pgkiln 0.84.0 → 0.85.0

package/src/builder/mail.ts

@@ -8,6 +8,7 @@ import { decryptSecret, encryptSecret, secretKeyConfigured } from '../secrets.ts
 import { clientIp, logActivity, type Session } from '../session.ts';
 import { isAdmin } from './locks.ts';
 import { back, BASE, csrf, developer, flash, input, region, select, send, shell, type Req } from './ui.ts';
+import { scopedTx as tx } from './i18n.ts';
 
 // Workspace utilities → Mail services (administrators): the mail services of
 // this installation (SMTP with a password or OAuth2, Microsoft Graph, Amazon
@@ -25,27 +26,27 @@ const check = (name: string, label: string, on: boolean, help?: string) =>
   html`<div class="field"><label class="check"><input type="checkbox" name="${name}" value="true"${on ? raw(' checked') : ''}> ${label}</label>${help ? html`<small class="help">${help}</small>` : ''}</div>`;
 const when = (d: Date | string | null) => (d ? new Date(d).toISOString().slice(0, 19).replace('T', ' ') : '');
 
-const SECRET_LABEL: Record<Provider, string> = {
-  smtp: 'Password, or the client secret (OAuth2)', graph: 'Client secret', ses: 'Secret access key', resend: 'API key',
-  postmark: 'Server token', sendgrid: 'API key', mailgun: 'API key', log: 'Secret (not used)',
-};
+const SECRET_LABEL = (p: Provider): string => ({
+  smtp: tx('ml.password_or_the_client_secret'), graph: tx('ml.client_secret'), ses: tx('ml.secret_access_key'), resend: tx('ml.api_key'),
+  postmark: tx('ml.server_token'), sendgrid: tx('ml.api_key'), mailgun: tx('ml.api_key'), log: tx('ml.secret_not_used'),
+})[p];
 
 /** What each provider is, for the choice of a new service. */
-export const PROVIDER_TEXT: Record<Provider, [icon: string, text: string]> = {
-  smtp: ['send', 'Any SMTP server or relay. Sign in with a password, or with OAuth2 (Exchange Online, Google Workspace).'],
-  graph: ['building', 'Microsoft 365 through the Graph API, as an Entra application with Mail.Send.'],
-  ses: ['database', 'Amazon Simple Email Service (API v2), with an IAM access key.'],
-  resend: ['send', 'Resend\'s HTTP API, with an API key.'],
-  postmark: ['send', 'Postmark\'s HTTP API, with a server token.'],
-  sendgrid: ['send', 'SendGrid\'s HTTP API, with an API key.'],
-  mailgun: ['send', 'Mailgun\'s HTTP API, with an API key and a sending domain.'],
-  log: ['list', 'For development and demos: the server writes each mail to its log and sends nothing.'],
-};
+export const PROVIDER_TEXT = (p: Provider): [icon: string, text: string] => ({
+  smtp: ['send', tx('ml.any_smtp_server_or_relay')],
+  graph: ['building', tx('ml.microsoft_365_through_the_graph')],
+  ses: ['database', tx('ml.amazon_simple_email_service_api')],
+  resend: ['send', tx('ml.resend_s_http_api_with')],
+  postmark: ['send', tx('ml.postmark_s_http_api_with')],
+  sendgrid: ['send', tx('ml.sendgrid_s_http_api_with')],
+  mailgun: ['send', tx('ml.mailgun_s_http_api_with')],
+  log: ['list', tx('ml.for_development_and_demos_the')],
+} as Record<Provider, [string, string]>)[p];
 
 /** Step 1 of a new service: choose the provider. */
 function providerChoice() {
   return html`<div class="ab-tiles ab-tiles-wrap">${PROVIDERS.map((p) =>
-    html`<a class="ab-tile" href="${BASE}/mail/new?provider=${p}"><span class="ab-tile-icon">${icon(PROVIDER_TEXT[p][0])}</span><strong>${PROVIDER_LABELS[p]}</strong><span>${PROVIDER_TEXT[p][1]}</span></a>`)}</div>`;
+    html`<a class="ab-tile" href="${BASE}/mail/new?provider=${p}"><span class="ab-tile-icon">${icon(PROVIDER_TEXT(p)[0])}</span><strong>${PROVIDER_LABELS[p]}</strong><span>${PROVIDER_TEXT(p)[1]}</span></a>`)}</div>`;
 }
 
 /**
@@ -60,70 +61,70 @@ export function serviceForm(x: Partial<MailService> & { has_secret?: boolean },
   const group = (legend: string, body: unknown, help?: string) =>
     html`<fieldset class="prop-group"><legend>${legend}</legend>${help ? html`<p class="muted u-mt0">${help}</p>` : ''}${body}</fieldset>`;
   const oauth = (scope: string) => html`<div class="form-grid">
-      ${input('tenant_id', 'Tenant ID (Microsoft Entra)', s.tenant_id, { placeholder: 'contoso.onmicrosoft.com or its GUID' })}
-      ${input('client_id', 'Client (application) ID', s.client_id)}
-      ${ws ? '' : input('token_url', 'Token URL', s.token_url, { placeholder: 'empty: Microsoft Entra of the tenant', help: 'Another identity provider\'s token endpoint (client credentials grant), e.g. Google\'s.' })}
-      ${input('scope', 'Scope', s.scope, { placeholder: `empty: ${scope}` })}
+      ${input('tenant_id', tx('ml.tenant_id_microsoft_entra'), s.tenant_id, { placeholder: tx('ml.contoso_onmicrosoft_com_or_its') })}
+      ${input('client_id', tx('ml.client_application_id'), s.client_id)}
+      ${ws ? '' : input('token_url', tx('ml.token_url'), s.token_url, { placeholder: tx('ml.empty_microsoft_entra_of_the'), help: tx('ml.another_identity_provider_s_token') })}
+      ${input('scope', tx('ml.scope'), s.scope, { placeholder: `empty: ${scope}` })}
     </div>`;
   const settings =
     provider === 'smtp'
-      ? html`${group('SMTP server', html`<div class="form-grid">
-          ${input('host', 'Host', s.host, { required: true, placeholder: 'smtp.office365.com' })}
-          ${input('port', 'Port', s.port ?? '', { type: 'number', placeholder: '587', help: 'Empty: 587 (STARTTLS) or 465 (TLS).' })}
-          ${select('security', 'Security', s.security ?? 'starttls', [['starttls', 'STARTTLS (required)'], ['tls', 'TLS from the start (port 465)'], ['none', 'None (a local relay only)']])}
-          ${select('auth', 'Sign-in', s.auth ?? 'password', [['password', 'User name and password'], ['oauth2', 'OAuth2 (XOAUTH2, client credentials)'], ['none', 'None']],
+      ? html`${group(tx('ml.smtp_server'), html`<div class="form-grid">
+          ${input('host', tx('ml.host'), s.host, { required: true, placeholder: 'smtp.office365.com' })}
+          ${input('port', tx('ml.port'), s.port ?? '', { type: 'number', placeholder: '587', help: tx('ml.empty_587_starttls_or_465') })}
+          ${select('security', tx('ml.security'), s.security ?? 'starttls', [['starttls', tx('ml.starttls_required')], ['tls', tx('ml.tls_from_the_start_port')], ['none', tx('ml.none_a_local_relay_only')]])}
+          ${select('auth', tx('ml.sign_in'), s.auth ?? 'password', [['password', tx('ml.user_name_and_password')], ['oauth2', tx('ml.oauth2_xoauth2_client_credentials')], ['none', tx('ml.none')]],
             'Microsoft 365 no longer takes passwords for SMTP: choose OAuth2 with an Entra application (SMTP.SendAsApp), or the Microsoft 365 (Graph) provider.')}
-          ${input('username', 'User name', s.username, { placeholder: 'the mailbox, e.g. noreply@example.com' })}
-        </div>${check('tls_verify', 'Check the server\'s certificate', s.tls_verify !== false, 'Switch off only for a relay with a self-signed certificate on your own network.')}`)}
-        <details class="prop-group prop-group-more"${s.auth === 'oauth2' ? raw(' open') : ''}><summary>OAuth2 sign-in <span class="muted">(only with Sign-in: OAuth2)</span></summary>${oauth('https://outlook.office365.com/.default')}</details>`
+          ${input('username', tx('ml.user_name'), s.username, { placeholder: tx('ml.the_mailbox_e_g_noreply') })}
+        </div>${check('tls_verify', tx('ml.check_the_server_s_certificate'), s.tls_verify !== false, tx('ml.switch_off_only_for_a'))}`)}
+        <details class="prop-group prop-group-more"${s.auth === 'oauth2' ? raw(' open') : ''}><summary>OAuth2 sign-in <span class="muted">${tx('ml.only_with_sign_in_oauth2')}</span></summary>${oauth('https://outlook.office365.com/.default')}</details>`
       : provider === 'graph'
-        ? group('Microsoft Entra application', html`${oauth('https://graph.microsoft.com/.default')}
-            ${check('save_to_sent_items', 'Keep a copy in the mailbox\'s Sent Items', s.save_to_sent_items === true)}`,
+        ? group(tx('ml.microsoft_entra_application'), html`${oauth('https://graph.microsoft.com/.default')}
+            ${check('save_to_sent_items', tx('ml.keep_a_copy_in_the'), s.save_to_sent_items === true)}`,
           'An application in Microsoft Entra with a client secret and the application permission Mail.Send, limited to the sending mailboxes.')
         : provider === 'ses'
-          ? group('Amazon SES', html`<div class="form-grid">
-              ${input('region', 'AWS region', s.region, { required: true, placeholder: 'eu-west-1' })}
-              ${input('access_key_id', 'Access key ID', s.access_key_id, { required: true })}</div>`,
+          ? group(tx('ml.amazon_ses'), html`<div class="form-grid">
+              ${input('region', tx('ml.aws_region'), s.region, { required: true, placeholder: tx('ml.eu_west_1') })}
+              ${input('access_key_id', tx('ml.access_key_id'), s.access_key_id, { required: true })}</div>`,
             'An IAM user allowed ses:SendEmail; the From addresses must be verified identities in SES.')
           : provider === 'mailgun'
-            ? group('Mailgun', html`<div class="form-grid">
-                ${input('domain', 'Sending domain', s.domain, { required: true, placeholder: 'mg.example.com' })}
-                ${select('mailgun_region', 'Region', s.mailgun_region ?? 'us', [['us', 'US'], ['eu', 'EU']])}</div>`)
+            ? group(tx('ml.mailgun'), html`<div class="form-grid">
+                ${input('domain', tx('ml.sending_domain'), s.domain, { required: true, placeholder: 'mg.example.com' })}
+                ${select('mailgun_region', tx('ml.region'), s.mailgun_region ?? 'us', [['us', 'US'], ['eu', 'EU']])}</div>`)
             : provider === 'postmark'
-              ? group('Postmark', html`<div class="form-grid">${input('message_stream', 'Message stream', s.message_stream, { placeholder: 'outbound' })}</div>`)
+              ? group(tx('ml.postmark'), html`<div class="form-grid">${input('message_stream', tx('ml.message_stream'), s.message_stream, { placeholder: 'outbound' })}</div>`)
               : '';
-  const secret = provider === 'log' ? '' : group(SECRET_LABEL[provider], html`
-      ${input('secret', SECRET_LABEL[provider], '', { type: 'password', auto: 'new-password',
-        help: x.has_secret && x.provider === provider ? 'A secret is stored (encrypted). It is never shown; type a new one to replace it.' : 'Stored encrypted; never shown again.' })}
-      ${x.has_secret ? check('remove_secret', 'Remove the stored secret', false) : ''}
-      ${secretKeyConfigured() ? '' : html`<div class="alert alert-error" role="alert">The server has no <code>PGKILN_SECRET_KEY</code>: secrets can't be stored until it is set.</div>`}`);
+  const secret = provider === 'log' ? '' : group(SECRET_LABEL(provider), html`
+      ${input('secret', SECRET_LABEL(provider), '', { type: 'password', auto: 'new-password',
+        help: x.has_secret && x.provider === provider ? 'A secret is stored (encrypted). It is never shown; type a new one to replace it.' : tx('ml.stored_encrypted_never_shown_again') })}
+      ${x.has_secret ? check('remove_secret', tx('ml.remove_the_stored_secret'), false) : ''}
+      ${secretKeyConfigured() ? '' : html`<div class="alert alert-error" role="alert">${tx.code('ml.no_secret_key')}</div>`}`);
   const viaHttp = provider !== 'smtp' && provider !== 'log' && !ws;
   return html`<form method="post" action="${action}" class="mail-service-form">${csrfField}
     <input type="hidden" name="provider" value="${provider}">
-    ${group('Service', html`<div class="form-grid">
-      ${isNew && !ws ? input('name', 'Name', '', { required: true, placeholder: 'e.g. OFFICE365', help: 'Upper case letters, digits and _.' }) : ''}
-      ${input('description', 'Description', x.description)}
-    </div>${check('enabled', 'Enabled', x.enabled !== false, 'A disabled service sends nothing: mail stays queued until it is enabled, or fails after its retries.')}`)}
-    ${group('Senders', html`<div class="form-grid">
-      ${input('senders', 'Allowed senders', (x.senders ?? []).join(', '), { required: true, placeholder: 'noreply@example.com, @example.com',
-        help: 'The From addresses this service may send as: an address, or @domain for every address of a domain (the provider must accept them too).' })}
-      ${input('default_from', 'Default From address', s.default_from, { placeholder: 'noreply@example.com', help: 'For applications that set none.' })}
+    ${group(tx('ml.service'), html`<div class="form-grid">
+      ${isNew && !ws ? input('name', tx('ml.name'), '', { required: true, placeholder: tx('ml.e_g_office365'), help: tx('ml.upper_case_letters_digits_and') }) : ''}
+      ${input('description', tx('ml.description'), x.description)}
+    </div>${check('enabled', tx('ml.enabled'), x.enabled !== false, 'A disabled service sends nothing: mail stays queued until it is enabled, or fails after its retries.')}`)}
+    ${group(tx('ml.senders'), html`<div class="form-grid">
+      ${input('senders', tx('ml.allowed_senders'), (x.senders ?? []).join(', '), { required: true, placeholder: tx('ml.noreply_example_com_example_com'),
+        help: tx('ml.the_from_addresses_this_service') })}
+      ${input('default_from', tx('ml.default_from_address'), s.default_from, { placeholder: tx('ml.noreply_example_com'), help: tx('ml.for_applications_that_set_none') })}
     </div>`)}
     ${settings}
     ${secret}
-    ${viaHttp ? html`<details class="prop-group prop-group-more"${s.base_url ? raw(' open') : ''}><summary>Advanced</summary><div class="form-grid">
-      ${input('base_url', 'API base URL', s.base_url, { placeholder: 'empty: the provider\'s own API', help: 'A gateway or proxy that speaks the provider\'s API. Administrators only.' })}</div></details>` : ''}
-    ${group('Check before saving', html`
+    ${viaHttp ? html`<details class="prop-group prop-group-more"${s.base_url ? raw(' open') : ''}><summary>${tx('ml.advanced')}</summary><div class="form-grid">
+      ${input('base_url', tx('ml.api_base_url'), s.base_url, { placeholder: tx('ml.empty_the_provider_s_own'), help: tx('ml.a_gateway_or_proxy_that') })}</div></details>` : ''}
+    ${group(tx('ml.check_before_saving'), html`
       ${x.id ? html`<input type="hidden" name="service_id" value="${x.id}">` : ''}
-      <div class="buttons mail-check-buttons"><button class="btn" formaction="${checkAction}" formnovalidate name="check" value="connection">${icon('play')} Test connection</button></div>
+      <div class="buttons mail-check-buttons"><button class="btn" formaction="${checkAction}" formnovalidate name="check" value="connection">${icon('play')} ${tx('ml.test_connection')}</button></div>
       <div class="form-grid">
-        ${input('test_to', 'Send a test mail to', tried?.to ?? '', { type: 'email', placeholder: 'you@example.com' })}
-        ${input('test_from', 'From', tried?.from ?? s.default_from ?? (x.senders ?? []).find((a) => !a.startsWith('@')) ?? '', { type: 'email', help: 'One of the allowed senders.' })}
+        ${input('test_to', tx('ml.send_a_test_mail_to'), tried?.to ?? '', { type: 'email', placeholder: tx('ml.you_example_com') })}
+        ${input('test_from', tx('ml.from'), tried?.from ?? s.default_from ?? (x.senders ?? []).find((a) => !a.startsWith('@')) ?? '', { type: 'email', help: tx('ml.one_of_the_allowed_senders') })}
       </div>
-      <div class="buttons mail-check-buttons"><button class="btn" formaction="${checkAction}" formnovalidate name="check" value="send">${icon('send')} Send test mail</button></div>
+      <div class="buttons mail-check-buttons"><button class="btn" formaction="${checkAction}" formnovalidate name="check" value="send">${icon('send')} ${tx('ml.send_test_mail')}</button></div>
       <div class="mail-check-result" role="status" aria-live="polite">${tried ? html`<div class="alert ${tried.ok ? 'alert-success' : 'alert-error'}">${tried.text}</div>` : ''}</div>`,
-      `Uses the settings above as they are filled in, without saving them.${x.has_secret ? ' An empty secret field uses the stored secret.' : ''} Test connection signs in (SMTP) or makes a read-only call with the key; a test mail is really sent.`)}
-    <div class="buttons">${isNew && !ws ? html`<a class="btn" href="${BASE}/mail/new">Choose another provider</a>` : ''}<button class="btn btn-hot">${isNew ? 'Add service' : 'Save'}</button></div>
+      x.has_secret ? tx('ml.check_help_secret') : tx('ml.check_help'))}
+    <div class="buttons">${isNew && !ws ? html`<a class="btn" href="${BASE}/mail/new">${tx('ml.choose_another_provider')}</a>` : ''}<button class="btn btn-hot">${isNew ? tx('ml.add_service') : tx('ml.save')}</button></div>
   </form>`;
 }
 
@@ -161,11 +162,11 @@ export function formValues(b: Record<string, string | undefined>, hasSecret: boo
     delete v.settings.token_url;
   }
   if (!opts.connection || v.senders.length) {
-    if (!v.senders.length) throw new Error('Name at least one allowed sender (an address, or @domain).');
+    if (!v.senders.length) throw new Error(tx('ml.name_at_least_one_allowed'));
     const bad = v.senders.find((x) => !SENDER.test(x));
     if (bad) throw new Error(`"${bad}" is not an address or @domain.`);
     const from = v.settings.default_from;
-    if (from && (!ADDRESS.test(from) || !senderAllowed(v.senders, from))) throw new Error('The default From address must be an address the service may send as.');
+    if (from && (!ADDRESS.test(from) || !senderAllowed(v.senders, from))) throw new Error(tx('ml.the_default_from_address_must'));
   }
   const problems = settingsProblems(v.provider, v.settings, hasSecret || !!b.secret);
   if (problems.length) throw new Error(problems.join(' '));
@@ -175,21 +176,21 @@ export function formValues(b: Record<string, string | undefined>, hasSecret: boo
 const STATUS_CLASS: Record<string, string> = { sent: ' tag-ok', queued: '', sending: '', error: ' tag-error', cancelled: '' };
 
 const mailTable = (rows: any[], withApp: boolean, actions?: (m: any) => unknown) => html`<div class="table-wrap"><table class="report report-reflow">
-  <thead><tr><th>Queued (UTC)</th>${withApp ? html`<th>Application</th>` : ''}<th>To</th><th>Subject</th><th>From</th><th class="num">Attempts</th><th>Status</th>${actions ? html`<th>Actions</th>` : ''}</tr></thead>
+  <thead><tr><th>${tx('ml.queued_utc')}</th>${withApp ? html`<th>${tx('ml.application')}</th>` : ''}<th>${tx('ml.to')}</th><th>${tx('ml.subject')}</th><th>${tx('ml.from')}</th><th class="num">${tx('ml.attempts')}</th><th>${tx('ml.status')}</th>${actions ? html`<th>${tx('ml.actions')}</th>` : ''}</tr></thead>
   <tbody>${rows.length ? rows.map((m) => html`<tr>
-    <td data-label="Queued">${when(m.created_at)}</td>${withApp ? html`<td data-label="Application">${m.app ?? ''}</td>` : ''}
-    <td data-label="To" class="u-break">${[...m.to_addresses, ...m.cc_addresses].join(', ')}${m.bcc_addresses.length ? html` <span class="muted">+${m.bcc_addresses.length} bcc</span>` : ''}</td>
-    <td data-label="Subject" class="u-break">${m.subject}${m.template ? html` <span class="muted">(${m.template})</span>` : ''}</td>
-    <td data-label="From" class="u-break">${m.from_address ?? ''}</td>
-    <td class="num" data-label="Attempts">${m.attempts}</td>
-    <td data-label="Status"><span class="tag${STATUS_CLASS[m.status] ?? ''}">${m.status}</span>${m.sent_at ? html` <span class="muted">${when(m.sent_at)}</span>` : ''}${m.message ? html`<br><span class="muted u-break">${m.message}</span>` : ''}</td>
-    ${actions ? html`<td data-label="Actions">${actions(m)}</td>` : ''}</tr>`)
-    : html`<tr><td colspan="${7 + (withApp ? 1 : 0) + (actions ? 1 : 0)}" class="empty">No mail yet.</td></tr>`}</tbody></table></div>`;
+    <td data-label="${tx('ml.queued')}">${when(m.created_at)}</td>${withApp ? html`<td data-label="${tx('ml.application')}">${m.app ?? ''}</td>` : ''}
+    <td data-label="${tx('ml.to')}" class="u-break">${[...m.to_addresses, ...m.cc_addresses].join(', ')}${m.bcc_addresses.length ? html` <span class="muted">+${m.bcc_addresses.length} bcc</span>` : ''}</td>
+    <td data-label="${tx('ml.subject')}" class="u-break">${m.subject}${m.template ? html` <span class="muted">(${m.template})</span>` : ''}</td>
+    <td data-label="${tx('ml.from')}" class="u-break">${m.from_address ?? ''}</td>
+    <td class="num" data-label="${tx('ml.attempts')}">${m.attempts}</td>
+    <td data-label="${tx('ml.status')}"><span class="tag${STATUS_CLASS[m.status] ?? ''}">${m.status}</span>${m.sent_at ? html` <span class="muted">${when(m.sent_at)}</span>` : ''}${m.message ? html`<br><span class="muted u-break">${m.message}</span>` : ''}</td>
+    ${actions ? html`<td data-label="${tx('ml.actions')}">${actions(m)}</td>` : ''}</tr>`)
+    : html`<tr><td colspan="${7 + (withApp ? 1 : 0) + (actions ? 1 : 0)}" class="empty">${tx('ml.no_mail_yet')}</td></tr>`}</tbody></table></div>`;
 
 async function adminOnly(s: Session, reply: any, title: string) {
   if (await isAdmin(s.username)) return true;
-  const main = html`<h1 class="u-mb1">${title}</h1><div class="alert alert-error" role="alert">Only administrators configure mail services.</div>`;
-  await send(reply.code(403), s, shell(s, title, [['App Builder', BASE], ['Workspace utilities', `${BASE}/utilities`], [title]], main));
+  const main = html`<h1 class="u-mb1">${title}</h1><div class="alert alert-error" role="alert">${tx('ml.only_administrators_configure_mail_services')}</div>`;
+  await send(reply.code(403), s, shell(s, title, [[tx('ml.app_builder'), BASE], [tx('ml.workspace_utilities'), `${BASE}/utilities`], [title]], main));
   return false;
 }
 
@@ -211,73 +212,73 @@ export async function runCheck(b: Record<string, string | undefined>, stored: Ma
       try {
         secret = decryptSecret(stored.secret_enc);
       } catch (e) {
-        throw new MailError(`The stored secret can't be read: ${(e as Error).message}`, false);
+        throw new MailError(tx('ml.secret_unreadable', { error: (e as Error).message }), false);
       }
     }
     const svc = { name: stored?.name ?? 'new', provider: v.provider, settings: v.settings, workspace_id: workspaceId };
     if (b.check === 'send') {
-      if (!ADDRESS.test(to)) throw new MailError('Give the address to send the test mail to.', false);
-      if (!ADDRESS.test(from) || !senderAllowed(v.senders, from)) throw new MailError('The From address must be one of the allowed senders.', false);
+      if (!ADDRESS.test(to)) throw new MailError(tx('ml.test_to_missing'), false);
+      if (!ADDRESS.test(from) || !senderAllowed(v.senders, from)) throw new MailError(tx('ml.from_not_allowed'), false);
       const pid = await deliver(v.provider, await serviceSettings(svc), secret, {
         from, to: [to], cc: [], bcc: [], replyTo: null, subject: `pgkiln: test of a mail service (${PROVIDER_LABELS[v.provider]})`,
         text: `This is a test of a pgkiln mail service${stored ? ` (${stored.name})` : ''}, sent from the App Builder by ${username}.`, html: null, attachments: [],
       });
-      return { ok: true, text: `The test mail was handed to ${PROVIDER_LABELS[v.provider]}${pid ? ` (its id: ${pid})` : ''}. Check the mailbox of ${to}.` };
+      return { ok: true, text: pid ? tx('ml.test_handed_id', { provider: PROVIDER_LABELS[v.provider], id: pid, to }) : tx('ml.test_handed', { provider: PROVIDER_LABELS[v.provider], to }) };
     }
     return { ok: true, text: await verifyService(svc, secret) };
   } catch (e) {
-    return { ok: false, text: e instanceof MailError || !(e instanceof TypeError) ? (e as Error).message : 'The check failed.' };
+    return { ok: false, text: e instanceof MailError || !(e instanceof TypeError) ? (e as Error).message : tx('ml.the_check_failed') };
   }
 }
 
 export async function mailRoutes(app: FastifyInstance) {
   app.get(`${BASE}/mail`, async (req: Req, reply) => {
     const s = await developer(req, reply);
-    if (!s || !(await adminOnly(s, reply, 'Mail services'))) return;
+    if (!s || !(await adminOnly(s, reply, tx('ml.mail_services')))) return;
     const services = (await owner.query(`select s.id, s.name, s.description, s.provider, s.senders, s.enabled, s.secret_enc is not null as has_secret,
         (select string_agg(a.alias, ', ' order by a.alias) from meta.app_mail_service x join meta.app a on a.id = x.app_id where x.service_id = s.id) as apps,
         (select w.name from meta.workspace w where w.id = s.workspace_id) as workspace
       from meta.mail_service s order by s.workspace_id is not null, s.name`)).rows;
     const recent = (await owner.query(`select ${MAIL_COLUMNS}, a.alias as app from meta.mail_queue q left join meta.app a on a.id = q.app_id order by q.id desc limit 100`)).rows;
     const main = html`
-      <div class="title-row"><h1>Mail services</h1></div>
-      <p class="muted u-mt0">How the applications of this installation send e-mail (<code>meta.send_mail()</code> from SQL, the <b>Send e-mail</b> process, e-mail templates). Mail is queued in the application's transaction and sent by the server after it commits. Choose the service of each application on the service's page.</p>
-      ${region('Services', html`<div class="table-wrap"><table class="report report-reflow">
-          <thead><tr><th>Service</th><th>Provider</th><th>Senders</th><th>Secret</th><th>Applications</th><th>Status</th></tr></thead>
+      <div class="title-row"><h1>${tx('ml.mail_services')}</h1></div>
+      <p class="muted u-mt0">${tx.code('ml.intro', { process: tx('ml.send_e_mail') })}</p>
+      ${region(tx('ml.services'), html`<div class="table-wrap"><table class="report report-reflow">
+          <thead><tr><th>${tx('ml.service')}</th><th>${tx('ml.provider')}</th><th>${tx('ml.senders')}</th><th>${tx('ml.secret')}</th><th>${tx('ml.applications')}</th><th>${tx('ml.status')}</th></tr></thead>
           <tbody>${services.length ? services.map((x) => html`<tr>
-            <td data-label="Service"><a href="${BASE}/mail/${x.id}">${x.name}</a>${x.description ? html` <span class="muted">${x.description}</span>` : ''}</td>
-            <td data-label="Provider">${PROVIDER_LABELS[x.provider as Provider]}</td>
-            <td data-label="Senders" class="u-break">${x.senders.join(', ')}</td>
-            <td data-label="Secret">${x.has_secret ? 'stored (encrypted)' : x.provider === 'log' ? '–' : html`<b>missing</b>`}</td>
-            <td data-label="Applications">${x.workspace ? html`<span class="tag">workspace ${x.workspace}</span> ` : ''}${x.apps ?? (x.workspace ? html`<span class="muted">its applications without a service of their own</span>` : html`<span class="muted">none</span>`)}</td>
-            <td data-label="Status">${x.enabled ? 'enabled' : html`<b>disabled</b>`}</td></tr>`)
-            : html`<tr><td colspan="6" class="empty">No mail services yet.</td></tr>`}</tbody></table></div>`,
-        html`<a class="btn btn-sm btn-hot" href="${BASE}/mail/new">${icon('plus')} Add service</a>`)}
+            <td data-label="${tx('ml.service')}"><a href="${BASE}/mail/${x.id}">${x.name}</a>${x.description ? html` <span class="muted">${x.description}</span>` : ''}</td>
+            <td data-label="${tx('ml.provider')}">${PROVIDER_LABELS[x.provider as Provider]}</td>
+            <td data-label="${tx('ml.senders')}" class="u-break">${x.senders.join(', ')}</td>
+            <td data-label="${tx('ml.secret')}">${x.has_secret ? 'stored (encrypted)' : x.provider === 'log' ? '–' : html`<b>missing</b>`}</td>
+            <td data-label="${tx('ml.applications')}">${x.workspace ? html`<span class="tag">workspace ${x.workspace}</span> ` : ''}${x.apps ?? (x.workspace ? html`<span class="muted">${tx('ml.its_applications_without_a_service')}</span>` : html`<span class="muted">none</span>`)}</td>
+            <td data-label="${tx('ml.status')}">${x.enabled ? 'enabled' : html`<b>disabled</b>`}</td></tr>`)
+            : html`<tr><td colspan="6" class="empty">${tx('ml.no_mail_services_yet')}</td></tr>`}</tbody></table></div>`,
+        html`<a class="btn btn-sm btn-hot" href="${BASE}/mail/new">${icon('plus')} ${tx('ml.add_service')}</a>`)}
       ${await builderMailRegion(s, services)}
-      ${region('Recent mail', mailTable(recent, true))}`;
-    return send(reply, s, shell(s, 'Mail services', [['App Builder', BASE], ['Workspace utilities', `${BASE}/utilities`], ['Mail services']], main));
+      ${region(tx('ml.recent_mail'), mailTable(recent, true))}`;
+    return send(reply, s, shell(s, tx('ml.mail_services'), [[tx('ml.app_builder'), BASE], [tx('ml.workspace_utilities'), `${BASE}/utilities`], [tx('ml.mail_services')]], main));
   });
 
   // (096) the builder's own mail ("Find my workspace"): a service and a From address it may send as
   app.post(`${BASE}/mail/builder`, async (req: Req, reply) => {
     const s = await developer(req, reply);
-    if (!s || !(await adminOnly(s, reply, 'Mail services'))) return;
+    if (!s || !(await adminOnly(s, reply, tx('ml.mail_services')))) return;
     const name = String(req.body?.service ?? '');
     const from = String(req.body?.from ?? '').trim();
     try {
       if (!name) await owner.query(`delete from meta.setting where name in ('builder_mail_service', 'builder_mail_from')`);
       else {
         const svc = await owner.one<{ senders: string[] }>('select senders from meta.mail_service where name = $1', [name]);
-        if (!svc) throw new Error('Choose one of the mail services.');
-        if (!/^[^@\s<>"]+@[^@\s<>"]+$/.test(from)) throw new Error('The From address is an e-mail address, e.g. pgkiln@example.com.');
-        if (!senderAllowed(svc.senders, from)) throw new Error(`The service ${name} may not send as ${from}: add it to its senders first.`);
+        if (!svc) throw new Error(tx('ml.choose_one_of_the_mail'));
+        if (!/^[^@\s<>"]+@[^@\s<>"]+$/.test(from)) throw new Error(tx('ml.the_from_address_is_an'));
+        if (!senderAllowed(svc.senders, from)) throw new Error(tx('ml.may_not_send_as', { name, from }));
         await owner.tx(async (c) => {
           for (const [k, v] of [['builder_mail_service', name], ['builder_mail_from', from]])
             await c.query('insert into meta.setting (name, value) values ($1, $2) on conflict (name) do update set value = excluded.value', [k, v]);
         });
       }
       await logActivity({ appId: null, username: s.username, event: 'mail_service', ip: clientIp(req), detail: name ? `builder mail: ${name} as ${from}` : 'builder mail: none' });
-      flash(s, name ? 'Builder mail saved: "Find my workspace" sends through it.' : 'The builder sends no mail now.');
+      flash(s, name ? tx('ml.builder_mail_saved_find_my') : tx('ml.the_builder_sends_no_mail'));
     } catch (e) {
       flash(s, (e as Error).message, 'error');
     }
@@ -287,29 +288,29 @@ export async function mailRoutes(app: FastifyInstance) {
   // a new service: choose the provider, then its settings only
   app.get(`${BASE}/mail/new`, async (req: Req, reply) => {
     const s = await developer(req, reply);
-    if (!s || !(await adminOnly(s, reply, 'Mail services'))) return;
+    if (!s || !(await adminOnly(s, reply, tx('ml.mail_services')))) return;
     const provider = (PROVIDERS as readonly string[]).includes(String(req.query.provider)) ? (req.query.provider as Provider) : null;
-    const main = html`<div class="title-row"><h1>Add a mail service</h1></div>
+    const main = html`<div class="title-row"><h1>${tx('ml.add_a_mail_service')}</h1></div>
       ${provider
-        ? html`<p class="muted u-mt0">Step 2 of 2: <b>${PROVIDER_LABELS[provider]}</b>. ${PROVIDER_TEXT[provider][1]}</p>
-            <div class="mail-form-page">${region('Settings', serviceForm({}, provider, `${BASE}/mail`, csrf(s), true))}</div>`
-        : html`<p class="muted u-mt0">Step 1 of 2: how should the applications send mail?</p>${providerChoice()}`}`;
-    return send(reply, s, shell(s, 'Add a mail service', [['App Builder', BASE], ['Workspace utilities', `${BASE}/utilities`], ['Mail services', `${BASE}/mail`], ['Add']], main));
+        ? html`<p class="muted u-mt0">Step 2 of 2: <b>${PROVIDER_LABELS[provider]}</b>. ${PROVIDER_TEXT(provider)[1]}</p>
+            <div class="mail-form-page">${region(tx('ml.settings'), serviceForm({}, provider, `${BASE}/mail`, csrf(s), true))}</div>`
+        : html`<p class="muted u-mt0">${tx('ml.step_1_of_2_how')}</p>${providerChoice()}`}`;
+    return send(reply, s, shell(s, tx('ml.add_a_mail_service'), [[tx('ml.app_builder'), BASE], [tx('ml.workspace_utilities'), `${BASE}/utilities`], [tx('ml.mail_services'), `${BASE}/mail`], [tx('ml.add')]], main));
   });
 
   app.post(`${BASE}/mail`, async (req: Req, reply) => {
     const s = await developer(req, reply);
-    if (!s || !(await adminOnly(s, reply, 'Mail services'))) return;
+    if (!s || !(await adminOnly(s, reply, tx('ml.mail_services')))) return;
     const b = req.body ?? {};
     try {
       const name = (b.name ?? '').trim().toUpperCase();
-      if (!/^[A-Z][A-Z0-9_]{0,59}$/.test(name)) throw new Error('The name is upper case letters, digits and _ (e.g. OFFICE365).');
+      if (!/^[A-Z][A-Z0-9_]{0,59}$/.test(name)) throw new Error(tx('ml.the_name_is_upper_case'));
       const v = formValues(b, false);
       const secret = b.secret ? encryptSecret(b.secret) : null;
       const r = await owner.one(
         `insert into meta.mail_service (name, description, provider, settings, senders, enabled, secret_enc) values ($1, $2, $3, $4, $5, $6, $7) returning id`,
         [name, v.description, v.provider, JSON.stringify(v.settings), v.senders, v.enabled, secret]);
-      flash(s, 'Mail service added. Choose the applications that send through it below, and test it.');
+      flash(s, tx('ml.mail_service_added_choose_the'));
       return back(reply, s, `${BASE}/mail/${r.id}`);
     } catch (e) {
       flash(s, (e as Error).message.includes('mail_service_name_key') ? 'A service with this name exists already.' : (e as Error).message, 'error');
@@ -319,7 +320,7 @@ export async function mailRoutes(app: FastifyInstance) {
 
   app.get(`${BASE}/mail/:id(^\\d+$)`, async (req: Req, reply) => {
     const s = await developer(req, reply);
-    if (!s || !(await adminOnly(s, reply, 'Mail services'))) return;
+    if (!s || !(await adminOnly(s, reply, tx('ml.mail_services')))) return;
     const x = await owner.one<MailService & { has_secret: boolean }>(
       'select id, name, description, provider, settings, senders, enabled, workspace_id, secret_enc is not null as has_secret from meta.mail_service where id = $1', [req.params.id]);
     if (!x) return reply.code(404).send('Not found');
@@ -334,34 +335,34 @@ export async function mailRoutes(app: FastifyInstance) {
     const main = html`
       <div class="title-row"><h1 class="mail-name">${x.name}</h1></div>
       <div class="mail-form-page">
-        ${region('Settings', html`
-          <form method="get" class="provider-switch">${select('provider', 'Provider', provider, PROVIDERS.map((p): [string, string] => [p, PROVIDER_LABELS[p]]),
-            provider !== x.provider ? 'Not saved yet: fill in the settings below and save to switch.' : undefined)}<button class="btn btn-sm">Change</button></form>
+        ${region(tx('ml.settings'), html`
+          <form method="get" class="provider-switch">${select('provider', tx('ml.provider'), provider, PROVIDERS.map((p): [string, string] => [p, PROVIDER_LABELS[p]]),
+            provider !== x.provider ? tx('ml.not_saved_yet_fill_in') : undefined)}<button class="btn btn-sm">${tx('ml.change')}</button></form>
           ${serviceForm(x, provider, `${BASE}/mail/${x.id}`, csrf(s), false)}
           <form method="post" action="${BASE}/mail/${x.id}/delete" class="danger-zone">${csrf(s)}
-            <button class="btn btn-danger" data-confirm="Delete mail service ${x.name}? Its applications can't send mail until they get another one.">Delete service</button></form>`)}
+            <button class="btn btn-danger" data-confirm="${tx('ml.delete_confirm', { name: x.name })}">${tx('ml.delete_service')}</button></form>`)}
       </div>
-      ${region('Applications', html`<p class="muted u-mt0">The applications that send through this service (each application has one), their From address (empty: the service's default) and a limit per day (UTC; empty: none). An application with another service shows it.</p>
+      ${region(tx('ml.applications'), html`<p class="muted u-mt0">${tx('ml.the_applications_that_send_through')}</p>
         <form method="post" action="${BASE}/mail/${x.id}/apps">${csrf(s)}
-        <div class="table-wrap"><table class="report report-reflow"><thead><tr><th>Application</th><th>Sends through this service</th><th>From address</th><th>Mails per day</th></tr></thead>
+        <div class="table-wrap"><table class="report report-reflow"><thead><tr><th>${tx('ml.application')}</th><th>${tx('ml.sends_through_this_service')}</th><th>${tx('ml.from_address')}</th><th>${tx('ml.mails_per_day')}</th></tr></thead>
         <tbody>${apps.length ? apps.map((a) => html`<tr>
-          <td data-label="Application">${a.name} <span class="muted">${a.alias}</span></td>
-          <td data-label="Sends through this service"><label class="check"><input type="checkbox" name="allow" value="${a.id}"${a.service_id === x.id ? raw(' checked') : ''}> yes</label>${a.other ? html` <span class="muted">now: ${a.other}</span>` : ''}</td>
-          <td data-label="From address"><input type="email" name="from_${a.id}" value="${a.service_id === x.id ? a.from_address ?? '' : ''}" aria-label="From address for ${a.alias}"></td>
-          <td data-label="Mails per day"><input type="number" min="0" name="max_${a.id}" value="${a.service_id === x.id ? a.max_per_day ?? '' : ''}" aria-label="Mails per day for ${a.alias}"></td></tr>`)
-          : html`<tr><td colspan="4" class="empty">No applications.</td></tr>`}</tbody></table></div>
-        <div class="buttons"><button class="btn btn-hot">Save</button></div></form>`)}
-      ${region('Recent mail', mailTable(recent, true))}`;
-    return send(reply, s, shell(s, x.name, [['App Builder', BASE], ['Workspace utilities', `${BASE}/utilities`], ['Mail services', `${BASE}/mail`], [x.name]], main));
+          <td data-label="${tx('ml.application')}">${a.name} <span class="muted">${a.alias}</span></td>
+          <td data-label="${tx('ml.sends_through_this_service')}"><label class="check"><input type="checkbox" name="allow" value="${a.id}"${a.service_id === x.id ? raw(' checked') : ''}> yes</label>${a.other ? html` <span class="muted">now: ${a.other}</span>` : ''}</td>
+          <td data-label="${tx('ml.from_address')}"><input type="email" name="from_${a.id}" value="${a.service_id === x.id ? a.from_address ?? '' : ''}" aria-label="${tx('ml.aria_from', { app: a.alias })}"></td>
+          <td data-label="${tx('ml.mails_per_day')}"><input type="number" min="0" name="max_${a.id}" value="${a.service_id === x.id ? a.max_per_day ?? '' : ''}" aria-label="${tx('ml.aria_max', { app: a.alias })}"></td></tr>`)
+          : html`<tr><td colspan="4" class="empty">${tx('ml.no_applications')}</td></tr>`}</tbody></table></div>
+        <div class="buttons"><button class="btn btn-hot">${tx('ml.save')}</button></div></form>`)}
+      ${region(tx('ml.recent_mail'), mailTable(recent, true))}`;
+    return send(reply, s, shell(s, x.name, [[tx('ml.app_builder'), BASE], [tx('ml.workspace_utilities'), `${BASE}/utilities`], [tx('ml.mail_services'), `${BASE}/mail`], [x.name]], main));
   });
 
   app.post(`${BASE}/mail/:id(^\\d+$)`, async (req: Req, reply) => {
     const s = await developer(req, reply);
-    if (!s || !(await adminOnly(s, reply, 'Mail services'))) return;
+    if (!s || !(await adminOnly(s, reply, tx('ml.mail_services')))) return;
     const b = req.body ?? {};
     try {
       const old = await owner.one<{ has_secret: boolean }>('select secret_enc is not null as has_secret from meta.mail_service where id = $1', [req.params.id]);
-      if (!old) throw new Error('Not found.');
+      if (!old) throw new Error(tx('ml.not_found'));
       const v = formValues(b, old.has_secret && b.remove_secret !== 'true');
       const secret = b.secret ? encryptSecret(b.secret) : null;
       await owner.query(
@@ -369,7 +370,7 @@ export async function mailRoutes(app: FastifyInstance) {
                 secret_enc = case when $8 then null when $7::text is null then secret_enc else $7 end
           where id = $1`,
         [req.params.id, v.description, v.provider, JSON.stringify(v.settings), v.senders, v.enabled, secret, b.remove_secret === 'true' && !b.secret]);
-      flash(s, 'Mail service saved.');
+      flash(s, tx('ml.mail_service_saved'));
     } catch (e) {
       flash(s, (e as Error).message, 'error');
     }
@@ -378,12 +379,12 @@ export async function mailRoutes(app: FastifyInstance) {
 
   app.post(`${BASE}/mail/:id(^\\d+$)/apps`, async (req: Req, reply) => {
     const s = await developer(req, reply);
-    if (!s || !(await adminOnly(s, reply, 'Mail services'))) return;
+    if (!s || !(await adminOnly(s, reply, tx('ml.mail_services')))) return;
     const b = req.body as Record<string, string | string[] | undefined>;
     const allow = new Set([b.allow ?? []].flat().map(Number).filter(Number.isInteger));
     try {
       const service = await owner.one<{ senders: string[]; workspace_id: number | null }>('select senders, workspace_id from meta.mail_service where id = $1', [req.params.id]);
-      if (!service) throw new Error('Not found.');
+      if (!service) throw new Error(tx('ml.not_found'));
       await owner.tx(async (c) => {
         // (sprint 118) a workspace's own service: that workspace's applications only
         const apps = (await c.query<{ id: number }>('select id from meta.app where $1::int is null or meta.app_workspace(id) = $1', [service.workspace_id])).rows.map((a) => a.id);
@@ -392,14 +393,14 @@ export async function mailRoutes(app: FastifyInstance) {
           const from = String(b[`from_${id}`] ?? '').trim() || null;
           if (from && (!ADDRESS.test(from) || !senderAllowed(service.senders, from))) throw new Error(`${from} is not an address this service may send as.`);
           const max = String(b[`max_${id}`] ?? '').trim();
-          if (max && !(Number.isInteger(Number(max)) && Number(max) >= 0)) throw new Error('Mails per day: a whole number of 0 or more (empty: no limit).');
+          if (max && !(Number.isInteger(Number(max)) && Number(max) >= 0)) throw new Error(tx('ml.mails_per_day_a_whole'));
           await c.query(
             `insert into meta.app_mail_service (app_id, service_id, from_address, max_per_day) values ($1, $2, $3, $4)
              on conflict (app_id) do update set service_id = excluded.service_id, from_address = excluded.from_address, max_per_day = excluded.max_per_day`,
             [id, req.params.id, from, max ? Number(max) : null]);
         }
       });
-      flash(s, 'Applications saved.');
+      flash(s, tx('ml.applications_saved'));
     } catch (e) {
       flash(s, (e as Error).message, 'error');
     }
@@ -410,7 +411,7 @@ export async function mailRoutes(app: FastifyInstance) {
   // JSON for builder.js; without JavaScript the form comes back with its values (the secret must be typed again).
   app.post(`${BASE}/mail/check`, async (req: Req, reply) => {
     const s = await developer(req, reply);
-    if (!s || !(await adminOnly(s, reply, 'Mail services'))) return;
+    if (!s || !(await adminOnly(s, reply, tx('ml.mail_services')))) return;
     const b = (req.body ?? {}) as Record<string, string | undefined>;
     const id = /^\d{1,9}$/.test(b.service_id ?? '') ? Number(b.service_id) : null;
     const stored = id ? await owner.one<MailService>('select * from meta.mail_service where id = $1', [id]) : null;
@@ -423,16 +424,16 @@ export async function mailRoutes(app: FastifyInstance) {
     if (String(req.headers.accept ?? '').includes('application/json')) return reply.header('cache-control', 'no-store').send(result);
     const x = { id: stored?.id, name: stored?.name, description: typed.description, provider: typed.provider, settings: typed.settings, senders: typed.senders, enabled: typed.enabled,
       has_secret: !!(stored?.secret_enc && stored.provider === typed.provider) };
-    const main = html`<div class="title-row"><h1>${stored ? stored.name : 'Add a mail service'}</h1></div>
-      <div class="mail-form-page">${region('Settings', serviceForm(x, typed.provider, stored ? `${BASE}/mail/${stored.id}` : `${BASE}/mail`, csrf(s), !stored, { ...result, to, from }))}</div>`;
-    return send(reply, s, shell(s, 'Mail service', [['App Builder', BASE], ['Workspace utilities', `${BASE}/utilities`], ['Mail services', `${BASE}/mail`], [stored?.name ?? 'Add']], main));
+    const main = html`<div class="title-row"><h1>${stored ? stored.name : tx('ml.add_a_mail_service')}</h1></div>
+      <div class="mail-form-page">${region(tx('ml.settings'), serviceForm(x, typed.provider, stored ? `${BASE}/mail/${stored.id}` : `${BASE}/mail`, csrf(s), !stored, { ...result, to, from }))}</div>`;
+    return send(reply, s, shell(s, tx('ml.mail_service'), [[tx('ml.app_builder'), BASE], [tx('ml.workspace_utilities'), `${BASE}/utilities`], [tx('ml.mail_services'), `${BASE}/mail`], [stored?.name ?? tx('ml.add')]], main));
   });
 
   app.post(`${BASE}/mail/:id(^\\d+$)/delete`, async (req: Req, reply) => {
     const s = await developer(req, reply);
-    if (!s || !(await adminOnly(s, reply, 'Mail services'))) return;
+    if (!s || !(await adminOnly(s, reply, tx('ml.mail_services')))) return;
     await owner.query('delete from meta.mail_service where id = $1', [req.params.id]);
-    flash(s, 'Mail service deleted.');
+    flash(s, tx('ml.mail_service_deleted'));
     return back(reply, s, `${BASE}/mail`);
   });
 
@@ -450,16 +451,16 @@ export async function mailRoutes(app: FastifyInstance) {
     const rows = (await owner.query(`select ${MAIL_COLUMNS} from meta.mail_queue q where q.app_id = $1 and ($2 = '' or q.status = $2) order by q.id desc limit 200`, [a.id, status])).rows;
     const admin = await isAdmin(s.username);
     const action = (m: any) => m.status === 'error' || m.status === 'cancelled'
-      ? html`<form method="post" action="${BASE}/apps/${a.id}/mail/${m.id}/retry">${csrf(s)}<button class="btn btn-sm">Send again</button></form>`
-      : m.status === 'queued' ? html`<form method="post" action="${BASE}/apps/${a.id}/mail/${m.id}/cancel">${csrf(s)}<button class="btn btn-sm">Cancel</button></form>` : '';
+      ? html`<form method="post" action="${BASE}/apps/${a.id}/mail/${m.id}/retry">${csrf(s)}<button class="btn btn-sm">${tx('ml.send_again')}</button></form>`
+      : m.status === 'queued' ? html`<form method="post" action="${BASE}/apps/${a.id}/mail/${m.id}/cancel">${csrf(s)}<button class="btn btn-sm">${tx('ml.cancel')}</button></form>` : '';
     const main = html`
       <div class="title-row"><h1 class="mail-name">Mail · ${a.name}</h1></div>
-      <p class="muted u-mt0">The mail this application queued (<code>meta.send_mail()</code>, the Send e-mail process), kept 30 days. ${service
-        ? html`It sends through <b>${service.name}</b> (${PROVIDER_LABELS[service.provider as Provider]}${service.enabled ? '' : ', disabled'}) as ${service.from_address ?? service.default_from ?? html`<i>no From address</i>`}; today: ${today}${service.max_per_day !== null ? ` of ${service.max_per_day}` : ''}.`
-        : html`<b>It may not send mail yet</b>: an administrator chooses its mail service${admin ? html` under <a href="${BASE}/mail">Mail services</a>` : ''}.`}</p>
-      <form method="get" class="u-mb1">${select('status', 'Status', status, [['', 'All'], ['queued', 'Queued'], ['sending', 'Sending'], ['sent', 'Sent'], ['error', 'Error'], ['cancelled', 'Cancelled']])}<button class="btn btn-sm">Show</button></form>
-      ${region('Mail', mailTable(rows, false, action))}`;
-    return send(reply, s, shell(s, `Mail · ${a.name}`, [['App Builder', BASE], [a.name, `${BASE}/apps/${a.id}`], ['Activity', `${BASE}/apps/${a.id}/activity`], ['Mail']], main));
+      <p class="muted u-mt0">${tx.code('ml.queue_intro')} ${service
+        ? tx.rich(service.max_per_day !== null ? 'ml.sends_through_max' : 'ml.sends_through', { service: html`<b>${service.name}</b>`, provider: `${PROVIDER_LABELS[service.provider as Provider]}${service.enabled ? '' : `, ${tx('ml.disabled_l')}`}`, from: service.from_address ?? service.default_from ?? html`<i>${tx('ml.no_from_address')}</i>`, today, max: service.max_per_day ?? '' })
+        : admin ? tx.rich('ml.no_service_admin', { none: html`<b>${tx('ml.it_may_not_send_mail')}</b>`, link: html`<a href="${BASE}/mail">${tx('ml.mail_services')}</a>` }) : tx.rich('ml.no_service', { none: html`<b>${tx('ml.it_may_not_send_mail')}</b>` })}</p>
+      <form method="get" class="u-mb1">${select('status', tx('ml.status'), status, [['', tx('ml.all')], ['queued', tx('ml.queued')], ['sending', tx('ml.sending')], ['sent', tx('ml.sent')], ['error', tx('ml.error')], ['cancelled', tx('ml.cancelled')]])}<button class="btn btn-sm">${tx('ml.show')}</button></form>
+      ${region(tx('ml.mail'), mailTable(rows, false, action))}`;
+    return send(reply, s, shell(s, tx('ml.mail_of', { app: a.name }), [[tx('ml.app_builder'), BASE], [a.name, `${BASE}/apps/${a.id}`], [tx('ml.activity'), `${BASE}/apps/${a.id}/activity`], [tx('ml.mail')]], main));
   });
 
   const change = (to: 'queued' | 'cancelled', from: string[]) => async (req: Req, reply: any) => {
@@ -471,7 +472,7 @@ export async function mailRoutes(app: FastifyInstance) {
         where id = $1 and app_id = $2 and status = any($5::text[])`,
       [req.params.mid, req.params.id, to, s.username, from]);
     if (r.rowCount && to === 'queued') await owner.query(`select pg_notify('pgkiln_mail', $1)`, [String(req.params.mid)]);
-    flash(s, r.rowCount ? (to === 'queued' ? 'The mail is queued again.' : 'The mail is cancelled.') : 'The mail has changed meanwhile.', r.rowCount ? 'ok' : 'error');
+    flash(s, r.rowCount ? (to === 'queued' ? tx('ml.the_mail_is_queued_again') : tx('ml.the_mail_is_cancelled')) : tx('ml.the_mail_has_changed_meanwhile'), r.rowCount ? 'ok' : 'error');
     return back(reply, s, `${BASE}/apps/${req.params.id}/mail`);
   };
   app.post(`${BASE}/apps/:id(^\\d+$)/mail/:mid(^\\d+$)/retry`, change('queued', ['error', 'cancelled']));
@@ -481,11 +482,11 @@ export async function mailRoutes(app: FastifyInstance) {
 /** (096) Mail services → Builder mail: the service and From address of the builder's own mail. */
 async function builderMailRegion(s: Session, services: { name: string; enabled: boolean }[]) {
   const set = Object.fromEntries((await owner.query<{ name: string; value: string }>(`select name, value from meta.setting where name in ('builder_mail_service', 'builder_mail_from')`)).rows.map((r) => [r.name, r.value]));
-  return region('Builder mail', html`<form method="post" action="${BASE}/mail/builder">${csrf(s)}
-    <p class="muted u-mt0">The service the builder itself sends through: <b>Find my workspace</b> on the sign-in page mails developers their workspaces (to the address on their account). None: the builder sends no mail.</p>
+  return region(tx('ml.builder_mail'), html`<form method="post" action="${BASE}/mail/builder">${csrf(s)}
+    <p class="muted u-mt0">${tx.rich('ml.builder_intro', { find: html`<b>${tx('ml.find_my_workspace')}</b>` })}</p>
     <div class="form-grid">
-      ${select('service', 'Service', set.builder_mail_service ?? '', [['', 'None'], ...services.map((x) => [x.name, `${x.name}${x.enabled ? '' : ' (disabled)'}`] as [string, string])])}
-      ${input('from', 'From address', set.builder_mail_from ?? '', { type: 'email', placeholder: 'pgkiln@example.com', help: 'One of the service\'s senders.' })}
+      ${select('service', tx('ml.service'), set.builder_mail_service ?? '', [['', tx('ml.none')], ...services.map((x) => [x.name, `${x.name}${x.enabled ? '' : ' (disabled)'}`] as [string, string])])}
+      ${input('from', tx('ml.from_address'), set.builder_mail_from ?? '', { type: 'email', placeholder: tx('ml.pgkiln_example_com'), help: tx('ml.one_of_the_service_s') })}
     </div>
-    <div class="buttons"><button class="btn">Save</button></div></form>`, '', 'builder-mail');
+    <div class="buttons"><button class="btn">${tx('ml.save')}</button></div></form>`, '', 'builder-mail');
 }