@camstack/addon-auth 1.2.144 → 1.2.145

package/dist/{dist-0YTEFDYk.js → dist-Be0i-dLp.js}

@@ -5420,7 +5420,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-BBF1iXUi.mjs
+//#region ../types/dist/sleep-DAX0-2v9.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -12313,6 +12313,123 @@ var ConvertResultSchema = object({
 	})).readonly()
 });
 /**
+* The viewer app's custom-scheme callback — the ONE list of URLs a hub flow
+* may hand a browser back to the native app at.
+*
+* Two readers, one answer: the admin-ui login page (`redirect=` for the
+* native sign-in handoff) and the hub itself (`auth.beginExternalLink`'s
+* `returnTo` for a native account link, D801). Both validate against this
+* list, so a scheme added for one flow can never be accepted by one side and
+* refused by the other.
+*
+* `camstack` is the production app; `camstack.dev` the dev client
+* (`APP_VARIANT=development`). Exact match after canonicalisation — no
+* query or fragment riders, no http(s).
+*/
+var APP_AUTH_CALLBACK_URLS = ["camstack://auth-callback", "camstack.dev://auth-callback"];
+/**
+* The variants the OS / linking layer produces for the same callback:
+* `scheme:///auth-callback` (expo-linking's empty-host standalone form — three
+* slashes) and a trailing `/` both mean `scheme://auth-callback`. Nothing else
+* is normalised: riders keep failing the exact match.
+*/
+function canonicalizeAppCallback(raw) {
+	return raw.replace(/^([a-z][a-z0-9.+-]*):\/\/\/(?!\/)/i, "$1://").replace(/\/$/, "");
+}
+/** The canonical allowlisted callback `raw` names, or `null`. */
+function parseAppAuthCallback(raw) {
+	if (typeof raw !== "string" || raw.length === 0 || raw.length > 512) return null;
+	const canonical = canonicalizeAppCallback(raw);
+	return APP_AUTH_CALLBACK_URLS.includes(canonical) ? canonical : null;
+}
+/**
+* The native-app browser sign-in flows the hub serves itself (D858).
+*
+* The viewer app opens the system browser at a hub START route (OIDC
+* `/addon/auth-oidc/<id>/start`, the passkey page `/auth/app/passkey`) and gets
+* a one-shot handoff code back at its custom scheme. These helpers are the one
+* reading of the request every leg shares - the OIDC addon, the finish leg and
+* the passkey page - so a rule tightened for one is tightened for all:
+*
+*  - PKCE is mandatory and S256 only (`code_challenge` = base64url of a SHA-256);
+*  - `state` is echoed back exactly;
+*  - the return URL is one of {@link APP_AUTH_CALLBACK_URLS}, never a free URL;
+*  - the purpose is `new-session` or `step-up` (the legacy `renew` has no browser flow).
+*
+* Pure and dependency-free (zod only) so an addon, the backend and a spec read
+* the same code.
+*/
+/** What the app redeems the code for. `step-up` yields a proof, never a session. */
+var AppFlowPurposeSchema = _enum(["new-session", "step-up"]);
+/** Where the app is sent when the request names no `redirect`. */
+var APP_FLOW_DEFAULT_REDIRECT = "camstack://auth-callback";
+/** S256 challenge: base64url of 32 bytes = 43 characters, no padding. */
+var CHALLENGE_PATTERN = /^[A-Za-z0-9_-]{43}$/;
+/** The app's own `state`: URL-safe characters only, bounded. */
+var STATE_PATTERN = /^[A-Za-z0-9._~-]{1,256}$/;
+/** Operator-facing words for a refusal (the "clear page", D858). */
+var APP_FLOW_REFUSAL_MESSAGES = {
+	"bad-challenge": "The sign-in request has no valid PKCE challenge (S256).",
+	"bad-challenge-method": "Only the S256 PKCE method is supported.",
+	"bad-state": "The sign-in request has no valid state.",
+	"bad-purpose": "The sign-in request names an unknown purpose.",
+	"bad-redirect": "The sign-in request names a return address this hub does not accept."
+};
+/**
+* Read the app parameters off a start query: `code_challenge`,
+* `code_challenge_method`, `state`, `purpose`, `redirect`. Anything missing or
+* malformed is refused - there is no lenient default for PKCE or state.
+*/
+function parseAppFlowRequest(query) {
+	const challenge = query["code_challenge"];
+	if (challenge === void 0 || !CHALLENGE_PATTERN.test(challenge)) return {
+		ok: false,
+		reason: "bad-challenge"
+	};
+	if (query["code_challenge_method"] !== "S256") return {
+		ok: false,
+		reason: "bad-challenge-method"
+	};
+	const state = query["state"];
+	if (state === void 0 || !STATE_PATTERN.test(state)) return {
+		ok: false,
+		reason: "bad-state"
+	};
+	const purpose = AppFlowPurposeSchema.safeParse(query["purpose"]);
+	if (!purpose.success) return {
+		ok: false,
+		reason: "bad-purpose"
+	};
+	const redirectParam = query["redirect"];
+	const redirect = redirectParam === void 0 ? APP_FLOW_DEFAULT_REDIRECT : parseAppAuthCallback(redirectParam);
+	if (redirect === null) return {
+		ok: false,
+		reason: "bad-redirect"
+	};
+	return {
+		ok: true,
+		request: {
+			codeChallenge: challenge,
+			state,
+			purpose: purpose.data,
+			redirect
+		}
+	};
+}
+/** The app's callback with `code` (success) or `error` (refusal), and the echoed `state` when known. */
+function appFlowLocation(redirect, result, state) {
+	const params = new URLSearchParams();
+	if ("code" in result) params.set("code", result.code);
+	else params.set("error", result.error);
+	if (state !== void 0) params.set("state", state);
+	return `${redirect}?${params.toString()}`;
+}
+/** How a native app starts one login method (D858), as `auth.listLoginMethods` reports it. */
+var AppLoginPathSchema = discriminatedUnion("kind", [object({ kind: literal("native") }), object({
+	kind: literal("browser"),
+	startPath: string().startsWith("/")
+})]);
+/**
 * The cookie that binds an SSO sign-in to the browser that started it.
 *
 * An IdP `/start` sets it to a random value and keeps only its SHA-256 in the
@@ -12485,7 +12602,9 @@ object({
 	signature: literal(DEVICE_CERT_SIGNATURE),
 	messageVersion: literal(DEVICE_SIGNATURE_MESSAGE_VERSION),
 	/** Which clients can execute it: a native app silently, a browser with a non-extractable WebCrypto key. */
-	clients: array(_enum(["native", "web"]))
+	clients: array(_enum(["native", "web"])),
+	/** The app executes it itself, silently (D858). */
+	app: AppLoginPathSchema.nullable()
 });
 /** host[:port] — a DNS name, IPv4 or bracketed IPv6. No userinfo, path or spaces. */
 var AUTHORITY_RE = /^(?:[a-z0-9.-]+|\[[0-9a-f:.]+\])(?::\d{1,5})?$/i;
@@ -16168,6 +16287,208 @@ method(object({
 	kind: "mutation",
 	auth: "admin"
 }), method(object({}), array(KeychainSecretMetaSchema).readonly(), { auth: "admin" }), method(object({}), KeychainStateSchema, { auth: "admin" });
+/**
+* device-history — the ONE mechanism for numeric history (D850).
+*
+* A device value is recorded because its capability says so (the `history`
+* block of a `*.cap.ts`, captured hub-side from `DeviceStateChanged`); any
+* other series is DECLARED by the addon that produces it and fed with points
+* (`record`) or closed five-minute buckets (`recordBuckets`). Rollups 5m / 1h /
+* 1d are computed here and nowhere else. Storage is `history.db` (D851).
+*
+* Who the PRODUCER is: `declareSeries`, `record` and `recordBuckets` are owner
+* checked against the `callerAddonId` the transport stamps into a call that
+* crossed a process (never in an input schema, so a session cannot supply it).
+* A call with no stamp is refused `not-owner`. The methods are `admin` so a
+* non-admin session never reaches them; an addon's `ctx.api` call bypasses the
+* tier by design.
+*/
+/** Whose history: a real device, or a cluster node (load, memory). */
+var DeviceHistorySubjectSchema = discriminatedUnion("kind", [object({
+	kind: literal("device"),
+	deviceId: number().int()
+}), object({
+	kind: literal("node"),
+	nodeId: string().min(1)
+})]);
+var DeviceHistoryKindSchema = _enum([
+	"gauge",
+	"counter",
+	"boolean"
+]);
+var DeviceHistoryResolutionSchema = _enum([
+	"raw",
+	"5m",
+	"1h",
+	"1d"
+]);
+/** Why a producer's point or bucket was not stored. Counted, never silent (D391). */
+var DeviceHistoryRefusalReasonSchema = _enum([
+	"undeclared",
+	"not-owner",
+	"opted-out",
+	"not-a-real-device",
+	"rate",
+	"ingest-mismatch",
+	"out-of-range"
+]);
+var RefusalSchema = object({
+	key: string(),
+	reason: DeviceHistoryRefusalReasonSchema,
+	count: number().int()
+});
+var IngestResultSchema = object({
+	accepted: number().int(),
+	refused: array(RefusalSchema).readonly()
+});
+var SeriesInfoSchema = object({
+	key: string(),
+	scope: string(),
+	kind: DeviceHistoryKindSchema,
+	/** `null` is unknown (a `unitFrom` series whose device does not state a unit right now), never a guess. */
+	unit: string().nullable(),
+	displayName: string(),
+	source: _enum(["cap", "addon"]),
+	firstTs: number(),
+	lastTs: number()
+});
+var QueryPointSchema = object({
+	/** Raw: the point's time. Rollup: the bucket start. */
+	t: number(),
+	samples: number().int(),
+	/** `sum / samples`. */
+	mean: number().nullable(),
+	/** Time-weighted mean (`tw_sum / tw_ms`); `null` for bucket-ingested series. For a boolean: the fraction of time true. */
+	twMean: number().nullable(),
+	min: number(),
+	max: number(),
+	/** `null` is unknown, never zero (D393). */
+	last: number().nullable()
+});
+var QuerySeriesSchema = object({
+	scope: string(),
+	/** The last point STRICTLY BEFORE `from` in the chosen tier, so a step chart can start at the held value. */
+	before: object({
+		t: number(),
+		value: number().nullable()
+	}).nullable(),
+	points: array(QueryPointSchema).readonly()
+});
+/** The window part of a query, shared by the device and node forms. */
+var QueryWindowShape = {
+	key: string(),
+	scope: string().optional(),
+	from: number(),
+	to: number(),
+	resolution: union([DeviceHistoryResolutionSchema, literal("auto")]).default("auto"),
+	maxPoints: number().int().positive().max(5e3).default(1e3)
+};
+var QueryResultSchema = object({
+	resolution: DeviceHistoryResolutionSchema,
+	series: array(QuerySeriesSchema).readonly(),
+	truncated: boolean()
+});
+var TierStatusSchema = object({
+	tier: DeviceHistoryResolutionSchema,
+	/** `null` until the first background count answered. */
+	rows: number().int().nullable(),
+	/** `rows` times a fixed per-row estimate — approximate, labelled so. */
+	approxBytes: number().nullable(),
+	countedAt: number().nullable()
+});
+/** Operator/diagnostic view: rows per tier, last runs, refusals and drops since boot. */
+var DeviceHistoryStatusSchema = object({
+	startedAt: number(),
+	/** The store is declared, series loaded and the first reconcile has answered. */
+	ready: boolean(),
+	series: number().int(),
+	metrics: number().int(),
+	optedOutDevices: number().int(),
+	tiers: array(TierStatusSchema).readonly(),
+	capture: object({
+		eventsSeen: number().int(),
+		pointsEmitted: number().int(),
+		pointsWritten: number().int(),
+		pointsDropped: number().int(),
+		bufferDepth: number().int(),
+		trailingEmitted: number().int(),
+		reconciledPoints: number().int(),
+		reconcileRuns: number().int(),
+		reconcileFailures: number().int(),
+		lastReconcileAt: number().nullable(),
+		lastFlushAt: number().nullable(),
+		flushFailures: number().int(),
+		skipped: record(string(), number().int())
+	}),
+	ingest: object({
+		accepted: number().int(),
+		refused: record(string(), number().int())
+	}),
+	rollup: object({
+		last5mAt: number().nullable(),
+		last1hAt: number().nullable(),
+		last1dAt: number().nullable(),
+		errors: number().int(),
+		dirty5m: number().int(),
+		dirty1h: number().int(),
+		dirty1d: number().int()
+	}),
+	retention: object({
+		lastRunAt: number().nullable(),
+		deleted: record(string(), number().int()),
+		purgedSeries: number().int()
+	}),
+	directory: object({
+		devices: number().int(),
+		lastRefreshAt: number().nullable()
+	})
+});
+method(object({ deviceId: number().int() }), array(SeriesInfoSchema).readonly()), method(object({ nodeId: string().min(1) }), array(SeriesInfoSchema).readonly(), { auth: "admin" }), method(object({
+	deviceId: number().int(),
+	...QueryWindowShape
+}), QueryResultSchema), method(object({
+	nodeId: string().min(1),
+	...QueryWindowShape
+}), QueryResultSchema, { auth: "admin" }), method(object({
+	name: string().regex(/^[a-z0-9-]+$/),
+	subjectKind: _enum(["device", "node"]),
+	kind: DeviceHistoryKindSchema,
+	unit: string().optional(),
+	displayName: string().min(1),
+	ingest: _enum(["points", "buckets"])
+}), object({ key: string() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ points: array(object({
+	key: string(),
+	subject: DeviceHistorySubjectSchema,
+	scope: string().default(""),
+	ts: number(),
+	value: number()
+})).max(5e3) }), IngestResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ buckets: array(object({
+	key: string(),
+	subject: DeviceHistorySubjectSchema,
+	scope: string().default(""),
+	bucketStart: number(),
+	samples: number().int().positive(),
+	sum: number(),
+	min: number(),
+	max: number(),
+	last: number().nullable(),
+	lastTs: number().nullable()
+})).max(5e3) }), IngestResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ deviceId: number().int() }), object({ enabled: boolean() })), method(object({
+	deviceId: number().int(),
+	enabled: boolean()
+}), object({ enabled: boolean() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({}), DeviceHistoryStatusSchema, { auth: "admin" });
 var DeviceCaStatusSchema = discriminatedUnion("state", [
 	object({ state: literal("absent") }),
 	object({
@@ -16285,6 +16606,9 @@ method(object({}), object({
 }), {
 	kind: "mutation",
 	auth: "admin"
+}), method(object({}), object({ ok: literal(true) }), {
+	kind: "mutation",
+	auth: "admin"
 }), method(object({
 	certPem: string().min(1),
 	caCertPem: string().min(1),
@@ -39050,7 +39374,13 @@ var LoginMethodContributionSchema = discriminatedUnion("kind", [
 		* `beginExternalLink` offer exactly the redirect methods that set this,
 		* whatever their id. Absent / false — a login button only.
 		*/
-		linkable: boolean().optional()
+		linkable: boolean().optional(),
+		/**
+		* How a NATIVE app starts this method (D858): `{ kind: 'browser', startPath }`
+		* when the route understands the app flow query (`app=1&code_challenge=…`),
+		* `null`/absent when there is no app path - the app hides the method.
+		*/
+		app: AppLoginPathSchema.nullable().optional()
 	}),
 	object({
 		kind: literal("widget"),
@@ -39062,7 +39392,9 @@ var LoginMethodContributionSchema = discriminatedUnion("kind", [
 		bundle: string(),
 		/** MF remote descriptor — `{ remoteName, exposedModule, componentKey }`. */
 		remote: WidgetRemoteSchema,
-		stage: LoginStageEnum
+		stage: LoginStageEnum,
+		/** Widgets are web ceremonies: no native app path (D858). Absent reads as `null`. */
+		app: AppLoginPathSchema.nullable().optional()
 	}),
 	object({
 		kind: literal("passkey"),
@@ -39074,7 +39406,9 @@ var LoginMethodContributionSchema = discriminatedUnion("kind", [
 		/** Effective WebAuthn RP ID (`resolveRpID()`) — the shell gates visibility on it. */
 		rpId: string(),
 		/** Effective expected origin (`resolveOrigin()`), null when unconfigured. */
-		origin: string().nullable()
+		origin: string().nullable(),
+		/** Set by the hub for the primary arm; a second-factor passkey has no app path (D858). */
+		app: AppLoginPathSchema.nullable().optional()
 	})
 ]);
 var loginMethodCapability = {
@@ -49631,7 +49965,20 @@ var SsoBridgeClaimsSchema = object({
 	* request to present the matching cookie — a login bridge is useless in
 	* any other browser.
 	*/
-	browserBinding: string().optional()
+	browserBinding: string().optional(),
+	/**
+	* The native app that started this sign-in (D858): its PKCE challenge,
+	* `state`, purpose and allow-listed return URL, copied from the server-side
+	* pending OIDC state. A bridge carrying it is finished ONLY at
+	* `/api/auth/sso/finish-app` (which mints a handoff code, never a web
+	* session); `/api/auth/sso/finish` refuses it.
+	*/
+	app: object({
+		codeChallenge: string(),
+		state: string(),
+		purpose: _enum(["new-session", "step-up"]),
+		redirect: string()
+	}).optional()
 });
 method(object({
 	claims: SsoBridgeClaimsSchema,
@@ -55071,7 +55418,7 @@ var MotionOnMotionChangedDataSchema = object({
 	/** Who started it (D672). Absent = the camera itself. Only `onboard` carries `sensor`. */
 	triggeredBy: MotionTriggeredBySchema.optional()
 });
-DeviceType.Camera, DeviceType.Sensor, method(object({ deviceId: number() }), boolean());
+DeviceType.Camera, DeviceType.Sensor, method(object({ deviceId: number() }), boolean()), DeviceType.Camera;
 object({
 	enabled: boolean(),
 	/** Ms epoch of the last operator-driven change. */
@@ -62428,6 +62775,66 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"deviceHistory.declareSeries": {
+		capName: "device-history",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"deviceHistory.getDeviceEnabled": {
+		capName: "device-history",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"deviceHistory.getStatus": {
+		capName: "device-history",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"deviceHistory.listNodeSeries": {
+		capName: "device-history",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"deviceHistory.listSeries": {
+		capName: "device-history",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"deviceHistory.query": {
+		capName: "device-history",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"deviceHistory.queryNode": {
+		capName: "device-history",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"deviceHistory.record": {
+		capName: "device-history",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"deviceHistory.recordBuckets": {
+		capName: "device-history",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"deviceHistory.setDeviceEnabled": {
+		capName: "device-history",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"deviceManager.addLocation": {
 		capName: "device-manager",
 		capScope: "system",
@@ -64492,6 +64899,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"nodeCertificates.forgetHub": {
+		capName: "node-certificates",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
 	"nodeCertificates.getCertificates": {
 		capName: "node-certificates",
 		capScope: "system",
@@ -69219,6 +69632,26 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"deviceHistory.getDeviceEnabled": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceHistory.listSeries": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceHistory.query": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceHistory.setDeviceEnabled": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"deviceManager.adoptionRelease": [{
 		name: "camDeviceId",
 		form: "single",
@@ -71397,6 +71830,7 @@ Object.freeze({
 	"network-access": "ingress",
 	"smtp-provider": "email"
 });
+DeviceType.Camera;
 var G711_SCALE_CORRECTION_DB = {
 	PCMU: 20 * Math.log10(4),
 	PCMA: 20 * Math.log10(8)
@@ -72463,6 +72897,18 @@ DEFAULT_NATIVE_LEASE_SETTINGS.admission;
 var MB = 1024 * 1024;
 1024 * MB, 3072 * MB;
 //#endregion
+Object.defineProperty(exports, "APP_FLOW_DEFAULT_REDIRECT", {
+	enumerable: true,
+	get: function() {
+		return APP_FLOW_DEFAULT_REDIRECT;
+	}
+});
+Object.defineProperty(exports, "APP_FLOW_REFUSAL_MESSAGES", {
+	enumerable: true,
+	get: function() {
+		return APP_FLOW_REFUSAL_MESSAGES;
+	}
+});
 Object.defineProperty(exports, "BaseAddon", {
 	enumerable: true,
 	get: function() {
@@ -72529,6 +72975,12 @@ Object.defineProperty(exports, "advertisedHubOrigins", {
 		return advertisedHubOrigins;
 	}
 });
+Object.defineProperty(exports, "appFlowLocation", {
+	enumerable: true,
+	get: function() {
+		return appFlowLocation;
+	}
+});
 Object.defineProperty(exports, "array", {
 	enumerable: true,
 	get: function() {
@@ -72619,6 +73071,12 @@ Object.defineProperty(exports, "oidcConnectionsCapability", {
 		return oidcConnectionsCapability;
 	}
 });
+Object.defineProperty(exports, "parseAppFlowRequest", {
+	enumerable: true,
+	get: function() {
+		return parseAppFlowRequest;
+	}
+});
 Object.defineProperty(exports, "pickRequestOrigin", {
 	enumerable: true,
 	get: function() {