{
  "common.activating": "Activating...",
  "common.add": "Add",
  "common.back": "Back",
  "common.cancel": "Cancel",
  "common.copied": "Copied to clipboard",
  "common.copy": "Copy",
  "common.create": "Create",
  "common.creating": "Creating...",
  "common.delete": "Delete",
  "common.disabled": "Disabled",
  "common.dismiss": "Dismiss",
  "common.edit": "Edit",
  "common.enabled": "Enabled",
  "common.loading": "Loading...",
  "common.next": "Next",
  "common.notFound": "Not found",
  "common.remove": "Remove",
  "common.save": "Save",
  "common.saving": "Saving...",
  "settings.sections.auth": "Auth",
  "sso.admin.action.activate": "Activate",
  "sso.admin.action.deactivate": "Deactivate",
  "sso.admin.action.test": "Verify Discovery",
  "sso.admin.activated": "SSO configuration activated",
  "sso.admin.activity.empty": "No SSO login activity yet. Activity will appear here once users start logging in via SSO.",
  "sso.admin.backToList": "Back to SSO configurations",
  "sso.admin.banner.activateNow": "Activate Now",
  "sso.admin.banner.created": "Your SSO configuration has been created. Would you like to activate it now?",
  "sso.admin.banner.notYet": "Not Yet",
  "sso.admin.column.created": "Created",
  "sso.admin.column.domains": "Domains",
  "sso.admin.column.name": "Name",
  "sso.admin.column.protocol": "Protocol",
  "sso.admin.column.status": "Status",
  "sso.admin.create.title": "Configure SSO",
  "sso.admin.created": "SSO configuration created",
  "sso.admin.deactivated": "SSO configuration deactivated",
  "sso.admin.delete.confirm": "Are you sure? This will remove the SSO configuration. Users with linked SSO identities will need to use password login.",
  "sso.admin.delete.success": "SSO configuration deleted",
  "sso.admin.delete.title": "Delete SSO Configuration",
  "sso.admin.detail.backToList": "Back to SSO",
  "sso.admin.detail.title": "SSO Configuration",
  "sso.admin.domains.empty": "No domains configured. Add at least one domain before activating SSO.",
  "sso.admin.empty.cta": "Configure SSO",
  "sso.admin.empty.description": "Configure Single Sign-On to let your users authenticate with your identity provider.",
  "sso.admin.empty.title": "No SSO configured",
  "sso.admin.error.activationFailed": "Failed to update activation status",
  "sso.admin.error.alreadyExists": "An SSO configuration already exists for this organization",
  "sso.admin.error.createFailed": "Failed to create SSO configuration",
  "sso.admin.error.deleteActive": "Cannot delete an active SSO configuration — deactivate it first",
  "sso.admin.error.deleteFailed": "Failed to delete SSO configuration",
  "sso.admin.error.domainAddFailed": "Failed to add domain",
  "sso.admin.error.domainRemoveFailed": "Failed to remove domain",
  "sso.admin.error.loadFailed": "Failed to load SSO configuration",
  "sso.admin.error.noDomainsForActivation": "Add at least one allowed email domain before activating",
  "sso.admin.error.notFound": "SSO configuration not found.",
  "sso.admin.error.saveFailed": "Failed to save SSO configuration",
  "sso.admin.error.testFailed": "Connection test failed",
  "sso.admin.field.autoLinkByEmail": "Auto-link by Email",
  "sso.admin.field.autoLinkByEmailDesc": "Automatically link existing users by matching email address",
  "sso.admin.field.changeSecret": "Change",
  "sso.admin.field.clientId": "Client ID",
  "sso.admin.field.clientSecret": "Client Secret",
  "sso.admin.field.issuer": "Issuer URL",
  "sso.admin.field.jitDisabledByScim": "Unavailable — SCIM directory sync is active. Revoke SCIM tokens to enable JIT.",
  "sso.admin.field.jitEnabled": "Just-in-Time Provisioning",
  "sso.admin.field.jitEnabledDesc": "Automatically create user accounts on first SSO login",
  "sso.admin.field.name": "Configuration Name",
  "sso.admin.field.protocol": "Protocol",
  "sso.admin.field.secretPlaceholder": "Enter new secret to replace existing",
  "sso.admin.field.secretRequired": "Enter client secret",
  "sso.admin.field.secretSet": "Client secret is configured",
  "sso.admin.new": "New SSO Config",
  "sso.admin.roles.description": "Map IdP app role names to local roles. Only explicitly mapped IdP roles grant local roles; on each SSO login, SSO-sourced roles are synced while manually-assigned roles are preserved.",
  "sso.admin.roles.empty": "No role mappings configured. Users will not receive SSO-sourced roles until an IdP role is explicitly mapped to a local role.",
  "sso.admin.roles.error.duplicate": "This IdP role is already mapped",
  "sso.admin.roles.error.emptyIdpRole": "IdP role name is required",
  "sso.admin.roles.error.emptyLocalRole": "Select a local role",
  "sso.admin.roles.error.saveFailed": "Failed to save role mappings",
  "sso.admin.roles.idpRole": "IdP Role Name",
  "sso.admin.roles.idpRolePlaceholder": "e.g. OpenMercato.Admin",
  "sso.admin.roles.localRole": "Local Role",
  "sso.admin.roles.saved": "Role mappings saved",
  "sso.admin.saved": "SSO configuration saved",
  "sso.admin.scim.endpointCopied": "SCIM endpoint URL copied",
  "sso.admin.scim.endpointUrl": "SCIM Endpoint URL",
  "sso.admin.scim.error.createFailed": "Failed to create SCIM token",
  "sso.admin.scim.error.revokeFailed": "Failed to revoke token",
  "sso.admin.scim.generateToken": "Generate Token",
  "sso.admin.scim.googleNotSupported": "Google Workspace does not support SCIM provisioning. Users are provisioned via Just-In-Time (JIT) on first login.",
  "sso.admin.scim.jitActiveWarning": "SCIM provisioning is unavailable while JIT provisioning is enabled. Disable JIT in the General tab to configure SCIM.",
  "sso.admin.scim.log.error": "Error",
  "sso.admin.scim.log.operation": "Operation",
  "sso.admin.scim.log.resource": "Resource",
  "sso.admin.scim.log.status": "Status",
  "sso.admin.scim.log.time": "Time",
  "sso.admin.scim.noTokens": "SCIM provisioning is not configured. Generate a bearer token to enable your identity provider to sync users automatically.",
  "sso.admin.scim.recentActivity": "Recent Provisioning Activity",
  "sso.admin.scim.revoke.action": "Revoke",
  "sso.admin.scim.revoke.confirm": "Are you sure? This token will no longer authenticate SCIM requests.",
  "sso.admin.scim.revoke.title": "Revoke Token",
  "sso.admin.scim.revoked": "Token revoked",
  "sso.admin.scim.tokenActive": "Active",
  "sso.admin.scim.tokenCopied": "Token copied to clipboard",
  "sso.admin.scim.tokenCreated": "Your SCIM token has been created. Copy it now — it will not be shown again.",
  "sso.admin.scim.tokenNamePlaceholder": "Token name (e.g., Entra ID Production)",
  "sso.admin.scim.tokenRevoked": "Revoked",
  "sso.admin.scim.tokens": "Bearer Tokens",
  "sso.admin.search": "Search by name or issuer...",
  "sso.admin.section.allowedDomains": "Allowed Domains",
  "sso.admin.section.oidcSettings": "OIDC Settings",
  "sso.admin.status.active": "Active",
  "sso.admin.status.inactive": "Inactive",
  "sso.admin.tab.activity": "Activity",
  "sso.admin.tab.domains": "Domains",
  "sso.admin.tab.general": "General",
  "sso.admin.tab.roles": "Role Mappings",
  "sso.admin.tab.scim": "Provisioning",
  "sso.admin.test.failed": "Discovery failed",
  "sso.admin.test.success": "Discovery successful — issuer is reachable",
  "sso.admin.title": "Single Sign-On",
  "sso.admin.wizard.credentials.callbackUrl": "Redirect URI (copy to your IdP)",
  "sso.admin.wizard.credentials.namePlaceholder": "e.g., Zitadel Production",
  "sso.admin.wizard.credentials.title": "OIDC Credentials",
  "sso.admin.wizard.domain.duplicate": "Domain already added",
  "sso.admin.wizard.domain.invalid": "Invalid domain format",
  "sso.admin.wizard.domain.limit": "Maximum 20 domains per configuration",
  "sso.admin.wizard.domains.description": "Users with email addresses matching these domains will be redirected to your SSO provider.",
  "sso.admin.wizard.domains.placeholder": "example.com",
  "sso.admin.wizard.domains.title": "Allowed Email Domains",
  "sso.admin.wizard.options.title": "Options",
  "sso.admin.wizard.protocol.oidcDesc": "Works with Zitadel, Microsoft Entra ID, Google Workspace, Okta, and more",
  "sso.admin.wizard.protocol.samlDesc": "Coming soon",
  "sso.admin.wizard.protocol.title": "Select Protocol",
  "sso.admin.wizard.review.note": "The configuration will be created as inactive. You can activate it from the detail page after verifying everything is correct.",
  "sso.admin.wizard.review.save": "Create Configuration",
  "sso.admin.wizard.review.testing": "Testing...",
  "sso.admin.wizard.review.title": "Review & Save",
  "sso.login.continueWithSso": "Continue with SSO",
  "sso.login.errors.emailNotVerified": "Your email address is not verified by the identity provider. Please verify your email and try again.",
  "sso.login.errors.failed": "SSO login failed. Please try again.",
  "sso.login.errors.idpError": "The identity provider returned an error. Please try again or contact your administrator.",
  "sso.login.errors.missingConfig": "SSO is not configured for this account.",
  "sso.login.errors.missingParams": "SSO callback was incomplete. Please try again.",
  "sso.login.errors.stateMissing": "SSO session expired. Please try again.",
  "sso.login.ssoEnabled": "SSO is enabled for this account"
}