@camstack/server 1.2.594 → 1.2.596

package/dist/auth/app-page-shell.js

@@ -1,3 +1,9 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.appCancelLink = exports.appHiddenField = exports.appSubmitButton = exports.appErrorLine = exports.appButton = exports.appHint = exports.appParagraph = exports.APP_PAGE_STYLE = exports.APP_PAGE_LOGOS = void 0;
+exports.appPageCsp = appPageCsp;
+exports.escapeHtml = escapeHtml;
+exports.renderAppPage = renderAppPage;
 /**
  * The one shell of every standalone page the hub renders for a native app
  * sign-in (D858): the passkey page, the confirmation page, the refusal pages.
@@ -17,13 +23,13 @@
  *    of the very string that is served, computed at module load - there is no
  *    hand-pasted hash that can fall out of step with the CSS.
  */
-import { createHash } from 'node:crypto';
-import { defaultTheme, themeToRootCss } from '@camstack/ui-library/theme/tokens';
+const node_crypto_1 = require("node:crypto");
+const tokens_1 = require("@camstack/ui-library/theme/tokens");
 /** The brand mark and wordmark, one per colour scheme (the files under `addon-admin-ui/public/brand`). */
 const LOGO_DARK = '<svg class="logo logo-dark" role="img" aria-label="CamStack" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 200 48" fill="none"><g transform="translate(4, 2) scale(0.68)"><rect x="8" y="28" width="48" height="28" rx="6" fill="#292524"/><rect x="12" y="16" width="40" height="28" rx="6" fill="#44403c"/><rect x="16" y="4" width="32" height="28" rx="6" fill="#f59e42"/><circle cx="32" cy="18" r="8" fill="#0c0a09" opacity="0.3"/><circle cx="32" cy="18" r="5" fill="#0c0a09" opacity="0.2"/><circle cx="32" cy="18" r="2.5" fill="#fafaf9" opacity="0.8"/></g><text x="52" y="31" font-family="system-ui, -apple-system, sans-serif" font-size="26" font-weight="700" letter-spacing="-0.5" fill="#fafaf9">Cam<tspan fill="#f59e42">Stack</tspan></text></svg>';
 const LOGO_LIGHT = '<svg class="logo logo-light" role="img" aria-label="CamStack" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 200 48" fill="none"><g transform="translate(4, 2) scale(0.68)"><rect x="8" y="28" width="48" height="28" rx="6" fill="#d6d3d1"/><rect x="12" y="16" width="40" height="28" rx="6" fill="#a8a29e"/><rect x="16" y="4" width="32" height="28" rx="6" fill="#e67e22"/><circle cx="32" cy="18" r="8" fill="#fafaf9" opacity="0.3"/><circle cx="32" cy="18" r="5" fill="#fafaf9" opacity="0.2"/><circle cx="32" cy="18" r="2.5" fill="#1c1917" opacity="0.7"/></g><text x="52" y="31" font-family="system-ui, -apple-system, sans-serif" font-size="26" font-weight="700" letter-spacing="-0.5" fill="#1c1917">Cam<tspan fill="#e67e22">Stack</tspan></text></svg>';
 /** The logo markup, exposed so a spec can hold it against the brand files. */
-export const APP_PAGE_LOGOS = {
+exports.APP_PAGE_LOGOS = {
     dark: LOGO_DARK,
     light: LOGO_LIGHT,
 };
@@ -62,19 +68,19 @@ const COMPONENT_CSS = [
     `.actions{display:flex;flex-direction:column;gap:var(--spacing-md)}`,
 ].join('');
 /** The one stylesheet, as served: the generated tokens followed by the component rules. */
-export const APP_PAGE_STYLE = `${themeToRootCss(defaultTheme)}${COMPONENT_CSS}`;
-const sha256Source = (text) => `'sha256-${createHash('sha256').update(text).digest('base64')}'`;
+exports.APP_PAGE_STYLE = `${(0, tokens_1.themeToRootCss)(tokens_1.defaultTheme)}${COMPONENT_CSS}`;
+const sha256Source = (text) => `'sha256-${(0, node_crypto_1.createHash)('sha256').update(text).digest('base64')}'`;
 /**
  * The CSP for a page rendered by {@link renderAppPage}: the inline style and
  * (when there is one) the inline script by hash, same-origin requests only, no
  * framing, no base rewrite. The hashes are computed from the strings the page
  * is built from, so they cannot disagree with it.
  */
-export function appPageCsp(options = {}) {
+function appPageCsp(options = {}) {
     return [
         "default-src 'none'",
         ...(options.script === undefined ? [] : [`script-src ${sha256Source(options.script)}`]),
-        `style-src ${sha256Source(APP_PAGE_STYLE)}`,
+        `style-src ${sha256Source(exports.APP_PAGE_STYLE)}`,
         ...(options.script === undefined ? [] : ["connect-src 'self'"]),
         "base-uri 'none'",
         `form-action ${options.formToSelf === true ? "'self'" : "'none'"}`,
@@ -82,29 +88,36 @@ export function appPageCsp(options = {}) {
     ].join('; ');
 }
 /** Escapes text for an HTML text node or a double-quoted attribute. */
-export function escapeHtml(text) {
+function escapeHtml(text) {
     return text.replace(/[&<>"']/g, (c) => `&#${c.charCodeAt(0)};`);
 }
 /** A full page: doctype, viewport (with safe-area fit), tokens, logo, a card holding `body`. */
-export function renderAppPage(input) {
+function renderAppPage(input) {
     const referrer = input.noReferrer === true ? '<meta name="referrer" content="no-referrer">' : '';
     const script = input.script === undefined ? '' : `<script>${input.script}</script>`;
     const strings = Object.entries(input.scriptStrings ?? {})
         .map(([key, value]) => ` data-s-${key}="${escapeHtml(value)}"`)
         .join('');
-    return `<!doctype html><html lang="${input.lang}"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1,viewport-fit=cover"><meta name="color-scheme" content="light dark">${referrer}<title>${escapeHtml(input.title)}</title><style>${APP_PAGE_STYLE}</style></head><body${strings}><main><div class="brand">${LOGO_DARK}${LOGO_LIGHT}</div><div class="card"><h1>${escapeHtml(input.heading)}</h1>${input.body}</div></main>${script}</body></html>`;
+    return `<!doctype html><html lang="${input.lang}"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1,viewport-fit=cover"><meta name="color-scheme" content="light dark">${referrer}<title>${escapeHtml(input.title)}</title><style>${exports.APP_PAGE_STYLE}</style></head><body${strings}><main><div class="brand">${LOGO_DARK}${LOGO_LIGHT}</div><div class="card"><h1>${escapeHtml(input.heading)}</h1>${input.body}</div></main>${script}</body></html>`;
 }
 /** A paragraph of the card (`text` is escaped). */
-export const appParagraph = (text) => `<p>${escapeHtml(text)}</p>`;
+const appParagraph = (text) => `<p>${escapeHtml(text)}</p>`;
+exports.appParagraph = appParagraph;
 /** A smaller, muted paragraph (`text` is escaped). */
-export const appHint = (text) => `<p class="hint">${escapeHtml(text)}</p>`;
+const appHint = (text) => `<p class="hint">${escapeHtml(text)}</p>`;
+exports.appHint = appHint;
 /** The primary button; `attributes` is trusted markup (already escaped), `label` is escaped. */
-export const appButton = (label, attributes) => `<button class="btn" type="button" ${attributes}>${escapeHtml(label)}</button>`;
+const appButton = (label, attributes) => `<button class="btn" type="button" ${attributes}>${escapeHtml(label)}</button>`;
+exports.appButton = appButton;
 /** The error line a script fills in; empty it renders nothing. */
-export const appErrorLine = (id) => `<p class="error" id="${id}" role="alert"></p>`;
+const appErrorLine = (id) => `<p class="error" id="${id}" role="alert"></p>`;
+exports.appErrorLine = appErrorLine;
 /** A submit button of a form (`name`/`value` are escaped); `secondary` is the outlined, non-default choice. */
-export const appSubmitButton = (label, name, value, secondary = false) => `<button class="${secondary ? 'btn secondary' : 'btn'}" type="submit" name="${escapeHtml(name)}" value="${escapeHtml(value)}">${escapeHtml(label)}</button>`;
+const appSubmitButton = (label, name, value, secondary = false) => `<button class="${secondary ? 'btn secondary' : 'btn'}" type="submit" name="${escapeHtml(name)}" value="${escapeHtml(value)}">${escapeHtml(label)}</button>`;
+exports.appSubmitButton = appSubmitButton;
 /** A hidden form field (`name`/`value` are escaped). */
-export const appHiddenField = (name, value) => `<input type="hidden" name="${escapeHtml(name)}" value="${escapeHtml(value)}">`;
+const appHiddenField = (name, value) => `<input type="hidden" name="${escapeHtml(name)}" value="${escapeHtml(value)}">`;
+exports.appHiddenField = appHiddenField;
 /** The quiet link under the actions (Cancel); `href` is escaped here. */
-export const appCancelLink = (href, label) => `<a class="link" href="${escapeHtml(href)}">${escapeHtml(label)}</a>`;
+const appCancelLink = (href, label) => `<a class="link" href="${escapeHtml(href)}">${escapeHtml(label)}</a>`;
+exports.appCancelLink = appCancelLink;

package/dist/auth/app-page-strings.js

@@ -1,3 +1,9 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.APP_PAGE_STRINGS = exports.APP_PAGE_DEFAULT_LANG = void 0;
+exports.appStrings = appStrings;
+exports.langFromAcceptLanguage = langFromAcceptLanguage;
+exports.resolveAppPageLang = resolveAppPageLang;
 /**
  * Every word the hub's app landing pages show (D858), in both languages, and
  * the one rule that picks the language.
@@ -12,8 +18,8 @@
  * (allow-listed) wins; else the first supported tag of `Accept-Language`
  * (`it*` -> `it`); else English. Neither input is ever reflected into a page.
  */
-import { APP_START_REFUSAL_MESSAGES, parseAppPageLang, } from '@camstack/types';
-export const APP_PAGE_DEFAULT_LANG = 'en';
+const types_1 = require("@camstack/types");
+exports.APP_PAGE_DEFAULT_LANG = 'en';
 const EN = {
     confirm: {
         title: 'Sign in the CamStack app',
@@ -42,7 +48,7 @@ const EN = {
         title: 'Sign-in request refused',
         hint: 'Close this window and try again from the app.',
         generic: 'The sign-in request was refused.',
-        reasons: APP_START_REFUSAL_MESSAGES,
+        reasons: types_1.APP_START_REFUSAL_MESSAGES,
     },
     consent: {
         titlePrefix: 'CamStack · Authorize ',
@@ -115,12 +121,12 @@ const IT = {
         signInFailed: 'Accesso non riuscito. Riprova.',
     },
 };
-export const APP_PAGE_STRINGS = { en: EN, it: IT };
-export function appStrings(lang) {
-    return APP_PAGE_STRINGS[lang];
+exports.APP_PAGE_STRINGS = { en: EN, it: IT };
+function appStrings(lang) {
+    return exports.APP_PAGE_STRINGS[lang];
 }
 /** The first supported language of an `Accept-Language` value (by q, then order), or `undefined`. */
-export function langFromAcceptLanguage(header) {
+function langFromAcceptLanguage(header) {
     const value = typeof header === 'string' ? header : header?.join(',');
     if (value === undefined || value.length > 512)
         return undefined;
@@ -137,15 +143,15 @@ export function langFromAcceptLanguage(header) {
         .filter((t) => Number.isFinite(t.weight) && t.weight > 0)
         .sort((a, b) => b.weight - a.weight || a.index - b.index);
     for (const { primary } of ranked) {
-        const lang = parseAppPageLang(primary);
+        const lang = (0, types_1.parseAppPageLang)(primary);
         if (lang !== undefined)
             return lang;
     }
     return undefined;
 }
 /** The page language: the app's `lang` (allow-listed), else `Accept-Language`, else English. */
-export function resolveAppPageLang(input) {
-    return (parseAppPageLang(input.lang) ??
+function resolveAppPageLang(input) {
+    return ((0, types_1.parseAppPageLang)(input.lang) ??
         langFromAcceptLanguage(input.acceptLanguage) ??
-        APP_PAGE_DEFAULT_LANG);
+        exports.APP_PAGE_DEFAULT_LANG);
 }

package/dist/auth/app-passkey-page.js

@@ -1,3 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.APP_PASSKEY_REFUSAL_CSP = exports.APP_PASSKEY_CSP = void 0;
+exports.appPasskeyPage = appPasskeyPage;
+exports.appPasskeyRefusalPage = appPasskeyRefusalPage;
 /**
  * The standalone passkey page for a native app sign-in (D858).
  *
@@ -14,8 +19,8 @@
  * specific is ever placed in the script; the only server-rendered value is the
  * (allow-listed, HTML-escaped) cancel link.
  */
-import { appButton, appCancelLink, appErrorLine, appHint, appPageCsp, appParagraph, escapeHtml, renderAppPage, } from './app-page-shell.js';
-import { appStrings } from './app-page-strings.js';
+const app_page_shell_js_1 = require("./app-page-shell.js");
+const app_page_strings_js_1 = require("./app-page-strings.js");
 const PAGE_SCRIPT = `(function () {
   var q = new URLSearchParams(location.search);
   var base = location.pathname.replace(/\\/+$/, '');
@@ -112,11 +117,11 @@ const PAGE_SCRIPT = `(function () {
  * The page's CSP: the shell's style and the one script by hash, same-origin
  * requests only, no framing, no base rewrite, no form posts, no plugins.
  */
-export const APP_PASSKEY_CSP = appPageCsp({ script: PAGE_SCRIPT });
+exports.APP_PASSKEY_CSP = (0, app_page_shell_js_1.appPageCsp)({ script: PAGE_SCRIPT });
 /** The page; `cancelHref` is the app callback carrying `error=cancelled`. */
-export function appPasskeyPage(cancelHref, lang) {
-    const t = appStrings(lang);
-    return renderAppPage({
+function appPasskeyPage(cancelHref, lang) {
+    const t = (0, app_page_strings_js_1.appStrings)(lang);
+    return (0, app_page_shell_js_1.renderAppPage)({
         lang,
         title: t.passkey.title,
         heading: t.passkey.heading,
@@ -129,23 +134,23 @@ export function appPasskeyPage(cancelHref, lang) {
             'sign-in-failed': t.script.signInFailed,
         },
         body: [
-            appParagraph(t.passkey.body),
-            appButton(t.passkey.button, 'id="go"'),
-            appErrorLine('msg'),
-            appCancelLink(cancelHref, t.passkey.cancel),
-            `<noscript><p class="error">${escapeHtml(t.passkey.noscript)}</p></noscript>`,
+            (0, app_page_shell_js_1.appParagraph)(t.passkey.body),
+            (0, app_page_shell_js_1.appButton)(t.passkey.button, 'id="go"'),
+            (0, app_page_shell_js_1.appErrorLine)('msg'),
+            (0, app_page_shell_js_1.appCancelLink)(cancelHref, t.passkey.cancel),
+            `<noscript><p class="error">${(0, app_page_shell_js_1.escapeHtml)(t.passkey.noscript)}</p></noscript>`,
         ].join(''),
     });
 }
 /** The page for a request the hub refuses to serve: a sentence, no script, no assets. */
-export function appPasskeyRefusalPage(message, lang) {
-    const t = appStrings(lang).refused;
-    return renderAppPage({
+function appPasskeyRefusalPage(message, lang) {
+    const t = (0, app_page_strings_js_1.appStrings)(lang).refused;
+    return (0, app_page_shell_js_1.renderAppPage)({
         lang,
         title: t.title,
         heading: t.title,
-        body: appParagraph(message) + appHint(t.hint),
+        body: (0, app_page_shell_js_1.appParagraph)(message) + (0, app_page_shell_js_1.appHint)(t.hint),
     });
 }
 /** CSP of the refusal page: the shell's style only, nothing runs. */
-export const APP_PASSKEY_REFUSAL_CSP = appPageCsp();
+exports.APP_PASSKEY_REFUSAL_CSP = (0, app_page_shell_js_1.appPageCsp)();

package/dist/auth/app-passkey-routes.js

@@ -1,3 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.APP_PASSKEY_PATH = void 0;
+exports.registerAppPasskeyRoutes = registerAppPasskeyRoutes;
 /**
  * The passkey app sign-in routes (D858):
  *
@@ -14,30 +18,30 @@
  * `{ error }` for a request that is not an app flow at all), so the page just
  * navigates. The app's parameters are never logged.
  */
-import { APP_FLOW_REFUSAL_MESSAGES, appFlowLocation, parseAppFlowRequest, } from '@camstack/types';
-import { z } from 'zod';
-import { APP_CONFIRM_PARAM, appConfirmCookie } from './app-confirm-routes.js';
-import { APP_PASSKEY_CSP, APP_PASSKEY_REFUSAL_CSP, appPasskeyPage, appPasskeyRefusalPage, } from './app-passkey-page.js';
-import { appStrings, resolveAppPageLang } from './app-page-strings.js';
-import { clientKeyFromRequest } from './auth-rate-limit.js';
-import { SessionUserGoneError } from './session-mint.js';
-export const APP_PASSKEY_PATH = '/auth/app/passkey';
-const FinishBodySchema = z.object({
-    response: z.record(z.string(), z.unknown()),
-    code_challenge: z.string().optional(),
-    code_challenge_method: z.string().optional(),
-    state: z.string().optional(),
-    purpose: z.string().optional(),
-    redirect: z.string().optional(),
-    lang: z.string().optional(),
+const types_1 = require("@camstack/types");
+const zod_1 = require("zod");
+const app_confirm_routes_js_1 = require("./app-confirm-routes.js");
+const app_passkey_page_js_1 = require("./app-passkey-page.js");
+const app_page_strings_js_1 = require("./app-page-strings.js");
+const auth_rate_limit_js_1 = require("./auth-rate-limit.js");
+const session_mint_js_1 = require("./session-mint.js");
+exports.APP_PASSKEY_PATH = '/auth/app/passkey';
+const FinishBodySchema = zod_1.z.object({
+    response: zod_1.z.record(zod_1.z.string(), zod_1.z.unknown()),
+    code_challenge: zod_1.z.string().optional(),
+    code_challenge_method: zod_1.z.string().optional(),
+    state: zod_1.z.string().optional(),
+    purpose: zod_1.z.string().optional(),
+    redirect: zod_1.z.string().optional(),
+    lang: zod_1.z.string().optional(),
 });
 function noStore(reply) {
     reply.header('Cache-Control', 'no-store');
     reply.header('Referrer-Policy', 'no-referrer');
 }
-export function registerAppPasskeyRoutes(fastify, deps) {
+function registerAppPasskeyRoutes(fastify, deps) {
     const limited = (bucket, request, reply) => {
-        const client = clientKeyFromRequest(request, deps.network);
+        const client = (0, auth_rate_limit_js_1.clientKeyFromRequest)(request, deps.network);
         if (client === null)
             return false;
         const verdict = deps.limiter.check(`${bucket}:${client}`);
@@ -47,11 +51,11 @@ export function registerAppPasskeyRoutes(fastify, deps) {
         void reply.status(429).send({ error: 'Too many attempts' });
         return true;
     };
-    fastify.get(APP_PASSKEY_PATH, async (request, reply) => {
+    fastify.get(exports.APP_PASSKEY_PATH, async (request, reply) => {
         noStore(reply);
         reply.type('text/html; charset=utf-8');
-        const parsed = parseAppFlowRequest(request.query);
-        const lang = resolveAppPageLang({
+        const parsed = (0, types_1.parseAppFlowRequest)(request.query);
+        const lang = (0, app_page_strings_js_1.resolveAppPageLang)({
             lang: parsed.ok ? parsed.request.lang : request.query['lang'],
             acceptLanguage: request.headers['accept-language'],
         });
@@ -59,26 +63,26 @@ export function registerAppPasskeyRoutes(fastify, deps) {
             deps.logger.warn('Passkey app sign-in refused at the page', {
                 meta: { reason: parsed.reason },
             });
-            reply.header('Content-Security-Policy', APP_PASSKEY_REFUSAL_CSP);
+            reply.header('Content-Security-Policy', app_passkey_page_js_1.APP_PASSKEY_REFUSAL_CSP);
             return reply
                 .status(400)
-                .send(appPasskeyRefusalPage(appStrings(lang).refused.reasons[parsed.reason], lang));
+                .send((0, app_passkey_page_js_1.appPasskeyRefusalPage)((0, app_page_strings_js_1.appStrings)(lang).refused.reasons[parsed.reason], lang));
         }
-        reply.header('Content-Security-Policy', APP_PASSKEY_CSP);
-        const cancel = appFlowLocation(parsed.request.redirect, { error: 'cancelled' }, parsed.request.state);
-        return reply.send(appPasskeyPage(cancel, lang));
+        reply.header('Content-Security-Policy', app_passkey_page_js_1.APP_PASSKEY_CSP);
+        const cancel = (0, types_1.appFlowLocation)(parsed.request.redirect, { error: 'cancelled' }, parsed.request.state);
+        return reply.send((0, app_passkey_page_js_1.appPasskeyPage)(cancel, lang));
     });
-    fastify.post(`${APP_PASSKEY_PATH}/begin`, async (request, reply) => {
+    fastify.post(`${exports.APP_PASSKEY_PATH}/begin`, async (request, reply) => {
         noStore(reply);
         if (limited('app-passkey-begin', request, reply))
             return reply;
-        const body = z.record(z.string(), z.unknown()).safeParse(request.body);
+        const body = zod_1.z.record(zod_1.z.string(), zod_1.z.unknown()).safeParse(request.body);
         const query = body.success
             ? Object.fromEntries(Object.entries(body.data).flatMap(([k, v]) => (typeof v === 'string' ? [[k, v]] : [])))
             : {};
-        const parsed = parseAppFlowRequest(query);
+        const parsed = (0, types_1.parseAppFlowRequest)(query);
         if (!parsed.ok)
-            return reply.status(400).send({ error: APP_FLOW_REFUSAL_MESSAGES[parsed.reason] });
+            return reply.status(400).send({ error: types_1.APP_FLOW_REFUSAL_MESSAGES[parsed.reason] });
         const provider = deps.passkeys();
         if (provider === null)
             return reply.status(503).send({ error: 'Passkeys are not available.' });
@@ -92,14 +96,14 @@ export function registerAppPasskeyRoutes(fastify, deps) {
             return reply.status(500).send({ error: 'Passkeys are not available.' });
         }
     });
-    fastify.post(`${APP_PASSKEY_PATH}/finish`, async (request, reply) => {
+    fastify.post(`${exports.APP_PASSKEY_PATH}/finish`, async (request, reply) => {
         noStore(reply);
         if (limited('app-passkey-finish', request, reply))
             return reply;
         const body = FinishBodySchema.safeParse(request.body);
         if (!body.success)
             return reply.status(400).send({ error: 'Malformed sign-in request.' });
-        const parsed = parseAppFlowRequest({
+        const parsed = (0, types_1.parseAppFlowRequest)({
             code_challenge: body.data.code_challenge,
             code_challenge_method: body.data.code_challenge_method,
             state: body.data.state,
@@ -108,11 +112,11 @@ export function registerAppPasskeyRoutes(fastify, deps) {
             lang: body.data.lang,
         });
         if (!parsed.ok)
-            return reply.status(400).send({ error: APP_FLOW_REFUSAL_MESSAGES[parsed.reason] });
+            return reply.status(400).send({ error: types_1.APP_FLOW_REFUSAL_MESSAGES[parsed.reason] });
         const app = parsed.request;
         const deny = (error) => {
             deps.logger.warn('Passkey app sign-in refused', { meta: { error } });
-            return reply.send({ location: appFlowLocation(app.redirect, { error }, app.state) });
+            return reply.send({ location: (0, types_1.appFlowLocation)(app.redirect, { error }, app.state) });
         };
         const provider = deps.passkeys();
         if (provider === null)
@@ -138,13 +142,13 @@ export function registerAppPasskeyRoutes(fastify, deps) {
                 app,
                 authMethod: 'passkey',
             });
-            reply.header('Set-Cookie', appConfirmCookie(parked.cookie, request.protocol === 'https'));
+            reply.header('Set-Cookie', (0, app_confirm_routes_js_1.appConfirmCookie)(parked.cookie, request.protocol === 'https'));
             return reply.send({
-                confirm: `confirm?${APP_CONFIRM_PARAM}=${encodeURIComponent(parked.token)}`,
+                confirm: `confirm?${app_confirm_routes_js_1.APP_CONFIRM_PARAM}=${encodeURIComponent(parked.token)}`,
             });
         }
         catch (error) {
-            if (error instanceof SessionUserGoneError)
+            if (error instanceof session_mint_js_1.SessionUserGoneError)
                 return deny('user-gone');
             deps.logger.error('Passkey app sign-in failed', {
                 meta: { error: error instanceof Error ? error.message : String(error) },

package/dist/auth/app-refused-route.js

@@ -1,3 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.APP_REFUSED_CSP = void 0;
+exports.appRefusedPage = appRefusedPage;
+exports.registerAppRefusedRoute = registerAppRefusedRoute;
 /**
  * `GET /auth/app/refused?reason=<code>` - the page that says why a native app
  * sign-in could not start (D858).
@@ -7,29 +12,29 @@
  * sentence, in the language of `lang`/`Accept-Language`, in the same shell as every other app page. The query is never echoed: an unknown or
  * absent code gets a generic sentence, a known one its fixed words.
  */
-import { APP_REFUSED_PATH, isAppStartRefusal } from '@camstack/types';
-import { appHint, appPageCsp, appParagraph, renderAppPage } from './app-page-shell.js';
-import { appStrings, resolveAppPageLang } from './app-page-strings.js';
+const types_1 = require("@camstack/types");
+const app_page_shell_js_1 = require("./app-page-shell.js");
+const app_page_strings_js_1 = require("./app-page-strings.js");
 /** The refusal page for `reason` (a known code, or anything: unknown renders the generic sentence). */
-export function appRefusedPage(reason, lang) {
-    const t = appStrings(lang).refused;
-    const message = isAppStartRefusal(reason) ? t.reasons[reason] : t.generic;
-    return renderAppPage({
+function appRefusedPage(reason, lang) {
+    const t = (0, app_page_strings_js_1.appStrings)(lang).refused;
+    const message = (0, types_1.isAppStartRefusal)(reason) ? t.reasons[reason] : t.generic;
+    return (0, app_page_shell_js_1.renderAppPage)({
         lang,
         title: t.title,
         heading: t.title,
-        body: appParagraph(message) + appHint(t.hint),
+        body: (0, app_page_shell_js_1.appParagraph)(message) + (0, app_page_shell_js_1.appHint)(t.hint),
     });
 }
 /** CSP of the refusal page: the shell's style only, nothing runs. */
-export const APP_REFUSED_CSP = appPageCsp();
-export function registerAppRefusedRoute(fastify) {
-    fastify.get(APP_REFUSED_PATH, async (request, reply) => {
+exports.APP_REFUSED_CSP = (0, app_page_shell_js_1.appPageCsp)();
+function registerAppRefusedRoute(fastify) {
+    fastify.get(types_1.APP_REFUSED_PATH, async (request, reply) => {
         reply.header('Cache-Control', 'no-store');
         reply.header('Referrer-Policy', 'no-referrer');
-        reply.header('Content-Security-Policy', APP_REFUSED_CSP);
+        reply.header('Content-Security-Policy', exports.APP_REFUSED_CSP);
         reply.type('text/html; charset=utf-8');
-        const lang = resolveAppPageLang({
+        const lang = (0, app_page_strings_js_1.resolveAppPageLang)({
             lang: request.query['lang'],
             acceptLanguage: request.headers['accept-language'],
         });

package/dist/auth/auth-network-policy.js

@@ -1,3 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_AUTH_NETWORK_POLICY = exports.TRUSTED_NETWORKS_KEY = exports.TRUSTED_PROXIES_KEY = void 0;
+exports.createAuthNetworkPolicy = createAuthNetworkPolicy;
 /**
  * The two network facts the auth surface reads from settings:
  *
@@ -13,10 +17,10 @@
  * answer yet is treated as an EMPTY list: no extra proxy is trusted, and no
  * network skips a factor — both fail closed.
  */
-import { createCidrMatcher, readCidrSetting } from '@camstack/system';
-import { resolveClientAddress } from './client-address.js';
-export const TRUSTED_PROXIES_KEY = 'auth.trustedProxies';
-export const TRUSTED_NETWORKS_KEY = 'auth.trustedNetworks';
+const system_1 = require("@camstack/system");
+const client_address_js_1 = require("./client-address.js");
+exports.TRUSTED_PROXIES_KEY = 'auth.trustedProxies';
+exports.TRUSTED_NETWORKS_KEY = 'auth.trustedNetworks';
 function asRequest(req) {
     if (req === null || typeof req !== 'object')
         return null;
@@ -32,7 +36,7 @@ function asRequest(req) {
 }
 function safeList(read, key) {
     try {
-        return readCidrSetting(read(key));
+        return (0, system_1.readCidrSetting)(read(key));
     }
     catch {
         return [];
@@ -41,31 +45,31 @@ function safeList(read, key) {
 /** One memo per list: rebuilding a BlockList per request is wasted work. */
 function memoMatcher() {
     let lastKey = null;
-    let last = createCidrMatcher([]);
+    let last = (0, system_1.createCidrMatcher)([]);
     return (entries) => {
         const key = entries.join('\n');
         if (key !== lastKey) {
             lastKey = key;
-            last = createCidrMatcher(entries);
+            last = (0, system_1.createCidrMatcher)(entries);
         }
         return last;
     };
 }
-export function createAuthNetworkPolicy(read) {
+function createAuthNetworkPolicy(read) {
     const networks = memoMatcher();
     return {
         clientAddress(req) {
             const request = asRequest(req);
             if (request === null)
                 return { ip: null, peer: null, viaProxy: false };
-            return resolveClientAddress(request, { trustedProxies: safeList(read, TRUSTED_PROXIES_KEY) });
+            return (0, client_address_js_1.resolveClientAddress)(request, { trustedProxies: safeList(read, exports.TRUSTED_PROXIES_KEY) });
         },
         isTrustedNetworkLogin(address) {
             if (address.viaProxy || address.ip === null)
                 return false;
-            return networks(safeList(read, TRUSTED_NETWORKS_KEY)).contains(address.ip);
+            return networks(safeList(read, exports.TRUSTED_NETWORKS_KEY)).contains(address.ip);
         },
     };
 }
 /** No settings: loopback is the only trusted proxy, no network skips a factor. */
-export const DEFAULT_AUTH_NETWORK_POLICY = createAuthNetworkPolicy(() => undefined);
+exports.DEFAULT_AUTH_NETWORK_POLICY = createAuthNetworkPolicy(() => undefined);

package/dist/auth/auth-provider-gate.js

@@ -1,14 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AUTH_GOVERNING_CAPS = void 0;
+exports.isAuthAddonDisabled = isAuthAddonDisabled;
+exports.bridgeProviderAddonId = bridgeProviderAddonId;
 /** Capabilities whose per-provider toggle is an auth addon's enable. */
-export const AUTH_GOVERNING_CAPS = ['auth-provider', 'user-passkeys'];
+exports.AUTH_GOVERNING_CAPS = ['auth-provider', 'user-passkeys'];
 /** Whether the operator disabled `addonId` on Identity → Authentication. */
-export function isAuthAddonDisabled(registry, addonId) {
-    return AUTH_GOVERNING_CAPS.some((cap) => registry.isProviderDisabled(cap, addonId));
+function isAuthAddonDisabled(registry, addonId) {
+    return exports.AUTH_GOVERNING_CAPS.some((cap) => registry.isProviderDisabled(cap, addonId));
 }
 /**
  * The addon behind an SSO bridge's `provider` claim: `auth-oidc/<instance>`
  * is signed by `auth-oidc`, anything else names its addon directly.
  */
-export function bridgeProviderAddonId(provider) {
+function bridgeProviderAddonId(provider) {
     const slash = provider.indexOf('/');
     return slash === -1 ? provider : provider.slice(0, slash);
 }

package/dist/auth/auth-rate-limit.js

@@ -1,3 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createRateLimiter = createRateLimiter;
+exports.clientKeyFromRequest = clientKeyFromRequest;
 /**
  * Public-auth rate limiting — fixed window per (bucket, client ip).
  *
@@ -12,8 +16,8 @@
  * BOUNDED (`maxKeys`, oldest-window evicted first) so an attacker
  * rotating spoofed source addresses cannot grow it without limit.
  */
-import { DEFAULT_AUTH_NETWORK_POLICY } from './auth-network-policy.js';
-export function createRateLimiter(options) {
+const auth_network_policy_js_1 = require("./auth-network-policy.js");
+function createRateLimiter(options) {
     const maxKeys = options.maxKeys ?? 10_000;
     const now = options.now ?? Date.now;
     const entries = new Map();
@@ -72,6 +76,6 @@ export function createRateLimiter(options) {
  * bucket locked the whole internet out. `null` = no originating request
  * (a mesh-internal `createCaller`) — never limited.
  */
-export function clientKeyFromRequest(req, policy = DEFAULT_AUTH_NETWORK_POLICY) {
+function clientKeyFromRequest(req, policy = auth_network_policy_js_1.DEFAULT_AUTH_NETWORK_POLICY) {
     return policy.clientAddress(req).ip;
 }

package/dist/auth/client-address.js

@@ -1,3 +1,6 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveClientAddress = resolveClientAddress;
 /**
  * The real client address of an HTTP / WS request.
  *
@@ -22,8 +25,8 @@
  * second factor from a trusted network) refuses `viaProxy` outright, whatever
  * address the headers name.
  */
-import { createCidrMatcher, normalizeIp } from '@camstack/system';
-import { isIP } from 'node:net';
+const system_1 = require("@camstack/system");
+const node_net_1 = require("node:net");
 const LOOPBACK = ['127.0.0.0/8', '::1/128'];
 function header(req, name) {
     const raw = req.headers[name];
@@ -31,15 +34,15 @@ function header(req, name) {
     return typeof value === 'string' && value.trim().length > 0 ? value : null;
 }
 function validIp(value) {
-    const ip = normalizeIp(value);
-    return isIP(ip) === 0 ? null : ip;
+    const ip = (0, system_1.normalizeIp)(value);
+    return (0, node_net_1.isIP)(ip) === 0 ? null : ip;
 }
-export function resolveClientAddress(req, config) {
+function resolveClientAddress(req, config) {
     const rawPeer = req.socket?.remoteAddress;
     const peer = typeof rawPeer === 'string' && rawPeer.length > 0 ? validIp(rawPeer) : null;
     if (peer === null)
         return { ip: null, peer: null, viaProxy: false };
-    const trusted = createCidrMatcher([...LOOPBACK, ...config.trustedProxies]);
+    const trusted = (0, system_1.createCidrMatcher)([...LOOPBACK, ...config.trustedProxies]);
     if (!trusted.contains(peer))
         return { ip: peer, peer, viaProxy: false };
     // Cloudflare stamps the connecting client itself; prefer it when it parses.