@camstack/system 1.2.116 → 1.2.117

package/dist/{lan-http-bind-BDJm4d-K.mjs → lan-http-bind-jKrj6OjQ.mjs}

@@ -621,11 +621,15 @@ function readTlsAccessStatus(dataDir, restartRequired = false) {
 * Second HTTP listener that shares the hub's existing request handler.
 *
 * Fastify is one protocol per instance; HTTPS stays on :4443 and this
-* binds a plain `http.Server` that emits `request` onto the same
-* handler graph (tRPC, cookies, data-plane, static).
+* binds a plain `http.Server` that emits `request` AND `upgrade` onto the
+* same handler graph (tRPC HTTP, cookies, data-plane, static, tRPC WS).
+*
+* Forwarding only `request` is not enough: the viewer speaks tRPC exclusively
+* over WebSocket (`wsLink`). `/health` wins the LAN race, then `ws://…/trpc`
+* hangs because nobody handles the upgrade on this socket.
 */
 var DEFAULT_HTTP_PORT = 4480;
-var handler = null;
+var handlers = null;
 var server = null;
 var pending = null;
 var state = {
@@ -633,9 +637,21 @@ var state = {
 	error: null,
 	port: DEFAULT_HTTP_PORT
 };
+var boundRequestedHost = null;
 var DEFAULT_LAN_HTTP_PORT = DEFAULT_HTTP_PORT;
+/** Map "all IPv4" to dual-stack IPv6 (`::`, ipv6Only false) so IPv4 still works. */
+function allFamiliesListenHost(host) {
+	if (host === "0.0.0.0" || host === "*" || host === "") return {
+		host: "::",
+		ipv6Only: false
+	};
+	return {
+		host,
+		ipv6Only: false
+	};
+}
 function registerLanHttpHandler(next) {
-	handler = next;
+	handlers = next;
 }
 function readLanHttpState() {
 	return state;
@@ -651,7 +667,7 @@ async function applyLanHttp(options) {
 		};
 		return state;
 	}
-	if (handler === null) {
+	if (handlers === null) {
 		state = {
 			listening: false,
 			error: "HTTP listener is not registered yet",
@@ -659,14 +675,17 @@ async function applyLanHttp(options) {
 		};
 		return state;
 	}
-	if (server !== null && state.listening && state.port === options.port) return state;
+	if (server !== null && state.listening && (options.port === 0 || state.port === options.port) && boundRequestedHost === options.host) return state;
 	await closeLanHttp();
 	try {
-		server = await listenHttp(options.port, options.host, handler);
+		const bound = await listenHttp(options.port, options.host, handlers);
+		server = bound;
+		boundRequestedHost = options.host;
+		const addr = bound.address();
 		state = {
 			listening: true,
 			error: null,
-			port: options.port
+			port: typeof addr === "object" && addr !== null ? addr.port : options.port
 		};
 		return state;
 	} catch (err) {
@@ -691,16 +710,29 @@ async function bindPendingLanHttp() {
 async function closeLanHttp() {
 	const current = server;
 	server = null;
+	boundRequestedHost = null;
 	if (current === null) return;
 	await new Promise((resolve) => {
 		current.close(() => resolve());
 	});
 }
-function listenHttp(port, host, onRequest) {
+function listenHttp(port, host, next) {
+	const resolved = allFamiliesListenHost(host);
+	return listenOn(port, resolved, next).catch((err) => {
+		if (resolved.host === "::" && host !== "::") return listenOn(port, {
+			host: "0.0.0.0",
+			ipv6Only: false
+		}, next);
+		throw err;
+	});
+}
+function listenOn(port, bind, next) {
 	return new Promise((resolve, reject) => {
-		const created = createServer(onRequest);
+		const created = createServer(next.onRequest);
+		created.on("upgrade", next.onUpgrade);
 		const onError = (err) => {
 			created.off("listening", onListening);
+			created.close();
 			reject(err);
 		};
 		const onListening = () => {
@@ -709,8 +741,12 @@ function listenHttp(port, host, onRequest) {
 		};
 		created.once("error", onError);
 		created.once("listening", onListening);
-		created.listen(port, host);
+		created.listen({
+			port,
+			host: bind.host,
+			ipv6Only: bind.ipv6Only
+		});
 	});
 }
 //#endregion
-export { evaluateExistingCert as S, collectCertIdentity as _, readLanHttpState as a, MAX_LEAF_VALIDITY_DAYS as b, readTlsAccessStatus as c, writeTlsMode as d, validateUploadedTls as f, CA_COMMON_NAME as g, reissueTlsLeaf as h, closeLanHttp as i, readTlsMode as l, loadTlsCert as m, applyLanHttp as n, registerLanHttpHandler as o, ensureTlsCert as p, bindPendingLanHttp as r, readExtraSans as s, DEFAULT_LAN_HTTP_PORT as t, writeExtraSans as u, CA_VALIDITY_DAYS as v, SERVER_AUTH_OID as x, LEAF_RENEWAL_WINDOW_DAYS as y };
+export { evaluateExistingCert as C, SERVER_AUTH_OID as S, CA_COMMON_NAME as _, closeLanHttp as a, LEAF_RENEWAL_WINDOW_DAYS as b, readExtraSans as c, writeExtraSans as d, writeTlsMode as f, reissueTlsLeaf as g, loadTlsCert as h, bindPendingLanHttp as i, readTlsAccessStatus as l, ensureTlsCert as m, allFamiliesListenHost as n, readLanHttpState as o, validateUploadedTls as p, applyLanHttp as r, registerLanHttpHandler as s, DEFAULT_LAN_HTTP_PORT as t, readTlsMode as u, collectCertIdentity as v, MAX_LEAF_VALIDITY_DAYS as x, CA_VALIDITY_DAYS as y };

package/dist/{retired-settings-keys-SrxMH3OT.mjs → retired-settings-keys--aM_vGF9.mjs}

@@ -1,4 +1,4 @@
-import { kt as asJsonObject } from "./dist-BpzbLPel.mjs";
+import { kt as asJsonObject } from "./dist-D4Vmj8iw.mjs";
 //#region src/builtins/sqlite-storage/retired-settings-keys.ts
 /**
 * Is THIS node the one whose settings store is the cluster's authority?

package/dist/{retired-settings-keys-BVAxT5XL.js → retired-settings-keys-DET4YkAU.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-Cri60Jd0.js");
+const require_dist = require("./dist-DMEGlqg6.js");
 //#region src/builtins/sqlite-storage/retired-settings-keys.ts
 /**
 * Is THIS node the one whose settings store is the cluster's authority?

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/system",
-  "version": "1.2.116",
+  "version": "1.2.117",
   "description": "Core addon for CamStack — builtins, pipeline, process management, auth, logging, events",
   "keywords": [
     "camstack",