@camstack/server 1.2.594 → 1.2.596

package/dist/api/dev-uploads-bundle.js

@@ -1,3 +1,41 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isSafeDevUploadVersion = isSafeDevUploadVersion;
+exports.packDevUploadVersionDir = packDevUploadVersionDir;
+exports.unpackDevUploadVersionBundle = unpackDevUploadVersionBundle;
 /**
  * Pack / unpack a hub `server-root/dev-uploads/<version>/` directory for
  * agent fan-out (`POST /api/server-upload/propagate` → `$agent.stageDevUploads`).
@@ -5,15 +43,15 @@
  * One gzipped tar carries every tarball + `manifest.json`. Fail-closed on
  * path traversal and on a layout that would not satisfy RootUpdateService.
  */
-import * as fs from 'node:fs';
-import * as os from 'node:os';
-import * as path from 'node:path';
-import * as tar from 'tar';
-import { DEV_UPLOAD_MANIFEST_FILE, isDevChannelVersion, readDevUploadManifest, } from '../server-root/index.js';
+const fs = __importStar(require("node:fs"));
+const os = __importStar(require("node:os"));
+const path = __importStar(require("node:path"));
+const tar = __importStar(require("tar"));
+const index_js_1 = require("../server-root/index.js");
 /** Version chars safe as a single path segment (matches server-upload). */
 const SAFE_VERSION_RE = /^[0-9A-Za-z][0-9A-Za-z.-]*$/;
-export function isSafeDevUploadVersion(version) {
-    return SAFE_VERSION_RE.test(version) && isDevChannelVersion(version);
+function isSafeDevUploadVersion(version) {
+    return SAFE_VERSION_RE.test(version) && (0, index_js_1.isDevChannelVersion)(version);
 }
 function hasPathTraversal(name) {
     return name.includes('/') || name.includes('\\') || name.includes('..');
@@ -22,8 +60,8 @@ function hasPathTraversal(name) {
  * Pack every file in `versionDir` (basename entries only) into a gzipped tar.
  * Refuses if the manifest is missing/invalid or lists a missing tarball.
  */
-export async function packDevUploadVersionDir(versionDir) {
-    const manifest = readDevUploadManifest(versionDir);
+async function packDevUploadVersionDir(versionDir) {
+    const manifest = (0, index_js_1.readDevUploadManifest)(versionDir);
     if (manifest === null) {
         throw new Error(`dev-uploads manifest missing or invalid in ${versionDir}`);
     }
@@ -36,7 +74,7 @@ export async function packDevUploadVersionDir(versionDir) {
             throw new Error(`dev-uploads tarball listed in manifest is missing: ${filename}`);
         }
     }
-    if (!fs.existsSync(path.join(versionDir, DEV_UPLOAD_MANIFEST_FILE))) {
+    if (!fs.existsSync(path.join(versionDir, index_js_1.DEV_UPLOAD_MANIFEST_FILE))) {
         throw new Error(`dev-uploads manifest file missing in ${versionDir}`);
     }
     const entries = fs.readdirSync(versionDir).filter((name) => {
@@ -62,7 +100,7 @@ export async function packDevUploadVersionDir(versionDir) {
  * atomically (stage sibling + rename). Validates version shape, entry names,
  * and that the extracted layout matches the manifest.
  */
-export async function unpackDevUploadVersionBundle(args) {
+async function unpackDevUploadVersionBundle(args) {
     const { serverRoot, version, bundle } = args;
     if (!isSafeDevUploadVersion(version)) {
         throw new Error(`Refused: version "${version}" is not a safe dev-channel version for staging`);
@@ -94,7 +132,7 @@ export async function unpackDevUploadVersionBundle(args) {
         if (refusedEntry !== null) {
             throw new Error(`Refused: archive entry is not a basename: ${refusedEntry}`);
         }
-        const manifest = readDevUploadManifest(stagingDir);
+        const manifest = (0, index_js_1.readDevUploadManifest)(stagingDir);
         if (manifest === null) {
             throw new Error('extracted archive has no valid manifest.json');
         }

package/dist/api/health/adaptive-probe.routes.js

@@ -1,3 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ADAPTIVE_PROBE_PER_IP_PER_MINUTE = exports.ADAPTIVE_PROBE_BYTES = void 0;
+exports.registerAdaptiveProbeRoute = registerAdaptiveProbeRoute;
 /**
  * Burst blob for adaptive-tier downlink measurement (D635).
  *
@@ -20,16 +24,16 @@
  * check the stream data plane applies — and is rate-limited per client IP.
  * Everything a refusal returns is a few bytes.
  */
-import { randomBytes } from 'node:crypto';
-import { isAuthorizedHealthRequest } from './health.routes.js';
-import { clientKeyFromRequest } from '../../auth/auth-rate-limit.js';
-export const ADAPTIVE_PROBE_BYTES = 1024 * 1024;
+const node_crypto_1 = require("node:crypto");
+const health_routes_js_1 = require("./health.routes.js");
+const auth_rate_limit_js_1 = require("../../auth/auth-rate-limit.js");
+exports.ADAPTIVE_PROBE_BYTES = 1024 * 1024;
 /**
  * Probes a client IP may draw per minute: 12. The client probes at most once
  * per 30 s per app (single-flight + cache), so 12 leaves room for several
  * apps/devices behind one NAT and caps an abuser at 12 MiB/min.
  */
-export const ADAPTIVE_PROBE_PER_IP_PER_MINUTE = 12;
+exports.ADAPTIVE_PROBE_PER_IP_PER_MINUTE = 12;
 /**
  * Random, so it is INCOMPRESSIBLE. The previous body was one repeated byte and
  * `@fastify/compress` (global in `main.ts`; its default types include
@@ -37,11 +41,11 @@ export const ADAPTIVE_PROBE_PER_IP_PER_MINUTE = 12;
  * trip and called it bandwidth. `compress: false` below stops our own
  * compressor; randomness also defeats one in a relay on the way.
  */
-const BODY = randomBytes(ADAPTIVE_PROBE_BYTES);
-export function registerAdaptiveProbeRoute(fastify, deps) {
+const BODY = (0, node_crypto_1.randomBytes)(exports.ADAPTIVE_PROBE_BYTES);
+function registerAdaptiveProbeRoute(fastify, deps) {
     fastify.get('/adaptive-probe', { compress: false }, async (req, reply) => {
         reply.header('cache-control', 'no-store');
-        const authorized = isAuthorizedHealthRequest({
+        const authorized = (0, health_routes_js_1.isAuthorizedHealthRequest)({
             ...(typeof req.headers.authorization === 'string'
                 ? { authorization: req.headers.authorization }
                 : {}),
@@ -49,7 +53,7 @@ export function registerAdaptiveProbeRoute(fastify, deps) {
         }, deps.verifyToken);
         if (!authorized)
             return reply.status(401).send({ ok: false, error: 'unauthorized' });
-        const key = clientKeyFromRequest(req, deps.network);
+        const key = (0, auth_rate_limit_js_1.clientKeyFromRequest)(req, deps.network);
         if (key !== null) {
             const verdict = deps.limiter.check(`adaptive-probe:${key}`);
             if (!verdict.allowed) {

package/dist/api/health/health.routes.js

@@ -1,3 +1,4 @@
+"use strict";
 /**
  * Health endpoints — fast probe surface for monitoring (k8s, uptime,
  * external watchdogs).
@@ -18,13 +19,17 @@
  * monitors talking to the hub and monitors talking directly to an agent
  * (`http://<agent>:4444/health`) see identical payloads.
  */
-import { isRunnerBootCheckDegraded } from '../../core/runner-health/runner-boot-check.js';
-import { isSessionGradeJwtPayload, readSessionCookieFromHeader } from '../../auth/session-cookie.js';
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildHubHealth = buildHubHealth;
+exports.isAuthorizedHealthRequest = isAuthorizedHealthRequest;
+exports.registerHealthRoutes = registerHealthRoutes;
+const runner_boot_check_js_1 = require("../../core/runner-health/runner-boot-check.js");
+const session_cookie_js_1 = require("../../auth/session-cookie.js");
 const AGENT_HEALTH_TIMEOUT_MS = 3_000;
 function nowIso() {
     return new Date().toISOString();
 }
-export async function buildHubHealth(deps, proc = process) {
+async function buildHubHealth(deps, proc = process) {
     // Fan-out-free: in-memory registry snapshot only, never a per-node RPC (#26).
     const nodes = deps.agentRegistry.listNodeLiveness();
     const remote = nodes.filter((n) => !n.isHub);
@@ -35,7 +40,7 @@ export async function buildHubHealth(deps, proc = process) {
     const runners = check === undefined
         ? undefined
         : {
-            degraded: isRunnerBootCheckDegraded(check),
+            degraded: (0, runner_boot_check_js_1.isRunnerBootCheckDegraded)(check),
             expected: check.expected,
             running: check.running,
             failed: check.failed.length,
@@ -85,16 +90,16 @@ async function fetchAgentHealth(deps, nodeId) {
  * (agent ids, versions, pids) — public probes get only `{ok}`.
  * Pure over (headers, verifier) so the spec exercises it directly.
  */
-export function isAuthorizedHealthRequest(headers, verifyToken) {
+function isAuthorizedHealthRequest(headers, verifyToken) {
     const bearer = headers.authorization?.startsWith('Bearer ')
         ? headers.authorization.slice('Bearer '.length)
         : null;
-    const cookieToken = readSessionCookieFromHeader(headers.cookie);
+    const cookieToken = (0, session_cookie_js_1.readSessionCookieFromHeader)(headers.cookie);
     for (const token of [bearer, cookieToken]) {
         if (!token)
             continue;
         try {
-            if (isSessionGradeJwtPayload(verifyToken(token)))
+            if ((0, session_cookie_js_1.isSessionGradeJwtPayload)(verifyToken(token)))
                 return true;
         }
         catch {
@@ -103,7 +108,7 @@ export function isAuthorizedHealthRequest(headers, verifyToken) {
     }
     return false;
 }
-export function registerHealthRoutes(fastify, deps) {
+function registerHealthRoutes(fastify, deps) {
     const authorized = (req) => isAuthorizedHealthRequest({
         ...(typeof req.headers.authorization === 'string'
             ? { authorization: req.headers.authorization }

package/dist/api/hub-cluster-url.js

@@ -1,5 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HubAddressUnavailableError = void 0;
+exports.resolveHubBaseUrl = resolveHubBaseUrl;
+exports.clusterBaseUrlResolver = clusterBaseUrlResolver;
 /** Thrown when the hub cannot name an address `audience` can reach. */
-export class HubAddressUnavailableError extends Error {
+class HubAddressUnavailableError extends Error {
     audience;
     reason;
     constructor(audience, reason) {
@@ -12,12 +17,13 @@ export class HubAddressUnavailableError extends Error {
         this.name = 'HubAddressUnavailableError';
     }
 }
+exports.HubAddressUnavailableError = HubAddressUnavailableError;
 /**
  * Resolve the hub's base URL for `audience` from the live provider. Called per
  * delivery — interfaces and the allowlist move, and a deploy is rare enough
  * that a cache would only add a way to be stale.
  */
-export async function resolveHubBaseUrl(getSource, audience) {
+async function resolveHubBaseUrl(getSource, audience) {
     const source = getSource();
     if (source === null)
         throw new HubAddressUnavailableError(audience, 'local-network-unavailable');
@@ -26,6 +32,6 @@ export async function resolveHubBaseUrl(getSource, audience) {
         throw new HubAddressUnavailableError(audience, 'no-reachable-endpoint');
     return baseUrl;
 }
-export function clusterBaseUrlResolver(getSource) {
+function clusterBaseUrlResolver(getSource) {
     return () => resolveHubBaseUrl(getSource, 'internal');
 }

package/dist/api/model-distributor.js

@@ -1,8 +1,46 @@
-import { spawn } from 'node:child_process';
-import * as fs from 'node:fs';
-import * as path from 'node:path';
-import { collectModelFiles, isModelDownloaded } from '@camstack/system';
-import { buildHubHttpSource } from './addon-upload.js';
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.tarModelFiles = tarModelFiles;
+exports.distributeModelWith = distributeModelWith;
+exports.buildModelDistributorProvider = buildModelDistributorProvider;
+const node_child_process_1 = require("node:child_process");
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const system_1 = require("@camstack/system");
+const addon_upload_js_1 = require("./addon-upload.js");
 const AGENT_DISTRIBUTE_TIMEOUT_MS = 60_000;
 function hubModelsDir() {
     return path.join(process.env['CAMSTACK_DATA'] ?? 'camstack-data', 'models');
@@ -12,9 +50,9 @@ function hubModelsDir() {
  * Async (spawn, not execFileSync) so a large model doesn't block the event
  * loop. The agent untars this exact buffer into its own modelsDir.
  */
-export function tarModelFiles(cwd, files) {
+function tarModelFiles(cwd, files) {
     return new Promise((resolve, reject) => {
-        const child = spawn('tar', ['-czf', '-', '-C', cwd, ...files]);
+        const child = (0, node_child_process_1.spawn)('tar', ['-czf', '-', '-C', cwd, ...files]);
         const chunks = [];
         const errChunks = [];
         child.stdout.on('data', (c) => chunks.push(c));
@@ -33,7 +71,7 @@ export function tarModelFiles(cwd, files) {
  * precondition-check → collect → tar → stage → trigger the agent pull.
  * `nodeId === 'hub'` is a no-op (the artifact is already resident).
  */
-export async function distributeModelWith(seam, input) {
+async function distributeModelWith(seam, input) {
     const { targetNodeId, modelId, format, entry } = input;
     if (targetNodeId === 'hub') {
         return { ok: true, sha256: '', bytes: 0, path: seam.modelsDir };
@@ -41,7 +79,7 @@ export async function distributeModelWith(seam, input) {
     if (!seam.isPresent(entry, format)) {
         throw new Error(`model ${modelId}/${format} not present on hub — download or convert it first`);
     }
-    const files = collectModelFiles(entry, format).filter((f) => seam.fileExists(f));
+    const files = (0, system_1.collectModelFiles)(entry, format).filter((f) => seam.fileExists(f));
     if (files.length === 0) {
         throw new Error(`model ${modelId}/${format} resolved no files to distribute`);
     }
@@ -56,17 +94,17 @@ export async function distributeModelWith(seam, input) {
  * Moleculer broker + the deploy-stage registry, which a forked addon can't
  * reach.
  */
-export function buildModelDistributorProvider(moleculer, loggingService, 
+function buildModelDistributorProvider(moleculer, loggingService, 
 /** The `local-network` cap's cluster address (`hub-cluster-url.ts`). */
 resolveClusterBaseUrl) {
     const logger = loggingService.createLogger('model-distributor');
     const modelsDir = hubModelsDir();
     const seam = {
         modelsDir,
-        isPresent: (entry, format) => isModelDownloaded(modelsDir, entry, format),
+        isPresent: (entry, format) => (0, system_1.isModelDownloaded)(modelsDir, entry, format),
         fileExists: (rel) => fs.existsSync(path.join(modelsDir, rel)),
         tar: (files) => tarModelFiles(modelsDir, files),
-        stage: async (buffer) => buildHubHttpSource(buffer, await resolveClusterBaseUrl()),
+        stage: async (buffer) => (0, addon_upload_js_1.buildHubHttpSource)(buffer, await resolveClusterBaseUrl()),
         callAgent: async (nodeId, payload) => {
             const broker = moleculer?.broker;
             if (!broker)

package/dist/api/oauth2/consent-page.js

@@ -1,25 +1,28 @@
-import { appHiddenField, appHint, appSubmitButton, escapeHtml, renderAppPage, } from '../../auth/app-page-shell.js';
-import { appStrings } from '../../auth/app-page-strings.js';
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.renderConsentPage = renderConsentPage;
+const app_page_shell_js_1 = require("../../auth/app-page-shell.js");
+const app_page_strings_js_1 = require("../../auth/app-page-strings.js");
 /** Allow/Deny consent screen on the hub's shared page shell (the look of the
  *  app sign-in pages). Submitting POSTs to the same path with the hidden query
  *  fields + `consent=allow|deny`. */
-export function renderConsentPage(input) {
+function renderConsentPage(input) {
     const hidden = Object.entries(input.hidden)
-        .map(([name, value]) => appHiddenField(name, value))
+        .map(([name, value]) => (0, app_page_shell_js_1.appHiddenField)(name, value))
         .join('');
-    const t = appStrings(input.lang).consent;
+    const t = (0, app_page_strings_js_1.appStrings)(input.lang).consent;
     const destination = input.redirectUri
-        ? `<p class="hint">${escapeHtml(t.sendingTo)}<code>${escapeHtml(input.redirectUri)}</code></p>`
+        ? `<p class="hint">${(0, app_page_shell_js_1.escapeHtml)(t.sendingTo)}<code>${(0, app_page_shell_js_1.escapeHtml)(input.redirectUri)}</code></p>`
         : '';
-    return renderAppPage({
+    return (0, app_page_shell_js_1.renderAppPage)({
         lang: input.lang,
         title: `${t.titlePrefix}${input.displayName}`,
         heading: `${t.headingPrefix}${input.displayName}`,
         body: [
-            `<p>${escapeHtml(t.signedInAs)}<strong>${escapeHtml(input.username)}</strong></p>`,
-            appHint(`${t.grantPrefix}${input.scopeSummary}`),
+            `<p>${(0, app_page_shell_js_1.escapeHtml)(t.signedInAs)}<strong>${(0, app_page_shell_js_1.escapeHtml)(input.username)}</strong></p>`,
+            (0, app_page_shell_js_1.appHint)(`${t.grantPrefix}${input.scopeSummary}`),
             destination,
-            `<form method="POST">${hidden}<div class="actions">${appSubmitButton(t.allow, 'consent', 'allow')}${appSubmitButton(t.deny, 'consent', 'deny', true)}</div></form>`,
+            `<form method="POST">${hidden}<div class="actions">${(0, app_page_shell_js_1.appSubmitButton)(t.allow, 'consent', 'allow')}${(0, app_page_shell_js_1.appSubmitButton)(t.deny, 'consent', 'deny', true)}</div></form>`,
         ].join(''),
     });
 }

package/dist/api/oauth2/oauth2-routes.js

@@ -1,7 +1,15 @@
-import { loginRedirectUrl, SESSION_COOKIE, shouldRedirectToLogin, } from '../../auth/session-cookie.js';
-import { resolveAppPageLang } from '../../auth/app-page-strings.js';
-import { renderConsentPage } from './consent-page.js';
-import { isPrivateHost } from './private-host.js';
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.redactAuthorizeQuery = redactAuthorizeQuery;
+exports.describeAuthorizeCall = describeAuthorizeCall;
+exports.validateAuthorizeQuery = validateAuthorizeQuery;
+exports.isRedirectUriAllowed = isRedirectUriAllowed;
+exports.summariseScopes = summariseScopes;
+exports.registerOauth2Routes = registerOauth2Routes;
+const session_cookie_js_1 = require("../../auth/session-cookie.js");
+const app_page_strings_js_1 = require("../../auth/app-page-strings.js");
+const consent_page_js_1 = require("./consent-page.js");
+const private_host_js_1 = require("./private-host.js");
 /**
  * Query keys whose VALUE may be logged.
  *
@@ -26,7 +34,7 @@ function truncate(value, max) {
     return value.length > max ? `${value.slice(0, max)}…` : value;
 }
 /** Rebuild a query string with every non-allow-listed value replaced. */
-export function redactAuthorizeQuery(rawQuery) {
+function redactAuthorizeQuery(rawQuery) {
     if (rawQuery === '')
         return '';
     const parts = [];
@@ -49,7 +57,7 @@ function describeReferer(raw) {
     }
 }
 /** Everything the log is allowed to know about an inbound authorize call. */
-export function describeAuthorizeCall(url, headers, hasSessionCookie) {
+function describeAuthorizeCall(url, headers, hasSessionCookie) {
     const q = url.indexOf('?');
     const ua = headers['user-agent'];
     return {
@@ -110,7 +118,7 @@ function resolveIntegrationParam(raw) {
  *  NOT checked — that pair is verified only at the Lambda boundary, and a
  *  PUBLIC client (`requiresPkce`) has no secret to check it against at all;
  *  the S256 challenge is what binds the code to its requester instead. */
-export function validateAuthorizeQuery(q, knownIntegrations, pendingAddons = []) {
+function validateAuthorizeQuery(q, knownIntegrations, pendingAddons = []) {
     if (q.response_type !== 'code')
         return { ok: false, status: 400, error: 'unsupported_response_type' };
     // Four distinct faults used to collapse into one opaque string.
@@ -190,7 +198,7 @@ export function validateAuthorizeQuery(q, knownIntegrations, pendingAddons = [])
  * `startsWith` on a string the browser will parse differently is exactly how an
  * allow-list gets walked around.
  */
-export function isRedirectUriAllowed(redirectUri, allowedPrefixes, allowedPrivateHostPaths = []) {
+function isRedirectUriAllowed(redirectUri, allowedPrefixes, allowedPrivateHostPaths = []) {
     if (allowedPrefixes.some((p) => redirectUri.startsWith(p)))
         return true;
     if (allowedPrivateHostPaths.length === 0)
@@ -204,12 +212,12 @@ export function isRedirectUriAllowed(redirectUri, allowedPrefixes, allowedPrivat
     }
     if (url.protocol !== 'http:' && url.protocol !== 'https:')
         return false;
-    if (!isPrivateHost(url.hostname))
+    if (!(0, private_host_js_1.isPrivateHost)(url.hostname))
         return false;
     return allowedPrivateHostPaths.includes(url.pathname);
 }
 /** One-line human summary of a scope list for the consent screen. */
-export function summariseScopes(scopes) {
+function summariseScopes(scopes) {
     if (scopes.some((s) => s.type === 'category' && s.target === 'device')) {
         return 'view and control all your cameras and devices';
     }
@@ -249,10 +257,10 @@ function refuseAuthorize(reply, logger, method, call, refusal) {
  * it" is invisible and every refusal reads as a first arrival.
  */
 function refuseUnauthenticated(request, reply, logger, call, reason) {
-    const redirected = shouldRedirectToLogin(request.method, request.headers.accept);
+    const redirected = (0, session_cookie_js_1.shouldRedirectToLogin)(request.method, request.headers.accept);
     logger.info(redirected ? 'oauth2 authorize bounced to login' : 'oauth2 authorize refused: unauthenticated', { meta: { method: request.method, reason, redirected, ...call } });
     if (redirected)
-        return reply.redirect(loginRedirectUrl(request.url));
+        return reply.redirect((0, session_cookie_js_1.loginRedirectUrl)(request.url));
     return reply.status(401).send({ error: 'unauthorized' });
 }
 /** Read integrationId → descriptor from every registered `oauth-integration`
@@ -278,7 +286,7 @@ function parseFormBody(raw) {
     }
     return result;
 }
-export function registerOauth2Routes(fastify, deps) {
+function registerOauth2Routes(fastify, deps) {
     // Register a content-type parser for application/x-www-form-urlencoded so that
     // consent POST and token POST can read form bodies. @fastify/formbody is not in
     // the project's dependencies; we use URLSearchParams (Node built-in) instead.
@@ -295,7 +303,7 @@ export function registerOauth2Routes(fastify, deps) {
     // the PWA service-worker navigate fallback, and the Vite dev proxy — no
     // per-path special-casing anywhere.
     fastify.get('/api/oauth2/authorize', async (request, reply) => {
-        const cookie = request.cookies[SESSION_COOKIE];
+        const cookie = request.cookies[session_cookie_js_1.SESSION_COOKIE];
         const call = describeAuthorizeCall(request.url, request.headers, Boolean(cookie));
         if (!cookie) {
             return refuseUnauthenticated(request, reply, deps.logger, call, 'no-session-cookie');
@@ -333,8 +341,8 @@ export function registerOauth2Routes(fastify, deps) {
                 .status(400)
                 .send({ error: 'invalid_request — redirect_uri not allowed for this integration' });
         }
-        const html = renderConsentPage({
-            lang: resolveAppPageLang({
+        const html = (0, consent_page_js_1.renderConsentPage)({
+            lang: (0, app_page_strings_js_1.resolveAppPageLang)({
                 lang: request.query['lang'],
                 acceptLanguage: request.headers['accept-language'],
             }),
@@ -393,7 +401,7 @@ export function registerOauth2Routes(fastify, deps) {
     });
     // ─── POST /api/oauth2/authorize ───────────────────────────────────────────
     fastify.post('/api/oauth2/authorize', async (request, reply) => {
-        const cookie = request.cookies[SESSION_COOKIE];
+        const cookie = request.cookies[session_cookie_js_1.SESSION_COOKIE];
         // `query` is empty here by nature, not by loss: the consent POST carries its
         // parameters as form fields. `method: POST` in the same line says so.
         const call = describeAuthorizeCall(request.url, request.headers, Boolean(cookie));

package/dist/api/oauth2/private-host.js

@@ -1,3 +1,4 @@
+"use strict";
 /**
  * Is this hostname unreachable from the public internet?
  *
@@ -14,6 +15,8 @@
  * not the one the browser will use). Names are admitted only by suffix, from a
  * closed list of suffixes that cannot be registered on the public internet.
  */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isPrivateHost = isPrivateHost;
 /** Suffixes that are, by definition, not publicly routable names. */
 const PRIVATE_NAME_SUFFIXES = ['.local', '.internal', '.home.arpa', '.ts.net'];
 /** Names that are exactly the loopback host. */
@@ -64,7 +67,7 @@ function isPrivateIpv6(host) {
  * True iff `host` (a `URL.hostname`, already lowercased by the URL parser) is
  * private by literal inspection. Never resolves.
  */
-export function isPrivateHost(host) {
+function isPrivateHost(host) {
     if (host === '')
         return false;
     if (LOOPBACK_NAMES.includes(host))