@camstack/server 1.2.594 → 1.2.595

package/dist/api/trpc/trpc.context.js

@@ -1,9 +1,14 @@
-import { ADMIN_TOKEN_PREFIX, getUserManagementInternal } from '@camstack/system';
-import { classifyBearerPrincipal, normalizeTokenScopes } from '@camstack/types';
-import { DEFAULT_AUTH_NETWORK_POLICY } from '../../auth/auth-network-policy.js';
-import { SHARE_TOKEN_PREFIX, } from '../../core/auth/share-token.service.js';
-import { requestLangInputFrom, resolveRequestLang } from '../../i18n/request-lang.js';
-import { readCredentialIdentity } from './trpc-error-principal.js';
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createMeshTrpcContext = createMeshTrpcContext;
+exports.createTrpcContext = createTrpcContext;
+exports.createWsTrpcContext = createWsTrpcContext;
+const system_1 = require("@camstack/system");
+const types_1 = require("@camstack/types");
+const auth_network_policy_js_1 = require("../../auth/auth-network-policy.js");
+const share_token_service_js_1 = require("../../core/auth/share-token.service.js");
+const request_lang_js_1 = require("../../i18n/request-lang.js");
+const trpc_error_principal_js_1 = require("./trpc-error-principal.js");
 /**
  * Live-scope refresh memo (see the JWT branch of `resolveUser`).
  *
@@ -31,7 +36,7 @@ async function refreshScopesFromStore(userId, addonRegistry) {
             ? (await userMgmt.listUsers()).find((u) => u.id === userId)
             : null;
         if (fresh)
-            scopes = normalizeTokenScopes(fresh.scopes ?? []);
+            scopes = (0, types_1.normalizeTokenScopes)(fresh.scopes ?? []);
     }
     catch {
         scopes = null;
@@ -87,7 +92,7 @@ function extractTokenFromRequest(req) {
 function requestFacts(req) {
     if (req === undefined)
         return {};
-    const ip = DEFAULT_AUTH_NETWORK_POLICY.clientAddress(req).ip;
+    const ip = auth_network_policy_js_1.DEFAULT_AUTH_NETWORK_POLICY.clientAddress(req).ip;
     const url = req.url;
     const path = typeof url === 'string' ? url.split('?')[0] : undefined;
     return { ...(path !== undefined ? { path } : {}), ...(ip !== null ? { ip } : {}) };
@@ -98,7 +103,7 @@ function requestFacts(req) {
  * an admin, not revoked, not expired) is local-auth's (`AdminTokenManager`).
  */
 async function resolveAdminToken(token, addonRegistry, facts) {
-    const internal = getUserManagementInternal(addonRegistry.getCapabilityRegistry().getSingleton('user-management'));
+    const internal = (0, system_1.getUserManagementInternal)(addonRegistry.getCapabilityRegistry().getSingleton('user-management'));
     if (internal === null)
         return null;
     const record = await internal.adminTokens.validate(token).catch(() => null);
@@ -128,13 +133,13 @@ async function resolveAdminToken(token, addonRegistry, facts) {
 async function resolveUser(token, authService, addonRegistry, shareTokens = null, logger = null, facts = {}) {
     if (!token)
         return null;
-    if (token.startsWith(ADMIN_TOKEN_PREFIX))
+    if (token.startsWith(system_1.ADMIN_TOKEN_PREFIX))
         return resolveAdminToken(token, addonRegistry, facts);
     // Share-token path (`csv_*`): resolve through the ShareTokenService.
     // The synthetic principal is maximally restricted — non-admin, no
     // scopes; the `shareView` grant routes it into the fail-closed
     // allowlist in `protectedProcedure` instead of the scope matcher.
-    if (token.startsWith(SHARE_TOKEN_PREFIX)) {
+    if (token.startsWith(share_token_service_js_1.SHARE_TOKEN_PREFIX)) {
         if (!shareTokens)
             return null;
         try {
@@ -186,7 +191,7 @@ async function resolveUser(token, authService, addonRegistry, shareTokens = null
                 isScoped: true,
                 // Migrate any v2 `device:targets` grant to a v3 selector at the
                 // boundary so the enforcement matcher only ever sees v3.
-                scopes: normalizeTokenScopes(record.scopes),
+                scopes: (0, types_1.normalizeTokenScopes)(record.scopes),
             };
         }
         catch {
@@ -207,7 +212,7 @@ async function resolveUser(token, authService, addonRegistry, shareTokens = null
         }
         // What the token IS decides both WHETHER it authenticates at all and
         // WHERE its scopes come from.
-        const principal = classifyBearerPrincipal(payload);
+        const principal = (0, types_1.classifyBearerPrincipal)(payload);
         // ── The allowlist ────────────────────────────────────────────────
         // Every token this hub mints verifies under the same `auth.jwtSecret`, so
         // `verifyToken` succeeding means "we minted this", never "this is an API
@@ -239,7 +244,7 @@ async function resolveUser(token, authService, addonRegistry, shareTokens = null
         // What the token says it IS. An `oauth-access` token is an account link,
         // and until this was carried onto the principal a refusal of one was
         // indistinguishable in the logs from a refusal of a browser session.
-        const credential = readCredentialIdentity(payload);
+        const credential = (0, trpc_error_principal_js_1.readCredentialIdentity)(payload);
         return {
             id: payload.userId ?? 'unknown',
             username: payload.username ?? 'unknown',
@@ -275,7 +280,7 @@ async function resolveUser(token, authService, addonRegistry, shareTokens = null
             // Assistant grant with `[]` and the hub refused the component's first
             // call with `Have: (none)` (2026-08-19). The user store knows nothing
             // about a link and must not get a vote on one.
-            ...(payload.scopes !== undefined ? { scopes: normalizeTokenScopes(payload.scopes) } : {}),
+            ...(payload.scopes !== undefined ? { scopes: (0, types_1.normalizeTokenScopes)(payload.scopes) } : {}),
             ...(!payload.isAdmin && principal.kind === 'session'
                 ? await (async () => {
                     const fresh = await refreshScopesFromStore(payload.userId ?? 'unknown', addonRegistry);
@@ -326,7 +331,7 @@ function makeDeviceScopeLookup(addonRegistry) {
  * next step once the mesh census has measured what each node calls (D802).
  * There is no HTTP request behind the call.
  */
-export function createMeshTrpcContext(principal = 'mesh') {
+function createMeshTrpcContext(principal = 'mesh') {
     const user = {
         id: principal,
         username: principal,
@@ -337,12 +342,12 @@ export function createMeshTrpcContext(principal = 'mesh') {
     return { user };
 }
 /** Context factory for HTTP tRPC requests (Fastify adapter). */
-export async function createTrpcContext(req, authService, addonRegistry, shareTokens = null, logger = null) {
+async function createTrpcContext(req, authService, addonRegistry, shareTokens = null, logger = null) {
     const token = extractTokenFromRequest(req);
     return {
         user: await resolveUser(token, authService, addonRegistry, shareTokens, logger, requestFacts(req)),
         req,
-        lang: resolveRequestLang(requestLangInputFrom(req.headers, readQuery(req))),
+        lang: (0, request_lang_js_1.resolveRequestLang)((0, request_lang_js_1.requestLangInputFrom)(req.headers, readQuery(req))),
         deviceScopeLookup: makeDeviceScopeLookup(addonRegistry),
         deviceFleet: () => addonRegistry.getPersistedDeviceList(),
     };
@@ -352,7 +357,7 @@ export async function createTrpcContext(req, authService, addonRegistry, shareTo
  * Token is sent via tRPC connectionParams (a JSON message sent right after
  * the WS handshake), which is more reliable than query params through proxies.
  */
-export async function createWsTrpcContext(opts, authService, addonRegistry, shareTokens = null, logger = null) {
+async function createWsTrpcContext(opts, authService, addonRegistry, shareTokens = null, logger = null) {
     // 1. connectionParams.token (sent by BackendClient's createWSClient)
     const paramToken = opts.info.connectionParams?.['token'];
     const token = (typeof paramToken === 'string' ? paramToken : null) ?? extractTokenFromRequest(opts.req);
@@ -361,7 +366,7 @@ export async function createWsTrpcContext(opts, authService, addonRegistry, shar
     return {
         user,
         req: opts.req,
-        lang: resolveRequestLang(requestLangInputFrom(opts.req.headers, readQuery(opts.req), opts.info.connectionParams?.['lang'])),
+        lang: (0, request_lang_js_1.resolveRequestLang)((0, request_lang_js_1.requestLangInputFrom)(opts.req.headers, readQuery(opts.req), opts.info.connectionParams?.['lang'])),
         ...(user === null && token !== null && token !== '' ? { credentialRejected: true } : {}),
         ...(user !== null && sessionId !== undefined
             ? {

package/dist/api/trpc/trpc.middleware.js

@@ -1,17 +1,25 @@
-import { getCatalogRegistry, METHOD_ACCESS_MAP } from '@camstack/system';
-import { DEFAULT_CATALOG_LANG, localizeConfigTree } from '@camstack/types';
-import { initTRPC, TRPCError } from '@trpc/server';
-import superjson from 'superjson';
-import { formatTrpcError } from './cap-route-error-formatter.js';
-import { NON_ADMIN_CONFIG_REDACTED_METHODS } from './device-config-secret-redaction.js';
-import { projectListAllForPrincipal } from './principal-visibility.js';
-import { LOCALIZED_SCHEMA_PATHS } from './localized-schema-paths.js';
-import { checkScopeAccess, DEVICE_ENUMERATION_METHODS } from './scope-access.js';
-import { checkShareViewAccess, projectListAllForShareScope, projectShareScopeRows, SHARE_SCOPE_PROJECTED_METHODS, } from './share-view-access.js';
-import { trpcUserError } from './user-error.js';
-const t = initTRPC.context().create({
-    transformer: superjson,
-    errorFormatter: formatTrpcError,
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.adminProcedure = exports.protectedProcedure = exports.createCallerFactory = exports.publicProcedure = exports.trpcRouter = void 0;
+exports.iterableSubscription = iterableSubscription;
+exports.iterableInterval = iterableInterval;
+const system_1 = require("@camstack/system");
+const types_1 = require("@camstack/types");
+const server_1 = require("@trpc/server");
+const superjson_1 = __importDefault(require("superjson"));
+const cap_route_error_formatter_js_1 = require("./cap-route-error-formatter.js");
+const device_config_secret_redaction_js_1 = require("./device-config-secret-redaction.js");
+const principal_visibility_js_1 = require("./principal-visibility.js");
+const localized_schema_paths_js_1 = require("./localized-schema-paths.js");
+const scope_access_js_1 = require("./scope-access.js");
+const share_view_access_js_1 = require("./share-view-access.js");
+const user_error_js_1 = require("./user-error.js");
+const t = server_1.initTRPC.context().create({
+    transformer: superjson_1.default,
+    errorFormatter: cap_route_error_formatter_js_1.formatTrpcError,
 });
 // ---------------------------------------------------------------------------
 // Async-generator subscription helpers (tRPC v11 — replaces deprecated observable)
@@ -22,7 +30,7 @@ const t = initTRPC.context().create({
  *
  * @param subscribe — called once; receives a `push` callback and must return an unsubscribe fn.
  */
-export async function* iterableSubscription(subscribe) {
+async function* iterableSubscription(subscribe) {
     const queue = [];
     let resolve = null;
     const unsub = subscribe((value) => {
@@ -47,7 +55,7 @@ export async function* iterableSubscription(subscribe) {
  * Create an interval-based async generator that yields a value on each tick.
  * Useful for polling subscriptions.
  */
-export async function* iterableInterval(intervalMs, getValue) {
+async function* iterableInterval(intervalMs, getValue) {
     try {
         while (true) {
             yield getValue();
@@ -66,22 +74,22 @@ export async function* iterableInterval(intervalMs, getValue) {
  */
 const localizeSchemaOutput = t.middleware(async ({ ctx, path, next }) => {
     const out = await next();
-    const lang = ctx.lang ?? DEFAULT_CATALOG_LANG;
-    if (!out.ok || lang === DEFAULT_CATALOG_LANG || !LOCALIZED_SCHEMA_PATHS.has(path))
+    const lang = ctx.lang ?? types_1.DEFAULT_CATALOG_LANG;
+    if (!out.ok || lang === types_1.DEFAULT_CATALOG_LANG || !localized_schema_paths_js_1.LOCALIZED_SCHEMA_PATHS.has(path))
         return out;
-    return { ...out, data: localizeConfigTree(out.data, getCatalogRegistry().lookupFor(lang)) };
+    return { ...out, data: (0, types_1.localizeConfigTree)(out.data, (0, system_1.getCatalogRegistry)().lookupFor(lang)) };
 });
 /** Every authenticated procedure starts from here, so the localizing middleware is the outermost. */
 const localized = t.procedure.use(localizeSchemaOutput);
-export const trpcRouter = t.router;
-export const publicProcedure = t.procedure;
+exports.trpcRouter = t.router;
+exports.publicProcedure = t.procedure;
 /**
  * Server-side caller factory — turns the hub appRouter into a directly
  * invokable record under a supplied `TrpcContext`. The core-cap bridge
  * (`core-cap-bridge.ts`) uses it to expose core routers over the
  * Moleculer mesh without an HTTP round-trip.
  */
-export const createCallerFactory = t.createCallerFactory;
+exports.createCallerFactory = t.createCallerFactory;
 /**
  * Caps-only authenticated procedure (v2).
  *
@@ -102,15 +110,15 @@ export const createCallerFactory = t.createCallerFactory;
  * Single source of authority for caps: `isAdmin`. The legacy role enum
  * collapsed onto this boolean in v2.
  */
-export const protectedProcedure = localized.use(async ({ ctx, next, path, getRawInput }) => {
+exports.protectedProcedure = localized.use(async ({ ctx, next, path, getRawInput }) => {
     if (!ctx.user) {
-        throw new TRPCError({ code: 'UNAUTHORIZED' });
+        throw new server_1.TRPCError({ code: 'UNAUTHORIZED' });
     }
     // A WebSocket resolves its principal once, at connect. Its login session is
     // re-checked on every call, so a logout or revocation ends a socket that is
     // already open — not only the next one.
     if (ctx.sessionLive !== undefined && !ctx.sessionLive()) {
-        throw trpcUserError('UNAUTHORIZED', 'auth.session-ended', undefined, 'Session ended — sign in again');
+        throw (0, user_error_js_1.trpcUserError)('UNAUTHORIZED', 'auth.session-ended', undefined, 'Session ended — sign in again');
     }
     // Share-view principals (`csv_*` tokens) NEVER reach the admin bypass,
     // the hand-written-route pass-through, or the scope matcher below —
@@ -118,9 +126,9 @@ export const protectedProcedure = localized.use(async ({ ctx, next, path, getRaw
     // (`share-view-access.ts`): enumerated methods only, in-scope devices only.
     if (ctx.user.shareView) {
         const rawInput = await getRawInput();
-        const result = checkShareViewAccess(ctx.user.shareView.scope, path, rawInput);
+        const result = (0, share_view_access_js_1.checkShareViewAccess)(ctx.user.shareView.scope, path, rawInput);
         if (!result.ok) {
-            throw new TRPCError({ code: 'FORBIDDEN', message: result.reason });
+            throw new server_1.TRPCError({ code: 'FORBIDDEN', message: result.reason });
         }
         // `deviceManager.listAll` is allowlisted for the embed's tile names,
         // but its raw rows describe EVERY device (config incl. credentials).
@@ -128,7 +136,7 @@ export const protectedProcedure = localized.use(async ({ ctx, next, path, getRaw
         if (path === 'deviceManager.listAll') {
             const out = await next({ ctx: { ...ctx, user: ctx.user } });
             if (out.ok) {
-                return { ...out, data: projectListAllForShareScope(out.data, ctx.user.shareView.scope) };
+                return { ...out, data: (0, share_view_access_js_1.projectListAllForShareScope)(out.data, ctx.user.shareView.scope) };
             }
             return out;
         }
@@ -139,10 +147,10 @@ export const protectedProcedure = localized.use(async ({ ctx, next, path, getRaw
         // those calls through — this is where the answer is cut. Without it the
         // allowlist would be a doorman who checks the ticket and then hands over
         // the whole building.
-        if (SHARE_SCOPE_PROJECTED_METHODS.has(path)) {
+        if (share_view_access_js_1.SHARE_SCOPE_PROJECTED_METHODS.has(path)) {
             const out = await next({ ctx: { ...ctx, user: ctx.user } });
             if (out.ok) {
-                return { ...out, data: projectShareScopeRows(out.data, ctx.user.shareView.scope) };
+                return { ...out, data: (0, share_view_access_js_1.projectShareScopeRows)(out.data, ctx.user.shareView.scope) };
             }
             return out;
         }
@@ -160,16 +168,16 @@ export const protectedProcedure = localized.use(async ({ ctx, next, path, getRaw
     // already passed; defer further gating to any explicit
     // `adminProcedure` chained on top of this one. A cap route is
     // scope-matched first.
-    if (path in METHOD_ACCESS_MAP) {
+    if (path in system_1.METHOD_ACCESS_MAP) {
         // Device-scope caps may be gated by a `device:N` scope. Resolve the
         // raw input once so the matcher can read `input.deviceId` without
         // re-doing the Zod parse (tRPC caches the parsed input downstream).
         // The `getDeviceAncestors` hook lets the matcher walk parent → child
         // accessory inheritance (grant on Reolink also covers its siren / PIR).
         const rawInput = await getRawInput();
-        const result = checkScopeAccess(ctx.user.scopes ?? [], path, rawInput, ctx.deviceScopeLookup);
+        const result = (0, scope_access_js_1.checkScopeAccess)(ctx.user.scopes ?? [], path, rawInput, ctx.deviceScopeLookup);
         if (!result.ok) {
-            throw new TRPCError({ code: 'FORBIDDEN', message: result.reason });
+            throw new server_1.TRPCError({ code: 'FORBIDDEN', message: result.reason });
         }
     }
     // A non-admin who is allowed to READ a device is not thereby allowed to
@@ -179,7 +187,7 @@ export const protectedProcedure = localized.use(async ({ ctx, next, path, getRaw
     // every camera in the deployment. The value is withheld HERE, at the
     // transport boundary, so in-process callers (`ctx.api`, the pipeline
     // orchestrator, the drivers that must actually connect) are unaffected.
-    const redactConfigSecrets = NON_ADMIN_CONFIG_REDACTED_METHODS.get(path);
+    const redactConfigSecrets = device_config_secret_redaction_js_1.NON_ADMIN_CONFIG_REDACTED_METHODS.get(path);
     const out = await next({ ctx: { ...ctx, user: ctx.user } });
     if (!out.ok)
         return out;
@@ -187,8 +195,8 @@ export const protectedProcedure = localized.use(async ({ ctx, next, path, getRaw
     // matcher lets a `device`-selector grant reach `deviceManager.listAll`
     // precisely because the answer is cut here; without this the grant would
     // hand back the whole fleet — names, locations, online state.
-    if (DEVICE_ENUMERATION_METHODS.has(path)) {
-        const projected = projectListAllForPrincipal(out.data, ctx.user.isAdmin, ctx.user.scopes ?? [], ctx.deviceFleet?.() ?? []);
+    if (scope_access_js_1.DEVICE_ENUMERATION_METHODS.has(path)) {
+        const projected = (0, principal_visibility_js_1.projectListAllForPrincipal)(out.data, ctx.user.isAdmin, ctx.user.scopes ?? [], ctx.deviceFleet?.() ?? []);
         return {
             ...out,
             data: redactConfigSecrets ? redactConfigSecrets(projected) : projected,
@@ -209,9 +217,9 @@ export const protectedProcedure = localized.use(async ({ ctx, next, path, getRaw
  * `protectedProcedure`. Useful on hand-written routes whose admin-only
  * nature should be obvious to a code reader.
  */
-export const adminProcedure = protectedProcedure.use(({ ctx, next }) => {
+exports.adminProcedure = exports.protectedProcedure.use(({ ctx, next }) => {
     if (!ctx.user.isAdmin) {
-        throw trpcUserError('FORBIDDEN', 'auth.admin-required', undefined, 'Admin required');
+        throw (0, user_error_js_1.trpcUserError)('FORBIDDEN', 'auth.admin-required', undefined, 'Admin required');
     }
     return next({ ctx });
 });

package/dist/api/trpc/trpc.router.js

@@ -1,25 +1,66 @@
-import * as path from 'node:path';
-import { createAddonSettingsRouter } from '../core/addon-settings.router.js';
-import { getSessionConnections } from '../../auth/session-connections.js';
-import { createAgentPairingRouter } from '../core/agent-pairing.router.js';
-import { createCertificatesRouter } from '../core/certificates.router.js';
-import { createNodeCertificatesClient } from '../../core/agent/node-certificates-client.js';
-import { createAuthRouter } from '../core/auth.router.js';
-import { buildAddonsProvider, buildIntegrationsProvider, buildNetworkQualityProvider, buildNodesProvider, buildSystemProvider, buildToastProvider, createNodeRootPackageLookup, } from '../core/cap-providers.js';
-import { createCapabilitiesRouter } from '../core/capabilities.router.js';
-import { createClusterNodesRouter } from '../core/cluster-nodes.router.js';
-import { createEventBusProxyRouter } from '../core/event-bus-proxy.router.js';
-import { createHwAccelRouter } from '../core/hwaccel.router.js';
-import { createLiveEventsRouter } from '../core/live-events.router.js';
-import { createLogsRouter } from '../core/logs.router.js';
-import { createNotificationsRouter } from '../core/notifications.router.js';
-import { createReplRouter } from '../core/repl.router.js';
-import { buildServerManagementProvider } from '../core/server-management.provider.js';
-import { createStreamProbeRouter } from '../core/stream-probe.router.js';
-import { createSystemEventsRouter } from '../core/system-events.router.js';
-import { buildRuntimeCapRouters } from './cap-router-runtime.js';
-import { classifyClientRequest, deriveRelayOnly, extractUserAgent, } from './client-ip.js';
-import { trpcRouter } from './trpc.middleware';
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.enrichInputWithUserAgent = enrichInputWithUserAgent;
+exports.enrichInputWithRelayClass = enrichInputWithRelayClass;
+exports.stripTalkbackFromRequest = stripTalkbackFromRequest;
+exports.enrichHintsWithClientClass = enrichHintsWithClientClass;
+exports.wrapWebrtcSessionProviderWithRelay = wrapWebrtcSessionProviderWithRelay;
+exports.buildAppRouter = buildAppRouter;
+const path = __importStar(require("node:path"));
+const addon_settings_router_js_1 = require("../core/addon-settings.router.js");
+const session_connections_js_1 = require("../../auth/session-connections.js");
+const agent_pairing_router_js_1 = require("../core/agent-pairing.router.js");
+const certificates_router_js_1 = require("../core/certificates.router.js");
+const node_certificates_client_js_1 = require("../../core/agent/node-certificates-client.js");
+const auth_router_js_1 = require("../core/auth.router.js");
+const cap_providers_js_1 = require("../core/cap-providers.js");
+const capabilities_router_js_1 = require("../core/capabilities.router.js");
+const cluster_nodes_router_js_1 = require("../core/cluster-nodes.router.js");
+const event_bus_proxy_router_js_1 = require("../core/event-bus-proxy.router.js");
+const hwaccel_router_js_1 = require("../core/hwaccel.router.js");
+const live_events_router_js_1 = require("../core/live-events.router.js");
+const logs_router_js_1 = require("../core/logs.router.js");
+const notifications_router_js_1 = require("../core/notifications.router.js");
+const repl_router_js_1 = require("../core/repl.router.js");
+const server_management_provider_js_1 = require("../core/server-management.provider.js");
+const stream_probe_router_js_1 = require("../core/stream-probe.router.js");
+const system_events_router_js_1 = require("../core/system-events.router.js");
+const cap_router_runtime_js_1 = require("./cap-router-runtime.js");
+const client_ip_js_1 = require("./client-ip.js");
+const trpc_middleware_1 = require("./trpc.middleware");
 /**
  * Merge the server-read User-Agent into a signaling call's
  * `consumerAttribution`, building a NEW input object (immutable — never
@@ -28,7 +69,7 @@ import { trpcRouter } from './trpc.middleware';
  * unchanged. Any client-supplied `userAgent` is OVERWRITTEN — the hub
  * trusts only the request context, never the client.
  */
-export function enrichInputWithUserAgent(input, userAgent) {
+function enrichInputWithUserAgent(input, userAgent) {
     if (userAgent === null)
         return input;
     const base = input.consumerAttribution ?? { kind: 'webrtc-browser' };
@@ -87,10 +128,10 @@ const FORCE_RELAY_REMOTE = process.env.CAMSTACK_FORCE_RELAY_REMOTE === '1' ||
  *
  * Immutable — builds a NEW input object, never mutates the caller's.
  */
-export function enrichInputWithRelayClass(input, clientClass) {
+function enrichInputWithRelayClass(input, clientClass) {
     if (clientClass === null)
         return input;
-    const relayOnly = FORCE_RELAY_REMOTE ? deriveRelayOnly(clientClass) : false;
+    const relayOnly = FORCE_RELAY_REMOTE ? (0, client_ip_js_1.deriveRelayOnly)(clientClass) : false;
     return { ...input, relayOnly };
 }
 /**
@@ -106,7 +147,7 @@ export function enrichInputWithRelayClass(input, clientClass) {
  *
  * Immutable — builds a NEW input object, never mutates the caller's.
  */
-export function stripTalkbackFromRequest(input, clientClass) {
+function stripTalkbackFromRequest(input, clientClass) {
     if (clientClass === null || input.talkback === undefined)
         return input;
     const { talkback: _dropped, ...rest } = input;
@@ -120,7 +161,7 @@ export function stripTalkbackFromRequest(input, clientClass) {
  * stays as the documented seam so a future probe can still thread class
  * without a cap change; today it is a no-op.
  */
-export function enrichHintsWithClientClass(input, _clientClass) {
+function enrichHintsWithClientClass(input, _clientClass) {
     return input;
 }
 /**
@@ -156,16 +197,16 @@ export function enrichHintsWithClientClass(input, _clientClass) {
  * All OTHER methods delegate straight through — auth, the remote-proxy
  * factory and every signaling behaviour are untouched.
  */
-export function wrapWebrtcSessionProviderWithRelay(provider, ctx) {
-    const userAgent = extractUserAgent(ctx.req);
-    const clientClass = classifyClientRequest(ctx.req);
+function wrapWebrtcSessionProviderWithRelay(provider, ctx) {
+    const userAgent = (0, client_ip_js_1.extractUserAgent)(ctx.req);
+    const clientClass = (0, client_ip_js_1.classifyClientRequest)(ctx.req);
     // The login session this request runs under: media opened here dies with it
     // (`session-connections.ts`). A principal with no `sid` has nothing to tie to.
     const authSessionId = ctx.user?.sessionId;
     const hold = (deviceId, mediaSessionId) => {
         if (authSessionId === undefined)
             return;
-        getSessionConnections().trackMedia(authSessionId, {
+        (0, session_connections_js_1.getSessionConnections)().trackMedia(authSessionId, {
             deviceId,
             mediaSessionId,
             close: () => provider.closeSession({ deviceId, sessionId: mediaSessionId }),
@@ -185,7 +226,7 @@ export function wrapWebrtcSessionProviderWithRelay(provider, ctx) {
         },
         closeSession: (input) => {
             if (authSessionId !== undefined) {
-                getSessionConnections().forgetMedia(authSessionId, input.sessionId);
+                (0, session_connections_js_1.getSessionConnections)().forgetMedia(authSessionId, input.sessionId);
             }
             return provider.closeSession(input);
         },
@@ -206,14 +247,14 @@ export function wrapWebrtcSessionProviderWithRelay(provider, ctx) {
 function buildServerProviders(services) {
     const wrap = (fn) => (ctx) => fn(ctx);
     return {
-        'network-quality': wrap(() => buildNetworkQualityProvider(services.networkQualityService)),
-        system: wrap(() => buildSystemProvider(services.featureService, services.capabilityRegistry, services.loggingService.createLogger('site-location'))),
-        toast: wrap((ctx) => buildToastProvider(services.toastService, ctx)),
-        integrations: wrap(() => buildIntegrationsProvider(services.addonRegistry, services.eventBus, services.loggingService, services.capabilityRegistry)),
-        nodes: wrap(() => buildNodesProvider(services.agentRegistry, services.moleculer, services.addonRegistry, createNodeRootPackageLookup(services.moleculer, services.serverUpdateService), services.loggingService.createLogger('nodes'))),
+        'network-quality': wrap(() => (0, cap_providers_js_1.buildNetworkQualityProvider)(services.networkQualityService)),
+        system: wrap(() => (0, cap_providers_js_1.buildSystemProvider)(services.featureService, services.capabilityRegistry, services.loggingService.createLogger('site-location'))),
+        toast: wrap((ctx) => (0, cap_providers_js_1.buildToastProvider)(services.toastService, ctx)),
+        integrations: wrap(() => (0, cap_providers_js_1.buildIntegrationsProvider)(services.addonRegistry, services.eventBus, services.loggingService, services.capabilityRegistry)),
+        nodes: wrap(() => (0, cap_providers_js_1.buildNodesProvider)(services.agentRegistry, services.moleculer, services.addonRegistry, (0, cap_providers_js_1.createNodeRootPackageLookup)(services.moleculer, services.serverUpdateService), services.loggingService.createLogger('nodes'))),
         // server-management — runtime-updatable root package (phase 1: hub only).
-        'server-management': wrap(() => buildServerManagementProvider(services.serverUpdateService)),
-        addons: wrap((ctx) => buildAddonsProvider(services.addonRegistry, services.addonPackageService, services.loggingService, services.moleculer, services.configService, ctx, services.agentRegistry)),
+        'server-management': wrap(() => (0, server_management_provider_js_1.buildServerManagementProvider)(services.serverUpdateService)),
+        addons: wrap((ctx) => (0, cap_providers_js_1.buildAddonsProvider)(services.addonRegistry, services.addonPackageService, services.loggingService, services.moleculer, services.configService, ctx, services.agentRegistry)),
         // webrtc-session — the resolved broker singleton, wrapped per request to
         // inject the server-read User-Agent into signaling attribution (the broker
         // is a forked addon that can't see the HTTP request). Cross-node (agent-
@@ -255,7 +296,7 @@ function buildCapabilityRouters(services) {
     // (`import type`) — its value is never called; the codegen
     // `generated-cap-mounts.ts` / `generated-cap-routers.ts` remain the TYPE
     // source of record.
-    const dynamicCaps = buildRuntimeCapRouters({
+    const dynamicCaps = (0, cap_router_runtime_js_1.buildRuntimeCapRouters)({
         capabilityRegistry: services.capabilityRegistry,
         moleculer: services.moleculer,
         serverProviders: buildServerProviders(services),
@@ -270,44 +311,44 @@ function buildCapabilityRouters(services) {
         //    by `buildServerProviders`. ──────
         ...dynamicCaps,
         // ── Non-cap (core) routers — hand-written, single-impl ──────────
-        notifications: createNotificationsRouter(services.notificationService),
+        notifications: (0, notifications_router_js_1.createNotificationsRouter)(services.notificationService),
         // Raw DB proxy for forked workers to read/write addon store.
         // Workers use ctx.api.addonSettingsRaw.getGlobal.query({...}).
         // NOT the three-level settings gateway — that's the
         // `addonSettings` cap router (mounted dynamically above).
-        addonSettingsRaw: createAddonSettingsRouter(services.configService),
-        eventBusProxy: createEventBusProxyRouter(services.eventBus),
-        repl: createReplRouter(services.replEngine),
-        systemEvents: createSystemEventsRouter(services.eventBus),
-        capabilities: createCapabilitiesRouter(services.capabilityRegistry, services.configService),
-        logs: createLogsRouter(services.loggingService),
-        live: createLiveEventsRouter(services.eventBus, services.addonRegistry),
+        addonSettingsRaw: (0, addon_settings_router_js_1.createAddonSettingsRouter)(services.configService),
+        eventBusProxy: (0, event_bus_proxy_router_js_1.createEventBusProxyRouter)(services.eventBus),
+        repl: (0, repl_router_js_1.createReplRouter)(services.replEngine),
+        systemEvents: (0, system_events_router_js_1.createSystemEventsRouter)(services.eventBus),
+        capabilities: (0, capabilities_router_js_1.createCapabilitiesRouter)(services.capabilityRegistry, services.configService),
+        logs: (0, logs_router_js_1.createLogsRouter)(services.loggingService),
+        live: (0, live_events_router_js_1.createLiveEventsRouter)(services.eventBus, services.addonRegistry),
         // stream-probe — fixed core API (ffprobe wrapper), not a cap.
-        streamProbe: createStreamProbeRouter(services.streamProbe),
+        streamProbe: (0, stream_probe_router_js_1.createStreamProbeRouter)(services.streamProbe),
         // hwaccel — fixed core API, repointed onto the `platform-probe` cap
         // (the sole cross-node-pinnable hwaccel surface). UI pipeline /
         // NodeDetail pages query per-node to show which hardware backend each
         // agent will use.
-        hwaccel: createHwAccelRouter(services.capabilityRegistry, services.moleculer),
+        hwaccel: (0, hwaccel_router_js_1.createHwAccelRouter)(services.capabilityRegistry, services.moleculer),
         // clusterNodes — fixed core API. Write-side purge for the durable
         // offline-node history (Track A "Forget node"); read side is push-only.
-        clusterNodes: createClusterNodesRouter(services.agentRegistry),
+        clusterNodes: (0, cluster_nodes_router_js_1.createClusterNodesRouter)(services.agentRegistry),
         // certificates - Identity -> Certificates inventory (HTTPS per node, mesh CA). D855.
-        certificates: createCertificatesRouter({
+        certificates: (0, certificates_router_js_1.createCertificatesRouter)({
             registry: services.capabilityRegistry,
             agentRegistry: services.agentRegistry,
-            nodeClient: (nodeId) => createNodeCertificatesClient(services.moleculer, nodeId),
+            nodeClient: (nodeId) => (0, node_certificates_client_js_1.createNodeCertificatesClient)(services.moleculer, nodeId),
             nodeAddonIds: (nodeId) => services.moleculer.getNodeAddonIds(nodeId),
             hubDataDir: path.resolve(services.configService.get('server.dataPath') ?? 'camstack-data'),
             log: services.loggingService.createLogger('certificates'),
         }),
         // agentPairing - hub-initiated pairing of agents, unpairing (D857).
-        agentPairing: createAgentPairingRouter({
+        agentPairing: (0, agent_pairing_router_js_1.createAgentPairingRouter)({
             registry: services.capabilityRegistry,
-            nodeClient: (nodeId) => createNodeCertificatesClient(services.moleculer, nodeId),
+            nodeClient: (nodeId) => (0, node_certificates_client_js_1.createNodeCertificatesClient)(services.moleculer, nodeId),
             log: services.loggingService.createLogger('agent-pairing'),
         }),
-        auth: createAuthRouter(services.authService, services.capabilityRegistry, services.moleculer, services.shareTokenService, services.handoffCodeService, services.externalLinkIntents, services.nativeLink ?? null, {
+        auth: (0, auth_router_js_1.createAuthRouter)(services.authService, services.capabilityRegistry, services.moleculer, services.shareTokenService, services.handoffCodeService, services.externalLinkIntents, services.nativeLink ?? null, {
             ...(services.authNetworkPolicy !== undefined
                 ? { network: services.authNetworkPolicy }
                 : {}),
@@ -322,8 +363,8 @@ function buildCapabilityRouters(services) {
         //   - restreamer / streaming-engine / webrtc
     };
 }
-export function buildAppRouter(services) {
-    return trpcRouter({
+function buildAppRouter(services) {
+    return (0, trpc_middleware_1.trpcRouter)({
         ...buildCapabilityRouters(services),
     });
 }

package/dist/api/trpc/user-error.js

@@ -1,14 +1,17 @@
-import { TRPCError } from '@trpc/server';
-import { userError } from '@camstack/types';
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.trpcUserError = trpcUserError;
+const server_1 = require("@trpc/server");
+const types_1 = require("@camstack/types");
 /**
  * A `TRPCError` that carries a stable i18n code (D863). `message` stays the
  * English text; the error formatter swaps it for the `server` catalog text in
  * the request language and keeps `{ code, params }` in `data.i18n`.
  */
-export function trpcUserError(trpcCode, i18nCode, params, englishFallback) {
-    return new TRPCError({
+function trpcUserError(trpcCode, i18nCode, params, englishFallback) {
+    return new server_1.TRPCError({
         code: trpcCode,
         message: englishFallback,
-        cause: userError(i18nCode, params, englishFallback),
+        cause: (0, types_1.userError)(i18nCode, params, englishFallback),
     });
 }