dsh-mobile 0.1.0-alpha.1

package/lib/index.mjs

@@ -0,0 +1,2118 @@
+import { X509Certificate, createHash, randomBytes, timingSafeEqual } from "node:crypto";
+import { basename, dirname, isAbsolute, join, resolve } from "node:path";
+import z from "@deepseek-ai/schemastery";
+import { connect, isIP } from "node:net";
+import { chmod, lstat, mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { createServer, request } from "node:http";
+import { createServer as createServer$1 } from "node:https";
+import { Transform } from "node:stream";
+import { pipeline } from "node:stream/promises";
+//#region src/access.ts
+/** Stable error categories converted to deliberately terse HTTP responses. */
+var AccessError = class extends Error {
+	status;
+	code;
+	constructor(status, code) {
+		super(code);
+		this.status = status;
+		this.code = code;
+		this.name = "AccessError";
+	}
+};
+/** Fixed-window limiter whose attacker-controlled key table is itself bounded. */
+var BoundedRateLimiter = class {
+	limit;
+	windowMs;
+	maximumKeys;
+	buckets = /* @__PURE__ */ new Map();
+	constructor(limit, windowMs, maximumKeys) {
+		this.limit = limit;
+		this.windowMs = windowMs;
+		this.maximumKeys = maximumKeys;
+	}
+	/** Consume one attempt; unknown keys fail closed when the bounded table is full. */
+	take(key, now) {
+		for (const [candidate, bucket] of this.buckets) if (bucket.resetAt <= now) this.buckets.delete(candidate);
+		const current = this.buckets.get(key);
+		if (current === void 0) {
+			if (this.buckets.size >= this.maximumKeys) return false;
+			this.buckets.set(key, {
+				count: 1,
+				resetAt: now + this.windowMs
+			});
+			return true;
+		}
+		if (current.count >= this.limit) return false;
+		current.count += 1;
+		return true;
+	}
+	/** Current table size, exposed for bounded-state assertions. */
+	get size() {
+		return this.buckets.size;
+	}
+};
+function opaqueToken() {
+	return randomBytes(32).toString("base64url");
+}
+function digest(value) {
+	return createHash("sha256").update(value, "utf8").digest();
+}
+function digestHex(value) {
+	return digest(value).toString("hex");
+}
+function matchesDigest(value, expected) {
+	return timingSafeEqual(digest(value), expected);
+}
+function normalizeLabel(value) {
+	const label = (value ?? "Mobile device").normalize("NFC").trim();
+	if (label.length < 1 || label.length > 64 || /[\u0000-\u001f\u007f]/u.test(label)) throw new AccessError(400, "invalid_request");
+	return label;
+}
+function publicDevice(device) {
+	return Object.freeze({
+		id: device.id,
+		label: device.label,
+		createdAt: device.createdAt,
+		expiresAt: device.expiresAt,
+		lastSeenAt: device.lastSeenAt,
+		...device.revokedAt === void 0 ? {} : { revokedAt: device.revokedAt }
+	});
+}
+/** Pairing, persistent-device, short-Session, revocation, and CSRF state machine. */
+var AccessController = class {
+	store;
+	options;
+	now;
+	pairLimiter;
+	devices = [];
+	pairingWindow;
+	sessions = /* @__PURE__ */ new Map();
+	sessionEndedListeners = /* @__PURE__ */ new Set();
+	mutation = Promise.resolve();
+	initialized = false;
+	closing = false;
+	closeTask;
+	constructor(store, options) {
+		this.store = store;
+		this.options = options;
+		this.now = options.now ?? Date.now;
+		this.pairLimiter = new BoundedRateLimiter(options.maxPairingAttempts, options.rateLimitWindowMs, options.maxRateLimitKeys);
+	}
+	/** Load and validate digest-only durable state before accepting traffic. */
+	async initialize() {
+		if (this.initialized || this.closing) throw new Error("access controller cannot be initialized again");
+		const snapshot = await this.store.load();
+		if (snapshot.devices.length > this.options.maxDevices) throw new Error("device state exceeds configured maxDevices");
+		this.devices = [...snapshot.devices];
+		this.initialized = true;
+	}
+	requireInitialized() {
+		if (!this.initialized || this.closing) throw new Error("access controller is not available");
+	}
+	async exclusive(operation) {
+		const prior = this.mutation;
+		let release;
+		this.mutation = new Promise((resolve) => {
+			release = resolve;
+		});
+		await prior;
+		try {
+			return await operation();
+		} finally {
+			release();
+		}
+	}
+	snapshot(devices) {
+		return Object.freeze({
+			version: 1,
+			devices: Object.freeze([...devices])
+		});
+	}
+	emitSessionEnded(session) {
+		const authorization = Object.freeze({
+			sessionKey: session.key,
+			deviceId: session.deviceId,
+			expiresAt: session.expiresAt
+		});
+		for (const listener of this.sessionEndedListeners) listener(authorization);
+	}
+	removeSession(key) {
+		const session = this.sessions.get(key);
+		if (session === void 0) return;
+		this.sessions.delete(key);
+		this.emitSessionEnded(session);
+	}
+	pruneSessions(now) {
+		for (const [key, session] of this.sessions) if (session.expiresAt <= now) this.removeSession(key);
+	}
+	createSession(deviceId, now, deviceExpiresAt) {
+		this.pruneSessions(now);
+		if (this.sessions.size >= this.options.maxSessions) {
+			const oldest = [...this.sessions.values()].sort((left, right) => left.createdAt - right.createdAt)[0];
+			if (oldest !== void 0) this.removeSession(oldest.key);
+		}
+		const sessionToken = opaqueToken();
+		const csrfToken = opaqueToken();
+		const key = digestHex(sessionToken);
+		const record = Object.freeze({
+			key,
+			deviceId,
+			csrfDigest: digest(csrfToken),
+			createdAt: now,
+			expiresAt: Math.min(now + this.options.sessionTtlMs, deviceExpiresAt)
+		});
+		this.sessions.set(key, record);
+		return Object.freeze({
+			deviceId,
+			sessionToken,
+			csrfToken,
+			sessionExpiresAt: record.expiresAt
+		});
+	}
+	/** Open one short pairing window and return its one-time secret to a loopback caller only. */
+	async openPairing(requestedTtlMs) {
+		this.requireInitialized();
+		return this.exclusive(async () => {
+			const ttl = requestedTtlMs ?? this.options.pairingTtlMs;
+			if (!Number.isSafeInteger(ttl) || ttl < 1e4 || ttl > this.options.pairingTtlMs) throw new AccessError(400, "invalid_request");
+			const token = opaqueToken();
+			const expiresAt = this.now() + ttl;
+			this.pairingWindow = Object.freeze({
+				digest: digest(token),
+				expiresAt
+			});
+			return Object.freeze({
+				token,
+				expiresAt
+			});
+		});
+	}
+	/** Consume the pairing window exactly once and persist only the device-token digest. */
+	async pair(sourceKey, token, label) {
+		this.requireInitialized();
+		const now = this.now();
+		if (!this.pairLimiter.take(sourceKey, now)) throw new AccessError(429, "rate_limited");
+		if (token.length > 512) throw new AccessError(401, "authentication_failed");
+		return this.exclusive(async () => {
+			const window = this.pairingWindow;
+			if (window === void 0 || window.expiresAt <= now || !matchesDigest(token, window.digest)) {
+				if (window !== void 0 && window.expiresAt <= now) this.pairingWindow = void 0;
+				throw new AccessError(401, "authentication_failed");
+			}
+			this.pairingWindow = void 0;
+			if (this.devices.filter((device) => device.revokedAt === void 0 && device.expiresAt > now).length >= this.options.maxDevices) throw new AccessError(409, "device_limit");
+			const deviceToken = opaqueToken();
+			const device = Object.freeze({
+				id: randomBytes(16).toString("hex"),
+				label: normalizeLabel(label),
+				tokenDigest: digestHex(deviceToken),
+				createdAt: now,
+				expiresAt: now + this.options.deviceTtlMs,
+				lastSeenAt: now
+			});
+			const next = [...this.devices.filter((candidate) => candidate.revokedAt === void 0 && candidate.expiresAt > now), device];
+			await this.store.save(this.snapshot(next));
+			this.devices = next;
+			const session = this.createSession(device.id, now, device.expiresAt);
+			return Object.freeze({
+				...session,
+				deviceToken,
+				deviceExpiresAt: device.expiresAt
+			});
+		});
+	}
+	/** Exchange a valid persistent device credential for a new short Session. */
+	async renew(deviceToken) {
+		this.requireInitialized();
+		if (deviceToken.length > 512) throw new AccessError(401, "authentication_failed");
+		return this.exclusive(async () => {
+			const now = this.now();
+			const tokenDigest = digest(deviceToken);
+			const index = this.devices.findIndex((device) => timingSafeEqual(Buffer.from(device.tokenDigest, "hex"), tokenDigest));
+			const device = this.devices[index];
+			if (device === void 0 || device.revokedAt !== void 0 || device.expiresAt <= now) throw new AccessError(401, "authentication_failed");
+			const updated = Object.freeze({
+				...device,
+				lastSeenAt: now
+			});
+			const next = [...this.devices];
+			next[index] = updated;
+			await this.store.save(this.snapshot(next));
+			this.devices = next;
+			return this.createSession(device.id, now, device.expiresAt);
+		});
+	}
+	/** Resolve a short Session Cookie without revealing whether device or Session failed. */
+	authorizeSession(sessionToken) {
+		this.requireInitialized();
+		if (sessionToken.length > 512) throw new AccessError(401, "authentication_failed");
+		const now = this.now();
+		this.pruneSessions(now);
+		const key = digestHex(sessionToken);
+		const session = this.sessions.get(key);
+		const device = session === void 0 ? void 0 : this.devices.find((candidate) => candidate.id === session.deviceId);
+		if (session === void 0 || device === void 0 || device.revokedAt !== void 0 || device.expiresAt <= now) {
+			if (session !== void 0) this.removeSession(session.key);
+			throw new AccessError(401, "authentication_failed");
+		}
+		return Object.freeze({
+			sessionKey: key,
+			deviceId: session.deviceId,
+			expiresAt: session.expiresAt
+		});
+	}
+	/** Require the Session-bound anti-CSRF value for an authenticated mutation. */
+	assertCsrf(authorization, csrfToken) {
+		const session = this.sessions.get(authorization.sessionKey);
+		if (session === void 0 || csrfToken === void 0 || csrfToken.length > 512 || !matchesDigest(csrfToken, session.csrfDigest)) throw new AccessError(403, "forbidden");
+	}
+	/** End one short Session and notify the gateway to abort its attached work. */
+	logout(authorization) {
+		this.removeSession(authorization.sessionKey);
+	}
+	/** Persist revocation, then end every Session owned by that device. */
+	async revokeDevice(deviceId) {
+		this.requireInitialized();
+		return this.exclusive(async () => {
+			const index = this.devices.findIndex((device) => device.id === deviceId);
+			const device = this.devices[index];
+			if (device === void 0 || device.revokedAt !== void 0) return false;
+			const next = [...this.devices];
+			next[index] = Object.freeze({
+				...device,
+				revokedAt: this.now()
+			});
+			await this.store.save(this.snapshot(next));
+			this.devices = next;
+			for (const [key, session] of this.sessions) if (session.deviceId === deviceId) this.removeSession(key);
+			return true;
+		});
+	}
+	/** Remove every persistent credential and terminate every active Session. */
+	async resetDevices() {
+		this.requireInitialized();
+		await this.exclusive(async () => {
+			await this.store.save(this.snapshot([]));
+			this.devices = [];
+			for (const key of [...this.sessions.keys()]) this.removeSession(key);
+			this.pairingWindow = void 0;
+		});
+	}
+	/** Safe metadata for the loopback administration surface. */
+	listDevices() {
+		this.requireInitialized();
+		return Object.freeze(this.devices.map(publicDevice));
+	}
+	/** Pairing status without exposing the one-time secret. */
+	pairingStatus() {
+		this.requireInitialized();
+		const window = this.pairingWindow;
+		if (window === void 0 || window.expiresAt <= this.now()) {
+			this.pairingWindow = void 0;
+			return Object.freeze({ open: false });
+		}
+		return Object.freeze({
+			open: true,
+			expiresAt: window.expiresAt
+		});
+	}
+	/** Subscribe gateway resources to Session logout, expiry, eviction, and device revocation. */
+	onSessionEnded(listener) {
+		this.sessionEndedListeners.add(listener);
+		return () => {
+			this.sessionEndedListeners.delete(listener);
+		};
+	}
+	/** Stop new operations, drain durable mutations, then clear volatile credentials. */
+	close() {
+		if (this.closeTask !== void 0) return this.closeTask;
+		this.closing = true;
+		this.closeTask = this.finishClose();
+		return this.closeTask;
+	}
+	async finishClose() {
+		await this.mutation;
+		this.pairingWindow = void 0;
+		for (const key of [...this.sessions.keys()]) this.removeSession(key);
+		this.sessionEndedListeners.clear();
+		this.initialized = false;
+	}
+	/** Bounded volatile-state metrics for tests and local status. */
+	metrics() {
+		return Object.freeze({
+			sessions: this.sessions.size,
+			rateLimitKeys: this.pairLimiter.size
+		});
+	}
+};
+//#endregion
+//#region src/network.ts
+function parseIpv4(address) {
+	const parts = address.split(".");
+	if (parts.length !== 4) throw new Error(`invalid IPv4 address ${JSON.stringify(address)}`);
+	let value = 0n;
+	for (const part of parts) {
+		if (!/^\d{1,3}$/u.test(part)) throw new Error(`invalid IPv4 address ${JSON.stringify(address)}`);
+		const octet = Number(part);
+		if (octet > 255) throw new Error(`invalid IPv4 address ${JSON.stringify(address)}`);
+		value = value << 8n | BigInt(octet);
+	}
+	return value;
+}
+function parseIpv6Part(part, address) {
+	if (part.includes(".")) {
+		const ipv4 = parseIpv4(part);
+		return [Number(ipv4 >> 16n & 65535n), Number(ipv4 & 65535n)];
+	}
+	if (!/^[\da-f]{1,4}$/iu.test(part)) throw new Error(`invalid IPv6 address ${JSON.stringify(address)}`);
+	return [Number.parseInt(part, 16)];
+}
+function parseIpv6(address) {
+	const withoutZone = address.split("%", 1)[0] ?? address;
+	if (withoutZone.split("::").length > 2) throw new Error(`invalid IPv6 address ${JSON.stringify(address)}`);
+	const [leftText, rightText] = withoutZone.split("::");
+	const left = leftText === "" ? [] : leftText.split(":").flatMap((part) => parseIpv6Part(part, address));
+	const right = rightText === void 0 || rightText === "" ? [] : rightText.split(":").flatMap((part) => parseIpv6Part(part, address));
+	const omitted = 8 - left.length - right.length;
+	if (rightText === void 0 ? omitted !== 0 : omitted < 1) throw new Error(`invalid IPv6 address ${JSON.stringify(address)}`);
+	const groups = [
+		...left,
+		...Array.from({ length: omitted }, () => 0),
+		...right
+	];
+	if (groups.length !== 8) throw new Error(`invalid IPv6 address ${JSON.stringify(address)}`);
+	return groups.reduce((value, group) => value << 16n | BigInt(group), 0n);
+}
+function mappedIpv4(address) {
+	return /^::ffff:(\d{1,3}(?:\.\d{1,3}){3})$/iu.exec(address)?.[1];
+}
+function parseIp(address) {
+	const unwrapped = address.startsWith("[") && address.endsWith("]") ? address.slice(1, -1) : address;
+	const mapped = mappedIpv4(unwrapped);
+	if (mapped !== void 0) return {
+		bits: 32,
+		value: parseIpv4(mapped)
+	};
+	const version = isIP(unwrapped.split("%", 1)[0] ?? unwrapped);
+	if (version === 4) return {
+		bits: 32,
+		value: parseIpv4(unwrapped)
+	};
+	if (version === 6) return {
+		bits: 128,
+		value: parseIpv6(unwrapped)
+	};
+	throw new Error(`invalid IP address ${JSON.stringify(address)}`);
+}
+/** Parse and canonicalize one IPv4 or IPv6 CIDR. */
+function parseCidr(source) {
+	const slash = source.lastIndexOf("/");
+	if (slash <= 0 || slash === source.length - 1) throw new Error(`invalid CIDR ${JSON.stringify(source)}`);
+	const parsed = parseIp(source.slice(0, slash));
+	const prefixText = source.slice(slash + 1);
+	if (!/^\d{1,3}$/u.test(prefixText)) throw new Error(`invalid CIDR ${JSON.stringify(source)}`);
+	const prefix = Number(prefixText);
+	if (prefix > parsed.bits) throw new Error(`invalid CIDR ${JSON.stringify(source)}`);
+	const hostBits = BigInt(parsed.bits - prefix);
+	const mask = hostBits === BigInt(parsed.bits) ? 0n : (1n << BigInt(parsed.bits)) - 1n ^ (1n << hostBits) - 1n;
+	const network = parsed.value & mask;
+	if (network !== parsed.value) throw new Error(`CIDR ${JSON.stringify(source)} has host bits set`);
+	return Object.freeze({
+		bits: parsed.bits,
+		network,
+		prefix,
+		source
+	});
+}
+/** Whether a directly connected socket address belongs to at least one allowed CIDR. */
+function addressAllowed(address, cidrs) {
+	if (address === void 0) return false;
+	let parsed;
+	try {
+		parsed = parseIp(address);
+	} catch {
+		return false;
+	}
+	return cidrs.some((cidr) => {
+		if (cidr.bits !== parsed.bits) return false;
+		const hostBits = BigInt(cidr.bits - cidr.prefix);
+		const mask = hostBits === BigInt(cidr.bits) ? 0n : (1n << BigInt(cidr.bits)) - 1n ^ (1n << hostBits) - 1n;
+		return (parsed.value & mask) === cidr.network;
+	});
+}
+/** Whether an IP literal is loopback and therefore eligible for HTTP-only development. */
+function isLoopbackAddress(address) {
+	try {
+		const parsed = parseIp(address);
+		if (parsed.bits === 32) return parsed.value >> 24n === 127n;
+		return parsed.value === 1n;
+	} catch {
+		return false;
+	}
+}
+/** Parse a bare host or host:port authority without accepting URL components. */
+function parseAuthority(source) {
+	if (source.trim() !== source || source.length === 0 || /[/?#@\\]/u.test(source)) throw new Error(`invalid public authority ${JSON.stringify(source)}`);
+	let url;
+	try {
+		url = new URL(`https://${source}`);
+	} catch {
+		throw new Error(`invalid public authority ${JSON.stringify(source)}`);
+	}
+	if (url.username !== "" || url.password !== "" || url.pathname !== "/" || url.search !== "" || url.hash !== "") throw new Error(`invalid public authority ${JSON.stringify(source)}`);
+	const explicitPort = /\]:\d+$/u.test(source) || !source.startsWith("[") && /:\d+$/u.test(source);
+	const hostname = url.hostname.toLowerCase();
+	const port = explicitPort ? Number(url.port === "" ? 443 : url.port) : void 0;
+	if (port !== void 0 && (!Number.isInteger(port) || port < 1 || port > 65535)) throw new Error(`invalid public authority ${JSON.stringify(source)}`);
+	return port === void 0 ? Object.freeze({ hostname }) : Object.freeze({
+		hostname,
+		port
+	});
+}
+function formatHostname(hostname) {
+	return hostname.includes(":") && !hostname.startsWith("[") ? `[${hostname}]` : hostname;
+}
+/** Resolve an authority against the actual listener port. */
+function resolveAuthority(spec, listenerPort) {
+	return `${formatHostname(spec.hostname)}:${String(spec.port ?? listenerPort)}`;
+}
+/** Exact Host/Origin/CIDR policy for the directly exposed listener. */
+var RequestTrustPolicy = class {
+	cidrs;
+	authorities;
+	origins;
+	scheme;
+	constructor(specs, listenerPort, cidrs, tls) {
+		this.cidrs = cidrs;
+		this.scheme = tls ? "https" : "http";
+		this.authorities = new Set(specs.map((spec) => resolveAuthority(spec, listenerPort).toLowerCase()));
+		this.origins = new Set([...this.authorities].map((authority) => new URL(`${this.scheme}://${authority}`).origin.toLowerCase()));
+	}
+	/** Validate the exact Host header after WHATWG authority normalization. */
+	acceptsHost(header) {
+		return this.canonicalHost(header) !== void 0;
+	}
+	/** Return the canonical accepted Host authority, otherwise undefined. */
+	canonicalHost(header) {
+		if (header === void 0 || /[/?#@\\]/u.test(header)) return void 0;
+		let normalized;
+		try {
+			const parsed = new URL(`${this.scheme}://${header}`);
+			if (parsed.pathname !== "/" || parsed.username !== "" || parsed.password !== "") return void 0;
+			normalized = resolveAuthority({
+				hostname: parsed.hostname,
+				port: Number(parsed.port || (this.scheme === "https" ? "443" : "80"))
+			}, 80).toLowerCase();
+		} catch {
+			return;
+		}
+		return this.authorities.has(normalized) ? normalized : void 0;
+	}
+	/** Validate an exact same-scheme browser Origin. */
+	acceptsOrigin(header) {
+		return this.canonicalOrigin(header) !== void 0;
+	}
+	/** Return the canonical accepted Origin, otherwise undefined. */
+	canonicalOrigin(header) {
+		if (header === void 0) return void 0;
+		let normalized;
+		try {
+			const parsed = new URL(header);
+			if (parsed.pathname !== "/" || parsed.search !== "" || parsed.hash !== "" || parsed.username !== "" || parsed.password !== "") return;
+			normalized = parsed.origin.toLowerCase();
+		} catch {
+			return;
+		}
+		return this.origins.has(normalized) ? normalized : void 0;
+	}
+};
+//#endregion
+//#region src/config.ts
+/** Loader-facing defaults; {@link parseGatewayConfig} enforces cross-field security rules. */
+const Config = z.object({
+	setupFile: z.string().hidden(),
+	publicOrigin: z.string(),
+	listenHost: z.string(),
+	listenPort: z.natural().max(65535),
+	upstreamOrigin: z.string(),
+	publicAuthorities: z.array(String).default(void 0),
+	allowedCidrs: z.array(String).default(void 0),
+	stateFile: String,
+	controlFile: z.string().hidden().required(),
+	customCssFile: z.string().hidden(),
+	initiallyEnabled: z.boolean().hidden().required(),
+	tls: z.object({
+		mode: z.union([z.const("provided"), z.const("disabled")]),
+		certFile: z.string(),
+		keyFile: z.string(),
+		caFile: z.string()
+	}),
+	pairingTtlMs: z.natural(),
+	deviceTtlMs: z.natural(),
+	sessionTtlMs: z.natural(),
+	maxDevices: z.natural(),
+	maxSessions: z.natural(),
+	maxConnections: z.natural(),
+	maxActiveRequests: z.natural(),
+	maxWebSockets: z.natural(),
+	maxBodyBytes: z.natural(),
+	upstreamTimeoutMs: z.natural(),
+	rateLimitWindowMs: z.natural(),
+	maxPairingAttempts: z.natural(),
+	maxRateLimitKeys: z.natural()
+});
+function integer(value, name, fallback, minimum, maximum) {
+	const resolved = value ?? fallback;
+	if (typeof resolved !== "number" || !Number.isSafeInteger(resolved) || resolved < minimum || resolved > maximum) throw new Error(`${name} must be an integer from ${String(minimum)} through ${String(maximum)}`);
+	return resolved;
+}
+function stringArray(value, name) {
+	if (!Array.isArray(value) || value.length === 0 || value.some((entry) => typeof entry !== "string")) throw new Error(`${name} must be a non-empty string array`);
+	return value;
+}
+function absoluteFile(value, name) {
+	if (typeof value !== "string" || value.length === 0 || !isAbsolute(value)) throw new Error(`${name} must be an absolute file path`);
+	return resolve(value);
+}
+/** Resolve the hidden runtime-control file independently from gateway configuration. */
+function parseControlFile(value) {
+	return absoluteFile(value, "controlFile");
+}
+function parseUpstream(value) {
+	const source = value ?? "http://127.0.0.1:3080";
+	if (typeof source !== "string") throw new Error("upstreamOrigin must be a string");
+	let url;
+	try {
+		url = new URL(source);
+	} catch {
+		throw new Error("upstreamOrigin must be an HTTP loopback origin");
+	}
+	if (url.protocol !== "http:" || !isLoopbackAddress(url.hostname) || url.username !== "" || url.password !== "" || url.pathname !== "/" || url.search !== "" || url.hash !== "" || url.port === "") throw new Error("upstreamOrigin must be an HTTP loopback origin with an explicit port and no path or credentials");
+	return url;
+}
+function parsePublicOrigin(value) {
+	if (value === void 0) return void 0;
+	if (typeof value !== "string" || value.length === 0 || value.trim() !== value) throw new Error("publicOrigin must be an HTTPS origin");
+	let url;
+	try {
+		url = new URL(value);
+	} catch {
+		throw new Error("publicOrigin must be an HTTPS origin");
+	}
+	if (url.protocol !== "https:" || url.username !== "" || url.password !== "" || url.pathname !== "/" || url.search !== "" || url.hash !== "") throw new Error("publicOrigin must be an HTTPS origin with no path or credentials");
+	if (url.hostname === "0.0.0.0" || url.hostname === "[::]") throw new Error("publicOrigin must name a reachable host");
+	return Object.freeze({
+		authority: parseAuthority(url.host),
+		port: Number(url.port || "443")
+	});
+}
+function parseTls(value, listenHost) {
+	const mode = value?.mode ?? "provided";
+	if (mode === "disabled") {
+		if (!isLoopbackAddress(listenHost)) throw new Error("TLS may be disabled only on an IP loopback listener");
+		return Object.freeze({ mode });
+	}
+	return Object.freeze({
+		mode,
+		certFile: absoluteFile(value?.certFile, "tls.certFile"),
+		keyFile: absoluteFile(value?.keyFile, "tls.keyFile"),
+		...value?.caFile === void 0 ? {} : { caFile: absoluteFile(value.caFile, "tls.caFile") }
+	});
+}
+/** Parse configuration and reject unsafe topology, credential, and resource combinations. */
+function parseGatewayConfig(raw) {
+	if (typeof raw !== "object" || raw === null || Array.isArray(raw)) throw new Error("mobile-access config must be an object");
+	const value = raw;
+	const publicOrigin = parsePublicOrigin(value.publicOrigin);
+	if (publicOrigin !== void 0 && value.listenPort !== void 0) throw new Error("publicOrigin cannot be combined with listenPort");
+	if (publicOrigin !== void 0 && value.publicAuthorities !== void 0) throw new Error("publicOrigin cannot be combined with publicAuthorities");
+	const listenHost = value.listenHost ?? (publicOrigin === void 0 ? "127.0.0.1" : "0.0.0.0");
+	if (isIP(listenHost) === 0) throw new Error("listenHost must be an IP literal");
+	const listenPort = publicOrigin?.port ?? integer(value.listenPort, "listenPort", 3443, 0, 65535);
+	const upstreamOrigin = parseUpstream(value.upstreamOrigin);
+	const tls = parseTls(value.tls, listenHost);
+	if (publicOrigin !== void 0 && tls.mode !== "provided") throw new Error("publicOrigin requires TLS");
+	let authorities;
+	if (publicOrigin !== void 0) authorities = [publicOrigin.authority];
+	else {
+		let authoritySources = value.publicAuthorities;
+		if (authoritySources === void 0 || authoritySources.length === 0) {
+			if (!isLoopbackAddress(listenHost)) throw new Error("publicAuthorities is required for a non-loopback listener");
+			authoritySources = [listenHost];
+		}
+		authorities = authoritySources.map(parseAuthority);
+	}
+	for (const authority of authorities) {
+		if (listenPort === 0 && authority.port !== void 0) throw new Error("explicit public authority ports require a non-zero listenPort");
+		if (authority.port !== void 0 && listenPort !== 0 && authority.port !== listenPort) throw new Error("every explicit public authority port must equal listenPort");
+	}
+	if (new Set(authorities.map((entry) => `${entry.hostname}:${String(entry.port ?? listenPort)}`)).size !== authorities.length) throw new Error("publicAuthorities must not contain duplicates");
+	const allowedCidrs = stringArray(value.allowedCidrs ?? (isLoopbackAddress(listenHost) ? ["127.0.0.0/8", "::1/128"] : void 0), "allowedCidrs").map(parseCidr);
+	if (new Set(allowedCidrs.map((entry) => `${String(entry.bits)}:${entry.network.toString(16)}:${String(entry.prefix)}`)).size !== allowedCidrs.length) throw new Error("allowedCidrs must not contain duplicates");
+	const deviceTtlMs = integer(value.deviceTtlMs, "deviceTtlMs", 7776e6, 6e4, 316224e5);
+	const sessionTtlMs = integer(value.sessionTtlMs, "sessionTtlMs", 288e5, 3e4, 864e5);
+	if (sessionTtlMs > deviceTtlMs) throw new Error("sessionTtlMs must not exceed deviceTtlMs");
+	return Object.freeze({
+		listenHost,
+		listenPort,
+		upstreamOrigin,
+		authorities: Object.freeze(authorities),
+		allowedCidrs: Object.freeze(allowedCidrs),
+		stateFile: absoluteFile(value.stateFile, "stateFile"),
+		customCssFile: value.customCssFile === void 0 ? join(dirname(absoluteFile(value.stateFile, "stateFile")), "mobile.css") : absoluteFile(value.customCssFile, "customCssFile"),
+		tls,
+		pairingTtlMs: integer(value.pairingTtlMs, "pairingTtlMs", 12e4, 1e4, 6e5),
+		deviceTtlMs,
+		sessionTtlMs,
+		maxDevices: integer(value.maxDevices, "maxDevices", 32, 1, 256),
+		maxSessions: integer(value.maxSessions, "maxSessions", 64, 1, 1024),
+		maxConnections: integer(value.maxConnections, "maxConnections", 64, 1, 1024),
+		maxActiveRequests: integer(value.maxActiveRequests, "maxActiveRequests", 32, 1, 1024),
+		maxWebSockets: integer(value.maxWebSockets, "maxWebSockets", 16, 1, 256),
+		maxBodyBytes: integer(value.maxBodyBytes, "maxBodyBytes", 167772160, 1024, 268435456),
+		upstreamTimeoutMs: integer(value.upstreamTimeoutMs, "upstreamTimeoutMs", 3e4, 1e3, 3e5),
+		rateLimitWindowMs: integer(value.rateLimitWindowMs, "rateLimitWindowMs", 6e4, 1e3, 36e5),
+		maxPairingAttempts: integer(value.maxPairingAttempts, "maxPairingAttempts", 8, 1, 100),
+		maxRateLimitKeys: integer(value.maxRateLimitKeys, "maxRateLimitKeys", 256, 1, 4096)
+	});
+}
+//#endregion
+//#region src/control.ts
+/** Validate control state loaded across the filesystem boundary. */
+function parseMobileAccessControlState(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error("mobile-access control state must be an object");
+	const record = value;
+	if (record.version !== 1 || typeof record.enabled !== "boolean" || Reflect.ownKeys(record).some((key) => key !== "version" && key !== "enabled")) throw new Error("mobile-access control state has an unsupported format");
+	return Object.freeze({
+		version: 1,
+		enabled: record.enabled
+	});
+}
+/** Atomic JSON store whose absent-file state comes from the installation-time default. */
+var JsonMobileAccessControlStore = class {
+	file;
+	initiallyEnabled;
+	constructor(file, initiallyEnabled) {
+		this.file = file;
+		this.initiallyEnabled = initiallyEnabled;
+	}
+	async load() {
+		let stat;
+		try {
+			stat = await lstat(this.file);
+		} catch (error) {
+			if (error.code === "ENOENT") return Object.freeze({
+				version: 1,
+				enabled: this.initiallyEnabled
+			});
+			throw error;
+		}
+		if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 4096) throw new Error("mobile-access control state must be a regular file no larger than 4 KiB");
+		let parsed;
+		try {
+			parsed = JSON.parse(await readFile(this.file, "utf8"));
+		} catch (error) {
+			throw new Error("mobile-access control state is not valid JSON", { cause: error });
+		}
+		return parseMobileAccessControlState(parsed);
+	}
+	async save(state) {
+		const validated = parseMobileAccessControlState(state);
+		const directory = dirname(this.file);
+		await mkdir(directory, {
+			recursive: true,
+			mode: 448
+		});
+		try {
+			const current = await lstat(this.file);
+			if (!current.isFile() || current.isSymbolicLink()) throw new Error("mobile-access control state target must remain a regular file");
+		} catch (error) {
+			if (error.code !== "ENOENT") throw error;
+		}
+		const temporary = join(directory, `.${basename(this.file)}.${randomBytes(12).toString("hex")}.tmp`);
+		try {
+			await writeFile(temporary, `${JSON.stringify(validated)}\n`, {
+				encoding: "utf8",
+				flag: "wx",
+				mode: 384
+			});
+			await chmod(temporary, 384);
+			await rename(temporary, this.file);
+		} catch (error) {
+			try {
+				await rm(temporary, { force: true });
+			} catch (cleanupError) {
+				throw new AggregateError([error, cleanupError], "control state write and temporary cleanup both failed");
+			}
+			throw error;
+		}
+	}
+};
+/** Serialized persistent lifecycle for the gateway behind the always-loaded Cordis entry. */
+var MobileAccessGatewayController = class {
+	store;
+	startRuntime;
+	runtime;
+	initialized = false;
+	closing = false;
+	queue = Promise.resolve();
+	closeTask;
+	constructor(store, startRuntime) {
+		this.store = store;
+		this.startRuntime = startRuntime;
+	}
+	/** Load the durable preference and start the first runtime when enabled. */
+	initialize() {
+		return this.enqueue(async () => {
+			if (this.initialized) throw new Error("mobile-access control is already initialized");
+			if (this.closing) throw new Error("mobile-access control is closing");
+			if ((await this.store.load()).enabled) this.runtime = await this.startRuntime();
+			this.initialized = true;
+		});
+	}
+	/** Return the committed in-process runtime state. */
+	isRunning() {
+		return this.runtime !== void 0;
+	}
+	/** Start or stop the runtime and persist only a successfully committed transition. */
+	setRunning(running) {
+		if (this.closing) return Promise.reject(/* @__PURE__ */ new Error("mobile-access control is closing"));
+		return this.enqueue(async () => {
+			if (!this.initialized) throw new Error("mobile-access control is not initialized");
+			if (this.isRunning() === running) return;
+			if (running) await this.enable();
+			else await this.disable();
+		});
+	}
+	/** Stop the runtime after earlier transitions without changing the restart preference. */
+	close() {
+		if (this.closeTask !== void 0) return this.closeTask;
+		this.closing = true;
+		this.closeTask = this.enqueue(async () => {
+			const runtime = this.runtime;
+			if (runtime === void 0) return;
+			await runtime.close();
+			this.runtime = void 0;
+		});
+		return this.closeTask;
+	}
+	async enable() {
+		const candidate = await this.startRuntime();
+		try {
+			await this.store.save({
+				version: 1,
+				enabled: true
+			});
+		} catch (error) {
+			try {
+				await candidate.close();
+			} catch (rollbackError) {
+				throw new AggregateError([error, rollbackError], "enabling mobile access failed and runtime rollback also failed");
+			}
+			throw error;
+		}
+		this.runtime = candidate;
+	}
+	async disable() {
+		const previous = this.runtime;
+		if (previous === void 0) return;
+		await previous.close();
+		try {
+			await this.store.save({
+				version: 1,
+				enabled: false
+			});
+		} catch (error) {
+			try {
+				this.runtime = await this.startRuntime();
+			} catch (rollbackError) {
+				this.runtime = void 0;
+				throw new AggregateError([error, rollbackError], "disabling mobile access failed and runtime rollback also failed");
+			}
+			throw error;
+		}
+		this.runtime = void 0;
+	}
+	enqueue(operation) {
+		const run = this.queue.then(operation, operation);
+		this.queue = run.then(() => {}, () => {});
+		return run;
+	}
+};
+//#endregion
+//#region src/http-security.ts
+const DEVICE_COOKIE = "dsh_ma_device";
+const SESSION_COOKIE = "dsh_ma_session";
+const CSRF_COOKIE = "dsh_ma_csrf";
+const CSRF_HEADER = "x-dsh-mobile-csrf";
+const LOCAL_ADMIN_PREFIX = "/api/mobile-access";
+const AUTH_PREFIX = "/mobile-access";
+const WS_PATHS = /* @__PURE__ */ new Set(["/api/events.mux", "/api/events.host"]);
+/** Terse request failure safe to expose without internal diagnostics. */
+var HttpError = class extends Error {
+	status;
+	code;
+	constructor(status, code) {
+		super(code);
+		this.status = status;
+		this.code = code;
+		this.name = "HttpError";
+	}
+};
+/** Parse only origin-form request targets and reject ambiguous slash encodings. */
+function parseRequestTarget(raw) {
+	if (raw === void 0 || !raw.startsWith("/") || raw.startsWith("//") || raw.includes("\\") || /[\u0000-\u001f\u007f]/u.test(raw)) throw new HttpError(400, "bad_request");
+	let parsed;
+	let decodedPathname;
+	try {
+		parsed = new URL(raw, "http://gateway.invalid");
+		decodedPathname = decodeURIComponent(parsed.pathname);
+	} catch {
+		throw new HttpError(400, "bad_request");
+	}
+	if (decodedPathname.includes("\\") || decodedPathname.startsWith("//") || /[\u0000-\u001f\u007f]/u.test(decodedPathname)) throw new HttpError(400, "bad_request");
+	return Object.freeze({
+		raw,
+		pathname: parsed.pathname,
+		decodedPathname,
+		search: parsed.search
+	});
+}
+/** Set the gateway-owned browser protections and non-cacheability. */
+function setSecurityHeaders(response, tls) {
+	response.setHeader("Cache-Control", "no-store");
+	response.setHeader("Content-Security-Policy", [
+		"default-src 'self'",
+		"base-uri 'none'",
+		"object-src 'none'",
+		"frame-ancestors 'none'",
+		"form-action 'self'",
+		"script-src 'self' 'unsafe-inline'",
+		"style-src 'self' 'unsafe-inline'",
+		"img-src 'self' data: blob:",
+		"font-src 'self' data:",
+		"connect-src 'self'",
+		"worker-src 'self' blob:"
+	].join("; "));
+	response.setHeader("Permissions-Policy", "camera=(), microphone=(), geolocation=(), payment=(), usb=()");
+	response.setHeader("Referrer-Policy", "no-referrer");
+	response.setHeader("X-Content-Type-Options", "nosniff");
+	response.setHeader("X-Frame-Options", "DENY");
+	response.setHeader("Cross-Origin-Resource-Policy", "same-origin");
+	if (tls) response.setHeader("Strict-Transport-Security", "max-age=31536000");
+}
+/** Send a bounded JSON response without reflecting request or upstream data. */
+function sendJson(response, status, value, tls) {
+	if (response.headersSent || response.destroyed) return;
+	setSecurityHeaders(response, tls);
+	const body = `${JSON.stringify(value)}\n`;
+	response.writeHead(status, {
+		"Content-Type": "application/json; charset=utf-8",
+		"Content-Length": Buffer.byteLength(body)
+	});
+	response.end(body);
+}
+/** Send a generic failure containing only a stable category. */
+function sendFailure(response, status, code, tls) {
+	sendJson(response, status, { error: code }, tls);
+}
+/** Read and parse one bounded JSON object. */
+async function readJsonObject(request, maximumBytes) {
+	if (request.headers["content-type"]?.split(";", 1)[0]?.trim().toLowerCase() !== "application/json") throw new HttpError(415, "unsupported_media_type");
+	const declared = request.headers["content-length"];
+	if (declared !== void 0) {
+		if (!/^\d+$/u.test(declared) || Number(declared) > maximumBytes) throw new HttpError(413, "payload_too_large");
+	}
+	const chunks = [];
+	let total = 0;
+	for await (const chunk of request) {
+		const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+		total += buffer.length;
+		if (total > maximumBytes) throw new HttpError(413, "payload_too_large");
+		chunks.push(buffer);
+	}
+	let parsed;
+	try {
+		parsed = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+	} catch {
+		throw new HttpError(400, "bad_request");
+	}
+	if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) throw new HttpError(400, "bad_request");
+	return parsed;
+}
+/** Strict cookie parser: malformed or duplicate names invalidate the whole header. */
+function parseCookies(header) {
+	if (header === void 0) return /* @__PURE__ */ new Map();
+	if (header.length > 8192) return void 0;
+	const cookies = /* @__PURE__ */ new Map();
+	for (const part of header.split(";")) {
+		const equals = part.indexOf("=");
+		if (equals <= 0) return void 0;
+		const name = part.slice(0, equals).trim();
+		const value = part.slice(equals + 1).trim();
+		if (!/^[!#$%&'*+\-.^_`|~\dA-Za-z]+$/u.test(name) || !/^[\w\-.~+/=]*$/u.test(value) || cookies.has(name)) return;
+		cookies.set(name, value);
+	}
+	return cookies;
+}
+/** Serialize a host-only Cookie with no Domain attribute. */
+function cookie(name, value, options) {
+	const parts = [
+		`${name}=${value}`,
+		`Path=${options.path}`,
+		`Max-Age=${String(Math.max(0, Math.floor(options.maxAgeSeconds)))}`,
+		"SameSite=Strict",
+		"Priority=High"
+	];
+	if (options.tls) parts.push("Secure");
+	if (options.httpOnly) parts.push("HttpOnly");
+	return parts.join("; ");
+}
+/** Enforce direct CIDR, exact Host, and browser same-origin facts. */
+function assertExternalTrust(request, policy, requireOrigin) {
+	if (!addressAllowed(request.socket.remoteAddress, policy.cidrs) || !policy.acceptsHost(request.headers.host)) throw new HttpError(403, "forbidden");
+	const origin = request.headers.origin;
+	if (origin !== void 0 && !policy.acceptsOrigin(origin)) throw new HttpError(403, "forbidden");
+	const site = request.headers["sec-fetch-site"];
+	if (site !== void 0 && site !== "same-origin" && site !== "none") throw new HttpError(403, "forbidden");
+	if (requireOrigin && (!policy.acceptsOrigin(origin) || site !== "same-origin")) throw new HttpError(403, "forbidden");
+}
+function localAuthority(header) {
+	if (header === void 0 || /[/?#@\\]/u.test(header)) return void 0;
+	try {
+		const url = new URL(`http://${header}`);
+		if (url.pathname !== "/" || url.username !== "" || url.password !== "") return void 0;
+		return {
+			hostname: url.hostname,
+			authority: url.host.toLowerCase()
+		};
+	} catch {
+		return;
+	}
+}
+/** Protect the inner management route from non-loopback and DNS-rebinding callers. */
+function assertLocalAdminTrust(request, requireBrowserOrigin) {
+	if (request.socket.remoteAddress === void 0 || !isLoopbackAddress(request.socket.remoteAddress)) throw new HttpError(403, "forbidden");
+	const host = localAuthority(request.headers.host);
+	if (host === void 0 || host.hostname !== "localhost" && !isLoopbackAddress(host.hostname)) throw new HttpError(403, "forbidden");
+	const site = request.headers["sec-fetch-site"];
+	if (site !== void 0 && site !== "same-origin" && site !== "none") throw new HttpError(403, "forbidden");
+	const origin = request.headers.origin;
+	if (origin !== void 0) try {
+		const parsed = new URL(origin);
+		if (parsed.host.toLowerCase() !== host.authority || parsed.protocol !== "http:" && parsed.protocol !== "https:") throw new HttpError(403, "forbidden");
+	} catch (error) {
+		if (error instanceof HttpError) throw error;
+		throw new HttpError(403, "forbidden");
+	}
+	if (requireBrowserOrigin && site !== void 0 && (origin === void 0 || site !== "same-origin")) throw new HttpError(403, "forbidden");
+}
+//#endregion
+//#region src/gateway.ts
+const MAX_CONTROL_BODY_BYTES = 16384;
+const MAX_HEADER_BYTES = 16384;
+const PAIR_PAGE = `<!doctype html>
+<html lang="en">
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width,initial-scale=1,viewport-fit=cover">
+<title>Pair DSH mobile access</title>
+<main>
+  <h1>Pair this device</h1>
+  <form id="pair-form">
+    <label>Pairing code <input id="pair-token" autocomplete="one-time-code" required></label>
+    <label>Device name <input id="device-label" maxlength="64" autocomplete="off"></label>
+    <button type="submit">Pair</button>
+    <output id="pair-status"></output>
+  </form>
+</main>
+<script src="/mobile-access/pair.js" defer><\/script>
+</html>
+`;
+const PAIR_SCRIPT = `(() => {
+  const form = document.getElementById('pair-form')
+  const token = document.getElementById('pair-token')
+  const label = document.getElementById('device-label')
+  const status = document.getElementById('pair-status')
+  const fragment = new URLSearchParams(location.hash.slice(1))
+  const supplied = fragment.get('token')
+  history.replaceState(null, '', location.pathname)
+  if (supplied) token.value = supplied
+  form.addEventListener('submit', async (event) => {
+    event.preventDefault()
+    status.value = 'Pairing…'
+    const response = await fetch('/mobile-access/auth/pair', {
+      method: 'POST',
+      credentials: 'same-origin',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ token: token.value, label: label.value || undefined }),
+    })
+    if (!response.ok) {
+      status.value = 'Pairing failed'
+      return
+    }
+    location.replace('/')
+  })
+})()
+`;
+const LOGIN_PAGE = `<!doctype html>
+<html lang="en">
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width,initial-scale=1,viewport-fit=cover">
+<title>Reconnect DSH mobile access</title>
+<main>
+  <h1>Reconnect this device</h1>
+  <p id="login-progress">Restoring the secure Session…</p>
+  <section id="login-failed" hidden>
+    <p>This device is no longer paired. Open pairing on the computer, then pair it again.</p>
+    <a href="/mobile-access/pair">Open pairing</a>
+  </section>
+</main>
+<script src="/mobile-access/login.js" defer><\/script>
+</html>
+`;
+const LOGIN_SCRIPT = `(() => {
+  const candidate = new URL(location.href).searchParams.get('return')
+  let returnPath = '/'
+  if (candidate && candidate.startsWith('/')) {
+    try {
+      const resolved = new URL(candidate, location.origin)
+      const pathname = decodeURIComponent(resolved.pathname)
+      if (resolved.origin === location.origin && pathname !== '/mobile-access'
+        && !pathname.startsWith('/mobile-access/') && !pathname.includes('\\\\')) {
+        returnPath = resolved.pathname + resolved.search + resolved.hash
+      }
+    } catch {
+      // Malformed untrusted return targets keep the safe root default.
+    }
+  }
+  fetch('/mobile-access/auth/renew', {
+    method: 'POST',
+    credentials: 'same-origin',
+    headers: { 'content-type': 'application/json' },
+    body: '{}',
+  }).then((response) => {
+    if (response.ok) {
+      location.replace(returnPath)
+      return
+    }
+    document.getElementById('login-progress').hidden = true
+    document.getElementById('login-failed').hidden = false
+  }).catch(() => {
+    document.getElementById('login-progress').textContent = 'The computer is unavailable.'
+  })
+})()
+`;
+var ByteLimitTransform = class extends Transform {
+	maximum;
+	total = 0;
+	constructor(maximum) {
+		super();
+		this.maximum = maximum;
+	}
+	_transform(chunk, encoding, callback) {
+		const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk, encoding);
+		this.total += buffer.length;
+		if (this.total > this.maximum) {
+			callback(new HttpError(413, "payload_too_large"));
+			return;
+		}
+		callback(null, buffer);
+	}
+};
+function stripIpv6Brackets(hostname) {
+	return hostname.startsWith("[") && hostname.endsWith("]") ? hostname.slice(1, -1) : hostname;
+}
+function parsePemCertificates(contents, source) {
+	const text = contents.toString("utf8");
+	const pattern = /-----BEGIN CERTIFICATE-----[\s\S]*?-----END CERTIFICATE-----/gu;
+	const blocks = text.match(pattern) ?? [];
+	if (blocks.length === 0 || text.replace(pattern, "").trim() !== "") throw new Error(`${source} must contain only PEM certificates`);
+	return blocks.map((pem) => {
+		let certificate;
+		try {
+			certificate = new X509Certificate(pem);
+		} catch (error) {
+			throw new Error(`${source} contains an invalid certificate`, { cause: error });
+		}
+		return Object.freeze({
+			pem: `${pem}\n`,
+			certificate
+		});
+	});
+}
+function validateServerChain(chain) {
+	const now = Date.now();
+	for (const [index, entry] of chain.entries()) {
+		if (Date.parse(entry.certificate.validFrom) > now || Date.parse(entry.certificate.validTo) <= now) throw new Error("TLS certificate chain contains a certificate that is not currently valid");
+		if (index === 0) continue;
+		if (entry.certificate.subject === entry.certificate.issuer && entry.certificate.verify(entry.certificate.publicKey)) throw new Error("TLS server certificate chain must not include a self-signed root");
+		const child = chain[index - 1].certificate;
+		if (!entry.certificate.ca || !child.checkIssued(entry.certificate) || !child.verify(entry.certificate.publicKey)) throw new Error("TLS server certificate chain is not an ordered leaf-to-intermediate chain");
+	}
+}
+async function tlsOptions(config) {
+	if (config.tls.mode === "disabled") throw new Error("TLS options requested for a disabled listener");
+	const [certFile, key, additionalChainFile] = await Promise.all([
+		readFile(config.tls.certFile),
+		readFile(config.tls.keyFile),
+		config.tls.caFile === void 0 ? Promise.resolve(void 0) : readFile(config.tls.caFile)
+	]);
+	const chain = [...parsePemCertificates(certFile, "tls.certFile"), ...additionalChainFile === void 0 ? [] : parsePemCertificates(additionalChainFile, "tls.caFile")];
+	validateServerChain(chain);
+	const leaf = chain[0].certificate;
+	for (const authority of config.authorities) {
+		const hostname = stripIpv6Brackets(authority.hostname);
+		if ((isIP(hostname) === 0 ? leaf.checkHost(hostname) : leaf.checkIP(hostname)) === void 0) throw new Error(`TLS certificate does not cover configured authority ${hostname}`);
+	}
+	return {
+		cert: chain.map((entry) => entry.pem).join(""),
+		key,
+		requestCert: false,
+		minVersion: "TLSv1.2",
+		maxHeaderSize: MAX_HEADER_BYTES
+	};
+}
+function websocketAccept(key) {
+	return createHash("sha1").update(`${key}258EAFA5-E914-47DA-95CA-C5AB0DC85B11`, "ascii").digest("base64");
+}
+function headerValue(headers, name) {
+	const value = headers[name];
+	return Array.isArray(value) ? void 0 : value;
+}
+function hasToken(header, token) {
+	return header?.split(",").some((value) => value.trim().toLowerCase() === token) ?? false;
+}
+function rejectUpgrade(socket, status, code) {
+	if (socket.destroyed) return;
+	const body = `${JSON.stringify({ error: code })}\n`;
+	socket.end([
+		`HTTP/1.1 ${String(status)} ${status === 401 ? "Unauthorized" : status === 403 ? "Forbidden" : "Bad Request"}`,
+		"Connection: close",
+		"Cache-Control: no-store",
+		"Content-Type: application/json; charset=utf-8",
+		"Referrer-Policy: no-referrer",
+		"X-Content-Type-Options: nosniff",
+		`Content-Length: ${String(Buffer.byteLength(body))}`,
+		"",
+		body
+	].join("\r\n"));
+}
+function sanitizeRequestHeaders(request, upstream) {
+	const headers = { host: upstream.host };
+	if (request.headers.origin !== void 0) headers.origin = upstream.origin;
+	if (request.headers["sec-fetch-site"] !== void 0) headers["sec-fetch-site"] = "same-origin";
+	for (const name of [
+		"accept",
+		"accept-encoding",
+		"accept-language",
+		"content-encoding",
+		"content-length",
+		"content-type",
+		"if-match",
+		"if-modified-since",
+		"if-none-match",
+		"if-unmodified-since",
+		"range",
+		"user-agent"
+	]) {
+		const value = request.headers[name];
+		if (value !== void 0) headers[name] = value;
+	}
+	return headers;
+}
+const BLOCKED_RESPONSE_HEADERS = /* @__PURE__ */ new Set([
+	"alt-svc",
+	"cache-control",
+	"connection",
+	"content-security-policy",
+	"content-security-policy-report-only",
+	"cross-origin-embedder-policy",
+	"cross-origin-opener-policy",
+	"cross-origin-resource-policy",
+	"expires",
+	"keep-alive",
+	"nel",
+	"permissions-policy",
+	"pragma",
+	"proxy-authenticate",
+	"referrer-policy",
+	"report-to",
+	"reporting-endpoints",
+	"server",
+	"set-cookie",
+	"strict-transport-security",
+	"trailer",
+	"transfer-encoding",
+	"upgrade",
+	"via",
+	"x-content-type-options",
+	"x-frame-options",
+	"x-powered-by"
+]);
+function sanitizeResponseHeaders(headers, upstream) {
+	const clean = {};
+	for (const [name, value] of Object.entries(headers)) {
+		const lower = name.toLowerCase();
+		if (value === void 0 || BLOCKED_RESPONSE_HEADERS.has(lower) || lower.startsWith("access-control-")) continue;
+		if (lower === "location" && typeof value === "string") {
+			try {
+				const location = new URL(value, upstream);
+				clean.location = location.origin === upstream.origin ? `${location.pathname}${location.search}${location.hash}` : value;
+			} catch {
+				continue;
+			}
+			continue;
+		}
+		clean[lower] = value;
+	}
+	return clean;
+}
+function requestCookies(request) {
+	const cookies = parseCookies(request.headers.cookie);
+	if (cookies === void 0) throw new HttpError(401, "authentication_failed");
+	return cookies;
+}
+function mapError(error) {
+	if (error instanceof HttpError) return error;
+	if (error instanceof AccessError) return new HttpError(error.status, error.code);
+	return new HttpError(500, "internal_error");
+}
+/** Authenticated TLS edge in front of the ordinary loopback-only DSH Web server. */
+var MobileAccessGateway = class {
+	config;
+	access;
+	tlsEnabled;
+	policy;
+	server;
+	listenerPort;
+	connectedSockets = /* @__PURE__ */ new Set();
+	activeRequests = /* @__PURE__ */ new Map();
+	activeWebSockets = /* @__PURE__ */ new Map();
+	nextOperationId = 1;
+	closing = false;
+	started = false;
+	closeTask;
+	removeSessionListener;
+	renewLimiter;
+	constructor(config, store) {
+		this.config = config;
+		this.tlsEnabled = config.tls.mode === "provided";
+		this.access = new AccessController(store, {
+			pairingTtlMs: config.pairingTtlMs,
+			deviceTtlMs: config.deviceTtlMs,
+			sessionTtlMs: config.sessionTtlMs,
+			maxDevices: config.maxDevices,
+			maxSessions: config.maxSessions,
+			rateLimitWindowMs: config.rateLimitWindowMs,
+			maxPairingAttempts: config.maxPairingAttempts,
+			maxRateLimitKeys: config.maxRateLimitKeys
+		});
+		this.renewLimiter = new BoundedRateLimiter(Math.min(100, config.maxPairingAttempts * 4), config.rateLimitWindowMs, config.maxRateLimitKeys);
+		this.removeSessionListener = this.access.onSessionEnded((authorization) => {
+			this.abortSessionResources(authorization.sessionKey);
+		});
+	}
+	/** Initialize durable state, validate TLS, and bind the externally reachable listener. */
+	async start() {
+		if (this.started || this.server !== void 0) throw new Error("mobile-access gateway cannot be started twice");
+		this.started = true;
+		await this.access.initialize();
+		try {
+			const handler = (request, response) => {
+				this.handleExternalRequest(request, response).catch((error) => {
+					const mapped = mapError(error);
+					if (response.headersSent) response.destroy();
+					else sendFailure(response, mapped.status, mapped.code, this.tlsEnabled);
+				});
+			};
+			const server = this.tlsEnabled ? createServer$1(await tlsOptions(this.config), handler) : createServer({ maxHeaderSize: MAX_HEADER_BYTES }, handler);
+			this.server = server;
+			server.maxHeadersCount = 64;
+			server.maxConnections = this.config.maxConnections;
+			server.headersTimeout = 1e4;
+			server.requestTimeout = this.config.upstreamTimeoutMs;
+			server.keepAliveTimeout = 5e3;
+			server.on("connection", (socket) => {
+				if (this.connectedSockets.size >= this.config.maxConnections) {
+					socket.destroy();
+					return;
+				}
+				this.connectedSockets.add(socket);
+				socket.once("close", () => {
+					this.connectedSockets.delete(socket);
+				});
+			});
+			server.on("connect", (_request, socket) => {
+				socket.destroy();
+			});
+			server.on("upgrade", (request, socket, head) => {
+				this.handleUpgrade(request, socket, head).catch((error) => {
+					const mapped = mapError(error);
+					rejectUpgrade(socket, mapped.status, mapped.code);
+				});
+			});
+			server.on("clientError", (_error, socket) => {
+				rejectUpgrade(socket, 400, "bad_request");
+			});
+			await new Promise((resolve, reject) => {
+				const failed = (error) => {
+					reject(error);
+				};
+				server.once("error", failed);
+				server.listen(this.config.listenPort, this.config.listenHost, () => {
+					server.off("error", failed);
+					resolve();
+				});
+			});
+			const address = server.address();
+			if (address === null || typeof address === "string") throw new Error("gateway listener has no TCP address");
+			this.listenerPort = address.port;
+			this.policy = new RequestTrustPolicy(this.config.authorities, address.port, this.config.allowedCidrs, this.tlsEnabled);
+		} catch (error) {
+			await this.closeFailedStart();
+			throw error;
+		}
+	}
+	async closeFailedStart() {
+		for (const socket of this.connectedSockets) socket.destroy();
+		const server = this.server;
+		this.server = void 0;
+		if (server?.listening === true) await new Promise((resolve) => {
+			server.close(() => resolve());
+		});
+		await this.access.close();
+	}
+	/** Actual bound address, available after start and safe for loopback status output. */
+	address() {
+		if (this.listenerPort === void 0 || this.policy === void 0) throw new Error("gateway is not listening");
+		const origin = this.policy.origins.values().next().value;
+		if (origin === void 0) throw new Error("gateway has no public authority");
+		return Object.freeze({
+			host: this.config.listenHost,
+			port: this.listenerPort,
+			origin
+		});
+	}
+	requirePolicy() {
+		if (this.policy === void 0 || this.closing) throw new HttpError(503, "unavailable");
+		return this.policy;
+	}
+	authorize(request) {
+		const sessionToken = requestCookies(request).get(SESSION_COOKIE);
+		if (sessionToken === void 0) throw new HttpError(401, "authentication_failed");
+		return this.access.authorizeSession(sessionToken);
+	}
+	requireCsrf(request, authorization) {
+		const value = headerValue(request.headers, CSRF_HEADER);
+		this.access.assertCsrf(authorization, value);
+	}
+	setSessionCookies(response, result, now) {
+		const maxAge = (result.sessionExpiresAt - now) / 1e3;
+		response.setHeader("Set-Cookie", [cookie(SESSION_COOKIE, result.sessionToken, {
+			tls: this.tlsEnabled,
+			httpOnly: true,
+			path: "/",
+			maxAgeSeconds: maxAge
+		}), cookie(CSRF_COOKIE, result.csrfToken, {
+			tls: this.tlsEnabled,
+			httpOnly: false,
+			path: "/",
+			maxAgeSeconds: maxAge
+		})]);
+	}
+	async handlePair(request, response) {
+		const body = await readJsonObject(request, MAX_CONTROL_BODY_BYTES);
+		if (typeof body.token !== "string" || body.label !== void 0 && typeof body.label !== "string") throw new HttpError(400, "bad_request");
+		const result = await this.access.pair(request.socket.remoteAddress ?? "unknown", body.token, body.label);
+		const now = Date.now();
+		this.setSessionCookies(response, result, now);
+		const sessionCookies = response.getHeader("Set-Cookie");
+		response.setHeader("Set-Cookie", [...sessionCookies, cookie(DEVICE_COOKIE, result.deviceToken, {
+			tls: this.tlsEnabled,
+			httpOnly: true,
+			path: "/mobile-access/auth/renew",
+			maxAgeSeconds: (result.deviceExpiresAt - now) / 1e3
+		})]);
+		sendJson(response, 201, {
+			paired: true,
+			deviceId: result.deviceId,
+			csrfToken: result.csrfToken,
+			sessionExpiresAt: result.sessionExpiresAt
+		}, this.tlsEnabled);
+	}
+	async handleRenew(request, response) {
+		if (!this.renewLimiter.take(request.socket.remoteAddress ?? "unknown", Date.now())) throw new HttpError(429, "rate_limited");
+		await readJsonObject(request, MAX_CONTROL_BODY_BYTES);
+		const deviceToken = requestCookies(request).get(DEVICE_COOKIE);
+		if (deviceToken === void 0) throw new HttpError(401, "authentication_failed");
+		let result;
+		try {
+			result = await this.access.renew(deviceToken);
+		} catch (error) {
+			if (error instanceof AccessError && error.status === 401) response.setHeader("Set-Cookie", cookie(DEVICE_COOKIE, "", {
+				tls: this.tlsEnabled,
+				httpOnly: true,
+				path: "/mobile-access/auth/renew",
+				maxAgeSeconds: 0
+			}));
+			throw error;
+		}
+		this.setSessionCookies(response, result, Date.now());
+		sendJson(response, 200, {
+			renewed: true,
+			deviceId: result.deviceId,
+			csrfToken: result.csrfToken,
+			sessionExpiresAt: result.sessionExpiresAt
+		}, this.tlsEnabled);
+	}
+	async handleLogout(request, response) {
+		await readJsonObject(request, MAX_CONTROL_BODY_BYTES);
+		const authorization = this.authorize(request);
+		this.requireCsrf(request, authorization);
+		this.access.logout(authorization);
+		response.setHeader("Set-Cookie", [cookie(SESSION_COOKIE, "", {
+			tls: this.tlsEnabled,
+			httpOnly: true,
+			path: "/",
+			maxAgeSeconds: 0
+		}), cookie(CSRF_COOKIE, "", {
+			tls: this.tlsEnabled,
+			httpOnly: false,
+			path: "/",
+			maxAgeSeconds: 0
+		})]);
+		sendJson(response, 200, { loggedOut: true }, this.tlsEnabled);
+	}
+	async handleExternalRequest(request, response) {
+		const target = parseRequestTarget(request.url);
+		assertExternalTrust(request, this.requirePolicy(), request.method !== "GET" && request.method !== "HEAD");
+		if (target.decodedPathname === "/api/mobile-access" || target.decodedPathname.startsWith(`/api/mobile-access/`)) throw new HttpError(404, "not_found");
+		if (request.method === "TRACE" || request.method === "CONNECT") throw new HttpError(405, "method_not_allowed");
+		if (target.search === "" && request.method === "GET" && target.decodedPathname === `/mobile-access/health`) {
+			sendJson(response, 200, { ok: true }, this.tlsEnabled);
+			return;
+		}
+		if (target.search === "" && request.method === "GET" && (target.decodedPathname === `/mobile-access/pair` || target.decodedPathname === `/mobile-access/pair.js`)) {
+			if (!this.access.pairingStatus().open) throw new HttpError(404, "not_found");
+			setSecurityHeaders(response, this.tlsEnabled);
+			const body = target.decodedPathname.endsWith(".js") ? PAIR_SCRIPT : PAIR_PAGE;
+			response.writeHead(200, {
+				"Content-Type": target.decodedPathname.endsWith(".js") ? "text/javascript; charset=utf-8" : "text/html; charset=utf-8",
+				"Content-Length": Buffer.byteLength(body)
+			});
+			response.end(body);
+			return;
+		}
+		if (request.method === "GET" && (target.decodedPathname === `/mobile-access/login` || target.decodedPathname === `/mobile-access/login.js`)) {
+			if (target.decodedPathname.endsWith(".js") && target.search !== "") throw new HttpError(400, "bad_request");
+			setSecurityHeaders(response, this.tlsEnabled);
+			const body = target.decodedPathname.endsWith(".js") ? LOGIN_SCRIPT : LOGIN_PAGE;
+			response.writeHead(200, {
+				"Content-Type": target.decodedPathname.endsWith(".js") ? "text/javascript; charset=utf-8" : "text/html; charset=utf-8",
+				"Content-Length": Buffer.byteLength(body)
+			});
+			response.end(body);
+			return;
+		}
+		if (target.search === "" && request.method === "POST" && target.decodedPathname === `/mobile-access/auth/pair`) {
+			await this.handlePair(request, response);
+			return;
+		}
+		if (target.search === "" && request.method === "POST" && target.decodedPathname === `/mobile-access/auth/renew`) {
+			await this.handleRenew(request, response);
+			return;
+		}
+		if (target.search === "" && request.method === "POST" && target.decodedPathname === `/mobile-access/auth/logout`) {
+			await this.handleLogout(request, response);
+			return;
+		}
+		const customCss = target.search === "" && request.method === "GET" && target.decodedPathname === `/mobile-access/custom.css`;
+		if (!customCss && (target.decodedPathname === "/mobile-access" || target.decodedPathname.startsWith(`/mobile-access/`))) throw new HttpError(404, "not_found");
+		if (request.method !== "GET" && request.method !== "HEAD" && request.method !== "POST") throw new HttpError(405, "method_not_allowed");
+		if (request.method === "POST" && target.decodedPathname !== "/api" && !target.decodedPathname.startsWith("/api/")) throw new HttpError(405, "method_not_allowed");
+		let authorization;
+		try {
+			authorization = this.authorize(request);
+		} catch (error) {
+			const mapped = mapError(error);
+			const acceptsHtml = request.headers.accept?.split(",").some((value) => value.trim().split(";", 1)[0] === "text/html") ?? false;
+			const topLevel = request.method === "GET" && acceptsHtml && (request.headers["sec-fetch-dest"] === void 0 || request.headers["sec-fetch-dest"] === "document") && target.decodedPathname !== "/api" && !target.decodedPathname.startsWith("/api/");
+			if (mapped.status === 401 && topLevel) {
+				const returnPath = target.raw.length <= 2048 ? target.raw : "/";
+				setSecurityHeaders(response, this.tlsEnabled);
+				response.writeHead(302, {
+					Location: `${AUTH_PREFIX}/login?return=${encodeURIComponent(returnPath)}`,
+					"Content-Length": 0
+				});
+				response.end();
+				return;
+			}
+			throw error;
+		}
+		if (customCss) {
+			let body;
+			try {
+				body = await readFile(this.config.customCssFile);
+			} catch (error) {
+				if (error.code !== "ENOENT") throw error;
+				body = Buffer.from("/* Add mobile overrides in the DSH home mobile-access/mobile.css file. */\n");
+			}
+			if (body.byteLength > 262144) throw new HttpError(413, "payload_too_large");
+			setSecurityHeaders(response, this.tlsEnabled);
+			response.writeHead(200, {
+				"Content-Type": "text/css; charset=utf-8",
+				"Content-Length": body.byteLength
+			});
+			response.end(body);
+			return;
+		}
+		await this.proxyHttp(request, response, authorization);
+	}
+	allocateRequest(authorization, response, upstream) {
+		if (this.activeRequests.size >= this.config.maxActiveRequests) throw new HttpError(429, "busy");
+		const id = this.nextOperationId++;
+		const abort = () => {
+			upstream.request?.destroy();
+			if (!response.destroyed) response.destroy();
+		};
+		const timer = setTimeout(abort, Math.max(1, authorization.expiresAt - Date.now()));
+		timer.unref();
+		this.activeRequests.set(id, Object.freeze({
+			...authorization,
+			abort,
+			timer
+		}));
+		return {
+			id,
+			release: () => {
+				const entry = this.activeRequests.get(id);
+				if (entry !== void 0) clearTimeout(entry.timer);
+				this.activeRequests.delete(id);
+			}
+		};
+	}
+	async proxyHttp(request$1, response, authorization) {
+		const declared = request$1.headers["content-length"];
+		if (declared !== void 0 && (!/^\d+$/u.test(declared) || Number(declared) > this.config.maxBodyBytes)) throw new HttpError(413, "payload_too_large");
+		const holder = {};
+		const operation = this.allocateRequest(authorization, response, holder);
+		let bodyDone;
+		try {
+			const proxied = await new Promise((resolve, reject) => {
+				const upstreamRequest = request({
+					protocol: "http:",
+					hostname: stripIpv6Brackets(this.config.upstreamOrigin.hostname),
+					port: Number(this.config.upstreamOrigin.port),
+					method: request$1.method,
+					path: request$1.url,
+					headers: sanitizeRequestHeaders(request$1, this.config.upstreamOrigin),
+					agent: false
+				});
+				holder.request = upstreamRequest;
+				upstreamRequest.setTimeout(this.config.upstreamTimeoutMs, () => {
+					upstreamRequest.destroy(/* @__PURE__ */ new Error("upstream timeout"));
+				});
+				upstreamRequest.once("response", resolve);
+				upstreamRequest.once("error", reject);
+				bodyDone = pipeline(request$1, new ByteLimitTransform(this.config.maxBodyBytes), upstreamRequest);
+				bodyDone.catch(reject);
+			});
+			setSecurityHeaders(response, this.tlsEnabled);
+			response.writeHead(proxied.statusCode ?? 502, sanitizeResponseHeaders(proxied.headers, this.config.upstreamOrigin));
+			await Promise.all([bodyDone, pipeline(proxied, response)]);
+		} catch (error) {
+			holder.request?.destroy();
+			await bodyDone?.catch(() => void 0);
+			if (error instanceof HttpError) throw error;
+			if (response.headersSent) response.destroy();
+			else throw new HttpError(502, "upstream_unavailable");
+		} finally {
+			operation.release();
+		}
+	}
+	abortSessionResources(sessionKey) {
+		for (const request of this.activeRequests.values()) if (request.sessionKey === sessionKey) request.abort();
+		for (const socket of this.activeWebSockets.values()) if (socket.sessionKey === sessionKey) {
+			socket.client.destroy();
+			socket.upstream.destroy();
+		}
+	}
+	async readUpgradeResponse(upstream, expectedAccept) {
+		return new Promise((resolve, reject) => {
+			let buffer = Buffer.alloc(0);
+			const failed = (error) => {
+				cleanup();
+				reject(error);
+			};
+			const closed = () => {
+				cleanup();
+				reject(/* @__PURE__ */ new Error("upstream closed during WebSocket handshake"));
+			};
+			const data = (chunk) => {
+				buffer = Buffer.concat([buffer, chunk]);
+				if (buffer.length > MAX_HEADER_BYTES) {
+					failed(/* @__PURE__ */ new Error("upstream WebSocket headers are too large"));
+					return;
+				}
+				const end = buffer.indexOf("\r\n\r\n");
+				if (end < 0) return;
+				cleanup();
+				const lines = buffer.subarray(0, end).toString("latin1").split("\r\n");
+				if (lines.shift() !== "HTTP/1.1 101 Switching Protocols") {
+					reject(/* @__PURE__ */ new Error("upstream refused WebSocket upgrade"));
+					return;
+				}
+				const selected = /* @__PURE__ */ new Map();
+				for (const line of lines) {
+					const colon = line.indexOf(":");
+					if (colon <= 0) {
+						reject(/* @__PURE__ */ new Error("upstream returned malformed WebSocket headers"));
+						return;
+					}
+					const name = line.slice(0, colon).trim().toLowerCase();
+					const value = line.slice(colon + 1).trim();
+					if (selected.has(name)) {
+						reject(/* @__PURE__ */ new Error("upstream returned duplicate WebSocket headers"));
+						return;
+					}
+					selected.set(name, value);
+				}
+				if (selected.get("upgrade")?.toLowerCase() !== "websocket" || !hasToken(selected.get("connection"), "upgrade") || selected.get("sec-websocket-accept") !== expectedAccept) {
+					reject(/* @__PURE__ */ new Error("upstream returned an invalid WebSocket handshake"));
+					return;
+				}
+				const output = [
+					"HTTP/1.1 101 Switching Protocols",
+					"Upgrade: websocket",
+					"Connection: Upgrade",
+					`Sec-WebSocket-Accept: ${expectedAccept}`
+				];
+				const protocol = selected.get("sec-websocket-protocol");
+				const extensions = selected.get("sec-websocket-extensions");
+				if (protocol !== void 0) output.push(`Sec-WebSocket-Protocol: ${protocol}`);
+				if (extensions !== void 0) output.push(`Sec-WebSocket-Extensions: ${extensions}`);
+				output.push("Referrer-Policy: no-referrer", "X-Content-Type-Options: nosniff", "", "");
+				resolve({
+					header: output.join("\r\n"),
+					remainder: buffer.subarray(end + 4)
+				});
+			};
+			const cleanup = () => {
+				upstream.off("data", data);
+				upstream.off("error", failed);
+				upstream.off("close", closed);
+			};
+			upstream.on("data", data);
+			upstream.once("error", failed);
+			upstream.once("close", closed);
+		});
+	}
+	async handleUpgrade(request, client, head) {
+		const target = parseRequestTarget(request.url);
+		assertExternalTrust(request, this.requirePolicy(), true);
+		if (target.search !== "" || !WS_PATHS.has(target.decodedPathname)) throw new HttpError(404, "not_found");
+		if (request.method !== "GET" || headerValue(request.headers, "upgrade")?.toLowerCase() !== "websocket" || !hasToken(headerValue(request.headers, "connection"), "upgrade")) throw new HttpError(400, "bad_request");
+		const key = headerValue(request.headers, "sec-websocket-key");
+		if (key === void 0 || headerValue(request.headers, "sec-websocket-version") !== "13") throw new HttpError(400, "bad_request");
+		let decodedKey;
+		try {
+			decodedKey = Buffer.from(key, "base64");
+		} catch {
+			throw new HttpError(400, "bad_request");
+		}
+		if (decodedKey.length !== 16 || decodedKey.toString("base64") !== key) throw new HttpError(400, "bad_request");
+		const authorization = this.authorize(request);
+		if (this.activeWebSockets.size >= this.config.maxWebSockets) throw new HttpError(429, "busy");
+		const upstream = connect({
+			host: stripIpv6Brackets(this.config.upstreamOrigin.hostname),
+			port: Number(this.config.upstreamOrigin.port)
+		});
+		client.pause();
+		const id = this.nextOperationId++;
+		const closeBoth = () => {
+			client.destroy();
+			upstream.destroy();
+		};
+		const timer = setTimeout(closeBoth, Math.max(1, authorization.expiresAt - Date.now()));
+		timer.unref();
+		const record = Object.freeze({
+			...authorization,
+			client,
+			upstream,
+			timer
+		});
+		this.activeWebSockets.set(id, record);
+		const cleanup = () => {
+			const active = this.activeWebSockets.get(id);
+			if (active !== void 0) clearTimeout(active.timer);
+			this.activeWebSockets.delete(id);
+		};
+		client.once("close", () => {
+			upstream.destroy();
+			cleanup();
+		});
+		upstream.once("close", () => {
+			client.destroy();
+			cleanup();
+		});
+		upstream.setTimeout(this.config.upstreamTimeoutMs, closeBoth);
+		try {
+			await new Promise((resolve, reject) => {
+				upstream.once("connect", resolve);
+				upstream.once("error", reject);
+			});
+			const requestLines = [
+				`GET ${target.raw} HTTP/1.1`,
+				`Host: ${this.config.upstreamOrigin.host}`,
+				"Upgrade: websocket",
+				"Connection: Upgrade",
+				`Origin: ${this.config.upstreamOrigin.origin}`,
+				"Sec-Fetch-Site: same-origin",
+				`Sec-WebSocket-Key: ${key}`,
+				"Sec-WebSocket-Version: 13"
+			];
+			const protocol = headerValue(request.headers, "sec-websocket-protocol");
+			const extensions = headerValue(request.headers, "sec-websocket-extensions");
+			if (protocol !== void 0) requestLines.push(`Sec-WebSocket-Protocol: ${protocol}`);
+			if (extensions !== void 0) requestLines.push(`Sec-WebSocket-Extensions: ${extensions}`);
+			requestLines.push("", "");
+			upstream.write(requestLines.join("\r\n"));
+			if (head.length > 0) upstream.write(head);
+			const handshake = await this.readUpgradeResponse(upstream, websocketAccept(key));
+			upstream.setTimeout(0);
+			client.write(handshake.header);
+			if (handshake.remainder.length > 0) client.write(handshake.remainder);
+			upstream.pipe(client);
+			client.pipe(upstream);
+			client.resume();
+		} catch (error) {
+			closeBoth();
+			if (error instanceof HttpError) throw error;
+			throw new HttpError(502, "upstream_unavailable");
+		}
+	}
+	/** Loopback-only DSH WebServer route for opening pairing and managing devices. */
+	localAdminRoute() {
+		return {
+			kind: "prefix",
+			path: LOCAL_ADMIN_PREFIX,
+			handler: async (request, response) => {
+				try {
+					const target = parseRequestTarget(request.url);
+					assertLocalAdminTrust(request, request.method === "POST");
+					if (target.search !== "") throw new HttpError(400, "bad_request");
+					if (request.method === "GET" && target.decodedPathname === `/api/mobile-access/status`) {
+						sendJson(response, 200, {
+							gateway: this.address(),
+							pairing: this.access.pairingStatus(),
+							deviceCount: this.access.listDevices().length,
+							resources: {
+								connections: this.connectedSockets.size,
+								activeRequests: this.activeRequests.size,
+								webSockets: this.activeWebSockets.size
+							}
+						}, false);
+						return;
+					}
+					if (request.method === "GET" && target.decodedPathname === `/api/mobile-access/devices`) {
+						sendJson(response, 200, { devices: this.access.listDevices() }, false);
+						return;
+					}
+					if (request.method === "POST" && target.decodedPathname === `/api/mobile-access/pairing/open`) {
+						const body = await readJsonObject(request, MAX_CONTROL_BODY_BYTES);
+						if (body.ttlMs !== void 0 && typeof body.ttlMs !== "number") throw new HttpError(400, "bad_request");
+						const opened = await this.access.openPairing(body.ttlMs);
+						sendJson(response, 201, {
+							...opened,
+							pairUrl: `${this.address().origin}/mobile-access/pair#token=${opened.token}`
+						}, false);
+						return;
+					}
+					if (request.method === "POST" && target.decodedPathname === `/api/mobile-access/devices/revoke`) {
+						const body = await readJsonObject(request, MAX_CONTROL_BODY_BYTES);
+						if (typeof body.deviceId !== "string" || !/^[a-f\d]{32}$/u.test(body.deviceId)) throw new HttpError(400, "bad_request");
+						if (!await this.access.revokeDevice(body.deviceId)) throw new HttpError(404, "not_found");
+						sendJson(response, 200, { revoked: true }, false);
+						return;
+					}
+					if (request.method === "POST" && target.decodedPathname === `/api/mobile-access/devices/reset`) {
+						if ((await readJsonObject(request, MAX_CONTROL_BODY_BYTES)).confirm !== true) throw new HttpError(400, "bad_request");
+						await this.access.resetDevices();
+						sendJson(response, 200, { reset: true }, false);
+						return;
+					}
+					throw new HttpError(404, "not_found");
+				} catch (error) {
+					const mapped = mapError(error);
+					if (response.headersSent) response.destroy();
+					else sendFailure(response, mapped.status, mapped.code, false);
+				}
+			}
+		};
+	}
+	/** Close listeners and abort all accepted work before resolving teardown. */
+	async close() {
+		if (this.closeTask !== void 0) return this.closeTask;
+		this.closeTask = this.performClose();
+		return this.closeTask;
+	}
+	async performClose() {
+		this.closing = true;
+		this.removeSessionListener();
+		const accessClose = this.access.close();
+		for (const request of this.activeRequests.values()) request.abort();
+		for (const websocket of this.activeWebSockets.values()) {
+			websocket.client.destroy();
+			websocket.upstream.destroy();
+		}
+		for (const socket of this.connectedSockets) socket.destroy();
+		const server = this.server;
+		this.server = void 0;
+		if (server !== void 0 && server.listening) {
+			server.closeAllConnections();
+			await new Promise((resolve) => {
+				server.close(() => resolve());
+			});
+		}
+		await accessClose;
+		this.activeRequests.clear();
+		this.activeWebSockets.clear();
+		this.connectedSockets.clear();
+		this.policy = void 0;
+		this.listenerPort = void 0;
+	}
+	/** Safe metadata helper for direct loopback integrations. */
+	devices() {
+		return this.access.listDevices();
+	}
+};
+//#endregion
+//#region src/storage.ts
+function assertInteger(value, name) {
+	if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0) throw new Error(`device state ${name} must be a non-negative integer`);
+}
+function parseDevice(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error("device state contains an invalid device");
+	const record = value;
+	if (typeof record.id !== "string" || !/^[a-f\d]{32}$/u.test(record.id)) throw new Error("device state contains an invalid id");
+	if (typeof record.label !== "string" || record.label.length < 1 || record.label.length > 64 || /[\u0000-\u001f\u007f]/u.test(record.label)) throw new Error("device state contains an invalid label");
+	if (typeof record.tokenDigest !== "string" || !/^[a-f\d]{64}$/u.test(record.tokenDigest)) throw new Error("device state contains an invalid credential digest");
+	assertInteger(record.createdAt, "createdAt");
+	assertInteger(record.expiresAt, "expiresAt");
+	assertInteger(record.lastSeenAt, "lastSeenAt");
+	if (record.revokedAt !== void 0) assertInteger(record.revokedAt, "revokedAt");
+	if (record.expiresAt <= record.createdAt || record.lastSeenAt < record.createdAt) throw new Error("device state contains inconsistent timestamps");
+	return Object.freeze({
+		id: record.id,
+		label: record.label,
+		tokenDigest: record.tokenDigest,
+		createdAt: record.createdAt,
+		expiresAt: record.expiresAt,
+		lastSeenAt: record.lastSeenAt,
+		...record.revokedAt === void 0 ? {} : { revokedAt: record.revokedAt }
+	});
+}
+/** Validate durable data before it can authorize a device. */
+function parseDeviceSnapshot(value, maximumDevices = 256) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error("device state must be an object");
+	const snapshot = value;
+	if (snapshot.version !== 1 || !Array.isArray(snapshot.devices) || snapshot.devices.length > maximumDevices) throw new Error("device state has an unsupported version or device count");
+	const devices = snapshot.devices.map(parseDevice);
+	if (new Set(devices.map((device) => device.id)).size !== devices.length || new Set(devices.map((device) => device.tokenDigest)).size !== devices.length) throw new Error("device state contains duplicate device identities");
+	return Object.freeze({
+		version: 1,
+		devices: Object.freeze(devices)
+	});
+}
+/** Atomic JSON implementation with symlink refusal and owner-only file creation. */
+var JsonDeviceStore = class {
+	file;
+	maximumDevices;
+	constructor(file, maximumDevices = 256) {
+		this.file = file;
+		this.maximumDevices = maximumDevices;
+	}
+	async load() {
+		let stat;
+		try {
+			stat = await lstat(this.file);
+		} catch (error) {
+			if (error.code === "ENOENT") return Object.freeze({
+				version: 1,
+				devices: Object.freeze([])
+			});
+			throw error;
+		}
+		if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 1048576) throw new Error("device state must be a regular file no larger than 1 MiB");
+		let parsed;
+		try {
+			parsed = JSON.parse(await readFile(this.file, "utf8"));
+		} catch (error) {
+			throw new Error("device state is not valid JSON", { cause: error });
+		}
+		return parseDeviceSnapshot(parsed, this.maximumDevices);
+	}
+	async save(snapshot) {
+		const validated = parseDeviceSnapshot(snapshot, this.maximumDevices);
+		const directory = dirname(this.file);
+		await mkdir(directory, {
+			recursive: true,
+			mode: 448
+		});
+		try {
+			const current = await lstat(this.file);
+			if (!current.isFile() || current.isSymbolicLink()) throw new Error("device state target must remain a regular file");
+		} catch (error) {
+			if (error.code !== "ENOENT") throw error;
+		}
+		const temporary = join(directory, `.${basename(this.file)}.${randomBytes(12).toString("hex")}.tmp`);
+		try {
+			await writeFile(temporary, `${JSON.stringify(validated)}\n`, {
+				encoding: "utf8",
+				flag: "wx",
+				mode: 384
+			});
+			await rename(temporary, this.file);
+			await chmod(this.file, 384);
+		} catch (error) {
+			try {
+				await rm(temporary, { force: true });
+			} catch (cleanupError) {
+				throw new AggregateError([error, cleanupError], "device state write and temporary cleanup both failed");
+			}
+			throw error;
+		}
+	}
+};
+/** In-memory store useful for embedding and deterministic tests. */
+var MemoryDeviceStore = class {
+	snapshot;
+	constructor(initial = {
+		version: 1,
+		devices: []
+	}) {
+		this.snapshot = parseDeviceSnapshot(initial);
+	}
+	async load() {
+		return structuredClone(this.snapshot);
+	}
+	async save(snapshot) {
+		this.snapshot = structuredClone(parseDeviceSnapshot(snapshot));
+	}
+	/** Return a defensive copy for assertions or administrative export. */
+	inspect() {
+		return structuredClone(this.snapshot);
+	}
+};
+//#endregion
+//#region src/plugin.ts
+/** Stable Cordis plugin name. */
+const name = "dsh-mobile";
+/** The stock WebServer is the only DSH Host service this plugin requires. */
+const inject = ["webServer"];
+function mapAdminError(error) {
+	return error instanceof HttpError ? error : new HttpError(500, "internal_error");
+}
+const SETUP_KEYS = /* @__PURE__ */ new Set([
+	"version",
+	"publicOrigin",
+	"listenHost",
+	"listenPort",
+	"upstreamOrigin",
+	"publicAuthorities",
+	"allowedCidrs",
+	"tls"
+]);
+async function loadSetup(config) {
+	if (config.setupFile === void 0) return config;
+	if (!isAbsolute(config.setupFile)) throw new Error("setupFile must be an absolute file path");
+	let source;
+	try {
+		source = await readFile(resolve(config.setupFile), "utf8");
+	} catch (error) {
+		if (error.code === "ENOENT") return config;
+		throw error;
+	}
+	let parsed;
+	try {
+		parsed = JSON.parse(source);
+	} catch (error) {
+		throw new Error("mobile setup file is not valid JSON", { cause: error });
+	}
+	if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error("mobile setup file must be an object");
+	const record = parsed;
+	if (record.version !== 1 || Reflect.ownKeys(record).some((key) => typeof key !== "string" || !SETUP_KEYS.has(key))) throw new Error("mobile setup file has an unsupported format");
+	const { version: _version, ...setup } = record;
+	const merged = { ...config };
+	for (const key of SETUP_KEYS) if (key !== "version") delete merged[key];
+	return {
+		...merged,
+		...setup
+	};
+}
+/** Mount the resident control route and its optional authenticated LAN gateway. */
+async function apply(ctx, config) {
+	const resolved = parseGatewayConfig(await loadSetup(config));
+	let gateway;
+	const controller = new MobileAccessGatewayController(new JsonMobileAccessControlStore(parseControlFile(config.controlFile), config.initiallyEnabled), async () => {
+		const candidate = new MobileAccessGateway(resolved, new JsonDeviceStore(resolved.stateFile, resolved.maxDevices));
+		await candidate.start();
+		gateway = candidate;
+		return { close: async () => {
+			if (gateway === candidate) gateway = void 0;
+			await candidate.close();
+		} };
+	});
+	const adminRoute = {
+		kind: "prefix",
+		path: LOCAL_ADMIN_PREFIX,
+		handler: async (request, response) => {
+			try {
+				const target = parseRequestTarget(request.url);
+				assertLocalAdminTrust(request, request.method === "POST");
+				if (target.search !== "") throw new HttpError(400, "bad_request");
+				if (request.method === "GET" && target.decodedPathname === `/api/mobile-access/control`) {
+					sendJson(response, 200, {
+						running: controller.isRunning(),
+						origin: gateway?.address().origin
+					}, false);
+					return;
+				}
+				if (request.method === "POST" && target.decodedPathname === `/api/mobile-access/control`) {
+					const body = await readJsonObject(request, 4096);
+					if (typeof body.running !== "boolean") throw new HttpError(400, "bad_request");
+					await controller.setRunning(body.running);
+					sendJson(response, 200, {
+						running: controller.isRunning(),
+						origin: gateway?.address().origin
+					}, false);
+					return;
+				}
+				const active = gateway;
+				if (active === void 0) throw new HttpError(409, "gateway_stopped");
+				await active.localAdminRoute().handler(request, response);
+			} catch (error) {
+				const mapped = mapAdminError(error);
+				if (response.headersSent) response.destroy();
+				else sendFailure(response, mapped.status, mapped.code, false);
+			}
+		}
+	};
+	await ctx.effect(async () => {
+		const unregister = ctx.webServer.register(adminRoute);
+		try {
+			await controller.initialize();
+		} catch (error) {
+			unregister();
+			throw error;
+		}
+		return async () => {
+			unregister();
+			await controller.close();
+		};
+	}, "dsh-mobile: local control and authenticated LAN gateway");
+}
+//#endregion
+export { AUTH_PREFIX, AccessController, AccessError, BoundedRateLimiter, CSRF_COOKIE, CSRF_HEADER, Config, DEVICE_COOKIE, JsonDeviceStore, JsonMobileAccessControlStore, LOCAL_ADMIN_PREFIX, MemoryDeviceStore, MobileAccessGateway, MobileAccessGatewayController, RequestTrustPolicy, SESSION_COOKIE, WS_PATHS, addressAllowed, apply, inject, isLoopbackAddress, name, parseAuthority, parseCidr, parseControlFile, parseDeviceSnapshot, parseGatewayConfig, parseMobileAccessControlState, resolveAuthority };
+
+//# sourceMappingURL=index.mjs.map