@camstack/addon-auth 1.2.146 → 1.2.147

package/dist/{dist-BtJOajm3.mjs → dist-BGsjH-S3.mjs}

@@ -12327,6 +12327,13 @@ function parseAppAuthCallback(raw) {
 */
 /** What the app redeems the code for. `step-up` yields a proof, never a session. */
 var AppFlowPurposeSchema = _enum(["new-session", "step-up"]);
+/** The languages the hub's app landing pages are written in (D858). */
+var AppPageLangSchema = _enum(["en", "it"]);
+/** Narrows an untrusted `lang` value to the allow-list; anything else is `undefined`, never echoed. */
+function parseAppPageLang(value) {
+	const parsed = AppPageLangSchema.safeParse(value);
+	return parsed.success ? parsed.data : void 0;
+}
 /** Where the app is sent when the request names no `redirect`. */
 var APP_FLOW_DEFAULT_REDIRECT = "camstack://auth-callback";
 /** S256 challenge: base64url of 32 bytes = 43 characters, no padding. */
@@ -12343,7 +12350,8 @@ var STATE_PATTERN = /^[A-Za-z0-9._~-]{1,256}$/;
 var APP_REFUSED_PATH = "/auth/app/refused";
 /**
 * Read the app parameters off a start query: `code_challenge`,
-* `code_challenge_method`, `state`, `purpose`, `redirect`. Anything missing or
+* `code_challenge_method`, `state`, `purpose`, `redirect`, and the optional `lang` (an unknown value is
+* dropped, not refused). Anything missing or
 * malformed is refused - there is no lenient default for PKCE or state.
 */
 function parseAppFlowRequest(query) {
@@ -12372,13 +12380,15 @@ function parseAppFlowRequest(query) {
 		ok: false,
 		reason: "bad-redirect"
 	};
+	const lang = parseAppPageLang(query["lang"]);
 	return {
 		ok: true,
 		request: {
 			codeChallenge: challenge,
 			state,
 			purpose: purpose.data,
-			redirect
+			redirect,
+			...lang !== void 0 ? { lang } : {}
 		}
 	};
 }
@@ -49957,7 +49967,9 @@ var SsoBridgeClaimsSchema = object({
 		codeChallenge: string(),
 		state: string(),
 		purpose: _enum(["new-session", "step-up"]),
-		redirect: string()
+		redirect: string(),
+		/** The page language the app asked for (D858); the confirm page speaks it. */
+		lang: _enum(["en", "it"]).optional()
 	}).optional()
 });
 method(object({
@@ -59356,6 +59368,21 @@ DeviceType.Switch, DeviceType.Siren, DeviceType.Light, method(object({
 	on: boolean(),
 	lastChangedAt: number()
 });
+/** C0 controls, DEL and the C1 range: none of them belongs in a name. */
+function hasControlCharacter(value) {
+	for (const char of value) {
+		const code = char.codePointAt(0) ?? 0;
+		if (code <= 31 || code >= 127 && code <= 159) return true;
+	}
+	return false;
+}
+string().transform((value) => value.trim()).pipe(string().min(1, "The server name cannot be empty").max(48, `The server name is at most 48 characters`).refine((value) => !hasControlCharacter(value), { message: "The server name cannot contain control characters" }));
+/** What every reader gets: the name to show, and whether the hub chose it itself. */
+var ServerNameInfoSchema = object({
+	name: string(),
+	/** `true` when nobody named the hub: `name` is the machine hostname. */
+	isDefault: boolean()
+});
 /**
 * system — system-scoped singleton capability exposing hub-level
 * health, feature flags, network interface enumeration, and the
@@ -59385,6 +59412,12 @@ var FeatureManifestSchema = object({
 	backup: boolean(),
 	repl: boolean()
 });
+/**
+* `system.info`: the feature flags plus the hub's human name (D861). The name is
+* `{ name, isDefault }` — `isDefault: true` means nobody named the hub and `name`
+* is the machine hostname.
+*/
+var SystemInfoSchema = FeatureManifestSchema.extend({ serverName: ServerNameInfoSchema });
 var HealthStatusSchema = object({
 	status: literal("ok"),
 	uptime: number()
@@ -59857,7 +59890,7 @@ var LoggingSettingsStateSchema = object({
 	opsLogRetentionDays: number().int().min(0),
 	persisted: boolean()
 });
-method(_void(), FeatureManifestSchema), method(_void(), HealthStatusSchema), method(_void(), FeatureManifestSchema), method(_void(), array(NetworkAddressSchema).readonly()), method(_void(), unknown().nullable(), { auth: "admin" }), method(record(string(), unknown()), _null(), {
+method(_void(), SystemInfoSchema), method(_void(), HealthStatusSchema), method(_void(), FeatureManifestSchema), method(_void(), array(NetworkAddressSchema).readonly()), method(_void(), unknown().nullable(), { auth: "admin" }), method(record(string(), unknown()), _null(), {
 	kind: "mutation",
 	auth: "admin"
 }), method(_void(), _void(), {
@@ -72892,4 +72925,4 @@ DEFAULT_NATIVE_LEASE_SETTINGS.admission;
 var MB = 1024 * 1024;
 1024 * MB, 3072 * MB;
 //#endregion
-export { object as A, globalSecretScope as C, array as D, toSecretFieldView as E, boolean as O, arrayItemFieldPath as S, isSecretMarker as T, resolveIconKey as _, addonWidgetsSourceCapability as a, BaseAddon as b, authProviderCapability as c, loginMethodCapability as d, normalizeOrigin as f, requestMountPrefix as g, pickRequestOrigin as h, addonRoutesCapability as i, string as j, number as k, buildAddonRouteProvider as l, parseAppFlowRequest as m, APP_REFUSED_PATH as n, advertisedHubOrigins as o, oidcConnectionsCapability as p, SSO_STATE_COOKIE as r, appFlowLocation as s, APP_FLOW_DEFAULT_REDIRECT as t, claimedRequestOrigins as u, userPasskeysCapability as v, isSecretClear as w, SECRET_CLEAR as x, errMsg as y };
+export { number as A, arrayItemFieldPath as C, toSecretFieldView as D, isSecretMarker as E, string as M, array as O, SECRET_CLEAR as S, isSecretClear as T, requestMountPrefix as _, addonWidgetsSourceCapability as a, errMsg as b, authProviderCapability as c, loginMethodCapability as d, normalizeOrigin as f, pickRequestOrigin as g, parseAppPageLang as h, addonRoutesCapability as i, object as j, boolean as k, buildAddonRouteProvider as l, parseAppFlowRequest as m, APP_REFUSED_PATH as n, advertisedHubOrigins as o, oidcConnectionsCapability as p, SSO_STATE_COOKIE as r, appFlowLocation as s, APP_FLOW_DEFAULT_REDIRECT as t, claimedRequestOrigins as u, resolveIconKey as v, globalSecretScope as w, BaseAddon as x, userPasskeysCapability as y };

package/dist/{dist-DtqB-MTf.js → dist-DDdB_Mme.js}

@@ -12361,6 +12361,13 @@ function parseAppAuthCallback(raw) {
 */
 /** What the app redeems the code for. `step-up` yields a proof, never a session. */
 var AppFlowPurposeSchema = _enum(["new-session", "step-up"]);
+/** The languages the hub's app landing pages are written in (D858). */
+var AppPageLangSchema = _enum(["en", "it"]);
+/** Narrows an untrusted `lang` value to the allow-list; anything else is `undefined`, never echoed. */
+function parseAppPageLang(value) {
+	const parsed = AppPageLangSchema.safeParse(value);
+	return parsed.success ? parsed.data : void 0;
+}
 /** Where the app is sent when the request names no `redirect`. */
 var APP_FLOW_DEFAULT_REDIRECT = "camstack://auth-callback";
 /** S256 challenge: base64url of 32 bytes = 43 characters, no padding. */
@@ -12377,7 +12384,8 @@ var STATE_PATTERN = /^[A-Za-z0-9._~-]{1,256}$/;
 var APP_REFUSED_PATH = "/auth/app/refused";
 /**
 * Read the app parameters off a start query: `code_challenge`,
-* `code_challenge_method`, `state`, `purpose`, `redirect`. Anything missing or
+* `code_challenge_method`, `state`, `purpose`, `redirect`, and the optional `lang` (an unknown value is
+* dropped, not refused). Anything missing or
 * malformed is refused - there is no lenient default for PKCE or state.
 */
 function parseAppFlowRequest(query) {
@@ -12406,13 +12414,15 @@ function parseAppFlowRequest(query) {
 		ok: false,
 		reason: "bad-redirect"
 	};
+	const lang = parseAppPageLang(query["lang"]);
 	return {
 		ok: true,
 		request: {
 			codeChallenge: challenge,
 			state,
 			purpose: purpose.data,
-			redirect
+			redirect,
+			...lang !== void 0 ? { lang } : {}
 		}
 	};
 }
@@ -49991,7 +50001,9 @@ var SsoBridgeClaimsSchema = object({
 		codeChallenge: string(),
 		state: string(),
 		purpose: _enum(["new-session", "step-up"]),
-		redirect: string()
+		redirect: string(),
+		/** The page language the app asked for (D858); the confirm page speaks it. */
+		lang: _enum(["en", "it"]).optional()
 	}).optional()
 });
 method(object({
@@ -59390,6 +59402,21 @@ DeviceType.Switch, DeviceType.Siren, DeviceType.Light, method(object({
 	on: boolean(),
 	lastChangedAt: number()
 });
+/** C0 controls, DEL and the C1 range: none of them belongs in a name. */
+function hasControlCharacter(value) {
+	for (const char of value) {
+		const code = char.codePointAt(0) ?? 0;
+		if (code <= 31 || code >= 127 && code <= 159) return true;
+	}
+	return false;
+}
+string().transform((value) => value.trim()).pipe(string().min(1, "The server name cannot be empty").max(48, `The server name is at most 48 characters`).refine((value) => !hasControlCharacter(value), { message: "The server name cannot contain control characters" }));
+/** What every reader gets: the name to show, and whether the hub chose it itself. */
+var ServerNameInfoSchema = object({
+	name: string(),
+	/** `true` when nobody named the hub: `name` is the machine hostname. */
+	isDefault: boolean()
+});
 /**
 * system — system-scoped singleton capability exposing hub-level
 * health, feature flags, network interface enumeration, and the
@@ -59419,6 +59446,12 @@ var FeatureManifestSchema = object({
 	backup: boolean(),
 	repl: boolean()
 });
+/**
+* `system.info`: the feature flags plus the hub's human name (D861). The name is
+* `{ name, isDefault }` — `isDefault: true` means nobody named the hub and `name`
+* is the machine hostname.
+*/
+var SystemInfoSchema = FeatureManifestSchema.extend({ serverName: ServerNameInfoSchema });
 var HealthStatusSchema = object({
 	status: literal("ok"),
 	uptime: number()
@@ -59891,7 +59924,7 @@ var LoggingSettingsStateSchema = object({
 	opsLogRetentionDays: number().int().min(0),
 	persisted: boolean()
 });
-method(_void(), FeatureManifestSchema), method(_void(), HealthStatusSchema), method(_void(), FeatureManifestSchema), method(_void(), array(NetworkAddressSchema).readonly()), method(_void(), unknown().nullable(), { auth: "admin" }), method(record(string(), unknown()), _null(), {
+method(_void(), SystemInfoSchema), method(_void(), HealthStatusSchema), method(_void(), FeatureManifestSchema), method(_void(), array(NetworkAddressSchema).readonly()), method(_void(), unknown().nullable(), { auth: "admin" }), method(record(string(), unknown()), _null(), {
 	kind: "mutation",
 	auth: "admin"
 }), method(_void(), _void(), {
@@ -73106,6 +73139,12 @@ Object.defineProperty(exports, "parseAppFlowRequest", {
 		return parseAppFlowRequest;
 	}
 });
+Object.defineProperty(exports, "parseAppPageLang", {
+	enumerable: true,
+	get: function() {
+		return parseAppPageLang;
+	}
+});
 Object.defineProperty(exports, "pickRequestOrigin", {
 	enumerable: true,
 	get: function() {

package/dist/oidc/auth-oidc.addon.js

@@ -2,7 +2,7 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_dist = require("../dist-DtqB-MTf.js");
+const require_dist = require("../dist-DDdB_Mme.js");
 let node_crypto = require("node:crypto");
 node_crypto = require_dist.__toESM(node_crypto);
 //#region ../../node_modules/jose/dist/webapi/lib/buffer_utils.js
@@ -1411,7 +1411,8 @@ var AuthOidcAddon = class extends require_dist.BaseAddon {
 				const reason = parsed.ok ? "combined-flow" : parsed.reason;
 				reply.code(303);
 				reply.header("Cache-Control", "no-store");
-				reply.header("Location", `${require_dist.APP_REFUSED_PATH}?reason=${reason}`);
+				const lang = require_dist.parseAppPageLang(query["lang"]);
+				reply.header("Location", `${require_dist.APP_REFUSED_PATH}?reason=${reason}${lang !== void 0 ? `&lang=${lang}` : ""}`);
 				reply.send("");
 				return;
 			}
@@ -1524,7 +1525,8 @@ var AuthOidcAddon = class extends require_dist.BaseAddon {
 					codeChallenge: result.app.codeChallenge,
 					state: result.app.state,
 					purpose: result.app.purpose,
-					redirect: result.app.redirect
+					redirect: result.app.redirect,
+					...result.app.lang !== void 0 ? { lang: result.app.lang } : {}
 				} } : {}
 			} });
 			const finish = new URLSearchParams({ bridge: bridgeToken });

package/dist/oidc/auth-oidc.addon.mjs

@@ -1,4 +1,4 @@
-import { C as globalSecretScope, E as toSecretFieldView, S as arrayItemFieldPath, T as isSecretMarker, _ as resolveIconKey, b as BaseAddon, c as authProviderCapability, d as loginMethodCapability, f as normalizeOrigin, g as requestMountPrefix, h as pickRequestOrigin, i as addonRoutesCapability, l as buildAddonRouteProvider, m as parseAppFlowRequest, n as APP_REFUSED_PATH, o as advertisedHubOrigins, p as oidcConnectionsCapability, r as SSO_STATE_COOKIE, s as appFlowLocation, t as APP_FLOW_DEFAULT_REDIRECT, u as claimedRequestOrigins, w as isSecretClear, x as SECRET_CLEAR, y as errMsg } from "../dist-BtJOajm3.mjs";
+import { C as arrayItemFieldPath, D as toSecretFieldView, E as isSecretMarker, S as SECRET_CLEAR, T as isSecretClear, _ as requestMountPrefix, b as errMsg, c as authProviderCapability, d as loginMethodCapability, f as normalizeOrigin, g as pickRequestOrigin, h as parseAppPageLang, i as addonRoutesCapability, l as buildAddonRouteProvider, m as parseAppFlowRequest, n as APP_REFUSED_PATH, o as advertisedHubOrigins, p as oidcConnectionsCapability, r as SSO_STATE_COOKIE, s as appFlowLocation, t as APP_FLOW_DEFAULT_REDIRECT, u as claimedRequestOrigins, v as resolveIconKey, w as globalSecretScope, x as BaseAddon } from "../dist-BGsjH-S3.mjs";
 import * as crypto$1 from "node:crypto";
 //#region ../../node_modules/jose/dist/webapi/lib/buffer_utils.js
 var encoder = new TextEncoder(), decoder = new TextDecoder(), strictDecoder = new TextDecoder("utf-8", { fatal: !0 });
@@ -1406,7 +1406,8 @@ var AuthOidcAddon = class extends BaseAddon {
 				const reason = parsed.ok ? "combined-flow" : parsed.reason;
 				reply.code(303);
 				reply.header("Cache-Control", "no-store");
-				reply.header("Location", `${APP_REFUSED_PATH}?reason=${reason}`);
+				const lang = parseAppPageLang(query["lang"]);
+				reply.header("Location", `${APP_REFUSED_PATH}?reason=${reason}${lang !== void 0 ? `&lang=${lang}` : ""}`);
 				reply.send("");
 				return;
 			}
@@ -1519,7 +1520,8 @@ var AuthOidcAddon = class extends BaseAddon {
 					codeChallenge: result.app.codeChallenge,
 					state: result.app.state,
 					purpose: result.app.purpose,
-					redirect: result.app.redirect
+					redirect: result.app.redirect,
+					...result.app.lang !== void 0 ? { lang: result.app.lang } : {}
 				} } : {}
 			} });
 			const finish = new URLSearchParams({ bridge: bridgeToken });

package/dist/webauthn/{_virtual_mf-localSharedImportMap___mfe_internal__addon_auth_webauthn_widgets-C3_j2tlC.mjs → _virtual_mf-localSharedImportMap___mfe_internal__addon_auth_webauthn_widgets-DiKn9eAB.mjs}

@@ -18,7 +18,7 @@ var e = {
 	},
 	"@camstack/types": {
 		name: "@camstack/types",
-		version: "1.2.372",
+		version: "1.2.373",
 		scope: ["default"],
 		loaded: !1,
 		from: "addon_auth_webauthn_widgets",
@@ -33,7 +33,7 @@ var e = {
 	},
 	"@camstack/ui-library": {
 		name: "@camstack/ui-library",
-		version: "1.2.290",
+		version: "1.2.291",
 		scope: ["default"],
 		loaded: !1,
 		from: "addon_auth_webauthn_widgets",

package/dist/webauthn/auth-webauthn.addon.js

@@ -2,7 +2,7 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_dist = require("../dist-DtqB-MTf.js");
+const require_dist = require("../dist-DDdB_Mme.js");
 let stream = require("stream");
 stream = require_dist.__toESM(stream, 1);
 let http = require("http");

package/dist/webauthn/auth-webauthn.addon.mjs

@@ -1,4 +1,4 @@
-import { A as object, D as array, O as boolean, a as addonWidgetsSourceCapability, b as BaseAddon, d as loginMethodCapability, j as string, k as number, v as userPasskeysCapability } from "../dist-BtJOajm3.mjs";
+import { A as number, M as string, O as array, a as addonWidgetsSourceCapability, d as loginMethodCapability, j as object, k as boolean, x as BaseAddon, y as userPasskeysCapability } from "../dist-BGsjH-S3.mjs";
 import { createRequire } from "node:module";
 import Stream from "stream";
 import http from "http";

package/dist/webauthn/{hostInit-H35G8h3o.mjs → hostInit-Cf9MrMyw.mjs}

@@ -36,7 +36,7 @@ async function r() {
 				}
 			},
 			"@camstack/types": {
-				version: "1.2.372",
+				version: "1.2.373",
 				scope: "default",
 				shareConfig: {
 					singleton: !0,
@@ -81,7 +81,7 @@ async function r() {
 				}
 			},
 			"@camstack/ui-library": {
-				version: "1.2.290",
+				version: "1.2.291",
 				scope: "default",
 				shareConfig: {
 					singleton: !0,

package/dist/webauthn/remoteEntry.js

@@ -30,7 +30,7 @@ async function d(e) {
 	}
 }
 async function f() {
-	return l ||= d(() => import("./_virtual_mf-localSharedImportMap___mfe_internal__addon_auth_webauthn_widgets-C3_j2tlC.mjs")).catch((e) => {
+	return l ||= d(() => import("./_virtual_mf-localSharedImportMap___mfe_internal__addon_auth_webauthn_widgets-DiKn9eAB.mjs")).catch((e) => {
 		throw l = void 0, e;
 	}), l;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/addon-auth",
-  "version": "1.2.146",
+  "version": "1.2.147",
   "description": "Authentication bundle — OIDC and WebAuthn/passkey. Multi-entry npm package shipping 2 addons under a single bundle; each addon keeps its own id, capabilities, and runner.",
   "keywords": [
     "camstack",