@authrim/setup 0.1.82 → 0.1.85

package/dist/cli/commands/init.js

@@ -31,7 +31,7 @@ async function selectLanguage() {
         message: 'Select language / 言語を選択 / 选择语言',
         choices: locales.map((l) => ({
             value: l.code,
-            name: `${l.flag || ''} ${l.nativeName}`.trim(),
+            name: l.nativeName,
         })),
     });
     return locale;
@@ -831,60 +831,63 @@ async function runLoadConfig() {
 async function runQuickSetup(options) {
     console.log('');
     console.log(chalk.blue('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━'));
-    console.log(chalk.bold('⚡ Quick Setup'));
+    console.log(chalk.bold(t('quick.title')));
     console.log(chalk.blue('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━'));
     console.log('');
     // Step 1: Environment prefix
     const envPrefix = await input({
-        message: 'Enter environment name',
+        message: t('env.prompt'),
         default: options.env || 'prod',
         validate: (value) => {
             if (!/^[a-z][a-z0-9-]*$/.test(value)) {
-                return 'Only lowercase alphanumeric and hyphens allowed (e.g., prod, staging, dev)';
+                return t('env.customValidation');
             }
             return true;
         },
     });
     // Check if environment already exists
-    const checkSpinner = ora('Checking for existing environments...').start();
+    const checkSpinner = ora(t('env.checking')).start();
     try {
         const existingEnvs = await detectEnvironments();
         const existingEnv = existingEnvs.find((e) => e.env === envPrefix);
         if (existingEnv) {
-            checkSpinner.fail(`Environment "${envPrefix}" already exists`);
+            checkSpinner.fail(t('env.alreadyExists', { env: envPrefix }));
             console.log('');
-            console.log(chalk.yellow('  Existing resources:'));
-            console.log(`    Workers: ${existingEnv.workers.length}`);
-            console.log(`    D1 Databases: ${existingEnv.d1.length}`);
-            console.log(`    KV Namespaces: ${existingEnv.kv.length}`);
+            console.log(chalk.yellow('  ' + t('env.existingResources')));
+            console.log(`    ${t('env.workers', { count: String(existingEnv.workers.length) })}`);
+            console.log(`    ${t('env.d1Databases', { count: String(existingEnv.d1.length) })}`);
+            console.log(`    ${t('env.kvNamespaces', { count: String(existingEnv.kv.length) })}`);
             console.log('');
-            console.log(chalk.yellow('  Please choose a different name or use "npx @authrim/setup manage" to delete it first.'));
+            console.log(chalk.yellow('  ' + t('env.chooseAnother')));
             return;
         }
-        checkSpinner.succeed('Environment name is available');
+        checkSpinner.succeed(t('env.available'));
     }
     catch {
-        checkSpinner.warn('Could not check existing environments (continuing anyway)');
+        checkSpinner.warn(t('env.checkFailed'));
     }
     // Step 2: Cloudflare API Token
     const cfApiToken = await password({
-        message: 'Enter Cloudflare API Token',
+        message: t('cf.apiTokenPrompt'),
         mask: '*',
         validate: (value) => {
             if (!value || value.length < 10) {
-                return 'Please enter a valid API Token';
+                return t('cf.apiTokenValidation');
             }
             return true;
         },
     });
     // Step 3: Show infrastructure info
     console.log('');
-    console.log(chalk.gray('  Workers to deploy: ' + envPrefix + '-ar-router, ' + envPrefix + '-ar-auth, ...'));
-    console.log(chalk.gray('  Default API: ' + getWorkersDevUrl(envPrefix + '-ar-router')));
+    console.log(chalk.gray('  ' +
+        t('infra.workersToDeploy', {
+            workers: envPrefix + '-ar-router, ' + envPrefix + '-ar-auth, ...',
+        })));
+    console.log(chalk.gray('  ' + t('infra.defaultApi', { url: getWorkersDevUrl(envPrefix + '-ar-router') })));
     console.log('');
     // Step 4: Domain configuration (single-tenant mode only in Quick Setup)
     const useCustomDomain = await confirm({
-        message: 'Configure custom domain? (for Issuer URL)',
+        message: t('domain.prompt'),
         default: false,
     });
     let apiDomain = null;
@@ -892,55 +895,59 @@ async function runQuickSetup(options) {
     let adminUiDomain = null;
     if (useCustomDomain) {
         console.log('');
-        console.log(chalk.gray('  In single-tenant mode, Issuer URL = API domain'));
+        console.log(chalk.gray('  ' + t('domain.singleTenantNote')));
         console.log('');
         apiDomain = await input({
-            message: 'API / Issuer domain (e.g., auth.example.com)',
+            message: t('domain.apiDomain'),
             validate: (value) => {
                 if (!value)
                     return true; // Allow empty for workers.dev fallback
                 if (!/^[a-z0-9][a-z0-9.-]*\.[a-z]{2,}$/.test(value)) {
-                    return 'Please enter a valid domain (e.g., auth.example.com)';
+                    return t('domain.customValidation');
                 }
                 return true;
             },
         });
         loginUiDomain = await input({
-            message: 'Login UI domain (Enter to skip)',
+            message: t('domain.loginUiDomain'),
             default: '',
         });
         adminUiDomain = await input({
-            message: 'Admin UI domain (Enter to skip)',
+            message: t('domain.adminUiDomain'),
             default: '',
         });
     }
     // Database Configuration
     console.log('');
-    console.log(chalk.blue('━━━ Database Configuration ━━━'));
-    console.log(chalk.yellow('⚠️  Database region cannot be changed after creation.'));
+    console.log(chalk.blue('━━━ ' + t('db.title') + ' ━━━'));
+    console.log(chalk.yellow('⚠️  ' + t('db.regionWarning')));
     console.log('');
     const locationChoices = [
-        { name: 'Automatic (nearest to you)', value: 'auto' },
-        { name: '── Location Hints ──', value: '__separator1__', disabled: true },
-        { name: 'North America (West)', value: 'wnam' },
-        { name: 'North America (East)', value: 'enam' },
-        { name: 'Europe (West)', value: 'weur' },
-        { name: 'Europe (East)', value: 'eeur' },
-        { name: 'Asia Pacific', value: 'apac' },
-        { name: 'Oceania', value: 'oc' },
-        { name: '── Jurisdiction (Compliance) ──', value: '__separator2__', disabled: true },
-        { name: 'EU Jurisdiction (GDPR compliance)', value: 'eu' },
+        { name: t('region.auto'), value: 'auto' },
+        { name: '── ' + t('db.locationHints') + ' ──', value: '__separator1__', disabled: true },
+        { name: t('region.wnam'), value: 'wnam' },
+        { name: t('region.enam'), value: 'enam' },
+        { name: t('region.weur'), value: 'weur' },
+        { name: t('region.eeur'), value: 'eeur' },
+        { name: t('region.apac'), value: 'apac' },
+        { name: t('region.oceania'), value: 'oc' },
+        {
+            name: '── ' + t('db.jurisdictionCompliance') + ' ──',
+            value: '__separator2__',
+            disabled: true,
+        },
+        { name: t('region.euJurisdiction'), value: 'eu' },
     ];
-    console.log(chalk.gray('  Core DB: Stores OAuth clients, tokens, sessions, audit logs'));
+    console.log(chalk.gray('  ' + t('db.coreDescription')));
     const coreDbLocation = await select({
-        message: 'Core Database region',
+        message: t('db.coreRegion'),
         choices: locationChoices,
         default: 'auto',
     });
     console.log('');
-    console.log(chalk.gray('  PII DB: Stores user profiles, credentials, personal data'));
+    console.log(chalk.gray('  ' + t('db.piiDescription')));
     const piiDbLocation = await select({
-        message: 'PII Database region',
+        message: t('db.piiRegion'),
         choices: locationChoices,
         default: 'auto',
     });
@@ -956,43 +963,43 @@ async function runQuickSetup(options) {
     }
     // Email Provider Configuration
     console.log('');
-    console.log(chalk.blue('━━━ Email Provider ━━━'));
-    console.log(chalk.gray('Configure email sending for magic links and verification codes.'));
+    console.log(chalk.blue('━━━ ' + t('email.title') + ' ━━━'));
+    console.log(chalk.gray(t('email.description')));
     console.log('');
     const configureEmail = await confirm({
-        message: 'Configure email provider now?',
+        message: t('email.prompt'),
         default: false,
     });
     let emailConfig = { provider: 'none' };
     if (configureEmail) {
         console.log('');
-        console.log(chalk.gray('Resend is the supported email provider.'));
-        console.log(chalk.gray('Get your API key at: https://resend.com/api-keys'));
-        console.log(chalk.gray('Set up domain at: https://resend.com/domains'));
+        console.log(chalk.gray(t('email.resendDesc')));
+        console.log(chalk.gray(t('email.apiKeyHint')));
+        console.log(chalk.gray(t('email.domainHint')));
         console.log('');
         const resendApiKey = await password({
-            message: 'Resend API key',
+            message: t('email.apiKeyPrompt'),
             mask: '*',
             validate: (value) => {
                 if (!value.trim())
-                    return 'API key is required';
+                    return t('email.apiKeyRequired');
                 if (!value.startsWith('re_')) {
-                    return 'Warning: Resend API keys typically start with "re_"';
+                    return t('email.apiKeyWarning');
                 }
                 return true;
             },
         });
         const fromAddress = await input({
-            message: 'From email address',
+            message: t('email.fromAddressPrompt'),
             default: 'noreply@yourdomain.com',
             validate: (value) => {
                 if (!value.includes('@'))
-                    return 'Please enter a valid email address';
+                    return t('email.fromAddressValidation');
                 return true;
             },
         });
         const fromName = await input({
-            message: 'From display name (optional)',
+            message: t('email.fromNamePrompt'),
             default: 'Authrim',
         });
         emailConfig = {
@@ -1002,8 +1009,8 @@ async function runQuickSetup(options) {
             apiKey: resendApiKey,
         };
         console.log('');
-        console.log(chalk.yellow('⚠️  Domain verification required for sending from your own domain.'));
-        console.log(chalk.gray('   See: https://resend.com/docs/dashboard/domains/introduction'));
+        console.log(chalk.yellow('⚠️  ' + t('email.domainVerificationRequired')));
+        console.log(chalk.gray('   ' + t('email.seeDocumentation')));
     }
     // Create configuration
     const config = createDefaultConfig(envPrefix);
@@ -1093,94 +1100,94 @@ async function runQuickSetup(options) {
 async function runNormalSetup(options) {
     console.log('');
     console.log(chalk.blue('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━'));
-    console.log(chalk.bold('🔧 Custom Setup'));
+    console.log(chalk.bold(t('custom.title')));
     console.log(chalk.blue('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━'));
     console.log('');
     // Step 1: Environment prefix
     const envPrefix = await input({
-        message: 'Enter environment name',
+        message: t('env.prompt'),
         default: options.env || 'prod',
         validate: (value) => {
             if (!/^[a-z][a-z0-9-]*$/.test(value)) {
-                return 'Only lowercase alphanumeric and hyphens allowed (e.g., prod, staging, dev)';
+                return t('env.customValidation');
             }
             return true;
         },
     });
     // Check if environment already exists
-    const checkSpinner = ora('Checking for existing environments...').start();
+    const checkSpinner = ora(t('env.checking')).start();
     try {
         const existingEnvs = await detectEnvironments();
         const existingEnv = existingEnvs.find((e) => e.env === envPrefix);
         if (existingEnv) {
-            checkSpinner.fail(`Environment "${envPrefix}" already exists`);
+            checkSpinner.fail(t('env.alreadyExists', { env: envPrefix }));
             console.log('');
-            console.log(chalk.yellow('  Existing resources:'));
-            console.log(`    Workers: ${existingEnv.workers.length}`);
-            console.log(`    D1 Databases: ${existingEnv.d1.length}`);
-            console.log(`    KV Namespaces: ${existingEnv.kv.length}`);
+            console.log(chalk.yellow('  ' + t('env.existingResources')));
+            console.log(`    ${t('env.workers', { count: String(existingEnv.workers.length) })}`);
+            console.log(`    ${t('env.d1Databases', { count: String(existingEnv.d1.length) })}`);
+            console.log(`    ${t('env.kvNamespaces', { count: String(existingEnv.kv.length) })}`);
             console.log('');
-            console.log(chalk.yellow('  Please choose a different name or use "npx @authrim/setup manage" to delete it first.'));
+            console.log(chalk.yellow('  ' + t('env.chooseAnother')));
             return;
         }
-        checkSpinner.succeed('Environment name is available');
+        checkSpinner.succeed(t('env.available'));
     }
     catch {
-        checkSpinner.warn('Could not check existing environments (continuing anyway)');
+        checkSpinner.warn(t('env.checkFailed'));
     }
     // Step 2: Cloudflare API Token
     const cfApiToken = await password({
-        message: 'Enter Cloudflare API Token',
+        message: t('cf.apiTokenPrompt'),
         mask: '*',
         validate: (value) => {
             if (!value || value.length < 10) {
-                return 'Please enter a valid API Token';
+                return t('cf.apiTokenValidation');
             }
             return true;
         },
     });
     // Step 3: Profile selection
     const profile = await select({
-        message: 'Select OIDC profile',
+        message: t('profile.prompt'),
         choices: [
             {
                 value: 'basic-op',
-                name: 'Basic OP (Standard OIDC Provider)',
-                description: 'Standard OIDC features',
+                name: t('profile.basicOp'),
+                description: t('profile.basicOpDesc'),
             },
             {
                 value: 'fapi-rw',
-                name: 'FAPI Read-Write (Financial Grade)',
-                description: 'FAPI 1.0 Read-Write Security Profile compliant',
+                name: t('profile.fapiRw'),
+                description: t('profile.fapiRwDesc'),
             },
             {
                 value: 'fapi2-security',
-                name: 'FAPI 2.0 Security Profile',
-                description: 'FAPI 2.0 Security Profile compliant (highest security)',
+                name: t('profile.fapi2Security'),
+                description: t('profile.fapi2SecurityDesc'),
             },
         ],
         default: 'basic-op',
     });
     // Step 4: Infrastructure overview (Workers are auto-generated from env)
     console.log('');
-    console.log(chalk.blue('━━━ Infrastructure (Auto-generated) ━━━'));
+    console.log(chalk.blue('━━━ ' + t('infra.title') + ' ━━━'));
     console.log('');
-    console.log(chalk.gray('  The following Workers will be deployed:'));
-    console.log(`    Router:     ${chalk.cyan(envPrefix + '-ar-router')}`);
-    console.log(`    Auth:       ${chalk.cyan(envPrefix + '-ar-auth')}`);
-    console.log(`    Token:      ${chalk.cyan(envPrefix + '-ar-token')}`);
-    console.log(`    Management: ${chalk.cyan(envPrefix + '-ar-management')}`);
-    console.log(chalk.gray('    ... and other supporting workers'));
+    console.log(chalk.gray('  ' + t('infra.workersNote')));
+    console.log(`    ${t('infra.router')}     ${chalk.cyan(envPrefix + '-ar-router')}`);
+    console.log(`    ${t('infra.auth')}       ${chalk.cyan(envPrefix + '-ar-auth')}`);
+    console.log(`    ${t('infra.token')}      ${chalk.cyan(envPrefix + '-ar-token')}`);
+    console.log(`    ${t('infra.management')} ${chalk.cyan(envPrefix + '-ar-management')}`);
+    console.log(chalk.gray('    ' + t('infra.otherWorkers')));
     console.log('');
-    console.log(chalk.gray('  Default endpoints (without custom domain):'));
-    console.log(`    API:        ${chalk.gray(getWorkersDevUrl(envPrefix + '-ar-router'))}`);
-    console.log(`    UI:         ${chalk.gray(getPagesDevUrl(envPrefix + '-ar-ui'))}`);
+    console.log(chalk.gray('  ' + t('infra.defaultEndpoints')));
+    console.log(`    ${t('infra.api')}        ${chalk.gray(getWorkersDevUrl(envPrefix + '-ar-router'))}`);
+    console.log(`    ${t('infra.ui')}         ${chalk.gray(getPagesDevUrl(envPrefix + '-ar-ui'))}`);
     console.log('');
     // Step 5: Tenant configuration
-    console.log(chalk.blue('━━━ Tenant Mode ━━━'));
+    console.log(chalk.blue('━━━ ' + t('tenant.title') + ' ━━━'));
     console.log('');
     const multiTenant = await confirm({
-        message: 'Enable multi-tenant mode? (subdomain-based tenant isolation)',
+        message: t('tenant.multiTenantPrompt'),
         default: false,
     });
     let tenantName = 'default';
@@ -1193,59 +1200,59 @@ async function runNormalSetup(options) {
     if (multiTenant) {
         // Multi-tenant mode: base domain is required, becomes the issuer base
         console.log('');
-        console.log(chalk.blue('━━━ Multi-tenant URL Configuration ━━━'));
+        console.log(chalk.blue('━━━ ' + t('tenant.multiTenantTitle') + ' ━━━'));
         console.log('');
-        console.log(chalk.gray('  In multi-tenant mode:'));
-        console.log(chalk.gray('    • Each tenant has a subdomain: https://{tenant}.{base-domain}'));
-        console.log(chalk.gray('    • The base domain points to the router Worker'));
-        console.log(chalk.gray('    • Issuer URL is dynamically built from Host header'));
+        console.log(chalk.gray('  ' + t('tenant.multiTenantNote1')));
+        console.log(chalk.gray('    • ' + t('tenant.multiTenantNote2')));
+        console.log(chalk.gray('    • ' + t('tenant.multiTenantNote3')));
+        console.log(chalk.gray('    • ' + t('tenant.multiTenantNote4')));
         console.log('');
         baseDomain = await input({
-            message: 'Base domain (e.g., authrim.com)',
+            message: t('tenant.baseDomainPrompt'),
             validate: (value) => {
                 if (!value)
-                    return 'Base domain is required for multi-tenant mode';
+                    return t('tenant.baseDomainRequired');
                 if (!/^[a-z0-9][a-z0-9.-]*\.[a-z]{2,}$/.test(value)) {
-                    return 'Please enter a valid domain (e.g., authrim.com)';
+                    return t('tenant.baseDomainValidation');
                 }
                 return true;
             },
         });
         console.log('');
-        console.log(chalk.green('  ✓ Issuer URL format: https://{tenant}.' + baseDomain));
-        console.log(chalk.gray('    Example: https://acme.' + baseDomain));
+        console.log(chalk.green('  ✓ ' + t('tenant.issuerFormat', { domain: baseDomain })));
+        console.log(chalk.gray('    ' + t('tenant.issuerExample', { domain: baseDomain })));
         console.log('');
         // API domain in multi-tenant is the base domain (or custom apex)
         apiDomain = baseDomain;
         tenantName = await input({
-            message: 'Default tenant name (identifier)',
+            message: t('tenant.defaultTenantPrompt'),
             default: 'default',
             validate: (value) => {
                 if (!/^[a-z][a-z0-9-]*$/.test(value)) {
-                    return 'Only lowercase alphanumeric and hyphens allowed';
+                    return t('tenant.defaultTenantValidation');
                 }
                 return true;
             },
         });
         tenantDisplayName = await input({
-            message: 'Default tenant display name',
+            message: t('tenant.displayNamePrompt'),
             default: 'Default Tenant',
         });
         // UI domains for multi-tenant
         console.log('');
-        console.log(chalk.blue('━━━ UI Domain Configuration ━━━'));
+        console.log(chalk.blue('━━━ ' + t('tenant.uiDomainTitle') + ' ━━━'));
         console.log('');
         const useCustomUiDomain = await confirm({
-            message: 'Configure custom UI domains?',
+            message: t('tenant.customUiDomainPrompt'),
             default: false,
         });
         if (useCustomUiDomain) {
             loginUiDomain = await input({
-                message: 'Login UI domain (e.g., login.example.com)',
+                message: t('tenant.loginUiDomain'),
                 default: '',
             });
             adminUiDomain = await input({
-                message: 'Admin UI domain (e.g., admin.example.com)',
+                message: t('tenant.adminUiDomain'),
                 default: '',
             });
         }
@@ -1253,86 +1260,86 @@ async function runNormalSetup(options) {
     else {
         // Single-tenant mode
         console.log('');
-        console.log(chalk.blue('━━━ Single-tenant URL Configuration ━━━'));
+        console.log(chalk.blue('━━━ ' + t('tenant.singleTenantTitle') + ' ━━━'));
         console.log('');
-        console.log(chalk.gray('  In single-tenant mode:'));
-        console.log(chalk.gray('    • Issuer URL = API custom domain (or workers.dev fallback)'));
-        console.log(chalk.gray('    • All clients share the same issuer'));
+        console.log(chalk.gray('  ' + t('tenant.singleTenantNote1')));
+        console.log(chalk.gray('    • ' + t('tenant.singleTenantNote2')));
+        console.log(chalk.gray('    • ' + t('tenant.singleTenantNote3')));
         console.log('');
         tenantDisplayName = await input({
-            message: 'Organization name (display name)',
+            message: t('tenant.organizationName'),
             default: 'Default Tenant',
         });
         const useCustomDomain = await confirm({
-            message: 'Configure custom domain?',
+            message: t('domain.prompt'),
             default: false,
         });
         if (useCustomDomain) {
             console.log('');
-            console.log(chalk.gray('  Enter custom domains (leave empty to use Cloudflare defaults)'));
+            console.log(chalk.gray('  ' + t('domain.enterDomains')));
             console.log('');
             apiDomain = await input({
-                message: 'API / Issuer domain (e.g., auth.example.com)',
+                message: t('domain.apiDomain'),
                 validate: (value) => {
                     if (!value)
                         return true;
                     if (!/^[a-z0-9][a-z0-9.-]*\.[a-z]{2,}$/.test(value)) {
-                        return 'Please enter a valid domain';
+                        return t('domain.customValidation');
                     }
                     return true;
                 },
             });
             loginUiDomain = await input({
-                message: 'Login UI domain (Enter to skip)',
+                message: t('domain.loginUiDomain'),
                 default: '',
             });
             adminUiDomain = await input({
-                message: 'Admin UI domain (Enter to skip)',
+                message: t('domain.adminUiDomain'),
                 default: '',
             });
         }
         if (apiDomain) {
             console.log('');
-            console.log(chalk.green('  ✓ Issuer URL: https://' + apiDomain));
+            console.log(chalk.green('  ✓ ' + t('domain.issuerUrl', { url: 'https://' + apiDomain })));
         }
         else {
             console.log('');
-            console.log(chalk.green('  ✓ Issuer URL: ' + getWorkersDevUrl(envPrefix + '-ar-router')));
-            console.log(chalk.gray('    (using Cloudflare workers.dev domain)'));
+            console.log(chalk.green('  ✓ ' + t('domain.issuerUrl', { url: getWorkersDevUrl(envPrefix + '-ar-router') })));
+            console.log(chalk.gray('    ' + t('domain.usingWorkersDev')));
         }
     }
     // Step 5: Optional components
     console.log('');
-    console.log(chalk.blue('━━━ Optional Components ━━━'));
-    console.log(chalk.gray('  Note: Social Login and Policy Engine are standard components'));
+    console.log(chalk.blue('━━━ ' + t('components.title') + ' ━━━'));
+    console.log(chalk.gray('  ' + t('components.note')));
     console.log('');
     const enableSaml = await confirm({
-        message: 'Enable SAML support?',
+        message: t('components.samlPrompt'),
         default: false,
     });
     const enableVc = await confirm({
-        message: 'Enable Verifiable Credentials?',
+        message: t('components.vcPrompt'),
         default: false,
     });
     // Step 6: Feature flags
     console.log('');
-    console.log(chalk.blue('━━━ Feature Flags ━━━'));
+    console.log(chalk.blue('━━━ ' + t('features.title') + ' ━━━'));
     console.log('');
     const enableQueue = await confirm({
-        message: 'Enable Cloudflare Queues? (for audit logs)',
+        message: t('features.queuePrompt'),
         default: false,
     });
     const enableR2 = await confirm({
-        message: 'Enable Cloudflare R2? (for avatars)',
+        message: t('features.r2Prompt'),
         default: false,
     });
     const emailProviderChoice = await select({
-        message: 'Select email provider',
+        message: t('email.title'),
         choices: [
-            { value: 'none', name: 'None (configure later)' },
-            { value: 'resend', name: 'Resend' },
+            { value: 'none', name: t('email.skipOption') },
+            { value: 'resend', name: t('email.resendOption') },
             { value: 'sendgrid', name: 'SendGrid (coming soon)', disabled: true },
-            { value: 'ses', name: 'AWS SES (coming soon)', disabled: true },
+            { value: 'ses', name: t('email.sesOption') + ' (coming soon)', disabled: true },
         ],
         default: 'none',
     });
@@ -1340,33 +1347,33 @@ async function runNormalSetup(options) {
     let emailConfigNormal = { provider: 'none' };
     if (emailProviderChoice === 'resend') {
         console.log('');
-        console.log(chalk.blue('━━━ Resend Configuration ━━━'));
-        console.log(chalk.gray('Get your API key at: https://resend.com/api-keys'));
-        console.log(chalk.gray('Set up domain at: https://resend.com/domains'));
+        console.log(chalk.blue('━━━ ' + t('email.resendOption') + ' ━━━'));
+        console.log(chalk.gray(t('email.apiKeyHint')));
+        console.log(chalk.gray(t('email.domainHint')));
         console.log('');
         const resendApiKey = await password({
-            message: 'Resend API key',
+            message: t('email.apiKeyPrompt'),
             mask: '*',
             validate: (value) => {
                 if (!value.trim())
-                    return 'API key is required';
+                    return t('email.apiKeyRequired');
                 if (!value.startsWith('re_')) {
-                    return 'Warning: Resend API keys typically start with "re_"';
+                    return t('email.apiKeyWarning');
                 }
                 return true;
             },
         });
         const fromAddress = await input({
-            message: 'From email address',
+            message: t('email.fromAddressPrompt'),
             default: 'noreply@yourdomain.com',
             validate: (value) => {
                 if (!value.includes('@'))
-                    return 'Please enter a valid email address';
+                    return t('email.fromAddressValidation');
                 return true;
             },
         });
         const fromName = await input({
-            message: 'From display name (optional)',
+            message: t('email.fromNamePrompt'),
             default: 'Authrim',
         });
         emailConfigNormal = {
@@ -1376,12 +1383,12 @@ async function runNormalSetup(options) {
             apiKey: resendApiKey,
         };
         console.log('');
-        console.log(chalk.yellow('⚠️  Domain verification required for sending from your own domain.'));
-        console.log(chalk.gray('   See: https://resend.com/docs/dashboard/domains/introduction'));
+        console.log(chalk.yellow('⚠️  ' + t('email.domainVerificationRequired')));
+        console.log(chalk.gray('   ' + t('email.seeDocumentation')));
     }
     // Step 7: Advanced OIDC settings
     const configureOidc = await confirm({
-        message: 'Configure OIDC settings? (token TTL, etc.)',
+        message: t('oidc.configurePrompt'),
         default: false,
     });
     let accessTokenTtl = 3600; // 1 hour
@@ -1390,76 +1397,76 @@ async function runNormalSetup(options) {
     let pkceRequired = true;
     if (configureOidc) {
         console.log('');
-        console.log(chalk.blue('━━━ OIDC Settings ━━━'));
+        console.log(chalk.blue('━━━ ' + t('oidc.title') + ' ━━━'));
         console.log('');
         const accessTokenTtlStr = await input({
-            message: 'Access Token TTL (sec)',
+            message: t('oidc.accessTokenTtl'),
             default: '3600',
             validate: (value) => {
                 const num = parseInt(value, 10);
                 if (isNaN(num) || num <= 0)
-                    return 'Please enter a positive integer';
+                    return t('oidc.positiveInteger');
                 return true;
             },
         });
         accessTokenTtl = parseInt(accessTokenTtlStr, 10);
         const refreshTokenTtlStr = await input({
-            message: 'Refresh Token TTL (sec)',
+            message: t('oidc.refreshTokenTtl'),
             default: '604800',
             validate: (value) => {
                 const num = parseInt(value, 10);
                 if (isNaN(num) || num <= 0)
-                    return 'Please enter a positive integer';
+                    return t('oidc.positiveInteger');
                 return true;
             },
         });
         refreshTokenTtl = parseInt(refreshTokenTtlStr, 10);
         const authCodeTtlStr = await input({
-            message: 'Authorization Code TTL (sec)',
+            message: t('oidc.authCodeTtl'),
             default: '600',
             validate: (value) => {
                 const num = parseInt(value, 10);
                 if (isNaN(num) || num <= 0)
-                    return 'Please enter a positive integer';
+                    return t('oidc.positiveInteger');
                 return true;
             },
         });
         authCodeTtl = parseInt(authCodeTtlStr, 10);
         pkceRequired = await confirm({
-            message: 'Require PKCE?',
+            message: t('oidc.pkceRequired'),
             default: true,
         });
     }
     // Step 8: Sharding settings
     const configureSharding = await confirm({
-        message: 'Configure sharding? (for high-load environments)',
+        message: t('sharding.configurePrompt'),
         default: false,
     });
     let authCodeShards = 64;
     let refreshTokenShards = 8;
     if (configureSharding) {
         console.log('');
-        console.log(chalk.blue('━━━ Sharding Settings ━━━'));
-        console.log(chalk.gray('  Note: Power of 2 recommended for shard count (8, 16, 32, 64, 128)'));
+        console.log(chalk.blue('━━━ ' + t('sharding.title') + ' ━━━'));
+        console.log(chalk.gray('  ' + t('sharding.note')));
         console.log('');
         const authCodeShardsStr = await input({
-            message: 'Auth Code shard count',
+            message: t('sharding.authCodeShards'),
             default: '64',
             validate: (value) => {
                 const num = parseInt(value, 10);
                 if (isNaN(num) || num <= 0)
-                    return 'Please enter a positive integer';
+                    return t('oidc.positiveInteger');
                 return true;
             },
         });
         authCodeShards = parseInt(authCodeShardsStr, 10);
         const refreshTokenShardsStr = await input({
-            message: 'Refresh Token shard count',
+            message: t('sharding.refreshTokenShards'),
             default: '8',
             validate: (value) => {
                 const num = parseInt(value, 10);
                 if (isNaN(num) || num <= 0)
-                    return 'Please enter a positive integer';
+                    return t('oidc.positiveInteger');
                 return true;
             },
         });
@@ -1467,32 +1474,36 @@ async function runNormalSetup(options) {
     }
     // Step 9: Database Configuration
     console.log('');
-    console.log(chalk.blue('━━━ Database Configuration ━━━'));
-    console.log(chalk.yellow('⚠️  Database region cannot be changed after creation.'));
+    console.log(chalk.blue('━━━ ' + t('db.title') + ' ━━━'));
+    console.log(chalk.yellow('⚠️  ' + t('db.regionWarning')));
     console.log('');
     const dbLocationChoices = [
-        { name: 'Automatic (nearest to you)', value: 'auto' },
-        { name: '── Location Hints ──', value: '__separator1__', disabled: true },
-        { name: 'North America (West)', value: 'wnam' },
-        { name: 'North America (East)', value: 'enam' },
-        { name: 'Europe (West)', value: 'weur' },
-        { name: 'Europe (East)', value: 'eeur' },
-        { name: 'Asia Pacific', value: 'apac' },
-        { name: 'Oceania', value: 'oc' },
-        { name: '── Jurisdiction (Compliance) ──', value: '__separator2__', disabled: true },
-        { name: 'EU Jurisdiction (GDPR compliance)', value: 'eu' },
+        { name: t('region.auto'), value: 'auto' },
+        { name: '── ' + t('db.locationHints') + ' ──', value: '__separator1__', disabled: true },
+        { name: t('region.wnam'), value: 'wnam' },
+        { name: t('region.enam'), value: 'enam' },
+        { name: t('region.weur'), value: 'weur' },
+        { name: t('region.eeur'), value: 'eeur' },
+        { name: t('region.apac'), value: 'apac' },
+        { name: t('region.oceania'), value: 'oc' },
+        {
+            name: '── ' + t('db.jurisdictionCompliance') + ' ──',
+            value: '__separator2__',
+            disabled: true,
+        },
+        { name: t('region.euJurisdiction'), value: 'eu' },
     ];
-    console.log(chalk.gray('  Core DB: Stores OAuth clients, tokens, sessions, audit logs'));
+    console.log(chalk.gray('  ' + t('db.coreDescription')));
     const coreDbLocation = await select({
-        message: 'Core Database region',
+        message: t('db.coreRegion'),
         choices: dbLocationChoices,
         default: 'auto',
     });
     console.log('');
-    console.log(chalk.gray('  PII DB: Stores user profiles, credentials, personal data'));
-    console.log(chalk.gray('  Consider your data protection requirements.'));
+    console.log(chalk.gray('  ' + t('db.piiDescription')));
+    console.log(chalk.gray('  ' + t('db.piiNote')));
     const piiDbLocation = await select({
-        message: 'PII Database region',
+        message: t('db.piiRegion'),
         choices: dbLocationChoices,
         default: 'auto',
     });