dsh-mobile 0.1.0-alpha.2 → 0.1.0-alpha.4

package/README.md

@@ -1,5 +1,5 @@
 <p align="center">
-  <img src="https://unpkg.com/dsh-mobile@0.1.0-alpha.2/assets/brand/repository-hero.png" alt="A lively whale girl using a phone beside a desktop running DSH" width="100%">
+  <img src="https://unpkg.com/dsh-mobile@latest/assets/brand/repository-hero.png" alt="A lively whale girl using a phone beside a desktop running DSH" width="100%">
 </p>
 
 <h1 align="center">DSH Mobile</h1>
@@ -61,14 +61,14 @@ pnpm dsh plugin --profile web exec dsh-mobile setup
 pnpm dsh --profile web
 ```
 
-Both paths install the public npm package into stock DSH without patching its source. Setup selects the LAN address, creates the local TLS certificate, and stores plugin data under `$DSH_HOME/mobile-access/`; run `dsh-mobile setup --help` through the same `plugin exec` command for manual network options.
+Both paths install the public npm package into stock DSH without patching its source. Setup remembers the selected LAN interface, creates one local CA, and stores plugin data under `$DSH_HOME/mobile-access/`; run `dsh-mobile setup --help` through the same `plugin exec` command for manual network options. When DHCP changes that interface's IP, the plugin follows the new address and signs a matching server certificate from the same CA on the next DSH start.
 
-1. Copy the generated `dsh-mobile-ca.cer` to Android and install it as a user CA certificate.
+1. Copy the generated `dsh-mobile-ca.cer` to Android and install it once as a user CA certificate.
 2. Open the Mobile card in the lower-left corner of the desktop DSH UI.
-3. Start access and create a pairing link. The link is copied to the clipboard.
-4. Paste the link into the Android app, or open it directly in a mobile browser.
+3. Start access and select **Create pairing key**. The key is copied to the clipboard; the same card also shows a complete browser link.
+4. Open the Android app; it finds DSH on the LAN automatically. Paste the key and connect. Alternatively, open the browser link directly on the phone.
 
-Pairing links expire after two minutes and work once. The app and each browser have separate cookie stores, so pair them separately.
+The key and browser link expire after two minutes and work once. After pairing, Android stores a revocable device credential encrypted by Android Keystore. The app can rediscover the same DSH installation on the default port after its LAN address changes and renew its short Web session without another key. Browser profiles still pair separately.
 
 ## Everyday control
 
@@ -79,6 +79,8 @@ The two access modes are equivalent:
 - Android app: a thin system WebView shell without browser address and tab bars.
 - Mobile browser: open the setup origin directly; no app installation is required.
 
+Android discovery scans only the current Wi-Fi `/24` on the default HTTPS port `3443`. It returns a stable, non-secret installation identifier; credentials never appear in discovery responses. A custom port or unusual subnet remains available through manual address entry.
+
 ## Customize the mobile Web UI
 
 This is a same-origin Web extension surface, not a fixed theme editor. DSH can edit two files on the computer:
@@ -162,7 +164,7 @@ flowchart LR
 ## Security model
 
 - The gateway accepts only the selected private LAN CIDR, exact Host, and same-origin browser requests.
-- The Android app never bypasses TLS validation. The certificate must cover the LAN address in use.
+- The Android app never bypasses TLS validation. The stable local CA signs a server certificate for the selected interface's current LAN address at each DSH start.
 - Pairing creates an HttpOnly session; devices and active sessions can be revoked from the computer.
 - Control and device-management routes are loopback-only.
 - Authentication happens before any request reaches the stock DSH loopback server. DSH itself is never rebound to `0.0.0.0`.

package/README.zh.md

@@ -1,5 +1,5 @@
 <p align="center">
-  <img src="https://unpkg.com/dsh-mobile@0.1.0-alpha.2/assets/brand/repository-hero.png" alt="鲸鱼娘拿着手机连接桌面上的 DSH" width="100%">
+  <img src="https://unpkg.com/dsh-mobile@latest/assets/brand/repository-hero.png" alt="鲸鱼娘拿着手机连接桌面上的 DSH" width="100%">
 </p>
 
 <h1 align="center">DSH Mobile</h1>
@@ -61,14 +61,14 @@ pnpm dsh plugin --profile web exec dsh-mobile setup
 pnpm dsh --profile web
 ```
 
-两种方式都会把公开 npm 包安装到原生 DSH，不修改 DSH 源码。设置向导会选择局域网地址、生成本地 TLS 证书，并把插件数据保存到 `$DSH_HOME/mobile-access/`；需要手动指定网卡或端口时，通过同一个 `plugin exec` 命令运行 `dsh-mobile setup --help`。
+两种方式都会把公开 npm 包安装到原生 DSH，不修改 DSH 源码。设置向导会记住所选局域网网卡、生成一份稳定的本地 CA，并把插件数据保存到 `$DSH_HOME/mobile-access/`；需要手动指定网卡或端口时，通过同一个 `plugin exec` 命令运行 `dsh-mobile setup --help`。DHCP 改变该网卡的 IP 后，插件会在下次启动 DSH 时跟随新地址，并用同一 CA 自动签发匹配的服务器证书。
 
-1. 将向导输出的 `dsh-mobile-ca.cer` 复制到 Android，并在系统设置中安装为用户 CA 证书。
+1. 将向导输出的 `dsh-mobile-ca.cer` 复制到 Android，并在系统设置中一次性安装为用户 CA 证书。
 2. 在电脑 DSH 左下角打开“移动端”卡片。
-3. 确认服务已开启，点击“生成配对链接”。链接会复制到剪贴板。
-4. 在 Android App 中粘贴链接，或直接在手机浏览器中打开链接。
+3. 确认服务已开启，点击“生成配对密钥”。密钥会复制到剪贴板，同一卡片也会显示完整的浏览器链接。
+4. 打开 Android App，它会自动在局域网中找到 DSH。粘贴密钥并连接；也可直接在手机浏览器打开卡片中的链接。
 
-配对链接两分钟内有效且只能使用一次。App 与浏览器拥有各自的 Cookie 存储，因此需要分别配对。
+密钥和浏览器链接两分钟内有效且只能使用一次。配对后，Android 会用 Android Keystore 加密保存可随时撤销的设备凭据。局域网 IP 变化后，App 能在默认端口重新找到同一个 DSH，并自动续期短期 Web 会话，不需要新密钥。浏览器仍需单独配对。
 
 ## 日常使用
 
@@ -79,6 +79,8 @@ pnpm dsh --profile web
 - Android App：使用系统 WebView 打开同一 DSH 页面，没有浏览器地址栏和标签栏。
 - 手机浏览器：直接访问向导显示的 `https://局域网地址:端口`，无需安装 App。
 
+Android 自动发现只扫描当前 Wi-Fi 的 `/24` 网段和默认 HTTPS 端口 `3443`。发现响应只包含稳定的非机密安装标识，不包含任何凭据。使用自定义端口或特殊子网时，仍可手动输入地址。
+
 ## 自定义移动端 Web UI
 
 这不是一个只能换颜色的主题编辑器，而是与 DSH 页面同源的 Web 扩展面。电脑上的 DSH 可以编辑两个文件：
@@ -167,7 +169,7 @@ flowchart LR
 ## 安全模型
 
 - 网关只接受设置向导选定的私有局域网 CIDR、精确 Host 和同源浏览器请求。
-- Android App 不跳过 TLS 校验；证书必须覆盖实际访问的局域网 IP。
+- Android App 不跳过 TLS 校验；稳定的本地 CA 会在每次 DSH 启动时为所选网卡的当前局域网地址签发服务器证书。
 - 配对设备获得短期 HttpOnly Session，设备和会话都可在电脑端撤销。
 - 管理接口只允许从电脑回环地址访问，移动端无法打开、关闭网关或管理其他设备。
 - 外层网关在认证后才代理到原生 DSH 的回环端口，不会把 DSH 自身绑定到 `0.0.0.0`。

package/lib/cli.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
-import { X509Certificate } from "node:crypto";
-import { chmod, mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import { chmod, mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
 import { homedir, networkInterfaces } from "node:os";
-import { join, resolve } from "node:path";
+import { basename, dirname, join, resolve } from "node:path";
+import { X509Certificate, createPrivateKey, createPublicKey } from "node:crypto";
 import { generate } from "selfsigned";
-//#region src/cli.ts
+//#region src/managed-setup.ts
 function privateIpv4(value) {
 	const parts = value.split(".").map(Number);
 	return parts.length === 4 && parts.every((part) => Number.isInteger(part) && part >= 0 && part <= 255) && (parts[0] === 10 || parts[0] === 172 && parts[1] >= 16 && parts[1] <= 31 || parts[0] === 192 && parts[1] === 168);
@@ -19,13 +19,157 @@ function networkCidr(address, cidr) {
 		0
 	].map((shift) => network >>> shift & 255).join(".")}/${String(prefix)}`;
 }
-function availableAddresses() {
-	const candidates = Object.values(networkInterfaces()).flatMap((entries) => entries ?? []).filter((entry) => entry.family === "IPv4" && !entry.internal && privateIpv4(entry.address) && entry.cidr !== null).map((entry) => ({
+/** List current private IPv4 candidates with their interface identity. */
+function availableLanNetworks(table = networkInterfaces()) {
+	const candidates = Object.entries(table).flatMap(([name, entries]) => (entries ?? []).filter((entry) => entry.family === "IPv4" && !entry.internal && privateIpv4(entry.address) && entry.cidr !== null).map((entry) => ({
+		name,
 		address: entry.address,
 		cidr: networkCidr(entry.address, entry.cidr)
-	}));
-	return [...new Map(candidates.map((entry) => [entry.address, entry])).values()];
+	})));
+	return [...new Map(candidates.map((entry) => [`${entry.name}\0${entry.address}`, entry])).values()];
+}
+/** Select an active LAN, optionally by address or by a previously saved interface name. */
+function selectLanNetwork(requestedAddress, requestedInterface, table) {
+	const candidates = availableLanNetworks(table);
+	if (requestedAddress !== void 0) {
+		const match = candidates.find((candidate) => candidate.address === requestedAddress);
+		if (match === void 0) throw new Error(`--address ${requestedAddress} is not an active private LAN address`);
+		return match;
+	}
+	if (requestedInterface !== void 0) {
+		const matches = candidates.filter((candidate) => candidate.name === requestedInterface);
+		if (matches.length === 1) return matches[0];
+		if (matches.length === 0) throw new Error(`saved LAN interface ${JSON.stringify(requestedInterface)} is not connected`);
+		throw new Error(`saved LAN interface ${JSON.stringify(requestedInterface)} has more than one private IPv4 address`);
+	}
+	if (candidates.length === 1) return candidates[0];
+	if (candidates.length === 0) throw new Error("no active private LAN address was found; connect to Wi-Fi or Ethernet");
+	throw new Error(`more than one LAN address is active; rerun with --address and one of: ${candidates.map((entry) => entry.address).join(", ")}`);
+}
+function assertMatchingCa(certPem, keyPem) {
+	const certificate = new X509Certificate(certPem);
+	if (!certificate.ca || certificate.subject !== certificate.issuer || !certificate.verify(certificate.publicKey)) throw new Error("managed TLS CA must be a self-signed CA certificate");
+	const privatePublic = createPublicKey(createPrivateKey(keyPem)).export({
+		format: "der",
+		type: "spki"
+	});
+	const certificatePublic = certificate.publicKey.export({
+		format: "der",
+		type: "spki"
+	});
+	if (!privatePublic.equals(certificatePublic)) throw new Error("managed TLS CA certificate and key do not match");
+	if (Date.parse(certificate.validFrom) > Date.now() || Date.parse(certificate.validTo) <= Date.now()) throw new Error("managed TLS CA certificate is not currently valid");
+	return certificate;
+}
+async function atomicWrite(file, contents) {
+	const directory = dirname(file);
+	await mkdir(directory, {
+		recursive: true,
+		mode: 448
+	});
+	const temporary = join(directory, `.${basename(file)}.${process.pid}.tmp`);
+	await writeFile(temporary, contents, { mode: 384 });
+	await chmod(temporary, 384);
+	await rename(temporary, file);
+}
+/** Create a long-lived CA or migrate the legacy self-signed server certificate as that CA. */
+async function ensureManagedCa(setup, legacy) {
+	let certPem;
+	let keyPem;
+	try {
+		[certPem, keyPem] = await Promise.all([readFile(setup.caCertFile, "utf8"), readFile(setup.caKeyFile, "utf8")]);
+	} catch (error) {
+		if (error.code !== "ENOENT") throw error;
+		let migrated = false;
+		if (legacy !== void 0) try {
+			[certPem, keyPem] = await Promise.all([readFile(legacy.certFile, "utf8"), readFile(legacy.keyFile, "utf8")]);
+			assertMatchingCa(certPem, keyPem);
+			migrated = true;
+		} catch (legacyError) {
+			if (legacyError.code !== "ENOENT") throw legacyError;
+		}
+		if (!migrated) {
+			const now = /* @__PURE__ */ new Date();
+			const notAfter = new Date(now);
+			notAfter.setFullYear(notAfter.getFullYear() + 5);
+			const generated = await generate([{
+				name: "commonName",
+				value: "DeepSeek Harness Mobile CA"
+			}], {
+				keyType: "ec",
+				curve: "P-256",
+				algorithm: "sha256",
+				notBeforeDate: /* @__PURE__ */ new Date(now.getTime() - 3e5),
+				notAfterDate: notAfter,
+				extensions: [{
+					name: "basicConstraints",
+					cA: true,
+					critical: true
+				}, {
+					name: "keyUsage",
+					digitalSignature: true,
+					keyCertSign: true,
+					cRLSign: true,
+					critical: true
+				}]
+			});
+			certPem = generated.cert;
+			keyPem = generated.private;
+		}
+		if (certPem === void 0 || keyPem === void 0) throw new Error("managed TLS CA creation did not produce key material");
+		await Promise.all([atomicWrite(setup.caCertFile, certPem), atomicWrite(setup.caKeyFile, keyPem)]);
+	}
+	if (certPem === void 0 || keyPem === void 0) throw new Error("managed TLS CA creation did not produce key material");
+	return assertMatchingCa(certPem, keyPem);
+}
+/** Sign and atomically install a server leaf for the interface's current address. */
+async function refreshManagedServerCertificate(setup, address) {
+	const [caCert, caKey] = await Promise.all([readFile(setup.tls.caCertFile, "utf8"), readFile(setup.tls.caKeyFile, "utf8")]);
+	assertMatchingCa(caCert, caKey);
+	const now = /* @__PURE__ */ new Date();
+	const notAfter = new Date(now);
+	notAfter.setDate(notAfter.getDate() + 397);
+	const server = await generate([{
+		name: "commonName",
+		value: "DeepSeek Harness Mobile"
+	}], {
+		keyType: "ec",
+		curve: "P-256",
+		algorithm: "sha256",
+		notBeforeDate: /* @__PURE__ */ new Date(now.getTime() - 3e5),
+		notAfterDate: notAfter,
+		ca: {
+			cert: caCert,
+			key: caKey
+		},
+		extensions: [
+			{
+				name: "basicConstraints",
+				cA: false,
+				critical: true
+			},
+			{
+				name: "keyUsage",
+				digitalSignature: true,
+				critical: true
+			},
+			{
+				name: "extKeyUsage",
+				serverAuth: true
+			},
+			{
+				name: "subjectAltName",
+				altNames: [{
+					type: 7,
+					ip: address
+				}]
+			}
+		]
+	});
+	await Promise.all([atomicWrite(setup.tls.certFile, server.cert), atomicWrite(setup.tls.keyFile, server.private)]);
 }
+//#endregion
+//#region src/cli.ts
 function parseOptions(args) {
 	let address;
 	let port = 3443;
@@ -52,30 +196,18 @@ function parseOptions(args) {
 	}
 	if (!Number.isSafeInteger(port) || port < 1024 || port > 65535) throw new Error("--port must be from 1024 through 65535");
 	if (!Number.isSafeInteger(dshPort) || dshPort < 1024 || dshPort > 65535) throw new Error("--dsh-port must be from 1024 through 65535");
-	if (address !== void 0 && !privateIpv4(address)) throw new Error("--address must be a private IPv4 address");
 	return {
 		...address === void 0 ? {} : { address },
 		port,
 		dshPort
 	};
 }
-function selectNetwork(requested) {
-	const candidates = availableAddresses();
-	if (requested !== void 0) {
-		const match = candidates.find((candidate) => candidate.address === requested);
-		if (match === void 0) throw new Error(`--address ${requested} is not an active private LAN address`);
-		return match;
-	}
-	if (candidates.length === 1) return candidates[0];
-	if (candidates.length === 0) throw new Error("no active private LAN address was found; connect to Wi-Fi or Ethernet");
-	throw new Error(`more than one LAN address is active; rerun with --address and one of: ${candidates.map((entry) => entry.address).join(", ")}`);
-}
 function dshHome() {
 	return resolve(process.env.DSH_HOME ?? join(homedir(), ".dsh"));
 }
 async function setup(args) {
 	const options = parseOptions(args);
-	const network = selectNetwork(options.address);
+	const network = selectLanNetwork(options.address);
 	const home = dshHome();
 	const directory = join(home, "mobile-access");
 	const tls = join(directory, "tls");
@@ -83,53 +215,36 @@ async function setup(args) {
 		recursive: true,
 		mode: 448
 	});
-	const now = /* @__PURE__ */ new Date();
-	const notAfter = new Date(now);
-	notAfter.setDate(notAfter.getDate() + 397);
-	const certificate = await generate([{
-		name: "commonName",
-		value: network.address
-	}], {
-		keyType: "ec",
-		curve: "P-256",
-		algorithm: "sha256",
-		notBeforeDate: /* @__PURE__ */ new Date(now.getTime() - 3e5),
-		notAfterDate: notAfter,
-		extensions: [
-			{
-				name: "basicConstraints",
-				cA: true,
-				critical: true
-			},
-			{
-				name: "keyUsage",
-				digitalSignature: true,
-				keyCertSign: true,
-				cRLSign: true,
-				critical: true
-			},
-			{
-				name: "extKeyUsage",
-				serverAuth: true
-			},
-			{
-				name: "subjectAltName",
-				altNames: [{
-					type: 7,
-					ip: network.address
-				}]
-			}
-		]
-	});
-	const certFile = join(tls, "cert.pem");
-	const keyFile = join(tls, "key.pem");
+	const legacyCertFile = join(tls, "cert.pem");
+	const legacyKeyFile = join(tls, "key.pem");
+	const certFile = join(tls, "server-cert.pem");
+	const keyFile = join(tls, "server-key.pem");
+	const caCertFile = join(tls, "ca.pem");
+	const caKeyFile = join(tls, "ca-key.pem");
 	const androidCertificate = join(tls, "dsh-mobile-ca.cer");
+	const managedTls = {
+		mode: "managed",
+		caCertFile,
+		caKeyFile,
+		certFile,
+		keyFile
+	};
+	const ca = await ensureManagedCa(managedTls, {
+		certFile: legacyCertFile,
+		keyFile: legacyKeyFile
+	});
+	const managedSetup = {
+		version: 2,
+		networkInterface: network.name,
+		listenPort: options.port,
+		upstreamOrigin: `http://127.0.0.1:${String(options.dshPort)}`,
+		tls: managedTls
+	};
+	await refreshManagedServerCertificate(managedSetup, network.address);
+	await writeFile(androidCertificate, ca.raw, { mode: 384 });
 	await Promise.all([
-		writeFile(certFile, certificate.cert, { mode: 384 }),
-		writeFile(keyFile, certificate.private, { mode: 384 }),
-		writeFile(androidCertificate, new X509Certificate(certificate.cert).raw, { mode: 384 })
-	]);
-	await Promise.all([
+		chmod(caCertFile, 384),
+		chmod(caKeyFile, 384),
 		chmod(certFile, 384),
 		chmod(keyFile, 384),
 		chmod(androidCertificate, 384)
@@ -165,19 +280,11 @@ async function setup(args) {
 	}
 	const origin = `https://${network.address}:${String(options.port)}`;
 	await Promise.all([writeFile(join(directory, "setup.json"), `${JSON.stringify({
-		version: 1,
-		publicOrigin: origin,
-		listenHost: network.address,
-		upstreamOrigin: `http://127.0.0.1:${String(options.dshPort)}`,
-		allowedCidrs: [network.cidr],
-		tls: {
-			mode: "provided",
-			certFile: certFile.replaceAll("\\", "/"),
-			keyFile: keyFile.replaceAll("\\", "/")
-		}
+		...managedSetup,
+		tls: Object.fromEntries(Object.entries(managedSetup.tls).map(([key, value]) => [key, typeof value === "string" ? value.replaceAll("\\", "/") : value]))
 	}, null, 2)}\n`, { mode: 384 }), writeFile(join(directory, "control.json"), "{\"version\":1,\"enabled\":true}\n", { mode: 384 })]);
-	console.log(`DSH Mobile is configured for ${origin}`);
-	console.log(`Install this certificate on Android before connecting: ${androidCertificate}`);
+	console.log(`DSH Mobile follows ${network.name} and is currently configured for ${origin}`);
+	console.log(`Install this CA certificate on Android once: ${androidCertificate}`);
 	console.log(`Ask DSH to customize the mobile Web UI and features in: ${customCss} and ${customScript}`);
 	console.log("Start DSH with: dsh --profile web");
 	console.log("Then open the Mobile card in the lower-left corner and create a pairing link.");

package/lib/client.js

@@ -92,9 +92,21 @@ window.__ModuleLoader__.load({
 				}
 			});
 			const body = await response.json();
-			if (!response.ok) throw new Error(typeof body.error === "string" ? body.error : `HTTP ${String(response.status)}`);
+			if (!response.ok) {
+				const code = typeof body.error === "string" ? body.error : `HTTP ${String(response.status)}`;
+				throw new Error(controlErrorMessage(code));
+			}
 			return body;
 		}
+		function controlErrorMessage(code) {
+			const zh = navigator.language.toLowerCase().startsWith("zh");
+			const message = {
+				network_address_changed: ["局域网地址已变化，请重启 DSH 后重试。", "The LAN address changed. Restart DSH and try again."],
+				network_interface_unavailable: ["保存的局域网网卡未连接，请连接网络后重启 DSH。", "The saved LAN interface is disconnected. Connect it and restart DSH."],
+				listen_port_in_use: ["移动访问端口已被占用。", "The mobile-access port is already in use."]
+			}[code];
+			return message === void 0 ? code : message[zh ? 0 : 1];
+		}
 		function mobileExtensionRequest(path, init = {}) {
 			const target = new URL(path, location.href);
 			if (target.origin !== location.origin) throw new TypeError("mobile extension requests must stay on the DSH origin");
@@ -125,7 +137,7 @@ window.__ModuleLoader__.load({
 			const toggle = element("button");
 			toggle.dataset.primary = "true";
 			const pair = element("button");
-			pair.textContent = zh ? "生成配对链接" : "Create pairing link";
+			pair.textContent = zh ? "生成配对密钥" : "Create pairing key";
 			actions.append(toggle, pair);
 			panel.append(title, status, actions);
 			root.append(panel);
@@ -163,8 +175,10 @@ window.__ModuleLoader__.load({
 					body: "{}"
 				}).then(async (data) => {
 					const url = typeof data.pairUrl === "string" ? data.pairUrl : "";
-					if (url !== "" && navigator.clipboard !== void 0) await navigator.clipboard.writeText(url);
-					status.textContent = url === "" ? zh ? "无法生成链接" : "Could not create link" : zh ? `链接已复制：${url}` : `Copied: ${url}`;
+					const token = typeof data.token === "string" ? data.token : "";
+					const copied = token !== "" ? token : url;
+					if (copied !== "" && navigator.clipboard !== void 0) await navigator.clipboard.writeText(copied);
+					status.textContent = copied === "" ? zh ? "无法生成密钥" : "Could not create key" : zh ? `配对密钥已复制：${copied}${url === "" ? "" : `\n手机浏览器链接：${url}`}` : `Pairing key copied: ${copied}${url === "" ? "" : `\nMobile browser link: ${url}`}`;
 				}, (error) => {
 					status.textContent = error instanceof Error ? error.message : String(error);
 				}).finally(() => {

package/lib/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","names":["createElement"],"sources":["../src/client.ts"],"sourcesContent":["import { createElement } from 'react'\n\ninterface ClientContext {\n  effect(effect: () => void | (() => void), label?: string): void\n  slots: {\n    inject(key: string, callback: () => (() => void)): () => void\n    register(options: { name: string; id: string }, component: (props: { wide: boolean }) => unknown): () => void\n  }\n}\n\ninterface MobileExtensionContext {\n  readonly document: Document\n  readonly request: (path: string, init?: RequestInit) => Promise<Response>\n  readonly root: HTMLElement\n  readonly window: Window\n}\n\ntype MobileExtensionMount = (context: MobileExtensionContext) => void | (() => void)\n\ninterface MobileExtensionRegistry {\n  register(mount: MobileExtensionMount): void\n}\n\ndeclare global {\n  interface Window {\n    dshMobile?: MobileExtensionRegistry\n  }\n}\n\nconst MOBILE_QUERY = '(max-width: 720px)'\n\nconst BASE_STYLES = `\n@media ${MOBILE_QUERY} {\n  :root {\n    --dsh-mobile-accent: #2563eb;\n    --dsh-mobile-font-scale: 1;\n    --dsh-mobile-radius: 14px;\n  }\n  html { font-size: calc(16px * var(--dsh-mobile-font-scale)); }\n  body { overscroll-behavior: none; }\n  button, [role='button'], input, textarea, select { min-height: 44px; }\n  input, textarea, select { font-size: 16px !important; }\n  [data-sidebar-collapsed] {\n    padding-top: env(safe-area-inset-top);\n    padding-right: env(safe-area-inset-right);\n    padding-bottom: env(safe-area-inset-bottom);\n    padding-left: env(safe-area-inset-left);\n  }\n  [data-shell-overlay] { inset: env(safe-area-inset-top) env(safe-area-inset-right) env(safe-area-inset-bottom) env(safe-area-inset-left); }\n  * { -webkit-tap-highlight-color: transparent; }\n}\n@media (prefers-reduced-motion: reduce) {\n  *, *::before, *::after { scroll-behavior: auto !important; animation-duration: 0.01ms !important; transition-duration: 0.01ms !important; }\n}\n.dsh-mobile-control {\n  position: fixed;\n  left: 68px;\n  bottom: 12px;\n  z-index: 90;\n  color: #172554;\n  font: 14px/1.45 system-ui, -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif;\n}\n.dsh-mobile-control button {\n  min-width: 44px;\n  min-height: 44px;\n  border: 1px solid #bfdbfe;\n  border-radius: 12px;\n  background: #fff;\n  color: #1e3a8a;\n  cursor: pointer;\n}\n.dsh-mobile-control__trigger {\n  width: 100%;\n  min-width: 44px;\n  min-height: 44px;\n  padding: 0 12px;\n  border: 0;\n  border-radius: 10px;\n  background: transparent;\n  color: inherit;\n  font: inherit;\n  font-weight: 700;\n  cursor: pointer;\n}\n.dsh-mobile-control__trigger:hover { background: rgb(37 99 235 / 8%); }\n.dsh-mobile-control__panel {\n  width: min(320px, calc(100vw - 24px));\n  margin-bottom: 8px;\n  padding: 16px;\n  border: 1px solid #dbeafe;\n  border-radius: 16px;\n  background: #fff;\n  box-shadow: 0 10px 30px rgb(15 23 42 / 12%);\n}\n.dsh-mobile-control__title { margin: 0 0 4px; font-size: 16px; font-weight: 800; }\n.dsh-mobile-control__status { margin: 0 0 14px; color: #475569; overflow-wrap: anywhere; }\n.dsh-mobile-control__actions { display: grid; grid-template-columns: 1fr 1fr; gap: 8px; }\n.dsh-mobile-control__actions button[data-primary='true'] { background: #2563eb; border-color: #2563eb; color: #fff; }\n.dsh-mobile-control[hidden], .dsh-mobile-control__panel[hidden] { display: none; }\n`\n\nfunction isLoopbackHost(hostname: string): boolean {\n  return hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '[::1]' || hostname === '::1'\n}\n\nfunction element<K extends keyof HTMLElementTagNameMap>(name: K, className?: string): HTMLElementTagNameMap[K] {\n  const node = document.createElement(name)\n  if (className !== undefined) node.className = className\n  return node\n}\n\nasync function requestJson(path: string, init?: RequestInit): Promise<Record<string, unknown>> {\n  const response = await fetch(path, {\n    ...init,\n    headers: { 'content-type': 'application/json', ...init?.headers },\n  })\n  const body = await response.json() as Record<string, unknown>\n  if (!response.ok) throw new Error(typeof body.error === 'string' ? body.error : `HTTP ${String(response.status)}`)\n  return body\n}\n\nfunction mobileExtensionRequest(path: string, init: RequestInit = {}): Promise<Response> {\n  const target = new URL(path, location.href)\n  if (target.origin !== location.origin) throw new TypeError('mobile extension requests must stay on the DSH origin')\n  const headers = new Headers(init.headers)\n  const method = (init.method ?? 'GET').toUpperCase()\n  if (method !== 'GET' && method !== 'HEAD' && !headers.has('x-dsh-mobile-csrf')) {\n    const csrf = document.cookie.split(';').map(entry => entry.trim())\n      .find(entry => entry.startsWith('dsh_ma_csrf='))?.slice('dsh_ma_csrf='.length)\n    if (csrf !== undefined) headers.set('x-dsh-mobile-csrf', csrf)\n  }\n  return fetch(target, {\n    ...init,\n    cache: 'no-store',\n    credentials: 'same-origin',\n    headers,\n    redirect: 'error',\n  })\n}\n\nfunction installControl(): { remove: () => void; toggle: () => void } {\n  const zh = navigator.language.toLowerCase().startsWith('zh')\n  const root = element('div', 'dsh-mobile-control')\n  const panel = element('section', 'dsh-mobile-control__panel')\n  panel.hidden = true\n  const title = element('h2', 'dsh-mobile-control__title')\n  title.textContent = zh ? '移动访问' : 'Mobile access'\n  const status = element('p', 'dsh-mobile-control__status')\n  status.textContent = zh ? '正在读取状态…' : 'Reading status…'\n  const actions = element('div', 'dsh-mobile-control__actions')\n  const toggle = element('button')\n  toggle.dataset.primary = 'true'\n  const pair = element('button')\n  pair.textContent = zh ? '生成配对链接' : 'Create pairing link'\n  actions.append(toggle, pair)\n  panel.append(title, status, actions)\n  root.append(panel)\n  document.body.append(root)\n\n  let running = false\n  const render = (data: Record<string, unknown>): void => {\n    running = data.running === true\n    const origin = typeof data.origin === 'string' ? data.origin : undefined\n    status.textContent = running\n      ? (zh ? `已开启：${origin ?? ''}` : `Running: ${origin ?? ''}`)\n      : (zh ? '已关闭。DSH 仍只在本机可用。' : 'Stopped. DSH remains local-only.')\n    toggle.textContent = running ? (zh ? '关闭' : 'Stop') : (zh ? '开启' : 'Start')\n    pair.disabled = !running\n  }\n  const refresh = async (): Promise<void> => {\n    try { render(await requestJson('/api/mobile-access/control')) }\n    catch (error) { status.textContent = error instanceof Error ? error.message : String(error) }\n  }\n  toggle.addEventListener('click', () => {\n    toggle.disabled = true\n    void requestJson('/api/mobile-access/control', {\n      method: 'POST',\n      body: JSON.stringify({ running: !running }),\n    }).then(render, (error: unknown) => {\n      status.textContent = error instanceof Error ? error.message : String(error)\n    }).finally(() => { toggle.disabled = false })\n  })\n  pair.addEventListener('click', () => {\n    pair.disabled = true\n    void requestJson('/api/mobile-access/pairing/open', {\n      method: 'POST',\n      body: '{}',\n    }).then(async (data) => {\n      const url = typeof data.pairUrl === 'string' ? data.pairUrl : ''\n      if (url !== '' && navigator.clipboard !== undefined) await navigator.clipboard.writeText(url)\n      status.textContent = url === '' ? (zh ? '无法生成链接' : 'Could not create link')\n        : (zh ? `链接已复制：${url}` : `Copied: ${url}`)\n    }, (error: unknown) => {\n      status.textContent = error instanceof Error ? error.message : String(error)\n    }).finally(() => { pair.disabled = !running })\n  })\n  void refresh()\n  return {\n    remove: () => { root.remove() },\n    toggle: () => { panel.hidden = !panel.hidden },\n  }\n}\n\nfunction installCustomExtension(): () => void {\n  let activeRoot: HTMLElement | undefined\n  let activeDispose: (() => void) | undefined\n  let observedSource = ''\n  let loading = false\n  let pendingMount: MobileExtensionMount | undefined\n  const previousRegistry = window.dshMobile\n  const registry: MobileExtensionRegistry = Object.freeze({\n    register: (mount: MobileExtensionMount): void => {\n      if (typeof mount !== 'function') throw new TypeError('dshMobile.register requires a mount function')\n      pendingMount = mount\n    },\n  })\n  const registeredMount = (): MobileExtensionMount | undefined => pendingMount\n  window.dshMobile = registry\n\n  const refresh = async (): Promise<void> => {\n    if (loading || document.visibilityState === 'hidden') return\n    loading = true\n    try {\n      const response = await fetch('/mobile-access/custom.js', {\n        cache: 'no-store',\n        credentials: 'same-origin',\n        redirect: 'error',\n      })\n      if (!response.ok || !response.headers.get('content-type')?.startsWith('text/javascript')) return\n      const source = await response.text()\n      if (source === observedSource) return\n      observedSource = source\n      pendingMount = undefined\n      const script = document.createElement('script')\n      script.textContent = `${source}\\n//# sourceURL=dsh-mobile-custom.js`\n      document.head.append(script)\n      script.remove()\n      const mount = registeredMount()\n      if (mount === undefined) return\n\n      const nextRoot = document.createElement('div')\n      nextRoot.dataset.dshMobileExtension = 'true'\n      document.body.append(nextRoot)\n      try {\n        const nextDispose = mount(Object.freeze({\n          document,\n          request: mobileExtensionRequest,\n          root: nextRoot,\n          window,\n        }))\n        if (nextDispose !== undefined && typeof nextDispose !== 'function') {\n          throw new TypeError('the mobile extension mount function must return a disposer or undefined')\n        }\n        activeDispose?.()\n        activeRoot?.remove()\n        activeRoot = nextRoot\n        activeDispose = typeof nextDispose === 'function' ? nextDispose : undefined\n      } catch (error) {\n        nextRoot.remove()\n        console.error('DSH Mobile custom extension failed to mount', error)\n      }\n    } catch {\n      // A transient LAN disconnect keeps the last successfully mounted extension.\n    } finally {\n      loading = false\n    }\n  }\n  void refresh()\n  const timer = setInterval(() => { void refresh() }, 1_000)\n  return () => {\n    clearInterval(timer)\n    activeDispose?.()\n    activeRoot?.remove()\n    if (previousRegistry === undefined) delete window.dshMobile\n    else window.dshMobile = previousRegistry\n  }\n}\n\n/** Install the responsive mobile layer and the loopback-only control card. */\nexport function apply(ctx: ClientContext): void {\n  ctx.effect(() => {\n    const style = document.createElement('style')\n    style.dataset.plugin = 'dsh-mobile'\n    style.textContent = BASE_STYLES\n    document.head.append(style)\n\n    const loopback = isLoopbackHost(location.hostname)\n    const custom = loopback ? undefined : document.createElement('style')\n    let customRefresh: ReturnType<typeof setInterval> | undefined\n    let customLoading = false\n    if (custom !== undefined) {\n      custom.dataset.plugin = 'dsh-mobile'\n      document.head.append(custom)\n      const refreshCustomCss = async (): Promise<void> => {\n        if (customLoading || document.visibilityState === 'hidden') return\n        customLoading = true\n        try {\n          const response = await fetch('/mobile-access/custom.css', {\n            cache: 'no-store',\n            credentials: 'same-origin',\n            redirect: 'error',\n          })\n          if (!response.ok || !response.headers.get('content-type')?.startsWith('text/css')) return\n          const css = await response.text()\n          if (custom.textContent !== css) custom.textContent = css\n        } catch {\n          // A transient LAN disconnect keeps the last successfully applied stylesheet.\n        } finally {\n          customLoading = false\n        }\n      }\n      void refreshCustomCss()\n      customRefresh = setInterval(() => { void refreshCustomCss() }, 1_000)\n    }\n    const removeCustomExtension = loopback ? undefined : installCustomExtension()\n    const control = loopback ? installControl() : undefined\n    const disposeSlot = control === undefined ? undefined : ctx.slots.inject('sidebar.footer.action', () => ctx.slots.register({\n      name: 'sidebar.footer.action',\n      id: 'dsh-mobile',\n    }, ({ wide }) => createElement('button', {\n      className: 'dsh-mobile-control__trigger',\n      type: 'button',\n      title: controlLabel(),\n      onClick: control.toggle,\n    }, wide ? controlLabel() : 'M')))\n    return () => {\n      if (customRefresh !== undefined) clearInterval(customRefresh)\n      disposeSlot?.()\n      control?.remove()\n      removeCustomExtension?.()\n      custom?.remove()\n      style.remove()\n    }\n  }, 'dsh-mobile: responsive UI and local control')\n}\n\n/** Client face has no service prerequisites. */\nexport const inject: readonly string[] = ['slots']\n\nfunction controlLabel(): string {\n  return navigator.language.toLowerCase().startsWith('zh') ? '移动端' : 'Mobile access'\n}\n"],"mappings":";;;;;;;;EA+BA,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAsEpB,SAAS,eAAe,UAA2B;GACjD,OAAO,aAAa,eAAe,aAAa,eAAe,aAAa,WAAW,aAAa;EACtG;EAEA,SAAS,QAA+C,MAAS,WAA8C;GAC7G,MAAM,OAAO,SAAS,cAAc,IAAI;GACxC,IAAI,cAAc,KAAA,GAAW,KAAK,YAAY;GAC9C,OAAO;EACT;EAEA,eAAe,YAAY,MAAc,MAAsD;GAC7F,MAAM,WAAW,MAAM,MAAM,MAAM;IACjC,GAAG;IACH,SAAS;KAAE,gBAAgB;KAAoB,GAAG,MAAM;IAAQ;GAClE,CAAC;GACD,MAAM,OAAO,MAAM,SAAS,KAAK;GACjC,IAAI,CAAC,SAAS,IAAI,MAAM,IAAI,MAAM,OAAO,KAAK,UAAU,WAAW,KAAK,QAAQ,QAAQ,OAAO,SAAS,MAAM,GAAG;GACjH,OAAO;EACT;EAEA,SAAS,uBAAuB,MAAc,OAAoB,CAAC,GAAsB;GACvF,MAAM,SAAS,IAAI,IAAI,MAAM,SAAS,IAAI;GAC1C,IAAI,OAAO,WAAW,SAAS,QAAQ,MAAM,IAAI,UAAU,uDAAuD;GAClH,MAAM,UAAU,IAAI,QAAQ,KAAK,OAAO;GACxC,MAAM,UAAU,KAAK,UAAU,MAAA,CAAO,YAAY;GAClD,IAAI,WAAW,SAAS,WAAW,UAAU,CAAC,QAAQ,IAAI,mBAAmB,GAAG;IAC9E,MAAM,OAAO,SAAS,OAAO,MAAM,GAAG,CAAC,CAAC,KAAI,UAAS,MAAM,KAAK,CAAC,CAAC,CAC/D,MAAK,UAAS,MAAM,WAAW,cAAc,CAAC,CAAC,EAAE,MAAM,EAAqB;IAC/E,IAAI,SAAS,KAAA,GAAW,QAAQ,IAAI,qBAAqB,IAAI;GAC/D;GACA,OAAO,MAAM,QAAQ;IACnB,GAAG;IACH,OAAO;IACP,aAAa;IACb;IACA,UAAU;GACZ,CAAC;EACH;EAEA,SAAS,iBAA6D;GACpE,MAAM,KAAK,UAAU,SAAS,YAAY,CAAC,CAAC,WAAW,IAAI;GAC3D,MAAM,OAAO,QAAQ,OAAO,oBAAoB;GAChD,MAAM,QAAQ,QAAQ,WAAW,2BAA2B;GAC5D,MAAM,SAAS;GACf,MAAM,QAAQ,QAAQ,MAAM,2BAA2B;GACvD,MAAM,cAAc,KAAK,SAAS;GAClC,MAAM,SAAS,QAAQ,KAAK,4BAA4B;GACxD,OAAO,cAAc,KAAK,YAAY;GACtC,MAAM,UAAU,QAAQ,OAAO,6BAA6B;GAC5D,MAAM,SAAS,QAAQ,QAAQ;GAC/B,OAAO,QAAQ,UAAU;GACzB,MAAM,OAAO,QAAQ,QAAQ;GAC7B,KAAK,cAAc,KAAK,WAAW;GACnC,QAAQ,OAAO,QAAQ,IAAI;GAC3B,MAAM,OAAO,OAAO,QAAQ,OAAO;GACnC,KAAK,OAAO,KAAK;GACjB,SAAS,KAAK,OAAO,IAAI;GAEzB,IAAI,UAAU;GACd,MAAM,UAAU,SAAwC;IACtD,UAAU,KAAK,YAAY;IAC3B,MAAM,SAAS,OAAO,KAAK,WAAW,WAAW,KAAK,SAAS,KAAA;IAC/D,OAAO,cAAc,UAChB,KAAK,OAAO,UAAU,OAAO,YAAY,UAAU,OACnD,KAAK,qBAAqB;IAC/B,OAAO,cAAc,UAAW,KAAK,OAAO,SAAW,KAAK,OAAO;IACnE,KAAK,WAAW,CAAC;GACnB;GACA,MAAM,UAAU,YAA2B;IACzC,IAAI;KAAE,OAAO,MAAM,YAAY,4BAA4B,CAAC;IAAE,SACvD,OAAO;KAAE,OAAO,cAAc,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;IAAE;GAC9F;GACA,OAAO,iBAAiB,eAAe;IACrC,OAAO,WAAW;IAClB,YAAiB,8BAA8B;KAC7C,QAAQ;KACR,MAAM,KAAK,UAAU,EAAE,SAAS,CAAC,QAAQ,CAAC;IAC5C,CAAC,CAAC,CAAC,KAAK,SAAS,UAAmB;KAClC,OAAO,cAAc,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;IAC5E,CAAC,CAAC,CAAC,cAAc;KAAE,OAAO,WAAW;IAAM,CAAC;GAC9C,CAAC;GACD,KAAK,iBAAiB,eAAe;IACnC,KAAK,WAAW;IAChB,YAAiB,mCAAmC;KAClD,QAAQ;KACR,MAAM;IACR,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS;KACtB,MAAM,MAAM,OAAO,KAAK,YAAY,WAAW,KAAK,UAAU;KAC9D,IAAI,QAAQ,MAAM,UAAU,cAAc,KAAA,GAAW,MAAM,UAAU,UAAU,UAAU,GAAG;KAC5F,OAAO,cAAc,QAAQ,KAAM,KAAK,WAAW,0BAC9C,KAAK,SAAS,QAAQ,WAAW;IACxC,IAAI,UAAmB;KACrB,OAAO,cAAc,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;IAC5E,CAAC,CAAC,CAAC,cAAc;KAAE,KAAK,WAAW,CAAC;IAAQ,CAAC;GAC/C,CAAC;GACD,QAAa;GACb,OAAO;IACL,cAAc;KAAE,KAAK,OAAO;IAAE;IAC9B,cAAc;KAAE,MAAM,SAAS,CAAC,MAAM;IAAO;GAC/C;EACF;EAEA,SAAS,yBAAqC;GAC5C,IAAI;GACJ,IAAI;GACJ,IAAI,iBAAiB;GACrB,IAAI,UAAU;GACd,IAAI;GACJ,MAAM,mBAAmB,OAAO;GAChC,MAAM,WAAoC,OAAO,OAAO,EACtD,WAAW,UAAsC;IAC/C,IAAI,OAAO,UAAU,YAAY,MAAM,IAAI,UAAU,8CAA8C;IACnG,eAAe;GACjB,EACF,CAAC;GACD,MAAM,wBAA0D;GAChE,OAAO,YAAY;GAEnB,MAAM,UAAU,YAA2B;IACzC,IAAI,WAAW,SAAS,oBAAoB,UAAU;IACtD,UAAU;IACV,IAAI;KACF,MAAM,WAAW,MAAM,MAAM,4BAA4B;MACvD,OAAO;MACP,aAAa;MACb,UAAU;KACZ,CAAC;KACD,IAAI,CAAC,SAAS,MAAM,CAAC,SAAS,QAAQ,IAAI,cAAc,CAAC,EAAE,WAAW,iBAAiB,GAAG;KAC1F,MAAM,SAAS,MAAM,SAAS,KAAK;KACnC,IAAI,WAAW,gBAAgB;KAC/B,iBAAiB;KACjB,eAAe,KAAA;KACf,MAAM,SAAS,SAAS,cAAc,QAAQ;KAC9C,OAAO,cAAc,GAAG,OAAO;KAC/B,SAAS,KAAK,OAAO,MAAM;KAC3B,OAAO,OAAO;KACd,MAAM,QAAQ,gBAAgB;KAC9B,IAAI,UAAU,KAAA,GAAW;KAEzB,MAAM,WAAW,SAAS,cAAc,KAAK;KAC7C,SAAS,QAAQ,qBAAqB;KACtC,SAAS,KAAK,OAAO,QAAQ;KAC7B,IAAI;MACF,MAAM,cAAc,MAAM,OAAO,OAAO;OACtC;OACA,SAAS;OACT,MAAM;OACN;MACF,CAAC,CAAC;MACF,IAAI,gBAAgB,KAAA,KAAa,OAAO,gBAAgB,YACtD,MAAM,IAAI,UAAU,yEAAyE;MAE/F,gBAAgB;MAChB,YAAY,OAAO;MACnB,aAAa;MACb,gBAAgB,OAAO,gBAAgB,aAAa,cAAc,KAAA;KACpE,SAAS,OAAO;MACd,SAAS,OAAO;MAChB,QAAQ,MAAM,+CAA+C,KAAK;KACpE;IACF,QAAQ,CAER,UAAU;KACR,UAAU;IACZ;GACF;GACA,QAAa;GACb,MAAM,QAAQ,kBAAkB;IAAE,QAAa;GAAE,GAAG,GAAK;GACzD,aAAa;IACX,cAAc,KAAK;IACnB,gBAAgB;IAChB,YAAY,OAAO;IACnB,IAAI,qBAAqB,KAAA,GAAW,OAAO,OAAO;SAC7C,OAAO,YAAY;GAC1B;EACF;;EAGA,SAAgB,MAAM,KAA0B;GAC9C,IAAI,aAAa;IACf,MAAM,QAAQ,SAAS,cAAc,OAAO;IAC5C,MAAM,QAAQ,SAAS;IACvB,MAAM,cAAc;IACpB,SAAS,KAAK,OAAO,KAAK;IAE1B,MAAM,WAAW,eAAe,SAAS,QAAQ;IACjD,MAAM,SAAS,WAAW,KAAA,IAAY,SAAS,cAAc,OAAO;IACpE,IAAI;IACJ,IAAI,gBAAgB;IACpB,IAAI,WAAW,KAAA,GAAW;KACxB,OAAO,QAAQ,SAAS;KACxB,SAAS,KAAK,OAAO,MAAM;KAC3B,MAAM,mBAAmB,YAA2B;MAClD,IAAI,iBAAiB,SAAS,oBAAoB,UAAU;MAC5D,gBAAgB;MAChB,IAAI;OACF,MAAM,WAAW,MAAM,MAAM,6BAA6B;QACxD,OAAO;QACP,aAAa;QACb,UAAU;OACZ,CAAC;OACD,IAAI,CAAC,SAAS,MAAM,CAAC,SAAS,QAAQ,IAAI,cAAc,CAAC,EAAE,WAAW,UAAU,GAAG;OACnF,MAAM,MAAM,MAAM,SAAS,KAAK;OAChC,IAAI,OAAO,gBAAgB,KAAK,OAAO,cAAc;MACvD,QAAQ,CAER,UAAU;OACR,gBAAgB;MAClB;KACF;KACA,iBAAsB;KACtB,gBAAgB,kBAAkB;MAAE,iBAAsB;KAAE,GAAG,GAAK;IACtE;IACA,MAAM,wBAAwB,WAAW,KAAA,IAAY,uBAAuB;IAC5E,MAAM,UAAU,WAAW,eAAe,IAAI,KAAA;IAC9C,MAAM,cAAc,YAAY,KAAA,IAAY,KAAA,IAAY,IAAI,MAAM,OAAO,+BAA+B,IAAI,MAAM,SAAS;KACzH,MAAM;KACN,IAAI;IACN,IAAI,EAAE,YAAA,GAAWA,MAAAA,cAAAA,CAAc,UAAU;KACvC,WAAW;KACX,MAAM;KACN,OAAO,aAAa;KACpB,SAAS,QAAQ;IACnB,GAAG,OAAO,aAAa,IAAI,GAAG,CAAC,CAAC;IAChC,aAAa;KACX,IAAI,kBAAkB,KAAA,GAAW,cAAc,aAAa;KAC5D,cAAc;KACd,SAAS,OAAO;KAChB,wBAAwB;KACxB,QAAQ,OAAO;KACf,MAAM,OAAO;IACf;GACF,GAAG,6CAA6C;EAClD;;EAGA,MAAa,SAA4B,CAAC,OAAO;EAEjD,SAAS,eAAuB;GAC9B,OAAO,UAAU,SAAS,YAAY,CAAC,CAAC,WAAW,IAAI,IAAI,QAAQ;EACrE"}
+{"version":3,"file":"client.js","names":["createElement"],"sources":["../src/client.ts"],"sourcesContent":["import { createElement } from 'react'\n\ninterface ClientContext {\n  effect(effect: () => void | (() => void), label?: string): void\n  slots: {\n    inject(key: string, callback: () => (() => void)): () => void\n    register(options: { name: string; id: string }, component: (props: { wide: boolean }) => unknown): () => void\n  }\n}\n\ninterface MobileExtensionContext {\n  readonly document: Document\n  readonly request: (path: string, init?: RequestInit) => Promise<Response>\n  readonly root: HTMLElement\n  readonly window: Window\n}\n\ntype MobileExtensionMount = (context: MobileExtensionContext) => void | (() => void)\n\ninterface MobileExtensionRegistry {\n  register(mount: MobileExtensionMount): void\n}\n\ndeclare global {\n  interface Window {\n    dshMobile?: MobileExtensionRegistry\n  }\n}\n\nconst MOBILE_QUERY = '(max-width: 720px)'\n\nconst BASE_STYLES = `\n@media ${MOBILE_QUERY} {\n  :root {\n    --dsh-mobile-accent: #2563eb;\n    --dsh-mobile-font-scale: 1;\n    --dsh-mobile-radius: 14px;\n  }\n  html { font-size: calc(16px * var(--dsh-mobile-font-scale)); }\n  body { overscroll-behavior: none; }\n  button, [role='button'], input, textarea, select { min-height: 44px; }\n  input, textarea, select { font-size: 16px !important; }\n  [data-sidebar-collapsed] {\n    padding-top: env(safe-area-inset-top);\n    padding-right: env(safe-area-inset-right);\n    padding-bottom: env(safe-area-inset-bottom);\n    padding-left: env(safe-area-inset-left);\n  }\n  [data-shell-overlay] { inset: env(safe-area-inset-top) env(safe-area-inset-right) env(safe-area-inset-bottom) env(safe-area-inset-left); }\n  * { -webkit-tap-highlight-color: transparent; }\n}\n@media (prefers-reduced-motion: reduce) {\n  *, *::before, *::after { scroll-behavior: auto !important; animation-duration: 0.01ms !important; transition-duration: 0.01ms !important; }\n}\n.dsh-mobile-control {\n  position: fixed;\n  left: 68px;\n  bottom: 12px;\n  z-index: 90;\n  color: #172554;\n  font: 14px/1.45 system-ui, -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif;\n}\n.dsh-mobile-control button {\n  min-width: 44px;\n  min-height: 44px;\n  border: 1px solid #bfdbfe;\n  border-radius: 12px;\n  background: #fff;\n  color: #1e3a8a;\n  cursor: pointer;\n}\n.dsh-mobile-control__trigger {\n  width: 100%;\n  min-width: 44px;\n  min-height: 44px;\n  padding: 0 12px;\n  border: 0;\n  border-radius: 10px;\n  background: transparent;\n  color: inherit;\n  font: inherit;\n  font-weight: 700;\n  cursor: pointer;\n}\n.dsh-mobile-control__trigger:hover { background: rgb(37 99 235 / 8%); }\n.dsh-mobile-control__panel {\n  width: min(320px, calc(100vw - 24px));\n  margin-bottom: 8px;\n  padding: 16px;\n  border: 1px solid #dbeafe;\n  border-radius: 16px;\n  background: #fff;\n  box-shadow: 0 10px 30px rgb(15 23 42 / 12%);\n}\n.dsh-mobile-control__title { margin: 0 0 4px; font-size: 16px; font-weight: 800; }\n.dsh-mobile-control__status { margin: 0 0 14px; color: #475569; overflow-wrap: anywhere; }\n.dsh-mobile-control__actions { display: grid; grid-template-columns: 1fr 1fr; gap: 8px; }\n.dsh-mobile-control__actions button[data-primary='true'] { background: #2563eb; border-color: #2563eb; color: #fff; }\n.dsh-mobile-control[hidden], .dsh-mobile-control__panel[hidden] { display: none; }\n`\n\nfunction isLoopbackHost(hostname: string): boolean {\n  return hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '[::1]' || hostname === '::1'\n}\n\nfunction element<K extends keyof HTMLElementTagNameMap>(name: K, className?: string): HTMLElementTagNameMap[K] {\n  const node = document.createElement(name)\n  if (className !== undefined) node.className = className\n  return node\n}\n\nasync function requestJson(path: string, init?: RequestInit): Promise<Record<string, unknown>> {\n  const response = await fetch(path, {\n    ...init,\n    headers: { 'content-type': 'application/json', ...init?.headers },\n  })\n  const body = await response.json() as Record<string, unknown>\n  if (!response.ok) {\n    const code = typeof body.error === 'string' ? body.error : `HTTP ${String(response.status)}`\n    throw new Error(controlErrorMessage(code))\n  }\n  return body\n}\n\nfunction controlErrorMessage(code: string): string {\n  const zh = navigator.language.toLowerCase().startsWith('zh')\n  const messages: Record<string, readonly [string, string]> = {\n    network_address_changed: ['局域网地址已变化，请重启 DSH 后重试。', 'The LAN address changed. Restart DSH and try again.'],\n    network_interface_unavailable: ['保存的局域网网卡未连接，请连接网络后重启 DSH。', 'The saved LAN interface is disconnected. Connect it and restart DSH.'],\n    listen_port_in_use: ['移动访问端口已被占用。', 'The mobile-access port is already in use.'],\n  }\n  const message = messages[code]\n  return message === undefined ? code : message[zh ? 0 : 1]\n}\n\nfunction mobileExtensionRequest(path: string, init: RequestInit = {}): Promise<Response> {\n  const target = new URL(path, location.href)\n  if (target.origin !== location.origin) throw new TypeError('mobile extension requests must stay on the DSH origin')\n  const headers = new Headers(init.headers)\n  const method = (init.method ?? 'GET').toUpperCase()\n  if (method !== 'GET' && method !== 'HEAD' && !headers.has('x-dsh-mobile-csrf')) {\n    const csrf = document.cookie.split(';').map(entry => entry.trim())\n      .find(entry => entry.startsWith('dsh_ma_csrf='))?.slice('dsh_ma_csrf='.length)\n    if (csrf !== undefined) headers.set('x-dsh-mobile-csrf', csrf)\n  }\n  return fetch(target, {\n    ...init,\n    cache: 'no-store',\n    credentials: 'same-origin',\n    headers,\n    redirect: 'error',\n  })\n}\n\nfunction installControl(): { remove: () => void; toggle: () => void } {\n  const zh = navigator.language.toLowerCase().startsWith('zh')\n  const root = element('div', 'dsh-mobile-control')\n  const panel = element('section', 'dsh-mobile-control__panel')\n  panel.hidden = true\n  const title = element('h2', 'dsh-mobile-control__title')\n  title.textContent = zh ? '移动访问' : 'Mobile access'\n  const status = element('p', 'dsh-mobile-control__status')\n  status.textContent = zh ? '正在读取状态…' : 'Reading status…'\n  const actions = element('div', 'dsh-mobile-control__actions')\n  const toggle = element('button')\n  toggle.dataset.primary = 'true'\n  const pair = element('button')\n  pair.textContent = zh ? '生成配对密钥' : 'Create pairing key'\n  actions.append(toggle, pair)\n  panel.append(title, status, actions)\n  root.append(panel)\n  document.body.append(root)\n\n  let running = false\n  const render = (data: Record<string, unknown>): void => {\n    running = data.running === true\n    const origin = typeof data.origin === 'string' ? data.origin : undefined\n    status.textContent = running\n      ? (zh ? `已开启：${origin ?? ''}` : `Running: ${origin ?? ''}`)\n      : (zh ? '已关闭。DSH 仍只在本机可用。' : 'Stopped. DSH remains local-only.')\n    toggle.textContent = running ? (zh ? '关闭' : 'Stop') : (zh ? '开启' : 'Start')\n    pair.disabled = !running\n  }\n  const refresh = async (): Promise<void> => {\n    try { render(await requestJson('/api/mobile-access/control')) }\n    catch (error) { status.textContent = error instanceof Error ? error.message : String(error) }\n  }\n  toggle.addEventListener('click', () => {\n    toggle.disabled = true\n    void requestJson('/api/mobile-access/control', {\n      method: 'POST',\n      body: JSON.stringify({ running: !running }),\n    }).then(render, (error: unknown) => {\n      status.textContent = error instanceof Error ? error.message : String(error)\n    }).finally(() => { toggle.disabled = false })\n  })\n  pair.addEventListener('click', () => {\n    pair.disabled = true\n    void requestJson('/api/mobile-access/pairing/open', {\n      method: 'POST',\n      body: '{}',\n    }).then(async (data) => {\n      const url = typeof data.pairUrl === 'string' ? data.pairUrl : ''\n      const token = typeof data.token === 'string' ? data.token : ''\n      const copied = token !== '' ? token : url\n      if (copied !== '' && navigator.clipboard !== undefined) await navigator.clipboard.writeText(copied)\n      status.textContent = copied === '' ? (zh ? '无法生成密钥' : 'Could not create key')\n        : (zh\n            ? `配对密钥已复制：${copied}${url === '' ? '' : `\\n手机浏览器链接：${url}`}`\n            : `Pairing key copied: ${copied}${url === '' ? '' : `\\nMobile browser link: ${url}`}`)\n    }, (error: unknown) => {\n      status.textContent = error instanceof Error ? error.message : String(error)\n    }).finally(() => { pair.disabled = !running })\n  })\n  void refresh()\n  return {\n    remove: () => { root.remove() },\n    toggle: () => { panel.hidden = !panel.hidden },\n  }\n}\n\nfunction installCustomExtension(): () => void {\n  let activeRoot: HTMLElement | undefined\n  let activeDispose: (() => void) | undefined\n  let observedSource = ''\n  let loading = false\n  let pendingMount: MobileExtensionMount | undefined\n  const previousRegistry = window.dshMobile\n  const registry: MobileExtensionRegistry = Object.freeze({\n    register: (mount: MobileExtensionMount): void => {\n      if (typeof mount !== 'function') throw new TypeError('dshMobile.register requires a mount function')\n      pendingMount = mount\n    },\n  })\n  const registeredMount = (): MobileExtensionMount | undefined => pendingMount\n  window.dshMobile = registry\n\n  const refresh = async (): Promise<void> => {\n    if (loading || document.visibilityState === 'hidden') return\n    loading = true\n    try {\n      const response = await fetch('/mobile-access/custom.js', {\n        cache: 'no-store',\n        credentials: 'same-origin',\n        redirect: 'error',\n      })\n      if (!response.ok || !response.headers.get('content-type')?.startsWith('text/javascript')) return\n      const source = await response.text()\n      if (source === observedSource) return\n      observedSource = source\n      pendingMount = undefined\n      const script = document.createElement('script')\n      script.textContent = `${source}\\n//# sourceURL=dsh-mobile-custom.js`\n      document.head.append(script)\n      script.remove()\n      const mount = registeredMount()\n      if (mount === undefined) return\n\n      const nextRoot = document.createElement('div')\n      nextRoot.dataset.dshMobileExtension = 'true'\n      document.body.append(nextRoot)\n      try {\n        const nextDispose = mount(Object.freeze({\n          document,\n          request: mobileExtensionRequest,\n          root: nextRoot,\n          window,\n        }))\n        if (nextDispose !== undefined && typeof nextDispose !== 'function') {\n          throw new TypeError('the mobile extension mount function must return a disposer or undefined')\n        }\n        activeDispose?.()\n        activeRoot?.remove()\n        activeRoot = nextRoot\n        activeDispose = typeof nextDispose === 'function' ? nextDispose : undefined\n      } catch (error) {\n        nextRoot.remove()\n        console.error('DSH Mobile custom extension failed to mount', error)\n      }\n    } catch {\n      // A transient LAN disconnect keeps the last successfully mounted extension.\n    } finally {\n      loading = false\n    }\n  }\n  void refresh()\n  const timer = setInterval(() => { void refresh() }, 1_000)\n  return () => {\n    clearInterval(timer)\n    activeDispose?.()\n    activeRoot?.remove()\n    if (previousRegistry === undefined) delete window.dshMobile\n    else window.dshMobile = previousRegistry\n  }\n}\n\n/** Install the responsive mobile layer and the loopback-only control card. */\nexport function apply(ctx: ClientContext): void {\n  ctx.effect(() => {\n    const style = document.createElement('style')\n    style.dataset.plugin = 'dsh-mobile'\n    style.textContent = BASE_STYLES\n    document.head.append(style)\n\n    const loopback = isLoopbackHost(location.hostname)\n    const custom = loopback ? undefined : document.createElement('style')\n    let customRefresh: ReturnType<typeof setInterval> | undefined\n    let customLoading = false\n    if (custom !== undefined) {\n      custom.dataset.plugin = 'dsh-mobile'\n      document.head.append(custom)\n      const refreshCustomCss = async (): Promise<void> => {\n        if (customLoading || document.visibilityState === 'hidden') return\n        customLoading = true\n        try {\n          const response = await fetch('/mobile-access/custom.css', {\n            cache: 'no-store',\n            credentials: 'same-origin',\n            redirect: 'error',\n          })\n          if (!response.ok || !response.headers.get('content-type')?.startsWith('text/css')) return\n          const css = await response.text()\n          if (custom.textContent !== css) custom.textContent = css\n        } catch {\n          // A transient LAN disconnect keeps the last successfully applied stylesheet.\n        } finally {\n          customLoading = false\n        }\n      }\n      void refreshCustomCss()\n      customRefresh = setInterval(() => { void refreshCustomCss() }, 1_000)\n    }\n    const removeCustomExtension = loopback ? undefined : installCustomExtension()\n    const control = loopback ? installControl() : undefined\n    const disposeSlot = control === undefined ? undefined : ctx.slots.inject('sidebar.footer.action', () => ctx.slots.register({\n      name: 'sidebar.footer.action',\n      id: 'dsh-mobile',\n    }, ({ wide }) => createElement('button', {\n      className: 'dsh-mobile-control__trigger',\n      type: 'button',\n      title: controlLabel(),\n      onClick: control.toggle,\n    }, wide ? controlLabel() : 'M')))\n    return () => {\n      if (customRefresh !== undefined) clearInterval(customRefresh)\n      disposeSlot?.()\n      control?.remove()\n      removeCustomExtension?.()\n      custom?.remove()\n      style.remove()\n    }\n  }, 'dsh-mobile: responsive UI and local control')\n}\n\n/** Client face has no service prerequisites. */\nexport const inject: readonly string[] = ['slots']\n\nfunction controlLabel(): string {\n  return navigator.language.toLowerCase().startsWith('zh') ? '移动端' : 'Mobile access'\n}\n"],"mappings":";;;;;;;;EA+BA,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAsEpB,SAAS,eAAe,UAA2B;GACjD,OAAO,aAAa,eAAe,aAAa,eAAe,aAAa,WAAW,aAAa;EACtG;EAEA,SAAS,QAA+C,MAAS,WAA8C;GAC7G,MAAM,OAAO,SAAS,cAAc,IAAI;GACxC,IAAI,cAAc,KAAA,GAAW,KAAK,YAAY;GAC9C,OAAO;EACT;EAEA,eAAe,YAAY,MAAc,MAAsD;GAC7F,MAAM,WAAW,MAAM,MAAM,MAAM;IACjC,GAAG;IACH,SAAS;KAAE,gBAAgB;KAAoB,GAAG,MAAM;IAAQ;GAClE,CAAC;GACD,MAAM,OAAO,MAAM,SAAS,KAAK;GACjC,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,OAAO,OAAO,KAAK,UAAU,WAAW,KAAK,QAAQ,QAAQ,OAAO,SAAS,MAAM;IACzF,MAAM,IAAI,MAAM,oBAAoB,IAAI,CAAC;GAC3C;GACA,OAAO;EACT;EAEA,SAAS,oBAAoB,MAAsB;GACjD,MAAM,KAAK,UAAU,SAAS,YAAY,CAAC,CAAC,WAAW,IAAI;GAM3D,MAAM,UAAU;IAJd,yBAAyB,CAAC,yBAAyB,qDAAqD;IACxG,+BAA+B,CAAC,6BAA6B,sEAAsE;IACnI,oBAAoB,CAAC,eAAe,2CAA2C;GAE1D,EAAE;GACzB,OAAO,YAAY,KAAA,IAAY,OAAO,QAAQ,KAAK,IAAI;EACzD;EAEA,SAAS,uBAAuB,MAAc,OAAoB,CAAC,GAAsB;GACvF,MAAM,SAAS,IAAI,IAAI,MAAM,SAAS,IAAI;GAC1C,IAAI,OAAO,WAAW,SAAS,QAAQ,MAAM,IAAI,UAAU,uDAAuD;GAClH,MAAM,UAAU,IAAI,QAAQ,KAAK,OAAO;GACxC,MAAM,UAAU,KAAK,UAAU,MAAA,CAAO,YAAY;GAClD,IAAI,WAAW,SAAS,WAAW,UAAU,CAAC,QAAQ,IAAI,mBAAmB,GAAG;IAC9E,MAAM,OAAO,SAAS,OAAO,MAAM,GAAG,CAAC,CAAC,KAAI,UAAS,MAAM,KAAK,CAAC,CAAC,CAC/D,MAAK,UAAS,MAAM,WAAW,cAAc,CAAC,CAAC,EAAE,MAAM,EAAqB;IAC/E,IAAI,SAAS,KAAA,GAAW,QAAQ,IAAI,qBAAqB,IAAI;GAC/D;GACA,OAAO,MAAM,QAAQ;IACnB,GAAG;IACH,OAAO;IACP,aAAa;IACb;IACA,UAAU;GACZ,CAAC;EACH;EAEA,SAAS,iBAA6D;GACpE,MAAM,KAAK,UAAU,SAAS,YAAY,CAAC,CAAC,WAAW,IAAI;GAC3D,MAAM,OAAO,QAAQ,OAAO,oBAAoB;GAChD,MAAM,QAAQ,QAAQ,WAAW,2BAA2B;GAC5D,MAAM,SAAS;GACf,MAAM,QAAQ,QAAQ,MAAM,2BAA2B;GACvD,MAAM,cAAc,KAAK,SAAS;GAClC,MAAM,SAAS,QAAQ,KAAK,4BAA4B;GACxD,OAAO,cAAc,KAAK,YAAY;GACtC,MAAM,UAAU,QAAQ,OAAO,6BAA6B;GAC5D,MAAM,SAAS,QAAQ,QAAQ;GAC/B,OAAO,QAAQ,UAAU;GACzB,MAAM,OAAO,QAAQ,QAAQ;GAC7B,KAAK,cAAc,KAAK,WAAW;GACnC,QAAQ,OAAO,QAAQ,IAAI;GAC3B,MAAM,OAAO,OAAO,QAAQ,OAAO;GACnC,KAAK,OAAO,KAAK;GACjB,SAAS,KAAK,OAAO,IAAI;GAEzB,IAAI,UAAU;GACd,MAAM,UAAU,SAAwC;IACtD,UAAU,KAAK,YAAY;IAC3B,MAAM,SAAS,OAAO,KAAK,WAAW,WAAW,KAAK,SAAS,KAAA;IAC/D,OAAO,cAAc,UAChB,KAAK,OAAO,UAAU,OAAO,YAAY,UAAU,OACnD,KAAK,qBAAqB;IAC/B,OAAO,cAAc,UAAW,KAAK,OAAO,SAAW,KAAK,OAAO;IACnE,KAAK,WAAW,CAAC;GACnB;GACA,MAAM,UAAU,YAA2B;IACzC,IAAI;KAAE,OAAO,MAAM,YAAY,4BAA4B,CAAC;IAAE,SACvD,OAAO;KAAE,OAAO,cAAc,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;IAAE;GAC9F;GACA,OAAO,iBAAiB,eAAe;IACrC,OAAO,WAAW;IAClB,YAAiB,8BAA8B;KAC7C,QAAQ;KACR,MAAM,KAAK,UAAU,EAAE,SAAS,CAAC,QAAQ,CAAC;IAC5C,CAAC,CAAC,CAAC,KAAK,SAAS,UAAmB;KAClC,OAAO,cAAc,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;IAC5E,CAAC,CAAC,CAAC,cAAc;KAAE,OAAO,WAAW;IAAM,CAAC;GAC9C,CAAC;GACD,KAAK,iBAAiB,eAAe;IACnC,KAAK,WAAW;IAChB,YAAiB,mCAAmC;KAClD,QAAQ;KACR,MAAM;IACR,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS;KACtB,MAAM,MAAM,OAAO,KAAK,YAAY,WAAW,KAAK,UAAU;KAC9D,MAAM,QAAQ,OAAO,KAAK,UAAU,WAAW,KAAK,QAAQ;KAC5D,MAAM,SAAS,UAAU,KAAK,QAAQ;KACtC,IAAI,WAAW,MAAM,UAAU,cAAc,KAAA,GAAW,MAAM,UAAU,UAAU,UAAU,MAAM;KAClG,OAAO,cAAc,WAAW,KAAM,KAAK,WAAW,yBACjD,KACG,WAAW,SAAS,QAAQ,KAAK,KAAK,aAAa,UACnD,uBAAuB,SAAS,QAAQ,KAAK,KAAK,0BAA0B;IACtF,IAAI,UAAmB;KACrB,OAAO,cAAc,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;IAC5E,CAAC,CAAC,CAAC,cAAc;KAAE,KAAK,WAAW,CAAC;IAAQ,CAAC;GAC/C,CAAC;GACD,QAAa;GACb,OAAO;IACL,cAAc;KAAE,KAAK,OAAO;IAAE;IAC9B,cAAc;KAAE,MAAM,SAAS,CAAC,MAAM;IAAO;GAC/C;EACF;EAEA,SAAS,yBAAqC;GAC5C,IAAI;GACJ,IAAI;GACJ,IAAI,iBAAiB;GACrB,IAAI,UAAU;GACd,IAAI;GACJ,MAAM,mBAAmB,OAAO;GAChC,MAAM,WAAoC,OAAO,OAAO,EACtD,WAAW,UAAsC;IAC/C,IAAI,OAAO,UAAU,YAAY,MAAM,IAAI,UAAU,8CAA8C;IACnG,eAAe;GACjB,EACF,CAAC;GACD,MAAM,wBAA0D;GAChE,OAAO,YAAY;GAEnB,MAAM,UAAU,YAA2B;IACzC,IAAI,WAAW,SAAS,oBAAoB,UAAU;IACtD,UAAU;IACV,IAAI;KACF,MAAM,WAAW,MAAM,MAAM,4BAA4B;MACvD,OAAO;MACP,aAAa;MACb,UAAU;KACZ,CAAC;KACD,IAAI,CAAC,SAAS,MAAM,CAAC,SAAS,QAAQ,IAAI,cAAc,CAAC,EAAE,WAAW,iBAAiB,GAAG;KAC1F,MAAM,SAAS,MAAM,SAAS,KAAK;KACnC,IAAI,WAAW,gBAAgB;KAC/B,iBAAiB;KACjB,eAAe,KAAA;KACf,MAAM,SAAS,SAAS,cAAc,QAAQ;KAC9C,OAAO,cAAc,GAAG,OAAO;KAC/B,SAAS,KAAK,OAAO,MAAM;KAC3B,OAAO,OAAO;KACd,MAAM,QAAQ,gBAAgB;KAC9B,IAAI,UAAU,KAAA,GAAW;KAEzB,MAAM,WAAW,SAAS,cAAc,KAAK;KAC7C,SAAS,QAAQ,qBAAqB;KACtC,SAAS,KAAK,OAAO,QAAQ;KAC7B,IAAI;MACF,MAAM,cAAc,MAAM,OAAO,OAAO;OACtC;OACA,SAAS;OACT,MAAM;OACN;MACF,CAAC,CAAC;MACF,IAAI,gBAAgB,KAAA,KAAa,OAAO,gBAAgB,YACtD,MAAM,IAAI,UAAU,yEAAyE;MAE/F,gBAAgB;MAChB,YAAY,OAAO;MACnB,aAAa;MACb,gBAAgB,OAAO,gBAAgB,aAAa,cAAc,KAAA;KACpE,SAAS,OAAO;MACd,SAAS,OAAO;MAChB,QAAQ,MAAM,+CAA+C,KAAK;KACpE;IACF,QAAQ,CAER,UAAU;KACR,UAAU;IACZ;GACF;GACA,QAAa;GACb,MAAM,QAAQ,kBAAkB;IAAE,QAAa;GAAE,GAAG,GAAK;GACzD,aAAa;IACX,cAAc,KAAK;IACnB,gBAAgB;IAChB,YAAY,OAAO;IACnB,IAAI,qBAAqB,KAAA,GAAW,OAAO,OAAO;SAC7C,OAAO,YAAY;GAC1B;EACF;;EAGA,SAAgB,MAAM,KAA0B;GAC9C,IAAI,aAAa;IACf,MAAM,QAAQ,SAAS,cAAc,OAAO;IAC5C,MAAM,QAAQ,SAAS;IACvB,MAAM,cAAc;IACpB,SAAS,KAAK,OAAO,KAAK;IAE1B,MAAM,WAAW,eAAe,SAAS,QAAQ;IACjD,MAAM,SAAS,WAAW,KAAA,IAAY,SAAS,cAAc,OAAO;IACpE,IAAI;IACJ,IAAI,gBAAgB;IACpB,IAAI,WAAW,KAAA,GAAW;KACxB,OAAO,QAAQ,SAAS;KACxB,SAAS,KAAK,OAAO,MAAM;KAC3B,MAAM,mBAAmB,YAA2B;MAClD,IAAI,iBAAiB,SAAS,oBAAoB,UAAU;MAC5D,gBAAgB;MAChB,IAAI;OACF,MAAM,WAAW,MAAM,MAAM,6BAA6B;QACxD,OAAO;QACP,aAAa;QACb,UAAU;OACZ,CAAC;OACD,IAAI,CAAC,SAAS,MAAM,CAAC,SAAS,QAAQ,IAAI,cAAc,CAAC,EAAE,WAAW,UAAU,GAAG;OACnF,MAAM,MAAM,MAAM,SAAS,KAAK;OAChC,IAAI,OAAO,gBAAgB,KAAK,OAAO,cAAc;MACvD,QAAQ,CAER,UAAU;OACR,gBAAgB;MAClB;KACF;KACA,iBAAsB;KACtB,gBAAgB,kBAAkB;MAAE,iBAAsB;KAAE,GAAG,GAAK;IACtE;IACA,MAAM,wBAAwB,WAAW,KAAA,IAAY,uBAAuB;IAC5E,MAAM,UAAU,WAAW,eAAe,IAAI,KAAA;IAC9C,MAAM,cAAc,YAAY,KAAA,IAAY,KAAA,IAAY,IAAI,MAAM,OAAO,+BAA+B,IAAI,MAAM,SAAS;KACzH,MAAM;KACN,IAAI;IACN,IAAI,EAAE,YAAA,GAAWA,MAAAA,cAAAA,CAAc,UAAU;KACvC,WAAW;KACX,MAAM;KACN,OAAO,aAAa;KACpB,SAAS,QAAQ;IACnB,GAAG,OAAO,aAAa,IAAI,GAAG,CAAC,CAAC;IAChC,aAAa;KACX,IAAI,kBAAkB,KAAA,GAAW,cAAc,aAAa;KAC5D,cAAc;KACd,SAAS,OAAO;KAChB,wBAAwB;KACxB,QAAQ,OAAO;KACf,MAAM,OAAO;IACf;GACF,GAAG,6CAA6C;EAClD;;EAGA,MAAa,SAA4B,CAAC,OAAO;EAEjD,SAAS,eAAuB;GAC9B,OAAO,UAAU,SAAS,YAAY,CAAC,CAAC,WAAW,IAAI,IAAI,QAAQ;EACrE"}

package/lib/index.d.mts

@@ -239,6 +239,8 @@ interface PluginConfig {
   customCssFile?: string;
   /** Optional user script that mounts authenticated mobile-only Web features. */
   customScriptFile?: string;
+  /** Stable public discovery identifier; it is not an authentication secret. */
+  instanceId?: string;
   /** First-run state used only while the control file does not exist. */
   initiallyEnabled: boolean;
   tls?: {
@@ -271,6 +273,7 @@ interface ResolvedGatewayConfig {
   readonly stateFile: string;
   readonly customCssFile: string;
   readonly customScriptFile: string;
+  readonly instanceId: string;
   readonly tls: TlsConfig;
   readonly pairingTtlMs: number;
   readonly deviceTtlMs: number;
@@ -375,6 +378,8 @@ declare class MobileAccessGateway {
   private setSessionCookies;
   private handlePair;
   private handleRenew;
+  private handleNativePair;
+  private handleNativeRenew;
   private handleLogout;
   private handleExternalRequest;
   private allocateRequest;

package/lib/index.mjs

@@ -1,4 +1,4 @@
-import { X509Certificate, createHash, randomBytes, timingSafeEqual } from "node:crypto";
+import { X509Certificate, createHash, createPrivateKey, createPublicKey, randomBytes, timingSafeEqual } from "node:crypto";
 import { basename, dirname, isAbsolute, join, resolve } from "node:path";
 import z from "@deepseek-ai/schemastery";
 import { connect, isIP } from "node:net";
@@ -7,6 +7,8 @@ import { createServer, request } from "node:http";
 import { createServer as createServer$1 } from "node:https";
 import { Transform } from "node:stream";
 import { pipeline } from "node:stream/promises";
+import { networkInterfaces } from "node:os";
+import { generate } from "selfsigned";
 //#region src/access.ts
 /** Stable error categories converted to deliberately terse HTTP responses. */
 var AccessError = class extends Error {
@@ -541,6 +543,7 @@ const Config = z.object({
 	controlFile: z.string().hidden().required(),
 	customCssFile: z.string().hidden(),
 	customScriptFile: z.string().hidden(),
+	instanceId: z.string().hidden(),
 	initiallyEnabled: z.boolean().hidden().required(),
 	tls: z.object({
 		mode: z.union([z.const("provided"), z.const("disabled")]),
@@ -662,6 +665,9 @@ function parseGatewayConfig(raw) {
 		stateFile: absoluteFile(value.stateFile, "stateFile"),
 		customCssFile: value.customCssFile === void 0 ? join(dirname(absoluteFile(value.stateFile, "stateFile")), "mobile.css") : absoluteFile(value.customCssFile, "customCssFile"),
 		customScriptFile: value.customScriptFile === void 0 ? join(dirname(absoluteFile(value.stateFile, "stateFile")), "mobile.js") : absoluteFile(value.customScriptFile, "customScriptFile"),
+		instanceId: value.instanceId === void 0 ? createHash("sha256").update(absoluteFile(value.stateFile, "stateFile")).digest("hex") : /^[a-f\d]{64}$/u.test(value.instanceId) ? value.instanceId : (() => {
+			throw new Error("instanceId must be a lowercase SHA-256 value");
+		})(),
 		tls,
 		pairingTtlMs: integer(value.pairingTtlMs, "pairingTtlMs", 12e4, 1e4, 6e5),
 		deviceTtlMs,
@@ -1467,6 +1473,33 @@ var MobileAccessGateway = class {
 			sessionExpiresAt: result.sessionExpiresAt
 		}, this.tlsEnabled);
 	}
+	async handleNativePair(request, response) {
+		const body = await readJsonObject(request, MAX_CONTROL_BODY_BYTES);
+		if (typeof body.token !== "string" || body.label !== void 0 && typeof body.label !== "string") throw new HttpError(400, "bad_request");
+		const result = await this.access.pair(request.socket.remoteAddress ?? "unknown", body.token, body.label);
+		sendJson(response, 201, {
+			instanceId: this.config.instanceId,
+			deviceId: result.deviceId,
+			deviceToken: result.deviceToken,
+			deviceExpiresAt: result.deviceExpiresAt,
+			sessionToken: result.sessionToken,
+			csrfToken: result.csrfToken,
+			sessionExpiresAt: result.sessionExpiresAt
+		}, this.tlsEnabled);
+	}
+	async handleNativeRenew(request, response) {
+		if (!this.renewLimiter.take(request.socket.remoteAddress ?? "unknown", Date.now())) throw new HttpError(429, "rate_limited");
+		const body = await readJsonObject(request, MAX_CONTROL_BODY_BYTES);
+		if (typeof body.deviceToken !== "string") throw new HttpError(400, "bad_request");
+		const result = await this.access.renew(body.deviceToken);
+		sendJson(response, 200, {
+			instanceId: this.config.instanceId,
+			deviceId: result.deviceId,
+			sessionToken: result.sessionToken,
+			csrfToken: result.csrfToken,
+			sessionExpiresAt: result.sessionExpiresAt
+		}, this.tlsEnabled);
+	}
 	async handleLogout(request, response) {
 		await readJsonObject(request, MAX_CONTROL_BODY_BYTES);
 		const authorization = this.authorize(request);
@@ -1494,6 +1527,14 @@ var MobileAccessGateway = class {
 			sendJson(response, 200, { ok: true }, this.tlsEnabled);
 			return;
 		}
+		if (target.search === "" && request.method === "GET" && target.decodedPathname === `/mobile-access/discovery`) {
+			sendJson(response, 200, {
+				protocol: 1,
+				instanceId: this.config.instanceId,
+				port: this.address().port
+			}, this.tlsEnabled);
+			return;
+		}
 		if (target.search === "" && request.method === "GET" && (target.decodedPathname === `/mobile-access/pair` || target.decodedPathname === `/mobile-access/pair.js`)) {
 			if (!this.access.pairingStatus().open) throw new HttpError(404, "not_found");
 			setSecurityHeaders(response, this.tlsEnabled);
@@ -1524,6 +1565,14 @@ var MobileAccessGateway = class {
 			await this.handleRenew(request, response);
 			return;
 		}
+		if (target.search === "" && request.method === "POST" && target.decodedPathname === `/mobile-access/auth/native-pair`) {
+			await this.handleNativePair(request, response);
+			return;
+		}
+		if (target.search === "" && request.method === "POST" && target.decodedPathname === `/mobile-access/auth/native-renew`) {
+			await this.handleNativeRenew(request, response);
+			return;
+		}
 		if (target.search === "" && request.method === "POST" && target.decodedPathname === `/mobile-access/auth/logout`) {
 			await this.handleLogout(request, response);
 			return;
@@ -2016,13 +2065,190 @@ var MemoryDeviceStore = class {
 	}
 };
 //#endregion
+//#region src/managed-setup.ts
+function requiredString(value, name) {
+	if (typeof value !== "string" || value.length === 0) throw new Error(`${name} must be a non-empty string`);
+	return value;
+}
+/** Validate the durable managed setup before it controls network and filesystem operations. */
+function parseManagedSetup(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error("mobile setup file must be an object");
+	const record = value;
+	if (record.version !== 2 || Reflect.ownKeys(record).some((key) => typeof key !== "string" || ![
+		"version",
+		"networkInterface",
+		"listenPort",
+		"upstreamOrigin",
+		"tls"
+	].includes(key))) throw new Error("mobile setup file has an unsupported format");
+	if (!Number.isSafeInteger(record.listenPort) || record.listenPort < 1024 || record.listenPort > 65535) throw new Error("mobile setup listenPort must be from 1024 through 65535");
+	if (typeof record.tls !== "object" || record.tls === null || Array.isArray(record.tls)) throw new Error("mobile setup tls must be an object");
+	const tls = record.tls;
+	if (tls.mode !== "managed" || Reflect.ownKeys(tls).some((key) => typeof key !== "string" || ![
+		"mode",
+		"caCertFile",
+		"caKeyFile",
+		"certFile",
+		"keyFile"
+	].includes(key))) throw new Error("mobile setup tls has an unsupported format");
+	return Object.freeze({
+		version: 2,
+		networkInterface: requiredString(record.networkInterface, "mobile setup networkInterface"),
+		listenPort: record.listenPort,
+		upstreamOrigin: requiredString(record.upstreamOrigin, "mobile setup upstreamOrigin"),
+		tls: Object.freeze({
+			mode: "managed",
+			caCertFile: requiredString(tls.caCertFile, "mobile setup tls.caCertFile"),
+			caKeyFile: requiredString(tls.caKeyFile, "mobile setup tls.caKeyFile"),
+			certFile: requiredString(tls.certFile, "mobile setup tls.certFile"),
+			keyFile: requiredString(tls.keyFile, "mobile setup tls.keyFile")
+		})
+	});
+}
+function privateIpv4(value) {
+	const parts = value.split(".").map(Number);
+	return parts.length === 4 && parts.every((part) => Number.isInteger(part) && part >= 0 && part <= 255) && (parts[0] === 10 || parts[0] === 172 && parts[1] >= 16 && parts[1] <= 31 || parts[0] === 192 && parts[1] === 168);
+}
+function networkCidr(address, cidr) {
+	const prefix = Number(cidr.slice(cidr.lastIndexOf("/") + 1));
+	const network = (address.split(".").reduce((total, part) => (total << 8 | Number(part)) >>> 0, 0) & (prefix === 0 ? 0 : 4294967295 << 32 - prefix >>> 0)) >>> 0;
+	return `${[
+		24,
+		16,
+		8,
+		0
+	].map((shift) => network >>> shift & 255).join(".")}/${String(prefix)}`;
+}
+/** List current private IPv4 candidates with their interface identity. */
+function availableLanNetworks(table = networkInterfaces()) {
+	const candidates = Object.entries(table).flatMap(([name, entries]) => (entries ?? []).filter((entry) => entry.family === "IPv4" && !entry.internal && privateIpv4(entry.address) && entry.cidr !== null).map((entry) => ({
+		name,
+		address: entry.address,
+		cidr: networkCidr(entry.address, entry.cidr)
+	})));
+	return [...new Map(candidates.map((entry) => [`${entry.name}\0${entry.address}`, entry])).values()];
+}
+/** Select an active LAN, optionally by address or by a previously saved interface name. */
+function selectLanNetwork(requestedAddress, requestedInterface, table) {
+	const candidates = availableLanNetworks(table);
+	if (requestedAddress !== void 0) {
+		const match = candidates.find((candidate) => candidate.address === requestedAddress);
+		if (match === void 0) throw new Error(`--address ${requestedAddress} is not an active private LAN address`);
+		return match;
+	}
+	if (requestedInterface !== void 0) {
+		const matches = candidates.filter((candidate) => candidate.name === requestedInterface);
+		if (matches.length === 1) return matches[0];
+		if (matches.length === 0) throw new Error(`saved LAN interface ${JSON.stringify(requestedInterface)} is not connected`);
+		throw new Error(`saved LAN interface ${JSON.stringify(requestedInterface)} has more than one private IPv4 address`);
+	}
+	if (candidates.length === 1) return candidates[0];
+	if (candidates.length === 0) throw new Error("no active private LAN address was found; connect to Wi-Fi or Ethernet");
+	throw new Error(`more than one LAN address is active; rerun with --address and one of: ${candidates.map((entry) => entry.address).join(", ")}`);
+}
+function assertMatchingCa(certPem, keyPem) {
+	const certificate = new X509Certificate(certPem);
+	if (!certificate.ca || certificate.subject !== certificate.issuer || !certificate.verify(certificate.publicKey)) throw new Error("managed TLS CA must be a self-signed CA certificate");
+	const privatePublic = createPublicKey(createPrivateKey(keyPem)).export({
+		format: "der",
+		type: "spki"
+	});
+	const certificatePublic = certificate.publicKey.export({
+		format: "der",
+		type: "spki"
+	});
+	if (!privatePublic.equals(certificatePublic)) throw new Error("managed TLS CA certificate and key do not match");
+	if (Date.parse(certificate.validFrom) > Date.now() || Date.parse(certificate.validTo) <= Date.now()) throw new Error("managed TLS CA certificate is not currently valid");
+	return certificate;
+}
+async function atomicWrite(file, contents) {
+	const directory = dirname(file);
+	await mkdir(directory, {
+		recursive: true,
+		mode: 448
+	});
+	const temporary = join(directory, `.${basename(file)}.${process.pid}.tmp`);
+	await writeFile(temporary, contents, { mode: 384 });
+	await chmod(temporary, 384);
+	await rename(temporary, file);
+}
+/** Sign and atomically install a server leaf for the interface's current address. */
+async function refreshManagedServerCertificate(setup, address) {
+	const [caCert, caKey] = await Promise.all([readFile(setup.tls.caCertFile, "utf8"), readFile(setup.tls.caKeyFile, "utf8")]);
+	assertMatchingCa(caCert, caKey);
+	const now = /* @__PURE__ */ new Date();
+	const notAfter = new Date(now);
+	notAfter.setDate(notAfter.getDate() + 397);
+	const server = await generate([{
+		name: "commonName",
+		value: "DeepSeek Harness Mobile"
+	}], {
+		keyType: "ec",
+		curve: "P-256",
+		algorithm: "sha256",
+		notBeforeDate: /* @__PURE__ */ new Date(now.getTime() - 3e5),
+		notAfterDate: notAfter,
+		ca: {
+			cert: caCert,
+			key: caKey
+		},
+		extensions: [
+			{
+				name: "basicConstraints",
+				cA: false,
+				critical: true
+			},
+			{
+				name: "keyUsage",
+				digitalSignature: true,
+				critical: true
+			},
+			{
+				name: "extKeyUsage",
+				serverAuth: true
+			},
+			{
+				name: "subjectAltName",
+				altNames: [{
+					type: 7,
+					ip: address
+				}]
+			}
+		]
+	});
+	await Promise.all([atomicWrite(setup.tls.certFile, server.cert), atomicWrite(setup.tls.keyFile, server.private)]);
+}
+/** Resolve the saved interface to the ordinary gateway config consumed by the Host plugin. */
+async function materializeManagedSetup(setup, table) {
+	const network = selectLanNetwork(void 0, setup.networkInterface, table);
+	await refreshManagedServerCertificate(setup, network.address);
+	const ca = new X509Certificate(await readFile(setup.tls.caCertFile, "utf8"));
+	return {
+		publicOrigin: `https://${network.address}:${String(setup.listenPort)}`,
+		listenHost: network.address,
+		upstreamOrigin: setup.upstreamOrigin,
+		allowedCidrs: [network.cidr],
+		instanceId: ca.fingerprint256.replaceAll(":", "").toLowerCase(),
+		tls: {
+			mode: "provided",
+			certFile: setup.tls.certFile,
+			keyFile: setup.tls.keyFile
+		}
+	};
+}
+//#endregion
 //#region src/plugin.ts
 /** Stable Cordis plugin name. */
 const name = "dsh-mobile";
 /** The stock WebServer is the only DSH Host service this plugin requires. */
 const inject = ["webServer"];
 function mapAdminError(error) {
-	return error instanceof HttpError ? error : new HttpError(500, "internal_error");
+	if (error instanceof HttpError) return error;
+	const code = error.code;
+	if (code === "EADDRNOTAVAIL") return new HttpError(409, "network_address_changed");
+	if (code === "EADDRINUSE") return new HttpError(409, "listen_port_in_use");
+	if (error instanceof Error && error.message.startsWith("saved LAN interface ")) return new HttpError(409, "network_interface_unavailable");
+	return new HttpError(500, "internal_error");
 }
 const SETUP_KEYS = /* @__PURE__ */ new Set([
 	"version",
@@ -2032,6 +2258,7 @@ const SETUP_KEYS = /* @__PURE__ */ new Set([
 	"upstreamOrigin",
 	"publicAuthorities",
 	"allowedCidrs",
+	"instanceId",
 	"tls"
 ]);
 async function loadSetup(config) {
@@ -2052,6 +2279,15 @@ async function loadSetup(config) {
 	}
 	if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error("mobile setup file must be an object");
 	const record = parsed;
+	if (record.version === 2) {
+		const setup = await materializeManagedSetup(parseManagedSetup(record));
+		const merged = { ...config };
+		for (const key of SETUP_KEYS) if (key !== "version") delete merged[key];
+		return {
+			...merged,
+			...setup
+		};
+	}
 	if (record.version !== 1 || Reflect.ownKeys(record).some((key) => typeof key !== "string" || !SETUP_KEYS.has(key))) throw new Error("mobile setup file has an unsupported format");
 	const { version: _version, ...setup } = record;
 	const merged = { ...config };

package/package.json

@@ -1,11 +1,11 @@
 {
   "name": "dsh-mobile",
-  "version": "0.1.0-alpha.2",
+  "version": "0.1.0-alpha.4",
   "private": false,
   "description": "Authenticated Android and mobile-browser access for the stock DeepSeek Harness Web UI",
   "type": "module",
   "bin": {
-    "dsh-mobile": "lib/cli.js"
+    "dsh-mobile": "lib/cli.js"
   },
   "main": "./lib/index.mjs",
   "types": "./lib/index.d.mts",
@@ -20,8 +20,8 @@
     "./package.json": "./package.json"
   },
   "files": [
-    "lib/**/*.mjs",
-    "lib/cli.js",
+    "lib/**/*.mjs",
+    "lib/cli.js",
     "lib/**/*.d.mts",
     "lib/client.js",
     "lib/client.js.map",