@camstack/addon-auth 1.2.143 → 1.2.144

package/dist/{dist-DscyrBBw.js → dist-ChwITXNa.mjs}

@@ -1,37 +1,3 @@
-//#region \0rolldown/runtime.js
-var __create = Object.create;
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __esmMin = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
-var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod), cb = null), mod.exports);
-var __exportAll = (all, no_symbols) => {
-	let target = {};
-	for (var name in all) __defProp(target, name, {
-		get: all[name],
-		enumerable: true
-	});
-	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
-	return target;
-};
-var __copyProps = (to, from, except, desc) => {
-	if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
-		key = keys[i];
-		if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {
-			get: ((k) => from[k]).bind(null, key),
-			enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
-		});
-	}
-	return to;
-};
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {
-	value: mod,
-	enumerable: true
-}) : target, mod));
-var __toCommonJS = (mod) => __hasOwnProp.call(mod, "module.exports") ? mod["module.exports"] : __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-require("node:crypto");
 //#region ../types/dist/event-category-C4hVnRo8.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
@@ -12326,6 +12292,242 @@ var ConvertResultSchema = object({
 * One name, two readers (the OIDC addon that sets it, the hub that checks it).
 */
 var SSO_STATE_COOKIE = "camstack_sso_state";
+/**
+* Device certificates (D855) — the wire contract shared by the hub, the admin
+* UI and the native viewer.
+*
+* A device (a phone) generates its OWN P-256 key pair in hardware (Secure
+* Enclave / Android Keystore / a non-extractable WebCrypto key). The private
+* key never travels. The hub signs the PUBLIC key into an X.509 leaf under a
+* dedicated device CA; the device later proves possession of the key by
+* signing a hub-issued nonce, and the hub answers with the same session a
+* password login opens.
+*
+* Everything on the wire is a small string (a PEM, a base64url signature):
+* D613 is about bulk bytes, and a certificate is ~600 bytes.
+*/
+/** Signature algorithm of every device credential: ECDSA, curve P-256, SHA-256. */
+var DEVICE_CERT_SIGNATURE = "ecdsa-p256-sha256";
+/** First line of every signed message; a change of format bumps the version. */
+var DEVICE_SIGNATURE_MESSAGE_VERSION = "camstack-device-cert-v1";
+_enum([
+	"login",
+	"renew",
+	"revoke"
+]);
+var DevicePlatformSchema = _enum([
+	"ios",
+	"android",
+	"web",
+	"other"
+]);
+var Base64UrlSchema = string().min(1).max(4096).regex(/^[A-Za-z0-9_-]+$/);
+var PemSchema = string().min(1).max(16384);
+/**
+* Why a device-certificate endpoint said no. Distinct from a transport / 5xx
+* failure: those carry no reason and mean "try again", never "the credential is
+* dead". The viewer switches on this exhaustively.
+*/
+var DeviceRefusalReasonSchema = _enum([
+	"revoked",
+	"unknown-credential",
+	"expired",
+	"bad-signature",
+	"nonce-invalid",
+	"rate-limited",
+	"invalid-certificate",
+	"superseded",
+	"user-gone",
+	"unavailable",
+	"code-invalid",
+	"self-enrollment-disabled",
+	"step-up-required",
+	"bad-public-key"
+]);
+var DeviceRefusalSchema = object({
+	ok: literal(false),
+	reason: DeviceRefusalReasonSchema,
+	definitive: boolean(),
+	retryAfterSeconds: number().optional()
+});
+object({
+	code: string().min(1).max(256),
+	/** SubjectPublicKeyInfo DER of the device's P-256 public key, base64url. */
+	publicKeySpki: Base64UrlSchema,
+	deviceName: string().min(1).max(80).optional(),
+	platform: DevicePlatformSchema
+});
+discriminatedUnion("ok", [object({
+	credentialId: string(),
+	certPem: PemSchema,
+	/** The device CA certificate the leaf chains to. */
+	chainPem: PemSchema,
+	notAfter: number(),
+	user: object({
+		id: string(),
+		username: string()
+	})
+}).extend({ ok: literal(true) }), DeviceRefusalSchema]);
+object({
+	/** The single-use step-up proof (`auth.deviceEnrollProofFrom…`). */
+	proof: string().min(1).max(512),
+	publicKeySpki: Base64UrlSchema,
+	deviceName: string().min(1).max(80),
+	platform: DevicePlatformSchema
+});
+object({
+	proof: string(),
+	expiresAt: number()
+});
+discriminatedUnion("ok", [object({
+	nonce: string(),
+	/** The origin to put in the signed message. The app compares it to the hub it dialled. */
+	origin: string(),
+	expiresAt: number(),
+	signature: literal(DEVICE_CERT_SIGNATURE)
+}).extend({ ok: literal(true) }), DeviceRefusalSchema]);
+object({
+	certPem: PemSchema,
+	nonce: string().min(1).max(256),
+	/** ECDSA P-256 SHA-256 over {@link buildDeviceSignatureMessage}; raw r||s or DER, base64url. */
+	signature: Base64UrlSchema
+});
+discriminatedUnion("ok", [object({
+	credentialId: string(),
+	certPem: PemSchema,
+	chainPem: PemSchema,
+	notAfter: number()
+}).extend({ ok: literal(true) }), DeviceRefusalSchema]);
+discriminatedUnion("ok", [object({
+	ok: literal(true),
+	credentialId: string(),
+	sessionsEnded: number().int()
+}), DeviceRefusalSchema]);
+var DeviceCredentialStatusSchema = _enum([
+	"active",
+	"expired",
+	"revoked"
+]);
+var DeviceCredentialSchema = object({
+	id: string(),
+	userId: string(),
+	username: string().nullable(),
+	deviceName: string(),
+	platform: DevicePlatformSchema,
+	enrolledVia: _enum(["qr", "self"]),
+	/** SHA-256 of the leaf certificate DER, colon-hex. */
+	fingerprint: string(),
+	issuedAt: number(),
+	expiresAt: number(),
+	lastUsedAt: number().nullable(),
+	lastUsedFrom: string().nullable(),
+	revokedAt: number().nullable(),
+	/** `admin:<userId>` | `user:<userId>` | `device` | `user-deleted`. */
+	revokedBy: string().nullable(),
+	status: DeviceCredentialStatusSchema
+});
+var StartEnrollmentOutputSchema = object({
+	/** Shown once; only its hash is kept. */
+	code: string(),
+	expiresAt: number(),
+	/** `camstack://enroll?hub=…&code=…` — what the QR encodes. */
+	enrollUrl: string(),
+	/** The hub origin in the link, or `null` when the hub could not name one (the link then has no `hub`). */
+	hubOrigin: string().nullable(),
+	/** Every origin the apps may try (role `appConnections`). */
+	hubOrigins: array(string())
+});
+object({
+	kind: literal("device-certificate"),
+	id: literal("device-certificate"),
+	label: string(),
+	stage: literal("primary"),
+	/** tRPC paths under the hub's `auth` router, so a client names no literal. */
+	challengePath: literal("auth.getDeviceChallenge"),
+	revokePath: literal("auth.revokeOwnDeviceCertificate"),
+	enrollSelfPath: literal("auth.enrollSelf"),
+	loginPath: literal("auth.loginWithDeviceCertificate"),
+	renewPath: literal("auth.renewDeviceCertificate"),
+	signature: literal(DEVICE_CERT_SIGNATURE),
+	messageVersion: literal(DEVICE_SIGNATURE_MESSAGE_VERSION),
+	/** Which clients can execute it: a native app silently, a browser with a non-extractable WebCrypto key. */
+	clients: array(_enum(["native", "web"]))
+});
+/** host[:port] — a DNS name, IPv4 or bracketed IPv6. No userinfo, path or spaces. */
+var AUTHORITY_RE = /^(?:[a-z0-9.-]+|\[[0-9a-f:.]+\])(?::\d{1,5})?$/i;
+/** Same grammar as the hub's `parseForwardedPrefix` (spa-mount.ts). */
+var PREFIX_RE = /^\/[A-Za-z0-9_\-.]+(?:\/[A-Za-z0-9_\-.]+)*$/;
+var MAX_PREFIX_LENGTH = 512;
+/** First value of a possibly comma-joined forwarded header (the client-most proxy). */
+function firstValue(value) {
+	if (value === void 0) return null;
+	const first = value.split(",")[0]?.trim() ?? "";
+	return first.length === 0 ? null : first;
+}
+/** `scheme://host[:port]` normalised by WHATWG URL, or `null` if it is not an http(s) origin. */
+function normalizeOrigin(value) {
+	try {
+		const url = new URL(value);
+		if (url.protocol !== "https:" && url.protocol !== "http:") return null;
+		if (url.username !== "" || url.password !== "") return null;
+		return url.origin;
+	} catch {
+		return null;
+	}
+}
+/** The mount prefix the relay named (no trailing slash), or `''`. Invalid = absent. */
+function requestMountPrefix(headers) {
+	const raw = headers["x-forwarded-prefix"];
+	if (raw === void 0 || raw.length === 0 || raw.length > MAX_PREFIX_LENGTH) return "";
+	const trimmed = raw.endsWith("/") ? raw.slice(0, -1) : raw;
+	if (trimmed === "" || !PREFIX_RE.test(trimmed)) return "";
+	if (trimmed.split("/").some((segment) => segment === ".." || segment === ".")) return "";
+	return trimmed;
+}
+/**
+* The origins the request CLAIMS, most specific first: the proxy's
+* `X-Forwarded-Host` over `Host`; the named `X-Forwarded-Proto`, or https
+* then http when none is named (the hub terminates TLS itself on 4443).
+*/
+function claimedRequestOrigins(headers) {
+	const authority = firstValue(headers["x-forwarded-host"]) ?? firstValue(headers["host"]);
+	if (authority === null || !AUTHORITY_RE.test(authority)) return [];
+	const proto = firstValue(headers["x-forwarded-proto"])?.toLowerCase() ?? null;
+	const schemes = proto === "https" || proto === "http" ? [proto] : proto === null ? ["https", "http"] : [];
+	const out = [];
+	for (const scheme of schemes) {
+		const origin = normalizeOrigin(`${scheme}://${authority}`);
+		if (origin !== null) out.push(origin);
+	}
+	return out;
+}
+/** Every origin the hub advertises itself at, normalised. Never the app link, never loopback. */
+function advertisedHubOrigins(book) {
+	const candidates = [];
+	for (const row of book.rows) {
+		if (row.kind === "app-link" || row.kind === "loopback") continue;
+		candidates.push(row.baseUrl);
+	}
+	const { publicEndpoint, internal, appConnections } = book.roles;
+	if (publicEndpoint.resolved !== null) candidates.push(publicEndpoint.resolved);
+	if (internal.resolved !== null) candidates.push(internal.resolved);
+	candidates.push(...appConnections.resolved);
+	candidates.push(...book.listenerOrigins ?? []);
+	const out = /* @__PURE__ */ new Set();
+	for (const candidate of candidates) {
+		const origin = normalizeOrigin(candidate);
+		if (origin !== null) out.add(origin);
+	}
+	return out;
+}
+/**
+* The origin to send the browser back to: the first claimed origin that is in
+* `allowed`, or `null` (the caller then uses its default address).
+*/
+function pickRequestOrigin(headers, allowed) {
+	for (const origin of claimedRequestOrigins(headers)) if (allowed.has(origin)) return origin;
+	return null;
+}
 var ExpressionBindingSourceSchema = union([
 	object({
 		kind: literal("field").optional(),
@@ -15932,6 +16134,136 @@ method(object({
 	kind: "mutation",
 	auth: "admin"
 }), method(object({}), array(KeychainSecretMetaSchema).readonly(), { auth: "admin" }), method(object({}), KeychainStateSchema, { auth: "admin" });
+var DeviceCaStatusSchema = discriminatedUnion("state", [
+	object({ state: literal("absent") }),
+	object({
+		state: literal("ready"),
+		subject: string(),
+		fingerprintSha256: string(),
+		validTo: string()
+	}),
+	object({
+		state: literal("unavailable"),
+		reason: string()
+	})
+]);
+var DeviceCertificateSettingsSchema = object({ selfEnrollment: _enum(["allowed", "disabled"]) });
+method(object({
+	userId: string().min(1).optional(),
+	includeRevoked: boolean().default(false)
+}), array(DeviceCredentialSchema).readonly(), { auth: "admin" }), method(object({
+	userId: string().min(1),
+	deviceName: string().min(1).max(80)
+}), StartEnrollmentOutputSchema, {
+	kind: "mutation",
+	auth: "admin",
+	caller: "required"
+}), method(object({ id: string().min(1) }), object({
+	revoked: boolean(),
+	sessionsEnded: number().int(),
+	status: DeviceCredentialStatusSchema
+}), {
+	kind: "mutation",
+	auth: "admin",
+	caller: "required"
+}), method(object({}), DeviceCertificateSettingsSchema, { auth: "admin" }), method(DeviceCertificateSettingsSchema, DeviceCertificateSettingsSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ id: string().min(1) }), object({ result: _enum([
+	"deleted",
+	"live",
+	"unknown"
+]) }), {
+	kind: "mutation",
+	auth: "admin",
+	caller: "required"
+}), method(object({}), DeviceCaStatusSchema, { auth: "admin" }), method(object({
+	id: string().min(1),
+	deviceName: string().min(1).max(80)
+}), object({ renamed: boolean() }), {
+	kind: "mutation",
+	auth: "admin"
+});
+/**
+* `node-certificates` - what a node holds and the two renewals the hub drives
+* (D856): the node's MESH leaf (mutual TLS to the hub) and its HTTPS leaf (issued
+* from the hub's local CA so a device that trusts the hub root trusts the node).
+*
+* Provided by the AGENT RUNTIME (the synthetic `agent-runtime` addon id, like
+* `server-management`): the hub reaches it through the ordinary node-pinned
+* capability call - no new Moleculer action. The hub's own certificates are
+* handled in-process by the hub (`certificates` router), so this cap has no hub
+* provider.
+*
+* No private key ever crosses the mesh: the node generates its key pair, sends a
+* CSR, and the hub returns only the signed certificate.
+*/
+var MeshLeafInfoSchema = object({
+	cn: string(),
+	serial: string(),
+	fingerprintSha256: string(),
+	notBefore: number(),
+	notAfter: number()
+});
+var HttpsLeafInfoSchema = object({
+	fingerprintSha256: string(),
+	issuer: string(),
+	sans: array(string()),
+	notBefore: number(),
+	notAfter: number()
+});
+var NodeHttpsStateSchema = discriminatedUnion("state", [object({
+	state: literal("served"),
+	leaf: HttpsLeafInfoSchema
+}), object({
+	state: literal("not-issued"),
+	reason: string()
+})]);
+method(object({}), object({
+	nodeId: string(),
+	mesh: MeshLeafInfoSchema.nullable(),
+	https: NodeHttpsStateSchema
+}), { auth: "admin" }), method(object({}), object({ csrPem: string() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	certPem: string().min(1),
+	caCertPem: string().min(1),
+	confirmWithinMs: number().int().min(1e4).max(6e5)
+}), object({
+	fingerprintSha256: string(),
+	serial: string()
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ fingerprintSha256: string() }), object({ confirmed: boolean() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({}), object({ rolledBack: boolean() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({}), object({
+	csrPem: string(),
+	hostnames: array(string()),
+	addresses: array(string()),
+	/** SHA-256 of the hub local CA this node pinned at its first install; `null` before one. */
+	pinnedCaFingerprintSha256: string().nullable()
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	certPem: string().min(1),
+	caCertPem: string().min(1),
+	/**
+	* The hub signals that its local CA was rotated (D227) and this leaf chains to the NEW
+	* one. Only the hub, over the authenticated mesh, can say so; a leaf with a different CA
+	* and no signal is refused.
+	*/
+	caRotation: boolean().optional()
+}), HttpsLeafInfoSchema, {
+	kind: "mutation",
+	auth: "admin"
+});
 var KeychainKeySourceSchema = object({
 	kind: _enum([
 		"config-file",
@@ -61912,6 +62244,54 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"deviceCredentials.deleteDeviceCredential": {
+		capName: "device-credentials",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"deviceCredentials.getDeviceCaStatus": {
+		capName: "device-credentials",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"deviceCredentials.getDeviceCertificateSettings": {
+		capName: "device-credentials",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"deviceCredentials.listDeviceCredentials": {
+		capName: "device-credentials",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"deviceCredentials.renameDeviceCredential": {
+		capName: "device-credentials",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"deviceCredentials.revokeDeviceCredential": {
+		capName: "device-credentials",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"deviceCredentials.setDeviceCertificateSettings": {
+		capName: "device-credentials",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"deviceCredentials.startEnrollment": {
+		capName: "device-credentials",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"deviceDiscovery.adoptDevice": {
 		capName: "device-discovery",
 		capScope: "device",
@@ -64072,6 +64452,48 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"nodeCertificates.confirmMeshLeaf": {
+		capName: "node-certificates",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"nodeCertificates.getCertificates": {
+		capName: "node-certificates",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"nodeCertificates.installHttpsCertificate": {
+		capName: "node-certificates",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"nodeCertificates.installMeshLeaf": {
+		capName: "node-certificates",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"nodeCertificates.prepareHttpsCertificate": {
+		capName: "node-certificates",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"nodeCertificates.prepareMeshRenewal": {
+		capName: "node-certificates",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"nodeCertificates.rollbackMeshLeaf": {
+		capName: "node-certificates",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"nodes.clusterAddonStatus": {
 		capName: "nodes",
 		capScope: "system",
@@ -72007,165 +72429,4 @@ DEFAULT_NATIVE_LEASE_SETTINGS.admission;
 var MB = 1024 * 1024;
 1024 * MB, 3072 * MB;
 //#endregion
-Object.defineProperty(exports, "BaseAddon", {
-	enumerable: true,
-	get: function() {
-		return BaseAddon;
-	}
-});
-Object.defineProperty(exports, "SECRET_CLEAR", {
-	enumerable: true,
-	get: function() {
-		return SECRET_CLEAR;
-	}
-});
-Object.defineProperty(exports, "SSO_STATE_COOKIE", {
-	enumerable: true,
-	get: function() {
-		return SSO_STATE_COOKIE;
-	}
-});
-Object.defineProperty(exports, "__commonJSMin", {
-	enumerable: true,
-	get: function() {
-		return __commonJSMin;
-	}
-});
-Object.defineProperty(exports, "__esmMin", {
-	enumerable: true,
-	get: function() {
-		return __esmMin;
-	}
-});
-Object.defineProperty(exports, "__exportAll", {
-	enumerable: true,
-	get: function() {
-		return __exportAll;
-	}
-});
-Object.defineProperty(exports, "__toCommonJS", {
-	enumerable: true,
-	get: function() {
-		return __toCommonJS;
-	}
-});
-Object.defineProperty(exports, "__toESM", {
-	enumerable: true,
-	get: function() {
-		return __toESM;
-	}
-});
-Object.defineProperty(exports, "addonRoutesCapability", {
-	enumerable: true,
-	get: function() {
-		return addonRoutesCapability;
-	}
-});
-Object.defineProperty(exports, "addonWidgetsSourceCapability", {
-	enumerable: true,
-	get: function() {
-		return addonWidgetsSourceCapability;
-	}
-});
-Object.defineProperty(exports, "array", {
-	enumerable: true,
-	get: function() {
-		return array;
-	}
-});
-Object.defineProperty(exports, "arrayItemFieldPath", {
-	enumerable: true,
-	get: function() {
-		return arrayItemFieldPath;
-	}
-});
-Object.defineProperty(exports, "authProviderCapability", {
-	enumerable: true,
-	get: function() {
-		return authProviderCapability;
-	}
-});
-Object.defineProperty(exports, "boolean", {
-	enumerable: true,
-	get: function() {
-		return boolean;
-	}
-});
-Object.defineProperty(exports, "buildAddonRouteProvider", {
-	enumerable: true,
-	get: function() {
-		return buildAddonRouteProvider;
-	}
-});
-Object.defineProperty(exports, "errMsg", {
-	enumerable: true,
-	get: function() {
-		return errMsg;
-	}
-});
-Object.defineProperty(exports, "globalSecretScope", {
-	enumerable: true,
-	get: function() {
-		return globalSecretScope;
-	}
-});
-Object.defineProperty(exports, "isSecretClear", {
-	enumerable: true,
-	get: function() {
-		return isSecretClear;
-	}
-});
-Object.defineProperty(exports, "isSecretMarker", {
-	enumerable: true,
-	get: function() {
-		return isSecretMarker;
-	}
-});
-Object.defineProperty(exports, "loginMethodCapability", {
-	enumerable: true,
-	get: function() {
-		return loginMethodCapability;
-	}
-});
-Object.defineProperty(exports, "number", {
-	enumerable: true,
-	get: function() {
-		return number;
-	}
-});
-Object.defineProperty(exports, "object", {
-	enumerable: true,
-	get: function() {
-		return object;
-	}
-});
-Object.defineProperty(exports, "oidcConnectionsCapability", {
-	enumerable: true,
-	get: function() {
-		return oidcConnectionsCapability;
-	}
-});
-Object.defineProperty(exports, "resolveIconKey", {
-	enumerable: true,
-	get: function() {
-		return resolveIconKey;
-	}
-});
-Object.defineProperty(exports, "string", {
-	enumerable: true,
-	get: function() {
-		return string;
-	}
-});
-Object.defineProperty(exports, "toSecretFieldView", {
-	enumerable: true,
-	get: function() {
-		return toSecretFieldView;
-	}
-});
-Object.defineProperty(exports, "userPasskeysCapability", {
-	enumerable: true,
-	get: function() {
-		return userPasskeysCapability;
-	}
-});
+export { array as C, string as D, object as E, toSecretFieldView as S, number as T, SECRET_CLEAR as _, authProviderCapability as a, isSecretClear as b, loginMethodCapability as c, pickRequestOrigin as d, requestMountPrefix as f, BaseAddon as g, errMsg as h, advertisedHubOrigins as i, normalizeOrigin as l, userPasskeysCapability as m, addonRoutesCapability as n, buildAddonRouteProvider as o, resolveIconKey as p, addonWidgetsSourceCapability as r, claimedRequestOrigins as s, SSO_STATE_COOKIE as t, oidcConnectionsCapability as u, arrayItemFieldPath as v, boolean as w, isSecretMarker as x, globalSecretScope as y };