dsh-vpn 0.1.0

package/lib/client.js

@@ -0,0 +1,1346 @@
+window.__ModuleLoader__.load({
+	id: "dsh-vpn",
+	factory: (require) => {
+		var module = { exports: {} };
+		var exports = module.exports;
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/client/index.ts
+var index_exports = {};
+__export(index_exports, {
+  PACKAGE_NAME: () => PACKAGE_NAME,
+  apply: () => apply,
+  inject: () => inject
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/client/api.ts
+async function post(path, body = {}) {
+  try {
+    const res = await fetch(new URL(`/api/dsh-vpn${path}`, document.baseURI), {
+      method: "POST",
+      credentials: "same-origin",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify(body)
+    });
+    const value = await res.json().catch(() => null);
+    if (value && typeof value === "object" && "ok" in value) return value;
+    return { ok: false, error: "http", message: `HTTP ${res.status}` };
+  } catch (err) {
+    return { ok: false, error: "network", message: err instanceof Error ? err.message : String(err) };
+  }
+}
+var vpnApi = {
+  getSettings: () => post("/settings/get"),
+  saveSettings: (form) => post("/settings/save", form),
+  forgetHostKey: () => post("/host-key/forget"),
+  test: () => post("/test"),
+  status: () => post("/status"),
+  links: () => post("/links"),
+  install: (regenerate) => post("/install", { regenerate }),
+  uninstall: () => post("/uninstall")
+};
+
+// src/client/locales.ts
+var NS = "dsh-vpn";
+var zh = {
+  title: "VPN \u8282\u70B9",
+  description: "\u5728\u4F60\u7684 VPS \u4E0A\u4E00\u952E\u90E8\u7F72 sing-box\uFF0C\u5E76\u7528\u4E8C\u7EF4\u7801\u5BFC\u5165\u624B\u673A\u6216\u7535\u8111\u4E0A\u7684\u4EE3\u7406\u5BA2\u6237\u7AEF\u3002",
+  serverSection: "\u670D\u52A1\u5668",
+  host: "\u670D\u52A1\u5668 IP \u6216\u57DF\u540D",
+  hostHint: "\u4F60\u8D2D\u4E70\u7684 VPS \u7684\u516C\u7F51\u5730\u5740\u3002",
+  port: "SSH \u7AEF\u53E3",
+  username: "\u7528\u6237\u540D",
+  usernameHint: "\u5EFA\u8BAE\u7528 root\uFF1B\u5176\u4ED6\u7528\u6237\u9700\u8981\u6709 sudo \u6743\u9650\u3002",
+  password: "\u5BC6\u7801",
+  passwordSaved: "\u5DF2\u4FDD\u5B58\uFF08\u7559\u7A7A\u5219\u4E0D\u4FEE\u6539\uFF09",
+  passwordEmpty: "\u767B\u5F55 VPS \u7684\u5BC6\u7801",
+  linkAddress: "\u8282\u70B9\u5730\u5740\uFF08\u53EF\u9009\uFF09",
+  linkAddressHint: "\u5199\u8FDB\u8282\u70B9\u94FE\u63A5\u7684\u5730\u5740\uFF0C\u7559\u7A7A\u5219\u4F7F\u7528\u670D\u52A1\u5668 IP\u3002\u7528\u4E8E NAT \u673A\u5668\u6216\u57DF\u540D\u3002",
+  hostKey: "\u4E3B\u673A\u6307\u7EB9",
+  hostKeyHint: "\u9996\u6B21\u8FDE\u63A5\u65F6\u8BB0\u5F55\u3002\u4EE5\u540E\u5982\u679C\u6307\u7EB9\u53D8\u5316\u4F1A\u62D2\u7EDD\u8FDE\u63A5\uFF0C\u9632\u6B62\u5BC6\u7801\u88AB\u4E2D\u95F4\u4EBA\u622A\u83B7\u3002",
+  hostKeyNone: "\u5C1A\u672A\u8FDE\u63A5\u8FC7",
+  forgetHostKey: "\u91CD\u7F6E\u6307\u7EB9",
+  save: "\u4FDD\u5B58",
+  saved: "\u5DF2\u4FDD\u5B58",
+  test: "\u6D4B\u8BD5\u8FDE\u63A5",
+  testOk: "\u8FDE\u63A5\u6210\u529F\uFF1A{system}\uFF0C\u53EF\u4EE5\u83B7\u5F97 root \u6743\u9650\u3002",
+  unsaved: "\u6709\u672A\u4FDD\u5B58\u7684\u4FEE\u6539\uFF0C\u8BF7\u5148\u4FDD\u5B58\u3002",
+  protocolSection: "\u534F\u8BAE",
+  protocolHint: "\u52FE\u9009\u8981\u5B89\u88C5\u7684\u534F\u8BAE\uFF0C\u4FDD\u5B58\u540E\u70B9\u300C\u5B89\u88C5 / \u66F4\u65B0\u300D\u751F\u6548\u3002",
+  insecureTag: "\u9700\u8DF3\u8FC7\u8BC1\u4E66\u6821\u9A8C",
+  insecureHint: "\u8BE5\u534F\u8BAE\u7684\u5206\u4EAB\u94FE\u63A5\u65E0\u6CD5\u9501\u5B9A\u8BC1\u4E66\uFF0C\u5BA2\u6237\u7AEF\u4F1A\u8DF3\u8FC7\u8BC1\u4E66\u6821\u9A8C\uFF0C\u5B89\u5168\u6027\u8F83\u4F4E\u3002",
+  certSection: "\u8BC1\u4E66",
+  certHint: "\u7528\u4E8E Hysteria2\u3001TUIC\u3001AnyTLS\u3002Reality \u548C Shadowsocks \u4E0D\u9700\u8981\u8BC1\u4E66\u3002",
+  certSelf: "\u81EA\u7B7E\u8BC1\u4E66",
+  certSelfHint: "\u65E0\u9700\u4EFB\u4F55\u51C6\u5907\u3002Hysteria2 \u4F1A\u9501\u5B9A\u8BC1\u4E66\uFF1BTUIC \u548C AnyTLS \u7684\u5BA2\u6237\u7AEF\u9700\u8DF3\u8FC7\u8BC1\u4E66\u6821\u9A8C\u3002",
+  certIp: "IP \u8BC1\u4E66\uFF08\u63A8\u8350\uFF09",
+  certIpHint: "\u514D\u8D39\u5411 Let's Encrypt \u7533\u8BF7\u7B7E\u53D1\u7ED9\u670D\u52A1\u5668 IP \u7684\u6B63\u89C4\u8BC1\u4E66\uFF0C\u6240\u6709\u5BA2\u6237\u7AEF\u6B63\u5E38\u6821\u9A8C\uFF0C\u65E0\u9700\u57DF\u540D\u3002\u8BC1\u4E66\u6709\u6548\u671F 6 \u5929\uFF0Csing-box \u81EA\u52A8\u7EED\u671F\uFF0C\u9700\u8981\u5728\u5B89\u5168\u7EC4\u91CC\u4E00\u76F4\u5F00\u653E TCP 80 \u7AEF\u53E3\u3002",
+  certExpires: "IP \u8BC1\u4E66\u6709\u6548\u671F\u81F3 {date}\uFF08\u5269\u4F59\u7EA6 {hours} \u5C0F\u65F6\uFF09\uFF0C\u4F1A\u81EA\u52A8\u7EED\u671F\u3002",
+  certNotIssued: "IP \u8BC1\u4E66\u5C1A\u672A\u7B7E\u53D1\u3002",
+  certExpiring: "IP \u8BC1\u4E66\u5C06\u5728 {hours} \u5C0F\u65F6\u5185\u8FC7\u671F\uFF0C\u4F46\u8FD8\u6CA1\u6709\u7EED\u671F\u6210\u529F\u3002\u8BF7\u786E\u8BA4\u5B89\u5168\u7EC4\u4E00\u76F4\u5F00\u653E TCP 80 \u7AEF\u53E3\uFF0C\u5426\u5219\u8BC1\u4E66\u8FC7\u671F\u540E\u8282\u70B9\u5C06\u65E0\u6CD5\u8FDE\u63A5\u3002",
+  certExpired: "IP \u8BC1\u4E66\u5DF2\u8FC7\u671F\uFF0C\u5BA2\u6237\u7AEF\u5C06\u65E0\u6CD5\u8FDE\u63A5\uFF01\u8BF7\u5728\u5B89\u5168\u7EC4\u5F00\u653E TCP 80 \u7AEF\u53E3\u540E\u70B9\u300C\u5B89\u88C5 / \u66F4\u65B0\u300D\uFF0C\u6216\u6539\u7528\u81EA\u7B7E\u8BC1\u4E66\u3002",
+  deploySection: "\u90E8\u7F72",
+  install: "\u5B89\u88C5 / \u66F4\u65B0",
+  regenerate: "\u91CD\u65B0\u751F\u6210\u5BC6\u94A5\uFF08\u65E7\u94FE\u63A5\u5168\u90E8\u5931\u6548\uFF09",
+  uninstall: "\u5378\u8F7D",
+  confirmUninstall: "\u786E\u8BA4\u5378\u8F7D\uFF1F",
+  confirmRegenerate: "\u786E\u8BA4\u91CD\u65B0\u751F\u6210\uFF1F",
+  cancel: "\u53D6\u6D88",
+  status: "\u67E5\u770B\u72B6\u6001",
+  statusActive: "sing-box {version} \u8FD0\u884C\u4E2D\u3002",
+  statusInactive: "sing-box \u5DF2\u5B89\u88C5\u4F46\u672A\u8FD0\u884C\u3002",
+  statusNotInstalled: "\u5C1A\u672A\u5B89\u88C5\u3002",
+  listening: "\u76D1\u542C",
+  installed: "\u5B89\u88C5\u5B8C\u6210\u3002",
+  uninstalled: "\u5DF2\u5378\u8F7D\u3002",
+  working: "\u6267\u884C\u4E2D\u2026",
+  qrSection: "\u8282\u70B9\u4E8C\u7EF4\u7801",
+  qrHint: "\u7528 v2rayN\u3001NekoBox\u3001Shadowrocket\u3001sing-box\u3001Clash Meta \u7B49\u5BA2\u6237\u7AEF\u626B\u63CF\u5BFC\u5165\u3002\u4E8C\u7EF4\u7801\u7B49\u540C\u4E8E\u5BC6\u7801\uFF0C\u8BF7\u52FF\u5916\u4F20\u3002",
+  refresh: "\u5237\u65B0",
+  qrEmpty: "\u70B9\u300C\u5237\u65B0\u300D\u4ECE\u670D\u52A1\u5668\u8BFB\u53D6\u8282\u70B9\u5E76\u751F\u6210\u4E8C\u7EF4\u7801\u3002",
+  copy: "\u590D\u5236\u94FE\u63A5",
+  copied: "\u5DF2\u590D\u5236",
+  portLabel: "\u7AEF\u53E3 {port}",
+  cloudFirewall: "\u63D0\u9192\uFF1A\u8FD8\u9700\u8981\u5728\u4E91\u670D\u52A1\u5546\u63A7\u5236\u53F0\u7684\u5B89\u5168\u7EC4\u91CC\u653E\u884C\u4EE5\u4E0B\u7AEF\u53E3\uFF1A{ports}",
+  "err.not_configured": "\u8BF7\u5148\u586B\u5199\u5E76\u4FDD\u5B58\u670D\u52A1\u5668\u4FE1\u606F\u3002",
+  "err.auth_failed": "SSH \u767B\u5F55\u5931\u8D25\uFF1A\u7528\u6237\u540D\u6216\u5BC6\u7801\u9519\u8BEF\u3002",
+  "err.host_key_mismatch": "\u670D\u52A1\u5668\u6307\u7EB9\u4E0E\u4E0A\u6B21\u4E0D\u540C\uFF0C\u5DF2\u62D2\u7EDD\u8FDE\u63A5\u3002\u5982\u679C\u4F60\u91CD\u88C5\u4E86\u7CFB\u7EDF\u6216\u6362\u4E86\u673A\u5668\uFF0C\u8BF7\u70B9\u300C\u91CD\u7F6E\u6307\u7EB9\u300D\u540E\u91CD\u8BD5\u3002",
+  "err.connect_failed": "\u65E0\u6CD5\u8FDE\u63A5\u670D\u52A1\u5668\uFF1A{message}",
+  "err.timeout": "\u64CD\u4F5C\u8D85\u65F6\u3002",
+  "err.sudo_failed": "\u65E0\u6CD5\u83B7\u5F97 root \u6743\u9650\uFF1A\u8BE5\u7528\u6237\u6CA1\u6709 sudo \u6743\u9650\u6216\u5BC6\u7801\u9519\u8BEF\u3002",
+  "err.not_root": "\u65E0\u6CD5\u83B7\u5F97 root \u6743\u9650\u3002",
+  "err.no_systemd": "\u670D\u52A1\u5668\u7CFB\u7EDF\u4E0D\u53D7\u652F\u6301\uFF08\u9700\u8981 systemd\uFF09\u3002",
+  "err.download_failed": "\u670D\u52A1\u5668\u65E0\u6CD5\u4ECE GitHub \u4E0B\u8F7D sing-box\uFF1A{message}",
+  "err.not_installed": "\u670D\u52A1\u5668\u4E0A\u5C1A\u672A\u5B89\u88C5\uFF0C\u8BF7\u5148\u70B9\u300C\u5B89\u88C5 / \u66F4\u65B0\u300D\u3002",
+  "err.invalid": "\u586B\u5199\u6709\u8BEF\uFF1A{message}",
+  "err.cert_needs_ip": "IP \u8BC1\u4E66\u9700\u8981\u7528 IP \u5730\u5740\u4F5C\u4E3A\u8282\u70B9\u5730\u5740\uFF0C\u8BF7\u68C0\u67E5\u670D\u52A1\u5668 IP \u6216\u8282\u70B9\u5730\u5740\u3002",
+  "err.port80_in_use": "\u670D\u52A1\u5668\u7684 TCP 80 \u7AEF\u53E3\u5DF2\u88AB\u5176\u4ED6\u7A0B\u5E8F\u5360\u7528\uFF08{message}\uFF09\uFF0C\u65E0\u6CD5\u7533\u8BF7 IP \u8BC1\u4E66\u3002\u8BF7\u505C\u7528\u8BE5\u7A0B\u5E8F\u6216\u6539\u7528\u81EA\u7B7E\u8BC1\u4E66\u3002",
+  "err.cert_failed": "IP \u8BC1\u4E66\u7533\u8BF7\u5931\u8D25\uFF0C\u5DF2\u81EA\u52A8\u6539\u56DE\u81EA\u7B7E\u8BC1\u4E66\uFF0C\u8282\u70B9\u4ECD\u53EF\u4F7F\u7528\u3002\u5E38\u89C1\u539F\u56E0\u662F\u5B89\u5168\u7EC4\u6CA1\u6709\u5F00\u653E TCP 80 \u7AEF\u53E3\u3002\u8BE6\u60C5\uFF1A{message}",
+  "err.other": "\u5931\u8D25\uFF1A{message}",
+  "field.host": "\u670D\u52A1\u5668 IP \u6216\u57DF\u540D\u683C\u5F0F\u4E0D\u6B63\u786E\u3002",
+  "field.port": "SSH \u7AEF\u53E3\u9700\u5728 1\u201365535 \u4E4B\u95F4\u3002",
+  "field.username": "\u7528\u6237\u540D\u683C\u5F0F\u4E0D\u6B63\u786E\u3002",
+  "field.password": "\u8BF7\u586B\u5199\u5BC6\u7801\u3002",
+  "field.protocols": "\u8BF7\u81F3\u5C11\u52FE\u9009\u4E00\u4E2A\u534F\u8BAE\u3002",
+  "field.linkAddress": "\u8282\u70B9\u5730\u5740\u683C\u5F0F\u4E0D\u6B63\u786E\u3002",
+  "field.certMode": "IP \u8BC1\u4E66\u9700\u8981\u7528 IP \u5730\u5740\u4F5C\u4E3A\u8282\u70B9\u5730\u5740\uFF1A\u8BF7\u628A\u300C\u8282\u70B9\u5730\u5740\u300D\u7559\u7A7A\uFF08\u4F7F\u7528\u670D\u52A1\u5668 IP\uFF09\u6216\u586B\u5199 IP\uFF0C\u6216\u6539\u7528\u81EA\u7B7E\u8BC1\u4E66\u3002"
+};
+var en = {
+  title: "VPN node",
+  description: "Deploy sing-box to your VPS in one click and import it into proxy apps by scanning QR codes.",
+  serverSection: "Server",
+  host: "Server IP or domain",
+  hostHint: "Public address of your VPS.",
+  port: "SSH port",
+  username: "Username",
+  usernameHint: "root is recommended; other users need sudo.",
+  password: "Password",
+  passwordSaved: "Saved (leave blank to keep)",
+  passwordEmpty: "Password for the VPS",
+  linkAddress: "Node address (optional)",
+  linkAddressHint: "Address written into node links; defaults to the server IP. For NAT machines or domains.",
+  hostKey: "Host fingerprint",
+  hostKeyHint: "Recorded on first connection. A changed fingerprint is refused so the password cannot be intercepted.",
+  hostKeyNone: "Not connected yet",
+  forgetHostKey: "Reset fingerprint",
+  save: "Save",
+  saved: "Saved",
+  test: "Test connection",
+  testOk: "Connected: {system}, root access OK.",
+  unsaved: "You have unsaved changes; save first.",
+  protocolSection: "Protocols",
+  protocolHint: 'Select protocols to install; save, then click "Install / update".',
+  insecureTag: "Skips cert check",
+  insecureHint: "Share links for this protocol cannot pin the certificate, so clients skip verification. Less secure.",
+  certSection: "Certificate",
+  certHint: "Used by Hysteria2, TUIC and AnyTLS. Reality and Shadowsocks need none.",
+  certSelf: "Self-signed",
+  certSelfHint: "No setup needed. Hysteria2 pins it; TUIC and AnyTLS clients must skip verification.",
+  certIp: "IP certificate (recommended)",
+  certIpHint: "A free Let's Encrypt certificate issued to the server IP: every client verifies it normally, no domain needed. Valid 6 days and renewed automatically by sing-box; keep TCP port 80 open in the security group.",
+  certExpires: "IP certificate valid until {date} (about {hours} h left), renewed automatically.",
+  certNotIssued: "IP certificate not issued yet.",
+  certExpiring: "The IP certificate expires within {hours} h and has not been renewed yet. Keep TCP port 80 open in the security group, or clients will fail once it expires.",
+  certExpired: 'The IP certificate has expired, so clients cannot connect! Open TCP port 80 in the security group and click "Install / update", or switch to self-signed.',
+  deploySection: "Deploy",
+  install: "Install / update",
+  regenerate: "Regenerate keys (old links stop working)",
+  uninstall: "Uninstall",
+  confirmUninstall: "Really uninstall?",
+  confirmRegenerate: "Really regenerate?",
+  cancel: "Cancel",
+  status: "Check status",
+  statusActive: "sing-box {version} is running.",
+  statusInactive: "sing-box is installed but not running.",
+  statusNotInstalled: "Not installed yet.",
+  listening: "Listening",
+  installed: "Installed.",
+  uninstalled: "Uninstalled.",
+  working: "Working\u2026",
+  qrSection: "Node QR codes",
+  qrHint: "Scan with v2rayN, NekoBox, Shadowrocket, sing-box, Clash Meta and similar apps. A QR code is as secret as a password.",
+  refresh: "Refresh",
+  qrEmpty: 'Click "Refresh" to read the nodes from the server and show QR codes.',
+  copy: "Copy link",
+  copied: "Copied",
+  portLabel: "Port {port}",
+  cloudFirewall: "Reminder: also open these ports in your cloud provider's security group: {ports}",
+  "err.not_configured": "Fill in and save the server details first.",
+  "err.auth_failed": "SSH login failed: wrong username or password.",
+  "err.host_key_mismatch": 'The server fingerprint changed, so the connection was refused. If you reinstalled or replaced the server, click "Reset fingerprint" and retry.',
+  "err.connect_failed": "Cannot connect to the server: {message}",
+  "err.timeout": "The operation timed out.",
+  "err.sudo_failed": "Cannot get root: the user lacks sudo or the password is wrong.",
+  "err.not_root": "Cannot get root.",
+  "err.no_systemd": "Unsupported server OS (systemd required).",
+  "err.download_failed": "The server cannot download sing-box from GitHub: {message}",
+  "err.not_installed": 'Nothing installed yet; click "Install / update" first.',
+  "err.invalid": "Invalid input: {message}",
+  "err.cert_needs_ip": "An IP certificate needs an IP address as the node address; check the server IP or node address.",
+  "err.port80_in_use": "TCP port 80 on the server is used by another program ({message}), so an IP certificate cannot be issued. Stop it or use self-signed.",
+  "err.cert_failed": "The IP certificate was not issued, so the node fell back to self-signed and still works. Usually TCP port 80 is not open in the security group. Details: {message}",
+  "err.other": "Failed: {message}",
+  "field.host": "The server IP or domain is not valid.",
+  "field.port": "The SSH port must be 1\u201365535.",
+  "field.username": "The username is not valid.",
+  "field.password": "Enter the password.",
+  "field.protocols": "Select at least one protocol.",
+  "field.linkAddress": "The node address is not valid.",
+  "field.certMode": 'An IP certificate needs an IP address as the node address: leave "Node address" empty (uses the server IP) or enter an IP, or use self-signed.'
+};
+
+// src/client/styles.ts
+var STYLES = `
+.dshvpn { display: flex; flex-direction: column; gap: 20px; max-width: 880px; color: var(--dsw-alias-label-primary, inherit); }
+.dshvpn section { display: flex; flex-direction: column; gap: 8px; }
+.dshvpn h3 { margin: 0; font-size: 14px; font-weight: 600; }
+.dshvpn-muted { color: var(--dsw-alias-label-tertiary, #888); font-size: 12px; }
+.dshvpn-warn { color: var(--dsw-alias-state-warn-primary, #b7791f); font-size: 12px; }
+.dshvpn-grid { display: grid; grid-template-columns: repeat(2, minmax(0, 1fr)); gap: 12px 16px; }
+.dshvpn-grid label { display: flex; flex-direction: column; gap: 4px; font-size: 13px; }
+.dshvpn-grid .dshvpn-wide { grid-column: 1 / -1; }
+@media (max-width: 640px) { .dshvpn-grid { grid-template-columns: 1fr; } }
+.dshvpn-hostkey { display: flex; flex-wrap: wrap; align-items: center; gap: 6px; font-size: 13px; }
+.dshvpn-hostkey code, .dshvpn-link { font-family: var(--dsw-font-markdown-code-block, ui-monospace, monospace); font-size: 12px; word-break: break-all; }
+.dshvpn-hostkey small { flex-basis: 100%; }
+.dshvpn-protocols { display: flex; flex-direction: column; gap: 6px; }
+.dshvpn-protocol { display: flex; align-items: center; gap: 8px; }
+.dshvpn-radio { display: flex; align-items: flex-start; gap: 8px; font-size: 13px; cursor: pointer; }
+.dshvpn-radio input { margin-top: 3px; }
+.dshvpn-radio span { display: flex; flex-direction: column; gap: 2px; }
+.dshvpn-actions, .dshvpn-row { display: flex; flex-wrap: wrap; align-items: center; gap: 8px; }
+.dshvpn-row { justify-content: space-between; }
+.dshvpn-danger { color: var(--dsw-alias-state-error-primary, #d33) !important; }
+.dshvpn-notice { padding: 8px 12px; border-radius: 8px; font-size: 13px; white-space: pre-wrap;
+  border: 1px solid var(--dsw-alias-border-l2, rgba(127,127,127,.3)); background: var(--dsw-alias-bg-layer-1, transparent); }
+.dshvpn-success { border-color: var(--dsw-alias-state-success-primary, #2f855a); }
+.dshvpn-error { border-color: var(--dsw-alias-state-error-primary, #d33); }
+.dshvpn-qr-grid { display: grid; grid-template-columns: repeat(auto-fill, minmax(220px, 1fr)); gap: 12px; }
+.dshvpn-qr-card { display: flex; flex-direction: column; align-items: flex-start; gap: 8px; padding: 12px; border-radius: 10px;
+  border: 1px solid var(--dsw-alias-border-l2, rgba(127,127,127,.3)); background: var(--dsw-alias-bg-layer-1, transparent); }
+.dshvpn-qr-head { display: flex; flex-direction: column; gap: 2px; }
+/* QR codes stay black-on-white in dark mode so every scanner can read them. */
+.dshvpn-qr { background: #fff; padding: 6px; border-radius: 6px; line-height: 0; align-self: center; }
+.dshvpn-qr svg { width: 180px; height: 180px; }
+.dshvpn-link { display: block; max-width: 100%; max-height: 3.2em; overflow: hidden; color: var(--dsw-alias-label-secondary, #666); }
+`;
+
+// src/client/VpnSettingsPage.tsx
+var import_react = require("react");
+var import_dsh_client_ui_primitives = require("@deepseek-ai/dsh-client-ui-primitives");
+
+// node_modules/.pnpm/uqr@0.1.3/node_modules/uqr/dist/index.mjs
+var QrCodeDataType = /* @__PURE__ */ ((QrCodeDataType2) => {
+  QrCodeDataType2[QrCodeDataType2["Border"] = -1] = "Border";
+  QrCodeDataType2[QrCodeDataType2["Data"] = 0] = "Data";
+  QrCodeDataType2[QrCodeDataType2["Function"] = 1] = "Function";
+  QrCodeDataType2[QrCodeDataType2["Position"] = 2] = "Position";
+  QrCodeDataType2[QrCodeDataType2["Timing"] = 3] = "Timing";
+  QrCodeDataType2[QrCodeDataType2["Alignment"] = 4] = "Alignment";
+  return QrCodeDataType2;
+})(QrCodeDataType || {});
+var LOW = [0, 1];
+var MEDIUM = [1, 0];
+var QUARTILE = [2, 3];
+var HIGH = [3, 2];
+var EccMap = {
+  L: LOW,
+  M: MEDIUM,
+  Q: QUARTILE,
+  H: HIGH
+};
+var NUMERIC_REGEX = /^\d*$/;
+var ALPHANUMERIC_REGEX = /^[A-Z0-9 $%*+./:-]*$/;
+var ALPHANUMERIC_CHARSET = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ $%*+-./:";
+var MIN_VERSION = 1;
+var MAX_VERSION = 40;
+var PENALTY_N1 = 3;
+var PENALTY_N2 = 3;
+var PENALTY_N3 = 40;
+var PENALTY_N4 = 10;
+var ECC_CODEWORDS_PER_BLOCK = [
+  // Version: (note that index 0 is for padding, and is set to an illegal value)
+  // 0,  1,  2,  3,  4,  5,  6,  7,  8,  9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40    Error correction level
+  [-1, 7, 10, 15, 20, 26, 18, 20, 24, 30, 18, 20, 24, 26, 30, 22, 24, 28, 30, 28, 28, 28, 28, 30, 30, 26, 28, 30, 30, 30, 30, 30, 30, 30, 30, 30, 30, 30, 30, 30, 30],
+  // Low
+  [-1, 10, 16, 26, 18, 24, 16, 18, 22, 22, 26, 30, 22, 22, 24, 24, 28, 28, 26, 26, 26, 26, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28, 28],
+  // Medium
+  [-1, 13, 22, 18, 26, 18, 24, 18, 22, 20, 24, 28, 26, 24, 20, 30, 24, 28, 28, 26, 30, 28, 30, 30, 30, 30, 28, 30, 30, 30, 30, 30, 30, 30, 30, 30, 30, 30, 30, 30, 30],
+  // Quartile
+  [-1, 17, 28, 22, 16, 22, 28, 26, 26, 24, 28, 24, 28, 22, 24, 24, 30, 28, 28, 26, 28, 30, 24, 30, 30, 30, 30, 30, 30, 30, 30, 30, 30, 30, 30, 30, 30, 30, 30, 30, 30]
+  // High
+];
+var NUM_ERROR_CORRECTION_BLOCKS = [
+  // Version: (note that index 0 is for padding, and is set to an illegal value)
+  // 0, 1, 2, 3, 4, 5, 6, 7, 8, 9,10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40    Error correction level
+  [-1, 1, 1, 1, 1, 1, 2, 2, 2, 2, 4, 4, 4, 4, 4, 6, 6, 6, 6, 7, 8, 8, 9, 9, 10, 12, 12, 12, 13, 14, 15, 16, 17, 18, 19, 19, 20, 21, 22, 24, 25],
+  // Low
+  [-1, 1, 1, 1, 2, 2, 4, 4, 4, 5, 5, 5, 8, 9, 9, 10, 10, 11, 13, 14, 16, 17, 17, 18, 20, 21, 23, 25, 26, 28, 29, 31, 33, 35, 37, 38, 40, 43, 45, 47, 49],
+  // Medium
+  [-1, 1, 1, 2, 2, 4, 4, 6, 6, 8, 8, 8, 10, 12, 16, 12, 17, 16, 18, 21, 20, 23, 23, 25, 27, 29, 34, 34, 35, 38, 40, 43, 45, 48, 51, 53, 56, 59, 62, 65, 68],
+  // Quartile
+  [-1, 1, 1, 2, 4, 4, 4, 5, 6, 8, 8, 11, 11, 16, 16, 18, 16, 19, 21, 25, 25, 25, 34, 30, 32, 35, 37, 40, 42, 45, 48, 51, 54, 57, 60, 63, 66, 70, 74, 77, 81]
+  // High
+];
+var QrCode = class {
+  /* -- Constructor (low level) and fields -- */
+  // Creates a new QR Code with the given version number,
+  // error correction level, data codeword bytes, and mask number.
+  // This is a low-level API that most users should not use directly.
+  // A mid-level API is the encodeSegments() function.
+  constructor(version, ecc, dataCodewords, msk) {
+    this.version = version;
+    this.ecc = ecc;
+    if (version < MIN_VERSION || version > MAX_VERSION)
+      throw new RangeError("Version value out of range");
+    if (msk < -1 || msk > 7)
+      throw new RangeError("Mask value out of range");
+    this.size = version * 4 + 17;
+    const row = Array.from({ length: this.size }).fill(false);
+    for (let i = 0; i < this.size; i++) {
+      this.modules.push(row.slice());
+      this.types.push(row.map(() => 0));
+    }
+    this.drawFunctionPatterns();
+    const allCodewords = this.addEccAndInterleave(dataCodewords);
+    this.drawCodewords(allCodewords);
+    if (msk === -1) {
+      let minPenalty = 1e9;
+      for (let i = 0; i < 8; i++) {
+        this.applyMask(i);
+        this.drawFormatBits(i);
+        const penalty = this.getPenaltyScore();
+        if (penalty < minPenalty) {
+          msk = i;
+          minPenalty = penalty;
+        }
+        this.applyMask(i);
+      }
+    }
+    this.mask = msk;
+    this.applyMask(msk);
+    this.drawFormatBits(msk);
+  }
+  /* -- Fields -- */
+  // The width and height of this QR Code, measured in modules, between
+  // 21 and 177 (inclusive). This is equal to version * 4 + 17.
+  size;
+  // The index of the mask pattern used in this QR Code, which is between 0 and 7 (inclusive).
+  // Even if a QR Code is created with automatic masking requested (mask = -1),
+  // the resulting object still has a mask value between 0 and 7.
+  mask;
+  // The modules of this QR Code (false = light, true = dark).
+  // Immutable after constructor finishes. Accessed through getModule().
+  modules = [];
+  types = [];
+  /* -- Accessor methods -- */
+  // Returns the color of the module (pixel) at the given coordinates, which is false
+  // for light or true for dark. The top left corner has the coordinates (x=0, y=0).
+  // If the given coordinates are out of bounds, then false (light) is returned.
+  getModule(x, y) {
+    return x >= 0 && x < this.size && y >= 0 && y < this.size && this.modules[y][x];
+  }
+  /* -- Private helper methods for constructor: Drawing function modules -- */
+  // Reads this object's version field, and draws and marks all function modules.
+  drawFunctionPatterns() {
+    for (let i = 0; i < this.size; i++) {
+      this.setFunctionModule(6, i, i % 2 === 0, QrCodeDataType.Timing);
+      this.setFunctionModule(i, 6, i % 2 === 0, QrCodeDataType.Timing);
+    }
+    this.drawFinderPattern(3, 3);
+    this.drawFinderPattern(this.size - 4, 3);
+    this.drawFinderPattern(3, this.size - 4);
+    const alignPatPos = this.getAlignmentPatternPositions();
+    const numAlign = alignPatPos.length;
+    for (let i = 0; i < numAlign; i++) {
+      for (let j = 0; j < numAlign; j++) {
+        if (!(i === 0 && j === 0 || i === 0 && j === numAlign - 1 || i === numAlign - 1 && j === 0))
+          this.drawAlignmentPattern(alignPatPos[i], alignPatPos[j]);
+      }
+    }
+    this.drawFormatBits(0);
+    this.drawVersion();
+  }
+  // Draws two copies of the format bits (with its own error correction code)
+  // based on the given mask and this object's error correction level field.
+  drawFormatBits(mask) {
+    const data = this.ecc[1] << 3 | mask;
+    let rem = data;
+    for (let i = 0; i < 10; i++)
+      rem = rem << 1 ^ (rem >>> 9) * 1335;
+    const bits = (data << 10 | rem) ^ 21522;
+    for (let i = 0; i <= 5; i++)
+      this.setFunctionModule(8, i, getBit(bits, i));
+    this.setFunctionModule(8, 7, getBit(bits, 6));
+    this.setFunctionModule(8, 8, getBit(bits, 7));
+    this.setFunctionModule(7, 8, getBit(bits, 8));
+    for (let i = 9; i < 15; i++)
+      this.setFunctionModule(14 - i, 8, getBit(bits, i));
+    for (let i = 0; i < 8; i++)
+      this.setFunctionModule(this.size - 1 - i, 8, getBit(bits, i));
+    for (let i = 8; i < 15; i++)
+      this.setFunctionModule(8, this.size - 15 + i, getBit(bits, i));
+    this.setFunctionModule(8, this.size - 8, true);
+  }
+  // Draws two copies of the version bits (with its own error correction code),
+  // based on this object's version field, iff 7 <= version <= 40.
+  drawVersion() {
+    if (this.version < 7)
+      return;
+    let rem = this.version;
+    for (let i = 0; i < 12; i++)
+      rem = rem << 1 ^ (rem >>> 11) * 7973;
+    const bits = this.version << 12 | rem;
+    for (let i = 0; i < 18; i++) {
+      const color = getBit(bits, i);
+      const a = this.size - 11 + i % 3;
+      const b = Math.floor(i / 3);
+      this.setFunctionModule(a, b, color);
+      this.setFunctionModule(b, a, color);
+    }
+  }
+  // Draws a 9*9 finder pattern including the border separator,
+  // with the center module at (x, y). Modules can be out of bounds.
+  drawFinderPattern(x, y) {
+    for (let dy = -4; dy <= 4; dy++) {
+      for (let dx = -4; dx <= 4; dx++) {
+        const dist = Math.max(Math.abs(dx), Math.abs(dy));
+        const xx = x + dx;
+        const yy = y + dy;
+        if (xx >= 0 && xx < this.size && yy >= 0 && yy < this.size)
+          this.setFunctionModule(xx, yy, dist !== 2 && dist !== 4, QrCodeDataType.Position);
+      }
+    }
+  }
+  // Draws a 5*5 alignment pattern, with the center module
+  // at (x, y). All modules must be in bounds.
+  drawAlignmentPattern(x, y) {
+    for (let dy = -2; dy <= 2; dy++) {
+      for (let dx = -2; dx <= 2; dx++) {
+        this.setFunctionModule(
+          x + dx,
+          y + dy,
+          Math.max(Math.abs(dx), Math.abs(dy)) !== 1,
+          QrCodeDataType.Alignment
+        );
+      }
+    }
+  }
+  // Sets the color of a module and marks it as a function module.
+  // Only used by the constructor. Coordinates must be in bounds.
+  setFunctionModule(x, y, isDark, type = QrCodeDataType.Function) {
+    this.modules[y][x] = isDark;
+    this.types[y][x] = type;
+  }
+  /* -- Private helper methods for constructor: Codewords and masking -- */
+  // Returns a new byte string representing the given data with the appropriate error correction
+  // codewords appended to it, based on this object's version and error correction level.
+  addEccAndInterleave(data) {
+    const ver = this.version;
+    const ecl = this.ecc;
+    if (data.length !== getNumDataCodewords(ver, ecl))
+      throw new RangeError("Invalid argument");
+    const numBlocks = NUM_ERROR_CORRECTION_BLOCKS[ecl[0]][ver];
+    const blockEccLen = ECC_CODEWORDS_PER_BLOCK[ecl[0]][ver];
+    const rawCodewords = Math.floor(getNumRawDataModules(ver) / 8);
+    const numShortBlocks = numBlocks - rawCodewords % numBlocks;
+    const shortBlockLen = Math.floor(rawCodewords / numBlocks);
+    const blocks = [];
+    const rsDiv = reedSolomonComputeDivisor(blockEccLen);
+    for (let i = 0, k = 0; i < numBlocks; i++) {
+      const dat = data.slice(k, k + shortBlockLen - blockEccLen + (i < numShortBlocks ? 0 : 1));
+      k += dat.length;
+      const ecc = reedSolomonComputeRemainder(dat, rsDiv);
+      if (i < numShortBlocks)
+        dat.push(0);
+      blocks.push(dat.concat(ecc));
+    }
+    const result = [];
+    for (let i = 0; i < blocks[0].length; i++) {
+      blocks.forEach((block, j) => {
+        if (i !== shortBlockLen - blockEccLen || j >= numShortBlocks)
+          result.push(block[i]);
+      });
+    }
+    return result;
+  }
+  // Draws the given sequence of 8-bit codewords (data and error correction) onto the entire
+  // data area of this QR Code. Function modules need to be marked off before this is called.
+  drawCodewords(data) {
+    if (data.length !== Math.floor(getNumRawDataModules(this.version) / 8))
+      throw new RangeError("Invalid argument");
+    let i = 0;
+    for (let right = this.size - 1; right >= 1; right -= 2) {
+      if (right === 6)
+        right = 5;
+      for (let vert = 0; vert < this.size; vert++) {
+        for (let j = 0; j < 2; j++) {
+          const x = right - j;
+          const upward = (right + 1 & 2) === 0;
+          const y = upward ? this.size - 1 - vert : vert;
+          if (!this.types[y][x] && i < data.length * 8) {
+            this.modules[y][x] = getBit(data[i >>> 3], 7 - (i & 7));
+            i++;
+          }
+        }
+      }
+    }
+  }
+  // XORs the codeword modules in this QR Code with the given mask pattern.
+  // The function modules must be marked and the codeword bits must be drawn
+  // before masking. Due to the arithmetic of XOR, calling applyMask() with
+  // the same mask value a second time will undo the mask. A final well-formed
+  // QR Code needs exactly one (not zero, two, etc.) mask applied.
+  applyMask(mask) {
+    if (mask < 0 || mask > 7)
+      throw new RangeError("Mask value out of range");
+    for (let y = 0; y < this.size; y++) {
+      for (let x = 0; x < this.size; x++) {
+        let invert;
+        switch (mask) {
+          case 0:
+            invert = (x + y) % 2 === 0;
+            break;
+          case 1:
+            invert = y % 2 === 0;
+            break;
+          case 2:
+            invert = x % 3 === 0;
+            break;
+          case 3:
+            invert = (x + y) % 3 === 0;
+            break;
+          case 4:
+            invert = (Math.floor(x / 3) + Math.floor(y / 2)) % 2 === 0;
+            break;
+          case 5:
+            invert = x * y % 2 + x * y % 3 === 0;
+            break;
+          case 6:
+            invert = (x * y % 2 + x * y % 3) % 2 === 0;
+            break;
+          case 7:
+            invert = ((x + y) % 2 + x * y % 3) % 2 === 0;
+            break;
+          default:
+            throw new Error("Unreachable");
+        }
+        if (!this.types[y][x] && invert)
+          this.modules[y][x] = !this.modules[y][x];
+      }
+    }
+  }
+  // Calculates and returns the penalty score based on state of this QR Code's current modules.
+  // This is used by the automatic mask choice algorithm to find the mask pattern that yields the lowest score.
+  getPenaltyScore() {
+    let result = 0;
+    for (let y = 0; y < this.size; y++) {
+      let runColor = false;
+      let runX = 0;
+      const runHistory = [0, 0, 0, 0, 0, 0, 0];
+      for (let x = 0; x < this.size; x++) {
+        if (this.modules[y][x] === runColor) {
+          runX++;
+          if (runX === 5)
+            result += PENALTY_N1;
+          else if (runX > 5)
+            result++;
+        } else {
+          this.finderPenaltyAddHistory(runX, runHistory);
+          if (!runColor)
+            result += this.finderPenaltyCountPatterns(runHistory) * PENALTY_N3;
+          runColor = this.modules[y][x];
+          runX = 1;
+        }
+      }
+      result += this.finderPenaltyTerminateAndCount(runColor, runX, runHistory) * PENALTY_N3;
+    }
+    for (let x = 0; x < this.size; x++) {
+      let runColor = false;
+      let runY = 0;
+      const runHistory = [0, 0, 0, 0, 0, 0, 0];
+      for (let y = 0; y < this.size; y++) {
+        if (this.modules[y][x] === runColor) {
+          runY++;
+          if (runY === 5)
+            result += PENALTY_N1;
+          else if (runY > 5)
+            result++;
+        } else {
+          this.finderPenaltyAddHistory(runY, runHistory);
+          if (!runColor)
+            result += this.finderPenaltyCountPatterns(runHistory) * PENALTY_N3;
+          runColor = this.modules[y][x];
+          runY = 1;
+        }
+      }
+      result += this.finderPenaltyTerminateAndCount(runColor, runY, runHistory) * PENALTY_N3;
+    }
+    for (let y = 0; y < this.size - 1; y++) {
+      for (let x = 0; x < this.size - 1; x++) {
+        const color = this.modules[y][x];
+        if (color === this.modules[y][x + 1] && color === this.modules[y + 1][x] && color === this.modules[y + 1][x + 1]) {
+          result += PENALTY_N2;
+        }
+      }
+    }
+    let dark = 0;
+    for (const row of this.modules)
+      dark = row.reduce((sum, color) => sum + (color ? 1 : 0), dark);
+    const total = this.size * this.size;
+    const k = Math.ceil(Math.abs(dark * 20 - total * 10) / total) - 1;
+    result += k * PENALTY_N4;
+    return result;
+  }
+  /* -- Private helper functions -- */
+  // Returns an ascending list of positions of alignment patterns for this version number.
+  // Each position is in the range [0,177), and are used on both the x and y axes.
+  // This could be implemented as lookup table of 40 variable-length lists of integers.
+  getAlignmentPatternPositions() {
+    if (this.version === 1) {
+      return [];
+    } else {
+      const numAlign = Math.floor(this.version / 7) + 2;
+      const step = this.version === 32 ? 26 : Math.ceil((this.version * 4 + 4) / (numAlign * 2 - 2)) * 2;
+      const result = [6];
+      for (let pos = this.size - 7; result.length < numAlign; pos -= step)
+        result.splice(1, 0, pos);
+      return result;
+    }
+  }
+  // Can only be called immediately after a light run is added, and
+  // returns either 0, 1, or 2. A helper function for getPenaltyScore().
+  finderPenaltyCountPatterns(runHistory) {
+    const n = runHistory[1];
+    const core = n > 0 && runHistory[2] === n && runHistory[3] === n * 3 && runHistory[4] === n && runHistory[5] === n;
+    return (core && runHistory[0] >= n * 4 && runHistory[6] >= n ? 1 : 0) + (core && runHistory[6] >= n * 4 && runHistory[0] >= n ? 1 : 0);
+  }
+  // Must be called at the end of a line (row or column) of modules. A helper function for getPenaltyScore().
+  finderPenaltyTerminateAndCount(currentRunColor, currentRunLength, runHistory) {
+    if (currentRunColor) {
+      this.finderPenaltyAddHistory(currentRunLength, runHistory);
+      currentRunLength = 0;
+    }
+    currentRunLength += this.size;
+    this.finderPenaltyAddHistory(currentRunLength, runHistory);
+    return this.finderPenaltyCountPatterns(runHistory);
+  }
+  // Pushes the given value to the front and drops the last value. A helper function for getPenaltyScore().
+  finderPenaltyAddHistory(currentRunLength, runHistory) {
+    if (runHistory[0] === 0)
+      currentRunLength += this.size;
+    runHistory.pop();
+    runHistory.unshift(currentRunLength);
+  }
+};
+function appendBits(val, len, bb) {
+  if (len < 0 || len > 31 || val >>> len !== 0)
+    throw new RangeError("Value out of range");
+  for (let i = len - 1; i >= 0; i--)
+    bb.push(val >>> i & 1);
+}
+function getBit(x, i) {
+  return (x >>> i & 1) !== 0;
+}
+var QrSegment = class {
+  // Creates a new QR Code segment with the given attributes and data.
+  // The character count (numChars) must agree with the mode and the bit buffer length,
+  // but the constraint isn't checked. The given bit buffer is cloned and stored.
+  constructor(mode, numChars, bitData) {
+    this.mode = mode;
+    this.numChars = numChars;
+    this.bitData = bitData;
+    if (numChars < 0)
+      throw new RangeError("Invalid argument");
+    this.bitData = bitData.slice();
+  }
+  /* -- Methods -- */
+  // Returns a new copy of the data bits of this segment.
+  getData() {
+    return this.bitData.slice();
+  }
+};
+var MODE_NUMERIC = [1, 10, 12, 14];
+var MODE_ALPHANUMERIC = [2, 9, 11, 13];
+var MODE_BYTE = [4, 8, 16, 16];
+function numCharCountBits(mode, ver) {
+  return mode[Math.floor((ver + 7) / 17) + 1];
+}
+function makeBytes(data) {
+  const bb = [];
+  for (const b of data)
+    appendBits(b, 8, bb);
+  return new QrSegment(MODE_BYTE, data.length, bb);
+}
+function makeNumeric(digits) {
+  if (!isNumeric(digits))
+    throw new RangeError("String contains non-numeric characters");
+  const bb = [];
+  for (let i = 0; i < digits.length; ) {
+    const n = Math.min(digits.length - i, 3);
+    appendBits(Number.parseInt(digits.substring(i, i + n), 10), n * 3 + 1, bb);
+    i += n;
+  }
+  return new QrSegment(MODE_NUMERIC, digits.length, bb);
+}
+function makeAlphanumeric(text) {
+  if (!isAlphanumeric(text))
+    throw new RangeError("String contains unencodable characters in alphanumeric mode");
+  const bb = [];
+  let i;
+  for (i = 0; i + 2 <= text.length; i += 2) {
+    let temp = ALPHANUMERIC_CHARSET.indexOf(text.charAt(i)) * 45;
+    temp += ALPHANUMERIC_CHARSET.indexOf(text.charAt(i + 1));
+    appendBits(temp, 11, bb);
+  }
+  if (i < text.length)
+    appendBits(ALPHANUMERIC_CHARSET.indexOf(text.charAt(i)), 6, bb);
+  return new QrSegment(MODE_ALPHANUMERIC, text.length, bb);
+}
+function makeSegments(text) {
+  if (text === "")
+    return [];
+  else if (isNumeric(text))
+    return [makeNumeric(text)];
+  else if (isAlphanumeric(text))
+    return [makeAlphanumeric(text)];
+  else
+    return [makeBytes(toUtf8ByteArray(text))];
+}
+function isNumeric(text) {
+  return NUMERIC_REGEX.test(text);
+}
+function isAlphanumeric(text) {
+  return ALPHANUMERIC_REGEX.test(text);
+}
+function getTotalBits(segs, version) {
+  let result = 0;
+  for (const seg of segs) {
+    const ccbits = numCharCountBits(seg.mode, version);
+    if (seg.numChars >= 1 << ccbits)
+      return Number.POSITIVE_INFINITY;
+    result += 4 + ccbits + seg.bitData.length;
+  }
+  return result;
+}
+function toUtf8ByteArray(str) {
+  str = encodeURI(str);
+  const result = [];
+  for (let i = 0; i < str.length; i++) {
+    if (str.charAt(i) !== "%") {
+      result.push(str.charCodeAt(i));
+    } else {
+      result.push(Number.parseInt(str.substring(i + 1, i + 3), 16));
+      i += 2;
+    }
+  }
+  return result;
+}
+function getNumRawDataModules(ver) {
+  if (ver < MIN_VERSION || ver > MAX_VERSION)
+    throw new RangeError("Version number out of range");
+  let result = (16 * ver + 128) * ver + 64;
+  if (ver >= 2) {
+    const numAlign = Math.floor(ver / 7) + 2;
+    result -= (25 * numAlign - 10) * numAlign - 55;
+    if (ver >= 7)
+      result -= 36;
+  }
+  return result;
+}
+function getNumDataCodewords(ver, ecl) {
+  return Math.floor(getNumRawDataModules(ver) / 8) - ECC_CODEWORDS_PER_BLOCK[ecl[0]][ver] * NUM_ERROR_CORRECTION_BLOCKS[ecl[0]][ver];
+}
+function reedSolomonComputeDivisor(degree) {
+  if (degree < 1 || degree > 255)
+    throw new RangeError("Degree out of range");
+  const result = [];
+  for (let i = 0; i < degree - 1; i++)
+    result.push(0);
+  result.push(1);
+  let root = 1;
+  for (let i = 0; i < degree; i++) {
+    for (let j = 0; j < result.length; j++) {
+      result[j] = reedSolomonMultiply(result[j], root);
+      if (j + 1 < result.length)
+        result[j] ^= result[j + 1];
+    }
+    root = reedSolomonMultiply(root, 2);
+  }
+  return result;
+}
+function reedSolomonComputeRemainder(data, divisor) {
+  const result = divisor.map((_) => 0);
+  for (const b of data) {
+    const factor = b ^ result.shift();
+    result.push(0);
+    divisor.forEach((coef, i) => result[i] ^= reedSolomonMultiply(coef, factor));
+  }
+  return result;
+}
+function reedSolomonMultiply(x, y) {
+  if (x >>> 8 !== 0 || y >>> 8 !== 0)
+    throw new RangeError("Byte out of range");
+  let z = 0;
+  for (let i = 7; i >= 0; i--) {
+    z = z << 1 ^ (z >>> 7) * 285;
+    z ^= (y >>> i & 1) * x;
+  }
+  return z;
+}
+function encodeSegments(segs, ecl, minVersion = 1, maxVersion = 40, mask = -1, boostEcl = true) {
+  if (!(MIN_VERSION <= minVersion && minVersion <= maxVersion && maxVersion <= MAX_VERSION) || mask < -1 || mask > 7) {
+    throw new RangeError("Invalid value");
+  }
+  let version;
+  let dataUsedBits;
+  for (version = minVersion; ; version++) {
+    const dataCapacityBits2 = getNumDataCodewords(version, ecl) * 8;
+    const usedBits = getTotalBits(segs, version);
+    if (usedBits <= dataCapacityBits2) {
+      dataUsedBits = usedBits;
+      break;
+    }
+    if (version >= maxVersion)
+      throw new RangeError("Data too long");
+  }
+  for (const newEcl of [MEDIUM, QUARTILE, HIGH]) {
+    if (boostEcl && dataUsedBits <= getNumDataCodewords(version, newEcl) * 8)
+      ecl = newEcl;
+  }
+  const bb = [];
+  for (const seg of segs) {
+    appendBits(seg.mode[0], 4, bb);
+    appendBits(seg.numChars, numCharCountBits(seg.mode, version), bb);
+    for (const b of seg.getData())
+      bb.push(b);
+  }
+  const dataCapacityBits = getNumDataCodewords(version, ecl) * 8;
+  appendBits(0, Math.min(4, dataCapacityBits - bb.length), bb);
+  appendBits(0, (8 - bb.length % 8) % 8, bb);
+  for (let padByte = 236; bb.length < dataCapacityBits; padByte ^= 236 ^ 17)
+    appendBits(padByte, 8, bb);
+  const dataCodewords = Array.from({ length: Math.ceil(bb.length / 8) }, () => 0);
+  bb.forEach((b, i) => dataCodewords[i >>> 3] |= b << 7 - (i & 7));
+  return new QrCode(version, ecl, dataCodewords, mask);
+}
+function encode(data, options) {
+  const {
+    ecc = "L",
+    boostEcc = false,
+    minVersion = 1,
+    maxVersion = 40,
+    maskPattern = -1,
+    border = 1
+  } = options || {};
+  const segment = typeof data === "string" ? makeSegments(data) : Array.isArray(data) ? [makeBytes(data)] : void 0;
+  if (!segment)
+    throw new Error(`uqr only supports encoding string and binary data, but got: ${typeof data}`);
+  const qr = encodeSegments(
+    segment,
+    EccMap[ecc],
+    minVersion,
+    maxVersion,
+    maskPattern,
+    boostEcc
+  );
+  const result = addBorder({
+    version: qr.version,
+    maskPattern: qr.mask,
+    size: qr.size,
+    data: qr.modules,
+    types: qr.types
+  }, border);
+  if (options?.invert)
+    result.data = result.data.map((row) => row.map((mod) => !mod));
+  options?.onEncoded?.(result);
+  return result;
+}
+function addBorder(input, border = 1) {
+  if (!border)
+    return input;
+  const { size } = input;
+  const newSize = size + border * 2;
+  input.size = newSize;
+  input.data.forEach((row) => {
+    for (let i = 0; i < border; i++) {
+      row.unshift(false);
+      row.push(false);
+    }
+  });
+  for (let i = 0; i < border; i++) {
+    input.data.unshift(Array.from({ length: newSize }, (_) => false));
+    input.data.push(Array.from({ length: newSize }, (_) => false));
+  }
+  const b = QrCodeDataType.Border;
+  input.types.forEach((row) => {
+    for (let i = 0; i < border; i++) {
+      row.unshift(b);
+      row.push(b);
+    }
+  });
+  for (let i = 0; i < border; i++) {
+    input.types.unshift(Array.from({ length: newSize }, (_) => b));
+    input.types.push(Array.from({ length: newSize }, (_) => b));
+  }
+  return input;
+}
+function escapeAttr(value) {
+  return value.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+}
+function renderSVG(data, options = {}) {
+  const result = encode(data, options);
+  const {
+    pixelSize = 10,
+    whiteColor = "white",
+    blackColor = "black"
+  } = options;
+  const height = result.size * pixelSize;
+  const width = result.size * pixelSize;
+  let svg = `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 ${width} ${height}">`;
+  const paths = [];
+  for (let row = 0; row < result.size; row++) {
+    for (let col = 0; col < result.size; col++) {
+      const x = col * pixelSize;
+      const y = row * pixelSize;
+      if (result.data[row][col])
+        paths.push(`M${x},${y}h${pixelSize}v${pixelSize}h-${pixelSize}z`);
+    }
+  }
+  svg += `<rect fill="${escapeAttr(whiteColor)}" width="${width}" height="${height}"/>`;
+  svg += `<path fill="${escapeAttr(blackColor)}" d="${paths.join("")}"/>`;
+  svg += "</svg>";
+  return svg;
+}
+
+// src/protocols.ts
+var PROTOCOLS = [
+  { id: "reality", name: "VLESS Reality", transport: "TCP", insecureLink: false, defaultSelected: true },
+  { id: "hy2", name: "Hysteria2", transport: "UDP", insecureLink: false, defaultSelected: true },
+  { id: "tuic", name: "TUIC v5", transport: "UDP", insecureLink: true, defaultSelected: false },
+  { id: "anytls", name: "AnyTLS", transport: "TCP", insecureLink: true, defaultSelected: false },
+  { id: "ss", name: "Shadowsocks 2022", transport: "TCP+UDP", insecureLink: false, defaultSelected: false }
+];
+var PROTOCOL_IDS = PROTOCOLS.map((p) => p.id);
+var DEFAULT_PROTOCOLS = PROTOCOLS.filter((p) => p.defaultSelected).map((p) => p.id);
+
+// src/client/VpnSettingsPage.tsx
+var import_jsx_runtime = require("react/jsx-runtime");
+var ERROR_KEYS = /* @__PURE__ */ new Set([
+  "not_configured",
+  "auth_failed",
+  "host_key_mismatch",
+  "connect_failed",
+  "timeout",
+  "sudo_failed",
+  "not_root",
+  "no_systemd",
+  "download_failed",
+  "not_installed",
+  "invalid",
+  "cert_needs_ip",
+  "port80_in_use",
+  "cert_failed"
+]);
+var FIELD_KEYS = /* @__PURE__ */ new Set(["host", "port", "username", "password", "protocols", "linkAddress", "certMode"]);
+function errorText(t, f) {
+  if (f.error === "invalid" && f.field !== void 0 && FIELD_KEYS.has(f.field)) return t(`field.${f.field}`);
+  const key = ERROR_KEYS.has(f.error) ? `err.${f.error}` : "err.other";
+  return t(key, { message: f.message ?? f.error });
+}
+function formOf(s) {
+  return { host: s.host, port: s.port, username: s.username, password: "", protocols: [...s.protocols], certMode: s.certMode, linkAddress: s.linkAddress };
+}
+var sameForm = (a, b) => a.host === b.host && a.port === b.port && a.username === b.username && a.password === b.password && a.linkAddress === b.linkAddress && a.certMode === b.certMode && a.protocols.join() === [...b.protocols].join();
+function transportsFor(id) {
+  const t = PROTOCOLS.find((p) => p.id === id)?.transport ?? "TCP";
+  return t === "TCP+UDP" ? ["tcp", "udp"] : [t.toLowerCase()];
+}
+function QrCard({ item, t }) {
+  const [copied, setCopied] = (0, import_react.useState)(false);
+  const info = PROTOCOLS.find((p) => p.id === item.id);
+  const svg = (0, import_react.useMemo)(() => renderSVG(item.link, { ecc: "M", border: 2, pixelSize: 4 }), [item.link]);
+  return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: "dshvpn-qr-card", children: [
+    /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: "dshvpn-qr-head", children: [
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("strong", { children: info?.name ?? item.id }),
+      /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("span", { className: "dshvpn-muted", children: [
+        t("portLabel", { port: item.port }),
+        " \xB7 ",
+        info?.transport
+      ] })
+    ] }),
+    /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", { className: "dshvpn-qr", dangerouslySetInnerHTML: { __html: svg } }),
+    item.insecure === true && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(import_dsh_client_ui_primitives.Tag, { tone: "warning", children: t("insecureTag") }),
+    /* @__PURE__ */ (0, import_jsx_runtime.jsx)("code", { className: "dshvpn-link", title: item.link, children: item.link }),
+    /* @__PURE__ */ (0, import_jsx_runtime.jsx)(import_dsh_client_ui_primitives.Button, { size: "sm", variant: "outline", onClick: () => {
+      void (0, import_dsh_client_ui_primitives.writeClipboard)(item.link).then(() => {
+        setCopied(true);
+        setTimeout(() => {
+          setCopied(false);
+        }, 1500);
+      });
+    }, children: copied ? t("copied") : t("copy") })
+  ] });
+}
+function VpnSettingsPage({ view, t, api }) {
+  const [saved, setSaved] = (0, import_react.useState)(null);
+  const [form, setForm] = (0, import_react.useState)(null);
+  const [busy, setBusy] = (0, import_react.useState)(null);
+  const [notice, setNotice] = (0, import_react.useState)(null);
+  const [links, setLinks] = (0, import_react.useState)(null);
+  const [regenerate, setRegenerate] = (0, import_react.useState)(false);
+  const [confirming, setConfirming] = (0, import_react.useState)(null);
+  (0, import_react.useEffect)(() => {
+    let live = true;
+    void api.getSettings().then((r) => {
+      if (!live) return;
+      if (r.ok) {
+        setSaved(r.settings);
+        setForm(formOf(r.settings));
+      } else setNotice({ tone: "error", text: errorText(t, r) });
+    });
+    return () => {
+      live = false;
+    };
+  }, [api, t]);
+  if (view === "summary") return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(import_jsx_runtime.Fragment, { children: t("description") });
+  if (!saved || !form) return /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", { className: "dshvpn-muted", children: notice?.text ?? t("working") });
+  const dirty = !sameForm(form, formOf(saved));
+  const set = (key, value) => {
+    setForm({ ...form, [key]: value });
+  };
+  const toggle = (id, on) => {
+    set("protocols", PROTOCOLS.map((p) => p.id).filter((p) => p === id ? on : form.protocols.includes(p)));
+  };
+  async function op(name, call, onOk) {
+    setBusy(name);
+    setNotice(null);
+    try {
+      const r = await call();
+      setNotice(r.ok ? onOk(r) : { tone: "error", text: errorText(t, r) });
+      return r;
+    } finally {
+      setBusy(null);
+    }
+  }
+  const save = () => op("save", () => api.saveSettings(form), (r) => {
+    setSaved(r.settings);
+    setForm(formOf(r.settings));
+    return { tone: "success", text: t("saved") };
+  });
+  const refreshSettings = async () => {
+    const r = await api.getSettings();
+    if (r.ok) {
+      setSaved(r.settings);
+      setForm((f) => f && { ...f });
+    }
+  };
+  const portsReminder = (l) => t("cloudFirewall", {
+    ports: [
+      ...l.items.map((i) => transportsFor(i.id).map((tr) => `${i.port}/${tr.toUpperCase()}`).join(" ")),
+      ...l.cert === "ip" ? ["80/TCP"] : []
+    ].join(", ")
+  });
+  const install = async () => {
+    const r = await op("install", () => api.install(regenerate), (v) => {
+      if (v.links) setLinks(v.links);
+      return { tone: "success", text: `${t("installed")} ${v.links ? portsReminder(v.links) : ""}` };
+    });
+    if (!r.ok && r.links) setLinks(r.links);
+    setRegenerate(false);
+    void refreshSettings();
+  };
+  const disabled = busy !== null;
+  const needsSave = dirty || !saved.configured;
+  return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: "dshvpn", children: [
+    /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("section", { children: [
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("h3", { children: t("serverSection") }),
+      /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: "dshvpn-grid", children: [
+        /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("label", { children: [
+          /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { children: t("host") }),
+          /* @__PURE__ */ (0, import_jsx_runtime.jsx)(import_dsh_client_ui_primitives.Input, { value: form.host, placeholder: "203.0.113.10", onChange: (e) => {
+            set("host", e.target.value);
+          } }),
+          /* @__PURE__ */ (0, import_jsx_runtime.jsx)("small", { className: "dshvpn-muted", children: t("hostHint") })
+        ] }),
+        /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("label", { children: [
+          /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { children: t("port") }),
+          /* @__PURE__ */ (0, import_jsx_runtime.jsx)(import_dsh_client_ui_primitives.Input, { value: String(form.port), inputMode: "numeric", onChange: (e) => {
+            set("port", Number(e.target.value.replace(/\D/g, "")) || 0);
+          } })
+        ] }),
+        /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("label", { children: [
+          /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { children: t("username") }),
+          /* @__PURE__ */ (0, import_jsx_runtime.jsx)(import_dsh_client_ui_primitives.Input, { value: form.username, autoComplete: "off", onChange: (e) => {
+            set("username", e.target.value);
+          } }),
+          /* @__PURE__ */ (0, import_jsx_runtime.jsx)("small", { className: "dshvpn-muted", children: t("usernameHint") })
+        ] }),
+        /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("label", { children: [
+          /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { children: t("password") }),
+          /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
+            import_dsh_client_ui_primitives.Input,
+            {
+              type: "password",
+              value: form.password,
+              autoComplete: "new-password",
+              placeholder: saved.hasPassword ? t("passwordSaved") : t("passwordEmpty"),
+              onChange: (e) => {
+                set("password", e.target.value);
+              }
+            }
+          )
+        ] }),
+        /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("label", { className: "dshvpn-wide", children: [
+          /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { children: t("linkAddress") }),
+          /* @__PURE__ */ (0, import_jsx_runtime.jsx)(import_dsh_client_ui_primitives.Input, { value: form.linkAddress, placeholder: form.host, onChange: (e) => {
+            set("linkAddress", e.target.value);
+          } }),
+          /* @__PURE__ */ (0, import_jsx_runtime.jsx)("small", { className: "dshvpn-muted", children: t("linkAddressHint") })
+        ] })
+      ] }),
+      /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: "dshvpn-hostkey", children: [
+        /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { children: t("hostKey") }),
+        /* @__PURE__ */ (0, import_jsx_runtime.jsx)("code", { children: saved.hostKey ?? t("hostKeyNone") }),
+        saved.hostKey !== null && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
+          import_dsh_client_ui_primitives.Button,
+          {
+            size: "sm",
+            variant: "ghost",
+            disabled,
+            onClick: () => {
+              void op("forget", api.forgetHostKey, (r) => {
+                setSaved(r.settings);
+                return null;
+              });
+            },
+            children: t("forgetHostKey")
+          }
+        ),
+        /* @__PURE__ */ (0, import_jsx_runtime.jsx)("small", { className: "dshvpn-muted", children: t("hostKeyHint") })
+      ] })
+    ] }),
+    /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("section", { children: [
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("h3", { children: t("protocolSection") }),
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("small", { className: "dshvpn-muted", children: t("protocolHint") }),
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", { className: "dshvpn-protocols", children: PROTOCOLS.map((p) => /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: "dshvpn-protocol", children: [
+        /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
+          import_dsh_client_ui_primitives.Checkbox,
+          {
+            label: p.name,
+            checked: form.protocols.includes(p.id),
+            disabled,
+            onChange: (on) => {
+              toggle(p.id, on);
+            }
+          }
+        ),
+        /* @__PURE__ */ (0, import_jsx_runtime.jsx)(import_dsh_client_ui_primitives.Tag, { children: p.transport }),
+        p.insecureLink && form.certMode === "self" && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { title: t("insecureHint"), children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(import_dsh_client_ui_primitives.Tag, { tone: "warning", children: t("insecureTag") }) })
+      ] }, p.id)) })
+    ] }),
+    /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("section", { children: [
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("h3", { children: t("certSection") }),
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("small", { className: "dshvpn-muted", children: t("certHint") }),
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", { className: "dshvpn-protocols", children: ["self", "ip"].map((mode) => /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("label", { className: "dshvpn-radio", children: [
+        /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
+          "input",
+          {
+            type: "radio",
+            name: "dshvpn-cert",
+            checked: form.certMode === mode,
+            disabled,
+            onChange: () => {
+              set("certMode", mode);
+            }
+          }
+        ),
+        /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("span", { children: [
+          /* @__PURE__ */ (0, import_jsx_runtime.jsx)("strong", { children: mode === "ip" ? t("certIp") : t("certSelf") }),
+          /* @__PURE__ */ (0, import_jsx_runtime.jsx)("small", { className: "dshvpn-muted", children: mode === "ip" ? t("certIpHint") : t("certSelfHint") })
+        ] })
+      ] }, mode)) })
+    ] }),
+    /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: "dshvpn-actions", children: [
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)(import_dsh_client_ui_primitives.Button, { variant: "primary", disabled: disabled || !dirty, onClick: () => {
+        void save();
+      }, children: t("save") }),
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
+        import_dsh_client_ui_primitives.Button,
+        {
+          variant: "outline",
+          disabled: disabled || needsSave,
+          onClick: () => {
+            void op("test", api.test, (r) => {
+              void refreshSettings();
+              return { tone: "success", text: t("testOk", { system: String(r.result?.system ?? "") }) };
+            });
+          },
+          children: t("test")
+        }
+      ),
+      dirty && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("small", { className: "dshvpn-warn", children: t("unsaved") })
+    ] }),
+    /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("section", { children: [
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("h3", { children: t("deploySection") }),
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)(import_dsh_client_ui_primitives.Checkbox, { label: t("regenerate"), checked: regenerate, disabled, onChange: setRegenerate }),
+      /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: "dshvpn-actions", children: [
+        confirming === "regenerate" ? /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(import_jsx_runtime.Fragment, { children: [
+          /* @__PURE__ */ (0, import_jsx_runtime.jsx)(import_dsh_client_ui_primitives.Button, { variant: "primary", onClick: () => {
+            setConfirming(null);
+            void install();
+          }, children: t("confirmRegenerate") }),
+          /* @__PURE__ */ (0, import_jsx_runtime.jsx)(import_dsh_client_ui_primitives.Button, { variant: "ghost", onClick: () => {
+            setConfirming(null);
+          }, children: t("cancel") })
+        ] }) : /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
+          import_dsh_client_ui_primitives.Button,
+          {
+            variant: "primary",
+            disabled: disabled || needsSave,
+            onClick: () => {
+              if (regenerate) setConfirming("regenerate");
+              else void install();
+            },
+            children: t("install")
+          }
+        ),
+        /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
+          import_dsh_client_ui_primitives.Button,
+          {
+            variant: "outline",
+            disabled: disabled || needsSave,
+            onClick: () => {
+              void op("status", api.status, (r) => {
+                const res = r.result ?? {};
+                if (res.installed !== true) return { tone: "info", text: t("statusNotInstalled") };
+                const listening = Object.entries(res.listening ?? {}).map(([id, ok]) => `${PROTOCOLS.find((p) => p.id === id)?.name ?? id} ${ok ? "\u2713" : "\u2717"}`).join("  ");
+                const head = res.active === true ? t("statusActive", { version: String(res.version ?? "") }) : t("statusInactive");
+                const cert = res.cert ?? {};
+                const hours = cert.expires_in_hours ?? 0;
+                const certProblem = cert.mode === "ip" && (cert.issued !== true || hours < 24);
+                const certLine = cert.mode !== "ip" ? "" : cert.issued !== true ? `
+${t("certNotIssued")}` : hours < 0 ? `
+${t("certExpired")}` : hours < 24 ? `
+${t("certExpiring", { hours })}` : `
+${t("certExpires", { date: new Date(cert.expires ?? "").toLocaleString(), hours })}`;
+                const healthy = res.active === true && !certProblem;
+                return { tone: healthy ? "success" : "error", text: `${head} ${t("listening")}: ${listening}${certLine}` };
+              });
+            },
+            children: t("status")
+          }
+        ),
+        confirming === "uninstall" ? /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(import_jsx_runtime.Fragment, { children: [
+          /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
+            import_dsh_client_ui_primitives.Button,
+            {
+              variant: "primary",
+              className: "dshvpn-danger",
+              onClick: () => {
+                setConfirming(null);
+                void op("uninstall", api.uninstall, () => {
+                  setLinks(null);
+                  return { tone: "success", text: t("uninstalled") };
+                });
+              },
+              children: t("confirmUninstall")
+            }
+          ),
+          /* @__PURE__ */ (0, import_jsx_runtime.jsx)(import_dsh_client_ui_primitives.Button, { variant: "ghost", onClick: () => {
+            setConfirming(null);
+          }, children: t("cancel") })
+        ] }) : /* @__PURE__ */ (0, import_jsx_runtime.jsx)(import_dsh_client_ui_primitives.Button, { variant: "ghost", className: "dshvpn-danger", disabled: disabled || needsSave, onClick: () => {
+          setConfirming("uninstall");
+        }, children: t("uninstall") })
+      ] })
+    ] }),
+    (busy !== null || notice) && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", { className: `dshvpn-notice dshvpn-${busy !== null ? "info" : notice?.tone}`, role: "status", children: busy !== null ? t("working") : notice?.text }),
+    /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("section", { children: [
+      /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: "dshvpn-row", children: [
+        /* @__PURE__ */ (0, import_jsx_runtime.jsx)("h3", { children: t("qrSection") }),
+        /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
+          import_dsh_client_ui_primitives.Button,
+          {
+            variant: "outline",
+            size: "sm",
+            disabled: disabled || needsSave,
+            onClick: () => {
+              void op("links", api.links, (r) => {
+                if (r.links) setLinks(r.links);
+                return null;
+              });
+            },
+            children: t("refresh")
+          }
+        )
+      ] }),
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("small", { className: "dshvpn-muted", children: t("qrHint") }),
+      links ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", { className: "dshvpn-qr-grid", children: links.items.map((item) => /* @__PURE__ */ (0, import_jsx_runtime.jsx)(QrCard, { item, t }, item.id)) }) : /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { className: "dshvpn-muted", children: t("qrEmpty") })
+    ] })
+  ] });
+}
+
+// src/client/index.ts
+var PACKAGE_NAME = "dsh-vpn";
+var inject = ["slots", "locale"];
+function apply(ctx) {
+  ctx.effect(() => ctx.locale.register(NS, { zh, en }), "dsh-vpn: dictionaries");
+  ctx.effect(() => {
+    const style = document.createElement("style");
+    style.dataset.dshPlugin = PACKAGE_NAME;
+    style.textContent = STYLES;
+    document.head.append(style);
+    return () => {
+      style.remove();
+    };
+  }, "dsh-vpn: styles");
+  ctx.slots.inject("plugins.bundle.config", () => ctx.slots.register({
+    name: "plugins.bundle.config",
+    key: PACKAGE_NAME,
+    locale: NS,
+    inject: () => ({ api: vpnApi })
+  }, VpnSettingsPage));
+}
+
+		return module.exports;
+	}
+});