@attraccess/plugin-wago 0.1.0-nightly.990.1 → 0.1.0-nightly.991.1

package/dist/index.js

@@ -52544,14 +52544,7 @@ function parseAnnouncement(payload) {
   return { ...heartbeat, pairingCode: input.pairingCode.trim() };
 }
 function parseHeartbeat(payload) {
-  let value;
-  try {
-    value = JSON.parse(payload.toString("utf8"));
-  } catch {
-    throw new Error("announcement is not valid JSON");
-  }
-  if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("announcement must be an object");
-  const input = value;
+  const input = parseObject(payload, "announcement");
   const required = ["hardwareId", "protocolVersion", "runtimeVersion"];
   for (const key of required)
     if (typeof input[key] !== "string" || !input[key].trim()) throw new Error(`announcement ${key} is required`);
@@ -52612,23 +52605,7 @@ function parseOperationalMessage(prefix, topic, payload) {
     throw new Error("operational streamId is invalid");
   const streamId = value.streamId;
   if (suffix === "state") {
-    if (typeof value.connected !== "boolean" || !isNullableInteger(value.revision) || !isNullableString(value.contentHash) || !isBooleanRecord(value.outputs) || value.inputs !== void 0 && !isBooleanRecord(value.inputs) || value.readiness !== void 0 && (!value.readiness || typeof value.readiness !== "object" || Array.isArray(value.readiness) || typeof value.readiness.hardwareAvailable !== "boolean"))
-      throw new Error("invalid state message");
-    return {
-      hardwareId,
-      message: {
-        category: "state",
-        timestamp,
-        streamId,
-        sequence,
-        connected: value.connected,
-        revision: value.revision,
-        contentHash: value.contentHash,
-        outputs: value.outputs,
-        ...value.inputs !== void 0 ? { inputs: value.inputs } : {},
-        ...value.readiness !== void 0 ? { readiness: { hardwareAvailable: value.readiness.hardwareAvailable } } : {}
-      }
-    };
+    return { hardwareId, message: parseStateMessage(value, { timestamp, streamId, sequence }) };
   }
   if (suffix === "measurements") {
     return {
@@ -52673,6 +52650,20 @@ function parseOperationalMessage(prefix, topic, payload) {
     }
   };
 }
+function parseStateMessage(value, envelope) {
+  if (typeof value.connected !== "boolean" || !isNullableInteger(value.revision) || !isNullableString(value.contentHash) || !isBooleanRecord(value.outputs) || value.inputs !== void 0 && !isBooleanRecord(value.inputs) || value.readiness !== void 0 && (!value.readiness || typeof value.readiness !== "object" || Array.isArray(value.readiness) || typeof value.readiness.hardwareAvailable !== "boolean"))
+    throw new Error("invalid state message");
+  return {
+    category: "state",
+    ...envelope,
+    connected: value.connected,
+    revision: value.revision,
+    contentHash: value.contentHash,
+    outputs: value.outputs,
+    ...value.inputs !== void 0 ? { inputs: value.inputs } : {},
+    ...value.readiness !== void 0 ? { readiness: { hardwareAvailable: value.readiness.hardwareAvailable } } : {}
+  };
+}
 function configurationReportedHardwareId(prefix, topic) {
   const topicPrefix = `${normalizeOperationalPrefix(prefix)}/v${CONFIGURATION_PROTOCOL_VERSION}/controllers/`;
   const topicSuffix = "/configuration/reported";
@@ -52973,30 +52964,33 @@ function validateModbusBindings(snapshot) {
     if (Array.isArray(snapshot.logicalChannels))
       for (const channel of snapshot.logicalChannels) {
         if (channel?.physicalPointId !== point.id) continue;
-        const capabilities = Array.isArray(channel.capabilities) ? channel.capabilities : [];
-        if (capabilities.includes("output") && action && device) {
-          for (let offset = 0; offset < registerCount(action); offset++) {
-            const key = JSON.stringify([
-              device.connectionId,
-              device.unitId,
-              action.functionCode === 5 ? "coil" : "register",
-              wireAddress(action) + offset
-            ]);
-            if (outputOwners.has(key)) fail("each physical Modbus output must have a single logical owner");
-            outputOwners.add(key);
-          }
-        }
-        if (capabilities.includes("input") && !capabilities.includes("measurement"))
-          fail(
-            measurement ? "Modbus register inputs require measurement capability and its named measurement transform" : "input requires named measurement"
-          );
-        if (capabilities.includes("output") && !action) fail("output requires named action");
-        if (capabilities.includes("measurement") && (!measurement || channel.measurement?.unit !== measurement.unit || (channel.measurement?.kind ?? "live") !== measurement.kind || channel.measurement?.scale !== 1 || channel.measurement?.offset !== 0))
-          fail("measurement channel must match profile unit/kind with identity transform");
+        validateChannelBinding(channel, measurement, action, device, outputOwners, fail);
       }
   }
   return errors;
 }
+function validateChannelBinding(channel, measurement, action, device, outputOwners, fail) {
+  const capabilities = Array.isArray(channel.capabilities) ? channel.capabilities : [];
+  if (capabilities.includes("output") && action && device) {
+    for (let offset = 0; offset < registerCount(action); offset++) {
+      const key = JSON.stringify([
+        device.connectionId,
+        device.unitId,
+        action.functionCode === 5 ? "coil" : "register",
+        wireAddress(action) + offset
+      ]);
+      if (outputOwners.has(key)) fail("each physical Modbus output must have a single logical owner");
+      outputOwners.add(key);
+    }
+  }
+  if (capabilities.includes("input") && !capabilities.includes("measurement"))
+    fail(
+      measurement ? "Modbus register inputs require measurement capability and its named measurement transform" : "input requires named measurement"
+    );
+  if (capabilities.includes("output") && !action) fail("output requires named action");
+  if (capabilities.includes("measurement") && (!measurement || channel.measurement?.unit !== measurement.unit || (channel.measurement?.kind ?? "live") !== measurement.kind || channel.measurement?.scale !== 1 || channel.measurement?.offset !== 0))
+    fail("measurement channel must match profile unit/kind with identity transform");
+}
 
 // backend/configuration.ts
 var HARDWARE_PROFILES = ["751-9301", "879-3000", "879-1300", "modbus"];
@@ -53897,13 +53891,7 @@ var WagoCommandHandler = class {
     __publicField(this, "dependencies", dependencies);
     __publicField(this, "pending", /* @__PURE__ */ new Map());
   }
-  async schema(config, resourceId) {
-    const controllers = await this.dependencies.controllers().find({ where: { trustState: "claimed" }, order: { name: "ASC" } });
-    const controllerId = positiveInteger2(config.controllerId);
-    const revision2 = controllerId ? await this.dependencies.appliedRevision(controllerId) : null;
-    const snapshot = revision2 ? JSON.parse(revision2.snapshot) : null;
-    const channelId2 = typeof config.channelId === "string" ? config.channelId : void 0;
-    const outputChannels = snapshot?.logicalChannels.filter((item) => item.capabilities.includes("output")) ?? [];
+  async channelNames(controllerId, revision2) {
     let names = {};
     if (controllerId) {
       const draft = await this.dependencies.context.getRepository(WagoConfigurationDraft).findOneBy({ controllerId });
@@ -53913,6 +53901,16 @@ var WagoCommandHandler = class {
       } catch {
       }
     }
+    return names;
+  }
+  async schema(config, resourceId) {
+    const controllers = await this.dependencies.controllers().find({ where: { trustState: "claimed" }, order: { name: "ASC" } });
+    const controllerId = positiveInteger2(config.controllerId);
+    const revision2 = controllerId ? await this.dependencies.appliedRevision(controllerId) : null;
+    const snapshot = revision2 ? JSON.parse(revision2.snapshot) : null;
+    const channelId2 = typeof config.channelId === "string" ? config.channelId : void 0;
+    const outputChannels = snapshot?.logicalChannels.filter((item) => item.capabilities.includes("output")) ?? [];
+    const names = await this.channelNames(controllerId, revision2);
     const channel = outputChannels.find((item) => item.id === channelId2);
     const references = channelId2 && controllerId ? await this.references(controllerId, channelId2, resourceId) : [];
     const properties = {
@@ -54345,6 +54343,30 @@ var faultCodes = /* @__PURE__ */ new Set([
 function identifier(value) {
   return typeof value === "string" && value.trim().length > 0 && value.length <= 256 && !Array.from(value).some((character) => character.charCodeAt(0) < 32);
 }
+function isObject(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function validStatePayload(data, kind, canonical) {
+  if (canonical && kind === "state" && data.readiness !== void 0 && (!isObject(data.readiness) || data.readiness.hardwareAvailable !== void 0 && typeof data.readiness.hardwareAvailable !== "boolean"))
+    return false;
+  if (canonical && kind === "state" && !(data.contentHash === null || typeof data.contentHash === "string" && /^[0-9a-f]{64}$/i.test(data.contentHash)))
+    return false;
+  if (canonical && kind === "state" && (typeof data.connected !== "boolean" || !(data.revision === null || Number.isSafeInteger(data.revision) && data.revision >= 0) || !isObject(data.outputs) || data.inputs !== void 0 && !isObject(data.inputs) || ![...Object.values(data.outputs), ...Object.values(isObject(data.inputs) ? data.inputs : {})].every(
+    (value) => typeof value === "boolean"
+  )))
+    return false;
+  return true;
+}
+function validEventPayload(data, kind, canonical) {
+  if (canonical && kind === "configuration/reported" && (!Number.isSafeInteger(data.revision) || data.revision < 1 || typeof data.contentHash !== "string" || !/^[0-9a-f]{64}$/i.test(data.contentHash) || !Array.isArray(data.errors)))
+    return false;
+  if (kind === "measurements" && (!identifier(data.channelId) || typeof data.value !== "number" || !Number.isFinite(data.value) || (canonical ? !Number.isSafeInteger(data.value) || !CANONICAL_UNITS.includes(data.unit) || !["live", "cumulative"].includes(data.kind) : !["ampere", "volt", "watt", "percent"].includes(data.unit))))
+    return false;
+  if (kind === "faults" && !identifier(data.channelId)) return false;
+  if (kind === "acknowledgements" && (!identifier(data.id) || !["accepted", "duplicate", "rejected"].includes(data.status)))
+    return false;
+  return true;
+}
 var WagoDiagnosticsStore = class {
   constructor(now = Date.now) {
     __publicField(this, "now", now);
@@ -54436,27 +54458,40 @@ var WagoDiagnosticsStore = class {
     if (!DIAGNOSTIC_CATEGORIES.includes(kind)) return false;
     const canonical = canonicalEnvelope(data, kind);
     if (canonical && !validEnvelope(data, this.now())) return false;
-    const isObject = (value) => !!value && typeof value === "object" && !Array.isArray(value);
-    if (canonical && kind === "state" && data.readiness !== void 0 && (!isObject(data.readiness) || data.readiness.hardwareAvailable !== void 0 && typeof data.readiness.hardwareAvailable !== "boolean"))
-      return false;
-    if (canonical && kind === "state" && !(data.contentHash === null || typeof data.contentHash === "string" && /^[0-9a-f]{64}$/i.test(data.contentHash)))
-      return false;
-    if (canonical && kind === "configuration/reported" && (!Number.isSafeInteger(data.revision) || data.revision < 1 || typeof data.contentHash !== "string" || !/^[0-9a-f]{64}$/i.test(data.contentHash) || !Array.isArray(data.errors)))
-      return false;
-    if (canonical && kind === "state" && (typeof data.connected !== "boolean" || !(data.revision === null || Number.isSafeInteger(data.revision) && data.revision >= 0) || !isObject(data.outputs) || data.inputs !== void 0 && !isObject(data.inputs) || ![...Object.values(data.outputs), ...Object.values(isObject(data.inputs) ? data.inputs : {})].every(
-      (value) => typeof value === "boolean"
-    )))
-      return false;
-    if (kind === "measurements" && (!identifier(data.channelId) || typeof data.value !== "number" || !Number.isFinite(data.value) || (canonical ? !Number.isSafeInteger(data.value) || !CANONICAL_UNITS.includes(data.unit) || !["live", "cumulative"].includes(data.kind) : !["ampere", "volt", "watt", "percent"].includes(data.unit))))
-      return false;
-    if (kind === "faults" && !identifier(data.channelId)) return false;
-    if (kind === "acknowledgements" && (!identifier(data.id) || !["accepted", "duplicate", "rejected"].includes(data.status)))
-      return false;
+    if (!validStatePayload(data, kind, canonical) || !validEventPayload(data, kind, canonical)) return false;
     const oldest = [...this.controllers].find(([, value]) => !value.activeStream)?.[0];
     if (!this.controllers.has(id) && this.controllers.size >= MAX_CONTROLLERS && oldest === void 0) return false;
     if (!this.controllers.has(id) && this.controllers.size >= MAX_CONTROLLERS && oldest !== void 0)
       this.controllers.delete(oldest);
     const state = this.read(id);
+    if (!this.admitIncoming(id, state, kind, data, canonical)) return false;
+    state.touched = this.now();
+    const receivedAt = new Date(this.now()).toISOString();
+    const metadata2 = {
+      sourceAt: canonical ? data.timestamp : null,
+      receivedAt,
+      streamId: canonical ? state.activeStream : null,
+      sequence: canonical ? data.sequence : null
+    };
+    if (kind === "heartbeat") state.heartbeatAt = canonical ? data.timestamp : receivedAt;
+    if (kind === "state") this.applyState(state, data, canonical, metadata2);
+    this.applyEvents(id, state, kind, data, canonical, metadata2);
+    for (const collection2 of [
+      state.cumulativeMeasurements,
+      state.inputs,
+      state.outputs,
+      state.measurements,
+      state.faults,
+      state.acknowledgements
+    ]) {
+      while (Object.keys(collection2).length > MAX_CHANNELS) delete collection2[Object.keys(collection2)[0]];
+    }
+    state.events.push({ kind, receivedAt });
+    state.events = state.events.slice(-50);
+    this.controllers.set(id, state);
+    return true;
+  }
+  admitIncoming(id, state, kind, data, canonical) {
     if (!canonical && kind === "heartbeat" && typeof data.sequence === "number") {
       if (data.sequence < (state.legacyHeartbeatSequence ?? 0)) return false;
       state.legacyHeartbeatSequence = data.sequence;
@@ -54496,43 +54531,38 @@ var WagoDiagnosticsStore = class {
       }
       return false;
     }
-    state.touched = this.now();
-    const receivedAt = new Date(this.now()).toISOString();
-    const metadata2 = {
-      sourceAt: canonical ? data.timestamp : null,
-      receivedAt,
-      streamId: canonical ? state.activeStream : null,
-      sequence: canonical ? data.sequence : null
-    };
-    if (kind === "heartbeat") state.heartbeatAt = canonical ? data.timestamp : receivedAt;
-    if (kind === "state") {
-      const contentHash = typeof data.contentHash === "string" && /^[0-9a-f]{64}$/i.test(data.contentHash) ? data.contentHash : void 0;
-      const hardwareAvailable = isObject(data.readiness) && typeof data.readiness.hardwareAvailable === "boolean" ? data.readiness.hardwareAvailable : void 0;
-      if (state.connected !== data.connected || state.revision !== data.revision || state.contentHash !== contentHash || state.hardwareAvailable !== hardwareAvailable) {
-        if (state.stateSourceAt || canonical && state.connected === false)
-          state.measurementAfter = canonical ? sourceTime(data.timestamp) : this.now();
-        state.measurements = /* @__PURE__ */ Object.create(null);
-        state.cumulativeMeasurements = /* @__PURE__ */ Object.create(null);
-      }
-      state.inputs = /* @__PURE__ */ Object.create(null);
-      state.outputs = /* @__PURE__ */ Object.create(null);
-      if (typeof data.connected === "boolean") state.connected = data.connected;
-      state.revision = Number.isSafeInteger(data.revision) ? data.revision : void 0;
-      state.contentHash = contentHash;
-      state.hardwareAvailable = hardwareAvailable;
-      state.stateSourceAt = canonical ? data.timestamp : void 0;
-      if (data.outputs && typeof data.outputs === "object" && !Array.isArray(data.outputs)) {
-        for (const [channelId2, value] of Object.entries(data.outputs).slice(0, MAX_CHANNELS)) {
-          if (identifier(channelId2) && typeof value === "boolean")
-            state.outputs[channelId2] = { kind: "output", value, ...metadata2 };
-        }
-      }
-      if (isObject(data.inputs))
-        for (const [channelId2, value] of Object.entries(data.inputs).slice(0, MAX_CHANNELS)) {
-          if (identifier(channelId2) && typeof value === "boolean")
-            state.inputs[channelId2] = { kind: "input", value, ...metadata2 };
-        }
-    }
+    return true;
+  }
+  applyState(state, data, canonical, metadata2) {
+    const contentHash = typeof data.contentHash === "string" && /^[0-9a-f]{64}$/i.test(data.contentHash) ? data.contentHash : void 0;
+    const hardwareAvailable = isObject(data.readiness) && typeof data.readiness.hardwareAvailable === "boolean" ? data.readiness.hardwareAvailable : void 0;
+    if (state.connected !== data.connected || state.revision !== data.revision || state.contentHash !== contentHash || state.hardwareAvailable !== hardwareAvailable) {
+      if (state.stateSourceAt || canonical && state.connected === false)
+        state.measurementAfter = canonical ? sourceTime(data.timestamp) : this.now();
+      state.measurements = /* @__PURE__ */ Object.create(null);
+      state.cumulativeMeasurements = /* @__PURE__ */ Object.create(null);
+    }
+    state.inputs = /* @__PURE__ */ Object.create(null);
+    state.outputs = /* @__PURE__ */ Object.create(null);
+    if (typeof data.connected === "boolean") state.connected = data.connected;
+    state.revision = Number.isSafeInteger(data.revision) ? data.revision : void 0;
+    state.contentHash = contentHash;
+    state.hardwareAvailable = hardwareAvailable;
+    state.stateSourceAt = canonical ? data.timestamp : void 0;
+    if (data.outputs && typeof data.outputs === "object" && !Array.isArray(data.outputs)) {
+      for (const [channelId2, value] of Object.entries(data.outputs).slice(0, MAX_CHANNELS)) {
+        if (identifier(channelId2) && typeof value === "boolean")
+          state.outputs[channelId2] = { kind: "output", value, ...metadata2 };
+      }
+    }
+    if (isObject(data.inputs))
+      for (const [channelId2, value] of Object.entries(data.inputs).slice(0, MAX_CHANNELS)) {
+        if (identifier(channelId2) && typeof value === "boolean")
+          state.inputs[channelId2] = { kind: "input", value, ...metadata2 };
+      }
+  }
+  applyEvents(id, state, kind, data, canonical, metadata2) {
+    const { receivedAt } = metadata2;
     if (kind === "measurements" && identifier(data.channelId) && typeof data.value === "number" && Number.isFinite(data.value) && (canonical ? CANONICAL_UNITS : ["ampere", "volt", "watt", "percent"]).includes(data.unit)) {
       const collection2 = canonical && data.kind === "cumulative" ? state.cumulativeMeasurements : state.measurements;
       collection2[data.channelId] = {
@@ -54566,20 +54596,6 @@ var WagoDiagnosticsStore = class {
         receivedAt,
         errors: safeValidationSummaries(data.errors)
       };
-    for (const collection2 of [
-      state.cumulativeMeasurements,
-      state.inputs,
-      state.outputs,
-      state.measurements,
-      state.faults,
-      state.acknowledgements
-    ]) {
-      while (Object.keys(collection2).length > MAX_CHANNELS) delete collection2[Object.keys(collection2)[0]];
-    }
-    state.events.push({ kind, receivedAt });
-    state.events = state.events.slice(-50);
-    this.controllers.set(id, state);
-    return true;
   }
 };
 
@@ -56184,14 +56200,14 @@ function wagoFw31IdentityRead(withRoot = false) {
     (path, i) => `printf 'source${i}\\n' && /bin/bash -o pipefail -c ${quotedRead} bash "${withRoot ? "$root" : ""}/${path}"`
   ).join(" && ")} && printf 'complete\\n'; }`;
 }
-function isCc100Fw31Identity(output) {
-  if (output.length + (output.endsWith("\n") ? 0 : 1) > 5e4) return false;
+function parseIdentityFrames(output) {
+  if (output.length + (output.endsWith("\n") ? 0 : 1) > 5e4) return null;
   const chunks = [[], [], []];
   let source = -1;
   let bytes = 0;
   let complete = false;
   for (const line of (output.endsWith("\n") ? output.slice(0, -1) : output).split("\n")) {
-    if (complete) return false;
+    if (complete) return null;
     if (line === `source${source + 1}` && source < 2) {
       source++;
       continue;
@@ -56201,25 +56217,35 @@ function isCc100Fw31Identity(output) {
       continue;
     }
     if (source >= 0 && /^ *$/.test(line)) continue;
-    if (source < 0 || !/^ *[0-9]+(?: +[0-9]+)* *$/.test(line)) return false;
+    if (source < 0 || !/^ *[0-9]+(?: +[0-9]+)* *$/.test(line)) return null;
     for (const token of line.trim().split(/ +/)) {
       const byte = Number(token);
-      if (++bytes > 8192 || byte > 255) return false;
+      if (++bytes > 8192 || byte > 255) return null;
       chunks[source].push(byte);
     }
   }
-  if (!complete) return false;
+  if (!complete) return null;
+  return chunks;
+}
+function parseIdentityFields(text) {
+  if (/[^\n\x20-\x7e]/.test(text)) return null;
+  const fields2 = /* @__PURE__ */ new Map();
+  for (const line of text.split("\n")) {
+    if (line === "" || line.startsWith("#")) continue;
+    const match = /^([A-Z][A-Z0-9_]*)=(?:"([^"\\]*)"|([^"\\\s]+))$/.exec(line);
+    if (!match || fields2.has(match[1])) return null;
+    fields2.set(match[1], match[2] ?? match[3]);
+  }
+  return fields2;
+}
+function isCc100Fw31Identity(output) {
+  const chunks = parseIdentityFrames(output);
+  if (!chunks) return false;
   const texts = chunks.map((chunk) => Buffer.from(chunk).toString("latin1"));
   if (texts[2] !== "CC100-751-9301\0") return false;
   for (let i = 0; i < 2; i++) {
-    if (/[^\n\x20-\x7e]/.test(texts[i])) return false;
-    const fields2 = /* @__PURE__ */ new Map();
-    for (const line of texts[i].split("\n")) {
-      if (line === "" || line.startsWith("#")) continue;
-      const match = /^([A-Z][A-Z0-9_]*)=(?:"([^"\\]*)"|([^"\\\s]+))$/.exec(line);
-      if (!match || fields2.has(match[1])) return false;
-      fields2.set(match[1], match[2] ?? match[3]);
-    }
+    const fields2 = parseIdentityFields(texts[i]);
+    if (!fields2) return false;
     if (i === 0) {
       if (!["PTXDIST_PLATFORM_NAME", "VERSION", "VERSION_ID"].every((key) => fields2.has(key))) return false;
       for (const [key, value] of fields2) {
@@ -56939,6 +56965,36 @@ WagoCredentialRotationEntity = __decorateClass([
 // backend/wago-credential-rotation.ts
 var CAPABILITY = "credential-rotation-v1";
 var WAIT_MS = 3e4;
+function assertRotationController(controller, retry) {
+  if (controller.trustState !== "claimed" || !controller.mqttServerId || controller.compatibilityError)
+    throw new import_common4.ConflictException("A compatible claimed controller is required.");
+  if ("credentialMqttServerId" in controller && controller.credentialMqttServerId != null && controller.credentialMqttServerId !== controller.mqttServerId)
+    throw new import_common4.ConflictException("Use the original credential broker before rotating credentials.");
+  let capabilities;
+  try {
+    capabilities = JSON.parse(controller.capabilities);
+  } catch {
+    capabilities = [];
+  }
+  if (!Array.isArray(capabilities) || !capabilities.includes(CAPABILITY))
+    throw new import_common4.ConflictException("Install a runtime supporting credential-rotation-v1 before rotating credentials.");
+  const heartbeatAt = sourceTime(controller.lastHeartbeatAt);
+  const now = Date.now();
+  if (!retry && (heartbeatAt === null || heartbeatAt > now || now - heartbeatAt >= 9e4))
+    throw new import_common4.ConflictException("Wait for a fresh permanent controller heartbeat before rotating credentials.");
+}
+function checkPendingRotation(previous, credentialEpoch, retry, mqttServerId, prefix) {
+  if (previous && previous.credentialEpoch !== credentialEpoch)
+    throw new import_common4.ConflictException("Recover the previous credential registration before rotating again.");
+  if (previous && previous.phase !== "completed" && !retry)
+    throw new import_common4.ConflictException("Retry the pending credential handoff instead of rotating again.");
+  if (retry && (!previous || previous.phase === "provisioning"))
+    throw new import_common4.ConflictException("Broker rotation completion is uncertain. Recover broker credentials before retrying.");
+  if (retry && previous?.phase === "completed") return { state: "completed", revision: previous.revision };
+  if (previous && (previous.mqttServerId !== mqttServerId || previous.prefix !== prefix))
+    throw new import_common4.ConflictException("Credential rotation must use its original broker and namespace.");
+  return void 0;
+}
 var WagoCredentialRotationUncertainError = class extends import_common4.ConflictException {
   constructor() {
     super("Credential rotation is incomplete. Inspect its recovery state and retry the pending handoff.");
@@ -56965,22 +57021,7 @@ var WagoCredentialRotationService = class {
     await guard.assertOwned();
     const controller = await this.context.getRepository(WagoController).findOneBy({ id: controllerId });
     if (!controller) throw new import_common4.NotFoundException("WAGO controller not found");
-    if (controller.trustState !== "claimed" || !controller.mqttServerId || controller.compatibilityError)
-      throw new import_common4.ConflictException("A compatible claimed controller is required.");
-    if ("credentialMqttServerId" in controller && controller.credentialMqttServerId != null && controller.credentialMqttServerId !== controller.mqttServerId)
-      throw new import_common4.ConflictException("Use the original credential broker before rotating credentials.");
-    let capabilities;
-    try {
-      capabilities = JSON.parse(controller.capabilities);
-    } catch {
-      capabilities = [];
-    }
-    if (!Array.isArray(capabilities) || !capabilities.includes(CAPABILITY))
-      throw new import_common4.ConflictException("Install a runtime supporting credential-rotation-v1 before rotating credentials.");
-    const heartbeatAt = sourceTime(controller.lastHeartbeatAt);
-    const now = Date.now();
-    if (!retry && (heartbeatAt === null || heartbeatAt > now || now - heartbeatAt >= 9e4))
-      throw new import_common4.ConflictException("Wait for a fresh permanent controller heartbeat before rotating credentials.");
+    assertRotationController(controller, retry);
     const [epochRow] = await this.repository.query(
       "SELECT credential_epoch AS epoch FROM plugin_wago_controllers WHERE id = ?",
       [controllerId]
@@ -56991,17 +57032,8 @@ var WagoCredentialRotationService = class {
     prefix = normalizeOperationalPrefix(prefix);
     const identity = `wago-controller-${controller.hardwareId}`;
     const previous = await this.repository.createQueryBuilder("rotation").addSelect("rotation.encryptedCredentials").where("rotation.controllerId = :controllerId", { controllerId }).getOne();
-    if (previous && previous.credentialEpoch !== credentialEpoch)
-      throw new import_common4.ConflictException("Recover the previous credential registration before rotating again.");
-    if (previous && previous.phase !== "completed" && !retry)
-      throw new import_common4.ConflictException("Retry the pending credential handoff instead of rotating again.");
-    if (retry && (!previous || previous.phase === "provisioning"))
-      throw new import_common4.ConflictException(
-        "Broker rotation completion is uncertain. Recover broker credentials before retrying."
-      );
-    if (retry && previous?.phase === "completed") return { state: "completed", revision: previous.revision };
-    if (previous && (previous.mqttServerId !== controller.mqttServerId || previous.prefix !== prefix))
-      throw new import_common4.ConflictException("Credential rotation must use its original broker and namespace.");
+    const completed = checkPendingRotation(previous, credentialEpoch, retry, controller.mqttServerId, prefix);
+    if (completed) return completed;
     const lifecycle = new WagoAudit(this.context).begin(principal, controllerId, "credential_rotation");
     await lifecycle.attempt();
     let uncertain = retry;
@@ -58717,6 +58749,9 @@ WagoRuntimeArtifactsService = __decorateClass([
 // backend/wago-commissioning-readiness.ts
 var import_common7 = require("@nestjs/common");
 var import_plugins_backend_sdk11 = require("@attraccess/plugins-backend-sdk");
+function isReadiness(value) {
+  return !!value && typeof value === "object" && "configurationAccepted" in value && typeof value.configurationAccepted === "boolean" && "hardwareAvailable" in value && typeof value.hardwareAvailable === "boolean" && "ready" in value && typeof value.ready === "boolean";
+}
 var WagoCommissioningReadiness = class {
   constructor(context) {
     __publicField(this, "context", context);
@@ -58755,7 +58790,7 @@ var WagoCommissioningReadiness = class {
           const now = Date.now();
           const value = JSON.parse(message.payload.toString("utf8"));
           const readiness = value.readiness;
-          if (timestamp > now || event.contentHash !== null && !/^[a-f0-9]{64}$/i.test(event.contentHash) || !readiness || typeof readiness !== "object" || !("configurationAccepted" in readiness) || typeof readiness.configurationAccepted !== "boolean" || !("hardwareAvailable" in readiness) || typeof readiness.hardwareAvailable !== "boolean" || !("ready" in readiness) || typeof readiness.ready !== "boolean") {
+          if (timestamp > now || event.contentHash !== null && !/^[a-f0-9]{64}$/i.test(event.contentHash) || !isReadiness(readiness)) {
             current.state = void 0;
             return;
           }
@@ -59114,34 +59149,36 @@ function assertManagementKey(key) {
     const inner = read();
     if (offset !== bytes.length || inner.length % 8 || !inner.subarray(0, 4).equals(inner.subarray(4, 8)))
       throw new Error();
-    let cursor = 8;
-    const part = () => {
-      const length = inner.readUInt32BE(cursor);
-      cursor += 4;
-      if (length > inner.length - cursor) throw new Error();
-      const value = inner.subarray(cursor, cursor + length);
-      cursor += length;
-      return value;
-    };
-    if (part().toString() !== algorithm) throw new Error();
-    const pub = part(), priv = part();
-    if (pub.length !== 32 || priv.length !== 64 || !priv.subarray(32).equals(pub) || !publicBlob(pub).equals(blob) || part().length)
-      throw new Error();
-    const derived = (0, import_node_crypto12.createPublicKey)(
-      (0, import_node_crypto12.createPrivateKey)({
-        key: Buffer.concat([Buffer.from("302e020100300506032b657004220420", "hex"), priv.subarray(0, 32)]),
-        format: "der",
-        type: "pkcs8"
-      })
-    ).export({ format: "jwk" });
-    if (typeof derived.x !== "string" || !Buffer.from(derived.x, "base64url").equals(pub)) throw new Error();
-    const padding = inner.subarray(cursor);
-    if (!padding.length || padding.length > 8 || !padding.every((value, index) => value === index + 1))
-      throw new Error();
+    assertPrivateKeyPayload(inner, blob);
   } catch {
     throw new Error("invalid_key");
   }
 }
+function assertPrivateKeyPayload(inner, blob) {
+  let cursor = 8;
+  const part = () => {
+    const length = inner.readUInt32BE(cursor);
+    cursor += 4;
+    if (length > inner.length - cursor) throw new Error();
+    const value = inner.subarray(cursor, cursor + length);
+    cursor += length;
+    return value;
+  };
+  if (part().toString() !== algorithm) throw new Error();
+  const pub = part(), priv = part();
+  if (pub.length !== 32 || priv.length !== 64 || !priv.subarray(32).equals(pub) || !publicBlob(pub).equals(blob) || part().length)
+    throw new Error();
+  const derived = (0, import_node_crypto12.createPublicKey)(
+    (0, import_node_crypto12.createPrivateKey)({
+      key: Buffer.concat([Buffer.from("302e020100300506032b657004220420", "hex"), priv.subarray(0, 32)]),
+      format: "der",
+      type: "pkcs8"
+    })
+  ).export({ format: "jwk" });
+  if (typeof derived.x !== "string" || !Buffer.from(derived.x, "base64url").equals(pub)) throw new Error();
+  const padding = inner.subarray(cursor);
+  if (!padding.length || padding.length > 8 || !padding.every((value, index) => value === index + 1)) throw new Error();
+}
 function restoreManagementKey(privateKey, expectedFingerprint) {
   try {
     if (privateKey.length > 4096) throw new Error();
@@ -59571,15 +59608,7 @@ var WagoManagementService = class {
           await this.adapter.installKey(tx, input.temporarySsh, key.publicKey);
           await this.step(record2, owner, "verifying_key");
           await this.verify(record2, key.privateKey);
-          if (record2.mode === "baseline") {
-            await this.step(record2, owner, "restricting_access");
-            await this.adapter.restrictAccess(tx, input.temporarySsh, key.privateKey);
-            await this.step(record2, owner, "verifying_baseline");
-            await this.verify(record2, key.privateKey);
-            const result = await this.adapter.verifyBaseline(tx, key.privateKey);
-            if (!result.passwordDisabled || !result.defaultAccessDisabled || !result.minimumPrivileges || !result.wbmSecure && !record2.exceptions.includes("wbm_exposed") || !result.otherManagementSecure && !record2.exceptions.includes("other_services_exposed"))
-              throw new Error();
-          }
+          if (record2.mode === "baseline") await this.enforceBaseline(record2, owner, input.temporarySsh, key.privateKey);
           await this.step(record2, owner, "committing");
           await this.adapter.commit(tx, input.temporarySsh, key.privateKey);
           record2.state = record2.mode === "baseline" && record2.exceptions.length === 0 ? "hardened" : "key_enrolled";
@@ -59596,6 +59625,16 @@ var WagoManagementService = class {
       assertOwned
     );
   }
+  async enforceBaseline(record2, owner, credential, privateKey) {
+    const tx = record2.transaction;
+    await this.step(record2, owner, "restricting_access");
+    await this.adapter.restrictAccess(tx, credential, privateKey);
+    await this.step(record2, owner, "verifying_baseline");
+    await this.verify(record2, privateKey);
+    const result = await this.adapter.verifyBaseline(tx, privateKey);
+    if (!result.passwordDisabled || !result.defaultAccessDisabled || !result.minimumPrivileges || !result.wbmSecure && !record2.exceptions.includes("wbm_exposed") || !result.otherManagementSecure && !record2.exceptions.includes("other_services_exposed"))
+      throw new Error();
+  }
   async recover(controllerId, input, assertOwned) {
     exactKeys2(input, ["confirm", "temporarySsh"]);
     if (input.confirm !== true) throw new ManagementError("invalid_request");
@@ -60671,15 +60710,22 @@ var WagoCommissioningService = class {
       (result) => result.state === "awaiting_discovery"
     );
   }
-  async deliverWhileLocked(id, input, principal = null) {
+  async loadDeliverableSession(id) {
     const session = await this.sessions.findOneBy({ id });
     if (!session) throw new import_common8.NotFoundException("commissioning session not found");
     if (!["awaiting_delivery", "delivering", "awaiting_codesys_confirmation", "delivery_failed"].includes(session.state))
       throw new import_common8.ConflictException("commissioning session cannot be delivered in its current state");
-    const credential = requireDeliveryCredentials(input);
-    if (principal) session.initiatingPrincipal = JSON.stringify(principal);
+    return session;
+  }
+  async requireRuntimeArtifact(session) {
     if (!isRuntimeArtifactConfigured() && !session.runtimeArtifactDigest && !await this.artifacts?.has())
       throw new import_common8.ConflictException("Import a signed CC100 runtime release before installation.");
+  }
+  async deliverWhileLocked(id, input, principal = null) {
+    const session = await this.loadDeliverableSession(id);
+    const credential = requireDeliveryCredentials(input);
+    if (principal) session.initiatingPrincipal = JSON.stringify(principal);
+    await this.requireRuntimeArtifact(session);
     let pairingCode;
     try {
       pairingCode = this.decryptVerifier(session);
@@ -62427,6 +62473,41 @@ var import_plugins_backend_sdk18 = require("@attraccess/plugins-backend-sdk");
 // backend/diagnostics.service.ts
 var import_common11 = require("@nestjs/common");
 var import_plugins_backend_sdk17 = require("@attraccess/plugins-backend-sdk");
+function hasDraftChanges(draft, latest) {
+  return !!draft && (!latest || configurationHash(JSON.parse(draft.snapshot)) !== latest.contentHash || configurationHash({ metadata: draft.presetProvenance ? JSON.parse(draft.presetProvenance) : null }) !== configurationHash({ metadata: latest.presetProvenance ? JSON.parse(latest.presetProvenance) : null }));
+}
+function configurationRejections(latest, runtime) {
+  return latest?.rejectionErrors ? safeValidationSummaries(JSON.parse(latest.rejectionErrors)) : latest && runtime.rejection?.revision === latest.revision && runtime.rejection.contentHash === latest.contentHash ? runtime.rejection.errors : [];
+}
+function configurationSummary(draft, latest, applied, runtime, revisionMismatch) {
+  const validationErrors = draft ? validateSnapshot(JSON.parse(draft.snapshot)) : [];
+  return {
+    draftUpdatedAt: draft?.updatedAt ?? null,
+    draftChanged: hasDraftChanges(draft, latest),
+    validationErrorCount: validationErrors.length,
+    // Codes originate in our validator. Omit messages and dynamic paths, which can include arbitrary draft values.
+    validationCodes: [...new Set(validationErrors.map((error) => error.code))].slice(0, 50),
+    validationErrors: safeValidationSummaries(validationErrors),
+    rejectionErrors: configurationRejections(latest, runtime),
+    publishedRevision: latest?.revision ?? null,
+    publishedState: latest?.state ?? null,
+    appliedRevision: applied?.revision ?? null,
+    reportedRevision: runtime.revision ?? null,
+    revisionMismatch,
+    rejected: latest?.state === "rejected"
+  };
+}
+function runtimeStreamSummary(runtime) {
+  return {
+    sequenceGaps: runtime.activeStream ? runtime.sequenceGaps : null,
+    activeStream: runtime.activeStream ?? null,
+    trackingExhausted: runtime.trackingExhausted,
+    stateConnected: runtime.connected ?? null,
+    stateHardwareAvailable: runtime.hardwareAvailable ?? null,
+    stateSourceAt: runtime.stateSourceAt ?? null,
+    sequenceExplanation: runtime.activeStream ? "Gaps are scoped to boot stream ID and message category; duplicates and retired streams are ignored." : "Legacy payloads have no source envelope; sequence gaps and source freshness are unavailable."
+  };
+}
 function own(values, key) {
   return Object.prototype.hasOwnProperty.call(values, key) ? values[key] : void 0;
 }
@@ -62560,7 +62641,6 @@ var WagoDiagnosticsService = class {
       applied?.revision ?? null,
       Object.fromEntries(appliedSnapshot?.logicalChannels.map((channel) => [channel.id, channel.capabilities]) ?? [])
     );
-    const validationErrors = draft ? validateSnapshot(JSON.parse(draft.snapshot)) : [];
     return {
       controllerId,
       generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
@@ -62572,28 +62652,8 @@ var WagoDiagnosticsService = class {
       protocolVersion: controller.protocolVersion,
       capabilities: JSON.parse(controller.capabilities).slice(0, 64),
       incompatible: !!controller.compatibilityError,
-      sequenceGaps: runtime.activeStream ? runtime.sequenceGaps : null,
-      activeStream: runtime.activeStream ?? null,
-      trackingExhausted: runtime.trackingExhausted,
-      stateConnected: runtime.connected ?? null,
-      stateHardwareAvailable: runtime.hardwareAvailable ?? null,
-      stateSourceAt: runtime.stateSourceAt ?? null,
-      sequenceExplanation: runtime.activeStream ? "Gaps are scoped to boot stream ID and message category; duplicates and retired streams are ignored." : "Legacy payloads have no source envelope; sequence gaps and source freshness are unavailable.",
-      configuration: {
-        draftUpdatedAt: draft?.updatedAt ?? null,
-        draftChanged: !!draft && (!latest || configurationHash(JSON.parse(draft.snapshot)) !== latest.contentHash || configurationHash({ metadata: draft.presetProvenance ? JSON.parse(draft.presetProvenance) : null }) !== configurationHash({ metadata: latest.presetProvenance ? JSON.parse(latest.presetProvenance) : null })),
-        validationErrorCount: validationErrors.length,
-        // Codes originate in our validator. Omit messages and dynamic paths, which can include arbitrary draft values.
-        validationCodes: [...new Set(validationErrors.map((error) => error.code))].slice(0, 50),
-        validationErrors: safeValidationSummaries(validationErrors),
-        rejectionErrors: latest?.rejectionErrors ? safeValidationSummaries(JSON.parse(latest.rejectionErrors)) : latest && runtime.rejection?.revision === latest.revision && runtime.rejection.contentHash === latest.contentHash ? runtime.rejection.errors : [],
-        publishedRevision: latest?.revision ?? null,
-        publishedState: latest?.state ?? null,
-        appliedRevision: applied?.revision ?? null,
-        reportedRevision: runtime.revision ?? null,
-        revisionMismatch,
-        rejected: latest?.state === "rejected"
-      },
+      ...runtimeStreamSummary(runtime),
+      configuration: configurationSummary(draft, latest, applied, runtime, revisionMismatch),
       hardwareReadiness: "unknown",
       hardwareReadinessReason: "Reported hardware availability is shown when supplied; it does not prove physical I/O readiness. Applied configuration and cached output state are not physical proof.",
       channels: ((appliedSnapshot ?? snapshot)?.logicalChannels ?? []).slice(0, 256).map((channel) => {
@@ -63015,12 +63075,23 @@ var WagoFlowService = class {
       return;
     }
     const channels = await this.channels(controller.id);
+    const stream = this.admitEvent(controller, event, eventTime);
+    if (!stream) return;
+    if (event.category === "state") {
+      this.applyState(controller, event, eventTime, stream, channels);
+    } else if ("channelId" in event) {
+      const channel = channels.find((channel2) => channel2.id === event.channelId);
+      if (!channel || event.category === "measurement" && !channel.capabilities.includes("measurement")) return;
+      this.store(controller, event.channelId, event, event.category === "measurement" ? event.value : event);
+    }
+  }
+  admitEvent(controller, event, eventTime) {
     let stream = this.streams.get(controller.id);
-    if (stream?.exhausted) return;
+    if (stream?.exhausted) return void 0;
     if (!stream || stream.active !== event.streamId) {
       if (event.category !== "state" || stream?.retired.has(event.streamId) || stream && (!event.connected || Date.now() - eventTime > STALE_AFTER_MS2 || eventTime <= stream.latestSourceTime)) {
         this.context.logger.warn(`Ignoring unestablished or retired WAGO stream for ${controller.hardwareId}`);
-        return;
+        return void 0;
       }
       if (stream && stream.retired.size >= MAX_RETIRED_STREAMS) {
         stream.exhausted = true;
@@ -63028,7 +63099,7 @@ var WagoFlowService = class {
         this.context.logger.warn(
           `WAGO stream history exhausted for ${controller.hardwareId}; refusing further samples`
         );
-        return;
+        return void 0;
       }
       const retired = stream?.retired ?? /* @__PURE__ */ new Set();
       if (stream) retired.add(stream.active);
@@ -63045,7 +63116,7 @@ var WagoFlowService = class {
     const previous = stream.sequences.get(event.category);
     if (previous !== void 0 && event.sequence <= previous) {
       this.context.logger.warn(`Ignoring duplicate or out-of-order WAGO event for ${controller.hardwareId}`);
-      return;
+      return void 0;
     }
     if (previous !== void 0 && event.sequence > previous + 1)
       this.context.logger.warn(
@@ -63053,32 +63124,28 @@ var WagoFlowService = class {
       );
     stream.sequences.set(event.category, event.sequence);
     stream.latestSourceTime = Math.max(stream.latestSourceTime, eventTime);
-    if (event.category === "state") {
-      const wasUnavailable = this.offlineControllers.has(controller.id) || this.unavailableHardware.has(controller.id) || this.unavailableConfiguration.has(controller.id) || stream.stateTimestamp !== void 0 && Date.now() - stream.stateTimestamp > STALE_AFTER_MS2;
-      stream.stateTimestamp = eventTime;
-      if (event.connected) this.offlineControllers.delete(controller.id);
-      else this.offlineControllers.add(controller.id);
-      if (event.readiness?.hardwareAvailable === false) this.unavailableHardware.add(controller.id);
-      else if (event.readiness?.hardwareAvailable === true) this.unavailableHardware.delete(controller.id);
-      const applied = this.appliedConfigurations.get(controller.id);
-      if (applied && event.revision === applied.revision && event.contentHash === applied.contentHash)
-        this.unavailableConfiguration.delete(controller.id);
-      else this.unavailableConfiguration.add(controller.id);
-      if (wasUnavailable || !event.connected || this.unavailableHardware.has(controller.id) || this.unavailableConfiguration.has(controller.id))
-        stream.sampleNotBefore = Math.max(stream.sampleNotBefore, eventTime);
-      for (const state of this.cache.values()) {
-        if (state.controllerId !== controller.id) continue;
-        if (wasUnavailable || !event.connected || this.unavailableHardware.has(controller.id) || this.unavailableConfiguration.has(controller.id) || state.category === "state")
-          state.invalidated = true;
-      }
-      for (const channel of channels) {
-        const value = channel.capabilities.includes("input") && Object.hasOwn(event.inputs ?? {}, channel.id) ? event.inputs[channel.id] : channel.capabilities.includes("output") && Object.hasOwn(event.outputs, channel.id) ? event.outputs[channel.id] : void 0;
-        if (typeof value === "boolean") this.store(controller, channel.id, event, value);
-      }
-    } else if ("channelId" in event) {
-      const channel = channels.find((channel2) => channel2.id === event.channelId);
-      if (!channel || event.category === "measurement" && !channel.capabilities.includes("measurement")) return;
-      this.store(controller, event.channelId, event, event.category === "measurement" ? event.value : event);
+    return stream;
+  }
+  applyState(controller, event, eventTime, stream, channels) {
+    const wasUnavailable = this.offlineControllers.has(controller.id) || this.unavailableHardware.has(controller.id) || this.unavailableConfiguration.has(controller.id) || stream.stateTimestamp !== void 0 && Date.now() - stream.stateTimestamp > STALE_AFTER_MS2;
+    stream.stateTimestamp = eventTime;
+    if (event.connected) this.offlineControllers.delete(controller.id);
+    else this.offlineControllers.add(controller.id);
+    if (event.readiness?.hardwareAvailable === false) this.unavailableHardware.add(controller.id);
+    else if (event.readiness?.hardwareAvailable === true) this.unavailableHardware.delete(controller.id);
+    const applied = this.appliedConfigurations.get(controller.id);
+    if (applied && event.revision === applied.revision && event.contentHash === applied.contentHash)
+      this.unavailableConfiguration.delete(controller.id);
+    else this.unavailableConfiguration.add(controller.id);
+    const invalidateSamples = wasUnavailable || !event.connected || this.unavailableHardware.has(controller.id) || this.unavailableConfiguration.has(controller.id);
+    if (invalidateSamples) stream.sampleNotBefore = Math.max(stream.sampleNotBefore, eventTime);
+    for (const state of this.cache.values()) {
+      if (state.controllerId !== controller.id) continue;
+      if (invalidateSamples || state.category === "state") state.invalidated = true;
+    }
+    for (const channel of channels) {
+      const value = channel.capabilities.includes("input") && Object.hasOwn(event.inputs ?? {}, channel.id) ? event.inputs[channel.id] : channel.capabilities.includes("output") && Object.hasOwn(event.outputs, channel.id) ? event.outputs[channel.id] : void 0;
+      if (typeof value === "boolean") this.store(controller, channel.id, event, value);
     }
   }
   store(controller, channelId2, event, value) {