@dsh-cove/dsh-web-all 0.0.0-stage → 0.4.3

package/lib/types/host/services/remote-web-ui/server-mode/accounts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"accounts.d.ts","sourceRoot":"","sources":["../../../../../../src/host/services/remote-web-ui/server-mode/accounts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAiBH,mEAAmE;AACnE,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,MAAM,CAAA;AAE1C,oCAAoC;AACpC,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAA;IAChB,2DAA2D;IAC3D,YAAY,EAAE,MAAM,CAAA;IACpB,IAAI,EAAE,WAAW,CAAA;IACjB,OAAO,EAAE,OAAO,CAAA;IAChB,wCAAwC;IACxC,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,EAAE,MAAM,CAAA;CACpB;AAED,6EAA6E;AAC7E,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,WAAW,CAAA;IACjB,OAAO,EAAE,OAAO,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,2DAA2D;AAC3D,MAAM,MAAM,mBAAmB,GAAG,iBAAiB,GAAG,oBAAoB,GAAG,8BAA8B,CAAA;AAE3G,0EAA0E;AAC1E,qBAAa,oBAAqB,SAAQ,KAAK;IACjC,QAAQ,CAAC,IAAI,EAAE,mBAAmB;gBAAzB,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM;CAIhE;AAED,gFAAgF;AAChF,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,MAAM,MAAM,CAAA;IACjB,4CAA4C;IAC5C,UAAU,EAAE,MAAM,MAAM,CAAA;CACzB;AAkBD,0DAA0D;AAC1D,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAQnE;AAED,4EAA4E;AAC5E,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAwB1E;AAED;;;GAGG;AACH,qBAAa,YAAY;IACvB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAmC;IAC5D,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAQ;IAC7B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAkB;IACvC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA4B;IACxD,OAAO,CAAC,OAAO,CAAO;IACtB,OAAO,CAAC,QAAQ,CAAQ;IACxB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAwB;IAElD,SAAS,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI;IAK3C,OAAO,CAAC,OAAO;IAIf,OAAO,CAAC,cAAc;IAItB,YAAY,IAAI,OAAO;IAEvB,uFAAuF;IACvF,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG;QAAE,IAAI,EAAE,WAAW,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS;IAOnF,OAAO,CAAC,UAAU;gBAmBN,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB;IAiBhD,oDAAoD;IACpD,OAAO,CAAC,IAAI;IAkCZ,0DAA0D;IAC1D,OAAO,CAAC,OAAO;IAqBf,yEAAyE;IACzE,OAAO,IAAI,OAAO;IAIlB,0EAA0E;IAC1E,OAAO,CAAC,kBAAkB;IAQ1B,mEAAmE;IACnE,OAAO,CAAC,oBAAoB;IAM5B;;;OAGG;IACH,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,GAAG,eAAe;IAsB9E,8EAA8E;IAC9E,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO;IAMnD,6DAA6D;IAC7D,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS;IAIjD;;;;OAIG;IACH,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,GAAG,eAAe;IA0BpE,gDAAgD;IAChD,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAIpC,wDAAwD;IACxD,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO;IAQxD,2EAA2E;IAC3E,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,GAAG,OAAO;IAYrD,sEAAsE;IACtE,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO;IAYvD,iEAAiE;IACjE,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAajC,OAAO,CAAC,YAAY;IAQpB,0CAA0C;IAC1C,IAAI,IAAI,eAAe,EAAE;IAIzB,OAAO,CAAC,UAAU;CAQnB;AAED,8EAA8E;AAC9E,wBAAgB,UAAU,IAAI,MAAM,CAEnC"}

package/lib/types/host/services/remote-web-ui/server-mode/accounts.js

@@ -0,0 +1,396 @@
+/**
+ * Account store for the server-mode gateway: username, scrypt password hash,
+ * role, and enabled flag, persisted to a 0600 JSON file with atomic writes.
+ *
+ * Security invariants:
+ * - Passwords are never stored in plaintext; only the scrypt verifier string
+ *   (`scrypt$N$r$p$saltHex$hashHex`) is persisted.
+ * - Verification uses `timingSafeEqual` over the derived key.
+ * - The store file is created 0600 (owner read/write only) and rewritten via
+ *   a temp file + rename so a crash cannot leave a half-written store.
+ * - No record exposes the password hash through the snapshot surface.
+ */
+import { randomBytes as nodeRandomBytes, scryptSync, timingSafeEqual, } from 'node:crypto';
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync, } from 'node:fs';
+import { dirname } from 'node:path';
+/** Typed mutation conflict surfaced as HTTP 409 by the gateway routes. */
+export class AccountConflictError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = 'AccountConflictError';
+    }
+}
+/**
+ * scrypt parameters: 16 MiB memory (128*N*r), node's default cost class.
+ * N=16384 stays well under the OpenSSL default maxmem (32 MiB) and keeps a
+ * single verification fast enough for a login endpoint while still making
+ * offline brute force ~1s-class per guess.
+ */
+const SCRYPT = { N: 16_384, r: 8, p: 1, keylen: 64, maxmem: 32 * 1024 * 1024 };
+const STORE_VERSION = 2;
+/** Hash a password into the persisted verifier string. */
+export function hashPassword(password, salt) {
+    const derived = scryptSync(password, salt, SCRYPT.keylen, {
+        N: SCRYPT.N,
+        r: SCRYPT.r,
+        p: SCRYPT.p,
+        maxmem: SCRYPT.maxmem,
+    });
+    return `scrypt$${SCRYPT.N}$${SCRYPT.r}$${SCRYPT.p}$${salt.toString('hex')}$${derived.toString('hex')}`;
+}
+/** Constant-time password verification against a stored verifier string. */
+export function verifyPassword(password, verifier) {
+    const parts = verifier.split('$');
+    if (parts.length !== 6 || parts[0] !== 'scrypt')
+        return false;
+    const n = Number(parts[1]);
+    const r = Number(parts[2]);
+    const p = Number(parts[3]);
+    if (!Number.isInteger(n) || !Number.isInteger(r) || !Number.isInteger(p))
+        return false;
+    let salt;
+    let expected;
+    try {
+        salt = Buffer.from(parts[4], 'hex');
+        expected = Buffer.from(parts[5], 'hex');
+    }
+    catch {
+        return false;
+    }
+    // A hostile or malformed verifier (wrong params, absurd memory) must read
+    // as a failed verification, never as a crash in the login path.
+    let derived;
+    try {
+        derived = scryptSync(password, salt, SCRYPT.keylen, { N: n, r, p, maxmem: SCRYPT.maxmem });
+    }
+    catch {
+        return false;
+    }
+    return derived.length === expected.length && timingSafeEqual(derived, expected);
+}
+/**
+ * The account store. Loads the file at construction and persists every
+ * mutation through an atomic 0600 write.
+ */
+export class AccountStore {
+    accounts = new Map();
+    file;
+    deps;
+    generations = new Map();
+    healthy = true;
+    pristine = false;
+    listeners = new Set();
+    subscribe(listener) {
+        this.listeners.add(listener);
+        return () => { this.listeners.delete(listener); };
+    }
+    changed() {
+        for (const listener of [...this.listeners]) {
+            try {
+                listener();
+            }
+            catch { /* isolate observers */ }
+        }
+    }
+    requireHealthy() {
+        if (!this.healthy)
+            throw new Error('account store requires operator recovery');
+    }
+    canBootstrap() { return this.healthy && this.pristine && this.accounts.size === 0; }
+    /** Live authorization identity, independent of a persisted session's role snapshot. */
+    authorization(username) {
+        const account = this.accounts.get(username);
+        if (!this.healthy || account?.enabled !== true)
+            return undefined;
+        if (this.generations.has(username) && this.generations.get(username) !== account.authVersion)
+            return undefined;
+        return /^[a-f0-9]{64}$/.test(account.authVersion) ? { role: account.role, version: account.authVersion } : undefined;
+    }
+    invalidate(username) {
+        this.requireHealthy();
+        this.generations.set(username, nodeRandomBytes(32).toString('hex'));
+        try {
+            mkdirSync(dirname(this.file), { recursive: true });
+            const temporary = `${this.file}.auth.tmp-${process.pid}`;
+            writeFileSync(temporary, JSON.stringify(Object.fromEntries(this.generations)), { mode: 0o600 });
+            chmodSync(temporary, 0o600);
+            renameSync(temporary, `${this.file}.auth`);
+        }
+        catch (error) {
+            this.healthy = false;
+            this.changed();
+            // A separate durable deny marker prevents an older account/session image
+            // being trusted after restart when the generation journal cannot commit.
+            writeFileSync(`${this.file}.blocked`, 'authorization persistence failed', { mode: 0o600 });
+            throw error;
+        }
+    }
+    constructor(file, deps) {
+        this.file = file;
+        this.deps = deps;
+        this.healthy = !existsSync(`${file}.blocked`);
+        try {
+            if (existsSync(`${file}.auth`)) {
+                const versions = JSON.parse(readFileSync(`${file}.auth`, 'utf8'));
+                if (versions === null || typeof versions !== 'object' || Array.isArray(versions))
+                    throw new Error('invalid authorization journal');
+                for (const [name, version] of Object.entries(versions)) {
+                    if (typeof version !== 'string' || !/^[a-f0-9]{64}$/.test(version))
+                        throw new Error('invalid authorization generation');
+                    this.generations.set(name, version);
+                }
+            }
+        }
+        catch {
+            this.healthy = false;
+        }
+        this.load();
+    }
+    /** Read the persisted file, if any, into memory. */
+    load() {
+        if (!existsSync(this.file)) {
+            this.pristine = this.healthy && !existsSync(`${this.file}.auth`);
+            if (!this.pristine)
+                this.healthy = false;
+            return;
+        }
+        try {
+            const parsed = JSON.parse(readFileSync(this.file, 'utf8'));
+            if ((parsed.version !== 1 && parsed.version !== STORE_VERSION) || !Array.isArray(parsed.accounts))
+                throw new Error('unsupported account image');
+            const next = new Map();
+            for (const row of parsed.accounts) {
+                if (row === null || typeof row !== 'object' || typeof row.username !== 'string' || !row.username.trim()
+                    || next.has(row.username) || typeof row.passwordHash !== 'string' || !row.passwordHash
+                    || (row.role !== 'admin' && row.role !== 'user') || typeof row.enabled !== 'boolean'
+                    || !Number.isSafeInteger(row.createdAt) || row.createdAt < 0
+                    || (parsed.version === STORE_VERSION && (typeof row.authVersion !== 'string' || !/^[a-f0-9]{64}$/.test(row.authVersion))))
+                    throw new Error('invalid account image');
+                next.set(row.username, { ...row, authVersion: parsed.version === 1 ? nodeRandomBytes(32).toString('hex') : row.authVersion });
+            }
+            if (!this.healthy)
+                return;
+            if (parsed.version === 1) {
+                // Commit the migration barrier before the v2 image. An interruption
+                // between writes denies old credentials instead of resetting identity.
+                this.generations.clear();
+                for (const [name, row] of next)
+                    this.generations.set(name, row.authVersion);
+                const temporary = `${this.file}.auth.tmp-${process.pid}`;
+                writeFileSync(temporary, JSON.stringify(Object.fromEntries(this.generations)), { mode: 0o600 });
+                chmodSync(temporary, 0o600);
+                renameSync(temporary, `${this.file}.auth`);
+                this.persist(next);
+            }
+            for (const [name, row] of next)
+                this.accounts.set(name, row);
+        }
+        catch {
+            this.healthy = false;
+            this.accounts.clear();
+        }
+    }
+    /** Atomic 0600 persistence of the current account set. */
+    persist(next = this.accounts) {
+        const dir = dirname(this.file);
+        mkdirSync(dir, { recursive: true });
+        const payload = JSON.stringify({
+            version: STORE_VERSION,
+            accounts: [...next.values()],
+        });
+        const tmp = `${this.file}.tmp-${String(process.pid)}`;
+        try {
+            writeFileSync(tmp, payload, { mode: 0o600 });
+            chmodSync(tmp, 0o600);
+            renameSync(tmp, this.file);
+            this.pristine = false;
+        }
+        catch (error) {
+            this.healthy = false;
+            this.changed();
+            writeFileSync(`${this.file}.blocked`, 'account persistence failed; operator recovery required', { mode: 0o600 });
+            throw error;
+        }
+    }
+    /** Whether the store has any account (gateway fails closed on empty). */
+    isEmpty() {
+        return this.accounts.size === 0;
+    }
+    /** Whether this mutation would remove the store's final enabled admin. */
+    isLastEnabledAdmin(record) {
+        if (record.role !== 'admin' || !record.enabled)
+            return false;
+        for (const account of this.accounts.values()) {
+            if (account !== record && account.role === 'admin' && account.enabled)
+                return false;
+        }
+        return true;
+    }
+    /** Refuse a mutation that would leave no enabled administrator. */
+    requireAdminSurvivor(record) {
+        if (this.isLastEnabledAdmin(record)) {
+            throw new AccountConflictError('last-enabled-admin', 'at least one enabled admin account is required');
+        }
+    }
+    /**
+     * Create one account. Refuses an existing username. The first account is
+     * always an administrator, regardless of the caller-supplied role.
+     */
+    create(username, password, role) {
+        this.requireHealthy();
+        const name = username.trim();
+        if (role !== 'admin' && role !== 'user')
+            throw new Error('invalid account role');
+        if (name === '')
+            throw new Error('account: username must not be empty');
+        if (this.accounts.has(name))
+            throw new AccountConflictError('username-exists', 'account: username already exists');
+        const record = {
+            username: name,
+            passwordHash: hashPassword(password, this.deps.randomSalt()),
+            role: this.accounts.size === 0 ? 'admin' : role,
+            enabled: true,
+            createdAt: this.deps.now(),
+            authVersion: nodeRandomBytes(32).toString('hex'),
+        };
+        if (this.generations.has(name)) {
+            this.invalidate(name);
+            record.authVersion = this.generations.get(name);
+        }
+        const next = new Map(this.accounts).set(name, record);
+        this.persist(next);
+        this.accounts.set(name, record);
+        this.changed();
+        return this.snapshotOf(record);
+    }
+    /** Verify a username/password pair. Never reveals whether the user exists. */
+    verify(username, password) {
+        const record = this.accounts.get(username);
+        if (!this.healthy || record === undefined || !record.enabled)
+            return false;
+        return verifyPassword(password, record.passwordHash);
+    }
+    /** Look up the role of an existing account, or undefined. */
+    roleOf(username) {
+        return this.accounts.get(username)?.role;
+    }
+    /**
+     * Create a passwordless external-identity binding. External login may not
+     * bootstrap the store: an operator must create the first local administrator
+     * explicitly, otherwise unrestricted provider JIT binding could claim it.
+     */
+    ensureExternal(username, role) {
+        this.requireHealthy();
+        if (!username.trim() || (role !== 'admin' && role !== 'user'))
+            throw new Error('invalid external account');
+        const existing = this.accounts.get(username);
+        if (existing !== undefined)
+            return this.snapshotOf(existing);
+        if (this.accounts.size === 0) {
+            throw new AccountConflictError('external-bootstrap-forbidden', 'create a local administrator before external sign-in');
+        }
+        const record = {
+            username,
+            // A valid but unknowable verifier keeps the version-1 store compatible;
+            // external accounts can authenticate only through their provider.
+            passwordHash: hashPassword(nodeRandomBytes(32).toString('base64url'), this.deps.randomSalt()),
+            role,
+            enabled: true,
+            createdAt: this.deps.now(),
+            authVersion: nodeRandomBytes(32).toString('hex'),
+        };
+        if (this.generations.has(username)) {
+            this.invalidate(username);
+            record.authVersion = this.generations.get(username);
+        }
+        const next = new Map(this.accounts).set(username, record);
+        this.persist(next);
+        this.accounts.set(username, record);
+        this.changed();
+        return this.snapshotOf(record);
+    }
+    /** Whether an account exists and is enabled. */
+    isEnabled(username) {
+        return this.accounts.get(username)?.enabled === true;
+    }
+    /** Replace a password (does not touch other fields). */
+    setPassword(username, password) {
+        const record = this.accounts.get(username);
+        if (record === undefined)
+            return false;
+        this.invalidate(username);
+        this.commitChange(username, { ...record, passwordHash: hashPassword(password, this.deps.randomSalt()) });
+        return true;
+    }
+    /** Change a role without allowing the last enabled admin to be demoted. */
+    setRole(username, role) {
+        this.requireHealthy();
+        if (role !== 'admin' && role !== 'user')
+            throw new Error('invalid account role');
+        const record = this.accounts.get(username);
+        if (record === undefined)
+            return false;
+        if (role === record.role)
+            return true;
+        if (role !== 'admin')
+            this.requireAdminSurvivor(record);
+        this.invalidate(username);
+        this.commitChange(username, { ...record, role });
+        return true;
+    }
+    /** Enable or disable an account (disabled accounts cannot log in). */
+    setEnabled(username, enabled) {
+        this.requireHealthy();
+        if (typeof enabled !== 'boolean')
+            throw new Error('invalid enabled flag');
+        const record = this.accounts.get(username);
+        if (record === undefined)
+            return false;
+        if (enabled === record.enabled)
+            return true;
+        if (!enabled)
+            this.requireAdminSurvivor(record);
+        this.invalidate(username);
+        this.commitChange(username, { ...record, enabled });
+        return true;
+    }
+    /** Remove an account without deleting the last enabled admin. */
+    remove(username) {
+        const record = this.accounts.get(username);
+        if (record === undefined)
+            return false;
+        this.requireAdminSurvivor(record);
+        this.invalidate(username);
+        const next = new Map(this.accounts);
+        next.delete(username);
+        this.persist(next);
+        this.accounts.delete(username);
+        this.changed();
+        return true;
+    }
+    commitChange(username, record) {
+        record.authVersion = this.generations.get(username);
+        const next = new Map(this.accounts).set(username, record);
+        this.persist(next);
+        this.accounts.set(username, record);
+        this.changed();
+    }
+    /** All accounts as redacted snapshots. */
+    list() {
+        return [...this.accounts.values()].map((record) => this.snapshotOf(record)).sort((a, b) => a.username.localeCompare(b.username));
+    }
+    snapshotOf(record) {
+        return {
+            username: record.username,
+            role: record.role,
+            enabled: record.enabled,
+            createdAt: record.createdAt,
+        };
+    }
+}
+/** A 16-byte cryptographically random salt (the live seam implementation). */
+export function randomSalt() {
+    return nodeRandomBytes(16);
+}

package/lib/types/host/services/remote-web-ui/server-mode/cookie.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Cookie read/write helpers for the server-mode gateway. The gateway owns
+ * the auth domain: it sets its own HttpOnly session cookie on the public
+ * origin and strips any upstream Set-Cookie it proxies.
+ */
+/** Read one cookie value from a Cookie header. */
+export declare function readCookie(header: string | undefined, name: string): string | undefined;
+/** Build a Set-Cookie header value. */
+export declare function makeSetCookie(name: string, value: string, options?: {
+    /** Only set under TLS. */
+    secure?: boolean;
+    /** Browser-side lifetime hint; the server still enforces real expiry. */
+    maxAgeSeconds?: number;
+}): string;
+/**
+ * Build a Set-Cookie for a non-secret, browser-readable marker (no HttpOnly).
+ * The gateway writes dsh_gw this way so the client half can recognise "served
+ * by our gateway" synchronously, while the real session cookie stays HttpOnly.
+ */
+export declare function makeReadableCookie(name: string, value: string, options?: {
+    secure?: boolean;
+    maxAgeSeconds?: number;
+}): string;
+/** Build a Set-Cookie header value that clears a cookie. */
+export declare function makeClearCookie(name: string, options?: {
+    secure?: boolean;
+}): string;
+//# sourceMappingURL=cookie.d.ts.map

package/lib/types/host/services/remote-web-ui/server-mode/cookie.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookie.d.ts","sourceRoot":"","sources":["../../../../../../src/host/services/remote-web-ui/server-mode/cookie.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,kDAAkD;AAClD,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CASvF;AAED,uCAAuC;AACvC,wBAAgB,aAAa,CAC3B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,OAAO,GAAE;IACP,0BAA0B;IAC1B,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,yEAAyE;IACzE,aAAa,CAAC,EAAE,MAAM,CAAA;CAClB,GACL,MAAM,CAKR;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAAO,GACzD,MAAM,CAKR;AAED,4DAA4D;AAC5D,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,MAAM,CAIxF"}

package/lib/types/host/services/remote-web-ui/server-mode/cookie.js

@@ -0,0 +1,48 @@
+/**
+ * Cookie read/write helpers for the server-mode gateway. The gateway owns
+ * the auth domain: it sets its own HttpOnly session cookie on the public
+ * origin and strips any upstream Set-Cookie it proxies.
+ */
+/** Read one cookie value from a Cookie header. */
+export function readCookie(header, name) {
+    if (header === undefined)
+        return undefined;
+    for (const part of header.split(';')) {
+        const eq = part.indexOf('=');
+        if (eq < 0)
+            continue;
+        const key = part.slice(0, eq).trim();
+        if (key === name)
+            return part.slice(eq + 1).trim();
+    }
+    return undefined;
+}
+/** Build a Set-Cookie header value. */
+export function makeSetCookie(name, value, options = {}) {
+    const parts = [`${name}=${value}`, 'Path=/', 'HttpOnly', 'SameSite=Lax'];
+    if (options.secure)
+        parts.push('Secure');
+    if (options.maxAgeSeconds !== undefined)
+        parts.push(`Max-Age=${String(options.maxAgeSeconds)}`);
+    return parts.join('; ');
+}
+/**
+ * Build a Set-Cookie for a non-secret, browser-readable marker (no HttpOnly).
+ * The gateway writes dsh_gw this way so the client half can recognise "served
+ * by our gateway" synchronously, while the real session cookie stays HttpOnly.
+ */
+export function makeReadableCookie(name, value, options = {}) {
+    const parts = [`${name}=${value}`, 'Path=/', 'SameSite=Lax'];
+    if (options.secure)
+        parts.push('Secure');
+    if (options.maxAgeSeconds !== undefined)
+        parts.push(`Max-Age=${String(options.maxAgeSeconds)}`);
+    return parts.join('; ');
+}
+/** Build a Set-Cookie header value that clears a cookie. */
+export function makeClearCookie(name, options = {}) {
+    const parts = [`${name}=`, 'Path=/', 'HttpOnly', 'SameSite=Lax', 'Max-Age=0'];
+    if (options.secure)
+        parts.push('Secure');
+    return parts.join('; ');
+}

package/lib/types/host/services/remote-web-ui/server-mode/dsh-home.d.ts

@@ -0,0 +1,17 @@
+/**
+ * DSH_HOME resolution shared by the plugin family's Host halves: the
+ * environment override wins, the platform home fallback follows. Mirrors
+ * what the family’s host plugins each used to implement locally.
+ */
+/** Expand a leading ~ (or ~user) in a path, platform-style. */
+export declare function expandHome(path: string, home?: string): string;
+/**
+ * Resolve the DSH home directory.
+ * @param env - process environment to read DSH_HOME from.
+ * @param home - platform home directory fallback (test seam).
+ * @returns the absolute DSH home path.
+ */
+export declare function resolveDshHome(env?: NodeJS.ProcessEnv, home?: string): string;
+/** Resolve the DSH home directory from the live environment. */
+export declare function dshHome(): string;
+//# sourceMappingURL=dsh-home.d.ts.map

package/lib/types/host/services/remote-web-ui/server-mode/dsh-home.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dsh-home.d.ts","sourceRoot":"","sources":["../../../../../../src/host/services/remote-web-ui/server-mode/dsh-home.ts"],"names":[],"mappings":"AACA;;;;GAIG;AAMH,+DAA+D;AAC/D,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,MAAkB,GAAG,MAAM,CAMzE;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,EAAE,IAAI,GAAE,MAAkB,GAAG,MAAM,CAUrG;AAED,gEAAgE;AAChE,wBAAgB,OAAO,IAAI,MAAM,CAEhC"}

package/lib/types/host/services/remote-web-ui/server-mode/dsh-home.js

@@ -0,0 +1,40 @@
+// Generated by scripts/sync-shared.mjs from shared/host/dsh-home.ts. Do not edit this copy; edit the shared source and run "node scripts/sync-shared.mjs".
+/**
+ * DSH_HOME resolution shared by the plugin family's Host halves: the
+ * environment override wins, the platform home fallback follows. Mirrors
+ * what the family’s host plugins each used to implement locally.
+ */
+import { homedir } from 'node:os';
+import { isAbsolute, join } from 'node:path';
+import { isAbsolute as posixIsAbsolute, join as posixJoin } from 'node:path/posix';
+/** Expand a leading ~ (or ~user) in a path, platform-style. */
+export function expandHome(path, home = homedir()) {
+    const isPosix = home.startsWith('/');
+    const j = isPosix ? posixJoin : join;
+    if (path === '~')
+        return home;
+    if (path.startsWith('~/') || path.startsWith('~\\'))
+        return j(home, path.slice(2));
+    return path;
+}
+/**
+ * Resolve the DSH home directory.
+ * @param env - process environment to read DSH_HOME from.
+ * @param home - platform home directory fallback (test seam).
+ * @returns the absolute DSH home path.
+ */
+export function resolveDshHome(env = process.env, home = homedir()) {
+    const isPosix = home.startsWith('/');
+    const j = isPosix ? posixJoin : join;
+    const isAbs = isPosix ? posixIsAbsolute : isAbsolute;
+    const raw = env.DSH_HOME;
+    if (raw !== undefined && raw.trim() !== '') {
+        const expanded = expandHome(raw.trim(), home);
+        return isAbs(expanded) ? expanded : j(process.cwd(), expanded);
+    }
+    return j(home, '.dsh');
+}
+/** Resolve the DSH home directory from the live environment. */
+export function dshHome() {
+    return resolveDshHome();
+}

package/lib/types/host/services/remote-web-ui/server-mode/external-auth.d.ts

@@ -0,0 +1,73 @@
+import type { AccountRole } from './accounts.ts';
+export interface OidcProviderConfig {
+    id: string;
+    label?: string;
+    issuer: string;
+    clientId: string;
+    clientSecret: string;
+    scopes?: string[];
+    allowedSubjects?: string[];
+    allowedEmailDomains?: string[];
+    defaultRole?: AccountRole;
+}
+export interface FeishuProviderConfig {
+    id?: string;
+    label?: string;
+    appId: string;
+    appSecret: string;
+    authorizationUrl?: string;
+    baseUrl?: string;
+    allowedOpenIds?: string[];
+    defaultRole?: AccountRole;
+}
+export interface ExternalPrincipal {
+    providerId: string;
+    subject: string;
+    issuer?: string;
+    tenant?: string;
+    displayName?: string;
+    email?: string;
+    role: AccountRole;
+}
+export interface PublicAuthProvider {
+    id: string;
+    label: string;
+    type: 'oidc' | 'feishu';
+}
+export interface ExternalAuthDeps {
+    now?: () => number;
+    randomBytes?: (size: number) => Buffer;
+    fetch?: typeof fetch;
+    maxPendingMs?: number;
+}
+/** Short-lived, one-time authorization state plus provider protocol adapters. */
+export declare class ExternalAuthService {
+    private readonly pending;
+    private readonly discoveries;
+    private readonly oidc;
+    private readonly feishu;
+    private readonly now;
+    private readonly random;
+    private readonly fetchImpl;
+    private readonly maxPendingMs;
+    constructor(config: {
+        oidc?: OidcProviderConfig[];
+        feishu?: FeishuProviderConfig;
+    }, deps?: ExternalAuthDeps);
+    list(): PublicAuthProvider[];
+    private newPending;
+    private take;
+    private sweep;
+    private discovery;
+    begin(providerId: string, redirectUri: string, next: string): Promise<URL>;
+    callback(providerId: string, redirectUri: string, code: string, state: string): Promise<{
+        principal: ExternalPrincipal;
+        next: string;
+    }>;
+    private finishOidc;
+    private oidcPrincipal;
+    private finishFeishu;
+}
+/** External identities are namespaced local account keys, never display names. */
+export declare function externalAccountName(principal: ExternalPrincipal): string;
+//# sourceMappingURL=external-auth.d.ts.map

package/lib/types/host/services/remote-web-ui/server-mode/external-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"external-auth.d.ts","sourceRoot":"","sources":["../../../../../../src/host/services/remote-web-ui/server-mode/external-auth.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAA;AAEhD,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;IACjB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;IAC1B,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC9B,WAAW,CAAC,EAAE,WAAW,CAAA;CAC1B;AAED,MAAM,WAAW,oBAAoB;IACnC,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,MAAM,CAAA;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IACzB,WAAW,CAAC,EAAE,WAAW,CAAA;CAC1B;AAED,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,CAAA;IAClB,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,WAAW,CAAA;CAClB;AAED,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,GAAG,QAAQ,CAAA;CACxB;AAYD,MAAM,WAAW,gBAAgB;IAC/B,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;IAClB,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAA;IACtC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAA;IACpB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAiDD,iFAAiF;AACjF,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA0C;IAClE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA4C;IACxE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAwC;IAC7D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA0C;IACjE,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAc;IAClC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA0B;IACjD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAc;IACxC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAQ;gBAEzB,MAAM,EAAE;QAAE,IAAI,CAAC,EAAE,kBAAkB,EAAE,CAAC;QAAC,MAAM,CAAC,EAAE,oBAAoB,CAAA;KAAE,EAAE,IAAI,GAAE,gBAAqB;IAgB/G,IAAI,IAAI,kBAAkB,EAAE;IAO5B,OAAO,CAAC,UAAU;IAgBlB,OAAO,CAAC,IAAI;IAQZ,OAAO,CAAC,KAAK;YAKC,SAAS;IAsBjB,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC;IA8B1E,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,iBAAiB,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;YAS/H,UAAU;IAqBxB,OAAO,CAAC,aAAa;YAeP,YAAY;CAsB3B;AAED,kFAAkF;AAClF,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,iBAAiB,GAAG,MAAM,CAExE"}