@camstack/types 1.2.364 → 1.2.366

package/dist/addon.js

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_sleep = require("./sleep-BBXNq778.js");
+const require_sleep = require("./sleep-NZlEFYGX.js");
 const require_event_category = require("./event-category-T43rdQWR.js");
 const require_err_msg = require("./err-msg-Dx2Kor0g.js");
 //#region src/generated/cap-input-defaults.ts
@@ -16,7 +16,7 @@ const require_err_msg = require("./err-msg-Dx2Kor0g.js");
 * Plain data, zero Zod: a forked runner must not import the schema barrel
 * (~144MB RSS per runner — D28).
 *
-* Coverage: 25 caps, 66 methods with defaults.
+* Coverage: 26 caps, 67 methods with defaults.
 */
 var CAP_INPUT_DEFAULTS = Object.freeze({
 	"addons": { "getLogs": { "limit": 100 } },
@@ -39,6 +39,7 @@ var CAP_INPUT_DEFAULTS = Object.freeze({
 		"page": 1,
 		"pageSize": 50
 	} },
+	"device-credentials": { "listDeviceCredentials": { "includeRevoked": false } },
 	"device-manager": { "adoptionListCandidates": {
 		"page": 1,
 		"pageSize": 50

package/dist/addon.mjs

@@ -1,4 +1,4 @@
-import { $ as ReadinessRegistry, A as viewerUiCapability, At as clearKnownSecrets, C as isZodSecret, Cn as isSecretMarker, Dt as REVALIDATE_AFTER_MS, E as HF_REPO, En as toSecretFieldView, Et as resolveSecretViewsIn, Ft as shortSecretRefHash, Gt as normalizeAddonInitResult, H as expandCapMethods, I as adminUiCapability, It as PEER_BYTES_CHUNK_BYTES, Lt as PEER_BYTES_MAX_OUTSTANDING, Mt as knownSecretCount, Nt as registerKnownSecret, Ot as createSecretsAccess, P as describeCustomActions, Pt as scrubKnownSecrets, Q as MODEL_FORMATS, Rt as PEER_BYTES_STALL_MS, S as collectZodSecretPaths, Sn as isSecretFieldView, Tn as makeSecretMarker, Ut as DisposerChain, Vt as DATAPLANE_SECRET_HEADER, Wt as BaseAddon, X as readNodePin, Y as nodePin, _ as createEventBusSliceSource, an as isSecretRef, bn as classifySecretWrite, c as asString, d as parseJsonUnknown, dn as emitReadiness, en as SECRET_REF_SCHEME, et as ReadinessTimeoutError, f as hfModelUrl, g as createDeviceProxy, h as isDeviceScopedCap, in as globalSecretScope, j as DEVICE_CHILDREN_BATCH_MAX, jt as forgetKnownSecret, k as deviceOpsCapability, kt as MIN_SCRUBBED_LENGTH, m as DEVICE_SCOPED_CAPS, nn as buildSecretRef, o as asJsonObject, on as normalizeSecretOwner, p as BOOT_RECOVERY_BACKOFF_MS, r as maskUrlCredentials, rn as formatSecretScope, rt as scopeKey, sn as parseSecretRef, t as sleep, tn as arrayItemFieldPath, un as createEvent, wn as isSecretMarkerLike, xn as isSecretClear, yn as SECRET_CLEAR, zt as PEER_BYTES_TICKET_TTL_MS } from "./sleep-BBF1iXUi.mjs";
+import { A as viewerUiCapability, At as createSecretsAccess, Bt as PEER_BYTES_STALL_MS, C as isZodSecret, Cn as isSecretClear, Dn as makeSecretMarker, E as HF_REPO, En as isSecretMarkerLike, Ft as registerKnownSecret, Gt as DisposerChain, I as adminUiCapability, It as scrubKnownSecrets, Kt as BaseAddon, Lt as shortSecretRefHash, Mt as clearKnownSecrets, Nt as forgetKnownSecret, On as toSecretFieldView, Ot as resolveSecretViewsIn, P as describeCustomActions, Pt as knownSecretCount, Q as readNodePin, Rt as PEER_BYTES_CHUNK_BYTES, S as collectZodSecretPaths, Sn as classifySecretWrite, Tn as isSecretMarker, Ut as DATAPLANE_SECRET_HEADER, Vt as PEER_BYTES_TICKET_TTL_MS, W as expandCapMethods, Z as nodePin, _ as createEventBusSliceSource, an as formatSecretScope, at as scopeKey, c as asString, cn as normalizeSecretOwner, d as parseJsonUnknown, et as MODEL_FORMATS, f as hfModelUrl, fn as createEvent, g as createDeviceProxy, h as isDeviceScopedCap, in as buildSecretRef, j as DEVICE_CHILDREN_BATCH_MAX, jt as MIN_SCRUBBED_LENGTH, k as deviceOpsCapability, kt as REVALIDATE_AFTER_MS, ln as parseSecretRef, m as DEVICE_SCOPED_CAPS, nn as SECRET_REF_SCHEME, nt as ReadinessTimeoutError, o as asJsonObject, on as globalSecretScope, p as BOOT_RECOVERY_BACKOFF_MS, pn as emitReadiness, qt as normalizeAddonInitResult, r as maskUrlCredentials, rn as arrayItemFieldPath, sn as isSecretRef, t as sleep, tt as ReadinessRegistry, wn as isSecretFieldView, xn as SECRET_CLEAR, zt as PEER_BYTES_MAX_OUTSTANDING } from "./sleep-DxJdzHni.mjs";
 import { t as EventCategory } from "./event-category-C4hVnRo8.mjs";
 import { a as DeviceType, t as errMsg } from "./err-msg-DX6i_MY4.mjs";
 //#region src/generated/cap-input-defaults.ts
@@ -15,7 +15,7 @@ import { a as DeviceType, t as errMsg } from "./err-msg-DX6i_MY4.mjs";
 * Plain data, zero Zod: a forked runner must not import the schema barrel
 * (~144MB RSS per runner — D28).
 *
-* Coverage: 25 caps, 66 methods with defaults.
+* Coverage: 26 caps, 67 methods with defaults.
 */
 var CAP_INPUT_DEFAULTS = Object.freeze({
 	"addons": { "getLogs": { "limit": 100 } },
@@ -38,6 +38,7 @@ var CAP_INPUT_DEFAULTS = Object.freeze({
 		"page": 1,
 		"pageSize": 50
 	} },
+	"device-credentials": { "listDeviceCredentials": { "includeRevoked": false } },
 	"device-manager": { "adoptionListCandidates": {
 		"page": 1,
 		"pageSize": 50

package/dist/auth/device-certificate.d.ts

@@ -0,0 +1,372 @@
+/**
+ * Device certificates (D855) — the wire contract shared by the hub, the admin
+ * UI and the native viewer.
+ *
+ * A device (a phone) generates its OWN P-256 key pair in hardware (Secure
+ * Enclave / Android Keystore / a non-extractable WebCrypto key). The private
+ * key never travels. The hub signs the PUBLIC key into an X.509 leaf under a
+ * dedicated device CA; the device later proves possession of the key by
+ * signing a hub-issued nonce, and the hub answers with the same session a
+ * password login opens.
+ *
+ * Everything on the wire is a small string (a PEM, a base64url signature):
+ * D613 is about bulk bytes, and a certificate is ~600 bytes.
+ */
+import { z } from 'zod';
+/** Signature algorithm of every device credential: ECDSA, curve P-256, SHA-256. */
+export declare const DEVICE_CERT_SIGNATURE: 'ecdsa-p256-sha256';
+/** First line of every signed message; a change of format bumps the version. */
+export declare const DEVICE_SIGNATURE_MESSAGE_VERSION: 'camstack-device-cert-v1';
+/** What a signature is for. A login signature can never be replayed as a renewal. */
+export declare const DeviceSignaturePurposeSchema: z.ZodEnum<{
+    login: "login";
+    renew: "renew";
+    revoke: "revoke";
+}>;
+export type DeviceSignaturePurpose = z.infer<typeof DeviceSignaturePurposeSchema>;
+/** Leaf lifetime and the window in which the app renews it. */
+export declare const DEVICE_CERT_VALIDITY_DAYS = 365;
+export declare const DEVICE_CERT_RENEW_WINDOW_DAYS = 30;
+/** One-shot enrollment code and login nonce lifetimes. */
+export declare const DEVICE_ENROLLMENT_TTL_MS: number;
+export declare const DEVICE_NONCE_TTL_MS = 60000;
+/** SAN URI prefixes of a device leaf. */
+export declare const DEVICE_SAN_CREDENTIAL_PREFIX: 'camstack:credential:';
+export declare const DEVICE_SAN_USER_PREFIX: 'camstack:user:';
+/**
+ * The exact bytes a device signs (UTF-8, `\n` separators, no trailing newline):
+ *
+ *   camstack-device-cert-v1
+ *   <login|renew>
+ *   <origin>            the hub origin returned by `getDeviceChallenge`
+ *   <nonce>
+ *
+ * The origin is part of the message so a signature collected by a look-alike
+ * hub is worthless on the real one; the hub additionally binds the nonce to
+ * the origin it issued it for and refuses any other.
+ */
+export declare function buildDeviceSignatureMessage(input: {
+    readonly purpose: DeviceSignaturePurpose;
+    readonly origin: string;
+    readonly nonce: string;
+}): string;
+/** The deep link a QR carries: `camstack://enroll?hub=<origin>&code=<code>`. */
+export declare function buildDeviceEnrollmentLink(input: {
+    readonly hub?: string;
+    readonly code: string;
+    readonly scheme?: string;
+}): string;
+/** Parse an enrollment deep link; `null` when it is not one. `hub` is absent when the link names none. */
+export declare function parseDeviceEnrollmentLink(raw: string): {
+    readonly hub: string | null;
+    readonly code: string;
+} | null;
+export declare const DevicePlatformSchema: z.ZodEnum<{
+    android: "android";
+    ios: "ios";
+    other: "other";
+    web: "web";
+}>;
+export type DevicePlatform = z.infer<typeof DevicePlatformSchema>;
+/**
+ * Why a device-certificate endpoint said no. Distinct from a transport / 5xx
+ * failure: those carry no reason and mean "try again", never "the credential is
+ * dead". The viewer switches on this exhaustively.
+ */
+export declare const DeviceRefusalReasonSchema: z.ZodEnum<{
+    "bad-public-key": "bad-public-key";
+    "bad-signature": "bad-signature";
+    "code-invalid": "code-invalid";
+    expired: "expired";
+    "invalid-certificate": "invalid-certificate";
+    "nonce-invalid": "nonce-invalid";
+    "rate-limited": "rate-limited";
+    revoked: "revoked";
+    "self-enrollment-disabled": "self-enrollment-disabled";
+    "step-up-required": "step-up-required";
+    superseded: "superseded";
+    unavailable: "unavailable";
+    "unknown-credential": "unknown-credential";
+    "user-gone": "user-gone";
+}>;
+export type DeviceRefusalReason = z.infer<typeof DeviceRefusalReasonSchema>;
+/** The only answers after which the app may count towards deleting its credential. */
+export declare const DEFINITIVE_DEVICE_REFUSALS: readonly DeviceRefusalReason[];
+/** Consecutive DEFINITIVE answers before the app deletes its key and certificate. */
+export declare const DEVICE_DEFINITIVE_REFUSALS_BEFORE_DELETE = 3;
+export declare function isDefinitiveDeviceRefusal(reason: DeviceRefusalReason): boolean;
+export declare const DeviceRefusalSchema: z.ZodObject<{
+    ok: z.ZodLiteral<false>;
+    reason: z.ZodEnum<{
+        "bad-public-key": "bad-public-key";
+        "bad-signature": "bad-signature";
+        "code-invalid": "code-invalid";
+        expired: "expired";
+        "invalid-certificate": "invalid-certificate";
+        "nonce-invalid": "nonce-invalid";
+        "rate-limited": "rate-limited";
+        revoked: "revoked";
+        "self-enrollment-disabled": "self-enrollment-disabled";
+        "step-up-required": "step-up-required";
+        superseded: "superseded";
+        unavailable: "unavailable";
+        "unknown-credential": "unknown-credential";
+        "user-gone": "user-gone";
+    }>;
+    definitive: z.ZodBoolean;
+    retryAfterSeconds: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>;
+export type DeviceRefusal = z.infer<typeof DeviceRefusalSchema>;
+/**
+ * A credential-bound session that can no longer refresh answers
+ * `auth.refreshSession` with UNAUTHORIZED whose message is this prefix + the
+ * reason; {@link deviceRefusalFromMessage} reads it back.
+ */
+export declare const DEVICE_REFRESH_REFUSAL_PREFIX: 'device-credential:';
+export declare function deviceRefusalFromMessage(message: string): DeviceRefusalReason | null;
+export declare const CompleteEnrollmentInputSchema: z.ZodObject<{
+    code: z.ZodString;
+    publicKeySpki: z.ZodString;
+    deviceName: z.ZodOptional<z.ZodString>;
+    platform: z.ZodEnum<{
+        android: "android";
+        ios: "ios";
+        other: "other";
+        web: "web";
+    }>;
+}, z.core.$strip>;
+export type CompleteEnrollmentInput = z.infer<typeof CompleteEnrollmentInputSchema>;
+export declare const CompleteEnrollmentOutputSchema: z.ZodObject<{
+    credentialId: z.ZodString;
+    certPem: z.ZodString;
+    chainPem: z.ZodString;
+    notAfter: z.ZodNumber;
+    user: z.ZodObject<{
+        id: z.ZodString;
+        username: z.ZodString;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type CompleteEnrollmentOutput = z.infer<typeof CompleteEnrollmentOutputSchema>;
+export declare const CompleteEnrollmentResultSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    credentialId: z.ZodString;
+    certPem: z.ZodString;
+    chainPem: z.ZodString;
+    notAfter: z.ZodNumber;
+    user: z.ZodObject<{
+        id: z.ZodString;
+        username: z.ZodString;
+    }, z.core.$strip>;
+    ok: z.ZodLiteral<true>;
+}, z.core.$strip>, z.ZodObject<{
+    ok: z.ZodLiteral<false>;
+    reason: z.ZodEnum<{
+        "bad-public-key": "bad-public-key";
+        "bad-signature": "bad-signature";
+        "code-invalid": "code-invalid";
+        expired: "expired";
+        "invalid-certificate": "invalid-certificate";
+        "nonce-invalid": "nonce-invalid";
+        "rate-limited": "rate-limited";
+        revoked: "revoked";
+        "self-enrollment-disabled": "self-enrollment-disabled";
+        "step-up-required": "step-up-required";
+        superseded: "superseded";
+        unavailable: "unavailable";
+        "unknown-credential": "unknown-credential";
+        "user-gone": "user-gone";
+    }>;
+    definitive: z.ZodBoolean;
+    retryAfterSeconds: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>], "ok">;
+export type CompleteEnrollmentResult = z.infer<typeof CompleteEnrollmentResultSchema>;
+export declare const EnrollSelfInputSchema: z.ZodObject<{
+    proof: z.ZodString;
+    publicKeySpki: z.ZodString;
+    deviceName: z.ZodString;
+    platform: z.ZodEnum<{
+        android: "android";
+        ios: "ios";
+        other: "other";
+        web: "web";
+    }>;
+}, z.core.$strip>;
+export type EnrollSelfInput = z.infer<typeof EnrollSelfInputSchema>;
+export declare const DeviceEnrollProofSchema: z.ZodObject<{
+    proof: z.ZodString;
+    expiresAt: z.ZodNumber;
+}, z.core.$strip>;
+export declare const DeviceChallengeSchema: z.ZodObject<{
+    nonce: z.ZodString;
+    origin: z.ZodString;
+    expiresAt: z.ZodNumber;
+    signature: z.ZodLiteral<"ecdsa-p256-sha256">;
+}, z.core.$strip>;
+export type DeviceChallenge = z.infer<typeof DeviceChallengeSchema>;
+export declare const DeviceChallengeResultSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    nonce: z.ZodString;
+    origin: z.ZodString;
+    expiresAt: z.ZodNumber;
+    signature: z.ZodLiteral<"ecdsa-p256-sha256">;
+    ok: z.ZodLiteral<true>;
+}, z.core.$strip>, z.ZodObject<{
+    ok: z.ZodLiteral<false>;
+    reason: z.ZodEnum<{
+        "bad-public-key": "bad-public-key";
+        "bad-signature": "bad-signature";
+        "code-invalid": "code-invalid";
+        expired: "expired";
+        "invalid-certificate": "invalid-certificate";
+        "nonce-invalid": "nonce-invalid";
+        "rate-limited": "rate-limited";
+        revoked: "revoked";
+        "self-enrollment-disabled": "self-enrollment-disabled";
+        "step-up-required": "step-up-required";
+        superseded: "superseded";
+        unavailable: "unavailable";
+        "unknown-credential": "unknown-credential";
+        "user-gone": "user-gone";
+    }>;
+    definitive: z.ZodBoolean;
+    retryAfterSeconds: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>], "ok">;
+export type DeviceChallengeResult = z.infer<typeof DeviceChallengeResultSchema>;
+export declare const DeviceProofInputSchema: z.ZodObject<{
+    certPem: z.ZodString;
+    nonce: z.ZodString;
+    signature: z.ZodString;
+}, z.core.$strip>;
+export type DeviceProofInput = z.infer<typeof DeviceProofInputSchema>;
+export declare const RenewDeviceCertificateOutputSchema: z.ZodObject<{
+    credentialId: z.ZodString;
+    certPem: z.ZodString;
+    chainPem: z.ZodString;
+    notAfter: z.ZodNumber;
+}, z.core.$strip>;
+export type RenewDeviceCertificateOutput = z.infer<typeof RenewDeviceCertificateOutputSchema>;
+export declare const RenewDeviceCertificateResultSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    credentialId: z.ZodString;
+    certPem: z.ZodString;
+    chainPem: z.ZodString;
+    notAfter: z.ZodNumber;
+    ok: z.ZodLiteral<true>;
+}, z.core.$strip>, z.ZodObject<{
+    ok: z.ZodLiteral<false>;
+    reason: z.ZodEnum<{
+        "bad-public-key": "bad-public-key";
+        "bad-signature": "bad-signature";
+        "code-invalid": "code-invalid";
+        expired: "expired";
+        "invalid-certificate": "invalid-certificate";
+        "nonce-invalid": "nonce-invalid";
+        "rate-limited": "rate-limited";
+        revoked: "revoked";
+        "self-enrollment-disabled": "self-enrollment-disabled";
+        "step-up-required": "step-up-required";
+        superseded: "superseded";
+        unavailable: "unavailable";
+        "unknown-credential": "unknown-credential";
+        "user-gone": "user-gone";
+    }>;
+    definitive: z.ZodBoolean;
+    retryAfterSeconds: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>], "ok">;
+export type RenewDeviceCertificateResult = z.infer<typeof RenewDeviceCertificateResultSchema>;
+export declare const RevokeOwnDeviceCertificateResultSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    ok: z.ZodLiteral<true>;
+    credentialId: z.ZodString;
+    sessionsEnded: z.ZodNumber;
+}, z.core.$strip>, z.ZodObject<{
+    ok: z.ZodLiteral<false>;
+    reason: z.ZodEnum<{
+        "bad-public-key": "bad-public-key";
+        "bad-signature": "bad-signature";
+        "code-invalid": "code-invalid";
+        expired: "expired";
+        "invalid-certificate": "invalid-certificate";
+        "nonce-invalid": "nonce-invalid";
+        "rate-limited": "rate-limited";
+        revoked: "revoked";
+        "self-enrollment-disabled": "self-enrollment-disabled";
+        "step-up-required": "step-up-required";
+        superseded: "superseded";
+        unavailable: "unavailable";
+        "unknown-credential": "unknown-credential";
+        "user-gone": "user-gone";
+    }>;
+    definitive: z.ZodBoolean;
+    retryAfterSeconds: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>], "ok">;
+export type RevokeOwnDeviceCertificateResult = z.infer<typeof RevokeOwnDeviceCertificateResultSchema>;
+/** Who revoked a credential, as `revokedBy` records it: `admin:<userId>` | `user:<userId>` | `device`. */
+export type DeviceRevoker = {
+    readonly kind: 'admin';
+    readonly userId: string;
+} | {
+    readonly kind: 'user';
+    readonly userId: string;
+} | {
+    readonly kind: 'device';
+};
+export declare function formatDeviceRevoker(revoker: DeviceRevoker): string;
+export declare const DeviceCredentialStatusSchema: z.ZodEnum<{
+    active: "active";
+    expired: "expired";
+    revoked: "revoked";
+}>;
+export type DeviceCredentialStatus = z.infer<typeof DeviceCredentialStatusSchema>;
+export declare const DeviceCredentialSchema: z.ZodObject<{
+    id: z.ZodString;
+    userId: z.ZodString;
+    username: z.ZodNullable<z.ZodString>;
+    deviceName: z.ZodString;
+    platform: z.ZodEnum<{
+        android: "android";
+        ios: "ios";
+        other: "other";
+        web: "web";
+    }>;
+    enrolledVia: z.ZodEnum<{
+        qr: "qr";
+        self: "self";
+    }>;
+    fingerprint: z.ZodString;
+    issuedAt: z.ZodNumber;
+    expiresAt: z.ZodNumber;
+    lastUsedAt: z.ZodNullable<z.ZodNumber>;
+    lastUsedFrom: z.ZodNullable<z.ZodString>;
+    revokedAt: z.ZodNullable<z.ZodNumber>;
+    revokedBy: z.ZodNullable<z.ZodString>;
+    status: z.ZodEnum<{
+        active: "active";
+        expired: "expired";
+        revoked: "revoked";
+    }>;
+}, z.core.$strip>;
+export type DeviceCredential = z.infer<typeof DeviceCredentialSchema>;
+export declare const StartEnrollmentOutputSchema: z.ZodObject<{
+    code: z.ZodString;
+    expiresAt: z.ZodNumber;
+    enrollUrl: z.ZodString;
+    hubOrigin: z.ZodNullable<z.ZodString>;
+    hubOrigins: z.ZodArray<z.ZodString>;
+}, z.core.$strip>;
+export type StartEnrollmentOutput = z.infer<typeof StartEnrollmentOutputSchema>;
+/** The `device-certificate` arm of `auth.listLoginMethods`. */
+export declare const DeviceCertificateLoginMethodSchema: z.ZodObject<{
+    kind: z.ZodLiteral<"device-certificate">;
+    id: z.ZodLiteral<"device-certificate">;
+    label: z.ZodString;
+    stage: z.ZodLiteral<"primary">;
+    challengePath: z.ZodLiteral<"auth.getDeviceChallenge">;
+    revokePath: z.ZodLiteral<"auth.revokeOwnDeviceCertificate">;
+    enrollSelfPath: z.ZodLiteral<"auth.enrollSelf">;
+    loginPath: z.ZodLiteral<"auth.loginWithDeviceCertificate">;
+    renewPath: z.ZodLiteral<"auth.renewDeviceCertificate">;
+    signature: z.ZodLiteral<"ecdsa-p256-sha256">;
+    messageVersion: z.ZodLiteral<"camstack-device-cert-v1">;
+    clients: z.ZodArray<z.ZodEnum<{
+        native: "native";
+        web: "web";
+    }>>;
+}, z.core.$strip>;
+export type DeviceCertificateLoginMethod = z.infer<typeof DeviceCertificateLoginMethodSchema>;

package/dist/auth/request-origin.d.ts

@@ -0,0 +1,43 @@
+/**
+ * The hub address an OIDC sign-in STARTED at — so it returns there (D791).
+ *
+ * The browser must come back to the origin it left from: the session cookie,
+ * the admin UI's stored token and a popup's `window.opener` all belong to
+ * one origin. Before this the `redirect_uri` was the hub's single browser
+ * address (`hubBrowserOrigin`), so a sign-in started on the LAN address
+ * (`https://192.168.x.x:4443`) finished on the public tunnel.
+ *
+ * The origin is read from the `/start` request — `X-Forwarded-Host` /
+ * `Host`, `X-Forwarded-Proto` — and is NEVER trusted as such: a forged
+ * `Host` would otherwise choose where the IdP sends the authorization code.
+ * It is used only when it equals, exactly, an origin the hub advertises
+ * itself at (the Network page's addresses: detected, custom, the public
+ * endpoint, the app-connection set) or the origin of the operator's
+ * configured redirect override. Anything else falls back to the default
+ * browser address, exactly as before.
+ *
+ * The mount prefix (`X-Forwarded-Prefix`, the reverse-proxy relay) is kept on
+ * the path when well-formed — it can only move the callback within an
+ * allowlisted origin, where the hub serves or 404s it and a strict IdP
+ * refuses an unregistered one.
+ */
+import type { HubAddressBook } from '../capabilities/local-network.cap.js';
+/** A request's headers as the addon-routes bridge hands them (lower-cased names). */
+export type RequestHeaders = Readonly<Record<string, string | undefined>>;
+/** `scheme://host[:port]` normalised by WHATWG URL, or `null` if it is not an http(s) origin. */
+export declare function normalizeOrigin(value: string): string | null;
+/** The mount prefix the relay named (no trailing slash), or `''`. Invalid = absent. */
+export declare function requestMountPrefix(headers: RequestHeaders): string;
+/**
+ * The origins the request CLAIMS, most specific first: the proxy's
+ * `X-Forwarded-Host` over `Host`; the named `X-Forwarded-Proto`, or https
+ * then http when none is named (the hub terminates TLS itself on 4443).
+ */
+export declare function claimedRequestOrigins(headers: RequestHeaders): readonly string[];
+/** Every origin the hub advertises itself at, normalised. Never the app link, never loopback. */
+export declare function advertisedHubOrigins(book: HubAddressBook): ReadonlySet<string>;
+/**
+ * The origin to send the browser back to: the first claimed origin that is in
+ * `allowed`, or `null` (the caller then uses its default address).
+ */
+export declare function pickRequestOrigin(headers: RequestHeaders, allowed: ReadonlySet<string>): string | null;

package/dist/capabilities/air-quality-sensor.cap.d.ts

@@ -58,6 +58,38 @@ export declare const airQualitySensorCapability: {
      * `scripts/check-runtime-state-durability.ts`.
      */
     readonly durability: 'restored';
+    /**
+     * History (D850): recorded series.
+     */
+    readonly history: {
+        readonly fields: {
+            readonly co2Ppm: {
+                readonly kind: 'gauge';
+                readonly unit: 'ppm';
+                readonly deadband: 5;
+            };
+            readonly vocPpb: {
+                readonly kind: 'gauge';
+                readonly unit: 'ppb';
+                readonly deadband: 5;
+            };
+            readonly pm25: {
+                readonly kind: 'gauge';
+                readonly unit: 'ug/m3';
+                readonly deadband: 1;
+            };
+            readonly pm10: {
+                readonly kind: 'gauge';
+                readonly unit: 'ug/m3';
+                readonly deadband: 1;
+            };
+            readonly aqi: {
+                readonly kind: 'gauge';
+                readonly unit: 'count';
+                readonly deadband: 1;
+            };
+        };
+    };
     /** Clock fields: written, but excluded from the compare that decides
      *  whether persisting is worth a SQLite commit. */
     readonly volatileStateFields: readonly ["lastFetchedAt"];

package/dist/capabilities/alarm-panel.cap.d.ts

@@ -177,6 +177,10 @@ export declare const alarmPanelCapability: {
      * `scripts/check-runtime-state-durability.ts`.
      */
     readonly durability: 'restored';
+    /**
+     * History (D850): none — enum state; arm/disarm history belongs in the events ledger.
+     */
+    readonly history: 'none';
     /** Clock fields: written, but excluded from the compare that decides
      *  whether persisting is worth a SQLite commit. */
     readonly volatileStateFields: readonly ["lastChangedAt"];

package/dist/capabilities/ambient-light-sensor.cap.d.ts

@@ -41,6 +41,19 @@ export declare const ambientLightSensorCapability: {
      * `scripts/check-runtime-state-durability.ts`.
      */
     readonly durability: 'restored';
+    /**
+     * History (D850): recorded series. Wide range, so a RELATIVE deadband (10 %).
+     */
+    readonly history: {
+        readonly fields: {
+            readonly lux: {
+                readonly kind: 'gauge';
+                readonly unit: 'lx';
+                readonly deadbandPct: 10;
+                readonly minIntervalMs: 60000;
+            };
+        };
+    };
     /** Clock fields: written, but excluded from the compare that decides
      *  whether persisting is worth a SQLite commit. */
     readonly volatileStateFields: readonly ["lastFetchedAt"];

package/dist/capabilities/audio-metrics.cap.d.ts

@@ -175,6 +175,10 @@ export declare const audioMetricsCapability: {
      * `scripts/check-runtime-state-durability.ts`.
      */
     readonly durability: 'session';
+    /**
+     * History (D850): none — the level is the addon series `pipeline-analytics/audio-level` (producer `record`); the other numbers move every inference window and duplicate it.
+     */
+    readonly history: 'none';
 };
 export type IAudioMetricsProvider = InferProvider<typeof audioMetricsCapability>;
 export { AudioMetricsSnapshotSchema, AudioClassSummarySchema, AudioMetricsHistoryPointSchema, AudioMetricsHistorySchema, };

package/dist/capabilities/automation-control.cap.d.ts

@@ -67,5 +67,9 @@ export declare const automationControlCapability: {
      * `scripts/check-runtime-state-durability.ts`.
      */
     readonly durability: 'session';
+    /**
+     * History (D850): none — configuration and transient run state.
+     */
+    readonly history: 'none';
 };
 export type IAutomationControlProvider = InferProvider<typeof automationControlCapability>;

package/dist/capabilities/battery.cap.d.ts

@@ -149,6 +149,17 @@ export declare const batteryCapability: {
      * `scripts/check-runtime-state-durability.ts`.
      */
     readonly durability: 'restored';
+    /**
+     * History (D850): recorded series. The generic capture replaces the `battery` series of `pipeline-analytics:stats-5m`.
+     */
+    readonly history: {
+        readonly fields: {
+            readonly percentage: {
+                readonly kind: 'gauge';
+                readonly unit: '%';
+            };
+        };
+    };
     /** Clock fields: written, but excluded from the compare that decides
      *  whether persisting is worth a SQLite commit. */
     readonly volatileStateFields: readonly ["lastUpdated"];

package/dist/capabilities/binary.cap.d.ts

@@ -42,6 +42,16 @@ export declare const binaryCapability: {
      * `scripts/check-runtime-state-durability.ts`.
      */
     readonly durability: 'restored';
+    /**
+     * History (D850): recorded series.
+     */
+    readonly history: {
+        readonly fields: {
+            readonly on: {
+                readonly kind: 'boolean';
+            };
+        };
+    };
     /** Clock fields: written, but excluded from the compare that decides
      *  whether persisting is worth a SQLite commit. */
     readonly volatileStateFields: readonly ["lastChangedAt"];

package/dist/capabilities/brightness.cap.d.ts

@@ -67,5 +67,17 @@ export declare const brightnessCapability: {
      * `scripts/check-runtime-state-durability.ts`.
      */
     readonly durability: 'session';
+    /**
+     * History (D850): recorded series. Actuator tier: level keeps every change.
+     */
+    readonly history: {
+        readonly fields: {
+            readonly percentage: {
+                readonly kind: 'gauge';
+                readonly unit: '%';
+                readonly minIntervalMs: 0;
+            };
+        };
+    };
 };
 export type IBrightnessProvider = InferProvider<typeof brightnessCapability>;

package/dist/capabilities/camera-streams.cap.d.ts

@@ -403,5 +403,9 @@ export declare const cameraStreamsCapability: {
      * `scripts/check-runtime-state-durability.ts`.
      */
     readonly durability: 'session';
+    /**
+     * History (D850): none — `online` duplicates device-status.online (one authority); slot data is nested enum/string.
+     */
+    readonly history: 'none';
 };
 export type ICameraStreamsProvider = InferProvider<typeof cameraStreamsCapability>;