@start9labs/start-sdk 2.0.1 → 2.0.3

package/node_modules/@start9labs/start-core/osBindings/DerivedAddressInfo.d.ts

@@ -1,4 +1,3 @@
-import type { GuaAccess } from './GuaAccess';
 import type { HostnameInfo } from './HostnameInfo';
 export type DerivedAddressInfo = {
     /**
@@ -10,12 +9,12 @@ export type DerivedAddressInfo = {
      */
     disabled: Array<[string, number]>;
     /**
-     * User override: per-GUA exposure (only for IPv6 global-unicast addresses),
-     * keyed by the GUA's `SocketAddrV6`. Absent ⇒ [`GuaAccess::Lan`].
+     * User override: IPv6 global-unicast addresses opted into WAN exposure.
+     * Projected into `HostnameInfo.public` by `update_addresses`, so `public`
+     * stays the single source of truth for WAN reachability (P2P address
+     * selection, upstream pinholes). A GUA not in this set is LAN-only.
      */
-    guaAccess: {
-        [key: string]: GuaAccess;
-    };
+    guaWan: Array<string>;
     /**
      * COMPUTED: NetServiceData::update — all possible addresses for this binding
      */

package/node_modules/@start9labs/start-core/osBindings/NetworkInterfaceInfo.d.ts

@@ -4,5 +4,5 @@ export type NetworkInterfaceInfo = {
     name: string | null;
     secure: boolean | null;
     ipInfo: IpInfo | null;
-    type: GatewayType | null;
+    type: GatewayType;
 };

package/node_modules/@start9labs/start-core/osBindings/PartitionInfo.d.ts

@@ -1,14 +1,14 @@
-import type { LegacyBackupInfo } from './LegacyBackupInfo';
 import type { StartOsRecoveryInfo } from './StartOsRecoveryInfo';
 export type PartitionInfo = {
     logicalname: string;
     label: string | null;
     capacity: number;
     used: number | null;
+    available: number | null;
     startOs: {
         [key: string]: StartOsRecoveryInfo;
     };
-    legacyBackup: LegacyBackupInfo | null;
+    legacyBackup: boolean;
     guid: string | null;
     filesystem: string | null;
 };

package/node_modules/@start9labs/start-core/osBindings/QueryDnsRes.d.ts

@@ -0,0 +1,9 @@
+/**
+ * What a public domain currently resolves to, per address family. A public
+ * domain is DualStack: the operator points an `A` record at the gateway's WAN
+ * IPv4 and an `AAAA` at the box's IPv6 GUA. Either may be absent.
+ */
+export type QueryDnsRes = {
+    ipv4: string | null;
+    ipv6: string | null;
+};

package/node_modules/@start9labs/start-core/osBindings/QueryDnsRes.js

@@ -0,0 +1,4 @@
+"use strict";
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=QueryDnsRes.js.map

package/node_modules/@start9labs/start-core/osBindings/QueryDnsRes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"QueryDnsRes.js","sourceRoot":"","sources":["../../lib/osBindings/QueryDnsRes.ts"],"names":[],"mappings":";AAAA,4GAA4G"}

package/node_modules/@start9labs/start-core/osBindings/index.d.ts

@@ -49,7 +49,7 @@ export { BindParams } from './BindParams';
 export { BindRangeParams } from './BindRangeParams';
 export { BindingRanges } from './BindingRanges';
 export { BindingSetAddressEnabledParams } from './BindingSetAddressEnabledParams';
-export { BindingSetGuaAccessParams } from './BindingSetGuaAccessParams';
+export { BindingSetGuaWanParams } from './BindingSetGuaWanParams';
 export { Bindings } from './Bindings';
 export { Blake3Commitment } from './Blake3Commitment';
 export { BlockDev } from './BlockDev';
@@ -63,6 +63,7 @@ export { CheckDependenciesResult } from './CheckDependenciesResult';
 export { CheckDnsParams } from './CheckDnsParams';
 export { CheckPortParams } from './CheckPortParams';
 export { CheckPortRes } from './CheckPortRes';
+export { CheckPortV6Res } from './CheckPortV6Res';
 export { Cifs } from './Cifs';
 export { CifsAddParams } from './CifsAddParams';
 export { CifsBackupTarget } from './CifsBackupTarget';
@@ -137,7 +138,6 @@ export { GetUsersParams } from './GetUsersParams';
 export { GigaBytes } from './GigaBytes';
 export { GitHash } from './GitHash';
 export { Governor } from './Governor';
-export { GuaAccess } from './GuaAccess';
 export { Guid } from './Guid';
 export { HardwareRequirements } from './HardwareRequirements';
 export { HealthCheckId } from './HealthCheckId';
@@ -162,7 +162,6 @@ export { InstallingState } from './InstallingState';
 export { IpInfo } from './IpInfo';
 export { KeyboardOptions } from './KeyboardOptions';
 export { KillParams } from './KillParams';
-export { LegacyBackupInfo } from './LegacyBackupInfo';
 export { ListNotificationParams } from './ListNotificationParams';
 export { ListPackageSignersParams } from './ListPackageSignersParams';
 export { ListServiceInterfacesParams } from './ListServiceInterfacesParams';
@@ -232,6 +231,7 @@ export { ProxyAuth } from './ProxyAuth';
 export { Public } from './Public';
 export { PublicDomainConfig } from './PublicDomainConfig';
 export { QueryDnsParams } from './QueryDnsParams';
+export { QueryDnsRes } from './QueryDnsRes';
 export { RangeBindInfo } from './RangeBindInfo';
 export { RangeServiceInterface } from './RangeServiceInterface';
 export { RebuildParams } from './RebuildParams';

package/node_modules/@start9labs/start-core/osBindings/tunnel/AddPinholeParams.d.ts

@@ -0,0 +1,21 @@
+export type AddPinholeParams = {
+    /**
+     * The client's global IPv6 (GUA) to expose. Must be an address this tunnel
+     * delegates to a client — its subnet needs an IPv6 prefix.
+     */
+    gua: string;
+    /**
+     * External port opened on the GUA.
+     */
+    externalPort: number;
+    /**
+     * Destination port on the GUA. Omit for a pure pinhole (no NAT, internal ==
+     * external); set a different value for a port remap (e.g. 80 -> 443).
+     */
+    internalPort?: number;
+    label: string | null;
+    /**
+     * Number of contiguous ports, counting up from external/internal. Default 1.
+     */
+    count?: number;
+};

package/node_modules/@start9labs/start-core/osBindings/tunnel/AddPinholeParams.js

@@ -0,0 +1,4 @@
+"use strict";
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=AddPinholeParams.js.map

package/node_modules/@start9labs/start-core/osBindings/tunnel/AddPinholeParams.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AddPinholeParams.js","sourceRoot":"","sources":["../../../lib/osBindings/tunnel/AddPinholeParams.ts"],"names":[],"mappings":";AAAA,4GAA4G"}

package/node_modules/@start9labs/start-core/osBindings/tunnel/HttpRedirectStatus.d.ts

@@ -0,0 +1,12 @@
+export type HttpRedirectStatus = {
+    ip: string;
+    /**
+     * Whether the redirect is on for this IP (default true).
+     */
+    enabled: boolean;
+    /**
+     * Whether a port-forward already occupies port 80 on this IP, in which case
+     * the redirect yields and does not bind.
+     */
+    forwarded: boolean;
+};

package/node_modules/@start9labs/start-core/osBindings/tunnel/HttpRedirectStatus.js

@@ -0,0 +1,4 @@
+"use strict";
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=HttpRedirectStatus.js.map

package/node_modules/@start9labs/start-core/osBindings/tunnel/HttpRedirectStatus.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"HttpRedirectStatus.js","sourceRoot":"","sources":["../../../lib/osBindings/tunnel/HttpRedirectStatus.ts"],"names":[],"mappings":";AAAA,4GAA4G"}

package/node_modules/@start9labs/start-core/osBindings/tunnel/HttpRedirects.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Per-IPv4 HTTP→HTTPS redirect state. The tunnel runs a redirect on port 80 of
+ * every public IPv4 by default; this records the addresses where the user has
+ * turned it off (absence = on). The redirect also yields to any port-forward
+ * occupying port 80 on that IP, so the two never fight over the port.
+ */
+export type HttpRedirects = {
+    disabled: string[];
+};

package/node_modules/@start9labs/start-core/osBindings/tunnel/HttpRedirects.js

@@ -0,0 +1,4 @@
+"use strict";
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=HttpRedirects.js.map

package/node_modules/@start9labs/start-core/osBindings/tunnel/HttpRedirects.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"HttpRedirects.js","sourceRoot":"","sources":["../../../lib/osBindings/tunnel/HttpRedirects.ts"],"names":[],"mappings":";AAAA,4GAA4G"}

package/node_modules/@start9labs/start-core/osBindings/tunnel/NetworkInterfaceInfo.d.ts

@@ -4,5 +4,5 @@ export type NetworkInterfaceInfo = {
     name: string | null;
     secure: boolean | null;
     ipInfo: IpInfo | null;
-    type: GatewayType | null;
+    type: GatewayType;
 };

package/node_modules/@start9labs/start-core/osBindings/tunnel/Pinhole.d.ts

@@ -0,0 +1,24 @@
+/**
+ * One IPv6 GUA firewall entry, keyed by the exposed `[GUA]:external_port`. The
+ * destination is always the same GUA. When `internal_port` is `None` (or equals
+ * the key's port) it's a pure firewall pinhole — `ct state new accept`, no NAT.
+ * When it differs it's a port-only DNAT to `[GUA]:internal_port` (e.g. 80→443),
+ * the v6 analogue of a `PortForward::Dnat`.
+ */
+export type Pinhole = {
+    label: string | null;
+    enabled: boolean;
+    /**
+     * Contiguous ports opened, counting up from the key's port; `1` for single.
+     */
+    count: number;
+    /**
+     * Destination port on the GUA; `None` means "same as the external (key) port"
+     * — a pure pinhole. A different value makes this a port-DNAT.
+     */
+    internalPort: number | null;
+    /**
+     * Gateway-created (PCP) vs user-added. Drives the UI Manual/Automatic split.
+     */
+    auto: boolean;
+};

package/node_modules/@start9labs/start-core/osBindings/{GuaAccess.js → tunnel/Pinhole.js}

@@ -1,4 +1,4 @@
 "use strict";
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
 Object.defineProperty(exports, "__esModule", { value: true });
-//# sourceMappingURL=GuaAccess.js.map
+//# sourceMappingURL=Pinhole.js.map

package/node_modules/@start9labs/start-core/osBindings/tunnel/Pinhole.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Pinhole.js","sourceRoot":"","sources":["../../../lib/osBindings/tunnel/Pinhole.ts"],"names":[],"mappings":";AAAA,4GAA4G"}

package/node_modules/@start9labs/start-core/osBindings/tunnel/Pinholes6.d.ts

@@ -0,0 +1,4 @@
+import type { Pinhole } from './Pinhole';
+export type Pinholes6 = {
+    [key: string]: Pinhole;
+};

package/node_modules/@start9labs/start-core/osBindings/tunnel/Pinholes6.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=Pinholes6.js.map

package/node_modules/@start9labs/start-core/osBindings/tunnel/Pinholes6.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Pinholes6.js","sourceRoot":"","sources":["../../../lib/osBindings/tunnel/Pinholes6.ts"],"names":[],"mappings":""}

package/node_modules/@start9labs/start-core/osBindings/tunnel/RemovePinholeParams.d.ts

@@ -0,0 +1,4 @@
+export type RemovePinholeParams = {
+    gua: string;
+    externalPort: number;
+};

package/node_modules/@start9labs/start-core/osBindings/tunnel/RemovePinholeParams.js

@@ -0,0 +1,4 @@
+"use strict";
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=RemovePinholeParams.js.map

package/node_modules/@start9labs/start-core/osBindings/tunnel/RemovePinholeParams.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RemovePinholeParams.js","sourceRoot":"","sources":["../../../lib/osBindings/tunnel/RemovePinholeParams.ts"],"names":[],"mappings":";AAAA,4GAA4G"}

package/node_modules/@start9labs/start-core/osBindings/tunnel/SetHttpRedirectEnabledParams.d.ts

@@ -0,0 +1,7 @@
+export type SetHttpRedirectEnabledParams = {
+    /**
+     * The public IPv4 whose default-on port-80 HTTP→HTTPS redirect to toggle.
+     */
+    ip: string;
+    enabled: boolean;
+};

package/node_modules/@start9labs/start-core/osBindings/tunnel/SetHttpRedirectEnabledParams.js

@@ -0,0 +1,4 @@
+"use strict";
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=SetHttpRedirectEnabledParams.js.map

package/node_modules/@start9labs/start-core/osBindings/tunnel/SetHttpRedirectEnabledParams.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SetHttpRedirectEnabledParams.js","sourceRoot":"","sources":["../../../lib/osBindings/tunnel/SetHttpRedirectEnabledParams.ts"],"names":[],"mappings":";AAAA,4GAA4G"}

package/node_modules/@start9labs/start-core/osBindings/tunnel/SetPinholeEnabledParams.d.ts

@@ -0,0 +1,5 @@
+export type SetPinholeEnabledParams = {
+    gua: string;
+    externalPort: number;
+    enabled: boolean;
+};

package/node_modules/@start9labs/start-core/osBindings/tunnel/SetPinholeEnabledParams.js

@@ -0,0 +1,4 @@
+"use strict";
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=SetPinholeEnabledParams.js.map

package/node_modules/@start9labs/start-core/osBindings/tunnel/SetPinholeEnabledParams.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SetPinholeEnabledParams.js","sourceRoot":"","sources":["../../../lib/osBindings/tunnel/SetPinholeEnabledParams.ts"],"names":[],"mappings":";AAAA,4GAA4G"}

package/node_modules/@start9labs/start-core/osBindings/tunnel/SetSubnetIpv6Params.d.ts

@@ -0,0 +1,8 @@
+export type SetSubnetIpv6Params = {
+    subnet: string;
+    /**
+     * The routed IPv6 prefix delegated to this subnet (e.g. a /64 from Hetzner,
+     * a /56 from Linode). `null` disables IPv6 on the subnet.
+     */
+    prefix: string | null;
+};

package/node_modules/@start9labs/start-core/osBindings/tunnel/SetSubnetIpv6Params.js

@@ -0,0 +1,4 @@
+"use strict";
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=SetSubnetIpv6Params.js.map

package/node_modules/@start9labs/start-core/osBindings/tunnel/SetSubnetIpv6Params.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SetSubnetIpv6Params.js","sourceRoot":"","sources":["../../../lib/osBindings/tunnel/SetSubnetIpv6Params.ts"],"names":[],"mappings":";AAAA,4GAA4G"}

package/node_modules/@start9labs/start-core/osBindings/tunnel/ShowConfigParams.d.ts

@@ -1,5 +1,4 @@
 export type ShowConfigParams = {
     subnet: string;
     ip: string;
-    wanAddr: string | null;
 };

package/node_modules/@start9labs/start-core/osBindings/tunnel/TunnelDatabase.d.ts

@@ -1,7 +1,9 @@
 import type { AnyVerifyingKey } from './AnyVerifyingKey';
 import type { DnsRecords } from './DnsRecords';
 import type { GatewayId } from './GatewayId';
+import type { HttpRedirects } from './HttpRedirects';
 import type { NetworkInterfaceInfo } from './NetworkInterfaceInfo';
+import type { Pinholes6 } from './Pinholes6';
 import type { PortForwards } from './PortForwards';
 import type { Sessions } from './Sessions';
 import type { SignerInfo } from './SignerInfo';
@@ -19,5 +21,12 @@ export type TunnelDatabase = {
     };
     wg: WgServer;
     portForwards: PortForwards;
+    /**
+     * IPv6 GUA firewall pinholes: inbound to a client's own global address is
+     * accepted (no NAT — the GUA is directly routable), keyed by the exposed
+     * `[GUA]:port`. The v4 analogue is a `PortForward::Dnat`.
+     */
+    pinholes6: Pinholes6;
     dnsRecords: DnsRecords;
+    httpRedirects: HttpRedirects;
 };

package/node_modules/@start9labs/start-core/osBindings/tunnel/UpdatePinholeLabelParams.d.ts

@@ -0,0 +1,5 @@
+export type UpdatePinholeLabelParams = {
+    gua: string;
+    externalPort: number;
+    label: string | null;
+};

package/node_modules/@start9labs/start-core/osBindings/tunnel/UpdatePinholeLabelParams.js

@@ -0,0 +1,4 @@
+"use strict";
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=UpdatePinholeLabelParams.js.map

package/node_modules/@start9labs/start-core/osBindings/tunnel/UpdatePinholeLabelParams.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"UpdatePinholeLabelParams.js","sourceRoot":"","sources":["../../../lib/osBindings/tunnel/UpdatePinholeLabelParams.ts"],"names":[],"mappings":";AAAA,4GAA4G"}

package/node_modules/@start9labs/start-core/osBindings/tunnel/WgSubnetConfig.d.ts

@@ -9,4 +9,10 @@ export type WgSubnetConfig = {
      * keeps the default masquerade; a per-device `wan_ip` overrides this.
      */
     wanIp: string | null;
+    /**
+     * Routed IPv6 prefix delegated to this subnet, if any. Each host on the
+     * subnet (the server and every client) gets one `/128` out of it with its
+     * tunnel IPv4 embedded — see [`crate::tunnel::wg6`].
+     */
+    ipv6: string | null;
 };

package/node_modules/@start9labs/start-core/osBindings/tunnel/index.d.ts

@@ -1,6 +1,7 @@
 export { AddDeviceParams } from './AddDeviceParams';
 export { AddDnsRecordParams } from './AddDnsRecordParams';
 export { AddKeyParams } from './AddKeyParams';
+export { AddPinholeParams } from './AddPinholeParams';
 export { AddPortForwardParams } from './AddPortForwardParams';
 export { AddSubnetParams } from './AddSubnetParams';
 export { AnyVerifyingKey } from './AnyVerifyingKey';
@@ -11,16 +12,21 @@ export { DnsRecordEntry } from './DnsRecordEntry';
 export { DnsRecords } from './DnsRecords';
 export { GatewayId } from './GatewayId';
 export { GatewayType } from './GatewayType';
+export { HttpRedirectStatus } from './HttpRedirectStatus';
+export { HttpRedirects } from './HttpRedirects';
 export { IpInfo } from './IpInfo';
 export { ListDevicesParams } from './ListDevicesParams';
 export { NetworkInterfaceInfo } from './NetworkInterfaceInfo';
 export { NetworkInterfaceType } from './NetworkInterfaceType';
 export { Pem } from './Pem';
+export { Pinhole } from './Pinhole';
+export { Pinholes6 } from './Pinholes6';
 export { PortForward } from './PortForward';
 export { PortForwards } from './PortForwards';
 export { RemoveDeviceParams } from './RemoveDeviceParams';
 export { RemoveDnsRecordParams } from './RemoveDnsRecordParams';
 export { RemoveKeyParams } from './RemoveKeyParams';
+export { RemovePinholeParams } from './RemovePinholeParams';
 export { RemovePortForwardParams } from './RemovePortForwardParams';
 export { Session } from './Session';
 export { Sessions } from './Sessions';
@@ -28,9 +34,12 @@ export { SetAutoPortForwardParams } from './SetAutoPortForwardParams';
 export { SetDeviceKindParams } from './SetDeviceKindParams';
 export { SetDeviceWanParams } from './SetDeviceWanParams';
 export { SetDnsInjectionParams } from './SetDnsInjectionParams';
+export { SetHttpRedirectEnabledParams } from './SetHttpRedirectEnabledParams';
 export { SetPasswordParams } from './SetPasswordParams';
+export { SetPinholeEnabledParams } from './SetPinholeEnabledParams';
 export { SetPortForwardEnabledParams } from './SetPortForwardEnabledParams';
 export { SetSubnetDnsParams } from './SetSubnetDnsParams';
+export { SetSubnetIpv6Params } from './SetSubnetIpv6Params';
 export { SetSubnetWanParams } from './SetSubnetWanParams';
 export { ShowConfigParams } from './ShowConfigParams';
 export { SignerInfo } from './SignerInfo';
@@ -39,6 +48,7 @@ export { SubnetParams } from './SubnetParams';
 export { TunnelCertData } from './TunnelCertData';
 export { TunnelDatabase } from './TunnelDatabase';
 export { TunnelUpdateResult } from './TunnelUpdateResult';
+export { UpdatePinholeLabelParams } from './UpdatePinholeLabelParams';
 export { UpdatePortForwardLabelParams } from './UpdatePortForwardLabelParams';
 export { WebserverInfo } from './WebserverInfo';
 export { WgClientKind } from './WgClientKind';

package/node_modules/@start9labs/start-core/package.json

@@ -5,7 +5,9 @@
   "sideEffects": true,
   "scripts": {
     "peggy": "peggy --allowed-start-rules \"*\" --plugin ./node_modules/ts-pegjs/dist/tspegjs -o lib/exver/exver.ts lib/exver/exver.pegjs",
-    "copy": "cpy \"**/*.js\" \"**/*.d.ts\" ../dist --cwd=lib --parents && cp -a node_modules dist/ && cpy package.json README.md LICENSE dist",
+    "copy": "cpy \"**/*.js\" \"**/*.d.ts\" ../dist --cwd=lib --parents && node -e \"fs.cpSync('node_modules','dist/node_modules',{recursive:true,verbatimSymlinks:true})\" && cpy package.json README.md LICENSE dist",
+    "clean:dist": "node -e \"fs.rmSync('dist',{recursive:true,force:true})\"",
+    "build": "npm run clean:dist && npm run tsc && npm run copy",
     "test": "jest -c ./jest.config.js --coverage",
     "buildOutput": "npx prettier --write \"**/*.ts\"",
     "check": "tsc --noEmit",
@@ -32,13 +34,6 @@
     "zod": "4.4.3",
     "zod-deep-partial": "^1.4.4"
   },
-  "prettier": {
-    "trailingComma": "all",
-    "tabWidth": 2,
-    "semi": false,
-    "singleQuote": true,
-    "arrowParens": "avoid"
-  },
   "devDependencies": {
     "@types/jest": "^30.0.0",
     "@types/lodash.merge": "^4.6.2",

package/node_modules/@start9labs/start-core/util/ip.d.ts

@@ -35,6 +35,13 @@ export declare class IpAddress {
     isIpv6(): boolean;
     /** Returns true if this is a public IPv4 address (not in any private range). */
     isPublic(): boolean;
+    /**
+     * Returns true if this is an IPv6 global-unicast address (a GUA) — i.e. IPv6
+     * that is not loopback, unique-local (`fc00::/7`), or link-local (`fe80::/10`).
+     * Mirrors the backend's `ipv6_is_local`, so it identifies the same globally
+     * routable address StartOS advertises for DualStack.
+     */
+    isGua(): boolean;
     /**
      * Returns a new IpAddress incremented by `n`.
      * @param n - The integer amount to add (fractional part is truncated)
@@ -107,5 +114,7 @@ export declare const IPV4_LOOPBACK: IpNet;
 export declare const IPV6_LOOPBACK: IpNet;
 /** IPv6 link-local network (fe80::/10). */
 export declare const IPV6_LINK_LOCAL: IpNet;
+/** IPv6 unique-local network (fc00::/7). */
+export declare const IPV6_ULA: IpNet;
 /** Carrier-Grade NAT (CGNAT) address range (100.64.0.0/10), per RFC 6598. */
 export declare const CGNAT: IpNet;

package/node_modules/@start9labs/start-core/util/ip.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CGNAT = exports.IPV6_LINK_LOCAL = exports.IPV6_LOOPBACK = exports.IPV4_LOOPBACK = exports.PRIVATE_IPV4_RANGES = exports.IpNet = exports.IpAddress = void 0;
+exports.CGNAT = exports.IPV6_ULA = exports.IPV6_LINK_LOCAL = exports.IPV6_LOOPBACK = exports.IPV4_LOOPBACK = exports.PRIVATE_IPV4_RANGES = exports.IpNet = exports.IpAddress = void 0;
 /**
  * Represents an IPv4 or IPv6 address as raw octets with arithmetic and comparison operations.
  *
@@ -77,20 +77,7 @@ class IpAddress {
             if (octets.some(o => o > 255)) {
                 throw new Error('invalid ip address');
             }
-            let pre = octets.slice(0, 8);
-            while (pre[pre.length - 1] == 0) {
-                pre.pop();
-            }
-            let post = octets.slice(8);
-            while (post[0] == 0) {
-                post.unshift();
-            }
-            if (pre.length + post.length == 16) {
-                return new IpAddress(octets, octets.join(':'));
-            }
-            else {
-                return new IpAddress(octets, pre.join(':') + '::' + post.join(':'));
-            }
+            return new IpAddress(octets, renderIpv6(octets));
         }
         else {
             throw new Error('invalid ip address');
@@ -108,6 +95,18 @@ class IpAddress {
     isPublic() {
         return this.isIpv4() && !exports.PRIVATE_IPV4_RANGES.some(r => r.contains(this));
     }
+    /**
+     * Returns true if this is an IPv6 global-unicast address (a GUA) — i.e. IPv6
+     * that is not loopback, unique-local (`fc00::/7`), or link-local (`fe80::/10`).
+     * Mirrors the backend's `ipv6_is_local`, so it identifies the same globally
+     * routable address StartOS advertises for DualStack.
+     */
+    isGua() {
+        return (this.isIpv6() &&
+            !exports.IPV6_LOOPBACK.contains(this) &&
+            !exports.IPV6_ULA.contains(this) &&
+            !exports.IPV6_LINK_LOCAL.contains(this));
+    }
     /**
      * Returns a new IpAddress incremented by `n`.
      * @param n - The integer amount to add (fractional part is truncated)
@@ -188,23 +187,7 @@ class IpAddress {
             this.renderedOctets = [...this.octets];
         }
         else if (this.octets.length === 16) {
-            const contigZeros = this.octets.reduce((acc, x, idx) => {
-                if (x === 0) {
-                    acc.current++;
-                }
-                else {
-                    acc.current = 0;
-                }
-                if (acc.current > acc.end - acc.start) {
-                    acc.end = idx + 1;
-                    acc.start = acc.end - acc.current;
-                }
-                return acc;
-            }, { start: 0, end: 0, current: 0 });
-            if (contigZeros.end - contigZeros.start >= 2) {
-                return `${this.octets.slice(0, contigZeros.start).join(':')}::${this.octets.slice(contigZeros.end).join(':')}`;
-            }
-            this.renderedAddress = this.octets.join(':');
+            this.renderedAddress = renderIpv6(this.octets);
             this.renderedOctets = [...this.octets];
         }
         else {
@@ -333,6 +316,41 @@ exports.IPV4_LOOPBACK = IpNet.parse('127.0.0.0/8');
 exports.IPV6_LOOPBACK = IpNet.parse('::1/128');
 /** IPv6 link-local network (fe80::/10). */
 exports.IPV6_LINK_LOCAL = IpNet.parse('fe80::/10');
+/** IPv6 unique-local network (fc00::/7). */
+exports.IPV6_ULA = IpNet.parse('fc00::/7');
 /** Carrier-Grade NAT (CGNAT) address range (100.64.0.0/10), per RFC 6598. */
 exports.CGNAT = IpNet.parse('100.64.0.0/10');
+/**
+ * Render 16 IPv6 octets to a canonical string: eight 16-bit groups in lowercase
+ * hex, with the longest run of two or more all-zero groups collapsed to `::`.
+ */
+function renderIpv6(octets) {
+    const groups = [];
+    for (let i = 0; i < 16; i += 2) {
+        groups.push((octets[i] << 8) | octets[i + 1]);
+    }
+    let bestStart = -1;
+    let bestLen = 0;
+    let curStart = -1;
+    let curLen = 0;
+    for (let i = 0; i <= groups.length; i++) {
+        if (i < groups.length && groups[i] === 0) {
+            if (curStart < 0)
+                curStart = i;
+            curLen++;
+        }
+        else {
+            if (curLen > bestLen) {
+                bestLen = curLen;
+                bestStart = curStart;
+            }
+            curStart = -1;
+            curLen = 0;
+        }
+    }
+    const hex = groups.map(g => g.toString(16));
+    return bestLen >= 2
+        ? `${hex.slice(0, bestStart).join(':')}::${hex.slice(bestStart + bestLen).join(':')}`
+        : hex.join(':');
+}
 //# sourceMappingURL=ip.js.map