feat: inline domain health checks and improve address UX

- addPublicDomain returns DNS query + port check results (AddPublicDomainRes)
  so frontend skips separate API calls after adding a domain
- addPrivateDomain returns check_dns result for the gateway
- Support multiple ports per domain in validation modal (deduplicated)
- Run port checks concurrently via futures::future::join_all
- Add note to add-domain dialog showing other interfaces on same host
- Add addXForwardedHeaders to knownProtocols in SDK Host.ts
- Add plugin filter kind, pluginId filter, matchesAny, and docs to
  getServiceInterface.ts
- Add PassthroughInfo type and passthroughs field to NetworkInfo
- Pluralize "port forwarding rules" in i18n dictionaries

sdk/base/lib/interfaces/Host.ts

@@ -14,28 +14,34 @@ export const knownProtocols = {
     defaultPort: 80,
     withSsl: 'https',
     alpn: { specified: ['http/1.1'] } as AlpnInfo,
+    addXForwardedHeaders: true,
   },
   https: {
     secure: { ssl: true },
     defaultPort: 443,
+    addXForwardedHeaders: true,
   },
   ws: {
     secure: null,
     defaultPort: 80,
     withSsl: 'wss',
     alpn: { specified: ['http/1.1'] } as AlpnInfo,
+    addXForwardedHeaders: true,
   },
   wss: {
     secure: { ssl: true },
     defaultPort: 443,
+    addXForwardedHeaders: true,
   },
   ssh: {
     secure: { ssl: false },
     defaultPort: 22,
+    addXForwardedHeaders: false,
   },
   dns: {
     secure: { ssl: false },
     defaultPort: 53,
+    addXForwardedHeaders: false,
   },
 } as const
 
@@ -136,7 +142,7 @@ export class MultiHost {
     const sslProto = this.getSslProto(options)
     const addSsl = sslProto
       ? {
-          addXForwardedHeaders: false,
+          addXForwardedHeaders: knownProtocols[sslProto].addXForwardedHeaders,
           preferredExternalPort: knownProtocols[sslProto].defaultPort,
           scheme: sslProto,
           alpn: 'alpn' in protoInfo ? protoInfo.alpn : null,
@@ -148,7 +154,7 @@ export class MultiHost {
             preferredExternalPort: 443,
             scheme: sslProto,
             alpn: null,
-            ...('addSsl' in options ? options.addSsl : null),
+            ...options.addSsl,
           }
         : null
 

sdk/base/lib/osBindings/AddPublicDomainRes.ts

@@ -0,0 +1,7 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+import type { CheckPortRes } from './CheckPortRes'
+
+export type AddPublicDomainRes = {
+  dns: string | null
+  port: Array<CheckPortRes>
+}

sdk/base/lib/osBindings/NetworkInfo.ts

@@ -5,6 +5,7 @@ import type { DnsSettings } from './DnsSettings'
 import type { GatewayId } from './GatewayId'
 import type { Host } from './Host'
 import type { NetworkInterfaceInfo } from './NetworkInterfaceInfo'
+import type { PassthroughInfo } from './PassthroughInfo'
 import type { WifiInfo } from './WifiInfo'
 
 export type NetworkInfo = {
@@ -14,4 +15,5 @@ export type NetworkInfo = {
   acme: { [key: AcmeProvider]: AcmeSettings }
   dns: DnsSettings
   defaultOutbound: string | null
+  passthroughs: Array<PassthroughInfo>
 }

sdk/base/lib/osBindings/PassthroughInfo.ts

@@ -0,0 +1,9 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+
+export type PassthroughInfo = {
+  hostname: string
+  listenPort: number
+  backend: string
+  publicGateways: string[]
+  privateIps: string[]
+}

sdk/base/lib/osBindings/index.ts

@@ -19,6 +19,7 @@ export { AddPackageSignerParams } from './AddPackageSignerParams'
 export { AddPackageToCategoryParams } from './AddPackageToCategoryParams'
 export { AddPrivateDomainParams } from './AddPrivateDomainParams'
 export { AddPublicDomainParams } from './AddPublicDomainParams'
+export { AddPublicDomainRes } from './AddPublicDomainRes'
 export { AddressInfo } from './AddressInfo'
 export { AddSslOptions } from './AddSslOptions'
 export { AddTunnelParams } from './AddTunnelParams'
@@ -201,6 +202,7 @@ export { PackagePlugin } from './PackagePlugin'
 export { PackageState } from './PackageState'
 export { PackageVersionInfo } from './PackageVersionInfo'
 export { PartitionInfo } from './PartitionInfo'
+export { PassthroughInfo } from './PassthroughInfo'
 export { PasswordType } from './PasswordType'
 export { PathOrUrl } from './PathOrUrl'
 export { Pem } from './Pem'

sdk/base/lib/util/getServiceInterface.ts

@@ -26,6 +26,18 @@ export const getHostname = (url: string): Hostname | null => {
   return last
 }
 
+/**
+ * The kinds of hostnames that can be filtered on.
+ *
+ * - `'mdns'` — mDNS / Bonjour `.local` hostnames
+ * - `'domain'` — any os-managed domain name (matches both `'private-domain'` and `'public-domain'` metadata kinds)
+ * - `'ip'` — shorthand for both `'ipv4'` and `'ipv6'`
+ * - `'ipv4'` — IPv4 addresses only
+ * - `'ipv6'` — IPv6 addresses only
+ * - `'localhost'` — loopback addresses (`localhost`, `127.0.0.1`, `::1`)
+ * - `'link-local'` — IPv6 link-local addresses (fe80::/10)
+ * - `'plugin'` — hostnames provided by a plugin package
+ */
 type FilterKinds =
   | 'mdns'
   | 'domain'
@@ -34,10 +46,25 @@ type FilterKinds =
   | 'ipv6'
   | 'localhost'
   | 'link-local'
+  | 'plugin'
+
+/**
+ * Describes which hostnames to include (or exclude) when filtering a `Filled` address.
+ *
+ * Every field is optional — omitted fields impose no constraint.
+ * Filters are composable: the `.filter()` method intersects successive filters,
+ * and the `exclude` field inverts a nested filter.
+ */
 export type Filter = {
+  /** Keep only hostnames with the given visibility. `'public'` = externally reachable, `'private'` = LAN-only. */
   visibility?: 'public' | 'private'
+  /** Keep only hostnames whose metadata kind matches. A single kind or array of kinds. `'ip'` expands to `['ipv4','ipv6']`, `'domain'` matches both `'private-domain'` and `'public-domain'`. */
   kind?: FilterKinds | FilterKinds[]
+  /** Arbitrary predicate — hostnames for which this returns `false` are excluded. */
   predicate?: (h: HostnameInfo) => boolean
+  /** Keep only plugin hostnames provided by this package. Implies `kind: 'plugin'`. */
+  pluginId?: PackageId
+  /** A nested filter whose matches are *removed* from the result (logical NOT). */
   exclude?: Filter
 }
 
@@ -65,9 +92,13 @@ type KindFilter<K extends FilterKinds> = K extends 'mdns'
         ?
             | (HostnameInfo & { metadata: { kind: 'ipv6' } })
             | KindFilter<Exclude<K, 'ipv6'>>
-        : K extends 'ip'
-          ? KindFilter<Exclude<K, 'ip'> | 'ipv4' | 'ipv6'>
-          : never
+        : K extends 'plugin'
+          ?
+              | (HostnameInfo & { metadata: { kind: 'plugin' } })
+              | KindFilter<Exclude<K, 'plugin'>>
+          : K extends 'ip'
+            ? KindFilter<Exclude<K, 'ip'> | 'ipv4' | 'ipv6'>
+            : never
 
 type FilterReturnTy<F extends Filter> = F extends {
   visibility: infer V extends 'public' | 'private'
@@ -107,20 +138,62 @@ type FormatReturnTy<
       ? UrlString | FormatReturnTy<F, Exclude<Format, 'urlstring'>>
       : never
 
+/**
+ * A resolved address with its hostnames already populated, plus helpers
+ * for filtering, formatting, and converting hostnames to URLs.
+ *
+ * Filters are chainable and each call returns a new `Filled` narrowed to the
+ * matching subset of hostnames:
+ *
+ * ```ts
+ * addresses.nonLocal                         // exclude localhost & link-local
+ * addresses.public                           // only publicly-reachable hostnames
+ * addresses.filter({ kind: 'domain' })       // only domain-name hostnames
+ * addresses.filter({ visibility: 'private' }) // only LAN-reachable hostnames
+ * addresses.nonLocal.filter({ kind: 'ip' })  // chainable — non-local IPs only
+ * ```
+ */
 export type Filled<F extends Filter = {}> = {
+  /** The hostnames that survived all applied filters. */
   hostnames: HostnameInfo[]
 
+  /** Convert a single hostname into a fully-formed URL string, applying the address's scheme, username, and suffix. */
   toUrl: (h: HostnameInfo) => UrlString
 
+  /**
+   * Return every hostname in the requested format.
+   *
+   * - `'urlstring'` (default) — formatted URL strings
+   * - `'url'`                 — `URL` objects
+   * - `'hostname-info'`       — raw `HostnameInfo` objects
+   */
   format: <Format extends Formats = 'urlstring'>(
     format?: Format,
   ) => FormatReturnTy<{}, Format>[]
 
+  /**
+   * Apply an arbitrary {@link Filter} and return a new `Filled` containing only
+   * the hostnames that match. Filters compose: calling `.filter()` on an
+   * already-filtered `Filled` intersects the constraints.
+   */
   filter: <NewFilter extends Filter>(
     filter: NewFilter,
   ) => Filled<NewFilter & Filter>
 
+  /**
+   * Apply multiple filters and return hostnames that match **any** of them (union / OR).
+   *
+   * ```ts
+   * addresses.matchesAny([{ kind: 'domain' }, { kind: 'mdns' }])
+   * ```
+   */
+  matchesAny: <NewFilters extends Filter[]>(
+    filters: [...NewFilters],
+  ) => Filled<NewFilters[number] & F>
+
+  /** Shorthand filter that excludes `localhost` and IPv6 link-local addresses — keeps only network-reachable hostnames. */
   nonLocal: Filled<typeof nonLocalFilter & Filter>
+  /** Shorthand filter that keeps only publicly-reachable hostnames (those with `public: true`). */
   public: Filled<typeof publicFilter & Filter>
 }
 export type FilledAddressInfo = AddressInfo & Filled
@@ -210,7 +283,16 @@ function filterRec(
             ['localhost', '127.0.0.1', '::1'].includes(h.hostname)) ||
           (kind.has('link-local') &&
             h.metadata.kind === 'ipv6' &&
-            IPV6_LINK_LOCAL.contains(IpAddress.parse(h.hostname)))),
+            IPV6_LINK_LOCAL.contains(IpAddress.parse(h.hostname))) ||
+          (kind.has('plugin') && h.metadata.kind === 'plugin')),
+    )
+  }
+  if (filter.pluginId) {
+    const id = filter.pluginId
+    hostnames = hostnames.filter(
+      (h) =>
+        invert !==
+        (h.metadata.kind === 'plugin' && h.metadata.packageId === id),
     )
   }
 
@@ -280,6 +362,19 @@ export const filledAddress = (
           filterRec(hostnames, filter, false),
         )
       },
+      matchesAny: <NewFilters extends Filter[]>(filters: [...NewFilters]) => {
+        const seen = new Set<HostnameInfo>()
+        const union: HostnameInfo[] = []
+        for (const f of filters) {
+          for (const h of filterRec(hostnames, f, false)) {
+            if (!seen.has(h)) {
+              seen.add(h)
+              union.push(h)
+            }
+          }
+        }
+        return filledAddressFromHostnames<NewFilters[number] & F>(union)
+      },
       get nonLocal(): Filled<typeof nonLocalFilter & F> {
         return getNonLocal()
       },