@riceawa/dsh-lan-gateway 0.6.1 → 0.6.2

package/README.md

@@ -6,7 +6,7 @@
 
 <p align="center">
   <img src="https://img.shields.io/badge/DeepSeek%20Harness-4d6bfe?logo=deepseek&logoColor=fff&style=flat-square" alt="DeepSeek Harness" />
-  <img src="https://img.shields.io/badge/version-0.6.1-2b7fff?style=flat-square" alt="version 0.6.1" />
+  <img src="https://img.shields.io/badge/version-0.6.2-2b7fff?style=flat-square" alt="version 0.6.2" />
   <img src="https://img.shields.io/badge/TLS-8b5cf6?logo=lock&logoColor=fff&style=flat-square" alt="TLS" />
   <img src="https://img.shields.io/github/license/rice-awa/dsh-lan-gateway?style=flat-square" alt="MIT license" />
   <a href="https://awesome-dsh-plugin.com"><img src="https://awesome-dsh-plugin.com/badge.svg" alt="awesome · DSH plugin" /></a>
@@ -44,7 +44,7 @@ cd dsh-lan-gateway
 pnpm install
 pnpm build          # host → lib/index.js
 pnpm build:client   # client → lib/client.js
-pnpm test           # 204 项
+pnpm test           # 206 项
 ```
 
 仓库里还有一个 [lan-gateway](skills/lan-gateway.md) 技能，安装后可直接在 dsh 对话里说「设置网关密码为 …」「开启远程访问」，agent 会调用 `lan_gateway` 工具完成，密码以参数传入，不写入配置，也不回显。改密码也可以不走模型：在本机打开 **Plugins** 页的「LAN 网关」卡片，直接填两次新密码覆盖（见下「登录密码」）。安装方式见 [INSTALL.md](INSTALL.md#for-agents完整安装流程)。
@@ -204,7 +204,7 @@ client bundle 在模块级给 `Crypto` 原型补一个基于 `crypto.getRandomVa
 ## 开发
 
 ```bash
-pnpm test        # 204 项
+pnpm test        # 206 项
 pnpm typecheck   # tsc 双端（host + client）
 ```
 
@@ -219,8 +219,9 @@ pnpm typecheck   # tsc 双端（host + client）
 ✓ tests/x509.test.ts                           ( 6) 自签名证书 DER/SAN/签名/TLS 握手
 ✓ tests/tls.test.ts                            ( 9) 证书持久化 / 到期换发 / 重生成 / 自定义证书加载
 ✓ tests/uuid-shim.test.ts                      ( 3) 不安全源补丁 / 安全源 no-op / v4 正确性
-✓ tests/settings-card.test.ts                  (15) 设置页字段编解码（三态 auto ↔ false 不可混淆）/
-                                                    卡片注册槽与条目 id 契约 / 密码草稿闸门（长度与确认）
+✓ tests/settings-card.test.ts                  (17) 设置页字段编解码（三态 auto ↔ false 不可混淆）/
+                                                    卡片注册槽与条目 id 契约 / 密码草稿闸门（长度与确认）/
+                                                    密码状态徽标三态（缺字段 = 未知，不是「未设置」）
 ✓ tests/integration/gateway.test.ts            (26) 真实网关端到端：全来源登录 / LAN 豁免 / 跨站 403 / 升级拒绝 /
                                                     cookie 属性 / epoch 撤销 / 逐会话登出 / 尾斜杠 / IPv6 / 会话中继
 ✓ tests/integration/management-plane.test.ts   (24) 真实 apply()：工具与卡片交替启停 / 未编辑字段与未知键保留 /

package/lib/client.js

@@ -162,6 +162,15 @@ window.__ModuleLoader__.load({
 		* @module @riceawa/dsh-lan-gateway/client/card
 		*/
 		/**
+		* Classify the host's `passwordSet` for the badge.
+		* @param passwordSet - the snapshot's flag, or `undefined` when absent.
+		* @returns `set` / `unset` / `unknown` (absent field).
+		*/
+		function passwordStatus(passwordSet) {
+			if (passwordSet === void 0) return "unknown";
+			return passwordSet ? "set" : "unset";
+		}
+		/**
 		* Judge a password draft the way the host's password route will, so a draft the
 		* card enables is never answered with a 400. The length bound is the shared
 		* {@link MIN_PASSWORD_LENGTH}; the confirmation is a UI concern and is checked
@@ -199,7 +208,9 @@ window.__ModuleLoader__.load({
 				passwordConfirm: "再次输入新密码",
 				passwordSet: "已设置",
 				passwordUnset: "未设置",
+				passwordUnknown: "状态未知（宿主端较旧）",
 				passwordRequired: "未设置密码时网关拒绝启动。",
+				passwordHostStale: "宿主端没有报告密码状态，说明 dsh web 还在运行旧版本：重启后这里才会显示「已设置 / 未设置」，这个改密表单也才会生效。",
 				passwordChange: "修改密码",
 				passwordChanged: "密码已更新：旧密码立即失效，所有已登录会话已作废。",
 				passwordFailed: "修改密码失败，请重试。",
@@ -262,7 +273,9 @@ window.__ModuleLoader__.load({
 				passwordConfirm: "Repeat new password",
 				passwordSet: "Set",
 				passwordUnset: "Not set",
+				passwordUnknown: "Unknown (older host)",
 				passwordRequired: "The gateway refuses to start without a password.",
+				passwordHostStale: "The host did not report a password state, so dsh web is still running the previous build: restart it to get Set / Not set here and to make this form take effect.",
 				passwordChange: "Change password",
 				passwordChanged: "Password updated: the old one no longer works and every signed-in session was revoked.",
 				passwordFailed: "The password change failed — retry.",
@@ -402,6 +415,7 @@ window.__ModuleLoader__.load({
 			const dirty = Object.keys(drafts).length > 0;
 			const passwordDraftProblem = passwordProblem(password, passwordConfirm);
 			const passwordTyping = password !== "" || passwordConfirm !== "";
+			const passwordBadge = passwordStatus(route.passwordSet);
 			/** Adopt the host's post-write snapshot, keeping the last known values. */
 			const adopt = (body) => {
 				if (body.config === void 0) return;
@@ -411,7 +425,7 @@ window.__ModuleLoader__.load({
 					port: body.port ?? 0,
 					tls: body.tls ?? "",
 					lastError: body.lastError ?? null,
-					passwordSet: body.passwordSet === true
+					...body.passwordSet !== void 0 ? { passwordSet: body.passwordSet } : {}
 				});
 			};
 			/**
@@ -638,18 +652,22 @@ window.__ModuleLoader__.load({
 										style: styles.label,
 										children: t.passwordSection
 									}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
-										style: route.passwordSet === true ? styles.badge : styles.badgeAlert,
-										children: route.passwordSet === true ? t.passwordSet : t.passwordUnset
+										style: passwordBadge === "unset" ? styles.badgeAlert : styles.badge,
+										children: passwordBadge === "set" ? t.passwordSet : passwordBadge === "unset" ? t.passwordUnset : t.passwordUnknown
 									})]
 								}),
 								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
 									style: styles.hint,
 									children: t.passwordHint
 								}),
-								route.passwordSet === true ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+								passwordBadge === "unset" ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
 									style: styles.error,
 									children: t.passwordRequired
-								}),
+								}) : null,
+								passwordBadge === "unknown" ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+									style: styles.hint,
+									children: t.passwordHostStale
+								}) : null,
 								/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 									style: styles.passwordRow,
 									children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {

package/lib/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","names":["useState"],"sources":["../src/config-fields.ts","../src/client/lan-gateway-card.tsx","../src/client/index.ts"],"sourcesContent":["/**\n * The `lan-gateway` configuration field table: which settings keys exist, how\n * each one is rendered, and how a draft string becomes a config value or a\n * clear.\n *\n * The host and the browser card share this module. The host derives the key set\n * its config route accepts and the set an empty value clears from it; the card\n * renders its controls from it. A field therefore cannot be editable on one\n * side and unknown on the other, which is what let the card silently rewrite\n * keys it never showed.\n *\n * It also carries `MIN_PASSWORD_LENGTH`: the login password is deliberately not\n * a field here (it is a secret in `state.json`, not a settings key), but its\n * length bound is a contract the card's form and the host's password route\n * must not disagree about.\n *\n * Because both halves import it, this module must stay dependency-free and\n * side-effect-free: no schemastery (the host schema remains the validating\n * authority, not this table), no node built-ins, no DOM, no I/O.\n *\n * @module @riceawa/dsh-lan-gateway/config-fields\n */\n\n/**\n * The wire shape of the `lan-gateway` config section, as the Settings card sees\n * it. Deliberately narrower than the host's `Config`: `cookieName` and the\n * retired `authRequired` are not card-editable. The config route applies a\n * patch, so a key absent here is left untouched rather than reset.\n */\nexport interface LanGatewaySettings {\n  enabled?: boolean\n  gatewayPort?: number\n  dshTargetPort?: number\n  lanCidrs?: string[]\n  lanPasswordless?: boolean\n  cookieMaxAgeDays?: number\n  tlsEnabled?: boolean\n  tlsMode?: 'self-signed' | 'custom'\n  tlsCertPath?: string\n  tlsKeyPath?: string\n  tlsSelfSignedHosts?: string\n  tlsCertMaxAgeDays?: number\n  allowInsecurePlaintext?: boolean\n  trustedTerminator?: string\n  secureCookies?: boolean\n}\n\n/** A settings key this table knows how to edit. */\nexport type ConfigFieldKey = keyof LanGatewaySettings\n\n/**\n * Minimum login-password length, in characters. The credential is not a config\n * field (it lives in `state.json`, never in the schema), but the bound belongs\n * here all the same: the card's password form and the host's password route\n * both read it, so a draft the card accepts is never answered with a 400.\n */\nexport const MIN_PASSWORD_LENGTH = 8\n\n/** How a field is rendered and parsed. */\nexport type FieldKind = 'boolean' | 'number' | 'text' | 'cidrs' | 'select' | 'tristate'\n\nexport interface FieldDef {\n  readonly field: ConfigFieldKey\n  readonly kind: FieldKind\n  /** An empty draft clears the key back to the composition layer. */\n  readonly optional?: boolean\n  /** The accepted values of a `select` field. */\n  readonly options?: readonly string[]\n}\n\n/** The three states of a tri-state field, in display order. */\nexport const TRISTATE_OPTIONS = ['auto', 'true', 'false'] as const\n\n/**\n * The editable settings, in display order. Adding a config key means adding it\n * here (the host whitelist and the card's controls both follow), to the\n * `Config` schema in `index.ts`, and to `listenerKey` when it changes listener\n * behavior.\n */\nexport const FIELDS: readonly FieldDef[] = [\n  { field: 'enabled', kind: 'boolean' },\n  { field: 'gatewayPort', kind: 'number' },\n  { field: 'dshTargetPort', kind: 'number', optional: true },\n  { field: 'lanCidrs', kind: 'cidrs' },\n  { field: 'lanPasswordless', kind: 'boolean' },\n  { field: 'cookieMaxAgeDays', kind: 'number' },\n  { field: 'tlsEnabled', kind: 'boolean' },\n  { field: 'tlsMode', kind: 'select', options: ['self-signed', 'custom'] },\n  { field: 'tlsSelfSignedHosts', kind: 'text' },\n  { field: 'tlsCertPath', kind: 'text', optional: true },\n  { field: 'tlsKeyPath', kind: 'text', optional: true },\n  { field: 'tlsCertMaxAgeDays', kind: 'number' },\n  { field: 'allowInsecurePlaintext', kind: 'boolean' },\n  { field: 'trustedTerminator', kind: 'text', optional: true },\n  { field: 'secureCookies', kind: 'tristate' },\n]\n\n/** Every settings key the config route accepts; anything else is ignored. */\nexport const CONFIG_FIELD_KEYS: ReadonlySet<string> = new Set(FIELDS.map(def => def.field as string))\n\n/** Keys an empty submitted value clears back to the composition layer. */\nexport const OPTIONAL_CONFIG_KEYS: ReadonlySet<string> = new Set(\n  FIELDS.filter(def => def.optional === true).map(def => def.field as string),\n)\n\n/** Render a stored value as draft text. */\nexport function formatValue(def: FieldDef, value: unknown): string {\n  switch (def.kind) {\n    case 'boolean': return value === true ? 'true' : 'false'\n    case 'number': return typeof value === 'number' ? String(value) : ''\n    case 'cidrs': return Array.isArray(value) ? value.join(', ') : ''\n    case 'select': return typeof value === 'string' ? value : (def.options?.[0] ?? '')\n    // Tri-state: an unset value is a distinct third state (\"auto\"), never \"false\".\n    case 'tristate': return value === true ? 'true' : value === false ? 'false' : 'auto'\n    case 'text': return typeof value === 'string' ? value : ''\n  }\n}\n\n/** One field's contribution to a config patch. */\nexport type Write = { kind: 'set'; value: unknown } | { kind: 'clear' }\n\n/** Parse draft text into a value for the POST body; undefined blocks saving. */\nexport function parseValue(def: FieldDef, text: string): Write | undefined {\n  const trimmed = text.trim()\n  switch (def.kind) {\n    case 'boolean':\n      if (trimmed === 'true') return { kind: 'set', value: true }\n      if (trimmed === 'false') return { kind: 'set', value: false }\n      return undefined\n    case 'number':\n      if (trimmed === '') return def.optional ? { kind: 'clear' } : undefined\n      if (!/^\\d+$/.test(trimmed)) return undefined\n      return { kind: 'set', value: Number(trimmed) }\n    case 'cidrs': {\n      const cidrs = trimmed.split(',').map(s => s.trim()).filter(s => s !== '')\n      return cidrs.length === 0 ? { kind: 'clear' } : { kind: 'set', value: cidrs }\n    }\n    case 'select':\n      return def.options?.includes(trimmed) ? { kind: 'set', value: trimmed } : undefined\n    case 'tristate':\n      // 'auto' clears the key so it re-inherits the composition layer (and the\n      // resolution rule), which is what an unset tri-state means.\n      if (trimmed === 'auto') return { kind: 'clear' }\n      if (trimmed === 'true') return { kind: 'set', value: true }\n      if (trimmed === 'false') return { kind: 'set', value: false }\n      return undefined\n    case 'text':\n      return trimmed === '' ? (def.optional ? { kind: 'clear' } : undefined) : { kind: 'set', value: trimmed }\n  }\n}\n","/**\n * The lan-gateway settings card, rendered by the official DSH Plugins page\n * through its `plugins.item` slot.\n *\n * ModLens-style: the card carries NO injected services. It reads and writes\n * the loopback-only `/lan-gateway/config` host route (the browser never sees\n * the settings seam or any secret), so the only platform service it needs is\n * the `slots` service every plugin already has.\n *\n * @module @riceawa/dsh-lan-gateway/client/card\n */\n\nimport { useEffect, useState, type ChangeEvent, type ReactNode } from 'react'\nimport type { PropsRuntime } from '@deepseek-ai/dsh-client-ui-slots'\n// Type-only. The Plugins page owns the `plugins.item` contract, and its own\n// doc says a registrant merges that contract with `import type` instead of\n// importing the package at runtime. Taking the contract from its owner is also\n// what turns the next upstream rename of this slot into a compile error here,\n// rather than a card that quietly stops rendering.\nimport type {} from '@deepseek-ai/dsh-client-ui-plugin-manager/client'\nimport {\n  FIELDS,\n  MIN_PASSWORD_LENGTH,\n  TRISTATE_OPTIONS,\n  formatValue,\n  parseValue,\n  type FieldDef,\n  type LanGatewaySettings,\n} from '../config-fields.ts'\n\n/**\n * Props the renderer binds for this card. The Plugins page asks for either the\n * card's one-liner (`summary`) or the body of its own page (`page`), and draws\n * the page's title, icon, and crumb itself. The card needs no injected face —\n * it fetches its own route.\n */\nexport type LanGatewayCardProps = PropsRuntime<'plugins.item'>\n\n/**\n * The card's field table and value codecs live in `config-fields.ts`, shared\n * with the host: the host's config route decides which submitted keys are\n * editable and which empty value means \"clear\", and a table duplicated here\n * would let the two disagree about a field the card can render but the route\n * would refuse. Re-exported so the existing tests keep their import path.\n */\nexport { FIELDS, TRISTATE_OPTIONS, formatValue, parseValue }\nexport type { FieldDef, LanGatewaySettings }\n\n/** GET /lan-gateway/config response. */\ninterface RouteState {\n  config: LanGatewaySettings\n  running: boolean\n  port: number\n  tls: string\n  lastError: string | null\n  /** Whether a login credential exists. Never the credential itself. */\n  passwordSet?: boolean\n}\n\n/** Why a password draft cannot be submitted yet. */\nexport type PasswordProblem = 'tooShort' | 'mismatch'\n\n/**\n * Judge a password draft the way the host's password route will, so a draft the\n * card enables is never answered with a 400. The length bound is the shared\n * {@link MIN_PASSWORD_LENGTH}; the confirmation is a UI concern and is checked\n * here rather than server-side (the host is told one password, and storing only\n * what was typed twice is the browser's job).\n * @param password - the new password draft.\n * @param confirm - the confirmation draft.\n * @returns the reason it cannot be submitted, or `null` when it can.\n */\nexport function passwordProblem(password: string, confirm: string): PasswordProblem | null {\n  if (password.length < MIN_PASSWORD_LENGTH) return 'tooShort'\n  if (password !== confirm) return 'mismatch'\n  return null\n}\n\n/* ------------------------------------------------------------------ */\n/* Bilingual copy (ModLens-style: two small sets, picked by browser)   */\n/* ------------------------------------------------------------------ */\n\ninterface Labels {\n  title: string\n  description: string\n  unsaved: string\n  save: string\n  saving: string\n  discard: string\n  reset: string\n  readOnly: string\n  saveFailed: string\n  loadFailed: string\n  emptyMeansClear: string\n  running: string\n  stopped: string\n  tls: string\n  lastError: string\n  passwordSection: string\n  passwordHint: string\n  passwordNew: string\n  passwordConfirm: string\n  passwordSet: string\n  passwordUnset: string\n  passwordRequired: string\n  passwordChange: string\n  passwordChanged: string\n  passwordFailed: string\n  passwordStaleHost: string\n  passwordTooShort: string\n  passwordMismatch: string\n  [key: `field.${string}`]: string\n  [key: `hint.${string}`]: string\n  [key: `opt.${string}`]: string\n}\n\nconst LABELS: Record<'zh' | 'en', Labels> = {\n  zh: {\n    title: 'LAN 网关',\n    description: '远程访问开关、端口、TLS 证书、受信网段等网关设置',\n    unsaved: '未保存',\n    save: '保存',\n    saving: '保存中…',\n    discard: '放弃',\n    reset: '重置',\n    readOnly: '网关设置只能在宿主机本机打开 dsh web 时修改：配置路由仅监听回环地址，经网关远程访问的浏览器会被拒绝。远程请改用 lan_gateway 工具。',\n    saveFailed: '保存未生效，请检查输入后重试。',\n    loadFailed: '无法读取网关配置',\n    emptyMeansClear: '留空 = 使用默认',\n    running: '运行中',\n    stopped: '已停止',\n    tls: 'TLS',\n    lastError: '上次错误',\n    passwordSection: '登录密码',\n    passwordHint: '当前密码不会显示（也读不出来）。输入两次新密码后直接覆盖原密码；改密会递增会话代次，所有已登录会话与已建立的 WebSocket 立即失效。仅在从本机 loopback 打开 dsh web 时可改。',\n    passwordNew: '新密码（至少 8 位）',\n    passwordConfirm: '再次输入新密码',\n    passwordSet: '已设置',\n    passwordUnset: '未设置',\n    passwordRequired: '未设置密码时网关拒绝启动。',\n    passwordChange: '修改密码',\n    passwordChanged: '密码已更新：旧密码立即失效，所有已登录会话已作废。',\n    passwordFailed: '修改密码失败，请重试。',\n    passwordStaleHost: '宿主端没有响应这个接口：可能还没重启 dsh web 加载新版本。重启后再试；重启前仍可用 lan_gateway 工具改密。',\n    passwordTooShort: '密码至少 8 位。',\n    passwordMismatch: '两次输入不一致。',\n    'field.enabled': '启用网关',\n    'hint.enabled': '启动时监听 0.0.0.0 网关端口',\n    'field.gatewayPort': '网关端口',\n    'hint.gatewayPort': '绑定到 0.0.0.0 的监听端口（默认 3081）',\n    'field.dshTargetPort': 'dsh 目标端口',\n    'hint.dshTargetPort': '留空则自动跟随 dsh web 端口（默认 3080）',\n    'field.lanCidrs': '免密 LAN 网段',\n    'hint.lanCidrs': '逗号分隔的 CIDR，如 10.0.0.0/8, 192.168.0.0/16',\n    'field.lanPasswordless': 'LAN 免登录',\n    'hint.lanPasswordless': 'LAN/回环来源跳过网关登录页，但仍共用同一上游会话（需 dsh ≥ 0.1.2）',\n    'field.allowInsecurePlaintext': '允许明文 HTTP',\n    'hint.allowInsecurePlaintext': '危险：关闭 TLS 或受信终止代理时仍启动监听，密码与会话将以明文传输',\n    'field.trustedTerminator': '受信 TLS 终止代理',\n    'hint.trustedTerminator': '可选：声明前置代理标识，视为加密入口（如 nginx）。留空 = 未声明。注意：登录限流以 TCP 源地址为键，代理之后所有浏览器共用一个额度（5 次/分钟）',\n    'field.secureCookies': '会话 cookie 的 Secure 属性',\n    'hint.secureCookies': '自动 = TLS 或已声明受信终止代理时加 Secure。受信代理只做明文鉴权、浏览器走 http 访问时须设为 false，否则浏览器拒收 Secure cookie，登录会无限弹回登录页',\n    'opt.auto': '自动',\n    'opt.true': '始终 Secure',\n    'opt.false': '不加 Secure（明文浏览器入口）',\n    'field.cookieMaxAgeDays': '会话有效期（天）',\n    'hint.cookieMaxAgeDays': '登录 cookie 的存活天数（默认 7）',\n    'field.tlsEnabled': '启用 TLS（HTTPS）',\n    'hint.tlsEnabled': '以 HTTPS 提供网关服务',\n    'field.tlsMode': '证书来源',\n    'hint.tlsMode': 'self-signed = 自动生成自签名证书；custom = 使用自己的证书',\n    'field.tlsSelfSignedHosts': '自签名证书域名/IP',\n    'hint.tlsSelfSignedHosts': '逗号分隔，写入证书 SAN，如 localhost, 192.168.1.5。仅影响下次换发：已有证书沿用至到期，改动不会立刻生效',\n    'field.tlsCertPath': '证书文件路径（custom）',\n    'hint.tlsCertPath': 'PEM 格式证书（或证书链）的绝对路径',\n    'field.tlsKeyPath': '私钥文件路径（custom）',\n    'hint.tlsKeyPath': '与证书配套的 PEM 私钥绝对路径',\n    'field.tlsCertMaxAgeDays': '自签名证书有效期（天）',\n    'hint.tlsCertMaxAgeDays': '默认 825（约 27 个月）。仅影响下次换发：已有证书沿用至到期',\n  },\n  en: {\n    title: 'LAN Gateway',\n    description: 'Remote-access switch, port, TLS certificate, trusted CIDRs and more',\n    unsaved: 'Unsaved',\n    save: 'Save',\n    saving: 'Saving…',\n    discard: 'Discard',\n    reset: 'Reset',\n    readOnly: 'Gateway settings can only be changed where dsh web runs locally: the config route listens on loopback only, so a browser reaching dsh through the gateway is refused. Use the lan_gateway tool remotely.',\n    saveFailed: 'The save did not land — check the inputs and retry.',\n    loadFailed: 'Cannot read the gateway configuration',\n    emptyMeansClear: 'Empty = default',\n    running: 'Running',\n    stopped: 'Stopped',\n    tls: 'TLS',\n    lastError: 'Last error',\n    passwordSection: 'Login password',\n    passwordHint: 'The current password is never shown (it cannot be read back). Enter a new one twice to overwrite it; changing it advances the session epoch, so every signed-in session and live WebSocket is invalidated at once. Only changeable where dsh web runs on loopback.',\n    passwordNew: 'New password (min 8 chars)',\n    passwordConfirm: 'Repeat new password',\n    passwordSet: 'Set',\n    passwordUnset: 'Not set',\n    passwordRequired: 'The gateway refuses to start without a password.',\n    passwordChange: 'Change password',\n    passwordChanged: 'Password updated: the old one no longer works and every signed-in session was revoked.',\n    passwordFailed: 'The password change failed — retry.',\n    passwordStaleHost: 'The host did not answer this endpoint — it may still be running the previous build. Restart dsh web and retry; the lan_gateway tool can change the password meanwhile.',\n    passwordTooShort: 'At least 8 characters.',\n    passwordMismatch: 'The two entries do not match.',\n    'field.enabled': 'Enable gateway',\n    'hint.enabled': 'Listen on the gateway port at boot',\n    'field.gatewayPort': 'Gateway port',\n    'hint.gatewayPort': 'Port bound on 0.0.0.0 (default 3081)',\n    'field.dshTargetPort': 'dsh target port',\n    'hint.dshTargetPort': 'Leave empty to follow the dsh web port (default 3080)',\n    'field.lanCidrs': 'Password-free LAN CIDRs',\n    'hint.lanCidrs': 'Comma separated CIDRs, e.g. 10.0.0.0/8, 192.168.0.0/16',\n    'field.lanPasswordless': 'LAN skip login',\n    'hint.lanPasswordless': 'LAN/loopback sources skip the gateway login page but still ride one shared upstream session (needs dsh >= 0.1.2)',\n    'field.allowInsecurePlaintext': 'Allow plaintext HTTP',\n    'hint.allowInsecurePlaintext': 'Dangerous: start the listener even without TLS or a trusted terminator; passwords and sessions travel in clear',\n    'field.trustedTerminator': 'Trusted TLS terminator',\n    'hint.trustedTerminator': 'Optional identifier for a front proxy (e.g. nginx) treated as the encrypted ingress. Empty = none declared. Note: login rate limiting keys on the TCP source address, so behind a proxy every browser shares one budget (5/min)',\n    'field.secureCookies': 'Session cookie Secure attribute',\n    'hint.secureCookies': 'Auto = Secure when TLS or a trusted terminator is declared. Set false when the trusted proxy only authenticates over plaintext and browsers reach it over http — otherwise browsers drop the Secure cookie and every login bounces back to the login page',\n    'opt.auto': 'Auto',\n    'opt.true': 'Always Secure',\n    'opt.false': 'No Secure (plaintext browser ingress)',\n    'field.cookieMaxAgeDays': 'Session lifetime (days)',\n    'hint.cookieMaxAgeDays': 'Login cookie lifetime (default 7)',\n    'field.tlsEnabled': 'Enable TLS (HTTPS)',\n    'hint.tlsEnabled': 'Serve the gateway over HTTPS',\n    'field.tlsMode': 'Certificate source',\n    'hint.tlsMode': 'self-signed = auto-generated certificate; custom = your own files',\n    'field.tlsSelfSignedHosts': 'Self-signed hosts (SANs)',\n    'hint.tlsSelfSignedHosts': 'Comma separated DNS/IP names, e.g. localhost, 192.168.1.5. Applies to the next issuance only: an existing certificate is reused until it expires',\n    'field.tlsCertPath': 'Certificate path (custom)',\n    'hint.tlsCertPath': 'Absolute path to a PEM certificate (or chain)',\n    'field.tlsKeyPath': 'Private key path (custom)',\n    'hint.tlsKeyPath': 'Absolute path to the matching PEM private key',\n    'field.tlsCertMaxAgeDays': 'Self-signed validity (days)',\n    'hint.tlsCertMaxAgeDays': 'Default 825 (about 27 months). Applies to the next issuance only: an existing certificate is reused until it expires',\n  },\n}\n\nfunction labels(): Labels {\n  const lang = (typeof navigator !== 'undefined' ? navigator.language : 'en').toLowerCase()\n  return lang.startsWith('zh') ? LABELS.zh : LABELS.en\n}\n\n/**\n * The card's title in the browser's language, for the Plugins page's list\n * entry. A thunk so the label follows the page's locale without re-registering.\n * @returns the localized card title.\n */\nexport function cardTitle(): string {\n  return labels().title\n}\n\n/* ------------------------------------------------------------------ */\n/* Card                                                                */\n/* ------------------------------------------------------------------ */\n\n/**\n * Render the LAN gateway card. Self-loading: fetches the config route on\n * mount, posts the edited config on save.\n *\n * `view` swaps between the card's one-liner and its page body, so the branch\n * sits after the hooks: the Plugins page re-renders one contribution under the\n * other view when the card is opened.\n * @param props - the view the Plugins page is asking for.\n * @returns the one-liner, the card, or nothing while the route is unreachable.\n */\nexport function LanGatewayCard(props: LanGatewayCardProps): ReactNode {\n  const t = labels()\n  const [open, setOpen] = useState(false)\n  const [route, setRoute] = useState<RouteState | null>(null)\n  const [loadFailed, setLoadFailed] = useState(false)\n  const [drafts, setDrafts] = useState<Partial<Record<string, string>>>({})\n  const [saving, setSaving] = useState(false)\n  const [failed, setFailed] = useState<string | null>(null)\n  // The password section is its own submit path: a password is not a settings\n  // key, so it must not ride the config patch (nor light up the card's \"未保存\"\n  // badge for every keystroke in a password box).\n  const [password, setPasswordDraft] = useState('')\n  const [passwordConfirm, setPasswordConfirmDraft] = useState('')\n  const [passwordBusy, setPasswordBusy] = useState(false)\n  const [passwordError, setPasswordError] = useState<string | null>(null)\n  const [passwordNotice, setPasswordNotice] = useState<string | null>(null)\n\n  useEffect(() => {\n    let cancelled = false\n    fetch('/lan-gateway/config')\n      .then(async (response) => {\n        if (cancelled) return\n        if (!response.ok) throw new Error(`HTTP ${response.status}`)\n        setRoute(await response.json() as RouteState)\n      })\n      .catch(() => {\n        if (!cancelled) setLoadFailed(true)\n      })\n    return () => { cancelled = true }\n  }, [])\n\n  // The Plugins page lists this plugin as one card and opens its own page on\n  // demand: `summary` is the one-liner the list shows, `page` the body. The\n  // hooks above run for both views, because the same contribution flips\n  // between them.\n  if (props.view === 'summary') return t.description\n\n  // A remote browser reaches this card through the gateway, which answers 403\n  // for the plugin's own prefix by design, so the route is unreachable exactly\n  // where a user is most likely to go looking for the setting. Rendering\n  // nothing left them with a blank entry and no way to tell a missing card from\n  // a broken one; say what is wrong and where the card does work instead.\n  if (loadFailed) {\n    return (\n      <div style={styles.card}>\n        <div style={styles.header}>\n          <span style={styles.headerTop}>\n            <span style={styles.name}>{t.title}</span>\n          </span>\n          <span style={styles.description}>{t.loadFailed}</span>\n        </div>\n        <div style={styles.body}>\n          <p style={styles.hint}>{t.readOnly}</p>\n        </div>\n      </div>\n    )\n  }\n  if (route === null) return null\n\n  const { config } = route\n  const draftOf = (field: keyof LanGatewaySettings): string =>\n    drafts[field] ?? formatValue(FIELDS.find(f => f.field === field)!, config[field])\n\n  const stage = (field: string, text: string): void => {\n    setDrafts(prev => ({ ...prev, [field]: text }))\n    setFailed(null)\n  }\n\n  const resetField = (def: FieldDef): void => {\n    setDrafts(prev => {\n      const next = { ...prev }\n      delete next[def.field]\n      return next\n    })\n  }\n\n  const discard = (): void => {\n    setDrafts({})\n    setFailed(null)\n  }\n\n  const invalid = (): boolean =>\n    Object.entries(drafts).some(([field, text]) => {\n      const def = FIELDS.find(f => f.field === field)\n      return def === undefined || parseValue(def, text ?? '') === undefined\n    })\n\n  const dirty = Object.keys(drafts).length > 0\n  const passwordDraftProblem = passwordProblem(password, passwordConfirm)\n  const passwordTyping = password !== '' || passwordConfirm !== ''\n\n  /** Adopt the host's post-write snapshot, keeping the last known values. */\n  const adopt = (body: Partial<RouteState>): void => {\n    if (body.config === undefined) return\n    setRoute({\n      config: body.config,\n      running: body.running ?? false,\n      port: body.port ?? 0,\n      tls: body.tls ?? '',\n      lastError: body.lastError ?? null,\n      passwordSet: body.passwordSet === true,\n    })\n  }\n\n  /**\n   * Overwrite the login password. Deliberately writes only to\n   * `/lan-gateway/password`: the credential is not part of the config patch, so\n   * a change here can never disturb an unsaved settings draft, and the old\n   * password is neither sent nor requested.\n   */\n  const changePassword = async (): Promise<void> => {\n    if (passwordBusy || passwordProblem(password, passwordConfirm) !== null) return\n    setPasswordBusy(true)\n    setPasswordError(null)\n    setPasswordNotice(null)\n    try {\n      const response = await fetch('/lan-gateway/password', {\n        method: 'POST',\n        headers: { 'content-type': 'application/json' },\n        body: JSON.stringify({ password }),\n      })\n      // A host that predates this route answers the SPA fallback (HTML, 200),\n      // not a 404 — so \"not our JSON\" is the signal, and it must not read as a\n      // wrong password or a network failure.\n      const body = await response.json().catch(() => null) as (Partial<RouteState> & { error?: string }) | null\n      if (!response.ok) {\n        setPasswordError(body?.error ?? (response.status === 404 ? t.passwordStaleHost : `HTTP ${response.status}`))\n        return\n      }\n      if (body === null) {\n        setPasswordError(t.passwordStaleHost)\n        return\n      }\n      // Clear the boxes the moment the write lands: the new credential is now\n      // the stored one, and leaving it on screen is the one thing a password\n      // field should not do.\n      setPasswordDraft('')\n      setPasswordConfirmDraft('')\n      setPasswordNotice(t.passwordChanged)\n      adopt(body)\n    } catch {\n      setPasswordError(t.passwordFailed)\n    } finally {\n      setPasswordBusy(false)\n    }\n  }\n\n  const save = async (): Promise<void> => {\n    if (!dirty || saving || invalid()) return\n    setSaving(true)\n    setFailed(null)\n    try {\n      // A patch of the edited fields only, never the whole config: the card\n      // cannot express every key the section may hold (a custom `cookieName`,\n      // say), and posting a synthesized full config made the route treat those\n      // keys as submitted — resetting each one to its schema default.\n      const patch: Record<string, unknown> = {}\n      for (const [field, text] of Object.entries(drafts)) {\n        const def = FIELDS.find(f => f.field === field)\n        if (def === undefined) continue\n        const write = parseValue(def, text ?? '')\n        if (write === undefined) continue\n        patch[field] = write.kind === 'clear' ? null : write.value\n      }\n      const response = await fetch('/lan-gateway/config', {\n        method: 'POST',\n        headers: { 'content-type': 'application/json' },\n        body: JSON.stringify(patch),\n      })\n      const body = await response.json().catch(() => ({})) as Partial<RouteState> & { error?: string }\n      if (!response.ok) {\n        setFailed(body.error ?? `HTTP ${response.status}`)\n        return\n      }\n      adopt(body)\n      setDrafts({})\n    } catch {\n      setFailed(t.saveFailed)\n    } finally {\n      setSaving(false)\n    }\n  }\n\n  const renderControl = (def: FieldDef): ReactNode => {\n    const field = def.field\n    const label = t[`field.${field}`]\n    const hint = t[`hint.${field}`]\n    const text = draftOf(field)\n    switch (def.kind) {\n      case 'boolean':\n        return (\n          <div style={styles.field}>\n            <label style={styles.checkRow}>\n              <input\n                type=\"checkbox\"\n                checked={text === 'true'}\n                disabled={saving}\n                onChange={(e: ChangeEvent<HTMLInputElement>) =>\n                  stage(field, e.target.checked ? 'true' : 'false')}\n              />\n              <span style={styles.label}>{label}</span>\n              <button\n                type=\"button\"\n                style={styles.reset}\n                disabled={saving || !drafts[field]}\n                onClick={() => resetField(def)}\n              >\n                {t.reset}\n              </button>\n            </label>\n            <span style={styles.hint}>{hint}</span>\n          </div>\n        )\n      case 'select':\n      case 'tristate': {\n        // A tri-state renders as a three-way select because neither a checkbox\n        // (cannot express \"unset\") nor a text field (cannot express false)\n        // distinguishes auto from an explicit false.\n        const options = def.kind === 'tristate' ? TRISTATE_OPTIONS : (def.options ?? [])\n        return (\n          <div style={styles.field}>\n            <label style={styles.label} htmlFor={`lan-gw-${field}`}>{label}</label>\n            <select\n              id={`lan-gw-${field}`}\n              style={styles.input}\n              value={text}\n              disabled={saving}\n              onChange={(e: ChangeEvent<HTMLSelectElement>) => stage(field, e.target.value)}\n            >\n              {options.map(option => (\n                <option key={option} value={option}>\n                  {def.kind === 'tristate' ? t[`opt.${option}`] : option}\n                </option>\n              ))}\n            </select>\n            <span style={styles.hint}>{hint}</span>\n            <button\n              type=\"button\"\n              style={styles.reset}\n              disabled={saving || !drafts[field]}\n              onClick={() => resetField(def)}\n            >\n              {t.reset}\n            </button>\n          </div>\n        )\n      }\n      default:\n        return (\n          <div style={styles.field}>\n            <label style={styles.label} htmlFor={`lan-gw-${field}`}>{label}</label>\n            <input\n              id={`lan-gw-${field}`}\n              style={styles.input}\n              type={def.kind === 'number' ? 'number' : 'text'}\n              value={text}\n              disabled={saving}\n              placeholder={def.optional ? t.emptyMeansClear : undefined}\n              onChange={(e: ChangeEvent<HTMLInputElement>) => stage(field, e.target.value)}\n            />\n            <span style={styles.hint}>{hint}</span>\n          </div>\n        )\n    }\n  }\n\n  const statusLine = `${route.running ? t.running : t.stopped} · ${t.tls}: ${route.tls} · :${route.port}`\n\n  return (\n    <div style={open ? { ...styles.card, ...styles.cardOpen } : styles.card}>\n      <button\n        type=\"button\"\n        style={styles.header}\n        aria-expanded={open}\n        onClick={() => { setOpen(!open) }}\n      >\n        <span style={styles.headerTop}>\n          <span style={styles.name}>{t.title}</span>\n          <span style={styles.status} title={statusLine}>{statusLine}</span>\n          {dirty ? <span style={styles.pending}>{t.unsaved}</span> : null}\n          <span style={open ? { ...styles.chevron, ...styles.chevronOpen } : styles.chevron}>{open ? '▾' : '▸'}</span>\n        </span>\n        <span style={styles.description}>{t.description}</span>\n      </button>\n      {open\n        ? (\n          <div style={styles.body}>\n            {route.lastError ? <p style={styles.error} role=\"status\">{t.lastError}: {route.lastError}</p> : null}\n            <div style={styles.section}>\n              <div style={styles.sectionHead}>\n                <span style={styles.label}>{t.passwordSection}</span>\n                <span style={route.passwordSet === true ? styles.badge : styles.badgeAlert}>\n                  {route.passwordSet === true ? t.passwordSet : t.passwordUnset}\n                </span>\n              </div>\n              <p style={styles.hint}>{t.passwordHint}</p>\n              {route.passwordSet === true ? null : <p style={styles.error}>{t.passwordRequired}</p>}\n              <div style={styles.passwordRow}>\n                <input\n                  id=\"lan-gw-password\"\n                  type=\"password\"\n                  autoComplete=\"new-password\"\n                  aria-label={t.passwordNew}\n                  style={passwordInput}\n                  placeholder={t.passwordNew}\n                  value={password}\n                  disabled={passwordBusy}\n                  onChange={(e: ChangeEvent<HTMLInputElement>) => {\n                    setPasswordDraft(e.target.value)\n                    setPasswordError(null)\n                    setPasswordNotice(null)\n                  }}\n                />\n                <input\n                  id=\"lan-gw-password-confirm\"\n                  type=\"password\"\n                  autoComplete=\"new-password\"\n                  aria-label={t.passwordConfirm}\n                  style={passwordInput}\n                  placeholder={t.passwordConfirm}\n                  value={passwordConfirm}\n                  disabled={passwordBusy}\n                  onChange={(e: ChangeEvent<HTMLInputElement>) => {\n                    setPasswordConfirmDraft(e.target.value)\n                    setPasswordError(null)\n                    setPasswordNotice(null)\n                  }}\n                />\n              </div>\n              <div style={styles.passwordFoot}>\n                {passwordError !== null\n                  ? <p style={styles.error} role=\"alert\">{passwordError}</p>\n                  : passwordNotice !== null\n                    ? <p style={styles.notice} role=\"status\">{passwordNotice}</p>\n                    : passwordTyping && passwordDraftProblem !== null\n                      ? (\n                        <p style={styles.error} role=\"status\">\n                          {passwordDraftProblem === 'tooShort' ? t.passwordTooShort : t.passwordMismatch}\n                        </p>\n                      )\n                      : null}\n                <button\n                  type=\"button\"\n                  style={styles.save}\n                  disabled={passwordBusy || passwordDraftProblem !== null}\n                  onClick={() => { void changePassword() }}\n                >\n                  {passwordBusy ? t.saving : t.passwordChange}\n                </button>\n              </div>\n            </div>\n            {FIELDS.map(def => <div key={def.field}>{renderControl(def)}</div>)}\n            <div style={styles.footer}>\n              {failed ? <p style={styles.error} role=\"status\">{failed}</p> : null}\n              <button\n                type=\"button\"\n                style={styles.discard}\n                disabled={!dirty || saving}\n                onClick={discard}\n              >\n                {t.discard}\n              </button>\n              <button\n                type=\"button\"\n                style={styles.save}\n                disabled={!dirty || invalid() || saving}\n                onClick={() => { void save() }}\n              >\n                {saving ? t.saving : t.save}\n              </button>\n            </div>\n          </div>\n        )\n        : null}\n    </div>\n  )\n}\n\n/* ------------------------------------------------------------------ */\n/* Styling — the official DSH theme tokens (light/dark aware), with    */\n/* neutral fallbacks so the card never renders black-on-black or       */\n/* white-on-white even if a token is missing.                          */\n/* ------------------------------------------------------------------ */\n\n/** Theme token with a fallback for token-less environments. */\nfunction tk(token: string, fallback: string): string {\n  return `var(${token}, ${fallback})`\n}\n\nconst L = {\n  border: tk('--dsw-alias-border-l2', 'rgba(127,127,127,0.35)'),\n  bg: tk('--dsw-alias-bg-layer-3', 'transparent'),\n  bgOpen: tk('--dsw-alias-bg-layer-2', 'transparent'),\n  labelPrimary: tk('--dsw-alias-label-primary', 'inherit'),\n  labelSecondary: tk('--dsw-alias-label-secondary', 'inherit'),\n  labelTertiary: tk('--dsw-alias-label-tertiary', 'rgba(127,127,127,0.8)'),\n  labelDimmed: tk('--dsw-alias-label-dimmed', 'rgba(127,127,127,0.6)'),\n  error: tk('--dsw-alias-label-error', '#d1242f'),\n  brand: tk('--dsw-alias-brand-primary', '#4f6ef7'),\n  badgeBg: tk('--dsw-alias-bg-module-platform', 'rgba(127,127,127,0.14)'),\n}\n\nconst styles: Record<string, React.CSSProperties> = {\n  card: {\n    listStyle: 'none',\n    border: `1px solid ${L.border}`,\n    borderRadius: '12px',\n    background: L.bg,\n    transition: 'border-color .16s, background .16s',\n    overflow: 'hidden',\n  },\n  cardOpen: {\n    background: L.bgOpen,\n    borderColor: L.labelDimmed,\n  },\n  header: {\n    display: 'flex',\n    flexDirection: 'column',\n    alignItems: 'stretch',\n    gap: '6px',\n    width: '100%',\n    padding: '14px 16px',\n    border: 0,\n    background: 'none',\n    font: 'inherit',\n    color: 'inherit',\n    textAlign: 'left',\n    cursor: 'pointer',\n  },\n  headerTop: { display: 'flex', alignItems: 'center', gap: '12px', width: '100%' },\n  name: { flex: '1 1 auto', minWidth: 0, fontSize: '15px', fontWeight: 600, lineHeight: 1.4, color: L.labelPrimary },\n  // The status carries a verbose TLS cert summary; cap it and ellipsize so it\n  // can never swallow the row or squeeze the title (the old nowrap alone\n  // caused the description to be pushed into a thin wrapping column).\n  status: {\n    flex: '0 1 auto',\n    minWidth: 0,\n    maxWidth: '60%',\n    fontSize: '11px',\n    lineHeight: 1.4,\n    color: L.labelTertiary,\n    whiteSpace: 'nowrap',\n    overflow: 'hidden',\n    textOverflow: 'ellipsis',\n  },\n  description: {\n    display: 'block',\n    fontSize: '13px',\n    lineHeight: 1.5,\n    color: L.labelTertiary,\n    whiteSpace: 'nowrap',\n    overflow: 'hidden',\n    textOverflow: 'ellipsis',\n  },\n  pending: {\n    flex: 'none',\n    borderRadius: '999px',\n    padding: '1px 8px',\n    fontSize: '11px',\n    lineHeight: '17px',\n    fontWeight: 500,\n    whiteSpace: 'nowrap',\n    background: L.badgeBg,\n    color: L.labelSecondary,\n  },\n  chevron: { flex: 'none', color: L.labelTertiary, fontSize: '12px', transition: 'transform .16s' },\n  chevronOpen: { transform: 'rotate(180deg)' },\n  body: {\n    borderTop: `1px solid ${L.border}`,\n    margin: '0 16px',\n    paddingBottom: '8px',\n    display: 'flex',\n    flexDirection: 'column',\n  },\n  // The password block sits inside the card body, ahead of the config fields:\n  // it is the setting an operator comes here for, and it owns its own submit\n  // button (a password is not part of the settings patch), so it is separated\n  // by a rule rather than merged into the field list.\n  section: {\n    display: 'flex',\n    flexDirection: 'column',\n    gap: '8px',\n    padding: '14px 0',\n    borderBottom: `1px solid ${L.border}`,\n  },\n  sectionHead: { display: 'flex', alignItems: 'center', gap: '8px' },\n  badge: {\n    borderRadius: '999px',\n    padding: '1px 8px',\n    fontSize: '11px',\n    lineHeight: '17px',\n    fontWeight: 500,\n    whiteSpace: 'nowrap',\n    background: L.badgeBg,\n    color: L.labelSecondary,\n  },\n  badgeAlert: {\n    borderRadius: '999px',\n    padding: '1px 8px',\n    fontSize: '11px',\n    lineHeight: '17px',\n    fontWeight: 500,\n    whiteSpace: 'nowrap',\n    background: L.badgeBg,\n    color: L.error,\n  },\n  notice: { flex: 1, minWidth: 0, margin: 0, fontSize: '12px', lineHeight: 1.5, color: L.labelSecondary },\n  passwordRow: { display: 'flex', flexWrap: 'wrap', gap: '8px' },\n  passwordFoot: {\n    display: 'flex',\n    alignItems: 'center',\n    justifyContent: 'flex-end',\n    gap: '8px',\n    marginTop: '2px',\n  },\n  field: {\n    display: 'flex',\n    flexDirection: 'column',\n    gap: '6px',\n    padding: '12px 0',\n  },\n  label: { fontSize: '13px', fontWeight: 500, lineHeight: 1.5, color: L.labelPrimary },\n  hint: { margin: 0, fontSize: '12px', lineHeight: 1.5, color: L.labelTertiary },\n  checkRow: { display: 'flex', alignItems: 'center', gap: '8px', cursor: 'pointer' },\n  reset: {\n    border: 'none',\n    background: 'none',\n    padding: 0,\n    font: 'inherit',\n    fontSize: '12px',\n    lineHeight: 1.5,\n    color: L.labelSecondary,\n    cursor: 'pointer',\n    alignSelf: 'flex-start',\n  },\n  input: {\n    height: '34px',\n    padding: '0 12px',\n    border: `1px solid ${L.border}`,\n    borderRadius: '8px',\n    background: L.bg,\n    font: 'inherit',\n    fontSize: '13px',\n    lineHeight: 1.5,\n    color: L.labelPrimary,\n  },\n  footer: {\n    display: 'flex',\n    alignItems: 'center',\n    justifyContent: 'flex-end',\n    gap: '8px',\n    padding: '12px 0 4px',\n    borderTop: `1px solid ${L.border}`,\n  },\n  error: { flex: 1, minWidth: 0, margin: 0, fontSize: '12px', lineHeight: 1.5, color: L.error },\n  discard: {\n    appearance: 'none',\n    border: `1px solid ${L.border}`,\n    borderRadius: '8px',\n    padding: '5px 14px',\n    font: 'inherit',\n    fontSize: '13px',\n    lineHeight: 1.5,\n    background: 'none',\n    color: L.labelSecondary,\n    cursor: 'pointer',\n  },\n  save: {\n    appearance: 'none',\n    border: '1px solid transparent',\n    borderRadius: '8px',\n    padding: '5px 14px',\n    font: 'inherit',\n    fontSize: '13px',\n    lineHeight: 1.5,\n    background: L.labelPrimary,\n    color: L.bg,\n    cursor: 'pointer',\n  },\n}\n\n/** The shared input style plus the growth two side-by-side password boxes need. */\nconst passwordInput: React.CSSProperties = { ...styles.input, flex: '1 1 160px' }\n","/**\n * @riceawa/dsh-lan-gateway — browser half.\n *\n * Two jobs:\n * 1. Insecure-origin UUID shim: the gateway can serve the GUI over plain HTTP\n *    on LAN addresses, where browsers lack `crypto.randomUUID()`. This bundle\n *    installs a getRandomValues-backed `randomUUID` on the Crypto prototype at\n *    module scope. With TLS enabled the origin is secure and the shim is a\n *    no-op.\n * 2. Settings card: registers the LAN gateway card into the official Plugins\n *    page (`plugins.item` slot) so port, CIDRs, auth, and TLS stay adjustable\n *    from the GUI.\n */\n\n/** RFC 4122 v4 UUID from crypto.getRandomValues (available on insecure origins). */\nfunction uuidFromRandomValues(): string {\n  const bytes = globalThis.crypto.getRandomValues(new Uint8Array(16))\n  const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength)\n  view.setUint8(6, (view.getUint8(6) & 0x0f) | 0x40)\n  view.setUint8(8, (view.getUint8(8) & 0x3f) | 0x80)\n  const hex = Array.from(bytes, byte => byte.toString(16).padStart(2, '0')).join('')\n  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`\n}\n\n/**\n * Install `randomUUID` on the browser Crypto prototype when the platform\n * lacks it. Idempotent; re-checks every call.\n * @returns `true` when the shim was installed by this call.\n */\nexport function installRandomUuidShim(): boolean {\n  const cryptoObj = globalThis.crypto\n  if (cryptoObj === undefined) return false\n  if (typeof cryptoObj.randomUUID === 'function') return false\n  if (typeof cryptoObj.getRandomValues !== 'function') return false\n  try {\n    // Browsers expose crypto.randomUUID through the Crypto prototype; patching\n    // the prototype (not the instance) covers `crypto.randomUUID()` everywhere.\n    const proto = Object.getPrototypeOf(cryptoObj) as { randomUUID?: unknown } | null\n    if (proto !== null && typeof proto.randomUUID !== 'function') {\n      Object.defineProperty(proto, 'randomUUID', {\n        value: uuidFromRandomValues,\n        writable: true,\n        configurable: true,\n      })\n      return true\n    }\n    // Fallback: direct instance property (sandboxed/odd environments).\n    Object.defineProperty(cryptoObj, 'randomUUID', {\n      value: uuidFromRandomValues,\n      writable: true,\n      configurable: true,\n    })\n    return true\n  } catch {\n    return false\n  }\n}\n\n// Module scope: the shim is live as soon as this bundle is evaluated, before\n// any RPC/session code runs. apply() re-runs it as a belt-and-braces re-check.\ninstallRandomUuidShim()\n\nimport type { ClientContext } from '@deepseek-ai/dsh-client-runtime/client'\n// Type-only, and never bundled: the Plugins page's slot contract (`plugins.item`)\n// and the settings domain's `configForms` service both resolve from the web\n// shell's frozen module table. Importing them is what subjects the registration\n// below to the platform's own contract instead of a local copy that drifts the\n// next time upstream renames a slot.\nimport type {} from '@deepseek-ai/dsh-client-ui-plugin-manager/client'\nimport type {} from '@deepseek-ai/dsh-client-ui-settings/client'\nimport { LanGatewayCard, cardTitle } from './lan-gateway-card.tsx'\n\nexport const name = 'dsh-lan-gateway'\n\n/**\n * The profile entry id this plugin's bundle patch composes it under, and the\n * settings namespace dsh ≥ 0.1.7 addresses every write by.\n */\nconst ENTRY_ID = 'dsh-lan-gateway'\n\n/** The slots service the card rides, and the settings mirror the gate reads. */\nexport const inject = ['slots', 'configForms']\n\n/**\n * Mount the settings card and the UUID shim.\n * @param ctx - the browser plugin context.\n */\nexport function apply(ctx: ClientContext): void {\n  installRandomUuidShim()\n\n  // The card rides the official Plugins page. Like ModLens it registers with no\n  // inject face and fetches its own loopback config route, so it depends on no\n  // settings, locale, or connection service.\n  //\n  // dsh 0.1.7 replaced the namespace-keyed `settings.plugin.item` slot with the\n  // list slot `plugins.item`, which is where a host-plane plugin's own\n  // configuration page belongs (\"one companion package per host-plane\n  // namespace\"); the page renders the contribution as the card's one-liner and,\n  // once opened, as the body of the plugin's own page. Registering into the\n  // retired slot left the card invisible on 0.1.7.\n  //\n  // `whileServed` keeps the entry off the page until the Host's settings mirror\n  // serves this plugin's entry. That is the one gate worth having: without a\n  // Loader entry there is nothing to write to, and the card would appear only\n  // to fail every save with the route's 409.\n  ctx.effect(() => ctx.configForms.whileServed([ENTRY_ID], () =>\n    ctx.slots.inject('plugins.item', () => ctx.slots.register({\n      name: 'plugins.item',\n      id: ENTRY_ID,\n      order: 30,\n      label: () => cardTitle(),\n    }, LanGatewayCard))))\n}\n"],"mappings":";;;;;;;;;;EAuEA,MAAa,mBAAmB;GAAC;GAAQ;GAAQ;EAAO;;;;;;;EAQxD,MAAa,SAA8B;GACzC;IAAE,OAAO;IAAW,MAAM;GAAU;GACpC;IAAE,OAAO;IAAe,MAAM;GAAS;GACvC;IAAE,OAAO;IAAiB,MAAM;IAAU,UAAU;GAAK;GACzD;IAAE,OAAO;IAAY,MAAM;GAAQ;GACnC;IAAE,OAAO;IAAmB,MAAM;GAAU;GAC5C;IAAE,OAAO;IAAoB,MAAM;GAAS;GAC5C;IAAE,OAAO;IAAc,MAAM;GAAU;GACvC;IAAE,OAAO;IAAW,MAAM;IAAU,SAAS,CAAC,eAAe,QAAQ;GAAE;GACvE;IAAE,OAAO;IAAsB,MAAM;GAAO;GAC5C;IAAE,OAAO;IAAe,MAAM;IAAQ,UAAU;GAAK;GACrD;IAAE,OAAO;IAAc,MAAM;IAAQ,UAAU;GAAK;GACpD;IAAE,OAAO;IAAqB,MAAM;GAAS;GAC7C;IAAE,OAAO;IAA0B,MAAM;GAAU;GACnD;IAAE,OAAO;IAAqB,MAAM;IAAQ,UAAU;GAAK;GAC3D;IAAE,OAAO;IAAiB,MAAM;GAAW;EAC7C;EAGsD,IAAI,IAAI,OAAO,KAAI,QAAO,IAAI,KAAe,CAAC;EAG3C,IAAI,IAC3D,OAAO,QAAO,QAAO,IAAI,aAAa,IAAI,CAAC,CAAC,KAAI,QAAO,IAAI,KAAe,CAC5E;;EAGA,SAAgB,YAAY,KAAe,OAAwB;GACjE,QAAQ,IAAI,MAAZ;IACE,KAAK,WAAW,OAAO,UAAU,OAAO,SAAS;IACjD,KAAK,UAAU,OAAO,OAAO,UAAU,WAAW,OAAO,KAAK,IAAI;IAClE,KAAK,SAAS,OAAO,MAAM,QAAQ,KAAK,IAAI,MAAM,KAAK,IAAI,IAAI;IAC/D,KAAK,UAAU,OAAO,OAAO,UAAU,WAAW,QAAS,IAAI,UAAU,MAAM;IAE/E,KAAK,YAAY,OAAO,UAAU,OAAO,SAAS,UAAU,QAAQ,UAAU;IAC9E,KAAK,QAAQ,OAAO,OAAO,UAAU,WAAW,QAAQ;GAC1D;EACF;;EAMA,SAAgB,WAAW,KAAe,MAAiC;GACzE,MAAM,UAAU,KAAK,KAAK;GAC1B,QAAQ,IAAI,MAAZ;IACE,KAAK;KACH,IAAI,YAAY,QAAQ,OAAO;MAAE,MAAM;MAAO,OAAO;KAAK;KAC1D,IAAI,YAAY,SAAS,OAAO;MAAE,MAAM;MAAO,OAAO;KAAM;KAC5D;IACF,KAAK;KACH,IAAI,YAAY,IAAI,OAAO,IAAI,WAAW,EAAE,MAAM,QAAQ,IAAI,KAAA;KAC9D,IAAI,CAAC,QAAQ,KAAK,OAAO,GAAG,OAAO,KAAA;KACnC,OAAO;MAAE,MAAM;MAAO,OAAO,OAAO,OAAO;KAAE;IAC/C,KAAK,SAAS;KACZ,MAAM,QAAQ,QAAQ,MAAM,GAAG,CAAC,CAAC,KAAI,MAAK,EAAE,KAAK,CAAC,CAAC,CAAC,QAAO,MAAK,MAAM,EAAE;KACxE,OAAO,MAAM,WAAW,IAAI,EAAE,MAAM,QAAQ,IAAI;MAAE,MAAM;MAAO,OAAO;KAAM;IAC9E;IACA,KAAK,UACH,OAAO,IAAI,SAAS,SAAS,OAAO,IAAI;KAAE,MAAM;KAAO,OAAO;IAAQ,IAAI,KAAA;IAC5E,KAAK;KAGH,IAAI,YAAY,QAAQ,OAAO,EAAE,MAAM,QAAQ;KAC/C,IAAI,YAAY,QAAQ,OAAO;MAAE,MAAM;MAAO,OAAO;KAAK;KAC1D,IAAI,YAAY,SAAS,OAAO;MAAE,MAAM;MAAO,OAAO;KAAM;KAC5D;IACF,KAAK,QACH,OAAO,YAAY,KAAM,IAAI,WAAW,EAAE,MAAM,QAAQ,IAAI,KAAA,IAAa;KAAE,MAAM;KAAO,OAAO;IAAQ;GAC3G;EACF;;;;;;;;;;;;;;;;;;;;;;;;EC7EA,SAAgB,gBAAgB,UAAkB,SAAyC;GACzF,IAAI,SAAS,SAAA,GAA8B,OAAO;GAClD,IAAI,aAAa,SAAS,OAAO;GACjC,OAAO;EACT;EAwCA,MAAM,SAAsC;GAC1C,IAAI;IACF,OAAO;IACP,aAAa;IACb,SAAS;IACT,MAAM;IACN,QAAQ;IACR,SAAS;IACT,OAAO;IACP,UAAU;IACV,YAAY;IACZ,YAAY;IACZ,iBAAiB;IACjB,SAAS;IACT,SAAS;IACT,KAAK;IACL,WAAW;IACX,iBAAiB;IACjB,cAAc;IACd,aAAa;IACb,iBAAiB;IACjB,aAAa;IACb,eAAe;IACf,kBAAkB;IAClB,gBAAgB;IAChB,iBAAiB;IACjB,gBAAgB;IAChB,mBAAmB;IACnB,kBAAkB;IAClB,kBAAkB;IAClB,iBAAiB;IACjB,gBAAgB;IAChB,qBAAqB;IACrB,oBAAoB;IACpB,uBAAuB;IACvB,sBAAsB;IACtB,kBAAkB;IAClB,iBAAiB;IACjB,yBAAyB;IACzB,wBAAwB;IACxB,gCAAgC;IAChC,+BAA+B;IAC/B,2BAA2B;IAC3B,0BAA0B;IAC1B,uBAAuB;IACvB,sBAAsB;IACtB,YAAY;IACZ,YAAY;IACZ,aAAa;IACb,0BAA0B;IAC1B,yBAAyB;IACzB,oBAAoB;IACpB,mBAAmB;IACnB,iBAAiB;IACjB,gBAAgB;IAChB,4BAA4B;IAC5B,2BAA2B;IAC3B,qBAAqB;IACrB,oBAAoB;IACpB,oBAAoB;IACpB,mBAAmB;IACnB,2BAA2B;IAC3B,0BAA0B;GAC5B;GACA,IAAI;IACF,OAAO;IACP,aAAa;IACb,SAAS;IACT,MAAM;IACN,QAAQ;IACR,SAAS;IACT,OAAO;IACP,UAAU;IACV,YAAY;IACZ,YAAY;IACZ,iBAAiB;IACjB,SAAS;IACT,SAAS;IACT,KAAK;IACL,WAAW;IACX,iBAAiB;IACjB,cAAc;IACd,aAAa;IACb,iBAAiB;IACjB,aAAa;IACb,eAAe;IACf,kBAAkB;IAClB,gBAAgB;IAChB,iBAAiB;IACjB,gBAAgB;IAChB,mBAAmB;IACnB,kBAAkB;IAClB,kBAAkB;IAClB,iBAAiB;IACjB,gBAAgB;IAChB,qBAAqB;IACrB,oBAAoB;IACpB,uBAAuB;IACvB,sBAAsB;IACtB,kBAAkB;IAClB,iBAAiB;IACjB,yBAAyB;IACzB,wBAAwB;IACxB,gCAAgC;IAChC,+BAA+B;IAC/B,2BAA2B;IAC3B,0BAA0B;IAC1B,uBAAuB;IACvB,sBAAsB;IACtB,YAAY;IACZ,YAAY;IACZ,aAAa;IACb,0BAA0B;IAC1B,yBAAyB;IACzB,oBAAoB;IACpB,mBAAmB;IACnB,iBAAiB;IACjB,gBAAgB;IAChB,4BAA4B;IAC5B,2BAA2B;IAC3B,qBAAqB;IACrB,oBAAoB;IACpB,oBAAoB;IACpB,mBAAmB;IACnB,2BAA2B;IAC3B,0BAA0B;GAC5B;EACF;EAEA,SAAS,SAAiB;GAExB,QADc,OAAO,cAAc,cAAc,UAAU,WAAW,KAAA,CAAM,YAClE,CAAC,CAAC,WAAW,IAAI,IAAI,OAAO,KAAK,OAAO;EACpD;;;;;;EAOA,SAAgB,YAAoB;GAClC,OAAO,OAAO,CAAC,CAAC;EAClB;;;;;;;;;;;EAgBA,SAAgB,eAAe,OAAuC;GACpE,MAAM,IAAI,OAAO;GACjB,MAAM,CAAC,MAAM,YAAA,GAAWA,MAAAA,SAAAA,CAAS,KAAK;GACtC,MAAM,CAAC,OAAO,aAAA,GAAYA,MAAAA,SAAAA,CAA4B,IAAI;GAC1D,MAAM,CAAC,YAAY,kBAAA,GAAiBA,MAAAA,SAAAA,CAAS,KAAK;GAClD,MAAM,CAAC,QAAQ,cAAA,GAAaA,MAAAA,SAAAA,CAA0C,CAAC,CAAC;GACxE,MAAM,CAAC,QAAQ,cAAA,GAAaA,MAAAA,SAAAA,CAAS,KAAK;GAC1C,MAAM,CAAC,QAAQ,cAAA,GAAaA,MAAAA,SAAAA,CAAwB,IAAI;GAIxD,MAAM,CAAC,UAAU,qBAAA,GAAoBA,MAAAA,SAAAA,CAAS,EAAE;GAChD,MAAM,CAAC,iBAAiB,4BAAA,GAA2BA,MAAAA,SAAAA,CAAS,EAAE;GAC9D,MAAM,CAAC,cAAc,oBAAA,GAAmBA,MAAAA,SAAAA,CAAS,KAAK;GACtD,MAAM,CAAC,eAAe,qBAAA,GAAoBA,MAAAA,SAAAA,CAAwB,IAAI;GACtE,MAAM,CAAC,gBAAgB,sBAAA,GAAqBA,MAAAA,SAAAA,CAAwB,IAAI;GAExE,CAAA,GAAA,MAAA,UAAA,OAAgB;IACd,IAAI,YAAY;IAChB,MAAM,qBAAqB,CAAC,CACzB,KAAK,OAAO,aAAa;KACxB,IAAI,WAAW;KACf,IAAI,CAAC,SAAS,IAAI,MAAM,IAAI,MAAM,QAAQ,SAAS,QAAQ;KAC3D,SAAS,MAAM,SAAS,KAAK,CAAe;IAC9C,CAAC,CAAC,CACD,YAAY;KACX,IAAI,CAAC,WAAW,cAAc,IAAI;IACpC,CAAC;IACH,aAAa;KAAE,YAAY;IAAK;GAClC,GAAG,CAAC,CAAC;GAML,IAAI,MAAM,SAAS,WAAW,OAAO,EAAE;GAOvC,IAAI,YACF,OACE,iBAAA,GAAA,kBAAA,KAAA,CAAC,OAAD;IAAK,OAAO,OAAO;IAAnB,UAAA,CACE,iBAAA,GAAA,kBAAA,KAAA,CAAC,OAAD;KAAK,OAAO,OAAO;KAAnB,UAAA,CACE,iBAAA,GAAA,kBAAA,IAAA,CAAC,QAAD;MAAM,OAAO,OAAO;MAClB,UAAA,iBAAA,GAAA,kBAAA,IAAA,CAAC,QAAD;OAAM,OAAO,OAAO;OAAO,UAAA,EAAE;MAAY,CAAA;KACrC,CAAA,GACN,iBAAA,GAAA,kBAAA,IAAA,CAAC,QAAD;MAAM,OAAO,OAAO;MAAc,UAAA,EAAE;KAAiB,CAAA,CAClD;IACL,CAAA,GAAA,iBAAA,GAAA,kBAAA,IAAA,CAAC,OAAD;KAAK,OAAO,OAAO;KACjB,UAAA,iBAAA,GAAA,kBAAA,IAAA,CAAC,KAAD;MAAG,OAAO,OAAO;MAAO,UAAA,EAAE;KAAY,CAAA;IACnC,CAAA,CACF;;GAGT,IAAI,UAAU,MAAM,OAAO;GAE3B,MAAM,EAAE,WAAW;GACnB,MAAM,WAAW,UACf,OAAO,UAAU,YAAY,OAAO,MAAK,MAAK,EAAE,UAAU,KAAK,GAAI,OAAO,MAAM;GAElF,MAAM,SAAS,OAAe,SAAuB;IACnD,WAAU,UAAS;KAAE,GAAG;MAAO,QAAQ;IAAK,EAAE;IAC9C,UAAU,IAAI;GAChB;GAEA,MAAM,cAAc,QAAwB;IAC1C,WAAU,SAAQ;KAChB,MAAM,OAAO,EAAE,GAAG,KAAK;KACvB,OAAO,KAAK,IAAI;KAChB,OAAO;IACT,CAAC;GACH;GAEA,MAAM,gBAAsB;IAC1B,UAAU,CAAC,CAAC;IACZ,UAAU,IAAI;GAChB;GAEA,MAAM,gBACJ,OAAO,QAAQ,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,UAAU;IAC7C,MAAM,MAAM,OAAO,MAAK,MAAK,EAAE,UAAU,KAAK;IAC9C,OAAO,QAAQ,KAAA,KAAa,WAAW,KAAK,QAAQ,EAAE,MAAM,KAAA;GAC9D,CAAC;GAEH,MAAM,QAAQ,OAAO,KAAK,MAAM,CAAC,CAAC,SAAS;GAC3C,MAAM,uBAAuB,gBAAgB,UAAU,eAAe;GACtE,MAAM,iBAAiB,aAAa,MAAM,oBAAoB;;GAG9D,MAAM,SAAS,SAAoC;IACjD,IAAI,KAAK,WAAW,KAAA,GAAW;IAC/B,SAAS;KACP,QAAQ,KAAK;KACb,SAAS,KAAK,WAAW;KACzB,MAAM,KAAK,QAAQ;KACnB,KAAK,KAAK,OAAO;KACjB,WAAW,KAAK,aAAa;KAC7B,aAAa,KAAK,gBAAgB;IACpC,CAAC;GACH;;;;;;;GAQA,MAAM,iBAAiB,YAA2B;IAChD,IAAI,gBAAgB,gBAAgB,UAAU,eAAe,MAAM,MAAM;IACzE,gBAAgB,IAAI;IACpB,iBAAiB,IAAI;IACrB,kBAAkB,IAAI;IACtB,IAAI;KACF,MAAM,WAAW,MAAM,MAAM,yBAAyB;MACpD,QAAQ;MACR,SAAS,EAAE,gBAAgB,mBAAmB;MAC9C,MAAM,KAAK,UAAU,EAAE,SAAS,CAAC;KACnC,CAAC;KAID,MAAM,OAAO,MAAM,SAAS,KAAK,CAAC,CAAC,YAAY,IAAI;KACnD,IAAI,CAAC,SAAS,IAAI;MAChB,iBAAiB,MAAM,UAAU,SAAS,WAAW,MAAM,EAAE,oBAAoB,QAAQ,SAAS,SAAS;MAC3G;KACF;KACA,IAAI,SAAS,MAAM;MACjB,iBAAiB,EAAE,iBAAiB;MACpC;KACF;KAIA,iBAAiB,EAAE;KACnB,wBAAwB,EAAE;KAC1B,kBAAkB,EAAE,eAAe;KACnC,MAAM,IAAI;IACZ,QAAQ;KACN,iBAAiB,EAAE,cAAc;IACnC,UAAU;KACR,gBAAgB,KAAK;IACvB;GACF;GAEA,MAAM,OAAO,YAA2B;IACtC,IAAI,CAAC,SAAS,UAAU,QAAQ,GAAG;IACnC,UAAU,IAAI;IACd,UAAU,IAAI;IACd,IAAI;KAKF,MAAM,QAAiC,CAAC;KACxC,KAAK,MAAM,CAAC,OAAO,SAAS,OAAO,QAAQ,MAAM,GAAG;MAClD,MAAM,MAAM,OAAO,MAAK,MAAK,EAAE,UAAU,KAAK;MAC9C,IAAI,QAAQ,KAAA,GAAW;MACvB,MAAM,QAAQ,WAAW,KAAK,QAAQ,EAAE;MACxC,IAAI,UAAU,KAAA,GAAW;MACzB,MAAM,SAAS,MAAM,SAAS,UAAU,OAAO,MAAM;KACvD;KACA,MAAM,WAAW,MAAM,MAAM,uBAAuB;MAClD,QAAQ;MACR,SAAS,EAAE,gBAAgB,mBAAmB;MAC9C,MAAM,KAAK,UAAU,KAAK;KAC5B,CAAC;KACD,MAAM,OAAO,MAAM,SAAS,KAAK,CAAC,CAAC,aAAa,CAAC,EAAE;KACnD,IAAI,CAAC,SAAS,IAAI;MAChB,UAAU,KAAK,SAAS,QAAQ,SAAS,QAAQ;MACjD;KACF;KACA,MAAM,IAAI;KACV,UAAU,CAAC,CAAC;IACd,QAAQ;KACN,UAAU,EAAE,UAAU;IACxB,UAAU;KACR,UAAU,KAAK;IACjB;GACF;GAEA,MAAM,iBAAiB,QAA6B;IAClD,MAAM,QAAQ,IAAI;IAClB,MAAM,QAAQ,EAAE,SAAS;IACzB,MAAM,OAAO,EAAE,QAAQ;IACvB,MAAM,OAAO,QAAQ,KAAK;IAC1B,QAAQ,IAAI,MAAZ;KACE,KAAK,WACH,OACE,iBAAA,GAAA,kBAAA,KAAA,CAAC,OAAD;MAAK,OAAO,OAAO;MAAnB,UAAA,CACE,iBAAA,GAAA,kBAAA,KAAA,CAAC,SAAD;OAAO,OAAO,OAAO;OAArB,UAAA;QACE,iBAAA,GAAA,kBAAA,IAAA,CAAC,SAAD;SACE,MAAK;SACL,SAAS,SAAS;SAClB,UAAU;SACV,WAAW,MACT,MAAM,OAAO,EAAE,OAAO,UAAU,SAAS,OAAO;QACnD,CAAA;QACD,iBAAA,GAAA,kBAAA,IAAA,CAAC,QAAD;SAAM,OAAO,OAAO;SAAQ,UAAA;QAAY,CAAA;QACxC,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD;SACE,MAAK;SACL,OAAO,OAAO;SACd,UAAU,UAAU,CAAC,OAAO;SAC5B,eAAe,WAAW,GAAG;SAE5B,UAAA,EAAE;QACG,CAAA;OACH;MACP,CAAA,GAAA,iBAAA,GAAA,kBAAA,IAAA,CAAC,QAAD;OAAM,OAAO,OAAO;OAAO,UAAA;MAAW,CAAA,CACnC;;KAET,KAAK;KACL,KAAK,YAAY;MAIf,MAAM,UAAU,IAAI,SAAS,aAAa,mBAAoB,IAAI,WAAW,CAAC;MAC9E,OACE,iBAAA,GAAA,kBAAA,KAAA,CAAC,OAAD;OAAK,OAAO,OAAO;OAAnB,UAAA;QACE,iBAAA,GAAA,kBAAA,IAAA,CAAC,SAAD;SAAO,OAAO,OAAO;SAAO,SAAS,UAAU;SAAU,UAAA;QAAa,CAAA;QACtE,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD;SACE,IAAI,UAAU;SACd,OAAO,OAAO;SACd,OAAO;SACP,UAAU;SACV,WAAW,MAAsC,MAAM,OAAO,EAAE,OAAO,KAAK;SAE3E,UAAA,QAAQ,KAAI,WACX,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD;UAAqB,OAAO;UACzB,UAAA,IAAI,SAAS,aAAa,EAAE,OAAO,YAAY;SAC1C,GAFK,MAEL,CACT;QACK,CAAA;QACR,iBAAA,GAAA,kBAAA,IAAA,CAAC,QAAD;SAAM,OAAO,OAAO;SAAO,UAAA;QAAW,CAAA;QACtC,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD;SACE,MAAK;SACL,OAAO,OAAO;SACd,UAAU,UAAU,CAAC,OAAO;SAC5B,eAAe,WAAW,GAAG;SAE5B,UAAA,EAAE;QACG,CAAA;OACL;;KAET;KACA,SACE,OACE,iBAAA,GAAA,kBAAA,KAAA,CAAC,OAAD;MAAK,OAAO,OAAO;MAAnB,UAAA;OACE,iBAAA,GAAA,kBAAA,IAAA,CAAC,SAAD;QAAO,OAAO,OAAO;QAAO,SAAS,UAAU;QAAU,UAAA;OAAa,CAAA;OACtE,iBAAA,GAAA,kBAAA,IAAA,CAAC,SAAD;QACE,IAAI,UAAU;QACd,OAAO,OAAO;QACd,MAAM,IAAI,SAAS,WAAW,WAAW;QACzC,OAAO;QACP,UAAU;QACV,aAAa,IAAI,WAAW,EAAE,kBAAkB,KAAA;QAChD,WAAW,MAAqC,MAAM,OAAO,EAAE,OAAO,KAAK;OAC5E,CAAA;OACD,iBAAA,GAAA,kBAAA,IAAA,CAAC,QAAD;QAAM,OAAO,OAAO;QAAO,UAAA;OAAW,CAAA;MACnC;;IAEX;GACF;GAEA,MAAM,aAAa,GAAG,MAAM,UAAU,EAAE,UAAU,EAAE,QAAQ,KAAK,EAAE,IAAI,IAAI,MAAM,IAAI,MAAM,MAAM;GAEjG,OACE,iBAAA,GAAA,kBAAA,KAAA,CAAC,OAAD;IAAK,OAAO,OAAO;KAAE,GAAG,OAAO;KAAM,GAAG,OAAO;IAAS,IAAI,OAAO;IAAnE,UAAA,CACE,iBAAA,GAAA,kBAAA,KAAA,CAAC,UAAD;KACE,MAAK;KACL,OAAO,OAAO;KACd,iBAAe;KACf,eAAe;MAAE,QAAQ,CAAC,IAAI;KAAE;KAJlC,UAAA,CAME,iBAAA,GAAA,kBAAA,KAAA,CAAC,QAAD;MAAM,OAAO,OAAO;MAApB,UAAA;OACE,iBAAA,GAAA,kBAAA,IAAA,CAAC,QAAD;QAAM,OAAO,OAAO;QAAO,UAAA,EAAE;OAAY,CAAA;OACzC,iBAAA,GAAA,kBAAA,IAAA,CAAC,QAAD;QAAM,OAAO,OAAO;QAAQ,OAAO;QAAa,UAAA;OAAiB,CAAA;OAChE,QAAQ,iBAAA,GAAA,kBAAA,IAAA,CAAC,QAAD;QAAM,OAAO,OAAO;QAAU,UAAA,EAAE;OAAc,CAAA,IAAI;OAC3D,iBAAA,GAAA,kBAAA,IAAA,CAAC,QAAD;QAAM,OAAO,OAAO;SAAE,GAAG,OAAO;SAAS,GAAG,OAAO;QAAY,IAAI,OAAO;QAAU,UAAA,OAAO,MAAM;OAAU,CAAA;MACvG;KACN,CAAA,GAAA,iBAAA,GAAA,kBAAA,IAAA,CAAC,QAAD;MAAM,OAAO,OAAO;MAAc,UAAA,EAAE;KAAkB,CAAA,CAChD;IACP,CAAA,GAAA,OAEG,iBAAA,GAAA,kBAAA,KAAA,CAAC,OAAD;KAAK,OAAO,OAAO;KAAnB,UAAA;MACG,MAAM,YAAY,iBAAA,GAAA,kBAAA,KAAA,CAAC,KAAD;OAAG,OAAO,OAAO;OAAO,MAAK;OAA7B,UAAA;QAAuC,EAAE;QAAU;QAAG,MAAM;OAAa;MAAI,CAAA,IAAA;MAChG,iBAAA,GAAA,kBAAA,KAAA,CAAC,OAAD;OAAK,OAAO,OAAO;OAAnB,UAAA;QACE,iBAAA,GAAA,kBAAA,KAAA,CAAC,OAAD;SAAK,OAAO,OAAO;SAAnB,UAAA,CACE,iBAAA,GAAA,kBAAA,IAAA,CAAC,QAAD;UAAM,OAAO,OAAO;UAAQ,UAAA,EAAE;SAAsB,CAAA,GACpD,iBAAA,GAAA,kBAAA,IAAA,CAAC,QAAD;UAAM,OAAO,MAAM,gBAAgB,OAAO,OAAO,QAAQ,OAAO;UAC7D,UAAA,MAAM,gBAAgB,OAAO,EAAE,cAAc,EAAE;SAC5C,CAAA,CACH;;QACL,iBAAA,GAAA,kBAAA,IAAA,CAAC,KAAD;SAAG,OAAO,OAAO;SAAO,UAAA,EAAE;QAAgB,CAAA;QACzC,MAAM,gBAAgB,OAAO,OAAO,iBAAA,GAAA,kBAAA,IAAA,CAAC,KAAD;SAAG,OAAO,OAAO;SAAQ,UAAA,EAAE;QAAoB,CAAA;QACpF,iBAAA,GAAA,kBAAA,KAAA,CAAC,OAAD;SAAK,OAAO,OAAO;SAAnB,UAAA,CACE,iBAAA,GAAA,kBAAA,IAAA,CAAC,SAAD;UACE,IAAG;UACH,MAAK;UACL,cAAa;UACb,cAAY,EAAE;UACd,OAAO;UACP,aAAa,EAAE;UACf,OAAO;UACP,UAAU;UACV,WAAW,MAAqC;WAC9C,iBAAiB,EAAE,OAAO,KAAK;WAC/B,iBAAiB,IAAI;WACrB,kBAAkB,IAAI;UACxB;SACD,CAAA,GACD,iBAAA,GAAA,kBAAA,IAAA,CAAC,SAAD;UACE,IAAG;UACH,MAAK;UACL,cAAa;UACb,cAAY,EAAE;UACd,OAAO;UACP,aAAa,EAAE;UACf,OAAO;UACP,UAAU;UACV,WAAW,MAAqC;WAC9C,wBAAwB,EAAE,OAAO,KAAK;WACtC,iBAAiB,IAAI;WACrB,kBAAkB,IAAI;UACxB;SACD,CAAA,CACE;;QACL,iBAAA,GAAA,kBAAA,KAAA,CAAC,OAAD;SAAK,OAAO,OAAO;SAAnB,UAAA,CACG,kBAAkB,OACf,iBAAA,GAAA,kBAAA,IAAA,CAAC,KAAD;UAAG,OAAO,OAAO;UAAO,MAAK;UAAS,UAAA;SAAiB,CAAA,IACvD,mBAAmB,OACjB,iBAAA,GAAA,kBAAA,IAAA,CAAC,KAAD;UAAG,OAAO,OAAO;UAAQ,MAAK;UAAU,UAAA;SAAkB,CAAA,IAC1D,kBAAkB,yBAAyB,OAEzC,iBAAA,GAAA,kBAAA,IAAA,CAAC,KAAD;UAAG,OAAO,OAAO;UAAO,MAAK;UAC1B,UAAA,yBAAyB,aAAa,EAAE,mBAAmB,EAAE;SAC7D,CAAA,IAEH,MACR,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD;UACE,MAAK;UACL,OAAO,OAAO;UACd,UAAU,gBAAgB,yBAAyB;UACnD,eAAe;WAAE,eAAoB;UAAE;UAEtC,UAAA,eAAe,EAAE,SAAS,EAAE;SACvB,CAAA,CACL;;OACF;;MACJ,OAAO,KAAI,QAAO,iBAAA,GAAA,kBAAA,IAAA,CAAC,OAAD,EAAA,UAAsB,cAAc,GAAG,EAAO,GAApC,IAAI,KAAgC,CAAC;MAClE,iBAAA,GAAA,kBAAA,KAAA,CAAC,OAAD;OAAK,OAAO,OAAO;OAAnB,UAAA;QACG,SAAS,iBAAA,GAAA,kBAAA,IAAA,CAAC,KAAD;SAAG,OAAO,OAAO;SAAO,MAAK;SAAU,UAAA;QAAU,CAAA,IAAI;QAC/D,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD;SACE,MAAK;SACL,OAAO,OAAO;SACd,UAAU,CAAC,SAAS;SACpB,SAAS;SAER,UAAA,EAAE;QACG,CAAA;QACR,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD;SACE,MAAK;SACL,OAAO,OAAO;SACd,UAAU,CAAC,SAAS,QAAQ,KAAK;SACjC,eAAe;UAAE,KAAU;SAAE;SAE5B,UAAA,SAAS,EAAE,SAAS,EAAE;QACjB,CAAA;OACL;;KACF;IAEL,CAAA,IAAA,IACD;;EAET;;EASA,SAAS,GAAG,OAAe,UAA0B;GACnD,OAAO,OAAO,MAAM,IAAI,SAAS;EACnC;EAEA,MAAM,IAAI;GACR,QAAQ,GAAG,yBAAyB,wBAAwB;GAC5D,IAAI,GAAG,0BAA0B,aAAa;GAC9C,QAAQ,GAAG,0BAA0B,aAAa;GAClD,cAAc,GAAG,6BAA6B,SAAS;GACvD,gBAAgB,GAAG,+BAA+B,SAAS;GAC3D,eAAe,GAAG,8BAA8B,uBAAuB;GACvE,aAAa,GAAG,4BAA4B,uBAAuB;GACnE,OAAO,GAAG,2BAA2B,SAAS;GAC9C,OAAO,GAAG,6BAA6B,SAAS;GAChD,SAAS,GAAG,kCAAkC,wBAAwB;EACxE;EAEA,MAAM,SAA8C;GAClD,MAAM;IACJ,WAAW;IACX,QAAQ,aAAa,EAAE;IACvB,cAAc;IACd,YAAY,EAAE;IACd,YAAY;IACZ,UAAU;GACZ;GACA,UAAU;IACR,YAAY,EAAE;IACd,aAAa,EAAE;GACjB;GACA,QAAQ;IACN,SAAS;IACT,eAAe;IACf,YAAY;IACZ,KAAK;IACL,OAAO;IACP,SAAS;IACT,QAAQ;IACR,YAAY;IACZ,MAAM;IACN,OAAO;IACP,WAAW;IACX,QAAQ;GACV;GACA,WAAW;IAAE,SAAS;IAAQ,YAAY;IAAU,KAAK;IAAQ,OAAO;GAAO;GAC/E,MAAM;IAAE,MAAM;IAAY,UAAU;IAAG,UAAU;IAAQ,YAAY;IAAK,YAAY;IAAK,OAAO,EAAE;GAAa;GAIjH,QAAQ;IACN,MAAM;IACN,UAAU;IACV,UAAU;IACV,UAAU;IACV,YAAY;IACZ,OAAO,EAAE;IACT,YAAY;IACZ,UAAU;IACV,cAAc;GAChB;GACA,aAAa;IACX,SAAS;IACT,UAAU;IACV,YAAY;IACZ,OAAO,EAAE;IACT,YAAY;IACZ,UAAU;IACV,cAAc;GAChB;GACA,SAAS;IACP,MAAM;IACN,cAAc;IACd,SAAS;IACT,UAAU;IACV,YAAY;IACZ,YAAY;IACZ,YAAY;IACZ,YAAY,EAAE;IACd,OAAO,EAAE;GACX;GACA,SAAS;IAAE,MAAM;IAAQ,OAAO,EAAE;IAAe,UAAU;IAAQ,YAAY;GAAiB;GAChG,aAAa,EAAE,WAAW,iBAAiB;GAC3C,MAAM;IACJ,WAAW,aAAa,EAAE;IAC1B,QAAQ;IACR,eAAe;IACf,SAAS;IACT,eAAe;GACjB;GAKA,SAAS;IACP,SAAS;IACT,eAAe;IACf,KAAK;IACL,SAAS;IACT,cAAc,aAAa,EAAE;GAC/B;GACA,aAAa;IAAE,SAAS;IAAQ,YAAY;IAAU,KAAK;GAAM;GACjE,OAAO;IACL,cAAc;IACd,SAAS;IACT,UAAU;IACV,YAAY;IACZ,YAAY;IACZ,YAAY;IACZ,YAAY,EAAE;IACd,OAAO,EAAE;GACX;GACA,YAAY;IACV,cAAc;IACd,SAAS;IACT,UAAU;IACV,YAAY;IACZ,YAAY;IACZ,YAAY;IACZ,YAAY,EAAE;IACd,OAAO,EAAE;GACX;GACA,QAAQ;IAAE,MAAM;IAAG,UAAU;IAAG,QAAQ;IAAG,UAAU;IAAQ,YAAY;IAAK,OAAO,EAAE;GAAe;GACtG,aAAa;IAAE,SAAS;IAAQ,UAAU;IAAQ,KAAK;GAAM;GAC7D,cAAc;IACZ,SAAS;IACT,YAAY;IACZ,gBAAgB;IAChB,KAAK;IACL,WAAW;GACb;GACA,OAAO;IACL,SAAS;IACT,eAAe;IACf,KAAK;IACL,SAAS;GACX;GACA,OAAO;IAAE,UAAU;IAAQ,YAAY;IAAK,YAAY;IAAK,OAAO,EAAE;GAAa;GACnF,MAAM;IAAE,QAAQ;IAAG,UAAU;IAAQ,YAAY;IAAK,OAAO,EAAE;GAAc;GAC7E,UAAU;IAAE,SAAS;IAAQ,YAAY;IAAU,KAAK;IAAO,QAAQ;GAAU;GACjF,OAAO;IACL,QAAQ;IACR,YAAY;IACZ,SAAS;IACT,MAAM;IACN,UAAU;IACV,YAAY;IACZ,OAAO,EAAE;IACT,QAAQ;IACR,WAAW;GACb;GACA,OAAO;IACL,QAAQ;IACR,SAAS;IACT,QAAQ,aAAa,EAAE;IACvB,cAAc;IACd,YAAY,EAAE;IACd,MAAM;IACN,UAAU;IACV,YAAY;IACZ,OAAO,EAAE;GACX;GACA,QAAQ;IACN,SAAS;IACT,YAAY;IACZ,gBAAgB;IAChB,KAAK;IACL,SAAS;IACT,WAAW,aAAa,EAAE;GAC5B;GACA,OAAO;IAAE,MAAM;IAAG,UAAU;IAAG,QAAQ;IAAG,UAAU;IAAQ,YAAY;IAAK,OAAO,EAAE;GAAM;GAC5F,SAAS;IACP,YAAY;IACZ,QAAQ,aAAa,EAAE;IACvB,cAAc;IACd,SAAS;IACT,MAAM;IACN,UAAU;IACV,YAAY;IACZ,YAAY;IACZ,OAAO,EAAE;IACT,QAAQ;GACV;GACA,MAAM;IACJ,YAAY;IACZ,QAAQ;IACR,cAAc;IACd,SAAS;IACT,MAAM;IACN,UAAU;IACV,YAAY;IACZ,YAAY,EAAE;IACd,OAAO,EAAE;IACT,QAAQ;GACV;EACF;;EAGA,MAAM,gBAAqC;GAAE,GAAG,OAAO;GAAO,MAAM;EAAY;;;;;;;;;;;;;;;;;ECx0BhF,SAAS,uBAA+B;GACtC,MAAM,QAAQ,WAAW,OAAO,gCAAgB,IAAI,WAAW,EAAE,CAAC;GAClE,MAAM,OAAO,IAAI,SAAS,MAAM,QAAQ,MAAM,YAAY,MAAM,UAAU;GAC1E,KAAK,SAAS,GAAI,KAAK,SAAS,CAAC,IAAI,KAAQ,EAAI;GACjD,KAAK,SAAS,GAAI,KAAK,SAAS,CAAC,IAAI,KAAQ,GAAI;GACjD,MAAM,MAAM,MAAM,KAAK,QAAO,SAAQ,KAAK,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE;GACjF,OAAO,GAAG,IAAI,MAAM,GAAG,CAAC,EAAE,GAAG,IAAI,MAAM,GAAG,EAAE,EAAE,GAAG,IAAI,MAAM,IAAI,EAAE,EAAE,GAAG,IAAI,MAAM,IAAI,EAAE,EAAE,GAAG,IAAI,MAAM,EAAE;EACzG;;;;;;EAOA,SAAgB,wBAAiC;GAC/C,MAAM,YAAY,WAAW;GAC7B,IAAI,cAAc,KAAA,GAAW,OAAO;GACpC,IAAI,OAAO,UAAU,eAAe,YAAY,OAAO;GACvD,IAAI,OAAO,UAAU,oBAAoB,YAAY,OAAO;GAC5D,IAAI;IAGF,MAAM,QAAQ,OAAO,eAAe,SAAS;IAC7C,IAAI,UAAU,QAAQ,OAAO,MAAM,eAAe,YAAY;KAC5D,OAAO,eAAe,OAAO,cAAc;MACzC,OAAO;MACP,UAAU;MACV,cAAc;KAChB,CAAC;KACD,OAAO;IACT;IAEA,OAAO,eAAe,WAAW,cAAc;KAC7C,OAAO;KACP,UAAU;KACV,cAAc;IAChB,CAAC;IACD,OAAO;GACT,QAAQ;IACN,OAAO;GACT;EACF;EAIA,sBAAsB;EAYtB,MAAa,OAAO;;;;;EAMpB,MAAM,WAAW;;EAGjB,MAAa,SAAS,CAAC,SAAS,aAAa;;;;;EAM7C,SAAgB,MAAM,KAA0B;GAC9C,sBAAsB;GAiBtB,IAAI,aAAa,IAAI,YAAY,YAAY,CAAC,QAAQ,SACpD,IAAI,MAAM,OAAO,sBAAsB,IAAI,MAAM,SAAS;IACxD,MAAM;IACN,IAAI;IACJ,OAAO;IACP,aAAa,UAAU;GACzB,GAAG,cAAc,CAAC,CAAC,CAAC;EACxB"}
+{"version":3,"file":"client.js","names":["useState"],"sources":["../src/config-fields.ts","../src/client/lan-gateway-card.tsx","../src/client/index.ts"],"sourcesContent":["/**\n * The `lan-gateway` configuration field table: which settings keys exist, how\n * each one is rendered, and how a draft string becomes a config value or a\n * clear.\n *\n * The host and the browser card share this module. The host derives the key set\n * its config route accepts and the set an empty value clears from it; the card\n * renders its controls from it. A field therefore cannot be editable on one\n * side and unknown on the other, which is what let the card silently rewrite\n * keys it never showed.\n *\n * It also carries `MIN_PASSWORD_LENGTH`: the login password is deliberately not\n * a field here (it is a secret in `state.json`, not a settings key), but its\n * length bound is a contract the card's form and the host's password route\n * must not disagree about.\n *\n * Because both halves import it, this module must stay dependency-free and\n * side-effect-free: no schemastery (the host schema remains the validating\n * authority, not this table), no node built-ins, no DOM, no I/O.\n *\n * @module @riceawa/dsh-lan-gateway/config-fields\n */\n\n/**\n * The wire shape of the `lan-gateway` config section, as the Settings card sees\n * it. Deliberately narrower than the host's `Config`: `cookieName` and the\n * retired `authRequired` are not card-editable. The config route applies a\n * patch, so a key absent here is left untouched rather than reset.\n */\nexport interface LanGatewaySettings {\n  enabled?: boolean\n  gatewayPort?: number\n  dshTargetPort?: number\n  lanCidrs?: string[]\n  lanPasswordless?: boolean\n  cookieMaxAgeDays?: number\n  tlsEnabled?: boolean\n  tlsMode?: 'self-signed' | 'custom'\n  tlsCertPath?: string\n  tlsKeyPath?: string\n  tlsSelfSignedHosts?: string\n  tlsCertMaxAgeDays?: number\n  allowInsecurePlaintext?: boolean\n  trustedTerminator?: string\n  secureCookies?: boolean\n}\n\n/** A settings key this table knows how to edit. */\nexport type ConfigFieldKey = keyof LanGatewaySettings\n\n/**\n * Minimum login-password length, in characters. The credential is not a config\n * field (it lives in `state.json`, never in the schema), but the bound belongs\n * here all the same: the card's password form and the host's password route\n * both read it, so a draft the card accepts is never answered with a 400.\n */\nexport const MIN_PASSWORD_LENGTH = 8\n\n/** How a field is rendered and parsed. */\nexport type FieldKind = 'boolean' | 'number' | 'text' | 'cidrs' | 'select' | 'tristate'\n\nexport interface FieldDef {\n  readonly field: ConfigFieldKey\n  readonly kind: FieldKind\n  /** An empty draft clears the key back to the composition layer. */\n  readonly optional?: boolean\n  /** The accepted values of a `select` field. */\n  readonly options?: readonly string[]\n}\n\n/** The three states of a tri-state field, in display order. */\nexport const TRISTATE_OPTIONS = ['auto', 'true', 'false'] as const\n\n/**\n * The editable settings, in display order. Adding a config key means adding it\n * here (the host whitelist and the card's controls both follow), to the\n * `Config` schema in `index.ts`, and to `listenerKey` when it changes listener\n * behavior.\n */\nexport const FIELDS: readonly FieldDef[] = [\n  { field: 'enabled', kind: 'boolean' },\n  { field: 'gatewayPort', kind: 'number' },\n  { field: 'dshTargetPort', kind: 'number', optional: true },\n  { field: 'lanCidrs', kind: 'cidrs' },\n  { field: 'lanPasswordless', kind: 'boolean' },\n  { field: 'cookieMaxAgeDays', kind: 'number' },\n  { field: 'tlsEnabled', kind: 'boolean' },\n  { field: 'tlsMode', kind: 'select', options: ['self-signed', 'custom'] },\n  { field: 'tlsSelfSignedHosts', kind: 'text' },\n  { field: 'tlsCertPath', kind: 'text', optional: true },\n  { field: 'tlsKeyPath', kind: 'text', optional: true },\n  { field: 'tlsCertMaxAgeDays', kind: 'number' },\n  { field: 'allowInsecurePlaintext', kind: 'boolean' },\n  { field: 'trustedTerminator', kind: 'text', optional: true },\n  { field: 'secureCookies', kind: 'tristate' },\n]\n\n/** Every settings key the config route accepts; anything else is ignored. */\nexport const CONFIG_FIELD_KEYS: ReadonlySet<string> = new Set(FIELDS.map(def => def.field as string))\n\n/** Keys an empty submitted value clears back to the composition layer. */\nexport const OPTIONAL_CONFIG_KEYS: ReadonlySet<string> = new Set(\n  FIELDS.filter(def => def.optional === true).map(def => def.field as string),\n)\n\n/** Render a stored value as draft text. */\nexport function formatValue(def: FieldDef, value: unknown): string {\n  switch (def.kind) {\n    case 'boolean': return value === true ? 'true' : 'false'\n    case 'number': return typeof value === 'number' ? String(value) : ''\n    case 'cidrs': return Array.isArray(value) ? value.join(', ') : ''\n    case 'select': return typeof value === 'string' ? value : (def.options?.[0] ?? '')\n    // Tri-state: an unset value is a distinct third state (\"auto\"), never \"false\".\n    case 'tristate': return value === true ? 'true' : value === false ? 'false' : 'auto'\n    case 'text': return typeof value === 'string' ? value : ''\n  }\n}\n\n/** One field's contribution to a config patch. */\nexport type Write = { kind: 'set'; value: unknown } | { kind: 'clear' }\n\n/** Parse draft text into a value for the POST body; undefined blocks saving. */\nexport function parseValue(def: FieldDef, text: string): Write | undefined {\n  const trimmed = text.trim()\n  switch (def.kind) {\n    case 'boolean':\n      if (trimmed === 'true') return { kind: 'set', value: true }\n      if (trimmed === 'false') return { kind: 'set', value: false }\n      return undefined\n    case 'number':\n      if (trimmed === '') return def.optional ? { kind: 'clear' } : undefined\n      if (!/^\\d+$/.test(trimmed)) return undefined\n      return { kind: 'set', value: Number(trimmed) }\n    case 'cidrs': {\n      const cidrs = trimmed.split(',').map(s => s.trim()).filter(s => s !== '')\n      return cidrs.length === 0 ? { kind: 'clear' } : { kind: 'set', value: cidrs }\n    }\n    case 'select':\n      return def.options?.includes(trimmed) ? { kind: 'set', value: trimmed } : undefined\n    case 'tristate':\n      // 'auto' clears the key so it re-inherits the composition layer (and the\n      // resolution rule), which is what an unset tri-state means.\n      if (trimmed === 'auto') return { kind: 'clear' }\n      if (trimmed === 'true') return { kind: 'set', value: true }\n      if (trimmed === 'false') return { kind: 'set', value: false }\n      return undefined\n    case 'text':\n      return trimmed === '' ? (def.optional ? { kind: 'clear' } : undefined) : { kind: 'set', value: trimmed }\n  }\n}\n","/**\n * The lan-gateway settings card, rendered by the official DSH Plugins page\n * through its `plugins.item` slot.\n *\n * ModLens-style: the card carries NO injected services. It reads and writes\n * the loopback-only `/lan-gateway/config` host route (the browser never sees\n * the settings seam or any secret), so the only platform service it needs is\n * the `slots` service every plugin already has.\n *\n * @module @riceawa/dsh-lan-gateway/client/card\n */\n\nimport { useEffect, useState, type ChangeEvent, type ReactNode } from 'react'\nimport type { PropsRuntime } from '@deepseek-ai/dsh-client-ui-slots'\n// Type-only. The Plugins page owns the `plugins.item` contract, and its own\n// doc says a registrant merges that contract with `import type` instead of\n// importing the package at runtime. Taking the contract from its owner is also\n// what turns the next upstream rename of this slot into a compile error here,\n// rather than a card that quietly stops rendering.\nimport type {} from '@deepseek-ai/dsh-client-ui-plugin-manager/client'\nimport {\n  FIELDS,\n  MIN_PASSWORD_LENGTH,\n  TRISTATE_OPTIONS,\n  formatValue,\n  parseValue,\n  type FieldDef,\n  type LanGatewaySettings,\n} from '../config-fields.ts'\n\n/**\n * Props the renderer binds for this card. The Plugins page asks for either the\n * card's one-liner (`summary`) or the body of its own page (`page`), and draws\n * the page's title, icon, and crumb itself. The card needs no injected face —\n * it fetches its own route.\n */\nexport type LanGatewayCardProps = PropsRuntime<'plugins.item'>\n\n/**\n * The card's field table and value codecs live in `config-fields.ts`, shared\n * with the host: the host's config route decides which submitted keys are\n * editable and which empty value means \"clear\", and a table duplicated here\n * would let the two disagree about a field the card can render but the route\n * would refuse. Re-exported so the existing tests keep their import path.\n */\nexport { FIELDS, TRISTATE_OPTIONS, formatValue, parseValue }\nexport type { FieldDef, LanGatewaySettings }\n\n/** GET /lan-gateway/config response. */\ninterface RouteState {\n  config: LanGatewaySettings\n  running: boolean\n  port: number\n  tls: string\n  lastError: string | null\n  /** Whether a login credential exists. Never the credential itself. */\n  passwordSet?: boolean\n}\n\n/** Why a password draft cannot be submitted yet. */\nexport type PasswordProblem = 'tooShort' | 'mismatch'\n\n/**\n * The card's password badge state.\n *\n * Three states, not two: a host that predates the password route does not\n * report `passwordSet` at all, and `undefined` must read as \"unknown\" rather\n * than \"not set\" — a client refreshed against a running old host would\n * otherwise announce that a gateway which is demonstrably running (it cannot\n * start without a credential) has no password.\n */\nexport type PasswordStatus = 'set' | 'unset' | 'unknown'\n\n/**\n * Classify the host's `passwordSet` for the badge.\n * @param passwordSet - the snapshot's flag, or `undefined` when absent.\n * @returns `set` / `unset` / `unknown` (absent field).\n */\nexport function passwordStatus(passwordSet: boolean | undefined): PasswordStatus {\n  if (passwordSet === undefined) return 'unknown'\n  return passwordSet ? 'set' : 'unset'\n}\n\n/**\n * Judge a password draft the way the host's password route will, so a draft the\n * card enables is never answered with a 400. The length bound is the shared\n * {@link MIN_PASSWORD_LENGTH}; the confirmation is a UI concern and is checked\n * here rather than server-side (the host is told one password, and storing only\n * what was typed twice is the browser's job).\n * @param password - the new password draft.\n * @param confirm - the confirmation draft.\n * @returns the reason it cannot be submitted, or `null` when it can.\n */\nexport function passwordProblem(password: string, confirm: string): PasswordProblem | null {\n  if (password.length < MIN_PASSWORD_LENGTH) return 'tooShort'\n  if (password !== confirm) return 'mismatch'\n  return null\n}\n\n/* ------------------------------------------------------------------ */\n/* Bilingual copy (ModLens-style: two small sets, picked by browser)   */\n/* ------------------------------------------------------------------ */\n\ninterface Labels {\n  title: string\n  description: string\n  unsaved: string\n  save: string\n  saving: string\n  discard: string\n  reset: string\n  readOnly: string\n  saveFailed: string\n  loadFailed: string\n  emptyMeansClear: string\n  running: string\n  stopped: string\n  tls: string\n  lastError: string\n  passwordSection: string\n  passwordHint: string\n  passwordNew: string\n  passwordConfirm: string\n  passwordSet: string\n  passwordUnset: string\n  passwordUnknown: string\n  passwordRequired: string\n  passwordHostStale: string\n  passwordChange: string\n  passwordChanged: string\n  passwordFailed: string\n  passwordStaleHost: string\n  passwordTooShort: string\n  passwordMismatch: string\n  [key: `field.${string}`]: string\n  [key: `hint.${string}`]: string\n  [key: `opt.${string}`]: string\n}\n\nconst LABELS: Record<'zh' | 'en', Labels> = {\n  zh: {\n    title: 'LAN 网关',\n    description: '远程访问开关、端口、TLS 证书、受信网段等网关设置',\n    unsaved: '未保存',\n    save: '保存',\n    saving: '保存中…',\n    discard: '放弃',\n    reset: '重置',\n    readOnly: '网关设置只能在宿主机本机打开 dsh web 时修改：配置路由仅监听回环地址，经网关远程访问的浏览器会被拒绝。远程请改用 lan_gateway 工具。',\n    saveFailed: '保存未生效，请检查输入后重试。',\n    loadFailed: '无法读取网关配置',\n    emptyMeansClear: '留空 = 使用默认',\n    running: '运行中',\n    stopped: '已停止',\n    tls: 'TLS',\n    lastError: '上次错误',\n    passwordSection: '登录密码',\n    passwordHint: '当前密码不会显示（也读不出来）。输入两次新密码后直接覆盖原密码；改密会递增会话代次，所有已登录会话与已建立的 WebSocket 立即失效。仅在从本机 loopback 打开 dsh web 时可改。',\n    passwordNew: '新密码（至少 8 位）',\n    passwordConfirm: '再次输入新密码',\n    passwordSet: '已设置',\n    passwordUnset: '未设置',\n    passwordUnknown: '状态未知（宿主端较旧）',\n    passwordRequired: '未设置密码时网关拒绝启动。',\n    passwordHostStale: '宿主端没有报告密码状态，说明 dsh web 还在运行旧版本：重启后这里才会显示「已设置 / 未设置」，这个改密表单也才会生效。',\n    passwordChange: '修改密码',\n    passwordChanged: '密码已更新：旧密码立即失效，所有已登录会话已作废。',\n    passwordFailed: '修改密码失败，请重试。',\n    passwordStaleHost: '宿主端没有响应这个接口：可能还没重启 dsh web 加载新版本。重启后再试；重启前仍可用 lan_gateway 工具改密。',\n    passwordTooShort: '密码至少 8 位。',\n    passwordMismatch: '两次输入不一致。',\n    'field.enabled': '启用网关',\n    'hint.enabled': '启动时监听 0.0.0.0 网关端口',\n    'field.gatewayPort': '网关端口',\n    'hint.gatewayPort': '绑定到 0.0.0.0 的监听端口（默认 3081）',\n    'field.dshTargetPort': 'dsh 目标端口',\n    'hint.dshTargetPort': '留空则自动跟随 dsh web 端口（默认 3080）',\n    'field.lanCidrs': '免密 LAN 网段',\n    'hint.lanCidrs': '逗号分隔的 CIDR，如 10.0.0.0/8, 192.168.0.0/16',\n    'field.lanPasswordless': 'LAN 免登录',\n    'hint.lanPasswordless': 'LAN/回环来源跳过网关登录页，但仍共用同一上游会话（需 dsh ≥ 0.1.2）',\n    'field.allowInsecurePlaintext': '允许明文 HTTP',\n    'hint.allowInsecurePlaintext': '危险：关闭 TLS 或受信终止代理时仍启动监听，密码与会话将以明文传输',\n    'field.trustedTerminator': '受信 TLS 终止代理',\n    'hint.trustedTerminator': '可选：声明前置代理标识，视为加密入口（如 nginx）。留空 = 未声明。注意：登录限流以 TCP 源地址为键，代理之后所有浏览器共用一个额度（5 次/分钟）',\n    'field.secureCookies': '会话 cookie 的 Secure 属性',\n    'hint.secureCookies': '自动 = TLS 或已声明受信终止代理时加 Secure。受信代理只做明文鉴权、浏览器走 http 访问时须设为 false，否则浏览器拒收 Secure cookie，登录会无限弹回登录页',\n    'opt.auto': '自动',\n    'opt.true': '始终 Secure',\n    'opt.false': '不加 Secure（明文浏览器入口）',\n    'field.cookieMaxAgeDays': '会话有效期（天）',\n    'hint.cookieMaxAgeDays': '登录 cookie 的存活天数（默认 7）',\n    'field.tlsEnabled': '启用 TLS（HTTPS）',\n    'hint.tlsEnabled': '以 HTTPS 提供网关服务',\n    'field.tlsMode': '证书来源',\n    'hint.tlsMode': 'self-signed = 自动生成自签名证书；custom = 使用自己的证书',\n    'field.tlsSelfSignedHosts': '自签名证书域名/IP',\n    'hint.tlsSelfSignedHosts': '逗号分隔，写入证书 SAN，如 localhost, 192.168.1.5。仅影响下次换发：已有证书沿用至到期，改动不会立刻生效',\n    'field.tlsCertPath': '证书文件路径（custom）',\n    'hint.tlsCertPath': 'PEM 格式证书（或证书链）的绝对路径',\n    'field.tlsKeyPath': '私钥文件路径（custom）',\n    'hint.tlsKeyPath': '与证书配套的 PEM 私钥绝对路径',\n    'field.tlsCertMaxAgeDays': '自签名证书有效期（天）',\n    'hint.tlsCertMaxAgeDays': '默认 825（约 27 个月）。仅影响下次换发：已有证书沿用至到期',\n  },\n  en: {\n    title: 'LAN Gateway',\n    description: 'Remote-access switch, port, TLS certificate, trusted CIDRs and more',\n    unsaved: 'Unsaved',\n    save: 'Save',\n    saving: 'Saving…',\n    discard: 'Discard',\n    reset: 'Reset',\n    readOnly: 'Gateway settings can only be changed where dsh web runs locally: the config route listens on loopback only, so a browser reaching dsh through the gateway is refused. Use the lan_gateway tool remotely.',\n    saveFailed: 'The save did not land — check the inputs and retry.',\n    loadFailed: 'Cannot read the gateway configuration',\n    emptyMeansClear: 'Empty = default',\n    running: 'Running',\n    stopped: 'Stopped',\n    tls: 'TLS',\n    lastError: 'Last error',\n    passwordSection: 'Login password',\n    passwordHint: 'The current password is never shown (it cannot be read back). Enter a new one twice to overwrite it; changing it advances the session epoch, so every signed-in session and live WebSocket is invalidated at once. Only changeable where dsh web runs on loopback.',\n    passwordNew: 'New password (min 8 chars)',\n    passwordConfirm: 'Repeat new password',\n    passwordSet: 'Set',\n    passwordUnset: 'Not set',\n    passwordUnknown: 'Unknown (older host)',\n    passwordRequired: 'The gateway refuses to start without a password.',\n    passwordHostStale: 'The host did not report a password state, so dsh web is still running the previous build: restart it to get Set / Not set here and to make this form take effect.',\n    passwordChange: 'Change password',\n    passwordChanged: 'Password updated: the old one no longer works and every signed-in session was revoked.',\n    passwordFailed: 'The password change failed — retry.',\n    passwordStaleHost: 'The host did not answer this endpoint — it may still be running the previous build. Restart dsh web and retry; the lan_gateway tool can change the password meanwhile.',\n    passwordTooShort: 'At least 8 characters.',\n    passwordMismatch: 'The two entries do not match.',\n    'field.enabled': 'Enable gateway',\n    'hint.enabled': 'Listen on the gateway port at boot',\n    'field.gatewayPort': 'Gateway port',\n    'hint.gatewayPort': 'Port bound on 0.0.0.0 (default 3081)',\n    'field.dshTargetPort': 'dsh target port',\n    'hint.dshTargetPort': 'Leave empty to follow the dsh web port (default 3080)',\n    'field.lanCidrs': 'Password-free LAN CIDRs',\n    'hint.lanCidrs': 'Comma separated CIDRs, e.g. 10.0.0.0/8, 192.168.0.0/16',\n    'field.lanPasswordless': 'LAN skip login',\n    'hint.lanPasswordless': 'LAN/loopback sources skip the gateway login page but still ride one shared upstream session (needs dsh >= 0.1.2)',\n    'field.allowInsecurePlaintext': 'Allow plaintext HTTP',\n    'hint.allowInsecurePlaintext': 'Dangerous: start the listener even without TLS or a trusted terminator; passwords and sessions travel in clear',\n    'field.trustedTerminator': 'Trusted TLS terminator',\n    'hint.trustedTerminator': 'Optional identifier for a front proxy (e.g. nginx) treated as the encrypted ingress. Empty = none declared. Note: login rate limiting keys on the TCP source address, so behind a proxy every browser shares one budget (5/min)',\n    'field.secureCookies': 'Session cookie Secure attribute',\n    'hint.secureCookies': 'Auto = Secure when TLS or a trusted terminator is declared. Set false when the trusted proxy only authenticates over plaintext and browsers reach it over http — otherwise browsers drop the Secure cookie and every login bounces back to the login page',\n    'opt.auto': 'Auto',\n    'opt.true': 'Always Secure',\n    'opt.false': 'No Secure (plaintext browser ingress)',\n    'field.cookieMaxAgeDays': 'Session lifetime (days)',\n    'hint.cookieMaxAgeDays': 'Login cookie lifetime (default 7)',\n    'field.tlsEnabled': 'Enable TLS (HTTPS)',\n    'hint.tlsEnabled': 'Serve the gateway over HTTPS',\n    'field.tlsMode': 'Certificate source',\n    'hint.tlsMode': 'self-signed = auto-generated certificate; custom = your own files',\n    'field.tlsSelfSignedHosts': 'Self-signed hosts (SANs)',\n    'hint.tlsSelfSignedHosts': 'Comma separated DNS/IP names, e.g. localhost, 192.168.1.5. Applies to the next issuance only: an existing certificate is reused until it expires',\n    'field.tlsCertPath': 'Certificate path (custom)',\n    'hint.tlsCertPath': 'Absolute path to a PEM certificate (or chain)',\n    'field.tlsKeyPath': 'Private key path (custom)',\n    'hint.tlsKeyPath': 'Absolute path to the matching PEM private key',\n    'field.tlsCertMaxAgeDays': 'Self-signed validity (days)',\n    'hint.tlsCertMaxAgeDays': 'Default 825 (about 27 months). Applies to the next issuance only: an existing certificate is reused until it expires',\n  },\n}\n\nfunction labels(): Labels {\n  const lang = (typeof navigator !== 'undefined' ? navigator.language : 'en').toLowerCase()\n  return lang.startsWith('zh') ? LABELS.zh : LABELS.en\n}\n\n/**\n * The card's title in the browser's language, for the Plugins page's list\n * entry. A thunk so the label follows the page's locale without re-registering.\n * @returns the localized card title.\n */\nexport function cardTitle(): string {\n  return labels().title\n}\n\n/* ------------------------------------------------------------------ */\n/* Card                                                                */\n/* ------------------------------------------------------------------ */\n\n/**\n * Render the LAN gateway card. Self-loading: fetches the config route on\n * mount, posts the edited config on save.\n *\n * `view` swaps between the card's one-liner and its page body, so the branch\n * sits after the hooks: the Plugins page re-renders one contribution under the\n * other view when the card is opened.\n * @param props - the view the Plugins page is asking for.\n * @returns the one-liner, the card, or nothing while the route is unreachable.\n */\nexport function LanGatewayCard(props: LanGatewayCardProps): ReactNode {\n  const t = labels()\n  const [open, setOpen] = useState(false)\n  const [route, setRoute] = useState<RouteState | null>(null)\n  const [loadFailed, setLoadFailed] = useState(false)\n  const [drafts, setDrafts] = useState<Partial<Record<string, string>>>({})\n  const [saving, setSaving] = useState(false)\n  const [failed, setFailed] = useState<string | null>(null)\n  // The password section is its own submit path: a password is not a settings\n  // key, so it must not ride the config patch (nor light up the card's \"未保存\"\n  // badge for every keystroke in a password box).\n  const [password, setPasswordDraft] = useState('')\n  const [passwordConfirm, setPasswordConfirmDraft] = useState('')\n  const [passwordBusy, setPasswordBusy] = useState(false)\n  const [passwordError, setPasswordError] = useState<string | null>(null)\n  const [passwordNotice, setPasswordNotice] = useState<string | null>(null)\n\n  useEffect(() => {\n    let cancelled = false\n    fetch('/lan-gateway/config')\n      .then(async (response) => {\n        if (cancelled) return\n        if (!response.ok) throw new Error(`HTTP ${response.status}`)\n        setRoute(await response.json() as RouteState)\n      })\n      .catch(() => {\n        if (!cancelled) setLoadFailed(true)\n      })\n    return () => { cancelled = true }\n  }, [])\n\n  // The Plugins page lists this plugin as one card and opens its own page on\n  // demand: `summary` is the one-liner the list shows, `page` the body. The\n  // hooks above run for both views, because the same contribution flips\n  // between them.\n  if (props.view === 'summary') return t.description\n\n  // A remote browser reaches this card through the gateway, which answers 403\n  // for the plugin's own prefix by design, so the route is unreachable exactly\n  // where a user is most likely to go looking for the setting. Rendering\n  // nothing left them with a blank entry and no way to tell a missing card from\n  // a broken one; say what is wrong and where the card does work instead.\n  if (loadFailed) {\n    return (\n      <div style={styles.card}>\n        <div style={styles.header}>\n          <span style={styles.headerTop}>\n            <span style={styles.name}>{t.title}</span>\n          </span>\n          <span style={styles.description}>{t.loadFailed}</span>\n        </div>\n        <div style={styles.body}>\n          <p style={styles.hint}>{t.readOnly}</p>\n        </div>\n      </div>\n    )\n  }\n  if (route === null) return null\n\n  const { config } = route\n  const draftOf = (field: keyof LanGatewaySettings): string =>\n    drafts[field] ?? formatValue(FIELDS.find(f => f.field === field)!, config[field])\n\n  const stage = (field: string, text: string): void => {\n    setDrafts(prev => ({ ...prev, [field]: text }))\n    setFailed(null)\n  }\n\n  const resetField = (def: FieldDef): void => {\n    setDrafts(prev => {\n      const next = { ...prev }\n      delete next[def.field]\n      return next\n    })\n  }\n\n  const discard = (): void => {\n    setDrafts({})\n    setFailed(null)\n  }\n\n  const invalid = (): boolean =>\n    Object.entries(drafts).some(([field, text]) => {\n      const def = FIELDS.find(f => f.field === field)\n      return def === undefined || parseValue(def, text ?? '') === undefined\n    })\n\n  const dirty = Object.keys(drafts).length > 0\n  const passwordDraftProblem = passwordProblem(password, passwordConfirm)\n  const passwordTyping = password !== '' || passwordConfirm !== ''\n  const passwordBadge = passwordStatus(route.passwordSet)\n\n  /** Adopt the host's post-write snapshot, keeping the last known values. */\n  const adopt = (body: Partial<RouteState>): void => {\n    if (body.config === undefined) return\n    setRoute({\n      config: body.config,\n      running: body.running ?? false,\n      port: body.port ?? 0,\n      tls: body.tls ?? '',\n      lastError: body.lastError ?? null,\n      // Absent is a state of its own (an older host does not report the field),\n      // so it must not be coerced into `false`: that is what made a running,\n      // password-protected gateway render as \"not set\".\n      ...(body.passwordSet !== undefined ? { passwordSet: body.passwordSet } : {}),\n    })\n  }\n\n  /**\n   * Overwrite the login password. Deliberately writes only to\n   * `/lan-gateway/password`: the credential is not part of the config patch, so\n   * a change here can never disturb an unsaved settings draft, and the old\n   * password is neither sent nor requested.\n   */\n  const changePassword = async (): Promise<void> => {\n    if (passwordBusy || passwordProblem(password, passwordConfirm) !== null) return\n    setPasswordBusy(true)\n    setPasswordError(null)\n    setPasswordNotice(null)\n    try {\n      const response = await fetch('/lan-gateway/password', {\n        method: 'POST',\n        headers: { 'content-type': 'application/json' },\n        body: JSON.stringify({ password }),\n      })\n      // A host that predates this route answers the SPA fallback (HTML, 200),\n      // not a 404 — so \"not our JSON\" is the signal, and it must not read as a\n      // wrong password or a network failure.\n      const body = await response.json().catch(() => null) as (Partial<RouteState> & { error?: string }) | null\n      if (!response.ok) {\n        setPasswordError(body?.error ?? (response.status === 404 ? t.passwordStaleHost : `HTTP ${response.status}`))\n        return\n      }\n      if (body === null) {\n        setPasswordError(t.passwordStaleHost)\n        return\n      }\n      // Clear the boxes the moment the write lands: the new credential is now\n      // the stored one, and leaving it on screen is the one thing a password\n      // field should not do.\n      setPasswordDraft('')\n      setPasswordConfirmDraft('')\n      setPasswordNotice(t.passwordChanged)\n      adopt(body)\n    } catch {\n      setPasswordError(t.passwordFailed)\n    } finally {\n      setPasswordBusy(false)\n    }\n  }\n\n  const save = async (): Promise<void> => {\n    if (!dirty || saving || invalid()) return\n    setSaving(true)\n    setFailed(null)\n    try {\n      // A patch of the edited fields only, never the whole config: the card\n      // cannot express every key the section may hold (a custom `cookieName`,\n      // say), and posting a synthesized full config made the route treat those\n      // keys as submitted — resetting each one to its schema default.\n      const patch: Record<string, unknown> = {}\n      for (const [field, text] of Object.entries(drafts)) {\n        const def = FIELDS.find(f => f.field === field)\n        if (def === undefined) continue\n        const write = parseValue(def, text ?? '')\n        if (write === undefined) continue\n        patch[field] = write.kind === 'clear' ? null : write.value\n      }\n      const response = await fetch('/lan-gateway/config', {\n        method: 'POST',\n        headers: { 'content-type': 'application/json' },\n        body: JSON.stringify(patch),\n      })\n      const body = await response.json().catch(() => ({})) as Partial<RouteState> & { error?: string }\n      if (!response.ok) {\n        setFailed(body.error ?? `HTTP ${response.status}`)\n        return\n      }\n      adopt(body)\n      setDrafts({})\n    } catch {\n      setFailed(t.saveFailed)\n    } finally {\n      setSaving(false)\n    }\n  }\n\n  const renderControl = (def: FieldDef): ReactNode => {\n    const field = def.field\n    const label = t[`field.${field}`]\n    const hint = t[`hint.${field}`]\n    const text = draftOf(field)\n    switch (def.kind) {\n      case 'boolean':\n        return (\n          <div style={styles.field}>\n            <label style={styles.checkRow}>\n              <input\n                type=\"checkbox\"\n                checked={text === 'true'}\n                disabled={saving}\n                onChange={(e: ChangeEvent<HTMLInputElement>) =>\n                  stage(field, e.target.checked ? 'true' : 'false')}\n              />\n              <span style={styles.label}>{label}</span>\n              <button\n                type=\"button\"\n                style={styles.reset}\n                disabled={saving || !drafts[field]}\n                onClick={() => resetField(def)}\n              >\n                {t.reset}\n              </button>\n            </label>\n            <span style={styles.hint}>{hint}</span>\n          </div>\n        )\n      case 'select':\n      case 'tristate': {\n        // A tri-state renders as a three-way select because neither a checkbox\n        // (cannot express \"unset\") nor a text field (cannot express false)\n        // distinguishes auto from an explicit false.\n        const options = def.kind === 'tristate' ? TRISTATE_OPTIONS : (def.options ?? [])\n        return (\n          <div style={styles.field}>\n            <label style={styles.label} htmlFor={`lan-gw-${field}`}>{label}</label>\n            <select\n              id={`lan-gw-${field}`}\n              style={styles.input}\n              value={text}\n              disabled={saving}\n              onChange={(e: ChangeEvent<HTMLSelectElement>) => stage(field, e.target.value)}\n            >\n              {options.map(option => (\n                <option key={option} value={option}>\n                  {def.kind === 'tristate' ? t[`opt.${option}`] : option}\n                </option>\n              ))}\n            </select>\n            <span style={styles.hint}>{hint}</span>\n            <button\n              type=\"button\"\n              style={styles.reset}\n              disabled={saving || !drafts[field]}\n              onClick={() => resetField(def)}\n            >\n              {t.reset}\n            </button>\n          </div>\n        )\n      }\n      default:\n        return (\n          <div style={styles.field}>\n            <label style={styles.label} htmlFor={`lan-gw-${field}`}>{label}</label>\n            <input\n              id={`lan-gw-${field}`}\n              style={styles.input}\n              type={def.kind === 'number' ? 'number' : 'text'}\n              value={text}\n              disabled={saving}\n              placeholder={def.optional ? t.emptyMeansClear : undefined}\n              onChange={(e: ChangeEvent<HTMLInputElement>) => stage(field, e.target.value)}\n            />\n            <span style={styles.hint}>{hint}</span>\n          </div>\n        )\n    }\n  }\n\n  const statusLine = `${route.running ? t.running : t.stopped} · ${t.tls}: ${route.tls} · :${route.port}`\n\n  return (\n    <div style={open ? { ...styles.card, ...styles.cardOpen } : styles.card}>\n      <button\n        type=\"button\"\n        style={styles.header}\n        aria-expanded={open}\n        onClick={() => { setOpen(!open) }}\n      >\n        <span style={styles.headerTop}>\n          <span style={styles.name}>{t.title}</span>\n          <span style={styles.status} title={statusLine}>{statusLine}</span>\n          {dirty ? <span style={styles.pending}>{t.unsaved}</span> : null}\n          <span style={open ? { ...styles.chevron, ...styles.chevronOpen } : styles.chevron}>{open ? '▾' : '▸'}</span>\n        </span>\n        <span style={styles.description}>{t.description}</span>\n      </button>\n      {open\n        ? (\n          <div style={styles.body}>\n            {route.lastError ? <p style={styles.error} role=\"status\">{t.lastError}: {route.lastError}</p> : null}\n            <div style={styles.section}>\n              <div style={styles.sectionHead}>\n                <span style={styles.label}>{t.passwordSection}</span>\n                <span style={passwordBadge === 'unset' ? styles.badgeAlert : styles.badge}>\n                  {passwordBadge === 'set'\n                    ? t.passwordSet\n                    : passwordBadge === 'unset' ? t.passwordUnset : t.passwordUnknown}\n                </span>\n              </div>\n              <p style={styles.hint}>{t.passwordHint}</p>\n              {passwordBadge === 'unset' ? <p style={styles.error}>{t.passwordRequired}</p> : null}\n              {passwordBadge === 'unknown' ? <p style={styles.hint}>{t.passwordHostStale}</p> : null}\n              <div style={styles.passwordRow}>\n                <input\n                  id=\"lan-gw-password\"\n                  type=\"password\"\n                  autoComplete=\"new-password\"\n                  aria-label={t.passwordNew}\n                  style={passwordInput}\n                  placeholder={t.passwordNew}\n                  value={password}\n                  disabled={passwordBusy}\n                  onChange={(e: ChangeEvent<HTMLInputElement>) => {\n                    setPasswordDraft(e.target.value)\n                    setPasswordError(null)\n                    setPasswordNotice(null)\n                  }}\n                />\n                <input\n                  id=\"lan-gw-password-confirm\"\n                  type=\"password\"\n                  autoComplete=\"new-password\"\n                  aria-label={t.passwordConfirm}\n                  style={passwordInput}\n                  placeholder={t.passwordConfirm}\n                  value={passwordConfirm}\n                  disabled={passwordBusy}\n                  onChange={(e: ChangeEvent<HTMLInputElement>) => {\n                    setPasswordConfirmDraft(e.target.value)\n                    setPasswordError(null)\n                    setPasswordNotice(null)\n                  }}\n                />\n              </div>\n              <div style={styles.passwordFoot}>\n                {passwordError !== null\n                  ? <p style={styles.error} role=\"alert\">{passwordError}</p>\n                  : passwordNotice !== null\n                    ? <p style={styles.notice} role=\"status\">{passwordNotice}</p>\n                    : passwordTyping && passwordDraftProblem !== null\n                      ? (\n                        <p style={styles.error} role=\"status\">\n                          {passwordDraftProblem === 'tooShort' ? t.passwordTooShort : t.passwordMismatch}\n                        </p>\n                      )\n                      : null}\n                <button\n                  type=\"button\"\n                  style={styles.save}\n                  disabled={passwordBusy || passwordDraftProblem !== null}\n                  onClick={() => { void changePassword() }}\n                >\n                  {passwordBusy ? t.saving : t.passwordChange}\n                </button>\n              </div>\n            </div>\n            {FIELDS.map(def => <div key={def.field}>{renderControl(def)}</div>)}\n            <div style={styles.footer}>\n              {failed ? <p style={styles.error} role=\"status\">{failed}</p> : null}\n              <button\n                type=\"button\"\n                style={styles.discard}\n                disabled={!dirty || saving}\n                onClick={discard}\n              >\n                {t.discard}\n              </button>\n              <button\n                type=\"button\"\n                style={styles.save}\n                disabled={!dirty || invalid() || saving}\n                onClick={() => { void save() }}\n              >\n                {saving ? t.saving : t.save}\n              </button>\n            </div>\n          </div>\n        )\n        : null}\n    </div>\n  )\n}\n\n/* ------------------------------------------------------------------ */\n/* Styling — the official DSH theme tokens (light/dark aware), with    */\n/* neutral fallbacks so the card never renders black-on-black or       */\n/* white-on-white even if a token is missing.                          */\n/* ------------------------------------------------------------------ */\n\n/** Theme token with a fallback for token-less environments. */\nfunction tk(token: string, fallback: string): string {\n  return `var(${token}, ${fallback})`\n}\n\nconst L = {\n  border: tk('--dsw-alias-border-l2', 'rgba(127,127,127,0.35)'),\n  bg: tk('--dsw-alias-bg-layer-3', 'transparent'),\n  bgOpen: tk('--dsw-alias-bg-layer-2', 'transparent'),\n  labelPrimary: tk('--dsw-alias-label-primary', 'inherit'),\n  labelSecondary: tk('--dsw-alias-label-secondary', 'inherit'),\n  labelTertiary: tk('--dsw-alias-label-tertiary', 'rgba(127,127,127,0.8)'),\n  labelDimmed: tk('--dsw-alias-label-dimmed', 'rgba(127,127,127,0.6)'),\n  error: tk('--dsw-alias-label-error', '#d1242f'),\n  brand: tk('--dsw-alias-brand-primary', '#4f6ef7'),\n  badgeBg: tk('--dsw-alias-bg-module-platform', 'rgba(127,127,127,0.14)'),\n}\n\nconst styles: Record<string, React.CSSProperties> = {\n  card: {\n    listStyle: 'none',\n    border: `1px solid ${L.border}`,\n    borderRadius: '12px',\n    background: L.bg,\n    transition: 'border-color .16s, background .16s',\n    overflow: 'hidden',\n  },\n  cardOpen: {\n    background: L.bgOpen,\n    borderColor: L.labelDimmed,\n  },\n  header: {\n    display: 'flex',\n    flexDirection: 'column',\n    alignItems: 'stretch',\n    gap: '6px',\n    width: '100%',\n    padding: '14px 16px',\n    border: 0,\n    background: 'none',\n    font: 'inherit',\n    color: 'inherit',\n    textAlign: 'left',\n    cursor: 'pointer',\n  },\n  headerTop: { display: 'flex', alignItems: 'center', gap: '12px', width: '100%' },\n  name: { flex: '1 1 auto', minWidth: 0, fontSize: '15px', fontWeight: 600, lineHeight: 1.4, color: L.labelPrimary },\n  // The status carries a verbose TLS cert summary; cap it and ellipsize so it\n  // can never swallow the row or squeeze the title (the old nowrap alone\n  // caused the description to be pushed into a thin wrapping column).\n  status: {\n    flex: '0 1 auto',\n    minWidth: 0,\n    maxWidth: '60%',\n    fontSize: '11px',\n    lineHeight: 1.4,\n    color: L.labelTertiary,\n    whiteSpace: 'nowrap',\n    overflow: 'hidden',\n    textOverflow: 'ellipsis',\n  },\n  description: {\n    display: 'block',\n    fontSize: '13px',\n    lineHeight: 1.5,\n    color: L.labelTertiary,\n    whiteSpace: 'nowrap',\n    overflow: 'hidden',\n    textOverflow: 'ellipsis',\n  },\n  pending: {\n    flex: 'none',\n    borderRadius: '999px',\n    padding: '1px 8px',\n    fontSize: '11px',\n    lineHeight: '17px',\n    fontWeight: 500,\n    whiteSpace: 'nowrap',\n    background: L.badgeBg,\n    color: L.labelSecondary,\n  },\n  chevron: { flex: 'none', color: L.labelTertiary, fontSize: '12px', transition: 'transform .16s' },\n  chevronOpen: { transform: 'rotate(180deg)' },\n  body: {\n    borderTop: `1px solid ${L.border}`,\n    margin: '0 16px',\n    paddingBottom: '8px',\n    display: 'flex',\n    flexDirection: 'column',\n  },\n  // The password block sits inside the card body, ahead of the config fields:\n  // it is the setting an operator comes here for, and it owns its own submit\n  // button (a password is not part of the settings patch), so it is separated\n  // by a rule rather than merged into the field list.\n  section: {\n    display: 'flex',\n    flexDirection: 'column',\n    gap: '8px',\n    padding: '14px 0',\n    borderBottom: `1px solid ${L.border}`,\n  },\n  sectionHead: { display: 'flex', alignItems: 'center', gap: '8px' },\n  badge: {\n    borderRadius: '999px',\n    padding: '1px 8px',\n    fontSize: '11px',\n    lineHeight: '17px',\n    fontWeight: 500,\n    whiteSpace: 'nowrap',\n    background: L.badgeBg,\n    color: L.labelSecondary,\n  },\n  badgeAlert: {\n    borderRadius: '999px',\n    padding: '1px 8px',\n    fontSize: '11px',\n    lineHeight: '17px',\n    fontWeight: 500,\n    whiteSpace: 'nowrap',\n    background: L.badgeBg,\n    color: L.error,\n  },\n  notice: { flex: 1, minWidth: 0, margin: 0, fontSize: '12px', lineHeight: 1.5, color: L.labelSecondary },\n  passwordRow: { display: 'flex', flexWrap: 'wrap', gap: '8px' },\n  passwordFoot: {\n    display: 'flex',\n    alignItems: 'center',\n    justifyContent: 'flex-end',\n    gap: '8px',\n    marginTop: '2px',\n  },\n  field: {\n    display: 'flex',\n    flexDirection: 'column',\n    gap: '6px',\n    padding: '12px 0',\n  },\n  label: { fontSize: '13px', fontWeight: 500, lineHeight: 1.5, color: L.labelPrimary },\n  hint: { margin: 0, fontSize: '12px', lineHeight: 1.5, color: L.labelTertiary },\n  checkRow: { display: 'flex', alignItems: 'center', gap: '8px', cursor: 'pointer' },\n  reset: {\n    border: 'none',\n    background: 'none',\n    padding: 0,\n    font: 'inherit',\n    fontSize: '12px',\n    lineHeight: 1.5,\n    color: L.labelSecondary,\n    cursor: 'pointer',\n    alignSelf: 'flex-start',\n  },\n  input: {\n    height: '34px',\n    padding: '0 12px',\n    border: `1px solid ${L.border}`,\n    borderRadius: '8px',\n    background: L.bg,\n    font: 'inherit',\n    fontSize: '13px',\n    lineHeight: 1.5,\n    color: L.labelPrimary,\n  },\n  footer: {\n    display: 'flex',\n    alignItems: 'center',\n    justifyContent: 'flex-end',\n    gap: '8px',\n    padding: '12px 0 4px',\n    borderTop: `1px solid ${L.border}`,\n  },\n  error: { flex: 1, minWidth: 0, margin: 0, fontSize: '12px', lineHeight: 1.5, color: L.error },\n  discard: {\n    appearance: 'none',\n    border: `1px solid ${L.border}`,\n    borderRadius: '8px',\n    padding: '5px 14px',\n    font: 'inherit',\n    fontSize: '13px',\n    lineHeight: 1.5,\n    background: 'none',\n    color: L.labelSecondary,\n    cursor: 'pointer',\n  },\n  save: {\n    appearance: 'none',\n    border: '1px solid transparent',\n    borderRadius: '8px',\n    padding: '5px 14px',\n    font: 'inherit',\n    fontSize: '13px',\n    lineHeight: 1.5,\n    background: L.labelPrimary,\n    color: L.bg,\n    cursor: 'pointer',\n  },\n}\n\n/** The shared input style plus the growth two side-by-side password boxes need. */\nconst passwordInput: React.CSSProperties = { ...styles.input, flex: '1 1 160px' }\n","/**\n * @riceawa/dsh-lan-gateway — browser half.\n *\n * Two jobs:\n * 1. Insecure-origin UUID shim: the gateway can serve the GUI over plain HTTP\n *    on LAN addresses, where browsers lack `crypto.randomUUID()`. This bundle\n *    installs a getRandomValues-backed `randomUUID` on the Crypto prototype at\n *    module scope. With TLS enabled the origin is secure and the shim is a\n *    no-op.\n * 2. Settings card: registers the LAN gateway card into the official Plugins\n *    page (`plugins.item` slot) so port, CIDRs, auth, and TLS stay adjustable\n *    from the GUI.\n */\n\n/** RFC 4122 v4 UUID from crypto.getRandomValues (available on insecure origins). */\nfunction uuidFromRandomValues(): string {\n  const bytes = globalThis.crypto.getRandomValues(new Uint8Array(16))\n  const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength)\n  view.setUint8(6, (view.getUint8(6) & 0x0f) | 0x40)\n  view.setUint8(8, (view.getUint8(8) & 0x3f) | 0x80)\n  const hex = Array.from(bytes, byte => byte.toString(16).padStart(2, '0')).join('')\n  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`\n}\n\n/**\n * Install `randomUUID` on the browser Crypto prototype when the platform\n * lacks it. Idempotent; re-checks every call.\n * @returns `true` when the shim was installed by this call.\n */\nexport function installRandomUuidShim(): boolean {\n  const cryptoObj = globalThis.crypto\n  if (cryptoObj === undefined) return false\n  if (typeof cryptoObj.randomUUID === 'function') return false\n  if (typeof cryptoObj.getRandomValues !== 'function') return false\n  try {\n    // Browsers expose crypto.randomUUID through the Crypto prototype; patching\n    // the prototype (not the instance) covers `crypto.randomUUID()` everywhere.\n    const proto = Object.getPrototypeOf(cryptoObj) as { randomUUID?: unknown } | null\n    if (proto !== null && typeof proto.randomUUID !== 'function') {\n      Object.defineProperty(proto, 'randomUUID', {\n        value: uuidFromRandomValues,\n        writable: true,\n        configurable: true,\n      })\n      return true\n    }\n    // Fallback: direct instance property (sandboxed/odd environments).\n    Object.defineProperty(cryptoObj, 'randomUUID', {\n      value: uuidFromRandomValues,\n      writable: true,\n      configurable: true,\n    })\n    return true\n  } catch {\n    return false\n  }\n}\n\n// Module scope: the shim is live as soon as this bundle is evaluated, before\n// any RPC/session code runs. apply() re-runs it as a belt-and-braces re-check.\ninstallRandomUuidShim()\n\nimport type { ClientContext } from '@deepseek-ai/dsh-client-runtime/client'\n// Type-only, and never bundled: the Plugins page's slot contract (`plugins.item`)\n// and the settings domain's `configForms` service both resolve from the web\n// shell's frozen module table. Importing them is what subjects the registration\n// below to the platform's own contract instead of a local copy that drifts the\n// next time upstream renames a slot.\nimport type {} from '@deepseek-ai/dsh-client-ui-plugin-manager/client'\nimport type {} from '@deepseek-ai/dsh-client-ui-settings/client'\nimport { LanGatewayCard, cardTitle } from './lan-gateway-card.tsx'\n\nexport const name = 'dsh-lan-gateway'\n\n/**\n * The profile entry id this plugin's bundle patch composes it under, and the\n * settings namespace dsh ≥ 0.1.7 addresses every write by.\n */\nconst ENTRY_ID = 'dsh-lan-gateway'\n\n/** The slots service the card rides, and the settings mirror the gate reads. */\nexport const inject = ['slots', 'configForms']\n\n/**\n * Mount the settings card and the UUID shim.\n * @param ctx - the browser plugin context.\n */\nexport function apply(ctx: ClientContext): void {\n  installRandomUuidShim()\n\n  // The card rides the official Plugins page. Like ModLens it registers with no\n  // inject face and fetches its own loopback config route, so it depends on no\n  // settings, locale, or connection service.\n  //\n  // dsh 0.1.7 replaced the namespace-keyed `settings.plugin.item` slot with the\n  // list slot `plugins.item`, which is where a host-plane plugin's own\n  // configuration page belongs (\"one companion package per host-plane\n  // namespace\"); the page renders the contribution as the card's one-liner and,\n  // once opened, as the body of the plugin's own page. Registering into the\n  // retired slot left the card invisible on 0.1.7.\n  //\n  // `whileServed` keeps the entry off the page until the Host's settings mirror\n  // serves this plugin's entry. That is the one gate worth having: without a\n  // Loader entry there is nothing to write to, and the card would appear only\n  // to fail every save with the route's 409.\n  ctx.effect(() => ctx.configForms.whileServed([ENTRY_ID], () =>\n    ctx.slots.inject('plugins.item', () => ctx.slots.register({\n      name: 'plugins.item',\n      id: ENTRY_ID,\n      order: 30,\n      label: () => cardTitle(),\n    }, LanGatewayCard))))\n}\n"],"mappings":";;;;;;;;;;EAuEA,MAAa,mBAAmB;GAAC;GAAQ;GAAQ;EAAO;;;;;;;EAQxD,MAAa,SAA8B;GACzC;IAAE,OAAO;IAAW,MAAM;GAAU;GACpC;IAAE,OAAO;IAAe,MAAM;GAAS;GACvC;IAAE,OAAO;IAAiB,MAAM;IAAU,UAAU;GAAK;GACzD;IAAE,OAAO;IAAY,MAAM;GAAQ;GACnC;IAAE,OAAO;IAAmB,MAAM;GAAU;GAC5C;IAAE,OAAO;IAAoB,MAAM;GAAS;GAC5C;IAAE,OAAO;IAAc,MAAM;GAAU;GACvC;IAAE,OAAO;IAAW,MAAM;IAAU,SAAS,CAAC,eAAe,QAAQ;GAAE;GACvE;IAAE,OAAO;IAAsB,MAAM;GAAO;GAC5C;IAAE,OAAO;IAAe,MAAM;IAAQ,UAAU;GAAK;GACrD;IAAE,OAAO;IAAc,MAAM;IAAQ,UAAU;GAAK;GACpD;IAAE,OAAO;IAAqB,MAAM;GAAS;GAC7C;IAAE,OAAO;IAA0B,MAAM;GAAU;GACnD;IAAE,OAAO;IAAqB,MAAM;IAAQ,UAAU;GAAK;GAC3D;IAAE,OAAO;IAAiB,MAAM;GAAW;EAC7C;EAGsD,IAAI,IAAI,OAAO,KAAI,QAAO,IAAI,KAAe,CAAC;EAG3C,IAAI,IAC3D,OAAO,QAAO,QAAO,IAAI,aAAa,IAAI,CAAC,CAAC,KAAI,QAAO,IAAI,KAAe,CAC5E;;EAGA,SAAgB,YAAY,KAAe,OAAwB;GACjE,QAAQ,IAAI,MAAZ;IACE,KAAK,WAAW,OAAO,UAAU,OAAO,SAAS;IACjD,KAAK,UAAU,OAAO,OAAO,UAAU,WAAW,OAAO,KAAK,IAAI;IAClE,KAAK,SAAS,OAAO,MAAM,QAAQ,KAAK,IAAI,MAAM,KAAK,IAAI,IAAI;IAC/D,KAAK,UAAU,OAAO,OAAO,UAAU,WAAW,QAAS,IAAI,UAAU,MAAM;IAE/E,KAAK,YAAY,OAAO,UAAU,OAAO,SAAS,UAAU,QAAQ,UAAU;IAC9E,KAAK,QAAQ,OAAO,OAAO,UAAU,WAAW,QAAQ;GAC1D;EACF;;EAMA,SAAgB,WAAW,KAAe,MAAiC;GACzE,MAAM,UAAU,KAAK,KAAK;GAC1B,QAAQ,IAAI,MAAZ;IACE,KAAK;KACH,IAAI,YAAY,QAAQ,OAAO;MAAE,MAAM;MAAO,OAAO;KAAK;KAC1D,IAAI,YAAY,SAAS,OAAO;MAAE,MAAM;MAAO,OAAO;KAAM;KAC5D;IACF,KAAK;KACH,IAAI,YAAY,IAAI,OAAO,IAAI,WAAW,EAAE,MAAM,QAAQ,IAAI,KAAA;KAC9D,IAAI,CAAC,QAAQ,KAAK,OAAO,GAAG,OAAO,KAAA;KACnC,OAAO;MAAE,MAAM;MAAO,OAAO,OAAO,OAAO;KAAE;IAC/C,KAAK,SAAS;KACZ,MAAM,QAAQ,QAAQ,MAAM,GAAG,CAAC,CAAC,KAAI,MAAK,EAAE,KAAK,CAAC,CAAC,CAAC,QAAO,MAAK,MAAM,EAAE;KACxE,OAAO,MAAM,WAAW,IAAI,EAAE,MAAM,QAAQ,IAAI;MAAE,MAAM;MAAO,OAAO;KAAM;IAC9E;IACA,KAAK,UACH,OAAO,IAAI,SAAS,SAAS,OAAO,IAAI;KAAE,MAAM;KAAO,OAAO;IAAQ,IAAI,KAAA;IAC5E,KAAK;KAGH,IAAI,YAAY,QAAQ,OAAO,EAAE,MAAM,QAAQ;KAC/C,IAAI,YAAY,QAAQ,OAAO;MAAE,MAAM;MAAO,OAAO;KAAK;KAC1D,IAAI,YAAY,SAAS,OAAO;MAAE,MAAM;MAAO,OAAO;KAAM;KAC5D;IACF,KAAK,QACH,OAAO,YAAY,KAAM,IAAI,WAAW,EAAE,MAAM,QAAQ,IAAI,KAAA,IAAa;KAAE,MAAM;KAAO,OAAO;IAAQ;GAC3G;EACF;;;;;;;;;;;;;;;;;;;ECvEA,SAAgB,eAAe,aAAkD;GAC/E,IAAI,gBAAgB,KAAA,GAAW,OAAO;GACtC,OAAO,cAAc,QAAQ;EAC/B;;;;;;;;;;;EAYA,SAAgB,gBAAgB,UAAkB,SAAyC;GACzF,IAAI,SAAS,SAAA,GAA8B,OAAO;GAClD,IAAI,aAAa,SAAS,OAAO;GACjC,OAAO;EACT;EA0CA,MAAM,SAAsC;GAC1C,IAAI;IACF,OAAO;IACP,aAAa;IACb,SAAS;IACT,MAAM;IACN,QAAQ;IACR,SAAS;IACT,OAAO;IACP,UAAU;IACV,YAAY;IACZ,YAAY;IACZ,iBAAiB;IACjB,SAAS;IACT,SAAS;IACT,KAAK;IACL,WAAW;IACX,iBAAiB;IACjB,cAAc;IACd,aAAa;IACb,iBAAiB;IACjB,aAAa;IACb,eAAe;IACf,iBAAiB;IACjB,kBAAkB;IAClB,mBAAmB;IACnB,gBAAgB;IAChB,iBAAiB;IACjB,gBAAgB;IAChB,mBAAmB;IACnB,kBAAkB;IAClB,kBAAkB;IAClB,iBAAiB;IACjB,gBAAgB;IAChB,qBAAqB;IACrB,oBAAoB;IACpB,uBAAuB;IACvB,sBAAsB;IACtB,kBAAkB;IAClB,iBAAiB;IACjB,yBAAyB;IACzB,wBAAwB;IACxB,gCAAgC;IAChC,+BAA+B;IAC/B,2BAA2B;IAC3B,0BAA0B;IAC1B,uBAAuB;IACvB,sBAAsB;IACtB,YAAY;IACZ,YAAY;IACZ,aAAa;IACb,0BAA0B;IAC1B,yBAAyB;IACzB,oBAAoB;IACpB,mBAAmB;IACnB,iBAAiB;IACjB,gBAAgB;IAChB,4BAA4B;IAC5B,2BAA2B;IAC3B,qBAAqB;IACrB,oBAAoB;IACpB,oBAAoB;IACpB,mBAAmB;IACnB,2BAA2B;IAC3B,0BAA0B;GAC5B;GACA,IAAI;IACF,OAAO;IACP,aAAa;IACb,SAAS;IACT,MAAM;IACN,QAAQ;IACR,SAAS;IACT,OAAO;IACP,UAAU;IACV,YAAY;IACZ,YAAY;IACZ,iBAAiB;IACjB,SAAS;IACT,SAAS;IACT,KAAK;IACL,WAAW;IACX,iBAAiB;IACjB,cAAc;IACd,aAAa;IACb,iBAAiB;IACjB,aAAa;IACb,eAAe;IACf,iBAAiB;IACjB,kBAAkB;IAClB,mBAAmB;IACnB,gBAAgB;IAChB,iBAAiB;IACjB,gBAAgB;IAChB,mBAAmB;IACnB,kBAAkB;IAClB,kBAAkB;IAClB,iBAAiB;IACjB,gBAAgB;IAChB,qBAAqB;IACrB,oBAAoB;IACpB,uBAAuB;IACvB,sBAAsB;IACtB,kBAAkB;IAClB,iBAAiB;IACjB,yBAAyB;IACzB,wBAAwB;IACxB,gCAAgC;IAChC,+BAA+B;IAC/B,2BAA2B;IAC3B,0BAA0B;IAC1B,uBAAuB;IACvB,sBAAsB;IACtB,YAAY;IACZ,YAAY;IACZ,aAAa;IACb,0BAA0B;IAC1B,yBAAyB;IACzB,oBAAoB;IACpB,mBAAmB;IACnB,iBAAiB;IACjB,gBAAgB;IAChB,4BAA4B;IAC5B,2BAA2B;IAC3B,qBAAqB;IACrB,oBAAoB;IACpB,oBAAoB;IACpB,mBAAmB;IACnB,2BAA2B;IAC3B,0BAA0B;GAC5B;EACF;EAEA,SAAS,SAAiB;GAExB,QADc,OAAO,cAAc,cAAc,UAAU,WAAW,KAAA,CAAM,YAClE,CAAC,CAAC,WAAW,IAAI,IAAI,OAAO,KAAK,OAAO;EACpD;;;;;;EAOA,SAAgB,YAAoB;GAClC,OAAO,OAAO,CAAC,CAAC;EAClB;;;;;;;;;;;EAgBA,SAAgB,eAAe,OAAuC;GACpE,MAAM,IAAI,OAAO;GACjB,MAAM,CAAC,MAAM,YAAA,GAAWA,MAAAA,SAAAA,CAAS,KAAK;GACtC,MAAM,CAAC,OAAO,aAAA,GAAYA,MAAAA,SAAAA,CAA4B,IAAI;GAC1D,MAAM,CAAC,YAAY,kBAAA,GAAiBA,MAAAA,SAAAA,CAAS,KAAK;GAClD,MAAM,CAAC,QAAQ,cAAA,GAAaA,MAAAA,SAAAA,CAA0C,CAAC,CAAC;GACxE,MAAM,CAAC,QAAQ,cAAA,GAAaA,MAAAA,SAAAA,CAAS,KAAK;GAC1C,MAAM,CAAC,QAAQ,cAAA,GAAaA,MAAAA,SAAAA,CAAwB,IAAI;GAIxD,MAAM,CAAC,UAAU,qBAAA,GAAoBA,MAAAA,SAAAA,CAAS,EAAE;GAChD,MAAM,CAAC,iBAAiB,4BAAA,GAA2BA,MAAAA,SAAAA,CAAS,EAAE;GAC9D,MAAM,CAAC,cAAc,oBAAA,GAAmBA,MAAAA,SAAAA,CAAS,KAAK;GACtD,MAAM,CAAC,eAAe,qBAAA,GAAoBA,MAAAA,SAAAA,CAAwB,IAAI;GACtE,MAAM,CAAC,gBAAgB,sBAAA,GAAqBA,MAAAA,SAAAA,CAAwB,IAAI;GAExE,CAAA,GAAA,MAAA,UAAA,OAAgB;IACd,IAAI,YAAY;IAChB,MAAM,qBAAqB,CAAC,CACzB,KAAK,OAAO,aAAa;KACxB,IAAI,WAAW;KACf,IAAI,CAAC,SAAS,IAAI,MAAM,IAAI,MAAM,QAAQ,SAAS,QAAQ;KAC3D,SAAS,MAAM,SAAS,KAAK,CAAe;IAC9C,CAAC,CAAC,CACD,YAAY;KACX,IAAI,CAAC,WAAW,cAAc,IAAI;IACpC,CAAC;IACH,aAAa;KAAE,YAAY;IAAK;GAClC,GAAG,CAAC,CAAC;GAML,IAAI,MAAM,SAAS,WAAW,OAAO,EAAE;GAOvC,IAAI,YACF,OACE,iBAAA,GAAA,kBAAA,KAAA,CAAC,OAAD;IAAK,OAAO,OAAO;IAAnB,UAAA,CACE,iBAAA,GAAA,kBAAA,KAAA,CAAC,OAAD;KAAK,OAAO,OAAO;KAAnB,UAAA,CACE,iBAAA,GAAA,kBAAA,IAAA,CAAC,QAAD;MAAM,OAAO,OAAO;MAClB,UAAA,iBAAA,GAAA,kBAAA,IAAA,CAAC,QAAD;OAAM,OAAO,OAAO;OAAO,UAAA,EAAE;MAAY,CAAA;KACrC,CAAA,GACN,iBAAA,GAAA,kBAAA,IAAA,CAAC,QAAD;MAAM,OAAO,OAAO;MAAc,UAAA,EAAE;KAAiB,CAAA,CAClD;IACL,CAAA,GAAA,iBAAA,GAAA,kBAAA,IAAA,CAAC,OAAD;KAAK,OAAO,OAAO;KACjB,UAAA,iBAAA,GAAA,kBAAA,IAAA,CAAC,KAAD;MAAG,OAAO,OAAO;MAAO,UAAA,EAAE;KAAY,CAAA;IACnC,CAAA,CACF;;GAGT,IAAI,UAAU,MAAM,OAAO;GAE3B,MAAM,EAAE,WAAW;GACnB,MAAM,WAAW,UACf,OAAO,UAAU,YAAY,OAAO,MAAK,MAAK,EAAE,UAAU,KAAK,GAAI,OAAO,MAAM;GAElF,MAAM,SAAS,OAAe,SAAuB;IACnD,WAAU,UAAS;KAAE,GAAG;MAAO,QAAQ;IAAK,EAAE;IAC9C,UAAU,IAAI;GAChB;GAEA,MAAM,cAAc,QAAwB;IAC1C,WAAU,SAAQ;KAChB,MAAM,OAAO,EAAE,GAAG,KAAK;KACvB,OAAO,KAAK,IAAI;KAChB,OAAO;IACT,CAAC;GACH;GAEA,MAAM,gBAAsB;IAC1B,UAAU,CAAC,CAAC;IACZ,UAAU,IAAI;GAChB;GAEA,MAAM,gBACJ,OAAO,QAAQ,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,UAAU;IAC7C,MAAM,MAAM,OAAO,MAAK,MAAK,EAAE,UAAU,KAAK;IAC9C,OAAO,QAAQ,KAAA,KAAa,WAAW,KAAK,QAAQ,EAAE,MAAM,KAAA;GAC9D,CAAC;GAEH,MAAM,QAAQ,OAAO,KAAK,MAAM,CAAC,CAAC,SAAS;GAC3C,MAAM,uBAAuB,gBAAgB,UAAU,eAAe;GACtE,MAAM,iBAAiB,aAAa,MAAM,oBAAoB;GAC9D,MAAM,gBAAgB,eAAe,MAAM,WAAW;;GAGtD,MAAM,SAAS,SAAoC;IACjD,IAAI,KAAK,WAAW,KAAA,GAAW;IAC/B,SAAS;KACP,QAAQ,KAAK;KACb,SAAS,KAAK,WAAW;KACzB,MAAM,KAAK,QAAQ;KACnB,KAAK,KAAK,OAAO;KACjB,WAAW,KAAK,aAAa;KAI7B,GAAI,KAAK,gBAAgB,KAAA,IAAY,EAAE,aAAa,KAAK,YAAY,IAAI,CAAC;IAC5E,CAAC;GACH;;;;;;;GAQA,MAAM,iBAAiB,YAA2B;IAChD,IAAI,gBAAgB,gBAAgB,UAAU,eAAe,MAAM,MAAM;IACzE,gBAAgB,IAAI;IACpB,iBAAiB,IAAI;IACrB,kBAAkB,IAAI;IACtB,IAAI;KACF,MAAM,WAAW,MAAM,MAAM,yBAAyB;MACpD,QAAQ;MACR,SAAS,EAAE,gBAAgB,mBAAmB;MAC9C,MAAM,KAAK,UAAU,EAAE,SAAS,CAAC;KACnC,CAAC;KAID,MAAM,OAAO,MAAM,SAAS,KAAK,CAAC,CAAC,YAAY,IAAI;KACnD,IAAI,CAAC,SAAS,IAAI;MAChB,iBAAiB,MAAM,UAAU,SAAS,WAAW,MAAM,EAAE,oBAAoB,QAAQ,SAAS,SAAS;MAC3G;KACF;KACA,IAAI,SAAS,MAAM;MACjB,iBAAiB,EAAE,iBAAiB;MACpC;KACF;KAIA,iBAAiB,EAAE;KACnB,wBAAwB,EAAE;KAC1B,kBAAkB,EAAE,eAAe;KACnC,MAAM,IAAI;IACZ,QAAQ;KACN,iBAAiB,EAAE,cAAc;IACnC,UAAU;KACR,gBAAgB,KAAK;IACvB;GACF;GAEA,MAAM,OAAO,YAA2B;IACtC,IAAI,CAAC,SAAS,UAAU,QAAQ,GAAG;IACnC,UAAU,IAAI;IACd,UAAU,IAAI;IACd,IAAI;KAKF,MAAM,QAAiC,CAAC;KACxC,KAAK,MAAM,CAAC,OAAO,SAAS,OAAO,QAAQ,MAAM,GAAG;MAClD,MAAM,MAAM,OAAO,MAAK,MAAK,EAAE,UAAU,KAAK;MAC9C,IAAI,QAAQ,KAAA,GAAW;MACvB,MAAM,QAAQ,WAAW,KAAK,QAAQ,EAAE;MACxC,IAAI,UAAU,KAAA,GAAW;MACzB,MAAM,SAAS,MAAM,SAAS,UAAU,OAAO,MAAM;KACvD;KACA,MAAM,WAAW,MAAM,MAAM,uBAAuB;MAClD,QAAQ;MACR,SAAS,EAAE,gBAAgB,mBAAmB;MAC9C,MAAM,KAAK,UAAU,KAAK;KAC5B,CAAC;KACD,MAAM,OAAO,MAAM,SAAS,KAAK,CAAC,CAAC,aAAa,CAAC,EAAE;KACnD,IAAI,CAAC,SAAS,IAAI;MAChB,UAAU,KAAK,SAAS,QAAQ,SAAS,QAAQ;MACjD;KACF;KACA,MAAM,IAAI;KACV,UAAU,CAAC,CAAC;IACd,QAAQ;KACN,UAAU,EAAE,UAAU;IACxB,UAAU;KACR,UAAU,KAAK;IACjB;GACF;GAEA,MAAM,iBAAiB,QAA6B;IAClD,MAAM,QAAQ,IAAI;IAClB,MAAM,QAAQ,EAAE,SAAS;IACzB,MAAM,OAAO,EAAE,QAAQ;IACvB,MAAM,OAAO,QAAQ,KAAK;IAC1B,QAAQ,IAAI,MAAZ;KACE,KAAK,WACH,OACE,iBAAA,GAAA,kBAAA,KAAA,CAAC,OAAD;MAAK,OAAO,OAAO;MAAnB,UAAA,CACE,iBAAA,GAAA,kBAAA,KAAA,CAAC,SAAD;OAAO,OAAO,OAAO;OAArB,UAAA;QACE,iBAAA,GAAA,kBAAA,IAAA,CAAC,SAAD;SACE,MAAK;SACL,SAAS,SAAS;SAClB,UAAU;SACV,WAAW,MACT,MAAM,OAAO,EAAE,OAAO,UAAU,SAAS,OAAO;QACnD,CAAA;QACD,iBAAA,GAAA,kBAAA,IAAA,CAAC,QAAD;SAAM,OAAO,OAAO;SAAQ,UAAA;QAAY,CAAA;QACxC,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD;SACE,MAAK;SACL,OAAO,OAAO;SACd,UAAU,UAAU,CAAC,OAAO;SAC5B,eAAe,WAAW,GAAG;SAE5B,UAAA,EAAE;QACG,CAAA;OACH;MACP,CAAA,GAAA,iBAAA,GAAA,kBAAA,IAAA,CAAC,QAAD;OAAM,OAAO,OAAO;OAAO,UAAA;MAAW,CAAA,CACnC;;KAET,KAAK;KACL,KAAK,YAAY;MAIf,MAAM,UAAU,IAAI,SAAS,aAAa,mBAAoB,IAAI,WAAW,CAAC;MAC9E,OACE,iBAAA,GAAA,kBAAA,KAAA,CAAC,OAAD;OAAK,OAAO,OAAO;OAAnB,UAAA;QACE,iBAAA,GAAA,kBAAA,IAAA,CAAC,SAAD;SAAO,OAAO,OAAO;SAAO,SAAS,UAAU;SAAU,UAAA;QAAa,CAAA;QACtE,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD;SACE,IAAI,UAAU;SACd,OAAO,OAAO;SACd,OAAO;SACP,UAAU;SACV,WAAW,MAAsC,MAAM,OAAO,EAAE,OAAO,KAAK;SAE3E,UAAA,QAAQ,KAAI,WACX,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD;UAAqB,OAAO;UACzB,UAAA,IAAI,SAAS,aAAa,EAAE,OAAO,YAAY;SAC1C,GAFK,MAEL,CACT;QACK,CAAA;QACR,iBAAA,GAAA,kBAAA,IAAA,CAAC,QAAD;SAAM,OAAO,OAAO;SAAO,UAAA;QAAW,CAAA;QACtC,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD;SACE,MAAK;SACL,OAAO,OAAO;SACd,UAAU,UAAU,CAAC,OAAO;SAC5B,eAAe,WAAW,GAAG;SAE5B,UAAA,EAAE;QACG,CAAA;OACL;;KAET;KACA,SACE,OACE,iBAAA,GAAA,kBAAA,KAAA,CAAC,OAAD;MAAK,OAAO,OAAO;MAAnB,UAAA;OACE,iBAAA,GAAA,kBAAA,IAAA,CAAC,SAAD;QAAO,OAAO,OAAO;QAAO,SAAS,UAAU;QAAU,UAAA;OAAa,CAAA;OACtE,iBAAA,GAAA,kBAAA,IAAA,CAAC,SAAD;QACE,IAAI,UAAU;QACd,OAAO,OAAO;QACd,MAAM,IAAI,SAAS,WAAW,WAAW;QACzC,OAAO;QACP,UAAU;QACV,aAAa,IAAI,WAAW,EAAE,kBAAkB,KAAA;QAChD,WAAW,MAAqC,MAAM,OAAO,EAAE,OAAO,KAAK;OAC5E,CAAA;OACD,iBAAA,GAAA,kBAAA,IAAA,CAAC,QAAD;QAAM,OAAO,OAAO;QAAO,UAAA;OAAW,CAAA;MACnC;;IAEX;GACF;GAEA,MAAM,aAAa,GAAG,MAAM,UAAU,EAAE,UAAU,EAAE,QAAQ,KAAK,EAAE,IAAI,IAAI,MAAM,IAAI,MAAM,MAAM;GAEjG,OACE,iBAAA,GAAA,kBAAA,KAAA,CAAC,OAAD;IAAK,OAAO,OAAO;KAAE,GAAG,OAAO;KAAM,GAAG,OAAO;IAAS,IAAI,OAAO;IAAnE,UAAA,CACE,iBAAA,GAAA,kBAAA,KAAA,CAAC,UAAD;KACE,MAAK;KACL,OAAO,OAAO;KACd,iBAAe;KACf,eAAe;MAAE,QAAQ,CAAC,IAAI;KAAE;KAJlC,UAAA,CAME,iBAAA,GAAA,kBAAA,KAAA,CAAC,QAAD;MAAM,OAAO,OAAO;MAApB,UAAA;OACE,iBAAA,GAAA,kBAAA,IAAA,CAAC,QAAD;QAAM,OAAO,OAAO;QAAO,UAAA,EAAE;OAAY,CAAA;OACzC,iBAAA,GAAA,kBAAA,IAAA,CAAC,QAAD;QAAM,OAAO,OAAO;QAAQ,OAAO;QAAa,UAAA;OAAiB,CAAA;OAChE,QAAQ,iBAAA,GAAA,kBAAA,IAAA,CAAC,QAAD;QAAM,OAAO,OAAO;QAAU,UAAA,EAAE;OAAc,CAAA,IAAI;OAC3D,iBAAA,GAAA,kBAAA,IAAA,CAAC,QAAD;QAAM,OAAO,OAAO;SAAE,GAAG,OAAO;SAAS,GAAG,OAAO;QAAY,IAAI,OAAO;QAAU,UAAA,OAAO,MAAM;OAAU,CAAA;MACvG;KACN,CAAA,GAAA,iBAAA,GAAA,kBAAA,IAAA,CAAC,QAAD;MAAM,OAAO,OAAO;MAAc,UAAA,EAAE;KAAkB,CAAA,CAChD;IACP,CAAA,GAAA,OAEG,iBAAA,GAAA,kBAAA,KAAA,CAAC,OAAD;KAAK,OAAO,OAAO;KAAnB,UAAA;MACG,MAAM,YAAY,iBAAA,GAAA,kBAAA,KAAA,CAAC,KAAD;OAAG,OAAO,OAAO;OAAO,MAAK;OAA7B,UAAA;QAAuC,EAAE;QAAU;QAAG,MAAM;OAAa;MAAI,CAAA,IAAA;MAChG,iBAAA,GAAA,kBAAA,KAAA,CAAC,OAAD;OAAK,OAAO,OAAO;OAAnB,UAAA;QACE,iBAAA,GAAA,kBAAA,KAAA,CAAC,OAAD;SAAK,OAAO,OAAO;SAAnB,UAAA,CACE,iBAAA,GAAA,kBAAA,IAAA,CAAC,QAAD;UAAM,OAAO,OAAO;UAAQ,UAAA,EAAE;SAAsB,CAAA,GACpD,iBAAA,GAAA,kBAAA,IAAA,CAAC,QAAD;UAAM,OAAO,kBAAkB,UAAU,OAAO,aAAa,OAAO;UACjE,UAAA,kBAAkB,QACf,EAAE,cACF,kBAAkB,UAAU,EAAE,gBAAgB,EAAE;SAChD,CAAA,CACH;;QACL,iBAAA,GAAA,kBAAA,IAAA,CAAC,KAAD;SAAG,OAAO,OAAO;SAAO,UAAA,EAAE;QAAgB,CAAA;QACzC,kBAAkB,UAAU,iBAAA,GAAA,kBAAA,IAAA,CAAC,KAAD;SAAG,OAAO,OAAO;SAAQ,UAAA,EAAE;QAAoB,CAAA,IAAI;QAC/E,kBAAkB,YAAY,iBAAA,GAAA,kBAAA,IAAA,CAAC,KAAD;SAAG,OAAO,OAAO;SAAO,UAAA,EAAE;QAAqB,CAAA,IAAI;QAClF,iBAAA,GAAA,kBAAA,KAAA,CAAC,OAAD;SAAK,OAAO,OAAO;SAAnB,UAAA,CACE,iBAAA,GAAA,kBAAA,IAAA,CAAC,SAAD;UACE,IAAG;UACH,MAAK;UACL,cAAa;UACb,cAAY,EAAE;UACd,OAAO;UACP,aAAa,EAAE;UACf,OAAO;UACP,UAAU;UACV,WAAW,MAAqC;WAC9C,iBAAiB,EAAE,OAAO,KAAK;WAC/B,iBAAiB,IAAI;WACrB,kBAAkB,IAAI;UACxB;SACD,CAAA,GACD,iBAAA,GAAA,kBAAA,IAAA,CAAC,SAAD;UACE,IAAG;UACH,MAAK;UACL,cAAa;UACb,cAAY,EAAE;UACd,OAAO;UACP,aAAa,EAAE;UACf,OAAO;UACP,UAAU;UACV,WAAW,MAAqC;WAC9C,wBAAwB,EAAE,OAAO,KAAK;WACtC,iBAAiB,IAAI;WACrB,kBAAkB,IAAI;UACxB;SACD,CAAA,CACE;;QACL,iBAAA,GAAA,kBAAA,KAAA,CAAC,OAAD;SAAK,OAAO,OAAO;SAAnB,UAAA,CACG,kBAAkB,OACf,iBAAA,GAAA,kBAAA,IAAA,CAAC,KAAD;UAAG,OAAO,OAAO;UAAO,MAAK;UAAS,UAAA;SAAiB,CAAA,IACvD,mBAAmB,OACjB,iBAAA,GAAA,kBAAA,IAAA,CAAC,KAAD;UAAG,OAAO,OAAO;UAAQ,MAAK;UAAU,UAAA;SAAkB,CAAA,IAC1D,kBAAkB,yBAAyB,OAEzC,iBAAA,GAAA,kBAAA,IAAA,CAAC,KAAD;UAAG,OAAO,OAAO;UAAO,MAAK;UAC1B,UAAA,yBAAyB,aAAa,EAAE,mBAAmB,EAAE;SAC7D,CAAA,IAEH,MACR,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD;UACE,MAAK;UACL,OAAO,OAAO;UACd,UAAU,gBAAgB,yBAAyB;UACnD,eAAe;WAAE,eAAoB;UAAE;UAEtC,UAAA,eAAe,EAAE,SAAS,EAAE;SACvB,CAAA,CACL;;OACF;;MACJ,OAAO,KAAI,QAAO,iBAAA,GAAA,kBAAA,IAAA,CAAC,OAAD,EAAA,UAAsB,cAAc,GAAG,EAAO,GAApC,IAAI,KAAgC,CAAC;MAClE,iBAAA,GAAA,kBAAA,KAAA,CAAC,OAAD;OAAK,OAAO,OAAO;OAAnB,UAAA;QACG,SAAS,iBAAA,GAAA,kBAAA,IAAA,CAAC,KAAD;SAAG,OAAO,OAAO;SAAO,MAAK;SAAU,UAAA;QAAU,CAAA,IAAI;QAC/D,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD;SACE,MAAK;SACL,OAAO,OAAO;SACd,UAAU,CAAC,SAAS;SACpB,SAAS;SAER,UAAA,EAAE;QACG,CAAA;QACR,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD;SACE,MAAK;SACL,OAAO,OAAO;SACd,UAAU,CAAC,SAAS,QAAQ,KAAK;SACjC,eAAe;UAAE,KAAU;SAAE;SAE5B,UAAA,SAAS,EAAE,SAAS,EAAE;QACjB,CAAA;OACL;;KACF;IAEL,CAAA,IAAA,IACD;;EAET;;EASA,SAAS,GAAG,OAAe,UAA0B;GACnD,OAAO,OAAO,MAAM,IAAI,SAAS;EACnC;EAEA,MAAM,IAAI;GACR,QAAQ,GAAG,yBAAyB,wBAAwB;GAC5D,IAAI,GAAG,0BAA0B,aAAa;GAC9C,QAAQ,GAAG,0BAA0B,aAAa;GAClD,cAAc,GAAG,6BAA6B,SAAS;GACvD,gBAAgB,GAAG,+BAA+B,SAAS;GAC3D,eAAe,GAAG,8BAA8B,uBAAuB;GACvE,aAAa,GAAG,4BAA4B,uBAAuB;GACnE,OAAO,GAAG,2BAA2B,SAAS;GAC9C,OAAO,GAAG,6BAA6B,SAAS;GAChD,SAAS,GAAG,kCAAkC,wBAAwB;EACxE;EAEA,MAAM,SAA8C;GAClD,MAAM;IACJ,WAAW;IACX,QAAQ,aAAa,EAAE;IACvB,cAAc;IACd,YAAY,EAAE;IACd,YAAY;IACZ,UAAU;GACZ;GACA,UAAU;IACR,YAAY,EAAE;IACd,aAAa,EAAE;GACjB;GACA,QAAQ;IACN,SAAS;IACT,eAAe;IACf,YAAY;IACZ,KAAK;IACL,OAAO;IACP,SAAS;IACT,QAAQ;IACR,YAAY;IACZ,MAAM;IACN,OAAO;IACP,WAAW;IACX,QAAQ;GACV;GACA,WAAW;IAAE,SAAS;IAAQ,YAAY;IAAU,KAAK;IAAQ,OAAO;GAAO;GAC/E,MAAM;IAAE,MAAM;IAAY,UAAU;IAAG,UAAU;IAAQ,YAAY;IAAK,YAAY;IAAK,OAAO,EAAE;GAAa;GAIjH,QAAQ;IACN,MAAM;IACN,UAAU;IACV,UAAU;IACV,UAAU;IACV,YAAY;IACZ,OAAO,EAAE;IACT,YAAY;IACZ,UAAU;IACV,cAAc;GAChB;GACA,aAAa;IACX,SAAS;IACT,UAAU;IACV,YAAY;IACZ,OAAO,EAAE;IACT,YAAY;IACZ,UAAU;IACV,cAAc;GAChB;GACA,SAAS;IACP,MAAM;IACN,cAAc;IACd,SAAS;IACT,UAAU;IACV,YAAY;IACZ,YAAY;IACZ,YAAY;IACZ,YAAY,EAAE;IACd,OAAO,EAAE;GACX;GACA,SAAS;IAAE,MAAM;IAAQ,OAAO,EAAE;IAAe,UAAU;IAAQ,YAAY;GAAiB;GAChG,aAAa,EAAE,WAAW,iBAAiB;GAC3C,MAAM;IACJ,WAAW,aAAa,EAAE;IAC1B,QAAQ;IACR,eAAe;IACf,SAAS;IACT,eAAe;GACjB;GAKA,SAAS;IACP,SAAS;IACT,eAAe;IACf,KAAK;IACL,SAAS;IACT,cAAc,aAAa,EAAE;GAC/B;GACA,aAAa;IAAE,SAAS;IAAQ,YAAY;IAAU,KAAK;GAAM;GACjE,OAAO;IACL,cAAc;IACd,SAAS;IACT,UAAU;IACV,YAAY;IACZ,YAAY;IACZ,YAAY;IACZ,YAAY,EAAE;IACd,OAAO,EAAE;GACX;GACA,YAAY;IACV,cAAc;IACd,SAAS;IACT,UAAU;IACV,YAAY;IACZ,YAAY;IACZ,YAAY;IACZ,YAAY,EAAE;IACd,OAAO,EAAE;GACX;GACA,QAAQ;IAAE,MAAM;IAAG,UAAU;IAAG,QAAQ;IAAG,UAAU;IAAQ,YAAY;IAAK,OAAO,EAAE;GAAe;GACtG,aAAa;IAAE,SAAS;IAAQ,UAAU;IAAQ,KAAK;GAAM;GAC7D,cAAc;IACZ,SAAS;IACT,YAAY;IACZ,gBAAgB;IAChB,KAAK;IACL,WAAW;GACb;GACA,OAAO;IACL,SAAS;IACT,eAAe;IACf,KAAK;IACL,SAAS;GACX;GACA,OAAO;IAAE,UAAU;IAAQ,YAAY;IAAK,YAAY;IAAK,OAAO,EAAE;GAAa;GACnF,MAAM;IAAE,QAAQ;IAAG,UAAU;IAAQ,YAAY;IAAK,OAAO,EAAE;GAAc;GAC7E,UAAU;IAAE,SAAS;IAAQ,YAAY;IAAU,KAAK;IAAO,QAAQ;GAAU;GACjF,OAAO;IACL,QAAQ;IACR,YAAY;IACZ,SAAS;IACT,MAAM;IACN,UAAU;IACV,YAAY;IACZ,OAAO,EAAE;IACT,QAAQ;IACR,WAAW;GACb;GACA,OAAO;IACL,QAAQ;IACR,SAAS;IACT,QAAQ,aAAa,EAAE;IACvB,cAAc;IACd,YAAY,EAAE;IACd,MAAM;IACN,UAAU;IACV,YAAY;IACZ,OAAO,EAAE;GACX;GACA,QAAQ;IACN,SAAS;IACT,YAAY;IACZ,gBAAgB;IAChB,KAAK;IACL,SAAS;IACT,WAAW,aAAa,EAAE;GAC5B;GACA,OAAO;IAAE,MAAM;IAAG,UAAU;IAAG,QAAQ;IAAG,UAAU;IAAQ,YAAY;IAAK,OAAO,EAAE;GAAM;GAC5F,SAAS;IACP,YAAY;IACZ,QAAQ,aAAa,EAAE;IACvB,cAAc;IACd,SAAS;IACT,MAAM;IACN,UAAU;IACV,YAAY;IACZ,YAAY;IACZ,OAAO,EAAE;IACT,QAAQ;GACV;GACA,MAAM;IACJ,YAAY;IACZ,QAAQ;IACR,cAAc;IACd,SAAS;IACT,MAAM;IACN,UAAU;IACV,YAAY;IACZ,YAAY,EAAE;IACd,OAAO,EAAE;IACT,QAAQ;GACV;EACF;;EAGA,MAAM,gBAAqC;GAAE,GAAG,OAAO;GAAO,MAAM;EAAY;;;;;;;;;;;;;;;;;EC12BhF,SAAS,uBAA+B;GACtC,MAAM,QAAQ,WAAW,OAAO,gCAAgB,IAAI,WAAW,EAAE,CAAC;GAClE,MAAM,OAAO,IAAI,SAAS,MAAM,QAAQ,MAAM,YAAY,MAAM,UAAU;GAC1E,KAAK,SAAS,GAAI,KAAK,SAAS,CAAC,IAAI,KAAQ,EAAI;GACjD,KAAK,SAAS,GAAI,KAAK,SAAS,CAAC,IAAI,KAAQ,GAAI;GACjD,MAAM,MAAM,MAAM,KAAK,QAAO,SAAQ,KAAK,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE;GACjF,OAAO,GAAG,IAAI,MAAM,GAAG,CAAC,EAAE,GAAG,IAAI,MAAM,GAAG,EAAE,EAAE,GAAG,IAAI,MAAM,IAAI,EAAE,EAAE,GAAG,IAAI,MAAM,IAAI,EAAE,EAAE,GAAG,IAAI,MAAM,EAAE;EACzG;;;;;;EAOA,SAAgB,wBAAiC;GAC/C,MAAM,YAAY,WAAW;GAC7B,IAAI,cAAc,KAAA,GAAW,OAAO;GACpC,IAAI,OAAO,UAAU,eAAe,YAAY,OAAO;GACvD,IAAI,OAAO,UAAU,oBAAoB,YAAY,OAAO;GAC5D,IAAI;IAGF,MAAM,QAAQ,OAAO,eAAe,SAAS;IAC7C,IAAI,UAAU,QAAQ,OAAO,MAAM,eAAe,YAAY;KAC5D,OAAO,eAAe,OAAO,cAAc;MACzC,OAAO;MACP,UAAU;MACV,cAAc;KAChB,CAAC;KACD,OAAO;IACT;IAEA,OAAO,eAAe,WAAW,cAAc;KAC7C,OAAO;KACP,UAAU;KACV,cAAc;IAChB,CAAC;IACD,OAAO;GACT,QAAQ;IACN,OAAO;GACT;EACF;EAIA,sBAAsB;EAYtB,MAAa,OAAO;;;;;EAMpB,MAAM,WAAW;;EAGjB,MAAa,SAAS,CAAC,SAAS,aAAa;;;;;EAM7C,SAAgB,MAAM,KAA0B;GAC9C,sBAAsB;GAiBtB,IAAI,aAAa,IAAI,YAAY,YAAY,CAAC,QAAQ,SACpD,IAAI,MAAM,OAAO,sBAAsB,IAAI,MAAM,SAAS;IACxD,MAAM;IACN,IAAI;IACJ,OAAO;IACP,aAAa,UAAU;GACzB,GAAG,cAAc,CAAC,CAAC,CAAC;EACxB"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@riceawa/dsh-lan-gateway",
   "description": "LAN/internet reverse-proxy gateway for the DeepSeek Harness web GUI: binds 0.0.0.0 and forwards to the loopback dsh web server. Default-deny: every source (loopback, LAN, internet) must sign in with an HMAC session cookie unless lanPasswordless is explicitly enabled; against dsh >= 0.1.2-rc.1 the gateway relays one shared upstream browser session, so the harness's own authorization still gates every request. Fail-closed start guard (password required, plaintext needs an explicit opt-in), session revocation by epoch (password changes and secret rotation kill cookies and live WebSockets), same-site/Origin fence on HTTP and WebSocket upgrades, optional TLS (auto self-signed or user-supplied certs), and a Settings → Plugins card for live adjustment of port, CIDRs, auth, TLS, and the login password (the card overwrites the stored credential without ever displaying the old one; the password stays a scrypt hash in state.json, out of the config schema). Includes an insecure-origin UUID shim client bundle: on gateway-served plain-HTTP origins browsers lack crypto.randomUUID, so the client half patches a getRandomValues-backed randomUUID onto the Crypto prototype, fixing workspace open over LAN without touching DSH source.",
-  "version": "0.6.1",
+  "version": "0.6.2",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",

package/src/client/lan-gateway-card.tsx

@@ -60,6 +60,27 @@ interface RouteState {
 /** Why a password draft cannot be submitted yet. */
 export type PasswordProblem = 'tooShort' | 'mismatch'
 
+/**
+ * The card's password badge state.
+ *
+ * Three states, not two: a host that predates the password route does not
+ * report `passwordSet` at all, and `undefined` must read as "unknown" rather
+ * than "not set" — a client refreshed against a running old host would
+ * otherwise announce that a gateway which is demonstrably running (it cannot
+ * start without a credential) has no password.
+ */
+export type PasswordStatus = 'set' | 'unset' | 'unknown'
+
+/**
+ * Classify the host's `passwordSet` for the badge.
+ * @param passwordSet - the snapshot's flag, or `undefined` when absent.
+ * @returns `set` / `unset` / `unknown` (absent field).
+ */
+export function passwordStatus(passwordSet: boolean | undefined): PasswordStatus {
+  if (passwordSet === undefined) return 'unknown'
+  return passwordSet ? 'set' : 'unset'
+}
+
 /**
  * Judge a password draft the way the host's password route will, so a draft the
  * card enables is never answered with a 400. The length bound is the shared
@@ -102,7 +123,9 @@ interface Labels {
   passwordConfirm: string
   passwordSet: string
   passwordUnset: string
+  passwordUnknown: string
   passwordRequired: string
+  passwordHostStale: string
   passwordChange: string
   passwordChanged: string
   passwordFailed: string
@@ -137,7 +160,9 @@ const LABELS: Record<'zh' | 'en', Labels> = {
     passwordConfirm: '再次输入新密码',
     passwordSet: '已设置',
     passwordUnset: '未设置',
+    passwordUnknown: '状态未知（宿主端较旧）',
     passwordRequired: '未设置密码时网关拒绝启动。',
+    passwordHostStale: '宿主端没有报告密码状态，说明 dsh web 还在运行旧版本：重启后这里才会显示「已设置 / 未设置」，这个改密表单也才会生效。',
     passwordChange: '修改密码',
     passwordChanged: '密码已更新：旧密码立即失效，所有已登录会话已作废。',
     passwordFailed: '修改密码失败，请重试。',
@@ -200,7 +225,9 @@ const LABELS: Record<'zh' | 'en', Labels> = {
     passwordConfirm: 'Repeat new password',
     passwordSet: 'Set',
     passwordUnset: 'Not set',
+    passwordUnknown: 'Unknown (older host)',
     passwordRequired: 'The gateway refuses to start without a password.',
+    passwordHostStale: 'The host did not report a password state, so dsh web is still running the previous build: restart it to get Set / Not set here and to make this form take effect.',
     passwordChange: 'Change password',
     passwordChanged: 'Password updated: the old one no longer works and every signed-in session was revoked.',
     passwordFailed: 'The password change failed — retry.',
@@ -361,6 +388,7 @@ export function LanGatewayCard(props: LanGatewayCardProps): ReactNode {
   const dirty = Object.keys(drafts).length > 0
   const passwordDraftProblem = passwordProblem(password, passwordConfirm)
   const passwordTyping = password !== '' || passwordConfirm !== ''
+  const passwordBadge = passwordStatus(route.passwordSet)
 
   /** Adopt the host's post-write snapshot, keeping the last known values. */
   const adopt = (body: Partial<RouteState>): void => {
@@ -371,7 +399,10 @@ export function LanGatewayCard(props: LanGatewayCardProps): ReactNode {
       port: body.port ?? 0,
       tls: body.tls ?? '',
       lastError: body.lastError ?? null,
-      passwordSet: body.passwordSet === true,
+      // Absent is a state of its own (an older host does not report the field),
+      // so it must not be coerced into `false`: that is what made a running,
+      // password-protected gateway render as "not set".
+      ...(body.passwordSet !== undefined ? { passwordSet: body.passwordSet } : {}),
     })
   }
 
@@ -562,12 +593,15 @@ export function LanGatewayCard(props: LanGatewayCardProps): ReactNode {
             <div style={styles.section}>
               <div style={styles.sectionHead}>
                 <span style={styles.label}>{t.passwordSection}</span>
-                <span style={route.passwordSet === true ? styles.badge : styles.badgeAlert}>
-                  {route.passwordSet === true ? t.passwordSet : t.passwordUnset}
+                <span style={passwordBadge === 'unset' ? styles.badgeAlert : styles.badge}>
+                  {passwordBadge === 'set'
+                    ? t.passwordSet
+                    : passwordBadge === 'unset' ? t.passwordUnset : t.passwordUnknown}
                 </span>
               </div>
               <p style={styles.hint}>{t.passwordHint}</p>
-              {route.passwordSet === true ? null : <p style={styles.error}>{t.passwordRequired}</p>}
+              {passwordBadge === 'unset' ? <p style={styles.error}>{t.passwordRequired}</p> : null}
+              {passwordBadge === 'unknown' ? <p style={styles.hint}>{t.passwordHostStale}</p> : null}
               <div style={styles.passwordRow}>
                 <input
                   id="lan-gw-password"