@openmdm/core 0.2.0

package/dist/index.js

@@ -0,0 +1,1368 @@
+import { randomUUID, createHmac, timingSafeEqual } from 'crypto';
+
+// src/index.ts
+
+// src/types.ts
+var MDMError = class extends Error {
+  constructor(message, code, statusCode = 500, details) {
+    super(message);
+    this.code = code;
+    this.statusCode = statusCode;
+    this.details = details;
+    this.name = "MDMError";
+  }
+};
+var DeviceNotFoundError = class extends MDMError {
+  constructor(deviceId) {
+    super(`Device not found: ${deviceId}`, "DEVICE_NOT_FOUND", 404);
+  }
+};
+var PolicyNotFoundError = class extends MDMError {
+  constructor(policyId) {
+    super(`Policy not found: ${policyId}`, "POLICY_NOT_FOUND", 404);
+  }
+};
+var ApplicationNotFoundError = class extends MDMError {
+  constructor(identifier) {
+    super(`Application not found: ${identifier}`, "APPLICATION_NOT_FOUND", 404);
+  }
+};
+var EnrollmentError = class extends MDMError {
+  constructor(message, details) {
+    super(message, "ENROLLMENT_ERROR", 400, details);
+  }
+};
+var AuthenticationError = class extends MDMError {
+  constructor(message = "Authentication required") {
+    super(message, "AUTHENTICATION_ERROR", 401);
+  }
+};
+var AuthorizationError = class extends MDMError {
+  constructor(message = "Access denied") {
+    super(message, "AUTHORIZATION_ERROR", 403);
+  }
+};
+var ValidationError = class extends MDMError {
+  constructor(message, details) {
+    super(message, "VALIDATION_ERROR", 400, details);
+  }
+};
+var DEFAULT_RETRY_CONFIG = {
+  maxRetries: 3,
+  initialDelay: 1e3,
+  maxDelay: 3e4
+};
+function createWebhookManager(config) {
+  const endpoints = /* @__PURE__ */ new Map();
+  const retryConfig = { ...DEFAULT_RETRY_CONFIG, ...config.retry };
+  if (config.endpoints) {
+    for (const endpoint of config.endpoints) {
+      endpoints.set(endpoint.id, endpoint);
+    }
+  }
+  function signPayload(payload, secret) {
+    return createHmac("sha256", secret).update(payload).digest("hex");
+  }
+  function getBackoffDelay(retryCount) {
+    const delay = retryConfig.initialDelay * Math.pow(2, retryCount);
+    return Math.min(delay, retryConfig.maxDelay);
+  }
+  function shouldDeliverToEndpoint(endpoint, eventType) {
+    if (!endpoint.enabled) {
+      return false;
+    }
+    if (endpoint.events.includes("*")) {
+      return true;
+    }
+    return endpoint.events.includes(eventType);
+  }
+  async function deliverToEndpoint(endpoint, payload) {
+    const payloadString = JSON.stringify(payload);
+    let lastError;
+    let lastStatusCode;
+    for (let attempt = 0; attempt <= retryConfig.maxRetries; attempt++) {
+      try {
+        const headers = {
+          "Content-Type": "application/json",
+          "X-OpenMDM-Event": payload.event,
+          "X-OpenMDM-Delivery": payload.id,
+          "X-OpenMDM-Timestamp": payload.timestamp,
+          ...endpoint.headers
+        };
+        if (config.signingSecret) {
+          const signature = signPayload(payloadString, config.signingSecret);
+          headers["X-OpenMDM-Signature"] = `sha256=${signature}`;
+        }
+        const response = await fetch(endpoint.url, {
+          method: "POST",
+          headers,
+          body: payloadString,
+          signal: AbortSignal.timeout(3e4)
+          // 30 second timeout
+        });
+        lastStatusCode = response.status;
+        if (response.ok) {
+          return {
+            endpointId: endpoint.id,
+            success: true,
+            statusCode: response.status,
+            retryCount: attempt,
+            deliveredAt: /* @__PURE__ */ new Date()
+          };
+        }
+        if (response.status >= 400 && response.status < 500 && response.status !== 429) {
+          return {
+            endpointId: endpoint.id,
+            success: false,
+            statusCode: response.status,
+            error: `HTTP ${response.status}: ${response.statusText}`,
+            retryCount: attempt
+          };
+        }
+        lastError = `HTTP ${response.status}: ${response.statusText}`;
+      } catch (error) {
+        lastError = error instanceof Error ? error.message : String(error);
+      }
+      if (attempt < retryConfig.maxRetries) {
+        const delay = getBackoffDelay(attempt);
+        await new Promise((resolve) => setTimeout(resolve, delay));
+      }
+    }
+    return {
+      endpointId: endpoint.id,
+      success: false,
+      statusCode: lastStatusCode,
+      error: lastError || "Max retries exceeded",
+      retryCount: retryConfig.maxRetries
+    };
+  }
+  return {
+    async deliver(event) {
+      const matchingEndpoints = Array.from(endpoints.values()).filter(
+        (ep) => shouldDeliverToEndpoint(ep, event.type)
+      );
+      if (matchingEndpoints.length === 0) {
+        return [];
+      }
+      const payload = {
+        id: randomUUID(),
+        event: event.type,
+        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+        data: event.payload
+      };
+      const deliveryPromises = matchingEndpoints.map(
+        (endpoint) => deliverToEndpoint(endpoint, payload)
+      );
+      const results = await Promise.all(deliveryPromises);
+      for (const result of results) {
+        if (!result.success) {
+          console.error(
+            `[OpenMDM] Webhook delivery failed to endpoint ${result.endpointId}:`,
+            result.error
+          );
+        }
+      }
+      return results;
+    },
+    addEndpoint(endpoint) {
+      endpoints.set(endpoint.id, endpoint);
+    },
+    removeEndpoint(endpointId) {
+      endpoints.delete(endpointId);
+    },
+    updateEndpoint(endpointId, updates) {
+      const existing = endpoints.get(endpointId);
+      if (existing) {
+        endpoints.set(endpointId, { ...existing, ...updates });
+      }
+    },
+    getEndpoints() {
+      return Array.from(endpoints.values());
+    },
+    async testEndpoint(endpointId) {
+      const endpoint = endpoints.get(endpointId);
+      if (!endpoint) {
+        return {
+          endpointId,
+          success: false,
+          error: "Endpoint not found",
+          retryCount: 0
+        };
+      }
+      const testPayload = {
+        id: randomUUID(),
+        event: "device.heartbeat",
+        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+        data: {
+          test: true,
+          message: "OpenMDM webhook test"
+        }
+      };
+      return deliverToEndpoint(endpoint, testPayload);
+    }
+  };
+}
+function verifyWebhookSignature(payload, signature, secret) {
+  const expectedSignature = `sha256=${createHmac("sha256", secret).update(payload).digest("hex")}`;
+  if (signature.length !== expectedSignature.length) {
+    return false;
+  }
+  let result = 0;
+  for (let i = 0; i < signature.length; i++) {
+    result |= signature.charCodeAt(i) ^ expectedSignature.charCodeAt(i);
+  }
+  return result === 0;
+}
+
+// src/schema.ts
+var mdmSchema = {
+  tables: {
+    // ----------------------------------------
+    // Devices Table
+    // ----------------------------------------
+    mdm_devices: {
+      columns: {
+        id: { type: "string", primaryKey: true },
+        external_id: { type: "string", nullable: true },
+        enrollment_id: { type: "string", unique: true },
+        status: {
+          type: "enum",
+          enumValues: ["pending", "enrolled", "unenrolled", "blocked"],
+          default: "pending"
+        },
+        // Device Info
+        model: { type: "string", nullable: true },
+        manufacturer: { type: "string", nullable: true },
+        os_version: { type: "string", nullable: true },
+        serial_number: { type: "string", nullable: true },
+        imei: { type: "string", nullable: true },
+        mac_address: { type: "string", nullable: true },
+        android_id: { type: "string", nullable: true },
+        // MDM State
+        policy_id: {
+          type: "string",
+          nullable: true,
+          references: { table: "mdm_policies", column: "id", onDelete: "set null" }
+        },
+        last_heartbeat: { type: "datetime", nullable: true },
+        last_sync: { type: "datetime", nullable: true },
+        // Telemetry (denormalized for quick access)
+        battery_level: { type: "integer", nullable: true },
+        storage_used: { type: "bigint", nullable: true },
+        storage_total: { type: "bigint", nullable: true },
+        latitude: { type: "string", nullable: true },
+        // Stored as string for precision
+        longitude: { type: "string", nullable: true },
+        location_timestamp: { type: "datetime", nullable: true },
+        // JSON fields
+        installed_apps: { type: "json", nullable: true },
+        tags: { type: "json", nullable: true },
+        metadata: { type: "json", nullable: true },
+        // Timestamps
+        created_at: { type: "datetime", default: "now" },
+        updated_at: { type: "datetime", default: "now" }
+      },
+      indexes: [
+        { columns: ["enrollment_id"], unique: true },
+        { columns: ["status"] },
+        { columns: ["policy_id"] },
+        { columns: ["last_heartbeat"] },
+        { columns: ["mac_address"] },
+        { columns: ["serial_number"] }
+      ]
+    },
+    // ----------------------------------------
+    // Policies Table
+    // ----------------------------------------
+    mdm_policies: {
+      columns: {
+        id: { type: "string", primaryKey: true },
+        name: { type: "string" },
+        description: { type: "text", nullable: true },
+        is_default: { type: "boolean", default: false },
+        settings: { type: "json" },
+        created_at: { type: "datetime", default: "now" },
+        updated_at: { type: "datetime", default: "now" }
+      },
+      indexes: [
+        { columns: ["name"] },
+        { columns: ["is_default"] }
+      ]
+    },
+    // ----------------------------------------
+    // Applications Table
+    // ----------------------------------------
+    mdm_applications: {
+      columns: {
+        id: { type: "string", primaryKey: true },
+        name: { type: "string" },
+        package_name: { type: "string" },
+        version: { type: "string" },
+        version_code: { type: "integer" },
+        url: { type: "string" },
+        hash: { type: "string", nullable: true },
+        // SHA-256
+        size: { type: "bigint", nullable: true },
+        min_sdk_version: { type: "integer", nullable: true },
+        // Deployment settings
+        show_icon: { type: "boolean", default: true },
+        run_after_install: { type: "boolean", default: false },
+        run_at_boot: { type: "boolean", default: false },
+        is_system: { type: "boolean", default: false },
+        // State
+        is_active: { type: "boolean", default: true },
+        // Metadata
+        metadata: { type: "json", nullable: true },
+        created_at: { type: "datetime", default: "now" },
+        updated_at: { type: "datetime", default: "now" }
+      },
+      indexes: [
+        { columns: ["package_name"] },
+        { columns: ["package_name", "version"], unique: true },
+        { columns: ["is_active"] }
+      ]
+    },
+    // ----------------------------------------
+    // Commands Table
+    // ----------------------------------------
+    mdm_commands: {
+      columns: {
+        id: { type: "string", primaryKey: true },
+        device_id: {
+          type: "string",
+          references: { table: "mdm_devices", column: "id", onDelete: "cascade" }
+        },
+        type: { type: "string" },
+        payload: { type: "json", nullable: true },
+        status: {
+          type: "enum",
+          enumValues: ["pending", "sent", "acknowledged", "completed", "failed", "cancelled"],
+          default: "pending"
+        },
+        result: { type: "json", nullable: true },
+        error: { type: "text", nullable: true },
+        created_at: { type: "datetime", default: "now" },
+        sent_at: { type: "datetime", nullable: true },
+        acknowledged_at: { type: "datetime", nullable: true },
+        completed_at: { type: "datetime", nullable: true }
+      },
+      indexes: [
+        { columns: ["device_id"] },
+        { columns: ["status"] },
+        { columns: ["device_id", "status"] },
+        { columns: ["created_at"] }
+      ]
+    },
+    // ----------------------------------------
+    // Events Table
+    // ----------------------------------------
+    mdm_events: {
+      columns: {
+        id: { type: "string", primaryKey: true },
+        device_id: {
+          type: "string",
+          references: { table: "mdm_devices", column: "id", onDelete: "cascade" }
+        },
+        type: { type: "string" },
+        payload: { type: "json" },
+        created_at: { type: "datetime", default: "now" }
+      },
+      indexes: [
+        { columns: ["device_id"] },
+        { columns: ["type"] },
+        { columns: ["device_id", "type"] },
+        { columns: ["created_at"] }
+      ]
+    },
+    // ----------------------------------------
+    // Groups Table
+    // ----------------------------------------
+    mdm_groups: {
+      columns: {
+        id: { type: "string", primaryKey: true },
+        name: { type: "string" },
+        description: { type: "text", nullable: true },
+        policy_id: {
+          type: "string",
+          nullable: true,
+          references: { table: "mdm_policies", column: "id", onDelete: "set null" }
+        },
+        parent_id: {
+          type: "string",
+          nullable: true,
+          references: { table: "mdm_groups", column: "id", onDelete: "set null" }
+        },
+        metadata: { type: "json", nullable: true },
+        created_at: { type: "datetime", default: "now" },
+        updated_at: { type: "datetime", default: "now" }
+      },
+      indexes: [
+        { columns: ["name"] },
+        { columns: ["policy_id"] },
+        { columns: ["parent_id"] }
+      ]
+    },
+    // ----------------------------------------
+    // Device Groups (Many-to-Many)
+    // ----------------------------------------
+    mdm_device_groups: {
+      columns: {
+        device_id: {
+          type: "string",
+          references: { table: "mdm_devices", column: "id", onDelete: "cascade" }
+        },
+        group_id: {
+          type: "string",
+          references: { table: "mdm_groups", column: "id", onDelete: "cascade" }
+        },
+        created_at: { type: "datetime", default: "now" }
+      },
+      indexes: [
+        { columns: ["device_id", "group_id"], unique: true },
+        { columns: ["group_id"] }
+      ]
+    },
+    // ----------------------------------------
+    // Push Tokens (for FCM/MQTT registration)
+    // ----------------------------------------
+    mdm_push_tokens: {
+      columns: {
+        id: { type: "string", primaryKey: true },
+        device_id: {
+          type: "string",
+          references: { table: "mdm_devices", column: "id", onDelete: "cascade" }
+        },
+        provider: {
+          type: "enum",
+          enumValues: ["fcm", "mqtt", "websocket"]
+        },
+        token: { type: "string" },
+        is_active: { type: "boolean", default: true },
+        created_at: { type: "datetime", default: "now" },
+        updated_at: { type: "datetime", default: "now" }
+      },
+      indexes: [
+        { columns: ["device_id"] },
+        { columns: ["provider", "token"], unique: true },
+        { columns: ["is_active"] }
+      ]
+    },
+    // ----------------------------------------
+    // Application Deployments (Which apps go to which policies/groups)
+    // ----------------------------------------
+    mdm_app_deployments: {
+      columns: {
+        id: { type: "string", primaryKey: true },
+        application_id: {
+          type: "string",
+          references: { table: "mdm_applications", column: "id", onDelete: "cascade" }
+        },
+        // Target can be policy or group
+        target_type: {
+          type: "enum",
+          enumValues: ["policy", "group"]
+        },
+        target_id: { type: "string" },
+        action: {
+          type: "enum",
+          enumValues: ["install", "update", "uninstall"],
+          default: "install"
+        },
+        is_required: { type: "boolean", default: false },
+        created_at: { type: "datetime", default: "now" }
+      },
+      indexes: [
+        { columns: ["application_id"] },
+        { columns: ["target_type", "target_id"] }
+      ]
+    },
+    // ----------------------------------------
+    // App Versions (Version history for rollback support)
+    // ----------------------------------------
+    mdm_app_versions: {
+      columns: {
+        id: { type: "string", primaryKey: true },
+        application_id: {
+          type: "string",
+          references: { table: "mdm_applications", column: "id", onDelete: "cascade" }
+        },
+        package_name: { type: "string" },
+        version: { type: "string" },
+        version_code: { type: "integer" },
+        url: { type: "string" },
+        hash: { type: "string", nullable: true },
+        size: { type: "bigint", nullable: true },
+        release_notes: { type: "text", nullable: true },
+        is_minimum_version: { type: "boolean", default: false },
+        created_at: { type: "datetime", default: "now" }
+      },
+      indexes: [
+        { columns: ["application_id"] },
+        { columns: ["package_name"] },
+        { columns: ["package_name", "version_code"], unique: true },
+        { columns: ["is_minimum_version"] }
+      ]
+    },
+    // ----------------------------------------
+    // App Rollbacks (Rollback history and status)
+    // ----------------------------------------
+    mdm_rollbacks: {
+      columns: {
+        id: { type: "string", primaryKey: true },
+        device_id: {
+          type: "string",
+          references: { table: "mdm_devices", column: "id", onDelete: "cascade" }
+        },
+        package_name: { type: "string" },
+        from_version: { type: "string" },
+        from_version_code: { type: "integer" },
+        to_version: { type: "string" },
+        to_version_code: { type: "integer" },
+        reason: { type: "text", nullable: true },
+        status: {
+          type: "enum",
+          enumValues: ["pending", "in_progress", "completed", "failed"],
+          default: "pending"
+        },
+        error: { type: "text", nullable: true },
+        initiated_by: { type: "string", nullable: true },
+        created_at: { type: "datetime", default: "now" },
+        completed_at: { type: "datetime", nullable: true }
+      },
+      indexes: [
+        { columns: ["device_id"] },
+        { columns: ["package_name"] },
+        { columns: ["device_id", "package_name"] },
+        { columns: ["status"] },
+        { columns: ["created_at"] }
+      ]
+    },
+    // ----------------------------------------
+    // Webhook Endpoints (For outbound webhook configuration storage)
+    // ----------------------------------------
+    mdm_webhook_endpoints: {
+      columns: {
+        id: { type: "string", primaryKey: true },
+        url: { type: "string" },
+        events: { type: "json" },
+        // Array of event types or ['*']
+        headers: { type: "json", nullable: true },
+        enabled: { type: "boolean", default: true },
+        description: { type: "text", nullable: true },
+        created_at: { type: "datetime", default: "now" },
+        updated_at: { type: "datetime", default: "now" }
+      },
+      indexes: [
+        { columns: ["enabled"] }
+      ]
+    },
+    // ----------------------------------------
+    // Webhook Deliveries (Delivery history and status)
+    // ----------------------------------------
+    mdm_webhook_deliveries: {
+      columns: {
+        id: { type: "string", primaryKey: true },
+        endpoint_id: {
+          type: "string",
+          references: { table: "mdm_webhook_endpoints", column: "id", onDelete: "cascade" }
+        },
+        event_id: { type: "string" },
+        event_type: { type: "string" },
+        payload: { type: "json" },
+        status: {
+          type: "enum",
+          enumValues: ["pending", "success", "failed"],
+          default: "pending"
+        },
+        status_code: { type: "integer", nullable: true },
+        error: { type: "text", nullable: true },
+        retry_count: { type: "integer", default: 0 },
+        created_at: { type: "datetime", default: "now" },
+        delivered_at: { type: "datetime", nullable: true }
+      },
+      indexes: [
+        { columns: ["endpoint_id"] },
+        { columns: ["event_type"] },
+        { columns: ["status"] },
+        { columns: ["created_at"] }
+      ]
+    }
+  }
+};
+function getTableNames() {
+  return Object.keys(mdmSchema.tables);
+}
+function getColumnNames(tableName) {
+  const table = mdmSchema.tables[tableName];
+  if (!table) throw new Error(`Table ${tableName} not found in schema`);
+  return Object.keys(table.columns);
+}
+function getPrimaryKey(tableName) {
+  const table = mdmSchema.tables[tableName];
+  if (!table) throw new Error(`Table ${tableName} not found in schema`);
+  for (const [name, def] of Object.entries(table.columns)) {
+    if (def.primaryKey) return name;
+  }
+  return null;
+}
+function snakeToCamel(str) {
+  return str.replace(/_([a-z])/g, (_, letter) => letter.toUpperCase());
+}
+function camelToSnake(str) {
+  return str.replace(/[A-Z]/g, (letter) => `_${letter.toLowerCase()}`);
+}
+function transformToCamelCase(obj) {
+  const result = {};
+  for (const [key, value] of Object.entries(obj)) {
+    result[snakeToCamel(key)] = value;
+  }
+  return result;
+}
+function transformToSnakeCase(obj) {
+  const result = {};
+  for (const [key, value] of Object.entries(obj)) {
+    result[camelToSnake(key)] = value;
+  }
+  return result;
+}
+
+// src/index.ts
+function createMDM(config) {
+  const { database, push, enrollment, webhooks: webhooksConfig, plugins = [] } = config;
+  const eventHandlers = /* @__PURE__ */ new Map();
+  const pushAdapter = push ? createPushAdapter(push, database) : createStubPushAdapter();
+  const webhookManager = webhooksConfig ? createWebhookManager(webhooksConfig) : void 0;
+  const on = (event, handler) => {
+    if (!eventHandlers.has(event)) {
+      eventHandlers.set(event, /* @__PURE__ */ new Set());
+    }
+    const handlers = eventHandlers.get(event);
+    handlers.add(handler);
+    return () => {
+      handlers.delete(handler);
+    };
+  };
+  const emit = async (event, data) => {
+    const handlers = eventHandlers.get(event);
+    const eventRecord = {
+      id: randomUUID(),
+      deviceId: data.device?.id || data.deviceId || "",
+      type: event,
+      payload: data,
+      createdAt: /* @__PURE__ */ new Date()
+    };
+    try {
+      await database.createEvent({
+        deviceId: eventRecord.deviceId,
+        type: eventRecord.type,
+        payload: eventRecord.payload
+      });
+    } catch (error) {
+      console.error("[OpenMDM] Failed to persist event:", error);
+    }
+    if (webhookManager) {
+      webhookManager.deliver(eventRecord).catch((error) => {
+        console.error("[OpenMDM] Webhook delivery error:", error);
+      });
+    }
+    if (handlers) {
+      for (const handler of handlers) {
+        try {
+          await handler(eventRecord);
+        } catch (error) {
+          console.error(`[OpenMDM] Event handler error for ${event}:`, error);
+        }
+      }
+    }
+    if (config.onEvent) {
+      try {
+        await config.onEvent(eventRecord);
+      } catch (error) {
+        console.error("[OpenMDM] onEvent hook error:", error);
+      }
+    }
+  };
+  const devices = {
+    async get(id) {
+      return database.findDevice(id);
+    },
+    async getByEnrollmentId(enrollmentId) {
+      return database.findDeviceByEnrollmentId(enrollmentId);
+    },
+    async list(filter) {
+      return database.listDevices(filter);
+    },
+    async create(data) {
+      const device = await database.createDevice(data);
+      await emit("device.enrolled", { device });
+      if (config.onDeviceEnrolled) {
+        await config.onDeviceEnrolled(device);
+      }
+      return device;
+    },
+    async update(id, data) {
+      const oldDevice = await database.findDevice(id);
+      if (!oldDevice) {
+        throw new DeviceNotFoundError(id);
+      }
+      const device = await database.updateDevice(id, data);
+      if (data.status && data.status !== oldDevice.status) {
+        await emit("device.statusChanged", {
+          device,
+          oldStatus: oldDevice.status,
+          newStatus: data.status
+        });
+      }
+      if (data.policyId !== void 0 && data.policyId !== oldDevice.policyId) {
+        await emit("device.policyChanged", {
+          device,
+          oldPolicyId: oldDevice.policyId || void 0,
+          newPolicyId: data.policyId || void 0
+        });
+      }
+      return device;
+    },
+    async delete(id) {
+      const device = await database.findDevice(id);
+      if (device) {
+        await database.deleteDevice(id);
+        await emit("device.unenrolled", { device });
+        if (config.onDeviceUnenrolled) {
+          await config.onDeviceUnenrolled(device);
+        }
+      }
+    },
+    async assignPolicy(deviceId, policyId) {
+      const device = await this.update(deviceId, { policyId });
+      await pushAdapter.send(deviceId, {
+        type: "policy.updated",
+        payload: { policyId },
+        priority: "high"
+      });
+      return device;
+    },
+    async addToGroup(deviceId, groupId) {
+      await database.addDeviceToGroup(deviceId, groupId);
+    },
+    async removeFromGroup(deviceId, groupId) {
+      await database.removeDeviceFromGroup(deviceId, groupId);
+    },
+    async getGroups(deviceId) {
+      return database.getDeviceGroups(deviceId);
+    },
+    async sendCommand(deviceId, input) {
+      const command = await database.createCommand({
+        ...input,
+        deviceId
+      });
+      const pushResult = await pushAdapter.send(deviceId, {
+        type: `command.${input.type}`,
+        payload: {
+          commandId: command.id,
+          type: input.type,
+          ...input.payload
+        },
+        priority: "high"
+      });
+      if (pushResult.success) {
+        await database.updateCommand(command.id, {
+          status: "sent",
+          sentAt: /* @__PURE__ */ new Date()
+        });
+      }
+      if (config.onCommand) {
+        await config.onCommand(command);
+      }
+      return database.findCommand(command.id);
+    },
+    async sync(deviceId) {
+      return this.sendCommand(deviceId, { type: "sync" });
+    },
+    async reboot(deviceId) {
+      return this.sendCommand(deviceId, { type: "reboot" });
+    },
+    async lock(deviceId, message) {
+      return this.sendCommand(deviceId, {
+        type: "lock",
+        payload: message ? { message } : void 0
+      });
+    },
+    async wipe(deviceId, preserveData) {
+      return this.sendCommand(deviceId, {
+        type: preserveData ? "wipe" : "factoryReset",
+        payload: { preserveData }
+      });
+    }
+  };
+  const policies = {
+    async get(id) {
+      return database.findPolicy(id);
+    },
+    async getDefault() {
+      return database.findDefaultPolicy();
+    },
+    async list() {
+      return database.listPolicies();
+    },
+    async create(data) {
+      if (data.isDefault) {
+        const existingPolicies = await database.listPolicies();
+        for (const policy of existingPolicies) {
+          if (policy.isDefault) {
+            await database.updatePolicy(policy.id, { isDefault: false });
+          }
+        }
+      }
+      return database.createPolicy(data);
+    },
+    async update(id, data) {
+      if (data.isDefault) {
+        const existingPolicies = await database.listPolicies();
+        for (const policy2 of existingPolicies) {
+          if (policy2.isDefault && policy2.id !== id) {
+            await database.updatePolicy(policy2.id, { isDefault: false });
+          }
+        }
+      }
+      const policy = await database.updatePolicy(id, data);
+      const devicesResult = await database.listDevices({ policyId: id });
+      if (devicesResult.devices.length > 0) {
+        const deviceIds = devicesResult.devices.map((d) => d.id);
+        await pushAdapter.sendBatch(deviceIds, {
+          type: "policy.updated",
+          payload: { policyId: id },
+          priority: "high"
+        });
+      }
+      return policy;
+    },
+    async delete(id) {
+      const devicesResult = await database.listDevices({ policyId: id });
+      if (devicesResult.devices.length > 0) {
+        for (const device of devicesResult.devices) {
+          await database.updateDevice(device.id, { policyId: null });
+        }
+      }
+      await database.deletePolicy(id);
+    },
+    async setDefault(id) {
+      return this.update(id, { isDefault: true });
+    },
+    async getDevices(policyId) {
+      const result = await database.listDevices({ policyId });
+      return result.devices;
+    },
+    async applyToDevice(policyId, deviceId) {
+      await devices.assignPolicy(deviceId, policyId);
+    }
+  };
+  const apps = {
+    async get(id) {
+      return database.findApplication(id);
+    },
+    async getByPackage(packageName, version) {
+      return database.findApplicationByPackage(packageName, version);
+    },
+    async list(activeOnly) {
+      return database.listApplications(activeOnly);
+    },
+    async register(data) {
+      return database.createApplication(data);
+    },
+    async update(id, data) {
+      return database.updateApplication(id, data);
+    },
+    async delete(id) {
+      await database.deleteApplication(id);
+    },
+    async activate(id) {
+      return database.updateApplication(id, { isActive: true });
+    },
+    async deactivate(id) {
+      return database.updateApplication(id, { isActive: false });
+    },
+    async deploy(packageName, target) {
+      const app = await database.findApplicationByPackage(packageName);
+      if (!app) {
+        throw new ApplicationNotFoundError(packageName);
+      }
+      const deviceIds = [];
+      if (target.devices) {
+        deviceIds.push(...target.devices);
+      }
+      if (target.groups) {
+        for (const groupId of target.groups) {
+          const groupDevices = await database.listDevicesInGroup(groupId);
+          deviceIds.push(...groupDevices.map((d) => d.id));
+        }
+      }
+      if (target.policies) {
+        for (const policyId of target.policies) {
+          const result = await database.listDevices({ policyId });
+          deviceIds.push(...result.devices.map((d) => d.id));
+        }
+      }
+      const uniqueDeviceIds = [...new Set(deviceIds)];
+      if (uniqueDeviceIds.length > 0) {
+        await pushAdapter.sendBatch(uniqueDeviceIds, {
+          type: "command.installApp",
+          payload: {
+            packageName: app.packageName,
+            version: app.version,
+            versionCode: app.versionCode,
+            url: app.url,
+            hash: app.hash
+          },
+          priority: "high"
+        });
+        for (const deviceId of uniqueDeviceIds) {
+          await database.createCommand({
+            deviceId,
+            type: "installApp",
+            payload: {
+              packageName: app.packageName,
+              version: app.version,
+              url: app.url
+            }
+          });
+        }
+      }
+    },
+    async installOnDevice(packageName, deviceId, version) {
+      const app = await database.findApplicationByPackage(packageName, version);
+      if (!app) {
+        throw new ApplicationNotFoundError(packageName);
+      }
+      return devices.sendCommand(deviceId, {
+        type: "installApp",
+        payload: {
+          packageName: app.packageName,
+          version: app.version,
+          versionCode: app.versionCode,
+          url: app.url,
+          hash: app.hash
+        }
+      });
+    },
+    async uninstallFromDevice(packageName, deviceId) {
+      return devices.sendCommand(deviceId, {
+        type: "uninstallApp",
+        payload: { packageName }
+      });
+    }
+  };
+  const commands = {
+    async get(id) {
+      return database.findCommand(id);
+    },
+    async list(filter) {
+      return database.listCommands(filter);
+    },
+    async send(input) {
+      return devices.sendCommand(input.deviceId, {
+        type: input.type,
+        payload: input.payload
+      });
+    },
+    async cancel(id) {
+      return database.updateCommand(id, { status: "cancelled" });
+    },
+    async acknowledge(id) {
+      const command = await database.updateCommand(id, {
+        status: "acknowledged",
+        acknowledgedAt: /* @__PURE__ */ new Date()
+      });
+      const device = await database.findDevice(command.deviceId);
+      if (device) {
+        await emit("command.acknowledged", { device, command });
+      }
+      return command;
+    },
+    async complete(id, result) {
+      const command = await database.updateCommand(id, {
+        status: "completed",
+        result,
+        completedAt: /* @__PURE__ */ new Date()
+      });
+      const device = await database.findDevice(command.deviceId);
+      if (device) {
+        await emit("command.completed", { device, command, result });
+      }
+      return command;
+    },
+    async fail(id, error) {
+      const command = await database.updateCommand(id, {
+        status: "failed",
+        error,
+        completedAt: /* @__PURE__ */ new Date()
+      });
+      const device = await database.findDevice(command.deviceId);
+      if (device) {
+        await emit("command.failed", { device, command, error });
+      }
+      return command;
+    },
+    async getPending(deviceId) {
+      return database.getPendingCommands(deviceId);
+    }
+  };
+  const groups = {
+    async get(id) {
+      return database.findGroup(id);
+    },
+    async list() {
+      return database.listGroups();
+    },
+    async create(data) {
+      return database.createGroup(data);
+    },
+    async update(id, data) {
+      return database.updateGroup(id, data);
+    },
+    async delete(id) {
+      await database.deleteGroup(id);
+    },
+    async getDevices(groupId) {
+      return database.listDevicesInGroup(groupId);
+    },
+    async addDevice(groupId, deviceId) {
+      await database.addDeviceToGroup(deviceId, groupId);
+    },
+    async removeDevice(groupId, deviceId) {
+      await database.removeDeviceFromGroup(deviceId, groupId);
+    },
+    async getChildren(groupId) {
+      const allGroups = await database.listGroups();
+      return allGroups.filter((g) => g.parentId === groupId);
+    }
+  };
+  const enroll = async (request) => {
+    if (enrollment?.allowedMethods && !enrollment.allowedMethods.includes(request.method)) {
+      throw new EnrollmentError(
+        `Enrollment method '${request.method}' is not allowed`
+      );
+    }
+    if (enrollment?.deviceSecret) {
+      const isValid = verifyEnrollmentSignature(
+        request,
+        enrollment.deviceSecret
+      );
+      if (!isValid) {
+        throw new EnrollmentError("Invalid enrollment signature");
+      }
+    }
+    if (enrollment?.validate) {
+      const isValid = await enrollment.validate(request);
+      if (!isValid) {
+        throw new EnrollmentError("Enrollment validation failed");
+      }
+    }
+    const enrollmentId = request.macAddress || request.serialNumber || request.imei || request.androidId;
+    if (!enrollmentId) {
+      throw new EnrollmentError(
+        "Device must provide at least one identifier (macAddress, serialNumber, imei, or androidId)"
+      );
+    }
+    let device = await database.findDeviceByEnrollmentId(enrollmentId);
+    if (device) {
+      device = await database.updateDevice(device.id, {
+        status: "enrolled",
+        model: request.model,
+        manufacturer: request.manufacturer,
+        osVersion: request.osVersion,
+        lastSync: /* @__PURE__ */ new Date()
+      });
+    } else if (enrollment?.autoEnroll) {
+      device = await database.createDevice({
+        enrollmentId,
+        model: request.model,
+        manufacturer: request.manufacturer,
+        osVersion: request.osVersion,
+        serialNumber: request.serialNumber,
+        imei: request.imei,
+        macAddress: request.macAddress,
+        androidId: request.androidId,
+        policyId: request.policyId || enrollment.defaultPolicyId
+      });
+      if (enrollment.defaultGroupId) {
+        await database.addDeviceToGroup(device.id, enrollment.defaultGroupId);
+      }
+    } else if (enrollment?.requireApproval) {
+      device = await database.createDevice({
+        enrollmentId,
+        model: request.model,
+        manufacturer: request.manufacturer,
+        osVersion: request.osVersion,
+        serialNumber: request.serialNumber,
+        imei: request.imei,
+        macAddress: request.macAddress,
+        androidId: request.androidId
+      });
+    } else {
+      throw new EnrollmentError(
+        "Device not registered and auto-enroll is disabled"
+      );
+    }
+    let policy = null;
+    if (device.policyId) {
+      policy = await database.findPolicy(device.policyId);
+    }
+    if (!policy) {
+      policy = await database.findDefaultPolicy();
+    }
+    const tokenSecret = config.auth?.deviceTokenSecret || enrollment?.deviceSecret || "";
+    const tokenExpiration = config.auth?.deviceTokenExpiration || 365 * 24 * 60 * 60;
+    const token = generateDeviceToken(device.id, tokenSecret, tokenExpiration);
+    await emit("device.enrolled", { device });
+    if (config.onDeviceEnrolled) {
+      await config.onDeviceEnrolled(device);
+    }
+    for (const plugin of plugins) {
+      if (plugin.onEnroll) {
+        await plugin.onEnroll(device, request);
+      }
+      if (plugin.onDeviceEnrolled) {
+        await plugin.onDeviceEnrolled(device);
+      }
+    }
+    return {
+      deviceId: device.id,
+      enrollmentId: device.enrollmentId,
+      policyId: policy?.id,
+      policy: policy || void 0,
+      serverUrl: config.serverUrl || "",
+      pushConfig: {
+        provider: push?.provider || "polling",
+        fcmSenderId: push?.fcmCredentials?.project_id,
+        mqttUrl: push?.mqttUrl,
+        mqttTopic: push?.mqttTopicPrefix ? `${push.mqttTopicPrefix}/${device.id}` : `openmdm/devices/${device.id}`,
+        pollingInterval: push?.pollingInterval || 60
+      },
+      token,
+      tokenExpiresAt: new Date(Date.now() + tokenExpiration * 1e3)
+    };
+  };
+  const processHeartbeat = async (deviceId, heartbeat) => {
+    const device = await database.findDevice(deviceId);
+    if (!device) {
+      throw new DeviceNotFoundError(deviceId);
+    }
+    const updateData = {
+      lastHeartbeat: heartbeat.timestamp,
+      batteryLevel: heartbeat.batteryLevel,
+      storageUsed: heartbeat.storageUsed,
+      storageTotal: heartbeat.storageTotal,
+      installedApps: heartbeat.installedApps
+    };
+    if (heartbeat.location) {
+      updateData.location = heartbeat.location;
+    }
+    const updatedDevice = await database.updateDevice(deviceId, updateData);
+    await emit("device.heartbeat", { device: updatedDevice, heartbeat });
+    if (heartbeat.location) {
+      await emit("device.locationUpdated", {
+        device: updatedDevice,
+        location: heartbeat.location
+      });
+    }
+    if (device.installedApps && heartbeat.installedApps) {
+      const oldApps = new Map(
+        device.installedApps.map((a) => [a.packageName, a])
+      );
+      const newApps = new Map(
+        heartbeat.installedApps.map((a) => [a.packageName, a])
+      );
+      for (const [pkg, app] of newApps) {
+        const oldApp = oldApps.get(pkg);
+        if (!oldApp) {
+          await emit("app.installed", { device: updatedDevice, app });
+        } else if (oldApp.version !== app.version) {
+          await emit("app.updated", {
+            device: updatedDevice,
+            app,
+            oldVersion: oldApp.version
+          });
+        }
+      }
+      for (const [pkg] of oldApps) {
+        if (!newApps.has(pkg)) {
+          await emit("app.uninstalled", {
+            device: updatedDevice,
+            packageName: pkg
+          });
+        }
+      }
+    }
+    if (config.onHeartbeat) {
+      await config.onHeartbeat(updatedDevice, heartbeat);
+    }
+    for (const plugin of plugins) {
+      if (plugin.onHeartbeat) {
+        await plugin.onHeartbeat(updatedDevice, heartbeat);
+      }
+    }
+  };
+  const verifyDeviceToken = async (token) => {
+    try {
+      const tokenSecret = config.auth?.deviceTokenSecret || enrollment?.deviceSecret || "";
+      const parts = token.split(".");
+      if (parts.length !== 3) {
+        return null;
+      }
+      const [header, payload, signature] = parts;
+      const expectedSignature = createHmac("sha256", tokenSecret).update(`${header}.${payload}`).digest("base64url");
+      if (signature !== expectedSignature) {
+        return null;
+      }
+      const decoded = JSON.parse(
+        Buffer.from(payload, "base64url").toString("utf-8")
+      );
+      if (decoded.exp && decoded.exp < Math.floor(Date.now() / 1e3)) {
+        return null;
+      }
+      return { deviceId: decoded.sub };
+    } catch {
+      return null;
+    }
+  };
+  const getPlugins = () => plugins;
+  const getPlugin = (name) => {
+    return plugins.find((p) => p.name === name);
+  };
+  const instance = {
+    devices,
+    policies,
+    apps,
+    commands,
+    groups,
+    push: pushAdapter,
+    webhooks: webhookManager,
+    db: database,
+    config,
+    on,
+    emit,
+    enroll,
+    processHeartbeat,
+    verifyDeviceToken,
+    getPlugins,
+    getPlugin
+  };
+  (async () => {
+    for (const plugin of plugins) {
+      if (plugin.onInit) {
+        try {
+          await plugin.onInit(instance);
+          console.log(`[OpenMDM] Plugin initialized: ${plugin.name}`);
+        } catch (error) {
+          console.error(
+            `[OpenMDM] Failed to initialize plugin ${plugin.name}:`,
+            error
+          );
+        }
+      }
+    }
+  })();
+  return instance;
+}
+function createPushAdapter(config, database) {
+  if (!config) {
+    return createStubPushAdapter();
+  }
+  return {
+    async send(deviceId, message) {
+      console.log(
+        `[OpenMDM] Push to ${deviceId}: ${message.type}`,
+        message.payload
+      );
+      return { success: true, messageId: randomUUID() };
+    },
+    async sendBatch(deviceIds, message) {
+      console.log(
+        `[OpenMDM] Push to ${deviceIds.length} devices: ${message.type}`
+      );
+      const results = deviceIds.map((deviceId) => ({
+        deviceId,
+        result: { success: true, messageId: randomUUID() }
+      }));
+      return {
+        successCount: deviceIds.length,
+        failureCount: 0,
+        results
+      };
+    },
+    async registerToken(deviceId, token) {
+      if (config.provider === "polling") {
+        return;
+      }
+      await database.upsertPushToken({
+        deviceId,
+        provider: config.provider,
+        token
+      });
+    },
+    async unregisterToken(deviceId) {
+      if (config.provider === "polling") {
+        return;
+      }
+      await database.deletePushToken(deviceId, config.provider);
+    }
+  };
+}
+function createStubPushAdapter() {
+  return {
+    async send(deviceId, message) {
+      console.log(`[OpenMDM] Push (stub): ${deviceId} <- ${message.type}`);
+      return { success: true, messageId: "stub" };
+    },
+    async sendBatch(deviceIds, message) {
+      console.log(
+        `[OpenMDM] Push (stub): ${deviceIds.length} devices <- ${message.type}`
+      );
+      return {
+        successCount: deviceIds.length,
+        failureCount: 0,
+        results: deviceIds.map((deviceId) => ({
+          deviceId,
+          result: { success: true, messageId: "stub" }
+        }))
+      };
+    }
+  };
+}
+function verifyEnrollmentSignature(request, secret) {
+  const { signature, ...data } = request;
+  if (!signature) {
+    return false;
+  }
+  const identifier = data.macAddress || data.serialNumber || data.imei || data.androidId || "";
+  const message = `${identifier}:${data.timestamp}`;
+  const expectedSignature = createHmac("sha256", secret).update(message).digest("hex");
+  try {
+    return timingSafeEqual(
+      Buffer.from(signature, "hex"),
+      Buffer.from(expectedSignature, "hex")
+    );
+  } catch {
+    return false;
+  }
+}
+function generateDeviceToken(deviceId, secret, expirationSeconds) {
+  const header = Buffer.from(
+    JSON.stringify({ alg: "HS256", typ: "JWT" })
+  ).toString("base64url");
+  const now = Math.floor(Date.now() / 1e3);
+  const payload = Buffer.from(
+    JSON.stringify({
+      sub: deviceId,
+      iat: now,
+      exp: now + expirationSeconds,
+      iss: "openmdm"
+    })
+  ).toString("base64url");
+  const signature = createHmac("sha256", secret).update(`${header}.${payload}`).digest("base64url");
+  return `${header}.${payload}.${signature}`;
+}
+
+export { ApplicationNotFoundError, AuthenticationError, AuthorizationError, DeviceNotFoundError, EnrollmentError, MDMError, PolicyNotFoundError, ValidationError, camelToSnake, createMDM, createWebhookManager, getColumnNames, getPrimaryKey, getTableNames, mdmSchema, snakeToCamel, transformToCamelCase, transformToSnakeCase, verifyWebhookSignature };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map