@camstack/system 1.2.116 → 1.2.118

package/dist/addon-utils.d.ts

@@ -14,7 +14,7 @@
  *
  * See memory: camstack_runner_ram_and_build_rootcause.
  */
-export { downloadFile, ensureModel, isModelDownloaded, deleteModelFromDisk, collectModelFiles, getModelFilePath, } from './download/model-downloader.js';
+export { downloadFile, ensureModel, isModelDownloaded, deleteModelFromDisk, collectModelFiles, getModelFilePath, type DownloadFileOptions, type DownloadRedirectPolicy, } from './download/model-downloader.js';
 export { ModelDownloadService } from './download/model-download-service.js';
 export { createFileDataPlaneHandler } from './http/file-data-plane.js';
 export { parseRangeHeader, contentTypeFor, type ByteRange, } from './http/authenticated-file-server.js';

package/dist/addon-utils.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("./chunk-Cek0wNdY.js");
-const require_file_data_plane = require("./file-data-plane-DUHPHa-Y.js");
+const require_file_data_plane = require("./file-data-plane-DO8KbxCe.js");
 const require_custom_action_registry = require("./custom-action-registry-jY0NOZK8.js");
 exports.CustomActionRegistry = require_custom_action_registry.CustomActionRegistry;
 exports.ModelDownloadService = require_file_data_plane.ModelDownloadService;

package/dist/addon-utils.mjs

@@ -1,3 +1,3 @@
-import { c as collectModelFiles, f as ensureModel, h as isModelDownloaded, i as parseRangeHeader, l as deleteModelFromDisk, m as getModelFilePath, n as contentTypeFor, s as ModelDownloadService, t as createFileDataPlaneHandler, u as downloadFile } from "./file-data-plane-CuE_hBli.mjs";
+import { c as collectModelFiles, f as ensureModel, h as isModelDownloaded, i as parseRangeHeader, l as deleteModelFromDisk, m as getModelFilePath, n as contentTypeFor, s as ModelDownloadService, t as createFileDataPlaneHandler, u as downloadFile } from "./file-data-plane-BhKdxJgf.mjs";
 import { t as CustomActionRegistry } from "./custom-action-registry-F__gp_VX.mjs";
 export { CustomActionRegistry, ModelDownloadService, collectModelFiles, contentTypeFor, createFileDataPlaneHandler, deleteModelFromDisk, downloadFile, ensureModel, getModelFilePath, isModelDownloaded, parseRangeHeader };

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Cri60Jd0.js");
+const require_dist = require("../../dist-C2_1HCpW.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { Gt as EventCategory, v as addonPagesCapability, vt as errMsg, yt as BaseAddon } from "../../dist-BpzbLPel.mjs";
+import { Gt as EventCategory, v as addonPagesCapability, vt as errMsg, yt as BaseAddon } from "../../dist-DCTpBXm4.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import * as path$1 from "node:path";

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Cri60Jd0.js");
+const require_dist = require("../../dist-C2_1HCpW.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { Gt as EventCategory, b as addonWidgetsCapability, vt as errMsg, yt as BaseAddon } from "../../dist-BpzbLPel.mjs";
+import { Gt as EventCategory, b as addonWidgetsCapability, vt as errMsg, yt as BaseAddon } from "../../dist-DCTpBXm4.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import * as path$1 from "node:path";

package/dist/builtins/alerts/alerts.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Cri60Jd0.js");
+const require_dist = require("../../dist-C2_1HCpW.js");
 //#region src/builtins/alerts/prune-policy.ts
 /**
 * Ids older than `cutoffMs`, oldest first.

package/dist/builtins/alerts/alerts.addon.mjs

@@ -1,4 +1,4 @@
-import { Gt as EventCategory, Mt as createEvent, n as AlertSchema, vt as errMsg, x as alertsCapability, yt as BaseAddon } from "../../dist-BpzbLPel.mjs";
+import { Gt as EventCategory, Mt as createEvent, n as AlertSchema, vt as errMsg, x as alertsCapability, yt as BaseAddon } from "../../dist-DCTpBXm4.mjs";
 //#region src/builtins/alerts/prune-policy.ts
 /**
 * Ids older than `cutoffMs`, oldest first.

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Cri60Jd0.js");
+const require_dist = require("../../dist-C2_1HCpW.js");
 let node_crypto = require("node:crypto");
 let buffer = require("buffer");
 let node_fs_promises = require("node:fs/promises");

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { C as backupCapability, Gt as EventCategory, yt as BaseAddon } from "../../dist-BpzbLPel.mjs";
+import { C as backupCapability, Gt as EventCategory, yt as BaseAddon } from "../../dist-DCTpBXm4.mjs";
 import { randomBytes, randomUUID } from "node:crypto";
 import { Buffer as Buffer$1 } from "buffer";
 import * as fsp from "node:fs/promises";

package/dist/builtins/console-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Cri60Jd0.js");
+const require_dist = require("../../dist-C2_1HCpW.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/console-logging/index.mjs

@@ -1,4 +1,4 @@
-import { X as logDestinationCapability, yt as BaseAddon } from "../../dist-BpzbLPel.mjs";
+import { X as logDestinationCapability, yt as BaseAddon } from "../../dist-DCTpBXm4.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/core-blocks/core-blocks.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Cri60Jd0.js");
+const require_dist = require("../../dist-C2_1HCpW.js");
 let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 node_fs_promises = require_chunk.__toESM(node_fs_promises);

package/dist/builtins/core-blocks/core-blocks.addon.mjs

@@ -1,4 +1,4 @@
-import { D as coreBlockAddonId, O as coreBlockIdFromAddonId, c as CoreBlockSchema, k as coreBlocksCapability, l as DeclaredDevices, o as CORE_BLOCKS_ADDON_ID, s as CORE_BLOCK_ADDON_PREFIX, vt as errMsg, yt as BaseAddon } from "../../dist-BpzbLPel.mjs";
+import { D as coreBlockAddonId, O as coreBlockIdFromAddonId, c as CoreBlockSchema, k as coreBlocksCapability, l as DeclaredDevices, o as CORE_BLOCKS_ADDON_ID, s as CORE_BLOCK_ADDON_PREFIX, vt as errMsg, yt as BaseAddon } from "../../dist-DCTpBXm4.mjs";
 import { randomUUID } from "node:crypto";
 import * as fs from "node:fs/promises";
 import * as path$1 from "node:path";

package/dist/builtins/device-manager/device-manager.addon.js

@@ -3,8 +3,8 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Cri60Jd0.js");
-const require_retired_settings_keys = require("../../retired-settings-keys-BVAxT5XL.js");
+const require_dist = require("../../dist-C2_1HCpW.js");
+const require_retired_settings_keys = require("../../retired-settings-keys-DHRXLMPn.js");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");
 //#region src/builtins/device-manager/adoption-job-engine.ts

package/dist/builtins/device-manager/device-manager.addon.mjs

@@ -1,5 +1,5 @@
-import { Ct as DeviceFeature, E as buildStreamParamsConfigSchema, F as deviceStatusCapability, Gt as EventCategory, Lt as isDeviceConfigCap, N as deviceManagerCapability, Ot as WELL_KNOWN_TAB_MAP, P as deviceStateCapability, R as enumerateItemArrayFields, Tt as DeviceType, Wt as sleep, a as CAP_NAMES_WITH_STATUS, at as runtimeStatePolicyFor, et as normalizeUnit, nt as parseStreamParamsFormPatch, p as STREAM_PROFILE_META, t as ALL_CAPABILITY_DEFINITIONS, u as DeviceStatusSchema, vt as errMsg, wt as DeviceRole, yt as BaseAddon, z as enumerateSchemaFields } from "../../dist-BpzbLPel.mjs";
-import { n as purgeRetiredSettingsRows } from "../../retired-settings-keys-SrxMH3OT.mjs";
+import { Ct as DeviceFeature, E as buildStreamParamsConfigSchema, F as deviceStatusCapability, Gt as EventCategory, Lt as isDeviceConfigCap, N as deviceManagerCapability, Ot as WELL_KNOWN_TAB_MAP, P as deviceStateCapability, R as enumerateItemArrayFields, Tt as DeviceType, Wt as sleep, a as CAP_NAMES_WITH_STATUS, at as runtimeStatePolicyFor, et as normalizeUnit, nt as parseStreamParamsFormPatch, p as STREAM_PROFILE_META, t as ALL_CAPABILITY_DEFINITIONS, u as DeviceStatusSchema, vt as errMsg, wt as DeviceRole, yt as BaseAddon, z as enumerateSchemaFields } from "../../dist-DCTpBXm4.mjs";
+import { n as purgeRetiredSettingsRows } from "../../retired-settings-keys-Czd76yLZ.mjs";
 import { randomUUID } from "node:crypto";
 import { canonicalDeviceFingerprint } from "@camstack/types/node";
 //#region src/builtins/device-manager/adoption-job-engine.ts

package/dist/builtins/doorbell/virtual-doorbell.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Cri60Jd0.js");
+const require_dist = require("../../dist-C2_1HCpW.js");
 //#region src/builtins/doorbell/trigger-engine.ts
 /**
 * Pure trigger logic for the virtual-doorbell builtin — edge detection over

package/dist/builtins/doorbell/virtual-doorbell.addon.mjs

@@ -1,4 +1,4 @@
-import { G as isSameAddonId, Gt as EventCategory, I as doorbellCapability, Mt as createEvent, Tt as DeviceType, vt as errMsg, w as bareAddonId, yt as BaseAddon } from "../../dist-BpzbLPel.mjs";
+import { G as isSameAddonId, Gt as EventCategory, I as doorbellCapability, Mt as createEvent, Tt as DeviceType, vt as errMsg, w as bareAddonId, yt as BaseAddon } from "../../dist-DCTpBXm4.mjs";
 //#region src/builtins/doorbell/trigger-engine.ts
 /**
 * Pure trigger logic for the virtual-doorbell builtin — edge detection over

package/dist/builtins/hub-forwarder/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Cri60Jd0.js");
+const require_dist = require("../../dist-C2_1HCpW.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/hub-forwarder/index.mjs

@@ -1,4 +1,4 @@
-import { X as logDestinationCapability, yt as BaseAddon } from "../../dist-BpzbLPel.mjs";
+import { X as logDestinationCapability, yt as BaseAddon } from "../../dist-DCTpBXm4.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/liveness-monitor/liveness-monitor.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Cri60Jd0.js");
+const require_dist = require("../../dist-C2_1HCpW.js");
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/liveness-monitor/liveness-monitor.addon.mjs

@@ -1,4 +1,4 @@
-import { Gt as EventCategory, Mt as createEvent, vt as errMsg, yt as BaseAddon } from "../../dist-BpzbLPel.mjs";
+import { Gt as EventCategory, Mt as createEvent, vt as errMsg, yt as BaseAddon } from "../../dist-DCTpBXm4.mjs";
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/local-auth/local-auth.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Cri60Jd0.js");
+const require_dist = require("../../dist-C2_1HCpW.js");
 let node_crypto = require("node:crypto");
 node_crypto = require_chunk.__toESM(node_crypto);
 let crypto$1 = require("crypto");

package/dist/builtins/local-auth/local-auth.addon.mjs

@@ -1,5 +1,5 @@
 import { i as __require, o as __toESM, t as __commonJSMin } from "../../chunk-CNf5ZN-e.mjs";
-import { S as authProviderCapability, _ as UserRecordSchema, ht as userManagementCapability, m as ScopedTokenSchema, r as ApiKeyRecordSchema, yt as BaseAddon } from "../../dist-BpzbLPel.mjs";
+import { S as authProviderCapability, _ as UserRecordSchema, ht as userManagementCapability, m as ScopedTokenSchema, r as ApiKeyRecordSchema, yt as BaseAddon } from "../../dist-DCTpBXm4.mjs";
 import * as crypto$2 from "node:crypto";
 import { createHash, randomUUID, timingSafeEqual } from "node:crypto";
 import nodeCrypto from "crypto";

package/dist/builtins/local-network/ipv6-lan.d.ts

@@ -0,0 +1,26 @@
+/**
+ * IPv6 helpers for LAN advertisement: prefix matching (privacy addresses
+ * rotate inside a /64), Linux `/proc/net/if_inet6` flags, and the gate
+ * that keeps temporary GUA off the connection candidate list.
+ */
+/** First 64 bits, canonical hex groups, or null if the address is not IPv6. */
+export declare function ipv6Prefix64Key(address: string): string | null;
+/** 32-char lowercase hex (same encoding as `/proc/net/if_inet6`). */
+export declare function ipv6ToHex32(address: string): string | null;
+/**
+ * Parse Linux `if_inet6` into hex32 → flags. Unknown / malformed lines
+ * are skipped. Keys match {@link ipv6ToHex32}.
+ */
+export declare function parseProcIfInet6(text: string): ReadonlyMap<string, number>;
+/**
+ * Whether this IPv6 should be auto-seeded / advertised.
+ * `flags === undefined` means the platform did not tell us (macOS, tests
+ * without a proc snapshot) — keep every non-link-local plausible address.
+ *
+ * On Linux, drop addresses marked TEMPORARY / DEPRECATED / TENTATIVE, and
+ * `flags === 0` which is how this kernel reports RFC 4941 privacy temps
+ * (the stable GUA is PERMANENT|NODAD). Do **not** require PERMANENT —
+ * stateful DHCPv6 GUA often has only NODAD (0x02).
+ */
+export declare function shouldAdvertiseIpv6(address: string, flags: number | undefined): boolean;
+export declare function ipv6AllowlistMatches(address: string, allowed: readonly string[]): boolean;

package/dist/builtins/local-network/local-network.addon.d.ts

@@ -10,6 +10,8 @@ interface MeshEndpointCache {
     /** Hub HTTPS port the mesh endpoint targets. */
     readonly port: number;
 }
+/** Drop rotated IPv6 / dead extras from the persisted allowlist. */
+export declare const ALLOWLIST_RECONCILE_INTERVAL_MS: number;
 /** The three places a hub listen port can be learned, most authoritative first. */
 export interface ListenPortSources {
     /** `server.port` from the hub's live config section; null when unreadable. */
@@ -37,6 +39,11 @@ interface LocalNetworkConfig {
      * different address after a reboot.
      */
     readonly notificationBaseUrl: string;
+    /**
+     * Base URLs the SDK / viewer should race. Empty = AUTO (LAN IPv4 + public
+     * tunnel). Stored verbatim, same contract as `notificationBaseUrl`.
+     */
+    readonly viewerBaseUrls: readonly string[];
     /** LAN HTTP listener. Default true — native apps skip the private cert. */
     readonly httpEnabled: boolean;
     /** Dedicated HTTP port. Must not equal the HTTPS listen port. */
@@ -46,6 +53,8 @@ interface LocalNetworkConfig {
 }
 export declare class LocalNetworkAddon extends BaseAddon<LocalNetworkConfig> {
     private pollTimer;
+    private allowlistTimer;
+    private allowlistReconcilePending;
     private lastSnapshotKey;
     /** Optional public hostname tracked from `NetworkTunnelStarted`/
      *  `Stopped` events on the bus. */
@@ -66,6 +75,13 @@ export declare class LocalNetworkAddon extends BaseAddon<LocalNetworkConfig> {
      * rather than a link that 404s).
      */
     private resolveNotificationEndpoint;
+    private snapshotViewerEndpoints;
+    /**
+     * Palette shown in the Network tab: LAN IPv4, stable LAN IPv6, public,
+     * mesh. The viewer HTTP/WS race is a subset (`selectViewerEndpoints`) —
+     * IPv6 stays in this list because ICE/WebRTC gathers it regardless.
+     */
+    private buildAdvertisedEndpoints;
     protected onInitialize(): Promise<ProviderRegistration[]>;
     protected globalSettingsSchema(): import('@camstack/types').ConfigUISchema;
     protected onConfigChanged(): Promise<void>;
@@ -115,6 +131,11 @@ export declare class LocalNetworkAddon extends BaseAddon<LocalNetworkConfig> {
     /** `server.port` from the live config section, or null when unreadable. */
     private readConfiguredPort;
     private enumerate;
+    /**
+     * Replace rotated IPv6 and drop addresses that no longer exist, without
+     * clearing operator extras that are still live (docker/vpn opt-in).
+     */
+    private persistReconciledAllowlist;
     private detectChanges;
 }
 /**
@@ -142,12 +163,14 @@ interface OsNetworkInterfaceInfo {
     readonly internal: boolean;
     readonly mac: string;
 }
-export declare function enumerateOsInterfaces(ifaces: NodeJS.Dict<readonly OsNetworkInterfaceInfo[]>): readonly LocalInterface[];
+export declare function enumerateOsInterfaces(ifaces: NodeJS.Dict<readonly OsNetworkInterfaceInfo[]>, ipv6Flags?: ReadonlyMap<string, number>): readonly LocalInterface[];
 /**
  * Filter the interface list by the operator's allowlist. Empty
  * allowlist = no-op (every interface passes); otherwise only entries
- * whose `address` matches an allowlist entry remain. Loopback always
- * survives so the SDK keeps `127.0.0.1` as the last-resort fallback.
+ * whose `address` matches an allowlist entry remain. IPv6 matches the
+ * allowlisted /64 so a rotated privacy address does not hide the live
+ * GUA. Loopback is not an advertised client route and is not forced
+ * through.
  */
 export declare function applyAllowlist(interfaces: readonly LocalInterface[], allowed: readonly string[]): readonly LocalInterface[];
 /**
@@ -157,17 +180,16 @@ export declare function applyAllowlist(interfaces: readonly LocalInterface[], al
 export declare function pickPreferred(interfaces: readonly LocalInterface[]): LocalInterface | null;
 /**
  * Build the ordered candidate URL list. Priority schema:
- *   0       — preferred LAN IPv4
- *   10+     — other LAN IPv4
+ *   0       — preferred LAN IPv4 (or local hostname)
+ *   10+     — other LAN IPv4 and stable LAN IPv6
  *   100     — public tunnel hostname (always HTTPS)
  *   150     — mesh endpoint (Tailscale MagicDNS / 100.x, always HTTPS)
- *   200+    — LAN IPv6
  *   1000    — loopback (last resort)
  *
  * The mesh endpoint ranks just below a true public funnel (a Funnel is
  * reachable by ANY client; the mesh needs the peer on the same tailnet)
- * but above the IPv6 / loopback fallbacks — giving remote, mesh-joined
- * clients a working candidate when no public tunnel is up.
+ * but above loopback. LAN IPv6 sits in the LAN band with IPv4 so a
+ * dual-stack client can win the race on IPv6 when it is faster.
  *
  * `scheme` controls loopback URLs and, when LAN HTTP is off, LAN URLs.
  * When {@link LanHttpAdvertisement} is enabled and listening, LAN (and
@@ -184,17 +206,25 @@ export interface LanHttpAdvertisement {
     readonly localHostname: string | null;
 }
 export declare function buildEndpoints(interfaces: readonly LocalInterface[], port: number, includeLoopback: boolean, ipv4Only: boolean, publicHostname: string, scheme?: 'http' | 'https', meshEndpoint?: MeshEndpointCache | null, lanHttp?: LanHttpAdvertisement | null): ConnectionEndpoint[];
+/** AUTO viewer race: LAN IPv4 + the public tunnel. Never IPv6, mesh, or loopback. */
+export declare function isDefaultViewerEndpoint(endpoint: ConnectionEndpoint): boolean;
+/**
+ * The URLs the SDK should race for API / viewer access.
+ *
+ * Empty `viewerBaseUrls` = AUTO (IPv4 + public tunnel). A non-empty list is
+ * the operator's pin; if none of those URLs are in the current palette,
+ * fall back to AUTO rather than racing an empty set.
+ */
+export declare function selectViewerEndpoints(endpoints: readonly ConnectionEndpoint[], viewerBaseUrls: readonly string[]): ConnectionEndpoint[];
 /**
  * First-boot heuristic: which addresses should the allowlist start
  * with? Includes LAN + Wi-Fi IPv4 addresses + plausible IPv6:
  *
  *   - **IPv4**: skip link-local (`169.254.*`), keep the rest.
  *   - **IPv6**: skip link-local (`fe80::*`), unspecified, and
- *     multicast. Keep ULAs (`fc00::/7` → `fc??:` / `fd??:`) and Global
- *     Unicast addresses (`2000::/3` → `2???`/`3???`). Privacy-extension
- *     temporary addresses get included by default; the operator can
- *     prune them from the Network Addresses tab if the rotating IPs
- *     become a nuisance.
+ *     multicast. Keep ULAs (`fc00::/7`) and Global Unicast (`2000::/3`).
+ *     Privacy-extension temporary addresses are skipped when Linux flags
+ *     mark them non-permanent (`plausible === false`).
  *
  * Skips docker/vpn/loopback/other entirely — those stay opt-in.
  */
@@ -219,4 +249,10 @@ export declare function isPlausibleAutoSeed(address: string, family: 'IPv4' | 'I
 export declare function classifyKind(name: string, address: string, internal: boolean): LocalInterface['kind'];
 /** Convert an IPv4/IPv6 netmask string to its prefix length (CIDR). */
 export declare function prefixLen(netmask: string): number;
-export {};
+/**
+ * Rewrite a persisted allowlist against the live interface set:
+ * current auto-seed (LAN/Wi-Fi, stable IPv6) plus still-live operator
+ * extras (docker/vpn). Empty stays empty — that is "unrestricted".
+ */
+export declare function reconcileAllowlist(current: readonly string[], interfaces: readonly LocalInterface[]): string[];
+export { ipv6Prefix64Key, parseProcIfInet6, shouldAdvertiseIpv6, } from './ipv6-lan.js';