@camstack/types 1.2.368 → 1.2.370

package/dist/addon.js

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_sleep = require("./sleep-CXlc9YJ5.js");
+const require_sleep = require("./sleep-DnQ5WsMI.js");
 const require_event_category = require("./event-category-T43rdQWR.js");
 const require_err_msg = require("./err-msg-Dx2Kor0g.js");
 //#region src/generated/cap-input-defaults.ts

package/dist/addon.mjs

@@ -1,4 +1,4 @@
-import { A as viewerUiCapability, At as createSecretsAccess, Bt as PEER_BYTES_STALL_MS, C as isZodSecret, Cn as isSecretClear, Dn as makeSecretMarker, E as HF_REPO, En as isSecretMarkerLike, Ft as registerKnownSecret, Gt as DisposerChain, I as adminUiCapability, It as scrubKnownSecrets, Kt as BaseAddon, Lt as shortSecretRefHash, Mt as clearKnownSecrets, Nt as forgetKnownSecret, On as toSecretFieldView, Ot as resolveSecretViewsIn, P as describeCustomActions, Pt as knownSecretCount, Q as readNodePin, Rt as PEER_BYTES_CHUNK_BYTES, S as collectZodSecretPaths, Sn as classifySecretWrite, Tn as isSecretMarker, Ut as DATAPLANE_SECRET_HEADER, Vt as PEER_BYTES_TICKET_TTL_MS, W as expandCapMethods, Z as nodePin, _ as createEventBusSliceSource, an as formatSecretScope, at as scopeKey, c as asString, cn as normalizeSecretOwner, d as parseJsonUnknown, et as MODEL_FORMATS, f as hfModelUrl, fn as createEvent, g as createDeviceProxy, h as isDeviceScopedCap, in as buildSecretRef, j as DEVICE_CHILDREN_BATCH_MAX, jt as MIN_SCRUBBED_LENGTH, k as deviceOpsCapability, kt as REVALIDATE_AFTER_MS, ln as parseSecretRef, m as DEVICE_SCOPED_CAPS, nn as SECRET_REF_SCHEME, nt as ReadinessTimeoutError, o as asJsonObject, on as globalSecretScope, p as BOOT_RECOVERY_BACKOFF_MS, pn as emitReadiness, qt as normalizeAddonInitResult, r as maskUrlCredentials, rn as arrayItemFieldPath, sn as isSecretRef, t as sleep, tt as ReadinessRegistry, wn as isSecretFieldView, xn as SECRET_CLEAR, zt as PEER_BYTES_MAX_OUTSTANDING } from "./sleep--g-h2_c_.mjs";
+import { A as viewerUiCapability, At as createSecretsAccess, Bt as PEER_BYTES_STALL_MS, C as isZodSecret, Cn as isSecretClear, Dn as makeSecretMarker, E as HF_REPO, En as isSecretMarkerLike, Ft as registerKnownSecret, Gt as DisposerChain, I as adminUiCapability, It as scrubKnownSecrets, Kt as BaseAddon, Lt as shortSecretRefHash, Mt as clearKnownSecrets, Nt as forgetKnownSecret, On as toSecretFieldView, Ot as resolveSecretViewsIn, P as describeCustomActions, Pt as knownSecretCount, Q as readNodePin, Rt as PEER_BYTES_CHUNK_BYTES, S as collectZodSecretPaths, Sn as classifySecretWrite, Tn as isSecretMarker, Ut as DATAPLANE_SECRET_HEADER, Vt as PEER_BYTES_TICKET_TTL_MS, W as expandCapMethods, Z as nodePin, _ as createEventBusSliceSource, an as formatSecretScope, at as scopeKey, c as asString, cn as normalizeSecretOwner, d as parseJsonUnknown, et as MODEL_FORMATS, f as hfModelUrl, fn as createEvent, g as createDeviceProxy, h as isDeviceScopedCap, in as buildSecretRef, j as DEVICE_CHILDREN_BATCH_MAX, jt as MIN_SCRUBBED_LENGTH, k as deviceOpsCapability, kt as REVALIDATE_AFTER_MS, ln as parseSecretRef, m as DEVICE_SCOPED_CAPS, nn as SECRET_REF_SCHEME, nt as ReadinessTimeoutError, o as asJsonObject, on as globalSecretScope, p as BOOT_RECOVERY_BACKOFF_MS, pn as emitReadiness, qt as normalizeAddonInitResult, r as maskUrlCredentials, rn as arrayItemFieldPath, sn as isSecretRef, t as sleep, tt as ReadinessRegistry, wn as isSecretFieldView, xn as SECRET_CLEAR, zt as PEER_BYTES_MAX_OUTSTANDING } from "./sleep-DAX0-2v9.mjs";
 import { t as EventCategory } from "./event-category-C4hVnRo8.mjs";
 import { a as DeviceType, t as errMsg } from "./err-msg-DX6i_MY4.mjs";
 //#region src/generated/cap-input-defaults.ts

package/dist/auth/app-flow.d.ts

@@ -0,0 +1,72 @@
+/**
+ * The native-app browser sign-in flows the hub serves itself (D858).
+ *
+ * The viewer app opens the system browser at a hub START route (OIDC
+ * `/addon/auth-oidc/<id>/start`, the passkey page `/auth/app/passkey`) and gets
+ * a one-shot handoff code back at its custom scheme. These helpers are the one
+ * reading of the request every leg shares - the OIDC addon, the finish leg and
+ * the passkey page - so a rule tightened for one is tightened for all:
+ *
+ *  - PKCE is mandatory and S256 only (`code_challenge` = base64url of a SHA-256);
+ *  - `state` is echoed back exactly;
+ *  - the return URL is one of {@link APP_AUTH_CALLBACK_URLS}, never a free URL;
+ *  - the purpose is `new-session` or `step-up` (the legacy `renew` has no browser flow).
+ *
+ * Pure and dependency-free (zod only) so an addon, the backend and a spec read
+ * the same code.
+ */
+import { z } from 'zod';
+/** What the app redeems the code for. `step-up` yields a proof, never a session. */
+export declare const AppFlowPurposeSchema: z.ZodEnum<{
+    "new-session": "new-session";
+    "step-up": "step-up";
+}>;
+export type AppFlowPurpose = z.infer<typeof AppFlowPurposeSchema>;
+/** Where the app is sent when the request names no `redirect`. */
+export declare const APP_FLOW_DEFAULT_REDIRECT = "camstack://auth-callback";
+/**
+ * A browser OIDC flow started for an app carries this prefix on the IdP
+ * `state` it generates, so a callback whose pending state is gone (expired,
+ * replayed) can still be answered at the app and not on a hub error page. The
+ * destination of that answer is the fixed default callback - the prefix
+ * selects nothing the requester controls.
+ */
+export declare const APP_FLOW_STATE_PREFIX = "a.";
+/** A validated app flow request. */
+export interface AppFlowRequest {
+    readonly codeChallenge: string;
+    readonly state: string;
+    readonly purpose: AppFlowPurpose;
+    /** The canonical allow-listed callback URL. */
+    readonly redirect: string;
+}
+export type AppFlowRefusal = 'bad-challenge' | 'bad-challenge-method' | 'bad-state' | 'bad-purpose' | 'bad-redirect';
+export type AppFlowParse = {
+    readonly ok: true;
+    readonly request: AppFlowRequest;
+} | {
+    readonly ok: false;
+    readonly reason: AppFlowRefusal;
+};
+/** Operator-facing words for a refusal (the "clear page", D858). */
+export declare const APP_FLOW_REFUSAL_MESSAGES: Record<AppFlowRefusal, string>;
+/**
+ * Read the app parameters off a start query: `code_challenge`,
+ * `code_challenge_method`, `state`, `purpose`, `redirect`. Anything missing or
+ * malformed is refused - there is no lenient default for PKCE or state.
+ */
+export declare function parseAppFlowRequest(query: Readonly<Record<string, string | undefined>>): AppFlowParse;
+/** The app's callback with `code` (success) or `error` (refusal), and the echoed `state` when known. */
+export declare function appFlowLocation(redirect: string, result: {
+    readonly code: string;
+} | {
+    readonly error: string;
+}, state?: string): string;
+/** How a native app starts one login method (D858), as `auth.listLoginMethods` reports it. */
+export declare const AppLoginPathSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<"native">;
+}, z.core.$strip>, z.ZodObject<{
+    kind: z.ZodLiteral<"browser">;
+    startPath: z.ZodString;
+}, z.core.$strip>], "kind">;
+export type AppLoginPath = z.infer<typeof AppLoginPathSchema>;

package/dist/auth/device-certificate.d.ts

@@ -368,5 +368,11 @@ export declare const DeviceCertificateLoginMethodSchema: z.ZodObject<{
         native: "native";
         web: "web";
     }>>;
+    app: z.ZodNullable<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"native">;
+    }, z.core.$strip>, z.ZodObject<{
+        kind: z.ZodLiteral<"browser">;
+        startPath: z.ZodString;
+    }, z.core.$strip>], "kind">>;
 }, z.core.$strip>;
 export type DeviceCertificateLoginMethod = z.infer<typeof DeviceCertificateLoginMethodSchema>;

package/dist/capabilities/hub-address.d.ts

@@ -147,3 +147,20 @@ export declare const HUB_MDNS_TXT_KEYS: {
     readonly url: 'url';
 };
 export declare const HUB_MDNS_ROLE = "hub";
+/**
+ * How a hub finds agents to pair (D857): every agent publishes ONE mDNS service for its API
+ * port, paired or not. The TXT record carries only public facts. Finding an agent grants
+ * nothing: pairing still needs the six-digit code confirmed on both screens.
+ */
+export declare const AGENT_MDNS_SERVICE_TYPE = "camstack-agent";
+/** The fully-qualified name a hub browses for. */
+export declare const AGENT_MDNS_QUERY_NAME = "_camstack-agent._tcp.local";
+/** The TXT keys of the agent advertisement. Every value is public. */
+export declare const AGENT_MDNS_TXT_KEYS: {
+    readonly nodeId: 'nodeId';
+    readonly version: 'version';
+    /** `unpaired` | `pending` | `paired`. */
+    readonly state: 'state';
+    /** First 16 hex chars of the SHA-256 of the agent's mesh leaf; present once paired. */
+    readonly keyFingerprint: 'fp';
+};

package/dist/capabilities/index.d.ts

@@ -69,7 +69,7 @@ export { EMBEDDING_MODEL_FAILED, EMBEDDING_REQUIREMENTS_FAILED, EMBEDDING_REQUIR
 export type { FailureContribution, IFailureContributionProvider, } from './failure-contribution.cap.js';
 export { FailureContributionSchema, FailureReasonCountSchema, failureContributionCapability, } from './failure-contribution.cap.js';
 export { filesystemBrowseCapability, type IFilesystemBrowseProvider, } from './filesystem-browse.cap.js';
-export { AUTOMATIC_HUB_ADDRESS_FLAGS, checkRoleAddress, HUB_ADDRESS_ROLES, type HubAddressCheck, type HubAddressFlags, type HubAddressRole, type HubAddressRoleResolution, type HubAddressRoles, type HubAddressSource, type HubAppConnectionsResolution, HUB_MDNS_QUERY_NAME, HUB_MDNS_ROLE, HUB_MDNS_SERVICE_TYPE, HUB_MDNS_TXT_KEYS, hubAddressHostname, isDefaultAppConnectionEndpoint, isSingleHubAddressRole, PUBLIC_ENDPOINT_HTTP_REASON, resolveAppConnections, resolveHubAddressRoles, resolveInternalAddress, resolveNotificationTapAddress, resolvePublicEndpoint, SINGLE_HUB_ADDRESS_ROLES, type SingleHubAddressRole, selectAppConnectionEndpoints, validateCustomAddress, } from './hub-address.js';
+export { AUTOMATIC_HUB_ADDRESS_FLAGS, checkRoleAddress, HUB_ADDRESS_ROLES, type HubAddressCheck, type HubAddressFlags, type HubAddressRole, type HubAddressRoleResolution, type HubAddressRoles, type HubAddressSource, type HubAppConnectionsResolution, HUB_MDNS_QUERY_NAME, HUB_MDNS_ROLE, HUB_MDNS_SERVICE_TYPE, HUB_MDNS_TXT_KEYS, AGENT_MDNS_QUERY_NAME, AGENT_MDNS_SERVICE_TYPE, AGENT_MDNS_TXT_KEYS, hubAddressHostname, isDefaultAppConnectionEndpoint, isSingleHubAddressRole, PUBLIC_ENDPOINT_HTTP_REASON, resolveAppConnections, resolveHubAddressRoles, resolveInternalAddress, resolveNotificationTapAddress, resolvePublicEndpoint, SINGLE_HUB_ADDRESS_ROLES, type SingleHubAddressRole, selectAppConnectionEndpoints, validateCustomAddress, } from './hub-address.js';
 export { type HfModelResolution, HfModelResolutionSchema, type ILlmProvider, type LlmDefault, LlmDefaultSchema, type LlmDefaultSelector, LlmDefaultSelectorSchema, type LlmProfile, type LlmProfileKind, type LlmProfileKindDescriptor, LlmProfileKindDescriptorSchema, LlmProfileKindSchema, LlmProfileSchema, type LlmRuntimeNode, LlmRuntimeNodeSchema, type LlmUsageRollup, LlmUsageRollupSchema, llmCapability, type ManagedModelCatalogEntry, ManagedModelCatalogEntrySchema, } from './llm.cap.js';
 export { type AppleFmAvailability, AppleFmAvailabilitySchema, type AppleFmUnavailableReason, AppleFmUnavailableReasonSchema, type ILlmRuntimeProvider, type LlmDownloadProgress, LlmDownloadProgressSchema, type LlmNodeModel, LlmNodeModelSchema, type LlmRuntimeAppleCompleteInput, LlmRuntimeAppleCompleteInputSchema, type LlmRuntimeCancelInput, LlmRuntimeCancelInputSchema, type LlmRuntimeCompleteInput, LlmRuntimeCompleteInputSchema, type LlmRuntimeDiskUsage, LlmRuntimeDiskUsageSchema, type LlmRuntimeStatus, LlmRuntimeStatusSchema, llmRuntimeCapability, type ManagedModelExtraFile, ManagedModelExtraFileSchema, type ManagedModelRef, ManagedModelRefSchema, type ManagedRuntimeConfig, ManagedRuntimeConfigSchema, } from './llm-runtime.cap.js';
 export { type LlmErrorCode, LlmErrorCodeSchema, type LlmGenerateBaseInput, LlmGenerateBaseInputSchema, type LlmGenerateErr, LlmGenerateErrSchema, type LlmGenerateOk, LlmGenerateOkSchema, type LlmGenerateResult, LlmGenerateResultSchema, type LlmImage, LlmImageSchema, type LlmRefusalSource, LlmRefusalSourceSchema, type LlmRetryPolicy, LlmRetryPolicySchema, LlmTimeoutDefaults, type LlmUsage, LlmUsageSchema, } from './llm-shared.js';

package/dist/capabilities/login-method.cap.d.ts

@@ -60,6 +60,12 @@ export declare const RedirectLoginMethodSchema: z.ZodObject<{
         "second-factor": "second-factor";
     }>;
     linkable: z.ZodOptional<z.ZodBoolean>;
+    app: z.ZodOptional<z.ZodNullable<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"native">;
+    }, z.core.$strip>, z.ZodObject<{
+        kind: z.ZodLiteral<"browser">;
+        startPath: z.ZodString;
+    }, z.core.$strip>], "kind">>>;
 }, z.core.$strip>;
 /**
  * A Module-Federation widget the login page mounts for an in-page
@@ -82,6 +88,12 @@ export declare const WidgetLoginMethodSchema: z.ZodObject<{
         primary: "primary";
         "second-factor": "second-factor";
     }>;
+    app: z.ZodOptional<z.ZodNullable<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"native">;
+    }, z.core.$strip>, z.ZodObject<{
+        kind: z.ZodLiteral<"browser">;
+        startPath: z.ZodString;
+    }, z.core.$strip>], "kind">>>;
 }, z.core.$strip>;
 /**
  * A declarative WebAuthn ceremony the shell renders natively (no remote
@@ -99,6 +111,12 @@ export declare const PasskeyLoginMethodSchema: z.ZodObject<{
     }>;
     rpId: z.ZodString;
     origin: z.ZodNullable<z.ZodString>;
+    app: z.ZodOptional<z.ZodNullable<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"native">;
+    }, z.core.$strip>, z.ZodObject<{
+        kind: z.ZodLiteral<"browser">;
+        startPath: z.ZodString;
+    }, z.core.$strip>], "kind">>>;
 }, z.core.$strip>;
 /** One login-method contribution — redirect button, pre-auth widget, or native passkey ceremony. */
 export declare const LoginMethodContributionSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
@@ -112,6 +130,12 @@ export declare const LoginMethodContributionSchema: z.ZodDiscriminatedUnion<[z.Z
         "second-factor": "second-factor";
     }>;
     linkable: z.ZodOptional<z.ZodBoolean>;
+    app: z.ZodOptional<z.ZodNullable<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"native">;
+    }, z.core.$strip>, z.ZodObject<{
+        kind: z.ZodLiteral<"browser">;
+        startPath: z.ZodString;
+    }, z.core.$strip>], "kind">>>;
 }, z.core.$strip>, z.ZodObject<{
     kind: z.ZodLiteral<"widget">;
     id: z.ZodString;
@@ -126,6 +150,12 @@ export declare const LoginMethodContributionSchema: z.ZodDiscriminatedUnion<[z.Z
         primary: "primary";
         "second-factor": "second-factor";
     }>;
+    app: z.ZodOptional<z.ZodNullable<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"native">;
+    }, z.core.$strip>, z.ZodObject<{
+        kind: z.ZodLiteral<"browser">;
+        startPath: z.ZodString;
+    }, z.core.$strip>], "kind">>>;
 }, z.core.$strip>, z.ZodObject<{
     kind: z.ZodLiteral<"passkey">;
     id: z.ZodString;
@@ -136,6 +166,12 @@ export declare const LoginMethodContributionSchema: z.ZodDiscriminatedUnion<[z.Z
     }>;
     rpId: z.ZodString;
     origin: z.ZodNullable<z.ZodString>;
+    app: z.ZodOptional<z.ZodNullable<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"native">;
+    }, z.core.$strip>, z.ZodObject<{
+        kind: z.ZodLiteral<"browser">;
+        startPath: z.ZodString;
+    }, z.core.$strip>], "kind">>>;
 }, z.core.$strip>], "kind">;
 export declare const loginMethodCapability: {
     readonly name: 'login-method';
@@ -154,6 +190,12 @@ export declare const loginMethodCapability: {
                 "second-factor": "second-factor";
             }>;
             linkable: z.ZodOptional<z.ZodBoolean>;
+            app: z.ZodOptional<z.ZodNullable<z.ZodDiscriminatedUnion<[z.ZodObject<{
+                kind: z.ZodLiteral<"native">;
+            }, z.core.$strip>, z.ZodObject<{
+                kind: z.ZodLiteral<"browser">;
+                startPath: z.ZodString;
+            }, z.core.$strip>], "kind">>>;
         }, z.core.$strip>, z.ZodObject<{
             kind: z.ZodLiteral<"widget">;
             id: z.ZodString;
@@ -168,6 +210,12 @@ export declare const loginMethodCapability: {
                 primary: "primary";
                 "second-factor": "second-factor";
             }>;
+            app: z.ZodOptional<z.ZodNullable<z.ZodDiscriminatedUnion<[z.ZodObject<{
+                kind: z.ZodLiteral<"native">;
+            }, z.core.$strip>, z.ZodObject<{
+                kind: z.ZodLiteral<"browser">;
+                startPath: z.ZodString;
+            }, z.core.$strip>], "kind">>>;
         }, z.core.$strip>, z.ZodObject<{
             kind: z.ZodLiteral<"passkey">;
             id: z.ZodString;
@@ -178,6 +226,12 @@ export declare const loginMethodCapability: {
             }>;
             rpId: z.ZodString;
             origin: z.ZodNullable<z.ZodString>;
+            app: z.ZodOptional<z.ZodNullable<z.ZodDiscriminatedUnion<[z.ZodObject<{
+                kind: z.ZodLiteral<"native">;
+            }, z.core.$strip>, z.ZodObject<{
+                kind: z.ZodLiteral<"browser">;
+                startPath: z.ZodString;
+            }, z.core.$strip>], "kind">>>;
         }, z.core.$strip>], "kind">>>, import("./capability-definition.js").CapabilityMethodKind>;
     };
     /** BIG PLAN 2: declarative mount hint — read by `@camstack/system` `buildCapRouters`. */

package/dist/capabilities/node-certificates.cap.d.ts

@@ -108,6 +108,15 @@ export declare const nodeCertificatesCapability: {
             addresses: z.ZodArray<z.ZodString>;
             pinnedCaFingerprintSha256: z.ZodNullable<z.ZodString>;
         }, z.core.$strip>, "mutation">;
+        /**
+         * The hub unpairs this node (D857): it erases its mesh material, goes back to the
+         * unpaired state and advertises itself again. The call is answered first; the wire
+         * goes down right after, so the hub revokes the node's certificates BEFORE this
+         * connection drops, never after.
+         */
+        readonly forgetHub: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{}, z.core.$strip>, z.ZodObject<{
+            ok: z.ZodLiteral<true>;
+        }, z.core.$strip>, "mutation">;
         /** Install the hub-signed HTTPS leaf and hot-swap the serving context (no restart). */
         readonly installHttpsCertificate: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
             certPem: z.ZodString;

package/dist/capabilities/sso-bridge.cap.d.ts

@@ -79,6 +79,15 @@ declare const SsoBridgeClaimsSchema: z.ZodObject<{
     linkIntent: z.ZodOptional<z.ZodString>;
     issuer: z.ZodOptional<z.ZodString>;
     browserBinding: z.ZodOptional<z.ZodString>;
+    app: z.ZodOptional<z.ZodObject<{
+        codeChallenge: z.ZodString;
+        state: z.ZodString;
+        purpose: z.ZodEnum<{
+            "new-session": "new-session";
+            "step-up": "step-up";
+        }>;
+        redirect: z.ZodString;
+    }, z.core.$strip>>;
 }, z.core.$strip>;
 export declare const ssoBridgeCapability: {
     readonly name: 'sso-bridge';
@@ -166,6 +175,15 @@ export declare const ssoBridgeCapability: {
                 linkIntent: z.ZodOptional<z.ZodString>;
                 issuer: z.ZodOptional<z.ZodString>;
                 browserBinding: z.ZodOptional<z.ZodString>;
+                app: z.ZodOptional<z.ZodObject<{
+                    codeChallenge: z.ZodString;
+                    state: z.ZodString;
+                    purpose: z.ZodEnum<{
+                        "new-session": "new-session";
+                        "step-up": "step-up";
+                    }>;
+                    redirect: z.ZodString;
+                }, z.core.$strip>>;
             }, z.core.$strip>;
             ttlSec: z.ZodOptional<z.ZodUnion<readonly [z.ZodNumber, z.ZodLiteral<"never">]>>;
         }, z.core.$strip>, z.ZodObject<{
@@ -238,6 +256,15 @@ export declare const ssoBridgeCapability: {
             linkIntent: z.ZodOptional<z.ZodString>;
             issuer: z.ZodOptional<z.ZodString>;
             browserBinding: z.ZodOptional<z.ZodString>;
+            app: z.ZodOptional<z.ZodObject<{
+                codeChallenge: z.ZodString;
+                state: z.ZodString;
+                purpose: z.ZodEnum<{
+                    "new-session": "new-session";
+                    "step-up": "step-up";
+                }>;
+                redirect: z.ZodString;
+            }, z.core.$strip>>;
         }, z.core.$strip>>, import("./capability-definition.js").CapabilityMethodKind>;
     };
 };

package/dist/client.js

@@ -558,6 +558,12 @@ zod.z.object({
 	codec: zod.z.string().optional(),
 	resolution: CamStreamResolutionSchema.optional()
 });
+zod.z.enum(["new-session", "step-up"]);
+/** How a native app starts one login method (D858), as `auth.listLoginMethods` reports it. */
+var AppLoginPathSchema = zod.z.discriminatedUnion("kind", [zod.z.object({ kind: zod.z.literal("native") }), zod.z.object({
+	kind: zod.z.literal("browser"),
+	startPath: zod.z.string().startsWith("/")
+})]);
 //#endregion
 //#region src/auth/device-certificate.ts
 /**
@@ -790,7 +796,9 @@ zod.z.object({
 	signature: zod.z.literal(DEVICE_CERT_SIGNATURE),
 	messageVersion: zod.z.literal(DEVICE_SIGNATURE_MESSAGE_VERSION),
 	/** Which clients can execute it: a native app silently, a browser with a non-extractable WebCrypto key. */
-	clients: zod.z.array(zod.z.enum(["native", "web"]))
+	clients: zod.z.array(zod.z.enum(["native", "web"])),
+	/** The app executes it itself, silently (D858). */
+	app: AppLoginPathSchema.nullable()
 });
 //#endregion
 //#region src/catalogs/sensor-active-state.ts

package/dist/client.mjs

@@ -557,6 +557,12 @@ z.object({
 	codec: z.string().optional(),
 	resolution: CamStreamResolutionSchema.optional()
 });
+z.enum(["new-session", "step-up"]);
+/** How a native app starts one login method (D858), as `auth.listLoginMethods` reports it. */
+var AppLoginPathSchema = z.discriminatedUnion("kind", [z.object({ kind: z.literal("native") }), z.object({
+	kind: z.literal("browser"),
+	startPath: z.string().startsWith("/")
+})]);
 //#endregion
 //#region src/auth/device-certificate.ts
 /**
@@ -789,7 +795,9 @@ z.object({
 	signature: z.literal(DEVICE_CERT_SIGNATURE),
 	messageVersion: z.literal(DEVICE_SIGNATURE_MESSAGE_VERSION),
 	/** Which clients can execute it: a native app silently, a browser with a non-extractable WebCrypto key. */
-	clients: z.array(z.enum(["native", "web"]))
+	clients: z.array(z.enum(["native", "web"])),
+	/** The app executes it itself, silently (D858). */
+	app: AppLoginPathSchema.nullable()
 });
 //#endregion
 //#region src/catalogs/sensor-active-state.ts