@camstack/server 1.2.592 → 1.2.594

package/dist/api/core/server-name.js

@@ -1,4 +1,3 @@
-"use strict";
 /**
  * Reads the hub's human name (D861) from the one row that holds it,
  * `system-settings` / `server.name`, and falls back to the machine hostname.
@@ -12,44 +11,37 @@
  * hub that looks unnamed because its store is down is not mistaken for one that
  * was never named.
  */
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.ServerNameReader = void 0;
-exports.serverNameReaderFor = serverNameReaderFor;
-const node_os_1 = __importDefault(require("node:os"));
-const types_1 = require("@camstack/types");
+import os from 'node:os';
+import { errMsg, resolveServerName, SERVER_NAME_SETTING_KEY } from '@camstack/types';
 const SYSTEM_SETTINGS_COLLECTION = 'system-settings';
-class ServerNameReader {
+export class ServerNameReader {
     deps;
     constructor(deps) {
         this.deps = deps;
     }
     async read() {
-        const hostname = (this.deps.hostname ?? node_os_1.default.hostname)();
+        const hostname = (this.deps.hostname ?? os.hostname)();
         try {
             const stored = await this.deps.store.get({
                 collection: SYSTEM_SETTINGS_COLLECTION,
-                key: types_1.SERVER_NAME_SETTING_KEY,
+                key: SERVER_NAME_SETTING_KEY,
             });
-            return (0, types_1.resolveServerName)(stored, hostname);
+            return resolveServerName(stored, hostname);
         }
         catch (err) {
             this.deps.logger?.warn('server name read failed - answering the hostname default', {
-                meta: { error: (0, types_1.errMsg)(err) },
+                meta: { error: errMsg(err) },
             });
-            return (0, types_1.resolveServerName)(undefined, hostname);
+            return resolveServerName(undefined, hostname);
         }
     }
 }
-exports.ServerNameReader = ServerNameReader;
 /**
  * A reader that resolves the `settings-store` cap lazily from the registry (it
  * boots after the routers are built). Without a registry, or before the cap is
  * up, the read throws and {@link ServerNameReader} answers the hostname default.
  */
-function serverNameReaderFor(registry, logger) {
+export function serverNameReaderFor(registry, logger) {
     return new ServerNameReader({
         store: {
             get: async (input) => {

package/dist/api/core/site-location.js

@@ -1,4 +1,3 @@
-"use strict";
 /**
  * Site location — the installation's coordinates, as a fact of the SITE.
  *
@@ -45,15 +44,9 @@
  * and a derivation must never overwrite a typed value, which is why
  * `SiteLocationService.detect` refuses when `source === 'operator-set'`.
  */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.SiteLocationService = exports.GEO_IP_ENDPOINTS = exports.GEO_IP_TIMEOUT_MS = exports.SITE_LOCATION_KEY = void 0;
-exports.isUsableCoordinate = isUsableCoordinate;
-exports.toStatus = toStatus;
-exports.parseGeoIpPayload = parseGeoIpPayload;
-exports.geolocatePublicIp = geolocatePublicIp;
-const types_1 = require("@camstack/types");
+import { errMsg } from '@camstack/types';
 /** The `system-settings` row this module owns. */
-exports.SITE_LOCATION_KEY = 'site-location';
+export const SITE_LOCATION_KEY = 'site-location';
 const SYSTEM_SETTINGS_COLLECTION = 'system-settings';
 /**
  * The addon store the coordinates used to live in. Read ONCE, lazily, to
@@ -70,7 +63,7 @@ const LEGACY_LNG_KEY = 'siteLongitude';
  * is long enough for a cold TLS handshake to a CDN and short enough that a
  * captive-portal black hole does not look like a hang.
  */
-exports.GEO_IP_TIMEOUT_MS = 4_000;
+export const GEO_IP_TIMEOUT_MS = 4_000;
 /**
  * No-key, HTTPS geo-IP endpoints, tried in order until one parses.
  *
@@ -79,7 +72,7 @@ exports.GEO_IP_TIMEOUT_MS = 4_000;
  * and the request carries nothing but the hub's IP — which the endpoint would
  * see regardless, since seeing it is the entire mechanism.
  */
-exports.GEO_IP_ENDPOINTS = [
+export const GEO_IP_ENDPOINTS = [
     'https://ipinfo.io/json',
     'https://ipapi.co/json/',
 ];
@@ -89,7 +82,7 @@ exports.GEO_IP_ENDPOINTS = [
  * is treated as absent rather than clamped: a wrong-but-plausible coordinate
  * produces a wrong sunrise silently, which is worse than the declared fallback.
  */
-function isUsableCoordinate(lat, lng) {
+export function isUsableCoordinate(lat, lng) {
     if (typeof lat !== 'number' || typeof lng !== 'number')
         return false;
     if (!Number.isFinite(lat) || !Number.isFinite(lng))
@@ -99,7 +92,7 @@ function isUsableCoordinate(lat, lng) {
     return lat !== 0 || lng !== 0;
 }
 /** Project a stored row onto the wire shape. */
-function toStatus(record) {
+export function toStatus(record) {
     if (record === null) {
         return { location: null, derivationAttemptedAt: null, derivationError: null };
     }
@@ -152,7 +145,7 @@ function asRecord(raw) {
  * three field names, and an adapter per vendor is how a 30-line fetch becomes a
  * folder.
  */
-function parseGeoIpPayload(payload) {
+export function parseGeoIpPayload(payload) {
     if (payload === null || typeof payload !== 'object')
         return null;
     const obj = payload;
@@ -183,12 +176,12 @@ function parseGeoIpPayload(payload) {
  * Every failure mode collapses to `null` plus a log line: this is a *default*,
  * and a default that throws would take down whatever asked for it.
  */
-async function geolocatePublicIp(fetchImpl, logger, endpoints = exports.GEO_IP_ENDPOINTS) {
+export async function geolocatePublicIp(fetchImpl, logger, endpoints = GEO_IP_ENDPOINTS) {
     for (const url of endpoints) {
         try {
             const response = await fetchImpl(url, {
                 headers: { Accept: 'application/json' },
-                signal: AbortSignal.timeout(exports.GEO_IP_TIMEOUT_MS),
+                signal: AbortSignal.timeout(GEO_IP_TIMEOUT_MS),
             });
             if (!response.ok) {
                 logger?.debug('geo-IP endpoint refused', { meta: { url, status: response.status } });
@@ -200,7 +193,7 @@ async function geolocatePublicIp(fetchImpl, logger, endpoints = exports.GEO_IP_E
             logger?.debug('geo-IP endpoint answered without usable coordinates', { meta: { url } });
         }
         catch (err) {
-            logger?.debug('geo-IP endpoint failed', { meta: { url, error: (0, types_1.errMsg)(err) } });
+            logger?.debug('geo-IP endpoint failed', { meta: { url, error: errMsg(err) } });
         }
     }
     return null;
@@ -213,7 +206,7 @@ async function geolocatePublicIp(fetchImpl, logger, endpoints = exports.GEO_IP_E
  * `derivationAttemptedAt` bounds them across requests and across restarts. The
  * durable marker is the real guarantee; the in-process one only stops a burst.
  */
-class SiteLocationService {
+export class SiteLocationService {
     deps;
     static inFlight = null;
     constructor(deps) {
@@ -230,7 +223,7 @@ class SiteLocationService {
         try {
             return asRecord(await this.deps.store.get({
                 collection: SYSTEM_SETTINGS_COLLECTION,
-                key: exports.SITE_LOCATION_KEY,
+                key: SITE_LOCATION_KEY,
             }));
         }
         catch (err) {
@@ -238,14 +231,14 @@ class SiteLocationService {
             // the derivation off to overwrite a value that exists. Rethrow-as-null is
             // exactly the D49 shape this repo has been bitten by, so the caller is
             // told instead.
-            this.deps.logger?.warn('site location read failed', { meta: { error: (0, types_1.errMsg)(err) } });
+            this.deps.logger?.warn('site location read failed', { meta: { error: errMsg(err) } });
             throw err;
         }
     }
     async write(record) {
         await this.deps.store.set({
             collection: SYSTEM_SETTINGS_COLLECTION,
-            key: exports.SITE_LOCATION_KEY,
+            key: SITE_LOCATION_KEY,
             value: record,
         });
     }
@@ -275,7 +268,7 @@ class SiteLocationService {
         }
         catch (err) {
             this.deps.logger?.debug('legacy site coordinates read failed', {
-                meta: { error: (0, types_1.errMsg)(err) },
+                meta: { error: errMsg(err) },
             });
             return null;
         }
@@ -340,7 +333,7 @@ class SiteLocationService {
             // The marker is what makes it one-shot. Losing it costs a retry on the
             // next read, never a wrong value.
             this.deps.logger?.warn('site location failure marker could not be persisted', {
-                meta: { error: (0, types_1.errMsg)(err) },
+                meta: { error: errMsg(err) },
             });
         }
         return toStatus(failure);
@@ -386,4 +379,3 @@ class SiteLocationService {
         return this.derive();
     }
 }
-exports.SiteLocationService = SiteLocationService;

package/dist/api/core/stream-probe.router.js

@@ -1,6 +1,3 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createStreamProbeRouter = createStreamProbeRouter;
 /**
  * Stream probe router — fixed core API (not a capability).
  *
@@ -11,32 +8,32 @@ exports.createStreamProbeRouter = createStreamProbeRouter;
  * Previously these endpoints lived under `streaming.probeStream` — moved
  * here as part of eliminating the `streaming` aggregator capability.
  */
-const zod_1 = require("zod");
-const types_1 = require("@camstack/types");
-const trpc_middleware_js_1 = require("../trpc/trpc.middleware.js");
-const ProbedStreamSchema = zod_1.z.object({
-    width: zod_1.z.number().optional(),
-    height: zod_1.z.number().optional(),
-    codec: zod_1.z.string().optional(),
-    fps: zod_1.z.number().optional(),
-    bitrateKbps: zod_1.z.number().optional(),
-    quality: zod_1.z.enum(['high', 'mid', 'low']),
+import { z } from 'zod';
+import { classifyStream } from '@camstack/types';
+import { trpcRouter, adminProcedure } from '../trpc/trpc.middleware.js';
+const ProbedStreamSchema = z.object({
+    width: z.number().optional(),
+    height: z.number().optional(),
+    codec: z.string().optional(),
+    fps: z.number().optional(),
+    bitrateKbps: z.number().optional(),
+    quality: z.enum(['high', 'mid', 'low']),
 });
-const FieldProbeResultSchema = zod_1.z.object({
-    status: zod_1.z.enum(['ok', 'error']),
-    labels: zod_1.z.array(zod_1.z.string()).optional(),
-    error: zod_1.z.string().optional(),
+const FieldProbeResultSchema = z.object({
+    status: z.enum(['ok', 'error']),
+    labels: z.array(z.string()).optional(),
+    error: z.string().optional(),
 });
-function createStreamProbeRouter(sp) {
-    return (0, trpc_middleware_js_1.trpcRouter)({
-        probe: trpc_middleware_js_1.adminProcedure
-            .input(zod_1.z.object({ url: zod_1.z.string(), force: zod_1.z.boolean().optional() }))
+export function createStreamProbeRouter(sp) {
+    return trpcRouter({
+        probe: adminProcedure
+            .input(z.object({ url: z.string(), force: z.boolean().optional() }))
             .output(ProbedStreamSchema)
             .mutation(async ({ input }) => {
             if (!sp)
                 throw new Error('StreamProbeService not available');
             const metadata = await sp.probe(input.url, { force: input.force });
-            return { ...metadata, quality: (0, types_1.classifyStream)(metadata) };
+            return { ...metadata, quality: classifyStream(metadata) };
         }),
         /**
          * Generic field probe — decides stream vs HTTP reachability based on
@@ -46,8 +43,8 @@ function createStreamProbeRouter(sp) {
          * that need the kernel's probe without re-implementing ffprobe /
          * HTTP fetch in every addon.
          */
-        probeField: trpc_middleware_js_1.adminProcedure
-            .input(zod_1.z.object({ key: zod_1.z.string(), value: zod_1.z.unknown() }))
+        probeField: adminProcedure
+            .input(z.object({ key: z.string(), value: z.unknown() }))
             .output(FieldProbeResultSchema)
             .mutation(async ({ input }) => {
             if (!sp)

package/dist/api/core/system-events.router.js

@@ -1,6 +1,3 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createSystemEventsRouter = createSystemEventsRouter;
 /**
  * System events router — fixed core API (not a capability).
  *
@@ -9,10 +6,10 @@ exports.createSystemEventsRouter = createSystemEventsRouter;
  * All filters are applied server-side by the SystemEventBus — the client
  * only receives matching events.
  */
-const zod_1 = require("zod");
-const trpc_middleware_js_1 = require("../trpc/trpc.middleware.js");
-const principal_visibility_js_1 = require("../trpc/principal-visibility.js");
-const public_event_filter_js_1 = require("./public-event-filter.js");
+import { z } from 'zod';
+import { trpcRouter, protectedProcedure, iterableSubscription } from '../trpc/trpc.middleware.js';
+import { scopedEventVisibility } from '../trpc/principal-visibility.js';
+import { isPublicEvent, publicRecent } from './public-event-filter.js';
 function serialize(e) {
     return {
         id: e.id,
@@ -33,20 +30,20 @@ function serialize(e) {
  * Category handling is split (asymmetric): see the per-method schemas
  * below.
  */
-const ScopeFieldsSchema = zod_1.z.object({
+const ScopeFieldsSchema = z.object({
     /** Legacy source filter (exact type+id match). */
-    source: zod_1.z
+    source: z
         .object({
-        type: zod_1.z.string(),
-        id: zod_1.z.union([zod_1.z.string(), zod_1.z.number()]),
+        type: z.string(),
+        id: z.union([z.string(), z.number()]),
     })
         .optional(),
     /** Agent/node filter (prefix match: 'hub' matches 'hub/pipeline'). */
-    agentId: zod_1.z.string().optional(),
+    agentId: z.string().optional(),
     /** Addon filter. Matches source.addonId or source.id when type='addon'. */
-    addonId: zod_1.z.string().optional(),
+    addonId: z.string().optional(),
     /** Device filter. Matches source.deviceId or source.id when type='device'. */
-    deviceId: zod_1.z.number().optional(),
+    deviceId: z.number().optional(),
 });
 /**
  * `getRecent` accepts a category array so the UI can drive a
@@ -61,8 +58,8 @@ const ScopeFieldsSchema = zod_1.z.object({
  * `category` field as `string | string[]`.
  */
 const GetRecentInputSchema = ScopeFieldsSchema.extend({
-    category: zod_1.z.union([zod_1.z.string(), zod_1.z.array(zod_1.z.string())]).optional(),
-    limit: zod_1.z.number().int().min(1).max(500).optional(),
+    category: z.union([z.string(), z.array(z.string())]).optional(),
+    limit: z.number().int().min(1).max(500).optional(),
 });
 /**
  * `subscribe` keeps category as a single string — a WIRE choice now, not a bus
@@ -78,17 +75,17 @@ const GetRecentInputSchema = ScopeFieldsSchema.extend({
  * wildcard and narrow client-side.
  */
 const SubscribeInputSchema = ScopeFieldsSchema.extend({
-    category: zod_1.z.string().optional(),
+    category: z.string().optional(),
 });
-function createSystemEventsRouter(eb) {
-    return (0, trpc_middleware_js_1.trpcRouter)({
-        getRecent: trpc_middleware_js_1.protectedProcedure.input(GetRecentInputSchema).query(({ input, ctx }) => {
+export function createSystemEventsRouter(eb) {
+    return trpcRouter({
+        getRecent: protectedProcedure.input(GetRecentInputSchema).query(({ input, ctx }) => {
             // SECURITY (F0.5): filter the history to what a device-restricted scoped
             // token may view. null ⇒ admin / broad category-view operator ⇒ unfiltered.
             // An owner-only category (D224) is not history anyone may read. Both
             // projections run BEFORE the limit, so N asked is N public rows answered.
-            const keep = (0, principal_visibility_js_1.scopedEventVisibility)(ctx.user, ctx.deviceScopeLookup);
-            return (0, public_event_filter_js_1.publicRecent)(eb, {
+            const keep = scopedEventVisibility(ctx.user, ctx.deviceScopeLookup);
+            return publicRecent(eb, {
                 ...(input.source ? { source: input.source } : {}),
                 ...(input.agentId ? { agentId: input.agentId } : {}),
                 ...(input.addonId ? { addonId: input.addonId } : {}),
@@ -96,11 +93,11 @@ function createSystemEventsRouter(eb) {
                 ...(input.category ? { category: input.category } : {}),
             }, input.limit, keep).map(serialize);
         }),
-        subscribe: trpc_middleware_js_1.protectedProcedure.input(SubscribeInputSchema).subscription(({ input, ctx }) => {
+        subscribe: protectedProcedure.input(SubscribeInputSchema).subscription(({ input, ctx }) => {
             // SECURITY (F0.5): a device-restricted scoped token must not receive every
             // camera's live events. Same projection as `getRecent`.
-            const keep = (0, principal_visibility_js_1.scopedEventVisibility)(ctx.user, ctx.deviceScopeLookup);
-            return (0, trpc_middleware_js_1.iterableSubscription)((push) => {
+            const keep = scopedEventVisibility(ctx.user, ctx.deviceScopeLookup);
+            return iterableSubscription((push) => {
                 return eb.subscribe({
                     ...(input.source ? { source: input.source } : {}),
                     ...(input.agentId ? { agentId: input.agentId } : {}),
@@ -108,7 +105,7 @@ function createSystemEventsRouter(eb) {
                     ...(input.deviceId !== undefined ? { deviceId: input.deviceId } : {}),
                     ...(input.category ? { category: input.category } : {}),
                 }, (event) => {
-                    if (!(0, public_event_filter_js_1.isPublicEvent)(event))
+                    if (!isPublicEvent(event))
                         return;
                     if (!keep || keep(event))
                         push(serialize(event));

package/dist/api/cors/cors-policy.js

@@ -1,4 +1,3 @@
-"use strict";
 /**
  * cors-policy — which browser origins may READ this hub's responses (D707).
  *
@@ -32,23 +31,15 @@
  *
  * Pure: no Fastify, no I/O — `register-cors-policy.ts` is the glue.
  */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.CORS_PREFLIGHT_MAX_AGE_SEC = exports.CORS_EXPOSED_HEADERS = exports.CORS_ALLOWED_HEADERS = exports.CORS_ALLOWED_METHODS = exports.OPAQUE_ORIGIN = exports.VIEWER_PWA_ORIGIN = void 0;
-exports.normalizeOrigin = normalizeOrigin;
-exports.parseConfiguredOrigins = parseConfiguredOrigins;
-exports.builtInOrigins = builtInOrigins;
-exports.judgeCorsOrigin = judgeCorsOrigin;
-exports.corsResponseHeaders = corsResponseHeaders;
-exports.appendVary = appendVary;
 /** The hosted viewer PWA (operator decision 2026-10-06). */
-exports.VIEWER_PWA_ORIGIN = 'https://camstack.zentik.app';
+export const VIEWER_PWA_ORIGIN = 'https://camstack.zentik.app';
 /**
  * The serialisation of an opaque origin. The native app's OTA embed
  * (`assets/embed/camstack-embed.html`, loaded from `file://`) sends it.
  */
-exports.OPAQUE_ORIGIN = 'null';
+export const OPAQUE_ORIGIN = 'null';
 /** Every method a hub route answers. */
-exports.CORS_ALLOWED_METHODS = 'GET, HEAD, POST, PUT, PATCH, DELETE, OPTIONS';
+export const CORS_ALLOWED_METHODS = 'GET, HEAD, POST, PUT, PATCH, DELETE, OPTIONS';
 /**
  * Request headers a cross-origin caller may send. `authorization` is the
  * whole point; `range` is recorded-media seeking; the `trpc-*` / `x-trpc-*`
@@ -56,25 +47,25 @@ exports.CORS_ALLOWED_METHODS = 'GET, HEAD, POST, PUT, PATCH, DELETE, OPTIONS';
  * the cookie→bearer exchange is a same-origin mechanism and a cross-origin
  * page has no business asking for it.
  */
-exports.CORS_ALLOWED_HEADERS = 'authorization, content-type, range, if-range, if-none-match, cache-control, trpc-accept, x-trpc-source, x-trpc-batch-mode';
+export const CORS_ALLOWED_HEADERS = 'authorization, content-type, range, if-range, if-none-match, cache-control, trpc-accept, x-trpc-source, x-trpc-batch-mode';
 /**
  * Response headers a cross-origin script may read. The byte-range trio is
  * recorded playback (a seek reads `content-range`); `content-disposition` is
  * export downloads; `retry-after` is the rate limiter; the `x-camstack-*`
  * trio is the clip-still contract (a 204 that says WHY there is no image).
  */
-exports.CORS_EXPOSED_HEADERS = 'content-range, accept-ranges, content-length, content-disposition, etag, retry-after, x-camstack-reason, x-camstack-reason-code, x-camstack-disposition';
+export const CORS_EXPOSED_HEADERS = 'content-range, accept-ranges, content-length, content-disposition, etag, retry-after, x-camstack-reason, x-camstack-reason-code, x-camstack-disposition';
 /** Preflight cache. Chromium caps at 7200 s; Firefox honours up to 86400. */
-exports.CORS_PREFLIGHT_MAX_AGE_SEC = 7200;
+export const CORS_PREFLIGHT_MAX_AGE_SEC = 7200;
 /**
  * The canonical serialisation of an origin (`scheme://host[:port]`, lower
  * case, default port dropped), or `null` when `raw` is not an http(s) origin.
  * `null` (the opaque origin) is accepted verbatim.
  */
-function normalizeOrigin(raw) {
+export function normalizeOrigin(raw) {
     const trimmed = raw.trim();
-    if (trimmed === exports.OPAQUE_ORIGIN)
-        return exports.OPAQUE_ORIGIN;
+    if (trimmed === OPAQUE_ORIGIN)
+        return OPAQUE_ORIGIN;
     let url;
     try {
         url = new URL(trimmed);
@@ -94,7 +85,7 @@ function normalizeOrigin(raw) {
     return url.origin;
 }
 /** Read the configured value (array from YAML, already split from env). */
-function parseConfiguredOrigins(value) {
+export function parseConfiguredOrigins(value) {
     if (!Array.isArray(value))
         return { origins: [], rejected: [] };
     const origins = [];
@@ -113,8 +104,8 @@ function parseConfiguredOrigins(value) {
     return { origins, rejected };
 }
 /** The built-in entries. */
-function builtInOrigins() {
-    return [exports.VIEWER_PWA_ORIGIN, exports.OPAQUE_ORIGIN];
+export function builtInOrigins() {
+    return [VIEWER_PWA_ORIGIN, OPAQUE_ORIGIN];
 }
 /** The first value of a possibly comma-joined forwarding header, lower case. */
 function firstHost(value) {
@@ -125,7 +116,7 @@ function firstHost(value) {
 }
 /** `host[:port]` of an http(s) origin, or null. */
 function hostOfOrigin(origin) {
-    if (origin === exports.OPAQUE_ORIGIN)
+    if (origin === OPAQUE_ORIGIN)
         return null;
     try {
         return new URL(origin).host.toLowerCase();
@@ -138,7 +129,7 @@ function hostOfOrigin(origin) {
  * Judge one request's `Origin`. `listed` is the full allowlist (built-ins and
  * the operator's extras), already normalised.
  */
-function judgeCorsOrigin(facts, listed) {
+export function judgeCorsOrigin(facts, listed) {
     const raw = facts.origin;
     if (raw === undefined || raw.length === 0)
         return { kind: 'no-origin' };
@@ -162,25 +153,25 @@ function judgeCorsOrigin(facts, listed) {
  * page, and `Vary: Origin` (set by the glue on every response) keeps a cache
  * from serving one origin's answer to another.
  */
-function corsResponseHeaders(origin, preflight) {
+export function corsResponseHeaders(origin, preflight) {
     const base = {
         'access-control-allow-origin': origin,
-        'access-control-expose-headers': exports.CORS_EXPOSED_HEADERS,
+        'access-control-expose-headers': CORS_EXPOSED_HEADERS,
     };
     if (preflight === null)
         return base;
     return {
         ...base,
-        'access-control-allow-methods': exports.CORS_ALLOWED_METHODS,
-        'access-control-allow-headers': exports.CORS_ALLOWED_HEADERS,
-        'access-control-max-age': String(exports.CORS_PREFLIGHT_MAX_AGE_SEC),
+        'access-control-allow-methods': CORS_ALLOWED_METHODS,
+        'access-control-allow-headers': CORS_ALLOWED_HEADERS,
+        'access-control-max-age': String(CORS_PREFLIGHT_MAX_AGE_SEC),
         // A public origin (the PWA) calling a LAN hub is a "private network"
         // request to Chromium; its preflight must be answered explicitly.
         ...(preflight.requestPrivateNetwork ? { 'access-control-allow-private-network': 'true' } : {}),
     };
 }
 /** Append `token` to a `Vary` value unless it is already there. */
-function appendVary(existing, token) {
+export function appendVary(existing, token) {
     if (existing === undefined || existing.trim().length === 0)
         return token;
     const parts = existing.split(',').map((p) => p.trim().toLowerCase());

package/dist/api/cors/register-cors-policy.js

@@ -1,9 +1,4 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createCorsPolicy = createCorsPolicy;
-exports.registerCorsPolicy = registerCorsPolicy;
-exports.refuseForeignWsUpgrade = refuseForeignWsUpgrade;
-const cors_policy_js_1 = require("./cors-policy.js");
+import { appendVary, builtInOrigins, corsResponseHeaders, judgeCorsOrigin, parseConfiguredOrigins, } from './cors-policy.js';
 /** Distinct refused origins remembered for log de-duplication. */
 const MAX_LOGGED_DENIALS = 256;
 function headerValue(value) {
@@ -18,8 +13,8 @@ function varyText(value) {
         return value.filter((v) => typeof v === 'string').join(', ');
     return undefined;
 }
-function createCorsPolicy(deps) {
-    const builtIns = (0, cors_policy_js_1.builtInOrigins)();
+export function createCorsPolicy(deps) {
+    const builtIns = builtInOrigins();
     let lastConfigured = Symbol('unset');
     let listed = new Set(builtIns);
     const loggedDenials = new Set();
@@ -28,7 +23,7 @@ function createCorsPolicy(deps) {
         if (configured === lastConfigured)
             return listed;
         lastConfigured = configured;
-        const parsed = (0, cors_policy_js_1.parseConfiguredOrigins)(configured);
+        const parsed = parseConfiguredOrigins(configured);
         if (parsed.rejected.length > 0) {
             deps.logger.warn('cors: ignored configured origins that are not http(s) origins', {
                 meta: { rejected: parsed.rejected, setting: 'server.corsOrigins' },
@@ -39,7 +34,7 @@ function createCorsPolicy(deps) {
     };
     return {
         judge(headers) {
-            const verdict = (0, cors_policy_js_1.judgeCorsOrigin)({
+            const verdict = judgeCorsOrigin({
                 origin: headerValue(headers.origin),
                 host: headerValue(headers.host),
                 forwardedHost: headerValue(headers['x-forwarded-host']),
@@ -64,17 +59,17 @@ function createCorsPolicy(deps) {
  * answered here with 204 (as before D707) — with grants only for an allowed
  * origin, so a refused preflight fails in the browser.
  */
-function registerCorsPolicy(fastify, policy) {
+export function registerCorsPolicy(fastify, policy) {
     fastify.addHook('onRequest', async (request, reply) => {
         // The answer depends on Origin for every route, so every response says so
         // — a cached same-origin answer must never be replayed to another origin.
-        const vary = (0, cors_policy_js_1.appendVary)(varyText(reply.getHeader('vary')), 'Origin');
+        const vary = appendVary(varyText(reply.getHeader('vary')), 'Origin');
         reply.header('vary', vary);
         reply.raw.setHeader('vary', vary);
         const verdict = policy.judge(request.headers);
         const isPreflight = request.method === 'OPTIONS' && request.headers['access-control-request-method'] !== undefined;
         if (verdict.kind === 'allowed') {
-            const headers = (0, cors_policy_js_1.corsResponseHeaders)(verdict.origin, isPreflight
+            const headers = corsResponseHeaders(verdict.origin, isPreflight
                 ? {
                     requestPrivateNetwork: headerValue(request.headers['access-control-request-private-network']) === 'true',
                 }
@@ -99,7 +94,7 @@ function registerCorsPolicy(fastify, policy) {
  * Node client, an agent) passes — Origin is the browser's signal, and auth is
  * the bearer in `connectionParams` either way.
  */
-function refuseForeignWsUpgrade(policy, headers, socket) {
+export function refuseForeignWsUpgrade(policy, headers, socket) {
     const verdict = policy.judge(headers);
     if (verdict.kind !== 'denied')
         return false;

package/dist/api/deploy-stage-registry.js

@@ -1,13 +1,10 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.DeployStageRegistry = void 0;
-const node_crypto_1 = require("node:crypto");
+import { createHash, randomUUID, timingSafeEqual } from 'node:crypto';
 /**
  * In-memory, single-use, TTL-bounded store of staged addon tarballs the hub
  * serves to agents over HTTP. One entry per deploy target; the token is
  * consumed on the first successful read so a bundle URL is never reusable.
  */
-class DeployStageRegistry {
+export class DeployStageRegistry {
     entries = new Map();
     ttlMs;
     now;
@@ -18,9 +15,9 @@ class DeployStageRegistry {
     stage(buffer) {
         // Reclaim abandoned (never-consumed) entries before inserting a new one.
         this.sweepExpired();
-        const id = (0, node_crypto_1.randomUUID)();
-        const token = (0, node_crypto_1.randomUUID)();
-        const sha256 = (0, node_crypto_1.createHash)('sha256').update(buffer).digest('hex');
+        const id = randomUUID();
+        const token = randomUUID();
+        const sha256 = createHash('sha256').update(buffer).digest('hex');
         this.entries.set(id, { token, buffer, sha256, expiresAt: this.now() + this.ttlMs });
         return { id, token, sha256, bytes: buffer.length };
     }
@@ -35,7 +32,7 @@ class DeployStageRegistry {
         // Constant-time comparison: different byte lengths → not equal (no timing oracle).
         const entryBuf = Buffer.from(entry.token);
         const tokenBuf = Buffer.from(token);
-        if (entryBuf.length !== tokenBuf.length || !(0, node_crypto_1.timingSafeEqual)(entryBuf, tokenBuf))
+        if (entryBuf.length !== tokenBuf.length || !timingSafeEqual(entryBuf, tokenBuf))
             return null;
         this.entries.delete(id); // single-use
         return entry.buffer;
@@ -57,4 +54,3 @@ class DeployStageRegistry {
                 this.entries.delete(id);
     }
 }
-exports.DeployStageRegistry = DeployStageRegistry;