@camstack/server 1.2.594 → 1.2.595

package/dist/api/trpc/core-cap-bridge.js

@@ -1,3 +1,4 @@
+"use strict";
 /**
  * Core-capability mesh bridge.
  *
@@ -16,13 +17,22 @@
  * service mounted on the hub node, `brokerTransportLink` resolves and
  * routes the call exactly like any addon-provided cap.
  */
-import { createCoreCapService } from '@camstack/system';
-import { Errors } from 'moleculer';
-import { authorizeRemoteUpdatePackage, } from './remote-addon-update-grant.js';
-import { getHttpRequestCensus } from './http-request-census.singleton.js';
-import { HUB_SERVICE_CAP_NAMES, capNameToNamespace } from './server-provided-caps.js';
-import { createMeshTrpcContext } from './trpc.context.js';
-import { createCallerFactory } from './trpc.middleware.js';
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.REMOTE_PRIVILEGE_LOG_ONLY = exports.REMOTE_UPDATE_PACKAGE_PATH = exports.REMOTE_PRIVILEGE_ALLOWLIST = exports.CORE_CAP_REMOTE_FORBIDDEN_TYPE = exports.REMOTE_DENIED_NAMESPACES = void 0;
+exports.setRemotePrivilegeLogSink = setRemotePrivilegeLogSink;
+exports.__resetRemotePrivilegeObservationForTests = __resetRemotePrivilegeObservationForTests;
+exports.observeRemotePrivilege = observeRemotePrivilege;
+exports.observeRemotePrivilegeRefused = observeRemotePrivilegeRefused;
+exports.isCoreServiceCapName = isCoreServiceCapName;
+exports.describeMeshOrigin = describeMeshOrigin;
+exports.buildCoreCapService = buildCoreCapService;
+const system_1 = require("@camstack/system");
+const moleculer_1 = require("moleculer");
+const remote_addon_update_grant_js_1 = require("./remote-addon-update-grant.js");
+const http_request_census_singleton_js_1 = require("./http-request-census.singleton.js");
+const server_provided_caps_js_1 = require("./server-provided-caps.js");
+const trpc_context_js_1 = require("./trpc.context.js");
+const trpc_middleware_js_1 = require("./trpc.middleware.js");
 /**
  * appRouter namespaces that back the CORE API surface and must be
  * reachable cross-process: every server-provided hub-service cap
@@ -44,7 +54,7 @@ import { createCallerFactory } from './trpc.middleware.js';
  */
 const CORE_NAMESPACES = new Set([
     // Service-backed cap routers (no addon provider) — derived, never copied.
-    ...HUB_SERVICE_CAP_NAMES.map(capNameToNamespace),
+    ...server_provided_caps_js_1.HUB_SERVICE_CAP_NAMES.map(server_provided_caps_js_1.capNameToNamespace),
     // Hand-written single-impl core routers.
     'capabilities',
     'notifications',
@@ -61,18 +71,18 @@ const CORE_NAMESPACES = new Set([
  * (they read their own settings through the settings door), so refusing them
  * to an agent costs nothing and takes them off the LAN.
  */
-export const REMOTE_DENIED_NAMESPACES = new Set([
+exports.REMOTE_DENIED_NAMESPACES = new Set([
     'logs',
     'addonSettingsRaw',
 ]);
 /** Moleculer error `type` of a bridged call another node may not make. */
-export const CORE_CAP_REMOTE_FORBIDDEN_TYPE = 'CORE_CAP_REMOTE_FORBIDDEN';
+exports.CORE_CAP_REMOTE_FORBIDDEN_TYPE = 'CORE_CAP_REMOTE_FORBIDDEN';
 /**
  * Hub-core procedure paths another node may call after {@link REMOTE_DENIED_NAMESPACES}.
  * Seeded from armed transport census on the live hub (2026-10): remote agents
  * (`mesh:<agent>`) called none of these; hub runners used this surface only.
  */
-export const REMOTE_PRIVILEGE_ALLOWLIST = new Set([
+exports.REMOTE_PRIVILEGE_ALLOWLIST = new Set([
     'addons.listCapabilityProviders',
     'nodes.topology',
     'integrations.getByAddonId',
@@ -82,20 +92,20 @@ export const REMOTE_PRIVILEGE_ALLOWLIST = new Set([
     'system.getSiteLocation',
 ]);
 /** The one path outside the allowlist a node may call, under {@link authorizeRemoteUpdatePackage}. */
-export const REMOTE_UPDATE_PACKAGE_PATH = 'addons.updatePackage';
+exports.REMOTE_UPDATE_PACKAGE_PATH = 'addons.updatePackage';
 /**
  * When true, remote bridged calls outside {@link REMOTE_PRIVILEGE_ALLOWLIST} are
  * logged once per `(nodeId, path)` per process — still admin, not refused.
  */
-export const REMOTE_PRIVILEGE_LOG_ONLY = false;
+exports.REMOTE_PRIVILEGE_LOG_ONLY = false;
 let remotePrivilegeLogSink = null;
 /** Attach the warn sink used by {@link observeRemotePrivilege}. */
-export function setRemotePrivilegeLogSink(sink) {
+function setRemotePrivilegeLogSink(sink) {
     remotePrivilegeLogSink = sink;
 }
 const remotePrivilegeObserved = new Set();
 /** Clears dedupe state and the sink — tests only. */
-export function __resetRemotePrivilegeObservationForTests() {
+function __resetRemotePrivilegeObservationForTests() {
     remotePrivilegeObserved.clear();
     remotePrivilegeLogSink = null;
 }
@@ -115,8 +125,8 @@ function warnRemotePrivilegeOnce(nodeId, path, message) {
  * One warn per `(nodeId, path)` while {@link REMOTE_PRIVILEGE_LOG_ONLY} is on.
  * Call only after {@link REMOTE_DENIED_NAMESPACES} has passed.
  */
-export function observeRemotePrivilege(nodeId, path) {
-    if (!REMOTE_PRIVILEGE_LOG_ONLY)
+function observeRemotePrivilege(nodeId, path) {
+    if (!exports.REMOTE_PRIVILEGE_LOG_ONLY)
         return;
     warnRemotePrivilegeOnce(nodeId, path, `mesh privilege: node:${nodeId} called ${path} (log-only; still allowed)`);
 }
@@ -124,7 +134,7 @@ export function observeRemotePrivilege(nodeId, path) {
  * One warn per `(nodeId, path)` when enforcement refuses a path not on
  * {@link REMOTE_PRIVILEGE_ALLOWLIST}. Call immediately before throwing.
  */
-export function observeRemotePrivilegeRefused(nodeId, path) {
+function observeRemotePrivilegeRefused(nodeId, path) {
     warnRemotePrivilegeOnce(nodeId, path, `mesh privilege: node:${nodeId} called ${path} (refused; not on grant)`);
 }
 /**
@@ -152,7 +162,7 @@ const CORE_CAP_NAMES = new Set([
  * already-maintained {@link CORE_NAMESPACES} — a new addon cap is covered with
  * zero changes here.
  */
-export function isCoreServiceCapName(capName) {
+function isCoreServiceCapName(capName) {
     return CORE_CAP_NAMES.has(capName);
 }
 function isProcedureNode(value) {
@@ -212,7 +222,7 @@ function countMeshCall(census, path, origin) {
  * principal. Never a token: there is none, the mesh context is trusted by
  * construction (`createMeshTrpcContext`).
  */
-export function describeMeshOrigin(origin) {
+function describeMeshOrigin(origin) {
     const node = origin.nodeId ?? 'unknown';
     return origin.caller === null ? `mesh:${node}` : `mesh:${node} via ${origin.caller}`;
 }
@@ -241,13 +251,13 @@ function resolveInvoker(caller, path) {
  * Each call runs under a principal naming its origin (D802): `mesh` for the
  * hub's own runners, `node:<nodeId>` for another node.
  */
-export function buildCoreCapService(appRouter, census = getHttpRequestCensus(), options = {}) {
-    const callerFactory = createCallerFactory(appRouter);
+function buildCoreCapService(appRouter, census = (0, http_request_census_singleton_js_1.getHttpRequestCensus)(), options = {}) {
+    const callerFactory = (0, trpc_middleware_js_1.createCallerFactory)(appRouter);
     const callers = new Map();
     const callerFor = (principal) => {
         let caller = callers.get(principal);
         if (caller === undefined) {
-            caller = callerFactory(createMeshTrpcContext(principal));
+            caller = callerFactory((0, trpc_context_js_1.createMeshTrpcContext)(principal));
             callers.set(principal, caller);
         }
         return caller;
@@ -272,22 +282,22 @@ export function buildCoreCapService(appRouter, census = getHttpRequestCensus(),
             invoke: async (input, origin) => {
                 countMeshCall(census, path, origin);
                 const remoteNode = remoteOrigin(origin, options.ownNodeId);
-                if (remoteNode !== null && REMOTE_DENIED_NAMESPACES.has(namespace)) {
-                    throw new Errors.MoleculerClientError(`"${path}" is not callable from another node (caller "${remoteNode}")`, 403, CORE_CAP_REMOTE_FORBIDDEN_TYPE);
+                if (remoteNode !== null && exports.REMOTE_DENIED_NAMESPACES.has(namespace)) {
+                    throw new moleculer_1.Errors.MoleculerClientError(`"${path}" is not callable from another node (caller "${remoteNode}")`, 403, exports.CORE_CAP_REMOTE_FORBIDDEN_TYPE);
                 }
                 if (remoteNode !== null) {
-                    if (REMOTE_PRIVILEGE_LOG_ONLY) {
+                    if (exports.REMOTE_PRIVILEGE_LOG_ONLY) {
                         observeRemotePrivilege(remoteNode, path);
                     }
-                    else if (path === REMOTE_UPDATE_PACKAGE_PATH && options.remoteUpdateGrant) {
-                        const decision = await authorizeRemoteUpdatePackage(remoteNode, input, options.remoteUpdateGrant);
+                    else if (path === exports.REMOTE_UPDATE_PACKAGE_PATH && options.remoteUpdateGrant) {
+                        const decision = await (0, remote_addon_update_grant_js_1.authorizeRemoteUpdatePackage)(remoteNode, input, options.remoteUpdateGrant);
                         if (!decision.allowed) {
-                            throw new Errors.MoleculerClientError(`"${path}" refused for caller "${remoteNode}": ${decision.reason ?? 'not permitted'}`, 403, CORE_CAP_REMOTE_FORBIDDEN_TYPE);
+                            throw new moleculer_1.Errors.MoleculerClientError(`"${path}" refused for caller "${remoteNode}": ${decision.reason ?? 'not permitted'}`, 403, exports.CORE_CAP_REMOTE_FORBIDDEN_TYPE);
                         }
                     }
-                    else if (!REMOTE_PRIVILEGE_ALLOWLIST.has(path)) {
+                    else if (!exports.REMOTE_PRIVILEGE_ALLOWLIST.has(path)) {
                         observeRemotePrivilegeRefused(remoteNode, path);
-                        throw new Errors.MoleculerClientError(`"${path}" is not on the remote privilege grant (caller "${remoteNode}")`, 403, CORE_CAP_REMOTE_FORBIDDEN_TYPE);
+                        throw new moleculer_1.Errors.MoleculerClientError(`"${path}" is not on the remote privilege grant (caller "${remoteNode}")`, 403, exports.CORE_CAP_REMOTE_FORBIDDEN_TYPE);
                     }
                 }
                 const invoke = resolveInvoker(callerFor(remoteNode === null ? 'mesh' : `node:${remoteNode}`), path);
@@ -297,7 +307,7 @@ export function buildCoreCapService(appRouter, census = getHttpRequestCensus(),
             },
         });
     }
-    return createCoreCapService({ actions });
+    return (0, system_1.createCoreCapService)({ actions });
 }
 /** The calling node when it is not the hub itself; `null` for the hub's own calls. */
 function remoteOrigin(origin, ownNodeId) {

package/dist/api/trpc/device-collection-dispatch.js

@@ -1,3 +1,4 @@
+"use strict";
 /**
  * The per-device COLLECTION dispatcher — a capability whose providers are
  * SOURCES of one device, listed beside each other.
@@ -59,9 +60,12 @@
  * camera with one provider behaves exactly as it did before this mount
  * existed, and it is pinned by spec.
  */
-import { CAP_METHOD_NOT_IMPLEMENTED } from '@camstack/system';
-import { deviceExtensionCapability, EXTENSION_SLOT_LISTING_METHOD, expandCapMethods, isArrayOutputSchema, reservedSourceOwner, unreachableExtensionSlotRow, } from '@camstack/types';
-import { TRPCError } from '@trpc/server';
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SOURCE_LISTING_METHOD = void 0;
+exports.requireDeviceCollection = requireDeviceCollection;
+const system_1 = require("@camstack/system");
+const types_1 = require("@camstack/types");
+const server_1 = require("@trpc/server");
 /**
  * The device-collection CONVENTION: a cap whose providers are sources declares
  * this method, taking `{ deviceId }` and returning one row per source with a
@@ -69,7 +73,7 @@ import { TRPCError } from '@trpc/server';
  * without a second registry of id prefixes — the provider that mints the ids
  * is the one that names them.
  */
-export const SOURCE_LISTING_METHOD = 'listSources';
+exports.SOURCE_LISTING_METHOD = 'listSources';
 /** The field on a source row that carries its id / clip-id namespace. */
 const SOURCE_ID_FIELD = 'source';
 /** The field on a source row that names the addon serving it (D555/D557). */
@@ -215,10 +219,10 @@ function isFanOutMethod(registry, capName, method) {
     const def = registry.getDefinition(capName);
     if (def === undefined)
         return false;
-    const schema = expandCapMethods(def)[method];
+    const schema = (0, types_1.expandCapMethods)(def)[method];
     if (schema === undefined || schema.kind === 'subscription')
         return false;
-    return isArrayOutputSchema(schema.output);
+    return (0, types_1.isArrayOutputSchema)(schema.output);
 }
 function errMessage(err) {
     return err instanceof Error ? err.message : String(err);
@@ -227,7 +231,7 @@ function errMessage(err) {
 async function callSource(source, method, input, capName, deviceId) {
     const fn = source.provider[method];
     if (typeof fn !== 'function') {
-        throw new TRPCError({
+        throw new server_1.TRPCError({
             code: 'NOT_IMPLEMENTED',
             message: notImplementedMessage(capName, source.addonId, deviceId, method),
         });
@@ -242,8 +246,8 @@ async function callSource(source, method, input, capName, deviceId) {
         return await fn.call(source.provider, input);
     }
     catch (err) {
-        if (errMessage(err).includes(CAP_METHOD_NOT_IMPLEMENTED)) {
-            throw new TRPCError({
+        if (errMessage(err).includes(system_1.CAP_METHOD_NOT_IMPLEMENTED)) {
+            throw new server_1.TRPCError({
                 code: 'NOT_IMPLEMENTED',
                 message: notImplementedMessage(capName, source.addonId, deviceId, method),
             });
@@ -328,18 +332,18 @@ function unreachableSourceRow(addonId, reason) {
  * behaviour, D554 decision 6).
  */
 const CAP_FAILURE_ROWS = {
-    [deviceExtensionCapability.name]: {
-        [EXTENSION_SLOT_LISTING_METHOD]: unreachableExtensionSlotRow,
+    [types_1.deviceExtensionCapability.name]: {
+        [types_1.EXTENSION_SLOT_LISTING_METHOD]: types_1.unreachableExtensionSlotRow,
     },
 };
 function failureRowFor(capName, method) {
     const own = CAP_FAILURE_ROWS[capName]?.[method];
     if (own !== undefined)
         return own;
-    return method === SOURCE_LISTING_METHOD ? unreachableSourceRow : null;
+    return method === exports.SOURCE_LISTING_METHOD ? unreachableSourceRow : null;
 }
 async function fanOut(sources, method, input, capName, deviceId, logger) {
-    const isSourceListing = method === SOURCE_LISTING_METHOD;
+    const isSourceListing = method === exports.SOURCE_LISTING_METHOD;
     const failureRow = failureRowFor(capName, method);
     const settled = await Promise.allSettled(sources.map(async (source) => await callSource(source, method, input, capName, deviceId)));
     const rows = [];
@@ -399,7 +403,7 @@ function finishRows(source, rows, isSourceListing, capName, deviceId, logger) {
         }
         const id = Reflect.get(row, SOURCE_ID_FIELD);
         if (typeof id === 'string') {
-            const owner = reservedSourceOwner(capName, id);
+            const owner = (0, types_1.reservedSourceOwner)(capName, id);
             if (owner !== null && owner !== source.addonId) {
                 // A RESERVED id (D625) is the DEFAULT of a picker, expressed as a
                 // value rather than as a sort order. A second row spelling it would
@@ -409,7 +413,7 @@ function finishRows(source, rows, isSourceListing, capName, deviceId, logger) {
                 // and emptying a camera's picker over one bad row is worse than the
                 // bad row. The guard in `scripts/` refuses the same spelling at build
                 // time; this is what happens when an old build reaches a new hub.
-                logger?.warn(`${capName}.${SOURCE_LISTING_METHOD}: source id "${id}" is RESERVED for "${owner}" — this addon's row is dropped`, {
+                logger?.warn(`${capName}.${exports.SOURCE_LISTING_METHOD}: source id "${id}" is RESERVED for "${owner}" — this addon's row is dropped`, {
                     tags: { deviceId, addonId: source.addonId },
                     meta: { capability: capName, sourceId: id, reservedFor: owner },
                 });
@@ -423,7 +427,7 @@ function finishRows(source, rows, isSourceListing, capName, deviceId, logger) {
 async function claimsOf(sources, capName, deviceId, logger) {
     const claimed = new Map();
     const unknownClaims = [];
-    const settled = await Promise.allSettled(sources.map(async (source) => await callSource(source, SOURCE_LISTING_METHOD, { deviceId }, capName, deviceId)));
+    const settled = await Promise.allSettled(sources.map(async (source) => await callSource(source, exports.SOURCE_LISTING_METHOD, { deviceId }, capName, deviceId)));
     for (const [index, result] of settled.entries()) {
         const source = sources[index];
         if (source === undefined)
@@ -431,7 +435,7 @@ async function claimsOf(sources, capName, deviceId, logger) {
         if (result.status === 'rejected' || !Array.isArray(result.value)) {
             // It could not name its sources, so it cannot be excluded on that basis
             // either — a read that FAILS must not destroy work (D49).
-            logger?.warn(`${capName}.${SOURCE_LISTING_METHOD}: source could not name its ids — routing falls back to it only if it is the only such source`, {
+            logger?.warn(`${capName}.${exports.SOURCE_LISTING_METHOD}: source could not name its ids — routing falls back to it only if it is the only such source`, {
                 tags: { deviceId, addonId: source.addonId },
                 meta: {
                     capability: capName,
@@ -497,7 +501,7 @@ async function dispatchScalar(sources, method, input, capName, deviceId, logger)
         tags: { deviceId },
         meta: { capability: capName, method, knownSources: known, input },
     });
-    throw new TRPCError({
+    throw new server_1.TRPCError({
         code: 'BAD_REQUEST',
         message: `Capability "${capName}.${method}": no source of device ${deviceId} claims ` +
             `${JSON.stringify(input)}. Sources: ${known.length > 0 ? known.join(', ') : '(none named)'}. ` +
@@ -522,7 +526,7 @@ function pinnedProvider(sources, input, capName, deviceId) {
     const picked = sources.filter((source) => source.addonId === pin);
     if (picked.length > 0)
         return picked;
-    throw new TRPCError({
+    throw new server_1.TRPCError({
         code: 'BAD_REQUEST',
         message: `Capability "${capName}": device ${deviceId} is not bound to provider "${pin}". ` +
             `Bound providers: ${sources.map((source) => source.addonId).join(', ') || '(none)'}. ` +
@@ -537,7 +541,7 @@ function pinnedProvider(sources, input, capName, deviceId) {
  * Returns null without a registry (the router then surfaces
  * PRECONDITION_FAILED), exactly as the singleton dispatcher does.
  */
-export function requireDeviceCollection(registry, capName, logger) {
+function requireDeviceCollection(registry, capName, logger) {
     if (!registry)
         return null;
     const dispatcher = new Proxy({}, {
@@ -547,7 +551,7 @@ export function requireDeviceCollection(registry, capName, logger) {
             return async (input) => {
                 const deviceId = input !== null && typeof input === 'object' ? Reflect.get(input, 'deviceId') : undefined;
                 if (typeof deviceId !== 'number') {
-                    throw new TRPCError({
+                    throw new server_1.TRPCError({
                         code: 'BAD_REQUEST',
                         message: `${capName}.${prop}: input must carry numeric "deviceId"`,
                     });
@@ -555,7 +559,7 @@ export function requireDeviceCollection(registry, capName, logger) {
                 const bound = await sourcesForDevice(registry, capName, deviceId, logger);
                 const sources = pinnedProvider(bound, input, capName, deviceId);
                 if (sources.length === 0) {
-                    throw new TRPCError({
+                    throw new server_1.TRPCError({
                         code: 'PRECONDITION_FAILED',
                         message: `Capability "${capName}" not registered for device ${deviceId}`,
                     });
@@ -576,7 +580,7 @@ export function requireDeviceCollection(registry, capName, logger) {
                         const answered = await callSource(first, prop, input, capName, deviceId);
                         if (!Array.isArray(answered))
                             return answered;
-                        return finishRows(first, answered, prop === SOURCE_LISTING_METHOD, capName, deviceId, logger);
+                        return finishRows(first, answered, prop === exports.SOURCE_LISTING_METHOD, capName, deviceId, logger);
                     }
                     return await fanOut(sources, prop, input, capName, deviceId, logger);
                 }

package/dist/api/trpc/device-config-secret-redaction.js

@@ -1,3 +1,4 @@
+"use strict";
 /**
  * Device-config secret redaction for NON-ADMIN principals.
  *
@@ -38,11 +39,26 @@
  * Pure module — no tRPC machinery — so the spec exercises it directly (same
  * pattern as `scope-access.ts` and `share-view-access.ts`).
  */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NON_ADMIN_CONFIG_REDACTED_METHODS = exports.REDACTED_SECRET = void 0;
+exports.isSecretConfigKey = isSecretConfigKey;
+exports.redactDeviceInfoSecrets = redactDeviceInfoSecrets;
+exports.redactDeviceInfoRecordSecrets = redactDeviceInfoRecordSecrets;
+exports.redactSettingsSections = redactSettingsSections;
+exports.redactSettingsAggregate = redactSettingsAggregate;
+exports.redactSettingsForm = redactSettingsForm;
+exports.redactExportSetup = redactExportSetup;
+exports.redactDeepSecrets = redactDeepSecrets;
+exports.redactStatusAggregateSetup = redactStatusAggregateSetup;
+exports.redactStatusAggregateBatchSetup = redactStatusAggregateBatchSetup;
+exports.redactConfigEntries = redactConfigEntries;
+exports.redactStreamUrlSecrets = redactStreamUrlSecrets;
+exports.maskUrlCredentialsDeep = maskUrlCredentialsDeep;
 /** What a non-admin sees instead of the value. Matches the `***` convention
  *  `maskUrlCredentials` already uses for credentials in log output, so one
  *  redaction marker means one thing across the system. */
-import { maskUrlCredentials } from '@camstack/types';
-export const REDACTED_SECRET = '***';
+const types_1 = require("@camstack/types");
+exports.REDACTED_SECRET = '***';
 /**
  * Config keys whose VALUE is a credential.
  *
@@ -63,7 +79,7 @@ const SECRET_KEY_SUBSTRINGS = [
     'api_key',
 ];
 /** True when a config key names a credential. Case-insensitive substring match. */
-export function isSecretConfigKey(key) {
+function isSecretConfigKey(key) {
     const lower = key.toLowerCase();
     return SECRET_KEY_SUBSTRINGS.some((needle) => lower.includes(needle));
 }
@@ -87,7 +103,7 @@ function declaredPathsOf(row) {
 /** Withhold every non-empty string at or below `value` (a declared secret node). */
 function withholdAll(value) {
     if (typeof value === 'string')
-        return value.length > 0 ? REDACTED_SECRET : value;
+        return value.length > 0 ? exports.REDACTED_SECRET : value;
     if (Array.isArray(value))
         return value.map(withholdAll);
     if (!isRecord(value))
@@ -124,7 +140,7 @@ function withholdPath(value, segments) {
  */
 function backstop(value) {
     if (typeof value === 'string') {
-        return value.includes('://') ? maskUrlCredentials(value) : value;
+        return value.includes('://') ? (0, types_1.maskUrlCredentials)(value) : value;
     }
     if (Array.isArray(value))
         return value.map(backstop);
@@ -134,7 +150,7 @@ function backstop(value) {
     for (const [key, child] of Object.entries(value)) {
         out[key] =
             isSecretConfigKey(key) && typeof child === 'string' && child.length > 0
-                ? REDACTED_SECRET
+                ? exports.REDACTED_SECRET
                 : backstop(child);
     }
     return out;
@@ -158,7 +174,7 @@ function redactConfigBlob(config, declared) {
  * Anything that is not a device row passes through untouched — a route that
  * errored upstream must not be rewritten into a plausible-looking shape.
  */
-export function redactDeviceInfoSecrets(data) {
+function redactDeviceInfoSecrets(data) {
     if (Array.isArray(data))
         return data.map((row) => redactDeviceInfoSecrets(row));
     if (!isRecord(data))
@@ -177,7 +193,7 @@ export function redactDeviceInfoSecrets(data) {
  * its own, so the function returns early having redacted nothing. A batch of a
  * single-device read must never be the ungated way to ask the same question.
  */
-export function redactDeviceInfoRecordSecrets(data) {
+function redactDeviceInfoRecordSecrets(data) {
     if (!isRecord(data))
         return data;
     const out = {};
@@ -189,7 +205,7 @@ export function redactDeviceInfoRecordSecrets(data) {
  * Project a `SettingsSchemaWithValues` (`{ sections: [{ fields: [...] }] }`).
  * Used by `getDeviceSettingsAggregate` and `getSettingsSchema`.
  */
-export function redactSettingsSections(data) {
+function redactSettingsSections(data) {
     if (!isRecord(data))
         return data;
     const sections = data['sections'];
@@ -214,7 +230,7 @@ export function redactSettingsSections(data) {
  * Project the combined aggregate, whose settings live one level down under
  * `settings`. The live half carries no config blob.
  */
-export function redactSettingsAggregate(data) {
+function redactSettingsAggregate(data) {
     if (!isRecord(data))
         return data;
     const settings = data['settings'];
@@ -259,8 +275,8 @@ function redactFormValue(value, secret, itemFields) {
         if (value.length === 0)
             return value;
         if (secret)
-            return REDACTED_SECRET;
-        return value.includes('://') ? maskUrlCredentials(value) : value;
+            return exports.REDACTED_SECRET;
+        return value.includes('://') ? (0, types_1.maskUrlCredentials)(value) : value;
     }
     if (Array.isArray(value))
         return value.map((el) => redactFormValue(el, secret, itemFields));
@@ -302,7 +318,7 @@ function redactFormField(field) {
     // The HomeKit QR caption spells the setup code out in prose.
     const caption = field['caption'];
     return field['type'] === 'qr-code' && typeof caption === 'string' && caption.length > 0
-        ? { ...redacted, caption: REDACTED_SECRET }
+        ? { ...redacted, caption: exports.REDACTED_SECRET }
         : redacted;
 }
 /**
@@ -319,7 +335,7 @@ function redactFormField(field) {
  * and `updateGlobalSettings` / `updateDeviceSettings` are admin-only, so a
  * redacted value can never be written back (D634).
  */
-export function redactSettingsForm(data) {
+function redactSettingsForm(data) {
     if (!isRecord(data))
         return data;
     const sections = data['sections'];
@@ -344,7 +360,7 @@ export function redactSettingsForm(data) {
  * panel renders it, so a non-admin keeps the link state and counts and never
  * receives the block (D634 r2). One object or a fanned-out array.
  */
-export function redactExportSetup(data) {
+function redactExportSetup(data) {
     if (Array.isArray(data))
         return data.map((row) => redactExportSetup(row));
     if (!isRecord(data) || !('setup' in data))
@@ -359,7 +375,7 @@ export function redactExportSetup(data) {
  * `access_token` and `?token=` picture URLs), an integration's `info`, a
  * broker list's `url` (D634 r3).
  */
-export function redactDeepSecrets(data) {
+function redactDeepSecrets(data) {
     return redactFormValue(data, false, undefined);
 }
 /** The status-aggregate entry that carries export pairing material. */
@@ -369,13 +385,13 @@ const DEVICE_EXPORT_CAP = 'device-export';
  * `device-export` entry loses its `setup` (D634 r3 — defence in depth; the
  * aggregation itself no longer asks a system collection cap per device).
  */
-export function redactStatusAggregateSetup(data) {
+function redactStatusAggregateSetup(data) {
     if (!isRecord(data) || !(DEVICE_EXPORT_CAP in data))
         return data;
     return { ...data, [DEVICE_EXPORT_CAP]: redactExportSetup(data[DEVICE_EXPORT_CAP]) };
 }
 /** Project a batch status aggregate (`Record<deviceId, Record<capName, status>>`). */
-export function redactStatusAggregateBatchSetup(data) {
+function redactStatusAggregateBatchSetup(data) {
     if (!isRecord(data))
         return data;
     const out = {};
@@ -385,7 +401,7 @@ export function redactStatusAggregateBatchSetup(data) {
     return out;
 }
 /** Project a flat `ConfigEntry[]` — `getConfigSchema`'s `{ key, value }` rows. */
-export function redactConfigEntries(data) {
+function redactConfigEntries(data) {
     if (!Array.isArray(data))
         return data;
     return data.map(redactFormField);
@@ -412,7 +428,7 @@ const URL_FIELD_KEYS = ['url', 'mutedUrl'];
  * (`codec`, `label`) and a non-string value pass through. Non-row payloads
  * pass through untouched — an upstream error must not be rewritten.
  */
-export function redactStreamUrlSecrets(data) {
+function redactStreamUrlSecrets(data) {
     if (Array.isArray(data))
         return data.map((row) => redactStreamUrlSecrets(row));
     if (!isRecord(data))
@@ -421,7 +437,7 @@ export function redactStreamUrlSecrets(data) {
     for (const [key, value] of Object.entries(data)) {
         out[key] =
             URL_FIELD_KEYS.includes(key) && typeof value === 'string' && value.length > 0
-                ? maskUrlCredentials(value)
+                ? (0, types_1.maskUrlCredentials)(value)
                 : value;
     }
     return out;
@@ -435,9 +451,9 @@ export function redactStreamUrlSecrets(data) {
  * any non-admin (D783). Only strings holding `://` are touched; no key is
  * judged by its name here, so `eventTypeTokens` & co. keep their values.
  */
-export function maskUrlCredentialsDeep(data) {
+function maskUrlCredentialsDeep(data) {
     if (typeof data === 'string')
-        return data.includes('://') ? maskUrlCredentials(data) : data;
+        return data.includes('://') ? (0, types_1.maskUrlCredentials)(data) : data;
     if (Array.isArray(data))
         return data.map(maskUrlCredentialsDeep);
     if (!isRecord(data))
@@ -464,7 +480,7 @@ export function maskUrlCredentialsDeep(data) {
  * `device-config-secret-redaction.spec.ts` pins the list so the addition is a
  * failing test rather than a silent leak.
  */
-export const NON_ADMIN_CONFIG_REDACTED_METHODS = new Map([
+exports.NON_ADMIN_CONFIG_REDACTED_METHODS = new Map([
     // ── Addon settings forms (D634) — hydrated with the STORED secret ──
     ['addonSettings.getGlobalSettings', redactSettingsForm],
     ['addonSettings.getIntegrationSettings', redactSettingsForm],