@camstack/types 1.2.364 → 1.2.366

package/dist/capabilities/tamper.cap.d.ts

@@ -35,6 +35,16 @@ export declare const tamperCapability: {
      * `scripts/check-runtime-state-durability.ts`.
      */
     readonly durability: 'restored';
+    /**
+     * History (D850): recorded series.
+     */
+    readonly history: {
+        readonly fields: {
+            readonly tampered: {
+                readonly kind: 'boolean';
+            };
+        };
+    };
     /** Clock fields: written, but excluded from the compare that decides
      *  whether persisting is worth a SQLite commit. */
     readonly volatileStateFields: readonly ["lastChangedAt"];

package/dist/capabilities/temperature-sensor.cap.d.ts

@@ -53,6 +53,18 @@ export declare const temperatureSensorCapability: {
      * `scripts/check-runtime-state-durability.ts`.
      */
     readonly durability: 'restored';
+    /**
+     * History (D850): recorded series.
+     */
+    readonly history: {
+        readonly fields: {
+            readonly celsius: {
+                readonly kind: 'gauge';
+                readonly unit: '°C';
+                readonly deadband: 0.1;
+            };
+        };
+    };
     /** Clock fields: written, but excluded from the compare that decides
      *  whether persisting is worth a SQLite commit. */
     readonly volatileStateFields: readonly ["lastFetchedAt"];

package/dist/capabilities/update.cap.d.ts

@@ -51,5 +51,9 @@ export declare const updateCapability: {
      * `scripts/check-runtime-state-durability.ts`.
      */
     readonly durability: 'session';
+    /**
+     * History (D850): none — text and state.
+     */
+    readonly history: 'none';
 };
 export type IUpdateProvider = InferProvider<typeof updateCapability>;

package/dist/capabilities/vacuum-control.cap.d.ts

@@ -244,5 +244,37 @@ export declare const vacuumControlCapability: {
      * `scripts/check-runtime-state-durability.ts`.
      */
     readonly durability: 'session';
+    /**
+     * History (D850): recorded series. Tank levels are fixed-object paths (`cleanWater.level`, ...).
+     */
+    readonly history: {
+        readonly fields: {
+            readonly batteryLevel: {
+                readonly kind: 'gauge';
+                readonly unit: '%';
+                readonly deadband: 2;
+            };
+            readonly 'cleanWater.level': {
+                readonly kind: 'gauge';
+                readonly unit: '%';
+                readonly deadband: 2;
+            };
+            readonly 'dirtyWater.level': {
+                readonly kind: 'gauge';
+                readonly unit: '%';
+                readonly deadband: 2;
+            };
+            readonly 'detergent.level': {
+                readonly kind: 'gauge';
+                readonly unit: '%';
+                readonly deadband: 2;
+            };
+            readonly 'dustBin.level': {
+                readonly kind: 'gauge';
+                readonly unit: '%';
+                readonly deadband: 2;
+            };
+        };
+    };
 };
 export type IVacuumControlProvider = InferProvider<typeof vacuumControlCapability>;

package/dist/capabilities/valve.cap.d.ts

@@ -95,5 +95,17 @@ export declare const valveCapability: {
      * `scripts/check-runtime-state-durability.ts`.
      */
     readonly durability: 'session';
+    /**
+     * History (D850): recorded series. Actuator tier: position keeps every change.
+     */
+    readonly history: {
+        readonly fields: {
+            readonly position: {
+                readonly kind: 'gauge';
+                readonly unit: '%';
+                readonly minIntervalMs: 0;
+            };
+        };
+    };
 };
 export type IValveProvider = InferProvider<typeof valveCapability>;

package/dist/capabilities/vibration.cap.d.ts

@@ -35,6 +35,16 @@ export declare const vibrationCapability: {
      * `scripts/check-runtime-state-durability.ts`.
      */
     readonly durability: 'restored';
+    /**
+     * History (D850): recorded series.
+     */
+    readonly history: {
+        readonly fields: {
+            readonly detected: {
+                readonly kind: 'boolean';
+            };
+        };
+    };
     /** Clock fields: written, but excluded from the compare that decides
      *  whether persisting is worth a SQLite commit. */
     readonly volatileStateFields: readonly ["lastChangedAt"];

package/dist/capabilities/water-heater.cap.d.ts

@@ -80,5 +80,22 @@ export declare const waterHeaterCapability: {
      * `scripts/check-runtime-state-durability.ts`.
      */
     readonly durability: 'session';
+    /**
+     * History (D850): recorded series. The schema carries no unit; providers publish Celsius. Setpoint keeps every change.
+     */
+    readonly history: {
+        readonly fields: {
+            readonly currentTemp: {
+                readonly kind: 'gauge';
+                readonly unit: '°C';
+                readonly deadband: 0.5;
+            };
+            readonly targetTemp: {
+                readonly kind: 'gauge';
+                readonly unit: '°C';
+                readonly minIntervalMs: 0;
+            };
+        };
+    };
 };
 export type IWaterHeaterProvider = InferProvider<typeof waterHeaterCapability>;

package/dist/capabilities/weather.cap.d.ts

@@ -78,5 +78,32 @@ export declare const weatherCapability: {
      * `scripts/check-runtime-state-durability.ts`.
      */
     readonly durability: 'session';
+    /**
+     * History (D850): recorded series. Units follow the sibling `*Unit` fields.
+     */
+    readonly history: {
+        readonly fields: {
+            readonly temperature: {
+                readonly kind: 'gauge';
+                readonly unitFrom: 'temperatureUnit';
+                readonly deadband: 0.2;
+            };
+            readonly humidity: {
+                readonly kind: 'gauge';
+                readonly unit: '%';
+                readonly deadband: 1;
+            };
+            readonly pressure: {
+                readonly kind: 'gauge';
+                readonly unitFrom: 'pressureUnit';
+                readonly deadband: 0.5;
+            };
+            readonly windSpeed: {
+                readonly kind: 'gauge';
+                readonly unitFrom: 'windSpeedUnit';
+                readonly deadband: 0.5;
+            };
+        };
+    };
 };
 export type IWeatherProvider = InferProvider<typeof weatherCapability>;

package/dist/capabilities/zone-analytics.cap.d.ts

@@ -462,6 +462,10 @@ export declare const zoneAnalyticsCapability: {
      * `scripts/check-runtime-state-durability.ts`.
      */
     readonly durability: 'session';
+    /**
+     * History (D850): none — occupancy is the addon series `pipeline-analytics/occupancy`; the rest is per-zone arrays keyed by runtime ids.
+     */
+    readonly history: 'none';
 };
 export type IZoneAnalyticsProvider = InferProvider<typeof zoneAnalyticsCapability>;
 export { CameraOccupancySnapshotSchema as _CameraOccupancySnapshotSchema, HistoryPointSchema, HistoryRangeSchema, HistoryResolutionEnum, PerScopeBreakdownSchema, StationaryObjectSchema, ZoneScopeBreakdownSchema, };

package/dist/capabilities/zone-rules.cap.d.ts

@@ -156,5 +156,9 @@ export declare const zoneRulesCapability: {
      * `scripts/check-runtime-state-durability.ts`.
      */
     readonly durability: 'restored';
+    /**
+     * History (D850): none — configuration arrays.
+     */
+    readonly history: 'none';
 };
 export type IZoneRulesProvider = InferProvider<typeof zoneRulesCapability>;

package/dist/capabilities/zones.cap.d.ts

@@ -153,5 +153,9 @@ export declare const zonesCapability: {
      * `scripts/check-runtime-state-durability.ts`.
      */
     readonly durability: 'restored';
+    /**
+     * History (D850): none — configuration arrays.
+     */
+    readonly history: 'none';
 };
 export type IZonesProvider = InferProvider<typeof zonesCapability>;

package/dist/client.d.ts

@@ -14,4 +14,4 @@
  * value this entry does not export — a missing name here is `undefined` at
  * runtime, not a build error.
  */
-export { APPLE_SA_TO_MACRO, AUDIO_MACRO_LABELS, AlarmArmModeSchema, CLIP_BROKER_PACED_RATES, COCO_TO_MACRO, CamProfileSchema, ICON_CATEGORIES, ICON_ENTRIES, ICON_KEYS, ICON_VIEWER_MODULES, IconKeySchema, LOCATION_ICON_FALLBACK, DEFAULT_TIMELAPSE_PREVIEW_TEXT, DeviceType, EVENTFUL_CAP_NAMES, EVENT_KIND_BY_CAP, EVENT_TAXONOMY, MACRO_LABELS, NC_ALARM_DELAY_MAX_SEC, NC_ALARM_SENSORS_MAX, NC_ALARM_SYSTEM_EVENT_KINDS, NC_ALARM_TRIGGERED_MAX_SEC, NC_BATTERY_CONSUMABLE_SYSTEM_EVENT_KINDS, NC_CAMERA_SCOPE_CAP_NAME, NC_CONSUMABLE_LOW_PERCENT_DEFAULT, NC_CONSUMABLE_LOW_PERCENT_MAX, NC_GROUPING_DEFAULT_SEC, NC_GROUPING_MAX_SEC, NC_GROUPING_MIN_SEC, NC_RULE_EDITOR_SECTION_ORDER, NC_RULE_KIND_SPECS, NC_SENSOR_TRANSITION_UNSUPPORTED_REASON, NC_SYSTEM_EVENT_FAMILY_FILTERS, NC_SYSTEM_EVENT_KIND_GROUP_SPECS, NC_SYSTEM_EVENT_SUMMARY_FAMILIES, NC_TEMPLATE_HELD_BACK_SYSTEM_EVENT_KINDS, NC_TEMPLATE_VARS, NcAlarmConfigSchema, NcAlarmSensorsSchema, NcAlarmSettingsPatchSchema, NcHistoryEntrySchema, NcRuleLastRunsSchema, NodeDirectorySchema, RECORDING_EXPORT_MAX_READ_BYTES, RETRAIN_REVIEW_ADJUSTED_IOU, RETRAIN_REVIEW_MATCH_IOU, RETRAIN_REVIEW_STATUSES, RETRAIN_REVISION_CONFLICT, SystemMirror, TIMELAPSE_DENSE_FLOOR_SEC, TimelapseRuleSchema, YAMNET_TO_MACRO, alarmDeviceBlocksArming, alarmDeviceSecureOnArm, alarmPatchLanded, canonicalIconKey, classifyRetrainReview, conditionVisibleForKind, createSystemProxy, droppedConditionsForKind, iconCategoryLabel, iconEntry, iconsInCategory, isIconKey, isHeldBackTemplateVar, isSystemRuleKind, kindsForDiscriminator, locationIconKey, knownValues, nodePickerItems, packagePickerItems, pickerForCondition, pickerForRuleClasses, parseRetrainRevisionConflict, resolveIconKey, resolveModeDelays, retrainBoxIou, retrainRevisionConflictMessage, ruleDeviceCompatCapNames, ruleEditorSectionsForKind, ruleGroupingApplies, ruleKindOf, ruleKindSpec, ruleSeedForSection, searchIcons, sensorTransitionNeverFires, sensorTransitionOffered, stateLabel, summarizeReview, systemEventDeliveryProblems, systemEventFilterAppliesToAnyKind, systemEventKindsOfFamily, systemFamilyOfKind, templateCarriesSummary, templateVarDeliveryApplies, templateVarKindApplies, templateVarSystemEventApplies, } from './index.js';
+export { APPLE_SA_TO_MACRO, AUDIO_MACRO_LABELS, AlarmArmModeSchema, CLIP_BROKER_PACED_RATES, COCO_TO_MACRO, CamProfileSchema, ICON_CATEGORIES, ICON_ENTRIES, ICON_KEYS, ICON_VIEWER_MODULES, IconKeySchema, LOCATION_ICON_FALLBACK, DEFINITIVE_DEVICE_REFUSALS, DEVICE_CERT_RENEW_WINDOW_DAYS, DEVICE_DEFINITIVE_REFUSALS_BEFORE_DELETE, DEVICE_REFRESH_REFUSAL_PREFIX, DEVICE_CERT_SIGNATURE, DEVICE_SIGNATURE_MESSAGE_VERSION, DEFAULT_TIMELAPSE_PREVIEW_TEXT, DeviceType, EVENTFUL_CAP_NAMES, EVENT_KIND_BY_CAP, EVENT_TAXONOMY, MACRO_LABELS, NC_ALARM_DELAY_MAX_SEC, NC_ALARM_SENSORS_MAX, NC_ALARM_SYSTEM_EVENT_KINDS, NC_ALARM_TRIGGERED_MAX_SEC, NC_BATTERY_CONSUMABLE_SYSTEM_EVENT_KINDS, NC_CAMERA_SCOPE_CAP_NAME, NC_CONSUMABLE_LOW_PERCENT_DEFAULT, NC_CONSUMABLE_LOW_PERCENT_MAX, NC_GROUPING_DEFAULT_SEC, NC_GROUPING_MAX_SEC, NC_GROUPING_MIN_SEC, NC_RULE_EDITOR_SECTION_ORDER, NC_RULE_KIND_SPECS, NC_SENSOR_TRANSITION_UNSUPPORTED_REASON, NC_SYSTEM_EVENT_FAMILY_FILTERS, NC_SYSTEM_EVENT_KIND_GROUP_SPECS, NC_SYSTEM_EVENT_SUMMARY_FAMILIES, NC_TEMPLATE_HELD_BACK_SYSTEM_EVENT_KINDS, NC_TEMPLATE_VARS, NcAlarmConfigSchema, NcAlarmSensorsSchema, NcAlarmSettingsPatchSchema, NcHistoryEntrySchema, NcRuleLastRunsSchema, NodeDirectorySchema, RECORDING_EXPORT_MAX_READ_BYTES, RETRAIN_REVIEW_ADJUSTED_IOU, RETRAIN_REVIEW_MATCH_IOU, RETRAIN_REVIEW_STATUSES, RETRAIN_REVISION_CONFLICT, SystemMirror, TIMELAPSE_DENSE_FLOOR_SEC, TimelapseRuleSchema, YAMNET_TO_MACRO, alarmDeviceBlocksArming, alarmDeviceSecureOnArm, alarmPatchLanded, canonicalIconKey, buildDeviceEnrollmentLink, buildDeviceSignatureMessage, deviceRefusalFromMessage, isDefinitiveDeviceRefusal, classifyRetrainReview, conditionVisibleForKind, createSystemProxy, droppedConditionsForKind, iconCategoryLabel, iconEntry, iconsInCategory, isIconKey, isHeldBackTemplateVar, isSystemRuleKind, kindsForDiscriminator, locationIconKey, knownValues, nodePickerItems, parseDeviceEnrollmentLink, packagePickerItems, pickerForCondition, pickerForRuleClasses, parseRetrainRevisionConflict, resolveIconKey, resolveModeDelays, retrainBoxIou, retrainRevisionConflictMessage, ruleDeviceCompatCapNames, ruleEditorSectionsForKind, ruleGroupingApplies, ruleKindOf, ruleKindSpec, ruleSeedForSection, searchIcons, sensorTransitionNeverFires, sensorTransitionOffered, stateLabel, summarizeReview, systemEventDeliveryProblems, systemEventFilterAppliesToAnyKind, systemEventKindsOfFamily, systemFamilyOfKind, templateCarriesSummary, templateVarDeliveryApplies, templateVarKindApplies, templateVarSystemEventApplies, } from './index.js';

package/dist/client.js

@@ -559,6 +559,240 @@ zod.z.object({
 	resolution: CamStreamResolutionSchema.optional()
 });
 //#endregion
+//#region src/auth/device-certificate.ts
+/**
+* Device certificates (D855) — the wire contract shared by the hub, the admin
+* UI and the native viewer.
+*
+* A device (a phone) generates its OWN P-256 key pair in hardware (Secure
+* Enclave / Android Keystore / a non-extractable WebCrypto key). The private
+* key never travels. The hub signs the PUBLIC key into an X.509 leaf under a
+* dedicated device CA; the device later proves possession of the key by
+* signing a hub-issued nonce, and the hub answers with the same session a
+* password login opens.
+*
+* Everything on the wire is a small string (a PEM, a base64url signature):
+* D613 is about bulk bytes, and a certificate is ~600 bytes.
+*/
+/** Signature algorithm of every device credential: ECDSA, curve P-256, SHA-256. */
+var DEVICE_CERT_SIGNATURE = "ecdsa-p256-sha256";
+/** First line of every signed message; a change of format bumps the version. */
+var DEVICE_SIGNATURE_MESSAGE_VERSION = "camstack-device-cert-v1";
+zod.z.enum([
+	"login",
+	"renew",
+	"revoke"
+]);
+var DEVICE_CERT_RENEW_WINDOW_DAYS = 30;
+/**
+* The exact bytes a device signs (UTF-8, `\n` separators, no trailing newline):
+*
+*   camstack-device-cert-v1
+*   <login|renew>
+*   <origin>            the hub origin returned by `getDeviceChallenge`
+*   <nonce>
+*
+* The origin is part of the message so a signature collected by a look-alike
+* hub is worthless on the real one; the hub additionally binds the nonce to
+* the origin it issued it for and refuses any other.
+*/
+function buildDeviceSignatureMessage(input) {
+	return [
+		DEVICE_SIGNATURE_MESSAGE_VERSION,
+		input.purpose,
+		input.origin,
+		input.nonce
+	].join("\n");
+}
+/** The deep link a QR carries: `camstack://enroll?hub=<origin>&code=<code>`. */
+function buildDeviceEnrollmentLink(input) {
+	const query = new URLSearchParams();
+	if (input.hub !== void 0) query.set("hub", input.hub);
+	query.set("code", input.code);
+	return `${input.scheme ?? "camstack"}://enroll?${query.toString()}`;
+}
+/** Parse an enrollment deep link; `null` when it is not one. `hub` is absent when the link names none. */
+function parseDeviceEnrollmentLink(raw) {
+	let url;
+	try {
+		url = new URL(raw);
+	} catch {
+		return null;
+	}
+	if (url.protocol !== "camstack:" && url.protocol !== "camstack.dev:") return null;
+	if (url.hostname !== "enroll") return null;
+	const code = url.searchParams.get("code");
+	if (code === null || code === "") return null;
+	const hub = url.searchParams.get("hub");
+	return {
+		hub: hub === null || hub === "" ? null : hub,
+		code
+	};
+}
+var DevicePlatformSchema = zod.z.enum([
+	"ios",
+	"android",
+	"web",
+	"other"
+]);
+var Base64UrlSchema = zod.z.string().min(1).max(4096).regex(/^[A-Za-z0-9_-]+$/);
+var PemSchema = zod.z.string().min(1).max(16384);
+/**
+* Why a device-certificate endpoint said no. Distinct from a transport / 5xx
+* failure: those carry no reason and mean "try again", never "the credential is
+* dead". The viewer switches on this exhaustively.
+*/
+var DeviceRefusalReasonSchema = zod.z.enum([
+	"revoked",
+	"unknown-credential",
+	"expired",
+	"bad-signature",
+	"nonce-invalid",
+	"rate-limited",
+	"invalid-certificate",
+	"superseded",
+	"user-gone",
+	"unavailable",
+	"code-invalid",
+	"self-enrollment-disabled",
+	"step-up-required",
+	"bad-public-key"
+]);
+/** The only answers after which the app may count towards deleting its credential. */
+var DEFINITIVE_DEVICE_REFUSALS = [
+	"revoked",
+	"unknown-credential",
+	"user-gone"
+];
+/** Consecutive DEFINITIVE answers before the app deletes its key and certificate. */
+var DEVICE_DEFINITIVE_REFUSALS_BEFORE_DELETE = 3;
+function isDefinitiveDeviceRefusal(reason) {
+	return DEFINITIVE_DEVICE_REFUSALS.includes(reason);
+}
+var DeviceRefusalSchema = zod.z.object({
+	ok: zod.z.literal(false),
+	reason: DeviceRefusalReasonSchema,
+	definitive: zod.z.boolean(),
+	retryAfterSeconds: zod.z.number().optional()
+});
+/**
+* A credential-bound session that can no longer refresh answers
+* `auth.refreshSession` with UNAUTHORIZED whose message is this prefix + the
+* reason; {@link deviceRefusalFromMessage} reads it back.
+*/
+var DEVICE_REFRESH_REFUSAL_PREFIX = "device-credential:";
+function deviceRefusalFromMessage(message) {
+	if (!message.startsWith("device-credential:")) return null;
+	const parsed = DeviceRefusalReasonSchema.safeParse(message.slice(18));
+	return parsed.success ? parsed.data : null;
+}
+zod.z.object({
+	code: zod.z.string().min(1).max(256),
+	/** SubjectPublicKeyInfo DER of the device's P-256 public key, base64url. */
+	publicKeySpki: Base64UrlSchema,
+	deviceName: zod.z.string().min(1).max(80).optional(),
+	platform: DevicePlatformSchema
+});
+var CompleteEnrollmentOutputSchema = zod.z.object({
+	credentialId: zod.z.string(),
+	certPem: PemSchema,
+	/** The device CA certificate the leaf chains to. */
+	chainPem: PemSchema,
+	notAfter: zod.z.number(),
+	user: zod.z.object({
+		id: zod.z.string(),
+		username: zod.z.string()
+	})
+});
+zod.z.discriminatedUnion("ok", [CompleteEnrollmentOutputSchema.extend({ ok: zod.z.literal(true) }), DeviceRefusalSchema]);
+zod.z.object({
+	/** The single-use step-up proof (`auth.deviceEnrollProofFrom…`). */
+	proof: zod.z.string().min(1).max(512),
+	publicKeySpki: Base64UrlSchema,
+	deviceName: zod.z.string().min(1).max(80),
+	platform: DevicePlatformSchema
+});
+zod.z.object({
+	proof: zod.z.string(),
+	expiresAt: zod.z.number()
+});
+var DeviceChallengeSchema = zod.z.object({
+	nonce: zod.z.string(),
+	/** The origin to put in the signed message. The app compares it to the hub it dialled. */
+	origin: zod.z.string(),
+	expiresAt: zod.z.number(),
+	signature: zod.z.literal(DEVICE_CERT_SIGNATURE)
+});
+zod.z.discriminatedUnion("ok", [DeviceChallengeSchema.extend({ ok: zod.z.literal(true) }), DeviceRefusalSchema]);
+zod.z.object({
+	certPem: PemSchema,
+	nonce: zod.z.string().min(1).max(256),
+	/** ECDSA P-256 SHA-256 over {@link buildDeviceSignatureMessage}; raw r||s or DER, base64url. */
+	signature: Base64UrlSchema
+});
+var RenewDeviceCertificateOutputSchema = zod.z.object({
+	credentialId: zod.z.string(),
+	certPem: PemSchema,
+	chainPem: PemSchema,
+	notAfter: zod.z.number()
+});
+zod.z.discriminatedUnion("ok", [RenewDeviceCertificateOutputSchema.extend({ ok: zod.z.literal(true) }), DeviceRefusalSchema]);
+zod.z.discriminatedUnion("ok", [zod.z.object({
+	ok: zod.z.literal(true),
+	credentialId: zod.z.string(),
+	sessionsEnded: zod.z.number().int()
+}), DeviceRefusalSchema]);
+var DeviceCredentialStatusSchema = zod.z.enum([
+	"active",
+	"expired",
+	"revoked"
+]);
+zod.z.object({
+	id: zod.z.string(),
+	userId: zod.z.string(),
+	username: zod.z.string().nullable(),
+	deviceName: zod.z.string(),
+	platform: DevicePlatformSchema,
+	enrolledVia: zod.z.enum(["qr", "self"]),
+	/** SHA-256 of the leaf certificate DER, colon-hex. */
+	fingerprint: zod.z.string(),
+	issuedAt: zod.z.number(),
+	expiresAt: zod.z.number(),
+	lastUsedAt: zod.z.number().nullable(),
+	lastUsedFrom: zod.z.string().nullable(),
+	revokedAt: zod.z.number().nullable(),
+	/** `admin:<userId>` | `user:<userId>` | `device` | `user-deleted`. */
+	revokedBy: zod.z.string().nullable(),
+	status: DeviceCredentialStatusSchema
+});
+zod.z.object({
+	/** Shown once; only its hash is kept. */
+	code: zod.z.string(),
+	expiresAt: zod.z.number(),
+	/** `camstack://enroll?hub=…&code=…` — what the QR encodes. */
+	enrollUrl: zod.z.string(),
+	/** The hub origin in the link, or `null` when the hub could not name one (the link then has no `hub`). */
+	hubOrigin: zod.z.string().nullable(),
+	/** Every origin the apps may try (role `appConnections`). */
+	hubOrigins: zod.z.array(zod.z.string())
+});
+zod.z.object({
+	kind: zod.z.literal("device-certificate"),
+	id: zod.z.literal("device-certificate"),
+	label: zod.z.string(),
+	stage: zod.z.literal("primary"),
+	/** tRPC paths under the hub's `auth` router, so a client names no literal. */
+	challengePath: zod.z.literal("auth.getDeviceChallenge"),
+	revokePath: zod.z.literal("auth.revokeOwnDeviceCertificate"),
+	enrollSelfPath: zod.z.literal("auth.enrollSelf"),
+	loginPath: zod.z.literal("auth.loginWithDeviceCertificate"),
+	renewPath: zod.z.literal("auth.renewDeviceCertificate"),
+	signature: zod.z.literal(DEVICE_CERT_SIGNATURE),
+	messageVersion: zod.z.literal(DEVICE_SIGNATURE_MESSAGE_VERSION),
+	/** Which clients can execute it: a native app silently, a browser with a non-extractable WebCrypto key. */
+	clients: zod.z.array(zod.z.enum(["native", "web"]))
+});
+//#endregion
 //#region src/catalogs/sensor-active-state.ts
 /**
 * THE table "which boolean of this device type counts as HIGH", and the
@@ -27412,6 +27646,16 @@ function createSystemProxy(api) {
 			release: (input) => dispatch("deviceAdoption", "release", "mutation", input),
 			resync: (input) => dispatch("deviceAdoption", "resync", "mutation", input)
 		},
+		deviceCredentials: {
+			listDeviceCredentials: (input) => dispatch("deviceCredentials", "listDeviceCredentials", "query", input),
+			startEnrollment: (input) => dispatch("deviceCredentials", "startEnrollment", "mutation", input),
+			revokeDeviceCredential: (input) => dispatch("deviceCredentials", "revokeDeviceCredential", "mutation", input),
+			getDeviceCertificateSettings: (input) => dispatch("deviceCredentials", "getDeviceCertificateSettings", "query", input),
+			setDeviceCertificateSettings: (input) => dispatch("deviceCredentials", "setDeviceCertificateSettings", "mutation", input),
+			deleteDeviceCredential: (input) => dispatch("deviceCredentials", "deleteDeviceCredential", "mutation", input),
+			getDeviceCaStatus: (input) => dispatch("deviceCredentials", "getDeviceCaStatus", "query", input),
+			renameDeviceCredential: (input) => dispatch("deviceCredentials", "renameDeviceCredential", "mutation", input)
+		},
 		deviceExport: {
 			getStatus: (input) => dispatch("deviceExport", "getStatus", "query", input),
 			listSupportedDeviceKinds: (input) => dispatch("deviceExport", "listSupportedDeviceKinds", "query", input),
@@ -30881,6 +31125,12 @@ exports.CLIP_BROKER_PACED_RATES = CLIP_BROKER_PACED_RATES;
 exports.COCO_TO_MACRO = COCO_TO_MACRO;
 exports.CamProfileSchema = CamProfileSchema;
 exports.DEFAULT_TIMELAPSE_PREVIEW_TEXT = DEFAULT_TIMELAPSE_PREVIEW_TEXT;
+exports.DEFINITIVE_DEVICE_REFUSALS = DEFINITIVE_DEVICE_REFUSALS;
+exports.DEVICE_CERT_RENEW_WINDOW_DAYS = DEVICE_CERT_RENEW_WINDOW_DAYS;
+exports.DEVICE_CERT_SIGNATURE = DEVICE_CERT_SIGNATURE;
+exports.DEVICE_DEFINITIVE_REFUSALS_BEFORE_DELETE = DEVICE_DEFINITIVE_REFUSALS_BEFORE_DELETE;
+exports.DEVICE_REFRESH_REFUSAL_PREFIX = DEVICE_REFRESH_REFUSAL_PREFIX;
+exports.DEVICE_SIGNATURE_MESSAGE_VERSION = DEVICE_SIGNATURE_MESSAGE_VERSION;
 exports.DeviceType = DeviceType;
 exports.EVENTFUL_CAP_NAMES = EVENTFUL_CAP_NAMES;
 exports.EVENT_KIND_BY_CAP = EVENT_KIND_BY_CAP;
@@ -30929,14 +31179,18 @@ exports.YAMNET_TO_MACRO = YAMNET_TO_MACRO;
 exports.alarmDeviceBlocksArming = alarmDeviceBlocksArming;
 exports.alarmDeviceSecureOnArm = alarmDeviceSecureOnArm;
 exports.alarmPatchLanded = alarmPatchLanded;
+exports.buildDeviceEnrollmentLink = buildDeviceEnrollmentLink;
+exports.buildDeviceSignatureMessage = buildDeviceSignatureMessage;
 exports.canonicalIconKey = canonicalIconKey;
 exports.classifyRetrainReview = classifyRetrainReview;
 exports.conditionVisibleForKind = conditionVisibleForKind;
 exports.createSystemProxy = createSystemProxy;
+exports.deviceRefusalFromMessage = deviceRefusalFromMessage;
 exports.droppedConditionsForKind = droppedConditionsForKind;
 exports.iconCategoryLabel = iconCategoryLabel;
 exports.iconEntry = iconEntry;
 exports.iconsInCategory = iconsInCategory;
+exports.isDefinitiveDeviceRefusal = isDefinitiveDeviceRefusal;
 exports.isHeldBackTemplateVar = isHeldBackTemplateVar;
 exports.isIconKey = isIconKey;
 exports.isSystemRuleKind = isSystemRuleKind;
@@ -30945,6 +31199,7 @@ exports.knownValues = knownValues;
 exports.locationIconKey = locationIconKey;
 exports.nodePickerItems = nodePickerItems;
 exports.packagePickerItems = packagePickerItems;
+exports.parseDeviceEnrollmentLink = parseDeviceEnrollmentLink;
 exports.parseRetrainRevisionConflict = parseRetrainRevisionConflict;
 exports.pickerForCondition = pickerForCondition;
 exports.pickerForRuleClasses = pickerForRuleClasses;