@attraccess/plugin-wago 0.1.0-nightly.979.1 → 0.1.0-nightly.981.1

package/dist/index.js

@@ -53808,13 +53808,13 @@ async function configurationFlowImpacts(context, controllerId, previous, current
   }
   const nodes = await context.dataSource.getRepository(import_plugins_backend_sdk5.ResourceFlowNode).createQueryBuilder("node").select(["node.id", "node.resourceId", "node.type", "node.data"]).where("node.type LIKE :type", { type: "plugin.wago.%" }).andWhere("node.data ->> 'controllerId' = :controllerId", { controllerId }).getMany();
   for (const node of nodes) {
-    const channelId = node.data?.channelId;
-    if (String(node.type) !== "plugin.wago.command" || typeof channelId !== "string" || !channelId) continue;
+    const channelId2 = node.data?.channelId;
+    if (String(node.type) !== "plugin.wago.command" || typeof channelId2 !== "string" || !channelId2) continue;
     const message = "Publication changes the configuration revision. Reopen and save this channel's command nodes after it applies.";
-    const impact = impacts.find((item) => item.channelId === channelId);
+    const impact = impacts.find((item) => item.channelId === channelId2);
     if (impact) {
       if (!impact.message.includes(message)) impact.message += ` ${message}`;
-    } else impacts.push({ channelId, message });
+    } else impacts.push({ channelId: channelId2, message });
   }
   return impacts.map((impact) => ({
     ...impact,
@@ -53900,21 +53900,21 @@ var WagoCommandHandler = class {
   async schema(config, resourceId) {
     const controllers = await this.dependencies.controllers().find({ where: { trustState: "claimed" }, order: { name: "ASC" } });
     const controllerId = positiveInteger2(config.controllerId);
-    const revision = controllerId ? await this.dependencies.appliedRevision(controllerId) : null;
-    const snapshot = revision ? JSON.parse(revision.snapshot) : null;
-    const channelId = typeof config.channelId === "string" ? config.channelId : void 0;
+    const revision2 = controllerId ? await this.dependencies.appliedRevision(controllerId) : null;
+    const snapshot = revision2 ? JSON.parse(revision2.snapshot) : null;
+    const channelId2 = typeof config.channelId === "string" ? config.channelId : void 0;
     const outputChannels = snapshot?.logicalChannels.filter((item) => item.capabilities.includes("output")) ?? [];
     let names = {};
     if (controllerId) {
       const draft = await this.dependencies.context.getRepository(WagoConfigurationDraft).findOneBy({ controllerId });
       try {
-        const storedNames = JSON.parse(revision?.presetProvenance ?? draft?.presetProvenance ?? "null")?.editor?.names;
+        const storedNames = JSON.parse(revision2?.presetProvenance ?? draft?.presetProvenance ?? "null")?.editor?.names;
         if (storedNames && typeof storedNames === "object" && !Array.isArray(storedNames)) names = storedNames;
       } catch {
       }
     }
-    const channel = outputChannels.find((item) => item.id === channelId);
-    const references = channelId && controllerId ? await this.references(controllerId, channelId, resourceId) : [];
+    const channel = outputChannels.find((item) => item.id === channelId2);
+    const references = channelId2 && controllerId ? await this.references(controllerId, channelId2, resourceId) : [];
     const properties = {
       controllerId: {
         type: "number",
@@ -53925,10 +53925,10 @@ var WagoCommandHandler = class {
           title: controller.name ?? controller.hardwareId
         })),
         refreshesSchema: true,
-        description: controllerId && !revision ? "Publish a configuration and wait for the controller to apply it before authoring commands." : void 0
+        description: controllerId && !revision2 ? "Publish a configuration and wait for the controller to apply it before authoring commands." : void 0
       }
     };
-    if (controllerId && revision && snapshot) {
+    if (controllerId && revision2 && snapshot) {
       properties.channelId = {
         type: "string",
         title: "Logical Channel",
@@ -53956,7 +53956,7 @@ var WagoCommandHandler = class {
       properties.expectedConfigurationRevision = {
         type: "number",
         title: "Configuration revision",
-        default: revision.revision,
+        default: revision2.revision,
         readOnly: true
       };
       properties.completionBehavior = {
@@ -54007,7 +54007,7 @@ var WagoCommandHandler = class {
   async validate(config, validationContext = /* @__PURE__ */ new Map()) {
     const parsed = this.parse(config);
     if ("errors" in parsed) return parsed.errors;
-    const { controllerId, channelId, action, expectedConfigurationRevision } = parsed.value;
+    const { controllerId, channelId: channelId2, action, expectedConfigurationRevision } = parsed.value;
     const controller = await this.cached(
       validationContext,
       `wago-controller:${controllerId}`,
@@ -54015,21 +54015,21 @@ var WagoCommandHandler = class {
     );
     if (!controller || controller.trustState !== "claimed")
       return [{ field: "controllerId", message: "Select a claimed WAGO controller." }];
-    const revision = await this.cached(
+    const revision2 = await this.cached(
       validationContext,
       `wago-applied-revision:${controllerId}`,
       () => this.dependencies.appliedRevision(controllerId)
     );
-    if (!revision) return [{ field: "controllerId", message: "The controller has no applied configuration revision." }];
-    if (revision.revision !== expectedConfigurationRevision)
+    if (!revision2) return [{ field: "controllerId", message: "The controller has no applied configuration revision." }];
+    if (revision2.revision !== expectedConfigurationRevision)
       return [
         {
           field: "expectedConfigurationRevision",
           message: "The controller configuration changed. Reopen the node and save the current revision."
         }
       ];
-    const snapshot = JSON.parse(revision.snapshot);
-    const channel = snapshot.logicalChannels.find((item) => item.id === channelId);
+    const snapshot = JSON.parse(revision2.snapshot);
+    const channel = snapshot.logicalChannels.find((item) => item.id === channelId2);
     if (!channel) return [{ field: "channelId", message: "The selected Logical Channel no longer exists." }];
     if (!channel.capabilities.includes("output"))
       return [{ field: "channelId", message: "The selected Logical Channel no longer supports output commands." }];
@@ -54051,7 +54051,7 @@ var WagoCommandHandler = class {
       throw new WagoCommandError(parsed.errors.map((error) => error.message).join(" "), "controller-rejection");
     const {
       controllerId,
-      channelId,
+      channelId: channelId2,
       action,
       value,
       expectedConfigurationRevision,
@@ -54063,11 +54063,11 @@ var WagoCommandHandler = class {
       throw new WagoCommandError(`WAGO controller ${controllerId} has no MQTT server`, "transport-dispatch");
     const settings = await this.dependencies.getSettings();
     const id = commandId;
-    this.dependencies.onCommand?.(controllerId, channelId, id);
+    this.dependencies.onCommand?.(controllerId, channelId2, id);
     const command = JSON.stringify({
       id,
       expiresAt: new Date(Date.now() + acknowledgementTimeoutSeconds * 1e3).toISOString(),
-      channelId,
+      channelId: channelId2,
       action,
       ...action === "set" ? { value } : {},
       expectedConfigurationRevision
@@ -54134,22 +54134,22 @@ var WagoCommandHandler = class {
       this.pending.delete(id);
     }
   }
-  async references(controllerId, channelId, resourceId) {
-    const nodes = await this.dependencies.context.dataSource.getRepository(import_plugins_backend_sdk7.ResourceFlowNode).createQueryBuilder("node").select(["node.id", "node.resourceId"]).where("node.type = :type", { type: "plugin.wago.command" }).andWhere("node.resourceId <> :resourceId", { resourceId }).andWhere("node.data ->> 'controllerId' = :controllerId", { controllerId }).andWhere("node.data ->> 'channelId' = :channelId", { channelId }).getMany();
+  async references(controllerId, channelId2, resourceId) {
+    const nodes = await this.dependencies.context.dataSource.getRepository(import_plugins_backend_sdk7.ResourceFlowNode).createQueryBuilder("node").select(["node.id", "node.resourceId"]).where("node.type = :type", { type: "plugin.wago.command" }).andWhere("node.resourceId <> :resourceId", { resourceId }).andWhere("node.data ->> 'controllerId' = :controllerId", { controllerId }).andWhere("node.data ->> 'channelId' = :channelId", { channelId: channelId2 }).getMany();
     return nodes.map((node) => `resource ${node.resourceId} / node ${node.id}`);
   }
   parse(config) {
     const errors = [];
     const controllerId = positiveInteger2(config.controllerId);
     const expectedConfigurationRevision = positiveInteger2(config.expectedConfigurationRevision);
-    const channelId = typeof config.channelId === "string" && config.channelId.trim() ? config.channelId : void 0;
+    const channelId2 = typeof config.channelId === "string" && config.channelId.trim() ? config.channelId : void 0;
     const action = config.action === "set" || config.action === "pulse" ? config.action : void 0;
     const completionBehavior = config.completionBehavior === "dispatch" ? "dispatch" : "acknowledged";
     const parsedTimeout = positiveInteger2(config.acknowledgementTimeoutSeconds);
     const acknowledgementTimeoutSeconds = parsedTimeout ?? DEFAULT_COMMAND_TIMEOUT_SECONDS;
     if (!controllerId)
       errors.push({ field: "controllerId", message: "A WAGO controller is required.", value: config.controllerId });
-    if (!channelId)
+    if (!channelId2)
       errors.push({ field: "channelId", message: "A Logical Channel is required.", value: config.channelId });
     if (!action) errors.push({ field: "action", message: "A supported operation is required.", value: config.action });
     if (action === "set" && typeof config.value !== "boolean")
@@ -54188,7 +54188,7 @@ var WagoCommandHandler = class {
     return {
       value: {
         controllerId,
-        channelId,
+        channelId: channelId2,
         action,
         ...action === "set" ? { value: config.value } : {},
         expectedConfigurationRevision,
@@ -54396,16 +54396,16 @@ var WagoDiagnosticsStore = class {
     if (copy.rejection && Date.parse(copy.rejection.receivedAt) < cutoff) delete copy.rejection;
     return copy;
   }
-  command(controllerId, channelId, id) {
+  command(controllerId, channelId2, id) {
     this.prune();
-    if (!identifier(channelId) || !identifier(id)) return;
+    if (!identifier(channelId2) || !identifier(id)) return;
     if (!this.controllers.has(controllerId) && this.controllers.size >= MAX_CONTROLLERS) return;
     const state = this.read(controllerId);
     state.touched = this.now();
     this.controllers.set(controllerId, state);
     const oldest = this.commands.keys().next().value;
     if (this.commands.size >= 1024 && oldest !== void 0) this.commands.delete(oldest);
-    this.commands.set(id, { controllerId, channelId, at: this.now() });
+    this.commands.set(id, { controllerId, channelId: channelId2, at: this.now() });
   }
   commandFailed(id, status) {
     this.prune();
@@ -54522,15 +54522,15 @@ var WagoDiagnosticsStore = class {
       state.hardwareAvailable = hardwareAvailable;
       state.stateSourceAt = canonical ? data.timestamp : void 0;
       if (data.outputs && typeof data.outputs === "object" && !Array.isArray(data.outputs)) {
-        for (const [channelId, value] of Object.entries(data.outputs).slice(0, MAX_CHANNELS)) {
-          if (identifier(channelId) && typeof value === "boolean")
-            state.outputs[channelId] = { kind: "output", value, ...metadata2 };
+        for (const [channelId2, value] of Object.entries(data.outputs).slice(0, MAX_CHANNELS)) {
+          if (identifier(channelId2) && typeof value === "boolean")
+            state.outputs[channelId2] = { kind: "output", value, ...metadata2 };
         }
       }
       if (isObject(data.inputs))
-        for (const [channelId, value] of Object.entries(data.inputs).slice(0, MAX_CHANNELS)) {
-          if (identifier(channelId) && typeof value === "boolean")
-            state.inputs[channelId] = { kind: "input", value, ...metadata2 };
+        for (const [channelId2, value] of Object.entries(data.inputs).slice(0, MAX_CHANNELS)) {
+          if (identifier(channelId2) && typeof value === "boolean")
+            state.inputs[channelId2] = { kind: "input", value, ...metadata2 };
         }
     }
     if (kind === "measurements" && identifier(data.channelId) && typeof data.value === "number" && Number.isFinite(data.value) && (canonical ? CANONICAL_UNITS : ["ampere", "volt", "watt", "percent"]).includes(data.unit)) {
@@ -54618,7 +54618,7 @@ var WagoService = class {
       claimedController: (id) => this.claimedController(id),
       getSettings: () => this.getSettings(),
       appliedRevision: (id) => this.appliedRevision(id),
-      onCommand: (controllerId, channelId, id) => this.diagnostics.command(controllerId, channelId, id),
+      onCommand: (controllerId, channelId2, id) => this.diagnostics.command(controllerId, channelId2, id),
       onCommandFailure: (id, status) => this.diagnostics.commandFailed(id, status)
     }));
     __publicField(this, "claimConfigurationLock", Promise.resolve());
@@ -54754,12 +54754,12 @@ var WagoService = class {
   }
   async getConfigurationBaseline(controllerId) {
     await this.claimedController(controllerId);
-    const [revision] = await this.revisions.find({
+    const [revision2] = await this.revisions.find({
       where: { controllerId, state: "applied" },
       order: { revision: "DESC" },
       take: 1
     });
-    return revision ?? null;
+    return revision2 ?? null;
   }
   async saveDraft(controllerId, snapshot, metadata2, principal, expectedDraft) {
     return this.withConfigurationLock(controllerId, async () => {
@@ -54953,12 +54953,12 @@ var WagoService = class {
       () => this.publishDraftWhileLocked(controllerId, force, reviewedHash, principal)
     );
   }
-  async rollback(controllerId, revision, force = false, sourceHash, currentHash, draftHash, principal) {
+  async rollback(controllerId, revision2, force = false, sourceHash, currentHash, draftHash, principal) {
     return this.withConfigurationLock(controllerId, async () => {
       const controller = await this.claimedController(controllerId);
       this.requireConfigurationCompatibility(controller);
-      const source = await this.revisions.findOneBy({ controllerId, revision });
-      if (!source) throw new import_common3.NotFoundException(`WAGO configuration revision ${revision} not found`);
+      const source = await this.revisions.findOneBy({ controllerId, revision: revision2 });
+      if (!source) throw new import_common3.NotFoundException(`WAGO configuration revision ${revision2} not found`);
       const current = await this.latestRevision(controllerId);
       const draft = await this.drafts.findOneBy({ controllerId });
       const snapshot = JSON.parse(source.snapshot);
@@ -54981,7 +54981,7 @@ var WagoService = class {
           impacts: approvedImpacts
         });
       let allocatedRevision;
-      const lifecycle = principal ? new WagoAudit(this.context).begin(principal, controllerId, "rollback", { sourceRevision: revision }) : void 0;
+      const lifecycle = principal ? new WagoAudit(this.context).begin(principal, controllerId, "rollback", { sourceRevision: revision2 }) : void 0;
       const persist = async () => {
         assertPreview(
           await configurationFlowImpacts(
@@ -55015,11 +55015,11 @@ var WagoService = class {
       return this.auditRevision(lifecycle, persist, () => allocatedRevision);
     });
   }
-  async acknowledgeRejection(controllerId, revision, expected, principal) {
+  async acknowledgeRejection(controllerId, revision2, expected, principal) {
     return this.withConfigurationLock(controllerId, async () => {
       await this.claimedController(controllerId);
-      const rejected = await this.revisions.findOneBy({ controllerId, revision });
-      if (!rejected) throw new import_common3.NotFoundException(`WAGO configuration revision ${revision} not found`);
+      const rejected = await this.revisions.findOneBy({ controllerId, revision: revision2 });
+      if (!rejected) throw new import_common3.NotFoundException(`WAGO configuration revision ${revision2} not found`);
       if (rejected.state !== "rejected" || !rejected.reportedAt || expected.contentHash !== rejected.contentHash || expected.reportedAt !== rejected.reportedAt)
         throw new import_common3.ConflictException("rejection changed; refresh and review it before acknowledging");
       if (rejected.rejectionAcknowledgedAt) return rejected;
@@ -55027,7 +55027,7 @@ var WagoService = class {
         principal,
         controllerId,
         "rejection_acknowledgement",
-        { revision },
+        { revision: revision2 },
         async () => {
           return this.revisions.save({
             ...rejected,
@@ -55038,11 +55038,11 @@ var WagoService = class {
       );
     });
   }
-  async previewRevision(controllerId, revision) {
+  async previewRevision(controllerId, revision2) {
     return this.withConfigurationLock(controllerId, async () => {
       await this.claimedController(controllerId);
-      const selected = await this.revisions.findOneBy({ controllerId, revision });
-      if (!selected) throw new import_common3.NotFoundException(`WAGO configuration revision ${revision} not found`);
+      const selected = await this.revisions.findOneBy({ controllerId, revision: revision2 });
+      if (!selected) throw new import_common3.NotFoundException(`WAGO configuration revision ${revision2} not found`);
       const [current] = await this.revisions.find({ where: { controllerId }, order: { revision: "DESC" }, take: 1 });
       const draft = await this.drafts.findOneBy({ controllerId });
       const impacts = await configurationFlowImpacts(
@@ -55064,8 +55064,8 @@ var WagoService = class {
       };
     });
   }
-  revisionIdentity(revision) {
-    return revision ? { revision: revision.revision, contentHash: revision.contentHash, metadata: revision.presetProvenance ?? null } : null;
+  revisionIdentity(revision2) {
+    return revision2 ? { revision: revision2.revision, contentHash: revision2.contentHash, metadata: revision2.presetProvenance ?? null } : null;
   }
   impactIdentity(impacts) {
     return impacts.map((impact) => ({
@@ -55184,17 +55184,17 @@ var WagoService = class {
     if (impacts.length && !force)
       throw new import_common3.ConflictException({ message: "acknowledge potential flow impacts before publishing", impacts });
     let allocatedRevision;
-    const dispatch = (revision) => {
-      allocatedRevision = revision.revision;
-      onAllocated?.(revision.revision);
-      return this.publishRevision(controller, revision);
+    const dispatch = (revision2) => {
+      allocatedRevision = revision2.revision;
+      onAllocated?.(revision2.revision);
+      return this.publishRevision(controller, revision2);
     };
     const lifecycle = principal ? new WagoAudit(this.context).begin(principal, controllerId, force ? "forced_publication" : "publication") : void 0;
     const persist = async () => {
       if (preparedDraft) await this.drafts.save(preparedDraft);
       if (previous?.state === "pending" && previous.contentHash === contentHash && (previous.presetProvenance ?? null) === (draft.presetProvenance ?? null))
         return dispatch(previous);
-      const revision = this.revisions.create({
+      const revision2 = this.revisions.create({
         controllerId,
         revision: (previous?.revision ?? 0) + 1,
         snapshot: draft.snapshot,
@@ -55205,7 +55205,7 @@ var WagoService = class {
         publishedAt: (/* @__PURE__ */ new Date()).toISOString(),
         reportedAt: null
       });
-      return dispatch(await this.revisions.save(revision));
+      return dispatch(await this.revisions.save(revision2));
     };
     return this.auditRevision(lifecycle, persist, () => allocatedRevision);
   }
@@ -55221,8 +55221,8 @@ var WagoService = class {
     }
   }
   async latestRevision(controllerId) {
-    const [revision] = await this.revisions.find({ where: { controllerId }, order: { revision: "DESC" }, take: 1 });
-    return revision ?? null;
+    const [revision2] = await this.revisions.find({ where: { controllerId }, order: { revision: "DESC" }, take: 1 });
+    return revision2 ?? null;
   }
   async createEnrollment(hardwareId, mqttServerId, manualCredentials, assertOwned = async () => void 0) {
     const normalizedHardwareId = hardwareId.trim();
@@ -55861,13 +55861,13 @@ var WagoService = class {
       return;
     }
     await this.withConfigurationLock(controllerId, async () => {
-      const revision = await this.revisions.findOneBy({ controllerId, revision: report.revision });
-      if (!revision || revision.contentHash !== report.contentHash) return;
-      if (revision.state !== "published") return;
-      revision.state = report.errors.length ? "rejected" : "applied";
-      revision.rejectionErrors = report.errors.length ? JSON.stringify(report.errors) : null;
-      revision.reportedAt = (/* @__PURE__ */ new Date()).toISOString();
-      await this.revisions.save(revision);
+      const revision2 = await this.revisions.findOneBy({ controllerId, revision: report.revision });
+      if (!revision2 || revision2.contentHash !== report.contentHash) return;
+      if (revision2.state !== "published") return;
+      revision2.state = report.errors.length ? "rejected" : "applied";
+      revision2.rejectionErrors = report.errors.length ? JSON.stringify(report.errors) : null;
+      revision2.reportedAt = (/* @__PURE__ */ new Date()).toISOString();
+      await this.revisions.save(revision2);
     });
   }
   onCommandAcknowledgement(controllerId, payload) {
@@ -55877,8 +55877,8 @@ var WagoService = class {
     const queue = this.configurationReportQueues.get(controllerId) ?? { pending: /* @__PURE__ */ new Map(), processing: false };
     this.configurationReportQueues.set(controllerId, queue);
     if (queue.processing) {
-      const revision = this.configurationReportRevision(payload);
-      const key = revision ?? Number.NaN;
+      const revision2 = this.configurationReportRevision(payload);
+      const key = revision2 ?? Number.NaN;
       if (queue.pending.has(key) || queue.pending.size < MAX_PENDING_CONFIGURATION_REPORTS)
         queue.pending.set(key, payload);
       else this.context.logger.warn(`Dropping excess WAGO configuration report for controller ${controllerId}`);
@@ -55898,8 +55898,8 @@ var WagoService = class {
       const pending = queue.pending.entries().next();
       if (pending.done) next = null;
       else {
-        const [revision, report] = pending.value;
-        queue.pending.delete(revision);
+        const [revision2, report] = pending.value;
+        queue.pending.delete(revision2);
         next = report;
       }
     }
@@ -55914,7 +55914,7 @@ var WagoService = class {
       return null;
     }
   }
-  async publishRevision(controller, revision) {
+  async publishRevision(controller, revision2) {
     if (!controller.mqttServerId) throw new import_common3.ConflictException(`WAGO controller ${controller.id} has no MQTT server`);
     const incompatibility = compatibilityError({
       protocolVersion: controller.protocolVersion,
@@ -55927,14 +55927,14 @@ var WagoService = class {
       configurationDesiredTopic(settings.operationalPrefix ?? "attraccess/wago", controller.hardwareId),
       JSON.stringify({
         protocolVersion: CONFIGURATION_PROTOCOL_VERSION,
-        revision: revision.revision,
-        contentHash: revision.contentHash,
-        snapshot: JSON.parse(revision.snapshot)
+        revision: revision2.revision,
+        contentHash: revision2.contentHash,
+        snapshot: JSON.parse(revision2.snapshot)
       }),
       { qos: 1, retain: true }
     );
-    revision.state = "published";
-    return this.revisions.save(revision);
+    revision2.state = "published";
+    return this.revisions.save(revision2);
   }
   connectivity(controller) {
     if (controller.trustState === "untrusted") return "untrusted";
@@ -55942,12 +55942,12 @@ var WagoService = class {
     return freshness(heartbeatAt, Date.now(), STALE_AFTER_MS) === "fresh" ? "online" : "stale";
   }
   async appliedRevision(controllerId) {
-    const [revision] = await this.revisions.find({
+    const [revision2] = await this.revisions.find({
       where: { controllerId, state: "applied" },
       order: { revision: "DESC" },
       take: 1
     });
-    return revision ?? null;
+    return revision2 ?? null;
   }
   matchesVerifier(controller, verifier) {
     const value = verifier.trim();
@@ -57008,11 +57008,11 @@ var WagoCredentialRotationService = class {
     try {
       let row = previous;
       if (!retry) {
-        const revision = (previous?.revision ?? 0) + 1;
-        if (!Number.isSafeInteger(revision)) throw new import_common4.ConflictException("Credential rotation revision exhausted.");
+        const revision2 = (previous?.revision ?? 0) + 1;
+        if (!Number.isSafeInteger(revision2)) throw new import_common4.ConflictException("Credential rotation revision exhausted.");
         row = this.repository.create({
           controllerId,
-          revision,
+          revision: revision2,
           credentialEpoch,
           phase: "provisioning",
           mqttServerId: controller.mqttServerId,
@@ -57146,7 +57146,7 @@ async function commissioningVerification(context, session, runtime) {
     mqttServerId: session.mqttServerId
   });
   const enrollment = session.enrollmentId === null ? null : await context.getRepository(WagoEnrollment).findOneBy({ id: session.enrollmentId });
-  const revision = controller ? await context.getRepository(WagoConfigurationRevision).findOne({
+  const revision2 = controller ? await context.getRepository(WagoConfigurationRevision).findOne({
     where: { controllerId: controller.id },
     order: { revision: "DESC" }
   }) : null;
@@ -57157,7 +57157,7 @@ async function commissioningVerification(context, session, runtime) {
   const runtimeFresh = Boolean(
     runtime && runtime.timestamp >= Date.parse(session.createdAt) && Date.now() - runtime.timestamp < 9e4 && runtime.timestamp <= Date.now()
   );
-  const hardwareReadiness = !runtime ? "unverified" : !runtimeFresh ? "stale" : runtime.connected && runtime.ready && runtime.hardwareAvailable && runtime.configurationAccepted && revision?.state === "applied" && runtime.revision === revision.revision && runtime.contentHash === revision.contentHash ? "ready" : "not_ready";
+  const hardwareReadiness = !runtime ? "unverified" : !runtimeFresh ? "stale" : runtime.connected && runtime.ready && runtime.hardwareAvailable && runtime.configurationAccepted && revision2?.state === "applied" && runtime.revision === revision2.revision && runtime.contentHash === revision2.contentHash ? "ready" : "not_ready";
   return {
     controllerId: controller?.trustState === "claimed" && controller.enrollmentId === session.enrollmentId ? controller.id : null,
     permanentConnection,
@@ -57165,7 +57165,7 @@ async function commissioningVerification(context, session, runtime) {
       enrollment?.revokedAt && enrollment.hardwareId === session.hardwareId && enrollment.mqttServerId === session.mqttServerId
     ),
     configurationApplied: Boolean(
-      revision?.state === "applied" && revision.reportedAt && Date.parse(revision.reportedAt) >= Date.parse(session.createdAt)
+      revision2?.state === "applied" && revision2.reportedAt && Date.parse(revision2.reportedAt) >= Date.parse(session.createdAt)
     ),
     // No qualified firmware-31 management transition or hardware health evidence exists yet.
     // Never turn a successful claim publication into a hardened-device success signal.
@@ -61964,10 +61964,10 @@ var WagoControllerApi = class {
   publishDraft(id, request, body) {
     return this.wago.publishDraft(id, body?.force === true, body?.reviewedHash, wagoAuditPrincipal(request));
   }
-  rollback(id, revision, request, body) {
+  rollback(id, revision2, request, body) {
     return this.wago.rollback(
       id,
-      revision,
+      revision2,
       body?.force === true,
       body?.sourceHash,
       body?.currentHash,
@@ -61975,11 +61975,11 @@ var WagoControllerApi = class {
       wagoAuditPrincipal(request)
     );
   }
-  acknowledgeRejection(id, revision, request, body) {
-    return this.wago.acknowledgeRejection(id, revision, body ?? {}, wagoAuditPrincipal(request));
+  acknowledgeRejection(id, revision2, request, body) {
+    return this.wago.acknowledgeRejection(id, revision2, body ?? {}, wagoAuditPrincipal(request));
   }
-  previewRevision(id, revision) {
-    return this.wago.previewRevision(id, revision);
+  previewRevision(id, revision2) {
+    return this.wago.previewRevision(id, revision2);
   }
 };
 __decorateClass([
@@ -62430,19 +62430,19 @@ var import_plugins_backend_sdk17 = require("@attraccess/plugins-backend-sdk");
 function own(values, key) {
   return Object.prototype.hasOwnProperty.call(values, key) ? values[key] : void 0;
 }
-function diagnosticReferences(nodes, channelIds, revision, capabilities) {
+function diagnosticReferences(nodes, channelIds, revision2, capabilities) {
   return nodes.map((node) => {
-    const channelId = typeof node.data.channelId === "string" ? node.data.channelId : "";
+    const channelId2 = typeof node.data.channelId === "string" ? node.data.channelId : "";
     const control = node.type === "plugin.wago.command";
     return {
       nodeId: node.id,
       resourceId: node.resourceId,
-      channelId,
+      channelId: channelId2,
       control,
       href: `/resources/${node.resourceId}/flows?node=${encodeURIComponent(node.id)}`,
-      invalid: !channelIds.includes(channelId) || control && (node.data.expectedConfigurationRevision !== revision || capabilities && (!own(capabilities, channelId)?.includes("output") || node.data.action === "pulse" && !own(capabilities, channelId)?.includes("pulse"))),
+      invalid: !channelIds.includes(channelId2) || control && (node.data.expectedConfigurationRevision !== revision2 || capabilities && (!own(capabilities, channelId2)?.includes("output") || node.data.action === "pulse" && !own(capabilities, channelId2)?.includes("pulse"))),
       conflict: control && nodes.some(
-        (other) => other.type === "plugin.wago.command" && other.resourceId !== node.resourceId && other.data.channelId === channelId
+        (other) => other.type === "plugin.wago.command" && other.resourceId !== node.resourceId && other.data.channelId === channelId2
       )
     };
   });
@@ -62470,7 +62470,7 @@ var WagoDiagnosticsService = class {
     const localNodes = nodes.slice(0, 1e3);
     const localChannelIds = [
       ...new Set(
-        localNodes.map((node) => node.data.channelId).filter((channelId) => typeof channelId === "string")
+        localNodes.map((node) => node.data.channelId).filter((channelId2) => typeof channelId2 === "string")
       )
     ];
     const controllerIdsForQuery = selectedControllerIds;
@@ -62482,7 +62482,7 @@ var WagoDiagnosticsService = class {
       localChannelIds.length ? this.context.dataSource.getRepository(import_plugins_backend_sdk17.ResourceFlowNode).createQueryBuilder("node").where("node.data ->> 'controllerId' IN (:...controllerIds)", { controllerIds: controllerIdsForQuery }).andWhere("node.data ->> 'channelId' IN (:...channelIds)", { channelIds: localChannelIds }).andWhere("node.type = :type", { type: "plugin.wago.command" }).take(1001).getMany() : Promise.resolve([])
     ]);
     const controllersById = new Map(controllers.map((controller) => [controller.id, controller]));
-    const appliedByControllerId = new Map(appliedRevisions.map((revision) => [revision.controllerId, revision]));
+    const appliedByControllerId = new Map(appliedRevisions.map((revision2) => [revision2.controllerId, revision2]));
     const referencesTruncated = conflictNodes.length > 1e3;
     const conflictNodesByControllerId = /* @__PURE__ */ new Map();
     for (const node of conflictNodes.slice(0, 1e3)) {
@@ -62620,7 +62620,7 @@ var WagoDiagnosticsService = class {
           acknowledgement: own(runtime.acknowledgements, channel.id) ?? null
         };
       }),
-      faults: Object.entries(runtime.faults).map(([channelId, fault]) => ({ channelId, ...fault })),
+      faults: Object.entries(runtime.faults).map(([channelId2, fault]) => ({ channelId: channelId2, ...fault })),
       references,
       referencesTruncated: nodes.length > 1e3,
       events: runtime.events,
@@ -62804,7 +62804,7 @@ var WagoFlowService = class {
     for (const id of this.streams.keys()) if (!controllerIds.has(id)) this.streams.delete(id);
     this.channelCache.clear();
     const revisions = await this.loadLatestAppliedRevisions(controllers.map((controller) => controller.id));
-    for (const revision of revisions) this.cacheChannels(revision);
+    for (const revision2 of revisions) this.cacheChannels(revision2);
     for (const controller of controllers)
       if (!this.channelCache.has(controller.id)) this.channelCache.set(controller.id, []);
     const validChannels = new Map(
@@ -62851,7 +62851,7 @@ var WagoFlowService = class {
       () => this.controllers.find({ where: { trustState: "claimed" }, order: { name: "ASC" } })
     );
     const selected = typeof config.controllerId === "number" ? controllers.find((controller) => controller.id === config.controllerId) : void 0;
-    const revision = selected ? await this.cached(validationContext, `wago-applied-revision:${selected.id}`, async () => {
+    const revision2 = selected ? await this.cached(validationContext, `wago-applied-revision:${selected.id}`, async () => {
       const [latest] = await this.revisions.find({
         where: { controllerId: selected.id, state: "applied" },
         order: { revision: "DESC" },
@@ -62859,10 +62859,10 @@ var WagoFlowService = class {
       });
       return latest ?? null;
     }) : null;
-    const channels = revision ? JSON.parse(revision.snapshot).logicalChannels : [];
+    const channels = revision2 ? JSON.parse(revision2.snapshot).logicalChannels : [];
     let names = {};
     try {
-      names = JSON.parse(revision?.presetProvenance ?? "null")?.editor?.names ?? {};
+      names = JSON.parse(revision2?.presetProvenance ?? "null")?.editor?.names ?? {};
     } catch {
     }
     const channel = channels.find((item) => item.id === config.channelId);
@@ -62875,7 +62875,7 @@ var WagoFlowService = class {
           const: controller.id,
           title: controller.name ?? controller.hardwareId
         })),
-        description: selected && !revision ? "Publish a configuration and wait for the controller to apply it first." : void 0
+        description: selected && !revision2 ? "Publish a configuration and wait for the controller to apply it first." : void 0
       },
       channelId: {
         type: "string",
@@ -63081,11 +63081,11 @@ var WagoFlowService = class {
       this.store(controller, event.channelId, event, event.category === "measurement" ? event.value : event);
     }
   }
-  store(controller, channelId, event, value) {
+  store(controller, channelId2, event, value) {
     const state = {
       controllerId: controller.id,
       hardwareId: controller.hardwareId,
-      channelId,
+      channelId: channelId2,
       category: event.category,
       value,
       timestamp: event.timestamp,
@@ -63097,7 +63097,7 @@ var WagoFlowService = class {
       offline: this.offlineControllers.has(controller.id),
       invalidated: this.unavailableHardware.has(controller.id) || this.unavailableConfiguration.has(controller.id) || Date.parse(event.timestamp) < (this.streams.get(controller.id)?.sampleNotBefore ?? 0)
     };
-    const cacheKey = this.cacheKey(controller.id, channelId, event.category);
+    const cacheKey = this.cacheKey(controller.id, channelId2, event.category);
     const previous = this.cache.get(cacheKey);
     this.cache.set(cacheKey, state);
     if (this.cache.size > MAX_CACHE_ENTRIES) {
@@ -63115,16 +63115,16 @@ var WagoFlowService = class {
   async channels(controllerId) {
     const cached = this.channelCache.get(controllerId);
     if (cached) return cached;
-    const [revision] = await this.revisions.find({
+    const [revision2] = await this.revisions.find({
       where: { controllerId, state: "applied" },
       order: { revision: "DESC" },
       take: 1
     });
-    if (!revision) {
+    if (!revision2) {
       this.channelCache.set(controllerId, []);
       return [];
     }
-    return this.cacheChannels(revision);
+    return this.cacheChannels(revision2);
   }
   async loadLatestAppliedRevisions(controllerIds) {
     if (!controllerIds.length) return [];
@@ -63134,28 +63134,28 @@ var WagoFlowService = class {
       "latest.controllerId = revision.controllerId AND latest.revision = revision.revision"
     ).where("revision.state = :state", { state: "applied" }).getMany();
   }
-  cacheChannels(revision) {
+  cacheChannels(revision2) {
     try {
-      const channels = JSON.parse(revision.snapshot).logicalChannels;
-      const previous = this.appliedConfigurations.get(revision.controllerId);
-      if (previous?.revision !== revision.revision || previous?.contentHash !== revision.contentHash) {
-        this.unavailableConfiguration.add(revision.controllerId);
+      const channels = JSON.parse(revision2.snapshot).logicalChannels;
+      const previous = this.appliedConfigurations.get(revision2.controllerId);
+      if (previous?.revision !== revision2.revision || previous?.contentHash !== revision2.contentHash) {
+        this.unavailableConfiguration.add(revision2.controllerId);
         for (const state of this.cache.values())
-          if (state.controllerId === revision.controllerId) state.invalidated = true;
+          if (state.controllerId === revision2.controllerId) state.invalidated = true;
       }
-      this.appliedConfigurations.set(revision.controllerId, {
-        revision: revision.revision,
-        contentHash: revision.contentHash
+      this.appliedConfigurations.set(revision2.controllerId, {
+        revision: revision2.revision,
+        contentHash: revision2.contentHash
       });
-      this.channelCache.set(revision.controllerId, channels);
+      this.channelCache.set(revision2.controllerId, channels);
       return channels;
     } catch {
-      this.channelCache.set(revision.controllerId, []);
+      this.channelCache.set(revision2.controllerId, []);
       return [];
     }
   }
-  cacheKey(controllerId, channelId, category) {
-    return `${controllerId}:${channelId}:${category}`;
+  cacheKey(controllerId, channelId2, category) {
+    return `${controllerId}:${channelId2}:${category}`;
   }
   categories(channel) {
     return [
@@ -63230,6 +63230,94 @@ WagoFlowService = __decorateClass([
   __decorateParam(0, (0, import_common13.Inject)(PLUGIN_CONTEXT5))
 ], WagoFlowService);
 
+// backend/wago-audit-policy.ts
+var summaryFields = {
+  "before.physicalPointCount": { type: "number", integer: true, min: 0 },
+  "before.logicalChannelCount": { type: "number", integer: true, min: 0 },
+  "after.physicalPointCount": { type: "number", integer: true, min: 0 },
+  "after.logicalChannelCount": { type: "number", integer: true, min: 0 }
+};
+var revision = { type: "number", integer: true, min: 1 };
+var channelId = { type: "string", pattern: "[a-zA-Z0-9_-]{1,64}" };
+var uuidPattern2 = "[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}";
+var controllerActions = [
+  { action: "wago.claim", subjectTypes: ["wago.controller"] },
+  { action: "wago.unclaim", subjectTypes: ["wago.controller"] },
+  { action: "wago.credential_rotation", subjectTypes: ["wago.controller"] },
+  { action: "wago.manual_credential_fallback", subjectTypes: ["wago.controller"] },
+  { action: "wago.publication", subjectTypes: ["wago.controller"], details: { revision } },
+  { action: "wago.forced_publication", subjectTypes: ["wago.controller"], details: { revision } },
+  {
+    action: "wago.rollback",
+    subjectTypes: ["wago.controller"],
+    details: { sourceRevision: revision, revision }
+  },
+  { action: "wago.rejection_acknowledgement", subjectTypes: ["wago.controller"], details: { revision } },
+  {
+    action: "wago.preset_application",
+    subjectTypes: ["wago.controller"],
+    details: {
+      presetId: { type: "string", oneOf: WAGO_PRESETS.map((preset) => preset.id) },
+      channelId,
+      ...summaryFields
+    }
+  },
+  {
+    action: "wago.preset_reapplication",
+    subjectTypes: ["wago.controller"],
+    details: {
+      presetId: { type: "string", oneOf: WAGO_PRESETS.map((preset) => preset.id) },
+      channelId,
+      ...summaryFields
+    }
+  },
+  {
+    action: "wago.profile_creation",
+    subjectTypes: ["wago.controller"],
+    details: {
+      profileId: { type: "string", maxLength: 160, pattern: "(?=[\\s\\S]*\\S)[\\s\\S]*" },
+      profileVersion: { type: "number", integer: true, min: 1, max: 1e6 },
+      ...summaryFields
+    }
+  },
+  {
+    action: "wago.profile_change",
+    subjectTypes: ["wago.controller"],
+    details: {
+      profileId: { type: "string", maxLength: 160, pattern: "(?=[\\s\\S]*\\S)[\\s\\S]*" },
+      profileVersion: { type: "number", integer: true, min: 1, max: 1e6 },
+      ...summaryFields
+    }
+  },
+  {
+    action: "wago.manual_command",
+    subjectTypes: ["wago.controller"],
+    details: {
+      channelId,
+      commandId: { type: "string", pattern: uuidPattern2 },
+      operation: { type: "string", oneOf: ["set", "pulse"] },
+      result: { type: "string", oneOf: ["dispatched", "acknowledged", "rejected", "timeout", "transport_failure"] }
+    }
+  }
+];
+var commissioningActions = [
+  "install",
+  "recover",
+  "security_inspect",
+  "security_review",
+  "security_apply",
+  "security_recover",
+  "platform_inspect",
+  "platform_activate",
+  "platform_recover",
+  "lease_recover"
+].map((action) => ({ action: `wago.commissioning.${action}`, subjectTypes: ["wago.commissioning"] }));
+var WAGO_AUDIT_DOMAIN = {
+  domain: "wago",
+  labels: { en: "WAGO controllers", de: "WAGO-Controller" },
+  actions: [...controllerActions, ...commissioningActions]
+};
+
 // backend/plugin.ts
 var PLUGIN_CONTEXT6 = /* @__PURE__ */ Symbol.for("attraccess.plugin.context");
 var WagoPluginModule = class {
@@ -63256,6 +63344,7 @@ var plugin = {
     createWagoCommandNode(() => services(context).command),
     ...createWagoStateNodes(() => services(context).state)
   ],
+  auditDomains: [WAGO_AUDIT_DOMAIN],
   register(context) {
     return {
       module: WagoPluginModule,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@attraccess/plugin-wago",
-  "version": "0.1.0-nightly.979.1",
+  "version": "0.1.0-nightly.981.1",
   "description": "Official Attraccess integration for WAGO CC100 controllers.",
   "keywords": [
     "attraccess-plugin",