@serfab/cadre-host 1.13.0 → 1.15.0

package/dist/installer/paths.d.ts

@@ -25,8 +25,6 @@ export declare function defaultHostJs(): string;
 export declare function defaultServiceDir(): string;
 /** Where the wizard writes the JSON config. */
 export declare function configPath(dataDir: string): string;
-/** Where the wizard writes the Ed25519 identity. */
-export declare function identityPath(dataDir: string): string;
 /** Logs directory (used by launchd / NSSM unit templates). */
 export declare function logsDir(dataDir: string): string;
 /** Per-platform install dir for the rendered service unit file. */

package/dist/installer/paths.js

@@ -55,10 +55,6 @@ export function defaultServiceDir() {
 export function configPath(dataDir) {
     return join(dataDir, 'host.config.json');
 }
-/** Where the wizard writes the Ed25519 identity. */
-export function identityPath(dataDir) {
-    return join(dataDir, 'identity.key');
-}
 /** Logs directory (used by launchd / NSSM unit templates). */
 export function logsDir(dataDir) {
     return join(dataDir, 'logs');

package/dist/installer/paths.js.map

@@ -1 +1 @@
-{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../src/installer/paths.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAIzC,8EAA8E;AAC9E,SAAS,OAAO,CAAC,QAA2B,EAAE,GAAG,KAAe;IAC9D,OAAO,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC;AAC5E,CAAC;AASD,oFAAoF;AACpF,MAAM,UAAU,cAAc,CAC5B,QAA2B,EAC3B,MAAoB,OAAO,CAAC,GAAmB,EAC/C,OAAe,OAAO,EAAE;IAExB,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,IAAI,GAAG,GAAG,CAAC,aAAa,EAAE,IAAI,EAAE,IAAI,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;YACzG,OAAO,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC;QAC/C,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,OAAO,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,SAAS,EAAE,qBAAqB,EAAE,WAAW,CAAC,CAAC;QACpG,CAAC;QACD,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,sEAAsE;YACtE,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC;YACtC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,sEAAsE;gBACtE,OAAO,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;YAClE,CAAC;YACD,OAAO,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;AACH,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,aAAa;IAC3B,oDAAoD;IACpD,mFAAmF;IACnF,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACrD,OAAO,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;AAC/C,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,iBAAiB;IAC/B,4CAA4C;IAC5C,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACrD,OAAO,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;AAC9C,CAAC;AAED,+CAA+C;AAC/C,MAAM,UAAU,UAAU,CAAC,OAAe;IACxC,OAAO,IAAI,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;AAC3C,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,OAAO,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;AACvC,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,OAAO,CAAC,OAAe;IACrC,OAAO,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,kBAAkB,CAChC,QAA2B,EAC3B,MAAoB,OAAO,CAAC,GAAmB,EAC/C,OAAe,OAAO,EAAE;IAExB,MAAM,EAAE,GAAG,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;IACpC,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,IAAI,GAAG,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,OAAO,CAAC,QAAQ,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;YAC7E,OAAO,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,oBAAoB,CAAC,CAAC;QAC1E,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,OAAO,OAAO,CAAC,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,cAAc,EAAE,6BAA6B,CAAC,CAAC;QACzF,CAAC;QACD,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,kEAAkE;YAClE,kDAAkD;YAClD,OAAO,sDAAsD,CAAC;QAChE,CAAC;IACH,CAAC;AACH,CAAC"}
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../src/installer/paths.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAIzC,8EAA8E;AAC9E,SAAS,OAAO,CAAC,QAA2B,EAAE,GAAG,KAAe;IAC9D,OAAO,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC;AAC5E,CAAC;AASD,oFAAoF;AACpF,MAAM,UAAU,cAAc,CAC5B,QAA2B,EAC3B,MAAoB,OAAO,CAAC,GAAmB,EAC/C,OAAe,OAAO,EAAE;IAExB,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,IAAI,GAAG,GAAG,CAAC,aAAa,EAAE,IAAI,EAAE,IAAI,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;YACzG,OAAO,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC;QAC/C,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,OAAO,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,SAAS,EAAE,qBAAqB,EAAE,WAAW,CAAC,CAAC;QACpG,CAAC;QACD,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,sEAAsE;YACtE,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC;YACtC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,sEAAsE;gBACtE,OAAO,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;YAClE,CAAC;YACD,OAAO,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;AACH,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,aAAa;IAC3B,oDAAoD;IACpD,mFAAmF;IACnF,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACrD,OAAO,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;AAC/C,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,iBAAiB;IAC/B,4CAA4C;IAC5C,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACrD,OAAO,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;AAC9C,CAAC;AAED,+CAA+C;AAC/C,MAAM,UAAU,UAAU,CAAC,OAAe;IACxC,OAAO,IAAI,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;AAC3C,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,OAAO,CAAC,OAAe;IACrC,OAAO,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,kBAAkB,CAChC,QAA2B,EAC3B,MAAoB,OAAO,CAAC,GAAmB,EAC/C,OAAe,OAAO,EAAE;IAExB,MAAM,EAAE,GAAG,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;IACpC,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,IAAI,GAAG,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,OAAO,CAAC,QAAQ,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;YAC7E,OAAO,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,oBAAoB,CAAC,CAAC;QAC1E,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,OAAO,OAAO,CAAC,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,cAAc,EAAE,6BAA6B,CAAC,CAAC;QACzF,CAAC;QACD,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,kEAAkE;YAClE,kDAAkD;YAClD,OAAO,sDAAsD,CAAC;QAChE,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/installer/wizard.d.ts

@@ -9,27 +9,30 @@ import type { SupportedPlatform } from './platform.js';
 export interface WizardDefaults {
     dataDir: string;
     uiPort: number;
-    libp2pPort: number;
     upnpEnabled: boolean;
-    /** Also run the host's own personal cadre here (founder persona). Default false. */
-    ownCadre: boolean;
+    /** Values a command-line flag already supplied: the wizard does not ask for them again. */
+    given?: {
+        dataDir?: boolean;
+        uiPort?: boolean;
+        upnpEnabled?: boolean;
+    };
+    /**
+     * The public IPv4 an interface holds (`publicInterfaceAddress`), when one does: the machine is
+     * reached directly (a VPS), so there is no router to ask about UPnP.
+     */
+    publicInterfaceIp?: string | null;
 }
 export interface WizardAnswers {
     dataDir: string;
     uiPort: number;
-    libp2pPort: number;
     upnpEnabled: boolean;
-    configureDdns: boolean;
-    /** Also run the host's own personal cadre here (founder persona). */
-    ownCadre: boolean;
 }
 export declare const DEFAULT_UI_PORT = 8765;
-export declare const DEFAULT_LIBP2P_PORT = 4001;
 export declare function defaultsForPlatform(platform: SupportedPlatform): WizardDefaults;
 /**
  * Drive the wizard with a function that returns the next user answer for
  * a prompt. Used both by the readline-backed `runWizard` and by tests.
  */
-export declare function runWizardWith(defaults: WizardDefaults, ask: (label: string, fallback: string) => Promise<string>): Promise<WizardAnswers>;
+export declare function runWizardWith(defaults: WizardDefaults, ask: (label: string, fallback: string) => Promise<string>, say?: (line: string) => void): Promise<WizardAnswers>;
 /** Production entrypoint — drives the wizard over stdin/stdout. */
 export declare function runWizard(defaults: WizardDefaults): Promise<WizardAnswers>;

package/dist/installer/wizard.js

@@ -8,36 +8,37 @@
 import { createInterface } from 'node:readline';
 import { defaultDataDir } from './paths.js';
 export const DEFAULT_UI_PORT = 8765;
-export const DEFAULT_LIBP2P_PORT = 4001;
 export function defaultsForPlatform(platform) {
     return {
         dataDir: defaultDataDir(platform),
         uiPort: DEFAULT_UI_PORT,
-        libp2pPort: DEFAULT_LIBP2P_PORT,
         upnpEnabled: true,
-        ownCadre: false,
     };
 }
 /**
  * Drive the wizard with a function that returns the next user answer for
  * a prompt. Used both by the readline-backed `runWizard` and by tests.
  */
-export async function runWizardWith(defaults, ask) {
-    const dataDir = (await ask('Data directory', defaults.dataDir)).trim() || defaults.dataDir;
-    const uiPort = parsePort(await ask('UI port (localhost only)', String(defaults.uiPort)), defaults.uiPort);
-    const libp2pPort = parsePort(await ask('Cadre libp2p port', String(defaults.libp2pPort)), defaults.libp2pPort);
-    const upnpEnabled = parseBool(await ask('Attempt UPnP port mapping on this network? [Y/n]', defaults.upnpEnabled ? 'Y' : 'n'), defaults.upnpEnabled);
-    const configureDdns = parseBool(await ask('Configure DDNS now? [y/N]', 'N'), false);
-    // Founder persona (opt-in). Most installs just donate nodes to friends and
-    // answer no — a no leaves cadre-host donor-only (no owner node, no /auth+/nat).
-    const ownCadre = parseBool(await ask('Also run your own personal cadre on this machine? (most people just donating nodes to friends say no) [y/N]', defaults.ownCadre ? 'Y' : 'N'), defaults.ownCadre);
-    return { dataDir, uiPort, libp2pPort, upnpEnabled, configureDdns, ownCadre };
+export async function runWizardWith(defaults, ask, say = () => { }) {
+    const given = defaults.given ?? {};
+    const dataDir = given.dataDir ? defaults.dataDir : (await ask('Data directory', defaults.dataDir)).trim() || defaults.dataDir;
+    const uiPort = given.uiPort
+        ? defaults.uiPort
+        : parsePort(await ask('UI port (localhost only)', String(defaults.uiPort)), defaults.uiPort);
+    let upnpEnabled = defaults.upnpEnabled;
+    if (defaults.publicInterfaceIp) {
+        say(`This machine has a public IP address (${defaults.publicInterfaceIp}), so it is reached directly: no router, no UPnP.`);
+    }
+    else if (!given.upnpEnabled) {
+        upnpEnabled = parseBool(await ask('This machine is behind a router. Ask it to map ports automatically (UPnP)? [Y/n]', defaults.upnpEnabled ? 'Y' : 'n'), defaults.upnpEnabled);
+    }
+    return { dataDir, uiPort, upnpEnabled };
 }
 /** Production entrypoint — drives the wizard over stdin/stdout. */
 export async function runWizard(defaults) {
     const rl = createInterface({ input: process.stdin, output: process.stdout });
     try {
-        return await runWizardWith(defaults, async (label, fallback) => prompt(rl, label, fallback));
+        return await runWizardWith(defaults, async (label, fallback) => prompt(rl, label, fallback), (line) => console.log(line));
     }
     finally {
         rl.close();

package/dist/installer/wizard.js.map

@@ -1 +1 @@
-{"version":3,"file":"wizard.js","sourceRoot":"","sources":["../../src/installer/wizard.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAuC,MAAM,eAAe,CAAC;AAErF,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAsB5C,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,CAAC;AACpC,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,CAAC;AAExC,MAAM,UAAU,mBAAmB,CAAC,QAA2B;IAC7D,OAAO;QACL,OAAO,EAAE,cAAc,CAAC,QAAQ,CAAC;QACjC,MAAM,EAAE,eAAe;QACvB,UAAU,EAAE,mBAAmB;QAC/B,WAAW,EAAE,IAAI;QACjB,QAAQ,EAAE,KAAK;KAChB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,QAAwB,EACxB,GAAyD;IAEzD,MAAM,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,gBAAgB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,QAAQ,CAAC,OAAO,CAAC;IAC3F,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC,0BAA0B,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC1G,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC,mBAAmB,EAAE,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC/G,MAAM,WAAW,GAAG,SAAS,CAC3B,MAAM,GAAG,CAAC,kDAAkD,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAC/F,QAAQ,CAAC,WAAW,CACrB,CAAC;IACF,MAAM,aAAa,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC,2BAA2B,EAAE,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;IACpF,2EAA2E;IAC3E,gFAAgF;IAChF,MAAM,QAAQ,GAAG,SAAS,CACxB,MAAM,GAAG,CAAC,6GAA6G,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EACvJ,QAAQ,CAAC,QAAQ,CAClB,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC;AAC/E,CAAC;AAED,mEAAmE;AACnE,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,QAAwB;IACtD,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7E,IAAI,CAAC;QACH,OAAO,MAAM,aAAa,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC/F,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,KAAK,EAAE,CAAC;IACb,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,EAAqB,EAAE,KAAa,EAAE,QAAgB;IACpE,OAAO,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,EAAE;QACrC,EAAE,CAAC,QAAQ,CAAC,GAAG,KAAK,KAAK,QAAQ,KAAK,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,SAAS,CAAC,KAAa,EAAE,QAAgB;IAChD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,OAAO;QAAE,OAAO,QAAQ,CAAC;IAC9B,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAC1B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,iBAAiB,KAAK,EAAE,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,SAAS,CAAC,KAAa,EAAE,QAAiB;IACjD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,IAAI,CAAC,OAAO;QAAE,OAAO,QAAQ,CAAC;IAC9B,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,IAAI,KAAK,CAAC,0BAA0B,KAAK,EAAE,CAAC,CAAC;AACrD,CAAC"}
+{"version":3,"file":"wizard.js","sourceRoot":"","sources":["../../src/installer/wizard.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,eAAe,EAAuC,MAAM,eAAe,CAAC;AAErF,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAsB5C,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,CAAC;AAEpC,MAAM,UAAU,mBAAmB,CAAC,QAA2B;IAC7D,OAAO;QACL,OAAO,EAAE,cAAc,CAAC,QAAQ,CAAC;QACjC,MAAM,EAAE,eAAe;QACvB,WAAW,EAAE,IAAI;KAClB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,QAAwB,EACxB,GAAyD,EACzD,MAA8B,GAAG,EAAE,GAAE,CAAC;IAEtC,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC;IACnC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,gBAAgB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,QAAQ,CAAC,OAAO,CAAC;IAC9H,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM;QACzB,CAAC,CAAC,QAAQ,CAAC,MAAM;QACjB,CAAC,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,0BAA0B,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC/F,IAAI,WAAW,GAAG,QAAQ,CAAC,WAAW,CAAC;IACvC,IAAI,QAAQ,CAAC,iBAAiB,EAAE,CAAC;QAC/B,GAAG,CAAC,yCAAyC,QAAQ,CAAC,iBAAiB,mDAAmD,CAAC,CAAC;IAC9H,CAAC;SAAM,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QAC9B,WAAW,GAAG,SAAS,CACrB,MAAM,GAAG,CAAC,kFAAkF,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAC/H,QAAQ,CAAC,WAAW,CACrB,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;AAC1C,CAAC;AAED,mEAAmE;AACnE,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,QAAwB;IACtD,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7E,IAAI,CAAC;QACH,OAAO,MAAM,aAAa,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5H,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,KAAK,EAAE,CAAC;IACb,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,EAAqB,EAAE,KAAa,EAAE,QAAgB;IACpE,OAAO,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,EAAE;QACrC,EAAE,CAAC,QAAQ,CAAC,GAAG,KAAK,KAAK,QAAQ,KAAK,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,SAAS,CAAC,KAAa,EAAE,QAAgB;IAChD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,OAAO;QAAE,OAAO,QAAQ,CAAC;IAC9B,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAC1B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,iBAAiB,KAAK,EAAE,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,SAAS,CAAC,KAAa,EAAE,QAAiB;IACjD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,IAAI,CAAC,OAAO;QAAE,OAAO,QAAQ,CAAC;IAC9B,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,IAAI,KAAK,CAAC,0BAA0B,KAAK,EAAE,CAAC,CAAC;AACrD,CAAC"}

package/dist/nat/address-resolver.d.ts

@@ -1,23 +1,24 @@
 /**
- * Build the multiaddrs that should be embedded in invites.
+ * Build the public multiaddrs of one hosted node from the host's current
+ * understanding of its dialable surface.
  *
- * Inputs are the host's currently-best understanding of its dialable surface:
- *   - DDNS hostname (`/dns4/<hostname>/...`) when configured AND reachable.
- *   - Raw external IP (`/ip4/<ip>/...`) when no DDNS but reachable.
- *   - Whatever libp2p reports otherwise — which would include a `/p2p-circuit/`
- *     address once cadre-host passes a relay to its owner node; it passes none
- *     yet (docs/cadre-host.md → "NAT and DDNS", item 2).
- *
- * This is intentionally a pure function so it's trivial to unit-test, and so
- * the NatService can be the only place that knows about settings → multiaddrs.
+ * Pure so it's trivial to unit-test, and so `NatService` is the only place
+ * that turns settings and routes into addresses. The addresses carry no
+ * `/p2p/` suffix: the node appends its own (cadre-core `normalizeSelfAddrs`,
+ * libp2p for announce addresses). The node's own LAN addresses are not here
+ * either — libp2p reports those itself.
  */
-export interface BuildInviteAddressesInput {
-    peerId: string;
-    externalPort: number;
+import type { PortRoute } from './types.js';
+export interface PublicAddressInput {
     ddnsHostname: string | null;
+    /** Last known public IPv4; null when unknown. */
     externalIp: string | null;
-    reachable: boolean;
-    /** Multiaddrs reported by the underlying libp2p node. */
-    libp2pAddrs: string[];
+    cgnatDetected: boolean;
+    tcp: PortRoute;
+    ws: PortRoute | null;
 }
-export declare function buildInviteAddresses(input: BuildInviteAddressesInput): string[];
+export declare function buildPublicAddresses(input: PublicAddressInput): string[];
+/** True for a hostname of dot-separated RFC 1123 labels, at most 253 characters. */
+export declare function isDnsHostname(s: string): boolean;
+/** True for a dotted-quad IPv4 outside every non-public range above. */
+export declare function isPublicIpv4(s: string): boolean;

package/dist/nat/address-resolver.js

@@ -1,31 +1,85 @@
-export function buildInviteAddresses(input) {
-    const suffix = `/p2p/${input.peerId}`;
-    // DNS path-of-truth: stable across IP changes.
-    if (input.reachable && input.ddnsHostname) {
-        return [`/dns4/${input.ddnsHostname}/tcp/${input.externalPort}${suffix}`];
-    }
-    // Raw IPv4: works when we know our external IP.
-    if (input.reachable && input.externalIp && isIpv4(input.externalIp)) {
-        return [`/ip4/${input.externalIp}/tcp/${input.externalPort}${suffix}`];
-    }
-    // Fallback: whatever libp2p sees. Strip any addresses that lack the
-    // peer suffix and append it for clarity, but otherwise pass through.
-    return input.libp2pAddrs.map((a) => withPeerSuffix(a, input.peerId));
+/**
+ * Build the public multiaddrs of one hosted node from the host's current
+ * understanding of its dialable surface.
+ *
+ * Pure so it's trivial to unit-test, and so `NatService` is the only place
+ * that turns settings and routes into addresses. The addresses carry no
+ * `/p2p/` suffix: the node appends its own (cadre-core `normalizeSelfAddrs`,
+ * libp2p for announce addresses). The node's own LAN addresses are not here
+ * either — libp2p reports those itself.
+ */
+export function buildPublicAddresses(input) {
+    const host = publicHost(input);
+    if (!host)
+        return [];
+    const out = [];
+    const tcpPort = routedPort(input.tcp, input.cgnatDetected);
+    if (tcpPort !== null)
+        out.push(`${host}/tcp/${tcpPort}`);
+    const wsPort = input.ws ? routedPort(input.ws, input.cgnatDetected) : null;
+    if (wsPort !== null)
+        out.push(`${host}/tcp/${wsPort}/ws`);
+    return out;
 }
-function withPeerSuffix(addr, peerId) {
-    if (addr.includes(`/p2p/${peerId}`))
-        return addr;
-    if (addr.includes('/p2p/'))
-        return addr; // already has *some* peer
-    return `${addr}/p2p/${peerId}`;
+/**
+ * `/dns4/<hostname>` when a DDNS hostname is configured (externally managed
+ * included), else `/ip4/<externalIp>` when that is a public IPv4, else none.
+ *
+ * A hostname that is not a DNS name is skipped rather than used: these addresses
+ * reach each node as `CADRE_APPEND_ANNOUNCE_ADDRS`, a comma-separated list that
+ * cadre-core validates at start, so one bad entry (a pasted URL, a comma) would
+ * stop every hosted node from starting.
+ */
+function publicHost(input) {
+    if (input.ddnsHostname && isDnsHostname(input.ddnsHostname))
+        return `/dns4/${input.ddnsHostname}`;
+    if (input.externalIp && isPublicIpv4(input.externalIp))
+        return `/ip4/${input.externalIp}`;
+    return null;
 }
-function isIpv4(s) {
+/** One RFC 1123 label: letters, digits and inner hyphens, 1–63 characters. */
+const DNS_LABEL = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/i;
+/** True for a hostname of dot-separated RFC 1123 labels, at most 253 characters. */
+export function isDnsHostname(s) {
+    return s.length <= 253 && s.split('.').every((label) => DNS_LABEL.test(label));
+}
+/**
+ * Under CGNAT a UPnP route produces nothing: the router's mapping is on a
+ * carrier-private address. A manual route still does, since the user asserted
+ * the forward (the CGNAT check can misfire).
+ */
+function routedPort(route, cgnatDetected) {
+    if (route.externalPort === null || route.source === null)
+        return null;
+    if (cgnatDetected && route.source === 'upnp')
+        return null;
+    return route.externalPort;
+}
+/** Private, carrier-grade, loopback, link-local, multicast and reserved IPv4 ranges. */
+const NON_PUBLIC_IPV4 = [
+    [0x00000000, 8], // 0.0.0.0/8
+    [0x0a000000, 8], // 10.0.0.0/8
+    [0x64400000, 10], // 100.64.0.0/10 (carrier-grade NAT)
+    [0x7f000000, 8], // 127.0.0.0/8
+    [0xa9fe0000, 16], // 169.254.0.0/16
+    [0xac100000, 12], // 172.16.0.0/12
+    [0xc0a80000, 16], // 192.168.0.0/16
+    [0xe0000000, 4], // 224.0.0.0/4 (multicast)
+    [0xf0000000, 4], // 240.0.0.0/4 (reserved, broadcast)
+];
+/** True for a dotted-quad IPv4 outside every non-public range above. */
+export function isPublicIpv4(s) {
+    const octets = parseIpv4(s);
+    if (!octets)
+        return false;
+    const value = ((octets[0] << 24) | (octets[1] << 16) | (octets[2] << 8) | octets[3]) >>> 0;
+    return !NON_PUBLIC_IPV4.some(([base, prefix]) => (value >>> (32 - prefix)) === (base >>> (32 - prefix)));
+}
+function parseIpv4(s) {
     const m = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(s);
     if (!m)
-        return false;
-    return m.slice(1).every((octet) => {
-        const n = Number(octet);
-        return n >= 0 && n <= 255;
-    });
+        return null;
+    const octets = m.slice(1).map(Number);
+    return octets.every((n) => n >= 0 && n <= 255) ? octets : null;
 }
 //# sourceMappingURL=address-resolver.js.map

package/dist/nat/address-resolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"address-resolver.js","sourceRoot":"","sources":["../../src/nat/address-resolver.ts"],"names":[],"mappings":"AAuBA,MAAM,UAAU,oBAAoB,CAAC,KAAgC;IACnE,MAAM,MAAM,GAAG,QAAQ,KAAK,CAAC,MAAM,EAAE,CAAC;IACtC,+CAA+C;IAC/C,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QAC1C,OAAO,CAAC,SAAS,KAAK,CAAC,YAAY,QAAQ,KAAK,CAAC,YAAY,GAAG,MAAM,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,gDAAgD;IAChD,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,UAAU,IAAI,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QACpE,OAAO,CAAC,QAAQ,KAAK,CAAC,UAAU,QAAQ,KAAK,CAAC,YAAY,GAAG,MAAM,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,oEAAoE;IACpE,qEAAqE;IACrE,OAAO,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,cAAc,CAAC,IAAY,EAAE,MAAc;IAClD,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,MAAM,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IACjD,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC,CAAE,0BAA0B;IACpE,OAAO,GAAG,IAAI,QAAQ,MAAM,EAAE,CAAC;AACjC,CAAC;AAED,SAAS,MAAM,CAAC,CAAS;IACvB,MAAM,CAAC,GAAG,8CAA8C,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjE,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACrB,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;QAChC,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QACxB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC;IAC5B,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"address-resolver.js","sourceRoot":"","sources":["../../src/nat/address-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAaH,MAAM,UAAU,oBAAoB,CAAC,KAAyB;IAC5D,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;IAC3D,IAAI,OAAO,KAAK,IAAI;QAAE,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,QAAQ,OAAO,EAAE,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3E,IAAI,MAAM,KAAK,IAAI;QAAE,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,QAAQ,MAAM,KAAK,CAAC,CAAC;IAC1D,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,UAAU,CAAC,KAAyB;IAC3C,IAAI,KAAK,CAAC,YAAY,IAAI,aAAa,CAAC,KAAK,CAAC,YAAY,CAAC;QAAE,OAAO,SAAS,KAAK,CAAC,YAAY,EAAE,CAAC;IAClG,IAAI,KAAK,CAAC,UAAU,IAAI,YAAY,CAAC,KAAK,CAAC,UAAU,CAAC;QAAE,OAAO,QAAQ,KAAK,CAAC,UAAU,EAAE,CAAC;IAC1F,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8EAA8E;AAC9E,MAAM,SAAS,GAAG,yCAAyC,CAAC;AAE5D,oFAAoF;AACpF,MAAM,UAAU,aAAa,CAAC,CAAS;IACrC,OAAO,CAAC,CAAC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;AACjF,CAAC;AAED;;;;GAIG;AACH,SAAS,UAAU,CAAC,KAAgB,EAAE,aAAsB;IAC1D,IAAI,KAAK,CAAC,YAAY,KAAK,IAAI,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACtE,IAAI,aAAa,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAC1D,OAAO,KAAK,CAAC,YAAY,CAAC;AAC5B,CAAC;AAED,wFAAwF;AACxF,MAAM,eAAe,GAAoC;IACvD,CAAC,UAAU,EAAE,CAAC,CAAC,EAAG,YAAY;IAC9B,CAAC,UAAU,EAAE,CAAC,CAAC,EAAG,aAAa;IAC/B,CAAC,UAAU,EAAE,EAAE,CAAC,EAAE,oCAAoC;IACtD,CAAC,UAAU,EAAE,CAAC,CAAC,EAAG,cAAc;IAChC,CAAC,UAAU,EAAE,EAAE,CAAC,EAAE,iBAAiB;IACnC,CAAC,UAAU,EAAE,EAAE,CAAC,EAAE,gBAAgB;IAClC,CAAC,UAAU,EAAE,EAAE,CAAC,EAAE,iBAAiB;IACnC,CAAC,UAAU,EAAE,CAAC,CAAC,EAAG,0BAA0B;IAC5C,CAAC,UAAU,EAAE,CAAC,CAAC,EAAG,oCAAoC;CACvD,CAAC;AAEF,wEAAwE;AACxE,MAAM,UAAU,YAAY,CAAC,CAAS;IACpC,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;IAC5B,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAE,IAAI,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAE,IAAI,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAE,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,CAAC;IAC/F,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,KAAK,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;AAC3G,CAAC;AAED,SAAS,SAAS,CAAC,CAAS;IAC1B,MAAM,CAAC,GAAG,8CAA8C,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjE,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACtC,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AACjE,CAAC"}

package/dist/nat/address-watch.d.ts

@@ -0,0 +1,37 @@
+import type { ManagedNodeInfo } from '../orchestrator/types.js';
+/**
+ * The shortest gap between two address restarts of one node. Bounds a flapping
+ * router (a mapping that keeps failing and coming back) to one restart per node
+ * per window; a difference found inside the window waits for the first check
+ * after it ends.
+ */
+export declare const NAT_ADDRESS_RESTART_MIN_INTERVAL_MS: number;
+/** Asked to restart one node so it starts announcing its current public addresses. */
+export type NodeAddressesStaleListener = (nodeId: string) => void | Promise<void>;
+/**
+ * Notices a running node whose announced public addresses differ from the ones
+ * it should announce now, and asks its listeners to restart that node. A node
+ * learns its public addresses only at start (`CADRE_APPEND_ANNOUNCE_ADDRS`), so
+ * a restart is how a changed mapping, forward, DDNS hostname or external IP
+ * reaches it.
+ */
+export declare class AddressWatch {
+    private readonly now;
+    private readonly listeners;
+    /** When each node was last asked to restart (ms since epoch). */
+    private readonly lastRestartAt;
+    constructor(now: () => number);
+    /** Register a restart listener. Returns an unsubscribe fn. */
+    subscribe(listener: NodeAddressesStaleListener): () => void;
+    /**
+     * Compare every running node's announced addresses with `expected(node)`, as
+     * sets, and ask for a restart of each that differs and was not restarted
+     * within {@link NAT_ADDRESS_RESTART_MIN_INTERVAL_MS}.
+     */
+    check(nodes: ManagedNodeInfo[], expected: (node: ManagedNodeInfo) => string[]): void;
+    /** A terminated node's id may come back as a fresh node, which owes nothing to the old window. */
+    private forgetMissing;
+    private restartedRecently;
+    /** Fire-and-forget: a restart takes seconds and must not hold up the NAT pass that found it. */
+    private notify;
+}

package/dist/nat/address-watch.js

@@ -0,0 +1,84 @@
+import debug from 'debug';
+const log = debug('cadre:host:nat-address-watch');
+/**
+ * The shortest gap between two address restarts of one node. Bounds a flapping
+ * router (a mapping that keeps failing and coming back) to one restart per node
+ * per window; a difference found inside the window waits for the first check
+ * after it ends.
+ */
+export const NAT_ADDRESS_RESTART_MIN_INTERVAL_MS = 10 * 60000;
+/**
+ * Notices a running node whose announced public addresses differ from the ones
+ * it should announce now, and asks its listeners to restart that node. A node
+ * learns its public addresses only at start (`CADRE_APPEND_ANNOUNCE_ADDRS`), so
+ * a restart is how a changed mapping, forward, DDNS hostname or external IP
+ * reaches it.
+ */
+export class AddressWatch {
+    constructor(now) {
+        this.now = now;
+        this.listeners = new Set();
+        /** When each node was last asked to restart (ms since epoch). */
+        this.lastRestartAt = new Map();
+    }
+    /** Register a restart listener. Returns an unsubscribe fn. */
+    subscribe(listener) {
+        this.listeners.add(listener);
+        return () => { this.listeners.delete(listener); };
+    }
+    /**
+     * Compare every running node's announced addresses with `expected(node)`, as
+     * sets, and ask for a restart of each that differs and was not restarted
+     * within {@link NAT_ADDRESS_RESTART_MIN_INTERVAL_MS}.
+     */
+    check(nodes, expected) {
+        this.forgetMissing(nodes);
+        if (this.listeners.size === 0)
+            return;
+        for (const node of nodes) {
+            if (node.status !== 'running')
+                continue;
+            if (sameAddressSet(node.announcedAddrs, expected(node)))
+                continue;
+            if (this.restartedRecently(node.id)) {
+                log('node %s announces stale addresses; restart deferred by the rate limit', node.id);
+                continue;
+            }
+            this.lastRestartAt.set(node.id, this.now());
+            log('node %s announces stale addresses; asking for a restart', node.id);
+            this.notify(node.id);
+        }
+    }
+    /** A terminated node's id may come back as a fresh node, which owes nothing to the old window. */
+    forgetMissing(nodes) {
+        const listed = new Set(nodes.map((n) => n.id));
+        for (const id of this.lastRestartAt.keys()) {
+            if (!listed.has(id))
+                this.lastRestartAt.delete(id);
+        }
+    }
+    restartedRecently(nodeId) {
+        const last = this.lastRestartAt.get(nodeId);
+        return last !== undefined && this.now() - last < NAT_ADDRESS_RESTART_MIN_INTERVAL_MS;
+    }
+    /** Fire-and-forget: a restart takes seconds and must not hold up the NAT pass that found it. */
+    notify(nodeId) {
+        for (const listener of this.listeners) {
+            try {
+                void Promise.resolve(listener(nodeId)).catch((err) => { logRestartFailure(nodeId, err); });
+            }
+            catch (err) {
+                logRestartFailure(nodeId, err);
+            }
+        }
+    }
+}
+function sameAddressSet(a, b) {
+    const left = new Set(a);
+    const right = new Set(b);
+    return left.size === right.size && [...left].every((addr) => right.has(addr));
+}
+function logRestartFailure(nodeId, err) {
+    log('address restart of node %s failed: %s', nodeId, err instanceof Error ? err.message : String(err));
+}
+//# sourceMappingURL=address-watch.js.map

package/dist/nat/address-watch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"address-watch.js","sourceRoot":"","sources":["../../src/nat/address-watch.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAI1B,MAAM,GAAG,GAAG,KAAK,CAAC,8BAA8B,CAAC,CAAC;AAElD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,EAAE,GAAG,KAAM,CAAC;AAK/D;;;;;;GAMG;AACH,MAAM,OAAO,YAAY;IAKvB,YAA6B,GAAiB;QAAjB,QAAG,GAAH,GAAG,CAAc;QAJ7B,cAAS,GAAG,IAAI,GAAG,EAA8B,CAAC;QACnE,iEAAiE;QAChD,kBAAa,GAAG,IAAI,GAAG,EAAkB,CAAC;IAEV,CAAC;IAElD,8DAA8D;IAC9D,SAAS,CAAC,QAAoC;QAC5C,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC7B,OAAO,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACpD,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,KAAwB,EAAE,QAA6C;QAC3E,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO;QACtC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;gBAAE,SAAS;YACxC,IAAI,cAAc,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;gBAAE,SAAS;YAClE,IAAI,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;gBACpC,GAAG,CAAC,uEAAuE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;gBACtF,SAAS;YACX,CAAC;YACD,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YAC5C,GAAG,CAAC,yDAAyD,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;YACxE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IAED,kGAAkG;IAC1F,aAAa,CAAC,KAAwB;QAC5C,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC/C,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,EAAE,CAAC;YAC3C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;gBAAE,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAEO,iBAAiB,CAAC,MAAc;QACtC,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5C,OAAO,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,mCAAmC,CAAC;IACvF,CAAC;IAED,gGAAgG;IACxF,MAAM,CAAC,MAAc;QAC3B,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACtC,IAAI,CAAC;gBACH,KAAK,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE,GAAG,iBAAiB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACtG,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,iBAAiB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YACjC,CAAC;QACH,CAAC;IACH,CAAC;CACF;AAED,SAAS,cAAc,CAAC,CAAoB,EAAE,CAAoB;IAChE,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;IACxB,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;IACzB,OAAO,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AAChF,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAc,EAAE,GAAY;IACrD,GAAG,CAAC,uCAAuC,EAAE,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;AACzG,CAAC"}

package/dist/nat/ddns/duckdns.d.ts

@@ -7,6 +7,7 @@ import type { DdnsProvider } from './index.js';
  * Response is plain text — `OK` on success, `KO` on failure.
  *
  * `hostname` may be supplied as the bare subdomain (`foo`) or the FQDN
- * (`foo.duckdns.org`); we strip the suffix.
+ * (`foo.duckdns.org`); the update strips the suffix, and `qualifyHostname`
+ * adds it.
  */
 export declare const duckDnsProvider: DdnsProvider;

package/dist/nat/ddns/duckdns.js

@@ -9,7 +9,8 @@ const log = debug('cadre:host:nat-ddns:duckdns');
  * Response is plain text — `OK` on success, `KO` on failure.
  *
  * `hostname` may be supplied as the bare subdomain (`foo`) or the FQDN
- * (`foo.duckdns.org`); we strip the suffix.
+ * (`foo.duckdns.org`); the update strips the suffix, and `qualifyHostname`
+ * adds it.
  */
 export const duckDnsProvider = {
     id: 'duckdns',
@@ -17,6 +18,9 @@ export const duckDnsProvider = {
     configFields: [
         { key: 'token', label: 'DuckDNS token', secret: true },
     ],
+    qualifyHostname(hostname) {
+        return `${stripSuffix(hostname)}${SUFFIX}`;
+    },
     async update(config, hostname, ip, deps) {
         const token = config['token'];
         if (!token) {

package/dist/nat/ddns/duckdns.js.map

@@ -1 +1 @@
-{"version":3,"file":"duckdns.js","sourceRoot":"","sources":["../../../src/nat/ddns/duckdns.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAGvC,MAAM,GAAG,GAAG,KAAK,CAAC,6BAA6B,CAAC,CAAC;AAEjD;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,eAAe,GAAiB;IAC3C,EAAE,EAAE,SAAS;IACb,WAAW,EAAE,SAAS;IACtB,YAAY,EAAE;QACZ,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,IAAI,EAAE;KACvD;IACD,KAAK,CAAC,MAAM,CACV,MAA8B,EAC9B,QAAgB,EAChB,EAAU,EACV,IAAsB;QAEtB,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;QAC9B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,QAAQ,CAAC,0BAA0B,EAAE,yCAAyC,CAAC,CAAC;QAC5F,CAAC;QACD,MAAM,SAAS,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,QAAQ,CAAC,gBAAgB,EAAE,qDAAqD,QAAQ,IAAI,CAAC,CAAC;QAC1G,CAAC;QAED,MAAM,GAAG,GAAG,0CAA0C,kBAAkB,CAAC,SAAS,CAAC,UAAU,kBAAkB,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC;QACtJ,GAAG,CAAC,wBAAwB,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QAE7C,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,QAAQ,CAChB,oBAAoB,EACpB,2BAA4B,GAAa,CAAC,OAAO,EAAE,CACpD,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,QAAQ,CAChB,oBAAoB,EACpB,gBAAgB,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,UAAU,EAAE,CAChD,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACvC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,MAAM,IAAI,QAAQ,CAChB,oBAAoB,EACpB,qBAAqB,IAAI,IAAI,SAAS,mBAAmB,CAC1D,CAAC;QACJ,CAAC;IACH,CAAC;CACF,CAAC;AAEF,MAAM,MAAM,GAAG,cAAc,CAAC;AAE9B,SAAS,WAAW,CAAC,QAAgB;IACnC,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACpC,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"duckdns.js","sourceRoot":"","sources":["../../../src/nat/ddns/duckdns.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAGvC,MAAM,GAAG,GAAG,KAAK,CAAC,6BAA6B,CAAC,CAAC;AAEjD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,eAAe,GAAiB;IAC3C,EAAE,EAAE,SAAS;IACb,WAAW,EAAE,SAAS;IACtB,YAAY,EAAE;QACZ,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,IAAI,EAAE;KACvD;IACD,eAAe,CAAC,QAAgB;QAC9B,OAAO,GAAG,WAAW,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE,CAAC;IAC7C,CAAC;IACD,KAAK,CAAC,MAAM,CACV,MAA8B,EAC9B,QAAgB,EAChB,EAAU,EACV,IAAsB;QAEtB,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;QAC9B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,QAAQ,CAAC,0BAA0B,EAAE,yCAAyC,CAAC,CAAC;QAC5F,CAAC;QACD,MAAM,SAAS,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,QAAQ,CAAC,gBAAgB,EAAE,qDAAqD,QAAQ,IAAI,CAAC,CAAC;QAC1G,CAAC;QAED,MAAM,GAAG,GAAG,0CAA0C,kBAAkB,CAAC,SAAS,CAAC,UAAU,kBAAkB,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC;QACtJ,GAAG,CAAC,wBAAwB,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QAE7C,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,QAAQ,CAChB,oBAAoB,EACpB,2BAA4B,GAAa,CAAC,OAAO,EAAE,CACpD,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,QAAQ,CAChB,oBAAoB,EACpB,gBAAgB,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,UAAU,EAAE,CAChD,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACvC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,MAAM,IAAI,QAAQ,CAChB,oBAAoB,EACpB,qBAAqB,IAAI,IAAI,SAAS,mBAAmB,CAC1D,CAAC;QACJ,CAAC;IACH,CAAC;CACF,CAAC;AAEF,MAAM,MAAM,GAAG,cAAc,CAAC;AAE9B,SAAS,WAAW,CAAC,QAAgB;IACnC,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACpC,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/nat/ddns/index.d.ts

@@ -16,6 +16,12 @@ export interface DdnsProvider {
     readonly id: string;
     readonly displayName: string;
     readonly configFields: ReadonlyArray<DdnsConfigField>;
+    /**
+     * The fully qualified name the provider publishes for a hostname as the user
+     * typed it. Stored in place of the typed form because hosted nodes announce the
+     * stored hostname as `/dns4/<hostname>`, so it has to resolve on its own.
+     */
+    qualifyHostname(hostname: string): string;
     /** Push `ip` for `hostname`. Throws NatError(ddns_update_failed) on failure. */
     update(config: Record<string, string>, hostname: string, ip: string, deps: DdnsProviderDeps): Promise<void>;
 }

package/dist/nat/ddns/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/nat/ddns/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAwB,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AA6B/C,+BAA+B;AAC/B,MAAM,CAAC,MAAM,iBAAiB,GAA2C;IACvE,OAAO,EAAE,eAAe;CACzB,CAAC;AAEF,qFAAqF;AACrF,MAAM,UAAU,WAAW,CAAC,UAAkB;IAC5C,MAAM,CAAC,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;IACxC,IAAI,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,IAAI,QAAQ,CAChB,uBAAuB,EACvB,0BAA0B,UAAU,eAAe,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC/F,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,mCAAmC;AACnC,MAAM,UAAU,aAAa;IAC3B,OAAO,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;AAC1C,CAAC;AAED,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/nat/ddns/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAwB,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAmC/C,+BAA+B;AAC/B,MAAM,CAAC,MAAM,iBAAiB,GAA2C;IACvE,OAAO,EAAE,eAAe;CACzB,CAAC;AAEF,qFAAqF;AACrF,MAAM,UAAU,WAAW,CAAC,UAAkB;IAC5C,MAAM,CAAC,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;IACxC,IAAI,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,IAAI,QAAQ,CAChB,uBAAuB,EACvB,0BAA0B,UAAU,eAAe,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC/F,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,mCAAmC;AACnC,MAAM,UAAU,aAAa;IAC3B,OAAO,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;AAC1C,CAAC;AAED,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC"}

package/dist/nat/index.d.ts

@@ -2,20 +2,24 @@
  * NAT / DDNS substrate for cadre-host.
  *
  * See ./nat-service.ts for the top-level orchestrator and `docs/cadre-host.md`
- * for integration notes (the long-running process owner is `cadre-host-local-ui`).
+ * for integration notes (the long-running process owner is `cadre-host start`).
  */
-export { NatService, createNatHandlers } from './nat-service.js';
-export type { NatServiceOptions, CadreNodeLike, AddressesChangedListener } from './nat-service.js';
+export { NatService, createNatHandlers, NAT_UNMAP_GRACE_MS, NAT_RECONCILE_INTERVAL_MS, NAT_IP_REDETECT_INTERVAL_MS, } from './nat-service.js';
+export type { NatServiceOptions, NatNodeSource, NatChangeListener } from './nat-service.js';
+export { NAT_ADDRESS_RESTART_MIN_INTERVAL_MS } from './address-watch.js';
+export type { NodeAddressesStaleListener } from './address-watch.js';
 export { NatStore } from './nat-store.js';
 export { NatError, } from './types.js';
-export type { NatStatusSnapshot, NatDdnsStatus, NatSettingsFile, NatDdnsSettings, NatHandlers, NatErrorCode, PortForwardMode, DirectReachability, DdnsProviderInfo, DdnsConfigField, } from './types.js';
+export type { NatStatusSnapshot, NatGatewayStatus, NatDdnsStatus, NatNetworkStatus, NetworkMode, NetworkSetting, NatSettingsFile, NatDdnsSettings, NatHandlers, NatErrorCode, DirectReachability, NodeReachability, NodeVerdict, PortKind, PortRoute, PortRouteSource, ManualForward, ManualForwardPatch, DdnsProviderInfo, DdnsConfigField, } from './types.js';
 export { ExternalIpDetector, isPlausibleIp, } from './external-ip.js';
 export type { ExternalIpResult, RouterIpProbe, ExternalIpDetectorOptions, } from './external-ip.js';
-export { PortMapperService, createDefaultPortMapper, DEFAULT_LEASE_TTL_MS, DEFAULT_REFRESH_MS, } from './port-mapper.js';
-export type { PortMapper, PortMappingResult, PortMapOptions, PortMapperState, PortMapperServiceOptions, } from './port-mapper.js';
-export { evaluateReachability } from './reachability.js';
-export { buildInviteAddresses } from './address-resolver.js';
-export type { BuildInviteAddressesInput } from './address-resolver.js';
+export { UpnpPortMapper, pickLanAddress, DEFAULT_LEASE_TTL_MS, DEFAULT_REFRESH_MS, GATEWAY_DISCOVERY_TIMEOUT_MS, } from './port-mapper.js';
+export type { PortMapper, GatewayInfo, PortMapRequest, PortMapResult, } from './port-mapper.js';
+export { evaluateNodeReachability, evaluateHostReachability } from './reachability.js';
+export type { NodeVerdictInput, NodeVerdictResult } from './reachability.js';
+export { buildPublicAddresses, isPublicIpv4 } from './address-resolver.js';
+export { publicInterfaceAddress, effectiveNetworkMode } from './network-mode.js';
+export type { PublicAddressInput } from './address-resolver.js';
 export { BUILTIN_PROVIDERS, getProvider, listProviders, duckDnsProvider, DdnsUpdater, } from './ddns/index.js';
 export type { DdnsProvider, DdnsProviderDeps, DdnsUpdaterOptions, DdnsUpdateOutcome, } from './ddns/index.js';
 export { KeytarSecretsStore, FileSecretsStore, createSecretsStore, ddnsAccount, KEYTAR_SERVICE, } from './secrets/index.js';

package/dist/nat/index.js

@@ -2,15 +2,17 @@
  * NAT / DDNS substrate for cadre-host.
  *
  * See ./nat-service.ts for the top-level orchestrator and `docs/cadre-host.md`
- * for integration notes (the long-running process owner is `cadre-host-local-ui`).
+ * for integration notes (the long-running process owner is `cadre-host start`).
  */
-export { NatService, createNatHandlers } from './nat-service.js';
+export { NatService, createNatHandlers, NAT_UNMAP_GRACE_MS, NAT_RECONCILE_INTERVAL_MS, NAT_IP_REDETECT_INTERVAL_MS, } from './nat-service.js';
+export { NAT_ADDRESS_RESTART_MIN_INTERVAL_MS } from './address-watch.js';
 export { NatStore } from './nat-store.js';
 export { NatError, } from './types.js';
 export { ExternalIpDetector, isPlausibleIp, } from './external-ip.js';
-export { PortMapperService, createDefaultPortMapper, DEFAULT_LEASE_TTL_MS, DEFAULT_REFRESH_MS, } from './port-mapper.js';
-export { evaluateReachability } from './reachability.js';
-export { buildInviteAddresses } from './address-resolver.js';
+export { UpnpPortMapper, pickLanAddress, DEFAULT_LEASE_TTL_MS, DEFAULT_REFRESH_MS, GATEWAY_DISCOVERY_TIMEOUT_MS, } from './port-mapper.js';
+export { evaluateNodeReachability, evaluateHostReachability } from './reachability.js';
+export { buildPublicAddresses, isPublicIpv4 } from './address-resolver.js';
+export { publicInterfaceAddress, effectiveNetworkMode } from './network-mode.js';
 export { BUILTIN_PROVIDERS, getProvider, listProviders, duckDnsProvider, DdnsUpdater, } from './ddns/index.js';
 export { KeytarSecretsStore, FileSecretsStore, createSecretsStore, ddnsAccount, KEYTAR_SERVICE, } from './secrets/index.js';
 //# sourceMappingURL=index.js.map

package/dist/nat/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/nat/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAEjE,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EACL,QAAQ,GACT,MAAM,YAAY,CAAC;AAapB,OAAO,EACL,kBAAkB,EAClB,aAAa,GACd,MAAM,kBAAkB,CAAC;AAM1B,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAQ1B,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAE7D,OAAO,EACL,iBAAiB,EACjB,WAAW,EACX,aAAa,EACb,eAAe,EACf,WAAW,GACZ,MAAM,iBAAiB,CAAC;AAOzB,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB,EAClB,WAAW,EACX,cAAc,GACf,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/nat/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,UAAU,EACV,iBAAiB,EACjB,kBAAkB,EAClB,yBAAyB,EACzB,2BAA2B,GAC5B,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,mCAAmC,EAAE,MAAM,oBAAoB,CAAC;AAEzE,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EACL,QAAQ,GACT,MAAM,YAAY,CAAC;AAuBpB,OAAO,EACL,kBAAkB,EAClB,aAAa,GACd,MAAM,kBAAkB,CAAC;AAM1B,OAAO,EACL,cAAc,EACd,cAAc,EACd,oBAAoB,EACpB,kBAAkB,EAClB,4BAA4B,GAC7B,MAAM,kBAAkB,CAAC;AAO1B,OAAO,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAEvF,OAAO,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAC3E,OAAO,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAEjF,OAAO,EACL,iBAAiB,EACjB,WAAW,EACX,aAAa,EACb,eAAe,EACf,WAAW,GACZ,MAAM,iBAAiB,CAAC;AAOzB,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB,EAClB,WAAW,EACX,cAAc,GACf,MAAM,oBAAoB,CAAC"}