@camstack/server 1.2.592 → 1.2.594

package/dist/api/core/auth.router.js

@@ -1,4 +1,3 @@
-"use strict";
 /**
  * Auth router — core API for login/logout/me.
  *
@@ -14,43 +13,40 @@
  * collection — the single, generic mechanism every auth addon contributes
  * to (superseding the removed `auth.listProviders`).
  */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.EXCHANGE_SESSION_HEADER = exports.BROWSER_HANDOFF_PATH = void 0;
-exports.createAuthRouter = createAuthRouter;
-const types_1 = require("@camstack/types");
-const server_1 = require("@trpc/server");
-const zod_1 = require("zod");
-const auth_network_policy_js_1 = require("../../auth/auth-network-policy.js");
-const app_passkey_routes_js_1 = require("../../auth/app-passkey-routes.js");
-const auth_rate_limit_js_1 = require("../../auth/auth-rate-limit.js");
-const auth_provider_gate_js_1 = require("../../auth/auth-provider-gate.js");
-const device_enroll_proofs_js_1 = require("../../auth/device-enroll-proofs.js");
-const external_link_intents_js_1 = require("../../auth/external-link-intents.js");
-const passkey_provider_js_1 = require("../../auth/passkey-provider.js");
-const second_factors_js_1 = require("../../auth/second-factors.js");
-const session_cookie_js_1 = require("../../auth/session-cookie.js");
-const hub_sessions_js_1 = require("../../auth/hub-sessions.js");
-const session_mint_js_1 = require("../../auth/session-mint.js");
-const handoff_code_service_js_1 = require("../../core/auth/handoff-code.service.js");
-const share_token_service_js_1 = require("../../core/auth/share-token.service.js");
-const principal_visibility_js_1 = require("../trpc/principal-visibility.js");
-const trpc_middleware_js_1 = require("../trpc/trpc.middleware.js");
-const auth_limits_js_1 = require("./auth-limits.js");
-const auth_admin_tokens_procedures_js_1 = require("./auth-admin-tokens.procedures.js");
-const auth_revoke_credentials_procedures_js_1 = require("./auth-revoke-credentials.procedures.js");
-const auth_reauth_procedures_js_1 = require("./auth-reauth.procedures.js");
-const auth_device_cert_procedures_js_1 = require("./auth-device-cert.procedures.js");
-const auth_sessions_procedures_js_1 = require("./auth-sessions.procedures.js");
-const server_name_js_1 = require("./server-name.js");
-const types_2 = require("@camstack/types");
-const user_error_js_1 = require("../trpc/user-error.js");
+import { advertisedHubOrigins, DEVICE_CERT_SIGNATURE, DEVICE_SIGNATURE_MESSAGE_VERSION, DeviceCertificateLoginMethodSchema, MethodAccessSchema, parseAppAuthCallback, pickRequestOrigin, PasskeyLoginMethodSchema, PasskeySummarySchema, RedirectLoginMethodSchema, ServerNameInfoSchema, summarizeEffectiveScope, TokenScopeSchema, WidgetLoginMethodSchema, } from '@camstack/types';
+import { TRPCError } from '@trpc/server';
+import { z } from 'zod';
+import { DEFAULT_AUTH_NETWORK_POLICY } from '../../auth/auth-network-policy.js';
+import { APP_PASSKEY_PATH } from '../../auth/app-passkey-routes.js';
+import { createRateLimiter } from '../../auth/auth-rate-limit.js';
+import { isAuthAddonDisabled } from '../../auth/auth-provider-gate.js';
+import { DeviceEnrollProofs } from '../../auth/device-enroll-proofs.js';
+import { ExternalLinkIntents } from '../../auth/external-link-intents.js';
+import { FinishRegistrationSchema, OptionsJsonSchema, resolvePasskeyProvider, SecondFactorPreferenceSchema, SetSecondFactorPreferenceSchema, } from '../../auth/passkey-provider.js';
+import { collectSecondFactors, SecondFactorSchema, } from '../../auth/second-factors.js';
+import { readSessionCookieFromHeader } from '../../auth/session-cookie.js';
+import { userManagementInternal } from '../../auth/hub-sessions.js';
+import { createSessionMinter, SessionRefreshRefusedError, SessionUserGoneError, } from '../../auth/session-mint.js';
+import { HandoffCodeService } from '../../core/auth/handoff-code.service.js';
+import { SHARE_TOKEN_TTL_MAX_SEC, SHARE_TOKEN_TTL_MIN_SEC, ShareTokenScopeSchema, } from '../../core/auth/share-token.service.js';
+import { filterViewableDeviceIds } from '../trpc/principal-visibility.js';
+import { adminProcedure, protectedProcedure, publicProcedure, trpcRouter, } from '../trpc/trpc.middleware.js';
+import { assertAccountNotLocked, limitByClient, limitByUser, PROCESS_AUTH_LIMITERS, recordAccountFailure, } from './auth-limits.js';
+import { createAdminTokenProcedures } from './auth-admin-tokens.procedures.js';
+import { createRevokeCredentialsProcedures } from './auth-revoke-credentials.procedures.js';
+import { assertReauthenticated, createReauthProcedures, ReauthTokenInput, } from './auth-reauth.procedures.js';
+import { createDeviceCertProcedures } from './auth-device-cert.procedures.js';
+import { createSessionProcedures } from './auth-sessions.procedures.js';
+import { serverNameReaderFor } from './server-name.js';
+import { userError } from '@camstack/types';
+import { trpcUserError } from '../trpc/user-error.js';
 /**
  * A public procedure limited per (procedure, REAL client address) — see
  * `auth-limits.ts` for the tiers and why the address is the forwarded client.
  */
 function makeRateLimitedProcedure(limiter, network) {
-    return trpc_middleware_js_1.publicProcedure.use(({ ctx, path, next }) => {
-        (0, auth_limits_js_1.limitByClient)(limiter, path, ctx.req, network);
+    return publicProcedure.use(({ ctx, path, next }) => {
+        limitByClient(limiter, path, ctx.req, network);
         return next({ ctx });
     });
 }
@@ -59,7 +55,7 @@ const STEP_UP_FRESH_MS = 120_000;
 /** Login methods that count as an authentication (a handoff / exchange / certificate session does not). */
 const STEP_UP_LOGIN_METHODS = ['password', 'passkey', 'sso'];
 /** Asks for the refresh-token flow (short access token + rotating refresh token). */
-const RefreshableInput = zod_1.z.boolean().optional();
+const RefreshableInput = z.boolean().optional();
 /** The request's User-Agent, trimmed, for the sessions list. */
 function clientLabel(req) {
     const ua = req?.headers['user-agent'];
@@ -71,11 +67,11 @@ function clientLabel(req) {
  * link claim, browser handoff — D801): per user, not per ip, because the
  * caller is known and a tunnel puts every client behind one address.
  */
-const SELF_CODE_LIMITER = (0, auth_rate_limit_js_1.createRateLimiter)({ windowMs: 60_000, max: 10 });
-const selfCodeProcedure = trpc_middleware_js_1.protectedProcedure.use(({ ctx, path, next }) => {
+const SELF_CODE_LIMITER = createRateLimiter({ windowMs: 60_000, max: 10 });
+const selfCodeProcedure = protectedProcedure.use(({ ctx, path, next }) => {
     const verdict = SELF_CODE_LIMITER.check(`${path}:${ctx.user?.id ?? 'anonymous'}`);
     if (!verdict.allowed) {
-        throw new server_1.TRPCError({
+        throw new TRPCError({
             code: 'TOO_MANY_REQUESTS',
             message: `Too many attempts — retry in ${verdict.retryAfterSeconds}s`,
         });
@@ -83,7 +79,7 @@ const selfCodeProcedure = trpc_middleware_js_1.protectedProcedure.use(({ ctx, pa
     return next({ ctx });
 });
 /** The hub route a browser-handoff code is redeemed at (`main.ts`). */
-exports.BROWSER_HANDOFF_PATH = '/api/auth/browser-handoff';
+export const BROWSER_HANDOFF_PATH = '/api/auth/browser-handoff';
 /**
  * The available second-factor kinds a user may satisfy after the
  * password leg. Capability-driven — `totp` maps to the
@@ -107,26 +103,26 @@ exports.BROWSER_HANDOFF_PATH = '/api/auth/browser-handoff';
  * `requiresTotp` is retained (`= secondFactors.includes('totp')`) for
  * backward compatibility with older SDK builds that branch on it.
  */
-const LoginResultSchema = zod_1.z.object({
-    token: zod_1.z.string(),
-    user: zod_1.z.object({
-        id: zod_1.z.string(),
-        username: zod_1.z.string(),
-        isAdmin: zod_1.z.boolean(),
+const LoginResultSchema = z.object({
+    token: z.string(),
+    user: z.object({
+        id: z.string(),
+        username: z.string(),
+        isAdmin: z.boolean(),
     }),
-    requiresTotp: zod_1.z.boolean().optional(),
-    secondFactors: zod_1.z.array(second_factors_js_1.SecondFactorSchema).optional(),
+    requiresTotp: z.boolean().optional(),
+    secondFactors: z.array(SecondFactorSchema).optional(),
     /** When the access token expires (epoch ms). Absent on a challenge. */
-    expiresAt: zod_1.z.number().optional(),
+    expiresAt: z.number().optional(),
     /** The server-side login session. */
-    sessionId: zod_1.z.string().optional(),
+    sessionId: z.string().optional(),
     /** When the session expires unless refreshed (epoch ms). */
-    sessionExpiresAt: zod_1.z.number().optional(),
+    sessionExpiresAt: z.number().optional(),
     /**
      * Only when the client asked (`refreshable: true`): swap it at
      * `auth.refreshSession` before `expiresAt`. Store it like a password.
      */
-    refreshToken: zod_1.z.string().optional(),
+    refreshToken: z.string().optional(),
 });
 // ── Login-method aggregation (login-method cap) ──────────────────────
 //
@@ -140,8 +136,8 @@ const LoginResultSchema = zod_1.z.object({
 // bundle's relative sibling imports inherit it and a CDN busts the WHOLE
 // bundle atomically on deploy (see the stamping site below). `redirect` and
 // `passkey` arms pass through untouched — no server-side enrichment needed.
-const PublicWidgetLoginMethodSchema = types_1.WidgetLoginMethodSchema.extend({
-    bundleUrl: zod_1.z.string(),
+const PublicWidgetLoginMethodSchema = WidgetLoginMethodSchema.extend({
+    bundleUrl: z.string(),
 });
 /** Stable per hub PROCESS — busts the login widget bundle URL on each
  *  restart/deploy while caching cleanly within the process's uptime. */
@@ -150,24 +146,24 @@ const AUTH_BUNDLE_VERSION = String(Date.now());
 // always sends `app` (`null` when there is no app path - the viewer hides the
 // method). It stays optional in the TYPE so the admin-ui's hand-mirrored arms,
 // which never read it, keep matching this union.
-const PublicRedirectLoginMethodSchema = types_1.RedirectLoginMethodSchema;
-const PublicPasskeyLoginMethodSchema = types_1.PasskeyLoginMethodSchema;
-const PublicLoginMethodSchema = zod_1.z.discriminatedUnion('kind', [
+const PublicRedirectLoginMethodSchema = RedirectLoginMethodSchema;
+const PublicPasskeyLoginMethodSchema = PasskeyLoginMethodSchema;
+const PublicLoginMethodSchema = z.discriminatedUnion('kind', [
     PublicRedirectLoginMethodSchema,
     PublicWidgetLoginMethodSchema,
     PublicPasskeyLoginMethodSchema,
-    types_1.DeviceCertificateLoginMethodSchema,
+    DeviceCertificateLoginMethodSchema,
 ]);
 /** One of the caller's linked sign-in identities, as the profile shows it (D782). */
-const OwnExternalIdentitySchema = zod_1.z.object({
-    provider: zod_1.z.string(),
-    subject: zod_1.z.string(),
-    label: zod_1.z.string().optional(),
-    linkedAt: zod_1.z.number(),
+const OwnExternalIdentitySchema = z.object({
+    provider: z.string(),
+    subject: z.string(),
+    label: z.string().optional(),
+    linkedAt: z.number(),
     /** The provider instance's button label, or `null` when it is gone / disabled. */
-    providerLabel: zod_1.z.string().nullable(),
+    providerLabel: z.string().nullable(),
     /** Whether the provider instance is configured and enabled right now. */
-    available: zod_1.z.boolean(),
+    available: z.boolean(),
 });
 // ── Share tokens (grid-view standalone share links) ──────────────────
 //
@@ -179,26 +175,26 @@ const OwnExternalIdentitySchema = zod_1.z.object({
 // TTL: a bounded number of seconds, or the EXPLICIT literal `'never'`
 // for a permanently-shared grid (revocation is the kill switch).
 // Omitted → 7-day default; infinite is never a silent default.
-const CreateShareTokenInputSchema = zod_1.z.object({
-    scope: share_token_service_js_1.ShareTokenScopeSchema,
-    ttlSec: zod_1.z
+const CreateShareTokenInputSchema = z.object({
+    scope: ShareTokenScopeSchema,
+    ttlSec: z
         .union([
-        zod_1.z.number().int().min(share_token_service_js_1.SHARE_TOKEN_TTL_MIN_SEC).max(share_token_service_js_1.SHARE_TOKEN_TTL_MAX_SEC),
-        zod_1.z.literal('never'),
+        z.number().int().min(SHARE_TOKEN_TTL_MIN_SEC).max(SHARE_TOKEN_TTL_MAX_SEC),
+        z.literal('never'),
     ])
         .optional(),
 });
-const ShareTokenSummarySchema = zod_1.z.object({
-    id: zod_1.z.string(),
-    userId: zod_1.z.string(),
-    tokenPrefix: zod_1.z.string(),
-    scope: share_token_service_js_1.ShareTokenScopeSchema,
-    createdAt: zod_1.z.number(),
+const ShareTokenSummarySchema = z.object({
+    id: z.string(),
+    userId: z.string(),
+    tokenPrefix: z.string(),
+    scope: ShareTokenScopeSchema,
+    createdAt: z.number(),
     /** Epoch ms, or `null` for never-expiring tokens. */
-    expiresAt: zod_1.z.number().nullable(),
+    expiresAt: z.number().nullable(),
     /** Derived convenience flag so listings surface infinite tokens clearly. */
-    neverExpires: zod_1.z.boolean(),
-    lastUsedAt: zod_1.z.number().optional(),
+    neverExpires: z.boolean(),
+    lastUsedAt: z.number().optional(),
 });
 function toShareTokenSummary(record) {
     return {
@@ -222,7 +218,7 @@ function assertRealUserSession(user, what = 'Share-token management') {
     // An admin token is a script's credential, never a person's session: it
     // must not turn itself into a session (handoff codes) or mint links.
     if (user.isScoped || user.shareView || user.adminTokenId !== undefined) {
-        throw new server_1.TRPCError({
+        throw new TRPCError({
             code: 'FORBIDDEN',
             message: `${what} requires a real user session`,
         });
@@ -239,7 +235,7 @@ function assertRealUserSession(user, what = 'Share-token management') {
 // answers with a freshly-minted session).
 /** Custom header a cross-site form can never set — CSRF gate for the
  *  cookie-authenticated `exchangeSession` mutation. */
-exports.EXCHANGE_SESSION_HEADER = 'x-camstack-exchange';
+export const EXCHANGE_SESSION_HEADER = 'x-camstack-exchange';
 /** Read a single-valued request header off the tRPC context request. */
 function readRequestHeader(req, name) {
     const value = req?.headers[name];
@@ -250,14 +246,14 @@ function readRequestHeader(req, name) {
     return null;
 }
 /** Per-access device reach summary (counts, never id lists). */
-const DeviceReachSummarySchema = zod_1.z.object({
-    all: zod_1.z.boolean(),
-    deviceCount: zod_1.z.number().int(),
+const DeviceReachSummarySchema = z.object({
+    all: z.boolean(),
+    deviceCount: z.number().int(),
 });
 /** One capability/addon grant flattened for the UI. */
-const ScopeGrantSummarySchema = zod_1.z.object({
-    name: zod_1.z.string(),
-    access: zod_1.z.array(types_1.MethodAccessSchema).readonly(),
+const ScopeGrantSummarySchema = z.object({
+    name: z.string(),
+    access: z.array(MethodAccessSchema).readonly(),
 });
 /**
  * The caller's RESOLVED effective scope (scope model v3). Selectors are
@@ -265,31 +261,31 @@ const ScopeGrantSummarySchema = zod_1.z.object({
  * the viewer (F3/F4) can HIDE out-of-scope surfaces from a single probe. A
  * non-admin with zero grants reports zero everything (born with no access).
  */
-const EffectiveScopeSchema = zod_1.z.object({
-    isAdmin: zod_1.z.boolean(),
-    allDevicesViewable: zod_1.z.boolean(),
-    viewableDeviceCount: zod_1.z.number().int(),
-    device: zod_1.z.object({
+const EffectiveScopeSchema = z.object({
+    isAdmin: z.boolean(),
+    allDevicesViewable: z.boolean(),
+    viewableDeviceCount: z.number().int(),
+    device: z.object({
         view: DeviceReachSummarySchema,
         create: DeviceReachSummarySchema,
         delete: DeviceReachSummarySchema,
     }),
-    system: zod_1.z.array(types_1.MethodAccessSchema).readonly(),
-    capabilities: zod_1.z.array(ScopeGrantSummarySchema).readonly(),
-    addons: zod_1.z.array(ScopeGrantSummarySchema).readonly(),
+    system: z.array(MethodAccessSchema).readonly(),
+    capabilities: z.array(ScopeGrantSummarySchema).readonly(),
+    addons: z.array(ScopeGrantSummarySchema).readonly(),
 });
 /** Wire shape of the authenticated user returned by `auth.me`. */
-const MeSchema = zod_1.z
+const MeSchema = z
     .object({
-    id: zod_1.z.string(),
-    username: zod_1.z.string(),
-    isAdmin: zod_1.z.boolean(),
-    permissions: zod_1.z.object({
-        isAdmin: zod_1.z.boolean(),
-        allowedProviders: zod_1.z.union([zod_1.z.literal('*'), zod_1.z.array(zod_1.z.string())]),
-        allowedDevices: zod_1.z.record(zod_1.z.string(), zod_1.z.unknown()),
+    id: z.string(),
+    username: z.string(),
+    isAdmin: z.boolean(),
+    permissions: z.object({
+        isAdmin: z.boolean(),
+        allowedProviders: z.union([z.literal('*'), z.array(z.string())]),
+        allowedDevices: z.record(z.string(), z.unknown()),
     }),
-    isApiKey: zod_1.z.boolean(),
+    isApiKey: z.boolean(),
     /**
      * The caller's resolved effective scope. Absent only on the (unreachable
      * here — `me` is `protected`) null-principal branch.
@@ -297,9 +293,9 @@ const MeSchema = zod_1.z
     scope: EffectiveScopeSchema.optional(),
 })
     .nullable();
-function createAuthRouter(auth, registry, moleculer = null, shareTokens = null, handoffCodes = new handoff_code_service_js_1.HandoffCodeService(), linkIntents = new external_link_intents_js_1.ExternalLinkIntents(), nativeLink = null, options = {}) {
-    const network = options.network ?? auth_network_policy_js_1.DEFAULT_AUTH_NETWORK_POLICY;
-    const limiters = options.limiters ?? auth_limits_js_1.PROCESS_AUTH_LIMITERS;
+export function createAuthRouter(auth, registry, moleculer = null, shareTokens = null, handoffCodes = new HandoffCodeService(), linkIntents = new ExternalLinkIntents(), nativeLink = null, options = {}) {
+    const network = options.network ?? DEFAULT_AUTH_NETWORK_POLICY;
+    const limiters = options.limiters ?? PROCESS_AUTH_LIMITERS;
     /** Secret-verifying legs (password / TOTP / passkey assertion / codes). */
     const credentialProcedure = makeRateLimitedProcedure(limiters.credential, network);
     /** Challenge-minting begin-legs — looser, they verify nothing. */
@@ -317,13 +313,13 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
      * admin change made mid-flow; signing from stale claims could mint a
      * stale-scope session.
      */
-    const minter = (0, session_mint_js_1.createSessionMinter)({
+    const minter = createSessionMinter({
         signer: auth,
         directory: () => registry?.getSingleton('user-management'),
         ...(options.sessions !== undefined ? { sessions: options.sessions } : {}),
         credentials: options.credentials ??
             (() => {
-                const internal = registry === null ? null : (0, hub_sessions_js_1.userManagementInternal)(registry);
+                const internal = registry === null ? null : userManagementInternal(registry);
                 return internal === null ? null : internal.deviceCredentials;
             }),
     });
@@ -352,8 +348,8 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
             return await mintSessionForUserId(userId, issue);
         }
         catch (error) {
-            if (error instanceof session_mint_js_1.SessionUserGoneError) {
-                throw (0, user_error_js_1.trpcUserError)('UNAUTHORIZED', 'auth.user-gone', undefined, 'User no longer exists');
+            if (error instanceof SessionUserGoneError) {
+                throw trpcUserError('UNAUTHORIZED', 'auth.user-gone', undefined, 'User no longer exists');
             }
             throw error;
         }
@@ -361,11 +357,11 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
     /** The second factors a primary login still owes (`auth/second-factors.ts`). */
     const collectSecondFactorsFor = async (userId, primary) => {
         const userMgmt = registry?.getSingleton('user-management');
-        return (0, second_factors_js_1.collectSecondFactors)({
+        return collectSecondFactors({
             ...(userMgmt && typeof userMgmt.getTotpStatus === 'function'
                 ? { getTotpStatus: (input) => userMgmt.getTotpStatus(input) }
                 : {}),
-            passkeyProvider: () => (0, passkey_provider_js_1.resolvePasskeyProvider)(registry, moleculer),
+            passkeyProvider: () => resolvePasskeyProvider(registry, moleculer),
         }, userId, primary);
     };
     /**
@@ -381,7 +377,7 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
         const address = network.clientAddress(req);
         if (!network.isTrustedNetworkLogin(address))
             return factors;
-        const internal = registry === null ? null : (0, hub_sessions_js_1.userManagementInternal)(registry);
+        const internal = registry === null ? null : userManagementInternal(registry);
         if (internal === null)
             return factors; // cannot audit it → do not skip it
         await internal.audit.record({
@@ -413,18 +409,18 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
             for (const [name, value] of Object.entries(req?.headers ?? {})) {
                 headers[name.toLowerCase()] = Array.isArray(value) ? value[0] : value;
             }
-            const picked = (0, types_1.pickRequestOrigin)(headers, (0, types_1.advertisedHubOrigins)(book));
+            const picked = pickRequestOrigin(headers, advertisedHubOrigins(book));
             return (picked ??
                 book.roles.publicEndpoint.resolved ??
                 book.roles.appConnections.resolved[0] ??
                 null);
         });
-    const enrollProofs = options.enrollProofs ?? new device_enroll_proofs_js_1.DeviceEnrollProofs(Date.now, options.logger ?? null);
+    const enrollProofs = options.enrollProofs ?? new DeviceEnrollProofs(Date.now, options.logger ?? null);
     /** The device credential behind a session, so a session minted FROM it inherits it (D855). */
     const credentialOfSession = (sessionId) => {
         if (sessionId === undefined || registry === null)
             return undefined;
-        const check = (0, hub_sessions_js_1.userManagementInternal)(registry)?.sessions.check(sessionId);
+        const check = userManagementInternal(registry)?.sessions.check(sessionId);
         return check?.state === 'active' ? (check.session.credentialId ?? undefined) : undefined;
     };
     /**
@@ -438,10 +434,10 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
     const assertFreshAuthentication = (user, reauthToken) => {
         const refuse = (message) => {
             options.logger?.warn(`Step-up refused: ${message}`, { tags: { userId: user.id } });
-            throw new server_1.TRPCError({ code: 'FORBIDDEN', message: `Sign in again first: ${message}` });
+            throw new TRPCError({ code: 'FORBIDDEN', message: `Sign in again first: ${message}` });
         };
         if (reauthToken !== undefined) {
-            (0, auth_reauth_procedures_js_1.assertReauthenticated)(auth, user, reauthToken);
+            assertReauthenticated(auth, user, reauthToken);
             if (!enrollProofs.consumeReauth(reauthToken))
                 refuse('that confirmation was already used');
             return;
@@ -449,7 +445,7 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
         const sid = user.sessionId;
         const check = sid === undefined || registry === null
             ? null
-            : (0, hub_sessions_js_1.userManagementInternal)(registry)?.sessions.check(sid);
+            : userManagementInternal(registry)?.sessions.check(sid);
         if (check?.state !== 'active')
             return refuse('no live session');
         if (!STEP_UP_LOGIN_METHODS.includes(check.session.method)) {
@@ -462,7 +458,7 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
             return refuse('this sign-in already started a step-up');
         }
     };
-    const serverNameReader = (0, server_name_js_1.serverNameReaderFor)(registry);
+    const serverNameReader = serverNameReaderFor(registry);
     const aggregateLoginMethods = async () => {
         if (!registry)
             return [];
@@ -475,7 +471,7 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
             // The operator's Enable/Disable on Identity → Authentication is the
             // addon's ONE enable (D777). It toggles `auth-provider` /
             // `user-passkeys`, never `login-method` — so ask the governing caps.
-            if ((0, auth_provider_gate_js_1.isAuthAddonDisabled)(registry, addonId))
+            if (isAuthAddonDisabled(registry, addonId))
                 continue;
             let contributions;
             try {
@@ -505,7 +501,7 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
                     // system browser at it; a second-factor ceremony has no app path.
                     const parsed = PublicPasskeyLoginMethodSchema.safeParse({
                         ...raw,
-                        app: raw.stage === 'primary' ? { kind: 'browser', startPath: app_passkey_routes_js_1.APP_PASSKEY_PATH } : null,
+                        app: raw.stage === 'primary' ? { kind: 'browser', startPath: APP_PASSKEY_PATH } : null,
                     });
                     if (parsed.success) {
                         out.push(parsed.data);
@@ -536,7 +532,7 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
         // The hub's own method (D855): a device certificate. Not an addon
         // contribution - the device CA lives in `local-auth` - so it is added here.
         // Offered only where the hub can actually serve it (local-auth up).
-        if ((0, hub_sessions_js_1.userManagementInternal)(registry) !== null)
+        if (userManagementInternal(registry) !== null)
             out.push({
                 kind: 'device-certificate',
                 id: 'device-certificate',
@@ -547,8 +543,8 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
                 renewPath: 'auth.renewDeviceCertificate',
                 revokePath: 'auth.revokeOwnDeviceCertificate',
                 enrollSelfPath: 'auth.enrollSelf',
-                signature: types_1.DEVICE_CERT_SIGNATURE,
-                messageVersion: types_1.DEVICE_SIGNATURE_MESSAGE_VERSION,
+                signature: DEVICE_CERT_SIGNATURE,
+                messageVersion: DEVICE_SIGNATURE_MESSAGE_VERSION,
                 clients: ['native'],
                 app: { kind: 'native' },
             });
@@ -561,9 +557,9 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
     const linkableProviders = async () => (await aggregateLoginMethods()).flatMap((m) => m.kind === 'redirect' && m.linkable === true
         ? [{ provider: m.id, label: m.label, startUrl: m.startUrl }]
         : []);
-    return (0, trpc_middleware_js_1.trpcRouter)({
+    return trpcRouter({
         login: credentialProcedure
-            .input(zod_1.z.object({ username: zod_1.z.string(), password: zod_1.z.string(), refreshable: RefreshableInput }))
+            .input(z.object({ username: z.string(), password: z.string(), refreshable: RefreshableInput }))
             .output(LoginResultSchema)
             .mutation(async ({ input, ctx }) => {
             const userMgmt = registry?.getSingleton('user-management');
@@ -577,14 +573,14 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
                     'The `local-auth` addon failed to initialize; check server logs ' +
                     'for an error tagged `[hub/local-auth]`.');
             }
-            (0, auth_limits_js_1.assertAccountNotLocked)(limiters, input.username);
+            assertAccountNotLocked(limiters, input.username);
             const user = await userMgmt.validateCredentials({
                 username: input.username,
                 password: input.password,
             });
             if (!user) {
-                (0, auth_limits_js_1.recordAccountFailure)(limiters, input.username);
-                throw (0, types_2.userError)('auth.invalid-credentials', undefined, 'Invalid credentials');
+                recordAccountFailure(limiters, input.username);
+                throw userError('auth.invalid-credentials', undefined, 'Invalid credentials');
             }
             // ── Second-factor gate ───────────────────────────────────────
             // After credentials validate, collect every ACTIVE second
@@ -629,7 +625,7 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
          *     deleted concurrently — rare).
          */
         loginVerifyTotp: credentialProcedure
-            .input(zod_1.z.object({ challengeToken: zod_1.z.string(), code: zod_1.z.string(), refreshable: RefreshableInput }))
+            .input(z.object({ challengeToken: z.string(), code: z.string(), refreshable: RefreshableInput }))
             .output(LoginResultSchema)
             .mutation(async ({ input, ctx }) => {
             const claims = auth.verifyTotpChallengeToken(input.challengeToken);
@@ -640,13 +636,13 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
             if (!userMgmt) {
                 throw new Error('Login unavailable — `user-management` capability not registered');
             }
-            (0, auth_limits_js_1.assertAccountNotLocked)(limiters, claims.username);
+            assertAccountNotLocked(limiters, claims.username);
             const verify = typeof userMgmt.verifyTotp === 'function'
                 ? await userMgmt.verifyTotp({ userId: claims.userId, code: input.code.trim() })
                 : { valid: false };
             if (!verify.valid) {
-                (0, auth_limits_js_1.recordAccountFailure)(limiters, claims.username);
-                throw (0, types_2.userError)('auth.invalid-totp', undefined, 'Invalid TOTP code');
+                recordAccountFailure(limiters, claims.username);
+                throw userError('auth.invalid-totp', undefined, 'Invalid TOTP code');
             }
             return mintSessionForUserId(claims.userId, issueFor(ctx.req, claims.method ?? 'password', input.refreshable));
         }),
@@ -658,14 +654,14 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
          * the client is still pre-session at this point.
          */
         loginBeginPasskey: ceremonyProcedure
-            .input(zod_1.z.object({ challengeToken: zod_1.z.string() }))
-            .output(passkey_provider_js_1.OptionsJsonSchema)
+            .input(z.object({ challengeToken: z.string() }))
+            .output(OptionsJsonSchema)
             .mutation(async ({ input }) => {
             const claims = auth.verifyTotpChallengeToken(input.challengeToken);
             if (!claims) {
-                throw (0, types_2.userError)('auth.login-challenge-expired', undefined, 'Invalid or expired login challenge — please re-enter your password');
+                throw userError('auth.login-challenge-expired', undefined, 'Invalid or expired login challenge — please re-enter your password');
             }
-            const provider = (0, passkey_provider_js_1.resolvePasskeyProvider)(registry, moleculer);
+            const provider = resolvePasskeyProvider(registry, moleculer);
             if (!provider)
                 throw new Error('Passkey authentication is not available');
             return provider.beginAuthentication({ userId: claims.userId });
@@ -678,28 +674,28 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
          * `loginVerifyTotp` uses (fresh user re-fetch for up-to-date scopes).
          */
         loginVerifyPasskey: credentialProcedure
-            .input(zod_1.z.object({
-            challengeToken: zod_1.z.string(),
-            response: zod_1.z.record(zod_1.z.string(), zod_1.z.unknown()),
+            .input(z.object({
+            challengeToken: z.string(),
+            response: z.record(z.string(), z.unknown()),
             refreshable: RefreshableInput,
         }))
             .output(LoginResultSchema)
             .mutation(async ({ input, ctx }) => {
             const claims = auth.verifyTotpChallengeToken(input.challengeToken);
             if (!claims) {
-                throw (0, types_2.userError)('auth.login-challenge-expired', undefined, 'Invalid or expired login challenge — please re-enter your password');
+                throw userError('auth.login-challenge-expired', undefined, 'Invalid or expired login challenge — please re-enter your password');
             }
-            const provider = (0, passkey_provider_js_1.resolvePasskeyProvider)(registry, moleculer);
+            const provider = resolvePasskeyProvider(registry, moleculer);
             if (!provider)
                 throw new Error('Passkey authentication is not available');
-            (0, auth_limits_js_1.assertAccountNotLocked)(limiters, claims.username);
+            assertAccountNotLocked(limiters, claims.username);
             const result = await provider.finishAuthentication({
                 userId: claims.userId,
                 response: input.response,
             });
             if (!result.verified) {
-                (0, auth_limits_js_1.recordAccountFailure)(limiters, claims.username);
-                throw (0, types_2.userError)('auth.passkey-verification-failed', undefined, 'Passkey verification failed');
+                recordAccountFailure(limiters, claims.username);
+                throw userError('auth.passkey-verification-failed', undefined, 'Passkey verification failed');
             }
             return mintSessionForUserId(claims.userId, issueFor(ctx.req, claims.method ?? 'password', input.refreshable));
         }),
@@ -715,10 +711,10 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
          * challenge store is bounded by its 5-min TTL prune.
          */
         passkeyLoginBegin: ceremonyProcedure
-            .input(zod_1.z.void())
-            .output(passkey_provider_js_1.OptionsJsonSchema)
+            .input(z.void())
+            .output(OptionsJsonSchema)
             .mutation(async () => {
-            const provider = (0, passkey_provider_js_1.resolvePasskeyProvider)(registry, moleculer);
+            const provider = resolvePasskeyProvider(registry, moleculer);
             if (!provider)
                 throw new Error('Passkey authentication is not available');
             return provider.beginDiscoverableAuthentication({});
@@ -739,17 +735,17 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
          * re-proving it adds nothing.
          */
         passkeyLoginFinish: credentialProcedure
-            .input(zod_1.z.object({ response: zod_1.z.record(zod_1.z.string(), zod_1.z.unknown()), refreshable: RefreshableInput }))
+            .input(z.object({ response: z.record(z.string(), z.unknown()), refreshable: RefreshableInput }))
             .output(LoginResultSchema)
             .mutation(async ({ input, ctx }) => {
-            const provider = (0, passkey_provider_js_1.resolvePasskeyProvider)(registry, moleculer);
+            const provider = resolvePasskeyProvider(registry, moleculer);
             if (!provider)
                 throw new Error('Passkey authentication is not available');
             const result = await provider.finishDiscoverableAuthentication({
                 response: input.response,
             });
             if (!result.verified || !result.userId) {
-                throw (0, user_error_js_1.trpcUserError)('UNAUTHORIZED', 'auth.passkey-verification-failed', undefined, 'Passkey verification failed');
+                throw trpcUserError('UNAUTHORIZED', 'auth.passkey-verification-failed', undefined, 'Passkey verification failed');
             }
             const secondFactors = await factorsOwedHere(result.userId, 'passkey', ctx.req);
             if (secondFactors.length > 0) {
@@ -794,25 +790,25 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
          *     scopes), equivalent to what `auth.login` hands out.
          */
         exchangeSession: credentialProcedure
-            .input(zod_1.z.object({ refreshable: RefreshableInput }).optional())
+            .input(z.object({ refreshable: RefreshableInput }).optional())
             .output(LoginResultSchema)
             .mutation(async ({ ctx, input }) => {
-            if (readRequestHeader(ctx.req, exports.EXCHANGE_SESSION_HEADER) !== '1') {
-                throw new server_1.TRPCError({
+            if (readRequestHeader(ctx.req, EXCHANGE_SESSION_HEADER) !== '1') {
+                throw new TRPCError({
                     code: 'FORBIDDEN',
-                    message: `Missing ${exports.EXCHANGE_SESSION_HEADER} header`,
+                    message: `Missing ${EXCHANGE_SESSION_HEADER} header`,
                 });
             }
-            const cookieToken = (0, session_cookie_js_1.readSessionCookieFromHeader)(readRequestHeader(ctx.req, 'cookie') ?? undefined);
+            const cookieToken = readSessionCookieFromHeader(readRequestHeader(ctx.req, 'cookie') ?? undefined);
             if (!cookieToken) {
-                throw (0, user_error_js_1.trpcUserError)('UNAUTHORIZED', 'auth.no-session-cookie', undefined, 'No session cookie');
+                throw trpcUserError('UNAUTHORIZED', 'auth.no-session-cookie', undefined, 'No session cookie');
             }
             let payload;
             try {
                 payload = auth.verifyToken(cookieToken);
             }
             catch {
-                throw (0, user_error_js_1.trpcUserError)('UNAUTHORIZED', 'auth.invalid-session-cookie', undefined, 'Invalid session cookie');
+                throw trpcUserError('UNAUTHORIZED', 'auth.invalid-session-cookie', undefined, 'Invalid session cookie');
             }
             // Reject non-session JWTs that verify under the same secret:
             // challenge/bridge tokens carry a `kind` discriminator, and a
@@ -821,7 +817,7 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
             if (kind !== undefined ||
                 typeof payload.isAdmin !== 'boolean' ||
                 typeof payload.userId !== 'string') {
-                throw (0, user_error_js_1.trpcUserError)('UNAUTHORIZED', 'auth.invalid-session-cookie', undefined, 'Invalid session cookie');
+                throw trpcUserError('UNAUTHORIZED', 'auth.invalid-session-cookie', undefined, 'Invalid session cookie');
             }
             // A session of its own for the client that asked (the hub-served
             // viewer): signing out of one never signs the other out.
@@ -840,19 +836,19 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
         /** Mint a one-time handoff code for the CALLING user. Real user
          *  sessions only — scoped (`cst_`) and share-view (`csv_`) callers
          *  must never convert themselves into a full session. */
-        createHandoffCode: trpc_middleware_js_1.protectedProcedure
-            .input(zod_1.z
+        createHandoffCode: protectedProcedure
+            .input(z
             .object({
-            purpose: zod_1.z.enum(['renew', 'new-session', 'step-up']).optional(),
+            purpose: z.enum(['renew', 'new-session', 'step-up']).optional(),
             /** PKCE S256 challenge of the app's verifier: redeem then requires the verifier. */
-            codeChallenge: zod_1.z.string().min(43).max(128).optional(),
+            codeChallenge: z.string().min(43).max(128).optional(),
             /** The app's anti-CSRF state, required again at redeem. */
-            state: zod_1.z.string().min(1).max(256).optional(),
+            state: z.string().min(1).max(256).optional(),
             /** `step-up`: a fresh single-use re-authentication, when the session itself is not a fresh sign-in. */
-            reauthToken: auth_reauth_procedures_js_1.ReauthTokenInput.optional(),
+            reauthToken: ReauthTokenInput.optional(),
         })
             .optional())
-            .output(zod_1.z.object({ code: zod_1.z.string(), expiresAt: zod_1.z.number() }))
+            .output(z.object({ code: z.string(), expiresAt: z.number() }))
             .mutation(({ ctx, input }) => {
             assertRealUserSession(ctx.user, 'Handoff-code minting');
             const purpose = input?.purpose ?? 'renew';
@@ -865,7 +861,7 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
                     tags: { userId: ctx.user.id },
                     meta: { purpose },
                 });
-                throw new server_1.TRPCError({
+                throw new TRPCError({
                     code: 'BAD_REQUEST',
                     message: 'codeChallenge (S256) and state are required for this handoff',
                 });
@@ -887,12 +883,12 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
         /** PUBLIC — redeem a one-time handoff code for a session bearer.
          *  Unknown / expired / already-used codes → UNAUTHORIZED. */
         redeemHandoffCode: credentialProcedure
-            .input(zod_1.z.object({
-            code: zod_1.z.string().min(1),
+            .input(z.object({
+            code: z.string().min(1),
             refreshable: RefreshableInput,
             /** PKCE: required when the code was minted with a `codeChallenge`. */
-            codeVerifier: zod_1.z.string().min(1).max(256).optional(),
-            state: zod_1.z.string().min(1).max(256).optional(),
+            codeVerifier: z.string().min(1).max(256).optional(),
+            state: z.string().min(1).max(256).optional(),
         }))
             .output(LoginResultSchema)
             .mutation(async ({ input, ctx }) => {
@@ -914,7 +910,7 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
                 });
             }
             if (!grant || grant.purpose === 'step-up') {
-                throw (0, user_error_js_1.trpcUserError)('UNAUTHORIZED', 'auth.handoff-code-invalid', undefined, 'Invalid or expired handoff code');
+                throw trpcUserError('UNAUTHORIZED', 'auth.handoff-code-invalid', undefined, 'Invalid or expired handoff code');
             }
             // A `renew` code continues THE SESSION IT WAS MINTED FROM. One without a session would
             // open a brand-new session with no PKCE behind it: refused.
@@ -922,7 +918,7 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
                 options.logger?.warn('Handoff redeem refused: a renew code with no session behind it', {
                     tags: { userId: grant.userId },
                 });
-                throw (0, user_error_js_1.trpcUserError)('UNAUTHORIZED', 'auth.handoff-code-invalid', undefined, 'Invalid or expired handoff code');
+                throw trpcUserError('UNAUTHORIZED', 'auth.handoff-code-invalid', undefined, 'Invalid or expired handoff code');
             }
             if (grant.purpose === 'renew' && grant.sessionId !== undefined) {
                 // A legacy client renewing: the SAME session, its expiry slides. A
@@ -931,9 +927,9 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
                     return await minter.continueSession(grant.userId, grant.sessionId);
                 }
                 catch (error) {
-                    if (error instanceof session_mint_js_1.SessionRefreshRefusedError ||
-                        error instanceof session_mint_js_1.SessionUserGoneError) {
-                        throw new server_1.TRPCError({
+                    if (error instanceof SessionRefreshRefusedError ||
+                        error instanceof SessionUserGoneError) {
+                        throw new TRPCError({
                             code: 'UNAUTHORIZED',
                             message: 'Session expired — sign in again',
                         });
@@ -947,8 +943,8 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
                 ...(grant.credentialId !== undefined ? { credentialId: grant.credentialId } : {}),
             });
         }),
-        me: trpc_middleware_js_1.protectedProcedure
-            .input(zod_1.z.void())
+        me: protectedProcedure
+            .input(z.void())
             .output(MeSchema)
             .query(({ ctx }) => {
             if (!ctx.user)
@@ -957,7 +953,7 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
             // hide surfaces from a single probe (F1 #5). Admins summarise to
             // "everything"; a scoped principal's selectors expand to counts.
             const fleet = ctx.deviceFleet?.() ?? [];
-            const scope = (0, types_1.summarizeEffectiveScope)(ctx.user.scopes ?? [], fleet, ctx.user.isAdmin);
+            const scope = summarizeEffectiveScope(ctx.user.scopes ?? [], fleet, ctx.user.isAdmin);
             return { ...ctx.user, scope };
         }),
         /**
@@ -981,13 +977,13 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
          * and the answer is "everything", which is what the panel must show
          * when the operator ticks the Admin box.
          */
-        previewScope: trpc_middleware_js_1.adminProcedure
-            .input(zod_1.z.object({
-            scopes: zod_1.z.array(types_1.TokenScopeSchema),
-            isAdmin: zod_1.z.boolean().default(false),
+        previewScope: adminProcedure
+            .input(z.object({
+            scopes: z.array(TokenScopeSchema),
+            isAdmin: z.boolean().default(false),
         }))
             .output(EffectiveScopeSchema)
-            .query(({ ctx, input }) => (0, types_1.summarizeEffectiveScope)(input.scopes, ctx.deviceFleet?.() ?? [], input.isAdmin)),
+            .query(({ ctx, input }) => summarizeEffectiveScope(input.scopes, ctx.deviceFleet?.() ?? [], input.isAdmin)),
         // ── Self-service profile operations ───────────────────────────────
         //
         // These route through the `user-management` capability provider but
@@ -1000,18 +996,18 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
         // them directly here is fine. The trpc admin-gate on the cap router
         // exists only to block third-party tampering — operators acting on
         // themselves bypass it intentionally.
-        changeOwnPassword: trpc_middleware_js_1.protectedProcedure
-            .input(zod_1.z.object({
-            currentPassword: zod_1.z.string().min(1),
-            newPassword: zod_1.z.string().min(8),
+        changeOwnPassword: protectedProcedure
+            .input(z.object({
+            currentPassword: z.string().min(1),
+            newPassword: z.string().min(8),
         }))
-            .output(zod_1.z.object({ success: zod_1.z.literal(true) }))
+            .output(z.object({ success: z.literal(true) }))
             .mutation(async ({ input, ctx }) => {
             const userMgmt = registry?.getSingleton('user-management');
             if (!userMgmt)
                 throw new Error('user-management capability not available');
             if (!ctx.user)
-                throw (0, types_2.userError)('auth.not-authenticated', undefined, 'Not authenticated');
+                throw userError('auth.not-authenticated', undefined, 'Not authenticated');
             // Re-validate the current password against the live store to
             // confirm session identity → password ownership match. Stops a
             // stolen session-token from rotating credentials silently.
@@ -1023,7 +1019,7 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
                 throw new Error('Current password is incorrect');
             // Hub-internal: the password changes AND every other session of the
             // user ends (this one stays signed in).
-            const internal = registry === null ? null : (0, hub_sessions_js_1.userManagementInternal)(registry);
+            const internal = registry === null ? null : userManagementInternal(registry);
             if (internal === null)
                 throw new Error('user-management capability not available');
             await internal.setPassword({
@@ -1033,44 +1029,44 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
             });
             return { success: true };
         }),
-        setupOwnTotp: trpc_middleware_js_1.protectedProcedure
-            .input(zod_1.z.void())
-            .output(zod_1.z.object({ secret: zod_1.z.string(), otpauthUrl: zod_1.z.string() }))
+        setupOwnTotp: protectedProcedure
+            .input(z.void())
+            .output(z.object({ secret: z.string(), otpauthUrl: z.string() }))
             .mutation(async ({ ctx }) => {
             const userMgmt = registry?.getSingleton('user-management');
             if (!userMgmt)
                 throw new Error('user-management capability not available');
             if (!ctx.user)
-                throw (0, types_2.userError)('auth.not-authenticated', undefined, 'Not authenticated');
+                throw userError('auth.not-authenticated', undefined, 'Not authenticated');
             return userMgmt.setupTotp({ userId: ctx.user.id });
         }),
-        confirmOwnTotp: trpc_middleware_js_1.protectedProcedure
-            .input(zod_1.z.object({ code: zod_1.z.string().min(1) }))
-            .output(zod_1.z.object({ success: zod_1.z.literal(true) }))
+        confirmOwnTotp: protectedProcedure
+            .input(z.object({ code: z.string().min(1) }))
+            .output(z.object({ success: z.literal(true) }))
             .mutation(async ({ input, ctx }) => {
             const userMgmt = registry?.getSingleton('user-management');
             if (!userMgmt)
                 throw new Error('user-management capability not available');
             if (!ctx.user)
-                throw (0, types_2.userError)('auth.not-authenticated', undefined, 'Not authenticated');
+                throw userError('auth.not-authenticated', undefined, 'Not authenticated');
             return userMgmt.confirmTotp({ userId: ctx.user.id, code: input.code });
         }),
-        disableOwnTotp: trpc_middleware_js_1.protectedProcedure
+        disableOwnTotp: protectedProcedure
             // Re-authentication required: a session alone must not strip 2FA.
-            .input(zod_1.z.object({ reauthToken: auth_reauth_procedures_js_1.ReauthTokenInput }).optional())
-            .output(zod_1.z.object({ success: zod_1.z.literal(true) }))
+            .input(z.object({ reauthToken: ReauthTokenInput }).optional())
+            .output(z.object({ success: z.literal(true) }))
             .mutation(async ({ ctx, input }) => {
-            (0, auth_reauth_procedures_js_1.assertReauthenticated)(auth, ctx.user, input?.reauthToken);
+            assertReauthenticated(auth, ctx.user, input?.reauthToken);
             const userMgmt = registry?.getSingleton('user-management');
             if (!userMgmt)
                 throw new Error('user-management capability not available');
             if (!ctx.user)
-                throw (0, types_2.userError)('auth.not-authenticated', undefined, 'Not authenticated');
+                throw userError('auth.not-authenticated', undefined, 'Not authenticated');
             return userMgmt.disableTotp({ userId: ctx.user.id });
         }),
-        getOwnTotpStatus: trpc_middleware_js_1.protectedProcedure
-            .input(zod_1.z.void())
-            .output(zod_1.z.object({ enabled: zod_1.z.boolean(), confirmedAt: zod_1.z.number().nullable() }))
+        getOwnTotpStatus: protectedProcedure
+            .input(z.void())
+            .output(z.object({ enabled: z.boolean(), confirmedAt: z.number().nullable() }))
             .query(async ({ ctx }) => {
             const userMgmt = registry?.getSingleton('user-management');
             if (!userMgmt || !ctx.user)
@@ -1085,24 +1081,24 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
         // THEIR OWN passkeys — the router is the trust boundary, exactly like
         // the TOTP self-service block above. Cap-agnostic: resolved through
         // the `user-passkeys` cap, never an addon id.
-        beginOwnPasskeyRegistration: trpc_middleware_js_1.protectedProcedure
-            .input(zod_1.z.void())
-            .output(passkey_provider_js_1.OptionsJsonSchema)
+        beginOwnPasskeyRegistration: protectedProcedure
+            .input(z.void())
+            .output(OptionsJsonSchema)
             .mutation(async ({ ctx }) => {
             if (!ctx.user)
-                throw (0, types_2.userError)('auth.not-authenticated', undefined, 'Not authenticated');
-            const provider = (0, passkey_provider_js_1.resolvePasskeyProvider)(registry, moleculer);
+                throw userError('auth.not-authenticated', undefined, 'Not authenticated');
+            const provider = resolvePasskeyProvider(registry, moleculer);
             if (!provider)
                 throw new Error('Passkey enrollment is not available');
             return provider.beginRegistration({ userId: ctx.user.id, username: ctx.user.username });
         }),
-        finishOwnPasskeyRegistration: trpc_middleware_js_1.protectedProcedure
-            .input(zod_1.z.object({ response: zod_1.z.record(zod_1.z.string(), zod_1.z.unknown()), label: zod_1.z.string() }))
-            .output(passkey_provider_js_1.FinishRegistrationSchema)
+        finishOwnPasskeyRegistration: protectedProcedure
+            .input(z.object({ response: z.record(z.string(), z.unknown()), label: z.string() }))
+            .output(FinishRegistrationSchema)
             .mutation(async ({ input, ctx }) => {
             if (!ctx.user)
-                throw (0, types_2.userError)('auth.not-authenticated', undefined, 'Not authenticated');
-            const provider = (0, passkey_provider_js_1.resolvePasskeyProvider)(registry, moleculer);
+                throw userError('auth.not-authenticated', undefined, 'Not authenticated');
+            const provider = resolvePasskeyProvider(registry, moleculer);
             if (!provider)
                 throw new Error('Passkey enrollment is not available');
             return provider.finishRegistration({
@@ -1111,13 +1107,13 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
                 label: input.label,
             });
         }),
-        listOwnPasskeys: trpc_middleware_js_1.protectedProcedure
-            .input(zod_1.z.void())
-            .output(zod_1.z.array(types_1.PasskeySummarySchema))
+        listOwnPasskeys: protectedProcedure
+            .input(z.void())
+            .output(z.array(PasskeySummarySchema))
             .query(async ({ ctx }) => {
             if (!ctx.user)
                 return [];
-            const provider = (0, passkey_provider_js_1.resolvePasskeyProvider)(registry, moleculer);
+            const provider = resolvePasskeyProvider(registry, moleculer);
             if (!provider)
                 return [];
             try {
@@ -1127,15 +1123,15 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
                 return [];
             }
         }),
-        removeOwnPasskey: trpc_middleware_js_1.protectedProcedure
+        removeOwnPasskey: protectedProcedure
             // Re-authentication required: removing a passkey can strip a factor.
-            .input(zod_1.z.object({ credentialId: zod_1.z.string(), reauthToken: auth_reauth_procedures_js_1.ReauthTokenInput.optional() }))
-            .output(zod_1.z.object({ success: zod_1.z.literal(true) }))
+            .input(z.object({ credentialId: z.string(), reauthToken: ReauthTokenInput.optional() }))
+            .output(z.object({ success: z.literal(true) }))
             .mutation(async ({ input, ctx }) => {
             if (!ctx.user)
-                throw (0, types_2.userError)('auth.not-authenticated', undefined, 'Not authenticated');
-            (0, auth_reauth_procedures_js_1.assertReauthenticated)(auth, ctx.user, input.reauthToken);
-            const provider = (0, passkey_provider_js_1.resolvePasskeyProvider)(registry, moleculer);
+                throw userError('auth.not-authenticated', undefined, 'Not authenticated');
+            assertReauthenticated(auth, ctx.user, input.reauthToken);
+            const provider = resolvePasskeyProvider(registry, moleculer);
             if (!provider)
                 throw new Error('Passkey management is not available');
             return provider.removePasskey({ userId: ctx.user.id, credentialId: input.credentialId });
@@ -1148,13 +1144,13 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
          * self-service block; reads degrade to `enabled: false` so the "My
          * access" page renders even while the provider is booting.
          */
-        getOwnPasskeySecondFactorPreference: trpc_middleware_js_1.protectedProcedure
-            .input(zod_1.z.void())
-            .output(passkey_provider_js_1.SecondFactorPreferenceSchema)
+        getOwnPasskeySecondFactorPreference: protectedProcedure
+            .input(z.void())
+            .output(SecondFactorPreferenceSchema)
             .query(async ({ ctx }) => {
             if (!ctx.user)
                 return { enabled: false };
-            const provider = (0, passkey_provider_js_1.resolvePasskeyProvider)(registry, moleculer);
+            const provider = resolvePasskeyProvider(registry, moleculer);
             if (!provider)
                 return { enabled: false };
             try {
@@ -1164,13 +1160,13 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
                 return { enabled: false };
             }
         }),
-        setOwnPasskeySecondFactorPreference: trpc_middleware_js_1.protectedProcedure
-            .input(zod_1.z.object({ enabled: zod_1.z.boolean() }))
-            .output(passkey_provider_js_1.SetSecondFactorPreferenceSchema)
+        setOwnPasskeySecondFactorPreference: protectedProcedure
+            .input(z.object({ enabled: z.boolean() }))
+            .output(SetSecondFactorPreferenceSchema)
             .mutation(async ({ input, ctx }) => {
             if (!ctx.user)
-                throw (0, types_2.userError)('auth.not-authenticated', undefined, 'Not authenticated');
-            const provider = (0, passkey_provider_js_1.resolvePasskeyProvider)(registry, moleculer);
+                throw userError('auth.not-authenticated', undefined, 'Not authenticated');
+            const provider = resolvePasskeyProvider(registry, moleculer);
             if (!provider)
                 throw new Error('Passkey management is not available');
             return provider.setSecondFactorPreference({
@@ -1183,9 +1179,9 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
         //    or regular); the resulting `csv_*` token authenticates as a
         //    restricted `share-view` principal limited to the embed surface
         //    + its in-scope devices (see `share-view-access.ts`). ──────────
-        createShareToken: trpc_middleware_js_1.protectedProcedure
+        createShareToken: protectedProcedure
             .input(CreateShareTokenInputSchema)
-            .output(zod_1.z.object({ id: zod_1.z.string(), token: zod_1.z.string(), expiresAt: zod_1.z.number().nullable() }))
+            .output(z.object({ id: z.string(), token: z.string(), expiresAt: z.number().nullable() }))
             .mutation(async ({ input, ctx }) => {
             assertRealUserSession(ctx.user);
             const service = requireShareTokens();
@@ -1202,10 +1198,10 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
                 ? input.scope
                 : {
                     ...input.scope,
-                    deviceIds: (0, principal_visibility_js_1.filterViewableDeviceIds)(ctx.user.scopes ?? [], input.scope.deviceIds, ctx.deviceScopeLookup),
+                    deviceIds: filterViewableDeviceIds(ctx.user.scopes ?? [], input.scope.deviceIds, ctx.deviceScopeLookup),
                 };
             if (scope.deviceIds.length === 0) {
-                throw new server_1.TRPCError({
+                throw new TRPCError({
                     code: 'FORBIDDEN',
                     message: 'None of the requested devices are within your scope — you cannot mint a share token for devices you cannot see',
                 });
@@ -1222,12 +1218,12 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
          * Home Assistant embed cache so a long-lived dashboard does not mint a
          * new row every hour. Expired / missing → NOT_FOUND (caller must create).
          */
-        extendShareToken: trpc_middleware_js_1.protectedProcedure
-            .input(zod_1.z.object({
-            id: zod_1.z.string().min(1),
-            ttlSec: zod_1.z.number().int().min(share_token_service_js_1.SHARE_TOKEN_TTL_MIN_SEC).max(share_token_service_js_1.SHARE_TOKEN_TTL_MAX_SEC),
+        extendShareToken: protectedProcedure
+            .input(z.object({
+            id: z.string().min(1),
+            ttlSec: z.number().int().min(SHARE_TOKEN_TTL_MIN_SEC).max(SHARE_TOKEN_TTL_MAX_SEC),
         }))
-            .output(zod_1.z.object({ id: zod_1.z.string(), expiresAt: zod_1.z.number() }))
+            .output(z.object({ id: z.string(), expiresAt: z.number() }))
             .mutation(async ({ input, ctx }) => {
             assertRealUserSession(ctx.user);
             const service = requireShareTokens();
@@ -1239,24 +1235,24 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
                     callerIsAdmin: ctx.user.isAdmin,
                 });
                 if (record.expiresAt === null) {
-                    throw (0, user_error_js_1.trpcUserError)('BAD_REQUEST', 'auth.share-never-expiring-extend', undefined, 'A never-expiring share token cannot be extended');
+                    throw trpcUserError('BAD_REQUEST', 'auth.share-never-expiring-extend', undefined, 'A never-expiring share token cannot be extended');
                 }
                 return { id: record.id, expiresAt: record.expiresAt };
             }
             catch (error) {
                 const message = error instanceof Error ? error.message : 'Share token extend failed';
                 if (/not found|expired/i.test(message)) {
-                    throw new server_1.TRPCError({ code: 'NOT_FOUND', message });
+                    throw new TRPCError({ code: 'NOT_FOUND', message });
                 }
                 if (/owner or an admin|never-expiring/i.test(message)) {
-                    throw new server_1.TRPCError({ code: 'FORBIDDEN', message });
+                    throw new TRPCError({ code: 'FORBIDDEN', message });
                 }
-                throw new server_1.TRPCError({ code: 'BAD_REQUEST', message });
+                throw new TRPCError({ code: 'BAD_REQUEST', message });
             }
         }),
-        revokeShareToken: trpc_middleware_js_1.protectedProcedure
-            .input(zod_1.z.object({ id: zod_1.z.string().min(1) }))
-            .output(zod_1.z.object({ success: zod_1.z.boolean() }))
+        revokeShareToken: protectedProcedure
+            .input(z.object({ id: z.string().min(1) }))
+            .output(z.object({ success: z.boolean() }))
             .mutation(async ({ input, ctx }) => {
             assertRealUserSession(ctx.user);
             const service = requireShareTokens();
@@ -1267,7 +1263,7 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
                     callerIsAdmin: ctx.user.isAdmin,
                 });
                 if (removed) {
-                    const internal = registry === null ? null : (0, hub_sessions_js_1.userManagementInternal)(registry);
+                    const internal = registry === null ? null : userManagementInternal(registry);
                     if (internal !== null) {
                         const ip = network.clientAddress(ctx.req).ip;
                         await internal.audit.record({
@@ -1287,7 +1283,7 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
                 return { success: removed };
             }
             catch (error) {
-                throw new server_1.TRPCError({
+                throw new TRPCError({
                     code: 'FORBIDDEN',
                     message: error instanceof Error ? error.message : 'Share token revoke failed',
                 });
@@ -1298,15 +1294,15 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
          * `owner: 'all'` — every user's, admin only. Omitted keeps the original
          * answer (own for a user, all for an admin) for clients that predate it.
          */
-        listShareTokens: trpc_middleware_js_1.protectedProcedure
-            .input(zod_1.z.object({ owner: zod_1.z.enum(['self', 'all']).optional() }).optional())
-            .output(zod_1.z.array(ShareTokenSummarySchema))
+        listShareTokens: protectedProcedure
+            .input(z.object({ owner: z.enum(['self', 'all']).optional() }).optional())
+            .output(z.array(ShareTokenSummarySchema))
             .query(async ({ ctx, input }) => {
             assertRealUserSession(ctx.user);
             const service = requireShareTokens();
             const owner = input?.owner ?? (ctx.user.isAdmin ? 'all' : 'self');
             if (owner === 'all' && !ctx.user.isAdmin) {
-                throw new server_1.TRPCError({
+                throw new TRPCError({
                     code: 'FORBIDDEN',
                     message: "Listing every user's share links requires an admin",
                 });
@@ -1314,11 +1310,11 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
             const records = owner === 'all' ? await service.listAll() : await service.listForUser(ctx.user.id);
             return records.map(toShareTokenSummary);
         }),
-        ...(0, auth_sessions_procedures_js_1.createSessionProcedures)({ registry, minter, credentialProcedure }),
-        ...(0, auth_device_cert_procedures_js_1.createDeviceCertProcedures)({
+        ...createSessionProcedures({ registry, minter, credentialProcedure }),
+        ...createDeviceCertProcedures({
             registry,
             minter,
-            publicProcedure: trpc_middleware_js_1.publicProcedure,
+            publicProcedure,
             auth,
             credentialLimiter: limiters.credential,
             ceremonyLimiter: limiters.ceremony,
@@ -1330,9 +1326,9 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
             resolveOrigin: resolveDeviceOrigin,
             issueFor,
         }),
-        ...(0, auth_reauth_procedures_js_1.createReauthProcedures)({ auth, registry, moleculer, limiters }),
-        ...(0, auth_admin_tokens_procedures_js_1.createAdminTokenProcedures)({ auth, registry, network }),
-        ...(0, auth_revoke_credentials_procedures_js_1.createRevokeCredentialsProcedures)({ registry, shareTokens, network }),
+        ...createReauthProcedures({ auth, registry, moleculer, limiters }),
+        ...createAdminTokenProcedures({ auth, registry, network }),
+        ...createRevokeCredentialsProcedures({ registry, shareTokens, network }),
         // ── External sign-in identities (D782) ────────────────────────
         //
         // A signed-in user links an OIDC identity to THEIR OWN account. The
@@ -1340,9 +1336,9 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
         // which also requires the same user's session cookie — the user id never
         // travels through the browser.
         /** Sign-in providers the caller can link (redirect methods declaring `linkable`). */
-        listLinkableProviders: trpc_middleware_js_1.protectedProcedure
-            .input(zod_1.z.void())
-            .output(zod_1.z.array(zod_1.z.object({ provider: zod_1.z.string(), label: zod_1.z.string() })))
+        listLinkableProviders: protectedProcedure
+            .input(z.void())
+            .output(z.array(z.object({ provider: z.string(), label: z.string() })))
             .query(async () => (await linkableProviders()).map(({ provider, label }) => ({ provider, label }))),
         /**
          * Start linking `provider` to the caller; the client navigates to `url`.
@@ -1350,33 +1346,33 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
          * (`APP_AUTH_CALLBACK_URLS`); the finish then parks the link for the app
          * to claim with `completeExternalLink` instead of needing a session cookie.
          */
-        beginExternalLink: trpc_middleware_js_1.protectedProcedure
-            .input(zod_1.z.object({
-            provider: zod_1.z.string().min(1),
-            returnTo: zod_1.z.string().optional(),
+        beginExternalLink: protectedProcedure
+            .input(z.object({
+            provider: z.string().min(1),
+            returnTo: z.string().optional(),
             /** From `auth.reauthenticate` — linking needs a fresh proof, not just a session. */
-            reauthToken: auth_reauth_procedures_js_1.ReauthTokenInput.optional(),
+            reauthToken: ReauthTokenInput.optional(),
         }))
-            .output(zod_1.z.object({ url: zod_1.z.string() }))
+            .output(z.object({ url: z.string() }))
             .mutation(async ({ ctx, input }) => {
             if (!ctx.user)
-                throw new server_1.TRPCError({ code: 'UNAUTHORIZED' });
+                throw new TRPCError({ code: 'UNAUTHORIZED' });
             assertRealUserSession(ctx.user, 'Linking a sign-in account');
             // Per user AND per client: each call mints an entry in a bounded
             // shared map, so a flood must not evict other users' pending links.
-            (0, auth_limits_js_1.limitByUser)(limiters.link, 'auth.beginExternalLink', ctx.user.id);
-            (0, auth_limits_js_1.limitByClient)(limiters.ceremony, 'auth.beginExternalLink', ctx.req, network);
-            (0, auth_reauth_procedures_js_1.assertReauthenticated)(auth, ctx.user, input.reauthToken);
-            const returnTo = input.returnTo === undefined ? undefined : (0, types_1.parseAppAuthCallback)(input.returnTo);
+            limitByUser(limiters.link, 'auth.beginExternalLink', ctx.user.id);
+            limitByClient(limiters.ceremony, 'auth.beginExternalLink', ctx.req, network);
+            assertReauthenticated(auth, ctx.user, input.reauthToken);
+            const returnTo = input.returnTo === undefined ? undefined : parseAppAuthCallback(input.returnTo);
             if (returnTo === null) {
-                throw new server_1.TRPCError({
+                throw new TRPCError({
                     code: 'BAD_REQUEST',
                     message: 'returnTo is not an allowed app callback',
                 });
             }
             const target = (await linkableProviders()).find((p) => p.provider === input.provider);
             if (target === undefined) {
-                throw new server_1.TRPCError({
+                throw new TRPCError({
                     code: 'BAD_REQUEST',
                     message: `Sign-in provider "${input.provider}" is not available for linking`,
                 });
@@ -1392,17 +1388,17 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
          * whatever the outcome.
          */
         completeExternalLink: selfCodeProcedure
-            .input(zod_1.z.object({ code: zod_1.z.string().min(1).max(256) }))
-            .output(zod_1.z.object({
-            outcome: zod_1.z.enum(['linked', 'conflict', 'expired', 'session']),
-            provider: zod_1.z.string().optional(),
+            .input(z.object({ code: z.string().min(1).max(256) }))
+            .output(z.object({
+            outcome: z.enum(['linked', 'conflict', 'expired', 'session']),
+            provider: z.string().optional(),
         }))
             .mutation(async ({ ctx, input }) => {
             if (!ctx.user)
-                throw new server_1.TRPCError({ code: 'UNAUTHORIZED' });
+                throw new TRPCError({ code: 'UNAUTHORIZED' });
             assertRealUserSession(ctx.user, 'Linking a sign-in account');
             if (nativeLink === null) {
-                throw new server_1.TRPCError({
+                throw new TRPCError({
                     code: 'PRECONDITION_FAILED',
                     message: 'Native linking is not available',
                 });
@@ -1422,14 +1418,14 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
          * lands on that page only: the route takes no destination.
          */
         createBrowserHandoff: selfCodeProcedure
-            .input(zod_1.z.void())
-            .output(zod_1.z.object({ path: zod_1.z.string(), expiresAt: zod_1.z.number() }))
+            .input(z.void())
+            .output(z.object({ path: z.string(), expiresAt: z.number() }))
             .mutation(({ ctx }) => {
             if (!ctx.user)
-                throw new server_1.TRPCError({ code: 'UNAUTHORIZED' });
+                throw new TRPCError({ code: 'UNAUTHORIZED' });
             assertRealUserSession(ctx.user, 'Opening the account page in a browser');
             if (nativeLink === null) {
-                throw new server_1.TRPCError({
+                throw new TRPCError({
                     code: 'PRECONDITION_FAILED',
                     message: 'Browser handoff is not available',
                 });
@@ -1439,12 +1435,12 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
                 purpose: 'new-session',
                 ...(parentCredential !== undefined ? { credentialId: parentCredential } : {}),
             });
-            return { path: `${exports.BROWSER_HANDOFF_PATH}?code=${encodeURIComponent(code)}`, expiresAt };
+            return { path: `${BROWSER_HANDOFF_PATH}?code=${encodeURIComponent(code)}`, expiresAt };
         }),
         /** The caller's linked identities; `available: false` when the provider instance is gone or off. */
-        listOwnExternalIdentities: trpc_middleware_js_1.protectedProcedure
-            .input(zod_1.z.void())
-            .output(zod_1.z.array(OwnExternalIdentitySchema))
+        listOwnExternalIdentities: protectedProcedure
+            .input(z.void())
+            .output(z.array(OwnExternalIdentitySchema))
             .query(async ({ ctx }) => {
             if (!ctx.user)
                 return [];
@@ -1463,12 +1459,12 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
             }));
         }),
         /** Remove one of the caller's own links. */
-        unlinkOwnExternalIdentity: trpc_middleware_js_1.protectedProcedure
-            .input(zod_1.z.object({ provider: zod_1.z.string().min(1), subject: zod_1.z.string().min(1) }))
-            .output(zod_1.z.object({ success: zod_1.z.boolean() }))
+        unlinkOwnExternalIdentity: protectedProcedure
+            .input(z.object({ provider: z.string().min(1), subject: z.string().min(1) }))
+            .output(z.object({ success: z.boolean() }))
             .mutation(async ({ ctx, input }) => {
             if (!ctx.user)
-                throw new server_1.TRPCError({ code: 'UNAUTHORIZED' });
+                throw new TRPCError({ code: 'UNAUTHORIZED' });
             assertRealUserSession(ctx.user, 'Unlinking a sign-in account');
             const userMgmt = registry?.getSingleton('user-management');
             if (!userMgmt)
@@ -1495,18 +1491,18 @@ function createAuthRouter(auth, registry, moleculer = null, shareTokens = null,
          * `listProviders`' old resilience) so one bad addon can't lock every
          * login method out of the UI.
          */
-        listLoginMethods: trpc_middleware_js_1.publicProcedure
-            .input(zod_1.z.void())
-            .output(zod_1.z.array(PublicLoginMethodSchema).readonly())
+        listLoginMethods: publicProcedure
+            .input(z.void())
+            .output(z.array(PublicLoginMethodSchema).readonly())
             .query(async () => aggregateLoginMethods()),
         /**
          * The hub's human name (D861), public like `listLoginMethods` and exposing
          * nothing else. A separate method on purpose: `listLoginMethods` stays the bare
          * array every installed viewer already parses.
          */
-        getServerName: trpc_middleware_js_1.publicProcedure
-            .input(zod_1.z.void())
-            .output(types_1.ServerNameInfoSchema)
+        getServerName: publicProcedure
+            .input(z.void())
+            .output(ServerNameInfoSchema)
             .query(async () => serverNameReader.read()),
     });
 }