@artenx/dshb 0.0.5 → 0.1.1

package/README.md

@@ -0,0 +1,18 @@
+# @artenx/dshb
+
+DSH-HoneyBee routes DSH filesystem, shell, subprocess, and PTY operations to local, SSH, and Docker execution nodes. It includes a node registry, an authentication gate, credential custody, workspace bindings, and a mobile-aware management UI.
+
+## Install
+
+```sh
+dsh plugin --profile web add @artenx/dshb
+```
+
+Restart the corresponding DSH Web profile after installation.
+
+## Requirements
+
+- Node.js 22.13 or newer
+- DeepSeek Harness 0.1.5-rc.1
+
+Source code and complete documentation: https://github.com/Artenx/dsh-honeybee

package/cordis.patch.yml

@@ -1,21 +1,21 @@
 - insert:
     - id: dshb-auth
-      name: dshb-auth
+      name: "@artenx/dshb/auth"
 - insert:
     - id: dshb-web-startup
-      name: dshb-auth/startup
+      name: "@artenx/dshb/auth/startup"
 - insert:
     - id: dshb-core
-      name: dshb-core
+      name: "@artenx/dshb/core"
 - insert:
     - id: dshb-router
-      name: dshb-router
+      name: "@artenx/dshb/router"
 - insert:
     - id: dshb-exec-ssh
-      name: dshb-exec-ssh
-- insert:
-    - id: dshb-ui
-      name: dshb-ui
+      name: "@artenx/dshb/exec-ssh"
 - insert:
     - id: dshb-exec-docker
-      name: dshb-exec-docker
+      name: "@artenx/dshb/exec-docker"
+- insert:
+    - id: dshb-ui
+      name: "@artenx/dshb"

package/lib/auth/credentials.d.ts

@@ -0,0 +1,30 @@
+//#region src/auth/credentials.d.ts
+interface AuthStoreData {
+  username: string;
+  salt: string;
+  hash: string;
+  sessionSecret: string;
+}
+declare function dshHome(): string;
+declare function authFilePath(): string;
+declare function sanitizeUsername(input: string): string;
+declare class CredentialStore {
+  private data;
+  private loaded;
+  private loadedMtime;
+  private file;
+  private maybeReload;
+  isInitialized(): boolean;
+  get username(): string | null;
+  get sessionSecret(): Buffer | null;
+  register(username: string, password: string): void;
+  verify(password: string): boolean;
+  changePassword(username: string, password: string): void;
+  changeUsername(username: string): void;
+  private load;
+  private save;
+}
+declare function sharedCredentialStore(): CredentialStore;
+//#endregion
+export { AuthStoreData, CredentialStore, authFilePath, dshHome, sanitizeUsername, sharedCredentialStore };
+//# sourceMappingURL=credentials.d.ts.map

package/lib/auth/credentials.js

@@ -0,0 +1,121 @@
+import { homedir } from "node:os";
+import { chmodSync, mkdirSync, readFileSync, renameSync, statSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { randomBytes, scryptSync, timingSafeEqual } from "node:crypto";
+//#region src/auth/credentials.ts
+function dshHome() {
+	return process.env.DSH_HOME ?? join(homedir(), ".dsh");
+}
+function authFilePath() {
+	return join(dshHome(), "dshb", "web-auth.json");
+}
+function sanitizeUsername(input) {
+	return input.replace(/[\x00-\x1f\x7f]/g, "").trim();
+}
+var CredentialStore = class {
+	data = null;
+	loaded = false;
+	loadedMtime = 0;
+	file() {
+		return authFilePath();
+	}
+	maybeReload() {
+		if (!this.loaded) {
+			this.load();
+			return;
+		}
+		try {
+			if (statSync(this.file()).mtimeMs !== this.loadedMtime) this.load();
+		} catch {
+			this.data = null;
+		}
+	}
+	isInitialized() {
+		this.maybeReload();
+		return this.data !== null;
+	}
+	get username() {
+		this.maybeReload();
+		return this.data?.username ?? null;
+	}
+	get sessionSecret() {
+		this.maybeReload();
+		return this.data ? Buffer.from(this.data.sessionSecret, "base64") : null;
+	}
+	register(username, password) {
+		this.maybeReload();
+		if (this.data) throw new Error("auth: already initialized");
+		const salt = randomBytes(16);
+		const hash = scryptSync(password, salt, 64);
+		this.data = {
+			username,
+			salt: salt.toString("base64"),
+			hash: hash.toString("base64"),
+			sessionSecret: randomBytes(32).toString("base64")
+		};
+		this.save();
+	}
+	verify(password) {
+		this.maybeReload();
+		if (!this.data) return false;
+		const hash = scryptSync(password, Buffer.from(this.data.salt, "base64"), 64);
+		const expected = Buffer.from(this.data.hash, "base64");
+		return timingSafeEqual(hash, expected);
+	}
+	changePassword(username, password) {
+		this.maybeReload();
+		if (!this.data) throw new Error("auth: not initialized");
+		const salt = randomBytes(16);
+		this.data = {
+			username,
+			salt: salt.toString("base64"),
+			hash: scryptSync(password, salt, 64).toString("base64"),
+			sessionSecret: randomBytes(32).toString("base64")
+		};
+		this.save();
+	}
+	changeUsername(username) {
+		this.maybeReload();
+		if (!this.data) throw new Error("auth: not initialized");
+		this.data = {
+			...this.data,
+			username,
+			sessionSecret: randomBytes(32).toString("base64")
+		};
+		this.save();
+	}
+	load() {
+		this.loaded = true;
+		const file = this.file();
+		try {
+			this.loadedMtime = statSync(file).mtimeMs;
+			const parsed = JSON.parse(readFileSync(file, "utf8"));
+			if (parsed.username && parsed.salt && parsed.hash && parsed.sessionSecret) this.data = parsed;
+		} catch {
+			this.data = null;
+		}
+	}
+	save() {
+		const file = this.file();
+		mkdirSync(join(file, ".."), {
+			recursive: true,
+			mode: 448
+		});
+		const tmp = `${file}.${process.pid}.tmp`;
+		writeFileSync(tmp, JSON.stringify(this.data), { mode: 384 });
+		renameSync(tmp, file);
+		chmodSync(file, 384);
+		try {
+			this.loadedMtime = statSync(file).mtimeMs;
+		} catch {}
+	}
+};
+let shared = null;
+function sharedCredentialStore() {
+	if (!shared) shared = new CredentialStore();
+	return shared;
+}
+//#endregion
+export { CredentialStore, authFilePath, dshHome, sanitizeUsername, sharedCredentialStore };
+
+//# sourceMappingURL=credentials.js.map

package/lib/auth/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","names":[],"sources":["../../src/auth/credentials.ts"],"sourcesContent":["import { chmodSync, mkdirSync, readFileSync, renameSync, statSync, writeFileSync } from 'node:fs'\nimport { homedir } from 'node:os'\nimport { join } from 'node:path'\nimport { randomBytes, scryptSync, timingSafeEqual } from 'node:crypto'\n\nexport interface AuthStoreData {\n  username: string\n  salt: string\n  hash: string\n  sessionSecret: string\n}\n\nexport function dshHome(): string {\n  return process.env.DSH_HOME ?? join(homedir(), '.dsh')\n}\n\nexport function authFilePath(): string {\n  return join(dshHome(), 'dshb', 'web-auth.json')\n}\n\nexport function sanitizeUsername(input: string): string {\n  return input.replace(/[\\x00-\\x1f\\x7f]/g, '').trim()\n}\n\nexport class CredentialStore {\n  private data: AuthStoreData | null = null\n  private loaded = false\n  private loadedMtime = 0\n\n  private file(): string {\n    return authFilePath()\n  }\n\n  private maybeReload(): void {\n    if (!this.loaded) {\n      this.load()\n      return\n    }\n    try {\n      const mtime = statSync(this.file()).mtimeMs\n      if (mtime !== this.loadedMtime) this.load()\n    } catch {\n      this.data = null\n    }\n  }\n\n  isInitialized(): boolean {\n    this.maybeReload()\n    return this.data !== null\n  }\n\n  get username(): string | null {\n    this.maybeReload()\n    return this.data?.username ?? null\n  }\n\n  get sessionSecret(): Buffer | null {\n    this.maybeReload()\n    return this.data ? Buffer.from(this.data.sessionSecret, 'base64') : null\n  }\n\n  register(username: string, password: string): void {\n    this.maybeReload()\n    if (this.data) throw new Error('auth: already initialized')\n    const salt = randomBytes(16)\n    const hash = scryptSync(password, salt, 64)\n    this.data = {\n      username,\n      salt: salt.toString('base64'),\n      hash: hash.toString('base64'),\n      sessionSecret: randomBytes(32).toString('base64'),\n    }\n    this.save()\n  }\n\n  verify(password: string): boolean {\n    this.maybeReload()\n    if (!this.data) return false\n    const hash = scryptSync(password, Buffer.from(this.data.salt, 'base64'), 64)\n    const expected = Buffer.from(this.data.hash, 'base64')\n    return timingSafeEqual(hash, expected)\n  }\n\n  changePassword(username: string, password: string): void {\n    this.maybeReload()\n    if (!this.data) throw new Error('auth: not initialized')\n    const salt = randomBytes(16)\n    this.data = {\n      username,\n      salt: salt.toString('base64'),\n      hash: scryptSync(password, salt, 64).toString('base64'),\n      sessionSecret: randomBytes(32).toString('base64'),\n    }\n    this.save()\n  }\n\n  changeUsername(username: string): void {\n    this.maybeReload()\n    if (!this.data) throw new Error('auth: not initialized')\n    this.data = { ...this.data, username, sessionSecret: randomBytes(32).toString('base64') }\n    this.save()\n  }\n\n  private load(): void {\n    this.loaded = true\n    const file = this.file()\n    try {\n      this.loadedMtime = statSync(file).mtimeMs\n      const parsed = JSON.parse(readFileSync(file, 'utf8')) as AuthStoreData\n      if (parsed.username && parsed.salt && parsed.hash && parsed.sessionSecret) {\n        this.data = parsed\n      }\n    } catch {\n      this.data = null\n    }\n  }\n\n  private save(): void {\n    const file = this.file()\n    mkdirSync(join(file, '..'), { recursive: true, mode: 0o700 })\n    const tmp = `${file}.${process.pid}.tmp`\n    writeFileSync(tmp, JSON.stringify(this.data), { mode: 0o600 })\n    renameSync(tmp, file)\n    chmodSync(file, 0o600)\n    try {\n      this.loadedMtime = statSync(file).mtimeMs\n    } catch {}\n  }\n}\n\nlet shared: CredentialStore | null = null\n\nexport function sharedCredentialStore(): CredentialStore {\n  if (!shared) shared = new CredentialStore()\n  return shared\n}\n"],"mappings":";;;;;AAYA,SAAgB,UAAkB;CAChC,OAAO,QAAQ,IAAI,YAAY,KAAK,QAAQ,GAAG,MAAM;AACvD;AAEA,SAAgB,eAAuB;CACrC,OAAO,KAAK,QAAQ,GAAG,QAAQ,eAAe;AAChD;AAEA,SAAgB,iBAAiB,OAAuB;CACtD,OAAO,MAAM,QAAQ,oBAAoB,EAAE,CAAC,CAAC,KAAK;AACpD;AAEA,IAAa,kBAAb,MAA6B;CAC3B,OAAqC;CACrC,SAAiB;CACjB,cAAsB;CAEtB,OAAuB;EACrB,OAAO,aAAa;CACtB;CAEA,cAA4B;EAC1B,IAAI,CAAC,KAAK,QAAQ;GAChB,KAAK,KAAK;GACV;EACF;EACA,IAAI;GAEF,IADc,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC,YACtB,KAAK,aAAa,KAAK,KAAK;EAC5C,QAAQ;GACN,KAAK,OAAO;EACd;CACF;CAEA,gBAAyB;EACvB,KAAK,YAAY;EACjB,OAAO,KAAK,SAAS;CACvB;CAEA,IAAI,WAA0B;EAC5B,KAAK,YAAY;EACjB,OAAO,KAAK,MAAM,YAAY;CAChC;CAEA,IAAI,gBAA+B;EACjC,KAAK,YAAY;EACjB,OAAO,KAAK,OAAO,OAAO,KAAK,KAAK,KAAK,eAAe,QAAQ,IAAI;CACtE;CAEA,SAAS,UAAkB,UAAwB;EACjD,KAAK,YAAY;EACjB,IAAI,KAAK,MAAM,MAAM,IAAI,MAAM,2BAA2B;EAC1D,MAAM,OAAO,YAAY,EAAE;EAC3B,MAAM,OAAO,WAAW,UAAU,MAAM,EAAE;EAC1C,KAAK,OAAO;GACV;GACA,MAAM,KAAK,SAAS,QAAQ;GAC5B,MAAM,KAAK,SAAS,QAAQ;GAC5B,eAAe,YAAY,EAAE,CAAC,CAAC,SAAS,QAAQ;EAClD;EACA,KAAK,KAAK;CACZ;CAEA,OAAO,UAA2B;EAChC,KAAK,YAAY;EACjB,IAAI,CAAC,KAAK,MAAM,OAAO;EACvB,MAAM,OAAO,WAAW,UAAU,OAAO,KAAK,KAAK,KAAK,MAAM,QAAQ,GAAG,EAAE;EAC3E,MAAM,WAAW,OAAO,KAAK,KAAK,KAAK,MAAM,QAAQ;EACrD,OAAO,gBAAgB,MAAM,QAAQ;CACvC;CAEA,eAAe,UAAkB,UAAwB;EACvD,KAAK,YAAY;EACjB,IAAI,CAAC,KAAK,MAAM,MAAM,IAAI,MAAM,uBAAuB;EACvD,MAAM,OAAO,YAAY,EAAE;EAC3B,KAAK,OAAO;GACV;GACA,MAAM,KAAK,SAAS,QAAQ;GAC5B,MAAM,WAAW,UAAU,MAAM,EAAE,CAAC,CAAC,SAAS,QAAQ;GACtD,eAAe,YAAY,EAAE,CAAC,CAAC,SAAS,QAAQ;EAClD;EACA,KAAK,KAAK;CACZ;CAEA,eAAe,UAAwB;EACrC,KAAK,YAAY;EACjB,IAAI,CAAC,KAAK,MAAM,MAAM,IAAI,MAAM,uBAAuB;EACvD,KAAK,OAAO;GAAE,GAAG,KAAK;GAAM;GAAU,eAAe,YAAY,EAAE,CAAC,CAAC,SAAS,QAAQ;EAAE;EACxF,KAAK,KAAK;CACZ;CAEA,OAAqB;EACnB,KAAK,SAAS;EACd,MAAM,OAAO,KAAK,KAAK;EACvB,IAAI;GACF,KAAK,cAAc,SAAS,IAAI,CAAC,CAAC;GAClC,MAAM,SAAS,KAAK,MAAM,aAAa,MAAM,MAAM,CAAC;GACpD,IAAI,OAAO,YAAY,OAAO,QAAQ,OAAO,QAAQ,OAAO,eAC1D,KAAK,OAAO;EAEhB,QAAQ;GACN,KAAK,OAAO;EACd;CACF;CAEA,OAAqB;EACnB,MAAM,OAAO,KAAK,KAAK;EACvB,UAAU,KAAK,MAAM,IAAI,GAAG;GAAE,WAAW;GAAM,MAAM;EAAM,CAAC;EAC5D,MAAM,MAAM,GAAG,KAAK,GAAG,QAAQ,IAAI;EACnC,cAAc,KAAK,KAAK,UAAU,KAAK,IAAI,GAAG,EAAE,MAAM,IAAM,CAAC;EAC7D,WAAW,KAAK,IAAI;EACpB,UAAU,MAAM,GAAK;EACrB,IAAI;GACF,KAAK,cAAc,SAAS,IAAI,CAAC,CAAC;EACpC,QAAQ,CAAC;CACX;AACF;AAEA,IAAI,SAAiC;AAErC,SAAgB,wBAAyC;CACvD,IAAI,CAAC,QAAQ,SAAS,IAAI,gBAAgB;CAC1C,OAAO;AACT"}

package/lib/auth/decorate-webserver.d.ts

@@ -0,0 +1,7 @@
+import { CredentialStore } from "./credentials.js";
+import WebServer from "@deepseek-ai/dsh-host-webserver";
+//#region src/auth/decorate-webserver.d.ts
+declare function decorateWebServer(webServer: WebServer, store: CredentialStore): () => void;
+//#endregion
+export { decorateWebServer };
+//# sourceMappingURL=decorate-webserver.d.ts.map

package/lib/auth/decorate-webserver.js

@@ -0,0 +1,75 @@
+import { AuthGate, rewriteToLoopback } from "./gate.js";
+//#region src/auth/decorate-webserver.ts
+function decorateWebServer(webServer, store) {
+	const gate = new AuthGate(store);
+	const origRegister = webServer.register.bind(webServer);
+	const origRegisterFallback = webServer.registerFallback.bind(webServer);
+	const origRegisterUpgrade = webServer.registerUpgrade.bind(webServer);
+	webServer.register = (route) => {
+		return origRegister({
+			...route,
+			handler: (req, res) => guarded(route, req, res)
+		});
+	};
+	webServer.registerFallback = (handler) => {
+		return origRegisterFallback((req, res) => guarded({
+			kind: "exact",
+			path: "/",
+			handler
+		}, req, res));
+	};
+	webServer.registerUpgrade = (route) => {
+		return origRegisterUpgrade({
+			...route,
+			handler: (req, socket, head) => guardedUpgrade(route, req, socket, head)
+		});
+	};
+	const ws = webServer;
+	const origFallback = ws.fallback;
+	if (typeof origFallback === "function" && !origFallback.__dshbGated) {
+		const wrapped = (req, res) => guarded({
+			kind: "exact",
+			path: "/",
+			handler: origFallback
+		}, req, res);
+		wrapped.__dshbGated = true;
+		ws.fallback = wrapped;
+	}
+	function guarded(route, req, res) {
+		const decision = gate.decide(req);
+		if (decision === "allow") {
+			rewriteToLoopback(req, webServer.port);
+			return route.handler(req, res);
+		}
+		if (decision === "exempt") return route.handler(req, res);
+		if (decision === "redirect-login") {
+			res.writeHead(302, { location: "/login" });
+			res.end();
+			return;
+		}
+		res.writeHead(401, { "content-type": "application/json" });
+		res.end(JSON.stringify({
+			ok: false,
+			error: "unauthorized"
+		}));
+	}
+	function guardedUpgrade(route, req, socket, head) {
+		const decision = gate.decide(req);
+		if (decision === "allow" || decision === "exempt") {
+			if (decision === "allow") rewriteToLoopback(req, webServer.port);
+			return route.handler(req, socket, head);
+		}
+		socket.write("HTTP/1.1 401 Unauthorized\r\nConnection: close\r\n\r\n");
+		socket.destroy();
+	}
+	return () => {
+		webServer.register = origRegister;
+		webServer.registerFallback = origRegisterFallback;
+		webServer.registerUpgrade = origRegisterUpgrade;
+		ws.fallback = origFallback;
+	};
+}
+//#endregion
+export { decorateWebServer };
+
+//# sourceMappingURL=decorate-webserver.js.map

package/lib/auth/decorate-webserver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"decorate-webserver.js","names":[],"sources":["../../src/auth/decorate-webserver.ts"],"sourcesContent":["import type { IncomingMessage, ServerResponse } from 'node:http'\nimport type { Duplex } from 'node:stream'\nimport type { WebRoute, WebUpgradeRoute } from '@deepseek-ai/dsh-host-webserver'\nimport type WebServer from '@deepseek-ai/dsh-host-webserver'\nimport { AuthGate, rewriteToLoopback } from './gate.js'\nimport type { CredentialStore } from './credentials.js'\n\nexport function decorateWebServer(\n  webServer: WebServer,\n  store: CredentialStore,\n): () => void {\n  const gate = new AuthGate(store)\n\n  const origRegister = webServer.register.bind(webServer)\n  const origRegisterFallback = webServer.registerFallback.bind(webServer)\n  const origRegisterUpgrade = webServer.registerUpgrade.bind(webServer)\n\n  webServer.register = (route: WebRoute): (() => void) => {\n    return origRegister({\n      ...route,\n      handler: (req, res) => guarded(route, req, res),\n    })\n  }\n\n  webServer.registerFallback = (handler: WebRoute['handler']): (() => void) => {\n    return origRegisterFallback((req, res) =>\n      guarded({ kind: 'exact', path: '/', handler }, req, res),\n    )\n  }\n\n  webServer.registerUpgrade = (route: WebUpgradeRoute): (() => void) => {\n    return origRegisterUpgrade({\n      ...route,\n      handler: (req, socket, head) => guardedUpgrade(route, req, socket, head),\n    })\n  }\n\n  // DSH 0.1.5+: the frontend-static plugin may have claimed the fallback seat\n  // *before* this decoration runs (plugin apply order is not guaranteed). The\n  // registerFallback wrap above only gates fallbacks registered later, so also\n  // wrap an already-claimed seat in place. Idempotent via the __dshbGated mark.\n  const ws = webServer as unknown as { fallback?: WebRoute['handler'] & { __dshbGated?: true } }\n  const origFallback = ws.fallback\n  if (typeof origFallback === 'function' && !origFallback.__dshbGated) {\n    const wrapped: WebRoute['handler'] & { __dshbGated?: true } = (req, res) =>\n      guarded({ kind: 'exact', path: '/', handler: origFallback }, req, res)\n    wrapped.__dshbGated = true\n    ws.fallback = wrapped\n  }\n\n  function guarded(\n    route: WebRoute,\n    req: IncomingMessage,\n    res: ServerResponse,\n  ): void | Promise<void> {\n    const decision = gate.decide(req)\n    if (decision === 'allow') {\n      rewriteToLoopback(req, webServer.port)\n      return route.handler(req, res)\n    }\n    if (decision === 'exempt') {\n      return route.handler(req, res)\n    }\n    if (decision === 'redirect-login') {\n      res.writeHead(302, { location: '/login' })\n      res.end()\n      return\n    }\n    res.writeHead(401, { 'content-type': 'application/json' })\n    res.end(JSON.stringify({ ok: false, error: 'unauthorized' }))\n  }\n\n  function guardedUpgrade(\n    route: WebUpgradeRoute,\n    req: IncomingMessage,\n    socket: Duplex,\n    head: Buffer,\n  ): void | Promise<void> {\n    const decision = gate.decide(req)\n    if (decision === 'allow' || decision === 'exempt') {\n      if (decision === 'allow') rewriteToLoopback(req, webServer.port)\n      return route.handler(req, socket, head)\n    }\n    socket.write('HTTP/1.1 401 Unauthorized\\r\\nConnection: close\\r\\n\\r\\n')\n    socket.destroy()\n  }\n\n  return () => {\n    webServer.register = origRegister\n    webServer.registerFallback = origRegisterFallback\n    webServer.registerUpgrade = origRegisterUpgrade\n    ws.fallback = origFallback\n  }\n}\n"],"mappings":";;AAOA,SAAgB,kBACd,WACA,OACY;CACZ,MAAM,OAAO,IAAI,SAAS,KAAK;CAE/B,MAAM,eAAe,UAAU,SAAS,KAAK,SAAS;CACtD,MAAM,uBAAuB,UAAU,iBAAiB,KAAK,SAAS;CACtE,MAAM,sBAAsB,UAAU,gBAAgB,KAAK,SAAS;CAEpE,UAAU,YAAY,UAAkC;EACtD,OAAO,aAAa;GAClB,GAAG;GACH,UAAU,KAAK,QAAQ,QAAQ,OAAO,KAAK,GAAG;EAChD,CAAC;CACH;CAEA,UAAU,oBAAoB,YAA+C;EAC3E,OAAO,sBAAsB,KAAK,QAChC,QAAQ;GAAE,MAAM;GAAS,MAAM;GAAK;EAAQ,GAAG,KAAK,GAAG,CACzD;CACF;CAEA,UAAU,mBAAmB,UAAyC;EACpE,OAAO,oBAAoB;GACzB,GAAG;GACH,UAAU,KAAK,QAAQ,SAAS,eAAe,OAAO,KAAK,QAAQ,IAAI;EACzE,CAAC;CACH;CAMA,MAAM,KAAK;CACX,MAAM,eAAe,GAAG;CACxB,IAAI,OAAO,iBAAiB,cAAc,CAAC,aAAa,aAAa;EACnE,MAAM,WAAyD,KAAK,QAClE,QAAQ;GAAE,MAAM;GAAS,MAAM;GAAK,SAAS;EAAa,GAAG,KAAK,GAAG;EACvE,QAAQ,cAAc;EACtB,GAAG,WAAW;CAChB;CAEA,SAAS,QACP,OACA,KACA,KACsB;EACtB,MAAM,WAAW,KAAK,OAAO,GAAG;EAChC,IAAI,aAAa,SAAS;GACxB,kBAAkB,KAAK,UAAU,IAAI;GACrC,OAAO,MAAM,QAAQ,KAAK,GAAG;EAC/B;EACA,IAAI,aAAa,UACf,OAAO,MAAM,QAAQ,KAAK,GAAG;EAE/B,IAAI,aAAa,kBAAkB;GACjC,IAAI,UAAU,KAAK,EAAE,UAAU,SAAS,CAAC;GACzC,IAAI,IAAI;GACR;EACF;EACA,IAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;EACzD,IAAI,IAAI,KAAK,UAAU;GAAE,IAAI;GAAO,OAAO;EAAe,CAAC,CAAC;CAC9D;CAEA,SAAS,eACP,OACA,KACA,QACA,MACsB;EACtB,MAAM,WAAW,KAAK,OAAO,GAAG;EAChC,IAAI,aAAa,WAAW,aAAa,UAAU;GACjD,IAAI,aAAa,SAAS,kBAAkB,KAAK,UAAU,IAAI;GAC/D,OAAO,MAAM,QAAQ,KAAK,QAAQ,IAAI;EACxC;EACA,OAAO,MAAM,wDAAwD;EACrE,OAAO,QAAQ;CACjB;CAEA,aAAa;EACX,UAAU,WAAW;EACrB,UAAU,mBAAmB;EAC7B,UAAU,kBAAkB;EAC5B,GAAG,WAAW;CAChB;AACF"}

package/lib/auth/gate.d.ts

@@ -0,0 +1,14 @@
+import { CredentialStore } from "./credentials.js";
+import { IncomingMessage } from "node:http";
+//#region src/auth/gate.d.ts
+type GateDecision = 'allow' | 'exempt' | 'redirect-login' | 'reject';
+declare class AuthGate {
+  private readonly store;
+  constructor(store: CredentialStore);
+  decide(req: IncomingMessage): GateDecision;
+  private isPageRequest;
+}
+declare function rewriteToLoopback(req: IncomingMessage, port: number): void;
+//#endregion
+export { AuthGate, GateDecision, rewriteToLoopback };
+//# sourceMappingURL=gate.d.ts.map

package/lib/auth/gate.js

@@ -0,0 +1,45 @@
+import { isLoopbackRequest } from "./loopback.js";
+import { SESSION_COOKIE, readCookie, verifySession } from "./session.js";
+//#region src/auth/gate.ts
+var AuthGate = class {
+	store;
+	constructor(store) {
+		this.store = store;
+	}
+	decide(req) {
+		const path = new URL(req.url ?? "/", "http://x").pathname;
+		if (path === "/login" || path.startsWith("/api/auth/")) return "exempt";
+		if (isLoopbackRequest(req.socket.remoteAddress, req.headers.host)) return "allow";
+		const secret = this.store.sessionSecret;
+		const username = this.store.username;
+		if (secret && username) {
+			const value = readCookie(req.headers.cookie, SESSION_COOKIE);
+			if (verifySession(value, secret, username)) return "allow";
+		}
+		if (this.isPageRequest(req)) return "redirect-login";
+		return "reject";
+	}
+	isPageRequest(req) {
+		if (req.method !== "GET" && req.method !== "HEAD") return false;
+		if (new URL(req.url ?? "/", "http://x").pathname.startsWith("/api/")) return false;
+		const accept = req.headers.accept ?? "";
+		return accept.includes("text/html") || accept.includes("*/*");
+	}
+};
+function rewriteToLoopback(req, port) {
+	const authority = `127.0.0.1:${port}`;
+	req.headers.host = authority;
+	for (const name of ["origin", "referer"]) {
+		const value = req.headers[name];
+		if (typeof value !== "string") continue;
+		try {
+			const url = new URL(value);
+			url.host = authority;
+			req.headers[name] = url.toString();
+		} catch {}
+	}
+}
+//#endregion
+export { AuthGate, rewriteToLoopback };
+
+//# sourceMappingURL=gate.js.map

package/lib/auth/gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate.js","names":[],"sources":["../../src/auth/gate.ts"],"sourcesContent":["import type { IncomingMessage } from 'node:http'\nimport { isLoopbackRequest } from './loopback.js'\nimport { readCookie, SESSION_COOKIE, verifySession } from './session.js'\nimport type { CredentialStore } from './credentials.js'\n\nexport type GateDecision = 'allow' | 'exempt' | 'redirect-login' | 'reject'\n\nexport class AuthGate {\n  constructor(private readonly store: CredentialStore) {}\n\n  decide(req: IncomingMessage): GateDecision {\n    const path = new URL(req.url ?? '/', 'http://x').pathname\n    if (path === '/login' || path.startsWith('/api/auth/')) return 'exempt'\n    if (isLoopbackRequest(req.socket.remoteAddress, req.headers.host)) return 'allow'\n    const secret = this.store.sessionSecret\n    const username = this.store.username\n    if (secret && username) {\n      const value = readCookie(req.headers.cookie, SESSION_COOKIE)\n      if (verifySession(value, secret, username)) return 'allow'\n    }\n    if (this.isPageRequest(req)) return 'redirect-login'\n    return 'reject'\n  }\n\n  private isPageRequest(req: IncomingMessage): boolean {\n    if (req.method !== 'GET' && req.method !== 'HEAD') return false\n    const path = new URL(req.url ?? '/', 'http://x').pathname\n    if (path.startsWith('/api/')) return false\n    const accept = req.headers.accept ?? ''\n    return accept.includes('text/html') || accept.includes('*/*')\n  }\n}\n\nexport function rewriteToLoopback(req: IncomingMessage, port: number): void {\n  const authority = `127.0.0.1:${port}`\n  req.headers.host = authority\n  for (const name of ['origin', 'referer'] as const) {\n    const value = req.headers[name]\n    if (typeof value !== 'string') continue\n    try {\n      const url = new URL(value)\n      url.host = authority\n      req.headers[name] = url.toString()\n    } catch {}\n  }\n}\n"],"mappings":";;;AAOA,IAAa,WAAb,MAAsB;CACS;CAA7B,YAAY,OAAyC;EAAxB,KAAA,QAAA;CAAyB;CAEtD,OAAO,KAAoC;EACzC,MAAM,OAAO,IAAI,IAAI,IAAI,OAAO,KAAK,UAAU,CAAC,CAAC;EACjD,IAAI,SAAS,YAAY,KAAK,WAAW,YAAY,GAAG,OAAO;EAC/D,IAAI,kBAAkB,IAAI,OAAO,eAAe,IAAI,QAAQ,IAAI,GAAG,OAAO;EAC1E,MAAM,SAAS,KAAK,MAAM;EAC1B,MAAM,WAAW,KAAK,MAAM;EAC5B,IAAI,UAAU,UAAU;GACtB,MAAM,QAAQ,WAAW,IAAI,QAAQ,QAAQ,cAAc;GAC3D,IAAI,cAAc,OAAO,QAAQ,QAAQ,GAAG,OAAO;EACrD;EACA,IAAI,KAAK,cAAc,GAAG,GAAG,OAAO;EACpC,OAAO;CACT;CAEA,cAAsB,KAA+B;EACnD,IAAI,IAAI,WAAW,SAAS,IAAI,WAAW,QAAQ,OAAO;EAE1D,IADa,IAAI,IAAI,IAAI,OAAO,KAAK,UAAU,CAAC,CAAC,SACxC,WAAW,OAAO,GAAG,OAAO;EACrC,MAAM,SAAS,IAAI,QAAQ,UAAU;EACrC,OAAO,OAAO,SAAS,WAAW,KAAK,OAAO,SAAS,KAAK;CAC9D;AACF;AAEA,SAAgB,kBAAkB,KAAsB,MAAoB;CAC1E,MAAM,YAAY,aAAa;CAC/B,IAAI,QAAQ,OAAO;CACnB,KAAK,MAAM,QAAQ,CAAC,UAAU,SAAS,GAAY;EACjD,MAAM,QAAQ,IAAI,QAAQ;EAC1B,IAAI,OAAO,UAAU,UAAU;EAC/B,IAAI;GACF,MAAM,MAAM,IAAI,IAAI,KAAK;GACzB,IAAI,OAAO;GACX,IAAI,QAAQ,QAAQ,IAAI,SAAS;EACnC,QAAQ,CAAC;CACX;AACF"}

package/lib/auth/index.d.ts

@@ -0,0 +1,8 @@
+import { Context } from "@deepseek-ai/cordis";
+//#region src/auth/index.d.ts
+declare const name = "dshb-auth";
+declare const inject: string[];
+declare function apply(ctx: Context): void;
+//#endregion
+export { apply, inject, name };
+//# sourceMappingURL=index.d.ts.map

package/lib/auth/index.js

@@ -0,0 +1,51 @@
+import { sharedCredentialStore } from "./credentials.js";
+import { decorateWebServer } from "./decorate-webserver.js";
+import { installLoopbackCompat } from "./loopback-compat.js";
+import { LoginRateLimiter } from "./ratelimit.js";
+import { registerAuthRoutes } from "./routes.js";
+import { createRequire } from "node:module";
+import { readFileSync, readdirSync } from "node:fs";
+import { basename, dirname, join } from "node:path";
+//#region src/auth/index.ts
+const name = "dshb-auth";
+const inject = ["webServer"];
+function registerFrontendBootRaceWorkaround(ctx) {
+	try {
+		const manifestPath = createRequire(import.meta.url).resolve("@deepseek-ai/dsh-web-frontend/package.json", { paths: [process.cwd()] });
+		const assetDir = join(dirname(manifestPath), "dist", "assets");
+		const assetName = readdirSync(assetDir).find((name) => /^index-.*\.js$/.test(name));
+		if (!assetName) return;
+		const assetPath = join(assetDir, assetName);
+		const source = readFileSync(assetPath, "utf8");
+		const patched = source.replace("await i.await(),this.assertEntriesActive(t)", "await i.await(),await new Promise(r=>setTimeout(r,8000)),this.assertEntriesActive(t)");
+		if (patched === source) return;
+		ctx.effect(() => ctx.webServer.register({
+			kind: "exact",
+			path: `/assets/${basename(assetPath)}`,
+			handler: (_req, res) => {
+				res.writeHead(200, {
+					"cache-control": "no-store",
+					"content-type": "application/javascript; charset=utf-8"
+				});
+				res.end(patched);
+			}
+		}));
+	} catch {}
+}
+function apply(ctx) {
+	decorateWebServer(ctx.webServer, sharedCredentialStore());
+	registerFrontendBootRaceWorkaround(ctx);
+	ctx.webServer.tapIndex(installLoopbackCompat);
+	registerAuthRoutes(ctx, sharedCredentialStore(), new LoginRateLimiter());
+	ctx.inject(["connection"], (connCtx) => {
+		const auth = connCtx.connection?.browserAuth;
+		if (auth && typeof auth.isAuthenticated === "function" && !auth.__dshbNeutralized) {
+			auth.isAuthenticated = () => true;
+			auth.__dshbNeutralized = true;
+		}
+	});
+}
+//#endregion
+export { apply, inject, name };
+
+//# sourceMappingURL=index.js.map

package/lib/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","names":[],"sources":["../../src/auth/index.ts"],"sourcesContent":["import { readFileSync, readdirSync } from 'node:fs'\nimport { createRequire } from 'node:module'\nimport { basename, dirname, join } from 'node:path'\nimport type { Context } from '@deepseek-ai/cordis'\nimport { sharedCredentialStore } from './credentials.js'\nimport { decorateWebServer } from './decorate-webserver.js'\nimport { installLoopbackCompat } from './loopback-compat.js'\nimport { LoginRateLimiter } from './ratelimit.js'\nimport { registerAuthRoutes } from './routes.js'\n\nexport const name = 'dshb-auth'\n\nexport const inject = ['webServer']\n\nfunction registerFrontendBootRaceWorkaround(ctx: Context): void {\n  try {\n    // Resolve from the active profile so the route patches the same hashed asset\n    // that dsh-web-app's static fallback serves.\n    const resolver = createRequire(import.meta.url)\n    const manifestPath = resolver.resolve('@deepseek-ai/dsh-web-frontend/package.json', {\n      paths: [process.cwd()],\n    })\n    const assetDir = join(dirname(manifestPath), 'dist', 'assets')\n    const assetName = readdirSync(assetDir).find((name) => /^index-.*\\.js$/.test(name))\n    if (!assetName) return\n\n    const assetPath = join(assetDir, assetName)\n    const source = readFileSync(assetPath, 'utf8')\n    // DSH 0.1.5 asserts before api-remotes' dynamic remote namespace fibers\n    // settle. Delay the assertion so mountApp sees the complete client graph;\n    // real activation failures still throw after the bounded wait.\n    const patched = source.replace(\n      'await i.await(),this.assertEntriesActive(t)',\n      'await i.await(),await new Promise(r=>setTimeout(r,8000)),this.assertEntriesActive(t)',\n    )\n    if (patched === source) return\n\n    ctx.effect(() =>\n      ctx.webServer.register({\n        kind: 'exact',\n        path: `/assets/${basename(assetPath)}`,\n        handler: (_req, res) => {\n          res.writeHead(200, {\n            'cache-control': 'no-store',\n            'content-type': 'application/javascript; charset=utf-8',\n          })\n          res.end(patched)\n        },\n      }),\n    )\n  } catch {\n    // Upstream assets are optional from DSHB's perspective. A missing or changed\n    // frontend layout simply skips this version-specific workaround.\n  }\n}\n\nexport function apply(ctx: Context): void {\n  decorateWebServer(ctx.webServer, sharedCredentialStore())\n  registerFrontendBootRaceWorkaround(ctx)\n  ctx.webServer.tapIndex(installLoopbackCompat)\n  registerAuthRoutes(ctx, sharedCredentialStore(), new LoginRateLimiter())\n\n  // DSH 0.1.5 introduced a browser-auth fence on the connection package: the SPA\n  // fallback calls connection.authorizeIndex() on \"/\" (mints/checks DSH's own\n  // launch-token cookie), and /api routes run requestRejection() which 401s when\n  // that DSH cookie is absent. DSHB uses its own session cookie and must stay the\n  // sole auth gate (DSH 0.1.1 had no such connection fence, so DSHB worked there).\n  // Neutralize the connection's browserAuth.isAuthenticated check so DSH's fence\n  // never rejects a DSHB-authenticated (or loopback) request; DSHB's gate still\n  // rejects unauthenticated access to gated routes. Property is read at request\n  // time, so installing it once after connection is ready suffices.\n  ctx.inject(['connection'], (connCtx: Context) => {\n    const conn = (connCtx as unknown as { connection?: { browserAuth?: { isAuthenticated?: (...a: unknown[]) => unknown; __dshbNeutralized?: true } } }).connection\n    const auth = conn?.browserAuth\n    if (auth && typeof auth.isAuthenticated === 'function' && !auth.__dshbNeutralized) {\n      auth.isAuthenticated = () => true\n      auth.__dshbNeutralized = true\n    }\n  })\n}\n"],"mappings":";;;;;;;;;AAUA,MAAa,OAAO;AAEpB,MAAa,SAAS,CAAC,WAAW;AAElC,SAAS,mCAAmC,KAAoB;CAC9D,IAAI;EAIF,MAAM,eADW,cAAc,YAAY,GACf,CAAC,CAAC,QAAQ,8CAA8C,EAClF,OAAO,CAAC,QAAQ,IAAI,CAAC,EACvB,CAAC;EACD,MAAM,WAAW,KAAK,QAAQ,YAAY,GAAG,QAAQ,QAAQ;EAC7D,MAAM,YAAY,YAAY,QAAQ,CAAC,CAAC,MAAM,SAAS,iBAAiB,KAAK,IAAI,CAAC;EAClF,IAAI,CAAC,WAAW;EAEhB,MAAM,YAAY,KAAK,UAAU,SAAS;EAC1C,MAAM,SAAS,aAAa,WAAW,MAAM;EAI7C,MAAM,UAAU,OAAO,QACrB,+CACA,sFACF;EACA,IAAI,YAAY,QAAQ;EAExB,IAAI,aACF,IAAI,UAAU,SAAS;GACrB,MAAM;GACN,MAAM,WAAW,SAAS,SAAS;GACnC,UAAU,MAAM,QAAQ;IACtB,IAAI,UAAU,KAAK;KACjB,iBAAiB;KACjB,gBAAgB;IAClB,CAAC;IACD,IAAI,IAAI,OAAO;GACjB;EACF,CAAC,CACH;CACF,QAAQ,CAGR;AACF;AAEA,SAAgB,MAAM,KAAoB;CACxC,kBAAkB,IAAI,WAAW,sBAAsB,CAAC;CACxD,mCAAmC,GAAG;CACtC,IAAI,UAAU,SAAS,qBAAqB;CAC5C,mBAAmB,KAAK,sBAAsB,GAAG,IAAI,iBAAiB,CAAC;CAWvE,IAAI,OAAO,CAAC,YAAY,IAAI,YAAqB;EAE/C,MAAM,OADQ,QAAuI,YAClI;EACnB,IAAI,QAAQ,OAAO,KAAK,oBAAoB,cAAc,CAAC,KAAK,mBAAmB;GACjF,KAAK,wBAAwB;GAC7B,KAAK,oBAAoB;EAC3B;CACF,CAAC;AACH"}

package/lib/auth/login-page.d.ts

@@ -0,0 +1,5 @@
+//#region src/auth/login-page.d.ts
+declare function loginPageHtml(): string;
+//#endregion
+export { loginPageHtml };
+//# sourceMappingURL=login-page.d.ts.map

package/lib/auth/login-page.js

@@ -0,0 +1,87 @@
+//#region src/auth/login-page.ts
+function loginPageHtml() {
+	return `<!doctype html>
+<html lang="zh-CN">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover">
+<title>DSHB 登录</title>
+<style>
+:root { color-scheme: dark; }
+body { margin: 0; min-height: 100vh; display: flex; align-items: center; justify-content: center; background: #0f1115; color: #e8eaf0; font-family: system-ui, -apple-system, "PingFang SC", sans-serif; }
+.card { width: min(92vw, 360px); padding: 32px 28px; background: #171a21; border: 1px solid #262b36; border-radius: 12px; }
+h1 { font-size: 20px; margin: 0 0 6px; }
+p.sub { margin: 0 0 20px; font-size: 13px; color: #8b93a5; }
+label { display: block; font-size: 13px; color: #aab1c0; margin: 14px 0 6px; }
+input { width: 100%; box-sizing: border-box; padding: 12px; font-size: 16px; border-radius: 8px; border: 1px solid #2c3242; background: #0f1115; color: #e8eaf0; }
+input:focus { outline: 2px solid #3b82f6; border-color: transparent; }
+button { margin-top: 22px; width: 100%; padding: 12px; font-size: 15px; border: 0; border-radius: 8px; background: #3b82f6; color: #fff; cursor: pointer; }
+button:disabled { opacity: .5; cursor: default; }
+.err { min-height: 18px; margin-top: 12px; font-size: 13px; color: #f87171; }
+</style>
+</head>
+<body>
+<div class="card">
+<h1 id="title">DSHB 登录</h1>
+<p class="sub" id="subtitle">DeepSeek Harness 管理端</p>
+<form id="form">
+<label for="username">用户名</label>
+<input id="username" name="username" autocomplete="username" required>
+<label for="password">密码</label>
+<input id="password" name="password" type="password" autocomplete="current-password" required>
+<button id="submit" type="submit">登录</button>
+<div class="err" id="error"></div>
+</form>
+</div>
+<script>
+(async () => {
+  const res = await fetch('/api/auth/status')
+  const status = await res.json()
+  const form = document.getElementById('form')
+  const title = document.getElementById('title')
+  const subtitle = document.getElementById('subtitle')
+  const submit = document.getElementById('submit')
+  const error = document.getElementById('error')
+  const password = document.getElementById('password')
+  let mode = 'login'
+  if (!status.initialized) {
+    mode = 'register'
+    title.textContent = '设置管理员账号'
+    subtitle.textContent = '首次使用，请创建管理员账号（密码至少 8 位）'
+    submit.textContent = '创建并登录'
+    password.autocomplete = 'new-password'
+  }
+  form.addEventListener('submit', async (ev) => {
+    ev.preventDefault()
+    submit.disabled = true
+    error.textContent = ''
+    try {
+      const resp = await fetch('/api/auth/' + mode, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({
+          username: document.getElementById('username').value,
+          password: password.value,
+        }),
+      })
+      const data = await resp.json()
+      if (resp.ok && data.ok) {
+        location.href = '/'
+        return
+      }
+      error.textContent = data.error || ('请求失败（' + resp.status + '）')
+    } catch {
+      error.textContent = '网络错误，请重试'
+    } finally {
+      submit.disabled = false
+    }
+  })
+})()
+<\/script>
+</body>
+</html>`;
+}
+//#endregion
+export { loginPageHtml };
+
+//# sourceMappingURL=login-page.js.map

package/lib/auth/login-page.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-page.js","names":[],"sources":["../../src/auth/login-page.ts"],"sourcesContent":["export function loginPageHtml(): string {\n  return `<!doctype html>\n<html lang=\"zh-CN\">\n<head>\n<meta charset=\"utf-8\">\n<meta name=\"viewport\" content=\"width=device-width, initial-scale=1, viewport-fit=cover\">\n<title>DSHB 登录</title>\n<style>\n:root { color-scheme: dark; }\nbody { margin: 0; min-height: 100vh; display: flex; align-items: center; justify-content: center; background: #0f1115; color: #e8eaf0; font-family: system-ui, -apple-system, \"PingFang SC\", sans-serif; }\n.card { width: min(92vw, 360px); padding: 32px 28px; background: #171a21; border: 1px solid #262b36; border-radius: 12px; }\nh1 { font-size: 20px; margin: 0 0 6px; }\np.sub { margin: 0 0 20px; font-size: 13px; color: #8b93a5; }\nlabel { display: block; font-size: 13px; color: #aab1c0; margin: 14px 0 6px; }\ninput { width: 100%; box-sizing: border-box; padding: 12px; font-size: 16px; border-radius: 8px; border: 1px solid #2c3242; background: #0f1115; color: #e8eaf0; }\ninput:focus { outline: 2px solid #3b82f6; border-color: transparent; }\nbutton { margin-top: 22px; width: 100%; padding: 12px; font-size: 15px; border: 0; border-radius: 8px; background: #3b82f6; color: #fff; cursor: pointer; }\nbutton:disabled { opacity: .5; cursor: default; }\n.err { min-height: 18px; margin-top: 12px; font-size: 13px; color: #f87171; }\n</style>\n</head>\n<body>\n<div class=\"card\">\n<h1 id=\"title\">DSHB 登录</h1>\n<p class=\"sub\" id=\"subtitle\">DeepSeek Harness 管理端</p>\n<form id=\"form\">\n<label for=\"username\">用户名</label>\n<input id=\"username\" name=\"username\" autocomplete=\"username\" required>\n<label for=\"password\">密码</label>\n<input id=\"password\" name=\"password\" type=\"password\" autocomplete=\"current-password\" required>\n<button id=\"submit\" type=\"submit\">登录</button>\n<div class=\"err\" id=\"error\"></div>\n</form>\n</div>\n<script>\n(async () => {\n  const res = await fetch('/api/auth/status')\n  const status = await res.json()\n  const form = document.getElementById('form')\n  const title = document.getElementById('title')\n  const subtitle = document.getElementById('subtitle')\n  const submit = document.getElementById('submit')\n  const error = document.getElementById('error')\n  const password = document.getElementById('password')\n  let mode = 'login'\n  if (!status.initialized) {\n    mode = 'register'\n    title.textContent = '设置管理员账号'\n    subtitle.textContent = '首次使用，请创建管理员账号（密码至少 8 位）'\n    submit.textContent = '创建并登录'\n    password.autocomplete = 'new-password'\n  }\n  form.addEventListener('submit', async (ev) => {\n    ev.preventDefault()\n    submit.disabled = true\n    error.textContent = ''\n    try {\n      const resp = await fetch('/api/auth/' + mode, {\n        method: 'POST',\n        headers: { 'content-type': 'application/json' },\n        body: JSON.stringify({\n          username: document.getElementById('username').value,\n          password: password.value,\n        }),\n      })\n      const data = await resp.json()\n      if (resp.ok && data.ok) {\n        location.href = '/'\n        return\n      }\n      error.textContent = data.error || ('请求失败（' + resp.status + '）')\n    } catch {\n      error.textContent = '网络错误，请重试'\n    } finally {\n      submit.disabled = false\n    }\n  })\n})()\n</script>\n</body>\n</html>`\n}\n"],"mappings":";AAAA,SAAgB,gBAAwB;CACtC,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgFT"}

package/lib/auth/loopback-compat.d.ts

@@ -0,0 +1,6 @@
+//#region src/auth/loopback-compat.d.ts
+declare function loopbackCompatScript(): string;
+declare function installLoopbackCompat(html: string): string;
+//#endregion
+export { installLoopbackCompat, loopbackCompatScript };
+//# sourceMappingURL=loopback-compat.d.ts.map