pgkiln 0.57.0 → 0.59.0

package/src/builder/i18n/en.ts

@@ -1046,4 +1046,672 @@ export const en = {
   'te.failed_stmt': 'Failed statement',
   'te.title_table': 'Table {table}',
   'te.title_create': 'Create table',
+  // ------------------------------------------------------------ Shared Components (sprint 124)
+  'comp.nav_entry': 'Navigation entry',
+  'comp.nav_entry.plural': 'Navigation menu',
+  'comp.authz_scheme': 'Authorization scheme',
+  'comp.authz_scheme.plural': 'Authorization schemes',
+  'comp.build_option': 'Build option',
+  'comp.build_option.plural': 'Build options',
+  'comp.page_group': 'Page group',
+  'comp.page_group.plural': 'Page groups',
+  'comp.lov': 'List of values',
+  'comp.lov.plural': 'Lists of values',
+  'comp.app_item': 'Application item',
+  'comp.app_item.plural': 'Application items',
+  'comp.app_process': 'Application process',
+  'comp.app_process.plural': 'Application processes',
+  'comp.app_computation': 'Application computation',
+  'comp.app_computation.plural': 'Application computations',
+  'comp.shortcut': 'Shortcut',
+  'comp.shortcut.plural': 'Shortcuts',
+  'comp.report_query': 'Report query',
+  'comp.report_query.plural': 'Report queries',
+  'comp.component_group': 'Component group',
+  'comp.component_group.plural': 'Component groups',
+  'comp.automation': 'Automation',
+  'comp.automation.plural': 'Automations',
+  'comp.automation_action': 'Automation action',
+  'comp.automation_action.plural': 'Automation actions',
+  'comp.report_layout': 'Report layout',
+  'comp.report_layout.plural': 'Report layouts',
+  'comp.document_template': 'Document template',
+  'comp.document_template.plural': 'Document templates',
+  'comp.task_definition': 'Task definition',
+  'comp.task_definition.plural': 'Task definitions',
+  'comp.workflow_definition': 'Workflow',
+  'comp.workflow_definition.plural': 'Workflows',
+  'comp.rest_module': 'REST module',
+  'comp.rest_module.plural': 'REST modules',
+  'comp.template_component': 'Template component',
+  'comp.template_component.plural': 'Template components',
+  'comp.web_credential': 'Web credential',
+  'comp.web_credential.plural': 'Web credentials',
+  'comp.rest_source': 'REST data source',
+  'comp.rest_source.plural': 'REST data sources',
+  'comp.data_load_def': 'Data load definition',
+  'comp.data_load_def.plural': 'Data load definitions',
+  'comp.list': 'List',
+  'comp.list.plural': 'Lists',
+  'comp.list_entry': 'List entry',
+  'comp.list_entry.plural': 'List entries',
+  'comp.supporting_script': 'Supporting script',
+  'comp.supporting_script.plural': 'Supporting objects',
+  'comp.search_config': 'Search configuration',
+  'comp.search_config.plural': 'Search configurations',
+  'comp.email_template': 'E-mail template',
+  'comp.email_template.plural': 'E-mail templates',
+  'comp.app_setting': 'Application setting',
+  'comp.app_setting.plural': 'Application settings',
+  'comp.dynamic_translation': 'Dynamic translation',
+  'comp.dynamic_translation.plural': 'Dynamic translations',
+  'sc.group.logic': 'Application Logic',
+  'sc.group.security': 'Security',
+  'sc.group.other': 'Other Components',
+  'sc.group.navigation': 'Navigation and Search',
+  'sc.group.ui': 'User Interface',
+  'sc.group.files': 'Files and Reports',
+  'sc.group.data': 'Data Sources',
+  'sc.group.workflows': 'Workflows and Automations',
+  'sc.group.globalization': 'Globalization',
+  'sc.group.ai': 'Generative AI',
+  'sc.item.application_items': 'Application Items',
+  'sc.item.application_processes': 'Application Processes',
+  'sc.item.application_computations': 'Application Computations',
+  'sc.item.application_settings': 'Application Settings',
+  'sc.item.build_options': 'Build Options',
+  'sc.item.application_definition': 'Application Definition',
+  'sc.item.access_control': 'Access Control',
+  'sc.item.authentication': 'Authentication',
+  'sc.item.authorization_schemes': 'Authorization Schemes',
+  'sc.item.security_attributes': 'Security Attributes',
+  'sc.item.sign_in_and_session_management': 'Sign-in and Session Management',
+  'sc.item.lists_of_values': 'Lists of Values',
+  'sc.item.lists': 'Lists',
+  'sc.item.list_entries': 'List Entries',
+  'sc.item.email_templates': 'Email Templates',
+  'sc.item.shortcuts': 'Shortcuts',
+  'sc.item.component_groups': 'Component Groups',
+  'sc.item.supporting_objects': 'Supporting Objects',
+  'sc.item.subscriptions': 'Subscriptions',
+  'sc.item.navigation_menu': 'Navigation Menu',
+  'sc.item.navigation_bar_list': 'Navigation Bar List',
+  'sc.item.breadcrumbs': 'Breadcrumbs',
+  'sc.item.page_groups': 'Page Groups',
+  'sc.item.search_configurations': 'Search Configurations',
+  'sc.item.themes_and_theme_roller': 'Themes and Theme Roller',
+  'sc.item.user_interface_attributes': 'User Interface Attributes',
+  'sc.item.template_components': 'Template Components',
+  'sc.item.plug_ins': 'Plug-ins',
+  'sc.item.component_settings': 'Component Settings',
+  'sc.item.progressive_web_app': 'Progressive Web App',
+  'sc.item.static_application_files': 'Static Application Files',
+  'sc.item.report_layouts': 'Report Layouts',
+  'sc.item.report_queries': 'Report Queries',
+  'sc.item.document_templates': 'Document Templates',
+  'sc.item.rest_data_sources': 'REST Data Sources',
+  'sc.item.web_credentials': 'Web Credentials',
+  'sc.item.restful_services': 'RESTful Services',
+  'sc.item.data_load_definitions': 'Data Load Definitions',
+  'sc.item.workflows': 'Workflows',
+  'sc.item.task_definitions': 'Task Definitions',
+  'sc.item.automations': 'Automations',
+  'sc.item.translations_and_text_messages': 'Translations and Text Messages',
+  'sc.item.dynamic_translations': 'Dynamic Translations',
+  'sc.item.globalization_attributes': 'Globalization Attributes',
+  'sc.item.ai_services': 'AI Services',
+  'sc.item.ai_agents': 'AI Agents',
+  'sc.entries': 'Entries',
+  'sc.list_sql': 'This list shows the rows of its query; entries below are not used.',
+  'sc.no_entries': 'No entries yet.',
+  'sc.add_entry': '＋ Add entry',
+  'sc.breadcrumbs_help': "A page's breadcrumb lists the pages above it: each page names its breadcrumb parent (Page Designer → page → Breadcrumb parent). Pages without one show Home.",
+  'sc.cs_help': "Defaults for the application's built-in component types, used where a component sets nothing itself. Empty: pgkiln's default.",
+  'sc.cs_now': '{help} {min}–{max}; now {now}.',
+  'sc.cs_saved': 'Component settings saved.',
+  'sc.intro': 'The components the pages of {app} share.',
+  'sc.tree_view': 'Tree view',
+  'sc.create': 'Create',
+  'sc.search': 'Search',
+  'sc.name': 'Name',
+  'sc.details': 'Details',
+  'sc.nothing_matches': 'Nothing matches.',
+  'sc.none_yet': 'No {what} yet.',
+  'sc.count': '{n} of {total}',
+  'sc.new': 'New {what}',
+  'sc.save': 'Save',
+  'sc.run_supporting': 'Run supporting objects…',
+  'sc.delete_confirm': 'Delete this {what}?',
+  'sc.delete': 'Delete',
+  'sc.not_found': 'Not found.',
+  'sc.groups_title': 'Identity-provider groups → roles',
+  'sc.groups_help': 'With single sign-on, members of these groups get the role in this app, and may sign in even without being listed above.',
+  'sc.remove_mapping': 'Remove mapping {group} to {role}',
+  'sc.no_groups': 'No group mappings.',
+  'sc.group_label': 'Group (as in the token)',
+  'sc.group_ph': 'e.g. hr-managers',
+  'sc.role_label': 'Role in this app',
+  'sc.role_ph': 'e.g. manager',
+  'sc.add_mapping': 'Add mapping',
+  'sc.access': 'Access control',
+  'sc.who': 'Who may sign in',
+  'sc.who.assigned': 'Only accounts listed below (role-based access)',
+  'sc.who.any': 'Any active account in the directory',
+  'sc.access_help': "Accounts live in the {directory}; here you grant them access to {app} and assign roles, which authorization schemes and {fn} check. Role changes apply at the user's next sign-in (their sessions in this app end).",
+  'sc.directory': 'user directory',
+  'sc.account': 'Account',
+  'sc.roles_in_app': 'Roles in this app',
+  'sc.last_signin': 'Last sign-in',
+  'sc.roles': 'Roles',
+  'sc.inactive': '(inactive)',
+  'sc.roles_of': 'Roles of {user}',
+  'sc.no_roles': 'no roles',
+  'sc.revoke_confirm': "Revoke {user}'s access to {app}?",
+  'sc.revoke': 'Revoke',
+  'sc.no_access': 'No accounts have access yet.',
+  'sc.grant': 'Grant access',
+  'sc.username_ph': 'username',
+  'sc.existing': 'An existing account.',
+  'sc.create_in_users': 'Create accounts in Users.',
+  'sc.roles_ph': 'comma separated, or pick below',
+  'sc.tree.security': 'Security',
+  'sc.tree.globalization': 'Globalization',
+  'sc.tree.translations': 'Translations and text messages',
+  'sc.tree.files': 'Files and plug-ins',
+  'sc.tree.static': 'Static application files',
+  'sc.tree.subscriptions': 'Subscriptions',
+  'sc.tree.subscribers': 'Subscriptions and subscribers',
+  'sc.add_kind': 'Add {what}',
+  'sc.add': '＋ Add',
+  'sc.review_run': 'Review and run…',
+  'sc.edit': 'Edit',
+  'sc.saved': '{what} saved.',
+  'sc.deleted': '{what} deleted.',
+  'sc.access_saved': 'Access control saved.',
+  'sc.no_account': 'There is no account "{user}". Create it under Users first.',
+  'sc.granted': 'Access granted to {user}.',
+  'sc.mapping_added': 'Group mapping added. It applies at the next sign-in.',
+  'sc.mapping_removed': 'Group mapping removed. It applies at the next sign-in.',
+  'sc.roles_saved': 'Roles saved. They apply at the next sign-in.',
+  'sc.revoked': 'Access revoked.',
+  // ------------------------------------------------------------ Application settings (sprint 124)
+  'st.tab.definition': 'Definition',
+  'st.tab.security': 'Security',
+  'st.tab.signin': 'Sign-in',
+  'st.tab.ui': 'User Interface',
+  'st.tab.globalization': 'Globalization',
+  'st.tab.errors': 'Errors and Sessions',
+  'st.tab.pwa': 'Progressive Web App',
+  'st.settings': 'Settings',
+  'st.name': 'Name',
+  'st.alias': 'Alias',
+  'st.version': 'Version',
+  'st.version_ph': 'Release 1.0',
+  'st.version_help': "Shown in the footer of the application's pages; empty: none.",
+  'st.home_page': 'Home page',
+  'st.app_type': 'Application type',
+  'st.app_type_help': 'Theme and library applications offer their theme or shared components to other applications (Shared Components → Subscriptions); Create application can start from a boilerplate application.',
+  'st.type.standard': 'Standard',
+  'st.type.theme': 'Theme application',
+  'st.type.library': 'Library application',
+  'st.type.boilerplate': 'Boilerplate application',
+  'st.authentication': 'Authentication',
+  'st.auth.app_users': 'App users (login page)',
+  'st.auth.header': 'HTTP header (reverse proxy)',
+  'st.auth.database': 'Database accounts (PostgreSQL roles)',
+  'st.auth.custom': 'Custom (a PL/pgSQL function)',
+  'st.auth.none': 'None (public)',
+  'st.db_role': 'Database role (parsing schema)',
+  'st.db_role_help': 'All application SQL runs as this role (SET LOCAL ROLE), so grants and row level security apply. Leave empty only for trusted internal apps.',
+  'st.debug': 'Debug mode',
+  'st.debug_help': 'Shows database error details to end users. Development only.',
+  'st.debug_msgs': 'Debug messages',
+  'st.debug_on': 'on, level {level}',
+  'st.off': 'off',
+  'st.debug_msgs_help': "Records every request's steps with timings and the messages of {fn}, kept {days} days.",
+  'st.header_title': 'HTTP header authentication',
+  'st.header_intro': 'Only used when Authentication is "HTTP header". A reverse proxy or single sign-on gateway signs users in and passes the user name in a header; pgkiln trusts it only from the proxy addresses in {env}',
+  'st.header_unset': 'not set on this server: header sign-in is refused',
+  'st.header_name': 'User name header',
+  'st.header_name_help': 'The request header with the user name (APEX: HTTP Header Variable). Empty: X-Remote-User. A changed or missing header ends the session.',
+  'st.logout_url': 'Sign-out URL',
+  'st.logout_url_ph': 'e.g. https://sso.example.com/logout',
+  'st.logout_url_help': "Where \"Sign out\" goes after the session ends, usually the proxy's own sign-out page. Empty: a \"signed out\" page.",
+  'st.header_auto': 'Create accounts automatically',
+  'st.header_auto_help': 'An unknown user name gets a new account with access to this app. Otherwise the account must exist and have access.',
+  'st.db_title': 'Database accounts',
+  'st.db_intro': "Only used when Authentication is \"Database accounts\". Users sign in with a PostgreSQL login role and its password, checked by a short connection to this database as that role. Superusers and pgkiln's own roles are always refused; with neither field set nobody can sign in.",
+  'st.db_roles': 'Allowed roles',
+  'st.db_roles_ph': 'e.g. alice, bob',
+  'st.db_roles_help': 'Login roles that may sign in, comma separated (exact names).',
+  'st.db_member': 'Or members of role',
+  'st.db_member_ph': 'e.g. app_users_group',
+  'st.db_member_help': 'Every member of this role may sign in too.',
+  'st.custom_title': 'Custom authentication',
+  'st.custom_intro': "Only used when Authentication is \"Custom\". Your own PL/pgSQL checks the user name and password on the sign-in form, as the application's database role; the password is passed as a parameter and never logged. Failed attempts are throttled like other sign-ins. With neither field set nobody can sign in.",
+  'st.custom_fn': 'Function name',
+  'st.custom_fn_ph': 'e.g. app.check_login',
+  'st.custom_fn_help': "A function (p_username text, p_password text) returns boolean, in lower case, optionally with its schema. The app's role needs EXECUTE on it. Takes precedence over the body below.",
+  'st.custom_body': 'Or function body',
+  'st.custom_body_help': 'PL/pgSQL with p_username and p_password, returning true for a valid sign-in, e.g. {example}',
+  'st.custom_post': 'Post-authentication code',
+  'st.custom_post_help': 'Optional PL/pgSQL run after a successful check, with p_username (and meta.app_user()), e.g. to record the last sign-in. Raising an exception refuses the sign-in. Application processes "after login" run afterwards as usual.',
+  'st.signin': 'Sign-in',
+  'st.methods': 'Sign-in methods',
+  'st.local': 'Username and password',
+  'st.ldap': 'Passwords from LDAP: {name}',
+  'st.disabled': '(disabled)',
+  'st.no_ldap': 'No LDAP directories configured. {add} to check passwords against LDAP or Active Directory.',
+  'st.add_one': 'Add one',
+  'st.ldap_help': 'LDAP passwords are checked by the username and password form, after local accounts, so keep that method on.',
+  'st.session_group': 'Session sharing group',
+  'st.session_group_ph': 'empty: not shared',
+  'st.session_group_help': 'Applications with the same group (and the user directory as authentication) share a sign-in: after signing in to one, the others open without a new sign-in, each with its own access check and roles; signing out of one signs out of all (APEX: session sharing). Lower case letters, digits and _.',
+  'st.remember': '"Keep me signed in" for (days)',
+  'st.remember_ph': 'empty: not offered',
+  'st.remember_help': 'Offers a checkbox on the sign-in form (APEX: persistent authentication). The browser stays signed in for this many days after the sign-in, also when the session ends; signing out, a new password, deactivation or removed access ends it. 1 to 365.',
+  'st.sso': 'Sign in with {name}',
+  'st.no_sso': 'No identity providers configured. {add} for single sign-on.',
+  'st.theme': 'Theme',
+  'st.base': 'Base style',
+  'st.base.iris': 'Iris (the default for new applications)',
+  'st.base.lavender': 'Lavender (Iris until pgkiln 0.41)',
+  'st.base.standard': 'Standard (pgkiln until 0.28)',
+  'st.base_help': 'Colours, corners, font and shadows of the whole application, light and dark. The colours below override its accent and header.',
+  'st.accent': 'Accent colour',
+  'st.header_colour': 'Header colour',
+  'st.accent_dark': 'Accent colour in dark mode',
+  'st.header_dark': 'Header colour in dark mode',
+  'st.own_colour': "Use this colour (else the base style's dark palette)",
+  'st.nav': 'Navigation menu',
+  'st.nav.side': 'Side (collapsible)',
+  'st.nav.top': 'Top bar',
+  'st.nav_help': 'On tablets and phones the menu is always a drawer.',
+  'st.nav_list': 'Navigation menu list',
+  'st.nav_entries': '- the navigation entries -',
+  'st.nav_list_help': 'A list (Shared Components → Lists) shown as the navigation menu instead of the navigation entries.',
+  'st.navbar_list': 'Navigation bar list',
+  'st.none_option': '- none -',
+  'st.navbar_help': 'A list shown as links in the header, next to the user menu.',
+  'st.missing': '{name} (missing!)',
+  'st.mode': 'Theme style',
+  'st.mode.auto': 'Automatic (light or dark, following the device)',
+  'st.mode.light': 'Light',
+  'st.mode.dark': 'Dark',
+  'st.user_choice': 'Users may choose light or dark',
+  'st.user_choice_help': 'Adds a switch to the user menu and My account; the choice is saved on the account (APEX: "Enable End Users to Choose Theme Style").',
+  'st.roller': 'Theme Roller: style variants…',
+  'st.styles_one': '{n} style',
+  'st.styles': '{n} styles',
+  'st.no_styles': 'no styles yet',
+  'st.language': 'Primary language',
+  'st.language_help': 'The language the app is built in, e.g. en, nl, de, en-GB.',
+  'st.languages': 'Translated languages',
+  'st.languages_ph': 'e.g. nl, de',
+  'st.languages_help': 'Comma separated. Translate texts under Shared Components → Globalization.',
+  'st.language_from': 'Language derived from',
+  'st.from.browser': 'Browser (Accept-Language)',
+  'st.from.user': 'User preference, then browser',
+  'st.from.primary': 'Always the primary language',
+  'st.language_from_help': 'Users can also switch with ?lang=xx or the picker on the login page.',
+  'st.date_format': 'Date format',
+  'st.date_format_ph': 'e.g. DD-MM-YYYY (empty: per language)',
+  'st.date_format_help': 'Masks: YYYY YY MM MON MONTH DD DY DAY HH24 HH MI SS AM',
+  'st.ts_format': 'Date and time format',
+  'st.ts_format_ph': 'e.g. DD-MM-YYYY HH24:MI',
+  'st.save_settings': 'Save settings',
+  'st.delete_confirm': 'Delete application {app} and all its pages?',
+  'st.delete': 'Delete application',
+  'st.error_fn': 'Error handling function',
+  'st.error_fn_ph': 'e.g. sales.error_message',
+  'st.error_fn_help': "schema.function(jsonb) returns jsonb, run as the application's role: it receives the message and what is known of an error (code, constraint, table, column, component, page, user, internal, reference) and may return {\"message\": \"…\"} to show instead. Empty: none.",
+  'st.warning': 'Session timeout warning (seconds)',
+  'st.warning_help': 'Signed-in users are warned this long before their session ends and can stay signed in (0: no warning).',
+  'st.save': 'Save',
+  'st.checklist': 'Security checklist',
+  'st.ck.role': 'Runs as a dedicated database role',
+  'st.ck.runtime': '(runs as the runtime connection)',
+  'st.ck.signin': 'Users must sign in',
+  'st.ck.public': 'Public application',
+  'st.ck.debug_on': 'Debug mode is on: error details are shown to users',
+  'st.ck.debug_off': 'Debug mode is off',
+  'st.ck.msgs_on': 'Debug messages are on (level {level}): every request is recorded',
+  'st.ck.msgs_off': 'Debug messages are off',
+  'st.ck.unprotected': 'Pages without checksum protection: {n}',
+  'st.ck.public_pages': 'Public pages: {n}',
+  'st.title': '{app} settings',
+  'st.err.fn_shape': 'The error handling function is schema.function, e.g. sales.error_message.',
+  'st.err.no_fn': 'There is no function {fn}(jsonb) returning jsonb.',
+  'st.err.warning': 'The session timeout warning is 0 to 3600 seconds.',
+  'st.saved': 'Saved.',
+  'st.settings_saved': 'Settings saved.',
+  'st.app_deleted': 'Application deleted.',
+  // ------------------------------------------------------------ Users and identity providers (sprint 125)
+  'us.hints_none': "This app doesn't check any roles yet. Roles only matter where an authorization scheme or {fn} checks them (Shared Components → Authorization schemes).",
+  'us.hints_label': 'Roles this app checks',
+  'us.hints_add': 'Add',
+  'us.hints_app': '{app} checks',
+  'us.title': 'Users',
+  'us.providers_btn': 'Identity providers (single sign-on)',
+  'us.ldap_btn': 'LDAP directories',
+  'us.intro': "One account per person. Give accounts access to applications, with roles per application, here or under an application's {where}.",
+  'us.access_path': 'Shared Components → Access control',
+  'us.accounts': 'Accounts',
+  'us.search_ph': 'Search name, username or e-mail…',
+  'us.search_label': 'Search accounts',
+  'us.search': 'Search',
+  'us.username': 'Username',
+  'us.name': 'Name',
+  'us.apps_roles': 'Applications (roles)',
+  'us.applications': 'Applications',
+  'us.signin': 'Sign-in',
+  'us.status': 'Status',
+  'us.none': 'none',
+  'us.password': 'password',
+  'us.no_password': 'no password',
+  'us.active': 'active',
+  'us.inactive': 'inactive',
+  'us.last': 'last {at}',
+  'us.no_accounts': 'No accounts found.',
+  'us.create': 'Create account',
+  'us.username_help': 'No spaces or colons; not case-sensitive.',
+  'us.email': 'E-mail',
+  'us.password_label': 'Password',
+  'us.password_help': 'At least 8 characters. Leave empty for accounts that only sign in through single sign-on.',
+  'us.must_change': 'Require change of password on first use',
+  'us.settings': 'Account settings',
+  'us.min_length': 'Minimum password length',
+  'us.lifetime': 'Password lifetime (days)',
+  'us.lifetime_help': 'After this many days users must choose a new password at sign-in. 0 = never.',
+  'us.mixed': 'Passwords need letters and digits',
+  'us.policy_note': 'Passwords may never contain the username. Sign-in is locked for {minutes} minutes after {failures} failed attempts (Workspace utilities → Instance settings); Unlock on an account lifts it.',
+  'us.save_settings': 'Save settings',
+  'us.created': 'Account created. Now give it access to applications.',
+  'us.exists': 'An account with that username already exists.',
+  'us.settings_saved': 'Account settings saved.',
+  'us.details': 'Details',
+  'us.active_label': 'Active',
+  'us.active_help': "Inactive accounts can't sign in to any application; deactivating ends their sessions.",
+  'us.save': 'Save',
+  'us.password_title': 'Password',
+  'us.set': 'Set',
+  'us.set_on': 'Set on {date}',
+  'us.sso_only': 'No password (single sign-on only)',
+  'us.must_next': 'Must be changed at the next sign-in',
+  'us.expires': 'Expires in {n} day(s)',
+  'us.fails': '{n} failed sign-in(s) in the last hour',
+  'us.unexpire': 'Unexpire password',
+  'us.expire': 'Expire password',
+  'us.unlock': 'Unlock sign-in',
+  'us.new_password': 'New password',
+  'us.set_password_label': 'Set a password',
+  'us.ends_sessions': 'Ends the account’s sessions.',
+  'us.set_password': 'Set password',
+  'us.remove_confirm': 'Remove the password? The account can then only sign in through single sign-on.',
+  'us.remove_password': 'Remove password',
+  'us.delete_confirm': 'Delete account {user} and all its application access?',
+  'us.delete': 'Delete account',
+  'us.app_access': 'Application access',
+  'us.application': 'Application',
+  'us.roles': 'Roles',
+  'us.roles_in': 'Roles in {app}',
+  'us.roles_ph': 'no roles (e.g. {example})',
+  'us.revoke_confirm': 'Revoke access to {app}?',
+  'us.revoke': 'Revoke',
+  'us.no_access': 'No access to any application yet.',
+  'us.grant': 'Grant access',
+  'us.roles_comma': 'comma separated, or pick below',
+  'us.saved': 'Account saved.',
+  'us.pw_removed': 'Password removed.',
+  'us.pw_set': 'Password set.',
+  'us.pw_expired': 'Password expired: it must be changed at the next sign-in.',
+  'us.pw_unexpired': 'Password no longer expired.',
+  'us.unlocked': 'Sign-in unlocked.',
+  'us.deleted': 'Account deleted.',
+  'us.granted': 'Access granted.',
+  'us.roles_saved': 'Roles saved. The user gets them at the next sign-in.',
+  'us.revoked': 'Access revoked.',
+  'idp.title': 'Identity providers',
+  'idp.name': 'Name (in URLs)',
+  'idp.name_help': 'lowercase, e.g. entra, google, keycloak',
+  'idp.protocol': 'Protocol',
+  'idp.label': 'Button label',
+  'idp.label_help': 'Shown as "Sign in with …"',
+  'idp.issuer': 'Issuer (OIDC: URL; SAML: the IdP entity ID)',
+  'idp.issuer_help': 'e.g. https://login.microsoftonline.com/<tenant>/v2.0, https://keycloak.example.com/realms/acme, or for SAML the entityID of the IdP metadata',
+  'idp.client_id': "Client ID (SAML: pgkiln's entity ID)",
+  'idp.client_id_help': 'OIDC: required. SAML: empty = the metadata URL of this provider.',
+  'idp.sso_url': 'SAML: IdP sign-in URL',
+  'idp.sso_url_help': 'The SingleSignOnService location (HTTP-Redirect binding) from the IdP metadata.',
+  'idp.cert': 'SAML: IdP signing certificate (PEM)',
+  'idp.cert_help': 'From the IdP metadata (X509Certificate, wrapped in BEGIN/END CERTIFICATE lines). Assertions must be signed with it.',
+  'idp.secret': 'Client secret',
+  'idp.secret_kept': 'A secret is stored. Leave empty to keep it.',
+  'idp.secret_public': 'Leave empty for a public client (PKCE only).',
+  'idp.scopes': 'Scopes',
+  'idp.username_claim': 'Username claim',
+  'idp.username_claim_help': 'Use a claim users cannot change themselves (e.g. preferred_username, upn, email). SAML: an attribute name, or nameID.',
+  'idp.groups_claim': 'Groups claim',
+  'idp.groups_claim_help': 'Dot paths work, e.g. realm_access.roles',
+  'idp.auto_create': 'Create accounts automatically on first sign-in',
+  'idp.auto_create_help': 'Otherwise only people with an account linked to this provider (or allowed below) can sign in.',
+  'idp.link': 'Link existing accounts with the same username on their first sign-in',
+  'idp.link_help': "Only when users can't choose the username claim themselves at this provider: otherwise someone could register the name of an existing account and take it over. With the e-mail claim, only verified addresses link. Turn it off once the accounts are linked.",
+  'idp.enabled': 'Enabled',
+  'idp.remove_secret': 'Remove the stored client secret',
+  'idp.add': 'Add provider',
+  'idp.intro': 'OpenID Connect providers for single sign-on (Microsoft Entra ID, Google, Okta, Keycloak, Auth0, …). Register pgkiln at the provider as a web application with the redirect URI shown, then enable the provider per application under {where}.',
+  'idp.where': 'Settings → Sign-in methods',
+  'idp.providers': 'Providers',
+  'idp.provider': 'Provider',
+  'idp.issuer_col': 'Issuer',
+  'idp.used_by': 'Used by',
+  'idp.linked': 'Linked accounts',
+  'idp.no_apps': 'no apps',
+  'idp.enabled_s': 'enabled',
+  'idp.disabled_s': 'disabled',
+  'idp.auto_s': 'auto-create',
+  'idp.links_s': 'links existing accounts',
+  'idp.none': 'No identity providers yet.',
+  'idp.settings': 'Settings',
+  'idp.delete_confirm': 'Delete {name}? Linked identities are removed; accounts stay.',
+  'idp.delete': 'Delete provider',
+  'idp.register_idp': 'Register at the identity provider',
+  'idp.sp_metadata': 'Service provider metadata (import it at the IdP):',
+  'idp.by_hand': 'Or by hand: entity ID {entity}, assertion consumer service (HTTP-POST) {acs}.',
+  'idp.saml_note': 'Based on {env}. Sign the assertions; send the groups in the {claim} attribute to map them to roles.',
+  'idp.register': 'Register at the provider',
+  'idp.redirect': 'Redirect URI (callback):',
+  'idp.public_url': 'Based on {env}; set it to the address users see (e.g. https://apps.example.com).',
+  'idp.grant': 'Grant type: {type} with PKCE. Scopes: {scopes}. Include a {claim} claim in the ID token to map groups to roles.',
+  'idp.auth_code': 'authorization code',
+  'idp.test': 'Test discovery',
+  'idp.added': 'Provider added. Register the redirect URI at the provider, then test the connection.',
+  'idp.saved': 'Provider saved.',
+  'idp.works': 'Discovery works. Authorization endpoint: {url}',
+  'idp.failed': 'Discovery failed: {error}',
+  'idp.deleted': 'Provider deleted.',
+  // ------------------------------------------------------------ Workspaces (sprint 125)
+  'wsp.title': 'Workspaces',
+  'wsp.admins_only': 'Only administrators manage workspaces.',
+  'wsp.err.exists': 'A workspace with this name exists already.',
+  'wsp.err.name_check': 'The name is 1 to 60 characters, without spaces at the start or end.',
+  'wsp.err.name': 'The name is 1 to 60 characters.',
+  'wsp.iso.secret': "set PGKILN_SECRET_KEY (at least 32 characters) in the server's environment: the workspace's database logins get passwords derived from it.",
+  'wsp.iso.runtime': 'set RUNTIME_DATABASE_URL: applications run on the owner connection, so no workspace can be isolated.',
+  'wsp.err.role_taken': 'this role belongs to another workspace already.',
+  'wsp.err.role_has': 'the workspace has this role already.',
+  'wsp.isolated_tag': 'isolated',
+  'wsp.iso.on': "Its applications run as {run} and its developers' SQL (SQL Workshop, code checks, the Advisor) as {dev}. Both reach only the roles below, and see only this workspace's applications, sessions and accounts in pgkiln's own tables. Developers who also belong to a shared workspace keep that workspace's rights there.",
+  'wsp.db_role': 'Database role',
+  'wsp.used_by': 'Used by',
+  'wsp.missing': 'missing',
+  'wsp.no_app': 'no application',
+  'wsp.remove': 'Remove',
+  'wsp.no_roles': "No database roles: applications here can't run as a role of their own.",
+  'wsp.add_role': 'Add a database role',
+  'wsp.add_role_help': "An existing role (not a superuser, not one that creates roles or bypasses row-level security). Its rights become this workspace's; it can't belong to another workspace.",
+  'wsp.add_role_btn': 'Add role',
+  'wsp.make_shared_confirm': "Make {name} shared again? Its applications then run on the shared runtime connection, and its developers' SQL as the owner.",
+  'wsp.make_shared': 'Make shared',
+  'wsp.shared_text': "Shared: the applications run on the shared runtime connection and the developers' SQL as the owner, like every shared workspace's.",
+  'wsp.iso_help': "Isolating gives the workspace two database logins of its own and the database roles its applications use now. Application code then reaches only those roles and this workspace's applications; its developers' SQL Workshop runs on the workspace's login instead of the owner. New applications get a new role and schema of their own.",
+  'wsp.to_isolate': 'To isolate a workspace, {problem}',
+  'wsp.isolate_confirm': 'Isolate {name}?',
+  'wsp.isolate': 'Isolate this workspace',
+  'wsp.isolation': 'Isolation',
+  'wsp.service': 'Manage service',
+  'wsp.message': 'Workspace message',
+  'wsp.message_help': "Shown to this workspace's developers on the App Builder home, e.g. a maintenance window. Plain text.",
+  'wsp.banner': 'Environment banner',
+  'wsp.banner_help': 'A short label shown at the top of every builder page while this workspace is current. Empty: no banner.',
+  'wsp.banner_colour': 'Banner colour',
+  'wsp.save': 'Save',
+  'wsp.prefs': 'Workspace preferences',
+  'wsp.sql_on': 'Enable the SQL Workshop',
+  'wsp.sql_on_help': 'Off: the SQL Worksheet, the Object Browser, SQL scripts, data loading and unloading, Quick SQL, the query builder, DDL, Compare and AI are refused while this workspace is current, for every developer.',
+  'wsp.rest_on': 'Enable RESTful services',
+  'wsp.rest_on_help': "Off: the REST modules of this workspace's applications answer 404 (Not found) at {path}; they can still be edited.",
+  'wsp.builder_home': 'Builder links open',
+  'wsp.home.apps': 'App Builder',
+  'wsp.home.home': 'Workspace home',
+  'wsp.builder_home_help': 'Where a link to /builder (a bookmark from before the Workspace home) leads in this workspace. Signing in always opens the Workspace home; the App Builder is at /builder/apps.',
+  'wsp.save_prefs': 'Save preferences',
+  'wsp.links': 'Extension links',
+  'wsp.links_help': "Links to other tools this workspace's developers use (monitoring, a wiki, a ticket system), in the builder's {menu} menu while the workspace is current. They open in a new tab.",
+  'wsp.extensions': 'Extensions',
+  'wsp.label': 'Label',
+  'wsp.url': 'URL',
+  'wsp.order': 'Order',
+  'wsp.delete_link_confirm': 'Delete the link {label}?',
+  'wsp.delete': 'Delete',
+  'wsp.no_links': 'No extension links.',
+  'wsp.label_ph': 'Monitoring',
+  'wsp.description': 'Description',
+  'wsp.add_link': 'Add link',
+  'wsp.switched': 'Workspace {name}.',
+  'wsp.intro': "A workspace groups applications and the developers who build them. Developers see and change the applications of their own workspaces; administrators see all of them. A shared workspace is not a security boundary between developers who write SQL: its SQL Workshop and application code run with this installation's rights. An {isolated} workspace is: its applications and SQL run on database logins of its own that reach only its database roles and its own applications.",
+  'wsp.isolated_word': 'isolated',
+  'wsp.workspace': 'Workspace',
+  'wsp.applications': 'Applications',
+  'wsp.developers': 'Developers',
+  'wsp.admins_text': 'administrators only',
+  'wsp.add': 'Add workspace',
+  'wsp.name': 'Name',
+  'wsp.name_help': 'For example the team or department that builds its applications here.',
+  'wsp.first_dev': 'You become its first developer; add others on its page.',
+  'wsp.added': 'Workspace {name} added.',
+  'wsp.settings': 'Settings',
+  'wsp.default_no_delete': "The Default workspace can't be deleted: imported applications and applications made with the command line start here.",
+  'wsp.delete_confirm': 'Delete workspace {name}?',
+  'wsp.delete_ws': 'Delete workspace',
+  'wsp.move_first': 'Move its applications to another workspace first.',
+  'wsp.devs_help': 'Developers of this workspace see and change its applications. Administrators see every workspace.',
+  'wsp.administrator': '(administrator)',
+  'wsp.ws_admins': 'Workspace administrators',
+  'wsp.ws_admins_help': "They manage this workspace's name and developers. Isolation, database roles, moving applications and deleting the workspace stay with administrators.",
+  'wsp.save_devs': 'Save developers',
+  'wsp.mail_net': 'Mail and network access',
+  'wsp.mail_net_text': "This workspace's own {mail} for its applications without one of their own, its {network} list (which hosts its applications may call, within the installation's list), and the {queue}.",
+  'wsp.mail_service': 'mail service',
+  'wsp.network': 'network access',
+  'wsp.queue': 'mail queue',
+  'wsp.iso_short_on': 'Isolated: its applications and SQL run on database logins of its own.',
+  'wsp.iso_short_off': 'Shared.',
+  'wsp.admins_change': 'Administrators change it.',
+  'wsp.application': 'Application',
+  'wsp.move_to': 'Move to',
+  'wsp.move_label': 'Move {app} to',
+  'wsp.move': 'Move',
+  'wsp.no_other': 'no other workspace',
+  'wsp.no_apps': 'No applications.',
+  'wsp.saved': 'Workspace saved.',
+  'wsp.not_found': 'Not found.',
+  'wsp.devs_saved': 'Developers saved.',
+  'wsp.not_moved': 'Not moved: {why}',
+  'wsp.moved': 'Application moved to {name}.',
+  'wsp.err.default': 'The Default workspace cannot be deleted.',
+  'wsp.err.isolated': 'Make the workspace shared (not isolated) before deleting it.',
+  'wsp.err.has_apps': 'Move the applications of this workspace to another workspace first.',
+  'wsp.deleted': 'Workspace {name} deleted.',
+  'wsp.isolated_now': 'The workspace is isolated: its applications and SQL now run on its own database logins.',
+  'wsp.shared_now': 'The workspace is shared again: its applications run on the shared runtime connection.',
+  'wsp.not_isolated': 'Not isolated: {why}',
+  'wsp.not_changed': 'Not changed: {why}',
+  'wsp.err.role_name': 'A role name is a letter or _ followed by letters, digits, _ or $ (at most 63).',
+  'wsp.err.no_role': 'There is no database role {role}.',
+  'wsp.err.role_used_one': '{apps} runs as {role}: give it another role first.',
+  'wsp.err.role_used': '{apps} run as {role}: give them another role first.',
+  'wsp.role_removed': 'Role {role} removed.',
+  'wsp.role_added': 'Role {role} added.',
+  'wsp.not_saved': 'Not saved: {why}',
+  'wsp.err.message': 'The message is at most 2000 characters.',
+  'wsp.err.banner': 'The banner label is at most 40 characters.',
+  'wsp.service_saved': 'Message and banner saved.',
+  'wsp.prefs_saved': 'Preferences saved.',
+  'wsp.err.label': 'The label is 1 to 60 characters.',
+  'wsp.err.url': 'The URL starts with http:// or https://.',
+  'wsp.err.description': 'The description is at most 500 characters.',
+  'wsp.err.order': 'The order is a whole number.',
+  'wsp.link_added': 'Link {label} added.',
+  'wsp.link_exists': 'There is a link {label} already.',
+  'wsp.link_not_saved': 'The link was not saved.',
+  'wsp.link_deleted': 'Link deleted.',
+  'wsp.util_title': 'Workspace utilization: {name}',
+  'wsp.pages': 'Pages',
+  'wsp.views30': 'Page views (30 days)',
+  'wsp.scripts': 'SQL scripts',
+  'wsp.regions': 'Regions',
+  'wsp.items': 'Items',
+  'wsp.users30': 'Users (30 days)',
+  'wsp.static': 'Static files',
+  'wsp.views': 'Page views',
+  'wsp.users': 'Users',
+  'wsp.schemas': 'Schemas',
+  'wsp.schemas_help': "The schemas the workspace's database roles may use, with the storage of their tables, indexes and TOAST data.",
+  'wsp.schema': 'Schema',
+  'wsp.owner': 'Owner',
+  'wsp.tables': 'Tables',
+  'wsp.storage': 'Storage',
+  'wsp.no_schemas': "No schemas: the workspace's applications have no database role of their own.",
+  'wsp.utilization': 'Utilization',
+  'wsp.util_crumb': 'Utilization: {name}',
+  // ------------------------------------------------------------ Developers (sprint 125)
+  'dev.title': 'Developers',
+  'dev.change_pw': 'Change your password',
+  'dev.current': 'Current password',
+  'dev.new': 'New password',
+  'dev.min8': 'At least 8 characters.',
+  'dev.change_btn': 'Change password',
+  'dev.your_email': 'Your e-mail address',
+  'dev.email': 'E-mail address',
+  'dev.email_help': '"Find my workspace" on the sign-in page sends your workspaces to it. Empty: none.',
+  'dev.save': 'Save',
+  'dev.accounts': 'Developer accounts',
+  'dev.accounts_help': "Administrators add and remove developers and can break other developers' page and application locks.",
+  'dev.username': 'Username',
+  'dev.role': 'Role',
+  'dev.email_col': 'E-mail',
+  'dev.you': '(you)',
+  'dev.administrator': 'Administrator',
+  'dev.developer': 'Developer',
+  'dev.email_of': 'E-mail address of {user}',
+  'dev.none': 'none',
+  'dev.make_dev': 'Make developer',
+  'dev.make_admin': 'Make administrator',
+  'dev.remove_confirm': 'Remove developer {user}?',
+  'dev.remove': 'Remove',
+  'dev.add': 'Add developer',
+  'dev.password': 'Password',
+  'dev.optional_email': 'Optional: for "Find my workspace".',
+  'dev.admins_only': 'Only administrators add and remove developers.',
+  'dev.err.email': 'The e-mail address is not valid.',
+  'dev.added_ws': 'Developer added to workspace {name}.',
+  'dev.added': 'Developer added.',
+  'dev.err.current': 'The current password is not correct.',
+  'dev.pw_changed': 'Password changed.',
+  'dev.email_saved': 'E-mail address saved.',
+  'dev.not_found': 'Not found.',
+  'dev.role_changed': 'Role changed.',
+  'dev.removed': 'Developer removed.',
 } as const;