@camstack/types 1.2.364 → 1.2.365

package/dist/index.js

@@ -6658,6 +6658,330 @@ var SSO_STATE_COOKIE = "camstack_sso_state";
 /** Seconds the state cookie lives — the pending IdP state lasts 5 minutes, the bridge 5 more. */
 var SSO_STATE_COOKIE_MAX_AGE_SEC = 600;
 //#endregion
+//#region src/auth/device-certificate.ts
+/**
+* Device certificates (D855) — the wire contract shared by the hub, the admin
+* UI and the native viewer.
+*
+* A device (a phone) generates its OWN P-256 key pair in hardware (Secure
+* Enclave / Android Keystore / a non-extractable WebCrypto key). The private
+* key never travels. The hub signs the PUBLIC key into an X.509 leaf under a
+* dedicated device CA; the device later proves possession of the key by
+* signing a hub-issued nonce, and the hub answers with the same session a
+* password login opens.
+*
+* Everything on the wire is a small string (a PEM, a base64url signature):
+* D613 is about bulk bytes, and a certificate is ~600 bytes.
+*/
+/** Signature algorithm of every device credential: ECDSA, curve P-256, SHA-256. */
+var DEVICE_CERT_SIGNATURE = "ecdsa-p256-sha256";
+/** First line of every signed message; a change of format bumps the version. */
+var DEVICE_SIGNATURE_MESSAGE_VERSION = "camstack-device-cert-v1";
+/** What a signature is for. A login signature can never be replayed as a renewal. */
+var DeviceSignaturePurposeSchema = zod.z.enum([
+	"login",
+	"renew",
+	"revoke"
+]);
+/** Leaf lifetime and the window in which the app renews it. */
+var DEVICE_CERT_VALIDITY_DAYS = 365;
+var DEVICE_CERT_RENEW_WINDOW_DAYS = 30;
+/** One-shot enrollment code and login nonce lifetimes. */
+var DEVICE_ENROLLMENT_TTL_MS = 10 * 6e4;
+var DEVICE_NONCE_TTL_MS = 6e4;
+/** SAN URI prefixes of a device leaf. */
+var DEVICE_SAN_CREDENTIAL_PREFIX = "camstack:credential:";
+var DEVICE_SAN_USER_PREFIX = "camstack:user:";
+/**
+* The exact bytes a device signs (UTF-8, `\n` separators, no trailing newline):
+*
+*   camstack-device-cert-v1
+*   <login|renew>
+*   <origin>            the hub origin returned by `getDeviceChallenge`
+*   <nonce>
+*
+* The origin is part of the message so a signature collected by a look-alike
+* hub is worthless on the real one; the hub additionally binds the nonce to
+* the origin it issued it for and refuses any other.
+*/
+function buildDeviceSignatureMessage(input) {
+	return [
+		DEVICE_SIGNATURE_MESSAGE_VERSION,
+		input.purpose,
+		input.origin,
+		input.nonce
+	].join("\n");
+}
+/** The deep link a QR carries: `camstack://enroll?hub=<origin>&code=<code>`. */
+function buildDeviceEnrollmentLink(input) {
+	const query = new URLSearchParams();
+	if (input.hub !== void 0) query.set("hub", input.hub);
+	query.set("code", input.code);
+	return `${input.scheme ?? "camstack"}://enroll?${query.toString()}`;
+}
+/** Parse an enrollment deep link; `null` when it is not one. `hub` is absent when the link names none. */
+function parseDeviceEnrollmentLink(raw) {
+	let url;
+	try {
+		url = new URL(raw);
+	} catch {
+		return null;
+	}
+	if (url.protocol !== "camstack:" && url.protocol !== "camstack.dev:") return null;
+	if (url.hostname !== "enroll") return null;
+	const code = url.searchParams.get("code");
+	if (code === null || code === "") return null;
+	const hub = url.searchParams.get("hub");
+	return {
+		hub: hub === null || hub === "" ? null : hub,
+		code
+	};
+}
+var DevicePlatformSchema = zod.z.enum([
+	"ios",
+	"android",
+	"web",
+	"other"
+]);
+var Base64UrlSchema = zod.z.string().min(1).max(4096).regex(/^[A-Za-z0-9_-]+$/);
+var PemSchema = zod.z.string().min(1).max(16384);
+/**
+* Why a device-certificate endpoint said no. Distinct from a transport / 5xx
+* failure: those carry no reason and mean "try again", never "the credential is
+* dead". The viewer switches on this exhaustively.
+*/
+var DeviceRefusalReasonSchema = zod.z.enum([
+	"revoked",
+	"unknown-credential",
+	"expired",
+	"bad-signature",
+	"nonce-invalid",
+	"rate-limited",
+	"invalid-certificate",
+	"superseded",
+	"user-gone",
+	"unavailable",
+	"code-invalid",
+	"self-enrollment-disabled",
+	"step-up-required",
+	"bad-public-key"
+]);
+/** The only answers after which the app may count towards deleting its credential. */
+var DEFINITIVE_DEVICE_REFUSALS = [
+	"revoked",
+	"unknown-credential",
+	"user-gone"
+];
+/** Consecutive DEFINITIVE answers before the app deletes its key and certificate. */
+var DEVICE_DEFINITIVE_REFUSALS_BEFORE_DELETE = 3;
+function isDefinitiveDeviceRefusal(reason) {
+	return DEFINITIVE_DEVICE_REFUSALS.includes(reason);
+}
+var DeviceRefusalSchema = zod.z.object({
+	ok: zod.z.literal(false),
+	reason: DeviceRefusalReasonSchema,
+	definitive: zod.z.boolean(),
+	retryAfterSeconds: zod.z.number().optional()
+});
+/**
+* A credential-bound session that can no longer refresh answers
+* `auth.refreshSession` with UNAUTHORIZED whose message is this prefix + the
+* reason; {@link deviceRefusalFromMessage} reads it back.
+*/
+var DEVICE_REFRESH_REFUSAL_PREFIX = "device-credential:";
+function deviceRefusalFromMessage(message) {
+	if (!message.startsWith("device-credential:")) return null;
+	const parsed = DeviceRefusalReasonSchema.safeParse(message.slice(18));
+	return parsed.success ? parsed.data : null;
+}
+var CompleteEnrollmentInputSchema = zod.z.object({
+	code: zod.z.string().min(1).max(256),
+	/** SubjectPublicKeyInfo DER of the device's P-256 public key, base64url. */
+	publicKeySpki: Base64UrlSchema,
+	deviceName: zod.z.string().min(1).max(80).optional(),
+	platform: DevicePlatformSchema
+});
+var CompleteEnrollmentOutputSchema = zod.z.object({
+	credentialId: zod.z.string(),
+	certPem: PemSchema,
+	/** The device CA certificate the leaf chains to. */
+	chainPem: PemSchema,
+	notAfter: zod.z.number(),
+	user: zod.z.object({
+		id: zod.z.string(),
+		username: zod.z.string()
+	})
+});
+var CompleteEnrollmentResultSchema = zod.z.discriminatedUnion("ok", [CompleteEnrollmentOutputSchema.extend({ ok: zod.z.literal(true) }), DeviceRefusalSchema]);
+var EnrollSelfInputSchema = zod.z.object({
+	/** The single-use step-up proof (`auth.deviceEnrollProofFrom…`). */
+	proof: zod.z.string().min(1).max(512),
+	publicKeySpki: Base64UrlSchema,
+	deviceName: zod.z.string().min(1).max(80),
+	platform: DevicePlatformSchema
+});
+var DeviceEnrollProofSchema = zod.z.object({
+	proof: zod.z.string(),
+	expiresAt: zod.z.number()
+});
+var DeviceChallengeSchema = zod.z.object({
+	nonce: zod.z.string(),
+	/** The origin to put in the signed message. The app compares it to the hub it dialled. */
+	origin: zod.z.string(),
+	expiresAt: zod.z.number(),
+	signature: zod.z.literal(DEVICE_CERT_SIGNATURE)
+});
+var DeviceChallengeResultSchema = zod.z.discriminatedUnion("ok", [DeviceChallengeSchema.extend({ ok: zod.z.literal(true) }), DeviceRefusalSchema]);
+var DeviceProofInputSchema = zod.z.object({
+	certPem: PemSchema,
+	nonce: zod.z.string().min(1).max(256),
+	/** ECDSA P-256 SHA-256 over {@link buildDeviceSignatureMessage}; raw r||s or DER, base64url. */
+	signature: Base64UrlSchema
+});
+var RenewDeviceCertificateOutputSchema = zod.z.object({
+	credentialId: zod.z.string(),
+	certPem: PemSchema,
+	chainPem: PemSchema,
+	notAfter: zod.z.number()
+});
+var RenewDeviceCertificateResultSchema = zod.z.discriminatedUnion("ok", [RenewDeviceCertificateOutputSchema.extend({ ok: zod.z.literal(true) }), DeviceRefusalSchema]);
+var RevokeOwnDeviceCertificateResultSchema = zod.z.discriminatedUnion("ok", [zod.z.object({
+	ok: zod.z.literal(true),
+	credentialId: zod.z.string(),
+	sessionsEnded: zod.z.number().int()
+}), DeviceRefusalSchema]);
+function formatDeviceRevoker(revoker) {
+	return revoker.kind === "device" ? "device" : `${revoker.kind}:${revoker.userId}`;
+}
+var DeviceCredentialStatusSchema = zod.z.enum([
+	"active",
+	"expired",
+	"revoked"
+]);
+var DeviceCredentialSchema = zod.z.object({
+	id: zod.z.string(),
+	userId: zod.z.string(),
+	username: zod.z.string().nullable(),
+	deviceName: zod.z.string(),
+	platform: DevicePlatformSchema,
+	enrolledVia: zod.z.enum(["qr", "self"]),
+	/** SHA-256 of the leaf certificate DER, colon-hex. */
+	fingerprint: zod.z.string(),
+	issuedAt: zod.z.number(),
+	expiresAt: zod.z.number(),
+	lastUsedAt: zod.z.number().nullable(),
+	lastUsedFrom: zod.z.string().nullable(),
+	revokedAt: zod.z.number().nullable(),
+	/** `admin:<userId>` | `user:<userId>` | `device` | `user-deleted`. */
+	revokedBy: zod.z.string().nullable(),
+	status: DeviceCredentialStatusSchema
+});
+var StartEnrollmentOutputSchema = zod.z.object({
+	/** Shown once; only its hash is kept. */
+	code: zod.z.string(),
+	expiresAt: zod.z.number(),
+	/** `camstack://enroll?hub=…&code=…` — what the QR encodes. */
+	enrollUrl: zod.z.string(),
+	/** The hub origin in the link, or `null` when the hub could not name one (the link then has no `hub`). */
+	hubOrigin: zod.z.string().nullable(),
+	/** Every origin the apps may try (role `appConnections`). */
+	hubOrigins: zod.z.array(zod.z.string())
+});
+/** The `device-certificate` arm of `auth.listLoginMethods`. */
+var DeviceCertificateLoginMethodSchema = zod.z.object({
+	kind: zod.z.literal("device-certificate"),
+	id: zod.z.literal("device-certificate"),
+	label: zod.z.string(),
+	stage: zod.z.literal("primary"),
+	/** tRPC paths under the hub's `auth` router, so a client names no literal. */
+	challengePath: zod.z.literal("auth.getDeviceChallenge"),
+	revokePath: zod.z.literal("auth.revokeOwnDeviceCertificate"),
+	enrollSelfPath: zod.z.literal("auth.enrollSelf"),
+	loginPath: zod.z.literal("auth.loginWithDeviceCertificate"),
+	renewPath: zod.z.literal("auth.renewDeviceCertificate"),
+	signature: zod.z.literal(DEVICE_CERT_SIGNATURE),
+	messageVersion: zod.z.literal(DEVICE_SIGNATURE_MESSAGE_VERSION),
+	/** Which clients can execute it: a native app silently, a browser with a non-extractable WebCrypto key. */
+	clients: zod.z.array(zod.z.enum(["native", "web"]))
+});
+//#endregion
+//#region src/auth/request-origin.ts
+/** host[:port] — a DNS name, IPv4 or bracketed IPv6. No userinfo, path or spaces. */
+var AUTHORITY_RE = /^(?:[a-z0-9.-]+|\[[0-9a-f:.]+\])(?::\d{1,5})?$/i;
+/** Same grammar as the hub's `parseForwardedPrefix` (spa-mount.ts). */
+var PREFIX_RE = /^\/[A-Za-z0-9_\-.]+(?:\/[A-Za-z0-9_\-.]+)*$/;
+var MAX_PREFIX_LENGTH = 512;
+/** First value of a possibly comma-joined forwarded header (the client-most proxy). */
+function firstValue(value) {
+	if (value === void 0) return null;
+	const first = value.split(",")[0]?.trim() ?? "";
+	return first.length === 0 ? null : first;
+}
+/** `scheme://host[:port]` normalised by WHATWG URL, or `null` if it is not an http(s) origin. */
+function normalizeOrigin(value) {
+	try {
+		const url = new URL(value);
+		if (url.protocol !== "https:" && url.protocol !== "http:") return null;
+		if (url.username !== "" || url.password !== "") return null;
+		return url.origin;
+	} catch {
+		return null;
+	}
+}
+/** The mount prefix the relay named (no trailing slash), or `''`. Invalid = absent. */
+function requestMountPrefix(headers) {
+	const raw = headers["x-forwarded-prefix"];
+	if (raw === void 0 || raw.length === 0 || raw.length > MAX_PREFIX_LENGTH) return "";
+	const trimmed = raw.endsWith("/") ? raw.slice(0, -1) : raw;
+	if (trimmed === "" || !PREFIX_RE.test(trimmed)) return "";
+	if (trimmed.split("/").some((segment) => segment === ".." || segment === ".")) return "";
+	return trimmed;
+}
+/**
+* The origins the request CLAIMS, most specific first: the proxy's
+* `X-Forwarded-Host` over `Host`; the named `X-Forwarded-Proto`, or https
+* then http when none is named (the hub terminates TLS itself on 4443).
+*/
+function claimedRequestOrigins(headers) {
+	const authority = firstValue(headers["x-forwarded-host"]) ?? firstValue(headers["host"]);
+	if (authority === null || !AUTHORITY_RE.test(authority)) return [];
+	const proto = firstValue(headers["x-forwarded-proto"])?.toLowerCase() ?? null;
+	const schemes = proto === "https" || proto === "http" ? [proto] : proto === null ? ["https", "http"] : [];
+	const out = [];
+	for (const scheme of schemes) {
+		const origin = normalizeOrigin(`${scheme}://${authority}`);
+		if (origin !== null) out.push(origin);
+	}
+	return out;
+}
+/** Every origin the hub advertises itself at, normalised. Never the app link, never loopback. */
+function advertisedHubOrigins(book) {
+	const candidates = [];
+	for (const row of book.rows) {
+		if (row.kind === "app-link" || row.kind === "loopback") continue;
+		candidates.push(row.baseUrl);
+	}
+	const { publicEndpoint, internal, appConnections } = book.roles;
+	if (publicEndpoint.resolved !== null) candidates.push(publicEndpoint.resolved);
+	if (internal.resolved !== null) candidates.push(internal.resolved);
+	candidates.push(...appConnections.resolved);
+	candidates.push(...book.listenerOrigins ?? []);
+	const out = /* @__PURE__ */ new Set();
+	for (const candidate of candidates) {
+		const origin = normalizeOrigin(candidate);
+		if (origin !== null) out.add(origin);
+	}
+	return out;
+}
+/**
+* The origin to send the browser back to: the first claimed origin that is in
+* `allowed`, or `null` (the caller then uses its default address).
+*/
+function pickRequestOrigin(headers, allowed) {
+	for (const origin of claimedRequestOrigins(headers)) if (allowed.has(origin)) return origin;
+	return null;
+}
+//#endregion
 //#region src/expression/binding-source.ts
 /**
 * What an expression's named bindings READ from.
@@ -13549,6 +13873,224 @@ var keychainCapability = {
 	}
 };
 //#endregion
+//#region src/capabilities/device-credentials.cap.ts
+var DeviceCaStatusSchema = zod.z.discriminatedUnion("state", [
+	zod.z.object({ state: zod.z.literal("absent") }),
+	zod.z.object({
+		state: zod.z.literal("ready"),
+		subject: zod.z.string(),
+		fingerprintSha256: zod.z.string(),
+		validTo: zod.z.string()
+	}),
+	zod.z.object({
+		state: zod.z.literal("unavailable"),
+		reason: zod.z.string()
+	})
+]);
+var DeviceCertificateSettingsSchema = zod.z.object({ selfEnrollment: zod.z.enum(["allowed", "disabled"]) });
+/**
+* `device-credentials` — the admin surface of device certificates (D855).
+*
+* Everything a device does ITSELF — completing an enrollment, getting a
+* challenge, signing in, renewing — is a PUBLIC procedure of the hub's `auth`
+* router (`auth.completeEnrollment`, `getDeviceChallenge`,
+* `loginWithDeviceCertificate`, `renewDeviceCertificate`): those legs are
+* proofs of possession, not capability calls, and must not be reachable as
+* cap methods. This cap holds only what an operator does about them.
+*
+* Provider: `local-auth`, which also owns the device CA and the registry.
+* The hub is the only node that persists device credentials.
+*/
+var deviceCredentialsCapability = {
+	name: "device-credentials",
+	scope: "system",
+	mode: "singleton",
+	methods: {
+		/**
+		* Every enrolled device, newest first; `userId` narrows to one user.
+		* `status` is derived: revoked wins over expired.
+		*/
+		listDeviceCredentials: require_sleep.method(zod.z.object({
+			userId: zod.z.string().min(1).optional(),
+			includeRevoked: zod.z.boolean().default(false)
+		}), zod.z.array(DeviceCredentialSchema).readonly(), { auth: "admin" }),
+		/**
+		* Mint a one-shot enrollment code for `userId` and a device name: 128-bit
+		* random, single use, 10 minutes, kept only as a hash. Returns the code
+		* once, with the `camstack://enroll?hub=…&code=…` link a QR carries.
+		* `caller` (the admin) is recorded in the audit trail.
+		*/
+		startEnrollment: require_sleep.method(zod.z.object({
+			userId: zod.z.string().min(1),
+			deviceName: zod.z.string().min(1).max(80)
+		}), StartEnrollmentOutputSchema, {
+			kind: "mutation",
+			auth: "admin",
+			caller: "required"
+		}),
+		/**
+		* Revoke a credential: its certificate stops logging in at once, and every
+		* session it opened ends (an open session also dies at its next refresh
+		* even if this call raced it). Idempotent.
+		*/
+		revokeDeviceCredential: require_sleep.method(zod.z.object({ id: zod.z.string().min(1) }), zod.z.object({
+			revoked: zod.z.boolean(),
+			sessionsEnded: zod.z.number().int(),
+			status: DeviceCredentialStatusSchema
+		}), {
+			kind: "mutation",
+			auth: "admin",
+			caller: "required"
+		}),
+		/**
+		* Hub-wide device-certificate settings. `selfEnrollment`: `allowed`
+		* (default) lets a signed-in user enroll their own device after a step-up
+		* sign-in; `disabled` makes `auth.enrollSelf` refuse. The admin QR path is
+		* unaffected. Hub-wide only (no per-role switch).
+		*/
+		getDeviceCertificateSettings: require_sleep.method(zod.z.object({}), DeviceCertificateSettingsSchema, { auth: "admin" }),
+		setDeviceCertificateSettings: require_sleep.method(DeviceCertificateSettingsSchema, DeviceCertificateSettingsSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Delete the registry row of a REVOKED credential (clean-up; the audit trail
+		* keeps the revocation). Refuses a live credential: revoke it first. After
+		* the row is gone the device's next call answers `unknown-credential`.
+		*/
+		deleteDeviceCredential: require_sleep.method(zod.z.object({ id: zod.z.string().min(1) }), zod.z.object({ result: zod.z.enum([
+			"deleted",
+			"live",
+			"unknown"
+		]) }), {
+			kind: "mutation",
+			auth: "admin",
+			caller: "required"
+		}),
+		/**
+		* The device CA: `absent` until the first enrollment creates it (lazily,
+		* never rotated on boot), `unavailable` while the keychain cannot answer.
+		*/
+		getDeviceCaStatus: require_sleep.method(zod.z.object({}), DeviceCaStatusSchema, { auth: "admin" }),
+		/** Rename a credential (the label only; the certificate is unchanged). */
+		renameDeviceCredential: require_sleep.method(zod.z.object({
+			id: zod.z.string().min(1),
+			deviceName: zod.z.string().min(1).max(80)
+		}), zod.z.object({ renamed: zod.z.boolean() }), {
+			kind: "mutation",
+			auth: "admin"
+		})
+	}
+};
+//#endregion
+//#region src/capabilities/node-certificates.cap.ts
+/**
+* `node-certificates` - what a node holds and the two renewals the hub drives
+* (D856): the node's MESH leaf (mutual TLS to the hub) and its HTTPS leaf (issued
+* from the hub's local CA so a device that trusts the hub root trusts the node).
+*
+* Provided by the AGENT RUNTIME (the synthetic `agent-runtime` addon id, like
+* `server-management`): the hub reaches it through the ordinary node-pinned
+* capability call - no new Moleculer action. The hub's own certificates are
+* handled in-process by the hub (`certificates` router), so this cap has no hub
+* provider.
+*
+* No private key ever crosses the mesh: the node generates its key pair, sends a
+* CSR, and the hub returns only the signed certificate.
+*/
+var MeshLeafInfoSchema = zod.z.object({
+	cn: zod.z.string(),
+	serial: zod.z.string(),
+	fingerprintSha256: zod.z.string(),
+	notBefore: zod.z.number(),
+	notAfter: zod.z.number()
+});
+var HttpsLeafInfoSchema = zod.z.object({
+	fingerprintSha256: zod.z.string(),
+	issuer: zod.z.string(),
+	sans: zod.z.array(zod.z.string()),
+	notBefore: zod.z.number(),
+	notAfter: zod.z.number()
+});
+var NodeHttpsStateSchema = zod.z.discriminatedUnion("state", [zod.z.object({
+	state: zod.z.literal("served"),
+	leaf: HttpsLeafInfoSchema
+}), zod.z.object({
+	state: zod.z.literal("not-issued"),
+	reason: zod.z.string()
+})]);
+var nodeCertificatesCapability = {
+	name: "node-certificates",
+	scope: "system",
+	mode: "singleton",
+	internal: true,
+	methods: {
+		/** The node's current mesh leaf (`null` when it is not enrolled on mTLS) and HTTPS state. */
+		getCertificates: require_sleep.method(zod.z.object({}), zod.z.object({
+			nodeId: zod.z.string(),
+			mesh: MeshLeafInfoSchema.nullable(),
+			https: NodeHttpsStateSchema
+		}), { auth: "admin" }),
+		/** Generate a NEW mesh key pair on the node; return the CSR (CN = node id). The key stays here. */
+		prepareMeshRenewal: require_sleep.method(zod.z.object({}), zod.z.object({ csrPem: zod.z.string() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* Install the hub-signed leaf for the key made by `prepareMeshRenewal`: persist it
+		* (keeping the previous one), then reconnect to the hub with it. The node reverts to
+		* the previous leaf by itself unless `confirmMeshLeaf` arrives within `confirmWithinMs`.
+		*/
+		installMeshLeaf: require_sleep.method(zod.z.object({
+			certPem: zod.z.string().min(1),
+			caCertPem: zod.z.string().min(1),
+			confirmWithinMs: zod.z.number().int().min(1e4).max(6e5)
+		}), zod.z.object({
+			fingerprintSha256: zod.z.string(),
+			serial: zod.z.string()
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** The hub saw the node reconnect with the new leaf: keep it, forget the previous one. */
+		confirmMeshLeaf: require_sleep.method(zod.z.object({ fingerprintSha256: zod.z.string() }), zod.z.object({ confirmed: zod.z.boolean() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Go back to the previous leaf now. `false` when there is none to go back to. */
+		rollbackMeshLeaf: require_sleep.method(zod.z.object({}), zod.z.object({ rolledBack: zod.z.boolean() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** A key pair + CSR for the node's HTTPS leaf, and the names the node reports for itself. */
+		prepareHttpsCertificate: require_sleep.method(zod.z.object({}), zod.z.object({
+			csrPem: zod.z.string(),
+			hostnames: zod.z.array(zod.z.string()),
+			addresses: zod.z.array(zod.z.string()),
+			/** SHA-256 of the hub local CA this node pinned at its first install; `null` before one. */
+			pinnedCaFingerprintSha256: zod.z.string().nullable()
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Install the hub-signed HTTPS leaf and hot-swap the serving context (no restart). */
+		installHttpsCertificate: require_sleep.method(zod.z.object({
+			certPem: zod.z.string().min(1),
+			caCertPem: zod.z.string().min(1),
+			/**
+			* The hub signals that its local CA was rotated (D227) and this leaf chains to the NEW
+			* one. Only the hub, over the authenticated mesh, can say so; a leaf with a different CA
+			* and no signal is refused.
+			*/
+			caRotation: zod.z.boolean().optional()
+		}), HttpsLeafInfoSchema, {
+			kind: "mutation",
+			auth: "admin"
+		})
+	},
+	mount: { kind: "skip" }
+};
+//#endregion
 //#region src/capabilities/keychain-admin.cap.ts
 /**
 * `keychain-admin` — the operator's view of the keychain (System → Secrets).
@@ -76263,6 +76805,54 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"deviceCredentials.deleteDeviceCredential": {
+		capName: "device-credentials",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"deviceCredentials.getDeviceCaStatus": {
+		capName: "device-credentials",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"deviceCredentials.getDeviceCertificateSettings": {
+		capName: "device-credentials",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"deviceCredentials.listDeviceCredentials": {
+		capName: "device-credentials",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"deviceCredentials.renameDeviceCredential": {
+		capName: "device-credentials",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"deviceCredentials.revokeDeviceCredential": {
+		capName: "device-credentials",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"deviceCredentials.setDeviceCertificateSettings": {
+		capName: "device-credentials",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"deviceCredentials.startEnrollment": {
+		capName: "device-credentials",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"deviceDiscovery.adoptDevice": {
 		capName: "device-discovery",
 		capScope: "device",
@@ -78423,6 +79013,48 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"nodeCertificates.confirmMeshLeaf": {
+		capName: "node-certificates",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"nodeCertificates.getCertificates": {
+		capName: "node-certificates",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"nodeCertificates.installHttpsCertificate": {
+		capName: "node-certificates",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"nodeCertificates.installMeshLeaf": {
+		capName: "node-certificates",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"nodeCertificates.prepareHttpsCertificate": {
+		capName: "node-certificates",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"nodeCertificates.prepareMeshRenewal": {
+		capName: "node-certificates",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"nodeCertificates.rollbackMeshLeaf": {
+		capName: "node-certificates",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"nodes.clusterAddonStatus": {
 		capName: "nodes",
 		capScope: "system",
@@ -82700,6 +83332,7 @@ var KNOWN_CAP_NAMES = [
 	"detection-pipeline",
 	"device-admin-link",
 	"device-adoption",
+	"device-credentials",
 	"device-discovery",
 	"device-export",
 	"device-extension",
@@ -82751,6 +83384,7 @@ var KNOWN_CAP_NAMES = [
 	"network-access",
 	"network-link",
 	"network-quality",
+	"node-certificates",
 	"nodes",
 	"notification-output",
 	"notification-rules",
@@ -82938,6 +83572,7 @@ var SYSTEM_CAP_NAMES = [
 	"database-snapshot",
 	"decoder",
 	"device-adoption",
+	"device-credentials",
 	"device-export",
 	"device-manager",
 	"device-provider",
@@ -82963,6 +83598,7 @@ var SYSTEM_CAP_NAMES = [
 	"mqtt-broker",
 	"network-access",
 	"network-quality",
+	"node-certificates",
 	"nodes",
 	"notification-output",
 	"notification-rules",
@@ -84964,6 +85600,7 @@ var CAPABILITY_NAMES = {
 	detectionPipeline: "detection-pipeline",
 	deviceAdminLink: "device-admin-link",
 	deviceAdoption: "device-adoption",
+	deviceCredentials: "device-credentials",
 	deviceDiscovery: "device-discovery",
 	deviceExport: "device-export",
 	deviceExtension: "device-extension",
@@ -85015,6 +85652,7 @@ var CAPABILITY_NAMES = {
 	networkAccess: "network-access",
 	networkLink: "network-link",
 	networkQuality: "network-quality",
+	nodeCertificates: "node-certificates",
 	nodes: "nodes",
 	notificationOutput: "notification-output",
 	notificationRules: "notification-rules",
@@ -85287,6 +85925,10 @@ var CAPABILITY_ROUTER_KEYS = [
 		key: "deviceAdoption",
 		name: "device-adoption"
 	},
+	{
+		key: "deviceCredentials",
+		name: "device-credentials"
+	},
 	{
 		key: "deviceDiscovery",
 		name: "device-discovery"
@@ -85491,6 +86133,10 @@ var CAPABILITY_ROUTER_KEYS = [
 		key: "networkQuality",
 		name: "network-quality"
 	},
+	{
+		key: "nodeCertificates",
+		name: "node-certificates"
+	},
 	{
 		key: "nodes",
 		name: "nodes"
@@ -85828,6 +86474,7 @@ var ALL_CAPABILITY_DEFINITIONS = [
 	detectionPipelineCapability,
 	deviceAdminLinkCapability,
 	deviceAdoptionCapability,
+	deviceCredentialsCapability,
 	deviceDiscoveryCapability,
 	deviceExportCapability,
 	deviceExtensionCapability,
@@ -85879,6 +86526,7 @@ var ALL_CAPABILITY_DEFINITIONS = [
 	networkAccessCapability,
 	networkLinkCapability,
 	networkQualityCapability,
+	nodeCertificatesCapability,
 	nodesCapability,
 	notificationOutputCapability,
 	notificationRulesCapability,
@@ -89384,6 +90032,16 @@ function createSystemProxy(api) {
 			release: (input) => dispatch("deviceAdoption", "release", "mutation", input),
 			resync: (input) => dispatch("deviceAdoption", "resync", "mutation", input)
 		},
+		deviceCredentials: {
+			listDeviceCredentials: (input) => dispatch("deviceCredentials", "listDeviceCredentials", "query", input),
+			startEnrollment: (input) => dispatch("deviceCredentials", "startEnrollment", "mutation", input),
+			revokeDeviceCredential: (input) => dispatch("deviceCredentials", "revokeDeviceCredential", "mutation", input),
+			getDeviceCertificateSettings: (input) => dispatch("deviceCredentials", "getDeviceCertificateSettings", "query", input),
+			setDeviceCertificateSettings: (input) => dispatch("deviceCredentials", "setDeviceCertificateSettings", "mutation", input),
+			deleteDeviceCredential: (input) => dispatch("deviceCredentials", "deleteDeviceCredential", "mutation", input),
+			getDeviceCaStatus: (input) => dispatch("deviceCredentials", "getDeviceCaStatus", "query", input),
+			renameDeviceCredential: (input) => dispatch("deviceCredentials", "renameDeviceCredential", "mutation", input)
+		},
 		deviceExport: {
 			getStatus: (input) => dispatch("deviceExport", "getStatus", "query", input),
 			listSupportedDeviceKinds: (input) => dispatch("deviceExport", "listSupportedDeviceKinds", "query", input),
@@ -98718,6 +99376,9 @@ exports.ClusterModelChoiceSchema = ClusterModelChoiceSchema;
 exports.CollectionColumnSchema = CollectionColumnSchema;
 exports.CollectionIndexSchema = CollectionIndexSchema;
 exports.ColorStatusSchema = ColorStatusSchema;
+exports.CompleteEnrollmentInputSchema = CompleteEnrollmentInputSchema;
+exports.CompleteEnrollmentOutputSchema = CompleteEnrollmentOutputSchema;
+exports.CompleteEnrollmentResultSchema = CompleteEnrollmentResultSchema;
 exports.ComposableCapabilitiesSchema = ComposableCapabilitiesSchema;
 exports.ComposableCapabilitySchema = ComposableCapabilitySchema;
 exports.ComposableFieldSchema = ComposableFieldSchema;
@@ -98835,6 +99496,7 @@ exports.DEFAULT_SESSION_PLACEMENT_POLICY = DEFAULT_SESSION_PLACEMENT_POLICY;
 exports.DEFAULT_SHARE_SOURCE = DEFAULT_SHARE_SOURCE;
 exports.DEFAULT_TIMELAPSE_PREVIEW_TEXT = DEFAULT_TIMELAPSE_PREVIEW_TEXT;
 exports.DEFAULT_TOKEN_EXPIRY = require_sleep.DEFAULT_TOKEN_EXPIRY;
+exports.DEFINITIVE_DEVICE_REFUSALS = DEFINITIVE_DEVICE_REFUSALS;
 exports.DERIVED_CAMERA_SILENCED_CAP_NAMES = DERIVED_CAMERA_SILENCED_CAP_NAMES;
 exports.DETAIL_CROP_PADDING_FIELD = DETAIL_CROP_PADDING_FIELD;
 exports.DETAIL_CROP_PADDING_KEY = DETAIL_CROP_PADDING_KEY;
@@ -98846,14 +99508,24 @@ exports.DETECTOR_ACCURACY = DETECTOR_ACCURACY;
 exports.DETECTOR_PERF = DETECTOR_PERF;
 exports.DEVICE_BACKEND_TO_FORMAT = DEVICE_BACKEND_TO_FORMAT;
 exports.DEVICE_CAP_NAMES = DEVICE_CAP_NAMES;
+exports.DEVICE_CERT_RENEW_WINDOW_DAYS = DEVICE_CERT_RENEW_WINDOW_DAYS;
+exports.DEVICE_CERT_SIGNATURE = DEVICE_CERT_SIGNATURE;
+exports.DEVICE_CERT_VALIDITY_DAYS = DEVICE_CERT_VALIDITY_DAYS;
 exports.DEVICE_CHILDREN_BATCH_MAX = require_sleep.DEVICE_CHILDREN_BATCH_MAX;
+exports.DEVICE_DEFINITIVE_REFUSALS_BEFORE_DELETE = DEVICE_DEFINITIVE_REFUSALS_BEFORE_DELETE;
 exports.DEVICE_DO_ACTIONS = DEVICE_DO_ACTIONS;
+exports.DEVICE_ENROLLMENT_TTL_MS = DEVICE_ENROLLMENT_TTL_MS;
+exports.DEVICE_NONCE_TTL_MS = DEVICE_NONCE_TTL_MS;
 exports.DEVICE_PROFILES = DEVICE_PROFILES;
 exports.DEVICE_RAMP = DEVICE_RAMP;
+exports.DEVICE_REFRESH_REFUSAL_PREFIX = DEVICE_REFRESH_REFUSAL_PREFIX;
 exports.DEVICE_RESTORE_RETRY_CONCURRENCY = DEVICE_RESTORE_RETRY_CONCURRENCY;
 exports.DEVICE_RESTORE_RETRY_DELAYS_MS = DEVICE_RESTORE_RETRY_DELAYS_MS;
+exports.DEVICE_SAN_CREDENTIAL_PREFIX = DEVICE_SAN_CREDENTIAL_PREFIX;
+exports.DEVICE_SAN_USER_PREFIX = DEVICE_SAN_USER_PREFIX;
 exports.DEVICE_SCOPED_CAPS = require_sleep.DEVICE_SCOPED_CAPS;
 exports.DEVICE_SETTINGS_CONTRIBUTION_METHODS = require_sleep.DEVICE_SETTINGS_CONTRIBUTION_METHODS;
+exports.DEVICE_SIGNATURE_MESSAGE_VERSION = DEVICE_SIGNATURE_MESSAGE_VERSION;
 exports.DEVICE_STATE_READERS = DEVICE_STATE_READERS;
 exports.DEVICE_STATUS_METHOD = require_sleep.DEVICE_STATUS_METHOD;
 exports.DEVICE_TYPE_CONTROL_KIND = DEVICE_TYPE_CONTROL_KIND;
@@ -98881,9 +99553,17 @@ exports.DetectionSourceSchema = DetectionSourceSchema;
 exports.DetectionSourcesSchema = DetectionSourcesSchema;
 exports.DetectorStoreClearSchema = DetectorStoreClearSchema;
 exports.DeviceAdminLinkSchema = DeviceAdminLinkSchema;
+exports.DeviceCaStatusSchema = DeviceCaStatusSchema;
+exports.DeviceCertificateLoginMethodSchema = DeviceCertificateLoginMethodSchema;
+exports.DeviceCertificateSettingsSchema = DeviceCertificateSettingsSchema;
+exports.DeviceChallengeResultSchema = DeviceChallengeResultSchema;
+exports.DeviceChallengeSchema = DeviceChallengeSchema;
 exports.DeviceCodeSeveritySchema = DeviceCodeSeveritySchema;
 exports.DeviceConfig = DeviceConfig;
+exports.DeviceCredentialSchema = DeviceCredentialSchema;
+exports.DeviceCredentialStatusSchema = DeviceCredentialStatusSchema;
 exports.DeviceDiscoveryStatusSchema = DeviceDiscoveryStatusSchema;
+exports.DeviceEnrollProofSchema = DeviceEnrollProofSchema;
 exports.DeviceExportExposeInputSchema = ExposeInputSchema;
 exports.DeviceExportStatusSchema = DeviceExportStatusSchema;
 exports.DeviceExportUnexposeInputSchema = UnexposeInputSchema;
@@ -98891,11 +99571,16 @@ exports.DeviceFeature = require_err_msg.DeviceFeature;
 exports.DeviceInfoSchema = DeviceInfoSchema;
 exports.DeviceModelChoiceSchema = DeviceModelChoiceSchema;
 exports.DeviceNetworkStatsSchema = DeviceNetworkStatsSchema;
+exports.DevicePlatformSchema = DevicePlatformSchema;
+exports.DeviceProofInputSchema = DeviceProofInputSchema;
 exports.DeviceRecommendationSchema = DeviceRecommendationSchema;
+exports.DeviceRefusalReasonSchema = DeviceRefusalReasonSchema;
+exports.DeviceRefusalSchema = DeviceRefusalSchema;
 exports.DeviceRestoreRetryScheduler = DeviceRestoreRetryScheduler;
 exports.DeviceRole = require_err_msg.DeviceRole;
 exports.DeviceRuntimeState = DeviceRuntimeState;
 exports.DeviceSelectorSchema = DeviceSelectorSchema;
+exports.DeviceSignaturePurposeSchema = DeviceSignaturePurposeSchema;
 exports.DeviceStatusSchema = DeviceStatusSchema;
 exports.DeviceType = require_err_msg.DeviceType;
 exports.DiagnosticIdSchema = DiagnosticIdSchema;
@@ -98948,6 +99633,7 @@ exports.EmbeddingResultSchema = EmbeddingResultSchema;
 exports.EmbeddingTowerSchema = EmbeddingTowerSchema;
 exports.EncodeProfileSchema = EncodeProfileSchema;
 exports.EnrichedWidgetMetadataSchema = EnrichedWidgetMetadataSchema;
+exports.EnrollSelfInputSchema = EnrollSelfInputSchema;
 exports.EnumSensorDateTimeFormatSchema = EnumSensorDateTimeFormatSchema;
 exports.EnumSensorStatusSchema = EnumSensorStatusSchema;
 exports.EventCategory = require_event_category.EventCategory;
@@ -99056,6 +99742,7 @@ exports.HealthStatusSchema = HealthStatusSchema;
 exports.HfModelResolutionSchema = HfModelResolutionSchema;
 exports.HistoryPointSchema = HistoryPointSchema;
 exports.HistoryResolutionEnum = HistoryResolutionEnum;
+exports.HttpsLeafInfoSchema = HttpsLeafInfoSchema;
 exports.HubAddressRoleSchema = HubAddressRoleSchema;
 exports.HumidifierStatusSchema = HumidifierStatusSchema;
 exports.HumiditySensorStatusSchema = HumiditySensorStatusSchema;
@@ -99251,6 +99938,7 @@ exports.MediaPlayerStateSchema = MediaPlayerStateSchema;
 exports.MediaPlayerStatusSchema = MediaPlayerStatusSchema;
 exports.MediaPresenceOwnerKindSchema = MediaPresenceOwnerKindSchema;
 exports.MediaRelocateModeSchema = MediaRelocateModeSchema;
+exports.MeshLeafInfoSchema = MeshLeafInfoSchema;
 exports.MeshPeerSchema = MeshPeerSchema;
 exports.MeshStatusSchema = MeshStatusSchema;
 exports.MethodAccessSchema = MethodAccessSchema;
@@ -99540,6 +100228,7 @@ exports.NodeColorIdSchema = require_node_color.NodeColorIdSchema;
 exports.NodeDeviceChangeSchema = NodeDeviceChangeSchema;
 exports.NodeDirectoryEntrySchema = NodeDirectoryEntrySchema;
 exports.NodeDirectorySchema = NodeDirectorySchema;
+exports.NodeHttpsStateSchema = NodeHttpsStateSchema;
 exports.NodeRecommendationSchema = NodeRecommendationSchema;
 exports.NotificationActionIconSchema = NotificationActionIconSchema;
 exports.NotificationActionSchema = NotificationActionSchema;
@@ -99758,6 +100447,8 @@ exports.RelocateMediaInputSchema = RelocateMediaInputSchema;
 exports.RelocateResidueInputSchema = RelocateResidueInputSchema;
 exports.RelocateResidueSchema = RelocateResidueSchema;
 exports.RenderedAsSchema = RenderedAsSchema;
+exports.RenewDeviceCertificateOutputSchema = RenewDeviceCertificateOutputSchema;
+exports.RenewDeviceCertificateResultSchema = RenewDeviceCertificateResultSchema;
 exports.ReportMotionInputSchema = ReportMotionInputSchema;
 exports.ReportedFailureContributionSchema = ReportedFailureContributionSchema;
 exports.ReportedLoadContributionSchema = ReportedLoadContributionSchema;
@@ -99809,6 +100500,7 @@ exports.RetrainTrackSchema = RetrainTrackSchema;
 exports.RetrainTrainingCorpusResolveResultSchema = RetrainTrainingCorpusResolveResultSchema;
 exports.RetrainTrainingCorpusSelectionSchema = RetrainTrainingCorpusSelectionSchema;
 exports.RetrainTransitionResultSchema = RetrainTransitionResultSchema;
+exports.RevokeOwnDeviceCertificateResultSchema = RevokeOwnDeviceCertificateResultSchema;
 exports.RingBuffer = RingBuffer;
 exports.RootStepSupplySchema = RootStepSupplySchema;
 exports.RtpSourceSchema = RtpSourceSchema;
@@ -99912,6 +100604,7 @@ exports.SpatialDetectionSchema = SpatialDetectionSchema;
 exports.SsoBridgeClaimsSchema = SsoBridgeClaimsSchema;
 exports.StaleDevicePinSchema = StaleDevicePinSchema;
 exports.StartEmbeddedInputSchema = StartEmbeddedInputSchema;
+exports.StartEnrollmentOutputSchema = StartEnrollmentOutputSchema;
 exports.StationaryObjectSchema = StationaryObjectSchema;
 exports.StorageAbortUploadInputSchema = AbortUploadInputSchema;
 exports.StorageAccessSchema = StorageAccessSchema;
@@ -100160,6 +100853,7 @@ exports.addonWidgetsCapability = addonWidgetsCapability;
 exports.addonWidgetsSourceCapability = addonWidgetsSourceCapability;
 exports.addonsCapability = addonsCapability;
 exports.adminUiCapability = require_sleep.adminUiCapability;
+exports.advertisedHubOrigins = advertisedHubOrigins;
 exports.airQualitySensorCapability = airQualitySensorCapability;
 exports.alarmDeviceBlocksArming = alarmDeviceBlocksArming;
 exports.alarmDeviceSecureOnArm = alarmDeviceSecureOnArm;
@@ -100212,6 +100906,8 @@ exports.buildAudioArgs = require_composition.buildAudioArgs;
 exports.buildBenchStepTree = buildBenchStepTree;
 exports.buildCapabilityLookup = buildCapabilityLookup;
 exports.buildDeviceAdminUrl = buildDeviceAdminUrl;
+exports.buildDeviceEnrollmentLink = buildDeviceEnrollmentLink;
+exports.buildDeviceSignatureMessage = buildDeviceSignatureMessage;
 exports.buildDoorbellCompositionFeature = buildDoorbellCompositionFeature;
 exports.buildEventKindDescriptor = buildEventKindDescriptor;
 exports.buildFfmpegArgs = require_composition.buildFfmpegArgs;
@@ -100244,6 +100940,7 @@ exports.capacitySessionsOf = capacitySessionsOf;
 exports.carbonMonoxideCapability = carbonMonoxideCapability;
 exports.cellsToRects = cellsToRects;
 exports.checkRoleAddress = checkRoleAddress;
+exports.claimedRequestOrigins = claimedRequestOrigins;
 exports.classifyBearerPrincipal = classifyBearerPrincipal;
 exports.classifyCamerasForBenchmark = classifyCamerasForBenchmark;
 exports.classifyInferenceHardware = classifyInferenceHardware;
@@ -100365,6 +101062,7 @@ exports.detectionPipelineCapability = detectionPipelineCapability;
 exports.deviceAdminLinkCapability = deviceAdminLinkCapability;
 exports.deviceAdoptionCapability = deviceAdoptionCapability;
 exports.deviceBackendToFormat = deviceBackendToFormat;
+exports.deviceCredentialsCapability = deviceCredentialsCapability;
 exports.deviceCustomAction = require_sleep.deviceCustomAction;
 exports.deviceDiscoveryCapability = deviceDiscoveryCapability;
 exports.deviceDoFamily = deviceDoFamily;
@@ -100374,6 +101072,7 @@ exports.deviceManagerCapability = deviceManagerCapability;
 exports.deviceMatchesProfile = deviceMatchesProfile;
 exports.deviceOpsCapability = require_sleep.deviceOpsCapability;
 exports.deviceProviderCapability = deviceProviderCapability;
+exports.deviceRefusalFromMessage = deviceRefusalFromMessage;
 exports.deviceSelectorMatches = deviceSelectorMatches;
 exports.deviceStateCapability = deviceStateCapability;
 exports.deviceStatusCapability = deviceStatusCapability;
@@ -100450,6 +101149,7 @@ exports.findTimezone = findTimezone;
 exports.floodCapability = floodCapability;
 exports.foldSnapshotByFunction = foldSnapshotByFunction;
 exports.forgetKnownSecret = require_sleep.forgetKnownSecret;
+exports.formatDeviceRevoker = formatDeviceRevoker;
 exports.formatForRuntime = formatForRuntime;
 exports.formatMediaOwnerKey = formatMediaOwnerKey;
 exports.formatMinutes = formatMinutes;
@@ -100509,6 +101209,7 @@ exports.isClusterScopedStep = isClusterScopedStep;
 exports.isCollectionArrayMethod = isCollectionArrayMethod;
 exports.isDefaultAlarmProfileId = isDefaultAlarmProfileId;
 exports.isDefaultAppConnectionEndpoint = isDefaultAppConnectionEndpoint;
+exports.isDefinitiveDeviceRefusal = isDefinitiveDeviceRefusal;
 exports.isDeployableToAgent = isDeployableToAgent;
 exports.isDetectionMacroClass = isDetectionMacroClass;
 exports.isDeviceConfigCap = require_sleep.isDeviceConfigCap;
@@ -100631,6 +101332,7 @@ exports.networkAccessCapability = networkAccessCapability;
 exports.networkLinkCapability = networkLinkCapability;
 exports.networkQualityCapability = networkQualityCapability;
 exports.nodeBenchmarkRefusals = nodeBenchmarkRefusals;
+exports.nodeCertificatesCapability = nodeCertificatesCapability;
 exports.nodePickerItems = nodePickerItems;
 exports.nodePin = require_sleep.nodePin;
 exports.nodesCapability = nodesCapability;
@@ -100638,6 +101340,7 @@ exports.normalizeAddonInitResult = require_sleep.normalizeAddonInitResult;
 exports.normalizeAudioLabel = normalizeAudioLabel;
 exports.normalizeCoreBlockWrite = normalizeCoreBlockWrite;
 exports.normalizeNodeId = require_sleep.normalizeNodeId;
+exports.normalizeOrigin = normalizeOrigin;
 exports.normalizeSecretOwner = require_sleep.normalizeSecretOwner;
 exports.normalizeTokenScopes = normalizeTokenScopes;
 exports.normalizeUnit = normalizeUnit;
@@ -100659,6 +101362,7 @@ exports.packagePickerItems = packagePickerItems;
 exports.parseAdminBase = parseAdminBase;
 exports.parseAppAuthCallback = parseAppAuthCallback;
 exports.parseCameraStreamConfig = parseCameraStreamConfig;
+exports.parseDeviceEnrollmentLink = parseDeviceEnrollmentLink;
 exports.parseExpression = require_composition.parseExpression;
 exports.parseJsonArray = require_sleep.parseJsonArray;
 exports.parseJsonObject = require_sleep.parseJsonObject;
@@ -100685,6 +101389,7 @@ exports.pickDetailCropConvention = pickDetailCropConvention;
 exports.pickInvalidClusterStepModels = pickInvalidClusterStepModels;
 exports.pickNativeLeaseOverride = pickNativeLeaseOverride;
 exports.pickPreferredRtspEntry = pickPreferredRtspEntry;
+exports.pickRequestOrigin = pickRequestOrigin;
 exports.pickRestartCandidate = pickRestartCandidate;
 exports.pickVideoEncoder = require_composition.pickVideoEncoder;
 exports.pickerForCondition = pickerForCondition;
@@ -100738,6 +101443,7 @@ exports.reducePoints = reducePoints;
 exports.registerKnownSecret = require_sleep.registerKnownSecret;
 exports.renameAlarmProfile = renameAlarmProfile;
 exports.replacedFieldKeys = replacedFieldKeys;
+exports.requestMountPrefix = requestMountPrefix;
 exports.requiredTopLevelKeys = requiredTopLevelKeys;
 exports.requiresPython = requiresPython;
 exports.reservedSourceOwner = reservedSourceOwner;