@camstack/types 1.2.368 → 1.2.370

package/dist/index.js

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_sleep = require("./sleep-CXlc9YJ5.js");
+const require_sleep = require("./sleep-DnQ5WsMI.js");
 const require_event_category = require("./event-category-T43rdQWR.js");
 const require_composition = require("./composition-DCYnv4I6.js");
 const require_node_color = require("./node-color.js");
@@ -6640,6 +6640,103 @@ function hasUrlScheme(url) {
 	return /^[a-z][a-z0-9+.-]*:/i.test(url);
 }
 //#endregion
+//#region src/auth/app-flow.ts
+/**
+* The native-app browser sign-in flows the hub serves itself (D858).
+*
+* The viewer app opens the system browser at a hub START route (OIDC
+* `/addon/auth-oidc/<id>/start`, the passkey page `/auth/app/passkey`) and gets
+* a one-shot handoff code back at its custom scheme. These helpers are the one
+* reading of the request every leg shares - the OIDC addon, the finish leg and
+* the passkey page - so a rule tightened for one is tightened for all:
+*
+*  - PKCE is mandatory and S256 only (`code_challenge` = base64url of a SHA-256);
+*  - `state` is echoed back exactly;
+*  - the return URL is one of {@link APP_AUTH_CALLBACK_URLS}, never a free URL;
+*  - the purpose is `new-session` or `step-up` (the legacy `renew` has no browser flow).
+*
+* Pure and dependency-free (zod only) so an addon, the backend and a spec read
+* the same code.
+*/
+/** What the app redeems the code for. `step-up` yields a proof, never a session. */
+var AppFlowPurposeSchema = zod.z.enum(["new-session", "step-up"]);
+/** Where the app is sent when the request names no `redirect`. */
+var APP_FLOW_DEFAULT_REDIRECT = "camstack://auth-callback";
+/**
+* A browser OIDC flow started for an app carries this prefix on the IdP
+* `state` it generates, so a callback whose pending state is gone (expired,
+* replayed) can still be answered at the app and not on a hub error page. The
+* destination of that answer is the fixed default callback - the prefix
+* selects nothing the requester controls.
+*/
+var APP_FLOW_STATE_PREFIX = "a.";
+/** S256 challenge: base64url of 32 bytes = 43 characters, no padding. */
+var CHALLENGE_PATTERN = /^[A-Za-z0-9_-]{43}$/;
+/** The app's own `state`: URL-safe characters only, bounded. */
+var STATE_PATTERN = /^[A-Za-z0-9._~-]{1,256}$/;
+/** Operator-facing words for a refusal (the "clear page", D858). */
+var APP_FLOW_REFUSAL_MESSAGES = {
+	"bad-challenge": "The sign-in request has no valid PKCE challenge (S256).",
+	"bad-challenge-method": "Only the S256 PKCE method is supported.",
+	"bad-state": "The sign-in request has no valid state.",
+	"bad-purpose": "The sign-in request names an unknown purpose.",
+	"bad-redirect": "The sign-in request names a return address this hub does not accept."
+};
+/**
+* Read the app parameters off a start query: `code_challenge`,
+* `code_challenge_method`, `state`, `purpose`, `redirect`. Anything missing or
+* malformed is refused - there is no lenient default for PKCE or state.
+*/
+function parseAppFlowRequest(query) {
+	const challenge = query["code_challenge"];
+	if (challenge === void 0 || !CHALLENGE_PATTERN.test(challenge)) return {
+		ok: false,
+		reason: "bad-challenge"
+	};
+	if (query["code_challenge_method"] !== "S256") return {
+		ok: false,
+		reason: "bad-challenge-method"
+	};
+	const state = query["state"];
+	if (state === void 0 || !STATE_PATTERN.test(state)) return {
+		ok: false,
+		reason: "bad-state"
+	};
+	const purpose = AppFlowPurposeSchema.safeParse(query["purpose"]);
+	if (!purpose.success) return {
+		ok: false,
+		reason: "bad-purpose"
+	};
+	const redirectParam = query["redirect"];
+	const redirect = redirectParam === void 0 ? APP_FLOW_DEFAULT_REDIRECT : parseAppAuthCallback(redirectParam);
+	if (redirect === null) return {
+		ok: false,
+		reason: "bad-redirect"
+	};
+	return {
+		ok: true,
+		request: {
+			codeChallenge: challenge,
+			state,
+			purpose: purpose.data,
+			redirect
+		}
+	};
+}
+/** The app's callback with `code` (success) or `error` (refusal), and the echoed `state` when known. */
+function appFlowLocation(redirect, result, state) {
+	const params = new URLSearchParams();
+	if ("code" in result) params.set("code", result.code);
+	else params.set("error", result.error);
+	if (state !== void 0) params.set("state", state);
+	return `${redirect}?${params.toString()}`;
+}
+/** How a native app starts one login method (D858), as `auth.listLoginMethods` reports it. */
+var AppLoginPathSchema = zod.z.discriminatedUnion("kind", [zod.z.object({ kind: zod.z.literal("native") }), zod.z.object({
+	kind: zod.z.literal("browser"),
+	startPath: zod.z.string().startsWith("/")
+})]);
+//#endregion
 //#region src/auth/sso-state.ts
 /**
 * The cookie that binds an SSO sign-in to the browser that started it.
@@ -6902,7 +6999,9 @@ var DeviceCertificateLoginMethodSchema = zod.z.object({
 	signature: zod.z.literal(DEVICE_CERT_SIGNATURE),
 	messageVersion: zod.z.literal(DEVICE_SIGNATURE_MESSAGE_VERSION),
 	/** Which clients can execute it: a native app silently, a browser with a non-extractable WebCrypto key. */
-	clients: zod.z.array(zod.z.enum(["native", "web"]))
+	clients: zod.z.array(zod.z.enum(["native", "web"])),
+	/** The app executes it itself, silently (D858). */
+	app: AppLoginPathSchema.nullable()
 });
 //#endregion
 //#region src/auth/request-origin.ts
@@ -14314,6 +14413,16 @@ var nodeCertificatesCapability = {
 			kind: "mutation",
 			auth: "admin"
 		}),
+		/**
+		* The hub unpairs this node (D857): it erases its mesh material, goes back to the
+		* unpaired state and advertises itself again. The call is answered first; the wire
+		* goes down right after, so the hub revokes the node's certificates BEFORE this
+		* connection drops, never after.
+		*/
+		forgetHub: require_sleep.method(zod.z.object({}), zod.z.object({ ok: zod.z.literal(true) }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		/** Install the hub-signed HTTPS leaf and hot-swap the serving context (no restart). */
 		installHttpsCertificate: require_sleep.method(zod.z.object({
 			certPem: zod.z.string().min(1),
@@ -38410,6 +38519,23 @@ var HUB_MDNS_TXT_KEYS = {
 	url: "url"
 };
 var HUB_MDNS_ROLE = "hub";
+/**
+* How a hub finds agents to pair (D857): every agent publishes ONE mDNS service for its API
+* port, paired or not. The TXT record carries only public facts. Finding an agent grants
+* nothing: pairing still needs the six-digit code confirmed on both screens.
+*/
+var AGENT_MDNS_SERVICE_TYPE = "camstack-agent";
+/** The fully-qualified name a hub browses for. */
+var AGENT_MDNS_QUERY_NAME = "_camstack-agent._tcp.local";
+/** The TXT keys of the agent advertisement. Every value is public. */
+var AGENT_MDNS_TXT_KEYS = {
+	nodeId: "nodeId",
+	version: "version",
+	/** `unpaired` | `pending` | `paired`. */
+	state: "state",
+	/** First 16 hex chars of the SHA-256 of the agent's mesh leaf; present once paired. */
+	keyFingerprint: "fp"
+};
 //#endregion
 //#region src/capabilities/ai-cap-timeouts.ts
 /**
@@ -39497,7 +39623,13 @@ var RedirectLoginMethodSchema = zod.z.object({
 	* `beginExternalLink` offer exactly the redirect methods that set this,
 	* whatever their id. Absent / false — a login button only.
 	*/
-	linkable: zod.z.boolean().optional()
+	linkable: zod.z.boolean().optional(),
+	/**
+	* How a NATIVE app starts this method (D858): `{ kind: 'browser', startPath }`
+	* when the route understands the app flow query (`app=1&code_challenge=…`),
+	* `null`/absent when there is no app path - the app hides the method.
+	*/
+	app: AppLoginPathSchema.nullable().optional()
 });
 /**
 * A Module-Federation widget the login page mounts for an in-page
@@ -39516,7 +39648,9 @@ var WidgetLoginMethodSchema = zod.z.object({
 	bundle: zod.z.string(),
 	/** MF remote descriptor — `{ remoteName, exposedModule, componentKey }`. */
 	remote: WidgetRemoteSchema,
-	stage: LoginStageEnum
+	stage: LoginStageEnum,
+	/** Widgets are web ceremonies: no native app path (D858). Absent reads as `null`. */
+	app: AppLoginPathSchema.nullable().optional()
 });
 /**
 * A declarative WebAuthn ceremony the shell renders natively (no remote
@@ -39534,7 +39668,9 @@ var PasskeyLoginMethodSchema = zod.z.object({
 	/** Effective WebAuthn RP ID (`resolveRpID()`) — the shell gates visibility on it. */
 	rpId: zod.z.string(),
 	/** Effective expected origin (`resolveOrigin()`), null when unconfigured. */
-	origin: zod.z.string().nullable()
+	origin: zod.z.string().nullable(),
+	/** Set by the hub for the primary arm; a second-factor passkey has no app path (D858). */
+	app: AppLoginPathSchema.nullable().optional()
 });
 /** One login-method contribution — redirect button, pre-auth widget, or native passkey ceremony. */
 var LoginMethodContributionSchema = zod.z.discriminatedUnion("kind", [
@@ -54188,7 +54324,20 @@ var SsoBridgeClaimsSchema = zod.z.object({
 	* request to present the matching cookie — a login bridge is useless in
 	* any other browser.
 	*/
-	browserBinding: zod.z.string().optional()
+	browserBinding: zod.z.string().optional(),
+	/**
+	* The native app that started this sign-in (D858): its PKCE challenge,
+	* `state`, purpose and allow-listed return URL, copied from the server-side
+	* pending OIDC state. A bridge carrying it is finished ONLY at
+	* `/api/auth/sso/finish-app` (which mints a handoff code, never a web
+	* session); `/api/auth/sso/finish` refuses it.
+	*/
+	app: zod.z.object({
+		codeChallenge: zod.z.string(),
+		state: zod.z.string(),
+		purpose: zod.z.enum(["new-session", "step-up"]),
+		redirect: zod.z.string()
+	}).optional()
 });
 var ssoBridgeCapability = {
 	name: "sso-bridge",
@@ -79826,6 +79975,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"nodeCertificates.forgetHub": {
+		capName: "node-certificates",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
 	"nodeCertificates.getCertificates": {
 		capName: "node-certificates",
 		capScope: "system",
@@ -100355,6 +100510,9 @@ function enumerateInferenceDevices(hw) {
 //#endregion
 exports.ACCESSORY_LABEL = ACCESSORY_LABEL;
 exports.ACCESS_ROLES = ACCESS_ROLES;
+exports.AGENT_MDNS_QUERY_NAME = AGENT_MDNS_QUERY_NAME;
+exports.AGENT_MDNS_SERVICE_TYPE = AGENT_MDNS_SERVICE_TYPE;
+exports.AGENT_MDNS_TXT_KEYS = AGENT_MDNS_TXT_KEYS;
 exports.ALEXA_EGRESS_PROFILE = ALEXA_EGRESS_PROFILE;
 exports.ALL_CAPABILITY_DEFINITIONS = ALL_CAPABILITY_DEFINITIONS;
 exports.APPEARANCE_BIN_COUNT = APPEARANCE_BIN_COUNT;
@@ -100364,6 +100522,9 @@ exports.APPEARANCE_RESOLVES_AMBIGUITY_DEFAULT = APPEARANCE_RESOLVES_AMBIGUITY_DE
 exports.APPLE_SA_TO_MACRO = APPLE_SA_TO_MACRO;
 exports.APP_AUTH_CALLBACK_MAX_LENGTH = APP_AUTH_CALLBACK_MAX_LENGTH;
 exports.APP_AUTH_CALLBACK_URLS = APP_AUTH_CALLBACK_URLS;
+exports.APP_FLOW_DEFAULT_REDIRECT = APP_FLOW_DEFAULT_REDIRECT;
+exports.APP_FLOW_REFUSAL_MESSAGES = APP_FLOW_REFUSAL_MESSAGES;
+exports.APP_FLOW_STATE_PREFIX = APP_FLOW_STATE_PREFIX;
 exports.ARCHIVED_DEBUG_NOTES_DEFAULT_LIMIT = ARCHIVED_DEBUG_NOTES_DEFAULT_LIMIT;
 exports.AUDIO_ANALYSIS_CAP_NAME = AUDIO_ANALYSIS_CAP_NAME;
 exports.AUDIO_BACKEND_CHOICES = AUDIO_BACKEND_CHOICES;
@@ -100411,6 +100572,8 @@ exports.AmbientLightSensorStatusSchema = AmbientLightSensorStatusSchema;
 exports.AnalyticsLtsSeriesSchema = AnalyticsLtsSeriesSchema;
 exports.ApiKeyRecordSchema = ApiKeyRecordSchema;
 exports.ApiKeySummarySchema = ApiKeySummarySchema;
+exports.AppFlowPurposeSchema = AppFlowPurposeSchema;
+exports.AppLoginPathSchema = AppLoginPathSchema;
 exports.AppleFmAvailabilitySchema = AppleFmAvailabilitySchema;
 exports.AppleFmUnavailableReasonSchema = AppleFmUnavailableReasonSchema;
 exports.ArchiveEntrySchema = ArchiveEntrySchema;
@@ -102143,6 +102306,7 @@ exports.alertsCapability = alertsCapability;
 exports.allDoActions = allDoActions;
 exports.allowedSuppliedEffect = allowedSuppliedEffect;
 exports.ambientLightSensorCapability = ambientLightSensorCapability;
+exports.appFlowLocation = appFlowLocation;
 exports.applyBlockingEdit = applyBlockingEdit;
 exports.applyModeDelaysEdits = applyModeDelaysEdits;
 exports.applyModeDeviceListEdit = applyModeDeviceListEdit;
@@ -102643,6 +102807,7 @@ exports.overlayClusterStepSettings = overlayClusterStepSettings;
 exports.packagePickerItems = packagePickerItems;
 exports.parseAdminBase = parseAdminBase;
 exports.parseAppAuthCallback = parseAppAuthCallback;
+exports.parseAppFlowRequest = parseAppFlowRequest;
 exports.parseCameraStreamConfig = parseCameraStreamConfig;
 exports.parseDeviceEnrollmentLink = parseDeviceEnrollmentLink;
 exports.parseExpression = require_composition.parseExpression;