@linxin666/dsh-remote-web-ui 0.3.6 → 0.3.9

package/lib/types/client/pair-api.d.ts

@@ -82,7 +82,6 @@ export interface DeviceFrame {
 /**
  * Mint a fresh pairing token (one active token at a time — this invalidates
  * any previous link).
- * @param workspaceId - optional current workspace to deep-link the phone into.
  * @param address - optional LAN IP literal the QR must be built from (the
  * default is the first interface); unknown literals refuse with
  * 'unknown-address'.
@@ -90,7 +89,7 @@ export interface DeviceFrame {
  * 0.0.0.0), or the forbidden refusal (the loopback-only fence rejected this
  * origin — the panel is a desktop control endpoint).
  */
-export declare function issuePair(workspaceId?: string, address?: string): Promise<IssueResponse>;
+export declare function issuePair(address?: string): Promise<IssueResponse>;
 /**
  * Accept a pairing token (the phone's first open of the QR link). Success
  * sets the device cookie; the page then reloads to boot with it.
@@ -109,10 +108,9 @@ export declare function stopPair(): Promise<void>;
 export declare function revokePair(deviceId: string): Promise<void>;
 /** Presence heartbeat from a paired phone (unpaired heartbeats 401 harmlessly). */
 export declare function sendHeartbeat(): Promise<void>;
-/** Whether the current page URL carries a pairing token / workspace target. */
+/** Whether the current page URL carries a pairing token. */
 export declare function readPairParams(search: string): {
     pair?: string;
-    workspace?: string;
 };
 /**
  * Strip one query parameter from the current URL without reloading.
@@ -120,8 +118,28 @@ export declare function readPairParams(search: string): {
  * @returns the new search string ('' when empty).
  */
 export declare function stripParam(name: string): string;
-/** Convert an issued `/m/` link into the desktop pairing form. */
-export declare function desktopPairUrl(mobileUrl: string): string;
+/** LAN-bind status frame from the loopback-only card endpoint. */
+export interface LanBindFrame {
+    profile: string;
+    /** The config toggle: true/false once flipped, null while untouched. */
+    setting: boolean | null;
+    /** The bind default the managed patch block currently pins. */
+    blockHost: string | null;
+    /** The live bind of the running web server. */
+    bindHost: string;
+    port: number;
+    lanUrls: string[];
+    firewall: {
+        ok: boolean;
+        managed: boolean;
+        note?: string;
+    };
+    platform: string;
+    /** true when the running bind has not caught up with the toggle yet. */
+    pendingRestart?: boolean;
+}
+/** Read the LAN-bind facts (loopback-only endpoint). */
+export declare function readLanBindStatus(): Promise<LanBindFrame>;
 /** Human-readable expiry clock, e.g. "10:35". */
 export declare function formatClock(epochMs: number): string;
 /** Calendar + clock for last-seen timestamps, e.g. "2026-08-19 10:35". */

package/lib/types/client/pair-api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pair-api.d.ts","sourceRoot":"","sources":["../../../src/client/pair-api.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,wBAAwB;AACxB,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,IAAI,CAAA;IACR,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,MAAM,CAAA;IACjB,8DAA8D;IAC9D,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,+DAA+D;IAC/D,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,wDAAwD;AACxD,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,KAAK,CAAA;IACT,IAAI,EAAE,cAAc,CAAA;CACrB;AAED,uEAAuE;AACvE,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,KAAK,CAAA;IACT,IAAI,EAAE,iBAAiB,CAAA;CACxB;AAED,qEAAqE;AACrE,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,KAAK,CAAA;IACT,IAAI,EAAE,WAAW,CAAA;CAClB;AAED,MAAM,MAAM,aAAa,GAAG,WAAW,GAAG,gBAAgB,GAAG,mBAAmB,GAAG,qBAAqB,CAAA;AAExG,oEAAoE;AACpE,MAAM,WAAW,cAAc;IAC7B,oBAAoB,EAAE,OAAO,CAAA;CAC9B;AAED,0DAA0D;AAC1D,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,cAAc,CAAC,CAQlE;AAED,8BAA8B;AAC9B,MAAM,MAAM,aAAa,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,SAAS,GAAG,MAAM,GAAG,WAAW,CAAA;CAAE,CAAA;AAEjF,sEAAsE;AACtE,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,UAAU,GAAG,SAAS,GAAG,QAAQ,CAAA;IACxC,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,oEAAoE;AACpE,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,EAAE,CAAA;CAC5C;AAED,kCAAkC;AAClC,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,OAAO,CAAA;IACb,KAAK,EAAE,cAAc,GAAG,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,cAAc,CAAA;IAC5E,YAAY,EAAE,OAAO,CAAA;IACrB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,gDAAgD;IAChD,OAAO,CAAC,EAAE,WAAW,EAAE,CAAA;IACvB,mEAAmE;IACnE,MAAM,CAAC,EAAE,iBAAiB,CAAA;IAC1B,mEAAmE;IACnE,OAAO,CAAC,EAAE,YAAY,CAAA;CACvB;AAED,iEAAiE;AACjE,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAA;IACV,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,OAAO,CAAA;IACf,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,SAAS,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAgB9F;AAED;;;;;GAKG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG,aAAa,CAAC,CAUrF;AAED,iEAAiE;AACjE,wBAAsB,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAG9C;AAED;;;GAGG;AACH,wBAAsB,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAQhE;AAED,mFAAmF;AACnF,wBAAsB,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAEnD;AAED,+EAA+E;AAC/E,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,CAQpF;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAI/C;AAED,kEAAkE;AAClE,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAIxD;AAED,iDAAiD;AACjD,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAKnD;AAED,0EAA0E;AAC1E,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAMtD;AAED;;;;;GAKG;AACH,wBAAsB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAsB7D"}
+{"version":3,"file":"pair-api.d.ts","sourceRoot":"","sources":["../../../src/client/pair-api.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,wBAAwB;AACxB,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,IAAI,CAAA;IACR,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,MAAM,CAAA;IACjB,8DAA8D;IAC9D,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,+DAA+D;IAC/D,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,wDAAwD;AACxD,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,KAAK,CAAA;IACT,IAAI,EAAE,cAAc,CAAA;CACrB;AAED,uEAAuE;AACvE,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,KAAK,CAAA;IACT,IAAI,EAAE,iBAAiB,CAAA;CACxB;AAED,qEAAqE;AACrE,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,KAAK,CAAA;IACT,IAAI,EAAE,WAAW,CAAA;CAClB;AAED,MAAM,MAAM,aAAa,GAAG,WAAW,GAAG,gBAAgB,GAAG,mBAAmB,GAAG,qBAAqB,CAAA;AAExG,oEAAoE;AACpE,MAAM,WAAW,cAAc;IAC7B,oBAAoB,EAAE,OAAO,CAAA;CAC9B;AAED,0DAA0D;AAC1D,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,cAAc,CAAC,CAQlE;AAED,8BAA8B;AAC9B,MAAM,MAAM,aAAa,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,SAAS,GAAG,MAAM,GAAG,WAAW,CAAA;CAAE,CAAA;AAEjF,sEAAsE;AACtE,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,UAAU,GAAG,SAAS,GAAG,QAAQ,CAAA;IACxC,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,oEAAoE;AACpE,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,EAAE,CAAA;CAC5C;AAED,kCAAkC;AAClC,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,OAAO,CAAA;IACb,KAAK,EAAE,cAAc,GAAG,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,cAAc,CAAA;IAC5E,YAAY,EAAE,OAAO,CAAA;IACrB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,gDAAgD;IAChD,OAAO,CAAC,EAAE,WAAW,EAAE,CAAA;IACvB,mEAAmE;IACnE,MAAM,CAAC,EAAE,iBAAiB,CAAA;IAC1B,mEAAmE;IACnE,OAAO,CAAC,EAAE,YAAY,CAAA;CACvB;AAED,iEAAiE;AACjE,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAA;IACV,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,OAAO,CAAA;IACf,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED;;;;;;;;;GASG;AACH,wBAAsB,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAexE;AAED;;;;;GAKG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG,aAAa,CAAC,CAUrF;AAED,iEAAiE;AACjE,wBAAsB,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAG9C;AAED;;;GAGG;AACH,wBAAsB,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAQhE;AAED,mFAAmF;AACnF,wBAAsB,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAEnD;AAED,4DAA4D;AAC5D,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAIhE;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAI/C;AAED,kEAAkE;AAClE,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAA;IACf,wEAAwE;IACxE,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;IACvB,+DAA+D;IAC/D,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,+CAA+C;IAC/C,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,QAAQ,EAAE;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IAC1D,QAAQ,EAAE,MAAM,CAAA;IAChB,wEAAwE;IACxE,cAAc,CAAC,EAAE,OAAO,CAAA;CACzB;AAED,wDAAwD;AACxD,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,YAAY,CAAC,CAI/D;AAED,iDAAiD;AACjD,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAKnD;AAED,0EAA0E;AAC1E,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAMtD;AAED;;;;;GAKG;AACH,wBAAsB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAsB7D"}

package/lib/types/client/pair-api.js

@@ -17,7 +17,6 @@ export async function readPairGatePolicy() {
 /**
  * Mint a fresh pairing token (one active token at a time — this invalidates
  * any previous link).
- * @param workspaceId - optional current workspace to deep-link the phone into.
  * @param address - optional LAN IP literal the QR must be built from (the
  * default is the first interface); unknown literals refuse with
  * 'unknown-address'.
@@ -25,12 +24,11 @@ export async function readPairGatePolicy() {
  * 0.0.0.0), or the forbidden refusal (the loopback-only fence rejected this
  * origin — the panel is a desktop control endpoint).
  */
-export async function issuePair(workspaceId, address) {
+export async function issuePair(address) {
     const response = await fetch('/api/pair/issue', {
         method: 'POST',
         headers: { 'content-type': 'application/json' },
         body: JSON.stringify({
-            ...(workspaceId !== undefined ? { workspaceId } : {}),
             ...(address !== undefined ? { address } : {}),
         }),
     });
@@ -90,15 +88,11 @@ export async function revokePair(deviceId) {
 export async function sendHeartbeat() {
     await fetch('/api/pair/heartbeat', { method: 'POST' });
 }
-/** Whether the current page URL carries a pairing token / workspace target. */
+/** Whether the current page URL carries a pairing token. */
 export function readPairParams(search) {
     const params = new URLSearchParams(search);
     const pair = params.get('pair');
-    const workspace = params.get('workspace');
-    return {
-        ...(pair !== null && pair !== '' ? { pair } : {}),
-        ...(workspace !== null && workspace !== '' ? { workspace } : {}),
-    };
+    return pair !== null && pair !== '' ? { pair } : {};
 }
 /**
  * Strip one query parameter from the current URL without reloading.
@@ -110,11 +104,12 @@ export function stripParam(name) {
     url.searchParams.delete(name);
     return url.search;
 }
-/** Convert an issued `/m/` link into the desktop pairing form. */
-export function desktopPairUrl(mobileUrl) {
-    const url = new URL(mobileUrl);
-    url.pathname = '/';
-    return url.href;
+/** Read the LAN-bind facts (loopback-only endpoint). */
+export async function readLanBindStatus() {
+    const response = await fetch('/api/pair/lan-bind');
+    if (!response.ok)
+        throw new Error(`remote-web-ui: lan-bind status failed with ${String(response.status)}`);
+    return await response.json();
 }
 /** Human-readable expiry clock, e.g. "10:35". */
 export function formatClock(epochMs) {

package/lib/types/client/remote-channel.d.ts

@@ -78,6 +78,9 @@ export interface ChannelWindow {
         origin: string;
         href: string;
     };
+    sessionStorage?: {
+        getItem(key: string): string | null;
+    };
 }
 /** Options for {@link installRemoteChannel}. */
 export interface RemoteChannelOptions {

package/lib/types/client/remote-channel.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remote-channel.d.ts","sourceRoot":"","sources":["../../../src/client/remote-channel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EACL,iBAAiB,EAEjB,aAAa,EACd,MAAM,4BAA4B,CAAA;AAEnC,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,CAAA;AAC3C,YAAY,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAA;AACvE,OAAO,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAA;AAIvE,qEAAqE;AACrE,MAAM,WAAW,6BAA6B;IAC5C,MAAM,EAAE,OAAO,GAAG,SAAS,GAAG,aAAa,GAAG,MAAM,CAAA;IACpD,KAAK,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAC;QAAC,oBAAoB,CAAC,EAAE,OAAO,CAAA;KAAE,CAAA;CAC9D;AAED,qFAAqF;AACrF,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,6BAA6B,EACvC,iBAAiB,EAAE,OAAO,GAAG,SAAS,GACrC,OAAO,CAQT;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAI5D;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAUhE;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE7D;AAED,yEAAyE;AACzE,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAcnF;AAED,wEAAwE;AACxE,UAAU,cAAc;IACtB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,qEAAqE;AACrE,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,OAAO,UAAU,CAAC,KAAK,CAAA;IAC9B,SAAS,EAAE,OAAO,SAAS,CAAA;IAC3B,WAAW,CAAC,EAAE,OAAO,WAAW,CAAA;IAChC,gBAAgB,CAAC,EAAE,cAAc,CAAA;IACjC,iBAAiB,CAAC,EAAE,cAAc,CAAA;IAClC,iBAAiB,CAAC,EAAE,cAAc,CAAA;IAClC,QAAQ,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;CAC3C;AAED,gDAAgD;AAChD,MAAM,WAAW,oBAAoB;IACnC,qEAAqE;IACrE,UAAU,CAAC,EAAE,MAAM,IAAI,CAAA;IACvB,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,MAAM,IAAI,CAAA;CACtB;AAoBD;;;GAGG;AACH,wBAAsB,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAO3E;AA0BD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,GAAE,oBAAyB,GAAG,MAAM,IAAI,CAwE1G;AAED;;;;;;GAMG;AACH,MAAM,MAAM,iBAAiB,GAAG,SAAS,GAAG,QAAQ,GAAG,MAAM,CAAA;AAE7D;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,GAAG,iBAAiB,CAIxF"}
+{"version":3,"file":"remote-channel.d.ts","sourceRoot":"","sources":["../../../src/client/remote-channel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EACL,iBAAiB,EAEjB,aAAa,EACd,MAAM,4BAA4B,CAAA;AAEnC,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,CAAA;AAC3C,YAAY,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAA;AACvE,OAAO,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAA;AAIvE,qEAAqE;AACrE,MAAM,WAAW,6BAA6B;IAC5C,MAAM,EAAE,OAAO,GAAG,SAAS,GAAG,aAAa,GAAG,MAAM,CAAA;IACpD,KAAK,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAC;QAAC,oBAAoB,CAAC,EAAE,OAAO,CAAA;KAAE,CAAA;CAC9D;AAED,qFAAqF;AACrF,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,6BAA6B,EACvC,iBAAiB,EAAE,OAAO,GAAG,SAAS,GACrC,OAAO,CAQT;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAI5D;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAUhE;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE7D;AAED,yEAAyE;AACzE,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAcnF;AAED,wEAAwE;AACxE,UAAU,cAAc;IACtB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,qEAAqE;AACrE,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,OAAO,UAAU,CAAC,KAAK,CAAA;IAC9B,SAAS,EAAE,OAAO,SAAS,CAAA;IAC3B,WAAW,CAAC,EAAE,OAAO,WAAW,CAAA;IAChC,gBAAgB,CAAC,EAAE,cAAc,CAAA;IACjC,iBAAiB,CAAC,EAAE,cAAc,CAAA;IAClC,iBAAiB,CAAC,EAAE,cAAc,CAAA;IAClC,QAAQ,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;IAC1C,cAAc,CAAC,EAAE;QAAE,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAA;KAAE,CAAA;CACzD;AAED,gDAAgD;AAChD,MAAM,WAAW,oBAAoB;IACnC,qEAAqE;IACrE,UAAU,CAAC,EAAE,MAAM,IAAI,CAAA;IACvB,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,MAAM,IAAI,CAAA;CACtB;AAoBD;;;GAGG;AACH,wBAAsB,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAO3E;AA0BD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,GAAE,oBAAyB,GAAG,MAAM,IAAI,CAmG1G;AAED;;;;;;GAMG;AACH,MAAM,MAAM,iBAAiB,GAAG,SAAS,GAAG,QAAQ,GAAG,MAAM,CAAA;AAE7D;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,GAAG,iBAAiB,CAIxF"}

package/lib/types/client/remote-channel.js

@@ -178,6 +178,38 @@ export function installRemoteChannel(window, options = {}) {
     const OriginalEventSource = window.EventSource;
     const sameOrigin = (url) => url.origin === window.location.origin;
     const rewrite = (raw) => rewriteRawUrl(raw, window.location.href, window.location.origin);
+    // The cookieless device credential (set by the /pair-app capture script):
+    // attaches as a header on gated fetches and as the device query on WS and
+    // EventSource handshakes, mirroring the boot patch exactly.
+    const device = (() => {
+        try {
+            return window.sessionStorage?.getItem(RULES.deviceKey) ?? null;
+        }
+        catch {
+            return null;
+        }
+    })();
+    const attach = (init) => {
+        if (device === null)
+            return init;
+        const headers = init?.headers;
+        if (typeof Headers !== 'undefined' && headers instanceof Headers) {
+            try {
+                headers.set(RULES.deviceHeader, device);
+            }
+            catch { /* ignore */ }
+            return init;
+        }
+        if (typeof headers === 'object' && headers !== null) {
+            return { ...init, headers: { ...headers, [RULES.deviceHeader]: device } };
+        }
+        return init;
+    };
+    const withDeviceQuery = (url) => {
+        if (device !== null)
+            url.searchParams.set(RULES.deviceQuery, device);
+        return url;
+    };
     const patchedFetch = (input, init) => {
         const url = new URL(typeof input === 'string' || input instanceof URL ? input.toString() : input.url, window.location.href);
         if (sameOrigin(url) && shouldRewriteFetchPath(url.pathname)) {
@@ -186,7 +218,7 @@ export function installRemoteChannel(window, options = {}) {
             const next = typeof input === 'string' || input instanceof URL
                 ? rewritten.toString()
                 : new Request(rewritten, input);
-            return Promise.resolve(originalFetch.call(window, next, init)).then(async (response) => {
+            return Promise.resolve(originalFetch.call(window, next, attach(init))).then(async (response) => {
                 if (await isUnpairedDenied(response.clone()))
                     options.onUnpaired?.();
                 else
@@ -203,7 +235,7 @@ export function installRemoteChannel(window, options = {}) {
             if (wsOrigin !== '' && wsOrigin === window.location.origin && shouldRewriteWsPath(parsed.pathname)) {
                 const rewritten = new URL(parsed);
                 rewritten.pathname = rewritePath(parsed.pathname);
-                super(rewritten, protocols);
+                super(withDeviceQuery(rewritten), protocols);
                 return;
             }
             super(url, protocols);
@@ -223,7 +255,7 @@ export function installRemoteChannel(window, options = {}) {
                 if (sameOrigin(parsed) && shouldRewriteFetchPath(parsed.pathname)) {
                     const rewritten = new URL(parsed);
                     rewritten.pathname = rewritePath(parsed.pathname);
-                    super(rewritten, eventSourceInitDict);
+                    super(withDeviceQuery(rewritten), eventSourceInitDict);
                     return;
                 }
                 super(url, eventSourceInitDict);

package/lib/types/client/settings-form.d.ts

@@ -6,7 +6,8 @@
  * each plugin's client bundle; mirrors the official ui-plugin-config
  * card-store pattern.
  */
-import type { SettingsScope, SnapshotStore } from '@deepseek-ai/dsh-client-runtime/client';
+import type { SettingsScope } from '@deepseek-ai/dsh-client-ui-settings/client';
+import type { SnapshotStore } from '@deepseek-ai/dsh-client-store';
 /** The write one field's staged text performs when the card is saved. */
 export type FieldWrite = {
     kind: 'set';
@@ -21,9 +22,11 @@ export interface FieldSpec {
     /**
      * Whether the Host treats this field as a secret and redacts its value from
      * the read-back (role('secret') in the section schema). Redacted secrets are
-     * never compared against the draft on save; the field lands when the scope
-     * reports the write succeeded (its secret-set marker under the bridge), so
-     * a successful secret save is not misreported as failed.
+     * never compared against the draft on save: the Host strips them from every
+     * wire view layer, so the settled snapshot carries nothing to read back. A
+     * staged secret set is judged by the mutation settling; the rest of its
+     * batch, when one exists, is still judged by read-back, and the atomic
+     * mutation lands every write or none.
      */
     secret?: boolean;
     /** Render a stored value as draft text; the empty string when the section carries none. */
@@ -49,8 +52,8 @@ export interface CardShell {
     available: boolean;
     /**
      * Whether the namespace is actually served to this client. False when the
-     * Host deployment does not expose it (e.g. the official apiproxy settings
-     * allowlist omits third-party namespaces): the card renders an explanation
+     * Host deployment does not expose it (e.g. the owning plugin's settings
+     * domain is not mounted): the card renders an explanation
      * instead of its form, so a missing namespace never looks like a missing
      * plugin.
      */
@@ -83,7 +86,7 @@ export interface CardActions {
     /** Drop every staged edit. */
     discard: () => void;
 }
-/** One durable write a batched settings scope performs. */
+/** One durable write inside the save's atomic scope mutation. */
 export interface BatchedWrite {
     /** Field this entry writes. */
     field: string;
@@ -92,28 +95,6 @@ export interface BatchedWrite {
     /** Value for op set (absent for unset). */
     value?: unknown;
 }
-/** Per-field outcome of one batched scope write. */
-export interface BatchedFieldResult {
-    /** Field this entry writes. */
-    field: string;
-    /** Whether the Host accepted this field's write (per the read-back view). */
-    landed: boolean;
-}
-/**
- * Result of a batched scope write. The bridge scope posts every planned write
- * in one /mutate so the Host validate hook judges baseURL+model together; a
- * batched refusal fails the whole save rather than per-field.
- */
-export interface BatchResult {
-    /** Whether the whole mutate was accepted. */
-    ok: boolean;
-    /** Per-field success, in the request order (always present when ok). */
-    fields: BatchedFieldResult[];
-    /** Host rejection code (mutate refused). */
-    code?: string;
-    /** Host rejection message (mutate refused). */
-    message?: string;
-}
 /** Constraints a numeric field's accepted drafts must satisfy, mirroring the host schema. */
 export interface NumberConstraints {
     /** The accepted value must be a whole number. */
@@ -128,8 +109,8 @@ export declare function textField(field: string): FieldSpec;
 /**
  * A free-text field the Host treats as a secret and redacts from the read-back
  * (role('secret') in the section schema). The card still edits it like text,
- * but a save never compares the redacted value back and relies on the scope
- * reporting the write landed.
+ * but a save never compares the redacted value back: the staged set is judged
+ * by the mutation settling (see {@link FieldSpec.secret}).
  */
 export declare function secretField(field: string): FieldSpec;
 /** A boolean field, edited through true/false draft text. */
@@ -171,19 +152,22 @@ export declare class CardForm<T> {
     /** The actions the card's slot registration injects. */
     actions(): CardActions;
     /**
-     * Write every staged edit, then re-seed from what the Host accepted.
+     * Write every staged edit in one atomic scope mutation, then re-seed from
+     * what the Host accepted.
      *
-     * When the scope carries the optional batch surface (the dsh-web
-     * bridge scope), every planned write rides one mutation so cross-field
-     * validate hooks (baseURL+model) judge the batch as a unit instead of
-     * deadlocking on per-field writes. Otherwise the per-field loop runs.
-     * A field lands only when the Host reports it held the staged value; a
-     * landed field's draft is dropped, a failed one stays staged for the user.
-     * @returns settlement after every write and the read-back.
+     * The whole batch rides one mutate, so cross-field validate hooks
+     * (baseURL+model) judge it as a unit: the Host either applies every write
+     * or refuses the batch. The 0.1.2 scope contract never rejects a refused
+     * mutation — the scope recovers with a fresh Host view and resolves — so
+     * resolution alone proves nothing: the outcome is judged by reading the
+     * settled snapshot back, one planned write at a time, and one missed write
+     * fails the whole save. A scope that still rejects on refusal (the dsh-web
+     * bridge scope) reports through the same failure path with its rejection
+     * message. A save that did not land keeps its drafts, so the user can
+     * correct them instead of retyping.
+     * @returns settlement after the mutation and the read-back.
      */
     save(): Promise<void>;
-    /** The scope's batch surface when it supports one; undefined conservatively otherwise. */
-    private batchedScope;
     /**
      * Every staged edit a save would write. An entry whose draft is not a value
      * its field accepts carries no write: the form is still dirty, and the save
@@ -192,8 +176,16 @@ export declare class CardForm<T> {
      * @returns the planned writes, in the order the fields were staged.
      */
     private plan;
-    private clear;
-    private store;
+    /**
+     * Read-back judgment for a planned set: the user layer must hold the
+     * intended value once the mutation has settled.
+     */
+    private landedSet;
+    /**
+     * Read-back judgment for a planned unset: the field must be gone from the
+     * user layer once the mutation has settled.
+     */
+    private landedUnset;
     private stage;
     private specOf;
     private snapshotOf;

package/lib/types/client/settings-form.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"settings-form.d.ts","sourceRoot":"","sources":["../../../src/client/settings-form.ts"],"names":[],"mappings":"AACA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAyB,aAAa,EAAE,MAAM,wCAAwC,CAAA;AAGjH,yEAAyE;AACzE,MAAM,MAAM,UAAU,GAClB;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,GAC/B;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,CAAA;AAErB,0EAA0E;AAC1E,MAAM,WAAW,SAAS;IACxB,+CAA+C;IAC/C,KAAK,EAAE,MAAM,CAAA;IACb;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,2FAA2F;IAC3F,MAAM,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM,CAAA;IAClC;;;OAGG;IACH,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,UAAU,GAAG,SAAS,CAAA;CAChD;AAED,wCAAwC;AACxC,MAAM,WAAW,UAAU;IACzB,sCAAsC;IACtC,IAAI,EAAE,MAAM,CAAA;IACZ,oEAAoE;IACpE,UAAU,EAAE,OAAO,CAAA;IACnB,gFAAgF;IAChF,OAAO,EAAE,OAAO,CAAA;CACjB;AAED,oDAAoD;AACpD,MAAM,WAAW,SAAS;IACxB,4EAA4E;IAC5E,SAAS,EAAE,OAAO,CAAA;IAClB;;;;;;OAMG;IACH,OAAO,EAAE,OAAO,CAAA;IAChB,gDAAgD;IAChD,QAAQ,EAAE,OAAO,CAAA;IACjB,4DAA4D;IAC5D,KAAK,EAAE,OAAO,CAAA;IACd,kEAAkE;IAClE,OAAO,EAAE,OAAO,CAAA;IAChB,2CAA2C;IAC3C,MAAM,EAAE,OAAO,CAAA;IACf,sFAAsF;IACtF,MAAM,EAAE,OAAO,CAAA;IACf;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,uDAAuD;AACvD,MAAM,WAAW,WAAW;IAC1B,sCAAsC;IACtC,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IAC3C,gFAAgF;IAChF,UAAU,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAA;IACnC,yEAAyE;IACzE,IAAI,EAAE,MAAM,IAAI,CAAA;IAChB,8BAA8B;IAC9B,OAAO,EAAE,MAAM,IAAI,CAAA;CACpB;AAoBD,2DAA2D;AAC3D,MAAM,WAAW,YAAY;IAC3B,+BAA+B;IAC/B,KAAK,EAAE,MAAM,CAAA;IACb,gDAAgD;IAChD,EAAE,EAAE,KAAK,GAAG,OAAO,CAAA;IACnB,2CAA2C;IAC3C,KAAK,CAAC,EAAE,OAAO,CAAA;CAChB;AAED,oDAAoD;AACpD,MAAM,WAAW,kBAAkB;IACjC,+BAA+B;IAC/B,KAAK,EAAE,MAAM,CAAA;IACb,6EAA6E;IAC7E,MAAM,EAAE,OAAO,CAAA;CAChB;AAED;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,6CAA6C;IAC7C,EAAE,EAAE,OAAO,CAAA;IACX,wEAAwE;IACxE,MAAM,EAAE,kBAAkB,EAAE,CAAA;IAC5B,4CAA4C;IAC5C,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,+CAA+C;IAC/C,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAQD,6FAA6F;AAC7F,MAAM,WAAW,iBAAiB;IAChC,iDAAiD;IACjD,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,gDAAgD;IAChD,GAAG,CAAC,EAAE,MAAM,CAAA;CACb;AAED,6JAA6J;AAC7J,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,GAAE,iBAAsB,GAAG,SAAS,CAezF;AAED,0DAA0D;AAC1D,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CASlD;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAEpD;AAED,6DAA6D;AAC7D,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAYrD;AAED,yGAAyG;AACzG,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAShF;AAED;;;;;;;GAOG;AACH,qBAAa,QAAQ,CAAC,CAAC;IAanB,OAAO,CAAC,QAAQ,CAAC,KAAK;IAZxB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAwB;IAC9C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgC;IACvD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAwB;IAClD,kFAAkF;IAClF,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAY;IACzC,OAAO,CAAC,QAAQ,CAAQ;IACxB,OAAO,CAAC,MAAM,CAAQ;IACtB,OAAO,CAAC,MAAM,CAAQ;IACtB,OAAO,CAAC,YAAY,CAAoB;IAExC,yEAAyE;gBAEtD,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC,EACxC,KAAK,EAAE,SAAS,EAAE;IAMpB;;;OAGG;IACH,OAAO,IAAI,IAAI;IAOf,wFAAwF;IACxF,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC;IAM3C,iFAAiF;IACjF,KAAK,IAAI,SAAS;IAelB,8EAA8E;IAC9E,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU;IAchC,wDAAwD;IACxD,OAAO,IAAI,WAAW;IAiBtB;;;;;;;;;;OAUG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAsC3B,0FAA0F;IAC1F,OAAO,CAAC,YAAY;IAKpB;;;;;;OAMG;IACH,OAAO,CAAC,IAAI;YAiBE,KAAK;YAKL,KAAK;IAUnB,OAAO,CAAC,KAAK;IAOb,OAAO,CAAC,MAAM;IAQd,OAAO,CAAC,UAAU;IAIlB,OAAO,CAAC,YAAY;IAIpB,OAAO,CAAC,SAAS;IAIjB,OAAO,CAAC,SAAS;IAIjB,OAAO,CAAC,MAAM;IAKd,OAAO,CAAC,OAAO;CAGhB"}
+{"version":3,"file":"settings-form.d.ts","sourceRoot":"","sources":["../../../src/client/settings-form.ts"],"names":[],"mappings":"AACA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAyB,MAAM,4CAA4C,CAAA;AACtG,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAA;AAGlE,yEAAyE;AACzE,MAAM,MAAM,UAAU,GAClB;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,GAC/B;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,CAAA;AAErB,0EAA0E;AAC1E,MAAM,WAAW,SAAS;IACxB,+CAA+C;IAC/C,KAAK,EAAE,MAAM,CAAA;IACb;;;;;;;;OAQG;IACH,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,2FAA2F;IAC3F,MAAM,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM,CAAA;IAClC;;;OAGG;IACH,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,UAAU,GAAG,SAAS,CAAA;CAChD;AAED,wCAAwC;AACxC,MAAM,WAAW,UAAU;IACzB,sCAAsC;IACtC,IAAI,EAAE,MAAM,CAAA;IACZ,oEAAoE;IACpE,UAAU,EAAE,OAAO,CAAA;IACnB,gFAAgF;IAChF,OAAO,EAAE,OAAO,CAAA;CACjB;AAED,oDAAoD;AACpD,MAAM,WAAW,SAAS;IACxB,4EAA4E;IAC5E,SAAS,EAAE,OAAO,CAAA;IAClB;;;;;;OAMG;IACH,OAAO,EAAE,OAAO,CAAA;IAChB,gDAAgD;IAChD,QAAQ,EAAE,OAAO,CAAA;IACjB,4DAA4D;IAC5D,KAAK,EAAE,OAAO,CAAA;IACd,kEAAkE;IAClE,OAAO,EAAE,OAAO,CAAA;IAChB,2CAA2C;IAC3C,MAAM,EAAE,OAAO,CAAA;IACf,sFAAsF;IACtF,MAAM,EAAE,OAAO,CAAA;IACf;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,uDAAuD;AACvD,MAAM,WAAW,WAAW;IAC1B,sCAAsC;IACtC,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IAC3C,gFAAgF;IAChF,UAAU,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAA;IACnC,yEAAyE;IACzE,IAAI,EAAE,MAAM,IAAI,CAAA;IAChB,8BAA8B;IAC9B,OAAO,EAAE,MAAM,IAAI,CAAA;CACpB;AAwBD,iEAAiE;AACjE,MAAM,WAAW,YAAY;IAC3B,+BAA+B;IAC/B,KAAK,EAAE,MAAM,CAAA;IACb,gDAAgD;IAChD,EAAE,EAAE,KAAK,GAAG,OAAO,CAAA;IACnB,2CAA2C;IAC3C,KAAK,CAAC,EAAE,OAAO,CAAA;CAChB;AAED,6FAA6F;AAC7F,MAAM,WAAW,iBAAiB;IAChC,iDAAiD;IACjD,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,gDAAgD;IAChD,GAAG,CAAC,EAAE,MAAM,CAAA;CACb;AAED,6JAA6J;AAC7J,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,GAAE,iBAAsB,GAAG,SAAS,CAezF;AAED,0DAA0D;AAC1D,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CASlD;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAEpD;AAED,6DAA6D;AAC7D,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAYrD;AAED,yGAAyG;AACzG,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAShF;AAED;;;;;;;GAOG;AACH,qBAAa,QAAQ,CAAC,CAAC;IAanB,OAAO,CAAC,QAAQ,CAAC,KAAK;IAZxB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAwB;IAC9C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgC;IACvD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAwB;IAClD,kFAAkF;IAClF,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAY;IACzC,OAAO,CAAC,QAAQ,CAAQ;IACxB,OAAO,CAAC,MAAM,CAAQ;IACtB,OAAO,CAAC,MAAM,CAAQ;IACtB,OAAO,CAAC,YAAY,CAAoB;IAExC,yEAAyE;gBAEtD,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC,EACxC,KAAK,EAAE,SAAS,EAAE;IAMpB;;;OAGG;IACH,OAAO,IAAI,IAAI;IAOf,wFAAwF;IACxF,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC;IAM3C,iFAAiF;IACjF,KAAK,IAAI,SAAS;IAelB,8EAA8E;IAC9E,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU;IAchC,wDAAwD;IACxD,OAAO,IAAI,WAAW;IAiBtB;;;;;;;;;;;;;;;OAeG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAyC3B;;;;;;OAMG;IACH,OAAO,CAAC,IAAI;IAiBZ;;;OAGG;IACH,OAAO,CAAC,SAAS;IAUjB;;;OAGG;IACH,OAAO,CAAC,WAAW;IAInB,OAAO,CAAC,KAAK;IAOb,OAAO,CAAC,MAAM;IAQd,OAAO,CAAC,UAAU;IAIlB,OAAO,CAAC,YAAY;IAIpB,OAAO,CAAC,SAAS;IAIjB,OAAO,CAAC,SAAS;IAIjB,OAAO,CAAC,MAAM;IAKd,OAAO,CAAC,OAAO;CAGhB"}

package/lib/types/client/settings-form.js

@@ -7,7 +7,7 @@
  * each plugin's client bundle; mirrors the official ui-plugin-config
  * card-store pattern.
  */
-import { createSnapshotStore } from '@deepseek-ai/dsh-client-runtime/client';
+import { createSnapshotStore } from '@deepseek-ai/dsh-client-store';
 /** A whole- or decimal-number field. An empty draft clears the field; any other draft that is not a finite number within the constraints blocks the save. */
 export function numberField(field, constraints = {}) {
     const { integer = false, min } = constraints;
@@ -43,8 +43,8 @@ export function textField(field) {
 /**
  * A free-text field the Host treats as a secret and redacts from the read-back
  * (role('secret') in the section schema). The card still edits it like text,
- * but a save never compares the redacted value back and relies on the scope
- * reporting the write landed.
+ * but a save never compares the redacted value back: the staged set is judged
+ * by the mutation settling (see {@link FieldSpec.secret}).
  */
 export function secretField(field) {
     return { ...textField(field), secret: true };
@@ -129,7 +129,7 @@ export class CardForm {
             exposed: snapshot.status === 'ready',
             writable: snapshot.writable,
             dirty: plan.length > 0,
-            invalid: plan.some(item => item.run === undefined),
+            invalid: plan.some(item => item.judge === undefined),
             saving: this.saving,
             failed: this.failed,
             ...this.failedReason === undefined ? {} : { failedReason: this.failedReason },
@@ -168,22 +168,26 @@ export class CardForm {
         };
     }
     /**
-     * Write every staged edit, then re-seed from what the Host accepted.
+     * Write every staged edit in one atomic scope mutation, then re-seed from
+     * what the Host accepted.
      *
-     * When the scope carries the optional batch surface (the dsh-web
-     * bridge scope), every planned write rides one mutation so cross-field
-     * validate hooks (baseURL+model) judge the batch as a unit instead of
-     * deadlocking on per-field writes. Otherwise the per-field loop runs.
-     * A field lands only when the Host reports it held the staged value; a
-     * landed field's draft is dropped, a failed one stays staged for the user.
-     * @returns settlement after every write and the read-back.
+     * The whole batch rides one mutate, so cross-field validate hooks
+     * (baseURL+model) judge it as a unit: the Host either applies every write
+     * or refuses the batch. The 0.1.2 scope contract never rejects a refused
+     * mutation — the scope recovers with a fresh Host view and resolves — so
+     * resolution alone proves nothing: the outcome is judged by reading the
+     * settled snapshot back, one planned write at a time, and one missed write
+     * fails the whole save. A scope that still rejects on refusal (the dsh-web
+     * bridge scope) reports through the same failure path with its rejection
+     * message. A save that did not land keeps its drafts, so the user can
+     * correct them instead of retyping.
+     * @returns settlement after the mutation and the read-back.
      */
     async save() {
         const plan = this.plan();
-        const valid = plan.filter(item => item.run !== undefined);
+        const valid = plan.filter((item) => item.judge !== undefined);
         if (plan.length === 0 || this.saving || valid.length !== plan.length)
             return;
-        const plannedWrites = valid.map(item => item.op);
         // Snapshot the staged entries this save writes, so an edit staged while it
         // is in flight (which replaces the same key) survives: only delete the key
         // when the entry is still the one this save started from.
@@ -194,39 +198,35 @@ export class CardForm {
         this.failed = false;
         this.failedReason = undefined;
         this.publish();
-        const landed = new Set();
-        const batch = this.batchedScope();
-        if (batch !== undefined) {
-            const result = await batch.mutate(plannedWrites);
-            if (result.ok) {
-                for (const field of result.fields) {
-                    if (field.landed)
-                        landed.add(field.field);
-                }
-            }
-            else {
-                this.failedReason = result.message;
-            }
+        // One atomic namespace mutation: the 0.1.2 scope contract takes ordered
+        // path operations, so the whole staged batch is validated, persisted, and
+        // recovered together — either every write lands or none does.
+        const ops = valid.map(item => item.op.op === 'set'
+            ? { op: 'set', path: [item.field], value: item.op.value }
+            : { op: 'unset', path: [item.field] });
+        let failedReason;
+        try {
+            await this.scope.mutate(ops);
         }
-        else {
-            for (const item of valid) {
-                if (await item.run())
-                    landed.add(item.field);
-            }
+        catch (error) {
+            failedReason = error instanceof Error ? error.message : String(error);
         }
+        // The 0.1.2 scope resolves even a refused mutation (it recovers with a
+        // fresh view instead of throwing), so resolution alone proves nothing:
+        // judge every planned write against the settled snapshot. The mutation is
+        // atomic, so one missed write fails the whole save and keeps the drafts.
+        const landed = failedReason === undefined && valid.every(item => item.judge());
         for (const [field, before] of pending) {
-            if (landed.has(field) && this.staged.get(field) === before)
+            if (landed && this.staged.get(field) === before)
                 this.staged.delete(field);
         }
         this.saving = false;
-        this.failed = landed.size !== pending.size;
+        this.failed = !landed;
+        // A read-back failure carries no server reason: the card surfaces its
+        // generic failure copy; a rejecting scope (the bridge) adds its message.
+        this.failedReason = failedReason;
         this.publish();
     }
-    /** The scope's batch surface when it supports one; undefined conservatively otherwise. */
-    batchedScope() {
-        const candidate = this.scope;
-        return typeof candidate?.mutate === 'function' ? candidate : undefined;
-    }
     /**
      * Every staged edit a save would write. An entry whose draft is not a value
      * its field accepts carries no write: the form is still dirty, and the save
@@ -240,35 +240,42 @@ export class CardForm {
             const spec = this.specOf(field);
             if (staged.clear) {
                 if (this.stored(field))
-                    plan.push({ field, op: { field, op: 'unset' }, run: () => this.clear(field) });
+                    plan.push({ field, op: { field, op: 'unset' }, judge: () => this.landedUnset(field) });
                 continue;
             }
             if (staged.text === spec.format(this.sectionValue(field)))
                 continue;
             const write = spec.parse(staged.text);
             if (write === undefined)
-                plan.push({ field, op: { field, op: 'unset' }, run: undefined });
+                plan.push({ field, op: { field, op: 'unset' }, judge: undefined });
             else if (write.kind === 'clear')
-                plan.push({ field, op: { field, op: 'unset' }, run: () => this.clear(field) });
+                plan.push({ field, op: { field, op: 'unset' }, judge: () => this.landedUnset(field) });
             else
-                plan.push({ field, op: { field, op: 'set', value: write.value }, run: () => this.store(field, write.value) });
+                plan.push({ field, op: { field, op: 'set', value: write.value }, judge: () => this.landedSet(field, write.value) });
         }
         return plan;
     }
-    async clear(field) {
-        await this.scope.unset(field);
-        return !this.stored(field);
-    }
-    async store(field, value) {
-        await this.scope.set(field, value);
-        // A redacted secret never appears in the user layer read-back; judging it
-        // by value would misreport a successful secret save as failed. The bridge
-        // reports secret writes through its secret-set markers (batch path); on
-        // the per-field path the scope resolved, so the write is landed.
+    /**
+     * Read-back judgment for a planned set: the user layer must hold the
+     * intended value once the mutation has settled.
+     */
+    landedSet(field, value) {
+        // A redacted secret never appears in any wire view layer: the Host strips
+        // role('secret') fields and reports them through a sidecar the scope
+        // snapshot does not expose, so there is nothing to compare the draft
+        // against. Settling is the only signal the form has; the rest of the
+        // batch, when one exists, still carries the atomic verdict by read-back.
         if (this.specOf(field).secret)
             return true;
         return this.userLayer()?.[field] === value;
     }
+    /**
+     * Read-back judgment for a planned unset: the field must be gone from the
+     * user layer once the mutation has settled.
+     */
+    landedUnset(field) {
+        return !this.stored(field);
+    }
     stage(field, edit) {
         this.staged.set(field, edit);
         this.failed = false;

package/lib/types/firewall.d.ts

@@ -0,0 +1,75 @@
+/**
+ * Host firewall management for the LAN bind toggle: while LAN access is on,
+ * keep one inbound allow rule for the bound port; when it turns off, remove
+ * the rule. Windows manages the Windows Defender Firewall rule via netsh;
+ * Linux uses the first available manager among firewalld / ufw / iptables.
+ * On every other platform (macOS included) the plugin reports the firewall
+ * as unmanaged: the port usually needs no rule there, and managing pf or the
+ * application firewall is out of scope for a distributable plugin.
+ *
+ * Ported from the dsh-LAN reference implementation (MIT), adapted to this
+ * package's structure and test seams.
+ */
+/** Rule name shared by every backend so re-runs recreate the same rule. */
+export declare const FIREWALL_RULE_NAME = "remote-web-ui (auto)";
+/** One command execution result (test seam replaces the runner). */
+export interface ToolResult {
+    ok: boolean;
+    out: string;
+    err: string;
+    /** true when the binary could not be spawned at all (ENOENT et al). */
+    missing?: boolean;
+}
+/** The command runner seam: spawnSync in production, a stub in tests. */
+export type CommandRunner = (cmd: string, args: readonly string[]) => ToolResult;
+/** Production runner: spawn without a shell, capture text, 20s timeout. */
+export declare const spawnRunner: CommandRunner;
+/** A firewall backend manages one allow rule for a TCP port. */
+export interface FirewallBackend {
+    /** Short label surfaced in the settings card (netsh, firewalld, ...). */
+    readonly label: string;
+    ruleExists(port: number): boolean;
+    addRule(port: number): boolean;
+    removeRule(port: number): boolean;
+}
+/**
+ * Detect the platform firewall manager. Returns undefined when the platform
+ * has no supported manager (macOS, unknown Linux without tools): the port
+ * then usually needs no rule and the UI reports "unmanaged".
+ */
+export declare function detectFirewallBackend(platform: NodeJS.Platform, run?: CommandRunner): FirewallBackend | undefined;
+/** Cached detection for the running platform (per process). */
+export declare function firewallBackend(): FirewallBackend | undefined;
+/** Firewall state reported to the settings card. */
+export interface FirewallSummary {
+    /** true when the rule state matches the LAN toggle (or nothing to manage). */
+    ok: boolean;
+    /** false when no supported firewall manager exists on this platform. */
+    managed: boolean;
+    /** Backend label or an explanation for unmanaged platforms. */
+    note?: string;
+}
+/**
+ * Delete-and-add: recreating the rule is idempotent and locale-proof (netsh
+ * output is localized, so parsing the live rule's port is fragile; the Linux
+ * backends follow the same recreate pattern).
+ */
+export declare function ensureFirewallRule(port: number): boolean;
+export declare function removeFirewallRule(port: number): boolean;
+/**
+ * Human-readable firewall state for the status endpoint. A missing backend
+ * means the platform has nothing to manage; detection stays at the call site
+ * so an explicit undefined cannot silently re-probe the real OS mid-test.
+ */
+export declare function computeFirewallSummary(port: number, lanEnabled: boolean, backend: FirewallBackend | undefined): FirewallSummary;
+/** How long a firewallSummary answer is reused before the backend is probed again. */
+export declare const FIREWALL_SUMMARY_TTL_MS = 30000;
+/** Forget the cached summary (rule mutations call this). */
+export declare function invalidateFirewallSummary(): void;
+/**
+ * The settings card polls this every ten seconds; the probes are blocking
+ * spawnSync subprocesses on managed platforms, so short-TTL memoization
+ * keeps one poll from freezing the host event loop per request.
+ */
+export declare function firewallSummary(port: number, lanEnabled: boolean): FirewallSummary;
+//# sourceMappingURL=firewall.d.ts.map