@camstack/types 1.2.364 → 1.2.365

package/dist/capabilities/index.d.ts

@@ -46,6 +46,8 @@ export { CustomModelDescriptorSchema, customModelRegistryCapability, ImportModel
 export { type DataStoreEngineInfo, dataStoreProviderCapability, EngineInfoSchema as DataStoreEngineInfoSchema, type IDataStoreProvider, } from './data-store-provider.cap.js';
 export { type ArchiveSqliteSnapshot, ArchiveSqliteSnapshotSchema, DATABASE_SNAPSHOT_PARTIAL_SUFFIX, DATABASE_SNAPSHOT_SUFFIX, DATABASE_SNAPSHOT_TIMEOUT_MS, type DatabaseSnapshotRequest, DatabaseSnapshotRequestSchema, type DatabaseSnapshotResult, DatabaseSnapshotResultSchema, type DatabaseSnapshotTable, DatabaseSnapshotTableSchema, type DatabaseSnapshotTargets, DatabaseSnapshotTargetsSchema, type DatabaseSnapshotWritten, DatabaseSnapshotWrittenSchema, databaseSnapshotCapability, type IDatabaseSnapshotProvider, } from './database-snapshot.cap.js';
 export { type IKeychainProvider, KEYCHAIN_MAX_REFS_PER_CALL, type KeychainResolveEntry, KeychainResolveEntrySchema, type KeychainResolveResult, KeychainResolveResultSchema, type KeychainSecretMeta, KeychainSecretMetaSchema, type KeychainState, KeychainStateSchema, type KeychainUnavailableReason, KeychainUnavailableReasonSchema, keychainCapability, } from './keychain.cap.js';
+export { type DeviceCaStatus, DeviceCaStatusSchema, type DeviceCertificateSettings, DeviceCertificateSettingsSchema, deviceCredentialsCapability, type IDeviceCredentialsProvider, } from './device-credentials.cap.js';
+export { type HttpsLeafInfo, HttpsLeafInfoSchema, type INodeCertificatesProvider, type MeshLeafInfo, MeshLeafInfoSchema, type NodeHttpsState, NodeHttpsStateSchema, nodeCertificatesCapability, } from './node-certificates.cap.js';
 export { type IKeychainAdminProvider, KEYCHAIN_RESET_CONFIRMATION, type KeychainAdminSecret, KeychainAdminSecretSchema, type KeychainAuditAction, KeychainAuditActionSchema, type KeychainAuditEntry, KeychainAuditEntrySchema, type KeychainKeySource, type KeychainKeySourceKind, KeychainKeySourceKindSchema, KeychainKeySourceSchema, KEYCHAIN_RESET_TRIGGER_ACTOR, type KeychainResetRecord, KeychainResetRecordSchema, type KeychainSecretUsage, KeychainSecretUsageSchema, type KeychainStatus, KeychainStatusSchema, keychainAdminCapability, type SystemHeldSecretName, SystemHeldSecretNameSchema, } from './keychain-admin.cap.js';
 export type { DecoderHwAccelConfig, HwAccelChoice, IDecoderCapProvider, } from './decoder.cap.js';
 export { DEFAULT_DECODER_HWACCEL_CONFIG, decoderCapability, HWACCEL_OPTIONS, } from './decoder.cap.js';
@@ -286,6 +288,8 @@ import type { dataStoreProviderCapability } from './data-store-provider.cap.js';
 import type { databaseSnapshotCapability } from './database-snapshot.cap.js';
 import type { keychainCapability } from './keychain.cap.js';
 import type { keychainAdminCapability } from './keychain-admin.cap.js';
+import type { deviceCredentialsCapability } from './device-credentials.cap.js';
+import type { nodeCertificatesCapability } from './node-certificates.cap.js';
 import type { dayNightCapability } from './day-night.cap.js';
 import type { decoderCapability } from './decoder.cap.js';
 import type { detectionPipelineCapability } from './detection-pipeline.cap.js';
@@ -409,6 +413,6 @@ import type { trainingProviderCapability } from './training-provider.cap.js';
 import type { zoneAnalyticsCapability } from './zone-analytics.cap.js';
 import type { zoneRulesCapability } from './zone-rules.cap.js';
 import type { zonesCapability } from './zones.cap.js';
-type AnyCapability = typeof streamSignalsCapability | typeof addonSettingsCapability | typeof alertsCapability | typeof storageCapability | typeof storageMigrationCapability | typeof storageProviderCapability | typeof storageEvictableCapability | typeof storageOccupancyCapability | typeof filesystemBrowseCapability | typeof backupCapability | typeof terminalSessionCapability | typeof settingsStoreCapability | typeof dataStoreProviderCapability | typeof databaseSnapshotCapability | typeof keychainCapability | typeof keychainAdminCapability | typeof logChannelsCapability | typeof logDestinationCapability | typeof loadContributionCapability | typeof failureContributionCapability | typeof adminUiCapability | typeof viewerUiCapability | typeof ssoBridgeCapability | typeof userPasskeysCapability | typeof smtpProviderCapability | typeof mqttBrokerCapability | typeof brokerCapability | typeof deviceAdoptionCapability | typeof deviceAdminLinkCapability | typeof deviceExportCapability | typeof addonPagesCapability | typeof addonPagesSourceCapability | typeof addonWidgetsCapability | typeof addonWidgetsSourceCapability | typeof customModelRegistryCapability | typeof modelDistributorCapability | typeof modelConvertCapability | typeof addonRoutesCapability | typeof streamBrokerCapability | typeof decoderCapability | typeof webrtcSessionCapability | typeof cameraStreamsCapability | typeof calendarSourceCapability | typeof calendarsCapability | typeof motionDetectionCapability | typeof pipelineExecutorCapability | typeof detectionPipelineCapability | typeof cameraPipelineConfigCapability | typeof pipelineRunnerCapability | typeof pipelineOrchestratorCapability | typeof audioAnalyzerCapability | typeof audioAnalysisCapability | typeof audioCodecCapability | typeof embeddingEncoderCapability | typeof vectorStoreCapability | typeof deviceProviderCapability | typeof deviceManagerCapability | typeof deviceStateCapability | typeof authProviderCapability | typeof loginMethodCapability | typeof networkAccessCapability | typeof turnProviderCapability | typeof snapshotCapability | typeof llmCapability | typeof llmRuntimeCapability | typeof notificationOutputCapability | typeof composerCapability | typeof coreBlocksCapability | typeof notificationRulesCapability | typeof pipelineAnalyticsCapability | typeof metricsProviderCapability | typeof ptzCapability | typeof ptzAutotrackCapability | typeof navigationCapability | typeof consumablesCapability | typeof connectionTestCapability | typeof rebootCapability | typeof deviceDiscoveryCapability | typeof brightnessCapability | typeof colorCapability | typeof climateControlCapability | typeof coverCapability | typeof valveCapability | typeof humidifierCapability | typeof waterHeaterCapability | typeof weatherCapability | typeof imageCapability | typeof lockControlCapability | typeof vacuumControlCapability | typeof petFeederCapability | typeof lawnMowerControlCapability | typeof fanControlCapability | typeof controlCapability | typeof notifierCapability | typeof mediaPlayerCapability | typeof alarmPanelCapability | typeof presenceCapability | typeof scriptRunnerCapability | typeof automationControlCapability | typeof motionTriggerCapability | typeof zonesCapability | typeof zoneRulesCapability | typeof trainingCapability | typeof trainingProviderCapability | typeof zoneAnalyticsCapability | typeof audioMetricsCapability | typeof motionCapability | typeof contactCapability | typeof floodCapability | typeof smokeCapability | typeof carbonMonoxideCapability | typeof gasCapability | typeof tamperCapability | typeof vibrationCapability | typeof connectivityCapability | typeof binaryCapability | typeof temperatureSensorCapability | typeof humiditySensorCapability | typeof ambientLightSensorCapability | typeof pressureSensorCapability | typeof powerMeterCapability | typeof airQualitySensorCapability | typeof numericSensorCapability | typeof enumSensorCapability | typeof recordingCapability | typeof recordingArchiveCapability | typeof recordingExportCapability | typeof recordingSignalCapability | typeof deviceOpsCapability | typeof platformProbeCapability | typeof localNetworkCapability | typeof meshNetworkCapability | typeof userManagementCapability | typeof systemCapability | typeof networkQualityCapability | typeof toastCapability | typeof nodesCapability | typeof serverManagementCapability | typeof integrationsCapability | typeof addonsCapability | typeof oauthIntegrationCapability | typeof oidcConnectionsCapability | typeof streamParamsCapability | typeof streamCatalogCapability | typeof motionZonesCapability | typeof cameraGridLayoutCapability | typeof sceneMonitorCapability | typeof privacyMaskCapability | typeof dayNightCapability | typeof recordingOnboardCapability | typeof imageSettingsCapability | typeof osdCapability | typeof osdManagerCapability | typeof accessoriesCapability | typeof batteryCapability | typeof networkLinkCapability | typeof buttonCapability | typeof cameraCredentialsCapability | typeof deviceStatusCapability | typeof doorbellCapability | typeof eventEmitterCapability | typeof faceGalleryCapability | typeof featureProbeCapability | typeof intercomCapability | typeof nativeObjectDetectionCapability | typeof plateGalleryCapability | typeof switchCapability | typeof updateCapability | typeof videoclipsCapability | typeof deviceExtensionCapability;
+type AnyCapability = typeof streamSignalsCapability | typeof addonSettingsCapability | typeof alertsCapability | typeof storageCapability | typeof storageMigrationCapability | typeof storageProviderCapability | typeof storageEvictableCapability | typeof storageOccupancyCapability | typeof filesystemBrowseCapability | typeof backupCapability | typeof terminalSessionCapability | typeof settingsStoreCapability | typeof dataStoreProviderCapability | typeof databaseSnapshotCapability | typeof keychainCapability | typeof keychainAdminCapability | typeof deviceCredentialsCapability | typeof nodeCertificatesCapability | typeof logChannelsCapability | typeof logDestinationCapability | typeof loadContributionCapability | typeof failureContributionCapability | typeof adminUiCapability | typeof viewerUiCapability | typeof ssoBridgeCapability | typeof userPasskeysCapability | typeof smtpProviderCapability | typeof mqttBrokerCapability | typeof brokerCapability | typeof deviceAdoptionCapability | typeof deviceAdminLinkCapability | typeof deviceExportCapability | typeof addonPagesCapability | typeof addonPagesSourceCapability | typeof addonWidgetsCapability | typeof addonWidgetsSourceCapability | typeof customModelRegistryCapability | typeof modelDistributorCapability | typeof modelConvertCapability | typeof addonRoutesCapability | typeof streamBrokerCapability | typeof decoderCapability | typeof webrtcSessionCapability | typeof cameraStreamsCapability | typeof calendarSourceCapability | typeof calendarsCapability | typeof motionDetectionCapability | typeof pipelineExecutorCapability | typeof detectionPipelineCapability | typeof cameraPipelineConfigCapability | typeof pipelineRunnerCapability | typeof pipelineOrchestratorCapability | typeof audioAnalyzerCapability | typeof audioAnalysisCapability | typeof audioCodecCapability | typeof embeddingEncoderCapability | typeof vectorStoreCapability | typeof deviceProviderCapability | typeof deviceManagerCapability | typeof deviceStateCapability | typeof authProviderCapability | typeof loginMethodCapability | typeof networkAccessCapability | typeof turnProviderCapability | typeof snapshotCapability | typeof llmCapability | typeof llmRuntimeCapability | typeof notificationOutputCapability | typeof composerCapability | typeof coreBlocksCapability | typeof notificationRulesCapability | typeof pipelineAnalyticsCapability | typeof metricsProviderCapability | typeof ptzCapability | typeof ptzAutotrackCapability | typeof navigationCapability | typeof consumablesCapability | typeof connectionTestCapability | typeof rebootCapability | typeof deviceDiscoveryCapability | typeof brightnessCapability | typeof colorCapability | typeof climateControlCapability | typeof coverCapability | typeof valveCapability | typeof humidifierCapability | typeof waterHeaterCapability | typeof weatherCapability | typeof imageCapability | typeof lockControlCapability | typeof vacuumControlCapability | typeof petFeederCapability | typeof lawnMowerControlCapability | typeof fanControlCapability | typeof controlCapability | typeof notifierCapability | typeof mediaPlayerCapability | typeof alarmPanelCapability | typeof presenceCapability | typeof scriptRunnerCapability | typeof automationControlCapability | typeof motionTriggerCapability | typeof zonesCapability | typeof zoneRulesCapability | typeof trainingCapability | typeof trainingProviderCapability | typeof zoneAnalyticsCapability | typeof audioMetricsCapability | typeof motionCapability | typeof contactCapability | typeof floodCapability | typeof smokeCapability | typeof carbonMonoxideCapability | typeof gasCapability | typeof tamperCapability | typeof vibrationCapability | typeof connectivityCapability | typeof binaryCapability | typeof temperatureSensorCapability | typeof humiditySensorCapability | typeof ambientLightSensorCapability | typeof pressureSensorCapability | typeof powerMeterCapability | typeof airQualitySensorCapability | typeof numericSensorCapability | typeof enumSensorCapability | typeof recordingCapability | typeof recordingArchiveCapability | typeof recordingExportCapability | typeof recordingSignalCapability | typeof deviceOpsCapability | typeof platformProbeCapability | typeof localNetworkCapability | typeof meshNetworkCapability | typeof userManagementCapability | typeof systemCapability | typeof networkQualityCapability | typeof toastCapability | typeof nodesCapability | typeof serverManagementCapability | typeof integrationsCapability | typeof addonsCapability | typeof oauthIntegrationCapability | typeof oidcConnectionsCapability | typeof streamParamsCapability | typeof streamCatalogCapability | typeof motionZonesCapability | typeof cameraGridLayoutCapability | typeof sceneMonitorCapability | typeof privacyMaskCapability | typeof dayNightCapability | typeof recordingOnboardCapability | typeof imageSettingsCapability | typeof osdCapability | typeof osdManagerCapability | typeof accessoriesCapability | typeof batteryCapability | typeof networkLinkCapability | typeof buttonCapability | typeof cameraCredentialsCapability | typeof deviceStatusCapability | typeof doorbellCapability | typeof eventEmitterCapability | typeof faceGalleryCapability | typeof featureProbeCapability | typeof intercomCapability | typeof nativeObjectDetectionCapability | typeof plateGalleryCapability | typeof switchCapability | typeof updateCapability | typeof videoclipsCapability | typeof deviceExtensionCapability;
 export type CapabilityName = AnyCapability['name'];
 export type ITypedReadinessRegistry = IReadinessRegistry<CapabilityName>;

package/dist/capabilities/node-certificates.cap.d.ts

@@ -0,0 +1,128 @@
+import { z } from 'zod';
+import { type InferProvider } from './capability-definition.js';
+/**
+ * `node-certificates` - what a node holds and the two renewals the hub drives
+ * (D856): the node's MESH leaf (mutual TLS to the hub) and its HTTPS leaf (issued
+ * from the hub's local CA so a device that trusts the hub root trusts the node).
+ *
+ * Provided by the AGENT RUNTIME (the synthetic `agent-runtime` addon id, like
+ * `server-management`): the hub reaches it through the ordinary node-pinned
+ * capability call - no new Moleculer action. The hub's own certificates are
+ * handled in-process by the hub (`certificates` router), so this cap has no hub
+ * provider.
+ *
+ * No private key ever crosses the mesh: the node generates its key pair, sends a
+ * CSR, and the hub returns only the signed certificate.
+ */
+export declare const MeshLeafInfoSchema: z.ZodObject<{
+    cn: z.ZodString;
+    serial: z.ZodString;
+    fingerprintSha256: z.ZodString;
+    notBefore: z.ZodNumber;
+    notAfter: z.ZodNumber;
+}, z.core.$strip>;
+export type MeshLeafInfo = z.infer<typeof MeshLeafInfoSchema>;
+export declare const HttpsLeafInfoSchema: z.ZodObject<{
+    fingerprintSha256: z.ZodString;
+    issuer: z.ZodString;
+    sans: z.ZodArray<z.ZodString>;
+    notBefore: z.ZodNumber;
+    notAfter: z.ZodNumber;
+}, z.core.$strip>;
+export type HttpsLeafInfo = z.infer<typeof HttpsLeafInfoSchema>;
+export declare const NodeHttpsStateSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    state: z.ZodLiteral<"served">;
+    leaf: z.ZodObject<{
+        fingerprintSha256: z.ZodString;
+        issuer: z.ZodString;
+        sans: z.ZodArray<z.ZodString>;
+        notBefore: z.ZodNumber;
+        notAfter: z.ZodNumber;
+    }, z.core.$strip>;
+}, z.core.$strip>, z.ZodObject<{
+    state: z.ZodLiteral<"not-issued">;
+    reason: z.ZodString;
+}, z.core.$strip>], "state">;
+export type NodeHttpsState = z.infer<typeof NodeHttpsStateSchema>;
+export declare const nodeCertificatesCapability: {
+    readonly name: 'node-certificates';
+    readonly scope: 'system';
+    readonly mode: 'singleton';
+    readonly internal: true;
+    readonly methods: {
+        /** The node's current mesh leaf (`null` when it is not enrolled on mTLS) and HTTPS state. */
+        readonly getCertificates: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{}, z.core.$strip>, z.ZodObject<{
+            nodeId: z.ZodString;
+            mesh: z.ZodNullable<z.ZodObject<{
+                cn: z.ZodString;
+                serial: z.ZodString;
+                fingerprintSha256: z.ZodString;
+                notBefore: z.ZodNumber;
+                notAfter: z.ZodNumber;
+            }, z.core.$strip>>;
+            https: z.ZodDiscriminatedUnion<[z.ZodObject<{
+                state: z.ZodLiteral<"served">;
+                leaf: z.ZodObject<{
+                    fingerprintSha256: z.ZodString;
+                    issuer: z.ZodString;
+                    sans: z.ZodArray<z.ZodString>;
+                    notBefore: z.ZodNumber;
+                    notAfter: z.ZodNumber;
+                }, z.core.$strip>;
+            }, z.core.$strip>, z.ZodObject<{
+                state: z.ZodLiteral<"not-issued">;
+                reason: z.ZodString;
+            }, z.core.$strip>], "state">;
+        }, z.core.$strip>, import("./capability-definition.js").CapabilityMethodKind>;
+        /** Generate a NEW mesh key pair on the node; return the CSR (CN = node id). The key stays here. */
+        readonly prepareMeshRenewal: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{}, z.core.$strip>, z.ZodObject<{
+            csrPem: z.ZodString;
+        }, z.core.$strip>, "mutation">;
+        /**
+         * Install the hub-signed leaf for the key made by `prepareMeshRenewal`: persist it
+         * (keeping the previous one), then reconnect to the hub with it. The node reverts to
+         * the previous leaf by itself unless `confirmMeshLeaf` arrives within `confirmWithinMs`.
+         */
+        readonly installMeshLeaf: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
+            certPem: z.ZodString;
+            caCertPem: z.ZodString;
+            confirmWithinMs: z.ZodNumber;
+        }, z.core.$strip>, z.ZodObject<{
+            fingerprintSha256: z.ZodString;
+            serial: z.ZodString;
+        }, z.core.$strip>, "mutation">;
+        /** The hub saw the node reconnect with the new leaf: keep it, forget the previous one. */
+        readonly confirmMeshLeaf: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
+            fingerprintSha256: z.ZodString;
+        }, z.core.$strip>, z.ZodObject<{
+            confirmed: z.ZodBoolean;
+        }, z.core.$strip>, "mutation">;
+        /** Go back to the previous leaf now. `false` when there is none to go back to. */
+        readonly rollbackMeshLeaf: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{}, z.core.$strip>, z.ZodObject<{
+            rolledBack: z.ZodBoolean;
+        }, z.core.$strip>, "mutation">;
+        /** A key pair + CSR for the node's HTTPS leaf, and the names the node reports for itself. */
+        readonly prepareHttpsCertificate: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{}, z.core.$strip>, z.ZodObject<{
+            csrPem: z.ZodString;
+            hostnames: z.ZodArray<z.ZodString>;
+            addresses: z.ZodArray<z.ZodString>;
+            pinnedCaFingerprintSha256: z.ZodNullable<z.ZodString>;
+        }, z.core.$strip>, "mutation">;
+        /** Install the hub-signed HTTPS leaf and hot-swap the serving context (no restart). */
+        readonly installHttpsCertificate: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
+            certPem: z.ZodString;
+            caCertPem: z.ZodString;
+            caRotation: z.ZodOptional<z.ZodBoolean>;
+        }, z.core.$strip>, z.ZodObject<{
+            fingerprintSha256: z.ZodString;
+            issuer: z.ZodString;
+            sans: z.ZodArray<z.ZodString>;
+            notBefore: z.ZodNumber;
+            notAfter: z.ZodNumber;
+        }, z.core.$strip>, "mutation">;
+    };
+    readonly mount: {
+        readonly kind: 'skip';
+    };
+};
+export type INodeCertificatesProvider = InferProvider<typeof nodeCertificatesCapability>;

package/dist/client.d.ts

@@ -14,4 +14,4 @@
  * value this entry does not export — a missing name here is `undefined` at
  * runtime, not a build error.
  */
-export { APPLE_SA_TO_MACRO, AUDIO_MACRO_LABELS, AlarmArmModeSchema, CLIP_BROKER_PACED_RATES, COCO_TO_MACRO, CamProfileSchema, ICON_CATEGORIES, ICON_ENTRIES, ICON_KEYS, ICON_VIEWER_MODULES, IconKeySchema, LOCATION_ICON_FALLBACK, DEFAULT_TIMELAPSE_PREVIEW_TEXT, DeviceType, EVENTFUL_CAP_NAMES, EVENT_KIND_BY_CAP, EVENT_TAXONOMY, MACRO_LABELS, NC_ALARM_DELAY_MAX_SEC, NC_ALARM_SENSORS_MAX, NC_ALARM_SYSTEM_EVENT_KINDS, NC_ALARM_TRIGGERED_MAX_SEC, NC_BATTERY_CONSUMABLE_SYSTEM_EVENT_KINDS, NC_CAMERA_SCOPE_CAP_NAME, NC_CONSUMABLE_LOW_PERCENT_DEFAULT, NC_CONSUMABLE_LOW_PERCENT_MAX, NC_GROUPING_DEFAULT_SEC, NC_GROUPING_MAX_SEC, NC_GROUPING_MIN_SEC, NC_RULE_EDITOR_SECTION_ORDER, NC_RULE_KIND_SPECS, NC_SENSOR_TRANSITION_UNSUPPORTED_REASON, NC_SYSTEM_EVENT_FAMILY_FILTERS, NC_SYSTEM_EVENT_KIND_GROUP_SPECS, NC_SYSTEM_EVENT_SUMMARY_FAMILIES, NC_TEMPLATE_HELD_BACK_SYSTEM_EVENT_KINDS, NC_TEMPLATE_VARS, NcAlarmConfigSchema, NcAlarmSensorsSchema, NcAlarmSettingsPatchSchema, NcHistoryEntrySchema, NcRuleLastRunsSchema, NodeDirectorySchema, RECORDING_EXPORT_MAX_READ_BYTES, RETRAIN_REVIEW_ADJUSTED_IOU, RETRAIN_REVIEW_MATCH_IOU, RETRAIN_REVIEW_STATUSES, RETRAIN_REVISION_CONFLICT, SystemMirror, TIMELAPSE_DENSE_FLOOR_SEC, TimelapseRuleSchema, YAMNET_TO_MACRO, alarmDeviceBlocksArming, alarmDeviceSecureOnArm, alarmPatchLanded, canonicalIconKey, classifyRetrainReview, conditionVisibleForKind, createSystemProxy, droppedConditionsForKind, iconCategoryLabel, iconEntry, iconsInCategory, isIconKey, isHeldBackTemplateVar, isSystemRuleKind, kindsForDiscriminator, locationIconKey, knownValues, nodePickerItems, packagePickerItems, pickerForCondition, pickerForRuleClasses, parseRetrainRevisionConflict, resolveIconKey, resolveModeDelays, retrainBoxIou, retrainRevisionConflictMessage, ruleDeviceCompatCapNames, ruleEditorSectionsForKind, ruleGroupingApplies, ruleKindOf, ruleKindSpec, ruleSeedForSection, searchIcons, sensorTransitionNeverFires, sensorTransitionOffered, stateLabel, summarizeReview, systemEventDeliveryProblems, systemEventFilterAppliesToAnyKind, systemEventKindsOfFamily, systemFamilyOfKind, templateCarriesSummary, templateVarDeliveryApplies, templateVarKindApplies, templateVarSystemEventApplies, } from './index.js';
+export { APPLE_SA_TO_MACRO, AUDIO_MACRO_LABELS, AlarmArmModeSchema, CLIP_BROKER_PACED_RATES, COCO_TO_MACRO, CamProfileSchema, ICON_CATEGORIES, ICON_ENTRIES, ICON_KEYS, ICON_VIEWER_MODULES, IconKeySchema, LOCATION_ICON_FALLBACK, DEFINITIVE_DEVICE_REFUSALS, DEVICE_CERT_RENEW_WINDOW_DAYS, DEVICE_DEFINITIVE_REFUSALS_BEFORE_DELETE, DEVICE_REFRESH_REFUSAL_PREFIX, DEVICE_CERT_SIGNATURE, DEVICE_SIGNATURE_MESSAGE_VERSION, DEFAULT_TIMELAPSE_PREVIEW_TEXT, DeviceType, EVENTFUL_CAP_NAMES, EVENT_KIND_BY_CAP, EVENT_TAXONOMY, MACRO_LABELS, NC_ALARM_DELAY_MAX_SEC, NC_ALARM_SENSORS_MAX, NC_ALARM_SYSTEM_EVENT_KINDS, NC_ALARM_TRIGGERED_MAX_SEC, NC_BATTERY_CONSUMABLE_SYSTEM_EVENT_KINDS, NC_CAMERA_SCOPE_CAP_NAME, NC_CONSUMABLE_LOW_PERCENT_DEFAULT, NC_CONSUMABLE_LOW_PERCENT_MAX, NC_GROUPING_DEFAULT_SEC, NC_GROUPING_MAX_SEC, NC_GROUPING_MIN_SEC, NC_RULE_EDITOR_SECTION_ORDER, NC_RULE_KIND_SPECS, NC_SENSOR_TRANSITION_UNSUPPORTED_REASON, NC_SYSTEM_EVENT_FAMILY_FILTERS, NC_SYSTEM_EVENT_KIND_GROUP_SPECS, NC_SYSTEM_EVENT_SUMMARY_FAMILIES, NC_TEMPLATE_HELD_BACK_SYSTEM_EVENT_KINDS, NC_TEMPLATE_VARS, NcAlarmConfigSchema, NcAlarmSensorsSchema, NcAlarmSettingsPatchSchema, NcHistoryEntrySchema, NcRuleLastRunsSchema, NodeDirectorySchema, RECORDING_EXPORT_MAX_READ_BYTES, RETRAIN_REVIEW_ADJUSTED_IOU, RETRAIN_REVIEW_MATCH_IOU, RETRAIN_REVIEW_STATUSES, RETRAIN_REVISION_CONFLICT, SystemMirror, TIMELAPSE_DENSE_FLOOR_SEC, TimelapseRuleSchema, YAMNET_TO_MACRO, alarmDeviceBlocksArming, alarmDeviceSecureOnArm, alarmPatchLanded, canonicalIconKey, buildDeviceEnrollmentLink, buildDeviceSignatureMessage, deviceRefusalFromMessage, isDefinitiveDeviceRefusal, classifyRetrainReview, conditionVisibleForKind, createSystemProxy, droppedConditionsForKind, iconCategoryLabel, iconEntry, iconsInCategory, isIconKey, isHeldBackTemplateVar, isSystemRuleKind, kindsForDiscriminator, locationIconKey, knownValues, nodePickerItems, parseDeviceEnrollmentLink, packagePickerItems, pickerForCondition, pickerForRuleClasses, parseRetrainRevisionConflict, resolveIconKey, resolveModeDelays, retrainBoxIou, retrainRevisionConflictMessage, ruleDeviceCompatCapNames, ruleEditorSectionsForKind, ruleGroupingApplies, ruleKindOf, ruleKindSpec, ruleSeedForSection, searchIcons, sensorTransitionNeverFires, sensorTransitionOffered, stateLabel, summarizeReview, systemEventDeliveryProblems, systemEventFilterAppliesToAnyKind, systemEventKindsOfFamily, systemFamilyOfKind, templateCarriesSummary, templateVarDeliveryApplies, templateVarKindApplies, templateVarSystemEventApplies, } from './index.js';

package/dist/client.js

@@ -559,6 +559,240 @@ zod.z.object({
 	resolution: CamStreamResolutionSchema.optional()
 });
 //#endregion
+//#region src/auth/device-certificate.ts
+/**
+* Device certificates (D855) — the wire contract shared by the hub, the admin
+* UI and the native viewer.
+*
+* A device (a phone) generates its OWN P-256 key pair in hardware (Secure
+* Enclave / Android Keystore / a non-extractable WebCrypto key). The private
+* key never travels. The hub signs the PUBLIC key into an X.509 leaf under a
+* dedicated device CA; the device later proves possession of the key by
+* signing a hub-issued nonce, and the hub answers with the same session a
+* password login opens.
+*
+* Everything on the wire is a small string (a PEM, a base64url signature):
+* D613 is about bulk bytes, and a certificate is ~600 bytes.
+*/
+/** Signature algorithm of every device credential: ECDSA, curve P-256, SHA-256. */
+var DEVICE_CERT_SIGNATURE = "ecdsa-p256-sha256";
+/** First line of every signed message; a change of format bumps the version. */
+var DEVICE_SIGNATURE_MESSAGE_VERSION = "camstack-device-cert-v1";
+zod.z.enum([
+	"login",
+	"renew",
+	"revoke"
+]);
+var DEVICE_CERT_RENEW_WINDOW_DAYS = 30;
+/**
+* The exact bytes a device signs (UTF-8, `\n` separators, no trailing newline):
+*
+*   camstack-device-cert-v1
+*   <login|renew>
+*   <origin>            the hub origin returned by `getDeviceChallenge`
+*   <nonce>
+*
+* The origin is part of the message so a signature collected by a look-alike
+* hub is worthless on the real one; the hub additionally binds the nonce to
+* the origin it issued it for and refuses any other.
+*/
+function buildDeviceSignatureMessage(input) {
+	return [
+		DEVICE_SIGNATURE_MESSAGE_VERSION,
+		input.purpose,
+		input.origin,
+		input.nonce
+	].join("\n");
+}
+/** The deep link a QR carries: `camstack://enroll?hub=<origin>&code=<code>`. */
+function buildDeviceEnrollmentLink(input) {
+	const query = new URLSearchParams();
+	if (input.hub !== void 0) query.set("hub", input.hub);
+	query.set("code", input.code);
+	return `${input.scheme ?? "camstack"}://enroll?${query.toString()}`;
+}
+/** Parse an enrollment deep link; `null` when it is not one. `hub` is absent when the link names none. */
+function parseDeviceEnrollmentLink(raw) {
+	let url;
+	try {
+		url = new URL(raw);
+	} catch {
+		return null;
+	}
+	if (url.protocol !== "camstack:" && url.protocol !== "camstack.dev:") return null;
+	if (url.hostname !== "enroll") return null;
+	const code = url.searchParams.get("code");
+	if (code === null || code === "") return null;
+	const hub = url.searchParams.get("hub");
+	return {
+		hub: hub === null || hub === "" ? null : hub,
+		code
+	};
+}
+var DevicePlatformSchema = zod.z.enum([
+	"ios",
+	"android",
+	"web",
+	"other"
+]);
+var Base64UrlSchema = zod.z.string().min(1).max(4096).regex(/^[A-Za-z0-9_-]+$/);
+var PemSchema = zod.z.string().min(1).max(16384);
+/**
+* Why a device-certificate endpoint said no. Distinct from a transport / 5xx
+* failure: those carry no reason and mean "try again", never "the credential is
+* dead". The viewer switches on this exhaustively.
+*/
+var DeviceRefusalReasonSchema = zod.z.enum([
+	"revoked",
+	"unknown-credential",
+	"expired",
+	"bad-signature",
+	"nonce-invalid",
+	"rate-limited",
+	"invalid-certificate",
+	"superseded",
+	"user-gone",
+	"unavailable",
+	"code-invalid",
+	"self-enrollment-disabled",
+	"step-up-required",
+	"bad-public-key"
+]);
+/** The only answers after which the app may count towards deleting its credential. */
+var DEFINITIVE_DEVICE_REFUSALS = [
+	"revoked",
+	"unknown-credential",
+	"user-gone"
+];
+/** Consecutive DEFINITIVE answers before the app deletes its key and certificate. */
+var DEVICE_DEFINITIVE_REFUSALS_BEFORE_DELETE = 3;
+function isDefinitiveDeviceRefusal(reason) {
+	return DEFINITIVE_DEVICE_REFUSALS.includes(reason);
+}
+var DeviceRefusalSchema = zod.z.object({
+	ok: zod.z.literal(false),
+	reason: DeviceRefusalReasonSchema,
+	definitive: zod.z.boolean(),
+	retryAfterSeconds: zod.z.number().optional()
+});
+/**
+* A credential-bound session that can no longer refresh answers
+* `auth.refreshSession` with UNAUTHORIZED whose message is this prefix + the
+* reason; {@link deviceRefusalFromMessage} reads it back.
+*/
+var DEVICE_REFRESH_REFUSAL_PREFIX = "device-credential:";
+function deviceRefusalFromMessage(message) {
+	if (!message.startsWith("device-credential:")) return null;
+	const parsed = DeviceRefusalReasonSchema.safeParse(message.slice(18));
+	return parsed.success ? parsed.data : null;
+}
+zod.z.object({
+	code: zod.z.string().min(1).max(256),
+	/** SubjectPublicKeyInfo DER of the device's P-256 public key, base64url. */
+	publicKeySpki: Base64UrlSchema,
+	deviceName: zod.z.string().min(1).max(80).optional(),
+	platform: DevicePlatformSchema
+});
+var CompleteEnrollmentOutputSchema = zod.z.object({
+	credentialId: zod.z.string(),
+	certPem: PemSchema,
+	/** The device CA certificate the leaf chains to. */
+	chainPem: PemSchema,
+	notAfter: zod.z.number(),
+	user: zod.z.object({
+		id: zod.z.string(),
+		username: zod.z.string()
+	})
+});
+zod.z.discriminatedUnion("ok", [CompleteEnrollmentOutputSchema.extend({ ok: zod.z.literal(true) }), DeviceRefusalSchema]);
+zod.z.object({
+	/** The single-use step-up proof (`auth.deviceEnrollProofFrom…`). */
+	proof: zod.z.string().min(1).max(512),
+	publicKeySpki: Base64UrlSchema,
+	deviceName: zod.z.string().min(1).max(80),
+	platform: DevicePlatformSchema
+});
+zod.z.object({
+	proof: zod.z.string(),
+	expiresAt: zod.z.number()
+});
+var DeviceChallengeSchema = zod.z.object({
+	nonce: zod.z.string(),
+	/** The origin to put in the signed message. The app compares it to the hub it dialled. */
+	origin: zod.z.string(),
+	expiresAt: zod.z.number(),
+	signature: zod.z.literal(DEVICE_CERT_SIGNATURE)
+});
+zod.z.discriminatedUnion("ok", [DeviceChallengeSchema.extend({ ok: zod.z.literal(true) }), DeviceRefusalSchema]);
+zod.z.object({
+	certPem: PemSchema,
+	nonce: zod.z.string().min(1).max(256),
+	/** ECDSA P-256 SHA-256 over {@link buildDeviceSignatureMessage}; raw r||s or DER, base64url. */
+	signature: Base64UrlSchema
+});
+var RenewDeviceCertificateOutputSchema = zod.z.object({
+	credentialId: zod.z.string(),
+	certPem: PemSchema,
+	chainPem: PemSchema,
+	notAfter: zod.z.number()
+});
+zod.z.discriminatedUnion("ok", [RenewDeviceCertificateOutputSchema.extend({ ok: zod.z.literal(true) }), DeviceRefusalSchema]);
+zod.z.discriminatedUnion("ok", [zod.z.object({
+	ok: zod.z.literal(true),
+	credentialId: zod.z.string(),
+	sessionsEnded: zod.z.number().int()
+}), DeviceRefusalSchema]);
+var DeviceCredentialStatusSchema = zod.z.enum([
+	"active",
+	"expired",
+	"revoked"
+]);
+zod.z.object({
+	id: zod.z.string(),
+	userId: zod.z.string(),
+	username: zod.z.string().nullable(),
+	deviceName: zod.z.string(),
+	platform: DevicePlatformSchema,
+	enrolledVia: zod.z.enum(["qr", "self"]),
+	/** SHA-256 of the leaf certificate DER, colon-hex. */
+	fingerprint: zod.z.string(),
+	issuedAt: zod.z.number(),
+	expiresAt: zod.z.number(),
+	lastUsedAt: zod.z.number().nullable(),
+	lastUsedFrom: zod.z.string().nullable(),
+	revokedAt: zod.z.number().nullable(),
+	/** `admin:<userId>` | `user:<userId>` | `device` | `user-deleted`. */
+	revokedBy: zod.z.string().nullable(),
+	status: DeviceCredentialStatusSchema
+});
+zod.z.object({
+	/** Shown once; only its hash is kept. */
+	code: zod.z.string(),
+	expiresAt: zod.z.number(),
+	/** `camstack://enroll?hub=…&code=…` — what the QR encodes. */
+	enrollUrl: zod.z.string(),
+	/** The hub origin in the link, or `null` when the hub could not name one (the link then has no `hub`). */
+	hubOrigin: zod.z.string().nullable(),
+	/** Every origin the apps may try (role `appConnections`). */
+	hubOrigins: zod.z.array(zod.z.string())
+});
+zod.z.object({
+	kind: zod.z.literal("device-certificate"),
+	id: zod.z.literal("device-certificate"),
+	label: zod.z.string(),
+	stage: zod.z.literal("primary"),
+	/** tRPC paths under the hub's `auth` router, so a client names no literal. */
+	challengePath: zod.z.literal("auth.getDeviceChallenge"),
+	revokePath: zod.z.literal("auth.revokeOwnDeviceCertificate"),
+	enrollSelfPath: zod.z.literal("auth.enrollSelf"),
+	loginPath: zod.z.literal("auth.loginWithDeviceCertificate"),
+	renewPath: zod.z.literal("auth.renewDeviceCertificate"),
+	signature: zod.z.literal(DEVICE_CERT_SIGNATURE),
+	messageVersion: zod.z.literal(DEVICE_SIGNATURE_MESSAGE_VERSION),
+	/** Which clients can execute it: a native app silently, a browser with a non-extractable WebCrypto key. */
+	clients: zod.z.array(zod.z.enum(["native", "web"]))
+});
+//#endregion
 //#region src/catalogs/sensor-active-state.ts
 /**
 * THE table "which boolean of this device type counts as HIGH", and the
@@ -27412,6 +27646,16 @@ function createSystemProxy(api) {
 			release: (input) => dispatch("deviceAdoption", "release", "mutation", input),
 			resync: (input) => dispatch("deviceAdoption", "resync", "mutation", input)
 		},
+		deviceCredentials: {
+			listDeviceCredentials: (input) => dispatch("deviceCredentials", "listDeviceCredentials", "query", input),
+			startEnrollment: (input) => dispatch("deviceCredentials", "startEnrollment", "mutation", input),
+			revokeDeviceCredential: (input) => dispatch("deviceCredentials", "revokeDeviceCredential", "mutation", input),
+			getDeviceCertificateSettings: (input) => dispatch("deviceCredentials", "getDeviceCertificateSettings", "query", input),
+			setDeviceCertificateSettings: (input) => dispatch("deviceCredentials", "setDeviceCertificateSettings", "mutation", input),
+			deleteDeviceCredential: (input) => dispatch("deviceCredentials", "deleteDeviceCredential", "mutation", input),
+			getDeviceCaStatus: (input) => dispatch("deviceCredentials", "getDeviceCaStatus", "query", input),
+			renameDeviceCredential: (input) => dispatch("deviceCredentials", "renameDeviceCredential", "mutation", input)
+		},
 		deviceExport: {
 			getStatus: (input) => dispatch("deviceExport", "getStatus", "query", input),
 			listSupportedDeviceKinds: (input) => dispatch("deviceExport", "listSupportedDeviceKinds", "query", input),
@@ -30881,6 +31125,12 @@ exports.CLIP_BROKER_PACED_RATES = CLIP_BROKER_PACED_RATES;
 exports.COCO_TO_MACRO = COCO_TO_MACRO;
 exports.CamProfileSchema = CamProfileSchema;
 exports.DEFAULT_TIMELAPSE_PREVIEW_TEXT = DEFAULT_TIMELAPSE_PREVIEW_TEXT;
+exports.DEFINITIVE_DEVICE_REFUSALS = DEFINITIVE_DEVICE_REFUSALS;
+exports.DEVICE_CERT_RENEW_WINDOW_DAYS = DEVICE_CERT_RENEW_WINDOW_DAYS;
+exports.DEVICE_CERT_SIGNATURE = DEVICE_CERT_SIGNATURE;
+exports.DEVICE_DEFINITIVE_REFUSALS_BEFORE_DELETE = DEVICE_DEFINITIVE_REFUSALS_BEFORE_DELETE;
+exports.DEVICE_REFRESH_REFUSAL_PREFIX = DEVICE_REFRESH_REFUSAL_PREFIX;
+exports.DEVICE_SIGNATURE_MESSAGE_VERSION = DEVICE_SIGNATURE_MESSAGE_VERSION;
 exports.DeviceType = DeviceType;
 exports.EVENTFUL_CAP_NAMES = EVENTFUL_CAP_NAMES;
 exports.EVENT_KIND_BY_CAP = EVENT_KIND_BY_CAP;
@@ -30929,14 +31179,18 @@ exports.YAMNET_TO_MACRO = YAMNET_TO_MACRO;
 exports.alarmDeviceBlocksArming = alarmDeviceBlocksArming;
 exports.alarmDeviceSecureOnArm = alarmDeviceSecureOnArm;
 exports.alarmPatchLanded = alarmPatchLanded;
+exports.buildDeviceEnrollmentLink = buildDeviceEnrollmentLink;
+exports.buildDeviceSignatureMessage = buildDeviceSignatureMessage;
 exports.canonicalIconKey = canonicalIconKey;
 exports.classifyRetrainReview = classifyRetrainReview;
 exports.conditionVisibleForKind = conditionVisibleForKind;
 exports.createSystemProxy = createSystemProxy;
+exports.deviceRefusalFromMessage = deviceRefusalFromMessage;
 exports.droppedConditionsForKind = droppedConditionsForKind;
 exports.iconCategoryLabel = iconCategoryLabel;
 exports.iconEntry = iconEntry;
 exports.iconsInCategory = iconsInCategory;
+exports.isDefinitiveDeviceRefusal = isDefinitiveDeviceRefusal;
 exports.isHeldBackTemplateVar = isHeldBackTemplateVar;
 exports.isIconKey = isIconKey;
 exports.isSystemRuleKind = isSystemRuleKind;
@@ -30945,6 +31199,7 @@ exports.knownValues = knownValues;
 exports.locationIconKey = locationIconKey;
 exports.nodePickerItems = nodePickerItems;
 exports.packagePickerItems = packagePickerItems;
+exports.parseDeviceEnrollmentLink = parseDeviceEnrollmentLink;
 exports.parseRetrainRevisionConflict = parseRetrainRevisionConflict;
 exports.pickerForCondition = pickerForCondition;
 exports.pickerForRuleClasses = pickerForRuleClasses;