@camstack/system 1.2.115 → 1.2.117

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-iAwSA2_f.js");
+const require_dist = require("../../dist-DMEGlqg6.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { Gt as EventCategory, v as addonPagesCapability, vt as errMsg, yt as BaseAddon } from "../../dist-Drb54SZD.mjs";
+import { Gt as EventCategory, v as addonPagesCapability, vt as errMsg, yt as BaseAddon } from "../../dist-D4Vmj8iw.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import * as path$1 from "node:path";

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-iAwSA2_f.js");
+const require_dist = require("../../dist-DMEGlqg6.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { Gt as EventCategory, b as addonWidgetsCapability, vt as errMsg, yt as BaseAddon } from "../../dist-Drb54SZD.mjs";
+import { Gt as EventCategory, b as addonWidgetsCapability, vt as errMsg, yt as BaseAddon } from "../../dist-D4Vmj8iw.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import * as path$1 from "node:path";

package/dist/builtins/alerts/alerts.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-iAwSA2_f.js");
+const require_dist = require("../../dist-DMEGlqg6.js");
 //#region src/builtins/alerts/prune-policy.ts
 /**
 * Ids older than `cutoffMs`, oldest first.

package/dist/builtins/alerts/alerts.addon.mjs

@@ -1,4 +1,4 @@
-import { Gt as EventCategory, Mt as createEvent, n as AlertSchema, vt as errMsg, x as alertsCapability, yt as BaseAddon } from "../../dist-Drb54SZD.mjs";
+import { Gt as EventCategory, Mt as createEvent, n as AlertSchema, vt as errMsg, x as alertsCapability, yt as BaseAddon } from "../../dist-D4Vmj8iw.mjs";
 //#region src/builtins/alerts/prune-policy.ts
 /**
 * Ids older than `cutoffMs`, oldest first.

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-iAwSA2_f.js");
+const require_dist = require("../../dist-DMEGlqg6.js");
 let node_crypto = require("node:crypto");
 let buffer = require("buffer");
 let node_fs_promises = require("node:fs/promises");

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { C as backupCapability, Gt as EventCategory, yt as BaseAddon } from "../../dist-Drb54SZD.mjs";
+import { C as backupCapability, Gt as EventCategory, yt as BaseAddon } from "../../dist-D4Vmj8iw.mjs";
 import { randomBytes, randomUUID } from "node:crypto";
 import { Buffer as Buffer$1 } from "buffer";
 import * as fsp from "node:fs/promises";

package/dist/builtins/console-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-iAwSA2_f.js");
+const require_dist = require("../../dist-DMEGlqg6.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/console-logging/index.mjs

@@ -1,4 +1,4 @@
-import { X as logDestinationCapability, yt as BaseAddon } from "../../dist-Drb54SZD.mjs";
+import { X as logDestinationCapability, yt as BaseAddon } from "../../dist-D4Vmj8iw.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/core-blocks/core-blocks.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-iAwSA2_f.js");
+const require_dist = require("../../dist-DMEGlqg6.js");
 let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 node_fs_promises = require_chunk.__toESM(node_fs_promises);

package/dist/builtins/core-blocks/core-blocks.addon.mjs

@@ -1,4 +1,4 @@
-import { D as coreBlockAddonId, O as coreBlockIdFromAddonId, c as CoreBlockSchema, k as coreBlocksCapability, l as DeclaredDevices, o as CORE_BLOCKS_ADDON_ID, s as CORE_BLOCK_ADDON_PREFIX, vt as errMsg, yt as BaseAddon } from "../../dist-Drb54SZD.mjs";
+import { D as coreBlockAddonId, O as coreBlockIdFromAddonId, c as CoreBlockSchema, k as coreBlocksCapability, l as DeclaredDevices, o as CORE_BLOCKS_ADDON_ID, s as CORE_BLOCK_ADDON_PREFIX, vt as errMsg, yt as BaseAddon } from "../../dist-D4Vmj8iw.mjs";
 import { randomUUID } from "node:crypto";
 import * as fs from "node:fs/promises";
 import * as path$1 from "node:path";

package/dist/builtins/device-manager/device-manager.addon.js

@@ -3,8 +3,8 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-iAwSA2_f.js");
-const require_retired_settings_keys = require("../../retired-settings-keys-OfhqQio4.js");
+const require_dist = require("../../dist-DMEGlqg6.js");
+const require_retired_settings_keys = require("../../retired-settings-keys-DET4YkAU.js");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");
 //#region src/builtins/device-manager/adoption-job-engine.ts

package/dist/builtins/device-manager/device-manager.addon.mjs

@@ -1,5 +1,5 @@
-import { Ct as DeviceFeature, E as buildStreamParamsConfigSchema, F as deviceStatusCapability, Gt as EventCategory, Lt as isDeviceConfigCap, N as deviceManagerCapability, Ot as WELL_KNOWN_TAB_MAP, P as deviceStateCapability, R as enumerateItemArrayFields, Tt as DeviceType, Wt as sleep, a as CAP_NAMES_WITH_STATUS, at as runtimeStatePolicyFor, et as normalizeUnit, nt as parseStreamParamsFormPatch, p as STREAM_PROFILE_META, t as ALL_CAPABILITY_DEFINITIONS, u as DeviceStatusSchema, vt as errMsg, wt as DeviceRole, yt as BaseAddon, z as enumerateSchemaFields } from "../../dist-Drb54SZD.mjs";
-import { n as purgeRetiredSettingsRows } from "../../retired-settings-keys-Dz5-7gjt.mjs";
+import { Ct as DeviceFeature, E as buildStreamParamsConfigSchema, F as deviceStatusCapability, Gt as EventCategory, Lt as isDeviceConfigCap, N as deviceManagerCapability, Ot as WELL_KNOWN_TAB_MAP, P as deviceStateCapability, R as enumerateItemArrayFields, Tt as DeviceType, Wt as sleep, a as CAP_NAMES_WITH_STATUS, at as runtimeStatePolicyFor, et as normalizeUnit, nt as parseStreamParamsFormPatch, p as STREAM_PROFILE_META, t as ALL_CAPABILITY_DEFINITIONS, u as DeviceStatusSchema, vt as errMsg, wt as DeviceRole, yt as BaseAddon, z as enumerateSchemaFields } from "../../dist-D4Vmj8iw.mjs";
+import { n as purgeRetiredSettingsRows } from "../../retired-settings-keys--aM_vGF9.mjs";
 import { randomUUID } from "node:crypto";
 import { canonicalDeviceFingerprint } from "@camstack/types/node";
 //#region src/builtins/device-manager/adoption-job-engine.ts

package/dist/builtins/doorbell/virtual-doorbell.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-iAwSA2_f.js");
+const require_dist = require("../../dist-DMEGlqg6.js");
 //#region src/builtins/doorbell/trigger-engine.ts
 /**
 * Pure trigger logic for the virtual-doorbell builtin — edge detection over

package/dist/builtins/doorbell/virtual-doorbell.addon.mjs

@@ -1,4 +1,4 @@
-import { G as isSameAddonId, Gt as EventCategory, I as doorbellCapability, Mt as createEvent, Tt as DeviceType, vt as errMsg, w as bareAddonId, yt as BaseAddon } from "../../dist-Drb54SZD.mjs";
+import { G as isSameAddonId, Gt as EventCategory, I as doorbellCapability, Mt as createEvent, Tt as DeviceType, vt as errMsg, w as bareAddonId, yt as BaseAddon } from "../../dist-D4Vmj8iw.mjs";
 //#region src/builtins/doorbell/trigger-engine.ts
 /**
 * Pure trigger logic for the virtual-doorbell builtin — edge detection over

package/dist/builtins/hub-forwarder/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-iAwSA2_f.js");
+const require_dist = require("../../dist-DMEGlqg6.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/hub-forwarder/index.mjs

@@ -1,4 +1,4 @@
-import { X as logDestinationCapability, yt as BaseAddon } from "../../dist-Drb54SZD.mjs";
+import { X as logDestinationCapability, yt as BaseAddon } from "../../dist-D4Vmj8iw.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/liveness-monitor/liveness-monitor.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-iAwSA2_f.js");
+const require_dist = require("../../dist-DMEGlqg6.js");
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/liveness-monitor/liveness-monitor.addon.mjs

@@ -1,4 +1,4 @@
-import { Gt as EventCategory, Mt as createEvent, vt as errMsg, yt as BaseAddon } from "../../dist-Drb54SZD.mjs";
+import { Gt as EventCategory, Mt as createEvent, vt as errMsg, yt as BaseAddon } from "../../dist-D4Vmj8iw.mjs";
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/local-auth/local-auth.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-iAwSA2_f.js");
+const require_dist = require("../../dist-DMEGlqg6.js");
 let node_crypto = require("node:crypto");
 node_crypto = require_chunk.__toESM(node_crypto);
 let crypto$1 = require("crypto");

package/dist/builtins/local-auth/local-auth.addon.mjs

@@ -1,5 +1,5 @@
 import { i as __require, o as __toESM, t as __commonJSMin } from "../../chunk-CNf5ZN-e.mjs";
-import { S as authProviderCapability, _ as UserRecordSchema, ht as userManagementCapability, m as ScopedTokenSchema, r as ApiKeyRecordSchema, yt as BaseAddon } from "../../dist-Drb54SZD.mjs";
+import { S as authProviderCapability, _ as UserRecordSchema, ht as userManagementCapability, m as ScopedTokenSchema, r as ApiKeyRecordSchema, yt as BaseAddon } from "../../dist-D4Vmj8iw.mjs";
 import * as crypto$2 from "node:crypto";
 import { createHash, randomUUID, timingSafeEqual } from "node:crypto";
 import nodeCrypto from "crypto";

package/dist/builtins/local-network/ipv6-lan.d.ts

@@ -0,0 +1,26 @@
+/**
+ * IPv6 helpers for LAN advertisement: prefix matching (privacy addresses
+ * rotate inside a /64), Linux `/proc/net/if_inet6` flags, and the gate
+ * that keeps temporary GUA off the connection candidate list.
+ */
+/** First 64 bits, canonical hex groups, or null if the address is not IPv6. */
+export declare function ipv6Prefix64Key(address: string): string | null;
+/** 32-char lowercase hex (same encoding as `/proc/net/if_inet6`). */
+export declare function ipv6ToHex32(address: string): string | null;
+/**
+ * Parse Linux `if_inet6` into hex32 → flags. Unknown / malformed lines
+ * are skipped. Keys match {@link ipv6ToHex32}.
+ */
+export declare function parseProcIfInet6(text: string): ReadonlyMap<string, number>;
+/**
+ * Whether this IPv6 should be auto-seeded / advertised.
+ * `flags === undefined` means the platform did not tell us (macOS, tests
+ * without a proc snapshot) — keep every non-link-local plausible address.
+ *
+ * On Linux, drop addresses marked TEMPORARY / DEPRECATED / TENTATIVE, and
+ * `flags === 0` which is how this kernel reports RFC 4941 privacy temps
+ * (the stable GUA is PERMANENT|NODAD). Do **not** require PERMANENT —
+ * stateful DHCPv6 GUA often has only NODAD (0x02).
+ */
+export declare function shouldAdvertiseIpv6(address: string, flags: number | undefined): boolean;
+export declare function ipv6AllowlistMatches(address: string, allowed: readonly string[]): boolean;

package/dist/builtins/local-network/local-hostname.d.ts

@@ -0,0 +1,15 @@
+export type ParseLocalHostnameResult = {
+    readonly ok: true;
+    readonly value: string | null;
+} | {
+    readonly ok: false;
+    readonly error: string;
+};
+/**
+ * Parse the operator-typed local hostname.
+ *
+ * Empty / whitespace → `null` (advertise the raw LAN IP). A DNS name is
+ * lowercased. A URL, port suffix, path, or bare IP is rejected so it cannot
+ * leak into a SAN or a candidate URL.
+ */
+export declare function parseLocalHostname(raw: string): ParseLocalHostnameResult;

package/dist/builtins/local-network/local-network.addon.d.ts

@@ -10,6 +10,8 @@ interface MeshEndpointCache {
     /** Hub HTTPS port the mesh endpoint targets. */
     readonly port: number;
 }
+/** Drop rotated IPv6 / dead extras from the persisted allowlist. */
+export declare const ALLOWLIST_RECONCILE_INTERVAL_MS: number;
 /** The three places a hub listen port can be learned, most authoritative first. */
 export interface ListenPortSources {
     /** `server.port` from the hub's live config section; null when unreadable. */
@@ -37,9 +39,17 @@ interface LocalNetworkConfig {
      * different address after a reboot.
      */
     readonly notificationBaseUrl: string;
+    /** LAN HTTP listener. Default true — native apps skip the private cert. */
+    readonly httpEnabled: boolean;
+    /** Dedicated HTTP port. Must not equal the HTTPS listen port. */
+    readonly httpPort: number;
+    /** Operator-declared DNS name advertised instead of the raw LAN IP. Empty = none. */
+    readonly localHostname: string;
 }
 export declare class LocalNetworkAddon extends BaseAddon<LocalNetworkConfig> {
     private pollTimer;
+    private allowlistTimer;
+    private allowlistReconcilePending;
     private lastSnapshotKey;
     /** Optional public hostname tracked from `NetworkTunnelStarted`/
      *  `Stopped` events on the bus. */
@@ -61,6 +71,8 @@ export declare class LocalNetworkAddon extends BaseAddon<LocalNetworkConfig> {
      */
     private resolveNotificationEndpoint;
     protected onInitialize(): Promise<ProviderRegistration[]>;
+    protected globalSettingsSchema(): import('@camstack/types').ConfigUISchema;
+    protected onConfigChanged(): Promise<void>;
     protected onShutdown(): Promise<void>;
     /**
      * Other hub addons (e.g. cloudflare-tunnel) signal the active public
@@ -86,6 +98,15 @@ export declare class LocalNetworkAddon extends BaseAddon<LocalNetworkConfig> {
      * not joined simply contributes nothing.
      */
     private reconcileMeshEndpoint;
+    private resolvedHttpPort;
+    private tlsDataDir;
+    private snapshotTls;
+    /**
+     * Bind or unbind the LAN HTTP sibling from the addon's own settings, and
+     * keep the leaf SAN in sync with `localHostname`. This is the settings
+     * side-effect path — there is no second persist API.
+     */
+    private applyLanAccessFromSettings;
     /**
      * The port this hub is actually listening on, plus the provenance of the
      * number. The boot loader merges the `CAMSTACK_PORT` env override into the
@@ -98,6 +119,11 @@ export declare class LocalNetworkAddon extends BaseAddon<LocalNetworkConfig> {
     /** `server.port` from the live config section, or null when unreadable. */
     private readConfiguredPort;
     private enumerate;
+    /**
+     * Replace rotated IPv6 and drop addresses that no longer exist, without
+     * clearing operator extras that are still live (docker/vpn opt-in).
+     */
+    private persistReconciledAllowlist;
     private detectChanges;
 }
 /**
@@ -125,12 +151,14 @@ interface OsNetworkInterfaceInfo {
     readonly internal: boolean;
     readonly mac: string;
 }
-export declare function enumerateOsInterfaces(ifaces: NodeJS.Dict<readonly OsNetworkInterfaceInfo[]>): readonly LocalInterface[];
+export declare function enumerateOsInterfaces(ifaces: NodeJS.Dict<readonly OsNetworkInterfaceInfo[]>, ipv6Flags?: ReadonlyMap<string, number>): readonly LocalInterface[];
 /**
  * Filter the interface list by the operator's allowlist. Empty
  * allowlist = no-op (every interface passes); otherwise only entries
- * whose `address` matches an allowlist entry remain. Loopback always
- * survives so the SDK keeps `127.0.0.1` as the last-resort fallback.
+ * whose `address` matches an allowlist entry remain. IPv6 matches the
+ * allowlisted /64 so a rotated privacy address does not hide the live
+ * GUA. Loopback always survives so the SDK keeps `127.0.0.1` as the
+ * last-resort fallback.
  */
 export declare function applyAllowlist(interfaces: readonly LocalInterface[], allowed: readonly string[]): readonly LocalInterface[];
 /**
@@ -140,37 +168,41 @@ export declare function applyAllowlist(interfaces: readonly LocalInterface[], al
 export declare function pickPreferred(interfaces: readonly LocalInterface[]): LocalInterface | null;
 /**
  * Build the ordered candidate URL list. Priority schema:
- *   0       — preferred LAN IPv4
- *   10+     — other LAN IPv4
+ *   0       — preferred LAN IPv4 (or local hostname)
+ *   10+     — other LAN IPv4 and stable LAN IPv6
  *   100     — public tunnel hostname (always HTTPS)
  *   150     — mesh endpoint (Tailscale MagicDNS / 100.x, always HTTPS)
- *   200+    — LAN IPv6
  *   1000    — loopback (last resort)
  *
  * The mesh endpoint ranks just below a true public funnel (a Funnel is
  * reachable by ANY client; the mesh needs the peer on the same tailnet)
- * but above the IPv6 / loopback fallbacks — giving remote, mesh-joined
- * clients a working candidate when no public tunnel is up.
+ * but above loopback. LAN IPv6 sits in the LAN band with IPv4 so a
+ * dual-stack client can win the race on IPv6 when it is faster.
  *
- * `scheme` controls LAN + loopback URLs. Browsers running over HTTPS
- * block `http://` candidates as mixed content, so callers loaded over
- * HTTPS should pass `scheme: 'https'` even when probing a LAN IP — the
- * hub's cert manager already issues a SAN-multi cert covering local
- * interfaces. The public tunnel + mesh endpoint always emit `https://`
- * (the tunnel edge / the hub itself terminates TLS).
+ * `scheme` controls loopback URLs and, when LAN HTTP is off, LAN URLs.
+ * When {@link LanHttpAdvertisement} is enabled and listening, LAN (and
+ * the local-hostname alias) switch to `http://…:httpPort` so a native
+ * client can skip the private certificate. Public tunnel + mesh always
+ * emit `https://`. Loopback stays on `scheme`/`port` — it is not a LAN
+ * candidate.
  */
-export declare function buildEndpoints(interfaces: readonly LocalInterface[], port: number, includeLoopback: boolean, ipv4Only: boolean, publicHostname: string, scheme?: 'http' | 'https', meshEndpoint?: MeshEndpointCache | null): ConnectionEndpoint[];
+export interface LanHttpAdvertisement {
+    readonly enabled: boolean;
+    readonly listening: boolean;
+    readonly httpPort: number;
+    readonly httpsPort: number;
+    readonly localHostname: string | null;
+}
+export declare function buildEndpoints(interfaces: readonly LocalInterface[], port: number, includeLoopback: boolean, ipv4Only: boolean, publicHostname: string, scheme?: 'http' | 'https', meshEndpoint?: MeshEndpointCache | null, lanHttp?: LanHttpAdvertisement | null): ConnectionEndpoint[];
 /**
  * First-boot heuristic: which addresses should the allowlist start
  * with? Includes LAN + Wi-Fi IPv4 addresses + plausible IPv6:
  *
  *   - **IPv4**: skip link-local (`169.254.*`), keep the rest.
  *   - **IPv6**: skip link-local (`fe80::*`), unspecified, and
- *     multicast. Keep ULAs (`fc00::/7` → `fc??:` / `fd??:`) and Global
- *     Unicast addresses (`2000::/3` → `2???`/`3???`). Privacy-extension
- *     temporary addresses get included by default; the operator can
- *     prune them from the Network Addresses tab if the rotating IPs
- *     become a nuisance.
+ *     multicast. Keep ULAs (`fc00::/7`) and Global Unicast (`2000::/3`).
+ *     Privacy-extension temporary addresses are skipped when Linux flags
+ *     mark them non-permanent (`plausible === false`).
  *
  * Skips docker/vpn/loopback/other entirely — those stay opt-in.
  */
@@ -195,4 +227,10 @@ export declare function isPlausibleAutoSeed(address: string, family: 'IPv4' | 'I
 export declare function classifyKind(name: string, address: string, internal: boolean): LocalInterface['kind'];
 /** Convert an IPv4/IPv6 netmask string to its prefix length (CIDR). */
 export declare function prefixLen(netmask: string): number;
-export {};
+/**
+ * Rewrite a persisted allowlist against the live interface set:
+ * current auto-seed (LAN/Wi-Fi, stable IPv6) plus still-live operator
+ * extras (docker/vpn). Empty stays empty — that is "unrestricted".
+ */
+export declare function reconcileAllowlist(current: readonly string[], interfaces: readonly LocalInterface[]): string[];
+export { ipv6Prefix64Key, parseProcIfInet6, shouldAdvertiseIpv6, } from './ipv6-lan.js';