@camstack/types 1.2.364 → 1.2.365

package/dist/addon.js

@@ -16,7 +16,7 @@ const require_err_msg = require("./err-msg-Dx2Kor0g.js");
 * Plain data, zero Zod: a forked runner must not import the schema barrel
 * (~144MB RSS per runner — D28).
 *
-* Coverage: 25 caps, 66 methods with defaults.
+* Coverage: 26 caps, 67 methods with defaults.
 */
 var CAP_INPUT_DEFAULTS = Object.freeze({
 	"addons": { "getLogs": { "limit": 100 } },
@@ -39,6 +39,7 @@ var CAP_INPUT_DEFAULTS = Object.freeze({
 		"page": 1,
 		"pageSize": 50
 	} },
+	"device-credentials": { "listDeviceCredentials": { "includeRevoked": false } },
 	"device-manager": { "adoptionListCandidates": {
 		"page": 1,
 		"pageSize": 50

package/dist/addon.mjs

@@ -15,7 +15,7 @@ import { a as DeviceType, t as errMsg } from "./err-msg-DX6i_MY4.mjs";
 * Plain data, zero Zod: a forked runner must not import the schema barrel
 * (~144MB RSS per runner — D28).
 *
-* Coverage: 25 caps, 66 methods with defaults.
+* Coverage: 26 caps, 67 methods with defaults.
 */
 var CAP_INPUT_DEFAULTS = Object.freeze({
 	"addons": { "getLogs": { "limit": 100 } },
@@ -38,6 +38,7 @@ var CAP_INPUT_DEFAULTS = Object.freeze({
 		"page": 1,
 		"pageSize": 50
 	} },
+	"device-credentials": { "listDeviceCredentials": { "includeRevoked": false } },
 	"device-manager": { "adoptionListCandidates": {
 		"page": 1,
 		"pageSize": 50

package/dist/auth/device-certificate.d.ts

@@ -0,0 +1,372 @@
+/**
+ * Device certificates (D855) — the wire contract shared by the hub, the admin
+ * UI and the native viewer.
+ *
+ * A device (a phone) generates its OWN P-256 key pair in hardware (Secure
+ * Enclave / Android Keystore / a non-extractable WebCrypto key). The private
+ * key never travels. The hub signs the PUBLIC key into an X.509 leaf under a
+ * dedicated device CA; the device later proves possession of the key by
+ * signing a hub-issued nonce, and the hub answers with the same session a
+ * password login opens.
+ *
+ * Everything on the wire is a small string (a PEM, a base64url signature):
+ * D613 is about bulk bytes, and a certificate is ~600 bytes.
+ */
+import { z } from 'zod';
+/** Signature algorithm of every device credential: ECDSA, curve P-256, SHA-256. */
+export declare const DEVICE_CERT_SIGNATURE: 'ecdsa-p256-sha256';
+/** First line of every signed message; a change of format bumps the version. */
+export declare const DEVICE_SIGNATURE_MESSAGE_VERSION: 'camstack-device-cert-v1';
+/** What a signature is for. A login signature can never be replayed as a renewal. */
+export declare const DeviceSignaturePurposeSchema: z.ZodEnum<{
+    login: "login";
+    renew: "renew";
+    revoke: "revoke";
+}>;
+export type DeviceSignaturePurpose = z.infer<typeof DeviceSignaturePurposeSchema>;
+/** Leaf lifetime and the window in which the app renews it. */
+export declare const DEVICE_CERT_VALIDITY_DAYS = 365;
+export declare const DEVICE_CERT_RENEW_WINDOW_DAYS = 30;
+/** One-shot enrollment code and login nonce lifetimes. */
+export declare const DEVICE_ENROLLMENT_TTL_MS: number;
+export declare const DEVICE_NONCE_TTL_MS = 60000;
+/** SAN URI prefixes of a device leaf. */
+export declare const DEVICE_SAN_CREDENTIAL_PREFIX: 'camstack:credential:';
+export declare const DEVICE_SAN_USER_PREFIX: 'camstack:user:';
+/**
+ * The exact bytes a device signs (UTF-8, `\n` separators, no trailing newline):
+ *
+ *   camstack-device-cert-v1
+ *   <login|renew>
+ *   <origin>            the hub origin returned by `getDeviceChallenge`
+ *   <nonce>
+ *
+ * The origin is part of the message so a signature collected by a look-alike
+ * hub is worthless on the real one; the hub additionally binds the nonce to
+ * the origin it issued it for and refuses any other.
+ */
+export declare function buildDeviceSignatureMessage(input: {
+    readonly purpose: DeviceSignaturePurpose;
+    readonly origin: string;
+    readonly nonce: string;
+}): string;
+/** The deep link a QR carries: `camstack://enroll?hub=<origin>&code=<code>`. */
+export declare function buildDeviceEnrollmentLink(input: {
+    readonly hub?: string;
+    readonly code: string;
+    readonly scheme?: string;
+}): string;
+/** Parse an enrollment deep link; `null` when it is not one. `hub` is absent when the link names none. */
+export declare function parseDeviceEnrollmentLink(raw: string): {
+    readonly hub: string | null;
+    readonly code: string;
+} | null;
+export declare const DevicePlatformSchema: z.ZodEnum<{
+    android: "android";
+    ios: "ios";
+    other: "other";
+    web: "web";
+}>;
+export type DevicePlatform = z.infer<typeof DevicePlatformSchema>;
+/**
+ * Why a device-certificate endpoint said no. Distinct from a transport / 5xx
+ * failure: those carry no reason and mean "try again", never "the credential is
+ * dead". The viewer switches on this exhaustively.
+ */
+export declare const DeviceRefusalReasonSchema: z.ZodEnum<{
+    "bad-public-key": "bad-public-key";
+    "bad-signature": "bad-signature";
+    "code-invalid": "code-invalid";
+    expired: "expired";
+    "invalid-certificate": "invalid-certificate";
+    "nonce-invalid": "nonce-invalid";
+    "rate-limited": "rate-limited";
+    revoked: "revoked";
+    "self-enrollment-disabled": "self-enrollment-disabled";
+    "step-up-required": "step-up-required";
+    superseded: "superseded";
+    unavailable: "unavailable";
+    "unknown-credential": "unknown-credential";
+    "user-gone": "user-gone";
+}>;
+export type DeviceRefusalReason = z.infer<typeof DeviceRefusalReasonSchema>;
+/** The only answers after which the app may count towards deleting its credential. */
+export declare const DEFINITIVE_DEVICE_REFUSALS: readonly DeviceRefusalReason[];
+/** Consecutive DEFINITIVE answers before the app deletes its key and certificate. */
+export declare const DEVICE_DEFINITIVE_REFUSALS_BEFORE_DELETE = 3;
+export declare function isDefinitiveDeviceRefusal(reason: DeviceRefusalReason): boolean;
+export declare const DeviceRefusalSchema: z.ZodObject<{
+    ok: z.ZodLiteral<false>;
+    reason: z.ZodEnum<{
+        "bad-public-key": "bad-public-key";
+        "bad-signature": "bad-signature";
+        "code-invalid": "code-invalid";
+        expired: "expired";
+        "invalid-certificate": "invalid-certificate";
+        "nonce-invalid": "nonce-invalid";
+        "rate-limited": "rate-limited";
+        revoked: "revoked";
+        "self-enrollment-disabled": "self-enrollment-disabled";
+        "step-up-required": "step-up-required";
+        superseded: "superseded";
+        unavailable: "unavailable";
+        "unknown-credential": "unknown-credential";
+        "user-gone": "user-gone";
+    }>;
+    definitive: z.ZodBoolean;
+    retryAfterSeconds: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>;
+export type DeviceRefusal = z.infer<typeof DeviceRefusalSchema>;
+/**
+ * A credential-bound session that can no longer refresh answers
+ * `auth.refreshSession` with UNAUTHORIZED whose message is this prefix + the
+ * reason; {@link deviceRefusalFromMessage} reads it back.
+ */
+export declare const DEVICE_REFRESH_REFUSAL_PREFIX: 'device-credential:';
+export declare function deviceRefusalFromMessage(message: string): DeviceRefusalReason | null;
+export declare const CompleteEnrollmentInputSchema: z.ZodObject<{
+    code: z.ZodString;
+    publicKeySpki: z.ZodString;
+    deviceName: z.ZodOptional<z.ZodString>;
+    platform: z.ZodEnum<{
+        android: "android";
+        ios: "ios";
+        other: "other";
+        web: "web";
+    }>;
+}, z.core.$strip>;
+export type CompleteEnrollmentInput = z.infer<typeof CompleteEnrollmentInputSchema>;
+export declare const CompleteEnrollmentOutputSchema: z.ZodObject<{
+    credentialId: z.ZodString;
+    certPem: z.ZodString;
+    chainPem: z.ZodString;
+    notAfter: z.ZodNumber;
+    user: z.ZodObject<{
+        id: z.ZodString;
+        username: z.ZodString;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type CompleteEnrollmentOutput = z.infer<typeof CompleteEnrollmentOutputSchema>;
+export declare const CompleteEnrollmentResultSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    credentialId: z.ZodString;
+    certPem: z.ZodString;
+    chainPem: z.ZodString;
+    notAfter: z.ZodNumber;
+    user: z.ZodObject<{
+        id: z.ZodString;
+        username: z.ZodString;
+    }, z.core.$strip>;
+    ok: z.ZodLiteral<true>;
+}, z.core.$strip>, z.ZodObject<{
+    ok: z.ZodLiteral<false>;
+    reason: z.ZodEnum<{
+        "bad-public-key": "bad-public-key";
+        "bad-signature": "bad-signature";
+        "code-invalid": "code-invalid";
+        expired: "expired";
+        "invalid-certificate": "invalid-certificate";
+        "nonce-invalid": "nonce-invalid";
+        "rate-limited": "rate-limited";
+        revoked: "revoked";
+        "self-enrollment-disabled": "self-enrollment-disabled";
+        "step-up-required": "step-up-required";
+        superseded: "superseded";
+        unavailable: "unavailable";
+        "unknown-credential": "unknown-credential";
+        "user-gone": "user-gone";
+    }>;
+    definitive: z.ZodBoolean;
+    retryAfterSeconds: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>], "ok">;
+export type CompleteEnrollmentResult = z.infer<typeof CompleteEnrollmentResultSchema>;
+export declare const EnrollSelfInputSchema: z.ZodObject<{
+    proof: z.ZodString;
+    publicKeySpki: z.ZodString;
+    deviceName: z.ZodString;
+    platform: z.ZodEnum<{
+        android: "android";
+        ios: "ios";
+        other: "other";
+        web: "web";
+    }>;
+}, z.core.$strip>;
+export type EnrollSelfInput = z.infer<typeof EnrollSelfInputSchema>;
+export declare const DeviceEnrollProofSchema: z.ZodObject<{
+    proof: z.ZodString;
+    expiresAt: z.ZodNumber;
+}, z.core.$strip>;
+export declare const DeviceChallengeSchema: z.ZodObject<{
+    nonce: z.ZodString;
+    origin: z.ZodString;
+    expiresAt: z.ZodNumber;
+    signature: z.ZodLiteral<"ecdsa-p256-sha256">;
+}, z.core.$strip>;
+export type DeviceChallenge = z.infer<typeof DeviceChallengeSchema>;
+export declare const DeviceChallengeResultSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    nonce: z.ZodString;
+    origin: z.ZodString;
+    expiresAt: z.ZodNumber;
+    signature: z.ZodLiteral<"ecdsa-p256-sha256">;
+    ok: z.ZodLiteral<true>;
+}, z.core.$strip>, z.ZodObject<{
+    ok: z.ZodLiteral<false>;
+    reason: z.ZodEnum<{
+        "bad-public-key": "bad-public-key";
+        "bad-signature": "bad-signature";
+        "code-invalid": "code-invalid";
+        expired: "expired";
+        "invalid-certificate": "invalid-certificate";
+        "nonce-invalid": "nonce-invalid";
+        "rate-limited": "rate-limited";
+        revoked: "revoked";
+        "self-enrollment-disabled": "self-enrollment-disabled";
+        "step-up-required": "step-up-required";
+        superseded: "superseded";
+        unavailable: "unavailable";
+        "unknown-credential": "unknown-credential";
+        "user-gone": "user-gone";
+    }>;
+    definitive: z.ZodBoolean;
+    retryAfterSeconds: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>], "ok">;
+export type DeviceChallengeResult = z.infer<typeof DeviceChallengeResultSchema>;
+export declare const DeviceProofInputSchema: z.ZodObject<{
+    certPem: z.ZodString;
+    nonce: z.ZodString;
+    signature: z.ZodString;
+}, z.core.$strip>;
+export type DeviceProofInput = z.infer<typeof DeviceProofInputSchema>;
+export declare const RenewDeviceCertificateOutputSchema: z.ZodObject<{
+    credentialId: z.ZodString;
+    certPem: z.ZodString;
+    chainPem: z.ZodString;
+    notAfter: z.ZodNumber;
+}, z.core.$strip>;
+export type RenewDeviceCertificateOutput = z.infer<typeof RenewDeviceCertificateOutputSchema>;
+export declare const RenewDeviceCertificateResultSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    credentialId: z.ZodString;
+    certPem: z.ZodString;
+    chainPem: z.ZodString;
+    notAfter: z.ZodNumber;
+    ok: z.ZodLiteral<true>;
+}, z.core.$strip>, z.ZodObject<{
+    ok: z.ZodLiteral<false>;
+    reason: z.ZodEnum<{
+        "bad-public-key": "bad-public-key";
+        "bad-signature": "bad-signature";
+        "code-invalid": "code-invalid";
+        expired: "expired";
+        "invalid-certificate": "invalid-certificate";
+        "nonce-invalid": "nonce-invalid";
+        "rate-limited": "rate-limited";
+        revoked: "revoked";
+        "self-enrollment-disabled": "self-enrollment-disabled";
+        "step-up-required": "step-up-required";
+        superseded: "superseded";
+        unavailable: "unavailable";
+        "unknown-credential": "unknown-credential";
+        "user-gone": "user-gone";
+    }>;
+    definitive: z.ZodBoolean;
+    retryAfterSeconds: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>], "ok">;
+export type RenewDeviceCertificateResult = z.infer<typeof RenewDeviceCertificateResultSchema>;
+export declare const RevokeOwnDeviceCertificateResultSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    ok: z.ZodLiteral<true>;
+    credentialId: z.ZodString;
+    sessionsEnded: z.ZodNumber;
+}, z.core.$strip>, z.ZodObject<{
+    ok: z.ZodLiteral<false>;
+    reason: z.ZodEnum<{
+        "bad-public-key": "bad-public-key";
+        "bad-signature": "bad-signature";
+        "code-invalid": "code-invalid";
+        expired: "expired";
+        "invalid-certificate": "invalid-certificate";
+        "nonce-invalid": "nonce-invalid";
+        "rate-limited": "rate-limited";
+        revoked: "revoked";
+        "self-enrollment-disabled": "self-enrollment-disabled";
+        "step-up-required": "step-up-required";
+        superseded: "superseded";
+        unavailable: "unavailable";
+        "unknown-credential": "unknown-credential";
+        "user-gone": "user-gone";
+    }>;
+    definitive: z.ZodBoolean;
+    retryAfterSeconds: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>], "ok">;
+export type RevokeOwnDeviceCertificateResult = z.infer<typeof RevokeOwnDeviceCertificateResultSchema>;
+/** Who revoked a credential, as `revokedBy` records it: `admin:<userId>` | `user:<userId>` | `device`. */
+export type DeviceRevoker = {
+    readonly kind: 'admin';
+    readonly userId: string;
+} | {
+    readonly kind: 'user';
+    readonly userId: string;
+} | {
+    readonly kind: 'device';
+};
+export declare function formatDeviceRevoker(revoker: DeviceRevoker): string;
+export declare const DeviceCredentialStatusSchema: z.ZodEnum<{
+    active: "active";
+    expired: "expired";
+    revoked: "revoked";
+}>;
+export type DeviceCredentialStatus = z.infer<typeof DeviceCredentialStatusSchema>;
+export declare const DeviceCredentialSchema: z.ZodObject<{
+    id: z.ZodString;
+    userId: z.ZodString;
+    username: z.ZodNullable<z.ZodString>;
+    deviceName: z.ZodString;
+    platform: z.ZodEnum<{
+        android: "android";
+        ios: "ios";
+        other: "other";
+        web: "web";
+    }>;
+    enrolledVia: z.ZodEnum<{
+        qr: "qr";
+        self: "self";
+    }>;
+    fingerprint: z.ZodString;
+    issuedAt: z.ZodNumber;
+    expiresAt: z.ZodNumber;
+    lastUsedAt: z.ZodNullable<z.ZodNumber>;
+    lastUsedFrom: z.ZodNullable<z.ZodString>;
+    revokedAt: z.ZodNullable<z.ZodNumber>;
+    revokedBy: z.ZodNullable<z.ZodString>;
+    status: z.ZodEnum<{
+        active: "active";
+        expired: "expired";
+        revoked: "revoked";
+    }>;
+}, z.core.$strip>;
+export type DeviceCredential = z.infer<typeof DeviceCredentialSchema>;
+export declare const StartEnrollmentOutputSchema: z.ZodObject<{
+    code: z.ZodString;
+    expiresAt: z.ZodNumber;
+    enrollUrl: z.ZodString;
+    hubOrigin: z.ZodNullable<z.ZodString>;
+    hubOrigins: z.ZodArray<z.ZodString>;
+}, z.core.$strip>;
+export type StartEnrollmentOutput = z.infer<typeof StartEnrollmentOutputSchema>;
+/** The `device-certificate` arm of `auth.listLoginMethods`. */
+export declare const DeviceCertificateLoginMethodSchema: z.ZodObject<{
+    kind: z.ZodLiteral<"device-certificate">;
+    id: z.ZodLiteral<"device-certificate">;
+    label: z.ZodString;
+    stage: z.ZodLiteral<"primary">;
+    challengePath: z.ZodLiteral<"auth.getDeviceChallenge">;
+    revokePath: z.ZodLiteral<"auth.revokeOwnDeviceCertificate">;
+    enrollSelfPath: z.ZodLiteral<"auth.enrollSelf">;
+    loginPath: z.ZodLiteral<"auth.loginWithDeviceCertificate">;
+    renewPath: z.ZodLiteral<"auth.renewDeviceCertificate">;
+    signature: z.ZodLiteral<"ecdsa-p256-sha256">;
+    messageVersion: z.ZodLiteral<"camstack-device-cert-v1">;
+    clients: z.ZodArray<z.ZodEnum<{
+        native: "native";
+        web: "web";
+    }>>;
+}, z.core.$strip>;
+export type DeviceCertificateLoginMethod = z.infer<typeof DeviceCertificateLoginMethodSchema>;

package/dist/auth/request-origin.d.ts

@@ -0,0 +1,43 @@
+/**
+ * The hub address an OIDC sign-in STARTED at — so it returns there (D791).
+ *
+ * The browser must come back to the origin it left from: the session cookie,
+ * the admin UI's stored token and a popup's `window.opener` all belong to
+ * one origin. Before this the `redirect_uri` was the hub's single browser
+ * address (`hubBrowserOrigin`), so a sign-in started on the LAN address
+ * (`https://192.168.x.x:4443`) finished on the public tunnel.
+ *
+ * The origin is read from the `/start` request — `X-Forwarded-Host` /
+ * `Host`, `X-Forwarded-Proto` — and is NEVER trusted as such: a forged
+ * `Host` would otherwise choose where the IdP sends the authorization code.
+ * It is used only when it equals, exactly, an origin the hub advertises
+ * itself at (the Network page's addresses: detected, custom, the public
+ * endpoint, the app-connection set) or the origin of the operator's
+ * configured redirect override. Anything else falls back to the default
+ * browser address, exactly as before.
+ *
+ * The mount prefix (`X-Forwarded-Prefix`, the reverse-proxy relay) is kept on
+ * the path when well-formed — it can only move the callback within an
+ * allowlisted origin, where the hub serves or 404s it and a strict IdP
+ * refuses an unregistered one.
+ */
+import type { HubAddressBook } from '../capabilities/local-network.cap.js';
+/** A request's headers as the addon-routes bridge hands them (lower-cased names). */
+export type RequestHeaders = Readonly<Record<string, string | undefined>>;
+/** `scheme://host[:port]` normalised by WHATWG URL, or `null` if it is not an http(s) origin. */
+export declare function normalizeOrigin(value: string): string | null;
+/** The mount prefix the relay named (no trailing slash), or `''`. Invalid = absent. */
+export declare function requestMountPrefix(headers: RequestHeaders): string;
+/**
+ * The origins the request CLAIMS, most specific first: the proxy's
+ * `X-Forwarded-Host` over `Host`; the named `X-Forwarded-Proto`, or https
+ * then http when none is named (the hub terminates TLS itself on 4443).
+ */
+export declare function claimedRequestOrigins(headers: RequestHeaders): readonly string[];
+/** Every origin the hub advertises itself at, normalised. Never the app link, never loopback. */
+export declare function advertisedHubOrigins(book: HubAddressBook): ReadonlySet<string>;
+/**
+ * The origin to send the browser back to: the first claimed origin that is in
+ * `allowed`, or `null` (the caller then uses its default address).
+ */
+export declare function pickRequestOrigin(headers: RequestHeaders, allowed: ReadonlySet<string>): string | null;

package/dist/capabilities/device-credentials.cap.d.ts

@@ -0,0 +1,174 @@
+import { z } from 'zod';
+import { type InferProvider } from './capability-definition.js';
+export declare const DeviceCaStatusSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    state: z.ZodLiteral<"absent">;
+}, z.core.$strip>, z.ZodObject<{
+    state: z.ZodLiteral<"ready">;
+    subject: z.ZodString;
+    fingerprintSha256: z.ZodString;
+    validTo: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    state: z.ZodLiteral<"unavailable">;
+    reason: z.ZodString;
+}, z.core.$strip>], "state">;
+export type DeviceCaStatus = z.infer<typeof DeviceCaStatusSchema>;
+export declare const DeviceCertificateSettingsSchema: z.ZodObject<{
+    selfEnrollment: z.ZodEnum<{
+        allowed: "allowed";
+        disabled: "disabled";
+    }>;
+}, z.core.$strip>;
+export type DeviceCertificateSettings = z.infer<typeof DeviceCertificateSettingsSchema>;
+/**
+ * `device-credentials` — the admin surface of device certificates (D855).
+ *
+ * Everything a device does ITSELF — completing an enrollment, getting a
+ * challenge, signing in, renewing — is a PUBLIC procedure of the hub's `auth`
+ * router (`auth.completeEnrollment`, `getDeviceChallenge`,
+ * `loginWithDeviceCertificate`, `renewDeviceCertificate`): those legs are
+ * proofs of possession, not capability calls, and must not be reachable as
+ * cap methods. This cap holds only what an operator does about them.
+ *
+ * Provider: `local-auth`, which also owns the device CA and the registry.
+ * The hub is the only node that persists device credentials.
+ */
+export declare const deviceCredentialsCapability: {
+    readonly name: 'device-credentials';
+    readonly scope: 'system';
+    readonly mode: 'singleton';
+    readonly methods: {
+        /**
+         * Every enrolled device, newest first; `userId` narrows to one user.
+         * `status` is derived: revoked wins over expired.
+         */
+        readonly listDeviceCredentials: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
+            userId: z.ZodOptional<z.ZodString>;
+            includeRevoked: z.ZodDefault<z.ZodBoolean>;
+        }, z.core.$strip>, z.ZodReadonly<z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            userId: z.ZodString;
+            username: z.ZodNullable<z.ZodString>;
+            deviceName: z.ZodString;
+            platform: z.ZodEnum<{
+                android: "android";
+                ios: "ios";
+                other: "other";
+                web: "web";
+            }>;
+            enrolledVia: z.ZodEnum<{
+                qr: "qr";
+                self: "self";
+            }>;
+            fingerprint: z.ZodString;
+            issuedAt: z.ZodNumber;
+            expiresAt: z.ZodNumber;
+            lastUsedAt: z.ZodNullable<z.ZodNumber>;
+            lastUsedFrom: z.ZodNullable<z.ZodString>;
+            revokedAt: z.ZodNullable<z.ZodNumber>;
+            revokedBy: z.ZodNullable<z.ZodString>;
+            status: z.ZodEnum<{
+                active: "active";
+                expired: "expired";
+                revoked: "revoked";
+            }>;
+        }, z.core.$strip>>>, import("./capability-definition.js").CapabilityMethodKind>;
+        /**
+         * Mint a one-shot enrollment code for `userId` and a device name: 128-bit
+         * random, single use, 10 minutes, kept only as a hash. Returns the code
+         * once, with the `camstack://enroll?hub=…&code=…` link a QR carries.
+         * `caller` (the admin) is recorded in the audit trail.
+         */
+        readonly startEnrollment: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
+            userId: z.ZodString;
+            deviceName: z.ZodString;
+        }, z.core.$strip>, z.ZodObject<{
+            code: z.ZodString;
+            expiresAt: z.ZodNumber;
+            enrollUrl: z.ZodString;
+            hubOrigin: z.ZodNullable<z.ZodString>;
+            hubOrigins: z.ZodArray<z.ZodString>;
+        }, z.core.$strip>, "mutation"> & {
+            readonly caller: 'required';
+        };
+        /**
+         * Revoke a credential: its certificate stops logging in at once, and every
+         * session it opened ends (an open session also dies at its next refresh
+         * even if this call raced it). Idempotent.
+         */
+        readonly revokeDeviceCredential: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
+            id: z.ZodString;
+        }, z.core.$strip>, z.ZodObject<{
+            revoked: z.ZodBoolean;
+            sessionsEnded: z.ZodNumber;
+            status: z.ZodEnum<{
+                active: "active";
+                expired: "expired";
+                revoked: "revoked";
+            }>;
+        }, z.core.$strip>, "mutation"> & {
+            readonly caller: 'required';
+        };
+        /**
+         * Hub-wide device-certificate settings. `selfEnrollment`: `allowed`
+         * (default) lets a signed-in user enroll their own device after a step-up
+         * sign-in; `disabled` makes `auth.enrollSelf` refuse. The admin QR path is
+         * unaffected. Hub-wide only (no per-role switch).
+         */
+        readonly getDeviceCertificateSettings: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{}, z.core.$strip>, z.ZodObject<{
+            selfEnrollment: z.ZodEnum<{
+                allowed: "allowed";
+                disabled: "disabled";
+            }>;
+        }, z.core.$strip>, import("./capability-definition.js").CapabilityMethodKind>;
+        readonly setDeviceCertificateSettings: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
+            selfEnrollment: z.ZodEnum<{
+                allowed: "allowed";
+                disabled: "disabled";
+            }>;
+        }, z.core.$strip>, z.ZodObject<{
+            selfEnrollment: z.ZodEnum<{
+                allowed: "allowed";
+                disabled: "disabled";
+            }>;
+        }, z.core.$strip>, "mutation">;
+        /**
+         * Delete the registry row of a REVOKED credential (clean-up; the audit trail
+         * keeps the revocation). Refuses a live credential: revoke it first. After
+         * the row is gone the device's next call answers `unknown-credential`.
+         */
+        readonly deleteDeviceCredential: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
+            id: z.ZodString;
+        }, z.core.$strip>, z.ZodObject<{
+            result: z.ZodEnum<{
+                deleted: "deleted";
+                live: "live";
+                unknown: "unknown";
+            }>;
+        }, z.core.$strip>, "mutation"> & {
+            readonly caller: 'required';
+        };
+        /**
+         * The device CA: `absent` until the first enrollment creates it (lazily,
+         * never rotated on boot), `unavailable` while the keychain cannot answer.
+         */
+        readonly getDeviceCaStatus: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{}, z.core.$strip>, z.ZodDiscriminatedUnion<[z.ZodObject<{
+            state: z.ZodLiteral<"absent">;
+        }, z.core.$strip>, z.ZodObject<{
+            state: z.ZodLiteral<"ready">;
+            subject: z.ZodString;
+            fingerprintSha256: z.ZodString;
+            validTo: z.ZodString;
+        }, z.core.$strip>, z.ZodObject<{
+            state: z.ZodLiteral<"unavailable">;
+            reason: z.ZodString;
+        }, z.core.$strip>], "state">, import("./capability-definition.js").CapabilityMethodKind>;
+        /** Rename a credential (the label only; the certificate is unchanged). */
+        readonly renameDeviceCredential: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
+            id: z.ZodString;
+            deviceName: z.ZodString;
+        }, z.core.$strip>, z.ZodObject<{
+            renamed: z.ZodBoolean;
+        }, z.core.$strip>, "mutation">;
+    };
+};
+export type IDeviceCredentialsProvider = InferProvider<typeof deviceCredentialsCapability>;