@camstack/system 1.2.436 → 1.2.438

package/dist/index.mjs

@@ -1,6 +1,6 @@
 import { i as __require } from "./chunk-CNf5ZN-e.mjs";
-import { $ as addonSettingsCapability, $r as parseJsonObject, $t as isObjectInput, Bn as scopesAllowDeviceCap, Br as emitDownForOwnedCaps, Cr as DEVICE_SETTINGS_CONTRIBUTION_METHODS, Dr as ReadinessRegistry, En as procedureAuthKey, Er as RUNTIME_DEFAULTS, F as LOG_LEVEL_RANK, Hr as expandCapMethods, Ht as extractNestedAddonId, In as resolveMethodAuth, L as METHOD_ACCESS_MAP, Lr as createEvent$1, Mr as asNumber, Nr as asString$1, Or as ReadinessTimeoutError, Sr as DATAPLANE_SECRET_HEADER$1, Xt as isCollectionArrayMethod, Yt as isArrayOutputSchema, Zn as supportedRuntimes, ai as scopeKey, bn as objectInputDeclaresAddonId, br as errMsg$1, di as EventCategory$1, dn as looseSchema, ei as parseJsonUnknown, en as isVoidInput, jr as asJsonObject$1, n as AGENT_MDNS_TXT_KEYS, ni as readinessKey, on as lifecycleJobSchema, r as ALL_CAPABILITY_DEFINITIONS, ri as resolveCapMount, t as AGENT_MDNS_SERVICE_TYPE, tn as kebabToCamel$1, un as logLevelAtMost, wr as DEVICE_STATUS_METHOD, xn as objectInputDeclaresRequiredDeviceId, zn as scopesAllowAddon } from "./dist-DjD2M79P.mjs";
-import { d as JWT_SIGNING_KEY_REF, f as JwtSigningKeyUnavailableError, g as processJwtSigningKey, i as generateDeviceCa, l as verifyDeviceLeaf, m as getProcessJwtSigningKeyState, n as DEVICE_CA_KEY_REF, o as issueDeviceLeaf, p as SYSTEM_SECRET_OWNER, s as loadDeviceCa, u as verifyDeviceSignature, v as staticJwtSigningKey } from "./device-ca-BNM5ai4t.mjs";
+import { Ar as DEVICE_SETTINGS_CONTRIBUTION_METHODS, B as METHOD_ACCESS_MAP, Br as asString$1, Dr as errMsg$1, En as objectInputDeclaresRequiredDeviceId, Fr as ReadinessTimeoutError, Gn as scopesAllowDeviceCap, Kt as extractNestedAddonId, Nr as RUNTIME_DEFAULTS, Pr as ReadinessRegistry, Qt as interpolate, R as LOG_LEVEL_RANK, Rr as asJsonObject$1, Tn as objectInputDeclaresAddonId, Vn as resolveMethodAuth, Wn as scopesAllowAddon, Wr as createEvent$1, Yr as expandCapMethods, Zn as splitTranslationRef, _ as CatalogFileSchema, an as isVoidInput, d as CATALOG_LANGS, dn as lifecycleJobSchema, en as isArrayOutputSchema, fi as scopeKey, gn as looseSchema, hn as logLevelAtMost, in as isObjectInput, ir as supportedRuntimes, jn as procedureAuthKey, jr as DEVICE_STATUS_METHOD, kr as DATAPLANE_SECRET_HEADER$1, li as readinessKey, n as AGENT_MDNS_TXT_KEYS, oi as parseJsonObject, on as kebabToCamel$1, qr as emitDownForOwnedCaps, r as ALL_CAPABILITY_DEFINITIONS, rt as addonSettingsCapability, si as parseJsonUnknown, t as AGENT_MDNS_SERVICE_TYPE, tn as isCollectionArrayMethod, ui as resolveCapMount, vi as userError, yi as EventCategory$1, zr as asNumber } from "./dist-Dc8GKC5H.mjs";
+import { d as JWT_SIGNING_KEY_REF, f as JwtSigningKeyUnavailableError, g as processJwtSigningKey, i as generateDeviceCa, l as verifyDeviceLeaf, m as getProcessJwtSigningKeyState, n as DEVICE_CA_KEY_REF, o as issueDeviceLeaf, p as SYSTEM_SECRET_OWNER, s as loadDeviceCa, u as verifyDeviceSignature, v as staticJwtSigningKey } from "./device-ca-DvIZjXIl.mjs";
 import { AlertCenterAddon } from "./builtins/alerts/alerts.addon.mjs";
 import "./builtins/alerts/index.mjs";
 import { CalendarsAddon } from "./builtins/calendars/calendars.addon.mjs";
@@ -16,26 +16,26 @@ import "./builtins/device-manager/index.mjs";
 import { HubForwarderAddon, HubForwarderDestination } from "./builtins/hub-forwarder/index.mjs";
 import { LivenessMonitorAddon } from "./builtins/liveness-monitor/liveness-monitor.addon.mjs";
 import "./builtins/liveness-monitor/index.mjs";
-import { LocalAuthAddon, _ as AuthManager, a as attachUserManagementInternal, b as isSettingsReadUnavailable, c as DeviceCredentialManager, d as ADMIN_TOKEN_MAX_LIFETIME_MS, f as ADMIN_TOKEN_PREFIX, g as ScopedTokenManager, h as REFRESH_TOKEN_PREFIX, i as USER_MANAGEMENT_INTERNAL, l as PREVIOUS_LEAF_GRACE_MS, m as LoginSessionManager, n as FIRST_BOOT_ADMIN_USERNAME, o as getUserManagementInternal, p as AdminTokenManager, r as UserManager, s as AuthAuditLog, t as FIRST_BOOT_ADMIN_PASSWORD, u as DeviceCaStore, v as parseTokenExpiry, x as ApiKeyManager, y as SettingsReadUnavailableError } from "./builtins/local-auth/local-auth.addon.mjs";
+import { LocalAuthAddon, S as ApiKeyManager, _ as ScopedTokenManager, a as attachUserManagementInternal, b as SettingsReadUnavailableError, c as DeviceCredentialManager, d as ADMIN_TOKEN_MAX_LIFETIME_MS, f as ADMIN_TOKEN_PREFIX, g as onSessionsRevoked, h as REFRESH_TOKEN_PREFIX, i as USER_MANAGEMENT_INTERNAL, l as PREVIOUS_LEAF_GRACE_MS, m as LoginSessionManager, n as FIRST_BOOT_ADMIN_USERNAME, o as getUserManagementInternal, p as AdminTokenManager, r as UserManager, s as AuthAuditLog, t as FIRST_BOOT_ADMIN_PASSWORD, u as DeviceCaStore, v as AuthManager, x as isSettingsReadUnavailable, y as parseTokenExpiry } from "./builtins/local-auth/local-auth.addon.mjs";
 import "./builtins/local-auth/index.mjs";
 import { LokiDestination, LokiLoggingAddon } from "./builtins/loki-logging/index.mjs";
 import NativeMetricsAddon, { a as NativeMetricsProvider, n as nodeProcReader, r as parseProcStat } from "./builtins/native-metrics/native-metrics.addon.mjs";
 import { FilesystemStorageAddon, t as FilesystemStorageProvider } from "./builtins/sqlite-storage/filesystem-storage.addon.mjs";
-import { c as SqliteSettingsBackend, l as prefixRange } from "./wal-maintenance-CaDsrJM_.mjs";
+import { c as SqliteSettingsBackend, l as prefixRange } from "./wal-maintenance-Bx3lcVA7.mjs";
 import { SqliteSettingsAddon } from "./builtins/sqlite-storage/sqlite-settings.addon.mjs";
 import { ConfigStore, DeviceStore } from "./builtins/sqlite-storage/index.mjs";
 import { StorageOrchestratorAddon, a as stripForwardedCaller, i as createHubCapForwardService, n as HUB_CAP_FWD_ACTION, o as buildStorageLocationRegistry, r as HUB_CAP_FWD_SERVICE, t as StorageOrchestratorService } from "./builtins/storage-orchestrator/storage-orchestrator.addon.mjs";
 import "./builtins/storage-orchestrator/index.mjs";
-import { A as AgentHttpsNames, C as LEAF_RENEWAL_WINDOW_DAYS, E as evaluateExistingCert, M as setProcessAgentHttpsNames, O as AGENT_HTTPS_NAMES_COLLECTION, S as CA_VALIDITY_DAYS, T as SERVER_AUTH_OID, a as collectAgentNames, b as collectCertIdentity, c as installAgentHttps, d as isPrivateAddress, f as issueAgentHttpsLeaf, g as CA_COMMON_NAME, h as pinnedHttpsCaFingerprint, i as certificateNames, j as getProcessAgentHttpsNames, k as AGENT_HTTPS_NAMES_COLUMNS, l as isContainerBridgeAddress, m as pemDigest, n as acceptAgentSans, o as createAgentHttpsRequest, p as loadAgentHttps, r as agentHttpsPaths, s as describeHttpsLeaf, t as AgentHttpsInstallError, u as isLocalOnlyHostname, w as MAX_LEAF_VALIDITY_DAYS, x as systemHostFacts } from "./agent-https-B8lKYVtU.mjs";
-import { a as MESH_CA_KEY_REF, i as MESH_CA_FIELD, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY } from "./constants-BFpowodq.mjs";
+import { A as AgentHttpsNames, C as LEAF_RENEWAL_WINDOW_DAYS, E as evaluateExistingCert, M as setProcessAgentHttpsNames, O as AGENT_HTTPS_NAMES_COLLECTION, S as CA_VALIDITY_DAYS, T as SERVER_AUTH_OID, a as collectAgentNames, b as collectCertIdentity, c as installAgentHttps, d as isPrivateAddress, f as issueAgentHttpsLeaf, g as CA_COMMON_NAME, h as pinnedHttpsCaFingerprint, i as certificateNames, j as getProcessAgentHttpsNames, k as AGENT_HTTPS_NAMES_COLUMNS, l as isContainerBridgeAddress, m as pemDigest, n as acceptAgentSans, o as createAgentHttpsRequest, p as loadAgentHttps, r as agentHttpsPaths, s as describeHttpsLeaf, t as AgentHttpsInstallError, u as isLocalOnlyHostname, w as MAX_LEAF_VALIDITY_DAYS, x as systemHostFacts } from "./agent-https-BPfHrI4c.mjs";
+import { a as MESH_CA_KEY_REF, i as MESH_CA_FIELD, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY } from "./constants-DQK705Sb.mjs";
 import { $ as generateMeshKeyPair, A as setProcessMeshPeerTransportLookup, B as describeMeshLeaf, C as setProcessMeshTlsEnabler, D as getProcessPeerLeaf, E as getProcessNodeMeshTransport, F as setProcessMeshTlsListenerState, G as MeshCaKeeper, H as setProcessMeshCertificateRegistry, I as MESH_NODE_CERTIFICATES_COLLECTION, J as caFingerprint, K as getProcessMeshCaState, L as MESH_NODE_CERTIFICATES_COLUMNS, M as revokeMeshCertificate, N as getProcessMeshTlsListenerState, O as isProcessVerifiedMeshPeer, P as openMeshTlsWhenRevocationsLoaded, Q as generateMeshCa, R as MeshCertificateRegistry, S as ServiceBroker, SystemConfigAddon, T as emitProcessNodeRegistered, U as MeshCrl, V as getProcessMeshCertificateRegistry, W as processMeshCrl, X as createMeshCsrPem, Y as caFingerprintCompact, Z as exportMeshPrivateKeyPem, _ as signPairingProof, _t as readCidrSetting, a as hubHostFromMeshAddress, at as AGENT_UI_UNLOCK_TTL_MS, b as TlsTcpTransporter, c as PAIRING_MAX_SESSIONS, ct as AGENT_UI_UNLOCK_VERSION, d as PAIRING_PROTOCOL, dt as mintAgentUiUnlockTicket, et as isValidAgentNodeId, f as PAIRING_TTL_MS, ft as parseAgentDashboardOrigins, g as keyFingerprintShort, gt as parseCidrList, h as describeCsr, ht as normalizeIp, i as AgentPairing, it as AGENT_DASHBOARD_ORIGINS_FIELD, j as renewMeshCertificate, k as onProcessNodeRegistered, l as PAIRING_PATHS, lt as UnlockTicketJtiStore, m as computePairingSas, mt as createCidrMatcher, n as HubPairing, nt as issueMeshLeafFromCsr, o as PAIRING_CODE_DIGITS, ot as AGENT_UI_UNLOCK_TYP, p as computePairingCommitment, pt as verifyAgentUiUnlockTicket, q as requireProcessMeshCa, r as PairingHttpError, rt as loadMeshCa, s as PAIRING_MAX_CODE_ATTEMPTS, st as AGENT_UI_UNLOCK_USE, tt as issueMeshLeafForNode, u as PAIRING_PIN_DIGITS, ut as isAllowedAgentDashboardReturnTo, v as verifyPairingProof, w as dropProcessPeer, x as Errors, y as MESH_TLS_PORT_HELLO_FIELD, z as RENEWAL_ABANDONED } from "./builtins/system-config/system-config.addon.mjs";
 import "./builtins/system-config/index.mjs";
 import { WinstonDestination, WinstonLoggingAddon } from "./builtins/winston-logging/index.mjs";
 import { C as isModelDownloaded, T as revisionWeightUrl, _ as downloadFile, a as startEventLoopStallMonitor, b as fetchJson, c as createAuthenticatedFileServer, d as resolveFilePath, f as ModelDownloadService, g as deleteModelFromDisk, h as collectModelFiles, i as attributeStall, l as parseRangeHeader, m as adoptModelRevisions, n as STALL_REPORT_MS, o as createFileDataPlaneHandler, r as STALL_TICK_MS, s as contentTypeFor, t as CustomActionRegistry, u as parseTokenizedUrl, v as downloadModel, w as resolveFormatRevision, x as getModelFilePath, y as ensureModel } from "./custom-action-registry-BQnbN0DP.mjs";
-import { C as DEFAULT_LAN_HTTP_PORT, D as closeLanHttp, E as bindPendingLanHttp, O as readLanHttpState, S as reissueTlsLeaf, T as applyLanHttp, _ as splitPemCertificates, a as storeUploadedCertificate, b as ensureTlsCert, c as leafFingerprintOf, d as servedHttpsLeafFingerprint, f as prepareBootTls, g as readTlsMode, h as readTlsAccessStatus, i as revertToGeneratedCertificate, k as registerLanHttpHandler, l as registerHttpsListener, m as readExtraSans, n as applyCertificateToListener, o as validateUploadedTls, p as UPLOADED_CA_FILE, r as regenerateCertificate, s as clearHttpsListener, t as createCiaoPublisher, u as reloadHttpsListener, v as writeExtraSans, w as allFamiliesListenHost, x as loadTlsCert, y as writeTlsMode } from "./hub-mdns-ciao-DJRwtlA8.mjs";
+import { C as DEFAULT_LAN_HTTP_PORT, D as closeLanHttp, E as bindPendingLanHttp, O as readLanHttpState, S as reissueTlsLeaf, T as applyLanHttp, _ as splitPemCertificates, a as storeUploadedCertificate, b as ensureTlsCert, c as leafFingerprintOf, d as servedHttpsLeafFingerprint, f as prepareBootTls, g as readTlsMode, h as readTlsAccessStatus, i as revertToGeneratedCertificate, k as registerLanHttpHandler, l as registerHttpsListener, m as readExtraSans, n as applyCertificateToListener, o as validateUploadedTls, p as UPLOADED_CA_FILE, r as regenerateCertificate, s as clearHttpsListener, t as createCiaoPublisher, u as reloadHttpsListener, v as writeExtraSans, w as allFamiliesListenHost, x as loadTlsCert, y as writeTlsMode } from "./hub-mdns-ciao-DMlQTdPU.mjs";
 import { n as getPlatformKeychainKey, r as setPlatformKeychainKey, t as clearPlatformKeychainKey } from "./platform-key-source-BWlq0jjn.mjs";
 import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-Di9daRwI.mjs";
-import { c as BackupDecryptError, f as generateBackupKeyPair, h as readBackupEncryptionHeader, l as BackupKeyFormatError, r as prepareRestoreArchive, s as SystemBackupService, t as BackupKeyRequiredError, u as BackupKeyMismatchError } from "./restore-archive-BxmP1ChO.mjs";
+import { c as BackupDecryptError, f as generateBackupKeyPair, h as readBackupEncryptionHeader, l as BackupKeyFormatError, r as prepareRestoreArchive, s as SystemBackupService, t as BackupKeyRequiredError, u as BackupKeyMismatchError } from "./restore-archive-DPg9duVY.mjs";
 import { z } from "zod";
 import * as crypto$1 from "node:crypto";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
@@ -44,7 +44,7 @@ import { connect, createConnection, createServer } from "node:net";
 import { mkdir, rm, stat, unlink } from "node:fs/promises";
 import * as path$1 from "node:path";
 import { dirname, isAbsolute, join, resolve } from "node:path";
-import * as os from "node:os";
+import * as os$1 from "node:os";
 import { tmpdir } from "node:os";
 import { pathToFileURL } from "node:url";
 import * as fs from "node:fs";
@@ -53,7 +53,7 @@ import { execFile, spawn } from "node:child_process";
 import * as util from "node:util";
 import { promisify } from "node:util";
 import { once } from "node:events";
-import { BOOT_RECOVERY_BACKOFF_MS, DATAPLANE_SECRET_HEADER, DEVICE_CHILDREN_BATCH_MAX, DeviceType, DisposerChain, EventCategory, PEER_BYTES_CHUNK_BYTES, PEER_BYTES_MAX_OUTSTANDING, PEER_BYTES_STALL_MS, PEER_BYTES_TICKET_TTL_MS, ReadinessRegistry as ReadinessRegistry$1, asJsonObject, asString, collectZodSecretPaths, createDeviceProxy, createEvent, createEventBusSliceSource, createSecretsAccess, deviceOpsCapability, emitReadiness, errMsg, expandCapMethods as expandCapMethods$1, maskUrlCredentials, readNodePin, scopeKey as scopeKey$1, scrubKnownSecrets, sleep, withCapInputDefaults } from "@camstack/types/addon";
+import { BOOT_RECOVERY_BACKOFF_MS, DATAPLANE_SECRET_HEADER, DEVICE_CHILDREN_BATCH_MAX, DeviceType, DisposerChain, ErrorI18nPayloadSchema, EventCategory, PEER_BYTES_CHUNK_BYTES, PEER_BYTES_MAX_OUTSTANDING, PEER_BYTES_STALL_MS, PEER_BYTES_TICKET_TTL_MS, ReadinessRegistry as ReadinessRegistry$1, asJsonObject, asString, collectZodSecretPaths, createDeviceProxy, createEvent, createEventBusSliceSource, createSecretsAccess, deviceOpsCapability, emitReadiness, errMsg, expandCapMethods as expandCapMethods$1, maskUrlCredentials, readErrorI18n, readNodePin, scopeKey as scopeKey$1, scrubKnownSecrets, sleep, withCapInputDefaults } from "@camstack/types/addon";
 import { createServer as createServer$1, request } from "node:http";
 import * as v8 from "node:v8";
 import { Session } from "node:inspector/promises";
@@ -1799,7 +1799,8 @@ function formatArrayBufferCensus(label, report, context) {
 }
 //#endregion
 //#region src/kernel/gc-census.ts
-function countsOf(entries, kinds) {
+function countsOf(entries, kinds, flagBits) {
+	const flags = {};
 	let majors = 0;
 	let minors = 0;
 	let incrementals = 0;
@@ -1809,13 +1810,17 @@ function countsOf(entries, kinds) {
 		else if (e.kind === kinds.minor) minors++;
 		else if (e.kind === kinds.incremental) incrementals++;
 		pauseMs += e.durationMs;
+		if (e.flags !== void 0) {
+			for (const f of flagBits) if ((e.flags & f.bit) !== 0) flags[f.name] = (flags[f.name] ?? 0) + 1;
+		}
 	}
 	return {
 		majors,
 		minors,
 		incrementals,
 		pauseMs,
-		windowMs: 0
+		windowMs: 0,
+		...Object.keys(flags).length > 0 ? { flags } : {}
 	};
 }
 /**
@@ -1827,7 +1832,7 @@ function countsOf(entries, kinds) {
 * observed and a process that is not collecting look identical on the line, and
 * they are the two answers furthest apart.
 */
-function createGcCensus(install, kinds, startedAt) {
+function createGcCensus(install, kinds, startedAt, flagBits = []) {
 	let pending = [];
 	const stopObserving = install((entry) => {
 		pending.push(entry);
@@ -1842,7 +1847,7 @@ function createGcCensus(install, kinds, startedAt) {
 			pending = [];
 			windowStart = at;
 			return {
-				...countsOf(taken, kinds),
+				...countsOf(taken, kinds, flagBits),
 				windowMs
 			};
 		},
@@ -1867,14 +1872,18 @@ function nodeGcObserver() {
 			minor: 1,
 			incremental: 8
 		}),
+		flagBits: readFlagBits(),
 		install: (observe) => {
 			try {
 				const observer = new (process.getBuiltinModule("node:perf_hooks")).PerformanceObserver((list) => {
 					for (const entry of list.getEntries()) {
 						const detail = "detail" in entry ? entry.detail : void 0;
+						const kind = typeof detail === "object" && detail !== null && "kind" in detail && typeof detail.kind === "number" ? detail.kind : -1;
+						const flags = typeof detail === "object" && detail !== null && "flags" in detail && typeof detail.flags === "number" ? detail.flags : void 0;
 						observe({
-							kind: typeof detail === "object" && detail !== null && "kind" in detail && typeof detail.kind === "number" ? detail.kind : -1,
-							durationMs: entry.duration
+							kind,
+							durationMs: entry.duration,
+							...flags !== void 0 ? { flags } : {}
 						});
 					}
 				});
@@ -1888,6 +1897,25 @@ function nodeGcObserver() {
 		}
 	};
 }
+var GC_FLAG_PREFIX = "NODE_PERFORMANCE_GC_FLAGS_";
+/**
+* The flag bits, read from `perf_hooks.constants` by their prefix so a flag V8
+* adds tomorrow gets a name without anyone editing a table. `NO` (0) can never
+* match a bit and is dropped.
+*/
+function readFlagBits() {
+	try {
+		const perf = process.getBuiltinModule("node:perf_hooks");
+		const bits = [];
+		for (const [key, value] of Object.entries(perf.constants)) if (key.startsWith(GC_FLAG_PREFIX) && typeof value === "number" && value > 0) bits.push({
+			name: key.slice(26),
+			bit: value
+		});
+		return bits;
+	} catch {
+		return [];
+	}
+}
 function readKinds(fallback) {
 	try {
 		const c = process.getBuiltinModule("node:perf_hooks").constants;
@@ -1914,7 +1942,14 @@ function readKinds(fallback) {
 function formatGcCensus(window) {
 	if (window === null || window === void 0) return "";
 	const perMin = (n) => window.windowMs <= 0 ? "?" : (n / (window.windowMs / 6e4)).toFixed(1);
-	return ` gc=maj${window.majors}/min${window.minors}/inc${window.incrementals}@${Math.round(window.windowMs / 1e3)}s gcMajPerMin=${perMin(window.majors)} gcPauseMs=${Math.round(window.pauseMs)}`;
+	return ` gc=maj${window.majors}/min${window.minors}/inc${window.incrementals}@${Math.round(window.windowMs / 1e3)}s gcMajPerMin=${perMin(window.majors)} gcPauseMs=${Math.round(window.pauseMs)}` + formatGcFlags(window.flags);
+}
+/** ` gcFlags=ALL_EXTERNAL_MEMORY:12,FORCED:1` — most frequent first; empty when none. */
+function formatGcFlags(flags) {
+	if (flags === void 0) return "";
+	const entries = Object.entries(flags).toSorted((a, b) => b[1] - a[1] || a[0].localeCompare(b[0]));
+	if (entries.length === 0) return "";
+	return ` gcFlags=${entries.map(([name, n]) => `${name}:${n}`).join(",")}`;
 }
 /**
 * The census. Always exists — `process.cpuUsage()` is available on every
@@ -2642,7 +2677,7 @@ function startHeapWatch(label = HUB_MAIN_HEAP_WATCH_LABEL, sink = consoleSink, i
 	const readMemory = reclaimOptions?.readMemory ?? (() => process.memoryUsage());
 	const now = reclaimOptions?.now ?? (() => Date.now());
 	const gcObserver = probes?.gcObserver ?? nodeGcObserver();
-	const gcCensus = createGcCensus(gcObserver.install, gcObserver.kinds, now());
+	const gcCensus = createGcCensus(gcObserver.install, gcObserver.kinds, now(), gcObserver.flagBits);
 	const cpuProbe = probes?.processCpu;
 	const processCpu = createProcessCpuCensus({
 		cpuUsageUs: cpuProbe?.cpuUsageUs ?? (() => {
@@ -2696,6 +2731,7 @@ function startHeapWatch(label = HUB_MAIN_HEAP_WATCH_LABEL, sink = consoleSink, i
 	};
 	let mode = "steady";
 	let lastLoggedAt = Number.NEGATIVE_INFINITY;
+	let firstLinePending = true;
 	const budgetMb = rssBudget?.budgetMb !== void 0 && rssBudget.budgetMb > 0 ? rssBudget.budgetMb : void 0;
 	const budgetSource = rssBudget?.source ?? "unspecified";
 	const releaseRatio = rssBudget?.releaseRatio ?? .9;
@@ -2754,7 +2790,9 @@ function startHeapWatch(label = HUB_MAIN_HEAP_WATCH_LABEL, sink = consoleSink, i
 			const due = at - lastLoggedAt >= intervalMs;
 			if (mode === "escalated" || due) {
 				lastLoggedAt = at;
-				const line = format(label, sample, loopDelay?.read(), budgetMb, `${formatHeapSpaces(readSpaces())}${formatEventPlane(eventPlane?.read())}` + formatSocketPlane(socketPlane?.read()) + formatMeshQueue(meshQueue?.()) + formatGcCensus(gcCensus?.read(at)) + formatProcessCpu(processCpu.read(at)));
+				const firstLine = firstLinePending;
+				firstLinePending = false;
+				const line = format(label, sample, loopDelay?.read(), budgetMb, `${formatHeapSpaces(readSpaces(), firstLine ? 0 : void 0)}${formatEventPlane(eventPlane?.read())}` + formatSocketPlane(socketPlane?.read()) + formatMeshQueue(meshQueue?.()) + formatGcCensus(gcCensus?.read(at)) + formatProcessCpu(processCpu.read(at)));
 				if (sample.nearLimit) sink.warn(`${line} — APPROACHING HEAP LIMIT`);
 				else if (mode === "escalated") sink.warn(`${line} — heap elevated, sampling every ${probeIntervalMs}ms`);
 				else sink.info(line);
@@ -4960,7 +4998,7 @@ var PythonEnvManager = class {
 	}
 	async ensure(options) {
 		const probe = await this.probe();
-		if (!probe.available || !probe.path) throw new Error("Python 3.10+ is required but not found on this system");
+		if (!probe.available || !probe.path) throw userError("system.python-required", void 0, "Python 3.10+ is required but not found on this system");
 		if (!fs.existsSync(path$1.join(this.venvPath, "bin", "python"))) await execFileAsync$7(probe.path, [
 			"-m",
 			"venv",
@@ -5228,7 +5266,7 @@ var StorageManager = class {
 	}
 	getProvider() {
 		if (this.legacyProvider) return this.legacyProvider;
-		if (!this.newStorageProvider && !this.settingsBackend && !this.locationManager) throw new Error("No storage provider configured");
+		if (!this.newStorageProvider && !this.settingsBackend && !this.locationManager) throw userError("storage.no-provider", void 0, "No storage provider configured");
 		return this.createLegacyShim();
 	}
 	setLocationManager(manager) {
@@ -5251,7 +5289,7 @@ var StorageManager = class {
 	* Builds IStorageLocation from settingsBackend (structured) + locationManager (files).
 	*/
 	getLocation(name, namespace) {
-		if (!this.legacyProvider && !this.newStorageProvider && !this.settingsBackend && !this.locationManager) throw new Error("No storage provider configured");
+		if (!this.legacyProvider && !this.newStorageProvider && !this.settingsBackend && !this.locationManager) throw userError("storage.no-provider", void 0, "No storage provider configured");
 		if (this.legacyProvider) try {
 			const LEGACY_MAP = {
 				config: "data",
@@ -6912,7 +6950,7 @@ function ensureLibraryBuilt(packageName, packagesDir) {
 * `copyDirRecursive` for the wedge this prevents.
 */
 async function installPackageFromNpm(packageName, targetDir) {
-	const tmpDir = await fs.promises.mkdtemp(path$1.join(os.tmpdir(), "camstack-install-"));
+	const tmpDir = await fs.promises.mkdtemp(path$1.join(os$1.tmpdir(), "camstack-install-"));
 	try {
 		const { stdout } = await execFileAsync$4("npm", [
 			"pack",
@@ -7583,7 +7621,7 @@ var execFileAsync$3 = promisify(execFile);
 * installer) pass their own.
 */
 function defaultNpmCacheDir() {
-	return path$1.join(os.tmpdir(), "camstack-npm-bootstrap");
+	return path$1.join(os$1.tmpdir(), "camstack-npm-bootstrap");
 }
 /**
 * Native node modules an addon needs at runtime but cannot be bundled
@@ -8527,7 +8565,7 @@ var AddonInstaller = class AddonInstaller {
 	* unusual auth, offline mode, etc).
 	*/
 	async installFromNpm(packageName, version) {
-		const tmpDir = fs.mkdtempSync(path$1.join(os.tmpdir(), "camstack-addon-npm-"));
+		const tmpDir = fs.mkdtempSync(path$1.join(os$1.tmpdir(), "camstack-addon-npm-"));
 		const packageSpec = version ? `${packageName}@${version}` : packageName;
 		this.logger.info(`${packageName} — installing from npm`);
 		try {
@@ -11677,6 +11715,17 @@ function createDoorSettingsView(addonId, door, sections) {
 			}
 			return out;
 		},
+		async listDeviceStoreIds() {
+			const all = await loadPrefixed(door, "addon-device-settings", `${addonId}:`, () => null);
+			const ids = /* @__PURE__ */ new Set();
+			for (const suffix of Object.keys(all)) {
+				const dot = suffix.indexOf(".");
+				if (dot <= 0) continue;
+				const deviceId = Number(suffix.slice(0, dot));
+				if (Number.isInteger(deviceId) && deviceId > 0) ids.add(deviceId);
+			}
+			return [...ids].toSorted((a, b) => a - b);
+		},
 		async writeDeviceStore(deviceId, patch) {
 			const scope = `${addonId}:${String(deviceId)}.`;
 			await replacePrefixed(door, "addon-device-settings", scope, {
@@ -14448,7 +14497,8 @@ var STORE_READABLE_BOOTSTRAP_KEYS = new Set([
 	"auth.tokenExpiry",
 	"auth.accessTokenExpiry",
 	"auth.trustedProxies",
-	"auth.trustedNetworks"
+	"auth.trustedNetworks",
+	"server.name"
 ]);
 /** May the settings store answer `key`, or is it env + config.yaml only? */
 function storeMayAnswer(key) {
@@ -14884,6 +14934,11 @@ var ConfigManager = class {
 			writeAddonStore: (patch) => active().writeAddonStore(patch),
 			readDeviceStore: (deviceId) => active().readDeviceStore(deviceId),
 			readDeviceStoreBatch: (deviceIds) => active().readDeviceStoreBatch(deviceIds),
+			listDeviceStoreIds: async () => {
+				const list = active().listDeviceStoreIds;
+				if (list === void 0) throw new Error("listDeviceStoreIds is not available on this settings view");
+				return list.call(active());
+			},
 			writeDeviceStore: (deviceId, patch) => active().writeDeviceStore(deviceId, patch),
 			clearDeviceStore: (deviceId) => active().clearDeviceStore(deviceId),
 			getSection: (section) => active().getSection(section),
@@ -18558,9 +18613,14 @@ function localEndpointPath(nodeId) {
 * node had answered (2026-09-25, device 3836).
 */
 var PeerAnsweredError = class extends Error {
-	constructor(message) {
+	/** The far end's stable error code (D863), carried so the hub can translate it. */
+	i18nCode;
+	i18nParams;
+	constructor(message, i18n) {
 		super(message);
 		this.name = "PeerAnsweredError";
+		this.i18nCode = i18n?.code;
+		this.i18nParams = i18n?.params;
 	}
 };
 //#endregion
@@ -18582,6 +18642,13 @@ var PayloadReply = class {
 		this.payload = payload;
 	}
 };
+//#endregion
+//#region src/kernel/transport/socket-channel.ts
+/** A peer's `i18n` is untrusted wire data: a malformed one is dropped, the message still travels. */
+function parseWireI18n(raw) {
+	const parsed = ErrorI18nPayloadSchema.safeParse(raw);
+	return parsed.success ? parsed.data : void 0;
+}
 var SocketChannel = class {
 	socket;
 	nextId = 1;
@@ -18793,11 +18860,13 @@ var SocketChannel = class {
 					body: result
 				});
 			} catch (err) {
+				const i18n = readErrorI18n(err);
 				resBytes = this.send({
 					k: "res",
 					id: frame.id,
 					ok: false,
-					err: err instanceof Error ? err.message : String(err)
+					err: err instanceof Error ? err.message : String(err),
+					...i18n !== null ? { i18n } : {}
 				});
 			}
 			if (label !== void 0) this.recordAction(label, wireBytes, resBytes);
@@ -18809,7 +18878,7 @@ var SocketChannel = class {
 			this.pending.delete(frame.id);
 			if (p.timer !== null) clearTimeout(p.timer);
 			if (p.action !== null) this.recordAction(p.action.label, p.action.reqBytes, wireBytes);
-			if (!frame.ok) p.reject(new PeerAnsweredError(frame.err));
+			if (!frame.ok) p.reject(new PeerAnsweredError(frame.err, parseWireI18n(frame.i18n)));
 			else if (frame.pl !== void 0) p.resolve(new PayloadReply(frame.body, frame.pl));
 			else p.resolve(frame.body);
 			return;
@@ -22115,8 +22184,8 @@ function probeLinuxGpus() {
 	return signals;
 }
 function probePlatform() {
-	const platform = os.platform();
-	const arch = os.arch();
+	const platform = os$1.platform();
+	const arch = os$1.arch();
 	if (platform === "linux") return {
 		platform,
 		arch,
@@ -24273,20 +24342,20 @@ function asNpuType(type) {
 	return null;
 }
 function localHardwareInfo() {
-	const platform = os.platform();
+	const platform = os$1.platform();
 	if (platform !== "darwin" && platform !== "linux" && platform !== "win32") return null;
-	const arch = os.arch() === "arm64" ? "arm64" : "x64";
+	const arch = os$1.arch() === "arm64" ? "arm64" : "x64";
 	const inference = mapSignalsToInferenceHardware(probePlatform());
 	const gpuType = inference.gpu ? asGpuType(inference.gpu.type) : null;
 	const npuType = inference.npu ? asNpuType(inference.npu.type) : null;
-	const cpus = os.cpus();
+	const cpus = os$1.cpus();
 	return {
 		platform,
 		arch,
 		cpuModel: cpus[0]?.model ?? "unknown",
 		cpuCores: cpus.length,
-		totalRAM_MB: Math.round(os.totalmem() / 1024 / 1024),
-		availableRAM_MB: Math.round(os.freemem() / 1024 / 1024),
+		totalRAM_MB: Math.round(os$1.totalmem() / 1024 / 1024),
+		availableRAM_MB: Math.round(os$1.freemem() / 1024 / 1024),
 		gpu: gpuType !== null ? {
 			type: gpuType,
 			name: gpuType
@@ -24644,7 +24713,7 @@ async function defaultHasBinary(binary) {
 	}
 }
 async function defaultDetectManager() {
-	const candidates = os.platform() === "darwin" ? ["brew"] : [
+	const candidates = os$1.platform() === "darwin" ? ["brew"] : [
 		"apt",
 		"apk",
 		"dnf",
@@ -26491,4 +26560,573 @@ var LifecycleJobEngine = class {
 */
 var CAP_METHOD_NOT_IMPLEMENTED = "CAP_METHOD_NOT_IMPLEMENTED";
 //#endregion
-export { ADMIN_TOKEN_MAX_LIFETIME_MS, ADMIN_TOKEN_PREFIX, AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AGENT_DASHBOARD_ORIGINS_FIELD, AGENT_HTTPS_NAMES_COLLECTION, AGENT_HTTPS_NAMES_COLUMNS, AGENT_READINESS_SERVICE_NAME, AGENT_UI_UNLOCK_TTL_MS, AGENT_UI_UNLOCK_TYP, AGENT_UI_UNLOCK_USE, AGENT_UI_UNLOCK_VERSION, ALL_CAPABILITY_DEFINITIONS, ARRAY_BUFFER_CENSUS_COOLDOWN_MS, ARRAY_BUFFER_CENSUS_SUSTAIN_MS, ARRAY_BUFFER_CENSUS_THRESHOLD_MB, ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRouteRegistry, AdminTokenManager, AgentHttpsInstallError, AgentHttpsNames, AgentMdnsAdvertiser, AgentMeshIdentityGate, AgentPairing, AlertCenterAddon, ApiKeyManager, AuthAuditLog, AuthManager, BackupDecryptError, BackupKeyFormatError, BackupKeyMismatchError, BackupKeyRequiredError, CAP_ACTION_OVERFLOW_LABEL, CAP_ACTION_UNLABELLED, CAP_METHOD_NOT_IMPLEMENTED, CA_COMMON_NAME, CA_VALIDITY_DAYS, CORE_CAP_SERVICE_NAME, CalendarsAddon, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, ComposerAddon, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CoreBlocksAddon, CustomActionRegistry, DECISIVE_HEAP_SPACES, DEFAULT_DATA_PATH, DEFAULT_HUB_TLS_TCP_PORT, DEFAULT_LAN_HTTP_PORT, DEFAULT_LOG_LEVEL, DEVICE_CA_KEY_REF, DEVICE_SETTINGS_CONTRIBUTION_METHODS, DEVICE_STATUS_METHOD, DataPlaneRegistry, DeviceCaStore, DeviceCredentialManager, DeviceManagerAddon, DeviceRegistry, DeviceStore, EMPTY_CAP_ACTION_READING, EMPTY_SOCKET_DIRECTION, EMPTY_SOCKET_PLANE_BASELINE, EVENT_PLANE_TOP_N, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FIRST_BOOT_ADMIN_PASSWORD, FIRST_BOOT_ADMIN_USERNAME, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, GET_STATUS_METHOD, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HEAP_RECLAIM_MIN_INTERVAL_MS, HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, HEAP_RECLAIM_TRIGGER_MB, HEAP_SPACE_REPORT_MIN_MB, HEAP_WATCH_INTERVAL_MS, HEAP_WATCH_WARN_RATIO, HUB_CAP_FWD_ACTION, HUB_CAP_FWD_SERVICE, HUB_MAIN_HEAP_WATCH_LABEL, HUB_MAIN_RSS_BUDGET_MB, HUB_RSS_BUDGET_ENV, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, HubPairing, INFRA_CAPABILITIES, IntegrationRegistry, JWT_SIGNING_KEY_REF, JobJournal, JwtSigningKeyUnavailableError, LEAF_RENEWAL_WINDOW_DAYS, LifecycleJobEngine, LifecycleStateMachine, LivenessMonitorAddon, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, LoggingGate, LoginSessionManager, LokiDestination, LokiLoggingAddon, MAX_CAP_ACTIONS_PER_PEER, MAX_LEAF_VALIDITY_DAYS, MESH_ACTION_FORBIDDEN_TYPE, MESH_CA_FIELD, MESH_CA_KEY_REF, MESH_CA_SETTINGS_KEY, MESH_NODE_CERTIFICATES_COLLECTION, MESH_NODE_CERTIFICATES_COLUMNS, MESH_NODE_UNAUTHENTICATED_TYPE, MESH_QUEUE_TOP_N, MESH_TLS_PORT_HELLO_FIELD, METHOD_ACCESS_MAP, MeshCaKeeper, MeshCertificateRegistry, MeshCrl, MeshIdentityGate, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NATIVE_SCAN_DEPTH, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, OUTBOUND_QUEUE_COOLDOWN_MS, OUTBOUND_QUEUE_SUSTAIN_MS, OUTBOUND_QUEUE_THRESHOLD_BYTES, PAIRING_CODE_DIGITS, PAIRING_MAX_CODE_ATTEMPTS, PAIRING_MAX_SESSIONS, PAIRING_PATHS, PAIRING_PIN_DIGITS, PAIRING_PROTOCOL, PAIRING_TTL_MS, PARENT_ROUTED_PROVIDER_ADDON_ID, PREVIOUS_LEAF_GRACE_MS, PYTHON_VERSION, PairingHttpError, PeerAnsweredError, PipelineRunner, PipelineValidator, PythonEnvManager, QUARANTINE_DIRNAME, REFRESH_TOKEN_PREFIX, RENEWAL_ABANDONED, RESTART_MARKER_FILE, RSS_BUDGET_REANNOUNCE_MIN_MS, RSS_BUDGET_RELEASE_RATIO, RUNNER_HEAP_WATCH_INTERVAL_MS, RUNNER_RSS_BUDGET_ENV, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, ReplEngine, RingBuffer, SERVER_AUTH_OID, SOCKET_PLANE_TOP_N, SOCKET_QUEUE_TOP_N, STALL_REPORT_MS, STALL_TICK_MS, STORE_READABLE_BOOTSTRAP_KEYS, SYSTEM_SECRET_OWNER, ScopedLogger, ScopedTokenManager, SettingsReadUnavailableError, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemBackupService, SystemConfigAddon, SystemEventBus, TRADITIONAL_NATIVE_PACKAGES, TlsTcpTransporter, ToastService, UDS_NO_ROUTE_PREFIX, UNCLAIMED, UPLOADED_CA_FILE, USER_MANAGEMENT_INTERNAL, UdsLocalTransportClient, UdsLocalTransportServer, UnlockTicketJtiStore, UserManager, WinstonDestination, WinstonLoggingAddon, ZERO_LOOP_DELAY, __resetCapUsageRegistryForTests, __resetLoggingGateForTests, acceptAgentSans, adaptBrokerToCluster, addonSettingsCapability, adoptModelRevisions, afterWorkerOnlineAnnounce, agentHttpsPaths, allFamiliesListenHost, answerClaimedGetStatus, applyCertificateToListener, applyLanHttp, attachUserManagementInternal, attributeStall, bindPendingLanHttp, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildAgentAnnouncement, buildBinaryPath, buildCapRouters, buildHeapSample, buildLinkChain, buildNativeCapProxy, buildNodeManifest, buildNpmChildEnv, buildStorageLocationRegistry, buildTransporter, builderMountedCapNames, caFingerprint, caFingerprintCompact, callRegisterNodeWithRetry, callWithServiceDiscovery, canServeDataPlane, capActionLabel, capActionName, capActionSuffix, capBareAction, capServiceName, certificateNames, classifyAddonDir, classifyCapRoute, clearHttpsListener, clearPendingRestart, clearPlatformKeychainKey, closeLanHttp, clusterEventTopic, collectAgentNames, collectCertIdentity, collectModelFiles, computePairingCommitment, computePairingSas, connectBrokerTransport, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonDataPlaneFacility, createAddonPeerBytesFacility, createAddonService, createAgentEventScope, createAgentHttpsRequest, createAgentTransport, createArrayBufferCensusGate, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCapActionCensus, createCiaoPublisher, createCidrMatcher, createCoreCapService, createDeferredHeapWatchSink, createDoorSettingsView, createEventPlaneMeter, createEventPlaneReader, createFileDataPlaneHandler, createHubCapForwardService, createHubService, createInspectorArrayBufferCensus, createKernelHwAccel, createKernelInferenceEngine, createLocalTransport, createLoopDelayMeter, createMeshAccessMiddleware, createMeshCsrPem, createMeshQueueReader, createOutboundQueueGate, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createSocketDirectionCounters, createSocketPlaneMeter, createSocketPlaneReader, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, createV8Reclaimer, currentBrokerTransporter, deleteModelFromDisk, deriveAgentListenPort, describeCsr, describeHttpsLeaf, describeMeshLeaf, describeProviderKindDrift, describeRss, detectWorkspacePackagesDir, deviceCapResolverLink, deviceOfGetStatus, diffCapActionCensus, diffEventPlane, diffSocketPlane, disconnectBrokerTransport, downloadBinary, downloadFile, downloadModel, dropProcessPeer, emitDownForOwnedCaps, emitHeapDiagnosticReport, emitProcessNodeRegistered, encodeFrame, ensureAddonNativePrebuilds, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensureNativePrebuilds, ensurePython, ensureTlsCert, evaluateExistingCert, expandCapMethods, exportMeshPrivateKeyPem, fetchJson, findInPath, formatArrayBufferCensus, formatEventPlane, formatHeapSpaces, formatLogLine, formatMeshQueue, formatOutboundQueueVerdict, formatSocketPlane, generateBackupKeyPair, generateDeviceCa, generateMeshCa, generateMeshKeyPair, getBrokerEventBus, getBrokerTlsTransporter, getCapUsageRegistry, getFfmpegDownloadUrl, getLoggingGate, getModelFilePath, getMoleculerEventStats, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPlatformKeychainKey, getProcessAgentHttpsNames, getProcessJwtSigningKeyState, getProcessMeshCaState, getProcessMeshCertificateRegistry, getProcessMeshTlsListenerState, getProcessNodeMeshTransport, getProcessPeerLeaf, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getUserManagementInternal, getWorkerDeviceRegistry, hasDotNode, heapSpaceField, hostNodeIdOf, hubHostFromMeshAddress, hubMainRssBudget, installAgentHttps, installBrokerTransporter, installManifestNativeDeps, installManifestPythonDeps, installManifestSystemDeps, installPackageFromNpm, installPythonPackages, installPythonRequirements, ipcParentLink, isAddonDeploySource, isAllowedAgentDashboardReturnTo, isArrayBufferCensusReport, isArrayOutputSchema, isCollectionArrayMethod, isContainerBridgeAddress, isCredentialKeyName, isInfraCapability, isInstalledTransporter, isLocalOnlyHostname, isModelDownloaded, isPeerEventPacket, isPrivateAddress, isProcessVerifiedMeshPeer, isRemoteForbiddenAction, isRemoteForbiddenOnAgent, isSettingsReadUnavailable, isSourceNewer, isValidAgentNodeId, isolatedBuiltinPhase, issueAgentHttpsLeaf, issueDeviceLeaf, issueMeshLeafForNode, issueMeshLeafFromCsr, keyFingerprintShort, leafFingerprintOf, loadAgentHttps, loadDeviceCa, loadMeshCa, loadTlsCert, localEndpointPath, localProviderLink, localSupportedPythonRuntimes, mapSignalsToInferenceHardware, meshErrorType, mintAgentUiUnlockTicket, mountNativeCapService, nextRssBudgetState, normalizeIp, onProcessNodeRegistered, openMeshTlsWhenRevocationsLoaded, overlayGetStatus, parseAgentDashboardOrigins, parseCapAction, parseCidrList, parseRangeHeader, parseRssBudgetMb, parseTokenExpiry, parseTokenizedUrl, partitionIsolatedBuiltinIds, pemDigest, pinnedHttpsCaFingerprint, prepareBootTls, prepareRestoreArchive, probePlatform, processJwtSigningKey, processMeshCrl, proxyToUpstream, quarantineAddonResidue, readBackupEncryptionHeader, readCidrSetting, readExtraSans, readHeapSpaces, readLanHttpState, readPendingRestart, readSocketQueues, readTlsAccessStatus, readTlsMode, readinessKey, reclaimIntervalMs, recordSocketFrame, redactLogEntry, redactLogMeta, redactLogText, regenerateCertificate, registerEventBusService, registerHttpsListener, registerLanHttpHandler, reissueTlsLeaf, reloadHttpsListener, renewMeshCertificate, requireProcessMeshCa, resolveFilePath, resolveFormatRevision, resolveHwAccel, resolveNpmInvocation, revertToGeneratedCertificate, revisionWeightUrl, revokeMeshCertificate, runHubAddonBoot, runNpm, sampleSocketDirection, scheduleSelfRestart, scopeKey, scopesAllowAddon, scopesAllowDeviceCap, selectAddonResidue, selectReportedSpaces, serializeTypedArrays, servedHttpsLeafFingerprint, setHubConnected, setNodeEventInterest, setPlatformKeychainKey, setProcessAgentHttpsNames, setProcessMeshCertificateRegistry, setProcessMeshPeerTransportLookup, setProcessMeshTlsEnabler, setProcessMeshTlsListenerState, setWrapperActive, shouldReclaim, signPairingProof, signalAllRunnerGroups, socketDirectionBytes, socketDirectionMessages, splitPemCertificates, stampCallerAddonId, startEventLoopStallMonitor, startHeapWatch, startRunnerHeapWatch, staticJwtSigningKey, storeMayAnswer, storeUploadedCertificate, strandedMb, stripCamstackDeps, stripForgedIdentity, stripForwardedCaller, subscribePassthrough, systemHostFacts, udsChildLogToWorkerEntry, validateProviderRegistrations, validateUploadedTls, verifyAgentUiUnlockTicket, verifyDeviceLeaf, verifyDeviceSignature, verifyPairingProof, waitUntilReady, writeExtraSans, writePendingRestart, writeTlsMode };
+//#region src/i18n/en.json
+var en_default = {
+	"auth.invalid-credentials": "Invalid credentials",
+	"auth.invalid-totp": "Invalid TOTP code",
+	"auth.not-authenticated": "Not authenticated",
+	"auth.login-challenge-expired": "Invalid or expired login challenge — please re-enter your password",
+	"auth.passkey-verification-failed": "Passkey verification failed",
+	"auth.user-gone": "User no longer exists",
+	"auth.no-session-cookie": "No session cookie",
+	"auth.invalid-session-cookie": "Invalid session cookie",
+	"auth.handoff-code-invalid": "Invalid or expired handoff code",
+	"auth.share-never-expiring-extend": "A never-expiring share token cannot be extended",
+	"auth.share-owner-only-extend": "Only the token owner or an admin can extend a share token",
+	"auth.share-owner-only-revoke": "Only the token owner or an admin can revoke a share token",
+	"auth.share-token-not-found": "Share token not found: {id}",
+	"auth.password-incorrect": "Password is incorrect",
+	"auth.session-required": "Requires a signed-in user session",
+	"auth.admin-required": "Admin required",
+	"auth.session-ended": "Session ended — sign in again",
+	"auth.access-denied": "Access denied",
+	"auth.totp-confirm-failed": "TOTP confirmation failed — code did not match",
+	"device.certificates-unavailable": "Device certificates are not available",
+	"device.not-found": "Device {id} not found",
+	"device.credentials-unavailable": "Device credentials not available",
+	"device.credential-not-found": "Device credential not found: {id}",
+	"storage.no-provider": "No storage provider configured",
+	"recording.export-unknown": "Unknown export \"{id}\"",
+	"recording.export-invalid-range": "Invalid time range {fromMs}..{toMs}",
+	"recording.export-no-profiles": "The export needs at least one stream profile",
+	"recording.export-not-ready": "Export \"{id}\" is not ready ({state})",
+	"recording.export-expired": "Export \"{id}\" has expired",
+	"recording.export-no-file": "Export \"{id}\" has no file on disk",
+	"recording.clip-render-unavailable": "Clip rendering is unavailable on this node",
+	"reolink.hub-host-missing": "Reolink Hub: host not configured",
+	"reolink.hub-password-missing": "Reolink Hub: password not configured",
+	"reolink.email-push-hub-attached": "Email push is not available for hub-attached cameras",
+	"reolink.email-push-not-wired": "Email Push Server is not wired — restart the Reolink addon",
+	"reolink.webhook-not-wired": "HaCfg Webhook Server is not wired — restart the Reolink addon",
+	"reolink.webhook-unsupported": "Camera firmware does not support Baichuan HaCfg webhook (cmd 806)",
+	"reolink.preset-invalid": "Invalid presetId: {presetId}",
+	"reolink.home-preset-not-baichuan": "Configured home preset is not a Baichuan id: {presetId}",
+	"reolink.day-night-schedule-unsupported": "Reolink cameras do not support a scheduled day/night mode",
+	"reolink.clip-device-not-reolink": "clip refresh: device {deviceId} is not a Reolink camera here",
+	"notifiers.gotify-server-url-required": "gotify: serverUrl is required",
+	"notifiers.gotify-app-token-required": "gotify: appToken is required",
+	"notifiers.email-to-required": "email: missing required config 'to'",
+	"hikvision.camera-name-required": "Camera name is required",
+	"hikvision.camera-ip-required": "Camera IP is required",
+	"hikvision.password-required": "Password is required",
+	"hikvision.home-preset-missing": "No home preset configured for this camera — set one in the PTZ settings",
+	"amcrest.camera-name-required": "Camera name is required",
+	"amcrest.camera-ip-required": "Camera IP is required",
+	"amcrest.password-required": "Password is required",
+	"amcrest.home-preset-missing": "No home preset configured for this camera — set one in the PTZ settings",
+	"wyze.camera-name-required": "Camera name is required",
+	"wyze.camera-mac-required": "Wyze: cannot persist a camera without a MAC address",
+	"dreame.manual-create-refused": "Dreame devices are adopted from the cloud, not created manually",
+	"rtsp.camera-name-required": "Camera name is required",
+	"rtsp.stream-required": "At least one RTSP stream URL is required",
+	"rtsp.too-many-streams": "At most 3 RTSP stream URLs are supported",
+	"gree.name-required": "Air conditioner name is required",
+	"gree.ip-required": "Air conditioner IP address is required",
+	"ecowitt.name-required": "Gateway name is required",
+	"ecowitt.host-required": "Gateway host is required for local-poll transport",
+	"unifi.name-required": "Controller name is required",
+	"unifi.host-required": "Controller host is required",
+	"vesync.name-required": "Account name is required",
+	"vesync.email-required": "Account email is required",
+	"unraid.name-required": "Server name is required",
+	"unraid.host-required": "Server host is required",
+	"velux.name-required": "Gateway name is required",
+	"velux.host-required": "Gateway host is required",
+	"cloudflare.custom-not-configured": "Custom tunnel not configured — run \"Enable\" from settings first",
+	"cloudflare.custom-needs-settings": "Custom tunnel needs: {missing}. Fill the settings above first.",
+	"cloudflare.zone-token-missing": "listZones: no Cloudflare API token is set",
+	"cloudflare.zone-not-visible": "Selected zone {zoneId} is not visible to this token",
+	"google.from-address-required": "Set From address on the Google broker (or Connect an account).",
+	"google.client-credentials-required": "Configure Client ID and Client secret before refreshing the Google token",
+	"globalSettings.s_alerts.title": "Alert Center",
+	"globalSettings.s_alerts.description": "Configure alert storage and retention.",
+	"globalSettings.s_alerts.maxAlerts.label": "Maximum stored alerts",
+	"globalSettings.s_alerts.maxAlerts.description": "Oldest read alerts are deleted when this limit is exceeded.",
+	"globalSettings.s_alerts.retentionDays.label": "Alert retention (days)",
+	"globalSettings.s_alerts.retentionDays.description": "Alerts older than this are automatically removed.",
+	"globalSettings.s_camera-grids.title": "Camera grids",
+	"globalSettings.s_camera-grids.description": "A grid is a composite camera: several cameras composed into one picture, recorded and played back like any other camera. Create one here with a name; open its camera to lay it out. Object detection is switched OFF on a new grid — the cameras it is composed from are already analysed.",
+	"globalSettings.s_camera-grids.cameraGrids.label": "Grids",
+	"globalSettings.s_camera-grids.cameraGrids.name.label": "Name",
+	"globalSettings.s_camera-grids.cameraGrids.enabled.label": "Enabled",
+	"globalSettings.s_camera-grids.cameraGrids.enabled.description": "A disabled grid withdraws its camera.",
+	"gridDevice.s_camera-grid-layout.title": "Grid layout",
+	"gridDevice.s_camera-grid-layout._gridLayout.label": "",
+	"globalSettings.s_console-logging.title": "Console Logging",
+	"globalSettings.s_console-logging.description": "Minimum log level to emit on stdout/stderr. Independent from the rotated-file (Winston) destination.",
+	"globalSettings.s_console-logging.level.label": "Log Level",
+	"globalSettings.s_console-logging.level.o_debug.label": "Debug",
+	"globalSettings.s_console-logging.level.o_info.label": "Info",
+	"globalSettings.s_console-logging.level.o_warn.label": "Warn",
+	"globalSettings.s_console-logging.level.o_error.label": "Error",
+	"dayNightConfig.dayNight_mode.label": "Mode",
+	"dayNightConfig.dayNight_sensitivity.label": "IR-cut sensitivity",
+	"dayNightConfig.dayNight_switchDelaySec.label": "Switch delay",
+	"section.s_day-night.title": "Day / Night",
+	"section.s_day-night.description": "IR-cut switching mode and the photocell knobs that gate it.",
+	"baseDeviceSection.s_driver-settings-unavailable.title": "Driver Settings",
+	"baseDeviceSection.s_driver-settings-unavailable.driver-settings-unavailable-notice.label": "Temporarily unavailable",
+	"imageSettingsConfig.imageSettings_brightness.label": "Brightness",
+	"imageSettingsConfig.imageSettings_contrast.label": "Contrast",
+	"imageSettingsConfig.imageSettings_saturation.label": "Saturation",
+	"imageSettingsConfig.imageSettings_sharpness.label": "Sharpness",
+	"imageSettingsConfig.imageSettings_mirror.label": "Mirror",
+	"imageSettingsConfig.imageSettings_flip.label": "Flip",
+	"imageSettingsConfig.imageSettings_rotate.label": "Rotation",
+	"imageSettingsConfig.imageSettings_whiteBalance.label": "White balance",
+	"imageSettingsConfig.imageSettings_warmth.label": "Warmth",
+	"imageSettingsConfig.imageSettings_exposureMode.label": "Exposure mode",
+	"imageSettingsConfig.imageSettings_backlightMode.label": "Backlight compensation",
+	"section.s_image-settings.title": "Image adjustment",
+	"section.s_image-settings.description": "Picture sliders, orientation and exposure. Option lists are read live from the camera — fields the firmware doesn't expose are hidden.",
+	"volumesField.id.label": "Id",
+	"volumesField.label.label": "Name",
+	"volumesField.status.label": "Status",
+	"volumesField.capacity.label": "Capacity",
+	"volumesField.free.label": "Free",
+	"tracksField.id.label": "Track",
+	"tracksField.primary.label": "Primary",
+	"tracksField.enabled.label": "Enabled",
+	"tracksField.codec.label": "Codec",
+	"tracksField.resolution.label": "Resolution",
+	"storageSection.s_recording-onboard-storage.title": "Camera storage",
+	"storageSection.s_recording-onboard-storage.description": "The card in the camera, as the camera itself describes it.",
+	"recordingSection.s_recording-onboard-recording.title": "Camera recording",
+	"recordingSection.s_recording-onboard-recording.description": "What the camera records to its own card. This writes the camera, not CamStack's recorder.",
+	"globalSettings.s_local-access.title": "LAN HTTP",
+	"globalSettings.s_local-access.description": "Native apps on this Wi-Fi use http:// and skip the private certificate. The tunnel and this admin UI stay on HTTPS. Turn off once a publicly-trusted certificate covers the LAN name.",
+	"globalSettings.s_local-access.httpEnabled.label": "Enable HTTP on the LAN",
+	"globalSettings.s_local-access.httpPort.label": "HTTP port",
+	"globalSettings.s_local-access.httpPort.description": "Dedicated listener. Must not equal the HTTPS port (4443 by default).",
+	"globalSettings.s_local-access.mdnsAdvertise.label": "Announce this hub on the LAN (mDNS)",
+	"globalSettings.s_local-access.mdnsAdvertise.description": "Lets `camstack login` find the hub without an address. Advertises only the HTTPS address, never a secret. Needs UDP 5353 multicast to reach the LAN (host networking or a dedicated container IP).",
+	"globalSettings.s_local-access.localHostname.label": "Local hostname",
+	"globalSettings.s_local-access.localHostname.description": "Advertised to the viewer instead of the raw LAN IP, and added to the certificate SAN. Requires this name to resolve on the LAN (router DNS, mDNS, or a hosts file). Leave empty to keep using the IP.",
+	"globalSettings.s_loki-logging.title": "Loki",
+	"globalSettings.s_loki-logging.description": "Ship this node’s logs to a Grafana Loki instance. Independent of the rotated-file and console destinations. Turn it on or off with the Enable/Disable control on this destination — the same one every other destination uses.",
+	"globalSettings.s_loki-logging.url.label": "Loki URL",
+	"globalSettings.s_loki-logging.url.description": "Base URL, e.g. http://loki:3100 — the /loki/api/v1/push path is added.",
+	"globalSettings.s_loki-logging.level.label": "Minimum level",
+	"globalSettings.s_loki-logging.level.o_debug.label": "Debug",
+	"globalSettings.s_loki-logging.level.o_info.label": "Info",
+	"globalSettings.s_loki-logging.level.o_warn.label": "Warn",
+	"globalSettings.s_loki-logging.level.o_error.label": "Error",
+	"globalSettings.s_loki-logging.job.label": "Job label",
+	"globalSettings.s_loki-logging.job.description": "The Loki `job` label. Keep it fixed — labels are indexed.",
+	"globalSettings.s_loki-logging.extraLabels.label": "Extra labels",
+	"globalSettings.s_loki-logging.extraLabels.description": "Static `key=value,key2=value2`. Low-cardinality only: per-entry values belong in the line body, and a high-cardinality label will bring Loki down.",
+	"globalSettings.s_loki-logging.tenantId.label": "Tenant ID",
+	"globalSettings.s_loki-logging.tenantId.description": "Sent as X-Scope-OrgID. Required by Grafana Cloud and multi-tenant Loki.",
+	"globalSettings.s_loki-logging.username.label": "Username",
+	"globalSettings.s_loki-logging.username.description": "HTTP basic auth. Leave empty for none.",
+	"globalSettings.s_loki-logging.password.label": "Password",
+	"globalSettings.s_loki-logging.batchIntervalMs.label": "Flush interval",
+	"globalSettings.s_loki-logging.batchIntervalMs.description": "How often a partial batch is pushed.",
+	"globalSettings.s_loki-logging.batchSize.label": "Batch size",
+	"globalSettings.s_loki-logging.batchSize.description": "Push early once this many entries are queued.",
+	"globalSettings.s_loki-logging.timeoutMs.label": "Request timeout",
+	"globalSettings.s_native-metrics-settings.title": "System Metrics",
+	"globalSettings.s_native-metrics-settings.samplingIntervalMs.label": "Sampling Interval",
+	"globalSettings.s_native-metrics-settings.samplingIntervalMs.description": "How often to collect system metrics",
+	"globalSettings.s_native-metrics-load-series.title": "Load history",
+	"globalSettings.s_native-metrics-load-series.loadSeriesCadenceSec.label": "Sampling cadence",
+	"globalSettings.s_native-metrics-load-series.loadSeriesCadenceSec.description": "How often every node reports its process tree. FIXED — a sample is emitted on every interval whether or not anything changed, so a gap in the chart means one thing only: nobody reported. Outside 5-60 s the value is refused.",
+	"globalSettings.s_native-metrics-load-series.loadSeriesRetentionHours.label": "Retention",
+	"globalSettings.s_native-metrics-load-series.loadSeriesRetentionHours.description": "How long the load history is kept on disk (the hub database, on the NVMe cache — never the recordings disk). This is the INTENTION; the row cap below is the guarantee.",
+	"globalSettings.s_native-metrics-load-series.load-series-cost.label": "What this configuration costs",
+	"globalSettings.s_native-metrics-load-series.load-series-cap.label": "Hard row cap",
+	"globalSettings.s_snapshot-cache.title": "Snapshot Cache",
+	"globalSettings.s_snapshot-cache.description": "Stale fallback when live capture fails. Per-device freshness is configured under Device → Snapshot → Max cache age.",
+	"globalSettings.s_snapshot-cache.staleTtlMs.label": "Stale fallback TTL (ms)",
+	"globalSettings.s_snapshot-cache.staleTtlMs.description": "If live capture fails, cached snapshot younger than this is still returned.",
+	"deviceSettingsContribution.s_snapshot-preferences.title": "Snapshot",
+	"deviceSettingsContribution.s_snapshot-preferences.snapshotStreamId.label": "Preferred stream",
+	"deviceSettingsContribution.s_snapshot-preferences.snapshotStreamId.description": "Stream used when grabbing a snapshot",
+	"deviceSettingsContribution.s_snapshot-preferences.snapshotMaxAgeS.label": "Max cache age (s)",
+	"deviceSettingsContribution.s_snapshot-preferences.snapshotDebug.label": "Debug logging",
+	"deviceSettingsContribution.s_snapshot-preferences.snapshotDebug.description": "Log stream selection and timing details for this device.",
+	"providerInfo.s_filesystem-storage.title": "Filesystem",
+	"providerInfo.s_filesystem-storage.basePath.label": "Base path",
+	"providerInfo.s_filesystem-storage.basePath.description": "Absolute directory path where files are stored.",
+	"global.s_system-config-server.description": "The name of this server, and its connection settings (read-only, loaded from config.yaml at bootstrap).",
+	"global.s_system-config-server.server-restart-note.label": "Restart required",
+	"global.s_system-config-server.port.label": "Port",
+	"global.s_system-config-server.port.description": "Listening port",
+	"global.s_system-config-server.host.label": "Host",
+	"global.s_system-config-server.host.description": "Bind address",
+	"global.s_system-config-server.dataPath.label": "Data Path",
+	"global.s_system-config-server.dataPath.description": "Root data directory",
+	"global.s_system-config-auth.description": "Token and session settings.",
+	"global.s_system-config-auth.tokenExpiry.label": "Session lifetime",
+	"global.s_system-config-auth.tokenExpiry.description": "How long a sign-in lasts without being used, as a duration string (e.g. 7d, 30d). Every refresh starts it again, so a device in use stays signed in; one left unopened this long must sign in again. A bare number is rejected — it would be read as milliseconds. Applies from the next sign-in or refresh.",
+	"global.s_system-config-auth.accessTokenExpiry.label": "Access token lifetime",
+	"global.s_system-config-auth.accessTokenExpiry.description": "How long one access token lives before the app silently swaps it for a new one (e.g. 2h; between 5m and 24h, never longer than the session). Shorter limits how long a copied token is useful. Apps that predate refresh tokens get one token for the whole session instead.",
+	"global.s_system-config-auth.trustedProxies.label": "Trusted reverse proxies",
+	"global.s_system-config-auth.trustedProxies.description": "Addresses or CIDR ranges (e.g. 192.168.1.2 or 10.0.0.0/24) of reverse proxies in front of the hub. Only a request whose direct sender is one of these — or this host itself, as with the Cloudflare tunnel — has its X-Forwarded-For / CF-Connecting-IP read as the real client address for rate limits. Leave empty unless a proxy on another host forwards to the hub.",
+	"global.s_system-config-auth.trustedNetworksWarning.label": "Skipping two-factor authentication",
+	"global.s_system-config-auth.trustedNetworks.label": "Trusted networks (skip the second factor)",
+	"global.s_system-config-auth.trustedNetworks.description": "Addresses or CIDR ranges, e.g. 192.168.1.0/24. Keep it as narrow as you can — a single trusted VLAN, not the whole LAN.",
+	"globalSettings.s_winston-logging.title": "Logging",
+	"globalSettings.s_winston-logging.description": "Global log verbosity + retention for rotated log files on this node.",
+	"globalSettings.s_winston-logging.level.label": "Log Level",
+	"globalSettings.s_winston-logging.level.o_debug.label": "Debug",
+	"globalSettings.s_winston-logging.level.o_info.label": "Info",
+	"globalSettings.s_winston-logging.level.o_warn.label": "Warn",
+	"globalSettings.s_winston-logging.level.o_error.label": "Error",
+	"globalSettings.s_winston-logging.retentionDays.label": "Retention (days)",
+	"globalSettings.s_winston-logging.retentionDays.description": "Number of days to keep rotated log files before deletion",
+	"system.python-required": "Python 3.10+ is required but not found on this system",
+	"system.device-enrollment-busy": "Too many pending device enrollments — try again shortly",
+	"system.admin-token-expiry-too-long": "An admin token must expire within 90 days",
+	"system.admin-token-name-required": "An admin token needs a name",
+	"system.user-exists": "User with username \"{username}\" already exists",
+	"system.user-not-found": "User with id \"{id}\" not found",
+	"system.addon-no-discovery": "Addon \"{addonId}\" does not support device discovery",
+	"system.addon-no-adoption": "Addon \"{addonId}\" does not support device adoption",
+	"system.addon-no-manual-create": "Addon \"{addonId}\" does not support manual device creation",
+	"system.location-name-required": "[device-manager] addLocation: name must be non-empty",
+	"system.location-required": "[device-manager] setLocationIcon: location must be non-empty",
+	"system.site-zone-name-required": "[device-manager] setSiteZone: name must be non-empty",
+	"server.handoff-busy": "Too many pending handoff codes — try again shortly",
+	"server.app-confirmations-busy": "Too many pending app confirmations",
+	"server.step-up-busy": "Too many pending step-up proofs",
+	"server.login-unavailable": "Login unavailable — `user-management` capability not registered",
+	"server.share-token-expired": "Share token expired: {id}",
+	"server.package-not-allowed": "Package \"{name}\" is not an allowed @camstack/* package",
+	"server.package-protected": "Cannot uninstall protected package \"{name}\"",
+	"server.package-required": "Package {packageName} is required and cannot be uninstalled"
+};
+//#endregion
+//#region src/i18n/it.json
+var it_default = {
+	"auth.invalid-credentials": "Credenziali non valide",
+	"auth.invalid-totp": "Codice TOTP non valido",
+	"auth.not-authenticated": "Non autenticato",
+	"auth.login-challenge-expired": "Richiesta di accesso non valida o scaduta — reinserisci la password",
+	"auth.passkey-verification-failed": "Verifica della passkey non riuscita",
+	"auth.user-gone": "L'utente non esiste più",
+	"auth.no-session-cookie": "Nessun cookie di sessione",
+	"auth.invalid-session-cookie": "Cookie di sessione non valido",
+	"auth.handoff-code-invalid": "Codice di passaggio non valido o scaduto",
+	"auth.share-never-expiring-extend": "Un token di condivisione senza scadenza non può essere prorogato",
+	"auth.share-owner-only-extend": "Solo il proprietario del token o un amministratore può prorogare un token di condivisione",
+	"auth.share-owner-only-revoke": "Solo il proprietario del token o un amministratore può revocare un token di condivisione",
+	"auth.share-token-not-found": "Token di condivisione non trovato: {id}",
+	"auth.password-incorrect": "La password non è corretta",
+	"auth.session-required": "Serve una sessione utente con accesso effettuato",
+	"auth.admin-required": "Serve un amministratore",
+	"auth.session-ended": "Sessione terminata — accedi di nuovo",
+	"auth.access-denied": "Accesso negato",
+	"auth.totp-confirm-failed": "Conferma TOTP non riuscita — il codice non corrisponde",
+	"device.certificates-unavailable": "I certificati dei dispositivi non sono disponibili",
+	"device.not-found": "Dispositivo {id} non trovato",
+	"device.credentials-unavailable": "Le credenziali del dispositivo non sono disponibili",
+	"device.credential-not-found": "Credenziale del dispositivo non trovata: {id}",
+	"storage.no-provider": "Nessun provider di archiviazione configurato",
+	"recording.export-unknown": "Esportazione \"{id}\" sconosciuta",
+	"recording.export-invalid-range": "Intervallo di tempo non valido {fromMs}..{toMs}",
+	"recording.export-no-profiles": "L'esportazione richiede almeno un profilo di flusso",
+	"recording.export-not-ready": "L'esportazione \"{id}\" non è pronta ({state})",
+	"recording.export-expired": "L'esportazione \"{id}\" è scaduta",
+	"recording.export-no-file": "L'esportazione \"{id}\" non ha alcun file su disco",
+	"recording.clip-render-unavailable": "La creazione delle clip non è disponibile su questo nodo",
+	"reolink.hub-host-missing": "Hub Reolink: host non configurato",
+	"reolink.hub-password-missing": "Hub Reolink: password non configurata",
+	"reolink.email-push-hub-attached": "Email push non è disponibile per le telecamere collegate a un hub",
+	"reolink.email-push-not-wired": "Il server Email Push non è collegato — riavvia l'addon Reolink",
+	"reolink.webhook-not-wired": "Il server webhook HaCfg non è collegato — riavvia l'addon Reolink",
+	"reolink.webhook-unsupported": "Il firmware della telecamera non supporta il webhook HaCfg Baichuan (cmd 806)",
+	"reolink.preset-invalid": "presetId non valido: {presetId}",
+	"reolink.home-preset-not-baichuan": "Il preset home configurato non è un id Baichuan: {presetId}",
+	"reolink.day-night-schedule-unsupported": "Le telecamere Reolink non supportano una modalità giorno/notte programmata",
+	"reolink.clip-device-not-reolink": "aggiornamento clip: il dispositivo {deviceId} non è una telecamera Reolink qui",
+	"notifiers.gotify-server-url-required": "gotify: serverUrl è obbligatorio",
+	"notifiers.gotify-app-token-required": "gotify: appToken è obbligatorio",
+	"notifiers.email-to-required": "email: manca la configurazione obbligatoria 'to'",
+	"hikvision.camera-name-required": "Il nome della telecamera è obbligatorio",
+	"hikvision.camera-ip-required": "L'IP della telecamera è obbligatorio",
+	"hikvision.password-required": "La password è obbligatoria",
+	"hikvision.home-preset-missing": "Nessun preset home configurato per questa telecamera — impostane uno nelle impostazioni PTZ",
+	"amcrest.camera-name-required": "Il nome della telecamera è obbligatorio",
+	"amcrest.camera-ip-required": "L'IP della telecamera è obbligatorio",
+	"amcrest.password-required": "La password è obbligatoria",
+	"amcrest.home-preset-missing": "Nessun preset home configurato per questa telecamera — impostane uno nelle impostazioni PTZ",
+	"wyze.camera-name-required": "Il nome della telecamera è obbligatorio",
+	"wyze.camera-mac-required": "Wyze: impossibile salvare una telecamera senza indirizzo MAC",
+	"dreame.manual-create-refused": "I dispositivi Dreame si acquisiscono dal cloud, non si creano a mano",
+	"rtsp.camera-name-required": "Il nome della telecamera è obbligatorio",
+	"rtsp.stream-required": "È richiesto almeno un URL di flusso RTSP",
+	"rtsp.too-many-streams": "Sono supportati al massimo 3 URL di flusso RTSP",
+	"gree.name-required": "Il nome del condizionatore è obbligatorio",
+	"gree.ip-required": "L'indirizzo IP del condizionatore è obbligatorio",
+	"ecowitt.name-required": "Il nome del gateway è obbligatorio",
+	"ecowitt.host-required": "L'host del gateway è obbligatorio per la lettura locale",
+	"unifi.name-required": "Il nome del controller è obbligatorio",
+	"unifi.host-required": "L'host del controller è obbligatorio",
+	"vesync.name-required": "Il nome dell'account è obbligatorio",
+	"vesync.email-required": "L'email dell'account è obbligatoria",
+	"unraid.name-required": "Il nome del server è obbligatorio",
+	"unraid.host-required": "L'host del server è obbligatorio",
+	"velux.name-required": "Il nome del gateway è obbligatorio",
+	"velux.host-required": "L'host del gateway è obbligatorio",
+	"cloudflare.custom-not-configured": "Tunnel personalizzato non configurato — avvia «Attiva» dalle impostazioni",
+	"cloudflare.custom-needs-settings": "Il tunnel personalizzato richiede: {missing}. Compila prima le impostazioni qui sopra.",
+	"cloudflare.zone-token-missing": "listZones: nessun token API Cloudflare impostato",
+	"cloudflare.zone-not-visible": "La zona selezionata {zoneId} non è visibile a questo token",
+	"google.from-address-required": "Imposta l'indirizzo del mittente sul broker Google (oppure collega un account).",
+	"google.client-credentials-required": "Configura ID client e segreto del client prima di aggiornare il token Google",
+	"globalSettings.s_alerts.title": "Centro avvisi",
+	"globalSettings.s_alerts.description": "Configura l'archiviazione e la conservazione degli avvisi.",
+	"globalSettings.s_alerts.maxAlerts.label": "Numero massimo di avvisi memorizzati",
+	"globalSettings.s_alerts.maxAlerts.description": "Quando si supera questo limite vengono eliminati gli avvisi letti più vecchi.",
+	"globalSettings.s_alerts.retentionDays.label": "Conservazione degli avvisi (giorni)",
+	"globalSettings.s_alerts.retentionDays.description": "Gli avvisi più vecchi di questo valore vengono rimossi automaticamente.",
+	"globalSettings.s_camera-grids.title": "Griglie di telecamere",
+	"globalSettings.s_camera-grids.description": "Una griglia è una telecamera composita: più telecamere unite in un'unica immagine, registrata e riprodotta come qualsiasi altra telecamera. Creane una qui con un nome; apri la sua telecamera per disporne i riquadri. Il rilevamento oggetti è DISATTIVATO su una nuova griglia, perché le telecamere che la compongono sono già analizzate.",
+	"globalSettings.s_camera-grids.cameraGrids.label": "Griglie",
+	"globalSettings.s_camera-grids.cameraGrids.name.label": "Nome",
+	"globalSettings.s_camera-grids.cameraGrids.enabled.label": "Attiva",
+	"globalSettings.s_camera-grids.cameraGrids.enabled.description": "Una griglia disattivata ritira la sua telecamera.",
+	"gridDevice.s_camera-grid-layout.title": "Disposizione della griglia",
+	"gridDevice.s_camera-grid-layout._gridLayout.label": "",
+	"globalSettings.s_console-logging.title": "Log su console",
+	"globalSettings.s_console-logging.description": "Livello minimo di log da emettere su stdout/stderr. Indipendente dalla destinazione su file ruotati (Winston).",
+	"globalSettings.s_console-logging.level.label": "Livello di log",
+	"globalSettings.s_console-logging.level.o_debug.label": "Debug",
+	"globalSettings.s_console-logging.level.o_info.label": "Info",
+	"globalSettings.s_console-logging.level.o_warn.label": "Avviso",
+	"globalSettings.s_console-logging.level.o_error.label": "Errore",
+	"dayNightConfig.dayNight_mode.label": "Modalità",
+	"dayNightConfig.dayNight_sensitivity.label": "Sensibilità del filtro IR-cut",
+	"dayNightConfig.dayNight_switchDelaySec.label": "Ritardo di commutazione",
+	"section.s_day-night.title": "Giorno / Notte",
+	"section.s_day-night.description": "Modalità di commutazione del filtro IR-cut e i parametri della fotocellula che la regolano.",
+	"baseDeviceSection.s_driver-settings-unavailable.title": "Impostazioni del driver",
+	"baseDeviceSection.s_driver-settings-unavailable.driver-settings-unavailable-notice.label": "Temporaneamente non disponibile",
+	"imageSettingsConfig.imageSettings_brightness.label": "Luminosità",
+	"imageSettingsConfig.imageSettings_contrast.label": "Contrasto",
+	"imageSettingsConfig.imageSettings_saturation.label": "Saturazione",
+	"imageSettingsConfig.imageSettings_sharpness.label": "Nitidezza",
+	"imageSettingsConfig.imageSettings_mirror.label": "Specchio",
+	"imageSettingsConfig.imageSettings_flip.label": "Capovolgi",
+	"imageSettingsConfig.imageSettings_rotate.label": "Rotazione",
+	"imageSettingsConfig.imageSettings_whiteBalance.label": "Bilanciamento del bianco",
+	"imageSettingsConfig.imageSettings_warmth.label": "Calore",
+	"imageSettingsConfig.imageSettings_exposureMode.label": "Modalità di esposizione",
+	"imageSettingsConfig.imageSettings_backlightMode.label": "Compensazione del controluce",
+	"section.s_image-settings.title": "Regolazione immagine",
+	"section.s_image-settings.description": "Cursori dell'immagine, orientamento ed esposizione. Gli elenchi delle opzioni sono letti in tempo reale dalla telecamera: i campi che il firmware non espone sono nascosti.",
+	"volumesField.id.label": "ID",
+	"volumesField.label.label": "Nome",
+	"volumesField.status.label": "Stato",
+	"volumesField.capacity.label": "Capacità",
+	"volumesField.free.label": "Libero",
+	"tracksField.id.label": "Traccia",
+	"tracksField.primary.label": "Principale",
+	"tracksField.enabled.label": "Attiva",
+	"tracksField.codec.label": "Codec",
+	"tracksField.resolution.label": "Risoluzione",
+	"storageSection.s_recording-onboard-storage.title": "Memoria della telecamera",
+	"storageSection.s_recording-onboard-storage.description": "La scheda nella telecamera, come la descrive la telecamera stessa.",
+	"recordingSection.s_recording-onboard-recording.title": "Registrazione sulla telecamera",
+	"recordingSection.s_recording-onboard-recording.description": "Ciò che la telecamera registra sulla propria scheda. Questo configura la telecamera, non il registratore di CamStack.",
+	"globalSettings.s_local-access.title": "HTTP sulla LAN",
+	"globalSettings.s_local-access.description": "Le app native su questo Wi-Fi usano http:// e saltano il certificato privato. Il tunnel e questa interfaccia restano su HTTPS. Disattivalo quando un certificato pubblicamente attendibile copre il nome della LAN.",
+	"globalSettings.s_local-access.httpEnabled.label": "Attiva HTTP sulla LAN",
+	"globalSettings.s_local-access.httpPort.label": "Porta HTTP",
+	"globalSettings.s_local-access.httpPort.description": "Listener dedicato. Non deve coincidere con la porta HTTPS (4443 per impostazione predefinita).",
+	"globalSettings.s_local-access.mdnsAdvertise.label": "Annuncia questo hub sulla LAN (mDNS)",
+	"globalSettings.s_local-access.mdnsAdvertise.description": "Permette a `camstack login` di trovare l'hub senza indirizzo. Annuncia solo l'indirizzo HTTPS, mai un segreto. Richiede il multicast UDP 5353 per raggiungere la LAN (rete host o IP dedicato del container).",
+	"globalSettings.s_local-access.localHostname.label": "Nome host locale",
+	"globalSettings.s_local-access.localHostname.description": "Annunciato al visualizzatore al posto dell'IP LAN grezzo e aggiunto al SAN del certificato. Richiede che questo nome si risolva sulla LAN (DNS del router, mDNS o file hosts). Lascia vuoto per continuare a usare l'IP.",
+	"globalSettings.s_loki-logging.title": "Loki",
+	"globalSettings.s_loki-logging.description": "Invia i log di questo nodo a un'istanza Grafana Loki. Indipendente dalle destinazioni su file ruotati e su console. Attivala o disattivala con il controllo Attiva/Disattiva di questa destinazione, lo stesso usato da tutte le altre.",
+	"globalSettings.s_loki-logging.url.label": "URL di Loki",
+	"globalSettings.s_loki-logging.url.description": "URL base, ad es. http://loki:3100: il percorso /loki/api/v1/push viene aggiunto.",
+	"globalSettings.s_loki-logging.level.label": "Livello minimo",
+	"globalSettings.s_loki-logging.level.o_debug.label": "Debug",
+	"globalSettings.s_loki-logging.level.o_info.label": "Info",
+	"globalSettings.s_loki-logging.level.o_warn.label": "Avviso",
+	"globalSettings.s_loki-logging.level.o_error.label": "Errore",
+	"globalSettings.s_loki-logging.job.label": "Etichetta job",
+	"globalSettings.s_loki-logging.job.description": "L'etichetta `job` di Loki. Tienila fissa: le etichette sono indicizzate.",
+	"globalSettings.s_loki-logging.extraLabels.label": "Etichette aggiuntive",
+	"globalSettings.s_loki-logging.extraLabels.description": "`chiave=valore,chiave2=valore2` statici. Solo a bassa cardinalità: i valori per singola voce vanno nel corpo della riga, e un'etichetta ad alta cardinalità manderà in crisi Loki.",
+	"globalSettings.s_loki-logging.tenantId.label": "ID tenant",
+	"globalSettings.s_loki-logging.tenantId.description": "Inviato come X-Scope-OrgID. Richiesto da Grafana Cloud e da Loki multi-tenant.",
+	"globalSettings.s_loki-logging.username.label": "Nome utente",
+	"globalSettings.s_loki-logging.username.description": "Autenticazione HTTP basic. Lascia vuoto se non serve.",
+	"globalSettings.s_loki-logging.password.label": "Password",
+	"globalSettings.s_loki-logging.batchIntervalMs.label": "Intervallo di invio",
+	"globalSettings.s_loki-logging.batchIntervalMs.description": "Ogni quanto viene inviato un lotto parziale.",
+	"globalSettings.s_loki-logging.batchSize.label": "Dimensione del lotto",
+	"globalSettings.s_loki-logging.batchSize.description": "Invia in anticipo quando sono in coda così tante voci.",
+	"globalSettings.s_loki-logging.timeoutMs.label": "Timeout della richiesta",
+	"globalSettings.s_native-metrics-settings.title": "Metriche di sistema",
+	"globalSettings.s_native-metrics-settings.samplingIntervalMs.label": "Intervallo di campionamento",
+	"globalSettings.s_native-metrics-settings.samplingIntervalMs.description": "Ogni quanto raccogliere le metriche di sistema",
+	"globalSettings.s_native-metrics-load-series.title": "Storico del carico",
+	"globalSettings.s_native-metrics-load-series.loadSeriesCadenceSec.label": "Cadenza di campionamento",
+	"globalSettings.s_native-metrics-load-series.loadSeriesCadenceSec.description": "Ogni quanto ogni nodo riporta il proprio albero di processi. FISSO: un campione viene emesso a ogni intervallo, che qualcosa sia cambiato o no, quindi un buco nel grafico significa una sola cosa: nessuno ha riportato. Fuori dall'intervallo 5-60 s il valore viene rifiutato.",
+	"globalSettings.s_native-metrics-load-series.loadSeriesRetentionHours.label": "Conservazione",
+	"globalSettings.s_native-metrics-load-series.loadSeriesRetentionHours.description": "Per quanto tempo lo storico del carico viene conservato su disco (il database dell'hub, sulla cache NVMe, mai sul disco delle registrazioni). Questa è l'INTENZIONE; il limite di righe qui sotto è la garanzia.",
+	"globalSettings.s_native-metrics-load-series.load-series-cost.label": "Costo di questa configurazione",
+	"globalSettings.s_native-metrics-load-series.load-series-cap.label": "Limite rigido di righe",
+	"globalSettings.s_snapshot-cache.title": "Cache degli snapshot",
+	"globalSettings.s_snapshot-cache.description": "Ripiego obsoleto quando la cattura dal vivo fallisce. La freschezza per dispositivo si configura in Dispositivo → Snapshot → Età massima della cache.",
+	"globalSettings.s_snapshot-cache.staleTtlMs.label": "TTL del ripiego obsoleto (ms)",
+	"globalSettings.s_snapshot-cache.staleTtlMs.description": "Se la cattura dal vivo fallisce, viene comunque restituito uno snapshot in cache più recente di questo valore.",
+	"deviceSettingsContribution.s_snapshot-preferences.title": "Snapshot",
+	"deviceSettingsContribution.s_snapshot-preferences.snapshotStreamId.label": "Flusso preferito",
+	"deviceSettingsContribution.s_snapshot-preferences.snapshotStreamId.description": "Flusso usato per acquisire uno snapshot",
+	"deviceSettingsContribution.s_snapshot-preferences.snapshotMaxAgeS.label": "Età massima della cache (s)",
+	"deviceSettingsContribution.s_snapshot-preferences.snapshotDebug.label": "Log di debug",
+	"deviceSettingsContribution.s_snapshot-preferences.snapshotDebug.description": "Registra la scelta del flusso e i tempi per questo dispositivo.",
+	"providerInfo.s_filesystem-storage.title": "File system",
+	"providerInfo.s_filesystem-storage.basePath.label": "Percorso base",
+	"providerInfo.s_filesystem-storage.basePath.description": "Percorso assoluto della cartella dove vengono salvati i file.",
+	"global.s_system-config-server.description": "Il nome di questo server e le sue impostazioni di connessione (sola lettura, caricate da config.yaml all'avvio).",
+	"global.s_system-config-server.server-restart-note.label": "Riavvio necessario",
+	"global.s_system-config-server.port.label": "Porta",
+	"global.s_system-config-server.port.description": "Porta di ascolto",
+	"global.s_system-config-server.host.label": "Host",
+	"global.s_system-config-server.host.description": "Indirizzo di bind",
+	"global.s_system-config-server.dataPath.label": "Percorso dei dati",
+	"global.s_system-config-server.dataPath.description": "Cartella radice dei dati",
+	"global.s_system-config-auth.description": "Impostazioni di token e sessione.",
+	"global.s_system-config-auth.tokenExpiry.label": "Durata della sessione",
+	"global.s_system-config-auth.tokenExpiry.description": "Per quanto tempo resta valido un accesso senza essere usato, come stringa di durata (ad es. 7d, 30d). Ogni rinnovo lo fa ripartire, quindi un dispositivo in uso resta connesso; uno lasciato inutilizzato per questo tempo deve accedere di nuovo. Un numero senza unità viene rifiutato: sarebbe letto come millisecondi. Si applica dal prossimo accesso o rinnovo.",
+	"global.s_system-config-auth.accessTokenExpiry.label": "Durata del token di accesso",
+	"global.s_system-config-auth.accessTokenExpiry.description": "Per quanto vive un token di accesso prima che l'app lo sostituisca in silenzio con uno nuovo (ad es. 2h; tra 5m e 24h, mai più della sessione). Più breve significa che un token copiato è utile per meno tempo. Le app precedenti ai token di rinnovo ricevono invece un unico token per tutta la sessione.",
+	"global.s_system-config-auth.trustedProxies.label": "Reverse proxy fidati",
+	"global.s_system-config-auth.trustedProxies.description": "Indirizzi o intervalli CIDR (ad es. 192.168.1.2 o 10.0.0.0/24) dei reverse proxy davanti all'hub. Solo una richiesta il cui mittente diretto è uno di questi, o questo stesso host come con il tunnel Cloudflare, ha X-Forwarded-For / CF-Connecting-IP letto come indirizzo reale del client per i limiti di frequenza. Lascia vuoto a meno che un proxy su un altro host inoltri verso l'hub.",
+	"global.s_system-config-auth.trustedNetworksWarning.label": "Salto dell'autenticazione a due fattori",
+	"global.s_system-config-auth.trustedNetworks.label": "Reti fidate (salta il secondo fattore)",
+	"global.s_system-config-auth.trustedNetworks.description": "Indirizzi o intervalli CIDR, ad es. 192.168.1.0/24. Mantienili il più stretti possibile: una singola VLAN fidata, non tutta la LAN.",
+	"globalSettings.s_winston-logging.title": "Log",
+	"globalSettings.s_winston-logging.description": "Dettaglio globale dei log e conservazione dei file di log ruotati su questo nodo.",
+	"globalSettings.s_winston-logging.level.label": "Livello di log",
+	"globalSettings.s_winston-logging.level.o_debug.label": "Debug",
+	"globalSettings.s_winston-logging.level.o_info.label": "Info",
+	"globalSettings.s_winston-logging.level.o_warn.label": "Avviso",
+	"globalSettings.s_winston-logging.level.o_error.label": "Errore",
+	"globalSettings.s_winston-logging.retentionDays.label": "Conservazione (giorni)",
+	"globalSettings.s_winston-logging.retentionDays.description": "Numero di giorni per cui conservare i file di log ruotati prima dell'eliminazione",
+	"system.python-required": "Serve Python 3.10 o successivo, ma non è stato trovato su questo sistema",
+	"system.device-enrollment-busy": "Troppe registrazioni di dispositivi in attesa — riprova tra poco",
+	"system.admin-token-expiry-too-long": "Un token amministratore deve scadere entro 90 giorni",
+	"system.admin-token-name-required": "Un token amministratore richiede un nome",
+	"system.user-exists": "Esiste già un utente con nome utente \"{username}\"",
+	"system.user-not-found": "Utente con ID \"{id}\" non trovato",
+	"system.addon-no-discovery": "L'addon \"{addonId}\" non supporta il rilevamento dei dispositivi",
+	"system.addon-no-adoption": "L'addon \"{addonId}\" non supporta l'acquisizione dei dispositivi",
+	"system.addon-no-manual-create": "L'addon \"{addonId}\" non supporta la creazione manuale di dispositivi",
+	"system.location-name-required": "Il nome del luogo non può essere vuoto",
+	"system.location-required": "Il luogo non può essere vuoto",
+	"system.site-zone-name-required": "Il nome della zona non può essere vuoto",
+	"server.handoff-busy": "Troppi codici di passaggio in attesa — riprova tra poco",
+	"server.app-confirmations-busy": "Troppe conferme di app in attesa",
+	"server.step-up-busy": "Troppe verifiche di sicurezza in attesa",
+	"server.login-unavailable": "Accesso non disponibile — la capacità `user-management` non è registrata",
+	"server.share-token-expired": "Token di condivisione scaduto: {id}",
+	"server.package-not-allowed": "Il pacchetto \"{name}\" non è un pacchetto @camstack/* consentito",
+	"server.package-protected": "Impossibile disinstallare il pacchetto protetto \"{name}\"",
+	"server.package-required": "Il pacchetto {packageName} è necessario e non può essere disinstallato"
+};
+//#endregion
+//#region src/i18n/catalog-registry.ts
+/**
+* The hub's translation catalogs (D863).
+*
+* Core namespace `server` ships inside this package (`en.json` / `it.json`:
+* user-facing error texts + core schema labels). Every installed addon may add
+* `i18n/<lang>.json` in its package directory; its namespace is its addon id.
+* Every file is validated with zod; a broken file is logged and ignored, never
+* fatal - the English text that travels beside every key is the floor.
+*/
+/** The core namespace: user-facing error texts and core schema labels. */
+var SERVER_NAMESPACE = "server";
+/** `@camstack/addon-provider-reolink` -> `provider-reolink`; `@camstack/system` -> `system`. */
+function catalogNamespaceOf(packageName) {
+	return packageName.replace(/^@camstack\//, "").replace(/^addon-/, "");
+}
+var CatalogRegistry = class {
+	warn;
+	namespaces = /* @__PURE__ */ new Map();
+	constructor(warn = () => void 0) {
+		this.warn = warn;
+	}
+	/** Validates `raw` and installs it; returns false (after warning) when it is not a flat string map. */
+	set(ns, lang, raw, origin) {
+		const parsed = CatalogFileSchema.safeParse(raw);
+		if (!parsed.success) {
+			this.warn(`i18n catalog ignored (${origin}): ${parsed.error.issues[0]?.message ?? "invalid"}`);
+			return false;
+		}
+		const langs = this.namespaces.get(ns) ?? /* @__PURE__ */ new Map();
+		langs.set(lang, parsed.data);
+		this.namespaces.set(ns, langs);
+		return true;
+	}
+	/** Loads `<packageDir>/i18n/<lang>.json` for every language that has a file. */
+	loadAddonDir(ns, packageDir) {
+		for (const lang of CATALOG_LANGS) {
+			const file = path$1.join(packageDir, "i18n", `${lang}.json`);
+			let text;
+			try {
+				text = fs.readFileSync(file, "utf8");
+			} catch {
+				continue;
+			}
+			try {
+				this.set(ns, lang, JSON.parse(text), file);
+			} catch (err) {
+				this.warn(`i18n catalog ignored (${file}): ${err instanceof Error ? err.message : "bad JSON"}`);
+			}
+		}
+	}
+	/** Drops a namespace (addon uninstalled or redeployed before a reload). */
+	clear(ns) {
+		this.namespaces.delete(ns);
+	}
+	/** The text for `ns:key` in `lang`, or `undefined`. Never falls back across languages. */
+	lookup(lang, ns, key) {
+		return this.namespaces.get(ns)?.get(lang)?.[key];
+	}
+	/**
+	* `t(ns, key, params, fallbackEnglish)` - the translation in `lang`, else
+	* the English fallback (also interpolated). English is never looked up: the
+	* fallback IS the English text.
+	*/
+	t(lang, ns, key, params, fallbackEnglish) {
+		return interpolate((lang === "en" ? void 0 : this.lookup(lang, ns, key)) ?? fallbackEnglish, params);
+	}
+	/** A lookup bound to one language, for `localizeConfigTree`. English never substitutes. */
+	lookupFor(lang) {
+		return (ns, key) => lang === "en" ? void 0 : this.lookup(lang, ns, key);
+	}
+	/** `t` for a `"ns:key"` reference. */
+	tRef(lang, ref, params, fallbackEnglish) {
+		const parts = splitTranslationRef(ref);
+		return parts === null ? interpolate(fallbackEnglish, params) : this.t(lang, parts.ns, parts.key, params, fallbackEnglish);
+	}
+};
+var shared = null;
+/** A fresh registry holding the core `server` namespace (specs build their own). */
+function createCoreCatalogRegistry(warn) {
+	const registry = new CatalogRegistry(warn);
+	registry.set(SERVER_NAMESPACE, "en", en_default, "server/en.json");
+	registry.set(SERVER_NAMESPACE, "it", it_default, "server/it.json");
+	return registry;
+}
+/** The hub's one registry, core catalogs preloaded. */
+function getCatalogRegistry(warn) {
+	if (shared === null) shared = createCoreCatalogRegistry(warn);
+	return shared;
+}
+/** Spec hook: forget the shared registry. */
+function resetCatalogRegistryForTests() {
+	shared = null;
+}
+//#endregion
+export { ADMIN_TOKEN_MAX_LIFETIME_MS, ADMIN_TOKEN_PREFIX, AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AGENT_DASHBOARD_ORIGINS_FIELD, AGENT_HTTPS_NAMES_COLLECTION, AGENT_HTTPS_NAMES_COLUMNS, AGENT_READINESS_SERVICE_NAME, AGENT_UI_UNLOCK_TTL_MS, AGENT_UI_UNLOCK_TYP, AGENT_UI_UNLOCK_USE, AGENT_UI_UNLOCK_VERSION, ALL_CAPABILITY_DEFINITIONS, ARRAY_BUFFER_CENSUS_COOLDOWN_MS, ARRAY_BUFFER_CENSUS_SUSTAIN_MS, ARRAY_BUFFER_CENSUS_THRESHOLD_MB, ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRouteRegistry, AdminTokenManager, AgentHttpsInstallError, AgentHttpsNames, AgentMdnsAdvertiser, AgentMeshIdentityGate, AgentPairing, AlertCenterAddon, ApiKeyManager, AuthAuditLog, AuthManager, BackupDecryptError, BackupKeyFormatError, BackupKeyMismatchError, BackupKeyRequiredError, CAP_ACTION_OVERFLOW_LABEL, CAP_ACTION_UNLABELLED, CAP_METHOD_NOT_IMPLEMENTED, CA_COMMON_NAME, CA_VALIDITY_DAYS, CORE_CAP_SERVICE_NAME, CalendarsAddon, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, CatalogRegistry, ComposerAddon, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CoreBlocksAddon, CustomActionRegistry, DECISIVE_HEAP_SPACES, DEFAULT_DATA_PATH, DEFAULT_HUB_TLS_TCP_PORT, DEFAULT_LAN_HTTP_PORT, DEFAULT_LOG_LEVEL, DEVICE_CA_KEY_REF, DEVICE_SETTINGS_CONTRIBUTION_METHODS, DEVICE_STATUS_METHOD, DataPlaneRegistry, DeviceCaStore, DeviceCredentialManager, DeviceManagerAddon, DeviceRegistry, DeviceStore, EMPTY_CAP_ACTION_READING, EMPTY_SOCKET_DIRECTION, EMPTY_SOCKET_PLANE_BASELINE, EVENT_PLANE_TOP_N, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FIRST_BOOT_ADMIN_PASSWORD, FIRST_BOOT_ADMIN_USERNAME, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, GET_STATUS_METHOD, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HEAP_RECLAIM_MIN_INTERVAL_MS, HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, HEAP_RECLAIM_TRIGGER_MB, HEAP_SPACE_REPORT_MIN_MB, HEAP_WATCH_INTERVAL_MS, HEAP_WATCH_WARN_RATIO, HUB_CAP_FWD_ACTION, HUB_CAP_FWD_SERVICE, HUB_MAIN_HEAP_WATCH_LABEL, HUB_MAIN_RSS_BUDGET_MB, HUB_RSS_BUDGET_ENV, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, HubPairing, INFRA_CAPABILITIES, IntegrationRegistry, JWT_SIGNING_KEY_REF, JobJournal, JwtSigningKeyUnavailableError, LEAF_RENEWAL_WINDOW_DAYS, LifecycleJobEngine, LifecycleStateMachine, LivenessMonitorAddon, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, LoggingGate, LoginSessionManager, LokiDestination, LokiLoggingAddon, MAX_CAP_ACTIONS_PER_PEER, MAX_LEAF_VALIDITY_DAYS, MESH_ACTION_FORBIDDEN_TYPE, MESH_CA_FIELD, MESH_CA_KEY_REF, MESH_CA_SETTINGS_KEY, MESH_NODE_CERTIFICATES_COLLECTION, MESH_NODE_CERTIFICATES_COLUMNS, MESH_NODE_UNAUTHENTICATED_TYPE, MESH_QUEUE_TOP_N, MESH_TLS_PORT_HELLO_FIELD, METHOD_ACCESS_MAP, MeshCaKeeper, MeshCertificateRegistry, MeshCrl, MeshIdentityGate, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NATIVE_SCAN_DEPTH, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, OUTBOUND_QUEUE_COOLDOWN_MS, OUTBOUND_QUEUE_SUSTAIN_MS, OUTBOUND_QUEUE_THRESHOLD_BYTES, PAIRING_CODE_DIGITS, PAIRING_MAX_CODE_ATTEMPTS, PAIRING_MAX_SESSIONS, PAIRING_PATHS, PAIRING_PIN_DIGITS, PAIRING_PROTOCOL, PAIRING_TTL_MS, PARENT_ROUTED_PROVIDER_ADDON_ID, PREVIOUS_LEAF_GRACE_MS, PYTHON_VERSION, PairingHttpError, PeerAnsweredError, PipelineRunner, PipelineValidator, PythonEnvManager, QUARANTINE_DIRNAME, REFRESH_TOKEN_PREFIX, RENEWAL_ABANDONED, RESTART_MARKER_FILE, RSS_BUDGET_REANNOUNCE_MIN_MS, RSS_BUDGET_RELEASE_RATIO, RUNNER_HEAP_WATCH_INTERVAL_MS, RUNNER_RSS_BUDGET_ENV, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, ReplEngine, RingBuffer, SERVER_AUTH_OID, SERVER_NAMESPACE, SOCKET_PLANE_TOP_N, SOCKET_QUEUE_TOP_N, STALL_REPORT_MS, STALL_TICK_MS, STORE_READABLE_BOOTSTRAP_KEYS, SYSTEM_SECRET_OWNER, ScopedLogger, ScopedTokenManager, SettingsReadUnavailableError, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemBackupService, SystemConfigAddon, SystemEventBus, TRADITIONAL_NATIVE_PACKAGES, TlsTcpTransporter, ToastService, UDS_NO_ROUTE_PREFIX, UNCLAIMED, UPLOADED_CA_FILE, USER_MANAGEMENT_INTERNAL, UdsLocalTransportClient, UdsLocalTransportServer, UnlockTicketJtiStore, UserManager, WinstonDestination, WinstonLoggingAddon, ZERO_LOOP_DELAY, __resetCapUsageRegistryForTests, __resetLoggingGateForTests, acceptAgentSans, adaptBrokerToCluster, addonSettingsCapability, adoptModelRevisions, afterWorkerOnlineAnnounce, agentHttpsPaths, allFamiliesListenHost, answerClaimedGetStatus, applyCertificateToListener, applyLanHttp, attachUserManagementInternal, attributeStall, bindPendingLanHttp, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildAgentAnnouncement, buildBinaryPath, buildCapRouters, buildHeapSample, buildLinkChain, buildNativeCapProxy, buildNodeManifest, buildNpmChildEnv, buildStorageLocationRegistry, buildTransporter, builderMountedCapNames, caFingerprint, caFingerprintCompact, callRegisterNodeWithRetry, callWithServiceDiscovery, canServeDataPlane, capActionLabel, capActionName, capActionSuffix, capBareAction, capServiceName, catalogNamespaceOf, certificateNames, classifyAddonDir, classifyCapRoute, clearHttpsListener, clearPendingRestart, clearPlatformKeychainKey, closeLanHttp, clusterEventTopic, collectAgentNames, collectCertIdentity, collectModelFiles, computePairingCommitment, computePairingSas, connectBrokerTransport, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonDataPlaneFacility, createAddonPeerBytesFacility, createAddonService, createAgentEventScope, createAgentHttpsRequest, createAgentTransport, createArrayBufferCensusGate, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCapActionCensus, createCiaoPublisher, createCidrMatcher, createCoreCapService, createCoreCatalogRegistry, createDeferredHeapWatchSink, createDoorSettingsView, createEventPlaneMeter, createEventPlaneReader, createFileDataPlaneHandler, createHubCapForwardService, createHubService, createInspectorArrayBufferCensus, createKernelHwAccel, createKernelInferenceEngine, createLocalTransport, createLoopDelayMeter, createMeshAccessMiddleware, createMeshCsrPem, createMeshQueueReader, createOutboundQueueGate, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createSocketDirectionCounters, createSocketPlaneMeter, createSocketPlaneReader, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, createV8Reclaimer, currentBrokerTransporter, deleteModelFromDisk, deriveAgentListenPort, describeCsr, describeHttpsLeaf, describeMeshLeaf, describeProviderKindDrift, describeRss, detectWorkspacePackagesDir, deviceCapResolverLink, deviceOfGetStatus, diffCapActionCensus, diffEventPlane, diffSocketPlane, disconnectBrokerTransport, downloadBinary, downloadFile, downloadModel, dropProcessPeer, emitDownForOwnedCaps, emitHeapDiagnosticReport, emitProcessNodeRegistered, encodeFrame, ensureAddonNativePrebuilds, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensureNativePrebuilds, ensurePython, ensureTlsCert, evaluateExistingCert, expandCapMethods, exportMeshPrivateKeyPem, fetchJson, findInPath, formatArrayBufferCensus, formatEventPlane, formatHeapSpaces, formatLogLine, formatMeshQueue, formatOutboundQueueVerdict, formatSocketPlane, generateBackupKeyPair, generateDeviceCa, generateMeshCa, generateMeshKeyPair, getBrokerEventBus, getBrokerTlsTransporter, getCapUsageRegistry, getCatalogRegistry, getFfmpegDownloadUrl, getLoggingGate, getModelFilePath, getMoleculerEventStats, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPlatformKeychainKey, getProcessAgentHttpsNames, getProcessJwtSigningKeyState, getProcessMeshCaState, getProcessMeshCertificateRegistry, getProcessMeshTlsListenerState, getProcessNodeMeshTransport, getProcessPeerLeaf, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getUserManagementInternal, getWorkerDeviceRegistry, hasDotNode, heapSpaceField, hostNodeIdOf, hubHostFromMeshAddress, hubMainRssBudget, installAgentHttps, installBrokerTransporter, installManifestNativeDeps, installManifestPythonDeps, installManifestSystemDeps, installPackageFromNpm, installPythonPackages, installPythonRequirements, ipcParentLink, isAddonDeploySource, isAllowedAgentDashboardReturnTo, isArrayBufferCensusReport, isArrayOutputSchema, isCollectionArrayMethod, isContainerBridgeAddress, isCredentialKeyName, isInfraCapability, isInstalledTransporter, isLocalOnlyHostname, isModelDownloaded, isPeerEventPacket, isPrivateAddress, isProcessVerifiedMeshPeer, isRemoteForbiddenAction, isRemoteForbiddenOnAgent, isSettingsReadUnavailable, isSourceNewer, isValidAgentNodeId, isolatedBuiltinPhase, issueAgentHttpsLeaf, issueDeviceLeaf, issueMeshLeafForNode, issueMeshLeafFromCsr, keyFingerprintShort, leafFingerprintOf, loadAgentHttps, loadDeviceCa, loadMeshCa, loadTlsCert, localEndpointPath, localProviderLink, localSupportedPythonRuntimes, mapSignalsToInferenceHardware, meshErrorType, mintAgentUiUnlockTicket, mountNativeCapService, nextRssBudgetState, normalizeIp, onProcessNodeRegistered, onSessionsRevoked, openMeshTlsWhenRevocationsLoaded, overlayGetStatus, parseAgentDashboardOrigins, parseCapAction, parseCidrList, parseRangeHeader, parseRssBudgetMb, parseTokenExpiry, parseTokenizedUrl, partitionIsolatedBuiltinIds, pemDigest, pinnedHttpsCaFingerprint, prepareBootTls, prepareRestoreArchive, probePlatform, processJwtSigningKey, processMeshCrl, proxyToUpstream, quarantineAddonResidue, readBackupEncryptionHeader, readCidrSetting, readExtraSans, readHeapSpaces, readLanHttpState, readPendingRestart, readSocketQueues, readTlsAccessStatus, readTlsMode, readinessKey, reclaimIntervalMs, recordSocketFrame, redactLogEntry, redactLogMeta, redactLogText, regenerateCertificate, registerEventBusService, registerHttpsListener, registerLanHttpHandler, reissueTlsLeaf, reloadHttpsListener, renewMeshCertificate, requireProcessMeshCa, resetCatalogRegistryForTests, resolveFilePath, resolveFormatRevision, resolveHwAccel, resolveNpmInvocation, revertToGeneratedCertificate, revisionWeightUrl, revokeMeshCertificate, runHubAddonBoot, runNpm, sampleSocketDirection, scheduleSelfRestart, scopeKey, scopesAllowAddon, scopesAllowDeviceCap, selectAddonResidue, selectReportedSpaces, serializeTypedArrays, servedHttpsLeafFingerprint, setHubConnected, setNodeEventInterest, setPlatformKeychainKey, setProcessAgentHttpsNames, setProcessMeshCertificateRegistry, setProcessMeshPeerTransportLookup, setProcessMeshTlsEnabler, setProcessMeshTlsListenerState, setWrapperActive, shouldReclaim, signPairingProof, signalAllRunnerGroups, socketDirectionBytes, socketDirectionMessages, splitPemCertificates, stampCallerAddonId, startEventLoopStallMonitor, startHeapWatch, startRunnerHeapWatch, staticJwtSigningKey, storeMayAnswer, storeUploadedCertificate, strandedMb, stripCamstackDeps, stripForgedIdentity, stripForwardedCaller, subscribePassthrough, systemHostFacts, udsChildLogToWorkerEntry, validateProviderRegistrations, validateUploadedTls, verifyAgentUiUnlockTicket, verifyDeviceLeaf, verifyDeviceSignature, verifyPairingProof, waitUntilReady, writeExtraSans, writePendingRestart, writeTlsMode };