@attraccess/plugin-shelly 0.1.0-alpha.0

package/dist/index.js

@@ -0,0 +1,952 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var __decorateClass = (decorators, target, key, kind) => {
+  var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc(target, key) : target;
+  for (var i = decorators.length - 1, decorator; i >= 0; i--)
+    if (decorator = decorators[i])
+      result = (kind ? decorator(target, key, result) : decorator(result)) || result;
+  if (kind && result) __defProp(target, key, result);
+  return result;
+};
+var __decorateParam = (index, decorator) => (target, key) => decorator(target, key, index);
+var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
+
+// backend/plugin.ts
+var plugin_exports = {};
+__export(plugin_exports, {
+  default: () => plugin_default
+});
+module.exports = __toCommonJS(plugin_exports);
+
+// backend/device-registry.service.ts
+var import_common = require("@nestjs/common");
+
+// backend/shelly-device.entity.ts
+var import_plugins_backend_sdk = require("@attraccess/plugins-backend-sdk");
+var ShellyDevice = class {
+  constructor() {
+    __publicField(this, "id");
+    __publicField(this, "name");
+    __publicField(this, "ipAddress");
+    __publicField(this, "generation");
+    __publicField(this, "model");
+    __publicField(this, "authState");
+    __publicField(this, "lastProbeAt");
+    __publicField(this, "lastProbeError");
+    __publicField(this, "createdAt");
+    __publicField(this, "updatedAt");
+  }
+};
+__decorateClass([
+  (0, import_plugins_backend_sdk.PrimaryGeneratedColumn)({ type: "integer" })
+], ShellyDevice.prototype, "id", 2);
+__decorateClass([
+  (0, import_plugins_backend_sdk.Column)({ type: "varchar" })
+], ShellyDevice.prototype, "name", 2);
+__decorateClass([
+  (0, import_plugins_backend_sdk.Column)({ type: "varchar", name: "ip_address", unique: true })
+], ShellyDevice.prototype, "ipAddress", 2);
+__decorateClass([
+  (0, import_plugins_backend_sdk.Column)({ type: "integer", nullable: true })
+], ShellyDevice.prototype, "generation", 2);
+__decorateClass([
+  (0, import_plugins_backend_sdk.Column)({ type: "varchar", nullable: true })
+], ShellyDevice.prototype, "model", 2);
+__decorateClass([
+  (0, import_plugins_backend_sdk.Column)({ type: "varchar", name: "auth_state", default: "unknown" })
+], ShellyDevice.prototype, "authState", 2);
+__decorateClass([
+  (0, import_plugins_backend_sdk.Column)({ type: "varchar", name: "last_probe_at", nullable: true })
+], ShellyDevice.prototype, "lastProbeAt", 2);
+__decorateClass([
+  (0, import_plugins_backend_sdk.Column)({ type: "varchar", name: "last_probe_error", nullable: true })
+], ShellyDevice.prototype, "lastProbeError", 2);
+__decorateClass([
+  (0, import_plugins_backend_sdk.Column)({ type: "varchar", name: "created_at" })
+], ShellyDevice.prototype, "createdAt", 2);
+__decorateClass([
+  (0, import_plugins_backend_sdk.Column)({ type: "varchar", name: "updated_at" })
+], ShellyDevice.prototype, "updatedAt", 2);
+ShellyDevice = __decorateClass([
+  (0, import_plugins_backend_sdk.Entity)({ name: "plugin_shelly_devices" })
+], ShellyDevice);
+
+// backend/device-registry.service.ts
+var PLUGIN_CONTEXT = /* @__PURE__ */ Symbol.for("attraccess.plugin.context");
+var DeviceRegistryService = class {
+  constructor(context) {
+    __publicField(this, "context", context);
+    __publicField(this, "repository", null);
+  }
+  // Resolve the repository lazily, not in the constructor: plugin providers are
+  // instantiated during the host's DI pass, before the host DataSource ref is
+  // wired up (PluginContext.getRepository throws "Host DataSource is not
+  // available yet" until bootstrap completes). The first query happens on an
+  // HTTP request, well after bootstrap, so resolving on demand is safe; cache it
+  // once resolved.
+  get devices() {
+    if (this.repository === null) {
+      this.repository = this.context.getRepository(ShellyDevice);
+    }
+    return this.repository;
+  }
+  list() {
+    return this.devices.find({ order: { createdAt: "ASC", id: "ASC" } });
+  }
+  findById(id) {
+    return this.devices.findOne({ where: { id } });
+  }
+  findByIp(ipAddress) {
+    return this.devices.findOne({ where: { ipAddress } });
+  }
+  create(input) {
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const device = this.devices.create({
+      name: input.name,
+      ipAddress: input.ipAddress,
+      generation: input.generation,
+      model: input.model,
+      authState: input.authState,
+      lastProbeAt: input.lastProbeAt,
+      lastProbeError: input.lastProbeError,
+      createdAt: now,
+      updatedAt: now
+    });
+    return this.devices.save(device);
+  }
+  async updateProbe(id, patch) {
+    await this.devices.update(id, {
+      generation: patch.generation,
+      model: patch.model,
+      authState: patch.authState,
+      lastProbeAt: patch.lastProbeAt,
+      lastProbeError: patch.lastProbeError,
+      updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+    });
+  }
+  async updateAuthState(id, authState) {
+    await this.devices.update(id, {
+      authState,
+      updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+    });
+  }
+  async delete(id) {
+    await this.devices.delete(id);
+  }
+};
+DeviceRegistryService = __decorateClass([
+  (0, import_common.Injectable)(),
+  __decorateParam(0, (0, import_common.Inject)(PLUGIN_CONTEXT))
+], DeviceRegistryService);
+
+// backend/discovery.service.ts
+var import_common3 = require("@nestjs/common");
+
+// backend/mdns-discovery.ts
+var import_node_dgram = require("node:dgram");
+var MDNS_ADDRESS = "224.0.0.251";
+var MDNS_PORT = 5353;
+var SERVICE = "_shelly._tcp.local";
+var DEFAULT_TIMEOUT_MS = 2e3;
+var TYPE_PTR = 12;
+var TYPE_A = 1;
+var QCLASS_IN_UNICAST = 32769;
+function buildQuery() {
+  const labels = SERVICE.split(".");
+  const nameLength = labels.reduce((total, label) => total + 1 + label.length, 0) + 1;
+  const packet = Buffer.alloc(12 + nameLength + 4);
+  packet.writeUInt16BE(1, 4);
+  let offset = 12;
+  for (const label of labels) {
+    packet.writeUInt8(label.length, offset);
+    offset += 1;
+    offset += packet.write(label, offset, "ascii");
+  }
+  packet.writeUInt8(0, offset);
+  offset += 1;
+  packet.writeUInt16BE(TYPE_PTR, offset);
+  packet.writeUInt16BE(QCLASS_IN_UNICAST, offset + 2);
+  return packet;
+}
+function skipName(packet, start) {
+  let offset = start;
+  while (offset < packet.length) {
+    const length = packet[offset];
+    if (length === 0) return offset + 1;
+    if ((length & 192) === 192) return offset + 2;
+    offset += length + 1;
+  }
+  return packet.length;
+}
+function parseShellyAddresses(packet) {
+  if (!packet.toString("latin1").includes("_shelly")) return [];
+  if (packet.length < 12) return [];
+  const counts = [4, 6, 8, 10].map((at) => packet.readUInt16BE(at));
+  const [questions, answers, authorities, additionals] = counts;
+  let offset = 12;
+  for (let i = 0; i < questions; i++) {
+    offset = skipName(packet, offset) + 4;
+  }
+  const addresses = [];
+  const records = answers + authorities + additionals;
+  for (let i = 0; i < records && offset + 10 <= packet.length; i++) {
+    offset = skipName(packet, offset);
+    if (offset + 10 > packet.length) break;
+    const type = packet.readUInt16BE(offset);
+    const rdLength = packet.readUInt16BE(offset + 8);
+    offset += 10;
+    if (offset + rdLength > packet.length) break;
+    if (type === TYPE_A && rdLength === 4) {
+      addresses.push([packet[offset], packet[offset + 1], packet[offset + 2], packet[offset + 3]].join("."));
+    }
+    offset += rdLength;
+  }
+  return [...new Set(addresses)];
+}
+function discoverViaMdns(timeoutMs = DEFAULT_TIMEOUT_MS) {
+  return new Promise((resolve) => {
+    const found = /* @__PURE__ */ new Set();
+    let socket;
+    try {
+      socket = (0, import_node_dgram.createSocket)({ type: "udp4", reuseAddr: true });
+    } catch {
+      resolve([]);
+      return;
+    }
+    let settled = false;
+    const finish = () => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      try {
+        socket.close();
+      } catch {
+      }
+      resolve([...found]);
+    };
+    const timer = setTimeout(finish, timeoutMs);
+    timer.unref?.();
+    socket.on("error", finish);
+    socket.on("message", (message) => {
+      for (const address of parseShellyAddresses(message)) found.add(address);
+    });
+    socket.on("listening", () => {
+      try {
+        socket.setMulticastTTL(255);
+        socket.send(buildQuery(), MDNS_PORT, MDNS_ADDRESS);
+      } catch {
+        finish();
+      }
+    });
+    try {
+      socket.bind(0);
+    } catch {
+      finish();
+    }
+  });
+}
+
+// backend/network-scan.ts
+var import_node_os = require("node:os");
+var MIN_PREFIX_LENGTH = 22;
+var InvalidCidrError = class extends Error {
+};
+var CIDR_PATTERN = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})\/(\d{1,2})$/;
+function toInt(octets) {
+  return (octets[0] << 24 | octets[1] << 16 | octets[2] << 8 | octets[3]) >>> 0;
+}
+function toIp(value) {
+  return [value >>> 24 & 255, value >>> 16 & 255, value >>> 8 & 255, value & 255].join(".");
+}
+function isPrivateIpv4(ip) {
+  const parts = ip.split(".").map(Number);
+  if (parts.length !== 4 || parts.some((p) => !Number.isInteger(p) || p < 0 || p > 255)) return false;
+  const [a, b] = parts;
+  if (a === 10) return true;
+  if (a === 172 && b >= 16 && b <= 31) return true;
+  if (a === 192 && b === 168) return true;
+  if (a === 169 && b === 254) return true;
+  return false;
+}
+function expandCidr(cidr) {
+  const match = CIDR_PATTERN.exec(cidr.trim());
+  if (!match) {
+    throw new InvalidCidrError(`"${cidr}" is not a valid IPv4 CIDR (expected e.g. 192.168.1.0/24)`);
+  }
+  const octets = match.slice(1, 5).map(Number);
+  const prefix = Number(match[5]);
+  if (octets.some((o) => o > 255) || prefix > 32) {
+    throw new InvalidCidrError(`"${cidr}" is not a valid IPv4 CIDR (expected e.g. 192.168.1.0/24)`);
+  }
+  if (prefix < MIN_PREFIX_LENGTH) {
+    throw new InvalidCidrError(
+      `subnet ${cidr} is too large to scan \u2014 use a prefix of /${MIN_PREFIX_LENGTH} or longer (e.g. /24)`
+    );
+  }
+  const address = toInt(octets);
+  const mask = prefix === 0 ? 0 : 4294967295 << 32 - prefix >>> 0;
+  const network = (address & mask) >>> 0;
+  const broadcast = (network | ~mask >>> 0) >>> 0;
+  if (!isPrivateIpv4(toIp(network))) {
+    throw new InvalidCidrError(
+      `refusing to scan ${cidr}: only private networks (10/8, 172.16/12, 192.168/16, 169.254/16) may be scanned`
+    );
+  }
+  const first = prefix >= 31 ? network : network + 1;
+  const last = prefix >= 31 ? broadcast : broadcast - 1;
+  const hosts = [];
+  for (let value = first; value <= last; value++) {
+    hosts.push(toIp(value));
+  }
+  return hosts;
+}
+function localScanTargets() {
+  const targets = /* @__PURE__ */ new Set();
+  for (const addresses of Object.values((0, import_node_os.networkInterfaces)())) {
+    for (const address of addresses ?? []) {
+      const isIpv4 = address.family === "IPv4" || address.family === 4;
+      if (!isIpv4 || address.internal || !address.cidr) continue;
+      const prefix = Number(address.cidr.split("/")[1]);
+      if (!Number.isInteger(prefix) || prefix < MIN_PREFIX_LENGTH) continue;
+      if (!isPrivateIpv4(address.address)) continue;
+      targets.add(address.cidr);
+    }
+  }
+  return [...targets];
+}
+
+// backend/shelly-probe.service.ts
+var import_common2 = require("@nestjs/common");
+var PROBE_TIMEOUT_MS = 5e3;
+var SCAN_PROBE_TIMEOUT_MS = 1e3;
+var ShellyProbeService = class {
+  /**
+   * Probes `http://<ipAddress>/shelly` and interprets the response. Throws an
+   * Error with a human-readable message if the device is unreachable or returns
+   * a non-OK / non-JSON response.
+   */
+  async probe(ipAddress, timeoutMs = PROBE_TIMEOUT_MS) {
+    const url = `http://${ipAddress}/shelly`;
+    let json;
+    try {
+      const res = await fetch(url, {
+        signal: AbortSignal.timeout(timeoutMs),
+        headers: { Accept: "application/json" }
+      });
+      if (!res.ok) {
+        throw new Error(`device responded HTTP ${res.status}`);
+      }
+      json = await res.json();
+    } catch (err) {
+      const reason = err instanceof Error ? err.message : String(err);
+      throw new Error(`probe of ${url} failed: ${reason}`);
+    }
+    return this.interpret(json);
+  }
+  interpret(json) {
+    if (typeof json.gen === "number") {
+      const authState2 = json.auth_en === true ? "required" : "none";
+      return { generation: json.gen, model: json.model ?? null, authState: authState2, raw: json };
+    }
+    const authState = json.auth === true ? "required" : "none";
+    return { generation: 1, model: json.type ?? null, authState, raw: json };
+  }
+};
+ShellyProbeService = __decorateClass([
+  (0, import_common2.Injectable)()
+], ShellyProbeService);
+
+// backend/discovery.service.ts
+var SCAN_CONCURRENCY = 64;
+async function mapWithConcurrency(items, limit, worker) {
+  const results = new Array(items.length);
+  let cursor = 0;
+  const runners = Array.from({ length: Math.min(limit, items.length) }, async () => {
+    while (cursor < items.length) {
+      const index = cursor++;
+      results[index] = await worker(items[index]);
+    }
+  });
+  await Promise.all(runners);
+  return results;
+}
+var DiscoveryService = class {
+  constructor(registry, probe) {
+    __publicField(this, "registry", registry);
+    __publicField(this, "probe", probe);
+  }
+  /**
+   * Discovers devices and writes them to the registry.
+   *
+   * @param cidr Subnet to scan. Omitted, the host's own private networks are
+   *   used — which finds nothing on a Docker bridge network (its /16 is skipped
+   *   as too large), so containerised installs are expected to pass one.
+   */
+  async discover(cidr) {
+    const subnets = cidr ? [cidr] : localScanTargets();
+    const scanTargets = subnets.flatMap((subnet) => expandCidr(subnet));
+    const mdnsAddresses = (await discoverViaMdns()).filter(isPrivateIpv4);
+    const seen = new Set(mdnsAddresses);
+    const candidates = mdnsAddresses.map((ipAddress) => ({
+      ipAddress,
+      source: "mdns"
+    }));
+    for (const ipAddress of scanTargets) {
+      if (seen.has(ipAddress)) continue;
+      seen.add(ipAddress);
+      candidates.push({ ipAddress, source: "scan" });
+    }
+    const hits = (await mapWithConcurrency(candidates, SCAN_CONCURRENCY, async (candidate) => {
+      try {
+        const result = await this.probe.probe(candidate.ipAddress, SCAN_PROBE_TIMEOUT_MS);
+        return { ...candidate, result };
+      } catch {
+        return null;
+      }
+    })).filter((hit) => hit !== null);
+    const devices = [];
+    for (const hit of hits) {
+      devices.push(await this.persist(hit.ipAddress, hit.source, hit.result));
+    }
+    return { subnets, probed: candidates.length, devices };
+  }
+  async persist(ipAddress, source, result) {
+    const probeFields = {
+      generation: result.generation,
+      model: result.model,
+      authState: result.authState,
+      lastProbeAt: (/* @__PURE__ */ new Date()).toISOString(),
+      lastProbeError: null
+    };
+    const existing = await this.registry.findByIp(ipAddress);
+    if (existing) {
+      await this.registry.updateProbe(existing.id, probeFields);
+      return { deviceId: existing.id, ipAddress, name: existing.name, ...result, isNew: false, source };
+    }
+    const name = result.model ? `${result.model} (${ipAddress})` : ipAddress;
+    const created = await this.registry.create({ name, ipAddress, ...probeFields });
+    return { deviceId: created.id, ipAddress, name, ...result, isNew: true, source };
+  }
+};
+DiscoveryService = __decorateClass([
+  (0, import_common3.Injectable)(),
+  __decorateParam(0, (0, import_common3.Inject)(DeviceRegistryService)),
+  __decorateParam(1, (0, import_common3.Inject)(ShellyProbeService))
+], DiscoveryService);
+
+// backend/shelly.controller.ts
+var import_common7 = require("@nestjs/common");
+var import_plugins_backend_sdk2 = require("@attraccess/plugins-backend-sdk");
+
+// backend/shelly-device-api.service.ts
+var import_common5 = require("@nestjs/common");
+
+// backend/shelly-http.client.ts
+var import_crypto = require("crypto");
+var import_common4 = require("@nestjs/common");
+var REQUEST_TIMEOUT_MS = 8e3;
+var ShellyHttpClient = class {
+  getJson(url, credentials) {
+    return this.requestJson(url, { method: "GET", credentials });
+  }
+  postJson(url, body, credentials) {
+    return this.requestJson(url, { method: "POST", body, credentials });
+  }
+  async requestJson(url, options) {
+    const requestOptions = this.buildFetchOptions(options.method, options.body);
+    let response = await fetch(url, requestOptions);
+    if (response.status === 401 && options.credentials.currentPassword) {
+      response = await fetch(url, {
+        ...requestOptions,
+        headers: {
+          ...asHeaderRecord(requestOptions.headers),
+          ...this.buildAuthHeader(response, url, options.method, options.credentials)
+        }
+      });
+    }
+    if (!response.ok) {
+      throw new Error(`Shelly request ${url} failed: HTTP ${response.status}`);
+    }
+    return response.json();
+  }
+  buildFetchOptions(method, body) {
+    const headers = { Accept: "application/json" };
+    if (body !== void 0) {
+      headers["Content-Type"] = "application/json";
+    }
+    return {
+      method,
+      signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+      headers,
+      body: body === void 0 ? void 0 : JSON.stringify(body)
+    };
+  }
+  buildAuthHeader(response, url, method, credentials) {
+    const username = credentials.username?.trim() || "admin";
+    const password = credentials.currentPassword ?? "";
+    const challenge = response.headers.get("www-authenticate") ?? response.headers.get("WWW-Authenticate") ?? "";
+    if (!challenge.toLowerCase().startsWith("digest ")) {
+      return { Authorization: `Basic ${Buffer.from(`${username}:${password}`).toString("base64")}` };
+    }
+    return { Authorization: buildDigestAuthorization(challenge, url, method, username, password) };
+  }
+};
+ShellyHttpClient = __decorateClass([
+  (0, import_common4.Injectable)()
+], ShellyHttpClient);
+function asHeaderRecord(headers) {
+  if (!headers) return {};
+  if (headers instanceof Headers) return Object.fromEntries(headers.entries());
+  if (Array.isArray(headers)) return Object.fromEntries(headers);
+  return headers;
+}
+function buildDigestAuthorization(challenge, url, method, username, password) {
+  const params = parseDigestChallenge(challenge);
+  const algorithm = (params.algorithm ?? "MD5").toUpperCase();
+  const hash = algorithm.includes("SHA-256") ? sha256 : md5;
+  const nonce = params.nonce;
+  const realm = params.realm;
+  if (!nonce || !realm) {
+    return `Basic ${Buffer.from(`${username}:${password}`).toString("base64")}`;
+  }
+  const requestUrl = new URL(url);
+  const uri = `${requestUrl.pathname}${requestUrl.search}`;
+  const qop = params.qop?.split(",").map((value) => value.trim()).includes("auth") ? "auth" : void 0;
+  const nc = "00000001";
+  const cnonce = (0, import_crypto.randomBytes)(8).toString("hex");
+  const ha1 = hash(`${username}:${realm}:${password}`);
+  const ha2 = hash(`${method}:${uri}`);
+  const response = qop ? hash(`${ha1}:${nonce}:${nc}:${cnonce}:${qop}:${ha2}`) : hash(`${ha1}:${nonce}:${ha2}`);
+  const parts = [
+    `username="${username}"`,
+    `realm="${realm}"`,
+    `nonce="${nonce}"`,
+    `uri="${uri}"`,
+    `response="${response}"`,
+    `algorithm=${algorithm}`
+  ];
+  if (params.opaque) parts.push(`opaque="${params.opaque}"`);
+  if (qop) parts.push(`qop=${qop}`, `nc=${nc}`, `cnonce="${cnonce}"`);
+  return `Digest ${parts.join(", ")}`;
+}
+function parseDigestChallenge(challenge) {
+  const digest = challenge.replace(/^Digest\s+/i, "");
+  const params = {};
+  for (const match of digest.matchAll(/([a-zA-Z0-9_-]+)=(?:"([^"]*)"|([^,]*))/g)) {
+    params[match[1].toLowerCase()] = match[2] ?? match[3] ?? "";
+  }
+  return params;
+}
+function md5(value) {
+  return (0, import_crypto.createHash)("md5").update(value).digest("hex");
+}
+function sha256(value) {
+  return (0, import_crypto.createHash)("sha256").update(value).digest("hex");
+}
+
+// backend/shelly-device-api.service.ts
+var ShellyDeviceApiService = class {
+  // esbuild does not emit decorator metadata, so Nest cannot infer constructor
+  // types for injection — always inject by an explicit token.
+  constructor(http) {
+    __publicField(this, "http", http);
+  }
+  async getDeviceInfo(target) {
+    const [status, config] = await Promise.all(
+      target.generation === 1 ? [
+        this.http.getJson(`http://${target.ipAddress}/status`, target),
+        this.http.getJson(`http://${target.ipAddress}/settings`, target)
+      ] : [
+        this.http.getJson(`http://${target.ipAddress}/rpc/Shelly.GetStatus`, target),
+        this.http.getJson(`http://${target.ipAddress}/rpc/Shelly.GetConfig`, target)
+      ]
+    );
+    return { generation: target.generation, status, config, fetchedAt: (/* @__PURE__ */ new Date()).toISOString() };
+  }
+  async setAdminPassword(input) {
+    const username = input.username?.trim() || "admin";
+    if (input.generation === 1) {
+      const url = new URL(`http://${input.ipAddress}/settings/login`);
+      url.searchParams.set("enabled", "1");
+      url.searchParams.set("username", username);
+      url.searchParams.set("password", input.password);
+      await this.http.getJson(url.toString(), input);
+      return;
+    }
+    const info = await this.http.getJson(`http://${input.ipAddress}/shelly`, input);
+    const realm = info.id?.trim();
+    if (!realm) {
+      throw new Error("Shelly.SetAuth requires the device id from GET /shelly");
+    }
+    await this.http.postJson(
+      `http://${input.ipAddress}/rpc/Shelly.SetAuth`,
+      {
+        user: username,
+        realm,
+        ha1: md5(`${username}:${realm}:${input.password}`)
+      },
+      input
+    );
+  }
+};
+ShellyDeviceApiService = __decorateClass([
+  (0, import_common5.Injectable)(),
+  __decorateParam(0, (0, import_common5.Inject)(ShellyHttpClient))
+], ShellyDeviceApiService);
+
+// backend/shelly-firmware.service.ts
+var import_common6 = require("@nestjs/common");
+var ShellyFirmwareService = class {
+  // esbuild does not emit decorator metadata, so Nest cannot infer constructor
+  // types for injection — always inject by an explicit token.
+  constructor(http) {
+    __publicField(this, "http", http);
+  }
+  async getStatus(target) {
+    return target.generation === 1 ? this.getGen1Status(target) : this.getGen2Status(target);
+  }
+  /**
+   * Kicks off the OTA. The device answers before it reboots; from then on it is
+   * unreachable for a while, so callers must poll getStatus() rather than expect
+   * a completion signal here.
+   */
+  async startUpdate(target, stage) {
+    if (target.generation === 1) {
+      const url = new URL(`http://${target.ipAddress}/ota`);
+      url.searchParams.set(stage === "beta" ? "beta" : "update", "true");
+      await this.http.getJson(url.toString(), target);
+      return;
+    }
+    await this.http.postJson(`http://${target.ipAddress}/rpc/Shelly.Update`, { stage }, target);
+  }
+  async getGen1Status(target) {
+    const ota = await this.http.getJson(`http://${target.ipAddress}/ota`, target);
+    const current = ota.old_version ?? null;
+    const stable = ota.has_update && ota.new_version && ota.new_version !== current ? ota.new_version : null;
+    const beta = ota.beta_version && ota.beta_version !== current ? ota.beta_version : null;
+    return {
+      generation: 1,
+      currentVersion: current,
+      available: { stable, beta },
+      hasUpdate: stable !== null,
+      state: toFirmwareState(ota.status),
+      fetchedAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+  }
+  async getGen2Status(target) {
+    const [info, check] = await Promise.all([
+      this.http.getJson(`http://${target.ipAddress}/rpc/Shelly.GetDeviceInfo`, target),
+      this.http.getJson(
+        `http://${target.ipAddress}/rpc/Shelly.CheckForUpdate`,
+        target
+      )
+    ]);
+    const stable = check?.stable?.version ?? null;
+    const beta = check?.beta?.version ?? null;
+    return {
+      generation: target.generation,
+      currentVersion: info?.ver ?? null,
+      available: { stable, beta },
+      hasUpdate: stable !== null,
+      // ponytail: Gen2+ only reports OTA progress over its WebSocket NotifyEvent
+      // channel, not over REST — a device we can reach is by definition not
+      // mid-update, so the UI infers "updating" from the device being offline
+      // right after it triggered one.
+      state: "idle",
+      fetchedAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+  }
+};
+ShellyFirmwareService = __decorateClass([
+  (0, import_common6.Injectable)(),
+  __decorateParam(0, (0, import_common6.Inject)(ShellyHttpClient))
+], ShellyFirmwareService);
+function toFirmwareState(status) {
+  return status === "idle" || status === "pending" || status === "updating" ? status : "unknown";
+}
+
+// backend/shelly.controller.ts
+var ShellyController = class {
+  // esbuild does not emit decorator metadata, so Nest cannot infer constructor
+  // types for injection — always inject by an explicit token.
+  constructor(registry, probe, discovery, deviceApi, firmware) {
+    __publicField(this, "registry", registry);
+    __publicField(this, "probe", probe);
+    __publicField(this, "discovery", discovery);
+    __publicField(this, "deviceApi", deviceApi);
+    __publicField(this, "firmware", firmware);
+  }
+  async discover(body) {
+    const cidr = (body?.cidr ?? "").trim() || void 0;
+    try {
+      return await this.discovery.discover(cidr);
+    } catch (err) {
+      if (err instanceof InvalidCidrError) {
+        throw new import_common7.BadRequestException(err.message);
+      }
+      throw err;
+    }
+  }
+  list() {
+    return this.registry.list();
+  }
+  async add(body) {
+    const ipAddress = (body?.ipAddress ?? "").trim();
+    if (!ipAddress) {
+      throw new import_common7.BadRequestException("ipAddress is required");
+    }
+    if (await this.registry.findByIp(ipAddress)) {
+      throw new import_common7.ConflictException(`a device with IP ${ipAddress} already exists`);
+    }
+    const name = (body?.name ?? "").trim() || ipAddress;
+    const probed = await this.tryProbe(ipAddress);
+    return this.registry.create({
+      name,
+      ipAddress,
+      generation: probed.result?.generation ?? null,
+      model: probed.result?.model ?? null,
+      authState: probed.result?.authState ?? "unknown",
+      lastProbeAt: probed.at,
+      lastProbeError: probed.error
+    });
+  }
+  async firmwareOverview() {
+    const devices = await this.registry.list();
+    return Promise.all(
+      devices.map(async (device) => {
+        if (device.generation === null) {
+          return { deviceId: device.id, status: null, error: "device generation is unknown; probe it first" };
+        }
+        try {
+          const status = await this.firmware.getStatus({
+            ipAddress: device.ipAddress,
+            generation: device.generation
+          });
+          return { deviceId: device.id, status, error: null };
+        } catch (err) {
+          return { deviceId: device.id, status: null, error: err instanceof Error ? err.message : String(err) };
+        }
+      })
+    );
+  }
+  async firmwareStatus(id, query) {
+    const device = await this.requireDeviceWithGeneration(id);
+    return this.firmware.getStatus({
+      ipAddress: device.ipAddress,
+      generation: device.generation,
+      username: query.username,
+      currentPassword: query.currentPassword
+    });
+  }
+  async startFirmwareUpdate(id, body) {
+    const stage = body?.stage ?? "stable";
+    if (stage !== "stable" && stage !== "beta") {
+      throw new import_common7.BadRequestException(`stage must be "stable" or "beta"`);
+    }
+    const device = await this.requireDeviceWithGeneration(id);
+    await this.firmware.startUpdate(
+      {
+        ipAddress: device.ipAddress,
+        generation: device.generation,
+        username: body?.username,
+        currentPassword: body?.currentPassword
+      },
+      stage
+    );
+    return { started: true, stage };
+  }
+  async reprobe(id) {
+    const device = await this.registry.findById(id);
+    if (!device) {
+      throw new import_common7.NotFoundException(`device ${id} not found`);
+    }
+    const probed = await this.tryProbe(device.ipAddress);
+    await this.registry.updateProbe(id, {
+      // On a failed re-probe keep the previously-known values rather than
+      // wiping them; only the error + timestamp are refreshed.
+      generation: probed.result?.generation ?? device.generation,
+      model: probed.result?.model ?? device.model,
+      authState: probed.result?.authState ?? device.authState,
+      lastProbeAt: probed.at,
+      lastProbeError: probed.error
+    });
+    const updated = await this.registry.findById(id);
+    if (!updated) {
+      throw new import_common7.NotFoundException(`device ${id} not found`);
+    }
+    return updated;
+  }
+  async info(id, body) {
+    const device = await this.requireDeviceWithGeneration(id);
+    try {
+      return await this.deviceApi.getDeviceInfo({
+        ipAddress: device.ipAddress,
+        generation: device.generation,
+        username: body?.username,
+        currentPassword: body?.currentPassword
+      });
+    } catch (err) {
+      throw toDeviceCommunicationException(err);
+    }
+  }
+  async setAuth(id, body) {
+    const password = body?.password?.trim();
+    if (!password) {
+      throw new import_common7.BadRequestException("password is required");
+    }
+    const device = await this.requireDeviceWithGeneration(id);
+    try {
+      await this.deviceApi.setAdminPassword({
+        ipAddress: device.ipAddress,
+        generation: device.generation,
+        username: body.username,
+        currentPassword: body.currentPassword,
+        password
+      });
+    } catch (err) {
+      throw toDeviceCommunicationException(err);
+    }
+    await this.registry.updateAuthState(id, "required");
+    const updated = await this.registry.findById(id);
+    if (!updated) {
+      throw new import_common7.NotFoundException(`device ${id} not found`);
+    }
+    return updated;
+  }
+  async remove(id) {
+    if (!await this.registry.findById(id)) {
+      throw new import_common7.NotFoundException(`device ${id} not found`);
+    }
+    await this.registry.delete(id);
+    return { deleted: true };
+  }
+  async requireDeviceWithGeneration(id) {
+    const device = await this.registry.findById(id);
+    if (!device) {
+      throw new import_common7.NotFoundException(`device ${id} not found`);
+    }
+    if (device.generation !== null) {
+      return device;
+    }
+    const probed = await this.tryProbe(device.ipAddress);
+    if (!probed.result) {
+      throw new import_common7.BadRequestException(`device generation is unknown; probe failed: ${probed.error}`);
+    }
+    await this.registry.updateProbe(id, {
+      generation: probed.result.generation,
+      model: probed.result.model,
+      authState: probed.result.authState,
+      lastProbeAt: probed.at,
+      lastProbeError: null
+    });
+    const updated = await this.registry.findById(id);
+    if (!updated?.generation) {
+      throw new import_common7.NotFoundException(`device ${id} not found`);
+    }
+    return updated;
+  }
+  async tryProbe(ipAddress) {
+    const at = (/* @__PURE__ */ new Date()).toISOString();
+    try {
+      return { result: await this.probe.probe(ipAddress), error: null, at };
+    } catch (err) {
+      return { result: null, error: err instanceof Error ? err.message : String(err), at };
+    }
+  }
+};
+__decorateClass([
+  (0, import_common7.Post)("discovery"),
+  __decorateParam(0, (0, import_common7.Body)())
+], ShellyController.prototype, "discover", 1);
+__decorateClass([
+  (0, import_common7.Get)("devices")
+], ShellyController.prototype, "list", 1);
+__decorateClass([
+  (0, import_common7.Post)("devices"),
+  __decorateParam(0, (0, import_common7.Body)())
+], ShellyController.prototype, "add", 1);
+__decorateClass([
+  (0, import_common7.Get)("devices/firmware")
+], ShellyController.prototype, "firmwareOverview", 1);
+__decorateClass([
+  (0, import_common7.Get)("devices/:id/firmware"),
+  __decorateParam(0, (0, import_common7.Param)("id", import_common7.ParseIntPipe)),
+  __decorateParam(1, (0, import_common7.Query)())
+], ShellyController.prototype, "firmwareStatus", 1);
+__decorateClass([
+  (0, import_common7.Post)("devices/:id/firmware/update"),
+  __decorateParam(0, (0, import_common7.Param)("id", import_common7.ParseIntPipe)),
+  __decorateParam(1, (0, import_common7.Body)())
+], ShellyController.prototype, "startFirmwareUpdate", 1);
+__decorateClass([
+  (0, import_common7.Post)("devices/:id/probe"),
+  __decorateParam(0, (0, import_common7.Param)("id", import_common7.ParseIntPipe))
+], ShellyController.prototype, "reprobe", 1);
+__decorateClass([
+  (0, import_common7.Post)("devices/:id/info"),
+  __decorateParam(0, (0, import_common7.Param)("id", import_common7.ParseIntPipe)),
+  __decorateParam(1, (0, import_common7.Body)())
+], ShellyController.prototype, "info", 1);
+__decorateClass([
+  (0, import_common7.Post)("devices/:id/auth"),
+  __decorateParam(0, (0, import_common7.Param)("id", import_common7.ParseIntPipe)),
+  __decorateParam(1, (0, import_common7.Body)())
+], ShellyController.prototype, "setAuth", 1);
+__decorateClass([
+  (0, import_common7.Delete)("devices/:id"),
+  __decorateParam(0, (0, import_common7.Param)("id", import_common7.ParseIntPipe))
+], ShellyController.prototype, "remove", 1);
+ShellyController = __decorateClass([
+  (0, import_plugins_backend_sdk2.Auth)("resources.update"),
+  (0, import_common7.Controller)("shelly"),
+  __decorateParam(0, (0, import_common7.Inject)(DeviceRegistryService)),
+  __decorateParam(1, (0, import_common7.Inject)(ShellyProbeService)),
+  __decorateParam(2, (0, import_common7.Inject)(DiscoveryService)),
+  __decorateParam(3, (0, import_common7.Inject)(ShellyDeviceApiService)),
+  __decorateParam(4, (0, import_common7.Inject)(ShellyFirmwareService))
+], ShellyController);
+function toDeviceCommunicationException(err) {
+  return new import_common7.BadGatewayException(err instanceof Error ? err.message : String(err));
+}
+
+// backend/plugin.ts
+var PLUGIN_CONTEXT2 = /* @__PURE__ */ Symbol.for("attraccess.plugin.context");
+var ShellyPluginModule = class {
+};
+var plugin = {
+  // Host registers these into the shared DataSource at load time (gated on
+  // DATABASE_ACCESS) so the registry service can use a real repository.
+  entities: [ShellyDevice],
+  register(context) {
+    return {
+      module: ShellyPluginModule,
+      controllers: [ShellyController],
+      providers: [
+        { provide: PLUGIN_CONTEXT2, useValue: context },
+        DeviceRegistryService,
+        ShellyProbeService,
+        DiscoveryService,
+        ShellyHttpClient,
+        ShellyDeviceApiService,
+        ShellyFirmwareService
+      ]
+    };
+  }
+};
+var plugin_default = plugin;