@camstack/server 1.2.594 → 1.2.595

package/dist/api/server-upload-propagate.js

@@ -1,3 +1,39 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerServerUploadPropagateRoute = registerServerUploadPropagateRoute;
 /**
  * POST /api/server-upload/propagate — deliver an already-uploaded
  * `dev-uploads/<version>/` set from the hub onto one agent, then leave
@@ -6,13 +42,13 @@
  * Mirrors addon fan-out: pack the version dir → stage one-shot hub-http
  * ticket → `$agent.stageDevUploads`. Does NOT promote the closure.
  */
-import * as fs from 'node:fs';
-import * as path from 'node:path';
-import { AGENT_DEPLOY_CONTROL_TIMEOUT_MS, } from './agent-addon-delivery.js';
-import { buildHubHttpSource } from './addon-upload.js';
-import { isSafeDevUploadVersion, packDevUploadVersionDir } from './dev-uploads-bundle.js';
-import { authorizeUploadRequest, } from './upload-auth.js';
-import { devUploadVersionDir, readDevUploadManifest, serverRootDir } from '../server-root/index.js';
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const agent_addon_delivery_js_1 = require("./agent-addon-delivery.js");
+const addon_upload_js_1 = require("./addon-upload.js");
+const dev_uploads_bundle_js_1 = require("./dev-uploads-bundle.js");
+const upload_auth_js_1 = require("./upload-auth.js");
+const index_js_1 = require("../server-root/index.js");
 function isStageResponse(value) {
     if (value === null || typeof value !== 'object')
         return false;
@@ -34,7 +70,7 @@ function readBody(value) {
             error: 'nodeId must be a top-level agent id (not "hub" and not a child runner id)',
         };
     }
-    if (!isSafeDevUploadVersion(body.version)) {
+    if (!(0, dev_uploads_bundle_js_1.isSafeDevUploadVersion)(body.version)) {
         return {
             error: `Refused: version "${body.version}" is not a safe dev-channel version ` +
                 '(expected `<base>-dev.<epochSeconds>`)',
@@ -42,10 +78,10 @@ function readBody(value) {
     }
     return { version: body.version, nodeId: body.nodeId };
 }
-export function registerServerUploadPropagateRoute(fastify, options) {
+function registerServerUploadPropagateRoute(fastify, options) {
     const { authService, addonRegistry, logger, broker, resolveClusterBaseUrl } = options;
     fastify.post('/api/server-upload/propagate', async (request, reply) => {
-        const auth = await authorizeUploadRequest({
+        const auth = await (0, upload_auth_js_1.authorizeUploadRequest)({
             authHeader: request.headers.authorization,
             authService,
             addonRegistry,
@@ -59,14 +95,14 @@ export function registerServerUploadPropagateRoute(fastify, options) {
         }
         const { version, nodeId } = parsed;
         const dataDir = path.resolve(options.dataDir ?? process.env['CAMSTACK_DATA'] ?? 'camstack-data');
-        const versionDir = devUploadVersionDir(serverRootDir(dataDir), version);
+        const versionDir = (0, index_js_1.devUploadVersionDir)((0, index_js_1.serverRootDir)(dataDir), version);
         if (!fs.existsSync(versionDir)) {
             return reply.status(404).send({
                 error: `No hub-side upload for ${version} at ${versionDir}. ` +
                     'Upload first with `camstack deploy-server` (POST /api/server-upload).',
             });
         }
-        const manifest = readDevUploadManifest(versionDir);
+        const manifest = (0, index_js_1.readDevUploadManifest)(versionDir);
         if (manifest === null) {
             return reply.status(400).send({
                 error: `Hub upload for ${version} has a missing or invalid manifest.json`,
@@ -86,8 +122,8 @@ export function registerServerUploadPropagateRoute(fastify, options) {
         let bundle;
         let source;
         try {
-            bundle = await packDevUploadVersionDir(versionDir);
-            source = buildHubHttpSource(bundle, hubBaseUrl);
+            bundle = await (0, dev_uploads_bundle_js_1.packDevUploadVersionDir)(versionDir);
+            source = (0, addon_upload_js_1.buildHubHttpSource)(bundle, hubBaseUrl);
         }
         catch (err) {
             const message = err instanceof Error ? err.message : String(err);
@@ -97,7 +133,7 @@ export function registerServerUploadPropagateRoute(fastify, options) {
             return reply.status(500).send({ error: `Failed to stage upload pack: ${message}` });
         }
         try {
-            const raw = await broker.call('$agent.stageDevUploads', { version, source }, { nodeID: nodeId, timeout: AGENT_DEPLOY_CONTROL_TIMEOUT_MS });
+            const raw = await broker.call('$agent.stageDevUploads', { version, source }, { nodeID: nodeId, timeout: agent_addon_delivery_js_1.AGENT_DEPLOY_CONTROL_TIMEOUT_MS });
             if (!isStageResponse(raw) || raw.success !== true) {
                 logger.warn('server-upload propagate: malformed agent response', {
                     meta: { version, nodeId },

package/dist/api/server-upload.js

@@ -1,3 +1,40 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateTarballSet = validateTarballSet;
+exports.registerServerUploadRoute = registerServerUploadRoute;
 /**
  * POST /api/server-upload — the dev server-deploy channel's upload gateway.
  *
@@ -23,11 +60,11 @@
  * the instance (done by `registerAddonUploadRoute`) — this route only adds
  * the handler.
  */
-import * as fs from 'node:fs';
-import * as path from 'node:path';
-import { devUploadVersionDir, isDevChannelVersion, serverRootDir, writeDevUploadManifest, } from '../server-root/index.js';
-import { isTarballFilename, readTarballManifest } from './tarball-manifest.js';
-import { authorizeUploadRequest, } from './upload-auth.js';
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const index_js_1 = require("../server-root/index.js");
+const tarball_manifest_js_1 = require("./tarball-manifest.js");
+const upload_auth_js_1 = require("./upload-auth.js");
 /**
  * Version chars beyond the dev-channel shape check: strictly semver-ish
  * (alnum, dots, dashes) so the version can never traverse out of
@@ -54,17 +91,17 @@ function flattenedTgzName(packageName) {
  * is derived server-side from the validated PACKAGE name — a client
  * filename never becomes a filesystem path.
  */
-export function validateTarballSet(files, version) {
+function validateTarballSet(files, version) {
     const seen = new Set();
     const validated = [];
     for (const file of files) {
         if (hasPathTraversal(file.filename)) {
             return { error: `Refused: filename contains path separators (${file.filename})` };
         }
-        if (!isTarballFilename(file.filename)) {
+        if (!(0, tarball_manifest_js_1.isTarballFilename)(file.filename)) {
             return { error: `Refused: ${file.filename} is not a .tgz/.tar.gz archive` };
         }
-        const manifest = readTarballManifest(file.buffer, file.filename);
+        const manifest = (0, tarball_manifest_js_1.readTarballManifest)(file.buffer, file.filename);
         if (manifest === null) {
             return {
                 error: `Refused: ${file.filename} is missing or has a malformed package/package.json`,
@@ -89,10 +126,10 @@ export function validateTarballSet(files, version) {
     }
     return validated;
 }
-export function registerServerUploadRoute(fastify, options) {
+function registerServerUploadRoute(fastify, options) {
     const { authService, addonRegistry, logger } = options;
     fastify.post('/api/server-upload', async (request, reply) => {
-        const auth = await authorizeUploadRequest({
+        const auth = await (0, upload_auth_js_1.authorizeUploadRequest)({
             authHeader: request.headers.authorization,
             authService,
             addonRegistry,
@@ -115,7 +152,7 @@ export function registerServerUploadRoute(fastify, options) {
         if (version === null || version.length === 0) {
             return reply.status(400).send({ error: 'Missing "version" field' });
         }
-        if (!SAFE_VERSION_RE.test(version) || !isDevChannelVersion(version)) {
+        if (!SAFE_VERSION_RE.test(version) || !(0, index_js_1.isDevChannelVersion)(version)) {
             return reply.status(400).send({
                 error: `Refused: version "${version}" is not dev-channel shaped — this route only ` +
                     'accepts `<base>-dev.<epochSeconds>` versions produced by `camstack deploy-server`.',
@@ -130,7 +167,7 @@ export function registerServerUploadRoute(fastify, options) {
             return reply.status(400).send({ error: validated.error });
         }
         const dataDir = path.resolve(options.dataDir ?? process.env['CAMSTACK_DATA'] ?? 'camstack-data');
-        const versionDir = devUploadVersionDir(serverRootDir(dataDir), version);
+        const versionDir = (0, index_js_1.devUploadVersionDir)((0, index_js_1.serverRootDir)(dataDir), version);
         fs.mkdirSync(versionDir, { recursive: true });
         const packages = {};
         for (const pkg of validated) {
@@ -138,7 +175,7 @@ export function registerServerUploadRoute(fastify, options) {
             fs.writeFileSync(path.join(versionDir, tgzName), pkg.buffer);
             packages[pkg.name] = tgzName;
         }
-        writeDevUploadManifest(versionDir, { version, packages });
+        (0, index_js_1.writeDevUploadManifest)(versionDir, { version, packages });
         logger.info('server-upload stored dev closure', {
             meta: { version, packages: Object.keys(packages), dir: versionDir },
         });

package/dist/api/sse-no-compression.js

@@ -1,5 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.markSseRequestNoCompression = markSseRequestNoCompression;
 /** Mutates the request headers in place; returns whether it marked the request. */
-export function markSseRequestNoCompression(request) {
+function markSseRequestNoCompression(request) {
     const accept = request.headers.accept;
     if (typeof accept === 'string' && accept.includes('text/event-stream')) {
         request.headers['x-no-compression'] = '1';

package/dist/api/static/frame-policy.js

@@ -1,8 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FRAME_ANCESTORS_POLICY = void 0;
+exports.isFramePolicyTarget = isFramePolicyTarget;
+exports.registerFramePolicy = registerFramePolicy;
 /** The one directive: frame me from my origin only. */
-export const FRAME_ANCESTORS_POLICY = "frame-ancestors 'self'";
+exports.FRAME_ANCESTORS_POLICY = "frame-ancestors 'self'";
 const CSP_HEADER = 'content-security-policy';
 /** Only a document can be framed; assets, JSON and streams are never one. */
-export function isFramePolicyTarget(contentType) {
+function isFramePolicyTarget(contentType) {
     return typeof contentType === 'string' && contentType.trim().toLowerCase().startsWith('text/html');
 }
 /**
@@ -11,13 +16,13 @@ export function isFramePolicyTarget(contentType) {
  * reverse proxy's streaming path) are not seen here; they carry no HTML
  * shell of ours.
  */
-export function registerFramePolicy(fastify) {
+function registerFramePolicy(fastify) {
     fastify.addHook('onSend', async (_request, reply, payload) => {
         if (!isFramePolicyTarget(reply.getHeader('content-type')))
             return payload;
         if (reply.getHeader(CSP_HEADER) !== undefined)
             return payload;
-        reply.header(CSP_HEADER, FRAME_ANCESTORS_POLICY);
+        reply.header(CSP_HEADER, exports.FRAME_ANCESTORS_POLICY);
         return payload;
     });
 }

package/dist/api/static/precompressed-asset.js

@@ -1,3 +1,4 @@
+"use strict";
 /**
  * Brotli-compressed copies of static SPA assets, cached on disk.
  *
@@ -16,12 +17,53 @@
  * The first request for a given file still pays the compression, exactly as
  * every request does today. Every request after it pays nothing.
  */
-import * as fs from 'node:fs';
-import * as fsp from 'node:fs/promises';
-import * as path from 'node:path';
-import { brotliCompress, constants as zlibConstants } from 'node:zlib';
-import { promisify } from 'node:util';
-const brotli = promisify(brotliCompress);
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.acceptsBrotli = acceptsBrotli;
+exports.isCompressibleAsset = isCompressibleAsset;
+exports.resolvePrecompressedAsset = resolvePrecompressedAsset;
+exports.warmPrecompressedAssets = warmPrecompressedAssets;
+exports.resetPrecompressedWarning = resetPrecompressedWarning;
+exports.precompressedTempPath = precompressedTempPath;
+exports.precompressedSiblingExists = precompressedSiblingExists;
+const fs = __importStar(require("node:fs"));
+const fsp = __importStar(require("node:fs/promises"));
+const path = __importStar(require("node:path"));
+const node_zlib_1 = require("node:zlib");
+const node_util_1 = require("node:util");
+const brotli = (0, node_util_1.promisify)(node_zlib_1.brotliCompress);
 /** Below this, the framing costs more than the compression saves — the same
  *  threshold `@fastify/compress` is registered with. */
 const MIN_BYTES = 1024;
@@ -35,12 +77,12 @@ const inFlight = new Map();
  *  error to repeat on every asset. */
 let warnedUnwritable = false;
 /** Does the client accept brotli? */
-export function acceptsBrotli(acceptEncoding) {
+function acceptsBrotli(acceptEncoding) {
     if (acceptEncoding === undefined)
         return false;
     return /\bbr\b/.test(acceptEncoding);
 }
-export function isCompressibleAsset(relOrAbs) {
+function isCompressibleAsset(relOrAbs) {
     return COMPRESSIBLE.test(relOrAbs);
 }
 /**
@@ -66,8 +108,8 @@ async function compressToDisk(filePath, brPath, log) {
             params: {
                 // Quality 11 is worth it BECAUSE this runs once. The per-request path
                 // could never afford it, which is why it was set to 4.
-                [zlibConstants.BROTLI_PARAM_QUALITY]: 11,
-                [zlibConstants.BROTLI_PARAM_SIZE_HINT]: raw.byteLength,
+                [node_zlib_1.constants.BROTLI_PARAM_QUALITY]: 11,
+                [node_zlib_1.constants.BROTLI_PARAM_SIZE_HINT]: raw.byteLength,
             },
         });
         // Write via a temp file + rename so a concurrent reader never sees a
@@ -100,7 +142,7 @@ async function compressToDisk(filePath, brPath, log) {
  * cache could not be written. The caller then serves exactly what it served
  * before, so this can only ever be an optimisation.
  */
-export async function resolvePrecompressedAsset(filePath, acceptEncoding, log) {
+async function resolvePrecompressedAsset(filePath, acceptEncoding, log) {
     const plain = { filePath, encoding: null };
     if (!acceptsBrotli(acceptEncoding) || !isCompressibleAsset(filePath))
         return plain;
@@ -141,7 +183,7 @@ export async function resolvePrecompressedAsset(filePath, acceptEncoding, log) {
  * a page load faster would be a bad trade. Failures are silent here — the
  * request path logs them if it ever hits one.
  */
-export function warmPrecompressedAssets(root, log) {
+function warmPrecompressedAssets(root, log) {
     void (async () => {
         let warmed = 0;
         for (const file of await listCompressible(root)) {
@@ -171,7 +213,7 @@ async function listCompressible(dir, out = []) {
     return out;
 }
 /** Test seam — the "read-only dist" warning is once per process. */
-export function resetPrecompressedWarning() {
+function resetPrecompressedWarning() {
     warnedUnwritable = false;
 }
 /**
@@ -180,10 +222,10 @@ export function resetPrecompressedWarning() {
  * root, which is what CI runs as, and the test that relied on it produced a
  * `.br` in a "read-only" directory (2026-09-23).
  */
-export function precompressedTempPath(brPath) {
+function precompressedTempPath(brPath) {
     return `${brPath}.${String(process.pid)}.tmp`;
 }
 /** Synchronous existence probe used by the callers' own guards. */
-export function precompressedSiblingExists(filePath) {
+function precompressedSiblingExists(filePath) {
     return fs.existsSync(`${filePath}.br`);
 }

package/dist/api/static/spa-mount.js

@@ -1,3 +1,42 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FORWARDED_PREFIX_HEADER = void 0;
+exports.parseForwardedPrefix = parseForwardedPrefix;
+exports.injectSpaMount = injectSpaMount;
+exports.sendSpaShell = sendSpaShell;
 /**
  * spa-mount — serving the admin-UI shell under a reverse-proxy path prefix.
  *
@@ -15,10 +54,10 @@
  *
  * Without the header nothing changes — the shell is served exactly as before.
  */
-import * as fs from 'node:fs/promises';
-import { spaShellCacheControl } from './spa-static';
+const fs = __importStar(require("node:fs/promises"));
+const spa_static_1 = require("./spa-static");
 /** Node lower-cases incoming header names. */
-export const FORWARDED_PREFIX_HEADER = 'x-forwarded-prefix';
+exports.FORWARDED_PREFIX_HEADER = 'x-forwarded-prefix';
 /** The canonical spelling, for `Vary`. */
 const FORWARDED_PREFIX_VARY = 'X-Forwarded-Prefix';
 const MOUNT_META_NAME = 'camstack-mount';
@@ -34,7 +73,7 @@ const MAX_PREFIX_LENGTH = 512;
  * an attribute. Invalid is treated as absent — a relay that gets this wrong
  * gets the root shell, never a 4xx and never a partial injection.
  */
-export function parseForwardedPrefix(value) {
+function parseForwardedPrefix(value) {
     if (typeof value !== 'string')
         return null;
     if (value.length === 0 || value.length > MAX_PREFIX_LENGTH)
@@ -61,7 +100,7 @@ export function parseForwardedPrefix(value) {
  * relative build shipped, and only the root worked (operator, 2026-09-07).
  * A root mount is therefore `<base href="/">`, not "no base at all".
  */
-export function injectSpaMount(html, prefix) {
+function injectSpaMount(html, prefix) {
     const match = /<head(?:\s[^>]*)?>/i.exec(html);
     if (match === null)
         return html;
@@ -75,8 +114,8 @@ export function injectSpaMount(html, prefix) {
  * `Vary: X-Forwarded-Prefix` — a cache that ignores `no-store` must still
  * never hand a root shell to a relayed request or vice versa.
  */
-export async function sendSpaShell(reply, indexPath, headers) {
-    reply.header('cache-control', spaShellCacheControl());
+async function sendSpaShell(reply, indexPath, headers) {
+    reply.header('cache-control', (0, spa_static_1.spaShellCacheControl)());
     reply.header('vary', FORWARDED_PREFIX_VARY);
     let html;
     try {
@@ -88,6 +127,6 @@ export async function sendSpaShell(reply, indexPath, headers) {
     }
     // `''` is the root mount: `injectSpaMount` writes `<base href="/">`, which a
     // relative-asset shell needs at every depth. Never "no base".
-    const prefix = parseForwardedPrefix(headers[FORWARDED_PREFIX_HEADER]) ?? '';
+    const prefix = parseForwardedPrefix(headers[exports.FORWARDED_PREFIX_HEADER]) ?? '';
     return reply.type('text/html').send(injectSpaMount(html, prefix));
 }

package/dist/api/static/spa-static.js

@@ -1,3 +1,4 @@
+"use strict";
 /**
  * spa-static — shared static-serving helpers for the SPAs the hub mounts
  * (admin-ui at `/`, viewer-ui at `/viewer/camstack`). Extracted so both
@@ -5,6 +6,12 @@
  * immutable; the service worker / registration / web manifest + the SPA shell
  * (`index.html`) always revalidate so a redeploy actually reaches clients.
  */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.spaShellCacheControl = spaShellCacheControl;
+exports.spaAssetCacheControl = spaAssetCacheControl;
+exports.addonBundleCacheControl = addonBundleCacheControl;
+exports.contentTypeForPath = contentTypeForPath;
+exports.isRetiredPublicPath = isRetiredPublicPath;
 /**
  * Cache-Control for the SPA SHELL (`index.html`) — the HTML entry only, never a
  * hashed asset.
@@ -22,7 +29,7 @@
  * send the shell with NO header at all, which is where the stale copies came
  * from.
  */
-export function spaShellCacheControl() {
+function spaShellCacheControl() {
     return 'no-store';
 }
 /**
@@ -37,7 +44,7 @@ export function spaShellCacheControl() {
  *     so the same bytes never carry two different policies.
  *   - Everything else (favicon, non-hashed files) → `no-cache`.
  */
-export function spaAssetCacheControl(rel) {
+function spaAssetCacheControl(rel) {
     const base = rel.split('/').pop() ?? rel;
     if (/^(sw\.js|registerSW\.js|workbox-.*\.js|manifest\.webmanifest)$/.test(base)) {
         return 'no-cache, must-revalidate';
@@ -66,7 +73,7 @@ export function spaAssetCacheControl(rel) {
  * until a manual hard-reload. Unknown fixed names now revalidate — the
  * cost is a cheap 304.
  */
-export function addonBundleCacheControl(filePath) {
+function addonBundleCacheControl(filePath) {
     const base = filePath.split('/').pop() ?? filePath;
     // Vite/rolldown content hash: exactly 8 base64url chars between a
     // hyphen and the extension (`dist-CYZr2fwk.mjs`, `….js-CQ-aEQ9b.mjs`).
@@ -107,14 +114,14 @@ const CONTENT_TYPES = {
  * assets directly (the admin-ui path goes through @fastify/static). Defaults
  * to `application/octet-stream` for unknown extensions.
  */
-export function contentTypeForPath(pathname) {
+function contentTypeForPath(pathname) {
     const base = pathname.split('/').pop() ?? pathname;
     const dot = base.lastIndexOf('.');
     const ext = dot >= 0 ? base.slice(dot + 1).toLowerCase() : '';
     return CONTENT_TYPES[ext] ?? 'application/octet-stream';
 }
 /** Paths intentionally retired instead of falling through to the admin SPA. */
-export function isRetiredPublicPath(url) {
+function isRetiredPublicPath(url) {
     const pathname = url.split('?')[0] ?? url;
     return (pathname === '/addon/stream-broker/embed' || pathname.startsWith('/addon/stream-broker/embed/'));
 }

package/dist/api/tarball-manifest.js

@@ -1,14 +1,51 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isTarballFilename = isTarballFilename;
+exports.readTarballManifest = readTarballManifest;
 /**
  * npm-pack tarball manifest inspection — shared by the addon upload route
  * (`/api/addons/upload`) and the dev server-deploy upload route
  * (`/api/server-upload`).
  */
-import { execFileSync } from 'node:child_process';
-import * as fs from 'node:fs';
-import * as os from 'node:os';
-import * as path from 'node:path';
+const node_child_process_1 = require("node:child_process");
+const fs = __importStar(require("node:fs"));
+const os = __importStar(require("node:os"));
+const path = __importStar(require("node:path"));
 const TARBALL_EXTENSIONS = ['.tgz', '.tar.gz'];
-export function isTarballFilename(filename) {
+function isTarballFilename(filename) {
     return TARBALL_EXTENSIONS.some((ext) => filename.endsWith(ext));
 }
 /**
@@ -23,12 +60,12 @@ export function isTarballFilename(filename) {
  * fixed inner path. Returns null (not throw) on malformed archives so
  * the caller can surface a precise 400 response.
  */
-export function readTarballManifest(buffer, filename) {
+function readTarballManifest(buffer, filename) {
     const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'camstack-tarball-check-'));
     const tgzPath = path.join(tmpDir, path.basename(filename));
     try {
         fs.writeFileSync(tgzPath, buffer);
-        const output = execFileSync('tar', ['-xzO', '-f', tgzPath, 'package/package.json'], {
+        const output = (0, node_child_process_1.execFileSync)('tar', ['-xzO', '-f', tgzPath, 'package/package.json'], {
             timeout: 5_000,
             stdio: ['ignore', 'pipe', 'ignore'],
         });