@camstack/addon-auth 1.2.144 → 1.2.145

package/dist/{dist-ChwITXNa.mjs → dist-B2h4Ziv7.mjs}

@@ -5386,7 +5386,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-BBF1iXUi.mjs
+//#region ../types/dist/sleep-DAX0-2v9.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -12279,6 +12279,123 @@ var ConvertResultSchema = object({
 	})).readonly()
 });
 /**
+* The viewer app's custom-scheme callback — the ONE list of URLs a hub flow
+* may hand a browser back to the native app at.
+*
+* Two readers, one answer: the admin-ui login page (`redirect=` for the
+* native sign-in handoff) and the hub itself (`auth.beginExternalLink`'s
+* `returnTo` for a native account link, D801). Both validate against this
+* list, so a scheme added for one flow can never be accepted by one side and
+* refused by the other.
+*
+* `camstack` is the production app; `camstack.dev` the dev client
+* (`APP_VARIANT=development`). Exact match after canonicalisation — no
+* query or fragment riders, no http(s).
+*/
+var APP_AUTH_CALLBACK_URLS = ["camstack://auth-callback", "camstack.dev://auth-callback"];
+/**
+* The variants the OS / linking layer produces for the same callback:
+* `scheme:///auth-callback` (expo-linking's empty-host standalone form — three
+* slashes) and a trailing `/` both mean `scheme://auth-callback`. Nothing else
+* is normalised: riders keep failing the exact match.
+*/
+function canonicalizeAppCallback(raw) {
+	return raw.replace(/^([a-z][a-z0-9.+-]*):\/\/\/(?!\/)/i, "$1://").replace(/\/$/, "");
+}
+/** The canonical allowlisted callback `raw` names, or `null`. */
+function parseAppAuthCallback(raw) {
+	if (typeof raw !== "string" || raw.length === 0 || raw.length > 512) return null;
+	const canonical = canonicalizeAppCallback(raw);
+	return APP_AUTH_CALLBACK_URLS.includes(canonical) ? canonical : null;
+}
+/**
+* The native-app browser sign-in flows the hub serves itself (D858).
+*
+* The viewer app opens the system browser at a hub START route (OIDC
+* `/addon/auth-oidc/<id>/start`, the passkey page `/auth/app/passkey`) and gets
+* a one-shot handoff code back at its custom scheme. These helpers are the one
+* reading of the request every leg shares - the OIDC addon, the finish leg and
+* the passkey page - so a rule tightened for one is tightened for all:
+*
+*  - PKCE is mandatory and S256 only (`code_challenge` = base64url of a SHA-256);
+*  - `state` is echoed back exactly;
+*  - the return URL is one of {@link APP_AUTH_CALLBACK_URLS}, never a free URL;
+*  - the purpose is `new-session` or `step-up` (the legacy `renew` has no browser flow).
+*
+* Pure and dependency-free (zod only) so an addon, the backend and a spec read
+* the same code.
+*/
+/** What the app redeems the code for. `step-up` yields a proof, never a session. */
+var AppFlowPurposeSchema = _enum(["new-session", "step-up"]);
+/** Where the app is sent when the request names no `redirect`. */
+var APP_FLOW_DEFAULT_REDIRECT = "camstack://auth-callback";
+/** S256 challenge: base64url of 32 bytes = 43 characters, no padding. */
+var CHALLENGE_PATTERN = /^[A-Za-z0-9_-]{43}$/;
+/** The app's own `state`: URL-safe characters only, bounded. */
+var STATE_PATTERN = /^[A-Za-z0-9._~-]{1,256}$/;
+/** Operator-facing words for a refusal (the "clear page", D858). */
+var APP_FLOW_REFUSAL_MESSAGES = {
+	"bad-challenge": "The sign-in request has no valid PKCE challenge (S256).",
+	"bad-challenge-method": "Only the S256 PKCE method is supported.",
+	"bad-state": "The sign-in request has no valid state.",
+	"bad-purpose": "The sign-in request names an unknown purpose.",
+	"bad-redirect": "The sign-in request names a return address this hub does not accept."
+};
+/**
+* Read the app parameters off a start query: `code_challenge`,
+* `code_challenge_method`, `state`, `purpose`, `redirect`. Anything missing or
+* malformed is refused - there is no lenient default for PKCE or state.
+*/
+function parseAppFlowRequest(query) {
+	const challenge = query["code_challenge"];
+	if (challenge === void 0 || !CHALLENGE_PATTERN.test(challenge)) return {
+		ok: false,
+		reason: "bad-challenge"
+	};
+	if (query["code_challenge_method"] !== "S256") return {
+		ok: false,
+		reason: "bad-challenge-method"
+	};
+	const state = query["state"];
+	if (state === void 0 || !STATE_PATTERN.test(state)) return {
+		ok: false,
+		reason: "bad-state"
+	};
+	const purpose = AppFlowPurposeSchema.safeParse(query["purpose"]);
+	if (!purpose.success) return {
+		ok: false,
+		reason: "bad-purpose"
+	};
+	const redirectParam = query["redirect"];
+	const redirect = redirectParam === void 0 ? APP_FLOW_DEFAULT_REDIRECT : parseAppAuthCallback(redirectParam);
+	if (redirect === null) return {
+		ok: false,
+		reason: "bad-redirect"
+	};
+	return {
+		ok: true,
+		request: {
+			codeChallenge: challenge,
+			state,
+			purpose: purpose.data,
+			redirect
+		}
+	};
+}
+/** The app's callback with `code` (success) or `error` (refusal), and the echoed `state` when known. */
+function appFlowLocation(redirect, result, state) {
+	const params = new URLSearchParams();
+	if ("code" in result) params.set("code", result.code);
+	else params.set("error", result.error);
+	if (state !== void 0) params.set("state", state);
+	return `${redirect}?${params.toString()}`;
+}
+/** How a native app starts one login method (D858), as `auth.listLoginMethods` reports it. */
+var AppLoginPathSchema = discriminatedUnion("kind", [object({ kind: literal("native") }), object({
+	kind: literal("browser"),
+	startPath: string().startsWith("/")
+})]);
+/**
 * The cookie that binds an SSO sign-in to the browser that started it.
 *
 * An IdP `/start` sets it to a random value and keeps only its SHA-256 in the
@@ -12451,7 +12568,9 @@ object({
 	signature: literal(DEVICE_CERT_SIGNATURE),
 	messageVersion: literal(DEVICE_SIGNATURE_MESSAGE_VERSION),
 	/** Which clients can execute it: a native app silently, a browser with a non-extractable WebCrypto key. */
-	clients: array(_enum(["native", "web"]))
+	clients: array(_enum(["native", "web"])),
+	/** The app executes it itself, silently (D858). */
+	app: AppLoginPathSchema.nullable()
 });
 /** host[:port] — a DNS name, IPv4 or bracketed IPv6. No userinfo, path or spaces. */
 var AUTHORITY_RE = /^(?:[a-z0-9.-]+|\[[0-9a-f:.]+\])(?::\d{1,5})?$/i;
@@ -16134,6 +16253,208 @@ method(object({
 	kind: "mutation",
 	auth: "admin"
 }), method(object({}), array(KeychainSecretMetaSchema).readonly(), { auth: "admin" }), method(object({}), KeychainStateSchema, { auth: "admin" });
+/**
+* device-history — the ONE mechanism for numeric history (D850).
+*
+* A device value is recorded because its capability says so (the `history`
+* block of a `*.cap.ts`, captured hub-side from `DeviceStateChanged`); any
+* other series is DECLARED by the addon that produces it and fed with points
+* (`record`) or closed five-minute buckets (`recordBuckets`). Rollups 5m / 1h /
+* 1d are computed here and nowhere else. Storage is `history.db` (D851).
+*
+* Who the PRODUCER is: `declareSeries`, `record` and `recordBuckets` are owner
+* checked against the `callerAddonId` the transport stamps into a call that
+* crossed a process (never in an input schema, so a session cannot supply it).
+* A call with no stamp is refused `not-owner`. The methods are `admin` so a
+* non-admin session never reaches them; an addon's `ctx.api` call bypasses the
+* tier by design.
+*/
+/** Whose history: a real device, or a cluster node (load, memory). */
+var DeviceHistorySubjectSchema = discriminatedUnion("kind", [object({
+	kind: literal("device"),
+	deviceId: number().int()
+}), object({
+	kind: literal("node"),
+	nodeId: string().min(1)
+})]);
+var DeviceHistoryKindSchema = _enum([
+	"gauge",
+	"counter",
+	"boolean"
+]);
+var DeviceHistoryResolutionSchema = _enum([
+	"raw",
+	"5m",
+	"1h",
+	"1d"
+]);
+/** Why a producer's point or bucket was not stored. Counted, never silent (D391). */
+var DeviceHistoryRefusalReasonSchema = _enum([
+	"undeclared",
+	"not-owner",
+	"opted-out",
+	"not-a-real-device",
+	"rate",
+	"ingest-mismatch",
+	"out-of-range"
+]);
+var RefusalSchema = object({
+	key: string(),
+	reason: DeviceHistoryRefusalReasonSchema,
+	count: number().int()
+});
+var IngestResultSchema = object({
+	accepted: number().int(),
+	refused: array(RefusalSchema).readonly()
+});
+var SeriesInfoSchema = object({
+	key: string(),
+	scope: string(),
+	kind: DeviceHistoryKindSchema,
+	/** `null` is unknown (a `unitFrom` series whose device does not state a unit right now), never a guess. */
+	unit: string().nullable(),
+	displayName: string(),
+	source: _enum(["cap", "addon"]),
+	firstTs: number(),
+	lastTs: number()
+});
+var QueryPointSchema = object({
+	/** Raw: the point's time. Rollup: the bucket start. */
+	t: number(),
+	samples: number().int(),
+	/** `sum / samples`. */
+	mean: number().nullable(),
+	/** Time-weighted mean (`tw_sum / tw_ms`); `null` for bucket-ingested series. For a boolean: the fraction of time true. */
+	twMean: number().nullable(),
+	min: number(),
+	max: number(),
+	/** `null` is unknown, never zero (D393). */
+	last: number().nullable()
+});
+var QuerySeriesSchema = object({
+	scope: string(),
+	/** The last point STRICTLY BEFORE `from` in the chosen tier, so a step chart can start at the held value. */
+	before: object({
+		t: number(),
+		value: number().nullable()
+	}).nullable(),
+	points: array(QueryPointSchema).readonly()
+});
+/** The window part of a query, shared by the device and node forms. */
+var QueryWindowShape = {
+	key: string(),
+	scope: string().optional(),
+	from: number(),
+	to: number(),
+	resolution: union([DeviceHistoryResolutionSchema, literal("auto")]).default("auto"),
+	maxPoints: number().int().positive().max(5e3).default(1e3)
+};
+var QueryResultSchema = object({
+	resolution: DeviceHistoryResolutionSchema,
+	series: array(QuerySeriesSchema).readonly(),
+	truncated: boolean()
+});
+var TierStatusSchema = object({
+	tier: DeviceHistoryResolutionSchema,
+	/** `null` until the first background count answered. */
+	rows: number().int().nullable(),
+	/** `rows` times a fixed per-row estimate — approximate, labelled so. */
+	approxBytes: number().nullable(),
+	countedAt: number().nullable()
+});
+/** Operator/diagnostic view: rows per tier, last runs, refusals and drops since boot. */
+var DeviceHistoryStatusSchema = object({
+	startedAt: number(),
+	/** The store is declared, series loaded and the first reconcile has answered. */
+	ready: boolean(),
+	series: number().int(),
+	metrics: number().int(),
+	optedOutDevices: number().int(),
+	tiers: array(TierStatusSchema).readonly(),
+	capture: object({
+		eventsSeen: number().int(),
+		pointsEmitted: number().int(),
+		pointsWritten: number().int(),
+		pointsDropped: number().int(),
+		bufferDepth: number().int(),
+		trailingEmitted: number().int(),
+		reconciledPoints: number().int(),
+		reconcileRuns: number().int(),
+		reconcileFailures: number().int(),
+		lastReconcileAt: number().nullable(),
+		lastFlushAt: number().nullable(),
+		flushFailures: number().int(),
+		skipped: record(string(), number().int())
+	}),
+	ingest: object({
+		accepted: number().int(),
+		refused: record(string(), number().int())
+	}),
+	rollup: object({
+		last5mAt: number().nullable(),
+		last1hAt: number().nullable(),
+		last1dAt: number().nullable(),
+		errors: number().int(),
+		dirty5m: number().int(),
+		dirty1h: number().int(),
+		dirty1d: number().int()
+	}),
+	retention: object({
+		lastRunAt: number().nullable(),
+		deleted: record(string(), number().int()),
+		purgedSeries: number().int()
+	}),
+	directory: object({
+		devices: number().int(),
+		lastRefreshAt: number().nullable()
+	})
+});
+method(object({ deviceId: number().int() }), array(SeriesInfoSchema).readonly()), method(object({ nodeId: string().min(1) }), array(SeriesInfoSchema).readonly(), { auth: "admin" }), method(object({
+	deviceId: number().int(),
+	...QueryWindowShape
+}), QueryResultSchema), method(object({
+	nodeId: string().min(1),
+	...QueryWindowShape
+}), QueryResultSchema, { auth: "admin" }), method(object({
+	name: string().regex(/^[a-z0-9-]+$/),
+	subjectKind: _enum(["device", "node"]),
+	kind: DeviceHistoryKindSchema,
+	unit: string().optional(),
+	displayName: string().min(1),
+	ingest: _enum(["points", "buckets"])
+}), object({ key: string() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ points: array(object({
+	key: string(),
+	subject: DeviceHistorySubjectSchema,
+	scope: string().default(""),
+	ts: number(),
+	value: number()
+})).max(5e3) }), IngestResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ buckets: array(object({
+	key: string(),
+	subject: DeviceHistorySubjectSchema,
+	scope: string().default(""),
+	bucketStart: number(),
+	samples: number().int().positive(),
+	sum: number(),
+	min: number(),
+	max: number(),
+	last: number().nullable(),
+	lastTs: number().nullable()
+})).max(5e3) }), IngestResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ deviceId: number().int() }), object({ enabled: boolean() })), method(object({
+	deviceId: number().int(),
+	enabled: boolean()
+}), object({ enabled: boolean() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({}), DeviceHistoryStatusSchema, { auth: "admin" });
 var DeviceCaStatusSchema = discriminatedUnion("state", [
 	object({ state: literal("absent") }),
 	object({
@@ -16251,6 +16572,9 @@ method(object({}), object({
 }), {
 	kind: "mutation",
 	auth: "admin"
+}), method(object({}), object({ ok: literal(true) }), {
+	kind: "mutation",
+	auth: "admin"
 }), method(object({
 	certPem: string().min(1),
 	caCertPem: string().min(1),
@@ -39016,7 +39340,13 @@ var LoginMethodContributionSchema = discriminatedUnion("kind", [
 		* `beginExternalLink` offer exactly the redirect methods that set this,
 		* whatever their id. Absent / false — a login button only.
 		*/
-		linkable: boolean().optional()
+		linkable: boolean().optional(),
+		/**
+		* How a NATIVE app starts this method (D858): `{ kind: 'browser', startPath }`
+		* when the route understands the app flow query (`app=1&code_challenge=…`),
+		* `null`/absent when there is no app path - the app hides the method.
+		*/
+		app: AppLoginPathSchema.nullable().optional()
 	}),
 	object({
 		kind: literal("widget"),
@@ -39028,7 +39358,9 @@ var LoginMethodContributionSchema = discriminatedUnion("kind", [
 		bundle: string(),
 		/** MF remote descriptor — `{ remoteName, exposedModule, componentKey }`. */
 		remote: WidgetRemoteSchema,
-		stage: LoginStageEnum
+		stage: LoginStageEnum,
+		/** Widgets are web ceremonies: no native app path (D858). Absent reads as `null`. */
+		app: AppLoginPathSchema.nullable().optional()
 	}),
 	object({
 		kind: literal("passkey"),
@@ -39040,7 +39372,9 @@ var LoginMethodContributionSchema = discriminatedUnion("kind", [
 		/** Effective WebAuthn RP ID (`resolveRpID()`) — the shell gates visibility on it. */
 		rpId: string(),
 		/** Effective expected origin (`resolveOrigin()`), null when unconfigured. */
-		origin: string().nullable()
+		origin: string().nullable(),
+		/** Set by the hub for the primary arm; a second-factor passkey has no app path (D858). */
+		app: AppLoginPathSchema.nullable().optional()
 	})
 ]);
 var loginMethodCapability = {
@@ -49597,7 +49931,20 @@ var SsoBridgeClaimsSchema = object({
 	* request to present the matching cookie — a login bridge is useless in
 	* any other browser.
 	*/
-	browserBinding: string().optional()
+	browserBinding: string().optional(),
+	/**
+	* The native app that started this sign-in (D858): its PKCE challenge,
+	* `state`, purpose and allow-listed return URL, copied from the server-side
+	* pending OIDC state. A bridge carrying it is finished ONLY at
+	* `/api/auth/sso/finish-app` (which mints a handoff code, never a web
+	* session); `/api/auth/sso/finish` refuses it.
+	*/
+	app: object({
+		codeChallenge: string(),
+		state: string(),
+		purpose: _enum(["new-session", "step-up"]),
+		redirect: string()
+	}).optional()
 });
 method(object({
 	claims: SsoBridgeClaimsSchema,
@@ -55037,7 +55384,7 @@ var MotionOnMotionChangedDataSchema = object({
 	/** Who started it (D672). Absent = the camera itself. Only `onboard` carries `sensor`. */
 	triggeredBy: MotionTriggeredBySchema.optional()
 });
-DeviceType.Camera, DeviceType.Sensor, method(object({ deviceId: number() }), boolean());
+DeviceType.Camera, DeviceType.Sensor, method(object({ deviceId: number() }), boolean()), DeviceType.Camera;
 object({
 	enabled: boolean(),
 	/** Ms epoch of the last operator-driven change. */
@@ -62394,6 +62741,66 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"deviceHistory.declareSeries": {
+		capName: "device-history",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"deviceHistory.getDeviceEnabled": {
+		capName: "device-history",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"deviceHistory.getStatus": {
+		capName: "device-history",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"deviceHistory.listNodeSeries": {
+		capName: "device-history",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"deviceHistory.listSeries": {
+		capName: "device-history",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"deviceHistory.query": {
+		capName: "device-history",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"deviceHistory.queryNode": {
+		capName: "device-history",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"deviceHistory.record": {
+		capName: "device-history",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"deviceHistory.recordBuckets": {
+		capName: "device-history",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"deviceHistory.setDeviceEnabled": {
+		capName: "device-history",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"deviceManager.addLocation": {
 		capName: "device-manager",
 		capScope: "system",
@@ -64458,6 +64865,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"nodeCertificates.forgetHub": {
+		capName: "node-certificates",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
 	"nodeCertificates.getCertificates": {
 		capName: "node-certificates",
 		capScope: "system",
@@ -69185,6 +69598,26 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"deviceHistory.getDeviceEnabled": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceHistory.listSeries": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceHistory.query": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceHistory.setDeviceEnabled": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"deviceManager.adoptionRelease": [{
 		name: "camDeviceId",
 		form: "single",
@@ -71363,6 +71796,7 @@ Object.freeze({
 	"network-access": "ingress",
 	"smtp-provider": "email"
 });
+DeviceType.Camera;
 var G711_SCALE_CORRECTION_DB = {
 	PCMU: 20 * Math.log10(4),
 	PCMA: 20 * Math.log10(8)
@@ -72429,4 +72863,4 @@ DEFAULT_NATIVE_LEASE_SETTINGS.admission;
 var MB = 1024 * 1024;
 1024 * MB, 3072 * MB;
 //#endregion
-export { array as C, string as D, object as E, toSecretFieldView as S, number as T, SECRET_CLEAR as _, authProviderCapability as a, isSecretClear as b, loginMethodCapability as c, pickRequestOrigin as d, requestMountPrefix as f, BaseAddon as g, errMsg as h, advertisedHubOrigins as i, normalizeOrigin as l, userPasskeysCapability as m, addonRoutesCapability as n, buildAddonRouteProvider as o, resolveIconKey as p, addonWidgetsSourceCapability as r, claimedRequestOrigins as s, SSO_STATE_COOKIE as t, oidcConnectionsCapability as u, arrayItemFieldPath as v, boolean as w, isSecretMarker as x, globalSecretScope as y };
+export { object as A, globalSecretScope as C, array as D, toSecretFieldView as E, boolean as O, arrayItemFieldPath as S, isSecretMarker as T, resolveIconKey as _, addonWidgetsSourceCapability as a, BaseAddon as b, authProviderCapability as c, loginMethodCapability as d, normalizeOrigin as f, requestMountPrefix as g, pickRequestOrigin as h, addonRoutesCapability as i, string as j, number as k, buildAddonRouteProvider as l, parseAppFlowRequest as m, APP_FLOW_REFUSAL_MESSAGES as n, advertisedHubOrigins as o, oidcConnectionsCapability as p, SSO_STATE_COOKIE as r, appFlowLocation as s, APP_FLOW_DEFAULT_REDIRECT as t, claimedRequestOrigins as u, userPasskeysCapability as v, isSecretClear as w, SECRET_CLEAR as x, errMsg as y };