@riceawa/dsh-lan-gateway 0.5.5 → 0.6.0

package/README.md

@@ -6,7 +6,7 @@
 
 <p align="center">
   <img src="https://img.shields.io/badge/DeepSeek%20Harness-4d6bfe?logo=deepseek&logoColor=fff&style=flat-square" alt="DeepSeek Harness" />
-  <img src="https://img.shields.io/badge/version-0.5.5-2b7fff?style=flat-square" alt="version 0.5.5" />
+  <img src="https://img.shields.io/badge/version-0.6.0-2b7fff?style=flat-square" alt="version 0.6.0" />
   <img src="https://img.shields.io/badge/TLS-8b5cf6?logo=lock&logoColor=fff&style=flat-square" alt="TLS" />
   <img src="https://img.shields.io/github/license/rice-awa/dsh-lan-gateway?style=flat-square" alt="MIT license" />
   <a href="https://awesome-dsh-plugin.com"><img src="https://awesome-dsh-plugin.com/badge.svg" alt="awesome · DSH plugin" /></a>
@@ -14,7 +14,7 @@
 
 `dsh web` 明确拒绝 `--host 0.0.0.0`，以免把远程代码执行暴露到网络。本插件的做法是让 dsh 继续只绑 `127.0.0.1`，另起一个反向代理监听未指定地址（双栈，IPv4 与 IPv6 客户端都可接入），转发到 loopback 端口并改写 `Host` / `Origin`。
 
-默认拒绝：loopback、LAN、公网三种来源都要先在网关登录页取得 HMAC 会话 cookie，LAN 免密需要显式打开 `lanPasswordless`，默认关闭。底座为 dsh ≥ 0.1.2-rc.1 时（含 QVD-2026-57410 的上游修复），网关在进程内中继一条共享上游会话，上游自身的授权仍然把关每个请求，网关只决定谁可以使用这条会话。
+默认拒绝：loopback、LAN、公网三种来源都要先在网关登录页取得 HMAC 会话 cookie，LAN 免密需要显式打开 `lanPasswordless`，默认关闭。底座要求 dsh ≥ 0.1.7（本插件按该版本的 settings API 写入配置；含 QVD-2026-57410 的上游修复），网关在进程内中继一条共享上游会话，上游自身的授权仍然把关每个请求，网关只决定谁可以使用这条会话。
 
 插件另外提供两项功能：
 
@@ -70,7 +70,7 @@ lan_gateway disable           # 关闭
 
 ## 配置
 
-所有可调项都暴露为 `lan-gateway` 用户设置命名空间。打开 **DSH 的 Settings → Plugins → 可配置插件**，展开「LAN 网关」卡片即可修改，保存即生效，监听器会按新配置自动重启。下表既是卡片字段，也是配置键：
+所有可调项都写在本插件自己的 profile 条目里（dsh ≥ 0.1.7 起，设置写入按**条目 id** 寻址；此前的 `lan-gateway` 用户设置命名空间已随 `settingsScope` 一起移除）。打开侧边栏的 **Plugins** 页，在官方插件列表里点开「LAN 网关」卡片即可修改，保存即生效，监听器会按新配置自动重启。卡片挂在 Plugins 页的 `plugins.item` 槽上，且只在底座确实 served 本插件条目时注册——没有 Loader 条目（写入必然 409）时卡片不会出现。下表既是卡片字段，也是配置键：
 
 | 键 | 默认值 | 说明 |
 | --- | --- | --- |
@@ -169,8 +169,8 @@ lan_gateway disable           # 关闭
 ## 安全模型
 
 - **来源分级只认 `socket.remoteAddress`**（IPv4-mapped IPv6 会先解包），分 loopback / lan / internet 三档，绝不信任 `X-Forwarded-For`。分级本身不授予任何访问，每一档默认都要出示有效网关会话，否则 302 到 `/__login`。
-- **LAN 免密是显式 opt-in**。`lanPasswordless: true` 只让命中 `lanCidrs` 或 loopback 的来源跳过网关自己的登录页；底座 ≥ 0.1.2-rc.1 时上游会话仍把关每个请求。底座没有浏览器会话认证时这个开关拒绝启用，否则等同于把 QVD-2026-57410 原样恢复。
-- **共享上游会话中继**（dsh ≥ 0.1.2-rc.1）。dsh 不再信任回环 Host，要求出示 HMAC 签名的 `dsh-auth-*` cookie。插件经 `connection` 服务拿到启动令牌，在回环传输上做一次浏览器等价的令牌换取，取得 cookie 后中继到每个转发请求；上游一旦 401 就丢弃这条会话并重新换取。这仍是「单密码 = 单操作者」：通过网关登录的用户共用同一条上游会话，持钥的上游才是真正的授权主体。
+- **LAN 免密是显式 opt-in**。`lanPasswordless: true` 只让命中 `lanCidrs` 或 loopback 的来源跳过网关自己的登录页；受支持的底座（dsh ≥ 0.1.7）上游会话仍把关每个请求。底座没有浏览器会话认证时这个开关拒绝启用，否则等同于把 QVD-2026-57410 原样恢复。
+- **共享上游会话中继**（dsh ≥ 0.1.7）。dsh 不再信任回环 Host，要求出示 HMAC 签名的 `dsh-auth-*` cookie。插件经 `connection` 服务拿到启动令牌，在回环传输上做一次浏览器等价的令牌换取，取得 cookie 后中继到每个转发请求；上游一旦 401 就丢弃这条会话并重新换取。这仍是「单密码 = 单操作者」：通过网关登录的用户共用同一条上游会话，持钥的上游才是真正的授权主体。
 - **登录页**。`/__login` 由网关独占、不转发。密码以 scrypt 校验，每写一次重新加盐；登录尝试按来源限流（5 次 / 分钟）。
 - **会话 cookie** 是 `payload.signature` 结构（HMAC-SHA256），带撤销 epoch 与逐会话 id，`HttpOnly; SameSite=Strict`。登出撤销的是当前这条会话：它建立的 WebSocket 一并断开，其他设备不受影响。改密、清密、`rotate-secret` 递增 epoch，作废全部已签发 cookie 并断开全部已建立的 WebSocket，客户端需要重新登录。清空密码会直接停止监听。
 - **管理面不外泄**。`/lan-gateway/*`（含配置路由）由网关独占、一律 403 不转发，远程访问者无法借网关改写 Host 触及本机 loopback 的配置接口。原生 `/lan-gateway/config` 只应答回环 Host 且同源的请求。远程管理走 `lan_gateway` 工具。
@@ -199,17 +199,23 @@ pnpm typecheck   # tsc 双端（host + client）
 ```
 
 ```
-✓ tests/gateway.test.ts               (40) 分类 / HMAC cookie / epoch / 逐会话撤销 / 密码状态 / 限流
-✓ tests/start-guard.test.ts           (19) fail-closed 启动守卫 / 配置路由回环围栏 /
-                                           Secure cookie 属性推断（含 null 清除路径）
-✓ tests/integration/gateway.test.ts   (26) 真实网关端到端：全来源登录 / LAN 豁免 / 跨站 403 / 升级拒绝 /
-                                           cookie 属性 / epoch 撤销 / 逐会话登出 / 尾斜杠 / IPv6 / 会话中继
-✓ tests/uuid-shim.test.ts             ( 3) 不安全源补丁 / 安全源 no-op / v4 正确性
-✓ tests/x509.test.ts                  ( 6) 自签名证书 DER/SAN/签名/TLS 握手
-✓ tests/tls.test.ts                   ( 9) 证书持久化 / 到期换发 / 重生成 / 自定义证书加载
-✓ tests/upstream-session.test.ts      ( 8) 真实回环令牌换取：cookie 名匹配 / 拒绝后重换 /
-                                           invalidate 重获取 / 日志播报 / 保住已持有会话
-✓ tests/settings-card.test.ts         ( 6) 设置页字段编解码：三态 auto ↔ false 不可混淆
+✓ tests/gateway.test.ts                        (40) 分类 / HMAC cookie / epoch / 逐会话撤销 / 密码状态 / 限流
+✓ tests/start-guard.test.ts                    (19) fail-closed 启动守卫 / 配置路由回环围栏 /
+                                                    Secure cookie 属性推断（含 null 清除路径）
+✓ tests/request-policy.test.ts                 (46) 判定缝纯函数：路径归一化 / 归属前缀 / 同站与登录围栏 /
+                                                    两个方向的头部变换
+✓ tests/upstream-session.test.ts               ( 8) 真实回环令牌换取：cookie 名匹配 / 拒绝后重换 /
+                                                    invalidate 重获取 / 日志播报 / 保住已持有会话
+✓ tests/x509.test.ts                           ( 6) 自签名证书 DER/SAN/签名/TLS 握手
+✓ tests/tls.test.ts                            ( 9) 证书持久化 / 到期换发 / 重生成 / 自定义证书加载
+✓ tests/uuid-shim.test.ts                      ( 3) 不安全源补丁 / 安全源 no-op / v4 正确性
+✓ tests/settings-card.test.ts                  (10) 设置页字段编解码（三态 auto ↔ false 不可混淆）/
+                                                    卡片注册槽与条目 id 契约
+✓ tests/integration/gateway.test.ts            (26) 真实网关端到端：全来源登录 / LAN 豁免 / 跨站 403 / 升级拒绝 /
+                                                    cookie 属性 / epoch 撤销 / 逐会话登出 / 尾斜杠 / IPv6 / 会话中继
+✓ tests/integration/management-plane.test.ts   (15) 真实 apply()：工具与卡片交替启停 / 未编辑字段与未知键保留 /
+                                                    清空后继承 / 拒绝不可启动配置
+✓ tests/integration/session-races.test.ts      ( 8) 改密落在登录与握手途中的竞态 / 上游非 101 应答
 ```
 
 ### 发布
@@ -233,8 +239,8 @@ pnpm typecheck   # tsc 双端（host + client）
 pnpm install --frozen-lockfile
 pnpm typecheck && pnpm test
 npm publish --access public                       # prepack 自动构建 lib/
-git tag -a v0.5.5 -m "…" && git push origin v0.5.5
-gh release create v0.5.5 --generate-notes ./*.tgz # 可选：Release + tgz 附件
+git tag -a v0.6.0 -m "…" && git push origin v0.6.0
+gh release create v0.6.0 --generate-notes ./*.tgz # 可选：Release + tgz 附件
 ```
 
 ## 安全评估
@@ -246,6 +252,10 @@ gh release create v0.5.5 --generate-notes ./*.tgz # 可选：Release + tgz 附
 - [上游研究](docs/security/qvd-2026-57410-research.md)：公开通告、上游提交与版本核对。
 - [0.5.4 复审与修复清单](docs/security/audit-2026-09-19-fix-list.md)：0.5.3 的实现细节复审（G1–G12）与修复记录。
 
+架构层面的复审另见 [docs/review/](docs/review/)：
+
+- [架构复审（2026-09-19）](docs/review/architecture-review-2026-09-19.md)：针对 0.5.4 的 C1–C6 结构候选与 D1–D14 缺陷清单，0.5.5 已全部关闭。文档记录的是复审当时的状态，不是待办列表。
+
 ## 许可
 
 [MIT](./LICENSE)

package/lib/client.js

@@ -151,13 +151,13 @@ window.__ModuleLoader__.load({
 		//#endregion
 		//#region src/client/lan-gateway-card.tsx
 		/**
-		* The lan-gateway settings card shown in the official DSH Settings → Plugins
-		* page (the `settings.plugin.item` slot).
+		* The lan-gateway settings card, rendered by the official DSH Plugins page
+		* through its `plugins.item` slot.
 		*
 		* ModLens-style: the card carries NO injected services. It reads and writes
 		* the loopback-only `/lan-gateway/config` host route (the browser never sees
-		* the settings seam or any secret), so the client bundle's only dependency is
-		* the `slots` service that every plugin already has.
+		* the settings seam or any secret), so the only platform service it needs is
+		* the `slots` service every plugin already has.
 		*
 		* @module @riceawa/dsh-lan-gateway/client/card
 		*/
@@ -267,12 +267,24 @@ window.__ModuleLoader__.load({
 			return (typeof navigator !== "undefined" ? navigator.language : "en").toLowerCase().startsWith("zh") ? LABELS.zh : LABELS.en;
 		}
 		/**
+		* The card's title in the browser's language, for the Plugins page's list
+		* entry. A thunk so the label follows the page's locale without re-registering.
+		* @returns the localized card title.
+		*/
+		function cardTitle() {
+			return labels().title;
+		}
+		/**
 		* Render the LAN gateway card. Self-loading: fetches the config route on
 		* mount, posts the edited config on save.
-		* @param _props - unused; the card needs no injected face.
-		* @returns the card, or nothing while the route is unreachable.
+		*
+		* `view` swaps between the card's one-liner and its page body, so the branch
+		* sits after the hooks: the Plugins page re-renders one contribution under the
+		* other view when the card is opened.
+		* @param props - the view the Plugins page is asking for.
+		* @returns the one-liner, the card, or nothing while the route is unreachable.
 		*/
-		function LanGatewayCard(_props) {
+		function LanGatewayCard(props) {
 			const t = labels();
 			const [open, setOpen] = (0, react.useState)(false);
 			const [route, setRoute] = (0, react.useState)(null);
@@ -293,7 +305,8 @@ window.__ModuleLoader__.load({
 					cancelled = true;
 				};
 			}, []);
-			if (loadFailed) return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("li", {
+			if (props.view === "summary") return t.description;
+			if (loadFailed) return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 				style: styles.card,
 				children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 					style: styles.header,
@@ -474,7 +487,7 @@ window.__ModuleLoader__.load({
 				}
 			};
 			const statusLine = `${route.running ? t.running : t.stopped} · ${t.tls}: ${route.tls} · :${route.port}`;
-			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("li", {
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 				style: open ? {
 					...styles.card,
 					...styles.cardOpen
@@ -757,10 +770,9 @@ window.__ModuleLoader__.load({
 		*    installs a getRandomValues-backed `randomUUID` on the Crypto prototype at
 		*    module scope. With TLS enabled the origin is secure and the shim is a
 		*    no-op.
-		* 2. Settings card: registers the LAN gateway card into the official
-		*    Settings → Plugins page (`settings.plugin.item` slot), editing the
-		*    `lan-gateway` settings namespace so port, CIDRs, auth, and TLS are
-		*    adjustable from the GUI.
+		* 2. Settings card: registers the LAN gateway card into the official Plugins
+		*    page (`plugins.item` slot) so port, CIDRs, auth, and TLS stay adjustable
+		*    from the GUI.
 		*/
 		/** RFC 4122 v4 UUID from crypto.getRandomValues (available on insecure origins). */
 		function uuidFromRandomValues() {
@@ -803,25 +815,25 @@ window.__ModuleLoader__.load({
 		}
 		installRandomUuidShim();
 		const name = "dsh-lan-gateway";
-		/** Only the slots service: the card itself is self-loading (ModLens-style). */
-		const inject = ["slots"];
+		/**
+		* The profile entry id this plugin's bundle patch composes it under, and the
+		* settings namespace dsh ≥ 0.1.7 addresses every write by.
+		*/
+		const ENTRY_ID = "dsh-lan-gateway";
+		/** The slots service the card rides, and the settings mirror the gate reads. */
+		const inject = ["slots", "configForms"];
 		/**
 		* Mount the settings card and the UUID shim.
 		* @param ctx - the browser plugin context.
 		*/
 		function apply(ctx) {
 			installRandomUuidShim();
-			const legacyListOptions = {
-				id: "lan-gateway",
-				order: 30
-			};
-			ctx.slots.inject("settings.plugin.item", function* () {
-				yield ctx.slots.register({
-					name: "settings.plugin.item",
-					key: "lan-gateway",
-					...legacyListOptions
-				}, LanGatewayCard);
-			});
+			ctx.effect(() => ctx.configForms.whileServed([ENTRY_ID], () => ctx.slots.inject("plugins.item", () => ctx.slots.register({
+				name: "plugins.item",
+				id: ENTRY_ID,
+				order: 30,
+				label: () => cardTitle()
+			}, LanGatewayCard))));
 		}
 		//#endregion
 		exports.apply = apply;

package/lib/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","names":["useState"],"sources":["../src/config-fields.ts","../src/client/lan-gateway-card.tsx","../src/client/index.ts"],"sourcesContent":["/**\n * The `lan-gateway` configuration field table: which settings keys exist, how\n * each one is rendered, and how a draft string becomes a config value or a\n * clear.\n *\n * The host and the browser card share this module. The host derives the key set\n * its config route accepts and the set an empty value clears from it; the card\n * renders its controls from it. A field therefore cannot be editable on one\n * side and unknown on the other, which is what let the card silently rewrite\n * keys it never showed.\n *\n * Because both halves import it, this module must stay dependency-free and\n * side-effect-free: no schemastery (the host schema remains the validating\n * authority, not this table), no node built-ins, no DOM, no I/O.\n *\n * @module @riceawa/dsh-lan-gateway/config-fields\n */\n\n/**\n * The wire shape of the `lan-gateway` config section, as the Settings card sees\n * it. Deliberately narrower than the host's `Config`: `cookieName` and the\n * retired `authRequired` are not card-editable. The config route applies a\n * patch, so a key absent here is left untouched rather than reset.\n */\nexport interface LanGatewaySettings {\n  enabled?: boolean\n  gatewayPort?: number\n  dshTargetPort?: number\n  lanCidrs?: string[]\n  lanPasswordless?: boolean\n  cookieMaxAgeDays?: number\n  tlsEnabled?: boolean\n  tlsMode?: 'self-signed' | 'custom'\n  tlsCertPath?: string\n  tlsKeyPath?: string\n  tlsSelfSignedHosts?: string\n  tlsCertMaxAgeDays?: number\n  allowInsecurePlaintext?: boolean\n  trustedTerminator?: string\n  secureCookies?: boolean\n}\n\n/** A settings key this table knows how to edit. */\nexport type ConfigFieldKey = keyof LanGatewaySettings\n\n/** How a field is rendered and parsed. */\nexport type FieldKind = 'boolean' | 'number' | 'text' | 'cidrs' | 'select' | 'tristate'\n\nexport interface FieldDef {\n  readonly field: ConfigFieldKey\n  readonly kind: FieldKind\n  /** An empty draft clears the key back to the composition layer. */\n  readonly optional?: boolean\n  /** The accepted values of a `select` field. */\n  readonly options?: readonly string[]\n}\n\n/** The three states of a tri-state field, in display order. */\nexport const TRISTATE_OPTIONS = ['auto', 'true', 'false'] as const\n\n/**\n * The editable settings, in display order. Adding a config key means adding it\n * here (the host whitelist and the card's controls both follow), to the\n * `Config` schema in `index.ts`, and to `listenerKey` when it changes listener\n * behavior.\n */\nexport const FIELDS: readonly FieldDef[] = [\n  { field: 'enabled', kind: 'boolean' },\n  { field: 'gatewayPort', kind: 'number' },\n  { field: 'dshTargetPort', kind: 'number', optional: true },\n  { field: 'lanCidrs', kind: 'cidrs' },\n  { field: 'lanPasswordless', kind: 'boolean' },\n  { field: 'cookieMaxAgeDays', kind: 'number' },\n  { field: 'tlsEnabled', kind: 'boolean' },\n  { field: 'tlsMode', kind: 'select', options: ['self-signed', 'custom'] },\n  { field: 'tlsSelfSignedHosts', kind: 'text' },\n  { field: 'tlsCertPath', kind: 'text', optional: true },\n  { field: 'tlsKeyPath', kind: 'text', optional: true },\n  { field: 'tlsCertMaxAgeDays', kind: 'number' },\n  { field: 'allowInsecurePlaintext', kind: 'boolean' },\n  { field: 'trustedTerminator', kind: 'text', optional: true },\n  { field: 'secureCookies', kind: 'tristate' },\n]\n\n/** Every settings key the config route accepts; anything else is ignored. */\nexport const CONFIG_FIELD_KEYS: ReadonlySet<string> = new Set(FIELDS.map(def => def.field as string))\n\n/** Keys an empty submitted value clears back to the composition layer. */\nexport const OPTIONAL_CONFIG_KEYS: ReadonlySet<string> = new Set(\n  FIELDS.filter(def => def.optional === true).map(def => def.field as string),\n)\n\n/** Render a stored value as draft text. */\nexport function formatValue(def: FieldDef, value: unknown): string {\n  switch (def.kind) {\n    case 'boolean': return value === true ? 'true' : 'false'\n    case 'number': return typeof value === 'number' ? String(value) : ''\n    case 'cidrs': return Array.isArray(value) ? value.join(', ') : ''\n    case 'select': return typeof value === 'string' ? value : (def.options?.[0] ?? '')\n    // Tri-state: an unset value is a distinct third state (\"auto\"), never \"false\".\n    case 'tristate': return value === true ? 'true' : value === false ? 'false' : 'auto'\n    case 'text': return typeof value === 'string' ? value : ''\n  }\n}\n\n/** One field's contribution to a config patch. */\nexport type Write = { kind: 'set'; value: unknown } | { kind: 'clear' }\n\n/** Parse draft text into a value for the POST body; undefined blocks saving. */\nexport function parseValue(def: FieldDef, text: string): Write | undefined {\n  const trimmed = text.trim()\n  switch (def.kind) {\n    case 'boolean':\n      if (trimmed === 'true') return { kind: 'set', value: true }\n      if (trimmed === 'false') return { kind: 'set', value: false }\n      return undefined\n    case 'number':\n      if (trimmed === '') return def.optional ? { kind: 'clear' } : undefined\n      if (!/^\\d+$/.test(trimmed)) return undefined\n      return { kind: 'set', value: Number(trimmed) }\n    case 'cidrs': {\n      const cidrs = trimmed.split(',').map(s => s.trim()).filter(s => s !== '')\n      return cidrs.length === 0 ? { kind: 'clear' } : { kind: 'set', value: cidrs }\n    }\n    case 'select':\n      return def.options?.includes(trimmed) ? { kind: 'set', value: trimmed } : undefined\n    case 'tristate':\n      // 'auto' clears the key so it re-inherits the composition layer (and the\n      // resolution rule), which is what an unset tri-state means.\n      if (trimmed === 'auto') return { kind: 'clear' }\n      if (trimmed === 'true') return { kind: 'set', value: true }\n      if (trimmed === 'false') return { kind: 'set', value: false }\n      return undefined\n    case 'text':\n      return trimmed === '' ? (def.optional ? { kind: 'clear' } : undefined) : { kind: 'set', value: trimmed }\n  }\n}\n","/**\n * The lan-gateway settings card shown in the official DSH Settings → Plugins\n * page (the `settings.plugin.item` slot).\n *\n * ModLens-style: the card carries NO injected services. It reads and writes\n * the loopback-only `/lan-gateway/config` host route (the browser never sees\n * the settings seam or any secret), so the client bundle's only dependency is\n * the `slots` service that every plugin already has.\n *\n * @module @riceawa/dsh-lan-gateway/client/card\n */\n\nimport { useEffect, useState, type ChangeEvent, type ReactNode } from 'react'\nimport type { PropsRuntime } from '@deepseek-ai/dsh-client-ui-slots'\nimport {\n  FIELDS,\n  TRISTATE_OPTIONS,\n  formatValue,\n  parseValue,\n  type FieldDef,\n  type LanGatewaySettings,\n} from '../config-fields.ts'\n\n/**\n * The official Settings → Plugins page declares the `settings.plugin.item`\n * slot keyed by the settings namespace each card edits (newer DSH releases;\n * older releases dispatched it as a list slot by `id`). The published package\n * ships no `src/`, so the entry is re-declared here — the runtime slot is\n * real; this only restores the compile-time table.\n */\ndeclare module '@deepseek-ai/dsh-client-ui-slots' {\n  interface SlotMap {\n    /** One plugin's card inside the plugin configuration section. */\n    'settings.plugin.item': { kind: 'keyed'; scope: 'root'; owner: { children?: never } }\n  }\n}\n\n/**\n * Props the renderer binds for this card (unused — the card is self-loading).\n */\nexport type LanGatewayCardProps = PropsRuntime<'settings.plugin.item'>\n\n/**\n * The card's field table and value codecs live in `config-fields.ts`, shared\n * with the host: the host's config route decides which submitted keys are\n * editable and which empty value means \"clear\", and a table duplicated here\n * would let the two disagree about a field the card can render but the route\n * would refuse. Re-exported so the existing tests keep their import path.\n */\nexport { FIELDS, TRISTATE_OPTIONS, formatValue, parseValue }\nexport type { FieldDef, LanGatewaySettings }\n\n/** GET /lan-gateway/config response. */\ninterface RouteState {\n  config: LanGatewaySettings\n  running: boolean\n  port: number\n  tls: string\n  lastError: string | null\n}\n\n/* ------------------------------------------------------------------ */\n/* Bilingual copy (ModLens-style: two small sets, picked by browser)   */\n/* ------------------------------------------------------------------ */\n\ninterface Labels {\n  title: string\n  description: string\n  unsaved: string\n  save: string\n  saving: string\n  discard: string\n  reset: string\n  readOnly: string\n  saveFailed: string\n  loadFailed: string\n  emptyMeansClear: string\n  running: string\n  stopped: string\n  tls: string\n  lastError: string\n  [key: `field.${string}`]: string\n  [key: `hint.${string}`]: string\n  [key: `opt.${string}`]: string\n}\n\nconst LABELS: Record<'zh' | 'en', Labels> = {\n  zh: {\n    title: 'LAN 网关',\n    description: '远程访问开关、端口、TLS 证书、受信网段等网关设置',\n    unsaved: '未保存',\n    save: '保存',\n    saving: '保存中…',\n    discard: '放弃',\n    reset: '重置',\n    readOnly: '网关设置只能在宿主机本机打开 dsh web 时修改：配置路由仅监听回环地址，经网关远程访问的浏览器会被拒绝。远程请改用 lan_gateway 工具。',\n    saveFailed: '保存未生效，请检查输入后重试。',\n    loadFailed: '无法读取网关配置',\n    emptyMeansClear: '留空 = 使用默认',\n    running: '运行中',\n    stopped: '已停止',\n    tls: 'TLS',\n    lastError: '上次错误',\n    'field.enabled': '启用网关',\n    'hint.enabled': '启动时监听 0.0.0.0 网关端口',\n    'field.gatewayPort': '网关端口',\n    'hint.gatewayPort': '绑定到 0.0.0.0 的监听端口（默认 3081）',\n    'field.dshTargetPort': 'dsh 目标端口',\n    'hint.dshTargetPort': '留空则自动跟随 dsh web 端口（默认 3080）',\n    'field.lanCidrs': '免密 LAN 网段',\n    'hint.lanCidrs': '逗号分隔的 CIDR，如 10.0.0.0/8, 192.168.0.0/16',\n    'field.lanPasswordless': 'LAN 免登录',\n    'hint.lanPasswordless': 'LAN/回环来源跳过网关登录页，但仍共用同一上游会话（需 dsh ≥ 0.1.2）',\n    'field.allowInsecurePlaintext': '允许明文 HTTP',\n    'hint.allowInsecurePlaintext': '危险：关闭 TLS 或受信终止代理时仍启动监听，密码与会话将以明文传输',\n    'field.trustedTerminator': '受信 TLS 终止代理',\n    'hint.trustedTerminator': '可选：声明前置代理标识，视为加密入口（如 nginx）。留空 = 未声明。注意：登录限流以 TCP 源地址为键，代理之后所有浏览器共用一个额度（5 次/分钟）',\n    'field.secureCookies': '会话 cookie 的 Secure 属性',\n    'hint.secureCookies': '自动 = TLS 或已声明受信终止代理时加 Secure。受信代理只做明文鉴权、浏览器走 http 访问时须设为 false，否则浏览器拒收 Secure cookie，登录会无限弹回登录页',\n    'opt.auto': '自动',\n    'opt.true': '始终 Secure',\n    'opt.false': '不加 Secure（明文浏览器入口）',\n    'field.cookieMaxAgeDays': '会话有效期（天）',\n    'hint.cookieMaxAgeDays': '登录 cookie 的存活天数（默认 7）',\n    'field.tlsEnabled': '启用 TLS（HTTPS）',\n    'hint.tlsEnabled': '以 HTTPS 提供网关服务',\n    'field.tlsMode': '证书来源',\n    'hint.tlsMode': 'self-signed = 自动生成自签名证书；custom = 使用自己的证书',\n    'field.tlsSelfSignedHosts': '自签名证书域名/IP',\n    'hint.tlsSelfSignedHosts': '逗号分隔，写入证书 SAN，如 localhost, 192.168.1.5。仅影响下次换发：已有证书沿用至到期，改动不会立刻生效',\n    'field.tlsCertPath': '证书文件路径（custom）',\n    'hint.tlsCertPath': 'PEM 格式证书（或证书链）的绝对路径',\n    'field.tlsKeyPath': '私钥文件路径（custom）',\n    'hint.tlsKeyPath': '与证书配套的 PEM 私钥绝对路径',\n    'field.tlsCertMaxAgeDays': '自签名证书有效期（天）',\n    'hint.tlsCertMaxAgeDays': '默认 825（约 27 个月）。仅影响下次换发：已有证书沿用至到期',\n  },\n  en: {\n    title: 'LAN Gateway',\n    description: 'Remote-access switch, port, TLS certificate, trusted CIDRs and more',\n    unsaved: 'Unsaved',\n    save: 'Save',\n    saving: 'Saving…',\n    discard: 'Discard',\n    reset: 'Reset',\n    readOnly: 'Gateway settings can only be changed where dsh web runs locally: the config route listens on loopback only, so a browser reaching dsh through the gateway is refused. Use the lan_gateway tool remotely.',\n    saveFailed: 'The save did not land — check the inputs and retry.',\n    loadFailed: 'Cannot read the gateway configuration',\n    emptyMeansClear: 'Empty = default',\n    running: 'Running',\n    stopped: 'Stopped',\n    tls: 'TLS',\n    lastError: 'Last error',\n    'field.enabled': 'Enable gateway',\n    'hint.enabled': 'Listen on the gateway port at boot',\n    'field.gatewayPort': 'Gateway port',\n    'hint.gatewayPort': 'Port bound on 0.0.0.0 (default 3081)',\n    'field.dshTargetPort': 'dsh target port',\n    'hint.dshTargetPort': 'Leave empty to follow the dsh web port (default 3080)',\n    'field.lanCidrs': 'Password-free LAN CIDRs',\n    'hint.lanCidrs': 'Comma separated CIDRs, e.g. 10.0.0.0/8, 192.168.0.0/16',\n    'field.lanPasswordless': 'LAN skip login',\n    'hint.lanPasswordless': 'LAN/loopback sources skip the gateway login page but still ride one shared upstream session (needs dsh >= 0.1.2)',\n    'field.allowInsecurePlaintext': 'Allow plaintext HTTP',\n    'hint.allowInsecurePlaintext': 'Dangerous: start the listener even without TLS or a trusted terminator; passwords and sessions travel in clear',\n    'field.trustedTerminator': 'Trusted TLS terminator',\n    'hint.trustedTerminator': 'Optional identifier for a front proxy (e.g. nginx) treated as the encrypted ingress. Empty = none declared. Note: login rate limiting keys on the TCP source address, so behind a proxy every browser shares one budget (5/min)',\n    'field.secureCookies': 'Session cookie Secure attribute',\n    'hint.secureCookies': 'Auto = Secure when TLS or a trusted terminator is declared. Set false when the trusted proxy only authenticates over plaintext and browsers reach it over http — otherwise browsers drop the Secure cookie and every login bounces back to the login page',\n    'opt.auto': 'Auto',\n    'opt.true': 'Always Secure',\n    'opt.false': 'No Secure (plaintext browser ingress)',\n    'field.cookieMaxAgeDays': 'Session lifetime (days)',\n    'hint.cookieMaxAgeDays': 'Login cookie lifetime (default 7)',\n    'field.tlsEnabled': 'Enable TLS (HTTPS)',\n    'hint.tlsEnabled': 'Serve the gateway over HTTPS',\n    'field.tlsMode': 'Certificate source',\n    'hint.tlsMode': 'self-signed = auto-generated certificate; custom = your own files',\n    'field.tlsSelfSignedHosts': 'Self-signed hosts (SANs)',\n    'hint.tlsSelfSignedHosts': 'Comma separated DNS/IP names, e.g. localhost, 192.168.1.5. Applies to the next issuance only: an existing certificate is reused until it expires',\n    'field.tlsCertPath': 'Certificate path (custom)',\n    'hint.tlsCertPath': 'Absolute path to a PEM certificate (or chain)',\n    'field.tlsKeyPath': 'Private key path (custom)',\n    'hint.tlsKeyPath': 'Absolute path to the matching PEM private key',\n    'field.tlsCertMaxAgeDays': 'Self-signed validity (days)',\n    'hint.tlsCertMaxAgeDays': 'Default 825 (about 27 months). Applies to the next issuance only: an existing certificate is reused until it expires',\n  },\n}\n\nfunction labels(): Labels {\n  const lang = (typeof navigator !== 'undefined' ? navigator.language : 'en').toLowerCase()\n  return lang.startsWith('zh') ? LABELS.zh : LABELS.en\n}\n\n/* ------------------------------------------------------------------ */\n/* Card                                                                */\n/* ------------------------------------------------------------------ */\n\n/**\n * Render the LAN gateway card. Self-loading: fetches the config route on\n * mount, posts the edited config on save.\n * @param _props - unused; the card needs no injected face.\n * @returns the card, or nothing while the route is unreachable.\n */\nexport function LanGatewayCard(_props: LanGatewayCardProps): ReactNode {\n  const t = labels()\n  const [open, setOpen] = useState(false)\n  const [route, setRoute] = useState<RouteState | null>(null)\n  const [loadFailed, setLoadFailed] = useState(false)\n  const [drafts, setDrafts] = useState<Partial<Record<string, string>>>({})\n  const [saving, setSaving] = useState(false)\n  const [failed, setFailed] = useState<string | null>(null)\n\n  useEffect(() => {\n    let cancelled = false\n    fetch('/lan-gateway/config')\n      .then(async (response) => {\n        if (cancelled) return\n        if (!response.ok) throw new Error(`HTTP ${response.status}`)\n        setRoute(await response.json() as RouteState)\n      })\n      .catch(() => {\n        if (!cancelled) setLoadFailed(true)\n      })\n    return () => { cancelled = true }\n  }, [])\n\n  // A remote browser reaches this card through the gateway, which answers 403\n  // for the plugin's own prefix by design, so the route is unreachable exactly\n  // where a user is most likely to go looking for the setting. Rendering\n  // nothing left them with a blank entry and no way to tell a missing card from\n  // a broken one; say what is wrong and where the card does work instead.\n  if (loadFailed) {\n    return (\n      <li style={styles.card}>\n        <div style={styles.header}>\n          <span style={styles.headerTop}>\n            <span style={styles.name}>{t.title}</span>\n          </span>\n          <span style={styles.description}>{t.loadFailed}</span>\n        </div>\n        <div style={styles.body}>\n          <p style={styles.hint}>{t.readOnly}</p>\n        </div>\n      </li>\n    )\n  }\n  if (route === null) return null\n\n  const { config } = route\n  const draftOf = (field: keyof LanGatewaySettings): string =>\n    drafts[field] ?? formatValue(FIELDS.find(f => f.field === field)!, config[field])\n\n  const stage = (field: string, text: string): void => {\n    setDrafts(prev => ({ ...prev, [field]: text }))\n    setFailed(null)\n  }\n\n  const resetField = (def: FieldDef): void => {\n    setDrafts(prev => {\n      const next = { ...prev }\n      delete next[def.field]\n      return next\n    })\n  }\n\n  const discard = (): void => {\n    setDrafts({})\n    setFailed(null)\n  }\n\n  const invalid = (): boolean =>\n    Object.entries(drafts).some(([field, text]) => {\n      const def = FIELDS.find(f => f.field === field)\n      return def === undefined || parseValue(def, text ?? '') === undefined\n    })\n\n  const dirty = Object.keys(drafts).length > 0\n\n  const save = async (): Promise<void> => {\n    if (!dirty || saving || invalid()) return\n    setSaving(true)\n    setFailed(null)\n    try {\n      // A patch of the edited fields only, never the whole config: the card\n      // cannot express every key the section may hold (a custom `cookieName`,\n      // say), and posting a synthesized full config made the route treat those\n      // keys as submitted — resetting each one to its schema default.\n      const patch: Record<string, unknown> = {}\n      for (const [field, text] of Object.entries(drafts)) {\n        const def = FIELDS.find(f => f.field === field)\n        if (def === undefined) continue\n        const write = parseValue(def, text ?? '')\n        if (write === undefined) continue\n        patch[field] = write.kind === 'clear' ? null : write.value\n      }\n      const response = await fetch('/lan-gateway/config', {\n        method: 'POST',\n        headers: { 'content-type': 'application/json' },\n        body: JSON.stringify(patch),\n      })\n      const body = await response.json().catch(() => ({})) as Partial<RouteState> & { error?: string }\n      if (!response.ok) {\n        setFailed(body.error ?? `HTTP ${response.status}`)\n        return\n      }\n      if (body.config !== undefined) {\n        setRoute({\n          config: body.config,\n          running: body.running ?? false,\n          port: body.port ?? 0,\n          tls: body.tls ?? '',\n          lastError: body.lastError ?? null,\n        })\n      }\n      setDrafts({})\n    } catch {\n      setFailed(t.saveFailed)\n    } finally {\n      setSaving(false)\n    }\n  }\n\n  const renderControl = (def: FieldDef): ReactNode => {\n    const field = def.field\n    const label = t[`field.${field}`]\n    const hint = t[`hint.${field}`]\n    const text = draftOf(field)\n    switch (def.kind) {\n      case 'boolean':\n        return (\n          <div style={styles.field}>\n            <label style={styles.checkRow}>\n              <input\n                type=\"checkbox\"\n                checked={text === 'true'}\n                disabled={saving}\n                onChange={(e: ChangeEvent<HTMLInputElement>) =>\n                  stage(field, e.target.checked ? 'true' : 'false')}\n              />\n              <span style={styles.label}>{label}</span>\n              <button\n                type=\"button\"\n                style={styles.reset}\n                disabled={saving || !drafts[field]}\n                onClick={() => resetField(def)}\n              >\n                {t.reset}\n              </button>\n            </label>\n            <span style={styles.hint}>{hint}</span>\n          </div>\n        )\n      case 'select':\n      case 'tristate': {\n        // A tri-state renders as a three-way select because neither a checkbox\n        // (cannot express \"unset\") nor a text field (cannot express false)\n        // distinguishes auto from an explicit false.\n        const options = def.kind === 'tristate' ? TRISTATE_OPTIONS : (def.options ?? [])\n        return (\n          <div style={styles.field}>\n            <label style={styles.label} htmlFor={`lan-gw-${field}`}>{label}</label>\n            <select\n              id={`lan-gw-${field}`}\n              style={styles.input}\n              value={text}\n              disabled={saving}\n              onChange={(e: ChangeEvent<HTMLSelectElement>) => stage(field, e.target.value)}\n            >\n              {options.map(option => (\n                <option key={option} value={option}>\n                  {def.kind === 'tristate' ? t[`opt.${option}`] : option}\n                </option>\n              ))}\n            </select>\n            <span style={styles.hint}>{hint}</span>\n            <button\n              type=\"button\"\n              style={styles.reset}\n              disabled={saving || !drafts[field]}\n              onClick={() => resetField(def)}\n            >\n              {t.reset}\n            </button>\n          </div>\n        )\n      }\n      default:\n        return (\n          <div style={styles.field}>\n            <label style={styles.label} htmlFor={`lan-gw-${field}`}>{label}</label>\n            <input\n              id={`lan-gw-${field}`}\n              style={styles.input}\n              type={def.kind === 'number' ? 'number' : 'text'}\n              value={text}\n              disabled={saving}\n              placeholder={def.optional ? t.emptyMeansClear : undefined}\n              onChange={(e: ChangeEvent<HTMLInputElement>) => stage(field, e.target.value)}\n            />\n            <span style={styles.hint}>{hint}</span>\n          </div>\n        )\n    }\n  }\n\n  const statusLine = `${route.running ? t.running : t.stopped} · ${t.tls}: ${route.tls} · :${route.port}`\n\n  return (\n    <li style={open ? { ...styles.card, ...styles.cardOpen } : styles.card}>\n      <button\n        type=\"button\"\n        style={styles.header}\n        aria-expanded={open}\n        onClick={() => { setOpen(!open) }}\n      >\n        <span style={styles.headerTop}>\n          <span style={styles.name}>{t.title}</span>\n          <span style={styles.status} title={statusLine}>{statusLine}</span>\n          {dirty ? <span style={styles.pending}>{t.unsaved}</span> : null}\n          <span style={open ? { ...styles.chevron, ...styles.chevronOpen } : styles.chevron}>{open ? '▾' : '▸'}</span>\n        </span>\n        <span style={styles.description}>{t.description}</span>\n      </button>\n      {open\n        ? (\n          <div style={styles.body}>\n            {route.lastError ? <p style={styles.error} role=\"status\">{t.lastError}: {route.lastError}</p> : null}\n            {FIELDS.map(def => <div key={def.field}>{renderControl(def)}</div>)}\n            <div style={styles.footer}>\n              {failed ? <p style={styles.error} role=\"status\">{failed}</p> : null}\n              <button\n                type=\"button\"\n                style={styles.discard}\n                disabled={!dirty || saving}\n                onClick={discard}\n              >\n                {t.discard}\n              </button>\n              <button\n                type=\"button\"\n                style={styles.save}\n                disabled={!dirty || invalid() || saving}\n                onClick={() => { void save() }}\n              >\n                {saving ? t.saving : t.save}\n              </button>\n            </div>\n          </div>\n        )\n        : null}\n    </li>\n  )\n}\n\n/* ------------------------------------------------------------------ */\n/* Styling — the official DSH theme tokens (light/dark aware), with    */\n/* neutral fallbacks so the card never renders black-on-black or       */\n/* white-on-white even if a token is missing.                          */\n/* ------------------------------------------------------------------ */\n\n/** Theme token with a fallback for token-less environments. */\nfunction tk(token: string, fallback: string): string {\n  return `var(${token}, ${fallback})`\n}\n\nconst L = {\n  border: tk('--dsw-alias-border-l2', 'rgba(127,127,127,0.35)'),\n  bg: tk('--dsw-alias-bg-layer-3', 'transparent'),\n  bgOpen: tk('--dsw-alias-bg-layer-2', 'transparent'),\n  labelPrimary: tk('--dsw-alias-label-primary', 'inherit'),\n  labelSecondary: tk('--dsw-alias-label-secondary', 'inherit'),\n  labelTertiary: tk('--dsw-alias-label-tertiary', 'rgba(127,127,127,0.8)'),\n  labelDimmed: tk('--dsw-alias-label-dimmed', 'rgba(127,127,127,0.6)'),\n  error: tk('--dsw-alias-label-error', '#d1242f'),\n  brand: tk('--dsw-alias-brand-primary', '#4f6ef7'),\n  badgeBg: tk('--dsw-alias-bg-module-platform', 'rgba(127,127,127,0.14)'),\n}\n\nconst styles: Record<string, React.CSSProperties> = {\n  card: {\n    listStyle: 'none',\n    border: `1px solid ${L.border}`,\n    borderRadius: '12px',\n    background: L.bg,\n    transition: 'border-color .16s, background .16s',\n    overflow: 'hidden',\n  },\n  cardOpen: {\n    background: L.bgOpen,\n    borderColor: L.labelDimmed,\n  },\n  header: {\n    display: 'flex',\n    flexDirection: 'column',\n    alignItems: 'stretch',\n    gap: '6px',\n    width: '100%',\n    padding: '14px 16px',\n    border: 0,\n    background: 'none',\n    font: 'inherit',\n    color: 'inherit',\n    textAlign: 'left',\n    cursor: 'pointer',\n  },\n  headerTop: { display: 'flex', alignItems: 'center', gap: '12px', width: '100%' },\n  name: { flex: '1 1 auto', minWidth: 0, fontSize: '15px', fontWeight: 600, lineHeight: 1.4, color: L.labelPrimary },\n  // The status carries a verbose TLS cert summary; cap it and ellipsize so it\n  // can never swallow the row or squeeze the title (the old nowrap alone\n  // caused the description to be pushed into a thin wrapping column).\n  status: {\n    flex: '0 1 auto',\n    minWidth: 0,\n    maxWidth: '60%',\n    fontSize: '11px',\n    lineHeight: 1.4,\n    color: L.labelTertiary,\n    whiteSpace: 'nowrap',\n    overflow: 'hidden',\n    textOverflow: 'ellipsis',\n  },\n  description: {\n    display: 'block',\n    fontSize: '13px',\n    lineHeight: 1.5,\n    color: L.labelTertiary,\n    whiteSpace: 'nowrap',\n    overflow: 'hidden',\n    textOverflow: 'ellipsis',\n  },\n  pending: {\n    flex: 'none',\n    borderRadius: '999px',\n    padding: '1px 8px',\n    fontSize: '11px',\n    lineHeight: '17px',\n    fontWeight: 500,\n    whiteSpace: 'nowrap',\n    background: L.badgeBg,\n    color: L.labelSecondary,\n  },\n  chevron: { flex: 'none', color: L.labelTertiary, fontSize: '12px', transition: 'transform .16s' },\n  chevronOpen: { transform: 'rotate(180deg)' },\n  body: {\n    borderTop: `1px solid ${L.border}`,\n    margin: '0 16px',\n    paddingBottom: '8px',\n    display: 'flex',\n    flexDirection: 'column',\n  },\n  field: {\n    display: 'flex',\n    flexDirection: 'column',\n    gap: '6px',\n    padding: '12px 0',\n  },\n  label: { fontSize: '13px', fontWeight: 500, lineHeight: 1.5, color: L.labelPrimary },\n  hint: { margin: 0, fontSize: '12px', lineHeight: 1.5, color: L.labelTertiary },\n  checkRow: { display: 'flex', alignItems: 'center', gap: '8px', cursor: 'pointer' },\n  reset: {\n    border: 'none',\n    background: 'none',\n    padding: 0,\n    font: 'inherit',\n    fontSize: '12px',\n    lineHeight: 1.5,\n    color: L.labelSecondary,\n    cursor: 'pointer',\n    alignSelf: 'flex-start',\n  },\n  input: {\n    height: '34px',\n    padding: '0 12px',\n    border: `1px solid ${L.border}`,\n    borderRadius: '8px',\n    background: L.bg,\n    font: 'inherit',\n    fontSize: '13px',\n    lineHeight: 1.5,\n    color: L.labelPrimary,\n  },\n  footer: {\n    display: 'flex',\n    alignItems: 'center',\n    justifyContent: 'flex-end',\n    gap: '8px',\n    padding: '12px 0 4px',\n    borderTop: `1px solid ${L.border}`,\n  },\n  error: { flex: 1, minWidth: 0, margin: 0, fontSize: '12px', lineHeight: 1.5, color: L.error },\n  discard: {\n    appearance: 'none',\n    border: `1px solid ${L.border}`,\n    borderRadius: '8px',\n    padding: '5px 14px',\n    font: 'inherit',\n    fontSize: '13px',\n    lineHeight: 1.5,\n    background: 'none',\n    color: L.labelSecondary,\n    cursor: 'pointer',\n  },\n  save: {\n    appearance: 'none',\n    border: '1px solid transparent',\n    borderRadius: '8px',\n    padding: '5px 14px',\n    font: 'inherit',\n    fontSize: '13px',\n    lineHeight: 1.5,\n    background: L.labelPrimary,\n    color: L.bg,\n    cursor: 'pointer',\n  },\n}\n","/**\n * @riceawa/dsh-lan-gateway — browser half.\n *\n * Two jobs:\n * 1. Insecure-origin UUID shim: the gateway can serve the GUI over plain HTTP\n *    on LAN addresses, where browsers lack `crypto.randomUUID()`. This bundle\n *    installs a getRandomValues-backed `randomUUID` on the Crypto prototype at\n *    module scope. With TLS enabled the origin is secure and the shim is a\n *    no-op.\n * 2. Settings card: registers the LAN gateway card into the official\n *    Settings → Plugins page (`settings.plugin.item` slot), editing the\n *    `lan-gateway` settings namespace so port, CIDRs, auth, and TLS are\n *    adjustable from the GUI.\n */\n\n/** RFC 4122 v4 UUID from crypto.getRandomValues (available on insecure origins). */\nfunction uuidFromRandomValues(): string {\n  const bytes = globalThis.crypto.getRandomValues(new Uint8Array(16))\n  const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength)\n  view.setUint8(6, (view.getUint8(6) & 0x0f) | 0x40)\n  view.setUint8(8, (view.getUint8(8) & 0x3f) | 0x80)\n  const hex = Array.from(bytes, byte => byte.toString(16).padStart(2, '0')).join('')\n  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`\n}\n\n/**\n * Install `randomUUID` on the browser Crypto prototype when the platform\n * lacks it. Idempotent; re-checks every call.\n * @returns `true` when the shim was installed by this call.\n */\nexport function installRandomUuidShim(): boolean {\n  const cryptoObj = globalThis.crypto\n  if (cryptoObj === undefined) return false\n  if (typeof cryptoObj.randomUUID === 'function') return false\n  if (typeof cryptoObj.getRandomValues !== 'function') return false\n  try {\n    // Browsers expose crypto.randomUUID through the Crypto prototype; patching\n    // the prototype (not the instance) covers `crypto.randomUUID()` everywhere.\n    const proto = Object.getPrototypeOf(cryptoObj) as { randomUUID?: unknown } | null\n    if (proto !== null && typeof proto.randomUUID !== 'function') {\n      Object.defineProperty(proto, 'randomUUID', {\n        value: uuidFromRandomValues,\n        writable: true,\n        configurable: true,\n      })\n      return true\n    }\n    // Fallback: direct instance property (sandboxed/odd environments).\n    Object.defineProperty(cryptoObj, 'randomUUID', {\n      value: uuidFromRandomValues,\n      writable: true,\n      configurable: true,\n    })\n    return true\n  } catch {\n    return false\n  }\n}\n\n// Module scope: the shim is live as soon as this bundle is evaluated, before\n// any RPC/session code runs. apply() re-runs it as a belt-and-braces re-check.\ninstallRandomUuidShim()\n\nimport type { ClientContext } from '@deepseek-ai/dsh-client-runtime/client'\nimport { LanGatewayCard } from './lan-gateway-card.tsx'\n\nexport const name = 'dsh-lan-gateway'\n\n/** Only the slots service: the card itself is self-loading (ModLens-style). */\nexport const inject = ['slots']\n\n/**\n * Mount the settings card and the UUID shim.\n * @param ctx - the browser plugin context.\n */\nexport function apply(ctx: ClientContext): void {\n  installRandomUuidShim()\n\n  // The card rides the official Plugins → Configurable tab. Like ModLens, it\n  // registers with no inject face and fetches its own loopback config route,\n  // so it has no settings/locale/connection service dependencies.\n  //\n  // The `settings.plugin.item` slot is keyed BY the settings namespace the\n  // card edits (rc.8 contract): the configurable tab only dispatches entries\n  // whose `options.key` is both present and served by the Host's settings\n  // describe mirror. Registering with `id` alone throws\n  // `keyed slot \"settings.plugin.item\" requires options.key` and the card\n  // silently disappears from Settings → Plugins.\n  //\n  // `id`/`order` ride the legacy list-slot shape (older DSH versions\n  // dispatched this slot by id): harmless metadata on the keyed slot, and\n  // what keeps the card mounting if this plugin ever loads into an older\n  // deployment. Spread from a typed constant so the keyed registration type\n  // stays exact.\n  const legacyListOptions = { id: 'lan-gateway', order: 30 } as const\n  ctx.slots.inject('settings.plugin.item', function* () {\n    yield ctx.slots.register({\n      name: 'settings.plugin.item',\n      key: 'lan-gateway',\n      ...legacyListOptions,\n    }, LanGatewayCard)\n  })\n}\n"],"mappings":";;;;;;;;;;EA0DA,MAAa,mBAAmB;GAAC;GAAQ;GAAQ;EAAO;;;;;;;EAQxD,MAAa,SAA8B;GACzC;IAAE,OAAO;IAAW,MAAM;GAAU;GACpC;IAAE,OAAO;IAAe,MAAM;GAAS;GACvC;IAAE,OAAO;IAAiB,MAAM;IAAU,UAAU;GAAK;GACzD;IAAE,OAAO;IAAY,MAAM;GAAQ;GACnC;IAAE,OAAO;IAAmB,MAAM;GAAU;GAC5C;IAAE,OAAO;IAAoB,MAAM;GAAS;GAC5C;IAAE,OAAO;IAAc,MAAM;GAAU;GACvC;IAAE,OAAO;IAAW,MAAM;IAAU,SAAS,CAAC,eAAe,QAAQ;GAAE;GACvE;IAAE,OAAO;IAAsB,MAAM;GAAO;GAC5C;IAAE,OAAO;IAAe,MAAM;IAAQ,UAAU;GAAK;GACrD;IAAE,OAAO;IAAc,MAAM;IAAQ,UAAU;GAAK;GACpD;IAAE,OAAO;IAAqB,MAAM;GAAS;GAC7C;IAAE,OAAO;IAA0B,MAAM;GAAU;GACnD;IAAE,OAAO;IAAqB,MAAM;IAAQ,UAAU;GAAK;GAC3D;IAAE,OAAO;IAAiB,MAAM;GAAW;EAC7C;EAGsD,IAAI,IAAI,OAAO,KAAI,QAAO,IAAI,KAAe,CAAC;EAG3C,IAAI,IAC3D,OAAO,QAAO,QAAO,IAAI,aAAa,IAAI,CAAC,CAAC,KAAI,QAAO,IAAI,KAAe,CAC5E;;EAGA,SAAgB,YAAY,KAAe,OAAwB;GACjE,QAAQ,IAAI,MAAZ;IACE,KAAK,WAAW,OAAO,UAAU,OAAO,SAAS;IACjD,KAAK,UAAU,OAAO,OAAO,UAAU,WAAW,OAAO,KAAK,IAAI;IAClE,KAAK,SAAS,OAAO,MAAM,QAAQ,KAAK,IAAI,MAAM,KAAK,IAAI,IAAI;IAC/D,KAAK,UAAU,OAAO,OAAO,UAAU,WAAW,QAAS,IAAI,UAAU,MAAM;IAE/E,KAAK,YAAY,OAAO,UAAU,OAAO,SAAS,UAAU,QAAQ,UAAU;IAC9E,KAAK,QAAQ,OAAO,OAAO,UAAU,WAAW,QAAQ;GAC1D;EACF;;EAMA,SAAgB,WAAW,KAAe,MAAiC;GACzE,MAAM,UAAU,KAAK,KAAK;GAC1B,QAAQ,IAAI,MAAZ;IACE,KAAK;KACH,IAAI,YAAY,QAAQ,OAAO;MAAE,MAAM;MAAO,OAAO;KAAK;KAC1D,IAAI,YAAY,SAAS,OAAO;MAAE,MAAM;MAAO,OAAO;KAAM;KAC5D;IACF,KAAK;KACH,IAAI,YAAY,IAAI,OAAO,IAAI,WAAW,EAAE,MAAM,QAAQ,IAAI,KAAA;KAC9D,IAAI,CAAC,QAAQ,KAAK,OAAO,GAAG,OAAO,KAAA;KACnC,OAAO;MAAE,MAAM;MAAO,OAAO,OAAO,OAAO;KAAE;IAC/C,KAAK,SAAS;KACZ,MAAM,QAAQ,QAAQ,MAAM,GAAG,CAAC,CAAC,KAAI,MAAK,EAAE,KAAK,CAAC,CAAC,CAAC,QAAO,MAAK,MAAM,EAAE;KACxE,OAAO,MAAM,WAAW,IAAI,EAAE,MAAM,QAAQ,IAAI;MAAE,MAAM;MAAO,OAAO;KAAM;IAC9E;IACA,KAAK,UACH,OAAO,IAAI,SAAS,SAAS,OAAO,IAAI;KAAE,MAAM;KAAO,OAAO;IAAQ,IAAI,KAAA;IAC5E,KAAK;KAGH,IAAI,YAAY,QAAQ,OAAO,EAAE,MAAM,QAAQ;KAC/C,IAAI,YAAY,QAAQ,OAAO;MAAE,MAAM;MAAO,OAAO;KAAK;KAC1D,IAAI,YAAY,SAAS,OAAO;MAAE,MAAM;MAAO,OAAO;KAAM;KAC5D;IACF,KAAK,QACH,OAAO,YAAY,KAAM,IAAI,WAAW,EAAE,MAAM,QAAQ,IAAI,KAAA,IAAa;KAAE,MAAM;KAAO,OAAO;IAAQ;GAC3G;EACF;;;;;;;;;;;;;;EClDA,MAAM,SAAsC;GAC1C,IAAI;IACF,OAAO;IACP,aAAa;IACb,SAAS;IACT,MAAM;IACN,QAAQ;IACR,SAAS;IACT,OAAO;IACP,UAAU;IACV,YAAY;IACZ,YAAY;IACZ,iBAAiB;IACjB,SAAS;IACT,SAAS;IACT,KAAK;IACL,WAAW;IACX,iBAAiB;IACjB,gBAAgB;IAChB,qBAAqB;IACrB,oBAAoB;IACpB,uBAAuB;IACvB,sBAAsB;IACtB,kBAAkB;IAClB,iBAAiB;IACjB,yBAAyB;IACzB,wBAAwB;IACxB,gCAAgC;IAChC,+BAA+B;IAC/B,2BAA2B;IAC3B,0BAA0B;IAC1B,uBAAuB;IACvB,sBAAsB;IACtB,YAAY;IACZ,YAAY;IACZ,aAAa;IACb,0BAA0B;IAC1B,yBAAyB;IACzB,oBAAoB;IACpB,mBAAmB;IACnB,iBAAiB;IACjB,gBAAgB;IAChB,4BAA4B;IAC5B,2BAA2B;IAC3B,qBAAqB;IACrB,oBAAoB;IACpB,oBAAoB;IACpB,mBAAmB;IACnB,2BAA2B;IAC3B,0BAA0B;GAC5B;GACA,IAAI;IACF,OAAO;IACP,aAAa;IACb,SAAS;IACT,MAAM;IACN,QAAQ;IACR,SAAS;IACT,OAAO;IACP,UAAU;IACV,YAAY;IACZ,YAAY;IACZ,iBAAiB;IACjB,SAAS;IACT,SAAS;IACT,KAAK;IACL,WAAW;IACX,iBAAiB;IACjB,gBAAgB;IAChB,qBAAqB;IACrB,oBAAoB;IACpB,uBAAuB;IACvB,sBAAsB;IACtB,kBAAkB;IAClB,iBAAiB;IACjB,yBAAyB;IACzB,wBAAwB;IACxB,gCAAgC;IAChC,+BAA+B;IAC/B,2BAA2B;IAC3B,0BAA0B;IAC1B,uBAAuB;IACvB,sBAAsB;IACtB,YAAY;IACZ,YAAY;IACZ,aAAa;IACb,0BAA0B;IAC1B,yBAAyB;IACzB,oBAAoB;IACpB,mBAAmB;IACnB,iBAAiB;IACjB,gBAAgB;IAChB,4BAA4B;IAC5B,2BAA2B;IAC3B,qBAAqB;IACrB,oBAAoB;IACpB,oBAAoB;IACpB,mBAAmB;IACnB,2BAA2B;IAC3B,0BAA0B;GAC5B;EACF;EAEA,SAAS,SAAiB;GAExB,QADc,OAAO,cAAc,cAAc,UAAU,WAAW,KAAA,CAAM,YAClE,CAAC,CAAC,WAAW,IAAI,IAAI,OAAO,KAAK,OAAO;EACpD;;;;;;;EAYA,SAAgB,eAAe,QAAwC;GACrE,MAAM,IAAI,OAAO;GACjB,MAAM,CAAC,MAAM,YAAA,GAAWA,MAAAA,SAAAA,CAAS,KAAK;GACtC,MAAM,CAAC,OAAO,aAAA,GAAYA,MAAAA,SAAAA,CAA4B,IAAI;GAC1D,MAAM,CAAC,YAAY,kBAAA,GAAiBA,MAAAA,SAAAA,CAAS,KAAK;GAClD,MAAM,CAAC,QAAQ,cAAA,GAAaA,MAAAA,SAAAA,CAA0C,CAAC,CAAC;GACxE,MAAM,CAAC,QAAQ,cAAA,GAAaA,MAAAA,SAAAA,CAAS,KAAK;GAC1C,MAAM,CAAC,QAAQ,cAAA,GAAaA,MAAAA,SAAAA,CAAwB,IAAI;GAExD,CAAA,GAAA,MAAA,UAAA,OAAgB;IACd,IAAI,YAAY;IAChB,MAAM,qBAAqB,CAAC,CACzB,KAAK,OAAO,aAAa;KACxB,IAAI,WAAW;KACf,IAAI,CAAC,SAAS,IAAI,MAAM,IAAI,MAAM,QAAQ,SAAS,QAAQ;KAC3D,SAAS,MAAM,SAAS,KAAK,CAAe;IAC9C,CAAC,CAAC,CACD,YAAY;KACX,IAAI,CAAC,WAAW,cAAc,IAAI;IACpC,CAAC;IACH,aAAa;KAAE,YAAY;IAAK;GAClC,GAAG,CAAC,CAAC;GAOL,IAAI,YACF,OACE,iBAAA,GAAA,kBAAA,KAAA,CAAC,MAAD;IAAI,OAAO,OAAO;IAAlB,UAAA,CACE,iBAAA,GAAA,kBAAA,KAAA,CAAC,OAAD;KAAK,OAAO,OAAO;KAAnB,UAAA,CACE,iBAAA,GAAA,kBAAA,IAAA,CAAC,QAAD;MAAM,OAAO,OAAO;MAClB,UAAA,iBAAA,GAAA,kBAAA,IAAA,CAAC,QAAD;OAAM,OAAO,OAAO;OAAO,UAAA,EAAE;MAAY,CAAA;KACrC,CAAA,GACN,iBAAA,GAAA,kBAAA,IAAA,CAAC,QAAD;MAAM,OAAO,OAAO;MAAc,UAAA,EAAE;KAAiB,CAAA,CAClD;IACL,CAAA,GAAA,iBAAA,GAAA,kBAAA,IAAA,CAAC,OAAD;KAAK,OAAO,OAAO;KACjB,UAAA,iBAAA,GAAA,kBAAA,IAAA,CAAC,KAAD;MAAG,OAAO,OAAO;MAAO,UAAA,EAAE;KAAY,CAAA;IACnC,CAAA,CACH;;GAGR,IAAI,UAAU,MAAM,OAAO;GAE3B,MAAM,EAAE,WAAW;GACnB,MAAM,WAAW,UACf,OAAO,UAAU,YAAY,OAAO,MAAK,MAAK,EAAE,UAAU,KAAK,GAAI,OAAO,MAAM;GAElF,MAAM,SAAS,OAAe,SAAuB;IACnD,WAAU,UAAS;KAAE,GAAG;MAAO,QAAQ;IAAK,EAAE;IAC9C,UAAU,IAAI;GAChB;GAEA,MAAM,cAAc,QAAwB;IAC1C,WAAU,SAAQ;KAChB,MAAM,OAAO,EAAE,GAAG,KAAK;KACvB,OAAO,KAAK,IAAI;KAChB,OAAO;IACT,CAAC;GACH;GAEA,MAAM,gBAAsB;IAC1B,UAAU,CAAC,CAAC;IACZ,UAAU,IAAI;GAChB;GAEA,MAAM,gBACJ,OAAO,QAAQ,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,UAAU;IAC7C,MAAM,MAAM,OAAO,MAAK,MAAK,EAAE,UAAU,KAAK;IAC9C,OAAO,QAAQ,KAAA,KAAa,WAAW,KAAK,QAAQ,EAAE,MAAM,KAAA;GAC9D,CAAC;GAEH,MAAM,QAAQ,OAAO,KAAK,MAAM,CAAC,CAAC,SAAS;GAE3C,MAAM,OAAO,YAA2B;IACtC,IAAI,CAAC,SAAS,UAAU,QAAQ,GAAG;IACnC,UAAU,IAAI;IACd,UAAU,IAAI;IACd,IAAI;KAKF,MAAM,QAAiC,CAAC;KACxC,KAAK,MAAM,CAAC,OAAO,SAAS,OAAO,QAAQ,MAAM,GAAG;MAClD,MAAM,MAAM,OAAO,MAAK,MAAK,EAAE,UAAU,KAAK;MAC9C,IAAI,QAAQ,KAAA,GAAW;MACvB,MAAM,QAAQ,WAAW,KAAK,QAAQ,EAAE;MACxC,IAAI,UAAU,KAAA,GAAW;MACzB,MAAM,SAAS,MAAM,SAAS,UAAU,OAAO,MAAM;KACvD;KACA,MAAM,WAAW,MAAM,MAAM,uBAAuB;MAClD,QAAQ;MACR,SAAS,EAAE,gBAAgB,mBAAmB;MAC9C,MAAM,KAAK,UAAU,KAAK;KAC5B,CAAC;KACD,MAAM,OAAO,MAAM,SAAS,KAAK,CAAC,CAAC,aAAa,CAAC,EAAE;KACnD,IAAI,CAAC,SAAS,IAAI;MAChB,UAAU,KAAK,SAAS,QAAQ,SAAS,QAAQ;MACjD;KACF;KACA,IAAI,KAAK,WAAW,KAAA,GAClB,SAAS;MACP,QAAQ,KAAK;MACb,SAAS,KAAK,WAAW;MACzB,MAAM,KAAK,QAAQ;MACnB,KAAK,KAAK,OAAO;MACjB,WAAW,KAAK,aAAa;KAC/B,CAAC;KAEH,UAAU,CAAC,CAAC;IACd,QAAQ;KACN,UAAU,EAAE,UAAU;IACxB,UAAU;KACR,UAAU,KAAK;IACjB;GACF;GAEA,MAAM,iBAAiB,QAA6B;IAClD,MAAM,QAAQ,IAAI;IAClB,MAAM,QAAQ,EAAE,SAAS;IACzB,MAAM,OAAO,EAAE,QAAQ;IACvB,MAAM,OAAO,QAAQ,KAAK;IAC1B,QAAQ,IAAI,MAAZ;KACE,KAAK,WACH,OACE,iBAAA,GAAA,kBAAA,KAAA,CAAC,OAAD;MAAK,OAAO,OAAO;MAAnB,UAAA,CACE,iBAAA,GAAA,kBAAA,KAAA,CAAC,SAAD;OAAO,OAAO,OAAO;OAArB,UAAA;QACE,iBAAA,GAAA,kBAAA,IAAA,CAAC,SAAD;SACE,MAAK;SACL,SAAS,SAAS;SAClB,UAAU;SACV,WAAW,MACT,MAAM,OAAO,EAAE,OAAO,UAAU,SAAS,OAAO;QACnD,CAAA;QACD,iBAAA,GAAA,kBAAA,IAAA,CAAC,QAAD;SAAM,OAAO,OAAO;SAAQ,UAAA;QAAY,CAAA;QACxC,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD;SACE,MAAK;SACL,OAAO,OAAO;SACd,UAAU,UAAU,CAAC,OAAO;SAC5B,eAAe,WAAW,GAAG;SAE5B,UAAA,EAAE;QACG,CAAA;OACH;MACP,CAAA,GAAA,iBAAA,GAAA,kBAAA,IAAA,CAAC,QAAD;OAAM,OAAO,OAAO;OAAO,UAAA;MAAW,CAAA,CACnC;;KAET,KAAK;KACL,KAAK,YAAY;MAIf,MAAM,UAAU,IAAI,SAAS,aAAa,mBAAoB,IAAI,WAAW,CAAC;MAC9E,OACE,iBAAA,GAAA,kBAAA,KAAA,CAAC,OAAD;OAAK,OAAO,OAAO;OAAnB,UAAA;QACE,iBAAA,GAAA,kBAAA,IAAA,CAAC,SAAD;SAAO,OAAO,OAAO;SAAO,SAAS,UAAU;SAAU,UAAA;QAAa,CAAA;QACtE,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD;SACE,IAAI,UAAU;SACd,OAAO,OAAO;SACd,OAAO;SACP,UAAU;SACV,WAAW,MAAsC,MAAM,OAAO,EAAE,OAAO,KAAK;SAE3E,UAAA,QAAQ,KAAI,WACX,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD;UAAqB,OAAO;UACzB,UAAA,IAAI,SAAS,aAAa,EAAE,OAAO,YAAY;SAC1C,GAFK,MAEL,CACT;QACK,CAAA;QACR,iBAAA,GAAA,kBAAA,IAAA,CAAC,QAAD;SAAM,OAAO,OAAO;SAAO,UAAA;QAAW,CAAA;QACtC,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD;SACE,MAAK;SACL,OAAO,OAAO;SACd,UAAU,UAAU,CAAC,OAAO;SAC5B,eAAe,WAAW,GAAG;SAE5B,UAAA,EAAE;QACG,CAAA;OACL;;KAET;KACA,SACE,OACE,iBAAA,GAAA,kBAAA,KAAA,CAAC,OAAD;MAAK,OAAO,OAAO;MAAnB,UAAA;OACE,iBAAA,GAAA,kBAAA,IAAA,CAAC,SAAD;QAAO,OAAO,OAAO;QAAO,SAAS,UAAU;QAAU,UAAA;OAAa,CAAA;OACtE,iBAAA,GAAA,kBAAA,IAAA,CAAC,SAAD;QACE,IAAI,UAAU;QACd,OAAO,OAAO;QACd,MAAM,IAAI,SAAS,WAAW,WAAW;QACzC,OAAO;QACP,UAAU;QACV,aAAa,IAAI,WAAW,EAAE,kBAAkB,KAAA;QAChD,WAAW,MAAqC,MAAM,OAAO,EAAE,OAAO,KAAK;OAC5E,CAAA;OACD,iBAAA,GAAA,kBAAA,IAAA,CAAC,QAAD;QAAM,OAAO,OAAO;QAAO,UAAA;OAAW,CAAA;MACnC;;IAEX;GACF;GAEA,MAAM,aAAa,GAAG,MAAM,UAAU,EAAE,UAAU,EAAE,QAAQ,KAAK,EAAE,IAAI,IAAI,MAAM,IAAI,MAAM,MAAM;GAEjG,OACE,iBAAA,GAAA,kBAAA,KAAA,CAAC,MAAD;IAAI,OAAO,OAAO;KAAE,GAAG,OAAO;KAAM,GAAG,OAAO;IAAS,IAAI,OAAO;IAAlE,UAAA,CACE,iBAAA,GAAA,kBAAA,KAAA,CAAC,UAAD;KACE,MAAK;KACL,OAAO,OAAO;KACd,iBAAe;KACf,eAAe;MAAE,QAAQ,CAAC,IAAI;KAAE;KAJlC,UAAA,CAME,iBAAA,GAAA,kBAAA,KAAA,CAAC,QAAD;MAAM,OAAO,OAAO;MAApB,UAAA;OACE,iBAAA,GAAA,kBAAA,IAAA,CAAC,QAAD;QAAM,OAAO,OAAO;QAAO,UAAA,EAAE;OAAY,CAAA;OACzC,iBAAA,GAAA,kBAAA,IAAA,CAAC,QAAD;QAAM,OAAO,OAAO;QAAQ,OAAO;QAAa,UAAA;OAAiB,CAAA;OAChE,QAAQ,iBAAA,GAAA,kBAAA,IAAA,CAAC,QAAD;QAAM,OAAO,OAAO;QAAU,UAAA,EAAE;OAAc,CAAA,IAAI;OAC3D,iBAAA,GAAA,kBAAA,IAAA,CAAC,QAAD;QAAM,OAAO,OAAO;SAAE,GAAG,OAAO;SAAS,GAAG,OAAO;QAAY,IAAI,OAAO;QAAU,UAAA,OAAO,MAAM;OAAU,CAAA;MACvG;KACN,CAAA,GAAA,iBAAA,GAAA,kBAAA,IAAA,CAAC,QAAD;MAAM,OAAO,OAAO;MAAc,UAAA,EAAE;KAAkB,CAAA,CAChD;IACP,CAAA,GAAA,OAEG,iBAAA,GAAA,kBAAA,KAAA,CAAC,OAAD;KAAK,OAAO,OAAO;KAAnB,UAAA;MACG,MAAM,YAAY,iBAAA,GAAA,kBAAA,KAAA,CAAC,KAAD;OAAG,OAAO,OAAO;OAAO,MAAK;OAA7B,UAAA;QAAuC,EAAE;QAAU;QAAG,MAAM;OAAa;MAAI,CAAA,IAAA;MAC/F,OAAO,KAAI,QAAO,iBAAA,GAAA,kBAAA,IAAA,CAAC,OAAD,EAAA,UAAsB,cAAc,GAAG,EAAO,GAApC,IAAI,KAAgC,CAAC;MAClE,iBAAA,GAAA,kBAAA,KAAA,CAAC,OAAD;OAAK,OAAO,OAAO;OAAnB,UAAA;QACG,SAAS,iBAAA,GAAA,kBAAA,IAAA,CAAC,KAAD;SAAG,OAAO,OAAO;SAAO,MAAK;SAAU,UAAA;QAAU,CAAA,IAAI;QAC/D,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD;SACE,MAAK;SACL,OAAO,OAAO;SACd,UAAU,CAAC,SAAS;SACpB,SAAS;SAER,UAAA,EAAE;QACG,CAAA;QACR,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD;SACE,MAAK;SACL,OAAO,OAAO;SACd,UAAU,CAAC,SAAS,QAAQ,KAAK;SACjC,eAAe;UAAE,KAAU;SAAE;SAE5B,UAAA,SAAS,EAAE,SAAS,EAAE;QACjB,CAAA;OACL;;KACF;IAEL,CAAA,IAAA,IACF;;EAER;;EASA,SAAS,GAAG,OAAe,UAA0B;GACnD,OAAO,OAAO,MAAM,IAAI,SAAS;EACnC;EAEA,MAAM,IAAI;GACR,QAAQ,GAAG,yBAAyB,wBAAwB;GAC5D,IAAI,GAAG,0BAA0B,aAAa;GAC9C,QAAQ,GAAG,0BAA0B,aAAa;GAClD,cAAc,GAAG,6BAA6B,SAAS;GACvD,gBAAgB,GAAG,+BAA+B,SAAS;GAC3D,eAAe,GAAG,8BAA8B,uBAAuB;GACvE,aAAa,GAAG,4BAA4B,uBAAuB;GACnE,OAAO,GAAG,2BAA2B,SAAS;GAC9C,OAAO,GAAG,6BAA6B,SAAS;GAChD,SAAS,GAAG,kCAAkC,wBAAwB;EACxE;EAEA,MAAM,SAA8C;GAClD,MAAM;IACJ,WAAW;IACX,QAAQ,aAAa,EAAE;IACvB,cAAc;IACd,YAAY,EAAE;IACd,YAAY;IACZ,UAAU;GACZ;GACA,UAAU;IACR,YAAY,EAAE;IACd,aAAa,EAAE;GACjB;GACA,QAAQ;IACN,SAAS;IACT,eAAe;IACf,YAAY;IACZ,KAAK;IACL,OAAO;IACP,SAAS;IACT,QAAQ;IACR,YAAY;IACZ,MAAM;IACN,OAAO;IACP,WAAW;IACX,QAAQ;GACV;GACA,WAAW;IAAE,SAAS;IAAQ,YAAY;IAAU,KAAK;IAAQ,OAAO;GAAO;GAC/E,MAAM;IAAE,MAAM;IAAY,UAAU;IAAG,UAAU;IAAQ,YAAY;IAAK,YAAY;IAAK,OAAO,EAAE;GAAa;GAIjH,QAAQ;IACN,MAAM;IACN,UAAU;IACV,UAAU;IACV,UAAU;IACV,YAAY;IACZ,OAAO,EAAE;IACT,YAAY;IACZ,UAAU;IACV,cAAc;GAChB;GACA,aAAa;IACX,SAAS;IACT,UAAU;IACV,YAAY;IACZ,OAAO,EAAE;IACT,YAAY;IACZ,UAAU;IACV,cAAc;GAChB;GACA,SAAS;IACP,MAAM;IACN,cAAc;IACd,SAAS;IACT,UAAU;IACV,YAAY;IACZ,YAAY;IACZ,YAAY;IACZ,YAAY,EAAE;IACd,OAAO,EAAE;GACX;GACA,SAAS;IAAE,MAAM;IAAQ,OAAO,EAAE;IAAe,UAAU;IAAQ,YAAY;GAAiB;GAChG,aAAa,EAAE,WAAW,iBAAiB;GAC3C,MAAM;IACJ,WAAW,aAAa,EAAE;IAC1B,QAAQ;IACR,eAAe;IACf,SAAS;IACT,eAAe;GACjB;GACA,OAAO;IACL,SAAS;IACT,eAAe;IACf,KAAK;IACL,SAAS;GACX;GACA,OAAO;IAAE,UAAU;IAAQ,YAAY;IAAK,YAAY;IAAK,OAAO,EAAE;GAAa;GACnF,MAAM;IAAE,QAAQ;IAAG,UAAU;IAAQ,YAAY;IAAK,OAAO,EAAE;GAAc;GAC7E,UAAU;IAAE,SAAS;IAAQ,YAAY;IAAU,KAAK;IAAO,QAAQ;GAAU;GACjF,OAAO;IACL,QAAQ;IACR,YAAY;IACZ,SAAS;IACT,MAAM;IACN,UAAU;IACV,YAAY;IACZ,OAAO,EAAE;IACT,QAAQ;IACR,WAAW;GACb;GACA,OAAO;IACL,QAAQ;IACR,SAAS;IACT,QAAQ,aAAa,EAAE;IACvB,cAAc;IACd,YAAY,EAAE;IACd,MAAM;IACN,UAAU;IACV,YAAY;IACZ,OAAO,EAAE;GACX;GACA,QAAQ;IACN,SAAS;IACT,YAAY;IACZ,gBAAgB;IAChB,KAAK;IACL,SAAS;IACT,WAAW,aAAa,EAAE;GAC5B;GACA,OAAO;IAAE,MAAM;IAAG,UAAU;IAAG,QAAQ;IAAG,UAAU;IAAQ,YAAY;IAAK,OAAO,EAAE;GAAM;GAC5F,SAAS;IACP,YAAY;IACZ,QAAQ,aAAa,EAAE;IACvB,cAAc;IACd,SAAS;IACT,MAAM;IACN,UAAU;IACV,YAAY;IACZ,YAAY;IACZ,OAAO,EAAE;IACT,QAAQ;GACV;GACA,MAAM;IACJ,YAAY;IACZ,QAAQ;IACR,cAAc;IACd,SAAS;IACT,MAAM;IACN,UAAU;IACV,YAAY;IACZ,YAAY,EAAE;IACd,OAAO,EAAE;IACT,QAAQ;GACV;EACF;;;;;;;;;;;;;;;;;;ECvlBA,SAAS,uBAA+B;GACtC,MAAM,QAAQ,WAAW,OAAO,gCAAgB,IAAI,WAAW,EAAE,CAAC;GAClE,MAAM,OAAO,IAAI,SAAS,MAAM,QAAQ,MAAM,YAAY,MAAM,UAAU;GAC1E,KAAK,SAAS,GAAI,KAAK,SAAS,CAAC,IAAI,KAAQ,EAAI;GACjD,KAAK,SAAS,GAAI,KAAK,SAAS,CAAC,IAAI,KAAQ,GAAI;GACjD,MAAM,MAAM,MAAM,KAAK,QAAO,SAAQ,KAAK,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE;GACjF,OAAO,GAAG,IAAI,MAAM,GAAG,CAAC,EAAE,GAAG,IAAI,MAAM,GAAG,EAAE,EAAE,GAAG,IAAI,MAAM,IAAI,EAAE,EAAE,GAAG,IAAI,MAAM,IAAI,EAAE,EAAE,GAAG,IAAI,MAAM,EAAE;EACzG;;;;;;EAOA,SAAgB,wBAAiC;GAC/C,MAAM,YAAY,WAAW;GAC7B,IAAI,cAAc,KAAA,GAAW,OAAO;GACpC,IAAI,OAAO,UAAU,eAAe,YAAY,OAAO;GACvD,IAAI,OAAO,UAAU,oBAAoB,YAAY,OAAO;GAC5D,IAAI;IAGF,MAAM,QAAQ,OAAO,eAAe,SAAS;IAC7C,IAAI,UAAU,QAAQ,OAAO,MAAM,eAAe,YAAY;KAC5D,OAAO,eAAe,OAAO,cAAc;MACzC,OAAO;MACP,UAAU;MACV,cAAc;KAChB,CAAC;KACD,OAAO;IACT;IAEA,OAAO,eAAe,WAAW,cAAc;KAC7C,OAAO;KACP,UAAU;KACV,cAAc;IAChB,CAAC;IACD,OAAO;GACT,QAAQ;IACN,OAAO;GACT;EACF;EAIA,sBAAsB;EAKtB,MAAa,OAAO;;EAGpB,MAAa,SAAS,CAAC,OAAO;;;;;EAM9B,SAAgB,MAAM,KAA0B;GAC9C,sBAAsB;GAkBtB,MAAM,oBAAoB;IAAE,IAAI;IAAe,OAAO;GAAG;GACzD,IAAI,MAAM,OAAO,wBAAwB,aAAa;IACpD,MAAM,IAAI,MAAM,SAAS;KACvB,MAAM;KACN,KAAK;KACL,GAAG;IACL,GAAG,cAAc;GACnB,CAAC;EACH"}
+{"version":3,"file":"client.js","names":["useState"],"sources":["../src/config-fields.ts","../src/client/lan-gateway-card.tsx","../src/client/index.ts"],"sourcesContent":["/**\n * The `lan-gateway` configuration field table: which settings keys exist, how\n * each one is rendered, and how a draft string becomes a config value or a\n * clear.\n *\n * The host and the browser card share this module. The host derives the key set\n * its config route accepts and the set an empty value clears from it; the card\n * renders its controls from it. A field therefore cannot be editable on one\n * side and unknown on the other, which is what let the card silently rewrite\n * keys it never showed.\n *\n * Because both halves import it, this module must stay dependency-free and\n * side-effect-free: no schemastery (the host schema remains the validating\n * authority, not this table), no node built-ins, no DOM, no I/O.\n *\n * @module @riceawa/dsh-lan-gateway/config-fields\n */\n\n/**\n * The wire shape of the `lan-gateway` config section, as the Settings card sees\n * it. Deliberately narrower than the host's `Config`: `cookieName` and the\n * retired `authRequired` are not card-editable. The config route applies a\n * patch, so a key absent here is left untouched rather than reset.\n */\nexport interface LanGatewaySettings {\n  enabled?: boolean\n  gatewayPort?: number\n  dshTargetPort?: number\n  lanCidrs?: string[]\n  lanPasswordless?: boolean\n  cookieMaxAgeDays?: number\n  tlsEnabled?: boolean\n  tlsMode?: 'self-signed' | 'custom'\n  tlsCertPath?: string\n  tlsKeyPath?: string\n  tlsSelfSignedHosts?: string\n  tlsCertMaxAgeDays?: number\n  allowInsecurePlaintext?: boolean\n  trustedTerminator?: string\n  secureCookies?: boolean\n}\n\n/** A settings key this table knows how to edit. */\nexport type ConfigFieldKey = keyof LanGatewaySettings\n\n/** How a field is rendered and parsed. */\nexport type FieldKind = 'boolean' | 'number' | 'text' | 'cidrs' | 'select' | 'tristate'\n\nexport interface FieldDef {\n  readonly field: ConfigFieldKey\n  readonly kind: FieldKind\n  /** An empty draft clears the key back to the composition layer. */\n  readonly optional?: boolean\n  /** The accepted values of a `select` field. */\n  readonly options?: readonly string[]\n}\n\n/** The three states of a tri-state field, in display order. */\nexport const TRISTATE_OPTIONS = ['auto', 'true', 'false'] as const\n\n/**\n * The editable settings, in display order. Adding a config key means adding it\n * here (the host whitelist and the card's controls both follow), to the\n * `Config` schema in `index.ts`, and to `listenerKey` when it changes listener\n * behavior.\n */\nexport const FIELDS: readonly FieldDef[] = [\n  { field: 'enabled', kind: 'boolean' },\n  { field: 'gatewayPort', kind: 'number' },\n  { field: 'dshTargetPort', kind: 'number', optional: true },\n  { field: 'lanCidrs', kind: 'cidrs' },\n  { field: 'lanPasswordless', kind: 'boolean' },\n  { field: 'cookieMaxAgeDays', kind: 'number' },\n  { field: 'tlsEnabled', kind: 'boolean' },\n  { field: 'tlsMode', kind: 'select', options: ['self-signed', 'custom'] },\n  { field: 'tlsSelfSignedHosts', kind: 'text' },\n  { field: 'tlsCertPath', kind: 'text', optional: true },\n  { field: 'tlsKeyPath', kind: 'text', optional: true },\n  { field: 'tlsCertMaxAgeDays', kind: 'number' },\n  { field: 'allowInsecurePlaintext', kind: 'boolean' },\n  { field: 'trustedTerminator', kind: 'text', optional: true },\n  { field: 'secureCookies', kind: 'tristate' },\n]\n\n/** Every settings key the config route accepts; anything else is ignored. */\nexport const CONFIG_FIELD_KEYS: ReadonlySet<string> = new Set(FIELDS.map(def => def.field as string))\n\n/** Keys an empty submitted value clears back to the composition layer. */\nexport const OPTIONAL_CONFIG_KEYS: ReadonlySet<string> = new Set(\n  FIELDS.filter(def => def.optional === true).map(def => def.field as string),\n)\n\n/** Render a stored value as draft text. */\nexport function formatValue(def: FieldDef, value: unknown): string {\n  switch (def.kind) {\n    case 'boolean': return value === true ? 'true' : 'false'\n    case 'number': return typeof value === 'number' ? String(value) : ''\n    case 'cidrs': return Array.isArray(value) ? value.join(', ') : ''\n    case 'select': return typeof value === 'string' ? value : (def.options?.[0] ?? '')\n    // Tri-state: an unset value is a distinct third state (\"auto\"), never \"false\".\n    case 'tristate': return value === true ? 'true' : value === false ? 'false' : 'auto'\n    case 'text': return typeof value === 'string' ? value : ''\n  }\n}\n\n/** One field's contribution to a config patch. */\nexport type Write = { kind: 'set'; value: unknown } | { kind: 'clear' }\n\n/** Parse draft text into a value for the POST body; undefined blocks saving. */\nexport function parseValue(def: FieldDef, text: string): Write | undefined {\n  const trimmed = text.trim()\n  switch (def.kind) {\n    case 'boolean':\n      if (trimmed === 'true') return { kind: 'set', value: true }\n      if (trimmed === 'false') return { kind: 'set', value: false }\n      return undefined\n    case 'number':\n      if (trimmed === '') return def.optional ? { kind: 'clear' } : undefined\n      if (!/^\\d+$/.test(trimmed)) return undefined\n      return { kind: 'set', value: Number(trimmed) }\n    case 'cidrs': {\n      const cidrs = trimmed.split(',').map(s => s.trim()).filter(s => s !== '')\n      return cidrs.length === 0 ? { kind: 'clear' } : { kind: 'set', value: cidrs }\n    }\n    case 'select':\n      return def.options?.includes(trimmed) ? { kind: 'set', value: trimmed } : undefined\n    case 'tristate':\n      // 'auto' clears the key so it re-inherits the composition layer (and the\n      // resolution rule), which is what an unset tri-state means.\n      if (trimmed === 'auto') return { kind: 'clear' }\n      if (trimmed === 'true') return { kind: 'set', value: true }\n      if (trimmed === 'false') return { kind: 'set', value: false }\n      return undefined\n    case 'text':\n      return trimmed === '' ? (def.optional ? { kind: 'clear' } : undefined) : { kind: 'set', value: trimmed }\n  }\n}\n","/**\n * The lan-gateway settings card, rendered by the official DSH Plugins page\n * through its `plugins.item` slot.\n *\n * ModLens-style: the card carries NO injected services. It reads and writes\n * the loopback-only `/lan-gateway/config` host route (the browser never sees\n * the settings seam or any secret), so the only platform service it needs is\n * the `slots` service every plugin already has.\n *\n * @module @riceawa/dsh-lan-gateway/client/card\n */\n\nimport { useEffect, useState, type ChangeEvent, type ReactNode } from 'react'\nimport type { PropsRuntime } from '@deepseek-ai/dsh-client-ui-slots'\n// Type-only. The Plugins page owns the `plugins.item` contract, and its own\n// doc says a registrant merges that contract with `import type` instead of\n// importing the package at runtime. Taking the contract from its owner is also\n// what turns the next upstream rename of this slot into a compile error here,\n// rather than a card that quietly stops rendering.\nimport type {} from '@deepseek-ai/dsh-client-ui-plugin-manager/client'\nimport {\n  FIELDS,\n  TRISTATE_OPTIONS,\n  formatValue,\n  parseValue,\n  type FieldDef,\n  type LanGatewaySettings,\n} from '../config-fields.ts'\n\n/**\n * Props the renderer binds for this card. The Plugins page asks for either the\n * card's one-liner (`summary`) or the body of its own page (`page`), and draws\n * the page's title, icon, and crumb itself. The card needs no injected face —\n * it fetches its own route.\n */\nexport type LanGatewayCardProps = PropsRuntime<'plugins.item'>\n\n/**\n * The card's field table and value codecs live in `config-fields.ts`, shared\n * with the host: the host's config route decides which submitted keys are\n * editable and which empty value means \"clear\", and a table duplicated here\n * would let the two disagree about a field the card can render but the route\n * would refuse. Re-exported so the existing tests keep their import path.\n */\nexport { FIELDS, TRISTATE_OPTIONS, formatValue, parseValue }\nexport type { FieldDef, LanGatewaySettings }\n\n/** GET /lan-gateway/config response. */\ninterface RouteState {\n  config: LanGatewaySettings\n  running: boolean\n  port: number\n  tls: string\n  lastError: string | null\n}\n\n/* ------------------------------------------------------------------ */\n/* Bilingual copy (ModLens-style: two small sets, picked by browser)   */\n/* ------------------------------------------------------------------ */\n\ninterface Labels {\n  title: string\n  description: string\n  unsaved: string\n  save: string\n  saving: string\n  discard: string\n  reset: string\n  readOnly: string\n  saveFailed: string\n  loadFailed: string\n  emptyMeansClear: string\n  running: string\n  stopped: string\n  tls: string\n  lastError: string\n  [key: `field.${string}`]: string\n  [key: `hint.${string}`]: string\n  [key: `opt.${string}`]: string\n}\n\nconst LABELS: Record<'zh' | 'en', Labels> = {\n  zh: {\n    title: 'LAN 网关',\n    description: '远程访问开关、端口、TLS 证书、受信网段等网关设置',\n    unsaved: '未保存',\n    save: '保存',\n    saving: '保存中…',\n    discard: '放弃',\n    reset: '重置',\n    readOnly: '网关设置只能在宿主机本机打开 dsh web 时修改：配置路由仅监听回环地址，经网关远程访问的浏览器会被拒绝。远程请改用 lan_gateway 工具。',\n    saveFailed: '保存未生效，请检查输入后重试。',\n    loadFailed: '无法读取网关配置',\n    emptyMeansClear: '留空 = 使用默认',\n    running: '运行中',\n    stopped: '已停止',\n    tls: 'TLS',\n    lastError: '上次错误',\n    'field.enabled': '启用网关',\n    'hint.enabled': '启动时监听 0.0.0.0 网关端口',\n    'field.gatewayPort': '网关端口',\n    'hint.gatewayPort': '绑定到 0.0.0.0 的监听端口（默认 3081）',\n    'field.dshTargetPort': 'dsh 目标端口',\n    'hint.dshTargetPort': '留空则自动跟随 dsh web 端口（默认 3080）',\n    'field.lanCidrs': '免密 LAN 网段',\n    'hint.lanCidrs': '逗号分隔的 CIDR，如 10.0.0.0/8, 192.168.0.0/16',\n    'field.lanPasswordless': 'LAN 免登录',\n    'hint.lanPasswordless': 'LAN/回环来源跳过网关登录页，但仍共用同一上游会话（需 dsh ≥ 0.1.2）',\n    'field.allowInsecurePlaintext': '允许明文 HTTP',\n    'hint.allowInsecurePlaintext': '危险：关闭 TLS 或受信终止代理时仍启动监听，密码与会话将以明文传输',\n    'field.trustedTerminator': '受信 TLS 终止代理',\n    'hint.trustedTerminator': '可选：声明前置代理标识，视为加密入口（如 nginx）。留空 = 未声明。注意：登录限流以 TCP 源地址为键，代理之后所有浏览器共用一个额度（5 次/分钟）',\n    'field.secureCookies': '会话 cookie 的 Secure 属性',\n    'hint.secureCookies': '自动 = TLS 或已声明受信终止代理时加 Secure。受信代理只做明文鉴权、浏览器走 http 访问时须设为 false，否则浏览器拒收 Secure cookie，登录会无限弹回登录页',\n    'opt.auto': '自动',\n    'opt.true': '始终 Secure',\n    'opt.false': '不加 Secure（明文浏览器入口）',\n    'field.cookieMaxAgeDays': '会话有效期（天）',\n    'hint.cookieMaxAgeDays': '登录 cookie 的存活天数（默认 7）',\n    'field.tlsEnabled': '启用 TLS（HTTPS）',\n    'hint.tlsEnabled': '以 HTTPS 提供网关服务',\n    'field.tlsMode': '证书来源',\n    'hint.tlsMode': 'self-signed = 自动生成自签名证书；custom = 使用自己的证书',\n    'field.tlsSelfSignedHosts': '自签名证书域名/IP',\n    'hint.tlsSelfSignedHosts': '逗号分隔，写入证书 SAN，如 localhost, 192.168.1.5。仅影响下次换发：已有证书沿用至到期，改动不会立刻生效',\n    'field.tlsCertPath': '证书文件路径（custom）',\n    'hint.tlsCertPath': 'PEM 格式证书（或证书链）的绝对路径',\n    'field.tlsKeyPath': '私钥文件路径（custom）',\n    'hint.tlsKeyPath': '与证书配套的 PEM 私钥绝对路径',\n    'field.tlsCertMaxAgeDays': '自签名证书有效期（天）',\n    'hint.tlsCertMaxAgeDays': '默认 825（约 27 个月）。仅影响下次换发：已有证书沿用至到期',\n  },\n  en: {\n    title: 'LAN Gateway',\n    description: 'Remote-access switch, port, TLS certificate, trusted CIDRs and more',\n    unsaved: 'Unsaved',\n    save: 'Save',\n    saving: 'Saving…',\n    discard: 'Discard',\n    reset: 'Reset',\n    readOnly: 'Gateway settings can only be changed where dsh web runs locally: the config route listens on loopback only, so a browser reaching dsh through the gateway is refused. Use the lan_gateway tool remotely.',\n    saveFailed: 'The save did not land — check the inputs and retry.',\n    loadFailed: 'Cannot read the gateway configuration',\n    emptyMeansClear: 'Empty = default',\n    running: 'Running',\n    stopped: 'Stopped',\n    tls: 'TLS',\n    lastError: 'Last error',\n    'field.enabled': 'Enable gateway',\n    'hint.enabled': 'Listen on the gateway port at boot',\n    'field.gatewayPort': 'Gateway port',\n    'hint.gatewayPort': 'Port bound on 0.0.0.0 (default 3081)',\n    'field.dshTargetPort': 'dsh target port',\n    'hint.dshTargetPort': 'Leave empty to follow the dsh web port (default 3080)',\n    'field.lanCidrs': 'Password-free LAN CIDRs',\n    'hint.lanCidrs': 'Comma separated CIDRs, e.g. 10.0.0.0/8, 192.168.0.0/16',\n    'field.lanPasswordless': 'LAN skip login',\n    'hint.lanPasswordless': 'LAN/loopback sources skip the gateway login page but still ride one shared upstream session (needs dsh >= 0.1.2)',\n    'field.allowInsecurePlaintext': 'Allow plaintext HTTP',\n    'hint.allowInsecurePlaintext': 'Dangerous: start the listener even without TLS or a trusted terminator; passwords and sessions travel in clear',\n    'field.trustedTerminator': 'Trusted TLS terminator',\n    'hint.trustedTerminator': 'Optional identifier for a front proxy (e.g. nginx) treated as the encrypted ingress. Empty = none declared. Note: login rate limiting keys on the TCP source address, so behind a proxy every browser shares one budget (5/min)',\n    'field.secureCookies': 'Session cookie Secure attribute',\n    'hint.secureCookies': 'Auto = Secure when TLS or a trusted terminator is declared. Set false when the trusted proxy only authenticates over plaintext and browsers reach it over http — otherwise browsers drop the Secure cookie and every login bounces back to the login page',\n    'opt.auto': 'Auto',\n    'opt.true': 'Always Secure',\n    'opt.false': 'No Secure (plaintext browser ingress)',\n    'field.cookieMaxAgeDays': 'Session lifetime (days)',\n    'hint.cookieMaxAgeDays': 'Login cookie lifetime (default 7)',\n    'field.tlsEnabled': 'Enable TLS (HTTPS)',\n    'hint.tlsEnabled': 'Serve the gateway over HTTPS',\n    'field.tlsMode': 'Certificate source',\n    'hint.tlsMode': 'self-signed = auto-generated certificate; custom = your own files',\n    'field.tlsSelfSignedHosts': 'Self-signed hosts (SANs)',\n    'hint.tlsSelfSignedHosts': 'Comma separated DNS/IP names, e.g. localhost, 192.168.1.5. Applies to the next issuance only: an existing certificate is reused until it expires',\n    'field.tlsCertPath': 'Certificate path (custom)',\n    'hint.tlsCertPath': 'Absolute path to a PEM certificate (or chain)',\n    'field.tlsKeyPath': 'Private key path (custom)',\n    'hint.tlsKeyPath': 'Absolute path to the matching PEM private key',\n    'field.tlsCertMaxAgeDays': 'Self-signed validity (days)',\n    'hint.tlsCertMaxAgeDays': 'Default 825 (about 27 months). Applies to the next issuance only: an existing certificate is reused until it expires',\n  },\n}\n\nfunction labels(): Labels {\n  const lang = (typeof navigator !== 'undefined' ? navigator.language : 'en').toLowerCase()\n  return lang.startsWith('zh') ? LABELS.zh : LABELS.en\n}\n\n/**\n * The card's title in the browser's language, for the Plugins page's list\n * entry. A thunk so the label follows the page's locale without re-registering.\n * @returns the localized card title.\n */\nexport function cardTitle(): string {\n  return labels().title\n}\n\n/* ------------------------------------------------------------------ */\n/* Card                                                                */\n/* ------------------------------------------------------------------ */\n\n/**\n * Render the LAN gateway card. Self-loading: fetches the config route on\n * mount, posts the edited config on save.\n *\n * `view` swaps between the card's one-liner and its page body, so the branch\n * sits after the hooks: the Plugins page re-renders one contribution under the\n * other view when the card is opened.\n * @param props - the view the Plugins page is asking for.\n * @returns the one-liner, the card, or nothing while the route is unreachable.\n */\nexport function LanGatewayCard(props: LanGatewayCardProps): ReactNode {\n  const t = labels()\n  const [open, setOpen] = useState(false)\n  const [route, setRoute] = useState<RouteState | null>(null)\n  const [loadFailed, setLoadFailed] = useState(false)\n  const [drafts, setDrafts] = useState<Partial<Record<string, string>>>({})\n  const [saving, setSaving] = useState(false)\n  const [failed, setFailed] = useState<string | null>(null)\n\n  useEffect(() => {\n    let cancelled = false\n    fetch('/lan-gateway/config')\n      .then(async (response) => {\n        if (cancelled) return\n        if (!response.ok) throw new Error(`HTTP ${response.status}`)\n        setRoute(await response.json() as RouteState)\n      })\n      .catch(() => {\n        if (!cancelled) setLoadFailed(true)\n      })\n    return () => { cancelled = true }\n  }, [])\n\n  // The Plugins page lists this plugin as one card and opens its own page on\n  // demand: `summary` is the one-liner the list shows, `page` the body. The\n  // hooks above run for both views, because the same contribution flips\n  // between them.\n  if (props.view === 'summary') return t.description\n\n  // A remote browser reaches this card through the gateway, which answers 403\n  // for the plugin's own prefix by design, so the route is unreachable exactly\n  // where a user is most likely to go looking for the setting. Rendering\n  // nothing left them with a blank entry and no way to tell a missing card from\n  // a broken one; say what is wrong and where the card does work instead.\n  if (loadFailed) {\n    return (\n      <div style={styles.card}>\n        <div style={styles.header}>\n          <span style={styles.headerTop}>\n            <span style={styles.name}>{t.title}</span>\n          </span>\n          <span style={styles.description}>{t.loadFailed}</span>\n        </div>\n        <div style={styles.body}>\n          <p style={styles.hint}>{t.readOnly}</p>\n        </div>\n      </div>\n    )\n  }\n  if (route === null) return null\n\n  const { config } = route\n  const draftOf = (field: keyof LanGatewaySettings): string =>\n    drafts[field] ?? formatValue(FIELDS.find(f => f.field === field)!, config[field])\n\n  const stage = (field: string, text: string): void => {\n    setDrafts(prev => ({ ...prev, [field]: text }))\n    setFailed(null)\n  }\n\n  const resetField = (def: FieldDef): void => {\n    setDrafts(prev => {\n      const next = { ...prev }\n      delete next[def.field]\n      return next\n    })\n  }\n\n  const discard = (): void => {\n    setDrafts({})\n    setFailed(null)\n  }\n\n  const invalid = (): boolean =>\n    Object.entries(drafts).some(([field, text]) => {\n      const def = FIELDS.find(f => f.field === field)\n      return def === undefined || parseValue(def, text ?? '') === undefined\n    })\n\n  const dirty = Object.keys(drafts).length > 0\n\n  const save = async (): Promise<void> => {\n    if (!dirty || saving || invalid()) return\n    setSaving(true)\n    setFailed(null)\n    try {\n      // A patch of the edited fields only, never the whole config: the card\n      // cannot express every key the section may hold (a custom `cookieName`,\n      // say), and posting a synthesized full config made the route treat those\n      // keys as submitted — resetting each one to its schema default.\n      const patch: Record<string, unknown> = {}\n      for (const [field, text] of Object.entries(drafts)) {\n        const def = FIELDS.find(f => f.field === field)\n        if (def === undefined) continue\n        const write = parseValue(def, text ?? '')\n        if (write === undefined) continue\n        patch[field] = write.kind === 'clear' ? null : write.value\n      }\n      const response = await fetch('/lan-gateway/config', {\n        method: 'POST',\n        headers: { 'content-type': 'application/json' },\n        body: JSON.stringify(patch),\n      })\n      const body = await response.json().catch(() => ({})) as Partial<RouteState> & { error?: string }\n      if (!response.ok) {\n        setFailed(body.error ?? `HTTP ${response.status}`)\n        return\n      }\n      if (body.config !== undefined) {\n        setRoute({\n          config: body.config,\n          running: body.running ?? false,\n          port: body.port ?? 0,\n          tls: body.tls ?? '',\n          lastError: body.lastError ?? null,\n        })\n      }\n      setDrafts({})\n    } catch {\n      setFailed(t.saveFailed)\n    } finally {\n      setSaving(false)\n    }\n  }\n\n  const renderControl = (def: FieldDef): ReactNode => {\n    const field = def.field\n    const label = t[`field.${field}`]\n    const hint = t[`hint.${field}`]\n    const text = draftOf(field)\n    switch (def.kind) {\n      case 'boolean':\n        return (\n          <div style={styles.field}>\n            <label style={styles.checkRow}>\n              <input\n                type=\"checkbox\"\n                checked={text === 'true'}\n                disabled={saving}\n                onChange={(e: ChangeEvent<HTMLInputElement>) =>\n                  stage(field, e.target.checked ? 'true' : 'false')}\n              />\n              <span style={styles.label}>{label}</span>\n              <button\n                type=\"button\"\n                style={styles.reset}\n                disabled={saving || !drafts[field]}\n                onClick={() => resetField(def)}\n              >\n                {t.reset}\n              </button>\n            </label>\n            <span style={styles.hint}>{hint}</span>\n          </div>\n        )\n      case 'select':\n      case 'tristate': {\n        // A tri-state renders as a three-way select because neither a checkbox\n        // (cannot express \"unset\") nor a text field (cannot express false)\n        // distinguishes auto from an explicit false.\n        const options = def.kind === 'tristate' ? TRISTATE_OPTIONS : (def.options ?? [])\n        return (\n          <div style={styles.field}>\n            <label style={styles.label} htmlFor={`lan-gw-${field}`}>{label}</label>\n            <select\n              id={`lan-gw-${field}`}\n              style={styles.input}\n              value={text}\n              disabled={saving}\n              onChange={(e: ChangeEvent<HTMLSelectElement>) => stage(field, e.target.value)}\n            >\n              {options.map(option => (\n                <option key={option} value={option}>\n                  {def.kind === 'tristate' ? t[`opt.${option}`] : option}\n                </option>\n              ))}\n            </select>\n            <span style={styles.hint}>{hint}</span>\n            <button\n              type=\"button\"\n              style={styles.reset}\n              disabled={saving || !drafts[field]}\n              onClick={() => resetField(def)}\n            >\n              {t.reset}\n            </button>\n          </div>\n        )\n      }\n      default:\n        return (\n          <div style={styles.field}>\n            <label style={styles.label} htmlFor={`lan-gw-${field}`}>{label}</label>\n            <input\n              id={`lan-gw-${field}`}\n              style={styles.input}\n              type={def.kind === 'number' ? 'number' : 'text'}\n              value={text}\n              disabled={saving}\n              placeholder={def.optional ? t.emptyMeansClear : undefined}\n              onChange={(e: ChangeEvent<HTMLInputElement>) => stage(field, e.target.value)}\n            />\n            <span style={styles.hint}>{hint}</span>\n          </div>\n        )\n    }\n  }\n\n  const statusLine = `${route.running ? t.running : t.stopped} · ${t.tls}: ${route.tls} · :${route.port}`\n\n  return (\n    <div style={open ? { ...styles.card, ...styles.cardOpen } : styles.card}>\n      <button\n        type=\"button\"\n        style={styles.header}\n        aria-expanded={open}\n        onClick={() => { setOpen(!open) }}\n      >\n        <span style={styles.headerTop}>\n          <span style={styles.name}>{t.title}</span>\n          <span style={styles.status} title={statusLine}>{statusLine}</span>\n          {dirty ? <span style={styles.pending}>{t.unsaved}</span> : null}\n          <span style={open ? { ...styles.chevron, ...styles.chevronOpen } : styles.chevron}>{open ? '▾' : '▸'}</span>\n        </span>\n        <span style={styles.description}>{t.description}</span>\n      </button>\n      {open\n        ? (\n          <div style={styles.body}>\n            {route.lastError ? <p style={styles.error} role=\"status\">{t.lastError}: {route.lastError}</p> : null}\n            {FIELDS.map(def => <div key={def.field}>{renderControl(def)}</div>)}\n            <div style={styles.footer}>\n              {failed ? <p style={styles.error} role=\"status\">{failed}</p> : null}\n              <button\n                type=\"button\"\n                style={styles.discard}\n                disabled={!dirty || saving}\n                onClick={discard}\n              >\n                {t.discard}\n              </button>\n              <button\n                type=\"button\"\n                style={styles.save}\n                disabled={!dirty || invalid() || saving}\n                onClick={() => { void save() }}\n              >\n                {saving ? t.saving : t.save}\n              </button>\n            </div>\n          </div>\n        )\n        : null}\n    </div>\n  )\n}\n\n/* ------------------------------------------------------------------ */\n/* Styling — the official DSH theme tokens (light/dark aware), with    */\n/* neutral fallbacks so the card never renders black-on-black or       */\n/* white-on-white even if a token is missing.                          */\n/* ------------------------------------------------------------------ */\n\n/** Theme token with a fallback for token-less environments. */\nfunction tk(token: string, fallback: string): string {\n  return `var(${token}, ${fallback})`\n}\n\nconst L = {\n  border: tk('--dsw-alias-border-l2', 'rgba(127,127,127,0.35)'),\n  bg: tk('--dsw-alias-bg-layer-3', 'transparent'),\n  bgOpen: tk('--dsw-alias-bg-layer-2', 'transparent'),\n  labelPrimary: tk('--dsw-alias-label-primary', 'inherit'),\n  labelSecondary: tk('--dsw-alias-label-secondary', 'inherit'),\n  labelTertiary: tk('--dsw-alias-label-tertiary', 'rgba(127,127,127,0.8)'),\n  labelDimmed: tk('--dsw-alias-label-dimmed', 'rgba(127,127,127,0.6)'),\n  error: tk('--dsw-alias-label-error', '#d1242f'),\n  brand: tk('--dsw-alias-brand-primary', '#4f6ef7'),\n  badgeBg: tk('--dsw-alias-bg-module-platform', 'rgba(127,127,127,0.14)'),\n}\n\nconst styles: Record<string, React.CSSProperties> = {\n  card: {\n    listStyle: 'none',\n    border: `1px solid ${L.border}`,\n    borderRadius: '12px',\n    background: L.bg,\n    transition: 'border-color .16s, background .16s',\n    overflow: 'hidden',\n  },\n  cardOpen: {\n    background: L.bgOpen,\n    borderColor: L.labelDimmed,\n  },\n  header: {\n    display: 'flex',\n    flexDirection: 'column',\n    alignItems: 'stretch',\n    gap: '6px',\n    width: '100%',\n    padding: '14px 16px',\n    border: 0,\n    background: 'none',\n    font: 'inherit',\n    color: 'inherit',\n    textAlign: 'left',\n    cursor: 'pointer',\n  },\n  headerTop: { display: 'flex', alignItems: 'center', gap: '12px', width: '100%' },\n  name: { flex: '1 1 auto', minWidth: 0, fontSize: '15px', fontWeight: 600, lineHeight: 1.4, color: L.labelPrimary },\n  // The status carries a verbose TLS cert summary; cap it and ellipsize so it\n  // can never swallow the row or squeeze the title (the old nowrap alone\n  // caused the description to be pushed into a thin wrapping column).\n  status: {\n    flex: '0 1 auto',\n    minWidth: 0,\n    maxWidth: '60%',\n    fontSize: '11px',\n    lineHeight: 1.4,\n    color: L.labelTertiary,\n    whiteSpace: 'nowrap',\n    overflow: 'hidden',\n    textOverflow: 'ellipsis',\n  },\n  description: {\n    display: 'block',\n    fontSize: '13px',\n    lineHeight: 1.5,\n    color: L.labelTertiary,\n    whiteSpace: 'nowrap',\n    overflow: 'hidden',\n    textOverflow: 'ellipsis',\n  },\n  pending: {\n    flex: 'none',\n    borderRadius: '999px',\n    padding: '1px 8px',\n    fontSize: '11px',\n    lineHeight: '17px',\n    fontWeight: 500,\n    whiteSpace: 'nowrap',\n    background: L.badgeBg,\n    color: L.labelSecondary,\n  },\n  chevron: { flex: 'none', color: L.labelTertiary, fontSize: '12px', transition: 'transform .16s' },\n  chevronOpen: { transform: 'rotate(180deg)' },\n  body: {\n    borderTop: `1px solid ${L.border}`,\n    margin: '0 16px',\n    paddingBottom: '8px',\n    display: 'flex',\n    flexDirection: 'column',\n  },\n  field: {\n    display: 'flex',\n    flexDirection: 'column',\n    gap: '6px',\n    padding: '12px 0',\n  },\n  label: { fontSize: '13px', fontWeight: 500, lineHeight: 1.5, color: L.labelPrimary },\n  hint: { margin: 0, fontSize: '12px', lineHeight: 1.5, color: L.labelTertiary },\n  checkRow: { display: 'flex', alignItems: 'center', gap: '8px', cursor: 'pointer' },\n  reset: {\n    border: 'none',\n    background: 'none',\n    padding: 0,\n    font: 'inherit',\n    fontSize: '12px',\n    lineHeight: 1.5,\n    color: L.labelSecondary,\n    cursor: 'pointer',\n    alignSelf: 'flex-start',\n  },\n  input: {\n    height: '34px',\n    padding: '0 12px',\n    border: `1px solid ${L.border}`,\n    borderRadius: '8px',\n    background: L.bg,\n    font: 'inherit',\n    fontSize: '13px',\n    lineHeight: 1.5,\n    color: L.labelPrimary,\n  },\n  footer: {\n    display: 'flex',\n    alignItems: 'center',\n    justifyContent: 'flex-end',\n    gap: '8px',\n    padding: '12px 0 4px',\n    borderTop: `1px solid ${L.border}`,\n  },\n  error: { flex: 1, minWidth: 0, margin: 0, fontSize: '12px', lineHeight: 1.5, color: L.error },\n  discard: {\n    appearance: 'none',\n    border: `1px solid ${L.border}`,\n    borderRadius: '8px',\n    padding: '5px 14px',\n    font: 'inherit',\n    fontSize: '13px',\n    lineHeight: 1.5,\n    background: 'none',\n    color: L.labelSecondary,\n    cursor: 'pointer',\n  },\n  save: {\n    appearance: 'none',\n    border: '1px solid transparent',\n    borderRadius: '8px',\n    padding: '5px 14px',\n    font: 'inherit',\n    fontSize: '13px',\n    lineHeight: 1.5,\n    background: L.labelPrimary,\n    color: L.bg,\n    cursor: 'pointer',\n  },\n}\n","/**\n * @riceawa/dsh-lan-gateway — browser half.\n *\n * Two jobs:\n * 1. Insecure-origin UUID shim: the gateway can serve the GUI over plain HTTP\n *    on LAN addresses, where browsers lack `crypto.randomUUID()`. This bundle\n *    installs a getRandomValues-backed `randomUUID` on the Crypto prototype at\n *    module scope. With TLS enabled the origin is secure and the shim is a\n *    no-op.\n * 2. Settings card: registers the LAN gateway card into the official Plugins\n *    page (`plugins.item` slot) so port, CIDRs, auth, and TLS stay adjustable\n *    from the GUI.\n */\n\n/** RFC 4122 v4 UUID from crypto.getRandomValues (available on insecure origins). */\nfunction uuidFromRandomValues(): string {\n  const bytes = globalThis.crypto.getRandomValues(new Uint8Array(16))\n  const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength)\n  view.setUint8(6, (view.getUint8(6) & 0x0f) | 0x40)\n  view.setUint8(8, (view.getUint8(8) & 0x3f) | 0x80)\n  const hex = Array.from(bytes, byte => byte.toString(16).padStart(2, '0')).join('')\n  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`\n}\n\n/**\n * Install `randomUUID` on the browser Crypto prototype when the platform\n * lacks it. Idempotent; re-checks every call.\n * @returns `true` when the shim was installed by this call.\n */\nexport function installRandomUuidShim(): boolean {\n  const cryptoObj = globalThis.crypto\n  if (cryptoObj === undefined) return false\n  if (typeof cryptoObj.randomUUID === 'function') return false\n  if (typeof cryptoObj.getRandomValues !== 'function') return false\n  try {\n    // Browsers expose crypto.randomUUID through the Crypto prototype; patching\n    // the prototype (not the instance) covers `crypto.randomUUID()` everywhere.\n    const proto = Object.getPrototypeOf(cryptoObj) as { randomUUID?: unknown } | null\n    if (proto !== null && typeof proto.randomUUID !== 'function') {\n      Object.defineProperty(proto, 'randomUUID', {\n        value: uuidFromRandomValues,\n        writable: true,\n        configurable: true,\n      })\n      return true\n    }\n    // Fallback: direct instance property (sandboxed/odd environments).\n    Object.defineProperty(cryptoObj, 'randomUUID', {\n      value: uuidFromRandomValues,\n      writable: true,\n      configurable: true,\n    })\n    return true\n  } catch {\n    return false\n  }\n}\n\n// Module scope: the shim is live as soon as this bundle is evaluated, before\n// any RPC/session code runs. apply() re-runs it as a belt-and-braces re-check.\ninstallRandomUuidShim()\n\nimport type { ClientContext } from '@deepseek-ai/dsh-client-runtime/client'\n// Type-only, and never bundled: the Plugins page's slot contract (`plugins.item`)\n// and the settings domain's `configForms` service both resolve from the web\n// shell's frozen module table. Importing them is what subjects the registration\n// below to the platform's own contract instead of a local copy that drifts the\n// next time upstream renames a slot.\nimport type {} from '@deepseek-ai/dsh-client-ui-plugin-manager/client'\nimport type {} from '@deepseek-ai/dsh-client-ui-settings/client'\nimport { LanGatewayCard, cardTitle } from './lan-gateway-card.tsx'\n\nexport const name = 'dsh-lan-gateway'\n\n/**\n * The profile entry id this plugin's bundle patch composes it under, and the\n * settings namespace dsh ≥ 0.1.7 addresses every write by.\n */\nconst ENTRY_ID = 'dsh-lan-gateway'\n\n/** The slots service the card rides, and the settings mirror the gate reads. */\nexport const inject = ['slots', 'configForms']\n\n/**\n * Mount the settings card and the UUID shim.\n * @param ctx - the browser plugin context.\n */\nexport function apply(ctx: ClientContext): void {\n  installRandomUuidShim()\n\n  // The card rides the official Plugins page. Like ModLens it registers with no\n  // inject face and fetches its own loopback config route, so it depends on no\n  // settings, locale, or connection service.\n  //\n  // dsh 0.1.7 replaced the namespace-keyed `settings.plugin.item` slot with the\n  // list slot `plugins.item`, which is where a host-plane plugin's own\n  // configuration page belongs (\"one companion package per host-plane\n  // namespace\"); the page renders the contribution as the card's one-liner and,\n  // once opened, as the body of the plugin's own page. Registering into the\n  // retired slot left the card invisible on 0.1.7.\n  //\n  // `whileServed` keeps the entry off the page until the Host's settings mirror\n  // serves this plugin's entry. That is the one gate worth having: without a\n  // Loader entry there is nothing to write to, and the card would appear only\n  // to fail every save with the route's 409.\n  ctx.effect(() => ctx.configForms.whileServed([ENTRY_ID], () =>\n    ctx.slots.inject('plugins.item', () => ctx.slots.register({\n      name: 'plugins.item',\n      id: ENTRY_ID,\n      order: 30,\n      label: () => cardTitle(),\n    }, LanGatewayCard))))\n}\n"],"mappings":";;;;;;;;;;EA0DA,MAAa,mBAAmB;GAAC;GAAQ;GAAQ;EAAO;;;;;;;EAQxD,MAAa,SAA8B;GACzC;IAAE,OAAO;IAAW,MAAM;GAAU;GACpC;IAAE,OAAO;IAAe,MAAM;GAAS;GACvC;IAAE,OAAO;IAAiB,MAAM;IAAU,UAAU;GAAK;GACzD;IAAE,OAAO;IAAY,MAAM;GAAQ;GACnC;IAAE,OAAO;IAAmB,MAAM;GAAU;GAC5C;IAAE,OAAO;IAAoB,MAAM;GAAS;GAC5C;IAAE,OAAO;IAAc,MAAM;GAAU;GACvC;IAAE,OAAO;IAAW,MAAM;IAAU,SAAS,CAAC,eAAe,QAAQ;GAAE;GACvE;IAAE,OAAO;IAAsB,MAAM;GAAO;GAC5C;IAAE,OAAO;IAAe,MAAM;IAAQ,UAAU;GAAK;GACrD;IAAE,OAAO;IAAc,MAAM;IAAQ,UAAU;GAAK;GACpD;IAAE,OAAO;IAAqB,MAAM;GAAS;GAC7C;IAAE,OAAO;IAA0B,MAAM;GAAU;GACnD;IAAE,OAAO;IAAqB,MAAM;IAAQ,UAAU;GAAK;GAC3D;IAAE,OAAO;IAAiB,MAAM;GAAW;EAC7C;EAGsD,IAAI,IAAI,OAAO,KAAI,QAAO,IAAI,KAAe,CAAC;EAG3C,IAAI,IAC3D,OAAO,QAAO,QAAO,IAAI,aAAa,IAAI,CAAC,CAAC,KAAI,QAAO,IAAI,KAAe,CAC5E;;EAGA,SAAgB,YAAY,KAAe,OAAwB;GACjE,QAAQ,IAAI,MAAZ;IACE,KAAK,WAAW,OAAO,UAAU,OAAO,SAAS;IACjD,KAAK,UAAU,OAAO,OAAO,UAAU,WAAW,OAAO,KAAK,IAAI;IAClE,KAAK,SAAS,OAAO,MAAM,QAAQ,KAAK,IAAI,MAAM,KAAK,IAAI,IAAI;IAC/D,KAAK,UAAU,OAAO,OAAO,UAAU,WAAW,QAAS,IAAI,UAAU,MAAM;IAE/E,KAAK,YAAY,OAAO,UAAU,OAAO,SAAS,UAAU,QAAQ,UAAU;IAC9E,KAAK,QAAQ,OAAO,OAAO,UAAU,WAAW,QAAQ;GAC1D;EACF;;EAMA,SAAgB,WAAW,KAAe,MAAiC;GACzE,MAAM,UAAU,KAAK,KAAK;GAC1B,QAAQ,IAAI,MAAZ;IACE,KAAK;KACH,IAAI,YAAY,QAAQ,OAAO;MAAE,MAAM;MAAO,OAAO;KAAK;KAC1D,IAAI,YAAY,SAAS,OAAO;MAAE,MAAM;MAAO,OAAO;KAAM;KAC5D;IACF,KAAK;KACH,IAAI,YAAY,IAAI,OAAO,IAAI,WAAW,EAAE,MAAM,QAAQ,IAAI,KAAA;KAC9D,IAAI,CAAC,QAAQ,KAAK,OAAO,GAAG,OAAO,KAAA;KACnC,OAAO;MAAE,MAAM;MAAO,OAAO,OAAO,OAAO;KAAE;IAC/C,KAAK,SAAS;KACZ,MAAM,QAAQ,QAAQ,MAAM,GAAG,CAAC,CAAC,KAAI,MAAK,EAAE,KAAK,CAAC,CAAC,CAAC,QAAO,MAAK,MAAM,EAAE;KACxE,OAAO,MAAM,WAAW,IAAI,EAAE,MAAM,QAAQ,IAAI;MAAE,MAAM;MAAO,OAAO;KAAM;IAC9E;IACA,KAAK,UACH,OAAO,IAAI,SAAS,SAAS,OAAO,IAAI;KAAE,MAAM;KAAO,OAAO;IAAQ,IAAI,KAAA;IAC5E,KAAK;KAGH,IAAI,YAAY,QAAQ,OAAO,EAAE,MAAM,QAAQ;KAC/C,IAAI,YAAY,QAAQ,OAAO;MAAE,MAAM;MAAO,OAAO;KAAK;KAC1D,IAAI,YAAY,SAAS,OAAO;MAAE,MAAM;MAAO,OAAO;KAAM;KAC5D;IACF,KAAK,QACH,OAAO,YAAY,KAAM,IAAI,WAAW,EAAE,MAAM,QAAQ,IAAI,KAAA,IAAa;KAAE,MAAM;KAAO,OAAO;IAAQ;GAC3G;EACF;;;;;;;;;;;;;;ECvDA,MAAM,SAAsC;GAC1C,IAAI;IACF,OAAO;IACP,aAAa;IACb,SAAS;IACT,MAAM;IACN,QAAQ;IACR,SAAS;IACT,OAAO;IACP,UAAU;IACV,YAAY;IACZ,YAAY;IACZ,iBAAiB;IACjB,SAAS;IACT,SAAS;IACT,KAAK;IACL,WAAW;IACX,iBAAiB;IACjB,gBAAgB;IAChB,qBAAqB;IACrB,oBAAoB;IACpB,uBAAuB;IACvB,sBAAsB;IACtB,kBAAkB;IAClB,iBAAiB;IACjB,yBAAyB;IACzB,wBAAwB;IACxB,gCAAgC;IAChC,+BAA+B;IAC/B,2BAA2B;IAC3B,0BAA0B;IAC1B,uBAAuB;IACvB,sBAAsB;IACtB,YAAY;IACZ,YAAY;IACZ,aAAa;IACb,0BAA0B;IAC1B,yBAAyB;IACzB,oBAAoB;IACpB,mBAAmB;IACnB,iBAAiB;IACjB,gBAAgB;IAChB,4BAA4B;IAC5B,2BAA2B;IAC3B,qBAAqB;IACrB,oBAAoB;IACpB,oBAAoB;IACpB,mBAAmB;IACnB,2BAA2B;IAC3B,0BAA0B;GAC5B;GACA,IAAI;IACF,OAAO;IACP,aAAa;IACb,SAAS;IACT,MAAM;IACN,QAAQ;IACR,SAAS;IACT,OAAO;IACP,UAAU;IACV,YAAY;IACZ,YAAY;IACZ,iBAAiB;IACjB,SAAS;IACT,SAAS;IACT,KAAK;IACL,WAAW;IACX,iBAAiB;IACjB,gBAAgB;IAChB,qBAAqB;IACrB,oBAAoB;IACpB,uBAAuB;IACvB,sBAAsB;IACtB,kBAAkB;IAClB,iBAAiB;IACjB,yBAAyB;IACzB,wBAAwB;IACxB,gCAAgC;IAChC,+BAA+B;IAC/B,2BAA2B;IAC3B,0BAA0B;IAC1B,uBAAuB;IACvB,sBAAsB;IACtB,YAAY;IACZ,YAAY;IACZ,aAAa;IACb,0BAA0B;IAC1B,yBAAyB;IACzB,oBAAoB;IACpB,mBAAmB;IACnB,iBAAiB;IACjB,gBAAgB;IAChB,4BAA4B;IAC5B,2BAA2B;IAC3B,qBAAqB;IACrB,oBAAoB;IACpB,oBAAoB;IACpB,mBAAmB;IACnB,2BAA2B;IAC3B,0BAA0B;GAC5B;EACF;EAEA,SAAS,SAAiB;GAExB,QADc,OAAO,cAAc,cAAc,UAAU,WAAW,KAAA,CAAM,YAClE,CAAC,CAAC,WAAW,IAAI,IAAI,OAAO,KAAK,OAAO;EACpD;;;;;;EAOA,SAAgB,YAAoB;GAClC,OAAO,OAAO,CAAC,CAAC;EAClB;;;;;;;;;;;EAgBA,SAAgB,eAAe,OAAuC;GACpE,MAAM,IAAI,OAAO;GACjB,MAAM,CAAC,MAAM,YAAA,GAAWA,MAAAA,SAAAA,CAAS,KAAK;GACtC,MAAM,CAAC,OAAO,aAAA,GAAYA,MAAAA,SAAAA,CAA4B,IAAI;GAC1D,MAAM,CAAC,YAAY,kBAAA,GAAiBA,MAAAA,SAAAA,CAAS,KAAK;GAClD,MAAM,CAAC,QAAQ,cAAA,GAAaA,MAAAA,SAAAA,CAA0C,CAAC,CAAC;GACxE,MAAM,CAAC,QAAQ,cAAA,GAAaA,MAAAA,SAAAA,CAAS,KAAK;GAC1C,MAAM,CAAC,QAAQ,cAAA,GAAaA,MAAAA,SAAAA,CAAwB,IAAI;GAExD,CAAA,GAAA,MAAA,UAAA,OAAgB;IACd,IAAI,YAAY;IAChB,MAAM,qBAAqB,CAAC,CACzB,KAAK,OAAO,aAAa;KACxB,IAAI,WAAW;KACf,IAAI,CAAC,SAAS,IAAI,MAAM,IAAI,MAAM,QAAQ,SAAS,QAAQ;KAC3D,SAAS,MAAM,SAAS,KAAK,CAAe;IAC9C,CAAC,CAAC,CACD,YAAY;KACX,IAAI,CAAC,WAAW,cAAc,IAAI;IACpC,CAAC;IACH,aAAa;KAAE,YAAY;IAAK;GAClC,GAAG,CAAC,CAAC;GAML,IAAI,MAAM,SAAS,WAAW,OAAO,EAAE;GAOvC,IAAI,YACF,OACE,iBAAA,GAAA,kBAAA,KAAA,CAAC,OAAD;IAAK,OAAO,OAAO;IAAnB,UAAA,CACE,iBAAA,GAAA,kBAAA,KAAA,CAAC,OAAD;KAAK,OAAO,OAAO;KAAnB,UAAA,CACE,iBAAA,GAAA,kBAAA,IAAA,CAAC,QAAD;MAAM,OAAO,OAAO;MAClB,UAAA,iBAAA,GAAA,kBAAA,IAAA,CAAC,QAAD;OAAM,OAAO,OAAO;OAAO,UAAA,EAAE;MAAY,CAAA;KACrC,CAAA,GACN,iBAAA,GAAA,kBAAA,IAAA,CAAC,QAAD;MAAM,OAAO,OAAO;MAAc,UAAA,EAAE;KAAiB,CAAA,CAClD;IACL,CAAA,GAAA,iBAAA,GAAA,kBAAA,IAAA,CAAC,OAAD;KAAK,OAAO,OAAO;KACjB,UAAA,iBAAA,GAAA,kBAAA,IAAA,CAAC,KAAD;MAAG,OAAO,OAAO;MAAO,UAAA,EAAE;KAAY,CAAA;IACnC,CAAA,CACF;;GAGT,IAAI,UAAU,MAAM,OAAO;GAE3B,MAAM,EAAE,WAAW;GACnB,MAAM,WAAW,UACf,OAAO,UAAU,YAAY,OAAO,MAAK,MAAK,EAAE,UAAU,KAAK,GAAI,OAAO,MAAM;GAElF,MAAM,SAAS,OAAe,SAAuB;IACnD,WAAU,UAAS;KAAE,GAAG;MAAO,QAAQ;IAAK,EAAE;IAC9C,UAAU,IAAI;GAChB;GAEA,MAAM,cAAc,QAAwB;IAC1C,WAAU,SAAQ;KAChB,MAAM,OAAO,EAAE,GAAG,KAAK;KACvB,OAAO,KAAK,IAAI;KAChB,OAAO;IACT,CAAC;GACH;GAEA,MAAM,gBAAsB;IAC1B,UAAU,CAAC,CAAC;IACZ,UAAU,IAAI;GAChB;GAEA,MAAM,gBACJ,OAAO,QAAQ,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,UAAU;IAC7C,MAAM,MAAM,OAAO,MAAK,MAAK,EAAE,UAAU,KAAK;IAC9C,OAAO,QAAQ,KAAA,KAAa,WAAW,KAAK,QAAQ,EAAE,MAAM,KAAA;GAC9D,CAAC;GAEH,MAAM,QAAQ,OAAO,KAAK,MAAM,CAAC,CAAC,SAAS;GAE3C,MAAM,OAAO,YAA2B;IACtC,IAAI,CAAC,SAAS,UAAU,QAAQ,GAAG;IACnC,UAAU,IAAI;IACd,UAAU,IAAI;IACd,IAAI;KAKF,MAAM,QAAiC,CAAC;KACxC,KAAK,MAAM,CAAC,OAAO,SAAS,OAAO,QAAQ,MAAM,GAAG;MAClD,MAAM,MAAM,OAAO,MAAK,MAAK,EAAE,UAAU,KAAK;MAC9C,IAAI,QAAQ,KAAA,GAAW;MACvB,MAAM,QAAQ,WAAW,KAAK,QAAQ,EAAE;MACxC,IAAI,UAAU,KAAA,GAAW;MACzB,MAAM,SAAS,MAAM,SAAS,UAAU,OAAO,MAAM;KACvD;KACA,MAAM,WAAW,MAAM,MAAM,uBAAuB;MAClD,QAAQ;MACR,SAAS,EAAE,gBAAgB,mBAAmB;MAC9C,MAAM,KAAK,UAAU,KAAK;KAC5B,CAAC;KACD,MAAM,OAAO,MAAM,SAAS,KAAK,CAAC,CAAC,aAAa,CAAC,EAAE;KACnD,IAAI,CAAC,SAAS,IAAI;MAChB,UAAU,KAAK,SAAS,QAAQ,SAAS,QAAQ;MACjD;KACF;KACA,IAAI,KAAK,WAAW,KAAA,GAClB,SAAS;MACP,QAAQ,KAAK;MACb,SAAS,KAAK,WAAW;MACzB,MAAM,KAAK,QAAQ;MACnB,KAAK,KAAK,OAAO;MACjB,WAAW,KAAK,aAAa;KAC/B,CAAC;KAEH,UAAU,CAAC,CAAC;IACd,QAAQ;KACN,UAAU,EAAE,UAAU;IACxB,UAAU;KACR,UAAU,KAAK;IACjB;GACF;GAEA,MAAM,iBAAiB,QAA6B;IAClD,MAAM,QAAQ,IAAI;IAClB,MAAM,QAAQ,EAAE,SAAS;IACzB,MAAM,OAAO,EAAE,QAAQ;IACvB,MAAM,OAAO,QAAQ,KAAK;IAC1B,QAAQ,IAAI,MAAZ;KACE,KAAK,WACH,OACE,iBAAA,GAAA,kBAAA,KAAA,CAAC,OAAD;MAAK,OAAO,OAAO;MAAnB,UAAA,CACE,iBAAA,GAAA,kBAAA,KAAA,CAAC,SAAD;OAAO,OAAO,OAAO;OAArB,UAAA;QACE,iBAAA,GAAA,kBAAA,IAAA,CAAC,SAAD;SACE,MAAK;SACL,SAAS,SAAS;SAClB,UAAU;SACV,WAAW,MACT,MAAM,OAAO,EAAE,OAAO,UAAU,SAAS,OAAO;QACnD,CAAA;QACD,iBAAA,GAAA,kBAAA,IAAA,CAAC,QAAD;SAAM,OAAO,OAAO;SAAQ,UAAA;QAAY,CAAA;QACxC,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD;SACE,MAAK;SACL,OAAO,OAAO;SACd,UAAU,UAAU,CAAC,OAAO;SAC5B,eAAe,WAAW,GAAG;SAE5B,UAAA,EAAE;QACG,CAAA;OACH;MACP,CAAA,GAAA,iBAAA,GAAA,kBAAA,IAAA,CAAC,QAAD;OAAM,OAAO,OAAO;OAAO,UAAA;MAAW,CAAA,CACnC;;KAET,KAAK;KACL,KAAK,YAAY;MAIf,MAAM,UAAU,IAAI,SAAS,aAAa,mBAAoB,IAAI,WAAW,CAAC;MAC9E,OACE,iBAAA,GAAA,kBAAA,KAAA,CAAC,OAAD;OAAK,OAAO,OAAO;OAAnB,UAAA;QACE,iBAAA,GAAA,kBAAA,IAAA,CAAC,SAAD;SAAO,OAAO,OAAO;SAAO,SAAS,UAAU;SAAU,UAAA;QAAa,CAAA;QACtE,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD;SACE,IAAI,UAAU;SACd,OAAO,OAAO;SACd,OAAO;SACP,UAAU;SACV,WAAW,MAAsC,MAAM,OAAO,EAAE,OAAO,KAAK;SAE3E,UAAA,QAAQ,KAAI,WACX,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD;UAAqB,OAAO;UACzB,UAAA,IAAI,SAAS,aAAa,EAAE,OAAO,YAAY;SAC1C,GAFK,MAEL,CACT;QACK,CAAA;QACR,iBAAA,GAAA,kBAAA,IAAA,CAAC,QAAD;SAAM,OAAO,OAAO;SAAO,UAAA;QAAW,CAAA;QACtC,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD;SACE,MAAK;SACL,OAAO,OAAO;SACd,UAAU,UAAU,CAAC,OAAO;SAC5B,eAAe,WAAW,GAAG;SAE5B,UAAA,EAAE;QACG,CAAA;OACL;;KAET;KACA,SACE,OACE,iBAAA,GAAA,kBAAA,KAAA,CAAC,OAAD;MAAK,OAAO,OAAO;MAAnB,UAAA;OACE,iBAAA,GAAA,kBAAA,IAAA,CAAC,SAAD;QAAO,OAAO,OAAO;QAAO,SAAS,UAAU;QAAU,UAAA;OAAa,CAAA;OACtE,iBAAA,GAAA,kBAAA,IAAA,CAAC,SAAD;QACE,IAAI,UAAU;QACd,OAAO,OAAO;QACd,MAAM,IAAI,SAAS,WAAW,WAAW;QACzC,OAAO;QACP,UAAU;QACV,aAAa,IAAI,WAAW,EAAE,kBAAkB,KAAA;QAChD,WAAW,MAAqC,MAAM,OAAO,EAAE,OAAO,KAAK;OAC5E,CAAA;OACD,iBAAA,GAAA,kBAAA,IAAA,CAAC,QAAD;QAAM,OAAO,OAAO;QAAO,UAAA;OAAW,CAAA;MACnC;;IAEX;GACF;GAEA,MAAM,aAAa,GAAG,MAAM,UAAU,EAAE,UAAU,EAAE,QAAQ,KAAK,EAAE,IAAI,IAAI,MAAM,IAAI,MAAM,MAAM;GAEjG,OACE,iBAAA,GAAA,kBAAA,KAAA,CAAC,OAAD;IAAK,OAAO,OAAO;KAAE,GAAG,OAAO;KAAM,GAAG,OAAO;IAAS,IAAI,OAAO;IAAnE,UAAA,CACE,iBAAA,GAAA,kBAAA,KAAA,CAAC,UAAD;KACE,MAAK;KACL,OAAO,OAAO;KACd,iBAAe;KACf,eAAe;MAAE,QAAQ,CAAC,IAAI;KAAE;KAJlC,UAAA,CAME,iBAAA,GAAA,kBAAA,KAAA,CAAC,QAAD;MAAM,OAAO,OAAO;MAApB,UAAA;OACE,iBAAA,GAAA,kBAAA,IAAA,CAAC,QAAD;QAAM,OAAO,OAAO;QAAO,UAAA,EAAE;OAAY,CAAA;OACzC,iBAAA,GAAA,kBAAA,IAAA,CAAC,QAAD;QAAM,OAAO,OAAO;QAAQ,OAAO;QAAa,UAAA;OAAiB,CAAA;OAChE,QAAQ,iBAAA,GAAA,kBAAA,IAAA,CAAC,QAAD;QAAM,OAAO,OAAO;QAAU,UAAA,EAAE;OAAc,CAAA,IAAI;OAC3D,iBAAA,GAAA,kBAAA,IAAA,CAAC,QAAD;QAAM,OAAO,OAAO;SAAE,GAAG,OAAO;SAAS,GAAG,OAAO;QAAY,IAAI,OAAO;QAAU,UAAA,OAAO,MAAM;OAAU,CAAA;MACvG;KACN,CAAA,GAAA,iBAAA,GAAA,kBAAA,IAAA,CAAC,QAAD;MAAM,OAAO,OAAO;MAAc,UAAA,EAAE;KAAkB,CAAA,CAChD;IACP,CAAA,GAAA,OAEG,iBAAA,GAAA,kBAAA,KAAA,CAAC,OAAD;KAAK,OAAO,OAAO;KAAnB,UAAA;MACG,MAAM,YAAY,iBAAA,GAAA,kBAAA,KAAA,CAAC,KAAD;OAAG,OAAO,OAAO;OAAO,MAAK;OAA7B,UAAA;QAAuC,EAAE;QAAU;QAAG,MAAM;OAAa;MAAI,CAAA,IAAA;MAC/F,OAAO,KAAI,QAAO,iBAAA,GAAA,kBAAA,IAAA,CAAC,OAAD,EAAA,UAAsB,cAAc,GAAG,EAAO,GAApC,IAAI,KAAgC,CAAC;MAClE,iBAAA,GAAA,kBAAA,KAAA,CAAC,OAAD;OAAK,OAAO,OAAO;OAAnB,UAAA;QACG,SAAS,iBAAA,GAAA,kBAAA,IAAA,CAAC,KAAD;SAAG,OAAO,OAAO;SAAO,MAAK;SAAU,UAAA;QAAU,CAAA,IAAI;QAC/D,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD;SACE,MAAK;SACL,OAAO,OAAO;SACd,UAAU,CAAC,SAAS;SACpB,SAAS;SAER,UAAA,EAAE;QACG,CAAA;QACR,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD;SACE,MAAK;SACL,OAAO,OAAO;SACd,UAAU,CAAC,SAAS,QAAQ,KAAK;SACjC,eAAe;UAAE,KAAU;SAAE;SAE5B,UAAA,SAAS,EAAE,SAAS,EAAE;QACjB,CAAA;OACL;;KACF;IAEL,CAAA,IAAA,IACD;;EAET;;EASA,SAAS,GAAG,OAAe,UAA0B;GACnD,OAAO,OAAO,MAAM,IAAI,SAAS;EACnC;EAEA,MAAM,IAAI;GACR,QAAQ,GAAG,yBAAyB,wBAAwB;GAC5D,IAAI,GAAG,0BAA0B,aAAa;GAC9C,QAAQ,GAAG,0BAA0B,aAAa;GAClD,cAAc,GAAG,6BAA6B,SAAS;GACvD,gBAAgB,GAAG,+BAA+B,SAAS;GAC3D,eAAe,GAAG,8BAA8B,uBAAuB;GACvE,aAAa,GAAG,4BAA4B,uBAAuB;GACnE,OAAO,GAAG,2BAA2B,SAAS;GAC9C,OAAO,GAAG,6BAA6B,SAAS;GAChD,SAAS,GAAG,kCAAkC,wBAAwB;EACxE;EAEA,MAAM,SAA8C;GAClD,MAAM;IACJ,WAAW;IACX,QAAQ,aAAa,EAAE;IACvB,cAAc;IACd,YAAY,EAAE;IACd,YAAY;IACZ,UAAU;GACZ;GACA,UAAU;IACR,YAAY,EAAE;IACd,aAAa,EAAE;GACjB;GACA,QAAQ;IACN,SAAS;IACT,eAAe;IACf,YAAY;IACZ,KAAK;IACL,OAAO;IACP,SAAS;IACT,QAAQ;IACR,YAAY;IACZ,MAAM;IACN,OAAO;IACP,WAAW;IACX,QAAQ;GACV;GACA,WAAW;IAAE,SAAS;IAAQ,YAAY;IAAU,KAAK;IAAQ,OAAO;GAAO;GAC/E,MAAM;IAAE,MAAM;IAAY,UAAU;IAAG,UAAU;IAAQ,YAAY;IAAK,YAAY;IAAK,OAAO,EAAE;GAAa;GAIjH,QAAQ;IACN,MAAM;IACN,UAAU;IACV,UAAU;IACV,UAAU;IACV,YAAY;IACZ,OAAO,EAAE;IACT,YAAY;IACZ,UAAU;IACV,cAAc;GAChB;GACA,aAAa;IACX,SAAS;IACT,UAAU;IACV,YAAY;IACZ,OAAO,EAAE;IACT,YAAY;IACZ,UAAU;IACV,cAAc;GAChB;GACA,SAAS;IACP,MAAM;IACN,cAAc;IACd,SAAS;IACT,UAAU;IACV,YAAY;IACZ,YAAY;IACZ,YAAY;IACZ,YAAY,EAAE;IACd,OAAO,EAAE;GACX;GACA,SAAS;IAAE,MAAM;IAAQ,OAAO,EAAE;IAAe,UAAU;IAAQ,YAAY;GAAiB;GAChG,aAAa,EAAE,WAAW,iBAAiB;GAC3C,MAAM;IACJ,WAAW,aAAa,EAAE;IAC1B,QAAQ;IACR,eAAe;IACf,SAAS;IACT,eAAe;GACjB;GACA,OAAO;IACL,SAAS;IACT,eAAe;IACf,KAAK;IACL,SAAS;GACX;GACA,OAAO;IAAE,UAAU;IAAQ,YAAY;IAAK,YAAY;IAAK,OAAO,EAAE;GAAa;GACnF,MAAM;IAAE,QAAQ;IAAG,UAAU;IAAQ,YAAY;IAAK,OAAO,EAAE;GAAc;GAC7E,UAAU;IAAE,SAAS;IAAQ,YAAY;IAAU,KAAK;IAAO,QAAQ;GAAU;GACjF,OAAO;IACL,QAAQ;IACR,YAAY;IACZ,SAAS;IACT,MAAM;IACN,UAAU;IACV,YAAY;IACZ,OAAO,EAAE;IACT,QAAQ;IACR,WAAW;GACb;GACA,OAAO;IACL,QAAQ;IACR,SAAS;IACT,QAAQ,aAAa,EAAE;IACvB,cAAc;IACd,YAAY,EAAE;IACd,MAAM;IACN,UAAU;IACV,YAAY;IACZ,OAAO,EAAE;GACX;GACA,QAAQ;IACN,SAAS;IACT,YAAY;IACZ,gBAAgB;IAChB,KAAK;IACL,SAAS;IACT,WAAW,aAAa,EAAE;GAC5B;GACA,OAAO;IAAE,MAAM;IAAG,UAAU;IAAG,QAAQ;IAAG,UAAU;IAAQ,YAAY;IAAK,OAAO,EAAE;GAAM;GAC5F,SAAS;IACP,YAAY;IACZ,QAAQ,aAAa,EAAE;IACvB,cAAc;IACd,SAAS;IACT,MAAM;IACN,UAAU;IACV,YAAY;IACZ,YAAY;IACZ,OAAO,EAAE;IACT,QAAQ;GACV;GACA,MAAM;IACJ,YAAY;IACZ,QAAQ;IACR,cAAc;IACd,SAAS;IACT,MAAM;IACN,UAAU;IACV,YAAY;IACZ,YAAY,EAAE;IACd,OAAO,EAAE;IACT,QAAQ;GACV;EACF;;;;;;;;;;;;;;;;;ECtmBA,SAAS,uBAA+B;GACtC,MAAM,QAAQ,WAAW,OAAO,gCAAgB,IAAI,WAAW,EAAE,CAAC;GAClE,MAAM,OAAO,IAAI,SAAS,MAAM,QAAQ,MAAM,YAAY,MAAM,UAAU;GAC1E,KAAK,SAAS,GAAI,KAAK,SAAS,CAAC,IAAI,KAAQ,EAAI;GACjD,KAAK,SAAS,GAAI,KAAK,SAAS,CAAC,IAAI,KAAQ,GAAI;GACjD,MAAM,MAAM,MAAM,KAAK,QAAO,SAAQ,KAAK,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE;GACjF,OAAO,GAAG,IAAI,MAAM,GAAG,CAAC,EAAE,GAAG,IAAI,MAAM,GAAG,EAAE,EAAE,GAAG,IAAI,MAAM,IAAI,EAAE,EAAE,GAAG,IAAI,MAAM,IAAI,EAAE,EAAE,GAAG,IAAI,MAAM,EAAE;EACzG;;;;;;EAOA,SAAgB,wBAAiC;GAC/C,MAAM,YAAY,WAAW;GAC7B,IAAI,cAAc,KAAA,GAAW,OAAO;GACpC,IAAI,OAAO,UAAU,eAAe,YAAY,OAAO;GACvD,IAAI,OAAO,UAAU,oBAAoB,YAAY,OAAO;GAC5D,IAAI;IAGF,MAAM,QAAQ,OAAO,eAAe,SAAS;IAC7C,IAAI,UAAU,QAAQ,OAAO,MAAM,eAAe,YAAY;KAC5D,OAAO,eAAe,OAAO,cAAc;MACzC,OAAO;MACP,UAAU;MACV,cAAc;KAChB,CAAC;KACD,OAAO;IACT;IAEA,OAAO,eAAe,WAAW,cAAc;KAC7C,OAAO;KACP,UAAU;KACV,cAAc;IAChB,CAAC;IACD,OAAO;GACT,QAAQ;IACN,OAAO;GACT;EACF;EAIA,sBAAsB;EAYtB,MAAa,OAAO;;;;;EAMpB,MAAM,WAAW;;EAGjB,MAAa,SAAS,CAAC,SAAS,aAAa;;;;;EAM7C,SAAgB,MAAM,KAA0B;GAC9C,sBAAsB;GAiBtB,IAAI,aAAa,IAAI,YAAY,YAAY,CAAC,QAAQ,SACpD,IAAI,MAAM,OAAO,sBAAsB,IAAI,MAAM,SAAS;IACxD,MAAM;IACN,IAAI;IACJ,OAAO;IACP,aAAa,UAAU;GACzB,GAAG,cAAc,CAAC,CAAC,CAAC;EACxB"}

package/lib/index.d.ts

@@ -128,8 +128,90 @@ interface Config {
    */
   secureCookies?: boolean;
 }
-/** Schemastery configuration validated by the Loader. */
-declare const Config: z<Config>;
+/** A `.volatile()` config field as the Loader hands it to `apply`. */
+interface ConfigRef<T> {
+  /** The current value; updated in place when the profile entry is written. */
+  get(): T;
+}
+/**
+ * The config object `apply` receives: dsh 0.1.7 hands every `.volatile()` field
+ * over as a reference rather than a value, so the plugin reads its live config
+ * through `readConfig`. A field declared optional and left unset resolves to
+ * `undefined` instead of a reference, hence the union inside `ConfigRef`.
+ */
+type ConfigRefs = { [K in keyof Required<Config>]: ConfigRef<Config[K]>; };
+/**
+ * Schemastery configuration validated by the Loader.
+ *
+ * Every field is `.volatile()`, which is what lets the Settings service write
+ * it: 0.1.7 projects only volatile fields into forms and refuses an edit to any
+ * other path (`not volatile`). The mark also changes the runtime shape — a
+ * volatile field arrives as a reference (see `ConfigRefs`), never as the plain
+ * value the rest of this file expects — so read it through `readConfig`.
+ */
+declare const Config: z<Schemastery.ObjectS<NoInfer<{
+  enabled: z<boolean, boolean, "volatile-defined">;
+  gatewayPort: z<number, number, "volatile-defined">;
+  dshTargetPort: z<number, number, "volatile">;
+  lanCidrs: z<NoInfer<string[]>, NoInfer<string[]>, "volatile-defined">;
+  lanPasswordless: z<boolean, boolean, "volatile-defined">;
+  authRequired: z<boolean, boolean, "volatile-defined">;
+  cookieMaxAgeDays: z<number, number, "volatile-defined">;
+  cookieName: z<string, string, "volatile-defined">;
+  tlsEnabled: z<boolean, boolean, "volatile-defined">;
+  tlsMode: z<"self-signed" | "custom", "self-signed" | "custom", "volatile-defined">;
+  tlsCertPath: z<string, string, "volatile">;
+  tlsKeyPath: z<string, string, "volatile">;
+  tlsSelfSignedHosts: z<string, string, "volatile-defined">;
+  tlsCertMaxAgeDays: z<number, number, "volatile-defined">;
+  allowInsecurePlaintext: z<boolean, boolean, "volatile-defined">;
+  trustedTerminator: z<string, string, "volatile">;
+  secureCookies: z<boolean, boolean, "volatile">;
+}>>, Schemastery.ObjectT<NoInfer<{
+  enabled: z<boolean, boolean, "volatile-defined">;
+  gatewayPort: z<number, number, "volatile-defined">;
+  dshTargetPort: z<number, number, "volatile">;
+  lanCidrs: z<NoInfer<string[]>, NoInfer<string[]>, "volatile-defined">;
+  lanPasswordless: z<boolean, boolean, "volatile-defined">;
+  authRequired: z<boolean, boolean, "volatile-defined">;
+  cookieMaxAgeDays: z<number, number, "volatile-defined">;
+  cookieName: z<string, string, "volatile-defined">;
+  tlsEnabled: z<boolean, boolean, "volatile-defined">;
+  tlsMode: z<"self-signed" | "custom", "self-signed" | "custom", "volatile-defined">;
+  tlsCertPath: z<string, string, "volatile">;
+  tlsKeyPath: z<string, string, "volatile">;
+  tlsSelfSignedHosts: z<string, string, "volatile-defined">;
+  tlsCertMaxAgeDays: z<number, number, "volatile-defined">;
+  allowInsecurePlaintext: z<boolean, boolean, "volatile-defined">;
+  trustedTerminator: z<string, string, "volatile">;
+  secureCookies: z<boolean, boolean, "volatile">;
+}>>, "plain">;
+/**
+ * Unwrap the config references into the plain values every other function in
+ * this file reads. Called on each access rather than once, because a settings
+ * write updates the references in place.
+ * @param refs - the config object handed to `apply`.
+ * @returns one detached plain snapshot.
+ */
+declare function readConfig(refs: ConfigRefs): Config;
+/**
+ * Build the reference-shaped config `apply` receives, exactly as the Loader
+ * builds it. Exported for tests that drive `apply` directly.
+ * @param raw - a config object; missing fields take their schema defaults.
+ * @returns one reference per volatile field.
+ */
+declare function configRefs(raw: object): ConfigRefs;
+/**
+ * Validate a raw config object the way the Loader does, and unwrap it.
+ *
+ * `Config` marks every field volatile, so a validation hands the values back as
+ * references (typed deeply-readonly by schemastery); this returns the plain
+ * shape the rest of the file reads. Used to judge a config the Settings card is
+ * about to save, before it is persisted.
+ * @param raw - a config object; missing fields take their schema defaults.
+ * @returns the validated plain config.
+ */
+declare function validateConfig(raw: object): Config;
 /** Facts the fail-closed start guard needs to judge a config. */
 interface StartFacts {
   /** Whether the dsh base enforces browser-session auth (auto-detected). */
@@ -183,6 +265,6 @@ declare function buildConfigPatch(submitted: Record<string, unknown>): {
   clear: string[];
   unknown: string[];
 };
-declare function apply(ctx: Context, config: Config): void;
+declare function apply(ctx: Context, config: ConfigRefs): void;
 //#endregion
-export { Config, GatewayController, StartFacts, ToolResult, UpstreamConnectionSurface, WebServerSurface, apply, buildConfigPatch, gatewayStartProblems, inject, isTrustedConfigRequest, name, resolveSecureCookies };
+export { Config, ConfigRef, ConfigRefs, GatewayController, StartFacts, ToolResult, UpstreamConnectionSurface, WebServerSurface, apply, buildConfigPatch, configRefs, gatewayStartProblems, inject, isTrustedConfigRequest, name, readConfig, resolveSecureCookies, validateConfig };