@dsh-plus/access-gate 0.2.4 → 0.3.1

package/lib/client.js

@@ -18000,16 +18000,16 @@ XID_Start XIDS`.split(/\s/).map((p) => [w(p), p]));
 		init_shellscript();
 		init_json();
 		var DiffBlock_module_default = {
-			"add": "obLtqa_add",
-			"block": "obLtqa_block",
-			"body": "obLtqa_body",
-			"copyButton": "obLtqa_copyButton",
-			"del": "obLtqa_del",
-			"expand": "obLtqa_expand",
-			"footer": "obLtqa_footer",
-			"gap": "obLtqa_gap",
-			"line": "obLtqa_line",
-			"path": "obLtqa_path"
+			"add": "nVxsMW_add",
+			"block": "nVxsMW_block",
+			"body": "nVxsMW_body",
+			"copyButton": "nVxsMW_copyButton",
+			"del": "nVxsMW_del",
+			"expand": "nVxsMW_expand",
+			"footer": "nVxsMW_footer",
+			"gap": "nVxsMW_gap",
+			"line": "nVxsMW_line",
+			"path": "nVxsMW_path"
 		};
 		//#endregion
 		//#region ../../node_modules/.pnpm/mdast-util-to-string@4.0.0/node_modules/mdast-util-to-string/lib/index.js
@@ -59244,27 +59244,27 @@ XID_Start XIDS`.split(/\s/).map((p) => [w(p), p]));
 			chunkString: "chunkString"
 		};
 		//#endregion
-		//#region ../../node_modules/.pnpm/@deepseek-ai+dsh-client-ui-primitives@0.1.3-alpha.2_@deepseek-ai+cordis@4.0.2/node_modules/@deepseek-ai/dsh-client-ui-primitives/lib/markdown/CodeBlock.module.css
+		//#region ../../node_modules/.pnpm/@deepseek-ai+dsh-client-ui-primitives@0.1.5-alpha.1_@deepseek-ai+cordis@4.0.2/node_modules/@deepseek-ai/dsh-client-ui-primitives/lib/markdown/CodeBlock.module.css
 		var CodeBlock_module_default = {
-			"action": "folzqq_action",
-			"banner": "folzqq_banner",
-			"bannerWrap": "folzqq_bannerWrap",
-			"block": "folzqq_block",
-			"copyButton": "folzqq_copyButton",
-			"infostring": "folzqq_infostring",
-			"plain": "folzqq_plain",
-			"shiki": "folzqq_shiki"
+			"action": "Hbqh2W_action",
+			"banner": "Hbqh2W_banner",
+			"bannerWrap": "Hbqh2W_bannerWrap",
+			"block": "Hbqh2W_block",
+			"copyButton": "Hbqh2W_copyButton",
+			"infostring": "Hbqh2W_infostring",
+			"plain": "Hbqh2W_plain",
+			"shiki": "Hbqh2W_shiki"
 		};
 		//#endregion
-		//#region ../../node_modules/.pnpm/@deepseek-ai+dsh-client-ui-primitives@0.1.3-alpha.2_@deepseek-ai+cordis@4.0.2/node_modules/@deepseek-ai/dsh-client-ui-primitives/lib/markdown/MarkdownText.module.css
+		//#region ../../node_modules/.pnpm/@deepseek-ai+dsh-client-ui-primitives@0.1.5-alpha.1_@deepseek-ai+cordis@4.0.2/node_modules/@deepseek-ai/dsh-client-ui-primitives/lib/markdown/MarkdownText.module.css
 		var MarkdownText_module_default = {
-			"fileMention": "vrxa6G_fileMention",
-			"image": "vrxa6G_image",
-			"imageAlt": "vrxa6G_imageAlt",
-			"linkIcon": "vrxa6G_linkIcon",
-			"markdown": "vrxa6G_markdown",
-			"tableFill": "vrxa6G_tableFill",
-			"tableScroll": "vrxa6G_tableScroll"
+			"fileMention": "BL43XG_fileMention",
+			"image": "BL43XG_image",
+			"imageAlt": "BL43XG_imageAlt",
+			"linkIcon": "BL43XG_linkIcon",
+			"markdown": "BL43XG_markdown",
+			"tableFill": "BL43XG_tableFill",
+			"tableScroll": "BL43XG_tableScroll"
 		};
 		//#endregion
 		//#region ../../node_modules/.pnpm/@shikijs+langs@4.4.3/node_modules/@shikijs/langs/dist/python.mjs
@@ -59584,7 +59584,7 @@ XID_Start XIDS`.split(/\s/).map((p) => [w(p), p]));
 			less_default = [lang];
 		}));
 		//#endregion
-		//#region ../../node_modules/.pnpm/@deepseek-ai+dsh-client-ui-primitives@0.1.3-alpha.2_@deepseek-ai+cordis@4.0.2/node_modules/@deepseek-ai/dsh-client-ui-primitives/lib/index.js
+		//#region ../../node_modules/.pnpm/@deepseek-ai+dsh-client-ui-primitives@0.1.5-alpha.1_@deepseek-ai+cordis@4.0.2/node_modules/@deepseek-ai/dsh-client-ui-primitives/lib/index.js
 		init_typescript();
 		init_shellscript();
 		init_json();
@@ -61284,6 +61284,30 @@ XID_Start XIDS`.split(/\s/).map((p) => [w(p), p]));
 				return;
 			}
 		}
+		/** Protocols a vocabulary-rewritten image destination may carry. */
+		function vocabularyImageUrl(url) {
+			try {
+				const protocol = new URL(url).protocol;
+				return protocol === "http:" || protocol === "https:" || protocol === "blob:" || protocol === "data:" ? url : void 0;
+			} catch {
+				return;
+			}
+		}
+		/**
+		* The displayable source for one image destination: absolute HTTP(S) as
+		* authored, otherwise the context's local-path vocabulary when it vouches for
+		* the destination. Either miss leaves the authored fallback (alt text) to the
+		* caller.
+		* @param url - The authored markdown destination.
+		* @param pathImages - Rewriting vocabulary, when the render pass has one.
+		* @returns The displayable image URL, or undefined.
+		*/
+		function imageSource(url, pathImages) {
+			const remote = remoteImageUrl(sanitizeUrl(normalizeUri(url)));
+			if (remote !== void 0) return remote;
+			const rewritten = pathImages?.resolve(url);
+			return rewritten === void 0 ? void 0 : vocabularyImageUrl(rewritten);
+		}
 		/**
 		* Create an empty {@link ReferenceTargets}.
 		* @returns Fresh empty maps.
@@ -61398,7 +61422,7 @@ XID_Start XIDS`.split(/\s/).map((p) => [w(p), p]));
 					inLink: true
 				}), key, !anchorWrapsOnlyImages(node.children));
 				case "linkReference": return renderLinkReference(node, key, context);
-				case "image": return renderImage(node.url, node.alt ?? "", key);
+				case "image": return renderImage(node.url, node.alt ?? "", key, context);
 				case "imageReference": return renderImageReference(node, key, context);
 				case "footnoteReference": return renderFootnoteReference(node, key, context);
 				case "definition":
@@ -61532,20 +61556,36 @@ XID_Start XIDS`.split(/\s/).map((p) => [w(p), p]));
 				return;
 			}
 		}
-		function renderImage(url, alt, key) {
-			const imageSrc = remoteImageUrl(sanitizeUrl(normalizeUri(url)));
+		function renderImage(url, alt, key, context) {
+			const imageSrc = imageSource(url, context.pathImages);
 			if (imageSrc === void 0) return (0, react_jsx_runtime.jsx)("span", {
 				className: MarkdownText_module_default.imageAlt,
 				children: alt
 			}, key);
+			return (0, react_jsx_runtime.jsx)(MarkdownImage, {
+				src: imageSrc,
+				alt,
+				destination: url
+			}, `${key}:${imageSrc}`);
+		}
+		/** Failed loads retain the authored alt or destination; a new source remounts the image. */
+		function MarkdownImage({ src, alt, destination }) {
+			const [failed, setFailed] = (0, react.useState)(false);
+			if (failed) return (0, react_jsx_runtime.jsx)("span", {
+				className: MarkdownText_module_default.imageAlt,
+				children: alt || destination
+			});
 			return (0, react_jsx_runtime.jsx)("img", {
 				className: MarkdownText_module_default.image,
-				src: imageSrc,
+				src,
 				alt,
+				onError: () => {
+					setFailed(true);
+				},
 				loading: "lazy",
 				decoding: "async",
 				referrerPolicy: "no-referrer"
-			}, key);
+			});
 		}
 		/** The bracketed source text a reference reverts to when its definition is missing. */
 		function referenceSuffix(node) {
@@ -61569,7 +61609,7 @@ XID_Start XIDS`.split(/\s/).map((p) => [w(p), p]));
 		function renderImageReference(node, key, context) {
 			const definition = context.targets.definitions.get(node.identifier.toUpperCase());
 			if (definition === void 0) return `![${node.alt ?? ""}${referenceSuffix(node)}`;
-			return renderImage(definition.url, node.alt ?? "", key);
+			return renderImage(definition.url, node.alt ?? "", key, context);
 		}
 		function renderFootnoteReference(node, key, context) {
 			const id = node.identifier.toUpperCase();
@@ -61630,7 +61670,7 @@ XID_Start XIDS`.split(/\s/).map((p) => [w(p), p]));
 		* full parse self-heals it.
 		*/
 		/** One settled full render: parse with math, resolve references, append the footnote section. */
-		function renderSettled(text, labels, fileMentions) {
+		function renderSettled(text, labels, fileMentions, pathImages) {
 			const root = parseGfmWithMath(text);
 			const targets = createReferenceTargets();
 			collectReferenceTargets(root.children, targets);
@@ -61638,6 +61678,7 @@ XID_Start XIDS`.split(/\s/).map((p) => [w(p), p]));
 				streaming: false,
 				labels,
 				fileMentions,
+				pathImages,
 				targets,
 				footnoteOrder: [],
 				footnoteCounts: /* @__PURE__ */ new Map()
@@ -61704,6 +61745,7 @@ XID_Start XIDS`.split(/\s/).map((p) => [w(p), p]));
 						streaming: true,
 						labels: this.labels,
 						fileMentions: void 0,
+						pathImages: void 0,
 						targets: frameTargets,
 						footnoteOrder: this.frozenFootnoteOrder,
 						footnoteCounts: this.frozenFootnoteCounts
@@ -61720,6 +61762,7 @@ XID_Start XIDS`.split(/\s/).map((p) => [w(p), p]));
 					streaming: true,
 					labels: this.labels,
 					fileMentions: void 0,
+					pathImages: void 0,
 					targets: frameTargets,
 					footnoteOrder: [...this.frozenFootnoteOrder],
 					footnoteCounts: new Map(this.frozenFootnoteCounts)
@@ -61736,13 +61779,13 @@ XID_Start XIDS`.split(/\s/).map((p) => [w(p), p]));
 				return this.lastRendered;
 			}
 		};
-		(0, react.memo)(function MarkdownText({ text, streaming = false, labels, fileMentions }) {
+		(0, react.memo)(function MarkdownText({ text, streaming = false, labels, fileMentions, pathImages }) {
 			const streamRef = (0, react.useRef)(null);
 			const streamLabelsRef = (0, react.useRef)(labels);
 			const children = (0, react.useMemo)(() => {
 				if (!streaming) {
 					streamRef.current = null;
-					return renderSettled(text, labels, fileMentions);
+					return renderSettled(text, labels, fileMentions, pathImages);
 				}
 				if (streamRef.current === null || streamLabelsRef.current !== labels) {
 					streamRef.current = new StreamingRenderer(labels);
@@ -61753,7 +61796,8 @@ XID_Start XIDS`.split(/\s/).map((p) => [w(p), p]));
 				text,
 				streaming,
 				labels,
-				fileMentions
+				fileMentions,
+				pathImages
 			]);
 			return (0, react_jsx_runtime.jsx)("div", {
 				className: MarkdownText_module_default.markdown,
@@ -62111,25 +62155,29 @@ ${extra}
 			return {
 				enabled: value.enabled,
 				allowedIpsText: value.allowedIps.join("\n"),
-				trustForwardedFor: value.trustForwardedFor
+				trustForwardedFor: value.trustForwardedFor,
+				autoLoginTrustedIps: value.autoLoginTrustedIps
 			};
 		}
 		function toPatch(draft) {
 			return {
 				enabled: draft.enabled,
 				allowedIps: draft.allowedIpsText.split("\n").map((s) => s.trim()).filter((s) => s.length > 0),
-				trustForwardedFor: draft.trustForwardedFor
+				trustForwardedFor: draft.trustForwardedFor,
+				autoLoginTrustedIps: draft.autoLoginTrustedIps
 			};
 		}
 		/** reason 枚举 → 文案 key。 */
 		const REASON_KEYS = {
 			local: "diagLocal",
-			cookie: "diagCookie"
+			cookie: "diagCookie",
+			"trusted-ip": "diagTrustedIp"
 		};
 		function verdictLabel(t, diag) {
 			if (!diag.enabled) return t("diagOff");
 			if (diag.verdict === "pass") return t("diagPass");
 			if (diag.verdict === "token-page") return t("diagTokenPage");
+			if (diag.verdict === "autologin") return t("diagAutoLogin");
 			return t("diagBlock");
 		}
 		function AccessGateCard(props) {
@@ -62254,6 +62302,14 @@ ${extra}
 							})
 						]
 					}),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)(CheckRow, {
+						prefix: "dag",
+						id: "dag-autologin",
+						label: t("autoLoginHint"),
+						checked: draft.autoLoginTrustedIps,
+						disabled,
+						onEdit: (v) => edit("autoLoginTrustedIps", v)
+					}),
 					/* @__PURE__ */ (0, react_jsx_runtime.jsx)(CheckRow, {
 						prefix: "dag",
 						id: "dag-xff",
@@ -62309,6 +62365,16 @@ ${extra}
 									children: diag.officialAuthed ? t("diagOfficialYes") : t("diagOfficialNo")
 								})]
 							}),
+							diag.autoLoginActive ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+								className: "dag-diagRow",
+								children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+									className: "dag-diagKey",
+									children: t("diagAutoLogin")
+								}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+									className: "dag-diagVal",
+									children: diag.autoLoginReady ? t("diagAutoLoginReady") : t("diagAutoLoginNoSecret")
+								})]
+							}) : null,
 							diag.invalidEntries.length > 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 								className: "dag-diagRow",
 								children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
@@ -62340,6 +62406,7 @@ ${extra}
 			mergedHint: "登录凭据由官方认证持有（启动令牌换 30 天 cookie）。获取当前令牌：服务器执行 dshctl url，或本机访问 /dsh-plus/gate/launch-url。",
 			allowedIps: "附加 IP 围栏白名单",
 			allowedIpsHint: "每行一个：精确 IP 或 CIDR（IPv4/IPv6 皆可）。非空时仅白名单来源可通行与登录；留空 = 不限制来源 IP（仅官方登录保护）。",
+			autoLoginHint: "IP 信任自动登录：白名单来源未认证时自动签发官方登录 cookie，免输启动令牌。开启即视为信任白名单内全部设备（tailnet 内），请确保白名单准确。",
 			trustForwardedFor: "信任 x-forwarded-for 还原客户端 IP",
 			trustForwardedForHint: "仅当入口代理强制覆盖该头时开启（tailscale serve 满足）；直连暴露场景必须关闭。",
 			diagTitle: "当前页面诊断",
@@ -62348,12 +62415,17 @@ ${extra}
 			diagReason: "放行原因",
 			diagLocal: "本机直连",
 			diagCookie: "官方 cookie",
+			diagTrustedIp: "IP 信任白名单",
 			diagOfficial: "官方登录状态",
 			diagOfficialYes: "已登录",
 			diagOfficialNo: "未登录",
 			diagPass: "放行",
 			diagBlock: "拦截",
 			diagTokenPage: "令牌输入页",
+			diagAutoLogin: "自动登录",
+			diagAutoLoginVerdict: "自动登录（免 token 进入）",
+			diagAutoLoginReady: "已就绪（签名密钥可读）",
+			diagAutoLoginNoSecret: "不可用（签名密钥读取失败，已降级）",
 			diagOff: "围栏未启用",
 			diagInvalid: "白名单存在无法解析的条目："
 		};
@@ -62365,6 +62437,7 @@ ${extra}
 			mergedHint: "Credentials are owned by official auth (launch token exchange, 30-day cookie). Get the current token: run dshctl url on the server, or visit /dsh-plus/gate/launch-url locally.",
 			allowedIps: "Additional IP fence allowlist",
 			allowedIpsHint: "One per line: exact IP or CIDR (IPv4/IPv6). When non-empty only listed sources may pass or log in; empty = no IP restriction (official login only).",
+			autoLoginHint: "Trusted-IP auto login: mint the official login cookie automatically for unauthenticated allowlisted sources, no launch token needed. Enabling trusts every allowlisted device (inside the tailnet); keep the allowlist accurate.",
 			trustForwardedFor: "Trust x-forwarded-for for client IP",
 			trustForwardedForHint: "Enable only when the entry proxy overwrites that header (tailscale serve does); must be off for direct exposure.",
 			diagTitle: "This page",
@@ -62373,12 +62446,17 @@ ${extra}
 			diagReason: "Reason",
 			diagLocal: "loopback",
 			diagCookie: "official cookie",
+			diagTrustedIp: "trusted IP allowlist",
 			diagOfficial: "Official login",
 			diagOfficialYes: "authenticated",
 			diagOfficialNo: "not authenticated",
 			diagPass: "pass",
 			diagBlock: "blocked",
 			diagTokenPage: "token page",
+			diagAutoLogin: "Auto login",
+			diagAutoLoginVerdict: "auto login (token-free entry)",
+			diagAutoLoginReady: "ready (signing secret readable)",
+			diagAutoLoginNoSecret: "unavailable (signing secret unreadable, degraded)",
 			diagOff: "gate disabled",
 			diagInvalid: "Allowlist entries that failed to parse:"
 		};

package/lib/index.d.ts

@@ -5,10 +5,12 @@ declare const Config: z<Schemastery.ObjectS<{
   enabled: z<boolean, boolean>;
   allowedIps: z<string[], string[]>;
   trustForwardedFor: z<boolean, boolean>;
+  autoLoginTrustedIps: z<boolean, boolean>;
 }>, Schemastery.ObjectT<{
   enabled: z<boolean, boolean>;
   allowedIps: z<string[], string[]>;
   trustForwardedFor: z<boolean, boolean>;
+  autoLoginTrustedIps: z<boolean, boolean>;
 }>>;
 type AccessGateConfig = Schemastery.TypeT<typeof Config>;
 //#endregion
@@ -23,9 +25,17 @@ declare module '@deepseek-ai/cordis' {
 /** 围栏服务：持有当前配置读取器（settings 用户层热更新经 setSource 注入）。 */
 declare class AccessGateService extends Service {
   private current;
+  /** 官方 browser-auth 签名密钥（惰性读取缓存；读取失败 = null，autoLogin fail-safe 降级）。 */
+  private signingSecret;
   constructor(ctx: Context, config: AccessGateConfig);
   /** 当前生效配置（诊断用）。 */
   policy(): AccessGateConfig;
+  /** 官方签名密钥（惰性缓存；失败返回 null 并记录，autoLogin 降级 fail-safe）。 */
+  private readSigningSecret;
+  /** IP 信任自动登录可用性（诊断用）：签名密钥可读即为可用。 */
+  autoLoginSecretReady(logger: {
+    warn(message: string): void;
+  }): boolean;
 }
 declare function apply(ctx: Context, config: AccessGateConfig): void;
 //#endregion