dsh-webdav-sync 1.0.1 → 1.0.3

package/lib/state.d.ts

@@ -18,7 +18,7 @@ export declare const CONFIG_NAME = "sync.json";
 /** Name of the sync state file. */
 export declare const STATE_NAME = "sync-state.json";
 /** Name of the cached copy of the server's file. */
-export declare const CACHE_NAME = "sync-server.dshsync";
+export declare const CACHE_NAME = "sync-server.prop";
 /** Name of the directory holding copies the sync replaced. */
 export declare const KEPT_DIR = "sync";
 /** The configuration as first written, before anything is known. */
@@ -47,8 +47,20 @@ export declare function loadConfig(paths: ResolvedPaths): Promise<{
 }>;
 /** Read the sync state; an empty one only when there is none. */
 export declare function loadState(paths: ResolvedPaths): Promise<StoredState>;
-/** Write the configuration, 0600 because it holds two secrets. */
+/** Write the configuration, 0600 because it holds upstream and local credentials. */
 export declare function saveConfig(paths: ResolvedPaths, config: SyncConfig): Promise<void>;
+/**
+ * Write the configuration the way `rememberPassword` says it must be written.
+ *
+ * The configuration in hand always carries a usable password: one that was typed
+ * this run and deliberately not remembered is put back into it, because a
+ * password emptied out of the running half would leave sync unable to sign in
+ * until the process restarted. Writing that object as it stands would therefore
+ * put on disk exactly the password the user asked not to keep. Every writer of
+ * the configuration goes through here, so that promise has one place to be kept —
+ * see `docs/decisions/0019-session-password-not-remembered.md`.
+ */
+export declare function persistConfig(paths: ResolvedPaths, config: SyncConfig): Promise<void>;
 /** Write the state. It holds no secret, but it does name a folder, so it is 0600 too. */
 export declare function saveState(paths: ResolvedPaths, state: StoredState): Promise<void>;
 /** Write the state directory itself, 0700, before anything goes in it. */

package/lib/state.js

@@ -14,8 +14,9 @@
 import { readFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import { createHash } from 'node:crypto';
-import { AUTO_CHOICES, AUTO_MANUAL, BACKUP_EXT, } from './wire.js';
+import { AUTO_CHOICES, AUTO_MANUAL, BACKUP_EXT, RELAY_DEFAULT_PORT, } from './wire.js';
 import { sum } from './crypto.js';
+import { normaliseDirs } from './dirs.js';
 import { isMissing, message, writeAtomic } from './store.js';
 /** Name of the configuration file inside the state directory. */
 export const CONFIG_NAME = 'sync.json';
@@ -40,7 +41,14 @@ export function defaultConfig() {
         defaults: true,
         plugins: true,
         patch: true,
+        dirs: [],
+        dirsEnabled: true,
         rememberPassword: true,
+        headers: '',
+        relayEnabled: false,
+        relayPort: RELAY_DEFAULT_PORT,
+        relayUser: '',
+        relayPassword: '',
     };
 }
 /** The configuration file's path. */
@@ -102,10 +110,30 @@ export async function loadState(paths) {
         return {};
     return raw;
 }
-/** Write the configuration, 0600 because it holds two secrets. */
+/** Write the configuration, 0600 because it holds upstream and local credentials. */
 export async function saveConfig(paths, config) {
     await writeAtomic(configFile(paths), `${JSON.stringify(config, null, 2)}\n`, SECRET_MODE);
 }
+/**
+ * Write the configuration the way `rememberPassword` says it must be written.
+ *
+ * The configuration in hand always carries a usable password: one that was typed
+ * this run and deliberately not remembered is put back into it, because a
+ * password emptied out of the running half would leave sync unable to sign in
+ * until the process restarted. Writing that object as it stands would therefore
+ * put on disk exactly the password the user asked not to keep. Every writer of
+ * the configuration goes through here, so that promise has one place to be kept —
+ * see `docs/decisions/0019-session-password-not-remembered.md`.
+ */
+export async function persistConfig(paths, config) {
+    if (config.rememberPassword) {
+        await saveConfig(paths, config);
+        releasePassword(paths);
+        return;
+    }
+    await saveConfig(paths, { ...config, password: '' });
+    holdPassword(paths, config.password);
+}
 /** Write the state. It holds no secret, but it does name a folder, so it is 0600 too. */
 export async function saveState(paths, state) {
     await writeAtomic(stateFile(paths), `${JSON.stringify(state, null, 2)}\n`, SECRET_MODE);
@@ -189,6 +217,14 @@ export function syncsPart(config, part) {
             return config.plugins;
         case 'patch':
             return config.patch;
+        // The extra directories carry a switch of their own, like the four parts above:
+        // the list of paths says *which* directories, the switch says whether this
+        // computer carries them at all. Off keeps the list — the paths are not
+        // forgotten — and changes nothing anywhere else: the part is carried through
+        // untouched, so a machine that stops carrying them never deletes them for the
+        // others.
+        case 'dirs':
+            return config.dirsEnabled;
     }
 }
 /** Fill in defaults and coerce the several fields that come from a browser. */
@@ -204,6 +240,8 @@ export function normaliseConfig(raw) {
     };
     const auto = raw.autoEvery;
     const autoEvery = typeof auto === 'number' && Number.isInteger(auto) && AUTO_CHOICES.includes(auto) ? auto : AUTO_MANUAL;
+    const port = raw.relayPort;
+    const relayPort = typeof port === 'number' && Number.isInteger(port) && port > 0 && port <= 65_535 ? port : base.relayPort;
     return {
         url: text('url'),
         user: text('user'),
@@ -214,7 +252,14 @@ export function normaliseConfig(raw) {
         defaults: flag('defaults'),
         plugins: flag('plugins'),
         patch: flag('patch'),
+        dirs: Array.isArray(raw.dirs) ? normaliseDirs(raw.dirs) : base.dirs,
+        dirsEnabled: flag('dirsEnabled'),
         rememberPassword: flag('rememberPassword'),
+        headers: text('headers'),
+        relayEnabled: flag('relayEnabled'),
+        relayPort,
+        relayUser: text('relayUser'),
+        relayPassword: text('relayPassword'),
     };
 }
 /**

package/lib/store.d.ts

@@ -137,7 +137,7 @@ export declare function isMissing(cause: unknown): boolean;
  * An error's message, said in one line, with whatever it was caused by.
  *
  * A wrapper's own message is the vaguest part of it — "fetch failed" and
- * "reading dsh-profile.dshsync" name the attempt, while the cause underneath
+ * "reading dsh-profile.prop" name the attempt, while the cause underneath
  * says `ECONNREFUSED` or the parse error, and that is what a reader needs. The
  * chain is followed rather than only read at the top, since the ends that were
  * wrapped twice on the way up are the ones with the reason in them. The walk is

package/lib/store.js

@@ -15,7 +15,7 @@
 import { readFile, writeFile, rename, mkdir, stat, readdir, unlink, chmod } from 'node:fs/promises';
 import { dirname, join } from 'node:path';
 import { randomBytes } from 'node:crypto';
-import { parseDocument, isMap, isScalar, isSeq, Scalar, YAMLSeq } from 'yaml';
+import { parseDocument, isMap, isScalar, isSeq } from 'yaml';
 import { hashJson } from './crypto.js';
 import { BACKUP_EXT, } from './wire.js';
 /** The profile patch row holding the model catalog. */
@@ -49,7 +49,7 @@ export async function readPatch(paths) {
     const contents = document.contents;
     const rows = [];
     if (isSeq(contents)) {
-        contents.items.forEach((item, index) => {
+        contents.items.forEach((item) => {
             if (!isMap(item))
                 return;
             const value = item.toJSON();
@@ -235,7 +235,7 @@ export function applyPatch(patch, parts) {
     if (parts.patch !== undefined) {
         const keep = [];
         const wanted = parts.patch.entries;
-        const wantedByKey = new Map(wanted.map((entry, index) => [keyOf(entry), entry]));
+        const wantedByKey = new Map(wanted.map((entry) => [keyOf(entry), entry]));
         const placed = new Set();
         // Kept in the list so a row the plugin does not understand — a comment, a
         // scalar, an `!!js` expression that parsed to a plain node — is not dropped
@@ -310,10 +310,12 @@ export async function writeIfChanged(file, data) {
     catch (cause) {
         if (!isMissing(cause))
             throw cause;
-        previous = Buffer.alloc(0);
+        // A file that is not there is not the same as one holding no bytes: it has
+        // to be created, and an empty carried file would otherwise never appear.
+        previous = undefined;
     }
     const next = typeof data === 'string' ? Buffer.from(data, 'utf8') : Buffer.from(data);
-    if (previous.equals(next))
+    if (previous !== undefined && previous.equals(next))
         return false;
     await writeAtomic(file, next);
     return true;
@@ -517,7 +519,7 @@ export function isMissing(cause) {
  * An error's message, said in one line, with whatever it was caused by.
  *
  * A wrapper's own message is the vaguest part of it — "fetch failed" and
- * "reading dsh-profile.dshsync" name the attempt, while the cause underneath
+ * "reading dsh-profile.prop" name the attempt, while the cause underneath
  * says `ECONNREFUSED` or the parse error, and that is what a reader needs. The
  * chain is followed rather than only read at the top, since the ends that were
  * wrapped twice on the way up are the ones with the reason in them. The walk is
@@ -554,7 +556,3 @@ function basenameOf(file) {
     const cut = Math.max(file.lastIndexOf('/'), file.lastIndexOf('\\'));
     return cut === -1 ? file : file.slice(cut + 1);
 }
-// The yaml node classes are referenced for the structural edits above, where a
-// re-created row has to be built as a real Map node rather than plain JSON.
-void Scalar;
-void YAMLSeq;

package/lib/wire.d.ts

@@ -42,20 +42,37 @@ export interface RouteError {
  */
 export declare const REMOTE_FOLDER = "dsh-webdav";
 /** The single sealed file this plugin owns on the server. */
-export declare const REMOTE_FILE = "dsh-profile.dshsync";
+export declare const REMOTE_FILE = "dsh-profile.prop";
 /** Extension the sealed envelope is written with. */
-export declare const BACKUP_EXT = ".dshsync";
+export declare const BACKUP_EXT = ".prop";
+/**
+ * The name {@link REMOTE_FILE} had before the suffix changed. Only ever read:
+ * a folder filled by an earlier version still holds its backup under this name,
+ * and finding it by the new one alone would read as "the server has nothing of
+ * ours" — which makes this computer push its own setup up, over whatever the
+ * other computer left there. See `docs/decisions/0035-backup-suffix-prop.md`.
+ */
+export declare const LEGACY_REMOTE_FILE = "dsh-profile.dshsync";
 /**
  * The parts of a DSH setup that travel, in merge order. Each is hashed on its
  * own, so a change to one never drags the others along behind it.
+ *
+ * `dirs` is the one part that does not come from a profile file: it is the whole
+ * set of extra directories the user named, each carried with its files, so a
+ * second computer gets both the path and what is under it. Its empty value is a
+ * real value (`{ dirs: [] }`), not an absent part, because "the list is now
+ * empty" is a change that has to travel like any other.
  */
-export declare const PARTS: readonly ["models", "defaults", "plugins", "patch"];
+export declare const PARTS: readonly ["models", "defaults", "plugins", "patch", "dirs"];
 export type Part = (typeof PARTS)[number];
-/** Human copy for each part, used by the card and by notices. */
-export declare const PART_LABELS: Record<Part, {
-    zh: string;
-    en: string;
-}>;
+/**
+ * Most extra directories one configuration may name.
+ *
+ * Each one is walked on every card open and carried whole on every push, so this
+ * is a bound on the work a configuration can quietly ask for — and the card needs
+ * to know it to stop offering "add" once it is reached.
+ */
+export declare const DIRS_MAX = 5;
 /** One model as the provider catalog declares it. Fields are open: the row is carried verbatim. */
 export interface ModelSpec {
     id: string;
@@ -69,15 +86,6 @@ export interface ModelSpec {
     compat?: Record<string, unknown>;
     [key: string]: unknown;
 }
-/** One provider entry under `llm-pi-ai.config.providers`. */
-export interface ProviderSpec {
-    displayName?: string;
-    apiKeyEnv?: string;
-    api?: string;
-    baseURL?: string;
-    models?: ModelSpec[];
-    [key: string]: unknown;
-}
 /** The `models` part: the model catalog exactly as the profile patch holds it. */
 export interface ModelsPart {
     /** The whole `llm-pi-ai` entry config, so fields beyond `providers` travel too. */
@@ -112,6 +120,53 @@ export interface PluginsPart {
     /** `dsh.profile.bundles`, verbatim and in order. */
     bundles: string[];
 }
+/** One file of an extra directory, carried whole. */
+export interface DirFileSpec {
+    /** Path relative to the directory it belongs to, `/` between segments. */
+    path: string;
+    /** The file's bytes, base64. Text files travel as their UTF-8 bytes like any other. */
+    data: string;
+}
+/** One extra directory: an absolute path on the computer that synced it, and its files. */
+export interface DirSpec {
+    /**
+     * The directory's own path, exactly as the computer that synced it has it. The
+     * path travels so a restore writes back into the same directory, which is what
+     * naming a directory here means.
+     */
+    path: string;
+    /** Its files, ordered by `path`, with the skip list already applied. */
+    files: DirFileSpec[];
+}
+/**
+ * The `dirs` part: directories outside the profile that travel with it.
+ *
+ * This is the one part a machine cannot be asked about cheaply — reading it means
+ * walking every directory the user named — so it is also the one part whose read
+ * can fail in a way that must not look like "the directory is empty". A directory
+ * that cannot be read is reported to the card and left exactly as the server has
+ * it for that sync; see {@link StatusResult.dirProblems}.
+ */
+export interface DirsPart {
+    dirs: DirSpec[];
+}
+/** A configured directory this computer could not read, and why not. */
+export interface DirProblem {
+    /** The configured path, as it is stored. */
+    path: string;
+    /** What went wrong, in a sentence the card can show. */
+    message: string;
+    /**
+     * True when the directory simply is not here.
+     *
+     * The difference from every other problem is not how the card shows it but what a
+     * write is allowed to do: a directory this computer cannot *read* is left alone, so
+     * a sync never writes blind over what it could not see — while one that is merely
+     * absent is exactly where a restore has to create it. Marking it keeps the two
+     * apart after the read has already happened.
+     */
+    missing?: boolean;
+}
 /** Everything one sealed backup carries. Field names are the wire format. */
 export interface Bundle {
     format: 'dsh-webdav-sync-backup';
@@ -124,6 +179,7 @@ export interface Bundle {
     defaults?: DefaultsPart;
     plugins?: PluginsPart;
     patch?: PatchPart;
+    dirs?: DirsPart;
 }
 /** The format word in the envelope; anything else on the server is not ours. */
 export declare const BUNDLE_FORMAT = "dsh-webdav-sync-backup";
@@ -156,6 +212,7 @@ export interface PartHashes {
     defaults?: string;
     plugins?: string;
     patch?: string;
+    dirs?: string;
 }
 /**
  * The variable half of the state: everything a completed sync records.
@@ -188,6 +245,13 @@ export interface StoredState extends SyncRecord {
     key?: string | undefined;
     /** Last sync attempt, ISO-8601. */
     last?: string | undefined;
+    /**
+     * Last attempt that actually moved something, ISO-8601: a push, a part taken
+     * from the server, or a restore. Absent until one has. This is the difference
+     * from {@link StoredState.last}, where every attempt lands whether or not the
+     * two sides had anything new to say to each other.
+     */
+    moved?: string | undefined;
     /** Last failure's message, empty when the last attempt succeeded. */
     error?: string | undefined;
     /**
@@ -218,8 +282,54 @@ export interface SyncConfig {
     plugins: boolean;
     /** Whether the remaining profile-patch rows travel. */
     patch: boolean;
+    /**
+     * Absolute paths of the extra directories that travel with the setup, in the
+     * order the user added them. The list itself is the `dirs` part, so what is
+     * named here is exactly what is synced: adding one starts carrying it, removing
+     * one stops. Never a relative path — see {@link DirSpec}.
+     */
+    dirs: string[];
+    /**
+     * Whether the extra directories travel with this setup.
+     *
+     * The list above is kept either way: switching this off says "this computer does
+     * not carry them", not "forget them". Nothing is deleted anywhere by turning it
+     * off — the server's copy of the part is carried through untouched, exactly as
+     * for the four parts above.
+     */
+    dirsEnabled: boolean;
     /** Whether the plugin's own address, user and password are kept for next time. */
     rememberPassword: boolean;
+    /**
+     * Extra request headers, one `Name: value` per line, sent with every request
+     * to the server. Transport detail: a secret here stays out of the state key
+     * and out of error messages.
+     */
+    headers: string;
+    /**
+     * Whether this computer forwards for other WebDAV clients on it.
+     *
+     * The forwarder is not a second configuration: it goes to the address, account
+     * and headers above, and only adds a door a local client can come in by. Off is
+     * the resting state, and nothing about the sync reads this.
+     */
+    relayEnabled: boolean;
+    /**
+     * The loopback port the forwarder listens on.
+     *
+     * Chosen once and kept: a client holds the whole address as the identity of the
+     * server it syncs with, so a changed port is a different server to it — it would
+     * start its join from scratch.
+     */
+    relayPort: number;
+    /**
+     * The account a client signs in with at the forwarder, minted the first time
+     * forwarding is switched on and then kept: it is written into the client's own
+     * configuration, so a new one would lock that client out.
+     */
+    relayUser: string;
+    /** The password half of {@link relayUser}. Shown to the user, since it exists to be copied. */
+    relayPassword: string;
 }
 /** The configuration as the card sees it: never a secret, only whether one is set. */
 export interface ConfigView {
@@ -232,7 +342,20 @@ export interface ConfigView {
     defaults: boolean;
     plugins: boolean;
     patch: boolean;
+    /** The extra directories that travel, as stored. Not a secret. */
+    dirs: string[];
+    /** Whether the extra directories travel with the current configuration. */
+    dirsEnabled: boolean;
     rememberPassword: boolean;
+    /** Extra request headers, one `Name: value` per line. Not a secret: travels to the card. */
+    headers: string;
+    /** Whether the forwarder is switched on for this configuration. */
+    relayEnabled: boolean;
+    /**
+     * The loopback port it listens on, so the card's draft holds the real one and
+     * shows an address that matches it. Not a secret, and not synced.
+     */
+    relayPort: number;
 }
 /** Where the plugin's files live, as the card shows them. */
 export interface PathsView {
@@ -263,11 +386,32 @@ export interface StatusResult {
     paths: PathsView;
     /** ISO-8601 of the last attempt, absent when none was made. */
     last?: string;
+    /**
+     * ISO-8601 of the last attempt that moved something — a push, a part taken from
+     * the server, a restore, an upload. Absent when none has, and equal to `last`
+     * after a forced or first sync. The gap between the two is a sync that ran and
+     * found nothing to do.
+     */
+    moved?: string;
     /** Last failure's message, empty when the last attempt succeeded. */
     error: string;
     notice?: Notice;
     /** What changed since the last sync, per part. */
     parts: PartView[];
+    /**
+     * The forwarder for other clients on this computer, present whenever the host
+     * has one. It rides the status because it is a switch on this same
+     * configuration: the card reads and writes it with everything else, and a
+     * second route would only be a second way to say the same thing.
+     */
+    relay?: RelayView;
+    /**
+     * Extra directories the configuration names that could not be read here, with
+     * the reason. Present exactly when there is at least one: a directory that
+     * cannot be read is left untouched by the sync rather than read as empty, and
+     * this is how the card is able to say so.
+     */
+    dirProblems?: DirProblem[];
     /** The profile declares plugins the installed tree does not have yet. */
     pendingInstall: boolean;
     /** Which plugins those are, present exactly when {@link pendingInstall} is true. */
@@ -286,7 +430,25 @@ export interface ConfigureBody {
     defaults?: boolean;
     plugins?: boolean;
     patch?: boolean;
+    /** The whole list of extra directories, replacing the stored one. */
+    dirs?: string[];
+    /** Whether the extra directories travel with this setup. */
+    dirsEnabled?: boolean;
     rememberPassword?: boolean;
+    headers?: string;
+    /** Whether the forwarder for other clients on this computer is switched on. */
+    relayEnabled?: boolean;
+    /**
+     * The loopback port it listens on.
+     *
+     * It is asked for rather than fixed because a port can already be taken, and a
+     * forwarder that could not be moved off a taken one would simply be unusable on
+     * that computer. Changing it is the same edit as turning the switch on: the
+     * card shows the address to paste, so the new one is in front of the user as
+     * they do it. Nothing else is affected — `sync.json` is this computer's own
+     * file and never travels, so another computer keeps its own port.
+     */
+    relayPort?: number;
 }
 /** POST {@link ROUTE_SYNC} body. */
 export interface SyncBody {
@@ -344,3 +506,52 @@ export interface PreviewResult {
     /** What the merge would do, part by part. Empty when nothing changed anywhere. */
     changes: PreviewChange[];
 }
+/** Loopback port the forwarder listens on when nothing else was asked for. */
+export declare const RELAY_DEFAULT_PORT = 3426;
+/** Bytes of randomness in the generated account's name; hex, so it is easy to type. */
+export declare const RELAY_USER_BYTES = 2;
+/** Bytes of randomness in its password; hex, so it is easy to copy. */
+export declare const RELAY_PASSWORD_BYTES = 16;
+/**
+ * The forwarder as the card shows it.
+ *
+ * It carries the account in the clear, unlike everything else the card is told:
+ * the whole reason the account exists is to be written into another program, and
+ * a secret the user cannot read is one they cannot copy. It lives in the plugin's
+ * own `sync.json`, which is the same file the WebDAV password is in.
+ */
+export interface RelayView {
+    /** Whether anything listens. */
+    enabled: boolean;
+    /** The loopback port it listens on. */
+    port: number;
+    /** The address to give a client, or '' while there is nothing to hand out. */
+    url: string;
+    /** The account a client signs in with. */
+    user: string;
+    /** Its password. */
+    password: string;
+    /** Whether it is listening right now. */
+    listening: boolean;
+    /** Why it is not, empty when all is well. */
+    error: string;
+}
+/**
+ * The address a client is given: loopback, the port, and the server's own path.
+ *
+ * The path is carried over so that the rest of the address means the same thing
+ * to the client as the real server's address did — a client that joins its own
+ * paths onto the host alone, and one that keeps the base path it was given, both
+ * end up asking for the same place. Pure form: the same port and target always
+ * give the same address.
+ */
+export declare function relayUrl(port: number, basePath: string): string;
+/**
+ * The path part of a WebDAV address, which the forwarded address carries over.
+ *
+ * `https://host/dav/` gives `/dav`; an address with no path, one that cannot be
+ * read at all, or one that is not http(s) gives ''. Both halves work out the
+ * forwarded address from this, so the line the card shows is the address the host
+ * would hand out for the same draft rather than a second opinion about it.
+ */
+export declare function relayBasePath(url: string): string;

package/lib/wire.js

@@ -41,24 +41,39 @@ export const ROUTE_UNDO = `${ROUTE_PREFIX}/undo`;
  */
 export const REMOTE_FOLDER = 'dsh-webdav';
 /** The single sealed file this plugin owns on the server. */
-export const REMOTE_FILE = 'dsh-profile.dshsync';
+export const REMOTE_FILE = 'dsh-profile.prop';
 /** Extension the sealed envelope is written with. */
-export const BACKUP_EXT = '.dshsync';
+export const BACKUP_EXT = '.prop';
+/**
+ * The name {@link REMOTE_FILE} had before the suffix changed. Only ever read:
+ * a folder filled by an earlier version still holds its backup under this name,
+ * and finding it by the new one alone would read as "the server has nothing of
+ * ours" — which makes this computer push its own setup up, over whatever the
+ * other computer left there. See `docs/decisions/0035-backup-suffix-prop.md`.
+ */
+export const LEGACY_REMOTE_FILE = 'dsh-profile.dshsync';
 // ---------------------------------------------------------------------------
 // The sync parts
 // ---------------------------------------------------------------------------
 /**
  * The parts of a DSH setup that travel, in merge order. Each is hashed on its
  * own, so a change to one never drags the others along behind it.
+ *
+ * `dirs` is the one part that does not come from a profile file: it is the whole
+ * set of extra directories the user named, each carried with its files, so a
+ * second computer gets both the path and what is under it. Its empty value is a
+ * real value (`{ dirs: [] }`), not an absent part, because "the list is now
+ * empty" is a change that has to travel like any other.
  */
-export const PARTS = ['models', 'defaults', 'plugins', 'patch'];
-/** Human copy for each part, used by the card and by notices. */
-export const PART_LABELS = {
-    models: { zh: '模型供应商与模型', en: 'Model providers and models' },
-    defaults: { zh: '默认模型', en: 'Default model' },
-    plugins: { zh: '已安装插件', en: 'Installed plugins' },
-    patch: { zh: '其余 profile 配置', en: 'Other profile configuration' },
-};
+export const PARTS = ['models', 'defaults', 'plugins', 'patch', 'dirs'];
+/**
+ * Most extra directories one configuration may name.
+ *
+ * Each one is walked on every card open and carried whole on every push, so this
+ * is a bound on the work a configuration can quietly ask for — and the card needs
+ * to know it to stop offering "add" once it is reached.
+ */
+export const DIRS_MAX = 5;
 /** The format word in the envelope; anything else on the server is not ours. */
 export const BUNDLE_FORMAT = 'dsh-webdav-sync-backup';
 /** The bundle structure version this build writes and reads. */
@@ -69,3 +84,43 @@ export const BUNDLE_APP = 'dsh-webdav-sync';
 export const AUTO_MANUAL = -1;
 /** The intervals the card offers, in minutes. */
 export const AUTO_CHOICES = [AUTO_MANUAL, 3, 15, 30, 60];
+// ---------------------------------------------------------------------------
+// The local forwarder — a switch on the configuration above, not a second one
+// ---------------------------------------------------------------------------
+/** Loopback port the forwarder listens on when nothing else was asked for. */
+export const RELAY_DEFAULT_PORT = 3426;
+/** Bytes of randomness in the generated account's name; hex, so it is easy to type. */
+export const RELAY_USER_BYTES = 2;
+/** Bytes of randomness in its password; hex, so it is easy to copy. */
+export const RELAY_PASSWORD_BYTES = 16;
+/**
+ * The address a client is given: loopback, the port, and the server's own path.
+ *
+ * The path is carried over so that the rest of the address means the same thing
+ * to the client as the real server's address did — a client that joins its own
+ * paths onto the host alone, and one that keeps the base path it was given, both
+ * end up asking for the same place. Pure form: the same port and target always
+ * give the same address.
+ */
+export function relayUrl(port, basePath) {
+    return `http://127.0.0.1:${port}${basePath}`;
+}
+/**
+ * The path part of a WebDAV address, which the forwarded address carries over.
+ *
+ * `https://host/dav/` gives `/dav`; an address with no path, one that cannot be
+ * read at all, or one that is not http(s) gives ''. Both halves work out the
+ * forwarded address from this, so the line the card shows is the address the host
+ * would hand out for the same draft rather than a second opinion about it.
+ */
+export function relayBasePath(url) {
+    try {
+        const parsed = new URL(url);
+        if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:')
+            return '';
+        return parsed.pathname.replace(/\/+$/, '');
+    }
+    catch {
+        return '';
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-webdav-sync",
-  "version": "1.0.1",
+  "version": "1.0.3",
   "description": "用 WebDAV 在多台电脑之间同步 DSH 的配置：模型供应商与模型、默认模型、已安装插件。整个备份在离开本机前用口令加密（AES-256-GCM + PBKDF2），以分片三方合并的方式在服务端保留一个加密文件。",
   "keywords": [
     "dsh",