@camstack/server 1.2.594 → 1.2.596

package/dist/api/core/capability-preference-writes.js

@@ -1,3 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.singletonPreferenceKey = singletonPreferenceKey;
+exports.singletonSwitchRefusal = singletonSwitchRefusal;
+exports.writeSingletonPreference = writeSingletonPreference;
+exports.writeCollectionToggle = writeCollectionToggle;
+exports.writeCollectionEnabledSet = writeCollectionEnabledSet;
 /**
  * The ONE write order for an operator's capability preference: PERSIST, then
  * switch the live registry (D675 amendment, 2026-09-29).
@@ -21,10 +28,10 @@
  * `setCollectionEnabledProviders`) and the `addons` cap's
  * `setCapabilityProviderEnabled`.
  */
-import { TRPCError } from '@trpc/server';
-import { persistCollectionDisabled } from './collection-preference';
+const server_1 = require("@trpc/server");
+const collection_preference_1 = require("./collection-preference");
 /** ConfigService key holding a singleton preference (global or per-node). */
-export function singletonPreferenceKey(capability, nodeId) {
+function singletonPreferenceKey(capability, nodeId) {
     return nodeId === undefined
         ? `capabilities.singleton.${capability}`
         : `capabilities.singletonNode.${capability}.${nodeId}`;
@@ -60,7 +67,7 @@ function findCapability(registry, capability) {
  * Reads the registry's own projection (`providers`, `perNode`), the same sets
  * `setActiveSingleton` checks.
  */
-export function singletonSwitchRefusal(registry, write) {
+function singletonSwitchRefusal(registry, write) {
     const cap = findCapability(registry, write.capability);
     if (cap === null) {
         return { code: 'NOT_FOUND', message: `Unknown capability: ${write.capability}` };
@@ -87,10 +94,10 @@ export function singletonSwitchRefusal(registry, write) {
     return null;
 }
 function refuse(refusal) {
-    throw new TRPCError({ code: refusal.code, message: refusal.message });
+    throw new server_1.TRPCError({ code: refusal.code, message: refusal.message });
 }
 /** Persist a singleton preference, then switch the registry. */
-export async function writeSingletonPreference(store, registry, write) {
+async function writeSingletonPreference(store, registry, write) {
     await serialised(write.capability, async () => {
         const refusal = singletonSwitchRefusal(registry, write);
         if (refusal !== null)
@@ -120,7 +127,7 @@ function applyDisabledSet(registry, capability, current, next) {
     }
 }
 /** Persist one collection provider's enable/disable, then apply it live. */
-export async function writeCollectionToggle(store, registry, toggle) {
+async function writeCollectionToggle(store, registry, toggle) {
     await serialised(toggle.capability, async () => {
         const cap = requireCollection(registry, toggle.capability);
         if (!cap.providers.includes(toggle.addonId)) {
@@ -135,7 +142,7 @@ export async function writeCollectionToggle(store, registry, toggle) {
             next.delete(toggle.addonId);
         else
             next.add(toggle.addonId);
-        await persistCollectionDisabled(store, toggle.capability, [...next]);
+        await (0, collection_preference_1.persistCollectionDisabled)(store, toggle.capability, [...next]);
         applyDisabledSet(registry, toggle.capability, current, next);
     });
 }
@@ -144,7 +151,7 @@ export async function writeCollectionToggle(store, registry, toggle) {
  * Registered providers outside `enabledAddonIds` are disabled; a disabled id
  * whose provider is not registered right now keeps its disabled mark.
  */
-export async function writeCollectionEnabledSet(store, registry, capability, enabledAddonIds) {
+async function writeCollectionEnabledSet(store, registry, capability, enabledAddonIds) {
     await serialised(capability, async () => {
         const cap = requireCollection(registry, capability);
         const wanted = new Set(enabledAddonIds);
@@ -156,7 +163,7 @@ export async function writeCollectionEnabledSet(store, registry, capability, ena
             else
                 next.add(providerId);
         }
-        await persistCollectionDisabled(store, capability, [...next]);
+        await (0, collection_preference_1.persistCollectionDisabled)(store, capability, [...next]);
         applyDisabledSet(registry, capability, current, next);
     });
 }

package/dist/api/core/certificates.router.js

@@ -1,3 +1,6 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createCertificatesRouter = createCertificatesRouter;
 /**
  * Certificates inventory and management - fixed core API for Identity ->
  * Certificates (D855, D856).
@@ -19,100 +22,100 @@
  *    the node, which must be paired again. Neither forgets a node:
  *    that stays `clusterNodes.forgetNode`.
  */
-import { X509Certificate } from 'node:crypto';
-import { caFingerprint, dropProcessPeer, getProcessMeshCaState, getProcessAgentHttpsNames, getProcessMeshCertificateRegistry, getProcessMeshTlsListenerState, getProcessPeerLeaf, onProcessNodeRegistered, issueAgentHttpsLeaf, processMeshCrl, renewMeshCertificate, revokeMeshCertificate, } from '@camstack/system';
-import { TRPCError } from '@trpc/server';
-import { z } from 'zod';
-import { adminProcedure, trpcRouter } from '../trpc/trpc.middleware.js';
+const node_crypto_1 = require("node:crypto");
+const system_1 = require("@camstack/system");
+const server_1 = require("@trpc/server");
+const zod_1 = require("zod");
+const trpc_middleware_js_1 = require("../trpc/trpc.middleware.js");
 const HUB_NODE_ID = 'hub';
 const EXPIRING_SOON_MS = 7 * 86_400_000;
-const TlsStatusRowSchema = z.object({
-    mode: z.enum(['generated', 'uploaded', 'disabled']),
-    leafFingerprintSha256: z.string().nullable(),
-    caFingerprintSha256: z.string().nullable(),
-    validTo: z.string().nullable(),
-    sans: z.array(z.string()),
-    reissueError: z.string().nullable(),
-    restartRequired: z.boolean(),
+const TlsStatusRowSchema = zod_1.z.object({
+    mode: zod_1.z.enum(['generated', 'uploaded', 'disabled']),
+    leafFingerprintSha256: zod_1.z.string().nullable(),
+    caFingerprintSha256: zod_1.z.string().nullable(),
+    validTo: zod_1.z.string().nullable(),
+    sans: zod_1.z.array(zod_1.z.string()),
+    reissueError: zod_1.z.string().nullable(),
+    restartRequired: zod_1.z.boolean(),
 });
-const NodeHttpsSchema = z.object({
-    nodeId: z.string(),
-    isHub: z.boolean(),
-    online: z.boolean(),
-    https: z.discriminatedUnion('kind', [
-        z.object({ kind: z.literal('served'), status: TlsStatusRowSchema }),
-        z.object({ kind: z.literal('not-served'), reason: z.string() }),
+const NodeHttpsSchema = zod_1.z.object({
+    nodeId: zod_1.z.string(),
+    isHub: zod_1.z.boolean(),
+    online: zod_1.z.boolean(),
+    https: zod_1.z.discriminatedUnion('kind', [
+        zod_1.z.object({ kind: zod_1.z.literal('served'), status: TlsStatusRowSchema }),
+        zod_1.z.object({ kind: zod_1.z.literal('not-served'), reason: zod_1.z.string() }),
         /** The hub could not read it right now: say so, never present it as "none". */
-        z.object({ kind: z.literal('unreadable'), reason: z.string() }),
+        zod_1.z.object({ kind: zod_1.z.literal('unreadable'), reason: zod_1.z.string() }),
     ]),
 });
-const MeshLeafRowSchema = z.object({
-    serial: z.string(),
-    fingerprintSha256: z.string(),
-    notBefore: z.number(),
-    notAfter: z.number(),
-    issuedAt: z.number(),
+const MeshLeafRowSchema = zod_1.z.object({
+    serial: zod_1.z.string(),
+    fingerprintSha256: zod_1.z.string(),
+    notBefore: zod_1.z.number(),
+    notAfter: zod_1.z.number(),
+    issuedAt: zod_1.z.number(),
     /** `enroll` | `pairing` | `renewal` | `boot` were issued by the hub; `observed` was read off a live connection. */
-    issuedVia: z.enum(['enroll', 'pairing', 'renewal', 'boot', 'observed']),
-    status: z.enum(['valid', 'expiring', 'expired', 'revoked']),
-    revokedAt: z.number().nullable(),
-    revokedReason: z.string().nullable(),
+    issuedVia: zod_1.z.enum(['enroll', 'pairing', 'renewal', 'boot', 'observed']),
+    status: zod_1.z.enum(['valid', 'expiring', 'expired', 'revoked']),
+    revokedAt: zod_1.z.number().nullable(),
+    revokedReason: zod_1.z.string().nullable(),
 });
-const MeshNodeSchema = z.object({
-    nodeId: z.string(),
-    online: z.boolean(),
+const MeshNodeSchema = zod_1.z.object({
+    nodeId: zod_1.z.string(),
+    online: zod_1.z.boolean(),
     /** The leaf the node holds now: the newest non-revoked one. `null` when none is known. */
     current: MeshLeafRowSchema.nullable(),
     /** The node is connected and presents exactly `current`. `null` when it is offline. */
-    presentingCurrent: z.boolean().nullable(),
+    presentingCurrent: zod_1.z.boolean().nullable(),
     /** Older and revoked leaves, newest first. */
-    history: z.array(MeshLeafRowSchema),
+    history: zod_1.z.array(MeshLeafRowSchema),
 });
-const MeshInventorySchema = z.object({
-    ca: z.discriminatedUnion('state', [
-        z.object({
-            state: z.literal('ready'),
-            subject: z.string(),
-            fingerprintSha256: z.string(),
-            validTo: z.string(),
+const MeshInventorySchema = zod_1.z.object({
+    ca: zod_1.z.discriminatedUnion('state', [
+        zod_1.z.object({
+            state: zod_1.z.literal('ready'),
+            subject: zod_1.z.string(),
+            fingerprintSha256: zod_1.z.string(),
+            validTo: zod_1.z.string(),
         }),
-        z.object({ state: z.literal('unavailable'), reason: z.string() }),
+        zod_1.z.object({ state: zod_1.z.literal('unavailable'), reason: zod_1.z.string() }),
     ]),
     /** Serials the hub refuses at the mesh handshake. Persisted with the registry and replayed at boot. */
-    revokedSerials: z.array(z.string()),
+    revokedSerials: zod_1.z.array(zod_1.z.string()),
     /** `false` while the registry is not up (no settings store): the node list is then incomplete. */
-    registryAvailable: z.boolean(),
+    registryAvailable: zod_1.z.boolean(),
     /** The hub's mesh TLS listener: `closed` means every agent is refused (e.g. revocations not loaded). */
-    listener: z.discriminatedUnion('state', [
-        z.object({ state: z.literal('open') }),
-        z.object({ state: z.literal('closed'), reason: z.string(), since: z.number() }),
-        z.object({ state: z.literal('not-started') }),
+    listener: zod_1.z.discriminatedUnion('state', [
+        zod_1.z.object({ state: zod_1.z.literal('open') }),
+        zod_1.z.object({ state: zod_1.z.literal('closed'), reason: zod_1.z.string(), since: zod_1.z.number() }),
+        zod_1.z.object({ state: zod_1.z.literal('not-started') }),
     ]),
-    nodes: z.array(MeshNodeSchema),
+    nodes: zod_1.z.array(MeshNodeSchema),
 });
-const MeshRenewResultSchema = z.discriminatedUnion('ok', [
-    z.object({
-        ok: z.literal(true),
-        nodeId: z.string(),
-        oldSerial: z.string().nullable(),
-        newSerial: z.string(),
-        newNotAfter: z.number(),
+const MeshRenewResultSchema = zod_1.z.discriminatedUnion('ok', [
+    zod_1.z.object({
+        ok: zod_1.z.literal(true),
+        nodeId: zod_1.z.string(),
+        oldSerial: zod_1.z.string().nullable(),
+        newSerial: zod_1.z.string(),
+        newNotAfter: zod_1.z.number(),
     }),
-    z.object({
-        ok: z.literal(false),
-        nodeId: z.string(),
-        stage: z.enum(['prepare', 'issue', 'install', 'reconnect', 'confirm']),
-        reason: z.string(),
+    zod_1.z.object({
+        ok: zod_1.z.literal(false),
+        nodeId: zod_1.z.string(),
+        stage: zod_1.z.enum(['prepare', 'issue', 'install', 'reconnect', 'confirm']),
+        reason: zod_1.z.string(),
         /** The node is on its previous leaf (or never left it): nothing was broken. */
-        keptPreviousLeaf: z.boolean(),
+        keptPreviousLeaf: zod_1.z.boolean(),
     }),
 ]);
-const MeshRevokeResultSchema = z.object({
-    nodeId: z.string(),
-    revokedSerials: z.array(z.string()),
-    disconnected: z.number().int(),
+const MeshRevokeResultSchema = zod_1.z.object({
+    nodeId: zod_1.z.string(),
+    revokedSerials: zod_1.z.array(zod_1.z.string()),
+    disconnected: zod_1.z.number().int(),
     /** What the operator does next. Revoking does not forget the node. */
-    next: z.string(),
+    next: zod_1.z.string(),
 });
 function leafStatus(record, at) {
     if (record.revokedAt !== null)
@@ -121,11 +124,11 @@ function leafStatus(record, at) {
         return 'expired';
     return record.notAfter - at < EXPIRING_SOON_MS ? 'expiring' : 'valid';
 }
-export function createCertificatesRouter(deps) {
+function createCertificatesRouter(deps) {
     const localNetwork = () => {
         const provider = deps.registry?.getSingleton('local-network');
         if (!provider) {
-            throw new TRPCError({
+            throw new server_1.TRPCError({
                 code: 'PRECONDITION_FAILED',
                 message: 'The local-network capability is not available yet',
             });
@@ -133,22 +136,22 @@ export function createCertificatesRouter(deps) {
         return provider;
     };
     const peers = deps.peers ?? {
-        peerLeaf: (nodeId) => getProcessPeerLeaf(nodeId),
-        dropPeer: (nodeId) => dropProcessPeer(nodeId),
+        peerLeaf: (nodeId) => (0, system_1.getProcessPeerLeaf)(nodeId),
+        dropPeer: (nodeId) => (0, system_1.dropProcessPeer)(nodeId),
     };
-    const meshRegistry = deps.meshRegistry ?? getProcessMeshCertificateRegistry;
-    const crl = deps.crl ?? processMeshCrl;
+    const meshRegistry = deps.meshRegistry ?? system_1.getProcessMeshCertificateRegistry;
+    const crl = deps.crl ?? system_1.processMeshCrl;
     const meshCa = deps.meshCa ??
         (() => {
-            const state = getProcessMeshCaState();
+            const state = (0, system_1.getProcessMeshCaState)();
             return state.state === 'ready' ? state.ca : null;
         });
-    const issueHttps = deps.issueHttps ?? issueAgentHttpsLeaf;
+    const issueHttps = deps.issueHttps ?? system_1.issueAgentHttpsLeaf;
     const listenerState = deps.listenerState ??
-        (() => getProcessMeshTlsListenerState() ?? { state: 'not-started' });
-    const httpsNames = deps.httpsNames ?? getProcessAgentHttpsNames;
+        (() => (0, system_1.getProcessMeshTlsListenerState)() ?? { state: 'not-started' });
+    const httpsNames = deps.httpsNames ?? system_1.getProcessAgentHttpsNames;
     const registrations = deps.registrations ?? {
-        subscribe: (listener) => onProcessNodeRegistered(listener),
+        subscribe: (listener) => (0, system_1.onProcessNodeRegistered)(listener),
     };
     /** One certificate operation per node at a time: a second one is refused, not interleaved. */
     const busy = new Set();
@@ -158,7 +161,7 @@ export function createCertificatesRouter(deps) {
                 tags: { nodeId: key },
                 meta: { what },
             });
-            throw new TRPCError({
+            throw new server_1.TRPCError({
                 code: 'CONFLICT',
                 message: `Another certificate operation is already running on ${key}. Wait for it to finish.`,
             });
@@ -173,14 +176,14 @@ export function createCertificatesRouter(deps) {
     };
     const requireAgent = (nodeId) => {
         if (nodeId === HUB_NODE_ID) {
-            throw new TRPCError({
+            throw new server_1.TRPCError({
                 code: 'PRECONDITION_FAILED',
                 message: 'The hub is not an agent: its HTTPS leaf is renewed with renewHttpsOnNode on "hub", and its mesh leaf is re-issued at every boot.',
             });
         }
         const client = deps.nodeClient(nodeId);
         if (client === null) {
-            throw new TRPCError({
+            throw new server_1.TRPCError({
                 code: 'PRECONDITION_FAILED',
                 message: `Node ${nodeId} is not reachable, or runs an agent too old to manage its certificates (update it).`,
             });
@@ -213,11 +216,11 @@ export function createCertificatesRouter(deps) {
         reissueError: null,
         restartRequired: false,
     });
-    return trpcRouter({
+    return (0, trpc_middleware_js_1.trpcRouter)({
         /** HTTPS certificate state per node. The hub serves its own; an agent serves a hub-issued leaf. */
-        listHttpsCertificates: adminProcedure
-            .input(z.void())
-            .output(z.array(NodeHttpsSchema))
+        listHttpsCertificates: trpc_middleware_js_1.adminProcedure
+            .input(zod_1.z.void())
+            .output(zod_1.z.array(NodeHttpsSchema))
             .query(async () => {
             const nodes = deps.agentRegistry.listNodeLiveness();
             const entries = nodes.some((n) => n.id === HUB_NODE_ID)
@@ -307,8 +310,8 @@ export function createCertificatesRouter(deps) {
          * local CA for the names the agent reports (private addresses and local-only host
          * names), and the agent hot-swaps it - no restart, no private key on the mesh.
          */
-        renewHttpsOnNode: adminProcedure
-            .input(z.object({ nodeId: z.string().min(1), reason: z.string().max(200).optional() }))
+        renewHttpsOnNode: trpc_middleware_js_1.adminProcedure
+            .input(zod_1.z.object({ nodeId: zod_1.z.string().min(1), reason: zod_1.z.string().max(200).optional() }))
             .output(TlsStatusRowSchema)
             .mutation(async ({ input }) => {
             if (input.nodeId === HUB_NODE_ID) {
@@ -350,7 +353,7 @@ export function createCertificatesRouter(deps) {
                     // the authenticated install call, so the node re-pins instead of refusing for ever.
                     const caRotation = prepared.pinnedCaFingerprintSha256 !== null &&
                         prepared.pinnedCaFingerprintSha256 !==
-                            new X509Certificate(issued.caCertPem).fingerprint256;
+                            new node_crypto_1.X509Certificate(issued.caCertPem).fingerprint256;
                     deps.log.info('Agent HTTPS leaf issued', {
                         tags,
                         meta: { accepted: issued.accepted, rejected: issued.rejected },
@@ -369,7 +372,7 @@ export function createCertificatesRouter(deps) {
                 catch (error) {
                     const message = error instanceof Error ? error.message : String(error);
                     deps.log.error('Agent HTTPS renewal failed', { tags, meta: { error: message } });
-                    throw new TRPCError({
+                    throw new server_1.TRPCError({
                         code: 'INTERNAL_SERVER_ERROR',
                         message: `HTTPS renewal on ${input.nodeId} failed: ${message}. The node keeps serving what it had.`,
                     });
@@ -377,17 +380,17 @@ export function createCertificatesRouter(deps) {
             });
         }),
         /** The mesh CA, the revocation list, and every node's recorded leaves. */
-        getMeshCertificates: adminProcedure
-            .input(z.void())
+        getMeshCertificates: trpc_middleware_js_1.adminProcedure
+            .input(zod_1.z.void())
             .output(MeshInventorySchema)
             .query(async () => {
-            const state = getProcessMeshCaState();
+            const state = (0, system_1.getProcessMeshCaState)();
             const ca = state.state === 'ready'
                 ? {
                     state: 'ready',
-                    subject: new X509Certificate(state.ca.certPem).subject,
-                    fingerprintSha256: caFingerprint(state.ca.certPem),
-                    validTo: new X509Certificate(state.ca.certPem).validTo,
+                    subject: new node_crypto_1.X509Certificate(state.ca.certPem).subject,
+                    fingerprintSha256: (0, system_1.caFingerprint)(state.ca.certPem),
+                    validTo: new node_crypto_1.X509Certificate(state.ca.certPem).validTo,
                 }
                 : { state: 'unavailable', reason: state.reason };
             const registry = meshRegistry();
@@ -437,20 +440,20 @@ export function createCertificatesRouter(deps) {
          * after the hub SEES it connected with the new leaf is the old serial revoked. A failed
          * swap keeps the old leaf valid and says why.
          */
-        renewMeshOnNode: adminProcedure
-            .input(z.object({ nodeId: z.string().min(1) }))
+        renewMeshOnNode: trpc_middleware_js_1.adminProcedure
+            .input(zod_1.z.object({ nodeId: zod_1.z.string().min(1) }))
             .output(MeshRenewResultSchema)
             .mutation(async ({ input }) => {
             const client = requireAgent(input.nodeId);
             const ca = meshCa();
             const registry = meshRegistry();
             if (ca === null || registry === null) {
-                throw new TRPCError({
+                throw new server_1.TRPCError({
                     code: 'PRECONDITION_FAILED',
                     message: 'The mesh CA or the certificate registry is not available yet.',
                 });
             }
-            const result = await exclusive(input.nodeId, 'mesh', () => renewMeshCertificate({
+            const result = await exclusive(input.nodeId, 'mesh', () => (0, system_1.renewMeshCertificate)({
                 nodeId: input.nodeId,
                 client,
                 ca,
@@ -473,24 +476,24 @@ export function createCertificatesRouter(deps) {
          * connect: it must be paired again. It is NOT forgotten - that stays
          * `clusterNodes.forgetNode`.
          */
-        revokeMeshOnNode: adminProcedure
-            .input(z.object({ nodeId: z.string().min(1) }))
+        revokeMeshOnNode: trpc_middleware_js_1.adminProcedure
+            .input(zod_1.z.object({ nodeId: zod_1.z.string().min(1) }))
             .output(MeshRevokeResultSchema)
             .mutation(async ({ input }) => {
             if (input.nodeId === HUB_NODE_ID) {
-                throw new TRPCError({
+                throw new server_1.TRPCError({
                     code: 'PRECONDITION_FAILED',
                     message: "The hub's own mesh leaf is re-issued at every boot; there is nothing to revoke.",
                 });
             }
             const registry = meshRegistry();
             if (registry === null) {
-                throw new TRPCError({
+                throw new server_1.TRPCError({
                     code: 'PRECONDITION_FAILED',
                     message: 'The certificate registry is not available yet.',
                 });
             }
-            const result = await revokeMeshCertificate({
+            const result = await (0, system_1.revokeMeshCertificate)({
                 nodeId: input.nodeId,
                 registry,
                 crl: crl(),

package/dist/api/core/cluster-nodes.router.js

@@ -1,3 +1,6 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createClusterNodesRouter = createClusterNodesRouter;
 /**
  * Cluster-nodes router — fixed core API (not a capability).
  *
@@ -10,9 +13,9 @@
  * `computeTopology` and is intentionally NOT exposed here — the admin UI reads
  * offline rows off the pushed `cluster.topology-snapshot`, never by polling.
  */
-import { z } from 'zod';
-import { trpcRouter, adminProcedure } from '../trpc/trpc.middleware.js';
-const ForgetNodeInputSchema = z.object({ nodeId: z.string().min(1) });
+const zod_1 = require("zod");
+const trpc_middleware_js_1 = require("../trpc/trpc.middleware.js");
+const ForgetNodeInputSchema = zod_1.z.object({ nodeId: zod_1.z.string().min(1) });
 /**
  * What forgetting a node ACTUALLY removed.
  *
@@ -23,21 +26,21 @@ const ForgetNodeInputSchema = z.object({ nodeId: z.string().min(1) });
  * sources of its topology row was being purged. An action that changed nothing
  * must not answer `success`.
  */
-const ForgetNodeResultSchema = z.object({
+const ForgetNodeResultSchema = zod_1.z.object({
     /** At least one source of the node's topology row was purged. */
-    forgotten: z.boolean(),
+    forgotten: zod_1.z.boolean(),
     /** The durable history row existed and is gone. */
-    historyRemoved: z.boolean(),
+    historyRemoved: zod_1.z.boolean(),
     /** The Moleculer node-catalog entry existed and is gone. */
-    registryRemoved: z.boolean(),
+    registryRemoved: zod_1.z.boolean(),
     /** Read back AFTER the attempt: the node is still in the cluster registry. */
-    stillListed: z.boolean(),
+    stillListed: zod_1.z.boolean(),
     /** One operator-grade sentence naming what happened. */
-    message: z.string(),
+    message: zod_1.z.string(),
 });
-const RepairNodeAddonsInputSchema = z.object({ nodeId: z.string().min(1) });
-export function createClusterNodesRouter(agentRegistry) {
-    return trpcRouter({
+const RepairNodeAddonsInputSchema = zod_1.z.object({ nodeId: zod_1.z.string().min(1) });
+function createClusterNodesRouter(agentRegistry) {
+    return (0, trpc_middleware_js_1.trpcRouter)({
         /**
          * The explicit half of the addon back-fill's trigger set.
          *
@@ -52,9 +55,9 @@ export function createClusterNodesRouter(agentRegistry) {
          * roster the node itself declared, with the same circuit breaker. Nothing
          * can be repaired by hand that the node could not have converged to.
          */
-        repairNodeAddons: adminProcedure
+        repairNodeAddons: trpc_middleware_js_1.adminProcedure
             .input(RepairNodeAddonsInputSchema)
-            .output(z.object({ success: z.boolean() }))
+            .output(zod_1.z.object({ success: zod_1.z.boolean() }))
             .mutation(async ({ input }) => {
             await agentRegistry.repairNodeAddons(input.nodeId);
             return { success: true };
@@ -62,7 +65,7 @@ export function createClusterNodesRouter(agentRegistry) {
         // Purge one node's persisted offline history. Pairs with
         // `pipelineOrchestrator.removeAgentSettings` on the frontend to fully
         // forget an offline node (history row + per-node pipeline assignments).
-        forgetNode: adminProcedure
+        forgetNode: trpc_middleware_js_1.adminProcedure
             .input(ForgetNodeInputSchema)
             .output(ForgetNodeResultSchema)
             // The service's own result IS the answer — this procedure adds nothing

package/dist/api/core/collection-preference.js

@@ -1,11 +1,15 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.collectionPreferenceKey = collectionPreferenceKey;
+exports.persistCollectionDisabled = persistCollectionDisabled;
 /** ConfigService key holding the persisted disabled-set for a collection cap. */
-export function collectionPreferenceKey(capability) {
+function collectionPreferenceKey(capability) {
     return `capabilities.collection.${capability}`;
 }
 /**
  * Persist the disabled-addonId set for a collection capability: the set the
  * registry WILL hold once the write has landed and is applied.
  */
-export async function persistCollectionDisabled(configService, capability, disabled) {
+async function persistCollectionDisabled(configService, capability, disabled) {
     await configService.set(collectionPreferenceKey(capability), JSON.stringify({ disabled: [...disabled] }));
 }