@camstack/system 1.2.437 → 1.2.439

package/dist/index.js

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-CEAyXW3Q.js");
-const require_device_ca = require("./device-ca-DImD8IzR.js");
+const require_dist = require("./dist-BOWdLjoK.js");
+const require_device_ca = require("./device-ca-DHG9OW2m.js");
 const require_builtins_alerts_alerts_addon = require("./builtins/alerts/alerts.addon.js");
 require("./builtins/alerts/index.js");
 const require_builtins_calendars_calendars_addon = require("./builtins/calendars/calendars.addon.js");
@@ -22,21 +22,21 @@ require("./builtins/local-auth/index.js");
 const require_builtins_loki_logging_index = require("./builtins/loki-logging/index.js");
 const require_builtins_native_metrics_native_metrics_addon = require("./builtins/native-metrics/native-metrics.addon.js");
 const require_builtins_sqlite_storage_filesystem_storage_addon = require("./builtins/sqlite-storage/filesystem-storage.addon.js");
-const require_wal_maintenance = require("./wal-maintenance-Ch79gy9S.js");
+const require_wal_maintenance = require("./wal-maintenance-DEL_jeG0.js");
 const require_builtins_sqlite_storage_sqlite_settings_addon = require("./builtins/sqlite-storage/sqlite-settings.addon.js");
 const require_builtins_sqlite_storage_index = require("./builtins/sqlite-storage/index.js");
 const require_builtins_storage_orchestrator_storage_orchestrator_addon = require("./builtins/storage-orchestrator/storage-orchestrator.addon.js");
 require("./builtins/storage-orchestrator/index.js");
-const require_agent_https = require("./agent-https-BZIwS4xF.js");
-const require_constants = require("./constants-CwRY32Nx.js");
+const require_agent_https = require("./agent-https-DlpTMDqA.js");
+const require_constants = require("./constants-BRsjQwi-.js");
 const require_builtins_system_config_system_config_addon = require("./builtins/system-config/system-config.addon.js");
 require("./builtins/system-config/index.js");
 const require_builtins_winston_logging_index = require("./builtins/winston-logging/index.js");
 const require_custom_action_registry = require("./custom-action-registry-Bf_YnagS.js");
-const require_hub_mdns_ciao = require("./hub-mdns-ciao-CBLvq2oj.js");
+const require_hub_mdns_ciao = require("./hub-mdns-ciao-D7S5AJRU.js");
 const require_platform_key_source = require("./platform-key-source-Di7HrlGR.js");
 const require_resource_monitor = require("./resource-monitor-mio9dSCT.js");
-const require_restore_archive = require("./restore-archive-C75srVbG.js");
+const require_restore_archive = require("./restore-archive-DiGiI6Jp.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 node_crypto = require_chunk.__toESM(node_crypto);
@@ -1802,7 +1802,8 @@ function formatArrayBufferCensus(label, report, context) {
 }
 //#endregion
 //#region src/kernel/gc-census.ts
-function countsOf(entries, kinds) {
+function countsOf(entries, kinds, flagBits) {
+	const flags = {};
 	let majors = 0;
 	let minors = 0;
 	let incrementals = 0;
@@ -1812,13 +1813,17 @@ function countsOf(entries, kinds) {
 		else if (e.kind === kinds.minor) minors++;
 		else if (e.kind === kinds.incremental) incrementals++;
 		pauseMs += e.durationMs;
+		if (e.flags !== void 0) {
+			for (const f of flagBits) if ((e.flags & f.bit) !== 0) flags[f.name] = (flags[f.name] ?? 0) + 1;
+		}
 	}
 	return {
 		majors,
 		minors,
 		incrementals,
 		pauseMs,
-		windowMs: 0
+		windowMs: 0,
+		...Object.keys(flags).length > 0 ? { flags } : {}
 	};
 }
 /**
@@ -1830,7 +1835,7 @@ function countsOf(entries, kinds) {
 * observed and a process that is not collecting look identical on the line, and
 * they are the two answers furthest apart.
 */
-function createGcCensus(install, kinds, startedAt) {
+function createGcCensus(install, kinds, startedAt, flagBits = []) {
 	let pending = [];
 	const stopObserving = install((entry) => {
 		pending.push(entry);
@@ -1845,7 +1850,7 @@ function createGcCensus(install, kinds, startedAt) {
 			pending = [];
 			windowStart = at;
 			return {
-				...countsOf(taken, kinds),
+				...countsOf(taken, kinds, flagBits),
 				windowMs
 			};
 		},
@@ -1870,14 +1875,18 @@ function nodeGcObserver() {
 			minor: 1,
 			incremental: 8
 		}),
+		flagBits: readFlagBits(),
 		install: (observe) => {
 			try {
 				const observer = new (process.getBuiltinModule("node:perf_hooks")).PerformanceObserver((list) => {
 					for (const entry of list.getEntries()) {
 						const detail = "detail" in entry ? entry.detail : void 0;
+						const kind = typeof detail === "object" && detail !== null && "kind" in detail && typeof detail.kind === "number" ? detail.kind : -1;
+						const flags = typeof detail === "object" && detail !== null && "flags" in detail && typeof detail.flags === "number" ? detail.flags : void 0;
 						observe({
-							kind: typeof detail === "object" && detail !== null && "kind" in detail && typeof detail.kind === "number" ? detail.kind : -1,
-							durationMs: entry.duration
+							kind,
+							durationMs: entry.duration,
+							...flags !== void 0 ? { flags } : {}
 						});
 					}
 				});
@@ -1891,6 +1900,25 @@ function nodeGcObserver() {
 		}
 	};
 }
+var GC_FLAG_PREFIX = "NODE_PERFORMANCE_GC_FLAGS_";
+/**
+* The flag bits, read from `perf_hooks.constants` by their prefix so a flag V8
+* adds tomorrow gets a name without anyone editing a table. `NO` (0) can never
+* match a bit and is dropped.
+*/
+function readFlagBits() {
+	try {
+		const perf = process.getBuiltinModule("node:perf_hooks");
+		const bits = [];
+		for (const [key, value] of Object.entries(perf.constants)) if (key.startsWith(GC_FLAG_PREFIX) && typeof value === "number" && value > 0) bits.push({
+			name: key.slice(26),
+			bit: value
+		});
+		return bits;
+	} catch {
+		return [];
+	}
+}
 function readKinds(fallback) {
 	try {
 		const c = process.getBuiltinModule("node:perf_hooks").constants;
@@ -1917,7 +1945,14 @@ function readKinds(fallback) {
 function formatGcCensus(window) {
 	if (window === null || window === void 0) return "";
 	const perMin = (n) => window.windowMs <= 0 ? "?" : (n / (window.windowMs / 6e4)).toFixed(1);
-	return ` gc=maj${window.majors}/min${window.minors}/inc${window.incrementals}@${Math.round(window.windowMs / 1e3)}s gcMajPerMin=${perMin(window.majors)} gcPauseMs=${Math.round(window.pauseMs)}`;
+	return ` gc=maj${window.majors}/min${window.minors}/inc${window.incrementals}@${Math.round(window.windowMs / 1e3)}s gcMajPerMin=${perMin(window.majors)} gcPauseMs=${Math.round(window.pauseMs)}` + formatGcFlags(window.flags);
+}
+/** ` gcFlags=ALL_EXTERNAL_MEMORY:12,FORCED:1` — most frequent first; empty when none. */
+function formatGcFlags(flags) {
+	if (flags === void 0) return "";
+	const entries = Object.entries(flags).toSorted((a, b) => b[1] - a[1] || a[0].localeCompare(b[0]));
+	if (entries.length === 0) return "";
+	return ` gcFlags=${entries.map(([name, n]) => `${name}:${n}`).join(",")}`;
 }
 /**
 * The census. Always exists — `process.cpuUsage()` is available on every
@@ -2645,7 +2680,7 @@ function startHeapWatch(label = HUB_MAIN_HEAP_WATCH_LABEL, sink = consoleSink, i
 	const readMemory = reclaimOptions?.readMemory ?? (() => process.memoryUsage());
 	const now = reclaimOptions?.now ?? (() => Date.now());
 	const gcObserver = probes?.gcObserver ?? nodeGcObserver();
-	const gcCensus = createGcCensus(gcObserver.install, gcObserver.kinds, now());
+	const gcCensus = createGcCensus(gcObserver.install, gcObserver.kinds, now(), gcObserver.flagBits);
 	const cpuProbe = probes?.processCpu;
 	const processCpu = createProcessCpuCensus({
 		cpuUsageUs: cpuProbe?.cpuUsageUs ?? (() => {
@@ -2699,6 +2734,7 @@ function startHeapWatch(label = HUB_MAIN_HEAP_WATCH_LABEL, sink = consoleSink, i
 	};
 	let mode = "steady";
 	let lastLoggedAt = Number.NEGATIVE_INFINITY;
+	let firstLinePending = true;
 	const budgetMb = rssBudget?.budgetMb !== void 0 && rssBudget.budgetMb > 0 ? rssBudget.budgetMb : void 0;
 	const budgetSource = rssBudget?.source ?? "unspecified";
 	const releaseRatio = rssBudget?.releaseRatio ?? .9;
@@ -2757,7 +2793,9 @@ function startHeapWatch(label = HUB_MAIN_HEAP_WATCH_LABEL, sink = consoleSink, i
 			const due = at - lastLoggedAt >= intervalMs;
 			if (mode === "escalated" || due) {
 				lastLoggedAt = at;
-				const line = format(label, sample, loopDelay?.read(), budgetMb, `${formatHeapSpaces(readSpaces())}${formatEventPlane(eventPlane?.read())}` + formatSocketPlane(socketPlane?.read()) + formatMeshQueue(meshQueue?.()) + formatGcCensus(gcCensus?.read(at)) + formatProcessCpu(processCpu.read(at)));
+				const firstLine = firstLinePending;
+				firstLinePending = false;
+				const line = format(label, sample, loopDelay?.read(), budgetMb, `${formatHeapSpaces(readSpaces(), firstLine ? 0 : void 0)}${formatEventPlane(eventPlane?.read())}` + formatSocketPlane(socketPlane?.read()) + formatMeshQueue(meshQueue?.()) + formatGcCensus(gcCensus?.read(at)) + formatProcessCpu(processCpu.read(at)));
 				if (sample.nearLimit) sink.warn(`${line} — APPROACHING HEAP LIMIT`);
 				else if (mode === "escalated") sink.warn(`${line} — heap elevated, sampling every ${probeIntervalMs}ms`);
 				else sink.info(line);
@@ -4963,7 +5001,7 @@ var PythonEnvManager = class {
 	}
 	async ensure(options) {
 		const probe = await this.probe();
-		if (!probe.available || !probe.path) throw new Error("Python 3.10+ is required but not found on this system");
+		if (!probe.available || !probe.path) throw require_dist.userError("system.python-required", void 0, "Python 3.10+ is required but not found on this system");
 		if (!node_fs.existsSync(node_path.join(this.venvPath, "bin", "python"))) await execFileAsync$7(probe.path, [
 			"-m",
 			"venv",
@@ -5231,7 +5269,7 @@ var StorageManager = class {
 	}
 	getProvider() {
 		if (this.legacyProvider) return this.legacyProvider;
-		if (!this.newStorageProvider && !this.settingsBackend && !this.locationManager) throw new Error("No storage provider configured");
+		if (!this.newStorageProvider && !this.settingsBackend && !this.locationManager) throw require_dist.userError("storage.no-provider", void 0, "No storage provider configured");
 		return this.createLegacyShim();
 	}
 	setLocationManager(manager) {
@@ -5254,7 +5292,7 @@ var StorageManager = class {
 	* Builds IStorageLocation from settingsBackend (structured) + locationManager (files).
 	*/
 	getLocation(name, namespace) {
-		if (!this.legacyProvider && !this.newStorageProvider && !this.settingsBackend && !this.locationManager) throw new Error("No storage provider configured");
+		if (!this.legacyProvider && !this.newStorageProvider && !this.settingsBackend && !this.locationManager) throw require_dist.userError("storage.no-provider", void 0, "No storage provider configured");
 		if (this.legacyProvider) try {
 			const LEGACY_MAP = {
 				config: "data",
@@ -11680,6 +11718,17 @@ function createDoorSettingsView(addonId, door, sections) {
 			}
 			return out;
 		},
+		async listDeviceStoreIds() {
+			const all = await loadPrefixed(door, "addon-device-settings", `${addonId}:`, () => null);
+			const ids = /* @__PURE__ */ new Set();
+			for (const suffix of Object.keys(all)) {
+				const dot = suffix.indexOf(".");
+				if (dot <= 0) continue;
+				const deviceId = Number(suffix.slice(0, dot));
+				if (Number.isInteger(deviceId) && deviceId > 0) ids.add(deviceId);
+			}
+			return [...ids].toSorted((a, b) => a - b);
+		},
 		async writeDeviceStore(deviceId, patch) {
 			const scope = `${addonId}:${String(deviceId)}.`;
 			await replacePrefixed(door, "addon-device-settings", scope, {
@@ -14888,6 +14937,11 @@ var ConfigManager = class {
 			writeAddonStore: (patch) => active().writeAddonStore(patch),
 			readDeviceStore: (deviceId) => active().readDeviceStore(deviceId),
 			readDeviceStoreBatch: (deviceIds) => active().readDeviceStoreBatch(deviceIds),
+			listDeviceStoreIds: async () => {
+				const list = active().listDeviceStoreIds;
+				if (list === void 0) throw new Error("listDeviceStoreIds is not available on this settings view");
+				return list.call(active());
+			},
 			writeDeviceStore: (deviceId, patch) => active().writeDeviceStore(deviceId, patch),
 			clearDeviceStore: (deviceId) => active().clearDeviceStore(deviceId),
 			getSection: (section) => active().getSection(section),
@@ -18562,9 +18616,14 @@ function localEndpointPath(nodeId) {
 * node had answered (2026-09-25, device 3836).
 */
 var PeerAnsweredError = class extends Error {
-	constructor(message) {
+	/** The far end's stable error code (D863), carried so the hub can translate it. */
+	i18nCode;
+	i18nParams;
+	constructor(message, i18n) {
 		super(message);
 		this.name = "PeerAnsweredError";
+		this.i18nCode = i18n?.code;
+		this.i18nParams = i18n?.params;
 	}
 };
 //#endregion
@@ -18586,6 +18645,13 @@ var PayloadReply = class {
 		this.payload = payload;
 	}
 };
+//#endregion
+//#region src/kernel/transport/socket-channel.ts
+/** A peer's `i18n` is untrusted wire data: a malformed one is dropped, the message still travels. */
+function parseWireI18n(raw) {
+	const parsed = _camstack_types_addon.ErrorI18nPayloadSchema.safeParse(raw);
+	return parsed.success ? parsed.data : void 0;
+}
 var SocketChannel = class {
 	socket;
 	nextId = 1;
@@ -18797,11 +18863,13 @@ var SocketChannel = class {
 					body: result
 				});
 			} catch (err) {
+				const i18n = (0, _camstack_types_addon.readErrorI18n)(err);
 				resBytes = this.send({
 					k: "res",
 					id: frame.id,
 					ok: false,
-					err: err instanceof Error ? err.message : String(err)
+					err: err instanceof Error ? err.message : String(err),
+					...i18n !== null ? { i18n } : {}
 				});
 			}
 			if (label !== void 0) this.recordAction(label, wireBytes, resBytes);
@@ -18813,7 +18881,7 @@ var SocketChannel = class {
 			this.pending.delete(frame.id);
 			if (p.timer !== null) clearTimeout(p.timer);
 			if (p.action !== null) this.recordAction(p.action.label, p.action.reqBytes, wireBytes);
-			if (!frame.ok) p.reject(new PeerAnsweredError(frame.err));
+			if (!frame.ok) p.reject(new PeerAnsweredError(frame.err, parseWireI18n(frame.i18n)));
 			else if (frame.pl !== void 0) p.resolve(new PayloadReply(frame.body, frame.pl));
 			else p.resolve(frame.body);
 			return;
@@ -26495,6 +26563,595 @@ var LifecycleJobEngine = class {
 */
 var CAP_METHOD_NOT_IMPLEMENTED = "CAP_METHOD_NOT_IMPLEMENTED";
 //#endregion
+//#region src/i18n/en.json
+var en_default = {
+	"auth.invalid-credentials": "Invalid credentials",
+	"auth.invalid-totp": "Invalid TOTP code",
+	"auth.not-authenticated": "Not authenticated",
+	"auth.login-challenge-expired": "Invalid or expired login challenge — please re-enter your password",
+	"auth.passkey-verification-failed": "Passkey verification failed",
+	"auth.user-gone": "User no longer exists",
+	"auth.no-session-cookie": "No session cookie",
+	"auth.invalid-session-cookie": "Invalid session cookie",
+	"auth.handoff-code-invalid": "Invalid or expired handoff code",
+	"auth.share-never-expiring-extend": "A never-expiring share token cannot be extended",
+	"auth.share-owner-only-extend": "Only the token owner or an admin can extend a share token",
+	"auth.share-owner-only-revoke": "Only the token owner or an admin can revoke a share token",
+	"auth.share-token-not-found": "Share token not found: {id}",
+	"auth.password-incorrect": "Password is incorrect",
+	"auth.session-required": "Requires a signed-in user session",
+	"auth.admin-required": "Admin required",
+	"auth.session-ended": "Session ended — sign in again",
+	"auth.access-denied": "Access denied",
+	"auth.totp-confirm-failed": "TOTP confirmation failed — code did not match",
+	"device.certificates-unavailable": "Device certificates are not available",
+	"device.not-found": "Device {id} not found",
+	"device.credentials-unavailable": "Device credentials not available",
+	"device.credential-not-found": "Device credential not found: {id}",
+	"storage.no-provider": "No storage provider configured",
+	"recording.export-unknown": "Unknown export \"{id}\"",
+	"recording.export-invalid-range": "Invalid time range {fromMs}..{toMs}",
+	"recording.export-no-profiles": "The export needs at least one stream profile",
+	"recording.export-not-ready": "Export \"{id}\" is not ready ({state})",
+	"recording.export-expired": "Export \"{id}\" has expired",
+	"recording.export-no-file": "Export \"{id}\" has no file on disk",
+	"recording.clip-render-unavailable": "Clip rendering is unavailable on this node",
+	"reolink.hub-host-missing": "Reolink Hub: host not configured",
+	"reolink.hub-password-missing": "Reolink Hub: password not configured",
+	"reolink.email-push-hub-attached": "Email push is not available for hub-attached cameras",
+	"reolink.email-push-not-wired": "Email Push Server is not wired — restart the Reolink addon",
+	"reolink.webhook-not-wired": "HaCfg Webhook Server is not wired — restart the Reolink addon",
+	"reolink.webhook-unsupported": "Camera firmware does not support Baichuan HaCfg webhook (cmd 806)",
+	"reolink.preset-invalid": "Invalid presetId: {presetId}",
+	"reolink.home-preset-not-baichuan": "Configured home preset is not a Baichuan id: {presetId}",
+	"reolink.day-night-schedule-unsupported": "Reolink cameras do not support a scheduled day/night mode",
+	"reolink.clip-device-not-reolink": "clip refresh: device {deviceId} is not a Reolink camera here",
+	"notifiers.gotify-server-url-required": "gotify: serverUrl is required",
+	"notifiers.gotify-app-token-required": "gotify: appToken is required",
+	"notifiers.email-to-required": "email: missing required config 'to'",
+	"hikvision.camera-name-required": "Camera name is required",
+	"hikvision.camera-ip-required": "Camera IP is required",
+	"hikvision.password-required": "Password is required",
+	"hikvision.home-preset-missing": "No home preset configured for this camera — set one in the PTZ settings",
+	"amcrest.camera-name-required": "Camera name is required",
+	"amcrest.camera-ip-required": "Camera IP is required",
+	"amcrest.password-required": "Password is required",
+	"amcrest.home-preset-missing": "No home preset configured for this camera — set one in the PTZ settings",
+	"wyze.camera-name-required": "Camera name is required",
+	"wyze.camera-mac-required": "Wyze: cannot persist a camera without a MAC address",
+	"dreame.manual-create-refused": "Dreame devices are adopted from the cloud, not created manually",
+	"rtsp.camera-name-required": "Camera name is required",
+	"rtsp.stream-required": "At least one RTSP stream URL is required",
+	"rtsp.too-many-streams": "At most 3 RTSP stream URLs are supported",
+	"gree.name-required": "Air conditioner name is required",
+	"gree.ip-required": "Air conditioner IP address is required",
+	"ecowitt.name-required": "Gateway name is required",
+	"ecowitt.host-required": "Gateway host is required for local-poll transport",
+	"unifi.name-required": "Controller name is required",
+	"unifi.host-required": "Controller host is required",
+	"vesync.name-required": "Account name is required",
+	"vesync.email-required": "Account email is required",
+	"unraid.name-required": "Server name is required",
+	"unraid.host-required": "Server host is required",
+	"velux.name-required": "Gateway name is required",
+	"velux.host-required": "Gateway host is required",
+	"cloudflare.custom-not-configured": "Custom tunnel not configured — run \"Enable\" from settings first",
+	"cloudflare.custom-needs-settings": "Custom tunnel needs: {missing}. Fill the settings above first.",
+	"cloudflare.zone-token-missing": "listZones: no Cloudflare API token is set",
+	"cloudflare.zone-not-visible": "Selected zone {zoneId} is not visible to this token",
+	"google.from-address-required": "Set From address on the Google broker (or Connect an account).",
+	"google.client-credentials-required": "Configure Client ID and Client secret before refreshing the Google token",
+	"globalSettings.s_alerts.title": "Alert Center",
+	"globalSettings.s_alerts.description": "Configure alert storage and retention.",
+	"globalSettings.s_alerts.maxAlerts.label": "Maximum stored alerts",
+	"globalSettings.s_alerts.maxAlerts.description": "Oldest read alerts are deleted when this limit is exceeded.",
+	"globalSettings.s_alerts.retentionDays.label": "Alert retention (days)",
+	"globalSettings.s_alerts.retentionDays.description": "Alerts older than this are automatically removed.",
+	"globalSettings.s_camera-grids.title": "Camera grids",
+	"globalSettings.s_camera-grids.description": "A grid is a composite camera: several cameras composed into one picture, recorded and played back like any other camera. Create one here with a name; open its camera to lay it out. Object detection is switched OFF on a new grid — the cameras it is composed from are already analysed.",
+	"globalSettings.s_camera-grids.cameraGrids.label": "Grids",
+	"globalSettings.s_camera-grids.cameraGrids.name.label": "Name",
+	"globalSettings.s_camera-grids.cameraGrids.enabled.label": "Enabled",
+	"globalSettings.s_camera-grids.cameraGrids.enabled.description": "A disabled grid withdraws its camera.",
+	"gridDevice.s_camera-grid-layout.title": "Grid layout",
+	"gridDevice.s_camera-grid-layout._gridLayout.label": "",
+	"globalSettings.s_console-logging.title": "Console Logging",
+	"globalSettings.s_console-logging.description": "Minimum log level to emit on stdout/stderr. Independent from the rotated-file (Winston) destination.",
+	"globalSettings.s_console-logging.level.label": "Log Level",
+	"globalSettings.s_console-logging.level.o_debug.label": "Debug",
+	"globalSettings.s_console-logging.level.o_info.label": "Info",
+	"globalSettings.s_console-logging.level.o_warn.label": "Warn",
+	"globalSettings.s_console-logging.level.o_error.label": "Error",
+	"dayNightConfig.dayNight_mode.label": "Mode",
+	"dayNightConfig.dayNight_sensitivity.label": "IR-cut sensitivity",
+	"dayNightConfig.dayNight_switchDelaySec.label": "Switch delay",
+	"section.s_day-night.title": "Day / Night",
+	"section.s_day-night.description": "IR-cut switching mode and the photocell knobs that gate it.",
+	"baseDeviceSection.s_driver-settings-unavailable.title": "Driver Settings",
+	"baseDeviceSection.s_driver-settings-unavailable.driver-settings-unavailable-notice.label": "Temporarily unavailable",
+	"imageSettingsConfig.imageSettings_brightness.label": "Brightness",
+	"imageSettingsConfig.imageSettings_contrast.label": "Contrast",
+	"imageSettingsConfig.imageSettings_saturation.label": "Saturation",
+	"imageSettingsConfig.imageSettings_sharpness.label": "Sharpness",
+	"imageSettingsConfig.imageSettings_mirror.label": "Mirror",
+	"imageSettingsConfig.imageSettings_flip.label": "Flip",
+	"imageSettingsConfig.imageSettings_rotate.label": "Rotation",
+	"imageSettingsConfig.imageSettings_whiteBalance.label": "White balance",
+	"imageSettingsConfig.imageSettings_warmth.label": "Warmth",
+	"imageSettingsConfig.imageSettings_exposureMode.label": "Exposure mode",
+	"imageSettingsConfig.imageSettings_backlightMode.label": "Backlight compensation",
+	"section.s_image-settings.title": "Image adjustment",
+	"section.s_image-settings.description": "Picture sliders, orientation and exposure. Option lists are read live from the camera — fields the firmware doesn't expose are hidden.",
+	"volumesField.id.label": "Id",
+	"volumesField.label.label": "Name",
+	"volumesField.status.label": "Status",
+	"volumesField.capacity.label": "Capacity",
+	"volumesField.free.label": "Free",
+	"tracksField.id.label": "Track",
+	"tracksField.primary.label": "Primary",
+	"tracksField.enabled.label": "Enabled",
+	"tracksField.codec.label": "Codec",
+	"tracksField.resolution.label": "Resolution",
+	"storageSection.s_recording-onboard-storage.title": "Camera storage",
+	"storageSection.s_recording-onboard-storage.description": "The card in the camera, as the camera itself describes it.",
+	"recordingSection.s_recording-onboard-recording.title": "Camera recording",
+	"recordingSection.s_recording-onboard-recording.description": "What the camera records to its own card. This writes the camera, not CamStack's recorder.",
+	"globalSettings.s_local-access.title": "LAN HTTP",
+	"globalSettings.s_local-access.description": "Native apps on this Wi-Fi use http:// and skip the private certificate. The tunnel and this admin UI stay on HTTPS. Turn off once a publicly-trusted certificate covers the LAN name.",
+	"globalSettings.s_local-access.httpEnabled.label": "Enable HTTP on the LAN",
+	"globalSettings.s_local-access.httpPort.label": "HTTP port",
+	"globalSettings.s_local-access.httpPort.description": "Dedicated listener. Must not equal the HTTPS port (4443 by default).",
+	"globalSettings.s_local-access.mdnsAdvertise.label": "Announce this hub on the LAN (mDNS)",
+	"globalSettings.s_local-access.mdnsAdvertise.description": "Lets `camstack login` find the hub without an address. Advertises only the HTTPS address, never a secret. Needs UDP 5353 multicast to reach the LAN (host networking or a dedicated container IP).",
+	"globalSettings.s_local-access.localHostname.label": "Local hostname",
+	"globalSettings.s_local-access.localHostname.description": "Advertised to the viewer instead of the raw LAN IP, and added to the certificate SAN. Requires this name to resolve on the LAN (router DNS, mDNS, or a hosts file). Leave empty to keep using the IP.",
+	"globalSettings.s_loki-logging.title": "Loki",
+	"globalSettings.s_loki-logging.description": "Ship this node’s logs to a Grafana Loki instance. Independent of the rotated-file and console destinations. Turn it on or off with the Enable/Disable control on this destination — the same one every other destination uses.",
+	"globalSettings.s_loki-logging.url.label": "Loki URL",
+	"globalSettings.s_loki-logging.url.description": "Base URL, e.g. http://loki:3100 — the /loki/api/v1/push path is added.",
+	"globalSettings.s_loki-logging.level.label": "Minimum level",
+	"globalSettings.s_loki-logging.level.o_debug.label": "Debug",
+	"globalSettings.s_loki-logging.level.o_info.label": "Info",
+	"globalSettings.s_loki-logging.level.o_warn.label": "Warn",
+	"globalSettings.s_loki-logging.level.o_error.label": "Error",
+	"globalSettings.s_loki-logging.job.label": "Job label",
+	"globalSettings.s_loki-logging.job.description": "The Loki `job` label. Keep it fixed — labels are indexed.",
+	"globalSettings.s_loki-logging.extraLabels.label": "Extra labels",
+	"globalSettings.s_loki-logging.extraLabels.description": "Static `key=value,key2=value2`. Low-cardinality only: per-entry values belong in the line body, and a high-cardinality label will bring Loki down.",
+	"globalSettings.s_loki-logging.tenantId.label": "Tenant ID",
+	"globalSettings.s_loki-logging.tenantId.description": "Sent as X-Scope-OrgID. Required by Grafana Cloud and multi-tenant Loki.",
+	"globalSettings.s_loki-logging.username.label": "Username",
+	"globalSettings.s_loki-logging.username.description": "HTTP basic auth. Leave empty for none.",
+	"globalSettings.s_loki-logging.password.label": "Password",
+	"globalSettings.s_loki-logging.batchIntervalMs.label": "Flush interval",
+	"globalSettings.s_loki-logging.batchIntervalMs.description": "How often a partial batch is pushed.",
+	"globalSettings.s_loki-logging.batchSize.label": "Batch size",
+	"globalSettings.s_loki-logging.batchSize.description": "Push early once this many entries are queued.",
+	"globalSettings.s_loki-logging.timeoutMs.label": "Request timeout",
+	"globalSettings.s_native-metrics-settings.title": "System Metrics",
+	"globalSettings.s_native-metrics-settings.samplingIntervalMs.label": "Sampling Interval",
+	"globalSettings.s_native-metrics-settings.samplingIntervalMs.description": "How often to collect system metrics",
+	"globalSettings.s_native-metrics-load-series.title": "Load history",
+	"globalSettings.s_native-metrics-load-series.loadSeriesCadenceSec.label": "Sampling cadence",
+	"globalSettings.s_native-metrics-load-series.loadSeriesCadenceSec.description": "How often every node reports its process tree. FIXED — a sample is emitted on every interval whether or not anything changed, so a gap in the chart means one thing only: nobody reported. Outside 5-60 s the value is refused.",
+	"globalSettings.s_native-metrics-load-series.loadSeriesRetentionHours.label": "Retention",
+	"globalSettings.s_native-metrics-load-series.loadSeriesRetentionHours.description": "How long the load history is kept on disk (the hub database, on the NVMe cache — never the recordings disk). This is the INTENTION; the row cap below is the guarantee.",
+	"globalSettings.s_native-metrics-load-series.load-series-cost.label": "What this configuration costs",
+	"globalSettings.s_native-metrics-load-series.load-series-cap.label": "Hard row cap",
+	"globalSettings.s_snapshot-cache.title": "Snapshot Cache",
+	"globalSettings.s_snapshot-cache.description": "Stale fallback when live capture fails. Per-device freshness is configured under Device → Snapshot → Max cache age.",
+	"globalSettings.s_snapshot-cache.staleTtlMs.label": "Stale fallback TTL (ms)",
+	"globalSettings.s_snapshot-cache.staleTtlMs.description": "If live capture fails, cached snapshot younger than this is still returned.",
+	"deviceSettingsContribution.s_snapshot-preferences.title": "Snapshot",
+	"deviceSettingsContribution.s_snapshot-preferences.snapshotStreamId.label": "Preferred stream",
+	"deviceSettingsContribution.s_snapshot-preferences.snapshotStreamId.description": "Stream used when grabbing a snapshot",
+	"deviceSettingsContribution.s_snapshot-preferences.snapshotMaxAgeS.label": "Max cache age (s)",
+	"deviceSettingsContribution.s_snapshot-preferences.snapshotDebug.label": "Debug logging",
+	"deviceSettingsContribution.s_snapshot-preferences.snapshotDebug.description": "Log stream selection and timing details for this device.",
+	"providerInfo.s_filesystem-storage.title": "Filesystem",
+	"providerInfo.s_filesystem-storage.basePath.label": "Base path",
+	"providerInfo.s_filesystem-storage.basePath.description": "Absolute directory path where files are stored.",
+	"global.s_system-config-server.description": "The name of this server, and its connection settings (read-only, loaded from config.yaml at bootstrap).",
+	"global.s_system-config-server.server-restart-note.label": "Restart required",
+	"global.s_system-config-server.port.label": "Port",
+	"global.s_system-config-server.port.description": "Listening port",
+	"global.s_system-config-server.host.label": "Host",
+	"global.s_system-config-server.host.description": "Bind address",
+	"global.s_system-config-server.dataPath.label": "Data Path",
+	"global.s_system-config-server.dataPath.description": "Root data directory",
+	"global.s_system-config-auth.description": "Token and session settings.",
+	"global.s_system-config-auth.tokenExpiry.label": "Session lifetime",
+	"global.s_system-config-auth.tokenExpiry.description": "How long a sign-in lasts without being used, as a duration string (e.g. 7d, 30d). Every refresh starts it again, so a device in use stays signed in; one left unopened this long must sign in again. A bare number is rejected — it would be read as milliseconds. Applies from the next sign-in or refresh.",
+	"global.s_system-config-auth.accessTokenExpiry.label": "Access token lifetime",
+	"global.s_system-config-auth.accessTokenExpiry.description": "How long one access token lives before the app silently swaps it for a new one (e.g. 2h; between 5m and 24h, never longer than the session). Shorter limits how long a copied token is useful. Apps that predate refresh tokens get one token for the whole session instead.",
+	"global.s_system-config-auth.trustedProxies.label": "Trusted reverse proxies",
+	"global.s_system-config-auth.trustedProxies.description": "Addresses or CIDR ranges (e.g. 192.168.1.2 or 10.0.0.0/24) of reverse proxies in front of the hub. Only a request whose direct sender is one of these — or this host itself, as with the Cloudflare tunnel — has its X-Forwarded-For / CF-Connecting-IP read as the real client address for rate limits. Leave empty unless a proxy on another host forwards to the hub.",
+	"global.s_system-config-auth.trustedNetworksWarning.label": "Skipping two-factor authentication",
+	"global.s_system-config-auth.trustedNetworks.label": "Trusted networks (skip the second factor)",
+	"global.s_system-config-auth.trustedNetworks.description": "Addresses or CIDR ranges, e.g. 192.168.1.0/24. Keep it as narrow as you can — a single trusted VLAN, not the whole LAN.",
+	"globalSettings.s_winston-logging.title": "Logging",
+	"globalSettings.s_winston-logging.description": "Global log verbosity + retention for rotated log files on this node.",
+	"globalSettings.s_winston-logging.level.label": "Log Level",
+	"globalSettings.s_winston-logging.level.o_debug.label": "Debug",
+	"globalSettings.s_winston-logging.level.o_info.label": "Info",
+	"globalSettings.s_winston-logging.level.o_warn.label": "Warn",
+	"globalSettings.s_winston-logging.level.o_error.label": "Error",
+	"globalSettings.s_winston-logging.retentionDays.label": "Retention (days)",
+	"globalSettings.s_winston-logging.retentionDays.description": "Number of days to keep rotated log files before deletion",
+	"system.python-required": "Python 3.10+ is required but not found on this system",
+	"system.device-enrollment-busy": "Too many pending device enrollments — try again shortly",
+	"system.admin-token-expiry-too-long": "An admin token must expire within 90 days",
+	"system.admin-token-name-required": "An admin token needs a name",
+	"system.user-exists": "User with username \"{username}\" already exists",
+	"system.user-not-found": "User with id \"{id}\" not found",
+	"system.addon-no-discovery": "Addon \"{addonId}\" does not support device discovery",
+	"system.addon-no-adoption": "Addon \"{addonId}\" does not support device adoption",
+	"system.addon-no-manual-create": "Addon \"{addonId}\" does not support manual device creation",
+	"system.location-name-required": "[device-manager] addLocation: name must be non-empty",
+	"system.location-required": "[device-manager] setLocationIcon: location must be non-empty",
+	"system.site-zone-name-required": "[device-manager] setSiteZone: name must be non-empty",
+	"server.handoff-busy": "Too many pending handoff codes — try again shortly",
+	"server.app-confirmations-busy": "Too many pending app confirmations",
+	"server.step-up-busy": "Too many pending step-up proofs",
+	"server.login-unavailable": "Login unavailable — `user-management` capability not registered",
+	"server.share-token-expired": "Share token expired: {id}",
+	"server.package-not-allowed": "Package \"{name}\" is not an allowed @camstack/* package",
+	"server.package-protected": "Cannot uninstall protected package \"{name}\"",
+	"server.package-required": "Package {packageName} is required and cannot be uninstalled",
+	"tls.cert-unparsable": "The certificate PEM could not be parsed.",
+	"tls.key-unparsable": "The private key PEM could not be parsed.",
+	"tls.key-mismatch": "The private key does not match the certificate.",
+	"tls.missing-server-auth": "The certificate is missing extendedKeyUsage = serverAuth.",
+	"tls.ca-required": "This certificate was not issued by a public certificate authority, so its CA certificate is required: devices need it to trust the hub. Paste the CA certificate (for mkcert, the rootCA.pem in the folder `mkcert -CAROOT` prints).",
+	"tls.ca-unparsable": "The CA certificate could not be parsed.",
+	"tls.ca-not-issuer": "The certificate was not issued by the CA certificate you supplied.",
+	"tls.ca-not-a-ca": "The supplied CA certificate is not a certificate authority (CA:TRUE is missing).",
+	"tls.ca-expired": "The supplied CA certificate has expired or is not valid yet.",
+	"tls.no-stored-upload": "No uploaded certificate is kept on this node."
+};
+//#endregion
+//#region src/i18n/it.json
+var it_default = {
+	"auth.invalid-credentials": "Credenziali non valide",
+	"auth.invalid-totp": "Codice TOTP non valido",
+	"auth.not-authenticated": "Non autenticato",
+	"auth.login-challenge-expired": "Richiesta di accesso non valida o scaduta — reinserisci la password",
+	"auth.passkey-verification-failed": "Verifica della passkey non riuscita",
+	"auth.user-gone": "L'utente non esiste più",
+	"auth.no-session-cookie": "Nessun cookie di sessione",
+	"auth.invalid-session-cookie": "Cookie di sessione non valido",
+	"auth.handoff-code-invalid": "Codice di passaggio non valido o scaduto",
+	"auth.share-never-expiring-extend": "Un token di condivisione senza scadenza non può essere prorogato",
+	"auth.share-owner-only-extend": "Solo il proprietario del token o un amministratore può prorogare un token di condivisione",
+	"auth.share-owner-only-revoke": "Solo il proprietario del token o un amministratore può revocare un token di condivisione",
+	"auth.share-token-not-found": "Token di condivisione non trovato: {id}",
+	"auth.password-incorrect": "La password non è corretta",
+	"auth.session-required": "Serve una sessione utente con accesso effettuato",
+	"auth.admin-required": "Serve un amministratore",
+	"auth.session-ended": "Sessione terminata — accedi di nuovo",
+	"auth.access-denied": "Accesso negato",
+	"auth.totp-confirm-failed": "Conferma TOTP non riuscita — il codice non corrisponde",
+	"device.certificates-unavailable": "I certificati dei dispositivi non sono disponibili",
+	"device.not-found": "Dispositivo {id} non trovato",
+	"device.credentials-unavailable": "Le credenziali del dispositivo non sono disponibili",
+	"device.credential-not-found": "Credenziale del dispositivo non trovata: {id}",
+	"storage.no-provider": "Nessun provider di archiviazione configurato",
+	"recording.export-unknown": "Esportazione \"{id}\" sconosciuta",
+	"recording.export-invalid-range": "Intervallo di tempo non valido {fromMs}..{toMs}",
+	"recording.export-no-profiles": "L'esportazione richiede almeno un profilo di flusso",
+	"recording.export-not-ready": "L'esportazione \"{id}\" non è pronta ({state})",
+	"recording.export-expired": "L'esportazione \"{id}\" è scaduta",
+	"recording.export-no-file": "L'esportazione \"{id}\" non ha alcun file su disco",
+	"recording.clip-render-unavailable": "La creazione delle clip non è disponibile su questo nodo",
+	"reolink.hub-host-missing": "Hub Reolink: host non configurato",
+	"reolink.hub-password-missing": "Hub Reolink: password non configurata",
+	"reolink.email-push-hub-attached": "Email push non è disponibile per le telecamere collegate a un hub",
+	"reolink.email-push-not-wired": "Il server Email Push non è collegato — riavvia l'addon Reolink",
+	"reolink.webhook-not-wired": "Il server webhook HaCfg non è collegato — riavvia l'addon Reolink",
+	"reolink.webhook-unsupported": "Il firmware della telecamera non supporta il webhook HaCfg Baichuan (cmd 806)",
+	"reolink.preset-invalid": "presetId non valido: {presetId}",
+	"reolink.home-preset-not-baichuan": "Il preset home configurato non è un id Baichuan: {presetId}",
+	"reolink.day-night-schedule-unsupported": "Le telecamere Reolink non supportano una modalità giorno/notte programmata",
+	"reolink.clip-device-not-reolink": "aggiornamento clip: il dispositivo {deviceId} non è una telecamera Reolink qui",
+	"notifiers.gotify-server-url-required": "gotify: serverUrl è obbligatorio",
+	"notifiers.gotify-app-token-required": "gotify: appToken è obbligatorio",
+	"notifiers.email-to-required": "email: manca la configurazione obbligatoria 'to'",
+	"hikvision.camera-name-required": "Il nome della telecamera è obbligatorio",
+	"hikvision.camera-ip-required": "L'IP della telecamera è obbligatorio",
+	"hikvision.password-required": "La password è obbligatoria",
+	"hikvision.home-preset-missing": "Nessun preset home configurato per questa telecamera — impostane uno nelle impostazioni PTZ",
+	"amcrest.camera-name-required": "Il nome della telecamera è obbligatorio",
+	"amcrest.camera-ip-required": "L'IP della telecamera è obbligatorio",
+	"amcrest.password-required": "La password è obbligatoria",
+	"amcrest.home-preset-missing": "Nessun preset home configurato per questa telecamera — impostane uno nelle impostazioni PTZ",
+	"wyze.camera-name-required": "Il nome della telecamera è obbligatorio",
+	"wyze.camera-mac-required": "Wyze: impossibile salvare una telecamera senza indirizzo MAC",
+	"dreame.manual-create-refused": "I dispositivi Dreame si acquisiscono dal cloud, non si creano a mano",
+	"rtsp.camera-name-required": "Il nome della telecamera è obbligatorio",
+	"rtsp.stream-required": "È richiesto almeno un URL di flusso RTSP",
+	"rtsp.too-many-streams": "Sono supportati al massimo 3 URL di flusso RTSP",
+	"gree.name-required": "Il nome del condizionatore è obbligatorio",
+	"gree.ip-required": "L'indirizzo IP del condizionatore è obbligatorio",
+	"ecowitt.name-required": "Il nome del gateway è obbligatorio",
+	"ecowitt.host-required": "L'host del gateway è obbligatorio per la lettura locale",
+	"unifi.name-required": "Il nome del controller è obbligatorio",
+	"unifi.host-required": "L'host del controller è obbligatorio",
+	"vesync.name-required": "Il nome dell'account è obbligatorio",
+	"vesync.email-required": "L'email dell'account è obbligatoria",
+	"unraid.name-required": "Il nome del server è obbligatorio",
+	"unraid.host-required": "L'host del server è obbligatorio",
+	"velux.name-required": "Il nome del gateway è obbligatorio",
+	"velux.host-required": "L'host del gateway è obbligatorio",
+	"cloudflare.custom-not-configured": "Tunnel personalizzato non configurato — avvia «Attiva» dalle impostazioni",
+	"cloudflare.custom-needs-settings": "Il tunnel personalizzato richiede: {missing}. Compila prima le impostazioni qui sopra.",
+	"cloudflare.zone-token-missing": "listZones: nessun token API Cloudflare impostato",
+	"cloudflare.zone-not-visible": "La zona selezionata {zoneId} non è visibile a questo token",
+	"google.from-address-required": "Imposta l'indirizzo del mittente sul broker Google (oppure collega un account).",
+	"google.client-credentials-required": "Configura ID client e segreto del client prima di aggiornare il token Google",
+	"globalSettings.s_alerts.title": "Centro avvisi",
+	"globalSettings.s_alerts.description": "Configura l'archiviazione e la conservazione degli avvisi.",
+	"globalSettings.s_alerts.maxAlerts.label": "Numero massimo di avvisi memorizzati",
+	"globalSettings.s_alerts.maxAlerts.description": "Quando si supera questo limite vengono eliminati gli avvisi letti più vecchi.",
+	"globalSettings.s_alerts.retentionDays.label": "Conservazione degli avvisi (giorni)",
+	"globalSettings.s_alerts.retentionDays.description": "Gli avvisi più vecchi di questo valore vengono rimossi automaticamente.",
+	"globalSettings.s_camera-grids.title": "Griglie di telecamere",
+	"globalSettings.s_camera-grids.description": "Una griglia è una telecamera composita: più telecamere unite in un'unica immagine, registrata e riprodotta come qualsiasi altra telecamera. Creane una qui con un nome; apri la sua telecamera per disporne i riquadri. Il rilevamento oggetti è DISATTIVATO su una nuova griglia, perché le telecamere che la compongono sono già analizzate.",
+	"globalSettings.s_camera-grids.cameraGrids.label": "Griglie",
+	"globalSettings.s_camera-grids.cameraGrids.name.label": "Nome",
+	"globalSettings.s_camera-grids.cameraGrids.enabled.label": "Attiva",
+	"globalSettings.s_camera-grids.cameraGrids.enabled.description": "Una griglia disattivata ritira la sua telecamera.",
+	"gridDevice.s_camera-grid-layout.title": "Disposizione della griglia",
+	"gridDevice.s_camera-grid-layout._gridLayout.label": "",
+	"globalSettings.s_console-logging.title": "Log su console",
+	"globalSettings.s_console-logging.description": "Livello minimo di log da emettere su stdout/stderr. Indipendente dalla destinazione su file ruotati (Winston).",
+	"globalSettings.s_console-logging.level.label": "Livello di log",
+	"globalSettings.s_console-logging.level.o_debug.label": "Debug",
+	"globalSettings.s_console-logging.level.o_info.label": "Info",
+	"globalSettings.s_console-logging.level.o_warn.label": "Avviso",
+	"globalSettings.s_console-logging.level.o_error.label": "Errore",
+	"dayNightConfig.dayNight_mode.label": "Modalità",
+	"dayNightConfig.dayNight_sensitivity.label": "Sensibilità del filtro IR-cut",
+	"dayNightConfig.dayNight_switchDelaySec.label": "Ritardo di commutazione",
+	"section.s_day-night.title": "Giorno / Notte",
+	"section.s_day-night.description": "Modalità di commutazione del filtro IR-cut e i parametri della fotocellula che la regolano.",
+	"baseDeviceSection.s_driver-settings-unavailable.title": "Impostazioni del driver",
+	"baseDeviceSection.s_driver-settings-unavailable.driver-settings-unavailable-notice.label": "Temporaneamente non disponibile",
+	"imageSettingsConfig.imageSettings_brightness.label": "Luminosità",
+	"imageSettingsConfig.imageSettings_contrast.label": "Contrasto",
+	"imageSettingsConfig.imageSettings_saturation.label": "Saturazione",
+	"imageSettingsConfig.imageSettings_sharpness.label": "Nitidezza",
+	"imageSettingsConfig.imageSettings_mirror.label": "Specchio",
+	"imageSettingsConfig.imageSettings_flip.label": "Capovolgi",
+	"imageSettingsConfig.imageSettings_rotate.label": "Rotazione",
+	"imageSettingsConfig.imageSettings_whiteBalance.label": "Bilanciamento del bianco",
+	"imageSettingsConfig.imageSettings_warmth.label": "Calore",
+	"imageSettingsConfig.imageSettings_exposureMode.label": "Modalità di esposizione",
+	"imageSettingsConfig.imageSettings_backlightMode.label": "Compensazione del controluce",
+	"section.s_image-settings.title": "Regolazione immagine",
+	"section.s_image-settings.description": "Cursori dell'immagine, orientamento ed esposizione. Gli elenchi delle opzioni sono letti in tempo reale dalla telecamera: i campi che il firmware non espone sono nascosti.",
+	"volumesField.id.label": "ID",
+	"volumesField.label.label": "Nome",
+	"volumesField.status.label": "Stato",
+	"volumesField.capacity.label": "Capacità",
+	"volumesField.free.label": "Libero",
+	"tracksField.id.label": "Traccia",
+	"tracksField.primary.label": "Principale",
+	"tracksField.enabled.label": "Attiva",
+	"tracksField.codec.label": "Codec",
+	"tracksField.resolution.label": "Risoluzione",
+	"storageSection.s_recording-onboard-storage.title": "Memoria della telecamera",
+	"storageSection.s_recording-onboard-storage.description": "La scheda nella telecamera, come la descrive la telecamera stessa.",
+	"recordingSection.s_recording-onboard-recording.title": "Registrazione sulla telecamera",
+	"recordingSection.s_recording-onboard-recording.description": "Ciò che la telecamera registra sulla propria scheda. Questo configura la telecamera, non il registratore di CamStack.",
+	"globalSettings.s_local-access.title": "HTTP sulla LAN",
+	"globalSettings.s_local-access.description": "Le app native su questo Wi-Fi usano http:// e saltano il certificato privato. Il tunnel e questa interfaccia restano su HTTPS. Disattivalo quando un certificato pubblicamente attendibile copre il nome della LAN.",
+	"globalSettings.s_local-access.httpEnabled.label": "Attiva HTTP sulla LAN",
+	"globalSettings.s_local-access.httpPort.label": "Porta HTTP",
+	"globalSettings.s_local-access.httpPort.description": "Listener dedicato. Non deve coincidere con la porta HTTPS (4443 per impostazione predefinita).",
+	"globalSettings.s_local-access.mdnsAdvertise.label": "Annuncia questo hub sulla LAN (mDNS)",
+	"globalSettings.s_local-access.mdnsAdvertise.description": "Permette a `camstack login` di trovare l'hub senza indirizzo. Annuncia solo l'indirizzo HTTPS, mai un segreto. Richiede il multicast UDP 5353 per raggiungere la LAN (rete host o IP dedicato del container).",
+	"globalSettings.s_local-access.localHostname.label": "Nome host locale",
+	"globalSettings.s_local-access.localHostname.description": "Annunciato al visualizzatore al posto dell'IP LAN grezzo e aggiunto al SAN del certificato. Richiede che questo nome si risolva sulla LAN (DNS del router, mDNS o file hosts). Lascia vuoto per continuare a usare l'IP.",
+	"globalSettings.s_loki-logging.title": "Loki",
+	"globalSettings.s_loki-logging.description": "Invia i log di questo nodo a un'istanza Grafana Loki. Indipendente dalle destinazioni su file ruotati e su console. Attivala o disattivala con il controllo Attiva/Disattiva di questa destinazione, lo stesso usato da tutte le altre.",
+	"globalSettings.s_loki-logging.url.label": "URL di Loki",
+	"globalSettings.s_loki-logging.url.description": "URL base, ad es. http://loki:3100: il percorso /loki/api/v1/push viene aggiunto.",
+	"globalSettings.s_loki-logging.level.label": "Livello minimo",
+	"globalSettings.s_loki-logging.level.o_debug.label": "Debug",
+	"globalSettings.s_loki-logging.level.o_info.label": "Info",
+	"globalSettings.s_loki-logging.level.o_warn.label": "Avviso",
+	"globalSettings.s_loki-logging.level.o_error.label": "Errore",
+	"globalSettings.s_loki-logging.job.label": "Etichetta job",
+	"globalSettings.s_loki-logging.job.description": "L'etichetta `job` di Loki. Tienila fissa: le etichette sono indicizzate.",
+	"globalSettings.s_loki-logging.extraLabels.label": "Etichette aggiuntive",
+	"globalSettings.s_loki-logging.extraLabels.description": "`chiave=valore,chiave2=valore2` statici. Solo a bassa cardinalità: i valori per singola voce vanno nel corpo della riga, e un'etichetta ad alta cardinalità manderà in crisi Loki.",
+	"globalSettings.s_loki-logging.tenantId.label": "ID tenant",
+	"globalSettings.s_loki-logging.tenantId.description": "Inviato come X-Scope-OrgID. Richiesto da Grafana Cloud e da Loki multi-tenant.",
+	"globalSettings.s_loki-logging.username.label": "Nome utente",
+	"globalSettings.s_loki-logging.username.description": "Autenticazione HTTP basic. Lascia vuoto se non serve.",
+	"globalSettings.s_loki-logging.password.label": "Password",
+	"globalSettings.s_loki-logging.batchIntervalMs.label": "Intervallo di invio",
+	"globalSettings.s_loki-logging.batchIntervalMs.description": "Ogni quanto viene inviato un lotto parziale.",
+	"globalSettings.s_loki-logging.batchSize.label": "Dimensione del lotto",
+	"globalSettings.s_loki-logging.batchSize.description": "Invia in anticipo quando sono in coda così tante voci.",
+	"globalSettings.s_loki-logging.timeoutMs.label": "Timeout della richiesta",
+	"globalSettings.s_native-metrics-settings.title": "Metriche di sistema",
+	"globalSettings.s_native-metrics-settings.samplingIntervalMs.label": "Intervallo di campionamento",
+	"globalSettings.s_native-metrics-settings.samplingIntervalMs.description": "Ogni quanto raccogliere le metriche di sistema",
+	"globalSettings.s_native-metrics-load-series.title": "Storico del carico",
+	"globalSettings.s_native-metrics-load-series.loadSeriesCadenceSec.label": "Cadenza di campionamento",
+	"globalSettings.s_native-metrics-load-series.loadSeriesCadenceSec.description": "Ogni quanto ogni nodo riporta il proprio albero di processi. FISSO: un campione viene emesso a ogni intervallo, che qualcosa sia cambiato o no, quindi un buco nel grafico significa una sola cosa: nessuno ha riportato. Fuori dall'intervallo 5-60 s il valore viene rifiutato.",
+	"globalSettings.s_native-metrics-load-series.loadSeriesRetentionHours.label": "Conservazione",
+	"globalSettings.s_native-metrics-load-series.loadSeriesRetentionHours.description": "Per quanto tempo lo storico del carico viene conservato su disco (il database dell'hub, sulla cache NVMe, mai sul disco delle registrazioni). Questa è l'INTENZIONE; il limite di righe qui sotto è la garanzia.",
+	"globalSettings.s_native-metrics-load-series.load-series-cost.label": "Costo di questa configurazione",
+	"globalSettings.s_native-metrics-load-series.load-series-cap.label": "Limite rigido di righe",
+	"globalSettings.s_snapshot-cache.title": "Cache degli snapshot",
+	"globalSettings.s_snapshot-cache.description": "Ripiego obsoleto quando la cattura dal vivo fallisce. La freschezza per dispositivo si configura in Dispositivo → Snapshot → Età massima della cache.",
+	"globalSettings.s_snapshot-cache.staleTtlMs.label": "TTL del ripiego obsoleto (ms)",
+	"globalSettings.s_snapshot-cache.staleTtlMs.description": "Se la cattura dal vivo fallisce, viene comunque restituito uno snapshot in cache più recente di questo valore.",
+	"deviceSettingsContribution.s_snapshot-preferences.title": "Snapshot",
+	"deviceSettingsContribution.s_snapshot-preferences.snapshotStreamId.label": "Flusso preferito",
+	"deviceSettingsContribution.s_snapshot-preferences.snapshotStreamId.description": "Flusso usato per acquisire uno snapshot",
+	"deviceSettingsContribution.s_snapshot-preferences.snapshotMaxAgeS.label": "Età massima della cache (s)",
+	"deviceSettingsContribution.s_snapshot-preferences.snapshotDebug.label": "Log di debug",
+	"deviceSettingsContribution.s_snapshot-preferences.snapshotDebug.description": "Registra la scelta del flusso e i tempi per questo dispositivo.",
+	"providerInfo.s_filesystem-storage.title": "File system",
+	"providerInfo.s_filesystem-storage.basePath.label": "Percorso base",
+	"providerInfo.s_filesystem-storage.basePath.description": "Percorso assoluto della cartella dove vengono salvati i file.",
+	"global.s_system-config-server.description": "Il nome di questo server e le sue impostazioni di connessione (sola lettura, caricate da config.yaml all'avvio).",
+	"global.s_system-config-server.server-restart-note.label": "Riavvio necessario",
+	"global.s_system-config-server.port.label": "Porta",
+	"global.s_system-config-server.port.description": "Porta di ascolto",
+	"global.s_system-config-server.host.label": "Host",
+	"global.s_system-config-server.host.description": "Indirizzo di bind",
+	"global.s_system-config-server.dataPath.label": "Percorso dei dati",
+	"global.s_system-config-server.dataPath.description": "Cartella radice dei dati",
+	"global.s_system-config-auth.description": "Impostazioni di token e sessione.",
+	"global.s_system-config-auth.tokenExpiry.label": "Durata della sessione",
+	"global.s_system-config-auth.tokenExpiry.description": "Per quanto tempo resta valido un accesso senza essere usato, come stringa di durata (ad es. 7d, 30d). Ogni rinnovo lo fa ripartire, quindi un dispositivo in uso resta connesso; uno lasciato inutilizzato per questo tempo deve accedere di nuovo. Un numero senza unità viene rifiutato: sarebbe letto come millisecondi. Si applica dal prossimo accesso o rinnovo.",
+	"global.s_system-config-auth.accessTokenExpiry.label": "Durata del token di accesso",
+	"global.s_system-config-auth.accessTokenExpiry.description": "Per quanto vive un token di accesso prima che l'app lo sostituisca in silenzio con uno nuovo (ad es. 2h; tra 5m e 24h, mai più della sessione). Più breve significa che un token copiato è utile per meno tempo. Le app precedenti ai token di rinnovo ricevono invece un unico token per tutta la sessione.",
+	"global.s_system-config-auth.trustedProxies.label": "Reverse proxy fidati",
+	"global.s_system-config-auth.trustedProxies.description": "Indirizzi o intervalli CIDR (ad es. 192.168.1.2 o 10.0.0.0/24) dei reverse proxy davanti all'hub. Solo una richiesta il cui mittente diretto è uno di questi, o questo stesso host come con il tunnel Cloudflare, ha X-Forwarded-For / CF-Connecting-IP letto come indirizzo reale del client per i limiti di frequenza. Lascia vuoto a meno che un proxy su un altro host inoltri verso l'hub.",
+	"global.s_system-config-auth.trustedNetworksWarning.label": "Salto dell'autenticazione a due fattori",
+	"global.s_system-config-auth.trustedNetworks.label": "Reti fidate (salta il secondo fattore)",
+	"global.s_system-config-auth.trustedNetworks.description": "Indirizzi o intervalli CIDR, ad es. 192.168.1.0/24. Mantienili il più stretti possibile: una singola VLAN fidata, non tutta la LAN.",
+	"globalSettings.s_winston-logging.title": "Log",
+	"globalSettings.s_winston-logging.description": "Dettaglio globale dei log e conservazione dei file di log ruotati su questo nodo.",
+	"globalSettings.s_winston-logging.level.label": "Livello di log",
+	"globalSettings.s_winston-logging.level.o_debug.label": "Debug",
+	"globalSettings.s_winston-logging.level.o_info.label": "Info",
+	"globalSettings.s_winston-logging.level.o_warn.label": "Avviso",
+	"globalSettings.s_winston-logging.level.o_error.label": "Errore",
+	"globalSettings.s_winston-logging.retentionDays.label": "Conservazione (giorni)",
+	"globalSettings.s_winston-logging.retentionDays.description": "Numero di giorni per cui conservare i file di log ruotati prima dell'eliminazione",
+	"system.python-required": "Serve Python 3.10 o successivo, ma non è stato trovato su questo sistema",
+	"system.device-enrollment-busy": "Troppe registrazioni di dispositivi in attesa — riprova tra poco",
+	"system.admin-token-expiry-too-long": "Un token amministratore deve scadere entro 90 giorni",
+	"system.admin-token-name-required": "Un token amministratore richiede un nome",
+	"system.user-exists": "Esiste già un utente con nome utente \"{username}\"",
+	"system.user-not-found": "Utente con ID \"{id}\" non trovato",
+	"system.addon-no-discovery": "L'addon \"{addonId}\" non supporta il rilevamento dei dispositivi",
+	"system.addon-no-adoption": "L'addon \"{addonId}\" non supporta l'acquisizione dei dispositivi",
+	"system.addon-no-manual-create": "L'addon \"{addonId}\" non supporta la creazione manuale di dispositivi",
+	"system.location-name-required": "Il nome del luogo non può essere vuoto",
+	"system.location-required": "Il luogo non può essere vuoto",
+	"system.site-zone-name-required": "Il nome della zona non può essere vuoto",
+	"server.handoff-busy": "Troppi codici di passaggio in attesa — riprova tra poco",
+	"server.app-confirmations-busy": "Troppe conferme di app in attesa",
+	"server.step-up-busy": "Troppe verifiche di sicurezza in attesa",
+	"server.login-unavailable": "Accesso non disponibile — la capacità `user-management` non è registrata",
+	"server.share-token-expired": "Token di condivisione scaduto: {id}",
+	"server.package-not-allowed": "Il pacchetto \"{name}\" non è un pacchetto @camstack/* consentito",
+	"server.package-protected": "Impossibile disinstallare il pacchetto protetto \"{name}\"",
+	"server.package-required": "Il pacchetto {packageName} è necessario e non può essere disinstallato",
+	"tls.cert-unparsable": "Impossibile leggere il PEM del certificato.",
+	"tls.key-unparsable": "Impossibile leggere il PEM della chiave privata.",
+	"tls.key-mismatch": "La chiave privata non corrisponde al certificato.",
+	"tls.missing-server-auth": "Al certificato manca extendedKeyUsage = serverAuth.",
+	"tls.ca-required": "Questo certificato non è stato emesso da una CA pubblica, quindi serve il certificato della sua CA: i dispositivi ne hanno bisogno per fidarsi dell'hub. Incolla il certificato della CA (per mkcert, il rootCA.pem nella cartella indicata da `mkcert -CAROOT`).",
+	"tls.ca-unparsable": "Impossibile leggere il certificato della CA.",
+	"tls.ca-not-issuer": "Il certificato non è stato emesso dalla CA che hai fornito.",
+	"tls.ca-not-a-ca": "Il certificato fornito non è una autorità di certificazione (manca CA:TRUE).",
+	"tls.ca-expired": "Il certificato della CA fornito è scaduto o non è ancora valido.",
+	"tls.no-stored-upload": "Su questo nodo non è conservato nessun certificato caricato."
+};
+//#endregion
+//#region src/i18n/catalog-registry.ts
+/**
+* The hub's translation catalogs (D863).
+*
+* Core namespace `server` ships inside this package (`en.json` / `it.json`:
+* user-facing error texts + core schema labels). Every installed addon may add
+* `i18n/<lang>.json` in its package directory; its namespace is its addon id.
+* Every file is validated with zod; a broken file is logged and ignored, never
+* fatal - the English text that travels beside every key is the floor.
+*/
+/** The core namespace: user-facing error texts and core schema labels. */
+var SERVER_NAMESPACE = "server";
+/** `@camstack/addon-provider-reolink` -> `provider-reolink`; `@camstack/system` -> `system`. */
+function catalogNamespaceOf(packageName) {
+	return packageName.replace(/^@camstack\//, "").replace(/^addon-/, "");
+}
+var CatalogRegistry = class {
+	warn;
+	namespaces = /* @__PURE__ */ new Map();
+	constructor(warn = () => void 0) {
+		this.warn = warn;
+	}
+	/** Validates `raw` and installs it; returns false (after warning) when it is not a flat string map. */
+	set(ns, lang, raw, origin) {
+		const parsed = require_dist.CatalogFileSchema.safeParse(raw);
+		if (!parsed.success) {
+			this.warn(`i18n catalog ignored (${origin}): ${parsed.error.issues[0]?.message ?? "invalid"}`);
+			return false;
+		}
+		const langs = this.namespaces.get(ns) ?? /* @__PURE__ */ new Map();
+		langs.set(lang, parsed.data);
+		this.namespaces.set(ns, langs);
+		return true;
+	}
+	/** Loads `<packageDir>/i18n/<lang>.json` for every language that has a file. */
+	loadAddonDir(ns, packageDir) {
+		for (const lang of require_dist.CATALOG_LANGS) {
+			const file = node_path.join(packageDir, "i18n", `${lang}.json`);
+			let text;
+			try {
+				text = node_fs.readFileSync(file, "utf8");
+			} catch {
+				continue;
+			}
+			try {
+				this.set(ns, lang, JSON.parse(text), file);
+			} catch (err) {
+				this.warn(`i18n catalog ignored (${file}): ${err instanceof Error ? err.message : "bad JSON"}`);
+			}
+		}
+	}
+	/** Drops a namespace (addon uninstalled or redeployed before a reload). */
+	clear(ns) {
+		this.namespaces.delete(ns);
+	}
+	/** The text for `ns:key` in `lang`, or `undefined`. Never falls back across languages. */
+	lookup(lang, ns, key) {
+		return this.namespaces.get(ns)?.get(lang)?.[key];
+	}
+	/**
+	* `t(ns, key, params, fallbackEnglish)` - the translation in `lang`, else
+	* the English fallback (also interpolated). English is never looked up: the
+	* fallback IS the English text.
+	*/
+	t(lang, ns, key, params, fallbackEnglish) {
+		return require_dist.interpolate((lang === "en" ? void 0 : this.lookup(lang, ns, key)) ?? fallbackEnglish, params);
+	}
+	/** A lookup bound to one language, for `localizeConfigTree`. English never substitutes. */
+	lookupFor(lang) {
+		return (ns, key) => lang === "en" ? void 0 : this.lookup(lang, ns, key);
+	}
+	/** `t` for a `"ns:key"` reference. */
+	tRef(lang, ref, params, fallbackEnglish) {
+		const parts = require_dist.splitTranslationRef(ref);
+		return parts === null ? require_dist.interpolate(fallbackEnglish, params) : this.t(lang, parts.ns, parts.key, params, fallbackEnglish);
+	}
+};
+var shared = null;
+/** A fresh registry holding the core `server` namespace (specs build their own). */
+function createCoreCatalogRegistry(warn) {
+	const registry = new CatalogRegistry(warn);
+	registry.set(SERVER_NAMESPACE, "en", en_default, "server/en.json");
+	registry.set(SERVER_NAMESPACE, "it", it_default, "server/it.json");
+	return registry;
+}
+/** The hub's one registry, core catalogs preloaded. */
+function getCatalogRegistry(warn) {
+	if (shared === null) shared = createCoreCatalogRegistry(warn);
+	return shared;
+}
+/** Spec hook: forget the shared registry. */
+function resetCatalogRegistryForTests() {
+	shared = null;
+}
+//#endregion
 exports.ADMIN_TOKEN_MAX_LIFETIME_MS = require_builtins_local_auth_local_auth_addon.ADMIN_TOKEN_MAX_LIFETIME_MS;
 exports.ADMIN_TOKEN_PREFIX = require_builtins_local_auth_local_auth_addon.ADMIN_TOKEN_PREFIX;
 exports.AGENT_CAP_FWD_ACTION = AGENT_CAP_FWD_ACTION;
@@ -26547,6 +27204,7 @@ exports.CapUsageRegistry = CapUsageRegistry;
 exports.CapabilityHandle = CapabilityHandle;
 exports.CapabilityRegistry = CapabilityRegistry;
 exports.CapabilityUnavailableError = CapabilityUnavailableError;
+exports.CatalogRegistry = CatalogRegistry;
 exports.ComposerAddon = require_builtins_composer_composer_addon.ComposerAddon;
 exports.ConfigManager = ConfigManager;
 exports.ConfigStore = require_builtins_sqlite_storage_index.ConfigStore$1;
@@ -26654,6 +27312,8 @@ exports.PAIRING_PIN_DIGITS = require_builtins_system_config_system_config_addon.
 exports.PAIRING_PROTOCOL = require_builtins_system_config_system_config_addon.PAIRING_PROTOCOL;
 exports.PAIRING_TTL_MS = require_builtins_system_config_system_config_addon.PAIRING_TTL_MS;
 exports.PARENT_ROUTED_PROVIDER_ADDON_ID = PARENT_ROUTED_PROVIDER_ADDON_ID;
+exports.PERMITTED_DNS_SUFFIXES = require_agent_https.PERMITTED_DNS_SUFFIXES;
+exports.PERMITTED_IP_RANGES = require_agent_https.PERMITTED_IP_RANGES;
 exports.PREVIOUS_LEAF_GRACE_MS = require_builtins_local_auth_local_auth_addon.PREVIOUS_LEAF_GRACE_MS;
 Object.defineProperty(exports, "PYTHON_VERSION", {
 	enumerable: true,
@@ -26680,6 +27340,7 @@ exports.ReadinessTimeoutError = require_dist.ReadinessTimeoutError;
 exports.ReplEngine = ReplEngine;
 exports.RingBuffer = RingBuffer;
 exports.SERVER_AUTH_OID = require_agent_https.SERVER_AUTH_OID;
+exports.SERVER_NAMESPACE = SERVER_NAMESPACE;
 exports.SOCKET_PLANE_TOP_N = SOCKET_PLANE_TOP_N;
 exports.SOCKET_QUEUE_TOP_N = SOCKET_QUEUE_TOP_N;
 exports.STALL_REPORT_MS = require_custom_action_registry.STALL_REPORT_MS;
@@ -26742,6 +27403,7 @@ Object.defineProperty(exports, "buildBinaryPath", {
 exports.buildCapRouters = buildCapRouters;
 exports.buildHeapSample = buildHeapSample;
 exports.buildLinkChain = buildLinkChain;
+exports.buildNameConstraintSet = require_agent_https.buildNameConstraintSet;
 exports.buildNativeCapProxy = buildNativeCapProxy;
 exports.buildNodeManifest = buildNodeManifest;
 exports.buildNpmChildEnv = buildNpmChildEnv;
@@ -26750,6 +27412,7 @@ exports.buildTransporter = buildTransporter;
 exports.builderMountedCapNames = builderMountedCapNames;
 exports.caFingerprint = require_builtins_system_config_system_config_addon.caFingerprint;
 exports.caFingerprintCompact = require_builtins_system_config_system_config_addon.caFingerprintCompact;
+exports.caReplacementMarkerFile = require_hub_mdns_ciao.caReplacementMarkerFile;
 exports.callRegisterNodeWithRetry = callRegisterNodeWithRetry;
 exports.callWithServiceDiscovery = callWithServiceDiscovery;
 exports.canServeDataPlane = canServeDataPlane;
@@ -26758,7 +27421,10 @@ exports.capActionName = capActionName;
 exports.capActionSuffix = capActionSuffix;
 exports.capBareAction = capBareAction;
 exports.capServiceName = capServiceName;
+exports.catalogNamespaceOf = catalogNamespaceOf;
 exports.certificateNames = require_agent_https.certificateNames;
+exports.chainsToPublicRoot = require_hub_mdns_ciao.chainsToPublicRoot;
+exports.checkUploadedCa = require_hub_mdns_ciao.checkUploadedCa;
 exports.classifyAddonDir = classifyAddonDir;
 exports.classifyCapRoute = classifyCapRoute;
 exports.clearHttpsListener = require_hub_mdns_ciao.clearHttpsListener;
@@ -26790,6 +27456,7 @@ exports.createCapActionCensus = createCapActionCensus;
 exports.createCiaoPublisher = require_hub_mdns_ciao.createCiaoPublisher;
 exports.createCidrMatcher = require_builtins_system_config_system_config_addon.createCidrMatcher;
 exports.createCoreCapService = createCoreCapService;
+exports.createCoreCatalogRegistry = createCoreCatalogRegistry;
 exports.createDeferredHeapWatchSink = createDeferredHeapWatchSink;
 exports.createDoorSettingsView = createDoorSettingsView;
 exports.createEventPlaneMeter = createEventPlaneMeter;
@@ -26897,6 +27564,7 @@ exports.generateMeshKeyPair = require_builtins_system_config_system_config_addon
 exports.getBrokerEventBus = getBrokerEventBus;
 exports.getBrokerTlsTransporter = getBrokerTlsTransporter;
 exports.getCapUsageRegistry = getCapUsageRegistry;
+exports.getCatalogRegistry = getCatalogRegistry;
 Object.defineProperty(exports, "getFfmpegDownloadUrl", {
 	enumerable: true,
 	get: function() {
@@ -26962,6 +27630,7 @@ exports.isAllowedAgentDashboardReturnTo = require_builtins_system_config_system_
 exports.isArrayBufferCensusReport = isArrayBufferCensusReport;
 exports.isArrayOutputSchema = require_dist.isArrayOutputSchema;
 exports.isCollectionArrayMethod = require_dist.isCollectionArrayMethod;
+exports.isConstrainedCa = require_agent_https.isConstrainedCa;
 exports.isContainerBridgeAddress = require_agent_https.isContainerBridgeAddress;
 exports.isCredentialKeyName = isCredentialKeyName;
 exports.isInfraCapability = isInfraCapability;
@@ -27009,6 +27678,8 @@ exports.parseTokenExpiry = require_builtins_local_auth_local_auth_addon.parseTok
 exports.parseTokenizedUrl = require_custom_action_registry.parseTokenizedUrl;
 exports.partitionIsolatedBuiltinIds = partitionIsolatedBuiltinIds;
 exports.pemDigest = require_agent_https.pemDigest;
+exports.permitsIdentity = require_agent_https.permitsIdentity;
+exports.permitsName = require_agent_https.permitsName;
 exports.pinnedHttpsCaFingerprint = require_agent_https.pinnedHttpsCaFingerprint;
 exports.prepareBootTls = require_hub_mdns_ciao.prepareBootTls;
 exports.prepareRestoreArchive = require_restore_archive.prepareRestoreArchive;
@@ -27022,6 +27693,7 @@ exports.readCidrSetting = require_builtins_system_config_system_config_addon.rea
 exports.readExtraSans = require_hub_mdns_ciao.readExtraSans;
 exports.readHeapSpaces = readHeapSpaces;
 exports.readLanHttpState = require_hub_mdns_ciao.readLanHttpState;
+exports.readNameConstraints = require_agent_https.readNameConstraints;
 exports.readPendingRestart = readPendingRestart;
 exports.readSocketQueues = readSocketQueues;
 exports.readTlsAccessStatus = require_hub_mdns_ciao.readTlsAccessStatus;
@@ -27039,11 +27711,14 @@ exports.registerLanHttpHandler = require_hub_mdns_ciao.registerLanHttpHandler;
 exports.reissueTlsLeaf = require_hub_mdns_ciao.reissueTlsLeaf;
 exports.reloadHttpsListener = require_hub_mdns_ciao.reloadHttpsListener;
 exports.renewMeshCertificate = require_builtins_system_config_system_config_addon.renewMeshCertificate;
+exports.replaceUnconstrainedLocalCa = require_hub_mdns_ciao.replaceUnconstrainedLocalCa;
 exports.requireProcessMeshCa = require_builtins_system_config_system_config_addon.requireProcessMeshCa;
+exports.resetCatalogRegistryForTests = resetCatalogRegistryForTests;
 exports.resolveFilePath = require_custom_action_registry.resolveFilePath;
 exports.resolveFormatRevision = require_custom_action_registry.resolveFormatRevision;
 exports.resolveHwAccel = resolveHwAccel;
 exports.resolveNpmInvocation = resolveNpmInvocation;
+exports.retirePreviousLocalCa = require_hub_mdns_ciao.retirePreviousLocalCa;
 exports.revertToGeneratedCertificate = require_hub_mdns_ciao.revertToGeneratedCertificate;
 exports.revisionWeightUrl = require_custom_action_registry.revisionWeightUrl;
 exports.revokeMeshCertificate = require_builtins_system_config_system_config_addon.revokeMeshCertificate;
@@ -27087,6 +27762,7 @@ exports.stripForwardedCaller = require_builtins_storage_orchestrator_storage_orc
 exports.subscribePassthrough = subscribePassthrough;
 exports.systemHostFacts = require_agent_https.systemHostFacts;
 exports.udsChildLogToWorkerEntry = udsChildLogToWorkerEntry;
+exports.useStoredUploadedCertificate = require_hub_mdns_ciao.useStoredUploadedCertificate;
 exports.validateProviderRegistrations = validateProviderRegistrations;
 exports.validateUploadedTls = require_hub_mdns_ciao.validateUploadedTls;
 exports.verifyAgentUiUnlockTicket = require_builtins_system_config_system_config_addon.verifyAgentUiUnlockTicket;