@camstack/server 1.2.592 → 1.2.594

package/dist/api/core/agent-pairing.router.js

@@ -1,7 +1,4 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createAgentPairingRouter = createAgentPairingRouter;
-const node_crypto_1 = require("node:crypto");
+import { X509Certificate } from 'node:crypto';
 /**
  * Agent pairing — fixed core API for System -> Cluster -> Agents (D857).
  *
@@ -21,67 +18,67 @@ const node_crypto_1 = require("node:crypto");
  * the hub checks it against the code it computed itself. A page that sends back
  * `code` from `getPairing` defeats the check and is a bug.
  */
-const hub_discovery_1 = require("@camstack/develop/hub-discovery");
-const system_1 = require("@camstack/system");
-const server_1 = require("@trpc/server");
-const zod_1 = require("zod");
-const agent_pairing_http_js_1 = require("../../core/agent/agent-pairing-http.js");
-const hub_agent_pairing_js_1 = require("../../core/agent/hub-agent-pairing.js");
-const trpc_middleware_js_1 = require("../trpc/trpc.middleware.js");
+import { browseAgentsMdns } from '@camstack/develop/hub-discovery';
+import { getProcessMeshCaState, getProcessMeshCertificateRegistry, getProcessPeerLeaf, HubPairing, isProcessVerifiedMeshPeer, dropProcessPeer, processMeshCrl, revokeMeshCertificate, DEFAULT_HUB_TLS_TCP_PORT, } from '@camstack/system';
+import { TRPCError } from '@trpc/server';
+import { z } from 'zod';
+import { createHttpAgentPairingTransport } from '../../core/agent/agent-pairing-http.js';
+import { HubAgentPairing } from '../../core/agent/hub-agent-pairing.js';
+import { adminProcedure, trpcRouter } from '../trpc/trpc.middleware.js';
 const HUB_NODE_ID = 'hub';
 const BROWSE_TIMEOUT_MS = 3_000;
-const EndpointSchema = zod_1.z.object({
-    host: zod_1.z.string().min(1).max(253),
-    port: zod_1.z.number().int().min(1).max(65535).default(4444),
+const EndpointSchema = z.object({
+    host: z.string().min(1).max(253),
+    port: z.number().int().min(1).max(65535).default(4444),
 });
-const PairingViewSchema = zod_1.z.object({
-    pairingId: zod_1.z.string(),
-    nodeId: zod_1.z.string(),
-    endpoint: zod_1.z.object({ host: zod_1.z.string(), port: zod_1.z.number() }),
+const PairingViewSchema = z.object({
+    pairingId: z.string(),
+    nodeId: z.string(),
+    endpoint: z.object({ host: z.string(), port: z.number() }),
     /**
      * The six digits the hub computed. For DISPLAY next to the agent's own: the operator
      * confirms by typing the code the AGENT shows, never by echoing this one.
      */
-    code: zod_1.z.string(),
-    state: zod_1.z.enum(['awaiting-confirmation', 'completing', 'paired', 'rejected', 'expired', 'failed']),
-    hubConfirmed: zod_1.z.boolean(),
-    agentConfirmed: zod_1.z.boolean(),
-    expiresAt: zod_1.z.number(),
-    failure: zod_1.z.string().nullable(),
+    code: z.string(),
+    state: z.enum(['awaiting-confirmation', 'completing', 'paired', 'rejected', 'expired', 'failed']),
+    hubConfirmed: z.boolean(),
+    agentConfirmed: z.boolean(),
+    expiresAt: z.number(),
+    failure: z.string().nullable(),
 });
-const DiscoveredAgentSchema = zod_1.z.object({
-    nodeId: zod_1.z.string(),
-    host: zod_1.z.string(),
-    port: zod_1.z.number(),
-    version: zod_1.z.string().nullable(),
-    state: zod_1.z.enum(['unpaired', 'pending', 'paired']),
-    fingerprint: zod_1.z.string().nullable(),
-    source: zod_1.z.enum(['mdns', 'address']),
-    connected: zod_1.z.boolean(),
+const DiscoveredAgentSchema = z.object({
+    nodeId: z.string(),
+    host: z.string(),
+    port: z.number(),
+    version: z.string().nullable(),
+    state: z.enum(['unpaired', 'pending', 'paired']),
+    fingerprint: z.string().nullable(),
+    source: z.enum(['mdns', 'address']),
+    connected: z.boolean(),
     pairing: PairingViewSchema.nullable(),
 });
-const UnpairResultSchema = zod_1.z.object({
-    nodeId: zod_1.z.string(),
+const UnpairResultSchema = z.object({
+    nodeId: z.string(),
     /** The agent acknowledged and is erasing its certificate; `false` when it could not be reached. */
-    agentNotified: zod_1.z.boolean(),
-    revokedSerials: zod_1.z.array(zod_1.z.string()),
-    disconnected: zod_1.z.number().int(),
-    next: zod_1.z.string(),
+    agentNotified: z.boolean(),
+    revokedSerials: z.array(z.string()),
+    disconnected: z.number().int(),
+    next: z.string(),
 });
-function createAgentPairingRouter(deps) {
-    const transport = deps.transport ?? (0, agent_pairing_http_js_1.createHttpAgentPairingTransport)();
+export function createAgentPairingRouter(deps) {
+    const transport = deps.transport ?? createHttpAgentPairingTransport();
     const meshCa = deps.meshCa ??
         (() => {
-            const state = (0, system_1.getProcessMeshCaState)();
+            const state = getProcessMeshCaState();
             return state.state === 'ready' ? state.ca : null;
         });
-    const meshRegistry = deps.meshRegistry ?? system_1.getProcessMeshCertificateRegistry;
-    const crl = deps.crl ?? system_1.processMeshCrl;
+    const meshRegistry = deps.meshRegistry ?? getProcessMeshCertificateRegistry;
+    const crl = deps.crl ?? processMeshCrl;
     const peers = deps.peers ?? {
-        peerLeaf: (nodeId) => (0, system_1.getProcessPeerLeaf)(nodeId),
-        dropPeer: (nodeId) => (0, system_1.dropProcessPeer)(nodeId),
+        peerLeaf: (nodeId) => getProcessPeerLeaf(nodeId),
+        dropPeer: (nodeId) => dropProcessPeer(nodeId),
     };
-    const isNodeConnected = deps.isNodeConnected ?? system_1.isProcessVerifiedMeshPeer;
+    const isNodeConnected = deps.isNodeConnected ?? isProcessVerifiedMeshPeer;
     const localNetwork = () => {
         const provider = deps.registry?.getSingleton('local-network');
         if (!provider) {
@@ -100,10 +97,10 @@ function createAgentPairingRouter(deps) {
             }
             return {
                 hubUrl,
-                hubMeshAddress: `${new URL(internal).hostname}:${system_1.DEFAULT_HUB_TLS_TCP_PORT}`,
+                hubMeshAddress: `${new URL(internal).hostname}:${DEFAULT_HUB_TLS_TCP_PORT}`,
             };
         });
-    const pairing = new system_1.HubPairing({
+    const pairing = new HubPairing({
         transport,
         ca: meshCa,
         hubNodeId: HUB_NODE_ID,
@@ -121,19 +118,19 @@ function createAgentPairingRouter(deps) {
             const registry = meshRegistry();
             if (registry === null)
                 return;
-            const keep = keepCertPem === undefined ? undefined : new node_crypto_1.X509Certificate(keepCertPem).fingerprint256;
+            const keep = keepCertPem === undefined ? undefined : new X509Certificate(keepCertPem).fingerprint256;
             await registry.revokeAllForNode(nodeId, reason, crl(), keep);
         },
         isLeafPresented: (nodeId, certPem) => {
             const seen = peers.peerLeaf?.(nodeId)?.fingerprint;
             const norm = (f) => f.replaceAll(':', '').toLowerCase();
-            return seen !== undefined && norm(seen) === norm(new node_crypto_1.X509Certificate(certPem).fingerprint256);
+            return seen !== undefined && norm(seen) === norm(new X509Certificate(certPem).fingerprint256);
         },
         revokeLeaf: async (_nodeId, certPem, reason) => {
             const registry = meshRegistry();
             if (registry === null)
                 return;
-            await registry.revoke(new node_crypto_1.X509Certificate(certPem).fingerprint256, reason, crl());
+            await registry.revoke(new X509Certificate(certPem).fingerprint256, reason, crl());
         },
         // Ids the registry has ever issued for: a node id differing only in case from one of them is refused.
         knownNodeIds: () => meshRegistry()
@@ -147,11 +144,11 @@ function createAgentPairingRouter(deps) {
             });
         },
     });
-    const service = new hub_agent_pairing_js_1.HubAgentPairing({
+    const service = new HubAgentPairing({
         pairing,
         transport,
         browse: deps.browse ??
-            (() => (0, hub_discovery_1.browseAgentsMdns)({
+            (() => browseAgentsMdns({
                 timeoutMs: BROWSE_TIMEOUT_MS,
                 onProblem: (message) => deps.log.warn(`agent browse problem: ${message}`),
             })),
@@ -164,51 +161,51 @@ function createAgentPairingRouter(deps) {
             return await run();
         }
         catch (err) {
-            if (err instanceof server_1.TRPCError)
+            if (err instanceof TRPCError)
                 throw err;
-            throw new server_1.TRPCError({
+            throw new TRPCError({
                 code: 'PRECONDITION_FAILED',
                 message: err instanceof Error ? err.message : String(err),
             });
         }
     };
-    return (0, trpc_middleware_js_1.trpcRouter)({
+    return trpcRouter({
         /** Agents found over mDNS and addresses typed so far, with any pairing in progress. */
-        listDiscoveredAgents: trpc_middleware_js_1.adminProcedure
-            .input(zod_1.z.object({ refresh: zod_1.z.boolean().optional() }).optional())
-            .output(zod_1.z.object({
-            agents: zod_1.z.array(DiscoveredAgentSchema),
-            scannedAt: zod_1.z.number().nullable(),
+        listDiscoveredAgents: adminProcedure
+            .input(z.object({ refresh: z.boolean().optional() }).optional())
+            .output(z.object({
+            agents: z.array(DiscoveredAgentSchema),
+            scannedAt: z.number().nullable(),
         }))
             .query(({ input }) => guard(() => service.listDiscovered({ refresh: input?.refresh === true }))),
         /** Probe an address the operator typed. The agent must be on a private / local address. */
-        addAgentByAddress: trpc_middleware_js_1.adminProcedure
-            .input(zod_1.z.object({
-            host: zod_1.z.string().min(1).max(253),
-            port: zod_1.z.number().int().min(1).max(65535).optional(),
+        addAgentByAddress: adminProcedure
+            .input(z.object({
+            host: z.string().min(1).max(253),
+            port: z.number().int().min(1).max(65535).optional(),
         }))
             .output(DiscoveredAgentSchema)
             .mutation(({ input }) => guard(() => service.addByAddress(input.host.trim(), input.port))),
         /** Offer the mesh CA to an agent and derive the code both screens show. */
-        beginPairing: trpc_middleware_js_1.adminProcedure
+        beginPairing: adminProcedure
             .input(EndpointSchema)
             .output(PairingViewSchema)
             .mutation(({ input }) => guard(() => service.begin({ host: input.host.trim(), port: input.port }))),
-        getPairing: trpc_middleware_js_1.adminProcedure
-            .input(zod_1.z.object({ pairingId: zod_1.z.string().min(1) }))
+        getPairing: adminProcedure
+            .input(z.object({ pairingId: z.string().min(1) }))
             .output(PairingViewSchema)
             .query(({ input }) => guard(() => service.get(input.pairingId))),
-        listPairings: trpc_middleware_js_1.adminProcedure
-            .input(zod_1.z.void())
-            .output(zod_1.z.array(PairingViewSchema))
+        listPairings: adminProcedure
+            .input(z.void())
+            .output(z.array(PairingViewSchema))
             .query(() => service.list().map((p) => p)),
         /** The operator typed the code shown on the AGENT. Wrong three times cancels the pairing. */
-        confirmPairing: trpc_middleware_js_1.adminProcedure
-            .input(zod_1.z.object({ pairingId: zod_1.z.string().min(1), code: zod_1.z.string().min(1).max(16) }))
+        confirmPairing: adminProcedure
+            .input(z.object({ pairingId: z.string().min(1), code: z.string().min(1).max(16) }))
             .output(PairingViewSchema)
             .mutation(({ input }) => guard(() => service.confirm(input.pairingId, input.code))),
-        rejectPairing: trpc_middleware_js_1.adminProcedure
-            .input(zod_1.z.object({ pairingId: zod_1.z.string().min(1) }))
+        rejectPairing: adminProcedure
+            .input(z.object({ pairingId: z.string().min(1) }))
             .output(PairingViewSchema)
             .mutation(({ input }) => guard(() => service.reject(input.pairingId))),
         /**
@@ -217,8 +214,8 @@ function createAgentPairingRouter(deps) {
          * because revoking drops its connection. An unreachable agent is still revoked (it can no longer
          * connect); it is then unpaired by hand on its own page.
          */
-        unpairAgent: trpc_middleware_js_1.adminProcedure
-            .input(zod_1.z.object({ nodeId: zod_1.z.string().min(1) }))
+        unpairAgent: adminProcedure
+            .input(z.object({ nodeId: z.string().min(1) }))
             .output(UnpairResultSchema)
             .mutation(({ input }) => guard(async () => {
             if (input.nodeId === HUB_NODE_ID) {
@@ -243,7 +240,7 @@ function createAgentPairingRouter(deps) {
                     });
                 }
             }
-            const revoked = await (0, system_1.revokeMeshCertificate)({
+            const revoked = await revokeMeshCertificate({
                 nodeId: input.nodeId,
                 registry,
                 crl: crl(),

package/dist/api/core/agents.router.js

@@ -1,6 +1,3 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createAgentsRouter = createAgentsRouter;
 /**
  * Agents router — fixed core API (not a capability).
  *
@@ -9,13 +6,13 @@ exports.createAgentsRouter = createAgentsRouter;
  * node listing remain; protocol endpoints (register, heartbeat, task
  * dispatch) are handled natively by the Moleculer service mesh.
  */
-const zod_1 = require("zod");
-const trpc_middleware_js_1 = require("../trpc/trpc.middleware.js");
-const AgentRoleSchema = zod_1.z.enum(['decoder', 'transcoder', 'detector', 'recorder']);
-function createAgentsRouter(ar, moleculer) {
-    return (0, trpc_middleware_js_1.trpcRouter)({
+import { z } from 'zod';
+import { trpcRouter, adminProcedure } from '../trpc/trpc.middleware.js';
+const AgentRoleSchema = z.enum(['decoder', 'transcoder', 'detector', 'recorder']);
+export function createAgentsRouter(ar, moleculer) {
+    return trpcRouter({
         // ── Node listing (replaces listAgents / listConnected) ────────────
-        listNodes: trpc_middleware_js_1.adminProcedure.input(zod_1.z.void()).query(async () => {
+        listNodes: adminProcedure.input(z.void()).query(async () => {
             const items = await ar.listNodes();
             // Spread to mutable copies: AgentListItem uses readonly arrays; Zod output schema uses mutable.
             return items.map((a) => ({
@@ -33,7 +30,7 @@ function createAgentsRouter(ar, moleculer) {
             }));
         }),
         // ── Capability discovery (via Moleculer service list) ─────────────
-        getAgentCapabilities: trpc_middleware_js_1.adminProcedure.input(zod_1.z.void()).query(async () => {
+        getAgentCapabilities: adminProcedure.input(z.void()).query(async () => {
             // eslint-disable-next-line @typescript-eslint/no-unsafe-call, @typescript-eslint/no-unsafe-member-access -- moleculer.broker.call typing chain unresolvable; runtime shape validated by the cast below
             const services = (await moleculer.broker.call('$node.services', {}));
             const capSet = new Set();
@@ -45,27 +42,27 @@ function createAgentsRouter(ar, moleculer) {
             return [...capSet].toSorted();
         }),
         // ── Role assignments ──────────────────────────────────────────────
-        getAssignments: trpc_middleware_js_1.adminProcedure
-            .input(zod_1.z.object({ cameraId: zod_1.z.number().optional() }))
+        getAssignments: adminProcedure
+            .input(z.object({ cameraId: z.number().optional() }))
             .query(({ input }) => ar.getAssignments(input.cameraId)),
-        setAssignment: trpc_middleware_js_1.adminProcedure
-            .input(zod_1.z.object({
-            cameraId: zod_1.z.number(),
+        setAssignment: adminProcedure
+            .input(z.object({
+            cameraId: z.number(),
             role: AgentRoleSchema,
-            agentId: zod_1.z.string(),
-            priority: zod_1.z.enum(['primary', 'backup', 'overflow']),
-            rtspUrl: zod_1.z.string().optional(),
+            agentId: z.string(),
+            priority: z.enum(['primary', 'backup', 'overflow']),
+            rtspUrl: z.string().optional(),
         }))
             .mutation(({ input }) => ar.setAssignment(input)),
-        removeAssignment: trpc_middleware_js_1.adminProcedure
-            .input(zod_1.z.object({
-            cameraId: zod_1.z.number(),
+        removeAssignment: adminProcedure
+            .input(z.object({
+            cameraId: z.number(),
             role: AgentRoleSchema,
         }))
             .mutation(({ input }) => ar.removeAssignment(input.cameraId, input.role)),
-        activateBackup: trpc_middleware_js_1.adminProcedure
-            .input(zod_1.z.object({
-            cameraId: zod_1.z.number(),
+        activateBackup: adminProcedure
+            .input(z.object({
+            cameraId: z.number(),
             role: AgentRoleSchema,
         }))
             .mutation(({ input }) => ar.activateBackup(input.cameraId, input.role)),

package/dist/api/core/auth-admin-tokens.procedures.js

@@ -1,7 +1,3 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.AuthAuditRecordSchema = exports.AdminTokenSchema = exports.ADMIN_TOKEN_MAX_DAYS = exports.ADMIN_TOKEN_DEFAULT_DAYS = void 0;
-exports.createAdminTokenProcedures = createAdminTokenProcedures;
 /**
  * Admin tokens (`csa_`) and the auth audit trail, as the `auth` router serves
  * them. The token store and its rules are local-auth's
@@ -9,44 +5,44 @@ exports.createAdminTokenProcedures = createAdminTokenProcedures;
  * real signed-in session (never a token minting a token), right after
  * re-authenticating. Every create / use / revoke is audited.
  */
-const system_1 = require("@camstack/system");
-const server_1 = require("@trpc/server");
-const zod_1 = require("zod");
-const hub_sessions_js_1 = require("../../auth/hub-sessions.js");
-const trpc_middleware_js_1 = require("../trpc/trpc.middleware.js");
-const auth_reauth_procedures_js_1 = require("./auth-reauth.procedures.js");
+import { ADMIN_TOKEN_MAX_LIFETIME_MS } from '@camstack/system';
+import { TRPCError } from '@trpc/server';
+import { z } from 'zod';
+import { userManagementInternal } from '../../auth/hub-sessions.js';
+import { adminProcedure } from '../trpc/trpc.middleware.js';
+import { assertReauthenticated, ReauthTokenInput } from './auth-reauth.procedures.js';
 const DAY_MS = 86_400_000;
-exports.ADMIN_TOKEN_DEFAULT_DAYS = 7;
-exports.ADMIN_TOKEN_MAX_DAYS = system_1.ADMIN_TOKEN_MAX_LIFETIME_MS / DAY_MS;
-exports.AdminTokenSchema = zod_1.z.object({
-    id: zod_1.z.string(),
-    createdBy: zod_1.z.string(),
-    name: zod_1.z.string(),
-    tokenPrefix: zod_1.z.string(),
-    createdAt: zod_1.z.number(),
-    expiresAt: zod_1.z.number(),
-    lastUsedAt: zod_1.z.number().nullable(),
-    revokedAt: zod_1.z.number().nullable(),
+export const ADMIN_TOKEN_DEFAULT_DAYS = 7;
+export const ADMIN_TOKEN_MAX_DAYS = ADMIN_TOKEN_MAX_LIFETIME_MS / DAY_MS;
+export const AdminTokenSchema = z.object({
+    id: z.string(),
+    createdBy: z.string(),
+    name: z.string(),
+    tokenPrefix: z.string(),
+    createdAt: z.number(),
+    expiresAt: z.number(),
+    lastUsedAt: z.number().nullable(),
+    revokedAt: z.number().nullable(),
 });
-exports.AuthAuditRecordSchema = zod_1.z.object({
-    id: zod_1.z.string(),
-    at: zod_1.z.number(),
-    action: zod_1.z.string(),
-    userId: zod_1.z.string().optional(),
-    ip: zod_1.z.string().optional(),
-    detail: zod_1.z.record(zod_1.z.string(), zod_1.z.union([zod_1.z.string(), zod_1.z.number(), zod_1.z.boolean()])).optional(),
+export const AuthAuditRecordSchema = z.object({
+    id: z.string(),
+    at: z.number(),
+    action: z.string(),
+    userId: z.string().optional(),
+    ip: z.string().optional(),
+    detail: z.record(z.string(), z.union([z.string(), z.number(), z.boolean()])).optional(),
 });
 function requireInternal(registry) {
-    const internal = registry === null ? null : (0, hub_sessions_js_1.userManagementInternal)(registry);
+    const internal = registry === null ? null : userManagementInternal(registry);
     if (internal === null) {
-        throw new server_1.TRPCError({
+        throw new TRPCError({
             code: 'PRECONDITION_FAILED',
             message: 'User management is not available',
         });
     }
     return internal;
 }
-function createAdminTokenProcedures(deps) {
+export function createAdminTokenProcedures(deps) {
     return {
         /**
          * ADMIN — mint an admin token for an ops script. Requires a real
@@ -54,28 +50,28 @@ function createAdminTokenProcedures(deps) {
          * re-authentication. Expiry mandatory: 1–90 days, default 7. The token
          * is in this answer only.
          */
-        createAdminToken: trpc_middleware_js_1.adminProcedure
-            .input(zod_1.z.object({
-            name: zod_1.z.string().trim().min(1).max(80),
-            expiresInDays: zod_1.z
+        createAdminToken: adminProcedure
+            .input(z.object({
+            name: z.string().trim().min(1).max(80),
+            expiresInDays: z
                 .number()
                 .int()
                 .min(1)
-                .max(exports.ADMIN_TOKEN_MAX_DAYS)
-                .default(exports.ADMIN_TOKEN_DEFAULT_DAYS),
-            reauthToken: auth_reauth_procedures_js_1.ReauthTokenInput.optional(),
+                .max(ADMIN_TOKEN_MAX_DAYS)
+                .default(ADMIN_TOKEN_DEFAULT_DAYS),
+            reauthToken: ReauthTokenInput.optional(),
         }))
-            .output(zod_1.z.object({ token: zod_1.z.string(), record: exports.AdminTokenSchema }))
+            .output(z.object({ token: z.string(), record: AdminTokenSchema }))
             .mutation(async ({ ctx, input }) => {
             if (ctx.user.isScoped === true ||
                 ctx.user.shareView !== undefined ||
                 ctx.user.credential !== undefined) {
-                throw new server_1.TRPCError({
+                throw new TRPCError({
                     code: 'FORBIDDEN',
                     message: 'An admin token can only be created from a signed-in admin session',
                 });
             }
-            (0, auth_reauth_procedures_js_1.assertReauthenticated)(deps.auth, ctx.user, input.reauthToken);
+            assertReauthenticated(deps.auth, ctx.user, input.reauthToken);
             const internal = requireInternal(deps.registry);
             const created = await internal.adminTokens.create({
                 createdBy: ctx.user.id,
@@ -97,14 +93,14 @@ function createAdminTokenProcedures(deps) {
             return created;
         }),
         /** ADMIN — every admin token not yet reaped (no secrets). */
-        listAdminTokens: trpc_middleware_js_1.adminProcedure
-            .input(zod_1.z.void())
-            .output(zod_1.z.array(exports.AdminTokenSchema))
+        listAdminTokens: adminProcedure
+            .input(z.void())
+            .output(z.array(AdminTokenSchema))
             .query(async () => [...(await requireInternal(deps.registry).adminTokens.list())]),
         /** ADMIN — revoke one admin token; it stops working at once. */
-        revokeAdminToken: trpc_middleware_js_1.adminProcedure
-            .input(zod_1.z.object({ id: zod_1.z.string().min(1) }))
-            .output(zod_1.z.object({ success: zod_1.z.boolean() }))
+        revokeAdminToken: adminProcedure
+            .input(z.object({ id: z.string().min(1) }))
+            .output(z.object({ success: z.boolean() }))
             .mutation(async ({ ctx, input }) => {
             const internal = requireInternal(deps.registry);
             const success = await internal.adminTokens.revoke(input.id);
@@ -120,14 +116,14 @@ function createAdminTokenProcedures(deps) {
             return { success };
         }),
         /** ADMIN — the authentication audit trail, newest first. */
-        listAuthAudit: trpc_middleware_js_1.adminProcedure
-            .input(zod_1.z
+        listAuthAudit: adminProcedure
+            .input(z
             .object({
-            limit: zod_1.z.number().int().min(1).max(500).optional(),
-            userId: zod_1.z.string().min(1).optional(),
+            limit: z.number().int().min(1).max(500).optional(),
+            userId: z.string().min(1).optional(),
         })
             .optional())
-            .output(zod_1.z.array(exports.AuthAuditRecordSchema))
+            .output(z.array(AuthAuditRecordSchema))
             .query(async ({ input }) => [
             ...(await requireInternal(deps.registry).audit.list({
                 ...(input?.limit !== undefined ? { limit: input.limit } : {}),