@camstack/server 1.2.594 → 1.2.596

package/dist/api/core/auth.router.js

@@ -1,3 +1,4 @@
+"use strict";
 /**
  * Auth router — core API for login/logout/me.
  *
@@ -13,40 +14,43 @@
  * collection — the single, generic mechanism every auth addon contributes
  * to (superseding the removed `auth.listProviders`).
  */
-import { advertisedHubOrigins, DEVICE_CERT_SIGNATURE, DEVICE_SIGNATURE_MESSAGE_VERSION, DeviceCertificateLoginMethodSchema, MethodAccessSchema, parseAppAuthCallback, pickRequestOrigin, PasskeyLoginMethodSchema, PasskeySummarySchema, RedirectLoginMethodSchema, ServerNameInfoSchema, summarizeEffectiveScope, TokenScopeSchema, WidgetLoginMethodSchema, } from '@camstack/types';
-import { TRPCError } from '@trpc/server';
-import { z } from 'zod';
-import { DEFAULT_AUTH_NETWORK_POLICY } from '../../auth/auth-network-policy.js';
-import { APP_PASSKEY_PATH } from '../../auth/app-passkey-routes.js';
-import { createRateLimiter } from '../../auth/auth-rate-limit.js';
-import { isAuthAddonDisabled } from '../../auth/auth-provider-gate.js';
-import { DeviceEnrollProofs } from '../../auth/device-enroll-proofs.js';
-import { ExternalLinkIntents } from '../../auth/external-link-intents.js';
-import { FinishRegistrationSchema, OptionsJsonSchema, resolvePasskeyProvider, SecondFactorPreferenceSchema, SetSecondFactorPreferenceSchema, } from '../../auth/passkey-provider.js';
-import { collectSecondFactors, SecondFactorSchema, } from '../../auth/second-factors.js';
-import { readSessionCookieFromHeader } from '../../auth/session-cookie.js';
-import { userManagementInternal } from '../../auth/hub-sessions.js';
-import { createSessionMinter, SessionRefreshRefusedError, SessionUserGoneError, } from '../../auth/session-mint.js';
-import { HandoffCodeService } from '../../core/auth/handoff-code.service.js';
-import { SHARE_TOKEN_TTL_MAX_SEC, SHARE_TOKEN_TTL_MIN_SEC, ShareTokenScopeSchema, } from '../../core/auth/share-token.service.js';
-import { filterViewableDeviceIds } from '../trpc/principal-visibility.js';
-import { adminProcedure, protectedProcedure, publicProcedure, trpcRouter, } from '../trpc/trpc.middleware.js';
-import { assertAccountNotLocked, limitByClient, limitByUser, PROCESS_AUTH_LIMITERS, recordAccountFailure, } from './auth-limits.js';
-import { createAdminTokenProcedures } from './auth-admin-tokens.procedures.js';
-import { createRevokeCredentialsProcedures } from './auth-revoke-credentials.procedures.js';
-import { assertReauthenticated, createReauthProcedures, ReauthTokenInput, } from './auth-reauth.procedures.js';
-import { createDeviceCertProcedures } from './auth-device-cert.procedures.js';
-import { createSessionProcedures } from './auth-sessions.procedures.js';
-import { serverNameReaderFor } from './server-name.js';
-import { userError } from '@camstack/types';
-import { trpcUserError } from '../trpc/user-error.js';
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EXCHANGE_SESSION_HEADER = exports.BROWSER_HANDOFF_PATH = void 0;
+exports.createAuthRouter = createAuthRouter;
+const types_1 = require("@camstack/types");
+const server_1 = require("@trpc/server");
+const zod_1 = require("zod");
+const auth_network_policy_js_1 = require("../../auth/auth-network-policy.js");
+const app_passkey_routes_js_1 = require("../../auth/app-passkey-routes.js");
+const auth_rate_limit_js_1 = require("../../auth/auth-rate-limit.js");
+const auth_provider_gate_js_1 = require("../../auth/auth-provider-gate.js");
+const device_enroll_proofs_js_1 = require("../../auth/device-enroll-proofs.js");
+const external_link_intents_js_1 = require("../../auth/external-link-intents.js");
+const passkey_provider_js_1 = require("../../auth/passkey-provider.js");
+const second_factors_js_1 = require("../../auth/second-factors.js");
+const session_cookie_js_1 = require("../../auth/session-cookie.js");
+const hub_sessions_js_1 = require("../../auth/hub-sessions.js");
+const session_mint_js_1 = require("../../auth/session-mint.js");
+const handoff_code_service_js_1 = require("../../core/auth/handoff-code.service.js");
+const share_token_service_js_1 = require("../../core/auth/share-token.service.js");
+const principal_visibility_js_1 = require("../trpc/principal-visibility.js");
+const trpc_middleware_js_1 = require("../trpc/trpc.middleware.js");
+const auth_limits_js_1 = require("./auth-limits.js");
+const auth_admin_tokens_procedures_js_1 = require("./auth-admin-tokens.procedures.js");
+const auth_revoke_credentials_procedures_js_1 = require("./auth-revoke-credentials.procedures.js");
+const auth_reauth_procedures_js_1 = require("./auth-reauth.procedures.js");
+const auth_device_cert_procedures_js_1 = require("./auth-device-cert.procedures.js");
+const auth_sessions_procedures_js_1 = require("./auth-sessions.procedures.js");
+const server_name_js_1 = require("./server-name.js");
+const types_2 = require("@camstack/types");
+const user_error_js_1 = require("../trpc/user-error.js");
 /**
  * A public procedure limited per (procedure, REAL client address) — see
  * `auth-limits.ts` for the tiers and why the address is the forwarded client.
  */
 function makeRateLimitedProcedure(limiter, network) {
-    return publicProcedure.use(({ ctx, path, next }) => {
-        limitByClient(limiter, path, ctx.req, network);
+    return trpc_middleware_js_1.publicProcedure.use(({ ctx, path, next }) => {
+        (0, auth_limits_js_1.limitByClient)(limiter, path, ctx.req, network);
         return next({ ctx });
     });
 }
@@ -55,7 +59,7 @@ const STEP_UP_FRESH_MS = 120_000;
 /** Login methods that count as an authentication (a handoff / exchange / certificate session does not). */
 const STEP_UP_LOGIN_METHODS = ['password', 'passkey', 'sso'];
 /** Asks for the refresh-token flow (short access token + rotating refresh token). */
-const RefreshableInput = z.boolean().optional();
+const RefreshableInput = zod_1.z.boolean().optional();
 /** The request's User-Agent, trimmed, for the sessions list. */
 function clientLabel(req) {
     const ua = req?.headers['user-agent'];
@@ -67,11 +71,11 @@ function clientLabel(req) {
  * link claim, browser handoff — D801): per user, not per ip, because the
  * caller is known and a tunnel puts every client behind one address.
  */
-const SELF_CODE_LIMITER = createRateLimiter({ windowMs: 60_000, max: 10 });
-const selfCodeProcedure = protectedProcedure.use(({ ctx, path, next }) => {
+const SELF_CODE_LIMITER = (0, auth_rate_limit_js_1.createRateLimiter)({ windowMs: 60_000, max: 10 });
+const selfCodeProcedure = trpc_middleware_js_1.protectedProcedure.use(({ ctx, path, next }) => {
     const verdict = SELF_CODE_LIMITER.check(`${path}:${ctx.user?.id ?? 'anonymous'}`);
     if (!verdict.allowed) {
-        throw new TRPCError({
+        throw new server_1.TRPCError({
             code: 'TOO_MANY_REQUESTS',
             message: `Too many attempts — retry in ${verdict.retryAfterSeconds}s`,
         });
@@ -79,7 +83,7 @@ const selfCodeProcedure = protectedProcedure.use(({ ctx, path, next }) => {
     return next({ ctx });
 });
 /** The hub route a browser-handoff code is redeemed at (`main.ts`). */
-export const BROWSER_HANDOFF_PATH = '/api/auth/browser-handoff';
+exports.BROWSER_HANDOFF_PATH = '/api/auth/browser-handoff';
 /**
  * The available second-factor kinds a user may satisfy after the
  * password leg. Capability-driven — `totp` maps to the
@@ -103,26 +107,26 @@ export const BROWSER_HANDOFF_PATH = '/api/auth/browser-handoff';
  * `requiresTotp` is retained (`= secondFactors.includes('totp')`) for
  * backward compatibility with older SDK builds that branch on it.
  */
-const LoginResultSchema = z.object({
-    token: z.string(),
-    user: z.object({
-        id: z.string(),
-        username: z.string(),
-        isAdmin: z.boolean(),
+const LoginResultSchema = zod_1.z.object({
+    token: zod_1.z.string(),
+    user: zod_1.z.object({
+        id: zod_1.z.string(),
+        username: zod_1.z.string(),
+        isAdmin: zod_1.z.boolean(),
     }),
-    requiresTotp: z.boolean().optional(),
-    secondFactors: z.array(SecondFactorSchema).optional(),
+    requiresTotp: zod_1.z.boolean().optional(),
+    secondFactors: zod_1.z.array(second_factors_js_1.SecondFactorSchema).optional(),
     /** When the access token expires (epoch ms). Absent on a challenge. */
-    expiresAt: z.number().optional(),
+    expiresAt: zod_1.z.number().optional(),
     /** The server-side login session. */
-    sessionId: z.string().optional(),
+    sessionId: zod_1.z.string().optional(),
     /** When the session expires unless refreshed (epoch ms). */
-    sessionExpiresAt: z.number().optional(),
+    sessionExpiresAt: zod_1.z.number().optional(),
     /**
      * Only when the client asked (`refreshable: true`): swap it at
      * `auth.refreshSession` before `expiresAt`. Store it like a password.
      */
-    refreshToken: z.string().optional(),
+    refreshToken: zod_1.z.string().optional(),
 });
 // ── Login-method aggregation (login-method cap) ──────────────────────
 //
@@ -136,8 +140,8 @@ const LoginResultSchema = z.object({
 // bundle's relative sibling imports inherit it and a CDN busts the WHOLE
 // bundle atomically on deploy (see the stamping site below). `redirect` and
 // `passkey` arms pass through untouched — no server-side enrichment needed.
-const PublicWidgetLoginMethodSchema = WidgetLoginMethodSchema.extend({
-    bundleUrl: z.string(),
+const PublicWidgetLoginMethodSchema = types_1.WidgetLoginMethodSchema.extend({
+    bundleUrl: zod_1.z.string(),
 });
 /** Stable per hub PROCESS — busts the login widget bundle URL on each
  *  restart/deploy while caching cleanly within the process's uptime. */
@@ -146,24 +150,24 @@ const AUTH_BUNDLE_VERSION = String(Date.now());
 // always sends `app` (`null` when there is no app path - the viewer hides the
 // method). It stays optional in the TYPE so the admin-ui's hand-mirrored arms,
 // which never read it, keep matching this union.
-const PublicRedirectLoginMethodSchema = RedirectLoginMethodSchema;
-const PublicPasskeyLoginMethodSchema = PasskeyLoginMethodSchema;
-const PublicLoginMethodSchema = z.discriminatedUnion('kind', [
+const PublicRedirectLoginMethodSchema = types_1.RedirectLoginMethodSchema;
+const PublicPasskeyLoginMethodSchema = types_1.PasskeyLoginMethodSchema;
+const PublicLoginMethodSchema = zod_1.z.discriminatedUnion('kind', [
     PublicRedirectLoginMethodSchema,
     PublicWidgetLoginMethodSchema,
     PublicPasskeyLoginMethodSchema,
-    DeviceCertificateLoginMethodSchema,
+    types_1.DeviceCertificateLoginMethodSchema,
 ]);
 /** One of the caller's linked sign-in identities, as the profile shows it (D782). */
-const OwnExternalIdentitySchema = z.object({
-    provider: z.string(),
-    subject: z.string(),
-    label: z.string().optional(),
-    linkedAt: z.number(),
+const OwnExternalIdentitySchema = zod_1.z.object({
+    provider: zod_1.z.string(),
+    subject: zod_1.z.string(),
+    label: zod_1.z.string().optional(),
+    linkedAt: zod_1.z.number(),
     /** The provider instance's button label, or `null` when it is gone / disabled. */
-    providerLabel: z.string().nullable(),
+    providerLabel: zod_1.z.string().nullable(),
     /** Whether the provider instance is configured and enabled right now. */
-    available: z.boolean(),
+    available: zod_1.z.boolean(),
 });
 // ── Share tokens (grid-view standalone share links) ──────────────────
 //
@@ -175,26 +179,26 @@ const OwnExternalIdentitySchema = z.object({
 // TTL: a bounded number of seconds, or the EXPLICIT literal `'never'`
 // for a permanently-shared grid (revocation is the kill switch).
 // Omitted → 7-day default; infinite is never a silent default.
-const CreateShareTokenInputSchema = z.object({
-    scope: ShareTokenScopeSchema,
-    ttlSec: z
+const CreateShareTokenInputSchema = zod_1.z.object({
+    scope: share_token_service_js_1.ShareTokenScopeSchema,
+    ttlSec: zod_1.z
         .union([
-        z.number().int().min(SHARE_TOKEN_TTL_MIN_SEC).max(SHARE_TOKEN_TTL_MAX_SEC),
-        z.literal('never'),
+        zod_1.z.number().int().min(share_token_service_js_1.SHARE_TOKEN_TTL_MIN_SEC).max(share_token_service_js_1.SHARE_TOKEN_TTL_MAX_SEC),
+        zod_1.z.literal('never'),
     ])
         .optional(),
 });
-const ShareTokenSummarySchema = z.object({
-    id: z.string(),
-    userId: z.string(),
-    tokenPrefix: z.string(),
-    scope: ShareTokenScopeSchema,
-    createdAt: z.number(),
+const ShareTokenSummarySchema = zod_1.z.object({
+    id: zod_1.z.string(),
+    userId: zod_1.z.string(),
+    tokenPrefix: zod_1.z.string(),
+    scope: share_token_service_js_1.ShareTokenScopeSchema,
+    createdAt: zod_1.z.number(),
     /** Epoch ms, or `null` for never-expiring tokens. */
-    expiresAt: z.number().nullable(),
+    expiresAt: zod_1.z.number().nullable(),
     /** Derived convenience flag so listings surface infinite tokens clearly. */
-    neverExpires: z.boolean(),
-    lastUsedAt: z.number().optional(),
+    neverExpires: zod_1.z.boolean(),
+    lastUsedAt: zod_1.z.number().optional(),
 });
 function toShareTokenSummary(record) {
     return {
@@ -218,7 +222,7 @@ function assertRealUserSession(user, what = 'Share-token management') {
     // An admin token is a script's credential, never a person's session: it
     // must not turn itself into a session (handoff codes) or mint links.
     if (user.isScoped || user.shareView || user.adminTokenId !== undefined) {
-        throw new TRPCError({
+        throw new server_1.TRPCError({
             code: 'FORBIDDEN',
             message: `${what} requires a real user session`,
         });
@@ -235,7 +239,7 @@ function assertRealUserSession(user, what = 'Share-token management') {
 // answers with a freshly-minted session).
 /** Custom header a cross-site form can never set — CSRF gate for the
  *  cookie-authenticated `exchangeSession` mutation. */
-export const EXCHANGE_SESSION_HEADER = 'x-camstack-exchange';
+exports.EXCHANGE_SESSION_HEADER = 'x-camstack-exchange';
 /** Read a single-valued request header off the tRPC context request. */
 function readRequestHeader(req, name) {
     const value = req?.headers[name];
@@ -246,14 +250,14 @@ function readRequestHeader(req, name) {
     return null;
 }
 /** Per-access device reach summary (counts, never id lists). */
-const DeviceReachSummarySchema = z.object({
-    all: z.boolean(),
-    deviceCount: z.number().int(),
+const DeviceReachSummarySchema = zod_1.z.object({
+    all: zod_1.z.boolean(),
+    deviceCount: zod_1.z.number().int(),
 });
 /** One capability/addon grant flattened for the UI. */
-const ScopeGrantSummarySchema = z.object({
-    name: z.string(),
-    access: z.array(MethodAccessSchema).readonly(),
+const ScopeGrantSummarySchema = zod_1.z.object({
+    name: zod_1.z.string(),
+    access: zod_1.z.array(types_1.MethodAccessSchema).readonly(),
 });
 /**
  * The caller's RESOLVED effective scope (scope model v3). Selectors are
@@ -261,31 +265,31 @@ const ScopeGrantSummarySchema = z.object({
  * the viewer (F3/F4) can HIDE out-of-scope surfaces from a single probe. A
  * non-admin with zero grants reports zero everything (born with no access).
  */
-const EffectiveScopeSchema = z.object({
-    isAdmin: z.boolean(),
-    allDevicesViewable: z.boolean(),
-    viewableDeviceCount: z.number().int(),
-    device: z.object({
+const EffectiveScopeSchema = zod_1.z.object({
+    isAdmin: zod_1.z.boolean(),
+    allDevicesViewable: zod_1.z.boolean(),
+    viewableDeviceCount: zod_1.z.number().int(),
+    device: zod_1.z.object({
         view: DeviceReachSummarySchema,
         create: DeviceReachSummarySchema,
         delete: DeviceReachSummarySchema,
     }),
-    system: z.array(MethodAccessSchema).readonly(),
-    capabilities: z.array(ScopeGrantSummarySchema).readonly(),
-    addons: z.array(ScopeGrantSummarySchema).readonly(),
+    system: zod_1.z.array(types_1.MethodAccessSchema).readonly(),
+    capabilities: zod_1.z.array(ScopeGrantSummarySchema).readonly(),
+    addons: zod_1.z.array(ScopeGrantSummarySchema).readonly(),
 });
 /** Wire shape of the authenticated user returned by `auth.me`. */
-const MeSchema = z
+const MeSchema = zod_1.z
     .object({
-    id: z.string(),
-    username: z.string(),
-    isAdmin: z.boolean(),
-    permissions: z.object({
-        isAdmin: z.boolean(),
-        allowedProviders: z.union([z.literal('*'), z.array(z.string())]),
-        allowedDevices: z.record(z.string(), z.unknown()),
+    id: zod_1.z.string(),
+    username: zod_1.z.string(),
+    isAdmin: zod_1.z.boolean(),
+    permissions: zod_1.z.object({
+        isAdmin: zod_1.z.boolean(),
+        allowedProviders: zod_1.z.union([zod_1.z.literal('*'), zod_1.z.array(zod_1.z.string())]),
+        allowedDevices: zod_1.z.record(zod_1.z.string(), zod_1.z.unknown()),
     }),
-    isApiKey: z.boolean(),
+    isApiKey: zod_1.z.boolean(),
     /**
      * The caller's resolved effective scope. Absent only on the (unreachable
      * here — `me` is `protected`) null-principal branch.
@@ -293,9 +297,9 @@ const MeSchema = z
     scope: EffectiveScopeSchema.optional(),
 })
     .nullable();
-export function createAuthRouter(auth, registry, moleculer = null, shareTokens = null, handoffCodes = new HandoffCodeService(), linkIntents = new ExternalLinkIntents(), nativeLink = null, options = {}) {
-    const network = options.network ?? DEFAULT_AUTH_NETWORK_POLICY;
-    const limiters = options.limiters ?? PROCESS_AUTH_LIMITERS;
+function createAuthRouter(auth, registry, moleculer = null, shareTokens = null, handoffCodes = new handoff_code_service_js_1.HandoffCodeService(), linkIntents = new external_link_intents_js_1.ExternalLinkIntents(), nativeLink = null, options = {}) {
+    const network = options.network ?? auth_network_policy_js_1.DEFAULT_AUTH_NETWORK_POLICY;
+    const limiters = options.limiters ?? auth_limits_js_1.PROCESS_AUTH_LIMITERS;
     /** Secret-verifying legs (password / TOTP / passkey assertion / codes). */
     const credentialProcedure = makeRateLimitedProcedure(limiters.credential, network);
     /** Challenge-minting begin-legs — looser, they verify nothing. */
@@ -313,13 +317,13 @@ export function createAuthRouter(auth, registry, moleculer = null, shareTokens =
      * admin change made mid-flow; signing from stale claims could mint a
      * stale-scope session.
      */
-    const minter = createSessionMinter({
+    const minter = (0, session_mint_js_1.createSessionMinter)({
         signer: auth,
         directory: () => registry?.getSingleton('user-management'),
         ...(options.sessions !== undefined ? { sessions: options.sessions } : {}),
         credentials: options.credentials ??
             (() => {
-                const internal = registry === null ? null : userManagementInternal(registry);
+                const internal = registry === null ? null : (0, hub_sessions_js_1.userManagementInternal)(registry);
                 return internal === null ? null : internal.deviceCredentials;
             }),
     });
@@ -348,8 +352,8 @@ export function createAuthRouter(auth, registry, moleculer = null, shareTokens =
             return await mintSessionForUserId(userId, issue);
         }
         catch (error) {
-            if (error instanceof SessionUserGoneError) {
-                throw trpcUserError('UNAUTHORIZED', 'auth.user-gone', undefined, 'User no longer exists');
+            if (error instanceof session_mint_js_1.SessionUserGoneError) {
+                throw (0, user_error_js_1.trpcUserError)('UNAUTHORIZED', 'auth.user-gone', undefined, 'User no longer exists');
             }
             throw error;
         }
@@ -357,11 +361,11 @@ export function createAuthRouter(auth, registry, moleculer = null, shareTokens =
     /** The second factors a primary login still owes (`auth/second-factors.ts`). */
     const collectSecondFactorsFor = async (userId, primary) => {
         const userMgmt = registry?.getSingleton('user-management');
-        return collectSecondFactors({
+        return (0, second_factors_js_1.collectSecondFactors)({
             ...(userMgmt && typeof userMgmt.getTotpStatus === 'function'
                 ? { getTotpStatus: (input) => userMgmt.getTotpStatus(input) }
                 : {}),
-            passkeyProvider: () => resolvePasskeyProvider(registry, moleculer),
+            passkeyProvider: () => (0, passkey_provider_js_1.resolvePasskeyProvider)(registry, moleculer),
         }, userId, primary);
     };
     /**
@@ -377,7 +381,7 @@ export function createAuthRouter(auth, registry, moleculer = null, shareTokens =
         const address = network.clientAddress(req);
         if (!network.isTrustedNetworkLogin(address))
             return factors;
-        const internal = registry === null ? null : userManagementInternal(registry);
+        const internal = registry === null ? null : (0, hub_sessions_js_1.userManagementInternal)(registry);
         if (internal === null)
             return factors; // cannot audit it → do not skip it
         await internal.audit.record({
@@ -409,18 +413,18 @@ export function createAuthRouter(auth, registry, moleculer = null, shareTokens =
             for (const [name, value] of Object.entries(req?.headers ?? {})) {
                 headers[name.toLowerCase()] = Array.isArray(value) ? value[0] : value;
             }
-            const picked = pickRequestOrigin(headers, advertisedHubOrigins(book));
+            const picked = (0, types_1.pickRequestOrigin)(headers, (0, types_1.advertisedHubOrigins)(book));
             return (picked ??
                 book.roles.publicEndpoint.resolved ??
                 book.roles.appConnections.resolved[0] ??
                 null);
         });
-    const enrollProofs = options.enrollProofs ?? new DeviceEnrollProofs(Date.now, options.logger ?? null);
+    const enrollProofs = options.enrollProofs ?? new device_enroll_proofs_js_1.DeviceEnrollProofs(Date.now, options.logger ?? null);
     /** The device credential behind a session, so a session minted FROM it inherits it (D855). */
     const credentialOfSession = (sessionId) => {
         if (sessionId === undefined || registry === null)
             return undefined;
-        const check = userManagementInternal(registry)?.sessions.check(sessionId);
+        const check = (0, hub_sessions_js_1.userManagementInternal)(registry)?.sessions.check(sessionId);
         return check?.state === 'active' ? (check.session.credentialId ?? undefined) : undefined;
     };
     /**
@@ -434,10 +438,10 @@ export function createAuthRouter(auth, registry, moleculer = null, shareTokens =
     const assertFreshAuthentication = (user, reauthToken) => {
         const refuse = (message) => {
             options.logger?.warn(`Step-up refused: ${message}`, { tags: { userId: user.id } });
-            throw new TRPCError({ code: 'FORBIDDEN', message: `Sign in again first: ${message}` });
+            throw new server_1.TRPCError({ code: 'FORBIDDEN', message: `Sign in again first: ${message}` });
         };
         if (reauthToken !== undefined) {
-            assertReauthenticated(auth, user, reauthToken);
+            (0, auth_reauth_procedures_js_1.assertReauthenticated)(auth, user, reauthToken);
             if (!enrollProofs.consumeReauth(reauthToken))
                 refuse('that confirmation was already used');
             return;
@@ -445,7 +449,7 @@ export function createAuthRouter(auth, registry, moleculer = null, shareTokens =
         const sid = user.sessionId;
         const check = sid === undefined || registry === null
             ? null
-            : userManagementInternal(registry)?.sessions.check(sid);
+            : (0, hub_sessions_js_1.userManagementInternal)(registry)?.sessions.check(sid);
         if (check?.state !== 'active')
             return refuse('no live session');
         if (!STEP_UP_LOGIN_METHODS.includes(check.session.method)) {
@@ -458,7 +462,7 @@ export function createAuthRouter(auth, registry, moleculer = null, shareTokens =
             return refuse('this sign-in already started a step-up');
         }
     };
-    const serverNameReader = serverNameReaderFor(registry);
+    const serverNameReader = (0, server_name_js_1.serverNameReaderFor)(registry);
     const aggregateLoginMethods = async () => {
         if (!registry)
             return [];
@@ -471,7 +475,7 @@ export function createAuthRouter(auth, registry, moleculer = null, shareTokens =
             // The operator's Enable/Disable on Identity → Authentication is the
             // addon's ONE enable (D777). It toggles `auth-provider` /
             // `user-passkeys`, never `login-method` — so ask the governing caps.
-            if (isAuthAddonDisabled(registry, addonId))
+            if ((0, auth_provider_gate_js_1.isAuthAddonDisabled)(registry, addonId))
                 continue;
             let contributions;
             try {
@@ -501,7 +505,7 @@ export function createAuthRouter(auth, registry, moleculer = null, shareTokens =
                     // system browser at it; a second-factor ceremony has no app path.
                     const parsed = PublicPasskeyLoginMethodSchema.safeParse({
                         ...raw,
-                        app: raw.stage === 'primary' ? { kind: 'browser', startPath: APP_PASSKEY_PATH } : null,
+                        app: raw.stage === 'primary' ? { kind: 'browser', startPath: app_passkey_routes_js_1.APP_PASSKEY_PATH } : null,
                     });
                     if (parsed.success) {
                         out.push(parsed.data);
@@ -532,7 +536,7 @@ export function createAuthRouter(auth, registry, moleculer = null, shareTokens =
         // The hub's own method (D855): a device certificate. Not an addon
         // contribution - the device CA lives in `local-auth` - so it is added here.
         // Offered only where the hub can actually serve it (local-auth up).
-        if (userManagementInternal(registry) !== null)
+        if ((0, hub_sessions_js_1.userManagementInternal)(registry) !== null)
             out.push({
                 kind: 'device-certificate',
                 id: 'device-certificate',
@@ -543,8 +547,8 @@ export function createAuthRouter(auth, registry, moleculer = null, shareTokens =
                 renewPath: 'auth.renewDeviceCertificate',
                 revokePath: 'auth.revokeOwnDeviceCertificate',
                 enrollSelfPath: 'auth.enrollSelf',
-                signature: DEVICE_CERT_SIGNATURE,
-                messageVersion: DEVICE_SIGNATURE_MESSAGE_VERSION,
+                signature: types_1.DEVICE_CERT_SIGNATURE,
+                messageVersion: types_1.DEVICE_SIGNATURE_MESSAGE_VERSION,
                 clients: ['native'],
                 app: { kind: 'native' },
             });
@@ -557,9 +561,9 @@ export function createAuthRouter(auth, registry, moleculer = null, shareTokens =
     const linkableProviders = async () => (await aggregateLoginMethods()).flatMap((m) => m.kind === 'redirect' && m.linkable === true
         ? [{ provider: m.id, label: m.label, startUrl: m.startUrl }]
         : []);
-    return trpcRouter({
+    return (0, trpc_middleware_js_1.trpcRouter)({
         login: credentialProcedure
-            .input(z.object({ username: z.string(), password: z.string(), refreshable: RefreshableInput }))
+            .input(zod_1.z.object({ username: zod_1.z.string(), password: zod_1.z.string(), refreshable: RefreshableInput }))
             .output(LoginResultSchema)
             .mutation(async ({ input, ctx }) => {
             const userMgmt = registry?.getSingleton('user-management');
@@ -573,14 +577,14 @@ export function createAuthRouter(auth, registry, moleculer = null, shareTokens =
                     'The `local-auth` addon failed to initialize; check server logs ' +
                     'for an error tagged `[hub/local-auth]`.');
             }
-            assertAccountNotLocked(limiters, input.username);
+            (0, auth_limits_js_1.assertAccountNotLocked)(limiters, input.username);
             const user = await userMgmt.validateCredentials({
                 username: input.username,
                 password: input.password,
             });
             if (!user) {
-                recordAccountFailure(limiters, input.username);
-                throw userError('auth.invalid-credentials', undefined, 'Invalid credentials');
+                (0, auth_limits_js_1.recordAccountFailure)(limiters, input.username);
+                throw (0, types_2.userError)('auth.invalid-credentials', undefined, 'Invalid credentials');
             }
             // ── Second-factor gate ───────────────────────────────────────
             // After credentials validate, collect every ACTIVE second
@@ -625,7 +629,7 @@ export function createAuthRouter(auth, registry, moleculer = null, shareTokens =
          *     deleted concurrently — rare).
          */
         loginVerifyTotp: credentialProcedure
-            .input(z.object({ challengeToken: z.string(), code: z.string(), refreshable: RefreshableInput }))
+            .input(zod_1.z.object({ challengeToken: zod_1.z.string(), code: zod_1.z.string(), refreshable: RefreshableInput }))
             .output(LoginResultSchema)
             .mutation(async ({ input, ctx }) => {
             const claims = auth.verifyTotpChallengeToken(input.challengeToken);
@@ -636,13 +640,13 @@ export function createAuthRouter(auth, registry, moleculer = null, shareTokens =
             if (!userMgmt) {
                 throw new Error('Login unavailable — `user-management` capability not registered');
             }
-            assertAccountNotLocked(limiters, claims.username);
+            (0, auth_limits_js_1.assertAccountNotLocked)(limiters, claims.username);
             const verify = typeof userMgmt.verifyTotp === 'function'
                 ? await userMgmt.verifyTotp({ userId: claims.userId, code: input.code.trim() })
                 : { valid: false };
             if (!verify.valid) {
-                recordAccountFailure(limiters, claims.username);
-                throw userError('auth.invalid-totp', undefined, 'Invalid TOTP code');
+                (0, auth_limits_js_1.recordAccountFailure)(limiters, claims.username);
+                throw (0, types_2.userError)('auth.invalid-totp', undefined, 'Invalid TOTP code');
             }
             return mintSessionForUserId(claims.userId, issueFor(ctx.req, claims.method ?? 'password', input.refreshable));
         }),
@@ -654,14 +658,14 @@ export function createAuthRouter(auth, registry, moleculer = null, shareTokens =
          * the client is still pre-session at this point.
          */
         loginBeginPasskey: ceremonyProcedure
-            .input(z.object({ challengeToken: z.string() }))
-            .output(OptionsJsonSchema)
+            .input(zod_1.z.object({ challengeToken: zod_1.z.string() }))
+            .output(passkey_provider_js_1.OptionsJsonSchema)
             .mutation(async ({ input }) => {
             const claims = auth.verifyTotpChallengeToken(input.challengeToken);
             if (!claims) {
-                throw userError('auth.login-challenge-expired', undefined, 'Invalid or expired login challenge — please re-enter your password');
+                throw (0, types_2.userError)('auth.login-challenge-expired', undefined, 'Invalid or expired login challenge — please re-enter your password');
             }
-            const provider = resolvePasskeyProvider(registry, moleculer);
+            const provider = (0, passkey_provider_js_1.resolvePasskeyProvider)(registry, moleculer);
             if (!provider)
                 throw new Error('Passkey authentication is not available');
             return provider.beginAuthentication({ userId: claims.userId });
@@ -674,28 +678,28 @@ export function createAuthRouter(auth, registry, moleculer = null, shareTokens =
          * `loginVerifyTotp` uses (fresh user re-fetch for up-to-date scopes).
          */
         loginVerifyPasskey: credentialProcedure
-            .input(z.object({
-            challengeToken: z.string(),
-            response: z.record(z.string(), z.unknown()),
+            .input(zod_1.z.object({
+            challengeToken: zod_1.z.string(),
+            response: zod_1.z.record(zod_1.z.string(), zod_1.z.unknown()),
             refreshable: RefreshableInput,
         }))
             .output(LoginResultSchema)
             .mutation(async ({ input, ctx }) => {
             const claims = auth.verifyTotpChallengeToken(input.challengeToken);
             if (!claims) {
-                throw userError('auth.login-challenge-expired', undefined, 'Invalid or expired login challenge — please re-enter your password');
+                throw (0, types_2.userError)('auth.login-challenge-expired', undefined, 'Invalid or expired login challenge — please re-enter your password');
             }
-            const provider = resolvePasskeyProvider(registry, moleculer);
+            const provider = (0, passkey_provider_js_1.resolvePasskeyProvider)(registry, moleculer);
             if (!provider)
                 throw new Error('Passkey authentication is not available');
-            assertAccountNotLocked(limiters, claims.username);
+            (0, auth_limits_js_1.assertAccountNotLocked)(limiters, claims.username);
             const result = await provider.finishAuthentication({
                 userId: claims.userId,
                 response: input.response,
             });
             if (!result.verified) {
-                recordAccountFailure(limiters, claims.username);
-                throw userError('auth.passkey-verification-failed', undefined, 'Passkey verification failed');
+                (0, auth_limits_js_1.recordAccountFailure)(limiters, claims.username);
+                throw (0, types_2.userError)('auth.passkey-verification-failed', undefined, 'Passkey verification failed');
             }
             return mintSessionForUserId(claims.userId, issueFor(ctx.req, claims.method ?? 'password', input.refreshable));
         }),
@@ -711,10 +715,10 @@ export function createAuthRouter(auth, registry, moleculer = null, shareTokens =
          * challenge store is bounded by its 5-min TTL prune.
          */
         passkeyLoginBegin: ceremonyProcedure
-            .input(z.void())
-            .output(OptionsJsonSchema)
+            .input(zod_1.z.void())
+            .output(passkey_provider_js_1.OptionsJsonSchema)
             .mutation(async () => {
-            const provider = resolvePasskeyProvider(registry, moleculer);
+            const provider = (0, passkey_provider_js_1.resolvePasskeyProvider)(registry, moleculer);
             if (!provider)
                 throw new Error('Passkey authentication is not available');
             return provider.beginDiscoverableAuthentication({});
@@ -735,17 +739,17 @@ export function createAuthRouter(auth, registry, moleculer = null, shareTokens =
          * re-proving it adds nothing.
          */
         passkeyLoginFinish: credentialProcedure
-            .input(z.object({ response: z.record(z.string(), z.unknown()), refreshable: RefreshableInput }))
+            .input(zod_1.z.object({ response: zod_1.z.record(zod_1.z.string(), zod_1.z.unknown()), refreshable: RefreshableInput }))
             .output(LoginResultSchema)
             .mutation(async ({ input, ctx }) => {
-            const provider = resolvePasskeyProvider(registry, moleculer);
+            const provider = (0, passkey_provider_js_1.resolvePasskeyProvider)(registry, moleculer);
             if (!provider)
                 throw new Error('Passkey authentication is not available');
             const result = await provider.finishDiscoverableAuthentication({
                 response: input.response,
             });
             if (!result.verified || !result.userId) {
-                throw trpcUserError('UNAUTHORIZED', 'auth.passkey-verification-failed', undefined, 'Passkey verification failed');
+                throw (0, user_error_js_1.trpcUserError)('UNAUTHORIZED', 'auth.passkey-verification-failed', undefined, 'Passkey verification failed');
             }
             const secondFactors = await factorsOwedHere(result.userId, 'passkey', ctx.req);
             if (secondFactors.length > 0) {
@@ -790,25 +794,25 @@ export function createAuthRouter(auth, registry, moleculer = null, shareTokens =
          *     scopes), equivalent to what `auth.login` hands out.
          */
         exchangeSession: credentialProcedure
-            .input(z.object({ refreshable: RefreshableInput }).optional())
+            .input(zod_1.z.object({ refreshable: RefreshableInput }).optional())
             .output(LoginResultSchema)
             .mutation(async ({ ctx, input }) => {
-            if (readRequestHeader(ctx.req, EXCHANGE_SESSION_HEADER) !== '1') {
-                throw new TRPCError({
+            if (readRequestHeader(ctx.req, exports.EXCHANGE_SESSION_HEADER) !== '1') {
+                throw new server_1.TRPCError({
                     code: 'FORBIDDEN',
-                    message: `Missing ${EXCHANGE_SESSION_HEADER} header`,
+                    message: `Missing ${exports.EXCHANGE_SESSION_HEADER} header`,
                 });
             }
-            const cookieToken = readSessionCookieFromHeader(readRequestHeader(ctx.req, 'cookie') ?? undefined);
+            const cookieToken = (0, session_cookie_js_1.readSessionCookieFromHeader)(readRequestHeader(ctx.req, 'cookie') ?? undefined);
             if (!cookieToken) {
-                throw trpcUserError('UNAUTHORIZED', 'auth.no-session-cookie', undefined, 'No session cookie');
+                throw (0, user_error_js_1.trpcUserError)('UNAUTHORIZED', 'auth.no-session-cookie', undefined, 'No session cookie');
             }
             let payload;
             try {
                 payload = auth.verifyToken(cookieToken);
             }
             catch {
-                throw trpcUserError('UNAUTHORIZED', 'auth.invalid-session-cookie', undefined, 'Invalid session cookie');
+                throw (0, user_error_js_1.trpcUserError)('UNAUTHORIZED', 'auth.invalid-session-cookie', undefined, 'Invalid session cookie');
             }
             // Reject non-session JWTs that verify under the same secret:
             // challenge/bridge tokens carry a `kind` discriminator, and a
@@ -817,7 +821,7 @@ export function createAuthRouter(auth, registry, moleculer = null, shareTokens =
             if (kind !== undefined ||
                 typeof payload.isAdmin !== 'boolean' ||
                 typeof payload.userId !== 'string') {
-                throw trpcUserError('UNAUTHORIZED', 'auth.invalid-session-cookie', undefined, 'Invalid session cookie');
+                throw (0, user_error_js_1.trpcUserError)('UNAUTHORIZED', 'auth.invalid-session-cookie', undefined, 'Invalid session cookie');
             }
             // A session of its own for the client that asked (the hub-served
             // viewer): signing out of one never signs the other out.
@@ -836,19 +840,19 @@ export function createAuthRouter(auth, registry, moleculer = null, shareTokens =
         /** Mint a one-time handoff code for the CALLING user. Real user
          *  sessions only — scoped (`cst_`) and share-view (`csv_`) callers
          *  must never convert themselves into a full session. */
-        createHandoffCode: protectedProcedure
-            .input(z
+        createHandoffCode: trpc_middleware_js_1.protectedProcedure
+            .input(zod_1.z
             .object({
-            purpose: z.enum(['renew', 'new-session', 'step-up']).optional(),
+            purpose: zod_1.z.enum(['renew', 'new-session', 'step-up']).optional(),
             /** PKCE S256 challenge of the app's verifier: redeem then requires the verifier. */
-            codeChallenge: z.string().min(43).max(128).optional(),
+            codeChallenge: zod_1.z.string().min(43).max(128).optional(),
             /** The app's anti-CSRF state, required again at redeem. */
-            state: z.string().min(1).max(256).optional(),
+            state: zod_1.z.string().min(1).max(256).optional(),
             /** `step-up`: a fresh single-use re-authentication, when the session itself is not a fresh sign-in. */
-            reauthToken: ReauthTokenInput.optional(),
+            reauthToken: auth_reauth_procedures_js_1.ReauthTokenInput.optional(),
         })
             .optional())
-            .output(z.object({ code: z.string(), expiresAt: z.number() }))
+            .output(zod_1.z.object({ code: zod_1.z.string(), expiresAt: zod_1.z.number() }))
             .mutation(({ ctx, input }) => {
             assertRealUserSession(ctx.user, 'Handoff-code minting');
             const purpose = input?.purpose ?? 'renew';
@@ -861,7 +865,7 @@ export function createAuthRouter(auth, registry, moleculer = null, shareTokens =
                     tags: { userId: ctx.user.id },
                     meta: { purpose },
                 });
-                throw new TRPCError({
+                throw new server_1.TRPCError({
                     code: 'BAD_REQUEST',
                     message: 'codeChallenge (S256) and state are required for this handoff',
                 });
@@ -883,12 +887,12 @@ export function createAuthRouter(auth, registry, moleculer = null, shareTokens =
         /** PUBLIC — redeem a one-time handoff code for a session bearer.
          *  Unknown / expired / already-used codes → UNAUTHORIZED. */
         redeemHandoffCode: credentialProcedure
-            .input(z.object({
-            code: z.string().min(1),
+            .input(zod_1.z.object({
+            code: zod_1.z.string().min(1),
             refreshable: RefreshableInput,
             /** PKCE: required when the code was minted with a `codeChallenge`. */
-            codeVerifier: z.string().min(1).max(256).optional(),
-            state: z.string().min(1).max(256).optional(),
+            codeVerifier: zod_1.z.string().min(1).max(256).optional(),
+            state: zod_1.z.string().min(1).max(256).optional(),
         }))
             .output(LoginResultSchema)
             .mutation(async ({ input, ctx }) => {
@@ -910,7 +914,7 @@ export function createAuthRouter(auth, registry, moleculer = null, shareTokens =
                 });
             }
             if (!grant || grant.purpose === 'step-up') {
-                throw trpcUserError('UNAUTHORIZED', 'auth.handoff-code-invalid', undefined, 'Invalid or expired handoff code');
+                throw (0, user_error_js_1.trpcUserError)('UNAUTHORIZED', 'auth.handoff-code-invalid', undefined, 'Invalid or expired handoff code');
             }
             // A `renew` code continues THE SESSION IT WAS MINTED FROM. One without a session would
             // open a brand-new session with no PKCE behind it: refused.
@@ -918,7 +922,7 @@ export function createAuthRouter(auth, registry, moleculer = null, shareTokens =
                 options.logger?.warn('Handoff redeem refused: a renew code with no session behind it', {
                     tags: { userId: grant.userId },
                 });
-                throw trpcUserError('UNAUTHORIZED', 'auth.handoff-code-invalid', undefined, 'Invalid or expired handoff code');
+                throw (0, user_error_js_1.trpcUserError)('UNAUTHORIZED', 'auth.handoff-code-invalid', undefined, 'Invalid or expired handoff code');
             }
             if (grant.purpose === 'renew' && grant.sessionId !== undefined) {
                 // A legacy client renewing: the SAME session, its expiry slides. A
@@ -927,9 +931,9 @@ export function createAuthRouter(auth, registry, moleculer = null, shareTokens =
                     return await minter.continueSession(grant.userId, grant.sessionId);
                 }
                 catch (error) {
-                    if (error instanceof SessionRefreshRefusedError ||
-                        error instanceof SessionUserGoneError) {
-                        throw new TRPCError({
+                    if (error instanceof session_mint_js_1.SessionRefreshRefusedError ||
+                        error instanceof session_mint_js_1.SessionUserGoneError) {
+                        throw new server_1.TRPCError({
                             code: 'UNAUTHORIZED',
                             message: 'Session expired — sign in again',
                         });
@@ -943,8 +947,8 @@ export function createAuthRouter(auth, registry, moleculer = null, shareTokens =
                 ...(grant.credentialId !== undefined ? { credentialId: grant.credentialId } : {}),
             });
         }),
-        me: protectedProcedure
-            .input(z.void())
+        me: trpc_middleware_js_1.protectedProcedure
+            .input(zod_1.z.void())
             .output(MeSchema)
             .query(({ ctx }) => {
             if (!ctx.user)
@@ -953,7 +957,7 @@ export function createAuthRouter(auth, registry, moleculer = null, shareTokens =
             // hide surfaces from a single probe (F1 #5). Admins summarise to
             // "everything"; a scoped principal's selectors expand to counts.
             const fleet = ctx.deviceFleet?.() ?? [];
-            const scope = summarizeEffectiveScope(ctx.user.scopes ?? [], fleet, ctx.user.isAdmin);
+            const scope = (0, types_1.summarizeEffectiveScope)(ctx.user.scopes ?? [], fleet, ctx.user.isAdmin);
             return { ...ctx.user, scope };
         }),
         /**
@@ -977,13 +981,13 @@ export function createAuthRouter(auth, registry, moleculer = null, shareTokens =
          * and the answer is "everything", which is what the panel must show
          * when the operator ticks the Admin box.
          */
-        previewScope: adminProcedure
-            .input(z.object({
-            scopes: z.array(TokenScopeSchema),
-            isAdmin: z.boolean().default(false),
+        previewScope: trpc_middleware_js_1.adminProcedure
+            .input(zod_1.z.object({
+            scopes: zod_1.z.array(types_1.TokenScopeSchema),
+            isAdmin: zod_1.z.boolean().default(false),
         }))
             .output(EffectiveScopeSchema)
-            .query(({ ctx, input }) => summarizeEffectiveScope(input.scopes, ctx.deviceFleet?.() ?? [], input.isAdmin)),
+            .query(({ ctx, input }) => (0, types_1.summarizeEffectiveScope)(input.scopes, ctx.deviceFleet?.() ?? [], input.isAdmin)),
         // ── Self-service profile operations ───────────────────────────────
         //
         // These route through the `user-management` capability provider but
@@ -996,18 +1000,18 @@ export function createAuthRouter(auth, registry, moleculer = null, shareTokens =
         // them directly here is fine. The trpc admin-gate on the cap router
         // exists only to block third-party tampering — operators acting on
         // themselves bypass it intentionally.
-        changeOwnPassword: protectedProcedure
-            .input(z.object({
-            currentPassword: z.string().min(1),
-            newPassword: z.string().min(8),
+        changeOwnPassword: trpc_middleware_js_1.protectedProcedure
+            .input(zod_1.z.object({
+            currentPassword: zod_1.z.string().min(1),
+            newPassword: zod_1.z.string().min(8),
         }))
-            .output(z.object({ success: z.literal(true) }))
+            .output(zod_1.z.object({ success: zod_1.z.literal(true) }))
             .mutation(async ({ input, ctx }) => {
             const userMgmt = registry?.getSingleton('user-management');
             if (!userMgmt)
                 throw new Error('user-management capability not available');
             if (!ctx.user)
-                throw userError('auth.not-authenticated', undefined, 'Not authenticated');
+                throw (0, types_2.userError)('auth.not-authenticated', undefined, 'Not authenticated');
             // Re-validate the current password against the live store to
             // confirm session identity → password ownership match. Stops a
             // stolen session-token from rotating credentials silently.
@@ -1019,7 +1023,7 @@ export function createAuthRouter(auth, registry, moleculer = null, shareTokens =
                 throw new Error('Current password is incorrect');
             // Hub-internal: the password changes AND every other session of the
             // user ends (this one stays signed in).
-            const internal = registry === null ? null : userManagementInternal(registry);
+            const internal = registry === null ? null : (0, hub_sessions_js_1.userManagementInternal)(registry);
             if (internal === null)
                 throw new Error('user-management capability not available');
             await internal.setPassword({
@@ -1029,44 +1033,44 @@ export function createAuthRouter(auth, registry, moleculer = null, shareTokens =
             });
             return { success: true };
         }),
-        setupOwnTotp: protectedProcedure
-            .input(z.void())
-            .output(z.object({ secret: z.string(), otpauthUrl: z.string() }))
+        setupOwnTotp: trpc_middleware_js_1.protectedProcedure
+            .input(zod_1.z.void())
+            .output(zod_1.z.object({ secret: zod_1.z.string(), otpauthUrl: zod_1.z.string() }))
             .mutation(async ({ ctx }) => {
             const userMgmt = registry?.getSingleton('user-management');
             if (!userMgmt)
                 throw new Error('user-management capability not available');
             if (!ctx.user)
-                throw userError('auth.not-authenticated', undefined, 'Not authenticated');
+                throw (0, types_2.userError)('auth.not-authenticated', undefined, 'Not authenticated');
             return userMgmt.setupTotp({ userId: ctx.user.id });
         }),
-        confirmOwnTotp: protectedProcedure
-            .input(z.object({ code: z.string().min(1) }))
-            .output(z.object({ success: z.literal(true) }))
+        confirmOwnTotp: trpc_middleware_js_1.protectedProcedure
+            .input(zod_1.z.object({ code: zod_1.z.string().min(1) }))
+            .output(zod_1.z.object({ success: zod_1.z.literal(true) }))
             .mutation(async ({ input, ctx }) => {
             const userMgmt = registry?.getSingleton('user-management');
             if (!userMgmt)
                 throw new Error('user-management capability not available');
             if (!ctx.user)
-                throw userError('auth.not-authenticated', undefined, 'Not authenticated');
+                throw (0, types_2.userError)('auth.not-authenticated', undefined, 'Not authenticated');
             return userMgmt.confirmTotp({ userId: ctx.user.id, code: input.code });
         }),
-        disableOwnTotp: protectedProcedure
+        disableOwnTotp: trpc_middleware_js_1.protectedProcedure
             // Re-authentication required: a session alone must not strip 2FA.
-            .input(z.object({ reauthToken: ReauthTokenInput }).optional())
-            .output(z.object({ success: z.literal(true) }))
+            .input(zod_1.z.object({ reauthToken: auth_reauth_procedures_js_1.ReauthTokenInput }).optional())
+            .output(zod_1.z.object({ success: zod_1.z.literal(true) }))
             .mutation(async ({ ctx, input }) => {
-            assertReauthenticated(auth, ctx.user, input?.reauthToken);
+            (0, auth_reauth_procedures_js_1.assertReauthenticated)(auth, ctx.user, input?.reauthToken);
             const userMgmt = registry?.getSingleton('user-management');
             if (!userMgmt)
                 throw new Error('user-management capability not available');
             if (!ctx.user)
-                throw userError('auth.not-authenticated', undefined, 'Not authenticated');
+                throw (0, types_2.userError)('auth.not-authenticated', undefined, 'Not authenticated');
             return userMgmt.disableTotp({ userId: ctx.user.id });
         }),
-        getOwnTotpStatus: protectedProcedure
-            .input(z.void())
-            .output(z.object({ enabled: z.boolean(), confirmedAt: z.number().nullable() }))
+        getOwnTotpStatus: trpc_middleware_js_1.protectedProcedure
+            .input(zod_1.z.void())
+            .output(zod_1.z.object({ enabled: zod_1.z.boolean(), confirmedAt: zod_1.z.number().nullable() }))
             .query(async ({ ctx }) => {
             const userMgmt = registry?.getSingleton('user-management');
             if (!userMgmt || !ctx.user)
@@ -1081,24 +1085,24 @@ export function createAuthRouter(auth, registry, moleculer = null, shareTokens =
         // THEIR OWN passkeys — the router is the trust boundary, exactly like
         // the TOTP self-service block above. Cap-agnostic: resolved through
         // the `user-passkeys` cap, never an addon id.
-        beginOwnPasskeyRegistration: protectedProcedure
-            .input(z.void())
-            .output(OptionsJsonSchema)
+        beginOwnPasskeyRegistration: trpc_middleware_js_1.protectedProcedure
+            .input(zod_1.z.void())
+            .output(passkey_provider_js_1.OptionsJsonSchema)
             .mutation(async ({ ctx }) => {
             if (!ctx.user)
-                throw userError('auth.not-authenticated', undefined, 'Not authenticated');
-            const provider = resolvePasskeyProvider(registry, moleculer);
+                throw (0, types_2.userError)('auth.not-authenticated', undefined, 'Not authenticated');
+            const provider = (0, passkey_provider_js_1.resolvePasskeyProvider)(registry, moleculer);
             if (!provider)
                 throw new Error('Passkey enrollment is not available');
             return provider.beginRegistration({ userId: ctx.user.id, username: ctx.user.username });
         }),
-        finishOwnPasskeyRegistration: protectedProcedure
-            .input(z.object({ response: z.record(z.string(), z.unknown()), label: z.string() }))
-            .output(FinishRegistrationSchema)
+        finishOwnPasskeyRegistration: trpc_middleware_js_1.protectedProcedure
+            .input(zod_1.z.object({ response: zod_1.z.record(zod_1.z.string(), zod_1.z.unknown()), label: zod_1.z.string() }))
+            .output(passkey_provider_js_1.FinishRegistrationSchema)
             .mutation(async ({ input, ctx }) => {
             if (!ctx.user)
-                throw userError('auth.not-authenticated', undefined, 'Not authenticated');
-            const provider = resolvePasskeyProvider(registry, moleculer);
+                throw (0, types_2.userError)('auth.not-authenticated', undefined, 'Not authenticated');
+            const provider = (0, passkey_provider_js_1.resolvePasskeyProvider)(registry, moleculer);
             if (!provider)
                 throw new Error('Passkey enrollment is not available');
             return provider.finishRegistration({
@@ -1107,13 +1111,13 @@ export function createAuthRouter(auth, registry, moleculer = null, shareTokens =
                 label: input.label,
             });
         }),
-        listOwnPasskeys: protectedProcedure
-            .input(z.void())
-            .output(z.array(PasskeySummarySchema))
+        listOwnPasskeys: trpc_middleware_js_1.protectedProcedure
+            .input(zod_1.z.void())
+            .output(zod_1.z.array(types_1.PasskeySummarySchema))
             .query(async ({ ctx }) => {
             if (!ctx.user)
                 return [];
-            const provider = resolvePasskeyProvider(registry, moleculer);
+            const provider = (0, passkey_provider_js_1.resolvePasskeyProvider)(registry, moleculer);
             if (!provider)
                 return [];
             try {
@@ -1123,15 +1127,15 @@ export function createAuthRouter(auth, registry, moleculer = null, shareTokens =
                 return [];
             }
         }),
-        removeOwnPasskey: protectedProcedure
+        removeOwnPasskey: trpc_middleware_js_1.protectedProcedure
             // Re-authentication required: removing a passkey can strip a factor.
-            .input(z.object({ credentialId: z.string(), reauthToken: ReauthTokenInput.optional() }))
-            .output(z.object({ success: z.literal(true) }))
+            .input(zod_1.z.object({ credentialId: zod_1.z.string(), reauthToken: auth_reauth_procedures_js_1.ReauthTokenInput.optional() }))
+            .output(zod_1.z.object({ success: zod_1.z.literal(true) }))
             .mutation(async ({ input, ctx }) => {
             if (!ctx.user)
-                throw userError('auth.not-authenticated', undefined, 'Not authenticated');
-            assertReauthenticated(auth, ctx.user, input.reauthToken);
-            const provider = resolvePasskeyProvider(registry, moleculer);
+                throw (0, types_2.userError)('auth.not-authenticated', undefined, 'Not authenticated');
+            (0, auth_reauth_procedures_js_1.assertReauthenticated)(auth, ctx.user, input.reauthToken);
+            const provider = (0, passkey_provider_js_1.resolvePasskeyProvider)(registry, moleculer);
             if (!provider)
                 throw new Error('Passkey management is not available');
             return provider.removePasskey({ userId: ctx.user.id, credentialId: input.credentialId });
@@ -1144,13 +1148,13 @@ export function createAuthRouter(auth, registry, moleculer = null, shareTokens =
          * self-service block; reads degrade to `enabled: false` so the "My
          * access" page renders even while the provider is booting.
          */
-        getOwnPasskeySecondFactorPreference: protectedProcedure
-            .input(z.void())
-            .output(SecondFactorPreferenceSchema)
+        getOwnPasskeySecondFactorPreference: trpc_middleware_js_1.protectedProcedure
+            .input(zod_1.z.void())
+            .output(passkey_provider_js_1.SecondFactorPreferenceSchema)
             .query(async ({ ctx }) => {
             if (!ctx.user)
                 return { enabled: false };
-            const provider = resolvePasskeyProvider(registry, moleculer);
+            const provider = (0, passkey_provider_js_1.resolvePasskeyProvider)(registry, moleculer);
             if (!provider)
                 return { enabled: false };
             try {
@@ -1160,13 +1164,13 @@ export function createAuthRouter(auth, registry, moleculer = null, shareTokens =
                 return { enabled: false };
             }
         }),
-        setOwnPasskeySecondFactorPreference: protectedProcedure
-            .input(z.object({ enabled: z.boolean() }))
-            .output(SetSecondFactorPreferenceSchema)
+        setOwnPasskeySecondFactorPreference: trpc_middleware_js_1.protectedProcedure
+            .input(zod_1.z.object({ enabled: zod_1.z.boolean() }))
+            .output(passkey_provider_js_1.SetSecondFactorPreferenceSchema)
             .mutation(async ({ input, ctx }) => {
             if (!ctx.user)
-                throw userError('auth.not-authenticated', undefined, 'Not authenticated');
-            const provider = resolvePasskeyProvider(registry, moleculer);
+                throw (0, types_2.userError)('auth.not-authenticated', undefined, 'Not authenticated');
+            const provider = (0, passkey_provider_js_1.resolvePasskeyProvider)(registry, moleculer);
             if (!provider)
                 throw new Error('Passkey management is not available');
             return provider.setSecondFactorPreference({
@@ -1179,9 +1183,9 @@ export function createAuthRouter(auth, registry, moleculer = null, shareTokens =
         //    or regular); the resulting `csv_*` token authenticates as a
         //    restricted `share-view` principal limited to the embed surface
         //    + its in-scope devices (see `share-view-access.ts`). ──────────
-        createShareToken: protectedProcedure
+        createShareToken: trpc_middleware_js_1.protectedProcedure
             .input(CreateShareTokenInputSchema)
-            .output(z.object({ id: z.string(), token: z.string(), expiresAt: z.number().nullable() }))
+            .output(zod_1.z.object({ id: zod_1.z.string(), token: zod_1.z.string(), expiresAt: zod_1.z.number().nullable() }))
             .mutation(async ({ input, ctx }) => {
             assertRealUserSession(ctx.user);
             const service = requireShareTokens();
@@ -1198,10 +1202,10 @@ export function createAuthRouter(auth, registry, moleculer = null, shareTokens =
                 ? input.scope
                 : {
                     ...input.scope,
-                    deviceIds: filterViewableDeviceIds(ctx.user.scopes ?? [], input.scope.deviceIds, ctx.deviceScopeLookup),
+                    deviceIds: (0, principal_visibility_js_1.filterViewableDeviceIds)(ctx.user.scopes ?? [], input.scope.deviceIds, ctx.deviceScopeLookup),
                 };
             if (scope.deviceIds.length === 0) {
-                throw new TRPCError({
+                throw new server_1.TRPCError({
                     code: 'FORBIDDEN',
                     message: 'None of the requested devices are within your scope — you cannot mint a share token for devices you cannot see',
                 });
@@ -1218,12 +1222,12 @@ export function createAuthRouter(auth, registry, moleculer = null, shareTokens =
          * Home Assistant embed cache so a long-lived dashboard does not mint a
          * new row every hour. Expired / missing → NOT_FOUND (caller must create).
          */
-        extendShareToken: protectedProcedure
-            .input(z.object({
-            id: z.string().min(1),
-            ttlSec: z.number().int().min(SHARE_TOKEN_TTL_MIN_SEC).max(SHARE_TOKEN_TTL_MAX_SEC),
+        extendShareToken: trpc_middleware_js_1.protectedProcedure
+            .input(zod_1.z.object({
+            id: zod_1.z.string().min(1),
+            ttlSec: zod_1.z.number().int().min(share_token_service_js_1.SHARE_TOKEN_TTL_MIN_SEC).max(share_token_service_js_1.SHARE_TOKEN_TTL_MAX_SEC),
         }))
-            .output(z.object({ id: z.string(), expiresAt: z.number() }))
+            .output(zod_1.z.object({ id: zod_1.z.string(), expiresAt: zod_1.z.number() }))
             .mutation(async ({ input, ctx }) => {
             assertRealUserSession(ctx.user);
             const service = requireShareTokens();
@@ -1235,24 +1239,24 @@ export function createAuthRouter(auth, registry, moleculer = null, shareTokens =
                     callerIsAdmin: ctx.user.isAdmin,
                 });
                 if (record.expiresAt === null) {
-                    throw trpcUserError('BAD_REQUEST', 'auth.share-never-expiring-extend', undefined, 'A never-expiring share token cannot be extended');
+                    throw (0, user_error_js_1.trpcUserError)('BAD_REQUEST', 'auth.share-never-expiring-extend', undefined, 'A never-expiring share token cannot be extended');
                 }
                 return { id: record.id, expiresAt: record.expiresAt };
             }
             catch (error) {
                 const message = error instanceof Error ? error.message : 'Share token extend failed';
                 if (/not found|expired/i.test(message)) {
-                    throw new TRPCError({ code: 'NOT_FOUND', message });
+                    throw new server_1.TRPCError({ code: 'NOT_FOUND', message });
                 }
                 if (/owner or an admin|never-expiring/i.test(message)) {
-                    throw new TRPCError({ code: 'FORBIDDEN', message });
+                    throw new server_1.TRPCError({ code: 'FORBIDDEN', message });
                 }
-                throw new TRPCError({ code: 'BAD_REQUEST', message });
+                throw new server_1.TRPCError({ code: 'BAD_REQUEST', message });
             }
         }),
-        revokeShareToken: protectedProcedure
-            .input(z.object({ id: z.string().min(1) }))
-            .output(z.object({ success: z.boolean() }))
+        revokeShareToken: trpc_middleware_js_1.protectedProcedure
+            .input(zod_1.z.object({ id: zod_1.z.string().min(1) }))
+            .output(zod_1.z.object({ success: zod_1.z.boolean() }))
             .mutation(async ({ input, ctx }) => {
             assertRealUserSession(ctx.user);
             const service = requireShareTokens();
@@ -1263,7 +1267,7 @@ export function createAuthRouter(auth, registry, moleculer = null, shareTokens =
                     callerIsAdmin: ctx.user.isAdmin,
                 });
                 if (removed) {
-                    const internal = registry === null ? null : userManagementInternal(registry);
+                    const internal = registry === null ? null : (0, hub_sessions_js_1.userManagementInternal)(registry);
                     if (internal !== null) {
                         const ip = network.clientAddress(ctx.req).ip;
                         await internal.audit.record({
@@ -1283,7 +1287,7 @@ export function createAuthRouter(auth, registry, moleculer = null, shareTokens =
                 return { success: removed };
             }
             catch (error) {
-                throw new TRPCError({
+                throw new server_1.TRPCError({
                     code: 'FORBIDDEN',
                     message: error instanceof Error ? error.message : 'Share token revoke failed',
                 });
@@ -1294,15 +1298,15 @@ export function createAuthRouter(auth, registry, moleculer = null, shareTokens =
          * `owner: 'all'` — every user's, admin only. Omitted keeps the original
          * answer (own for a user, all for an admin) for clients that predate it.
          */
-        listShareTokens: protectedProcedure
-            .input(z.object({ owner: z.enum(['self', 'all']).optional() }).optional())
-            .output(z.array(ShareTokenSummarySchema))
+        listShareTokens: trpc_middleware_js_1.protectedProcedure
+            .input(zod_1.z.object({ owner: zod_1.z.enum(['self', 'all']).optional() }).optional())
+            .output(zod_1.z.array(ShareTokenSummarySchema))
             .query(async ({ ctx, input }) => {
             assertRealUserSession(ctx.user);
             const service = requireShareTokens();
             const owner = input?.owner ?? (ctx.user.isAdmin ? 'all' : 'self');
             if (owner === 'all' && !ctx.user.isAdmin) {
-                throw new TRPCError({
+                throw new server_1.TRPCError({
                     code: 'FORBIDDEN',
                     message: "Listing every user's share links requires an admin",
                 });
@@ -1310,11 +1314,11 @@ export function createAuthRouter(auth, registry, moleculer = null, shareTokens =
             const records = owner === 'all' ? await service.listAll() : await service.listForUser(ctx.user.id);
             return records.map(toShareTokenSummary);
         }),
-        ...createSessionProcedures({ registry, minter, credentialProcedure }),
-        ...createDeviceCertProcedures({
+        ...(0, auth_sessions_procedures_js_1.createSessionProcedures)({ registry, minter, credentialProcedure }),
+        ...(0, auth_device_cert_procedures_js_1.createDeviceCertProcedures)({
             registry,
             minter,
-            publicProcedure,
+            publicProcedure: trpc_middleware_js_1.publicProcedure,
             auth,
             credentialLimiter: limiters.credential,
             ceremonyLimiter: limiters.ceremony,
@@ -1326,9 +1330,9 @@ export function createAuthRouter(auth, registry, moleculer = null, shareTokens =
             resolveOrigin: resolveDeviceOrigin,
             issueFor,
         }),
-        ...createReauthProcedures({ auth, registry, moleculer, limiters }),
-        ...createAdminTokenProcedures({ auth, registry, network }),
-        ...createRevokeCredentialsProcedures({ registry, shareTokens, network }),
+        ...(0, auth_reauth_procedures_js_1.createReauthProcedures)({ auth, registry, moleculer, limiters }),
+        ...(0, auth_admin_tokens_procedures_js_1.createAdminTokenProcedures)({ auth, registry, network }),
+        ...(0, auth_revoke_credentials_procedures_js_1.createRevokeCredentialsProcedures)({ registry, shareTokens, network }),
         // ── External sign-in identities (D782) ────────────────────────
         //
         // A signed-in user links an OIDC identity to THEIR OWN account. The
@@ -1336,9 +1340,9 @@ export function createAuthRouter(auth, registry, moleculer = null, shareTokens =
         // which also requires the same user's session cookie — the user id never
         // travels through the browser.
         /** Sign-in providers the caller can link (redirect methods declaring `linkable`). */
-        listLinkableProviders: protectedProcedure
-            .input(z.void())
-            .output(z.array(z.object({ provider: z.string(), label: z.string() })))
+        listLinkableProviders: trpc_middleware_js_1.protectedProcedure
+            .input(zod_1.z.void())
+            .output(zod_1.z.array(zod_1.z.object({ provider: zod_1.z.string(), label: zod_1.z.string() })))
             .query(async () => (await linkableProviders()).map(({ provider, label }) => ({ provider, label }))),
         /**
          * Start linking `provider` to the caller; the client navigates to `url`.
@@ -1346,33 +1350,33 @@ export function createAuthRouter(auth, registry, moleculer = null, shareTokens =
          * (`APP_AUTH_CALLBACK_URLS`); the finish then parks the link for the app
          * to claim with `completeExternalLink` instead of needing a session cookie.
          */
-        beginExternalLink: protectedProcedure
-            .input(z.object({
-            provider: z.string().min(1),
-            returnTo: z.string().optional(),
+        beginExternalLink: trpc_middleware_js_1.protectedProcedure
+            .input(zod_1.z.object({
+            provider: zod_1.z.string().min(1),
+            returnTo: zod_1.z.string().optional(),
             /** From `auth.reauthenticate` — linking needs a fresh proof, not just a session. */
-            reauthToken: ReauthTokenInput.optional(),
+            reauthToken: auth_reauth_procedures_js_1.ReauthTokenInput.optional(),
         }))
-            .output(z.object({ url: z.string() }))
+            .output(zod_1.z.object({ url: zod_1.z.string() }))
             .mutation(async ({ ctx, input }) => {
             if (!ctx.user)
-                throw new TRPCError({ code: 'UNAUTHORIZED' });
+                throw new server_1.TRPCError({ code: 'UNAUTHORIZED' });
             assertRealUserSession(ctx.user, 'Linking a sign-in account');
             // Per user AND per client: each call mints an entry in a bounded
             // shared map, so a flood must not evict other users' pending links.
-            limitByUser(limiters.link, 'auth.beginExternalLink', ctx.user.id);
-            limitByClient(limiters.ceremony, 'auth.beginExternalLink', ctx.req, network);
-            assertReauthenticated(auth, ctx.user, input.reauthToken);
-            const returnTo = input.returnTo === undefined ? undefined : parseAppAuthCallback(input.returnTo);
+            (0, auth_limits_js_1.limitByUser)(limiters.link, 'auth.beginExternalLink', ctx.user.id);
+            (0, auth_limits_js_1.limitByClient)(limiters.ceremony, 'auth.beginExternalLink', ctx.req, network);
+            (0, auth_reauth_procedures_js_1.assertReauthenticated)(auth, ctx.user, input.reauthToken);
+            const returnTo = input.returnTo === undefined ? undefined : (0, types_1.parseAppAuthCallback)(input.returnTo);
             if (returnTo === null) {
-                throw new TRPCError({
+                throw new server_1.TRPCError({
                     code: 'BAD_REQUEST',
                     message: 'returnTo is not an allowed app callback',
                 });
             }
             const target = (await linkableProviders()).find((p) => p.provider === input.provider);
             if (target === undefined) {
-                throw new TRPCError({
+                throw new server_1.TRPCError({
                     code: 'BAD_REQUEST',
                     message: `Sign-in provider "${input.provider}" is not available for linking`,
                 });
@@ -1388,17 +1392,17 @@ export function createAuthRouter(auth, registry, moleculer = null, shareTokens =
          * whatever the outcome.
          */
         completeExternalLink: selfCodeProcedure
-            .input(z.object({ code: z.string().min(1).max(256) }))
-            .output(z.object({
-            outcome: z.enum(['linked', 'conflict', 'expired', 'session']),
-            provider: z.string().optional(),
+            .input(zod_1.z.object({ code: zod_1.z.string().min(1).max(256) }))
+            .output(zod_1.z.object({
+            outcome: zod_1.z.enum(['linked', 'conflict', 'expired', 'session']),
+            provider: zod_1.z.string().optional(),
         }))
             .mutation(async ({ ctx, input }) => {
             if (!ctx.user)
-                throw new TRPCError({ code: 'UNAUTHORIZED' });
+                throw new server_1.TRPCError({ code: 'UNAUTHORIZED' });
             assertRealUserSession(ctx.user, 'Linking a sign-in account');
             if (nativeLink === null) {
-                throw new TRPCError({
+                throw new server_1.TRPCError({
                     code: 'PRECONDITION_FAILED',
                     message: 'Native linking is not available',
                 });
@@ -1418,14 +1422,14 @@ export function createAuthRouter(auth, registry, moleculer = null, shareTokens =
          * lands on that page only: the route takes no destination.
          */
         createBrowserHandoff: selfCodeProcedure
-            .input(z.void())
-            .output(z.object({ path: z.string(), expiresAt: z.number() }))
+            .input(zod_1.z.void())
+            .output(zod_1.z.object({ path: zod_1.z.string(), expiresAt: zod_1.z.number() }))
             .mutation(({ ctx }) => {
             if (!ctx.user)
-                throw new TRPCError({ code: 'UNAUTHORIZED' });
+                throw new server_1.TRPCError({ code: 'UNAUTHORIZED' });
             assertRealUserSession(ctx.user, 'Opening the account page in a browser');
             if (nativeLink === null) {
-                throw new TRPCError({
+                throw new server_1.TRPCError({
                     code: 'PRECONDITION_FAILED',
                     message: 'Browser handoff is not available',
                 });
@@ -1435,12 +1439,12 @@ export function createAuthRouter(auth, registry, moleculer = null, shareTokens =
                 purpose: 'new-session',
                 ...(parentCredential !== undefined ? { credentialId: parentCredential } : {}),
             });
-            return { path: `${BROWSER_HANDOFF_PATH}?code=${encodeURIComponent(code)}`, expiresAt };
+            return { path: `${exports.BROWSER_HANDOFF_PATH}?code=${encodeURIComponent(code)}`, expiresAt };
         }),
         /** The caller's linked identities; `available: false` when the provider instance is gone or off. */
-        listOwnExternalIdentities: protectedProcedure
-            .input(z.void())
-            .output(z.array(OwnExternalIdentitySchema))
+        listOwnExternalIdentities: trpc_middleware_js_1.protectedProcedure
+            .input(zod_1.z.void())
+            .output(zod_1.z.array(OwnExternalIdentitySchema))
             .query(async ({ ctx }) => {
             if (!ctx.user)
                 return [];
@@ -1459,12 +1463,12 @@ export function createAuthRouter(auth, registry, moleculer = null, shareTokens =
             }));
         }),
         /** Remove one of the caller's own links. */
-        unlinkOwnExternalIdentity: protectedProcedure
-            .input(z.object({ provider: z.string().min(1), subject: z.string().min(1) }))
-            .output(z.object({ success: z.boolean() }))
+        unlinkOwnExternalIdentity: trpc_middleware_js_1.protectedProcedure
+            .input(zod_1.z.object({ provider: zod_1.z.string().min(1), subject: zod_1.z.string().min(1) }))
+            .output(zod_1.z.object({ success: zod_1.z.boolean() }))
             .mutation(async ({ ctx, input }) => {
             if (!ctx.user)
-                throw new TRPCError({ code: 'UNAUTHORIZED' });
+                throw new server_1.TRPCError({ code: 'UNAUTHORIZED' });
             assertRealUserSession(ctx.user, 'Unlinking a sign-in account');
             const userMgmt = registry?.getSingleton('user-management');
             if (!userMgmt)
@@ -1491,18 +1495,18 @@ export function createAuthRouter(auth, registry, moleculer = null, shareTokens =
          * `listProviders`' old resilience) so one bad addon can't lock every
          * login method out of the UI.
          */
-        listLoginMethods: publicProcedure
-            .input(z.void())
-            .output(z.array(PublicLoginMethodSchema).readonly())
+        listLoginMethods: trpc_middleware_js_1.publicProcedure
+            .input(zod_1.z.void())
+            .output(zod_1.z.array(PublicLoginMethodSchema).readonly())
             .query(async () => aggregateLoginMethods()),
         /**
          * The hub's human name (D861), public like `listLoginMethods` and exposing
          * nothing else. A separate method on purpose: `listLoginMethods` stays the bare
          * array every installed viewer already parses.
          */
-        getServerName: publicProcedure
-            .input(z.void())
-            .output(ServerNameInfoSchema)
+        getServerName: trpc_middleware_js_1.publicProcedure
+            .input(zod_1.z.void())
+            .output(types_1.ServerNameInfoSchema)
             .query(async () => serverNameReader.read()),
     });
 }