@camstack/server 1.2.592 → 1.2.594

package/dist/api/server-upload-propagate.js

@@ -1,39 +1,3 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.registerServerUploadPropagateRoute = registerServerUploadPropagateRoute;
 /**
  * POST /api/server-upload/propagate — deliver an already-uploaded
  * `dev-uploads/<version>/` set from the hub onto one agent, then leave
@@ -42,13 +6,13 @@ exports.registerServerUploadPropagateRoute = registerServerUploadPropagateRoute;
  * Mirrors addon fan-out: pack the version dir → stage one-shot hub-http
  * ticket → `$agent.stageDevUploads`. Does NOT promote the closure.
  */
-const fs = __importStar(require("node:fs"));
-const path = __importStar(require("node:path"));
-const agent_addon_delivery_js_1 = require("./agent-addon-delivery.js");
-const addon_upload_js_1 = require("./addon-upload.js");
-const dev_uploads_bundle_js_1 = require("./dev-uploads-bundle.js");
-const upload_auth_js_1 = require("./upload-auth.js");
-const index_js_1 = require("../server-root/index.js");
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { AGENT_DEPLOY_CONTROL_TIMEOUT_MS, } from './agent-addon-delivery.js';
+import { buildHubHttpSource } from './addon-upload.js';
+import { isSafeDevUploadVersion, packDevUploadVersionDir } from './dev-uploads-bundle.js';
+import { authorizeUploadRequest, } from './upload-auth.js';
+import { devUploadVersionDir, readDevUploadManifest, serverRootDir } from '../server-root/index.js';
 function isStageResponse(value) {
     if (value === null || typeof value !== 'object')
         return false;
@@ -70,7 +34,7 @@ function readBody(value) {
             error: 'nodeId must be a top-level agent id (not "hub" and not a child runner id)',
         };
     }
-    if (!(0, dev_uploads_bundle_js_1.isSafeDevUploadVersion)(body.version)) {
+    if (!isSafeDevUploadVersion(body.version)) {
         return {
             error: `Refused: version "${body.version}" is not a safe dev-channel version ` +
                 '(expected `<base>-dev.<epochSeconds>`)',
@@ -78,10 +42,10 @@ function readBody(value) {
     }
     return { version: body.version, nodeId: body.nodeId };
 }
-function registerServerUploadPropagateRoute(fastify, options) {
+export function registerServerUploadPropagateRoute(fastify, options) {
     const { authService, addonRegistry, logger, broker, resolveClusterBaseUrl } = options;
     fastify.post('/api/server-upload/propagate', async (request, reply) => {
-        const auth = await (0, upload_auth_js_1.authorizeUploadRequest)({
+        const auth = await authorizeUploadRequest({
             authHeader: request.headers.authorization,
             authService,
             addonRegistry,
@@ -95,14 +59,14 @@ function registerServerUploadPropagateRoute(fastify, options) {
         }
         const { version, nodeId } = parsed;
         const dataDir = path.resolve(options.dataDir ?? process.env['CAMSTACK_DATA'] ?? 'camstack-data');
-        const versionDir = (0, index_js_1.devUploadVersionDir)((0, index_js_1.serverRootDir)(dataDir), version);
+        const versionDir = devUploadVersionDir(serverRootDir(dataDir), version);
         if (!fs.existsSync(versionDir)) {
             return reply.status(404).send({
                 error: `No hub-side upload for ${version} at ${versionDir}. ` +
                     'Upload first with `camstack deploy-server` (POST /api/server-upload).',
             });
         }
-        const manifest = (0, index_js_1.readDevUploadManifest)(versionDir);
+        const manifest = readDevUploadManifest(versionDir);
         if (manifest === null) {
             return reply.status(400).send({
                 error: `Hub upload for ${version} has a missing or invalid manifest.json`,
@@ -122,8 +86,8 @@ function registerServerUploadPropagateRoute(fastify, options) {
         let bundle;
         let source;
         try {
-            bundle = await (0, dev_uploads_bundle_js_1.packDevUploadVersionDir)(versionDir);
-            source = (0, addon_upload_js_1.buildHubHttpSource)(bundle, hubBaseUrl);
+            bundle = await packDevUploadVersionDir(versionDir);
+            source = buildHubHttpSource(bundle, hubBaseUrl);
         }
         catch (err) {
             const message = err instanceof Error ? err.message : String(err);
@@ -133,7 +97,7 @@ function registerServerUploadPropagateRoute(fastify, options) {
             return reply.status(500).send({ error: `Failed to stage upload pack: ${message}` });
         }
         try {
-            const raw = await broker.call('$agent.stageDevUploads', { version, source }, { nodeID: nodeId, timeout: agent_addon_delivery_js_1.AGENT_DEPLOY_CONTROL_TIMEOUT_MS });
+            const raw = await broker.call('$agent.stageDevUploads', { version, source }, { nodeID: nodeId, timeout: AGENT_DEPLOY_CONTROL_TIMEOUT_MS });
             if (!isStageResponse(raw) || raw.success !== true) {
                 logger.warn('server-upload propagate: malformed agent response', {
                     meta: { version, nodeId },

package/dist/api/server-upload.js

@@ -1,40 +1,3 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.validateTarballSet = validateTarballSet;
-exports.registerServerUploadRoute = registerServerUploadRoute;
 /**
  * POST /api/server-upload — the dev server-deploy channel's upload gateway.
  *
@@ -60,11 +23,11 @@ exports.registerServerUploadRoute = registerServerUploadRoute;
  * the instance (done by `registerAddonUploadRoute`) — this route only adds
  * the handler.
  */
-const fs = __importStar(require("node:fs"));
-const path = __importStar(require("node:path"));
-const index_js_1 = require("../server-root/index.js");
-const tarball_manifest_js_1 = require("./tarball-manifest.js");
-const upload_auth_js_1 = require("./upload-auth.js");
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { devUploadVersionDir, isDevChannelVersion, serverRootDir, writeDevUploadManifest, } from '../server-root/index.js';
+import { isTarballFilename, readTarballManifest } from './tarball-manifest.js';
+import { authorizeUploadRequest, } from './upload-auth.js';
 /**
  * Version chars beyond the dev-channel shape check: strictly semver-ish
  * (alnum, dots, dashes) so the version can never traverse out of
@@ -91,17 +54,17 @@ function flattenedTgzName(packageName) {
  * is derived server-side from the validated PACKAGE name — a client
  * filename never becomes a filesystem path.
  */
-function validateTarballSet(files, version) {
+export function validateTarballSet(files, version) {
     const seen = new Set();
     const validated = [];
     for (const file of files) {
         if (hasPathTraversal(file.filename)) {
             return { error: `Refused: filename contains path separators (${file.filename})` };
         }
-        if (!(0, tarball_manifest_js_1.isTarballFilename)(file.filename)) {
+        if (!isTarballFilename(file.filename)) {
             return { error: `Refused: ${file.filename} is not a .tgz/.tar.gz archive` };
         }
-        const manifest = (0, tarball_manifest_js_1.readTarballManifest)(file.buffer, file.filename);
+        const manifest = readTarballManifest(file.buffer, file.filename);
         if (manifest === null) {
             return {
                 error: `Refused: ${file.filename} is missing or has a malformed package/package.json`,
@@ -126,10 +89,10 @@ function validateTarballSet(files, version) {
     }
     return validated;
 }
-function registerServerUploadRoute(fastify, options) {
+export function registerServerUploadRoute(fastify, options) {
     const { authService, addonRegistry, logger } = options;
     fastify.post('/api/server-upload', async (request, reply) => {
-        const auth = await (0, upload_auth_js_1.authorizeUploadRequest)({
+        const auth = await authorizeUploadRequest({
             authHeader: request.headers.authorization,
             authService,
             addonRegistry,
@@ -152,7 +115,7 @@ function registerServerUploadRoute(fastify, options) {
         if (version === null || version.length === 0) {
             return reply.status(400).send({ error: 'Missing "version" field' });
         }
-        if (!SAFE_VERSION_RE.test(version) || !(0, index_js_1.isDevChannelVersion)(version)) {
+        if (!SAFE_VERSION_RE.test(version) || !isDevChannelVersion(version)) {
             return reply.status(400).send({
                 error: `Refused: version "${version}" is not dev-channel shaped — this route only ` +
                     'accepts `<base>-dev.<epochSeconds>` versions produced by `camstack deploy-server`.',
@@ -167,7 +130,7 @@ function registerServerUploadRoute(fastify, options) {
             return reply.status(400).send({ error: validated.error });
         }
         const dataDir = path.resolve(options.dataDir ?? process.env['CAMSTACK_DATA'] ?? 'camstack-data');
-        const versionDir = (0, index_js_1.devUploadVersionDir)((0, index_js_1.serverRootDir)(dataDir), version);
+        const versionDir = devUploadVersionDir(serverRootDir(dataDir), version);
         fs.mkdirSync(versionDir, { recursive: true });
         const packages = {};
         for (const pkg of validated) {
@@ -175,7 +138,7 @@ function registerServerUploadRoute(fastify, options) {
             fs.writeFileSync(path.join(versionDir, tgzName), pkg.buffer);
             packages[pkg.name] = tgzName;
         }
-        (0, index_js_1.writeDevUploadManifest)(versionDir, { version, packages });
+        writeDevUploadManifest(versionDir, { version, packages });
         logger.info('server-upload stored dev closure', {
             meta: { version, packages: Object.keys(packages), dir: versionDir },
         });

package/dist/api/sse-no-compression.js

@@ -1,8 +1,5 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.markSseRequestNoCompression = markSseRequestNoCompression;
 /** Mutates the request headers in place; returns whether it marked the request. */
-function markSseRequestNoCompression(request) {
+export function markSseRequestNoCompression(request) {
     const accept = request.headers.accept;
     if (typeof accept === 'string' && accept.includes('text/event-stream')) {
         request.headers['x-no-compression'] = '1';

package/dist/api/static/frame-policy.js

@@ -1,13 +1,8 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.FRAME_ANCESTORS_POLICY = void 0;
-exports.isFramePolicyTarget = isFramePolicyTarget;
-exports.registerFramePolicy = registerFramePolicy;
 /** The one directive: frame me from my origin only. */
-exports.FRAME_ANCESTORS_POLICY = "frame-ancestors 'self'";
+export const FRAME_ANCESTORS_POLICY = "frame-ancestors 'self'";
 const CSP_HEADER = 'content-security-policy';
 /** Only a document can be framed; assets, JSON and streams are never one. */
-function isFramePolicyTarget(contentType) {
+export function isFramePolicyTarget(contentType) {
     return typeof contentType === 'string' && contentType.trim().toLowerCase().startsWith('text/html');
 }
 /**
@@ -16,13 +11,13 @@ function isFramePolicyTarget(contentType) {
  * reverse proxy's streaming path) are not seen here; they carry no HTML
  * shell of ours.
  */
-function registerFramePolicy(fastify) {
+export function registerFramePolicy(fastify) {
     fastify.addHook('onSend', async (_request, reply, payload) => {
         if (!isFramePolicyTarget(reply.getHeader('content-type')))
             return payload;
         if (reply.getHeader(CSP_HEADER) !== undefined)
             return payload;
-        reply.header(CSP_HEADER, exports.FRAME_ANCESTORS_POLICY);
+        reply.header(CSP_HEADER, FRAME_ANCESTORS_POLICY);
         return payload;
     });
 }

package/dist/api/static/precompressed-asset.js

@@ -1,4 +1,3 @@
-"use strict";
 /**
  * Brotli-compressed copies of static SPA assets, cached on disk.
  *
@@ -17,53 +16,12 @@
  * The first request for a given file still pays the compression, exactly as
  * every request does today. Every request after it pays nothing.
  */
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.acceptsBrotli = acceptsBrotli;
-exports.isCompressibleAsset = isCompressibleAsset;
-exports.resolvePrecompressedAsset = resolvePrecompressedAsset;
-exports.warmPrecompressedAssets = warmPrecompressedAssets;
-exports.resetPrecompressedWarning = resetPrecompressedWarning;
-exports.precompressedTempPath = precompressedTempPath;
-exports.precompressedSiblingExists = precompressedSiblingExists;
-const fs = __importStar(require("node:fs"));
-const fsp = __importStar(require("node:fs/promises"));
-const path = __importStar(require("node:path"));
-const node_zlib_1 = require("node:zlib");
-const node_util_1 = require("node:util");
-const brotli = (0, node_util_1.promisify)(node_zlib_1.brotliCompress);
+import * as fs from 'node:fs';
+import * as fsp from 'node:fs/promises';
+import * as path from 'node:path';
+import { brotliCompress, constants as zlibConstants } from 'node:zlib';
+import { promisify } from 'node:util';
+const brotli = promisify(brotliCompress);
 /** Below this, the framing costs more than the compression saves — the same
  *  threshold `@fastify/compress` is registered with. */
 const MIN_BYTES = 1024;
@@ -77,12 +35,12 @@ const inFlight = new Map();
  *  error to repeat on every asset. */
 let warnedUnwritable = false;
 /** Does the client accept brotli? */
-function acceptsBrotli(acceptEncoding) {
+export function acceptsBrotli(acceptEncoding) {
     if (acceptEncoding === undefined)
         return false;
     return /\bbr\b/.test(acceptEncoding);
 }
-function isCompressibleAsset(relOrAbs) {
+export function isCompressibleAsset(relOrAbs) {
     return COMPRESSIBLE.test(relOrAbs);
 }
 /**
@@ -108,8 +66,8 @@ async function compressToDisk(filePath, brPath, log) {
             params: {
                 // Quality 11 is worth it BECAUSE this runs once. The per-request path
                 // could never afford it, which is why it was set to 4.
-                [node_zlib_1.constants.BROTLI_PARAM_QUALITY]: 11,
-                [node_zlib_1.constants.BROTLI_PARAM_SIZE_HINT]: raw.byteLength,
+                [zlibConstants.BROTLI_PARAM_QUALITY]: 11,
+                [zlibConstants.BROTLI_PARAM_SIZE_HINT]: raw.byteLength,
             },
         });
         // Write via a temp file + rename so a concurrent reader never sees a
@@ -142,7 +100,7 @@ async function compressToDisk(filePath, brPath, log) {
  * cache could not be written. The caller then serves exactly what it served
  * before, so this can only ever be an optimisation.
  */
-async function resolvePrecompressedAsset(filePath, acceptEncoding, log) {
+export async function resolvePrecompressedAsset(filePath, acceptEncoding, log) {
     const plain = { filePath, encoding: null };
     if (!acceptsBrotli(acceptEncoding) || !isCompressibleAsset(filePath))
         return plain;
@@ -183,7 +141,7 @@ async function resolvePrecompressedAsset(filePath, acceptEncoding, log) {
  * a page load faster would be a bad trade. Failures are silent here — the
  * request path logs them if it ever hits one.
  */
-function warmPrecompressedAssets(root, log) {
+export function warmPrecompressedAssets(root, log) {
     void (async () => {
         let warmed = 0;
         for (const file of await listCompressible(root)) {
@@ -213,7 +171,7 @@ async function listCompressible(dir, out = []) {
     return out;
 }
 /** Test seam — the "read-only dist" warning is once per process. */
-function resetPrecompressedWarning() {
+export function resetPrecompressedWarning() {
     warnedUnwritable = false;
 }
 /**
@@ -222,10 +180,10 @@ function resetPrecompressedWarning() {
  * root, which is what CI runs as, and the test that relied on it produced a
  * `.br` in a "read-only" directory (2026-09-23).
  */
-function precompressedTempPath(brPath) {
+export function precompressedTempPath(brPath) {
     return `${brPath}.${String(process.pid)}.tmp`;
 }
 /** Synchronous existence probe used by the callers' own guards. */
-function precompressedSiblingExists(filePath) {
+export function precompressedSiblingExists(filePath) {
     return fs.existsSync(`${filePath}.br`);
 }

package/dist/api/static/spa-mount.js

@@ -1,42 +1,3 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.FORWARDED_PREFIX_HEADER = void 0;
-exports.parseForwardedPrefix = parseForwardedPrefix;
-exports.injectSpaMount = injectSpaMount;
-exports.sendSpaShell = sendSpaShell;
 /**
  * spa-mount — serving the admin-UI shell under a reverse-proxy path prefix.
  *
@@ -54,10 +15,10 @@ exports.sendSpaShell = sendSpaShell;
  *
  * Without the header nothing changes — the shell is served exactly as before.
  */
-const fs = __importStar(require("node:fs/promises"));
-const spa_static_1 = require("./spa-static");
+import * as fs from 'node:fs/promises';
+import { spaShellCacheControl } from './spa-static';
 /** Node lower-cases incoming header names. */
-exports.FORWARDED_PREFIX_HEADER = 'x-forwarded-prefix';
+export const FORWARDED_PREFIX_HEADER = 'x-forwarded-prefix';
 /** The canonical spelling, for `Vary`. */
 const FORWARDED_PREFIX_VARY = 'X-Forwarded-Prefix';
 const MOUNT_META_NAME = 'camstack-mount';
@@ -73,7 +34,7 @@ const MAX_PREFIX_LENGTH = 512;
  * an attribute. Invalid is treated as absent — a relay that gets this wrong
  * gets the root shell, never a 4xx and never a partial injection.
  */
-function parseForwardedPrefix(value) {
+export function parseForwardedPrefix(value) {
     if (typeof value !== 'string')
         return null;
     if (value.length === 0 || value.length > MAX_PREFIX_LENGTH)
@@ -100,7 +61,7 @@ function parseForwardedPrefix(value) {
  * relative build shipped, and only the root worked (operator, 2026-09-07).
  * A root mount is therefore `<base href="/">`, not "no base at all".
  */
-function injectSpaMount(html, prefix) {
+export function injectSpaMount(html, prefix) {
     const match = /<head(?:\s[^>]*)?>/i.exec(html);
     if (match === null)
         return html;
@@ -114,8 +75,8 @@ function injectSpaMount(html, prefix) {
  * `Vary: X-Forwarded-Prefix` — a cache that ignores `no-store` must still
  * never hand a root shell to a relayed request or vice versa.
  */
-async function sendSpaShell(reply, indexPath, headers) {
-    reply.header('cache-control', (0, spa_static_1.spaShellCacheControl)());
+export async function sendSpaShell(reply, indexPath, headers) {
+    reply.header('cache-control', spaShellCacheControl());
     reply.header('vary', FORWARDED_PREFIX_VARY);
     let html;
     try {
@@ -127,6 +88,6 @@ async function sendSpaShell(reply, indexPath, headers) {
     }
     // `''` is the root mount: `injectSpaMount` writes `<base href="/">`, which a
     // relative-asset shell needs at every depth. Never "no base".
-    const prefix = parseForwardedPrefix(headers[exports.FORWARDED_PREFIX_HEADER]) ?? '';
+    const prefix = parseForwardedPrefix(headers[FORWARDED_PREFIX_HEADER]) ?? '';
     return reply.type('text/html').send(injectSpaMount(html, prefix));
 }

package/dist/api/static/spa-static.js

@@ -1,4 +1,3 @@
-"use strict";
 /**
  * spa-static — shared static-serving helpers for the SPAs the hub mounts
  * (admin-ui at `/`, viewer-ui at `/viewer/camstack`). Extracted so both
@@ -6,12 +5,6 @@
  * immutable; the service worker / registration / web manifest + the SPA shell
  * (`index.html`) always revalidate so a redeploy actually reaches clients.
  */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.spaShellCacheControl = spaShellCacheControl;
-exports.spaAssetCacheControl = spaAssetCacheControl;
-exports.addonBundleCacheControl = addonBundleCacheControl;
-exports.contentTypeForPath = contentTypeForPath;
-exports.isRetiredPublicPath = isRetiredPublicPath;
 /**
  * Cache-Control for the SPA SHELL (`index.html`) — the HTML entry only, never a
  * hashed asset.
@@ -29,7 +22,7 @@ exports.isRetiredPublicPath = isRetiredPublicPath;
  * send the shell with NO header at all, which is where the stale copies came
  * from.
  */
-function spaShellCacheControl() {
+export function spaShellCacheControl() {
     return 'no-store';
 }
 /**
@@ -44,7 +37,7 @@ function spaShellCacheControl() {
  *     so the same bytes never carry two different policies.
  *   - Everything else (favicon, non-hashed files) → `no-cache`.
  */
-function spaAssetCacheControl(rel) {
+export function spaAssetCacheControl(rel) {
     const base = rel.split('/').pop() ?? rel;
     if (/^(sw\.js|registerSW\.js|workbox-.*\.js|manifest\.webmanifest)$/.test(base)) {
         return 'no-cache, must-revalidate';
@@ -73,7 +66,7 @@ function spaAssetCacheControl(rel) {
  * until a manual hard-reload. Unknown fixed names now revalidate — the
  * cost is a cheap 304.
  */
-function addonBundleCacheControl(filePath) {
+export function addonBundleCacheControl(filePath) {
     const base = filePath.split('/').pop() ?? filePath;
     // Vite/rolldown content hash: exactly 8 base64url chars between a
     // hyphen and the extension (`dist-CYZr2fwk.mjs`, `….js-CQ-aEQ9b.mjs`).
@@ -114,14 +107,14 @@ const CONTENT_TYPES = {
  * assets directly (the admin-ui path goes through @fastify/static). Defaults
  * to `application/octet-stream` for unknown extensions.
  */
-function contentTypeForPath(pathname) {
+export function contentTypeForPath(pathname) {
     const base = pathname.split('/').pop() ?? pathname;
     const dot = base.lastIndexOf('.');
     const ext = dot >= 0 ? base.slice(dot + 1).toLowerCase() : '';
     return CONTENT_TYPES[ext] ?? 'application/octet-stream';
 }
 /** Paths intentionally retired instead of falling through to the admin SPA. */
-function isRetiredPublicPath(url) {
+export function isRetiredPublicPath(url) {
     const pathname = url.split('?')[0] ?? url;
     return (pathname === '/addon/stream-broker/embed' || pathname.startsWith('/addon/stream-broker/embed/'));
 }

package/dist/api/tarball-manifest.js

@@ -1,51 +1,14 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.isTarballFilename = isTarballFilename;
-exports.readTarballManifest = readTarballManifest;
 /**
  * npm-pack tarball manifest inspection — shared by the addon upload route
  * (`/api/addons/upload`) and the dev server-deploy upload route
  * (`/api/server-upload`).
  */
-const node_child_process_1 = require("node:child_process");
-const fs = __importStar(require("node:fs"));
-const os = __importStar(require("node:os"));
-const path = __importStar(require("node:path"));
+import { execFileSync } from 'node:child_process';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
 const TARBALL_EXTENSIONS = ['.tgz', '.tar.gz'];
-function isTarballFilename(filename) {
+export function isTarballFilename(filename) {
     return TARBALL_EXTENSIONS.some((ext) => filename.endsWith(ext));
 }
 /**
@@ -60,12 +23,12 @@ function isTarballFilename(filename) {
  * fixed inner path. Returns null (not throw) on malformed archives so
  * the caller can surface a precise 400 response.
  */
-function readTarballManifest(buffer, filename) {
+export function readTarballManifest(buffer, filename) {
     const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'camstack-tarball-check-'));
     const tgzPath = path.join(tmpDir, path.basename(filename));
     try {
         fs.writeFileSync(tgzPath, buffer);
-        const output = (0, node_child_process_1.execFileSync)('tar', ['-xzO', '-f', tgzPath, 'package/package.json'], {
+        const output = execFileSync('tar', ['-xzO', '-f', tgzPath, 'package/package.json'], {
             timeout: 5_000,
             stdio: ['ignore', 'pipe', 'ignore'],
         });