@camstack/system 1.2.428 → 1.2.429

package/dist/{dist-DHSJV4Qc.mjs → dist-CSSfTM18.mjs}

@@ -9769,6 +9769,206 @@ function scopesAllowAddon(scopes, addonId, access) {
 	return scopes.some((s) => s.type === "addon" && s.target === addonId && s.access.includes(access));
 }
 /**
+* Device certificates (D855) — the wire contract shared by the hub, the admin
+* UI and the native viewer.
+*
+* A device (a phone) generates its OWN P-256 key pair in hardware (Secure
+* Enclave / Android Keystore / a non-extractable WebCrypto key). The private
+* key never travels. The hub signs the PUBLIC key into an X.509 leaf under a
+* dedicated device CA; the device later proves possession of the key by
+* signing a hub-issued nonce, and the hub answers with the same session a
+* password login opens.
+*
+* Everything on the wire is a small string (a PEM, a base64url signature):
+* D613 is about bulk bytes, and a certificate is ~600 bytes.
+*/
+/** Signature algorithm of every device credential: ECDSA, curve P-256, SHA-256. */
+var DEVICE_CERT_SIGNATURE = "ecdsa-p256-sha256";
+/** First line of every signed message; a change of format bumps the version. */
+var DEVICE_SIGNATURE_MESSAGE_VERSION = "camstack-device-cert-v1";
+z.enum([
+	"login",
+	"renew",
+	"revoke"
+]);
+/** One-shot enrollment code and login nonce lifetimes. */
+var DEVICE_ENROLLMENT_TTL_MS = 10 * 6e4;
+var DEVICE_NONCE_TTL_MS = 6e4;
+/** SAN URI prefixes of a device leaf. */
+var DEVICE_SAN_CREDENTIAL_PREFIX = "camstack:credential:";
+var DEVICE_SAN_USER_PREFIX = "camstack:user:";
+/**
+* The exact bytes a device signs (UTF-8, `\n` separators, no trailing newline):
+*
+*   camstack-device-cert-v1
+*   <login|renew>
+*   <origin>            the hub origin returned by `getDeviceChallenge`
+*   <nonce>
+*
+* The origin is part of the message so a signature collected by a look-alike
+* hub is worthless on the real one; the hub additionally binds the nonce to
+* the origin it issued it for and refuses any other.
+*/
+function buildDeviceSignatureMessage(input) {
+	return [
+		DEVICE_SIGNATURE_MESSAGE_VERSION,
+		input.purpose,
+		input.origin,
+		input.nonce
+	].join("\n");
+}
+/** The deep link a QR carries: `camstack://enroll?hub=<origin>&code=<code>`. */
+function buildDeviceEnrollmentLink(input) {
+	const query = new URLSearchParams();
+	if (input.hub !== void 0) query.set("hub", input.hub);
+	query.set("code", input.code);
+	return `${input.scheme ?? "camstack"}://enroll?${query.toString()}`;
+}
+var DevicePlatformSchema = z.enum([
+	"ios",
+	"android",
+	"web",
+	"other"
+]);
+var Base64UrlSchema = z.string().min(1).max(4096).regex(/^[A-Za-z0-9_-]+$/);
+var PemSchema = z.string().min(1).max(16384);
+/**
+* Why a device-certificate endpoint said no. Distinct from a transport / 5xx
+* failure: those carry no reason and mean "try again", never "the credential is
+* dead". The viewer switches on this exhaustively.
+*/
+var DeviceRefusalReasonSchema = z.enum([
+	"revoked",
+	"unknown-credential",
+	"expired",
+	"bad-signature",
+	"nonce-invalid",
+	"rate-limited",
+	"invalid-certificate",
+	"superseded",
+	"user-gone",
+	"unavailable",
+	"code-invalid",
+	"self-enrollment-disabled",
+	"step-up-required",
+	"bad-public-key"
+]);
+var DeviceRefusalSchema = z.object({
+	ok: z.literal(false),
+	reason: DeviceRefusalReasonSchema,
+	definitive: z.boolean(),
+	retryAfterSeconds: z.number().optional()
+});
+z.object({
+	code: z.string().min(1).max(256),
+	/** SubjectPublicKeyInfo DER of the device's P-256 public key, base64url. */
+	publicKeySpki: Base64UrlSchema,
+	deviceName: z.string().min(1).max(80).optional(),
+	platform: DevicePlatformSchema
+});
+var CompleteEnrollmentOutputSchema = z.object({
+	credentialId: z.string(),
+	certPem: PemSchema,
+	/** The device CA certificate the leaf chains to. */
+	chainPem: PemSchema,
+	notAfter: z.number(),
+	user: z.object({
+		id: z.string(),
+		username: z.string()
+	})
+});
+z.discriminatedUnion("ok", [CompleteEnrollmentOutputSchema.extend({ ok: z.literal(true) }), DeviceRefusalSchema]);
+z.object({
+	/** The single-use step-up proof (`auth.deviceEnrollProofFrom…`). */
+	proof: z.string().min(1).max(512),
+	publicKeySpki: Base64UrlSchema,
+	deviceName: z.string().min(1).max(80),
+	platform: DevicePlatformSchema
+});
+z.object({
+	proof: z.string(),
+	expiresAt: z.number()
+});
+var DeviceChallengeSchema = z.object({
+	nonce: z.string(),
+	/** The origin to put in the signed message. The app compares it to the hub it dialled. */
+	origin: z.string(),
+	expiresAt: z.number(),
+	signature: z.literal(DEVICE_CERT_SIGNATURE)
+});
+z.discriminatedUnion("ok", [DeviceChallengeSchema.extend({ ok: z.literal(true) }), DeviceRefusalSchema]);
+z.object({
+	certPem: PemSchema,
+	nonce: z.string().min(1).max(256),
+	/** ECDSA P-256 SHA-256 over {@link buildDeviceSignatureMessage}; raw r||s or DER, base64url. */
+	signature: Base64UrlSchema
+});
+var RenewDeviceCertificateOutputSchema = z.object({
+	credentialId: z.string(),
+	certPem: PemSchema,
+	chainPem: PemSchema,
+	notAfter: z.number()
+});
+z.discriminatedUnion("ok", [RenewDeviceCertificateOutputSchema.extend({ ok: z.literal(true) }), DeviceRefusalSchema]);
+z.discriminatedUnion("ok", [z.object({
+	ok: z.literal(true),
+	credentialId: z.string(),
+	sessionsEnded: z.number().int()
+}), DeviceRefusalSchema]);
+function formatDeviceRevoker(revoker) {
+	return revoker.kind === "device" ? "device" : `${revoker.kind}:${revoker.userId}`;
+}
+var DeviceCredentialStatusSchema = z.enum([
+	"active",
+	"expired",
+	"revoked"
+]);
+var DeviceCredentialSchema = z.object({
+	id: z.string(),
+	userId: z.string(),
+	username: z.string().nullable(),
+	deviceName: z.string(),
+	platform: DevicePlatformSchema,
+	enrolledVia: z.enum(["qr", "self"]),
+	/** SHA-256 of the leaf certificate DER, colon-hex. */
+	fingerprint: z.string(),
+	issuedAt: z.number(),
+	expiresAt: z.number(),
+	lastUsedAt: z.number().nullable(),
+	lastUsedFrom: z.string().nullable(),
+	revokedAt: z.number().nullable(),
+	/** `admin:<userId>` | `user:<userId>` | `device` | `user-deleted`. */
+	revokedBy: z.string().nullable(),
+	status: DeviceCredentialStatusSchema
+});
+var StartEnrollmentOutputSchema = z.object({
+	/** Shown once; only its hash is kept. */
+	code: z.string(),
+	expiresAt: z.number(),
+	/** `camstack://enroll?hub=…&code=…` — what the QR encodes. */
+	enrollUrl: z.string(),
+	/** The hub origin in the link, or `null` when the hub could not name one (the link then has no `hub`). */
+	hubOrigin: z.string().nullable(),
+	/** Every origin the apps may try (role `appConnections`). */
+	hubOrigins: z.array(z.string())
+});
+z.object({
+	kind: z.literal("device-certificate"),
+	id: z.literal("device-certificate"),
+	label: z.string(),
+	stage: z.literal("primary"),
+	/** tRPC paths under the hub's `auth` router, so a client names no literal. */
+	challengePath: z.literal("auth.getDeviceChallenge"),
+	revokePath: z.literal("auth.revokeOwnDeviceCertificate"),
+	enrollSelfPath: z.literal("auth.enrollSelf"),
+	loginPath: z.literal("auth.loginWithDeviceCertificate"),
+	renewPath: z.literal("auth.renewDeviceCertificate"),
+	signature: z.literal(DEVICE_CERT_SIGNATURE),
+	messageVersion: z.literal(DEVICE_SIGNATURE_MESSAGE_VERSION),
+	/** Which clients can execute it: a native app silently, a browser with a non-extractable WebCrypto key. */
+	clients: z.array(z.enum(["native", "web"]))
+});
+/**
 * What an expression's named bindings READ from.
 *
 * Salvaged verbatim from the deleted device-link mechanism. Wiring's source
@@ -16009,6 +16209,220 @@ var keychainCapability = {
 		getState: method(z.object({}), KeychainStateSchema, { auth: "admin" })
 	}
 };
+var DeviceCaStatusSchema = z.discriminatedUnion("state", [
+	z.object({ state: z.literal("absent") }),
+	z.object({
+		state: z.literal("ready"),
+		subject: z.string(),
+		fingerprintSha256: z.string(),
+		validTo: z.string()
+	}),
+	z.object({
+		state: z.literal("unavailable"),
+		reason: z.string()
+	})
+]);
+var DeviceCertificateSettingsSchema = z.object({ selfEnrollment: z.enum(["allowed", "disabled"]) });
+/**
+* `device-credentials` — the admin surface of device certificates (D855).
+*
+* Everything a device does ITSELF — completing an enrollment, getting a
+* challenge, signing in, renewing — is a PUBLIC procedure of the hub's `auth`
+* router (`auth.completeEnrollment`, `getDeviceChallenge`,
+* `loginWithDeviceCertificate`, `renewDeviceCertificate`): those legs are
+* proofs of possession, not capability calls, and must not be reachable as
+* cap methods. This cap holds only what an operator does about them.
+*
+* Provider: `local-auth`, which also owns the device CA and the registry.
+* The hub is the only node that persists device credentials.
+*/
+var deviceCredentialsCapability = {
+	name: "device-credentials",
+	scope: "system",
+	mode: "singleton",
+	methods: {
+		/**
+		* Every enrolled device, newest first; `userId` narrows to one user.
+		* `status` is derived: revoked wins over expired.
+		*/
+		listDeviceCredentials: method(z.object({
+			userId: z.string().min(1).optional(),
+			includeRevoked: z.boolean().default(false)
+		}), z.array(DeviceCredentialSchema).readonly(), { auth: "admin" }),
+		/**
+		* Mint a one-shot enrollment code for `userId` and a device name: 128-bit
+		* random, single use, 10 minutes, kept only as a hash. Returns the code
+		* once, with the `camstack://enroll?hub=…&code=…` link a QR carries.
+		* `caller` (the admin) is recorded in the audit trail.
+		*/
+		startEnrollment: method(z.object({
+			userId: z.string().min(1),
+			deviceName: z.string().min(1).max(80)
+		}), StartEnrollmentOutputSchema, {
+			kind: "mutation",
+			auth: "admin",
+			caller: "required"
+		}),
+		/**
+		* Revoke a credential: its certificate stops logging in at once, and every
+		* session it opened ends (an open session also dies at its next refresh
+		* even if this call raced it). Idempotent.
+		*/
+		revokeDeviceCredential: method(z.object({ id: z.string().min(1) }), z.object({
+			revoked: z.boolean(),
+			sessionsEnded: z.number().int(),
+			status: DeviceCredentialStatusSchema
+		}), {
+			kind: "mutation",
+			auth: "admin",
+			caller: "required"
+		}),
+		/**
+		* Hub-wide device-certificate settings. `selfEnrollment`: `allowed`
+		* (default) lets a signed-in user enroll their own device after a step-up
+		* sign-in; `disabled` makes `auth.enrollSelf` refuse. The admin QR path is
+		* unaffected. Hub-wide only (no per-role switch).
+		*/
+		getDeviceCertificateSettings: method(z.object({}), DeviceCertificateSettingsSchema, { auth: "admin" }),
+		setDeviceCertificateSettings: method(DeviceCertificateSettingsSchema, DeviceCertificateSettingsSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Delete the registry row of a REVOKED credential (clean-up; the audit trail
+		* keeps the revocation). Refuses a live credential: revoke it first. After
+		* the row is gone the device's next call answers `unknown-credential`.
+		*/
+		deleteDeviceCredential: method(z.object({ id: z.string().min(1) }), z.object({ result: z.enum([
+			"deleted",
+			"live",
+			"unknown"
+		]) }), {
+			kind: "mutation",
+			auth: "admin",
+			caller: "required"
+		}),
+		/**
+		* The device CA: `absent` until the first enrollment creates it (lazily,
+		* never rotated on boot), `unavailable` while the keychain cannot answer.
+		*/
+		getDeviceCaStatus: method(z.object({}), DeviceCaStatusSchema, { auth: "admin" }),
+		/** Rename a credential (the label only; the certificate is unchanged). */
+		renameDeviceCredential: method(z.object({
+			id: z.string().min(1),
+			deviceName: z.string().min(1).max(80)
+		}), z.object({ renamed: z.boolean() }), {
+			kind: "mutation",
+			auth: "admin"
+		})
+	}
+};
+/**
+* `node-certificates` - what a node holds and the two renewals the hub drives
+* (D856): the node's MESH leaf (mutual TLS to the hub) and its HTTPS leaf (issued
+* from the hub's local CA so a device that trusts the hub root trusts the node).
+*
+* Provided by the AGENT RUNTIME (the synthetic `agent-runtime` addon id, like
+* `server-management`): the hub reaches it through the ordinary node-pinned
+* capability call - no new Moleculer action. The hub's own certificates are
+* handled in-process by the hub (`certificates` router), so this cap has no hub
+* provider.
+*
+* No private key ever crosses the mesh: the node generates its key pair, sends a
+* CSR, and the hub returns only the signed certificate.
+*/
+var MeshLeafInfoSchema = z.object({
+	cn: z.string(),
+	serial: z.string(),
+	fingerprintSha256: z.string(),
+	notBefore: z.number(),
+	notAfter: z.number()
+});
+var HttpsLeafInfoSchema = z.object({
+	fingerprintSha256: z.string(),
+	issuer: z.string(),
+	sans: z.array(z.string()),
+	notBefore: z.number(),
+	notAfter: z.number()
+});
+var NodeHttpsStateSchema = z.discriminatedUnion("state", [z.object({
+	state: z.literal("served"),
+	leaf: HttpsLeafInfoSchema
+}), z.object({
+	state: z.literal("not-issued"),
+	reason: z.string()
+})]);
+var nodeCertificatesCapability = {
+	name: "node-certificates",
+	scope: "system",
+	mode: "singleton",
+	internal: true,
+	methods: {
+		/** The node's current mesh leaf (`null` when it is not enrolled on mTLS) and HTTPS state. */
+		getCertificates: method(z.object({}), z.object({
+			nodeId: z.string(),
+			mesh: MeshLeafInfoSchema.nullable(),
+			https: NodeHttpsStateSchema
+		}), { auth: "admin" }),
+		/** Generate a NEW mesh key pair on the node; return the CSR (CN = node id). The key stays here. */
+		prepareMeshRenewal: method(z.object({}), z.object({ csrPem: z.string() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Install the hub-signed leaf for the key made by `prepareMeshRenewal`: persist it
+		* (keeping the previous one), then reconnect to the hub with it. The node reverts to
+		* the previous leaf by itself unless `confirmMeshLeaf` arrives within `confirmWithinMs`.
+		*/
+		installMeshLeaf: method(z.object({
+			certPem: z.string().min(1),
+			caCertPem: z.string().min(1),
+			confirmWithinMs: z.number().int().min(1e4).max(6e5)
+		}), z.object({
+			fingerprintSha256: z.string(),
+			serial: z.string()
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** The hub saw the node reconnect with the new leaf: keep it, forget the previous one. */
+		confirmMeshLeaf: method(z.object({ fingerprintSha256: z.string() }), z.object({ confirmed: z.boolean() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Go back to the previous leaf now. `false` when there is none to go back to. */
+		rollbackMeshLeaf: method(z.object({}), z.object({ rolledBack: z.boolean() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** A key pair + CSR for the node's HTTPS leaf, and the names the node reports for itself. */
+		prepareHttpsCertificate: method(z.object({}), z.object({
+			csrPem: z.string(),
+			hostnames: z.array(z.string()),
+			addresses: z.array(z.string()),
+			/** SHA-256 of the hub local CA this node pinned at its first install; `null` before one. */
+			pinnedCaFingerprintSha256: z.string().nullable()
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Install the hub-signed HTTPS leaf and hot-swap the serving context (no restart). */
+		installHttpsCertificate: method(z.object({
+			certPem: z.string().min(1),
+			caCertPem: z.string().min(1),
+			/**
+			* The hub signals that its local CA was rotated (D227) and this leaf chains to the NEW
+			* one. Only the hub, over the authenticated mesh, can say so; a leaf with a different CA
+			* and no signal is refused.
+			*/
+			caRotation: z.boolean().optional()
+		}), HttpsLeafInfoSchema, {
+			kind: "mutation",
+			auth: "admin"
+		})
+	},
+	mount: { kind: "skip" }
+};
 /**
 * `keychain-admin` — the operator's view of the keychain (System → Secrets).
 *
@@ -73219,6 +73633,54 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"deviceCredentials.deleteDeviceCredential": {
+		capName: "device-credentials",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"deviceCredentials.getDeviceCaStatus": {
+		capName: "device-credentials",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"deviceCredentials.getDeviceCertificateSettings": {
+		capName: "device-credentials",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"deviceCredentials.listDeviceCredentials": {
+		capName: "device-credentials",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"deviceCredentials.renameDeviceCredential": {
+		capName: "device-credentials",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"deviceCredentials.revokeDeviceCredential": {
+		capName: "device-credentials",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"deviceCredentials.setDeviceCertificateSettings": {
+		capName: "device-credentials",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"deviceCredentials.startEnrollment": {
+		capName: "device-credentials",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"deviceDiscovery.adoptDevice": {
 		capName: "device-discovery",
 		capScope: "device",
@@ -75379,6 +75841,48 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"nodeCertificates.confirmMeshLeaf": {
+		capName: "node-certificates",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"nodeCertificates.getCertificates": {
+		capName: "node-certificates",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"nodeCertificates.installHttpsCertificate": {
+		capName: "node-certificates",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"nodeCertificates.installMeshLeaf": {
+		capName: "node-certificates",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"nodeCertificates.prepareHttpsCertificate": {
+		capName: "node-certificates",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"nodeCertificates.prepareMeshRenewal": {
+		capName: "node-certificates",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"nodeCertificates.rollbackMeshLeaf": {
+		capName: "node-certificates",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"nodes.clusterAddonStatus": {
 		capName: "nodes",
 		capScope: "system",
@@ -79745,6 +80249,7 @@ var ALL_CAPABILITY_DEFINITIONS = [
 	detectionPipelineCapability,
 	deviceAdminLinkCapability,
 	deviceAdoptionCapability,
+	deviceCredentialsCapability,
 	deviceDiscoveryCapability,
 	deviceExportCapability,
 	deviceExtensionCapability,
@@ -79796,6 +80301,7 @@ var ALL_CAPABILITY_DEFINITIONS = [
 	networkAccessCapability,
 	networkLinkCapability,
 	networkQualityCapability,
+	nodeCertificatesCapability,
 	nodesCapability,
 	notificationOutputCapability,
 	notificationRulesCapability,
@@ -84150,4 +84656,4 @@ function enumerateInferenceDevices(hw) {
 	return out;
 }
 //#endregion
-export { buildStreamParamsConfigSchema as $, compositionItemFieldPath as $n, toSecretFieldView as $r, looseSchema as $t, LegacyStorageLocationDefaultSchema as A, settingsStoreCapability as An, expandCapMethods as Ar, expressionContainsBuiltinCall as At, StorageLocationModeSchema as B, userManagementCapability as Bn, nodePin as Br, isLocationEnabled as Bt, FIRST_LEVEL_MACRO_CLASSES as C, resolveLocationMode as Cn, collectSecretConfigKeys as Cr, deviceStatusCapability as Ct, HUB_MDNS_TXT_KEYS as D, scopesAllowAddon as Dn, defineCustomActions as Dr, evaluateCompositionField as Dt, HUB_MDNS_SERVICE_TYPE as E, runtimeStatePolicyFor as En, customAction as Er, enumerateSchemaFields as Et, RecordingStatusSchema as F, storageOccupancyCapability as Fn, isKeychainStoredField as Fr, gbToBytes as Ft, addonSettingsCapability as G, vectorStoreCapability as Gn, readinessKey as Gr, keychainCapability as Gt, StorageMigrationJobSchema as H, validateCustomAddress as Hn, parseJsonObject as Hr, isVoidInput as Ht, STORAGE_ACCESS_FALLBACK as I, storageProviderCapability as In, isSecretClear as Ir, isAppLinkBase as It, authProviderCapability as J, buildFfmpegArgs as Jn, scopeKey as Jr, lifecycleJobSchema as Jt, addonWidgetsCapability as K, withLocationMode as Kn, resolveCapMount as Kr, legacyAutoLinkIds as Kt, STREAM_PROFILE_META as L, streamCatalogCapability as Ln, isSecretMarker as Lr, isArrayOutputSchema as Lt, MINUTES_PER_DAY as M, snapshotCapability as Mn, hydrateSchema as Mr, filesystemBrowseCapability as Mt, MOTION_CLOSE_AFTER_MS as N, storageCapability as Nn, isDeviceConfigCap as Nr, foldSnapshotByFunction as Nt, KEYCHAIN_RESET_TRIGGER_ACTOR as O, scopesAllowDeviceCap as On, emitDownForOwnedCaps as Or, evictionPolicyOfLocation as Ot, RECORDING_SOURCE_CAMSTACK_ADDON as P, storageMigrationCapability as Pn, isEvent as Pr, formatMinutes as Pt, buildCapabilityLookup as Q, compositionFeatureEnabled as Qn, toNodeId as Qr, logLevelAtMost as Qt, ScopedTokenSchema as R, streamQualityLabel as Rn, isSecretMarkerLike as Rr, isCollectionArrayMethod as Rt, DeviceStatusSchema as S, resolveHubAddressRoles as Sn, buildSecretRef as Sr, deviceStateCapability as St, FieldClaimSchema as T, resolveNotificationTapAddress as Tn, createEvent as Tr, enumerateItemArrayFields as Tt, UserRecordSchema as U, vectorDimFromBase64 as Un, parseJsonUnknown as Ur, kebabToCamel as Ut, StorageLocationTypeSchema as V, validateComposition as Vn, normalizeSecretOwner as Vr, isObjectInput as Vt, addonPagesCapability as W, vectorIndexDimConflictError as Wn, parseSecretRef as Wr, keychainAdminCapability as Wt, bareAddonId as X, composedDeviceRef as Xn, secretTreeFromSchema as Xr, locationIconKey as Xt, backupCapability as Y, cloneStatefulExpressionMemory as Yn, secretTreeFromPaths as Yr, localNetworkCapability as Yt, batteryCapability as Z, composedDeviceStableId as Zn, sleep as Zr, logDestinationCapability as Zt, DATABASE_SNAPSHOT_TIMEOUT_MS as _, replacedFieldKeys as _n, SECRET_CLEAR as _r, defineExtensionSlotProvider as _t, BatteryStatusSchema as a, motionCapability as an, DeviceFeature as ar, compositionFieldKey as at, DERIVED_CAMERA_SILENCED_CAP_NAMES as b, resolveCoreBlockEntry as bn, asNumber as br, deviceExtensionCapability as bt, CAP_NAMES_WITH_STATUS as c, objectInputDeclaresAddonId as cn, errMsg as cr, coreBlockComposition as ct, CORE_BLOCKS_ADDON_ID as d, pickAppLinkHub as dn, DEVICE_SETTINGS_CONTRIBUTION_METHODS as dr, coreBlocksCapability as dt, transformSecretWrite as ei, mayReadLocation as en, compositionSliceKey as er, calendarsCapability as et, CORE_BLOCK_ADDON_PREFIX as f, planComposition as fn, DEVICE_STATUS_METHOD as fr, createDeviceExtensionProvider as ft, DATABASE_SNAPSHOT_SUFFIX as g, reducePoints as gn, ReadinessTimeoutError as gr, decodeVectorBase64 as gt, DATABASE_SNAPSHOT_PARTIAL_SUFFIX as h, ptzAutotrackCapability as hn, ReadinessRegistry as hr, declarationOwnerNodeId as ht, BaseDevice as i, modeMayWrite as in, toExpressionValue as ir, composerCapability as it, METHOD_ACCESS_MAP as j, siteZoneKey as jn, formatSecretScope as jr, extractNestedAddonId as jt, LOG_LEVEL_RANK as k, scoreRuntimes as kn, emitReadiness as kr, expandContainer as kt, COMPOSED_ITEM_FIXED_FIELDS as l, objectInputDeclaresRequiredDeviceId as ln, BaseAddon as lr, coreBlockIdFromAddonId as lt, CoreBlockSchema as m, procedureAuthKey as mn, RUNTIME_DEFAULTS as mr, databaseSnapshotCapability as mt, AlertSchema as n, memoizePinnedFfmpeg as nn, createStatefulExpressionMemory as nr, canonicalIconKey as nt, CAMERA_SWITCH_ORDER as o, normalizeCoreBlockWrite as on, DeviceRole as or, compositionSourceRefs as ot, CalendarPreferencesSchema as p, platformProbeCapability as pn, REDACTED_SECRET as pr, dataStoreProviderCapability as pt, alertsCapability as q, COMPOSER_ADDON_ID as qn, resolveSecretMarkers as qr, legacyModeOf as qt, ApiKeyRecordSchema as r, metricsProviderCapability as rn, disarmRoseMemory as rr, checkRoleAddress as rt, CAMSTACK_APP_LINK_ORIGIN as s, normalizeUnit as sn, DeviceType as sr, coreBlockAddonId as st, ALL_CAPABILITY_DEFINITIONS as t, EventCategory as ti, mayWriteToLocation as tn, compositionSourceKey as tr, cameraGridLayoutCapability as tt, COMPOSER_RUNNER_ID as u, parseStreamParamsFormPatch as un, DATAPLANE_SECRET_HEADER as ur, coreBlockSourceKind as ut, DATA_STORE_DATABASES as v, resolveAppConnections as vn, WELL_KNOWN_TAB_MAP as vr, deriveBatteryPresence as vt, FieldClaimModeSchema as w, resolveMethodAuth as wn, collectZodSecretPaths as wr, enumerateInferenceDevices as wt, DeclaredDevices as x, resolveCoreBlockFiles as xn, asString$1 as xr, deviceManagerCapability as xt, DAY_NAMES as y, resolveBucketMs as yn, asJsonObject as yr, describeComposableCaps as yt, StorageCleanupJobSchema as z, supportedRuntimes as zn, makeSecretMarker as zr, isDefaultAppConnectionEndpoint as zt };
+export { backupCapability as $, vectorStoreCapability as $n, readinessKey as $r, keychainCapability as $t, HUB_MDNS_SERVICE_TYPE as A, resolveHubAddressRoles as An, buildSecretRef as Ar, deviceStatusCapability as At, STORAGE_ACCESS_FALLBACK as B, snapshotCapability as Bn, hydrateSchema as Br, foldSnapshotByFunction as Bt, DEVICE_SAN_CREDENTIAL_PREFIX as C, ptzAutotrackCapability as Cn, ReadinessRegistry as Cr, defineExtensionSlotProvider as Ct, FIRST_LEVEL_MACRO_CLASSES as D, resolveBucketMs as Dn, asJsonObject as Dr, deviceExtensionCapability as Dt, DeviceStatusSchema as E, resolveAppConnections as En, WELL_KNOWN_TAB_MAP as Er, deviceCredentialsCapability as Et, METHOD_ACCESS_MAP as F, scopesAllowAddon as Fn, defineCustomActions as Fr, evictionPolicyOfLocation as Ft, StorageLocationTypeSchema as G, streamCatalogCapability as Gn, isSecretMarker as Gr, isArrayOutputSchema as Gt, ScopedTokenSchema as H, storageMigrationCapability as Hn, isEvent as Hr, formatMinutes as Ht, MINUTES_PER_DAY as I, scopesAllowDeviceCap as In, emitDownForOwnedCaps as Ir, expandContainer as It, addonPagesCapability as J, userManagementCapability as Jn, nodePin as Jr, isLocationEnabled as Jt, StorageMigrationJobSchema as K, streamQualityLabel as Kn, isSecretMarkerLike as Kr, isCollectionArrayMethod as Kt, MOTION_CLOSE_AFTER_MS as L, scoreRuntimes as Ln, emitReadiness as Lr, expressionContainsBuiltinCall as Lt, KEYCHAIN_RESET_TRIGGER_ACTOR as M, resolveMethodAuth as Mn, collectZodSecretPaths as Mr, enumerateItemArrayFields as Mt, LOG_LEVEL_RANK as N, resolveNotificationTapAddress as Nn, createEvent as Nr, enumerateSchemaFields as Nt, FieldClaimModeSchema as O, resolveCoreBlockEntry as On, asNumber as Or, deviceManagerCapability as Ot, LegacyStorageLocationDefaultSchema as P, runtimeStatePolicyFor as Pn, customAction as Pr, evaluateCompositionField as Pt, authProviderCapability as Q, vectorIndexDimConflictError as Qn, parseSecretRef as Qr, keychainAdminCapability as Qt, RECORDING_SOURCE_CAMSTACK_ADDON as R, settingsStoreCapability as Rn, expandCapMethods as Rr, extractNestedAddonId as Rt, DEVICE_NONCE_TTL_MS as S, procedureAuthKey as Sn, RUNTIME_DEFAULTS as Sr, decodeVectorBase64 as St, DeclaredDevices as T, replacedFieldKeys as Tn, SECRET_CLEAR as Tr, describeComposableCaps as Tt, StorageCleanupJobSchema as U, storageOccupancyCapability as Un, isKeychainStoredField as Ur, gbToBytes as Ut, STREAM_PROFILE_META as V, storageCapability as Vn, isDeviceConfigCap as Vr, formatDeviceRevoker as Vt, StorageLocationModeSchema as W, storageProviderCapability as Wn, isSecretClear as Wr, isAppLinkBase as Wt, addonWidgetsCapability as X, validateCustomAddress as Xn, parseJsonObject as Xr, isVoidInput as Xt, addonSettingsCapability as Y, validateComposition as Yn, normalizeSecretOwner as Yr, isObjectInput as Yt, alertsCapability as Z, vectorDimFromBase64 as Zn, parseJsonUnknown as Zr, kebabToCamel as Zt, DATABASE_SNAPSHOT_TIMEOUT_MS as _, objectInputDeclaresRequiredDeviceId as _n, BaseAddon as _r, coreBlocksCapability as _t, BatteryStatusSchema as a, sleep as ai, logDestinationCapability as an, composedDeviceStableId as ar, buildStreamParamsConfigSchema as at, DERIVED_CAMERA_SILENCED_CAP_NAMES as b, planComposition as bn, DEVICE_STATUS_METHOD as br, databaseSnapshotCapability as bt, CAP_NAMES_WITH_STATUS as c, transformSecretWrite as ci, mayReadLocation as cn, compositionSliceKey as cr, canonicalIconKey as ct, CORE_BLOCKS_ADDON_ID as d, metricsProviderCapability as dn, disarmRoseMemory as dr, compositionFieldKey as dt, resolveCapMount as ei, legacyAutoLinkIds as en, withLocationMode as er, bareAddonId as et, CORE_BLOCK_ADDON_PREFIX as f, modeMayWrite as fn, toExpressionValue as fr, compositionSourceRefs as ft, DATABASE_SNAPSHOT_SUFFIX as g, objectInputDeclaresAddonId as gn, errMsg as gr, coreBlockSourceKind as gt, DATABASE_SNAPSHOT_PARTIAL_SUFFIX as h, normalizeUnit as hn, DeviceType as hr, coreBlockIdFromAddonId as ht, BaseDevice as i, secretTreeFromSchema as ii, locationIconKey as in, composedDeviceRef as ir, buildDeviceSignatureMessage as it, HUB_MDNS_TXT_KEYS as j, resolveLocationMode as jn, collectSecretConfigKeys as jr, enumerateInferenceDevices as jt, FieldClaimSchema as k, resolveCoreBlockFiles as kn, asString$1 as kr, deviceStateCapability as kt, COMPOSED_ITEM_FIXED_FIELDS as l, EventCategory as li, mayWriteToLocation as ln, compositionSourceKey as lr, checkRoleAddress as lt, CoreBlockSchema as m, normalizeCoreBlockWrite as mn, DeviceRole as mr, coreBlockComposition as mt, AlertSchema as n, scopeKey as ni, lifecycleJobSchema as nn, buildFfmpegArgs as nr, buildCapabilityLookup as nt, CAMERA_SWITCH_ORDER as o, toNodeId as oi, logLevelAtMost as on, compositionFeatureEnabled as or, calendarsCapability as ot, CalendarPreferencesSchema as p, motionCapability as pn, DeviceFeature as pr, coreBlockAddonId as pt, UserRecordSchema as q, supportedRuntimes as qn, makeSecretMarker as qr, isDefaultAppConnectionEndpoint as qt, ApiKeyRecordSchema as r, secretTreeFromPaths as ri, localNetworkCapability as rn, cloneStatefulExpressionMemory as rr, buildDeviceEnrollmentLink as rt, CAMSTACK_APP_LINK_ORIGIN as s, toSecretFieldView as si, looseSchema as sn, compositionItemFieldPath as sr, cameraGridLayoutCapability as st, ALL_CAPABILITY_DEFINITIONS as t, resolveSecretMarkers as ti, legacyModeOf as tn, COMPOSER_ADDON_ID as tr, batteryCapability as tt, COMPOSER_RUNNER_ID as u, memoizePinnedFfmpeg as un, createStatefulExpressionMemory as ur, composerCapability as ut, DATA_STORE_DATABASES as v, parseStreamParamsFormPatch as vn, DATAPLANE_SECRET_HEADER as vr, createDeviceExtensionProvider as vt, DEVICE_SAN_USER_PREFIX as w, reducePoints as wn, ReadinessTimeoutError as wr, deriveBatteryPresence as wt, DEVICE_ENROLLMENT_TTL_MS as x, platformProbeCapability as xn, REDACTED_SECRET as xr, declarationOwnerNodeId as xt, DAY_NAMES as y, pickAppLinkHub as yn, DEVICE_SETTINGS_CONTRIBUTION_METHODS as yr, dataStoreProviderCapability as yt, RecordingStatusSchema as z, siteZoneKey as zn, formatSecretScope as zr, filesystemBrowseCapability as zt };

package/dist/file-host-worker.js

@@ -1,5 +1,5 @@
 require("./chunk-Cek0wNdY.js");
-const require_wal_maintenance = require("./wal-maintenance-DItkuOvu.js");
+const require_wal_maintenance = require("./wal-maintenance-BSGsxKW7.js");
 let node_worker_threads = require("node:worker_threads");
 //#region src/builtins/sqlite-storage/file-host-worker.ts
 /**

package/dist/file-host-worker.mjs

@@ -1,4 +1,4 @@
-import { C as callControl, E as controlTargetOf, T as callVector, _ as collectTransferables, a as WalMaintenance, b as isFileHostWorkerData, c as SqliteSettingsBackend, h as serializeError, o as createVectorIndex, s as vectorProviderOf, w as callData, x as trustInput, y as isFileHostRequest } from "./wal-maintenance-Drqhcjit.mjs";
+import { C as callControl, E as controlTargetOf, T as callVector, _ as collectTransferables, a as WalMaintenance, b as isFileHostWorkerData, c as SqliteSettingsBackend, h as serializeError, o as createVectorIndex, s as vectorProviderOf, w as callData, x as trustInput, y as isFileHostRequest } from "./wal-maintenance-DW0FfGV7.mjs";
 import { parentPort, threadId, workerData } from "node:worker_threads";
 //#region src/builtins/sqlite-storage/file-host-worker.ts
 /**

package/dist/index.d.ts

@@ -16,11 +16,14 @@ export type { CreateLoginSessionInput, LoginSessionCheck, LoginSessionMethod, Lo
 export { LoginSessionManager, REFRESH_TOKEN_PREFIX } from "./auth/login-session-manager.js";
 export type { AdminTokenRecord } from "./auth/admin-token-manager.js";
 export { ADMIN_TOKEN_MAX_LIFETIME_MS, ADMIN_TOKEN_PREFIX, AdminTokenManager } from "./auth/admin-token-manager.js";
+export { DeviceCaStore } from "./auth/device-ca-store.js";
+export { DEVICE_CA_KEY_REF, type DeviceCaSigner, generateDeviceCa, issueDeviceLeaf, loadDeviceCa, verifyDeviceLeaf, verifyDeviceSignature } from "./auth/device-ca.js";
+export { type AuthenticatedDevice, DeviceCredentialManager, type DeviceCredentialRecord, type DeviceCredentialState, PREVIOUS_LEAF_GRACE_MS, type DeviceCheckRefusal, type IssuedDeviceCertificate } from "./auth/device-credential-manager.js";
 export { AuthAuditLog } from "./auth/auth-audit-log.js";
 export type { AuthAuditAction, AuthAuditEvent, AuthAuditRecord } from "./auth/auth-audit-log.js";
 export type { CidrMatcher, ParsedCidr, ParsedCidrList } from "./auth/cidr.js";
 export { createCidrMatcher, normalizeIp, parseCidrList, readCidrSetting } from "./auth/cidr.js";
-export type { AdminTokensInternal, AuthAuditInternal, LinkExternalIdentityInput, LoginSessionsInternal, SetPasswordInput, UserManagementInternal } from "./auth/user-management-internal.js";
+export type { AdminTokensInternal, AuthAuditInternal, DeviceCredentialsInternal, LinkExternalIdentityInput, LoginSessionsInternal, SetPasswordInput, UserManagementInternal } from "./auth/user-management-internal.js";
 export { attachUserManagementInternal, getUserManagementInternal, USER_MANAGEMENT_INTERNAL } from "./auth/user-management-internal.js";
 export type { UserRecord, UserStorageAccess } from "./auth/user-manager.js";
 export { FIRST_BOOT_ADMIN_PASSWORD, FIRST_BOOT_ADMIN_USERNAME, UserManager } from "./auth/user-manager.js";