aimeat 1.4.8 → 1.6.1

package/dist/.env.example

@@ -34,6 +34,21 @@ AIMEAT_PORT=40050
 # CORS: comma-separated list of allowed origins, or * for all (default: *)
 # AIMEAT_CORS_ALLOWED_ORIGINS=*
 # AIMEAT_CORS_ALLOWED_ORIGINS=https://portal.aimeat.fi,https://my-app.example.com
+# ── Security Limits ────────────────────────────────────────────
+# AIMEAT_LOGIN_RATE_LIMIT_MAX=15              # Max login attempts per window (default: 15)
+# AIMEAT_LOGIN_RATE_LIMIT_WINDOW_MS=60000     # Login rate limit window in ms (default: 60s)
+# AIMEAT_REGISTRATION_RATE_LIMIT_MAX=5        # Max registrations per window (default: 5)
+# AIMEAT_REGISTRATION_RATE_LIMIT_WINDOW_MS=60000
+# AIMEAT_ADMIN_AUTH_RATE_LIMIT_MAX=5          # Max admin auth attempts per window (default: 5)
+# AIMEAT_ADMIN_AUTH_RATE_LIMIT_WINDOW_MS=60000
+# AIMEAT_PASSWORD_LOCKOUT_ATTEMPTS=5          # Failed attempts before lockout (default: 5)
+# AIMEAT_PASSWORD_LOCKOUT_MINUTES=15          # Lockout duration in minutes (default: 15)
+# AIMEAT_JSON_BODY_LIMIT_MB=5                 # Default JSON body limit (default: 5MB)
+# AIMEAT_JSON_BODY_LIMIT_LARGE_MB=15          # Large body limit for apps/extensions (default: 15MB)
+# AIMEAT_EXT_MAX_DEBIT=100                    # Max morsels per extension wallet.consume() call
+# AIMEAT_FEDERATION_AUTH_POLICY=disabled       # disabled | all_peers | specific_peers
+# AIMEAT_FEDERATION_DEFAULT_SCOPES=memory:read,catalogue:read
+
 # ── Auth & Tokens ──────────────────────────────────────────────
 # AIMEAT_JWT_TTL=3600              # JWT lifetime in seconds (default: 1h)
 # AIMEAT_OTK_TTL_MS=300000        # OTK expiry in ms (default: 5min)

package/dist/locales/en.json

@@ -213,6 +213,10 @@
     "close": "Close",
     "error": "Error",
     "unknownError": "Unknown error",
+    "federate": "Federate",
+    "federateTooltip": "Make visible across the federation network",
+    "federated": "Federated",
+    "notFederated": "Local only",
     "stats": {
       "agents": "Agents",
       "morsels": "Morsels",
@@ -535,7 +539,17 @@
       "noAgents": "No agents registered yet. When you connect an AI assistant via MCP, its memory entries will appear here.",
       "setupMcp": "Set up MCP →",
       "agent": "Agent",
-      "defaultAgent": "Default agent"
+      "defaultAgent": "Default agent",
+      "pullFromHome": "Copy from home",
+      "pushToHome": "Save to home",
+      "pullSuccess": "Entry copied from home node",
+      "pushSuccess": "Entry saved to home node",
+      "federatedSession": "Federated session. Some entries may be on your home node.",
+      "syncedToFederation": "Synced",
+      "shareToFederation": "Share",
+      "stopSharing": "Unshare",
+      "shareSuccess": "Shared to federation",
+      "unshareSuccess": "Removed from federation"
     },
     "files": {
       "title": "Stored Files",
@@ -724,7 +738,9 @@
       "error": "Could not load federation info.",
       "peers": "Connected Peers",
       "online": "Online",
-      "offline": "Offline"
+      "offline": "Offline",
+      "statusConnected": "Connected to {count} nodes",
+      "statusStandalone": "Standalone"
     },
     "access": {
       "title": "Access Codes & Tokens",
@@ -744,7 +760,17 @@
       "keepSafe": "Keep this safe — it's your owner recovery key.",
       "keyCopied": "Key copied to clipboard!",
       "mcpEndpoint": "MCP Endpoint",
-      "mcpDesc": "Use this URL to connect MCP-compatible AI platforms to your node."
+      "mcpDesc": "Use this URL to connect MCP-compatible AI platforms to your node.",
+      "fedTitle": "Federation Access",
+      "fedDesc": "Control which federation nodes can verify your identity for remote login.",
+      "fedAddNode": "Add Node",
+      "fedNodeId": "Node ID",
+      "fedAllowAll": "Allow all federation nodes",
+      "fedAllowAllWarn": "Any node can verify your identity",
+      "fedNoConsents": "No federation login access granted.",
+      "fedRemove": "Remove",
+      "fedGranted": "Auth access granted",
+      "fedRevoked": "Auth access revoked"
     },
     "nodes": {
       "title": "Personal Nodes",
@@ -2203,7 +2229,8 @@
     "errUserShort": "Username must be at least 3 characters",
     "errPassShort": "Password must be at least 4 characters",
     "errWrongPass": "Wrong password for that username.",
-    "errFederatedLogin": "Federated login is not yet supported. This node is {localNode}, but the identity belongs to {remoteNode}.",
+    "connectingHome": "Connecting to home node...",
+    "errFederatedLogin": "Could not reach home node {remoteNode} for federated login.",
     "loggedIn": "logged in",
     "logoutBtn": "Logout",
     "usernameLabel": "Username",
@@ -2315,6 +2342,7 @@
     "created": "Created",
     "trust": "Trust",
     "lastSeen": "Last Seen",
+    "lastLogin": "Last Login",
     "morselSupply": "Morsel Supply",
     "todayActivity": "Today's Activity",
     "morselPolicy": "Morsel Policy",
@@ -2966,6 +2994,63 @@
     "pushUnsubscribeBtn": "Unsubscribe",
     "pushNoBrowserSupport": "This browser does not support push notifications",
 
+    "blocked": "Blocked",
+    "blockedCooldown": "Cooldown",
+    "blockedDisabled": "Disabled",
+    "blockedQuietHours": "Quiet Hours",
+    "breakdownFailed": "Failed",
+    "breakdownRetried": "Retried",
+    "breakdownSent": "Sent",
+    "breakdownType": "Type",
+    "channelEmail": "Email",
+    "channelPush": "Push",
+    "channels": "Channels",
+    "emailDelivery": "Email Delivery",
+    "emailType": {
+      "group_send": "Group Send",
+      "magic_link": "Magic Link",
+      "match_suggestion": "Match Suggestion",
+      "notification": "Notification",
+      "verification": "Verification"
+    },
+    "emailsFailed": "Emails Failed",
+    "emailsRetried": "Emails Retried",
+    "emailsSent": "Emails Sent",
+    "expiredSubs": "Expired Subs",
+    "live": "live",
+    "mailboxNotifBlocked": "Mailbox Blocked",
+    "mailboxNotifFailed": "Mailbox Failed",
+    "mailboxNotifSent": "Mailbox Sent",
+    "mailboxNotifications": "Mailbox Notifications",
+    "period30Days": "30 Days",
+    "period7Days": "7 Days",
+    "periodAll": "All",
+    "periodApply": "Apply",
+    "periodCustom": "Custom",
+    "periodFrom": "From",
+    "periodLabel": "Period",
+    "periodThisWeek": "This Week",
+    "periodTo": "To",
+    "periodToday": "Today",
+    "weekMon": "Mon",
+    "weekTue": "Tue",
+    "weekWed": "Wed",
+    "weekThu": "Thu",
+    "weekFri": "Fri",
+    "weekSat": "Sat",
+    "weekSun": "Sun",
+    "pushDelivery": "Push Notifications",
+    "pushFailed": "Push Failed",
+    "pushSent": "Push Sent",
+    "pushType": {
+      "board": "Board",
+      "federation": "Federation",
+      "general": "General",
+      "organism": "Organism",
+      "test": "Test",
+      "work": "Work"
+    },
+
     "totalEntries": "Total Entries",
     "cities": "Cities",
     "categories": "Categories",
@@ -3181,6 +3266,32 @@
     "fedDepeeringExplain": "These peers are in the grace period before permanent removal. In-flight work can still complete.",
     "fedDepeeringGrace": "Grace ends",
 
+    "fedShareCatalogue": "Share Catalogue",
+    "fedReplicateMemory": "Replicate Memory",
+    "fedAllowRouting": "Allow Routing",
+    "fedAllowAuth": "Allow Federated Login",
+    "fedAuthPolicyTitle": "Federation Auth Policy",
+    "fedAuthPolicyDesc": "Control whether users from other nodes can log in here and what they can do.",
+    "fedAuthDisabled": "Disabled (no federated logins)",
+    "fedAuthAllPeers": "All peers (any active peer's users can log in)",
+    "fedAuthSpecificPeers": "Specific peers (per-peer control)",
+    "fedDefaultScopes": "Default scopes for federated users:",
+    "fedPeerMode": "Peer Mode",
+    "fedPeerModeFederation": "Federation",
+    "fedPeerModePrivate": "Private P2P",
+    "fedPolicyUpdated": "Peer policy updated",
+    "fedPolicySectionTitle": "Policy",
+
+    "fedNetworkDirectoryTitle": "Network Directory",
+    "fedNetworkDirectoryDesc": "Services and data available across the federation network.",
+    "fedNetworkDirType": "Type",
+    "fedNetworkDirName": "Name",
+    "fedNetworkDirNode": "Node",
+    "fedNetworkDirCategory": "Category",
+    "fedNetworkDirPrice": "Price",
+    "fedNetworkDirEmpty": "No federated services discovered yet. Services appear when peers share their catalogue.",
+    "fedNetworkDirSearch": "Search services...",
+
     "genesisExplain": "Genesis peers are the founding nodes of a federation cluster. The genesis node is the first node that creates the federation, and it manages peer approvals, key exchange, and cluster policies.",
     "genesisHelpTitle": "What are genesis peers?",
     "genesisHelpDetail": "When you create a new federation, your node becomes the genesis (origin) node. Other nodes request to join, and you approve or reject them here. Genesis peers have special privileges: they can set cluster-wide policies, approve new members, and suspend misbehaving nodes. Approved peers can exchange data according to federation rules.",
@@ -3211,6 +3322,17 @@
     "cfgGroup_totp": "TOTP",
     "cfgGroup_matching": "Matching",
     "cfgGroup_extensions": "Extensions",
+    "cfgGroup_security": "Security",
+    "cfg_security_login_rate_limit_max": "Login rate limit (max per window)",
+    "cfg_security_login_rate_limit_window_ms": "Login rate limit window (ms)",
+    "cfg_security_registration_rate_limit_max": "Registration rate limit (max per window)",
+    "cfg_security_registration_rate_limit_window_ms": "Registration rate limit window (ms)",
+    "cfg_security_admin_auth_rate_limit_max": "Admin auth rate limit (max per window)",
+    "cfg_security_admin_auth_rate_limit_window_ms": "Admin auth rate limit window (ms)",
+    "cfg_security_password_lockout_attempts": "Password lockout after N failures",
+    "cfg_security_password_lockout_minutes": "Password lockout duration (minutes)",
+    "cfg_security_json_body_limit_mb": "JSON body size limit (MB)",
+    "cfg_security_json_body_limit_large_mb": "Large body size limit for apps/extensions (MB)",
     "cfgGroup_marketplace": "Marketplace",
     "cfgGroup_push": "Push",
     "cfgGroup_eudiw": "EUDIW",
@@ -3841,7 +3963,8 @@
       "errUserShort": "Username must be at least 3 characters",
       "errPassShort": "Password must be at least 4 characters",
       "errWrongPass": "Wrong password for that username.",
-      "errFederatedLogin": "Federated login is not yet supported. This node is {localNode}, but the identity belongs to {remoteNode}.",
+      "connectingHome": "Connecting to home node...",
+      "errFederatedLogin": "Could not reach home node {remoteNode} for federated login.",
       "loggedIn": "logged in",
       "logoutBtn": "Logout",
       "whyTitle": "✨ What do you get?",
@@ -3911,7 +4034,12 @@
       "revoke": "Revoke",
       "never": "Never",
       "revoking": "Revoking...",
-      "revoked": "Consent revoked"
+      "revoked": "Consent revoked",
+      "scopeFederation": "Federation",
+      "scopeAuth": "Login Access",
+      "filterAll": "All",
+      "filterFederation": "Federation",
+      "filterAuth": "Login Access"
     },
     "audit": {
       "title": "Audit Report",
@@ -4280,6 +4408,11 @@
       "owner": "My Agents",
       "shared": "My Agents"
     },
+    "federate": "Federate",
+    "federated": "Federated",
+    "notFederated": "Local only",
+    "federateSuccess": "Package shared to federation",
+    "unfederateSuccess": "Package removed from federation",
     "operator": {
       "tabLabel": "Knowledge",
       "review": "Review",

package/dist/locales/fi.json

@@ -213,6 +213,10 @@
     "close": "Sulje",
     "error": "Virhe",
     "unknownError": "Tuntematon virhe",
+    "federate": "Federoi",
+    "federateTooltip": "Tee näkyväksi federaatioverkossa",
+    "federated": "Federoitu",
+    "notFederated": "Vain paikallinen",
     "stats": {
       "agents": "Agentit",
       "morsels": "Muruset",
@@ -535,7 +539,17 @@
       "noAgents": "Ei rekisteröityjä agentteja. Kun yhdistät AI-assistentin MCP:llä, sen muistimerkinnät näkyvät täällä.",
       "setupMcp": "Aseta MCP →",
       "agent": "Agentti",
-      "defaultAgent": "Oletusagentti"
+      "defaultAgent": "Oletusagentti",
+      "pullFromHome": "Kopioi kotisolmulta",
+      "pushToHome": "Tallenna kotisolmulle",
+      "pullSuccess": "Merkinta kopioitu kotisolmulta",
+      "pushSuccess": "Merkinta tallennettu kotisolmulle",
+      "federatedSession": "Federoitu istunto. Osa merkinnoista voi olla kotisolmullasi.",
+      "syncedToFederation": "Synkronoitu",
+      "shareToFederation": "Jaa",
+      "stopSharing": "Lopeta jakaminen",
+      "shareSuccess": "Jaettu federaatioon",
+      "unshareSuccess": "Poistettu federaatiosta"
     },
     "files": {
       "title": "Tallennetut tiedostot",
@@ -724,7 +738,9 @@
       "error": "Federaatiotietojen lataus epäonnistui.",
       "peers": "Yhdistetyt vertaiset",
       "online": "Online",
-      "offline": "Offline"
+      "offline": "Offline",
+      "statusConnected": "Yhdistetty {count} solmuun",
+      "statusStandalone": "Itsenäinen"
     },
     "access": {
       "title": "Pääsykoodit & tokenit",
@@ -744,7 +760,17 @@
       "keepSafe": "Pidä tämä turvassa — se on palautusavaimesi.",
       "keyCopied": "Avain kopioitu leikepöydälle!",
       "mcpEndpoint": "MCP-päätepiste",
-      "mcpDesc": "Käytä tätä URL:iä yhdistääksesi MCP-yhteensopivat AI-alustat solmuusi."
+      "mcpDesc": "Käytä tätä URL:iä yhdistääksesi MCP-yhteensopivat AI-alustat solmuusi.",
+      "fedTitle": "Federaatioyhteys",
+      "fedDesc": "Hallinnoi mitkä solmut voivat todentaa henkilöllisyytesi etäkirjautumista varten.",
+      "fedAddNode": "Lisää solmu",
+      "fedNodeId": "Solmun ID",
+      "fedAllowAll": "Salli kaikki federaatiosolmut",
+      "fedAllowAllWarn": "Mikä tahansa solmu voi todentaa henkilöllisyytesi",
+      "fedNoConsents": "Federaatiokirjautumista ei myönnetty.",
+      "fedRemove": "Poista",
+      "fedGranted": "Todennusoikeus myönnetty",
+      "fedRevoked": "Todennusoikeus peruutettu"
     },
     "nodes": {
       "title": "Henkilökohtaiset solmut",
@@ -2203,7 +2229,8 @@
     "errUserShort": "Käyttäjänimen tulee olla vähintään 3 merkkiä",
     "errPassShort": "Salasanan tulee olla vähintään 4 merkkiä",
     "errWrongPass": "Väärä salasana tälle käyttäjänimelle.",
-    "errFederatedLogin": "Federoitu kirjautuminen ei ole vielä tuettu. Tämä solmu on {localNode}, mutta identiteetti kuuluu solmuun {remoteNode}.",
+    "connectingHome": "Yhdistetään kotisolmuun...",
+    "errFederatedLogin": "Kotisolmuun {remoteNode} ei saatu yhteyttä federoitua kirjautumista varten.",
     "loggedIn": "kirjautuneena",
     "logoutBtn": "Kirjaudu ulos",
     "usernameLabel": "Käyttäjänimi",
@@ -2315,6 +2342,7 @@
     "created": "Luotu",
     "trust": "Luottamus",
     "lastSeen": "Viimeksi nähty",
+    "lastLogin": "Viimeisin kirjautuminen",
     "morselSupply": "Murusten tarjonta",
     "todayActivity": "Päivän aktiviteetti",
     "morselPolicy": "Muruspolitiikka",
@@ -2966,6 +2994,63 @@
     "pushUnsubscribeBtn": "Peru tilaus",
     "pushNoBrowserSupport": "Tämä selain ei tue push-ilmoituksia",
 
+    "blocked": "Estetyt",
+    "blockedCooldown": "Jäähdytys",
+    "blockedDisabled": "Pois käytöstä",
+    "blockedQuietHours": "Hiljaiset tunnit",
+    "breakdownFailed": "Epäonnistuneet",
+    "breakdownRetried": "Uudelleenyritykset",
+    "breakdownSent": "Lähetetyt",
+    "breakdownType": "Tyyppi",
+    "channelEmail": "Sähköposti",
+    "channelPush": "Push",
+    "channels": "Kanavat",
+    "emailDelivery": "Sähköpostin toimitus",
+    "emailType": {
+      "group_send": "Ryhmälähetys",
+      "magic_link": "Kirjautumislinkki",
+      "match_suggestion": "Ehdotus",
+      "notification": "Ilmoitus",
+      "verification": "Vahvistus"
+    },
+    "emailsFailed": "Epäonnistuneet",
+    "emailsRetried": "Uudelleenyritykset",
+    "emailsSent": "Lähetetyt",
+    "expiredSubs": "Vanhentuneet",
+    "live": "live",
+    "mailboxNotifBlocked": "Postilaatikko estetyt",
+    "mailboxNotifFailed": "Postilaatikko epäonn.",
+    "mailboxNotifSent": "Postilaatikko lähet.",
+    "mailboxNotifications": "Postilaatikkoilmoitukset",
+    "period30Days": "30 päivää",
+    "period7Days": "7 päivää",
+    "periodAll": "Kaikki",
+    "periodApply": "Hae",
+    "periodCustom": "Mukautettu",
+    "periodFrom": "Alkaen",
+    "periodLabel": "Ajanjakso",
+    "periodThisWeek": "Tämä viikko",
+    "periodTo": "Asti",
+    "periodToday": "Tänään",
+    "weekMon": "Ma",
+    "weekTue": "Ti",
+    "weekWed": "Ke",
+    "weekThu": "To",
+    "weekFri": "Pe",
+    "weekSat": "La",
+    "weekSun": "Su",
+    "pushDelivery": "Push-ilmoitukset",
+    "pushFailed": "Epäonnistuneet",
+    "pushSent": "Lähetetyt",
+    "pushType": {
+      "board": "Keskustelu",
+      "federation": "Federaatio",
+      "general": "Yleinen",
+      "organism": "Organismi",
+      "test": "Testi",
+      "work": "Työ"
+    },
+
     "totalEntries": "Merkintöjä yhteensä",
     "cities": "Kaupungit",
     "categories": "Kategoriat",
@@ -3181,6 +3266,32 @@
     "fedDepeeringExplain": "Nämä vertaiset ovat armonaikajaksolla ennen lopullista poistamista. Keskeneräiset työt voivat vielä valmistua.",
     "fedDepeeringGrace": "Armonaika päättyy",
 
+    "fedShareCatalogue": "Jaa katalogi",
+    "fedReplicateMemory": "Replikoi muisti",
+    "fedAllowRouting": "Salli reititys",
+    "fedAllowAuth": "Salli federaatiokirjautuminen",
+    "fedAuthPolicyTitle": "Federaation todennuspolitiikka",
+    "fedAuthPolicyDesc": "Hallitse voivatko muiden solmujen kayttajat kirjautua tanne ja mita he voivat tehda.",
+    "fedAuthDisabled": "Pois kaytosta (ei federaatiokirjautumisia)",
+    "fedAuthAllPeers": "Kaikki vertaiset (kaikkien aktiivisten vertaisten kayttajat voivat kirjautua)",
+    "fedAuthSpecificPeers": "Tietyt vertaiset (vertaiskohtainen hallinta)",
+    "fedDefaultScopes": "Oletuslaajuudet federoiduille kayttajille:",
+    "fedPeerMode": "Vertaistila",
+    "fedPeerModeFederation": "Federaatio",
+    "fedPeerModePrivate": "Yksityinen P2P",
+    "fedPolicyUpdated": "Vertaispolitiikka päivitetty",
+    "fedPolicySectionTitle": "Politiikka",
+
+    "fedNetworkDirectoryTitle": "Verkkohakemisto",
+    "fedNetworkDirectoryDesc": "Palvelut ja data saatavilla federaatioverkossa.",
+    "fedNetworkDirType": "Tyyppi",
+    "fedNetworkDirName": "Nimi",
+    "fedNetworkDirNode": "Solmu",
+    "fedNetworkDirCategory": "Kategoria",
+    "fedNetworkDirPrice": "Hinta",
+    "fedNetworkDirEmpty": "Federoituja palveluita ei vielä löydetty. Palvelut näkyvät kun vertaissolmut jakavat kataloginsa.",
+    "fedNetworkDirSearch": "Hae palveluita...",
+
     "genesisExplain": "Genesis-vertaiset ovat federaatioklusterin perustajasolmuja. Genesis-solmu on ensimmäinen solmu, joka luo federaation, ja se hallinnoi vertaishyväksyntöjä, avainten vaihtoa ja klusterikäytäntöjä.",
     "genesisHelpTitle": "Mitä genesis-vertaiset ovat?",
     "genesisHelpDetail": "Kun luot uuden federaation, solmustasi tulee genesis-solmu (alkuperä). Muut solmut pyytävät liittymistä, ja hyväksyt tai hylkäät ne täällä. Genesis-vertaisilla on erityisoikeuksia: ne voivat asettaa klusterinlaajuisia käytäntöjä, hyväksyä uusia jäseniä ja keskeyttää väärin käyttäytyvät solmut. Hyväksytyt vertaiset voivat vaihtaa dataa federaatiosääntöjen mukaisesti.",
@@ -3211,6 +3322,17 @@
     "cfgGroup_totp": "TOTP",
     "cfgGroup_matching": "Matchaus",
     "cfgGroup_extensions": "Laajennukset",
+    "cfgGroup_security": "Turvallisuus",
+    "cfg_security_login_rate_limit_max": "Kirjautumisen nopeusrajoitus (max per ikkuna)",
+    "cfg_security_login_rate_limit_window_ms": "Kirjautumisen nopeusrajoitusikkuna (ms)",
+    "cfg_security_registration_rate_limit_max": "Rekisteroinnin nopeusrajoitus (max per ikkuna)",
+    "cfg_security_registration_rate_limit_window_ms": "Rekisteroinnin nopeusrajoitusikkuna (ms)",
+    "cfg_security_admin_auth_rate_limit_max": "Admin-todennuksen nopeusrajoitus (max per ikkuna)",
+    "cfg_security_admin_auth_rate_limit_window_ms": "Admin-todennuksen nopeusrajoitusikkuna (ms)",
+    "cfg_security_password_lockout_attempts": "Salasanalukitus N epaonnistumisen jalkeen",
+    "cfg_security_password_lockout_minutes": "Salasanalukituksen kesto (minuuttia)",
+    "cfg_security_json_body_limit_mb": "JSON-sisallon kokoraja (Mt)",
+    "cfg_security_json_body_limit_large_mb": "Suuri kokoraja sovelluksille/laajennuksille (Mt)",
     "cfgGroup_marketplace": "Kauppapaikka",
     "cfgGroup_push": "Push-ilmoitukset",
     "cfgGroup_eudiw": "EUDIW",
@@ -3841,7 +3963,8 @@
       "errUserShort": "Käyttäjänimen tulee olla vähintään 3 merkkiä",
       "errPassShort": "Salasanan tulee olla vähintään 4 merkkiä",
       "errWrongPass": "Väärä salasana tälle käyttäjänimelle.",
-      "errFederatedLogin": "Federoitu kirjautuminen ei ole vielä tuettu. Tämä solmu on {localNode}, mutta identiteetti kuuluu solmuun {remoteNode}.",
+      "connectingHome": "Yhdistetään kotisolmuun...",
+      "errFederatedLogin": "Kotisolmuun {remoteNode} ei saatu yhteyttä federoitua kirjautumista varten.",
       "loggedIn": "kirjautuneena",
       "logoutBtn": "Kirjaudu ulos",
       "whyTitle": "✨ Mitä saat?",
@@ -3911,7 +4034,12 @@
       "revoke": "Peru",
       "never": "Ei koskaan",
       "revoking": "Perutaan...",
-      "revoked": "Suostumus peruttu"
+      "revoked": "Suostumus peruttu",
+      "scopeFederation": "Federaatio",
+      "scopeAuth": "Kirjautumisoikeus",
+      "filterAll": "Kaikki",
+      "filterFederation": "Federaatio",
+      "filterAuth": "Kirjautumisoikeus"
     },
     "audit": {
       "title": "Auditointiraportti",
@@ -4280,6 +4408,11 @@
       "owner": "Omat agentit",
       "shared": "Omat agentit"
     },
+    "federate": "Federoi",
+    "federated": "Federoitu",
+    "notFederated": "Vain paikallinen",
+    "federateSuccess": "Paketti jaettu federaatioon",
+    "unfederateSuccess": "Paketti poistettu federaatiosta",
     "operator": {
       "tabLabel": "Tietopankki",
       "review": "Arvioi",

package/dist/public/css/views/admin.css

@@ -111,6 +111,7 @@
 /* Cards */
 .adm-grid { display: grid; gap: 16px; margin-bottom: 20px; }
 .adm-grid-4 { grid-template-columns: repeat(auto-fit, minmax(180px, 1fr)); }
+.adm-grid-3 { grid-template-columns: repeat(auto-fit, minmax(220px, 1fr)); }
 .adm-grid-2 { grid-template-columns: repeat(auto-fit, minmax(340px, 1fr)); }
 .adm-card {
   background: var(--glass-bg, #FFFFFF);
@@ -575,3 +576,99 @@
 .adm-member-add { display: flex; gap: 8px; align-items: center; }
 .adm-member-add .adm-input { flex: 1; font-size: .85rem; }
 .adm-font-mono { font-family: 'JetBrains Mono', monospace; }
+
+/* ── Stats Time Range Selector ── */
+.adm-time-range {
+  display: flex;
+  flex-wrap: wrap;
+  align-items: center;
+  gap: 8px;
+  margin-bottom: 20px;
+  padding: 12px 16px;
+  background: var(--glass-bg, #FFFFFF);
+  border: 1px solid var(--glass-border, #E5E7EB);
+  border-radius: 8px;
+}
+.adm-time-range-label {
+  font-size: 0.8rem;
+  color: var(--text-dim);
+  margin-right: 4px;
+}
+.adm-time-btn {
+  padding: 4px 12px;
+  font-size: 0.75rem;
+  border: 1px solid var(--glass-border, #E5E7EB);
+  border-radius: 6px;
+  background: transparent;
+  color: #1A1A2E;
+  cursor: pointer;
+  font-family: inherit;
+  transition: all 0.15s;
+}
+.adm-time-btn:hover { border-color: var(--accent); color: var(--accent); }
+.adm-time-btn.active { background: var(--accent); color: #fff; border-color: var(--accent); }
+.adm-time-custom {
+  display: flex;
+  align-items: center;
+  gap: 6px;
+  margin-left: auto;
+}
+.adm-time-custom input[type="date"] {
+  padding: 3px 8px;
+  font-size: 0.75rem;
+  border: 1px solid var(--glass-border, #E5E7EB);
+  border-radius: 4px;
+  background: #FAFAF8;
+  color: #1A1A2E;
+  font-family: inherit;
+}
+
+/* ── Stats Breakdown Table ── */
+.adm-breakdown-table {
+  width: 100%;
+  border-collapse: collapse;
+  font-size: 0.78rem;
+  margin-top: 8px;
+}
+.adm-breakdown-table th {
+  text-align: left;
+  padding: 6px 10px;
+  color: var(--text-dim);
+  border-bottom: 1px solid var(--glass-border, #E5E7EB);
+  font-weight: 500;
+}
+.adm-breakdown-table td {
+  padding: 5px 10px;
+  border-bottom: 1px solid #F3F4F6;
+}
+.adm-breakdown-table td.num {
+  text-align: right;
+  font-variant-numeric: tabular-nums;
+}
+
+/* ── Stats Section Header Colors ── */
+.adm-section-purple  { color: #a855f7; }
+.adm-section-cyan    { color: #06b6d4; }
+.adm-section-violet  { color: #8b5cf6; }
+.adm-section-amber   { color: #f59e0b; }
+.adm-section-red     { color: #ef4444; }
+
+/* ── Breakdown Table ── */
+.adm-breakdown-table th.num { text-align: right; }
+
+/* ── Stats Inline Breakdown ── */
+.adm-date-separator { color: var(--text-dim); }
+.adm-mailbox-inline { padding: 10px 16px; }
+.adm-blocked-reasons { margin-bottom: 6px; color: var(--text-dim); }
+.adm-channels-summary { color: var(--text-dim); }
+
+.adm-badge-live {
+  display: inline-block;
+  font-size: 0.6rem;
+  padding: 1px 6px;
+  border-radius: 4px;
+  background: var(--accent);
+  color: #fff;
+  vertical-align: middle;
+  margin-left: 6px;
+}

package/dist/public/css/views/profile.css

@@ -1240,6 +1240,7 @@
 .pf .access-warn-text { font-size: .75rem; color: var(--warn); margin-top: .5rem; }
 .pf .access-mcp-url  { font-family: monospace; font-size: .85rem; color: var(--love3); }
 .pf .access-mcp-desc { font-size: .75rem; color: var(--muted); margin-top: .3rem; }
+.pf .access-fed-add  { margin-top: .5rem; }
 
 /* ── Wallet tab ── */
 .pf .wl-val-success  { color: var(--success, #22c55e); }
@@ -1742,6 +1743,42 @@
   color: var(--danger, #ef4444);
 }
 
+/* --- Federation toggle (knowledge-tab) --- */
+.pf .kpkg-fed-toggle {
+  cursor: pointer;
+  border: none;
+  font-size: .7rem;
+  padding: .15rem .5rem;
+  border-radius: 6px;
+  font-weight: 700;
+  letter-spacing: .03em;
+}
+.pf .kpkg-fed-toggle:disabled { opacity: .5; cursor: wait; }
+
+/* --- Data Wallet scope filter buttons --- */
+.pf .dw-scope-filters {
+  display: flex;
+  gap: 4px;
+  flex-shrink: 0;
+}
+.pf .dw-filter-row {
+  flex-wrap: wrap;
+  gap: 6px;
+}
+
+/* --- Memory federation badge --- */
+.pf .pf-fed-badge {
+  font-size: .65rem;
+  padding: .1rem .4rem;
+  margin-left: 4px;
+}
+
+/* --- Federation standalone variant --- */
+.pf .pf-federation-standalone {
+  color: var(--text-dim, #6B7280);
+  background: var(--bg-dim, #f5f5f5);
+}
+
 .pf-gen-test-component.pf-gen-test-skipped .pf-gen-test-badge {
   background: var(--bg-dim);
   color: var(--text-muted);