@camstack/system 1.2.390 → 1.2.391

package/dist/builtins/local-auth/local-auth.addon.d.ts

@@ -1,43 +1,44 @@
-import { ProviderRegistration, BaseAddon } from '@camstack/types';
+import type { ProviderRegistration } from "@camstack/types";
+import { BaseAddon } from "@camstack/types";
 export declare class LocalAuthAddon extends BaseAddon {
-    private authManager;
-    private userManager;
-    private apiKeyManager;
-    private scopedTokenManager;
-    private oauthSessionManager;
-    private reapTimer;
-    private totpManager;
-    private externalIdentities;
-    private signingKeyKeeper;
-    private loginSessions;
-    private adminTokens;
-    private auditLog;
-    constructor();
-    protected onInitialize(): Promise<ProviderRegistration[]>;
-    /**
-     * The hub-internal surface (`user-management-internal.ts`): operations no
-     * wire may reach. Called only by hub code holding this provider object.
-     */
-    private buildInternal;
-    /**
-     * End every way `userId` could still get in: login sessions (and the
-     * pre-session tokens, via the cutoff), scoped tokens, OAuth account links,
-     * the TOTP row and the external sign-in links. Each step is attempted even
-     * if an earlier one fails, and a failure is logged — a half-cleaned user is
-     * worse than a loud one.
-     */
-    private endAllAccess;
-    /**
-     * Drop auth rows that are dead but were never removed: scoped tokens past
-     * their expiry, and OAuth sessions revoked longer ago than
-     * {@link OAUTH_REVOKED_RETENTION_MS}.
-     *
-     * Neither row could authorise anything — `validate` rejects an expired
-     * token, and every consumer treats a missing session exactly like a revoked
-     * one. So this is hygiene, and it is best-effort: a failed sweep is logged
-     * and the next tick tries again. It must never be able to fail boot.
-     */
-    private reapAuthRows;
-    protected onShutdown(): Promise<void>;
+	private authManager;
+	private userManager;
+	private apiKeyManager;
+	private scopedTokenManager;
+	private oauthSessionManager;
+	private reapTimer;
+	private totpManager;
+	private externalIdentities;
+	private signingKeyKeeper;
+	private loginSessions;
+	private adminTokens;
+	private auditLog;
+	constructor();
+	protected onInitialize(): Promise<ProviderRegistration[]>;
+	/**
+	* The hub-internal surface (`user-management-internal.ts`): operations no
+	* wire may reach. Called only by hub code holding this provider object.
+	*/
+	private buildInternal;
+	/**
+	* End every way `userId` could still get in: login sessions (and the
+	* pre-session tokens, via the cutoff), scoped tokens, OAuth account links,
+	* the TOTP row and the external sign-in links. Each step is attempted even
+	* if an earlier one fails, and a failure is logged — a half-cleaned user is
+	* worse than a loud one.
+	*/
+	private endAllAccess;
+	/**
+	* Drop auth rows that are dead but were never removed: scoped tokens past
+	* their expiry, and OAuth sessions revoked longer ago than
+	* {@link OAUTH_REVOKED_RETENTION_MS}.
+	*
+	* Neither row could authorise anything — `validate` rejects an expired
+	* token, and every consumer treats a missing session exactly like a revoked
+	* one. So this is hygiene, and it is best-effort: a failed sweep is logged
+	* and the next tick tries again. It must never be able to fail boot.
+	*/
+	private reapAuthRows;
+	protected onShutdown(): Promise<void>;
 }
 export default LocalAuthAddon;

package/dist/builtins/local-auth/oauth-grants.d.ts

@@ -1,71 +1,71 @@
-import { ISsoBridgeProvider, TokenScope } from '@camstack/types';
-import { OauthSessionManager } from './oauth-session-manager.js';
+import type { ISsoBridgeProvider, TokenScope } from "@camstack/types";
+import type { OauthSessionManager } from "./oauth-session-manager.js";
 /**
- * The refresh lifetime for an integration whose descriptor declares none.
- * 30 days — the value every link used before `refreshTokenTtlSec` existed, kept
- * as the default so an integration that says nothing is unchanged.
- */
-export declare const DEFAULT_REFRESH_TTL_SEC = 2592000;
+* The refresh lifetime for an integration whose descriptor declares none.
+* 30 days — the value every link used before `refreshTokenTtlSec` existed, kept
+* as the default so an integration that says nothing is unchanged.
+*/
+export declare const DEFAULT_REFRESH_TTL_SEC = 2592e3;
 /** Seconds, or `'never'` for a refresh token minted with no `exp` claim. */
-export type RefreshTtl = number | 'never';
+export type RefreshTtl = number | "never";
 interface IssueCodeInput {
-    integrationId: string;
-    userId: string;
-    username: string;
-    scopes: TokenScope[];
-    redirectUri: string;
-    hubUrl: string;
-    codeChallenge?: string;
-    /**
-     * From the integration's `OauthIntegrationDescriptor.refreshTokenTtlSec`.
-     * Baked into the CODE so it travels with the link: re-reading the descriptor
-     * at refresh time would let an edit retroactively change the lifetime of a
-     * grant the operator already consented to.
-     */
-    refreshTtlSec?: RefreshTtl;
+	integrationId: string;
+	userId: string;
+	username: string;
+	scopes: TokenScope[];
+	redirectUri: string;
+	hubUrl: string;
+	codeChallenge?: string;
+	/**
+	* From the integration's `OauthIntegrationDescriptor.refreshTokenTtlSec`.
+	* Baked into the CODE so it travels with the link: re-reading the descriptor
+	* at refresh time would let an edit retroactively change the lifetime of a
+	* grant the operator already consented to.
+	*/
+	refreshTtlSec?: RefreshTtl;
 }
 /**
- * PKCE S256 check (RFC 7636 §4.6): `BASE64URL(SHA256(verifier)) === challenge`.
- *
- * Keyed off the CLAIM, never off the descriptor: a code minted with a challenge
- * stays unusable without the verifier even if the integration later stops
- * requiring PKCE. Constant-time compare so a wrong verifier cannot be walked
- * byte by byte inside the code's 60 s window.
- */
+* PKCE S256 check (RFC 7636 §4.6): `BASE64URL(SHA256(verifier)) === challenge`.
+*
+* Keyed off the CLAIM, never off the descriptor: a code minted with a challenge
+* stays unusable without the verifier even if the integration later stops
+* requiring PKCE. Constant-time compare so a wrong verifier cannot be walked
+* byte by byte inside the code's 60 s window.
+*/
 export declare function verifyPkceS256(challenge: string, verifier: string | undefined): boolean;
 interface TokenPair {
-    accessToken: string;
-    refreshToken: string;
-    expiresIn: number;
+	accessToken: string;
+	refreshToken: string;
+	expiresIn: number;
 }
 interface VerifiedAccess {
-    userId: string;
-    username: string;
-    scopes: TokenScope[];
+	userId: string;
+	username: string;
+	scopes: TokenScope[];
 }
 /** OAuth account-linking grant logic. Pure over an injected sso-bridge
- *  signer so it is unit-testable without the capability registry.
- *
- *  Authorization codes are short-lived (60 s). The `redirectUri`,
- *  `integrationId`, and a unique `jti` are embedded in the signed JWT
- *  so the HMAC signature is the real security boundary. Single-use is
- *  enforced by a `jti` consumed-set. The old in-process `pendingCodes`
- *  Map is gone — a hub restart no longer breaks in-flight exchanges,
- *  only risking a single replay within the remaining 60 s TTL. */
+*  signer so it is unit-testable without the capability registry.
+*
+*  Authorization codes are short-lived (60 s). The `redirectUri`,
+*  `integrationId`, and a unique `jti` are embedded in the signed JWT
+*  so the HMAC signature is the real security boundary. Single-use is
+*  enforced by a `jti` consumed-set. The old in-process `pendingCodes`
+*  Map is gone — a hub restart no longer breaks in-flight exchanges,
+*  only risking a single replay within the remaining 60 s TTL. */
 export declare function createOauthGrants(ssoBridge: ISsoBridgeProvider, sessionManager: OauthSessionManager): {
-    oauthIssueCode(input: IssueCodeInput): Promise<{
-        code: string;
-    }>;
-    oauthExchangeCode(input: {
-        code: string;
-        redirectUri: string;
-        codeVerifier?: string;
-    }): Promise<TokenPair | null>;
-    oauthRefresh(input: {
-        refreshToken: string;
-    }): Promise<TokenPair | null>;
-    oauthVerifyAccessToken(input: {
-        token: string;
-    }): Promise<VerifiedAccess | null>;
+	oauthIssueCode(input: IssueCodeInput): Promise<{
+		code: string;
+	}>;
+	oauthExchangeCode(input: {
+		code: string;
+		redirectUri: string;
+		codeVerifier?: string;
+	}): Promise<TokenPair | null>;
+	oauthRefresh(input: {
+		refreshToken: string;
+	}): Promise<TokenPair | null>;
+	oauthVerifyAccessToken(input: {
+		token: string;
+	}): Promise<VerifiedAccess | null>;
 };
 export {};

package/dist/builtins/local-auth/oauth-session-manager.d.ts

@@ -1,69 +1,69 @@
-import { SettingsStoreClient, TokenScope } from '@camstack/types';
+import type { SettingsStoreClient, TokenScope } from "@camstack/types";
 export interface OauthSession {
-    readonly id: string;
-    readonly userId: string;
-    readonly username: string;
-    readonly integrationId: string;
-    readonly scopes: TokenScope[];
-    readonly createdAt: number;
-    readonly lastUsedAt: number;
-    readonly revokedAt: number | null;
+	readonly id: string;
+	readonly userId: string;
+	readonly username: string;
+	readonly integrationId: string;
+	readonly scopes: TokenScope[];
+	readonly createdAt: number;
+	readonly lastUsedAt: number;
+	readonly revokedAt: number | null;
 }
 interface CreateInput {
-    readonly userId: string;
-    readonly username: string;
-    readonly integrationId: string;
-    readonly scopes: TokenScope[];
+	readonly userId: string;
+	readonly username: string;
+	readonly integrationId: string;
+	readonly scopes: TokenScope[];
 }
 export declare class OauthSessionManager {
-    private readonly store;
-    constructor(store: SettingsStoreClient);
-    /**
-     * Create a new OAuth session record. Generates a UUID as the session id,
-     * sets `createdAt` and `lastUsedAt` to now, `revokedAt` to null.
-     */
-    create(input: CreateInput): Promise<OauthSession>;
-    /**
-     * Return all sessions — both active and revoked. Callers decide
-     * whether to filter by `revokedAt`.
-     */
-    list(): Promise<OauthSession[]>;
-    /**
-     * Look up a session by its id. Returns null when not found.
-     */
-    getById(id: string): Promise<OauthSession | null>;
-    /**
-     * Mark a session as revoked by setting `revokedAt = now`.
-     *
-     * - Returns `true` on success (including idempotent re-revoke — the
-     *   existing `revokedAt` timestamp is preserved; it is NOT updated).
-     * - Returns `false` when the session id is not found.
-     */
-    markRevoked(id: string): Promise<boolean>;
-    /**
-     * Delete sessions revoked longer ago than `horizonMs`.
-     *
-     * Safe because an ABSENT session already fails closed exactly like a revoked
-     * one: every consumer in `oauth-grants.ts` reads
-     * `if (!session || session.revokedAt != null) return null`. Deleting the row
-     * therefore cannot re-enable a link that was cut — it removes a record whose
-     * only remaining job was to say "no", which the absence says too.
-     *
-     * A retention window rather than an immediate delete: a revoked account link
-     * is the kind of thing an operator looks up AFTER the fact ("when did I
-     * unlink that?"), and the row is tiny. Active sessions are never touched —
-     * the filter matches only rows with a `revokedAt` timestamp in range, and
-     * `revokedAt` is NULL on every live session, which SQL's `BETWEEN` never
-     * matches.
-     *
-     * Returns how many rows went.
-     */
-    reapRevoked(horizonMs: number): Promise<number>;
-    /**
-     * Update `lastUsedAt` to now. No-op (does not throw) when the session
-     * id is not found — the caller (token-use hot path) should not fail
-     * for a missing session that may have been concurrently revoked.
-     */
-    touch(id: string): Promise<void>;
+	private readonly store;
+	constructor(store: SettingsStoreClient);
+	/**
+	* Create a new OAuth session record. Generates a UUID as the session id,
+	* sets `createdAt` and `lastUsedAt` to now, `revokedAt` to null.
+	*/
+	create(input: CreateInput): Promise<OauthSession>;
+	/**
+	* Return all sessions — both active and revoked. Callers decide
+	* whether to filter by `revokedAt`.
+	*/
+	list(): Promise<OauthSession[]>;
+	/**
+	* Look up a session by its id. Returns null when not found.
+	*/
+	getById(id: string): Promise<OauthSession | null>;
+	/**
+	* Mark a session as revoked by setting `revokedAt = now`.
+	*
+	* - Returns `true` on success (including idempotent re-revoke — the
+	*   existing `revokedAt` timestamp is preserved; it is NOT updated).
+	* - Returns `false` when the session id is not found.
+	*/
+	markRevoked(id: string): Promise<boolean>;
+	/**
+	* Delete sessions revoked longer ago than `horizonMs`.
+	*
+	* Safe because an ABSENT session already fails closed exactly like a revoked
+	* one: every consumer in `oauth-grants.ts` reads
+	* `if (!session || session.revokedAt != null) return null`. Deleting the row
+	* therefore cannot re-enable a link that was cut — it removes a record whose
+	* only remaining job was to say "no", which the absence says too.
+	*
+	* A retention window rather than an immediate delete: a revoked account link
+	* is the kind of thing an operator looks up AFTER the fact ("when did I
+	* unlink that?"), and the row is tiny. Active sessions are never touched —
+	* the filter matches only rows with a `revokedAt` timestamp in range, and
+	* `revokedAt` is NULL on every live session, which SQL's `BETWEEN` never
+	* matches.
+	*
+	* Returns how many rows went.
+	*/
+	reapRevoked(horizonMs: number): Promise<number>;
+	/**
+	* Update `lastUsedAt` to now. No-op (does not throw) when the session
+	* id is not found — the caller (token-use hot path) should not fail
+	* for a missing session that may have been concurrently revoked.
+	*/
+	touch(id: string): Promise<void>;
 }
 export {};

package/dist/builtins/local-network/address-book.d.ts

@@ -1,35 +1,60 @@
-import { ConnectionEndpoint, HubAddressBook, HubAddressFlags, HubAddressRole } from '@camstack/types';
+/**
+* The Network page's address book, as pure functions: custom addresses plus
+* the role flags carried by detected and custom addresses alike.
+*
+* ## Storage (D734)
+*
+* One key per role: `appConnectionUrls` (`appConnections`, many),
+* `notificationTapUrl` (`notificationTaps`), `publicEndpointUrl`
+* (`publicEndpoint`) and `internalUrl` (`internal`). A single-valued role is
+* one URL — at most one address carries it, by construction. `''` / `[]` is
+* automatic. The custom addresses are `customAddresses` (url + label).
+*
+* The keys of the earlier role names (`viewerBaseUrls`, `notificationBaseUrl`,
+* `signInBaseUrl`, `agentBaseUrl`) are not read: a value stored under one is
+* ignored, and that role is automatic until the operator flags it again
+* (D734 — one install, re-set by hand, no migration code).
+*
+* ## A flag on an address that is in no row
+*
+* A flagged detected address can disappear (a DHCP move) while it still wins
+* its role. {@link normalizeAddressBook} turns every single-valued flag that
+* names neither a detected address, a custom one nor the app link into a
+* custom address carrying that role, on every read; the next write persists
+* the result — so the address shows as a custom row instead of vanishing.
+*/
+import { type ConnectionEndpoint, type HubAddressBook, type HubAddressFlags, type HubAddressRole } from "@camstack/types";
 export interface CustomAddress {
-    readonly baseUrl: string;
-    readonly label: string;
+	readonly baseUrl: string;
+	readonly label: string;
 }
 /** The address-book keys of the addon's stored settings. */
 export interface StoredAddressSettings {
-    readonly customAddresses: unknown;
-    readonly appConnectionUrls: readonly string[];
-    readonly notificationTapUrl: string;
-    readonly publicEndpointUrl: string;
-    readonly internalUrl: string;
+	readonly customAddresses: unknown;
+	readonly appConnectionUrls: readonly string[];
+	readonly notificationTapUrl: string;
+	readonly publicEndpointUrl: string;
+	readonly internalUrl: string;
 }
 export interface AddressBookState {
-    readonly custom: readonly CustomAddress[];
-    readonly flags: HubAddressFlags;
+	readonly custom: readonly CustomAddress[];
+	readonly flags: HubAddressFlags;
 }
 /** Parse the stored custom list; a malformed store reads as empty, never throws. */
 export declare function parseCustomAddresses(raw: unknown): readonly CustomAddress[];
 /**
- * The address book as it stands: stored custom addresses, plus every
- * single-valued flag that names neither a detected address, a custom one nor
- * the app link, promoted to a custom address (see the module doc).
- */
+* The address book as it stands: stored custom addresses, plus every
+* single-valued flag that names neither a detected address, a custom one nor
+* the app link, promoted to a custom address (see the module doc).
+*/
 export declare function normalizeAddressBook(stored: StoredAddressSettings, detectedUrls: ReadonlySet<string>): AddressBookState;
 /** The stored-settings patch that persists `state`. */
 export declare function addressBookPatch(state: AddressBookState): {
-    readonly customAddresses: readonly CustomAddress[];
-    readonly appConnectionUrls: readonly string[];
-    readonly notificationTapUrl: string;
-    readonly publicEndpointUrl: string;
-    readonly internalUrl: string;
+	readonly customAddresses: readonly CustomAddress[];
+	readonly appConnectionUrls: readonly string[];
+	readonly notificationTapUrl: string;
+	readonly publicEndpointUrl: string;
+	readonly internalUrl: string;
 };
 export declare function withCustomAddress(state: AddressBookState, entry: CustomAddress): AddressBookState;
 /** Drop a custom address and every flag it carried (those roles turn automatic). */
@@ -37,13 +62,13 @@ export declare function withoutCustomAddress(state: AddressBookState, baseUrl: s
 /** Every role back to automatic for `role`. */
 export declare function withRoleAutomatic(state: AddressBookState, role: HubAddressRole): AddressBookState;
 /**
- * Flag or unflag `baseUrl` for `role`. A single-valued role flagged here moves
- * off every other address (it is one URL); unflagging the address that carries
- * it returns the role to automatic. The app link flagged for notification
- * taps IS the automatic answer, stored as automatic — one representation.
- * `appConnections` toggles inside the set; toggling while automatic starts
- * from the automatic set (`autoApp`) so the other addresses keep racing.
- */
+* Flag or unflag `baseUrl` for `role`. A single-valued role flagged here moves
+* off every other address (it is one URL); unflagging the address that carries
+* it returns the role to automatic. The app link flagged for notification
+* taps IS the automatic answer, stored as automatic — one representation.
+* `appConnections` toggles inside the set; toggling while automatic starts
+* from the automatic set (`autoApp`) so the other addresses keep racing.
+*/
 export declare function withRoleFlag(state: AddressBookState, role: HubAddressRole, baseUrl: string, enabled: boolean, autoApp: readonly string[]): AddressBookState;
 /** What a row may be flagged with. */
 export declare function eligibleRoles(endpoint: ConnectionEndpoint): readonly HubAddressRole[];
@@ -51,19 +76,19 @@ export declare const CUSTOM_ADDRESS_PRIORITY = 200;
 /** A custom address as a palette entry (`kind: 'custom'`). */
 export declare function customEndpoint(entry: CustomAddress): ConnectionEndpoint;
 /**
- * The palette a client races: the detected endpoints plus the custom
- * addresses flagged `appConnections` (a detected URL is never listed twice).
- */
+* The palette a client races: the detected endpoints plus the custom
+* addresses flagged `appConnections` (a detected URL is never listed twice).
+*/
 export declare function withAppConnectionCustomEndpoints(detected: readonly ConnectionEndpoint[], state: AddressBookState): ConnectionEndpoint[];
 export interface AddressBookInputs {
-    /** Detected endpoints in the scheme the rows are shown in. */
-    readonly rowsPalette: readonly ConnectionEndpoint[];
-    /** Detected endpoints over HTTPS — what `internal` and `publicEndpoint` resolve over. */
-    readonly httpsPalette: readonly ConnectionEndpoint[];
-    readonly appLink: ConnectionEndpoint;
-    readonly appLinkHub: string | null;
+	/** Detected endpoints in the scheme the rows are shown in. */
+	readonly rowsPalette: readonly ConnectionEndpoint[];
+	/** Detected endpoints over HTTPS — what `internal` and `publicEndpoint` resolve over. */
+	readonly httpsPalette: readonly ConnectionEndpoint[];
+	readonly appLink: ConnectionEndpoint;
+	readonly appLinkHub: string | null;
 }
 /** Every role's answer — the resolvers from `@camstack/types`, nothing else. */
-export declare function resolveRoles(state: AddressBookState, appPalette: readonly ConnectionEndpoint[], httpsPalette: readonly ConnectionEndpoint[]): HubAddressBook['roles'];
+export declare function resolveRoles(state: AddressBookState, appPalette: readonly ConnectionEndpoint[], httpsPalette: readonly ConnectionEndpoint[]): HubAddressBook["roles"];
 /** The Addresses table: app link, detected rows, then custom-only rows. */
 export declare function buildAddressBook(state: AddressBookState, inputs: AddressBookInputs): HubAddressBook;

package/dist/builtins/local-network/index.d.ts

@@ -1,2 +1,2 @@
-export { LocalNetworkAddon, classifyKind, prefixLen } from './local-network.addon.js';
-export { LocalNetworkAddon as default } from './local-network.addon.js';
+export { LocalNetworkAddon, classifyKind, prefixLen } from "./local-network.addon.js";
+export { LocalNetworkAddon as default } from "./local-network.addon.js";

package/dist/builtins/local-network/ipv6-lan.d.ts

@@ -1,26 +1,21 @@
-/**
- * IPv6 helpers for LAN advertisement: prefix matching (privacy addresses
- * rotate inside a /64), Linux `/proc/net/if_inet6` flags, and the gate
- * that keeps temporary GUA off the connection candidate list.
- */
 /** First 64 bits, canonical hex groups, or null if the address is not IPv6. */
 export declare function ipv6Prefix64Key(address: string): string | null;
 /** 32-char lowercase hex (same encoding as `/proc/net/if_inet6`). */
 export declare function ipv6ToHex32(address: string): string | null;
 /**
- * Parse Linux `if_inet6` into hex32 → flags. Unknown / malformed lines
- * are skipped. Keys match {@link ipv6ToHex32}.
- */
+* Parse Linux `if_inet6` into hex32 → flags. Unknown / malformed lines
+* are skipped. Keys match {@link ipv6ToHex32}.
+*/
 export declare function parseProcIfInet6(text: string): ReadonlyMap<string, number>;
 /**
- * Whether this IPv6 should be auto-seeded / advertised.
- * `flags === undefined` means the platform did not tell us (macOS, tests
- * without a proc snapshot) — keep every non-link-local plausible address.
- *
- * On Linux, drop addresses marked TEMPORARY / DEPRECATED / TENTATIVE, and
- * `flags === 0` which is how this kernel reports RFC 4941 privacy temps
- * (the stable GUA is PERMANENT|NODAD). Do **not** require PERMANENT —
- * stateful DHCPv6 GUA often has only NODAD (0x02).
- */
+* Whether this IPv6 should be auto-seeded / advertised.
+* `flags === undefined` means the platform did not tell us (macOS, tests
+* without a proc snapshot) — keep every non-link-local plausible address.
+*
+* On Linux, drop addresses marked TEMPORARY / DEPRECATED / TENTATIVE, and
+* `flags === 0` which is how this kernel reports RFC 4941 privacy temps
+* (the stable GUA is PERMANENT|NODAD). Do **not** require PERMANENT —
+* stateful DHCPv6 GUA often has only NODAD (0x02).
+*/
 export declare function shouldAdvertiseIpv6(address: string, flags: number | undefined): boolean;
 export declare function ipv6AllowlistMatches(address: string, allowed: readonly string[]): boolean;

package/dist/builtins/local-network/local-hostname.d.ts

@@ -1,15 +1,15 @@
 export type ParseLocalHostnameResult = {
-    readonly ok: true;
-    readonly value: string | null;
+	readonly ok: true;
+	readonly value: string | null;
 } | {
-    readonly ok: false;
-    readonly error: string;
+	readonly ok: false;
+	readonly error: string;
 };
 /**
- * Parse the operator-typed local hostname.
- *
- * Empty / whitespace → `null` (advertise the raw LAN IP). A DNS name is
- * lowercased. A URL, port suffix, path, or bare IP is rejected so it cannot
- * leak into a SAN or a candidate URL.
- */
+* Parse the operator-typed local hostname.
+*
+* Empty / whitespace → `null` (advertise the raw LAN IP). A DNS name is
+* lowercased. A URL, port suffix, path, or bare IP is rejected so it cannot
+* leak into a SAN or a candidate URL.
+*/
 export declare function parseLocalHostname(raw: string): ParseLocalHostnameResult;