@camstack/types 1.2.369 → 1.2.371

package/dist/generated/addon-api.d.ts

@@ -12195,6 +12195,12 @@ export type AppRouter = TrpcCoreRouter<{
                 stage: "primary" | "second-factor";
                 icon?: string | undefined;
                 linkable?: boolean | undefined;
+                app?: {
+                    kind: "native";
+                } | {
+                    kind: "browser";
+                    startPath: string;
+                } | null | undefined;
             } | {
                 kind: "widget";
                 id: string;
@@ -12207,6 +12213,12 @@ export type AppRouter = TrpcCoreRouter<{
                 };
                 stage: "primary" | "second-factor";
                 bundleUrl: string;
+                app?: {
+                    kind: "native";
+                } | {
+                    kind: "browser";
+                    startPath: string;
+                } | null | undefined;
             } | {
                 kind: "passkey";
                 id: string;
@@ -12214,6 +12226,12 @@ export type AppRouter = TrpcCoreRouter<{
                 stage: "primary" | "second-factor";
                 rpId: string;
                 origin: string | null;
+                app?: {
+                    kind: "native";
+                } | {
+                    kind: "browser";
+                    startPath: string;
+                } | null | undefined;
             } | {
                 kind: "device-certificate";
                 id: "device-certificate";
@@ -12227,6 +12245,12 @@ export type AppRouter = TrpcCoreRouter<{
                 signature: "ecdsa-p256-sha256";
                 messageVersion: "camstack-device-cert-v1";
                 clients: ("web" | "native")[];
+                app: {
+                    kind: "native";
+                } | {
+                    kind: "browser";
+                    startPath: string;
+                } | null;
             })[];
             meta: object;
         }>;
@@ -13055,6 +13079,12 @@ export type AppRouter = TrpcCoreRouter<{
                 stage: "primary" | "second-factor";
                 icon?: string | undefined;
                 linkable?: boolean | undefined;
+                app?: {
+                    kind: "native";
+                } | {
+                    kind: "browser";
+                    startPath: string;
+                } | null | undefined;
             } | {
                 kind: "widget";
                 id: string;
@@ -13067,6 +13097,12 @@ export type AppRouter = TrpcCoreRouter<{
                 };
                 stage: "primary" | "second-factor";
                 bundleUrl: string;
+                app?: {
+                    kind: "native";
+                } | {
+                    kind: "browser";
+                    startPath: string;
+                } | null | undefined;
             } | {
                 kind: "passkey";
                 id: string;
@@ -13074,6 +13110,12 @@ export type AppRouter = TrpcCoreRouter<{
                 stage: "primary" | "second-factor";
                 rpId: string;
                 origin: string | null;
+                app?: {
+                    kind: "native";
+                } | {
+                    kind: "browser";
+                    startPath: string;
+                } | null | undefined;
             } | {
                 kind: "device-certificate";
                 id: "device-certificate";
@@ -13087,6 +13129,12 @@ export type AppRouter = TrpcCoreRouter<{
                 signature: "ecdsa-p256-sha256";
                 messageVersion: "camstack-device-cert-v1";
                 clients: ("web" | "native")[];
+                app: {
+                    kind: "native";
+                } | {
+                    kind: "browser";
+                    startPath: string;
+                } | null;
             })[];
             meta: object;
         }>;

package/dist/index.d.ts

@@ -151,6 +151,7 @@ export * from './types/pipeline-step.js';
 export * from './types/tracked.js';
 export { type BearerPayloadShape, type BearerPrincipal, classifyBearerPrincipal, methodAccessForHttpMethod, type PrincipalAddonReachInput, type PrincipalAddonReachVerdict, principalMayReachAddon, scopesAllowAddon, scopesAllowDeviceCap, } from './auth/principal-scope.js';
 export { APP_AUTH_CALLBACK_MAX_LENGTH, APP_AUTH_CALLBACK_URLS, canonicalizeAppCallback, hasUrlScheme, parseAppAuthCallback, } from './auth/app-callback.js';
+export { APP_FLOW_DEFAULT_REDIRECT, APP_FLOW_REFUSAL_MESSAGES, APP_FLOW_STATE_PREFIX, type AppFlowParse, type AppFlowPurpose, AppFlowPurposeSchema, type AppFlowRefusal, type AppFlowRequest, type AppLoginPath, AppLoginPathSchema, appFlowLocation, parseAppFlowRequest, } from './auth/app-flow.js';
 export { SSO_STATE_COOKIE, SSO_STATE_COOKIE_MAX_AGE_SEC } from './auth/sso-state.js';
 export { buildDeviceEnrollmentLink, buildDeviceSignatureMessage, type CompleteEnrollmentInput, CompleteEnrollmentInputSchema, type CompleteEnrollmentOutput, CompleteEnrollmentOutputSchema, DEVICE_CERT_RENEW_WINDOW_DAYS, DEVICE_CERT_SIGNATURE, DEVICE_CERT_VALIDITY_DAYS, DEVICE_ENROLLMENT_TTL_MS, DEVICE_NONCE_TTL_MS, DEVICE_SAN_CREDENTIAL_PREFIX, DEVICE_SAN_USER_PREFIX, DEVICE_SIGNATURE_MESSAGE_VERSION, type DeviceCertificateLoginMethod, DeviceCertificateLoginMethodSchema, type DeviceChallenge, DeviceChallengeSchema, type DeviceCredential, DeviceCredentialSchema, type DeviceCredentialStatus, DeviceCredentialStatusSchema, type DevicePlatform, DevicePlatformSchema, type DeviceProofInput, DeviceProofInputSchema, type CompleteEnrollmentResult, CompleteEnrollmentResultSchema, DEFINITIVE_DEVICE_REFUSALS, DEVICE_DEFINITIVE_REFUSALS_BEFORE_DELETE, DEVICE_REFRESH_REFUSAL_PREFIX, deviceRefusalFromMessage, type DeviceChallengeResult, DeviceChallengeResultSchema, DeviceEnrollProofSchema, type DeviceRefusal, type DeviceRefusalReason, DeviceRefusalReasonSchema, DeviceRefusalSchema, type DeviceRevoker, type EnrollSelfInput, EnrollSelfInputSchema, formatDeviceRevoker, isDefinitiveDeviceRefusal, type RenewDeviceCertificateResult, RenewDeviceCertificateResultSchema, type RevokeOwnDeviceCertificateResult, RevokeOwnDeviceCertificateResultSchema, type DeviceSignaturePurpose, DeviceSignaturePurposeSchema, type RenewDeviceCertificateOutput, RenewDeviceCertificateOutputSchema, type StartEnrollmentOutput, StartEnrollmentOutputSchema, parseDeviceEnrollmentLink, } from './auth/device-certificate.js';
 export { advertisedHubOrigins, claimedRequestOrigins, normalizeOrigin, pickRequestOrigin, type RequestHeaders, requestMountPrefix, } from './auth/request-origin.js';

package/dist/index.js

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_sleep = require("./sleep-CXlc9YJ5.js");
+const require_sleep = require("./sleep-DnQ5WsMI.js");
 const require_event_category = require("./event-category-T43rdQWR.js");
 const require_composition = require("./composition-DCYnv4I6.js");
 const require_node_color = require("./node-color.js");
@@ -6640,6 +6640,103 @@ function hasUrlScheme(url) {
 	return /^[a-z][a-z0-9+.-]*:/i.test(url);
 }
 //#endregion
+//#region src/auth/app-flow.ts
+/**
+* The native-app browser sign-in flows the hub serves itself (D858).
+*
+* The viewer app opens the system browser at a hub START route (OIDC
+* `/addon/auth-oidc/<id>/start`, the passkey page `/auth/app/passkey`) and gets
+* a one-shot handoff code back at its custom scheme. These helpers are the one
+* reading of the request every leg shares - the OIDC addon, the finish leg and
+* the passkey page - so a rule tightened for one is tightened for all:
+*
+*  - PKCE is mandatory and S256 only (`code_challenge` = base64url of a SHA-256);
+*  - `state` is echoed back exactly;
+*  - the return URL is one of {@link APP_AUTH_CALLBACK_URLS}, never a free URL;
+*  - the purpose is `new-session` or `step-up` (the legacy `renew` has no browser flow).
+*
+* Pure and dependency-free (zod only) so an addon, the backend and a spec read
+* the same code.
+*/
+/** What the app redeems the code for. `step-up` yields a proof, never a session. */
+var AppFlowPurposeSchema = zod.z.enum(["new-session", "step-up"]);
+/** Where the app is sent when the request names no `redirect`. */
+var APP_FLOW_DEFAULT_REDIRECT = "camstack://auth-callback";
+/**
+* A browser OIDC flow started for an app carries this prefix on the IdP
+* `state` it generates, so a callback whose pending state is gone (expired,
+* replayed) can still be answered at the app and not on a hub error page. The
+* destination of that answer is the fixed default callback - the prefix
+* selects nothing the requester controls.
+*/
+var APP_FLOW_STATE_PREFIX = "a.";
+/** S256 challenge: base64url of 32 bytes = 43 characters, no padding. */
+var CHALLENGE_PATTERN = /^[A-Za-z0-9_-]{43}$/;
+/** The app's own `state`: URL-safe characters only, bounded. */
+var STATE_PATTERN = /^[A-Za-z0-9._~-]{1,256}$/;
+/** Operator-facing words for a refusal (the "clear page", D858). */
+var APP_FLOW_REFUSAL_MESSAGES = {
+	"bad-challenge": "The sign-in request has no valid PKCE challenge (S256).",
+	"bad-challenge-method": "Only the S256 PKCE method is supported.",
+	"bad-state": "The sign-in request has no valid state.",
+	"bad-purpose": "The sign-in request names an unknown purpose.",
+	"bad-redirect": "The sign-in request names a return address this hub does not accept."
+};
+/**
+* Read the app parameters off a start query: `code_challenge`,
+* `code_challenge_method`, `state`, `purpose`, `redirect`. Anything missing or
+* malformed is refused - there is no lenient default for PKCE or state.
+*/
+function parseAppFlowRequest(query) {
+	const challenge = query["code_challenge"];
+	if (challenge === void 0 || !CHALLENGE_PATTERN.test(challenge)) return {
+		ok: false,
+		reason: "bad-challenge"
+	};
+	if (query["code_challenge_method"] !== "S256") return {
+		ok: false,
+		reason: "bad-challenge-method"
+	};
+	const state = query["state"];
+	if (state === void 0 || !STATE_PATTERN.test(state)) return {
+		ok: false,
+		reason: "bad-state"
+	};
+	const purpose = AppFlowPurposeSchema.safeParse(query["purpose"]);
+	if (!purpose.success) return {
+		ok: false,
+		reason: "bad-purpose"
+	};
+	const redirectParam = query["redirect"];
+	const redirect = redirectParam === void 0 ? APP_FLOW_DEFAULT_REDIRECT : parseAppAuthCallback(redirectParam);
+	if (redirect === null) return {
+		ok: false,
+		reason: "bad-redirect"
+	};
+	return {
+		ok: true,
+		request: {
+			codeChallenge: challenge,
+			state,
+			purpose: purpose.data,
+			redirect
+		}
+	};
+}
+/** The app's callback with `code` (success) or `error` (refusal), and the echoed `state` when known. */
+function appFlowLocation(redirect, result, state) {
+	const params = new URLSearchParams();
+	if ("code" in result) params.set("code", result.code);
+	else params.set("error", result.error);
+	if (state !== void 0) params.set("state", state);
+	return `${redirect}?${params.toString()}`;
+}
+/** How a native app starts one login method (D858), as `auth.listLoginMethods` reports it. */
+var AppLoginPathSchema = zod.z.discriminatedUnion("kind", [zod.z.object({ kind: zod.z.literal("native") }), zod.z.object({
+	kind: zod.z.literal("browser"),
+	startPath: zod.z.string().startsWith("/")
+})]);
+//#endregion
 //#region src/auth/sso-state.ts
 /**
 * The cookie that binds an SSO sign-in to the browser that started it.
@@ -6902,7 +6999,9 @@ var DeviceCertificateLoginMethodSchema = zod.z.object({
 	signature: zod.z.literal(DEVICE_CERT_SIGNATURE),
 	messageVersion: zod.z.literal(DEVICE_SIGNATURE_MESSAGE_VERSION),
 	/** Which clients can execute it: a native app silently, a browser with a non-extractable WebCrypto key. */
-	clients: zod.z.array(zod.z.enum(["native", "web"]))
+	clients: zod.z.array(zod.z.enum(["native", "web"])),
+	/** The app executes it itself, silently (D858). */
+	app: AppLoginPathSchema.nullable()
 });
 //#endregion
 //#region src/auth/request-origin.ts
@@ -38200,10 +38299,14 @@ function isLanIpv4Literal(endpoint) {
 	const host = hostnameOf(endpoint.baseUrl);
 	return host !== null && IPV4_LITERAL.test(host);
 }
+function isUnstable(endpoint) {
+	return endpoint.stable === false;
+}
 /** Lower = better; `null` = never this role's AUTOMATIC answer. */
 function autoRankFor(role, endpoint) {
 	if (endpoint.kind === "loopback" || endpoint.kind === "app-link" || endpoint.kind === "custom") return null;
 	if (hostnameOf(endpoint.baseUrl) === null) return null;
+	if (isUnstable(endpoint)) return null;
 	if (role === "internal") {
 		if (isLanIpv4Literal(endpoint)) return 0;
 		if (isPlausibleLan(endpoint)) return 1;
@@ -38358,6 +38461,7 @@ function resolveNotificationTapAddress(flags) {
 }
 /** AUTO app connections: LAN IPv4 + the public tunnel. Never IPv6, mesh, loopback or custom. */
 function isDefaultAppConnectionEndpoint(endpoint) {
+	if (isUnstable(endpoint)) return false;
 	if (endpoint.kind === "lan-ipv4") return true;
 	return endpoint.kind === "public" && endpoint.interfaceKind === "public";
 }
@@ -38438,6 +38542,18 @@ var AGENT_MDNS_TXT_KEYS = {
 	keyFingerprint: "fp"
 };
 //#endregion
+//#region src/capabilities/addon-catalog-href.ts
+/**
+* The Addons catalog filtered to the packages that declare `capability` — the
+* ONE spelling of that link (D860). It lives in `@camstack/types` so an addon's
+* own page (which may not import the admin UI) and the admin pages build it the
+* same way. `scripts/check-addon-install-links.ts` pins this file as the only
+* place the URL is written.
+*/
+function addonCatalogHref(capability) {
+	return `/system/addons?${new URLSearchParams({ capability }).toString()}`;
+}
+//#endregion
 //#region src/capabilities/ai-cap-timeouts.ts
 /**
 * Transport bounds for AI capability methods.
@@ -39524,7 +39640,13 @@ var RedirectLoginMethodSchema = zod.z.object({
 	* `beginExternalLink` offer exactly the redirect methods that set this,
 	* whatever their id. Absent / false — a login button only.
 	*/
-	linkable: zod.z.boolean().optional()
+	linkable: zod.z.boolean().optional(),
+	/**
+	* How a NATIVE app starts this method (D858): `{ kind: 'browser', startPath }`
+	* when the route understands the app flow query (`app=1&code_challenge=…`),
+	* `null`/absent when there is no app path - the app hides the method.
+	*/
+	app: AppLoginPathSchema.nullable().optional()
 });
 /**
 * A Module-Federation widget the login page mounts for an in-page
@@ -39543,7 +39665,9 @@ var WidgetLoginMethodSchema = zod.z.object({
 	bundle: zod.z.string(),
 	/** MF remote descriptor — `{ remoteName, exposedModule, componentKey }`. */
 	remote: WidgetRemoteSchema,
-	stage: LoginStageEnum
+	stage: LoginStageEnum,
+	/** Widgets are web ceremonies: no native app path (D858). Absent reads as `null`. */
+	app: AppLoginPathSchema.nullable().optional()
 });
 /**
 * A declarative WebAuthn ceremony the shell renders natively (no remote
@@ -39561,7 +39685,9 @@ var PasskeyLoginMethodSchema = zod.z.object({
 	/** Effective WebAuthn RP ID (`resolveRpID()`) — the shell gates visibility on it. */
 	rpId: zod.z.string(),
 	/** Effective expected origin (`resolveOrigin()`), null when unconfigured. */
-	origin: zod.z.string().nullable()
+	origin: zod.z.string().nullable(),
+	/** Set by the hub for the primary arm; a second-factor passkey has no app path (D858). */
+	app: AppLoginPathSchema.nullable().optional()
 });
 /** One login-method contribution — redirect button, pre-auth widget, or native passkey ceremony. */
 var LoginMethodContributionSchema = zod.z.discriminatedUnion("kind", [
@@ -40230,7 +40356,25 @@ var NetworkEndpointSchema = zod.z.object({
 	url: zod.z.string(),
 	hostname: zod.z.string(),
 	port: zod.z.number(),
-	protocol: zod.z.enum(["http", "https"])
+	protocol: zod.z.enum(["http", "https"]),
+	/**
+	* Whether this address survives a restart of its provider. `false` = it is
+	* re-issued every time (a Quick tunnel's random `*.trycloudflare.com`); the
+	* hub never selects such an address AUTOMATICALLY for a role (D860), though
+	* it stays visible and an operator may still flag it. Absent = stable: every
+	* provider except a Quick tunnel owns a name that does not change.
+	*/
+	stable: zod.z.boolean().optional()
+});
+/**
+* `data` of a `network.tunnel.started` event — what `local-network` (which
+* tails the bus and cannot import a provider) learns about the new address.
+*/
+var NetworkTunnelStartedDataSchema = zod.z.object({
+	url: zod.z.string(),
+	/** Mirrors {@link NetworkEndpointSchema} `stable`; absent = stable. */
+	stable: zod.z.boolean().optional(),
+	updated: zod.z.boolean().optional()
 });
 var NetworkAccessStatusSchema = zod.z.object({
 	connected: zod.z.boolean(),
@@ -54215,7 +54359,20 @@ var SsoBridgeClaimsSchema = zod.z.object({
 	* request to present the matching cookie — a login bridge is useless in
 	* any other browser.
 	*/
-	browserBinding: zod.z.string().optional()
+	browserBinding: zod.z.string().optional(),
+	/**
+	* The native app that started this sign-in (D858): its PKCE challenge,
+	* `state`, purpose and allow-listed return URL, copied from the server-side
+	* pending OIDC state. A bridge carrying it is finished ONLY at
+	* `/api/auth/sso/finish-app` (which mints a handoff code, never a web
+	* session); `/api/auth/sso/finish` refuses it.
+	*/
+	app: zod.z.object({
+		codeChallenge: zod.z.string(),
+		state: zod.z.string(),
+		purpose: zod.z.enum(["new-session", "step-up"]),
+		redirect: zod.z.string()
+	}).optional()
 });
 var ssoBridgeCapability = {
 	name: "sso-bridge",
@@ -57585,7 +57742,12 @@ var SearchResultSchema = zod.z.object({
 	publishedAt: zod.z.string(),
 	author: zod.z.string(),
 	installed: zod.z.boolean(),
-	installedVersion: zod.z.string().optional()
+	installedVersion: zod.z.string().optional(),
+	/**
+	* Capability names the package's addons declare (from its published
+	* manifest). `null` = the registry lookup failed — unknown, never `[]` (D393).
+	*/
+	capabilities: zod.z.array(zod.z.string()).readonly().nullable()
 });
 var AutoUpdateSettingsSchema = zod.z.object({
 	channel: ChannelSchema,
@@ -57804,7 +57966,11 @@ var addonsCapability = {
 			kind: "mutation",
 			auth: "admin"
 		}),
-		searchAvailable: require_sleep.method(zod.z.object({ query: zod.z.string().optional() }), zod.z.array(SearchResultSchema)),
+		searchAvailable: require_sleep.method(zod.z.object({
+			query: zod.z.string().optional(),
+			/** Only packages whose addons declare this capability (unknown ones excluded). */
+			capability: zod.z.string().optional()
+		}), zod.z.array(SearchResultSchema)),
 		/**
 		* Available package updates for a node. `nodeId` omitted (or
 		* `'hub'`) checks the hub's own installed packages; an agent
@@ -62077,7 +62243,13 @@ var ConnectionEndpointSchema = zod.z.object({
 	* calls so the client can sort even if the cap returns a new
 	* ordering between polls.
 	*/
-	priority: zod.z.number()
+	priority: zod.z.number(),
+	/**
+	* `false` = the address changes on its own (a Quick tunnel, re-issued on
+	* every respawn). Automatic role resolution skips it (D860); an explicit
+	* operator flag still honours it. Absent = stable.
+	*/
+	stable: zod.z.boolean().optional()
 });
 /**
 * Where the advertised local port came from. Ordered most → least
@@ -100400,6 +100572,9 @@ exports.APPEARANCE_RESOLVES_AMBIGUITY_DEFAULT = APPEARANCE_RESOLVES_AMBIGUITY_DE
 exports.APPLE_SA_TO_MACRO = APPLE_SA_TO_MACRO;
 exports.APP_AUTH_CALLBACK_MAX_LENGTH = APP_AUTH_CALLBACK_MAX_LENGTH;
 exports.APP_AUTH_CALLBACK_URLS = APP_AUTH_CALLBACK_URLS;
+exports.APP_FLOW_DEFAULT_REDIRECT = APP_FLOW_DEFAULT_REDIRECT;
+exports.APP_FLOW_REFUSAL_MESSAGES = APP_FLOW_REFUSAL_MESSAGES;
+exports.APP_FLOW_STATE_PREFIX = APP_FLOW_STATE_PREFIX;
 exports.ARCHIVED_DEBUG_NOTES_DEFAULT_LIMIT = ARCHIVED_DEBUG_NOTES_DEFAULT_LIMIT;
 exports.AUDIO_ANALYSIS_CAP_NAME = AUDIO_ANALYSIS_CAP_NAME;
 exports.AUDIO_BACKEND_CHOICES = AUDIO_BACKEND_CHOICES;
@@ -100447,6 +100622,8 @@ exports.AmbientLightSensorStatusSchema = AmbientLightSensorStatusSchema;
 exports.AnalyticsLtsSeriesSchema = AnalyticsLtsSeriesSchema;
 exports.ApiKeyRecordSchema = ApiKeyRecordSchema;
 exports.ApiKeySummarySchema = ApiKeySummarySchema;
+exports.AppFlowPurposeSchema = AppFlowPurposeSchema;
+exports.AppLoginPathSchema = AppLoginPathSchema;
 exports.AppleFmAvailabilitySchema = AppleFmAvailabilitySchema;
 exports.AppleFmUnavailableReasonSchema = AppleFmUnavailableReasonSchema;
 exports.ArchiveEntrySchema = ArchiveEntrySchema;
@@ -101512,6 +101689,7 @@ exports.NetworkAccessStatusSchema = NetworkAccessStatusSchema;
 exports.NetworkAddressSchema = NetworkAddressSchema;
 exports.NetworkEndpointSchema = NetworkEndpointSchema;
 exports.NetworkLinkStatusSchema = NetworkLinkStatusSchema;
+exports.NetworkTunnelStartedDataSchema = NetworkTunnelStartedDataSchema;
 exports.NodeBenchCellSchema = NodeBenchCellSchema;
 exports.NodeBenchClipSchema = NodeBenchClipSchema;
 exports.NodeBenchDeviceCellSchema = NodeBenchDeviceCellSchema;
@@ -102160,6 +102338,7 @@ exports.actionsForDevice = actionsForDevice;
 exports.actionsForDeviceType = actionsForDeviceType;
 exports.actionsForDevices = actionsForDevices;
 exports.activateAlarmProfile = activateAlarmProfile;
+exports.addonCatalogHref = addonCatalogHref;
 exports.addonPagesCapability = addonPagesCapability;
 exports.addonPagesSourceCapability = addonPagesSourceCapability;
 exports.addonRoutesCapability = addonRoutesCapability;
@@ -102179,6 +102358,7 @@ exports.alertsCapability = alertsCapability;
 exports.allDoActions = allDoActions;
 exports.allowedSuppliedEffect = allowedSuppliedEffect;
 exports.ambientLightSensorCapability = ambientLightSensorCapability;
+exports.appFlowLocation = appFlowLocation;
 exports.applyBlockingEdit = applyBlockingEdit;
 exports.applyModeDelaysEdits = applyModeDelaysEdits;
 exports.applyModeDeviceListEdit = applyModeDeviceListEdit;
@@ -102679,6 +102859,7 @@ exports.overlayClusterStepSettings = overlayClusterStepSettings;
 exports.packagePickerItems = packagePickerItems;
 exports.parseAdminBase = parseAdminBase;
 exports.parseAppAuthCallback = parseAppAuthCallback;
+exports.parseAppFlowRequest = parseAppFlowRequest;
 exports.parseCameraStreamConfig = parseCameraStreamConfig;
 exports.parseDeviceEnrollmentLink = parseDeviceEnrollmentLink;
 exports.parseExpression = require_composition.parseExpression;