@camstack/system 1.2.472 → 1.2.474

package/dist/file-host-worker.js

@@ -1,5 +1,5 @@
 require("./chunk-Cek0wNdY.js");
-const require_wal_maintenance = require("./wal-maintenance-Dxqd5igw.js");
+const require_wal_maintenance = require("./wal-maintenance-DyMUz_Hy.js");
 let node_worker_threads = require("node:worker_threads");
 //#region src/builtins/sqlite-storage/file-host-worker.ts
 /**

package/dist/file-host-worker.mjs

@@ -1,4 +1,4 @@
-import { C as RecordsEngine, D as callVector, E as callRecords, O as controlTargetOf, T as callData, _ as collectTransferables, a as WalMaintenance, b as isFileHostWorkerData, h as serializeError, l as SqliteSettingsBackend, o as createVectorIndex, s as vectorProviderOf, w as callControl, x as trustInput, y as isFileHostRequest } from "./wal-maintenance-KHzJXlF2.mjs";
+import { C as RecordsEngine, D as callVector, E as callRecords, O as controlTargetOf, T as callData, _ as collectTransferables, a as WalMaintenance, b as isFileHostWorkerData, h as serializeError, l as SqliteSettingsBackend, o as createVectorIndex, s as vectorProviderOf, w as callControl, x as trustInput, y as isFileHostRequest } from "./wal-maintenance-BnhkcEkI.mjs";
 import { parentPort, threadId, workerData } from "node:worker_threads";
 //#region src/builtins/sqlite-storage/file-host-worker.ts
 /**

package/dist/{hub-mdns-ciao-CYp1Gipm.mjs → hub-mdns-ciao-BDvqGIw4.mjs}

@@ -1,7 +1,7 @@
 import { o as __toESM } from "./chunk-CNf5ZN-e.mjs";
-import { Ta as userError } from "./dist-CdFkkmXW.mjs";
+import { Ea as userError } from "./dist-BugavoVR.mjs";
 import { f as X509Certificate$1 } from "./x509.es-DK__ETIe.mjs";
-import { D as reasonRequiresNewCa, E as evaluateExistingCert, F as readNameConstraints, N as permitsIdentity, _ as issueLeaf, b as collectCertIdentity, g as generateCa, j as isConstrainedCa, v as loadCa, y as localCaCommonName } from "./agent-https-JhvY1axF.mjs";
+import { D as reasonRequiresNewCa, E as evaluateExistingCert, F as readNameConstraints, N as permitsIdentity, _ as issueLeaf, b as collectCertIdentity, g as generateCa, j as isConstrainedCa, v as loadCa, y as localCaCommonName } from "./agent-https-CbczsyM0.mjs";
 import { X509Certificate, createPrivateKey } from "node:crypto";
 import { writeOwnerOnlyFileSync } from "@camstack/types/node";
 import { mkdir, writeFile } from "node:fs/promises";

package/dist/{hub-mdns-ciao-C174UDzO.js → hub-mdns-ciao-DkncLbg9.js}

@@ -1,7 +1,7 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-DX5Fu3mV.js");
+const require_dist = require("./dist-Sn-HiZ4e.js");
 const require_x509_es = require("./x509.es-C4cOo48M.js");
-const require_agent_https = require("./agent-https-bnyFRK7Y.js");
+const require_agent_https = require("./agent-https-DRwEbLL7.js");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");
 let node_fs_promises = require("node:fs/promises");

package/dist/index.js

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-DX5Fu3mV.js");
-const require_device_ca = require("./device-ca-CfiIg3a9.js");
+const require_dist = require("./dist-Sn-HiZ4e.js");
+const require_device_ca = require("./device-ca-Dg3rSU48.js");
 const require_read_all_rows$1 = require("./read-all-rows-CVoO1ONM.js");
 const require_builtins_alerts_alerts_addon = require("./builtins/alerts/alerts.addon.js");
 require("./builtins/alerts/index.js");
@@ -26,21 +26,21 @@ const require_builtins_loki_logging_index = require("./builtins/loki-logging/ind
 const require_builtins_native_metrics_native_metrics_addon = require("./builtins/native-metrics/native-metrics.addon.js");
 const require_builtins_device_history_device_history_addon = require("./builtins/device-history/device-history.addon.js");
 const require_builtins_sqlite_storage_filesystem_storage_addon = require("./builtins/sqlite-storage/filesystem-storage.addon.js");
-const require_wal_maintenance = require("./wal-maintenance-Dxqd5igw.js");
+const require_wal_maintenance = require("./wal-maintenance-DyMUz_Hy.js");
 const require_builtins_sqlite_storage_sqlite_settings_addon = require("./builtins/sqlite-storage/sqlite-settings.addon.js");
 const require_builtins_sqlite_storage_index = require("./builtins/sqlite-storage/index.js");
 const require_builtins_storage_orchestrator_storage_orchestrator_addon = require("./builtins/storage-orchestrator/storage-orchestrator.addon.js");
 require("./builtins/storage-orchestrator/index.js");
-const require_agent_https = require("./agent-https-bnyFRK7Y.js");
-const require_constants = require("./constants-CqbO6e9i.js");
+const require_agent_https = require("./agent-https-DRwEbLL7.js");
+const require_constants = require("./constants-C0hrXcEr.js");
 const require_builtins_system_config_system_config_addon = require("./builtins/system-config/system-config.addon.js");
 require("./builtins/system-config/index.js");
 const require_builtins_winston_logging_index = require("./builtins/winston-logging/index.js");
 const require_custom_action_registry = require("./custom-action-registry-MRyes5j0.js");
-const require_hub_mdns_ciao = require("./hub-mdns-ciao-C174UDzO.js");
+const require_hub_mdns_ciao = require("./hub-mdns-ciao-DkncLbg9.js");
 const require_platform_key_source = require("./platform-key-source-Di7HrlGR.js");
 const require_resource_monitor = require("./resource-monitor-mio9dSCT.js");
-const require_restore_archive = require("./restore-archive-B2jIFfu_.js");
+const require_restore_archive = require("./restore-archive-gYKzaJ4Y.js");
 const require_coral_accelerators = require("./coral-accelerators-BSVsBVzt.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
@@ -27185,6 +27185,10 @@ var en_default = {
 	"auth.session-ended": "Session ended — sign in again",
 	"auth.access-denied": "Access denied",
 	"auth.totp-confirm-failed": "TOTP confirmation failed — code did not match",
+	"auth.person-scopes-refused": "A person is an admin, with no scope rows, or holds exactly one viewer grant",
+	"auth.tokens-unavailable": "Tokens are not available yet",
+	"auth.token-label-required": "A token needs a name",
+	"auth.token-expiry-past": "A token must expire in the future",
 	"device.certificates-unavailable": "Device certificates are not available",
 	"device.not-found": "Device {id} not found",
 	"device.credentials-unavailable": "Device credentials not available",
@@ -27436,6 +27440,10 @@ var it_default = {
 	"auth.session-ended": "Sessione terminata — accedi di nuovo",
 	"auth.access-denied": "Accesso negato",
 	"auth.totp-confirm-failed": "Conferma TOTP non riuscita — il codice non corrisponde",
+	"auth.person-scopes-refused": "Una persona è amministratore, senza righe di permesso, oppure ha esattamente un permesso visualizzatore",
+	"auth.tokens-unavailable": "I token non sono ancora disponibili",
+	"auth.token-label-required": "Un token ha bisogno di un nome",
+	"auth.token-expiry-past": "Un token deve scadere nel futuro",
 	"device.certificates-unavailable": "I certificati dei dispositivi non sono disponibili",
 	"device.not-found": "Dispositivo {id} non trovato",
 	"device.credentials-unavailable": "Le credenziali del dispositivo non sono disponibili",

package/dist/index.mjs

@@ -1,6 +1,6 @@
 import { i as __require } from "./chunk-CNf5ZN-e.mjs";
-import { $r as errMsg$1, Ar as supportedRuntimes, Cn as isCollectionArrayMethod, Da as EventCategory$1, Dn as isObjectInput, Ea as withoutCallerStamp, Fi as asString$1, J as METHOD_ACCESS_MAP, Jn as objectInputDeclaresAddonId, K as LOG_LEVEL_RANK, Ki as defineRecordKinds, Ni as asJsonObject$1, On as isVoidInput, Pi as asNumber, Pn as lifecycleJobSchema, Rn as logLevelAtMost, Sn as isArrayOutputSchema, Sr as splitTranslationRef, Ta as userError, Ui as createEvent$1, Yi as expandCapMethods, Yn as objectInputDeclaresRequiredDeviceId, _ as CatalogFileSchema, ai as DEVICE_STATUS_METHOD, bi as ReadinessRegistry, da as parseJsonObject, er as procedureAuthKey, fa as parseJsonUnknown, fn as extractNestedAddonId, fr as resolveMethodAuth, ga as resolveCapMount, gr as scopesAllowDeviceCap, hr as scopesAllowAddon, ii as DEVICE_SETTINGS_CONTRIBUTION_METHODS, kn as kebabToCamel$1, ma as readinessKey, n as AGENT_MDNS_TXT_KEYS, ni as CALLER_STAMPED_CAPABILITIES$1, qi as emitDownForOwnedCaps, r as ALL_CAPABILITY_DEFINITIONS, ri as DATAPLANE_SECRET_HEADER$1, t as AGENT_MDNS_SERVICE_TYPE, u as CATALOG_LANGS, va as scopeKey, vn as interpolate, vt as addonSettingsCapability, xi as ReadinessTimeoutError, yi as RUNTIME_DEFAULTS, zn as looseSchema } from "./dist-CdFkkmXW.mjs";
-import { d as JWT_SIGNING_KEY_REF, f as JwtSigningKeyUnavailableError, g as processJwtSigningKey, i as generateDeviceCa, l as verifyDeviceLeaf, m as getProcessJwtSigningKeyState, n as DEVICE_CA_KEY_REF, o as issueDeviceLeaf, p as SYSTEM_SECRET_OWNER, s as loadDeviceCa, u as verifyDeviceSignature, v as staticJwtSigningKey } from "./device-ca-BWTWWBcc.mjs";
+import { Cn as isCollectionArrayMethod, Cr as splitTranslationRef, Da as withoutCallerStamp, Dn as isObjectInput, Ea as userError, Fi as asNumber, Ii as asString$1, J as METHOD_ACCESS_MAP, Ji as emitDownForOwnedCaps, Jn as objectInputDeclaresAddonId, K as LOG_LEVEL_RANK, Oa as EventCategory$1, On as isVoidInput, Pi as asJsonObject$1, Pn as lifecycleJobSchema, Rn as logLevelAtMost, Si as ReadinessTimeoutError, Sn as isArrayOutputSchema, Wi as createEvent$1, Xi as expandCapMethods, Yn as objectInputDeclaresRequiredDeviceId, _ as CatalogFileSchema, _a as resolveCapMount, _r as scopesAllowDeviceCap, ai as DEVICE_SETTINGS_CONTRIBUTION_METHODS, bi as RUNTIME_DEFAULTS, ei as errMsg$1, fa as parseJsonObject, fn as extractNestedAddonId, gr as scopesAllowAddon, ha as readinessKey, ii as DATAPLANE_SECRET_HEADER$1, jr as supportedRuntimes, kn as kebabToCamel$1, n as AGENT_MDNS_TXT_KEYS, oi as DEVICE_STATUS_METHOD, pa as parseJsonUnknown, pr as resolveMethodAuth, qi as defineRecordKinds, r as ALL_CAPABILITY_DEFINITIONS, ri as CALLER_STAMPED_CAPABILITIES$1, t as AGENT_MDNS_SERVICE_TYPE, tr as procedureAuthKey, u as CATALOG_LANGS, vn as interpolate, vt as addonSettingsCapability, xi as ReadinessRegistry, ya as scopeKey, zn as looseSchema } from "./dist-BugavoVR.mjs";
+import { d as JWT_SIGNING_KEY_REF, f as JwtSigningKeyUnavailableError, g as processJwtSigningKey, i as generateDeviceCa, l as verifyDeviceLeaf, m as getProcessJwtSigningKeyState, n as DEVICE_CA_KEY_REF, o as issueDeviceLeaf, p as SYSTEM_SECRET_OWNER, s as loadDeviceCa, u as verifyDeviceSignature, v as staticJwtSigningKey } from "./device-ca-CHdsePe5.mjs";
 import { t as require_read_all_rows } from "./read-all-rows-TaPqdWNF.mjs";
 import { AlertCenterAddon } from "./builtins/alerts/alerts.addon.mjs";
 import "./builtins/alerts/index.mjs";
@@ -25,21 +25,21 @@ import { LokiDestination, LokiLoggingAddon } from "./builtins/loki-logging/index
 import NativeMetricsAddon, { a as NativeMetricsProvider, n as nodeProcReader, r as parseProcStat } from "./builtins/native-metrics/native-metrics.addon.mjs";
 import { DeviceHistoryAddon } from "./builtins/device-history/device-history.addon.mjs";
 import { FilesystemStorageAddon, t as FilesystemStorageProvider } from "./builtins/sqlite-storage/filesystem-storage.addon.mjs";
-import { C as RecordsEngine, l as SqliteSettingsBackend } from "./wal-maintenance-KHzJXlF2.mjs";
+import { C as RecordsEngine, l as SqliteSettingsBackend } from "./wal-maintenance-BnhkcEkI.mjs";
 import { SqliteSettingsAddon } from "./builtins/sqlite-storage/sqlite-settings.addon.mjs";
 import { ConfigStore, DeviceStore } from "./builtins/sqlite-storage/index.mjs";
 import { StorageOrchestratorAddon, a as stripForwardedCaller, i as createHubCapForwardService, l as STORAGE_DRAIN_STATE_LEGACY, n as HUB_CAP_FWD_ACTION, o as buildStorageLocationRegistry, r as HUB_CAP_FWD_SERVICE, t as StorageOrchestratorService, u as storageOrchestratorRecordKinds } from "./builtins/storage-orchestrator/storage-orchestrator.addon.mjs";
 import "./builtins/storage-orchestrator/index.mjs";
-import { A as buildNameConstraintSet, B as setProcessAgentHttpsNames, C as LEAF_RENEWAL_WINDOW_DAYS, E as evaluateExistingCert, F as readNameConstraints, I as AGENT_HTTPS_NAMES_COLLECTION, L as AGENT_HTTPS_NAMES_COLUMNS, M as isLocalOnlyHostname, N as permitsIdentity, O as PERMITTED_DNS_SUFFIXES, P as permitsName, R as AgentHttpsNames, S as CA_VALIDITY_DAYS, T as SERVER_AUTH_OID, a as collectAgentNames, b as collectCertIdentity, c as installAgentHttps, d as issueAgentHttpsLeaf, f as loadAgentHttps, h as CA_COMMON_NAME, i as certificateNames, j as isConstrainedCa, k as PERMITTED_IP_RANGES, l as isContainerBridgeAddress, m as pinnedHttpsCaFingerprint, n as acceptAgentSans, o as createAgentHttpsRequest, p as pemDigest, r as agentHttpsPaths, s as describeHttpsLeaf, t as AgentHttpsInstallError, u as isPrivateAddress, w as MAX_LEAF_VALIDITY_DAYS, x as systemHostFacts, y as localCaCommonName, z as getProcessAgentHttpsNames } from "./agent-https-JhvY1axF.mjs";
-import { a as MESH_CA_KEY_REF, i as MESH_CA_FIELD, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY } from "./constants-zBiEodEM.mjs";
+import { A as buildNameConstraintSet, B as setProcessAgentHttpsNames, C as LEAF_RENEWAL_WINDOW_DAYS, E as evaluateExistingCert, F as readNameConstraints, I as AGENT_HTTPS_NAMES_COLLECTION, L as AGENT_HTTPS_NAMES_COLUMNS, M as isLocalOnlyHostname, N as permitsIdentity, O as PERMITTED_DNS_SUFFIXES, P as permitsName, R as AgentHttpsNames, S as CA_VALIDITY_DAYS, T as SERVER_AUTH_OID, a as collectAgentNames, b as collectCertIdentity, c as installAgentHttps, d as issueAgentHttpsLeaf, f as loadAgentHttps, h as CA_COMMON_NAME, i as certificateNames, j as isConstrainedCa, k as PERMITTED_IP_RANGES, l as isContainerBridgeAddress, m as pinnedHttpsCaFingerprint, n as acceptAgentSans, o as createAgentHttpsRequest, p as pemDigest, r as agentHttpsPaths, s as describeHttpsLeaf, t as AgentHttpsInstallError, u as isPrivateAddress, w as MAX_LEAF_VALIDITY_DAYS, x as systemHostFacts, y as localCaCommonName, z as getProcessAgentHttpsNames } from "./agent-https-CbczsyM0.mjs";
+import { a as MESH_CA_KEY_REF, i as MESH_CA_FIELD, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY } from "./constants-Dy8CaDeT.mjs";
 import { $ as generateMeshKeyPair, A as setProcessMeshPeerTransportLookup, B as describeMeshLeaf, C as setProcessMeshTlsEnabler, D as getProcessPeerLeaf, E as getProcessNodeMeshTransport, F as setProcessMeshTlsListenerState, G as MeshCaKeeper, H as setProcessMeshCertificateRegistry, I as MESH_NODE_CERTIFICATES_COLLECTION, J as caFingerprint, K as getProcessMeshCaState, L as MESH_NODE_CERTIFICATES_COLUMNS, M as revokeMeshCertificate, N as getProcessMeshTlsListenerState, O as isProcessVerifiedMeshPeer, P as openMeshTlsWhenRevocationsLoaded, Q as generateMeshCa, R as MeshCertificateRegistry, S as ServiceBroker, SystemConfigAddon, T as emitProcessNodeRegistered, U as MeshCrl, V as getProcessMeshCertificateRegistry, W as processMeshCrl, X as createMeshCsrPem, Y as caFingerprintCompact, Z as exportMeshPrivateKeyPem, _ as signPairingProof, _t as readCidrSetting, a as hubHostFromMeshAddress, at as AGENT_UI_UNLOCK_TTL_MS, b as TlsTcpTransporter, c as PAIRING_MAX_SESSIONS, ct as AGENT_UI_UNLOCK_VERSION, d as PAIRING_PROTOCOL, dt as mintAgentUiUnlockTicket, et as isValidAgentNodeId, f as PAIRING_TTL_MS, ft as parseAgentDashboardOrigins, g as keyFingerprintShort, gt as parseCidrList, h as describeCsr, ht as normalizeIp, i as AgentPairing, it as AGENT_DASHBOARD_ORIGINS_FIELD, j as renewMeshCertificate, k as onProcessNodeRegistered, l as PAIRING_PATHS, lt as UnlockTicketJtiStore, m as computePairingSas, mt as createCidrMatcher, n as HubPairing, nt as issueMeshLeafFromCsr, o as PAIRING_CODE_DIGITS, ot as AGENT_UI_UNLOCK_TYP, p as computePairingCommitment, pt as verifyAgentUiUnlockTicket, q as requireProcessMeshCa, r as PairingHttpError, rt as loadMeshCa, s as PAIRING_MAX_CODE_ATTEMPTS, st as AGENT_UI_UNLOCK_USE, tt as issueMeshLeafForNode, u as PAIRING_PIN_DIGITS, ut as isAllowedAgentDashboardReturnTo, v as verifyPairingProof, w as dropProcessPeer, x as Errors, y as MESH_TLS_PORT_HELLO_FIELD, z as RENEWAL_ABANDONED } from "./builtins/system-config/system-config.addon.mjs";
 import "./builtins/system-config/index.mjs";
 import { WinstonDestination, WinstonLoggingAddon } from "./builtins/winston-logging/index.mjs";
 import { C as isModelDownloaded, T as revisionWeightUrl, _ as downloadFile, a as startEventLoopStallMonitor, b as fetchJson, c as createAuthenticatedFileServer, d as resolveFilePath, f as ModelDownloadService, g as deleteModelFromDisk, h as collectModelFiles, i as attributeStall, l as parseRangeHeader, m as adoptModelRevisions, n as STALL_REPORT_MS, o as createFileDataPlaneHandler, r as STALL_TICK_MS, s as contentTypeFor, t as CustomActionRegistry, u as parseTokenizedUrl, v as downloadModel, w as resolveFormatRevision, x as getModelFilePath, y as ensureModel } from "./custom-action-registry-DZSCLBuT.mjs";
-import { A as allFamiliesListenHost, C as caReplacementMarkerFile, D as replaceUnconstrainedLocalCa, E as reissueTlsLeaf, F as registerLanHttpHandler, M as bindPendingLanHttp, N as closeLanHttp, O as retirePreviousLocalCa, P as readLanHttpState, S as validateUploadedTls, T as loadTlsCert, _ as splitPemCertificates, a as storeUploadedCertificate, b as chainsToPublicRoot, c as leafFingerprintOf, d as servedHttpsLeafFingerprint, f as prepareBootTls, g as readTlsMode, h as readTlsAccessStatus, i as revertToGeneratedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, l as registerHttpsListener, m as readExtraSans, n as applyCertificateToListener, o as useStoredUploadedCertificate, p as UPLOADED_CA_FILE, r as regenerateCertificate, s as clearHttpsListener, t as createCiaoPublisher, u as reloadHttpsListener, v as writeExtraSans, w as ensureTlsCert, x as checkUploadedCa, y as writeTlsMode } from "./hub-mdns-ciao-CYp1Gipm.mjs";
+import { A as allFamiliesListenHost, C as caReplacementMarkerFile, D as replaceUnconstrainedLocalCa, E as reissueTlsLeaf, F as registerLanHttpHandler, M as bindPendingLanHttp, N as closeLanHttp, O as retirePreviousLocalCa, P as readLanHttpState, S as validateUploadedTls, T as loadTlsCert, _ as splitPemCertificates, a as storeUploadedCertificate, b as chainsToPublicRoot, c as leafFingerprintOf, d as servedHttpsLeafFingerprint, f as prepareBootTls, g as readTlsMode, h as readTlsAccessStatus, i as revertToGeneratedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, l as registerHttpsListener, m as readExtraSans, n as applyCertificateToListener, o as useStoredUploadedCertificate, p as UPLOADED_CA_FILE, r as regenerateCertificate, s as clearHttpsListener, t as createCiaoPublisher, u as reloadHttpsListener, v as writeExtraSans, w as ensureTlsCert, x as checkUploadedCa, y as writeTlsMode } from "./hub-mdns-ciao-BDvqGIw4.mjs";
 import { n as getPlatformKeychainKey, r as setPlatformKeychainKey, t as clearPlatformKeychainKey } from "./platform-key-source-BWlq0jjn.mjs";
 import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-Di9daRwI.mjs";
-import { _ as backupRecordStoresOf, c as BackupDecryptError, f as generateBackupKeyPair, g as backupOrchestratorRecordKinds, h as readBackupEncryptionHeader, l as BackupKeyFormatError, r as prepareRestoreArchive, s as SystemBackupService, t as BackupKeyRequiredError, u as BackupKeyMismatchError } from "./restore-archive-BX0gaKtG.mjs";
+import { _ as backupRecordStoresOf, c as BackupDecryptError, f as generateBackupKeyPair, g as backupOrchestratorRecordKinds, h as readBackupEncryptionHeader, l as BackupKeyFormatError, r as prepareRestoreArchive, s as SystemBackupService, t as BackupKeyRequiredError, u as BackupKeyMismatchError } from "./restore-archive-CFBm30Gk.mjs";
 import { r as nodeCoralFs, t as classifyCoralAccelerator } from "./coral-accelerators-DBlgWB8k.mjs";
 import { z } from "zod";
 import * as crypto$1 from "node:crypto";
@@ -27182,6 +27182,10 @@ var en_default = {
 	"auth.session-ended": "Session ended — sign in again",
 	"auth.access-denied": "Access denied",
 	"auth.totp-confirm-failed": "TOTP confirmation failed — code did not match",
+	"auth.person-scopes-refused": "A person is an admin, with no scope rows, or holds exactly one viewer grant",
+	"auth.tokens-unavailable": "Tokens are not available yet",
+	"auth.token-label-required": "A token needs a name",
+	"auth.token-expiry-past": "A token must expire in the future",
 	"device.certificates-unavailable": "Device certificates are not available",
 	"device.not-found": "Device {id} not found",
 	"device.credentials-unavailable": "Device credentials not available",
@@ -27433,6 +27437,10 @@ var it_default = {
 	"auth.session-ended": "Sessione terminata — accedi di nuovo",
 	"auth.access-denied": "Accesso negato",
 	"auth.totp-confirm-failed": "Conferma TOTP non riuscita — il codice non corrisponde",
+	"auth.person-scopes-refused": "Una persona è amministratore, senza righe di permesso, oppure ha esattamente un permesso visualizzatore",
+	"auth.tokens-unavailable": "I token non sono ancora disponibili",
+	"auth.token-label-required": "Un token ha bisogno di un nome",
+	"auth.token-expiry-past": "Un token deve scadere nel futuro",
 	"device.certificates-unavailable": "I certificati dei dispositivi non sono disponibili",
 	"device.not-found": "Dispositivo {id} non trovato",
 	"device.credentials-unavailable": "Le credenziali del dispositivo non sono disponibili",

package/dist/{restore-archive-BX0gaKtG.mjs → restore-archive-CFBm30Gk.mjs}

@@ -1,4 +1,4 @@
-import { Ki as defineRecordKinds, M as DataStoreDatabaseSchema, x as DATABASE_SNAPSHOT_SUFFIX } from "./dist-CdFkkmXW.mjs";
+import { M as DataStoreDatabaseSchema, qi as defineRecordKinds, x as DATABASE_SNAPSHOT_SUFFIX } from "./dist-BugavoVR.mjs";
 import { z } from "zod";
 import { createCipheriv, createDecipheriv, createHash, createPrivateKey, createPublicKey, diffieHellman, generateKeyPairSync, hkdfSync, randomBytes } from "node:crypto";
 import { Buffer as Buffer$1 } from "buffer";

package/dist/{restore-archive-B2jIFfu_.js → restore-archive-gYKzaJ4Y.js}

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-DX5Fu3mV.js");
+const require_dist = require("./dist-Sn-HiZ4e.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 let buffer = require("buffer");

package/dist/{retired-settings-keys-C_Kjp-Bj.mjs → retired-settings-keys-CWp7ZSeA.mjs}

@@ -123,6 +123,14 @@ var RETIRED_SETTINGS_KEYS = [
 		keys: ["mediaAttachPolicy"],
 		perNodeKeys: [],
 		reason: "deleted 2026-08-28 (D272) — absent from MediaSettingsSchema, so the value was never even resolved, let alone read"
+	},
+	{
+		namespace: "waste-collections",
+		collection: "addon-settings",
+		row: "root",
+		keys: ["fetchHour"],
+		perNodeKeys: [],
+		reason: "deleted 2026-10-24 — the \"daily fetch hour\" was never honoured: sources refresh at boot and every 24 h from then, and nothing ever read the value back (D268)"
 	}
 ];
 /**

package/dist/{retired-settings-keys-CGUqX-Oz.js → retired-settings-keys-DorakcxV.js}

@@ -123,6 +123,14 @@ var RETIRED_SETTINGS_KEYS = [
 		keys: ["mediaAttachPolicy"],
 		perNodeKeys: [],
 		reason: "deleted 2026-08-28 (D272) — absent from MediaSettingsSchema, so the value was never even resolved, let alone read"
+	},
+	{
+		namespace: "waste-collections",
+		collection: "addon-settings",
+		row: "root",
+		keys: ["fetchHour"],
+		perNodeKeys: [],
+		reason: "deleted 2026-10-24 — the \"daily fetch hour\" was never honoured: sources refresh at boot and every 24 h from then, and nothing ever read the value back (D268)"
 	}
 ];
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/system",
-  "version": "1.2.472",
+  "version": "1.2.474",
   "description": "Core addon for CamStack — builtins, pipeline, process management, auth, logging, events",
   "keywords": [
     "camstack",
@@ -536,18 +536,13 @@
   "dependencies": {
     "@camstack/sdk": "*",
     "@camstack/types": "*",
-    "@homebridge/ciao": "^1.3.9",
     "@msgpack/msgpack": "^3.1.3",
-    "@peculiar/asn1-schema": "^2.6.0",
-    "@peculiar/asn1-x509": "^2.6.1",
-    "@peculiar/x509": "^1.14.3",
     "@trpc/client": "^11.16.0",
     "@trpc/server": "^11.16.0",
     "bcryptjs": "^3.0.3",
     "better-sqlite3": "^12.8.0",
     "croner": "^10.0.1",
     "esbuild": "^0.27.7",
-    "jose": "^6.2.3",
     "js-yaml": "^4.1.0",
     "jsonwebtoken": "^9.0.0",
     "moleculer": "0.15.0",
@@ -565,11 +560,16 @@
   },
   "devDependencies": {
     "@camstack/types": "*",
+    "@homebridge/ciao": "^1.3.9",
+    "@peculiar/asn1-schema": "^2.6.0",
+    "@peculiar/asn1-x509": "^2.6.1",
+    "@peculiar/x509": "^1.14.3",
     "@types/bcryptjs": "^2.4.6",
     "@types/better-sqlite3": "^7.6.13",
     "@types/js-yaml": "^4.0.9",
     "@types/jsonwebtoken": "^9.0.0",
     "@types/tar": "^6.1.13",
+    "jose": "^6.2.3",
     "tsup": "^8.0.0",
     "typescript": "~6.0.3",
     "vite": "^8.0.11",