@camstack/system 1.2.427 → 1.2.429

package/dist/{dist-BQG3QFg7.js → dist-Bgy_AmwX.js}

@@ -9769,6 +9769,206 @@ function scopesAllowAddon(scopes, addonId, access) {
 	return scopes.some((s) => s.type === "addon" && s.target === addonId && s.access.includes(access));
 }
 /**
+* Device certificates (D855) — the wire contract shared by the hub, the admin
+* UI and the native viewer.
+*
+* A device (a phone) generates its OWN P-256 key pair in hardware (Secure
+* Enclave / Android Keystore / a non-extractable WebCrypto key). The private
+* key never travels. The hub signs the PUBLIC key into an X.509 leaf under a
+* dedicated device CA; the device later proves possession of the key by
+* signing a hub-issued nonce, and the hub answers with the same session a
+* password login opens.
+*
+* Everything on the wire is a small string (a PEM, a base64url signature):
+* D613 is about bulk bytes, and a certificate is ~600 bytes.
+*/
+/** Signature algorithm of every device credential: ECDSA, curve P-256, SHA-256. */
+var DEVICE_CERT_SIGNATURE = "ecdsa-p256-sha256";
+/** First line of every signed message; a change of format bumps the version. */
+var DEVICE_SIGNATURE_MESSAGE_VERSION = "camstack-device-cert-v1";
+zod.z.enum([
+	"login",
+	"renew",
+	"revoke"
+]);
+/** One-shot enrollment code and login nonce lifetimes. */
+var DEVICE_ENROLLMENT_TTL_MS = 10 * 6e4;
+var DEVICE_NONCE_TTL_MS = 6e4;
+/** SAN URI prefixes of a device leaf. */
+var DEVICE_SAN_CREDENTIAL_PREFIX = "camstack:credential:";
+var DEVICE_SAN_USER_PREFIX = "camstack:user:";
+/**
+* The exact bytes a device signs (UTF-8, `\n` separators, no trailing newline):
+*
+*   camstack-device-cert-v1
+*   <login|renew>
+*   <origin>            the hub origin returned by `getDeviceChallenge`
+*   <nonce>
+*
+* The origin is part of the message so a signature collected by a look-alike
+* hub is worthless on the real one; the hub additionally binds the nonce to
+* the origin it issued it for and refuses any other.
+*/
+function buildDeviceSignatureMessage(input) {
+	return [
+		DEVICE_SIGNATURE_MESSAGE_VERSION,
+		input.purpose,
+		input.origin,
+		input.nonce
+	].join("\n");
+}
+/** The deep link a QR carries: `camstack://enroll?hub=<origin>&code=<code>`. */
+function buildDeviceEnrollmentLink(input) {
+	const query = new URLSearchParams();
+	if (input.hub !== void 0) query.set("hub", input.hub);
+	query.set("code", input.code);
+	return `${input.scheme ?? "camstack"}://enroll?${query.toString()}`;
+}
+var DevicePlatformSchema = zod.z.enum([
+	"ios",
+	"android",
+	"web",
+	"other"
+]);
+var Base64UrlSchema = zod.z.string().min(1).max(4096).regex(/^[A-Za-z0-9_-]+$/);
+var PemSchema = zod.z.string().min(1).max(16384);
+/**
+* Why a device-certificate endpoint said no. Distinct from a transport / 5xx
+* failure: those carry no reason and mean "try again", never "the credential is
+* dead". The viewer switches on this exhaustively.
+*/
+var DeviceRefusalReasonSchema = zod.z.enum([
+	"revoked",
+	"unknown-credential",
+	"expired",
+	"bad-signature",
+	"nonce-invalid",
+	"rate-limited",
+	"invalid-certificate",
+	"superseded",
+	"user-gone",
+	"unavailable",
+	"code-invalid",
+	"self-enrollment-disabled",
+	"step-up-required",
+	"bad-public-key"
+]);
+var DeviceRefusalSchema = zod.z.object({
+	ok: zod.z.literal(false),
+	reason: DeviceRefusalReasonSchema,
+	definitive: zod.z.boolean(),
+	retryAfterSeconds: zod.z.number().optional()
+});
+zod.z.object({
+	code: zod.z.string().min(1).max(256),
+	/** SubjectPublicKeyInfo DER of the device's P-256 public key, base64url. */
+	publicKeySpki: Base64UrlSchema,
+	deviceName: zod.z.string().min(1).max(80).optional(),
+	platform: DevicePlatformSchema
+});
+var CompleteEnrollmentOutputSchema = zod.z.object({
+	credentialId: zod.z.string(),
+	certPem: PemSchema,
+	/** The device CA certificate the leaf chains to. */
+	chainPem: PemSchema,
+	notAfter: zod.z.number(),
+	user: zod.z.object({
+		id: zod.z.string(),
+		username: zod.z.string()
+	})
+});
+zod.z.discriminatedUnion("ok", [CompleteEnrollmentOutputSchema.extend({ ok: zod.z.literal(true) }), DeviceRefusalSchema]);
+zod.z.object({
+	/** The single-use step-up proof (`auth.deviceEnrollProofFrom…`). */
+	proof: zod.z.string().min(1).max(512),
+	publicKeySpki: Base64UrlSchema,
+	deviceName: zod.z.string().min(1).max(80),
+	platform: DevicePlatformSchema
+});
+zod.z.object({
+	proof: zod.z.string(),
+	expiresAt: zod.z.number()
+});
+var DeviceChallengeSchema = zod.z.object({
+	nonce: zod.z.string(),
+	/** The origin to put in the signed message. The app compares it to the hub it dialled. */
+	origin: zod.z.string(),
+	expiresAt: zod.z.number(),
+	signature: zod.z.literal(DEVICE_CERT_SIGNATURE)
+});
+zod.z.discriminatedUnion("ok", [DeviceChallengeSchema.extend({ ok: zod.z.literal(true) }), DeviceRefusalSchema]);
+zod.z.object({
+	certPem: PemSchema,
+	nonce: zod.z.string().min(1).max(256),
+	/** ECDSA P-256 SHA-256 over {@link buildDeviceSignatureMessage}; raw r||s or DER, base64url. */
+	signature: Base64UrlSchema
+});
+var RenewDeviceCertificateOutputSchema = zod.z.object({
+	credentialId: zod.z.string(),
+	certPem: PemSchema,
+	chainPem: PemSchema,
+	notAfter: zod.z.number()
+});
+zod.z.discriminatedUnion("ok", [RenewDeviceCertificateOutputSchema.extend({ ok: zod.z.literal(true) }), DeviceRefusalSchema]);
+zod.z.discriminatedUnion("ok", [zod.z.object({
+	ok: zod.z.literal(true),
+	credentialId: zod.z.string(),
+	sessionsEnded: zod.z.number().int()
+}), DeviceRefusalSchema]);
+function formatDeviceRevoker(revoker) {
+	return revoker.kind === "device" ? "device" : `${revoker.kind}:${revoker.userId}`;
+}
+var DeviceCredentialStatusSchema = zod.z.enum([
+	"active",
+	"expired",
+	"revoked"
+]);
+var DeviceCredentialSchema = zod.z.object({
+	id: zod.z.string(),
+	userId: zod.z.string(),
+	username: zod.z.string().nullable(),
+	deviceName: zod.z.string(),
+	platform: DevicePlatformSchema,
+	enrolledVia: zod.z.enum(["qr", "self"]),
+	/** SHA-256 of the leaf certificate DER, colon-hex. */
+	fingerprint: zod.z.string(),
+	issuedAt: zod.z.number(),
+	expiresAt: zod.z.number(),
+	lastUsedAt: zod.z.number().nullable(),
+	lastUsedFrom: zod.z.string().nullable(),
+	revokedAt: zod.z.number().nullable(),
+	/** `admin:<userId>` | `user:<userId>` | `device` | `user-deleted`. */
+	revokedBy: zod.z.string().nullable(),
+	status: DeviceCredentialStatusSchema
+});
+var StartEnrollmentOutputSchema = zod.z.object({
+	/** Shown once; only its hash is kept. */
+	code: zod.z.string(),
+	expiresAt: zod.z.number(),
+	/** `camstack://enroll?hub=…&code=…` — what the QR encodes. */
+	enrollUrl: zod.z.string(),
+	/** The hub origin in the link, or `null` when the hub could not name one (the link then has no `hub`). */
+	hubOrigin: zod.z.string().nullable(),
+	/** Every origin the apps may try (role `appConnections`). */
+	hubOrigins: zod.z.array(zod.z.string())
+});
+zod.z.object({
+	kind: zod.z.literal("device-certificate"),
+	id: zod.z.literal("device-certificate"),
+	label: zod.z.string(),
+	stage: zod.z.literal("primary"),
+	/** tRPC paths under the hub's `auth` router, so a client names no literal. */
+	challengePath: zod.z.literal("auth.getDeviceChallenge"),
+	revokePath: zod.z.literal("auth.revokeOwnDeviceCertificate"),
+	enrollSelfPath: zod.z.literal("auth.enrollSelf"),
+	loginPath: zod.z.literal("auth.loginWithDeviceCertificate"),
+	renewPath: zod.z.literal("auth.renewDeviceCertificate"),
+	signature: zod.z.literal(DEVICE_CERT_SIGNATURE),
+	messageVersion: zod.z.literal(DEVICE_SIGNATURE_MESSAGE_VERSION),
+	/** Which clients can execute it: a native app silently, a browser with a non-extractable WebCrypto key. */
+	clients: zod.z.array(zod.z.enum(["native", "web"]))
+});
+/**
 * What an expression's named bindings READ from.
 *
 * Salvaged verbatim from the deleted device-link mechanism. Wiring's source
@@ -16009,6 +16209,220 @@ var keychainCapability = {
 		getState: method(zod.z.object({}), KeychainStateSchema, { auth: "admin" })
 	}
 };
+var DeviceCaStatusSchema = zod.z.discriminatedUnion("state", [
+	zod.z.object({ state: zod.z.literal("absent") }),
+	zod.z.object({
+		state: zod.z.literal("ready"),
+		subject: zod.z.string(),
+		fingerprintSha256: zod.z.string(),
+		validTo: zod.z.string()
+	}),
+	zod.z.object({
+		state: zod.z.literal("unavailable"),
+		reason: zod.z.string()
+	})
+]);
+var DeviceCertificateSettingsSchema = zod.z.object({ selfEnrollment: zod.z.enum(["allowed", "disabled"]) });
+/**
+* `device-credentials` — the admin surface of device certificates (D855).
+*
+* Everything a device does ITSELF — completing an enrollment, getting a
+* challenge, signing in, renewing — is a PUBLIC procedure of the hub's `auth`
+* router (`auth.completeEnrollment`, `getDeviceChallenge`,
+* `loginWithDeviceCertificate`, `renewDeviceCertificate`): those legs are
+* proofs of possession, not capability calls, and must not be reachable as
+* cap methods. This cap holds only what an operator does about them.
+*
+* Provider: `local-auth`, which also owns the device CA and the registry.
+* The hub is the only node that persists device credentials.
+*/
+var deviceCredentialsCapability = {
+	name: "device-credentials",
+	scope: "system",
+	mode: "singleton",
+	methods: {
+		/**
+		* Every enrolled device, newest first; `userId` narrows to one user.
+		* `status` is derived: revoked wins over expired.
+		*/
+		listDeviceCredentials: method(zod.z.object({
+			userId: zod.z.string().min(1).optional(),
+			includeRevoked: zod.z.boolean().default(false)
+		}), zod.z.array(DeviceCredentialSchema).readonly(), { auth: "admin" }),
+		/**
+		* Mint a one-shot enrollment code for `userId` and a device name: 128-bit
+		* random, single use, 10 minutes, kept only as a hash. Returns the code
+		* once, with the `camstack://enroll?hub=…&code=…` link a QR carries.
+		* `caller` (the admin) is recorded in the audit trail.
+		*/
+		startEnrollment: method(zod.z.object({
+			userId: zod.z.string().min(1),
+			deviceName: zod.z.string().min(1).max(80)
+		}), StartEnrollmentOutputSchema, {
+			kind: "mutation",
+			auth: "admin",
+			caller: "required"
+		}),
+		/**
+		* Revoke a credential: its certificate stops logging in at once, and every
+		* session it opened ends (an open session also dies at its next refresh
+		* even if this call raced it). Idempotent.
+		*/
+		revokeDeviceCredential: method(zod.z.object({ id: zod.z.string().min(1) }), zod.z.object({
+			revoked: zod.z.boolean(),
+			sessionsEnded: zod.z.number().int(),
+			status: DeviceCredentialStatusSchema
+		}), {
+			kind: "mutation",
+			auth: "admin",
+			caller: "required"
+		}),
+		/**
+		* Hub-wide device-certificate settings. `selfEnrollment`: `allowed`
+		* (default) lets a signed-in user enroll their own device after a step-up
+		* sign-in; `disabled` makes `auth.enrollSelf` refuse. The admin QR path is
+		* unaffected. Hub-wide only (no per-role switch).
+		*/
+		getDeviceCertificateSettings: method(zod.z.object({}), DeviceCertificateSettingsSchema, { auth: "admin" }),
+		setDeviceCertificateSettings: method(DeviceCertificateSettingsSchema, DeviceCertificateSettingsSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Delete the registry row of a REVOKED credential (clean-up; the audit trail
+		* keeps the revocation). Refuses a live credential: revoke it first. After
+		* the row is gone the device's next call answers `unknown-credential`.
+		*/
+		deleteDeviceCredential: method(zod.z.object({ id: zod.z.string().min(1) }), zod.z.object({ result: zod.z.enum([
+			"deleted",
+			"live",
+			"unknown"
+		]) }), {
+			kind: "mutation",
+			auth: "admin",
+			caller: "required"
+		}),
+		/**
+		* The device CA: `absent` until the first enrollment creates it (lazily,
+		* never rotated on boot), `unavailable` while the keychain cannot answer.
+		*/
+		getDeviceCaStatus: method(zod.z.object({}), DeviceCaStatusSchema, { auth: "admin" }),
+		/** Rename a credential (the label only; the certificate is unchanged). */
+		renameDeviceCredential: method(zod.z.object({
+			id: zod.z.string().min(1),
+			deviceName: zod.z.string().min(1).max(80)
+		}), zod.z.object({ renamed: zod.z.boolean() }), {
+			kind: "mutation",
+			auth: "admin"
+		})
+	}
+};
+/**
+* `node-certificates` - what a node holds and the two renewals the hub drives
+* (D856): the node's MESH leaf (mutual TLS to the hub) and its HTTPS leaf (issued
+* from the hub's local CA so a device that trusts the hub root trusts the node).
+*
+* Provided by the AGENT RUNTIME (the synthetic `agent-runtime` addon id, like
+* `server-management`): the hub reaches it through the ordinary node-pinned
+* capability call - no new Moleculer action. The hub's own certificates are
+* handled in-process by the hub (`certificates` router), so this cap has no hub
+* provider.
+*
+* No private key ever crosses the mesh: the node generates its key pair, sends a
+* CSR, and the hub returns only the signed certificate.
+*/
+var MeshLeafInfoSchema = zod.z.object({
+	cn: zod.z.string(),
+	serial: zod.z.string(),
+	fingerprintSha256: zod.z.string(),
+	notBefore: zod.z.number(),
+	notAfter: zod.z.number()
+});
+var HttpsLeafInfoSchema = zod.z.object({
+	fingerprintSha256: zod.z.string(),
+	issuer: zod.z.string(),
+	sans: zod.z.array(zod.z.string()),
+	notBefore: zod.z.number(),
+	notAfter: zod.z.number()
+});
+var NodeHttpsStateSchema = zod.z.discriminatedUnion("state", [zod.z.object({
+	state: zod.z.literal("served"),
+	leaf: HttpsLeafInfoSchema
+}), zod.z.object({
+	state: zod.z.literal("not-issued"),
+	reason: zod.z.string()
+})]);
+var nodeCertificatesCapability = {
+	name: "node-certificates",
+	scope: "system",
+	mode: "singleton",
+	internal: true,
+	methods: {
+		/** The node's current mesh leaf (`null` when it is not enrolled on mTLS) and HTTPS state. */
+		getCertificates: method(zod.z.object({}), zod.z.object({
+			nodeId: zod.z.string(),
+			mesh: MeshLeafInfoSchema.nullable(),
+			https: NodeHttpsStateSchema
+		}), { auth: "admin" }),
+		/** Generate a NEW mesh key pair on the node; return the CSR (CN = node id). The key stays here. */
+		prepareMeshRenewal: method(zod.z.object({}), zod.z.object({ csrPem: zod.z.string() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Install the hub-signed leaf for the key made by `prepareMeshRenewal`: persist it
+		* (keeping the previous one), then reconnect to the hub with it. The node reverts to
+		* the previous leaf by itself unless `confirmMeshLeaf` arrives within `confirmWithinMs`.
+		*/
+		installMeshLeaf: method(zod.z.object({
+			certPem: zod.z.string().min(1),
+			caCertPem: zod.z.string().min(1),
+			confirmWithinMs: zod.z.number().int().min(1e4).max(6e5)
+		}), zod.z.object({
+			fingerprintSha256: zod.z.string(),
+			serial: zod.z.string()
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** The hub saw the node reconnect with the new leaf: keep it, forget the previous one. */
+		confirmMeshLeaf: method(zod.z.object({ fingerprintSha256: zod.z.string() }), zod.z.object({ confirmed: zod.z.boolean() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Go back to the previous leaf now. `false` when there is none to go back to. */
+		rollbackMeshLeaf: method(zod.z.object({}), zod.z.object({ rolledBack: zod.z.boolean() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** A key pair + CSR for the node's HTTPS leaf, and the names the node reports for itself. */
+		prepareHttpsCertificate: method(zod.z.object({}), zod.z.object({
+			csrPem: zod.z.string(),
+			hostnames: zod.z.array(zod.z.string()),
+			addresses: zod.z.array(zod.z.string()),
+			/** SHA-256 of the hub local CA this node pinned at its first install; `null` before one. */
+			pinnedCaFingerprintSha256: zod.z.string().nullable()
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Install the hub-signed HTTPS leaf and hot-swap the serving context (no restart). */
+		installHttpsCertificate: method(zod.z.object({
+			certPem: zod.z.string().min(1),
+			caCertPem: zod.z.string().min(1),
+			/**
+			* The hub signals that its local CA was rotated (D227) and this leaf chains to the NEW
+			* one. Only the hub, over the authenticated mesh, can say so; a leaf with a different CA
+			* and no signal is refused.
+			*/
+			caRotation: zod.z.boolean().optional()
+		}), HttpsLeafInfoSchema, {
+			kind: "mutation",
+			auth: "admin"
+		})
+	},
+	mount: { kind: "skip" }
+};
 /**
 * `keychain-admin` — the operator's view of the keychain (System → Secrets).
 *
@@ -73219,6 +73633,54 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"deviceCredentials.deleteDeviceCredential": {
+		capName: "device-credentials",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"deviceCredentials.getDeviceCaStatus": {
+		capName: "device-credentials",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"deviceCredentials.getDeviceCertificateSettings": {
+		capName: "device-credentials",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"deviceCredentials.listDeviceCredentials": {
+		capName: "device-credentials",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"deviceCredentials.renameDeviceCredential": {
+		capName: "device-credentials",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"deviceCredentials.revokeDeviceCredential": {
+		capName: "device-credentials",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"deviceCredentials.setDeviceCertificateSettings": {
+		capName: "device-credentials",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"deviceCredentials.startEnrollment": {
+		capName: "device-credentials",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"deviceDiscovery.adoptDevice": {
 		capName: "device-discovery",
 		capScope: "device",
@@ -75379,6 +75841,48 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"nodeCertificates.confirmMeshLeaf": {
+		capName: "node-certificates",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"nodeCertificates.getCertificates": {
+		capName: "node-certificates",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"nodeCertificates.installHttpsCertificate": {
+		capName: "node-certificates",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"nodeCertificates.installMeshLeaf": {
+		capName: "node-certificates",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"nodeCertificates.prepareHttpsCertificate": {
+		capName: "node-certificates",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"nodeCertificates.prepareMeshRenewal": {
+		capName: "node-certificates",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"nodeCertificates.rollbackMeshLeaf": {
+		capName: "node-certificates",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"nodes.clusterAddonStatus": {
 		capName: "nodes",
 		capScope: "system",
@@ -79745,6 +80249,7 @@ var ALL_CAPABILITY_DEFINITIONS = [
 	detectionPipelineCapability,
 	deviceAdminLinkCapability,
 	deviceAdoptionCapability,
+	deviceCredentialsCapability,
 	deviceDiscoveryCapability,
 	deviceExportCapability,
 	deviceExtensionCapability,
@@ -79796,6 +80301,7 @@ var ALL_CAPABILITY_DEFINITIONS = [
 	networkAccessCapability,
 	networkLinkCapability,
 	networkQualityCapability,
+	nodeCertificatesCapability,
 	nodesCapability,
 	notificationOutputCapability,
 	notificationRulesCapability,
@@ -84288,6 +84794,30 @@ Object.defineProperty(exports, "DERIVED_CAMERA_SILENCED_CAP_NAMES", {
 		return DERIVED_CAMERA_SILENCED_CAP_NAMES;
 	}
 });
+Object.defineProperty(exports, "DEVICE_ENROLLMENT_TTL_MS", {
+	enumerable: true,
+	get: function() {
+		return DEVICE_ENROLLMENT_TTL_MS;
+	}
+});
+Object.defineProperty(exports, "DEVICE_NONCE_TTL_MS", {
+	enumerable: true,
+	get: function() {
+		return DEVICE_NONCE_TTL_MS;
+	}
+});
+Object.defineProperty(exports, "DEVICE_SAN_CREDENTIAL_PREFIX", {
+	enumerable: true,
+	get: function() {
+		return DEVICE_SAN_CREDENTIAL_PREFIX;
+	}
+});
+Object.defineProperty(exports, "DEVICE_SAN_USER_PREFIX", {
+	enumerable: true,
+	get: function() {
+		return DEVICE_SAN_USER_PREFIX;
+	}
+});
 Object.defineProperty(exports, "DEVICE_SETTINGS_CONTRIBUTION_METHODS", {
 	enumerable: true,
 	get: function() {
@@ -84570,6 +85100,18 @@ Object.defineProperty(exports, "buildCapabilityLookup", {
 		return buildCapabilityLookup;
 	}
 });
+Object.defineProperty(exports, "buildDeviceEnrollmentLink", {
+	enumerable: true,
+	get: function() {
+		return buildDeviceEnrollmentLink;
+	}
+});
+Object.defineProperty(exports, "buildDeviceSignatureMessage", {
+	enumerable: true,
+	get: function() {
+		return buildDeviceSignatureMessage;
+	}
+});
 Object.defineProperty(exports, "buildFfmpegArgs", {
 	enumerable: true,
 	get: function() {
@@ -84786,6 +85328,12 @@ Object.defineProperty(exports, "describeComposableCaps", {
 		return describeComposableCaps;
 	}
 });
+Object.defineProperty(exports, "deviceCredentialsCapability", {
+	enumerable: true,
+	get: function() {
+		return deviceCredentialsCapability;
+	}
+});
 Object.defineProperty(exports, "deviceExtensionCapability", {
 	enumerable: true,
 	get: function() {
@@ -84900,6 +85448,12 @@ Object.defineProperty(exports, "foldSnapshotByFunction", {
 		return foldSnapshotByFunction;
 	}
 });
+Object.defineProperty(exports, "formatDeviceRevoker", {
+	enumerable: true,
+	get: function() {
+		return formatDeviceRevoker;
+	}
+});
 Object.defineProperty(exports, "formatMinutes", {
 	enumerable: true,
 	get: function() {