@camstack/addon-auth 1.2.143 → 1.2.145

package/dist/{dist-DscyrBBw.js → dist-B2h4Ziv7.mjs}

@@ -1,37 +1,3 @@
-//#region \0rolldown/runtime.js
-var __create = Object.create;
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __esmMin = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
-var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod), cb = null), mod.exports);
-var __exportAll = (all, no_symbols) => {
-	let target = {};
-	for (var name in all) __defProp(target, name, {
-		get: all[name],
-		enumerable: true
-	});
-	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
-	return target;
-};
-var __copyProps = (to, from, except, desc) => {
-	if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
-		key = keys[i];
-		if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {
-			get: ((k) => from[k]).bind(null, key),
-			enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
-		});
-	}
-	return to;
-};
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {
-	value: mod,
-	enumerable: true
-}) : target, mod));
-var __toCommonJS = (mod) => __hasOwnProp.call(mod, "module.exports") ? mod["module.exports"] : __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-require("node:crypto");
 //#region ../types/dist/event-category-C4hVnRo8.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
@@ -5420,7 +5386,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-BBF1iXUi.mjs
+//#region ../types/dist/sleep-DAX0-2v9.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -12313,6 +12279,123 @@ var ConvertResultSchema = object({
 	})).readonly()
 });
 /**
+* The viewer app's custom-scheme callback — the ONE list of URLs a hub flow
+* may hand a browser back to the native app at.
+*
+* Two readers, one answer: the admin-ui login page (`redirect=` for the
+* native sign-in handoff) and the hub itself (`auth.beginExternalLink`'s
+* `returnTo` for a native account link, D801). Both validate against this
+* list, so a scheme added for one flow can never be accepted by one side and
+* refused by the other.
+*
+* `camstack` is the production app; `camstack.dev` the dev client
+* (`APP_VARIANT=development`). Exact match after canonicalisation — no
+* query or fragment riders, no http(s).
+*/
+var APP_AUTH_CALLBACK_URLS = ["camstack://auth-callback", "camstack.dev://auth-callback"];
+/**
+* The variants the OS / linking layer produces for the same callback:
+* `scheme:///auth-callback` (expo-linking's empty-host standalone form — three
+* slashes) and a trailing `/` both mean `scheme://auth-callback`. Nothing else
+* is normalised: riders keep failing the exact match.
+*/
+function canonicalizeAppCallback(raw) {
+	return raw.replace(/^([a-z][a-z0-9.+-]*):\/\/\/(?!\/)/i, "$1://").replace(/\/$/, "");
+}
+/** The canonical allowlisted callback `raw` names, or `null`. */
+function parseAppAuthCallback(raw) {
+	if (typeof raw !== "string" || raw.length === 0 || raw.length > 512) return null;
+	const canonical = canonicalizeAppCallback(raw);
+	return APP_AUTH_CALLBACK_URLS.includes(canonical) ? canonical : null;
+}
+/**
+* The native-app browser sign-in flows the hub serves itself (D858).
+*
+* The viewer app opens the system browser at a hub START route (OIDC
+* `/addon/auth-oidc/<id>/start`, the passkey page `/auth/app/passkey`) and gets
+* a one-shot handoff code back at its custom scheme. These helpers are the one
+* reading of the request every leg shares - the OIDC addon, the finish leg and
+* the passkey page - so a rule tightened for one is tightened for all:
+*
+*  - PKCE is mandatory and S256 only (`code_challenge` = base64url of a SHA-256);
+*  - `state` is echoed back exactly;
+*  - the return URL is one of {@link APP_AUTH_CALLBACK_URLS}, never a free URL;
+*  - the purpose is `new-session` or `step-up` (the legacy `renew` has no browser flow).
+*
+* Pure and dependency-free (zod only) so an addon, the backend and a spec read
+* the same code.
+*/
+/** What the app redeems the code for. `step-up` yields a proof, never a session. */
+var AppFlowPurposeSchema = _enum(["new-session", "step-up"]);
+/** Where the app is sent when the request names no `redirect`. */
+var APP_FLOW_DEFAULT_REDIRECT = "camstack://auth-callback";
+/** S256 challenge: base64url of 32 bytes = 43 characters, no padding. */
+var CHALLENGE_PATTERN = /^[A-Za-z0-9_-]{43}$/;
+/** The app's own `state`: URL-safe characters only, bounded. */
+var STATE_PATTERN = /^[A-Za-z0-9._~-]{1,256}$/;
+/** Operator-facing words for a refusal (the "clear page", D858). */
+var APP_FLOW_REFUSAL_MESSAGES = {
+	"bad-challenge": "The sign-in request has no valid PKCE challenge (S256).",
+	"bad-challenge-method": "Only the S256 PKCE method is supported.",
+	"bad-state": "The sign-in request has no valid state.",
+	"bad-purpose": "The sign-in request names an unknown purpose.",
+	"bad-redirect": "The sign-in request names a return address this hub does not accept."
+};
+/**
+* Read the app parameters off a start query: `code_challenge`,
+* `code_challenge_method`, `state`, `purpose`, `redirect`. Anything missing or
+* malformed is refused - there is no lenient default for PKCE or state.
+*/
+function parseAppFlowRequest(query) {
+	const challenge = query["code_challenge"];
+	if (challenge === void 0 || !CHALLENGE_PATTERN.test(challenge)) return {
+		ok: false,
+		reason: "bad-challenge"
+	};
+	if (query["code_challenge_method"] !== "S256") return {
+		ok: false,
+		reason: "bad-challenge-method"
+	};
+	const state = query["state"];
+	if (state === void 0 || !STATE_PATTERN.test(state)) return {
+		ok: false,
+		reason: "bad-state"
+	};
+	const purpose = AppFlowPurposeSchema.safeParse(query["purpose"]);
+	if (!purpose.success) return {
+		ok: false,
+		reason: "bad-purpose"
+	};
+	const redirectParam = query["redirect"];
+	const redirect = redirectParam === void 0 ? APP_FLOW_DEFAULT_REDIRECT : parseAppAuthCallback(redirectParam);
+	if (redirect === null) return {
+		ok: false,
+		reason: "bad-redirect"
+	};
+	return {
+		ok: true,
+		request: {
+			codeChallenge: challenge,
+			state,
+			purpose: purpose.data,
+			redirect
+		}
+	};
+}
+/** The app's callback with `code` (success) or `error` (refusal), and the echoed `state` when known. */
+function appFlowLocation(redirect, result, state) {
+	const params = new URLSearchParams();
+	if ("code" in result) params.set("code", result.code);
+	else params.set("error", result.error);
+	if (state !== void 0) params.set("state", state);
+	return `${redirect}?${params.toString()}`;
+}
+/** How a native app starts one login method (D858), as `auth.listLoginMethods` reports it. */
+var AppLoginPathSchema = discriminatedUnion("kind", [object({ kind: literal("native") }), object({
+	kind: literal("browser"),
+	startPath: string().startsWith("/")
+})]);
+/**
 * The cookie that binds an SSO sign-in to the browser that started it.
 *
 * An IdP `/start` sets it to a random value and keeps only its SHA-256 in the
@@ -12326,6 +12409,244 @@ var ConvertResultSchema = object({
 * One name, two readers (the OIDC addon that sets it, the hub that checks it).
 */
 var SSO_STATE_COOKIE = "camstack_sso_state";
+/**
+* Device certificates (D855) — the wire contract shared by the hub, the admin
+* UI and the native viewer.
+*
+* A device (a phone) generates its OWN P-256 key pair in hardware (Secure
+* Enclave / Android Keystore / a non-extractable WebCrypto key). The private
+* key never travels. The hub signs the PUBLIC key into an X.509 leaf under a
+* dedicated device CA; the device later proves possession of the key by
+* signing a hub-issued nonce, and the hub answers with the same session a
+* password login opens.
+*
+* Everything on the wire is a small string (a PEM, a base64url signature):
+* D613 is about bulk bytes, and a certificate is ~600 bytes.
+*/
+/** Signature algorithm of every device credential: ECDSA, curve P-256, SHA-256. */
+var DEVICE_CERT_SIGNATURE = "ecdsa-p256-sha256";
+/** First line of every signed message; a change of format bumps the version. */
+var DEVICE_SIGNATURE_MESSAGE_VERSION = "camstack-device-cert-v1";
+_enum([
+	"login",
+	"renew",
+	"revoke"
+]);
+var DevicePlatformSchema = _enum([
+	"ios",
+	"android",
+	"web",
+	"other"
+]);
+var Base64UrlSchema = string().min(1).max(4096).regex(/^[A-Za-z0-9_-]+$/);
+var PemSchema = string().min(1).max(16384);
+/**
+* Why a device-certificate endpoint said no. Distinct from a transport / 5xx
+* failure: those carry no reason and mean "try again", never "the credential is
+* dead". The viewer switches on this exhaustively.
+*/
+var DeviceRefusalReasonSchema = _enum([
+	"revoked",
+	"unknown-credential",
+	"expired",
+	"bad-signature",
+	"nonce-invalid",
+	"rate-limited",
+	"invalid-certificate",
+	"superseded",
+	"user-gone",
+	"unavailable",
+	"code-invalid",
+	"self-enrollment-disabled",
+	"step-up-required",
+	"bad-public-key"
+]);
+var DeviceRefusalSchema = object({
+	ok: literal(false),
+	reason: DeviceRefusalReasonSchema,
+	definitive: boolean(),
+	retryAfterSeconds: number().optional()
+});
+object({
+	code: string().min(1).max(256),
+	/** SubjectPublicKeyInfo DER of the device's P-256 public key, base64url. */
+	publicKeySpki: Base64UrlSchema,
+	deviceName: string().min(1).max(80).optional(),
+	platform: DevicePlatformSchema
+});
+discriminatedUnion("ok", [object({
+	credentialId: string(),
+	certPem: PemSchema,
+	/** The device CA certificate the leaf chains to. */
+	chainPem: PemSchema,
+	notAfter: number(),
+	user: object({
+		id: string(),
+		username: string()
+	})
+}).extend({ ok: literal(true) }), DeviceRefusalSchema]);
+object({
+	/** The single-use step-up proof (`auth.deviceEnrollProofFrom…`). */
+	proof: string().min(1).max(512),
+	publicKeySpki: Base64UrlSchema,
+	deviceName: string().min(1).max(80),
+	platform: DevicePlatformSchema
+});
+object({
+	proof: string(),
+	expiresAt: number()
+});
+discriminatedUnion("ok", [object({
+	nonce: string(),
+	/** The origin to put in the signed message. The app compares it to the hub it dialled. */
+	origin: string(),
+	expiresAt: number(),
+	signature: literal(DEVICE_CERT_SIGNATURE)
+}).extend({ ok: literal(true) }), DeviceRefusalSchema]);
+object({
+	certPem: PemSchema,
+	nonce: string().min(1).max(256),
+	/** ECDSA P-256 SHA-256 over {@link buildDeviceSignatureMessage}; raw r||s or DER, base64url. */
+	signature: Base64UrlSchema
+});
+discriminatedUnion("ok", [object({
+	credentialId: string(),
+	certPem: PemSchema,
+	chainPem: PemSchema,
+	notAfter: number()
+}).extend({ ok: literal(true) }), DeviceRefusalSchema]);
+discriminatedUnion("ok", [object({
+	ok: literal(true),
+	credentialId: string(),
+	sessionsEnded: number().int()
+}), DeviceRefusalSchema]);
+var DeviceCredentialStatusSchema = _enum([
+	"active",
+	"expired",
+	"revoked"
+]);
+var DeviceCredentialSchema = object({
+	id: string(),
+	userId: string(),
+	username: string().nullable(),
+	deviceName: string(),
+	platform: DevicePlatformSchema,
+	enrolledVia: _enum(["qr", "self"]),
+	/** SHA-256 of the leaf certificate DER, colon-hex. */
+	fingerprint: string(),
+	issuedAt: number(),
+	expiresAt: number(),
+	lastUsedAt: number().nullable(),
+	lastUsedFrom: string().nullable(),
+	revokedAt: number().nullable(),
+	/** `admin:<userId>` | `user:<userId>` | `device` | `user-deleted`. */
+	revokedBy: string().nullable(),
+	status: DeviceCredentialStatusSchema
+});
+var StartEnrollmentOutputSchema = object({
+	/** Shown once; only its hash is kept. */
+	code: string(),
+	expiresAt: number(),
+	/** `camstack://enroll?hub=…&code=…` — what the QR encodes. */
+	enrollUrl: string(),
+	/** The hub origin in the link, or `null` when the hub could not name one (the link then has no `hub`). */
+	hubOrigin: string().nullable(),
+	/** Every origin the apps may try (role `appConnections`). */
+	hubOrigins: array(string())
+});
+object({
+	kind: literal("device-certificate"),
+	id: literal("device-certificate"),
+	label: string(),
+	stage: literal("primary"),
+	/** tRPC paths under the hub's `auth` router, so a client names no literal. */
+	challengePath: literal("auth.getDeviceChallenge"),
+	revokePath: literal("auth.revokeOwnDeviceCertificate"),
+	enrollSelfPath: literal("auth.enrollSelf"),
+	loginPath: literal("auth.loginWithDeviceCertificate"),
+	renewPath: literal("auth.renewDeviceCertificate"),
+	signature: literal(DEVICE_CERT_SIGNATURE),
+	messageVersion: literal(DEVICE_SIGNATURE_MESSAGE_VERSION),
+	/** Which clients can execute it: a native app silently, a browser with a non-extractable WebCrypto key. */
+	clients: array(_enum(["native", "web"])),
+	/** The app executes it itself, silently (D858). */
+	app: AppLoginPathSchema.nullable()
+});
+/** host[:port] — a DNS name, IPv4 or bracketed IPv6. No userinfo, path or spaces. */
+var AUTHORITY_RE = /^(?:[a-z0-9.-]+|\[[0-9a-f:.]+\])(?::\d{1,5})?$/i;
+/** Same grammar as the hub's `parseForwardedPrefix` (spa-mount.ts). */
+var PREFIX_RE = /^\/[A-Za-z0-9_\-.]+(?:\/[A-Za-z0-9_\-.]+)*$/;
+var MAX_PREFIX_LENGTH = 512;
+/** First value of a possibly comma-joined forwarded header (the client-most proxy). */
+function firstValue(value) {
+	if (value === void 0) return null;
+	const first = value.split(",")[0]?.trim() ?? "";
+	return first.length === 0 ? null : first;
+}
+/** `scheme://host[:port]` normalised by WHATWG URL, or `null` if it is not an http(s) origin. */
+function normalizeOrigin(value) {
+	try {
+		const url = new URL(value);
+		if (url.protocol !== "https:" && url.protocol !== "http:") return null;
+		if (url.username !== "" || url.password !== "") return null;
+		return url.origin;
+	} catch {
+		return null;
+	}
+}
+/** The mount prefix the relay named (no trailing slash), or `''`. Invalid = absent. */
+function requestMountPrefix(headers) {
+	const raw = headers["x-forwarded-prefix"];
+	if (raw === void 0 || raw.length === 0 || raw.length > MAX_PREFIX_LENGTH) return "";
+	const trimmed = raw.endsWith("/") ? raw.slice(0, -1) : raw;
+	if (trimmed === "" || !PREFIX_RE.test(trimmed)) return "";
+	if (trimmed.split("/").some((segment) => segment === ".." || segment === ".")) return "";
+	return trimmed;
+}
+/**
+* The origins the request CLAIMS, most specific first: the proxy's
+* `X-Forwarded-Host` over `Host`; the named `X-Forwarded-Proto`, or https
+* then http when none is named (the hub terminates TLS itself on 4443).
+*/
+function claimedRequestOrigins(headers) {
+	const authority = firstValue(headers["x-forwarded-host"]) ?? firstValue(headers["host"]);
+	if (authority === null || !AUTHORITY_RE.test(authority)) return [];
+	const proto = firstValue(headers["x-forwarded-proto"])?.toLowerCase() ?? null;
+	const schemes = proto === "https" || proto === "http" ? [proto] : proto === null ? ["https", "http"] : [];
+	const out = [];
+	for (const scheme of schemes) {
+		const origin = normalizeOrigin(`${scheme}://${authority}`);
+		if (origin !== null) out.push(origin);
+	}
+	return out;
+}
+/** Every origin the hub advertises itself at, normalised. Never the app link, never loopback. */
+function advertisedHubOrigins(book) {
+	const candidates = [];
+	for (const row of book.rows) {
+		if (row.kind === "app-link" || row.kind === "loopback") continue;
+		candidates.push(row.baseUrl);
+	}
+	const { publicEndpoint, internal, appConnections } = book.roles;
+	if (publicEndpoint.resolved !== null) candidates.push(publicEndpoint.resolved);
+	if (internal.resolved !== null) candidates.push(internal.resolved);
+	candidates.push(...appConnections.resolved);
+	candidates.push(...book.listenerOrigins ?? []);
+	const out = /* @__PURE__ */ new Set();
+	for (const candidate of candidates) {
+		const origin = normalizeOrigin(candidate);
+		if (origin !== null) out.add(origin);
+	}
+	return out;
+}
+/**
+* The origin to send the browser back to: the first claimed origin that is in
+* `allowed`, or `null` (the caller then uses its default address).
+*/
+function pickRequestOrigin(headers, allowed) {
+	for (const origin of claimedRequestOrigins(headers)) if (allowed.has(origin)) return origin;
+	return null;
+}
 var ExpressionBindingSourceSchema = union([
 	object({
 		kind: literal("field").optional(),
@@ -15932,6 +16253,341 @@ method(object({
 	kind: "mutation",
 	auth: "admin"
 }), method(object({}), array(KeychainSecretMetaSchema).readonly(), { auth: "admin" }), method(object({}), KeychainStateSchema, { auth: "admin" });
+/**
+* device-history — the ONE mechanism for numeric history (D850).
+*
+* A device value is recorded because its capability says so (the `history`
+* block of a `*.cap.ts`, captured hub-side from `DeviceStateChanged`); any
+* other series is DECLARED by the addon that produces it and fed with points
+* (`record`) or closed five-minute buckets (`recordBuckets`). Rollups 5m / 1h /
+* 1d are computed here and nowhere else. Storage is `history.db` (D851).
+*
+* Who the PRODUCER is: `declareSeries`, `record` and `recordBuckets` are owner
+* checked against the `callerAddonId` the transport stamps into a call that
+* crossed a process (never in an input schema, so a session cannot supply it).
+* A call with no stamp is refused `not-owner`. The methods are `admin` so a
+* non-admin session never reaches them; an addon's `ctx.api` call bypasses the
+* tier by design.
+*/
+/** Whose history: a real device, or a cluster node (load, memory). */
+var DeviceHistorySubjectSchema = discriminatedUnion("kind", [object({
+	kind: literal("device"),
+	deviceId: number().int()
+}), object({
+	kind: literal("node"),
+	nodeId: string().min(1)
+})]);
+var DeviceHistoryKindSchema = _enum([
+	"gauge",
+	"counter",
+	"boolean"
+]);
+var DeviceHistoryResolutionSchema = _enum([
+	"raw",
+	"5m",
+	"1h",
+	"1d"
+]);
+/** Why a producer's point or bucket was not stored. Counted, never silent (D391). */
+var DeviceHistoryRefusalReasonSchema = _enum([
+	"undeclared",
+	"not-owner",
+	"opted-out",
+	"not-a-real-device",
+	"rate",
+	"ingest-mismatch",
+	"out-of-range"
+]);
+var RefusalSchema = object({
+	key: string(),
+	reason: DeviceHistoryRefusalReasonSchema,
+	count: number().int()
+});
+var IngestResultSchema = object({
+	accepted: number().int(),
+	refused: array(RefusalSchema).readonly()
+});
+var SeriesInfoSchema = object({
+	key: string(),
+	scope: string(),
+	kind: DeviceHistoryKindSchema,
+	/** `null` is unknown (a `unitFrom` series whose device does not state a unit right now), never a guess. */
+	unit: string().nullable(),
+	displayName: string(),
+	source: _enum(["cap", "addon"]),
+	firstTs: number(),
+	lastTs: number()
+});
+var QueryPointSchema = object({
+	/** Raw: the point's time. Rollup: the bucket start. */
+	t: number(),
+	samples: number().int(),
+	/** `sum / samples`. */
+	mean: number().nullable(),
+	/** Time-weighted mean (`tw_sum / tw_ms`); `null` for bucket-ingested series. For a boolean: the fraction of time true. */
+	twMean: number().nullable(),
+	min: number(),
+	max: number(),
+	/** `null` is unknown, never zero (D393). */
+	last: number().nullable()
+});
+var QuerySeriesSchema = object({
+	scope: string(),
+	/** The last point STRICTLY BEFORE `from` in the chosen tier, so a step chart can start at the held value. */
+	before: object({
+		t: number(),
+		value: number().nullable()
+	}).nullable(),
+	points: array(QueryPointSchema).readonly()
+});
+/** The window part of a query, shared by the device and node forms. */
+var QueryWindowShape = {
+	key: string(),
+	scope: string().optional(),
+	from: number(),
+	to: number(),
+	resolution: union([DeviceHistoryResolutionSchema, literal("auto")]).default("auto"),
+	maxPoints: number().int().positive().max(5e3).default(1e3)
+};
+var QueryResultSchema = object({
+	resolution: DeviceHistoryResolutionSchema,
+	series: array(QuerySeriesSchema).readonly(),
+	truncated: boolean()
+});
+var TierStatusSchema = object({
+	tier: DeviceHistoryResolutionSchema,
+	/** `null` until the first background count answered. */
+	rows: number().int().nullable(),
+	/** `rows` times a fixed per-row estimate — approximate, labelled so. */
+	approxBytes: number().nullable(),
+	countedAt: number().nullable()
+});
+/** Operator/diagnostic view: rows per tier, last runs, refusals and drops since boot. */
+var DeviceHistoryStatusSchema = object({
+	startedAt: number(),
+	/** The store is declared, series loaded and the first reconcile has answered. */
+	ready: boolean(),
+	series: number().int(),
+	metrics: number().int(),
+	optedOutDevices: number().int(),
+	tiers: array(TierStatusSchema).readonly(),
+	capture: object({
+		eventsSeen: number().int(),
+		pointsEmitted: number().int(),
+		pointsWritten: number().int(),
+		pointsDropped: number().int(),
+		bufferDepth: number().int(),
+		trailingEmitted: number().int(),
+		reconciledPoints: number().int(),
+		reconcileRuns: number().int(),
+		reconcileFailures: number().int(),
+		lastReconcileAt: number().nullable(),
+		lastFlushAt: number().nullable(),
+		flushFailures: number().int(),
+		skipped: record(string(), number().int())
+	}),
+	ingest: object({
+		accepted: number().int(),
+		refused: record(string(), number().int())
+	}),
+	rollup: object({
+		last5mAt: number().nullable(),
+		last1hAt: number().nullable(),
+		last1dAt: number().nullable(),
+		errors: number().int(),
+		dirty5m: number().int(),
+		dirty1h: number().int(),
+		dirty1d: number().int()
+	}),
+	retention: object({
+		lastRunAt: number().nullable(),
+		deleted: record(string(), number().int()),
+		purgedSeries: number().int()
+	}),
+	directory: object({
+		devices: number().int(),
+		lastRefreshAt: number().nullable()
+	})
+});
+method(object({ deviceId: number().int() }), array(SeriesInfoSchema).readonly()), method(object({ nodeId: string().min(1) }), array(SeriesInfoSchema).readonly(), { auth: "admin" }), method(object({
+	deviceId: number().int(),
+	...QueryWindowShape
+}), QueryResultSchema), method(object({
+	nodeId: string().min(1),
+	...QueryWindowShape
+}), QueryResultSchema, { auth: "admin" }), method(object({
+	name: string().regex(/^[a-z0-9-]+$/),
+	subjectKind: _enum(["device", "node"]),
+	kind: DeviceHistoryKindSchema,
+	unit: string().optional(),
+	displayName: string().min(1),
+	ingest: _enum(["points", "buckets"])
+}), object({ key: string() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ points: array(object({
+	key: string(),
+	subject: DeviceHistorySubjectSchema,
+	scope: string().default(""),
+	ts: number(),
+	value: number()
+})).max(5e3) }), IngestResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ buckets: array(object({
+	key: string(),
+	subject: DeviceHistorySubjectSchema,
+	scope: string().default(""),
+	bucketStart: number(),
+	samples: number().int().positive(),
+	sum: number(),
+	min: number(),
+	max: number(),
+	last: number().nullable(),
+	lastTs: number().nullable()
+})).max(5e3) }), IngestResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ deviceId: number().int() }), object({ enabled: boolean() })), method(object({
+	deviceId: number().int(),
+	enabled: boolean()
+}), object({ enabled: boolean() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({}), DeviceHistoryStatusSchema, { auth: "admin" });
+var DeviceCaStatusSchema = discriminatedUnion("state", [
+	object({ state: literal("absent") }),
+	object({
+		state: literal("ready"),
+		subject: string(),
+		fingerprintSha256: string(),
+		validTo: string()
+	}),
+	object({
+		state: literal("unavailable"),
+		reason: string()
+	})
+]);
+var DeviceCertificateSettingsSchema = object({ selfEnrollment: _enum(["allowed", "disabled"]) });
+method(object({
+	userId: string().min(1).optional(),
+	includeRevoked: boolean().default(false)
+}), array(DeviceCredentialSchema).readonly(), { auth: "admin" }), method(object({
+	userId: string().min(1),
+	deviceName: string().min(1).max(80)
+}), StartEnrollmentOutputSchema, {
+	kind: "mutation",
+	auth: "admin",
+	caller: "required"
+}), method(object({ id: string().min(1) }), object({
+	revoked: boolean(),
+	sessionsEnded: number().int(),
+	status: DeviceCredentialStatusSchema
+}), {
+	kind: "mutation",
+	auth: "admin",
+	caller: "required"
+}), method(object({}), DeviceCertificateSettingsSchema, { auth: "admin" }), method(DeviceCertificateSettingsSchema, DeviceCertificateSettingsSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ id: string().min(1) }), object({ result: _enum([
+	"deleted",
+	"live",
+	"unknown"
+]) }), {
+	kind: "mutation",
+	auth: "admin",
+	caller: "required"
+}), method(object({}), DeviceCaStatusSchema, { auth: "admin" }), method(object({
+	id: string().min(1),
+	deviceName: string().min(1).max(80)
+}), object({ renamed: boolean() }), {
+	kind: "mutation",
+	auth: "admin"
+});
+/**
+* `node-certificates` - what a node holds and the two renewals the hub drives
+* (D856): the node's MESH leaf (mutual TLS to the hub) and its HTTPS leaf (issued
+* from the hub's local CA so a device that trusts the hub root trusts the node).
+*
+* Provided by the AGENT RUNTIME (the synthetic `agent-runtime` addon id, like
+* `server-management`): the hub reaches it through the ordinary node-pinned
+* capability call - no new Moleculer action. The hub's own certificates are
+* handled in-process by the hub (`certificates` router), so this cap has no hub
+* provider.
+*
+* No private key ever crosses the mesh: the node generates its key pair, sends a
+* CSR, and the hub returns only the signed certificate.
+*/
+var MeshLeafInfoSchema = object({
+	cn: string(),
+	serial: string(),
+	fingerprintSha256: string(),
+	notBefore: number(),
+	notAfter: number()
+});
+var HttpsLeafInfoSchema = object({
+	fingerprintSha256: string(),
+	issuer: string(),
+	sans: array(string()),
+	notBefore: number(),
+	notAfter: number()
+});
+var NodeHttpsStateSchema = discriminatedUnion("state", [object({
+	state: literal("served"),
+	leaf: HttpsLeafInfoSchema
+}), object({
+	state: literal("not-issued"),
+	reason: string()
+})]);
+method(object({}), object({
+	nodeId: string(),
+	mesh: MeshLeafInfoSchema.nullable(),
+	https: NodeHttpsStateSchema
+}), { auth: "admin" }), method(object({}), object({ csrPem: string() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	certPem: string().min(1),
+	caCertPem: string().min(1),
+	confirmWithinMs: number().int().min(1e4).max(6e5)
+}), object({
+	fingerprintSha256: string(),
+	serial: string()
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ fingerprintSha256: string() }), object({ confirmed: boolean() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({}), object({ rolledBack: boolean() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({}), object({
+	csrPem: string(),
+	hostnames: array(string()),
+	addresses: array(string()),
+	/** SHA-256 of the hub local CA this node pinned at its first install; `null` before one. */
+	pinnedCaFingerprintSha256: string().nullable()
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({}), object({ ok: literal(true) }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	certPem: string().min(1),
+	caCertPem: string().min(1),
+	/**
+	* The hub signals that its local CA was rotated (D227) and this leaf chains to the NEW
+	* one. Only the hub, over the authenticated mesh, can say so; a leaf with a different CA
+	* and no signal is refused.
+	*/
+	caRotation: boolean().optional()
+}), HttpsLeafInfoSchema, {
+	kind: "mutation",
+	auth: "admin"
+});
 var KeychainKeySourceSchema = object({
 	kind: _enum([
 		"config-file",
@@ -38684,7 +39340,13 @@ var LoginMethodContributionSchema = discriminatedUnion("kind", [
 		* `beginExternalLink` offer exactly the redirect methods that set this,
 		* whatever their id. Absent / false — a login button only.
 		*/
-		linkable: boolean().optional()
+		linkable: boolean().optional(),
+		/**
+		* How a NATIVE app starts this method (D858): `{ kind: 'browser', startPath }`
+		* when the route understands the app flow query (`app=1&code_challenge=…`),
+		* `null`/absent when there is no app path - the app hides the method.
+		*/
+		app: AppLoginPathSchema.nullable().optional()
 	}),
 	object({
 		kind: literal("widget"),
@@ -38696,7 +39358,9 @@ var LoginMethodContributionSchema = discriminatedUnion("kind", [
 		bundle: string(),
 		/** MF remote descriptor — `{ remoteName, exposedModule, componentKey }`. */
 		remote: WidgetRemoteSchema,
-		stage: LoginStageEnum
+		stage: LoginStageEnum,
+		/** Widgets are web ceremonies: no native app path (D858). Absent reads as `null`. */
+		app: AppLoginPathSchema.nullable().optional()
 	}),
 	object({
 		kind: literal("passkey"),
@@ -38708,7 +39372,9 @@ var LoginMethodContributionSchema = discriminatedUnion("kind", [
 		/** Effective WebAuthn RP ID (`resolveRpID()`) — the shell gates visibility on it. */
 		rpId: string(),
 		/** Effective expected origin (`resolveOrigin()`), null when unconfigured. */
-		origin: string().nullable()
+		origin: string().nullable(),
+		/** Set by the hub for the primary arm; a second-factor passkey has no app path (D858). */
+		app: AppLoginPathSchema.nullable().optional()
 	})
 ]);
 var loginMethodCapability = {
@@ -49265,7 +49931,20 @@ var SsoBridgeClaimsSchema = object({
 	* request to present the matching cookie — a login bridge is useless in
 	* any other browser.
 	*/
-	browserBinding: string().optional()
+	browserBinding: string().optional(),
+	/**
+	* The native app that started this sign-in (D858): its PKCE challenge,
+	* `state`, purpose and allow-listed return URL, copied from the server-side
+	* pending OIDC state. A bridge carrying it is finished ONLY at
+	* `/api/auth/sso/finish-app` (which mints a handoff code, never a web
+	* session); `/api/auth/sso/finish` refuses it.
+	*/
+	app: object({
+		codeChallenge: string(),
+		state: string(),
+		purpose: _enum(["new-session", "step-up"]),
+		redirect: string()
+	}).optional()
 });
 method(object({
 	claims: SsoBridgeClaimsSchema,
@@ -54705,7 +55384,7 @@ var MotionOnMotionChangedDataSchema = object({
 	/** Who started it (D672). Absent = the camera itself. Only `onboard` carries `sensor`. */
 	triggeredBy: MotionTriggeredBySchema.optional()
 });
-DeviceType.Camera, DeviceType.Sensor, method(object({ deviceId: number() }), boolean());
+DeviceType.Camera, DeviceType.Sensor, method(object({ deviceId: number() }), boolean()), DeviceType.Camera;
 object({
 	enabled: boolean(),
 	/** Ms epoch of the last operator-driven change. */
@@ -61912,6 +62591,54 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"deviceCredentials.deleteDeviceCredential": {
+		capName: "device-credentials",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"deviceCredentials.getDeviceCaStatus": {
+		capName: "device-credentials",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"deviceCredentials.getDeviceCertificateSettings": {
+		capName: "device-credentials",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"deviceCredentials.listDeviceCredentials": {
+		capName: "device-credentials",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"deviceCredentials.renameDeviceCredential": {
+		capName: "device-credentials",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"deviceCredentials.revokeDeviceCredential": {
+		capName: "device-credentials",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"deviceCredentials.setDeviceCertificateSettings": {
+		capName: "device-credentials",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"deviceCredentials.startEnrollment": {
+		capName: "device-credentials",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"deviceDiscovery.adoptDevice": {
 		capName: "device-discovery",
 		capScope: "device",
@@ -62014,6 +62741,66 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"deviceHistory.declareSeries": {
+		capName: "device-history",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"deviceHistory.getDeviceEnabled": {
+		capName: "device-history",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"deviceHistory.getStatus": {
+		capName: "device-history",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"deviceHistory.listNodeSeries": {
+		capName: "device-history",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"deviceHistory.listSeries": {
+		capName: "device-history",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"deviceHistory.query": {
+		capName: "device-history",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"deviceHistory.queryNode": {
+		capName: "device-history",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"deviceHistory.record": {
+		capName: "device-history",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"deviceHistory.recordBuckets": {
+		capName: "device-history",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"deviceHistory.setDeviceEnabled": {
+		capName: "device-history",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"deviceManager.addLocation": {
 		capName: "device-manager",
 		capScope: "system",
@@ -64072,6 +64859,54 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"nodeCertificates.confirmMeshLeaf": {
+		capName: "node-certificates",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"nodeCertificates.forgetHub": {
+		capName: "node-certificates",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"nodeCertificates.getCertificates": {
+		capName: "node-certificates",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"nodeCertificates.installHttpsCertificate": {
+		capName: "node-certificates",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"nodeCertificates.installMeshLeaf": {
+		capName: "node-certificates",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"nodeCertificates.prepareHttpsCertificate": {
+		capName: "node-certificates",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"nodeCertificates.prepareMeshRenewal": {
+		capName: "node-certificates",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"nodeCertificates.rollbackMeshLeaf": {
+		capName: "node-certificates",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"nodes.clusterAddonStatus": {
 		capName: "nodes",
 		capScope: "system",
@@ -68763,6 +69598,26 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"deviceHistory.getDeviceEnabled": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceHistory.listSeries": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceHistory.query": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceHistory.setDeviceEnabled": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"deviceManager.adoptionRelease": [{
 		name: "camDeviceId",
 		form: "single",
@@ -70941,6 +71796,7 @@ Object.freeze({
 	"network-access": "ingress",
 	"smtp-provider": "email"
 });
+DeviceType.Camera;
 var G711_SCALE_CORRECTION_DB = {
 	PCMU: 20 * Math.log10(4),
 	PCMA: 20 * Math.log10(8)
@@ -72007,165 +72863,4 @@ DEFAULT_NATIVE_LEASE_SETTINGS.admission;
 var MB = 1024 * 1024;
 1024 * MB, 3072 * MB;
 //#endregion
-Object.defineProperty(exports, "BaseAddon", {
-	enumerable: true,
-	get: function() {
-		return BaseAddon;
-	}
-});
-Object.defineProperty(exports, "SECRET_CLEAR", {
-	enumerable: true,
-	get: function() {
-		return SECRET_CLEAR;
-	}
-});
-Object.defineProperty(exports, "SSO_STATE_COOKIE", {
-	enumerable: true,
-	get: function() {
-		return SSO_STATE_COOKIE;
-	}
-});
-Object.defineProperty(exports, "__commonJSMin", {
-	enumerable: true,
-	get: function() {
-		return __commonJSMin;
-	}
-});
-Object.defineProperty(exports, "__esmMin", {
-	enumerable: true,
-	get: function() {
-		return __esmMin;
-	}
-});
-Object.defineProperty(exports, "__exportAll", {
-	enumerable: true,
-	get: function() {
-		return __exportAll;
-	}
-});
-Object.defineProperty(exports, "__toCommonJS", {
-	enumerable: true,
-	get: function() {
-		return __toCommonJS;
-	}
-});
-Object.defineProperty(exports, "__toESM", {
-	enumerable: true,
-	get: function() {
-		return __toESM;
-	}
-});
-Object.defineProperty(exports, "addonRoutesCapability", {
-	enumerable: true,
-	get: function() {
-		return addonRoutesCapability;
-	}
-});
-Object.defineProperty(exports, "addonWidgetsSourceCapability", {
-	enumerable: true,
-	get: function() {
-		return addonWidgetsSourceCapability;
-	}
-});
-Object.defineProperty(exports, "array", {
-	enumerable: true,
-	get: function() {
-		return array;
-	}
-});
-Object.defineProperty(exports, "arrayItemFieldPath", {
-	enumerable: true,
-	get: function() {
-		return arrayItemFieldPath;
-	}
-});
-Object.defineProperty(exports, "authProviderCapability", {
-	enumerable: true,
-	get: function() {
-		return authProviderCapability;
-	}
-});
-Object.defineProperty(exports, "boolean", {
-	enumerable: true,
-	get: function() {
-		return boolean;
-	}
-});
-Object.defineProperty(exports, "buildAddonRouteProvider", {
-	enumerable: true,
-	get: function() {
-		return buildAddonRouteProvider;
-	}
-});
-Object.defineProperty(exports, "errMsg", {
-	enumerable: true,
-	get: function() {
-		return errMsg;
-	}
-});
-Object.defineProperty(exports, "globalSecretScope", {
-	enumerable: true,
-	get: function() {
-		return globalSecretScope;
-	}
-});
-Object.defineProperty(exports, "isSecretClear", {
-	enumerable: true,
-	get: function() {
-		return isSecretClear;
-	}
-});
-Object.defineProperty(exports, "isSecretMarker", {
-	enumerable: true,
-	get: function() {
-		return isSecretMarker;
-	}
-});
-Object.defineProperty(exports, "loginMethodCapability", {
-	enumerable: true,
-	get: function() {
-		return loginMethodCapability;
-	}
-});
-Object.defineProperty(exports, "number", {
-	enumerable: true,
-	get: function() {
-		return number;
-	}
-});
-Object.defineProperty(exports, "object", {
-	enumerable: true,
-	get: function() {
-		return object;
-	}
-});
-Object.defineProperty(exports, "oidcConnectionsCapability", {
-	enumerable: true,
-	get: function() {
-		return oidcConnectionsCapability;
-	}
-});
-Object.defineProperty(exports, "resolveIconKey", {
-	enumerable: true,
-	get: function() {
-		return resolveIconKey;
-	}
-});
-Object.defineProperty(exports, "string", {
-	enumerable: true,
-	get: function() {
-		return string;
-	}
-});
-Object.defineProperty(exports, "toSecretFieldView", {
-	enumerable: true,
-	get: function() {
-		return toSecretFieldView;
-	}
-});
-Object.defineProperty(exports, "userPasskeysCapability", {
-	enumerable: true,
-	get: function() {
-		return userPasskeysCapability;
-	}
-});
+export { object as A, globalSecretScope as C, array as D, toSecretFieldView as E, boolean as O, arrayItemFieldPath as S, isSecretMarker as T, resolveIconKey as _, addonWidgetsSourceCapability as a, BaseAddon as b, authProviderCapability as c, loginMethodCapability as d, normalizeOrigin as f, requestMountPrefix as g, pickRequestOrigin as h, addonRoutesCapability as i, string as j, number as k, buildAddonRouteProvider as l, parseAppFlowRequest as m, APP_FLOW_REFUSAL_MESSAGES as n, advertisedHubOrigins as o, oidcConnectionsCapability as p, SSO_STATE_COOKIE as r, appFlowLocation as s, APP_FLOW_DEFAULT_REDIRECT as t, claimedRequestOrigins as u, userPasskeysCapability as v, isSecretClear as w, SECRET_CLEAR as x, errMsg as y };