@camstack/server 1.2.574 → 1.2.576

package/dist/api/core/auth.router.js

@@ -21,6 +21,7 @@ const types_1 = require("@camstack/types");
 const server_1 = require("@trpc/server");
 const zod_1 = require("zod");
 const auth_network_policy_js_1 = require("../../auth/auth-network-policy.js");
+const app_passkey_routes_js_1 = require("../../auth/app-passkey-routes.js");
 const auth_rate_limit_js_1 = require("../../auth/auth-rate-limit.js");
 const auth_provider_gate_js_1 = require("../../auth/auth-provider-gate.js");
 const device_enroll_proofs_js_1 = require("../../auth/device-enroll-proofs.js");
@@ -142,10 +143,16 @@ const PublicWidgetLoginMethodSchema = types_1.WidgetLoginMethodSchema.extend({
 /** Stable per hub PROCESS — busts the login widget bundle URL on each
  *  restart/deploy while caching cleanly within the process's uptime. */
 const AUTH_BUNDLE_VERSION = String(Date.now());
+// Every arm of the PUBLIC list says how a native app starts it (D858): the hub
+// always sends `app` (`null` when there is no app path - the viewer hides the
+// method). It stays optional in the TYPE so the admin-ui's hand-mirrored arms,
+// which never read it, keep matching this union.
+const PublicRedirectLoginMethodSchema = types_1.RedirectLoginMethodSchema;
+const PublicPasskeyLoginMethodSchema = types_1.PasskeyLoginMethodSchema;
 const PublicLoginMethodSchema = zod_1.z.discriminatedUnion('kind', [
-    types_1.RedirectLoginMethodSchema,
+    PublicRedirectLoginMethodSchema,
     PublicWidgetLoginMethodSchema,
-    types_1.PasskeyLoginMethodSchema,
+    PublicPasskeyLoginMethodSchema,
     types_1.DeviceCertificateLoginMethodSchema,
 ]);
 /** One of the caller's linked sign-in identities, as the profile shows it (D782). */
@@ -477,7 +484,10 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
                 if (seenIds.has(raw.id))
                     continue;
                 if (raw.kind === 'redirect') {
-                    const parsed = types_1.RedirectLoginMethodSchema.safeParse(raw);
+                    const parsed = PublicRedirectLoginMethodSchema.safeParse({
+                        ...raw,
+                        app: raw.app ?? null,
+                    });
                     if (parsed.success) {
                         out.push(parsed.data);
                         seenIds.add(parsed.data.id);
@@ -487,7 +497,12 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
                 if (raw.kind === 'passkey') {
                     // Native ceremony — passes through untouched, no server-side
                     // enrichment (rpId/origin are already stamped by the addon).
-                    const parsed = types_1.PasskeyLoginMethodSchema.safeParse(raw);
+                    // The passkey page is the hub's own (D858): the primary arm runs in the
+                    // system browser at it; a second-factor ceremony has no app path.
+                    const parsed = PublicPasskeyLoginMethodSchema.safeParse({
+                        ...raw,
+                        app: raw.stage === 'primary' ? { kind: 'browser', startPath: app_passkey_routes_js_1.APP_PASSKEY_PATH } : null,
+                    });
                     if (parsed.success) {
                         out.push(parsed.data);
                         seenIds.add(parsed.data.id);
@@ -505,6 +520,7 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
                 // uptime). The `/api/addon-widgets` route strips the `v<…>/` segment.
                 const parsed = PublicWidgetLoginMethodSchema.safeParse({
                     ...raw,
+                    app: null,
                     bundleUrl: `/api/addon-widgets/${raw.addonId}/v${AUTH_BUNDLE_VERSION}/${raw.bundle}`,
                 });
                 if (parsed.success) {
@@ -530,6 +546,7 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
                 signature: types_1.DEVICE_CERT_SIGNATURE,
                 messageVersion: types_1.DEVICE_SIGNATURE_MESSAGE_VERSION,
                 clients: ['native'],
+                app: { kind: 'native' },
             });
         return out;
     };

package/dist/api/core/cap-providers.js

@@ -1532,7 +1532,7 @@ function buildAddonsProvider(ar, ps, ls, moleculer, configService, ctx, agentReg
         listInstallations: async (input) => (0, addon_uninstall_js_1.listInstallations)(uninstallSeam, input.packageName),
         reloadPackages: async () => ps.reloadPackages(),
         searchAvailable: async (input) => {
-            const results = await ps.searchNpm(input?.query);
+            const results = await ps.searchNpm(input?.query, input?.capability);
             const installedIds = new Set(ps.listInstalled().map((p) => p.name));
             return results.map((r) => ({
                 ...r,

package/dist/auth/app-confirm-page.js

@@ -0,0 +1,64 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.APP_CONFIRM_REFUSAL_CSP = exports.APP_CONFIRM_CSP = void 0;
+exports.appConfirmPage = appConfirmPage;
+exports.appConfirmRefusalPage = appConfirmRefusalPage;
+/**
+ * The hub-rendered confirmation page of a native app sign-in (D858):
+ * "Sign in the CamStack app as <username>?".
+ *
+ * Same discipline as the passkey page (`app-passkey-page.ts`): plain HTML, one
+ * inline script and one style pinned by SHA-256 in the CSP, same-origin
+ * requests only, no framing, no third-party asset. The page carries the
+ * one-shot token in a `data-` attribute (never in the script), so the script
+ * hash is a constant. Continue POSTs the token and navigates to the
+ * `location` the hub answers; Cancel is a plain link to the app with
+ * `error=cancelled`.
+ */
+const node_crypto_1 = require("node:crypto");
+const PAGE_SCRIPT = `(function () {
+  var btn = document.getElementById('go');
+  var msg = document.getElementById('msg');
+  var APP_CALLBACK = /^camstack(\\.dev)?:\\/\\/auth-callback(\\?|$)/;
+  btn.addEventListener('click', function () {
+    btn.disabled = true;
+    msg.textContent = '';
+    fetch(location.pathname, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ confirm: btn.getAttribute('data-confirm') }),
+      credentials: 'same-origin',
+      cache: 'no-store'
+    }).then(function (r) { return r.json(); }).then(function (body) {
+      if (typeof body.location !== 'string' || !APP_CALLBACK.test(body.location)) {
+        throw new Error(body.error || 'Sign-in failed.');
+      }
+      location.assign(body.location);
+    }).catch(function () {
+      msg.textContent = 'This confirmation expired. Start the sign-in again from the app.';
+    });
+  });
+})();`;
+const PAGE_STYLE = `body{font-family:system-ui,sans-serif;max-width:26rem;margin:4rem auto;padding:0 1rem;text-align:center}button{font:inherit;padding:.75rem 1.25rem;border-radius:.5rem;border:1px solid #888;cursor:pointer}p#msg{color:#b00020;min-height:1.5em}a{display:inline-block;margin-top:1rem}`;
+const sha256 = (text) => `'sha256-${(0, node_crypto_1.createHash)('sha256').update(text).digest('base64')}'`;
+/** The CSP: the one script and style by hash, same-origin requests, no framing, no form posts. */
+exports.APP_CONFIRM_CSP = [
+    "default-src 'none'",
+    `script-src ${sha256(PAGE_SCRIPT)}`,
+    `style-src ${sha256(PAGE_STYLE)}`,
+    "connect-src 'self'",
+    "base-uri 'none'",
+    "form-action 'none'",
+    "frame-ancestors 'none'",
+].join('; ');
+/** CSP of the refusal page: nothing runs, nothing loads. */
+exports.APP_CONFIRM_REFUSAL_CSP = "default-src 'none'; frame-ancestors 'none'";
+const escapeHtml = (text) => text.replace(/[&<>"']/g, (c) => `&#${c.charCodeAt(0)};`);
+/** The confirmation page for `username`; `cancelHref` is the app callback carrying `error=cancelled`. */
+function appConfirmPage(input) {
+    return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="referrer" content="no-referrer"><title>Sign in the CamStack app</title><style>${PAGE_STYLE}</style></head><body><h1>Sign in the CamStack app?</h1><p>The CamStack app on this device will be signed in as <strong>${escapeHtml(input.username)}</strong>.</p><p>Continue only if you just started this from the CamStack app.</p><button id="go" type="button" data-confirm="${escapeHtml(input.token)}">Continue</button><p id="msg" role="alert"></p><a href="${escapeHtml(input.cancelHref)}">Cancel</a><noscript><p>JavaScript is required to continue.</p></noscript><script>${PAGE_SCRIPT}</script></body></html>`;
+}
+/** A confirmation that is gone (expired, used, or opened in another browser): a sentence, nothing runs. */
+function appConfirmRefusalPage() {
+    return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Confirmation expired</title></head><body><h1>Confirmation expired</h1><p>This sign-in confirmation is no longer valid.</p><p>Close this window and start the sign-in again from the app.</p></body></html>`;
+}

package/dist/auth/app-confirm-routes.js

@@ -0,0 +1,107 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.APP_CONFIRM_PARAM = exports.APP_CONFIRM_PATH = void 0;
+exports.appConfirmCookie = appConfirmCookie;
+exports.registerAppConfirmRoutes = registerAppConfirmRoutes;
+/**
+ * `/auth/app/confirm` - the last step of a native app sign-in (D858).
+ *
+ * Both browser legs (the OIDC `finish-app`, the passkey `finish`) end here
+ * instead of at the app: they park an {@link AppConfirmations} entry and send
+ * the browser to this page. `GET` renders "Sign in the CamStack app as <user>?";
+ * `POST` (Continue) spends the one-shot, cookie-bound token and ONLY THEN mints
+ * the handoff code and answers `{ location }` at the app's scheme. Nothing is
+ * minted without the POST, and the token is useless in any other browser.
+ */
+const types_1 = require("@camstack/types");
+const zod_1 = require("zod");
+const app_confirmations_js_1 = require("./app-confirmations.js");
+const app_confirm_page_js_1 = require("./app-confirm-page.js");
+const auth_rate_limit_js_1 = require("./auth-rate-limit.js");
+const sso_finish_deps_js_1 = require("./sso-finish-deps.js");
+exports.APP_CONFIRM_PATH = '/auth/app/confirm';
+/** The query parameter carrying the token (masked in logged URLs). */
+exports.APP_CONFIRM_PARAM = 'confirm';
+/** `Set-Cookie` for the browser binding: HttpOnly, Lax (the entry may come from a cross-site redirect chain). */
+function appConfirmCookie(value, secure) {
+    return [
+        `${app_confirmations_js_1.APP_CONFIRM_COOKIE}=${value}`,
+        'Path=/',
+        'HttpOnly',
+        'SameSite=Lax',
+        'Max-Age=180',
+        ...(secure ? ['Secure'] : []),
+    ].join('; ');
+}
+const ConfirmBodySchema = zod_1.z.object({ confirm: zod_1.z.string().min(1).max(256) });
+function noStore(reply) {
+    reply.header('Cache-Control', 'no-store');
+    reply.header('Referrer-Policy', 'no-referrer');
+}
+/** The handoff code, minted for a confirmed person. */
+function mint(deps, confirmation) {
+    const { app } = confirmation;
+    const minted = deps.handoffCodes.create(confirmation.userId, {
+        purpose: app.purpose,
+        codeChallenge: app.codeChallenge,
+        state: app.state,
+        authMethod: confirmation.authMethod,
+    });
+    return (0, types_1.appFlowLocation)(app.redirect, { code: minted.code }, app.state);
+}
+function registerAppConfirmRoutes(fastify, deps) {
+    const limited = (request, reply) => {
+        const client = (0, auth_rate_limit_js_1.clientKeyFromRequest)(request, deps.network);
+        if (client === null)
+            return false;
+        const verdict = deps.limiter.check(`app-confirm:${client}`);
+        if (verdict.allowed)
+            return false;
+        reply.header('retry-after', String(verdict.retryAfterSeconds));
+        void reply.status(429).send({ error: 'Too many attempts' });
+        return true;
+    };
+    fastify.get(exports.APP_CONFIRM_PATH, async (request, reply) => {
+        noStore(reply);
+        reply.type('text/html; charset=utf-8');
+        if (limited(request, reply))
+            return reply;
+        const token = request.query[exports.APP_CONFIRM_PARAM];
+        const confirmation = token === undefined
+            ? null
+            : deps.confirmations.peek(token, (0, sso_finish_deps_js_1.readCookie)(request.headers.cookie, app_confirmations_js_1.APP_CONFIRM_COOKIE));
+        if (token === undefined || confirmation === null) {
+            deps.logger.warn('App sign-in confirmation page refused', {
+                meta: { reason: 'unknown-expired-or-other-browser' },
+            });
+            reply.header('Content-Security-Policy', app_confirm_page_js_1.APP_CONFIRM_REFUSAL_CSP);
+            return reply.status(400).send((0, app_confirm_page_js_1.appConfirmRefusalPage)());
+        }
+        reply.header('Content-Security-Policy', app_confirm_page_js_1.APP_CONFIRM_CSP);
+        return reply.send((0, app_confirm_page_js_1.appConfirmPage)({
+            username: confirmation.username,
+            token,
+            cancelHref: (0, types_1.appFlowLocation)(confirmation.app.redirect, { error: 'cancelled' }, confirmation.app.state),
+        }));
+    });
+    fastify.post(exports.APP_CONFIRM_PATH, async (request, reply) => {
+        noStore(reply);
+        if (limited(request, reply))
+            return reply;
+        const body = ConfirmBodySchema.safeParse(request.body);
+        if (!body.success)
+            return reply.status(400).send({ error: 'Malformed confirmation.' });
+        const confirmation = deps.confirmations.consume(body.data.confirm, (0, sso_finish_deps_js_1.readCookie)(request.headers.cookie, app_confirmations_js_1.APP_CONFIRM_COOKIE));
+        if (confirmation === null) {
+            deps.logger.warn('App sign-in confirmation refused', {
+                meta: { reason: 'unknown-used-expired-or-other-browser' },
+            });
+            return reply.status(400).send({ error: 'This confirmation expired.' });
+        }
+        deps.logger.info?.('App sign-in confirmed', {
+            tags: { userId: confirmation.userId },
+            meta: { method: confirmation.authMethod, purpose: confirmation.app.purpose },
+        });
+        return reply.send({ location: mint(deps, confirmation) });
+    });
+}

package/dist/auth/app-confirmations.js

@@ -0,0 +1,128 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AppConfirmations = exports.APP_CONFIRM_COOKIE = exports.APP_CONFIRM_TTL_MS = void 0;
+/**
+ * Pending "Sign in the CamStack app as <user>?" confirmations (D858).
+ *
+ * A custom URL scheme can be claimed by any app on the phone, so a browser leg
+ * that ends in `camstack://…?code=…` could hand a code to an app the user never
+ * meant to sign in (one that started the flow itself, with its own PKCE
+ * challenge, while an IdP session was live). The code is therefore minted only
+ * AFTER the signed-in person confirms, on a page the hub renders:
+ *
+ *  - the finished ceremony parks an entry here, keyed by a one-shot token;
+ *  - the token travels in the URL, but is useless without the browser-bound
+ *    cookie the entry was created with (the cookie's hash is kept, not the cookie);
+ *  - it lives {@link APP_CONFIRM_TTL_MS}, is consumed by the first `consume`
+ *    whatever the outcome, and the store is bounded.
+ *
+ * In-memory only: a hub restart simply means the person signs in again.
+ */
+const crypto = __importStar(require("node:crypto"));
+exports.APP_CONFIRM_TTL_MS = 120_000;
+const MAX_PENDING = 500;
+/** The cookie that binds a confirmation to the browser that finished the ceremony. */
+exports.APP_CONFIRM_COOKIE = 'camstack_app_confirm';
+const sha256 = (value) => crypto.createHash('sha256').update(value).digest('hex');
+function sameDigest(a, b) {
+    const left = Buffer.from(a, 'utf8');
+    const right = Buffer.from(b, 'utf8');
+    return left.length === right.length && crypto.timingSafeEqual(left, right);
+}
+class AppConfirmations {
+    now;
+    /** Keyed by SHA-256(token). */
+    pending = new Map();
+    constructor(now = Date.now) {
+        this.now = now;
+    }
+    /** Park a confirmation. Returns the one-shot token and the cookie value to set. */
+    create(confirmation) {
+        this.prune();
+        if (this.pending.size >= MAX_PENDING)
+            throw new Error('Too many pending app confirmations');
+        const token = crypto.randomBytes(32).toString('base64url');
+        const cookie = crypto.randomBytes(32).toString('base64url');
+        this.pending.set(sha256(token), {
+            ...confirmation,
+            cookieHash: sha256(cookie),
+            expiresAt: this.now() + exports.APP_CONFIRM_TTL_MS,
+        });
+        return { token, cookie };
+    }
+    /** Read without consuming (to render the page). `null` unless token and cookie both match. */
+    peek(token, cookie) {
+        this.prune();
+        const entry = this.pending.get(sha256(token));
+        if (entry === undefined || cookie === null || !sameDigest(sha256(cookie), entry.cookieHash)) {
+            return null;
+        }
+        return this.view(entry);
+    }
+    /**
+     * Spend the token. Burned on the FIRST attempt whatever the outcome - a wrong
+     * cookie included, so a leaked token cannot be probed with guesses.
+     */
+    consume(token, cookie) {
+        this.prune();
+        const key = sha256(token);
+        const entry = this.pending.get(key);
+        if (entry === undefined)
+            return null;
+        this.pending.delete(key);
+        if (cookie === null || !sameDigest(sha256(cookie), entry.cookieHash))
+            return null;
+        return this.view(entry);
+    }
+    get pendingCount() {
+        return this.pending.size;
+    }
+    view(entry) {
+        return {
+            userId: entry.userId,
+            username: entry.username,
+            app: entry.app,
+            authMethod: entry.authMethod,
+        };
+    }
+    prune() {
+        const at = this.now();
+        for (const [key, entry] of this.pending)
+            if (at > entry.expiresAt)
+                this.pending.delete(key);
+    }
+}
+exports.AppConfirmations = AppConfirmations;

package/dist/auth/app-passkey-page.js

@@ -0,0 +1,135 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.APP_PASSKEY_REFUSAL_CSP = exports.APP_PASSKEY_CSP = void 0;
+exports.appPasskeyPage = appPasskeyPage;
+exports.appPasskeyRefusalPage = appPasskeyRefusalPage;
+/**
+ * The standalone passkey page for a native app sign-in (D858).
+ *
+ * Served by the hub at `/auth/app/passkey`, NOT part of the admin-ui bundle:
+ * plain HTML and one small inline script, no third-party asset, no framework.
+ * The app opens it in the system browser (`ASWebAuthenticationSession` /
+ * Custom Tab); the WebAuthn relying party is the hub's own origin, so the app
+ * needs no per-domain entitlement. The page runs the usernameless assertion
+ * ceremony against `POST …/begin` and `POST …/finish` (same origin) and
+ * navigates to the `location` the hub answers - the app's custom scheme.
+ *
+ * The CSP pins exactly the one script and one style by hash, forbids every
+ * other source, and lets the page talk to its own origin only. Nothing request
+ * specific is ever placed in the script; the only server-rendered value is the
+ * (allow-listed, HTML-escaped) cancel link.
+ */
+const node_crypto_1 = require("node:crypto");
+const PAGE_SCRIPT = `(function () {
+  var q = new URLSearchParams(location.search);
+  var base = location.pathname.replace(/\\/+$/, '');
+  var btn = document.getElementById('go');
+  var msg = document.getElementById('msg');
+  var KEYS = ['code_challenge', 'code_challenge_method', 'state', 'purpose', 'redirect'];
+  var APP_CALLBACK = /^camstack(\\.dev)?:\\/\\/auth-callback(\\?|$)/;
+  function fromB64u(s) {
+    s = s.replace(/-/g, '+').replace(/_/g, '/');
+    while (s.length % 4) s += '=';
+    var b = atob(s), u = new Uint8Array(b.length);
+    for (var i = 0; i < b.length; i++) u[i] = b.charCodeAt(i);
+    return u.buffer;
+  }
+  function toB64u(buf) {
+    var u = new Uint8Array(buf), s = '';
+    for (var i = 0; i < u.length; i++) s += String.fromCharCode(u[i]);
+    return btoa(s).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '');
+  }
+  function flow() {
+    var o = {};
+    KEYS.forEach(function (k) { var v = q.get(k); if (v !== null) o[k] = v; });
+    return o;
+  }
+  function post(path, body) {
+    return fetch(base + path, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify(body),
+      credentials: 'same-origin',
+      cache: 'no-store'
+    }).then(function (r) { return r.json().then(function (j) { return { ok: r.ok, body: j }; }); });
+  }
+  function fail(text) { msg.textContent = text; btn.disabled = false; }
+  function go() {
+    btn.disabled = true;
+    msg.textContent = '';
+    if (!window.PublicKeyCredential || !navigator.credentials) {
+      return fail('This browser cannot use passkeys.');
+    }
+    post('/begin', flow()).then(function (begin) {
+      if (!begin.ok) throw new Error(begin.body.error || 'Passkeys are not available.');
+      var opts = begin.body.optionsJSON;
+      var pk = {
+        challenge: fromB64u(opts.challenge),
+        timeout: opts.timeout,
+        rpId: opts.rpId,
+        userVerification: opts.userVerification,
+        allowCredentials: (opts.allowCredentials || []).map(function (c) {
+          return { type: c.type, id: fromB64u(c.id), transports: c.transports };
+        })
+      };
+      return navigator.credentials.get({ publicKey: pk });
+    }).then(function (cred) {
+      var r = cred.response;
+      var body = flow();
+      body.response = {
+        id: cred.id,
+        rawId: toB64u(cred.rawId),
+        type: cred.type,
+        clientExtensionResults: cred.getClientExtensionResults ? cred.getClientExtensionResults() : {},
+        authenticatorAttachment: cred.authenticatorAttachment || undefined,
+        response: {
+          authenticatorData: toB64u(r.authenticatorData),
+          clientDataJSON: toB64u(r.clientDataJSON),
+          signature: toB64u(r.signature),
+          userHandle: r.userHandle ? toB64u(r.userHandle) : undefined
+        }
+      };
+      return post('/finish', body);
+    }).then(function (done) {
+      var next = done.body && done.body.confirm;
+      if (typeof next === 'string' && /^confirm\\?confirm=[A-Za-z0-9_-]+$/.test(next)) {
+        location.assign(next);
+        return;
+      }
+      var target = done.body && done.body.location;
+      if (typeof target !== 'string' || !APP_CALLBACK.test(target)) {
+        throw new Error((done.body && done.body.error) || 'Sign-in failed.');
+      }
+      location.assign(target);
+    }).catch(function (e) {
+      fail(e && e.name === 'NotAllowedError' ? 'The passkey request was cancelled.' : 'Sign-in failed. Try again.');
+    });
+  }
+  btn.addEventListener('click', go);
+})();`;
+const PAGE_STYLE = `body{font-family:system-ui,sans-serif;max-width:26rem;margin:4rem auto;padding:0 1rem;text-align:center}button{font:inherit;padding:.75rem 1.25rem;border-radius:.5rem;border:1px solid #888;cursor:pointer}p#msg{color:#b00020;min-height:1.5em}a{display:inline-block;margin-top:1rem}`;
+const sha256 = (text) => `'sha256-${(0, node_crypto_1.createHash)('sha256').update(text).digest('base64')}'`;
+/**
+ * The page's CSP: the one script and one style by hash, same-origin requests
+ * only, no framing, no base rewrite, no form posts, no plugins.
+ */
+exports.APP_PASSKEY_CSP = [
+    "default-src 'none'",
+    `script-src ${sha256(PAGE_SCRIPT)}`,
+    `style-src ${sha256(PAGE_STYLE)}`,
+    "connect-src 'self'",
+    "base-uri 'none'",
+    "form-action 'none'",
+    "frame-ancestors 'none'",
+].join('; ');
+const escapeHtml = (text) => text.replace(/[&<>"']/g, (c) => `&#${c.charCodeAt(0)};`);
+/** The page; `cancelHref` is the app callback carrying `error=cancelled`. */
+function appPasskeyPage(cancelHref) {
+    return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="referrer" content="no-referrer"><title>Sign in with a passkey</title><style>${PAGE_STYLE}</style></head><body><h1>CamStack</h1><button id="go" type="button">Sign in with a passkey</button><p id="msg" role="alert"></p><a href="${escapeHtml(cancelHref)}">Cancel</a><noscript><p>JavaScript is required to use a passkey.</p></noscript><script>${PAGE_SCRIPT}</script></body></html>`;
+}
+/** The page for a request the hub refuses to serve: a sentence, no script, no assets. */
+function appPasskeyRefusalPage(message) {
+    return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Sign-in request refused</title></head><body><h1>Sign-in request refused</h1><p>${escapeHtml(message)}</p><p>Close this window and try again from the app.</p></body></html>`;
+}
+/** CSP of the refusal page: nothing runs, nothing loads. */
+exports.APP_PASSKEY_REFUSAL_CSP = "default-src 'none'; frame-ancestors 'none'";

package/dist/auth/app-passkey-routes.js

@@ -0,0 +1,152 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.APP_PASSKEY_PATH = void 0;
+exports.registerAppPasskeyRoutes = registerAppPasskeyRoutes;
+/**
+ * The passkey app sign-in routes (D858):
+ *
+ *  - `GET  /auth/app/passkey`        - the standalone page (`app-passkey-page.ts`)
+ *  - `POST /auth/app/passkey/begin`  - assertion options (discoverable credentials)
+ *  - `POST /auth/app/passkey/finish` - the assertion -> a handoff code at the app
+ *
+ * The finish verifies the assertion through the `user-passkeys` provider (the
+ * same ceremony `auth.passkeyLoginFinish` runs), applies the second-factor rule
+ * of any primary login, and mints the ONE-SHOT handoff code - PKCE-bound,
+ * state-bound, purpose-aware - for the user the passkey belongs to. It opens no
+ * session, reads no cookie and honours no `returnTo`: the destination is the
+ * allow-listed app callback, nothing else. Every answer is `{ location }` (or an
+ * `{ error }` for a request that is not an app flow at all), so the page just
+ * navigates. The app's parameters are never logged.
+ */
+const types_1 = require("@camstack/types");
+const zod_1 = require("zod");
+const app_confirm_routes_js_1 = require("./app-confirm-routes.js");
+const app_passkey_page_js_1 = require("./app-passkey-page.js");
+const auth_rate_limit_js_1 = require("./auth-rate-limit.js");
+const session_mint_js_1 = require("./session-mint.js");
+exports.APP_PASSKEY_PATH = '/auth/app/passkey';
+const FinishBodySchema = zod_1.z.object({
+    response: zod_1.z.record(zod_1.z.string(), zod_1.z.unknown()),
+    code_challenge: zod_1.z.string().optional(),
+    code_challenge_method: zod_1.z.string().optional(),
+    state: zod_1.z.string().optional(),
+    purpose: zod_1.z.string().optional(),
+    redirect: zod_1.z.string().optional(),
+});
+function noStore(reply) {
+    reply.header('Cache-Control', 'no-store');
+    reply.header('Referrer-Policy', 'no-referrer');
+}
+function registerAppPasskeyRoutes(fastify, deps) {
+    const limited = (bucket, request, reply) => {
+        const client = (0, auth_rate_limit_js_1.clientKeyFromRequest)(request, deps.network);
+        if (client === null)
+            return false;
+        const verdict = deps.limiter.check(`${bucket}:${client}`);
+        if (verdict.allowed)
+            return false;
+        reply.header('retry-after', String(verdict.retryAfterSeconds));
+        void reply.status(429).send({ error: 'Too many attempts' });
+        return true;
+    };
+    fastify.get(exports.APP_PASSKEY_PATH, async (request, reply) => {
+        noStore(reply);
+        reply.type('text/html; charset=utf-8');
+        const parsed = (0, types_1.parseAppFlowRequest)(request.query);
+        if (!parsed.ok) {
+            deps.logger.warn('Passkey app sign-in refused at the page', {
+                meta: { reason: parsed.reason },
+            });
+            reply.header('Content-Security-Policy', app_passkey_page_js_1.APP_PASSKEY_REFUSAL_CSP);
+            return reply
+                .status(400)
+                .send((0, app_passkey_page_js_1.appPasskeyRefusalPage)(types_1.APP_FLOW_REFUSAL_MESSAGES[parsed.reason]));
+        }
+        reply.header('Content-Security-Policy', app_passkey_page_js_1.APP_PASSKEY_CSP);
+        const cancel = (0, types_1.appFlowLocation)(parsed.request.redirect, { error: 'cancelled' }, parsed.request.state);
+        return reply.send((0, app_passkey_page_js_1.appPasskeyPage)(cancel));
+    });
+    fastify.post(`${exports.APP_PASSKEY_PATH}/begin`, async (request, reply) => {
+        noStore(reply);
+        if (limited('app-passkey-begin', request, reply))
+            return reply;
+        const body = zod_1.z.record(zod_1.z.string(), zod_1.z.unknown()).safeParse(request.body);
+        const query = body.success
+            ? Object.fromEntries(Object.entries(body.data).flatMap(([k, v]) => (typeof v === 'string' ? [[k, v]] : [])))
+            : {};
+        const parsed = (0, types_1.parseAppFlowRequest)(query);
+        if (!parsed.ok)
+            return reply.status(400).send({ error: types_1.APP_FLOW_REFUSAL_MESSAGES[parsed.reason] });
+        const provider = deps.passkeys();
+        if (provider === null)
+            return reply.status(503).send({ error: 'Passkeys are not available.' });
+        try {
+            return await reply.send(await provider.beginDiscoverableAuthentication({}));
+        }
+        catch (error) {
+            deps.logger.error('Passkey app sign-in begin failed', {
+                meta: { error: error instanceof Error ? error.message : String(error) },
+            });
+            return reply.status(500).send({ error: 'Passkeys are not available.' });
+        }
+    });
+    fastify.post(`${exports.APP_PASSKEY_PATH}/finish`, async (request, reply) => {
+        noStore(reply);
+        if (limited('app-passkey-finish', request, reply))
+            return reply;
+        const body = FinishBodySchema.safeParse(request.body);
+        if (!body.success)
+            return reply.status(400).send({ error: 'Malformed sign-in request.' });
+        const parsed = (0, types_1.parseAppFlowRequest)({
+            code_challenge: body.data.code_challenge,
+            code_challenge_method: body.data.code_challenge_method,
+            state: body.data.state,
+            purpose: body.data.purpose,
+            redirect: body.data.redirect,
+        });
+        if (!parsed.ok)
+            return reply.status(400).send({ error: types_1.APP_FLOW_REFUSAL_MESSAGES[parsed.reason] });
+        const app = parsed.request;
+        const deny = (error) => {
+            deps.logger.warn('Passkey app sign-in refused', { meta: { error } });
+            return reply.send({ location: (0, types_1.appFlowLocation)(app.redirect, { error }, app.state) });
+        };
+        const provider = deps.passkeys();
+        if (provider === null)
+            return deny('passkey-unavailable');
+        try {
+            const result = await provider.finishDiscoverableAuthentication({
+                response: body.data.response,
+            });
+            if (!result.verified || result.userId === null)
+                return deny('passkey-failed');
+            const record = await deps.minter.findUser(result.userId);
+            // The rule of any primary login: owed second factors are not skippable
+            // here, and a browser page cannot ask for them - the app uses another method.
+            if ((await deps.secondFactors(record.id)).length > 0)
+                return deny('second-factor-required');
+            // The assertion verified; before ANY code exists the person confirms that
+            // THIS app is the one to sign in (a custom scheme can be claimed by
+            // another app, D858). The page goes to the sibling confirmation page; its
+            // cookie binds the token to this browser.
+            const parked = deps.confirmations.create({
+                userId: record.id,
+                username: record.username,
+                app,
+                authMethod: 'passkey',
+            });
+            reply.header('Set-Cookie', (0, app_confirm_routes_js_1.appConfirmCookie)(parked.cookie, request.protocol === 'https'));
+            return reply.send({
+                confirm: `confirm?${app_confirm_routes_js_1.APP_CONFIRM_PARAM}=${encodeURIComponent(parked.token)}`,
+            });
+        }
+        catch (error) {
+            if (error instanceof session_mint_js_1.SessionUserGoneError)
+                return deny('user-gone');
+            deps.logger.error('Passkey app sign-in failed', {
+                meta: { error: error instanceof Error ? error.message : String(error) },
+            });
+            return deny('failed');
+        }
+    });
+}

package/dist/auth/sso-finish-app.js

@@ -0,0 +1,96 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.finishSsoApp = finishSsoApp;
+/**
+ * `/api/auth/sso/finish-app` - the native-app leg of an OIDC sign-in (D858).
+ *
+ * The viewer starts OIDC at `/addon/auth-oidc/<id>/start?app=1&code_challenge=…`
+ * and the system browser must come back to the APP, not to the admin UI. The
+ * addon parks the app's PKCE challenge, `state`, purpose and return URL in its
+ * server-side pending state and signs them into the login bridge (`claims.app`);
+ * the callback then lands here instead of `/sso/finish`.
+ *
+ * Same trust as the web finish (D782, D810): the bridge must verify, be a LOGIN
+ * bridge of an enabled provider, be finished in the browser that started it
+ * (state-cookie binding) and only once (`jti`); the identity must be LINKED to
+ * a user. The difference is the product: NO web session and NO cookie. The hub
+ * mints the existing one-shot handoff code - PKCE-bound, state-bound - and
+ * redirects the browser to the app's custom scheme:
+ *
+ *  - `new-session`: the app redeems it at `auth.redeemHandoffCode` for a normal
+ *    session;
+ *  - `step-up`: the app redeems it at `auth.deviceEnrollProofFromHandoff` for a
+ *    device-enroll proof (D855). An IdP login has JUST happened in this request
+ *    chain - that is the fresh authentication - and nothing here reads a web
+ *    session cookie, so an old session can never launder a proof.
+ *
+ * Every refusal is a 302 to the app with `error=<code>` (and the app's `state`
+ * once the bridge is trusted): the app shows the message, the user is never left
+ * on a hub error page. The app's parameters are never logged.
+ *
+ * Pure: the Fastify route in `sso-routes.ts` wires the deps and maps the outcome.
+ */
+const types_1 = require("@camstack/types");
+const auth_provider_gate_js_1 = require("./auth-provider-gate.js");
+const session_mint_js_1 = require("./session-mint.js");
+const sso_finish_js_1 = require("./sso-finish.js");
+function refused(error, deps, redirect, state) {
+    deps.logRefusal?.(error);
+    return { kind: 'app', location: (0, types_1.appFlowLocation)(redirect, { error }, state) };
+}
+/** Exchange a verified app login bridge for a handoff code at the app's callback. */
+async function finishSsoApp(bridge, deps) {
+    const fallback = types_1.APP_FLOW_DEFAULT_REDIRECT;
+    if (!bridge)
+        return refused('invalid-bridge', deps, fallback, undefined);
+    const claims = deps.verifyBridge(bridge);
+    if (claims === null)
+        return refused('invalid-bridge', deps, fallback, undefined);
+    const app = claims.app;
+    if (app === undefined || !(0, sso_finish_js_1.isLoginBridge)(claims)) {
+        return refused('not-app-flow', deps, fallback, undefined);
+    }
+    // The signed redirect is checked against the allow-list again: the finish
+    // never trusts a stored URL to be one it would accept.
+    const redirect = (0, types_1.parseAppAuthCallback)(app.redirect);
+    if (redirect === null)
+        return refused('not-app-flow', deps, fallback, undefined);
+    const deny = (error) => refused(error, deps, redirect, app.state);
+    if (claims.linkIntent !== undefined)
+        return deny('link-not-supported');
+    if (deps.isProviderDisabled((0, auth_provider_gate_js_1.bridgeProviderAddonId)(claims.provider))) {
+        return deny('provider-disabled');
+    }
+    if (!(0, sso_finish_js_1.bridgeIsFirstUseHere)(claims, deps))
+        return deny('sso-state');
+    try {
+        const identity = (0, sso_finish_js_1.oidcIdentityOf)(claims);
+        if (identity === null)
+            return deny('invalid-bridge');
+        const link = await deps.identities.findUser(identity.provider, identity.subject);
+        // A link made under another issuer is not this identity (D782).
+        if (link === null || link.issuer !== identity.issuer)
+            return deny('sso-not-linked');
+        const record = await deps.minter.findUser(link.userId);
+        // Same rule as a password login: the second factors owed are not skippable
+        // here, and a browser leg cannot ask for them - the app uses another method.
+        if ((await deps.secondFactors(record.id)).length > 0)
+            return deny('second-factor-required');
+        // The person has just authenticated; before ANY code exists they confirm
+        // that THIS app is the one to sign in (a custom scheme can be claimed by
+        // another app, D858).
+        const parked = deps.confirmations.create({
+            userId: record.id,
+            username: record.username,
+            app: { codeChallenge: app.codeChallenge, state: app.state, purpose: app.purpose, redirect },
+            authMethod: 'sso',
+        });
+        return { kind: 'confirm', ...parked };
+    }
+    catch (error) {
+        if (error instanceof session_mint_js_1.SessionUserGoneError)
+            return deny('user-gone');
+        deps.logFailure?.(error);
+        return deny('failed');
+    }
+}

package/dist/auth/sso-finish.js

@@ -2,10 +2,12 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SSO_POPUP_COMPLETE_PATH = exports.SSO_LOGIN_PATH = exports.SSO_PROFILE_PATH = exports.OIDC_IDENTITY_PREFIX = exports.OIDC_BRIDGE_PROVIDER_PREFIX = void 0;
 exports.popupCompletionLocation = popupCompletionLocation;
+exports.oidcIdentityOf = oidcIdentityOf;
 exports.isLoginBridge = isLoginBridge;
 exports.appCallbackLocation = appCallbackLocation;
 exports.sessionFragmentParams = sessionFragmentParams;
 exports.finishSsoLogin = finishSsoLogin;
+exports.bridgeIsFirstUseHere = bridgeIsFirstUseHere;
 /**
  * `/api/auth/sso/finish` — swaps a verified login bridge for a session (D712),
  * or completes an explicit OIDC link (D782).
@@ -287,6 +289,10 @@ async function finishSsoReturn(bridge, deps) {
         return unauthorized('Invalid or expired bridge token');
     if (!isLoginBridge(claims))
         return unauthorized('Not a login bridge token');
+    // A bridge minted for a native app (D858) is finished only at `finish-app`,
+    // which hands the app a code; it must never become a web session here.
+    if (claims.app !== undefined)
+        return unauthorized('Not a web login bridge token');
     if (deps.isProviderDisabled((0, auth_provider_gate_js_1.bridgeProviderAddonId)(claims.provider))) {
         return unauthorized('Login provider is disabled');
     }

package/dist/auth/sso-routes.js

@@ -8,6 +8,9 @@ exports.registerSsoRoutes = registerSsoRoutes;
  *    browser-bound login bridge for a session / challenge / link
  *    (`sso-finish.ts` holds the rules). Limited per REAL client address.
  *    Every answer clears the `SSO_STATE_COOKIE`: it binds exactly one finish.
+ *  - `GET /api/auth/sso/finish-app?bridge=…` - the same bridge rules for a
+ *    NATIVE APP sign-in (D858): no web session, a handoff code at the app's
+ *    custom scheme (`sso-finish-app.ts`).
  *  - `GET /api/auth/browser-handoff?code=…` — a one-time code from
  *    `auth.createBrowserHandoff` opens the account page signed in (D801).
  */
@@ -16,6 +19,8 @@ const spa_mount_js_1 = require("../api/static/spa-mount.js");
 const auth_rate_limit_js_1 = require("./auth-rate-limit.js");
 const native_return_js_1 = require("./native-return.js");
 const sso_finish_js_1 = require("./sso-finish.js");
+const app_confirm_routes_js_1 = require("./app-confirm-routes.js");
+const sso_finish_app_js_1 = require("./sso-finish-app.js");
 const sso_finish_deps_js_1 = require("./sso-finish-deps.js");
 /** A User-Agent as a session's client label. */
 function clientOf(ua) {
@@ -61,6 +66,47 @@ function registerSsoRoutes(fastify, deps) {
         reply.header('Location', (0, native_return_js_1.ssoReturnLocation)(mount, outcome.location));
         return reply.send('');
     });
+    // The native-app leg (D858): same bridge rules, a handoff code instead of a
+    // session. Every outcome - success or refusal - is a 302 to the app.
+    fastify.get('/api/auth/sso/finish-app', async (request, reply) => {
+        reply.header('Referrer-Policy', 'no-referrer');
+        reply.header('Cache-Control', 'no-store');
+        const clearState = clearSsoStateCookie();
+        reply.header('Set-Cookie', clearState);
+        const client = (0, auth_rate_limit_js_1.clientKeyFromRequest)(request, deps.network);
+        if (client !== null) {
+            const verdict = deps.limiter.check(`sso-finish:${client}`);
+            if (!verdict.allowed) {
+                reply.header('retry-after', String(verdict.retryAfterSeconds));
+                return reply.status(429).send({ error: 'Too many attempts' });
+            }
+        }
+        const outcome = await (0, sso_finish_app_js_1.finishSsoApp)(request.query.bridge, {
+            ...(0, sso_finish_deps_js_1.createSsoFinishDeps)({
+                ...deps.wiring,
+                logFailure: (error) => deps.logger.error('SSO app finish failed', {
+                    meta: { error: error instanceof Error ? error.message : String(error) },
+                }),
+            }, request.headers.cookie),
+            minter: deps.minter,
+            confirmations: deps.confirmations,
+            logRefusal: (error) => deps.logger.warn('SSO app finish refused', { meta: { error } }),
+        });
+        reply.code(302);
+        if (outcome.kind === 'app') {
+            reply.header('Location', outcome.location);
+            return reply.send('');
+        }
+        // The confirmation page, on this hub (mount-aware); its cookie binds the
+        // token to this browser. The SSO state cookie is spent either way.
+        const mount = (0, spa_mount_js_1.parseForwardedPrefix)(request.headers['x-forwarded-prefix']) ?? '';
+        reply.header('Set-Cookie', [
+            clearState,
+            (0, app_confirm_routes_js_1.appConfirmCookie)(outcome.cookie, request.protocol === 'https'),
+        ]);
+        reply.header('Location', `${mount}${app_confirm_routes_js_1.APP_CONFIRM_PATH}?${app_confirm_routes_js_1.APP_CONFIRM_PARAM}=${encodeURIComponent(outcome.token)}`);
+        return reply.send('');
+    });
     // A one-time code minted by `auth.createBrowserHandoff` opens the account
     // page signed in (D801): the session rides the URL FRAGMENT (never a server
     // log), and the only destination is the account page.

package/dist/core/addon/addon-package.service.js

@@ -192,6 +192,7 @@ class AddonPackageService {
     cachedUpdates = null;
     searchCache = null;
     versionCache = new Map();
+    capabilityCache = new Map();
     updateAvailability;
     // -- Auto-update state ----------------------------------------------------
     autoUpdateConfig = {
@@ -217,6 +218,8 @@ class AddonPackageService {
     static UPDATE_CACHE_TTL_MS = 10 * 60 * 1000; // 10 minutes
     static SEARCH_CACHE_TTL_MS = 5 * 60 * 1000; // 5 minutes
     static VERSION_CACHE_TTL_MS = 10 * 60 * 1000; // 10 minutes
+    static CAPABILITY_CACHE_TTL_MS = 10 * 60 * 1000; // 10 minutes
+    static CAPABILITY_LOOKUP_CONCURRENCY = 6;
     static NPM_REGISTRY = 'https://registry.npmjs.org';
     static REGISTRY_TIMEOUT_MS = 10_000;
     constructor(loggingService, eventBusService, configService, addonRegistry, notificationService, toastService, 
@@ -777,8 +780,15 @@ class AddonPackageService {
     // =========================================================================
     // npm search
     // =========================================================================
-    /** Search npm for camstack addon packages, optionally filtered by query */
-    async searchNpm(query) {
+    /**
+     * Search npm for camstack addon packages, optionally filtered by query and
+     * by a capability the package must declare. The capabilities come from each
+     * package's own `/latest` manifest (`camstack.addons[].capabilities`) — the
+     * single source of truth (D4), no hand-kept keywords. A package whose
+     * manifest could not be read carries `capabilities: null` and is excluded
+     * from a capability-filtered result (unknown is not a match).
+     */
+    async searchNpm(query, capability) {
         const npmResults = await this.fetchSearchFromNpm();
         let filtered = npmResults;
         if (query) {
@@ -787,7 +797,14 @@ class AddonPackageService {
                 r.description?.toLowerCase().includes(q) ||
                 r.keywords?.some((k) => k.toLowerCase().includes(q)));
         }
-        return filtered.map((r) => ({
+        const capabilitiesByName = await this.lookupCapabilities(filtered.map((r) => r.name));
+        const failed = filtered.filter((r) => capabilitiesByName.get(r.name) === null).length;
+        if (failed > 0) {
+            this.logger.warn('npm capability lookup failed for some packages', {
+                meta: { failed, total: filtered.length, capability: capability ?? null },
+            });
+        }
+        const withCapabilities = filtered.map((r) => ({
             name: r.name,
             version: r.version,
             description: r.description ?? '',
@@ -796,7 +813,73 @@ class AddonPackageService {
             author: r.publisher?.username ?? '',
             installed: false, // caller will enrich
             installedVersion: undefined,
+            capabilities: capabilitiesByName.get(r.name) ?? null,
         }));
+        if (capability === undefined)
+            return withCapabilities;
+        return withCapabilities.filter((r) => r.capabilities?.includes(capability) === true);
+    }
+    /**
+     * Declared capabilities per package, through a bounded worker pool and the
+     * 10-minute cache. `null` = the lookup failed (not cached, so the next
+     * search retries).
+     */
+    async lookupCapabilities(names) {
+        const result = new Map();
+        const now = Date.now();
+        const pending = [];
+        for (const name of names) {
+            const cached = this.capabilityCache.get(name);
+            if (cached !== undefined && cached.expiresAt > now)
+                result.set(name, cached.capabilities);
+            else
+                pending.push(name);
+        }
+        let next = 0;
+        const worker = async () => {
+            while (next < pending.length) {
+                const name = pending[next++];
+                if (name === undefined)
+                    return;
+                const capabilities = await this.fetchPackageCapabilities(name);
+                result.set(name, capabilities);
+                if (capabilities !== null) {
+                    this.capabilityCache.set(name, {
+                        capabilities,
+                        expiresAt: Date.now() + AddonPackageService.CAPABILITY_CACHE_TTL_MS,
+                    });
+                }
+            }
+        };
+        const poolSize = Math.min(AddonPackageService.CAPABILITY_LOOKUP_CONCURRENCY, pending.length);
+        await Promise.all(Array.from({ length: poolSize }, worker));
+        return result;
+    }
+    /** Read `camstack.addons[].capabilities` from a package's `/latest`; null on any failure. */
+    async fetchPackageCapabilities(packageName) {
+        try {
+            const url = `${this.resolveRegistryBase()}/${packageName.replace('/', '%2F')}/latest`;
+            const response = await fetch(url, {
+                signal: AbortSignal.timeout(AddonPackageService.REGISTRY_TIMEOUT_MS),
+            });
+            if (!response.ok)
+                return null;
+            const data = await fetchJsonObject(response);
+            const addons = asRecord(data['camstack'])['addons'];
+            const names = new Set();
+            for (const addon of Array.isArray(addons) ? addons : []) {
+                const caps = asRecord(addon)['capabilities'];
+                for (const cap of Array.isArray(caps) ? caps : []) {
+                    const name = typeof cap === 'string' ? cap : asString(asRecord(cap)['name']);
+                    if (name)
+                        names.add(name);
+                }
+            }
+            return [...names];
+        }
+        catch {
+            return null;
+        }
     }
     // =========================================================================
     // Package versions

package/dist/core/auth/handoff-code.service.js

@@ -98,6 +98,7 @@ class HandoffCodeService {
             ...(options.codeChallenge !== undefined ? { codeChallenge: options.codeChallenge } : {}),
             ...(options.state !== undefined ? { state: options.state } : {}),
             ...(options.credentialId !== undefined ? { credentialId: options.credentialId } : {}),
+            ...(options.authMethod !== undefined ? { authMethod: options.authMethod } : {}),
             expiresAt,
         });
         return { code, expiresAt };

package/dist/main.js

@@ -96,6 +96,11 @@ const external_link_intents_js_1 = require("./auth/external-link-intents.js");
 const session_cookie_js_1 = require("./auth/session-cookie.js");
 const session_mint_js_1 = require("./auth/session-mint.js");
 const sso_finish_deps_js_1 = require("./auth/sso-finish-deps.js");
+const app_confirmations_js_1 = require("./auth/app-confirmations.js");
+const app_confirm_routes_js_1 = require("./auth/app-confirm-routes.js");
+const app_passkey_routes_js_1 = require("./auth/app-passkey-routes.js");
+const passkey_provider_js_1 = require("./auth/passkey-provider.js");
+const second_factors_js_1 = require("./auth/second-factors.js");
 const sso_routes_js_1 = require("./auth/sso-routes.js");
 const used_bridge_ids_js_1 = require("./auth/used-bridge-ids.js");
 const native_link_completions_js_1 = require("./auth/native-link-completions.js");
@@ -605,6 +610,8 @@ async function bootstrap() {
     // `jti`s of login bridges already finished — a bridge is single-use.
     const usedBridgeIds = new used_bridge_ids_js_1.UsedBridgeIds();
     const browserHandoffCodes = new handoff_code_service_1.HandoffCodeService();
+    // Parked "sign the app in?" confirmations of the two native app flows (D858).
+    const appConfirmations = new app_confirmations_js_1.AppConfirmations();
     const nativeLinkMinter = (0, session_mint_js_1.createSessionMinter)({
         signer: app.get(auth_service_1.AuthService),
         directory: () => capabilityRegistry.getSingleton('user-management'),
@@ -950,9 +957,39 @@ async function bootstrap() {
             network: authNetwork,
             limiter: authRouteLimiter,
             browserHandoffCodes,
+            confirmations: appConfirmations,
             minter: ssoMinter,
             logger: app.get(logging_service_1.LoggingService).createLogger('sso-finish'),
         });
+        // ── Passkey sign-in for the native app (D858) ───────────────────
+        // A standalone page + two same-origin legs; the assertion ends in a handoff
+        // code at the app's custom scheme, never in a web session.
+        (0, app_passkey_routes_js_1.registerAppPasskeyRoutes)(fastify, {
+            passkeys: () => (0, passkey_provider_js_1.resolvePasskeyProvider)(capabilityRegistry, app.get(moleculer_service_1.MoleculerService)),
+            secondFactors: (userId) => {
+                const um = capabilityRegistry.getSingleton('user-management');
+                return (0, second_factors_js_1.collectSecondFactors)({
+                    ...(um && typeof um.getTotpStatus === 'function'
+                        ? { getTotpStatus: (input) => um.getTotpStatus(input) }
+                        : {}),
+                    passkeyProvider: () => (0, passkey_provider_js_1.resolvePasskeyProvider)(capabilityRegistry, app.get(moleculer_service_1.MoleculerService)),
+                }, userId, 'passkey');
+            },
+            minter: ssoMinter,
+            confirmations: appConfirmations,
+            network: authNetwork,
+            limiter: authRouteLimiter,
+            logger: app.get(logging_service_1.LoggingService).createLogger('app-passkey'),
+        });
+        // The last step of both app flows: "Sign in the app as <user>?" - the
+        // handoff code is minted only when the person presses Continue (D858).
+        (0, app_confirm_routes_js_1.registerAppConfirmRoutes)(fastify, {
+            confirmations: appConfirmations,
+            handoffCodes: handoffCodeService,
+            network: authNetwork,
+            limiter: authRouteLimiter,
+            logger: app.get(logging_service_1.LoggingService).createLogger('app-confirm'),
+        });
         // ── Backup archive download ─────────────────────────────────────
         // Streams an archive through the storage cap's chunked-download
         // protocol at the pace the client reads it (D447). The route, its

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.2.574",
+  "version": "1.2.576",
   "license": "MIT",
   "private": false,
   "files": [
@@ -38,9 +38,9 @@
     ]
   },
   "dependencies": {
-    "@camstack/addon-admin-ui": "1.2.424",
+    "@camstack/addon-admin-ui": "1.2.426",
     "@camstack/addon-agent-ui": "1.2.233",
-    "@camstack/addon-auth": "1.2.144",
+    "@camstack/addon-auth": "1.2.145",
     "@camstack/addon-decoder-nodeav": "1.2.123",
     "@camstack/addon-notifiers": "1.2.134",
     "@camstack/addon-pipeline": "1.2.369",
@@ -48,8 +48,8 @@
     "@camstack/addon-post-analysis": "1.2.369",
     "@camstack/develop": "0.1.10",
     "@camstack/sdk": "1.2.131",
-    "@camstack/system": "1.2.433",
-    "@camstack/types": "1.2.369",
+    "@camstack/system": "1.2.435",
+    "@camstack/types": "1.2.371",
     "@camstack/ui-library": "1.2.289",
     "@fastify/compress": "^9.0.0",
     "@fastify/cookie": "^11.0.2",