@camstack/system 1.2.473 → 1.2.475

package/dist/file-host-worker.js

@@ -1,5 +1,5 @@
 require("./chunk-Cek0wNdY.js");
-const require_wal_maintenance = require("./wal-maintenance-BT8Ns0W3.js");
+const require_wal_maintenance = require("./wal-maintenance-D3UwIKX5.js");
 let node_worker_threads = require("node:worker_threads");
 //#region src/builtins/sqlite-storage/file-host-worker.ts
 /**

package/dist/file-host-worker.mjs

@@ -1,4 +1,4 @@
-import { C as RecordsEngine, D as callVector, E as callRecords, O as controlTargetOf, T as callData, _ as collectTransferables, a as WalMaintenance, b as isFileHostWorkerData, h as serializeError, l as SqliteSettingsBackend, o as createVectorIndex, s as vectorProviderOf, w as callControl, x as trustInput, y as isFileHostRequest } from "./wal-maintenance-BuB731DK.mjs";
+import { C as RecordsEngine, D as callVector, E as callRecords, O as controlTargetOf, T as callData, _ as collectTransferables, a as WalMaintenance, b as isFileHostWorkerData, h as serializeError, l as SqliteSettingsBackend, o as createVectorIndex, s as vectorProviderOf, w as callControl, x as trustInput, y as isFileHostRequest } from "./wal-maintenance-rLv4uOmp.mjs";
 import { parentPort, threadId, workerData } from "node:worker_threads";
 //#region src/builtins/sqlite-storage/file-host-worker.ts
 /**

package/dist/{hub-mdns-ciao-CUr6ewsX.js → hub-mdns-ciao-B1VcdfT1.js}

@@ -1,7 +1,7 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-Bmah6waF.js");
-const require_x509_es = require("./x509.es-C4cOo48M.js");
-const require_agent_https = require("./agent-https-B9Q3-IKd.js");
+const require_dist = require("./dist-BtDdPdZ7.js");
+const require_x509_es = require("./x509.es-WtnRNyYS.js");
+const require_agent_https = require("./agent-https-BsqT0qni.js");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");
 let node_fs_promises = require("node:fs/promises");
@@ -902,7 +902,7 @@ function applyCertificateToListener(dataDir) {
 //#region src/builtins/local-network/hub-mdns-ciao.ts
 function createCiaoPublisher() {
 	return { async publish(announcement) {
-		const { getResponder } = await Promise.resolve().then(() => /* @__PURE__ */ require_chunk.__toESM(require("./lib-8oZrELLm.js").default));
+		const { getResponder } = await Promise.resolve().then(() => /* @__PURE__ */ require_chunk.__toESM(require("./lib-C3U1yluo.js").default));
 		const responder = getResponder();
 		const service = responder.createService({
 			name: announcement.name,

package/dist/{hub-mdns-ciao-BemeCNGe.mjs → hub-mdns-ciao-Bc9PnWu3.mjs}

@@ -1,7 +1,7 @@
 import { o as __toESM } from "./chunk-CNf5ZN-e.mjs";
-import { Ea as userError } from "./dist-C9lbdBL5.mjs";
-import { f as X509Certificate$1 } from "./x509.es-DK__ETIe.mjs";
-import { D as reasonRequiresNewCa, E as evaluateExistingCert, F as readNameConstraints, N as permitsIdentity, _ as issueLeaf, b as collectCertIdentity, g as generateCa, j as isConstrainedCa, v as loadCa, y as localCaCommonName } from "./agent-https-DOwn4pqL.mjs";
+import { Ea as userError } from "./dist-DygMs3Qc.mjs";
+import { f as X509Certificate$1 } from "./x509.es-BRiJgOvu.mjs";
+import { D as reasonRequiresNewCa, E as evaluateExistingCert, F as readNameConstraints, N as permitsIdentity, _ as issueLeaf, b as collectCertIdentity, g as generateCa, j as isConstrainedCa, v as loadCa, y as localCaCommonName } from "./agent-https-wA8gGLc1.mjs";
 import { X509Certificate, createPrivateKey } from "node:crypto";
 import { writeOwnerOnlyFileSync } from "@camstack/types/node";
 import { mkdir, writeFile } from "node:fs/promises";
@@ -902,7 +902,7 @@ function applyCertificateToListener(dataDir) {
 //#region src/builtins/local-network/hub-mdns-ciao.ts
 function createCiaoPublisher() {
 	return { async publish(announcement) {
-		const { getResponder } = await import("./lib-DK38ompL.mjs").then((m) => /* @__PURE__ */ __toESM(m.default));
+		const { getResponder } = await import("./lib-DFZblCIu.mjs").then((m) => /* @__PURE__ */ __toESM(m.default));
 		const responder = getResponder();
 		const service = responder.createService({
 			name: announcement.name,

package/dist/index.js

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-Bmah6waF.js");
-const require_device_ca = require("./device-ca-BXzQ1pYj.js");
+const require_dist = require("./dist-BtDdPdZ7.js");
+const require_device_ca = require("./device-ca-ftrfVdc0.js");
 const require_read_all_rows$1 = require("./read-all-rows-CVoO1ONM.js");
 const require_builtins_alerts_alerts_addon = require("./builtins/alerts/alerts.addon.js");
 require("./builtins/alerts/index.js");
@@ -26,21 +26,21 @@ const require_builtins_loki_logging_index = require("./builtins/loki-logging/ind
 const require_builtins_native_metrics_native_metrics_addon = require("./builtins/native-metrics/native-metrics.addon.js");
 const require_builtins_device_history_device_history_addon = require("./builtins/device-history/device-history.addon.js");
 const require_builtins_sqlite_storage_filesystem_storage_addon = require("./builtins/sqlite-storage/filesystem-storage.addon.js");
-const require_wal_maintenance = require("./wal-maintenance-BT8Ns0W3.js");
+const require_wal_maintenance = require("./wal-maintenance-D3UwIKX5.js");
 const require_builtins_sqlite_storage_sqlite_settings_addon = require("./builtins/sqlite-storage/sqlite-settings.addon.js");
 const require_builtins_sqlite_storage_index = require("./builtins/sqlite-storage/index.js");
 const require_builtins_storage_orchestrator_storage_orchestrator_addon = require("./builtins/storage-orchestrator/storage-orchestrator.addon.js");
 require("./builtins/storage-orchestrator/index.js");
-const require_agent_https = require("./agent-https-B9Q3-IKd.js");
-const require_constants = require("./constants-XkWSVvgY.js");
+const require_agent_https = require("./agent-https-BsqT0qni.js");
+const require_constants = require("./constants-3Wj5OyEk.js");
 const require_builtins_system_config_system_config_addon = require("./builtins/system-config/system-config.addon.js");
 require("./builtins/system-config/index.js");
 const require_builtins_winston_logging_index = require("./builtins/winston-logging/index.js");
 const require_custom_action_registry = require("./custom-action-registry-MRyes5j0.js");
-const require_hub_mdns_ciao = require("./hub-mdns-ciao-CUr6ewsX.js");
+const require_hub_mdns_ciao = require("./hub-mdns-ciao-B1VcdfT1.js");
 const require_platform_key_source = require("./platform-key-source-Di7HrlGR.js");
 const require_resource_monitor = require("./resource-monitor-mio9dSCT.js");
-const require_restore_archive = require("./restore-archive-DbPmyjiM.js");
+const require_restore_archive = require("./restore-archive-TDkQfmLO.js");
 const require_coral_accelerators = require("./coral-accelerators-BSVsBVzt.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
@@ -27186,6 +27186,9 @@ var en_default = {
 	"auth.access-denied": "Access denied",
 	"auth.totp-confirm-failed": "TOTP confirmation failed — code did not match",
 	"auth.person-scopes-refused": "A person is an admin, with no scope rows, or holds exactly one viewer grant",
+	"auth.tokens-unavailable": "Tokens are not available yet",
+	"auth.token-label-required": "A token needs a name",
+	"auth.token-expiry-past": "A token must expire in the future",
 	"device.certificates-unavailable": "Device certificates are not available",
 	"device.not-found": "Device {id} not found",
 	"device.credentials-unavailable": "Device credentials not available",
@@ -27438,6 +27441,9 @@ var it_default = {
 	"auth.access-denied": "Accesso negato",
 	"auth.totp-confirm-failed": "Conferma TOTP non riuscita — il codice non corrisponde",
 	"auth.person-scopes-refused": "Una persona è amministratore, senza righe di permesso, oppure ha esattamente un permesso visualizzatore",
+	"auth.tokens-unavailable": "I token non sono ancora disponibili",
+	"auth.token-label-required": "Un token ha bisogno di un nome",
+	"auth.token-expiry-past": "Un token deve scadere nel futuro",
 	"device.certificates-unavailable": "I certificati dei dispositivi non sono disponibili",
 	"device.not-found": "Dispositivo {id} non trovato",
 	"device.credentials-unavailable": "Le credenziali del dispositivo non sono disponibili",

package/dist/index.mjs

@@ -1,6 +1,6 @@
 import { i as __require } from "./chunk-CNf5ZN-e.mjs";
-import { Cn as isCollectionArrayMethod, Cr as splitTranslationRef, Da as withoutCallerStamp, Dn as isObjectInput, Ea as userError, Fi as asNumber, Ii as asString$1, J as METHOD_ACCESS_MAP, Ji as emitDownForOwnedCaps, Jn as objectInputDeclaresAddonId, K as LOG_LEVEL_RANK, Oa as EventCategory$1, On as isVoidInput, Pi as asJsonObject$1, Pn as lifecycleJobSchema, Rn as logLevelAtMost, Si as ReadinessTimeoutError, Sn as isArrayOutputSchema, Wi as createEvent$1, Xi as expandCapMethods, Yn as objectInputDeclaresRequiredDeviceId, _ as CatalogFileSchema, _a as resolveCapMount, _r as scopesAllowDeviceCap, ai as DEVICE_SETTINGS_CONTRIBUTION_METHODS, bi as RUNTIME_DEFAULTS, ei as errMsg$1, fa as parseJsonObject, fn as extractNestedAddonId, gr as scopesAllowAddon, ha as readinessKey, ii as DATAPLANE_SECRET_HEADER$1, jr as supportedRuntimes, kn as kebabToCamel$1, n as AGENT_MDNS_TXT_KEYS, oi as DEVICE_STATUS_METHOD, pa as parseJsonUnknown, pr as resolveMethodAuth, qi as defineRecordKinds, r as ALL_CAPABILITY_DEFINITIONS, ri as CALLER_STAMPED_CAPABILITIES$1, t as AGENT_MDNS_SERVICE_TYPE, tr as procedureAuthKey, u as CATALOG_LANGS, vn as interpolate, vt as addonSettingsCapability, xi as ReadinessRegistry, ya as scopeKey, zn as looseSchema } from "./dist-C9lbdBL5.mjs";
-import { d as JWT_SIGNING_KEY_REF, f as JwtSigningKeyUnavailableError, g as processJwtSigningKey, i as generateDeviceCa, l as verifyDeviceLeaf, m as getProcessJwtSigningKeyState, n as DEVICE_CA_KEY_REF, o as issueDeviceLeaf, p as SYSTEM_SECRET_OWNER, s as loadDeviceCa, u as verifyDeviceSignature, v as staticJwtSigningKey } from "./device-ca-DyUtcpf4.mjs";
+import { Cn as isCollectionArrayMethod, Cr as splitTranslationRef, Da as withoutCallerStamp, Dn as isObjectInput, Ea as userError, Fi as asNumber, Ii as asString$1, J as METHOD_ACCESS_MAP, Ji as emitDownForOwnedCaps, Jn as objectInputDeclaresAddonId, K as LOG_LEVEL_RANK, Oa as EventCategory$1, On as isVoidInput, Pi as asJsonObject$1, Pn as lifecycleJobSchema, Rn as logLevelAtMost, Si as ReadinessTimeoutError, Sn as isArrayOutputSchema, Wi as createEvent$1, Xi as expandCapMethods, Yn as objectInputDeclaresRequiredDeviceId, _ as CatalogFileSchema, _a as resolveCapMount, _r as scopesAllowDeviceCap, ai as DEVICE_SETTINGS_CONTRIBUTION_METHODS, bi as RUNTIME_DEFAULTS, ei as errMsg$1, fa as parseJsonObject, fn as extractNestedAddonId, gr as scopesAllowAddon, ha as readinessKey, ii as DATAPLANE_SECRET_HEADER$1, jr as supportedRuntimes, kn as kebabToCamel$1, n as AGENT_MDNS_TXT_KEYS, oi as DEVICE_STATUS_METHOD, pa as parseJsonUnknown, pr as resolveMethodAuth, qi as defineRecordKinds, r as ALL_CAPABILITY_DEFINITIONS, ri as CALLER_STAMPED_CAPABILITIES$1, t as AGENT_MDNS_SERVICE_TYPE, tr as procedureAuthKey, u as CATALOG_LANGS, vn as interpolate, vt as addonSettingsCapability, xi as ReadinessRegistry, ya as scopeKey, zn as looseSchema } from "./dist-DygMs3Qc.mjs";
+import { d as JWT_SIGNING_KEY_REF, f as JwtSigningKeyUnavailableError, g as processJwtSigningKey, i as generateDeviceCa, l as verifyDeviceLeaf, m as getProcessJwtSigningKeyState, n as DEVICE_CA_KEY_REF, o as issueDeviceLeaf, p as SYSTEM_SECRET_OWNER, s as loadDeviceCa, u as verifyDeviceSignature, v as staticJwtSigningKey } from "./device-ca-DiV5xcMz.mjs";
 import { t as require_read_all_rows } from "./read-all-rows-TaPqdWNF.mjs";
 import { AlertCenterAddon } from "./builtins/alerts/alerts.addon.mjs";
 import "./builtins/alerts/index.mjs";
@@ -25,21 +25,21 @@ import { LokiDestination, LokiLoggingAddon } from "./builtins/loki-logging/index
 import NativeMetricsAddon, { a as NativeMetricsProvider, n as nodeProcReader, r as parseProcStat } from "./builtins/native-metrics/native-metrics.addon.mjs";
 import { DeviceHistoryAddon } from "./builtins/device-history/device-history.addon.mjs";
 import { FilesystemStorageAddon, t as FilesystemStorageProvider } from "./builtins/sqlite-storage/filesystem-storage.addon.mjs";
-import { C as RecordsEngine, l as SqliteSettingsBackend } from "./wal-maintenance-BuB731DK.mjs";
+import { C as RecordsEngine, l as SqliteSettingsBackend } from "./wal-maintenance-rLv4uOmp.mjs";
 import { SqliteSettingsAddon } from "./builtins/sqlite-storage/sqlite-settings.addon.mjs";
 import { ConfigStore, DeviceStore } from "./builtins/sqlite-storage/index.mjs";
 import { StorageOrchestratorAddon, a as stripForwardedCaller, i as createHubCapForwardService, l as STORAGE_DRAIN_STATE_LEGACY, n as HUB_CAP_FWD_ACTION, o as buildStorageLocationRegistry, r as HUB_CAP_FWD_SERVICE, t as StorageOrchestratorService, u as storageOrchestratorRecordKinds } from "./builtins/storage-orchestrator/storage-orchestrator.addon.mjs";
 import "./builtins/storage-orchestrator/index.mjs";
-import { A as buildNameConstraintSet, B as setProcessAgentHttpsNames, C as LEAF_RENEWAL_WINDOW_DAYS, E as evaluateExistingCert, F as readNameConstraints, I as AGENT_HTTPS_NAMES_COLLECTION, L as AGENT_HTTPS_NAMES_COLUMNS, M as isLocalOnlyHostname, N as permitsIdentity, O as PERMITTED_DNS_SUFFIXES, P as permitsName, R as AgentHttpsNames, S as CA_VALIDITY_DAYS, T as SERVER_AUTH_OID, a as collectAgentNames, b as collectCertIdentity, c as installAgentHttps, d as issueAgentHttpsLeaf, f as loadAgentHttps, h as CA_COMMON_NAME, i as certificateNames, j as isConstrainedCa, k as PERMITTED_IP_RANGES, l as isContainerBridgeAddress, m as pinnedHttpsCaFingerprint, n as acceptAgentSans, o as createAgentHttpsRequest, p as pemDigest, r as agentHttpsPaths, s as describeHttpsLeaf, t as AgentHttpsInstallError, u as isPrivateAddress, w as MAX_LEAF_VALIDITY_DAYS, x as systemHostFacts, y as localCaCommonName, z as getProcessAgentHttpsNames } from "./agent-https-DOwn4pqL.mjs";
-import { a as MESH_CA_KEY_REF, i as MESH_CA_FIELD, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY } from "./constants-p5mPM1iL.mjs";
+import { A as buildNameConstraintSet, B as setProcessAgentHttpsNames, C as LEAF_RENEWAL_WINDOW_DAYS, E as evaluateExistingCert, F as readNameConstraints, I as AGENT_HTTPS_NAMES_COLLECTION, L as AGENT_HTTPS_NAMES_COLUMNS, M as isLocalOnlyHostname, N as permitsIdentity, O as PERMITTED_DNS_SUFFIXES, P as permitsName, R as AgentHttpsNames, S as CA_VALIDITY_DAYS, T as SERVER_AUTH_OID, a as collectAgentNames, b as collectCertIdentity, c as installAgentHttps, d as issueAgentHttpsLeaf, f as loadAgentHttps, h as CA_COMMON_NAME, i as certificateNames, j as isConstrainedCa, k as PERMITTED_IP_RANGES, l as isContainerBridgeAddress, m as pinnedHttpsCaFingerprint, n as acceptAgentSans, o as createAgentHttpsRequest, p as pemDigest, r as agentHttpsPaths, s as describeHttpsLeaf, t as AgentHttpsInstallError, u as isPrivateAddress, w as MAX_LEAF_VALIDITY_DAYS, x as systemHostFacts, y as localCaCommonName, z as getProcessAgentHttpsNames } from "./agent-https-wA8gGLc1.mjs";
+import { a as MESH_CA_KEY_REF, i as MESH_CA_FIELD, n as DEFAULT_HUB_TLS_TCP_PORT, o as MESH_CA_SETTINGS_KEY } from "./constants-DZJAkne8.mjs";
 import { $ as generateMeshKeyPair, A as setProcessMeshPeerTransportLookup, B as describeMeshLeaf, C as setProcessMeshTlsEnabler, D as getProcessPeerLeaf, E as getProcessNodeMeshTransport, F as setProcessMeshTlsListenerState, G as MeshCaKeeper, H as setProcessMeshCertificateRegistry, I as MESH_NODE_CERTIFICATES_COLLECTION, J as caFingerprint, K as getProcessMeshCaState, L as MESH_NODE_CERTIFICATES_COLUMNS, M as revokeMeshCertificate, N as getProcessMeshTlsListenerState, O as isProcessVerifiedMeshPeer, P as openMeshTlsWhenRevocationsLoaded, Q as generateMeshCa, R as MeshCertificateRegistry, S as ServiceBroker, SystemConfigAddon, T as emitProcessNodeRegistered, U as MeshCrl, V as getProcessMeshCertificateRegistry, W as processMeshCrl, X as createMeshCsrPem, Y as caFingerprintCompact, Z as exportMeshPrivateKeyPem, _ as signPairingProof, _t as readCidrSetting, a as hubHostFromMeshAddress, at as AGENT_UI_UNLOCK_TTL_MS, b as TlsTcpTransporter, c as PAIRING_MAX_SESSIONS, ct as AGENT_UI_UNLOCK_VERSION, d as PAIRING_PROTOCOL, dt as mintAgentUiUnlockTicket, et as isValidAgentNodeId, f as PAIRING_TTL_MS, ft as parseAgentDashboardOrigins, g as keyFingerprintShort, gt as parseCidrList, h as describeCsr, ht as normalizeIp, i as AgentPairing, it as AGENT_DASHBOARD_ORIGINS_FIELD, j as renewMeshCertificate, k as onProcessNodeRegistered, l as PAIRING_PATHS, lt as UnlockTicketJtiStore, m as computePairingSas, mt as createCidrMatcher, n as HubPairing, nt as issueMeshLeafFromCsr, o as PAIRING_CODE_DIGITS, ot as AGENT_UI_UNLOCK_TYP, p as computePairingCommitment, pt as verifyAgentUiUnlockTicket, q as requireProcessMeshCa, r as PairingHttpError, rt as loadMeshCa, s as PAIRING_MAX_CODE_ATTEMPTS, st as AGENT_UI_UNLOCK_USE, tt as issueMeshLeafForNode, u as PAIRING_PIN_DIGITS, ut as isAllowedAgentDashboardReturnTo, v as verifyPairingProof, w as dropProcessPeer, x as Errors, y as MESH_TLS_PORT_HELLO_FIELD, z as RENEWAL_ABANDONED } from "./builtins/system-config/system-config.addon.mjs";
 import "./builtins/system-config/index.mjs";
 import { WinstonDestination, WinstonLoggingAddon } from "./builtins/winston-logging/index.mjs";
 import { C as isModelDownloaded, T as revisionWeightUrl, _ as downloadFile, a as startEventLoopStallMonitor, b as fetchJson, c as createAuthenticatedFileServer, d as resolveFilePath, f as ModelDownloadService, g as deleteModelFromDisk, h as collectModelFiles, i as attributeStall, l as parseRangeHeader, m as adoptModelRevisions, n as STALL_REPORT_MS, o as createFileDataPlaneHandler, r as STALL_TICK_MS, s as contentTypeFor, t as CustomActionRegistry, u as parseTokenizedUrl, v as downloadModel, w as resolveFormatRevision, x as getModelFilePath, y as ensureModel } from "./custom-action-registry-DZSCLBuT.mjs";
-import { A as allFamiliesListenHost, C as caReplacementMarkerFile, D as replaceUnconstrainedLocalCa, E as reissueTlsLeaf, F as registerLanHttpHandler, M as bindPendingLanHttp, N as closeLanHttp, O as retirePreviousLocalCa, P as readLanHttpState, S as validateUploadedTls, T as loadTlsCert, _ as splitPemCertificates, a as storeUploadedCertificate, b as chainsToPublicRoot, c as leafFingerprintOf, d as servedHttpsLeafFingerprint, f as prepareBootTls, g as readTlsMode, h as readTlsAccessStatus, i as revertToGeneratedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, l as registerHttpsListener, m as readExtraSans, n as applyCertificateToListener, o as useStoredUploadedCertificate, p as UPLOADED_CA_FILE, r as regenerateCertificate, s as clearHttpsListener, t as createCiaoPublisher, u as reloadHttpsListener, v as writeExtraSans, w as ensureTlsCert, x as checkUploadedCa, y as writeTlsMode } from "./hub-mdns-ciao-BemeCNGe.mjs";
+import { A as allFamiliesListenHost, C as caReplacementMarkerFile, D as replaceUnconstrainedLocalCa, E as reissueTlsLeaf, F as registerLanHttpHandler, M as bindPendingLanHttp, N as closeLanHttp, O as retirePreviousLocalCa, P as readLanHttpState, S as validateUploadedTls, T as loadTlsCert, _ as splitPemCertificates, a as storeUploadedCertificate, b as chainsToPublicRoot, c as leafFingerprintOf, d as servedHttpsLeafFingerprint, f as prepareBootTls, g as readTlsMode, h as readTlsAccessStatus, i as revertToGeneratedCertificate, j as applyLanHttp, k as DEFAULT_LAN_HTTP_PORT, l as registerHttpsListener, m as readExtraSans, n as applyCertificateToListener, o as useStoredUploadedCertificate, p as UPLOADED_CA_FILE, r as regenerateCertificate, s as clearHttpsListener, t as createCiaoPublisher, u as reloadHttpsListener, v as writeExtraSans, w as ensureTlsCert, x as checkUploadedCa, y as writeTlsMode } from "./hub-mdns-ciao-Bc9PnWu3.mjs";
 import { n as getPlatformKeychainKey, r as setPlatformKeychainKey, t as clearPlatformKeychainKey } from "./platform-key-source-BWlq0jjn.mjs";
 import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-Di9daRwI.mjs";
-import { _ as backupRecordStoresOf, c as BackupDecryptError, f as generateBackupKeyPair, g as backupOrchestratorRecordKinds, h as readBackupEncryptionHeader, l as BackupKeyFormatError, r as prepareRestoreArchive, s as SystemBackupService, t as BackupKeyRequiredError, u as BackupKeyMismatchError } from "./restore-archive-C0aohmAK.mjs";
+import { _ as backupRecordStoresOf, c as BackupDecryptError, f as generateBackupKeyPair, g as backupOrchestratorRecordKinds, h as readBackupEncryptionHeader, l as BackupKeyFormatError, r as prepareRestoreArchive, s as SystemBackupService, t as BackupKeyRequiredError, u as BackupKeyMismatchError } from "./restore-archive-D_Pwryre.mjs";
 import { r as nodeCoralFs, t as classifyCoralAccelerator } from "./coral-accelerators-DBlgWB8k.mjs";
 import { z } from "zod";
 import * as crypto$1 from "node:crypto";
@@ -27183,6 +27183,9 @@ var en_default = {
 	"auth.access-denied": "Access denied",
 	"auth.totp-confirm-failed": "TOTP confirmation failed — code did not match",
 	"auth.person-scopes-refused": "A person is an admin, with no scope rows, or holds exactly one viewer grant",
+	"auth.tokens-unavailable": "Tokens are not available yet",
+	"auth.token-label-required": "A token needs a name",
+	"auth.token-expiry-past": "A token must expire in the future",
 	"device.certificates-unavailable": "Device certificates are not available",
 	"device.not-found": "Device {id} not found",
 	"device.credentials-unavailable": "Device credentials not available",
@@ -27435,6 +27438,9 @@ var it_default = {
 	"auth.access-denied": "Accesso negato",
 	"auth.totp-confirm-failed": "Conferma TOTP non riuscita — il codice non corrisponde",
 	"auth.person-scopes-refused": "Una persona è amministratore, senza righe di permesso, oppure ha esattamente un permesso visualizzatore",
+	"auth.tokens-unavailable": "I token non sono ancora disponibili",
+	"auth.token-label-required": "Un token ha bisogno di un nome",
+	"auth.token-expiry-past": "Un token deve scadere nel futuro",
 	"device.certificates-unavailable": "I certificati dei dispositivi non sono disponibili",
 	"device.not-found": "Dispositivo {id} non trovato",
 	"device.credentials-unavailable": "Le credenziali del dispositivo non sono disponibili",

package/dist/{lib-8oZrELLm.js → lib-C3U1yluo.js}

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_x509_es = require("./x509.es-C4cOo48M.js");
+const require_x509_es = require("./x509.es-WtnRNyYS.js");
 const require_src$1 = require("./src-CnAqG6EF.js");
 //#region ../../node_modules/source-map/lib/base64.js
 var require_base64 = /* @__PURE__ */ require_chunk.__commonJSMin(((exports) => {

package/dist/{lib-DK38ompL.mjs → lib-DFZblCIu.mjs}

@@ -1,5 +1,5 @@
 import { a as __toCommonJS, i as __require, n as __esmMin, r as __exportAll, t as __commonJSMin } from "./chunk-CNf5ZN-e.mjs";
-import { b as tslib_es6_exports, y as init_tslib_es6 } from "./x509.es-DK__ETIe.mjs";
+import { b as tslib_es6_exports, y as init_tslib_es6 } from "./x509.es-BRiJgOvu.mjs";
 import { t as require_src } from "./src-hG4grMU4.mjs";
 //#region ../../node_modules/source-map/lib/base64.js
 var require_base64 = /* @__PURE__ */ __commonJSMin(((exports) => {

package/dist/{restore-archive-C0aohmAK.mjs → restore-archive-D_Pwryre.mjs}

@@ -1,4 +1,4 @@
-import { M as DataStoreDatabaseSchema, qi as defineRecordKinds, x as DATABASE_SNAPSHOT_SUFFIX } from "./dist-C9lbdBL5.mjs";
+import { M as DataStoreDatabaseSchema, qi as defineRecordKinds, x as DATABASE_SNAPSHOT_SUFFIX } from "./dist-DygMs3Qc.mjs";
 import { z } from "zod";
 import { createCipheriv, createDecipheriv, createHash, createPrivateKey, createPublicKey, diffieHellman, generateKeyPairSync, hkdfSync, randomBytes } from "node:crypto";
 import { Buffer as Buffer$1 } from "buffer";

package/dist/{restore-archive-DbPmyjiM.js → restore-archive-TDkQfmLO.js}

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-Bmah6waF.js");
+const require_dist = require("./dist-BtDdPdZ7.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 let buffer = require("buffer");

package/dist/tls/cert-utc-time.d.ts

@@ -0,0 +1 @@
+export declare function withUtcTimeEncoding<T>(encode: () => T | Promise<T>): Promise<T>;

package/dist/{x509.es-DK__ETIe.mjs → x509.es-BRiJgOvu.mjs}

@@ -12,6 +12,29 @@ var CERT_NOT_BEFORE_BACKDATE_MS = 5 * 6e4;
 function backdatedNotBefore(now) {
 	return /* @__PURE__ */ new Date(now.getTime() - CERT_NOT_BEFORE_BACKDATE_MS);
 }
+//#endregion
+//#region src/tls/cert-utc-time.ts
+var encodingDepth = 0;
+var localSetMilliseconds;
+function setMillisecondsAsUtc(ms) {
+	return this.setUTCMilliseconds(ms);
+}
+async function withUtcTimeEncoding(encode) {
+	if (encodingDepth === 0) {
+		localSetMilliseconds = Date.prototype.setMilliseconds;
+		Date.prototype.setMilliseconds = setMillisecondsAsUtc;
+	}
+	encodingDepth += 1;
+	try {
+		return await encode();
+	} finally {
+		encodingDepth -= 1;
+		if (encodingDepth === 0 && localSetMilliseconds !== void 0) {
+			Date.prototype.setMilliseconds = localSetMilliseconds;
+			localSetMilliseconds = void 0;
+		}
+	}
+}
 /*! *****************************************************************************
 Copyright (C) Microsoft. All rights reserved.
 Licensed under the Apache License, Version 2.0 (the "License"); you may not use
@@ -11913,4 +11936,4 @@ AsnEcSignatureFormatter.namedCurveSize.set("K-256", 32);
 AsnEcSignatureFormatter.namedCurveSize.set("P-384", 48);
 AsnEcSignatureFormatter.namedCurveSize.set("P-521", 66);
 //#endregion
-export { backdatedNotBefore as S, NameConstraints as _, KeyUsageFlags as a, tslib_es6_exports as b, Pkcs10CertificateRequest as c, SubjectKeyIdentifierExtension as d, X509Certificate as f, GeneralSubtrees as g, GeneralSubtree as h, Extension as i, Pkcs10CertificateRequestGenerator as l, cryptoProvider as m, BasicConstraintsExtension as n, KeyUsagesExtension as o, X509CertificateGenerator as p, ExtendedKeyUsageExtension as r, PemConverter as s, AuthorityKeyIdentifierExtension as t, SubjectAlternativeNameExtension as u, GeneralName$1 as v, AsnConvert as x, init_tslib_es6 as y };
+export { backdatedNotBefore as C, withUtcTimeEncoding as S, NameConstraints as _, KeyUsageFlags as a, tslib_es6_exports as b, Pkcs10CertificateRequest as c, SubjectKeyIdentifierExtension as d, X509Certificate as f, GeneralSubtrees as g, GeneralSubtree as h, Extension as i, Pkcs10CertificateRequestGenerator as l, cryptoProvider as m, BasicConstraintsExtension as n, KeyUsagesExtension as o, X509CertificateGenerator as p, ExtendedKeyUsageExtension as r, PemConverter as s, AuthorityKeyIdentifierExtension as t, SubjectAlternativeNameExtension as u, GeneralName$1 as v, AsnConvert as x, init_tslib_es6 as y };

package/dist/{x509.es-C4cOo48M.js → x509.es-WtnRNyYS.js}

@@ -12,6 +12,29 @@ var CERT_NOT_BEFORE_BACKDATE_MS = 5 * 6e4;
 function backdatedNotBefore(now) {
 	return /* @__PURE__ */ new Date(now.getTime() - CERT_NOT_BEFORE_BACKDATE_MS);
 }
+//#endregion
+//#region src/tls/cert-utc-time.ts
+var encodingDepth = 0;
+var localSetMilliseconds;
+function setMillisecondsAsUtc(ms) {
+	return this.setUTCMilliseconds(ms);
+}
+async function withUtcTimeEncoding(encode) {
+	if (encodingDepth === 0) {
+		localSetMilliseconds = Date.prototype.setMilliseconds;
+		Date.prototype.setMilliseconds = setMillisecondsAsUtc;
+	}
+	encodingDepth += 1;
+	try {
+		return await encode();
+	} finally {
+		encodingDepth -= 1;
+		if (encodingDepth === 0 && localSetMilliseconds !== void 0) {
+			Date.prototype.setMilliseconds = localSetMilliseconds;
+			localSetMilliseconds = void 0;
+		}
+	}
+}
 /*! *****************************************************************************
 Copyright (C) Microsoft. All rights reserved.
 Licensed under the Apache License, Version 2.0 (the "License"); you may not use
@@ -12045,3 +12068,9 @@ Object.defineProperty(exports, "tslib_es6_exports", {
 		return tslib_es6_exports;
 	}
 });
+Object.defineProperty(exports, "withUtcTimeEncoding", {
+	enumerable: true,
+	get: function() {
+		return withUtcTimeEncoding;
+	}
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/system",
-  "version": "1.2.473",
+  "version": "1.2.475",
   "description": "Core addon for CamStack — builtins, pipeline, process management, auth, logging, events",
   "keywords": [
     "camstack",