@camstack/server 1.2.594 → 1.2.596

package/dist/auth/device-enroll-proofs.js

@@ -1,4 +1,40 @@
-import { userError } from '@camstack/types';
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DeviceEnrollProofs = exports.DEVICE_ENROLL_PROOF_TTL_MS = void 0;
+const types_1 = require("@camstack/types");
 /**
  * Step-up proofs for `auth.enrollSelf` (D855).
  *
@@ -10,15 +46,15 @@ import { userError } from '@camstack/types';
  * `device-enroll`, bound to the user, 5 minutes, single use, kept only as a
  * hash. It replaces no session.
  */
-import * as crypto from 'node:crypto';
-export const DEVICE_ENROLL_PROOF_TTL_MS = 5 * 60_000;
+const crypto = __importStar(require("node:crypto"));
+exports.DEVICE_ENROLL_PROOF_TTL_MS = 5 * 60_000;
 const MAX_PENDING = 1_000;
 function hash(proof) {
     return crypto.createHash('sha256').update(proof).digest('hex');
 }
 /** How long a spent reauth token / claimed session is remembered (past the token's own 5 min). */
 const SPENT_MEMORY_MS = 6 * 60_000;
-export class DeviceEnrollProofs {
+class DeviceEnrollProofs {
     now;
     logger;
     pending = new Map();
@@ -39,9 +75,9 @@ export class DeviceEnrollProofs {
     mint(userId) {
         this.prune();
         if (this.pending.size >= MAX_PENDING)
-            throw userError('server.step-up-busy', undefined, 'Too many pending step-up proofs');
+            throw (0, types_1.userError)('server.step-up-busy', undefined, 'Too many pending step-up proofs');
         const proof = `cdp_${crypto.randomBytes(32).toString('base64url')}`;
-        const expiresAt = this.now() + DEVICE_ENROLL_PROOF_TTL_MS;
+        const expiresAt = this.now() + exports.DEVICE_ENROLL_PROOF_TTL_MS;
         this.pending.set(hash(proof), { userId, expiresAt });
         return { proof, expiresAt };
     }
@@ -110,3 +146,4 @@ export class DeviceEnrollProofs {
                 this.pending.delete(k);
     }
 }
+exports.DeviceEnrollProofs = DeviceEnrollProofs;

package/dist/auth/external-link-intents.js

@@ -1,3 +1,6 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ExternalLinkIntents = void 0;
 /**
  * Pending "link this sign-in account" requests (D782).
  *
@@ -12,12 +15,12 @@
  * Hub-local and in memory on purpose: an intent lives minutes, and a hub
  * restart mid-link costs the user one more click.
  */
-import { randomBytes } from 'node:crypto';
+const node_crypto_1 = require("node:crypto");
 /** Long enough for an IdP login with a password manager; short enough to be useless later. */
 const DEFAULT_TTL_MS = 10 * 60_000;
 /** Bounded: a session minting intents in a loop cannot grow this without limit. */
 const DEFAULT_MAX_ENTRIES = 1_000;
-export class ExternalLinkIntents {
+class ExternalLinkIntents {
     intents = new Map();
     now;
     ttlMs;
@@ -35,7 +38,7 @@ export class ExternalLinkIntents {
                 break;
             this.intents.delete(oldest.value);
         }
-        const handle = `li_${randomBytes(24).toString('base64url')}`;
+        const handle = `li_${(0, node_crypto_1.randomBytes)(24).toString('base64url')}`;
         this.intents.set(handle, {
             userId,
             provider,
@@ -66,3 +69,4 @@ export class ExternalLinkIntents {
         }
     }
 }
+exports.ExternalLinkIntents = ExternalLinkIntents;

package/dist/auth/hub-sessions.js

@@ -1,3 +1,9 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.userManagementInternal = userManagementInternal;
+exports.createSessionBacking = createSessionBacking;
+exports.sessionBackingFrom = sessionBackingFrom;
+exports.createSessionTokenCheck = createSessionTokenCheck;
 /**
  * The hub's two uses of the login-session table, which `local-auth` owns and
  * reaches only through its hub-internal surface (`UserManagementInternal`):
@@ -10,12 +16,12 @@
  * Both resolve `user-management` per call: a hub whose local-auth is not up
  * mints nothing and accepts no session (fail closed).
  */
-import { getUserManagementInternal, } from '@camstack/system';
+const system_1 = require("@camstack/system");
 /** The hub-internal user-management surface right now, or `null`. */
-export function userManagementInternal(registry) {
-    return getUserManagementInternal(registry.getSingleton('user-management'));
+function userManagementInternal(registry) {
+    return (0, system_1.getUserManagementInternal)(registry.getSingleton('user-management'));
 }
-export function createSessionBacking(sessions, lifetimes) {
+function createSessionBacking(sessions, lifetimes) {
     return {
         open: async (input) => {
             const { session, refreshToken } = await sessions.create({
@@ -37,7 +43,7 @@ export function createSessionBacking(sessions, lifetimes) {
     };
 }
 /** The session backing behind `registry`'s user-management, or `null` while it is not up. */
-export function sessionBackingFrom(registry, lifetimes) {
+function sessionBackingFrom(registry, lifetimes) {
     return () => {
         const internal = userManagementInternal(registry);
         return internal === null ? null : createSessionBacking(internal.sessions, lifetimes);
@@ -50,7 +56,7 @@ export function sessionBackingFrom(registry, lifetimes) {
  * release unless it was issued before the user's cutoff (logout everywhere,
  * a password change, deletion).
  */
-export function createSessionTokenCheck(registry) {
+function createSessionTokenCheck(registry) {
     return (payload) => {
         const internal = userManagementInternal(registry);
         if (internal === null)

package/dist/auth/native-link-completions.js

@@ -1,3 +1,6 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NativeLinkCompletions = exports.NATIVE_LINK_CODE_TTL_MS = exports.NATIVE_LINK_CODE_PREFIX = void 0;
 /**
  * Native-app account links waiting for the app to claim them (D801).
  *
@@ -14,20 +17,20 @@
  * outcome, and the store is bounded. In memory: a hub restart mid-link costs
  * one more tap.
  */
-import { createHash, randomBytes } from 'node:crypto';
-export const NATIVE_LINK_CODE_PREFIX = 'nlc_';
-export const NATIVE_LINK_CODE_TTL_MS = 60_000;
+const node_crypto_1 = require("node:crypto");
+exports.NATIVE_LINK_CODE_PREFIX = 'nlc_';
+exports.NATIVE_LINK_CODE_TTL_MS = 60_000;
 const MAX_PENDING = 1_000;
 function hash(code) {
-    return createHash('sha256').update(code).digest('hex');
+    return (0, node_crypto_1.createHash)('sha256').update(code).digest('hex');
 }
-export class NativeLinkCompletions {
+class NativeLinkCompletions {
     pending = new Map();
     now;
     ttlMs;
     constructor(opts = {}) {
         this.now = opts.now ?? Date.now;
-        this.ttlMs = opts.ttlMs ?? NATIVE_LINK_CODE_TTL_MS;
+        this.ttlMs = opts.ttlMs ?? exports.NATIVE_LINK_CODE_TTL_MS;
     }
     /** Park a verified link; returns the raw one-time code. */
     park(link) {
@@ -38,7 +41,7 @@ export class NativeLinkCompletions {
                 break;
             this.pending.delete(oldest.value);
         }
-        const code = `${NATIVE_LINK_CODE_PREFIX}${randomBytes(32).toString('base64url')}`;
+        const code = `${exports.NATIVE_LINK_CODE_PREFIX}${(0, node_crypto_1.randomBytes)(32).toString('base64url')}`;
         this.pending.set(hash(code), { ...link, expiresAt: this.now() + this.ttlMs });
         return code;
     }
@@ -62,3 +65,4 @@ export class NativeLinkCompletions {
         }
     }
 }
+exports.NativeLinkCompletions = NativeLinkCompletions;

package/dist/auth/native-return.js

@@ -1,3 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ssoReturnLocation = ssoReturnLocation;
+exports.browserHandoffLocation = browserHandoffLocation;
 /**
  * Where the hub's auth routes send a browser, as `Location` values (D801).
  *
@@ -7,23 +11,23 @@
  *    and must never be prefixed;
  *  - a browser handoff lands on the account page and nowhere else.
  */
-import { hasUrlScheme } from '@camstack/types';
-import { SSO_LOGIN_PATH, SSO_PROFILE_PATH, sessionFragmentParams } from './sso-finish.js';
-export function ssoReturnLocation(mount, location) {
-    return hasUrlScheme(location) ? location : `${mount}${location}`;
+const types_1 = require("@camstack/types");
+const sso_finish_js_1 = require("./sso-finish.js");
+function ssoReturnLocation(mount, location) {
+    return (0, types_1.hasUrlScheme)(location) ? location : `${mount}${location}`;
 }
 /**
  * The account page, signed in by a session in the FRAGMENT that admin-ui's
  * auth boot consumes (`#token=…&next=…`, as an SSO login return). Without a
  * session — unknown, used or expired code — the plain login page.
  */
-export function browserHandoffLocation(mount, session) {
+function browserHandoffLocation(mount, session) {
     if (session === null)
-        return `${mount}${SSO_LOGIN_PATH}`;
+        return `${mount}${sso_finish_js_1.SSO_LOGIN_PATH}`;
     const fragment = new URLSearchParams({
-        ...sessionFragmentParams(session),
-        next: SSO_PROFILE_PATH,
+        ...(0, sso_finish_js_1.sessionFragmentParams)(session),
+        next: sso_finish_js_1.SSO_PROFILE_PATH,
         provider: 'browser-handoff',
     });
-    return `${mount}${SSO_LOGIN_PATH}#${fragment.toString()}`;
+    return `${mount}${sso_finish_js_1.SSO_LOGIN_PATH}#${fragment.toString()}`;
 }

package/dist/auth/passkey-provider.js

@@ -1,5 +1,11 @@
-import { PasskeySummarySchema } from '@camstack/types';
-import { z } from 'zod';
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SetSecondFactorPreferenceSchema = exports.SecondFactorPreferenceSchema = exports.RemovePasskeySchema = exports.FinishDiscoverableAuthenticationSchema = exports.FinishAuthenticationSchema = exports.FinishRegistrationSchema = exports.OptionsJsonSchema = void 0;
+exports.resolvePasskeyProvider = resolvePasskeyProvider;
+exports.userHasPasskey = userHasPasskey;
+exports.passkeySecondFactorOptedIn = passkeySecondFactorOptedIn;
+const types_1 = require("@camstack/types");
+const zod_1 = require("zod");
 // ── Passkey (user-passkeys cap) resolution ───────────────────────────
 //
 // Cap-agnostic: the passkey provider is resolved through the
@@ -12,19 +18,19 @@ import { z } from 'zod';
 // The proxy is loosely typed (`Record<method, (params)=>Promise<unknown>>`);
 // its outputs are narrowed through the cap's own Zod schemas rather than
 // cast to the provider type (repo rule: no `as` on cross-boundary values).
-export const OptionsJsonSchema = z.object({ optionsJSON: z.record(z.string(), z.unknown()) });
-export const FinishRegistrationSchema = z.object({
-    success: z.literal(true),
-    credentialId: z.string(),
+exports.OptionsJsonSchema = zod_1.z.object({ optionsJSON: zod_1.z.record(zod_1.z.string(), zod_1.z.unknown()) });
+exports.FinishRegistrationSchema = zod_1.z.object({
+    success: zod_1.z.literal(true),
+    credentialId: zod_1.z.string(),
 });
-export const FinishAuthenticationSchema = z.object({ verified: z.boolean() });
-export const FinishDiscoverableAuthenticationSchema = z.object({
-    verified: z.boolean(),
-    userId: z.string().nullable(),
+exports.FinishAuthenticationSchema = zod_1.z.object({ verified: zod_1.z.boolean() });
+exports.FinishDiscoverableAuthenticationSchema = zod_1.z.object({
+    verified: zod_1.z.boolean(),
+    userId: zod_1.z.string().nullable(),
 });
-export const RemovePasskeySchema = z.object({ success: z.literal(true) });
-export const SecondFactorPreferenceSchema = z.object({ enabled: z.boolean() });
-export const SetSecondFactorPreferenceSchema = z.object({ success: z.literal(true) });
+exports.RemovePasskeySchema = zod_1.z.object({ success: zod_1.z.literal(true) });
+exports.SecondFactorPreferenceSchema = zod_1.z.object({ enabled: zod_1.z.boolean() });
+exports.SetSecondFactorPreferenceSchema = zod_1.z.object({ success: zod_1.z.literal(true) });
 function proxyPasskeyProvider(proxy) {
     const call = async (method, params) => {
         const fn = proxy[method];
@@ -33,19 +39,19 @@ function proxyPasskeyProvider(proxy) {
         return fn(params);
     };
     return {
-        beginRegistration: async (input) => OptionsJsonSchema.parse(await call('beginRegistration', input)),
-        finishRegistration: async (input) => FinishRegistrationSchema.parse(await call('finishRegistration', input)),
-        beginAuthentication: async (input) => OptionsJsonSchema.parse(await call('beginAuthentication', input)),
-        finishAuthentication: async (input) => FinishAuthenticationSchema.parse(await call('finishAuthentication', input)),
-        beginDiscoverableAuthentication: async (input) => OptionsJsonSchema.parse(await call('beginDiscoverableAuthentication', input)),
-        finishDiscoverableAuthentication: async (input) => FinishDiscoverableAuthenticationSchema.parse(await call('finishDiscoverableAuthentication', input)),
-        listPasskeys: async (input) => z.array(PasskeySummarySchema).parse(await call('listPasskeys', input)),
-        removePasskey: async (input) => RemovePasskeySchema.parse(await call('removePasskey', input)),
-        getSecondFactorPreference: async (input) => SecondFactorPreferenceSchema.parse(await call('getSecondFactorPreference', input)),
-        setSecondFactorPreference: async (input) => SetSecondFactorPreferenceSchema.parse(await call('setSecondFactorPreference', input)),
+        beginRegistration: async (input) => exports.OptionsJsonSchema.parse(await call('beginRegistration', input)),
+        finishRegistration: async (input) => exports.FinishRegistrationSchema.parse(await call('finishRegistration', input)),
+        beginAuthentication: async (input) => exports.OptionsJsonSchema.parse(await call('beginAuthentication', input)),
+        finishAuthentication: async (input) => exports.FinishAuthenticationSchema.parse(await call('finishAuthentication', input)),
+        beginDiscoverableAuthentication: async (input) => exports.OptionsJsonSchema.parse(await call('beginDiscoverableAuthentication', input)),
+        finishDiscoverableAuthentication: async (input) => exports.FinishDiscoverableAuthenticationSchema.parse(await call('finishDiscoverableAuthentication', input)),
+        listPasskeys: async (input) => zod_1.z.array(types_1.PasskeySummarySchema).parse(await call('listPasskeys', input)),
+        removePasskey: async (input) => exports.RemovePasskeySchema.parse(await call('removePasskey', input)),
+        getSecondFactorPreference: async (input) => exports.SecondFactorPreferenceSchema.parse(await call('getSecondFactorPreference', input)),
+        setSecondFactorPreference: async (input) => exports.SetSecondFactorPreferenceSchema.parse(await call('setSecondFactorPreference', input)),
     };
 }
-export function resolvePasskeyProvider(registry, moleculer) {
+function resolvePasskeyProvider(registry, moleculer) {
     const local = registry?.getCollection('user-passkeys')?.[0] ?? null;
     if (local)
         return local;
@@ -57,7 +63,7 @@ export function resolvePasskeyProvider(registry, moleculer) {
  * missing provider or a transport hiccup degrades to `false` so the
  * login flow is never blocked by passkey introspection.
  */
-export async function userHasPasskey(userId, provider) {
+async function userHasPasskey(userId, provider) {
     if (!provider)
         return false;
     try {
@@ -77,7 +83,7 @@ export async function userHasPasskey(userId, provider) {
  * hiccup all read as `false` so the preference lookup can never lock a
  * user out of the password flow.
  */
-export async function passkeySecondFactorOptedIn(userId, provider) {
+async function passkeySecondFactorOptedIn(userId, provider) {
     if (!provider || typeof provider.getSecondFactorPreference !== 'function')
         return false;
     try {

package/dist/auth/second-factors.js

@@ -1,15 +1,19 @@
-import { z } from 'zod';
-import { passkeySecondFactorOptedIn, userHasPasskey } from './passkey-provider.js';
-export const SecondFactorSchema = z.enum(['totp', 'passkey']);
-export async function collectSecondFactors(deps, userId, primary) {
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SecondFactorSchema = void 0;
+exports.collectSecondFactors = collectSecondFactors;
+const zod_1 = require("zod");
+const passkey_provider_js_1 = require("./passkey-provider.js");
+exports.SecondFactorSchema = zod_1.z.enum(['totp', 'passkey']);
+async function collectSecondFactors(deps, userId, primary) {
     const totpStatus = deps.getTotpStatus ? await deps.getTotpStatus({ userId }) : { enabled: false };
     const factors = [];
     if (totpStatus.enabled)
         factors.push('totp');
     if (primary !== 'passkey') {
         const provider = deps.passkeyProvider();
-        const enrolled = await userHasPasskey(userId, provider);
-        if (enrolled && (await passkeySecondFactorOptedIn(userId, provider))) {
+        const enrolled = await (0, passkey_provider_js_1.userHasPasskey)(userId, provider);
+        if (enrolled && (await (0, passkey_provider_js_1.passkeySecondFactorOptedIn)(userId, provider))) {
             factors.push('passkey');
         }
     }

package/dist/auth/session-connections.js

@@ -1,3 +1,4 @@
+"use strict";
 /**
  * What a login session still HOLDS on the hub — its open WebSockets and its
  * live media sessions — so that revoking the session ends them.
@@ -15,12 +16,16 @@
  *   the session (the WebRTC `closeSession`); recorded playback rides the same
  *   cap, so the same hold covers it.
  */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SessionConnections = exports.SESSION_ENDED_CLOSE_REASON = exports.SESSION_ENDED_CLOSE_CODE = void 0;
+exports.getSessionConnections = getSessionConnections;
+exports.__resetSessionConnectionsForTests = __resetSessionConnectionsForTests;
 /** WebSocket close code a client recognises as "the hub ended this session". */
-export const SESSION_ENDED_CLOSE_CODE = 4401;
-export const SESSION_ENDED_CLOSE_REASON = 'session-ended';
+exports.SESSION_ENDED_CLOSE_CODE = 4401;
+exports.SESSION_ENDED_CLOSE_REASON = 'session-ended';
 /** Bound on live media holds kept per login session (oldest dropped past it). */
 const MAX_MEDIA_HOLDS_PER_SESSION = 256;
-export class SessionConnections {
+class SessionConnections {
     sockets = new Set();
     media = new Map();
     logger = null;
@@ -72,7 +77,7 @@ export class SessionConnections {
                 continue;
             this.sockets.delete(tracked);
             try {
-                tracked.socket.close(SESSION_ENDED_CLOSE_CODE, SESSION_ENDED_CLOSE_REASON);
+                tracked.socket.close(exports.SESSION_ENDED_CLOSE_CODE, exports.SESSION_ENDED_CLOSE_REASON);
                 sockets += 1;
             }
             catch (error) {
@@ -118,13 +123,14 @@ export class SessionConnections {
         }
     }
 }
+exports.SessionConnections = SessionConnections;
 let instance = null;
 /** The process-wide registry (the WS factory, the WebRTC wrapper and the revoke listener share it). */
-export function getSessionConnections() {
+function getSessionConnections() {
     instance ??= new SessionConnections();
     return instance;
 }
 /** Test-only. */
-export function __resetSessionConnectionsForTests() {
+function __resetSessionConnectionsForTests() {
     instance = null;
 }

package/dist/auth/session-cookie.js

@@ -1,10 +1,21 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SESSION_COOKIE = void 0;
+exports.buildSessionCookie = buildSessionCookie;
+exports.clearSessionCookie = clearSessionCookie;
+exports.readSessionCookieFromHeader = readSessionCookieFromHeader;
+exports.shouldRedirectToLogin = shouldRedirectToLogin;
+exports.loginRedirectUrl = loginRedirectUrl;
+exports.isEmbedRedirectTarget = isEmbedRedirectTarget;
+exports.isSessionGradeJwtPayload = isSessionGradeJwtPayload;
+exports.sessionCookieIsSecure = sessionCookieIsSecure;
 /** Browser session cookie carrying the hub JWT. Set by POST /api/auth/session
  *  after a tRPC login; read by the addon-route catch-all for `authenticated`
  *  routes hit by a plain browser navigation. */
-export const SESSION_COOKIE = 'camstack_session';
-export function buildSessionCookie(token, ttlSec, opts = {}) {
+exports.SESSION_COOKIE = 'camstack_session';
+function buildSessionCookie(token, ttlSec, opts = {}) {
     return {
-        name: SESSION_COOKIE,
+        name: exports.SESSION_COOKIE,
         value: token,
         options: {
             httpOnly: true,
@@ -17,9 +28,9 @@ export function buildSessionCookie(token, ttlSec, opts = {}) {
         },
     };
 }
-export function clearSessionCookie(opts = {}) {
+function clearSessionCookie(opts = {}) {
     return {
-        name: SESSION_COOKIE,
+        name: exports.SESSION_COOKIE,
         value: '',
         options: { httpOnly: true, sameSite: 'lax', secure: opts.secure ?? true, path: '/', maxAge: 0 },
     };
@@ -30,7 +41,7 @@ export function clearSessionCookie(opts = {}) {
  * so callers don't depend on `@fastify/cookie` decoration order. Returns
  * `null` when the header is absent or carries no `camstack_session` pair.
  */
-export function readSessionCookieFromHeader(header) {
+function readSessionCookieFromHeader(header) {
     if (!header)
         return null;
     for (const pair of header.split(';')) {
@@ -38,7 +49,7 @@ export function readSessionCookieFromHeader(header) {
         if (eq === -1)
             continue;
         const name = pair.slice(0, eq).trim();
-        if (name !== SESSION_COOKIE)
+        if (name !== exports.SESSION_COOKIE)
             continue;
         const raw = pair.slice(eq + 1).trim();
         if (raw === '')
@@ -55,7 +66,7 @@ export function readSessionCookieFromHeader(header) {
 /** A browser navigation we can bounce to the login page: a top-level GET
  *  that wants HTML. Anything else (API call, POST, non-HTML) keeps the
  *  401 behavior so programmatic clients get a clean error. */
-export function shouldRedirectToLogin(method, accept) {
+function shouldRedirectToLogin(method, accept) {
     return method === 'GET' && typeof accept === 'string' && accept.includes('text/html');
 }
 /**
@@ -67,14 +78,14 @@ export function shouldRedirectToLogin(method, accept) {
  * the SPA re-mounts it itself (`hubPath`) — so one value serves both the
  * relayed and the direct case.
  */
-export function loginRedirectUrl(originalUrl, mountPrefix = null) {
+function loginRedirectUrl(originalUrl, mountPrefix = null) {
     return `${mountPrefix ?? ''}/login?next=${encodeURIComponent(originalUrl)}`;
 }
 /** Allowed redirect target for `GET /api/embed-auth`: a same-origin RELATIVE
  *  path to a stream-broker embed page. Defeats open-redirects — the endpoint
  *  sets the session cookie from a Bearer token, so the `next` must be safe to
  *  bounce to. Rejects absolute/protocol-relative URLs, backslashes, and `..`. */
-export function isEmbedRedirectTarget(next) {
+function isEmbedRedirectTarget(next) {
     if (!next.startsWith('/addon/stream-broker/embed/'))
         return false;
     if (next.includes('\\') || next.includes('://') || next.includes('..'))
@@ -89,7 +100,7 @@ export function isEmbedRedirectTarget(next) {
  * password-only attacker skip the second factor on every cookie-gated
  * surface. Shared by `POST /api/auth/session` and `auth.exchangeSession`.
  */
-export function isSessionGradeJwtPayload(payload) {
+function isSessionGradeJwtPayload(payload) {
     if (payload === null || typeof payload !== 'object')
         return false;
     const p = payload;
@@ -121,7 +132,7 @@ export function isSessionGradeJwtPayload(payload) {
  *    which is set by the proxy and by nothing else on a direct browser hit. A
  *    direct caller inventing the proto header alone changes nothing.
  */
-export function sessionCookieIsSecure(requestProtocol, headers, forwardedPrefixHeader) {
+function sessionCookieIsSecure(requestProtocol, headers, forwardedPrefixHeader) {
     const secureLeg = requestProtocol === 'https';
     if (!secureLeg)
         return false;

package/dist/auth/session-lifetimes.js

@@ -1,3 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_ACCESS_TOKEN_EXPIRY = exports.SESSION_LIFETIME_KEY = exports.ACCESS_TOKEN_EXPIRY_KEY = void 0;
+exports.readSessionLifetimes = readSessionLifetimes;
 /**
  * The two lifetimes of a login (System → Authentication):
  *
@@ -11,10 +15,10 @@
  * applies to the next login or refresh. A value that does not parse falls
  * back to the default — never to something longer.
  */
-import { parseTokenExpiry } from '@camstack/system';
-export const ACCESS_TOKEN_EXPIRY_KEY = 'auth.accessTokenExpiry';
-export const SESSION_LIFETIME_KEY = 'auth.tokenExpiry';
-export const DEFAULT_ACCESS_TOKEN_EXPIRY = '2h';
+const system_1 = require("@camstack/system");
+exports.ACCESS_TOKEN_EXPIRY_KEY = 'auth.accessTokenExpiry';
+exports.SESSION_LIFETIME_KEY = 'auth.tokenExpiry';
+exports.DEFAULT_ACCESS_TOKEN_EXPIRY = '2h';
 const DEFAULT_ACCESS_SEC = 2 * 3600;
 const MIN_ACCESS_SEC = 5 * 60;
 const MAX_ACCESS_SEC = 24 * 3600;
@@ -26,12 +30,12 @@ function safeRead(read, key) {
         return undefined;
     }
 }
-export function readSessionLifetimes(read) {
-    const session = parseTokenExpiry(safeRead(read, SESSION_LIFETIME_KEY));
-    const configuredAccess = safeRead(read, ACCESS_TOKEN_EXPIRY_KEY);
+function readSessionLifetimes(read) {
+    const session = (0, system_1.parseTokenExpiry)(safeRead(read, exports.SESSION_LIFETIME_KEY));
+    const configuredAccess = safeRead(read, exports.ACCESS_TOKEN_EXPIRY_KEY);
     const access = configuredAccess === undefined || configuredAccess === null || configuredAccess === ''
         ? null
-        : parseTokenExpiry(configuredAccess);
+        : (0, system_1.parseTokenExpiry)(configuredAccess);
     const accessSec = access !== null && access.ok
         ? Math.min(MAX_ACCESS_SEC, Math.max(MIN_ACCESS_SEC, access.seconds))
         : DEFAULT_ACCESS_SEC;

package/dist/auth/session-mint.js

@@ -1,5 +1,9 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SessionRefreshRefusedError = exports.SessionDirectoryUnavailableError = exports.SessionUserGoneError = void 0;
+exports.createSessionMinter = createSessionMinter;
 /** The user a credential names is not in `user-management` (deleted, or never existed). */
-export class SessionUserGoneError extends Error {
+class SessionUserGoneError extends Error {
     userId;
     constructor(userId) {
         super('User no longer exists');
@@ -7,15 +11,17 @@ export class SessionUserGoneError extends Error {
         this.name = 'SessionUserGoneError';
     }
 }
+exports.SessionUserGoneError = SessionUserGoneError;
 /** `user-management` is not registered: an infrastructure failure, never a 401. */
-export class SessionDirectoryUnavailableError extends Error {
+class SessionDirectoryUnavailableError extends Error {
     constructor() {
         super('Login unavailable — `user-management` capability not registered');
         this.name = 'SessionDirectoryUnavailableError';
     }
 }
+exports.SessionDirectoryUnavailableError = SessionDirectoryUnavailableError;
 /** A refresh token that does not continue a live session. */
-export class SessionRefreshRefusedError extends Error {
+class SessionRefreshRefusedError extends Error {
     reason;
     constructor(reason) {
         super('Session expired — sign in again');
@@ -23,7 +29,8 @@ export class SessionRefreshRefusedError extends Error {
         this.name = 'SessionRefreshRefusedError';
     }
 }
-export function createSessionMinter(deps) {
+exports.SessionRefreshRefusedError = SessionRefreshRefusedError;
+function createSessionMinter(deps) {
     const findUserOrNull = async (userId) => {
         const directory = deps.directory();
         if (!directory)