@riceawa/dsh-lan-gateway 0.3.0

package/lib/index.js

@@ -0,0 +1,1310 @@
+import { X509Certificate, createHmac, createSign, generateKeyPairSync, randomBytes, scryptSync, timingSafeEqual } from "node:crypto";
+import z from "@deepseek-ai/schemastery";
+import { settingsNamespace } from "@deepseek-ai/dsh-settings";
+import http from "node:http";
+import https from "node:https";
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { homedir } from "node:os";
+import { defineTool } from "@deepseek-ai/dsh-tools";
+/** Default LAN CIDRs: RFC1918 + link-local, IPv4. */
+const DEFAULT_LAN_CIDR_STRINGS = [...[
+	"10.0.0.0/8",
+	"172.16.0.0/12",
+	"192.168.0.0/16",
+	"169.254.0.0/16"
+]];
+/** Parse a dotted-quad IPv4 string to its 32-bit integer, or undefined. */
+function parseIpv4(text) {
+	const parts = text.split(".");
+	if (parts.length !== 4) return void 0;
+	let out = 0;
+	for (const part of parts) {
+		if (!/^\d{1,3}$/.test(part)) return void 0;
+		const byte = Number(part);
+		if (byte > 255) return void 0;
+		out = out << 8 | byte;
+	}
+	return out >>> 0;
+}
+/** Parse `a.b.c.d/len` into a {@link Cidr}, or undefined on malformed input. */
+function parseCidr(text) {
+	const slash = text.indexOf("/");
+	const addrText = slash === -1 ? text : text.slice(0, slash);
+	const prefixText = slash === -1 ? "32" : text.slice(slash + 1);
+	const addr = parseIpv4(addrText);
+	if (addr === void 0) return void 0;
+	if (!/^\d{1,2}$/.test(prefixText)) return void 0;
+	const prefix = Number(prefixText);
+	if (prefix < 0 || prefix > 32) return void 0;
+	return {
+		addr,
+		prefix
+	};
+}
+/** Whether a 32-bit IPv4 address falls inside one CIDR range. */
+function inCidr(ip, cidr) {
+	if (cidr.prefix === 0) return true;
+	const mask = cidr.prefix === 32 ? 4294967295 : 4294967295 << 32 - cidr.prefix >>> 0;
+	return (ip & mask) === (cidr.addr & mask);
+}
+/** Normalize a raw socket address to a bare IPv4/6 string we classify on. */
+function normalizeAddress(raw) {
+	const value = raw.trim();
+	const mapped = /^::ffff:(\d+\.\d+\.\d+\.\d+)$/.exec(value);
+	if (mapped !== null) return mapped[1];
+	return value;
+}
+/**
+* Classify a source address string into one of the three trust tiers.
+* @param remoteAddress - the raw value of `req.socket.remoteAddress`.
+* @param lanCidrs - CIDR strings treated as trusted LAN space (IPv4).
+* @returns the classification. IPv4-mapped IPv6 addresses are unwrapped.
+*/
+function classifySource(remoteAddress, lanCidrs = DEFAULT_LAN_CIDR_STRINGS) {
+	const address = normalizeAddress(remoteAddress ?? "");
+	if (address === "") return "internet";
+	const ipv4 = parseIpv4(address);
+	if (ipv4 !== void 0) {
+		if (ipv4 >>> 24 === 127) return "loopback";
+		for (const cidrText of lanCidrs) {
+			const cidr = parseCidr(cidrText);
+			if (cidr !== void 0 && inCidr(ipv4, cidr)) return "lan";
+		}
+		return "internet";
+	}
+	if (address === "::1") return "loopback";
+	if (address.toLowerCase().startsWith("fe80:")) return "lan";
+	return "internet";
+}
+/** Encode a byte buffer as URL-safe base64 without padding. */
+function base64url(input) {
+	return input.toString("base64url");
+}
+/**
+* Issue a signed session cookie value.
+* @param secret - the HMAC signing secret (base64 string).
+* @param expiresMs - epoch millis at which the session expires.
+* @returns a `payload.signature` string suitable for the cookie value.
+*/
+function signCookie(secret, expiresMs) {
+	const payload = base64url(Buffer.from(JSON.stringify({ exp: expiresMs })));
+	return `${payload}.${createHmac("sha256", secret).update(payload).digest("base64url")}`;
+}
+/** Whether a cookie value is a valid, unexpired session signed with `secret`. */
+function verifyCookie(secret, value, now) {
+	if (value === void 0) return false;
+	const dot = value.indexOf(".");
+	if (dot === -1) return false;
+	const payload = value.slice(0, dot);
+	const sig = value.slice(dot + 1);
+	const expected = createHmac("sha256", secret).update(payload).digest();
+	let actual;
+	try {
+		actual = Buffer.from(sig, "base64url");
+	} catch {
+		return false;
+	}
+	if (expected.length !== actual.length) return false;
+	if (!timingSafeEqual(expected, actual)) return false;
+	try {
+		const decoded = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+		return typeof decoded.exp === "number" && decoded.exp > now;
+	} catch {
+		return false;
+	}
+}
+/** A token bucket limiter keyed by source address. */
+var RateLimiter = class {
+	maxTokens;
+	windowMs;
+	buckets = /* @__PURE__ */ new Map();
+	constructor(maxTokens, windowMs) {
+		this.maxTokens = maxTokens;
+		this.windowMs = windowMs;
+	}
+	/**
+	* Attempt to consume one token for `key`.
+	* @returns true when the attempt is allowed, false when the source is
+	* temporarily rate-limited.
+	*/
+	allow(key) {
+		const now = Date.now();
+		const bucket = this.buckets.get(key);
+		if (bucket === void 0 || bucket.resetAt <= now) {
+			this.buckets.set(key, {
+				tokens: this.maxTokens - 1,
+				resetAt: now + this.windowMs
+			});
+			return true;
+		}
+		if (bucket.tokens > 0) {
+			bucket.tokens -= 1;
+			return true;
+		}
+		return false;
+	}
+	/** Drop expired buckets to bound memory. */
+	prune(now = Date.now()) {
+		for (const [key, bucket] of this.buckets) if (bucket.resetAt <= now) this.buckets.delete(key);
+	}
+};
+//#endregion
+//#region src/login.ts
+/** Path the gateway owns and never forwards. */
+const LOGIN_PATH = "/__login";
+/** Render the self-contained login page. */
+function renderLoginPage(opts = {}) {
+	const errorHtml = opts.limited ? "<p class=\"error\">Too many attempts — wait a minute and try again.</p>" : opts.error ? `<p class="error">${escapeHtml(opts.error)}</p>` : "";
+	return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>DeepSeek Harness — Remote Access</title>
+<style>
+  :root { color-scheme: dark; }
+  * { box-sizing: border-box; }
+  body {
+    margin: 0; min-height: 100vh; display: grid; place-items: center;
+    background: #0f1115; color: #e6e9ef; font: 14px/1.5 system-ui, -apple-system, sans-serif;
+  }
+  .card {
+    width: min(360px, 90vw); padding: 32px 28px; border: 1px solid #262b36; border-radius: 12px;
+    background: #161a21; box-shadow: 0 8px 30px rgba(0,0,0,.4);
+  }
+  h1 { font-size: 17px; margin: 0 0 4px; }
+  p.sub { color: #8b93a3; margin: 0 0 20px; font-size: 13px; }
+  label { display: block; font-size: 12px; color: #aab2c1; margin-bottom: 6px; }
+  input[type=password] {
+    width: 100%; padding: 10px 12px; border: 1px solid #2d3442; border-radius: 8px;
+    background: #0f1115; color: #e6e9ef; font-size: 14px;
+  }
+  button {
+    width: 100%; margin-top: 16px; padding: 10px; border: 0; border-radius: 8px;
+    background: #4f6ef7; color: #fff; font-size: 14px; font-weight: 600; cursor: pointer;
+  }
+  button:hover { background: #5c7afa; }
+  p.error { color: #ff7b72; font-size: 13px; margin: 12px 0 0; }
+</style>
+</head>
+<body>
+  <form class="card" method="post" action="${LOGIN_PATH}">
+    <h1>DeepSeek Harness</h1>
+    <p class="sub">This instance requires a password from your network location.</p>
+    <label for="password">Password</label>
+    <input type="password" id="password" name="password" autofocus autocomplete="current-password" required>
+    ${errorHtml}
+    <button type="submit">Sign in</button>
+  </form>
+</body>
+</html>`;
+}
+/** Minimal HTML-escape for the error string interpolated into the page. */
+function escapeHtml(text) {
+	return text.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll("\"", "&quot;").replaceAll("'", "&#39;");
+}
+/** Serve the GET login page. */
+function serveLoginGet(res, extraHeaders = {}) {
+	res.writeHead(200, {
+		"content-type": "text/html; charset=utf-8",
+		"cache-control": "no-store",
+		...extraHeaders
+	});
+	res.end(renderLoginPage());
+}
+/** Read a request body up to a byte ceiling, rejecting anything larger. */
+function readBody(req, maxBytes, res) {
+	return new Promise((resolve) => {
+		let size = 0;
+		const chunks = [];
+		req.on("data", (chunk) => {
+			size += chunk.length;
+			if (size > maxBytes) {
+				res.writeHead(413);
+				res.end();
+				resolve(void 0);
+				req.destroy();
+				return;
+			}
+			chunks.push(chunk);
+		});
+		req.on("end", () => {
+			resolve(Buffer.concat(chunks).toString("utf8"));
+		});
+		req.on("error", () => {
+			res.writeHead(400);
+			res.end();
+			resolve(void 0);
+		});
+	});
+}
+//#endregion
+//#region src/state.ts
+/**
+* Persistent runtime state for the LAN gateway: the cookie-signing secret and
+* the scrypt password hash. Lives in `~/.dsh/lan-gateway/state.json` (0600),
+* NOT in the schemastery Config — secrets must never surface in
+* `--dump-config` output. Writes are atomic (temp file + rename).
+*
+* @module @riceawa/dsh-lan-gateway/state
+*/
+/** The state directory: `~/.dsh/lan-gateway`. */
+function stateDir(home = homedir()) {
+	return join(home, ".dsh", "lan-gateway");
+}
+const STATE_FILENAME = "state.json";
+/** Whether a password is present and passes scrypt verification. */
+function verifyPassword(state, password) {
+	if (state.password === void 0) return false;
+	const { hash, salt } = state.password;
+	try {
+		const expected = Buffer.from(hash, "hex");
+		const actual = scryptSync(password, Buffer.from(salt, "hex"), expected.length);
+		return expected.length === actual.length && timingSafeEqual(expected, actual);
+	} catch {
+		return false;
+	}
+}
+/** Set (or clear) the password, re-salted on every write. */
+function setPassword(state, password) {
+	if (password === void 0) return { cookieSecret: state.cookieSecret };
+	const salt = randomBytes(16);
+	const hash = scryptSync(password, salt, 64);
+	return {
+		...state,
+		password: {
+			hash: hash.toString("hex"),
+			salt: salt.toString("hex")
+		}
+	};
+}
+function defaultState() {
+	return { cookieSecret: randomBytes(32).toString("base64") };
+}
+/** Load state; on first run (or a corrupt file) generate a fresh secret. */
+function loadState(home = homedir()) {
+	const dir = stateDir(home);
+	try {
+		const raw = readFileSync(join(dir, STATE_FILENAME), "utf8");
+		const parsed = JSON.parse(raw);
+		if (typeof parsed?.cookieSecret === "string" && parsed.cookieSecret.length >= 16) return parsed;
+		return defaultState();
+	} catch {
+		return defaultState();
+	}
+}
+/** Persist state atomically. */
+function saveState(state, home = homedir()) {
+	const dir = stateDir(home);
+	mkdirSync(dir, { recursive: true });
+	const target = join(dir, STATE_FILENAME);
+	const tmp = join(dir, `.state.${process.pid}.tmp`);
+	writeFileSync(tmp, JSON.stringify(state, null, 2), { mode: 384 });
+	renameSync(tmp, target);
+	try {
+		chmodSync(target, 384);
+	} catch {}
+}
+//#endregion
+//#region src/gateway.ts
+/**
+* The reverse-proxy gateway: a `node:http` server bound to `0.0.0.0` that
+* forwards every request to the loopback dsh web server, rewriting Host and
+* Origin so the dsh `/api` trust fence (which only trusts loopback) passes.
+*
+* Security model:
+* - Source is classified from `socket.remoteAddress` only (never
+*   `X-Forwarded-For`). LAN/loopback sources are proxied without a password;
+*   anything else must present a valid signed cookie or complete the login.
+* - Because this gateway rewrites Origin to loopback, dsh's own CSRF fence is
+*   blinded — so the gateway runs its own origin check on `/api*` requests
+*   BEFORE rewriting (reject `sec-fetch-site: cross-site` and any Origin that
+*   does not match the gateway authority the browser actually used).
+*
+* @module @riceawa/dsh-lan-gateway/gateway
+*/
+const DEFAULT_BODY_LIMIT_BYTES = 65536;
+const LOGIN_ATTEMPTS_LIMIT = 5;
+const LOGIN_ATTEMPTS_WINDOW_MS = 6e4;
+/**
+* The running gateway: owns the HTTP server and the auth state needed per
+* request. Created by the plugin on enable; torn down by the plugin on
+* disable or tree disposal.
+*/
+var LanGateway = class {
+	config;
+	server;
+	loginLimiter = new RateLimiter(LOGIN_ATTEMPTS_LIMIT, LOGIN_ATTEMPTS_WINDOW_MS);
+	state;
+	disposed = false;
+	constructor(config, state) {
+		this.config = config;
+		this.state = state;
+		const handle = (req, res) => {
+			this.handleHttp(req, res);
+		};
+		this.server = this.config.tls !== void 0 ? https.createServer({
+			cert: this.config.tls.cert,
+			key: this.config.tls.key
+		}, handle) : http.createServer(handle);
+		this.server.on("upgrade", (req, socket, head) => {
+			this.handleUpgrade(req, socket, head);
+		});
+	}
+	/** Replace the in-memory state (e.g. after a password change). */
+	setState(state) {
+		this.state = state;
+	}
+	/** Start listening; rejects if the port is already in use. */
+	async listen() {
+		return new Promise((resolve, reject) => {
+			const onError = (err) => {
+				this.server.off("listening", onListening);
+				reject(err);
+			};
+			const onListening = () => {
+				this.server.off("error", onError);
+				resolve();
+			};
+			this.server.once("error", onError);
+			this.server.once("listening", onListening);
+			this.server.listen(this.config.gatewayPort, "0.0.0.0");
+		});
+	}
+	/** Close the server and stop accepting connections. */
+	async close() {
+		if (this.disposed) return;
+		this.disposed = true;
+		return new Promise((resolve) => {
+			this.server.close(() => resolve());
+			this.server.closeAllConnections();
+		});
+	}
+	sourceClass(req) {
+		return classifySource(req.socket.remoteAddress, this.config.lanCidrs);
+	}
+	/** Parse the session cookie out of a Cookie header. */
+	sessionCookie(req) {
+		const header = req.headers.cookie;
+		if (typeof header !== "string") return void 0;
+		for (const part of header.split(";")) {
+			const trimmed = part.trim();
+			if (trimmed.startsWith(`${this.config.cookieName}=`)) return trimmed.slice(this.config.cookieName.length + 1);
+		}
+	}
+	/** Whether a request carries a valid session for its source. */
+	authorized(req) {
+		const cookie = this.sessionCookie(req);
+		return cookie !== void 0 && verifyCookie(this.state.cookieSecret, cookie, Date.now());
+	}
+	serveUnauthorized(res, limited) {
+		res.writeHead(302, {
+			location: `${LOGIN_PATH}${limited ? "?limited=1" : ""}`,
+			...this.securityHeaders()
+		});
+		res.end();
+	}
+	serveLoginError(res, message) {
+		const opts = { error: message };
+		res.writeHead(401, {
+			"content-type": "text/html; charset=utf-8",
+			"cache-control": "no-store",
+			...this.securityHeaders()
+		});
+		res.end(renderLoginPage(opts));
+	}
+	/** HSTS when the listener is HTTPS (never sent on plain HTTP). */
+	securityHeaders() {
+		return this.config.tls === void 0 ? {} : { "strict-transport-security": "max-age=15552000" };
+	}
+	/** Handle one HTTP request: auth gate → CSRF fence → forward. */
+	async handleHttp(req, res) {
+		const source = this.sourceClass(req);
+		const url = req.url ?? "/";
+		const pathname = url.split("?")[0] ?? "/";
+		if (pathname === "/__login") {
+			this.handleLogin(req, res);
+			return;
+		}
+		if (source === "internet" && this.config.authRequired) {
+			if (!this.authorized(req)) {
+				this.serveUnauthorized(res, false);
+				return;
+			}
+		}
+		if (pathname === "/api" || pathname.startsWith("/api/")) {
+			if (!this.passesCsrfFence(req)) {
+				res.writeHead(403, this.securityHeaders());
+				res.end("forbidden");
+				return;
+			}
+		}
+		this.forward(req, res, url);
+	}
+	/** Reject cross-site API traffic: the gateway's own origin check. */
+	passesCsrfFence(req) {
+		const headers = req.headers;
+		if (headers["sec-fetch-site"] === "cross-site") return false;
+		const origin = headers.origin;
+		if (origin === void 0) return true;
+		try {
+			const originHost = new URL(origin).host;
+			const requestHost = typeof headers.host === "string" ? headers.host : "";
+			return originHost === requestHost || originHost === stripDefaultPort(requestHost);
+		} catch {
+			return false;
+		}
+	}
+	/** Handle the login GET form / POST submission. */
+	handleLogin(req, res) {
+		req.url?.includes("limited=1");
+		if (req.method === "GET" || req.method === "HEAD") {
+			serveLoginGet(res, this.securityHeaders());
+			return;
+		}
+		if (req.method !== "POST") {
+			res.writeHead(405, { allow: "GET, POST" });
+			res.end();
+			return;
+		}
+		const key = req.socket.remoteAddress ?? "unknown";
+		if (!this.loginLimiter.allow(key)) {
+			this.serveLoginError(res, "Too many attempts — please wait a minute.");
+			return;
+		}
+		readBody(req, DEFAULT_BODY_LIMIT_BYTES, res).then((body) => {
+			if (body === void 0) return;
+			let password;
+			try {
+				password = new URLSearchParams(body).get("password") ?? void 0;
+			} catch {
+				password = void 0;
+			}
+			if (password === void 0 || !verifyPassword(this.state, password)) {
+				this.serveLoginError(res, "Incorrect password.");
+				return;
+			}
+			const expiresMs = Date.now() + this.config.cookieMaxAgeDays * 864e5;
+			const cookie = signCookie(this.state.cookieSecret, expiresMs);
+			const secure = this.config.tls !== void 0 ? "; Secure" : "";
+			res.writeHead(302, {
+				location: "/",
+				...this.securityHeaders(),
+				"set-cookie": [`${this.config.cookieName}=${cookie}; HttpOnly; SameSite=Lax; Path=/; Max-Age=${this.config.cookieMaxAgeDays * 86400}${secure}`]
+			});
+			res.end();
+		});
+	}
+	/** Forward an HTTP request to dsh, rewriting Host/Origin to loopback. */
+	forward(req, res, url) {
+		const headers = { ...req.headers };
+		headers.host = `127.0.0.1:${this.config.dshPort}`;
+		if (typeof headers.origin === "string") headers.origin = `http://127.0.0.1:${this.config.dshPort}`;
+		delete headers["proxy-connection"];
+		delete headers.connection;
+		const proxyReq = http.request({
+			host: "127.0.0.1",
+			port: this.config.dshPort,
+			method: req.method,
+			path: url,
+			headers
+		}, (proxyRes) => {
+			res.writeHead(proxyRes.statusCode ?? 502, proxyRes.headers);
+			proxyRes.pipe(res);
+		});
+		proxyReq.on("error", () => {
+			if (!res.headersSent) res.writeHead(502);
+			res.destroy();
+		});
+		req.pipe(proxyReq);
+	}
+	/** Forward a WebSocket upgrade, splicing the raw duplex through to dsh. */
+	handleUpgrade(req, socket, head) {
+		if (this.sourceClass(req) === "internet" && this.config.authRequired && !this.authorized(req)) {
+			socket.write("HTTP/1.1 401 Unauthorized\r\nConnection: close\r\n\r\n");
+			socket.destroy();
+			return;
+		}
+		const headers = { ...req.headers };
+		headers.host = `127.0.0.1:${this.config.dshPort}`;
+		if (typeof headers.origin === "string") headers.origin = `http://127.0.0.1:${this.config.dshPort}`;
+		delete headers["proxy-connection"];
+		const proxyReq = http.request({
+			host: "127.0.0.1",
+			port: this.config.dshPort,
+			method: "GET",
+			path: req.url ?? "/",
+			headers
+		});
+		proxyReq.on("upgrade", (proxyRes, proxySocket, proxyHead) => {
+			const statusLine = `HTTP/1.1 ${proxyRes.statusCode ?? 101} ${proxyRes.statusMessage ?? "Switching Protocols"}\r\n`;
+			const headerLines = Object.entries(proxyRes.headers).map(([key, value]) => `${key}: ${Array.isArray(value) ? value.join(", ") : value}\r\n`).join("");
+			socket.write(`${statusLine}${headerLines}\r\n`);
+			if (head !== void 0 && head.length > 0) proxySocket.write(head);
+			proxySocket.pipe(socket).pipe(proxySocket);
+			if (proxyHead !== void 0 && proxyHead.length > 0) proxySocket.unshift(proxyHead);
+			socket.on("error", () => proxySocket.destroy());
+			proxySocket.on("error", () => socket.destroy());
+		});
+		proxyReq.on("error", () => socket.destroy());
+		proxyReq.end();
+	}
+};
+/** Strip an explicit default port from a Host authority, if present. */
+function stripDefaultPort(host) {
+	const parsed = /^(.+?)(?::(\d+))?$/.exec(host);
+	if (parsed?.[2] === "80" || parsed?.[2] === "443") return parsed[1];
+	return host;
+}
+//#endregion
+//#region src/x509.ts
+/**
+* Minimal X.509 v3 self-signed certificate generator built on `node:crypto`
+* only — no openssl binary, no npm dependencies.
+*
+* The certificate is a standard RSA-2048 / sha256WithRSAEncryption leaf cert
+* (CA:FALSE) carrying the requested DNS/IP SANs, so browsers accept it for
+* `https://<host>:<port>` after the user approves the self-signed warning.
+*
+* @module @riceawa/dsh-lan-gateway/x509
+*/
+const TAG_SEQUENCE = 48;
+const TAG_SET = 49;
+const TAG_INTEGER = 2;
+const TAG_OID = 6;
+const TAG_BIT_STRING = 3;
+const TAG_OCTET_STRING = 4;
+const TAG_UTF8_STRING = 12;
+const TAG_UTCTIME = 23;
+/** Context-specific primitive [2] (dNSName / iPAddress inside SAN). */
+const TAG_CONTEXT_2 = 130;
+/** Context-specific primitive [7] (iPAddress). */
+const TAG_CONTEXT_7 = 135;
+/** DER length octets (short form up to 127, long form above). */
+function derLength(length) {
+	if (length < 128) return Buffer.from([length]);
+	const bytes = [];
+	let n = length;
+	while (n > 0) {
+		bytes.unshift(n & 255);
+		n >>>= 8;
+	}
+	return Buffer.from([128 | bytes.length, ...bytes]);
+}
+/** Tag a body with an identifier octet. */
+function derTag(tag, body) {
+	return Buffer.concat([
+		Buffer.from([tag]),
+		derLength(body.length),
+		body
+	]);
+}
+/** SEQUENCE OF parts. */
+function derSeq(...parts) {
+	return derTag(TAG_SEQUENCE, Buffer.concat(parts));
+}
+/** SET OF parts (one RDN). */
+function derSet(...parts) {
+	return derTag(TAG_SET, Buffer.concat(parts));
+}
+/** INTEGER from raw big-endian bytes (strips leading zeros, keeps sign bit clean). */
+function derInt(value) {
+	let start = 0;
+	while (start < value.length - 1 && value[start] === 0) start += 1;
+	let body = value.subarray(start);
+	if ((body[0] & 128) !== 0) body = Buffer.concat([Buffer.from([0]), body]);
+	return derTag(TAG_INTEGER, body);
+}
+/** OBJECT IDENTIFIER from a dotted string like `1.2.840.113549.1.1.11`. */
+function derOid(oid) {
+	const parts = oid.split(".").map(Number);
+	if (parts.length < 2 || parts.some((p) => !Number.isInteger(p) || p < 0)) throw new Error(`invalid OID: ${oid}`);
+	const body = [parts[0] * 40 + parts[1]];
+	for (const part of parts.slice(2)) {
+		let n = part;
+		const chunk = [n & 127];
+		n >>>= 7;
+		while (n > 0) {
+			chunk.unshift(n & 127 | 128);
+			n >>>= 7;
+		}
+		body.push(...chunk);
+	}
+	return derTag(TAG_OID, Buffer.from(body));
+}
+/** BIT STRING over raw content (unused-bits octet prepended). */
+function derBitString(content, unusedBits = 0) {
+	return derTag(TAG_BIT_STRING, Buffer.concat([Buffer.from([unusedBits]), content]));
+}
+/** OCTET STRING. */
+function derOctetString(content) {
+	return derTag(TAG_OCTET_STRING, content);
+}
+/** UTF8String (legal DirectoryString for the CN). */
+function derUtf8String(text) {
+	return derTag(TAG_UTF8_STRING, Buffer.from(text, "utf8"));
+}
+/** UTCTime: `YYMMDDHHMMSSZ` (valid until 2050). */
+function derUtcTime(date) {
+	const pad = (n) => String(n).padStart(2, "0");
+	const text = `${pad(date.getUTCFullYear() % 100)}${pad(date.getUTCMonth() + 1)}${pad(date.getUTCDate())}${pad(date.getUTCHours())}${pad(date.getUTCMinutes())}${pad(date.getUTCSeconds())}Z`;
+	return derTag(TAG_UTCTIME, Buffer.from(text, "ascii"));
+}
+/** BOOLEAN. */
+function derBoolean(value) {
+	return derTag(1, Buffer.from([value ? 255 : 0]));
+}
+/** SHA-256 with RSA encryption (no parameters). */
+function sha256WithRsa() {
+	return derSeq(derOid("1.2.840.113549.1.1.11"));
+}
+/**
+* Parse an IPv6 literal into its 16 raw bytes. Supports `::` compression,
+* hex groups, and an embedded dotted-quad IPv4 tail.
+*/
+function parseIpv6Bytes(text) {
+	let address = text.trim();
+	if (address.startsWith("[") && address.endsWith("]")) address = address.slice(1, -1);
+	if (address.includes("/")) address = address.split("/")[0];
+	const embeddedIpv4 = /^(.*:)(\d+\.\d+\.\d+\.\d+)$/.exec(address);
+	let head = address;
+	let tail = [];
+	if (embeddedIpv4 !== null) {
+		head = embeddedIpv4[1].replace(/:$/, "");
+		tail = embeddedIpv4[2].split(".").map(Number);
+		if (tail.some((b) => !Number.isInteger(b) || b < 0 || b > 255)) return void 0;
+	}
+	const doubleColon = head.indexOf("::");
+	if (doubleColon !== -1) {
+		if (head.indexOf("::", doubleColon + 1) !== -1) return void 0;
+		const left = head.slice(0, doubleColon);
+		const right = head.slice(doubleColon + 2);
+		const leftWords = parseWords(left);
+		const rightWords = parseWords(right);
+		if (leftWords === void 0 || rightWords === void 0) return void 0;
+		if (leftWords.length + rightWords.length + tail.length / 2 > 8) return void 0;
+		const gap = 8 - leftWords.length - rightWords.length - tail.length / 2;
+		return wordsToBytes([
+			...leftWords,
+			...Array(gap).fill(0),
+			...rightWords
+		], tail);
+	}
+	const words = parseWords(head);
+	if (words === void 0) return void 0;
+	if (words.length + tail.length / 2 !== 8) return void 0;
+	return wordsToBytes(words, tail);
+}
+function parseWords(text) {
+	if (text === "") return [];
+	const parts = text.split(":");
+	if (parts.some((p) => p === "")) return void 0;
+	const words = [];
+	for (const part of parts) {
+		if (!/^[0-9a-fA-F]{1,4}$/.test(part)) return void 0;
+		words.push(Number.parseInt(part, 16));
+	}
+	return words;
+}
+function wordsToBytes(words, ipv4Tail) {
+	const bytes = [];
+	for (const word of words) bytes.push(word >> 8 & 255, word & 255);
+	bytes.push(...ipv4Tail);
+	return Buffer.from(bytes);
+}
+/** Whether `text` is an IPv4 literal. */
+function isIpv4Literal(text) {
+	const parts = text.split(".");
+	return parts.length === 4 && parts.every((p) => /^\d{1,3}$/.test(p) && Number(p) <= 255);
+}
+/** A SAN general name: [2] dNSName (IA5) or [7] iPAddress (raw bytes). */
+function sanGeneralName(host) {
+	const trimmed = host.trim();
+	if (isIpv4Literal(trimmed)) return derTag(TAG_CONTEXT_7, Buffer.from(trimmed.split(".").map(Number)));
+	const ipv6 = parseIpv6Bytes(trimmed);
+	if (ipv6 !== void 0) return derTag(TAG_CONTEXT_7, ipv6);
+	return derTag(TAG_CONTEXT_2, Buffer.from(trimmed, "ascii"));
+}
+/** PEM-encode a DER body. */
+function pemEncode(label, der) {
+	return `-----BEGIN ${label}-----\n${der.toString("base64").match(/.{1,64}/g)?.join("\n") ?? ""}\n-----END ${label}-----\n`;
+}
+/**
+* Generate a self-signed X.509 v3 leaf certificate for `hosts`.
+* @param options - hosts, validity, subject.
+* @returns DER + PEM certificate, PEM private key, and the key objects.
+*/
+function generateSelfSignedCert(options) {
+	const hosts = options.hosts.map((h) => h.trim()).filter((h) => h !== "");
+	if (hosts.length === 0) throw new Error("self-signed certificate needs at least one host");
+	const { publicKey, privateKey } = generateKeyPairSync("rsa", {
+		modulusLength: 2048,
+		publicExponent: 65537
+	});
+	const commonName = options.commonName?.trim() || hosts[0];
+	const serial = randomBytes(16);
+	serial[0] &= 127;
+	const issuer = derSeq(derSet(derSeq(derOid("2.5.4.3"), derUtf8String(commonName))));
+	const subject = issuer;
+	const notBefore = /* @__PURE__ */ new Date(Date.now() - 36e5);
+	const notAfter = new Date(notBefore.getTime() + options.days * 864e5);
+	const validity = derSeq(derUtcTime(notBefore), derUtcTime(notAfter));
+	const spki = publicKey.export({
+		type: "spki",
+		format: "der"
+	});
+	const extensionsWrapper = derTag(163, derSeq(derSeq(derOid("2.5.29.19"), derBoolean(true), derOctetString(derSeq())), derSeq(derOid("2.5.29.15"), derBoolean(true), derOctetString(derBitString(Buffer.from([160])))), derSeq(derOid("2.5.29.37"), derOctetString(derSeq(derOid("1.3.6.1.5.5.7.3.1")))), derSeq(derOid("2.5.29.17"), derOctetString(derSeq(...hosts.map(sanGeneralName))))));
+	const tbs = derSeq(derTag(160, derInt(Buffer.from([2]))), derInt(serial), sha256WithRsa(), issuer, validity, subject, spki, extensionsWrapper);
+	const signature = createSign("sha256").update(tbs).end().sign(privateKey);
+	const certDer = derSeq(tbs, sha256WithRsa(), derBitString(signature));
+	return {
+		certDer,
+		certPem: pemEncode("CERTIFICATE", certDer),
+		keyPem: privateKey.export({
+			type: "pkcs8",
+			format: "pem"
+		}).toString(),
+		publicKey,
+		privateKey
+	};
+}
+//#endregion
+//#region src/tls.ts
+/**
+* TLS material management for the gateway: self-signed certificates are
+* generated once and persisted under `~/.dsh/lan-gateway/tls/` (0600) so
+* restarts reuse the same certificate instead of minting a new one every
+* boot; custom certificates are read straight from user-supplied PEM paths.
+*
+* @module @riceawa/dsh-lan-gateway/tls
+*/
+/** The TLS state directory: `~/.dsh/lan-gateway/tls`. */
+function tlsDir(home = homedir()) {
+	return join(home, ".dsh", "lan-gateway", "tls");
+}
+const SELF_SIGNED_CERT_FILE = "selfsigned.crt";
+const SELF_SIGNED_KEY_FILE = "selfsigned.key";
+function privateWrite(path, content) {
+	writeFileSync(path, content, { mode: 384 });
+	try {
+		chmodSync(path, 384);
+	} catch {}
+}
+/**
+* Load the persisted self-signed certificate, generating it on first use.
+* @param opts - hosts / validity for a fresh certificate.
+* @param home - dsh home override (tests).
+* @returns the material and whether it was just created.
+*/
+function loadOrCreateSelfSigned(opts, home = homedir()) {
+	const dir = tlsDir(home);
+	const certPath = join(dir, SELF_SIGNED_CERT_FILE);
+	const keyPath = join(dir, SELF_SIGNED_KEY_FILE);
+	if (existsSync(certPath) && existsSync(keyPath)) try {
+		const cert = readFileSync(certPath, "utf8");
+		const key = readFileSync(keyPath, "utf8");
+		new X509Certificate(cert);
+		return {
+			material: {
+				cert,
+				key
+			},
+			created: false
+		};
+	} catch {}
+	const material = generateSelfSignedMaterial(opts);
+	mkdirSync(dir, { recursive: true });
+	privateWrite(keyPath, material.key);
+	privateWrite(certPath, material.cert);
+	return {
+		material,
+		created: true
+	};
+}
+/**
+* Force-regenerate the self-signed certificate (new key + cert), replacing
+* the persisted files. Used by `lan_gateway tls-regenerate`.
+*/
+function regenerateSelfSigned(opts, home = homedir()) {
+	const dir = tlsDir(home);
+	mkdirSync(dir, { recursive: true });
+	const material = generateSelfSignedMaterial(opts);
+	privateWrite(join(dir, SELF_SIGNED_KEY_FILE), material.key);
+	privateWrite(join(dir, SELF_SIGNED_CERT_FILE), material.cert);
+	return material;
+}
+function generateSelfSignedMaterial(opts) {
+	const hosts = opts.hosts.map((h) => h.trim()).filter((h) => h !== "");
+	if (hosts.length === 0) throw new Error("self-signed TLS needs at least one host in tlsSelfSignedHosts");
+	const { certPem, keyPem } = generateSelfSignedCert({
+		hosts,
+		days: opts.days,
+		...opts.commonName !== void 0 ? { commonName: opts.commonName } : {}
+	});
+	return {
+		cert: certPem,
+		key: keyPem
+	};
+}
+/**
+* Load a user-supplied certificate + key pair from PEM files.
+* @param certPath - path to the PEM certificate (or chain).
+* @param keyPath - path to the PEM private key.
+* @returns the material.
+*/
+function loadCustomCert(certPath, keyPath) {
+	if (certPath === "") throw new Error("tlsMode=custom requires tlsCertPath (PEM certificate)");
+	if (keyPath === "") throw new Error("tlsMode=custom requires tlsKeyPath (PEM private key)");
+	let cert;
+	try {
+		cert = readFileSync(certPath, "utf8");
+	} catch (error) {
+		throw new Error(`cannot read TLS certificate "${certPath}": ${errorMessage(error)}`);
+	}
+	let key;
+	try {
+		key = readFileSync(keyPath, "utf8");
+	} catch (error) {
+		throw new Error(`cannot read TLS private key "${keyPath}": ${errorMessage(error)}`);
+	}
+	try {
+		new X509Certificate(cert);
+	} catch {
+		throw new Error(`"${certPath}" does not contain a valid PEM certificate`);
+	}
+	return {
+		cert,
+		key
+	};
+}
+/** Parse the user-facing `tlsSelfSignedHosts` string into SAN entries. */
+function parseSelfSignedHosts(text) {
+	return (text ?? "").split(/[,;]/).map((host) => host.trim()).filter((host) => host !== "").slice(0, 32);
+}
+/** Describe a PEM certificate (throws on malformed input). */
+function describeCert(certPem) {
+	const cert = new X509Certificate(certPem);
+	return {
+		subject: cert.subject,
+		issuer: cert.issuer,
+		validFrom: cert.validFrom,
+		validTo: cert.validTo,
+		fingerprint256: cert.fingerprint256,
+		...cert.subjectAltName !== void 0 ? { san: cert.subjectAltName } : {}
+	};
+}
+function errorMessage(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+//#endregion
+//#region src/tool.ts
+const LAN_GATEWAY_TOOL_NAME = "lan_gateway";
+/**
+* Build the `lan_gateway` tool over a controller interface implemented by the
+* plugin entry. Split so the tool stays testable and the plugin decides how
+* the controller mutates state.
+*/
+function lanGatewayTool(control) {
+	return defineTool({
+		name: LAN_GATEWAY_TOOL_NAME,
+		description: "Manage the LAN/internet gateway for this DeepSeek Harness web GUI. `status` shows whether the gateway is listening, on which port, toward which dsh port, whether a password is set, the trusted LAN CIDRs, and the TLS state. `enable` starts listening on 0.0.0.0 (loopback and LAN sources need no password; anything else must sign in). `disable` stops listening. `set-password` sets (or, with an empty password, clears) the gateway password for non-LAN access. `rotate-secret` invalidates every issued login cookie. `tls-regenerate` mints a fresh self-signed certificate (tlsMode must be self-signed) and restarts the listener.",
+		parameters: {
+			command: {
+				type: "string",
+				enum: [
+					"status",
+					"enable",
+					"disable",
+					"set-password",
+					"rotate-secret",
+					"tls-regenerate"
+				],
+				description: "`status` (default) — report gateway state. `enable` / `disable` — start or stop the listener. `set-password` — set or clear the login password. `rotate-secret` — invalidate all existing sessions. `tls-regenerate` — mint a new self-signed certificate."
+			},
+			password: {
+				type: "string",
+				description: "Required for `set-password`: the new password (min 8 chars). Omit or pass empty to clear."
+			}
+		},
+		output: {
+			schema: {
+				type: "object",
+				additionalProperties: false,
+				properties: {
+					ok: {
+						type: "boolean",
+						required: true
+					},
+					message: {
+						type: "string",
+						required: true
+					}
+				}
+			},
+			render: (_args, value) => [{
+				type: "text",
+				text: value.message
+			}]
+		},
+		async execute(args, _exec) {
+			switch (args.command ?? "status") {
+				case "status": return control.status();
+				case "enable": return control.enable();
+				case "disable": return control.disable();
+				case "set-password": {
+					const password = args.password;
+					return control.setPassword(typeof password === "string" ? password : void 0);
+				}
+				case "rotate-secret": return control.rotateSecret();
+				case "tls-regenerate": return control.regenerateTls();
+			}
+		}
+	});
+}
+//#endregion
+//#region src/index.ts
+/** Stable Cordis plugin name. */
+const name = "dsh-lan-gateway";
+/** Requires the web server service (binds before this row's apply runs) and the tool registry. */
+const inject = ["webServer", "tools"];
+/** The `lan-gateway` user-settings namespace, mirroring the composition schema. */
+const NS = settingsNamespace("lan-gateway");
+/** Optional config keys: an empty submitted value clears them back to the composition layer. */
+const OPTIONAL_CONFIG_KEYS = /* @__PURE__ */ new Set([
+	"dshTargetPort",
+	"tlsCertPath",
+	"tlsKeyPath"
+]);
+/** Schemastery configuration validated by the Loader. */
+const Config = z.object({
+	enabled: z.boolean().default(false),
+	gatewayPort: z.natural().min(1).max(65535).default(3081),
+	dshTargetPort: z.natural().min(1).max(65535),
+	lanCidrs: z.array(String).default([...DEFAULT_LAN_CIDR_STRINGS]),
+	authRequired: z.boolean().default(true),
+	cookieMaxAgeDays: z.natural().min(1).max(365).default(7),
+	cookieName: z.string().default("dsh_gw_auth"),
+	tlsEnabled: z.boolean().default(false),
+	tlsMode: z.union([z.const("self-signed"), z.const("custom")]).default("self-signed"),
+	tlsCertPath: z.string(),
+	tlsKeyPath: z.string(),
+	tlsSelfSignedHosts: z.string().default("localhost"),
+	tlsCertMaxAgeDays: z.natural().min(1).max(3650).default(825)
+});
+/** Resolve the TLS material for a config, or undefined when TLS is off. */
+function resolveTls(cfg) {
+	if (!cfg.tlsEnabled) return void 0;
+	if (cfg.tlsMode === "custom") return loadCustomCert(cfg.tlsCertPath ?? "", cfg.tlsKeyPath ?? "");
+	const hosts = parseSelfSignedHosts(cfg.tlsSelfSignedHosts);
+	if (hosts.length === 0) throw new Error("tlsSelfSignedHosts must name at least one host (DNS name or IP)");
+	const { material } = loadOrCreateSelfSigned({
+		hosts,
+		days: cfg.tlsCertMaxAgeDays
+	});
+	return material;
+}
+/** Config fields that require a listener restart when they change. */
+function listenerKey(cfg) {
+	return JSON.stringify([
+		cfg.gatewayPort,
+		cfg.dshTargetPort,
+		cfg.lanCidrs,
+		cfg.authRequired,
+		cfg.cookieMaxAgeDays,
+		cfg.cookieName,
+		cfg.tlsEnabled,
+		cfg.tlsMode,
+		cfg.tlsCertPath,
+		cfg.tlsKeyPath,
+		cfg.tlsSelfSignedHosts,
+		cfg.tlsCertMaxAgeDays
+	]);
+}
+/** One-line TLS description for status output. */
+function tlsStatusLine(cfg) {
+	if (!cfg.tlsEnabled) return "off";
+	if (cfg.tlsMode === "custom") return `custom (${cfg.tlsCertPath ?? "?"}, ${cfg.tlsKeyPath ?? "?"})`;
+	try {
+		const { material } = loadOrCreateSelfSigned({
+			hosts: parseSelfSignedHosts(cfg.tlsSelfSignedHosts),
+			days: cfg.tlsCertMaxAgeDays
+		});
+		const info = describeCert(material.cert);
+		return `self-signed [${info.subject}] exp ${info.validTo}`;
+	} catch (error) {
+		return `self-signed (unavailable: ${error instanceof Error ? error.message : String(error)})`;
+	}
+}
+/** Whether `hostname` is loopback (127/8, localhost, ::1). */
+function isLoopbackHost(hostname) {
+	if (hostname === "localhost" || hostname === "[::1]" || hostname === "::1") return true;
+	const parts = hostname.split(".");
+	return parts.length === 4 && parts[0] === "127" && parts.every((part) => /^\d{1,3}$/.test(part) && Number(part) <= 255);
+}
+/**
+* Same-origin loopback fence for the config route (mirrors the fence the dsh
+* host uses for its own /api, and what dsh-lan-gateway's sibling plugins do):
+* the Host must be loopback (the gateway rewrites it), cross-site fetches are
+* refused, and any Origin must match the Host the browser actually used.
+*/
+function isTrustedRequest(req) {
+	const host = req.headers?.host;
+	if (typeof host !== "string" || host === "") return false;
+	let hostUrl;
+	try {
+		hostUrl = new URL(`http://${host}`);
+	} catch {
+		return false;
+	}
+	if (!isLoopbackHost(hostUrl.hostname)) return false;
+	if (req.headers?.["sec-fetch-site"] === "cross-site") return false;
+	const origin = req.headers?.origin;
+	if (origin === void 0) return true;
+	try {
+		return new URL(origin).host === hostUrl.host;
+	} catch {
+		return false;
+	}
+}
+function apply(ctx, config) {
+	let state = loadState();
+	let gateway;
+	let startedWith;
+	let lastError;
+	let manualOverride;
+	/** The authoritative config: settings section when attached, else composition. */
+	let configSource = () => config;
+	/** Serializes listener start/stop/restart so settings changes cannot race. */
+	let syncing = Promise.resolve();
+	const effective = () => configSource();
+	const startGateway = async (cfg) => {
+		if (gateway !== void 0) return;
+		if (cfg.authRequired && state.password === void 0) throw new Error("dsh-lan-gateway: no password set — run `lan_gateway set-password` (or set authRequired=false in the plugin config) before enabling.");
+		const dshPort = cfg.dshTargetPort ?? ctx.webServer.port;
+		const tls = resolveTls(cfg);
+		const next = new LanGateway({
+			gatewayPort: cfg.gatewayPort,
+			dshPort,
+			lanCidrs: cfg.lanCidrs,
+			authRequired: cfg.authRequired,
+			cookieMaxAgeDays: cfg.cookieMaxAgeDays,
+			cookieName: cfg.cookieName,
+			...tls !== void 0 ? { tls } : {}
+		}, state);
+		await next.listen();
+		gateway = next;
+		startedWith = listenerKey(cfg);
+		ctx.logger.info(`dsh-lan-gateway: listening on 0.0.0.0:${cfg.gatewayPort}${tls !== void 0 ? " (TLS)" : ""} -> 127.0.0.1:${dshPort}`);
+	};
+	const stopGateway = async () => {
+		const current = gateway;
+		gateway = void 0;
+		startedWith = void 0;
+		if (current !== void 0) {
+			await current.close();
+			ctx.logger.info("dsh-lan-gateway: stopped");
+		}
+	};
+	/** Reconcile the listener with the effective config (start/stop/restart). */
+	const syncGateway = (reason) => {
+		syncing = syncing.then(async () => {
+			lastError = void 0;
+			const cfg = effective();
+			const shouldRun = manualOverride ?? cfg.enabled;
+			try {
+				if (gateway === void 0) {
+					if (shouldRun) await startGateway(cfg);
+				} else if (!shouldRun) await stopGateway();
+				else if (startedWith !== listenerKey(cfg)) {
+					await stopGateway();
+					await startGateway(cfg);
+				}
+			} catch (error) {
+				lastError = error instanceof Error ? error.message : String(error);
+				ctx.logger.warn(`dsh-lan-gateway: ${reason}: ${lastError}`);
+			}
+		});
+		return syncing;
+	};
+	let settingsScope;
+	ctx.inject(["settings"], (sctx) => {
+		const scope = sctx.settings.register(NS, Config, { base: config });
+		settingsScope = scope;
+		configSource = () => scope.get();
+		sctx.effect(() => scope.watch(() => {
+			syncGateway("settings change");
+		}));
+		sctx.effect(() => () => {
+			configSource = () => config;
+			settingsScope = void 0;
+		});
+		syncGateway("settings attach");
+	});
+	const configRouteHandler = async (req, res) => {
+		const send = (status, body) => {
+			res.writeHead(status, { "content-type": "application/json" });
+			res.end(JSON.stringify(body));
+		};
+		if (!isTrustedRequest(req)) {
+			send(403, { error: "request refused: this route answers loopback-origin requests only" });
+			return;
+		}
+		if (req.method === "GET") {
+			const cfg = effective();
+			send(200, {
+				config: cfg,
+				running: gateway !== void 0,
+				port: cfg.gatewayPort,
+				tls: tlsStatusLine(cfg),
+				lastError: lastError ?? null
+			});
+			return;
+		}
+		if (req.method !== "POST") {
+			send(405, { error: "method not allowed" });
+			return;
+		}
+		const body = await readBody(req, 65536, res);
+		if (body === void 0) return;
+		let submitted;
+		try {
+			submitted = JSON.parse(body);
+		} catch {
+			send(400, { error: "invalid JSON body" });
+			return;
+		}
+		if (typeof submitted !== "object" || submitted === null || Array.isArray(submitted)) {
+			send(400, { error: "body must be a config object" });
+			return;
+		}
+		let candidate;
+		try {
+			candidate = Config(submitted);
+		} catch (error) {
+			send(400, { error: error instanceof Error ? error.message : String(error) });
+			return;
+		}
+		if (settingsScope === void 0) {
+			send(409, { error: "settings service unavailable — edit the profile patch (cordis.patch.yml) instead" });
+			return;
+		}
+		const section = {};
+		for (const [key, value] of Object.entries(candidate)) {
+			if (value === null || value === void 0) continue;
+			if (typeof value === "string" && value === "" && OPTIONAL_CONFIG_KEYS.has(key)) continue;
+			section[key] = value;
+		}
+		try {
+			await settingsScope.replace(section);
+			await syncGateway("config route save");
+			const cfg = effective();
+			send(200, {
+				config: cfg,
+				running: gateway !== void 0,
+				port: cfg.gatewayPort,
+				tls: tlsStatusLine(cfg),
+				lastError: lastError ?? null
+			});
+		} catch (error) {
+			send(409, { error: error instanceof Error ? error.message : String(error) });
+		}
+	};
+	ctx.effect(() => ctx.webServer.register({
+		kind: "exact",
+		path: "/lan-gateway/config",
+		handler: configRouteHandler
+	}), "dsh-lan-gateway: config route");
+	ctx.tools.register(lanGatewayTool({
+		status() {
+			const cfg = effective();
+			const dshPort = cfg.dshTargetPort ?? ctx.webServer.port;
+			return {
+				ok: true,
+				message: `LAN gateway: ${gateway !== void 0 ? `LISTENING on 0.0.0.0:${cfg.gatewayPort}` : "stopped"}\n- dsh target: 127.0.0.1:${dshPort}\n- password: ${state.password !== void 0 ? "set" : "NOT SET"}\n- auth required for non-LAN: ${cfg.authRequired}\n- trusted LAN CIDRs: ${cfg.lanCidrs.join(", ") || "(none)"}\n- session cookie: ${cfg.cookieName}, ${cfg.cookieMaxAgeDays}d\n- TLS: ${tlsStatusLine(cfg)}` + (manualOverride !== void 0 ? `\n- manual override: ${manualOverride ? "enabled" : "disabled"}` : "") + (lastError !== void 0 ? `\n- last error: ${lastError}` : "")
+			};
+		},
+		async enable() {
+			manualOverride = true;
+			await syncGateway("tool enable");
+			return gateway !== void 0 ? {
+				ok: true,
+				message: `Gateway enabled: listening on 0.0.0.0:${effective().gatewayPort}`
+			} : {
+				ok: false,
+				message: `Failed to enable gateway: ${lastError ?? "unknown error"}`
+			};
+		},
+		async disable() {
+			manualOverride = false;
+			await syncGateway("tool disable");
+			return {
+				ok: true,
+				message: "Gateway disabled."
+			};
+		},
+		setPassword(password) {
+			if (password !== void 0 && password.length > 0 && password.length < 8) return {
+				ok: false,
+				message: "Password must be at least 8 characters."
+			};
+			const setting = password !== void 0 && password.length > 0;
+			state = setPassword(state, setting ? password : void 0);
+			saveState(state);
+			gateway?.setState(state);
+			return {
+				ok: true,
+				message: setting ? "Password set. Non-LAN access now requires it." : "Password cleared. Non-LAN access is now password-free (only safe if authRequired is false or no non-LAN sources exist)."
+			};
+		},
+		rotateSecret() {
+			const next = { cookieSecret: randomBytes(32).toString("base64") };
+			if (state.password !== void 0) next.password = state.password;
+			state = next;
+			saveState(state);
+			gateway?.setState(state);
+			return {
+				ok: true,
+				message: "Session secret rotated. All existing login cookies are now invalid."
+			};
+		},
+		async regenerateTls() {
+			const cfg = effective();
+			if (!cfg.tlsEnabled || cfg.tlsMode !== "self-signed") return {
+				ok: false,
+				message: "TLS is off or in custom mode — nothing to regenerate. Enable tlsEnabled with tlsMode=self-signed first."
+			};
+			const hosts = parseSelfSignedHosts(cfg.tlsSelfSignedHosts);
+			if (hosts.length === 0) return {
+				ok: false,
+				message: "tlsSelfSignedHosts must name at least one host (DNS name or IP)."
+			};
+			try {
+				regenerateSelfSigned({
+					hosts,
+					days: cfg.tlsCertMaxAgeDays
+				});
+				if (gateway !== void 0) {
+					await stopGateway();
+					await startGateway(effective());
+					lastError = void 0;
+				}
+				return {
+					ok: true,
+					message: "Self-signed certificate regenerated (new key). Listener restarted with the new certificate."
+				};
+			} catch (error) {
+				return {
+					ok: false,
+					message: `Failed to regenerate TLS certificate: ${error instanceof Error ? error.message : String(error)}`
+				};
+			}
+		}
+	}));
+	ctx.effect(async () => {
+		await syncGateway("boot");
+		return stopGateway;
+	}, "dsh-lan-gateway: listener lifecycle");
+}
+//#endregion
+export { Config, apply, inject, name };