smart-admin-web 10.14.0 → 10.20.0

package/dist/locales/en-US.js

@@ -79,10 +79,12 @@ const e = {
     comfortable: "Comfortable",
     compact: "Compact",
     language: "Language",
-    loginStyle: "Login style",
     collapse: "Collapse",
     openMenu: "Open menu",
     switchModule: "Switch app",
+    appearance: "Appearance",
+    back: "Back",
+    forward: "Forward",
     logout: "Log out",
     personalCenter: "Account",
     clearCache: "Clear cache",
@@ -112,6 +114,17 @@ const e = {
     auto: "Auto",
     themeColor: "Theme color",
     custom: "Custom",
+    accentName: {
+      blue: "Blue",
+      indigo: "Indigo",
+      purple: "Purple",
+      teal: "Teal",
+      green: "Green",
+      graphite: "Graphite",
+      custom: "Custom color"
+    },
+    accentDemoButton: "Button",
+    accentDemoLink: "Link text",
     layout: "Layout",
     layoutVertical: "Vertical",
     layoutVerticalMix: "Vertical Mix",
@@ -120,6 +133,9 @@ const e = {
     layoutTopHybridSidebarFirst: "Top Hybrid (Sidebar)",
     layoutTopHybridHeaderFirst: "Top Hybrid (Header)",
     interface: "Interface",
+    formStyle: "Form style",
+    formStyleModal: "Dialog",
+    formStyleDrawer: "Drawer",
     showBreadcrumb: "Breadcrumb",
     showTabs: "Tabs",
     fixedHeader: "Fixed header",
@@ -127,19 +143,17 @@ const e = {
     transitionNone: "None",
     transitionFade: "Fade",
     transitionFadeSlide: "Fade slide",
-    grayscale: "Grayscale",
-    watermark: "Watermark",
-    watermarkText: "Watermark text",
-    watermarkPlaceholder: "Enter watermark text",
-    formStyle: "Form style",
-    formStyleModal: "Modal",
-    formStyleDrawer: "Drawer",
     resetConfirm: "Reset all settings to default?",
     copyConfig: "Copy config",
     configCopied: "Current config copied (paste into DEFAULTS in stores/app.ts to make it the new default)",
     searchPlaceholder: "Search menu…",
     searchEmpty: "No matching menu",
-    searchHint: "↑↓ navigate · ↵ open · Esc close"
+    searchHint: "↑↓ navigate · ↵ open · Esc close",
+    descBreadcrumb: "Show the page path in the header",
+    descTabs: "Keep opened pages and switch between them",
+    descFixedHeader: "Pin the header with frosted glass",
+    descPageTransition: "Animation when switching pages",
+    descCollapse: "Hide the sidebar, more room for content"
   },
   tabs: {
     refresh: "Refresh",
@@ -201,9 +215,9 @@ const e = {
     ssoDingtalk: "DingTalk",
     sso: "SSO",
     ssoComingSoon: "Third-party login coming soon",
-    skinAurora: "Aurora",
-    skinSplit: "Split",
-    skinSpotlight: "Spotlight"
+    layoutLabel: "Switch sign-in layout",
+    layoutToSolo: "Switch to single column",
+    layoutToSplit: "Switch to two columns"
   },
   module: {
     choose: "Choose app",
@@ -228,6 +242,7 @@ const e = {
     editTitle: "Edit app",
     deleteConfirm: 'Delete app "{title}"?',
     disableConfirm: 'Disable app "{title}"? It will disappear from the portal',
+    builtinNoDisable: "The built-in app cannot be disabled",
     saved: "Saved",
     deleted: "Deleted"
   },
@@ -286,6 +301,139 @@ const e = {
     saved: "Saved",
     deleted: "Deleted"
   },
+  // Translations of the kernel seed menu / app titles (DefaultMenuSeed / DefaultModuleSeed); the title -> key table is locales/kernelMenuTitles.ts
+  menuTitle: {
+    module: {
+      system: "System",
+      business: "Business Center"
+    },
+    catalog: {
+      org: "Organization",
+      ops: "System Operations",
+      schedule: "Job Scheduling",
+      audit: "Audit Logs",
+      ai: "AI Management"
+    },
+    page: {
+      workbench: "Workbench",
+      org: "Organizations",
+      position: "Positions",
+      user: "Users",
+      role: "Roles",
+      config: "System Settings",
+      dict: "Dictionaries",
+      menu: "Menus",
+      module: "Modules",
+      notice: "Notifications",
+      recycle: "Recycle Bin",
+      monitor: "Server Monitor",
+      cache: "Cache",
+      apiDocs: "API Docs",
+      job: "Scheduled Jobs",
+      jobLog: "Job Runs",
+      jobMonitor: "Job Monitor",
+      loginLog: "Login Logs",
+      opLog: "Operation Logs",
+      exceptionLog: "Exception Logs",
+      session: "Online Sessions",
+      file: "Files",
+      aiModel: "AI Models",
+      aiUsage: "AI Usage"
+    },
+    button: {
+      orgQuery: "Org - Query",
+      orgCreate: "Org - Create",
+      orgUpdate: "Org - Update",
+      orgDelete: "Org - Delete",
+      orgCopy: "Org - Copy",
+      positionQuery: "Position - Query",
+      positionCreate: "Position - Create",
+      positionUpdate: "Position - Update",
+      positionDelete: "Position - Delete",
+      userQuery: "User - Query",
+      userCreate: "User - Create",
+      userUpdate: "User - Update",
+      userDelete: "User - Delete",
+      userResetPassword: "User - Reset Password",
+      userToggle: "User - Enable / Disable",
+      userImport: "User - Import",
+      userExport: "User - Export",
+      roleQuery: "Role - Query",
+      roleCreate: "Role - Create",
+      roleUpdate: "Role - Update",
+      roleDelete: "Role - Delete",
+      roleGrantMenus: "Role - Grant Menus",
+      roleDataScope: "Role - Data Scope",
+      roleGrantUsers: "Role - Grant Users",
+      ping: "Connectivity Probe",
+      configQuery: "Config - Query",
+      configCreate: "Config - Create",
+      configUpdate: "Config - Update",
+      configDelete: "Config - Delete",
+      configUploadLogo: "Config - Upload Logo",
+      sensitiveQuery: "Sensitive Action - Query",
+      sensitiveCreate: "Sensitive Action - Create",
+      sensitiveDelete: "Sensitive Action - Delete",
+      mfaClear: "MFA - Unbind User Authenticator",
+      dictTypeQuery: "Dict Type - Query",
+      dictTypeCreate: "Dict Type - Create",
+      dictTypeUpdate: "Dict Type - Update",
+      dictTypeDelete: "Dict Type - Delete",
+      dictItemQuery: "Dict Item - Query",
+      dictItemCreate: "Dict Item - Create",
+      dictItemUpdate: "Dict Item - Update",
+      dictItemDelete: "Dict Item - Delete",
+      menuQuery: "Menu - Query",
+      menuCreate: "Menu - Create",
+      menuUpdate: "Menu - Update",
+      menuDelete: "Menu - Delete",
+      moduleQuery: "Module - Query",
+      moduleCreate: "Module - Create",
+      moduleUpdate: "Module - Update",
+      moduleDelete: "Module - Delete",
+      noticeQuery: "Notice - Query",
+      noticePublish: "Notice - Publish",
+      noticeDelete: "Notice - Delete",
+      recycleQuery: "Recycle Bin - Query",
+      recyclePurge: "Recycle Bin - Delete Permanently",
+      recycleRestore: "Recycle Bin - Restore",
+      monitorQuery: "Server Monitor - Query",
+      cacheFlushAuth: "Cache - Clear Permissions",
+      cacheFlushDict: "Cache - Clear Dictionaries",
+      cacheFlushConfig: "Cache - Clear Configs",
+      cacheRebuildPortal: "Cache - Rebuild Portal Menus",
+      apiDocsView: "API Docs - View Contract",
+      jobQuery: "Job - Query",
+      jobCreate: "Job - Create",
+      jobUpdate: "Job - Update",
+      jobDelete: "Job - Delete",
+      jobToggle: "Job - Enable / Disable",
+      jobRun: "Job - Run Once",
+      jobLogQuery: "Job Run - Query",
+      jobLogKill: "Job Run - Terminate",
+      jobLogClear: "Job Run - Clear",
+      jobMonitorQuery: "Job Monitor - Query",
+      loginLogQuery: "Login Log - Query",
+      loginLogClear: "Login Log - Clear",
+      opLogQuery: "Operation Log - Query",
+      opLogClear: "Operation Log - Clear",
+      opLogExport: "Operation Log - Export",
+      exceptionLogQuery: "Exception Log - Query",
+      exceptionLogClear: "Exception Log - Clear",
+      sessionQuery: "Online Session - Query",
+      sessionKick: "Force Logout",
+      fileQuery: "File - Query",
+      fileUpload: "File - Upload",
+      fileDelete: "File - Delete",
+      fileDownload: "File - Download",
+      aiProviderQuery: "AI Provider - Query",
+      aiProviderCreate: "AI Provider - Create",
+      aiProviderUpdate: "AI Provider - Update",
+      aiProviderDelete: "AI Provider - Delete",
+      aiProviderTest: "AI Provider - Test Connection",
+      aiUsageQuery: "AI Usage - Query"
+    }
+  },
   iconPicker: {
     placeholder: "Select icon",
     title: "Select icon",
@@ -308,9 +456,13 @@ const e = {
     fixedNone: "Unpin",
     expand: "Expand",
     collapse: "Collapse",
+    total: "Total {n}",
     // TableZoomButton (blow a wide table up to the full viewport)
     zoom: "Zoom in",
-    zoomExit: "Zoom out"
+    zoomExit: "Zoom out",
+    // Shown when a search condition is beyond what the backend can express (see utils/tableFilter.ts)
+    filterFallback: 'Some search conditions are not supported by the server (one condition per field; a date range needs "on or after" plus "on or before" joined by AND). Searching with the recognizable ones.',
+    filterTruncated: "More than 10000 rows: search only covers the first 10000. Use a more specific condition."
   },
   workbench: {
     welcome: "Hello, {name}",
@@ -358,6 +510,8 @@ const e = {
     passwordHint: "Leave blank to auto-generate one (shown once after creation)",
     org: "Org",
     allOrgs: "All",
+    // Narrow content area: the org tree moves into a drawer (toolbar button + drawer title)
+    orgFilter: "Organization",
     orgPlaceholder: "Select org (optional)",
     position: "Position",
     positionPlaceholder: "Select position (optional)",
@@ -528,113 +682,349 @@ const e = {
     deleteConfirm: 'Delete config "{name}"?',
     saved: "Saved",
     deleted: "Deleted",
-    groupManagedBy: 'This group belongs to the "{tab}" tab; saved configs appear there',
-    groupExtra: {
-      title: "Other configs in this group",
-      hint: "Configs in this group that the form above does not list. View, edit or delete them here."
-    },
+    keyManagedBy: 'This key is managed by the "{tab}" form. Edit it there after saving.',
+    unsaved: "{n} unsaved change(s)",
+    unsavedTab: "Unsaved changes",
+    discard: "Discard",
+    leaveTitle: "Discard unsaved changes?",
+    leaveConfirm: "You have unsaved configuration changes. They will be lost if you leave.",
     tab: {
-      base: "General",
+      brand: "Branding & login",
+      signin: "Sign-in methods",
       security: "Security",
-      externalAuth: "External login",
-      upload: "Upload",
+      watermark: "Watermark",
+      sensitive: "Sensitive actions",
+      upload: "Uploads",
       job: "Scheduled jobs",
-      other: "Other"
+      advanced: "Advanced"
+    },
+    brand: {
+      desc: "How the site looks in the browser tab, the sidebar, the footer and the login page.",
+      preview: "Live preview",
+      previewAdmin: "Admin",
+      previewLogin: "Login",
+      groupSite: "Site",
+      groupLogin: "Login page",
+      copyrightPh: "Leave empty to show the site name",
+      copyrightUrlHint: "When set, the footer copyright becomes a link"
+    },
+    watermark: {
+      desc: "Overlaid on every page after sign-in, never on the login page.",
+      groupContent: "Content",
+      groupStyle: "Style",
+      enable: "Enable watermark",
+      enableHint: "Overlay faint text on every page so a leaked screenshot can be traced to a person",
+      content: "Content",
+      contentHint: "Each user sees their own details, in the order below",
+      contentEmpty: "Nothing is selected, so no watermark will show",
+      field: {
+        name: "Name",
+        account: "Account",
+        org: "Organization",
+        phone: "Phone (last 4)",
+        time: "Current time",
+        text: "Custom text"
+      },
+      text: "Custom text",
+      textHint: 'e.g. "Internal only"; the same for everyone',
+      textPlaceholder: "Up to {max} characters",
+      timeFormat: "Time format",
+      layout: "Layout",
+      layoutSingle: "One line",
+      layoutMulti: "Multi-line",
+      fontSize: "Font size",
+      opacity: "Strength",
+      opacityHint: "Higher is easier to read the mark, and harder to read the page",
+      rotate: "Angle",
+      density: "Density",
+      sparse: "Loose",
+      normal: "Normal",
+      dense: "Tight",
+      cross: "Staggered",
+      crossHint: "Offset alternate rows by half a tile so it is harder to crop out"
+    },
+    logo: {
+      title: "Logo",
+      edit: "Change logo",
+      upload: "Upload a new image…",
+      useUrl: "Use an image URL…",
+      remove: "Remove, use the default",
+      help: "PNG, JPG or WEBP, cropped square; also the browser tab icon",
+      fallback: "Without a logo the built-in one is used. The browser tab icon follows the logo too.",
+      badType: "Only PNG, JPG and WEBP images are supported",
+      tooLarge: "The image must be at most {mb} MB",
+      cropTitle: "Crop new logo",
+      cropTip: "Drag or use the arrow keys to reposition; scroll, the slider or +/- to zoom",
+      zoom: "Zoom",
+      apply: "Set new logo",
+      cropFailed: "Cropping failed, try another image",
+      badUrl: "Enter an address starting with http:// or https://, or a site path starting with /",
+      urlHint: "The image must be publicly readable. A square image works best."
+    },
+    advanced: {
+      desc: "Configs that belong to none of the tabs above, edited as raw key/value rows. Keys the tabs above manage are not listed here."
+    },
+    preview: {
+      minutes: "{n} min",
+      hours: "{n} h",
+      days: "{n} days",
+      off: "(not enabled)",
+      sep: ", ",
+      expand: "Expand",
+      collapse: "Collapse",
+      req: {
+        upper: "an uppercase letter",
+        lower: "a lowercase letter",
+        digit: "a digit",
+        special: "a special character"
+      },
+      lock: "After {count} wrong passwords in a row the account is locked for {minutes} min",
+      lockOff: "Wrong passwords never lock the account",
+      captcha: "Sign-in asks for a captcha ({type})",
+      totp: "Users can use an authenticator as a second factor",
+      totpSuper: "Users can use an authenticator as a second factor; super admins must",
+      smsMfa: "Users with a bound phone verify an SMS code at sign-in",
+      password: "Passwords need at least {min} characters and {reqs}",
+      passwordMin: "Passwords need at least {min} characters",
+      expire: "Passwords must be changed every {days} days",
+      noExpire: "Passwords never expire",
+      history: "A new password cannot repeat the last {n}",
+      historyOff: "A new password may repeat an old one",
+      firstChange: "Admin-created accounts must change their password at first sign-in",
+      firstChangeOff: "New accounts keep their initial password at first sign-in",
+      session: "Access tokens renew every {access}; sign-in lasts up to {refresh}",
+      rateLimit: "At most {permit} requests per {seconds} s from one source"
     },
     job: {
-      logRetentionDays: "Log retention days",
+      desc: "How long run logs are kept and who hears about failures.",
+      preview: "Live preview · effect",
+      groupLog: "Run logs",
+      groupAlert: "Failure alerts",
+      logRetentionDays: "Keep for",
+      logRetentionHint: "Older logs are cleaned up daily",
       alertEmails: "Alert emails",
-      alertEmailsHint: "Separate multiple emails with commas"
+      alertEmailsHint: "Press Enter to add; none means no email",
+      previewRetention: "Run logs are kept for {days} days; older ones are cleaned up daily",
+      previewKeep: "Keep {days} days",
+      previewAxisStart: "{days} days ago",
+      previewToday: "Today",
+      previewTo: "To",
+      previewSubject: "Subject",
+      previewSubjectText: "[{site}] Scheduled job failed: Daily report",
+      previewBody: 'Job "Daily report" failed at 02:00 after 3 retries.',
+      previewError: "database connection timed out (30s)",
+      previewNoAlert: "Failed runs send no email; they are only recorded in the run log"
     },
     externalAuth: {
-      hint: "Choose which deployed third-party sign-in methods appear on the login page. Disabled methods are hidden and authorize is rejected. Secrets stay in server appsettings.",
-      empty: "No external login providers registered (install optional packages or configure OIDC)",
-      showOnLogin: "On login page",
-      hidden: "Hidden",
-      loginVisible: "Show on login page",
-      summary: "{total} methods · {on} shown on login",
-      summaryFull: "{total} total · {registered} configured · {on} on login",
-      reset: "Reset",
-      notConfigured: "Not configured",
-      notConfiguredTip: "Not registered on this deployment (package/secrets missing). Cannot show on login.",
+      preview: "Live preview · sign-in box",
+      previewOther: "Other sign-in options",
+      hint: "Which sign-in options appear on the login page. Connection details for each third party are entered in its Settings and stored encrypted.",
+      groupLocal: "Local account",
+      groupThird: "Third-party",
+      password: "Username and password",
+      passwordHint: "Always available",
+      smsHint: "Sign in with phone number and SMS code",
+      state: {
+        notInstalled: "Not installed",
+        unconfigured: "Not configured",
+        configured: "Configured"
+      },
+      settings: "Settings",
+      addOidc: "Add OIDC",
+      needPackage: "Install the {pkg} package on the server first",
+      codeRegistered: "Registered in code; not configured here",
       linkByAccount: "Link by account",
+      linkByAccountHint: "People with the same account ID are bound to the local account on first sign-in; asks to confirm",
       linkByAccountConfirmTitle: "Turn on link by account?",
-      linkByAccountConfirm: "The first time someone signs in with {name}, if their {name} account ID is exactly the same as a local account, the two are bound and they are signed in directly. Super admins, disabled accounts and accounts already bound to {name} are never linked. Make sure both sides are the same people first, e.g. local accounts were synced from {name}."
+      linkByAccountConfirm: "The first time someone signs in with {name}, if their {name} account ID is exactly the same as a local account, the two are bound and they are signed in directly. Super admins, disabled accounts and accounts already bound to {name} are never linked. Make sure both sides are the same people first, e.g. local accounts were synced from {name}.",
+      field: {
+        displayName: "Display name",
+        code: "Identifier",
+        corpId: "Corp ID",
+        agentId: "Agent ID",
+        corpSecret: "App secret",
+        appKey: "AppKey",
+        appSecret: "AppSecret",
+        clientId: "Client ID",
+        clientSecret: "Client secret",
+        appId: "AppId",
+        authority: "Authority",
+        scopes: "Scopes",
+        usePkce: "Use PKCE"
+      },
+      sheet: {
+        title: "{name} sign-in settings",
+        addOidc: "Add OIDC",
+        oidcHint: "A standard OpenID Connect identity source",
+        secretNote: "Secrets are stored encrypted and are not displayed after saving",
+        namePlaceholder: "e.g. Company SSO",
+        codePlaceholder: "lowercase letters, digits, hyphens",
+        codeFixed: "Cannot be changed after saving",
+        codeTaken: "This identifier is already in use",
+        secretPlaceholder: "Paste the secret",
+        secretSet: "set",
+        keepSecret: "Leave blank to keep · current {now}",
+        secretRetype: "Enter the secret again",
+        endpointMoved: "Authority changed: to avoid sending the saved secret to a new address, enter the client secret again.",
+        ephemeralKey: "The data-protection master key is temporary, so secrets cannot be saved yet. Configure SmartAdmin:Security:DataProtection:Key and restart.",
+        ephemeralTitle: "The master key is temporary; saving is unavailable",
+        callback: "Callback URL",
+        callbackHint: "Enter this callback URL in the {name} console.",
+        idp: "identity provider",
+        callbackMissing: "SmartAdmin:ExternalAuth:CallbackBaseUrl is not set in production, so the callback URL cannot be computed.",
+        copyFailed: "Copy failed; select it manually",
+        test: "Test connection",
+        testing: "Testing…",
+        saved: "Saved",
+        clear: "Clear settings",
+        clearTitle: 'Clear the settings for "{name}"?',
+        clearConfirm: "After clearing, this sign-in option is unavailable and disappears from the login page. Accounts users have already bound to {name} are not deleted.",
+        cleared: "Cleared"
+      },
+      check: {
+        reachable: "Connectivity",
+        credentials: "Credentials",
+        agent: "AgentId",
+        appId: "AppId",
+        secret: "AppSecret",
+        discovery: "Discovery document",
+        issuer: "Issuer match",
+        endpoints: "Authorization and token endpoints",
+        clientSecret: "Client secret",
+        timeout: "Timeout",
+        error: "Error"
+      },
+      checkStatus: {
+        ok: "passed",
+        failed: "failed",
+        skipped: "not verified"
+      }
     },
     base: {
       siteTitle: "Site title",
-      logo: "Logo URL",
-      siteSubtitle: "Login subtitle",
+      siteSubtitle: "Subtitle",
       copyright: "Copyright",
       copyrightUrl: "Copyright link"
     },
+    login: {
+      language: "Login page language",
+      localeZh: "Chinese",
+      localeEn: "English",
+      showFeatures: "Show feature list",
+      headline: "Headline",
+      headlinePlaceholder: "Leave empty to use the built-in headline",
+      highlight: "Highlight",
+      highlightPlaceholder: "Word in the headline to highlight",
+      highlightHint: "Word in the headline shown in the accent color",
+      features: "Features",
+      featuresPlaceholder: "One per line, up to 5",
+      featuresHint: "One per line, up to 5",
+      highlightMissing: "Not in the headline; it will render as plain text",
+      tooManyFeatures: "At most 5 features"
+    },
     security: {
+      desc: "Sign-in protection, password rules, session length and rate limits. Takes effect on save.",
+      preview: "Rules users will meet",
+      groupLogin: "Sign-in protection",
+      groupSession: "Session",
+      groupRate: "Rate limit",
+      zeroNoLock: "0 = never lock",
+      zeroNever: "0 = never expires",
+      zeroOff: "0 = no limit",
+      unit: { times: "times", minutes: "min", days: "days", seconds: "s", chars: "chars" },
+      tryLabel: "Try a password",
+      tryMin: "At least {n} chars",
+      tryPass: "Accepted",
+      tryFail: "Rejected",
       loginLock: {
-        title: "Login lockout",
-        maxFailCount: "Max fail count",
-        lockMinutes: "Lock minutes"
+        maxFailCount: "Lock after failures",
+        lockMinutes: "Lock duration"
       },
       password: {
-        title: "Password complexity",
+        title: "Password",
         minLength: "Min length",
+        mustContain: "Must contain",
+        chipUpper: "A-Z",
+        chipLower: "a-z",
+        chipDigit: "0-9",
+        // @ 在 vue-i18n 里是链接语法,要用字面量插值转义
+        chipSpecial: "#{'@'}!",
         requireUpper: "Require uppercase",
         requireLower: "Require lowercase",
         requireDigit: "Require digit",
         requireSpecial: "Require special char",
-        expireDays: "Password max age (days, 0 = never)",
-        historyCount: "Password history count (0 = off)"
+        expireDays: "Max age",
+        historyCount: "No reuse of last",
+        forceChangeOnFirstLogin: "Change at first sign-in",
+        forceChangeOnFirstLoginHint: "New accounts only; resets still require a change"
       },
       session: {
-        title: "Session lifetime",
-        accessMinutes: "Access token (min)",
-        refreshMinutes: "Refresh token (min)"
+        accessMinutes: "Access token lifetime",
+        refreshMinutes: "Stay signed in up to"
       },
       captcha: {
-        title: "Login captcha",
-        enabled: "Enable login captcha",
-        type: "Captcha type",
-        types: { char: "Characters", path: "Stroke (anti-scrape)", math: "Arithmetic" }
+        enabled: "Login captcha",
+        type: "Type",
+        types: { char: "Characters", path: "Stroke", math: "Arithmetic" }
       },
       totp: {
-        title: "Authenticator (TOTP)",
-        enabled: "Enable authenticator",
-        requireForSuperAdmin: "Require authenticator for super admin",
+        enabled: "Authenticator (TOTP)",
+        requireForSuperAdmin: "Required for super admins",
         hint: "Toggles like login captcha — takes effect immediately. Per-user “require authenticator” only enforces at sign-in when this is on; users bind under Account security."
       },
       sms: {
-        title: "SMS verification",
         hint: "The second factor only applies to users with a bound phone; in development, codes are printed to the backend log — production requires a real SMS provider (ISmsSender)."
       },
-      mfa: { enabled: "Enable SMS second factor" },
-      smsLogin: { enabled: "Enable SMS code sign-in" },
+      mfa: { enabled: "SMS second factor" },
+      smsLogin: { enabled: "SMS code sign-in" },
       rateLimit: {
-        title: "Rate limiting",
-        enabled: "Enable rate limiting",
-        windowSeconds: "Window (seconds)",
-        permitPerWindow: "Global requests / window",
-        authPermitPerWindow: "Auth-endpoint requests / window"
+        enabled: "Enabled",
+        windowSeconds: "Window",
+        permitPerWindow: "Per source, at most",
+        authPermitPerWindow: "Sign-in endpoints, at most"
       },
       highSens: {
-        title: "High-sensitivity permissions (custom)",
-        hint: "Kernel defaults cannot be removed; only consumer custom codes can be added/deleted. Writes require recent reauth.",
         code: "Permission code",
         remark: "Remark",
-        codePh: "e.g. POST:/api/v1/biz/order",
-        remarkPh: "Optional remark",
+        codePh: "e.g. POST:/api/v1/biz/order/refund",
+        remarkPh: "Remark (optional)",
         codeRequired: "Permission code is required"
       }
     },
+    sensitive: {
+      desc: "Users must verify their identity again before calling these endpoints. Built-in ones cannot be removed; add your own business endpoints. Changes apply immediately.",
+      preview: "What users see when they call it",
+      previewTip: "Click a row to switch",
+      previewDoing: "You are about to call",
+      method: "Method",
+      path: "Endpoint",
+      builtin: "Built-in",
+      added: "Added, effective now",
+      removed: "Removed, effective now",
+      removeConfirm: 'Remove "{code}"? Calling it will no longer require re-verification.'
+    },
     upload: {
-      title: "Upload limits",
-      maxSizeMb: "Max size (MB)",
-      allowedExtensions: "Allowed extensions",
-      extPlaceholder: "Type an extension, e.g. .jpg",
-      extTip: "With leading dot, lowercase; empty falls back to server default"
+      desc: "Size and type limits for every upload on the site. Takes effect on save.",
+      preview: "Live preview · upload box",
+      previewDrop: "Click or drop files here",
+      previewLimit: "Accepts {exts}, up to {mb} MB per file",
+      previewDefault: "server default types",
+      groupLimit: "Limits",
+      maxSizeMb: "Max file size",
+      allowedExtensions: "Allowed types",
+      extTip: "Empty = server default",
+      quickAdd: "Quick add",
+      preset: { images: "Images", docs: "Documents", archives: "Archives", clear: "Clear" },
+      fileOk: "OK",
+      fileBadExt: "{ext} not allowed",
+      fileTooBig: "Over {mb} MB",
+      fileDefault: "Per server default"
     }
   },
   // Dict management (master-detail: types on the left, items on the right)
   dict: {
     title: "Dictionaries",
+    typeTitle: "Dictionary types",
     code: "Type code",
     name: "Type name",
     searchName: "Search name",
@@ -648,7 +1038,7 @@ const e = {
     typeSaved: "Saved",
     typeDeleted: "Deleted",
     itemsOf: 'Items of "{name}"',
-    selectTypeHint: "Select a dict type on the left to manage its items",
+    selectTypeHint: "Select a dict type above to manage its items",
     itemLabel: "Label",
     itemValue: "Value",
     itemLabelRequired: "Enter a label",
@@ -658,7 +1048,10 @@ const e = {
     editItemTitle: "Edit dict item",
     itemDeleteConfirm: 'Delete dict item "{label}"?',
     itemSaved: "Saved",
-    itemDeleted: "Deleted"
+    itemDeleted: "Deleted",
+    codeImmutable: "The code cannot be changed after creation",
+    itemsSheetTitle: "Dict items",
+    selectItem: "Select"
   },
   // Org management (tree table + parent-org tree select)
   org: {
@@ -673,6 +1066,7 @@ const e = {
     parentPlaceholder: "Select parent (blank = top level)",
     nameRequired: "Enter a name",
     codePlaceholder: "Leave blank to auto-generate",
+    codeImmutableHint: "The code cannot be changed after creation",
     addChild: "Add child",
     addTitle: "Add org",
     editTitle: "Edit org",
@@ -815,6 +1209,7 @@ const e = {
     name: "Name",
     sort: "Sort",
     codePlaceholder: "Auto-generated if empty",
+    codeImmutableHint: "The code cannot be changed after creation",
     nameRequired: "Enter a name",
     addTitle: "Add position",
     editTitle: "Edit position",
@@ -844,10 +1239,17 @@ const e = {
     deleted: "Deleted",
     grantMenus: "Grant menus",
     grantSaved: "Grants saved",
-    catalog: "Directory",
-    menuCol: "Menu",
-    buttonsCol: "Buttons",
     apiOnlyRow: "API only (no page)",
+    grantSearch: "Search directories, pages or buttons",
+    grantSearchClear: "Clear search",
+    grantSelectAll: 'Select all in "{name}"',
+    noButtons: "No button permissions",
+    grantNoMatch: "No matching permissions",
+    grantNoMatchElsewhere: "{count} directory(ies) match in other apps. Switch the app above to view them.",
+    grantNoMenus: "No menus in this app",
+    grantSummary: "Granted {on} / {total}",
+    grantSummarySplit: "{pages} pages · {buttons} buttons",
+    grantUnsaved: "Unsaved changes",
     dataScope: "Data scope",
     scopeType: "Scope type",
     customOrgs: "Custom orgs",
@@ -1030,6 +1432,7 @@ const e = {
       killed: "Kill requested",
       clear: "Clear logs",
       clearTitle: "Clear run logs",
+      clearRange: "Range",
       clearAll: "All records",
       beforeDays: "Older than {n} days",
       clearHint: "Running records are always kept; this is a hard delete and cannot be undone.",
@@ -1118,6 +1521,7 @@ const e = {
     enabled: "Enabled",
     disabled: "Disabled",
     pendingConfigTip: "No API key configured yet — fill it in before saving",
+    pendingConfig: "Pending setup",
     provider: {
       code: "Provider code",
       codePlaceholder: "Unique code, immutable after creation",
@@ -1159,7 +1563,8 @@ const e = {
       defaultTag: "Default",
       atLeastOne: "Keep at least one model",
       duplicateName: "Duplicate model name",
-      noDefault: "No default model set"
+      noDefault: "No default model set",
+      defaultUniqueHint: "The default model is unique across all providers: saving a new default here clears the default of any other provider."
     },
     test: {
       action: "Test connection",
@@ -1330,7 +1735,14 @@ const e = {
       csrfInvalid: "Request validation failed; refresh the page and try again",
       reauthRequired: "This action requires re-authentication",
       mfaBindPasswordRequired: "Verify your current password before binding an authenticator",
-      apiKeyInvalid: "API key missing or invalid"
+      apiKeyInvalid: "API key missing or invalid",
+      externalAuthTypeNotFound: "Sign-in type does not exist or its package is not installed",
+      externalAuthCodeExists: "This code is already in use",
+      externalAuthCodeInvalid: "Code is invalid or conflicts with a built-in sign-in method",
+      externalAuthFieldMissing: "Required field missing: {field}",
+      externalAuthDataProtectionKeyMissing: "No data-protection master key is configured, so third-party secrets cannot be stored safely. Set SmartAdmin:Security:DataProtection:Key first",
+      externalAuthProviderNotFound: "This sign-in method is not configured",
+      externalAuthEndpointBlocked: "This address is rejected by the outbound-request fence; check the scheme, host and network range"
     },
     perm: {
       denied: "Access denied",
@@ -1499,7 +1911,8 @@ const e = {
     fallbackLink: "Didn't open automatically? Click here",
     copyToken: "Copy my API token",
     copyTokenHint: "In the new tab, click Authentication → Bearer in the top right and paste the token you just copied",
-    tokenCopied: "Copied"
+    tokenCopied: "Copied",
+    tokenWarn: "The token is the credential of your current session and acts as your identity. Do not share it with anyone."
   },
   // User import / export: column titles + file names (mirror UserImportProfile / UserExportProfile columns)
   userExport: {