@camstack/system 1.2.357 → 1.2.359

package/dist/builtins/local-network/local-network.addon.js

@@ -1,11 +1,235 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CFVOy8VT.js");
+const require_dist = require("../../dist-W_X44h-s.js");
 const require_tls = require("../../tls-CCMX7MjX.js");
+let zod = require("zod");
 let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);
 let node_fs = require("node:fs");
 let node_net = require("node:net");
+//#region src/builtins/local-network/address-book.ts
+/**
+* The Network page's address book, as pure functions: custom addresses plus
+* the role flags carried by detected and custom addresses alike.
+*
+* ## Storage
+*
+* The role flags keep the keys they always had, so a rolled-back hub reads
+* them with the meaning it knew: `viewerBaseUrls` (viewer, many),
+* `notificationBaseUrl` (notifications, D709), `agentBaseUrl` and
+* `signInBaseUrl` (agents / sign-in, D729 amendment). A single-valued role is
+* one URL — at most one address carries it, by construction. `''` / `[]` is
+* automatic. The custom addresses are `customAddresses` (url + label).
+*
+* ## Migration in the read path
+*
+* Before this, a single-valued flag could name an address that was in no row:
+* the notification links' typed custom address (D709) and the two hub-address
+* overrides (D729 amendment) were free URLs. {@link normalizeAddressBook}
+* turns every such flag into a custom address carrying that role, on every
+* read; the next write persists the result. It is the same rule forever, not
+* a one-off: a flagged detected address that disappears (a DHCP move) shows up
+* as a custom row instead of vanishing while it still wins.
+*/
+var CustomAddressListSchema = zod.z.array(zod.z.object({
+	baseUrl: zod.z.string(),
+	label: zod.z.string()
+}));
+/** The label a flag promoted to a custom address is given. */
+var PROMOTED_LABEL = {
+	notifications: "Notification links address",
+	agents: "Hub address for agents",
+	signIn: "Sign-in address"
+};
+var SINGLE_ROLES = [
+	"notifications",
+	"agents",
+	"signIn"
+];
+function flagOf(value) {
+	return value === "" ? null : value;
+}
+/** Parse the stored custom list; a malformed store reads as empty, never throws. */
+function parseCustomAddresses(raw) {
+	const parsed = CustomAddressListSchema.safeParse(raw ?? []);
+	return parsed.success ? parsed.data : [];
+}
+/**
+* The address book as it stands: stored custom addresses, plus every
+* single-valued flag that names neither a detected address, a custom one nor
+* the app link, promoted to a custom address (see the module doc).
+*/
+function normalizeAddressBook(stored, detectedUrls) {
+	const flags = {
+		viewer: stored.viewerBaseUrls,
+		notifications: flagOf(stored.notificationBaseUrl),
+		agents: flagOf(stored.agentBaseUrl),
+		signIn: flagOf(stored.signInBaseUrl)
+	};
+	const custom = [...parseCustomAddresses(stored.customAddresses)];
+	for (const role of SINGLE_ROLES) {
+		const url = flags[role];
+		if (url === null || require_dist.isAppLinkBase(url) || detectedUrls.has(url)) continue;
+		if (custom.some((c) => c.baseUrl === url)) continue;
+		custom.push({
+			baseUrl: url,
+			label: PROMOTED_LABEL[role]
+		});
+	}
+	return {
+		custom,
+		flags
+	};
+}
+/** The stored-settings patch that persists `state`. */
+function addressBookPatch(state) {
+	return {
+		customAddresses: state.custom,
+		viewerBaseUrls: state.flags.viewer,
+		notificationBaseUrl: state.flags.notifications ?? "",
+		agentBaseUrl: state.flags.agents ?? "",
+		signInBaseUrl: state.flags.signIn ?? ""
+	};
+}
+function withCustomAddress(state, entry) {
+	const custom = state.custom.some((c) => c.baseUrl === entry.baseUrl) ? state.custom.map((c) => c.baseUrl === entry.baseUrl ? entry : c) : [...state.custom, entry];
+	return {
+		...state,
+		custom
+	};
+}
+/** Drop a custom address and every flag it carried (those roles turn automatic). */
+function withoutCustomAddress(state, baseUrl) {
+	const clear = (flag) => flag === baseUrl ? null : flag;
+	return {
+		custom: state.custom.filter((c) => c.baseUrl !== baseUrl),
+		flags: {
+			viewer: state.flags.viewer.filter((u) => u !== baseUrl),
+			notifications: clear(state.flags.notifications),
+			agents: clear(state.flags.agents),
+			signIn: clear(state.flags.signIn)
+		}
+	};
+}
+/** Every role back to automatic for `role`. */
+function withRoleAutomatic(state, role) {
+	return role === "viewer" ? {
+		...state,
+		flags: {
+			...state.flags,
+			viewer: []
+		}
+	} : {
+		...state,
+		flags: {
+			...state.flags,
+			[role]: null
+		}
+	};
+}
+/**
+* Flag or unflag `baseUrl` for `role`. A single-valued role flagged here moves
+* off every other address (it is one URL); unflagging the address that carries
+* it returns the role to automatic. The app link flagged for notifications IS
+* the automatic answer, stored as automatic — one representation. `viewer`
+* toggles inside the set; toggling while automatic starts from the automatic
+* set (`autoViewer`) so the other addresses keep racing.
+*/
+function withRoleFlag(state, role, baseUrl, enabled, autoViewer) {
+	if (role === "viewer") {
+		const without = (state.flags.viewer.length === 0 ? autoViewer : state.flags.viewer).filter((u) => u !== baseUrl);
+		const viewer = enabled ? [...without, baseUrl] : without;
+		return {
+			...state,
+			flags: {
+				...state.flags,
+				viewer
+			}
+		};
+	}
+	if (role === "notifications" && require_dist.isAppLinkBase(baseUrl)) return withRoleAutomatic(state, role);
+	if (enabled) return {
+		...state,
+		flags: {
+			...state.flags,
+			[role]: baseUrl
+		}
+	};
+	return state.flags[role] === baseUrl ? withRoleAutomatic(state, role) : state;
+}
+/** What a row may be flagged with. */
+function eligibleRoles(endpoint) {
+	if (endpoint.kind === "loopback") return [];
+	if (endpoint.kind === "app-link") return ["notifications"];
+	return [
+		"viewer",
+		"notifications",
+		"agents",
+		"signIn"
+	];
+}
+/** A custom address as a palette entry (`kind: 'custom'`). */
+function customEndpoint(entry) {
+	return {
+		label: entry.label === "" ? "Custom address" : entry.label,
+		baseUrl: entry.baseUrl,
+		kind: "custom",
+		interfaceKind: "other",
+		plausible: true,
+		plausibleReason: "",
+		priority: 200
+	};
+}
+/**
+* The palette a client races: the detected endpoints plus the custom
+* addresses flagged `viewer` (a detected URL is never listed twice).
+*/
+function withViewerCustomEndpoints(detected, state) {
+	const known = new Set(detected.map((e) => e.baseUrl));
+	const wanted = new Set(state.flags.viewer);
+	const extra = state.custom.filter((c) => wanted.has(c.baseUrl) && !known.has(c.baseUrl)).map(customEndpoint);
+	return [...detected, ...extra];
+}
+/** Every role's answer — the resolvers from `@camstack/types`, nothing else. */
+function resolveRoles(state, viewerPalette, httpsPalette) {
+	return require_dist.resolveHubAddressRoles(withViewerCustomEndpoints(viewerPalette, state), httpsPalette, state.flags);
+}
+function flagsOn(state, baseUrl) {
+	const out = [];
+	if (state.flags.viewer.includes(baseUrl)) out.push("viewer");
+	for (const role of SINGLE_ROLES) if (state.flags[role] === baseUrl) out.push(role);
+	return out;
+}
+function inUseOn(roles, baseUrl) {
+	const out = [];
+	if (roles.viewer.resolved.includes(baseUrl)) out.push("viewer");
+	for (const role of SINGLE_ROLES) if (roles[role].resolved === baseUrl) out.push(role);
+	return out;
+}
+/** The Addresses table: app link, detected rows, then custom-only rows. */
+function buildAddressBook(state, inputs) {
+	const roles = resolveRoles(state, inputs.rowsPalette, inputs.httpsPalette);
+	const customUrls = new Set(state.custom.map((c) => c.baseUrl));
+	const detectedUrls = new Set(inputs.rowsPalette.map((e) => e.baseUrl));
+	const row = (endpoint, detected) => ({
+		...endpoint,
+		detected,
+		custom: customUrls.has(endpoint.baseUrl),
+		flags: endpoint.kind === "app-link" ? [] : flagsOn(state, endpoint.baseUrl),
+		inUse: endpoint.kind === "app-link" ? roles.notifications.resolved === "https://camstack.zentik.app" ? ["notifications"] : [] : inUseOn(roles, endpoint.baseUrl),
+		eligible: eligibleRoles(endpoint)
+	});
+	return {
+		rows: [
+			row(inputs.appLink, false),
+			...inputs.rowsPalette.map((e) => row(e, true)),
+			...state.custom.filter((c) => !detectedUrls.has(c.baseUrl)).map((c) => row(customEndpoint(c), false))
+		],
+		roles,
+		appLinkHub: inputs.appLinkHub
+	};
+}
+//#endregion
 //#region src/builtins/local-network/ipv6-lan.ts
 /**
 * IPv6 helpers for LAN advertisement: prefix matching (privacy addresses
@@ -199,55 +423,135 @@ var LocalNetworkAddon = class extends require_dist.BaseAddon {
 			bootSeeded: false,
 			notificationBaseUrl: "",
 			viewerBaseUrls: [],
+			customAddresses: [],
 			httpEnabled: true,
 			httpPort: require_tls.DEFAULT_LAN_HTTP_PORT,
-			localHostname: ""
+			localHostname: "",
+			agentBaseUrl: "",
+			signInBaseUrl: ""
 		});
 	}
 	/**
-	* The effective flagged notification address: the operator's explicit
-	* choice, else AUTO — the CamStack app link (D709, operator decision
-	* 2026-10-06; before it AUTO was the tunnel, then the mesh). The app link is
-	* not a hub address: the NC's signed media and buttons keep their own hub
-	* ladder when it is flagged; only viewer taps take the app form.
+	* The detected palettes, with the mesh reconciled once: `https` (what agents
+	* and sign-in resolve over, and the app link's `hub=`) and `http` (what the
+	* viewer race resolves over, as before).
 	*/
-	resolveNotificationEndpoint() {
-		const explicit = this.config.notificationBaseUrl;
-		return explicit !== "" ? explicit : require_dist.CAMSTACK_APP_LINK_ORIGIN;
+	async palettes() {
+		const port = (await this.resolveAdvertisedListenPort(null)).port;
+		await this.reconcileMeshEndpoint();
+		return {
+			http: this.endpointsNow(false, false, "http", port),
+			https: this.endpointsNow(false, false, "https", port)
+		};
+	}
+	/** The stored address book, normalised against what is detected now. */
+	addressState(detected) {
+		return normalizeAddressBook(this.config, new Set(detected.map((e) => e.baseUrl)));
+	}
+	/** The role flags alone — they do not depend on what is detected. */
+	storedFlags() {
+		return normalizeAddressBook(this.config, /* @__PURE__ */ new Set()).flags;
+	}
+	/** `getAddresses`: the Addresses table and every role's answer. */
+	async addressBook(scheme) {
+		const { http, https } = await this.palettes();
+		return buildAddressBook(this.addressState([...http, ...https]), {
+			rowsPalette: scheme === "http" ? http : https,
+			httpsPalette: https,
+			appLink: appLinkEndpoint(),
+			appLinkHub: require_dist.pickAppLinkHub(https)
+		});
 	}
 	/**
-	* The `hub=` an app link carries: the best public HTTPS address in this
-	* cap's own palette (tunnel, then mesh) — so it can never disagree with
-	* what the Network page lists. See `pickAppLinkHub`.
+	* Apply one change to the address book and persist it, normalised (a flag
+	* naming an address in no row becomes a custom address in the same write).
 	*/
-	async resolveAppLinkHub() {
-		const port = (await this.resolveAdvertisedListenPort(null)).port;
-		return require_dist.pickAppLinkHub(await this.buildAdvertisedEndpoints(false, false, "https", port));
+	async changeAddressBook(change) {
+		const { http, https } = await this.palettes();
+		const detected = [...http, ...https];
+		const detectedUrls = new Set(detected.map((e) => e.baseUrl));
+		const changed = change(this.addressState(detected), {
+			detectedUrls,
+			autoViewer: [...new Set(detected.filter(require_dist.isDefaultViewerEndpoint).map((e) => e.baseUrl))]
+		});
+		const after = normalizeAddressBook({
+			...addressBookPatch(changed),
+			customAddresses: changed.custom
+		}, detectedUrls);
+		await this.updateGlobalSettings(addressBookPatch(after));
+	}
+	/** The deprecated `getHubAddresses` shape, from the role resolvers. */
+	async snapshotHubAddresses() {
+		const { roles } = await this.addressBook("https");
+		const legacy = (r) => ({
+			override: r.flagged,
+			resolved: r.resolved,
+			source: r.source === "flagged" ? "override" : r.source
+		});
+		return {
+			cluster: legacy(roles.agents),
+			browser: legacy(roles.signIn)
+		};
+	}
+	/**
+	* Flag / unflag `baseUrl` for `role`, or (`baseUrl: null`) return the role
+	* to automatic. Validated: the address must be a row (detected, custom, or
+	* the app link for notifications), never loopback, and `signIn` on plain
+	* http only when accepted. A refusal stores nothing.
+	*/
+	async setRole(role, baseUrl, enabled, acceptInsecureHttp) {
+		if (baseUrl === null || baseUrl.trim() === "" && role !== "viewer") {
+			await this.changeAddressBook((state) => withRoleAutomatic(state, role));
+			this.ctx.logger.info("local-network: address role set to automatic", { meta: { role } });
+			return;
+		}
+		let target = baseUrl.trim();
+		if (enabled) {
+			const check = require_dist.checkRoleAddress(role, target, { acceptInsecureHttp });
+			if (!check.ok) throw new Error(check.reason);
+			target = check.baseUrl;
+		}
+		await this.changeAddressBook((state, ctx) => {
+			const known = require_dist.isAppLinkBase(target) || ctx.detectedUrls.has(target) || state.custom.some((c) => c.baseUrl === target);
+			if (enabled && !known && role !== "notifications") throw new Error(`${target} is not in the address list — add it as a custom address first.`);
+			return withRoleFlag(state, role, target, enabled, ctx.autoViewer);
+		});
+		this.ctx.logger.info("local-network: address role set", { meta: {
+			role,
+			baseUrl: target,
+			enabled
+		} });
 	}
 	async notificationEndpointSnapshot() {
-		const explicit = this.config.notificationBaseUrl;
+		const resolution = require_dist.resolveNotificationsAddress(this.storedFlags());
+		const port = (await this.resolveAdvertisedListenPort(null)).port;
 		return {
-			baseUrl: explicit === "" ? null : explicit,
-			resolved: this.resolveNotificationEndpoint(),
-			appLinkHub: await this.resolveAppLinkHub()
+			baseUrl: resolution.flagged,
+			resolved: resolution.resolved,
+			appLinkHub: require_dist.pickAppLinkHub(await this.buildAdvertisedEndpoints(false, false, "https", port))
 		};
 	}
 	async snapshotViewerEndpoints() {
-		const selected = selectViewerEndpoints(await this.buildAdvertisedEndpoints(false, false, "http", (await this.resolveAdvertisedListenPort(null)).port), this.config.viewerBaseUrls);
+		const resolution = require_dist.resolveViewerAddresses(await this.buildAdvertisedEndpoints(false, false, "http", (await this.resolveAdvertisedListenPort(null)).port), this.storedFlags());
 		return {
-			baseUrls: this.config.viewerBaseUrls,
-			resolved: selected.map((e) => e.baseUrl)
+			baseUrls: resolution.flagged,
+			resolved: resolution.resolved
 		};
 	}
 	/**
-	* Palette shown in the Network tab: LAN IPv4, stable LAN IPv6, public,
-	* mesh. The viewer HTTP/WS race is a subset (`selectViewerEndpoints`) —
-	* IPv6 stays in this list because ICE/WebRTC gathers it regardless.
+	* Palette shown to clients: LAN IPv4, stable LAN IPv6, public, mesh, and
+	* the custom addresses flagged `viewer` (`kind: 'custom'`). The viewer
+	* HTTP/WS race is a subset (`selectViewerEndpoints`) — IPv6 stays in this
+	* list because ICE/WebRTC gathers it regardless.
 	*/
 	async buildAdvertisedEndpoints(includeLoopback, ipv4Only, scheme, httpsPort) {
-		const allow = this.config.allowedAddresses;
-		const interfaces = applyAllowlist(this.enumerate(), allow);
 		await this.reconcileMeshEndpoint();
+		const detected = this.endpointsNow(includeLoopback, ipv4Only, scheme, httpsPort);
+		return withViewerCustomEndpoints(detected, this.addressState(detected));
+	}
+	/** The DETECTED palette from the cached interface/tunnel/mesh state. */
+	endpointsNow(includeLoopback, ipv4Only, scheme, httpsPort) {
+		const interfaces = applyAllowlist(this.enumerate(), this.config.allowedAddresses);
 		const httpState = require_tls.readLanHttpState();
 		return buildEndpoints(interfaces, httpsPort, includeLoopback, ipv4Only, this.publicHostname, scheme, this.meshEndpoint, {
 			enabled: this.config.httpEnabled !== false,
@@ -290,20 +594,50 @@ var LocalNetworkAddon = class extends require_dist.BaseAddon {
 			},
 			getNotificationEndpoint: async () => this.notificationEndpointSnapshot(),
 			setNotificationEndpoint: async ({ baseUrl }) => {
-				await this.updateGlobalSettings({ notificationBaseUrl: baseUrl ?? "" });
-				this.ctx.logger.info("local-network: notification endpoint set", { meta: { baseUrl: baseUrl ?? "(auto)" } });
+				await this.setRole("notifications", baseUrl, true, false);
 				return this.notificationEndpointSnapshot();
 			},
 			getViewerEndpoints: async () => this.snapshotViewerEndpoints(),
 			setViewerEndpoints: async ({ baseUrls }) => {
-				const cleaned = [...new Set(baseUrls.filter((u) => u.length > 0))];
-				await this.updateGlobalSettings({ viewerBaseUrls: cleaned });
+				const viewer = [...new Set(baseUrls.filter((u) => u.length > 0))];
+				await this.changeAddressBook((state) => ({
+					...state,
+					flags: {
+						...state.flags,
+						viewer
+					}
+				}));
 				this.ctx.logger.info("local-network: viewer endpoints set", { meta: {
-					count: cleaned.length,
-					auto: cleaned.length === 0
+					count: viewer.length,
+					auto: viewer.length === 0
 				} });
 				return this.snapshotViewerEndpoints();
 			},
+			getAddresses: async (input) => this.addressBook(input?.scheme ?? "https"),
+			addCustomAddress: async ({ baseUrl, label }) => {
+				const check = require_dist.validateCustomAddress(baseUrl);
+				if (!check.ok) throw new Error(check.reason);
+				const entry = {
+					baseUrl: check.baseUrl,
+					label: label.trim()
+				};
+				await this.changeAddressBook((state) => withCustomAddress(state, entry));
+				this.ctx.logger.info("local-network: custom address added", { meta: {
+					baseUrl: entry.baseUrl,
+					label: entry.label
+				} });
+				return this.addressBook("https");
+			},
+			removeCustomAddress: async ({ baseUrl }) => {
+				await this.changeAddressBook((state) => withoutCustomAddress(state, baseUrl));
+				this.ctx.logger.info("local-network: custom address removed", { meta: { baseUrl } });
+				return this.addressBook("https");
+			},
+			setAddressRole: async ({ role, baseUrl, enabled, acceptInsecureHttp }) => {
+				await this.setRole(role, baseUrl, enabled, acceptInsecureHttp === true);
+				return this.addressBook("https");
+			},
+			getHubAddresses: async () => this.snapshotHubAddresses(),
 			getAllowedAddresses: async () => ({ addresses: this.config.allowedAddresses }),
 			resetAllowlistToBestMatch: async () => {
 				const seed = autoSeedAllowlist(this.enumerate());
@@ -845,25 +1179,6 @@ function buildEndpoints(interfaces, port, includeLoopback, ipv4Only, publicHostn
 	});
 	return out.toSorted((a, b) => a.priority - b.priority);
 }
-/** AUTO viewer race: LAN IPv4 + the public tunnel. Never IPv6, mesh, or loopback. */
-function isDefaultViewerEndpoint(endpoint) {
-	if (endpoint.kind === "lan-ipv4") return true;
-	return endpoint.kind === "public" && endpoint.interfaceKind === "public";
-}
-/**
-* The URLs the SDK should race for API / viewer access.
-*
-* Empty `viewerBaseUrls` = AUTO (IPv4 + public tunnel). A non-empty list is
-* the operator's pin; if none of those URLs are in the current palette,
-* fall back to AUTO rather than racing an empty set.
-*/
-function selectViewerEndpoints(endpoints, viewerBaseUrls) {
-	const auto = endpoints.filter(isDefaultViewerEndpoint);
-	if (viewerBaseUrls.length === 0) return auto;
-	const wanted = new Set(viewerBaseUrls);
-	const explicit = endpoints.filter((e) => wanted.has(e.baseUrl));
-	return explicit.length > 0 ? explicit : auto;
-}
 /**
 * First-boot heuristic: which addresses should the allowlist start
 * with? Includes LAN + Wi-Fi IPv4 addresses + plausible IPv6:
@@ -1002,12 +1317,10 @@ exports.classifyKind = classifyKind;
 exports.enumerateOsInterfaces = enumerateOsInterfaces;
 exports.explainNonPlausible = explainNonPlausible;
 exports.ipv6Prefix64Key = ipv6Prefix64Key;
-exports.isDefaultViewerEndpoint = isDefaultViewerEndpoint;
 exports.isPlausibleAutoSeed = isPlausibleAutoSeed;
 exports.parseProcIfInet6 = parseProcIfInet6;
 exports.pickPreferred = pickPreferred;
 exports.prefixLen = prefixLen;
 exports.reconcileAllowlist = reconcileAllowlist;
 exports.resolveAdvertisedPort = resolveAdvertisedPort;
-exports.selectViewerEndpoints = selectViewerEndpoints;
 exports.shouldAdvertiseIpv6 = shouldAdvertiseIpv6;