@camstack/system 1.2.358 → 1.2.360

package/dist/builtins/local-network/local-network.addon.js

@@ -1,11 +1,237 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DzAHit0a.js");
+const require_dist = require("../../dist-Cv1lnnQq.js");
 const require_tls = require("../../tls-CCMX7MjX.js");
+let zod = require("zod");
 let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);
 let node_fs = require("node:fs");
 let node_net = require("node:net");
+//#region src/builtins/local-network/address-book.ts
+/**
+* The Network page's address book, as pure functions: custom addresses plus
+* the role flags carried by detected and custom addresses alike.
+*
+* ## Storage (D734)
+*
+* One key per role: `appConnectionUrls` (`appConnections`, many),
+* `notificationTapUrl` (`notificationTaps`), `publicEndpointUrl`
+* (`publicEndpoint`) and `internalUrl` (`internal`). A single-valued role is
+* one URL — at most one address carries it, by construction. `''` / `[]` is
+* automatic. The custom addresses are `customAddresses` (url + label).
+*
+* The keys of the earlier role names (`viewerBaseUrls`, `notificationBaseUrl`,
+* `signInBaseUrl`, `agentBaseUrl`) are not read: a value stored under one is
+* ignored, and that role is automatic until the operator flags it again
+* (D734 — one install, re-set by hand, no migration code).
+*
+* ## A flag on an address that is in no row
+*
+* A flagged detected address can disappear (a DHCP move) while it still wins
+* its role. {@link normalizeAddressBook} turns every single-valued flag that
+* names neither a detected address, a custom one nor the app link into a
+* custom address carrying that role, on every read; the next write persists
+* the result — so the address shows as a custom row instead of vanishing.
+*/
+var CustomAddressListSchema = zod.z.array(zod.z.object({
+	baseUrl: zod.z.string(),
+	label: zod.z.string()
+}));
+/** The label a flag promoted to a custom address is given. */
+var PROMOTED_LABEL = {
+	notificationTaps: "Notification taps address",
+	internal: "Internal address",
+	publicEndpoint: "Public endpoint"
+};
+var SINGLE_ROLES = [
+	"notificationTaps",
+	"internal",
+	"publicEndpoint"
+];
+function flagOf(value) {
+	return value === "" ? null : value;
+}
+/** Parse the stored custom list; a malformed store reads as empty, never throws. */
+function parseCustomAddresses(raw) {
+	const parsed = CustomAddressListSchema.safeParse(raw ?? []);
+	return parsed.success ? parsed.data : [];
+}
+/**
+* The address book as it stands: stored custom addresses, plus every
+* single-valued flag that names neither a detected address, a custom one nor
+* the app link, promoted to a custom address (see the module doc).
+*/
+function normalizeAddressBook(stored, detectedUrls) {
+	const flags = {
+		appConnections: stored.appConnectionUrls,
+		notificationTaps: flagOf(stored.notificationTapUrl),
+		internal: flagOf(stored.internalUrl),
+		publicEndpoint: flagOf(stored.publicEndpointUrl)
+	};
+	const custom = [...parseCustomAddresses(stored.customAddresses)];
+	for (const role of SINGLE_ROLES) {
+		const url = flags[role];
+		if (url === null || require_dist.isAppLinkBase(url) || detectedUrls.has(url)) continue;
+		if (custom.some((c) => c.baseUrl === url)) continue;
+		custom.push({
+			baseUrl: url,
+			label: PROMOTED_LABEL[role]
+		});
+	}
+	return {
+		custom,
+		flags
+	};
+}
+/** The stored-settings patch that persists `state`. */
+function addressBookPatch(state) {
+	return {
+		customAddresses: state.custom,
+		appConnectionUrls: state.flags.appConnections,
+		notificationTapUrl: state.flags.notificationTaps ?? "",
+		publicEndpointUrl: state.flags.publicEndpoint ?? "",
+		internalUrl: state.flags.internal ?? ""
+	};
+}
+function withCustomAddress(state, entry) {
+	const custom = state.custom.some((c) => c.baseUrl === entry.baseUrl) ? state.custom.map((c) => c.baseUrl === entry.baseUrl ? entry : c) : [...state.custom, entry];
+	return {
+		...state,
+		custom
+	};
+}
+/** Drop a custom address and every flag it carried (those roles turn automatic). */
+function withoutCustomAddress(state, baseUrl) {
+	const clear = (flag) => flag === baseUrl ? null : flag;
+	return {
+		custom: state.custom.filter((c) => c.baseUrl !== baseUrl),
+		flags: {
+			appConnections: state.flags.appConnections.filter((u) => u !== baseUrl),
+			notificationTaps: clear(state.flags.notificationTaps),
+			internal: clear(state.flags.internal),
+			publicEndpoint: clear(state.flags.publicEndpoint)
+		}
+	};
+}
+/** Every role back to automatic for `role`. */
+function withRoleAutomatic(state, role) {
+	return role === "appConnections" ? {
+		...state,
+		flags: {
+			...state.flags,
+			appConnections: []
+		}
+	} : {
+		...state,
+		flags: {
+			...state.flags,
+			[role]: null
+		}
+	};
+}
+/**
+* Flag or unflag `baseUrl` for `role`. A single-valued role flagged here moves
+* off every other address (it is one URL); unflagging the address that carries
+* it returns the role to automatic. The app link flagged for notification
+* taps IS the automatic answer, stored as automatic — one representation.
+* `appConnections` toggles inside the set; toggling while automatic starts
+* from the automatic set (`autoApp`) so the other addresses keep racing.
+*/
+function withRoleFlag(state, role, baseUrl, enabled, autoApp) {
+	if (role === "appConnections") {
+		const without = (state.flags.appConnections.length === 0 ? autoApp : state.flags.appConnections).filter((u) => u !== baseUrl);
+		const appConnections = enabled ? [...without, baseUrl] : without;
+		return {
+			...state,
+			flags: {
+				...state.flags,
+				appConnections
+			}
+		};
+	}
+	if (role === "notificationTaps" && require_dist.isAppLinkBase(baseUrl)) return withRoleAutomatic(state, role);
+	if (enabled) return {
+		...state,
+		flags: {
+			...state.flags,
+			[role]: baseUrl
+		}
+	};
+	return state.flags[role] === baseUrl ? withRoleAutomatic(state, role) : state;
+}
+/** What a row may be flagged with. */
+function eligibleRoles(endpoint) {
+	if (endpoint.kind === "loopback") return [];
+	if (endpoint.kind === "app-link") return ["notificationTaps"];
+	return [
+		"appConnections",
+		"notificationTaps",
+		"internal",
+		"publicEndpoint"
+	];
+}
+/** A custom address as a palette entry (`kind: 'custom'`). */
+function customEndpoint(entry) {
+	return {
+		label: entry.label === "" ? "Custom address" : entry.label,
+		baseUrl: entry.baseUrl,
+		kind: "custom",
+		interfaceKind: "other",
+		plausible: true,
+		plausibleReason: "",
+		priority: 200
+	};
+}
+/**
+* The palette a client races: the detected endpoints plus the custom
+* addresses flagged `appConnections` (a detected URL is never listed twice).
+*/
+function withAppConnectionCustomEndpoints(detected, state) {
+	const known = new Set(detected.map((e) => e.baseUrl));
+	const wanted = new Set(state.flags.appConnections);
+	const extra = state.custom.filter((c) => wanted.has(c.baseUrl) && !known.has(c.baseUrl)).map(customEndpoint);
+	return [...detected, ...extra];
+}
+/** Every role's answer — the resolvers from `@camstack/types`, nothing else. */
+function resolveRoles(state, appPalette, httpsPalette) {
+	return require_dist.resolveHubAddressRoles(withAppConnectionCustomEndpoints(appPalette, state), httpsPalette, state.flags);
+}
+function flagsOn(state, baseUrl) {
+	const out = [];
+	if (state.flags.appConnections.includes(baseUrl)) out.push("appConnections");
+	for (const role of SINGLE_ROLES) if (state.flags[role] === baseUrl) out.push(role);
+	return out;
+}
+function inUseOn(roles, baseUrl) {
+	const out = [];
+	if (roles.appConnections.resolved.includes(baseUrl)) out.push("appConnections");
+	for (const role of SINGLE_ROLES) if (roles[role].resolved === baseUrl) out.push(role);
+	return out;
+}
+/** The Addresses table: app link, detected rows, then custom-only rows. */
+function buildAddressBook(state, inputs) {
+	const roles = resolveRoles(state, inputs.rowsPalette, inputs.httpsPalette);
+	const customUrls = new Set(state.custom.map((c) => c.baseUrl));
+	const detectedUrls = new Set(inputs.rowsPalette.map((e) => e.baseUrl));
+	const row = (endpoint, detected) => ({
+		...endpoint,
+		detected,
+		custom: customUrls.has(endpoint.baseUrl),
+		flags: endpoint.kind === "app-link" ? [] : flagsOn(state, endpoint.baseUrl),
+		inUse: endpoint.kind === "app-link" ? roles.notificationTaps.resolved === "https://camstack.zentik.app" ? ["notificationTaps"] : [] : inUseOn(roles, endpoint.baseUrl),
+		eligible: eligibleRoles(endpoint)
+	});
+	return {
+		rows: [
+			row(inputs.appLink, false),
+			...inputs.rowsPalette.map((e) => row(e, true)),
+			...state.custom.filter((c) => !detectedUrls.has(c.baseUrl)).map((c) => row(customEndpoint(c), false))
+		],
+		roles,
+		appLinkHub: inputs.appLinkHub
+	};
+}
+//#endregion
 //#region src/builtins/local-network/ipv6-lan.ts
 /**
 * IPv6 helpers for LAN advertisement: prefix matching (privacy addresses
@@ -197,72 +423,137 @@ var LocalNetworkAddon = class extends require_dist.BaseAddon {
 		super({
 			allowedAddresses: [],
 			bootSeeded: false,
-			notificationBaseUrl: "",
-			viewerBaseUrls: [],
+			notificationTapUrl: "",
+			appConnectionUrls: [],
+			customAddresses: [],
 			httpEnabled: true,
 			httpPort: require_tls.DEFAULT_LAN_HTTP_PORT,
 			localHostname: "",
-			agentBaseUrl: "",
-			signInBaseUrl: ""
+			internalUrl: "",
+			publicEndpointUrl: ""
 		});
 	}
 	/**
-	* Both audiences' hub address: the override when set, else the automatic
-	* pick over the HTTPS palette (`resolveHubAddress`). The one reading every
-	* consumer goes through — `getHubAddresses`.
+	* The detected palettes, with the mesh reconciled once: `https` (what
+	* `internal` and `publicEndpoint` resolve over, and the app link's `hub=`)
+	* and `http` (what the app-connections race resolves over).
 	*/
-	async snapshotHubAddresses() {
+	async palettes() {
 		const port = (await this.resolveAdvertisedListenPort(null)).port;
-		const palette = await this.buildAdvertisedEndpoints(false, false, "https", port);
+		await this.reconcileMeshEndpoint();
 		return {
-			cluster: require_dist.resolveHubAddress(palette, "cluster", this.config.agentBaseUrl || null),
-			browser: require_dist.resolveHubAddress(palette, "browser", this.config.signInBaseUrl || null)
+			http: this.endpointsNow(false, false, "http", port),
+			https: this.endpointsNow(false, false, "https", port)
 		};
 	}
+	/** The stored address book, normalised against what is detected now. */
+	addressState(detected) {
+		return normalizeAddressBook(this.config, new Set(detected.map((e) => e.baseUrl)));
+	}
+	/** The role flags alone — they do not depend on what is detected. */
+	storedFlags() {
+		return normalizeAddressBook(this.config, /* @__PURE__ */ new Set()).flags;
+	}
+	/** `getAddresses`: the Addresses table and every role's answer. */
+	async addressBook(scheme) {
+		const { http, https } = await this.palettes();
+		return buildAddressBook(this.addressState([...http, ...https]), {
+			rowsPalette: scheme === "http" ? http : https,
+			httpsPalette: https,
+			appLink: appLinkEndpoint(),
+			appLinkHub: require_dist.pickAppLinkHub(https)
+		});
+	}
 	/**
-	* The effective flagged notification address: the operator's explicit
-	* choice, else AUTO — the CamStack app link (D709, operator decision
-	* 2026-10-06; before it AUTO was the tunnel, then the mesh). The app link is
-	* not a hub address: the NC's signed media and buttons keep their own hub
-	* ladder when it is flagged; only viewer taps take the app form.
+	* Apply one change to the address book and persist it, normalised (a flag
+	* naming an address in no row becomes a custom address in the same write).
 	*/
-	resolveNotificationEndpoint() {
-		const explicit = this.config.notificationBaseUrl;
-		return explicit !== "" ? explicit : require_dist.CAMSTACK_APP_LINK_ORIGIN;
+	async changeAddressBook(change) {
+		const { http, https } = await this.palettes();
+		const detected = [...http, ...https];
+		const detectedUrls = new Set(detected.map((e) => e.baseUrl));
+		const changed = change(this.addressState(detected), {
+			detectedUrls,
+			autoApp: [...new Set(detected.filter(require_dist.isDefaultAppConnectionEndpoint).map((e) => e.baseUrl))]
+		});
+		const after = normalizeAddressBook({
+			...addressBookPatch(changed),
+			customAddresses: changed.custom
+		}, detectedUrls);
+		await this.updateGlobalSettings(addressBookPatch(after));
+	}
+	/** The deprecated `getHubAddresses` shape, from the role resolvers. */
+	async snapshotHubAddresses() {
+		const { roles } = await this.addressBook("https");
+		const legacy = (r) => ({
+			override: r.flagged,
+			resolved: r.resolved,
+			source: r.source === "flagged" ? "override" : r.source
+		});
+		return {
+			cluster: legacy(roles.internal),
+			browser: legacy(roles.publicEndpoint)
+		};
 	}
 	/**
-	* The `hub=` an app link carries: the best public HTTPS address in this
-	* cap's own palette (tunnel, then mesh) — so it can never disagree with
-	* what the Network page lists. See `pickAppLinkHub`.
+	* Flag / unflag `baseUrl` for `role`, or (`baseUrl: null`) return the role
+	* to automatic. Validated: the address must be a row (detected, custom, or
+	* the app link for `notificationTaps`), never loopback, and
+	* `publicEndpoint` on plain http only when accepted. A refusal stores nothing.
 	*/
-	async resolveAppLinkHub() {
-		const port = (await this.resolveAdvertisedListenPort(null)).port;
-		return require_dist.pickAppLinkHub(await this.buildAdvertisedEndpoints(false, false, "https", port));
+	async setRole(role, baseUrl, enabled, acceptInsecureHttp) {
+		if (baseUrl === null || baseUrl.trim() === "" && role !== "appConnections") {
+			await this.changeAddressBook((state) => withRoleAutomatic(state, role));
+			this.ctx.logger.info("local-network: address role set to automatic", { meta: { role } });
+			return;
+		}
+		let target = baseUrl.trim();
+		if (enabled) {
+			const check = require_dist.checkRoleAddress(role, target, { acceptInsecureHttp });
+			if (!check.ok) throw new Error(check.reason);
+			target = check.baseUrl;
+		}
+		await this.changeAddressBook((state, ctx) => {
+			const known = require_dist.isAppLinkBase(target) || ctx.detectedUrls.has(target) || state.custom.some((c) => c.baseUrl === target);
+			if (enabled && !known && role !== "notificationTaps") throw new Error(`${target} is not in the address list — add it as a custom address first.`);
+			return withRoleFlag(state, role, target, enabled, ctx.autoApp);
+		});
+		this.ctx.logger.info("local-network: address role set", { meta: {
+			role,
+			baseUrl: target,
+			enabled
+		} });
 	}
 	async notificationEndpointSnapshot() {
-		const explicit = this.config.notificationBaseUrl;
+		const resolution = require_dist.resolveNotificationTapAddress(this.storedFlags());
+		const port = (await this.resolveAdvertisedListenPort(null)).port;
 		return {
-			baseUrl: explicit === "" ? null : explicit,
-			resolved: this.resolveNotificationEndpoint(),
-			appLinkHub: await this.resolveAppLinkHub()
+			baseUrl: resolution.flagged,
+			resolved: resolution.resolved,
+			appLinkHub: require_dist.pickAppLinkHub(await this.buildAdvertisedEndpoints(false, false, "https", port))
 		};
 	}
 	async snapshotViewerEndpoints() {
-		const selected = selectViewerEndpoints(await this.buildAdvertisedEndpoints(false, false, "http", (await this.resolveAdvertisedListenPort(null)).port), this.config.viewerBaseUrls);
+		const resolution = require_dist.resolveAppConnections(await this.buildAdvertisedEndpoints(false, false, "http", (await this.resolveAdvertisedListenPort(null)).port), this.storedFlags());
 		return {
-			baseUrls: this.config.viewerBaseUrls,
-			resolved: selected.map((e) => e.baseUrl)
+			baseUrls: resolution.flagged,
+			resolved: resolution.resolved
 		};
 	}
 	/**
-	* Palette shown in the Network tab: LAN IPv4, stable LAN IPv6, public,
-	* mesh. The viewer HTTP/WS race is a subset (`selectViewerEndpoints`) —
-	* IPv6 stays in this list because ICE/WebRTC gathers it regardless.
+	* Palette shown to clients: LAN IPv4, stable LAN IPv6, public, mesh, and
+	* the custom addresses flagged `appConnections` (`kind: 'custom'`). The app
+	* HTTP/WS race is a subset (`selectAppConnectionEndpoints`) — IPv6 stays in this
+	* list because ICE/WebRTC gathers it regardless.
 	*/
 	async buildAdvertisedEndpoints(includeLoopback, ipv4Only, scheme, httpsPort) {
-		const allow = this.config.allowedAddresses;
-		const interfaces = applyAllowlist(this.enumerate(), allow);
 		await this.reconcileMeshEndpoint();
+		const detected = this.endpointsNow(includeLoopback, ipv4Only, scheme, httpsPort);
+		return withAppConnectionCustomEndpoints(detected, this.addressState(detected));
+	}
+	/** The DETECTED palette from the cached interface/tunnel/mesh state. */
+	endpointsNow(includeLoopback, ipv4Only, scheme, httpsPort) {
+		const interfaces = applyAllowlist(this.enumerate(), this.config.allowedAddresses);
 		const httpState = require_tls.readLanHttpState();
 		return buildEndpoints(interfaces, httpsPort, includeLoopback, ipv4Only, this.publicHostname, scheme, this.meshEndpoint, {
 			enabled: this.config.httpEnabled !== false,
@@ -305,35 +596,50 @@ var LocalNetworkAddon = class extends require_dist.BaseAddon {
 			},
 			getNotificationEndpoint: async () => this.notificationEndpointSnapshot(),
 			setNotificationEndpoint: async ({ baseUrl }) => {
-				await this.updateGlobalSettings({ notificationBaseUrl: baseUrl ?? "" });
-				this.ctx.logger.info("local-network: notification endpoint set", { meta: { baseUrl: baseUrl ?? "(auto)" } });
+				await this.setRole("notificationTaps", baseUrl, true, false);
 				return this.notificationEndpointSnapshot();
 			},
-			getHubAddresses: async () => this.snapshotHubAddresses(),
-			setHubAddress: async ({ audience, baseUrl }) => {
-				let stored = "";
-				if (baseUrl !== null && baseUrl.trim() !== "") {
-					const check = require_dist.validateHubAddressOverride(baseUrl);
-					if (!check.ok) throw new Error(check.reason);
-					stored = check.baseUrl;
-				}
-				await this.updateGlobalSettings(audience === "cluster" ? { agentBaseUrl: stored } : { signInBaseUrl: stored });
-				this.ctx.logger.info("local-network: hub address override set", { meta: {
-					audience,
-					baseUrl: stored === "" ? "(auto)" : stored
-				} });
-				return this.snapshotHubAddresses();
-			},
 			getViewerEndpoints: async () => this.snapshotViewerEndpoints(),
 			setViewerEndpoints: async ({ baseUrls }) => {
-				const cleaned = [...new Set(baseUrls.filter((u) => u.length > 0))];
-				await this.updateGlobalSettings({ viewerBaseUrls: cleaned });
-				this.ctx.logger.info("local-network: viewer endpoints set", { meta: {
-					count: cleaned.length,
-					auto: cleaned.length === 0
+				const appConnections = [...new Set(baseUrls.filter((u) => u.length > 0))];
+				await this.changeAddressBook((state) => ({
+					...state,
+					flags: {
+						...state.flags,
+						appConnections
+					}
+				}));
+				this.ctx.logger.info("local-network: app connections set", { meta: {
+					count: appConnections.length,
+					auto: appConnections.length === 0
 				} });
 				return this.snapshotViewerEndpoints();
 			},
+			getAddresses: async (input) => this.addressBook(input?.scheme ?? "https"),
+			addCustomAddress: async ({ baseUrl, label }) => {
+				const check = require_dist.validateCustomAddress(baseUrl);
+				if (!check.ok) throw new Error(check.reason);
+				const entry = {
+					baseUrl: check.baseUrl,
+					label: label.trim()
+				};
+				await this.changeAddressBook((state) => withCustomAddress(state, entry));
+				this.ctx.logger.info("local-network: custom address added", { meta: {
+					baseUrl: entry.baseUrl,
+					label: entry.label
+				} });
+				return this.addressBook("https");
+			},
+			removeCustomAddress: async ({ baseUrl }) => {
+				await this.changeAddressBook((state) => withoutCustomAddress(state, baseUrl));
+				this.ctx.logger.info("local-network: custom address removed", { meta: { baseUrl } });
+				return this.addressBook("https");
+			},
+			setAddressRole: async ({ role, baseUrl, enabled, acceptInsecureHttp }) => {
+				await this.setRole(role, baseUrl, enabled, acceptInsecureHttp === true);
+				return this.addressBook("https");
+			},
+			getHubAddresses: async () => this.snapshotHubAddresses(),
 			getAllowedAddresses: async () => ({ addresses: this.config.allowedAddresses }),
 			resetAllowlistToBestMatch: async () => {
 				const seed = autoSeedAllowlist(this.enumerate());
@@ -875,25 +1181,6 @@ function buildEndpoints(interfaces, port, includeLoopback, ipv4Only, publicHostn
 	});
 	return out.toSorted((a, b) => a.priority - b.priority);
 }
-/** AUTO viewer race: LAN IPv4 + the public tunnel. Never IPv6, mesh, or loopback. */
-function isDefaultViewerEndpoint(endpoint) {
-	if (endpoint.kind === "lan-ipv4") return true;
-	return endpoint.kind === "public" && endpoint.interfaceKind === "public";
-}
-/**
-* The URLs the SDK should race for API / viewer access.
-*
-* Empty `viewerBaseUrls` = AUTO (IPv4 + public tunnel). A non-empty list is
-* the operator's pin; if none of those URLs are in the current palette,
-* fall back to AUTO rather than racing an empty set.
-*/
-function selectViewerEndpoints(endpoints, viewerBaseUrls) {
-	const auto = endpoints.filter(isDefaultViewerEndpoint);
-	if (viewerBaseUrls.length === 0) return auto;
-	const wanted = new Set(viewerBaseUrls);
-	const explicit = endpoints.filter((e) => wanted.has(e.baseUrl));
-	return explicit.length > 0 ? explicit : auto;
-}
 /**
 * First-boot heuristic: which addresses should the allowlist start
 * with? Includes LAN + Wi-Fi IPv4 addresses + plausible IPv6:
@@ -1032,12 +1319,10 @@ exports.classifyKind = classifyKind;
 exports.enumerateOsInterfaces = enumerateOsInterfaces;
 exports.explainNonPlausible = explainNonPlausible;
 exports.ipv6Prefix64Key = ipv6Prefix64Key;
-exports.isDefaultViewerEndpoint = isDefaultViewerEndpoint;
 exports.isPlausibleAutoSeed = isPlausibleAutoSeed;
 exports.parseProcIfInet6 = parseProcIfInet6;
 exports.pickPreferred = pickPreferred;
 exports.prefixLen = prefixLen;
 exports.reconcileAllowlist = reconcileAllowlist;
 exports.resolveAdvertisedPort = resolveAdvertisedPort;
-exports.selectViewerEndpoints = selectViewerEndpoints;
 exports.shouldAdvertiseIpv6 = shouldAdvertiseIpv6;