@camstack/addon-training 0.1.42 → 0.1.43

package/dist/{dist-wRpOWEq6.js → dist-ZBXOtBdC.js}

@@ -12203,6 +12203,167 @@ var ConvertResultSchema = object({
 		files: array(string()).readonly()
 	})).readonly()
 });
+/**
+* Device certificates (D855) — the wire contract shared by the hub, the admin
+* UI and the native viewer.
+*
+* A device (a phone) generates its OWN P-256 key pair in hardware (Secure
+* Enclave / Android Keystore / a non-extractable WebCrypto key). The private
+* key never travels. The hub signs the PUBLIC key into an X.509 leaf under a
+* dedicated device CA; the device later proves possession of the key by
+* signing a hub-issued nonce, and the hub answers with the same session a
+* password login opens.
+*
+* Everything on the wire is a small string (a PEM, a base64url signature):
+* D613 is about bulk bytes, and a certificate is ~600 bytes.
+*/
+/** Signature algorithm of every device credential: ECDSA, curve P-256, SHA-256. */
+var DEVICE_CERT_SIGNATURE = "ecdsa-p256-sha256";
+/** First line of every signed message; a change of format bumps the version. */
+var DEVICE_SIGNATURE_MESSAGE_VERSION = "camstack-device-cert-v1";
+_enum([
+	"login",
+	"renew",
+	"revoke"
+]);
+var DevicePlatformSchema = _enum([
+	"ios",
+	"android",
+	"web",
+	"other"
+]);
+var Base64UrlSchema = string().min(1).max(4096).regex(/^[A-Za-z0-9_-]+$/);
+var PemSchema = string().min(1).max(16384);
+/**
+* Why a device-certificate endpoint said no. Distinct from a transport / 5xx
+* failure: those carry no reason and mean "try again", never "the credential is
+* dead". The viewer switches on this exhaustively.
+*/
+var DeviceRefusalReasonSchema = _enum([
+	"revoked",
+	"unknown-credential",
+	"expired",
+	"bad-signature",
+	"nonce-invalid",
+	"rate-limited",
+	"invalid-certificate",
+	"superseded",
+	"user-gone",
+	"unavailable",
+	"code-invalid",
+	"self-enrollment-disabled",
+	"step-up-required",
+	"bad-public-key"
+]);
+var DeviceRefusalSchema = object({
+	ok: literal(false),
+	reason: DeviceRefusalReasonSchema,
+	definitive: boolean(),
+	retryAfterSeconds: number().optional()
+});
+object({
+	code: string().min(1).max(256),
+	/** SubjectPublicKeyInfo DER of the device's P-256 public key, base64url. */
+	publicKeySpki: Base64UrlSchema,
+	deviceName: string().min(1).max(80).optional(),
+	platform: DevicePlatformSchema
+});
+discriminatedUnion("ok", [object({
+	credentialId: string(),
+	certPem: PemSchema,
+	/** The device CA certificate the leaf chains to. */
+	chainPem: PemSchema,
+	notAfter: number(),
+	user: object({
+		id: string(),
+		username: string()
+	})
+}).extend({ ok: literal(true) }), DeviceRefusalSchema]);
+object({
+	/** The single-use step-up proof (`auth.deviceEnrollProofFrom…`). */
+	proof: string().min(1).max(512),
+	publicKeySpki: Base64UrlSchema,
+	deviceName: string().min(1).max(80),
+	platform: DevicePlatformSchema
+});
+object({
+	proof: string(),
+	expiresAt: number()
+});
+discriminatedUnion("ok", [object({
+	nonce: string(),
+	/** The origin to put in the signed message. The app compares it to the hub it dialled. */
+	origin: string(),
+	expiresAt: number(),
+	signature: literal(DEVICE_CERT_SIGNATURE)
+}).extend({ ok: literal(true) }), DeviceRefusalSchema]);
+object({
+	certPem: PemSchema,
+	nonce: string().min(1).max(256),
+	/** ECDSA P-256 SHA-256 over {@link buildDeviceSignatureMessage}; raw r||s or DER, base64url. */
+	signature: Base64UrlSchema
+});
+discriminatedUnion("ok", [object({
+	credentialId: string(),
+	certPem: PemSchema,
+	chainPem: PemSchema,
+	notAfter: number()
+}).extend({ ok: literal(true) }), DeviceRefusalSchema]);
+discriminatedUnion("ok", [object({
+	ok: literal(true),
+	credentialId: string(),
+	sessionsEnded: number().int()
+}), DeviceRefusalSchema]);
+var DeviceCredentialStatusSchema = _enum([
+	"active",
+	"expired",
+	"revoked"
+]);
+var DeviceCredentialSchema = object({
+	id: string(),
+	userId: string(),
+	username: string().nullable(),
+	deviceName: string(),
+	platform: DevicePlatformSchema,
+	enrolledVia: _enum(["qr", "self"]),
+	/** SHA-256 of the leaf certificate DER, colon-hex. */
+	fingerprint: string(),
+	issuedAt: number(),
+	expiresAt: number(),
+	lastUsedAt: number().nullable(),
+	lastUsedFrom: string().nullable(),
+	revokedAt: number().nullable(),
+	/** `admin:<userId>` | `user:<userId>` | `device` | `user-deleted`. */
+	revokedBy: string().nullable(),
+	status: DeviceCredentialStatusSchema
+});
+var StartEnrollmentOutputSchema = object({
+	/** Shown once; only its hash is kept. */
+	code: string(),
+	expiresAt: number(),
+	/** `camstack://enroll?hub=…&code=…` — what the QR encodes. */
+	enrollUrl: string(),
+	/** The hub origin in the link, or `null` when the hub could not name one (the link then has no `hub`). */
+	hubOrigin: string().nullable(),
+	/** Every origin the apps may try (role `appConnections`). */
+	hubOrigins: array(string())
+});
+object({
+	kind: literal("device-certificate"),
+	id: literal("device-certificate"),
+	label: string(),
+	stage: literal("primary"),
+	/** tRPC paths under the hub's `auth` router, so a client names no literal. */
+	challengePath: literal("auth.getDeviceChallenge"),
+	revokePath: literal("auth.revokeOwnDeviceCertificate"),
+	enrollSelfPath: literal("auth.enrollSelf"),
+	loginPath: literal("auth.loginWithDeviceCertificate"),
+	renewPath: literal("auth.renewDeviceCertificate"),
+	signature: literal(DEVICE_CERT_SIGNATURE),
+	messageVersion: literal(DEVICE_SIGNATURE_MESSAGE_VERSION),
+	/** Which clients can execute it: a native app silently, a browser with a non-extractable WebCrypto key. */
+	clients: array(_enum(["native", "web"]))
+});
 var ExpressionBindingSourceSchema = union([
 	object({
 		kind: literal("field").optional(),
@@ -15775,6 +15936,136 @@ method(object({
 	kind: "mutation",
 	auth: "admin"
 }), method(object({}), array(KeychainSecretMetaSchema).readonly(), { auth: "admin" }), method(object({}), KeychainStateSchema, { auth: "admin" });
+var DeviceCaStatusSchema = discriminatedUnion("state", [
+	object({ state: literal("absent") }),
+	object({
+		state: literal("ready"),
+		subject: string(),
+		fingerprintSha256: string(),
+		validTo: string()
+	}),
+	object({
+		state: literal("unavailable"),
+		reason: string()
+	})
+]);
+var DeviceCertificateSettingsSchema = object({ selfEnrollment: _enum(["allowed", "disabled"]) });
+method(object({
+	userId: string().min(1).optional(),
+	includeRevoked: boolean().default(false)
+}), array(DeviceCredentialSchema).readonly(), { auth: "admin" }), method(object({
+	userId: string().min(1),
+	deviceName: string().min(1).max(80)
+}), StartEnrollmentOutputSchema, {
+	kind: "mutation",
+	auth: "admin",
+	caller: "required"
+}), method(object({ id: string().min(1) }), object({
+	revoked: boolean(),
+	sessionsEnded: number().int(),
+	status: DeviceCredentialStatusSchema
+}), {
+	kind: "mutation",
+	auth: "admin",
+	caller: "required"
+}), method(object({}), DeviceCertificateSettingsSchema, { auth: "admin" }), method(DeviceCertificateSettingsSchema, DeviceCertificateSettingsSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ id: string().min(1) }), object({ result: _enum([
+	"deleted",
+	"live",
+	"unknown"
+]) }), {
+	kind: "mutation",
+	auth: "admin",
+	caller: "required"
+}), method(object({}), DeviceCaStatusSchema, { auth: "admin" }), method(object({
+	id: string().min(1),
+	deviceName: string().min(1).max(80)
+}), object({ renamed: boolean() }), {
+	kind: "mutation",
+	auth: "admin"
+});
+/**
+* `node-certificates` - what a node holds and the two renewals the hub drives
+* (D856): the node's MESH leaf (mutual TLS to the hub) and its HTTPS leaf (issued
+* from the hub's local CA so a device that trusts the hub root trusts the node).
+*
+* Provided by the AGENT RUNTIME (the synthetic `agent-runtime` addon id, like
+* `server-management`): the hub reaches it through the ordinary node-pinned
+* capability call - no new Moleculer action. The hub's own certificates are
+* handled in-process by the hub (`certificates` router), so this cap has no hub
+* provider.
+*
+* No private key ever crosses the mesh: the node generates its key pair, sends a
+* CSR, and the hub returns only the signed certificate.
+*/
+var MeshLeafInfoSchema = object({
+	cn: string(),
+	serial: string(),
+	fingerprintSha256: string(),
+	notBefore: number(),
+	notAfter: number()
+});
+var HttpsLeafInfoSchema = object({
+	fingerprintSha256: string(),
+	issuer: string(),
+	sans: array(string()),
+	notBefore: number(),
+	notAfter: number()
+});
+var NodeHttpsStateSchema = discriminatedUnion("state", [object({
+	state: literal("served"),
+	leaf: HttpsLeafInfoSchema
+}), object({
+	state: literal("not-issued"),
+	reason: string()
+})]);
+method(object({}), object({
+	nodeId: string(),
+	mesh: MeshLeafInfoSchema.nullable(),
+	https: NodeHttpsStateSchema
+}), { auth: "admin" }), method(object({}), object({ csrPem: string() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	certPem: string().min(1),
+	caCertPem: string().min(1),
+	confirmWithinMs: number().int().min(1e4).max(6e5)
+}), object({
+	fingerprintSha256: string(),
+	serial: string()
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ fingerprintSha256: string() }), object({ confirmed: boolean() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({}), object({ rolledBack: boolean() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({}), object({
+	csrPem: string(),
+	hostnames: array(string()),
+	addresses: array(string()),
+	/** SHA-256 of the hub local CA this node pinned at its first install; `null` before one. */
+	pinnedCaFingerprintSha256: string().nullable()
+}), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	certPem: string().min(1),
+	caCertPem: string().min(1),
+	/**
+	* The hub signals that its local CA was rotated (D227) and this leaf chains to the NEW
+	* one. Only the hub, over the authenticated mesh, can say so; a leaf with a different CA
+	* and no signal is refused.
+	*/
+	caRotation: boolean().optional()
+}), HttpsLeafInfoSchema, {
+	kind: "mutation",
+	auth: "admin"
+});
 var KeychainKeySourceSchema = object({
 	kind: _enum([
 		"config-file",
@@ -61778,6 +62069,54 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"deviceCredentials.deleteDeviceCredential": {
+		capName: "device-credentials",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"deviceCredentials.getDeviceCaStatus": {
+		capName: "device-credentials",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"deviceCredentials.getDeviceCertificateSettings": {
+		capName: "device-credentials",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"deviceCredentials.listDeviceCredentials": {
+		capName: "device-credentials",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"deviceCredentials.renameDeviceCredential": {
+		capName: "device-credentials",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"deviceCredentials.revokeDeviceCredential": {
+		capName: "device-credentials",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"deviceCredentials.setDeviceCertificateSettings": {
+		capName: "device-credentials",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"deviceCredentials.startEnrollment": {
+		capName: "device-credentials",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"deviceDiscovery.adoptDevice": {
 		capName: "device-discovery",
 		capScope: "device",
@@ -63938,6 +64277,48 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"nodeCertificates.confirmMeshLeaf": {
+		capName: "node-certificates",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"nodeCertificates.getCertificates": {
+		capName: "node-certificates",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"nodeCertificates.installHttpsCertificate": {
+		capName: "node-certificates",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"nodeCertificates.installMeshLeaf": {
+		capName: "node-certificates",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"nodeCertificates.prepareHttpsCertificate": {
+		capName: "node-certificates",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"nodeCertificates.prepareMeshRenewal": {
+		capName: "node-certificates",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"nodeCertificates.rollbackMeshLeaf": {
+		capName: "node-certificates",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"nodes.clusterAddonStatus": {
 		capName: "nodes",
 		capScope: "system",

package/dist/{hostInit-1OJB0wPE.mjs → hostInit-Ci39xaf6.mjs}

@@ -36,7 +36,7 @@ async function r() {
 				}
 			},
 			"@camstack/types": {
-				version: "1.2.364",
+				version: "1.2.365",
 				scope: "default",
 				shareConfig: {
 					singleton: !0,
@@ -81,7 +81,7 @@ async function r() {
 				}
 			},
 			"@camstack/ui-library": {
-				version: "1.2.287",
+				version: "1.2.288",
 				scope: "default",
 				shareConfig: {
 					singleton: !0,

package/dist/index.js

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-require("./dist-wRpOWEq6.js");
+require("./dist-ZBXOtBdC.js");
 const require_orchestrator_training_addon = require("./orchestrator/training.addon.js");
 const require_providers_modal_training_modal_addon = require("./providers/modal/training-modal.addon.js");
 //#region src/providers/fake/fake-provider.ts

package/dist/orchestrator/training.addon.js

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_dist = require("../dist-wRpOWEq6.js");
+const require_dist = require("../dist-ZBXOtBdC.js");
 let node_path = require("node:path");
 node_path = require_dist.__toESM(node_path);
 let node_crypto = require("node:crypto");

package/dist/orchestrator/training.addon.mjs

@@ -1,4 +1,4 @@
-import { a as addonPagesSourceCapability, i as TrainingResultSchema, l as BaseAddon, n as TrainingJobSchema, o as parseTrainingEventLine, r as TrainingJobSpecSchema, s as trainingCapability, t as TRAINING_JOB_SCHEMA } from "../dist-BtEl1kYQ.mjs";
+import { a as addonPagesSourceCapability, i as TrainingResultSchema, l as BaseAddon, n as TrainingJobSchema, o as parseTrainingEventLine, r as TrainingJobSpecSchema, s as trainingCapability, t as TRAINING_JOB_SCHEMA } from "../dist-C7yODd9D.mjs";
 import path from "node:path";
 import { createHash } from "node:crypto";
 import { createReadStream } from "node:fs";

package/dist/{player-overlays-CqD89xkd.mjs → player-overlays-CLkmW1-R.mjs}

@@ -1,6 +1,6 @@
 import { S as e, _ as t, l as n, u as r } from "./_virtual_mf___mfe_internal__addon_training_page__loadShare__react__loadShare__.js-DeDbF7NI.mjs";
 import { n as i, t as a } from "./chevron-right-D3StkdcR.mjs";
-import { y as o } from "./responsive-Dwyuxd3q.mjs";
+import { y as o } from "./responsive-DaJFlnYN.mjs";
 import { n as s, r as c, t as l } from "./_virtual_mf___mfe_internal__addon_training_page__loadShare__react_mf_1_jsx_mf_2_runtime__loadShare__.js-DnrbBvrw.mjs";
 //#region ../ui-library/src/composites/widget-panel.tsx
 e();

package/dist/providers/modal/training-modal.addon.js

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_dist = require("../../dist-wRpOWEq6.js");
+const require_dist = require("../../dist-ZBXOtBdC.js");
 let node_path = require("node:path");
 node_path = require_dist.__toESM(node_path, 1);
 let node_crypto = require("node:crypto");

package/dist/providers/modal/training-modal.addon.mjs

@@ -1,4 +1,4 @@
-import { _ as number, b as string, c as trainingProviderCapability, d as arrayItemFieldPath, f as globalSecretScope, g as boolean, h as toSecretFieldView, l as BaseAddon, m as isSecretMarker, p as isSecretClear, u as SECRET_CLEAR, v as object, y as record } from "../../dist-BtEl1kYQ.mjs";
+import { _ as number, b as string, c as trainingProviderCapability, d as arrayItemFieldPath, f as globalSecretScope, g as boolean, h as toSecretFieldView, l as BaseAddon, m as isSecretMarker, p as isSecretClear, u as SECRET_CLEAR, v as object, y as record } from "../../dist-C7yODd9D.mjs";
 import { createRequire } from "node:module";
 import path, { dirname, posix } from "node:path";
 import { createHash, createPrivateKey, createPublicKey, createSign, randomBytes, randomUUID } from "node:crypto";

package/dist/remoteEntry.js

@@ -1,2 +1,2 @@
-import { n as e, t } from "./virtual_mf-REMOTE_ENTRY_ID___mfe_internal__addon_training_page__remoteEntry_js-D0zbWJUR.mjs";
+import { n as e, t } from "./virtual_mf-REMOTE_ENTRY_ID___mfe_internal__addon_training_page__remoteEntry_js-Cp9TxI8g.mjs";
 export { t as get, e as init };

package/dist/{responsive-Dwyuxd3q.mjs → responsive-DaJFlnYN.mjs}

@@ -1,5 +1,5 @@
 import { S as e, _ as t, c as n, l as r, m as i, t as a, u as o, v as s } from "./_virtual_mf___mfe_internal__addon_training_page__loadShare__react__loadShare__.js-DeDbF7NI.mjs";
-import { v as c } from "./_virtual_mf___mfe_internal__addon_training_page__loadShare___mf_0_camstack_mf_1_types__loadShare__.js-LhaXEy4l.mjs";
+import { v as c } from "./_virtual_mf___mfe_internal__addon_training_page__loadShare___mf_0_camstack_mf_1_types__loadShare__.js-BH6lTdjB.mjs";
 import "./_virtual_mf___mfe_internal__addon_training_page__loadShare__react_mf_1_jsx_mf_2_runtime__loadShare__.js-DnrbBvrw.mjs";
 //#region ../ui-library/src/lib/shared-context.ts
 e();

package/dist/{virtual_mf-REMOTE_ENTRY_ID___mfe_internal__addon_training_page__remoteEntry_js-D0zbWJUR.mjs → virtual_mf-REMOTE_ENTRY_ID___mfe_internal__addon_training_page__remoteEntry_js-Cp9TxI8g.mjs}

@@ -2762,7 +2762,7 @@ async function or(e) {
 	}
 }
 async function sr() {
-	return ir ||= or(() => import("./_virtual_mf-localSharedImportMap___mfe_internal__addon_training_page-DzsEYUgl.mjs")).catch((e) => {
+	return ir ||= or(() => import("./_virtual_mf-localSharedImportMap___mfe_internal__addon_training_page-B5F2D49H.mjs")).catch((e) => {
 		throw ir = void 0, e;
 	}), ir;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/addon-training",
-  "version": "0.1.42",
+  "version": "0.1.43",
   "description": "Cloud training for CamStack: fine-tune the root detector on your own frames, on your own GPU-cloud account",
   "keywords": [
     "camstack",