@attraccess/plugin-wago 0.1.0-nightly.929.1 → 0.1.0-nightly.935.1

package/dist/index.js

@@ -35,8 +35,8 @@ __export(plugin_exports, {
 module.exports = __toCommonJS(plugin_exports);
 
 // backend/wago.controller.ts
-var import_common2 = require("@nestjs/common");
-var import_plugins_backend_sdk6 = require("@attraccess/plugins-backend-sdk");
+var import_common3 = require("@nestjs/common");
+var import_plugins_backend_sdk8 = require("@attraccess/plugins-backend-sdk");
 
 // backend/wago.service.ts
 var import_node_crypto2 = require("node:crypto");
@@ -277,7 +277,36 @@ var CHANNEL_PROFILES = [
   "generic-digital-output",
   "generic-monitored-input"
 ];
-var CAPABILITIES = ["output", "input", "measurement", "pulse", "guard"];
+var CAPABILITIES = ["output", "input", "measurement", "pulse", "guard", "feedback"];
+var WAGO_PRESETS = [
+  {
+    id: "metered-switched-load",
+    name: "Metered switched load",
+    description: "Switches an output off immediately when disconnected and reports a transformed measurement."
+  },
+  {
+    id: "pulsed-lock-bank",
+    name: "Pulsed lock bank",
+    description: "Pulses an output briefly and returns it to off immediately when disconnected."
+  },
+  {
+    id: "guarded-enable-request",
+    name: "Guarded enable request",
+    description: "Makes a non-safety enable request only while an operational guard is satisfied."
+  },
+  { id: "generic-digital-output", name: "Generic digital output", description: "A conservative output foundation." },
+  { id: "generic-monitored-input", name: "Generic monitored input", description: "A monitored digital input foundation." }
+];
+function applyPreset(snapshot, application) {
+  const preset = application && WAGO_PRESETS.find((item) => item.id === application.presetId);
+  if (!preset) throw new Error("unknown WAGO preset");
+  const channel = presetChannel(application);
+  const existingIndex = snapshot.logicalChannels.findIndex((item) => item.id === application.channelId);
+  const logicalChannels = [...snapshot.logicalChannels];
+  if (existingIndex === -1) logicalChannels.push(channel);
+  else logicalChannels[existingIndex] = channel;
+  return { ...snapshot, logicalChannels };
+}
 function canonicalSnapshot(snapshot) {
   if (!snapshot || typeof snapshot !== "object" || Array.isArray(snapshot))
     throw new Error("configuration snapshot must be an object");
@@ -321,6 +350,7 @@ function validateSnapshot(snapshot) {
   const channels = collection(value.logicalChannels, "logicalChannels", errors);
   const pointIds = /* @__PURE__ */ new Set();
   const channelIds = /* @__PURE__ */ new Set();
+  const channelsById = /* @__PURE__ */ new Map();
   points.forEach((point, index) => {
     const path = `physicalPoints[${index}]`;
     if (!record(point, path, errors)) return;
@@ -335,8 +365,11 @@ function validateSnapshot(snapshot) {
       });
   });
   channels.forEach((channel, index) => {
-    if (channel && typeof channel === "object" && !Array.isArray(channel))
-      addId(channel.id, `logicalChannels[${index}].id`, channelIds, errors);
+    if (channel && typeof channel === "object" && !Array.isArray(channel)) {
+      const item = channel;
+      addId(item.id, `logicalChannels[${index}].id`, channelIds, errors);
+      if (typeof item.id === "string") channelsById.set(item.id, item);
+    }
   });
   channels.forEach((channel, index) => {
     const path = `logicalChannels[${index}]`;
@@ -353,6 +386,7 @@ function validateSnapshot(snapshot) {
         "range",
         "pulse",
         "guard",
+        "feedback",
         "measurement"
       ],
       errors
@@ -365,6 +399,7 @@ function validateSnapshot(snapshot) {
     validateRange(channel.range, `${path}.range`, capabilities, errors);
     validatePulse(channel.pulse, `${path}.pulse`, capabilities, errors);
     validateGuard(channel.guard, `${path}.guard`, capabilities, channelIds, errors);
+    validateFeedback(channel.feedback, `${path}.feedback`, capabilities, channel.id, channelsById, errors);
     validateMeasurement(channel.measurement, `${path}.measurement`, capabilities, errors);
     validateProfile(channel.profile, capabilities, path, errors);
   });
@@ -411,7 +446,7 @@ function exactKeys(value, path, allowed, errors, optional = []) {
       message: "field is not supported by configuration version 1"
     })
   );
-  allowed.filter((key) => !["range", "pulse", "guard", "measurement", ...optional].includes(key) && !(key in value)).forEach(
+  allowed.filter((key) => !["range", "pulse", "guard", "feedback", "measurement", ...optional].includes(key) && !(key in value)).forEach(
     (key) => errors.push({
       path: path === "$" ? key : `${path}.${key}`,
       code: "required_field",
@@ -519,6 +554,22 @@ function validateMeasurement(value, path, capabilities, errors) {
   if (!capabilities.has("measurement"))
     errors.push({ path, code: "unsupported_field", message: "measurement requires measurement capability" });
 }
+function validateFeedback(value, path, capabilities, currentChannelId, channelsById, errors) {
+  if (value === void 0) return;
+  if (!record(value, path, errors)) return;
+  exactKeys(value, path, ["channelId", "expected", "timeoutMs"], errors);
+  const feedbackChannel = typeof value.channelId === "string" ? channelsById.get(value.channelId) : void 0;
+  if (!feedbackChannel)
+    errors.push(referenceError(`${path}.channelId`, "logical channel", value.channelId));
+  else if (value.channelId === currentChannelId || !Array.isArray(feedbackChannel.capabilities) || !feedbackChannel.capabilities.includes("input"))
+    errors.push({ path: `${path}.channelId`, code: "invalid_feedback_channel", message: "feedback must reference a distinct input channel" });
+  if (!["match", "inverse"].includes(value.expected))
+    errors.push({ path: `${path}.expected`, code: "unsupported_value", message: "expected must be match or inverse" });
+  if (!Number.isSafeInteger(value.timeoutMs) || value.timeoutMs <= 0)
+    errors.push({ path: `${path}.timeoutMs`, code: "invalid_timeout", message: "timeoutMs must be a positive integer" });
+  if (!capabilities.has("feedback"))
+    errors.push({ path, code: "unsupported_field", message: "feedback requires feedback capability" });
+}
 function validateProfile(value, capabilities, path, errors) {
   const required = {
     "metered-switched-load": ["output", "measurement"],
@@ -535,6 +586,35 @@ function validateProfile(value, capabilities, path, errors) {
     })
   );
 }
+function presetChannel(application) {
+  const base = {
+    id: application.channelId,
+    physicalPointId: application.physicalPointId,
+    profile: application.presetId,
+    disconnectPolicy: { mode: application.presetId === "generic-monitored-input" ? "hold" : "immediate" }
+  };
+  switch (application.presetId) {
+    case "metered-switched-load":
+      return { ...base, capabilities: ["output", "measurement"], measurement: { unit: "watt", scale: 1, offset: 0 } };
+    case "pulsed-lock-bank":
+      return { ...base, capabilities: ["output", "pulse"], pulse: { durationMs: 500 } };
+    case "guarded-enable-request":
+      if (!application.guardChannelId) throw new Error("guarded enable requests require a guard channel");
+      return {
+        ...base,
+        capabilities: ["output", "guard"],
+        guard: { channelId: application.guardChannelId, when: "on" }
+      };
+    case "generic-monitored-input":
+      return { ...base, capabilities: ["input"] };
+    case "generic-digital-output":
+      return {
+        ...base,
+        capabilities: application.feedbackChannelId ? ["output", "feedback"] : ["output"],
+        ...application.feedbackChannelId ? { feedback: { channelId: application.feedbackChannelId, expected: "match", timeoutMs: 1e3 } } : {}
+      };
+  }
+}
 function referenceError(path, type, id) {
   return { path, code: "missing_reference", message: `${type} ${String(id)} does not exist in this snapshot` };
 }
@@ -554,6 +634,7 @@ var WagoConfigurationDraft = class {
     __publicField(this, "controllerId");
     __publicField(this, "snapshot");
     __publicField(this, "reviewedHash");
+    __publicField(this, "presetProvenance");
     __publicField(this, "updatedAt");
   }
 };
@@ -569,6 +650,9 @@ __decorateClass([
 __decorateClass([
   (0, import_plugins_backend_sdk4.Column)({ type: "varchar", name: "reviewed_hash", nullable: true })
 ], WagoConfigurationDraft.prototype, "reviewedHash", 2);
+__decorateClass([
+  (0, import_plugins_backend_sdk4.Column)({ type: "text", name: "preset_provenance", nullable: true })
+], WagoConfigurationDraft.prototype, "presetProvenance", 2);
 __decorateClass([
   (0, import_plugins_backend_sdk4.Column)({ type: "varchar", name: "updated_at" })
 ], WagoConfigurationDraft.prototype, "updatedAt", 2);
@@ -627,6 +711,12 @@ var PLUGIN_CONTEXT = /* @__PURE__ */ Symbol.for("attraccess.plugin.context");
 var STALE_AFTER_MS = 9e4;
 var MAX_PENDING_CONFIGURATION_REPORTS = 100;
 var ENROLLMENT_RETRY_MS = 6e4;
+var MqttSubscriptionError = class extends Error {
+  constructor(mqttError) {
+    super(String(mqttError));
+    __publicField(this, "mqttError", mqttError);
+  }
+};
 var WagoService = class {
   constructor(context) {
     __publicField(this, "context", context);
@@ -645,16 +735,22 @@ var WagoService = class {
     __publicField(this, "subscriptionRetryTimer", null);
     __publicField(this, "activeSubscriptionGeneration", 0);
     __publicField(this, "destroyed", false);
-    this.controllers = context.getRepository(WagoController);
-    this.settings = context.getRepository(WagoSettings);
-    this.enrollments = context.getRepository(WagoEnrollment);
-    this.drafts = context.getRepository(WagoConfigurationDraft);
-    this.revisions = context.getRepository(WagoConfigurationRevision);
   }
   async onModuleInit() {
+    this.controllers = this.context.getRepository(WagoController);
+    this.settings = this.context.getRepository(WagoSettings);
+    this.enrollments = this.context.getRepository(WagoEnrollment);
+    this.drafts = this.context.getRepository(WagoConfigurationDraft);
+    this.revisions = this.context.getRepository(WagoConfigurationRevision);
     const enrollments = await this.enrollments.createQueryBuilder("enrollment").where("enrollment.consumedAt IS NULL").getMany();
     for (const enrollment of enrollments) this.scheduleEnrollmentExpiry(enrollment);
-    await this.subscribeConfiguredServers();
+    try {
+      await this.subscribeConfiguredServers();
+    } catch (error) {
+      if (!(error instanceof MqttSubscriptionError)) throw error;
+      this.context.logger.warn(`Could not establish WAGO MQTT subscriptions during startup: ${String(error.mqttError)}`);
+      this.scheduleSubscriptionRetry();
+    }
   }
   onModuleDestroy() {
     this.destroyed = true;
@@ -715,6 +811,12 @@ var WagoService = class {
   async setDefaultMqttServer(serverId) {
     return this.setSettings(serverId);
   }
+  async enrollmentCredentialSupport(mqttServerId) {
+    if (!await this.context.getMqttServerConfig(mqttServerId))
+      throw new import_common.NotFoundException(`MQTT server ${mqttServerId} not found`);
+    const providers = await this.context.getMqttCredentialProvisioning().availableProviders(mqttServerId);
+    return { automatic: providers.length === 1 };
+  }
   async getDraft(controllerId) {
     await this.claimedController(controllerId);
     return this.drafts.findOneBy({ controllerId });
@@ -728,6 +830,35 @@ var WagoService = class {
     const errors = validateSnapshot(JSON.parse(draft.snapshot));
     return { valid: errors.length === 0, errors };
   }
+  presets() {
+    return WAGO_PRESETS;
+  }
+  async previewPreset(controllerId, application) {
+    const draft = await this.draftForPreset(controllerId);
+    const snapshot = JSON.parse(draft.snapshot);
+    return { draftHash: configurationHash(snapshot), diff: configurationDiff(snapshot, applyPreset(snapshot, application)) };
+  }
+  async applyPreset(controllerId, application, selectedPaths, previewedDraftHash) {
+    return this.withConfigurationLock(controllerId, async () => {
+      const draft = await this.draftForPreset(controllerId);
+      const snapshot = JSON.parse(draft.snapshot);
+      if (previewedDraftHash !== configurationHash(snapshot))
+        throw new import_common.ConflictException("selected preset changes no longer match the configuration draft");
+      const candidate = applyPreset(snapshot, application);
+      const diff = configurationDiff(snapshot, candidate);
+      const validPaths = new Set(diff.map((change) => change.path));
+      if (!Array.isArray(selectedPaths) || selectedPaths.some((path) => !validPaths.has(path)))
+        throw new import_common.ConflictException("selected preset changes no longer match the configuration draft");
+      draft.snapshot = canonicalSnapshot(applySelectedChanges(snapshot, diff, selectedPaths));
+      draft.reviewedHash = null;
+      draft.presetProvenance = JSON.stringify([
+        ...parsePresetProvenance(draft.presetProvenance).slice(-99),
+        { presetId: application.presetId, appliedAt: (/* @__PURE__ */ new Date()).toISOString(), selectedPaths }
+      ]);
+      draft.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+      return this.drafts.save(draft);
+    });
+  }
   async revisionsFor(controllerId, offset = 0, limit = 20) {
     await this.claimedController(controllerId);
     const pageOffset = Number.isSafeInteger(offset) && offset > 0 ? offset : 0;
@@ -780,7 +911,7 @@ var WagoService = class {
     await this.claimedController(controllerId);
     const serialized = canonicalSnapshot(snapshot);
     const existing = await this.drafts.findOneBy({ controllerId });
-    const draft = existing ?? this.drafts.create({ controllerId, snapshot: serialized, reviewedHash: null, updatedAt: "" });
+    const draft = existing ?? this.drafts.create({ controllerId, snapshot: serialized, reviewedHash: null, presetProvenance: null, updatedAt: "" });
     draft.snapshot = serialized;
     draft.reviewedHash = null;
     draft.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
@@ -796,6 +927,12 @@ var WagoService = class {
     const diff = configurationDiff(previous ? JSON.parse(previous.snapshot) : null, JSON.parse(draft.snapshot));
     return { draft, previous, changed: diff.length > 0, diff };
   }
+  async draftForPreset(controllerId) {
+    await this.claimedController(controllerId);
+    const draft = await this.drafts.findOneBy({ controllerId });
+    if (!draft) throw new import_common.NotFoundException(`WAGO controller ${controllerId} has no configuration draft`);
+    return draft;
+  }
   async publishDraftWhileLocked(controllerId) {
     const controller = await this.claimedController(controllerId);
     const draft = await this.drafts.findOneBy({ controllerId });
@@ -879,6 +1016,11 @@ var WagoService = class {
       ) : void 0
     };
   }
+  /** Server-side commissioning calls this to revoke a bootstrap identity without exposing it to a browser. */
+  async revokeEnrollmentForHardwareId(hardwareId) {
+    const enrollment = (await this.enrollments.find({ where: { hardwareId } })).find((item) => this.isActiveEnrollment(item));
+    if (enrollment) await this.revokeEnrollment(enrollment);
+  }
   async claim(id, name, verifier, mqttServerId) {
     return this.withClaimLock(id, async () => {
       const prepared = await this.withClaimConfigurationLock(() => this.prepareClaim(id, name, verifier, mqttServerId));
@@ -1040,7 +1182,7 @@ var WagoService = class {
     try {
       for (const serverId of serverIds) {
         replacements.push(
-          await this.context.mqtt.subscribe(serverId, `${DISCOVERY_ROOT}/+`, async (message) => {
+          await this.subscribeMqtt(serverId, `${DISCOVERY_ROOT}/+`, async (message) => {
             if (!this.isActiveSubscriptionGeneration(generation)) return;
             await this.onDiscovery(serverId, message.topic, message.payload);
           })
@@ -1056,7 +1198,7 @@ var WagoService = class {
           claimedControllers.map((controller) => [controller.hardwareId, controller])
         );
         replacements.push(
-          await this.context.mqtt.subscribe(
+          await this.subscribeMqtt(
             serverId,
             configurationReportedWildcardTopic(settings.operationalPrefix),
             (message) => {
@@ -1073,7 +1215,7 @@ var WagoService = class {
         }
         for (const controller of claimedControllers) {
           replacements.push(
-            await this.context.mqtt.subscribe(
+            await this.subscribeMqtt(
               serverId,
               heartbeatTopic(settings.operationalPrefix, controller.hardwareId),
               async (message) => {
@@ -1103,6 +1245,13 @@ var WagoService = class {
   unsubscribe() {
     this.subscriptions.splice(0).forEach((subscription) => subscription.unsubscribe());
   }
+  async subscribeMqtt(...args) {
+    try {
+      return await this.context.mqtt.subscribe(...args);
+    } catch (error) {
+      throw new MqttSubscriptionError(error);
+    }
+  }
   isActiveSubscriptionGeneration(generation) {
     return !this.destroyed && generation === this.activeSubscriptionGeneration;
   }
@@ -1414,11 +1563,462 @@ function safeEqual(left, right) {
 function isValidHardwareId(hardwareId) {
   return Boolean(hardwareId) && !/[/+#]/.test(hardwareId);
 }
+function parsePresetProvenance(value) {
+  if (!value) return [];
+  try {
+    const parsed = JSON.parse(value);
+    return Array.isArray(parsed) ? parsed : [];
+  } catch {
+    return [];
+  }
+}
+function applySelectedChanges(snapshot, diff, selectedPaths) {
+  let merged = JSON.parse(JSON.stringify(snapshot));
+  const changes = new Map(diff.map((change) => [change.path, change]));
+  for (const path of selectedPaths) {
+    const change = changes.get(path);
+    if (!change) continue;
+    const segments = [...path.matchAll(/\.([^.[\]]+)|\[(\d+)\]/g)].map((match) => match[1] ?? Number(match[2]));
+    if (!segments.length || segments.some((segment) => typeof segment === "string" && unsafePathSegment(segment))) continue;
+    merged = replacePath(merged, segments, change.current);
+  }
+  return merged;
+}
+function replacePath(value, [segment, ...remaining], replacement) {
+  if (segment === void 0) return replacement;
+  if (typeof segment === "number") {
+    const next = Array.isArray(value) ? [...value] : [];
+    if (remaining.length) next[segment] = replacePath(next[segment], remaining, replacement);
+    else if (replacement === void 0) delete next[segment];
+    else next[segment] = replacement;
+    return next;
+  }
+  const entries = Object.entries(value ?? {}).filter(([key]) => key !== segment);
+  if (remaining.length) entries.push([segment, replacePath(value?.[segment], remaining, replacement)]);
+  else if (replacement !== void 0) entries.push([segment, replacement]);
+  return Object.fromEntries(entries);
+}
+function unsafePathSegment(segment) {
+  return segment === "__proto__" || segment === "constructor" || segment === "prototype";
+}
+
+// backend/wago-commissioning.service.ts
+var import_common2 = require("@nestjs/common");
+var import_node_child_process = require("node:child_process");
+var import_node_crypto3 = require("node:crypto");
+var import_promises = require("node:fs/promises");
+var import_node_os = require("node:os");
+var import_node_path = require("node:path");
+var import_plugins_backend_sdk7 = require("@attraccess/plugins-backend-sdk");
+
+// backend/wago-commissioning-session.entity.ts
+var import_plugins_backend_sdk6 = require("@attraccess/plugins-backend-sdk");
+var WagoCommissioningSession = class {
+  constructor() {
+    __publicField(this, "id");
+    __publicField(this, "hardwareId");
+    __publicField(this, "mqttServerId");
+    __publicField(this, "targetHost");
+    __publicField(this, "hostKeyFingerprint");
+    __publicField(this, "firmwareBaseline");
+    __publicField(this, "state");
+    __publicField(this, "enrollmentExpiresAt");
+    __publicField(this, "codesysState");
+    __publicField(this, "auditLog");
+    __publicField(this, "failureReason");
+    __publicField(this, "createdAt");
+    __publicField(this, "updatedAt");
+  }
+};
+__decorateClass([
+  (0, import_plugins_backend_sdk6.PrimaryGeneratedColumn)({ type: "integer" })
+], WagoCommissioningSession.prototype, "id", 2);
+__decorateClass([
+  (0, import_plugins_backend_sdk6.Column)({ type: "varchar", name: "hardware_id" })
+], WagoCommissioningSession.prototype, "hardwareId", 2);
+__decorateClass([
+  (0, import_plugins_backend_sdk6.Column)({ type: "integer", name: "mqtt_server_id" })
+], WagoCommissioningSession.prototype, "mqttServerId", 2);
+__decorateClass([
+  (0, import_plugins_backend_sdk6.Column)({ type: "varchar", name: "target_host" })
+], WagoCommissioningSession.prototype, "targetHost", 2);
+__decorateClass([
+  (0, import_plugins_backend_sdk6.Column)({ type: "varchar", name: "host_key_fingerprint" })
+], WagoCommissioningSession.prototype, "hostKeyFingerprint", 2);
+__decorateClass([
+  (0, import_plugins_backend_sdk6.Column)({ type: "varchar", name: "firmware_baseline" })
+], WagoCommissioningSession.prototype, "firmwareBaseline", 2);
+__decorateClass([
+  (0, import_plugins_backend_sdk6.Column)({ type: "varchar" })
+], WagoCommissioningSession.prototype, "state", 2);
+__decorateClass([
+  (0, import_plugins_backend_sdk6.Column)({ type: "varchar", name: "enrollment_expires_at", nullable: true })
+], WagoCommissioningSession.prototype, "enrollmentExpiresAt", 2);
+__decorateClass([
+  (0, import_plugins_backend_sdk6.Column)({ type: "varchar", name: "codesys_state", nullable: true })
+], WagoCommissioningSession.prototype, "codesysState", 2);
+__decorateClass([
+  (0, import_plugins_backend_sdk6.Column)({ type: "varchar", name: "audit_log" })
+], WagoCommissioningSession.prototype, "auditLog", 2);
+__decorateClass([
+  (0, import_plugins_backend_sdk6.Column)({ type: "varchar", name: "failure_reason", nullable: true })
+], WagoCommissioningSession.prototype, "failureReason", 2);
+__decorateClass([
+  (0, import_plugins_backend_sdk6.Column)({ type: "varchar", name: "created_at" })
+], WagoCommissioningSession.prototype, "createdAt", 2);
+__decorateClass([
+  (0, import_plugins_backend_sdk6.Column)({ type: "varchar", name: "updated_at" })
+], WagoCommissioningSession.prototype, "updatedAt", 2);
+WagoCommissioningSession = __decorateClass([
+  (0, import_plugins_backend_sdk6.Entity)({ name: "plugin_wago_commissioning_sessions" })
+], WagoCommissioningSession);
+
+// backend/wago-commissioning.service.ts
+var SSH_TIMEOUT_MS = 2e4;
+var configuredFirmwareBaseline = process.env.WAGO_CC100_FIRMWARE_BASELINE?.trim() || "31";
+var configuredRuntimeImage = process.env.WAGO_CC100_RUNTIME_IMAGE?.trim() ?? "";
+var configuredRuntimeBundle = process.env.WAGO_CC100_RUNTIME_BUNDLE_PATH?.trim() ?? "";
+var configuredRuntimeBundleChecksum = process.env.WAGO_CC100_RUNTIME_BUNDLE_SHA256_PATH?.trim() ?? "";
+var configuredRuntimeBundleSignature = process.env.WAGO_CC100_RUNTIME_BUNDLE_SIGNATURE_PATH?.trim() ?? "";
+var SIGNING_NAMESPACE = "attraccess-wago-runtime";
+var SIGNING_IDENTITY = "attraccess-wago-runtime";
+var WagoCommissioningService = class {
+  constructor(context, wago) {
+    __publicField(this, "context", context);
+    __publicField(this, "wago", wago);
+    __publicField(this, "sessions");
+    this.sessions = context.getRepository(WagoCommissioningSession);
+  }
+  support() {
+    return {
+      firmwareBaseline: configuredFirmwareBaseline || null,
+      ready: Boolean(
+        configuredFirmwareBaseline && isImmutableImage(configuredRuntimeImage) && configuredRuntimeBundle && configuredRuntimeBundleChecksum && configuredRuntimeBundleSignature
+      )
+    };
+  }
+  async create(input) {
+    const hardwareId = input.hardwareId.trim();
+    if (!/^[A-Za-z0-9._-]+$/.test(hardwareId)) throw new import_common2.ConflictException("a valid controller hardware ID is required");
+    if (!isPrivateAddress(input.targetHost)) throw new import_common2.ConflictException("commissioning is limited to a private controller address");
+    if (!configuredFirmwareBaseline)
+      throw new import_common2.ConflictException("no CC100 firmware baseline is configured; commissioning is disabled until an exact supported baseline is set");
+    if (!await this.context.getMqttServerConfig(input.mqttServerId)) throw new import_common2.NotFoundException("MQTT server not found");
+    const hostKeyFingerprint = await scanHostKey(input.targetHost);
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    return this.sessions.save(
+      this.sessions.create({
+        hardwareId,
+        mqttServerId: input.mqttServerId,
+        targetHost: input.targetHost,
+        hostKeyFingerprint,
+        firmwareBaseline: configuredFirmwareBaseline,
+        state: "awaiting_identity_confirmation",
+        enrollmentExpiresAt: null,
+        codesysState: null,
+        auditLog: JSON.stringify([{ at: now, event: "host_key_scanned" }]),
+        failureReason: null,
+        createdAt: now,
+        updatedAt: now
+      })
+    );
+  }
+  async list() {
+    return this.sessions.find({ order: { updatedAt: "DESC" } });
+  }
+  async deliver(id, input) {
+    const session = await this.sessions.findOneBy({ id });
+    if (!session) throw new import_common2.NotFoundException("commissioning session not found");
+    if (session.state === "completed" || session.state === "revoked") throw new import_common2.ConflictException("commissioning session is no longer active");
+    if (!input.physicalIdentityConfirmed) throw new import_common2.ConflictException("physical controller identity confirmation is required");
+    if (input.hostKeyFingerprint !== session.hostKeyFingerprint) throw new import_common2.ConflictException("controller SSH host key does not match the scanned key");
+    if (!input.temporarySsh.username.trim() || !input.temporarySsh.password)
+      throw new import_common2.ConflictException("temporary SSH credentials are required for this session only");
+    if (!isRuntimeArtifactConfigured())
+      throw new import_common2.ConflictException("no immutable, signed CC100 runtime bundle is configured for commissioning");
+    try {
+      const inspection = await this.inspect(session.targetHost, session.hostKeyFingerprint, input.temporarySsh);
+      session.codesysState = inspection.codesys;
+      if (!isSupportedController(inspection.firmware, session.firmwareBaseline)) {
+        throw new import_common2.ConflictException(`unsupported CC100 model or firmware; expected baseline ${session.firmwareBaseline}`);
+      }
+      if (inspection.codesys === "active" && !input.codesysStopConfirmed) {
+        session.state = "awaiting_codesys_confirmation";
+        session.failureReason = "CODESYS is active; explicit administrator confirmation is required before it is stopped.";
+        return this.save(session, "codesys_confirmation_required");
+      }
+      const bundle = await verifyRuntimeBundle();
+      const enrollment = await this.wago.createEnrollment(session.hardwareId, session.mqttServerId);
+      if (!enrollment.password) throw new import_common2.ConflictException("automatic restricted MQTT credential provisioning is required for secure commissioning");
+      const runtimeEnv = [
+        `WAGO_HARDWARE_ID=${session.hardwareId}`,
+        `WAGO_MQTT_URL=${enrollment.broker.useTls ? "mqtts" : "mqtt"}://${enrollment.broker.host}:${enrollment.broker.port}`,
+        `WAGO_MQTT_USERNAME=${enrollment.username}`,
+        `WAGO_MQTT_PASSWORD=${enrollment.password}`,
+        `WAGO_ENROLLMENT_SECRET=${enrollment.claimSecret}`
+      ].join("\n");
+      if (inspection.codesys === "active")
+        await this.sudoRun(session.targetHost, session.hostKeyFingerprint, input.temporarySsh, "/etc/init.d/pp_codesys3 stop");
+      await this.sudoRun(
+        session.targetHost,
+        session.hostKeyFingerprint,
+        input.temporarySsh,
+        "docker info >/dev/null 2>&1 || /etc/init.d/dockerd start; docker info >/dev/null"
+      );
+      await this.writeRuntimeEnvironment(session.targetHost, session.hostKeyFingerprint, input.temporarySsh, runtimeEnv);
+      try {
+        await this.copyTo(session.targetHost, session.hostKeyFingerprint, input.temporarySsh, bundle.path, "/tmp/attraccess-wago-runtime.tar");
+        await this.sudoRun(
+          session.targetHost,
+          session.hostKeyFingerprint,
+          input.temporarySsh,
+          `docker load -i /tmp/attraccess-wago-runtime.tar && rm -f /tmp/attraccess-wago-runtime.tar && docker image inspect ${runtimeImageTag()} >/dev/null && (docker rm -f attraccess-wago >/dev/null 2>&1 || true) && docker run -d --name attraccess-wago --restart unless-stopped --env-file /etc/attraccess-wago/runtime.env -v /var/lib/attraccess-wago:/var/lib/attraccess-wago ${runtimeImageTag()}`
+        );
+      } finally {
+        await (0, import_promises.rm)(bundle.directory, { recursive: true, force: true });
+      }
+      session.state = "awaiting_discovery";
+      session.enrollmentExpiresAt = enrollment.expiresAt;
+      session.failureReason = null;
+      return this.save(session, "bootstrap_delivered");
+    } catch (error) {
+      session.state = "delivery_failed";
+      session.failureReason = error instanceof Error ? redact(error.message) : "Secure delivery failed";
+      return this.save(session, "delivery_failed");
+    }
+  }
+  async revoke(id) {
+    const session = await this.sessions.findOneBy({ id });
+    if (!session) throw new import_common2.NotFoundException("commissioning session not found");
+    await this.wago.revokeEnrollmentForHardwareId(session.hardwareId);
+    session.state = "revoked";
+    session.failureReason = null;
+    return this.save(session, "revoked");
+  }
+  async inspect(host, fingerprint, credential) {
+    const output = await this.run(host, fingerprint, credential, "cat /etc/os-release; printf '\\nCODESYS='; ps");
+    const [, codesys = "unknown"] = output.match(/CODESYS=([^\r\n]*)/) ?? [];
+    return { firmware: output, codesys: /codesys/i.test(codesys) ? "active" : "inactive" };
+  }
+  async writeRuntimeEnvironment(host, fingerprint, credential, content) {
+    await this.sudoRun(
+      host,
+      fingerprint,
+      credential,
+      "install -d -m 0700 /etc/attraccess-wago && umask 077 && base64 -d > /etc/attraccess-wago/runtime.env && chmod 0600 /etc/attraccess-wago/runtime.env",
+      Buffer.from(content).toString("base64")
+    );
+  }
+  async sudoRun(host, fingerprint, credential, command, input) {
+    return this.run(host, fingerprint, credential, `sudo -S sh -c ${shellQuote(command)}`, `${credential.password}
+${input ?? ""}`);
+  }
+  async run(host, fingerprint, credential, command, input) {
+    const dir = await (0, import_promises.mkdtemp)((0, import_node_path.join)((0, import_node_os.tmpdir)(), "attraccess-cc100-"));
+    const knownHosts = (0, import_node_path.join)(dir, "known_hosts");
+    const askPass = (0, import_node_path.join)(dir, "askpass");
+    try {
+      await (0, import_promises.writeFile)(knownHosts, await pinnedHostKey(host, fingerprint), { mode: 384 });
+      await (0, import_promises.writeFile)(askPass, `#!/bin/sh
+printf '%s\\n' "$ATTRACCESS_SSH_PASSWORD"
+`, { mode: 448 });
+      return await runProcess(
+        "ssh",
+        [
+          "-o",
+          "BatchMode=no",
+          "-o",
+          "NumberOfPasswordPrompts=1",
+          "-o",
+          "HostKeyAlgorithms=ssh-ed25519",
+          "-o",
+          "StrictHostKeyChecking=yes",
+          "-o",
+          `UserKnownHostsFile=${knownHosts}`,
+          "-o",
+          "ConnectTimeout=15",
+          `${credential.username}@${host}`,
+          "sh",
+          "-c",
+          command
+        ],
+        input,
+        { SSH_ASKPASS: askPass, SSH_ASKPASS_REQUIRE: "force", DISPLAY: "attraccess", ATTRACCESS_SSH_PASSWORD: credential.password }
+      );
+    } finally {
+      await (0, import_promises.rm)(dir, { recursive: true, force: true });
+    }
+  }
+  async copyTo(host, fingerprint, credential, source, destination) {
+    const dir = await (0, import_promises.mkdtemp)((0, import_node_path.join)((0, import_node_os.tmpdir)(), "attraccess-cc100-"));
+    const knownHosts = (0, import_node_path.join)(dir, "known_hosts");
+    const askPass = (0, import_node_path.join)(dir, "askpass");
+    try {
+      await (0, import_promises.writeFile)(knownHosts, await pinnedHostKey(host, fingerprint), { mode: 384 });
+      await (0, import_promises.writeFile)(askPass, `#!/bin/sh
+printf '%s\\n' "$ATTRACCESS_SSH_PASSWORD"
+`, { mode: 448 });
+      await runProcess(
+        "scp",
+        [
+          "-o",
+          "BatchMode=no",
+          "-o",
+          "NumberOfPasswordPrompts=1",
+          "-o",
+          "HostKeyAlgorithms=ssh-ed25519",
+          "-o",
+          "StrictHostKeyChecking=yes",
+          "-o",
+          `UserKnownHostsFile=${knownHosts}`,
+          "-o",
+          "ConnectTimeout=15",
+          source,
+          `${credential.username}@${host}:${destination}`
+        ],
+        void 0,
+        { SSH_ASKPASS: askPass, SSH_ASKPASS_REQUIRE: "force", DISPLAY: "attraccess", ATTRACCESS_SSH_PASSWORD: credential.password }
+      );
+    } finally {
+      await (0, import_promises.rm)(dir, { recursive: true, force: true });
+    }
+  }
+  save(session, event) {
+    const audit = JSON.parse(session.auditLog);
+    audit.push({ at: (/* @__PURE__ */ new Date()).toISOString(), event });
+    session.auditLog = JSON.stringify(audit.slice(-50));
+    session.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+    return this.sessions.save(session);
+  }
+};
+WagoCommissioningService = __decorateClass([
+  (0, import_common2.Injectable)(),
+  __decorateParam(0, (0, import_common2.Inject)(import_plugins_backend_sdk7.PLUGIN_CONTEXT))
+], WagoCommissioningService);
+async function scanHostKey(host) {
+  const dir = await (0, import_promises.mkdtemp)((0, import_node_path.join)((0, import_node_os.tmpdir)(), "attraccess-cc100-"));
+  const knownHosts = (0, import_node_path.join)(dir, "known_hosts");
+  try {
+    await (0, import_promises.writeFile)(knownHosts, await scanHostKeys(host), { mode: 384 });
+    return fingerprintFor(knownHosts);
+  } finally {
+    await (0, import_promises.rm)(dir, { recursive: true, force: true });
+  }
+}
+function scanHostKeys(host) {
+  return runProcess("ssh-keyscan", ["-T", "15", "-t", "ed25519", host]);
+}
+async function pinnedHostKey(host, expectedFingerprint) {
+  const key = (await scanHostKeys(host)).split("\n").find((line) => line.includes("ssh-ed25519"));
+  if (!key) throw new import_common2.ConflictException("the controller did not provide an Ed25519 SSH host key");
+  const dir = await (0, import_promises.mkdtemp)((0, import_node_path.join)((0, import_node_os.tmpdir)(), "attraccess-cc100-"));
+  const knownHosts = (0, import_node_path.join)(dir, "known_hosts");
+  try {
+    await (0, import_promises.writeFile)(knownHosts, `${key}
+`, { mode: 384 });
+    if (await fingerprintFor(knownHosts) !== expectedFingerprint) throw new import_common2.ConflictException("controller SSH host key changed after identity confirmation");
+    return `${key}
+`;
+  } finally {
+    await (0, import_promises.rm)(dir, { recursive: true, force: true });
+  }
+}
+async function fingerprintFor(knownHosts) {
+  const result = (await runProcess("ssh-keygen", ["-lf", knownHosts, "-E", "sha256"])).match(/(SHA256:[A-Za-z0-9+/=]+)/)?.[1];
+  if (!result) throw new import_common2.ConflictException("the controller did not provide a supported SSH host key");
+  return result;
+}
+function runProcess(command, args, input, environment) {
+  return new Promise((resolve, reject) => {
+    const child = (0, import_node_child_process.spawn)(command, args, { env: { ...process.env, ...environment }, stdio: ["pipe", "pipe", "pipe"] });
+    let stdout = "";
+    let stderr = "";
+    const timer = setTimeout(() => child.kill(), SSH_TIMEOUT_MS);
+    child.stdout.on("data", (chunk) => stdout += chunk);
+    child.stderr.on("data", (chunk) => stderr += chunk);
+    child.on("error", reject);
+    child.on("close", (code) => {
+      clearTimeout(timer);
+      if (code === 0) resolve(stdout);
+      else reject(new Error(stderr || `${command} exited with status ${code}`));
+    });
+    child.stdin.end(input);
+  });
+}
+function isPrivateAddress(host) {
+  const match = host.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
+  if (!match) return false;
+  const octets = match.slice(1).map(Number);
+  if (octets.some((octet) => octet > 255)) return false;
+  return octets[0] === 10 || octets[0] === 192 && octets[1] === 168 || octets[0] === 172 && octets[1] >= 16 && octets[1] <= 31;
+}
+function redact(value) {
+  return value.replace(/(?:password|secret|token)=?[^\s]*/gi, "[redacted]");
+}
+function isImmutableImage(image) {
+  return /@sha256:[a-f0-9]{64}$/i.test(image);
+}
+function isRuntimeArtifactConfigured() {
+  return Boolean(
+    isImmutableImage(configuredRuntimeImage) && configuredRuntimeBundle && configuredRuntimeBundleChecksum && configuredRuntimeBundleSignature
+  );
+}
+async function verifyRuntimeBundle() {
+  const directory = await (0, import_promises.mkdtemp)((0, import_node_path.join)((0, import_node_os.tmpdir)(), "attraccess-cc100-runtime-"));
+  const bundlePath = (0, import_node_path.join)(directory, "runtime.tar");
+  const checksumPath = (0, import_node_path.join)(directory, "runtime.tar.sha256");
+  const signaturePath = (0, import_node_path.join)(directory, "runtime.tar.sig");
+  try {
+    await Promise.all([
+      (0, import_promises.copyFile)(configuredRuntimeBundle, bundlePath),
+      (0, import_promises.copyFile)(configuredRuntimeBundleChecksum, checksumPath),
+      (0, import_promises.copyFile)(configuredRuntimeBundleSignature, signaturePath)
+    ]);
+  } catch (error) {
+    await (0, import_promises.rm)(directory, { recursive: true, force: true });
+    throw error;
+  }
+  const [bundle, checksum, signature] = await Promise.all([(0, import_promises.readFile)(bundlePath), (0, import_promises.readFile)(checksumPath, "utf8"), (0, import_promises.stat)(signaturePath)]);
+  if (!signature.isFile()) throw new import_common2.ConflictException("CC100 runtime signature is not a file");
+  const digest = (0, import_node_crypto3.createHash)("sha256").update(bundle).digest("hex");
+  if (!new RegExp(`^${digest}\\s+\\*?${escapeRegExp(configuredRuntimeBundle.split("/").pop() ?? "")}\\s*$`, "m").test(checksum)) {
+    throw new import_common2.ConflictException("CC100 runtime bundle checksum does not match");
+  }
+  try {
+    const allowedSigners = (0, import_node_path.join)(directory, "allowed_signers");
+    const publicKey = await (0, import_promises.readFile)((0, import_node_path.join)(__dirname, "signing-public-key.pub"), "utf8");
+    await (0, import_promises.writeFile)(allowedSigners, `${SIGNING_IDENTITY} ${publicKey.trim()}
+`, { mode: 384 });
+    await runProcess(
+      "ssh-keygen",
+      ["-Y", "verify", "-f", allowedSigners, "-I", SIGNING_IDENTITY, "-n", SIGNING_NAMESPACE, "-s", signaturePath],
+      bundle
+    );
+  } finally {
+    await (0, import_promises.rm)((0, import_node_path.join)(directory, "allowed_signers"), { force: true });
+  }
+  return { directory, path: bundlePath };
+}
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function runtimeImageTag() {
+  return configuredRuntimeImage.split("@", 1)[0];
+}
+function isSupportedController(inspection, firmwareBaseline) {
+  if (!inspection.includes('PTXDIST_PLATFORM_NAME="cc100"')) return false;
+  const reportedFirmware = inspection.match(/firmware[^\r\n]*?(\d+(?:\.\d+)+|\d+)/i)?.[1];
+  return !reportedFirmware || reportedFirmware.includes(firmwareBaseline);
+}
+function shellQuote(value) {
+  return `'${value.replace(/'/g, `'\\"'\\"'`)}'`;
+}
 
 // backend/wago.controller.ts
 var WagoControllerApi = class {
-  constructor(wago) {
+  constructor(wago, commissioning) {
     __publicField(this, "wago", wago);
+    __publicField(this, "commissioning", commissioning);
   }
   list() {
     return this.wago.list();
@@ -1429,9 +2029,30 @@ var WagoControllerApi = class {
   setSettings(body) {
     return this.wago.setSettings(body?.defaultMqttServerId, body?.operationalPrefix);
   }
-  enrollment(body) {
-    const manualCredentials = body?.manualUsername || body?.manualPassword ? { username: body.manualUsername ?? "", password: body.manualPassword ?? "" } : void 0;
-    return this.wago.createEnrollment(body?.hardwareId ?? "", body?.mqttServerId, manualCredentials);
+  commissioningSupport() {
+    return this.commissioning.support();
+  }
+  commissioningSessions() {
+    return this.commissioning.list();
+  }
+  createCommissioningSession(body) {
+    if (!body?.mqttServerId) throw new import_common3.BadRequestException("MQTT server is required");
+    return this.commissioning.create({
+      hardwareId: body.hardwareId ?? "",
+      mqttServerId: body.mqttServerId,
+      targetHost: body.targetHost ?? ""
+    });
+  }
+  deliverCommissioningSession(id, body) {
+    return this.commissioning.deliver(id, {
+      hostKeyFingerprint: body?.hostKeyFingerprint ?? "",
+      physicalIdentityConfirmed: body?.physicalIdentityConfirmed === true,
+      codesysStopConfirmed: body?.codesysStopConfirmed === true,
+      temporarySsh: { username: body?.temporarySsh?.username ?? "", password: body?.temporarySsh?.password ?? "" }
+    });
+  }
+  revokeCommissioningSession(id) {
+    return this.commissioning.revoke(id);
   }
   claim(id, body) {
     return this.wago.claim(id, body?.name ?? "", body?.verifier ?? "", body?.mqttServerId);
@@ -1439,6 +2060,17 @@ var WagoControllerApi = class {
   draft(id) {
     return this.wago.getDraft(id);
   }
+  presets() {
+    return this.wago.presets();
+  }
+  previewPreset(id, body) {
+    if (!body?.application) throw new import_common3.BadRequestException("application is required");
+    return this.wago.previewPreset(id, body.application);
+  }
+  applyPreset(id, body) {
+    if (!body?.application) throw new import_common3.BadRequestException("application is required");
+    return this.wago.applyPreset(id, body.application, body.selectedPaths ?? [], body.previewedDraftHash ?? "");
+  }
   saveDraft(id, body) {
     return this.wago.saveDraft(id, body?.snapshot);
   }
@@ -1462,78 +2094,114 @@ var WagoControllerApi = class {
   }
 };
 __decorateClass([
-  (0, import_common2.Get)("controllers")
+  (0, import_common3.Get)("controllers")
 ], WagoControllerApi.prototype, "list", 1);
 __decorateClass([
-  (0, import_common2.Get)("settings")
+  (0, import_common3.Get)("settings")
 ], WagoControllerApi.prototype, "settings", 1);
 __decorateClass([
-  (0, import_common2.Post)("settings"),
-  __decorateParam(0, (0, import_common2.Body)())
+  (0, import_common3.Post)("settings"),
+  __decorateParam(0, (0, import_common3.Body)())
 ], WagoControllerApi.prototype, "setSettings", 1);
 __decorateClass([
-  (0, import_common2.Post)("enrollments"),
-  __decorateParam(0, (0, import_common2.Body)())
-], WagoControllerApi.prototype, "enrollment", 1);
+  (0, import_common3.Get)("commissioning/support")
+], WagoControllerApi.prototype, "commissioningSupport", 1);
+__decorateClass([
+  (0, import_common3.Get)("commissioning/sessions")
+], WagoControllerApi.prototype, "commissioningSessions", 1);
+__decorateClass([
+  (0, import_common3.Post)("commissioning/sessions"),
+  __decorateParam(0, (0, import_common3.Body)())
+], WagoControllerApi.prototype, "createCommissioningSession", 1);
+__decorateClass([
+  (0, import_common3.Post)("commissioning/sessions/:id/deliver"),
+  __decorateParam(0, (0, import_common3.Param)("id", import_common3.ParseIntPipe)),
+  __decorateParam(1, (0, import_common3.Body)())
+], WagoControllerApi.prototype, "deliverCommissioningSession", 1);
 __decorateClass([
-  (0, import_common2.Post)("controllers/:id/claim"),
-  __decorateParam(0, (0, import_common2.Param)("id", import_common2.ParseIntPipe)),
-  __decorateParam(1, (0, import_common2.Body)())
+  (0, import_common3.Post)("commissioning/sessions/:id/revoke"),
+  __decorateParam(0, (0, import_common3.Param)("id", import_common3.ParseIntPipe))
+], WagoControllerApi.prototype, "revokeCommissioningSession", 1);
+__decorateClass([
+  (0, import_common3.Post)("controllers/:id/claim"),
+  __decorateParam(0, (0, import_common3.Param)("id", import_common3.ParseIntPipe)),
+  __decorateParam(1, (0, import_common3.Body)())
 ], WagoControllerApi.prototype, "claim", 1);
 __decorateClass([
-  (0, import_common2.Get)("controllers/:id/configuration/draft"),
-  __decorateParam(0, (0, import_common2.Param)("id", import_common2.ParseIntPipe))
+  (0, import_common3.Get)("controllers/:id/configuration/draft"),
+  __decorateParam(0, (0, import_common3.Param)("id", import_common3.ParseIntPipe))
 ], WagoControllerApi.prototype, "draft", 1);
 __decorateClass([
-  (0, import_common2.Post)("controllers/:id/configuration/draft"),
-  __decorateParam(0, (0, import_common2.Param)("id", import_common2.ParseIntPipe)),
-  __decorateParam(1, (0, import_common2.Body)())
+  (0, import_common3.Get)("configuration/presets")
+], WagoControllerApi.prototype, "presets", 1);
+__decorateClass([
+  (0, import_common3.Post)("controllers/:id/configuration/presets/preview"),
+  __decorateParam(0, (0, import_common3.Param)("id", import_common3.ParseIntPipe)),
+  __decorateParam(1, (0, import_common3.Body)())
+], WagoControllerApi.prototype, "previewPreset", 1);
+__decorateClass([
+  (0, import_common3.Post)("controllers/:id/configuration/presets/apply"),
+  __decorateParam(0, (0, import_common3.Param)("id", import_common3.ParseIntPipe)),
+  __decorateParam(1, (0, import_common3.Body)())
+], WagoControllerApi.prototype, "applyPreset", 1);
+__decorateClass([
+  (0, import_common3.Post)("controllers/:id/configuration/draft"),
+  __decorateParam(0, (0, import_common3.Param)("id", import_common3.ParseIntPipe)),
+  __decorateParam(1, (0, import_common3.Body)())
 ], WagoControllerApi.prototype, "saveDraft", 1);
 __decorateClass([
-  (0, import_common2.Post)("controllers/:id/configuration/validate"),
-  __decorateParam(0, (0, import_common2.Param)("id", import_common2.ParseIntPipe))
+  (0, import_common3.Post)("controllers/:id/configuration/validate"),
+  __decorateParam(0, (0, import_common3.Param)("id", import_common3.ParseIntPipe))
 ], WagoControllerApi.prototype, "validateDraft", 1);
 __decorateClass([
-  (0, import_common2.Post)("controllers/:id/configuration/review"),
-  __decorateParam(0, (0, import_common2.Param)("id", import_common2.ParseIntPipe))
+  (0, import_common3.Post)("controllers/:id/configuration/review"),
+  __decorateParam(0, (0, import_common3.Param)("id", import_common3.ParseIntPipe))
 ], WagoControllerApi.prototype, "reviewDraft", 1);
 __decorateClass([
-  (0, import_common2.Get)("controllers/:id/configuration/revisions"),
-  __decorateParam(0, (0, import_common2.Param)("id", import_common2.ParseIntPipe)),
-  __decorateParam(1, (0, import_common2.Query)("offset")),
-  __decorateParam(2, (0, import_common2.Query)("limit"))
+  (0, import_common3.Get)("controllers/:id/configuration/revisions"),
+  __decorateParam(0, (0, import_common3.Param)("id", import_common3.ParseIntPipe)),
+  __decorateParam(1, (0, import_common3.Query)("offset")),
+  __decorateParam(2, (0, import_common3.Query)("limit"))
 ], WagoControllerApi.prototype, "revisions", 1);
 __decorateClass([
-  (0, import_common2.Post)("controllers/:id/configuration/publish"),
-  __decorateParam(0, (0, import_common2.Param)("id", import_common2.ParseIntPipe))
+  (0, import_common3.Post)("controllers/:id/configuration/publish"),
+  __decorateParam(0, (0, import_common3.Param)("id", import_common3.ParseIntPipe))
 ], WagoControllerApi.prototype, "publishDraft", 1);
 __decorateClass([
-  (0, import_common2.Post)("controllers/:id/configuration/rollback/:revision"),
-  __decorateParam(0, (0, import_common2.Param)("id", import_common2.ParseIntPipe)),
-  __decorateParam(1, (0, import_common2.Param)("revision", import_common2.ParseIntPipe))
+  (0, import_common3.Post)("controllers/:id/configuration/rollback/:revision"),
+  __decorateParam(0, (0, import_common3.Param)("id", import_common3.ParseIntPipe)),
+  __decorateParam(1, (0, import_common3.Param)("revision", import_common3.ParseIntPipe))
 ], WagoControllerApi.prototype, "rollback", 1);
 __decorateClass([
-  (0, import_common2.Get)("controllers/:id/configuration/revisions/:revision/preview"),
-  __decorateParam(0, (0, import_common2.Param)("id", import_common2.ParseIntPipe)),
-  __decorateParam(1, (0, import_common2.Param)("revision", import_common2.ParseIntPipe))
+  (0, import_common3.Get)("controllers/:id/configuration/revisions/:revision/preview"),
+  __decorateParam(0, (0, import_common3.Param)("id", import_common3.ParseIntPipe)),
+  __decorateParam(1, (0, import_common3.Param)("revision", import_common3.ParseIntPipe))
 ], WagoControllerApi.prototype, "previewRevision", 1);
 WagoControllerApi = __decorateClass([
-  (0, import_plugins_backend_sdk6.Auth)("resources.update"),
-  (0, import_common2.Controller)("wago"),
-  __decorateParam(0, (0, import_common2.Inject)(WagoService))
+  (0, import_plugins_backend_sdk8.Auth)("system.settings.manage"),
+  (0, import_common3.Controller)("wago"),
+  __decorateParam(0, (0, import_common3.Inject)(WagoService)),
+  __decorateParam(1, (0, import_common3.Inject)(WagoCommissioningService))
 ], WagoControllerApi);
 
 // backend/plugin.ts
-var PLUGIN_CONTEXT2 = /* @__PURE__ */ Symbol.for("attraccess.plugin.context");
+var PLUGIN_CONTEXT3 = /* @__PURE__ */ Symbol.for("attraccess.plugin.context");
 var WagoPluginModule = class {
 };
 var plugin = {
-  entities: [WagoController, WagoSettings, WagoEnrollment, WagoConfigurationDraft, WagoConfigurationRevision],
+  entities: [
+    WagoController,
+    WagoSettings,
+    WagoEnrollment,
+    WagoConfigurationDraft,
+    WagoConfigurationRevision,
+    WagoCommissioningSession
+  ],
   register(context) {
     return {
       module: WagoPluginModule,
       controllers: [WagoControllerApi],
-      providers: [{ provide: PLUGIN_CONTEXT2, useValue: context }, WagoService]
+      providers: [{ provide: PLUGIN_CONTEXT3, useValue: context }, WagoService, WagoCommissioningService]
     };
   }
 };