dsh-mobile 0.1.0-alpha.2 → 0.1.0-alpha.3

package/README.md

@@ -61,9 +61,9 @@ pnpm dsh plugin --profile web exec dsh-mobile setup
 pnpm dsh --profile web
 ```
 
-Both paths install the public npm package into stock DSH without patching its source. Setup selects the LAN address, creates the local TLS certificate, and stores plugin data under `$DSH_HOME/mobile-access/`; run `dsh-mobile setup --help` through the same `plugin exec` command for manual network options.
+Both paths install the public npm package into stock DSH without patching its source. Setup remembers the selected LAN interface, creates one local CA, and stores plugin data under `$DSH_HOME/mobile-access/`; run `dsh-mobile setup --help` through the same `plugin exec` command for manual network options. When DHCP changes that interface's IP, the plugin follows the new address and signs a matching server certificate from the same CA on the next DSH start.
 
-1. Copy the generated `dsh-mobile-ca.cer` to Android and install it as a user CA certificate.
+1. Copy the generated `dsh-mobile-ca.cer` to Android and install it once as a user CA certificate.
 2. Open the Mobile card in the lower-left corner of the desktop DSH UI.
 3. Start access and create a pairing link. The link is copied to the clipboard.
 4. Paste the link into the Android app, or open it directly in a mobile browser.
@@ -162,7 +162,7 @@ flowchart LR
 ## Security model
 
 - The gateway accepts only the selected private LAN CIDR, exact Host, and same-origin browser requests.
-- The Android app never bypasses TLS validation. The certificate must cover the LAN address in use.
+- The Android app never bypasses TLS validation. The stable local CA signs a server certificate for the selected interface's current LAN address at each DSH start.
 - Pairing creates an HttpOnly session; devices and active sessions can be revoked from the computer.
 - Control and device-management routes are loopback-only.
 - Authentication happens before any request reaches the stock DSH loopback server. DSH itself is never rebound to `0.0.0.0`.

package/README.zh.md

@@ -61,9 +61,9 @@ pnpm dsh plugin --profile web exec dsh-mobile setup
 pnpm dsh --profile web
 ```
 
-两种方式都会把公开 npm 包安装到原生 DSH，不修改 DSH 源码。设置向导会选择局域网地址、生成本地 TLS 证书，并把插件数据保存到 `$DSH_HOME/mobile-access/`；需要手动指定网卡或端口时，通过同一个 `plugin exec` 命令运行 `dsh-mobile setup --help`。
+两种方式都会把公开 npm 包安装到原生 DSH，不修改 DSH 源码。设置向导会记住所选局域网网卡、生成一份稳定的本地 CA，并把插件数据保存到 `$DSH_HOME/mobile-access/`；需要手动指定网卡或端口时，通过同一个 `plugin exec` 命令运行 `dsh-mobile setup --help`。DHCP 改变该网卡的 IP 后，插件会在下次启动 DSH 时跟随新地址，并用同一 CA 自动签发匹配的服务器证书。
 
-1. 将向导输出的 `dsh-mobile-ca.cer` 复制到 Android，并在系统设置中安装为用户 CA 证书。
+1. 将向导输出的 `dsh-mobile-ca.cer` 复制到 Android，并在系统设置中一次性安装为用户 CA 证书。
 2. 在电脑 DSH 左下角打开“移动端”卡片。
 3. 确认服务已开启，点击“生成配对链接”。链接会复制到剪贴板。
 4. 在 Android App 中粘贴链接，或直接在手机浏览器中打开链接。
@@ -167,7 +167,7 @@ flowchart LR
 ## 安全模型
 
 - 网关只接受设置向导选定的私有局域网 CIDR、精确 Host 和同源浏览器请求。
-- Android App 不跳过 TLS 校验；证书必须覆盖实际访问的局域网 IP。
+- Android App 不跳过 TLS 校验；稳定的本地 CA 会在每次 DSH 启动时为所选网卡的当前局域网地址签发服务器证书。
 - 配对设备获得短期 HttpOnly Session，设备和会话都可在电脑端撤销。
 - 管理接口只允许从电脑回环地址访问，移动端无法打开、关闭网关或管理其他设备。
 - 外层网关在认证后才代理到原生 DSH 的回环端口，不会把 DSH 自身绑定到 `0.0.0.0`。

package/lib/cli.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
-import { X509Certificate } from "node:crypto";
-import { chmod, mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import { chmod, mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
 import { homedir, networkInterfaces } from "node:os";
-import { join, resolve } from "node:path";
+import { basename, dirname, join, resolve } from "node:path";
+import { X509Certificate, createPrivateKey, createPublicKey } from "node:crypto";
 import { generate } from "selfsigned";
-//#region src/cli.ts
+//#region src/managed-setup.ts
 function privateIpv4(value) {
 	const parts = value.split(".").map(Number);
 	return parts.length === 4 && parts.every((part) => Number.isInteger(part) && part >= 0 && part <= 255) && (parts[0] === 10 || parts[0] === 172 && parts[1] >= 16 && parts[1] <= 31 || parts[0] === 192 && parts[1] === 168);
@@ -19,13 +19,157 @@ function networkCidr(address, cidr) {
 		0
 	].map((shift) => network >>> shift & 255).join(".")}/${String(prefix)}`;
 }
-function availableAddresses() {
-	const candidates = Object.values(networkInterfaces()).flatMap((entries) => entries ?? []).filter((entry) => entry.family === "IPv4" && !entry.internal && privateIpv4(entry.address) && entry.cidr !== null).map((entry) => ({
+/** List current private IPv4 candidates with their interface identity. */
+function availableLanNetworks(table = networkInterfaces()) {
+	const candidates = Object.entries(table).flatMap(([name, entries]) => (entries ?? []).filter((entry) => entry.family === "IPv4" && !entry.internal && privateIpv4(entry.address) && entry.cidr !== null).map((entry) => ({
+		name,
 		address: entry.address,
 		cidr: networkCidr(entry.address, entry.cidr)
-	}));
-	return [...new Map(candidates.map((entry) => [entry.address, entry])).values()];
+	})));
+	return [...new Map(candidates.map((entry) => [`${entry.name}\0${entry.address}`, entry])).values()];
+}
+/** Select an active LAN, optionally by address or by a previously saved interface name. */
+function selectLanNetwork(requestedAddress, requestedInterface, table) {
+	const candidates = availableLanNetworks(table);
+	if (requestedAddress !== void 0) {
+		const match = candidates.find((candidate) => candidate.address === requestedAddress);
+		if (match === void 0) throw new Error(`--address ${requestedAddress} is not an active private LAN address`);
+		return match;
+	}
+	if (requestedInterface !== void 0) {
+		const matches = candidates.filter((candidate) => candidate.name === requestedInterface);
+		if (matches.length === 1) return matches[0];
+		if (matches.length === 0) throw new Error(`saved LAN interface ${JSON.stringify(requestedInterface)} is not connected`);
+		throw new Error(`saved LAN interface ${JSON.stringify(requestedInterface)} has more than one private IPv4 address`);
+	}
+	if (candidates.length === 1) return candidates[0];
+	if (candidates.length === 0) throw new Error("no active private LAN address was found; connect to Wi-Fi or Ethernet");
+	throw new Error(`more than one LAN address is active; rerun with --address and one of: ${candidates.map((entry) => entry.address).join(", ")}`);
+}
+function assertMatchingCa(certPem, keyPem) {
+	const certificate = new X509Certificate(certPem);
+	if (!certificate.ca || certificate.subject !== certificate.issuer || !certificate.verify(certificate.publicKey)) throw new Error("managed TLS CA must be a self-signed CA certificate");
+	const privatePublic = createPublicKey(createPrivateKey(keyPem)).export({
+		format: "der",
+		type: "spki"
+	});
+	const certificatePublic = certificate.publicKey.export({
+		format: "der",
+		type: "spki"
+	});
+	if (!privatePublic.equals(certificatePublic)) throw new Error("managed TLS CA certificate and key do not match");
+	if (Date.parse(certificate.validFrom) > Date.now() || Date.parse(certificate.validTo) <= Date.now()) throw new Error("managed TLS CA certificate is not currently valid");
+	return certificate;
+}
+async function atomicWrite(file, contents) {
+	const directory = dirname(file);
+	await mkdir(directory, {
+		recursive: true,
+		mode: 448
+	});
+	const temporary = join(directory, `.${basename(file)}.${process.pid}.tmp`);
+	await writeFile(temporary, contents, { mode: 384 });
+	await chmod(temporary, 384);
+	await rename(temporary, file);
+}
+/** Create a long-lived CA or migrate the legacy self-signed server certificate as that CA. */
+async function ensureManagedCa(setup, legacy) {
+	let certPem;
+	let keyPem;
+	try {
+		[certPem, keyPem] = await Promise.all([readFile(setup.caCertFile, "utf8"), readFile(setup.caKeyFile, "utf8")]);
+	} catch (error) {
+		if (error.code !== "ENOENT") throw error;
+		let migrated = false;
+		if (legacy !== void 0) try {
+			[certPem, keyPem] = await Promise.all([readFile(legacy.certFile, "utf8"), readFile(legacy.keyFile, "utf8")]);
+			assertMatchingCa(certPem, keyPem);
+			migrated = true;
+		} catch (legacyError) {
+			if (legacyError.code !== "ENOENT") throw legacyError;
+		}
+		if (!migrated) {
+			const now = /* @__PURE__ */ new Date();
+			const notAfter = new Date(now);
+			notAfter.setFullYear(notAfter.getFullYear() + 5);
+			const generated = await generate([{
+				name: "commonName",
+				value: "DeepSeek Harness Mobile CA"
+			}], {
+				keyType: "ec",
+				curve: "P-256",
+				algorithm: "sha256",
+				notBeforeDate: /* @__PURE__ */ new Date(now.getTime() - 3e5),
+				notAfterDate: notAfter,
+				extensions: [{
+					name: "basicConstraints",
+					cA: true,
+					critical: true
+				}, {
+					name: "keyUsage",
+					digitalSignature: true,
+					keyCertSign: true,
+					cRLSign: true,
+					critical: true
+				}]
+			});
+			certPem = generated.cert;
+			keyPem = generated.private;
+		}
+		if (certPem === void 0 || keyPem === void 0) throw new Error("managed TLS CA creation did not produce key material");
+		await Promise.all([atomicWrite(setup.caCertFile, certPem), atomicWrite(setup.caKeyFile, keyPem)]);
+	}
+	if (certPem === void 0 || keyPem === void 0) throw new Error("managed TLS CA creation did not produce key material");
+	return assertMatchingCa(certPem, keyPem);
+}
+/** Sign and atomically install a server leaf for the interface's current address. */
+async function refreshManagedServerCertificate(setup, address) {
+	const [caCert, caKey] = await Promise.all([readFile(setup.tls.caCertFile, "utf8"), readFile(setup.tls.caKeyFile, "utf8")]);
+	assertMatchingCa(caCert, caKey);
+	const now = /* @__PURE__ */ new Date();
+	const notAfter = new Date(now);
+	notAfter.setDate(notAfter.getDate() + 397);
+	const server = await generate([{
+		name: "commonName",
+		value: "DeepSeek Harness Mobile"
+	}], {
+		keyType: "ec",
+		curve: "P-256",
+		algorithm: "sha256",
+		notBeforeDate: /* @__PURE__ */ new Date(now.getTime() - 3e5),
+		notAfterDate: notAfter,
+		ca: {
+			cert: caCert,
+			key: caKey
+		},
+		extensions: [
+			{
+				name: "basicConstraints",
+				cA: false,
+				critical: true
+			},
+			{
+				name: "keyUsage",
+				digitalSignature: true,
+				critical: true
+			},
+			{
+				name: "extKeyUsage",
+				serverAuth: true
+			},
+			{
+				name: "subjectAltName",
+				altNames: [{
+					type: 7,
+					ip: address
+				}]
+			}
+		]
+	});
+	await Promise.all([atomicWrite(setup.tls.certFile, server.cert), atomicWrite(setup.tls.keyFile, server.private)]);
 }
+//#endregion
+//#region src/cli.ts
 function parseOptions(args) {
 	let address;
 	let port = 3443;
@@ -52,30 +196,18 @@ function parseOptions(args) {
 	}
 	if (!Number.isSafeInteger(port) || port < 1024 || port > 65535) throw new Error("--port must be from 1024 through 65535");
 	if (!Number.isSafeInteger(dshPort) || dshPort < 1024 || dshPort > 65535) throw new Error("--dsh-port must be from 1024 through 65535");
-	if (address !== void 0 && !privateIpv4(address)) throw new Error("--address must be a private IPv4 address");
 	return {
 		...address === void 0 ? {} : { address },
 		port,
 		dshPort
 	};
 }
-function selectNetwork(requested) {
-	const candidates = availableAddresses();
-	if (requested !== void 0) {
-		const match = candidates.find((candidate) => candidate.address === requested);
-		if (match === void 0) throw new Error(`--address ${requested} is not an active private LAN address`);
-		return match;
-	}
-	if (candidates.length === 1) return candidates[0];
-	if (candidates.length === 0) throw new Error("no active private LAN address was found; connect to Wi-Fi or Ethernet");
-	throw new Error(`more than one LAN address is active; rerun with --address and one of: ${candidates.map((entry) => entry.address).join(", ")}`);
-}
 function dshHome() {
 	return resolve(process.env.DSH_HOME ?? join(homedir(), ".dsh"));
 }
 async function setup(args) {
 	const options = parseOptions(args);
-	const network = selectNetwork(options.address);
+	const network = selectLanNetwork(options.address);
 	const home = dshHome();
 	const directory = join(home, "mobile-access");
 	const tls = join(directory, "tls");
@@ -83,53 +215,36 @@ async function setup(args) {
 		recursive: true,
 		mode: 448
 	});
-	const now = /* @__PURE__ */ new Date();
-	const notAfter = new Date(now);
-	notAfter.setDate(notAfter.getDate() + 397);
-	const certificate = await generate([{
-		name: "commonName",
-		value: network.address
-	}], {
-		keyType: "ec",
-		curve: "P-256",
-		algorithm: "sha256",
-		notBeforeDate: /* @__PURE__ */ new Date(now.getTime() - 3e5),
-		notAfterDate: notAfter,
-		extensions: [
-			{
-				name: "basicConstraints",
-				cA: true,
-				critical: true
-			},
-			{
-				name: "keyUsage",
-				digitalSignature: true,
-				keyCertSign: true,
-				cRLSign: true,
-				critical: true
-			},
-			{
-				name: "extKeyUsage",
-				serverAuth: true
-			},
-			{
-				name: "subjectAltName",
-				altNames: [{
-					type: 7,
-					ip: network.address
-				}]
-			}
-		]
-	});
-	const certFile = join(tls, "cert.pem");
-	const keyFile = join(tls, "key.pem");
+	const legacyCertFile = join(tls, "cert.pem");
+	const legacyKeyFile = join(tls, "key.pem");
+	const certFile = join(tls, "server-cert.pem");
+	const keyFile = join(tls, "server-key.pem");
+	const caCertFile = join(tls, "ca.pem");
+	const caKeyFile = join(tls, "ca-key.pem");
 	const androidCertificate = join(tls, "dsh-mobile-ca.cer");
+	const managedTls = {
+		mode: "managed",
+		caCertFile,
+		caKeyFile,
+		certFile,
+		keyFile
+	};
+	const ca = await ensureManagedCa(managedTls, {
+		certFile: legacyCertFile,
+		keyFile: legacyKeyFile
+	});
+	const managedSetup = {
+		version: 2,
+		networkInterface: network.name,
+		listenPort: options.port,
+		upstreamOrigin: `http://127.0.0.1:${String(options.dshPort)}`,
+		tls: managedTls
+	};
+	await refreshManagedServerCertificate(managedSetup, network.address);
+	await writeFile(androidCertificate, ca.raw, { mode: 384 });
 	await Promise.all([
-		writeFile(certFile, certificate.cert, { mode: 384 }),
-		writeFile(keyFile, certificate.private, { mode: 384 }),
-		writeFile(androidCertificate, new X509Certificate(certificate.cert).raw, { mode: 384 })
-	]);
-	await Promise.all([
+		chmod(caCertFile, 384),
+		chmod(caKeyFile, 384),
 		chmod(certFile, 384),
 		chmod(keyFile, 384),
 		chmod(androidCertificate, 384)
@@ -165,19 +280,11 @@ async function setup(args) {
 	}
 	const origin = `https://${network.address}:${String(options.port)}`;
 	await Promise.all([writeFile(join(directory, "setup.json"), `${JSON.stringify({
-		version: 1,
-		publicOrigin: origin,
-		listenHost: network.address,
-		upstreamOrigin: `http://127.0.0.1:${String(options.dshPort)}`,
-		allowedCidrs: [network.cidr],
-		tls: {
-			mode: "provided",
-			certFile: certFile.replaceAll("\\", "/"),
-			keyFile: keyFile.replaceAll("\\", "/")
-		}
+		...managedSetup,
+		tls: Object.fromEntries(Object.entries(managedSetup.tls).map(([key, value]) => [key, typeof value === "string" ? value.replaceAll("\\", "/") : value]))
 	}, null, 2)}\n`, { mode: 384 }), writeFile(join(directory, "control.json"), "{\"version\":1,\"enabled\":true}\n", { mode: 384 })]);
-	console.log(`DSH Mobile is configured for ${origin}`);
-	console.log(`Install this certificate on Android before connecting: ${androidCertificate}`);
+	console.log(`DSH Mobile follows ${network.name} and is currently configured for ${origin}`);
+	console.log(`Install this CA certificate on Android once: ${androidCertificate}`);
 	console.log(`Ask DSH to customize the mobile Web UI and features in: ${customCss} and ${customScript}`);
 	console.log("Start DSH with: dsh --profile web");
 	console.log("Then open the Mobile card in the lower-left corner and create a pairing link.");

package/lib/client.js

@@ -92,9 +92,21 @@ window.__ModuleLoader__.load({
 				}
 			});
 			const body = await response.json();
-			if (!response.ok) throw new Error(typeof body.error === "string" ? body.error : `HTTP ${String(response.status)}`);
+			if (!response.ok) {
+				const code = typeof body.error === "string" ? body.error : `HTTP ${String(response.status)}`;
+				throw new Error(controlErrorMessage(code));
+			}
 			return body;
 		}
+		function controlErrorMessage(code) {
+			const zh = navigator.language.toLowerCase().startsWith("zh");
+			const message = {
+				network_address_changed: ["局域网地址已变化，请重启 DSH 后重试。", "The LAN address changed. Restart DSH and try again."],
+				network_interface_unavailable: ["保存的局域网网卡未连接，请连接网络后重启 DSH。", "The saved LAN interface is disconnected. Connect it and restart DSH."],
+				listen_port_in_use: ["移动访问端口已被占用。", "The mobile-access port is already in use."]
+			}[code];
+			return message === void 0 ? code : message[zh ? 0 : 1];
+		}
 		function mobileExtensionRequest(path, init = {}) {
 			const target = new URL(path, location.href);
 			if (target.origin !== location.origin) throw new TypeError("mobile extension requests must stay on the DSH origin");

package/lib/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","names":["createElement"],"sources":["../src/client.ts"],"sourcesContent":["import { createElement } from 'react'\n\ninterface ClientContext {\n  effect(effect: () => void | (() => void), label?: string): void\n  slots: {\n    inject(key: string, callback: () => (() => void)): () => void\n    register(options: { name: string; id: string }, component: (props: { wide: boolean }) => unknown): () => void\n  }\n}\n\ninterface MobileExtensionContext {\n  readonly document: Document\n  readonly request: (path: string, init?: RequestInit) => Promise<Response>\n  readonly root: HTMLElement\n  readonly window: Window\n}\n\ntype MobileExtensionMount = (context: MobileExtensionContext) => void | (() => void)\n\ninterface MobileExtensionRegistry {\n  register(mount: MobileExtensionMount): void\n}\n\ndeclare global {\n  interface Window {\n    dshMobile?: MobileExtensionRegistry\n  }\n}\n\nconst MOBILE_QUERY = '(max-width: 720px)'\n\nconst BASE_STYLES = `\n@media ${MOBILE_QUERY} {\n  :root {\n    --dsh-mobile-accent: #2563eb;\n    --dsh-mobile-font-scale: 1;\n    --dsh-mobile-radius: 14px;\n  }\n  html { font-size: calc(16px * var(--dsh-mobile-font-scale)); }\n  body { overscroll-behavior: none; }\n  button, [role='button'], input, textarea, select { min-height: 44px; }\n  input, textarea, select { font-size: 16px !important; }\n  [data-sidebar-collapsed] {\n    padding-top: env(safe-area-inset-top);\n    padding-right: env(safe-area-inset-right);\n    padding-bottom: env(safe-area-inset-bottom);\n    padding-left: env(safe-area-inset-left);\n  }\n  [data-shell-overlay] { inset: env(safe-area-inset-top) env(safe-area-inset-right) env(safe-area-inset-bottom) env(safe-area-inset-left); }\n  * { -webkit-tap-highlight-color: transparent; }\n}\n@media (prefers-reduced-motion: reduce) {\n  *, *::before, *::after { scroll-behavior: auto !important; animation-duration: 0.01ms !important; transition-duration: 0.01ms !important; }\n}\n.dsh-mobile-control {\n  position: fixed;\n  left: 68px;\n  bottom: 12px;\n  z-index: 90;\n  color: #172554;\n  font: 14px/1.45 system-ui, -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif;\n}\n.dsh-mobile-control button {\n  min-width: 44px;\n  min-height: 44px;\n  border: 1px solid #bfdbfe;\n  border-radius: 12px;\n  background: #fff;\n  color: #1e3a8a;\n  cursor: pointer;\n}\n.dsh-mobile-control__trigger {\n  width: 100%;\n  min-width: 44px;\n  min-height: 44px;\n  padding: 0 12px;\n  border: 0;\n  border-radius: 10px;\n  background: transparent;\n  color: inherit;\n  font: inherit;\n  font-weight: 700;\n  cursor: pointer;\n}\n.dsh-mobile-control__trigger:hover { background: rgb(37 99 235 / 8%); }\n.dsh-mobile-control__panel {\n  width: min(320px, calc(100vw - 24px));\n  margin-bottom: 8px;\n  padding: 16px;\n  border: 1px solid #dbeafe;\n  border-radius: 16px;\n  background: #fff;\n  box-shadow: 0 10px 30px rgb(15 23 42 / 12%);\n}\n.dsh-mobile-control__title { margin: 0 0 4px; font-size: 16px; font-weight: 800; }\n.dsh-mobile-control__status { margin: 0 0 14px; color: #475569; overflow-wrap: anywhere; }\n.dsh-mobile-control__actions { display: grid; grid-template-columns: 1fr 1fr; gap: 8px; }\n.dsh-mobile-control__actions button[data-primary='true'] { background: #2563eb; border-color: #2563eb; color: #fff; }\n.dsh-mobile-control[hidden], .dsh-mobile-control__panel[hidden] { display: none; }\n`\n\nfunction isLoopbackHost(hostname: string): boolean {\n  return hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '[::1]' || hostname === '::1'\n}\n\nfunction element<K extends keyof HTMLElementTagNameMap>(name: K, className?: string): HTMLElementTagNameMap[K] {\n  const node = document.createElement(name)\n  if (className !== undefined) node.className = className\n  return node\n}\n\nasync function requestJson(path: string, init?: RequestInit): Promise<Record<string, unknown>> {\n  const response = await fetch(path, {\n    ...init,\n    headers: { 'content-type': 'application/json', ...init?.headers },\n  })\n  const body = await response.json() as Record<string, unknown>\n  if (!response.ok) throw new Error(typeof body.error === 'string' ? body.error : `HTTP ${String(response.status)}`)\n  return body\n}\n\nfunction mobileExtensionRequest(path: string, init: RequestInit = {}): Promise<Response> {\n  const target = new URL(path, location.href)\n  if (target.origin !== location.origin) throw new TypeError('mobile extension requests must stay on the DSH origin')\n  const headers = new Headers(init.headers)\n  const method = (init.method ?? 'GET').toUpperCase()\n  if (method !== 'GET' && method !== 'HEAD' && !headers.has('x-dsh-mobile-csrf')) {\n    const csrf = document.cookie.split(';').map(entry => entry.trim())\n      .find(entry => entry.startsWith('dsh_ma_csrf='))?.slice('dsh_ma_csrf='.length)\n    if (csrf !== undefined) headers.set('x-dsh-mobile-csrf', csrf)\n  }\n  return fetch(target, {\n    ...init,\n    cache: 'no-store',\n    credentials: 'same-origin',\n    headers,\n    redirect: 'error',\n  })\n}\n\nfunction installControl(): { remove: () => void; toggle: () => void } {\n  const zh = navigator.language.toLowerCase().startsWith('zh')\n  const root = element('div', 'dsh-mobile-control')\n  const panel = element('section', 'dsh-mobile-control__panel')\n  panel.hidden = true\n  const title = element('h2', 'dsh-mobile-control__title')\n  title.textContent = zh ? '移动访问' : 'Mobile access'\n  const status = element('p', 'dsh-mobile-control__status')\n  status.textContent = zh ? '正在读取状态…' : 'Reading status…'\n  const actions = element('div', 'dsh-mobile-control__actions')\n  const toggle = element('button')\n  toggle.dataset.primary = 'true'\n  const pair = element('button')\n  pair.textContent = zh ? '生成配对链接' : 'Create pairing link'\n  actions.append(toggle, pair)\n  panel.append(title, status, actions)\n  root.append(panel)\n  document.body.append(root)\n\n  let running = false\n  const render = (data: Record<string, unknown>): void => {\n    running = data.running === true\n    const origin = typeof data.origin === 'string' ? data.origin : undefined\n    status.textContent = running\n      ? (zh ? `已开启：${origin ?? ''}` : `Running: ${origin ?? ''}`)\n      : (zh ? '已关闭。DSH 仍只在本机可用。' : 'Stopped. DSH remains local-only.')\n    toggle.textContent = running ? (zh ? '关闭' : 'Stop') : (zh ? '开启' : 'Start')\n    pair.disabled = !running\n  }\n  const refresh = async (): Promise<void> => {\n    try { render(await requestJson('/api/mobile-access/control')) }\n    catch (error) { status.textContent = error instanceof Error ? error.message : String(error) }\n  }\n  toggle.addEventListener('click', () => {\n    toggle.disabled = true\n    void requestJson('/api/mobile-access/control', {\n      method: 'POST',\n      body: JSON.stringify({ running: !running }),\n    }).then(render, (error: unknown) => {\n      status.textContent = error instanceof Error ? error.message : String(error)\n    }).finally(() => { toggle.disabled = false })\n  })\n  pair.addEventListener('click', () => {\n    pair.disabled = true\n    void requestJson('/api/mobile-access/pairing/open', {\n      method: 'POST',\n      body: '{}',\n    }).then(async (data) => {\n      const url = typeof data.pairUrl === 'string' ? data.pairUrl : ''\n      if (url !== '' && navigator.clipboard !== undefined) await navigator.clipboard.writeText(url)\n      status.textContent = url === '' ? (zh ? '无法生成链接' : 'Could not create link')\n        : (zh ? `链接已复制：${url}` : `Copied: ${url}`)\n    }, (error: unknown) => {\n      status.textContent = error instanceof Error ? error.message : String(error)\n    }).finally(() => { pair.disabled = !running })\n  })\n  void refresh()\n  return {\n    remove: () => { root.remove() },\n    toggle: () => { panel.hidden = !panel.hidden },\n  }\n}\n\nfunction installCustomExtension(): () => void {\n  let activeRoot: HTMLElement | undefined\n  let activeDispose: (() => void) | undefined\n  let observedSource = ''\n  let loading = false\n  let pendingMount: MobileExtensionMount | undefined\n  const previousRegistry = window.dshMobile\n  const registry: MobileExtensionRegistry = Object.freeze({\n    register: (mount: MobileExtensionMount): void => {\n      if (typeof mount !== 'function') throw new TypeError('dshMobile.register requires a mount function')\n      pendingMount = mount\n    },\n  })\n  const registeredMount = (): MobileExtensionMount | undefined => pendingMount\n  window.dshMobile = registry\n\n  const refresh = async (): Promise<void> => {\n    if (loading || document.visibilityState === 'hidden') return\n    loading = true\n    try {\n      const response = await fetch('/mobile-access/custom.js', {\n        cache: 'no-store',\n        credentials: 'same-origin',\n        redirect: 'error',\n      })\n      if (!response.ok || !response.headers.get('content-type')?.startsWith('text/javascript')) return\n      const source = await response.text()\n      if (source === observedSource) return\n      observedSource = source\n      pendingMount = undefined\n      const script = document.createElement('script')\n      script.textContent = `${source}\\n//# sourceURL=dsh-mobile-custom.js`\n      document.head.append(script)\n      script.remove()\n      const mount = registeredMount()\n      if (mount === undefined) return\n\n      const nextRoot = document.createElement('div')\n      nextRoot.dataset.dshMobileExtension = 'true'\n      document.body.append(nextRoot)\n      try {\n        const nextDispose = mount(Object.freeze({\n          document,\n          request: mobileExtensionRequest,\n          root: nextRoot,\n          window,\n        }))\n        if (nextDispose !== undefined && typeof nextDispose !== 'function') {\n          throw new TypeError('the mobile extension mount function must return a disposer or undefined')\n        }\n        activeDispose?.()\n        activeRoot?.remove()\n        activeRoot = nextRoot\n        activeDispose = typeof nextDispose === 'function' ? nextDispose : undefined\n      } catch (error) {\n        nextRoot.remove()\n        console.error('DSH Mobile custom extension failed to mount', error)\n      }\n    } catch {\n      // A transient LAN disconnect keeps the last successfully mounted extension.\n    } finally {\n      loading = false\n    }\n  }\n  void refresh()\n  const timer = setInterval(() => { void refresh() }, 1_000)\n  return () => {\n    clearInterval(timer)\n    activeDispose?.()\n    activeRoot?.remove()\n    if (previousRegistry === undefined) delete window.dshMobile\n    else window.dshMobile = previousRegistry\n  }\n}\n\n/** Install the responsive mobile layer and the loopback-only control card. */\nexport function apply(ctx: ClientContext): void {\n  ctx.effect(() => {\n    const style = document.createElement('style')\n    style.dataset.plugin = 'dsh-mobile'\n    style.textContent = BASE_STYLES\n    document.head.append(style)\n\n    const loopback = isLoopbackHost(location.hostname)\n    const custom = loopback ? undefined : document.createElement('style')\n    let customRefresh: ReturnType<typeof setInterval> | undefined\n    let customLoading = false\n    if (custom !== undefined) {\n      custom.dataset.plugin = 'dsh-mobile'\n      document.head.append(custom)\n      const refreshCustomCss = async (): Promise<void> => {\n        if (customLoading || document.visibilityState === 'hidden') return\n        customLoading = true\n        try {\n          const response = await fetch('/mobile-access/custom.css', {\n            cache: 'no-store',\n            credentials: 'same-origin',\n            redirect: 'error',\n          })\n          if (!response.ok || !response.headers.get('content-type')?.startsWith('text/css')) return\n          const css = await response.text()\n          if (custom.textContent !== css) custom.textContent = css\n        } catch {\n          // A transient LAN disconnect keeps the last successfully applied stylesheet.\n        } finally {\n          customLoading = false\n        }\n      }\n      void refreshCustomCss()\n      customRefresh = setInterval(() => { void refreshCustomCss() }, 1_000)\n    }\n    const removeCustomExtension = loopback ? undefined : installCustomExtension()\n    const control = loopback ? installControl() : undefined\n    const disposeSlot = control === undefined ? undefined : ctx.slots.inject('sidebar.footer.action', () => ctx.slots.register({\n      name: 'sidebar.footer.action',\n      id: 'dsh-mobile',\n    }, ({ wide }) => createElement('button', {\n      className: 'dsh-mobile-control__trigger',\n      type: 'button',\n      title: controlLabel(),\n      onClick: control.toggle,\n    }, wide ? controlLabel() : 'M')))\n    return () => {\n      if (customRefresh !== undefined) clearInterval(customRefresh)\n      disposeSlot?.()\n      control?.remove()\n      removeCustomExtension?.()\n      custom?.remove()\n      style.remove()\n    }\n  }, 'dsh-mobile: responsive UI and local control')\n}\n\n/** Client face has no service prerequisites. */\nexport const inject: readonly string[] = ['slots']\n\nfunction controlLabel(): string {\n  return navigator.language.toLowerCase().startsWith('zh') ? '移动端' : 'Mobile access'\n}\n"],"mappings":";;;;;;;;EA+BA,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAsEpB,SAAS,eAAe,UAA2B;GACjD,OAAO,aAAa,eAAe,aAAa,eAAe,aAAa,WAAW,aAAa;EACtG;EAEA,SAAS,QAA+C,MAAS,WAA8C;GAC7G,MAAM,OAAO,SAAS,cAAc,IAAI;GACxC,IAAI,cAAc,KAAA,GAAW,KAAK,YAAY;GAC9C,OAAO;EACT;EAEA,eAAe,YAAY,MAAc,MAAsD;GAC7F,MAAM,WAAW,MAAM,MAAM,MAAM;IACjC,GAAG;IACH,SAAS;KAAE,gBAAgB;KAAoB,GAAG,MAAM;IAAQ;GAClE,CAAC;GACD,MAAM,OAAO,MAAM,SAAS,KAAK;GACjC,IAAI,CAAC,SAAS,IAAI,MAAM,IAAI,MAAM,OAAO,KAAK,UAAU,WAAW,KAAK,QAAQ,QAAQ,OAAO,SAAS,MAAM,GAAG;GACjH,OAAO;EACT;EAEA,SAAS,uBAAuB,MAAc,OAAoB,CAAC,GAAsB;GACvF,MAAM,SAAS,IAAI,IAAI,MAAM,SAAS,IAAI;GAC1C,IAAI,OAAO,WAAW,SAAS,QAAQ,MAAM,IAAI,UAAU,uDAAuD;GAClH,MAAM,UAAU,IAAI,QAAQ,KAAK,OAAO;GACxC,MAAM,UAAU,KAAK,UAAU,MAAA,CAAO,YAAY;GAClD,IAAI,WAAW,SAAS,WAAW,UAAU,CAAC,QAAQ,IAAI,mBAAmB,GAAG;IAC9E,MAAM,OAAO,SAAS,OAAO,MAAM,GAAG,CAAC,CAAC,KAAI,UAAS,MAAM,KAAK,CAAC,CAAC,CAC/D,MAAK,UAAS,MAAM,WAAW,cAAc,CAAC,CAAC,EAAE,MAAM,EAAqB;IAC/E,IAAI,SAAS,KAAA,GAAW,QAAQ,IAAI,qBAAqB,IAAI;GAC/D;GACA,OAAO,MAAM,QAAQ;IACnB,GAAG;IACH,OAAO;IACP,aAAa;IACb;IACA,UAAU;GACZ,CAAC;EACH;EAEA,SAAS,iBAA6D;GACpE,MAAM,KAAK,UAAU,SAAS,YAAY,CAAC,CAAC,WAAW,IAAI;GAC3D,MAAM,OAAO,QAAQ,OAAO,oBAAoB;GAChD,MAAM,QAAQ,QAAQ,WAAW,2BAA2B;GAC5D,MAAM,SAAS;GACf,MAAM,QAAQ,QAAQ,MAAM,2BAA2B;GACvD,MAAM,cAAc,KAAK,SAAS;GAClC,MAAM,SAAS,QAAQ,KAAK,4BAA4B;GACxD,OAAO,cAAc,KAAK,YAAY;GACtC,MAAM,UAAU,QAAQ,OAAO,6BAA6B;GAC5D,MAAM,SAAS,QAAQ,QAAQ;GAC/B,OAAO,QAAQ,UAAU;GACzB,MAAM,OAAO,QAAQ,QAAQ;GAC7B,KAAK,cAAc,KAAK,WAAW;GACnC,QAAQ,OAAO,QAAQ,IAAI;GAC3B,MAAM,OAAO,OAAO,QAAQ,OAAO;GACnC,KAAK,OAAO,KAAK;GACjB,SAAS,KAAK,OAAO,IAAI;GAEzB,IAAI,UAAU;GACd,MAAM,UAAU,SAAwC;IACtD,UAAU,KAAK,YAAY;IAC3B,MAAM,SAAS,OAAO,KAAK,WAAW,WAAW,KAAK,SAAS,KAAA;IAC/D,OAAO,cAAc,UAChB,KAAK,OAAO,UAAU,OAAO,YAAY,UAAU,OACnD,KAAK,qBAAqB;IAC/B,OAAO,cAAc,UAAW,KAAK,OAAO,SAAW,KAAK,OAAO;IACnE,KAAK,WAAW,CAAC;GACnB;GACA,MAAM,UAAU,YAA2B;IACzC,IAAI;KAAE,OAAO,MAAM,YAAY,4BAA4B,CAAC;IAAE,SACvD,OAAO;KAAE,OAAO,cAAc,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;IAAE;GAC9F;GACA,OAAO,iBAAiB,eAAe;IACrC,OAAO,WAAW;IAClB,YAAiB,8BAA8B;KAC7C,QAAQ;KACR,MAAM,KAAK,UAAU,EAAE,SAAS,CAAC,QAAQ,CAAC;IAC5C,CAAC,CAAC,CAAC,KAAK,SAAS,UAAmB;KAClC,OAAO,cAAc,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;IAC5E,CAAC,CAAC,CAAC,cAAc;KAAE,OAAO,WAAW;IAAM,CAAC;GAC9C,CAAC;GACD,KAAK,iBAAiB,eAAe;IACnC,KAAK,WAAW;IAChB,YAAiB,mCAAmC;KAClD,QAAQ;KACR,MAAM;IACR,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS;KACtB,MAAM,MAAM,OAAO,KAAK,YAAY,WAAW,KAAK,UAAU;KAC9D,IAAI,QAAQ,MAAM,UAAU,cAAc,KAAA,GAAW,MAAM,UAAU,UAAU,UAAU,GAAG;KAC5F,OAAO,cAAc,QAAQ,KAAM,KAAK,WAAW,0BAC9C,KAAK,SAAS,QAAQ,WAAW;IACxC,IAAI,UAAmB;KACrB,OAAO,cAAc,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;IAC5E,CAAC,CAAC,CAAC,cAAc;KAAE,KAAK,WAAW,CAAC;IAAQ,CAAC;GAC/C,CAAC;GACD,QAAa;GACb,OAAO;IACL,cAAc;KAAE,KAAK,OAAO;IAAE;IAC9B,cAAc;KAAE,MAAM,SAAS,CAAC,MAAM;IAAO;GAC/C;EACF;EAEA,SAAS,yBAAqC;GAC5C,IAAI;GACJ,IAAI;GACJ,IAAI,iBAAiB;GACrB,IAAI,UAAU;GACd,IAAI;GACJ,MAAM,mBAAmB,OAAO;GAChC,MAAM,WAAoC,OAAO,OAAO,EACtD,WAAW,UAAsC;IAC/C,IAAI,OAAO,UAAU,YAAY,MAAM,IAAI,UAAU,8CAA8C;IACnG,eAAe;GACjB,EACF,CAAC;GACD,MAAM,wBAA0D;GAChE,OAAO,YAAY;GAEnB,MAAM,UAAU,YAA2B;IACzC,IAAI,WAAW,SAAS,oBAAoB,UAAU;IACtD,UAAU;IACV,IAAI;KACF,MAAM,WAAW,MAAM,MAAM,4BAA4B;MACvD,OAAO;MACP,aAAa;MACb,UAAU;KACZ,CAAC;KACD,IAAI,CAAC,SAAS,MAAM,CAAC,SAAS,QAAQ,IAAI,cAAc,CAAC,EAAE,WAAW,iBAAiB,GAAG;KAC1F,MAAM,SAAS,MAAM,SAAS,KAAK;KACnC,IAAI,WAAW,gBAAgB;KAC/B,iBAAiB;KACjB,eAAe,KAAA;KACf,MAAM,SAAS,SAAS,cAAc,QAAQ;KAC9C,OAAO,cAAc,GAAG,OAAO;KAC/B,SAAS,KAAK,OAAO,MAAM;KAC3B,OAAO,OAAO;KACd,MAAM,QAAQ,gBAAgB;KAC9B,IAAI,UAAU,KAAA,GAAW;KAEzB,MAAM,WAAW,SAAS,cAAc,KAAK;KAC7C,SAAS,QAAQ,qBAAqB;KACtC,SAAS,KAAK,OAAO,QAAQ;KAC7B,IAAI;MACF,MAAM,cAAc,MAAM,OAAO,OAAO;OACtC;OACA,SAAS;OACT,MAAM;OACN;MACF,CAAC,CAAC;MACF,IAAI,gBAAgB,KAAA,KAAa,OAAO,gBAAgB,YACtD,MAAM,IAAI,UAAU,yEAAyE;MAE/F,gBAAgB;MAChB,YAAY,OAAO;MACnB,aAAa;MACb,gBAAgB,OAAO,gBAAgB,aAAa,cAAc,KAAA;KACpE,SAAS,OAAO;MACd,SAAS,OAAO;MAChB,QAAQ,MAAM,+CAA+C,KAAK;KACpE;IACF,QAAQ,CAER,UAAU;KACR,UAAU;IACZ;GACF;GACA,QAAa;GACb,MAAM,QAAQ,kBAAkB;IAAE,QAAa;GAAE,GAAG,GAAK;GACzD,aAAa;IACX,cAAc,KAAK;IACnB,gBAAgB;IAChB,YAAY,OAAO;IACnB,IAAI,qBAAqB,KAAA,GAAW,OAAO,OAAO;SAC7C,OAAO,YAAY;GAC1B;EACF;;EAGA,SAAgB,MAAM,KAA0B;GAC9C,IAAI,aAAa;IACf,MAAM,QAAQ,SAAS,cAAc,OAAO;IAC5C,MAAM,QAAQ,SAAS;IACvB,MAAM,cAAc;IACpB,SAAS,KAAK,OAAO,KAAK;IAE1B,MAAM,WAAW,eAAe,SAAS,QAAQ;IACjD,MAAM,SAAS,WAAW,KAAA,IAAY,SAAS,cAAc,OAAO;IACpE,IAAI;IACJ,IAAI,gBAAgB;IACpB,IAAI,WAAW,KAAA,GAAW;KACxB,OAAO,QAAQ,SAAS;KACxB,SAAS,KAAK,OAAO,MAAM;KAC3B,MAAM,mBAAmB,YAA2B;MAClD,IAAI,iBAAiB,SAAS,oBAAoB,UAAU;MAC5D,gBAAgB;MAChB,IAAI;OACF,MAAM,WAAW,MAAM,MAAM,6BAA6B;QACxD,OAAO;QACP,aAAa;QACb,UAAU;OACZ,CAAC;OACD,IAAI,CAAC,SAAS,MAAM,CAAC,SAAS,QAAQ,IAAI,cAAc,CAAC,EAAE,WAAW,UAAU,GAAG;OACnF,MAAM,MAAM,MAAM,SAAS,KAAK;OAChC,IAAI,OAAO,gBAAgB,KAAK,OAAO,cAAc;MACvD,QAAQ,CAER,UAAU;OACR,gBAAgB;MAClB;KACF;KACA,iBAAsB;KACtB,gBAAgB,kBAAkB;MAAE,iBAAsB;KAAE,GAAG,GAAK;IACtE;IACA,MAAM,wBAAwB,WAAW,KAAA,IAAY,uBAAuB;IAC5E,MAAM,UAAU,WAAW,eAAe,IAAI,KAAA;IAC9C,MAAM,cAAc,YAAY,KAAA,IAAY,KAAA,IAAY,IAAI,MAAM,OAAO,+BAA+B,IAAI,MAAM,SAAS;KACzH,MAAM;KACN,IAAI;IACN,IAAI,EAAE,YAAA,GAAWA,MAAAA,cAAAA,CAAc,UAAU;KACvC,WAAW;KACX,MAAM;KACN,OAAO,aAAa;KACpB,SAAS,QAAQ;IACnB,GAAG,OAAO,aAAa,IAAI,GAAG,CAAC,CAAC;IAChC,aAAa;KACX,IAAI,kBAAkB,KAAA,GAAW,cAAc,aAAa;KAC5D,cAAc;KACd,SAAS,OAAO;KAChB,wBAAwB;KACxB,QAAQ,OAAO;KACf,MAAM,OAAO;IACf;GACF,GAAG,6CAA6C;EAClD;;EAGA,MAAa,SAA4B,CAAC,OAAO;EAEjD,SAAS,eAAuB;GAC9B,OAAO,UAAU,SAAS,YAAY,CAAC,CAAC,WAAW,IAAI,IAAI,QAAQ;EACrE"}
+{"version":3,"file":"client.js","names":["createElement"],"sources":["../src/client.ts"],"sourcesContent":["import { createElement } from 'react'\n\ninterface ClientContext {\n  effect(effect: () => void | (() => void), label?: string): void\n  slots: {\n    inject(key: string, callback: () => (() => void)): () => void\n    register(options: { name: string; id: string }, component: (props: { wide: boolean }) => unknown): () => void\n  }\n}\n\ninterface MobileExtensionContext {\n  readonly document: Document\n  readonly request: (path: string, init?: RequestInit) => Promise<Response>\n  readonly root: HTMLElement\n  readonly window: Window\n}\n\ntype MobileExtensionMount = (context: MobileExtensionContext) => void | (() => void)\n\ninterface MobileExtensionRegistry {\n  register(mount: MobileExtensionMount): void\n}\n\ndeclare global {\n  interface Window {\n    dshMobile?: MobileExtensionRegistry\n  }\n}\n\nconst MOBILE_QUERY = '(max-width: 720px)'\n\nconst BASE_STYLES = `\n@media ${MOBILE_QUERY} {\n  :root {\n    --dsh-mobile-accent: #2563eb;\n    --dsh-mobile-font-scale: 1;\n    --dsh-mobile-radius: 14px;\n  }\n  html { font-size: calc(16px * var(--dsh-mobile-font-scale)); }\n  body { overscroll-behavior: none; }\n  button, [role='button'], input, textarea, select { min-height: 44px; }\n  input, textarea, select { font-size: 16px !important; }\n  [data-sidebar-collapsed] {\n    padding-top: env(safe-area-inset-top);\n    padding-right: env(safe-area-inset-right);\n    padding-bottom: env(safe-area-inset-bottom);\n    padding-left: env(safe-area-inset-left);\n  }\n  [data-shell-overlay] { inset: env(safe-area-inset-top) env(safe-area-inset-right) env(safe-area-inset-bottom) env(safe-area-inset-left); }\n  * { -webkit-tap-highlight-color: transparent; }\n}\n@media (prefers-reduced-motion: reduce) {\n  *, *::before, *::after { scroll-behavior: auto !important; animation-duration: 0.01ms !important; transition-duration: 0.01ms !important; }\n}\n.dsh-mobile-control {\n  position: fixed;\n  left: 68px;\n  bottom: 12px;\n  z-index: 90;\n  color: #172554;\n  font: 14px/1.45 system-ui, -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif;\n}\n.dsh-mobile-control button {\n  min-width: 44px;\n  min-height: 44px;\n  border: 1px solid #bfdbfe;\n  border-radius: 12px;\n  background: #fff;\n  color: #1e3a8a;\n  cursor: pointer;\n}\n.dsh-mobile-control__trigger {\n  width: 100%;\n  min-width: 44px;\n  min-height: 44px;\n  padding: 0 12px;\n  border: 0;\n  border-radius: 10px;\n  background: transparent;\n  color: inherit;\n  font: inherit;\n  font-weight: 700;\n  cursor: pointer;\n}\n.dsh-mobile-control__trigger:hover { background: rgb(37 99 235 / 8%); }\n.dsh-mobile-control__panel {\n  width: min(320px, calc(100vw - 24px));\n  margin-bottom: 8px;\n  padding: 16px;\n  border: 1px solid #dbeafe;\n  border-radius: 16px;\n  background: #fff;\n  box-shadow: 0 10px 30px rgb(15 23 42 / 12%);\n}\n.dsh-mobile-control__title { margin: 0 0 4px; font-size: 16px; font-weight: 800; }\n.dsh-mobile-control__status { margin: 0 0 14px; color: #475569; overflow-wrap: anywhere; }\n.dsh-mobile-control__actions { display: grid; grid-template-columns: 1fr 1fr; gap: 8px; }\n.dsh-mobile-control__actions button[data-primary='true'] { background: #2563eb; border-color: #2563eb; color: #fff; }\n.dsh-mobile-control[hidden], .dsh-mobile-control__panel[hidden] { display: none; }\n`\n\nfunction isLoopbackHost(hostname: string): boolean {\n  return hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '[::1]' || hostname === '::1'\n}\n\nfunction element<K extends keyof HTMLElementTagNameMap>(name: K, className?: string): HTMLElementTagNameMap[K] {\n  const node = document.createElement(name)\n  if (className !== undefined) node.className = className\n  return node\n}\n\nasync function requestJson(path: string, init?: RequestInit): Promise<Record<string, unknown>> {\n  const response = await fetch(path, {\n    ...init,\n    headers: { 'content-type': 'application/json', ...init?.headers },\n  })\n  const body = await response.json() as Record<string, unknown>\n  if (!response.ok) {\n    const code = typeof body.error === 'string' ? body.error : `HTTP ${String(response.status)}`\n    throw new Error(controlErrorMessage(code))\n  }\n  return body\n}\n\nfunction controlErrorMessage(code: string): string {\n  const zh = navigator.language.toLowerCase().startsWith('zh')\n  const messages: Record<string, readonly [string, string]> = {\n    network_address_changed: ['局域网地址已变化，请重启 DSH 后重试。', 'The LAN address changed. Restart DSH and try again.'],\n    network_interface_unavailable: ['保存的局域网网卡未连接，请连接网络后重启 DSH。', 'The saved LAN interface is disconnected. Connect it and restart DSH.'],\n    listen_port_in_use: ['移动访问端口已被占用。', 'The mobile-access port is already in use.'],\n  }\n  const message = messages[code]\n  return message === undefined ? code : message[zh ? 0 : 1]\n}\n\nfunction mobileExtensionRequest(path: string, init: RequestInit = {}): Promise<Response> {\n  const target = new URL(path, location.href)\n  if (target.origin !== location.origin) throw new TypeError('mobile extension requests must stay on the DSH origin')\n  const headers = new Headers(init.headers)\n  const method = (init.method ?? 'GET').toUpperCase()\n  if (method !== 'GET' && method !== 'HEAD' && !headers.has('x-dsh-mobile-csrf')) {\n    const csrf = document.cookie.split(';').map(entry => entry.trim())\n      .find(entry => entry.startsWith('dsh_ma_csrf='))?.slice('dsh_ma_csrf='.length)\n    if (csrf !== undefined) headers.set('x-dsh-mobile-csrf', csrf)\n  }\n  return fetch(target, {\n    ...init,\n    cache: 'no-store',\n    credentials: 'same-origin',\n    headers,\n    redirect: 'error',\n  })\n}\n\nfunction installControl(): { remove: () => void; toggle: () => void } {\n  const zh = navigator.language.toLowerCase().startsWith('zh')\n  const root = element('div', 'dsh-mobile-control')\n  const panel = element('section', 'dsh-mobile-control__panel')\n  panel.hidden = true\n  const title = element('h2', 'dsh-mobile-control__title')\n  title.textContent = zh ? '移动访问' : 'Mobile access'\n  const status = element('p', 'dsh-mobile-control__status')\n  status.textContent = zh ? '正在读取状态…' : 'Reading status…'\n  const actions = element('div', 'dsh-mobile-control__actions')\n  const toggle = element('button')\n  toggle.dataset.primary = 'true'\n  const pair = element('button')\n  pair.textContent = zh ? '生成配对链接' : 'Create pairing link'\n  actions.append(toggle, pair)\n  panel.append(title, status, actions)\n  root.append(panel)\n  document.body.append(root)\n\n  let running = false\n  const render = (data: Record<string, unknown>): void => {\n    running = data.running === true\n    const origin = typeof data.origin === 'string' ? data.origin : undefined\n    status.textContent = running\n      ? (zh ? `已开启：${origin ?? ''}` : `Running: ${origin ?? ''}`)\n      : (zh ? '已关闭。DSH 仍只在本机可用。' : 'Stopped. DSH remains local-only.')\n    toggle.textContent = running ? (zh ? '关闭' : 'Stop') : (zh ? '开启' : 'Start')\n    pair.disabled = !running\n  }\n  const refresh = async (): Promise<void> => {\n    try { render(await requestJson('/api/mobile-access/control')) }\n    catch (error) { status.textContent = error instanceof Error ? error.message : String(error) }\n  }\n  toggle.addEventListener('click', () => {\n    toggle.disabled = true\n    void requestJson('/api/mobile-access/control', {\n      method: 'POST',\n      body: JSON.stringify({ running: !running }),\n    }).then(render, (error: unknown) => {\n      status.textContent = error instanceof Error ? error.message : String(error)\n    }).finally(() => { toggle.disabled = false })\n  })\n  pair.addEventListener('click', () => {\n    pair.disabled = true\n    void requestJson('/api/mobile-access/pairing/open', {\n      method: 'POST',\n      body: '{}',\n    }).then(async (data) => {\n      const url = typeof data.pairUrl === 'string' ? data.pairUrl : ''\n      if (url !== '' && navigator.clipboard !== undefined) await navigator.clipboard.writeText(url)\n      status.textContent = url === '' ? (zh ? '无法生成链接' : 'Could not create link')\n        : (zh ? `链接已复制：${url}` : `Copied: ${url}`)\n    }, (error: unknown) => {\n      status.textContent = error instanceof Error ? error.message : String(error)\n    }).finally(() => { pair.disabled = !running })\n  })\n  void refresh()\n  return {\n    remove: () => { root.remove() },\n    toggle: () => { panel.hidden = !panel.hidden },\n  }\n}\n\nfunction installCustomExtension(): () => void {\n  let activeRoot: HTMLElement | undefined\n  let activeDispose: (() => void) | undefined\n  let observedSource = ''\n  let loading = false\n  let pendingMount: MobileExtensionMount | undefined\n  const previousRegistry = window.dshMobile\n  const registry: MobileExtensionRegistry = Object.freeze({\n    register: (mount: MobileExtensionMount): void => {\n      if (typeof mount !== 'function') throw new TypeError('dshMobile.register requires a mount function')\n      pendingMount = mount\n    },\n  })\n  const registeredMount = (): MobileExtensionMount | undefined => pendingMount\n  window.dshMobile = registry\n\n  const refresh = async (): Promise<void> => {\n    if (loading || document.visibilityState === 'hidden') return\n    loading = true\n    try {\n      const response = await fetch('/mobile-access/custom.js', {\n        cache: 'no-store',\n        credentials: 'same-origin',\n        redirect: 'error',\n      })\n      if (!response.ok || !response.headers.get('content-type')?.startsWith('text/javascript')) return\n      const source = await response.text()\n      if (source === observedSource) return\n      observedSource = source\n      pendingMount = undefined\n      const script = document.createElement('script')\n      script.textContent = `${source}\\n//# sourceURL=dsh-mobile-custom.js`\n      document.head.append(script)\n      script.remove()\n      const mount = registeredMount()\n      if (mount === undefined) return\n\n      const nextRoot = document.createElement('div')\n      nextRoot.dataset.dshMobileExtension = 'true'\n      document.body.append(nextRoot)\n      try {\n        const nextDispose = mount(Object.freeze({\n          document,\n          request: mobileExtensionRequest,\n          root: nextRoot,\n          window,\n        }))\n        if (nextDispose !== undefined && typeof nextDispose !== 'function') {\n          throw new TypeError('the mobile extension mount function must return a disposer or undefined')\n        }\n        activeDispose?.()\n        activeRoot?.remove()\n        activeRoot = nextRoot\n        activeDispose = typeof nextDispose === 'function' ? nextDispose : undefined\n      } catch (error) {\n        nextRoot.remove()\n        console.error('DSH Mobile custom extension failed to mount', error)\n      }\n    } catch {\n      // A transient LAN disconnect keeps the last successfully mounted extension.\n    } finally {\n      loading = false\n    }\n  }\n  void refresh()\n  const timer = setInterval(() => { void refresh() }, 1_000)\n  return () => {\n    clearInterval(timer)\n    activeDispose?.()\n    activeRoot?.remove()\n    if (previousRegistry === undefined) delete window.dshMobile\n    else window.dshMobile = previousRegistry\n  }\n}\n\n/** Install the responsive mobile layer and the loopback-only control card. */\nexport function apply(ctx: ClientContext): void {\n  ctx.effect(() => {\n    const style = document.createElement('style')\n    style.dataset.plugin = 'dsh-mobile'\n    style.textContent = BASE_STYLES\n    document.head.append(style)\n\n    const loopback = isLoopbackHost(location.hostname)\n    const custom = loopback ? undefined : document.createElement('style')\n    let customRefresh: ReturnType<typeof setInterval> | undefined\n    let customLoading = false\n    if (custom !== undefined) {\n      custom.dataset.plugin = 'dsh-mobile'\n      document.head.append(custom)\n      const refreshCustomCss = async (): Promise<void> => {\n        if (customLoading || document.visibilityState === 'hidden') return\n        customLoading = true\n        try {\n          const response = await fetch('/mobile-access/custom.css', {\n            cache: 'no-store',\n            credentials: 'same-origin',\n            redirect: 'error',\n          })\n          if (!response.ok || !response.headers.get('content-type')?.startsWith('text/css')) return\n          const css = await response.text()\n          if (custom.textContent !== css) custom.textContent = css\n        } catch {\n          // A transient LAN disconnect keeps the last successfully applied stylesheet.\n        } finally {\n          customLoading = false\n        }\n      }\n      void refreshCustomCss()\n      customRefresh = setInterval(() => { void refreshCustomCss() }, 1_000)\n    }\n    const removeCustomExtension = loopback ? undefined : installCustomExtension()\n    const control = loopback ? installControl() : undefined\n    const disposeSlot = control === undefined ? undefined : ctx.slots.inject('sidebar.footer.action', () => ctx.slots.register({\n      name: 'sidebar.footer.action',\n      id: 'dsh-mobile',\n    }, ({ wide }) => createElement('button', {\n      className: 'dsh-mobile-control__trigger',\n      type: 'button',\n      title: controlLabel(),\n      onClick: control.toggle,\n    }, wide ? controlLabel() : 'M')))\n    return () => {\n      if (customRefresh !== undefined) clearInterval(customRefresh)\n      disposeSlot?.()\n      control?.remove()\n      removeCustomExtension?.()\n      custom?.remove()\n      style.remove()\n    }\n  }, 'dsh-mobile: responsive UI and local control')\n}\n\n/** Client face has no service prerequisites. */\nexport const inject: readonly string[] = ['slots']\n\nfunction controlLabel(): string {\n  return navigator.language.toLowerCase().startsWith('zh') ? '移动端' : 'Mobile access'\n}\n"],"mappings":";;;;;;;;EA+BA,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAsEpB,SAAS,eAAe,UAA2B;GACjD,OAAO,aAAa,eAAe,aAAa,eAAe,aAAa,WAAW,aAAa;EACtG;EAEA,SAAS,QAA+C,MAAS,WAA8C;GAC7G,MAAM,OAAO,SAAS,cAAc,IAAI;GACxC,IAAI,cAAc,KAAA,GAAW,KAAK,YAAY;GAC9C,OAAO;EACT;EAEA,eAAe,YAAY,MAAc,MAAsD;GAC7F,MAAM,WAAW,MAAM,MAAM,MAAM;IACjC,GAAG;IACH,SAAS;KAAE,gBAAgB;KAAoB,GAAG,MAAM;IAAQ;GAClE,CAAC;GACD,MAAM,OAAO,MAAM,SAAS,KAAK;GACjC,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,OAAO,OAAO,KAAK,UAAU,WAAW,KAAK,QAAQ,QAAQ,OAAO,SAAS,MAAM;IACzF,MAAM,IAAI,MAAM,oBAAoB,IAAI,CAAC;GAC3C;GACA,OAAO;EACT;EAEA,SAAS,oBAAoB,MAAsB;GACjD,MAAM,KAAK,UAAU,SAAS,YAAY,CAAC,CAAC,WAAW,IAAI;GAM3D,MAAM,UAAU;IAJd,yBAAyB,CAAC,yBAAyB,qDAAqD;IACxG,+BAA+B,CAAC,6BAA6B,sEAAsE;IACnI,oBAAoB,CAAC,eAAe,2CAA2C;GAE1D,EAAE;GACzB,OAAO,YAAY,KAAA,IAAY,OAAO,QAAQ,KAAK,IAAI;EACzD;EAEA,SAAS,uBAAuB,MAAc,OAAoB,CAAC,GAAsB;GACvF,MAAM,SAAS,IAAI,IAAI,MAAM,SAAS,IAAI;GAC1C,IAAI,OAAO,WAAW,SAAS,QAAQ,MAAM,IAAI,UAAU,uDAAuD;GAClH,MAAM,UAAU,IAAI,QAAQ,KAAK,OAAO;GACxC,MAAM,UAAU,KAAK,UAAU,MAAA,CAAO,YAAY;GAClD,IAAI,WAAW,SAAS,WAAW,UAAU,CAAC,QAAQ,IAAI,mBAAmB,GAAG;IAC9E,MAAM,OAAO,SAAS,OAAO,MAAM,GAAG,CAAC,CAAC,KAAI,UAAS,MAAM,KAAK,CAAC,CAAC,CAC/D,MAAK,UAAS,MAAM,WAAW,cAAc,CAAC,CAAC,EAAE,MAAM,EAAqB;IAC/E,IAAI,SAAS,KAAA,GAAW,QAAQ,IAAI,qBAAqB,IAAI;GAC/D;GACA,OAAO,MAAM,QAAQ;IACnB,GAAG;IACH,OAAO;IACP,aAAa;IACb;IACA,UAAU;GACZ,CAAC;EACH;EAEA,SAAS,iBAA6D;GACpE,MAAM,KAAK,UAAU,SAAS,YAAY,CAAC,CAAC,WAAW,IAAI;GAC3D,MAAM,OAAO,QAAQ,OAAO,oBAAoB;GAChD,MAAM,QAAQ,QAAQ,WAAW,2BAA2B;GAC5D,MAAM,SAAS;GACf,MAAM,QAAQ,QAAQ,MAAM,2BAA2B;GACvD,MAAM,cAAc,KAAK,SAAS;GAClC,MAAM,SAAS,QAAQ,KAAK,4BAA4B;GACxD,OAAO,cAAc,KAAK,YAAY;GACtC,MAAM,UAAU,QAAQ,OAAO,6BAA6B;GAC5D,MAAM,SAAS,QAAQ,QAAQ;GAC/B,OAAO,QAAQ,UAAU;GACzB,MAAM,OAAO,QAAQ,QAAQ;GAC7B,KAAK,cAAc,KAAK,WAAW;GACnC,QAAQ,OAAO,QAAQ,IAAI;GAC3B,MAAM,OAAO,OAAO,QAAQ,OAAO;GACnC,KAAK,OAAO,KAAK;GACjB,SAAS,KAAK,OAAO,IAAI;GAEzB,IAAI,UAAU;GACd,MAAM,UAAU,SAAwC;IACtD,UAAU,KAAK,YAAY;IAC3B,MAAM,SAAS,OAAO,KAAK,WAAW,WAAW,KAAK,SAAS,KAAA;IAC/D,OAAO,cAAc,UAChB,KAAK,OAAO,UAAU,OAAO,YAAY,UAAU,OACnD,KAAK,qBAAqB;IAC/B,OAAO,cAAc,UAAW,KAAK,OAAO,SAAW,KAAK,OAAO;IACnE,KAAK,WAAW,CAAC;GACnB;GACA,MAAM,UAAU,YAA2B;IACzC,IAAI;KAAE,OAAO,MAAM,YAAY,4BAA4B,CAAC;IAAE,SACvD,OAAO;KAAE,OAAO,cAAc,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;IAAE;GAC9F;GACA,OAAO,iBAAiB,eAAe;IACrC,OAAO,WAAW;IAClB,YAAiB,8BAA8B;KAC7C,QAAQ;KACR,MAAM,KAAK,UAAU,EAAE,SAAS,CAAC,QAAQ,CAAC;IAC5C,CAAC,CAAC,CAAC,KAAK,SAAS,UAAmB;KAClC,OAAO,cAAc,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;IAC5E,CAAC,CAAC,CAAC,cAAc;KAAE,OAAO,WAAW;IAAM,CAAC;GAC9C,CAAC;GACD,KAAK,iBAAiB,eAAe;IACnC,KAAK,WAAW;IAChB,YAAiB,mCAAmC;KAClD,QAAQ;KACR,MAAM;IACR,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS;KACtB,MAAM,MAAM,OAAO,KAAK,YAAY,WAAW,KAAK,UAAU;KAC9D,IAAI,QAAQ,MAAM,UAAU,cAAc,KAAA,GAAW,MAAM,UAAU,UAAU,UAAU,GAAG;KAC5F,OAAO,cAAc,QAAQ,KAAM,KAAK,WAAW,0BAC9C,KAAK,SAAS,QAAQ,WAAW;IACxC,IAAI,UAAmB;KACrB,OAAO,cAAc,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;IAC5E,CAAC,CAAC,CAAC,cAAc;KAAE,KAAK,WAAW,CAAC;IAAQ,CAAC;GAC/C,CAAC;GACD,QAAa;GACb,OAAO;IACL,cAAc;KAAE,KAAK,OAAO;IAAE;IAC9B,cAAc;KAAE,MAAM,SAAS,CAAC,MAAM;IAAO;GAC/C;EACF;EAEA,SAAS,yBAAqC;GAC5C,IAAI;GACJ,IAAI;GACJ,IAAI,iBAAiB;GACrB,IAAI,UAAU;GACd,IAAI;GACJ,MAAM,mBAAmB,OAAO;GAChC,MAAM,WAAoC,OAAO,OAAO,EACtD,WAAW,UAAsC;IAC/C,IAAI,OAAO,UAAU,YAAY,MAAM,IAAI,UAAU,8CAA8C;IACnG,eAAe;GACjB,EACF,CAAC;GACD,MAAM,wBAA0D;GAChE,OAAO,YAAY;GAEnB,MAAM,UAAU,YAA2B;IACzC,IAAI,WAAW,SAAS,oBAAoB,UAAU;IACtD,UAAU;IACV,IAAI;KACF,MAAM,WAAW,MAAM,MAAM,4BAA4B;MACvD,OAAO;MACP,aAAa;MACb,UAAU;KACZ,CAAC;KACD,IAAI,CAAC,SAAS,MAAM,CAAC,SAAS,QAAQ,IAAI,cAAc,CAAC,EAAE,WAAW,iBAAiB,GAAG;KAC1F,MAAM,SAAS,MAAM,SAAS,KAAK;KACnC,IAAI,WAAW,gBAAgB;KAC/B,iBAAiB;KACjB,eAAe,KAAA;KACf,MAAM,SAAS,SAAS,cAAc,QAAQ;KAC9C,OAAO,cAAc,GAAG,OAAO;KAC/B,SAAS,KAAK,OAAO,MAAM;KAC3B,OAAO,OAAO;KACd,MAAM,QAAQ,gBAAgB;KAC9B,IAAI,UAAU,KAAA,GAAW;KAEzB,MAAM,WAAW,SAAS,cAAc,KAAK;KAC7C,SAAS,QAAQ,qBAAqB;KACtC,SAAS,KAAK,OAAO,QAAQ;KAC7B,IAAI;MACF,MAAM,cAAc,MAAM,OAAO,OAAO;OACtC;OACA,SAAS;OACT,MAAM;OACN;MACF,CAAC,CAAC;MACF,IAAI,gBAAgB,KAAA,KAAa,OAAO,gBAAgB,YACtD,MAAM,IAAI,UAAU,yEAAyE;MAE/F,gBAAgB;MAChB,YAAY,OAAO;MACnB,aAAa;MACb,gBAAgB,OAAO,gBAAgB,aAAa,cAAc,KAAA;KACpE,SAAS,OAAO;MACd,SAAS,OAAO;MAChB,QAAQ,MAAM,+CAA+C,KAAK;KACpE;IACF,QAAQ,CAER,UAAU;KACR,UAAU;IACZ;GACF;GACA,QAAa;GACb,MAAM,QAAQ,kBAAkB;IAAE,QAAa;GAAE,GAAG,GAAK;GACzD,aAAa;IACX,cAAc,KAAK;IACnB,gBAAgB;IAChB,YAAY,OAAO;IACnB,IAAI,qBAAqB,KAAA,GAAW,OAAO,OAAO;SAC7C,OAAO,YAAY;GAC1B;EACF;;EAGA,SAAgB,MAAM,KAA0B;GAC9C,IAAI,aAAa;IACf,MAAM,QAAQ,SAAS,cAAc,OAAO;IAC5C,MAAM,QAAQ,SAAS;IACvB,MAAM,cAAc;IACpB,SAAS,KAAK,OAAO,KAAK;IAE1B,MAAM,WAAW,eAAe,SAAS,QAAQ;IACjD,MAAM,SAAS,WAAW,KAAA,IAAY,SAAS,cAAc,OAAO;IACpE,IAAI;IACJ,IAAI,gBAAgB;IACpB,IAAI,WAAW,KAAA,GAAW;KACxB,OAAO,QAAQ,SAAS;KACxB,SAAS,KAAK,OAAO,MAAM;KAC3B,MAAM,mBAAmB,YAA2B;MAClD,IAAI,iBAAiB,SAAS,oBAAoB,UAAU;MAC5D,gBAAgB;MAChB,IAAI;OACF,MAAM,WAAW,MAAM,MAAM,6BAA6B;QACxD,OAAO;QACP,aAAa;QACb,UAAU;OACZ,CAAC;OACD,IAAI,CAAC,SAAS,MAAM,CAAC,SAAS,QAAQ,IAAI,cAAc,CAAC,EAAE,WAAW,UAAU,GAAG;OACnF,MAAM,MAAM,MAAM,SAAS,KAAK;OAChC,IAAI,OAAO,gBAAgB,KAAK,OAAO,cAAc;MACvD,QAAQ,CAER,UAAU;OACR,gBAAgB;MAClB;KACF;KACA,iBAAsB;KACtB,gBAAgB,kBAAkB;MAAE,iBAAsB;KAAE,GAAG,GAAK;IACtE;IACA,MAAM,wBAAwB,WAAW,KAAA,IAAY,uBAAuB;IAC5E,MAAM,UAAU,WAAW,eAAe,IAAI,KAAA;IAC9C,MAAM,cAAc,YAAY,KAAA,IAAY,KAAA,IAAY,IAAI,MAAM,OAAO,+BAA+B,IAAI,MAAM,SAAS;KACzH,MAAM;KACN,IAAI;IACN,IAAI,EAAE,YAAA,GAAWA,MAAAA,cAAAA,CAAc,UAAU;KACvC,WAAW;KACX,MAAM;KACN,OAAO,aAAa;KACpB,SAAS,QAAQ;IACnB,GAAG,OAAO,aAAa,IAAI,GAAG,CAAC,CAAC;IAChC,aAAa;KACX,IAAI,kBAAkB,KAAA,GAAW,cAAc,aAAa;KAC5D,cAAc;KACd,SAAS,OAAO;KAChB,wBAAwB;KACxB,QAAQ,OAAO;KACf,MAAM,OAAO;IACf;GACF,GAAG,6CAA6C;EAClD;;EAGA,MAAa,SAA4B,CAAC,OAAO;EAEjD,SAAS,eAAuB;GAC9B,OAAO,UAAU,SAAS,YAAY,CAAC,CAAC,WAAW,IAAI,IAAI,QAAQ;EACrE"}

package/lib/index.mjs

@@ -1,4 +1,4 @@
-import { X509Certificate, createHash, randomBytes, timingSafeEqual } from "node:crypto";
+import { X509Certificate, createHash, createPrivateKey, createPublicKey, randomBytes, timingSafeEqual } from "node:crypto";
 import { basename, dirname, isAbsolute, join, resolve } from "node:path";
 import z from "@deepseek-ai/schemastery";
 import { connect, isIP } from "node:net";
@@ -7,6 +7,8 @@ import { createServer, request } from "node:http";
 import { createServer as createServer$1 } from "node:https";
 import { Transform } from "node:stream";
 import { pipeline } from "node:stream/promises";
+import { networkInterfaces } from "node:os";
+import { generate } from "selfsigned";
 //#region src/access.ts
 /** Stable error categories converted to deliberately terse HTTP responses. */
 var AccessError = class extends Error {
@@ -2016,13 +2018,188 @@ var MemoryDeviceStore = class {
 	}
 };
 //#endregion
+//#region src/managed-setup.ts
+function requiredString(value, name) {
+	if (typeof value !== "string" || value.length === 0) throw new Error(`${name} must be a non-empty string`);
+	return value;
+}
+/** Validate the durable managed setup before it controls network and filesystem operations. */
+function parseManagedSetup(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error("mobile setup file must be an object");
+	const record = value;
+	if (record.version !== 2 || Reflect.ownKeys(record).some((key) => typeof key !== "string" || ![
+		"version",
+		"networkInterface",
+		"listenPort",
+		"upstreamOrigin",
+		"tls"
+	].includes(key))) throw new Error("mobile setup file has an unsupported format");
+	if (!Number.isSafeInteger(record.listenPort) || record.listenPort < 1024 || record.listenPort > 65535) throw new Error("mobile setup listenPort must be from 1024 through 65535");
+	if (typeof record.tls !== "object" || record.tls === null || Array.isArray(record.tls)) throw new Error("mobile setup tls must be an object");
+	const tls = record.tls;
+	if (tls.mode !== "managed" || Reflect.ownKeys(tls).some((key) => typeof key !== "string" || ![
+		"mode",
+		"caCertFile",
+		"caKeyFile",
+		"certFile",
+		"keyFile"
+	].includes(key))) throw new Error("mobile setup tls has an unsupported format");
+	return Object.freeze({
+		version: 2,
+		networkInterface: requiredString(record.networkInterface, "mobile setup networkInterface"),
+		listenPort: record.listenPort,
+		upstreamOrigin: requiredString(record.upstreamOrigin, "mobile setup upstreamOrigin"),
+		tls: Object.freeze({
+			mode: "managed",
+			caCertFile: requiredString(tls.caCertFile, "mobile setup tls.caCertFile"),
+			caKeyFile: requiredString(tls.caKeyFile, "mobile setup tls.caKeyFile"),
+			certFile: requiredString(tls.certFile, "mobile setup tls.certFile"),
+			keyFile: requiredString(tls.keyFile, "mobile setup tls.keyFile")
+		})
+	});
+}
+function privateIpv4(value) {
+	const parts = value.split(".").map(Number);
+	return parts.length === 4 && parts.every((part) => Number.isInteger(part) && part >= 0 && part <= 255) && (parts[0] === 10 || parts[0] === 172 && parts[1] >= 16 && parts[1] <= 31 || parts[0] === 192 && parts[1] === 168);
+}
+function networkCidr(address, cidr) {
+	const prefix = Number(cidr.slice(cidr.lastIndexOf("/") + 1));
+	const network = (address.split(".").reduce((total, part) => (total << 8 | Number(part)) >>> 0, 0) & (prefix === 0 ? 0 : 4294967295 << 32 - prefix >>> 0)) >>> 0;
+	return `${[
+		24,
+		16,
+		8,
+		0
+	].map((shift) => network >>> shift & 255).join(".")}/${String(prefix)}`;
+}
+/** List current private IPv4 candidates with their interface identity. */
+function availableLanNetworks(table = networkInterfaces()) {
+	const candidates = Object.entries(table).flatMap(([name, entries]) => (entries ?? []).filter((entry) => entry.family === "IPv4" && !entry.internal && privateIpv4(entry.address) && entry.cidr !== null).map((entry) => ({
+		name,
+		address: entry.address,
+		cidr: networkCidr(entry.address, entry.cidr)
+	})));
+	return [...new Map(candidates.map((entry) => [`${entry.name}\0${entry.address}`, entry])).values()];
+}
+/** Select an active LAN, optionally by address or by a previously saved interface name. */
+function selectLanNetwork(requestedAddress, requestedInterface, table) {
+	const candidates = availableLanNetworks(table);
+	if (requestedAddress !== void 0) {
+		const match = candidates.find((candidate) => candidate.address === requestedAddress);
+		if (match === void 0) throw new Error(`--address ${requestedAddress} is not an active private LAN address`);
+		return match;
+	}
+	if (requestedInterface !== void 0) {
+		const matches = candidates.filter((candidate) => candidate.name === requestedInterface);
+		if (matches.length === 1) return matches[0];
+		if (matches.length === 0) throw new Error(`saved LAN interface ${JSON.stringify(requestedInterface)} is not connected`);
+		throw new Error(`saved LAN interface ${JSON.stringify(requestedInterface)} has more than one private IPv4 address`);
+	}
+	if (candidates.length === 1) return candidates[0];
+	if (candidates.length === 0) throw new Error("no active private LAN address was found; connect to Wi-Fi or Ethernet");
+	throw new Error(`more than one LAN address is active; rerun with --address and one of: ${candidates.map((entry) => entry.address).join(", ")}`);
+}
+function assertMatchingCa(certPem, keyPem) {
+	const certificate = new X509Certificate(certPem);
+	if (!certificate.ca || certificate.subject !== certificate.issuer || !certificate.verify(certificate.publicKey)) throw new Error("managed TLS CA must be a self-signed CA certificate");
+	const privatePublic = createPublicKey(createPrivateKey(keyPem)).export({
+		format: "der",
+		type: "spki"
+	});
+	const certificatePublic = certificate.publicKey.export({
+		format: "der",
+		type: "spki"
+	});
+	if (!privatePublic.equals(certificatePublic)) throw new Error("managed TLS CA certificate and key do not match");
+	if (Date.parse(certificate.validFrom) > Date.now() || Date.parse(certificate.validTo) <= Date.now()) throw new Error("managed TLS CA certificate is not currently valid");
+	return certificate;
+}
+async function atomicWrite(file, contents) {
+	const directory = dirname(file);
+	await mkdir(directory, {
+		recursive: true,
+		mode: 448
+	});
+	const temporary = join(directory, `.${basename(file)}.${process.pid}.tmp`);
+	await writeFile(temporary, contents, { mode: 384 });
+	await chmod(temporary, 384);
+	await rename(temporary, file);
+}
+/** Sign and atomically install a server leaf for the interface's current address. */
+async function refreshManagedServerCertificate(setup, address) {
+	const [caCert, caKey] = await Promise.all([readFile(setup.tls.caCertFile, "utf8"), readFile(setup.tls.caKeyFile, "utf8")]);
+	assertMatchingCa(caCert, caKey);
+	const now = /* @__PURE__ */ new Date();
+	const notAfter = new Date(now);
+	notAfter.setDate(notAfter.getDate() + 397);
+	const server = await generate([{
+		name: "commonName",
+		value: "DeepSeek Harness Mobile"
+	}], {
+		keyType: "ec",
+		curve: "P-256",
+		algorithm: "sha256",
+		notBeforeDate: /* @__PURE__ */ new Date(now.getTime() - 3e5),
+		notAfterDate: notAfter,
+		ca: {
+			cert: caCert,
+			key: caKey
+		},
+		extensions: [
+			{
+				name: "basicConstraints",
+				cA: false,
+				critical: true
+			},
+			{
+				name: "keyUsage",
+				digitalSignature: true,
+				critical: true
+			},
+			{
+				name: "extKeyUsage",
+				serverAuth: true
+			},
+			{
+				name: "subjectAltName",
+				altNames: [{
+					type: 7,
+					ip: address
+				}]
+			}
+		]
+	});
+	await Promise.all([atomicWrite(setup.tls.certFile, server.cert), atomicWrite(setup.tls.keyFile, server.private)]);
+}
+/** Resolve the saved interface to the ordinary gateway config consumed by the Host plugin. */
+async function materializeManagedSetup(setup, table) {
+	const network = selectLanNetwork(void 0, setup.networkInterface, table);
+	await refreshManagedServerCertificate(setup, network.address);
+	return {
+		publicOrigin: `https://${network.address}:${String(setup.listenPort)}`,
+		listenHost: network.address,
+		upstreamOrigin: setup.upstreamOrigin,
+		allowedCidrs: [network.cidr],
+		tls: {
+			mode: "provided",
+			certFile: setup.tls.certFile,
+			keyFile: setup.tls.keyFile
+		}
+	};
+}
+//#endregion
 //#region src/plugin.ts
 /** Stable Cordis plugin name. */
 const name = "dsh-mobile";
 /** The stock WebServer is the only DSH Host service this plugin requires. */
 const inject = ["webServer"];
 function mapAdminError(error) {
-	return error instanceof HttpError ? error : new HttpError(500, "internal_error");
+	if (error instanceof HttpError) return error;
+	const code = error.code;
+	if (code === "EADDRNOTAVAIL") return new HttpError(409, "network_address_changed");
+	if (code === "EADDRINUSE") return new HttpError(409, "listen_port_in_use");
+	if (error instanceof Error && error.message.startsWith("saved LAN interface ")) return new HttpError(409, "network_interface_unavailable");
+	return new HttpError(500, "internal_error");
 }
 const SETUP_KEYS = /* @__PURE__ */ new Set([
 	"version",
@@ -2052,6 +2229,15 @@ async function loadSetup(config) {
 	}
 	if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error("mobile setup file must be an object");
 	const record = parsed;
+	if (record.version === 2) {
+		const setup = await materializeManagedSetup(parseManagedSetup(record));
+		const merged = { ...config };
+		for (const key of SETUP_KEYS) if (key !== "version") delete merged[key];
+		return {
+			...merged,
+			...setup
+		};
+	}
 	if (record.version !== 1 || Reflect.ownKeys(record).some((key) => typeof key !== "string" || !SETUP_KEYS.has(key))) throw new Error("mobile setup file has an unsupported format");
 	const { version: _version, ...setup } = record;
 	const merged = { ...config };

package/package.json

@@ -1,11 +1,11 @@
 {
   "name": "dsh-mobile",
-  "version": "0.1.0-alpha.2",
+  "version": "0.1.0-alpha.3",
   "private": false,
   "description": "Authenticated Android and mobile-browser access for the stock DeepSeek Harness Web UI",
   "type": "module",
   "bin": {
-    "dsh-mobile": "lib/cli.js"
+    "dsh-mobile": "lib/cli.js"
   },
   "main": "./lib/index.mjs",
   "types": "./lib/index.d.mts",
@@ -20,8 +20,8 @@
     "./package.json": "./package.json"
   },
   "files": [
-    "lib/**/*.mjs",
-    "lib/cli.js",
+    "lib/**/*.mjs",
+    "lib/cli.js",
     "lib/**/*.d.mts",
     "lib/client.js",
     "lib/client.js.map",