masks-server 0.7.0

data/config/locales/en/manage/namespaces.yml

@@ -0,0 +1,14 @@
+en:
+  manage:
+    namespaces:
+      title: "Namespaces"
+      release_confirm: "Release %{name}? The next application to ask for it gets it, and the scopes beneath it stop meaning what they mean now."
+      released: "%{name} is free to be claimed again."
+      columns:
+        name: "Name"
+        claimed_by: "Claimed by"
+        resource: "Resource"
+        claimed: "Claimed"
+      nothing: "nothing"
+      release: "Release"
+      archive_to_release: "archive to release"

data/config/locales/en/manage/organization.yml

@@ -0,0 +1,132 @@
+en:
+  manage:
+    organization:
+      title: "Organization"
+      back: "Organizations"
+      archived_lede: "Archived %{when}. Nobody signs in as a member of it."
+      lede: "Apps name it with organization=%{key}, and tokens carry the member's role."
+      lenses:
+        all: "Everyone"
+        owners: "Owners"
+        invited: "Invited"
+      counts:
+        members:
+          one: "Member"
+          other: "Members"
+        owners:
+          one: "Owner"
+          other: "Owners"
+        invitations: "Invitations open"
+        live_tokens: "Live tokens"
+      facts:
+        key: "Key"
+        id: "ID"
+        asked_for_with: "Asked for with"
+        created: "Created"
+      status:
+        expired: "Expired %{when}. Send it again to renew it."
+        invited: "Invited %{when}"
+        invited_by: "Invited %{when} by %{by}"
+        from_directory: "From the directory, since %{day}"
+        since: "Since %{day}"
+      notices:
+        invited: "%{email} is invited as %{role}. Nothing is granted until they accept."
+        role_set: "%{name} is %{role} now. Their tokens under the old role stop working."
+        withdrawn: "The invitation to %{name} is withdrawn."
+        removed: "%{name} is out of %{organization}."
+        resent: "The invitation to %{name} was sent again."
+        role_added: "%{organization} offers %{role} now."
+        role_dropped: "%{organization} no longer offers %{role}."
+        saved: "Saved."
+        provider_saved: "Saved. People who sign in through it join this organization."
+        provider_back: "%{provider} serves the whole tenant again."
+        archived: "%{organization} is archived."
+        restored: "%{organization} is back."
+      questions:
+        withdraw: "Withdraw the invitation to %{name}?"
+        remove: "Remove %{name} from %{organization}? Their tokens for it stop working."
+        hand_back: "Hand %{provider} back to the whole tenant? People who sign in through it stop joining %{organization}."
+        archive: "Archive %{organization}? This stops anyone signing in as a member."
+        archive_tokens:
+          one: "Archive %{organization}? This stops anyone signing in as a member and revokes its %{count} live token."
+          other: "Archive %{organization}? This stops anyone signing in as a member and revokes its %{count} live tokens."
+      missing: "No organization is keyed %{key}."
+      all: "All organizations"
+      archived_alert: "Archived %{day}. Members keep their roles, and restoring lets them sign in again."
+      restore: "Restore"
+      ownerless: "Nobody owns %{organization}, so only managers can change its members. Make a member an owner."
+      invitation_link: "No mail service is set up, so send this invitation link yourself. It works once."
+      members:
+        title: "Members"
+        lede: "Owners manage members from their own account page too. An invitation grants nothing until it is accepted."
+        who: "Who to show"
+        add: "Add member"
+        email: "Email"
+        role: "Role"
+        invite: "Invite"
+        cancel: "Cancel"
+        hint: "They join once they accept, from the address you invite. Someone without an account gets an invitation to make one."
+        person: "Person"
+        empty:
+          invited: "No invitations are open."
+          owners: "Nobody owns this organization. Make a member an owner so someone can manage it."
+          all: "Nobody belongs here yet. Add the first member as owner."
+        expired: "expired"
+        invited: "invited"
+        last_owner: "last owner"
+        role_of: "Role of %{name}"
+        send_again: "Send again"
+        owner_first: "Make someone else an owner first."
+        withdraw: "Withdraw"
+        remove: "Remove"
+      signing_in:
+        title: "Signing in"
+        lede: "A member signs in under this policy, ahead of the app's and the tenant's. It applies from the first step when the app names the organization."
+        policy: "Sign-in policy"
+        inherited: "The app's or the tenant's"
+        providers: "Providers"
+        no_groups_mapped: "No groups mapped"
+        joins_as: "%{mapping}. Anyone else joins as %{role}."
+        edit: "Edit"
+        hand_back: "Hand back"
+        no_providers: "None. Give the organization its own provider, and everyone who signs in through it joins here in the role their groups map to."
+        give_provider: "Give a provider to this organization"
+        groups_claim: "Groups claim"
+        unmapped_role: "Role for anyone else"
+        role_map: "Groups to roles"
+        role_map_hint: "One group per line. The first group a person holds decides their role, on every sign-in."
+        save: "Save"
+        cancel: "Cancel"
+        domains: "Domains"
+        proven: "Proven %{day}"
+        waiting: "Waiting for its DNS record"
+        no_domains: "None proven. Until one of its providers proves a domain, owners can invite only the addresses sign-up admits, and a provisioning token cannot set email addresses."
+        domains_link: "Domains"
+        provisioning: "Provisioning"
+        tokens_reach:
+          one: "%{count} live token reaches only this organization."
+          other: "%{count} live tokens reach only this organization."
+        no_tokens: "No provisioning token reaches only this organization."
+        provisioning_link: "Provisioning"
+      roles:
+        title: "Roles"
+        lede: "A role is a word the member's tokens carry. Every organization offers owner and member."
+        stop_offering: "Stop offering %{role}"
+        held: "%{count} held, so it stays"
+        offer: "Offer another role"
+        add: "Add"
+        hint: "Lowercase letters, digits, dashes, and underscores. A role someone holds stays until nobody does."
+      details:
+        title: "Details"
+        name: "Name"
+      activity:
+        title: "Activity"
+        lede: "Changes to the organization, and what happened while someone signed in as a member."
+        empty: "Nothing yet."
+      archive:
+        title: "Archive"
+        lede: "Archiving stops anyone signing in as a member of %{organization}. Members keep their roles, so restoring it puts everything back."
+        lede_tokens:
+          one: "Archiving stops anyone signing in as a member of %{organization} and revokes its %{count} live token. Members keep their roles, so restoring it puts everything back."
+          other: "Archiving stops anyone signing in as a member of %{organization} and revokes its %{count} live tokens. Members keep their roles, so restoring it puts everything back."
+        button: "Archive %{organization}"

data/config/locales/en/manage/organization_cell.yml

@@ -0,0 +1,4 @@
+en:
+  manage:
+    organization_cell:
+      no_owner: "no owner"

data/config/locales/en/manage/organization_headcount.yml

@@ -0,0 +1,9 @@
+en:
+  manage:
+    organization_headcount:
+      members:
+        one: "%{count} member"
+        other: "%{count} members"
+      invited:
+        one: "%{count} invited"
+        other: "%{count} invited"

data/config/locales/en/manage/organizations.yml

@@ -0,0 +1,31 @@
+en:
+  manage:
+    organizations:
+      title: "Organizations"
+      lede: "The customers inside this tenant. An app that asks for the organization scope signs a person in as a member of one, and their token carries the role they hold there."
+      columns:
+        organization: "Organization"
+        members: "Members"
+        roles: "Roles"
+        signs_in: "Signs in with"
+      restored: "%{name} is back."
+      members:
+        one: "%{count} member"
+        other: "%{count} members"
+      members_invited: "%{members}, %{count} invited"
+      add: "Add organization"
+      add_lede: "You become its first owner, and can add members once it exists."
+      name: "Name"
+      key: "Key"
+      key_hint: "An app asks for this organization with"
+      key_word: "key"
+      key_hint_end: ". The key cannot change later."
+      adding: "Adding..."
+      cancel: "Cancel"
+      empty: "No organizations yet. Add one for each customer whose people sign in together."
+      tenant_policy: "The tenant's policy"
+      archived:
+        title: "Archived"
+        lede: "Nobody signs in as a member of these. Restoring one puts its members back as they were."
+        detail: "· archived %{day} · %{members}"
+      restore: "Restore"

data/config/locales/en/manage/pairing.yml

@@ -0,0 +1,5 @@
+en:
+  manage:
+    pairing:
+      registration_failed: "registration failed"
+      secret_issued: "masks issued a secret to a browser, which must never happen"

data/config/locales/en/manage/policies.yml

@@ -0,0 +1,111 @@
+en:
+  manage:
+    policies:
+      title: "Policies"
+      add: "Add policy"
+      added: "%{name} added."
+      saved: "%{name} saved."
+      archived_notice: "%{name} is archived."
+      restored: "%{name} is back."
+      archive_confirm: "Archive %{name}? Its clients go back to the default."
+      never: "Never"
+      score: "%{score} or more"
+      presence:
+        "off": "Off"
+        optional: "Optional"
+        required: "Required"
+      first:
+        password: "Password"
+        passkey: "Passkey"
+        provider: "Provider"
+        email_code: "Emailed code"
+      second:
+        otp: "Authenticator app"
+        passkey: "Passkey"
+        backup_codes: "Backup codes"
+        email: "Email codes"
+        sms: "SMS codes"
+        trusted_device: "Approval from a trusted device"
+      confirmations:
+        none: "None"
+        code: "Emailed code"
+        link: "Emailed link"
+        approval: "Manager approval"
+      summary:
+        signup_open: "signup open"
+        invitation_only: "invitation only"
+        second_factor_required: "second factor required"
+        apps_require_second_factor: "second factor at every app sign-in"
+        lifetime: "sessions last %{duration}"
+        idle: "idle after %{duration}"
+        confirmed_by: "confirmed by %{confirmation}"
+        phone_required: "phone required"
+        hidden: "hidden accounts"
+      form:
+        new: "New policy"
+        name: "Name"
+        name_placeholder: "Customers"
+        key: "Key"
+        add_one: "Add one"
+        create: "Add"
+        save: "Save"
+        cancel: "Cancel"
+        signup:
+          legend: "Sign up"
+          open: "Open"
+          email_domains: "Email domains"
+          email_domains_placeholder: "any"
+          confirmation: "Confirmation"
+          no_mail: "No mail service."
+          scopes: "Signup scopes"
+          hidden: "Hide who has an account"
+          hidden_hint: "An email address is sent a code before anything else, whether it has an account or not, and a device that account has used before skips it. Nicknames sign in as they always have."
+          hidden_no_mail: "No mail service, so nobody can sign in with an email address."
+          open_warning: "An unknown address goes straight to signup, which tells anybody which addresses have accounts here."
+          work: "Browser check"
+          work_off: "Off"
+          work_light: "Light, a fraction of a second"
+          work_standard: "Standard, about a second"
+          work_strong: "Strong, several seconds"
+          work_bits: "%{bits} bits"
+          work_hint: "Before an account is made, the browser solves a hashing puzzle that makes signing up in bulk expensive. Nothing is sent to another service. Signing up then needs JavaScript."
+        account:
+          legend: "Account"
+          nickname: "Nickname"
+          email: "Email"
+          phone: "Phone"
+          email_verified: "Confirmed email"
+          phone_verified: "Confirmed phone"
+          no_sms: "No SMS service."
+        sign_in:
+          legend: "Sign in"
+          characters: "characters minimum"
+          refuse_common: "Refuse common passwords"
+          password_required: "Require a password at signup"
+          all_providers: "All providers"
+        second_factor:
+          legend: "Second factor"
+          required: "Required for everyone, not just managers"
+          apps: "Asked again at an app sign-in when the session did not use one"
+        risk:
+          legend: "Risk"
+          step_up: "Ask for a second factor at a score of"
+          refuse: "Refuse at"
+          refuse_breached: "Refuse passwords found in known breaches"
+          hint: "A sign-in scores up to 100: a new device 30, a new network 25, a risky network 50, repeated failures 20 or 40, an account dormant for six months 10, and a breached password 40. Breach checks send the first five characters of the password's SHA-1 hash, never the password."
+        sessions:
+          legend: "Sessions"
+          last: "Last"
+          after_sign_in: "after signing in"
+          end_after: "End after"
+          idle: "idle"
+          hint: "Apps covered by this policy ask again once a session is older or has been idle longer, even one that started under another policy. A shorter session also ends the refresh tokens issued in it."
+      list:
+        empty: "None yet. Clients use the built-in default."
+        default: "Default"
+        used_by: "Used by"
+        edit: "Edit"
+        archive: "Archive"
+      archived:
+        title: "Archived"
+        restore: "Restore"

data/config/locales/en/manage/policy_rules.yml

@@ -0,0 +1,73 @@
+en:
+  manage:
+    policy_rules:
+      factors:
+        password: "password"
+        passkey: "passkey"
+        provider: "provider"
+        email_code: "emailed code"
+        otp: "authenticator app"
+        backup_codes: "backup codes"
+      confirmations:
+        none: "none"
+        code: "emailed code"
+        link: "emailed link"
+        approval: "manager approval"
+      presence:
+        "off": "off"
+        optional: "optional"
+        required: "required"
+      answers:
+        "yes": "yes"
+        "no": "no"
+      units:
+        day:
+          one: "%{count} day"
+          other: "%{count} days"
+        hour:
+          one: "%{count} hour"
+          other: "%{count} hours"
+        minute:
+          one: "%{count} minute"
+          other: "%{count} minutes"
+        second:
+          one: "%{count} second"
+          other: "%{count} seconds"
+      terms:
+        signup: "Sign up"
+        email_domains: "Email domains"
+        hidden: "Hides who has an account"
+        nickname: "Nickname"
+        email: "Email"
+        email_verified: "Confirmed email"
+        phone: "Phone"
+        phone_verified: "Confirmed phone"
+        first_factors: "Signs in with"
+        providers: "Providers"
+        password: "Password"
+        second_factors: "Second factors"
+        second_factor_required: "Second factor required"
+        apps_require_second_factor: "Second factor at every app sign-in"
+        session_lifetime: "Session lifetime"
+        refuse_breached: "Refuses breached passwords"
+        password_required: "Password required at signup"
+        risk_step_up: "Second factor from risk"
+        risk_refuse: "Refused from risk"
+        idle_timeout: "Idle timeout"
+        confirmation: "Confirmation"
+        signup_scopes: "Signup scopes"
+        proof_of_work: "Browser check at signup"
+      values:
+        open: "open"
+        invitation_only: "invitation only"
+        any: "any"
+        nothing: "nothing"
+        every_one: "every one"
+        none: "none"
+        password: "at least %{minimum} characters"
+        not_common: "at least %{minimum} characters, not a common one"
+        default_lifetime: "14 days"
+        never: "never"
+        at: "at %{score}"
+        bits: "%{bits} bits"
+        "off": "off"

data/config/locales/en/manage/presence.yml

@@ -0,0 +1,26 @@
+en:
+  manage:
+    presence:
+      sessions: "Sessions"
+      devices: "Devices"
+      no_sessions: "Not signed in anywhere right now."
+      no_devices: "Nothing has signed in on their behalf yet."
+      revoke: "Revoke"
+      signed_in: "Signed in %{when}"
+      expires: "Expires %{when}"
+      last_seen: "Last seen %{when}"
+      show_more: "Show %{count} more"
+      blocked: "blocked"
+      unrecognised: "unrecognised"
+      sign_out: "Sign out"
+      block: "Block"
+      unblock: "Unblock"
+      sign_out_everywhere: "Sign out everywhere"
+      session_revoked: "Session revoked."
+      revoke_question: "Revoke this session? That browser is signed out at once."
+      device_signed_out: "Signed %{label} out everywhere."
+      device_blocked: "%{label} is blocked."
+      block_question: "Block %{label}? Nobody will be able to sign in on it until it is unblocked."
+      device_unblocked: "%{label} is unblocked."
+      signed_out_everywhere: "Signed out everywhere."
+      sign_out_everywhere_question: "Sign %{identifier} out everywhere? Every session and refresh token ends, and no device counts as a second factor any more."

data/config/locales/en/manage/providers.yml

@@ -0,0 +1,156 @@
+en:
+  manage:
+    providers:
+      title: "Providers"
+      add: "Add provider"
+      cancel: "Cancel"
+      protocols:
+        oidc: "OpenID Connect"
+        oauth2: "OAuth 2.0"
+        saml: "SAML 2.0"
+        mcp: "MCP server"
+      claims:
+        email: "Email"
+        email_verified: "Email confirmed"
+        name: "Name"
+        given_name: "Given name"
+        family_name: "Family name"
+        preferred_username: "Username"
+        picture: "Picture"
+      name_id_formats:
+        any: "Whatever the identity provider sends"
+        persistent: "Persistent"
+        email: "Email address"
+        unspecified: "Unspecified"
+      asked:
+        domain: "Domain"
+        tenant: "Directory (tenant) ID"
+        realm: "Realm"
+      notices:
+        discovered: "Endpoints filled in from the discovery document."
+        metadata_read: "Read the identity provider's entity, sign-in URL and certificates."
+        registered: "%{name} is registered, and applications can be let use it."
+        added: "%{name} can sign actors in now."
+        saved: "%{name} saved."
+        archived: "%{name} is archived."
+        restored: "%{name} is back."
+        reregistered: "masks registered itself with %{name} again."
+      confirm:
+        archive: "Archive %{name}? Nobody can sign in with it until it is restored."
+        register: "Register with %{name} again? Everybody connected to it has to connect again."
+      picker:
+        help: "Pick who actors will sign in with. Anything not listed speaks one of the three at the end."
+      form:
+        add_title: "Add %{name}"
+        edit_title: "Edit %{name}"
+        guide_lead: "Register masks with %{name} first:"
+        guide_link: "%{name}'s console"
+        give: "Give %{name} these"
+        the_provider: "the provider"
+        acs_url: "Assertion consumer service URL"
+        sp_entity_id: "Service provider entity ID"
+        redirect_uri: "Redirect URI"
+        name: "Name"
+        key: "Key"
+        identity_provider: "Identity provider"
+        metadata_url: "Metadata URL"
+        read: "Read"
+        paste_metadata: "Or paste the metadata"
+        metadata_hint: "A metadata URL is read again every night, so a certificate the identity provider rotates is picked up without anybody noticing."
+        entity_id: "Entity ID"
+        sign_in_url: "Sign-in URL"
+        certificates: "Signing certificates"
+        name_id_format: "Name ID format"
+        mcp_url: "MCP server URL"
+        mcp_hint: "masks finds the server's own authorization server from its protected resource metadata and registers itself there, so there is no client ID to copy. An MCP server never signs anybody in; it is only something applications can be let use."
+        issuer: "Issuer"
+        discover: "Discover"
+        authorization_url: "Authorization URL"
+        token_url: "Token URL"
+        userinfo_url: "Userinfo URL"
+        emails_url: "Verified emails URL"
+        jwks_uri: "JWKS URI"
+        optional: "optional"
+        discovered_if_empty: "discovered if left empty"
+        credentials: "Credentials"
+        services_id: "Services ID"
+        client_id: "Client ID"
+        client_secret: "Client secret"
+        unchanged: "unchanged"
+        team_id: "Team ID"
+        key_id: "Key ID"
+        private_key: "Private key (.p8)"
+        sends_secret: "Sends the secret"
+        secret_post: "in the request body"
+        secret_basic: "as basic auth"
+        secret_signed: "as a token it signs (Apple)"
+        extra_scopes: "Extra scopes"
+        oidc_scopes: "openid email profile are always asked"
+        claims: "Where each claim comes from"
+        subject_saml: "Subject (name_id, or an attribute)"
+        subject_oidc: "Subject (sub or oid)"
+        subject_path: "Subject path"
+        attribute_name: "attribute name"
+        applications: "Applications"
+        delegates: "Let applications use somebody's %{name} account"
+        provider: "provider"
+        delegates_hint: "An approved application can ask an actor to let it act as them at %{name} while they are away. masks keeps the tokens, refreshes them, and hands each one only to the application that actor said yes to."
+        delegated_scopes: "What applications may do"
+        server_grants: "whatever the server grants"
+        delegation_params: "Extra parameters when connecting"
+        delegation_asks: "An application asks for"
+        delegation_reconnect: "Changing what applications may do asks everybody to connect again."
+        signing_in: "Signing in"
+        owns: "%{name} owns the account"
+        this_provider: "This provider"
+        owns_hint: "On, somebody new gets an account here, and their name, photo and address follow %{name} each time they sign in. Off, it is only another way into an account that already exists. Either way it stands in for a password, never for a second factor."
+        trusts_email: "Trust the addresses it confirms"
+        trusts_email_hint: "Only for a provider that really checks an actor holds the mailbox, as Google, Apple and GitHub do. Off, only addresses in the domains below are taken at its word."
+        signals: "Accept its security events"
+        signals_lead: "It sends shared signals to"
+        signals_rest: "A session revoked, a credential changed, or an account disabled there signs the account out everywhere here."
+        saml_domains: "Email domains it answers for"
+        domains: "Email domains"
+        any_domain: "any domain"
+        signup_scopes: "Scopes a new account holds"
+        saving: "Saving..."
+        add: "Add"
+        save: "Save"
+      empty: "No provider is set up. Add one and actors can sign in with Google, GitHub, their company's identity provider, or anything that speaks OpenID Connect, OAuth 2.0 or SAML."
+      edit: "Edit"
+      register: "Register again"
+      archive: "Archive"
+      badges:
+        never_signs_in: "never signs in"
+        owns_accounts: "owns accounts"
+        existing_only: "existing accounts only"
+        trusts_email: "trusts confirmed addresses"
+        signals: "accepts security events"
+        delegates: "applications can use it"
+      facts:
+        acs_url: "Assertion consumer service URL"
+        redirect_uri: "Redirect URI"
+        sp_entity_id: "Service provider entity ID"
+        identity_provider: "Identity provider"
+        metadata: "Metadata"
+        metadata_read: "read %{day}"
+        never: "never"
+        pasted: "pasted, not refreshed"
+        client_id: "Client ID"
+        signing_key: "Signing key"
+        secret: "Secret"
+        held: "held"
+        none_set: "none set"
+        issuer: "Issuer"
+        scopes: "Scopes asked upstream"
+        mcp_server: "MCP server"
+        registered: "Registered"
+        delegation_scope: "Applications ask for"
+        delegations: "Applications using it"
+        delegated_scopes: "What applications may do"
+        connections: "Connected accounts"
+        signed_in: "%{count} sign in with it"
+      connected: "Who is connected (%{count})"
+      archived: "Archived"
+      archived_on: "archived %{day}"
+      restore: "Restore"

data/config/locales/en/manage/provisioning.yml

@@ -0,0 +1,29 @@
+en:
+  manage:
+    provisioning:
+      title: "Provisioning"
+      lede: "An identity provider adds, changes, suspends and removes actors here over SCIM 2.0."
+      revoke_confirm: "Revoke %{label}? Whatever provisions with it is refused from now on."
+      revoked: "%{label} is revoked."
+      lifetimes:
+        month: "30 days"
+        quarter: "90 days"
+        year: "A year"
+      connect:
+        title: "Connect a provider"
+        help: "Give the provider this URL and a token. A provisioned actor is known by their email, which masks takes as confirmed, and signs in through a provider or an invitation. Nobody who holds a masks: scope has their password or email changed this way, and the last manager is never suspended or removed."
+        base_url: "SCIM base URL"
+        label: "Label"
+        provisions: "Provisions"
+        every_account: "Every account"
+        only_members: "Only members of %{name}"
+        lifetime: "How long the token lives"
+        issue: "Issue a token"
+        shown_once: "This token is shown once. Copy it now."
+      tokens:
+        title: "Tokens"
+        none: "None issued."
+        never: "never"
+        issued_by: "by %{identifier}, used %{used}, expires %{expires}"
+        detail: "used %{used}, expires %{expires}"
+        revoke: "Revoke"

data/config/locales/en/manage/scopes_editor.yml

@@ -0,0 +1,21 @@
+en:
+  manage:
+    scopes_editor:
+      label: "Add a scope"
+      placeholder:
+        one: "Add a scope from %{count} known, or type a new one"
+        other: "Add a scope from %{count} known, or type a new one"
+      offered: "Scopes to add"
+      add_new: "Add new"
+      more:
+        one: "%{count} more. Keep typing to narrow the list."
+        other: "%{count} more. Keep typing to narrow the list."
+      held:
+        one: "%{count} scope chosen"
+        other: "%{count} scopes chosen"
+      remove: "Remove %{scope}"
+      all:
+        one: "Show %{count} scope"
+        other: "Show all %{count}"
+      fewer: "Show fewer"
+      none: "No scopes chosen."

data/config/locales/en/manage/senders.yml

@@ -0,0 +1,43 @@
+en:
+  manage:
+    senders:
+      added: "%{name} added."
+      saved: "%{name} saved."
+      archived_notice: "%{name} is archived."
+      restored: "%{name} is back."
+      archive_confirm: "Archive %{name}? Nothing is sent through it until it is restored."
+      primary_notice: "%{name} sends everything now."
+      tested: "%{name} handed a test message to %{to}."
+      kinds:
+        mail:
+          title: "Mail"
+          lede: "Invitations, resets, confirmations and codes. The primary one sends everything."
+          idle: "Nothing is emailed through a service of this tenant's own. Mail falls back to whatever the server was set up with, if anything."
+        sms:
+          title: "SMS"
+          lede: "Phone confirmations and sign-in codes. The primary one sends everything."
+          idle: "No SMS can be sent until a service is added."
+      form:
+        add: "Add a service"
+        edit: "Edit %{name}"
+        service: "Service"
+        key: "Key"
+        name: "Name"
+        optional: "%{label} (optional)"
+        unchanged: "unchanged"
+        primary: "Primary — send everything of this kind through it"
+        create: "Add"
+        save: "Save"
+        cancel: "Cancel"
+      list:
+        add: "Add"
+        primary: "Primary"
+        added: "added %{day}"
+        make_primary: "Make primary"
+        edit: "Edit"
+        archive: "Archive"
+        test_to: "Send a test to"
+        test: "Send a test"
+      archived:
+        title: "Archived"
+        restore: "Restore"