@mhome/app-facade-protocol 1.40.1 → 1.42.0

package/contract/pod-commissioning-v1.md

@@ -1,15 +1,18 @@
 # Pod commissioning v1
 
-A pod is a MeowLink end device that acts as an App client of one user. This
+A pod is a MeowLink end device that acts as a User Client or a Space Client. This
 contract is implementation-neutral: ESP-IDF on BLE-capable ESP32 chips is the
 first implementation, not a requirement. Commissioners are the native Clients:
 desktop/CLI Clientd, Android and iOS. The shared UI and CLI never talk BLE; they
 call the `/local/pod/*` targets of their native Client.
 
-Commissioning order is fixed: secure BLE session, Wi-Fi joined, user
-authorization, credential issue, delivery, activation. A credential is issued only
-after the pod reports a joined network. Failed setup releases the connection;
-pending cloud credentials expire, and a fresh successful claim cleans up old credentials.
+Network provisioning and activation are separate transactions. BLE provisions
+Wi-Fi; Ethernet and already-connected Wi-Fi skip it. Every initialization then
+uses a direct native Client ↔ Pod LAN security-2 session. No Core relay is used.
+The commissioner explicitly chooses `clientMode: "user" | "space"` during
+`/local/pod/commission/authorize`. User mode uses the personal Pod credential.
+Space mode uses a local Core credential signed by Lion; it carries no user
+identity and has no cloud access/refresh token. Changing mode requires reset.
 
 ## 1. Device identity
 
@@ -47,7 +50,7 @@ credential invalidation, or inside a re-provision window. A commissioned pod doe
 
 ## 3. Secure session
 
-Transport is ESP protocomm over BLE GATT. Endpoints are GATT characteristics
+Wi-Fi provisioning uses ESP protocomm over BLE GATT. Endpoints are GATT characteristics
 named by their Characteristic User Description descriptor (`0x2901`). A
 commissioner that cannot read descriptors falls back to fixed UUIDs: the service
 UUID with bytes 2–3 replaced by `prov-ctrl` `0xFF4F`, `prov-scan` `0xFF50`,
@@ -58,7 +61,7 @@ custom endpoints in table order from `0xFF54` (`pod-info` `0xFF54`,
 - Security: protocomm security 2 (SRP6a 3072-bit with SHA-512, then AES-256-GCM).
   Username `meow`. Password: a 6-digit decimal code.
 - Pods with a display generate a uniformly random code, precompute salt and
-  verifier at boot, and show the code only while a central is connected. A new
+  verifier at boot, and show it while connected over BLE or available for LAN initialization. A new
   code is generated after a successful commissioning, after 5 failed handshakes,
   or 10 minutes after it was first shown. Pods without a display are out of scope
   for v1.
@@ -70,8 +73,8 @@ custom endpoints in table order from `0xFF54` (`pod-info` `0xFF54`,
   `M` uses it as sent; `u` pads both to 384 bytes.
 - The record nonce is 8 random bytes followed by a 32-bit big-endian counter
   starting at 1, advanced after every encrypt and decrypt on both sides
-  (security 2 patch version 1; patch 0 keeps it fixed). Commissioners accept
-  patch versions 0 and 1 only. A lost or failed exchange leaves the two counters
+  (security 2 patch version 1; patch 0 keeps it fixed). Commissioners require
+  patch version 1; fixed-nonce patch 0 is rejected. A lost or failed exchange leaves the two counters
   unknown, so the commissioner abandons the secure session after any transport or
   decryption failure. A new `SessionCmd0` restarts the handshake on the same link.
 - While a device refuses handshakes after repeated wrong codes it clears the
@@ -81,8 +84,8 @@ custom endpoints in table order from `0xFF54` (`pod-info` `0xFF54`,
   such as Insufficient Authorization), so after every rejected handshake the
   commissioner reads `proto-ver` again and fails the session with `code_locked`
   when either field is present. A pod session also fails with `code_locked` after
-  the fifth rejected code. ESP pods restart with a new code after 5 failed
-  handshakes instead of reporting a lockout.
+  the fifth rejected code. Pods generate a fresh code after five rejected handshakes. Once network
+  configuration is saved, code rotation preserves that network.
 - One BLE connection at a time; a second central receives a disconnect.
 - Session deadline: 10 minutes from connect, or 2 minutes waiting for a
   handshake. On expiry the pod discards all unpersisted state.
@@ -95,15 +98,17 @@ custom endpoints in table order from `0xFF54` (`pod-info` `0xFF54`,
 | `prov-config` | yes | standard Wi-Fi set/apply/status |
 | `prov-ctrl` | yes | standard reset after a failed join, before a retry |
 | `pod-info` | yes | device information |
-| `pod-credential` | yes | credential delivery and activation status |
+| `pod-credential` | yes | LAN credential delivery/status/finish; BLE accepts only reprovision status/finish |
 
-Custom endpoint bodies are UTF-8 JSON, at most 480 bytes in each direction.
+Custom endpoint bodies are UTF-8 JSON, at most 480 bytes over BLE. LAN requests
+and responses are bounded to 64 KiB including encryption overhead.
 
 `pod-info` request `{}`, response:
 
 ```json
 {
   "protocol": 1,
+  "env": "prod",
   "deviceId": "a0b1c2d3e4f5",
   "model": "S1",
   "platform": "esp32c5",
@@ -114,6 +119,9 @@ Custom endpoint bodies are UTF-8 JSON, at most 480 bytes in each direction.
 }
 ```
 
+`env` must match the native Client runtime (`prod`, `dev`, `e2e`).
+`podId` is included when activation is in flight or durably completed, so a
+new session can observe completion without issuing another credential.
 `platform` is diagnostic only. `wifiConfigured` is true when the pod kept a
 working network across logout; the commissioner then skips the Wi-Fi steps after
 confirming connectivity with `prov-config` status. Inside a Wi-Fi change window
@@ -122,7 +130,7 @@ the response also carries `"mode":"reprovision"` and `wifiConfigured` is false
 
 `pod-credential` requests:
 
-- `{"op":"deliver","podId","refreshToken","scopeId","cloudApi","cloudWs"}` →
+- `{"op":"deliver","clientMode":"user","podId","refreshToken","scopeId","cloudApi","cloudWs"}` →
   `{"ok":true,"state":"activating"}`. Accepted only in `wifi_connected` outside a
   Wi-Fi change window; otherwise `{"ok":false,"state":<current pod state>,"reason"}`
   with `reason` `invalid_payload` (a missing or malformed field, including a
@@ -143,24 +151,55 @@ the response also carries `"mode":"reprovision"` and `wifiConfigured` is false
   best-effort: the commissioner records `completed` before sending it.
 
 Activation error codes: `time_sync_failed`, `cloud_unreachable`,
-`refresh_rejected`, `auth_rejected`, `storage_failed` (the final commit, or in a
+`local_hub_unavailable`, `refresh_rejected`, `auth_rejected`, `storage_failed` (the final commit, or in a
 Wi-Fi change window saving the new network, failed).
 
-The pod persists Wi-Fi, credential, endpoints and Space in one commit after a
-successful activation. Nothing from an abandoned attempt survives it; an
-implementation whose Wi-Fi driver caches the network on its own (ESP-IDF
-provisioning does) erases that cache when the attempt ends.
+The Pod commits Wi-Fi immediately after a successful join, before any credential
+issuance. Activation commits only identity/binding data. Failed activation,
+disconnection, code expiry and reboot preserve the successfully saved network.
+A failed join rolls back only the incomplete network change.
+
+### LAN discovery and channel
+
+- Service: `_meow-pod-init._tcp.local.` while network-ready and uninitialized.
+  TXT: full `deviceId`, `v=1`, `env`, optional `model`; SRV/A/AAAA locate the
+  endpoint. A failed or expired pairing attempt does not remove this service.
+- The same service works on Ethernet and Wi-Fi. BLE supplies the full device ID
+  and identity over its secure session; the short display ID is never the match
+  key. Discovery data is untrusted and is checked against encrypted `pod-info`.
+- HTTP POST `/{endpoint}` with `Content-Type: application/octet-stream` and a
+  fresh UUID `X-Meow-Session`. Allowed endpoints: `proto-ver`, `prov-session`,
+  `pod-info`, `pod-credential`. Wi-Fi endpoints are unavailable over LAN.
+  Clients connect to the resolved socket directly, with proxies/redirects off.
+- Run a fresh Security 2 patch-1 handshake on LAN. After BLE, reuse only the
+  temporarily held code, never the BLE session key or nonce. Ethernet setup
+  requests the code in the App UI. Business messages are AES-GCM protected.
+- Each IP session has separate crypto state. Devices cap simultaneous sessions
+  at four; pending handshakes expire after two minutes, sessions after ten.
+  An encrypted `pod-credential {"op":"close"}` releases that temporary session.
+- Stop init advertisement on durable completion. The existing session has a
+  short finish window for confirmation; normal business disconnection never
+  returns a completed device to initialization.
 
 ## 4. Pod state machine
 
 ```text
-unprovisioned ──connect──▶ session_open ──handshake──▶ secured
-secured ──prov-config apply──▶ wifi_joining ──▶ wifi_connected | wifi_failed
-wifi_failed ──retry──▶ wifi_joining
-wifi_connected ──deliver──▶ activating ──time sync, refresh, commit──▶ commissioned | failed
-any pre-commit state ──timeout/disconnect──▶ unprovisioned
+no network -> BLE secure -> join -> save Wi-Fi -> network ready
+Ethernet / saved Wi-Fi ------------------------> network ready
+network ready -> advertise init -> LAN secure -> authorize -> activate -> save identity
+join failure -> end attempt; start Wi-Fi setup again
+activation failure -> end attempt; keep network and init advertisement
+pairing expiry -> discard temporary sessions/code; keep network; accept a new code
 ```
 
+The App reports `discovering_lan` and `connecting_lan` during BLE handoff.
+Discovery snapshots distinguish `scanning` (BLE), `lanBrowsing`, optional
+`lanError`, and candidate `transport` (`ble` or `lan`). LAN candidates carry the
+full `deviceId`; Bluetooth denial never blocks them. The App retries initialization
+by selecting the LAN candidate, possibly re-entering the current code. It first
+reads actual device state: `commissioned` completes immediately, `activating`
+waits for the existing attempt, and a failed attempt may issue afresh.
+
 Runtime states after commit:
 
 - `commissioned`: normal operation.
@@ -316,7 +355,7 @@ and unexpired pending pods, each
 
 All targets are handled by the native Client and never forwarded. Payloads are
 domain input JSON. Clients without a usable Bluetooth adapter report
-`adapter.state` and reject commissioning with `bluetooth_unavailable`.
+`adapter.state` and reject BLE commissioning with `bluetooth_unavailable`; LAN candidates remain usable.
 
 A rejected request uses the facade error envelope
 `{"error","message","details":{"reason"}}`: `error` is `BAD_REQUEST` for an
@@ -394,9 +433,10 @@ example `storage_failed`) in `detail`. UIs show such a session as changing the
 pod's Wi-Fi rather than adding a pod.
 
 Session states, in order: `connecting`, `awaiting_code`, `securing`,
-`reading_info`, `awaiting_wifi`, `joining_wifi`, `awaiting_authorization`,
+`reading_info`, `awaiting_wifi`, `joining_wifi`, `discovering_lan`,
+`connecting_lan`, `awaiting_authorization`,
 `issuing`, `delivering`, `activating`, `completed`; terminal `failed`,
-`timed_out`. Wi-Fi states are skipped when the pod reports a
+`timed_out`. LAN candidates skip all Wi-Fi states. Wi-Fi states are also skipped when the pod reports a
 configured network and `prov-config` status reports it connected; while that
 status is `connecting` the commissioner keeps polling, and only after a failure
 does it reset Wi-Fi (`prov-ctrl`) and offer new credentials. The commissioner
@@ -407,10 +447,11 @@ scan runs waits for it. `revision` increases on every observable change.
 `delivering` on it is `activateBefore` plus 30 seconds.
 
 Only the device's durable `commissioned` response confirms successful setup.
-Lost BLE delivery confirmation or activation status fails the attempt, even
+Lost LAN delivery confirmation or activation status fails the attempt, even
 when Lion has already activated its credential. Expiry fails or times out the
 attempt. The commissioner does not recover interrupted setup through Lion's
-credential status. The user resets the device and starts a fresh attempt.
+credential status. The user selects the network-ready device again, establishes
+a fresh LAN session and reads its actual activation status.
 
 A refused `deliver` fails with `delivery_failed` carrying the pod's `reason`
 (`invalid_payload` or `wrong_state`) in `detail`. When the pod
@@ -423,14 +464,73 @@ app is in the background (Android foreground service of type
 
 Session error codes: `bluetooth_unavailable`, `device_busy`, `disconnected`,
 `code_rejected` (retry allowed), `code_locked`, `wifi_auth_failed`,
-`wifi_not_found`, `wifi_failed`, `issue_failed`, `delivery_failed`,
+`wifi_not_found`, `wifi_failed`, `lan_unavailable`, `device_mismatch`, `issue_failed`, `delivery_failed`,
 `activation_failed` (with the pod's activation code, or `not_activated`, in
 `detail`), `session_timeout`. `code_locked` is terminal: the device shows a new
 code once it accepts handshakes again. `failed` and `timed_out` always carry `error`. A rejected
-code returns to `awaiting_code` with `code_rejected`; a failed join returns to
-`awaiting_wifi` with the `wifi_*` code. No other state carries `error`. Terminal states release the link and radio
-without revoking credentials. Reset the Pod and start over after an uncertain
-activation outcome; unused pending cloud credentials expire automatically.
+code returns to `awaiting_code` with `code_rejected`; a failed Pod join ends in
+`failed` with the `wifi_*` code. No other state carries `error`. Terminal states release the link and radio
+without revoking credentials. Retry over LAN after an uncertain activation outcome; unused pending cloud credentials expire automatically.
 
 The schemas are `schema/pod-discovery.v1.schema.json` and
 `schema/pod-commission.v1.schema.json`.
+
+
+## 8. Space Client local credential
+
+`POST /api/v1/pod/space/credential/issue` uses the assisting App's user
+`Authorization` and `ScopeId`, with the same device identity request as personal
+issuance. Any current member may assist. The Space must be local and have one
+published Hub with business and Host TLS identities. Cloud Spaces must complete
+Hub setup first. The issuer creates a fresh `appClientId` (`a:<random id>`) and
+signs a local JWT using the existing Space signing key and local-client audience.
+
+Claims are `token_type: local_space_client_access`, `sub: <scopeId>`,
+`tenant_id`, `scope_id`, `hub_id`, `app_client_id`, `jti`, `iat`, `exp`, `is_test`.
+The expiry follows existing long-lived User local credentials. No `userId`,
+initializer identity, `podId` or `issuedScopeId` grants authority. User local
+credentials retain `local_client_access` and must not contain `app_client_id`.
+Personal Pod issuance no longer stores `issuedScopeId`.
+
+Lion sends `{jwtToken, clientSource:"pod"}` to the authenticated Hub Bridge
+`/hub/client/space/register`. Core verifies signature, audience, issuer, current
+Hub, environment, Space and canonical installation ID, and stores a pending
+credential. First authentication must occur within ten minutes of JWT issuance.
+The response is `{credentialId, status:"pending", activateBefore}`. Lion returns
+`{credentialId, appClientId, jwtToken, activateBefore, hubIdentity}` only after
+registration succeeds. The Hub identity includes its business P-256 key and
+Host TLS public key, bound to `tenantId`, `scopeId`, `hubId` and `hostId`.
+
+The secured LAN `pod-credential` delivery is:
+
+```json
+{"op":"deliver","clientMode":"space","credentialId":"…","appClientId":"a:…","jwtToken":"…","tenantId":"…","scopeId":"…","hubIdentity":{}}
+```
+
+The actual `hubIdentity` is the complete issuer response. User credential fields
+(`refreshToken`, cloud endpoints, `podId`) are rejected in this variant. Space
+credential fields are rejected in the User variant. LAN credential plaintext is
+bounded to 8192 bytes; BLE credential delivery remains disabled.
+
+The Pod discovers the matching runtime environment and Space's Hub, pins TLS,
+verifies the signed Hub proof, and authenticates with the local JWT and signed
+`appClientId`. Core atomically activates the pending credential after all binding
+checks. The Pod requires a Space principal for the same Space, installation and
+credential in the authenticated response, then durably saves the profile. Only
+then does LAN setup report completion. The LAN status field named `podId` is an
+enrollment correlation ID: for Space mode it carries `credentialId`, never the
+installation ID or acting principal.
+
+After activation, reconnects do not require Lion or renew a cloud session. The
+same Core verifies the JWT and local registration offline, with its cached Scope
+verification key. Failed activation preserves working Wi-Fi and leaves LAN
+commissioning available. Retry may require the pairing code again. Unused pending
+credentials cannot activate after the deadline. Factory reset deletes the local
+credential and identity key; no server-side revoke workflow is introduced.
+
+Core carries `AuthenticatedClient` through WS, dispatch, plugin admission,
+prepared actions, dialogs and presence. A Space Client can READ/WRITE its Space;
+MANAGE, personal resources and Host user administration are rejected. It joins
+the canonical Space-client conversation group, never an initializer's threads.
+The billing owner fallback is not an acting identity. Host management tokens are
+independent and are never issued by this flow.

package/fixtures/host-provision.completed.json

@@ -5,6 +5,7 @@
   "candidate": {
     "candidateId": "ble:5E6F7A8B",
     "kind": "host",
+    "transport": "ble",
     "name": "Kitchen Host",
     "shortId": "5E6F7A8B",
     "rssi": -61,

package/fixtures/pod-commission.awaiting-authorization.json

@@ -5,6 +5,7 @@
   "candidate": {
     "candidateId": "ble:1A2B3C4D",
     "kind": "pod",
+    "transport": "ble",
     "name": "MeowPod S1",
     "model": "S1",
     "shortId": "1A2B3C4D",
@@ -23,7 +24,13 @@
   "authorization": {
     "userId": "user-1",
     "userName": "Ada",
-    "scopes": [{ "scopeId": "scope-1", "name": "Home" }],
+    "scopes": [
+      {
+        "scopeId": "scope-1",
+        "name": "Home",
+        "local": true
+      }
+    ],
     "defaultScopeId": "scope-1"
   }
 }

package/fixtures/pod-commission.failed.json

@@ -5,6 +5,7 @@
   "candidate": {
     "candidateId": "ble:1A2B3C4D",
     "kind": "pod",
+    "transport": "ble",
     "name": "MeowPod S1",
     "model": "S1",
     "shortId": "1A2B3C4D",

package/fixtures/pod-commission.reprovision-completed.json

@@ -5,6 +5,7 @@
   "candidate": {
     "candidateId": "ble:1A2B3C4D",
     "kind": "pod",
+    "transport": "ble",
     "name": "MeowPod S1",
     "model": "S1",
     "shortId": "1A2B3C4D",

package/fixtures/pod-discovery.snapshot.json

@@ -1,11 +1,13 @@
 {
   "revision": 4,
+  "lanBrowsing": false,
   "scanning": true,
   "adapter": { "state": "ready" },
   "candidates": [
     {
       "candidateId": "ble:1A2B3C4D",
       "kind": "pod",
+      "transport": "ble",
       "name": "MeowPod S1",
       "model": "S1",
       "shortId": "1A2B3C4D",

package/manifest/app-facade.v1.json

@@ -1,6 +1,6 @@
 {
   "manifest": "mhome.app-facade.v1",
-  "contractVersion": "1.40.1",
+  "contractVersion": "1.42.0",
   "callSchema": "schema/facade-call.v1.schema.json",
   "routing": "manifest/routing.v1.json",
   "routingSchema": "schema/routing.v1.schema.json",

package/manifest/host-provision-targets.v1.json

@@ -1,6 +1,6 @@
 {
   "manifest": "mhome.host-provision.targets.v1",
-  "contractVersion": "1.40.1",
+  "contractVersion": "1.42.0",
   "contract": "contract/host-provisioning-v1.md",
   "localTargets": [
     "/local/host/provision/start",

package/manifest/hub-targets.v1.json

@@ -1,6 +1,6 @@
 {
   "manifest": "mhome.hub.targets.v1",
-  "contractVersion": "1.40.1",
+  "contractVersion": "1.42.0",
   "appTargets": [
     "/app/hub/get",
     "/app/hub/remove",

package/manifest/pod-targets.v1.json

@@ -1,6 +1,6 @@
 {
   "manifest": "mhome.pod.targets.v1",
-  "contractVersion": "1.40.1",
+  "contractVersion": "1.42.0",
   "contract": "contract/pod-commissioning-v1.md",
   "localTargets": [
     "/local/pod/discovery/start",
@@ -67,11 +67,13 @@
   "cloud": {
     "issue": "pod/credential/issue",
     "status": "pod/credential/status",
-    "statusSchema": "schema/pod-credential-status.v1.schema.json"
+    "statusSchema": "schema/pod-credential-status.v1.schema.json",
+    "spaceIssue": "pod/space/credential/issue"
   },
   "activationErrorCodes": [
     "time_sync_failed",
     "cloud_unreachable",
+    "local_hub_unavailable",
     "refresh_rejected",
     "auth_rejected",
     "storage_failed"
@@ -96,5 +98,12 @@
     "scope_not_offered",
     "cloud_unreachable_for_device",
     "busy"
+  ],
+  "lan": {
+    "credentialMaxBytes": 8192
+  },
+  "clientModes": [
+    "user",
+    "space"
   ]
 }

package/manifest/routing.v1.json

@@ -1,6 +1,6 @@
 {
   "manifest": "mhome.app-facade.routing.v1",
-  "contractVersion": "1.40.1",
+  "contractVersion": "1.42.0",
   "targetPrefix": "/app/",
   "default": {
     "execution": "scopeMode",

package/manifest/targets.v1.json

@@ -1,6 +1,6 @@
 {
   "manifest": "mhome.messaging.targets.v1",
-  "contractVersion": "1.40.1",
+  "contractVersion": "1.42.0",
   "requestTargets": [
     "/app/messaging/provider/list",
     "/app/messaging/provider-account/list",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mhome/app-facade-protocol",
-  "version": "1.40.1",
+  "version": "1.42.0",
   "description": "Build-time protocol artifacts for mhome.app-facade",
   "license": "MIT",
   "repository": {

package/protocol.json

@@ -1,6 +1,6 @@
 {
   "protocol": "mhome.app-facade",
-  "contractVersion": "1.40.1",
+  "contractVersion": "1.42.0",
   "manifest": "manifest/app-facade.v1.json",
   "schemas": {
     "capabilityDescriptor": "schema/capability-descriptor.v1.schema.json",

package/schema/person.v1.schema.json

@@ -204,7 +204,7 @@
           "type": "array",
           "items": {
             "type": "string",
-            "pattern": "^(person|cluster):.+$"
+            "pattern": "^h:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$"
           }
         }
       },

package/schema/pod-commission.v1.schema.json

@@ -16,6 +16,8 @@
         "reading_info",
         "awaiting_wifi",
         "joining_wifi",
+        "discovering_lan",
+        "connecting_lan",
         "awaiting_authorization",
         "issuing",
         "delivering",
@@ -64,10 +66,11 @@
           "items": {
             "type": "object",
             "additionalProperties": false,
-            "required": ["scopeId", "name"],
+            "required": ["scopeId", "name", "local"],
             "properties": {
               "scopeId": { "type": "string", "minLength": 1 },
-              "name": { "type": "string" }
+              "name": { "type": "string" },
+              "local": { "type": "boolean" }
             }
           }
         },
@@ -86,6 +89,8 @@
             "bluetooth_unavailable",
             "device_busy",
             "disconnected",
+            "lan_unavailable",
+            "device_mismatch",
             "code_rejected",
             "code_locked",
             "wifi_auth_failed",

package/schema/pod-discovery.v1.schema.json

@@ -1,13 +1,15 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://schemas.mhome.ai/app-facade/pod-discovery.v1.schema.json",
-  "title": "Native-client BLE discovery snapshot (pods and Hosts)",
+  "title": "Native-client BLE and LAN discovery snapshot (pods and Hosts)",
   "type": "object",
   "additionalProperties": false,
-  "required": ["revision", "scanning", "adapter", "candidates"],
+  "required": ["revision", "scanning", "lanBrowsing", "adapter", "candidates"],
   "properties": {
     "revision": { "type": "integer", "minimum": 0 },
     "scanning": { "type": "boolean" },
+    "lanBrowsing": { "type": "boolean" },
+    "lanError": { "type": "string" },
     "adapter": { "$ref": "#/$defs/adapter" },
     "candidates": { "type": "array", "items": { "$ref": "#/$defs/candidate" } }
   },
@@ -27,6 +29,7 @@
       "required": [
         "candidateId",
         "kind",
+        "transport",
         "name",
         "shortId",
         "rssi",
@@ -37,9 +40,11 @@
       "properties": {
         "candidateId": { "type": "string", "minLength": 1 },
         "kind": { "enum": ["pod", "host"] },
+        "transport": { "enum": ["ble", "lan"] },
+        "deviceId": { "type": "string", "minLength": 1, "maxLength": 64 },
         "name": { "type": "string", "minLength": 1 },
         "model": { "type": "string" },
-        "shortId": { "type": "string", "pattern": "^[0-9A-F]{8}$" },
+        "shortId": { "type": "string", "minLength": 1, "maxLength": 64 },
         "rssi": { "type": "integer" },
         "commissionable": { "type": "boolean" },
         "wifiConfigured": { "type": "boolean" },