@camstack/addon-auth 1.2.35 → 1.2.36

package/dist/{dist-XHHoN0qI.mjs → dist-By0Ejwk9.mjs}

@@ -26320,17 +26320,60 @@ var SetSiteLocationInputSchema = object({
 	longitude: number().min(-180).max(180)
 }).nullable();
 /**
-* One `(procedure, user-agent, ip, principal)` tuple of the HTTP request
+* The TRANSPORT a call arrived on.
+*
+* Every counted call carries exactly one of these, and `unknown` is a PLANE
+* rather than a gap: a plane that cannot attribute a call declares it here, so
+* the call lands in a named bucket instead of vanishing. `planes` summing to
+* `procedureCalls` is what makes "the sum of the planes explains the total"
+* checkable rather than asserted.
+*
+*  - `http`  — the Fastify tRPC plugin (`/trpc/*`), one context per request.
+*  - `ws`    — `applyWSSHandler`, counted per OPERATION rather than per
+*              connection; the viewer talks to the hub over `wsLink`
+*              exclusively, so this is the plane the HTTP census could not see.
+*  - `mesh`  — the in-process `$core-caps` bridge (`createCaller`), which
+*              never touches a socket and therefore never touched a census.
+*  - `unknown` — counted, plane undecidable. No hook produces it today, and
+*    that is exactly what its `0` asserts: every plane the hub has can name
+*    itself. It is an output bucket, never a knob — a call that arrives on a
+*    plane nobody instrumented lands here instead of vanishing from the total.
+*/
+var TransportPlaneSchema = _enum([
+	"http",
+	"ws",
+	"mesh",
+	"unknown"
+]);
+/**
+* Calls per plane. Every key is always present, `0` included — an absent plane
+* reads as "not instrumented", which is the one thing this census must never
+* make an operator wonder about.
+*/
+var TransportPlaneCountsSchema = object({
+	http: number(),
+	ws: number(),
+	mesh: number(),
+	unknown: number()
+});
+/**
+* One `(plane, procedure, user-agent, ip, principal)` tuple of the transport
 * census. `principal` is the DERIVED identity (`apocaliss92 (admin)`,
 * `scoped:1a2b3c4d (scoped-token)`, `anonymous`) that the tRPC error log
 * already prints - never a token, never an `Authorization` header.
+*
+* `subscriptions` is counted APART from `calls`: a subscription is opened once
+* and lives for hours, so folding it into a call count makes one long-lived
+* stream look like a storm.
 */
 var RequestCensusGroupSchema = object({
+	plane: TransportPlaneSchema,
 	procedure: string(),
 	userAgent: string(),
 	ip: string(),
 	principal: string(),
 	calls: number(),
+	subscriptions: number(),
 	perMin: number()
 });
 /**
@@ -26343,6 +26386,14 @@ var RequestCensusGroupSchema = object({
 var RequestCensusProcedureSchema = object({
 	procedure: string(),
 	calls: number(),
+	/**
+	* The same total, split by transport. THIS is the row that answers the
+	* question the census exists for: one look at `deviceManager.listAll` says
+	* which plane carried the 4 960, without joining two log lines by eye.
+	*/
+	planes: TransportPlaneCountsSchema,
+	/** Subscription STARTS on this procedure. Never folded into `calls`. */
+	subscriptions: number(),
 	perMin: number()
 });
 /**
@@ -26370,14 +26421,45 @@ var RequestCensusStatusSchema = object({
 	*/
 	procedureCalls: number(),
 	/**
+	* `procedureCalls` split by transport. The four keys sum to
+	* `procedureCalls` by construction - {@link RequestCensusSnapshotSchema}'s
+	* `planesExplainTotal` is that identity, checked rather than assumed.
+	*/
+	planes: TransportPlaneCountsSchema,
+	/**
+	* True iff `planes` sums to `procedureCalls`. False means a call was counted
+	* on no plane at all - which is a RESULT (a plane is missing from the
+	* instrument), not a failure, and it has to be visible to be read as one.
+	*/
+	planesExplainTotal: boolean(),
+	/**
 	* tRPC WebSocket connections opened during the window. NOT calls - the WS
-	* transport resolves one context per connection - but the number that says
-	* whether a plane this census cannot see was busy while HTTP was quiet.
+	* adapter resolves one context per connection - kept because a plane's call
+	* count of zero against 37 open connections says something different from a
+	* plane with no connections at all.
 	*/
 	wsConnections: number(),
+	/**
+	* Client frames the WS plane looked at. `wsMessages` far above
+	* `planes.ws + subscriptions` means most traffic is not operations
+	* (keepalives, connection params) - which is itself an answer.
+	*/
+	wsMessages: number(),
+	/**
+	* Subscription STARTS across every plane, excluded from `procedureCalls` on
+	* purpose: one live-events stream opened at boot and held for six hours is
+	* one subscription, and counting it as a call would let a quiet plane
+	* masquerade as the storm.
+	*/
+	subscriptions: number(),
+	/** `subscription.stop` frames. Starts minus stops is what is still open. */
+	subscriptionStops: number(),
 	distinctGroups: number(),
-	/** Calls counted in the totals whose group attribution was shed at the
-	*  cardinality bound. */
+	/**
+	* Operations counted in the totals whose CALLER attribution was shed at the
+	* cardinality bound. Unrelated to the `unknown` PLANE: these calls know
+	* which transport they arrived on, they just lost their group row.
+	*/
 	unattributedCalls: number(),
 	procedures: array(RequestCensusProcedureSchema).readonly(),
 	groups: array(RequestCensusGroupSchema).readonly()

package/dist/{dist-giwjMDHI.js → dist-Xgup874I.js}

@@ -26320,17 +26320,60 @@ var SetSiteLocationInputSchema = object({
 	longitude: number().min(-180).max(180)
 }).nullable();
 /**
-* One `(procedure, user-agent, ip, principal)` tuple of the HTTP request
+* The TRANSPORT a call arrived on.
+*
+* Every counted call carries exactly one of these, and `unknown` is a PLANE
+* rather than a gap: a plane that cannot attribute a call declares it here, so
+* the call lands in a named bucket instead of vanishing. `planes` summing to
+* `procedureCalls` is what makes "the sum of the planes explains the total"
+* checkable rather than asserted.
+*
+*  - `http`  — the Fastify tRPC plugin (`/trpc/*`), one context per request.
+*  - `ws`    — `applyWSSHandler`, counted per OPERATION rather than per
+*              connection; the viewer talks to the hub over `wsLink`
+*              exclusively, so this is the plane the HTTP census could not see.
+*  - `mesh`  — the in-process `$core-caps` bridge (`createCaller`), which
+*              never touches a socket and therefore never touched a census.
+*  - `unknown` — counted, plane undecidable. No hook produces it today, and
+*    that is exactly what its `0` asserts: every plane the hub has can name
+*    itself. It is an output bucket, never a knob — a call that arrives on a
+*    plane nobody instrumented lands here instead of vanishing from the total.
+*/
+var TransportPlaneSchema = _enum([
+	"http",
+	"ws",
+	"mesh",
+	"unknown"
+]);
+/**
+* Calls per plane. Every key is always present, `0` included — an absent plane
+* reads as "not instrumented", which is the one thing this census must never
+* make an operator wonder about.
+*/
+var TransportPlaneCountsSchema = object({
+	http: number(),
+	ws: number(),
+	mesh: number(),
+	unknown: number()
+});
+/**
+* One `(plane, procedure, user-agent, ip, principal)` tuple of the transport
 * census. `principal` is the DERIVED identity (`apocaliss92 (admin)`,
 * `scoped:1a2b3c4d (scoped-token)`, `anonymous`) that the tRPC error log
 * already prints - never a token, never an `Authorization` header.
+*
+* `subscriptions` is counted APART from `calls`: a subscription is opened once
+* and lives for hours, so folding it into a call count makes one long-lived
+* stream look like a storm.
 */
 var RequestCensusGroupSchema = object({
+	plane: TransportPlaneSchema,
 	procedure: string(),
 	userAgent: string(),
 	ip: string(),
 	principal: string(),
 	calls: number(),
+	subscriptions: number(),
 	perMin: number()
 });
 /**
@@ -26343,6 +26386,14 @@ var RequestCensusGroupSchema = object({
 var RequestCensusProcedureSchema = object({
 	procedure: string(),
 	calls: number(),
+	/**
+	* The same total, split by transport. THIS is the row that answers the
+	* question the census exists for: one look at `deviceManager.listAll` says
+	* which plane carried the 4 960, without joining two log lines by eye.
+	*/
+	planes: TransportPlaneCountsSchema,
+	/** Subscription STARTS on this procedure. Never folded into `calls`. */
+	subscriptions: number(),
 	perMin: number()
 });
 /**
@@ -26370,14 +26421,45 @@ var RequestCensusStatusSchema = object({
 	*/
 	procedureCalls: number(),
 	/**
+	* `procedureCalls` split by transport. The four keys sum to
+	* `procedureCalls` by construction - {@link RequestCensusSnapshotSchema}'s
+	* `planesExplainTotal` is that identity, checked rather than assumed.
+	*/
+	planes: TransportPlaneCountsSchema,
+	/**
+	* True iff `planes` sums to `procedureCalls`. False means a call was counted
+	* on no plane at all - which is a RESULT (a plane is missing from the
+	* instrument), not a failure, and it has to be visible to be read as one.
+	*/
+	planesExplainTotal: boolean(),
+	/**
 	* tRPC WebSocket connections opened during the window. NOT calls - the WS
-	* transport resolves one context per connection - but the number that says
-	* whether a plane this census cannot see was busy while HTTP was quiet.
+	* adapter resolves one context per connection - kept because a plane's call
+	* count of zero against 37 open connections says something different from a
+	* plane with no connections at all.
 	*/
 	wsConnections: number(),
+	/**
+	* Client frames the WS plane looked at. `wsMessages` far above
+	* `planes.ws + subscriptions` means most traffic is not operations
+	* (keepalives, connection params) - which is itself an answer.
+	*/
+	wsMessages: number(),
+	/**
+	* Subscription STARTS across every plane, excluded from `procedureCalls` on
+	* purpose: one live-events stream opened at boot and held for six hours is
+	* one subscription, and counting it as a call would let a quiet plane
+	* masquerade as the storm.
+	*/
+	subscriptions: number(),
+	/** `subscription.stop` frames. Starts minus stops is what is still open. */
+	subscriptionStops: number(),
 	distinctGroups: number(),
-	/** Calls counted in the totals whose group attribution was shed at the
-	*  cardinality bound. */
+	/**
+	* Operations counted in the totals whose CALLER attribution was shed at the
+	* cardinality bound. Unrelated to the `unknown` PLANE: these calls know
+	* which transport they arrived on, they just lost their group row.
+	*/
 	unattributedCalls: number(),
 	procedures: array(RequestCensusProcedureSchema).readonly(),
 	groups: array(RequestCensusGroupSchema).readonly()

package/dist/magic-link/auth-magic-link.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../chunk-Cek0wNdY.js");
-const require_dist = require("../dist-giwjMDHI.js");
+const require_dist = require("../dist-Xgup874I.js");
 //#region src/magic-link/auth-magic-link.addon.ts
 /**
 * Magic-link authentication addon.

package/dist/magic-link/auth-magic-link.addon.mjs

@@ -1,4 +1,4 @@
-import { a as loginMethodCapability, c as BaseAddon, i as buildAddonRouteProvider, r as authProviderCapability, s as errMsg, t as addonRoutesCapability } from "../dist-XHHoN0qI.mjs";
+import { a as loginMethodCapability, c as BaseAddon, i as buildAddonRouteProvider, r as authProviderCapability, s as errMsg, t as addonRoutesCapability } from "../dist-By0Ejwk9.mjs";
 //#region src/magic-link/auth-magic-link.addon.ts
 /**
 * Magic-link authentication addon.

package/dist/oidc/auth-oidc.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../chunk-Cek0wNdY.js");
-const require_dist = require("../dist-giwjMDHI.js");
+const require_dist = require("../dist-Xgup874I.js");
 let node_crypto = require("node:crypto");
 node_crypto = require_chunk.__toESM(node_crypto);
 //#region node_modules/jose/dist/webapi/lib/buffer_utils.js

package/dist/oidc/auth-oidc.addon.mjs

@@ -1,4 +1,4 @@
-import { a as loginMethodCapability, c as BaseAddon, i as buildAddonRouteProvider, r as authProviderCapability, s as errMsg, t as addonRoutesCapability } from "../dist-XHHoN0qI.mjs";
+import { a as loginMethodCapability, c as BaseAddon, i as buildAddonRouteProvider, r as authProviderCapability, s as errMsg, t as addonRoutesCapability } from "../dist-By0Ejwk9.mjs";
 import * as crypto$1 from "node:crypto";
 //#region node_modules/jose/dist/webapi/lib/buffer_utils.js
 var encoder = new TextEncoder();

package/dist/webauthn/{_virtual_mf-localSharedImportMap___mfe_internal__addon_auth_webauthn_widgets-Z3KQYLnY.mjs → _virtual_mf-localSharedImportMap___mfe_internal__addon_auth_webauthn_widgets-DQaOFxU5.mjs}

@@ -3,7 +3,7 @@ import "./dist-CYZr2fwk.mjs";
 var e = {
 	"@camstack/sdk": {
 		name: "@camstack/sdk",
-		version: "1.2.35",
+		version: "1.2.36",
 		scope: ["default"],
 		loaded: !1,
 		from: "addon_auth_webauthn_widgets",
@@ -18,7 +18,7 @@ var e = {
 	},
 	"@camstack/types": {
 		name: "@camstack/types",
-		version: "1.2.113",
+		version: "1.2.114",
 		scope: ["default"],
 		loaded: !1,
 		from: "addon_auth_webauthn_widgets",
@@ -33,7 +33,7 @@ var e = {
 	},
 	"@camstack/ui-library": {
 		name: "@camstack/ui-library",
-		version: "1.2.76",
+		version: "1.2.77",
 		scope: ["default"],
 		loaded: !1,
 		from: "addon_auth_webauthn_widgets",

package/dist/webauthn/auth-webauthn.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../chunk-Cek0wNdY.js");
-const require_dist = require("../dist-giwjMDHI.js");
+const require_dist = require("../dist-Xgup874I.js");
 let stream = require("stream");
 stream = require_chunk.__toESM(stream, 1);
 let http = require("http");

package/dist/webauthn/auth-webauthn.addon.mjs

@@ -1,4 +1,4 @@
-import { a as loginMethodCapability, c as BaseAddon, d as number, f as object, l as array, n as addonWidgetsSourceCapability, o as userPasskeysCapability, p as string, u as boolean } from "../dist-XHHoN0qI.mjs";
+import { a as loginMethodCapability, c as BaseAddon, d as number, f as object, l as array, n as addonWidgetsSourceCapability, o as userPasskeysCapability, p as string, u as boolean } from "../dist-By0Ejwk9.mjs";
 import { createRequire } from "node:module";
 import Stream from "stream";
 import http from "http";

package/dist/webauthn/{hostInit-RsaGzQLK.mjs → hostInit-lajduURf.mjs}

@@ -36,7 +36,7 @@ async function r() {
 				}
 			},
 			"@camstack/types": {
-				version: "1.2.113",
+				version: "1.2.114",
 				scope: "default",
 				shareConfig: {
 					singleton: !0,
@@ -45,7 +45,7 @@ async function r() {
 				}
 			},
 			"@camstack/sdk": {
-				version: "1.2.35",
+				version: "1.2.36",
 				scope: "default",
 				shareConfig: {
 					singleton: !0,
@@ -81,7 +81,7 @@ async function r() {
 				}
 			},
 			"@camstack/ui-library": {
-				version: "1.2.76",
+				version: "1.2.77",
 				scope: "default",
 				shareConfig: {
 					singleton: !0,

package/dist/webauthn/remoteEntry.js

@@ -30,7 +30,7 @@ async function d(e) {
 	}
 }
 async function f() {
-	return l ||= d(() => import("./_virtual_mf-localSharedImportMap___mfe_internal__addon_auth_webauthn_widgets-Z3KQYLnY.mjs")).catch((e) => {
+	return l ||= d(() => import("./_virtual_mf-localSharedImportMap___mfe_internal__addon_auth_webauthn_widgets-DQaOFxU5.mjs")).catch((e) => {
 		throw l = void 0, e;
 	}), l;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/addon-auth",
-  "version": "1.2.35",
+  "version": "1.2.36",
   "description": "Authentication bundle — magic-link, OIDC, and WebAuthn/passkey. Multi-entry npm package shipping 3 addons under a single bundle; each addon keeps its own id, capabilities, and runner.",
   "keywords": [
     "camstack",