@camstack/server 1.2.592 → 1.2.594

package/dist/api/trpc/http-request-census-hook.js

@@ -1,4 +1,3 @@
-"use strict";
 /**
  * The seam that feeds {@link HttpRequestCensus} from a live tRPC request.
  *
@@ -26,11 +25,9 @@
  * ever moves below a field access, that test fails instead of the hub paying
  * for a diagnostic nobody switched on.
  */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.recordTrpcHttpRequest = recordTrpcHttpRequest;
-const client_ip_js_1 = require("./client-ip.js");
-const http_request_census_js_1 = require("./http-request-census.js");
-const trpc_error_principal_js_1 = require("./trpc-error-principal.js");
+import { extractClientIp, extractUserAgent } from './client-ip.js';
+import { parseTrpcProcedures } from './http-request-census.js';
+import { describeTrpcPrincipal } from './trpc-error-principal.js';
 /**
  * Count one tRPC HTTP request against `census`.
  *
@@ -38,20 +35,20 @@ const trpc_error_principal_js_1 = require("./trpc-error-principal.js");
  * `describeTrpcPrincipal`, the same function the tRPC error log already uses -
  * a username and a credential KIND, never a token and never a header.
  */
-function recordTrpcHttpRequest(census, req, user) {
+export function recordTrpcHttpRequest(census, req, user) {
     if (!census.armed)
         return;
     if (req === undefined)
         return;
     const url = typeof req.url === 'string' ? req.url : '';
-    const procedures = (0, http_request_census_js_1.parseTrpcProcedures)(url, headerValue(req, 'content-type'));
+    const procedures = parseTrpcProcedures(url, headerValue(req, 'content-type'));
     if (procedures.length === 0)
         return;
     census.observeHttpRequest({
         procedures,
-        userAgent: (0, client_ip_js_1.extractUserAgent)(req),
-        ip: (0, client_ip_js_1.extractClientIp)(req),
-        principal: (0, trpc_error_principal_js_1.describeTrpcPrincipal)(user),
+        userAgent: extractUserAgent(req),
+        ip: extractClientIp(req),
+        principal: describeTrpcPrincipal(user),
     });
 }
 /** First value of a possibly-repeated header, or `null`. */

package/dist/api/trpc/http-request-census.js

@@ -1,4 +1,3 @@
-"use strict";
 /**
  * WHO is calling the hub, and OVER WHICH PLANE - measured at the transport,
  * never inferred.
@@ -105,13 +104,8 @@
  * request. Stale timers are neutralised by a generation counter instead of
  * being cleared, so no timer handle has to be stored or typed.
  */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.HttpRequestCensus = exports.UNKNOWN = exports.PROCEDURE_OVERFLOW = exports.BATCH_OVERFLOW_PROCEDURE = exports.MAX_BATCH_PROCEDURES = exports.USER_AGENT_MAX_CHARS = exports.MAX_PROCEDURES = exports.MAX_GROUPS = exports.MIN_REPORT_EVERY_MS = exports.DEFAULT_REPORT_EVERY_MS = exports.MIN_WINDOW_MS = exports.MAX_WINDOW_MS = exports.TRPC_URL_PREFIX = void 0;
-exports.zeroPlaneCounts = zeroPlaneCounts;
-exports.shortenUserAgent = shortenUserAgent;
-exports.parseTrpcProcedures = parseTrpcProcedures;
 /** Route prefix the tRPC plugin is registered under (`main.ts`). */
-exports.TRPC_URL_PREFIX = '/trpc/';
+export const TRPC_URL_PREFIX = '/trpc/';
 /**
  * Longest window the census may be armed for.
  *
@@ -121,11 +115,11 @@ exports.TRPC_URL_PREFIX = '/trpc/';
  * was already running. Ten minutes is not enough room for a container
  * recreation plus a cold boot.
  */
-exports.MAX_WINDOW_MS = 30 * 60_000;
+export const MAX_WINDOW_MS = 30 * 60_000;
 /** Shortest useful window. Anything below this cannot contain a boot. */
-exports.MIN_WINDOW_MS = 1_000;
+export const MIN_WINDOW_MS = 1_000;
 /** Default cadence of the aggregated report line. */
-exports.DEFAULT_REPORT_EVERY_MS = 30_000;
+export const DEFAULT_REPORT_EVERY_MS = 30_000;
 /**
  * Floor on the report cadence.
  *
@@ -133,7 +127,7 @@ exports.DEFAULT_REPORT_EVERY_MS = 30_000;
  * would be 41 lines a second, which is itself an incident - and a cadence an
  * operator could set to 100 ms would reproduce that with an aggregate.
  */
-exports.MIN_REPORT_EVERY_MS = 5_000;
+export const MIN_REPORT_EVERY_MS = 5_000;
 /**
  * Bound on distinct `(procedure, ua, ip, principal)` groups held in memory.
  *
@@ -142,27 +136,27 @@ exports.MIN_REPORT_EVERY_MS = 5_000;
  * COUNTED, never dropped silently - the totals stay exact, which is what the
  * negative proof rests on.
  */
-exports.MAX_GROUPS = 500;
+export const MAX_GROUPS = 500;
 /**
  * Bound on distinct procedure names. The router's procedure set is closed and
  * far below this; the bound exists so a garbage path cannot grow the map.
  * Names beyond it fold into {@link PROCEDURE_OVERFLOW} rather than vanishing.
  */
-exports.MAX_PROCEDURES = 500;
+export const MAX_PROCEDURES = 500;
 /** User-agent prefix kept in a group key. Full UA strings are long and their
  *  tail is build metadata that splits one client into many rows. */
-exports.USER_AGENT_MAX_CHARS = 80;
+export const USER_AGENT_MAX_CHARS = 80;
 /** Bound on procedures counted from one batched URL. tRPC's own `maxBatchSize`
  *  guards the router; this guards the census against a URL that never reaches
  *  a procedure at all. */
-exports.MAX_BATCH_PROCEDURES = 200;
+export const MAX_BATCH_PROCEDURES = 200;
 /** Synthetic name for batch entries beyond {@link MAX_BATCH_PROCEDURES}. */
-exports.BATCH_OVERFLOW_PROCEDURE = '(batch-overflow)';
+export const BATCH_OVERFLOW_PROCEDURE = '(batch-overflow)';
 /** Synthetic name for procedures beyond {@link MAX_PROCEDURES}. */
-exports.PROCEDURE_OVERFLOW = '(procedure-overflow)';
+export const PROCEDURE_OVERFLOW = '(procedure-overflow)';
 /** Placeholder used when a request carries no such signal. Never blank: an
  *  empty field reads as a logging defect rather than as an absent header. */
-exports.UNKNOWN = 'unknown';
+export const UNKNOWN = 'unknown';
 /** Group-key field separator. A character that cannot appear in a tRPC
  *  procedure path, so two different tuples can never collide into one row. */
 const KEY_SEPARATOR = ' | ';
@@ -173,7 +167,7 @@ const KEY_SEPARATOR = ' | ';
  * this literal fail to compile until it is given a counter. That is what keeps
  * "a plane is never silently absent" from being a comment nobody enforces.
  */
-function zeroPlaneCounts() {
+export function zeroPlaneCounts() {
     return { http: 0, ws: 0, mesh: 0, unknown: 0 };
 }
 /** Frozen view of a mutable plane counter, for the wire. */
@@ -193,15 +187,15 @@ function defaultSchedule(fn, ms) {
  * Exported because the truncation is part of the group KEY: a spec that builds
  * an expected key by hand must use the same rule, or it pins the wrong thing.
  */
-function shortenUserAgent(ua) {
+export function shortenUserAgent(ua) {
     if (ua === null)
-        return exports.UNKNOWN;
+        return UNKNOWN;
     const trimmed = ua.trim();
     if (trimmed.length === 0)
-        return exports.UNKNOWN;
-    if (trimmed.length <= exports.USER_AGENT_MAX_CHARS)
+        return UNKNOWN;
+    if (trimmed.length <= USER_AGENT_MAX_CHARS)
         return trimmed;
-    return `${trimmed.slice(0, exports.USER_AGENT_MAX_CHARS)}~`;
+    return `${trimmed.slice(0, USER_AGENT_MAX_CHARS)}~`;
 }
 /**
  * The procedures one tRPC HTTP request invokes.
@@ -220,15 +214,15 @@ function shortenUserAgent(ua) {
  * Returns `[]` for a URL that is not under the tRPC prefix, and for the bare
  * prefix with no path.
  */
-function parseTrpcProcedures(url, contentType) {
+export function parseTrpcProcedures(url, contentType) {
     const queryAt = url.indexOf('?');
     const pathname = queryAt === -1 ? url : url.slice(0, queryAt);
     const query = queryAt === -1 ? '' : url.slice(queryAt + 1);
-    if (!pathname.startsWith(exports.TRPC_URL_PREFIX))
+    if (!pathname.startsWith(TRPC_URL_PREFIX))
         return [];
     // The plugin route is `/trpc/:path` - one segment. Anything after a further
     // `/` is not part of the procedure path.
-    const rest = pathname.slice(exports.TRPC_URL_PREFIX.length);
+    const rest = pathname.slice(TRPC_URL_PREFIX.length);
     const slashAt = rest.indexOf('/');
     const rawPath = slashAt === -1 ? rest : rest.slice(0, slashAt);
     if (rawPath.length === 0)
@@ -244,14 +238,14 @@ function parseTrpcProcedures(url, contentType) {
         const name = part.trim();
         if (name.length === 0)
             continue;
-        if (out.length >= exports.MAX_BATCH_PROCEDURES) {
+        if (out.length >= MAX_BATCH_PROCEDURES) {
             overflowed = true;
             continue;
         }
         out.push(name);
     }
     if (overflowed)
-        out.push(exports.BATCH_OVERFLOW_PROCEDURE);
+        out.push(BATCH_OVERFLOW_PROCEDURE);
     return out;
 }
 /** `decodeURIComponent` throws on a malformed escape. A garbage path is still
@@ -298,7 +292,7 @@ function hasBatchFlag(query) {
  *
  * Disarmed it is one boolean read at every call site and nothing else.
  */
-class HttpRequestCensus {
+export class HttpRequestCensus {
     now;
     schedule;
     /** The ONLY thing a disarmed request path reads. */
@@ -309,7 +303,7 @@ class HttpRequestCensus {
     armedAt = 0;
     closedAt = 0;
     currentWindowMs = 0;
-    currentReportEveryMs = exports.DEFAULT_REPORT_EVERY_MS;
+    currentReportEveryMs = DEFAULT_REPORT_EVERY_MS;
     httpRequests = 0;
     batchedRequests = 0;
     procedureCalls = 0;
@@ -344,9 +338,9 @@ class HttpRequestCensus {
      * Re-arming CLEARS the counts and restarts the window: two overlapping
      * measurements in one table is a table nobody can divide by a duration.
      */
-    arm(windowMs, reportEveryMs = exports.DEFAULT_REPORT_EVERY_MS) {
-        const clampedWindow = clamp(windowMs, exports.MIN_WINDOW_MS, exports.MAX_WINDOW_MS);
-        const clampedReport = clamp(reportEveryMs, exports.MIN_REPORT_EVERY_MS, clampedWindow);
+    arm(windowMs, reportEveryMs = DEFAULT_REPORT_EVERY_MS) {
+        const clampedWindow = clamp(windowMs, MIN_WINDOW_MS, MAX_WINDOW_MS);
+        const clampedReport = clamp(reportEveryMs, MIN_REPORT_EVERY_MS, clampedWindow);
         this.reset();
         this.generation += 1;
         this.isArmed = true;
@@ -401,7 +395,7 @@ class HttpRequestCensus {
         if (observation.procedures.length === 0)
             return;
         const userAgent = shortenUserAgent(observation.userAgent);
-        const ip = observation.ip ?? exports.UNKNOWN;
+        const ip = observation.ip ?? UNKNOWN;
         const { plane, kind, principal } = observation;
         for (const procedure of observation.procedures) {
             if (kind === 'subscription')
@@ -420,7 +414,7 @@ class HttpRequestCensus {
                     group.calls += 1;
                 continue;
             }
-            if (this.byGroup.size >= exports.MAX_GROUPS) {
+            if (this.byGroup.size >= MAX_GROUPS) {
                 this.unattributedCalls += 1;
                 continue;
             }
@@ -466,7 +460,7 @@ class HttpRequestCensus {
         this.subscriptionStops += count;
     }
     /** Everything the window measured, busiest first. */
-    snapshot(limit = exports.MAX_GROUPS) {
+    snapshot(limit = MAX_GROUPS) {
         const elapsedMs = this.elapsedMs();
         const perMin = (calls) => elapsedMs === 0 ? 0 : Math.round((calls * 60_000) / elapsedMs);
         const procedures = [...this.byProcedure.entries()]
@@ -567,10 +561,10 @@ class HttpRequestCensus {
             bumpCount(existing, plane, kind);
             return;
         }
-        if (this.byProcedure.size >= exports.MAX_PROCEDURES) {
-            const overflow = this.byProcedure.get(exports.PROCEDURE_OVERFLOW) ?? newCount();
+        if (this.byProcedure.size >= MAX_PROCEDURES) {
+            const overflow = this.byProcedure.get(PROCEDURE_OVERFLOW) ?? newCount();
             bumpCount(overflow, plane, kind);
-            this.byProcedure.set(exports.PROCEDURE_OVERFLOW, overflow);
+            this.byProcedure.set(PROCEDURE_OVERFLOW, overflow);
             return;
         }
         const fresh = newCount();
@@ -609,7 +603,6 @@ class HttpRequestCensus {
         }, this.currentReportEveryMs);
     }
 }
-exports.HttpRequestCensus = HttpRequestCensus;
 /** Per-procedure rows carried on one report line. The router's procedure set
  *  is small; this is a guard against a garbage path, not a real cut. */
 const REPORTED_PROCEDURES = 40;

package/dist/api/trpc/http-request-census.singleton.js

@@ -1,4 +1,3 @@
-"use strict";
 /**
  * Process-wide holder for the HTTP request census.
  *
@@ -11,17 +10,14 @@
  * Same idiom as `lifecycle-runner.singleton.ts`, minus the init step: this one
  * has no dependencies, so the first reader creates it disarmed.
  */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.getHttpRequestCensus = getHttpRequestCensus;
-exports.__resetHttpRequestCensusForTests = __resetHttpRequestCensusForTests;
-const http_request_census_js_1 = require("./http-request-census.js");
+import { HttpRequestCensus } from './http-request-census.js';
 let instance = null;
 /** The process-wide census. Created disarmed on first use. */
-function getHttpRequestCensus() {
-    instance ??= new http_request_census_js_1.HttpRequestCensus();
+export function getHttpRequestCensus() {
+    instance ??= new HttpRequestCensus();
     return instance;
 }
 /** Test-only: drop the instance so a spec starts from a disarmed census. */
-function __resetHttpRequestCensusForTests() {
+export function __resetHttpRequestCensusForTests() {
     instance = null;
 }

package/dist/api/trpc/localized-schema-paths.js

@@ -1,6 +1,3 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.LOCALIZED_SCHEMA_PATHS = void 0;
 /**
  * The tRPC methods whose answer carries a settings schema (`ConfigUISchema`
  * or `ConfigUISchemaWithValues`) - the ONLY places the hub swaps a `labelKey`
@@ -11,7 +8,7 @@ exports.LOCALIZED_SCHEMA_PATHS = void 0;
  * A new cap method that returns a schema is added HERE (and nowhere else): a
  * schema served from a path not listed simply stays English.
  */
-exports.LOCALIZED_SCHEMA_PATHS = new Set([
+export const LOCALIZED_SCHEMA_PATHS = new Set([
     'addonSettings.getGlobalSettings',
     'addonSettings.getIntegrationSettings',
     'addonSettings.getDeviceSettings',

package/dist/api/trpc/principal-visibility.js

@@ -1,11 +1,3 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.callerCanViewDevice = callerCanViewDevice;
-exports.isBroadEventViewer = isBroadEventViewer;
-exports.filterViewableDeviceIds = filterViewableDeviceIds;
-exports.hasUnrestrictedDeviceView = hasUnrestrictedDeviceView;
-exports.projectListAllForPrincipal = projectListAllForPrincipal;
-exports.scopedEventVisibility = scopedEventVisibility;
 /**
  * Non-admin principal device visibility — the shared answer to "which cameras
  * may this scoped caller see?", reused by two hotfixes:
@@ -27,10 +19,10 @@ exports.scopedEventVisibility = scopedEventVisibility;
  * Pure module — no tRPC machinery — so the spec exercises it directly (same
  * pattern as `scope-access.ts` / `share-view-access.ts`).
  */
-const system_1 = require("@camstack/system");
-const types_1 = require("@camstack/types");
-const scope_access_js_1 = require("./scope-access.js");
-const share_view_access_js_1 = require("./share-view-access.js");
+import { METHOD_ACCESS_MAP } from '@camstack/system';
+import { resolveViewableDeviceIds } from '@camstack/types';
+import { checkScopeAccess } from './scope-access.js';
+import { projectListAllForDeviceIds } from './share-view-access.js';
 /**
  * Canonical "view this camera" probe. `snapshot.getSnapshot` is a device-scope,
  * `view`-access method every viewer surface needs (the grid-embed cold-start
@@ -40,7 +32,7 @@ const share_view_access_js_1 = require("./share-view-access.js");
  */
 const DEVICE_VIEW_PROBE = 'snapshot.getSnapshot';
 function assertProbeExists() {
-    const meta = system_1.METHOD_ACCESS_MAP[DEVICE_VIEW_PROBE];
+    const meta = METHOD_ACCESS_MAP[DEVICE_VIEW_PROBE];
     if (!meta || meta.capScope !== 'device' || meta.access !== 'view') {
         throw new Error(`principal-visibility: probe '${DEVICE_VIEW_PROBE}' is not a device-scope view method ` +
             `(codegen drift). Pick another canonical camera-view method.`);
@@ -52,8 +44,8 @@ assertProbeExists();
  * `device:[parent]` → child inheritance through the ancestor walk, exactly as
  * the per-camera middleware does.
  */
-function callerCanViewDevice(scopes, deviceId, lookup) {
-    return (0, scope_access_js_1.checkScopeAccess)(scopes, DEVICE_VIEW_PROBE, { deviceId }, lookup).ok;
+export function callerCanViewDevice(scopes, deviceId, lookup) {
+    return checkScopeAccess(scopes, DEVICE_VIEW_PROBE, { deviceId }, lookup).ok;
 }
 /**
  * A scoped principal sees the WHOLE event/telemetry firehose when it holds any
@@ -68,7 +60,7 @@ function callerCanViewDevice(scopes, deviceId, lookup) {
  * does not satisfy) would blank a surface they are entitled to. Availability and
  * security both point the same way here — broad grant, broad stream.
  */
-function isBroadEventViewer(scopes) {
+export function isBroadEventViewer(scopes) {
     return scopes.some((s) => s.type === 'category' && s.access.includes('view'));
 }
 /**
@@ -76,7 +68,7 @@ function isBroadEventViewer(scopes) {
  * share minting: an admin passes `isAdmin` and skips this; a non-admin gets the
  * intersection, and the router refuses when it is empty.
  */
-function filterViewableDeviceIds(scopes, requested, lookup) {
+export function filterViewableDeviceIds(scopes, requested, lookup) {
     return requested.filter((id) => callerCanViewDevice(scopes, id, lookup));
 }
 /** The device identity an event is attributable to, or null when it carries
@@ -104,7 +96,7 @@ function eventDeviceId(evt) {
  * `category:device[view]` grant, or a device grant with an `all` selector.
  * Such a caller enumerates the fleet unprojected, exactly as before.
  */
-function hasUnrestrictedDeviceView(isAdmin, scopes) {
+export function hasUnrestrictedDeviceView(isAdmin, scopes) {
     if (isAdmin)
         return true;
     return scopes.some((s) => s.access.includes('view') &&
@@ -126,11 +118,11 @@ function hasUnrestrictedDeviceView(isAdmin, scopes) {
  *
  * A caller with unrestricted reach is returned the payload untouched.
  */
-function projectListAllForPrincipal(data, isAdmin, scopes, fleet) {
+export function projectListAllForPrincipal(data, isAdmin, scopes, fleet) {
     if (hasUnrestrictedDeviceView(isAdmin, scopes))
         return data;
-    const viewable = (0, types_1.resolveViewableDeviceIds)(scopes, fleet, 'view');
-    return (0, share_view_access_js_1.projectListAllForDeviceIds)(data, viewable);
+    const viewable = resolveViewableDeviceIds(scopes, fleet, 'view');
+    return projectListAllForDeviceIds(data, viewable);
 }
 /**
  * Build the event-stream predicate for a NON-share principal (F0.5).
@@ -144,7 +136,7 @@ function projectListAllForPrincipal(data, isAdmin, scopes, fleet) {
  * Share-view (`csv_*`) principals are NOT handled here — they keep their own,
  * stricter `liveEventInShareScope` filter, applied by the routers first.
  */
-function scopedEventVisibility(user, lookup) {
+export function scopedEventVisibility(user, lookup) {
     if (user.isAdmin)
         return null;
     const scopes = user.scopes ?? [];

package/dist/api/trpc/remote-addon-update-grant.js

@@ -1,4 +1,3 @@
-"use strict";
 /**
  * The scoped grant that lets an agent update an addon on ITS OWN node (D842).
  *
@@ -19,8 +18,6 @@
  *
  * Every decision, allowed or refused, is written to the auth audit trail.
  */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.authorizeRemoteUpdatePackage = authorizeRemoteUpdatePackage;
 function readRequest(input) {
     if (input === null || typeof input !== 'object')
         return null;
@@ -70,7 +67,7 @@ function decide(callerNodeId, input, deps) {
     return { allowed: true, reason: null, detail };
 }
 /** Decide, audit, and return the decision. */
-async function authorizeRemoteUpdatePackage(callerNodeId, input, deps) {
+export async function authorizeRemoteUpdatePackage(callerNodeId, input, deps) {
     const { allowed, reason, detail } = decide(callerNodeId, input, deps);
     await deps.audit({
         action: allowed ? 'agent-addon-update' : 'agent-addon-update-refused',

package/dist/api/trpc/scope-access.js

@@ -1,8 +1,3 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.DEVICE_ENUMERATION_METHODS = void 0;
-exports.referencedDeviceIds = referencedDeviceIds;
-exports.checkScopeAccess = checkScopeAccess;
 /**
  * Pure scope-access matcher.
  *
@@ -29,8 +24,8 @@ exports.checkScopeAccess = checkScopeAccess;
  *      method's required `access` flavour.
  *   4. No matching scope → FORBIDDEN with a human-readable reason.
  */
-const system_1 = require("@camstack/system");
-const types_1 = require("@camstack/types");
+import { METHOD_ACCESS_MAP } from '@camstack/system';
+import { deviceSelectorMatches, METHOD_DEVICE_SELECTORS, scopeInherits } from '@camstack/types';
 /**
  * Pull `deviceId` off a tRPC request input. Device-scope cap methods
  * uniformly take `{deviceId: number, ...}` per the DeviceProxy contract,
@@ -68,13 +63,13 @@ function candidateMetas(deviceId, lookup) {
  *  the device, or — when the grant inherits at this access — a match on an
  *  ancestor. */
 function deviceScopeCovers(scope, access, candidates) {
-    const inherit = (0, types_1.scopeInherits)(scope, access);
+    const inherit = scopeInherits(scope, access);
     return candidates.some((cand, index) => {
         // index 0 is the device itself (always eligible); ancestors only when the
         // grant inherits.
         if (index > 0 && !inherit)
             return false;
-        return (0, types_1.deviceSelectorMatches)(scope.selector, cand);
+        return deviceSelectorMatches(scope.selector, cand);
     });
 }
 /** Render a device selector for the human-readable denial reason. */
@@ -102,7 +97,7 @@ function describeSelector(scope) {
  * one-camera token. The pairing is asserted by
  * `scoped-list-projection.spec.ts`.
  */
-exports.DEVICE_ENUMERATION_METHODS = new Set(['deviceManager.listAll']);
+export const DEVICE_ENUMERATION_METHODS = new Set(['deviceManager.listAll']);
 /**
  * Every deviceId a request NAMES, per the codegen'd
  * {@link METHOD_DEVICE_SELECTORS}. Absent / null / malformed values are
@@ -113,8 +108,8 @@ exports.DEVICE_ENUMERATION_METHODS = new Set(['deviceManager.listAll']);
  * on a device-scoped path has to say WHICH camera
  * (`trpc-error-device-tags.ts`).
  */
-function referencedDeviceIds(path, input) {
-    const fields = types_1.METHOD_DEVICE_SELECTORS[path];
+export function referencedDeviceIds(path, input) {
+    const fields = METHOD_DEVICE_SELECTORS[path];
     if (!fields || input === null || typeof input !== 'object')
         return [];
     const out = [];
@@ -189,8 +184,8 @@ function deviceRefsSatisfied(scopes, path, input, access, lookup) {
     }
     return { ok: true };
 }
-function checkScopeAccess(scopes, path, input, lookup) {
-    const meta = system_1.METHOD_ACCESS_MAP[path];
+export function checkScopeAccess(scopes, path, input, lookup) {
+    const meta = METHOD_ACCESS_MAP[path];
     if (!meta) {
         return { ok: false, reason: `Unknown method '${path}' — codegen drift` };
     }
@@ -226,7 +221,7 @@ function checkScopeAccess(scopes, path, input, lookup) {
                 targetMatches =
                     refs.length > 0
                         ? refs.every((id) => deviceScopeCovers(s, meta.access, candidateMetas(id, lookup)))
-                        : exports.DEVICE_ENUMERATION_METHODS.has(path);
+                        : DEVICE_ENUMERATION_METHODS.has(path);
                 break;
             }
         }

package/dist/api/trpc/server-provided-caps.js

@@ -1,4 +1,3 @@
-"use strict";
 /**
  * The capabilities the SERVER provides — routers mounted from
  * `buildServerProviders` (`trpc.router.ts`) rather than from an addon.
@@ -14,14 +13,11 @@
  *    provided the cap, no addon did, and the bridge list had been copied by
  *    hand before the cap existed.
  */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.ADDON_BACKED_SERVER_CAP_NAMES = exports.HUB_SERVICE_CAP_NAMES = void 0;
-exports.capNameToNamespace = capNameToNamespace;
 /**
  * Caps served by a hub SERVICE. No addon ever registers a provider for them,
  * so a forked runner can reach them only over the `$core-caps` bridge.
  */
-exports.HUB_SERVICE_CAP_NAMES = [
+export const HUB_SERVICE_CAP_NAMES = [
     'network-quality',
     'system',
     'toast',
@@ -37,8 +33,8 @@ exports.HUB_SERVICE_CAP_NAMES = [
  * cap; a resolver miss means the addon is down, not that the bridge should
  * answer — so they are deliberately NOT bridged.
  */
-exports.ADDON_BACKED_SERVER_CAP_NAMES = ['webrtc-session'];
+export const ADDON_BACKED_SERVER_CAP_NAMES = ['webrtc-session'];
 /** kebab-case cap name → the camelCase appRouter namespace it is mounted as. */
-function capNameToNamespace(capName) {
+export function capNameToNamespace(capName) {
     return capName.replace(/-([a-z])/g, (_m, c) => c.toUpperCase());
 }

package/dist/api/trpc/share-view-access.js

@@ -1,11 +1,3 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.SHARE_SCOPE_PROJECTED_METHODS = void 0;
-exports.checkShareViewAccess = checkShareViewAccess;
-exports.projectListAllForShareScope = projectListAllForShareScope;
-exports.projectListAllForDeviceIds = projectListAllForDeviceIds;
-exports.projectShareScopeRows = projectShareScopeRows;
-exports.liveEventInShareScope = liveEventInShareScope;
 /**
  * Methods callable WITHOUT a per-device check — their input carries no
  * deviceId. `live.onEvent` is here because its input is only a category;
@@ -135,7 +127,7 @@ function checkEventsViewAccess(scope, path, input) {
     }
     return { ok: false, reason: `'${path}' is not available to share-view tokens` };
 }
-function checkShareViewAccess(scope, path, input) {
+export function checkShareViewAccess(scope, path, input) {
     if (scope.kind === 'events-view') {
         return checkEventsViewAccess(scope, path, input);
     }
@@ -174,7 +166,7 @@ function checkShareViewAccess(scope, path, input) {
  * onto the whitelisted row (never the raw device — fail closed on fields).
  * Non-array payloads pass through untouched (the route errored upstream).
  */
-function projectListAllForShareScope(data, scope) {
+export function projectListAllForShareScope(data, scope) {
     return projectListAllForDeviceIds(data, new Set(scope.deviceIds));
 }
 /**
@@ -187,7 +179,7 @@ function projectListAllForShareScope(data, scope) {
  * would be two chances to forget `config` — which carries the camera
  * credentials in plaintext.
  */
-function projectListAllForDeviceIds(data, allowed) {
+export function projectListAllForDeviceIds(data, allowed) {
     if (!Array.isArray(data))
         return data;
     const rows = [];
@@ -235,7 +227,7 @@ function projectListAllForDeviceIds(data, allowed) {
  * Anything that is not a row payload passes through untouched (the route
  * errored upstream, and rewriting an error into `[]` would hide it).
  */
-function projectShareScopeRows(data, scope) {
+export function projectShareScopeRows(data, scope) {
     const allowed = new Set(scope.deviceIds);
     const keep = (row) => {
         if (row === null || typeof row !== 'object')
@@ -256,7 +248,7 @@ function projectShareScopeRows(data, scope) {
 /** Paths whose RESPONSE must be cut to the share scope before it leaves the
  *  server. Kept beside the enumeration so a method added to one and forgotten
  *  in the other is visible in a single file. */
-exports.SHARE_SCOPE_PROJECTED_METHODS = new Set([
+export const SHARE_SCOPE_PROJECTED_METHODS = new Set([
     'pipelineAnalytics.listRecentTracks',
     'pipelineAnalytics.listEventKindsBatch',
     'pipelineAnalytics.searchObjectEvents',
@@ -269,7 +261,7 @@ exports.SHARE_SCOPE_PROJECTED_METHODS = new Set([
  *   • `data.deviceId` — addon-sourced per-device telemetry
  *     (e.g. `pipeline.camera-metrics-snapshot`).
  */
-function liveEventInShareScope(evt, allowedDeviceIds) {
+export function liveEventInShareScope(evt, allowedDeviceIds) {
     const sourceId = evt.source?.id;
     if (typeof sourceId === 'number' && allowedDeviceIds.has(sourceId))
         return true;

package/dist/api/trpc/trpc-error-device-tags.js

@@ -1,4 +1,3 @@
-"use strict";
 /**
  * A tRPC error line about a camera has to say WHICH camera.
  *
@@ -21,18 +20,16 @@
  * one call, not N events. `deviceCount` is what tells a reader the line is
  * about a batch rather than a single camera.
  */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.trpcErrorDeviceTags = trpcErrorDeviceTags;
-const scope_access_js_1 = require("./scope-access.js");
+import { referencedDeviceIds } from './scope-access.js';
 /**
  * Device tags for a tRPC error line. Returns `{}` — never a partial or a
  * placeholder id — when the path names no device: a system-scope call is not
  * "about device 0".
  */
-function trpcErrorDeviceTags(path, input) {
+export function trpcErrorDeviceTags(path, input) {
     if (path === undefined)
         return {};
-    const ids = (0, scope_access_js_1.referencedDeviceIds)(path, input);
+    const ids = referencedDeviceIds(path, input);
     const first = ids[0];
     if (first === undefined)
         return {};

package/dist/api/trpc/trpc-error-principal.js

@@ -1,7 +1,3 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.readCredentialIdentity = readCredentialIdentity;
-exports.describeTrpcPrincipal = describeTrpcPrincipal;
 /**
  * Read the credential's self-description off verified claims.
  *
@@ -15,7 +11,7 @@ exports.describeTrpcPrincipal = describeTrpcPrincipal;
  * that a future token type could carry one meaning something else entirely, and
  * mislabelling a principal in a security log is worse than not labelling it.
  */
-function readCredentialIdentity(claims) {
+export function readCredentialIdentity(claims) {
     const kind = Reflect.get(claims, 'kind');
     if (kind !== 'sso-bridge')
         return {};
@@ -38,7 +34,7 @@ function readCredentialIdentity(claims) {
  *   apocaliss92 (oauth-access session=910a6179-…)
  *   apocaliss92 (session)
  */
-function describeTrpcPrincipal(user) {
+export function describeTrpcPrincipal(user) {
     // Never blank: an empty field reads as a logging defect rather than as an
     // unauthenticated request, and the two need different fixes.
     if (!user)