@attraccess/plugin-wago 0.1.0-nightly.932.1 → 0.1.0-nightly.935.1

package/dist/index.js

@@ -35,8 +35,8 @@ __export(plugin_exports, {
 module.exports = __toCommonJS(plugin_exports);
 
 // backend/wago.controller.ts
-var import_common2 = require("@nestjs/common");
-var import_plugins_backend_sdk6 = require("@attraccess/plugins-backend-sdk");
+var import_common3 = require("@nestjs/common");
+var import_plugins_backend_sdk8 = require("@attraccess/plugins-backend-sdk");
 
 // backend/wago.service.ts
 var import_node_crypto2 = require("node:crypto");
@@ -711,6 +711,12 @@ var PLUGIN_CONTEXT = /* @__PURE__ */ Symbol.for("attraccess.plugin.context");
 var STALE_AFTER_MS = 9e4;
 var MAX_PENDING_CONFIGURATION_REPORTS = 100;
 var ENROLLMENT_RETRY_MS = 6e4;
+var MqttSubscriptionError = class extends Error {
+  constructor(mqttError) {
+    super(String(mqttError));
+    __publicField(this, "mqttError", mqttError);
+  }
+};
 var WagoService = class {
   constructor(context) {
     __publicField(this, "context", context);
@@ -738,7 +744,13 @@ var WagoService = class {
     this.revisions = this.context.getRepository(WagoConfigurationRevision);
     const enrollments = await this.enrollments.createQueryBuilder("enrollment").where("enrollment.consumedAt IS NULL").getMany();
     for (const enrollment of enrollments) this.scheduleEnrollmentExpiry(enrollment);
-    await this.subscribeConfiguredServers();
+    try {
+      await this.subscribeConfiguredServers();
+    } catch (error) {
+      if (!(error instanceof MqttSubscriptionError)) throw error;
+      this.context.logger.warn(`Could not establish WAGO MQTT subscriptions during startup: ${String(error.mqttError)}`);
+      this.scheduleSubscriptionRetry();
+    }
   }
   onModuleDestroy() {
     this.destroyed = true;
@@ -803,7 +815,7 @@ var WagoService = class {
     if (!await this.context.getMqttServerConfig(mqttServerId))
       throw new import_common.NotFoundException(`MQTT server ${mqttServerId} not found`);
     const providers = await this.context.getMqttCredentialProvisioning().availableProviders(mqttServerId);
-    return { automatic: providers.length > 0 };
+    return { automatic: providers.length === 1 };
   }
   async getDraft(controllerId) {
     await this.claimedController(controllerId);
@@ -1004,6 +1016,11 @@ var WagoService = class {
       ) : void 0
     };
   }
+  /** Server-side commissioning calls this to revoke a bootstrap identity without exposing it to a browser. */
+  async revokeEnrollmentForHardwareId(hardwareId) {
+    const enrollment = (await this.enrollments.find({ where: { hardwareId } })).find((item) => this.isActiveEnrollment(item));
+    if (enrollment) await this.revokeEnrollment(enrollment);
+  }
   async claim(id, name, verifier, mqttServerId) {
     return this.withClaimLock(id, async () => {
       const prepared = await this.withClaimConfigurationLock(() => this.prepareClaim(id, name, verifier, mqttServerId));
@@ -1165,7 +1182,7 @@ var WagoService = class {
     try {
       for (const serverId of serverIds) {
         replacements.push(
-          await this.context.mqtt.subscribe(serverId, `${DISCOVERY_ROOT}/+`, async (message) => {
+          await this.subscribeMqtt(serverId, `${DISCOVERY_ROOT}/+`, async (message) => {
             if (!this.isActiveSubscriptionGeneration(generation)) return;
             await this.onDiscovery(serverId, message.topic, message.payload);
           })
@@ -1181,7 +1198,7 @@ var WagoService = class {
           claimedControllers.map((controller) => [controller.hardwareId, controller])
         );
         replacements.push(
-          await this.context.mqtt.subscribe(
+          await this.subscribeMqtt(
             serverId,
             configurationReportedWildcardTopic(settings.operationalPrefix),
             (message) => {
@@ -1198,7 +1215,7 @@ var WagoService = class {
         }
         for (const controller of claimedControllers) {
           replacements.push(
-            await this.context.mqtt.subscribe(
+            await this.subscribeMqtt(
               serverId,
               heartbeatTopic(settings.operationalPrefix, controller.hardwareId),
               async (message) => {
@@ -1228,6 +1245,13 @@ var WagoService = class {
   unsubscribe() {
     this.subscriptions.splice(0).forEach((subscription) => subscription.unsubscribe());
   }
+  async subscribeMqtt(...args) {
+    try {
+      return await this.context.mqtt.subscribe(...args);
+    } catch (error) {
+      throw new MqttSubscriptionError(error);
+    }
+  }
   isActiveSubscriptionGeneration(generation) {
     return !this.destroyed && generation === this.activeSubscriptionGeneration;
   }
@@ -1549,31 +1573,452 @@ function parsePresetProvenance(value) {
   }
 }
 function applySelectedChanges(snapshot, diff, selectedPaths) {
-  const merged = JSON.parse(JSON.stringify(snapshot));
+  let merged = JSON.parse(JSON.stringify(snapshot));
   const changes = new Map(diff.map((change) => [change.path, change]));
   for (const path of selectedPaths) {
     const change = changes.get(path);
     if (!change) continue;
     const segments = [...path.matchAll(/\.([^.[\]]+)|\[(\d+)\]/g)].map((match) => match[1] ?? Number(match[2]));
-    if (!segments.length) continue;
-    let target = merged;
-    for (const segment of segments.slice(0, -1)) {
-      const next = target[segment];
-      if (next === void 0) target[segment] = typeof segment === "number" ? [] : {};
-      target = target[segment];
-    }
-    const last = segments[segments.length - 1];
-    if (last === void 0) continue;
-    if (change.current === void 0) delete target[last];
-    else target[last] = change.current;
+    if (!segments.length || segments.some((segment) => typeof segment === "string" && unsafePathSegment(segment))) continue;
+    merged = replacePath(merged, segments, change.current);
   }
   return merged;
 }
+function replacePath(value, [segment, ...remaining], replacement) {
+  if (segment === void 0) return replacement;
+  if (typeof segment === "number") {
+    const next = Array.isArray(value) ? [...value] : [];
+    if (remaining.length) next[segment] = replacePath(next[segment], remaining, replacement);
+    else if (replacement === void 0) delete next[segment];
+    else next[segment] = replacement;
+    return next;
+  }
+  const entries = Object.entries(value ?? {}).filter(([key]) => key !== segment);
+  if (remaining.length) entries.push([segment, replacePath(value?.[segment], remaining, replacement)]);
+  else if (replacement !== void 0) entries.push([segment, replacement]);
+  return Object.fromEntries(entries);
+}
+function unsafePathSegment(segment) {
+  return segment === "__proto__" || segment === "constructor" || segment === "prototype";
+}
+
+// backend/wago-commissioning.service.ts
+var import_common2 = require("@nestjs/common");
+var import_node_child_process = require("node:child_process");
+var import_node_crypto3 = require("node:crypto");
+var import_promises = require("node:fs/promises");
+var import_node_os = require("node:os");
+var import_node_path = require("node:path");
+var import_plugins_backend_sdk7 = require("@attraccess/plugins-backend-sdk");
+
+// backend/wago-commissioning-session.entity.ts
+var import_plugins_backend_sdk6 = require("@attraccess/plugins-backend-sdk");
+var WagoCommissioningSession = class {
+  constructor() {
+    __publicField(this, "id");
+    __publicField(this, "hardwareId");
+    __publicField(this, "mqttServerId");
+    __publicField(this, "targetHost");
+    __publicField(this, "hostKeyFingerprint");
+    __publicField(this, "firmwareBaseline");
+    __publicField(this, "state");
+    __publicField(this, "enrollmentExpiresAt");
+    __publicField(this, "codesysState");
+    __publicField(this, "auditLog");
+    __publicField(this, "failureReason");
+    __publicField(this, "createdAt");
+    __publicField(this, "updatedAt");
+  }
+};
+__decorateClass([
+  (0, import_plugins_backend_sdk6.PrimaryGeneratedColumn)({ type: "integer" })
+], WagoCommissioningSession.prototype, "id", 2);
+__decorateClass([
+  (0, import_plugins_backend_sdk6.Column)({ type: "varchar", name: "hardware_id" })
+], WagoCommissioningSession.prototype, "hardwareId", 2);
+__decorateClass([
+  (0, import_plugins_backend_sdk6.Column)({ type: "integer", name: "mqtt_server_id" })
+], WagoCommissioningSession.prototype, "mqttServerId", 2);
+__decorateClass([
+  (0, import_plugins_backend_sdk6.Column)({ type: "varchar", name: "target_host" })
+], WagoCommissioningSession.prototype, "targetHost", 2);
+__decorateClass([
+  (0, import_plugins_backend_sdk6.Column)({ type: "varchar", name: "host_key_fingerprint" })
+], WagoCommissioningSession.prototype, "hostKeyFingerprint", 2);
+__decorateClass([
+  (0, import_plugins_backend_sdk6.Column)({ type: "varchar", name: "firmware_baseline" })
+], WagoCommissioningSession.prototype, "firmwareBaseline", 2);
+__decorateClass([
+  (0, import_plugins_backend_sdk6.Column)({ type: "varchar" })
+], WagoCommissioningSession.prototype, "state", 2);
+__decorateClass([
+  (0, import_plugins_backend_sdk6.Column)({ type: "varchar", name: "enrollment_expires_at", nullable: true })
+], WagoCommissioningSession.prototype, "enrollmentExpiresAt", 2);
+__decorateClass([
+  (0, import_plugins_backend_sdk6.Column)({ type: "varchar", name: "codesys_state", nullable: true })
+], WagoCommissioningSession.prototype, "codesysState", 2);
+__decorateClass([
+  (0, import_plugins_backend_sdk6.Column)({ type: "varchar", name: "audit_log" })
+], WagoCommissioningSession.prototype, "auditLog", 2);
+__decorateClass([
+  (0, import_plugins_backend_sdk6.Column)({ type: "varchar", name: "failure_reason", nullable: true })
+], WagoCommissioningSession.prototype, "failureReason", 2);
+__decorateClass([
+  (0, import_plugins_backend_sdk6.Column)({ type: "varchar", name: "created_at" })
+], WagoCommissioningSession.prototype, "createdAt", 2);
+__decorateClass([
+  (0, import_plugins_backend_sdk6.Column)({ type: "varchar", name: "updated_at" })
+], WagoCommissioningSession.prototype, "updatedAt", 2);
+WagoCommissioningSession = __decorateClass([
+  (0, import_plugins_backend_sdk6.Entity)({ name: "plugin_wago_commissioning_sessions" })
+], WagoCommissioningSession);
+
+// backend/wago-commissioning.service.ts
+var SSH_TIMEOUT_MS = 2e4;
+var configuredFirmwareBaseline = process.env.WAGO_CC100_FIRMWARE_BASELINE?.trim() || "31";
+var configuredRuntimeImage = process.env.WAGO_CC100_RUNTIME_IMAGE?.trim() ?? "";
+var configuredRuntimeBundle = process.env.WAGO_CC100_RUNTIME_BUNDLE_PATH?.trim() ?? "";
+var configuredRuntimeBundleChecksum = process.env.WAGO_CC100_RUNTIME_BUNDLE_SHA256_PATH?.trim() ?? "";
+var configuredRuntimeBundleSignature = process.env.WAGO_CC100_RUNTIME_BUNDLE_SIGNATURE_PATH?.trim() ?? "";
+var SIGNING_NAMESPACE = "attraccess-wago-runtime";
+var SIGNING_IDENTITY = "attraccess-wago-runtime";
+var WagoCommissioningService = class {
+  constructor(context, wago) {
+    __publicField(this, "context", context);
+    __publicField(this, "wago", wago);
+    __publicField(this, "sessions");
+    this.sessions = context.getRepository(WagoCommissioningSession);
+  }
+  support() {
+    return {
+      firmwareBaseline: configuredFirmwareBaseline || null,
+      ready: Boolean(
+        configuredFirmwareBaseline && isImmutableImage(configuredRuntimeImage) && configuredRuntimeBundle && configuredRuntimeBundleChecksum && configuredRuntimeBundleSignature
+      )
+    };
+  }
+  async create(input) {
+    const hardwareId = input.hardwareId.trim();
+    if (!/^[A-Za-z0-9._-]+$/.test(hardwareId)) throw new import_common2.ConflictException("a valid controller hardware ID is required");
+    if (!isPrivateAddress(input.targetHost)) throw new import_common2.ConflictException("commissioning is limited to a private controller address");
+    if (!configuredFirmwareBaseline)
+      throw new import_common2.ConflictException("no CC100 firmware baseline is configured; commissioning is disabled until an exact supported baseline is set");
+    if (!await this.context.getMqttServerConfig(input.mqttServerId)) throw new import_common2.NotFoundException("MQTT server not found");
+    const hostKeyFingerprint = await scanHostKey(input.targetHost);
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    return this.sessions.save(
+      this.sessions.create({
+        hardwareId,
+        mqttServerId: input.mqttServerId,
+        targetHost: input.targetHost,
+        hostKeyFingerprint,
+        firmwareBaseline: configuredFirmwareBaseline,
+        state: "awaiting_identity_confirmation",
+        enrollmentExpiresAt: null,
+        codesysState: null,
+        auditLog: JSON.stringify([{ at: now, event: "host_key_scanned" }]),
+        failureReason: null,
+        createdAt: now,
+        updatedAt: now
+      })
+    );
+  }
+  async list() {
+    return this.sessions.find({ order: { updatedAt: "DESC" } });
+  }
+  async deliver(id, input) {
+    const session = await this.sessions.findOneBy({ id });
+    if (!session) throw new import_common2.NotFoundException("commissioning session not found");
+    if (session.state === "completed" || session.state === "revoked") throw new import_common2.ConflictException("commissioning session is no longer active");
+    if (!input.physicalIdentityConfirmed) throw new import_common2.ConflictException("physical controller identity confirmation is required");
+    if (input.hostKeyFingerprint !== session.hostKeyFingerprint) throw new import_common2.ConflictException("controller SSH host key does not match the scanned key");
+    if (!input.temporarySsh.username.trim() || !input.temporarySsh.password)
+      throw new import_common2.ConflictException("temporary SSH credentials are required for this session only");
+    if (!isRuntimeArtifactConfigured())
+      throw new import_common2.ConflictException("no immutable, signed CC100 runtime bundle is configured for commissioning");
+    try {
+      const inspection = await this.inspect(session.targetHost, session.hostKeyFingerprint, input.temporarySsh);
+      session.codesysState = inspection.codesys;
+      if (!isSupportedController(inspection.firmware, session.firmwareBaseline)) {
+        throw new import_common2.ConflictException(`unsupported CC100 model or firmware; expected baseline ${session.firmwareBaseline}`);
+      }
+      if (inspection.codesys === "active" && !input.codesysStopConfirmed) {
+        session.state = "awaiting_codesys_confirmation";
+        session.failureReason = "CODESYS is active; explicit administrator confirmation is required before it is stopped.";
+        return this.save(session, "codesys_confirmation_required");
+      }
+      const bundle = await verifyRuntimeBundle();
+      const enrollment = await this.wago.createEnrollment(session.hardwareId, session.mqttServerId);
+      if (!enrollment.password) throw new import_common2.ConflictException("automatic restricted MQTT credential provisioning is required for secure commissioning");
+      const runtimeEnv = [
+        `WAGO_HARDWARE_ID=${session.hardwareId}`,
+        `WAGO_MQTT_URL=${enrollment.broker.useTls ? "mqtts" : "mqtt"}://${enrollment.broker.host}:${enrollment.broker.port}`,
+        `WAGO_MQTT_USERNAME=${enrollment.username}`,
+        `WAGO_MQTT_PASSWORD=${enrollment.password}`,
+        `WAGO_ENROLLMENT_SECRET=${enrollment.claimSecret}`
+      ].join("\n");
+      if (inspection.codesys === "active")
+        await this.sudoRun(session.targetHost, session.hostKeyFingerprint, input.temporarySsh, "/etc/init.d/pp_codesys3 stop");
+      await this.sudoRun(
+        session.targetHost,
+        session.hostKeyFingerprint,
+        input.temporarySsh,
+        "docker info >/dev/null 2>&1 || /etc/init.d/dockerd start; docker info >/dev/null"
+      );
+      await this.writeRuntimeEnvironment(session.targetHost, session.hostKeyFingerprint, input.temporarySsh, runtimeEnv);
+      try {
+        await this.copyTo(session.targetHost, session.hostKeyFingerprint, input.temporarySsh, bundle.path, "/tmp/attraccess-wago-runtime.tar");
+        await this.sudoRun(
+          session.targetHost,
+          session.hostKeyFingerprint,
+          input.temporarySsh,
+          `docker load -i /tmp/attraccess-wago-runtime.tar && rm -f /tmp/attraccess-wago-runtime.tar && docker image inspect ${runtimeImageTag()} >/dev/null && (docker rm -f attraccess-wago >/dev/null 2>&1 || true) && docker run -d --name attraccess-wago --restart unless-stopped --env-file /etc/attraccess-wago/runtime.env -v /var/lib/attraccess-wago:/var/lib/attraccess-wago ${runtimeImageTag()}`
+        );
+      } finally {
+        await (0, import_promises.rm)(bundle.directory, { recursive: true, force: true });
+      }
+      session.state = "awaiting_discovery";
+      session.enrollmentExpiresAt = enrollment.expiresAt;
+      session.failureReason = null;
+      return this.save(session, "bootstrap_delivered");
+    } catch (error) {
+      session.state = "delivery_failed";
+      session.failureReason = error instanceof Error ? redact(error.message) : "Secure delivery failed";
+      return this.save(session, "delivery_failed");
+    }
+  }
+  async revoke(id) {
+    const session = await this.sessions.findOneBy({ id });
+    if (!session) throw new import_common2.NotFoundException("commissioning session not found");
+    await this.wago.revokeEnrollmentForHardwareId(session.hardwareId);
+    session.state = "revoked";
+    session.failureReason = null;
+    return this.save(session, "revoked");
+  }
+  async inspect(host, fingerprint, credential) {
+    const output = await this.run(host, fingerprint, credential, "cat /etc/os-release; printf '\\nCODESYS='; ps");
+    const [, codesys = "unknown"] = output.match(/CODESYS=([^\r\n]*)/) ?? [];
+    return { firmware: output, codesys: /codesys/i.test(codesys) ? "active" : "inactive" };
+  }
+  async writeRuntimeEnvironment(host, fingerprint, credential, content) {
+    await this.sudoRun(
+      host,
+      fingerprint,
+      credential,
+      "install -d -m 0700 /etc/attraccess-wago && umask 077 && base64 -d > /etc/attraccess-wago/runtime.env && chmod 0600 /etc/attraccess-wago/runtime.env",
+      Buffer.from(content).toString("base64")
+    );
+  }
+  async sudoRun(host, fingerprint, credential, command, input) {
+    return this.run(host, fingerprint, credential, `sudo -S sh -c ${shellQuote(command)}`, `${credential.password}
+${input ?? ""}`);
+  }
+  async run(host, fingerprint, credential, command, input) {
+    const dir = await (0, import_promises.mkdtemp)((0, import_node_path.join)((0, import_node_os.tmpdir)(), "attraccess-cc100-"));
+    const knownHosts = (0, import_node_path.join)(dir, "known_hosts");
+    const askPass = (0, import_node_path.join)(dir, "askpass");
+    try {
+      await (0, import_promises.writeFile)(knownHosts, await pinnedHostKey(host, fingerprint), { mode: 384 });
+      await (0, import_promises.writeFile)(askPass, `#!/bin/sh
+printf '%s\\n' "$ATTRACCESS_SSH_PASSWORD"
+`, { mode: 448 });
+      return await runProcess(
+        "ssh",
+        [
+          "-o",
+          "BatchMode=no",
+          "-o",
+          "NumberOfPasswordPrompts=1",
+          "-o",
+          "HostKeyAlgorithms=ssh-ed25519",
+          "-o",
+          "StrictHostKeyChecking=yes",
+          "-o",
+          `UserKnownHostsFile=${knownHosts}`,
+          "-o",
+          "ConnectTimeout=15",
+          `${credential.username}@${host}`,
+          "sh",
+          "-c",
+          command
+        ],
+        input,
+        { SSH_ASKPASS: askPass, SSH_ASKPASS_REQUIRE: "force", DISPLAY: "attraccess", ATTRACCESS_SSH_PASSWORD: credential.password }
+      );
+    } finally {
+      await (0, import_promises.rm)(dir, { recursive: true, force: true });
+    }
+  }
+  async copyTo(host, fingerprint, credential, source, destination) {
+    const dir = await (0, import_promises.mkdtemp)((0, import_node_path.join)((0, import_node_os.tmpdir)(), "attraccess-cc100-"));
+    const knownHosts = (0, import_node_path.join)(dir, "known_hosts");
+    const askPass = (0, import_node_path.join)(dir, "askpass");
+    try {
+      await (0, import_promises.writeFile)(knownHosts, await pinnedHostKey(host, fingerprint), { mode: 384 });
+      await (0, import_promises.writeFile)(askPass, `#!/bin/sh
+printf '%s\\n' "$ATTRACCESS_SSH_PASSWORD"
+`, { mode: 448 });
+      await runProcess(
+        "scp",
+        [
+          "-o",
+          "BatchMode=no",
+          "-o",
+          "NumberOfPasswordPrompts=1",
+          "-o",
+          "HostKeyAlgorithms=ssh-ed25519",
+          "-o",
+          "StrictHostKeyChecking=yes",
+          "-o",
+          `UserKnownHostsFile=${knownHosts}`,
+          "-o",
+          "ConnectTimeout=15",
+          source,
+          `${credential.username}@${host}:${destination}`
+        ],
+        void 0,
+        { SSH_ASKPASS: askPass, SSH_ASKPASS_REQUIRE: "force", DISPLAY: "attraccess", ATTRACCESS_SSH_PASSWORD: credential.password }
+      );
+    } finally {
+      await (0, import_promises.rm)(dir, { recursive: true, force: true });
+    }
+  }
+  save(session, event) {
+    const audit = JSON.parse(session.auditLog);
+    audit.push({ at: (/* @__PURE__ */ new Date()).toISOString(), event });
+    session.auditLog = JSON.stringify(audit.slice(-50));
+    session.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+    return this.sessions.save(session);
+  }
+};
+WagoCommissioningService = __decorateClass([
+  (0, import_common2.Injectable)(),
+  __decorateParam(0, (0, import_common2.Inject)(import_plugins_backend_sdk7.PLUGIN_CONTEXT))
+], WagoCommissioningService);
+async function scanHostKey(host) {
+  const dir = await (0, import_promises.mkdtemp)((0, import_node_path.join)((0, import_node_os.tmpdir)(), "attraccess-cc100-"));
+  const knownHosts = (0, import_node_path.join)(dir, "known_hosts");
+  try {
+    await (0, import_promises.writeFile)(knownHosts, await scanHostKeys(host), { mode: 384 });
+    return fingerprintFor(knownHosts);
+  } finally {
+    await (0, import_promises.rm)(dir, { recursive: true, force: true });
+  }
+}
+function scanHostKeys(host) {
+  return runProcess("ssh-keyscan", ["-T", "15", "-t", "ed25519", host]);
+}
+async function pinnedHostKey(host, expectedFingerprint) {
+  const key = (await scanHostKeys(host)).split("\n").find((line) => line.includes("ssh-ed25519"));
+  if (!key) throw new import_common2.ConflictException("the controller did not provide an Ed25519 SSH host key");
+  const dir = await (0, import_promises.mkdtemp)((0, import_node_path.join)((0, import_node_os.tmpdir)(), "attraccess-cc100-"));
+  const knownHosts = (0, import_node_path.join)(dir, "known_hosts");
+  try {
+    await (0, import_promises.writeFile)(knownHosts, `${key}
+`, { mode: 384 });
+    if (await fingerprintFor(knownHosts) !== expectedFingerprint) throw new import_common2.ConflictException("controller SSH host key changed after identity confirmation");
+    return `${key}
+`;
+  } finally {
+    await (0, import_promises.rm)(dir, { recursive: true, force: true });
+  }
+}
+async function fingerprintFor(knownHosts) {
+  const result = (await runProcess("ssh-keygen", ["-lf", knownHosts, "-E", "sha256"])).match(/(SHA256:[A-Za-z0-9+/=]+)/)?.[1];
+  if (!result) throw new import_common2.ConflictException("the controller did not provide a supported SSH host key");
+  return result;
+}
+function runProcess(command, args, input, environment) {
+  return new Promise((resolve, reject) => {
+    const child = (0, import_node_child_process.spawn)(command, args, { env: { ...process.env, ...environment }, stdio: ["pipe", "pipe", "pipe"] });
+    let stdout = "";
+    let stderr = "";
+    const timer = setTimeout(() => child.kill(), SSH_TIMEOUT_MS);
+    child.stdout.on("data", (chunk) => stdout += chunk);
+    child.stderr.on("data", (chunk) => stderr += chunk);
+    child.on("error", reject);
+    child.on("close", (code) => {
+      clearTimeout(timer);
+      if (code === 0) resolve(stdout);
+      else reject(new Error(stderr || `${command} exited with status ${code}`));
+    });
+    child.stdin.end(input);
+  });
+}
+function isPrivateAddress(host) {
+  const match = host.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
+  if (!match) return false;
+  const octets = match.slice(1).map(Number);
+  if (octets.some((octet) => octet > 255)) return false;
+  return octets[0] === 10 || octets[0] === 192 && octets[1] === 168 || octets[0] === 172 && octets[1] >= 16 && octets[1] <= 31;
+}
+function redact(value) {
+  return value.replace(/(?:password|secret|token)=?[^\s]*/gi, "[redacted]");
+}
+function isImmutableImage(image) {
+  return /@sha256:[a-f0-9]{64}$/i.test(image);
+}
+function isRuntimeArtifactConfigured() {
+  return Boolean(
+    isImmutableImage(configuredRuntimeImage) && configuredRuntimeBundle && configuredRuntimeBundleChecksum && configuredRuntimeBundleSignature
+  );
+}
+async function verifyRuntimeBundle() {
+  const directory = await (0, import_promises.mkdtemp)((0, import_node_path.join)((0, import_node_os.tmpdir)(), "attraccess-cc100-runtime-"));
+  const bundlePath = (0, import_node_path.join)(directory, "runtime.tar");
+  const checksumPath = (0, import_node_path.join)(directory, "runtime.tar.sha256");
+  const signaturePath = (0, import_node_path.join)(directory, "runtime.tar.sig");
+  try {
+    await Promise.all([
+      (0, import_promises.copyFile)(configuredRuntimeBundle, bundlePath),
+      (0, import_promises.copyFile)(configuredRuntimeBundleChecksum, checksumPath),
+      (0, import_promises.copyFile)(configuredRuntimeBundleSignature, signaturePath)
+    ]);
+  } catch (error) {
+    await (0, import_promises.rm)(directory, { recursive: true, force: true });
+    throw error;
+  }
+  const [bundle, checksum, signature] = await Promise.all([(0, import_promises.readFile)(bundlePath), (0, import_promises.readFile)(checksumPath, "utf8"), (0, import_promises.stat)(signaturePath)]);
+  if (!signature.isFile()) throw new import_common2.ConflictException("CC100 runtime signature is not a file");
+  const digest = (0, import_node_crypto3.createHash)("sha256").update(bundle).digest("hex");
+  if (!new RegExp(`^${digest}\\s+\\*?${escapeRegExp(configuredRuntimeBundle.split("/").pop() ?? "")}\\s*$`, "m").test(checksum)) {
+    throw new import_common2.ConflictException("CC100 runtime bundle checksum does not match");
+  }
+  try {
+    const allowedSigners = (0, import_node_path.join)(directory, "allowed_signers");
+    const publicKey = await (0, import_promises.readFile)((0, import_node_path.join)(__dirname, "signing-public-key.pub"), "utf8");
+    await (0, import_promises.writeFile)(allowedSigners, `${SIGNING_IDENTITY} ${publicKey.trim()}
+`, { mode: 384 });
+    await runProcess(
+      "ssh-keygen",
+      ["-Y", "verify", "-f", allowedSigners, "-I", SIGNING_IDENTITY, "-n", SIGNING_NAMESPACE, "-s", signaturePath],
+      bundle
+    );
+  } finally {
+    await (0, import_promises.rm)((0, import_node_path.join)(directory, "allowed_signers"), { force: true });
+  }
+  return { directory, path: bundlePath };
+}
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function runtimeImageTag() {
+  return configuredRuntimeImage.split("@", 1)[0];
+}
+function isSupportedController(inspection, firmwareBaseline) {
+  if (!inspection.includes('PTXDIST_PLATFORM_NAME="cc100"')) return false;
+  const reportedFirmware = inspection.match(/firmware[^\r\n]*?(\d+(?:\.\d+)+|\d+)/i)?.[1];
+  return !reportedFirmware || reportedFirmware.includes(firmwareBaseline);
+}
+function shellQuote(value) {
+  return `'${value.replace(/'/g, `'\\"'\\"'`)}'`;
+}
 
 // backend/wago.controller.ts
 var WagoControllerApi = class {
-  constructor(wago) {
+  constructor(wago, commissioning) {
     __publicField(this, "wago", wago);
+    __publicField(this, "commissioning", commissioning);
   }
   list() {
     return this.wago.list();
@@ -1584,12 +2029,30 @@ var WagoControllerApi = class {
   setSettings(body) {
     return this.wago.setSettings(body?.defaultMqttServerId, body?.operationalPrefix);
   }
-  enrollment(body) {
-    const manualCredentials = body?.manualUsername || body?.manualPassword ? { username: body.manualUsername ?? "", password: body.manualPassword ?? "" } : void 0;
-    return this.wago.createEnrollment(body?.hardwareId ?? "", body?.mqttServerId, manualCredentials);
+  commissioningSupport() {
+    return this.commissioning.support();
   }
-  credentialSupport(mqttServerId) {
-    return this.wago.enrollmentCredentialSupport(mqttServerId);
+  commissioningSessions() {
+    return this.commissioning.list();
+  }
+  createCommissioningSession(body) {
+    if (!body?.mqttServerId) throw new import_common3.BadRequestException("MQTT server is required");
+    return this.commissioning.create({
+      hardwareId: body.hardwareId ?? "",
+      mqttServerId: body.mqttServerId,
+      targetHost: body.targetHost ?? ""
+    });
+  }
+  deliverCommissioningSession(id, body) {
+    return this.commissioning.deliver(id, {
+      hostKeyFingerprint: body?.hostKeyFingerprint ?? "",
+      physicalIdentityConfirmed: body?.physicalIdentityConfirmed === true,
+      codesysStopConfirmed: body?.codesysStopConfirmed === true,
+      temporarySsh: { username: body?.temporarySsh?.username ?? "", password: body?.temporarySsh?.password ?? "" }
+    });
+  }
+  revokeCommissioningSession(id) {
+    return this.commissioning.revoke(id);
   }
   claim(id, body) {
     return this.wago.claim(id, body?.name ?? "", body?.verifier ?? "", body?.mqttServerId);
@@ -1601,11 +2064,11 @@ var WagoControllerApi = class {
     return this.wago.presets();
   }
   previewPreset(id, body) {
-    if (!body?.application) throw new import_common2.BadRequestException("application is required");
+    if (!body?.application) throw new import_common3.BadRequestException("application is required");
     return this.wago.previewPreset(id, body.application);
   }
   applyPreset(id, body) {
-    if (!body?.application) throw new import_common2.BadRequestException("application is required");
+    if (!body?.application) throw new import_common3.BadRequestException("application is required");
     return this.wago.applyPreset(id, body.application, body.selectedPaths ?? [], body.previewedDraftHash ?? "");
   }
   saveDraft(id, body) {
@@ -1631,95 +2094,114 @@ var WagoControllerApi = class {
   }
 };
 __decorateClass([
-  (0, import_common2.Get)("controllers")
+  (0, import_common3.Get)("controllers")
 ], WagoControllerApi.prototype, "list", 1);
 __decorateClass([
-  (0, import_common2.Get)("settings")
+  (0, import_common3.Get)("settings")
 ], WagoControllerApi.prototype, "settings", 1);
 __decorateClass([
-  (0, import_common2.Post)("settings"),
-  __decorateParam(0, (0, import_common2.Body)())
+  (0, import_common3.Post)("settings"),
+  __decorateParam(0, (0, import_common3.Body)())
 ], WagoControllerApi.prototype, "setSettings", 1);
 __decorateClass([
-  (0, import_common2.Post)("enrollments"),
-  __decorateParam(0, (0, import_common2.Body)())
-], WagoControllerApi.prototype, "enrollment", 1);
+  (0, import_common3.Get)("commissioning/support")
+], WagoControllerApi.prototype, "commissioningSupport", 1);
+__decorateClass([
+  (0, import_common3.Get)("commissioning/sessions")
+], WagoControllerApi.prototype, "commissioningSessions", 1);
+__decorateClass([
+  (0, import_common3.Post)("commissioning/sessions"),
+  __decorateParam(0, (0, import_common3.Body)())
+], WagoControllerApi.prototype, "createCommissioningSession", 1);
+__decorateClass([
+  (0, import_common3.Post)("commissioning/sessions/:id/deliver"),
+  __decorateParam(0, (0, import_common3.Param)("id", import_common3.ParseIntPipe)),
+  __decorateParam(1, (0, import_common3.Body)())
+], WagoControllerApi.prototype, "deliverCommissioningSession", 1);
 __decorateClass([
-  (0, import_common2.Get)("enrollments/credential-support/:mqttServerId"),
-  __decorateParam(0, (0, import_common2.Param)("mqttServerId", import_common2.ParseIntPipe))
-], WagoControllerApi.prototype, "credentialSupport", 1);
+  (0, import_common3.Post)("commissioning/sessions/:id/revoke"),
+  __decorateParam(0, (0, import_common3.Param)("id", import_common3.ParseIntPipe))
+], WagoControllerApi.prototype, "revokeCommissioningSession", 1);
 __decorateClass([
-  (0, import_common2.Post)("controllers/:id/claim"),
-  __decorateParam(0, (0, import_common2.Param)("id", import_common2.ParseIntPipe)),
-  __decorateParam(1, (0, import_common2.Body)())
+  (0, import_common3.Post)("controllers/:id/claim"),
+  __decorateParam(0, (0, import_common3.Param)("id", import_common3.ParseIntPipe)),
+  __decorateParam(1, (0, import_common3.Body)())
 ], WagoControllerApi.prototype, "claim", 1);
 __decorateClass([
-  (0, import_common2.Get)("controllers/:id/configuration/draft"),
-  __decorateParam(0, (0, import_common2.Param)("id", import_common2.ParseIntPipe))
+  (0, import_common3.Get)("controllers/:id/configuration/draft"),
+  __decorateParam(0, (0, import_common3.Param)("id", import_common3.ParseIntPipe))
 ], WagoControllerApi.prototype, "draft", 1);
 __decorateClass([
-  (0, import_common2.Get)("configuration/presets")
+  (0, import_common3.Get)("configuration/presets")
 ], WagoControllerApi.prototype, "presets", 1);
 __decorateClass([
-  (0, import_common2.Post)("controllers/:id/configuration/presets/preview"),
-  __decorateParam(0, (0, import_common2.Param)("id", import_common2.ParseIntPipe)),
-  __decorateParam(1, (0, import_common2.Body)())
+  (0, import_common3.Post)("controllers/:id/configuration/presets/preview"),
+  __decorateParam(0, (0, import_common3.Param)("id", import_common3.ParseIntPipe)),
+  __decorateParam(1, (0, import_common3.Body)())
 ], WagoControllerApi.prototype, "previewPreset", 1);
 __decorateClass([
-  (0, import_common2.Post)("controllers/:id/configuration/presets/apply"),
-  __decorateParam(0, (0, import_common2.Param)("id", import_common2.ParseIntPipe)),
-  __decorateParam(1, (0, import_common2.Body)())
+  (0, import_common3.Post)("controllers/:id/configuration/presets/apply"),
+  __decorateParam(0, (0, import_common3.Param)("id", import_common3.ParseIntPipe)),
+  __decorateParam(1, (0, import_common3.Body)())
 ], WagoControllerApi.prototype, "applyPreset", 1);
 __decorateClass([
-  (0, import_common2.Post)("controllers/:id/configuration/draft"),
-  __decorateParam(0, (0, import_common2.Param)("id", import_common2.ParseIntPipe)),
-  __decorateParam(1, (0, import_common2.Body)())
+  (0, import_common3.Post)("controllers/:id/configuration/draft"),
+  __decorateParam(0, (0, import_common3.Param)("id", import_common3.ParseIntPipe)),
+  __decorateParam(1, (0, import_common3.Body)())
 ], WagoControllerApi.prototype, "saveDraft", 1);
 __decorateClass([
-  (0, import_common2.Post)("controllers/:id/configuration/validate"),
-  __decorateParam(0, (0, import_common2.Param)("id", import_common2.ParseIntPipe))
+  (0, import_common3.Post)("controllers/:id/configuration/validate"),
+  __decorateParam(0, (0, import_common3.Param)("id", import_common3.ParseIntPipe))
 ], WagoControllerApi.prototype, "validateDraft", 1);
 __decorateClass([
-  (0, import_common2.Post)("controllers/:id/configuration/review"),
-  __decorateParam(0, (0, import_common2.Param)("id", import_common2.ParseIntPipe))
+  (0, import_common3.Post)("controllers/:id/configuration/review"),
+  __decorateParam(0, (0, import_common3.Param)("id", import_common3.ParseIntPipe))
 ], WagoControllerApi.prototype, "reviewDraft", 1);
 __decorateClass([
-  (0, import_common2.Get)("controllers/:id/configuration/revisions"),
-  __decorateParam(0, (0, import_common2.Param)("id", import_common2.ParseIntPipe)),
-  __decorateParam(1, (0, import_common2.Query)("offset")),
-  __decorateParam(2, (0, import_common2.Query)("limit"))
+  (0, import_common3.Get)("controllers/:id/configuration/revisions"),
+  __decorateParam(0, (0, import_common3.Param)("id", import_common3.ParseIntPipe)),
+  __decorateParam(1, (0, import_common3.Query)("offset")),
+  __decorateParam(2, (0, import_common3.Query)("limit"))
 ], WagoControllerApi.prototype, "revisions", 1);
 __decorateClass([
-  (0, import_common2.Post)("controllers/:id/configuration/publish"),
-  __decorateParam(0, (0, import_common2.Param)("id", import_common2.ParseIntPipe))
+  (0, import_common3.Post)("controllers/:id/configuration/publish"),
+  __decorateParam(0, (0, import_common3.Param)("id", import_common3.ParseIntPipe))
 ], WagoControllerApi.prototype, "publishDraft", 1);
 __decorateClass([
-  (0, import_common2.Post)("controllers/:id/configuration/rollback/:revision"),
-  __decorateParam(0, (0, import_common2.Param)("id", import_common2.ParseIntPipe)),
-  __decorateParam(1, (0, import_common2.Param)("revision", import_common2.ParseIntPipe))
+  (0, import_common3.Post)("controllers/:id/configuration/rollback/:revision"),
+  __decorateParam(0, (0, import_common3.Param)("id", import_common3.ParseIntPipe)),
+  __decorateParam(1, (0, import_common3.Param)("revision", import_common3.ParseIntPipe))
 ], WagoControllerApi.prototype, "rollback", 1);
 __decorateClass([
-  (0, import_common2.Get)("controllers/:id/configuration/revisions/:revision/preview"),
-  __decorateParam(0, (0, import_common2.Param)("id", import_common2.ParseIntPipe)),
-  __decorateParam(1, (0, import_common2.Param)("revision", import_common2.ParseIntPipe))
+  (0, import_common3.Get)("controllers/:id/configuration/revisions/:revision/preview"),
+  __decorateParam(0, (0, import_common3.Param)("id", import_common3.ParseIntPipe)),
+  __decorateParam(1, (0, import_common3.Param)("revision", import_common3.ParseIntPipe))
 ], WagoControllerApi.prototype, "previewRevision", 1);
 WagoControllerApi = __decorateClass([
-  (0, import_plugins_backend_sdk6.Auth)("resources.update"),
-  (0, import_common2.Controller)("wago"),
-  __decorateParam(0, (0, import_common2.Inject)(WagoService))
+  (0, import_plugins_backend_sdk8.Auth)("system.settings.manage"),
+  (0, import_common3.Controller)("wago"),
+  __decorateParam(0, (0, import_common3.Inject)(WagoService)),
+  __decorateParam(1, (0, import_common3.Inject)(WagoCommissioningService))
 ], WagoControllerApi);
 
 // backend/plugin.ts
-var PLUGIN_CONTEXT2 = /* @__PURE__ */ Symbol.for("attraccess.plugin.context");
+var PLUGIN_CONTEXT3 = /* @__PURE__ */ Symbol.for("attraccess.plugin.context");
 var WagoPluginModule = class {
 };
 var plugin = {
-  entities: [WagoController, WagoSettings, WagoEnrollment, WagoConfigurationDraft, WagoConfigurationRevision],
+  entities: [
+    WagoController,
+    WagoSettings,
+    WagoEnrollment,
+    WagoConfigurationDraft,
+    WagoConfigurationRevision,
+    WagoCommissioningSession
+  ],
   register(context) {
     return {
       module: WagoPluginModule,
       controllers: [WagoControllerApi],
-      providers: [{ provide: PLUGIN_CONTEXT2, useValue: context }, WagoService]
+      providers: [{ provide: PLUGIN_CONTEXT3, useValue: context }, WagoService, WagoCommissioningService]
     };
   }
 };