@camstack/types 1.2.363 → 1.2.365

package/dist/generated/addon-api.d.ts

@@ -42,6 +42,7 @@ import type { dayNightCapability } from '../capabilities/day-night.cap.js';
 import type { decoderCapability } from '../capabilities/decoder.cap.js';
 import type { deviceAdminLinkCapability } from '../capabilities/device-admin-link.cap.js';
 import type { deviceAdoptionCapability } from '../capabilities/device-adoption.cap.js';
+import type { deviceCredentialsCapability } from '../capabilities/device-credentials.cap.js';
 import type { deviceDiscoveryCapability } from '../capabilities/device-discovery.cap.js';
 import type { deviceExportCapability } from '../capabilities/device-export.cap.js';
 import type { deviceExtensionCapability } from '../capabilities/device-extension.cap.js';
@@ -82,6 +83,7 @@ import type { nativeObjectDetectionCapability } from '../capabilities/native-obj
 import type { navigationCapability } from '../capabilities/navigation.cap.js';
 import type { networkAccessCapability } from '../capabilities/network-access.cap.js';
 import type { networkQualityCapability } from '../capabilities/network-quality.cap.js';
+import type { nodeCertificatesCapability } from '../capabilities/node-certificates.cap.js';
 import type { nodesCapability } from '../capabilities/nodes.cap.js';
 import type { notificationOutputCapability } from '../capabilities/notification-output.cap.js';
 import type { notificationRulesCapability } from '../capabilities/notification-rules.cap.js';
@@ -2145,6 +2147,69 @@ export type AppRouter = TrpcCoreRouter<{
             meta: object;
         }>;
     }>>;
+    deviceCredentials: TRPCBuiltRouter<{
+        ctx: TrpcContext;
+        meta: object;
+        errorShape: AugmentedErrorShape;
+        transformer: true;
+    }, TRPCDecorateCreateRouterOptions<{
+        listDeviceCredentials: TRPCQueryProcedure<{
+            input: {
+                [x: string]: unknown;
+            } & z.input<typeof deviceCredentialsCapability.methods.listDeviceCredentials.input>;
+            output: z.infer<typeof deviceCredentialsCapability.methods.listDeviceCredentials.output>;
+            meta: object;
+        }>;
+        startEnrollment: TRPCMutationProcedure<{
+            input: {
+                [x: string]: unknown;
+            } & z.input<typeof deviceCredentialsCapability.methods.startEnrollment.input>;
+            output: z.infer<typeof deviceCredentialsCapability.methods.startEnrollment.output>;
+            meta: object;
+        }>;
+        revokeDeviceCredential: TRPCMutationProcedure<{
+            input: {
+                [x: string]: unknown;
+            } & z.input<typeof deviceCredentialsCapability.methods.revokeDeviceCredential.input>;
+            output: z.infer<typeof deviceCredentialsCapability.methods.revokeDeviceCredential.output>;
+            meta: object;
+        }>;
+        getDeviceCertificateSettings: TRPCQueryProcedure<{
+            input: {
+                [x: string]: unknown;
+            } & z.input<typeof deviceCredentialsCapability.methods.getDeviceCertificateSettings.input>;
+            output: z.infer<typeof deviceCredentialsCapability.methods.getDeviceCertificateSettings.output>;
+            meta: object;
+        }>;
+        setDeviceCertificateSettings: TRPCMutationProcedure<{
+            input: {
+                [x: string]: unknown;
+            } & z.input<typeof deviceCredentialsCapability.methods.setDeviceCertificateSettings.input>;
+            output: z.infer<typeof deviceCredentialsCapability.methods.setDeviceCertificateSettings.output>;
+            meta: object;
+        }>;
+        deleteDeviceCredential: TRPCMutationProcedure<{
+            input: {
+                [x: string]: unknown;
+            } & z.input<typeof deviceCredentialsCapability.methods.deleteDeviceCredential.input>;
+            output: z.infer<typeof deviceCredentialsCapability.methods.deleteDeviceCredential.output>;
+            meta: object;
+        }>;
+        getDeviceCaStatus: TRPCQueryProcedure<{
+            input: {
+                [x: string]: unknown;
+            } & z.input<typeof deviceCredentialsCapability.methods.getDeviceCaStatus.input>;
+            output: z.infer<typeof deviceCredentialsCapability.methods.getDeviceCaStatus.output>;
+            meta: object;
+        }>;
+        renameDeviceCredential: TRPCMutationProcedure<{
+            input: {
+                [x: string]: unknown;
+            } & z.input<typeof deviceCredentialsCapability.methods.renameDeviceCredential.input>;
+            output: z.infer<typeof deviceCredentialsCapability.methods.renameDeviceCredential.output>;
+            meta: object;
+        }>;
+    }>>;
     deviceDiscovery: TRPCBuiltRouter<{
         ctx: TrpcContext;
         meta: object;
@@ -5016,6 +5081,62 @@ export type AppRouter = TrpcCoreRouter<{
             meta: object;
         }>;
     }>>;
+    nodeCertificates: TRPCBuiltRouter<{
+        ctx: TrpcContext;
+        meta: object;
+        errorShape: AugmentedErrorShape;
+        transformer: true;
+    }, TRPCDecorateCreateRouterOptions<{
+        getCertificates: TRPCQueryProcedure<{
+            input: {
+                [x: string]: unknown;
+            } & z.input<typeof nodeCertificatesCapability.methods.getCertificates.input>;
+            output: z.infer<typeof nodeCertificatesCapability.methods.getCertificates.output>;
+            meta: object;
+        }>;
+        prepareMeshRenewal: TRPCMutationProcedure<{
+            input: {
+                [x: string]: unknown;
+            } & z.input<typeof nodeCertificatesCapability.methods.prepareMeshRenewal.input>;
+            output: z.infer<typeof nodeCertificatesCapability.methods.prepareMeshRenewal.output>;
+            meta: object;
+        }>;
+        installMeshLeaf: TRPCMutationProcedure<{
+            input: {
+                [x: string]: unknown;
+            } & z.input<typeof nodeCertificatesCapability.methods.installMeshLeaf.input>;
+            output: z.infer<typeof nodeCertificatesCapability.methods.installMeshLeaf.output>;
+            meta: object;
+        }>;
+        confirmMeshLeaf: TRPCMutationProcedure<{
+            input: {
+                [x: string]: unknown;
+            } & z.input<typeof nodeCertificatesCapability.methods.confirmMeshLeaf.input>;
+            output: z.infer<typeof nodeCertificatesCapability.methods.confirmMeshLeaf.output>;
+            meta: object;
+        }>;
+        rollbackMeshLeaf: TRPCMutationProcedure<{
+            input: {
+                [x: string]: unknown;
+            } & z.input<typeof nodeCertificatesCapability.methods.rollbackMeshLeaf.input>;
+            output: z.infer<typeof nodeCertificatesCapability.methods.rollbackMeshLeaf.output>;
+            meta: object;
+        }>;
+        prepareHttpsCertificate: TRPCMutationProcedure<{
+            input: {
+                [x: string]: unknown;
+            } & z.input<typeof nodeCertificatesCapability.methods.prepareHttpsCertificate.input>;
+            output: z.infer<typeof nodeCertificatesCapability.methods.prepareHttpsCertificate.output>;
+            meta: object;
+        }>;
+        installHttpsCertificate: TRPCMutationProcedure<{
+            input: {
+                [x: string]: unknown;
+            } & z.input<typeof nodeCertificatesCapability.methods.installHttpsCertificate.input>;
+            output: z.infer<typeof nodeCertificatesCapability.methods.installHttpsCertificate.output>;
+            meta: object;
+        }>;
+    }>>;
     nodes: TRPCBuiltRouter<{
         ctx: TrpcContext;
         meta: object;
@@ -11290,6 +11411,268 @@ export type AppRouter = TrpcCoreRouter<{
             meta: object;
         }>;
     }>;
+    certificates: import("@trpc/server/unstable-core-do-not-import").Router<{
+        ctx: any;
+        meta: object;
+        errorShape: AugmentedErrorShape;
+        transformer: true;
+    }, import("@trpc/server/unstable-core-do-not-import").DecorateCreateRouterOptions<{
+        listHttpsCertificates: import("@trpc/server/unstable-core-do-not-import").QueryProcedure<{
+            input: void;
+            output: {
+                nodeId: string;
+                isHub: boolean;
+                online: boolean;
+                https: {
+                    kind: "served";
+                    status: {
+                        mode: "generated" | "uploaded" | "disabled";
+                        leafFingerprintSha256: string | null;
+                        caFingerprintSha256: string | null;
+                        validTo: string | null;
+                        sans: string[];
+                        reissueError: string | null;
+                        restartRequired: boolean;
+                    };
+                } | {
+                    kind: "not-served";
+                    reason: string;
+                } | {
+                    kind: "unreadable";
+                    reason: string;
+                };
+            }[];
+            meta: object;
+        }>;
+        renewHttpsOnNode: import("@trpc/server/unstable-core-do-not-import").MutationProcedure<{
+            input: {
+                nodeId: string;
+                reason?: string | undefined;
+            };
+            output: {
+                mode: "generated" | "uploaded" | "disabled";
+                leafFingerprintSha256: string | null;
+                caFingerprintSha256: string | null;
+                validTo: string | null;
+                sans: string[];
+                reissueError: string | null;
+                restartRequired: boolean;
+            };
+            meta: object;
+        }>;
+        getMeshCertificates: import("@trpc/server/unstable-core-do-not-import").QueryProcedure<{
+            input: void;
+            output: {
+                ca: {
+                    state: "ready";
+                    subject: string;
+                    fingerprintSha256: string;
+                    validTo: string;
+                } | {
+                    state: "unavailable";
+                    reason: string;
+                };
+                revokedSerials: string[];
+                registryAvailable: boolean;
+                listener: {
+                    state: "open";
+                } | {
+                    state: "closed";
+                    reason: string;
+                    since: number;
+                } | {
+                    state: "not-started";
+                };
+                nodes: {
+                    nodeId: string;
+                    online: boolean;
+                    current: {
+                        serial: string;
+                        fingerprintSha256: string;
+                        notBefore: number;
+                        notAfter: number;
+                        issuedAt: number;
+                        issuedVia: "enroll" | "renewal" | "boot" | "observed";
+                        status: "valid" | "expiring" | "expired" | "revoked";
+                        revokedAt: number | null;
+                        revokedReason: string | null;
+                    } | null;
+                    presentingCurrent: boolean | null;
+                    history: {
+                        serial: string;
+                        fingerprintSha256: string;
+                        notBefore: number;
+                        notAfter: number;
+                        issuedAt: number;
+                        issuedVia: "enroll" | "renewal" | "boot" | "observed";
+                        status: "valid" | "expiring" | "expired" | "revoked";
+                        revokedAt: number | null;
+                        revokedReason: string | null;
+                    }[];
+                }[];
+            };
+            meta: object;
+        }>;
+        renewMeshOnNode: import("@trpc/server/unstable-core-do-not-import").MutationProcedure<{
+            input: {
+                nodeId: string;
+            };
+            output: {
+                ok: true;
+                nodeId: string;
+                oldSerial: string | null;
+                newSerial: string;
+                newNotAfter: number;
+            } | {
+                ok: false;
+                nodeId: string;
+                stage: "prepare" | "issue" | "install" | "reconnect" | "confirm";
+                reason: string;
+                keptPreviousLeaf: boolean;
+            };
+            meta: object;
+        }>;
+        revokeMeshOnNode: import("@trpc/server/unstable-core-do-not-import").MutationProcedure<{
+            input: {
+                nodeId: string;
+            };
+            output: {
+                nodeId: string;
+                revokedSerials: string[];
+                disconnected: number;
+                next: string;
+            };
+            meta: object;
+        }>;
+    }>> & import("@trpc/server/unstable-core-do-not-import").DecorateCreateRouterOptions<{
+        listHttpsCertificates: import("@trpc/server/unstable-core-do-not-import").QueryProcedure<{
+            input: void;
+            output: {
+                nodeId: string;
+                isHub: boolean;
+                online: boolean;
+                https: {
+                    kind: "served";
+                    status: {
+                        mode: "generated" | "uploaded" | "disabled";
+                        leafFingerprintSha256: string | null;
+                        caFingerprintSha256: string | null;
+                        validTo: string | null;
+                        sans: string[];
+                        reissueError: string | null;
+                        restartRequired: boolean;
+                    };
+                } | {
+                    kind: "not-served";
+                    reason: string;
+                } | {
+                    kind: "unreadable";
+                    reason: string;
+                };
+            }[];
+            meta: object;
+        }>;
+        renewHttpsOnNode: import("@trpc/server/unstable-core-do-not-import").MutationProcedure<{
+            input: {
+                nodeId: string;
+                reason?: string | undefined;
+            };
+            output: {
+                mode: "generated" | "uploaded" | "disabled";
+                leafFingerprintSha256: string | null;
+                caFingerprintSha256: string | null;
+                validTo: string | null;
+                sans: string[];
+                reissueError: string | null;
+                restartRequired: boolean;
+            };
+            meta: object;
+        }>;
+        getMeshCertificates: import("@trpc/server/unstable-core-do-not-import").QueryProcedure<{
+            input: void;
+            output: {
+                ca: {
+                    state: "ready";
+                    subject: string;
+                    fingerprintSha256: string;
+                    validTo: string;
+                } | {
+                    state: "unavailable";
+                    reason: string;
+                };
+                revokedSerials: string[];
+                registryAvailable: boolean;
+                listener: {
+                    state: "open";
+                } | {
+                    state: "closed";
+                    reason: string;
+                    since: number;
+                } | {
+                    state: "not-started";
+                };
+                nodes: {
+                    nodeId: string;
+                    online: boolean;
+                    current: {
+                        serial: string;
+                        fingerprintSha256: string;
+                        notBefore: number;
+                        notAfter: number;
+                        issuedAt: number;
+                        issuedVia: "enroll" | "renewal" | "boot" | "observed";
+                        status: "valid" | "expiring" | "expired" | "revoked";
+                        revokedAt: number | null;
+                        revokedReason: string | null;
+                    } | null;
+                    presentingCurrent: boolean | null;
+                    history: {
+                        serial: string;
+                        fingerprintSha256: string;
+                        notBefore: number;
+                        notAfter: number;
+                        issuedAt: number;
+                        issuedVia: "enroll" | "renewal" | "boot" | "observed";
+                        status: "valid" | "expiring" | "expired" | "revoked";
+                        revokedAt: number | null;
+                        revokedReason: string | null;
+                    }[];
+                }[];
+            };
+            meta: object;
+        }>;
+        renewMeshOnNode: import("@trpc/server/unstable-core-do-not-import").MutationProcedure<{
+            input: {
+                nodeId: string;
+            };
+            output: {
+                ok: true;
+                nodeId: string;
+                oldSerial: string | null;
+                newSerial: string;
+                newNotAfter: number;
+            } | {
+                ok: false;
+                nodeId: string;
+                stage: "prepare" | "issue" | "install" | "reconnect" | "confirm";
+                reason: string;
+                keptPreviousLeaf: boolean;
+            };
+            meta: object;
+        }>;
+        revokeMeshOnNode: import("@trpc/server/unstable-core-do-not-import").MutationProcedure<{
+            input: {
+                nodeId: string;
+            };
+            output: {
+                nodeId: string;
+                revokedSerials: string[];
+                disconnected: number;
+                next: string;
+            };
+            meta: object;
+        }>;
+    }>;
     auth: import("@trpc/server/unstable-core-do-not-import").Router<{
         ctx: any;
         meta: object;
@@ -11320,7 +11703,7 @@ export type AppRouter = TrpcCoreRouter<{
                 code: string;
             };
             output: {
-                outcome: "session" | "linked" | "conflict" | "expired";
+                outcome: "session" | "expired" | "linked" | "conflict";
                 provider?: string | undefined;
             };
             meta: object;
@@ -11384,6 +11767,19 @@ export type AppRouter = TrpcCoreRouter<{
                 stage: "primary" | "second-factor";
                 rpId: string;
                 origin: string | null;
+            } | {
+                kind: "device-certificate";
+                id: "device-certificate";
+                label: string;
+                stage: "primary";
+                challengePath: "auth.getDeviceChallenge";
+                revokePath: "auth.revokeOwnDeviceCertificate";
+                enrollSelfPath: "auth.enrollSelf";
+                loginPath: "auth.loginWithDeviceCertificate";
+                renewPath: "auth.renewDeviceCertificate";
+                signature: "ecdsa-p256-sha256";
+                messageVersion: "camstack-device-cert-v1";
+                clients: ("web" | "native")[];
             })[];
             meta: object;
         }>;
@@ -11481,6 +11877,193 @@ export type AppRouter = TrpcCoreRouter<{
             };
             meta: object;
         }>;
+        completeEnrollment: import("@trpc/server/unstable-core-do-not-import").MutationProcedure<{
+            input: {
+                code: string;
+                publicKeySpki: string;
+                platform: "android" | "ios" | "other" | "web";
+                deviceName?: string | undefined;
+            };
+            output: {
+                credentialId: string;
+                certPem: string;
+                chainPem: string;
+                notAfter: number;
+                user: {
+                    id: string;
+                    username: string;
+                };
+                ok: true;
+            } | {
+                ok: false;
+                reason: "unavailable" | "expired" | "revoked" | "bad-public-key" | "bad-signature" | "code-invalid" | "invalid-certificate" | "nonce-invalid" | "rate-limited" | "self-enrollment-disabled" | "step-up-required" | "superseded" | "unknown-credential" | "user-gone";
+                definitive: boolean;
+                retryAfterSeconds?: number | undefined;
+            };
+            meta: object;
+        }>;
+        getDeviceChallenge: import("@trpc/server/unstable-core-do-not-import").MutationProcedure<{
+            input: void;
+            output: {
+                nonce: string;
+                origin: string;
+                expiresAt: number;
+                signature: "ecdsa-p256-sha256";
+                ok: true;
+            } | {
+                ok: false;
+                reason: "unavailable" | "expired" | "revoked" | "bad-public-key" | "bad-signature" | "code-invalid" | "invalid-certificate" | "nonce-invalid" | "rate-limited" | "self-enrollment-disabled" | "step-up-required" | "superseded" | "unknown-credential" | "user-gone";
+                definitive: boolean;
+                retryAfterSeconds?: number | undefined;
+            };
+            meta: object;
+        }>;
+        loginWithDeviceCertificate: import("@trpc/server/unstable-core-do-not-import").MutationProcedure<{
+            input: {
+                certPem: string;
+                nonce: string;
+                signature: string;
+                refreshable?: boolean | undefined;
+            };
+            output: {
+                ok: false;
+                reason: "unavailable" | "expired" | "revoked" | "bad-public-key" | "bad-signature" | "code-invalid" | "invalid-certificate" | "nonce-invalid" | "rate-limited" | "self-enrollment-disabled" | "step-up-required" | "superseded" | "unknown-credential" | "user-gone";
+                definitive: boolean;
+                retryAfterSeconds?: number | undefined;
+            } | {
+                ok: true;
+                token: string;
+                user: {
+                    id: string;
+                    username: string;
+                    isAdmin: boolean;
+                };
+                credentialId: string;
+                certNotAfter: number;
+                expiresAt?: number | undefined;
+                sessionId?: string | undefined;
+                sessionExpiresAt?: number | undefined;
+                refreshToken?: string | undefined;
+            };
+            meta: object;
+        }>;
+        renewDeviceCertificate: import("@trpc/server/unstable-core-do-not-import").MutationProcedure<{
+            input: {
+                certPem: string;
+                nonce: string;
+                signature: string;
+            };
+            output: {
+                credentialId: string;
+                certPem: string;
+                chainPem: string;
+                notAfter: number;
+                ok: true;
+            } | {
+                ok: false;
+                reason: "unavailable" | "expired" | "revoked" | "bad-public-key" | "bad-signature" | "code-invalid" | "invalid-certificate" | "nonce-invalid" | "rate-limited" | "self-enrollment-disabled" | "step-up-required" | "superseded" | "unknown-credential" | "user-gone";
+                definitive: boolean;
+                retryAfterSeconds?: number | undefined;
+            };
+            meta: object;
+        }>;
+        revokeOwnDeviceCertificate: import("@trpc/server/unstable-core-do-not-import").MutationProcedure<{
+            input: {
+                certPem: string;
+                nonce: string;
+                signature: string;
+            };
+            output: {
+                ok: true;
+                credentialId: string;
+                sessionsEnded: number;
+            } | {
+                ok: false;
+                reason: "unavailable" | "expired" | "revoked" | "bad-public-key" | "bad-signature" | "code-invalid" | "invalid-certificate" | "nonce-invalid" | "rate-limited" | "self-enrollment-disabled" | "step-up-required" | "superseded" | "unknown-credential" | "user-gone";
+                definitive: boolean;
+                retryAfterSeconds?: number | undefined;
+            };
+            meta: object;
+        }>;
+        listOwnDeviceCredentials: import("@trpc/server/unstable-core-do-not-import").QueryProcedure<{
+            input: {
+                includeRevoked?: boolean | undefined;
+            } | undefined;
+            output: {
+                id: string;
+                userId: string;
+                username: string | null;
+                deviceName: string;
+                platform: "android" | "ios" | "other" | "web";
+                enrolledVia: "self" | "qr";
+                fingerprint: string;
+                issuedAt: number;
+                expiresAt: number;
+                lastUsedAt: number | null;
+                lastUsedFrom: string | null;
+                revokedAt: number | null;
+                revokedBy: string | null;
+                status: "expired" | "revoked" | "active";
+            }[];
+            meta: object;
+        }>;
+        revokeOwnDeviceCredential: import("@trpc/server/unstable-core-do-not-import").MutationProcedure<{
+            input: {
+                id: string;
+            };
+            output: {
+                revoked: boolean;
+                sessionsEnded: number;
+            };
+            meta: object;
+        }>;
+        deviceEnrollProofFromReauth: import("@trpc/server/unstable-core-do-not-import").MutationProcedure<{
+            input: {
+                reauthToken: string;
+            };
+            output: {
+                proof: string;
+                expiresAt: number;
+            };
+            meta: object;
+        }>;
+        deviceEnrollProofFromHandoff: import("@trpc/server/unstable-core-do-not-import").MutationProcedure<{
+            input: {
+                code: string;
+                codeVerifier?: string | undefined;
+                state?: string | undefined;
+            };
+            output: {
+                proof: string;
+                expiresAt: number;
+            };
+            meta: object;
+        }>;
+        enrollSelf: import("@trpc/server/unstable-core-do-not-import").MutationProcedure<{
+            input: {
+                proof: string;
+                publicKeySpki: string;
+                deviceName: string;
+                platform: "android" | "ios" | "other" | "web";
+            };
+            output: {
+                credentialId: string;
+                certPem: string;
+                chainPem: string;
+                notAfter: number;
+                user: {
+                    id: string;
+                    username: string;
+                };
+                ok: true;
+            } | {
+                ok: false;
+                reason: "unavailable" | "expired" | "revoked" | "bad-public-key" | "bad-signature" | "code-invalid" | "invalid-certificate" | "nonce-invalid" | "rate-limited" | "self-enrollment-disabled" | "step-up-required" | "superseded" | "unknown-credential" | "user-gone";
+                definitive: boolean;
+                retryAfterSeconds?: number | undefined;
+            };
+            meta: object;
+        }>;
         refreshSession: import("@trpc/server/unstable-core-do-not-import").MutationProcedure<{
             input: {
                 refreshToken: string;
@@ -11688,7 +12271,10 @@ export type AppRouter = TrpcCoreRouter<{
         }>;
         createHandoffCode: import("@trpc/server/unstable-core-do-not-import").MutationProcedure<{
             input: {
-                purpose?: "renew" | "new-session" | undefined;
+                purpose?: "renew" | "new-session" | "step-up" | undefined;
+                codeChallenge?: string | undefined;
+                state?: string | undefined;
+                reauthToken?: string | undefined;
             } | undefined;
             output: {
                 code: string;
@@ -11700,6 +12286,8 @@ export type AppRouter = TrpcCoreRouter<{
             input: {
                 code: string;
                 refreshable?: boolean | undefined;
+                codeVerifier?: string | undefined;
+                state?: string | undefined;
             };
             output: {
                 token: string;
@@ -11975,7 +12563,7 @@ export type AppRouter = TrpcCoreRouter<{
                 code: string;
             };
             output: {
-                outcome: "session" | "linked" | "conflict" | "expired";
+                outcome: "session" | "expired" | "linked" | "conflict";
                 provider?: string | undefined;
             };
             meta: object;
@@ -12039,6 +12627,19 @@ export type AppRouter = TrpcCoreRouter<{
                 stage: "primary" | "second-factor";
                 rpId: string;
                 origin: string | null;
+            } | {
+                kind: "device-certificate";
+                id: "device-certificate";
+                label: string;
+                stage: "primary";
+                challengePath: "auth.getDeviceChallenge";
+                revokePath: "auth.revokeOwnDeviceCertificate";
+                enrollSelfPath: "auth.enrollSelf";
+                loginPath: "auth.loginWithDeviceCertificate";
+                renewPath: "auth.renewDeviceCertificate";
+                signature: "ecdsa-p256-sha256";
+                messageVersion: "camstack-device-cert-v1";
+                clients: ("web" | "native")[];
             })[];
             meta: object;
         }>;
@@ -12136,6 +12737,193 @@ export type AppRouter = TrpcCoreRouter<{
             };
             meta: object;
         }>;
+        completeEnrollment: import("@trpc/server/unstable-core-do-not-import").MutationProcedure<{
+            input: {
+                code: string;
+                publicKeySpki: string;
+                platform: "android" | "ios" | "other" | "web";
+                deviceName?: string | undefined;
+            };
+            output: {
+                credentialId: string;
+                certPem: string;
+                chainPem: string;
+                notAfter: number;
+                user: {
+                    id: string;
+                    username: string;
+                };
+                ok: true;
+            } | {
+                ok: false;
+                reason: "unavailable" | "expired" | "revoked" | "bad-public-key" | "bad-signature" | "code-invalid" | "invalid-certificate" | "nonce-invalid" | "rate-limited" | "self-enrollment-disabled" | "step-up-required" | "superseded" | "unknown-credential" | "user-gone";
+                definitive: boolean;
+                retryAfterSeconds?: number | undefined;
+            };
+            meta: object;
+        }>;
+        getDeviceChallenge: import("@trpc/server/unstable-core-do-not-import").MutationProcedure<{
+            input: void;
+            output: {
+                nonce: string;
+                origin: string;
+                expiresAt: number;
+                signature: "ecdsa-p256-sha256";
+                ok: true;
+            } | {
+                ok: false;
+                reason: "unavailable" | "expired" | "revoked" | "bad-public-key" | "bad-signature" | "code-invalid" | "invalid-certificate" | "nonce-invalid" | "rate-limited" | "self-enrollment-disabled" | "step-up-required" | "superseded" | "unknown-credential" | "user-gone";
+                definitive: boolean;
+                retryAfterSeconds?: number | undefined;
+            };
+            meta: object;
+        }>;
+        loginWithDeviceCertificate: import("@trpc/server/unstable-core-do-not-import").MutationProcedure<{
+            input: {
+                certPem: string;
+                nonce: string;
+                signature: string;
+                refreshable?: boolean | undefined;
+            };
+            output: {
+                ok: false;
+                reason: "unavailable" | "expired" | "revoked" | "bad-public-key" | "bad-signature" | "code-invalid" | "invalid-certificate" | "nonce-invalid" | "rate-limited" | "self-enrollment-disabled" | "step-up-required" | "superseded" | "unknown-credential" | "user-gone";
+                definitive: boolean;
+                retryAfterSeconds?: number | undefined;
+            } | {
+                ok: true;
+                token: string;
+                user: {
+                    id: string;
+                    username: string;
+                    isAdmin: boolean;
+                };
+                credentialId: string;
+                certNotAfter: number;
+                expiresAt?: number | undefined;
+                sessionId?: string | undefined;
+                sessionExpiresAt?: number | undefined;
+                refreshToken?: string | undefined;
+            };
+            meta: object;
+        }>;
+        renewDeviceCertificate: import("@trpc/server/unstable-core-do-not-import").MutationProcedure<{
+            input: {
+                certPem: string;
+                nonce: string;
+                signature: string;
+            };
+            output: {
+                credentialId: string;
+                certPem: string;
+                chainPem: string;
+                notAfter: number;
+                ok: true;
+            } | {
+                ok: false;
+                reason: "unavailable" | "expired" | "revoked" | "bad-public-key" | "bad-signature" | "code-invalid" | "invalid-certificate" | "nonce-invalid" | "rate-limited" | "self-enrollment-disabled" | "step-up-required" | "superseded" | "unknown-credential" | "user-gone";
+                definitive: boolean;
+                retryAfterSeconds?: number | undefined;
+            };
+            meta: object;
+        }>;
+        revokeOwnDeviceCertificate: import("@trpc/server/unstable-core-do-not-import").MutationProcedure<{
+            input: {
+                certPem: string;
+                nonce: string;
+                signature: string;
+            };
+            output: {
+                ok: true;
+                credentialId: string;
+                sessionsEnded: number;
+            } | {
+                ok: false;
+                reason: "unavailable" | "expired" | "revoked" | "bad-public-key" | "bad-signature" | "code-invalid" | "invalid-certificate" | "nonce-invalid" | "rate-limited" | "self-enrollment-disabled" | "step-up-required" | "superseded" | "unknown-credential" | "user-gone";
+                definitive: boolean;
+                retryAfterSeconds?: number | undefined;
+            };
+            meta: object;
+        }>;
+        listOwnDeviceCredentials: import("@trpc/server/unstable-core-do-not-import").QueryProcedure<{
+            input: {
+                includeRevoked?: boolean | undefined;
+            } | undefined;
+            output: {
+                id: string;
+                userId: string;
+                username: string | null;
+                deviceName: string;
+                platform: "android" | "ios" | "other" | "web";
+                enrolledVia: "self" | "qr";
+                fingerprint: string;
+                issuedAt: number;
+                expiresAt: number;
+                lastUsedAt: number | null;
+                lastUsedFrom: string | null;
+                revokedAt: number | null;
+                revokedBy: string | null;
+                status: "expired" | "revoked" | "active";
+            }[];
+            meta: object;
+        }>;
+        revokeOwnDeviceCredential: import("@trpc/server/unstable-core-do-not-import").MutationProcedure<{
+            input: {
+                id: string;
+            };
+            output: {
+                revoked: boolean;
+                sessionsEnded: number;
+            };
+            meta: object;
+        }>;
+        deviceEnrollProofFromReauth: import("@trpc/server/unstable-core-do-not-import").MutationProcedure<{
+            input: {
+                reauthToken: string;
+            };
+            output: {
+                proof: string;
+                expiresAt: number;
+            };
+            meta: object;
+        }>;
+        deviceEnrollProofFromHandoff: import("@trpc/server/unstable-core-do-not-import").MutationProcedure<{
+            input: {
+                code: string;
+                codeVerifier?: string | undefined;
+                state?: string | undefined;
+            };
+            output: {
+                proof: string;
+                expiresAt: number;
+            };
+            meta: object;
+        }>;
+        enrollSelf: import("@trpc/server/unstable-core-do-not-import").MutationProcedure<{
+            input: {
+                proof: string;
+                publicKeySpki: string;
+                deviceName: string;
+                platform: "android" | "ios" | "other" | "web";
+            };
+            output: {
+                credentialId: string;
+                certPem: string;
+                chainPem: string;
+                notAfter: number;
+                user: {
+                    id: string;
+                    username: string;
+                };
+                ok: true;
+            } | {
+                ok: false;
+                reason: "unavailable" | "expired" | "revoked" | "bad-public-key" | "bad-signature" | "code-invalid" | "invalid-certificate" | "nonce-invalid" | "rate-limited" | "self-enrollment-disabled" | "step-up-required" | "superseded" | "unknown-credential" | "user-gone";
+                definitive: boolean;
+                retryAfterSeconds?: number | undefined;
+            };
+            meta: object;
+        }>;
         refreshSession: import("@trpc/server/unstable-core-do-not-import").MutationProcedure<{
             input: {
                 refreshToken: string;
@@ -12343,7 +13131,10 @@ export type AppRouter = TrpcCoreRouter<{
         }>;
         createHandoffCode: import("@trpc/server/unstable-core-do-not-import").MutationProcedure<{
             input: {
-                purpose?: "renew" | "new-session" | undefined;
+                purpose?: "renew" | "new-session" | "step-up" | undefined;
+                codeChallenge?: string | undefined;
+                state?: string | undefined;
+                reauthToken?: string | undefined;
             } | undefined;
             output: {
                 code: string;
@@ -12355,6 +13146,8 @@ export type AppRouter = TrpcCoreRouter<{
             input: {
                 code: string;
                 refreshable?: boolean | undefined;
+                codeVerifier?: string | undefined;
+                state?: string | undefined;
             };
             output: {
                 token: string;