@openpalm/ui 0.13.0-beta.2 → 0.13.0-beta.4

package/build/server/chunks/{src-BwQUi60U.js → src-CQ2F7hgb.js}

@@ -1,12 +1,12 @@
-import { P as PROVIDER_DEFAULT_URLS, a as PROVIDER_KEY_MAP } from './provider-constants-1s1k8kbj.js';
-import { _ as __commonJSMin, b as __require } from './chunk-CLZ62Ad-.js';
+import { _ as __commonJSMin, b as __require, c as __toESM } from './chunk-DOvWTNp_.js';
+import { G as GUARDIAN_INGRESS_ADDON_IDS, B as BUILTIN_ADDON_IDS, P as PORTAL_SECRET_ADDON_IDS, v as validateNetworkPresetEnv, r as resolveNetworkPreset, b as PROVIDER_DEFAULT_URLS, i as isLoopback, c as PROVIDER_KEY_MAP, g as isNetworkAccessPreset } from './network-preset-CJ1RRnki.js';
 import Vt, { existsSync, readFileSync, copyFileSync, writeFileSync, chmodSync, mkdirSync, readdirSync, renameSync, statSync, rmSync, openSync, constants, writeSync, closeSync, lstatSync, chownSync } from 'node:fs';
 import { execFile, execFileSync } from 'node:child_process';
 import { createRequire } from 'node:module';
 import or, { resolve, join, dirname, win32, basename, posix, relative } from 'node:path';
 import { Buffer as Buffer$1 } from 'buffer';
 import { fileURLToPath } from 'node:url';
-import { homedir, tmpdir, hostname } from 'node:os';
+import { homedir, tmpdir, hostname, networkInterfaces } from 'node:os';
 import { createHash, randomBytes } from 'node:crypto';
 import Vr, { EventEmitter } from 'events';
 import I from 'fs';
@@ -7901,60 +7901,6 @@ function pruneBackupDirs(homeDir, keep) {
 	return toDelete;
 }
 //#endregion
-//#region ../lib/src/control-plane/addon-ids.ts
-/**
-* Canonical list of built-in addon IDs.
-*
-* Single source of truth — imported by both addons.ts and migrations.ts.
-* Update THIS file (and only this file) when adding or removing a built-in addon.
-*
-* Intentionally a pure-constants file with no imports so it can be safely
-* imported from anywhere without risk of circular dependencies.
-*/
-var BUILTIN_ADDON_IDS = [
-	"api",
-	"chat",
-	"discord",
-	"gateway",
-	"ollama",
-	"slack",
-	"voice"
-];
-/**
-* Addons whose ingress is served by the guardian container.
-*
-* Single source of truth for guardian deploy gating. Must mirror the Compose
-* profile gate on the guardian service in
-* `packages/skeleton/system/stack/portals.compose.yml`
-* (`profiles: [addon.chat, addon.api, addon.discord, addon.slack, addon.gateway]`):
-* enabling any of these requires the guardian, so the deploy set, the
-* expected-service seed, and the activation loop all deploy/health-wait on it.
-*
-* NOTE: broader than PORTAL_SECRET_ADDON_IDS — `gateway` uses the guardian but
-* has no portal secret of its own (see below). Keep the two lists distinct.
-*/
-var GUARDIAN_INGRESS_ADDON_IDS = [
-	"api",
-	"chat",
-	"discord",
-	"gateway",
-	"slack"
-];
-/**
-* First-party portals that own a dedicated `portal_<id>_secret`.
-*
-* Single source of truth for portal-secret provisioning (`ensurePortalSecret`).
-* Must mirror the `portal_*_secret` set the guardian mounts in
-* `portals.compose.yml` (chat, api, discord, slack). Excludes `gateway`, which
-* is guardian ingress but has no portal secret of its own.
-*/
-var PORTAL_SECRET_ADDON_IDS = [
-	"api",
-	"chat",
-	"discord",
-	"slack"
-];
-//#endregion
 //#region ../lib/src/control-plane/compose-services.ts
 var import_dist$1 = require_dist();
 /**
@@ -8126,7 +8072,7 @@ function ensureHomeDirs() {
 	for (const file of [`${home}/data/assistant/.local/share/opencode/auth.json`, `${home}/data/guardian/.local/share/opencode/auth.json`]) if (!existsSync(file)) writeFileSync(file, "");
 }
 var package_default = {
-	version: "0.13.0-beta.2"};
+	version: "0.13.0-beta.4"};
 //#endregion
 //#region ../lib/src/control-plane/versioning.ts
 var SEMVER_RE = /^v?\d+\.\d+\.\d+(?:[-+].*)?$/;
@@ -8248,7 +8194,7 @@ function sha256(content) {
 	return createHash("sha256").update(content).digest("hex");
 }
 /** Generate a hex string using Node's crypto.randomBytes (CSPRNG). */
-function randomHex(bytes) {
+function randomHex$1(bytes) {
 	return randomBytes(bytes).toString("hex");
 }
 //#endregion
@@ -8265,7 +8211,7 @@ function randomHex(bytes) {
 * Env validation has moved to `akm vault` + the in-house redactor — the
 * historical `.env.schema` files (varlock format) were retired in #391.
 */
-var logger$8 = createLogger("core-assets");
+var logger$8$1 = createLogger("core-assets");
 var _require$1 = createRequire(import.meta.url);
 function bundledAssetPath(relPath) {
 	try {
@@ -8289,7 +8235,7 @@ function readBundledStackAsset(name) {
 	try {
 		return readFileSync(bundledAssetPath(`system/stack/${name}`), "utf-8");
 	} catch (err) {
-		logger$8.warn("bundled stack asset unavailable (returning empty)", {
+		logger$8$1.warn("bundled stack asset unavailable (returning empty)", {
 			name,
 			error: errMessage(err)
 		});
@@ -8305,7 +8251,7 @@ function readBundledCustomCompose() {
 	try {
 		return readFileSync(bundledAssetPath("config/stack/custom.compose.yml"), "utf-8");
 	} catch (err) {
-		logger$8.warn("bundled custom.compose.yml unavailable (returning empty)", { error: errMessage(err) });
+		logger$8$1.warn("bundled custom.compose.yml unavailable (returning empty)", { error: errMessage(err) });
 		return "";
 	}
 }
@@ -11954,6 +11900,7 @@ function ensureSecrets(state) {
 	ensureSecret(state.homeDir, "op_guardian_admin_token", () => crypto.randomUUID().replace(/-/g, ""));
 	ensureSecret(state.homeDir, "op_guardian_mcp_token", () => crypto.randomUUID().replace(/-/g, ""));
 	ensureSecret(state.homeDir, "op_api_key", () => crypto.randomUUID().replace(/-/g, ""));
+	ensureSecret(state.homeDir, "op_opencode_password", () => crypto.randomUUID().replace(/-/g, ""));
 }
 function ensureAuthJson(state) {
 	const authJsonPath$1 = authJsonPath(state);
@@ -12627,7 +12574,7 @@ function portalSecretName(addon) {
 	return `portal_${addon.replace(/-/g, "_")}_secret`;
 }
 function ensurePortalSecret(homeDir, addon) {
-	return ensureSecret(homeDir, portalSecretName(addon), () => randomHex(16));
+	return ensureSecret(homeDir, portalSecretName(addon), () => randomHex$1(16));
 }
 /**
 * Parse enabled compose files and pre-create host-side volume mount
@@ -12978,6 +12925,14 @@ SLACK_ALLOWED_USERS=
 # Comma-separated blocked user IDs.
 SLACK_BLOCKED_USERS=
 
+# ---
+# Appearance
+# ---
+
+# Display name used in Slack modal titles and the App Home tab.
+# Default: OpenPalm
+SLACK_BOT_NAME=
+
 `,
 	gateway: "",
 	ollama: "",
@@ -13191,6 +13146,8 @@ function disableAddonByName(homeDir, name) {
 	try {
 		if (!VALID_NAME_RE.test(name)) throw new Error(`Invalid addon name: ${name}`);
 		setEnabledAddonState(homeDir, name, false);
+		const profileKey = profileEnvKey(name);
+		if (PROFILE_ONLY_ENV_KEYS.includes(profileKey)) for (const path of [stateEnvFile(homeDir), legacyStackEnvFile(homeDir)]) removeEnvKeyFromFile(path, profileKey);
 		return { ok: true };
 	} catch (error) {
 		return {
@@ -13790,8 +13747,8 @@ async function teardownRenamedProject(state, deps) {
 		warning: null,
 		blocked: false
 	};
-	const docker = await import('./docker2-HZnACjh6.js');
-	const { buildComposeOptions } = await import('./compose-args2-BFdWixAZ.js');
+	const docker = await import('./docker2-oBEn_Si9.js');
+	const { buildComposeOptions } = await import('./compose-args2-DiDeQtPu.js');
 	const resolvedDeps = {
 		detectExistingProject: docker.detectExistingProject,
 		composeDownProject: docker.composeDownProject
@@ -13841,6 +13798,87 @@ async function teardownRenamedProject(state, deps) {
 	};
 }
 //#endregion
+//#region ../lib/src/control-plane/overlay-deprecations.ts
+/**
+* Deprecation scan for the removed `channel_lan` Docker network (#490).
+*
+* `channel_lan` was renamed to `portal_net` in 0.12.0 and retained one
+* release as an empty compatibility bridge; it is fully removed from the
+* skeleton in 0.13.0. A user overlay (`config/stack/custom.compose.yml`)
+* that still attaches a service to `channel_lan` without defining that
+* network itself would produce an invalid merged compose config the moment
+* the skeleton refresh lands. This module is a read-only, advisory scan run
+* BEFORE any lifecycle mutation so the failure is caught early with an
+* actionable message instead of a later, worse Docker error.
+*/
+var DEPRECATED_NETWORK = "channel_lan";
+var REPLACEMENT_NETWORK = "portal_net";
+/**
+* Pure: parse compose YAML content; report services whose `networks` include
+* channel_lan (list or map form) and whether top-level networks defines it.
+* Unparseable/non-object input -> empty scan (advisory scan, fail-open by
+* design: compose preflight still hard-fails genuinely broken YAML).
+*/
+function scanComposeForChannelLan(content) {
+	const empty = {
+		referencedBy: [],
+		definesNetwork: false
+	};
+	try {
+		const doc = (0, import_dist$1.parse)(content);
+		if (typeof doc !== "object" || doc === null) return empty;
+		const referencedBy = [];
+		const services = doc.services;
+		if (typeof services === "object" && services !== null) for (const [svcName, svcDef] of Object.entries(services)) {
+			if (typeof svcDef !== "object" || svcDef === null) continue;
+			const networks = svcDef.networks;
+			if (Array.isArray(networks)) {
+				if (networks.some((n) => n === DEPRECATED_NETWORK)) referencedBy.push(svcName);
+			} else if (typeof networks === "object" && networks !== null) {
+				if (DEPRECATED_NETWORK in networks) referencedBy.push(svcName);
+			}
+		}
+		let definesNetwork = false;
+		const topNetworks = doc.networks;
+		if (typeof topNetworks === "object" && topNetworks !== null) definesNetwork = DEPRECATED_NETWORK in topNetworks;
+		return {
+			referencedBy,
+			definesNetwork
+		};
+	} catch {
+		return empty;
+	}
+}
+/**
+* Read-only check of the user overlay (customComposeFilePath(homeDir)).
+* Missing file -> both null.
+* referencedBy.length > 0 && !definesNetwork -> blockError (merged config
+*   would fail `docker compose config`): names the services, the file path,
+*   instructs renaming to portal_net, and states nothing was changed.
+* definesNetwork -> warning (self-defined network still validates but is
+*   deprecated; suggest renaming to portal_net).
+*/
+function checkCustomComposeChannelLan(homeDir) {
+	const path = customComposeFilePath(homeDir);
+	if (!existsSync(path)) return {
+		blockError: null,
+		warning: null
+	};
+	const scan = scanComposeForChannelLan(readFileSync(path, "utf-8"));
+	if (scan.referencedBy.length > 0 && !scan.definesNetwork) return {
+		blockError: `Service(s) ${scan.referencedBy.join(", ")} in ${path} reference the removed "${DEPRECATED_NETWORK}" Docker network. Rename to "${REPLACEMENT_NETWORK}" in ${path}; nothing was changed.`,
+		warning: null
+	};
+	if (scan.definesNetwork) return {
+		blockError: null,
+		warning: `${path} defines a deprecated "${DEPRECATED_NETWORK}" network. It still validates, but you should rename it to "${REPLACEMENT_NETWORK}".`
+	};
+	return {
+		blockError: null,
+		warning: null
+	};
+}
+//#endregion
 //#region ../lib/src/control-plane/install-lock.ts
 /**
 * Self-healing install lock for the setup wizard phase.
@@ -14197,6 +14235,9 @@ function reconcileStack(state, op) {
 	const activate = op.kind === "install" || op.kind === "upgrade";
 	const deactivate = op.kind === "uninstall";
 	const composes = op.kind === "upgrade";
+	const overlayCheck = checkCustomComposeChannelLan(state.homeDir);
+	if (overlayCheck.blockError && !deactivate) throw new Error(overlayCheck.blockError);
+	if (overlayCheck.warning) lifecycleLogger.warn(overlayCheck.warning);
 	return withStackEnvRollback(state, async () => {
 		const activating = !deactivate;
 		const home = await applyHome(state);
@@ -14217,7 +14258,8 @@ function reconcileStack(state, op) {
 		return {
 			active,
 			assetsUpdated: home.assetsUpdated,
-			backupDir: home.backupDir
+			backupDir: home.backupDir,
+			warnings: overlayCheck.warning ? [overlayCheck.warning] : []
 		};
 	});
 }
@@ -14650,6 +14692,114 @@ function createOpenCodeClient(opts) {
 	};
 }
 //#endregion
+//#region ../lib/src/control-plane/pairing.ts
+/**
+* Pairing code codec + guardian principal minting (#511 D3/D4).
+*
+* Portable control-plane logic: encoding/decoding the one-time pairing code
+* and orchestrating the guardian admin-API mint both live here so a future
+* `openpalm pair` CLI command never has to duplicate them (core-principles
+* §Shared control-plane library). `packages/ui`'s pairing route is a thin
+* transport wrapper over `mintDirectPrincipalPairingCode`; `packages/client`
+* carries a hand-maintained twin decoder (`parsePairingCode`) because the
+* client artifact never imports `@openpalm/lib` (purity gate).
+*
+* The pairing code itself is a self-contained, signed-nothing payload (D3):
+* `openpalm-pair:` + base64url(JSON). It is never persisted host-side — the
+* durable artifact is the minted guardian principal, individually revocable
+* via the guardian admin listener's principal-delete endpoint (#433,
+* `packages/guardian/src/admin.ts`).
+*/
+var PAIRING_CODE_PREFIX = "openpalm-pair:";
+var DEFAULT_GUARDIAN_ADMIN_URL = "http://127.0.0.1:3831";
+/** Bound on the guardian admin mint call (PR #564 second retest) — a listener
+*  that accepts but never responds must not hang the mint. */
+var PAIRING_ADMIN_TIMEOUT_MS = 5e3;
+/** Encode a pairing payload as `openpalm-pair:` + base64url(JSON). */
+function encodePairingCode(payload) {
+	const json = JSON.stringify(payload);
+	return `${PAIRING_CODE_PREFIX}${Buffer.from(json, "utf-8").toString("base64url")}`;
+}
+/** `slug(label) + '-' + 4 hex chars` — never the bare slug, so a mint never
+*  clobbers an existing principal via a bare-label upsert. */
+function slugifyLabel(label) {
+	return label.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 24).replace(/-+$/g, "") || "device";
+}
+function randomHex(byteLength) {
+	const bytes = new Uint8Array(byteLength);
+	crypto.getRandomValues(bytes);
+	return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+}
+/**
+* Mint a `direct` guardian principal via the guardian's existing loopback-
+* only, Bearer-gated admin API and return a one-time pairing code carrying
+* its credential (D3). Fails closed: a missing admin-token secret or an
+* unreachable/non-2xx admin API is a structured `{ ok: false }`, never a
+* thrown error and never a fetch attempt without a token in hand.
+*/
+async function mintDirectPrincipalPairingCode(options) {
+	const { homeDir, label, url, guardianAdminUrl = DEFAULT_GUARDIAN_ADMIN_URL, fetchImpl = fetch } = options;
+	let parsedUrl;
+	try {
+		parsedUrl = new URL(url);
+	} catch {
+		return {
+			ok: false,
+			error: "Pairing target url must be a valid http(s) URL."
+		};
+	}
+	if (parsedUrl.protocol !== "http:" && parsedUrl.protocol !== "https:") return {
+		ok: false,
+		error: "Pairing target url must be a valid http(s) URL."
+	};
+	const rawToken = readSecret(homeDir, "op_guardian_admin_token");
+	if (!rawToken) return {
+		ok: false,
+		error: "op_guardian_admin_token secret is missing — mint the guardian admin token first."
+	};
+	const adminToken = rawToken.trim();
+	const principalId = `${slugifyLabel(label)}-${randomHex(8)}`;
+	const principalToken = randomHex(32);
+	let response;
+	try {
+		response = await fetchImpl(`${guardianAdminUrl}/admin/principals`, {
+			method: "POST",
+			headers: {
+				authorization: `Bearer ${adminToken}`,
+				"content-type": "application/json"
+			},
+			body: JSON.stringify({
+				id: principalId,
+				kind: "direct",
+				token: principalToken,
+				label
+			}),
+			signal: AbortSignal.timeout(PAIRING_ADMIN_TIMEOUT_MS)
+		});
+	} catch {
+		return {
+			ok: false,
+			error: "guardian admin listener unreachable — is the stack running with a guardian-ingress addon enabled?"
+		};
+	}
+	if (!response.ok) return {
+		ok: false,
+		error: `guardian admin API responded with HTTP ${response.status}`
+	};
+	return {
+		ok: true,
+		code: encodePairingCode({
+			v: 1,
+			kind: "openpalm-client-api",
+			url,
+			label,
+			username: principalId,
+			secret: principalToken
+		}),
+		principalId
+	};
+}
+//#endregion
 //#region ../lib/src/control-plane/task-files.ts
 /**
 * Raw file access for the Automations admin tab — a plain editor for the akm
@@ -14738,7 +14888,7 @@ function allowedSecretForService(serviceName, service, secretName) {
 	const serviceId = normalizedSecretName(serviceName.replace(/^portal[-_]/i, ""));
 	const secretId = normalizedSecretName(secretName);
 	if (serviceName === "assistant") return /^(assistant|opencode|provider|llm|embedding|akm|user)_/.test(secretId);
-	if (serviceName === "guardian") return secretId.startsWith("guardian_") || secretId.startsWith("portal_") || secretId.startsWith("op_guardian_") || secretId === "op_api_key";
+	if (serviceName === "guardian") return secretId.startsWith("guardian_") || secretId.startsWith("portal_") || secretId.startsWith("op_guardian_") || secretId === "op_api_key" || secretId === "opencode_server_password";
 	if (serviceName === "admin") return /^(admin|ui|openpalm)_/.test(secretId);
 	if (isPortalService(serviceName, service)) return secretId.startsWith(`portal_${serviceId}_`) || secretId.startsWith(`${serviceId}_`);
 	return secretId.startsWith(`${serviceId}_`);
@@ -15121,6 +15271,20 @@ function emitProgress(options, state) {
 function projectNameForState(state) {
 	return resolveComposeProjectName(parseEnvFile(stackEnvPath(state)));
 }
+/**
+* Choose compose's `--pull` mode for a deploy from the version-of-record tag
+* (PR #564 second retest R8). `--pull missing` never refreshes a MOVING registry
+* tag (`latest`, channel names) once the image is present locally, so a
+* moving-tag rerun can recreate the OLD digest. Force `--pull always` for a
+* moving tag; keep `--pull missing` for an immutable pinned semver (correct AND
+* avoids a needless network pull) and for a locally-built `dev` image (which
+* must never hit the network). An unset tag is treated as moving (safe: refresh).
+*/
+function resolvePullMode(imageTag) {
+	const isDevTag = imageTag.startsWith("dev");
+	const isPinnedVersion = /^v?\d+\./.test(imageTag);
+	return !isDevTag && !isPinnedVersion ? "always" : "missing";
+}
 function resolveImageTag(state) {
 	const env = parseEnvFile(stackEnvPath(state));
 	return env.OP_ASSISTANT_VERSION ?? env.OP_IMAGE_TAG ?? "";
@@ -15305,7 +15469,7 @@ async function runDeploy(state, options = {}) {
 		const imageTag = resolveImageTag(state);
 		const isDevTag = imageTag.startsWith("dev");
 		const stackResult = await applyStack({ kind: "all" }, composeOpts, void 0, {
-			pull: "missing",
+			pull: resolvePullMode(imageTag),
 			healthTimeoutMs: 5 * 6e4
 		});
 		if (!stackResult.ok) {
@@ -15532,7 +15696,7 @@ function buildAkmEndpoint(provider, baseUrl, suffix) {
 *  - Atomic 0600 writes.
 *  - The OpenPalm config is parse-tolerant (we own it: corrupt → start from {}).
 */
-var logger$7 = createLogger("akm-sources");
+var logger$8 = createLogger("akm-sources");
 /** Source entry name added to the OpenPalm/container config (points at /host-stash). */
 var HOST_SOURCE_NAME = "host-akm";
 function readConfigTolerant(configPath) {
@@ -15550,7 +15714,7 @@ function readHostConfigBestEffort(configPath) {
 		const parsed = JSON.parse(readFileSync(configPath, "utf-8"));
 		return parsed && typeof parsed === "object" ? parsed : null;
 	} catch {
-		logger$7.warn("host akm config is not valid JSON — skipping profile import", { configPath });
+		logger$8.warn("host akm config is not valid JSON — skipping profile import", { configPath });
 		return null;
 	}
 }
@@ -15676,7 +15840,7 @@ function importHostProfiles(state, hostConfigPath) {
 *    If no host akm config exists the import is silently skipped — it is never
 *    a blocking condition.
 */
-var logger$6 = createLogger("host-akm-sharing");
+var logger$7 = createLogger("host-akm-sharing");
 var ENV_KEY = "OP_HOST_AKM_STASH";
 function userHome() {
 	return process.env.HOME ?? process.env.USERPROFILE ?? homedir();
@@ -15704,7 +15868,7 @@ function enableHostAkmSharing(state) {
 	const envPath = stackEnvPath(state);
 	writeFileAtomic(envPath, mergeEnvContent(existsSync(envPath) ? readFileSync(envPath, "utf-8") : "", { [ENV_KEY]: hostAkmStashPath() }), 384);
 	const { imported: profilesImported } = importHostProfiles(state, hostAkmConfigPath());
-	logger$6.info("host akm sharing enabled", {
+	logger$7.info("host akm sharing enabled", {
 		hostStashPath: hostAkmStashPath(),
 		profilesImported
 	});
@@ -15718,7 +15882,7 @@ function enableHostAkmSharing(state) {
 function disableHostAkmSharing(state) {
 	const envPath = stackEnvPath(state);
 	writeFileAtomic(envPath, removeEnvKey(existsSync(envPath) ? readFileSync(envPath, "utf-8") : "", ENV_KEY), 384);
-	logger$6.info("host akm sharing disabled");
+	logger$7.info("host akm sharing disabled");
 }
 //#endregion
 //#region ../lib/src/control-plane/markdown-task.ts
@@ -15730,14 +15894,14 @@ function disableHostAkmSharing(state) {
 *   prompt   — `prompt: <text>` inline prompt text
 *   workflow — `workflow: workflow:<ref>` + optional `params` map
 */
-var logger$5 = createLogger("task-file");
+var logger$6 = createLogger("task-file");
 function parseMarkdownTask(filePath) {
 	const id = basename(filePath).replace(/\.(?:ya?ml|md)$/, "");
 	let raw;
 	try {
 		raw = readFileSync(filePath, "utf-8");
 	} catch (err) {
-		logger$5.warn("failed to read task file", {
+		logger$6.warn("failed to read task file", {
 			filePath,
 			error: String(err)
 		});
@@ -15748,12 +15912,12 @@ function parseMarkdownTask(filePath) {
 	try {
 		const parsed = (0, import_dist.parse)(frontmatter);
 		if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-			logger$5.warn("task YAML is not an object", { filePath });
+			logger$6.warn("task YAML is not an object", { filePath });
 			return null;
 		}
 		fm = parsed;
 	} catch (err) {
-		logger$5.warn("failed to parse task YAML", {
+		logger$6.warn("failed to parse task YAML", {
 			filePath,
 			error: String(err)
 		});
@@ -15761,14 +15925,14 @@ function parseMarkdownTask(filePath) {
 	}
 	const schedule = fm.schedule;
 	if (typeof schedule !== "string" || !schedule.trim()) {
-		logger$5.warn("task missing or empty 'schedule'", { filePath });
+		logger$6.warn("task missing or empty 'schedule'", { filePath });
 		return null;
 	}
 	let target;
 	if (fm.command !== void 0) {
 		const cmd = Array.isArray(fm.command) ? fm.command.map(String) : typeof fm.command === "string" ? [fm.command] : null;
 		if (!cmd || cmd.length === 0) {
-			logger$5.warn("task 'command' must be a non-empty array", { filePath });
+			logger$6.warn("task 'command' must be a non-empty array", { filePath });
 			return null;
 		}
 		target = {
@@ -15777,12 +15941,12 @@ function parseMarkdownTask(filePath) {
 		};
 	} else if (fm.prompt !== void 0) {
 		if (typeof fm.prompt !== "string" || !fm.prompt.trim()) {
-			logger$5.warn("task 'prompt' must be a non-empty string", { filePath });
+			logger$6.warn("task 'prompt' must be a non-empty string", { filePath });
 			return null;
 		}
 		const promptBody = fm.prompt.trim() === "inline" ? body.trim() : fm.prompt.trim();
 		if (!promptBody) {
-			logger$5.warn("task prompt body is empty", { filePath });
+			logger$6.warn("task prompt body is empty", { filePath });
 			return null;
 		}
 		target = {
@@ -15792,7 +15956,7 @@ function parseMarkdownTask(filePath) {
 		};
 	} else if (fm.workflow !== void 0) {
 		if (typeof fm.workflow !== "string") {
-			logger$5.warn("task 'workflow' must be a string ref", { filePath });
+			logger$6.warn("task 'workflow' must be a string ref", { filePath });
 			return null;
 		}
 		target = {
@@ -15801,7 +15965,7 @@ function parseMarkdownTask(filePath) {
 			params: fm.params && typeof fm.params === "object" && !Array.isArray(fm.params) ? fm.params : {}
 		};
 	} else {
-		logger$5.warn("task must have one of: command, prompt, workflow", { filePath });
+		logger$6.warn("task must have one of: command, prompt, workflow", { filePath });
 		return null;
 	}
 	return {
@@ -16018,7 +16182,7 @@ function readUserEnvFile(envPath) {
 * Scheduling is handled by the OS cron daemon (via `akm tasks sync`).
 * Execution is handled by `akm tasks run <id>`.
 */
-var logger$4 = createLogger("scheduler");
+var logger$5 = createLogger("scheduler");
 function loadAutomations(stashDir) {
 	return loadMarkdownTasks(stashDir).map(taskToAutomationConfig);
 }
@@ -16036,7 +16200,7 @@ async function executeAutomation(id, akmEnv) {
 		} }, (error, _stdout, stderr) => {
 			if (error) {
 				const msg = stderr?.trim() || error.message;
-				logger$4.warn("akm tasks run failed", {
+				logger$5.warn("akm tasks run failed", {
 					id: taskId,
 					error: msg
 				});
@@ -16076,7 +16240,7 @@ function readAutomationLogs(id, dataDir, limit = 50) {
 *
 * Probes well-known endpoints for Docker Model Runner, Ollama, and LM Studio.
 */
-var logger$3 = createLogger("local-providers");
+var logger$4 = createLogger("local-providers");
 /** Ollama's root endpoint returns "Ollama is running" — use this to distinguish from other services on :11434. */
 async function validateOllamaResponse(res) {
 	try {
@@ -16254,7 +16418,7 @@ async function detectLocalProviders() {
 						try {
 							bodySnippet = (await resForValidate.text()).slice(0, 500);
 						} catch {}
-						logger$3.debug("provider probe response failed validation", {
+						logger$4.debug("provider probe response failed validation", {
 							provider,
 							url: probeUrl,
 							bodySnippet
@@ -16262,7 +16426,7 @@ async function detectLocalProviders() {
 						continue;
 					}
 				}
-				logger$3.debug("detected local provider", {
+				logger$4.debug("detected local provider", {
 					provider,
 					url: baseUrl
 				});
@@ -16282,7 +16446,7 @@ async function detectLocalProviders() {
 }
 //#endregion
 //#region ../lib/src/control-plane/hardware-detect.ts
-var logger$2 = createLogger("hardware-detect");
+var logger$3 = createLogger("hardware-detect");
 /** Parse `nvidia-smi --query-gpu=name,memory.total --format=csv,noheader,nounits`. */
 function parseNvidiaSmi(stdout) {
 	return stdout.split("\n").map((line) => line.trim()).filter(Boolean).map((line) => {
@@ -16389,7 +16553,7 @@ async function detectGpu() {
 		try {
 			found.push(...probe.parse(stdout));
 		} catch (error) {
-			logger$2.debug("gpu probe parse failed", {
+			logger$3.debug("gpu probe parse failed", {
 				vendor: probe.vendor,
 				error: String(error)
 			});
@@ -16535,15 +16699,30 @@ function validateSetupSpec(input) {
 	validateLlm(body, errors);
 	validateEmbedding(body, errors);
 	if (body.portalCredentials !== void 0 && (typeof body.portalCredentials !== "object" || body.portalCredentials === null)) errors.push("portalCredentials must be an object if provided");
+	validateNetwork(body, errors);
 	return {
 		valid: errors.length === 0,
 		errors
 	};
 }
+function validateNetwork(body, errors) {
+	if (body.network === void 0) return;
+	const network = requireObj(body.network, "network must be an object if provided", errors);
+	if (!network) return;
+	if (!isNetworkAccessPreset(network.preset)) {
+		errors.push(`network.preset must be one of: this-pc, home-password, home-open, shared-guardian`);
+		return;
+	}
+	const password = network.opencodePassword;
+	if (network.preset === "home-password") {
+		if (typeof password !== "string" || password.length < 8) errors.push("network.opencodePassword is required for the home-password preset and must be at least 8 characters");
+	} else if (password !== void 0) errors.push(`network.opencodePassword must not be supplied for the "${network.preset}" preset`);
+}
 function validateSecurity(body, errors) {
 	const security = requireObj(body.security, "security object is required", errors);
 	if (!security) return;
-	if (!requireStr(security, "uiLoginPassword", "security.uiLoginPassword is required and must be a non-empty string", errors)) return;
+	if (security.uiLoginPassword === void 0) return;
+	if (!requireStr(security, "uiLoginPassword", "security.uiLoginPassword must be a non-empty string when provided", errors)) return;
 	if (security.uiLoginPassword.length < 8) errors.push("security.uiLoginPassword must be at least 8 characters");
 }
 function validateOwner(body, errors) {
@@ -16601,7 +16780,7 @@ function validateConnectionsArray(connections, errors) {
 * This module does NOT include Docker operations (compose up, image pull, etc.)
 * — those happen separately in the caller after setup completes.
 */
-var logger$1 = createLogger("setup");
+var logger$2 = createLogger("setup");
 /**
 * Build the non-secret stack.env update payload from a setup spec.
 * Extracts owner name/email into OP_OWNER_* env vars.
@@ -16714,15 +16893,15 @@ function persistAkmConfig(state, opts) {
 }
 /**
 * Persist portal (discord/slack/…) credentials into the vault secrets env.
-* Credential values come from the setup spec first, falling back to the host
-* process environment for any canonical env var not supplied in the spec.
-* updateSecretsEnv routes secret-classified keys to their own files and the
-* rest to stack.env.
+* Credential values come ONLY from the setup spec. PR #564 second retest P1-3:
+* the previous host-process-env fallback silently consumed ambient variables
+* (e.g. a leftover `DISCORD_BOT_TOKEN` in the operator's shell) as operator
+* input, overwriting an existing secret BEFORE keep-existing semantics could
+* preserve it. Omitting a credential now leaves the persisted secret untouched
+* — updateSecretsEnv only writes the keys explicitly supplied.
 */
 function persistPortalCredentials(state, portalCredentials) {
-	const portalSecretUpdates = portalCredentials ? buildPortalCredentialEnvVars(portalCredentials) : {};
-	for (const mapping of Object.values(PORTAL_CREDENTIAL_ENV_MAP)) for (const envKey of Object.values(mapping)) if (!portalSecretUpdates[envKey] && process.env[envKey]) portalSecretUpdates[envKey] = process.env[envKey];
-	updateSecretsEnv(state, portalSecretUpdates);
+	updateSecretsEnv(state, portalCredentials ? buildPortalCredentialEnvVars(portalCredentials) : {});
 }
 /**
 * Seed the default automation (akm-improve) into the AKM stash. Idempotent —
@@ -16738,8 +16917,8 @@ function seedDefaultAutomation(state) {
 	const akmImproveTask = getRegistryAutomation("akm-improve");
 	if (akmImproveTask) {
 		writeFileSync(akmImproveDest, akmImproveTask);
-		logger$1.info("seeded default automation", { name: "akm-improve" });
-	} else logger$1.warn("default automation missing from registry; skipping seed", { name: "akm-improve" });
+		logger$2.info("seeded default automation", { name: "akm-improve" });
+	} else logger$2.warn("default automation missing from registry; skipping seed", { name: "akm-improve" });
 }
 async function performSetup(input, opts) {
 	const validation = validateSetupSpec(input);
@@ -16747,7 +16926,14 @@ async function performSetup(input, opts) {
 		ok: false,
 		error: validation.errors.join("; ")
 	};
-	const { llm, embedding, tts, stt, security, owner, connections, portalCredentials, addons, voiceProfile, ollamaProfile, imageTag, hostAkm } = input;
+	if (input.network) {
+		const envCheck = validateNetworkPresetEnv(input.network.preset, process.env);
+		if (!envCheck.valid) return {
+			ok: false,
+			error: envCheck.errors.join("; ")
+		};
+	}
+	const { llm, embedding, tts, stt, security, owner, connections, portalCredentials, addons, voiceProfile, ollamaProfile, imageTag, hostAkm, network } = input;
 	const state = createState();
 	initializeStateSecrets(state);
 	const lockHandle = acquireInstallLock(state.dataDir);
@@ -16755,7 +16941,7 @@ async function performSetup(input, opts) {
 		ok: false,
 		error: "install_in_progress: Another install is in progress. Wait for it to finish (the lock clears itself automatically after 30 minutes). If you're sure nothing is running, run 'openpalm unlock' to clear a stale lock."
 	};
-	logger$1.info("performing setup", { connectionCount: connections.length });
+	logger$2.info("performing setup", { connectionCount: connections.length });
 	const updates = buildOwnerEnvFromSetup(owner);
 	const providerKeys = buildAuthJsonFromSetup(connections);
 	try {
@@ -16764,11 +16950,19 @@ async function performSetup(input, opts) {
 			ensureSecrets(state);
 			updateSecretsEnv(state, updates);
 			persistPortalCredentials(state, portalCredentials);
-			patchSecretsEnvFile(state.homeDir, { OP_UI_LOGIN_PASSWORD: security.uiLoginPassword });
+			if (security.uiLoginPassword) patchSecretsEnvFile(state.homeDir, { OP_UI_LOGIN_PASSWORD: security.uiLoginPassword });
+			else if (!readSecret(state.homeDir, "op_ui_login_password")?.trim()) throw new Error("security.uiLoginPassword is required — no existing UI login password to preserve.");
+			if (network) {
+				const resolution = resolveNetworkPreset(network.preset, { opencodePassword: network.opencodePassword });
+				patchSecretsEnvFile(state.homeDir, {
+					...resolution.env,
+					...resolution.opencodePassword ? { OP_OPENCODE_PASSWORD: resolution.opencodePassword } : {}
+				});
+			}
 			writeAuthJsonProviderKeys(state, providerKeys);
 		} catch (err) {
 			const message = errMessage(err);
-			logger$1.error("failed to persist setup outputs", { error: message });
+			logger$2.error("failed to persist setup outputs", { error: message });
 			return {
 				ok: false,
 				error: `Failed to persist setup outputs: ${message}`
@@ -16786,14 +16980,18 @@ async function performSetup(input, opts) {
 			addHostStashToOpenpalmConfig(state);
 			if (hostAkm !== false) {
 				const { profilesImported } = enableHostAkmSharing(state);
-				logger$1.info("host akm sharing enabled during setup", { profilesImported });
+				logger$2.info("host akm sharing enabled during setup", { profilesImported });
 			} else disableHostAkmSharing(state);
 			if (tts || stt) writeVoiceVars({
 				tts,
 				stt
 			}, state.homeDir);
-			if (addons) {
-				for (const [name, enabled] of Object.entries(addons)) if (enabled) setAddonEnabled(state.homeDir, name, true, state);
+			if (addons) for (const [name, enabled] of Object.entries(addons)) setAddonEnabled(state.homeDir, name, enabled === true, state);
+			if (network?.preset === "shared-guardian") {
+				if (![...Object.entries(addons ?? {}).filter(([, on]) => on).map(([name]) => name), ...listEnabledAddonIds(state.homeDir)].some((a) => GUARDIAN_INGRESS_ADDON_IDS.includes(a))) {
+					setAddonEnabled(state.homeDir, "chat", true, state);
+					logger$2.info("shared-guardian preset auto-enabled the chat portal", { reason: "guardian ingress required for the protected front door" });
+				}
 			}
 			if (voiceProfile?.trim()) setAddonProfileSelection(state.homeDir, "voice", voiceProfile.trim());
 			if (ollamaProfile?.trim()) setAddonProfileSelection(state.homeDir, "ollama", ollamaProfile.trim());
@@ -16801,13 +16999,13 @@ async function performSetup(input, opts) {
 			seedDefaultAutomation(state);
 		} catch (err) {
 			const message = errMessage(err);
-			logger$1.error("failed to complete setup persistence", { error: message });
+			logger$2.error("failed to complete setup persistence", { error: message });
 			return {
 				ok: false,
 				error: `Setup persistence failed: ${message}`
 			};
 		}
-		logger$1.info("setup complete", { connectionCount: connections.length });
+		logger$2.info("setup complete", { connectionCount: connections.length });
 		return { ok: true };
 	} finally {
 		releaseInstallLock(lockHandle);
@@ -17147,60 +17345,2326 @@ async function getAkmStats(state) {
 	return parseAkmStats(healthResult.stdout, infoResult.stdout, proposalsResult.stdout);
 }
 //#endregion
-//#region ../lib/src/control-plane/bind-warning.ts
+//#region ../../node_modules/.bun/dns-packet@5.6.1/node_modules/dns-packet/types.js
+var require_types = /* @__PURE__ */ __commonJSMin(((exports) => {
+	exports.toString = function(type) {
+		switch (type) {
+			case 1: return "A";
+			case 10: return "NULL";
+			case 28: return "AAAA";
+			case 18: return "AFSDB";
+			case 42: return "APL";
+			case 257: return "CAA";
+			case 60: return "CDNSKEY";
+			case 59: return "CDS";
+			case 37: return "CERT";
+			case 5: return "CNAME";
+			case 49: return "DHCID";
+			case 32769: return "DLV";
+			case 39: return "DNAME";
+			case 48: return "DNSKEY";
+			case 43: return "DS";
+			case 55: return "HIP";
+			case 13: return "HINFO";
+			case 45: return "IPSECKEY";
+			case 25: return "KEY";
+			case 36: return "KX";
+			case 29: return "LOC";
+			case 15: return "MX";
+			case 35: return "NAPTR";
+			case 2: return "NS";
+			case 47: return "NSEC";
+			case 50: return "NSEC3";
+			case 51: return "NSEC3PARAM";
+			case 12: return "PTR";
+			case 46: return "RRSIG";
+			case 17: return "RP";
+			case 24: return "SIG";
+			case 6: return "SOA";
+			case 99: return "SPF";
+			case 33: return "SRV";
+			case 44: return "SSHFP";
+			case 32768: return "TA";
+			case 249: return "TKEY";
+			case 52: return "TLSA";
+			case 250: return "TSIG";
+			case 16: return "TXT";
+			case 252: return "AXFR";
+			case 251: return "IXFR";
+			case 41: return "OPT";
+			case 255: return "ANY";
+		}
+		return "UNKNOWN_" + type;
+	};
+	exports.toType = function(name) {
+		switch (name.toUpperCase()) {
+			case "A": return 1;
+			case "NULL": return 10;
+			case "AAAA": return 28;
+			case "AFSDB": return 18;
+			case "APL": return 42;
+			case "CAA": return 257;
+			case "CDNSKEY": return 60;
+			case "CDS": return 59;
+			case "CERT": return 37;
+			case "CNAME": return 5;
+			case "DHCID": return 49;
+			case "DLV": return 32769;
+			case "DNAME": return 39;
+			case "DNSKEY": return 48;
+			case "DS": return 43;
+			case "HIP": return 55;
+			case "HINFO": return 13;
+			case "IPSECKEY": return 45;
+			case "KEY": return 25;
+			case "KX": return 36;
+			case "LOC": return 29;
+			case "MX": return 15;
+			case "NAPTR": return 35;
+			case "NS": return 2;
+			case "NSEC": return 47;
+			case "NSEC3": return 50;
+			case "NSEC3PARAM": return 51;
+			case "PTR": return 12;
+			case "RRSIG": return 46;
+			case "RP": return 17;
+			case "SIG": return 24;
+			case "SOA": return 6;
+			case "SPF": return 99;
+			case "SRV": return 33;
+			case "SSHFP": return 44;
+			case "TA": return 32768;
+			case "TKEY": return 249;
+			case "TLSA": return 52;
+			case "TSIG": return 250;
+			case "TXT": return 16;
+			case "AXFR": return 252;
+			case "IXFR": return 251;
+			case "OPT": return 41;
+			case "ANY": return 255;
+			case "*": return 255;
+		}
+		if (name.toUpperCase().startsWith("UNKNOWN_")) return parseInt(name.slice(8));
+		return 0;
+	};
+}));
+//#endregion
+//#region ../../node_modules/.bun/dns-packet@5.6.1/node_modules/dns-packet/rcodes.js
+var require_rcodes = /* @__PURE__ */ __commonJSMin(((exports) => {
+	exports.toString = function(rcode) {
+		switch (rcode) {
+			case 0: return "NOERROR";
+			case 1: return "FORMERR";
+			case 2: return "SERVFAIL";
+			case 3: return "NXDOMAIN";
+			case 4: return "NOTIMP";
+			case 5: return "REFUSED";
+			case 6: return "YXDOMAIN";
+			case 7: return "YXRRSET";
+			case 8: return "NXRRSET";
+			case 9: return "NOTAUTH";
+			case 10: return "NOTZONE";
+			case 11: return "RCODE_11";
+			case 12: return "RCODE_12";
+			case 13: return "RCODE_13";
+			case 14: return "RCODE_14";
+			case 15: return "RCODE_15";
+		}
+		return "RCODE_" + rcode;
+	};
+	exports.toRcode = function(code) {
+		switch (code.toUpperCase()) {
+			case "NOERROR": return 0;
+			case "FORMERR": return 1;
+			case "SERVFAIL": return 2;
+			case "NXDOMAIN": return 3;
+			case "NOTIMP": return 4;
+			case "REFUSED": return 5;
+			case "YXDOMAIN": return 6;
+			case "YXRRSET": return 7;
+			case "NXRRSET": return 8;
+			case "NOTAUTH": return 9;
+			case "NOTZONE": return 10;
+			case "RCODE_11": return 11;
+			case "RCODE_12": return 12;
+			case "RCODE_13": return 13;
+			case "RCODE_14": return 14;
+			case "RCODE_15": return 15;
+		}
+		return 0;
+	};
+}));
+//#endregion
+//#region ../../node_modules/.bun/dns-packet@5.6.1/node_modules/dns-packet/opcodes.js
+var require_opcodes = /* @__PURE__ */ __commonJSMin(((exports) => {
+	exports.toString = function(opcode) {
+		switch (opcode) {
+			case 0: return "QUERY";
+			case 1: return "IQUERY";
+			case 2: return "STATUS";
+			case 3: return "OPCODE_3";
+			case 4: return "NOTIFY";
+			case 5: return "UPDATE";
+			case 6: return "OPCODE_6";
+			case 7: return "OPCODE_7";
+			case 8: return "OPCODE_8";
+			case 9: return "OPCODE_9";
+			case 10: return "OPCODE_10";
+			case 11: return "OPCODE_11";
+			case 12: return "OPCODE_12";
+			case 13: return "OPCODE_13";
+			case 14: return "OPCODE_14";
+			case 15: return "OPCODE_15";
+		}
+		return "OPCODE_" + opcode;
+	};
+	exports.toOpcode = function(code) {
+		switch (code.toUpperCase()) {
+			case "QUERY": return 0;
+			case "IQUERY": return 1;
+			case "STATUS": return 2;
+			case "OPCODE_3": return 3;
+			case "NOTIFY": return 4;
+			case "UPDATE": return 5;
+			case "OPCODE_6": return 6;
+			case "OPCODE_7": return 7;
+			case "OPCODE_8": return 8;
+			case "OPCODE_9": return 9;
+			case "OPCODE_10": return 10;
+			case "OPCODE_11": return 11;
+			case "OPCODE_12": return 12;
+			case "OPCODE_13": return 13;
+			case "OPCODE_14": return 14;
+			case "OPCODE_15": return 15;
+		}
+		return 0;
+	};
+}));
+//#endregion
+//#region ../../node_modules/.bun/dns-packet@5.6.1/node_modules/dns-packet/classes.js
+var require_classes = /* @__PURE__ */ __commonJSMin(((exports) => {
+	exports.toString = function(klass) {
+		switch (klass) {
+			case 1: return "IN";
+			case 2: return "CS";
+			case 3: return "CH";
+			case 4: return "HS";
+			case 255: return "ANY";
+		}
+		return "UNKNOWN_" + klass;
+	};
+	exports.toClass = function(name) {
+		switch (name.toUpperCase()) {
+			case "IN": return 1;
+			case "CS": return 2;
+			case "CH": return 3;
+			case "HS": return 4;
+			case "ANY": return 255;
+		}
+		return 0;
+	};
+}));
+//#endregion
+//#region ../../node_modules/.bun/dns-packet@5.6.1/node_modules/dns-packet/optioncodes.js
+var require_optioncodes = /* @__PURE__ */ __commonJSMin(((exports) => {
+	exports.toString = function(type) {
+		switch (type) {
+			case 1: return "LLQ";
+			case 2: return "UL";
+			case 3: return "NSID";
+			case 5: return "DAU";
+			case 6: return "DHU";
+			case 7: return "N3U";
+			case 8: return "CLIENT_SUBNET";
+			case 9: return "EXPIRE";
+			case 10: return "COOKIE";
+			case 11: return "TCP_KEEPALIVE";
+			case 12: return "PADDING";
+			case 13: return "CHAIN";
+			case 14: return "KEY_TAG";
+			case 26946: return "DEVICEID";
+		}
+		if (type < 0) return null;
+		return `OPTION_${type}`;
+	};
+	exports.toCode = function(name) {
+		if (typeof name === "number") return name;
+		if (!name) return -1;
+		switch (name.toUpperCase()) {
+			case "OPTION_0": return 0;
+			case "LLQ": return 1;
+			case "UL": return 2;
+			case "NSID": return 3;
+			case "OPTION_4": return 4;
+			case "DAU": return 5;
+			case "DHU": return 6;
+			case "N3U": return 7;
+			case "CLIENT_SUBNET": return 8;
+			case "EXPIRE": return 9;
+			case "COOKIE": return 10;
+			case "TCP_KEEPALIVE": return 11;
+			case "PADDING": return 12;
+			case "CHAIN": return 13;
+			case "KEY_TAG": return 14;
+			case "DEVICEID": return 26946;
+			case "OPTION_65535": return 65535;
+		}
+		const m = name.match(/_(\d+)$/);
+		if (m) return parseInt(m[1], 10);
+		return -1;
+	};
+}));
+//#endregion
+//#region ../../node_modules/.bun/@leichtgewicht+ip-codec@2.0.5/node_modules/@leichtgewicht/ip-codec/index.cjs
+var require_ip_codec = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	var ipCodec = (function(exports$1) {
+		Object.defineProperty(exports$1, "__esModule", { value: true });
+		exports$1.decode = decode;
+		exports$1.encode = encode;
+		exports$1.familyOf = familyOf;
+		exports$1.name = void 0;
+		exports$1.sizeOf = sizeOf;
+		exports$1.v6 = exports$1.v4 = void 0;
+		const v4Regex = /^(\d{1,3}\.){3,3}\d{1,3}$/;
+		const v4Size = 4;
+		const v6Regex = /^(::)?(((\d{1,3}\.){3}(\d{1,3}){1})?([0-9a-f]){0,4}:{0,2}){1,8}(::)?$/i;
+		const v6Size = 16;
+		const v4 = {
+			name: "v4",
+			size: v4Size,
+			isFormat: (ip) => v4Regex.test(ip),
+			encode(ip, buff, offset) {
+				offset = ~~offset;
+				buff = buff || new Uint8Array(offset + v4Size);
+				const max = ip.length;
+				let n = 0;
+				for (let i = 0; i < max;) {
+					const c = ip.charCodeAt(i++);
+					if (c === 46) {
+						buff[offset++] = n;
+						n = 0;
+					} else n = n * 10 + (c - 48);
+				}
+				buff[offset] = n;
+				return buff;
+			},
+			decode(buff, offset) {
+				offset = ~~offset;
+				return `${buff[offset++]}.${buff[offset++]}.${buff[offset++]}.${buff[offset]}`;
+			}
+		};
+		exports$1.v4 = v4;
+		const v6 = {
+			name: "v6",
+			size: v6Size,
+			isFormat: (ip) => ip.length > 0 && v6Regex.test(ip),
+			encode(ip, buff, offset) {
+				offset = ~~offset;
+				let end = offset + v6Size;
+				let fill = -1;
+				let hexN = 0;
+				let decN = 0;
+				let prevColon = true;
+				let useDec = false;
+				buff = buff || new Uint8Array(offset + v6Size);
+				for (let i = 0; i < ip.length; i++) {
+					let c = ip.charCodeAt(i);
+					if (c === 58) {
+						if (prevColon) {
+							if (fill !== -1) {
+								if (offset < end) buff[offset] = 0;
+								if (offset < end - 1) buff[offset + 1] = 0;
+								offset += 2;
+							} else if (offset < end) fill = offset;
+						} else {
+							if (useDec === true) {
+								if (offset < end) buff[offset] = decN;
+								offset++;
+							} else {
+								if (offset < end) buff[offset] = hexN >> 8;
+								if (offset < end - 1) buff[offset + 1] = hexN & 255;
+								offset += 2;
+							}
+							hexN = 0;
+							decN = 0;
+						}
+						prevColon = true;
+						useDec = false;
+					} else if (c === 46) {
+						if (offset < end) buff[offset] = decN;
+						offset++;
+						decN = 0;
+						hexN = 0;
+						prevColon = false;
+						useDec = true;
+					} else {
+						prevColon = false;
+						if (c >= 97) c -= 87;
+						else if (c >= 65) c -= 55;
+						else {
+							c -= 48;
+							decN = decN * 10 + c;
+						}
+						hexN = (hexN << 4) + c;
+					}
+				}
+				if (prevColon === false) if (useDec === true) {
+					if (offset < end) buff[offset] = decN;
+					offset++;
+				} else {
+					if (offset < end) buff[offset] = hexN >> 8;
+					if (offset < end - 1) buff[offset + 1] = hexN & 255;
+					offset += 2;
+				}
+				else if (fill === 0) {
+					if (offset < end) buff[offset] = 0;
+					if (offset < end - 1) buff[offset + 1] = 0;
+					offset += 2;
+				} else if (fill !== -1) {
+					offset += 2;
+					for (let i = Math.min(offset - 1, end - 1); i >= fill + 2; i--) buff[i] = buff[i - 2];
+					buff[fill] = 0;
+					buff[fill + 1] = 0;
+					fill = offset;
+				}
+				if (fill !== offset && fill !== -1) {
+					if (offset > end - 2) offset = end - 2;
+					while (end > fill) buff[--end] = offset < end && offset > fill ? buff[--offset] : 0;
+				} else while (offset < end) buff[offset++] = 0;
+				return buff;
+			},
+			decode(buff, offset) {
+				offset = ~~offset;
+				let result = "";
+				for (let i = 0; i < v6Size; i += 2) {
+					if (i !== 0) result += ":";
+					result += (buff[offset + i] << 8 | buff[offset + i + 1]).toString(16);
+				}
+				return result.replace(/(^|:)0(:0)*:0(:|$)/, "$1::$3").replace(/:{3,4}/, "::");
+			}
+		};
+		exports$1.v6 = v6;
+		exports$1.name = "ip";
+		function sizeOf(ip) {
+			if (v4.isFormat(ip)) return v4.size;
+			if (v6.isFormat(ip)) return v6.size;
+			throw Error(`Invalid ip address: ${ip}`);
+		}
+		function familyOf(string) {
+			return sizeOf(string) === v4.size ? 1 : 2;
+		}
+		function encode(ip, buff, offset) {
+			offset = ~~offset;
+			const size = sizeOf(ip);
+			if (typeof buff === "function") buff = buff(offset + size);
+			if (size === v4.size) return v4.encode(ip, buff, offset);
+			return v6.encode(ip, buff, offset);
+		}
+		function decode(buff, offset, length) {
+			offset = ~~offset;
+			length = length || buff.length - offset;
+			if (length === v4.size) return v4.decode(buff, offset, length);
+			if (length === v6.size) return v6.decode(buff, offset, length);
+			throw Error(`Invalid buffer size needs to be ${v4.size} for v4 or ${v6.size} for v6.`);
+		}
+		return "default" in exports$1 ? exports$1.default : exports$1;
+	})({});
+	if (typeof define === "function" && define.amd) define([], function() {
+		return ipCodec;
+	});
+	else if (typeof module === "object" && typeof exports === "object") module.exports = ipCodec;
+}));
+//#endregion
+//#region ../../node_modules/.bun/dns-packet@5.6.1/node_modules/dns-packet/index.js
+var require_dns_packet = /* @__PURE__ */ __commonJSMin(((exports) => {
+	var Buffer$1 = __require("buffer").Buffer;
+	var types = require_types();
+	var rcodes = require_rcodes();
+	var opcodes = require_opcodes();
+	var classes = require_classes();
+	var optioncodes = require_optioncodes();
+	var ip = require_ip_codec();
+	var QUERY_FLAG = 0;
+	var RESPONSE_FLAG = 32768;
+	var FLUSH_MASK = 32768;
+	var NOT_FLUSH_MASK = -32769;
+	var QU_MASK = 32768;
+	var NOT_QU_MASK = -32769;
+	var name = exports.name = {};
+	name.encode = function(str, buf, offset, { mail = false } = {}) {
+		if (!buf) buf = Buffer$1.alloc(name.encodingLength(str));
+		if (!offset) offset = 0;
+		const oldOffset = offset;
+		const n = str.replace(/^\.|\.$/gm, "");
+		if (n.length) {
+			let list = [];
+			if (mail) {
+				let localPart = "";
+				n.split(".").forEach((label) => {
+					if (label.endsWith("\\")) localPart += (localPart.length ? "." : "") + label.slice(0, -1);
+					else if (list.length === 0 && localPart.length) list.push(localPart + "." + label);
+					else list.push(label);
+				});
+			} else list = n.split(".");
+			for (let i = 0; i < list.length; i++) {
+				const len = buf.write(list[i], offset + 1);
+				buf[offset] = len;
+				offset += len + 1;
+			}
+		}
+		buf[offset++] = 0;
+		name.encode.bytes = offset - oldOffset;
+		return buf;
+	};
+	name.encode.bytes = 0;
+	name.decode = function(buf, offset, { mail = false } = {}) {
+		if (!offset) offset = 0;
+		const list = [];
+		let oldOffset = offset;
+		let totalLength = 0;
+		let consumedBytes = 0;
+		let jumped = false;
+		while (true) {
+			if (offset >= buf.length) throw new Error("Cannot decode name (buffer overflow)");
+			const len = buf[offset++];
+			consumedBytes += jumped ? 0 : 1;
+			if (len === 0) break;
+			else if ((len & 192) === 0) {
+				if (offset + len > buf.length) throw new Error("Cannot decode name (buffer overflow)");
+				totalLength += len + 1;
+				if (totalLength > 254) throw new Error("Cannot decode name (name too long)");
+				let label = buf.toString("utf-8", offset, offset + len);
+				if (mail) label = label.replace(/\./g, "\\.");
+				list.push(label);
+				offset += len;
+				consumedBytes += jumped ? 0 : len;
+			} else if ((len & 192) === 192) {
+				if (offset + 1 > buf.length) throw new Error("Cannot decode name (buffer overflow)");
+				const jumpOffset = buf.readUInt16BE(offset - 1) - 49152;
+				if (jumpOffset >= oldOffset) throw new Error("Cannot decode name (bad pointer)");
+				offset = jumpOffset;
+				oldOffset = jumpOffset;
+				consumedBytes += jumped ? 0 : 1;
+				jumped = true;
+			} else throw new Error("Cannot decode name (bad label)");
+		}
+		name.decode.bytes = consumedBytes;
+		return list.length === 0 ? "." : list.join(".");
+	};
+	name.decode.bytes = 0;
+	name.encodingLength = function(n) {
+		if (n === "." || n === "..") return 1;
+		return Buffer$1.byteLength(n.replace(/^\.|\.$/gm, "")) + 2;
+	};
+	var string = {};
+	string.encode = function(s, buf, offset) {
+		if (!buf) buf = Buffer$1.alloc(string.encodingLength(s));
+		if (!offset) offset = 0;
+		const len = buf.write(s, offset + 1);
+		buf[offset] = len;
+		string.encode.bytes = len + 1;
+		return buf;
+	};
+	string.encode.bytes = 0;
+	string.decode = function(buf, offset) {
+		if (!offset) offset = 0;
+		const len = buf[offset];
+		const s = buf.toString("utf-8", offset + 1, offset + 1 + len);
+		string.decode.bytes = len + 1;
+		return s;
+	};
+	string.decode.bytes = 0;
+	string.encodingLength = function(s) {
+		return Buffer$1.byteLength(s) + 1;
+	};
+	var header = {};
+	header.encode = function(h, buf, offset) {
+		if (!buf) buf = header.encodingLength(h);
+		if (!offset) offset = 0;
+		const flags = (h.flags || 0) & 32767;
+		const type = h.type === "response" ? RESPONSE_FLAG : QUERY_FLAG;
+		buf.writeUInt16BE(h.id || 0, offset);
+		buf.writeUInt16BE(flags | type, offset + 2);
+		buf.writeUInt16BE(h.questions.length, offset + 4);
+		buf.writeUInt16BE(h.answers.length, offset + 6);
+		buf.writeUInt16BE(h.authorities.length, offset + 8);
+		buf.writeUInt16BE(h.additionals.length, offset + 10);
+		return buf;
+	};
+	header.encode.bytes = 12;
+	header.decode = function(buf, offset) {
+		if (!offset) offset = 0;
+		if (buf.length < 12) throw new Error("Header must be 12 bytes");
+		const flags = buf.readUInt16BE(offset + 2);
+		return {
+			id: buf.readUInt16BE(offset),
+			type: flags & RESPONSE_FLAG ? "response" : "query",
+			flags: flags & 32767,
+			flag_qr: (flags >> 15 & 1) === 1,
+			opcode: opcodes.toString(flags >> 11 & 15),
+			flag_aa: (flags >> 10 & 1) === 1,
+			flag_tc: (flags >> 9 & 1) === 1,
+			flag_rd: (flags >> 8 & 1) === 1,
+			flag_ra: (flags >> 7 & 1) === 1,
+			flag_z: (flags >> 6 & 1) === 1,
+			flag_ad: (flags >> 5 & 1) === 1,
+			flag_cd: (flags >> 4 & 1) === 1,
+			rcode: rcodes.toString(flags & 15),
+			questions: new Array(buf.readUInt16BE(offset + 4)),
+			answers: new Array(buf.readUInt16BE(offset + 6)),
+			authorities: new Array(buf.readUInt16BE(offset + 8)),
+			additionals: new Array(buf.readUInt16BE(offset + 10))
+		};
+	};
+	header.decode.bytes = 12;
+	header.encodingLength = function() {
+		return 12;
+	};
+	var runknown = exports.unknown = {};
+	runknown.encode = function(data, buf, offset) {
+		if (!buf) buf = Buffer$1.alloc(runknown.encodingLength(data));
+		if (!offset) offset = 0;
+		buf.writeUInt16BE(data.length, offset);
+		data.copy(buf, offset + 2);
+		runknown.encode.bytes = data.length + 2;
+		return buf;
+	};
+	runknown.encode.bytes = 0;
+	runknown.decode = function(buf, offset) {
+		if (!offset) offset = 0;
+		const len = buf.readUInt16BE(offset);
+		const data = buf.slice(offset + 2, offset + 2 + len);
+		runknown.decode.bytes = len + 2;
+		return data;
+	};
+	runknown.decode.bytes = 0;
+	runknown.encodingLength = function(data) {
+		return data.length + 2;
+	};
+	var rns = exports.ns = {};
+	rns.encode = function(data, buf, offset) {
+		if (!buf) buf = Buffer$1.alloc(rns.encodingLength(data));
+		if (!offset) offset = 0;
+		name.encode(data, buf, offset + 2);
+		buf.writeUInt16BE(name.encode.bytes, offset);
+		rns.encode.bytes = name.encode.bytes + 2;
+		return buf;
+	};
+	rns.encode.bytes = 0;
+	rns.decode = function(buf, offset) {
+		if (!offset) offset = 0;
+		const len = buf.readUInt16BE(offset);
+		const dd = name.decode(buf, offset + 2);
+		rns.decode.bytes = len + 2;
+		return dd;
+	};
+	rns.decode.bytes = 0;
+	rns.encodingLength = function(data) {
+		return name.encodingLength(data) + 2;
+	};
+	var rsoa = exports.soa = {};
+	rsoa.encode = function(data, buf, offset) {
+		if (!buf) buf = Buffer$1.alloc(rsoa.encodingLength(data));
+		if (!offset) offset = 0;
+		const oldOffset = offset;
+		offset += 2;
+		name.encode(data.mname, buf, offset);
+		offset += name.encode.bytes;
+		name.encode(data.rname, buf, offset, { mail: true });
+		offset += name.encode.bytes;
+		buf.writeUInt32BE(data.serial || 0, offset);
+		offset += 4;
+		buf.writeUInt32BE(data.refresh || 0, offset);
+		offset += 4;
+		buf.writeUInt32BE(data.retry || 0, offset);
+		offset += 4;
+		buf.writeUInt32BE(data.expire || 0, offset);
+		offset += 4;
+		buf.writeUInt32BE(data.minimum || 0, offset);
+		offset += 4;
+		buf.writeUInt16BE(offset - oldOffset - 2, oldOffset);
+		rsoa.encode.bytes = offset - oldOffset;
+		return buf;
+	};
+	rsoa.encode.bytes = 0;
+	rsoa.decode = function(buf, offset) {
+		if (!offset) offset = 0;
+		const oldOffset = offset;
+		const data = {};
+		offset += 2;
+		data.mname = name.decode(buf, offset);
+		offset += name.decode.bytes;
+		data.rname = name.decode(buf, offset, { mail: true });
+		offset += name.decode.bytes;
+		data.serial = buf.readUInt32BE(offset);
+		offset += 4;
+		data.refresh = buf.readUInt32BE(offset);
+		offset += 4;
+		data.retry = buf.readUInt32BE(offset);
+		offset += 4;
+		data.expire = buf.readUInt32BE(offset);
+		offset += 4;
+		data.minimum = buf.readUInt32BE(offset);
+		offset += 4;
+		rsoa.decode.bytes = offset - oldOffset;
+		return data;
+	};
+	rsoa.decode.bytes = 0;
+	rsoa.encodingLength = function(data) {
+		return 22 + name.encodingLength(data.mname) + name.encodingLength(data.rname);
+	};
+	var rtxt = exports.txt = {};
+	rtxt.encode = function(data, buf, offset) {
+		if (!Array.isArray(data)) data = [data];
+		for (let i = 0; i < data.length; i++) {
+			if (typeof data[i] === "string") data[i] = Buffer$1.from(data[i]);
+			if (!Buffer$1.isBuffer(data[i])) throw new Error("Must be a Buffer");
+		}
+		if (!buf) buf = Buffer$1.alloc(rtxt.encodingLength(data));
+		if (!offset) offset = 0;
+		const oldOffset = offset;
+		offset += 2;
+		data.forEach(function(d) {
+			buf[offset++] = d.length;
+			d.copy(buf, offset, 0, d.length);
+			offset += d.length;
+		});
+		buf.writeUInt16BE(offset - oldOffset - 2, oldOffset);
+		rtxt.encode.bytes = offset - oldOffset;
+		return buf;
+	};
+	rtxt.encode.bytes = 0;
+	rtxt.decode = function(buf, offset) {
+		if (!offset) offset = 0;
+		const oldOffset = offset;
+		let remaining = buf.readUInt16BE(offset);
+		offset += 2;
+		let data = [];
+		while (remaining > 0) {
+			const len = buf[offset++];
+			--remaining;
+			if (remaining < len) throw new Error("Buffer overflow");
+			data.push(buf.slice(offset, offset + len));
+			offset += len;
+			remaining -= len;
+		}
+		rtxt.decode.bytes = offset - oldOffset;
+		return data;
+	};
+	rtxt.decode.bytes = 0;
+	rtxt.encodingLength = function(data) {
+		if (!Array.isArray(data)) data = [data];
+		let length = 2;
+		data.forEach(function(buf) {
+			if (typeof buf === "string") length += Buffer$1.byteLength(buf) + 1;
+			else length += buf.length + 1;
+		});
+		return length;
+	};
+	var rnull = exports.null = {};
+	rnull.encode = function(data, buf, offset) {
+		if (!buf) buf = Buffer$1.alloc(rnull.encodingLength(data));
+		if (!offset) offset = 0;
+		if (typeof data === "string") data = Buffer$1.from(data);
+		if (!data) data = Buffer$1.alloc(0);
+		const oldOffset = offset;
+		offset += 2;
+		const len = data.length;
+		data.copy(buf, offset, 0, len);
+		offset += len;
+		buf.writeUInt16BE(offset - oldOffset - 2, oldOffset);
+		rnull.encode.bytes = offset - oldOffset;
+		return buf;
+	};
+	rnull.encode.bytes = 0;
+	rnull.decode = function(buf, offset) {
+		if (!offset) offset = 0;
+		const oldOffset = offset;
+		const len = buf.readUInt16BE(offset);
+		offset += 2;
+		const data = buf.slice(offset, offset + len);
+		offset += len;
+		rnull.decode.bytes = offset - oldOffset;
+		return data;
+	};
+	rnull.decode.bytes = 0;
+	rnull.encodingLength = function(data) {
+		if (!data) return 2;
+		return (Buffer$1.isBuffer(data) ? data.length : Buffer$1.byteLength(data)) + 2;
+	};
+	var rhinfo = exports.hinfo = {};
+	rhinfo.encode = function(data, buf, offset) {
+		if (!buf) buf = Buffer$1.alloc(rhinfo.encodingLength(data));
+		if (!offset) offset = 0;
+		const oldOffset = offset;
+		offset += 2;
+		string.encode(data.cpu, buf, offset);
+		offset += string.encode.bytes;
+		string.encode(data.os, buf, offset);
+		offset += string.encode.bytes;
+		buf.writeUInt16BE(offset - oldOffset - 2, oldOffset);
+		rhinfo.encode.bytes = offset - oldOffset;
+		return buf;
+	};
+	rhinfo.encode.bytes = 0;
+	rhinfo.decode = function(buf, offset) {
+		if (!offset) offset = 0;
+		const oldOffset = offset;
+		const data = {};
+		offset += 2;
+		data.cpu = string.decode(buf, offset);
+		offset += string.decode.bytes;
+		data.os = string.decode(buf, offset);
+		offset += string.decode.bytes;
+		rhinfo.decode.bytes = offset - oldOffset;
+		return data;
+	};
+	rhinfo.decode.bytes = 0;
+	rhinfo.encodingLength = function(data) {
+		return string.encodingLength(data.cpu) + string.encodingLength(data.os) + 2;
+	};
+	var rptr = exports.ptr = {};
+	var rcname = exports.cname = rptr;
+	var rdname = exports.dname = rptr;
+	rptr.encode = function(data, buf, offset) {
+		if (!buf) buf = Buffer$1.alloc(rptr.encodingLength(data));
+		if (!offset) offset = 0;
+		name.encode(data, buf, offset + 2);
+		buf.writeUInt16BE(name.encode.bytes, offset);
+		rptr.encode.bytes = name.encode.bytes + 2;
+		return buf;
+	};
+	rptr.encode.bytes = 0;
+	rptr.decode = function(buf, offset) {
+		if (!offset) offset = 0;
+		const data = name.decode(buf, offset + 2);
+		rptr.decode.bytes = name.decode.bytes + 2;
+		return data;
+	};
+	rptr.decode.bytes = 0;
+	rptr.encodingLength = function(data) {
+		return name.encodingLength(data) + 2;
+	};
+	var rsrv = exports.srv = {};
+	rsrv.encode = function(data, buf, offset) {
+		if (!buf) buf = Buffer$1.alloc(rsrv.encodingLength(data));
+		if (!offset) offset = 0;
+		buf.writeUInt16BE(data.priority || 0, offset + 2);
+		buf.writeUInt16BE(data.weight || 0, offset + 4);
+		buf.writeUInt16BE(data.port || 0, offset + 6);
+		name.encode(data.target, buf, offset + 8);
+		const len = name.encode.bytes + 6;
+		buf.writeUInt16BE(len, offset);
+		rsrv.encode.bytes = len + 2;
+		return buf;
+	};
+	rsrv.encode.bytes = 0;
+	rsrv.decode = function(buf, offset) {
+		if (!offset) offset = 0;
+		const len = buf.readUInt16BE(offset);
+		const data = {};
+		data.priority = buf.readUInt16BE(offset + 2);
+		data.weight = buf.readUInt16BE(offset + 4);
+		data.port = buf.readUInt16BE(offset + 6);
+		data.target = name.decode(buf, offset + 8);
+		rsrv.decode.bytes = len + 2;
+		return data;
+	};
+	rsrv.decode.bytes = 0;
+	rsrv.encodingLength = function(data) {
+		return 8 + name.encodingLength(data.target);
+	};
+	var rcaa = exports.caa = {};
+	rcaa.ISSUER_CRITICAL = 128;
+	rcaa.encode = function(data, buf, offset) {
+		const len = rcaa.encodingLength(data);
+		if (!buf) buf = Buffer$1.alloc(rcaa.encodingLength(data));
+		if (!offset) offset = 0;
+		if (data.issuerCritical) data.flags = rcaa.ISSUER_CRITICAL;
+		buf.writeUInt16BE(len - 2, offset);
+		offset += 2;
+		buf.writeUInt8(data.flags || 0, offset);
+		offset += 1;
+		string.encode(data.tag, buf, offset);
+		offset += string.encode.bytes;
+		buf.write(data.value, offset);
+		offset += Buffer$1.byteLength(data.value);
+		rcaa.encode.bytes = len;
+		return buf;
+	};
+	rcaa.encode.bytes = 0;
+	rcaa.decode = function(buf, offset) {
+		if (!offset) offset = 0;
+		const len = buf.readUInt16BE(offset);
+		offset += 2;
+		const oldOffset = offset;
+		const data = {};
+		data.flags = buf.readUInt8(offset);
+		offset += 1;
+		data.tag = string.decode(buf, offset);
+		offset += string.decode.bytes;
+		data.value = buf.toString("utf-8", offset, oldOffset + len);
+		data.issuerCritical = !!(data.flags & rcaa.ISSUER_CRITICAL);
+		rcaa.decode.bytes = len + 2;
+		return data;
+	};
+	rcaa.decode.bytes = 0;
+	rcaa.encodingLength = function(data) {
+		return string.encodingLength(data.tag) + string.encodingLength(data.value) + 2;
+	};
+	var rmx = exports.mx = {};
+	rmx.encode = function(data, buf, offset) {
+		if (!buf) buf = Buffer$1.alloc(rmx.encodingLength(data));
+		if (!offset) offset = 0;
+		const oldOffset = offset;
+		offset += 2;
+		buf.writeUInt16BE(data.preference || 0, offset);
+		offset += 2;
+		name.encode(data.exchange, buf, offset);
+		offset += name.encode.bytes;
+		buf.writeUInt16BE(offset - oldOffset - 2, oldOffset);
+		rmx.encode.bytes = offset - oldOffset;
+		return buf;
+	};
+	rmx.encode.bytes = 0;
+	rmx.decode = function(buf, offset) {
+		if (!offset) offset = 0;
+		const oldOffset = offset;
+		const data = {};
+		offset += 2;
+		data.preference = buf.readUInt16BE(offset);
+		offset += 2;
+		data.exchange = name.decode(buf, offset);
+		offset += name.decode.bytes;
+		rmx.decode.bytes = offset - oldOffset;
+		return data;
+	};
+	rmx.encodingLength = function(data) {
+		return 4 + name.encodingLength(data.exchange);
+	};
+	var ra = exports.a = {};
+	ra.encode = function(host, buf, offset) {
+		if (!buf) buf = Buffer$1.alloc(ra.encodingLength(host));
+		if (!offset) offset = 0;
+		buf.writeUInt16BE(4, offset);
+		offset += 2;
+		ip.v4.encode(host, buf, offset);
+		ra.encode.bytes = 6;
+		return buf;
+	};
+	ra.encode.bytes = 0;
+	ra.decode = function(buf, offset) {
+		if (!offset) offset = 0;
+		offset += 2;
+		const host = ip.v4.decode(buf, offset);
+		ra.decode.bytes = 6;
+		return host;
+	};
+	ra.decode.bytes = 0;
+	ra.encodingLength = function() {
+		return 6;
+	};
+	var raaaa = exports.aaaa = {};
+	raaaa.encode = function(host, buf, offset) {
+		if (!buf) buf = Buffer$1.alloc(raaaa.encodingLength(host));
+		if (!offset) offset = 0;
+		buf.writeUInt16BE(16, offset);
+		offset += 2;
+		ip.v6.encode(host, buf, offset);
+		raaaa.encode.bytes = 18;
+		return buf;
+	};
+	raaaa.encode.bytes = 0;
+	raaaa.decode = function(buf, offset) {
+		if (!offset) offset = 0;
+		offset += 2;
+		const host = ip.v6.decode(buf, offset);
+		raaaa.decode.bytes = 18;
+		return host;
+	};
+	raaaa.decode.bytes = 0;
+	raaaa.encodingLength = function() {
+		return 18;
+	};
+	var roption = exports.option = {};
+	roption.encode = function(option, buf, offset) {
+		if (!buf) buf = Buffer$1.alloc(roption.encodingLength(option));
+		if (!offset) offset = 0;
+		const oldOffset = offset;
+		const code = optioncodes.toCode(option.code);
+		buf.writeUInt16BE(code, offset);
+		offset += 2;
+		if (option.data) {
+			buf.writeUInt16BE(option.data.length, offset);
+			offset += 2;
+			option.data.copy(buf, offset);
+			offset += option.data.length;
+		} else switch (code) {
+			case 8:
+				const spl = option.sourcePrefixLength || 0;
+				const fam = option.family || ip.familyOf(option.ip);
+				const ipBuf = ip.encode(option.ip, Buffer$1.alloc);
+				const ipLen = Math.ceil(spl / 8);
+				buf.writeUInt16BE(ipLen + 4, offset);
+				offset += 2;
+				buf.writeUInt16BE(fam, offset);
+				offset += 2;
+				buf.writeUInt8(spl, offset++);
+				buf.writeUInt8(option.scopePrefixLength || 0, offset++);
+				ipBuf.copy(buf, offset, 0, ipLen);
+				offset += ipLen;
+				break;
+			case 11:
+				if (option.timeout) {
+					buf.writeUInt16BE(2, offset);
+					offset += 2;
+					buf.writeUInt16BE(option.timeout, offset);
+					offset += 2;
+				} else {
+					buf.writeUInt16BE(0, offset);
+					offset += 2;
+				}
+				break;
+			case 12:
+				const len = option.length || 0;
+				buf.writeUInt16BE(len, offset);
+				offset += 2;
+				buf.fill(0, offset, offset + len);
+				offset += len;
+				break;
+			case 14:
+				const tagsLen = option.tags.length * 2;
+				buf.writeUInt16BE(tagsLen, offset);
+				offset += 2;
+				for (const tag of option.tags) {
+					buf.writeUInt16BE(tag, offset);
+					offset += 2;
+				}
+				break;
+			default: throw new Error(`Unknown roption code: ${option.code}`);
+		}
+		roption.encode.bytes = offset - oldOffset;
+		return buf;
+	};
+	roption.encode.bytes = 0;
+	roption.decode = function(buf, offset) {
+		if (!offset) offset = 0;
+		const option = {};
+		option.code = buf.readUInt16BE(offset);
+		option.type = optioncodes.toString(option.code);
+		offset += 2;
+		const len = buf.readUInt16BE(offset);
+		offset += 2;
+		option.data = buf.slice(offset, offset + len);
+		switch (option.code) {
+			case 8:
+				option.family = buf.readUInt16BE(offset);
+				offset += 2;
+				option.sourcePrefixLength = buf.readUInt8(offset++);
+				option.scopePrefixLength = buf.readUInt8(offset++);
+				const padded = Buffer$1.alloc(option.family === 1 ? 4 : 16);
+				buf.copy(padded, 0, offset, offset + len - 4);
+				option.ip = ip.decode(padded);
+				break;
+			case 11:
+				if (len > 0) {
+					option.timeout = buf.readUInt16BE(offset);
+					offset += 2;
+				}
+				break;
+			case 14:
+				option.tags = [];
+				for (let i = 0; i < len; i += 2) {
+					option.tags.push(buf.readUInt16BE(offset));
+					offset += 2;
+				}
+		}
+		roption.decode.bytes = len + 4;
+		return option;
+	};
+	roption.decode.bytes = 0;
+	roption.encodingLength = function(option) {
+		if (option.data) return option.data.length + 4;
+		switch (optioncodes.toCode(option.code)) {
+			case 8:
+				const spl = option.sourcePrefixLength || 0;
+				return Math.ceil(spl / 8) + 8;
+			case 11: return typeof option.timeout === "number" ? 6 : 4;
+			case 12: return option.length + 4;
+			case 14: return 4 + option.tags.length * 2;
+		}
+		throw new Error(`Unknown roption code: ${option.code}`);
+	};
+	var ropt = exports.opt = {};
+	ropt.encode = function(options, buf, offset) {
+		if (!buf) buf = Buffer$1.alloc(ropt.encodingLength(options));
+		if (!offset) offset = 0;
+		const oldOffset = offset;
+		const rdlen = encodingLengthList(options, roption);
+		buf.writeUInt16BE(rdlen, offset);
+		offset = encodeList(options, roption, buf, offset + 2);
+		ropt.encode.bytes = offset - oldOffset;
+		return buf;
+	};
+	ropt.encode.bytes = 0;
+	ropt.decode = function(buf, offset) {
+		if (!offset) offset = 0;
+		const oldOffset = offset;
+		const options = [];
+		let rdlen = buf.readUInt16BE(offset);
+		offset += 2;
+		let o = 0;
+		while (rdlen > 0) {
+			options[o++] = roption.decode(buf, offset);
+			offset += roption.decode.bytes;
+			rdlen -= roption.decode.bytes;
+		}
+		ropt.decode.bytes = offset - oldOffset;
+		return options;
+	};
+	ropt.decode.bytes = 0;
+	ropt.encodingLength = function(options) {
+		return 2 + encodingLengthList(options || [], roption);
+	};
+	var rdnskey = exports.dnskey = {};
+	rdnskey.PROTOCOL_DNSSEC = 3;
+	rdnskey.ZONE_KEY = 128;
+	rdnskey.SECURE_ENTRYPOINT = 32768;
+	rdnskey.encode = function(key, buf, offset) {
+		if (!buf) buf = Buffer$1.alloc(rdnskey.encodingLength(key));
+		if (!offset) offset = 0;
+		const oldOffset = offset;
+		const keydata = key.key;
+		if (!Buffer$1.isBuffer(keydata)) throw new Error("Key must be a Buffer");
+		offset += 2;
+		buf.writeUInt16BE(key.flags, offset);
+		offset += 2;
+		buf.writeUInt8(rdnskey.PROTOCOL_DNSSEC, offset);
+		offset += 1;
+		buf.writeUInt8(key.algorithm, offset);
+		offset += 1;
+		keydata.copy(buf, offset, 0, keydata.length);
+		offset += keydata.length;
+		rdnskey.encode.bytes = offset - oldOffset;
+		buf.writeUInt16BE(rdnskey.encode.bytes - 2, oldOffset);
+		return buf;
+	};
+	rdnskey.encode.bytes = 0;
+	rdnskey.decode = function(buf, offset) {
+		if (!offset) offset = 0;
+		const oldOffset = offset;
+		var key = {};
+		var length = buf.readUInt16BE(offset);
+		offset += 2;
+		key.flags = buf.readUInt16BE(offset);
+		offset += 2;
+		if (buf.readUInt8(offset) !== rdnskey.PROTOCOL_DNSSEC) throw new Error("Protocol must be 3");
+		offset += 1;
+		key.algorithm = buf.readUInt8(offset);
+		offset += 1;
+		key.key = buf.slice(offset, oldOffset + length + 2);
+		offset += key.key.length;
+		rdnskey.decode.bytes = offset - oldOffset;
+		return key;
+	};
+	rdnskey.decode.bytes = 0;
+	rdnskey.encodingLength = function(key) {
+		return 6 + Buffer$1.byteLength(key.key);
+	};
+	var rrrsig = exports.rrsig = {};
+	rrrsig.encode = function(sig, buf, offset) {
+		if (!buf) buf = Buffer$1.alloc(rrrsig.encodingLength(sig));
+		if (!offset) offset = 0;
+		const oldOffset = offset;
+		const signature = sig.signature;
+		if (!Buffer$1.isBuffer(signature)) throw new Error("Signature must be a Buffer");
+		offset += 2;
+		buf.writeUInt16BE(types.toType(sig.typeCovered), offset);
+		offset += 2;
+		buf.writeUInt8(sig.algorithm, offset);
+		offset += 1;
+		buf.writeUInt8(sig.labels, offset);
+		offset += 1;
+		buf.writeUInt32BE(sig.originalTTL, offset);
+		offset += 4;
+		buf.writeUInt32BE(sig.expiration, offset);
+		offset += 4;
+		buf.writeUInt32BE(sig.inception, offset);
+		offset += 4;
+		buf.writeUInt16BE(sig.keyTag, offset);
+		offset += 2;
+		name.encode(sig.signersName, buf, offset);
+		offset += name.encode.bytes;
+		signature.copy(buf, offset, 0, signature.length);
+		offset += signature.length;
+		rrrsig.encode.bytes = offset - oldOffset;
+		buf.writeUInt16BE(rrrsig.encode.bytes - 2, oldOffset);
+		return buf;
+	};
+	rrrsig.encode.bytes = 0;
+	rrrsig.decode = function(buf, offset) {
+		if (!offset) offset = 0;
+		const oldOffset = offset;
+		var sig = {};
+		var length = buf.readUInt16BE(offset);
+		offset += 2;
+		sig.typeCovered = types.toString(buf.readUInt16BE(offset));
+		offset += 2;
+		sig.algorithm = buf.readUInt8(offset);
+		offset += 1;
+		sig.labels = buf.readUInt8(offset);
+		offset += 1;
+		sig.originalTTL = buf.readUInt32BE(offset);
+		offset += 4;
+		sig.expiration = buf.readUInt32BE(offset);
+		offset += 4;
+		sig.inception = buf.readUInt32BE(offset);
+		offset += 4;
+		sig.keyTag = buf.readUInt16BE(offset);
+		offset += 2;
+		sig.signersName = name.decode(buf, offset);
+		offset += name.decode.bytes;
+		sig.signature = buf.slice(offset, oldOffset + length + 2);
+		offset += sig.signature.length;
+		rrrsig.decode.bytes = offset - oldOffset;
+		return sig;
+	};
+	rrrsig.decode.bytes = 0;
+	rrrsig.encodingLength = function(sig) {
+		return 20 + name.encodingLength(sig.signersName) + Buffer$1.byteLength(sig.signature);
+	};
+	var rrp = exports.rp = {};
+	rrp.encode = function(data, buf, offset) {
+		if (!buf) buf = Buffer$1.alloc(rrp.encodingLength(data));
+		if (!offset) offset = 0;
+		const oldOffset = offset;
+		offset += 2;
+		name.encode(data.mbox || ".", buf, offset, { mail: true });
+		offset += name.encode.bytes;
+		name.encode(data.txt || ".", buf, offset);
+		offset += name.encode.bytes;
+		rrp.encode.bytes = offset - oldOffset;
+		buf.writeUInt16BE(rrp.encode.bytes - 2, oldOffset);
+		return buf;
+	};
+	rrp.encode.bytes = 0;
+	rrp.decode = function(buf, offset) {
+		if (!offset) offset = 0;
+		const oldOffset = offset;
+		const data = {};
+		offset += 2;
+		data.mbox = name.decode(buf, offset, { mail: true }) || ".";
+		offset += name.decode.bytes;
+		data.txt = name.decode(buf, offset) || ".";
+		offset += name.decode.bytes;
+		rrp.decode.bytes = offset - oldOffset;
+		return data;
+	};
+	rrp.decode.bytes = 0;
+	rrp.encodingLength = function(data) {
+		return 2 + name.encodingLength(data.mbox || ".") + name.encodingLength(data.txt || ".");
+	};
+	var typebitmap = {};
+	typebitmap.encode = function(typelist, buf, offset) {
+		if (!buf) buf = Buffer$1.alloc(typebitmap.encodingLength(typelist));
+		if (!offset) offset = 0;
+		const oldOffset = offset;
+		var typesByWindow = [];
+		for (var i = 0; i < typelist.length; i++) {
+			var typeid = types.toType(typelist[i]);
+			if (typesByWindow[typeid >> 8] === void 0) typesByWindow[typeid >> 8] = [];
+			typesByWindow[typeid >> 8][typeid >> 3 & 31] |= 1 << 7 - (typeid & 7);
+		}
+		for (i = 0; i < typesByWindow.length; i++) if (typesByWindow[i] !== void 0) {
+			var windowBuf = Buffer$1.from(typesByWindow[i]);
+			buf.writeUInt8(i, offset);
+			offset += 1;
+			buf.writeUInt8(windowBuf.length, offset);
+			offset += 1;
+			windowBuf.copy(buf, offset);
+			offset += windowBuf.length;
+		}
+		typebitmap.encode.bytes = offset - oldOffset;
+		return buf;
+	};
+	typebitmap.encode.bytes = 0;
+	typebitmap.decode = function(buf, offset, length) {
+		if (!offset) offset = 0;
+		const oldOffset = offset;
+		var typelist = [];
+		while (offset - oldOffset < length) {
+			var window = buf.readUInt8(offset);
+			offset += 1;
+			var windowLength = buf.readUInt8(offset);
+			offset += 1;
+			for (var i = 0; i < windowLength; i++) {
+				var b = buf.readUInt8(offset + i);
+				for (var j = 0; j < 8; j++) if (b & 1 << 7 - j) {
+					var typeid = types.toString(window << 8 | i << 3 | j);
+					typelist.push(typeid);
+				}
+			}
+			offset += windowLength;
+		}
+		typebitmap.decode.bytes = offset - oldOffset;
+		return typelist;
+	};
+	typebitmap.decode.bytes = 0;
+	typebitmap.encodingLength = function(typelist) {
+		var extents = [];
+		for (var i = 0; i < typelist.length; i++) {
+			var typeid = types.toType(typelist[i]);
+			extents[typeid >> 8] = Math.max(extents[typeid >> 8] || 0, typeid & 255);
+		}
+		var len = 0;
+		for (i = 0; i < extents.length; i++) if (extents[i] !== void 0) len += 2 + Math.ceil((extents[i] + 1) / 8);
+		return len;
+	};
+	var rnsec = exports.nsec = {};
+	rnsec.encode = function(record, buf, offset) {
+		if (!buf) buf = Buffer$1.alloc(rnsec.encodingLength(record));
+		if (!offset) offset = 0;
+		const oldOffset = offset;
+		offset += 2;
+		name.encode(record.nextDomain, buf, offset);
+		offset += name.encode.bytes;
+		typebitmap.encode(record.rrtypes, buf, offset);
+		offset += typebitmap.encode.bytes;
+		rnsec.encode.bytes = offset - oldOffset;
+		buf.writeUInt16BE(rnsec.encode.bytes - 2, oldOffset);
+		return buf;
+	};
+	rnsec.encode.bytes = 0;
+	rnsec.decode = function(buf, offset) {
+		if (!offset) offset = 0;
+		const oldOffset = offset;
+		var record = {};
+		var length = buf.readUInt16BE(offset);
+		offset += 2;
+		record.nextDomain = name.decode(buf, offset);
+		offset += name.decode.bytes;
+		record.rrtypes = typebitmap.decode(buf, offset, length - (offset - oldOffset));
+		offset += typebitmap.decode.bytes;
+		rnsec.decode.bytes = offset - oldOffset;
+		return record;
+	};
+	rnsec.decode.bytes = 0;
+	rnsec.encodingLength = function(record) {
+		return 2 + name.encodingLength(record.nextDomain) + typebitmap.encodingLength(record.rrtypes);
+	};
+	var rnsec3 = exports.nsec3 = {};
+	rnsec3.encode = function(record, buf, offset) {
+		if (!buf) buf = Buffer$1.alloc(rnsec3.encodingLength(record));
+		if (!offset) offset = 0;
+		const oldOffset = offset;
+		const salt = record.salt;
+		if (!Buffer$1.isBuffer(salt)) throw new Error("salt must be a Buffer");
+		const nextDomain = record.nextDomain;
+		if (!Buffer$1.isBuffer(nextDomain)) throw new Error("nextDomain must be a Buffer");
+		offset += 2;
+		buf.writeUInt8(record.algorithm, offset);
+		offset += 1;
+		buf.writeUInt8(record.flags, offset);
+		offset += 1;
+		buf.writeUInt16BE(record.iterations, offset);
+		offset += 2;
+		buf.writeUInt8(salt.length, offset);
+		offset += 1;
+		salt.copy(buf, offset, 0, salt.length);
+		offset += salt.length;
+		buf.writeUInt8(nextDomain.length, offset);
+		offset += 1;
+		nextDomain.copy(buf, offset, 0, nextDomain.length);
+		offset += nextDomain.length;
+		typebitmap.encode(record.rrtypes, buf, offset);
+		offset += typebitmap.encode.bytes;
+		rnsec3.encode.bytes = offset - oldOffset;
+		buf.writeUInt16BE(rnsec3.encode.bytes - 2, oldOffset);
+		return buf;
+	};
+	rnsec3.encode.bytes = 0;
+	rnsec3.decode = function(buf, offset) {
+		if (!offset) offset = 0;
+		const oldOffset = offset;
+		var record = {};
+		var length = buf.readUInt16BE(offset);
+		offset += 2;
+		record.algorithm = buf.readUInt8(offset);
+		offset += 1;
+		record.flags = buf.readUInt8(offset);
+		offset += 1;
+		record.iterations = buf.readUInt16BE(offset);
+		offset += 2;
+		const saltLength = buf.readUInt8(offset);
+		offset += 1;
+		record.salt = buf.slice(offset, offset + saltLength);
+		offset += saltLength;
+		const hashLength = buf.readUInt8(offset);
+		offset += 1;
+		record.nextDomain = buf.slice(offset, offset + hashLength);
+		offset += hashLength;
+		record.rrtypes = typebitmap.decode(buf, offset, length - (offset - oldOffset));
+		offset += typebitmap.decode.bytes;
+		rnsec3.decode.bytes = offset - oldOffset;
+		return record;
+	};
+	rnsec3.decode.bytes = 0;
+	rnsec3.encodingLength = function(record) {
+		return 8 + record.salt.length + record.nextDomain.length + typebitmap.encodingLength(record.rrtypes);
+	};
+	var rds = exports.ds = {};
+	rds.encode = function(digest, buf, offset) {
+		if (!buf) buf = Buffer$1.alloc(rds.encodingLength(digest));
+		if (!offset) offset = 0;
+		const oldOffset = offset;
+		const digestdata = digest.digest;
+		if (!Buffer$1.isBuffer(digestdata)) throw new Error("Digest must be a Buffer");
+		offset += 2;
+		buf.writeUInt16BE(digest.keyTag, offset);
+		offset += 2;
+		buf.writeUInt8(digest.algorithm, offset);
+		offset += 1;
+		buf.writeUInt8(digest.digestType, offset);
+		offset += 1;
+		digestdata.copy(buf, offset, 0, digestdata.length);
+		offset += digestdata.length;
+		rds.encode.bytes = offset - oldOffset;
+		buf.writeUInt16BE(rds.encode.bytes - 2, oldOffset);
+		return buf;
+	};
+	rds.encode.bytes = 0;
+	rds.decode = function(buf, offset) {
+		if (!offset) offset = 0;
+		const oldOffset = offset;
+		var digest = {};
+		var length = buf.readUInt16BE(offset);
+		offset += 2;
+		digest.keyTag = buf.readUInt16BE(offset);
+		offset += 2;
+		digest.algorithm = buf.readUInt8(offset);
+		offset += 1;
+		digest.digestType = buf.readUInt8(offset);
+		offset += 1;
+		digest.digest = buf.slice(offset, oldOffset + length + 2);
+		offset += digest.digest.length;
+		rds.decode.bytes = offset - oldOffset;
+		return digest;
+	};
+	rds.decode.bytes = 0;
+	rds.encodingLength = function(digest) {
+		return 6 + Buffer$1.byteLength(digest.digest);
+	};
+	var rsshfp = exports.sshfp = {};
+	rsshfp.getFingerprintLengthForHashType = function getFingerprintLengthForHashType(hashType) {
+		switch (hashType) {
+			case 1: return 20;
+			case 2: return 32;
+		}
+	};
+	rsshfp.encode = function encode(record, buf, offset) {
+		if (!buf) buf = Buffer$1.alloc(rsshfp.encodingLength(record));
+		if (!offset) offset = 0;
+		const oldOffset = offset;
+		offset += 2;
+		buf[offset] = record.algorithm;
+		offset += 1;
+		buf[offset] = record.hash;
+		offset += 1;
+		const fingerprintBuf = Buffer$1.from(record.fingerprint.toUpperCase(), "hex");
+		if (fingerprintBuf.length !== rsshfp.getFingerprintLengthForHashType(record.hash)) throw new Error("Invalid fingerprint length");
+		fingerprintBuf.copy(buf, offset);
+		offset += fingerprintBuf.byteLength;
+		rsshfp.encode.bytes = offset - oldOffset;
+		buf.writeUInt16BE(rsshfp.encode.bytes - 2, oldOffset);
+		return buf;
+	};
+	rsshfp.encode.bytes = 0;
+	rsshfp.decode = function decode(buf, offset) {
+		if (!offset) offset = 0;
+		const oldOffset = offset;
+		const record = {};
+		offset += 2;
+		record.algorithm = buf[offset];
+		offset += 1;
+		record.hash = buf[offset];
+		offset += 1;
+		const fingerprintLength = rsshfp.getFingerprintLengthForHashType(record.hash);
+		record.fingerprint = buf.slice(offset, offset + fingerprintLength).toString("hex").toUpperCase();
+		offset += fingerprintLength;
+		rsshfp.decode.bytes = offset - oldOffset;
+		return record;
+	};
+	rsshfp.decode.bytes = 0;
+	rsshfp.encodingLength = function(record) {
+		return 4 + Buffer$1.from(record.fingerprint, "hex").byteLength;
+	};
+	var rnaptr = exports.naptr = {};
+	rnaptr.encode = function(data, buf, offset) {
+		if (!buf) buf = Buffer$1.alloc(rnaptr.encodingLength(data));
+		if (!offset) offset = 0;
+		const oldOffset = offset;
+		offset += 2;
+		buf.writeUInt16BE(data.order || 0, offset);
+		offset += 2;
+		buf.writeUInt16BE(data.preference || 0, offset);
+		offset += 2;
+		string.encode(data.flags, buf, offset);
+		offset += string.encode.bytes;
+		string.encode(data.services, buf, offset);
+		offset += string.encode.bytes;
+		string.encode(data.regexp, buf, offset);
+		offset += string.encode.bytes;
+		name.encode(data.replacement, buf, offset);
+		offset += name.encode.bytes;
+		rnaptr.encode.bytes = offset - oldOffset;
+		buf.writeUInt16BE(rnaptr.encode.bytes - 2, oldOffset);
+		return buf;
+	};
+	rnaptr.encode.bytes = 0;
+	rnaptr.decode = function(buf, offset) {
+		if (!offset) offset = 0;
+		const oldOffset = offset;
+		const data = {};
+		offset += 2;
+		data.order = buf.readUInt16BE(offset);
+		offset += 2;
+		data.preference = buf.readUInt16BE(offset);
+		offset += 2;
+		data.flags = string.decode(buf, offset);
+		offset += string.decode.bytes;
+		data.services = string.decode(buf, offset);
+		offset += string.decode.bytes;
+		data.regexp = string.decode(buf, offset);
+		offset += string.decode.bytes;
+		data.replacement = name.decode(buf, offset);
+		offset += name.decode.bytes;
+		rnaptr.decode.bytes = offset - oldOffset;
+		return data;
+	};
+	rnaptr.decode.bytes = 0;
+	rnaptr.encodingLength = function(data) {
+		return string.encodingLength(data.flags) + string.encodingLength(data.services) + string.encodingLength(data.regexp) + name.encodingLength(data.replacement) + 6;
+	};
+	var rtlsa = exports.tlsa = {};
+	rtlsa.encode = function(cert, buf, offset) {
+		if (!buf) buf = Buffer$1.alloc(rtlsa.encodingLength(cert));
+		if (!offset) offset = 0;
+		const oldOffset = offset;
+		const certdata = cert.certificate;
+		if (!Buffer$1.isBuffer(certdata)) throw new Error("Certificate must be a Buffer");
+		offset += 2;
+		buf.writeUInt8(cert.usage, offset);
+		offset += 1;
+		buf.writeUInt8(cert.selector, offset);
+		offset += 1;
+		buf.writeUInt8(cert.matchingType, offset);
+		offset += 1;
+		certdata.copy(buf, offset, 0, certdata.length);
+		offset += certdata.length;
+		rtlsa.encode.bytes = offset - oldOffset;
+		buf.writeUInt16BE(rtlsa.encode.bytes - 2, oldOffset);
+		return buf;
+	};
+	rtlsa.encode.bytes = 0;
+	rtlsa.decode = function(buf, offset) {
+		if (!offset) offset = 0;
+		const oldOffset = offset;
+		const cert = {};
+		const length = buf.readUInt16BE(offset);
+		offset += 2;
+		cert.usage = buf.readUInt8(offset);
+		offset += 1;
+		cert.selector = buf.readUInt8(offset);
+		offset += 1;
+		cert.matchingType = buf.readUInt8(offset);
+		offset += 1;
+		cert.certificate = buf.slice(offset, oldOffset + length + 2);
+		offset += cert.certificate.length;
+		rtlsa.decode.bytes = offset - oldOffset;
+		return cert;
+	};
+	rtlsa.decode.bytes = 0;
+	rtlsa.encodingLength = function(cert) {
+		return 5 + Buffer$1.byteLength(cert.certificate);
+	};
+	var renc = exports.record = function(type) {
+		switch (type.toUpperCase()) {
+			case "A": return ra;
+			case "PTR": return rptr;
+			case "CNAME": return rcname;
+			case "DNAME": return rdname;
+			case "TXT": return rtxt;
+			case "NULL": return rnull;
+			case "AAAA": return raaaa;
+			case "SRV": return rsrv;
+			case "HINFO": return rhinfo;
+			case "CAA": return rcaa;
+			case "NS": return rns;
+			case "SOA": return rsoa;
+			case "MX": return rmx;
+			case "OPT": return ropt;
+			case "DNSKEY": return rdnskey;
+			case "RRSIG": return rrrsig;
+			case "RP": return rrp;
+			case "NSEC": return rnsec;
+			case "NSEC3": return rnsec3;
+			case "SSHFP": return rsshfp;
+			case "DS": return rds;
+			case "NAPTR": return rnaptr;
+			case "TLSA": return rtlsa;
+		}
+		return runknown;
+	};
+	var answer = exports.answer = {};
+	answer.encode = function(a, buf, offset) {
+		if (!buf) buf = Buffer$1.alloc(answer.encodingLength(a));
+		if (!offset) offset = 0;
+		const oldOffset = offset;
+		name.encode(a.name, buf, offset);
+		offset += name.encode.bytes;
+		buf.writeUInt16BE(types.toType(a.type), offset);
+		if (a.type.toUpperCase() === "OPT") {
+			if (a.name !== ".") throw new Error("OPT name must be root.");
+			buf.writeUInt16BE(a.udpPayloadSize || 4096, offset + 2);
+			buf.writeUInt8(a.extendedRcode || 0, offset + 4);
+			buf.writeUInt8(a.ednsVersion || 0, offset + 5);
+			buf.writeUInt16BE(a.flags || 0, offset + 6);
+			offset += 8;
+			ropt.encode(a.options || [], buf, offset);
+			offset += ropt.encode.bytes;
+		} else {
+			let klass = classes.toClass(a.class === void 0 ? "IN" : a.class);
+			if (a.flush) klass |= FLUSH_MASK;
+			buf.writeUInt16BE(klass, offset + 2);
+			buf.writeUInt32BE(a.ttl || 0, offset + 4);
+			offset += 8;
+			const enc = renc(a.type);
+			enc.encode(a.data, buf, offset);
+			offset += enc.encode.bytes;
+		}
+		answer.encode.bytes = offset - oldOffset;
+		return buf;
+	};
+	answer.encode.bytes = 0;
+	answer.decode = function(buf, offset) {
+		if (!offset) offset = 0;
+		const a = {};
+		const oldOffset = offset;
+		a.name = name.decode(buf, offset);
+		offset += name.decode.bytes;
+		a.type = types.toString(buf.readUInt16BE(offset));
+		if (a.type === "OPT") {
+			a.udpPayloadSize = buf.readUInt16BE(offset + 2);
+			a.extendedRcode = buf.readUInt8(offset + 4);
+			a.ednsVersion = buf.readUInt8(offset + 5);
+			a.flags = buf.readUInt16BE(offset + 6);
+			a.flag_do = (a.flags >> 15 & 1) === 1;
+			a.options = ropt.decode(buf, offset + 8);
+			offset += 8 + ropt.decode.bytes;
+		} else {
+			const klass = buf.readUInt16BE(offset + 2);
+			a.ttl = buf.readUInt32BE(offset + 4);
+			a.class = classes.toString(klass & NOT_FLUSH_MASK);
+			a.flush = !!(klass & FLUSH_MASK);
+			const enc = renc(a.type);
+			a.data = enc.decode(buf, offset + 8);
+			offset += 8 + enc.decode.bytes;
+		}
+		answer.decode.bytes = offset - oldOffset;
+		return a;
+	};
+	answer.decode.bytes = 0;
+	answer.encodingLength = function(a) {
+		const data = a.data !== null && a.data !== void 0 ? a.data : a.options;
+		return name.encodingLength(a.name) + 8 + renc(a.type).encodingLength(data);
+	};
+	var question = exports.question = {};
+	question.encode = function(q, buf, offset) {
+		if (!buf) buf = Buffer$1.alloc(question.encodingLength(q));
+		if (!offset) offset = 0;
+		const oldOffset = offset;
+		name.encode(q.name, buf, offset);
+		offset += name.encode.bytes;
+		buf.writeUInt16BE(types.toType(q.type), offset);
+		offset += 2;
+		buf.writeUInt16BE(classes.toClass(q.class === void 0 ? "IN" : q.class), offset);
+		offset += 2;
+		question.encode.bytes = offset - oldOffset;
+		return q;
+	};
+	question.encode.bytes = 0;
+	question.decode = function(buf, offset) {
+		if (!offset) offset = 0;
+		const oldOffset = offset;
+		const q = {};
+		q.name = name.decode(buf, offset);
+		offset += name.decode.bytes;
+		q.type = types.toString(buf.readUInt16BE(offset));
+		offset += 2;
+		q.class = classes.toString(buf.readUInt16BE(offset));
+		offset += 2;
+		if (!!(q.class & QU_MASK)) q.class &= NOT_QU_MASK;
+		question.decode.bytes = offset - oldOffset;
+		return q;
+	};
+	question.decode.bytes = 0;
+	question.encodingLength = function(q) {
+		return name.encodingLength(q.name) + 4;
+	};
+	exports.AUTHORITATIVE_ANSWER = 1024;
+	exports.TRUNCATED_RESPONSE = 512;
+	exports.RECURSION_DESIRED = 256;
+	exports.RECURSION_AVAILABLE = 128;
+	exports.AUTHENTIC_DATA = 32;
+	exports.CHECKING_DISABLED = 16;
+	exports.DNSSEC_OK = 32768;
+	exports.encode = function(result, buf, offset) {
+		const allocing = !buf;
+		if (allocing) buf = Buffer$1.alloc(exports.encodingLength(result));
+		if (!offset) offset = 0;
+		const oldOffset = offset;
+		if (!result.questions) result.questions = [];
+		if (!result.answers) result.answers = [];
+		if (!result.authorities) result.authorities = [];
+		if (!result.additionals) result.additionals = [];
+		header.encode(result, buf, offset);
+		offset += header.encode.bytes;
+		offset = encodeList(result.questions, question, buf, offset);
+		offset = encodeList(result.answers, answer, buf, offset);
+		offset = encodeList(result.authorities, answer, buf, offset);
+		offset = encodeList(result.additionals, answer, buf, offset);
+		exports.encode.bytes = offset - oldOffset;
+		if (allocing && exports.encode.bytes !== buf.length) return buf.slice(0, exports.encode.bytes);
+		return buf;
+	};
+	exports.encode.bytes = 0;
+	exports.decode = function(buf, offset) {
+		if (!offset) offset = 0;
+		const oldOffset = offset;
+		const result = header.decode(buf, offset);
+		offset += header.decode.bytes;
+		offset = decodeList(result.questions, question, buf, offset);
+		offset = decodeList(result.answers, answer, buf, offset);
+		offset = decodeList(result.authorities, answer, buf, offset);
+		offset = decodeList(result.additionals, answer, buf, offset);
+		exports.decode.bytes = offset - oldOffset;
+		return result;
+	};
+	exports.decode.bytes = 0;
+	exports.encodingLength = function(result) {
+		return header.encodingLength(result) + encodingLengthList(result.questions || [], question) + encodingLengthList(result.answers || [], answer) + encodingLengthList(result.authorities || [], answer) + encodingLengthList(result.additionals || [], answer);
+	};
+	exports.streamEncode = function(result) {
+		const buf = exports.encode(result);
+		const sbuf = Buffer$1.alloc(2);
+		sbuf.writeUInt16BE(buf.byteLength);
+		const combine = Buffer$1.concat([sbuf, buf]);
+		exports.streamEncode.bytes = combine.byteLength;
+		return combine;
+	};
+	exports.streamEncode.bytes = 0;
+	exports.streamDecode = function(sbuf) {
+		const len = sbuf.readUInt16BE(0);
+		if (sbuf.byteLength < len + 2) return null;
+		const result = exports.decode(sbuf.slice(2));
+		exports.streamDecode.bytes = exports.decode.bytes;
+		return result;
+	};
+	exports.streamDecode.bytes = 0;
+	function encodingLengthList(list, enc) {
+		let len = 0;
+		for (let i = 0; i < list.length; i++) len += enc.encodingLength(list[i]);
+		return len;
+	}
+	function encodeList(list, enc, buf, offset) {
+		for (let i = 0; i < list.length; i++) {
+			enc.encode(list[i], buf, offset);
+			offset += enc.encode.bytes;
+		}
+		return offset;
+	}
+	function decodeList(list, enc, buf, offset) {
+		for (let i = 0; i < list.length; i++) {
+			list[i] = enc.decode(buf, offset);
+			offset += enc.decode.bytes;
+		}
+		return offset;
+	}
+}));
+//#endregion
+//#region ../../node_modules/.bun/thunky@1.1.0/node_modules/thunky/index.js
+var require_thunky = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	var nextTick = nextTickArgs;
+	process.nextTick(upgrade, 42);
+	module.exports = thunky;
+	function thunky(fn) {
+		var state = run;
+		return thunk;
+		function thunk(callback) {
+			state(callback || noop);
+		}
+		function run(callback) {
+			var stack = [callback];
+			state = wait;
+			fn(done);
+			function wait(callback) {
+				stack.push(callback);
+			}
+			function done(err) {
+				var args = arguments;
+				state = isError(err) ? run : finished;
+				while (stack.length) finished(stack.shift());
+				function finished(callback) {
+					nextTick(apply, callback, args);
+				}
+			}
+		}
+	}
+	function isError(err) {
+		return Object.prototype.toString.call(err) === "[object Error]";
+	}
+	function noop() {}
+	function apply(callback, args) {
+		callback.apply(null, args);
+	}
+	function upgrade(val) {
+		if (val === 42) nextTick = process.nextTick;
+	}
+	function nextTickArgs(fn, a, b) {
+		process.nextTick(function() {
+			fn(a, b);
+		});
+	}
+}));
+//#endregion
+//#region ../lib/src/control-plane/mdns-responder.ts
+var import_multicast_dns = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMin(((exports, module) => {
+	var packet = require_dns_packet();
+	var dgram = __require("dgram");
+	var thunky = require_thunky();
+	var events = __require("events");
+	var os = __require("os");
+	var noop = function() {};
+	module.exports = function(opts) {
+		if (!opts) opts = {};
+		var that = new events.EventEmitter();
+		var port = typeof opts.port === "number" ? opts.port : 5353;
+		var type = opts.type || "udp4";
+		var ip = opts.ip || opts.host || (type === "udp4" ? "224.0.0.251" : null);
+		var me = {
+			address: ip,
+			port
+		};
+		var memberships = {};
+		var destroyed = false;
+		var interval = null;
+		if (type === "udp6" && (!ip || !opts.interface)) throw new Error("For IPv6 multicast you must specify `ip` and `interface`");
+		var socket = opts.socket || dgram.createSocket({
+			type,
+			reuseAddr: opts.reuseAddr !== false,
+			toString: function() {
+				return type;
+			}
+		});
+		socket.on("error", function(err) {
+			if (err.code === "EACCES" || err.code === "EADDRINUSE") that.emit("error", err);
+			else that.emit("warning", err);
+		});
+		socket.on("message", function(message, rinfo) {
+			try {
+				message = packet.decode(message);
+			} catch (err) {
+				that.emit("warning", err);
+				return;
+			}
+			that.emit("packet", message, rinfo);
+			if (message.type === "query") that.emit("query", message, rinfo);
+			if (message.type === "response") that.emit("response", message, rinfo);
+		});
+		socket.on("listening", function() {
+			if (!port) port = me.port = socket.address().port;
+			if (opts.multicast !== false) {
+				that.update();
+				interval = setInterval(that.update, 5e3);
+				socket.setMulticastTTL(opts.ttl || 255);
+				socket.setMulticastLoopback(opts.loopback !== false);
+			}
+		});
+		var bind = thunky(function(cb) {
+			if (!port || opts.bind === false) return cb(null);
+			socket.once("error", cb);
+			socket.bind(port, opts.bind || opts.interface, function() {
+				socket.removeListener("error", cb);
+				cb(null);
+			});
+		});
+		bind(function(err) {
+			if (err) return that.emit("error", err);
+			that.emit("ready");
+		});
+		that.send = function(value, rinfo, cb) {
+			if (typeof rinfo === "function") return that.send(value, null, rinfo);
+			if (!cb) cb = noop;
+			if (!rinfo) rinfo = me;
+			else if (!rinfo.host && !rinfo.address) rinfo.address = me.address;
+			bind(onbind);
+			function onbind(err) {
+				if (destroyed) return cb();
+				if (err) return cb(err);
+				var message = packet.encode(value);
+				socket.send(message, 0, message.length, rinfo.port, rinfo.address || rinfo.host, cb);
+			}
+		};
+		that.response = that.respond = function(res, rinfo, cb) {
+			if (Array.isArray(res)) res = { answers: res };
+			res.type = "response";
+			res.flags = (res.flags || 0) | packet.AUTHORITATIVE_ANSWER;
+			that.send(res, rinfo, cb);
+		};
+		that.query = function(q, type, rinfo, cb) {
+			if (typeof type === "function") return that.query(q, null, null, type);
+			if (typeof type === "object" && type && type.port) return that.query(q, null, type, rinfo);
+			if (typeof rinfo === "function") return that.query(q, type, null, rinfo);
+			if (!cb) cb = noop;
+			if (typeof q === "string") q = [{
+				name: q,
+				type: type || "ANY"
+			}];
+			if (Array.isArray(q)) q = {
+				type: "query",
+				questions: q
+			};
+			q.type = "query";
+			that.send(q, rinfo, cb);
+		};
+		that.destroy = function(cb) {
+			if (!cb) cb = noop;
+			if (destroyed) return process.nextTick(cb);
+			destroyed = true;
+			clearInterval(interval);
+			for (var iface in memberships) try {
+				socket.dropMembership(ip, iface);
+			} catch (e) {}
+			memberships = {};
+			socket.close(cb);
+		};
+		that.update = function() {
+			var ifaces = opts.interface ? [].concat(opts.interface) : allInterfaces();
+			var updated = false;
+			for (var i = 0; i < ifaces.length; i++) {
+				var addr = ifaces[i];
+				if (memberships[addr]) continue;
+				try {
+					socket.addMembership(ip, addr);
+					memberships[addr] = true;
+					updated = true;
+				} catch (err) {
+					that.emit("warning", err);
+				}
+			}
+			if (updated) {
+				if (socket.setMulticastInterface) try {
+					socket.setMulticastInterface(opts.interface || defaultInterface());
+				} catch (err) {
+					that.emit("warning", err);
+				}
+				that.emit("networkInterface");
+			}
+		};
+		return that;
+	};
+	function defaultInterface() {
+		var networks = os.networkInterfaces();
+		var names = Object.keys(networks);
+		for (var i = 0; i < names.length; i++) {
+			var net = networks[names[i]];
+			for (var j = 0; j < net.length; j++) {
+				var iface = net[j];
+				if (isIPv4(iface.family) && !iface.internal) {
+					if (os.platform() === "darwin" && names[i] === "en0") return iface.address;
+					return "0.0.0.0";
+				}
+			}
+		}
+		return "127.0.0.1";
+	}
+	function allInterfaces() {
+		var networks = os.networkInterfaces();
+		var names = Object.keys(networks);
+		var res = [];
+		for (var i = 0; i < names.length; i++) {
+			var net = networks[names[i]];
+			for (var j = 0; j < net.length; j++) {
+				var iface = net[j];
+				if (isIPv4(iface.family)) {
+					res.push(iface.address);
+					break;
+				}
+			}
+		}
+		return res;
+	}
+	function isIPv4(family) {
+		return family === 4 || family === "IPv4";
+	}
+})))());
+var logger$1 = createLogger("mdns");
+var MDNS_PORT = 5353;
+var TTL = 120;
+var HTTP_SERVICE = "_http._tcp.local";
+var DEFAULT_GUARDIAN_PORT = 3830;
+var DEFAULT_ASSISTANT_PORT = 3800;
 /**
-* Startup warning for non-loopback bind addresses.
-*
-* When OP_BIND_ADDRESS is set to a non-loopback value (anything other than
-* 127.0.0.1, localhost, or ::1), services are exposed on the host network
-* interface. This helper produces a structured list of warning lines that
-* callers should log at WARN level so operators are aware.
-*
-* Per-service overrides (e.g. OP_CHAT_BIND_ADDRESS, OP_VOICE_BIND_ADDRESS)
-* are also checked and reported individually.
+* Sanitize an arbitrary string into a DNS label: lowercase, map every
+* character outside `[a-z0-9-]` (including `_`) to `-`, collapse `-` runs,
+* strip leading/trailing `-`, truncate to `maxLength`, and fall back to
+* `"openpalm"` if nothing survives. `maxLength` defaults to 54 so the
+* guardian variant (`<label>-guardian`, +9 chars) still fits the 63-char
+* DNS label limit.
 */
-/** Known per-service bind address env var names (mirrors compose files). */
-var PER_SERVICE_BIND_VARS = [
-	"OP_ASSISTANT_BIND_ADDRESS",
-	"OP_CLIENT_BIND_ADDRESS",
-	"OP_CHAT_BIND_ADDRESS",
-	"OP_API_BIND_ADDRESS",
-	"OP_VOICE_BIND_ADDRESS"
-];
-function isLoopback(value) {
-	const v = value.trim();
-	return v === "127.0.0.1" || v === "localhost" || v === "::1";
+function sanitizeDnsLabel(raw, maxLength = 54) {
+	return raw.trim().toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/-+/g, "-").replace(/^-+|-+$/g, "").slice(0, maxLength).replace(/-+$/g, "") || "openpalm";
 }
 /**
-* Opt-in: allow the web UI (including the first-run setup wizard) to be reached
-* from a remote machine. When set, the UI server binds all interfaces and the
-* Host/Origin allowlist + the setup-localhost-only gate are relaxed.
-*
-* This deliberately reopens the owner-race the setup gate normally prevents, so
-* it is OFF by default and must be explicitly enabled by the operator. Reach the
-* UI over an SSH tunnel or a reverse proxy instead when you can.
+* Derive the base label and full `.local` names from `OP_PROJECT_NAME`
+* (there is no structured "assistant name" — persona is free-text
+* markdown). Defaults to `openpalm`.
 */
-function isRemoteSetupAllowed(env = process.env) {
-	const v = env.OP_ALLOW_REMOTE_SETUP?.trim().toLowerCase();
-	return v === "1" || v === "true" || v === "yes";
+function deriveMdnsNames(env) {
+	const base = sanitizeDnsLabel(env.OP_PROJECT_NAME ?? "openpalm");
+	return {
+		base,
+		assistantName: `${base}.local`,
+		guardianName: `${base}-guardian.local`
+	};
+}
+function isMdnsOffToken(value) {
+	if (value === void 0) return false;
+	const v = value.trim().toLowerCase();
+	return v === "0" || v === "false" || v === "off" || v === "no";
+}
+function isGuardianGated(env) {
+	if (isMdnsOffToken(env.OP_MDNS)) return false;
+	if (env.GUARDIAN_DIRECT_INGRESS !== "true") return false;
+	const bind = env.OP_BIND_ADDRESS;
+	return !!bind && !isLoopback(bind);
+}
+function isAssistantGated(env) {
+	if (isMdnsOffToken(env.OP_MDNS)) return false;
+	const bind = env.OP_ASSISTANT_BIND_ADDRESS;
+	return !!bind && !isLoopback(bind);
+}
+function parsePort(value, fallback) {
+	if (!value) return fallback;
+	const n = Number.parseInt(value, 10);
+	return Number.isFinite(n) && n > 0 ? n : fallback;
+}
+function defaultHostIpv4() {
+	const interfaces = networkInterfaces();
+	const addresses = [];
+	for (const entries of Object.values(interfaces)) {
+		if (!entries) continue;
+		for (const entry of entries) {
+			const family = entry.family;
+			if ((family === "IPv4" || family === 4) && !entry.internal) addresses.push(entry.address);
+		}
+	}
+	return addresses;
+}
+/** True only for a dotted-quad IPv4 literal (4 octets, each 0-255). */
+function isIpv4(address) {
+	const parts = address.trim().split(".");
+	if (parts.length !== 4) return false;
+	return parts.every((p) => /^\d{1,3}$/.test(p) && Number(p) <= 255);
+}
+/** A specific bind IP narrows the addresses; a wildcard bind uses the host interface list. */
+function resolveAdvertAddresses(bind, hostIpv4) {
+	const v = bind.trim();
+	return (v !== "" && v !== "0.0.0.0" && v !== "::" ? [v] : hostIpv4).filter(isIpv4);
 }
 /**
-* Inspect `env` for non-loopback bind address settings and return one warning
-* line per problematic variable.  Returns an empty array when everything is
-* loopback (or unset, since the compose default is 127.0.0.1).
-*
-* @param env - The environment to inspect; typically `process.env`.
+* Resolve which names should be advertised right now, given non-secret env
+* (typically `readStackEnv(homeDir)`). Disabled entirely when `OP_MDNS`
+* trims/lowercases to "0"/"false"/"off"/"no". Guardian advert iff
+* `OP_BIND_ADDRESS` is set and non-loopback; assistant advert iff
+* `OP_ASSISTANT_BIND_ADDRESS` is set and non-loopback. An advert with zero
+* resolved addresses is dropped.
 */
-function collectBindAddressWarnings(env) {
-	const warnings = [];
-	const globalBind = env.OP_BIND_ADDRESS;
-	if (globalBind && !isLoopback(globalBind)) warnings.push(`OP_BIND_ADDRESS is set to "${globalBind}" — services will be exposed on the host network interface, not just loopback. Ensure a firewall is in place if this host is reachable from untrusted networks.`);
-	for (const key of PER_SERVICE_BIND_VARS) {
-		const val = env[key];
-		if (val && !isLoopback(val)) warnings.push(`${key} is set to "${val}" — this service will be exposed on the host network interface.`);
+function resolveMdnsAdvertisements(env, hostIpv4 = defaultHostIpv4()) {
+	const names = deriveMdnsNames(env);
+	const adverts = [];
+	if (isGuardianGated(env)) {
+		const bind = env.OP_BIND_ADDRESS;
+		const addresses = resolveAdvertAddresses(bind, hostIpv4);
+		if (addresses.length > 0) adverts.push({
+			service: "guardian",
+			name: names.guardianName,
+			port: parsePort(env.OP_GUARDIAN_PORT, DEFAULT_GUARDIAN_PORT),
+			addresses
+		});
+	}
+	if (isAssistantGated(env)) {
+		const bind = env.OP_ASSISTANT_BIND_ADDRESS;
+		const addresses = resolveAdvertAddresses(bind, hostIpv4);
+		if (addresses.length > 0) adverts.push({
+			service: "assistant",
+			name: names.assistantName,
+			port: parsePort(env.OP_ASSISTANT_PORT, DEFAULT_ASSISTANT_PORT),
+			addresses
+		});
+	}
+	return adverts;
+}
+/**
+* Names/ports/advertised-state for the admin UI, independent of whether any
+* host IPv4 address can actually be resolved right now — `advertised`
+* reflects the bind-address gate only (D6: gating is bind-address-only), so
+* this never needs a `hostIpv4` param.
+*/
+function resolveMdnsStatus(env) {
+	const names = deriveMdnsNames(env);
+	return {
+		assistant: {
+			name: names.assistantName,
+			port: parsePort(env.OP_ASSISTANT_PORT, DEFAULT_ASSISTANT_PORT),
+			advertised: isAssistantGated(env)
+		},
+		guardian: {
+			name: names.guardianName,
+			port: parsePort(env.OP_GUARDIAN_PORT, DEFAULT_GUARDIAN_PORT),
+			advertised: isGuardianGated(env)
+		}
+	};
+}
+/** The `<name>._http._tcp.local` service instance for a `<name>.local` host. */
+function mdnsInstanceName(name) {
+	return `${name.toLowerCase().endsWith(".local") ? name.slice(0, -6) : name}.${HTTP_SERVICE}`;
+}
+/**
+* Build the answer + additional records for `questions` against the currently
+* advertised `adverts`. `A`/`ANY` queries match a `.local` name exactly; `PTR`/
+* `ANY` queries for `_http._tcp.local` list one service instance per advert
+* with SRV/TXT/A in the additional section. Returns `null` when nothing matches.
+*/
+function buildResponse(questions, adverts) {
+	const answers = [];
+	const additionals = [];
+	const aRecord = (name, address) => ({
+		name,
+		type: "A",
+		ttl: TTL,
+		flush: true,
+		data: address
+	});
+	for (const q of questions) {
+		const qName = (q.name ?? "").toLowerCase();
+		const qType = q.type;
+		if (qType === "A" || qType === "ANY") {
+			const advert = adverts.find((a) => a.name.toLowerCase() === qName);
+			if (advert) for (const address of advert.addresses) answers.push(aRecord(advert.name, address));
+		}
+		if ((qType === "PTR" || qType === "ANY") && qName === HTTP_SERVICE) for (const advert of adverts) {
+			const instance = mdnsInstanceName(advert.name);
+			answers.push({
+				name: HTTP_SERVICE,
+				type: "PTR",
+				ttl: TTL,
+				data: instance
+			});
+			additionals.push({
+				name: instance,
+				type: "SRV",
+				ttl: TTL,
+				data: {
+					port: advert.port,
+					target: advert.name
+				}
+			});
+			additionals.push({
+				name: instance,
+				type: "TXT",
+				ttl: TTL,
+				data: ["path=/"]
+			});
+			for (const address of advert.addresses) additionals.push(aRecord(advert.name, address));
+		}
+	}
+	if (answers.length === 0) return null;
+	return {
+		answers,
+		additionals
+	};
+}
+/** Gratuitous announcement (one A answer per advert address). */
+function announcementAnswers(adverts) {
+	return adverts.flatMap((a) => a.addresses.map((address) => ({
+		name: a.name,
+		type: "A",
+		ttl: TTL,
+		flush: true,
+		data: address
+	})));
+}
+/** TTL-0 goodbye records for every advert address, sent best-effort on stop(). */
+function goodbyeAnswers(adverts) {
+	return adverts.flatMap((a) => a.addresses.map((address) => ({
+		name: a.name,
+		type: "A",
+		ttl: 0,
+		flush: true,
+		data: address
+	})));
+}
+/** Test-only override consulted whenever a caller doesn't pass `deps.makeMdns`. */
+var testMdnsFactory = null;
+function defaultMdnsFactory() {
+	return (0, import_multicast_dns.default)({ loopback: false });
+}
+/**
+* Build a live responder for `adverts`. Returns the public handle (`stop()` —
+* goodbye + destroy) plus an internal `silentClose` (destroy with no goodbye,
+* used only by `_resetMdnsResponderForTests`). All failures are logged `warn`
+* and swallowed — advertisement is a convenience and must never take the UI
+* server down.
+*/
+function createResponder(adverts, deps = {}) {
+	if (adverts.length === 0) return null;
+	const factory = deps.makeMdns ?? testMdnsFactory ?? defaultMdnsFactory;
+	const names = adverts.map((a) => a.name);
+	let mdns;
+	try {
+		mdns = factory();
+	} catch (err) {
+		logger$1.warn("mdns: failed to create socket", {
+			error: String(err),
+			names
+		});
+		return null;
+	}
+	let stopped = false;
+	let announceTimer = null;
+	function announce() {
+		const answers = announcementAnswers(adverts);
+		if (answers.length === 0) return;
+		try {
+			mdns.respond({ answers });
+		} catch (err) {
+			logger$1.warn("mdns: send failed", {
+				error: String(err),
+				names
+			});
+		}
+	}
+	try {
+		mdns.on("query", (message, rinfo) => {
+			if (stopped) return;
+			try {
+				const res = buildResponse(message.questions ?? [], adverts);
+				if (!res) return;
+				const legacy = rinfo.port !== MDNS_PORT;
+				mdns.respond(res, legacy ? rinfo : void 0);
+			} catch (err) {
+				logger$1.warn("mdns: message handling failed", {
+					error: String(err),
+					names
+				});
+			}
+		});
+		mdns.on("error", (err) => logger$1.warn("mdns: socket error", {
+			error: err.message,
+			names
+		}));
+		mdns.on("warning", (err) => logger$1.warn("mdns: warning", {
+			error: err.message,
+			names
+		}));
+	} catch (err) {
+		logger$1.warn("mdns: listener setup failed", {
+			error: String(err),
+			names
+		});
+	}
+	announce();
+	announceTimer = setTimeout(() => announce(), 1e3);
+	announceTimer.unref?.();
+	function destroy() {
+		if (announceTimer) clearTimeout(announceTimer);
+		try {
+			mdns.destroy();
+		} catch (err) {
+			logger$1.warn("mdns: close failed", {
+				error: String(err),
+				names
+			});
+		}
+	}
+	function silentClose() {
+		if (stopped) return;
+		stopped = true;
+		destroy();
+	}
+	return {
+		handle: { stop() {
+			if (stopped) return;
+			stopped = true;
+			try {
+				const answers = goodbyeAnswers(adverts);
+				if (answers.length > 0) mdns.respond({ answers });
+			} catch (err) {
+				logger$1.warn("mdns: goodbye failed", {
+					error: String(err),
+					names
+				});
+			}
+			destroy();
+		} },
+		silentClose
+	};
+}
+var active = null;
+/**
+* Reconcile the live responder against the current stack.env (read fresh on
+* every call — never process.env for the gate vars, since hooks.server.ts's
+* startup promotion is only-if-unset and would go stale after a PUT). The
+* single process-env exception: `OP_MDNS` in `processEnv` force-disables
+* (operator/test kill switch), checked alongside the stack.env value. Never
+* throws. Returns the effective `MdnsStatus` so route handlers can echo it.
+*/
+function reconcileMdnsResponder(homeDir, deps = {}) {
+	let env;
+	try {
+		env = deps.env ?? readStackEnv(homeDir);
+	} catch (err) {
+		logger$1.warn("mdns: reading stack.env failed", { error: String(err) });
+		env = {};
+	}
+	const effectiveEnv = isMdnsOffToken((deps.processEnv ?? process.env).OP_MDNS) ? {
+		...env,
+		OP_MDNS: "off"
+	} : env;
+	try {
+		const adverts = resolveMdnsAdvertisements(effectiveEnv, deps.hostIpv4);
+		const key = JSON.stringify(adverts);
+		if (active && active.key === key) return resolveMdnsStatus(effectiveEnv);
+		if (active) {
+			try {
+				active.handle.stop();
+			} catch (err) {
+				logger$1.warn("mdns: stop failed during reconcile", { error: String(err) });
+			}
+			active = null;
+		}
+		if (adverts.length > 0) {
+			const created = createResponder(adverts, { makeMdns: deps.makeMdns });
+			if (created) active = {
+				key,
+				...created
+			};
+		}
+	} catch (err) {
+		logger$1.warn("mdns: reconcile failed", { error: String(err) });
 	}
-	if (isRemoteSetupAllowed(env)) warnings.push("OP_ALLOW_REMOTE_SETUP is enabled — the web UI is reachable from remote machines and the setup wizard is no longer restricted to the host. Only use this on a trusted network behind a firewall.");
-	return warnings;
+	return resolveMdnsStatus(effectiveEnv);
 }
 function resolveClientAppPort(env = process.env) {
 	return Number(env.OP_HOST_CLIENT_PORT) || 3890;
@@ -17209,5 +19673,5 @@ function resolveClientAppUrl(env = process.env) {
 	return `http://127.0.0.1:${resolveClientAppPort(env)}/chat`;
 }
 
-export { execFileNoThrow as $, AKM_USER_ENV_REF as A, composeStart as B, composeStats as C, DOCKER_IMAGE_NAMES as D, ELECTRON_ASSET_PATTERN as E, composeStop as F, createLogger as G, HostSwapBlockedError as H, INSTALL_LOCK_STALE_AFTER_MS as I, createOpenCodeClient as J, createState as K, deleteUserEnvKey as L, deriveLaunchStatus as M, deriveLocalStackState as N, detectExistingProject as O, PLATFORM_VERSION as P, detectGpu as Q, detectHostOpenCode as R, SERVICE_VERSION_KEYS as S, detectLocalProviders as T, detectRootlessDocker as U, detectRuntime as V, disableHostAkmSharing as W, dismissSecretStripNotice as X, dockerHasNvidiaRuntime as Y, enableHostAkmSharing as Z, ensureAkmUserEnv as _, acquireInstallLock as a, stackDirFor as a$, executeAutomation as a0, fetchProviderModels as a1, formatForDisplay as a2, getAddonProfileAvailability as a3, getAddonProfileSelection as a4, getAddonProfiles as a5, getAddonServiceNames as a6, getAkmStats as a7, getDockerEvents as a8, getHostAkmSharingStatus as a9, readPinnedVersions as aA, readSecret as aB, readSecretFile as aC, readSecretStripNotice as aD, readStackEnv as aE, readStackRuntimeEnv as aF, readStackSecretEnv as aG, readTaskFile as aH, readUserEnvFile as aI, readVersions as aJ, recommendSetup as aK, reconcileHostOwnership as aL, recordProjectRename as aM, releaseInstallLock as aN, removeSecretFile as aO, removeTaskFile as aP, require_dist as aQ, resolveClientAppUrl as aR, resolveComposeProjectName as aS, resolveDataDir as aT, resolveDeployJournalPath as aU, resolveOpenPalmHome as aV, runAssistantAkmCommand as aW, runDeploy as aX, seedUiBuild as aY, setAddonEnabled as aZ, setAddonProfileSelection as a_, getRegistryAddonConfig as aa, getRunningImages as ab, hostAkmStashPath as ac, importHostOpenCode as ad, inspectInstallLock as ae, isAllowedService as af, isRemoteSetupAllowed as ag, isSetupComplete as ah, isVersionKey as ai, listAssistantCliTools as aj, listAvailableAddonIds as ak, listBackupDirs as al, listEnabledAddonIds as am, listSecretFiles as an, loadAutomations as ao, mapDockerError as ap, markSetupComplete as aq, mergeEnvContent as ar, normalizeVersion as as, parseEnvFile as at, patchSecretsEnvFile as au, performSetup as av, pruneBackupDirs as aw, readAutomationLogs as ax, readChannelPreference as ay, readDeployJournal as az, addonProfileId as b, stripVoiceVariantSuffix as b0, summarizeBackups as b1, unlockInstallLock as b2, useExistingProviderForAssistantCli as b3, validateProposedState as b4, writeChannelPreference as b5, writeFileAtomic as b6, writeSecretFile as b7, writeStackSecretEnv as b8, writeTaskFile as b9, writeUserEnvKey as ba, writeVersions as bb, writeVoiceVars as bc, annotateAddonProfileAvailability as c, applyInstall as d, applyStack as e, applyUninstall as f, applyUpdate as g, assertSafeSecretFilename as h, assertSafeTaskFilename as i, authJsonPath as j, backupSetupInputs as k, buildAkmEndpoint as l, buildAkmEnv as m, buildComposeOptions as n, buildManagedServices as o, checkDocker as p, checkDockerCompose as q, classifyLocalInstall as r, collectBindAddressWarnings as s, compareComparableVersions as t, composeDown as u, composeDownProject as v, composeLogs as w, composePreflight as x, composePs as y, composeRestart as z };
-//# sourceMappingURL=src-BwQUi60U.js.map
+export { executeAutomation as $, AKM_USER_ENV_REF as A, composeStats as B, composeStop as C, DOCKER_IMAGE_NAMES as D, ELECTRON_ASSET_PATTERN as E, createLogger as F, createOpenCodeClient as G, HostSwapBlockedError as H, INSTALL_LOCK_STALE_AFTER_MS as I, createState as J, deleteUserEnvKey as K, deriveLaunchStatus as L, deriveLocalStackState as M, detectExistingProject as N, detectGpu as O, PLATFORM_VERSION as P, detectHostOpenCode as Q, detectLocalProviders as R, SERVICE_VERSION_KEYS as S, detectRootlessDocker as T, detectRuntime as U, disableHostAkmSharing as V, dismissSecretStripNotice as W, dockerHasNvidiaRuntime as X, enableHostAkmSharing as Y, ensureAkmUserEnv as Z, execFileNoThrow as _, acquireInstallLock as a, setAddonEnabled as a$, fetchProviderModels as a0, formatForDisplay as a1, getAddonProfileAvailability as a2, getAddonProfileSelection as a3, getAddonProfiles as a4, getAddonServiceNames as a5, getAkmStats as a6, getDockerEvents as a7, getHostAkmSharingStatus as a8, getRegistryAddonConfig as a9, readSecret as aA, readSecretFile as aB, readSecretStripNotice as aC, readStackEnv as aD, readStackRuntimeEnv as aE, readStackSecretEnv as aF, readTaskFile as aG, readUserEnvFile as aH, readVersions as aI, recommendSetup as aJ, reconcileHostOwnership as aK, reconcileMdnsResponder as aL, recordProjectRename as aM, releaseInstallLock as aN, removeSecretFile as aO, removeTaskFile as aP, require_dist as aQ, resolveClientAppPort as aR, resolveClientAppUrl as aS, resolveComposeProjectName as aT, resolveDataDir as aU, resolveDeployJournalPath as aV, resolveMdnsStatus as aW, resolveOpenPalmHome as aX, runAssistantAkmCommand as aY, runDeploy as aZ, seedUiBuild as a_, getRunningImages as aa, hostAkmStashPath as ab, importHostOpenCode as ac, inspectInstallLock as ad, isAllowedService as ae, isSetupComplete as af, isVersionKey as ag, listAssistantCliTools as ah, listAvailableAddonIds as ai, listBackupDirs as aj, listEnabledAddonIds as ak, listSecretFiles as al, loadAutomations as am, mapDockerError as an, markSetupComplete as ao, mergeEnvContent as ap, mintDirectPrincipalPairingCode as aq, normalizeVersion as ar, parseEnvFile as as, patchSecretsEnvFile as at, performSetup as au, pruneBackupDirs as av, readAutomationLogs as aw, readChannelPreference as ax, readDeployJournal as ay, readPinnedVersions as az, addonProfileId as b, setAddonProfileSelection as b0, stackDirFor as b1, stripVoiceVariantSuffix as b2, summarizeBackups as b3, unlockInstallLock as b4, useExistingProviderForAssistantCli as b5, validateProposedState as b6, writeChannelPreference as b7, writeFileAtomic as b8, writeSecretFile as b9, writeStackSecretEnv as ba, writeTaskFile as bb, writeUserEnvKey as bc, writeVersions as bd, writeVoiceVars as be, annotateAddonProfileAvailability as c, applyInstall as d, applyStack as e, applyUninstall as f, applyUpdate as g, assertSafeSecretFilename as h, assertSafeTaskFilename as i, authJsonPath as j, backupSetupInputs as k, buildAkmEndpoint as l, buildAkmEnv as m, buildComposeOptions as n, buildManagedServices as o, checkDocker as p, checkDockerCompose as q, classifyLocalInstall as r, compareComparableVersions as s, composeDown as t, composeDownProject as u, composeLogs as v, composePreflight as w, composePs as x, composeRestart as y, composeStart as z };
+//# sourceMappingURL=src-CQ2F7hgb.js.map