@camstack/server 1.2.593 → 1.2.594

package/dist/auth/sso-finish-app.js

@@ -1,6 +1,3 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.finishSsoApp = finishSsoApp;
 /**
  * `/api/auth/sso/finish-app` - the native-app leg of an OIDC sign-in (D858).
  *
@@ -30,41 +27,41 @@ exports.finishSsoApp = finishSsoApp;
  *
  * Pure: the Fastify route in `sso-routes.ts` wires the deps and maps the outcome.
  */
-const types_1 = require("@camstack/types");
-const auth_provider_gate_js_1 = require("./auth-provider-gate.js");
-const session_mint_js_1 = require("./session-mint.js");
-const sso_finish_js_1 = require("./sso-finish.js");
+import { APP_FLOW_DEFAULT_REDIRECT, appFlowLocation, parseAppAuthCallback, } from '@camstack/types';
+import { bridgeProviderAddonId } from './auth-provider-gate.js';
+import { SessionUserGoneError } from './session-mint.js';
+import { bridgeIsFirstUseHere, isLoginBridge, oidcIdentityOf, } from './sso-finish.js';
 function refused(error, deps, redirect, state) {
     deps.logRefusal?.(error);
-    return { kind: 'app', location: (0, types_1.appFlowLocation)(redirect, { error }, state) };
+    return { kind: 'app', location: appFlowLocation(redirect, { error }, state) };
 }
 /** Exchange a verified app login bridge for a handoff code at the app's callback. */
-async function finishSsoApp(bridge, deps) {
-    const fallback = types_1.APP_FLOW_DEFAULT_REDIRECT;
+export async function finishSsoApp(bridge, deps) {
+    const fallback = APP_FLOW_DEFAULT_REDIRECT;
     if (!bridge)
         return refused('invalid-bridge', deps, fallback, undefined);
     const claims = deps.verifyBridge(bridge);
     if (claims === null)
         return refused('invalid-bridge', deps, fallback, undefined);
     const app = claims.app;
-    if (app === undefined || !(0, sso_finish_js_1.isLoginBridge)(claims)) {
+    if (app === undefined || !isLoginBridge(claims)) {
         return refused('not-app-flow', deps, fallback, undefined);
     }
     // The signed redirect is checked against the allow-list again: the finish
     // never trusts a stored URL to be one it would accept.
-    const redirect = (0, types_1.parseAppAuthCallback)(app.redirect);
+    const redirect = parseAppAuthCallback(app.redirect);
     if (redirect === null)
         return refused('not-app-flow', deps, fallback, undefined);
     const deny = (error) => refused(error, deps, redirect, app.state);
     if (claims.linkIntent !== undefined)
         return deny('link-not-supported');
-    if (deps.isProviderDisabled((0, auth_provider_gate_js_1.bridgeProviderAddonId)(claims.provider))) {
+    if (deps.isProviderDisabled(bridgeProviderAddonId(claims.provider))) {
         return deny('provider-disabled');
     }
-    if (!(0, sso_finish_js_1.bridgeIsFirstUseHere)(claims, deps))
+    if (!bridgeIsFirstUseHere(claims, deps))
         return deny('sso-state');
     try {
-        const identity = (0, sso_finish_js_1.oidcIdentityOf)(claims);
+        const identity = oidcIdentityOf(claims);
         if (identity === null)
             return deny('invalid-bridge');
         const link = await deps.identities.findUser(identity.provider, identity.subject);
@@ -94,7 +91,7 @@ async function finishSsoApp(bridge, deps) {
         return { kind: 'confirm', ...parked };
     }
     catch (error) {
-        if (error instanceof session_mint_js_1.SessionUserGoneError)
+        if (error instanceof SessionUserGoneError)
             return deny('user-gone');
         deps.logFailure?.(error);
         return deny('failed');

package/dist/auth/sso-finish-deps.js

@@ -1,29 +1,23 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.sessionUserIdFromCookie = sessionUserIdFromCookie;
-exports.readCookie = readCookie;
-exports.ssoBrowserBinding = ssoBrowserBinding;
-exports.createSsoFinishDeps = createSsoFinishDeps;
-const types_1 = require("@camstack/types");
+import { userError } from '@camstack/types';
 /**
  * The live wiring of `finishSsoLogin`'s deps (D777, D782) — kept out of
  * `main.ts` so the route there stays a three-line mapping.
  */
-const node_crypto_1 = require("node:crypto");
-const system_1 = require("@camstack/system");
-const types_2 = require("@camstack/types");
-const auth_provider_gate_js_1 = require("./auth-provider-gate.js");
-const passkey_provider_js_1 = require("./passkey-provider.js");
-const second_factors_js_1 = require("./second-factors.js");
-const session_cookie_js_1 = require("./session-cookie.js");
+import { createHash } from 'node:crypto';
+import { getUserManagementInternal } from '@camstack/system';
+import { SSO_STATE_COOKIE } from '@camstack/types';
+import { isAuthAddonDisabled } from './auth-provider-gate.js';
+import { resolvePasskeyProvider } from './passkey-provider.js';
+import { collectSecondFactors } from './second-factors.js';
+import { readSessionCookieFromHeader } from './session-cookie.js';
 /**
  * The user a REAL session cookie names, or `null`. Same rule as
  * `auth.exchangeSession`: a bridge or challenge token verifies under the same
  * secret but carries a `kind`, and a session always has a boolean `isAdmin`
  * and a string `userId`.
  */
-function sessionUserIdFromCookie(auth, cookieHeader) {
-    const token = (0, session_cookie_js_1.readSessionCookieFromHeader)(cookieHeader);
+export function sessionUserIdFromCookie(auth, cookieHeader) {
+    const token = readSessionCookieFromHeader(cookieHeader);
     if (token === null)
         return null;
     try {
@@ -39,7 +33,7 @@ function sessionUserIdFromCookie(auth, cookieHeader) {
     }
 }
 /** The value of one cookie in a raw `Cookie` header, or `null`. */
-function readCookie(header, name) {
+export function readCookie(header, name) {
     if (header === undefined)
         return null;
     for (const pair of header.split(';')) {
@@ -54,22 +48,22 @@ function readCookie(header, name) {
     return null;
 }
 /** SHA-256 (hex) of the request's SSO state cookie, or `null` without one. */
-function ssoBrowserBinding(cookieHeader) {
-    const value = readCookie(cookieHeader, types_2.SSO_STATE_COOKIE);
-    return value === null ? null : (0, node_crypto_1.createHash)('sha256').update(value).digest('hex');
+export function ssoBrowserBinding(cookieHeader) {
+    const value = readCookie(cookieHeader, SSO_STATE_COOKIE);
+    return value === null ? null : createHash('sha256').update(value).digest('hex');
 }
-function createSsoFinishDeps(wiring, cookieHeader) {
+export function createSsoFinishDeps(wiring, cookieHeader) {
     const { auth, registry, moleculer } = wiring;
     const userManagement = () => {
         const um = registry.getSingleton('user-management');
         if (!um)
-            throw (0, types_1.userError)('server.login-unavailable', undefined, 'Login unavailable — `user-management` capability not registered');
+            throw userError('server.login-unavailable', undefined, 'Login unavailable — `user-management` capability not registered');
         return um;
     };
     return {
         verifyBridge: (token) => auth.verifySsoBridgeToken(token),
         minter: wiring.minter,
-        isProviderDisabled: (addonId) => (0, auth_provider_gate_js_1.isAuthAddonDisabled)(registry, addonId),
+        isProviderDisabled: (addonId) => isAuthAddonDisabled(registry, addonId),
         identities: {
             findUser: async (provider, subject) => userManagement().findUserByExternalIdentity({ provider, subject }),
             link: async (input) => {
@@ -82,7 +76,7 @@ function createSsoFinishDeps(wiring, cookieHeader) {
                     return 'conflict';
                 // Hub-internal: creating a link is on no wire (not tRPC, not the
                 // mesh, not ctx.api) — only this in-process caller reaches it.
-                const internal = (0, system_1.getUserManagementInternal)(um);
+                const internal = getUserManagementInternal(um);
                 if (internal === null)
                     throw new Error('External sign-in linking not available');
                 await internal.linkExternalIdentity(input);
@@ -98,7 +92,7 @@ function createSsoFinishDeps(wiring, cookieHeader) {
             ? {
                 trustedNetworkLogin: wiring.trustedNetworkLogin,
                 auditSkip: async (userId, factors) => {
-                    const internal = (0, system_1.getUserManagementInternal)(registry.getSingleton('user-management'));
+                    const internal = getUserManagementInternal(registry.getSingleton('user-management'));
                     if (internal === null)
                         throw new Error('auth audit unavailable');
                     const ip = wiring.sessionIssue?.().ip;
@@ -114,11 +108,11 @@ function createSsoFinishDeps(wiring, cookieHeader) {
         sessionUserId: () => sessionUserIdFromCookie(auth, cookieHeader),
         secondFactors: (userId) => {
             const um = registry.getSingleton('user-management');
-            return (0, second_factors_js_1.collectSecondFactors)({
+            return collectSecondFactors({
                 ...(um && typeof um.getTotpStatus === 'function'
                     ? { getTotpStatus: (input) => um.getTotpStatus(input) }
                     : {}),
-                passkeyProvider: () => (0, passkey_provider_js_1.resolvePasskeyProvider)(registry, moleculer),
+                passkeyProvider: () => resolvePasskeyProvider(registry, moleculer),
             }, userId, 'sso');
         },
         signChallenge: (user) => auth.signTotpChallengeToken(user),

package/dist/auth/sso-finish.js

@@ -1,13 +1,3 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.SSO_POPUP_COMPLETE_PATH = exports.SSO_LOGIN_PATH = exports.SSO_PROFILE_PATH = exports.OIDC_IDENTITY_PREFIX = exports.OIDC_BRIDGE_PROVIDER_PREFIX = void 0;
-exports.popupCompletionLocation = popupCompletionLocation;
-exports.oidcIdentityOf = oidcIdentityOf;
-exports.isLoginBridge = isLoginBridge;
-exports.appCallbackLocation = appCallbackLocation;
-exports.sessionFragmentParams = sessionFragmentParams;
-exports.finishSsoLogin = finishSsoLogin;
-exports.bridgeIsFirstUseHere = bridgeIsFirstUseHere;
 /**
  * `/api/auth/sso/finish` — swaps a verified login bridge for a session (D712),
  * or completes an explicit OIDC link (D782).
@@ -45,10 +35,10 @@ exports.bridgeIsFirstUseHere = bridgeIsFirstUseHere;
  *
  * Pure: the Fastify route in `main.ts` wires the deps and maps the outcome.
  */
-const node_crypto_1 = require("node:crypto");
-const types_1 = require("@camstack/types");
-const auth_provider_gate_js_1 = require("./auth-provider-gate.js");
-const session_mint_js_1 = require("./session-mint.js");
+import { timingSafeEqual } from 'node:crypto';
+import { hasUrlScheme } from '@camstack/types';
+import { bridgeProviderAddonId } from './auth-provider-gate.js';
+import { SessionUserGoneError, } from './session-mint.js';
 /**
  * `auth-oidc` signs `auth-oidc/<instance>`.
  *
@@ -60,25 +50,25 @@ const session_mint_js_1 = require("./session-mint.js");
  * non-OIDC provider fails closed until it has its own bridge format. (The
  * magic-link bridge that named a user record directly is gone with its addon.)
  */
-exports.OIDC_BRIDGE_PROVIDER_PREFIX = 'auth-oidc/';
+export const OIDC_BRIDGE_PROVIDER_PREFIX = 'auth-oidc/';
 /** `auth-oidc` names an identity `oidc:<instance>:<sub>`. */
-exports.OIDC_IDENTITY_PREFIX = 'oidc:';
+export const OIDC_IDENTITY_PREFIX = 'oidc:';
 /**
  * Where a completed (or refused) link lands — the signed-in user's profile —
  * and where a login returns. Admin-ui routes, relative to its mount: the
  * route in `main.ts` prepends the hub's mount prefix. (These read `/admin/…`
  * once, a path admin-ui has no route for, so both returns drew a blank page.)
  */
-exports.SSO_PROFILE_PATH = '/system/my-access';
-exports.SSO_LOGIN_PATH = '/login';
-const PROFILE_PATH = exports.SSO_PROFILE_PATH;
-const LOGIN_PATH = exports.SSO_LOGIN_PATH;
+export const SSO_PROFILE_PATH = '/system/my-access';
+export const SSO_LOGIN_PATH = '/login';
+const PROFILE_PATH = SSO_PROFILE_PATH;
+const LOGIN_PATH = SSO_LOGIN_PATH;
 /**
  * The admin-ui page a POPUP sign-in lands on (D791): it hands the outcome to
  * the window that opened it and closes, or — opener gone — continues to the
  * page the outcome names, like a full-page return.
  */
-exports.SSO_POPUP_COMPLETE_PATH = '/sso-complete';
+export const SSO_POPUP_COMPLETE_PATH = '/sso-complete';
 /**
  * The popup form of a return `location`: the completion page, with what the
  * page return carried — the login FRAGMENT (session / challenge / error) or
@@ -87,39 +77,39 @@ exports.SSO_POPUP_COMPLETE_PATH = '/sso-complete';
  * never reaches a server log, and the completion page never posts it to
  * another origin.
  */
-function popupCompletionLocation(location) {
+export function popupCompletionLocation(location) {
     const hashAt = location.indexOf('#');
     const pathAndQuery = hashAt === -1 ? location : location.slice(0, hashAt);
     const fragment = hashAt === -1 ? '' : location.slice(hashAt + 1);
     const queryAt = pathAndQuery.indexOf('?');
     const path = queryAt === -1 ? pathAndQuery : pathAndQuery.slice(0, queryAt);
     const query = queryAt === -1 ? '' : pathAndQuery.slice(queryAt + 1);
-    const target = path === exports.SSO_PROFILE_PATH ? 'profile' : 'login';
+    const target = path === SSO_PROFILE_PATH ? 'profile' : 'login';
     const carried = [query, fragment].filter((part) => part.length > 0).join('&');
-    return `${exports.SSO_POPUP_COMPLETE_PATH}#return=${target}${carried.length > 0 ? `&${carried}` : ''}`;
+    return `${SSO_POPUP_COMPLETE_PATH}#return=${target}${carried.length > 0 ? `&${carried}` : ''}`;
 }
 /**
  * `(provider, subject, issuer)` of an OIDC bridge, or `null` when it is not a
  * well-formed one. A subject is unique only per issuer, so a bridge without
  * the verified `iss` names no identity.
  */
-function oidcIdentityOf(claims) {
-    if (!claims.provider.startsWith(exports.OIDC_BRIDGE_PROVIDER_PREFIX))
+export function oidcIdentityOf(claims) {
+    if (!claims.provider.startsWith(OIDC_BRIDGE_PROVIDER_PREFIX))
         return null;
     if (claims.issuer === undefined || claims.issuer.length === 0)
         return null;
-    const instance = claims.provider.slice(exports.OIDC_BRIDGE_PROVIDER_PREFIX.length);
+    const instance = claims.provider.slice(OIDC_BRIDGE_PROVIDER_PREFIX.length);
     if (instance.length === 0)
         return null;
-    const prefix = `${exports.OIDC_IDENTITY_PREFIX}${instance}:`;
+    const prefix = `${OIDC_IDENTITY_PREFIX}${instance}:`;
     if (!claims.userId.startsWith(prefix))
         return null;
     const subject = claims.userId.slice(prefix.length);
     return subject.length === 0 ? null : { provider: claims.provider, subject, issuer: claims.issuer };
 }
 /** Whether `claims` is a LOGIN bridge — the only kind this endpoint swaps. */
-function isLoginBridge(claims) {
-    return claims.provider.startsWith(exports.OIDC_BRIDGE_PROVIDER_PREFIX);
+export function isLoginBridge(claims) {
+    return claims.provider.startsWith(OIDC_BRIDGE_PROVIDER_PREFIX);
 }
 function unauthorized(error) {
     return { kind: 'error', status: 401, body: { error } };
@@ -131,11 +121,11 @@ function linkRefused(reason) {
     return redirect(`${PROFILE_PATH}?linkError=${reason}`);
 }
 /** The app's callback with one query parameter — `link=<code>` or `linkError=<reason>`. */
-function appCallbackLocation(returnTo, key, value) {
+export function appCallbackLocation(returnTo, key, value) {
     return `${returnTo}?${key}=${encodeURIComponent(value)}`;
 }
 function failed(error, deps) {
-    if (error instanceof session_mint_js_1.SessionUserGoneError)
+    if (error instanceof SessionUserGoneError)
         return unauthorized('User no longer exists');
     // The detail stays in the server log: a store error can name user ids.
     deps.logFailure?.(error);
@@ -146,7 +136,7 @@ function failed(error, deps) {
  * admin-ui is a refreshing client — the refresh token and both expiries. A
  * fragment never reaches a server log or a Referer.
  */
-function sessionFragmentParams(session) {
+export function sessionFragmentParams(session) {
     return {
         token: session.token,
         ...(session.refreshToken !== undefined ? { refreshToken: session.refreshToken } : {}),
@@ -252,12 +242,12 @@ async function completeLogin(claims, deps) {
     }
     return signIn(await deps.minter.findUser(link.userId), claims.provider, deps);
 }
-async function finishSsoLogin(bridge, deps, options = {}) {
+export async function finishSsoLogin(bridge, deps, options = {}) {
     const outcome = await finishSsoReturn(bridge, deps);
     if (options.popup !== true || outcome.kind !== 'redirect')
         return outcome;
     // A native return goes to the app's scheme, never to a popup page.
-    if ((0, types_1.hasUrlScheme)(outcome.location))
+    if (hasUrlScheme(outcome.location))
         return outcome;
     return redirect(popupCompletionLocation(outcome.location));
 }
@@ -265,7 +255,7 @@ async function finishSsoLogin(bridge, deps, options = {}) {
 function sameDigest(a, b) {
     const left = Buffer.from(a, 'utf8');
     const right = Buffer.from(b, 'utf8');
-    return left.length === right.length && (0, node_crypto_1.timingSafeEqual)(left, right);
+    return left.length === right.length && timingSafeEqual(left, right);
 }
 /**
  * Is this the FIRST presentation of the bridge, in the browser that started
@@ -273,7 +263,7 @@ function sameDigest(a, b) {
  * presented from a browser without the cookie is refused without being burned
  * — the real browser can still finish.
  */
-function bridgeIsFirstUseHere(claims, deps) {
+export function bridgeIsFirstUseHere(claims, deps) {
     if (claims.jti === undefined || claims.browserBinding === undefined)
         return false;
     const presented = deps.browserBinding();
@@ -293,7 +283,7 @@ async function finishSsoReturn(bridge, deps) {
     // which hands the app a code; it must never become a web session here.
     if (claims.app !== undefined)
         return unauthorized('Not a web login bridge token');
-    if (deps.isProviderDisabled((0, auth_provider_gate_js_1.bridgeProviderAddonId)(claims.provider))) {
+    if (deps.isProviderDisabled(bridgeProviderAddonId(claims.provider))) {
         return unauthorized('Login provider is disabled');
     }
     if (!bridgeIsFirstUseHere(claims, deps)) {

package/dist/auth/sso-routes.js

@@ -1,6 +1,3 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.registerSsoRoutes = registerSsoRoutes;
 /**
  * The two browser-facing SSO routes, kept out of `main.ts`:
  *
@@ -14,14 +11,14 @@ exports.registerSsoRoutes = registerSsoRoutes;
  *  - `GET /api/auth/browser-handoff?code=…` — a one-time code from
  *    `auth.createBrowserHandoff` opens the account page signed in (D801).
  */
-const types_1 = require("@camstack/types");
-const spa_mount_js_1 = require("../api/static/spa-mount.js");
-const auth_rate_limit_js_1 = require("./auth-rate-limit.js");
-const native_return_js_1 = require("./native-return.js");
-const sso_finish_js_1 = require("./sso-finish.js");
-const app_confirm_routes_js_1 = require("./app-confirm-routes.js");
-const sso_finish_app_js_1 = require("./sso-finish-app.js");
-const sso_finish_deps_js_1 = require("./sso-finish-deps.js");
+import { SSO_STATE_COOKIE } from '@camstack/types';
+import { parseForwardedPrefix } from '../api/static/spa-mount.js';
+import { clientKeyFromRequest } from './auth-rate-limit.js';
+import { browserHandoffLocation, ssoReturnLocation } from './native-return.js';
+import { finishSsoLogin } from './sso-finish.js';
+import { APP_CONFIRM_PARAM, APP_CONFIRM_PATH, appConfirmCookie } from './app-confirm-routes.js';
+import { finishSsoApp } from './sso-finish-app.js';
+import { createSsoFinishDeps } from './sso-finish-deps.js';
 /** A User-Agent as a session's client label. */
 function clientOf(ua) {
     const value = Array.isArray(ua) ? ua[0] : ua;
@@ -29,11 +26,11 @@ function clientOf(ua) {
 }
 /** Expire the state cookie (both Secure variants are cleared by name + path). */
 function clearSsoStateCookie() {
-    return `${types_1.SSO_STATE_COOKIE}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`;
+    return `${SSO_STATE_COOKIE}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`;
 }
-function registerSsoRoutes(fastify, deps) {
+export function registerSsoRoutes(fastify, deps) {
     fastify.get('/api/auth/sso/finish', async (request, reply) => {
-        const client = (0, auth_rate_limit_js_1.clientKeyFromRequest)(request, deps.network);
+        const client = clientKeyFromRequest(request, deps.network);
         if (client !== null) {
             const verdict = deps.limiter.check(`sso-finish:${client}`);
             if (!verdict.allowed) {
@@ -41,7 +38,7 @@ function registerSsoRoutes(fastify, deps) {
                 return reply.status(429).send({ error: 'Too many attempts' });
             }
         }
-        const outcome = await (0, sso_finish_js_1.finishSsoLogin)(request.query.bridge, (0, sso_finish_deps_js_1.createSsoFinishDeps)({
+        const outcome = await finishSsoLogin(request.query.bridge, createSsoFinishDeps({
             ...deps.wiring,
             sessionIssue: () => {
                 const ip = deps.network.clientAddress(request).ip;
@@ -62,8 +59,8 @@ function registerSsoRoutes(fastify, deps) {
         reply.code(302);
         // Admin-ui paths are relative to the hub's mount (HA ingress etc.); a
         // native app return (`camstack://…`, D801) is not a hub path at all.
-        const mount = (0, spa_mount_js_1.parseForwardedPrefix)(request.headers['x-forwarded-prefix']) ?? '';
-        reply.header('Location', (0, native_return_js_1.ssoReturnLocation)(mount, outcome.location));
+        const mount = parseForwardedPrefix(request.headers['x-forwarded-prefix']) ?? '';
+        reply.header('Location', ssoReturnLocation(mount, outcome.location));
         return reply.send('');
     });
     // The native-app leg (D858): same bridge rules, a handoff code instead of a
@@ -73,7 +70,7 @@ function registerSsoRoutes(fastify, deps) {
         reply.header('Cache-Control', 'no-store');
         const clearState = clearSsoStateCookie();
         reply.header('Set-Cookie', clearState);
-        const client = (0, auth_rate_limit_js_1.clientKeyFromRequest)(request, deps.network);
+        const client = clientKeyFromRequest(request, deps.network);
         if (client !== null) {
             const verdict = deps.limiter.check(`sso-finish:${client}`);
             if (!verdict.allowed) {
@@ -81,8 +78,8 @@ function registerSsoRoutes(fastify, deps) {
                 return reply.status(429).send({ error: 'Too many attempts' });
             }
         }
-        const outcome = await (0, sso_finish_app_js_1.finishSsoApp)(request.query.bridge, {
-            ...(0, sso_finish_deps_js_1.createSsoFinishDeps)({
+        const outcome = await finishSsoApp(request.query.bridge, {
+            ...createSsoFinishDeps({
                 ...deps.wiring,
                 logFailure: (error) => deps.logger.error('SSO app finish failed', {
                     meta: { error: error instanceof Error ? error.message : String(error) },
@@ -99,19 +96,19 @@ function registerSsoRoutes(fastify, deps) {
         }
         // The confirmation page, on this hub (mount-aware); its cookie binds the
         // token to this browser. The SSO state cookie is spent either way.
-        const mount = (0, spa_mount_js_1.parseForwardedPrefix)(request.headers['x-forwarded-prefix']) ?? '';
+        const mount = parseForwardedPrefix(request.headers['x-forwarded-prefix']) ?? '';
         reply.header('Set-Cookie', [
             clearState,
-            (0, app_confirm_routes_js_1.appConfirmCookie)(outcome.cookie, request.protocol === 'https'),
+            appConfirmCookie(outcome.cookie, request.protocol === 'https'),
         ]);
-        reply.header('Location', `${mount}${app_confirm_routes_js_1.APP_CONFIRM_PATH}?${app_confirm_routes_js_1.APP_CONFIRM_PARAM}=${encodeURIComponent(outcome.token)}`);
+        reply.header('Location', `${mount}${APP_CONFIRM_PATH}?${APP_CONFIRM_PARAM}=${encodeURIComponent(outcome.token)}`);
         return reply.send('');
     });
     // A one-time code minted by `auth.createBrowserHandoff` opens the account
     // page signed in (D801): the session rides the URL FRAGMENT (never a server
     // log), and the only destination is the account page.
     fastify.get('/api/auth/browser-handoff', async (request, reply) => {
-        const mount = (0, spa_mount_js_1.parseForwardedPrefix)(request.headers['x-forwarded-prefix']) ?? '';
+        const mount = parseForwardedPrefix(request.headers['x-forwarded-prefix']) ?? '';
         const grant = typeof request.query.code === 'string'
             ? deps.browserHandoffCodes.redeem(request.query.code)
             : null;
@@ -136,7 +133,7 @@ function registerSsoRoutes(fastify, deps) {
         }
         reply.code(302);
         reply.header('Referrer-Policy', 'no-referrer');
-        reply.header('Location', (0, native_return_js_1.browserHandoffLocation)(mount, session));
+        reply.header('Location', browserHandoffLocation(mount, session));
         return reply.send('');
     });
 }

package/dist/auth/used-bridge-ids.js

@@ -1,6 +1,3 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.UsedBridgeIds = void 0;
 /**
  * The `jti`s of login bridges already swapped for a session or a link.
  *
@@ -15,7 +12,7 @@ exports.UsedBridgeIds = void 0;
  */
 const RETENTION_MS = 10 * 60_000;
 const DEFAULT_MAX_ENTRIES = 10_000;
-class UsedBridgeIds {
+export class UsedBridgeIds {
     used = new Map();
     now;
     maxEntries;
@@ -49,4 +46,3 @@ class UsedBridgeIds {
         }
     }
 }
-exports.UsedBridgeIds = UsedBridgeIds;

package/dist/boot/boot-config.js

@@ -1,53 +1,14 @@
-"use strict";
 /**
  * Phase 1: Bootstrap config loading and infrastructure setup.
  *
  * Extracted from main.ts — pure extraction, no behavior change.
  */
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.ignoredTlsCertSources = ignoredTlsCertSources;
-exports.retiredSecretSources = retiredSecretSources;
-exports.loadBootstrapConfig = loadBootstrapConfig;
-exports.setupInfra = setupInfra;
-const fs = __importStar(require("node:fs"));
-const path = __importStar(require("node:path"));
-const types_1 = require("@camstack/types");
-const yaml = __importStar(require("js-yaml"));
-const config_schema_1 = require("../core/config/config.schema");
-const storage_location_manager_1 = require("../core/storage/storage-location-manager");
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { asJsonObject } from '@camstack/types';
+import * as yaml from 'js-yaml';
+import { bootstrapSchema } from '../core/config/config.schema';
+import { StorageLocationManager } from '../core/storage/storage-location-manager';
 // ---------------------------------------------------------------------------
 // Constants
 // ---------------------------------------------------------------------------
@@ -100,7 +61,7 @@ function setNested(obj, p, value) {
         return obj;
     if (rest.length === 0)
         return { ...obj, [head]: value };
-    const child = (0, types_1.asJsonObject)(obj[head]) ?? {};
+    const child = asJsonObject(obj[head]) ?? {};
     return { ...obj, [head]: setNested(child, rest.join('.'), value) };
 }
 /**
@@ -108,12 +69,12 @@ function setNested(obj, p, value) {
  * certificate and is now ignored (D726). Blank env values count as unset,
  * exactly as the override loop treats them.
  */
-function ignoredTlsCertSources(env, raw) {
+export function ignoredTlsCertSources(env, raw) {
     const fromEnv = IGNORED_TLS_CERT_ENV.filter((name) => {
         const value = env[name];
         return value !== undefined && value !== '';
     });
-    const tls = (0, types_1.asJsonObject)(raw['tls']) ?? {};
+    const tls = asJsonObject(raw['tls']) ?? {};
     const fromYaml = IGNORED_TLS_CERT_KEYS.filter((key) => tls[key] !== undefined).map((key) => `tls.${key}`);
     return [...fromEnv, ...fromYaml];
 }
@@ -121,12 +82,12 @@ function ignoredTlsCertSources(env, raw) {
  * Every retired secret source still present: env variables set (non-blank) and
  * `config.yaml` `auth.*` keys. Names only — a value is never read into a log.
  */
-function retiredSecretSources(env, raw) {
+export function retiredSecretSources(env, raw) {
     const fromEnv = RETIRED_SECRET_ENV.filter((name) => {
         const value = env[name];
         return value !== undefined && value !== '';
     });
-    const auth = (0, types_1.asJsonObject)(raw['auth']) ?? {};
+    const auth = asJsonObject(raw['auth']) ?? {};
     const fromYaml = RETIRED_AUTH_KEYS.filter((key) => auth[key] !== undefined && auth[key] !== null).map((key) => `auth.${key}`);
     return [...fromEnv, ...fromYaml];
 }
@@ -137,13 +98,13 @@ function retiredSecretSources(env, raw) {
  * Load bootstrap config from a YAML file, apply env-var overrides, and
  * validate via the bootstrap Zod schema.
  */
-function loadBootstrapConfig(configPath) {
+export function loadBootstrapConfig(configPath) {
     // Only bootstrap sections live in config.yaml.
     // All runtime settings are stored in the SQL system_settings table.
     let raw;
     if (fs.existsSync(configPath)) {
         const content = fs.readFileSync(configPath, 'utf-8');
-        raw = (0, types_1.asJsonObject)(yaml.load(content)) ?? {};
+        raw = asJsonObject(yaml.load(content)) ?? {};
         // Merge in any missing bootstrap sections (server, auth only)
         let updated = false;
         for (const [key, defaults] of Object.entries(CONFIG_DEFAULTS)) {
@@ -205,7 +166,7 @@ function loadBootstrapConfig(configPath) {
         console.warn(`[Phase1] WARN ${ignored.join(', ')} ignored — the certificate is set only in the admin UI. ` +
             'Upload the certificate in Network → Local access (D726).');
     }
-    return config_schema_1.bootstrapSchema.parse(raw);
+    return bootstrapSchema.parse(raw);
 }
 // ---------------------------------------------------------------------------
 // setupInfra
@@ -214,7 +175,7 @@ function loadBootstrapConfig(configPath) {
  * Phase 2: Create StorageLocationManager, ensure directories, configure TLS.
  * Returns the full InfraContext needed by subsequent boot phases.
  */
-async function setupInfra(_configPath, bootstrapConfig) {
+export async function setupInfra(_configPath, bootstrapConfig) {
     // No secret is generated here: the session signing key is the keychain's
     // (local-auth loads or creates it once the keychain is up — D797).
     const config = bootstrapConfig;
@@ -224,7 +185,7 @@ async function setupInfra(_configPath, bootstrapConfig) {
     console.log(`[Phase1] Bootstrap: port=${port}, host=${host}, dataPath=${dataPath}`);
     // --- Phase 2: Init StorageLocationManager → ensure all dirs exist ---
     console.log('[Phase2] Initializing storage locations…');
-    const locationManager = new storage_location_manager_1.StorageLocationManager(dataPath);
+    const locationManager = new StorageLocationManager(dataPath);
     await locationManager.initializeDefaults();
     const locationStatus = locationManager.getStatus();
     for (const { name, available, path: locPath } of locationStatus) {

package/dist/boot/init-sequence.js

@@ -1,4 +1,3 @@
-"use strict";
 /**
  * The hub's `onModuleInit` order, as one named, testable sequence.
  *
@@ -15,10 +14,8 @@
  *   4. AddonRegistry — boots EVERY addon. Minutes of work on a real hub.
  *   5. …post-boot reconciles.
  */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.runBootInitSequence = runBootInitSequence;
 /** Run the boot init steps in dependency order. */
-async function runBootInitSequence(sequence) {
+export async function runBootInitSequence(sequence) {
     await sequence.moleculer();
     await sequence.addonBridge();
     await sequence.agentRegistry();