herdr-remote 0.2.0

package/dist/tui.mjs

@@ -0,0 +1,3982 @@
+import { createRequire as __createRequire } from 'node:module';
+import { dirname as __dirnameOf } from 'node:path';
+import { fileURLToPath as __fileURLToPath } from 'node:url';
+const require = __createRequire(import.meta.url);
+const __filename = __fileURLToPath(import.meta.url);
+const __dirname = __dirnameOf(__filename);
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
+var __commonJS = (cb, mod) => function __require2() {
+  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+
+// src/config.js
+var require_config = __commonJS({
+  "src/config.js"(exports, module) {
+    "use strict";
+    var fs = __require("node:fs");
+    var os = __require("node:os");
+    var path = __require("node:path");
+    function findPackageRoot(start) {
+      let directory = start;
+      for (let depth = 0; depth < 8; depth += 1) {
+        const candidate = path.join(directory, "package.json");
+        try {
+          if (JSON.parse(fs.readFileSync(candidate, "utf8")).name === "herdr-remote") return directory;
+        } catch {
+        }
+        const parent = path.dirname(directory);
+        if (parent === directory) break;
+        directory = parent;
+      }
+      return path.resolve(start, "..");
+    }
+    var PACKAGE_ROOT = findPackageRoot(__dirname);
+    var ACCESS_MODES2 = ["local", "lan", "remote"];
+    var LANGUAGES = ["auto", "zh", "en"];
+    var KEEPALIVE_MANAGERS = ["auto", "systemd", "launchd", "supervisor", "none"];
+    var DEFAULTS = {
+      ui: {
+        language: "auto"
+      },
+      relay: {
+        mode: "local",
+        port: 8787,
+        // Address advertised in pairing URLs when mode is "lan". Empty means "pick
+        // the first non-internal IPv4 automatically".
+        lanHost: "",
+        // Manual override for the URL browsers open. Empty means "derive it".
+        publicUrl: "",
+        // Operator-run relay, e.g. wss://herdr.example.com (mode "remote" only).
+        remoteUrl: "",
+        maxPayloadBytes: 1024 * 1024,
+        maxClientsPerHost: 16,
+        allowedOrigins: []
+      },
+      herdr: {
+        socketPath: null,
+        args: [],
+        cwd: os.homedir()
+      },
+      auth: {
+        pairingTtlMs: 10 * 60 * 1e3,
+        deviceTtlMs: 30 * 24 * 60 * 60 * 1e3,
+        maxDevices: 32
+      },
+      cleanup: {
+        intervalMs: 60 * 1e3,
+        heartbeatIntervalMs: 30 * 1e3,
+        staleAfterMs: 90 * 1e3
+      },
+      keepalive: {
+        manager: "auto"
+      }
+    };
+    function clone(value) {
+      return JSON.parse(JSON.stringify(value));
+    }
+    function configDir() {
+      return process.env.HERDR_REMOTE_CONFIG_DIR || path.join(os.homedir(), ".config", "herdr-remote");
+    }
+    function stateDir2() {
+      return process.env.HERDR_REMOTE_STATE_DIR || path.join(os.homedir(), ".local", "state", "herdr-remote");
+    }
+    function configPath2() {
+      return path.join(configDir(), "config.json");
+    }
+    function runtimeStatePath() {
+      return path.join(stateDir2(), "runtime.json");
+    }
+    function legacyConfigPath() {
+      return process.env.HERDR_PLUGIN_CONFIG_DIR ? path.join(process.env.HERDR_PLUGIN_CONFIG_DIR, "config.json") : null;
+    }
+    function readJson(filePath) {
+      try {
+        return JSON.parse(fs.readFileSync(filePath, "utf8"));
+      } catch (error) {
+        if (error.code !== "ENOENT") {
+          process.stderr.write(`herdr-remote: ignoring invalid JSON at ${filePath}: ${error.message}
+`);
+        }
+        return {};
+      }
+    }
+    function migrateLegacyConfig() {
+      const target = configPath2();
+      if (fs.existsSync(target)) return { migrated: false, reason: "config already exists" };
+      const legacy = legacyConfigPath();
+      if (!legacy || !fs.existsSync(legacy)) return { migrated: false, reason: "no legacy config" };
+      try {
+        fs.mkdirSync(path.dirname(target), { recursive: true, mode: 448 });
+        fs.copyFileSync(legacy, target);
+        return { migrated: true, from: legacy, to: target };
+      } catch (error) {
+        return { migrated: false, reason: error.message };
+      }
+    }
+    function mergeConfig(fileConfig) {
+      const config = clone(DEFAULTS);
+      for (const section of Object.keys(config)) {
+        if (fileConfig && fileConfig[section] && typeof fileConfig[section] === "object") {
+          Object.assign(config[section], fileConfig[section]);
+        }
+      }
+      return config;
+    }
+    function normalizeLegacyFields(config, fileConfig) {
+      const legacy = fileConfig && fileConfig.relay || {};
+      const hasExplicitMode = ACCESS_MODES2.includes(legacy.mode);
+      if (!hasExplicitMode) {
+        if (legacy.local === false && typeof legacy.url === "string" && legacy.url) {
+          config.relay.mode = "remote";
+          if (!config.relay.remoteUrl) config.relay.remoteUrl = legacy.url;
+        } else if (typeof legacy.host === "string" && legacy.host && !isLoopbackHost(legacy.host)) {
+          config.relay.mode = "lan";
+        } else {
+          config.relay.mode = "local";
+        }
+      }
+      if (config.relay.mode === "lan" && !config.relay.lanHost && typeof legacy.host === "string" && !isLoopbackHost(legacy.host) && legacy.host !== "0.0.0.0") {
+        config.relay.lanHost = legacy.host;
+      }
+      delete config.relay.local;
+      delete config.relay.host;
+      delete config.relay.url;
+      if (typeof config.relay.publicUrl === "string" && /^https?:\/\/(127\.0\.0\.1|localhost)(:\d+)?\/?$/.test(config.relay.publicUrl)) {
+        config.relay.publicUrl = "";
+      }
+    }
+    function parseInteger(value, fallback, min, max) {
+      const numeric = Number(value);
+      if (!Number.isInteger(numeric) || numeric < min || numeric > max) return fallback;
+      return numeric;
+    }
+    function isLoopbackHost(value) {
+      return value === "127.0.0.1" || value === "localhost" || value === "::1" || value === "[::1]";
+    }
+    function isUnspecifiedAddress(value) {
+      const address = typeof value === "string" ? value.trim().toLowerCase() : "";
+      return address === "0.0.0.0" || address === "::" || address === "[::]";
+    }
+    function isUnspecifiedHost(value) {
+      try {
+        const hostname = new URL(value).hostname.toLowerCase();
+        return hostname === "0.0.0.0" || hostname === "::" || hostname === "[::]";
+      } catch {
+        return false;
+      }
+    }
+    function normalizeUrl(value) {
+      return typeof value === "string" ? value.trim().replace(/\/+$/, "") : "";
+    }
+    function validate(config) {
+      if (!ACCESS_MODES2.includes(config.relay.mode)) config.relay.mode = DEFAULTS.relay.mode;
+      if (!LANGUAGES.includes(config.ui.language)) config.ui.language = DEFAULTS.ui.language;
+      if (!KEEPALIVE_MANAGERS.includes(config.keepalive.manager)) config.keepalive.manager = DEFAULTS.keepalive.manager;
+      config.relay.port = parseInteger(config.relay.port, DEFAULTS.relay.port, 1, 65535);
+      config.relay.maxPayloadBytes = parseInteger(config.relay.maxPayloadBytes, DEFAULTS.relay.maxPayloadBytes, 4096, 16 * 1024 * 1024);
+      config.relay.maxClientsPerHost = parseInteger(config.relay.maxClientsPerHost, DEFAULTS.relay.maxClientsPerHost, 1, 256);
+      config.auth.pairingTtlMs = parseInteger(config.auth.pairingTtlMs, DEFAULTS.auth.pairingTtlMs, 30 * 1e3, 24 * 60 * 60 * 1e3);
+      config.auth.deviceTtlMs = parseInteger(config.auth.deviceTtlMs, DEFAULTS.auth.deviceTtlMs, 60 * 1e3, 365 * 24 * 60 * 60 * 1e3);
+      config.auth.maxDevices = parseInteger(config.auth.maxDevices, DEFAULTS.auth.maxDevices, 1, 1e4);
+      config.cleanup.intervalMs = parseInteger(config.cleanup.intervalMs, DEFAULTS.cleanup.intervalMs, 1e3, 24 * 60 * 60 * 1e3);
+      config.cleanup.heartbeatIntervalMs = parseInteger(config.cleanup.heartbeatIntervalMs, DEFAULTS.cleanup.heartbeatIntervalMs, 1e3, 10 * 60 * 1e3);
+      config.cleanup.staleAfterMs = parseInteger(config.cleanup.staleAfterMs, DEFAULTS.cleanup.staleAfterMs, config.cleanup.heartbeatIntervalMs * 2, 24 * 60 * 60 * 1e3);
+      config.relay.publicUrl = normalizeUrl(config.relay.publicUrl);
+      config.relay.remoteUrl = normalizeUrl(config.relay.remoteUrl);
+      config.relay.lanHost = typeof config.relay.lanHost === "string" ? config.relay.lanHost.trim() : "";
+      if (config.relay.mode === "lan" && (isLoopbackHost(config.relay.lanHost) || isUnspecifiedAddress(config.relay.lanHost))) {
+        config.relay.lanHost = "";
+      }
+      if (isUnspecifiedHost(config.relay.publicUrl)) config.relay.publicUrl = "";
+      if (!Array.isArray(config.relay.allowedOrigins)) config.relay.allowedOrigins = [];
+      if (!Array.isArray(config.herdr.args) || !config.herdr.args.every((arg) => typeof arg === "string")) {
+        config.herdr.args = [];
+      }
+      if (typeof config.herdr.socketPath !== "string" || config.herdr.socketPath.length === 0) {
+        config.herdr.socketPath = null;
+      }
+      if (typeof config.herdr.cwd !== "string" || config.herdr.cwd.length === 0) {
+        config.herdr.cwd = os.homedir();
+      }
+      if (config.relay.mode === "remote" && !config.relay.remoteUrl) {
+        config.relay.mode = "local";
+      }
+      return config;
+    }
+    function applyEnvironment(config) {
+      const env = process.env;
+      if (env.HERDR_REMOTE_LANG && LANGUAGES.includes(env.HERDR_REMOTE_LANG)) config.ui.language = env.HERDR_REMOTE_LANG;
+      if (env.HERDR_REMOTE_MODE && ACCESS_MODES2.includes(env.HERDR_REMOTE_MODE)) config.relay.mode = env.HERDR_REMOTE_MODE;
+      if (env.RELAY_PORT) config.relay.port = env.RELAY_PORT;
+      if (env.RELAY_PUBLIC_URL) config.relay.publicUrl = env.RELAY_PUBLIC_URL;
+      if (env.RELAY_REMOTE_URL) config.relay.remoteUrl = env.RELAY_REMOTE_URL;
+      if (env.HERDR_SOCKET_PATH) config.herdr.socketPath = env.HERDR_SOCKET_PATH;
+      if (env.HERDR_CWD) config.herdr.cwd = env.HERDR_CWD;
+      if (env.HERDR_ARGS_JSON) {
+        try {
+          const args = JSON.parse(env.HERDR_ARGS_JSON);
+          if (Array.isArray(args)) config.herdr.args = args;
+        } catch (error) {
+          process.stderr.write(`herdr-remote: invalid HERDR_ARGS_JSON: ${error.message}
+`);
+        }
+      }
+    }
+    function loadConfig2() {
+      const fileConfig = readJson(configPath2());
+      const config = mergeConfig(fileConfig);
+      normalizeLegacyFields(config, fileConfig);
+      applyEnvironment(config);
+      validate(config);
+      return config;
+    }
+    function configExists2() {
+      return fs.existsSync(configPath2());
+    }
+    function runsLocalRelay(config) {
+      return config.relay.mode !== "remote";
+    }
+    function bindAddress2(config) {
+      return config.relay.mode === "lan" ? "0.0.0.0" : "127.0.0.1";
+    }
+    function advertisedHost(config, fallbackLanHost = null) {
+      if (config.relay.mode === "lan") {
+        const configured = config.relay.lanHost;
+        if (configured && !isLoopbackHost(configured) && !isUnspecifiedAddress(configured)) return configured;
+        if (fallbackLanHost && !isLoopbackHost(fallbackLanHost) && !isUnspecifiedAddress(fallbackLanHost)) {
+          return fallbackLanHost;
+        }
+        return "127.0.0.1";
+      }
+      return "127.0.0.1";
+    }
+    function resolvePublicUrl2(config, fallbackLanHost = null) {
+      if (config.relay.publicUrl) return config.relay.publicUrl;
+      if (config.relay.mode === "remote") return httpOrigin(config.relay.remoteUrl);
+      return `http://${advertisedHost(config, fallbackLanHost)}:${config.relay.port}`;
+    }
+    function resolveAdminOrigin2(config) {
+      if (config.relay.mode === "remote") return httpOrigin(config.relay.remoteUrl);
+      return `http://127.0.0.1:${config.relay.port}`;
+    }
+    function resolveHostRelayUrl(config) {
+      const base = config.relay.mode === "remote" ? config.relay.remoteUrl : `ws://127.0.0.1:${config.relay.port}`;
+      return hostWebSocketUrl(base);
+    }
+    function httpOrigin(value) {
+      try {
+        const url = new URL(value);
+        if (url.protocol === "ws:") url.protocol = "http:";
+        if (url.protocol === "wss:") url.protocol = "https:";
+        const pathname = url.pathname.replace(/\/+$/, "");
+        return `${url.origin}${pathname}`;
+      } catch {
+        return normalizeUrl(value);
+      }
+    }
+    function hostWebSocketUrl(base) {
+      const url = new URL(base);
+      if (url.protocol === "http:") url.protocol = "ws:";
+      if (url.protocol === "https:") url.protocol = "wss:";
+      const pathname = url.pathname.replace(/\/+$/, "");
+      if (!pathname || pathname === "/") {
+        url.pathname = "/ws/host";
+      } else if (!pathname.endsWith("/ws/host")) {
+        url.pathname = `${pathname}/ws/host`;
+      }
+      return url.toString();
+    }
+    function clientWebSocketUrl(locationLike) {
+      const url = new URL(locationLike);
+      if (url.protocol === "http:") url.protocol = "ws:";
+      if (url.protocol === "https:") url.protocol = "wss:";
+      const pathname = url.pathname.replace(/\/+$/, "");
+      url.pathname = !pathname || pathname === "/" ? "/ws/client" : `${pathname}/ws/client`;
+      return url.toString();
+    }
+    module.exports = {
+      PACKAGE_ROOT,
+      DEFAULTS,
+      ACCESS_MODES: ACCESS_MODES2,
+      LANGUAGES,
+      KEEPALIVE_MANAGERS,
+      configDir,
+      configPath: configPath2,
+      configExists: configExists2,
+      stateDir: stateDir2,
+      runtimeStatePath,
+      legacyConfigPath,
+      migrateLegacyConfig,
+      loadConfig: loadConfig2,
+      validate,
+      runsLocalRelay,
+      bindAddress: bindAddress2,
+      advertisedHost,
+      resolvePublicUrl: resolvePublicUrl2,
+      resolveAdminOrigin: resolveAdminOrigin2,
+      resolveHostRelayUrl,
+      hostWebSocketUrl,
+      clientWebSocketUrl,
+      httpOrigin,
+      isLoopbackHost,
+      isUnspecifiedAddress,
+      isUnspecifiedHost
+    };
+  }
+});
+
+// src/i18n/en.js
+var require_en = __commonJS({
+  "src/i18n/en.js"(exports, module) {
+    "use strict";
+    module.exports = {
+      "app.name": "Herdr Remote",
+      "app.tagline": "Remote browser access to your Herdr workspaces",
+      "common.yes": "Yes",
+      "common.no": "No",
+      "common.on": "on",
+      "common.off": "off",
+      "common.none": "none",
+      "common.auto": "auto",
+      "common.unknown": "unknown",
+      "common.running": "running",
+      "common.stopped": "stopped",
+      "common.connected": "connected",
+      "common.disconnected": "disconnected",
+      "common.installed": "installed",
+      "common.notInstalled": "not installed",
+      "common.enabled": "enabled",
+      "common.disabled": "disabled",
+      "common.loading": "Working\u2026",
+      "common.save": "Save settings",
+      "common.saved": "Configuration saved to {path}",
+      "common.back": "Back",
+      "common.cancel": "Cancel",
+      "common.confirm": "Confirm",
+      "common.pid": "pid {pid}",
+      "common.notApplicable": "n/a",
+      "nav.overview": "Overview",
+      "nav.pair": "Pair a device",
+      "nav.services": "Services",
+      "nav.relay": "Relay",
+      "nav.keepalive": "Keep-alive",
+      "nav.herdr": "Herdr",
+      "nav.about": "Language & about",
+      "mode.local": "This machine only",
+      "mode.lan": "Local network / Tailscale",
+      "mode.remote": "Self-hosted relay",
+      "mode.local.description": "The relay listens on 127.0.0.1. Only a browser on this machine can reach it.",
+      "mode.lan.description": "The relay listens on 0.0.0.0 (every interface), so phones on your LAN or tailnet can reach it.",
+      "mode.remote.description": "No local relay. The workstation dials a relay you run, which is the only way in from outside your network.",
+      "overview.title": "Status",
+      "overview.mode": "Access mode",
+      "overview.relay": "Relay",
+      "overview.host": "Host connector",
+      "overview.socket": "Herdr socket",
+      "overview.webUrl": "Web UI",
+      "overview.keepalive": "Keep-alive",
+      "overview.devices": "Browsers",
+      "overview.hosts": "Workstations",
+      "overview.uptime": "Relay uptime",
+      "overview.relayLocal": "local, {bind}:{port}",
+      "overview.relayRemote": "remote, {url}",
+      "overview.socketMissing": "not found \u2014 is Herdr running?",
+      "overview.unreachable": "unreachable: {message}",
+      "overview.notStarted": "Services are not running. Open the Services tab to start them.",
+      "pair.title": "Pair a device",
+      "pair.generate": "Generate a one-time pairing code",
+      "pair.regenerate": "Generate another code",
+      "pair.working": "Starting services and requesting a code\u2026",
+      "pair.code": "Pairing code",
+      "pair.url": "Open on your phone",
+      "pair.expires": "Expires in {minutes} (at {time})",
+      "pair.expired": "This code has expired. Generate a new one.",
+      "pair.instructions": "Open the URL, enter the code, and the browser is paired for good.",
+      "pair.qrHint": "Scan the code with your phone camera to open the URL.",
+      "pair.qrUnavailable": "The terminal is too narrow for a QR code; use the URL above.",
+      "pair.failed": "Could not create a pairing code: {message}",
+      "pair.hostOffline": "The relay has no workstation connected yet. Start the services first.",
+      "services.title": "Services",
+      "services.start": "Start services",
+      "services.stop": "Stop services",
+      "services.restart": "Restart services",
+      "services.started": "Services started.",
+      "services.stopped": "Services stopped.",
+      "services.restarted": "Services restarted.",
+      "services.startFailed": "Could not start services: {message}",
+      "services.stopFailed": "Could not stop services: {message}",
+      "services.unsavedBlocked": "There are unsaved changes. Save them first, or the services restart on the configuration still on disk.",
+      "services.managedNotice": "These services are managed by {manager}; the keep-alive unit was used to apply the change.",
+      "services.logs": "Recent log output",
+      "services.logEmpty": "No log output yet.",
+      "services.logRelay": "Relay",
+      "services.logHost": "Host connector",
+      "relay.title": "Relay settings",
+      "relay.settings": "Settings",
+      "relay.password": "Relay password",
+      "relay.passwordHint": "Must match RELAY_PASSWORD on the relay. Leave empty for a public relay.",
+      "relay.passwordSet": "set",
+      "relay.passwordEmpty": "not set (public relay)",
+      "relay.passwordSaved": "Relay password saved. Restart the services to apply it.",
+      "relay.showPassword": "Show the password",
+      "relay.hidePassword": "Hide the password",
+      "relay.identity": "Workstation id",
+      "relay.regenerate": "Generate a new workstation identity",
+      "relay.regenerated": "New workstation identity generated. Restart the services to enrol again.",
+      "relay.envSnippet": "Command for your relay server",
+      "relay.envHint": "Run this on the relay host.",
+      "relay.test": "Test the relay connection",
+      "relay.testOk": "Relay reachable: version {version}, {hosts} workstation(s) connected.",
+      "relay.testFailed": "Relay unreachable: {message}",
+      "relay.selectAddress": "Choose the address to advertise",
+      "relay.listenAddress": "Listen address",
+      "relay.listenAddressHint": "This is the server bind address. The advertised address below is what browsers open.",
+      "relay.addressTailscale": "Tailscale",
+      "relay.addressLan": "LAN",
+      "relay.addressVirtual": "virtual",
+      "relay.addressLoopback": "loopback",
+      "relay.noAddresses": "No non-loopback addresses found. Connect to a network or start Tailscale.",
+      "relay.docsHint": "Running your own relay: see docs/self-hosted-relay.md",
+      "keepalive.title": "Keep-alive service",
+      "keepalive.manager": "Manager",
+      "keepalive.state": "State",
+      "keepalive.install": "Install and start",
+      "keepalive.uninstall": "Stop and remove",
+      "keepalive.restart": "Restart the service",
+      "keepalive.installed": "Keep-alive installed with {manager}.",
+      "keepalive.uninstalled": "Keep-alive removed.",
+      "keepalive.restarted": "Keep-alive service restarted.",
+      "keepalive.failed": "Keep-alive operation failed: {message}",
+      "keepalive.unitPath": "Unit file",
+      "keepalive.logsHint": "Follow logs with: {command}",
+      "keepalive.linger": "Start at boot without logging in",
+      "keepalive.lingerEnabled": "Lingering is enabled: the service starts at boot.",
+      "keepalive.lingerDisabled": "Lingering is off, so the service only runs while you are logged in.",
+      "keepalive.enableLinger": "Enable start at boot",
+      "keepalive.lingerDone": "Lingering enabled for {username}.",
+      "keepalive.fallbackNote": "No system service manager is available; a supervised background process is used instead. It does not survive a reboot.",
+      "herdr.title": "Herdr integration",
+      "herdr.socketPath": "Socket path",
+      "herdr.args": "Extra arguments",
+      "herdr.plugin": "Plugin registration",
+      "herdr.pluginRegistered": "Registered with Herdr.",
+      "herdr.pluginMissing": "Not registered with Herdr.",
+      "herdr.register": "Register this package as a Herdr plugin",
+      "herdr.unregister": "Unregister the Herdr plugin",
+      "herdr.registerDone": "Registered: {path}",
+      "herdr.unregisterDone": "Plugin unregistered.",
+      "herdr.registerFailed": "Registration failed: {message}",
+      "herdr.cliMissing": "The herdr command was not found on PATH.",
+      "about.title": "Language & about",
+      "about.language": "Interface language",
+      "about.languageAuto": "Follow the system ({detected})",
+      "about.languageZh": "\u4E2D\u6587",
+      "about.languageEn": "English",
+      "about.version": "Version",
+      "about.configPath": "Config file",
+      "about.statePath": "State directory",
+      "about.relayPackage": "Relay package",
+      "about.docs": "Self-hosting guide: docs/self-hosted-relay.md",
+      "wizard.title": "First-time setup",
+      "wizard.step": "Step {current} of {total}",
+      "wizard.languageTitle": "Choose your language",
+      "wizard.accessTitle": "How do you want to reach this machine?",
+      "wizard.accessHint": "You can change this later on the Relay screen.",
+      "wizard.addressTitle": "Which address should phones use?",
+      "wizard.relayTitle": "Your relay server",
+      "wizard.relayUrlLabel": "Relay URL (wss://\u2026)",
+      "wizard.relayHint": "The relay must already be running. See docs/self-hosted-relay.md to set one up.",
+      "wizard.passwordTitle": "Relay password",
+      "wizard.passwordHint": "The RELAY_PASSWORD your relay was started with. Leave it empty if the relay has none.",
+      "wizard.finishTitle": "Ready",
+      "wizard.finishHint": "Configuration will be saved to {path}.",
+      "wizard.startNow": "Start the services now",
+      "wizard.installKeepalive": "Keep the services running in the background",
+      "wizard.finish": "Save and continue",
+      "field.mode": "Access mode",
+      "field.port": "Relay port",
+      "field.lanHost": "Browser address",
+      "field.remoteUrl": "Relay URL",
+      "field.publicUrl": "Browser URL override",
+      "field.socketPath": "Herdr socket path",
+      "field.herdrArgs": "Herdr arguments",
+      "field.language": "Language",
+      "field.keepalive": "Keep-alive manager",
+      "placeholder.autoDiscovered": "auto-discovered",
+      "placeholder.none": "none",
+      "error.invalidMode": "Unknown access mode.",
+      "error.invalidPort": "The port must be a number between 1 and 65535.",
+      "error.invalidLanHost": "The browser address must be a reachable LAN or Tailscale address, not loopback or 0.0.0.0.",
+      "error.invalidRelayUrl": "The relay URL must start with wss://, ws://, https:// or http://.",
+      "error.invalidPublicUrl": "The browser URL must start with https:// or http:// and cannot use 0.0.0.0 or ::.",
+      "error.invalidLanguage": "Unknown language.",
+      "error.invalidKeepalive": "Unknown keep-alive manager.",
+      "error.unknownField": "Unknown setting.",
+      "error.remoteUrlRequired": "A relay URL is required for the self-hosted relay mode.",
+      "error.saveFailed": "Could not save the configuration: {message}",
+      "hint.navigate": "\u2191\u2193 move",
+      "hint.select": "\u21B5 select",
+      "hint.edit": "\u21B5 edit",
+      "hint.tabs": "\u2190 \u2192 switch tab",
+      "hint.back": "esc back",
+      "hint.quit": "q quit",
+      "hint.mouseOn": "m mouse off",
+      "hint.mouseOff": "m mouse on",
+      "hint.mouseUnsupported": "mouse unsupported",
+      "hint.restartRequired": "Restart the services to apply these changes.",
+      "hint.unsavedChanges": "Unsaved changes \u2014 press s to save.",
+      "hint.save": "s save",
+      "hint.editing": "\u21B5 confirm \xB7 esc cancel"
+    };
+  }
+});
+
+// src/i18n/zh.js
+var require_zh = __commonJS({
+  "src/i18n/zh.js"(exports, module) {
+    "use strict";
+    module.exports = {
+      "app.name": "Herdr Remote",
+      "app.tagline": "\u5728\u6D4F\u89C8\u5668\u91CC\u8FDC\u7A0B\u4F7F\u7528\u4F60\u7684 Herdr \u5DE5\u4F5C\u533A",
+      "common.yes": "\u662F",
+      "common.no": "\u5426",
+      "common.on": "\u5F00",
+      "common.off": "\u5173",
+      "common.none": "\u65E0",
+      "common.auto": "\u81EA\u52A8",
+      "common.unknown": "\u672A\u77E5",
+      "common.running": "\u8FD0\u884C\u4E2D",
+      "common.stopped": "\u5DF2\u505C\u6B62",
+      "common.connected": "\u5DF2\u8FDE\u63A5",
+      "common.disconnected": "\u672A\u8FDE\u63A5",
+      "common.installed": "\u5DF2\u5B89\u88C5",
+      "common.notInstalled": "\u672A\u5B89\u88C5",
+      "common.enabled": "\u5DF2\u542F\u7528",
+      "common.disabled": "\u5DF2\u505C\u7528",
+      "common.loading": "\u5904\u7406\u4E2D\u2026",
+      "common.save": "\u4FDD\u5B58\u8BBE\u7F6E",
+      "common.saved": "\u914D\u7F6E\u5DF2\u4FDD\u5B58\u5230 {path}",
+      "common.back": "\u8FD4\u56DE",
+      "common.cancel": "\u53D6\u6D88",
+      "common.confirm": "\u786E\u8BA4",
+      "common.pid": "\u8FDB\u7A0B {pid}",
+      "common.notApplicable": "\u4E0D\u9002\u7528",
+      "nav.overview": "\u6982\u89C8",
+      "nav.pair": "\u914D\u5BF9\u8BBE\u5907",
+      "nav.services": "\u670D\u52A1",
+      "nav.relay": "Relay",
+      "nav.keepalive": "\u4FDD\u6D3B",
+      "nav.herdr": "Herdr",
+      "nav.about": "\u8BED\u8A00\u4E0E\u5173\u4E8E",
+      "mode.local": "\u4EC5\u672C\u673A",
+      "mode.lan": "\u5C40\u57DF\u7F51 / Tailscale",
+      "mode.remote": "\u81EA\u5EFA relay",
+      "mode.local.description": "relay \u76D1\u542C 127.0.0.1\uFF0C\u53EA\u6709\u672C\u673A\u6D4F\u89C8\u5668\u80FD\u8BBF\u95EE\u3002",
+      "mode.lan.description": "relay \u76D1\u542C 0.0.0.0\uFF08\u6240\u6709\u7F51\u5361\uFF09\uFF0C\u5C40\u57DF\u7F51\u6216 tailnet \u91CC\u7684\u624B\u673A\u90FD\u80FD\u8BBF\u95EE\u3002",
+      "mode.remote.description": "\u4E0D\u542F\u52A8\u672C\u5730 relay\u3002\u672C\u673A\u8FDE\u63A5\u4F60\u81EA\u5EFA\u7684 relay\uFF0C\u8FD9\u662F\u4ECE\u5916\u7F51\u8BBF\u95EE\u7684\u552F\u4E00\u65B9\u5F0F\u3002",
+      "overview.title": "\u72B6\u6001",
+      "overview.mode": "\u8BBF\u95EE\u65B9\u5F0F",
+      "overview.relay": "Relay",
+      "overview.host": "\u4E3B\u673A\u8FDE\u63A5\u5668",
+      "overview.socket": "Herdr \u5957\u63A5\u5B57",
+      "overview.webUrl": "Web \u754C\u9762",
+      "overview.keepalive": "\u4FDD\u6D3B\u670D\u52A1",
+      "overview.devices": "\u6D4F\u89C8\u5668",
+      "overview.hosts": "\u5DE5\u4F5C\u7AD9",
+      "overview.uptime": "Relay \u8FD0\u884C\u65F6\u957F",
+      "overview.relayLocal": "\u672C\u5730\uFF0C{bind}:{port}",
+      "overview.relayRemote": "\u8FDC\u7A0B\uFF0C{url}",
+      "overview.socketMissing": "\u672A\u627E\u5230 \u2014 Herdr \u5728\u8FD0\u884C\u5417\uFF1F",
+      "overview.unreachable": "\u65E0\u6CD5\u8BBF\u95EE\uFF1A{message}",
+      "overview.notStarted": "\u670D\u52A1\u672A\u8FD0\u884C\uFF0C\u8BF7\u5230\u300C\u670D\u52A1\u300D\u9875\u9762\u542F\u52A8\u3002",
+      "pair.title": "\u914D\u5BF9\u8BBE\u5907",
+      "pair.generate": "\u751F\u6210\u4E00\u6B21\u6027\u914D\u5BF9\u7801",
+      "pair.regenerate": "\u91CD\u65B0\u751F\u6210\u914D\u5BF9\u7801",
+      "pair.working": "\u6B63\u5728\u542F\u52A8\u670D\u52A1\u5E76\u7533\u8BF7\u914D\u5BF9\u7801\u2026",
+      "pair.code": "\u914D\u5BF9\u7801",
+      "pair.url": "\u5728\u624B\u673A\u4E0A\u6253\u5F00",
+      "pair.expires": "\u5269\u4F59 {minutes}\uFF08\u81F3 {time}\uFF09",
+      "pair.expired": "\u914D\u5BF9\u7801\u5DF2\u8FC7\u671F\uFF0C\u8BF7\u91CD\u65B0\u751F\u6210\u3002",
+      "pair.instructions": "\u6253\u5F00\u94FE\u63A5\u3001\u8F93\u5165\u914D\u5BF9\u7801\uFF0C\u4E4B\u540E\u8FD9\u53F0\u6D4F\u89C8\u5668\u5C31\u957F\u671F\u53EF\u7528\u4E86\u3002",
+      "pair.qrHint": "\u7528\u624B\u673A\u76F8\u673A\u626B\u7801\u5373\u53EF\u6253\u5F00\u94FE\u63A5\u3002",
+      "pair.qrUnavailable": "\u7EC8\u7AEF\u5BBD\u5EA6\u4E0D\u8DB3\u4EE5\u663E\u793A\u4E8C\u7EF4\u7801\uFF0C\u8BF7\u4F7F\u7528\u4E0A\u9762\u7684\u94FE\u63A5\u3002",
+      "pair.failed": "\u751F\u6210\u914D\u5BF9\u7801\u5931\u8D25\uFF1A{message}",
+      "pair.hostOffline": "relay \u4E0A\u8FD8\u6CA1\u6709\u5DE5\u4F5C\u7AD9\u8FDE\u63A5\uFF0C\u8BF7\u5148\u542F\u52A8\u670D\u52A1\u3002",
+      "services.title": "\u670D\u52A1",
+      "services.start": "\u542F\u52A8\u670D\u52A1",
+      "services.stop": "\u505C\u6B62\u670D\u52A1",
+      "services.restart": "\u91CD\u542F\u670D\u52A1",
+      "services.started": "\u670D\u52A1\u5DF2\u542F\u52A8\u3002",
+      "services.stopped": "\u670D\u52A1\u5DF2\u505C\u6B62\u3002",
+      "services.restarted": "\u670D\u52A1\u5DF2\u91CD\u542F\u3002",
+      "services.startFailed": "\u542F\u52A8\u670D\u52A1\u5931\u8D25\uFF1A{message}",
+      "services.stopFailed": "\u505C\u6B62\u670D\u52A1\u5931\u8D25\uFF1A{message}",
+      "services.unsavedBlocked": "\u6709\u672A\u4FDD\u5B58\u7684\u4FEE\u6539\u3002\u8BF7\u5148\u4FDD\u5B58\uFF0C\u5426\u5219\u670D\u52A1\u4F1A\u7528\u78C1\u76D8\u4E0A\u7684\u65E7\u914D\u7F6E\u91CD\u542F\u3002",
+      "services.managedNotice": "\u670D\u52A1\u7531 {manager} \u6258\u7BA1\uFF0C\u5DF2\u901A\u8FC7\u4FDD\u6D3B\u670D\u52A1\u6267\u884C\u6B64\u64CD\u4F5C\u3002",
+      "services.logs": "\u6700\u8FD1\u65E5\u5FD7",
+      "services.logEmpty": "\u6682\u65E0\u65E5\u5FD7\u8F93\u51FA\u3002",
+      "services.logRelay": "Relay",
+      "services.logHost": "\u4E3B\u673A\u8FDE\u63A5\u5668",
+      "relay.title": "Relay \u8BBE\u7F6E",
+      "relay.settings": "\u8BBE\u7F6E",
+      "relay.password": "Relay \u5BC6\u7801",
+      "relay.passwordHint": "\u9700\u4E0E relay \u4E0A\u7684 RELAY_PASSWORD \u4E00\u81F4\u3002\u7559\u7A7A\u8868\u793A\u516C\u7528 relay\u3002",
+      "relay.passwordSet": "\u5DF2\u8BBE\u7F6E",
+      "relay.passwordEmpty": "\u672A\u8BBE\u7F6E\uFF08\u516C\u7528 relay\uFF09",
+      "relay.passwordSaved": "Relay \u5BC6\u7801\u5DF2\u4FDD\u5B58\uFF0C\u91CD\u542F\u670D\u52A1\u540E\u751F\u6548\u3002",
+      "relay.showPassword": "\u663E\u793A\u5BC6\u7801",
+      "relay.hidePassword": "\u9690\u85CF\u5BC6\u7801",
+      "relay.identity": "\u5DE5\u4F5C\u7AD9\u6807\u8BC6",
+      "relay.regenerate": "\u91CD\u65B0\u751F\u6210\u5DE5\u4F5C\u7AD9\u6807\u8BC6",
+      "relay.regenerated": "\u5DF2\u751F\u6210\u65B0\u7684\u5DE5\u4F5C\u7AD9\u6807\u8BC6\uFF0C\u91CD\u542F\u670D\u52A1\u540E\u4F1A\u91CD\u65B0\u6CE8\u518C\u3002",
+      "relay.envSnippet": "relay \u670D\u52A1\u5668\u542F\u52A8\u547D\u4EE4",
+      "relay.envHint": "\u5728 relay \u4E3B\u673A\u4E0A\u6267\u884C\u8FD9\u6761\u547D\u4EE4\u3002",
+      "relay.test": "\u6D4B\u8BD5 relay \u8FDE\u63A5",
+      "relay.testOk": "relay \u53EF\u8BBF\u95EE\uFF1A\u7248\u672C {version}\uFF0C\u5DF2\u8FDE\u63A5 {hosts} \u53F0\u5DE5\u4F5C\u7AD9\u3002",
+      "relay.testFailed": "relay \u65E0\u6CD5\u8BBF\u95EE\uFF1A{message}",
+      "relay.selectAddress": "\u9009\u62E9\u5BF9\u5916\u516C\u5E03\u7684\u5730\u5740",
+      "relay.listenAddress": "\u76D1\u542C\u5730\u5740",
+      "relay.listenAddressHint": "\u8FD9\u662F\u670D\u52A1\u5668\u7ED1\u5B9A\u5730\u5740\uFF1B\u4E0B\u9762\u7684\u5BF9\u5916\u516C\u5E03\u5730\u5740\u624D\u662F\u6D4F\u89C8\u5668\u8981\u6253\u5F00\u7684\u5730\u5740\u3002",
+      "relay.addressTailscale": "Tailscale",
+      "relay.addressLan": "\u5C40\u57DF\u7F51",
+      "relay.addressVirtual": "\u865A\u62DF\u7F51\u5361",
+      "relay.addressLoopback": "\u56DE\u73AF",
+      "relay.noAddresses": "\u6CA1\u6709\u627E\u5230\u975E\u56DE\u73AF\u5730\u5740\uFF0C\u8BF7\u5148\u8FDE\u63A5\u7F51\u7EDC\u6216\u542F\u52A8 Tailscale\u3002",
+      "relay.docsHint": "\u81EA\u5EFA relay \u8BF7\u53C2\u9605 docs/self-hosted-relay.zh-CN.md",
+      "keepalive.title": "\u540E\u53F0\u4FDD\u6D3B\u670D\u52A1",
+      "keepalive.manager": "\u7BA1\u7406\u65B9\u5F0F",
+      "keepalive.state": "\u72B6\u6001",
+      "keepalive.install": "\u5B89\u88C5\u5E76\u542F\u52A8",
+      "keepalive.uninstall": "\u505C\u6B62\u5E76\u79FB\u9664",
+      "keepalive.restart": "\u91CD\u542F\u4FDD\u6D3B\u670D\u52A1",
+      "keepalive.installed": "\u5DF2\u901A\u8FC7 {manager} \u5B89\u88C5\u4FDD\u6D3B\u670D\u52A1\u3002",
+      "keepalive.uninstalled": "\u4FDD\u6D3B\u670D\u52A1\u5DF2\u79FB\u9664\u3002",
+      "keepalive.restarted": "\u4FDD\u6D3B\u670D\u52A1\u5DF2\u91CD\u542F\u3002",
+      "keepalive.failed": "\u4FDD\u6D3B\u64CD\u4F5C\u5931\u8D25\uFF1A{message}",
+      "keepalive.unitPath": "\u5355\u5143\u6587\u4EF6",
+      "keepalive.logsHint": "\u67E5\u770B\u65E5\u5FD7\uFF1A{command}",
+      "keepalive.linger": "\u672A\u767B\u5F55\u4E5F\u5F00\u673A\u81EA\u542F",
+      "keepalive.lingerEnabled": "\u5DF2\u5F00\u542F linger\uFF1A\u5F00\u673A\u5373\u542F\u52A8\u3002",
+      "keepalive.lingerDisabled": "\u672A\u5F00\u542F linger\uFF0C\u670D\u52A1\u53EA\u5728\u4F60\u767B\u5F55\u671F\u95F4\u8FD0\u884C\u3002",
+      "keepalive.enableLinger": "\u5F00\u542F\u5F00\u673A\u81EA\u542F",
+      "keepalive.lingerDone": "\u5DF2\u4E3A {username} \u5F00\u542F linger\u3002",
+      "keepalive.fallbackNote": "\u7CFB\u7EDF\u6CA1\u6709\u53EF\u7528\u7684\u670D\u52A1\u7BA1\u7406\u5668\uFF0C\u6539\u7528\u5185\u7F6E\u7684\u540E\u53F0\u5B88\u62A4\u8FDB\u7A0B\uFF0C\u91CD\u542F\u7535\u8111\u540E\u4E0D\u4F1A\u81EA\u52A8\u6062\u590D\u3002",
+      "herdr.title": "Herdr \u96C6\u6210",
+      "herdr.socketPath": "\u5957\u63A5\u5B57\u8DEF\u5F84",
+      "herdr.args": "\u9644\u52A0\u53C2\u6570",
+      "herdr.plugin": "\u63D2\u4EF6\u6CE8\u518C",
+      "herdr.pluginRegistered": "\u5DF2\u6CE8\u518C\u5230 Herdr\u3002",
+      "herdr.pluginMissing": "\u5C1A\u672A\u6CE8\u518C\u5230 Herdr\u3002",
+      "herdr.register": "\u628A\u672C\u5305\u6CE8\u518C\u4E3A Herdr \u63D2\u4EF6",
+      "herdr.unregister": "\u53D6\u6D88\u6CE8\u518C Herdr \u63D2\u4EF6",
+      "herdr.registerDone": "\u5DF2\u6CE8\u518C\uFF1A{path}",
+      "herdr.unregisterDone": "\u63D2\u4EF6\u5DF2\u53D6\u6D88\u6CE8\u518C\u3002",
+      "herdr.registerFailed": "\u6CE8\u518C\u5931\u8D25\uFF1A{message}",
+      "herdr.cliMissing": "PATH \u4E2D\u627E\u4E0D\u5230 herdr \u547D\u4EE4\u3002",
+      "about.title": "\u8BED\u8A00\u4E0E\u5173\u4E8E",
+      "about.language": "\u754C\u9762\u8BED\u8A00",
+      "about.languageAuto": "\u8DDF\u968F\u7CFB\u7EDF\uFF08{detected}\uFF09",
+      "about.languageZh": "\u4E2D\u6587",
+      "about.languageEn": "English",
+      "about.version": "\u7248\u672C",
+      "about.configPath": "\u914D\u7F6E\u6587\u4EF6",
+      "about.statePath": "\u72B6\u6001\u76EE\u5F55",
+      "about.relayPackage": "Relay \u5305",
+      "about.docs": "\u81EA\u5EFA relay \u6307\u5357\uFF1Adocs/self-hosted-relay.zh-CN.md",
+      "wizard.title": "\u9996\u6B21\u8BBE\u7F6E",
+      "wizard.step": "\u7B2C {current} / {total} \u6B65",
+      "wizard.languageTitle": "\u9009\u62E9\u8BED\u8A00",
+      "wizard.accessTitle": "\u4F60\u6253\u7B97\u600E\u4E48\u8BBF\u95EE\u8FD9\u53F0\u673A\u5668\uFF1F",
+      "wizard.accessHint": "\u4E4B\u540E\u53EF\u4EE5\u5728 Relay \u9875\u9762\u968F\u65F6\u4FEE\u6539\u3002",
+      "wizard.addressTitle": "\u624B\u673A\u5E94\u8BE5\u4F7F\u7528\u54EA\u4E2A\u5730\u5740\uFF1F",
+      "wizard.relayTitle": "\u4F60\u7684 relay \u670D\u52A1\u5668",
+      "wizard.relayUrlLabel": "Relay \u5730\u5740\uFF08wss://\u2026\uFF09",
+      "wizard.relayHint": "relay \u9700\u8981\u5DF2\u7ECF\u5728\u8FD0\u884C\u3002\u642D\u5EFA\u65B9\u6CD5\u89C1 docs/self-hosted-relay.zh-CN.md\u3002",
+      "wizard.passwordTitle": "Relay \u5BC6\u7801",
+      "wizard.passwordHint": "relay \u542F\u52A8\u65F6\u8BBE\u7F6E\u7684 RELAY_PASSWORD\u3002relay \u6CA1\u8BBE\u5BC6\u7801\u5C31\u7559\u7A7A\u3002",
+      "wizard.finishTitle": "\u5B8C\u6210",
+      "wizard.finishHint": "\u914D\u7F6E\u5C06\u4FDD\u5B58\u5230 {path}\u3002",
+      "wizard.startNow": "\u7ACB\u5373\u542F\u52A8\u670D\u52A1",
+      "wizard.installKeepalive": "\u8BA9\u670D\u52A1\u5728\u540E\u53F0\u4FDD\u6301\u8FD0\u884C",
+      "wizard.finish": "\u4FDD\u5B58\u5E76\u7EE7\u7EED",
+      "field.mode": "\u8BBF\u95EE\u65B9\u5F0F",
+      "field.port": "Relay \u7AEF\u53E3",
+      "field.lanHost": "\u6D4F\u89C8\u5668\u5730\u5740",
+      "field.remoteUrl": "Relay \u5730\u5740",
+      "field.publicUrl": "\u6D4F\u89C8\u5668\u5730\u5740\uFF08\u8986\u76D6\uFF09",
+      "field.socketPath": "Herdr \u5957\u63A5\u5B57\u8DEF\u5F84",
+      "field.herdrArgs": "Herdr \u53C2\u6570",
+      "field.language": "\u8BED\u8A00",
+      "field.keepalive": "\u4FDD\u6D3B\u7BA1\u7406\u65B9\u5F0F",
+      "placeholder.autoDiscovered": "\u81EA\u52A8\u63A2\u6D4B",
+      "placeholder.none": "\u65E0",
+      "error.invalidMode": "\u672A\u77E5\u7684\u8BBF\u95EE\u65B9\u5F0F\u3002",
+      "error.invalidPort": "\u7AEF\u53E3\u5FC5\u987B\u662F 1 \u5230 65535 \u4E4B\u95F4\u7684\u6570\u5B57\u3002",
+      "error.invalidLanHost": "\u6D4F\u89C8\u5668\u5730\u5740\u5FC5\u987B\u662F\u53EF\u8BBF\u95EE\u7684\u5C40\u57DF\u7F51\u6216 Tailscale \u5730\u5740\uFF0C\u4E0D\u80FD\u586B\u5199\u56DE\u73AF\u5730\u5740\u6216 0.0.0.0\u3002",
+      "error.invalidRelayUrl": "Relay \u5730\u5740\u9700\u4EE5 wss://\u3001ws://\u3001https:// \u6216 http:// \u5F00\u5934\u3002",
+      "error.invalidPublicUrl": "\u6D4F\u89C8\u5668\u5730\u5740\u9700\u4EE5 https:// \u6216 http:// \u5F00\u5934\uFF0C\u4E0D\u80FD\u4F7F\u7528 0.0.0.0 \u6216 ::\u3002",
+      "error.invalidLanguage": "\u672A\u77E5\u7684\u8BED\u8A00\u3002",
+      "error.invalidKeepalive": "\u672A\u77E5\u7684\u4FDD\u6D3B\u7BA1\u7406\u65B9\u5F0F\u3002",
+      "error.unknownField": "\u672A\u77E5\u7684\u8BBE\u7F6E\u9879\u3002",
+      "error.remoteUrlRequired": "\u81EA\u5EFA relay \u6A21\u5F0F\u5FC5\u987B\u586B\u5199 Relay \u5730\u5740\u3002",
+      "error.saveFailed": "\u4FDD\u5B58\u914D\u7F6E\u5931\u8D25\uFF1A{message}",
+      "hint.navigate": "\u2191\u2193 \u79FB\u52A8",
+      "hint.select": "\u21B5 \u9009\u62E9",
+      "hint.edit": "\u21B5 \u7F16\u8F91",
+      "hint.tabs": "\u2190 \u2192 \u5207\u6362\u9875\u9762",
+      "hint.back": "esc \u8FD4\u56DE",
+      "hint.quit": "q \u9000\u51FA",
+      "hint.mouseOn": "m \u5173\u95ED\u9F20\u6807",
+      "hint.mouseOff": "m \u5F00\u542F\u9F20\u6807",
+      "hint.mouseUnsupported": "\u4E0D\u652F\u6301\u9F20\u6807",
+      "hint.restartRequired": "\u9700\u8981\u91CD\u542F\u670D\u52A1\u624D\u80FD\u751F\u6548\u3002",
+      "hint.unsavedChanges": "\u6709\u672A\u4FDD\u5B58\u7684\u4FEE\u6539 \u2014 \u6309 s \u4FDD\u5B58\u3002",
+      "hint.save": "s \u4FDD\u5B58",
+      "hint.editing": "\u21B5 \u786E\u8BA4 \xB7 esc \u53D6\u6D88"
+    };
+  }
+});
+
+// src/i18n/index.js
+var require_i18n = __commonJS({
+  "src/i18n/index.js"(exports, module) {
+    "use strict";
+    var en = require_en();
+    var zh = require_zh();
+    var CATALOGUES = { en, zh };
+    var DEFAULT_LOCALE = "en";
+    function detectLocale2({ env = process.env, preference = "auto" } = {}) {
+      if (preference && preference !== "auto" && CATALOGUES[preference]) return preference;
+      if (env.HERDR_REMOTE_LANG && CATALOGUES[env.HERDR_REMOTE_LANG]) return env.HERDR_REMOTE_LANG;
+      const raw = env.LC_ALL || env.LC_MESSAGES || env.LANG || env.LANGUAGE || "";
+      const primary = String(raw).split(/[:.@]/)[0].toLowerCase();
+      if (primary.startsWith("zh")) return "zh";
+      return DEFAULT_LOCALE;
+    }
+    function interpolate(template, values) {
+      if (!values) return template;
+      return template.replace(/\{(\w+)\}/g, (match, key) => Object.prototype.hasOwnProperty.call(values, key) ? String(values[key]) : match);
+    }
+    function createTranslator2(locale = DEFAULT_LOCALE) {
+      const active = CATALOGUES[locale] || CATALOGUES[DEFAULT_LOCALE];
+      const fallback = CATALOGUES[DEFAULT_LOCALE];
+      const t = (key, values) => {
+        const template = active[key] ?? fallback[key] ?? key;
+        return interpolate(template, values);
+      };
+      t.locale = locale;
+      t.has = (key) => Object.prototype.hasOwnProperty.call(active, key);
+      return t;
+    }
+    module.exports = {
+      CATALOGUES,
+      DEFAULT_LOCALE,
+      detectLocale: detectLocale2,
+      createTranslator: createTranslator2,
+      interpolate
+    };
+  }
+});
+
+// src/net-interfaces.js
+var require_net_interfaces = __commonJS({
+  "src/net-interfaces.js"(exports, module) {
+    "use strict";
+    var os = __require("node:os");
+    var VIRTUAL_NAME_PATTERN = /^(docker|br-|virbr|veth|vmnet|vboxnet|lxcbr|cni|flannel|kube)/i;
+    var TAILSCALE_NAME_PATTERN = /^(tailscale|ts)\d*$/i;
+    function isTailscaleAddress(address) {
+      const octets = String(address).split(".");
+      if (octets.length !== 4) return false;
+      const first = Number(octets[0]);
+      const second = Number(octets[1]);
+      if (!Number.isInteger(first) || !Number.isInteger(second)) return false;
+      return first === 100 && second >= 64 && second <= 127;
+    }
+    function classify(name, info) {
+      if (info.internal) return "loopback";
+      if (TAILSCALE_NAME_PATTERN.test(name) || isTailscaleAddress(info.address)) return "tailscale";
+      if (VIRTUAL_NAME_PATTERN.test(name)) return "virtual";
+      return "lan";
+    }
+    var KIND_ORDER = { tailscale: 0, lan: 1, virtual: 2, loopback: 3 };
+    function listReachableAddresses2({ includeLoopback = true, includeIpv6 = false } = {}) {
+      const interfaces = os.networkInterfaces();
+      const results = [];
+      for (const [name, entries] of Object.entries(interfaces)) {
+        for (const info of entries || []) {
+          const family = typeof info.family === "string" ? info.family : `IPv${info.family}`;
+          if (family !== "IPv4" && !(includeIpv6 && family === "IPv6")) continue;
+          const kind = classify(name, info);
+          if (kind === "loopback" && !includeLoopback) continue;
+          results.push({
+            name,
+            address: info.address,
+            family,
+            kind,
+            internal: Boolean(info.internal)
+          });
+        }
+      }
+      results.sort((a, b) => {
+        const byKind = KIND_ORDER[a.kind] - KIND_ORDER[b.kind];
+        if (byKind !== 0) return byKind;
+        return a.address.localeCompare(b.address);
+      });
+      return results;
+    }
+    function preferredLanAddress2() {
+      const candidates = listReachableAddresses2({ includeLoopback: false });
+      return candidates.length > 0 ? candidates[0].address : null;
+    }
+    module.exports = {
+      isTailscaleAddress,
+      listReachableAddresses: listReachableAddresses2,
+      preferredLanAddress: preferredLanAddress2
+    };
+  }
+});
+
+// src/state.js
+var require_state = __commonJS({
+  "src/state.js"(exports, module) {
+    "use strict";
+    var crypto = __require("node:crypto");
+    var fs = __require("node:fs");
+    var path = __require("node:path");
+    function ensureDir(dirPath) {
+      fs.mkdirSync(dirPath, { recursive: true, mode: 448 });
+      try {
+        fs.chmodSync(dirPath, 448);
+      } catch {
+      }
+    }
+    function writeJsonAtomic(filePath, value) {
+      ensureDir(path.dirname(filePath));
+      const tempPath = `${filePath}.${process.pid}.${crypto.randomBytes(4).toString("hex")}.tmp`;
+      fs.writeFileSync(tempPath, `${JSON.stringify(value, null, 2)}
+`, { mode: 384 });
+      try {
+        fs.chmodSync(tempPath, 384);
+      } catch {
+      }
+      fs.renameSync(tempPath, filePath);
+      try {
+        fs.chmodSync(filePath, 384);
+      } catch {
+      }
+    }
+    function readJson(filePath, fallback) {
+      try {
+        return JSON.parse(fs.readFileSync(filePath, "utf8"));
+      } catch (error) {
+        if (error.code !== "ENOENT") {
+          process.stderr.write(`herdr-remote: invalid state at ${filePath}: ${error.message}
+`);
+        }
+        return fallback;
+      }
+    }
+    function randomToken(bytes = 32) {
+      return crypto.randomBytes(bytes).toString("base64url");
+    }
+    module.exports = {
+      ensureDir,
+      writeJsonAtomic,
+      readJson,
+      randomToken
+    };
+  }
+});
+
+// src/settings-model.js
+var require_settings_model = __commonJS({
+  "src/settings-model.js"(exports, module) {
+    "use strict";
+    var {
+      ACCESS_MODES: ACCESS_MODES2,
+      KEEPALIVE_MANAGERS,
+      LANGUAGES,
+      configDir,
+      configPath: configPath2,
+      isLoopbackHost,
+      isUnspecifiedAddress,
+      isUnspecifiedHost,
+      loadConfig: loadConfig2,
+      resolvePublicUrl: resolvePublicUrl2
+    } = require_config();
+    var { ensureDir, readJson, writeJsonAtomic } = require_state();
+    var { preferredLanAddress: preferredLanAddress2 } = require_net_interfaces();
+    var FIELDS2 = [
+      { id: "mode", kind: "choice", choices: ACCESS_MODES2, labelKey: "field.mode" },
+      { id: "port", kind: "text", labelKey: "field.port", visibleFor: ["local", "lan"] },
+      { id: "lanHost", kind: "address", labelKey: "field.lanHost", visibleFor: ["lan"] },
+      { id: "remoteUrl", kind: "text", labelKey: "field.remoteUrl", visibleFor: ["remote"] },
+      { id: "publicUrl", kind: "text", labelKey: "field.publicUrl" },
+      { id: "socketPath", kind: "text", labelKey: "field.socketPath" },
+      { id: "herdrArgs", kind: "text", labelKey: "field.herdrArgs" },
+      { id: "language", kind: "choice", choices: LANGUAGES, labelKey: "field.language" },
+      { id: "keepaliveManager", kind: "choice", choices: KEEPALIVE_MANAGERS, labelKey: "field.keepalive" }
+    ];
+    var EMPTY = "";
+    function clone(value) {
+      return JSON.parse(JSON.stringify(value));
+    }
+    function createDraft2(config = loadConfig2()) {
+      return clone(config);
+    }
+    function fieldsForMode2(mode) {
+      return FIELDS2.filter((field) => !field.visibleFor || field.visibleFor.includes(mode));
+    }
+    function getField2(draft, id) {
+      switch (id) {
+        case "mode":
+          return draft.relay.mode;
+        case "port":
+          return String(draft.relay.port);
+        case "lanHost":
+          return draft.relay.lanHost || EMPTY;
+        case "remoteUrl":
+          return draft.relay.remoteUrl || EMPTY;
+        case "publicUrl":
+          return draft.relay.publicUrl || EMPTY;
+        case "socketPath":
+          return draft.herdr.socketPath || EMPTY;
+        case "herdrArgs":
+          return (draft.herdr.args || []).join(" ");
+        case "language":
+          return draft.ui.language;
+        case "keepaliveManager":
+          return draft.keepalive.manager;
+        default:
+          return EMPTY;
+      }
+    }
+    function getFieldPlaceholder2(draft, id) {
+      switch (id) {
+        case "lanHost":
+          return preferredLanAddress2() || "0.0.0.0";
+        case "publicUrl":
+          return resolvePublicUrl2(draft, preferredLanAddress2());
+        case "socketPath":
+          return "placeholder.autoDiscovered";
+        case "herdrArgs":
+          return "placeholder.none";
+        case "remoteUrl":
+          return "wss://relay.example.com";
+        default:
+          return EMPTY;
+      }
+    }
+    function isValidUrl(value, protocols) {
+      try {
+        const url = new URL(value);
+        return protocols.includes(url.protocol);
+      } catch {
+        return false;
+      }
+    }
+    function setField2(draft, id, rawValue) {
+      const next = clone(draft);
+      const value = typeof rawValue === "string" ? rawValue.trim() : rawValue;
+      switch (id) {
+        case "mode": {
+          if (!ACCESS_MODES2.includes(value)) return { draft, errorKey: "error.invalidMode" };
+          next.relay.mode = value;
+          if (value === "lan" && (isLoopbackHost(next.relay.lanHost) || isUnspecifiedAddress(next.relay.lanHost))) {
+            next.relay.lanHost = EMPTY;
+          }
+          next.relay.publicUrl = EMPTY;
+          break;
+        }
+        case "port": {
+          const port = Number.parseInt(value, 10);
+          if (!Number.isInteger(port) || port < 1 || port > 65535) return { draft, errorKey: "error.invalidPort" };
+          next.relay.port = port;
+          break;
+        }
+        case "lanHost": {
+          if (value && (isLoopbackHost(value) || isUnspecifiedAddress(value))) {
+            return { draft, errorKey: "error.invalidLanHost" };
+          }
+          next.relay.lanHost = value || EMPTY;
+          break;
+        }
+        case "remoteUrl": {
+          if (value && !isValidUrl(value, ["ws:", "wss:", "http:", "https:"])) {
+            return { draft, errorKey: "error.invalidRelayUrl" };
+          }
+          next.relay.remoteUrl = value.replace(/\/+$/, "");
+          break;
+        }
+        case "publicUrl": {
+          if (value && (!isValidUrl(value, ["http:", "https:"]) || isUnspecifiedHost(value))) {
+            return { draft, errorKey: "error.invalidPublicUrl" };
+          }
+          next.relay.publicUrl = value.replace(/\/+$/, "");
+          break;
+        }
+        case "socketPath": {
+          next.herdr.socketPath = value || null;
+          break;
+        }
+        case "herdrArgs": {
+          next.herdr.args = value ? value.split(/\s+/).filter(Boolean) : [];
+          break;
+        }
+        case "language": {
+          if (!LANGUAGES.includes(value)) return { draft, errorKey: "error.invalidLanguage" };
+          next.ui.language = value;
+          break;
+        }
+        case "keepaliveManager": {
+          if (!KEEPALIVE_MANAGERS.includes(value)) return { draft, errorKey: "error.invalidKeepalive" };
+          next.keepalive.manager = value;
+          break;
+        }
+        default:
+          return { draft, errorKey: "error.unknownField" };
+      }
+      return { draft: next, errorKey: null };
+    }
+    function validateDraft2(draft) {
+      const problems = [];
+      if (draft.relay.mode === "remote" && !draft.relay.remoteUrl) problems.push("error.remoteUrlRequired");
+      return problems;
+    }
+    function saveDraft2(draft) {
+      const problems = validateDraft2(draft);
+      if (problems.length > 0) {
+        const error = new Error(`configuration is incomplete: ${problems.join(", ")}`);
+        error.problems = problems;
+        throw error;
+      }
+      const current = readJson(configPath2(), {}) || {};
+      const merged = { ...current };
+      merged.ui = { ...current.ui || {}, language: draft.ui.language };
+      merged.relay = {
+        ...current.relay || {},
+        mode: draft.relay.mode,
+        port: draft.relay.port,
+        lanHost: draft.relay.mode === "lan" && (isLoopbackHost(draft.relay.lanHost) || isUnspecifiedAddress(draft.relay.lanHost)) ? EMPTY : draft.relay.lanHost,
+        publicUrl: draft.relay.publicUrl,
+        remoteUrl: draft.relay.remoteUrl
+      };
+      delete merged.relay.local;
+      delete merged.relay.host;
+      delete merged.relay.url;
+      delete merged.patch;
+      merged.herdr = {
+        ...current.herdr || {},
+        socketPath: draft.herdr.socketPath,
+        args: draft.herdr.args
+      };
+      if (!merged.herdr.socketPath) delete merged.herdr.socketPath;
+      merged.keepalive = { ...current.keepalive || {}, manager: draft.keepalive.manager };
+      ensureDir(configDir());
+      writeJsonAtomic(configPath2(), merged);
+      return { ok: true, path: configPath2() };
+    }
+    function requiresRestart2(before, after) {
+      return before.relay.mode !== after.relay.mode || before.relay.port !== after.relay.port || before.relay.lanHost !== after.relay.lanHost || before.relay.remoteUrl !== after.relay.remoteUrl || before.relay.publicUrl !== after.relay.publicUrl || before.herdr.socketPath !== after.herdr.socketPath || before.herdr.args.join(" ") !== after.herdr.args.join(" ");
+    }
+    module.exports = {
+      FIELDS: FIELDS2,
+      createDraft: createDraft2,
+      fieldsForMode: fieldsForMode2,
+      getField: getField2,
+      getFieldPlaceholder: getFieldPlaceholder2,
+      setField: setField2,
+      validateDraft: validateDraft2,
+      saveDraft: saveDraft2,
+      requiresRestart: requiresRestart2
+    };
+  }
+});
+
+// src/terminal-palette.js
+var require_terminal_palette = __commonJS({
+  "src/terminal-palette.js"(exports, module) {
+    "use strict";
+    var fs = __require("node:fs");
+    var { spawnSync } = __require("node:child_process");
+    var { ANSI_PALETTE_KEYS, sanitizeTerminalPalette } = __require("herdr-remote-relay/protocol");
+    var { runtimeStatePath, stateDir: stateDir2 } = require_config();
+    var { ensureDir, readJson, writeJsonAtomic } = require_state();
+    var ANSI_SLOTS = ANSI_PALETTE_KEYS.length;
+    var READ_TIMEOUT_TENTHS = "3";
+    var MAX_IDLE_READS = 2;
+    var TOTAL_TIMEOUT_MS = 3e3;
+    var ANSI_KEYS = ANSI_PALETTE_KEYS;
+    function parseXColor(value) {
+      if (typeof value !== "string") return null;
+      const match = /^rgba?:([0-9a-f]+)\/([0-9a-f]+)\/([0-9a-f]+)/i.exec(value.trim());
+      if (!match) return null;
+      const channels = match.slice(1, 4).map((raw) => {
+        const width = raw.length;
+        if (width === 0 || width > 4) return null;
+        const scaled = Math.round(parseInt(raw, 16) / (16 ** width - 1) * 255);
+        return Math.max(0, Math.min(255, scaled));
+      });
+      if (channels.some((channel) => channel === null)) return null;
+      return `#${channels.map((channel) => channel.toString(16).padStart(2, "0")).join("")}`;
+    }
+    function findOscColorReply(text, expectedPrefix) {
+      if (typeof text !== "string") return null;
+      const start = text.indexOf(`${expectedPrefix};`);
+      if (start === -1) return null;
+      const stringTerminator = text.indexOf("\x1B\\", start);
+      const bell = text.indexOf("\x07", start);
+      let bodyEnd = -1;
+      let end = -1;
+      if (stringTerminator !== -1 && (bell === -1 || stringTerminator < bell)) {
+        bodyEnd = stringTerminator;
+        end = stringTerminator + 2;
+      } else if (bell !== -1) {
+        bodyEnd = bell;
+        end = bell + 1;
+      } else {
+        return null;
+      }
+      const color = parseXColor(text.slice(start + expectedPrefix.length + 1, bodyEnd).trim());
+      return color ? { color, start, end } : null;
+    }
+    function parseOscColorReply(reply, expectedPrefix) {
+      return findOscColorReply(reply, expectedPrefix)?.color ?? null;
+    }
+    var sanitizePalette = sanitizeTerminalPalette;
+    function paletteFromEnvironment(env = process.env) {
+      const raw = env.HERDR_TERM_PALETTE_JSON;
+      if (!raw) return null;
+      try {
+        return sanitizePalette(JSON.parse(raw));
+      } catch {
+        return null;
+      }
+    }
+    function runStty(args, ttyPath) {
+      return spawnSync("stty", [...args, "-F", ttyPath], { encoding: "utf8", timeout: 1e3 });
+    }
+    function takeOscColorReply(state, expectedPrefix) {
+      const found = findOscColorReply(state.pending, expectedPrefix);
+      if (!found) return null;
+      state.pending = state.pending.slice(0, found.start) + state.pending.slice(found.end);
+      return found.color;
+    }
+    function collectPalette(ask) {
+      const palette = {};
+      const foreground = ask("\x1B]10;?\x1B\\", "\x1B]10");
+      if (foreground) palette.foreground = foreground;
+      const background = ask("\x1B]11;?\x1B\\", "\x1B]11");
+      if (background) palette.background = background;
+      const cursor = ask("\x1B]12;?\x1B\\", "\x1B]12");
+      if (cursor) palette.cursor = cursor;
+      const ansi = {};
+      for (let slot = 0; slot < ANSI_SLOTS; slot += 1) {
+        const color = ask(`\x1B]4;${slot};?\x1B\\`, `\x1B]4;${slot}`);
+        if (!color) break;
+        ansi[ANSI_KEYS[slot]] = color;
+      }
+      if (Object.keys(ansi).length === ANSI_SLOTS) palette.ansi = ansi;
+      return sanitizePalette(palette);
+    }
+    function askTerminal(fd, query, expectedPrefix, state) {
+      fs.writeSync(fd, query);
+      const buffer = Buffer.alloc(256);
+      let idleReads = 0;
+      while (idleReads < MAX_IDLE_READS && Date.now() < state.overallDeadline) {
+        const matched = takeOscColorReply(state, expectedPrefix);
+        if (matched) return matched;
+        let bytesRead = 0;
+        try {
+          bytesRead = fs.readSync(fd, buffer, 0, buffer.length, null);
+        } catch (error) {
+          if (error.code === "EAGAIN") {
+            idleReads += 1;
+            continue;
+          }
+          return null;
+        }
+        if (bytesRead > 0) {
+          state.pending += buffer.toString("latin1", 0, bytesRead);
+          idleReads = 0;
+        } else {
+          idleReads += 1;
+        }
+      }
+      return takeOscColorReply(state, expectedPrefix);
+    }
+    function probeTerminalPalette({ ttyPath = "/dev/tty", timeoutMs = TOTAL_TIMEOUT_MS } = {}) {
+      if (process.platform === "win32") return null;
+      let fd = null;
+      let savedMode = null;
+      try {
+        fd = fs.openSync(ttyPath, "r+");
+      } catch {
+        return null;
+      }
+      try {
+        const saved = runStty(["-g"], ttyPath);
+        if (saved.status !== 0) return null;
+        savedMode = saved.stdout.trim();
+        if (runStty(["raw", "-echo", "min", "0", "time", READ_TIMEOUT_TENTHS], ttyPath).status !== 0) return null;
+        const state = { pending: "", overallDeadline: Date.now() + timeoutMs };
+        return collectPalette((query, prefix) => askTerminal(fd, query, prefix, state));
+      } catch {
+        return null;
+      } finally {
+        if (savedMode) runStty([savedMode], ttyPath);
+        if (fd !== null) {
+          try {
+            fs.closeSync(fd);
+          } catch {
+          }
+        }
+      }
+    }
+    function rememberTerminalPalette(palette) {
+      const clean = sanitizePalette(palette);
+      if (!clean) return null;
+      try {
+        ensureDir(stateDir2());
+        const state = readJson(runtimeStatePath(), {});
+        writeJsonAtomic(runtimeStatePath(), { ...state, terminalPalette: clean });
+      } catch {
+      }
+      return clean;
+    }
+    function rememberedTerminalPalette() {
+      try {
+        return sanitizePalette(readJson(runtimeStatePath(), {}).terminalPalette);
+      } catch {
+        return null;
+      }
+    }
+    function resolveHostPalette({ env = process.env, probe = probeTerminalPalette } = {}) {
+      return paletteFromEnvironment(env) || probe() || null;
+    }
+    function captureTerminalPalette({ env = process.env, probe = probeTerminalPalette } = {}) {
+      if (env.HERDR_TERM_PALETTE_JSON) return paletteFromEnvironment(env);
+      if (!process.stdin.isTTY || !process.stdout.isTTY) return null;
+      const palette = probe();
+      if (!palette) return null;
+      env.HERDR_TERM_PALETTE_JSON = JSON.stringify(palette);
+      rememberTerminalPalette(palette);
+      return palette;
+    }
+    module.exports = {
+      ANSI_KEYS,
+      ANSI_SLOTS,
+      parseXColor,
+      parseOscColorReply,
+      takeOscColorReply,
+      collectPalette,
+      sanitizePalette,
+      paletteFromEnvironment,
+      probeTerminalPalette,
+      resolveHostPalette,
+      captureTerminalPalette,
+      rememberTerminalPalette,
+      rememberedTerminalPalette
+    };
+  }
+});
+
+// src/socket-discovery.js
+var require_socket_discovery = __commonJS({
+  "src/socket-discovery.js"(exports, module) {
+    "use strict";
+    var fs = __require("node:fs");
+    var os = __require("node:os");
+    var path = __require("node:path");
+    function defaultSocketPath(env = process.env, platform = process.platform) {
+      if (env.HERDR_SOCKET_PATH) return env.HERDR_SOCKET_PATH;
+      if (platform === "win32") {
+        const appData = env.APPDATA || path.join(os.homedir(), "AppData", "Roaming");
+        return path.join(appData, "herdr", "herdr.sock");
+      }
+      const configHome = env.XDG_CONFIG_HOME || path.join(os.homedir(), ".config");
+      return path.join(configHome, "herdr", "herdr.sock");
+    }
+    function resolveSocketPath(configuredPath = null, env = process.env) {
+      return configuredPath || env.HERDR_SOCKET_PATH || defaultSocketPath(env);
+    }
+    function inspectSocket(socketPath, options = {}) {
+      if (typeof socketPath !== "string" || socketPath.length === 0) {
+        return { ok: false, reason: "socket path is empty", path: socketPath };
+      }
+      try {
+        const stat = fs.statSync(socketPath);
+        if (process.platform !== "win32" && !stat.isSocket()) {
+          return { ok: false, reason: "path is not a Unix socket", path: socketPath };
+        }
+        if (options.requireOwner !== false && typeof process.getuid === "function" && stat.uid !== process.getuid()) {
+          return { ok: false, reason: "socket is not owned by the current user", path: socketPath, uid: stat.uid };
+        }
+        return { ok: true, path: socketPath, uid: stat.uid, mode: stat.mode };
+      } catch (error) {
+        return { ok: false, reason: error.code === "ENOENT" ? "socket does not exist" : error.message, path: socketPath };
+      }
+    }
+    function assertSocket(socketPath, options = {}) {
+      const result = inspectSocket(socketPath, options);
+      if (!result.ok) {
+        const error = new Error(`Herdr socket unavailable at ${socketPath}: ${result.reason}`);
+        error.code = "HERDR_SOCKET_UNAVAILABLE";
+        error.details = result;
+        throw error;
+      }
+      return result;
+    }
+    module.exports = {
+      defaultSocketPath,
+      resolveSocketPath,
+      inspectSocket,
+      assertSocket
+    };
+  }
+});
+
+// src/herdr-command.js
+var require_herdr_command = __commonJS({
+  "src/herdr-command.js"(exports, module) {
+    "use strict";
+    function resolveHerdrCommand() {
+      return process.env.HERDR_BIN_PATH || "herdr";
+    }
+    module.exports = { resolveHerdrCommand };
+  }
+});
+
+// src/service.js
+var require_service = __commonJS({
+  "src/service.js"(exports, module) {
+    "use strict";
+    var fs = __require("node:fs");
+    var http = __require("node:http");
+    var https = __require("node:https");
+    var path = __require("node:path");
+    var { spawn } = __require("node:child_process");
+    var {
+      PACKAGE_ROOT,
+      bindAddress: bindAddress2,
+      configDir,
+      loadConfig: loadConfig2,
+      resolveAdminOrigin: resolveAdminOrigin2,
+      resolveHostRelayUrl,
+      resolvePublicUrl: resolvePublicUrl2,
+      runsLocalRelay,
+      runtimeStatePath,
+      stateDir: stateDir2
+    } = require_config();
+    var { ensureDir, randomToken, readJson, writeJsonAtomic } = require_state();
+    var {
+      probeTerminalPalette,
+      paletteFromEnvironment,
+      rememberTerminalPalette,
+      rememberedTerminalPalette
+    } = require_terminal_palette();
+    var { resolveSocketPath } = require_socket_discovery();
+    var { preferredLanAddress: preferredLanAddress2 } = require_net_interfaces();
+    var { resolveHerdrCommand } = require_herdr_command();
+    var RUNTIME_VERSION = 2;
+    function pidAlive(pid) {
+      if (!Number.isInteger(pid) || pid <= 0) return false;
+      try {
+        process.kill(pid, 0);
+        return true;
+      } catch (error) {
+        return error.code === "EPERM";
+      }
+    }
+    function readRuntime2() {
+      const state = readJson(runtimeStatePath(), {});
+      return state && typeof state === "object" ? state : {};
+    }
+    function ensureRuntime2() {
+      ensureDir(configDir());
+      ensureDir(stateDir2());
+      const state = readRuntime2();
+      if (!state.version) state.version = RUNTIME_VERSION;
+      if (!state.hostId) state.hostId = `host-${randomToken(9)}`;
+      if (!state.hostToken) state.hostToken = randomToken(32);
+      writeJsonAtomic(runtimeStatePath(), state);
+      return state;
+    }
+    function setRelayPassword2(password) {
+      const state = ensureRuntime2();
+      state.relayPassword = typeof password === "string" ? password.trim() : "";
+      writeJsonAtomic(runtimeStatePath(), state);
+      return state;
+    }
+    function regenerateHostIdentity2() {
+      const state = ensureRuntime2();
+      state.hostId = `host-${randomToken(9)}`;
+      state.hostToken = randomToken(32);
+      writeJsonAtomic(runtimeStatePath(), state);
+      return state;
+    }
+    var cachedTerminalPalette;
+    function hostTerminalPalette({ refresh = false } = {}) {
+      if (!refresh && cachedTerminalPalette !== void 0) return cachedTerminalPalette;
+      const inherited = paletteFromEnvironment();
+      if (inherited) {
+        cachedTerminalPalette = inherited;
+        return cachedTerminalPalette;
+      }
+      const probed = probeTerminalPalette();
+      if (probed) {
+        cachedTerminalPalette = rememberTerminalPalette(probed);
+        return cachedTerminalPalette;
+      }
+      cachedTerminalPalette = rememberedTerminalPalette();
+      return cachedTerminalPalette;
+    }
+    function logPath(name) {
+      return path.join(stateDir2(), `${name}.log`);
+    }
+    function relayBinPath() {
+      const manifest = __require.resolve("herdr-remote-relay/package.json");
+      return path.join(path.dirname(manifest), "bin", "herdr-remote-relay.js");
+    }
+    function relayAuthStatePath() {
+      return path.join(stateDir2(), "relay-auth.json");
+    }
+    function serviceSpecs(config = loadConfig2(), state = ensureRuntime2()) {
+      const specs = [];
+      const publicUrl = resolvePublicUrl2(config, preferredLanAddress2());
+      if (runsLocalRelay(config)) {
+        specs.push({
+          name: "relay",
+          command: process.execPath,
+          args: [relayBinPath()],
+          env: {
+            // Let the shared web UI tell a private workstation relay apart from
+            // the operator-facing self-hosted relay. Standalone relay installs
+            // default to remote mode.
+            RELAY_DEPLOYMENT_MODE: "local",
+            RELAY_BIND: bindAddress2(config),
+            RELAY_PORT: String(config.relay.port),
+            RELAY_PUBLIC_URL: publicUrl,
+            // A relay we start ourselves is closed to everything but this
+            // workstation: reusing the host token as its password costs nothing and
+            // stops another machine on the LAN from enrolling into it.
+            RELAY_PASSWORD: state.hostToken,
+            RELAY_AUTH_STATE_FILE: relayAuthStatePath(),
+            RELAY_ALLOWED_ORIGINS: (config.relay.allowedOrigins || []).join(","),
+            RELAY_MAX_CLIENTS_PER_HOST: String(config.relay.maxClientsPerHost)
+          }
+        });
+      }
+      const terminalPalette = hostTerminalPalette();
+      specs.push({
+        name: "host",
+        command: process.execPath,
+        args: [path.join(PACKAGE_ROOT, "src", "host-connector.js")],
+        env: {
+          // Captured here, where a terminal may still be attached, because the
+          // connector itself usually runs detached with no terminal to ask.
+          ...terminalPalette ? { HERDR_TERM_PALETTE_JSON: JSON.stringify(terminalPalette) } : {},
+          RELAY_URL: resolveHostRelayUrl(config),
+          RELAY_HOST_ID: state.hostId,
+          RELAY_HOST_TOKEN: state.hostToken,
+          RELAY_PASSWORD: runsLocalRelay(config) ? state.hostToken : state.relayPassword || "",
+          HERDR_SOCKET_PATH: resolveSocketPath(config.herdr.socketPath),
+          HERDR_ARGS_JSON: JSON.stringify(config.herdr.args),
+          HERDR_CWD: config.herdr.cwd,
+          HERDR_BIN_PATH: resolveHerdrCommand()
+        }
+      });
+      return specs;
+    }
+    function baseEnvironment() {
+      return { ...process.env, HERDR_REMOTE_SERVICE: "1" };
+    }
+    function spawnDetached(spec) {
+      ensureDir(stateDir2());
+      const logFd = fs.openSync(logPath(spec.name), "a");
+      try {
+        const child = spawn(spec.command, spec.args, {
+          cwd: PACKAGE_ROOT,
+          env: { ...baseEnvironment(), ...spec.env },
+          detached: true,
+          stdio: ["ignore", logFd, logFd]
+        });
+        child.unref();
+        return child.pid;
+      } finally {
+        fs.closeSync(logFd);
+      }
+    }
+    function recordManagedPid(state, name, pid) {
+      const existing = Array.isArray(state.managedPids) ? state.managedPids : [];
+      const kept = existing.filter((entry) => entry && entry.pid !== pid && pidAlive(entry.pid));
+      if (Number.isInteger(pid) && pidAlive(pid)) {
+        kept.push({ name, pid, startedAt: (/* @__PURE__ */ new Date()).toISOString() });
+      }
+      state.managedPids = kept;
+      return state;
+    }
+    function managedPids(state = readRuntime2()) {
+      const pids = /* @__PURE__ */ new Map();
+      for (const [name, pid] of [["supervisor", state.supervisorPid], ["host", state.hostPid], ["relay", state.relayPid]]) {
+        if (pidAlive(pid) && !pids.has(pid)) pids.set(pid, name);
+      }
+      for (const entry of state.managedPids || []) {
+        if (entry && pidAlive(entry.pid) && !pids.has(entry.pid)) pids.set(entry.pid, entry.name);
+      }
+      return [...pids].map(([pid, name]) => ({ pid, name }));
+    }
+    function startServices() {
+      const config = loadConfig2();
+      const state = ensureRuntime2();
+      const next = { ...state };
+      const specs = serviceSpecs(config, state);
+      for (const spec of specs) {
+        const pidKey = `${spec.name}Pid`;
+        if (pidAlive(next[pidKey])) continue;
+        next[pidKey] = spawnDetached(spec);
+        recordManagedPid(next, spec.name, next[pidKey]);
+      }
+      if (!specs.some((spec) => spec.name === "relay") && pidAlive(next.relayPid)) {
+        try {
+          process.kill(next.relayPid, "SIGTERM");
+        } catch {
+        }
+        next.relayPid = null;
+      }
+      next.startedAt = next.startedAt || (/* @__PURE__ */ new Date()).toISOString();
+      next.mode = config.relay.mode;
+      writeJsonAtomic(runtimeStatePath(), next);
+      return {
+        ok: true,
+        mode: config.relay.mode,
+        relay: {
+          local: runsLocalRelay(config),
+          pid: next.relayPid || null,
+          alive: pidAlive(next.relayPid),
+          bind: runsLocalRelay(config) ? bindAddress2(config) : null,
+          port: config.relay.port,
+          remoteUrl: config.relay.remoteUrl || null
+        },
+        host: {
+          pid: next.hostPid || null,
+          alive: pidAlive(next.hostPid),
+          socketPath: resolveSocketPath(config.herdr.socketPath)
+        },
+        publicUrl: resolvePublicUrl2(config, preferredLanAddress2())
+      };
+    }
+    function stopServices() {
+      const state = readRuntime2();
+      const stopped = [];
+      const targets = managedPids(state).sort((a, b) => (a.name === "supervisor" ? 0 : 1) - (b.name === "supervisor" ? 0 : 1));
+      for (const { pid, name } of targets) {
+        try {
+          process.kill(pid, "SIGTERM");
+          stopped.push({ name, pid });
+        } catch (error) {
+          process.stderr.write(`herdr-remote: could not stop ${name} (pid ${pid}): ${error.message}
+`);
+        }
+      }
+      state.hostPid = null;
+      state.relayPid = null;
+      state.supervisorPid = null;
+      state.managedPids = [];
+      state.startedAt = null;
+      ensureDir(stateDir2());
+      writeJsonAtomic(runtimeStatePath(), state);
+      return { ok: true, stopped };
+    }
+    function restartServices() {
+      stopServices();
+      return startServices();
+    }
+    function requestJson2(urlString, options = {}) {
+      return new Promise((resolve, reject) => {
+        let url;
+        try {
+          url = new URL(urlString);
+        } catch (error) {
+          return reject(error);
+        }
+        const transport = url.protocol === "https:" ? https : http;
+        const request = transport.request(url, {
+          method: options.method || "GET",
+          headers: options.headers || {},
+          timeout: options.timeout || 1500
+        }, (response) => {
+          const chunks = [];
+          response.on("data", (chunk) => chunks.push(chunk));
+          response.on("end", () => {
+            const text = Buffer.concat(chunks).toString("utf8");
+            let body;
+            try {
+              body = JSON.parse(text);
+            } catch {
+              body = { raw: text };
+            }
+            if (response.statusCode >= 400) {
+              const error = new Error(body.message || `HTTP ${response.statusCode}`);
+              error.statusCode = response.statusCode;
+              error.body = body;
+              reject(error);
+            } else resolve(body);
+          });
+        });
+        request.on("timeout", () => request.destroy(new Error("request timed out")));
+        request.on("error", reject);
+        if (options.body) request.write(options.body);
+        request.end();
+      });
+    }
+    function healthUrl(config) {
+      return `${resolveAdminOrigin2(config)}/healthz`;
+    }
+    async function waitForRelay(config, { attempts = 20, delayMs = 100 } = {}) {
+      let lastError;
+      for (let attempt = 0; attempt < attempts; attempt += 1) {
+        try {
+          return await requestJson2(healthUrl(config), { timeout: 800 });
+        } catch (error) {
+          lastError = error;
+        }
+        await new Promise((resolve) => setTimeout(resolve, delayMs));
+      }
+      throw lastError || new Error("relay did not become ready");
+    }
+    async function waitForHost(config, { attempts = 30, delayMs = 100 } = {}) {
+      let lastHealth = null;
+      for (let attempt = 0; attempt < attempts; attempt += 1) {
+        try {
+          lastHealth = await requestJson2(healthUrl(config), { timeout: 800 });
+          if (lastHealth.hosts > 0) return lastHealth;
+        } catch (error2) {
+          lastHealth = { ok: false, message: error2.message };
+        }
+        await new Promise((resolve) => setTimeout(resolve, delayMs));
+      }
+      const error = new Error(lastHealth?.message || "the Herdr host connector did not register with the relay");
+      error.health = lastHealth;
+      throw error;
+    }
+    async function statusServices() {
+      const config = loadConfig2();
+      const state = readRuntime2();
+      const lanAddress = preferredLanAddress2();
+      let health = null;
+      try {
+        health = await requestJson2(healthUrl(config), { timeout: 1200 });
+      } catch (error) {
+        health = { ok: false, message: error.message };
+      }
+      const socketPath = resolveSocketPath(config.herdr.socketPath);
+      return {
+        ok: true,
+        mode: config.relay.mode,
+        relay: {
+          local: runsLocalRelay(config),
+          pid: state.relayPid || null,
+          alive: runsLocalRelay(config) ? pidAlive(state.relayPid) : null,
+          bind: runsLocalRelay(config) ? bindAddress2(config) : null,
+          port: config.relay.port,
+          remoteUrl: config.relay.remoteUrl || null,
+          health
+        },
+        host: {
+          pid: state.hostPid || null,
+          alive: pidAlive(state.hostPid),
+          hostId: state.hostId || null,
+          socketPath,
+          socketExists: Boolean(socketPath) && fs.existsSync(socketPath)
+        },
+        publicUrl: resolvePublicUrl2(config, lanAddress),
+        startedAt: state.startedAt || null
+      };
+    }
+    async function pair2() {
+      const config = loadConfig2();
+      const state = ensureRuntime2();
+      if (runsLocalRelay(config)) startServices();
+      await waitForRelay(config);
+      await waitForHost(config);
+      const pairing = await requestJson2(`${resolveAdminOrigin2(config)}/api/pair/start`, {
+        method: "POST",
+        headers: {
+          "X-Herdr-Host-Id": state.hostId,
+          "X-Herdr-Host-Token": state.hostToken
+        },
+        timeout: 5e3
+      });
+      return pairing;
+    }
+    function extractPairingCode2(response) {
+      const code = response?.code || response?.pairCode;
+      if (typeof code !== "string" || code.length === 0) {
+        throw new Error("the relay response did not contain a valid pairing code");
+      }
+      return code;
+    }
+    function readLogTail2(name, lines = 40) {
+      try {
+        const content = fs.readFileSync(logPath(name), "utf8");
+        return content.split("\n").filter(Boolean).slice(-lines);
+      } catch {
+        return [];
+      }
+    }
+    module.exports = {
+      RUNTIME_VERSION,
+      pidAlive,
+      readRuntime: readRuntime2,
+      ensureRuntime: ensureRuntime2,
+      recordManagedPid,
+      managedPids,
+      setRelayPassword: setRelayPassword2,
+      regenerateHostIdentity: regenerateHostIdentity2,
+      serviceSpecs,
+      baseEnvironment,
+      hostTerminalPalette,
+      startServices,
+      stopServices,
+      restartServices,
+      statusServices,
+      requestJson: requestJson2,
+      waitForRelay,
+      waitForHost,
+      pair: pair2,
+      extractPairingCode: extractPairingCode2,
+      relayBinPath,
+      relayAuthStatePath,
+      logPath,
+      readLogTail: readLogTail2
+    };
+  }
+});
+
+// src/keepalive.js
+var require_keepalive = __commonJS({
+  "src/keepalive.js"(exports, module) {
+    "use strict";
+    var fs = __require("node:fs");
+    var os = __require("node:os");
+    var path = __require("node:path");
+    var { spawn, spawnSync } = __require("node:child_process");
+    var { PACKAGE_ROOT, loadConfig: loadConfig2, stateDir: stateDir2 } = require_config();
+    var { ensureDir, readJson, writeJsonAtomic } = require_state();
+    var { logPath, pidAlive } = require_service();
+    var SYSTEMD_UNIT_NAME = "herdr-remote.service";
+    var LAUNCHD_LABEL = "dev.herdr.remote";
+    var FALLBACK_PID_FILE = "supervisor.pid";
+    function cliEntryPoint() {
+      return path.join(PACKAGE_ROOT, "bin", "herdr-remote.js");
+    }
+    function systemdUnitPath() {
+      const configHome = process.env.XDG_CONFIG_HOME || path.join(os.homedir(), ".config");
+      return path.join(configHome, "systemd", "user", SYSTEMD_UNIT_NAME);
+    }
+    function launchdPlistPath() {
+      return path.join(os.homedir(), "Library", "LaunchAgents", `${LAUNCHD_LABEL}.plist`);
+    }
+    function fallbackPidPath() {
+      return path.join(stateDir2(), FALLBACK_PID_FILE);
+    }
+    function commandExists(command) {
+      const searchPath = process.env.PATH || "";
+      return searchPath.split(path.delimiter).filter(Boolean).some((directory) => {
+        try {
+          fs.accessSync(path.join(directory, command), fs.constants.X_OK);
+          return true;
+        } catch {
+          return false;
+        }
+      });
+    }
+    function detectManager(preference = "auto") {
+      if (preference && preference !== "auto") return preference;
+      if (process.platform === "linux") {
+        if (commandExists("systemctl") && (process.env.DBUS_SESSION_BUS_ADDRESS || process.env.XDG_RUNTIME_DIR)) {
+          return "systemd";
+        }
+        return "supervisor";
+      }
+      if (process.platform === "darwin") {
+        return commandExists("launchctl") ? "launchd" : "supervisor";
+      }
+      return "supervisor";
+    }
+    function renderSystemdUnit({ nodePath = process.execPath, entryPoint = cliEntryPoint(), environment = {} } = {}) {
+      const environmentLines = Object.entries(environment).map(([key, value]) => `Environment=${key}=${value}`).join("\n");
+      return `[Unit]
+Description=Herdr Remote (relay and host connector)
+Documentation=https://github.com/herdr/herdr-remote
+After=default.target
+
+[Service]
+Type=simple
+ExecStart=${nodePath} ${entryPoint} run
+Restart=always
+RestartSec=3
+# Give the relay and host connector time to close sessions cleanly.
+TimeoutStopSec=15
+${environmentLines}
+
+[Install]
+WantedBy=default.target
+`;
+    }
+    function escapeXml(value) {
+      return String(value).replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&apos;");
+    }
+    function renderLaunchdPlist({
+      nodePath = process.execPath,
+      entryPoint = cliEntryPoint(),
+      label = LAUNCHD_LABEL,
+      outLog = logPath("supervisor"),
+      errLog = logPath("supervisor"),
+      environment = {}
+    } = {}) {
+      const environmentEntries = Object.entries(environment).map(([key, value]) => `      <key>${escapeXml(key)}</key>
+      <string>${escapeXml(value)}</string>`).join("\n");
+      const environmentBlock = environmentEntries ? `    <key>EnvironmentVariables</key>
+    <dict>
+${environmentEntries}
+    </dict>
+` : "";
+      return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+  <dict>
+    <key>Label</key>
+    <string>${escapeXml(label)}</string>
+    <key>ProgramArguments</key>
+    <array>
+      <string>${escapeXml(nodePath)}</string>
+      <string>${escapeXml(entryPoint)}</string>
+      <string>run</string>
+    </array>
+    <key>RunAtLoad</key>
+    <true/>
+    <key>KeepAlive</key>
+    <true/>
+    <key>ProcessType</key>
+    <string>Background</string>
+${environmentBlock}    <key>StandardOutPath</key>
+    <string>${escapeXml(outLog)}</string>
+    <key>StandardErrorPath</key>
+    <string>${escapeXml(errLog)}</string>
+  </dict>
+</plist>
+`;
+    }
+    function systemctl(args, { capture = true } = {}) {
+      return spawnSync("systemctl", ["--user", ...args], {
+        encoding: "utf8",
+        stdio: capture ? "pipe" : "inherit"
+      });
+    }
+    function systemdStatus() {
+      const installed = fs.existsSync(systemdUnitPath());
+      if (!installed) return { manager: "systemd", installed: false, active: false, enabled: false };
+      const active = systemctl(["is-active", SYSTEMD_UNIT_NAME]);
+      const enabled = systemctl(["is-enabled", SYSTEMD_UNIT_NAME]);
+      const lingering = spawnSync("loginctl", ["show-user", os.userInfo().username, "--property=Linger"], { encoding: "utf8" });
+      return {
+        manager: "systemd",
+        installed: true,
+        active: String(active.stdout || "").trim() === "active",
+        enabled: String(enabled.stdout || "").trim().startsWith("enabled"),
+        linger: String(lingering.stdout || "").includes("Linger=yes"),
+        unitPath: systemdUnitPath(),
+        state: String(active.stdout || active.stderr || "").trim()
+      };
+    }
+    function systemdInstall() {
+      const unitPath = systemdUnitPath();
+      ensureDir(path.dirname(unitPath));
+      fs.writeFileSync(unitPath, renderSystemdUnit(), { mode: 420 });
+      const reload = systemctl(["daemon-reload"]);
+      if (reload.status !== 0) {
+        throw new Error(`systemctl --user daemon-reload failed: ${String(reload.stderr || "").trim()}`);
+      }
+      const enable = systemctl(["enable", "--now", SYSTEMD_UNIT_NAME]);
+      if (enable.status !== 0) {
+        throw new Error(`systemctl --user enable --now failed: ${String(enable.stderr || "").trim()}`);
+      }
+      return { ok: true, unitPath, hint: `loginctl enable-linger ${os.userInfo().username}` };
+    }
+    function systemdUninstall() {
+      const unitPath = systemdUnitPath();
+      systemctl(["disable", "--now", SYSTEMD_UNIT_NAME]);
+      if (fs.existsSync(unitPath)) fs.rmSync(unitPath, { force: true });
+      systemctl(["daemon-reload"]);
+      return { ok: true, unitPath };
+    }
+    function launchdDomainTarget() {
+      return `gui/${process.getuid ? process.getuid() : ""}`;
+    }
+    function launchdStatus() {
+      const plistPath = launchdPlistPath();
+      const installed = fs.existsSync(plistPath);
+      if (!installed) return { manager: "launchd", installed: false, active: false, enabled: false };
+      const result = spawnSync("launchctl", ["print", `${launchdDomainTarget()}/${LAUNCHD_LABEL}`], { encoding: "utf8" });
+      const output = String(result.stdout || "");
+      return {
+        manager: "launchd",
+        installed: true,
+        active: result.status === 0 && /state = running/.test(output),
+        enabled: result.status === 0,
+        unitPath: plistPath,
+        state: result.status === 0 ? "loaded" : "not loaded"
+      };
+    }
+    function launchdInstall() {
+      const plistPath = launchdPlistPath();
+      ensureDir(path.dirname(plistPath));
+      ensureDir(stateDir2());
+      fs.writeFileSync(plistPath, renderLaunchdPlist(), { mode: 420 });
+      spawnSync("launchctl", ["bootout", `${launchdDomainTarget()}/${LAUNCHD_LABEL}`], { stdio: "ignore" });
+      const result = spawnSync("launchctl", ["bootstrap", launchdDomainTarget(), plistPath], { encoding: "utf8" });
+      if (result.status !== 0) {
+        throw new Error(`launchctl bootstrap failed: ${String(result.stderr || "").trim()}`);
+      }
+      spawnSync("launchctl", ["enable", `${launchdDomainTarget()}/${LAUNCHD_LABEL}`], { stdio: "ignore" });
+      return { ok: true, unitPath: plistPath };
+    }
+    function launchdUninstall() {
+      const plistPath = launchdPlistPath();
+      spawnSync("launchctl", ["bootout", `${launchdDomainTarget()}/${LAUNCHD_LABEL}`], { stdio: "ignore" });
+      if (fs.existsSync(plistPath)) fs.rmSync(plistPath, { force: true });
+      return { ok: true, unitPath: plistPath };
+    }
+    function readFallbackPid() {
+      const record = readJson(fallbackPidPath(), {});
+      return Number.isInteger(record.pid) ? record.pid : null;
+    }
+    function fallbackStatus() {
+      const pid = readFallbackPid();
+      const alive = pidAlive(pid);
+      return {
+        manager: "supervisor",
+        installed: alive,
+        active: alive,
+        enabled: false,
+        pid: alive ? pid : null,
+        unitPath: fallbackPidPath(),
+        state: alive ? "running" : "stopped"
+      };
+    }
+    function fallbackInstall() {
+      if (pidAlive(readFallbackPid())) return { ok: true, alreadyRunning: true, pid: readFallbackPid() };
+      ensureDir(stateDir2());
+      const logFd = fs.openSync(logPath("supervisor"), "a");
+      try {
+        const child = spawn(process.execPath, [cliEntryPoint(), "run", "--daemon"], {
+          cwd: PACKAGE_ROOT,
+          env: { ...process.env, HERDR_REMOTE_SERVICE: "1" },
+          detached: true,
+          stdio: ["ignore", logFd, logFd]
+        });
+        child.unref();
+        writeJsonAtomic(fallbackPidPath(), { pid: child.pid, startedAt: (/* @__PURE__ */ new Date()).toISOString() });
+        return { ok: true, pid: child.pid, note: "this fallback does not survive a reboot" };
+      } finally {
+        fs.closeSync(logFd);
+      }
+    }
+    function fallbackUninstall() {
+      const pid = readFallbackPid();
+      if (pidAlive(pid)) {
+        try {
+          process.kill(pid, "SIGTERM");
+        } catch {
+        }
+      }
+      try {
+        fs.rmSync(fallbackPidPath(), { force: true });
+      } catch {
+      }
+      return { ok: true, stoppedPid: pid };
+    }
+    function resolveManager(config = loadConfig2()) {
+      return detectManager(config.keepalive?.manager || "auto");
+    }
+    function status(config = loadConfig2()) {
+      const manager = resolveManager(config);
+      if (manager === "none") return { manager: "none", installed: false, active: false, enabled: false };
+      if (manager === "systemd") return systemdStatus();
+      if (manager === "launchd") return launchdStatus();
+      return fallbackStatus();
+    }
+    function install(config = loadConfig2()) {
+      const manager = resolveManager(config);
+      if (manager === "systemd") return { manager, ...systemdInstall() };
+      if (manager === "launchd") return { manager, ...launchdInstall() };
+      if (manager === "none") throw new Error("keep-alive is disabled in the configuration");
+      return { manager: "supervisor", ...fallbackInstall() };
+    }
+    function uninstall(config = loadConfig2()) {
+      const manager = resolveManager(config);
+      if (manager === "systemd") return { manager, ...systemdUninstall() };
+      if (manager === "launchd") return { manager, ...launchdUninstall() };
+      return { manager: "supervisor", ...fallbackUninstall() };
+    }
+    function restart(config = loadConfig2()) {
+      const manager = resolveManager(config);
+      if (manager === "systemd") {
+        const result = systemctl(["restart", SYSTEMD_UNIT_NAME]);
+        if (result.status !== 0) throw new Error(String(result.stderr || "").trim() || "systemctl restart failed");
+        return { manager, ok: true };
+      }
+      if (manager === "launchd") {
+        spawnSync("launchctl", ["kickstart", "-k", `${launchdDomainTarget()}/${LAUNCHD_LABEL}`], { stdio: "ignore" });
+        return { manager, ok: true };
+      }
+      fallbackUninstall();
+      return { manager: "supervisor", ...fallbackInstall() };
+    }
+    function stopManaged(config = loadConfig2()) {
+      const current = status(config);
+      if (!current.installed && !current.active) return { managed: false };
+      if (current.manager === "systemd") {
+        systemctl(["stop", SYSTEMD_UNIT_NAME]);
+        return { managed: true, manager: "systemd" };
+      }
+      if (current.manager === "launchd") {
+        spawnSync("launchctl", ["bootout", `${launchdDomainTarget()}/${LAUNCHD_LABEL}`], { stdio: "ignore" });
+        return { managed: true, manager: "launchd" };
+      }
+      if (current.manager === "supervisor" && current.active) {
+        fallbackUninstall();
+        return { managed: true, manager: "supervisor" };
+      }
+      return { managed: false };
+    }
+    function enableLinger() {
+      const username = os.userInfo().username;
+      const result = spawnSync("loginctl", ["enable-linger", username], { encoding: "utf8" });
+      if (result.status !== 0) {
+        throw new Error(String(result.stderr || "").trim() || "loginctl enable-linger failed");
+      }
+      return { ok: true, username };
+    }
+    function logsHint(config = loadConfig2()) {
+      const manager = resolveManager(config);
+      if (manager === "systemd") return `journalctl --user -u ${SYSTEMD_UNIT_NAME} -f`;
+      if (manager === "launchd") return `tail -f ${logPath("supervisor")}`;
+      return `tail -f ${logPath("supervisor")}`;
+    }
+    module.exports = {
+      SYSTEMD_UNIT_NAME,
+      LAUNCHD_LABEL,
+      cliEntryPoint,
+      systemdUnitPath,
+      launchdPlistPath,
+      fallbackPidPath,
+      detectManager,
+      resolveManager,
+      renderSystemdUnit,
+      renderLaunchdPlist,
+      escapeXml,
+      status,
+      install,
+      uninstall,
+      restart,
+      stopManaged,
+      enableLinger,
+      logsHint
+    };
+  }
+});
+
+// src/lifecycle.js
+var require_lifecycle = __commonJS({
+  "src/lifecycle.js"(exports, module) {
+    "use strict";
+    var { loadConfig: loadConfig2 } = require_config();
+    var keepalive2 = require_keepalive();
+    var { restartServices, startServices, statusServices, stopServices } = require_service();
+    function managerInUse(config) {
+      const status = keepalive2.status(config);
+      return status.installed || status.active ? status : null;
+    }
+    function startAll2(config = loadConfig2()) {
+      const managed = managerInUse(config);
+      if (managed) {
+        keepalive2.restart(config);
+        return { ok: true, managed: true, manager: managed.manager };
+      }
+      return { ...startServices(), managed: false };
+    }
+    function stopAll2(config = loadConfig2()) {
+      const result = keepalive2.stopManaged(config);
+      if (result.managed) {
+        stopServices();
+        return { ok: true, managed: true, manager: result.manager };
+      }
+      return { ...stopServices(), managed: false };
+    }
+    function restartAll2(config = loadConfig2()) {
+      const managed = managerInUse(config);
+      if (managed) {
+        keepalive2.restart(config);
+        return { ok: true, managed: true, manager: managed.manager };
+      }
+      return { ...restartServices(), managed: false };
+    }
+    async function fullStatus2(config = loadConfig2()) {
+      const [services, keepaliveStatus] = [await statusServices(), keepalive2.status(config)];
+      return {
+        ...services,
+        keepalive: keepaliveStatus,
+        logsHint: keepalive2.logsHint(config)
+      };
+    }
+    module.exports = { startAll: startAll2, stopAll: stopAll2, restartAll: restartAll2, fullStatus: fullStatus2, managerInUse };
+  }
+});
+
+// src/herdr-plugin.js
+var require_herdr_plugin = __commonJS({
+  "src/herdr-plugin.js"(exports, module) {
+    "use strict";
+    var fs = __require("node:fs");
+    var path = __require("node:path");
+    var { spawnSync } = __require("node:child_process");
+    var { PACKAGE_ROOT } = require_config();
+    var PLUGIN_ID = "herdr.remote.web";
+    var MANIFEST_NAME = "herdr-plugin.toml";
+    function manifestPath() {
+      return path.join(PACKAGE_ROOT, MANIFEST_NAME);
+    }
+    function herdrAvailable() {
+      const result = spawnSync("herdr", ["--version"], { stdio: "ignore" });
+      return result.status === 0 || result.status === 1;
+    }
+    function runHerdr(args, { timeout = 15e3 } = {}) {
+      const result = spawnSync("herdr", args, { encoding: "utf8", timeout });
+      if (result.error && result.error.code === "ENOENT") {
+        const error = new Error("herdr command not found");
+        error.code = "HERDR_NOT_FOUND";
+        throw error;
+      }
+      return result;
+    }
+    function parsePluginList(output) {
+      const plugins = [];
+      for (const line of String(output || "").split("\n")) {
+        const match = /^-\s+(\S+)\s+\((.*?)\)\s+(\S+)(?:\s+\[(.*)\])?/.exec(line.trim());
+        if (!match) continue;
+        const [, id, name, state, rawSource] = match;
+        const source = rawSource ? rawSource.split(";")[0].trim() : null;
+        plugins.push({
+          id,
+          name,
+          enabled: state === "enabled",
+          source,
+          warnings: rawSource && rawSource.includes(";") ? rawSource.slice(rawSource.indexOf(";") + 1).trim() : null,
+          localPath: source && source.startsWith("local:") ? source.slice("local:".length) : null
+        });
+      }
+      return plugins;
+    }
+    function registrationStatus() {
+      if (!fs.existsSync(manifestPath())) {
+        return { available: false, registered: false, reason: "manifest missing" };
+      }
+      let result;
+      try {
+        result = runHerdr(["plugin", "list"]);
+      } catch (error) {
+        if (error.code === "HERDR_NOT_FOUND") return { available: false, registered: false, reason: "herdr not found" };
+        throw error;
+      }
+      if (result.status !== 0) {
+        return { available: true, registered: false, reason: String(result.stderr || "").trim() };
+      }
+      const plugins = parsePluginList(result.stdout);
+      const entry = plugins.find((plugin) => plugin.id === PLUGIN_ID);
+      if (!entry) return { available: true, registered: false, packageRoot: PACKAGE_ROOT };
+      return {
+        available: true,
+        registered: true,
+        enabled: entry.enabled,
+        linkedPath: entry.localPath,
+        // A stale link pointing at an old checkout is the main failure mode after
+        // switching from a source install to npm.
+        stale: Boolean(entry.localPath) && path.resolve(entry.localPath) !== path.resolve(PACKAGE_ROOT),
+        packageRoot: PACKAGE_ROOT
+      };
+    }
+    function register() {
+      const current = registrationStatus();
+      if (current.registered && current.stale) {
+        runHerdr(["plugin", "unlink", PLUGIN_ID]);
+      }
+      const result = runHerdr(["plugin", "link", PACKAGE_ROOT]);
+      if (result.status !== 0) {
+        throw new Error(String(result.stderr || result.stdout || "").trim() || "herdr plugin link failed");
+      }
+      return { ok: true, path: PACKAGE_ROOT, output: String(result.stdout || "").trim() };
+    }
+    function unregister() {
+      const result = runHerdr(["plugin", "unlink", PLUGIN_ID]);
+      if (result.status !== 0) {
+        throw new Error(String(result.stderr || result.stdout || "").trim() || "herdr plugin unlink failed");
+      }
+      return { ok: true, output: String(result.stdout || "").trim() };
+    }
+    module.exports = {
+      PLUGIN_ID,
+      manifestPath,
+      herdrAvailable,
+      parsePluginList,
+      registrationStatus,
+      register,
+      unregister
+    };
+  }
+});
+
+// tui/src/index.tsx
+import { render } from "ink";
+
+// tui/src/App.tsx
+import { useCallback as useCallback2, useEffect as useEffect6, useMemo as useMemo4, useRef as useRef3, useState as useState10 } from "react";
+import { Box as Box11, Text as Text11, useApp, useInput as useInput9 } from "ink";
+
+// tui/src/mouse/index.tsx
+import {
+  createContext,
+  useCallback,
+  useContext,
+  useEffect,
+  useMemo,
+  useRef,
+  useState
+} from "react";
+
+// tui/src/mouse/source.ts
+import { PassThrough } from "node:stream";
+
+// tui/src/mouse/protocol.ts
+var ESC = String.fromCharCode(27);
+var ENABLE_MOUSE = `${ESC}[?1000h${ESC}[?1002h${ESC}[?1003h${ESC}[?1006h`;
+var DISABLE_MOUSE = `${ESC}[?1006l${ESC}[?1003l${ESC}[?1002l${ESC}[?1000l`;
+var SGR_PATTERN = /^\x1b\[<(\d+);(\d+);(\d+)([Mm])/;
+var MAX_PENDING = 32;
+function decodeButton(code, isRelease) {
+  if (code & 64) return (code & 3) === 1 ? "wheel-down" : "wheel-up";
+  if (isRelease) return "none";
+  switch (code & 3) {
+    case 0:
+      return "left";
+    case 1:
+      return "middle";
+    case 2:
+      return "right";
+    default:
+      return "none";
+  }
+}
+function couldBeMousePrefix(value) {
+  return `${ESC}[<`.startsWith(value.slice(0, 3)) && value.length <= MAX_PENDING && /^\x1b(\[(<[\d;]*)?)?$/.test(value);
+}
+function splitMouseInput(buffer) {
+  const events = [];
+  let passthrough = "";
+  let index = 0;
+  while (index < buffer.length) {
+    const escapeAt = buffer.indexOf(ESC, index);
+    if (escapeAt === -1) {
+      passthrough += buffer.slice(index);
+      return { events, passthrough, pending: "" };
+    }
+    passthrough += buffer.slice(index, escapeAt);
+    const rest = buffer.slice(escapeAt);
+    const match = SGR_PATTERN.exec(rest);
+    if (match) {
+      const code = Number(match[1]);
+      const isRelease = match[4] === "m";
+      const isMotion = (code & 32) !== 0;
+      const isWheel = (code & 64) !== 0;
+      events.push({
+        type: isWheel ? "wheel" : isMotion ? "move" : isRelease ? "release" : "press",
+        button: decodeButton(code, isRelease),
+        x: Number(match[2]),
+        y: Number(match[3]),
+        shift: (code & 4) !== 0,
+        alt: (code & 8) !== 0,
+        ctrl: (code & 16) !== 0
+      });
+      index = escapeAt + match[0].length;
+      continue;
+    }
+    if (couldBeMousePrefix(rest)) {
+      return { events, passthrough, pending: rest };
+    }
+    passthrough += ESC;
+    index = escapeAt + 1;
+  }
+  return { events, passthrough, pending: "" };
+}
+function createMouseSplitter() {
+  let pending = "";
+  return (chunk) => {
+    const result = splitMouseInput(pending + chunk);
+    pending = result.pending;
+    return { events: result.events, passthrough: result.passthrough };
+  };
+}
+
+// tui/src/mouse/source.ts
+function createMouseSource(input = process.stdin, output = process.stdout) {
+  const supported = Boolean(input.isTTY && output.isTTY);
+  const listeners = /* @__PURE__ */ new Set();
+  const split = createMouseSplitter();
+  const forwarded = new PassThrough();
+  const onData = (chunk) => {
+    const text = typeof chunk === "string" ? chunk : chunk.toString("utf8");
+    const { events, passthrough } = split(text);
+    for (const event of events) {
+      for (const listener of listeners) listener(event);
+    }
+    if (passthrough.length > 0) forwarded.write(passthrough);
+  };
+  if (supported) input.on("data", onData);
+  const stdin = forwarded;
+  stdin.isTTY = input.isTTY;
+  stdin.setRawMode = ((mode) => {
+    input.setRawMode?.(mode);
+    return stdin;
+  });
+  stdin.ref = (() => {
+    input.ref?.();
+    return stdin;
+  });
+  stdin.unref = (() => {
+    input.unref?.();
+    return stdin;
+  });
+  let enabled = false;
+  const enable = () => {
+    if (!supported || enabled) return;
+    output.write(ENABLE_MOUSE);
+    enabled = true;
+  };
+  const disable = () => {
+    if (!enabled) return;
+    output.write(DISABLE_MOUSE);
+    enabled = false;
+  };
+  return {
+    stdin,
+    supported,
+    isEnabled: () => enabled,
+    enable,
+    disable,
+    subscribe(listener) {
+      listeners.add(listener);
+      return () => listeners.delete(listener);
+    },
+    dispose() {
+      disable();
+      listeners.clear();
+      if (supported) input.off("data", onData);
+    }
+  };
+}
+
+// tui/src/mouse/index.tsx
+import { jsx } from "react/jsx-runtime";
+function measureElement(node) {
+  if (!node?.yogaNode) return null;
+  const layout = node.yogaNode.getComputedLayout();
+  let left = 0;
+  let top = 0;
+  let current = node;
+  while (current?.yogaNode) {
+    const own = current.yogaNode.getComputedLayout();
+    left += own.left;
+    top += own.top;
+    current = current.parentNode ?? void 0;
+  }
+  return { left: left + 1, top: top + 1, width: layout.width, height: layout.height };
+}
+function rectContains(rect, x, y) {
+  return x >= rect.left && x < rect.left + rect.width && y >= rect.top && y < rect.top + rect.height;
+}
+var MouseRegistryContext = createContext(null);
+var MouseStateContext = createContext(null);
+function MouseProvider({ source, children }) {
+  const targets = useRef(/* @__PURE__ */ new Set());
+  const pressed = useRef(null);
+  const [hovered, setHovered] = useState(null);
+  const [enabled, setEnabled] = useState(false);
+  const register = useCallback((target) => {
+    targets.current.add(target);
+    return () => {
+      targets.current.delete(target);
+      if (pressed.current === target) pressed.current = null;
+      setHovered((current) => current === target ? null : current);
+    };
+  }, []);
+  const hitTest = useCallback((x, y) => {
+    let best = null;
+    let bestArea = Number.POSITIVE_INFINITY;
+    for (const target of targets.current) {
+      const rect = measureElement(target.ref.current);
+      if (!rect || rect.width <= 0 || rect.height <= 0) continue;
+      if (!rectContains(rect, x, y)) continue;
+      const area = rect.width * rect.height;
+      if (area < bestArea) {
+        best = target;
+        bestArea = area;
+      }
+    }
+    return best;
+  }, []);
+  useEffect(() => {
+    if (!source) return void 0;
+    return source.subscribe((event) => {
+      if (event.type === "wheel") return;
+      const target = hitTest(event.x, event.y);
+      if (event.type === "move") {
+        setHovered((current) => current === target ? current : target);
+        return;
+      }
+      if (event.type === "press") {
+        if (event.button !== "left") return;
+        pressed.current = target;
+        setHovered(target);
+        return;
+      }
+      if (pressed.current && pressed.current === target) target?.onClick?.();
+      pressed.current = null;
+    });
+  }, [source, hitTest]);
+  useEffect(() => {
+    const previous = hovered;
+    previous?.onHover?.(true);
+    return () => previous?.onHover?.(false);
+  }, [hovered]);
+  const enable = useCallback(() => {
+    if (!source) return;
+    source.enable();
+    setEnabled(source.isEnabled());
+  }, [source]);
+  const disable = useCallback(() => {
+    if (!source) return;
+    source.disable();
+    setEnabled(source.isEnabled());
+  }, [source]);
+  const registry = useMemo(() => ({ register }), [register]);
+  const state = useMemo(() => ({
+    supported: Boolean(source?.supported),
+    enabled,
+    enable,
+    disable
+  }), [source, enabled, enable, disable]);
+  return /* @__PURE__ */ jsx(MouseRegistryContext.Provider, { value: registry, children: /* @__PURE__ */ jsx(MouseStateContext.Provider, { value: state, children }) });
+}
+var KEYBOARD_ONLY = {
+  supported: false,
+  enabled: false,
+  enable: () => {
+  },
+  disable: () => {
+  }
+};
+function useMouse() {
+  return useContext(MouseStateContext) ?? KEYBOARD_ONLY;
+}
+function useMouseTarget(ref, { onClick, disabled = false } = {}) {
+  const context = useContext(MouseRegistryContext);
+  const [hovered, setHovered] = useState(false);
+  const handler = useRef(onClick);
+  handler.current = onClick;
+  const target = useMemo(() => ({
+    ref,
+    onClick: () => handler.current?.(),
+    onHover: setHovered
+  }), [ref]);
+  useEffect(() => {
+    if (!context || disabled) return void 0;
+    return context.register(target);
+  }, [context, target, disabled]);
+  useEffect(() => {
+    if (disabled) setHovered(false);
+  }, [disabled]);
+  return hovered && !disabled;
+}
+
+// tui/src/theme.ts
+var theme = {
+  /** Selection and focus. */
+  accent: "cyan",
+  /** Frame lines and separators. */
+  border: "gray",
+  /** Secondary text: labels, hints, paths. */
+  muted: "gray",
+  ok: "green",
+  warn: "yellow",
+  bad: "red"
+};
+var SELECTED_MARKER = "\u25B8";
+var UNSELECTED_MARKER = " ";
+var STATUS_COLOR = {
+  ok: theme.ok,
+  warn: theme.warn,
+  bad: theme.bad,
+  idle: theme.muted
+};
+var STATUS_GLYPH = {
+  ok: "\u25CF",
+  warn: "\u25CF",
+  bad: "\u25CF",
+  idle: "\u25CB"
+};
+
+// tui/src/api.ts
+var import_config = __toESM(require_config());
+var import_i18n = __toESM(require_i18n());
+var import_net_interfaces = __toESM(require_net_interfaces());
+var import_settings_model = __toESM(require_settings_model());
+var import_service = __toESM(require_service());
+var import_lifecycle = __toESM(require_lifecycle());
+var keepalive = __toESM(require_keepalive());
+var herdrPlugin = __toESM(require_herdr_plugin());
+function detectLocale(options = {}) {
+  return (0, import_i18n.detectLocale)(options);
+}
+function listReachableAddresses(options = {}) {
+  return (0, import_net_interfaces.listReachableAddresses)(options);
+}
+function relayStartCommand(config, password) {
+  const publicUrl = config.relay.remoteUrl ? config.relay.remoteUrl.replace(/^ws/, "http") : "https://relay.example.com";
+  const parts = ["herdr-remote-relay", `--public-url ${publicUrl}`, "--trust-proxy"];
+  if (password) parts.push(`--password '${password.replace(/'/g, "'\\''")}'`);
+  return parts.join(" ");
+}
+async function probeRelay(config) {
+  try {
+    const health = await (0, import_service.requestJson)(`${(0, import_config.resolveAdminOrigin)(config)}/healthz`, { timeout: 4e3 });
+    return { ok: true, version: health.version, hosts: health.hosts };
+  } catch (error) {
+    return { ok: false, message: error.message };
+  }
+}
+function formatUptime(seconds, t) {
+  if (!Number.isFinite(seconds)) return t("common.unknown");
+  const total = Math.max(0, Math.floor(seconds));
+  const hours = Math.floor(total / 3600);
+  const minutes = Math.floor(total % 3600 / 60);
+  if (hours > 0) return `${hours}h ${minutes}m`;
+  if (minutes > 0) return `${minutes}m ${total % 60}s`;
+  return `${total}s`;
+}
+
+// tui/src/screens/Overview.tsx
+import { Box as Box2, Text as Text2 } from "ink";
+
+// tui/src/components/common.tsx
+import { useEffect as useEffect2, useRef as useRef2 } from "react";
+import { Box, Text } from "ink";
+import { jsx as jsx2, jsxs } from "react/jsx-runtime";
+function StatusDot({ level: level2 }) {
+  return /* @__PURE__ */ jsx2(Text, { color: STATUS_COLOR[level2], children: STATUS_GLYPH[level2] });
+}
+var LABEL_COLUMN_WIDTH = 20;
+function Row({
+  label,
+  labelWidth = LABEL_COLUMN_WIDTH,
+  children
+}) {
+  return /* @__PURE__ */ jsxs(Box, { children: [
+    /* @__PURE__ */ jsx2(Box, { width: labelWidth, flexShrink: 0, children: /* @__PURE__ */ jsx2(Text, { color: theme.muted, wrap: "truncate-end", children: label }) }),
+    /* @__PURE__ */ jsx2(Box, { flexGrow: 1, children })
+  ] });
+}
+function Selectable({ selected, disabled = false, onSelect, onHover, children }) {
+  const ref = useRef2(null);
+  const hovered = useMouseTarget(ref, { disabled, onClick: onSelect });
+  useFollowPointer(hovered, onHover);
+  const active = selected || hovered;
+  const color = disabled ? theme.muted : active ? theme.accent : void 0;
+  return /* @__PURE__ */ jsxs(Box, { ref, children: [
+    /* @__PURE__ */ jsxs(Text, { color: active ? theme.accent : void 0, children: [
+      active ? SELECTED_MARKER : UNSELECTED_MARKER,
+      " "
+    ] }),
+    /* @__PURE__ */ jsx2(Text, { color, bold: active, dimColor: disabled, children })
+  ] });
+}
+function useFollowPointer(hovered, onHover) {
+  const handler = useRef2(onHover);
+  handler.current = onHover;
+  useEffect2(() => {
+    if (hovered) handler.current?.();
+  }, [hovered]);
+}
+function Menu({
+  items,
+  selectedId,
+  onChange,
+  onSelect
+}) {
+  return /* @__PURE__ */ jsx2(Box, { flexDirection: "column", children: items.map((item) => /* @__PURE__ */ jsx2(
+    Selectable,
+    {
+      selected: item.id === selectedId,
+      disabled: item.disabled,
+      onSelect: () => onSelect(item.id),
+      onHover: () => onChange(item.id),
+      children: item.label
+    },
+    item.id
+  )) });
+}
+function FieldRow({
+  label,
+  selected,
+  disabled = false,
+  labelWidth = 22,
+  onSelect,
+  onHover,
+  children
+}) {
+  const ref = useRef2(null);
+  const hovered = useMouseTarget(ref, { disabled, onClick: onSelect });
+  useFollowPointer(hovered, onHover);
+  const active = selected || hovered;
+  return /* @__PURE__ */ jsxs(Box, { ref, children: [
+    /* @__PURE__ */ jsxs(Box, { width: labelWidth, flexShrink: 0, children: [
+      /* @__PURE__ */ jsxs(Text, { color: active ? theme.accent : void 0, children: [
+        active ? SELECTED_MARKER : UNSELECTED_MARKER,
+        " "
+      ] }),
+      /* @__PURE__ */ jsx2(Text, { color: active ? theme.accent : theme.muted, bold: active, wrap: "truncate-end", children: label })
+    ] }),
+    /* @__PURE__ */ jsx2(Box, { flexGrow: 1, children })
+  ] });
+}
+function Panel({ title, children }) {
+  return /* @__PURE__ */ jsxs(Box, { flexDirection: "column", borderStyle: "round", borderColor: theme.border, paddingX: 1, flexGrow: 1, children: [
+    title ? /* @__PURE__ */ jsx2(Box, { marginBottom: 1, children: /* @__PURE__ */ jsx2(Text, { bold: true, children: title }) }) : null,
+    children
+  ] });
+}
+function Message({ text, level: level2 }) {
+  if (!text) return null;
+  const color = level2 === "error" ? theme.bad : level2 === "success" ? theme.ok : theme.muted;
+  return /* @__PURE__ */ jsx2(Box, { marginTop: 1, children: /* @__PURE__ */ jsx2(Text, { color, children: text }) });
+}
+
+// tui/src/screens/Overview.tsx
+import { Fragment, jsx as jsx3, jsxs as jsxs2 } from "react/jsx-runtime";
+function level(alive) {
+  if (alive === null || alive === void 0) return "idle";
+  return alive ? "ok" : "bad";
+}
+function Overview({ ctx }) {
+  const { t, status, config } = ctx;
+  if (!status) {
+    return /* @__PURE__ */ jsx3(Panel, { title: t("overview.title"), children: /* @__PURE__ */ jsx3(Text2, { color: theme.muted, children: t("common.loading") }) });
+  }
+  const health = status.relay.health || {};
+  const relayReachable = health.ok !== false;
+  const relayLevel = status.relay.local ? level(status.relay.alive) : relayReachable ? "ok" : "bad";
+  const keepaliveLevel = status.keepalive.active ? "ok" : status.keepalive.installed ? "warn" : "idle";
+  const nothingRunning = !status.host.alive && (status.relay.local ? !status.relay.alive : !relayReachable);
+  return /* @__PURE__ */ jsxs2(Panel, { title: t("overview.title"), children: [
+    /* @__PURE__ */ jsx3(Row, { label: t("overview.mode"), children: /* @__PURE__ */ jsx3(Text2, { children: t(`mode.${status.mode}`) }) }),
+    /* @__PURE__ */ jsx3(Row, { label: t("overview.relay"), children: /* @__PURE__ */ jsxs2(Box2, { children: [
+      /* @__PURE__ */ jsx3(StatusDot, { level: relayLevel }),
+      /* @__PURE__ */ jsxs2(Text2, { children: [
+        " ",
+        status.relay.local ? t("overview.relayLocal", { bind: status.relay.bind ?? "", port: status.relay.port }) : t("overview.relayRemote", { url: status.relay.remoteUrl ?? "" })
+      ] }),
+      status.relay.local && status.relay.pid ? /* @__PURE__ */ jsx3(Text2, { color: theme.muted, children: `  ${t("common.pid", { pid: status.relay.pid })}` }) : null
+    ] }) }),
+    /* @__PURE__ */ jsx3(Row, { label: t("overview.host"), children: /* @__PURE__ */ jsxs2(Box2, { children: [
+      /* @__PURE__ */ jsx3(StatusDot, { level: level(status.host.alive) }),
+      /* @__PURE__ */ jsx3(Text2, { children: ` ${status.host.alive ? t("common.running") : t("common.stopped")}` }),
+      status.host.pid ? /* @__PURE__ */ jsx3(Text2, { color: theme.muted, children: `  ${t("common.pid", { pid: status.host.pid })}` }) : null
+    ] }) }),
+    /* @__PURE__ */ jsx3(Row, { label: t("overview.socket"), children: /* @__PURE__ */ jsxs2(Box2, { children: [
+      /* @__PURE__ */ jsx3(StatusDot, { level: status.host.socketExists ? "ok" : "warn" }),
+      /* @__PURE__ */ jsx3(Text2, { color: theme.muted, children: ` ${status.host.socketPath}` }),
+      status.host.socketExists ? null : /* @__PURE__ */ jsx3(Text2, { color: theme.warn, children: `  ${t("overview.socketMissing")}` })
+    ] }) }),
+    /* @__PURE__ */ jsx3(Row, { label: t("overview.webUrl"), children: /* @__PURE__ */ jsx3(Text2, { color: theme.accent, children: status.publicUrl }) }),
+    /* @__PURE__ */ jsx3(Row, { label: t("overview.keepalive"), children: /* @__PURE__ */ jsxs2(Box2, { children: [
+      /* @__PURE__ */ jsx3(StatusDot, { level: keepaliveLevel }),
+      /* @__PURE__ */ jsxs2(Text2, { children: [
+        ` ${status.keepalive.manager} \u2014 `,
+        status.keepalive.active ? t("common.running") : status.keepalive.installed ? t("common.installed") : t("common.notInstalled")
+      ] })
+    ] }) }),
+    /* @__PURE__ */ jsx3(Box2, { marginTop: 1, flexDirection: "column", children: relayReachable ? /* @__PURE__ */ jsxs2(Fragment, { children: [
+      /* @__PURE__ */ jsx3(Row, { label: t("overview.hosts"), children: /* @__PURE__ */ jsx3(Text2, { children: health.hosts ?? 0 }) }),
+      /* @__PURE__ */ jsx3(Row, { label: t("overview.devices"), children: /* @__PURE__ */ jsx3(Text2, { children: health.clients ?? 0 }) }),
+      /* @__PURE__ */ jsx3(Row, { label: t("overview.uptime"), children: /* @__PURE__ */ jsx3(Text2, { color: theme.muted, children: formatUptime(health.uptimeSeconds, t) }) })
+    ] }) : /* @__PURE__ */ jsx3(Text2, { color: theme.warn, children: t("overview.unreachable", { message: health.message ?? "" }) }) }),
+    nothingRunning ? /* @__PURE__ */ jsx3(Box2, { marginTop: 1, children: /* @__PURE__ */ jsx3(Text2, { color: theme.muted, children: t("overview.notStarted") }) }) : null,
+    config.relay.mode === "local" ? /* @__PURE__ */ jsx3(Box2, { marginTop: 1, children: /* @__PURE__ */ jsx3(Text2, { color: theme.muted, children: t("mode.local.description") }) }) : null,
+    /* @__PURE__ */ jsx3(Message, { text: ctx.message?.text ?? null, level: ctx.message?.level ?? "info" })
+  ] });
+}
+
+// tui/src/screens/Pair.tsx
+import { useEffect as useEffect3, useState as useState2 } from "react";
+import { Box as Box3, Text as Text3, useInput, useWindowSize } from "ink";
+import QRCode from "qrcode";
+import { jsx as jsx4, jsxs as jsxs3 } from "react/jsx-runtime";
+var MIN_QR_COLUMNS = 44;
+function PairScreen({ ctx }) {
+  const { t, run } = ctx;
+  const { columns } = useWindowSize();
+  const [pairing, setPairing] = useState2(null);
+  const [qr, setQr] = useState2(null);
+  const [remainingMs, setRemainingMs] = useState2(0);
+  const [selected, setSelected] = useState2("generate");
+  useEffect3(() => {
+    if (!pairing) return void 0;
+    const tick = () => setRemainingMs(Math.max(0, pairing.expiresAt - Date.now()));
+    tick();
+    const timer = setInterval(tick, 1e3);
+    return () => clearInterval(timer);
+  }, [pairing]);
+  useEffect3(() => {
+    if (!pairing || columns < MIN_QR_COLUMNS) {
+      setQr(null);
+      return;
+    }
+    let cancelled = false;
+    QRCode.toString(pairing.pairUrl, { type: "terminal", small: true, errorCorrectionLevel: "L" }).then((value) => {
+      if (!cancelled) setQr(value.replace(/\n$/, ""));
+    }).catch(() => {
+      if (!cancelled) setQr(null);
+    });
+    return () => {
+      cancelled = true;
+    };
+  }, [pairing, columns]);
+  const generate = () => run(async () => {
+    ctx.notify(t("pair.working"));
+    try {
+      const result = await (0, import_service.pair)();
+      const code = (0, import_service.extractPairingCode)(result);
+      setPairing({ ...result, code });
+      ctx.notify("", "info");
+    } catch (error) {
+      const message = error.message;
+      setPairing(null);
+      throw new Error(/host_offline|no Herdr host|did not register/i.test(message) ? t("pair.hostOffline") : t("pair.failed", { message }));
+    }
+  });
+  useInput((_input, key) => {
+    if (key.return) generate();
+  }, { isActive: ctx.editingId === null });
+  const expired = pairing !== null && remainingMs <= 0;
+  const minutes = Math.floor(remainingMs / 6e4);
+  const seconds = Math.floor(remainingMs % 6e4 / 1e3);
+  return /* @__PURE__ */ jsxs3(Panel, { title: t("pair.title"), children: [
+    /* @__PURE__ */ jsx4(
+      Menu,
+      {
+        items: [{ id: "generate", label: pairing ? t("pair.regenerate") : t("pair.generate") }],
+        selectedId: selected,
+        onChange: setSelected,
+        onSelect: generate
+      }
+    ),
+    pairing ? /* @__PURE__ */ jsxs3(Box3, { flexDirection: "column", marginTop: 1, children: [
+      /* @__PURE__ */ jsxs3(Box3, { children: [
+        /* @__PURE__ */ jsx4(Text3, { color: theme.muted, children: `${t("pair.code")}  ` }),
+        /* @__PURE__ */ jsx4(Text3, { bold: true, color: expired ? theme.muted : theme.accent, children: pairing.code.split("").join(" ") })
+      ] }),
+      /* @__PURE__ */ jsxs3(Box3, { children: [
+        /* @__PURE__ */ jsx4(Text3, { color: theme.muted, children: `${t("pair.url")}  ` }),
+        /* @__PURE__ */ jsx4(Text3, { children: pairing.pairUrl })
+      ] }),
+      /* @__PURE__ */ jsx4(Box3, { marginTop: 1, children: /* @__PURE__ */ jsx4(Text3, { color: expired ? theme.bad : theme.muted, children: expired ? t("pair.expired") : t("pair.expires", {
+        minutes: `${minutes}:${String(seconds).padStart(2, "0")}`,
+        time: new Date(pairing.expiresAt).toLocaleTimeString()
+      }) }) }),
+      !expired && qr ? /* @__PURE__ */ jsxs3(Box3, { flexDirection: "column", marginTop: 1, children: [
+        /* @__PURE__ */ jsx4(Text3, { children: qr }),
+        /* @__PURE__ */ jsx4(Text3, { color: theme.muted, children: t("pair.qrHint") })
+      ] }) : null,
+      !expired && !qr && columns < MIN_QR_COLUMNS ? /* @__PURE__ */ jsx4(Box3, { marginTop: 1, children: /* @__PURE__ */ jsx4(Text3, { color: theme.muted, children: t("pair.qrUnavailable") }) }) : null,
+      /* @__PURE__ */ jsx4(Box3, { marginTop: 1, children: /* @__PURE__ */ jsx4(Text3, { color: theme.muted, children: t("pair.instructions") }) })
+    ] }) : null,
+    /* @__PURE__ */ jsx4(Message, { text: ctx.message?.text ?? null, level: ctx.message?.level ?? "info" })
+  ] });
+}
+
+// tui/src/screens/Services.tsx
+import { useState as useState3 } from "react";
+import { Box as Box4, Text as Text4, useInput as useInput2 } from "ink";
+import { jsx as jsx5, jsxs as jsxs4 } from "react/jsx-runtime";
+var LOG_LINES = 8;
+function Services({ ctx }) {
+  const { t, run, status } = ctx;
+  const [selected, setSelected] = useState3("start");
+  const items = [
+    { id: "start", label: t("services.start") },
+    { id: "stop", label: t("services.stop") },
+    { id: "restart", label: t("services.restart") }
+  ];
+  const activate = (id) => {
+    if (ctx.dirty && id !== "stop") {
+      ctx.notify(t("services.unsavedBlocked"), "error");
+      return;
+    }
+    return run(() => {
+      const config = ctx.config;
+      if (id === "start") {
+        const result2 = (0, import_lifecycle.startAll)(config);
+        ctx.notify(result2.managed ? t("services.managedNotice", { manager: result2.manager ?? "" }) : t("services.started"), "success");
+        return;
+      }
+      if (id === "stop") {
+        const result2 = (0, import_lifecycle.stopAll)(config);
+        ctx.notify(result2.managed ? t("services.managedNotice", { manager: result2.manager ?? "" }) : t("services.stopped"), "success");
+        return;
+      }
+      const result = (0, import_lifecycle.restartAll)(config);
+      ctx.notify(result.managed ? t("services.managedNotice", { manager: result.manager ?? "" }) : t("services.restarted"), "success");
+    });
+  };
+  useInput2((_input, key) => {
+    const index = items.findIndex((item) => item.id === selected);
+    if (key.upArrow) setSelected(items[(index - 1 + items.length) % items.length].id);
+    else if (key.downArrow) setSelected(items[(index + 1) % items.length].id);
+    else if (key.return) activate(selected);
+  }, { isActive: ctx.editingId === null });
+  const relayLog = (0, import_service.readLogTail)("relay", LOG_LINES);
+  const hostLog = (0, import_service.readLogTail)("host", LOG_LINES);
+  return /* @__PURE__ */ jsxs4(Panel, { title: t("services.title"), children: [
+    /* @__PURE__ */ jsx5(Menu, { items, selectedId: selected, onChange: setSelected, onSelect: activate }),
+    ctx.dirty ? /* @__PURE__ */ jsx5(Box4, { marginTop: 1, children: /* @__PURE__ */ jsx5(Text4, { color: theme.warn, children: t("services.unsavedBlocked") }) }) : null,
+    status?.keepalive.installed ? /* @__PURE__ */ jsx5(Box4, { marginTop: 1, children: /* @__PURE__ */ jsx5(Text4, { color: theme.muted, children: t("services.managedNotice", { manager: status.keepalive.manager }) }) }) : null,
+    /* @__PURE__ */ jsxs4(Box4, { flexDirection: "column", marginTop: 1, children: [
+      /* @__PURE__ */ jsx5(Text4, { color: theme.muted, children: t("services.logs") }),
+      /* @__PURE__ */ jsx5(LogBlock, { title: t("services.logRelay"), lines: relayLog, emptyText: t("services.logEmpty") }),
+      /* @__PURE__ */ jsx5(LogBlock, { title: t("services.logHost"), lines: hostLog, emptyText: t("services.logEmpty") })
+    ] }),
+    /* @__PURE__ */ jsx5(Message, { text: ctx.message?.text ?? null, level: ctx.message?.level ?? "info" })
+  ] });
+}
+function LogBlock({ title, lines, emptyText }) {
+  return /* @__PURE__ */ jsxs4(Box4, { flexDirection: "column", marginTop: 1, children: [
+    /* @__PURE__ */ jsx5(Text4, { bold: true, color: theme.muted, children: title }),
+    lines.length === 0 ? /* @__PURE__ */ jsx5(Text4, { color: theme.muted, children: emptyText }) : lines.map((line, index) => (
+      // Log lines are positional and may repeat, so the index is the only
+      // stable identity available here.
+      // eslint-disable-next-line react/no-array-index-key
+      /* @__PURE__ */ jsx5(Text4, { color: theme.muted, wrap: "truncate-end", children: line }, index)
+    ))
+  ] });
+}
+
+// tui/src/screens/Relay.tsx
+import { useMemo as useMemo2, useState as useState5 } from "react";
+import { Box as Box6, Text as Text6, useInput as useInput4 } from "ink";
+
+// tui/src/components/TextField.tsx
+import { useEffect as useEffect4, useState as useState4 } from "react";
+import { Box as Box5, Text as Text5, useInput as useInput3 } from "ink";
+import { jsx as jsx6, jsxs as jsxs5 } from "react/jsx-runtime";
+var CONTROL_CHARACTERS = /[\x00-\x1f\x7f]/;
+function TextField({ value, placeholder, active, mask = false, onSubmit, onCancel }) {
+  const [buffer, setBuffer] = useState4(value);
+  useEffect4(() => {
+    if (active) setBuffer(value);
+  }, [active, value]);
+  useInput3((input, key) => {
+    if (key.return) {
+      onSubmit(buffer);
+      return;
+    }
+    if (key.escape) {
+      setBuffer(value);
+      onCancel();
+      return;
+    }
+    if (key.backspace || key.delete) {
+      setBuffer((current) => current.slice(0, -1));
+      return;
+    }
+    if (key.ctrl && input === "u") {
+      setBuffer("");
+      return;
+    }
+    if (input && !key.ctrl && !key.meta && !CONTROL_CHARACTERS.test(input)) {
+      setBuffer((current) => current + input);
+    }
+  }, { isActive: active });
+  const display = active ? buffer : value;
+  const shown = mask && display ? "\u2022".repeat(Math.min(display.length, 32)) : display;
+  if (!active) {
+    return shown ? /* @__PURE__ */ jsx6(Text5, { children: shown }) : /* @__PURE__ */ jsx6(Text5, { color: theme.muted, children: placeholder ?? "" });
+  }
+  return /* @__PURE__ */ jsxs5(Box5, { children: [
+    /* @__PURE__ */ jsx6(Text5, { color: theme.accent, children: shown }),
+    /* @__PURE__ */ jsx6(Text5, { color: theme.accent, inverse: true, children: " " })
+  ] });
+}
+
+// tui/src/screens/Relay.tsx
+import { jsx as jsx7, jsxs as jsxs6 } from "react/jsx-runtime";
+function RelayScreen({ ctx }) {
+  const { t, draft, editingId } = ctx;
+  const [selected, setSelected] = useState5("mode");
+  const [revealTokens, setRevealTokens] = useState5(false);
+  const [showEnv, setShowEnv] = useState5(false);
+  const [password, setPassword] = useState5(ctx.runtime.relayPassword || "");
+  const fields = useMemo2(
+    () => (0, import_settings_model.fieldsForMode)(draft.relay.mode).filter((field) => ["mode", "port", "lanHost", "remoteUrl", "publicUrl"].includes(field.id)),
+    [draft.relay.mode]
+  );
+  const entries = [
+    ...fields.map((field) => ({
+      id: field.id,
+      kind: "field",
+      fieldKind: field.kind,
+      label: t(field.labelKey)
+    })),
+    // The password only matters when talking to a relay somebody else started;
+    // a local relay is configured with our own token automatically.
+    ...draft.relay.mode === "remote" ? [{ id: "password", kind: "password", label: t("relay.password") }] : [],
+    // Saving needs a row of its own. Every field here only edits a draft, and
+    // the services restart from what is on disk — with `s` as the sole way to
+    // commit, a change could look applied, survive a restart, and never take
+    // effect. It is also the only way to save with the mouse.
+    { id: "save", kind: "action", label: t("common.save") },
+    { id: "test", kind: "action", label: t("relay.test") },
+    ...draft.relay.mode === "remote" ? [
+      { id: "reveal", kind: "action", label: revealTokens ? t("relay.hidePassword") : t("relay.showPassword") },
+      { id: "env", kind: "action", label: t("relay.envSnippet") }
+    ] : [],
+    { id: "regenerate", kind: "action", label: t("relay.regenerate") }
+  ];
+  const addresses = useMemo2(() => listReachableAddresses({ includeLoopback: false }), []);
+  const applyField = (id, value) => {
+    const result = (0, import_settings_model.setField)(draft, id, value);
+    if (result.errorKey) {
+      ctx.notify(t(result.errorKey), "error");
+      return false;
+    }
+    ctx.updateDraft(result.draft);
+    ctx.notify("", "info");
+    return true;
+  };
+  const save = () => {
+    try {
+      const result = (0, import_settings_model.saveDraft)(draft);
+      ctx.reloadConfig();
+      ctx.notify(t("common.saved", { path: result.path }), "success");
+    } catch (error) {
+      const problems = error.problems;
+      ctx.notify(problems ? problems.map((key) => t(key)).join(" ") : t("error.saveFailed", { message: error.message }), "error");
+    }
+  };
+  const activate = (id) => {
+    const entry = entries.find((candidate) => candidate.id === id);
+    if (!entry) return;
+    if (entry.kind === "field" || entry.kind === "password") {
+      ctx.setEditing(id);
+      return;
+    }
+    if (id === "save") {
+      save();
+      return;
+    }
+    if (id === "reveal") {
+      setRevealTokens((current) => !current);
+      return;
+    }
+    if (id === "env") {
+      setShowEnv((current) => !current);
+      return;
+    }
+    if (id === "regenerate") {
+      ctx.run(() => {
+        (0, import_service.regenerateHostIdentity)();
+        ctx.reloadConfig();
+        ctx.notify(t("relay.regenerated"), "success");
+      });
+      return;
+    }
+    if (id === "test") {
+      ctx.run(async () => {
+        const result = await probeRelay(ctx.config);
+        ctx.notify(
+          result.ok ? t("relay.testOk", { version: result.version ?? "?", hosts: result.hosts ?? 0 }) : t("relay.testFailed", { message: result.message ?? "" }),
+          result.ok ? "success" : "error"
+        );
+      });
+    }
+  };
+  useInput4((input, key) => {
+    const index = entries.findIndex((entry) => entry.id === selected);
+    if (key.upArrow) setSelected(entries[(index - 1 + entries.length) % entries.length].id);
+    else if (key.downArrow) setSelected(entries[(index + 1) % entries.length].id);
+    else if (key.return) activate(selected);
+    else if (input === "s") save();
+  }, { isActive: editingId === null });
+  if (editingId === "mode") {
+    return /* @__PURE__ */ jsx7(Panel, { title: t("field.mode"), children: /* @__PURE__ */ jsx7(
+      ChoiceList,
+      {
+        options: ["local", "lan", "remote"].map((mode) => ({
+          id: mode,
+          label: t(`mode.${mode}`),
+          description: t(`mode.${mode}.description`)
+        })),
+        current: draft.relay.mode,
+        onPick: (mode) => {
+          applyField("mode", mode);
+          ctx.setEditing(null);
+        },
+        onCancel: () => ctx.setEditing(null)
+      }
+    ) });
+  }
+  if (editingId === "lanHost") {
+    const options = addresses.map((address) => ({
+      id: address.address,
+      label: `${address.address}  (${address.name}, ${t(addressKindKey(address.kind))})`
+    }));
+    return /* @__PURE__ */ jsx7(Panel, { title: t("relay.selectAddress"), children: options.length === 0 ? /* @__PURE__ */ jsx7(Text6, { color: theme.warn, children: t("relay.noAddresses") }) : /* @__PURE__ */ jsx7(
+      ChoiceList,
+      {
+        options,
+        current: draft.relay.lanHost || options[0].id,
+        onPick: (address) => {
+          applyField("lanHost", address);
+          ctx.setEditing(null);
+        },
+        onCancel: () => ctx.setEditing(null)
+      }
+    ) });
+  }
+  return /* @__PURE__ */ jsxs6(Panel, { title: t("relay.title"), children: [
+    draft.relay.mode !== "remote" ? /* @__PURE__ */ jsxs6(Box6, { flexDirection: "column", marginBottom: 1, children: [
+      /* @__PURE__ */ jsx7(Row, { label: t("relay.listenAddress"), children: /* @__PURE__ */ jsx7(Text6, { color: theme.muted, children: `${(0, import_config.bindAddress)(draft)}:${draft.relay.port}` }) }),
+      /* @__PURE__ */ jsx7(Text6, { color: theme.muted, children: t("relay.listenAddressHint") })
+    ] }) : null,
+    entries.map((entry) => entry.kind === "action" ? /* @__PURE__ */ jsx7(
+      Selectable,
+      {
+        selected: selected === entry.id,
+        onSelect: () => {
+          setSelected(entry.id);
+          activate(entry.id);
+        },
+        onHover: () => setSelected(entry.id),
+        children: entry.label
+      },
+      entry.id
+    ) : /* @__PURE__ */ jsx7(
+      FieldRow,
+      {
+        label: entry.label,
+        selected: selected === entry.id,
+        onSelect: () => activate(entry.id),
+        onHover: () => setSelected(entry.id),
+        children: entry.kind === "password" ? /* @__PURE__ */ jsx7(
+          TextField,
+          {
+            value: password,
+            placeholder: t("relay.passwordEmpty"),
+            active: editingId === "password",
+            mask: !revealTokens,
+            onSubmit: (value) => {
+              setPassword(value);
+              (0, import_service.setRelayPassword)(value);
+              ctx.setEditing(null);
+              ctx.notify(t("relay.passwordSaved"), "success");
+            },
+            onCancel: () => ctx.setEditing(null)
+          }
+        ) : entry.fieldKind === "choice" ? (
+          // Choice fields are picked from a list, never typed, so they
+          // show the translated label rather than the stored id.
+          /* @__PURE__ */ jsx7(Text6, { children: t(`mode.${(0, import_settings_model.getField)(draft, entry.id)}`) })
+        ) : /* @__PURE__ */ jsx7(
+          TextField,
+          {
+            value: (0, import_settings_model.getField)(draft, entry.id),
+            placeholder: placeholderText(ctx, entry.id),
+            active: editingId === entry.id,
+            onSubmit: (value) => {
+              if (applyField(entry.id, value)) ctx.setEditing(null);
+            },
+            onCancel: () => ctx.setEditing(null)
+          }
+        )
+      },
+      entry.id
+    )),
+    ctx.dirty ? /* @__PURE__ */ jsx7(Box6, { marginTop: 1, children: /* @__PURE__ */ jsx7(Text6, { color: theme.warn, children: t("hint.unsavedChanges") }) }) : null,
+    draft.relay.mode === "remote" ? /* @__PURE__ */ jsx7(Box6, { marginTop: 1, children: /* @__PURE__ */ jsx7(Text6, { color: theme.muted, children: t("relay.passwordHint") }) }) : null,
+    /* @__PURE__ */ jsx7(Box6, { marginTop: 1, children: /* @__PURE__ */ jsx7(Row, { label: t("relay.identity"), children: /* @__PURE__ */ jsx7(Text6, { color: theme.muted, children: ctx.runtime.hostId }) }) }),
+    showEnv ? /* @__PURE__ */ jsxs6(Box6, { flexDirection: "column", marginTop: 1, borderStyle: "round", borderColor: theme.border, paddingX: 1, children: [
+      /* @__PURE__ */ jsx7(Text6, { color: theme.muted, children: t("relay.envHint") }),
+      /* @__PURE__ */ jsx7(Text6, { children: relayStartCommand(ctx.config, password) })
+    ] }) : null,
+    /* @__PURE__ */ jsx7(Box6, { marginTop: 1, children: /* @__PURE__ */ jsx7(Text6, { color: theme.muted, children: t("relay.docsHint") }) }),
+    /* @__PURE__ */ jsx7(Message, { text: ctx.message?.text ?? null, level: ctx.message?.level ?? "info" })
+  ] });
+}
+function placeholderText(ctx, id) {
+  const raw = (0, import_settings_model.getFieldPlaceholder)(ctx.draft, id);
+  return raw.startsWith("placeholder.") ? ctx.t(raw) : raw;
+}
+function addressKindKey(kind) {
+  return `relay.address${kind.charAt(0).toUpperCase()}${kind.slice(1)}`;
+}
+function ChoiceList({
+  options,
+  current,
+  onPick,
+  onCancel
+}) {
+  const [cursor, setCursor] = useState5(() => {
+    const index = options.findIndex((option) => option.id === current);
+    return index >= 0 ? index : 0;
+  });
+  const active = options[Math.min(cursor, options.length - 1)];
+  useInput4((_input, key) => {
+    if (key.escape) {
+      onCancel();
+      return;
+    }
+    if (key.upArrow) setCursor((value) => (value - 1 + options.length) % options.length);
+    else if (key.downArrow) setCursor((value) => (value + 1) % options.length);
+    else if (key.return && active) onPick(active.id);
+  });
+  return /* @__PURE__ */ jsxs6(Box6, { flexDirection: "column", children: [
+    /* @__PURE__ */ jsx7(
+      Menu,
+      {
+        items: options.map((option) => ({ id: option.id, label: option.label })),
+        selectedId: active?.id ?? "",
+        onChange: (id) => setCursor(options.findIndex((option) => option.id === id)),
+        onSelect: onPick
+      }
+    ),
+    active?.description ? /* @__PURE__ */ jsx7(Box6, { marginTop: 1, children: /* @__PURE__ */ jsx7(Text6, { color: theme.muted, children: active.description }) }) : null
+  ] });
+}
+
+// tui/src/screens/Keepalive.tsx
+import { useState as useState6 } from "react";
+import { Box as Box7, Text as Text7, useInput as useInput5 } from "ink";
+import { jsx as jsx8, jsxs as jsxs7 } from "react/jsx-runtime";
+var MANAGERS = ["auto", "systemd", "launchd", "supervisor", "none"];
+function Keepalive({ ctx }) {
+  const { t, status, draft, editingId } = ctx;
+  const [selected, setSelected] = useState6("install");
+  const current = status?.keepalive;
+  const entries = [
+    { id: "install", label: t("keepalive.install") },
+    { id: "restart", label: t("keepalive.restart") },
+    { id: "uninstall", label: t("keepalive.uninstall") },
+    { id: "manager", label: `${t("keepalive.manager")}: ${draft.keepalive.manager}` },
+    ...process.platform === "linux" && current?.manager === "systemd" && !current?.linger ? [{ id: "linger", label: t("keepalive.enableLinger") }] : []
+  ];
+  const activate = (id) => {
+    if (id === "manager") {
+      ctx.setEditing("keepaliveManager");
+      return;
+    }
+    ctx.run(() => {
+      if (id === "install") {
+        const result = keepalive.install(ctx.config);
+        ctx.notify(t("keepalive.installed", { manager: result.manager }), "success");
+        return;
+      }
+      if (id === "uninstall") {
+        keepalive.uninstall(ctx.config);
+        ctx.notify(t("keepalive.uninstalled"), "success");
+        return;
+      }
+      if (id === "restart") {
+        keepalive.restart(ctx.config);
+        ctx.notify(t("keepalive.restarted"), "success");
+        return;
+      }
+      if (id === "linger") {
+        const result = keepalive.enableLinger();
+        ctx.notify(t("keepalive.lingerDone", { username: result.username }), "success");
+      }
+    });
+  };
+  useInput5((_input, key) => {
+    const index = entries.findIndex((entry) => entry.id === selected);
+    if (key.upArrow) setSelected(entries[(index - 1 + entries.length) % entries.length].id);
+    else if (key.downArrow) setSelected(entries[(index + 1) % entries.length].id);
+    else if (key.return) activate(selected);
+  }, { isActive: editingId === null });
+  if (editingId === "keepaliveManager") {
+    return /* @__PURE__ */ jsx8(Panel, { title: t("field.keepalive"), children: /* @__PURE__ */ jsx8(
+      ChoiceList,
+      {
+        options: MANAGERS.map((manager) => ({ id: manager, label: manager })),
+        current: draft.keepalive.manager,
+        onPick: (manager) => {
+          const result = (0, import_settings_model.setField)(draft, "keepaliveManager", manager);
+          if (result.errorKey) {
+            ctx.notify(t(result.errorKey), "error");
+            return;
+          }
+          ctx.updateDraft(result.draft);
+          try {
+            (0, import_settings_model.saveDraft)(result.draft);
+            ctx.reloadConfig();
+          } catch (error) {
+            ctx.notify(t("error.saveFailed", { message: error.message }), "error");
+          }
+          ctx.setEditing(null);
+        },
+        onCancel: () => ctx.setEditing(null)
+      }
+    ) });
+  }
+  return /* @__PURE__ */ jsxs7(Panel, { title: t("keepalive.title"), children: [
+    /* @__PURE__ */ jsx8(Row, { label: t("keepalive.manager"), children: /* @__PURE__ */ jsx8(Text7, { children: current?.manager ?? t("common.unknown") }) }),
+    /* @__PURE__ */ jsx8(Row, { label: t("keepalive.state"), children: /* @__PURE__ */ jsxs7(Box7, { children: [
+      /* @__PURE__ */ jsx8(StatusDot, { level: current?.active ? "ok" : current?.installed ? "warn" : "idle" }),
+      /* @__PURE__ */ jsxs7(Text7, { children: [
+        " ",
+        current?.active ? t("common.running") : current?.installed ? t("common.installed") : t("common.notInstalled")
+      ] })
+    ] }) }),
+    current?.unitPath ? /* @__PURE__ */ jsx8(Row, { label: t("keepalive.unitPath"), children: /* @__PURE__ */ jsx8(Text7, { color: theme.muted, children: current.unitPath }) }) : null,
+    /* @__PURE__ */ jsx8(Box7, { marginTop: 1, flexDirection: "column", children: entries.map((entry) => /* @__PURE__ */ jsx8(
+      Selectable,
+      {
+        selected: selected === entry.id,
+        onSelect: () => {
+          setSelected(entry.id);
+          activate(entry.id);
+        },
+        onHover: () => setSelected(entry.id),
+        children: entry.label
+      },
+      entry.id
+    )) }),
+    /* @__PURE__ */ jsxs7(Box7, { marginTop: 1, flexDirection: "column", children: [
+      current?.manager === "systemd" ? /* @__PURE__ */ jsx8(Text7, { color: current.linger ? theme.muted : theme.warn, children: current.linger ? t("keepalive.lingerEnabled") : t("keepalive.lingerDisabled") }) : null,
+      current?.manager === "supervisor" ? /* @__PURE__ */ jsx8(Text7, { color: theme.warn, children: t("keepalive.fallbackNote") }) : null,
+      /* @__PURE__ */ jsx8(Text7, { color: theme.muted, children: t("keepalive.logsHint", { command: status?.logsHint ?? "" }) })
+    ] }),
+    /* @__PURE__ */ jsx8(Message, { text: ctx.message?.text ?? null, level: ctx.message?.level ?? "info" })
+  ] });
+}
+
+// tui/src/screens/Herdr.tsx
+import { useEffect as useEffect5, useState as useState7 } from "react";
+import { Box as Box8, Text as Text8, useInput as useInput6 } from "ink";
+import { jsx as jsx9, jsxs as jsxs8 } from "react/jsx-runtime";
+function HerdrScreen({ ctx }) {
+  const { t, draft, editingId } = ctx;
+  const [selected, setSelected] = useState7("socketPath");
+  const [registration, setRegistration] = useState7(null);
+  const reloadRegistration = () => {
+    try {
+      setRegistration(herdrPlugin.registrationStatus());
+    } catch (error) {
+      ctx.notify(error.message, "error");
+    }
+  };
+  useEffect5(reloadRegistration, []);
+  const entries = [
+    { id: "socketPath", kind: "field", label: t("herdr.socketPath") },
+    { id: "herdrArgs", kind: "field", label: t("herdr.args") },
+    { id: "save", kind: "action", label: t("common.save") },
+    {
+      id: registration?.registered && !registration?.stale ? "unregister" : "register",
+      kind: "action",
+      label: registration?.registered && !registration?.stale ? t("herdr.unregister") : t("herdr.register")
+    }
+  ];
+  const applyField = (id, value) => {
+    const result = (0, import_settings_model.setField)(draft, id, value);
+    if (result.errorKey) {
+      ctx.notify(t(result.errorKey), "error");
+      return false;
+    }
+    ctx.updateDraft(result.draft);
+    return true;
+  };
+  const save = () => {
+    try {
+      const result = (0, import_settings_model.saveDraft)(draft);
+      ctx.reloadConfig();
+      ctx.notify(t("common.saved", { path: result.path }), "success");
+    } catch (error) {
+      ctx.notify(t("error.saveFailed", { message: error.message }), "error");
+    }
+  };
+  const activate = (id) => {
+    if (id === "socketPath" || id === "herdrArgs") {
+      ctx.setEditing(id);
+      return;
+    }
+    if (id === "save") {
+      save();
+      return;
+    }
+    ctx.run(() => {
+      try {
+        if (id === "register") {
+          const result = herdrPlugin.register();
+          ctx.notify(t("herdr.registerDone", { path: result.path }), "success");
+        } else {
+          herdrPlugin.unregister();
+          ctx.notify(t("herdr.unregisterDone"), "success");
+        }
+      } catch (error) {
+        const failure = error;
+        throw new Error(failure.code === "HERDR_NOT_FOUND" ? t("herdr.cliMissing") : t("herdr.registerFailed", { message: failure.message }));
+      } finally {
+        reloadRegistration();
+      }
+    });
+  };
+  useInput6((input, key) => {
+    const index = entries.findIndex((entry) => entry.id === selected);
+    const safeIndex = index >= 0 ? index : 0;
+    if (key.upArrow) setSelected(entries[(safeIndex - 1 + entries.length) % entries.length].id);
+    else if (key.downArrow) setSelected(entries[(safeIndex + 1) % entries.length].id);
+    else if (key.return) activate(selected);
+    else if (input === "s") save();
+  }, { isActive: editingId === null });
+  return /* @__PURE__ */ jsxs8(Panel, { title: t("herdr.title"), children: [
+    entries.map((entry) => entry.kind === "field" ? /* @__PURE__ */ jsx9(
+      FieldRow,
+      {
+        label: entry.label,
+        selected: selected === entry.id,
+        onSelect: () => activate(entry.id),
+        onHover: () => setSelected(entry.id),
+        children: /* @__PURE__ */ jsx9(
+          TextField,
+          {
+            value: (0, import_settings_model.getField)(draft, entry.id),
+            placeholder: ctx.t((0, import_settings_model.getFieldPlaceholder)(draft, entry.id)),
+            active: editingId === entry.id,
+            onSubmit: (value) => {
+              if (applyField(entry.id, value)) ctx.setEditing(null);
+            },
+            onCancel: () => ctx.setEditing(null)
+          }
+        )
+      },
+      entry.id
+    ) : /* @__PURE__ */ jsx9(Box8, { marginTop: 1, children: /* @__PURE__ */ jsx9(
+      Selectable,
+      {
+        selected: selected === entry.id,
+        onSelect: () => {
+          setSelected(entry.id);
+          activate(entry.id);
+        },
+        onHover: () => setSelected(entry.id),
+        children: entry.label
+      }
+    ) }, entry.id)),
+    ctx.dirty ? /* @__PURE__ */ jsx9(Box8, { marginTop: 1, children: /* @__PURE__ */ jsx9(Text8, { color: theme.warn, children: t("hint.unsavedChanges") }) }) : null,
+    /* @__PURE__ */ jsxs8(Box8, { marginTop: 1, flexDirection: "column", children: [
+      /* @__PURE__ */ jsx9(Row, { label: t("herdr.plugin"), children: /* @__PURE__ */ jsxs8(Box8, { children: [
+        /* @__PURE__ */ jsx9(StatusDot, { level: registration?.registered && !registration?.stale ? "ok" : registration?.stale ? "warn" : "idle" }),
+        /* @__PURE__ */ jsxs8(Text8, { children: [
+          " ",
+          registration?.registered ? t("herdr.pluginRegistered") : t("herdr.pluginMissing")
+        ] })
+      ] }) }),
+      registration?.packageRoot ? /* @__PURE__ */ jsx9(Row, { label: "", children: /* @__PURE__ */ jsx9(Text8, { color: theme.muted, children: registration.packageRoot }) }) : null,
+      registration && !registration.available ? /* @__PURE__ */ jsx9(Text8, { color: theme.warn, children: t("herdr.cliMissing") }) : null,
+      registration?.stale && registration.linkedPath ? (
+        // A leftover link to an old source checkout is the usual state after
+        // switching to the npm install; re-registering repoints it.
+        /* @__PURE__ */ jsx9(Text8, { color: theme.warn, children: registration.linkedPath })
+      ) : null
+    ] }),
+    /* @__PURE__ */ jsx9(Message, { text: ctx.message?.text ?? null, level: ctx.message?.level ?? "info" })
+  ] });
+}
+
+// tui/src/screens/About.tsx
+import { useState as useState8 } from "react";
+import { Box as Box9, Text as Text9, useInput as useInput7 } from "ink";
+import { jsx as jsx10, jsxs as jsxs9 } from "react/jsx-runtime";
+function About({ ctx }) {
+  const { t, draft } = ctx;
+  const [selected, setSelected] = useState8("auto");
+  const detected = detectLocale({ preference: "auto" });
+  const options = [
+    { id: "auto", label: t("about.languageAuto", { detected }) },
+    { id: "zh", label: t("about.languageZh") },
+    { id: "en", label: t("about.languageEn") }
+  ];
+  const choose = (language) => {
+    const result = (0, import_settings_model.setField)(draft, "language", language);
+    if (result.errorKey) {
+      ctx.notify(t(result.errorKey), "error");
+      return;
+    }
+    ctx.updateDraft(result.draft);
+    try {
+      (0, import_settings_model.saveDraft)(result.draft);
+      ctx.reloadConfig();
+      ctx.notify(t("common.saved", { path: (0, import_config.configPath)() }), "success");
+    } catch (error) {
+      ctx.notify(t("error.saveFailed", { message: error.message }), "error");
+    }
+  };
+  useInput7((_input, key) => {
+    const index = options.findIndex((option) => option.id === selected);
+    if (key.upArrow) setSelected(options[(index - 1 + options.length) % options.length].id);
+    else if (key.downArrow) setSelected(options[(index + 1) % options.length].id);
+    else if (key.return) choose(selected);
+  }, { isActive: ctx.editingId === null });
+  return /* @__PURE__ */ jsxs9(Panel, { title: t("about.title"), children: [
+    /* @__PURE__ */ jsx10(Text9, { color: theme.muted, children: t("about.language") }),
+    /* @__PURE__ */ jsx10(Box9, { flexDirection: "column", marginTop: 1, marginBottom: 1, children: options.map((option) => /* @__PURE__ */ jsx10(
+      Selectable,
+      {
+        selected: selected === option.id,
+        onSelect: () => {
+          setSelected(option.id);
+          choose(option.id);
+        },
+        onHover: () => setSelected(option.id),
+        children: `${option.label}${draft.ui.language === option.id ? "  \u2713" : ""}`
+      },
+      option.id
+    )) }),
+    /* @__PURE__ */ jsx10(Row, { label: t("about.version"), children: /* @__PURE__ */ jsx10(Text9, { color: theme.muted, children: "0.2.0" }) }),
+    /* @__PURE__ */ jsx10(Row, { label: t("about.configPath"), children: /* @__PURE__ */ jsx10(Text9, { color: theme.muted, children: (0, import_config.configPath)() }) }),
+    /* @__PURE__ */ jsx10(Row, { label: t("about.statePath"), children: /* @__PURE__ */ jsx10(Text9, { color: theme.muted, children: (0, import_config.stateDir)() }) }),
+    /* @__PURE__ */ jsx10(Box9, { marginTop: 1, children: /* @__PURE__ */ jsx10(Text9, { color: theme.muted, children: t("about.docs") }) }),
+    /* @__PURE__ */ jsx10(Message, { text: ctx.message?.text ?? null, level: ctx.message?.level ?? "info" })
+  ] });
+}
+
+// tui/src/screens/Wizard.tsx
+import { useMemo as useMemo3, useState as useState9 } from "react";
+import { Box as Box10, Text as Text10, useInput as useInput8 } from "ink";
+import { jsx as jsx11, jsxs as jsxs10 } from "react/jsx-runtime";
+function stepsFor(mode) {
+  const steps = ["language", "access"];
+  if (mode === "lan") steps.push("address");
+  if (mode === "remote") steps.push("relayUrl", "password");
+  steps.push("finish");
+  return steps;
+}
+function Wizard({ ctx, onDone }) {
+  const { t, draft, editingId } = ctx;
+  const [step, setStep] = useState9("language");
+  const [password, setPassword] = useState9(ctx.runtime.relayPassword || "");
+  const [startNow, setStartNow] = useState9(true);
+  const [installKeepalive, setInstallKeepalive] = useState9(true);
+  const [finishSelection, setFinishSelection] = useState9("startNow");
+  const addresses = useMemo3(
+    () => listReachableAddresses({ includeLoopback: false }),
+    []
+  );
+  const steps = useMemo3(() => stepsFor(draft.relay.mode), [draft.relay.mode]);
+  const stepIndex = Math.max(0, steps.indexOf(step));
+  const apply = (id, value) => {
+    const result = (0, import_settings_model.setField)(draft, id, value);
+    if (result.errorKey) {
+      ctx.notify(t(result.errorKey), "error");
+      return false;
+    }
+    ctx.updateDraft(result.draft);
+    ctx.notify("", "info");
+    return true;
+  };
+  const advance = (from, order = steps) => {
+    const index = order.indexOf(from);
+    setStep(order[Math.min(order.length - 1, index + 1)]);
+  };
+  const back = () => {
+    const index = steps.indexOf(step);
+    if (index > 0) setStep(steps[index - 1]);
+  };
+  const finish = () => {
+    ctx.run(async () => {
+      if (draft.relay.mode === "remote") {
+        (0, import_service.setRelayPassword)(password);
+      }
+      (0, import_settings_model.saveDraft)(draft);
+      ctx.reloadConfig();
+      const finalConfig = (0, import_config.loadConfig)();
+      let keepaliveInstalled = false;
+      if (installKeepalive) {
+        try {
+          keepalive.install(finalConfig);
+          keepaliveInstalled = true;
+        } catch (error) {
+          ctx.notify(t("keepalive.failed", { message: error.message }), "error");
+        }
+      }
+      if (startNow && !keepaliveInstalled) (0, import_lifecycle.startAll)(finalConfig);
+      onDone();
+    });
+  };
+  const header = /* @__PURE__ */ jsxs10(Box10, { flexDirection: "column", marginBottom: 1, children: [
+    /* @__PURE__ */ jsx11(Text10, { bold: true, children: t("wizard.title") }),
+    /* @__PURE__ */ jsx11(Text10, { color: theme.muted, children: t("wizard.step", { current: stepIndex + 1, total: steps.length }) })
+  ] });
+  if (step === "language") {
+    return /* @__PURE__ */ jsxs10(Panel, { title: t("wizard.languageTitle"), children: [
+      header,
+      /* @__PURE__ */ jsx11(
+        ChoiceList,
+        {
+          options: [
+            { id: "auto", label: t("about.languageAuto", { detected: ctx.locale }) },
+            { id: "zh", label: t("about.languageZh") },
+            { id: "en", label: t("about.languageEn") }
+          ],
+          current: draft.ui.language,
+          onPick: (language) => {
+            if (apply("language", language)) advance("language");
+          },
+          onCancel: () => {
+          }
+        }
+      ),
+      /* @__PURE__ */ jsx11(Message, { text: ctx.message?.text ?? null, level: ctx.message?.level ?? "info" })
+    ] });
+  }
+  if (step === "access") {
+    return /* @__PURE__ */ jsxs10(Panel, { title: t("wizard.accessTitle"), children: [
+      header,
+      /* @__PURE__ */ jsx11(
+        ChoiceList,
+        {
+          options: ["local", "lan", "remote"].map((mode) => ({
+            id: mode,
+            label: t(`mode.${mode}`),
+            description: t(`mode.${mode}.description`)
+          })),
+          current: draft.relay.mode,
+          onPick: (mode) => {
+            if (apply("mode", mode)) advance("access", stepsFor(mode));
+          },
+          onCancel: back
+        }
+      ),
+      /* @__PURE__ */ jsx11(Box10, { marginTop: 1, children: /* @__PURE__ */ jsx11(Text10, { color: theme.muted, children: t("wizard.accessHint") }) }),
+      /* @__PURE__ */ jsx11(Message, { text: ctx.message?.text ?? null, level: ctx.message?.level ?? "info" })
+    ] });
+  }
+  if (step === "address") {
+    return /* @__PURE__ */ jsxs10(Panel, { title: t("wizard.addressTitle"), children: [
+      header,
+      addresses.length === 0 ? /* @__PURE__ */ jsxs10(Box10, { flexDirection: "column", children: [
+        /* @__PURE__ */ jsx11(Text10, { color: theme.warn, children: t("relay.noAddresses") }),
+        /* @__PURE__ */ jsx11(Box10, { marginTop: 1, children: /* @__PURE__ */ jsx11(Selectable, { selected: true, onSelect: () => advance("address"), children: t("wizard.finish") }) }),
+        /* @__PURE__ */ jsx11(SkipKey, { onSkip: () => advance("address"), onBack: back })
+      ] }) : /* @__PURE__ */ jsx11(
+        ChoiceList,
+        {
+          options: addresses.map((address) => ({
+            id: address.address,
+            label: `${address.address}  (${address.name}, ${address.kind})`
+          })),
+          current: draft.relay.lanHost || addresses[0].address,
+          onPick: (address) => {
+            if (apply("lanHost", address)) advance("address");
+          },
+          onCancel: back
+        }
+      ),
+      /* @__PURE__ */ jsx11(Message, { text: ctx.message?.text ?? null, level: ctx.message?.level ?? "info" })
+    ] });
+  }
+  if (step === "relayUrl") {
+    return /* @__PURE__ */ jsxs10(Panel, { title: t("wizard.relayTitle"), children: [
+      header,
+      /* @__PURE__ */ jsx11(FieldRow, { label: t("wizard.relayUrlLabel"), selected: true, onSelect: () => {
+      }, children: /* @__PURE__ */ jsx11(
+        TextField,
+        {
+          value: draft.relay.remoteUrl,
+          placeholder: "wss://relay.example.com",
+          active: true,
+          onSubmit: (value) => {
+            if (!value) {
+              ctx.notify(t("error.remoteUrlRequired"), "error");
+              return;
+            }
+            if (apply("remoteUrl", value)) advance("relayUrl");
+          },
+          onCancel: back
+        }
+      ) }),
+      /* @__PURE__ */ jsx11(Box10, { marginTop: 1, children: /* @__PURE__ */ jsx11(Text10, { color: theme.muted, children: t("wizard.relayHint") }) }),
+      /* @__PURE__ */ jsx11(Message, { text: ctx.message?.text ?? null, level: ctx.message?.level ?? "info" })
+    ] });
+  }
+  if (step === "password") {
+    return /* @__PURE__ */ jsxs10(Panel, { title: t("wizard.passwordTitle"), children: [
+      header,
+      /* @__PURE__ */ jsx11(FieldRow, { label: t("relay.password"), selected: true, onSelect: () => {
+      }, children: /* @__PURE__ */ jsx11(
+        TextField,
+        {
+          value: password,
+          placeholder: t("relay.passwordEmpty"),
+          active: true,
+          mask: true,
+          onSubmit: (value) => {
+            setPassword(value);
+            advance("password");
+          },
+          onCancel: back
+        }
+      ) }),
+      /* @__PURE__ */ jsx11(Box10, { marginTop: 1, children: /* @__PURE__ */ jsx11(Text10, { color: theme.muted, children: t("wizard.passwordHint") }) }),
+      /* @__PURE__ */ jsx11(Message, { text: ctx.message?.text ?? null, level: ctx.message?.level ?? "info" })
+    ] });
+  }
+  const finishItems = [
+    { id: "startNow", label: `${t("wizard.startNow")}  [${startNow ? "\xD7" : " "}]` },
+    { id: "installKeepalive", label: `${t("wizard.installKeepalive")}  [${installKeepalive ? "\xD7" : " "}]` },
+    { id: "finish", label: t("wizard.finish") }
+  ];
+  const activateFinish = (id) => {
+    if (id === "startNow") {
+      setStartNow((value) => !value);
+      return;
+    }
+    if (id === "installKeepalive") {
+      setInstallKeepalive((value) => !value);
+      return;
+    }
+    finish();
+  };
+  return /* @__PURE__ */ jsxs10(Panel, { title: t("wizard.finishTitle"), children: [
+    header,
+    /* @__PURE__ */ jsx11(
+      FinishKeys,
+      {
+        items: finishItems.map((item) => item.id),
+        selected: finishSelection,
+        onSelect: setFinishSelection,
+        onActivate: activateFinish,
+        onBack: back
+      }
+    ),
+    finishItems.map((item) => /* @__PURE__ */ jsx11(
+      Selectable,
+      {
+        selected: finishSelection === item.id,
+        onSelect: () => {
+          setFinishSelection(item.id);
+          activateFinish(item.id);
+        },
+        onHover: () => setFinishSelection(item.id),
+        children: item.label
+      },
+      item.id
+    )),
+    /* @__PURE__ */ jsx11(Box10, { marginTop: 1, children: /* @__PURE__ */ jsx11(Text10, { color: theme.muted, children: t("wizard.finishHint", { path: (0, import_config.configPath)() }) }) }),
+    /* @__PURE__ */ jsx11(Message, { text: ctx.message?.text ?? null, level: ctx.message?.level ?? "info" })
+  ] });
+}
+function FinishKeys({
+  items,
+  selected,
+  onSelect,
+  onActivate,
+  onBack
+}) {
+  useInput8((_input, key) => {
+    const index = Math.max(0, items.indexOf(selected));
+    if (key.escape) onBack();
+    else if (key.upArrow) onSelect(items[(index - 1 + items.length) % items.length]);
+    else if (key.downArrow) onSelect(items[(index + 1) % items.length]);
+    else if (key.return) onActivate(selected);
+  });
+  return null;
+}
+function SkipKey({ onSkip, onBack }) {
+  useInput8((_input, key) => {
+    if (key.return) onSkip();
+    else if (key.escape) onBack();
+  });
+  return null;
+}
+
+// tui/src/App.tsx
+import { jsx as jsx12, jsxs as jsxs11 } from "react/jsx-runtime";
+var STATUS_POLL_MS = 3e3;
+var TABS = [
+  { id: "overview", labelKey: "nav.overview" },
+  { id: "pair", labelKey: "nav.pair" },
+  { id: "services", labelKey: "nav.services" },
+  { id: "relay", labelKey: "nav.relay" },
+  { id: "keepalive", labelKey: "nav.keepalive" },
+  { id: "herdr", labelKey: "nav.herdr" },
+  { id: "about", labelKey: "nav.about" }
+];
+function Tab({ label, active, onSelect }) {
+  const ref = useRef3(null);
+  const hovered = useMouseTarget(ref, { onClick: onSelect });
+  return /* @__PURE__ */ jsx12(Box11, { ref, marginRight: 2, children: /* @__PURE__ */ jsx12(
+    Text11,
+    {
+      color: active || hovered ? theme.accent : theme.muted,
+      bold: active,
+      underline: active || hovered,
+      children: label
+    }
+  ) });
+}
+function Footer({ hints }) {
+  return /* @__PURE__ */ jsx12(Box11, { marginTop: 1, paddingX: 1, children: /* @__PURE__ */ jsx12(Text11, { color: theme.muted, children: hints.join("  \xB7  ") }) });
+}
+function App({ initialLanguage, needsWizard }) {
+  const { exit } = useApp();
+  const mouse = useMouse();
+  const [config, setConfig] = useState10(() => (0, import_config.loadConfig)());
+  const [draft, setDraft] = useState10(() => (0, import_settings_model.createDraft)());
+  const [runtime, setRuntime] = useState10(() => (0, import_service.ensureRuntime)());
+  const [status, setStatus] = useState10(null);
+  const [tab, setTab] = useState10("overview");
+  const [message, setMessage] = useState10(null);
+  const [busy, setBusy] = useState10(false);
+  const [editingId, setEditingId] = useState10(null);
+  const [wizardDone, setWizardDone] = useState10(!needsWizard);
+  const locale = useMemo4(
+    () => detectLocale({ preference: initialLanguage ?? draft.ui.language }),
+    [initialLanguage, draft.ui.language]
+  );
+  const t = useMemo4(() => (0, import_i18n.createTranslator)(locale), [locale]);
+  const dirty = useMemo4(() => JSON.stringify(config) !== JSON.stringify(draft), [config, draft]);
+  const restartPending = useMemo4(() => dirty && (0, import_settings_model.requiresRestart)(config, draft), [config, draft, dirty]);
+  const notify = useCallback2((text, level2 = "info") => {
+    setMessage({ text, level: level2 });
+  }, []);
+  const refresh = useCallback2(() => {
+    (0, import_lifecycle.fullStatus)((0, import_config.loadConfig)()).then((next) => setStatus(next)).catch((error) => notify(error.message, "error"));
+  }, [notify]);
+  const reloadConfig = useCallback2(() => {
+    const next = (0, import_config.loadConfig)();
+    setConfig(next);
+    setDraft((0, import_settings_model.createDraft)(next));
+    setRuntime((0, import_service.ensureRuntime)());
+  }, []);
+  const run = useCallback2((task) => {
+    setBusy(true);
+    Promise.resolve().then(task).catch((error) => notify(error.message, "error")).finally(() => {
+      setBusy(false);
+      refresh();
+    });
+  }, [notify, refresh]);
+  useEffect6(() => {
+    if (!wizardDone) return void 0;
+    refresh();
+    const timer = setInterval(() => {
+      if (!editingId) refresh();
+    }, STATUS_POLL_MS);
+    return () => clearInterval(timer);
+  }, [wizardDone, refresh, editingId]);
+  const mouseChoice = useRef3(null);
+  useEffect6(() => {
+    if (mouseChoice.current !== null) return;
+    if (mouse.supported && !mouse.enabled) mouse.enable();
+  }, [mouse.supported, mouse.enabled, mouse]);
+  const context = {
+    t,
+    locale,
+    config,
+    draft,
+    status,
+    runtime,
+    busy,
+    dirty,
+    editingId,
+    updateDraft: setDraft,
+    reloadConfig,
+    setEditing: setEditingId,
+    notify,
+    run,
+    refresh,
+    message
+  };
+  useInput9((input, key) => {
+    if (key.ctrl && input === "c") {
+      exit();
+      return;
+    }
+    if (input === "q") {
+      exit();
+      return;
+    }
+    if (input === "r") {
+      setMessage(null);
+      refresh();
+      return;
+    }
+    if (input === "m") {
+      if (!mouse.supported) {
+        notify(t("hint.mouseUnsupported"), "info");
+        return;
+      }
+      mouseChoice.current = !mouse.enabled;
+      if (mouse.enabled) mouse.disable();
+      else mouse.enable();
+      return;
+    }
+    const index = TABS.findIndex((entry) => entry.id === tab);
+    if (key.rightArrow || key.tab && !key.shift) {
+      setTab(TABS[(index + 1) % TABS.length].id);
+      return;
+    }
+    if (key.leftArrow || key.tab && key.shift) {
+      setTab(TABS[(index - 1 + TABS.length) % TABS.length].id);
+      return;
+    }
+    const digit = Number.parseInt(input, 10);
+    if (Number.isInteger(digit) && digit >= 1 && digit <= TABS.length) setTab(TABS[digit - 1].id);
+  }, { isActive: wizardDone && editingId === null });
+  if (!wizardDone) {
+    return /* @__PURE__ */ jsx12(
+      Wizard,
+      {
+        ctx: context,
+        onDone: () => {
+          reloadConfig();
+          setWizardDone(true);
+          refresh();
+        }
+      }
+    );
+  }
+  const hints = [
+    t("hint.navigate"),
+    t("hint.select"),
+    t("hint.tabs"),
+    dirty ? t("hint.save") : null,
+    mouse.supported ? mouse.enabled ? t("hint.mouseOn") : t("hint.mouseOff") : t("hint.mouseUnsupported"),
+    t("hint.quit")
+  ].filter(Boolean);
+  return /* @__PURE__ */ jsxs11(Box11, { flexDirection: "column", paddingX: 1, paddingY: 1, children: [
+    /* @__PURE__ */ jsxs11(Box11, { marginBottom: 1, children: [
+      /* @__PURE__ */ jsx12(Text11, { bold: true, children: t("app.name") }),
+      /* @__PURE__ */ jsx12(Text11, { color: theme.muted, children: `  ${t("app.tagline")}` })
+    ] }),
+    /* @__PURE__ */ jsx12(Box11, { marginBottom: 1, children: TABS.map((entry, entryIndex) => /* @__PURE__ */ jsx12(
+      Tab,
+      {
+        label: `${entryIndex + 1} ${t(entry.labelKey)}`,
+        active: entry.id === tab,
+        onSelect: () => setTab(entry.id)
+      },
+      entry.id
+    )) }),
+    tab === "overview" ? /* @__PURE__ */ jsx12(Overview, { ctx: context }) : null,
+    tab === "pair" ? /* @__PURE__ */ jsx12(PairScreen, { ctx: context }) : null,
+    tab === "services" ? /* @__PURE__ */ jsx12(Services, { ctx: context }) : null,
+    tab === "relay" ? /* @__PURE__ */ jsx12(RelayScreen, { ctx: context }) : null,
+    tab === "keepalive" ? /* @__PURE__ */ jsx12(Keepalive, { ctx: context }) : null,
+    tab === "herdr" ? /* @__PURE__ */ jsx12(HerdrScreen, { ctx: context }) : null,
+    tab === "about" ? /* @__PURE__ */ jsx12(About, { ctx: context }) : null,
+    restartPending ? /* @__PURE__ */ jsx12(Box11, { marginTop: 1, children: /* @__PURE__ */ jsx12(Text11, { color: theme.warn, children: t("hint.restartRequired") }) }) : null,
+    /* @__PURE__ */ jsx12(Footer, { hints })
+  ] });
+}
+
+// tui/src/terminal.ts
+var ESC2 = String.fromCharCode(27);
+var ENTER_ALT_SCREEN = `${ESC2}[?1049h${ESC2}[H`;
+var EXIT_ALT_SCREEN = `${ESC2}[?1049l`;
+var SHOW_CURSOR = `${ESC2}[?25h`;
+function enterFullScreen(output = process.stdout) {
+  try {
+    output.write(ENTER_ALT_SCREEN);
+  } catch {
+  }
+}
+function restoreTerminal(output = process.stdout) {
+  try {
+    output.write(`${DISABLE_MOUSE}${SHOW_CURSOR}${EXIT_ALT_SCREEN}`);
+  } catch {
+  }
+}
+
+// tui/src/index.tsx
+import { jsx as jsx13 } from "react/jsx-runtime";
+async function startTui({ language = null } = {}) {
+  const needsWizard = !(0, import_config.configExists)();
+  const mouse = createMouseSource(process.stdin, process.stdout);
+  enterFullScreen();
+  const instance = render(
+    /* @__PURE__ */ jsx13(MouseProvider, { source: mouse, children: /* @__PURE__ */ jsx13(App, { initialLanguage: language, needsWizard }) }),
+    { stdin: mouse.stdin, exitOnCtrlC: false }
+  );
+  const cleanup = () => {
+    mouse.dispose();
+    restoreTerminal();
+  };
+  const onSignal = () => {
+    instance.unmount();
+    cleanup();
+    process.exit(0);
+  };
+  process.once("SIGINT", onSignal);
+  process.once("SIGTERM", onSignal);
+  process.once("exit", cleanup);
+  try {
+    await instance.waitUntilExit();
+  } finally {
+    cleanup();
+    process.off("SIGINT", onSignal);
+    process.off("SIGTERM", onSignal);
+  }
+}
+export {
+  App,
+  Wizard,
+  startTui
+};