@camstack/server 1.2.594 → 1.2.596

package/dist/agent/agent-http-auth.js

@@ -1,3 +1,4 @@
+"use strict";
 /**
  * Agent HTTP auth — pure request-authorization helpers for the agent's
  * port-4444 API (mirrors the hub's /health hardening).
@@ -14,9 +15,20 @@
  *     agent made up, a proof the mesh CA signed), never by who calls. An
  *     unpaired agent offers nothing else remotely.
  */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isLocalHostHeader = isLocalHostHeader;
+exports.authInputOf = authInputOf;
+exports.hasForwardingHeader = hasForwardingHeader;
+exports.isGenuineLoopback = isGenuineLoopback;
+exports.isLoopbackAddress = isLoopbackAddress;
+exports.readBearerToken = readBearerToken;
+exports.isAuthorizedAgentRequest = isAuthorizedAgentRequest;
+exports.isPairingProtocolRequest = isPairingProtocolRequest;
+exports.isUnlockSessionRequest = isUnlockSessionRequest;
+exports.isUnlockInfoRequest = isUnlockInfoRequest;
 const LOCAL_HOSTNAMES = new Set(['localhost', '127.0.0.1', '[::1]']);
 /** `host[:port]` of the agent's own machine: localhost, 127.0.0.1 or [::1]. */
-export function isLocalHostHeader(host) {
+function isLocalHostHeader(host) {
     const lower = host.trim().toLowerCase();
     const name = lower.startsWith('[') ? lower.slice(0, lower.indexOf(']') + 1) : lower.split(':')[0];
     return name !== undefined && LOCAL_HOSTNAMES.has(name);
@@ -53,7 +65,7 @@ function isBrowserSafeLocal(input) {
     return true;
 }
 /** Build the auth input of a Node/Fastify request. */
-export function authInputOf(req) {
+function authInputOf(req) {
     const one = (name) => {
         const v = req.headers[name];
         return typeof v === 'string' ? v : undefined;
@@ -79,18 +91,18 @@ const FORWARDING_HEADERS = [
     'cf-connecting-ip',
 ];
 /** True when any header says the request was relayed (D857): then loopback proves nothing. */
-export function hasForwardingHeader(headers) {
+function hasForwardingHeader(headers) {
     return FORWARDING_HEADERS.some((name) => headers[name] !== undefined);
 }
 /**
  * A request from this machine itself: a loopback peer AND no forwarding header. A reverse proxy on
  * the same host makes every caller look like 127.0.0.1; the header it adds is what gives it away.
  */
-export function isGenuineLoopback(input) {
+function isGenuineLoopback(input) {
     return (input.forwarded !== true && isLoopbackAddress(input.remoteAddress) && isBrowserSafeLocal(input));
 }
 /** IPv4/IPv6 loopback (incl. the IPv4-mapped IPv6 form Node reports). */
-export function isLoopbackAddress(addr) {
+function isLoopbackAddress(addr) {
     if (!addr)
         return false;
     if (addr === '::1')
@@ -103,7 +115,7 @@ export function isLoopbackAddress(addr) {
     return parts.every((p) => /^\d{1,3}$/.test(p));
 }
 /** Extract the bearer token value, or `null`. */
-export function readBearerToken(authorization) {
+function readBearerToken(authorization) {
     if (!authorization?.startsWith('Bearer '))
         return null;
     const token = authorization.slice('Bearer '.length);
@@ -113,7 +125,7 @@ export function readBearerToken(authorization) {
  * True when the request may access the protected agent API: it comes from this
  * machine, or it carries a session token minted from a hub unlock ticket.
  */
-export function isAuthorizedAgentRequest(input, sessionTokenOk = () => false) {
+function isAuthorizedAgentRequest(input, sessionTokenOk = () => false) {
     if (isGenuineLoopback(input))
         return true;
     const token = readBearerToken(input.authorization);
@@ -138,7 +150,7 @@ const PAIRING_POST = new Set([
  * the network without a session. `forget` is NOT among them — leaving a hub is an
  * authenticated action (this machine, or a hub-unlocked session).
  */
-export function isPairingProtocolRequest(method, urlPath) {
+function isPairingProtocolRequest(method, urlPath) {
     const pathOnly = urlPath.split('?')[0] ?? urlPath;
     if (method === 'GET')
         return PAIRING_GET.has(pathOnly);
@@ -150,7 +162,7 @@ export function isPairingProtocolRequest(method, urlPath) {
  * Redeem a hub unlock ticket for a session token — reachable remotely without
  * a prior session (the ticket IS the proof). Paired agents only.
  */
-export function isUnlockSessionRequest(method, urlPath) {
+function isUnlockSessionRequest(method, urlPath) {
     const pathOnly = urlPath.split('?')[0] ?? urlPath;
     return method === 'POST' && pathOnly === '/api/agent/session';
 }
@@ -158,7 +170,7 @@ export function isUnlockSessionRequest(method, urlPath) {
  * Public unlock probe: `nodeId` + hub HTTPS origin for Continue-with-hub (D821).
  * No secrets, no metrics — only what the locked unlock screen needs.
  */
-export function isUnlockInfoRequest(method, urlPath) {
+function isUnlockInfoRequest(method, urlPath) {
     const pathOnly = urlPath.split('?')[0] ?? urlPath;
     return method === 'GET' && pathOnly === '/api/agent/unlock-info';
 }

package/dist/agent/agent-http.js

@@ -1,30 +1,82 @@
+"use strict";
 /**
  * Agent HTTP server -- lightweight Fastify instance for agent status,
  * process management, config editing, and static UI serving.
  */
-import { randomBytes } from 'node:crypto';
-import * as fs from 'node:fs';
-import * as path from 'node:path';
-import Fastify from 'fastify';
-import { z } from 'zod';
-import { caFingerprintCompact, loadAgentHttps, UnlockTicketJtiStore, verifyAgentUiUnlockTicket, } from '@camstack/system';
-import { startSniffingListener } from './agent-sniffing-listener.js';
-import { isAuthorizedAgentRequest, authInputOf, isPairingProtocolRequest, isUnlockInfoRequest, isUnlockSessionRequest, } from './agent-http-auth.js';
-import { registerAgentPairingRoutes } from './agent-pairing-routes.js';
-import { isAgentPaired, pinnedMeshCaCert } from './agent-pairing-store.js';
-import { writeOwnerOnlyFileSync } from '@camstack/types/node';
-import { registerAgentUpdateRoutes } from './agent-update-routes.js';
-import { deriveHubUrlFromHubAddress, pickIpv4 } from './derive-hub-url.js';
-import { addonsFromStatus, joinAddonRuntime, processesFromList } from './agent-addon-runtime.js';
-import { createHubsFinder } from './hubs-found.js';
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.pickIpv4 = void 0;
+exports.describePairedHub = describePairedHub;
+exports.compareVersions = compareVersions;
+exports.readUiDistCandidate = readUiDistCandidate;
+exports.pickUiDist = pickUiDist;
+exports.resolveUiDistDir = resolveUiDistDir;
+exports.getRegistryNodes = getRegistryNodes;
+exports.resolveHubEndpoint = resolveHubEndpoint;
+exports.isOpaqueHostname = isOpaqueHostname;
+exports.nodeDisplayName = nodeDisplayName;
+exports.mapDiscoveredNodes = mapDiscoveredNodes;
+exports.createAgentHttpServer = createAgentHttpServer;
+exports.startAgentHttpServer = startAgentHttpServer;
+const node_crypto_1 = require("node:crypto");
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const fastify_1 = __importDefault(require("fastify"));
+const zod_1 = require("zod");
+const system_1 = require("@camstack/system");
+const agent_sniffing_listener_js_1 = require("./agent-sniffing-listener.js");
+const agent_http_auth_js_1 = require("./agent-http-auth.js");
+const agent_pairing_routes_js_1 = require("./agent-pairing-routes.js");
+const agent_pairing_store_js_1 = require("./agent-pairing-store.js");
+const node_1 = require("@camstack/types/node");
+const agent_update_routes_js_1 = require("./agent-update-routes.js");
+const derive_hub_url_js_1 = require("./derive-hub-url.js");
+Object.defineProperty(exports, "pickIpv4", { enumerable: true, get: function () { return derive_hub_url_js_1.pickIpv4; } });
+const agent_addon_runtime_js_1 = require("./agent-addon-runtime.js");
+const hubs_found_js_1 = require("./hubs-found.js");
 /** The pinned CA's fingerprint, or `null` when none is pinned or the PEM cannot be read. */
-export function describePairedHub(pinnedCa, hubHttpsOrigin) {
+function describePairedHub(pinnedCa, hubHttpsOrigin) {
     if (pinnedCa === null)
         return null;
     try {
         return {
             url: hubHttpsOrigin,
-            caFingerprint: caFingerprintCompact(pinnedCa),
+            caFingerprint: (0, system_1.caFingerprintCompact)(pinnedCa),
         };
     }
     catch {
@@ -32,7 +84,7 @@ export function describePairedHub(pinnedCa, hubHttpsOrigin) {
     }
 }
 /** Dotted-numeric version compare; `null` sorts lowest. */
-export function compareVersions(a, b) {
+function compareVersions(a, b) {
     if (a === null && b === null)
         return 0;
     if (a === null)
@@ -53,7 +105,7 @@ export function compareVersions(a, b) {
  * Read an agent-ui package dir (`<base>/package.json` + `<base>/dist/index.html`)
  * into a candidate. Returns `null` when the dist is absent/unusable.
  */
-export function readUiDistCandidate(baseDir) {
+function readUiDistCandidate(baseDir) {
     const dir = path.join(baseDir, 'dist');
     if (!fs.existsSync(path.join(dir, 'index.html')))
         return null;
@@ -83,13 +135,13 @@ export function readUiDistCandidate(baseDir) {
  * over `@fastify/static` — so which dir that variable names is load-bearing
  * here, not just at first boot.
  */
-export function pickUiDist(installed, bundled) {
+function pickUiDist(installed, bundled) {
     if (installed && bundled) {
         return compareVersions(bundled.version, installed.version) > 0 ? bundled.dir : installed.dir;
     }
     return installed?.dir ?? bundled?.dir ?? null;
 }
-export function resolveUiDistDir(dataDir, 
+function resolveUiDistDir(dataDir, 
 // `CAMSTACK_BUNDLED_ADDONS_DIR` — a dir of package dirs keyed by SHORT name
 // (`<dir>/addon-agent-ui`), the same shape `AddonInstaller.findLocalPackage`
 // joins onto. On a packaged desktop that is the closure's own scope dir,
@@ -127,10 +179,10 @@ function readConfigFile(configPath) {
 }
 /** agent.json holds the agent's private mesh key (D857): owner-only on every OS. */
 function writeConfigFile(configPath, data) {
-    writeOwnerOnlyFileSync(configPath, JSON.stringify(data, null, 2));
+    (0, node_1.writeOwnerOnlyFileSync)(configPath, JSON.stringify(data, null, 2));
 }
 /** Live Moleculer registry snapshot — reused by agent-bootstrap's Option A. */
-export function getRegistryNodes(broker) {
+function getRegistryNodes(broker) {
     try {
         return broker.registry.getNodeList({ onlyAvailable: true }).map((node) => ({
             id: node.id,
@@ -142,33 +194,30 @@ export function getRegistryNodes(broker) {
         return [];
     }
 }
-// `pickIpv4` moved to derive-hub-url.ts (single home shared with
-// `deriveHubUrlFromRegistry`); re-exported here to preserve this module's API.
-export { pickIpv4 };
 /**
  * A human-readable, reachable address for the hub node as the agent actually
  * sees it in the Moleculer registry. Used to fill in the effective address
  * even in UDP-discovery mode where no address was manually configured.
  */
-export function resolveHubEndpoint(nodes) {
+function resolveHubEndpoint(nodes) {
     const hub = nodes.find((n) => n.id === 'hub');
     if (!hub)
         return null;
-    return pickIpv4(hub.ipList) ?? hub.hostname ?? null;
+    return (0, derive_hub_url_js_1.pickIpv4)(hub.ipList) ?? hub.hostname ?? null;
 }
 /** A container id (12 hex) or full id (64 hex): a name nobody chose. */
-export function isOpaqueHostname(hostname) {
+function isOpaqueHostname(hostname) {
     return /^[0-9a-f]{12}$|^[0-9a-f]{64}$/.test(hostname);
 }
 /**
  * Prefer a name an operator can recognise over the bare Moleculer node id —
  * and over a container's id, which is what the hostname of a hub in Docker is.
  */
-export function nodeDisplayName(node) {
+function nodeDisplayName(node) {
     const hostname = typeof node.hostname === 'string' ? node.hostname.trim() : '';
     if (hostname.length > 0 && hostname !== node.id && !isOpaqueHostname(hostname))
         return hostname;
-    const ip = pickIpv4(node.ipList);
+    const ip = (0, derive_hub_url_js_1.pickIpv4)(node.ipList);
     if (ip !== null)
         return ip;
     return hostname.length > 0 ? hostname : node.id;
@@ -177,7 +226,7 @@ export function nodeDisplayName(node) {
  * Map raw registry nodes (minus self) to the UI-facing shape: the hub carries
  * a human `displayName` (hostname or IPv4) so the UI never shows only `hub`.
  */
-export function mapDiscoveredNodes(nodes, selfId) {
+function mapDiscoveredNodes(nodes, selfId) {
     return nodes
         .filter((n) => n.id !== selfId)
         .map((n) => {
@@ -214,7 +263,7 @@ function getEffectiveConfig(configPath, nodeId) {
     return {
         name: typeof raw.name === 'string' ? raw.name : nodeId,
         hubAddress: typeof raw.hubAddress === 'string' ? raw.hubAddress : null,
-        paired: isAgentPaired(configPath),
+        paired: (0, agent_pairing_store_js_1.isAgentPaired)(configPath),
         hasMeshTls: raw.meshTls !== null && typeof raw.meshTls === 'object',
     };
 }
@@ -225,18 +274,18 @@ function getEffectiveConfig(configPath, nodeId) {
  */
 const EDITABLE_CONFIG_KEYS = ['name', 'hubAddress', 'logLevel'];
 /** Value types of the editable keys; unknown keys pass through to the allow-list refusal above. */
-const ConfigPatchSchema = z.looseObject({
-    name: z.string().max(100).nullable().optional(),
-    hubAddress: z.string().max(300).nullable().optional(),
-    logLevel: z.enum(['debug', 'info', 'warn', 'error']).optional(),
+const ConfigPatchSchema = zod_1.z.looseObject({
+    name: zod_1.z.string().max(100).nullable().optional(),
+    hubAddress: zod_1.z.string().max(300).nullable().optional(),
+    logLevel: zod_1.z.enum(['debug', 'info', 'warn', 'error']).optional(),
 });
 /** Clock skew allowed between the hub that issued a ticket and this agent's boot instant. */
 const TICKET_BOOT_SKEW_MS = 2 * 60_000;
 // ---------------------------------------------------------------------------
 // Factory
 // ---------------------------------------------------------------------------
-export async function createAgentHttpServer(getBroker, config) {
-    const app = Fastify({ logger: false });
+async function createAgentHttpServer(getBroker, config) {
+    const app = (0, fastify_1.default)({ logger: false });
     // No CORS: the agent's page is served by the agent itself, so every legitimate caller is
     // same-origin. `Access-Control-Allow-Origin: *` would let any web page read this API (D857).
     // -- Auth gate (port-4444 hardening, mirrors the hub's /health work) --
@@ -251,13 +300,13 @@ export async function createAgentHttpServer(getBroker, config) {
      * ends every session (D857).
      */
     const unlockSessions = new Map();
-    let unlockJtis = new UnlockTicketJtiStore();
+    let unlockJtis = new system_1.UnlockTicketJtiStore();
     let jtiBinding = null;
     const bootMs = Date.now();
     /** What vouches for a session now: the pinned CA, else nothing. */
     const caBinding = () => {
-        const ca = pinnedMeshCaCert(config.configPath);
-        return ca === null ? null : `ca:${caFingerprintCompact(ca)}`;
+        const ca = (0, agent_pairing_store_js_1.pinnedMeshCaCert)(config.configPath);
+        return ca === null ? null : `ca:${(0, system_1.caFingerprintCompact)(ca)}`;
     };
     const sessionOk = (token) => {
         const entry = unlockSessions.get(token);
@@ -286,19 +335,19 @@ export async function createAgentHttpServer(getBroker, config) {
         const matched = req.routeOptions.url ?? '';
         if (method === 'GET' && matched === '/health')
             return;
-        if (isPairingProtocolRequest(method, matched))
+        if ((0, agent_http_auth_js_1.isPairingProtocolRequest)(method, matched))
             return;
-        if (isUnlockSessionRequest(method, matched))
+        if ((0, agent_http_auth_js_1.isUnlockSessionRequest)(method, matched))
             return;
-        if (isUnlockInfoRequest(method, matched))
+        if ((0, agent_http_auth_js_1.isUnlockInfoRequest)(method, matched))
             return;
-        const authInput = authInputOf(req);
-        if (isAuthorizedAgentRequest(authInput, sessionOk))
+        const authInput = (0, agent_http_auth_js_1.authInputOf)(req);
+        if ((0, agent_http_auth_js_1.isAuthorizedAgentRequest)(authInput, sessionOk))
             return;
         return reply.status(401).send({ ok: false, error: 'unauthorized' });
     });
     if (config.pairing !== undefined) {
-        registerAgentPairingRoutes(app, {
+        (0, agent_pairing_routes_js_1.registerAgentPairingRoutes)(app, {
             pairing: config.pairing,
             onForgetHub: config.onForgetHub ?? (async () => undefined),
             log: (message) => config.log?.info(message),
@@ -353,15 +402,15 @@ export async function createAgentHttpServer(getBroker, config) {
         // where `eff.hubAddress` is null.
         const resolvedHubAddress = resolveHubEndpoint(nodes);
         // HTTPS origin the agent UI uses for "Continue with hub" unlock (D821).
-        const hubHttpsOrigin = (eff.hubAddress !== null ? deriveHubUrlFromHubAddress(eff.hubAddress) : undefined) ??
-            (resolvedHubAddress !== null ? deriveHubUrlFromHubAddress(resolvedHubAddress) : undefined) ??
+        const hubHttpsOrigin = (eff.hubAddress !== null ? (0, derive_hub_url_js_1.deriveHubUrlFromHubAddress)(eff.hubAddress) : undefined) ??
+            (resolvedHubAddress !== null ? (0, derive_hub_url_js_1.deriveHubUrlFromHubAddress)(resolvedHubAddress) : undefined) ??
             null;
         // Version of the Electron wrapper (injected by the desktop app); absent
         // when the agent runs headless / in Docker.
         const appVersion = process.env['CAMSTACK_AGENT_APP_VERSION'] ?? null;
         const discoveredNodes = mapDiscoveredNodes(nodes, broker.nodeID);
         // The hub this agent is paired with, for the agent UI's "Paired with" card (D857).
-        const pairedHub = describePairedHub(pinnedMeshCaCert(config.configPath), hubHttpsOrigin);
+        const pairedHub = describePairedHub((0, agent_pairing_store_js_1.pinnedMeshCaCert)(config.configPath), hubHttpsOrigin);
         try {
             const status = (await broker.call('$agent.status'));
             return {
@@ -403,8 +452,8 @@ export async function createAgentHttpServer(getBroker, config) {
         const eff = getEffectiveConfig(config.configPath, config.nodeId);
         const nodes = getRegistryNodes(getBroker());
         const resolvedHubAddress = resolveHubEndpoint(nodes);
-        const hubHttpsOrigin = (eff.hubAddress !== null ? deriveHubUrlFromHubAddress(eff.hubAddress) : undefined) ??
-            (resolvedHubAddress !== null ? deriveHubUrlFromHubAddress(resolvedHubAddress) : undefined) ??
+        const hubHttpsOrigin = (eff.hubAddress !== null ? (0, derive_hub_url_js_1.deriveHubUrlFromHubAddress)(eff.hubAddress) : undefined) ??
+            (resolvedHubAddress !== null ? (0, derive_hub_url_js_1.deriveHubUrlFromHubAddress)(resolvedHubAddress) : undefined) ??
             null;
         return {
             paired: eff.paired,
@@ -415,7 +464,7 @@ export async function createAgentHttpServer(getBroker, config) {
     // -- Unlock session (hub admin ticket → tab Bearer; D821) -----------
     app.post('/api/agent/session', async (req, reply) => {
         // The ticket is signed by the mesh CA this agent pinned at pairing (D857).
-        const pinnedCa = pinnedMeshCaCert(config.configPath);
+        const pinnedCa = (0, agent_pairing_store_js_1.pinnedMeshCaCert)(config.configPath);
         if (pinnedCa === null) {
             return reply.status(400).send({ ok: false, error: 'agent is not paired' });
         }
@@ -424,7 +473,7 @@ export async function createAgentHttpServer(getBroker, config) {
             return reply.status(400).send({ ok: false, error: 'ticket required' });
         }
         // Nothing issued before this process started is accepted: the one-use ledger is in memory.
-        const payload = verifyAgentUiUnlockTicket(pinnedCa, ticket, {
+        const payload = (0, system_1.verifyAgentUiUnlockTicket)(pinnedCa, ticket, {
             expectedNodeId: config.nodeId,
             notBeforeMs: bootMs - TICKET_BOOT_SKEW_MS,
         });
@@ -434,13 +483,13 @@ export async function createAgentHttpServer(getBroker, config) {
         }
         // A new vouching CA or secret starts a new ledger.
         if (jtiBinding !== binding) {
-            unlockJtis = new UnlockTicketJtiStore();
+            unlockJtis = new system_1.UnlockTicketJtiStore();
             jtiBinding = binding;
         }
         if (!unlockJtis.consume(payload.jti, payload.exp)) {
             return reply.status(401).send({ ok: false, error: 'unlock ticket already used' });
         }
-        const token = randomBytes(32).toString('base64url');
+        const token = (0, node_crypto_1.randomBytes)(32).toString('base64url');
         // Session outlives the ticket so the tab keeps working after redeem.
         const sessionExp = Date.now() + 8 * 60 * 60_000;
         unlockSessions.set(token, { exp: sessionExp, binding });
@@ -462,7 +511,7 @@ export async function createAgentHttpServer(getBroker, config) {
             broker.call('$agent.status').catch(() => null),
             broker.call('$process.list').catch(() => []),
         ]);
-        return joinAddonRuntime(addonsFromStatus(status), processesFromList(list));
+        return (0, agent_addon_runtime_js_1.joinAddonRuntime)((0, agent_addon_runtime_js_1.addonsFromStatus)(status), (0, agent_addon_runtime_js_1.processesFromList)(list));
     });
     // -- Addon restart --------------------------------------------------
     app.post('/api/agent/addon/restart', async (req, reply) => {
@@ -543,13 +592,13 @@ export async function createAgentHttpServer(getBroker, config) {
     // -- Updates (framework local; addon roster read-only) --------------
     // Registered AFTER the onRequest hook above, so every path it mounts is
     // gated by the same loopback-or-bearer rule as the rest of `/api/`.
-    registerAgentUpdateRoutes(app, config.updateControls ?? {});
+    (0, agent_update_routes_js_1.registerAgentUpdateRoutes)(app, config.updateControls ?? {});
     // -- Hubs found on this network (D839) ------------------------------
     // The cached list is free; the refresh browses mDNS for a few seconds. The
     // UI asks on demand (opening the edit form, "Search again"), never on its
     // status poll.
     const hubsFinder = config.hubsFinder ??
-        createHubsFinder({
+        (0, hubs_found_js_1.createHubsFinder)({
             getConfiguredHubAddress: () => getEffectiveConfig(config.configPath, config.nodeId).hubAddress,
             log: (message) => console.warn(`[Agent] ${message}`),
         });
@@ -564,7 +613,7 @@ export async function createAgentHttpServer(getBroker, config) {
     // -- Static file serving (agent-ui) ---------------------------------
     const uiDir = resolveUiDistDir(config.dataDir, process.env['CAMSTACK_BUNDLED_ADDONS_DIR']);
     if (uiDir) {
-        const fastifyStatic = await import('@fastify/static');
+        const fastifyStatic = await Promise.resolve().then(() => __importStar(require('@fastify/static')));
         // Every route the static plugin mounts is the public UI bundle: tag them for the auth gate.
         let mountingAssets = true;
         app.addHook('onRoute', (route) => {
@@ -607,14 +656,14 @@ export async function createAgentHttpServer(getBroker, config) {
  * of a connection picks the protocol, so there is no second port. Resolves with
  * the listener (to hot-swap the certificate), or `null` when it failed to start.
  */
-export async function startAgentHttpServer(getBroker, config) {
+async function startAgentHttpServer(getBroker, config) {
     try {
         const app = await createAgentHttpServer(getBroker, config);
         await app.ready();
-        const material = loadAgentHttps(config.dataDir, (reason) => config.log?.error('The HTTPS bundle on disk is unusable - serving plain HTTP only', {
+        const material = (0, system_1.loadAgentHttps)(config.dataDir, (reason) => config.log?.error('The HTTPS bundle on disk is unusable - serving plain HTTP only', {
             meta: { reason },
         }));
-        const listener = await startSniffingListener({
+        const listener = await (0, agent_sniffing_listener_js_1.startSniffingListener)({
             httpServer: app.server,
             port: config.port,
             host: '0.0.0.0',

package/dist/agent/agent-hub-addon-update.js

@@ -1,3 +1,9 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HUB_UPDATE_TIMEOUT_MS = exports.HUB_ADDON_UPDATE_ACTION = exports.HUB_ADDON_LIST_ACTION = void 0;
+exports.hubVersionsFromList = hubVersionsFromList;
+exports.isBehindHub = isBehindHub;
+exports.createAgentHubAddonControls = createAgentHubAddonControls;
 /**
  * Updating an addon from the agent itself (D840) — by asking the HUB.
  *
@@ -22,18 +28,18 @@
  * (`remote-addon-update-grant.ts`): own node, the hub's recorded version, audited.
  * Any refusal reaches the UI verbatim as the update's failure, never as silence.
  */
-import { compareSemver } from '../server-root/index.js';
+const index_js_1 = require("../server-root/index.js");
 /** Hub procedures this module calls, as `$core-caps` actions. */
-export const HUB_ADDON_LIST_ACTION = '$core-caps.addons.list';
-export const HUB_ADDON_UPDATE_ACTION = '$core-caps.addons.updatePackage';
+exports.HUB_ADDON_LIST_ACTION = '$core-caps.addons.list';
+exports.HUB_ADDON_UPDATE_ACTION = '$core-caps.addons.updatePackage';
 /** An agent's deploy + reload of a large package can take minutes. */
-export const HUB_UPDATE_TIMEOUT_MS = 330_000;
+exports.HUB_UPDATE_TIMEOUT_MS = 330_000;
 const HUB_LIST_TIMEOUT_MS = 15_000;
 function errorMessage(err) {
     return err instanceof Error ? err.message : String(err);
 }
 /** `packageName → packageVersion` from an `addons.list` answer; unreadable rows are skipped. */
-export function hubVersionsFromList(list) {
+function hubVersionsFromList(list) {
     const out = new Map();
     if (!Array.isArray(list))
         return out;
@@ -52,8 +58,8 @@ export function hubVersionsFromList(list) {
     return out;
 }
 /** True when the hub's version is strictly newer than this node's. */
-export function isBehindHub(installed, hub) {
-    return installed !== null && hub !== null && compareSemver(hub, installed) > 0;
+function isBehindHub(installed, hub) {
+    return installed !== null && hub !== null && (0, index_js_1.compareSemver)(hub, installed) > 0;
 }
 /** The hub answered `{ success: false, error }`, or something unreadable. */
 function failureOf(result) {
@@ -64,11 +70,11 @@ function failureOf(result) {
     const error = Reflect.get(result, 'error');
     return typeof error === 'string' && error.length > 0 ? error : 'the hub reported a failure';
 }
-export function createAgentHubAddonControls(deps) {
+function createAgentHubAddonControls(deps) {
     const states = new Map();
     const getHubVersions = async () => {
         try {
-            const list = await deps.callHub(HUB_ADDON_LIST_ACTION, undefined, HUB_LIST_TIMEOUT_MS);
+            const list = await deps.callHub(exports.HUB_ADDON_LIST_ACTION, undefined, HUB_LIST_TIMEOUT_MS);
             return { ok: true, versions: hubVersionsFromList(list) };
         }
         catch (err) {
@@ -77,7 +83,7 @@ export function createAgentHubAddonControls(deps) {
     };
     const run = async (packageName, version) => {
         try {
-            const result = await deps.callHub(HUB_ADDON_UPDATE_ACTION, { name: packageName, version, nodeId: deps.nodeId }, HUB_UPDATE_TIMEOUT_MS);
+            const result = await deps.callHub(exports.HUB_ADDON_UPDATE_ACTION, { name: packageName, version, nodeId: deps.nodeId }, exports.HUB_UPDATE_TIMEOUT_MS);
             const failure = failureOf(result);
             states.set(packageName, failure === null
                 ? { status: 'done', targetVersion: version, message: null }

package/dist/agent/agent-hub-registration.js

@@ -1,3 +1,6 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createAgentHubRegistration = createAgentHubRegistration;
 /**
  * The agent's upward capability registration (D3).
  *
@@ -25,8 +28,8 @@
  * coalesced (one in flight, at most one queued, the manifest built when it
  * goes). Nothing waits on a timer: the triggers are events, the retry is the ack.
  */
-import { callRegisterNodeWithRetry, meshErrorType, MESH_NODE_UNAUTHENTICATED_TYPE, } from '@camstack/system';
-export function createAgentHubRegistration(opts) {
+const system_1 = require("@camstack/system");
+function createAgentHubRegistration(opts) {
     let sending = false;
     let queuedReason = null;
     const send = (reason) => {
@@ -38,12 +41,12 @@ export function createAgentHubRegistration(opts) {
         const broker = {
             call: (action, params, callOpts) => opts.broker().call(action, params, callOpts),
         };
-        callRegisterNodeWithRetry(broker, manifest, {
+        (0, system_1.callRegisterNodeWithRetry)(broker, manifest, {
             target: 'hub',
             ...(opts.signal !== undefined ? { signal: opts.signal } : {}),
             log: opts.log,
             onAttemptFailed: (err) => {
-                if (meshErrorType(err) === MESH_NODE_UNAUTHENTICATED_TYPE)
+                if ((0, system_1.meshErrorType)(err) === system_1.MESH_NODE_UNAUTHENTICATED_TYPE)
                     opts.onCertificateRefused?.(err);
             },
         })

package/dist/agent/agent-infra-capabilities.js

@@ -1,3 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AGENT_LOCAL_DATA_STORE_ENV = void 0;
+exports.resolveAgentInfraCapabilities = resolveAgentInfraCapabilities;
 /**
  * Which infra capabilities an AGENT boots — and the one it no longer does.
  *
@@ -43,13 +47,13 @@
  * in this series stay in place: commit 1 is inert whenever a local engine
  * exists, and commit 3 is documentation.
  */
-import { INFRA_CAPABILITIES } from '@camstack/system';
+const system_1 = require("@camstack/system");
 /**
  * The env var that puts the local engine back. Named for what it restores, not
  * for what it disables, so an operator reading a container's environment can
  * tell what it does without this file.
  */
-export const AGENT_LOCAL_DATA_STORE_ENV = 'CAMSTACK_AGENT_LOCAL_DATA_STORE';
+exports.AGENT_LOCAL_DATA_STORE_ENV = 'CAMSTACK_AGENT_LOCAL_DATA_STORE';
 /** The capability an agent no longer boots. */
 const DATA_STORE_PROVIDER = 'data-store-provider';
 /**
@@ -87,7 +91,7 @@ function isEnabled(raw) {
  *
  * `INFRA_CAPABILITIES` itself is never touched: the hub reads the same array.
  */
-export function resolveAgentInfraCapabilities(env) {
-    const keepLocalStore = isEnabled(env[AGENT_LOCAL_DATA_STORE_ENV]);
-    return INFRA_CAPABILITIES.filter((cap) => !HUB_ONLY_INFRA.has(cap.name) && (keepLocalStore || cap.name !== DATA_STORE_PROVIDER));
+function resolveAgentInfraCapabilities(env) {
+    const keepLocalStore = isEnabled(env[exports.AGENT_LOCAL_DATA_STORE_ENV]);
+    return system_1.INFRA_CAPABILITIES.filter((cap) => !HUB_ONLY_INFRA.has(cap.name) && (keepLocalStore || cap.name !== DATA_STORE_PROVIDER));
 }