{
  "tunnelSettings": {
    "title": "Remote access",
    "subtitle": "Expose this gateway on the internet so the mobile app can connect from anywhere. Off by default for your security.",
    "needToken": "Sign in to the gateway (valid token) to manage remote access.",
    "riskBannerTitle": "Security notice",
    "riskBannerBody": "Remote access exposes your gateway on the public internet. Only enable when you understand the risks.",
    "emptyStateTitle": "Get a public HTTPS URL",
    "emptyStateBody": "Start remote access to reach this gateway from your phone or anywhere on the internet.",
    "publicUrlLabel": "Public URL",
    "showOptions": "More options",
    "hideOptions": "Hide options",
    "showAdvanced": "Advanced settings",
    "hideAdvanced": "Hide advanced settings",
    "pairWaitingForTunnel": "Start remote access above, then scan the QR code here to pair your mobile app.",
    "consentExpiredBanner": "The remote access security notice was updated. Re-confirm before starting the tunnel or enabling auto-start.",
    "statusTitle": "Status",
    "loading": "Loading tunnel status…",
    "statusConnected": "Connected",
    "statusConnecting": "Connecting…",
    "statusReconnecting": "Reconnecting…",
    "statusPreparingFrpc": "Preparing frpc…",
    "statusRegistering": "Registering tunnel…",
    "statusProvisioningTls": "Provisioning HTTPS…",
    "statusStartingFrpc": "Connecting to frp…",
    "statusError": "Error",
    "statusOff": "Off",
    "frpcDownloading": "Downloading frpc…",
    "frpcDownloadingPercent": "Downloading frpc… {{percent}}%",
    "frpcDownloadingBytes": "Downloading frpc… {{received}}",
    "frpcDownloadingUrlLabel": "Download URL",
    "frpcExtracting": "Extracting frpc…",
    "startProgressTitle": "Startup progress",
    "startProgressHint": "First start can take 2–4 minutes (DNS propagation + HTTPS). DNS validation retries once automatically. The public URL appears before the tunnel is fully ready.",
    "startProgressElapsed": "Current step: {{elapsed}}",
    "publicUrlPendingNotice": "Public URL is assigned. Finish the remaining steps before using it remotely.",
    "stepPrepareFrpc": "Prepare frpc client",
    "stepRegister": "Register with broker",
    "stepRegisterDetail": "Public URL assigned — HTTPS and frp connection still in progress",
    "stepTls": "Provision HTTPS certificate",
    "stepTlsDetail": "Requesting TLS certificate for your subdomain",
    "stepTlsChecking": "Checking existing certificate",
    "stepTlsDnsChallenge": "Publishing DNS validation record",
    "stepTlsDnsPropagation": "Waiting for DNS on all public resolvers (can take 2–4 minutes)",
    "stepTlsCaValidation": "Waiting for certificate authority validation",
    "stepTlsIssuing": "Issuing certificate",
    "stepFrpcLogin": "Connect frpc to frp server",
    "stepFrpcDetail": "Waiting for frpc login (up to 60 seconds)",
    "stepReconnectDetail": "Reconnecting frpc after interruption",
    "uptime": "Uptime",
    "lanHint": "For LAN + tunnel QR, set gateway host to 0.0.0.0 in Gateway settings.",
    "pairTitle": "Mobile app pairing",
    "pairSubtitle": "Scan with your mobile app. The app exchanges a one-time pairing key for your gateway token.",
    "pairTunnelActive": "Remote access is on. The QR includes your tunnel URL, LAN address when available, and a one-time pairing key.",
    "pairBaseUrlLabel": "Gateway URL for pairing",
    "pairBaseUrlHint": "Use an address reachable from your phone (for example LAN IP and port). This may differ from the address in your desktop browser.",
    "pairBaseUrlPlaceholder": "http://192.168.x.x:28790",
    "pairBlockedTitle": "Pairing is not ready on localhost",
    "pairBlockedLoopbackBody": "Your gateway is only listening on this computer (127.0.0.1). Phones cannot reach that address. Use a LAN IP after exposing the gateway on your network, or start remote access below.",
    "pairBlockedNextSteps": "Or enable remote access below for tunnel pairing.",
    "pairEnableLanButton": "Enable LAN pairing",
    "pairEnableLanConfirmTitle": "Expose gateway on your LAN?",
    "pairEnableLanConfirmBody": "This sets gateway bind to LAN (0.0.0.0) and restarts the gateway. Anyone on your local network who obtains the pairing QR or token could access your assistant. Only continue on networks you trust.",
    "pairEnableLanEnabling": "Enabling LAN pairing…",
    "pairEnableLanSecurityAuditLink": "Review gateway security audit",
    "pairSuggestedLanLabel": "Suggested LAN address on this machine",
    "pairUseSuggestedUrl": "Use suggested address",
    "pairCandidatesTitle": "Detected LAN addresses",
    "pairSelectCandidateTitle": "Choose a LAN address",
    "pairSelectCandidateHint": "Pick the address your phone can reach on this network. The mobile app can probe each URL with GET /api/tunnel/pair/ping before pairing.",
    "pairMobileProbeHint": "Mobile apps: validate manual URLs with POST /api/tunnel/pair/validate-url, probe with GET /api/tunnel/pair/ping, then exchange ps via POST /api/tunnel/exchange-token.",
    "pairQrDisabled": "Scanning is disabled until the gateway is reachable from your phone.",
    "pairLocalhostWarning": "This URL looks like localhost. Phones on the network cannot reach your machine unless you expose the gateway (for example bind to LAN and use http://<this-machine-ip>:<port>).",
    "pairSecurityNote": "The QR contains a one-time pairing key (valid 5 minutes, single use). Only show it where you trust the people and cameras around you.",
    "pairEncoding": "Generating QR…",
    "pairImageError": "Could not generate a QR image. Copy the pairing link instead.",
    "pairCopyLink": "Copy pairing link",
    "pairCopied": "Copied pairing link",
    "pairSchemeHint": "Format registered by apps: xopc://gateway/mobile-connect?baseUrl=…&ps=… (exchange ps for token via POST /api/tunnel/exchange-token)",
    "pairInvalidBaseUrl": "Enter an absolute gateway URL starting with http:// or https:// (no path required).",
    "pairTunnelPublicUrl": "Tunnel URL",
    "pairTunnelLanUrl": "LAN URL (in QR)",
    "start": "Start remote access",
    "stop": "Disconnect",
    "release": "Release public URL",
    "releaseHint": "Revokes the subdomain on the broker. Your next start will get a new public URL.",
    "releaseConfirmTitle": "Release public URL?",
    "releaseConfirmBody": "This deregisters the tunnel on frp.xopc.ai and clears saved credentials. You will get a new subdomain when you start remote access again.",
    "releaseConfirmLabel": "Release",
    "copyUrl": "Copy public URL",
    "copied": "Copied",
    "refreshQr": "Refresh QR",
    "optionsTitle": "Options",
    "autoStart": "Start tunnel when gateway launches",
    "autoStartHint": "Available after you start remote access once and accept the security notice.",
    "autoStartConfirmTitle": "Start tunnel on every gateway launch?",
    "autoStartConfirmBody": "Your gateway will be reachable from the internet whenever it runs. Only enable if you accept that risk.",
    "autoStartConfirmLabel": "Enable auto-start",
    "consentTitle": "Enable remote access",
    "consentIntro": "Read carefully before exposing your gateway:",
    "consentBullet1": "A public URL lets anyone who obtains it use your gateway Bearer token.",
    "consentBullet2": "Traffic is proxied via frp.xopc.ai (third-party infrastructure).",
    "consentBullet3": "Use a strong token; stop the tunnel when you do not need remote access.",
    "consentCheckbox": "I understand these risks and want to enable remote access",
    "consentConfirm": "Accept and start",
    "consentReconfirm": "Accept and continue",
    "consentCancel": "Cancel",
    "deeplinkTitle": "Deep link payload",
    "brokerNote": "Traffic is proxied via frp.xopc.ai. Keep your gateway token private.",
    "brokerDocsLink": "Public tunnel security docs",
    "brokerSecretTitle": "Tunnel Registration Key",
    "brokerSecretStepTitle": "Step 1 · Tunnel Registration Key",
    "brokerSecretHint": "Create a Tunnel Registration Key in the xopc Console, paste it below, and save. The key registers with frp.xopc.ai via the X-Registration-Secret header and is stored in xopc.json on this machine.",
    "brokerSecretConsoleLink": "Create Tunnel Registration Key in Console",
    "brokerSecretEnvHint": "The legacy environment variable XOPC_TUNNEL_REGISTRATION_SECRET is set (it overrides the value below). Create a new key in the Console, save it here, then remove the env var.",
    "brokerSecretMaskedHelp": "A key is saved in local config. You can view, copy, or replace it.",
    "brokerSecretPlaceholder": "Paste Tunnel Registration Key",
    "brokerSecretPlaceholderKeep": "Paste a new Tunnel Registration Key",
    "brokerSecretMissingHint": "Create a key in the Console first, then paste it here and save.",
    "brokerSecretRequiredBeforeStart": "Save a Tunnel Registration Key above before starting remote access.",
    "brokerSecretSave": "Save key",
    "brokerSecretSaveAndContinue": "Save and continue",
    "brokerSecretClear": "Clear saved key",
    "brokerSecretSaved": "Tunnel Registration Key saved",
    "brokerSecretCleared": "Saved Tunnel Registration Key cleared",
    "brokerSecretReadyTitle": "Tunnel Registration Key configured",
    "brokerSecretReadyHint": "You can start remote access below. Use Reconfigure to replace the key.",
    "brokerSecretReconfigure": "Reconfigure",
    "brokerSecretCancelReconfigure": "Cancel",
    "brokerSecretRevealFailed": "Could not load the saved key",
    "brokerSecretNotInConfigFile": "Key is not in the config file; plaintext cannot be shown.",
    "copyKey": "Copy key",
    "showKey": "Show key",
    "hideKey": "Hide key",
    "flowStepStart": "Step 2 · Start remote access"
  }
}
