 // src/settings-service.types.ts
 function envKeyOf(namespace, key) {
   const slug = `${namespace}_${key}`.replace(/[.-]/g, "_").toUpperCase();
-  return slug;
+  return `OS_${slug}`;
 }
 var SettingsLockedError = class extends Error {
   constructor(namespace, key, reason = "locked-by-env") {
@@ -210,20 +210,20 @@ var SettingsService = class {
   // Manifest registry
   // ---------------------------------------------------------------------
   /** Register (or replace) a manifest. Idempotent. */
-  registerManifest(manifest5) {
+  registerManifest(manifest6) {
     const scopes = /* @__PURE__ */ new Map();
     const encryptedKeys = /* @__PURE__ */ new Set();
     const defaults = /* @__PURE__ */ new Map();
-    const defaultScope = manifest5.scope ?? "tenant";
-    for (const spec of manifest5.specifiers) {
+    const defaultScope = manifest6.scope ?? "tenant";
+    for (const spec of manifest6.specifiers) {
       if (!spec.key || LAYOUT_ONLY_TYPES.has(spec.type)) continue;
       scopes.set(spec.key, spec.scope ?? defaultScope);
       if (spec.encrypted || spec.type === "password") encryptedKeys.add(spec.key);
       if (typeof spec.default !== "undefined") defaults.set(spec.key, spec.default);
     }
-    const prev = this.registry.get(manifest5.namespace);
+    const prev = this.registry.get(manifest6.namespace);
     const actions = prev?.actions ?? /* @__PURE__ */ new Map();
-    this.registry.set(manifest5.namespace, { manifest: manifest5, scopes, encryptedKeys, defaults, actions });
+    this.registry.set(manifest6.namespace, { manifest: manifest6, scopes, encryptedKeys, defaults, actions });
   }
   /** Look up a manifest, or throw `UnknownNamespaceError`. */
   getManifest(namespace) {
@@ -950,11 +950,90 @@ var settingsPluginManifestHeader = {
   type: "plugin",
   scope: "system",
   name: "Settings Service",
-  description: "Generic settings registry + K/V resolver with Env > Tenant > User > Default precedence. ADR-0007."
+  description: "Generic settings registry + K/V resolver with OS_* env > Tenant > User > Default precedence. ADR-0007."
 };
 
-// src/manifests/mail.manifest.ts
+// src/manifests/auth.manifest.ts
 var manifest = {
+  namespace: "auth",
+  version: 1,
+  label: "Authentication",
+  icon: "LockKeyhole",
+  description: "Sign-in, registration, and built-in auth feature controls.",
+  scope: "global",
+  readPermission: "manage_platform_settings",
+  writePermission: "manage_platform_settings",
+  category: "Security",
+  order: 15,
+  specifiers: [
+    {
+      type: "group",
+      id: "email_password",
+      label: "Email and password",
+      required: false,
+      description: "Control local email/password sign-in and self-service registration."
+    },
+    {
+      type: "toggle",
+      key: "email_password_enabled",
+      label: "Enable email/password login",
+      required: false,
+      default: true
+    },
+    {
+      type: "toggle",
+      key: "signup_enabled",
+      label: "Allow self-service registration",
+      required: false,
+      default: true,
+      visible: "${data.email_password_enabled !== false}"
+    },
+    {
+      type: "toggle",
+      key: "require_email_verification",
+      label: "Require email verification",
+      required: false,
+      default: false,
+      visible: "${data.email_password_enabled !== false}"
+    },
+    {
+      type: "group",
+      id: "social",
+      label: "Social sign-in",
+      required: false,
+      description: "Configure the built-in Google sign-in provider. Deployment env vars still win."
+    },
+    {
+      type: "toggle",
+      key: "google_enabled",
+      label: "Enable Google login",
+      required: false,
+      default: true,
+      description: "Requires a Google OAuth client ID and secret from Google Cloud Console."
+    },
+    {
+      type: "text",
+      key: "google_client_id",
+      label: "Google client ID",
+      required: true,
+      description: "OAuth client ID from Google Cloud Console. GOOGLE_CLIENT_ID can also be set on the server.",
+      visible: "${data.google_enabled !== false}"
+    },
+    {
+      type: "password",
+      key: "google_client_secret",
+      label: "Google client secret",
+      required: true,
+      encrypted: true,
+      description: "Stored encrypted at rest. GOOGLE_CLIENT_SECRET can also be set on the server.",
+      visible: "${data.google_enabled !== false}"
+    }
+  ]
+};
+var authSettingsManifest = manifest;
+
+// src/manifests/mail.manifest.ts
+var manifest2 = {
   namespace: "mail",
   version: 1,
   label: "Mail Delivery",
@@ -1055,7 +1134,7 @@ var manifest = {
     }
   ]
 };
-var mailSettingsManifest = manifest;
+var mailSettingsManifest = manifest2;
 var mailTestActionHandler = async ({ values }) => {
   const provider = String(values.provider ?? "smtp");
   const fromEmail = values.from_email;
@@ -1148,7 +1227,7 @@ var featureFlagsSettingsManifest = {
       id: "beta_notice",
       label: "Heads up",
       required: false,
-      bannerText: "Beta features may change without notice. Pin via env vars (e.g. `FEATURE_FLAGS_AI_ENABLED=true`) to lock for the whole deployment.",
+      bannerText: "Beta features may change without notice. Pin via env vars (e.g. `OS_FEATURE_FLAGS_AI_ENABLED=true`) to lock for the whole deployment.",
       bannerSeverity: "warning"
     },
     { type: "group", id: "productivity", label: "Productivity", required: false },
@@ -1168,7 +1247,7 @@ var featureFlagsSettingsManifest = {
 };
 
 // src/manifests/storage.manifest.ts
-var manifest2 = {
+var manifest3 = {
   namespace: "storage",
   version: 1,
   label: "File Storage",
@@ -1308,7 +1387,7 @@ var manifest2 = {
     }
   ]
 };
-var storageSettingsManifest = manifest2;
+var storageSettingsManifest = manifest3;
 var storageTestActionHandler = async ({ values }) => {
   const adapter = String(values.adapter ?? "local");
   if (adapter === "local") {
@@ -1341,7 +1420,7 @@ var storageTestActionHandler = async ({ values }) => {
 };
 
 // src/manifests/ai.manifest.ts
-var manifest3 = {
+var manifest4 = {
   namespace: "ai",
   version: 1,
   label: "AI",
@@ -1842,7 +1921,7 @@ var manifest3 = {
     }
   ]
 };
-var aiSettingsManifest = manifest3;
+var aiSettingsManifest = manifest4;
 var aiTestActionHandler = async ({ values, payload }) => {
   const overrides = extractOverrides(payload);
   const merged = { ...values, ...overrides };
@@ -1901,7 +1980,7 @@ function extractOverrides(payload) {
 }
 
 // src/manifests/knowledge.manifest.ts
-var manifest4 = {
+var manifest5 = {
   namespace: "knowledge",
   version: 1,
   label: "Knowledge",
@@ -2055,11 +2134,12 @@ var manifest4 = {
     }
   ]
 };
-var knowledgeSettingsManifest = manifest4;
+var knowledgeSettingsManifest = manifest5;
 
 // src/manifests/index.ts
 var builtinSettingsManifests = [
   brandingSettingsManifest,
+  authSettingsManifest,
   mailSettingsManifest,
   storageSettingsManifest,
   aiSettingsManifest,
@@ -2129,6 +2209,37 @@ var en = {
         logo_url: { label: "Logo URL", help: "Example: https://\u2026/logo.svg" }
       }
     },
+    auth: {
+      title: "Authentication",
+      description: "Sign-in, registration, and built-in auth feature controls.",
+      groups: {
+        email_password: {
+          title: "Email and password",
+          description: "Control local email/password sign-in and self-service registration."
+        },
+        social: {
+          title: "Social sign-in",
+          description: "Configure the built-in Google sign-in provider. Deployment env vars still win."
+        }
+      },
+      keys: {
+        email_password_enabled: { label: "Enable email/password login" },
+        signup_enabled: { label: "Allow self-service registration" },
+        require_email_verification: { label: "Require email verification" },
+        google_enabled: {
+          label: "Enable Google login",
+          help: "Requires a Google OAuth client ID and secret from Google Cloud Console."
+        },
+        google_client_id: {
+          label: "Google client ID",
+          help: "OAuth client ID from Google Cloud Console. GOOGLE_CLIENT_ID can also be set on the server."
+        },
+        google_client_secret: {
+          label: "Google client secret",
+          help: "Stored encrypted at rest. GOOGLE_CLIENT_SECRET can also be set on the server."
+        }
+      }
+    },
     feature_flags: {
       title: "Feature Flags",
       description: "Toggle experimental and beta features for this workspace.",
@@ -2445,6 +2556,37 @@ var zhCN = {
         logo_url: { label: "Logo \u94FE\u63A5", help: "\u793A\u4F8B:https://\u2026/logo.svg" }
       }
     },
+    auth: {
+      title: "\u8BA4\u8BC1",
+      description: "\u767B\u5F55\u3001\u6CE8\u518C\u4EE5\u53CA\u5185\u7F6E\u8BA4\u8BC1\u529F\u80FD\u7684\u63A7\u5236\u9879\u3002",
+      groups: {
+        email_password: {
+          title: "\u90AE\u7BB1\u4E0E\u5BC6\u7801",
+          description: "\u63A7\u5236\u672C\u5730\u90AE\u7BB1/\u5BC6\u7801\u767B\u5F55\u4E0E\u81EA\u52A9\u6CE8\u518C\u3002"
+        },
+        social: {
+          title: "\u793E\u4EA4\u767B\u5F55",
+          description: "\u914D\u7F6E\u5185\u7F6E\u7684 Google \u767B\u5F55\u63D0\u4F9B\u5546\u3002\u90E8\u7F72\u73AF\u5883\u53D8\u91CF\u4ECD\u4F18\u5148\u751F\u6548\u3002"
+        }
+      },
+      keys: {
+        email_password_enabled: { label: "\u542F\u7528\u90AE\u7BB1/\u5BC6\u7801\u767B\u5F55" },
+        signup_enabled: { label: "\u5141\u8BB8\u81EA\u52A9\u6CE8\u518C" },
+        require_email_verification: { label: "\u8981\u6C42\u90AE\u7BB1\u9A8C\u8BC1" },
+        google_enabled: {
+          label: "\u542F\u7528 Google \u767B\u5F55",
+          help: "\u9700\u8981\u5728 Google Cloud Console \u4E2D\u521B\u5EFA\u7684 Google OAuth \u5BA2\u6237\u7AEF ID \u4E0E\u5BC6\u94A5\u3002"
+        },
+        google_client_id: {
+          label: "Google \u5BA2\u6237\u7AEF ID",
+          help: "\u6765\u81EA Google Cloud Console \u7684 OAuth \u5BA2\u6237\u7AEF ID\u3002\u4E5F\u53EF\u5728\u670D\u52A1\u5668\u4E0A\u8BBE\u7F6E GOOGLE_CLIENT_ID\u3002"
+        },
+        google_client_secret: {
+          label: "Google \u5BA2\u6237\u7AEF\u5BC6\u94A5",
+          help: "\u52A0\u5BC6\u5B58\u50A8\u3002\u4E5F\u53EF\u5728\u670D\u52A1\u5668\u4E0A\u8BBE\u7F6E GOOGLE_CLIENT_SECRET\u3002"
+        }
+      }
+    },
     feature_flags: {
       title: "\u529F\u80FD\u5F00\u5173",
       description: "\u4E3A\u5F53\u524D\u5DE5\u4F5C\u533A\u5F00\u542F\u5B9E\u9A8C\u6027\u4E0E\u6D4B\u8BD5\u529F\u80FD\u3002",
@@ -2668,6 +2810,37 @@ var jaJP = {
         logo_url: { label: "\u30ED\u30B4 URL", help: "\u4F8B: https://\u2026/logo.svg" }
       }
     },
+    auth: {
+      title: "\u8A8D\u8A3C",
+      description: "\u30B5\u30A4\u30F3\u30A4\u30F3\u3001\u767B\u9332\u3001\u7D44\u307F\u8FBC\u307F\u8A8D\u8A3C\u6A5F\u80FD\u306E\u5236\u5FA1\u3002",
+      groups: {
+        email_password: {
+          title: "\u30E1\u30FC\u30EB\u3068\u30D1\u30B9\u30EF\u30FC\u30C9",
+          description: "\u30ED\u30FC\u30AB\u30EB\u306E\u30E1\u30FC\u30EB/\u30D1\u30B9\u30EF\u30FC\u30C9\u30B5\u30A4\u30F3\u30A4\u30F3\u3068\u30BB\u30EB\u30D5\u30B5\u30FC\u30D3\u30B9\u767B\u9332\u3092\u5236\u5FA1\u3057\u307E\u3059\u3002"
+        },
+        social: {
+          title: "\u30BD\u30FC\u30B7\u30E3\u30EB\u30B5\u30A4\u30F3\u30A4\u30F3",
+          description: "\u7D44\u307F\u8FBC\u307F\u306E Google \u30B5\u30A4\u30F3\u30A4\u30F3\u30D7\u30ED\u30D0\u30A4\u30C0\u30FC\u3092\u8A2D\u5B9A\u3057\u307E\u3059\u3002\u30C7\u30D7\u30ED\u30A4\u306E\u74B0\u5883\u5909\u6570\u304C\u512A\u5148\u3055\u308C\u307E\u3059\u3002"
+        }
+      },
+      keys: {
+        email_password_enabled: { label: "\u30E1\u30FC\u30EB/\u30D1\u30B9\u30EF\u30FC\u30C9\u30ED\u30B0\u30A4\u30F3\u3092\u6709\u52B9\u5316" },
+        signup_enabled: { label: "\u30BB\u30EB\u30D5\u30B5\u30FC\u30D3\u30B9\u767B\u9332\u3092\u8A31\u53EF" },
+        require_email_verification: { label: "\u30E1\u30FC\u30EB\u78BA\u8A8D\u3092\u5FC5\u9808\u306B\u3059\u308B" },
+        google_enabled: {
+          label: "Google \u30ED\u30B0\u30A4\u30F3\u3092\u6709\u52B9\u5316",
+          help: "Google Cloud Console \u306E Google OAuth \u30AF\u30E9\u30A4\u30A2\u30F3\u30C8 ID \u3068\u30B7\u30FC\u30AF\u30EC\u30C3\u30C8\u304C\u5FC5\u8981\u3067\u3059\u3002"
+        },
+        google_client_id: {
+          label: "Google \u30AF\u30E9\u30A4\u30A2\u30F3\u30C8 ID",
+          help: "Google Cloud Console \u306E OAuth \u30AF\u30E9\u30A4\u30A2\u30F3\u30C8 ID\u3002\u30B5\u30FC\u30D0\u30FC\u5074\u3067 GOOGLE_CLIENT_ID \u3092\u8A2D\u5B9A\u3059\u308B\u3053\u3068\u3082\u3067\u304D\u307E\u3059\u3002"
+        },
+        google_client_secret: {
+          label: "Google \u30AF\u30E9\u30A4\u30A2\u30F3\u30C8\u30B7\u30FC\u30AF\u30EC\u30C3\u30C8",
+          help: "\u4FDD\u5B58\u6642\u306B\u6697\u53F7\u5316\u3055\u308C\u307E\u3059\u3002\u30B5\u30FC\u30D0\u30FC\u5074\u3067 GOOGLE_CLIENT_SECRET \u3092\u8A2D\u5B9A\u3059\u308B\u3053\u3068\u3082\u3067\u304D\u307E\u3059\u3002"
+        }
+      }
+    },
     feature_flags: {
       title: "\u6A5F\u80FD\u30D5\u30E9\u30B0",
       description: "\u3053\u306E\u30EF\u30FC\u30AF\u30B9\u30DA\u30FC\u30B9\u3067\u5B9F\u9A13\u7684\u30FB\u30D9\u30FC\u30BF\u6A5F\u80FD\u3092\u5207\u66FF\u3048\u307E\u3059\u3002",
@@ -2728,6 +2901,196 @@ var jaJP = {
       actions: {
         test: { label: "\u63A5\u7D9A\u30C6\u30B9\u30C8" }
       }
+    },
+    ai: {
+      title: "AI \u3068 Embedder",
+      description: "\u30D7\u30E9\u30C3\u30C8\u30D5\u30A9\u30FC\u30E0\u306E AI \u304A\u3088\u3073\u30CA\u30EC\u30C3\u30B8\u30B5\u30FC\u30D3\u30B9\u304C\u4F7F\u7528\u3059\u308B LLM \u30D7\u30ED\u30D0\u30A4\u30C0\u30FC\u3001\u30E2\u30C7\u30EB\u3001\u8A8D\u8A3C\u60C5\u5831\u3001Embedder \u8A2D\u5B9A\u3002",
+      groups: {
+        provider: {
+          title: "\u30D7\u30ED\u30D0\u30A4\u30C0\u30FC",
+          description: "LLM \u30D0\u30C3\u30AF\u30A8\u30F3\u30C9\u3092\u9078\u629E\u3057\u307E\u3059\u3002Memory \u30E2\u30FC\u30C9\u306F\u5165\u529B\u3092\u305D\u306E\u307E\u307E\u8FD4\u3057\u307E\u3059\u3002\u30C6\u30B9\u30C8\u7528\u3067\u3042\u308A\u3001\u672C\u756A\u3067\u306F\u4F7F\u7528\u3057\u306A\u3044\u3067\u304F\u3060\u3055\u3044\u3002"
+        },
+        gateway: {
+          title: "Vercel AI Gateway",
+          description: "\u30DE\u30EB\u30C1\u30D7\u30ED\u30D0\u30A4\u30C0\u30FC\u30EB\u30FC\u30BF\u30FC\u3002\u30E2\u30C7\u30EB\u6307\u5B9A\u306F `provider/model` \u5F62\u5F0F\u306B\u5F93\u3044\u307E\u3059\uFF08\u4F8B: `openai/gpt-4o`\uFF09\u3002"
+        },
+        openai: { title: "OpenAI" },
+        anthropic: { title: "Anthropic" },
+        google: { title: "Google" },
+        defaults: {
+          title: "\u751F\u6210\u306E\u30C7\u30D5\u30A9\u30EB\u30C8\u5024",
+          description: "\u30A8\u30FC\u30B8\u30A7\u30F3\u30C8\u307E\u305F\u306F\u30C1\u30E3\u30C3\u30C8\u30EA\u30AF\u30A8\u30B9\u30C8\u304C\u72EC\u81EA\u306E\u5024\u3092\u6307\u5B9A\u3057\u306A\u3044\u5834\u5408\u306B\u9069\u7528\u3055\u308C\u307E\u3059\u3002"
+        },
+        observability: { title: "\u53EF\u89B3\u6E2C\u6027" },
+        embedder: {
+          title: "Embedder",
+          description: "\u30CA\u30EC\u30C3\u30B8\u30BD\u30FC\u30B9\u3068 RAG \u304C\u4F7F\u7528\u3059\u308B\u30C6\u30AD\u30B9\u30C8 \u2192 \u30D9\u30AF\u30C8\u30EB\u30D7\u30ED\u30D0\u30A4\u30C0\u30FC\u3002\u4E0A\u8A18\u306E\u30C1\u30E3\u30C3\u30C8\u30D7\u30ED\u30D0\u30A4\u30C0\u30FC\u3068\u306F\u72EC\u7ACB\u3057\u3066\u3044\u307E\u3059\u3002"
+        }
+      },
+      keys: {
+        provider: {
+          label: "\u30D7\u30ED\u30D0\u30A4\u30C0\u30FC",
+          options: {
+            memory: "Memory\uFF08\u30A8\u30B3\u30FC \u2014 \u30C6\u30B9\u30C8\u5C02\u7528\uFF09",
+            gateway: "Vercel AI Gateway",
+            openai: "OpenAI",
+            anthropic: "Anthropic",
+            google: "Google Generative AI"
+          }
+        },
+        gateway_model: {
+          label: "Gateway \u30E2\u30C7\u30EB",
+          help: "AI_GATEWAY_MODEL \u3068\u3057\u3066\u8EE2\u9001\u3055\u308C\u307E\u3059\u3002\u4F8B: openai/gpt-4o"
+        },
+        gateway_api_key: {
+          label: "Gateway API \u30AD\u30FC",
+          help: "\u4EFB\u610F \u2014 Gateway \u304C\u8A8D\u8A3C\u3092\u8981\u6C42\u3059\u308B\u5834\u5408\u306E\u307F\u5FC5\u8981\u3067\u3059\u3002"
+        },
+        openai_api_key: {
+          label: "OpenAI API \u30AD\u30FC",
+          help: "OPENAI_API_KEY \u3068\u3057\u3066\u8EE2\u9001\u3055\u308C\u307E\u3059\u3002\u4FDD\u5B58\u6642\u306B\u6697\u53F7\u5316\u3055\u308C\u307E\u3059\u3002"
+        },
+        openai_model: {
+          label: "\u30E2\u30C7\u30EB",
+          help: "\u30C7\u30D5\u30A9\u30EB\u30C8\u306E\u30E2\u30C7\u30EB ID\u3002\u30A8\u30FC\u30B8\u30A7\u30F3\u30C8\u5358\u4F4D\u306E\u4E0A\u66F8\u304D\u304C\u512A\u5148\u3055\u308C\u307E\u3059\u3002"
+        },
+        openai_base_url: {
+          label: "Base URL",
+          help: "Azure OpenAI \u3084\u81EA\u5DF1\u30DB\u30B9\u30C8\u578B\u30B2\u30FC\u30C8\u30A6\u30A7\u30A4\u7528\u306E\u4E0A\u66F8\u304D\u3002api.openai.com \u306E\u5834\u5408\u306F\u7A7A\u6B04\u306B\u3057\u307E\u3059\u3002"
+        },
+        anthropic_api_key: {
+          label: "Anthropic API \u30AD\u30FC",
+          help: "ANTHROPIC_API_KEY \u3068\u3057\u3066\u8EE2\u9001\u3055\u308C\u307E\u3059\u3002\u4FDD\u5B58\u6642\u306B\u6697\u53F7\u5316\u3055\u308C\u307E\u3059\u3002"
+        },
+        anthropic_model: { label: "\u30E2\u30C7\u30EB" },
+        google_api_key: {
+          label: "Google API \u30AD\u30FC",
+          help: "GOOGLE_GENERATIVE_AI_API_KEY \u3068\u3057\u3066\u8EE2\u9001\u3055\u308C\u307E\u3059\u3002\u4FDD\u5B58\u6642\u306B\u6697\u53F7\u5316\u3055\u308C\u307E\u3059\u3002"
+        },
+        google_model: { label: "\u30E2\u30C7\u30EB" },
+        temperature: {
+          label: "Temperature",
+          help: "0 = \u6C7A\u5B9A\u7684\u30012 = \u975E\u5E38\u306B\u5275\u9020\u7684\u3002"
+        },
+        max_tokens: {
+          label: "\u6700\u5927\u51FA\u529B\u30C8\u30FC\u30AF\u30F3\u6570",
+          help: "\u30EC\u30B9\u30DD\u30F3\u30B9\u3054\u3068\u306B\u751F\u6210\u3055\u308C\u308B\u30C8\u30FC\u30AF\u30F3\u306E\u4E0A\u9650\u3002"
+        },
+        request_timeout_ms: { label: "\u30EA\u30AF\u30A8\u30B9\u30C8\u30BF\u30A4\u30E0\u30A2\u30A6\u30C8 (ms)" },
+        trace_enabled: {
+          label: "\u30C8\u30EC\u30FC\u30B9\u3092\u8A18\u9332",
+          help: "\u30C7\u30D0\u30C3\u30B0\u3068\u518D\u751F\u306E\u305F\u3081 prompt/response \u30C8\u30EC\u30FC\u30B9\u3092 sys_ai_trace \u306B\u4FDD\u5B58\u3057\u307E\u3059\u3002"
+        },
+        log_prompts: {
+          label: "\u5B8C\u5168\u306A\u30D7\u30ED\u30F3\u30D7\u30C8\u3092\u8A18\u9332",
+          help: "\u30E1\u30BF\u30C7\u30FC\u30BF\u3060\u3051\u3067\u306A\u304F\u30EC\u30F3\u30C0\u30EA\u30F3\u30B0\u3055\u308C\u305F\u30D7\u30ED\u30F3\u30D7\u30C8\u3092\u30C8\u30EC\u30FC\u30B9\u884C\u306B\u542B\u3081\u307E\u3059\u3002\u26A0 PII \u304C\u6F0F\u3048\u3044\u3059\u308B\u53EF\u80FD\u6027\u304C\u3042\u308A\u307E\u3059\u3002\u898F\u5236\u74B0\u5883\u3067\u306F\u7121\u52B9\u306B\u3057\u3066\u304F\u3060\u3055\u3044\u3002"
+        },
+        embedder_provider: {
+          label: "\u30D7\u30ED\u30D0\u30A4\u30C0\u30FC",
+          options: {
+            none: "\u7121\u52B9\uFF08\u57CB\u3081\u8FBC\u307F\u306A\u3057\uFF09",
+            openai: "OpenAI",
+            azure: "Azure OpenAI",
+            dashscope: "\u963F\u91CC\u901A\u4E49 DashScope",
+            zhipu: "\u667A\u8C31 BigModel",
+            siliconflow: "\u7845\u57FA\u6D41\u52A8 SiliconFlow",
+            doubao: "\u706B\u5C71\u5F15\u64CE Doubao",
+            minimax: "MiniMax",
+            ollama: "Ollama\uFF08\u30ED\u30FC\u30AB\u30EB\uFF09",
+            custom: "\u30AB\u30B9\u30BF\u30E0\uFF08OpenAI \u4E92\u63DB\uFF09"
+          }
+        },
+        embedder_api_key: {
+          label: "Embedder API \u30AD\u30FC",
+          help: "Authorization \u30D8\u30C3\u30C0\u30FC\u3068\u3057\u3066\u9001\u4FE1\u3055\u308C\u308B Bearer \u30C8\u30FC\u30AF\u30F3\u3002Ollama \u3067\u306F\u7A7A\u3067\u306A\u3044\u4EFB\u610F\u306E\u5024\u3067\u52D5\u4F5C\u3057\u307E\u3059\u3002"
+        },
+        embedder_model: {
+          label: "\u30E2\u30C7\u30EB",
+          help: "\u4F8B \u2014 OpenAI: text-embedding-3-small \xB7 \u963F\u91CC\u901A\u4E49: text-embedding-v3 \xB7 \u667A\u8C31: embedding-3 \xB7 \u7845\u57FA\u6D41\u52A8: BAAI/bge-m3 \xB7 Ollama: bge-m3"
+        },
+        embedder_base_url: {
+          label: "Base URL",
+          help: "\u30A8\u30F3\u30C9\u30DD\u30A4\u30F3\u30C8\u306E\u30EB\u30FC\u30C8\uFF08/embeddings \u3092\u542B\u307E\u306A\u3044\uFF09\u3002\u30D7\u30EA\u30BB\u30C3\u30C8\u304B\u3089\u81EA\u52D5\u5165\u529B\u3055\u308C\u307E\u3059\u3002\u30D7\u30ED\u30AD\u30B7\u3084\u81EA\u5DF1\u30DB\u30B9\u30C8\u578B\u30B2\u30FC\u30C8\u30A6\u30A7\u30A4\u7528\u306B\u4E0A\u66F8\u304D\u3067\u304D\u307E\u3059\u3002"
+        },
+        embedder_dimensions: {
+          label: "\u6B21\u5143\u6570",
+          help: "\u51FA\u529B\u6B21\u5143\u6570\u3092\u4E0A\u66F8\u304D\u3057\u307E\u3059\uFF08Matryoshka \u30E2\u30C7\u30EB\u306E\u307F\uFF09\u3002\u7A7A\u6B04\u306E\u5834\u5408\u306F\u30E2\u30C7\u30EB\u306E\u30C7\u30D5\u30A9\u30EB\u30C8\u3092\u4F7F\u7528\u3057\u307E\u3059\u3002"
+        },
+        embedder_batch_size: {
+          label: "\u30D0\u30C3\u30C1\u30B5\u30A4\u30BA",
+          help: "embed() \u547C\u3073\u51FA\u3057\u3054\u3068\u306E\u30C1\u30E3\u30F3\u30AF\u6570\u3002\u30D7\u30ED\u30D0\u30A4\u30C0\u30FC\u306E\u30EC\u30FC\u30C8/\u30B5\u30A4\u30BA\u5236\u9650\u306B\u9054\u3059\u308B\u5834\u5408\u306F\u6E1B\u3089\u3057\u307E\u3059\u3002"
+        }
+      },
+      actions: {
+        test: { label: "\u63A5\u7D9A\u30C6\u30B9\u30C8" },
+        test_embedder: { label: "Embedder \u3092\u30C6\u30B9\u30C8" }
+      }
+    },
+    knowledge: {
+      title: "\u30CA\u30EC\u30C3\u30B8",
+      description: "RAG / \u30CA\u30EC\u30C3\u30B8\u30BD\u30FC\u30B9\u7528\u306E\u30D9\u30AF\u30C8\u30EB\u30B9\u30C8\u30A2\u30D0\u30C3\u30AF\u30A8\u30F3\u30C9\u3002\u26A0 \u30A2\u30C0\u30D7\u30BF\u30FC\u3092\u5207\u66FF\u3048\u3066\u3082\u65E2\u5B58\u306E\u30A4\u30F3\u30C7\u30C3\u30AF\u30B9\u306F\u79FB\u884C\u3055\u308C\u307E\u305B\u3093\u3002",
+      groups: {
+        adapter: {
+          title: "\u30D0\u30C3\u30AF\u30A8\u30F3\u30C9",
+          description: "\u30C9\u30AD\u30E5\u30E1\u30F3\u30C8\u30C1\u30E3\u30F3\u30AF\u3068\u305D\u306E\u30D9\u30AF\u30C8\u30EB\u306E\u4FDD\u5B58\u5148\u3092\u9078\u629E\u3057\u307E\u3059\u3002"
+        },
+        turso: {
+          title: "Turso / libSQL",
+          description: "\u30DE\u30CD\u30FC\u30B8\u30C9 Turso\u3001\u30ED\u30FC\u30AB\u30EB\u30D5\u30A1\u30A4\u30EB\u3001\u30A4\u30F3\u30E1\u30E2\u30EA\u306E\u3044\u305A\u308C\u3067\u3082\u52D5\u4F5C\u3057\u307E\u3059\u3002"
+        },
+        ragflow: {
+          title: "RAGFlow",
+          description: "\u5916\u90E8 RAGFlow \u30C7\u30D7\u30ED\u30A4\u3002\u30BB\u30EB\u30D5\u30DB\u30B9\u30C8\u306E\u624B\u9806\u306F https://ragflow.io \u3092\u53C2\u7167\u3057\u3066\u304F\u3060\u3055\u3044\u3002"
+        },
+        indexing: {
+          title: "\u30A4\u30F3\u30C7\u30C3\u30AF\u30B9\u306E\u30C7\u30D5\u30A9\u30EB\u30C8\u5024",
+          description: "KnowledgeSource.adapterConfig \u306E\u30BD\u30FC\u30B9\u5358\u4F4D\u306E\u5024\u304C\u512A\u5148\u3055\u308C\u307E\u3059\u3002"
+        },
+        permissions: { title: "\u6A29\u9650" }
+      },
+      keys: {
+        adapter: {
+          label: "\u30A2\u30C0\u30D7\u30BF\u30FC",
+          options: {
+            memory: "\u30A4\u30F3\u30E1\u30E2\u30EA\uFF08\u958B\u767A/\u30C6\u30B9\u30C8\u5C02\u7528\uFF09",
+            turso: "Turso / libSQL\uFF08\u30AF\u30E9\u30A6\u30C9\u307E\u305F\u306F\u30ED\u30FC\u30AB\u30EB\uFF09",
+            ragflow: "RAGFlow\uFF08\u5916\u90E8\uFF09"
+          }
+        },
+        turso_url: {
+          label: "\u63A5\u7D9A URL",
+          help: "\u4F8B: libsql://your-tenant.turso.io \xB7 file:./.objectstack/knowledge.db \xB7 :memory:"
+        },
+        turso_auth_token: {
+          label: "\u8A8D\u8A3C\u30C8\u30FC\u30AF\u30F3",
+          help: "\u30DE\u30CD\u30FC\u30B8\u30C9 Turso URL \u306E\u5834\u5408\u306E\u307F\u5FC5\u8981\u3067\u3059\u3002"
+        },
+        ragflow_base_url: { label: "Base URL", help: "\u4F8B: http://localhost:9380" },
+        ragflow_api_key: { label: "API \u30AD\u30FC" },
+        ragflow_default_dataset: {
+          label: "\u30C7\u30D5\u30A9\u30EB\u30C8\u30C7\u30FC\u30BF\u30BB\u30C3\u30C8 ID",
+          help: "KnowledgeSource \u304C\u72EC\u81EA\u306E RAGFlow \u30C7\u30FC\u30BF\u30BB\u30C3\u30C8\u3092\u6307\u5B9A\u3057\u306A\u3044\u5834\u5408\u306B\u4F7F\u7528\u3055\u308C\u307E\u3059\u3002"
+        },
+        chunk_target: {
+          label: "\u76EE\u6A19\u30C1\u30E3\u30F3\u30AF\u30B5\u30A4\u30BA\uFF08\u6587\u5B57\u6570\uFF09",
+          help: "\u30C8\u30FC\u30AF\u30F3\u5358\u4F4D\u306E\u5206\u5272\u304C\u884C\u308F\u308C\u308B\u524D\u306E\u30C1\u30E3\u30F3\u30AF\u30B5\u30A4\u30BA\u306E\u30BD\u30D5\u30C8\u4E0A\u9650\u3002"
+        },
+        chunk_overlap: {
+          label: "\u30C1\u30E3\u30F3\u30AF\u306E\u91CD\u306A\u308A\uFF08\u6587\u5B57\u6570\uFF09",
+          help: "\u5883\u754C\u3092\u8D8A\u3048\u3066\u30B3\u30F3\u30C6\u30AD\u30B9\u30C8\u3092\u7DAD\u6301\u3059\u308B\u305F\u3081\u3001\u524D\u306E\u30C1\u30E3\u30F3\u30AF\u304B\u3089\u4FDD\u6301\u3059\u308B\u6587\u5B57\u6570\u3002"
+        },
+        over_fetch: {
+          label: "\u30AA\u30FC\u30D0\u30FC\u30D5\u30A7\u30C3\u30C1\u500D\u7387",
+          help: "JS \u5074\u306E\u30E1\u30BF\u30C7\u30FC\u30BF\u30D5\u30A3\u30EB\u30BF\u30EA\u30F3\u30B0\u3067\u3082\u884C\u304C\u6B8B\u308B\u3088\u3046\u3001\u5185\u90E8\u3067 topK \xD7 overFetch \u4EF6\u306E\u5019\u88DC\u3092\u53D6\u5F97\u3057\u307E\u3059\u3002"
+        },
+        enforce_rls: {
+          label: "\u691C\u7D22\u6642\u306B RLS \u3092\u5F37\u5236",
+          help: "\u5404\u30D2\u30C3\u30C8\u3092\u547C\u3073\u51FA\u3057\u5143\u306E\u30EC\u30B3\u30FC\u30C9\u30EC\u30D9\u30EB\u6A29\u9650\u306B\u5BFE\u3057\u3066\u518D\u78BA\u8A8D\u3057\u307E\u3059\u3002\u26A0 \u7121\u52B9\u5316\u3059\u308B\u3068\u30D7\u30E9\u30C3\u30C8\u30D5\u30A9\u30FC\u30E0\u56FA\u6709\u306E\u30BB\u30FC\u30D5\u30AC\u30FC\u30C9\u304C\u30B9\u30AD\u30C3\u30D7\u3055\u308C\u307E\u3059\u3002"
+        }
+      },
+      actions: {
+        test: { label: "\u63A5\u7D9A\u30C6\u30B9\u30C8" }
+      }
     }
   }
 };
@@ -2794,6 +3157,37 @@ var esES = {
         logo_url: { label: "URL del logotipo", help: "Ejemplo: https://\u2026/logo.svg" }
       }
     },
+    auth: {
+      title: "Autenticaci\xF3n",
+      description: "Inicio de sesi\xF3n, registro y controles de las funciones de autenticaci\xF3n integradas.",
+      groups: {
+        email_password: {
+          title: "Correo y contrase\xF1a",
+          description: "Controla el inicio de sesi\xF3n local con correo/contrase\xF1a y el registro de autoservicio."
+        },
+        social: {
+          title: "Inicio de sesi\xF3n social",
+          description: "Configura el proveedor de inicio de sesi\xF3n de Google integrado. Las variables de entorno del despliegue siguen teniendo prioridad."
+        }
+      },
+      keys: {
+        email_password_enabled: { label: "Habilitar inicio de sesi\xF3n con correo/contrase\xF1a" },
+        signup_enabled: { label: "Permitir registro de autoservicio" },
+        require_email_verification: { label: "Requerir verificaci\xF3n de correo" },
+        google_enabled: {
+          label: "Habilitar inicio de sesi\xF3n con Google",
+          help: "Requiere un ID de cliente y un secreto de OAuth de Google desde Google Cloud Console."
+        },
+        google_client_id: {
+          label: "ID de cliente de Google",
+          help: "ID de cliente de OAuth desde Google Cloud Console. Tambi\xE9n se puede definir GOOGLE_CLIENT_ID en el servidor."
+        },
+        google_client_secret: {
+          label: "Secreto de cliente de Google",
+          help: "Se almacena cifrado en reposo. Tambi\xE9n se puede definir GOOGLE_CLIENT_SECRET en el servidor."
+        }
+      }
+    },
     feature_flags: {
       title: "Indicadores de funci\xF3n",
       description: "Activa funciones experimentales y en beta para este espacio de trabajo.",