@camstack/server 1.2.592 → 1.2.594

package/dist/auth/device-enroll-proofs.js

@@ -1,40 +1,4 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.DeviceEnrollProofs = exports.DEVICE_ENROLL_PROOF_TTL_MS = void 0;
-const types_1 = require("@camstack/types");
+import { userError } from '@camstack/types';
 /**
  * Step-up proofs for `auth.enrollSelf` (D855).
  *
@@ -46,15 +10,15 @@ const types_1 = require("@camstack/types");
  * `device-enroll`, bound to the user, 5 minutes, single use, kept only as a
  * hash. It replaces no session.
  */
-const crypto = __importStar(require("node:crypto"));
-exports.DEVICE_ENROLL_PROOF_TTL_MS = 5 * 60_000;
+import * as crypto from 'node:crypto';
+export const DEVICE_ENROLL_PROOF_TTL_MS = 5 * 60_000;
 const MAX_PENDING = 1_000;
 function hash(proof) {
     return crypto.createHash('sha256').update(proof).digest('hex');
 }
 /** How long a spent reauth token / claimed session is remembered (past the token's own 5 min). */
 const SPENT_MEMORY_MS = 6 * 60_000;
-class DeviceEnrollProofs {
+export class DeviceEnrollProofs {
     now;
     logger;
     pending = new Map();
@@ -75,9 +39,9 @@ class DeviceEnrollProofs {
     mint(userId) {
         this.prune();
         if (this.pending.size >= MAX_PENDING)
-            throw (0, types_1.userError)('server.step-up-busy', undefined, 'Too many pending step-up proofs');
+            throw userError('server.step-up-busy', undefined, 'Too many pending step-up proofs');
         const proof = `cdp_${crypto.randomBytes(32).toString('base64url')}`;
-        const expiresAt = this.now() + exports.DEVICE_ENROLL_PROOF_TTL_MS;
+        const expiresAt = this.now() + DEVICE_ENROLL_PROOF_TTL_MS;
         this.pending.set(hash(proof), { userId, expiresAt });
         return { proof, expiresAt };
     }
@@ -146,4 +110,3 @@ class DeviceEnrollProofs {
                 this.pending.delete(k);
     }
 }
-exports.DeviceEnrollProofs = DeviceEnrollProofs;

package/dist/auth/external-link-intents.js

@@ -1,6 +1,3 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.ExternalLinkIntents = void 0;
 /**
  * Pending "link this sign-in account" requests (D782).
  *
@@ -15,12 +12,12 @@ exports.ExternalLinkIntents = void 0;
  * Hub-local and in memory on purpose: an intent lives minutes, and a hub
  * restart mid-link costs the user one more click.
  */
-const node_crypto_1 = require("node:crypto");
+import { randomBytes } from 'node:crypto';
 /** Long enough for an IdP login with a password manager; short enough to be useless later. */
 const DEFAULT_TTL_MS = 10 * 60_000;
 /** Bounded: a session minting intents in a loop cannot grow this without limit. */
 const DEFAULT_MAX_ENTRIES = 1_000;
-class ExternalLinkIntents {
+export class ExternalLinkIntents {
     intents = new Map();
     now;
     ttlMs;
@@ -38,7 +35,7 @@ class ExternalLinkIntents {
                 break;
             this.intents.delete(oldest.value);
         }
-        const handle = `li_${(0, node_crypto_1.randomBytes)(24).toString('base64url')}`;
+        const handle = `li_${randomBytes(24).toString('base64url')}`;
         this.intents.set(handle, {
             userId,
             provider,
@@ -69,4 +66,3 @@ class ExternalLinkIntents {
         }
     }
 }
-exports.ExternalLinkIntents = ExternalLinkIntents;

package/dist/auth/hub-sessions.js

@@ -1,9 +1,3 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.userManagementInternal = userManagementInternal;
-exports.createSessionBacking = createSessionBacking;
-exports.sessionBackingFrom = sessionBackingFrom;
-exports.createSessionTokenCheck = createSessionTokenCheck;
 /**
  * The hub's two uses of the login-session table, which `local-auth` owns and
  * reaches only through its hub-internal surface (`UserManagementInternal`):
@@ -16,12 +10,12 @@ exports.createSessionTokenCheck = createSessionTokenCheck;
  * Both resolve `user-management` per call: a hub whose local-auth is not up
  * mints nothing and accepts no session (fail closed).
  */
-const system_1 = require("@camstack/system");
+import { getUserManagementInternal, } from '@camstack/system';
 /** The hub-internal user-management surface right now, or `null`. */
-function userManagementInternal(registry) {
-    return (0, system_1.getUserManagementInternal)(registry.getSingleton('user-management'));
+export function userManagementInternal(registry) {
+    return getUserManagementInternal(registry.getSingleton('user-management'));
 }
-function createSessionBacking(sessions, lifetimes) {
+export function createSessionBacking(sessions, lifetimes) {
     return {
         open: async (input) => {
             const { session, refreshToken } = await sessions.create({
@@ -43,7 +37,7 @@ function createSessionBacking(sessions, lifetimes) {
     };
 }
 /** The session backing behind `registry`'s user-management, or `null` while it is not up. */
-function sessionBackingFrom(registry, lifetimes) {
+export function sessionBackingFrom(registry, lifetimes) {
     return () => {
         const internal = userManagementInternal(registry);
         return internal === null ? null : createSessionBacking(internal.sessions, lifetimes);
@@ -56,7 +50,7 @@ function sessionBackingFrom(registry, lifetimes) {
  * release unless it was issued before the user's cutoff (logout everywhere,
  * a password change, deletion).
  */
-function createSessionTokenCheck(registry) {
+export function createSessionTokenCheck(registry) {
     return (payload) => {
         const internal = userManagementInternal(registry);
         if (internal === null)

package/dist/auth/native-link-completions.js

@@ -1,6 +1,3 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.NativeLinkCompletions = exports.NATIVE_LINK_CODE_TTL_MS = exports.NATIVE_LINK_CODE_PREFIX = void 0;
 /**
  * Native-app account links waiting for the app to claim them (D801).
  *
@@ -17,20 +14,20 @@ exports.NativeLinkCompletions = exports.NATIVE_LINK_CODE_TTL_MS = exports.NATIVE
  * outcome, and the store is bounded. In memory: a hub restart mid-link costs
  * one more tap.
  */
-const node_crypto_1 = require("node:crypto");
-exports.NATIVE_LINK_CODE_PREFIX = 'nlc_';
-exports.NATIVE_LINK_CODE_TTL_MS = 60_000;
+import { createHash, randomBytes } from 'node:crypto';
+export const NATIVE_LINK_CODE_PREFIX = 'nlc_';
+export const NATIVE_LINK_CODE_TTL_MS = 60_000;
 const MAX_PENDING = 1_000;
 function hash(code) {
-    return (0, node_crypto_1.createHash)('sha256').update(code).digest('hex');
+    return createHash('sha256').update(code).digest('hex');
 }
-class NativeLinkCompletions {
+export class NativeLinkCompletions {
     pending = new Map();
     now;
     ttlMs;
     constructor(opts = {}) {
         this.now = opts.now ?? Date.now;
-        this.ttlMs = opts.ttlMs ?? exports.NATIVE_LINK_CODE_TTL_MS;
+        this.ttlMs = opts.ttlMs ?? NATIVE_LINK_CODE_TTL_MS;
     }
     /** Park a verified link; returns the raw one-time code. */
     park(link) {
@@ -41,7 +38,7 @@ class NativeLinkCompletions {
                 break;
             this.pending.delete(oldest.value);
         }
-        const code = `${exports.NATIVE_LINK_CODE_PREFIX}${(0, node_crypto_1.randomBytes)(32).toString('base64url')}`;
+        const code = `${NATIVE_LINK_CODE_PREFIX}${randomBytes(32).toString('base64url')}`;
         this.pending.set(hash(code), { ...link, expiresAt: this.now() + this.ttlMs });
         return code;
     }
@@ -65,4 +62,3 @@ class NativeLinkCompletions {
         }
     }
 }
-exports.NativeLinkCompletions = NativeLinkCompletions;

package/dist/auth/native-return.js

@@ -1,7 +1,3 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.ssoReturnLocation = ssoReturnLocation;
-exports.browserHandoffLocation = browserHandoffLocation;
 /**
  * Where the hub's auth routes send a browser, as `Location` values (D801).
  *
@@ -11,23 +7,23 @@ exports.browserHandoffLocation = browserHandoffLocation;
  *    and must never be prefixed;
  *  - a browser handoff lands on the account page and nowhere else.
  */
-const types_1 = require("@camstack/types");
-const sso_finish_js_1 = require("./sso-finish.js");
-function ssoReturnLocation(mount, location) {
-    return (0, types_1.hasUrlScheme)(location) ? location : `${mount}${location}`;
+import { hasUrlScheme } from '@camstack/types';
+import { SSO_LOGIN_PATH, SSO_PROFILE_PATH, sessionFragmentParams } from './sso-finish.js';
+export function ssoReturnLocation(mount, location) {
+    return hasUrlScheme(location) ? location : `${mount}${location}`;
 }
 /**
  * The account page, signed in by a session in the FRAGMENT that admin-ui's
  * auth boot consumes (`#token=…&next=…`, as an SSO login return). Without a
  * session — unknown, used or expired code — the plain login page.
  */
-function browserHandoffLocation(mount, session) {
+export function browserHandoffLocation(mount, session) {
     if (session === null)
-        return `${mount}${sso_finish_js_1.SSO_LOGIN_PATH}`;
+        return `${mount}${SSO_LOGIN_PATH}`;
     const fragment = new URLSearchParams({
-        ...(0, sso_finish_js_1.sessionFragmentParams)(session),
-        next: sso_finish_js_1.SSO_PROFILE_PATH,
+        ...sessionFragmentParams(session),
+        next: SSO_PROFILE_PATH,
         provider: 'browser-handoff',
     });
-    return `${mount}${sso_finish_js_1.SSO_LOGIN_PATH}#${fragment.toString()}`;
+    return `${mount}${SSO_LOGIN_PATH}#${fragment.toString()}`;
 }

package/dist/auth/passkey-provider.js

@@ -1,11 +1,5 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.SetSecondFactorPreferenceSchema = exports.SecondFactorPreferenceSchema = exports.RemovePasskeySchema = exports.FinishDiscoverableAuthenticationSchema = exports.FinishAuthenticationSchema = exports.FinishRegistrationSchema = exports.OptionsJsonSchema = void 0;
-exports.resolvePasskeyProvider = resolvePasskeyProvider;
-exports.userHasPasskey = userHasPasskey;
-exports.passkeySecondFactorOptedIn = passkeySecondFactorOptedIn;
-const types_1 = require("@camstack/types");
-const zod_1 = require("zod");
+import { PasskeySummarySchema } from '@camstack/types';
+import { z } from 'zod';
 // ── Passkey (user-passkeys cap) resolution ───────────────────────────
 //
 // Cap-agnostic: the passkey provider is resolved through the
@@ -18,19 +12,19 @@ const zod_1 = require("zod");
 // The proxy is loosely typed (`Record<method, (params)=>Promise<unknown>>`);
 // its outputs are narrowed through the cap's own Zod schemas rather than
 // cast to the provider type (repo rule: no `as` on cross-boundary values).
-exports.OptionsJsonSchema = zod_1.z.object({ optionsJSON: zod_1.z.record(zod_1.z.string(), zod_1.z.unknown()) });
-exports.FinishRegistrationSchema = zod_1.z.object({
-    success: zod_1.z.literal(true),
-    credentialId: zod_1.z.string(),
+export const OptionsJsonSchema = z.object({ optionsJSON: z.record(z.string(), z.unknown()) });
+export const FinishRegistrationSchema = z.object({
+    success: z.literal(true),
+    credentialId: z.string(),
 });
-exports.FinishAuthenticationSchema = zod_1.z.object({ verified: zod_1.z.boolean() });
-exports.FinishDiscoverableAuthenticationSchema = zod_1.z.object({
-    verified: zod_1.z.boolean(),
-    userId: zod_1.z.string().nullable(),
+export const FinishAuthenticationSchema = z.object({ verified: z.boolean() });
+export const FinishDiscoverableAuthenticationSchema = z.object({
+    verified: z.boolean(),
+    userId: z.string().nullable(),
 });
-exports.RemovePasskeySchema = zod_1.z.object({ success: zod_1.z.literal(true) });
-exports.SecondFactorPreferenceSchema = zod_1.z.object({ enabled: zod_1.z.boolean() });
-exports.SetSecondFactorPreferenceSchema = zod_1.z.object({ success: zod_1.z.literal(true) });
+export const RemovePasskeySchema = z.object({ success: z.literal(true) });
+export const SecondFactorPreferenceSchema = z.object({ enabled: z.boolean() });
+export const SetSecondFactorPreferenceSchema = z.object({ success: z.literal(true) });
 function proxyPasskeyProvider(proxy) {
     const call = async (method, params) => {
         const fn = proxy[method];
@@ -39,19 +33,19 @@ function proxyPasskeyProvider(proxy) {
         return fn(params);
     };
     return {
-        beginRegistration: async (input) => exports.OptionsJsonSchema.parse(await call('beginRegistration', input)),
-        finishRegistration: async (input) => exports.FinishRegistrationSchema.parse(await call('finishRegistration', input)),
-        beginAuthentication: async (input) => exports.OptionsJsonSchema.parse(await call('beginAuthentication', input)),
-        finishAuthentication: async (input) => exports.FinishAuthenticationSchema.parse(await call('finishAuthentication', input)),
-        beginDiscoverableAuthentication: async (input) => exports.OptionsJsonSchema.parse(await call('beginDiscoverableAuthentication', input)),
-        finishDiscoverableAuthentication: async (input) => exports.FinishDiscoverableAuthenticationSchema.parse(await call('finishDiscoverableAuthentication', input)),
-        listPasskeys: async (input) => zod_1.z.array(types_1.PasskeySummarySchema).parse(await call('listPasskeys', input)),
-        removePasskey: async (input) => exports.RemovePasskeySchema.parse(await call('removePasskey', input)),
-        getSecondFactorPreference: async (input) => exports.SecondFactorPreferenceSchema.parse(await call('getSecondFactorPreference', input)),
-        setSecondFactorPreference: async (input) => exports.SetSecondFactorPreferenceSchema.parse(await call('setSecondFactorPreference', input)),
+        beginRegistration: async (input) => OptionsJsonSchema.parse(await call('beginRegistration', input)),
+        finishRegistration: async (input) => FinishRegistrationSchema.parse(await call('finishRegistration', input)),
+        beginAuthentication: async (input) => OptionsJsonSchema.parse(await call('beginAuthentication', input)),
+        finishAuthentication: async (input) => FinishAuthenticationSchema.parse(await call('finishAuthentication', input)),
+        beginDiscoverableAuthentication: async (input) => OptionsJsonSchema.parse(await call('beginDiscoverableAuthentication', input)),
+        finishDiscoverableAuthentication: async (input) => FinishDiscoverableAuthenticationSchema.parse(await call('finishDiscoverableAuthentication', input)),
+        listPasskeys: async (input) => z.array(PasskeySummarySchema).parse(await call('listPasskeys', input)),
+        removePasskey: async (input) => RemovePasskeySchema.parse(await call('removePasskey', input)),
+        getSecondFactorPreference: async (input) => SecondFactorPreferenceSchema.parse(await call('getSecondFactorPreference', input)),
+        setSecondFactorPreference: async (input) => SetSecondFactorPreferenceSchema.parse(await call('setSecondFactorPreference', input)),
     };
 }
-function resolvePasskeyProvider(registry, moleculer) {
+export function resolvePasskeyProvider(registry, moleculer) {
     const local = registry?.getCollection('user-passkeys')?.[0] ?? null;
     if (local)
         return local;
@@ -63,7 +57,7 @@ function resolvePasskeyProvider(registry, moleculer) {
  * missing provider or a transport hiccup degrades to `false` so the
  * login flow is never blocked by passkey introspection.
  */
-async function userHasPasskey(userId, provider) {
+export async function userHasPasskey(userId, provider) {
     if (!provider)
         return false;
     try {
@@ -83,7 +77,7 @@ async function userHasPasskey(userId, provider) {
  * hiccup all read as `false` so the preference lookup can never lock a
  * user out of the password flow.
  */
-async function passkeySecondFactorOptedIn(userId, provider) {
+export async function passkeySecondFactorOptedIn(userId, provider) {
     if (!provider || typeof provider.getSecondFactorPreference !== 'function')
         return false;
     try {

package/dist/auth/second-factors.js

@@ -1,19 +1,15 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.SecondFactorSchema = void 0;
-exports.collectSecondFactors = collectSecondFactors;
-const zod_1 = require("zod");
-const passkey_provider_js_1 = require("./passkey-provider.js");
-exports.SecondFactorSchema = zod_1.z.enum(['totp', 'passkey']);
-async function collectSecondFactors(deps, userId, primary) {
+import { z } from 'zod';
+import { passkeySecondFactorOptedIn, userHasPasskey } from './passkey-provider.js';
+export const SecondFactorSchema = z.enum(['totp', 'passkey']);
+export async function collectSecondFactors(deps, userId, primary) {
     const totpStatus = deps.getTotpStatus ? await deps.getTotpStatus({ userId }) : { enabled: false };
     const factors = [];
     if (totpStatus.enabled)
         factors.push('totp');
     if (primary !== 'passkey') {
         const provider = deps.passkeyProvider();
-        const enrolled = await (0, passkey_provider_js_1.userHasPasskey)(userId, provider);
-        if (enrolled && (await (0, passkey_provider_js_1.passkeySecondFactorOptedIn)(userId, provider))) {
+        const enrolled = await userHasPasskey(userId, provider);
+        if (enrolled && (await passkeySecondFactorOptedIn(userId, provider))) {
             factors.push('passkey');
         }
     }

package/dist/auth/session-connections.js

@@ -1,4 +1,3 @@
-"use strict";
 /**
  * What a login session still HOLDS on the hub — its open WebSockets and its
  * live media sessions — so that revoking the session ends them.
@@ -16,16 +15,12 @@
  *   the session (the WebRTC `closeSession`); recorded playback rides the same
  *   cap, so the same hold covers it.
  */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.SessionConnections = exports.SESSION_ENDED_CLOSE_REASON = exports.SESSION_ENDED_CLOSE_CODE = void 0;
-exports.getSessionConnections = getSessionConnections;
-exports.__resetSessionConnectionsForTests = __resetSessionConnectionsForTests;
 /** WebSocket close code a client recognises as "the hub ended this session". */
-exports.SESSION_ENDED_CLOSE_CODE = 4401;
-exports.SESSION_ENDED_CLOSE_REASON = 'session-ended';
+export const SESSION_ENDED_CLOSE_CODE = 4401;
+export const SESSION_ENDED_CLOSE_REASON = 'session-ended';
 /** Bound on live media holds kept per login session (oldest dropped past it). */
 const MAX_MEDIA_HOLDS_PER_SESSION = 256;
-class SessionConnections {
+export class SessionConnections {
     sockets = new Set();
     media = new Map();
     logger = null;
@@ -77,7 +72,7 @@ class SessionConnections {
                 continue;
             this.sockets.delete(tracked);
             try {
-                tracked.socket.close(exports.SESSION_ENDED_CLOSE_CODE, exports.SESSION_ENDED_CLOSE_REASON);
+                tracked.socket.close(SESSION_ENDED_CLOSE_CODE, SESSION_ENDED_CLOSE_REASON);
                 sockets += 1;
             }
             catch (error) {
@@ -123,14 +118,13 @@ class SessionConnections {
         }
     }
 }
-exports.SessionConnections = SessionConnections;
 let instance = null;
 /** The process-wide registry (the WS factory, the WebRTC wrapper and the revoke listener share it). */
-function getSessionConnections() {
+export function getSessionConnections() {
     instance ??= new SessionConnections();
     return instance;
 }
 /** Test-only. */
-function __resetSessionConnectionsForTests() {
+export function __resetSessionConnectionsForTests() {
     instance = null;
 }

package/dist/auth/session-cookie.js

@@ -1,21 +1,10 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.SESSION_COOKIE = void 0;
-exports.buildSessionCookie = buildSessionCookie;
-exports.clearSessionCookie = clearSessionCookie;
-exports.readSessionCookieFromHeader = readSessionCookieFromHeader;
-exports.shouldRedirectToLogin = shouldRedirectToLogin;
-exports.loginRedirectUrl = loginRedirectUrl;
-exports.isEmbedRedirectTarget = isEmbedRedirectTarget;
-exports.isSessionGradeJwtPayload = isSessionGradeJwtPayload;
-exports.sessionCookieIsSecure = sessionCookieIsSecure;
 /** Browser session cookie carrying the hub JWT. Set by POST /api/auth/session
  *  after a tRPC login; read by the addon-route catch-all for `authenticated`
  *  routes hit by a plain browser navigation. */
-exports.SESSION_COOKIE = 'camstack_session';
-function buildSessionCookie(token, ttlSec, opts = {}) {
+export const SESSION_COOKIE = 'camstack_session';
+export function buildSessionCookie(token, ttlSec, opts = {}) {
     return {
-        name: exports.SESSION_COOKIE,
+        name: SESSION_COOKIE,
         value: token,
         options: {
             httpOnly: true,
@@ -28,9 +17,9 @@ function buildSessionCookie(token, ttlSec, opts = {}) {
         },
     };
 }
-function clearSessionCookie(opts = {}) {
+export function clearSessionCookie(opts = {}) {
     return {
-        name: exports.SESSION_COOKIE,
+        name: SESSION_COOKIE,
         value: '',
         options: { httpOnly: true, sameSite: 'lax', secure: opts.secure ?? true, path: '/', maxAge: 0 },
     };
@@ -41,7 +30,7 @@ function clearSessionCookie(opts = {}) {
  * so callers don't depend on `@fastify/cookie` decoration order. Returns
  * `null` when the header is absent or carries no `camstack_session` pair.
  */
-function readSessionCookieFromHeader(header) {
+export function readSessionCookieFromHeader(header) {
     if (!header)
         return null;
     for (const pair of header.split(';')) {
@@ -49,7 +38,7 @@ function readSessionCookieFromHeader(header) {
         if (eq === -1)
             continue;
         const name = pair.slice(0, eq).trim();
-        if (name !== exports.SESSION_COOKIE)
+        if (name !== SESSION_COOKIE)
             continue;
         const raw = pair.slice(eq + 1).trim();
         if (raw === '')
@@ -66,7 +55,7 @@ function readSessionCookieFromHeader(header) {
 /** A browser navigation we can bounce to the login page: a top-level GET
  *  that wants HTML. Anything else (API call, POST, non-HTML) keeps the
  *  401 behavior so programmatic clients get a clean error. */
-function shouldRedirectToLogin(method, accept) {
+export function shouldRedirectToLogin(method, accept) {
     return method === 'GET' && typeof accept === 'string' && accept.includes('text/html');
 }
 /**
@@ -78,14 +67,14 @@ function shouldRedirectToLogin(method, accept) {
  * the SPA re-mounts it itself (`hubPath`) — so one value serves both the
  * relayed and the direct case.
  */
-function loginRedirectUrl(originalUrl, mountPrefix = null) {
+export function loginRedirectUrl(originalUrl, mountPrefix = null) {
     return `${mountPrefix ?? ''}/login?next=${encodeURIComponent(originalUrl)}`;
 }
 /** Allowed redirect target for `GET /api/embed-auth`: a same-origin RELATIVE
  *  path to a stream-broker embed page. Defeats open-redirects — the endpoint
  *  sets the session cookie from a Bearer token, so the `next` must be safe to
  *  bounce to. Rejects absolute/protocol-relative URLs, backslashes, and `..`. */
-function isEmbedRedirectTarget(next) {
+export function isEmbedRedirectTarget(next) {
     if (!next.startsWith('/addon/stream-broker/embed/'))
         return false;
     if (next.includes('\\') || next.includes('://') || next.includes('..'))
@@ -100,7 +89,7 @@ function isEmbedRedirectTarget(next) {
  * password-only attacker skip the second factor on every cookie-gated
  * surface. Shared by `POST /api/auth/session` and `auth.exchangeSession`.
  */
-function isSessionGradeJwtPayload(payload) {
+export function isSessionGradeJwtPayload(payload) {
     if (payload === null || typeof payload !== 'object')
         return false;
     const p = payload;
@@ -132,7 +121,7 @@ function isSessionGradeJwtPayload(payload) {
  *    which is set by the proxy and by nothing else on a direct browser hit. A
  *    direct caller inventing the proto header alone changes nothing.
  */
-function sessionCookieIsSecure(requestProtocol, headers, forwardedPrefixHeader) {
+export function sessionCookieIsSecure(requestProtocol, headers, forwardedPrefixHeader) {
     const secureLeg = requestProtocol === 'https';
     if (!secureLeg)
         return false;

package/dist/auth/session-lifetimes.js

@@ -1,7 +1,3 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.DEFAULT_ACCESS_TOKEN_EXPIRY = exports.SESSION_LIFETIME_KEY = exports.ACCESS_TOKEN_EXPIRY_KEY = void 0;
-exports.readSessionLifetimes = readSessionLifetimes;
 /**
  * The two lifetimes of a login (System → Authentication):
  *
@@ -15,10 +11,10 @@ exports.readSessionLifetimes = readSessionLifetimes;
  * applies to the next login or refresh. A value that does not parse falls
  * back to the default — never to something longer.
  */
-const system_1 = require("@camstack/system");
-exports.ACCESS_TOKEN_EXPIRY_KEY = 'auth.accessTokenExpiry';
-exports.SESSION_LIFETIME_KEY = 'auth.tokenExpiry';
-exports.DEFAULT_ACCESS_TOKEN_EXPIRY = '2h';
+import { parseTokenExpiry } from '@camstack/system';
+export const ACCESS_TOKEN_EXPIRY_KEY = 'auth.accessTokenExpiry';
+export const SESSION_LIFETIME_KEY = 'auth.tokenExpiry';
+export const DEFAULT_ACCESS_TOKEN_EXPIRY = '2h';
 const DEFAULT_ACCESS_SEC = 2 * 3600;
 const MIN_ACCESS_SEC = 5 * 60;
 const MAX_ACCESS_SEC = 24 * 3600;
@@ -30,12 +26,12 @@ function safeRead(read, key) {
         return undefined;
     }
 }
-function readSessionLifetimes(read) {
-    const session = (0, system_1.parseTokenExpiry)(safeRead(read, exports.SESSION_LIFETIME_KEY));
-    const configuredAccess = safeRead(read, exports.ACCESS_TOKEN_EXPIRY_KEY);
+export function readSessionLifetimes(read) {
+    const session = parseTokenExpiry(safeRead(read, SESSION_LIFETIME_KEY));
+    const configuredAccess = safeRead(read, ACCESS_TOKEN_EXPIRY_KEY);
     const access = configuredAccess === undefined || configuredAccess === null || configuredAccess === ''
         ? null
-        : (0, system_1.parseTokenExpiry)(configuredAccess);
+        : parseTokenExpiry(configuredAccess);
     const accessSec = access !== null && access.ok
         ? Math.min(MAX_ACCESS_SEC, Math.max(MIN_ACCESS_SEC, access.seconds))
         : DEFAULT_ACCESS_SEC;

package/dist/auth/session-mint.js

@@ -1,9 +1,5 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.SessionRefreshRefusedError = exports.SessionDirectoryUnavailableError = exports.SessionUserGoneError = void 0;
-exports.createSessionMinter = createSessionMinter;
 /** The user a credential names is not in `user-management` (deleted, or never existed). */
-class SessionUserGoneError extends Error {
+export class SessionUserGoneError extends Error {
     userId;
     constructor(userId) {
         super('User no longer exists');
@@ -11,17 +7,15 @@ class SessionUserGoneError extends Error {
         this.name = 'SessionUserGoneError';
     }
 }
-exports.SessionUserGoneError = SessionUserGoneError;
 /** `user-management` is not registered: an infrastructure failure, never a 401. */
-class SessionDirectoryUnavailableError extends Error {
+export class SessionDirectoryUnavailableError extends Error {
     constructor() {
         super('Login unavailable — `user-management` capability not registered');
         this.name = 'SessionDirectoryUnavailableError';
     }
 }
-exports.SessionDirectoryUnavailableError = SessionDirectoryUnavailableError;
 /** A refresh token that does not continue a live session. */
-class SessionRefreshRefusedError extends Error {
+export class SessionRefreshRefusedError extends Error {
     reason;
     constructor(reason) {
         super('Session expired — sign in again');
@@ -29,8 +23,7 @@ class SessionRefreshRefusedError extends Error {
         this.name = 'SessionRefreshRefusedError';
     }
 }
-exports.SessionRefreshRefusedError = SessionRefreshRefusedError;
-function createSessionMinter(deps) {
+export function createSessionMinter(deps) {
     const findUserOrNull = async (userId) => {
         const directory = deps.directory();
         if (!directory)