@camstack/server 1.2.594 → 1.2.596

package/dist/api/trpc/http-request-census-hook.js

@@ -1,3 +1,4 @@
+"use strict";
 /**
  * The seam that feeds {@link HttpRequestCensus} from a live tRPC request.
  *
@@ -25,9 +26,11 @@
  * ever moves below a field access, that test fails instead of the hub paying
  * for a diagnostic nobody switched on.
  */
-import { extractClientIp, extractUserAgent } from './client-ip.js';
-import { parseTrpcProcedures } from './http-request-census.js';
-import { describeTrpcPrincipal } from './trpc-error-principal.js';
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.recordTrpcHttpRequest = recordTrpcHttpRequest;
+const client_ip_js_1 = require("./client-ip.js");
+const http_request_census_js_1 = require("./http-request-census.js");
+const trpc_error_principal_js_1 = require("./trpc-error-principal.js");
 /**
  * Count one tRPC HTTP request against `census`.
  *
@@ -35,20 +38,20 @@ import { describeTrpcPrincipal } from './trpc-error-principal.js';
  * `describeTrpcPrincipal`, the same function the tRPC error log already uses -
  * a username and a credential KIND, never a token and never a header.
  */
-export function recordTrpcHttpRequest(census, req, user) {
+function recordTrpcHttpRequest(census, req, user) {
     if (!census.armed)
         return;
     if (req === undefined)
         return;
     const url = typeof req.url === 'string' ? req.url : '';
-    const procedures = parseTrpcProcedures(url, headerValue(req, 'content-type'));
+    const procedures = (0, http_request_census_js_1.parseTrpcProcedures)(url, headerValue(req, 'content-type'));
     if (procedures.length === 0)
         return;
     census.observeHttpRequest({
         procedures,
-        userAgent: extractUserAgent(req),
-        ip: extractClientIp(req),
-        principal: describeTrpcPrincipal(user),
+        userAgent: (0, client_ip_js_1.extractUserAgent)(req),
+        ip: (0, client_ip_js_1.extractClientIp)(req),
+        principal: (0, trpc_error_principal_js_1.describeTrpcPrincipal)(user),
     });
 }
 /** First value of a possibly-repeated header, or `null`. */

package/dist/api/trpc/http-request-census.js

@@ -1,3 +1,4 @@
+"use strict";
 /**
  * WHO is calling the hub, and OVER WHICH PLANE - measured at the transport,
  * never inferred.
@@ -104,8 +105,13 @@
  * request. Stale timers are neutralised by a generation counter instead of
  * being cleared, so no timer handle has to be stored or typed.
  */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HttpRequestCensus = exports.UNKNOWN = exports.PROCEDURE_OVERFLOW = exports.BATCH_OVERFLOW_PROCEDURE = exports.MAX_BATCH_PROCEDURES = exports.USER_AGENT_MAX_CHARS = exports.MAX_PROCEDURES = exports.MAX_GROUPS = exports.MIN_REPORT_EVERY_MS = exports.DEFAULT_REPORT_EVERY_MS = exports.MIN_WINDOW_MS = exports.MAX_WINDOW_MS = exports.TRPC_URL_PREFIX = void 0;
+exports.zeroPlaneCounts = zeroPlaneCounts;
+exports.shortenUserAgent = shortenUserAgent;
+exports.parseTrpcProcedures = parseTrpcProcedures;
 /** Route prefix the tRPC plugin is registered under (`main.ts`). */
-export const TRPC_URL_PREFIX = '/trpc/';
+exports.TRPC_URL_PREFIX = '/trpc/';
 /**
  * Longest window the census may be armed for.
  *
@@ -115,11 +121,11 @@ export const TRPC_URL_PREFIX = '/trpc/';
  * was already running. Ten minutes is not enough room for a container
  * recreation plus a cold boot.
  */
-export const MAX_WINDOW_MS = 30 * 60_000;
+exports.MAX_WINDOW_MS = 30 * 60_000;
 /** Shortest useful window. Anything below this cannot contain a boot. */
-export const MIN_WINDOW_MS = 1_000;
+exports.MIN_WINDOW_MS = 1_000;
 /** Default cadence of the aggregated report line. */
-export const DEFAULT_REPORT_EVERY_MS = 30_000;
+exports.DEFAULT_REPORT_EVERY_MS = 30_000;
 /**
  * Floor on the report cadence.
  *
@@ -127,7 +133,7 @@ export const DEFAULT_REPORT_EVERY_MS = 30_000;
  * would be 41 lines a second, which is itself an incident - and a cadence an
  * operator could set to 100 ms would reproduce that with an aggregate.
  */
-export const MIN_REPORT_EVERY_MS = 5_000;
+exports.MIN_REPORT_EVERY_MS = 5_000;
 /**
  * Bound on distinct `(procedure, ua, ip, principal)` groups held in memory.
  *
@@ -136,27 +142,27 @@ export const MIN_REPORT_EVERY_MS = 5_000;
  * COUNTED, never dropped silently - the totals stay exact, which is what the
  * negative proof rests on.
  */
-export const MAX_GROUPS = 500;
+exports.MAX_GROUPS = 500;
 /**
  * Bound on distinct procedure names. The router's procedure set is closed and
  * far below this; the bound exists so a garbage path cannot grow the map.
  * Names beyond it fold into {@link PROCEDURE_OVERFLOW} rather than vanishing.
  */
-export const MAX_PROCEDURES = 500;
+exports.MAX_PROCEDURES = 500;
 /** User-agent prefix kept in a group key. Full UA strings are long and their
  *  tail is build metadata that splits one client into many rows. */
-export const USER_AGENT_MAX_CHARS = 80;
+exports.USER_AGENT_MAX_CHARS = 80;
 /** Bound on procedures counted from one batched URL. tRPC's own `maxBatchSize`
  *  guards the router; this guards the census against a URL that never reaches
  *  a procedure at all. */
-export const MAX_BATCH_PROCEDURES = 200;
+exports.MAX_BATCH_PROCEDURES = 200;
 /** Synthetic name for batch entries beyond {@link MAX_BATCH_PROCEDURES}. */
-export const BATCH_OVERFLOW_PROCEDURE = '(batch-overflow)';
+exports.BATCH_OVERFLOW_PROCEDURE = '(batch-overflow)';
 /** Synthetic name for procedures beyond {@link MAX_PROCEDURES}. */
-export const PROCEDURE_OVERFLOW = '(procedure-overflow)';
+exports.PROCEDURE_OVERFLOW = '(procedure-overflow)';
 /** Placeholder used when a request carries no such signal. Never blank: an
  *  empty field reads as a logging defect rather than as an absent header. */
-export const UNKNOWN = 'unknown';
+exports.UNKNOWN = 'unknown';
 /** Group-key field separator. A character that cannot appear in a tRPC
  *  procedure path, so two different tuples can never collide into one row. */
 const KEY_SEPARATOR = ' | ';
@@ -167,7 +173,7 @@ const KEY_SEPARATOR = ' | ';
  * this literal fail to compile until it is given a counter. That is what keeps
  * "a plane is never silently absent" from being a comment nobody enforces.
  */
-export function zeroPlaneCounts() {
+function zeroPlaneCounts() {
     return { http: 0, ws: 0, mesh: 0, unknown: 0 };
 }
 /** Frozen view of a mutable plane counter, for the wire. */
@@ -187,15 +193,15 @@ function defaultSchedule(fn, ms) {
  * Exported because the truncation is part of the group KEY: a spec that builds
  * an expected key by hand must use the same rule, or it pins the wrong thing.
  */
-export function shortenUserAgent(ua) {
+function shortenUserAgent(ua) {
     if (ua === null)
-        return UNKNOWN;
+        return exports.UNKNOWN;
     const trimmed = ua.trim();
     if (trimmed.length === 0)
-        return UNKNOWN;
-    if (trimmed.length <= USER_AGENT_MAX_CHARS)
+        return exports.UNKNOWN;
+    if (trimmed.length <= exports.USER_AGENT_MAX_CHARS)
         return trimmed;
-    return `${trimmed.slice(0, USER_AGENT_MAX_CHARS)}~`;
+    return `${trimmed.slice(0, exports.USER_AGENT_MAX_CHARS)}~`;
 }
 /**
  * The procedures one tRPC HTTP request invokes.
@@ -214,15 +220,15 @@ export function shortenUserAgent(ua) {
  * Returns `[]` for a URL that is not under the tRPC prefix, and for the bare
  * prefix with no path.
  */
-export function parseTrpcProcedures(url, contentType) {
+function parseTrpcProcedures(url, contentType) {
     const queryAt = url.indexOf('?');
     const pathname = queryAt === -1 ? url : url.slice(0, queryAt);
     const query = queryAt === -1 ? '' : url.slice(queryAt + 1);
-    if (!pathname.startsWith(TRPC_URL_PREFIX))
+    if (!pathname.startsWith(exports.TRPC_URL_PREFIX))
         return [];
     // The plugin route is `/trpc/:path` - one segment. Anything after a further
     // `/` is not part of the procedure path.
-    const rest = pathname.slice(TRPC_URL_PREFIX.length);
+    const rest = pathname.slice(exports.TRPC_URL_PREFIX.length);
     const slashAt = rest.indexOf('/');
     const rawPath = slashAt === -1 ? rest : rest.slice(0, slashAt);
     if (rawPath.length === 0)
@@ -238,14 +244,14 @@ export function parseTrpcProcedures(url, contentType) {
         const name = part.trim();
         if (name.length === 0)
             continue;
-        if (out.length >= MAX_BATCH_PROCEDURES) {
+        if (out.length >= exports.MAX_BATCH_PROCEDURES) {
             overflowed = true;
             continue;
         }
         out.push(name);
     }
     if (overflowed)
-        out.push(BATCH_OVERFLOW_PROCEDURE);
+        out.push(exports.BATCH_OVERFLOW_PROCEDURE);
     return out;
 }
 /** `decodeURIComponent` throws on a malformed escape. A garbage path is still
@@ -292,7 +298,7 @@ function hasBatchFlag(query) {
  *
  * Disarmed it is one boolean read at every call site and nothing else.
  */
-export class HttpRequestCensus {
+class HttpRequestCensus {
     now;
     schedule;
     /** The ONLY thing a disarmed request path reads. */
@@ -303,7 +309,7 @@ export class HttpRequestCensus {
     armedAt = 0;
     closedAt = 0;
     currentWindowMs = 0;
-    currentReportEveryMs = DEFAULT_REPORT_EVERY_MS;
+    currentReportEveryMs = exports.DEFAULT_REPORT_EVERY_MS;
     httpRequests = 0;
     batchedRequests = 0;
     procedureCalls = 0;
@@ -338,9 +344,9 @@ export class HttpRequestCensus {
      * Re-arming CLEARS the counts and restarts the window: two overlapping
      * measurements in one table is a table nobody can divide by a duration.
      */
-    arm(windowMs, reportEveryMs = DEFAULT_REPORT_EVERY_MS) {
-        const clampedWindow = clamp(windowMs, MIN_WINDOW_MS, MAX_WINDOW_MS);
-        const clampedReport = clamp(reportEveryMs, MIN_REPORT_EVERY_MS, clampedWindow);
+    arm(windowMs, reportEveryMs = exports.DEFAULT_REPORT_EVERY_MS) {
+        const clampedWindow = clamp(windowMs, exports.MIN_WINDOW_MS, exports.MAX_WINDOW_MS);
+        const clampedReport = clamp(reportEveryMs, exports.MIN_REPORT_EVERY_MS, clampedWindow);
         this.reset();
         this.generation += 1;
         this.isArmed = true;
@@ -395,7 +401,7 @@ export class HttpRequestCensus {
         if (observation.procedures.length === 0)
             return;
         const userAgent = shortenUserAgent(observation.userAgent);
-        const ip = observation.ip ?? UNKNOWN;
+        const ip = observation.ip ?? exports.UNKNOWN;
         const { plane, kind, principal } = observation;
         for (const procedure of observation.procedures) {
             if (kind === 'subscription')
@@ -414,7 +420,7 @@ export class HttpRequestCensus {
                     group.calls += 1;
                 continue;
             }
-            if (this.byGroup.size >= MAX_GROUPS) {
+            if (this.byGroup.size >= exports.MAX_GROUPS) {
                 this.unattributedCalls += 1;
                 continue;
             }
@@ -460,7 +466,7 @@ export class HttpRequestCensus {
         this.subscriptionStops += count;
     }
     /** Everything the window measured, busiest first. */
-    snapshot(limit = MAX_GROUPS) {
+    snapshot(limit = exports.MAX_GROUPS) {
         const elapsedMs = this.elapsedMs();
         const perMin = (calls) => elapsedMs === 0 ? 0 : Math.round((calls * 60_000) / elapsedMs);
         const procedures = [...this.byProcedure.entries()]
@@ -561,10 +567,10 @@ export class HttpRequestCensus {
             bumpCount(existing, plane, kind);
             return;
         }
-        if (this.byProcedure.size >= MAX_PROCEDURES) {
-            const overflow = this.byProcedure.get(PROCEDURE_OVERFLOW) ?? newCount();
+        if (this.byProcedure.size >= exports.MAX_PROCEDURES) {
+            const overflow = this.byProcedure.get(exports.PROCEDURE_OVERFLOW) ?? newCount();
             bumpCount(overflow, plane, kind);
-            this.byProcedure.set(PROCEDURE_OVERFLOW, overflow);
+            this.byProcedure.set(exports.PROCEDURE_OVERFLOW, overflow);
             return;
         }
         const fresh = newCount();
@@ -603,6 +609,7 @@ export class HttpRequestCensus {
         }, this.currentReportEveryMs);
     }
 }
+exports.HttpRequestCensus = HttpRequestCensus;
 /** Per-procedure rows carried on one report line. The router's procedure set
  *  is small; this is a guard against a garbage path, not a real cut. */
 const REPORTED_PROCEDURES = 40;

package/dist/api/trpc/http-request-census.singleton.js

@@ -1,3 +1,4 @@
+"use strict";
 /**
  * Process-wide holder for the HTTP request census.
  *
@@ -10,14 +11,17 @@
  * Same idiom as `lifecycle-runner.singleton.ts`, minus the init step: this one
  * has no dependencies, so the first reader creates it disarmed.
  */
-import { HttpRequestCensus } from './http-request-census.js';
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getHttpRequestCensus = getHttpRequestCensus;
+exports.__resetHttpRequestCensusForTests = __resetHttpRequestCensusForTests;
+const http_request_census_js_1 = require("./http-request-census.js");
 let instance = null;
 /** The process-wide census. Created disarmed on first use. */
-export function getHttpRequestCensus() {
-    instance ??= new HttpRequestCensus();
+function getHttpRequestCensus() {
+    instance ??= new http_request_census_js_1.HttpRequestCensus();
     return instance;
 }
 /** Test-only: drop the instance so a spec starts from a disarmed census. */
-export function __resetHttpRequestCensusForTests() {
+function __resetHttpRequestCensusForTests() {
     instance = null;
 }

package/dist/api/trpc/localized-schema-paths.js

@@ -1,3 +1,6 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LOCALIZED_SCHEMA_PATHS = void 0;
 /**
  * The tRPC methods whose answer carries a settings schema (`ConfigUISchema`
  * or `ConfigUISchemaWithValues`) - the ONLY places the hub swaps a `labelKey`
@@ -8,7 +11,7 @@
  * A new cap method that returns a schema is added HERE (and nowhere else): a
  * schema served from a path not listed simply stays English.
  */
-export const LOCALIZED_SCHEMA_PATHS = new Set([
+exports.LOCALIZED_SCHEMA_PATHS = new Set([
     'addonSettings.getGlobalSettings',
     'addonSettings.getIntegrationSettings',
     'addonSettings.getDeviceSettings',

package/dist/api/trpc/principal-visibility.js

@@ -1,3 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.callerCanViewDevice = callerCanViewDevice;
+exports.isBroadEventViewer = isBroadEventViewer;
+exports.filterViewableDeviceIds = filterViewableDeviceIds;
+exports.hasUnrestrictedDeviceView = hasUnrestrictedDeviceView;
+exports.projectListAllForPrincipal = projectListAllForPrincipal;
+exports.scopedEventVisibility = scopedEventVisibility;
 /**
  * Non-admin principal device visibility — the shared answer to "which cameras
  * may this scoped caller see?", reused by two hotfixes:
@@ -19,10 +27,10 @@
  * Pure module — no tRPC machinery — so the spec exercises it directly (same
  * pattern as `scope-access.ts` / `share-view-access.ts`).
  */
-import { METHOD_ACCESS_MAP } from '@camstack/system';
-import { resolveViewableDeviceIds } from '@camstack/types';
-import { checkScopeAccess } from './scope-access.js';
-import { projectListAllForDeviceIds } from './share-view-access.js';
+const system_1 = require("@camstack/system");
+const types_1 = require("@camstack/types");
+const scope_access_js_1 = require("./scope-access.js");
+const share_view_access_js_1 = require("./share-view-access.js");
 /**
  * Canonical "view this camera" probe. `snapshot.getSnapshot` is a device-scope,
  * `view`-access method every viewer surface needs (the grid-embed cold-start
@@ -32,7 +40,7 @@ import { projectListAllForDeviceIds } from './share-view-access.js';
  */
 const DEVICE_VIEW_PROBE = 'snapshot.getSnapshot';
 function assertProbeExists() {
-    const meta = METHOD_ACCESS_MAP[DEVICE_VIEW_PROBE];
+    const meta = system_1.METHOD_ACCESS_MAP[DEVICE_VIEW_PROBE];
     if (!meta || meta.capScope !== 'device' || meta.access !== 'view') {
         throw new Error(`principal-visibility: probe '${DEVICE_VIEW_PROBE}' is not a device-scope view method ` +
             `(codegen drift). Pick another canonical camera-view method.`);
@@ -44,8 +52,8 @@ assertProbeExists();
  * `device:[parent]` → child inheritance through the ancestor walk, exactly as
  * the per-camera middleware does.
  */
-export function callerCanViewDevice(scopes, deviceId, lookup) {
-    return checkScopeAccess(scopes, DEVICE_VIEW_PROBE, { deviceId }, lookup).ok;
+function callerCanViewDevice(scopes, deviceId, lookup) {
+    return (0, scope_access_js_1.checkScopeAccess)(scopes, DEVICE_VIEW_PROBE, { deviceId }, lookup).ok;
 }
 /**
  * A scoped principal sees the WHOLE event/telemetry firehose when it holds any
@@ -60,7 +68,7 @@ export function callerCanViewDevice(scopes, deviceId, lookup) {
  * does not satisfy) would blank a surface they are entitled to. Availability and
  * security both point the same way here — broad grant, broad stream.
  */
-export function isBroadEventViewer(scopes) {
+function isBroadEventViewer(scopes) {
     return scopes.some((s) => s.type === 'category' && s.access.includes('view'));
 }
 /**
@@ -68,7 +76,7 @@ export function isBroadEventViewer(scopes) {
  * share minting: an admin passes `isAdmin` and skips this; a non-admin gets the
  * intersection, and the router refuses when it is empty.
  */
-export function filterViewableDeviceIds(scopes, requested, lookup) {
+function filterViewableDeviceIds(scopes, requested, lookup) {
     return requested.filter((id) => callerCanViewDevice(scopes, id, lookup));
 }
 /** The device identity an event is attributable to, or null when it carries
@@ -96,7 +104,7 @@ function eventDeviceId(evt) {
  * `category:device[view]` grant, or a device grant with an `all` selector.
  * Such a caller enumerates the fleet unprojected, exactly as before.
  */
-export function hasUnrestrictedDeviceView(isAdmin, scopes) {
+function hasUnrestrictedDeviceView(isAdmin, scopes) {
     if (isAdmin)
         return true;
     return scopes.some((s) => s.access.includes('view') &&
@@ -118,11 +126,11 @@ export function hasUnrestrictedDeviceView(isAdmin, scopes) {
  *
  * A caller with unrestricted reach is returned the payload untouched.
  */
-export function projectListAllForPrincipal(data, isAdmin, scopes, fleet) {
+function projectListAllForPrincipal(data, isAdmin, scopes, fleet) {
     if (hasUnrestrictedDeviceView(isAdmin, scopes))
         return data;
-    const viewable = resolveViewableDeviceIds(scopes, fleet, 'view');
-    return projectListAllForDeviceIds(data, viewable);
+    const viewable = (0, types_1.resolveViewableDeviceIds)(scopes, fleet, 'view');
+    return (0, share_view_access_js_1.projectListAllForDeviceIds)(data, viewable);
 }
 /**
  * Build the event-stream predicate for a NON-share principal (F0.5).
@@ -136,7 +144,7 @@ export function projectListAllForPrincipal(data, isAdmin, scopes, fleet) {
  * Share-view (`csv_*`) principals are NOT handled here — they keep their own,
  * stricter `liveEventInShareScope` filter, applied by the routers first.
  */
-export function scopedEventVisibility(user, lookup) {
+function scopedEventVisibility(user, lookup) {
     if (user.isAdmin)
         return null;
     const scopes = user.scopes ?? [];

package/dist/api/trpc/remote-addon-update-grant.js

@@ -1,3 +1,4 @@
+"use strict";
 /**
  * The scoped grant that lets an agent update an addon on ITS OWN node (D842).
  *
@@ -18,6 +19,8 @@
  *
  * Every decision, allowed or refused, is written to the auth audit trail.
  */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.authorizeRemoteUpdatePackage = authorizeRemoteUpdatePackage;
 function readRequest(input) {
     if (input === null || typeof input !== 'object')
         return null;
@@ -67,7 +70,7 @@ function decide(callerNodeId, input, deps) {
     return { allowed: true, reason: null, detail };
 }
 /** Decide, audit, and return the decision. */
-export async function authorizeRemoteUpdatePackage(callerNodeId, input, deps) {
+async function authorizeRemoteUpdatePackage(callerNodeId, input, deps) {
     const { allowed, reason, detail } = decide(callerNodeId, input, deps);
     await deps.audit({
         action: allowed ? 'agent-addon-update' : 'agent-addon-update-refused',

package/dist/api/trpc/scope-access.js

@@ -1,3 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEVICE_ENUMERATION_METHODS = void 0;
+exports.referencedDeviceIds = referencedDeviceIds;
+exports.checkScopeAccess = checkScopeAccess;
 /**
  * Pure scope-access matcher.
  *
@@ -24,8 +29,8 @@
  *      method's required `access` flavour.
  *   4. No matching scope → FORBIDDEN with a human-readable reason.
  */
-import { METHOD_ACCESS_MAP } from '@camstack/system';
-import { deviceSelectorMatches, METHOD_DEVICE_SELECTORS, scopeInherits } from '@camstack/types';
+const system_1 = require("@camstack/system");
+const types_1 = require("@camstack/types");
 /**
  * Pull `deviceId` off a tRPC request input. Device-scope cap methods
  * uniformly take `{deviceId: number, ...}` per the DeviceProxy contract,
@@ -63,13 +68,13 @@ function candidateMetas(deviceId, lookup) {
  *  the device, or — when the grant inherits at this access — a match on an
  *  ancestor. */
 function deviceScopeCovers(scope, access, candidates) {
-    const inherit = scopeInherits(scope, access);
+    const inherit = (0, types_1.scopeInherits)(scope, access);
     return candidates.some((cand, index) => {
         // index 0 is the device itself (always eligible); ancestors only when the
         // grant inherits.
         if (index > 0 && !inherit)
             return false;
-        return deviceSelectorMatches(scope.selector, cand);
+        return (0, types_1.deviceSelectorMatches)(scope.selector, cand);
     });
 }
 /** Render a device selector for the human-readable denial reason. */
@@ -97,7 +102,7 @@ function describeSelector(scope) {
  * one-camera token. The pairing is asserted by
  * `scoped-list-projection.spec.ts`.
  */
-export const DEVICE_ENUMERATION_METHODS = new Set(['deviceManager.listAll']);
+exports.DEVICE_ENUMERATION_METHODS = new Set(['deviceManager.listAll']);
 /**
  * Every deviceId a request NAMES, per the codegen'd
  * {@link METHOD_DEVICE_SELECTORS}. Absent / null / malformed values are
@@ -108,8 +113,8 @@ export const DEVICE_ENUMERATION_METHODS = new Set(['deviceManager.listAll']);
  * on a device-scoped path has to say WHICH camera
  * (`trpc-error-device-tags.ts`).
  */
-export function referencedDeviceIds(path, input) {
-    const fields = METHOD_DEVICE_SELECTORS[path];
+function referencedDeviceIds(path, input) {
+    const fields = types_1.METHOD_DEVICE_SELECTORS[path];
     if (!fields || input === null || typeof input !== 'object')
         return [];
     const out = [];
@@ -184,8 +189,8 @@ function deviceRefsSatisfied(scopes, path, input, access, lookup) {
     }
     return { ok: true };
 }
-export function checkScopeAccess(scopes, path, input, lookup) {
-    const meta = METHOD_ACCESS_MAP[path];
+function checkScopeAccess(scopes, path, input, lookup) {
+    const meta = system_1.METHOD_ACCESS_MAP[path];
     if (!meta) {
         return { ok: false, reason: `Unknown method '${path}' — codegen drift` };
     }
@@ -221,7 +226,7 @@ export function checkScopeAccess(scopes, path, input, lookup) {
                 targetMatches =
                     refs.length > 0
                         ? refs.every((id) => deviceScopeCovers(s, meta.access, candidateMetas(id, lookup)))
-                        : DEVICE_ENUMERATION_METHODS.has(path);
+                        : exports.DEVICE_ENUMERATION_METHODS.has(path);
                 break;
             }
         }

package/dist/api/trpc/server-provided-caps.js

@@ -1,3 +1,4 @@
+"use strict";
 /**
  * The capabilities the SERVER provides — routers mounted from
  * `buildServerProviders` (`trpc.router.ts`) rather than from an addon.
@@ -13,11 +14,14 @@
  *    provided the cap, no addon did, and the bridge list had been copied by
  *    hand before the cap existed.
  */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ADDON_BACKED_SERVER_CAP_NAMES = exports.HUB_SERVICE_CAP_NAMES = void 0;
+exports.capNameToNamespace = capNameToNamespace;
 /**
  * Caps served by a hub SERVICE. No addon ever registers a provider for them,
  * so a forked runner can reach them only over the `$core-caps` bridge.
  */
-export const HUB_SERVICE_CAP_NAMES = [
+exports.HUB_SERVICE_CAP_NAMES = [
     'network-quality',
     'system',
     'toast',
@@ -33,8 +37,8 @@ export const HUB_SERVICE_CAP_NAMES = [
  * cap; a resolver miss means the addon is down, not that the bridge should
  * answer — so they are deliberately NOT bridged.
  */
-export const ADDON_BACKED_SERVER_CAP_NAMES = ['webrtc-session'];
+exports.ADDON_BACKED_SERVER_CAP_NAMES = ['webrtc-session'];
 /** kebab-case cap name → the camelCase appRouter namespace it is mounted as. */
-export function capNameToNamespace(capName) {
+function capNameToNamespace(capName) {
     return capName.replace(/-([a-z])/g, (_m, c) => c.toUpperCase());
 }

package/dist/api/trpc/share-view-access.js

@@ -1,3 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SHARE_SCOPE_PROJECTED_METHODS = void 0;
+exports.checkShareViewAccess = checkShareViewAccess;
+exports.projectListAllForShareScope = projectListAllForShareScope;
+exports.projectListAllForDeviceIds = projectListAllForDeviceIds;
+exports.projectShareScopeRows = projectShareScopeRows;
+exports.liveEventInShareScope = liveEventInShareScope;
 /**
  * Methods callable WITHOUT a per-device check — their input carries no
  * deviceId. `live.onEvent` is here because its input is only a category;
@@ -127,7 +135,7 @@ function checkEventsViewAccess(scope, path, input) {
     }
     return { ok: false, reason: `'${path}' is not available to share-view tokens` };
 }
-export function checkShareViewAccess(scope, path, input) {
+function checkShareViewAccess(scope, path, input) {
     if (scope.kind === 'events-view') {
         return checkEventsViewAccess(scope, path, input);
     }
@@ -166,7 +174,7 @@ export function checkShareViewAccess(scope, path, input) {
  * onto the whitelisted row (never the raw device — fail closed on fields).
  * Non-array payloads pass through untouched (the route errored upstream).
  */
-export function projectListAllForShareScope(data, scope) {
+function projectListAllForShareScope(data, scope) {
     return projectListAllForDeviceIds(data, new Set(scope.deviceIds));
 }
 /**
@@ -179,7 +187,7 @@ export function projectListAllForShareScope(data, scope) {
  * would be two chances to forget `config` — which carries the camera
  * credentials in plaintext.
  */
-export function projectListAllForDeviceIds(data, allowed) {
+function projectListAllForDeviceIds(data, allowed) {
     if (!Array.isArray(data))
         return data;
     const rows = [];
@@ -227,7 +235,7 @@ export function projectListAllForDeviceIds(data, allowed) {
  * Anything that is not a row payload passes through untouched (the route
  * errored upstream, and rewriting an error into `[]` would hide it).
  */
-export function projectShareScopeRows(data, scope) {
+function projectShareScopeRows(data, scope) {
     const allowed = new Set(scope.deviceIds);
     const keep = (row) => {
         if (row === null || typeof row !== 'object')
@@ -248,7 +256,7 @@ export function projectShareScopeRows(data, scope) {
 /** Paths whose RESPONSE must be cut to the share scope before it leaves the
  *  server. Kept beside the enumeration so a method added to one and forgotten
  *  in the other is visible in a single file. */
-export const SHARE_SCOPE_PROJECTED_METHODS = new Set([
+exports.SHARE_SCOPE_PROJECTED_METHODS = new Set([
     'pipelineAnalytics.listRecentTracks',
     'pipelineAnalytics.listEventKindsBatch',
     'pipelineAnalytics.searchObjectEvents',
@@ -261,7 +269,7 @@ export const SHARE_SCOPE_PROJECTED_METHODS = new Set([
  *   • `data.deviceId` — addon-sourced per-device telemetry
  *     (e.g. `pipeline.camera-metrics-snapshot`).
  */
-export function liveEventInShareScope(evt, allowedDeviceIds) {
+function liveEventInShareScope(evt, allowedDeviceIds) {
     const sourceId = evt.source?.id;
     if (typeof sourceId === 'number' && allowedDeviceIds.has(sourceId))
         return true;

package/dist/api/trpc/trpc-error-device-tags.js

@@ -1,3 +1,4 @@
+"use strict";
 /**
  * A tRPC error line about a camera has to say WHICH camera.
  *
@@ -20,16 +21,18 @@
  * one call, not N events. `deviceCount` is what tells a reader the line is
  * about a batch rather than a single camera.
  */
-import { referencedDeviceIds } from './scope-access.js';
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.trpcErrorDeviceTags = trpcErrorDeviceTags;
+const scope_access_js_1 = require("./scope-access.js");
 /**
  * Device tags for a tRPC error line. Returns `{}` — never a partial or a
  * placeholder id — when the path names no device: a system-scope call is not
  * "about device 0".
  */
-export function trpcErrorDeviceTags(path, input) {
+function trpcErrorDeviceTags(path, input) {
     if (path === undefined)
         return {};
-    const ids = referencedDeviceIds(path, input);
+    const ids = (0, scope_access_js_1.referencedDeviceIds)(path, input);
     const first = ids[0];
     if (first === undefined)
         return {};

package/dist/api/trpc/trpc-error-principal.js

@@ -1,3 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readCredentialIdentity = readCredentialIdentity;
+exports.describeTrpcPrincipal = describeTrpcPrincipal;
 /**
  * Read the credential's self-description off verified claims.
  *
@@ -11,7 +15,7 @@
  * that a future token type could carry one meaning something else entirely, and
  * mislabelling a principal in a security log is worse than not labelling it.
  */
-export function readCredentialIdentity(claims) {
+function readCredentialIdentity(claims) {
     const kind = Reflect.get(claims, 'kind');
     if (kind !== 'sso-bridge')
         return {};
@@ -34,7 +38,7 @@ export function readCredentialIdentity(claims) {
  *   apocaliss92 (oauth-access session=910a6179-…)
  *   apocaliss92 (session)
  */
-export function describeTrpcPrincipal(user) {
+function describeTrpcPrincipal(user) {
     // Never blank: an empty field reads as a logging defect rather than as an
     // unauthenticated request, and the two need different fixes.
     if (!user)