dsh-zen-remote 2.2.9 → 2.3.1

package/lib/client.js

@@ -2067,7 +2067,7 @@ __modules["client-data/settings-form.js"] = function (require, module, exports)
  * (devices / pairing) plus the T14 envelope (ok / gateway / config / viaGateway).
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ZenRemoteSettingsForm = exports.SETTINGS_FIELDS = exports.IDLE_HOURS_MAX = exports.SERVER_NAME_MAX = exports.RESTART_FIELDS = exports.DEVICE_TOKEN_FIELD = exports.CLIENT_CONFIG_ROUTE = exports.CLIENT_RECONNECT_ROUTE = exports.CLIENT_STATUS_ROUTE = exports.CLIENT_CLAIM_ROUTE = exports.ADMIN_PLUGIN_BRIDGE_ROUTE = exports.ADMIN_PUSH_TEST_ROUTE = exports.ADMIN_ACTION_ROUTE = exports.ADMIN_PAIR_ROUTE = exports.ADMIN_STATUS_ROUTE = void 0;
+exports.ZenRemoteSettingsForm = exports.SETTINGS_FIELDS = exports.IDLE_HOURS_MAX = exports.SERVER_NAME_MAX = exports.RESTART_FIELDS = exports.PAIRING_CODE_LENGTH = exports.PAIRING_CODE_ALPHABET = exports.DEVICE_TOKEN_FIELD = exports.CLIENT_CONFIG_ROUTE = exports.CLIENT_RECONNECT_ROUTE = exports.CLIENT_STATUS_ROUTE = exports.CLIENT_CLAIM_ROUTE = exports.ADMIN_PLUGIN_BRIDGE_ROUTE = exports.ADMIN_PUSH_TEST_ROUTE = exports.ADMIN_ACTION_ROUTE = exports.ADMIN_PAIR_ROUTE = exports.ADMIN_STATUS_ROUTE = void 0;
 exports.deriveClientStatusView = deriveClientStatusView;
 exports.clientStatusLineOf = clientStatusLineOf;
 exports.normalizePairingCode = normalizePairingCode;
@@ -2246,10 +2246,18 @@ function clientStatusLineOf(view, now) {
         default: return { kind: 'unpaired' };
     }
 }
-/** What the pairing-code box keeps as its draft: uppercase, no spaces or
- * hyphens (the gateway strips every other character at claim time anyway). */
+/** The gateway's 32-character unambiguous pairing-code alphabet (no 0/O/1/I/L)
+ * and fixed 8-character length (`lib/lan-gate-server.cjs:330-335`). */
+exports.PAIRING_CODE_ALPHABET = 'ABCDEFGHJKMNPQRSTUVWXYZ23456789';
+exports.PAIRING_CODE_LENGTH = 8;
+/** What the pairing-code box keeps as its draft: uppercase, restricted to the
+ * 32-character pairing-code alphabet (excluding 0/O/1/I/L and symbols), and
+ * capped at 8 characters. */
 function normalizePairingCode(input) {
-    return input.toUpperCase().replace(/[\s-]/g, '');
+    return input
+        .toUpperCase()
+        .replace(/[^ABCDEFGHJKMNPQRSTUVWXYZ23456789]/g, '')
+        .slice(0, exports.PAIRING_CODE_LENGTH);
 }
 /**
  * Whether the settings page may follow the SERVER's record of this device's
@@ -3236,7 +3244,7 @@ exports.zh = {
     // T60: the pairing button's disabled reason while the device-name draft is invalid.
     'settings.client.fixDeviceName': '请先修正设备名称',
     'settings.client.pairingCode': '配对码',
-    'settings.client.pairingCodeHint': '在服务端设置页生成「桌面应用端」配对码后填入（8 位，自动转大写）。',
+    'settings.client.pairingCodeHint': '在服务端设置页生成「桌面应用端」配对码后填入（8 位，自动转大写并过滤 0/O/1/I/L 与符号）。',
     'settings.client.pair': '配对',
     'settings.client.pairing': '配对中…',
     'settings.client.failInvalid': '服务端地址不合法',
@@ -3349,6 +3357,210 @@ exports.zh = {
     'downloadToLocal': '下载到本机',
     'downloadBusy': '下载中…',
     'downloadFailed': '下载失败',
+    // --- GW-10: 远程访问与配对向导（服务端公网/局域网接入 + 手机/桌面客户端配对） ---
+    'wizard.title': '远程访问与设备配对',
+    'wizard.subtitle': '配置本机作为服务端（开放手机与另一台电脑连入）或作为客户端连接远端主机',
+    'wizard.off': '局域网模式 / 待配置',
+    'wizard.step.pick': '选择角色与接入',
+    'wizard.step.configure': '填写连接参数',
+    'wizard.step.verify': '连通验证与配对',
+    'wizard.role.sectionTitle': '本机角色',
+    'wizard.role.host': '作为服务端（主机）',
+    'wizard.role.hostDesc': '本机运行主力会话与网关，允许手机或另一台 DSH 电脑连入并操作会话',
+    'wizard.role.client': '作为桌面客户端（从机）',
+    'wizard.role.clientDesc': '本机连接到另一台 DSH 服务端，在侧边栏直接查看与操作远端共享的会话',
+    'wizard.role.clientPickNote': '切为客户端后，本机将连接到远端服务端的网关（支持公网 HTTPS 域名或局域网 / Tailscale 地址）。点击「下一步」填写服务端地址与配对码。',
+    'wizard.ingressSectionTitle': '服务端接入方式',
+    'wizard.path.caddy': '内置 Caddy（推荐）',
+    'wizard.path.caddyDesc': '适合有公网 IP 的环境。自动下载 Caddy 并通过 Cloudflare DNS 申请证书，无需手写反代配置',
+    'wizard.path.external': '使用已有反向代理',
+    'wizard.path.externalDesc': '适合已部署 Nginx、Caddy 或 Lucky 的环境。提供现成转发规则，直接填入现有反代即可',
+    'wizard.path.cloudflared': 'Cloudflare Tunnel 内网穿透',
+    'wizard.path.cloudflaredDesc': '无需公网 IP，也不必配置路由器端口映射。通过 Cloudflare 隧道直连本机，需域名已接入 Cloudflare',
+    'wizard.path.lan': '局域网 / Tailscale 直连',
+    'wizard.path.lanDesc': '在同一局域网或虚拟局域网内连接手机与另一台电脑，无需域名与公网证书',
+    'wizard.next': '下一步',
+    'wizard.back': '上一步',
+    'wizard.hostName': '服务端显示名称',
+    'wizard.hostNamePlaceholder': '例如：mac-mini',
+    'wizard.hostNameHint': '其他电脑或手机连入后在侧边栏看到的主机名称（可留空使用默认名称）',
+    'wizard.autoShare': '新建会话自动共享给已配对的桌面客户端',
+    'wizard.lanUrl': '局域网 / Tailscale 访问地址（可选）',
+    'wizard.lanUrlPlaceholder': 'http://192.168.1.10:3088',
+    'wizard.lanUrlHint': '填写本机局域网或 Tailscale 地址（如 http://192.168.1.10:3088），方便下一步直接生成手机扫码二维码与客户端连接信息',
+    'wizard.domain': '访问域名',
+    'wizard.domainHint': '填写完整域名，如 dsh.example.com（不带 https:// 和路径）',
+    'wizard.httpsPort': 'HTTPS 端口',
+    'wizard.cfToken': 'Cloudflare API 令牌',
+    'wizard.cfTokenHint': '用于自动申请证书或配置隧道，以 0600 权限保存在本机，不写入配置文件',
+    'wizard.cfTokenHowTo': '如何获取 API 令牌',
+    'wizard.serverUrl': '反代后的公网地址',
+    'wizard.serverUrlHint': '填写完整 HTTPS 根地址，如 https://dsh.example.com（不支持子目录）',
+    'wizard.proxySnippet': '查看 Nginx / Caddy / Lucky 配置参考',
+    'wizard.badDomain': '域名格式无效，请填写如 dsh.example.com 的域名',
+    'wizard.badPort': '端口号需为 1–65535 之间的整数',
+    'wizard.missingToken': '请填写 Cloudflare API 令牌',
+    'wizard.badServerUrl': '请填写有效的根路径地址（公网需 https://，局域网可用 http://，不含子目录）',
+    'wizard.verify.gateway': '本地网关就绪',
+    'wizard.verify.public': '访问地址连通',
+    'wizard.verify.pairing': '设备配对状态',
+    'wizard.light.pass': '正常',
+    'wizard.light.pending': '待验证',
+    'wizard.light.fail': '异常',
+    'wizard.pairTarget.web': '配对手机 / 浏览器（扫码）',
+    'wizard.pairTarget.desktop': '配对另一台电脑（桌面客户端）',
+    'wizard.startVerify': '生成配对二维码',
+    'wizard.reverify': '重新生成二维码',
+    'wizard.pairingCode': '配对码',
+    'wizard.pairingSeconds': '有效期剩余 {seconds} 秒',
+    'wizard.qrHint': '用手机相机或浏览器扫码打开配对页，输入上方配对码完成连接',
+    'wizard.verifyPass': '配对成功，设备 {deviceId} 已连接',
+    'wizard.verifyCookieInsecure': '手机已完成配对，但反向代理未传递 X-Forwarded-Proto: https，导致安全 Cookie 未生效。请检查转发头后重试',
+    'wizard.verifyExpired': '配对码已过期，请点击下方按钮重新生成',
+    'wizard.verifyStale': '接入配置已变更，请重新生成二维码',
+    'wizard.verifyPending': '请用手机扫描二维码并在页面中输入配对码…',
+    'wizard.verifyNotStarted': '点击下方按钮验证访问地址并生成手机配对二维码',
+    'wizard.desktop.addressLabel': '服务端连接地址（供客户端填写）',
+    'wizard.desktop.addressFallback': 'http://<本机局域网IP>:{port}',
+    'wizard.desktop.generate': '生成桌面客户端配对码',
+    'wizard.desktop.regenerate': '重新生成配对码',
+    'wizard.desktop.copyInfo': '复制地址与配对码',
+    'wizard.desktop.guide': '在另一台电脑打开本插件详情页，第 1 步选「作为桌面客户端」，第 2 步填入上方服务端地址与 8 位配对码即可完成连接。',
+    'wizard.desktop.pairedTitle': '已连接的桌面客户端（{count}）',
+    'wizard.desktop.pairedEmpty': '暂未配对桌面客户端',
+    'wizard.client.deviceName': '本机设备名称',
+    'wizard.client.deviceNamePlaceholder': '例如：macbook-pro',
+    'wizard.client.deviceNameHint': '配对后在服务端设备列表中显示的名称',
+    'wizard.client.serverUrl': '服务端地址',
+    'wizard.client.serverUrlPlaceholder': 'https://dsh.example.com 或 http://192.168.1.10:3088',
+    'wizard.client.serverUrlHint': '填写服务端的公网 HTTPS 地址，或局域网 / Tailscale 下的 http://<服务端IP>:3088',
+    'wizard.client.pairingCode': '8 位桌面配对码',
+    'wizard.client.pairingCodePlaceholder': '在服务端向导第 3 步切到「配对另一台电脑」生成',
+    'wizard.client.pairingCodeHint': '输入服务端生成的 8 位桌面客户端专用配对码（自动转大写，自动过滤 0/O/1/I/L 及符号）',
+    'wizard.client.pairAndConnect': '配对并连接服务端',
+    'wizard.client.pairingBusy': '正在配对并连接…',
+    'wizard.client.skipToStatus': '已配对，查看连接状态',
+    'wizard.client.lightCredential': '本地配对凭证',
+    'wizard.client.lightConnection': '服务端连接',
+    'wizard.client.lightSync': '会话与插件同步',
+    'wizard.client.reconfigure': '更换服务端 / 重新配对',
+    'wizard.startFailed': '验证未通过：{reason}',
+    'wizard.startFailedProbe': '无法访问该连接地址（{detail}）',
+    'wizard.startFailedRuntime': '入口服务尚未运行，请先在上方启动',
+    'wizard.startFailedGateway': '本地网关未响应，请检查网关运行状态',
+    'wizard.startFailedPair': '无法生成配对码（{detail}）',
+    'wizard.startFailedUrl': '公网地址格式无效',
+    'wizard.remoteOnly': '安全限制：公网接入向导仅限在服务端本机操作',
+    'wizard.notWired': '当前服务端版本不支持此功能，请升级后重试',
+    'wizard.card.proxyTitle': '反向代理配置参考',
+    'wizard.card.tokenTitle': '获取 Cloudflare API 令牌',
+    'wizard.card.copy': '复制配置',
+    'wizard.card.copied': '已复制',
+    'wizard.card.close': '关闭',
+    'wizard.card.tokenStep1': '登录 Cloudflare 控制台（dash.cloudflare.com），进入右上角「我的个人资料 → API 令牌」（用户令牌，以 cfut_ 开头），或左侧「管理账户 → 账户 API 令牌」（账户令牌，以 cfat_ 开头）',
+    'wizard.card.tokenStep2': '点击「创建令牌」（Create Token），选择「编辑区域 DNS」（Edit zone DNS）模板',
+    'wizard.card.tokenStep3': '在「权限」中保留默认的「区域（Zone）· DNS · 编辑（Edit）」权限',
+    'wizard.card.tokenStep4': '在「区域资源」（Zone Resources）中选择「包括（Include）· 特定区域（Specific zone）· 你的域名」',
+    'wizard.card.tokenStep5': '若使用 Cloudflare Tunnel，点击「+ 添加更多权限」补充下方所列的隧道、账户设置与区域读取权限',
+    'wizard.card.tokenStep6': '点击「继续以显示摘要」（Continue to summary），核对无误后点击「创建令牌」（Create Token）',
+    'wizard.card.tokenStep7': '复制生成的 API 令牌密钥（仅在创建完成页显示一次，关闭后无法再次查看）',
+    'wizard.card.tokenStep8': '粘贴到下方输入框并点击「保存令牌」',
+    'wizard.card.tokenPerms': '所需权限对照',
+    'wizard.card.tokenPermDns': '区域 · DNS · 编辑',
+    'wizard.card.tokenPermDnsWhy': '必选，用于 DNS-01 证书签发与解析记录配置',
+    'wizard.card.tokenPermTunnel': '账户 · Cloudflare Tunnel · 编辑',
+    'wizard.card.tokenPermTunnelWhy': '仅 Cloudflare Tunnel 方式需要',
+    'wizard.card.tokenPermAccount': '账户 · 账户设置 · 读取',
+    'wizard.card.tokenPermAccountWhy': '仅 Cloudflare Tunnel 方式需要（读取账户 ID）',
+    'wizard.card.tokenPermZoneRead': '区域 · 区域 · 读取',
+    'wizard.card.tokenPermZoneReadWhy': '仅 Cloudflare Tunnel 方式需要（定位域名所属区域）',
+    'wizard.card.tokenPaste': '粘贴 API 令牌',
+    'wizard.card.tokenUse': '保存令牌',
+    'wizard.card.migrateTitle': '将域名接入 Cloudflare',
+    'wizard.card.migrateStep1': '在域名注册商后台关闭 DNSSEC（若已开启），并确认域名未锁定 NS（名称服务器）修改',
+    'wizard.card.migrateStep2': '登录 Cloudflare 控制台，在左侧导航进入「域（Domains）→ 概览」，点击「接入域」（Onboard a domain）',
+    'wizard.card.migrateStep3': '输入你的根域名（如 example.com），选择快速扫描 DNS 记录，点击继续并选择 Free 计划',
+    'wizard.card.migrateStep4': '核对扫描出的 DNS 解析记录后继续，复制 Cloudflare 分配的两个名称服务器（Nameservers）地址',
+    'wizard.card.migrateStep5': '前往域名注册商后台，将原有 NS 替换为 Cloudflare 分配的两个名称服务器地址',
+    'wizard.card.migrateStep6': '等待状态变为「活动（Active）」（通常数分钟至数小时），返回此处点击「重新检测域名状态」',
+    'wizard.card.migrateRecheck': '重新检测域名状态',
+    'wizard.card.proxyCheck': '已配置完成，去验证',
+    'wizard.card.portForwardTitle': '路由器端口映射说明',
+    'wizard.card.portForwardStep1': '登录路由器管理后台（常见地址为 192.168.1.1 或 192.168.0.1）',
+    'wizard.card.portForwardStep2': '进入「端口转发 / 虚拟服务器 / NAT」设置页面',
+    'wizard.card.portForwardStep3': '新增 TCP 转发规则：外部端口 {port} 指向本机内网 IP 的 {port} 端口',
+    'wizard.card.portForwardStep4': '保存规则后，使用手机移动网络（关闭 Wi-Fi）测试公网连接',
+    'wizard.portForwardEntry': '非 443 端口：查看路由器端口映射说明',
+    'wizard.migrateEntry': '域名尚未接入 Cloudflare？',
+    'wizard.ingress': '入口服务',
+    'wizard.caddy.start': '启动 Caddy',
+    'wizard.caddy.starting': '正在下载并启动…',
+    'wizard.caddy.stop': '停止',
+    'wizard.caddy.running': 'Caddy 运行中',
+    'wizard.caddy.stopped': 'Caddy 已停止',
+    'wizard.caddy.neverStarted': 'Caddy 未启动',
+    'wizard.caddy.startOk': 'Caddy 已启动',
+    'wizard.caddy.startFailed': 'Caddy 启动失败：{reason}',
+    'wizard.caddy.failDownload': '自动下载失败，请手动安装后重试',
+    'wizard.caddy.failValidate': '生成的配置文件校验未通过',
+    'wizard.caddy.failAlreadyRunning': '服务已在运行中',
+    'wizard.caddy.failMissingToken': '请先在上一步保存 Cloudflare API 令牌',
+    'wizard.caddy.failNoDomain': '请先在上一步填写有效的访问域名',
+    'wizard.caddy.failBadConfig': '配置参数有误：{detail}',
+    'wizard.caddy.failSpawn': '无法拉起 Caddy 进程',
+    'wizard.token.saved': '已保存在本机',
+    'wizard.token.saveFailed': '令牌保存失败，请重试',
+    'wizard.tunnel.setup': '创建并启动隧道',
+    'wizard.tunnel.stop': '停止',
+    'wizard.tunnel.running': '隧道运行中',
+    'wizard.tunnel.stopped': '隧道已停止',
+    'wizard.tunnel.neverStarted': '隧道未启动',
+    'wizard.tunnel.ok': 'Cloudflare 隧道已就绪并开始运行',
+    'wizard.tunnel.conflict': '检测到同名隧道，请选择要复用的隧道：',
+    'wizard.tunnel.useExisting': '复用隧道',
+    'wizard.tunnel.zoneNotFound': '当前令牌下未找到该域名所属的 Cloudflare 区域，请确认域名已接入该账号',
+    'wizard.tunnel.dnsConflict': '该域名已存在指向 {detail} 的 CNAME 记录，请先在 Cloudflare DNS 中清理后再试',
+    'wizard.tunnel.auth': 'Cloudflare 认证失败，请检查令牌权限是否正确',
+    'wizard.tunnel.network': '无法连接 Cloudflare API，请检查网络',
+    'wizard.tunnel.api': 'Cloudflare 接口报错：{detail}',
+    'wizard.tunnel.spawnFailed': 'cloudflared 启动失败：{detail}',
+    'wizard.tunnel.noToken': '请先在上一步保存 Cloudflare API 令牌',
+    'wizard.tunnel.badDomain': '域名格式无效',
+    'wizard.tunnel.checking': '正在配置隧道并启动（首次自动下载 cloudflared）…',
+    'wizard.check.okOnCf': '已确认域名托管在 Cloudflare',
+    'wizard.check.okNotOnCf': '未在 Cloudflare 中找到该域名，请先完成域名接入',
+    'wizard.check.failed': '域名检测失败：{reason}',
+    'wizard.overview.roleLabel': '当前角色',
+    'wizard.overview.gatewayLabel': '本地网关',
+    'wizard.overview.gatewayReady': '运行正常 · 端口 {port}',
+    'wizard.overview.gatewayDown': '未响应',
+    'wizard.overview.ingressLabel': '接入方式与地址',
+    'wizard.overview.devicesLabel': '已配对设备',
+    'wizard.overview.devicesSummary': '手机/网页 {web} 台 · 桌面客户端 {desktop} 台',
+    'wizard.overview.devicesNone': '暂未配对设备',
+    'wizard.overview.clientCredLabel': '本地配对凭证',
+    'wizard.overview.clientConnLabel': '服务端连接',
+    'wizard.overview.clientServerLabel': '远端服务端地址',
+    'wizard.overview.startSetup': '开始配置向导',
+    'wizard.overview.reconfigure': '修改接入配置',
+    'wizard.overview.pairPhone': '配对手机 / 扫码',
+    'wizard.overview.pairDesktop': '配对另一台电脑',
+    'wizard.overview.clientDetail': '连接详情与配对向导',
+    'wizard.overview.emptyIntro': '尚未完成远程访问配置。点击右侧按钮启动向导，按步骤配置本机作为服务端（开放手机与另一台电脑连入）或作为桌面客户端连接远端主机。',
+    'wizard.modal.title': '远程访问与配对向导',
+    'wizard.modal.stepTag': '第 {num} 步',
+    'wizard.modal.step1Desc': '选择本机作为服务端还是桌面客户端；若作为服务端，选择外部设备的连入方式',
+    'wizard.modal.step2Desc': '根据上一步选择的方案，填写对应的连接地址、域名或配对凭证',
+    'wizard.modal.step3Desc': '检测连通状态，并扫码配对手机或生成桌面客户端配对码',
+    'wizard.modal.selectedPlan': '已选方案：{plan}',
+    'wizard.modal.cancel': '取消',
+    'wizard.modal.saveAndNext': '保存并进入验证',
+    'wizard.modal.finish': '完成',
+    'wizard.light.probing': '检测中…',
+    'wizard.overview.manageDevices': '管理设备',
+    'wizard.devicesModal.title': '已配对设备管理',
+    'wizard.devicesModal.subtitle': '查看与管理已配对的手机/网页设备及桌面客户端，支持改名、切换布局或吊销凭证',
+    'wizard.devicesModal.retest': '重新测试连通性',
 };
 /** English dictionary, key-identical to the Chinese source of truth. */
 exports.en = {
@@ -3543,7 +3755,7 @@ exports.en = {
     // T60: the pairing button's disabled reason while the device-name draft is invalid.
     'settings.client.fixDeviceName': 'Fix the device name first',
     'settings.client.pairingCode': 'Pairing code',
-    'settings.client.pairingCodeHint': 'Generate a desktop-client pairing code on the server\u2019s settings page and enter it here (8 characters, uppercased automatically).',
+    'settings.client.pairingCodeHint': 'Generate a desktop-client pairing code on the server\u2019s settings page and enter it here (8 characters; auto-uppercased and filters out 0/O/1/I/L and symbols).',
     'settings.client.pair': 'Pair',
     'settings.client.pairing': 'Pairing…',
     'settings.client.failInvalid': 'The server address is not valid',
@@ -3654,6 +3866,210 @@ exports.en = {
     'downloadToLocal': 'Download to this computer',
     'downloadBusy': 'Downloading…',
     'downloadFailed': 'Download failed',
+    // --- GW-10: remote access & device pairing wizard ---
+    'wizard.title': 'Remote Access & Device Pairing',
+    'wizard.subtitle': 'Set up this machine as a server (for phones and other computers) or as a client connected to a remote host',
+    'wizard.off': 'LAN mode / Not configured',
+    'wizard.step.pick': 'Role & Access',
+    'wizard.step.configure': 'Connection Settings',
+    'wizard.step.verify': 'Verify & Pair',
+    'wizard.role.sectionTitle': 'Machine Role',
+    'wizard.role.host': 'Server (Host)',
+    'wizard.role.hostDesc': 'Runs main sessions and the gateway on this machine so phones or other DSH computers can connect',
+    'wizard.role.client': 'Desktop Client',
+    'wizard.role.clientDesc': 'Connects to another DSH server so shared remote sessions appear directly in this sidebar',
+    'wizard.role.clientPickNote': 'In Client mode, this machine connects to a remote server gateway over HTTPS or LAN / Tailscale. Click "Next" to enter the server address and pairing code.',
+    'wizard.ingressSectionTitle': 'Server Access Method',
+    'wizard.path.caddy': 'Managed Caddy (Recommended)',
+    'wizard.path.caddyDesc': 'Best when you have a public IP. Downloads Caddy and issues TLS certificates via Cloudflare DNS automatically',
+    'wizard.path.external': 'Existing Reverse Proxy',
+    'wizard.path.externalDesc': 'Already running Nginx, Caddy, or Lucky? Copy a ready-made proxy rule into your existing setup',
+    'wizard.path.cloudflared': 'Cloudflare Tunnel',
+    'wizard.path.cloudflaredDesc': 'No public IP or router port forwarding needed. Connects directly through a Cloudflare tunnel',
+    'wizard.path.lan': 'LAN / Tailscale Direct',
+    'wizard.path.lanDesc': 'Connect phones and computers on the same LAN or Tailscale network without a domain or TLS certificate',
+    'wizard.next': 'Next',
+    'wizard.back': 'Back',
+    'wizard.hostName': 'Server Display Name',
+    'wizard.hostNamePlaceholder': 'e.g. mac-mini',
+    'wizard.hostNameHint': 'Name shown in the sidebar of connected computers and phones (leave blank for default)',
+    'wizard.autoShare': 'Automatically share new sessions with paired desktop clients',
+    'wizard.lanUrl': 'LAN / Tailscale URL (optional)',
+    'wizard.lanUrlPlaceholder': 'http://192.168.1.10:3088',
+    'wizard.lanUrlHint': 'Enter this machine\u2019s LAN or Tailscale URL (e.g. http://192.168.1.10:3088) to generate a phone QR code and copyable client address in the next step',
+    'wizard.domain': 'Domain',
+    'wizard.domainHint': 'Full domain name, e.g. dsh.example.com (without https:// or path)',
+    'wizard.httpsPort': 'HTTPS Port',
+    'wizard.cfToken': 'Cloudflare API Token',
+    'wizard.cfTokenHint': 'Used for certificate issuance or tunnel setup. Stored locally (0600) and never written to config files',
+    'wizard.cfTokenHowTo': 'How to create an API token',
+    'wizard.serverUrl': 'Public HTTPS URL',
+    'wizard.serverUrlHint': 'Root HTTPS URL, e.g. https://dsh.example.com (subdirectories are not supported)',
+    'wizard.proxySnippet': 'View Nginx / Caddy / Lucky config snippets',
+    'wizard.badDomain': 'Invalid domain format (e.g. dsh.example.com)',
+    'wizard.badPort': 'Port must be an integer between 1 and 65535',
+    'wizard.missingToken': 'Enter your Cloudflare API token',
+    'wizard.badServerUrl': 'Enter a valid root URL (https:// for public, http:// for LAN, no path)',
+    'wizard.verify.gateway': 'Local gateway',
+    'wizard.verify.public': 'Access URL reachable',
+    'wizard.verify.pairing': 'Device paired',
+    'wizard.light.pass': 'Ready',
+    'wizard.light.pending': 'Waiting',
+    'wizard.light.fail': 'Failed',
+    'wizard.pairTarget.web': 'Pair Phone / Browser (QR)',
+    'wizard.pairTarget.desktop': 'Pair Another Computer (Desktop Client)',
+    'wizard.startVerify': 'Generate Pairing QR Code',
+    'wizard.reverify': 'Regenerate QR Code',
+    'wizard.pairingCode': 'Pairing code',
+    'wizard.pairingSeconds': 'Expires in {seconds}s',
+    'wizard.qrHint': 'Scan with your phone to open the pairing page, then enter the code above',
+    'wizard.verifyPass': 'Paired — device {deviceId} connected',
+    'wizard.verifyCookieInsecure': 'Paired, but the reverse proxy did not pass X-Forwarded-Proto: https. Add the header so secure cookies work, then verify again',
+    'wizard.verifyExpired': 'Pairing code expired — generate a new one below',
+    'wizard.verifyStale': 'Configuration changed — generate a new QR code',
+    'wizard.verifyPending': 'Scan the QR code on your phone and enter the pairing code…',
+    'wizard.verifyNotStarted': 'Click the button below to verify the access URL and generate a phone pairing QR code',
+    'wizard.desktop.addressLabel': 'Server Address (for client machine)',
+    'wizard.desktop.addressFallback': 'http://<LAN-IP>:{port}',
+    'wizard.desktop.generate': 'Generate Desktop Pairing Code',
+    'wizard.desktop.regenerate': 'Regenerate Code',
+    'wizard.desktop.copyInfo': 'Copy Address & Code',
+    'wizard.desktop.guide': 'On the other computer, open this plugin page, choose "Desktop Client" in Step 1, and enter the server address and 8-character code above in Step 2.',
+    'wizard.desktop.pairedTitle': 'Paired Desktop Clients ({count})',
+    'wizard.desktop.pairedEmpty': 'No desktop clients paired yet',
+    'wizard.client.deviceName': 'This Computer\u2019s Name',
+    'wizard.client.deviceNamePlaceholder': 'e.g. macbook-pro',
+    'wizard.client.deviceNameHint': 'Shown in the server\u2019s paired device list',
+    'wizard.client.serverUrl': 'Server Address',
+    'wizard.client.serverUrlPlaceholder': 'https://dsh.example.com or http://192.168.1.10:3088',
+    'wizard.client.serverUrlHint': 'Enter the server\u2019s public HTTPS URL or LAN / Tailscale http://<IP>:3088 address',
+    'wizard.client.pairingCode': '8-Character Desktop Pairing Code',
+    'wizard.client.pairingCodePlaceholder': 'Generated under "Pair Another Computer" in Step 3 on the server',
+    'wizard.client.pairingCodeHint': 'Enter the 8-character desktop client code generated on the server (auto-uppercased; 0/O/1/I/L and symbols are filtered out)',
+    'wizard.client.pairAndConnect': 'Pair & Connect',
+    'wizard.client.pairingBusy': 'Pairing & connecting…',
+    'wizard.client.skipToStatus': 'Already Paired — View Status',
+    'wizard.client.lightCredential': 'Pairing token',
+    'wizard.client.lightConnection': 'Server connection',
+    'wizard.client.lightSync': 'Session & plugin sync',
+    'wizard.client.reconfigure': 'Change Server / Re-pair',
+    'wizard.startFailed': 'Verification failed: {reason}',
+    'wizard.startFailedProbe': 'access URL could not reach this gateway ({detail})',
+    'wizard.startFailedRuntime': 'ingress service is not running — start it above first',
+    'wizard.startFailedGateway': 'local gateway did not respond',
+    'wizard.startFailedPair': 'failed to generate pairing code ({detail})',
+    'wizard.startFailedUrl': 'invalid public URL',
+    'wizard.remoteOnly': 'Security restriction: public access setup is only available directly on the host machine',
+    'wizard.notWired': 'This feature requires a newer server version',
+    'wizard.card.proxyTitle': 'Reverse Proxy Configuration',
+    'wizard.card.tokenTitle': 'Create a Cloudflare API Token',
+    'wizard.card.copy': 'Copy',
+    'wizard.card.copied': 'Copied',
+    'wizard.card.close': 'Close',
+    'wizard.card.tokenStep1': 'In the Cloudflare dashboard (dash.cloudflare.com), open "My Profile → API Tokens" (user token, cfut_) or "Manage Account → Account API tokens" (account token, cfat_)',
+    'wizard.card.tokenStep2': 'Select "Create Token" and choose the "Edit zone DNS" template',
+    'wizard.card.tokenStep3': 'Under Permissions, keep the default "Zone · DNS · Edit" permission',
+    'wizard.card.tokenStep4': 'Under "Zone Resources", select "Include · Specific zone · your domain"',
+    'wizard.card.tokenStep5': 'If using Cloudflare Tunnel, click "+ Add more" to add the tunnel, account settings, and zone read permissions listed below',
+    'wizard.card.tokenStep6': 'Select "Continue to summary", review the details, and select "Create Token"',
+    'wizard.card.tokenStep7': 'Copy the generated token secret (shown only once)',
+    'wizard.card.tokenStep8': 'Paste it below and click "Save Token"',
+    'wizard.card.tokenPerms': 'Required permissions',
+    'wizard.card.tokenPermDns': 'Zone · DNS · Edit',
+    'wizard.card.tokenPermDnsWhy': 'Required for DNS-01 certificate issuance and DNS records',
+    'wizard.card.tokenPermTunnel': 'Account · Cloudflare Tunnel · Edit',
+    'wizard.card.tokenPermTunnelWhy': 'Cloudflare Tunnel only',
+    'wizard.card.tokenPermAccount': 'Account · Account Settings · Read',
+    'wizard.card.tokenPermAccountWhy': 'Cloudflare Tunnel only (reads account ID)',
+    'wizard.card.tokenPermZoneRead': 'Zone · Zone · Read',
+    'wizard.card.tokenPermZoneReadWhy': 'Cloudflare Tunnel only (locates domain zone)',
+    'wizard.card.tokenPaste': 'Paste API token',
+    'wizard.card.tokenUse': 'Save Token',
+    'wizard.card.migrateTitle': 'Add Your Domain to Cloudflare',
+    'wizard.card.migrateStep1': 'Turn off DNSSEC at your domain registrar (if active) and ensure nameserver changes are unlocked',
+    'wizard.card.migrateStep2': 'In the Cloudflare dashboard, go to "Domains → Overview" and select "Onboard a domain"',
+    'wizard.card.migrateStep3': 'Enter your apex domain (e.g. example.com), scan DNS records, click Continue, and select the Free plan',
+    'wizard.card.migrateStep4': 'Review the scanned DNS records, continue, and copy the two assigned Cloudflare nameservers',
+    'wizard.card.migrateStep5': 'At your domain registrar, replace the existing nameservers with the two Cloudflare nameservers',
+    'wizard.card.migrateStep6': 'Once the domain status becomes "Active" on the Domains page, return here and click "Recheck Domain"',
+    'wizard.card.migrateRecheck': 'Recheck Domain',
+    'wizard.card.proxyCheck': 'Configured — Verify Now',
+    'wizard.card.portForwardTitle': 'Router Port Forwarding',
+    'wizard.card.portForwardStep1': 'Sign in to your router admin page (typically 192.168.1.1 or 192.168.0.1)',
+    'wizard.card.portForwardStep2': 'Open "Port Forwarding / Virtual Server / NAT"',
+    'wizard.card.portForwardStep3': 'Add a TCP rule: external port {port} → this machine\u2019s LAN IP on port {port}',
+    'wizard.card.portForwardStep4': 'Save the rule and test the public URL over mobile data (with Wi-Fi turned off)',
+    'wizard.portForwardEntry': 'Non-443 port: router port forwarding guide',
+    'wizard.migrateEntry': 'Domain not on Cloudflare yet?',
+    'wizard.ingress': 'Ingress service',
+    'wizard.caddy.start': 'Start Caddy',
+    'wizard.caddy.starting': 'Downloading & starting…',
+    'wizard.caddy.stop': 'Stop',
+    'wizard.caddy.running': 'Caddy running',
+    'wizard.caddy.stopped': 'Caddy stopped',
+    'wizard.caddy.neverStarted': 'Caddy not started',
+    'wizard.caddy.startOk': 'Caddy started',
+    'wizard.caddy.startFailed': 'Caddy failed to start: {reason}',
+    'wizard.caddy.failDownload': 'auto-download failed — install Caddy manually and retry',
+    'wizard.caddy.failValidate': 'generated config failed validation',
+    'wizard.caddy.failAlreadyRunning': 'already running',
+    'wizard.caddy.failMissingToken': 'save your Cloudflare API token in the previous step first',
+    'wizard.caddy.failNoDomain': 'save a valid domain in the previous step first',
+    'wizard.caddy.failBadConfig': 'invalid configuration: {detail}',
+    'wizard.caddy.failSpawn': 'failed to start Caddy process',
+    'wizard.token.saved': 'Saved locally',
+    'wizard.token.saveFailed': 'Failed to save token — please retry',
+    'wizard.tunnel.setup': 'Create & Start Tunnel',
+    'wizard.tunnel.stop': 'Stop',
+    'wizard.tunnel.running': 'Tunnel running',
+    'wizard.tunnel.stopped': 'Tunnel stopped',
+    'wizard.tunnel.neverStarted': 'Tunnel not started',
+    'wizard.tunnel.ok': 'Cloudflare tunnel is active and running',
+    'wizard.tunnel.conflict': 'A tunnel with this name already exists — select one to reuse:',
+    'wizard.tunnel.useExisting': 'Reuse tunnel',
+    'wizard.tunnel.zoneNotFound': 'Domain zone not found under this token — make sure the domain is active on this Cloudflare account',
+    'wizard.tunnel.dnsConflict': 'A CNAME record for this domain already points to {detail} — remove it in Cloudflare DNS first',
+    'wizard.tunnel.auth': 'Cloudflare authentication failed — check token permissions',
+    'wizard.tunnel.network': 'Could not reach Cloudflare API',
+    'wizard.tunnel.api': 'Cloudflare API error: {detail}',
+    'wizard.tunnel.spawnFailed': 'cloudflared failed to start: {detail}',
+    'wizard.tunnel.noToken': 'Save your Cloudflare API token in the previous step first',
+    'wizard.tunnel.badDomain': 'Invalid domain format',
+    'wizard.tunnel.checking': 'Configuring tunnel & starting (downloading cloudflared on first run)…',
+    'wizard.check.okOnCf': 'Domain is active on Cloudflare',
+    'wizard.check.okNotOnCf': 'Domain not found on Cloudflare — add it to Cloudflare first',
+    'wizard.check.failed': 'Domain check failed: {reason}',
+    'wizard.overview.roleLabel': 'Current Role',
+    'wizard.overview.gatewayLabel': 'Local Gateway',
+    'wizard.overview.gatewayReady': 'Running · port {port}',
+    'wizard.overview.gatewayDown': 'Unreachable',
+    'wizard.overview.ingressLabel': 'Access Method & URL',
+    'wizard.overview.devicesLabel': 'Paired Devices',
+    'wizard.overview.devicesSummary': 'Phone/Web {web} · Desktop {desktop}',
+    'wizard.overview.devicesNone': 'No paired devices yet',
+    'wizard.overview.clientCredLabel': 'Local Credential',
+    'wizard.overview.clientConnLabel': 'Server Connection',
+    'wizard.overview.clientServerLabel': 'Remote Server URL',
+    'wizard.overview.startSetup': 'Start Setup Wizard',
+    'wizard.overview.reconfigure': 'Reconfigure Wizard',
+    'wizard.overview.pairPhone': 'Pair Phone (QR)',
+    'wizard.overview.pairDesktop': 'Pair Desktop Client',
+    'wizard.overview.clientDetail': 'Connection & Pairing Wizard',
+    'wizard.overview.emptyIntro': 'Remote access is not configured yet. Click the button on the right to launch the step-by-step wizard for server access or desktop client pairing.',
+    'wizard.modal.title': 'Remote Access & Pairing Wizard',
+    'wizard.modal.stepTag': 'Step {num}',
+    'wizard.modal.step1Desc': 'Choose whether this machine acts as the server or a desktop client, and select how devices connect',
+    'wizard.modal.step2Desc': 'Fill in the connection URL, domain, or pairing code for your selected plan',
+    'wizard.modal.step3Desc': 'Verify connectivity and pair your phone or desktop client',
+    'wizard.modal.selectedPlan': 'Selected plan: {plan}',
+    'wizard.modal.cancel': 'Cancel',
+    'wizard.modal.saveAndNext': 'Save & Verify',
+    'wizard.modal.finish': 'Done',
+    'wizard.light.probing': 'Checking…',
+    'wizard.overview.manageDevices': 'Manage Devices',
+    'wizard.devicesModal.title': 'Paired Devices',
+    'wizard.devicesModal.subtitle': 'View and manage paired phone/web and desktop client devices — rename, switch layout, or revoke access',
+    'wizard.devicesModal.retest': 'Retest Connectivity',
 };
 };
 __modules["client-data/shares.js"] = function (require, module, exports) {
@@ -17197,6 +17613,2865 @@ function registerSettingsPage(ctx, section) {
     });
 }
 };
+__modules["client-data/qr.js"] = function (require, module, exports) {
+"use strict";
+/**
+ * Minimal QR encoder (GW-10): byte mode, versions 1–5, ECC level L, fixed
+ * mask 0 — enough for any sane origin URL (106 bytes at v5) while keeping
+ * the whole implementation single-block (no interleave) and reviewable.
+ * Returns the module matrix (true = dark) or null when the text does not
+ * fit. Pure: the check script verifies it at decoder level (RS syndromes
+ * all-zero + data recovery + format-info BCH), which is stronger than any
+ * memorized reference vector.
+ *
+ * Standard QR constants only: sizes 21/25/29/33/37, data codewords
+ * 19/34/55/80/108, ECC codewords 7/10/15/20/26, alignment centers
+ * [6,18]/[6,22]/[6,26]/[6,30], Galois field 0x11d, format-info generator
+ * 0x537 XOR-mask 0x5412.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.qrMatrix = qrMatrix;
+const VERSIONS = [
+    { size: 21, dataCodewords: 19, eccCodewords: 7, alignment: null, capacity: 17 },
+    { size: 25, dataCodewords: 34, eccCodewords: 10, alignment: [6, 18], capacity: 32 },
+    { size: 29, dataCodewords: 55, eccCodewords: 15, alignment: [6, 22], capacity: 53 },
+    { size: 33, dataCodewords: 80, eccCodewords: 20, alignment: [6, 26], capacity: 78 },
+    { size: 37, dataCodewords: 108, eccCodewords: 26, alignment: [6, 30], capacity: 106 },
+];
+// --- Galois field GF(256), polynomial 0x11d -----------------------------------
+const EXP = new Uint8Array(512);
+const LOG = new Uint8Array(256);
+{
+    let value = 1;
+    for (let exponent = 0; exponent < 255; exponent++) {
+        EXP[exponent] = value;
+        LOG[value] = exponent;
+        value <<= 1;
+        if (value & 0x100)
+            value ^= 0x11d;
+    }
+    for (let exponent = 255; exponent < 512; exponent++)
+        EXP[exponent] = EXP[exponent - 255] ?? 0;
+}
+function gfMul(a, b) {
+    if (a === 0 || b === 0)
+        return 0;
+    const la = LOG[a];
+    const lb = LOG[b];
+    if (la === undefined || lb === undefined)
+        return 0;
+    return EXP[la + lb] ?? 0;
+}
+/** Reed–Solomon remainder of `data` under the generator for `eccLen` check
+ * codewords (LFSR division). The generator is ∏(x − α^i), i = 0…eccLen−1,
+ * coefficients high-order first; g[j]·x lands at index j, g[j]·α^i at
+ * index j+1. */
+function rsRemainder(data, eccLen) {
+    let generator = [1];
+    for (let i = 0; i < eccLen; i++) {
+        const next = new Array(generator.length + 1).fill(0);
+        for (let j = 0; j < generator.length; j++) {
+            const coefficient = generator[j];
+            if (coefficient === undefined)
+                continue;
+            const low = next[j] ?? 0;
+            const high = next[j + 1] ?? 0;
+            next[j] = low ^ coefficient;
+            next[j + 1] = high ^ gfMul(coefficient, EXP[i] ?? 0);
+        }
+        generator = next;
+    }
+    const remainder = new Uint8Array(eccLen);
+    for (const byte of data) {
+        const factor = byte ^ (remainder[0] ?? 0);
+        remainder.copyWithin(0, 1);
+        remainder[eccLen - 1] = 0;
+        if (factor !== 0) {
+            for (let i = 0; i < eccLen; i++) {
+                remainder[i] = (remainder[i] ?? 0) ^ gfMul(generator[i + 1] ?? 0, factor);
+            }
+        }
+    }
+    return remainder;
+}
+// --- bit assembly --------------------------------------------------------------
+class BitBuffer {
+    bits = [];
+    push(value, length) {
+        for (let shift = length - 1; shift >= 0; shift--)
+            this.bits.push((value >>> shift) & 1);
+    }
+}
+function buildCodewords(text, version) {
+    const buffer = new BitBuffer();
+    buffer.push(0b0100, 4); // byte mode
+    buffer.push(text.length, 8);
+    for (const byte of text)
+        buffer.push(byte, 8);
+    // Terminator (up to 4 zero bits), then pad to a byte boundary.
+    buffer.push(0, Math.min(4, version.dataCodewords * 8 - buffer.bits.length));
+    while (buffer.bits.length % 8 !== 0)
+        buffer.push(0, 1);
+    const bytes = [];
+    for (let i = 0; i < buffer.bits.length; i += 8) {
+        let byte = 0;
+        for (let j = 0; j < 8; j++)
+            byte = (byte << 1) | (buffer.bits[i + j] ?? 0);
+        bytes.push(byte);
+    }
+    // Pad alternately 0xEC / 0x11 to the data capacity.
+    for (let pad = 0; bytes.length < version.dataCodewords; pad++)
+        bytes.push(pad % 2 === 0 ? 0xec : 0x11);
+    const remainder = rsRemainder(Uint8Array.from(bytes), version.eccCodewords);
+    return Uint8Array.from([...bytes, ...remainder]);
+}
+function blankGrid(size) {
+    return Array.from({ length: size }, () => new Array(size).fill(null));
+}
+function placeFinder(grid, row, col) {
+    const n = grid.length;
+    for (let dr = -1; dr <= 7; dr++) {
+        for (let dc = -1; dc <= 7; dc++) {
+            const r = row + dr;
+            const c = col + dc;
+            if (r < 0 || r >= n || c < 0 || c >= n)
+                continue;
+            const inRing = dr >= 0 && dr <= 6 && (dc === 0 || dc === 6);
+            const inRing2 = dc >= 0 && dc <= 6 && (dr === 0 || dr === 6);
+            const inCore = dr >= 2 && dr <= 4 && dc >= 2 && dc <= 4;
+            const target = grid[r];
+            if (target !== undefined)
+                target[c] = inRing || inRing2 || inCore;
+        }
+    }
+}
+function placeAlignment(grid, centers) {
+    for (const row of centers) {
+        for (const col of centers) {
+            // Skip the centers that sit inside a finder's 7×7 (only possible at
+            // the three corners; versions 2–5 have none).
+            let overlapsFinder = false;
+            for (const [fr, fc] of [[0, 0], [0, grid.length - 7], [grid.length - 7, 0]]) {
+                if (row >= fr - 1 && row <= fr + 7 && col >= fc - 1 && col <= fc + 7)
+                    overlapsFinder = true;
+            }
+            if (overlapsFinder)
+                continue;
+            for (let dr = -2; dr <= 2; dr++) {
+                for (let dc = -2; dc <= 2; dc++) {
+                    const target = grid[row + dr];
+                    if (target !== undefined)
+                        target[col + dc] = Math.max(Math.abs(dr), Math.abs(dc)) !== 1;
+                }
+            }
+        }
+    }
+}
+function reserveFormatAreas(grid) {
+    const n = grid.length;
+    // `false` marks RESERVED (kept from the data placer, overwritten by the
+    // real format bits later); null stays "free for data".
+    const put = (row, col, value) => {
+        const target = grid[row];
+        if (target !== undefined)
+            target[col] = value;
+    };
+    for (let i = 0; i <= 8; i++) {
+        if (i !== 6)
+            put(8, i, false);
+        if (i !== 6)
+            put(i, 8, false);
+    }
+    for (let i = 0; i < 8; i++) {
+        put(n - 1 - i, 8, false);
+        // NOTE: unlike the first copy there is NO skip here — the second copy
+        // crosses no timing pattern, and leaving one cell unreserved (the
+        // first-copy rule pasted over) would let a data bit land inside it and
+        // desynchronize the whole stream (v2+).
+        put(8, n - 1 - i, false);
+    }
+    put(n - 8, 8, true); // the fixed dark module
+}
+function formatBits(mask) {
+    const data = (0b01 << 3) | mask; // ECC level L
+    let rem = data << 10;
+    for (let i = 4; i >= 0; i--) {
+        if ((rem >>> (i + 10)) & 1)
+            rem ^= 0x537 << i;
+    }
+    return ((data << 10) | rem) ^ 0x5412;
+}
+function placeFormat(grid, mask) {
+    const n = grid.length;
+    const bits = formatBits(mask);
+    // ISO/IEC 18004 Figure 25: bit 14 (MSB) sits at (8, 0) / (n - 1, 8) and
+    // bit 0 (LSB) sits at (0, 8) / (8, n - 1). Placing LSB-first reverses the
+    // 15-bit BCH codeword and makes every real scanner reject the symbol.
+    const bit = (index) => ((bits >>> index) & 1) === 1;
+    const put = (row, col, value) => {
+        const target = grid[row];
+        if (target !== undefined)
+            target[col] = value;
+    };
+    for (let i = 0; i <= 5; i++)
+        put(8, i, bit(14 - i));
+    put(8, 7, bit(8));
+    put(8, 8, bit(7));
+    put(7, 8, bit(6));
+    for (let i = 9; i <= 14; i++)
+        put(14 - i, 8, bit(14 - i));
+    for (let i = 0; i <= 6; i++)
+        put(n - 1 - i, 8, bit(14 - i));
+    for (let i = 7; i <= 14; i++)
+        put(8, n - 15 + i, bit(14 - i));
+}
+function placeData(grid, codewords) {
+    const n = grid.length;
+    // Fixed mask 0: (row + col) even flips. Any mask decodes; the penalty
+    // optimization is optional and this keeps the implementation small.
+    const maskFlips = (row, col) => (row + col) % 2 === 0;
+    let bitIndex = 7;
+    let byteIndex = 0;
+    let increment = -1;
+    let row = n - 1;
+    // The standard two-column zigzag: from the bottom-right corner upward,
+    // column PAIR by column PAIR, skipping the timing column pair (6).
+    for (let right = n - 1; right >= 0; right -= 2) {
+        if (right === 6)
+            right = 5;
+        // Fill the pair top-to-bottom or bottom-to-top until the edge.
+        while (true) {
+            const cells = grid[row];
+            // `row` is always in range here (the while loop flips before that can
+            // change); the guard only keeps a future invariant break non-fatal.
+            if (cells === undefined)
+                break;
+            for (let col = right; col >= right - 1; col--) {
+                const current = cells[col];
+                if (current !== true && current !== false) {
+                    let dark = false;
+                    const byte = codewords[byteIndex];
+                    if (byte !== undefined && byteIndex < codewords.length)
+                        dark = ((byte >>> bitIndex) & 1) === 1;
+                    if (maskFlips(row, col))
+                        dark = !dark;
+                    cells[col] = dark;
+                    bitIndex -= 1;
+                    if (bitIndex === -1) {
+                        byteIndex += 1;
+                        bitIndex = 7;
+                    }
+                }
+            }
+            row += increment;
+            if (row < 0 || row >= n) {
+                row -= increment;
+                increment = -increment;
+                break;
+            }
+        }
+    }
+}
+/**
+ * The QR matrix for `text` (UTF-8, byte mode), or null when it does not fit
+ * into a version-5-L symbol (106 bytes).
+ */
+function qrMatrix(text) {
+    const bytes = new TextEncoder().encode(text);
+    const version = VERSIONS.find((candidate) => candidate.capacity >= bytes.length);
+    if (version === undefined)
+        return null;
+    const grid = blankGrid(version.size);
+    placeFinder(grid, 0, 0);
+    placeFinder(grid, 0, version.size - 7);
+    placeFinder(grid, version.size - 7, 0);
+    if (version.alignment !== null)
+        placeAlignment(grid, version.alignment);
+    // Timing patterns.
+    for (let i = 8; i < version.size - 8; i++) {
+        const timingRow = grid[6];
+        const column = grid[i];
+        if (timingRow !== undefined && timingRow[i] === null)
+            timingRow[i] = i % 2 === 0;
+        if (column !== undefined && column[6] === null)
+            column[6] = i % 2 === 0;
+    }
+    reserveFormatAreas(grid);
+    const codewords = buildCodewords(bytes, version);
+    placeData(grid, codewords);
+    placeFormat(grid, 0);
+    return grid.map((row) => row.map((cell) => cell === true));
+}
+};
+__modules["client-data/wizard.js"] = function (require, module, exports) {
+"use strict";
+/**
+ * Wizard UI pure logic (GW-10): route constants, wire types, the step
+ * state machine, form validation and the derived lights — everything the
+ * React components need that a test can drive without a DOM. Mirrors of
+ * the host half's shapes (src/wizard/routes.ts / verify.ts /
+ * proxy-snippets.ts) live HERE because the browser bundle cannot import
+ * those modules (they transitively import node builtins through
+ * config.ts); the check script cross-checks the snippet templates against
+ * the host's so the two cannot drift.
+ *
+ * Validation mirrors src/config.ts's `hostOf` for the same reason — the
+ * row layer applies the same rule when the fields land there, so a client
+ * that accepts something the resolver would silently drop would only set
+ * the user up for a mystery.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SNIPPET_KINDS = exports.WIZARD_TUNNEL_STATUS_ROUTE = exports.WIZARD_TUNNEL_STOP_ROUTE = exports.WIZARD_TUNNEL_SETUP_ROUTE = exports.WIZARD_TUNNEL_CHECK_ROUTE = exports.WIZARD_CADDY_STATUS_ROUTE = exports.WIZARD_CADDY_STOP_ROUTE = exports.WIZARD_CADDY_START_ROUTE = exports.WIZARD_TUNNEL_TOKEN_ROUTE = exports.WIZARD_CF_TOKEN_ROUTE = exports.WIZARD_VERIFY_ROUTE = exports.WIZARD_STATUS_ROUTE = void 0;
+exports.tunnelFailureCopy = tunnelFailureCopy;
+exports.tunnelCheckCopy = tunnelCheckCopy;
+exports.initialStep = initialStep;
+exports.isWizardConfigured = isWizardConfigured;
+exports.formSeedOf = formSeedOf;
+exports.upstreamPortOf = upstreamPortOf;
+exports.stepAfterPick = stepAfterPick;
+exports.isValidHostname = isValidHostname;
+exports.isValidPort = isValidPort;
+exports.publicUrlFrom = publicUrlFrom;
+exports.configureReadiness = configureReadiness;
+exports.deriveWizardLights = deriveWizardLights;
+exports.deriveClientWizardLights = deriveClientWizardLights;
+exports.pairingSecondsLeft = pairingSecondsLeft;
+exports.caddyFailureCopy = caddyFailureCopy;
+exports.nginxSnippetText = nginxSnippetText;
+exports.caddySnippetText = caddySnippetText;
+exports.luckyStepTexts = luckyStepTexts;
+/** Wizard route constants — mirror of src/wizard/routes.ts. */
+exports.WIZARD_STATUS_ROUTE = '/_dsh/zen-remote/admin/wizard/status';
+exports.WIZARD_VERIFY_ROUTE = '/_dsh/zen-remote/admin/wizard/verify';
+exports.WIZARD_CF_TOKEN_ROUTE = '/_dsh/zen-remote/admin/wizard/cf-token';
+exports.WIZARD_TUNNEL_TOKEN_ROUTE = '/_dsh/zen-remote/admin/wizard/tunnel-token';
+exports.WIZARD_CADDY_START_ROUTE = '/_dsh/zen-remote/admin/wizard/caddy/start';
+exports.WIZARD_CADDY_STOP_ROUTE = '/_dsh/zen-remote/admin/wizard/caddy/stop';
+exports.WIZARD_CADDY_STATUS_ROUTE = '/_dsh/zen-remote/admin/wizard/caddy/status';
+exports.WIZARD_TUNNEL_CHECK_ROUTE = '/_dsh/zen-remote/admin/wizard/tunnel/check-domain';
+exports.WIZARD_TUNNEL_SETUP_ROUTE = '/_dsh/zen-remote/admin/wizard/tunnel/setup';
+exports.WIZARD_TUNNEL_STOP_ROUTE = '/_dsh/zen-remote/admin/wizard/tunnel/stop';
+exports.WIZARD_TUNNEL_STATUS_ROUTE = '/_dsh/zen-remote/admin/wizard/tunnel/status';
+/** The tunnel setup failure's locale key (plus params). Pure. */
+function tunnelFailureCopy(reason, detail) {
+    switch (reason) {
+        case 'tunnel-conflict':
+            return { key: 'wizard.tunnel.conflict', params: {} };
+        case 'zone-not-found':
+            return { key: 'wizard.tunnel.zoneNotFound', params: {} };
+        case 'dns-conflict':
+            return { key: 'wizard.tunnel.dnsConflict', params: { detail: detail ?? '' } };
+        case 'auth':
+            return { key: 'wizard.tunnel.auth', params: {} };
+        case 'network':
+            return { key: 'wizard.tunnel.network', params: {} };
+        case 'no-token':
+            return { key: 'wizard.tunnel.noToken', params: {} };
+        case 'bad-domain':
+            return { key: 'wizard.tunnel.badDomain', params: {} };
+        case 'spawn-failed':
+            return { key: 'wizard.tunnel.spawnFailed', params: { detail: detail ?? '' } };
+        default:
+            return { key: 'wizard.tunnel.api', params: { detail: detail ?? reason } };
+    }
+}
+/** The domain check's copy (the migration card's re-check). Pure. */
+function tunnelCheckCopy(result) {
+    if (result.ok) {
+        return result.onCloudflare
+            ? { key: 'wizard.check.okOnCf', tone: 'ok' }
+            : { key: 'wizard.check.okNotOnCf', tone: 'error' };
+    }
+    return { key: 'wizard.check.failed', tone: 'error' };
+}
+/** Where the wizard opens: a configured ingress jumps straight to verify. */
+function initialStep(status) {
+    return status !== undefined && status.mode !== 'off' ? 'verify' : 'pick';
+}
+/**
+ * Whether the inline overview card should render the configured status
+ * dashboard instead of the first-time setup prompt.
+ */
+function isWizardConfigured(input) {
+    if (input.effectiveClient) {
+        return input.tokenConfigured || input.clientServerUrl.trim() !== '' || input.clientState === 'connected';
+    }
+    if (input.wizardStatus !== undefined && (input.wizardStatus.mode !== 'off' || input.wizardStatus.publicUrl !== '')) {
+        return true;
+    }
+    return input.pairedDeviceCount > 0 || input.hasSavedHostConfig;
+}
+/**
+ * The configure-form seed from one wizard status projection (GW-fix-3/M1):
+ * the projection (wizard/status) is the ONLY surface that carries the
+ * ingress fields — admin/status strips them by design, so the form must
+ * seed from here. Empty values leave the form untouched.
+ */
+function formSeedOf(status) {
+    if (status === undefined || status.mode === 'off') {
+        return { domain: '', httpsPort: '', serverUrl: '', path: undefined };
+    }
+    return {
+        domain: status.domain,
+        httpsPort: String(status.httpsPort),
+        serverUrl: status.publicUrl,
+        path: status.mode,
+    };
+}
+/**
+ * The reverse-proxy snippet's upstream port: the gateway's ACTUAL port as
+ * the wizard runtime reports it, falling back to the configured default
+ * 3088 when no status has landed yet (GW-fix-3/M2).
+ */
+function upstreamPortOf(status) {
+    return typeof status?.gatewayActualPort === 'number' && status.gatewayActualPort >= 1 && status.gatewayActualPort <= 65535
+        ? status.gatewayActualPort
+        : 3088;
+}
+/** The step AFTER pick, given the user's path choice. */
+function stepAfterPick() {
+    return 'configure';
+}
+/** Hostname shape (mirror of src/config.ts hostOf): bare letters/digits/
+ * dots/inner hyphens, labels ≤ 63, total ≤ 253, no scheme/path/port/
+ * whitespace. IP literals pass. */
+const HOSTNAME_PATTERN = /^[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?(?:\.[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?)*$/;
+function isValidHostname(value) {
+    return value.length <= 253 && HOSTNAME_PATTERN.test(value);
+}
+/** Port strings: [1, 65535]. */
+function isValidPort(value) {
+    if (!/^\d+$/.test(value))
+        return false;
+    const parsed = Number(value);
+    return Number.isInteger(parsed) && parsed >= 1 && parsed <= 65535;
+}
+/** The public origin a verified domain+port answers on (443 hides the port). */
+function publicUrlFrom(domain, httpsPort) {
+    return httpsPort === 443 ? `https://${domain}` : `https://${domain}:${httpsPort}`;
+}
+/** Which configure form is complete enough to advance. */
+function configureReadiness(path, form) {
+    if (path === 'lan') {
+        const trimmed = form.serverUrl.trim().replace(/\/+$/u, '');
+        if (trimmed === '')
+            return { ok: true, publicUrl: '', httpsPort: 443 };
+        let parsed;
+        try {
+            parsed = new URL(trimmed);
+        }
+        catch {
+            return { ok: false, error: 'bad-server-url' };
+        }
+        if ((parsed.protocol !== 'http:' && parsed.protocol !== 'https:') || (parsed.pathname !== '/' && parsed.pathname !== '') || parsed.search !== '' || parsed.hash !== '') {
+            return { ok: false, error: 'bad-server-url' };
+        }
+        return { ok: true, publicUrl: parsed.origin, httpsPort: 443 };
+    }
+    if (path === 'external') {
+        // The user's own reverse proxy: the public origin is the one thing to
+        // get right (same admission the probe applies — https, root path).
+        const trimmed = form.serverUrl.trim().replace(/\/+$/u, '');
+        let parsed;
+        try {
+            parsed = new URL(trimmed);
+        }
+        catch {
+            return { ok: false, error: 'bad-server-url' };
+        }
+        if (parsed.protocol !== 'https:' || (parsed.pathname !== '/' && parsed.pathname !== '') || parsed.search !== '' || parsed.hash !== '') {
+            return { ok: false, error: 'bad-server-url' };
+        }
+        return { ok: true, publicUrl: parsed.origin, httpsPort: 443 };
+    }
+    if (!isValidHostname(form.domain.trim()))
+        return { ok: false, error: 'bad-domain' };
+    if (!isValidPort(form.httpsPort.trim()))
+        return { ok: false, error: 'bad-port' };
+    const port = Number(form.httpsPort.trim());
+    if ((path === 'caddy' || path === 'cloudflared') && form.cfToken.trim() === '')
+        return { ok: false, error: 'missing-token' };
+    return { ok: true, publicUrl: publicUrlFrom(form.domain.trim(), port), httpsPort: port };
+}
+/** Pending-but-started states the lights stay amber on. */
+const VERIFY_PENDING_RESULTS = new Set(['not-started', 'pending', 'stale', 'code-expired']);
+/**
+ * The three progress lights, derived from the admin/status reachability
+ * plus the verification poll result. Before a session is started the poll
+ * answers `not-started`, which is a pending state — the public and pairing
+ * lights stay amber (nothing has been tried, so red would just shout);
+ * once started, an amber poll keeps them amber, a wrong-shape answer
+ * (redirect, someone else's server) turns the public light red, and an
+ * insecure cookie turns the pairing light red without ever passing.
+ */
+function deriveWizardLights(input) {
+    const { poll, startResult } = input;
+    const startProbeFailed = startResult !== undefined && !startResult.ok
+        && (startResult.reason === 'probe-failed' || startResult.reason === 'bad-public-url' || startResult.reason === 'no-public-url');
+    const startProbePassed = startResult?.ok === true && poll?.result !== 'stale' && poll?.result !== 'cookie-insecure';
+    const publicFail = startProbeFailed || (poll !== undefined && poll.result !== 'pass' && !VERIFY_PENDING_RESULTS.has(poll.result));
+    return {
+        gateway: input.gatewayReachable ? 'pass' : 'fail',
+        publicUrl: (poll?.result === 'pass' || startProbePassed) ? 'pass' : publicFail ? 'fail' : 'pending',
+        pairing: poll?.result === 'pass' ? 'pass' : poll?.result === 'cookie-insecure' ? 'fail' : 'pending',
+    };
+}
+const CLIENT_FAIL_STATES = new Set([
+    'unreachable',
+    'revoked',
+    'incompatible',
+    'invalid-url',
+    'unexpected',
+]);
+/**
+ * Derive the three status lights for the desktop sub-client verification
+ * step (`role === 'client'`).
+ */
+function deriveClientWizardLights(input) {
+    const connected = input.clientState === 'connected';
+    const failed = input.clientState !== undefined && CLIENT_FAIL_STATES.has(input.clientState);
+    return {
+        credential: (input.tokenConfigured || connected) ? 'pass' : input.clientState === 'revoked' ? 'fail' : 'pending',
+        connection: connected ? 'pass' : failed ? 'fail' : 'pending',
+        sync: connected ? (input.interceptInstalled === false ? 'fail' : 'pass') : 'pending',
+    };
+}
+/** Pairing-code countdown, whole seconds, never negative. */
+function pairingSecondsLeft(expiresAt, now) {
+    return Math.max(0, Math.ceil((expiresAt - now) / 1000));
+}
+/**
+ * The managed-Caddy start-failure copy: maps the wire error code to a
+ * locale key (+params / manual-install link). Pure — the check script pins
+ * every mapping.
+ */
+function caddyFailureCopy(error, detail, installUrl) {
+    switch (error) {
+        case 'missing-token':
+            return { key: 'wizard.caddy.failMissingToken', params: {} };
+        case 'already-running':
+            return { key: 'wizard.caddy.failAlreadyRunning', params: {} };
+        case 'bad-config':
+            return { key: 'wizard.caddy.failBadConfig', params: { detail: detail ?? '' } };
+        case 'download-failed':
+            return { key: 'wizard.caddy.failDownload', params: {}, ...(installUrl !== undefined ? { installUrl } : {}) };
+        case 'validate-failed':
+            return { key: 'wizard.caddy.failValidate', params: {} };
+        default:
+            return { key: 'wizard.caddy.failSpawn', params: {} };
+    }
+}
+/** Same grammar the row layer and the host half enforce. */
+function valid(input) {
+    if (!isValidHostname(input.domain))
+        return null;
+    if (!isValidHostname(input.upstreamHost))
+        return null;
+    if (!Number.isInteger(input.upstreamPort) || input.upstreamPort < 1 || input.upstreamPort > 65535)
+        return null;
+    return { domain: input.domain, upstream: input.upstreamHost, port: input.upstreamPort };
+}
+function nginxSnippetText(input) {
+    const parts = valid(input);
+    if (parts === null)
+        return null;
+    return [
+        '# 这段放在 http {} 层（若已有同名 map 则跳过）',
+        'map $http_upgrade $connection_upgrade {',
+        '    default upgrade;',
+        "    ''      close;",
+        '}',
+        '',
+        'server {',
+        '    listen 443 ssl;',
+        `    server_name ${parts.domain};`,
+        '',
+        '    location / {',
+        `        proxy_pass http://${parts.upstream}:${parts.port};`,
+        '        proxy_http_version 1.1;',
+        '        proxy_set_header Upgrade $http_upgrade;',
+        '        proxy_set_header Connection $connection_upgrade;',
+        '        proxy_set_header Host $host;',
+        '        proxy_set_header X-Real-IP $remote_addr;',
+        '        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;',
+        '        proxy_set_header X-Forwarded-Proto $scheme;',
+        '        proxy_buffering off;',
+        '        client_max_body_size 128m;',
+        '        proxy_read_timeout 3600s;',
+        '        proxy_send_timeout 3600s;',
+        '    }',
+        '}',
+        '',
+    ].join('\n');
+}
+function caddySnippetText(input) {
+    const parts = valid(input);
+    if (parts === null)
+        return null;
+    return `${parts.domain} {\n    reverse_proxy ${parts.upstream}:${parts.port}\n}\n`;
+}
+/** The Lucky steps (mirror of proxy-snippets.ts luckySteps). */
+function luckyStepTexts(input) {
+    const parts = valid(input);
+    if (parts === null)
+        return null;
+    return [
+        '在 Lucky 的「Web 服务」里新建一条规则，监听 443 端口，绑定你的域名。',
+        `后端（反代目标）填 http://${parts.upstream}:${parts.port}，开启 WebSocket 支持。`,
+        '打开「万事大吉」开关（放行全部路径），保存即可生效。',
+    ];
+}
+/** The snippet kinds the reverse-proxy card tabs over, in tab order. */
+exports.SNIPPET_KINDS = ['nginx', 'caddy', 'lucky'];
+};
+__modules["client/wizard/WizardCard.js"] = function (require, module, exports) {
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WizardCard = WizardCard;
+const jsx_runtime_1 = require("react/jsx-runtime");
+/**
+ * WizardCard (GW-10): the modal popup for steps the user must perform
+ * ELSEWHERE — creating the Cloudflare token, configuring their own
+ * reverse proxy. Numbered steps in the page locale, copy-to-clipboard for
+ * the value or snippet at hand, Esc / backdrop / button to close. Scoped
+ * under `[data-zen-remote="wizard-card"]`.
+ *
+ * Deliberately NO react-dom portal: `react-dom` is not a seed word of the
+ * host browser module table (GW-fix-4 — `check-client-externals` gates the
+ * allowlist), so the overlay renders IN PLACE as a `position: fixed`
+ * layer. That keeps the plugin version-agnostic; the z-index floor of
+ * 1000 clears the Plugins page chrome, and no ancestor of the detail page
+ * establishes a containing block that could clip it.
+ */
+const react_1 = require("react");
+function WizardCard({ title, children, copyText, copyLabel, copiedLabel, closeLabel, primaryAction, onClose }) {
+    const [copied, setCopied] = (0, react_1.useState)(false);
+    const copiedTimer = (0, react_1.useRef)();
+    (0, react_1.useEffect)(() => {
+        const onKey = (event) => {
+            if (event.key === 'Escape')
+                onClose();
+        };
+        document.addEventListener('keydown', onKey);
+        return () => {
+            document.removeEventListener('keydown', onKey);
+            if (copiedTimer.current !== undefined)
+                clearTimeout(copiedTimer.current);
+        };
+    }, [onClose]);
+    const copy = async () => {
+        if (copyText === undefined || copyText === null || copyText === '')
+            return;
+        try {
+            await navigator.clipboard.writeText(copyText);
+            setCopied(true);
+            if (copiedTimer.current !== undefined)
+                clearTimeout(copiedTimer.current);
+            copiedTimer.current = setTimeout(() => setCopied(false), 2000);
+        }
+        catch {
+            // Clipboard denial (permissions, non-secure context): the snippet is
+            // selectable text anyway.
+        }
+    };
+    return ((0, jsx_runtime_1.jsx)("div", { "data-zen-remote": "wizard-card", onClick: onClose, children: (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-cardPanel", onClick: (event) => event.stopPropagation(), children: [(0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-cardHeader", children: [(0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-cardTitle", children: title }), (0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-cardCloseIcon", "aria-label": closeLabel, onClick: onClose, children: "\u00D7" })] }), (0, jsx_runtime_1.jsx)("div", { className: "zr-wizard-cardBody", children: children }), (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-cardActions", children: [(0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-btn", onClick: onClose, children: closeLabel }), copyText !== undefined && copyText !== null && copyText !== '' ? ((0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-btn", onClick: () => { void copy(); }, children: copied ? copiedLabel : copyLabel })) : null, primaryAction] })] }) }));
+}
+};
+__modules["client/wizard/cards/MigrateCard.js"] = function (require, module, exports) {
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MigrateCard = MigrateCard;
+const jsx_runtime_1 = require("react/jsx-runtime");
+const WizardCard_tsx_1 = require("./client/wizard/WizardCard.js");
+const STEPS = ['migrateStep1', 'migrateStep2', 'migrateStep3', 'migrateStep4', 'migrateStep5', 'migrateStep6'];
+function MigrateCard({ t, onRecheck, onClose }) {
+    return ((0, jsx_runtime_1.jsx)(WizardCard_tsx_1.WizardCard, { title: t('wizard.card.migrateTitle'), copyText: null, copyLabel: t('wizard.card.copy'), copiedLabel: t('wizard.card.copied'), closeLabel: t('wizard.card.close'), primaryAction: ((0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-btn zr-wizard-btnPrimary", onClick: onRecheck, children: t('wizard.card.migrateRecheck') })), onClose: onClose, children: (0, jsx_runtime_1.jsx)("div", { className: "zr-wizard-cardSteps", children: STEPS.map((key, index) => ((0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-cardStep", children: `${index + 1}. ${t(`wizard.card.${key}`)}` }, key))) }) }));
+}
+};
+__modules["client/wizard/cards/PortForwardCard.js"] = function (require, module, exports) {
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PortForwardCard = PortForwardCard;
+const jsx_runtime_1 = require("react/jsx-runtime");
+const WizardCard_tsx_1 = require("./client/wizard/WizardCard.js");
+const STEPS = ['portForwardStep1', 'portForwardStep2', 'portForwardStep3', 'portForwardStep4'];
+function PortForwardCard({ t, port, onClose }) {
+    return ((0, jsx_runtime_1.jsx)(WizardCard_tsx_1.WizardCard, { title: t('wizard.card.portForwardTitle'), copyText: null, copyLabel: t('wizard.card.copy'), copiedLabel: t('wizard.card.copied'), closeLabel: t('wizard.card.close'), onClose: onClose, children: (0, jsx_runtime_1.jsx)("div", { className: "zr-wizard-cardSteps", children: STEPS.map((key, index) => ((0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-cardStep", children: `${index + 1}. ${t(`wizard.card.${key}`, { port: String(port) })}` }, key))) }) }));
+}
+};
+__modules["client/wizard/cards/ProxyCard.js"] = function (require, module, exports) {
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ProxyCard = ProxyCard;
+const jsx_runtime_1 = require("react/jsx-runtime");
+/**
+ * ProxyCard (GW-11): the reverse-proxy snippets for the user's OWN proxy,
+ * tabbed nginx / Caddy / Lucky, with the snippet copy button and the
+ * 「我配好了，检查」 button that hands control back to the wizard's
+ * verification step.
+ */
+const react_1 = require("react");
+const wizard_ts_1 = require("./client-data/wizard.js");
+const WizardCard_tsx_1 = require("./client/wizard/WizardCard.js");
+function ProxyCard({ t, domain, upstreamPort, onCheck, onClose }) {
+    const [tab, setTab] = (0, react_1.useState)('nginx');
+    const input = { domain, upstreamHost: '127.0.0.1', upstreamPort };
+    const text = tab === 'nginx'
+        ? (0, wizard_ts_1.nginxSnippetText)(input)
+        : tab === 'caddy' ? (0, wizard_ts_1.caddySnippetText)(input) : ((0, wizard_ts_1.luckyStepTexts)(input) ?? []).join('\n');
+    return ((0, jsx_runtime_1.jsxs)(WizardCard_tsx_1.WizardCard, { title: t('wizard.card.proxyTitle'), copyText: text, copyLabel: t('wizard.card.copy'), copiedLabel: t('wizard.card.copied'), closeLabel: t('wizard.card.close'), primaryAction: ((0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-btn zr-wizard-btnPrimary", onClick: () => { onCheck(); onClose(); }, children: t('wizard.card.proxyCheck') })), onClose: onClose, children: [(0, jsx_runtime_1.jsx)("div", { className: "zr-wizard-cardTabs", children: wizard_ts_1.SNIPPET_KINDS.map((kind) => ((0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-cardTab", "data-selected": tab === kind, onClick: () => setTab(kind), children: kind }, kind))) }), text === null
+                ? (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-cardStep", children: t('wizard.badDomain') })
+                : (0, jsx_runtime_1.jsx)("pre", { className: "zr-wizard-cardCode", children: text })] }));
+}
+};
+__modules["client/wizard/cards/TokenCard.js"] = function (require, module, exports) {
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TokenCard = TokenCard;
+const jsx_runtime_1 = require("react/jsx-runtime");
+/**
+ * TokenCard (GW-11): the Cloudflare API-token creation walkthrough — eight
+ * numbered steps, the permission checklist as a small table, and a
+ * paste-in box that hands the token back to the wizard's form (`onUse`).
+ * The token never persists in component state beyond the box and never
+ * leaves this machine except inside the wizard's own POST.
+ */
+const react_1 = require("react");
+const WizardCard_tsx_1 = require("./client/wizard/WizardCard.js");
+const STEPS = ['tokenStep1', 'tokenStep2', 'tokenStep3', 'tokenStep4', 'tokenStep5', 'tokenStep6', 'tokenStep7', 'tokenStep8'];
+function TokenCard({ t, onUse, onClose }) {
+    const [pasted, setPasted] = (0, react_1.useState)('');
+    return ((0, jsx_runtime_1.jsxs)(WizardCard_tsx_1.WizardCard, { title: t('wizard.card.tokenTitle'), copyText: null, copyLabel: t('wizard.card.copy'), copiedLabel: t('wizard.card.copied'), closeLabel: t('wizard.card.close'), primaryAction: ((0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-btn zr-wizard-btnPrimary", disabled: pasted.trim() === '', onClick: () => onUse(pasted.trim()), children: t('wizard.card.tokenUse') })), onClose: onClose, children: [(0, jsx_runtime_1.jsx)("div", { className: "zr-wizard-cardSteps", children: STEPS.map((key, index) => ((0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-cardStep", children: `${index + 1}. ${t(`wizard.card.${key}`)}` }, key))) }), (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-cardSubhead", children: t('wizard.card.tokenPerms') }), (0, jsx_runtime_1.jsx)("table", { className: "zr-wizard-cardTable", children: (0, jsx_runtime_1.jsxs)("tbody", { children: [(0, jsx_runtime_1.jsxs)("tr", { children: [(0, jsx_runtime_1.jsx)("td", { className: "zr-wizard-cardPerm", children: t('wizard.card.tokenPermDns') }), (0, jsx_runtime_1.jsx)("td", { className: "zr-wizard-cardWhy", children: t('wizard.card.tokenPermDnsWhy') })] }), (0, jsx_runtime_1.jsxs)("tr", { children: [(0, jsx_runtime_1.jsx)("td", { className: "zr-wizard-cardPerm", children: t('wizard.card.tokenPermTunnel') }), (0, jsx_runtime_1.jsx)("td", { className: "zr-wizard-cardWhy", children: t('wizard.card.tokenPermTunnelWhy') })] }), (0, jsx_runtime_1.jsxs)("tr", { children: [(0, jsx_runtime_1.jsx)("td", { className: "zr-wizard-cardPerm", children: t('wizard.card.tokenPermAccount') }), (0, jsx_runtime_1.jsx)("td", { className: "zr-wizard-cardWhy", children: t('wizard.card.tokenPermAccountWhy') })] }), (0, jsx_runtime_1.jsxs)("tr", { children: [(0, jsx_runtime_1.jsx)("td", { className: "zr-wizard-cardPerm", children: t('wizard.card.tokenPermZoneRead') }), (0, jsx_runtime_1.jsx)("td", { className: "zr-wizard-cardWhy", children: t('wizard.card.tokenPermZoneReadWhy') })] })] }) }), (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-field", children: [(0, jsx_runtime_1.jsx)("label", { className: "zr-wizard-label", htmlFor: "zr-wizard-token-paste", children: t('wizard.card.tokenPaste') }), (0, jsx_runtime_1.jsx)("input", { id: "zr-wizard-token-paste", className: "zr-wizard-input", type: "password", value: pasted, onChange: (event) => setPasted(event.target.value) })] })] }));
+}
+};
+__modules["client/wizard/GatewayWizard.js"] = function (require, module, exports) {
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GatewayWizard = GatewayWizard;
+const jsx_runtime_1 = require("react/jsx-runtime");
+/**
+ * GatewayWizard (GW-10): the unified three-step remote-access & device-pairing
+ * guide at the top of the plugin detail page (`plugins.bundle.config`,
+ * `key: 'dsh-zen-remote'`).
+ *
+ * Covers both deployment roles in one entry point:
+ * - Server (`host`): choose the ingress method (Caddy / Reverse Proxy /
+ *   Cloudflare Tunnel / LAN & Tailscale), configure parameters + server
+ *   display name & auto-share, verify connectivity, and pair either a
+ *   Phone/Browser (QR code) or another Desktop DSH Client (8-character
+ *   desktop pairing code + live paired-client list).
+ * - Desktop Client (`client`): enter the server gateway URL + 8-character
+ *   desktop pairing code to claim a device token, and verify live
+ *   connection & session-sync status.
+ */
+const react_1 = require("react");
+const settings_form_ts_1 = require("./client-data/settings-form.js");
+const qr_ts_1 = require("./client-data/qr.js");
+const wizard_ts_1 = require("./client-data/wizard.js");
+const MigrateCard_tsx_1 = require("./client/wizard/cards/MigrateCard.js");
+const PortForwardCard_tsx_1 = require("./client/wizard/cards/PortForwardCard.js");
+const ProxyCard_tsx_1 = require("./client/wizard/cards/ProxyCard.js");
+const TokenCard_tsx_1 = require("./client/wizard/cards/TokenCard.js");
+/** The start failure's locale key + params, from the wire reason. */
+function startFailureCopy(result) {
+    switch (result.reason) {
+        case 'bad-public-url':
+        case 'no-public-url':
+            return { key: 'wizard.startFailedUrl', params: {} };
+        case 'runtime-not-ready':
+            return { key: 'wizard.startFailedRuntime', params: {} };
+        case 'gateway-unreachable':
+            return { key: 'wizard.startFailedGateway', params: {} };
+        case 'pair-refused':
+            return { key: 'wizard.startFailedPair', params: { detail: String(result.detail ?? '') } };
+        case 'probe-failed': {
+            const detail = result.detail;
+            const shape = detail === undefined || detail.kind !== 'reached'
+                ? String(detail?.reason ?? 'network')
+                : `root=${detail.root} admin=${detail.admin}`;
+            return { key: 'wizard.startFailedProbe', params: { detail: shape } };
+        }
+    }
+}
+/** The QR code's SVG path: one rect per dark module, pixel-crisp. */
+function qrSvgPath(matrix, scale) {
+    let path = '';
+    matrix.forEach((cells, row) => {
+        cells.forEach((dark, col) => {
+            if (dark)
+                path += `M${col * scale} ${row * scale}h${scale}v${scale}h-${scale}z`;
+        });
+    });
+    return path;
+}
+const LIGHT_ORDER = [
+    { key: 'wizard.verify.gateway', light: 'gateway' },
+    { key: 'wizard.verify.public', light: 'publicUrl' },
+    { key: 'wizard.verify.pairing', light: 'pairing' },
+];
+const CLIENT_LIGHT_ORDER = [
+    { key: 'wizard.client.lightCredential', light: 'credential' },
+    { key: 'wizard.client.lightConnection', light: 'connection' },
+    { key: 'wizard.client.lightSync', light: 'sync' },
+];
+const LIGHT_LABEL = {
+    pass: 'wizard.light.pass',
+    pending: 'wizard.light.pending',
+    fail: 'wizard.light.fail',
+};
+const STEP_ORDER = ['pick', 'configure', 'verify'];
+const ROLE_OPTIONS = [
+    ['host', 'wizard.role.host', 'wizard.role.hostDesc'],
+    ['client', 'wizard.role.client', 'wizard.role.clientDesc'],
+];
+const PATH_OPTIONS = [
+    ['caddy', 'wizard.path.caddy', 'wizard.path.caddyDesc'],
+    ['external', 'wizard.path.external', 'wizard.path.externalDesc'],
+    ['cloudflared', 'wizard.path.cloudflared', 'wizard.path.cloudflaredDesc'],
+    ['lan', 'wizard.path.lan', 'wizard.path.lanDesc'],
+];
+function clientStatusCopy(view, now, t) {
+    const line = (0, settings_form_ts_1.clientStatusLineOf)(view, now);
+    switch (line.kind) {
+        case 'connectedName': return t('settings.client.statusConnectedName', { serverName: line.serverName });
+        case 'connected': return t('settings.client.statusConnected', { serverUrl: line.serverUrl });
+        case 'offlineRetry': return t('settings.client.statusOfflineRetry', { seconds: line.seconds });
+        case 'offlineRetrySoon': return t('settings.client.statusOfflineRetrySoon');
+        case 'unreachable': return t('settings.client.statusUnreachable');
+        case 'revoked': return t('settings.client.statusRevoked');
+        case 'incompatible': return t('settings.client.statusIncompatible');
+        case 'unexpected': return t('settings.client.statusUnexpected');
+        case 'invalidUrl': return t('settings.client.statusInvalidUrl');
+        default: return t('settings.client.statusUnpaired');
+    }
+}
+function claimFailCopy(code, retryAfterMs, t) {
+    switch (code) {
+        case 'invalid': return t('settings.client.failInvalid');
+        case 'insecure-http': return t('settings.client.failInsecureHttp');
+        case 'bad-code': return t('settings.client.failBadCode');
+        case 'locked': {
+            const minutes = Math.max(1, Math.ceil((retryAfterMs ?? 0) / 60000));
+            return t('settings.client.failLocked', { minutes });
+        }
+        case 'unreachable': return t('settings.client.failUnreachable');
+        case 'role-mismatch': return t('settings.client.failRoleMismatch');
+        default: return t('settings.client.failUnexpected');
+    }
+}
+function GatewayWizard(props) {
+    const { t, config } = props;
+    const [modalOpen, setModalOpen] = (0, react_1.useState)(false);
+    const [devicesModalOpen, setDevicesModalOpen] = (0, react_1.useState)(false);
+    const [step, setStep] = (0, react_1.useState)('pick');
+    const [wizardRole, setWizardRole] = (0, react_1.useState)('host');
+    const [path, setPath] = (0, react_1.useState)('caddy');
+    const [domain, setDomain] = (0, react_1.useState)('');
+    const [httpsPort, setHttpsPort] = (0, react_1.useState)('443');
+    const [cfToken, setCfToken] = (0, react_1.useState)('');
+    const [serverUrl, setServerUrl] = (0, react_1.useState)('');
+    const [hostName, setHostName] = (0, react_1.useState)('');
+    const [autoShare, setAutoShare] = (0, react_1.useState)(true);
+    const [formError, setFormError] = (0, react_1.useState)(null);
+    const [savingConfig, setSavingConfig] = (0, react_1.useState)(false);
+    const [hostSavedInSession, setHostSavedInSession] = (0, react_1.useState)(false);
+    const [wizardStatus, setWizardStatus] = (0, react_1.useState)();
+    const [gatewayReachable, setGatewayReachable] = (0, react_1.useState)(false);
+    const [viaGateway, setViaGateway] = (0, react_1.useState)(false); // default local; server wall is the real gate
+    const [statusLoaded, setStatusLoaded] = (0, react_1.useState)(false);
+    const [allDevices, setAllDevices] = (0, react_1.useState)([]);
+    const [deviceBusy, setDeviceBusy] = (0, react_1.useState)(false);
+    const [deviceError, setDeviceError] = (0, react_1.useState)(false);
+    const [renamingDevice, setRenamingDevice] = (0, react_1.useState)(null);
+    const [pairTarget, setPairTarget] = (0, react_1.useState)('web');
+    const [desktopPairing, setDesktopPairing] = (0, react_1.useState)();
+    const [desktopPairBusy, setDesktopPairBusy] = (0, react_1.useState)(false);
+    const [desktopCopied, setDesktopCopied] = (0, react_1.useState)(false);
+    const [startResult, setStartResult] = (0, react_1.useState)();
+    const [probingUrl, setProbingUrl] = (0, react_1.useState)(false);
+    const [webPairRequested, setWebPairRequested] = (0, react_1.useState)(false);
+    const [poll, setPoll] = (0, react_1.useState)();
+    const [notWired, setNotWired] = (0, react_1.useState)(false);
+    const [now, setNow] = (0, react_1.useState)(() => Date.now());
+    const [card, setCard] = (0, react_1.useState)();
+    const [tokenNotice, setTokenNotice] = (0, react_1.useState)();
+    const [caddyState, setCaddyState] = (0, react_1.useState)();
+    const [caddyBusy, setCaddyBusy] = (0, react_1.useState)(false);
+    const [caddyStartError, setCaddyStartError] = (0, react_1.useState)();
+    const [tunnelState, setTunnelState] = (0, react_1.useState)();
+    const [tunnelBusy, setTunnelBusy] = (0, react_1.useState)(false);
+    const [tunnelResult, setTunnelResult] = (0, react_1.useState)();
+    const [tunnelCheck, setTunnelCheck] = (0, react_1.useState)();
+    const [adoptTunnelId, setAdoptTunnelId] = (0, react_1.useState)();
+    const [probedClient, setProbedClient] = (0, react_1.useState)(null);
+    const selectPath = (0, react_1.useCallback)((nextPath) => {
+        setFormError(null);
+        setPath((prev) => {
+            if (prev !== nextPath) {
+                setCaddyStartError(undefined);
+                setTunnelResult(undefined);
+                setTunnelCheck(undefined);
+                setAdoptTunnelId(undefined);
+                setStartResult(undefined);
+                setPoll(undefined);
+                setWebPairRequested(false);
+            }
+            return nextPath;
+        });
+    }, []);
+    const webDeviceCount = (0, react_1.useMemo)(() => allDevices.filter((d) => d.role === 'web').length, [allDevices]);
+    const desktopDevices = (0, react_1.useMemo)(() => allDevices.filter((d) => d.role === 'desktop-client'), [allDevices]);
+    // Client-mode states
+    const [clientDeviceName, setClientDeviceName] = (0, react_1.useState)('');
+    const [clientServerUrl, setClientServerUrl] = (0, react_1.useState)('');
+    const [clientPairCode, setClientPairCode] = (0, react_1.useState)('');
+    const [clientClaimBusy, setClientClaimBusy] = (0, react_1.useState)(false);
+    const [clientClaimFail, setClientClaimFail] = (0, react_1.useState)(null);
+    const [clientView, setClientView] = (0, react_1.useState)();
+    const [clientLoading, setClientLoading] = (0, react_1.useState)(false);
+    const [clientReconnectBusy, setClientReconnectBusy] = (0, react_1.useState)(false);
+    const [clientUnpairBusy, setClientUnpairBusy] = (0, react_1.useState)(false);
+    // The saved role, live.
+    const roleSnapshot = (0, react_1.useSyncExternalStore)((0, react_1.useCallback)((cb) => config.subscribe(cb), [config]), () => config.getSnapshot());
+    const savedClient = config.savedRoleIsClient();
+    const effectiveClient = savedClient || (probedClient === true && !config.rowRoleKnown());
+    // When the row document carries no role at all, probe the lightweight
+    // client-config route (both roles register it).
+    (0, react_1.useEffect)(() => {
+        if (config.rowRoleKnown())
+            return;
+        let cancelled = false;
+        fetch(settings_form_ts_1.CLIENT_CONFIG_ROUTE)
+            .then((response) => (response.ok ? response.json() : undefined))
+            .then((body) => {
+            if (!cancelled)
+                setProbedClient(body?.role === 'client');
+        })
+            .catch(() => {
+            if (!cancelled)
+                setProbedClient(false);
+        });
+        return () => { cancelled = true; };
+    }, [config, roleSnapshot]);
+    // Seed role & row-stored fields once when the form snapshot settles.
+    const rowSeededRef = (0, react_1.useRef)(false);
+    (0, react_1.useEffect)(() => {
+        if (rowSeededRef.current || roleSnapshot.scopeStatus === 'loading')
+            return;
+        if (!config.rowRoleKnown() && probedClient === null)
+            return;
+        rowSeededRef.current = true;
+        const rowName = typeof config.rowValue('serverName') === 'string' ? config.rowValue('serverName') : '';
+        const rowAutoShare = config.rowValue('autoShareNewSessions');
+        const rowClientUrl = typeof config.rowValue('serverUrl') === 'string' ? config.rowValue('serverUrl') : '';
+        if (rowName !== '') {
+            setHostName(rowName);
+            setClientDeviceName(rowName);
+        }
+        if (typeof rowAutoShare === 'boolean')
+            setAutoShare(rowAutoShare);
+        if (rowClientUrl !== '')
+            setClientServerUrl(rowClientUrl);
+        if (effectiveClient) {
+            setWizardRole('client');
+            setStep(roleSnapshot.deviceToken.configured || rowClientUrl !== '' ? 'verify' : 'configure');
+        }
+        else {
+            setWizardRole('host');
+        }
+    }, [roleSnapshot, probedClient, effectiveClient, config]);
+    const loadClientStatus = (0, react_1.useCallback)(async () => {
+        setClientLoading(true);
+        try {
+            const response = await fetch(settings_form_ts_1.CLIENT_STATUS_ROUTE);
+            if (response.ok) {
+                const body = (await response.json());
+                setClientView((0, settings_form_ts_1.deriveClientStatusView)(body));
+            }
+        }
+        catch {
+            // keep last client view
+        }
+        finally {
+            setClientLoading(false);
+        }
+    }, []);
+    const hostTicketRef = (0, react_1.useRef)(0);
+    const loadHostStatus = (0, react_1.useCallback)(async () => {
+        const mine = ++hostTicketRef.current;
+        try {
+            const [wizardResponse, adminResponse] = await Promise.all([fetch(wizard_ts_1.WIZARD_STATUS_ROUTE), fetch(settings_form_ts_1.ADMIN_STATUS_ROUTE)]);
+            if (wizardResponse.ok && mine === hostTicketRef.current) {
+                const body = (await wizardResponse.json());
+                if (body?.ok === true)
+                    setWizardStatus(body);
+            }
+            if (adminResponse.ok && mine === hostTicketRef.current) {
+                const body = (await adminResponse.json());
+                if (body?.ok === true) {
+                    setGatewayReachable(body.gatewayReachable === true);
+                    setViaGateway(body.viaGateway === true);
+                    const derived = (0, settings_form_ts_1.deriveSettingsView)(body, { now: Date.now() });
+                    setAllDevices(derived.devices);
+                    if (derived.pairing?.role === 'desktop-client' && typeof body.gateway?.pairing?.expiresAt === 'number') {
+                        setDesktopPairing({ code: derived.pairing.code, expiresAt: body.gateway.pairing.expiresAt });
+                    }
+                }
+            }
+            if (mine === hostTicketRef.current)
+                setStatusLoaded(true);
+        }
+        catch {
+            // keep the last ready data
+        }
+    }, []);
+    // Poll host routes when on host role, or client status when on client role.
+    (0, react_1.useEffect)(() => {
+        if (effectiveClient) {
+            void loadClientStatus();
+            const handle = setInterval(() => { void loadClientStatus(); }, 5000);
+            return () => clearInterval(handle);
+        }
+        void loadHostStatus();
+        const handle = setInterval(() => { void loadHostStatus(); }, 5000);
+        return () => clearInterval(handle);
+    }, [effectiveClient, loadClientStatus, loadHostStatus]);
+    const runDeviceAction = async (payload) => {
+        setDeviceBusy(true);
+        setDeviceError(false);
+        try {
+            const response = await fetch(settings_form_ts_1.ADMIN_ACTION_ROUTE, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify(payload),
+            });
+            const body = (await response.json().catch(() => ({})));
+            if (response.ok && body.ok === true) {
+                await loadHostStatus();
+            }
+            else {
+                setDeviceError(true);
+            }
+        }
+        catch {
+            setDeviceError(true);
+        }
+        finally {
+            setDeviceBusy(false);
+        }
+    };
+    // Close the wizard modal or devices modal on Escape when no sub-card is open and not mid-save.
+    (0, react_1.useEffect)(() => {
+        if ((!modalOpen && !devicesModalOpen) || card !== undefined)
+            return;
+        const onKey = (event) => {
+            if (event.key === 'Escape' && !savingConfig && !clientClaimBusy && !deviceBusy) {
+                if (renamingDevice !== null) {
+                    setRenamingDevice(null);
+                    return;
+                }
+                if (devicesModalOpen) {
+                    setDevicesModalOpen(false);
+                    return;
+                }
+                setModalOpen(false);
+            }
+        };
+        document.addEventListener('keydown', onKey);
+        return () => document.removeEventListener('keydown', onKey);
+    }, [modalOpen, devicesModalOpen, card, savingConfig, clientClaimBusy, deviceBusy, renamingDevice]);
+    // Seed the entry step AND the configure forms from the FIRST ready
+    // wizard status on a host deployment.
+    const seededRef = (0, react_1.useRef)(false);
+    (0, react_1.useEffect)(() => {
+        if (seededRef.current || wizardStatus === undefined || effectiveClient)
+            return;
+        seededRef.current = true;
+        setStep((0, wizard_ts_1.initialStep)(wizardStatus));
+        const seed = (0, wizard_ts_1.formSeedOf)(wizardStatus);
+        if (seed.path !== undefined)
+            setPath(seed.path);
+        else if (wizardStatus.publicUrl !== '')
+            setPath('lan');
+        if (seed.domain !== '')
+            setDomain(seed.domain);
+        if (seed.httpsPort !== '')
+            setHttpsPort(seed.httpsPort);
+        if (seed.serverUrl !== '') {
+            setServerUrl(seed.serverUrl);
+        }
+        else if (wizardStatus.mode === 'off' && wizardStatus.lanAddress !== undefined && wizardStatus.lanAddress !== '') {
+            setServerUrl(`http://${wizardStatus.lanAddress}:${(0, wizard_ts_1.upstreamPortOf)(wizardStatus)}`);
+        }
+    }, [wizardStatus, effectiveClient]);
+    // Verification polling: only while a web pairing session is active and could still move.
+    const pollVerdict = poll?.result;
+    (0, react_1.useEffect)(() => {
+        const active = webPairRequested
+            && startResult?.ok === true
+            && startResult.pairingCode !== ''
+            && (pollVerdict === undefined || pollVerdict === 'not-started' || pollVerdict === 'pending');
+        if (!active)
+            return;
+        let cancelled = false;
+        const beat = async () => {
+            try {
+                const response = await fetch(wizard_ts_1.WIZARD_VERIFY_ROUTE);
+                if (!response.ok || cancelled)
+                    return;
+                const body = (await response.json());
+                if (body?.result !== undefined && !cancelled)
+                    setPoll(body);
+            }
+            catch {
+                // keep the last verdict
+            }
+        };
+        const handle = setInterval(() => { void beat(); }, 3000);
+        void beat();
+        return () => {
+            cancelled = true;
+            clearInterval(handle);
+        };
+    }, [webPairRequested, startResult, pollVerdict]);
+    // Countdown ticker while a web or desktop pairing code (or client retry) is active.
+    const hasActiveCountdown = (webPairRequested && startResult?.ok === true && startResult.pairingCode !== '')
+        || (desktopPairing !== undefined && desktopPairing.expiresAt > now)
+        || clientView?.nextRetryAt !== undefined;
+    (0, react_1.useEffect)(() => {
+        if (!hasActiveCountdown)
+            return;
+        const handle = setInterval(() => setNow(Date.now()), 1000);
+        return () => clearInterval(handle);
+    }, [hasActiveCountdown]);
+    const disabled = !effectiveClient && viaGateway;
+    const tokenSaved = wizardStatus?.cfTokenConfigured === true || tokenNotice === 'saved';
+    const effectiveCfToken = cfToken.trim() !== '' ? cfToken : (tokenSaved ? '__SAVED__' : '');
+    const readiness = (0, react_1.useMemo)(() => (0, wizard_ts_1.configureReadiness)(path, { domain, httpsPort, cfToken: effectiveCfToken, serverUrl }), [path, domain, httpsPort, effectiveCfToken, serverUrl]);
+    const resolvedVerifyUrl = (0, react_1.useMemo)(() => {
+        if (path === 'external' || path === 'lan') {
+            const trimmed = serverUrl.trim();
+            if (trimmed !== '')
+                return trimmed;
+        }
+        if (readiness.ok && readiness.publicUrl !== '')
+            return readiness.publicUrl;
+        if (wizardStatus?.publicUrl !== undefined && wizardStatus.publicUrl !== '')
+            return wizardStatus.publicUrl;
+        if (path === 'lan') {
+            const lanHost = wizardStatus?.lanAddress !== undefined && wizardStatus.lanAddress !== ''
+                ? wizardStatus.lanAddress
+                : '127.0.0.1';
+            return `http://${lanHost}:${(0, wizard_ts_1.upstreamPortOf)(wizardStatus)}`;
+        }
+        return '';
+    }, [path, serverUrl, readiness, wizardStatus]);
+    const probeAccessUrl = (0, react_1.useCallback)(async (urlToProbe) => {
+        if (urlToProbe === '')
+            return;
+        setNotWired(false);
+        setProbingUrl(true);
+        try {
+            const sendProbe = () => fetch(wizard_ts_1.WIZARD_VERIFY_ROUTE, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ publicUrl: urlToProbe, probeOnly: true }),
+            });
+            let response = await sendProbe();
+            // When switching from client to host role, the plugin row reloads and the
+            // gateway child process takes a brief moment to bind its port. Retry once
+            // or twice before surfacing a transient 404 or gateway-unreachable.
+            for (let attempt = 0; attempt < 2; attempt++) {
+                if (response.status === 404) {
+                    await new Promise((resolve) => setTimeout(resolve, 900));
+                    response = await sendProbe();
+                    continue;
+                }
+                const clone = (await response.clone().json().catch(() => undefined));
+                if (clone !== undefined && !clone.ok && clone.reason === 'gateway-unreachable') {
+                    await new Promise((resolve) => setTimeout(resolve, 900));
+                    response = await sendProbe();
+                    continue;
+                }
+                break;
+            }
+            if (response.status === 501) {
+                setNotWired(true);
+                return;
+            }
+            const body = (await response.json());
+            if (body.ok)
+                setGatewayReachable(true);
+            setStartResult((prev) => {
+                // Keep an active web pairing code on screen if one was already requested and probe passed.
+                if (body.ok && prev?.ok === true && prev.pairingCode !== '' && body.pairingCode === '') {
+                    return prev;
+                }
+                return body;
+            });
+        }
+        catch {
+            setStartResult({ ok: false, reason: 'gateway-unreachable' });
+        }
+        finally {
+            setProbingUrl(false);
+        }
+    }, []);
+    // Automatically test access URL connectivity when the verify step opens (or when
+    // managed Caddy / Tunnel transitions to running while on the verify step).
+    (0, react_1.useEffect)(() => {
+        if (!modalOpen || step !== 'verify' || wizardRole !== 'host' || disabled)
+            return;
+        if (resolvedVerifyUrl === '')
+            return;
+        void probeAccessUrl(resolvedVerifyUrl);
+    }, [modalOpen, step, wizardRole, disabled, resolvedVerifyUrl, caddyState, tunnelState, probeAccessUrl]);
+    const saveTokenValue = async (rawToken) => {
+        try {
+            const response = await fetch(wizard_ts_1.WIZARD_CF_TOKEN_ROUTE, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ token: rawToken }),
+            });
+            if (response.status === 404 && effectiveClient) {
+                await props.saveRowFields({
+                    role: 'host',
+                    autoShareNewSessions: autoShare,
+                    ...(hostName.trim() !== '' ? { serverName: hostName.trim() } : {}),
+                });
+                setProbedClient(false);
+                for (let i = 0; i < 6; i++) {
+                    await new Promise((resolve) => setTimeout(resolve, 650));
+                    const retry = await fetch(wizard_ts_1.WIZARD_CF_TOKEN_ROUTE, {
+                        method: 'POST',
+                        headers: { 'Content-Type': 'application/json' },
+                        body: JSON.stringify({ token: rawToken }),
+                    });
+                    if (retry.status !== 404) {
+                        const ok = retry.ok;
+                        setTokenNotice(ok ? 'saved' : 'failed');
+                        if (ok)
+                            setCfToken('');
+                        return ok;
+                    }
+                }
+            }
+            const ok = response.ok;
+            setTokenNotice(ok ? 'saved' : 'failed');
+            if (ok)
+                setCfToken('');
+            return ok;
+        }
+        catch {
+            setTokenNotice('failed');
+            return false;
+        }
+    };
+    const advanceFromConfigure = async () => {
+        setFormError(null);
+        if (!readiness.ok) {
+            setFormError(readiness.error);
+            return;
+        }
+        setSavingConfig(true);
+        const wasClient = effectiveClient;
+        const currentHostSetting = typeof config.rowValue('host') === 'string' ? config.rowValue('host').trim() : '';
+        const needsLanHostBind = path === 'lan' && currentHostSetting !== '0.0.0.0' && currentHostSetting !== '::';
+        try {
+            try {
+                const baseFields = {
+                    role: 'host',
+                    autoShareNewSessions: autoShare,
+                    ...(hostName.trim() !== '' ? { serverName: hostName.trim() } : {}),
+                };
+                if (path === 'lan') {
+                    // LAN / Tailscale direct connections arrive on the machine's LAN or
+                    // Tailscale interface, so the gateway child must bind to `0.0.0.0`
+                    // rather than loopback-only `127.0.0.1`.
+                    await props.saveRowFields({
+                        ...baseFields,
+                        host: '0.0.0.0',
+                        ingressMode: 'off',
+                        ...(readiness.publicUrl !== '' ? { ingressPublicUrl: readiness.publicUrl } : {}),
+                    }, readiness.publicUrl === '' ? { unset: ['ingressPublicUrl'] } : undefined);
+                }
+                else if (path === 'external') {
+                    await props.saveRowFields({
+                        ...baseFields,
+                        ingressMode: 'external',
+                        ingressPublicUrl: readiness.publicUrl,
+                    });
+                }
+                else {
+                    await props.saveRowFields({
+                        ...baseFields,
+                        ingressMode: path,
+                        ingressDomain: domain.trim(),
+                        ingressHttpsPort: readiness.httpsPort,
+                    });
+                }
+                // If this machine was previously in client mode or just rebound
+                // `host` to `0.0.0.0` for LAN access, wait for the restart-watcher to
+                // reload the plugin row and respawn the local gateway child process
+                // before saving the token or probing.
+                if (wasClient || needsLanHostBind) {
+                    setProbedClient(false);
+                    if (needsLanHostBind && !wasClient) {
+                        // Give the restart-watcher time to observe the `host` change and
+                        // restart the gateway child on 0.0.0.0.
+                        await new Promise((resolve) => setTimeout(resolve, 900));
+                    }
+                    for (let i = 0; i < 6; i++) {
+                        await new Promise((resolve) => setTimeout(resolve, 650));
+                        try {
+                            const res = await fetch(settings_form_ts_1.ADMIN_STATUS_ROUTE);
+                            if (res.ok) {
+                                const body = (await res.json());
+                                if (body?.ok === true && body.gatewayReachable === true)
+                                    break;
+                            }
+                        }
+                        catch {
+                            // keep waiting for gateway startup
+                        }
+                    }
+                    await loadHostStatus();
+                }
+            }
+            catch {
+                // Even if the row mutation is pending mirror sync, proceed to token save / verify.
+            }
+            if ((path === 'caddy' || path === 'cloudflared') && cfToken.trim() !== '') {
+                const saved = await saveTokenValue(cfToken.trim());
+                if (!saved)
+                    return;
+            }
+            // Mode-switch process synchronization: stop any managed ingress process
+            // that does not belong to the newly saved path so an old tunnel or
+            // Caddy child never keeps running across a mode change.
+            if (path !== 'caddy') {
+                fetch(wizard_ts_1.WIZARD_CADDY_STOP_ROUTE, { method: 'POST' }).catch(() => { });
+                setCaddyState('stopped');
+                setCaddyStartError(undefined);
+            }
+            if (path !== 'cloudflared') {
+                fetch(wizard_ts_1.WIZARD_TUNNEL_STOP_ROUTE, { method: 'POST' }).catch(() => { });
+                setTunnelState('stopped');
+                setTunnelResult(undefined);
+                setTunnelCheck(undefined);
+                setAdoptTunnelId(undefined);
+            }
+            await loadHostStatus();
+            setHostSavedInSession(true);
+            setStep('verify');
+        }
+        finally {
+            setSavingConfig(false);
+        }
+    };
+    const startVerification = async () => {
+        const publicUrl = resolvedVerifyUrl;
+        setNotWired(false);
+        setWebPairRequested(true);
+        setProbingUrl(true);
+        try {
+            const response = await fetch(wizard_ts_1.WIZARD_VERIFY_ROUTE, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ publicUrl }),
+            });
+            if (response.status === 501) {
+                setNotWired(true);
+                return;
+            }
+            const body = (await response.json());
+            if (body.ok)
+                setGatewayReachable(true);
+            setStartResult(body);
+            setPoll(body.ok ? { result: 'not-started' } : undefined);
+        }
+        catch {
+            setStartResult({ ok: false, reason: 'gateway-unreachable' });
+            setPoll(undefined);
+        }
+        finally {
+            setProbingUrl(false);
+        }
+    };
+    const runDesktopPair = async () => {
+        setDesktopPairBusy(true);
+        setDesktopCopied(false);
+        try {
+            const response = await fetch(settings_form_ts_1.ADMIN_PAIR_ROUTE, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ role: 'desktop-client' }),
+            });
+            if (response.ok) {
+                const body = (await response.json());
+                if (body?.ok === true && typeof body.code === 'string' && typeof body.expiresAt === 'number') {
+                    setDesktopPairing({ code: body.code, expiresAt: body.expiresAt });
+                }
+            }
+        }
+        catch {
+            // ignore network error; user can retry
+        }
+        finally {
+            setDesktopPairBusy(false);
+        }
+    };
+    const resolvedHostEndpoint = (0, react_1.useMemo)(() => {
+        if (path === 'external' || path === 'lan') {
+            const trimmed = serverUrl.trim();
+            if (trimmed !== '')
+                return trimmed;
+        }
+        if (readiness.ok && readiness.publicUrl !== '')
+            return readiness.publicUrl;
+        if (wizardStatus?.publicUrl !== undefined && wizardStatus.publicUrl !== '')
+            return wizardStatus.publicUrl;
+        const port = (0, wizard_ts_1.upstreamPortOf)(wizardStatus);
+        if (wizardStatus?.lanAddress !== undefined && wizardStatus.lanAddress !== '') {
+            return `http://${wizardStatus.lanAddress}:${port}`;
+        }
+        return `http://<服务端局域网IP>:${port}`;
+    }, [path, serverUrl, readiness, wizardStatus]);
+    const copyDesktopInfo = async () => {
+        if (desktopPairing === undefined)
+            return;
+        const text = `服务端地址：${resolvedHostEndpoint}\n桌面客户端配对码：${desktopPairing.code}`;
+        try {
+            await navigator.clipboard?.writeText(text);
+            setDesktopCopied(true);
+        }
+        catch {
+            // ignore clipboard refusal
+        }
+    };
+    const runClientClaim = async () => {
+        setFormError(null);
+        setClientClaimFail(null);
+        const trimmedUrl = clientServerUrl.trim();
+        const normalizedCode = (0, settings_form_ts_1.normalizePairingCode)(clientPairCode);
+        if (trimmedUrl === '' || !/^https?:\/\//i.test(trimmedUrl)) {
+            setFormError('bad-client-url');
+            return;
+        }
+        if (normalizedCode === '') {
+            setFormError('bad-client-code');
+            return;
+        }
+        setClientClaimBusy(true);
+        try {
+            // If the deployment is currently running as 'host', switch role to 'client'
+            // first so the backend restart-watcher reloads the plugin into client mode
+            // and registers CLIENT_CLAIM_ROUTE.
+            if (!effectiveClient) {
+                try {
+                    await props.saveRowFields({
+                        role: 'client',
+                        ...(clientDeviceName.trim() !== '' ? { serverName: clientDeviceName.trim() } : {}),
+                    });
+                    await new Promise((resolve) => setTimeout(resolve, 1600));
+                }
+                catch {
+                    // proceed to claim attempt
+                }
+            }
+            const deviceName = (0, settings_form_ts_1.claimDeviceNameOf)(clientDeviceName, t('settings.client.deviceNameDefault'));
+            const response = await fetch(settings_form_ts_1.CLIENT_CLAIM_ROUTE, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({
+                    serverUrl: trimmedUrl,
+                    code: normalizedCode,
+                    deviceName,
+                }),
+            });
+            const body = (await response.json());
+            if (body?.ok === true && typeof body.token === 'string' && body.token !== '') {
+                const urlToWrite = typeof body.serverUrl === 'string' && body.serverUrl !== '' ? body.serverUrl : trimmedUrl;
+                const echoed = typeof body.deviceName === 'string' && body.deviceName.trim() !== '' ? body.deviceName.trim() : deviceName;
+                await config.writeClientPairing(urlToWrite, body.token, echoed);
+                setClientPairCode('');
+                await loadClientStatus();
+                setStep('verify');
+            }
+            else {
+                const failReason = body && typeof body.code === 'string' ? body.code : 'unexpected';
+                const retryAfterMs = body && typeof body.retryAfterMs === 'number' ? body.retryAfterMs : undefined;
+                setClientClaimFail(retryAfterMs === undefined ? { code: failReason } : { code: failReason, retryAfterMs });
+            }
+        }
+        catch {
+            setClientClaimFail({ code: 'unreachable' });
+        }
+        finally {
+            setClientClaimBusy(false);
+        }
+    };
+    const runClientReconnect = async () => {
+        setClientReconnectBusy(true);
+        try {
+            await fetch(settings_form_ts_1.CLIENT_RECONNECT_ROUTE, { method: 'POST' });
+            await loadClientStatus();
+        }
+        catch {
+            // ignore
+        }
+        finally {
+            setClientReconnectBusy(false);
+        }
+    };
+    const runClientUnpair = async () => {
+        setClientUnpairBusy(true);
+        try {
+            await config.clearDeviceToken();
+            await loadClientStatus();
+            setStep('configure');
+        }
+        catch {
+            // ignore
+        }
+        finally {
+            setClientUnpairBusy(false);
+        }
+    };
+    // Managed-Caddy & Tunnel controls (GW-13a / GW-13b): keyed strictly off the
+    // currently selected `path` so switching away from Tunnel or Caddy never
+    // leaves the previous mode's status bar or notices on screen.
+    const caddyPath = wizardRole === 'host' && path === 'caddy';
+    const tunnelPath = wizardRole === 'host' && path === 'cloudflared';
+    const pollIngressState = async (route, apply) => {
+        try {
+            const response = await fetch(route);
+            if (!response.ok)
+                return;
+            const body = (await response.json());
+            if (body?.state === 'running' || body?.state === 'stopped' || body?.state === 'never-started')
+                apply(body.state);
+        }
+        catch {
+            // keep the last state
+        }
+    };
+    (0, react_1.useEffect)(() => {
+        if (step !== 'verify' || !caddyPath)
+            return;
+        const beat = () => pollIngressState(wizard_ts_1.WIZARD_CADDY_STATUS_ROUTE, setCaddyState);
+        void beat();
+        const handle = setInterval(() => { void beat(); }, 3000);
+        return () => clearInterval(handle);
+    }, [step, caddyPath]);
+    (0, react_1.useEffect)(() => {
+        if (step !== 'verify' || !tunnelPath)
+            return;
+        const beat = () => pollIngressState(wizard_ts_1.WIZARD_TUNNEL_STATUS_ROUTE, setTunnelState);
+        void beat();
+        const handle = setInterval(() => { void beat(); }, 3000);
+        return () => clearInterval(handle);
+    }, [step, tunnelPath]);
+    const startCaddy = async () => {
+        setCaddyStartError(undefined);
+        setCaddyBusy(true);
+        try {
+            const parsedPort = Number(httpsPort.trim());
+            const response = await fetch(wizard_ts_1.WIZARD_CADDY_START_ROUTE, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({
+                    domain: domain.trim(),
+                    ...(Number.isSafeInteger(parsedPort) && parsedPort >= 1 && parsedPort <= 65535 ? { httpsPort: parsedPort } : {}),
+                }),
+            });
+            const body = (await response.json());
+            if (body?.ok === true) {
+                setCaddyState('running');
+                setTunnelState('stopped');
+                return;
+            }
+            if (response.status === 501) {
+                setNotWired(true);
+                return;
+            }
+            setCaddyStartError((0, wizard_ts_1.caddyFailureCopy)(String(body?.error ?? ''), typeof body?.detail === 'string' ? body.detail : undefined, typeof body?.installUrl === 'string' ? body.installUrl : undefined));
+        }
+        catch {
+            setCaddyStartError({ key: 'wizard.caddy.failSpawn', params: {} });
+        }
+        finally {
+            setCaddyBusy(false);
+        }
+    };
+    const stopCaddy = async () => {
+        try {
+            await fetch(wizard_ts_1.WIZARD_CADDY_STOP_ROUTE, { method: 'POST' });
+            setCaddyState('stopped');
+        }
+        catch {
+            // the 3 s poll will correct the label
+        }
+    };
+    // Tunnel path (GW-13b): the check-domain probe (the migration card's
+    // re-check) and the full setup. A conflict carries the same-name list —
+    // each entry offers adoption, which re-runs setup with its tunnelId.
+    const checkDomain = async () => {
+        const targetDomain = path === 'external' ? serverUrl.trim() : domain.trim();
+        setTunnelCheck(undefined);
+        try {
+            const response = await fetch(wizard_ts_1.WIZARD_TUNNEL_CHECK_ROUTE, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ domain: targetDomain }),
+            });
+            const body = (await response.json());
+            setTunnelCheck(body);
+        }
+        catch {
+            setTunnelCheck({ ok: false, reason: 'network' });
+        }
+    };
+    const setupTunnelNow = async (tunnelId) => {
+        setTunnelBusy(true);
+        try {
+            const response = await fetch(wizard_ts_1.WIZARD_TUNNEL_SETUP_ROUTE, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ domain: domain.trim(), ...(tunnelId !== undefined ? { tunnelId } : {}) }),
+            });
+            const body = (await response.json());
+            setTunnelResult(body);
+            if (body.ok) {
+                setTunnelState('running');
+                setCaddyState('stopped');
+            }
+        }
+        catch {
+            setTunnelResult({ ok: false, reason: 'network' });
+        }
+        finally {
+            setTunnelBusy(false);
+        }
+    };
+    // Only show on the bundle detail page (never on a component row page).
+    const subject = props.subject;
+    if (subject !== undefined && (subject.kind === 'row' || (subject.pkg?.name !== undefined && subject.pkg.name !== 'dsh-zen-remote'))) {
+        return null;
+    }
+    const baseHostLights = (0, wizard_ts_1.deriveWizardLights)({ gatewayReachable, poll, startResult });
+    const lights = pairTarget === 'desktop-client' && desktopDevices.length > 0
+        ? { ...baseHostLights, pairing: 'pass' }
+        : baseHostLights;
+    const clientLights = (0, wizard_ts_1.deriveClientWizardLights)({
+        tokenConfigured: roleSnapshot.deviceToken.configured || clientView?.state === 'connected',
+        clientState: clientView?.state,
+        interceptInstalled: clientView?.intercept?.installed,
+    });
+    const verified = poll?.result === 'pass';
+    const qr = startResult?.ok === true ? (0, qr_ts_1.qrMatrix)(startResult.publicUrl) : null;
+    const stepLabel = (name) => t(name === 'pick' ? 'wizard.step.pick' : name === 'configure' ? 'wizard.step.configure' : 'wizard.step.verify');
+    const currentStepIndex = STEP_ORDER.indexOf(step);
+    const pathName = (value) => t(value === 'caddy'
+        ? 'wizard.path.caddy'
+        : value === 'external'
+            ? 'wizard.path.external'
+            : value === 'cloudflared'
+                ? 'wizard.path.cloudflared'
+                : 'wizard.path.lan');
+    const hasSavedHostConfig = hostSavedInSession
+        || config.rowValue('role') === 'host'
+        || (typeof config.rowValue('ingressPublicUrl') === 'string' && config.rowValue('ingressPublicUrl').trim() !== '');
+    const configured = (0, wizard_ts_1.isWizardConfigured)({
+        effectiveClient,
+        wizardStatus,
+        pairedDeviceCount: webDeviceCount + desktopDevices.length,
+        hasSavedHostConfig,
+        tokenConfigured: roleSnapshot.deviceToken.configured,
+        clientServerUrl,
+        clientState: clientView?.state,
+    });
+    const statusSummary = (() => {
+        if (effectiveClient) {
+            if (clientView?.state === 'connected') {
+                const label = clientView.serverName !== '' ? clientView.serverName : (clientView.serverUrl || t('wizard.role.client'));
+                return { state: 'pass', text: `${t('wizard.role.client')} · ${label}` };
+            }
+            if (roleSnapshot.deviceToken.configured) {
+                return { state: 'pending', text: t('wizard.role.client') };
+            }
+            return { state: 'idle', text: t('settings.client.statusUnpaired') };
+        }
+        if (wizardStatus === undefined || wizardStatus.mode === 'off') {
+            if (configured && gatewayReachable) {
+                return { state: 'pass', text: t('wizard.path.lan') };
+            }
+            return { state: 'idle', text: t('wizard.off') };
+        }
+        if (wizardStatus.mode === 'caddy') {
+            const running = caddyState === 'running' || (caddyState === undefined && wizardStatus.caddyRunning);
+            return { state: running ? 'pass' : 'pending', text: t(running ? 'wizard.caddy.running' : 'wizard.caddy.stopped') };
+        }
+        if (wizardStatus.mode === 'cloudflared') {
+            const running = tunnelState === 'running' || (tunnelState === undefined && wizardStatus.cloudflaredRunning);
+            return { state: running ? 'pass' : 'pending', text: t(running ? 'wizard.tunnel.running' : 'wizard.tunnel.stopped') };
+        }
+        return { state: 'pass', text: wizardStatus.publicUrl || t('wizard.path.external') };
+    })();
+    const openWizardAt = (targetStep, options) => {
+        setFormError(null);
+        if (options?.role !== undefined)
+            setWizardRole(options.role);
+        if (options?.target !== undefined)
+            setPairTarget(options.target);
+        setStep(targetStep);
+        setModalOpen(true);
+    };
+    return ((0, jsx_runtime_1.jsxs)("div", { "data-zen-remote": "wizard", children: [(0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-header", children: [(0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-headerText", children: [(0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-title", children: t('wizard.title') }), (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-subtitle", children: t('wizard.subtitle') })] }), (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-statusBadge", "data-state": statusSummary.state, children: [(0, jsx_runtime_1.jsx)("span", { className: "zr-wizard-dot", "data-state": statusSummary.state === 'pass' ? 'pass' : 'pending' }), (0, jsx_runtime_1.jsx)("span", { children: statusSummary.text })] })] }), statusLoaded && viaGateway && !effectiveClient ? (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-notice", "data-tone": "error", children: t('wizard.remoteOnly') }) : null, notWired ? (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-notice", children: t('wizard.notWired') }) : null, configured ? (effectiveClient ? ((0, jsx_runtime_1.jsxs)(jsx_runtime_1.Fragment, { children: [(0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-overviewGrid", children: [(0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-overviewItem", children: [(0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-overviewLabel", children: t('wizard.overview.roleLabel') }), (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-overviewValue", children: t('wizard.role.client') }), (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-overviewSub", children: clientDeviceName.trim() !== '' ? clientDeviceName : t('settings.client.deviceNameDefault') })] }), (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-overviewItem", children: [(0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-overviewLabel", children: t('wizard.overview.clientCredLabel') }), (0, jsx_runtime_1.jsxs)("p", { className: "zr-wizard-overviewValue", children: [(0, jsx_runtime_1.jsx)("span", { className: "zr-wizard-dot", "data-state": clientLights.credential }), (0, jsx_runtime_1.jsx)("span", { children: roleSnapshot.deviceToken.configured ? t('settings.client.tokenSet') : t('settings.client.statusUnpaired') })] }), (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-overviewSub", children: t(LIGHT_LABEL[clientLights.credential]) })] }), (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-overviewItem", children: [(0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-overviewLabel", children: t('wizard.overview.clientConnLabel') }), (0, jsx_runtime_1.jsxs)("p", { className: "zr-wizard-overviewValue", children: [(0, jsx_runtime_1.jsx)("span", { className: "zr-wizard-dot", "data-state": clientLights.connection }), (0, jsx_runtime_1.jsx)("span", { children: clientView === undefined
+                                                    ? (clientLoading ? t('settings.client.statusRefreshing') : t('settings.client.statusUnpaired'))
+                                                    : clientStatusCopy(clientView, now, t) })] }), (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-overviewSub", children: t(LIGHT_LABEL[clientLights.connection]) })] }), (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-overviewItem", children: [(0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-overviewLabel", children: t('wizard.overview.clientServerLabel') }), (0, jsx_runtime_1.jsxs)("p", { className: "zr-wizard-overviewValue", children: [(0, jsx_runtime_1.jsx)("span", { className: "zr-wizard-dot", "data-state": clientLights.sync }), (0, jsx_runtime_1.jsx)("span", { children: clientView?.serverUrl || clientServerUrl || '—' })] }), (0, jsx_runtime_1.jsxs)("p", { className: "zr-wizard-overviewSub", children: [t('wizard.client.lightSync'), "\uFF1A", t(LIGHT_LABEL[clientLights.sync])] })] })] }), (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-footer", children: [(0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-row", children: [(0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-btn", disabled: clientLoading, onClick: () => { void loadClientStatus(); }, children: clientLoading ? t('settings.client.statusRefreshing') : t('settings.client.statusRefresh') }), clientView?.nextRetryAt !== undefined ? ((0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-btn", disabled: clientReconnectBusy, onClick: () => { void runClientReconnect(); }, children: clientReconnectBusy ? t('settings.client.reconnectBusy') : t('settings.client.reconnect') })) : null] }), (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-row", children: [(0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-btn", onClick: () => openWizardAt('pick', { role: 'client' }), children: t('wizard.overview.reconfigure') }), (0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-btn zr-wizard-btnPrimary", onClick: () => openWizardAt(roleSnapshot.deviceToken.configured ? 'verify' : 'configure', { role: 'client' }), children: t('wizard.overview.clientDetail') })] })] })] })) : ((0, jsx_runtime_1.jsxs)(jsx_runtime_1.Fragment, { children: [(0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-overviewGrid", children: [(0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-overviewItem", children: [(0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-overviewLabel", children: t('wizard.overview.roleLabel') }), (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-overviewValue", children: t('wizard.role.host') }), (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-overviewSub", children: hostName.trim() !== '' ? hostName : t('settings.sourceDefault') })] }), (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-overviewItem", children: [(0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-overviewLabel", children: t('wizard.overview.gatewayLabel') }), (0, jsx_runtime_1.jsxs)("p", { className: "zr-wizard-overviewValue", children: [(0, jsx_runtime_1.jsx)("span", { className: "zr-wizard-dot", "data-state": gatewayReachable ? 'pass' : 'fail' }), (0, jsx_runtime_1.jsx)("span", { children: gatewayReachable
+                                                    ? t('wizard.overview.gatewayReady', { port: String((0, wizard_ts_1.upstreamPortOf)(wizardStatus)) })
+                                                    : t('wizard.overview.gatewayDown') })] }), (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-overviewSub", children: autoShare ? t('wizard.autoShare') : t('settings.fieldAutoShare') })] }), (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-overviewItem", children: [(0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-overviewLabel", children: t('wizard.overview.ingressLabel') }), (0, jsx_runtime_1.jsxs)("p", { className: "zr-wizard-overviewValue", children: [(0, jsx_runtime_1.jsx)("span", { className: "zr-wizard-dot", "data-state": statusSummary.state === 'pass' ? 'pass' : 'pending' }), (0, jsx_runtime_1.jsx)("span", { children: pathName(path) })] }), (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-overviewSub", children: resolvedHostEndpoint })] }), (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-overviewItem", children: [(0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-overviewHead", children: [(0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-overviewLabel", children: t('wizard.overview.devicesLabel') }), (0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-linkBtn", disabled: disabled, onClick: () => {
+                                                    setDeviceError(false);
+                                                    setRenamingDevice(null);
+                                                    setDevicesModalOpen(true);
+                                                }, children: t('wizard.overview.manageDevices') })] }), (0, jsx_runtime_1.jsxs)("p", { className: "zr-wizard-overviewValue", children: [(0, jsx_runtime_1.jsx)("span", { className: "zr-wizard-dot", "data-state": allDevices.length > 0 ? 'pass' : 'pending' }), (0, jsx_runtime_1.jsx)("span", { children: allDevices.length > 0
+                                                    ? t('wizard.overview.devicesSummary', { web: String(webDeviceCount), desktop: String(desktopDevices.length) })
+                                                    : t('wizard.overview.devicesNone') })] }), (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-overviewSub", children: statusSummary.text })] })] }), (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-footer", children: [(0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-row", children: [(0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-btn", disabled: disabled, onClick: () => openWizardAt('pick', { role: 'host' }), children: t('wizard.overview.reconfigure') }), (0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-btn", disabled: disabled, onClick: () => {
+                                            setDeviceError(false);
+                                            setRenamingDevice(null);
+                                            setDevicesModalOpen(true);
+                                        }, children: t('wizard.overview.manageDevices') })] }), (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-row", children: [(0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-btn", disabled: disabled, onClick: () => openWizardAt('verify', { role: 'host', target: 'desktop-client' }), children: t('wizard.overview.pairDesktop') }), (0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-btn zr-wizard-btnPrimary", disabled: disabled, onClick: () => openWizardAt('verify', { role: 'host', target: 'web' }), children: t('wizard.overview.pairPhone') })] })] })] }))) : ((0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-emptyBanner", children: [(0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-emptyText", children: t('wizard.overview.emptyIntro') }), (0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-btn zr-wizard-btnPrimary", disabled: disabled, onClick: () => openWizardAt('pick'), children: t('wizard.overview.startSetup') })] })), modalOpen ? ((0, jsx_runtime_1.jsx)("div", { "data-zen-remote": "wizard-modal", onClick: () => {
+                    if (!savingConfig && !clientClaimBusy)
+                        setModalOpen(false);
+                }, children: (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-modalDialog", role: "dialog", "aria-modal": "true", "aria-label": t('wizard.modal.title'), onClick: (event) => event.stopPropagation(), children: [(0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-modalHeader", children: [(0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-modalTitle", children: t('wizard.modal.title') }), (0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-cardCloseIcon", "aria-label": t('wizard.card.close'), disabled: savingConfig || clientClaimBusy, onClick: () => setModalOpen(false), children: "\u00D7" })] }), (0, jsx_runtime_1.jsx)("ol", { className: "zr-wizard-stepper", "aria-label": t('wizard.modal.title'), children: STEP_ORDER.map((name, index) => {
+                                const state = currentStepIndex > index ? 'done' : currentStepIndex === index ? 'current' : 'upcoming';
+                                return ((0, jsx_runtime_1.jsxs)("li", { style: { display: 'contents' }, children: [(0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-stepItem", "data-state": state, "aria-current": state === 'current' ? 'step' : undefined, children: [(0, jsx_runtime_1.jsx)("span", { className: "zr-wizard-stepCircle", "aria-hidden": "true", children: state === 'done' ? ((0, jsx_runtime_1.jsx)("svg", { width: "13", height: "13", viewBox: "0 0 16 16", fill: "none", children: (0, jsx_runtime_1.jsx)("path", { d: "M3.5 8.5L6.5 11.5L12.5 4.5", stroke: "currentColor", strokeWidth: "2", strokeLinecap: "round", strokeLinejoin: "round" }) })) : (index + 1) }), (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-stepText", children: [(0, jsx_runtime_1.jsx)("span", { className: "zr-wizard-stepTag", children: t('wizard.modal.stepTag', { num: String(index + 1) }) }), (0, jsx_runtime_1.jsx)("span", { className: "zr-wizard-stepName", children: stepLabel(name) })] })] }), index < STEP_ORDER.length - 1 ? ((0, jsx_runtime_1.jsx)("div", { className: "zr-wizard-stepConnector", "data-done": currentStepIndex > index, "aria-hidden": "true" })) : null] }, name));
+                            }) }), step === 'pick' ? ((0, jsx_runtime_1.jsxs)(jsx_runtime_1.Fragment, { children: [(0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-modalBody", children: [(0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-stepIntro", children: t('wizard.modal.step1Desc') }), (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-sectionTitle", children: t('wizard.role.sectionTitle') }), (0, jsx_runtime_1.jsx)("div", { className: "zr-wizard-roleGrid", role: "radiogroup", "aria-label": t('wizard.role.sectionTitle'), children: ROLE_OPTIONS.map(([roleValue, nameKey, descKey]) => {
+                                                const selected = wizardRole === roleValue;
+                                                return ((0, jsx_runtime_1.jsxs)("button", { type: "button", role: "radio", "aria-checked": selected, className: "zr-wizard-path", "data-selected": selected, disabled: disabled, onClick: () => {
+                                                        setFormError(null);
+                                                        setWizardRole(roleValue);
+                                                    }, children: [(0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-pathHead", children: [(0, jsx_runtime_1.jsx)("span", { className: "zr-wizard-pathRadio", "data-selected": selected, "aria-hidden": "true" }), (0, jsx_runtime_1.jsx)("span", { className: "zr-wizard-pathName", children: t(nameKey) })] }), (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-pathDesc", children: t(descKey) })] }, roleValue));
+                                            }) }), wizardRole === 'host' ? ((0, jsx_runtime_1.jsxs)(jsx_runtime_1.Fragment, { children: [(0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-sectionTitle", children: t('wizard.ingressSectionTitle') }), (0, jsx_runtime_1.jsx)("div", { className: "zr-wizard-paths", role: "radiogroup", "aria-label": t('wizard.ingressSectionTitle'), children: PATH_OPTIONS.map(([value, nameKey, descKey]) => {
+                                                        const selected = path === value;
+                                                        return ((0, jsx_runtime_1.jsxs)("button", { type: "button", role: "radio", "aria-checked": selected, className: "zr-wizard-path", "data-selected": selected, disabled: disabled, onClick: () => {
+                                                                selectPath(value);
+                                                            }, onDoubleClick: () => {
+                                                                if (disabled)
+                                                                    return;
+                                                                selectPath(value);
+                                                                setStep((0, wizard_ts_1.stepAfterPick)());
+                                                            }, children: [(0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-pathHead", children: [(0, jsx_runtime_1.jsx)("span", { className: "zr-wizard-pathRadio", "data-selected": selected, "aria-hidden": "true" }), (0, jsx_runtime_1.jsx)("span", { className: "zr-wizard-pathName", children: t(nameKey) })] }), (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-pathDesc", children: t(descKey) })] }, value));
+                                                    }) })] })) : ((0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-notice", children: t('wizard.role.clientPickNote') }))] }), (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-modalFooter", children: [(0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-btn", onClick: () => setModalOpen(false), children: t('wizard.modal.cancel') }), (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-row", children: [(0, jsx_runtime_1.jsx)("span", { className: "zr-wizard-footerHint", children: wizardRole === 'host'
+                                                        ? `${t('wizard.role.host')} · ${pathName(path)}`
+                                                        : t('wizard.role.client') }), (0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-btn zr-wizard-btnPrimary", disabled: disabled, onClick: () => {
+                                                        setFormError(null);
+                                                        setStep((0, wizard_ts_1.stepAfterPick)());
+                                                    }, children: t('wizard.next') })] })] })] })) : null, step === 'configure' ? ((0, jsx_runtime_1.jsxs)(jsx_runtime_1.Fragment, { children: [(0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-modalBody", children: [(0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-stepIntro", children: t('wizard.modal.step2Desc') }), (0, jsx_runtime_1.jsx)("div", { className: "zr-wizard-selectedBar", children: (0, jsx_runtime_1.jsx)("span", { className: "zr-wizard-selectedLabel", children: t('wizard.modal.selectedPlan', {
+                                                    plan: wizardRole === 'host'
+                                                        ? `${t('wizard.role.host')} · ${pathName(path)}`
+                                                        : t('wizard.role.client'),
+                                                }) }) }), wizardRole === 'host' ? ((0, jsx_runtime_1.jsxs)(jsx_runtime_1.Fragment, { children: [(0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-formStack", children: [(0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-field", children: [(0, jsx_runtime_1.jsx)("label", { className: "zr-wizard-label", htmlFor: "zr-wizard-host-name", children: t('wizard.hostName') }), (0, jsx_runtime_1.jsx)("input", { id: "zr-wizard-host-name", className: "zr-wizard-input", type: "text", placeholder: t('wizard.hostNamePlaceholder'), value: hostName, disabled: disabled, onChange: (event) => setHostName(event.target.value) }), (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-hint", children: t('wizard.hostNameHint') })] }), (0, jsx_runtime_1.jsxs)("label", { className: "zr-wizard-checkRow", children: [(0, jsx_runtime_1.jsx)("input", { type: "checkbox", checked: autoShare, disabled: disabled, onChange: (event) => setAutoShare(event.target.checked) }), (0, jsx_runtime_1.jsx)("span", { children: t('wizard.autoShare') })] })] }), path === 'lan' ? ((0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-field", children: [(0, jsx_runtime_1.jsx)("label", { className: "zr-wizard-label", htmlFor: "zr-wizard-lan-url", children: t('wizard.lanUrl') }), (0, jsx_runtime_1.jsx)("input", { id: "zr-wizard-lan-url", className: "zr-wizard-input", type: "url", placeholder: t('wizard.lanUrlPlaceholder'), value: serverUrl, disabled: disabled, onChange: (event) => setServerUrl(event.target.value) }), (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-hint", children: t('wizard.lanUrlHint') })] })) : path === 'external' ? ((0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-field", children: [(0, jsx_runtime_1.jsx)("label", { className: "zr-wizard-label", htmlFor: "zr-wizard-server-url", children: t('wizard.serverUrl') }), (0, jsx_runtime_1.jsx)("input", { id: "zr-wizard-server-url", className: "zr-wizard-input", type: "url", placeholder: "https://dsh.example.com", value: serverUrl, disabled: disabled, onChange: (event) => setServerUrl(event.target.value) }), (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-hint", children: t('wizard.serverUrlHint') }), (0, jsx_runtime_1.jsx)("div", { className: "zr-wizard-row", children: (0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-linkBtn", disabled: disabled, onClick: () => setCard('proxy'), children: t('wizard.proxySnippet') }) })] })) : ((0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-formStack", children: [(0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-formGrid", children: [(0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-field", children: [(0, jsx_runtime_1.jsx)("label", { className: "zr-wizard-label", htmlFor: "zr-wizard-domain", children: t('wizard.domain') }), (0, jsx_runtime_1.jsx)("input", { id: "zr-wizard-domain", className: "zr-wizard-input", type: "text", placeholder: "dsh.example.com", value: domain, disabled: disabled, onChange: (event) => setDomain(event.target.value) }), (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-hint", children: t('wizard.domainHint') })] }), (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-field zr-wizard-fieldPort", children: [(0, jsx_runtime_1.jsx)("label", { className: "zr-wizard-label", htmlFor: "zr-wizard-port", children: t('wizard.httpsPort') }), (0, jsx_runtime_1.jsx)("input", { id: "zr-wizard-port", className: "zr-wizard-input", type: "text", inputMode: "numeric", value: httpsPort, disabled: disabled, onChange: (event) => setHttpsPort(event.target.value) })] })] }), path === 'caddy' && (0, wizard_ts_1.isValidPort)(httpsPort.trim()) && httpsPort.trim() !== '443' ? ((0, jsx_runtime_1.jsx)("div", { className: "zr-wizard-row", children: (0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-linkBtn", disabled: disabled, onClick: () => setCard('portforward'), children: t('wizard.portForwardEntry') }) })) : null, (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-field", children: [(0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-labelRow", children: [(0, jsx_runtime_1.jsx)("label", { className: "zr-wizard-label", htmlFor: "zr-wizard-token", children: t('wizard.cfToken') }), tokenSaved ? (0, jsx_runtime_1.jsx)("span", { className: "zr-wizard-savedTag", children: t('wizard.token.saved') }) : null] }), (0, jsx_runtime_1.jsx)("input", { id: "zr-wizard-token", className: "zr-wizard-input", type: "password", placeholder: tokenSaved ? '••••••••••••••••' : '', value: cfToken, disabled: disabled, onChange: (event) => setCfToken(event.target.value) }), (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-hint", children: t('wizard.cfTokenHint') }), (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-row", children: [(0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-linkBtn", disabled: disabled, onClick: () => setCard('token'), children: t('wizard.cfTokenHowTo') }), path === 'cloudflared' ? ((0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-linkBtn", disabled: disabled, onClick: () => setCard('migrate'), children: t('wizard.migrateEntry') })) : null] })] })] })), tokenNotice === 'failed' ? ((0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-notice", "data-tone": "error", children: t('wizard.token.saveFailed') })) : null, formError !== null ? ((0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-notice", "data-tone": "error", children: t(formError === 'bad-domain' ? 'wizard.badDomain' : formError === 'bad-port' ? 'wizard.badPort' : formError === 'missing-token' ? 'wizard.missingToken' : 'wizard.badServerUrl') })) : null] })) : ((0, jsx_runtime_1.jsxs)(jsx_runtime_1.Fragment, { children: [(0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-formStack", children: [(0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-field", children: [(0, jsx_runtime_1.jsx)("label", { className: "zr-wizard-label", htmlFor: "zr-wizard-client-device", children: t('wizard.client.deviceName') }), (0, jsx_runtime_1.jsx)("input", { id: "zr-wizard-client-device", className: "zr-wizard-input", type: "text", placeholder: t('wizard.client.deviceNamePlaceholder'), value: clientDeviceName, disabled: clientClaimBusy, onChange: (event) => setClientDeviceName(event.target.value) }), (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-hint", children: t('wizard.client.deviceNameHint') })] }), (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-field", children: [(0, jsx_runtime_1.jsx)("label", { className: "zr-wizard-label", htmlFor: "zr-wizard-client-url", children: t('wizard.client.serverUrl') }), (0, jsx_runtime_1.jsx)("input", { id: "zr-wizard-client-url", className: "zr-wizard-input", type: "url", placeholder: t('wizard.client.serverUrlPlaceholder'), value: clientServerUrl, disabled: clientClaimBusy, onChange: (event) => setClientServerUrl(event.target.value) }), (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-hint", children: t('wizard.client.serverUrlHint') })] }), (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-field", children: [(0, jsx_runtime_1.jsx)("label", { className: "zr-wizard-label", htmlFor: "zr-wizard-client-code", children: t('wizard.client.pairingCode') }), (0, jsx_runtime_1.jsx)("input", { id: "zr-wizard-client-code", className: "zr-wizard-input", type: "text", autoComplete: "off", spellCheck: false, placeholder: t('wizard.client.pairingCodePlaceholder'), value: clientPairCode, disabled: clientClaimBusy, onChange: (event) => setClientPairCode((0, settings_form_ts_1.normalizePairingCode)(event.target.value)) }), (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-hint", children: t('wizard.client.pairingCodeHint') })] })] }), formError === 'bad-client-url' ? ((0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-notice", "data-tone": "error", children: t('settings.client.failInvalid') })) : null, formError === 'bad-client-code' ? ((0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-notice", "data-tone": "error", children: t('settings.client.failBadCode') })) : null, clientClaimFail !== null ? ((0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-notice", "data-tone": "error", children: claimFailCopy(clientClaimFail.code, clientClaimFail.retryAfterMs, t) })) : null] }))] }), (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-modalFooter", children: [(0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-btn", disabled: disabled || savingConfig || clientClaimBusy, onClick: () => {
+                                                setFormError(null);
+                                                setStep('pick');
+                                            }, children: t('wizard.back') }), wizardRole === 'host' ? ((0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-btn zr-wizard-btnPrimary", disabled: disabled || savingConfig, onClick: () => { void advanceFromConfigure(); }, children: t('wizard.modal.saveAndNext') })) : ((0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-row", children: [roleSnapshot.deviceToken.configured ? ((0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-btn", disabled: clientClaimBusy, onClick: () => setStep('verify'), children: t('wizard.client.skipToStatus') })) : null, (0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-btn zr-wizard-btnPrimary", disabled: clientClaimBusy, onClick: () => { void runClientClaim(); }, children: clientClaimBusy ? t('wizard.client.pairingBusy') : t('wizard.client.pairAndConnect') })] }))] })] })) : null, step === 'verify' ? ((0, jsx_runtime_1.jsxs)(jsx_runtime_1.Fragment, { children: [(0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-modalBody", children: [(0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-stepIntro", children: t('wizard.modal.step3Desc') }), wizardRole === 'host' ? ((0, jsx_runtime_1.jsxs)(jsx_runtime_1.Fragment, { children: [caddyPath ? ((0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-serviceBar", "data-zen-remote": "wizard-caddy-controls", children: [(0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-serviceInfo", children: [(0, jsx_runtime_1.jsx)("span", { className: "zr-wizard-dot", "data-state": caddyState === 'running' ? 'pass' : 'pending' }), (0, jsx_runtime_1.jsx)("span", { className: "zr-wizard-label", children: t('wizard.ingress') }), (0, jsx_runtime_1.jsx)("span", { className: "zr-wizard-hint", children: caddyBusy
+                                                                        ? t('wizard.caddy.starting')
+                                                                        : t(caddyState === 'running' ? 'wizard.caddy.running' : caddyState === 'stopped' ? 'wizard.caddy.stopped' : 'wizard.caddy.neverStarted') })] }), (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-row", children: [(0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-btn zr-wizard-btnPrimary", disabled: disabled || caddyBusy || caddyState === 'running', onClick: () => { void startCaddy(); }, children: caddyBusy ? t('wizard.caddy.starting') : t('wizard.caddy.start') }), (0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-btn", disabled: disabled || caddyBusy || caddyState !== 'running', onClick: () => { void stopCaddy(); }, children: t('wizard.caddy.stop') })] })] })) : null, tunnelPath ? ((0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-serviceBar", "data-zen-remote": "wizard-tunnel-controls", children: [(0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-serviceInfo", children: [(0, jsx_runtime_1.jsx)("span", { className: "zr-wizard-dot", "data-state": tunnelState === 'running' ? 'pass' : 'pending' }), (0, jsx_runtime_1.jsx)("span", { className: "zr-wizard-label", children: t('wizard.ingress') }), (0, jsx_runtime_1.jsx)("span", { className: "zr-wizard-hint", children: t(tunnelState === 'running' ? 'wizard.tunnel.running' : tunnelState === 'stopped' ? 'wizard.tunnel.stopped' : 'wizard.tunnel.neverStarted') })] }), (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-row", children: [(0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-btn zr-wizard-btnPrimary", disabled: disabled || tunnelBusy, onClick: () => { void setupTunnelNow(adoptTunnelId); }, children: tunnelBusy ? t('wizard.tunnel.checking') : tunnelState === 'running' ? t('wizard.reverify') : t('wizard.tunnel.setup') }), (0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-btn", disabled: disabled || tunnelState !== 'running', onClick: () => {
+                                                                        void (async () => {
+                                                                            try {
+                                                                                await fetch(wizard_ts_1.WIZARD_TUNNEL_STOP_ROUTE, { method: 'POST' });
+                                                                                setTunnelState('stopped');
+                                                                            }
+                                                                            catch { /* the poll corrects */ }
+                                                                        })();
+                                                                    }, children: t('wizard.tunnel.stop') })] })] })) : null, tunnelPath && tunnelCheck !== undefined ? (() => {
+                                                    const copy = (0, wizard_ts_1.tunnelCheckCopy)(tunnelCheck);
+                                                    return (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-notice", "data-tone": copy.tone === 'error' ? 'error' : undefined, children: copy.key === 'wizard.check.failed'
+                                                            ? t('wizard.check.failed', { reason: tunnelCheck.ok ? '' : String(tunnelCheck.reason) })
+                                                            : t(copy.key) });
+                                                })() : null, tunnelPath && tunnelResult !== undefined && !tunnelResult.ok && tunnelResult.reason === 'tunnel-conflict' && tunnelResult.existing !== undefined ? ((0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-field", children: [(0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-label", children: t('wizard.tunnel.conflict') }), (0, jsx_runtime_1.jsx)("div", { className: "zr-wizard-row", children: tunnelResult.existing.map((tunnel) => ((0, jsx_runtime_1.jsxs)("button", { type: "button", className: "zr-wizard-linkBtn", disabled: disabled || tunnelBusy, onClick: () => { setAdoptTunnelId(tunnel.id); void setupTunnelNow(tunnel.id); }, children: [t('wizard.tunnel.useExisting'), "\uFF1A", tunnel.name, "\uFF08", tunnel.status, "\uFF09"] }, tunnel.id))) })] })) : null, tunnelPath && tunnelResult !== undefined && tunnelResult.ok ? (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-notice", children: t('wizard.tunnel.ok') }) : null, tunnelPath && tunnelResult !== undefined && !tunnelResult.ok && tunnelResult.reason !== 'tunnel-conflict' ? (() => {
+                                                    const copy = (0, wizard_ts_1.tunnelFailureCopy)(tunnelResult.reason, tunnelResult.detail);
+                                                    return (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-notice", "data-tone": "error", children: t(copy.key, copy.params) });
+                                                })() : null, caddyPath && caddyStartError !== undefined ? ((0, jsx_runtime_1.jsxs)("p", { className: "zr-wizard-notice", "data-tone": "error", children: [t('wizard.caddy.startFailed', { reason: t(caddyStartError.key, caddyStartError.params) }), caddyStartError.installUrl !== undefined ? ((0, jsx_runtime_1.jsxs)(jsx_runtime_1.Fragment, { children: [" ", (0, jsx_runtime_1.jsx)("a", { className: "zr-wizard-link", href: caddyStartError.installUrl, target: "_blank", rel: "noreferrer", children: caddyStartError.installUrl })] })) : null] })) : null, (0, jsx_runtime_1.jsx)("ul", { className: "zr-wizard-lights", children: LIGHT_ORDER.map(({ key, light }) => {
+                                                        const state = lights[light];
+                                                        const labelText = light === 'publicUrl' && probingUrl
+                                                            ? t('wizard.light.probing')
+                                                            : t(LIGHT_LABEL[state]);
+                                                        return ((0, jsx_runtime_1.jsxs)("li", { className: "zr-wizard-light", "data-state": state, children: [(0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-lightMain", children: [(0, jsx_runtime_1.jsx)("span", { className: "zr-wizard-dot", "data-state": state }), (0, jsx_runtime_1.jsx)("span", { className: "zr-wizard-lightName", children: t(key) })] }), (0, jsx_runtime_1.jsx)("span", { className: "zr-wizard-lightState", "data-state": state, children: labelText })] }, key));
+                                                    }) }), startResult !== undefined && !startResult.ok ? (() => {
+                                                    const copy = startFailureCopy(startResult);
+                                                    return (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-notice", "data-tone": "error", children: t('wizard.startFailed', { reason: t(copy.key, copy.params) }) });
+                                                })() : null, (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-targetTabs", role: "tablist", children: [(0, jsx_runtime_1.jsx)("button", { type: "button", role: "tab", "aria-selected": pairTarget === 'web', className: "zr-wizard-targetTab", "data-selected": pairTarget === 'web', disabled: disabled, onClick: () => setPairTarget('web'), children: t('wizard.pairTarget.web') }), (0, jsx_runtime_1.jsx)("button", { type: "button", role: "tab", "aria-selected": pairTarget === 'desktop-client', className: "zr-wizard-targetTab", "data-selected": pairTarget === 'desktop-client', disabled: disabled, onClick: () => setPairTarget('desktop-client'), children: t('wizard.pairTarget.desktop') })] }), pairTarget === 'web' ? ((0, jsx_runtime_1.jsxs)(jsx_runtime_1.Fragment, { children: [webPairRequested && startResult?.ok === true && startResult.pairingCode !== '' ? ((0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-pairPanel", children: [(0, jsx_runtime_1.jsx)("svg", { className: "zr-wizard-qr", "data-usable": qr !== null, role: "img", "aria-label": t('wizard.qrHint'), shapeRendering: "crispEdges", viewBox: qr === null ? undefined : `-16 -16 ${(qr.length + 8) * 4} ${(qr.length + 8) * 4}`, children: qr === null ? null : ((0, jsx_runtime_1.jsxs)(jsx_runtime_1.Fragment, { children: [(0, jsx_runtime_1.jsx)("rect", { x: -16, y: -16, width: (qr.length + 8) * 4, height: (qr.length + 8) * 4, fill: "#fff" }), (0, jsx_runtime_1.jsx)("path", { d: qrSvgPath(qr, 4), fill: "#000" })] })) }), (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-pairMeta", children: [(0, jsx_runtime_1.jsx)("span", { className: "zr-wizard-label", children: t('wizard.pairingCode') }), (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-code", children: startResult.pairingCode }), (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-countdown", children: t('wizard.pairingSeconds', { seconds: String((0, wizard_ts_1.pairingSecondsLeft)(startResult.expiresAt, now)) }) }), (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-hint", children: t('wizard.qrHint') })] })] })) : null, poll?.result === 'pass' ? (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-notice", "data-tone": "ok", children: t('wizard.verifyPass', { deviceId: poll.deviceId }) }) : null, poll?.result === 'cookie-insecure' ? (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-notice", "data-tone": "error", children: t('wizard.verifyCookieInsecure') }) : null, poll?.result === 'code-expired' ? (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-notice", "data-tone": "error", children: t('wizard.verifyExpired') }) : null, poll?.result === 'stale' ? (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-notice", "data-tone": "error", children: t('wizard.verifyStale') }) : null, webPairRequested && (poll?.result === 'pending' || poll?.result === 'not-started') ? (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-hint", children: t('wizard.verifyPending') }) : null, !webPairRequested && poll === undefined ? (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-hint", children: t('wizard.verifyNotStarted') }) : null] })) : ((0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-desktopBox", children: [(0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-hint", children: t('wizard.desktop.guide') }), (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-field", children: [(0, jsx_runtime_1.jsx)("span", { className: "zr-wizard-label", children: t('wizard.desktop.addressLabel') }), (0, jsx_runtime_1.jsx)("code", { className: "zr-wizard-input", children: resolvedHostEndpoint })] }), desktopPairing !== undefined && desktopPairing.expiresAt > now ? ((0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-pairMeta", children: [(0, jsx_runtime_1.jsx)("span", { className: "zr-wizard-label", children: t('wizard.pairingCode') }), (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-code", children: desktopPairing.code }), (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-countdown", children: t('wizard.pairingSeconds', { seconds: String((0, wizard_ts_1.pairingSecondsLeft)(desktopPairing.expiresAt, now)) }) })] })) : null, (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-row", children: [(0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-btn zr-wizard-btnPrimary", disabled: disabled || desktopPairBusy, onClick: () => { void runDesktopPair(); }, children: desktopPairing !== undefined && desktopPairing.expiresAt > now ? t('wizard.desktop.regenerate') : t('wizard.desktop.generate') }), desktopPairing !== undefined && desktopPairing.expiresAt > now ? ((0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-btn", disabled: disabled, onClick: () => { void copyDesktopInfo(); }, children: desktopCopied ? t('wizard.card.copied') : t('wizard.desktop.copyInfo') })) : null] })] }))] })) : ((0, jsx_runtime_1.jsxs)(jsx_runtime_1.Fragment, { children: [(0, jsx_runtime_1.jsx)("ul", { className: "zr-wizard-lights", children: CLIENT_LIGHT_ORDER.map(({ key, light }) => ((0, jsx_runtime_1.jsxs)("li", { className: "zr-wizard-light", "data-state": clientLights[light], children: [(0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-lightMain", children: [(0, jsx_runtime_1.jsx)("span", { className: "zr-wizard-dot", "data-state": clientLights[light] }), (0, jsx_runtime_1.jsx)("span", { className: "zr-wizard-lightName", children: t(key) })] }), (0, jsx_runtime_1.jsx)("span", { className: "zr-wizard-lightState", "data-state": clientLights[light], children: t(LIGHT_LABEL[clientLights[light]]) })] }, key))) }), (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-clientBox", children: [(0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-label", children: t('settings.client.statusTitle') }), (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-notice", "data-tone": clientView?.state === 'connected' ? 'ok' : clientLights.connection === 'fail' ? 'error' : undefined, children: clientView === undefined
+                                                                ? (clientLoading ? t('settings.client.statusRefreshing') : t('settings.client.statusUnpaired'))
+                                                                : clientStatusCopy(clientView, now, t) }), (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-row", children: [(0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-btn", disabled: clientLoading, onClick: () => { void loadClientStatus(); }, children: clientLoading ? t('settings.client.statusRefreshing') : t('settings.client.statusRefresh') }), clientView?.nextRetryAt !== undefined ? ((0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-btn zr-wizard-btnPrimary", disabled: clientReconnectBusy, onClick: () => { void runClientReconnect(); }, children: clientReconnectBusy ? t('settings.client.reconnectBusy') : t('settings.client.reconnect') })) : null, roleSnapshot.deviceToken.configured ? ((0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-btn", disabled: clientUnpairBusy, onClick: () => { void runClientUnpair(); }, children: clientUnpairBusy ? t('settings.client.unpairBusy') : t('settings.client.unpair') })) : null] })] })] }))] }), (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-modalFooter", children: [(0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-btn", disabled: disabled, onClick: () => setStep('configure'), children: t('wizard.back') }), (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-row", children: [wizardRole === 'host' && resolvedVerifyUrl !== '' ? ((0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-btn", disabled: disabled || probingUrl, onClick: () => { void probeAccessUrl(resolvedVerifyUrl); }, children: probingUrl ? t('wizard.light.probing') : t('wizard.devicesModal.retest') })) : null, wizardRole === 'host' && pairTarget === 'web' ? ((0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-btn zr-wizard-btnPrimary", disabled: disabled || probingUrl, onClick: () => { void startVerification(); }, children: verified ? t('wizard.reverify') : t('wizard.startVerify') })) : null, wizardRole === 'host' && pairTarget === 'desktop-client' ? ((0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-btn zr-wizard-btnPrimary", disabled: disabled || desktopPairBusy, onClick: () => { void runDesktopPair(); }, children: desktopPairing !== undefined && desktopPairing.expiresAt > now ? t('wizard.desktop.regenerate') : t('wizard.desktop.generate') })) : null, (0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-btn", onClick: () => setModalOpen(false), children: t('wizard.modal.finish') })] })] })] })) : null] }) })) : null, devicesModalOpen ? ((0, jsx_runtime_1.jsx)("div", { "data-zen-remote": "wizard-modal", onClick: () => {
+                    if (!deviceBusy)
+                        setDevicesModalOpen(false);
+                }, children: (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-modalDialog", role: "dialog", "aria-modal": "true", "aria-label": t('wizard.devicesModal.title'), onClick: (event) => event.stopPropagation(), children: [(0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-modalHeader", children: [(0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-headerText", children: [(0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-modalTitle", children: t('wizard.devicesModal.title') }), (0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-subtitle", children: t('wizard.devicesModal.subtitle') })] }), (0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-cardCloseIcon", "aria-label": t('wizard.card.close'), disabled: deviceBusy, onClick: () => setDevicesModalOpen(false), children: "\u00D7" })] }), (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-modalBody", children: [deviceError ? ((0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-notice", "data-tone": "error", children: t('settings.actionFail') })) : null, allDevices.length === 0 ? ((0, jsx_runtime_1.jsx)("p", { className: "zr-wizard-notice", children: t('settings.devicesEmpty') })) : ((0, jsx_runtime_1.jsx)("ul", { className: "zr-wizard-deviceList", children: allDevices.map((device) => ((0, jsx_runtime_1.jsxs)("li", { className: "zr-wizard-deviceItem", children: [(0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-deviceHead", children: [(0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-deviceTitleRow", children: [(0, jsx_runtime_1.jsx)("span", { className: "zr-wizard-lightName", children: device.name }), (0, jsx_runtime_1.jsx)("span", { className: "zr-wizard-deviceBadge", children: device.role === 'web' ? t('settings.deviceRoleWeb') : t('settings.deviceRoleDesktop') }), device.role === 'web' ? ((0, jsx_runtime_1.jsx)("span", { className: "zr-wizard-deviceBadge", children: device.hasPush ? t('settings.devicePushOn') : t('settings.devicePushOff') })) : null] }), (0, jsx_runtime_1.jsx)("span", { className: "zr-wizard-hint", children: t('settings.deviceLastSeen', { time: new Date(device.lastSeen).toLocaleString() }) })] }), (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-deviceActions", children: [device.role === 'web' ? ((0, jsx_runtime_1.jsxs)("select", { className: "zr-wizard-select", "aria-label": t('settings.deviceKindSelect', { name: device.name }), disabled: disabled || deviceBusy, value: device.kind, onChange: (event) => {
+                                                            void runDeviceAction({ action: 'set-kind', id: device.id, kind: event.currentTarget.value });
+                                                        }, children: [(0, jsx_runtime_1.jsx)("option", { value: "auto", children: t('settings.kindAuto') }), (0, jsx_runtime_1.jsx)("option", { value: "phone", children: t('settings.kindPhone') }), (0, jsx_runtime_1.jsx)("option", { value: "desktop", children: t('settings.kindDesktop') })] })) : null, (0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-linkBtn", disabled: disabled || deviceBusy, onClick: () => setRenamingDevice({ id: device.id, draft: device.name }), children: t('settings.deviceRename') }), (0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-linkBtn", disabled: disabled || deviceBusy, onClick: () => {
+                                                            if (window.confirm(t('settings.revokeConfirm'))) {
+                                                                void runDeviceAction({ action: 'revoke', id: device.id });
+                                                            }
+                                                        }, children: t('settings.deviceRevoke') })] }), renamingDevice?.id === device.id ? ((0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-row", children: [(0, jsx_runtime_1.jsx)("input", { className: "zr-wizard-input", style: { flex: 1, minWidth: 160 }, "aria-label": t('settings.renamePrompt'), maxLength: 40, value: renamingDevice.draft, autoFocus: true, onChange: (event) => setRenamingDevice({ id: device.id, draft: event.currentTarget.value }), onKeyDown: (event) => {
+                                                            if (event.key === 'Enter') {
+                                                                const trimmed = renamingDevice.draft.trim();
+                                                                setRenamingDevice(null);
+                                                                if (trimmed !== '' && trimmed !== device.name) {
+                                                                    void runDeviceAction({ action: 'rename', id: device.id, name: trimmed });
+                                                                }
+                                                            }
+                                                            if (event.key === 'Escape')
+                                                                setRenamingDevice(null);
+                                                        } }), (0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-btn zr-wizard-btnPrimary", disabled: deviceBusy, onClick: () => {
+                                                            const trimmed = renamingDevice.draft.trim();
+                                                            setRenamingDevice(null);
+                                                            if (trimmed !== '' && trimmed !== device.name) {
+                                                                void runDeviceAction({ action: 'rename', id: device.id, name: trimmed });
+                                                            }
+                                                        }, children: t('settings.renameSave') }), (0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-btn", disabled: deviceBusy, onClick: () => setRenamingDevice(null), children: t('settings.renameCancel') })] })) : null] }, device.id))) }))] }), (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-modalFooter", children: [(0, jsx_runtime_1.jsx)("div", { className: "zr-wizard-row", children: allDevices.length > 0 ? ((0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-btn", disabled: disabled || deviceBusy, onClick: () => {
+                                            if (window.confirm(t('settings.revokeAllConfirm'))) {
+                                                void runDeviceAction({ action: 'revoke-all' });
+                                            }
+                                        }, children: t('settings.revokeAll') })) : null }), (0, jsx_runtime_1.jsxs)("div", { className: "zr-wizard-row", children: [(0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-btn", disabled: disabled || deviceBusy, onClick: () => {
+                                                setDevicesModalOpen(false);
+                                                openWizardAt('verify', { role: 'host', target: 'desktop-client' });
+                                            }, children: t('wizard.overview.pairDesktop') }), (0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-btn zr-wizard-btnPrimary", disabled: disabled || deviceBusy, onClick: () => {
+                                                setDevicesModalOpen(false);
+                                                openWizardAt('verify', { role: 'host', target: 'web' });
+                                            }, children: t('wizard.overview.pairPhone') }), (0, jsx_runtime_1.jsx)("button", { type: "button", className: "zr-wizard-btn", disabled: deviceBusy, onClick: () => setDevicesModalOpen(false), children: t('wizard.card.close') })] })] })] }) })) : null, card === 'proxy' ? ((0, jsx_runtime_1.jsx)(ProxyCard_tsx_1.ProxyCard, { t: t, domain: (() => {
+                    if (domain.trim() !== '')
+                        return domain.trim();
+                    try {
+                        const parsed = new URL(serverUrl.trim());
+                        if (parsed.hostname !== '')
+                            return parsed.hostname;
+                    }
+                    catch { /* fall back to placeholder */ }
+                    return 'dsh.example.com';
+                })(), upstreamPort: (0, wizard_ts_1.upstreamPortOf)(wizardStatus), onCheck: () => {
+                    setStep('verify');
+                    void startVerification();
+                }, onClose: () => setCard(undefined) })) : null, card === 'token' ? ((0, jsx_runtime_1.jsx)(TokenCard_tsx_1.TokenCard, { t: t, onUse: (token) => {
+                    void (async () => {
+                        await saveTokenValue(token);
+                        setCard(undefined);
+                    })();
+                }, onClose: () => setCard(undefined) })) : null, card === 'migrate' ? ((0, jsx_runtime_1.jsx)(MigrateCard_tsx_1.MigrateCard, { t: t, onRecheck: () => {
+                    setCard(undefined);
+                    void checkDomain();
+                }, onClose: () => setCard(undefined) })) : null, card === 'portforward' ? ((0, jsx_runtime_1.jsx)(PortForwardCard_tsx_1.PortForwardCard, { t: t, port: Number(httpsPort.trim()) || 8443, onClose: () => setCard(undefined) })) : null] }));
+}
+};
+__modules["client/wizard/wizard-css.js"] = function (require, module, exports) {
+"use strict";
+/**
+ * Wizard-page CSS (GW-10), scoped end to end under the block's own
+ * `data-zen-remote` attributes — the desktop no-op rule in its CSS form:
+ * nothing here may reach a selector the wizard does not own, so the
+ * Plugins detail page at ≥1024px renders byte-identically whether or not
+ * the component mounts. Same transcription discipline as settings-css.ts
+ * (host design tokens only, no literal colors).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WIZARD_CSS = void 0;
+exports.WIZARD_CSS = `
+[data-plugin-detail="dsh-zen-remote"] section[data-plugin-config]:empty {
+  display: none;
+}
+
+[data-zen-remote="wizard"] {
+  display: flex;
+  flex-direction: column;
+  gap: 16px;
+  width: 100%;
+  box-sizing: border-box;
+  margin-inline: auto;
+  border: 1px solid var(--dsw-alias-border-l2);
+  border-radius: 12px;
+  background: var(--dsw-alias-bg-layer-2, var(--dsw-alias-bg-module-platform));
+  padding: 18px 20px;
+}
+
+[data-zen-remote="wizard"] .zr-wizard-header {
+  display: flex;
+  align-items: flex-start;
+  justify-content: space-between;
+  gap: 12px;
+  flex-wrap: wrap;
+}
+[data-zen-remote="wizard"] .zr-wizard-headerText {
+  display: flex;
+  flex-direction: column;
+  gap: 4px;
+  min-width: 0;
+}
+[data-zen-remote="wizard"] .zr-wizard-title {
+  font-size: 15px;
+  font-weight: 600;
+  color: var(--dsw-alias-label-primary);
+  margin: 0;
+}
+[data-zen-remote="wizard"] .zr-wizard-subtitle {
+  font-size: 12.5px;
+  color: var(--dsw-alias-label-tertiary);
+  margin: 0;
+  line-height: 1.45;
+}
+[data-zen-remote="wizard"] .zr-wizard-statusBadge {
+  display: inline-flex;
+  align-items: center;
+  gap: 6px;
+  font-size: 12px;
+  font-weight: 500;
+  padding: 4px 10px;
+  border-radius: 999px;
+  border: 1px solid var(--dsw-alias-border-l2);
+  background: var(--dsw-alias-bg-layer-3, var(--dsw-alias-bg-module-platform));
+  color: var(--dsw-alias-label-secondary);
+  white-space: nowrap;
+}
+[data-zen-remote="wizard"] .zr-wizard-statusBadge[data-state="pass"] {
+  color: var(--dsw-alias-label-primary);
+}
+
+[data-zen-remote="wizard"] .zr-wizard-notice {
+  font-size: 12.5px;
+  border: 1px solid var(--dsw-alias-border-l2);
+  border-radius: 8px;
+  padding: 9px 12px;
+  background: var(--dsw-alias-bg-layer-3, var(--dsw-alias-bg-module-platform));
+  color: var(--dsw-alias-label-secondary);
+  margin: 0;
+  line-height: 1.45;
+}
+[data-zen-remote="wizard"] .zr-wizard-notice[data-tone="error"] {
+  border-color: var(--dsw-alias-state-error-primary, #d5304f);
+  color: var(--dsw-alias-state-error-primary, #d5304f);
+}
+[data-zen-remote="wizard"] .zr-wizard-notice[data-tone="ok"] {
+  border-color: var(--dsw-alias-state-success-primary, #16a34a);
+  color: var(--dsw-alias-state-success-primary, #16a34a);
+}
+
+/* Inline Status Overview Card (2x2 spacious layout, full text visibility) */
+[data-zen-remote="wizard"] .zr-wizard-overviewGrid {
+  display: grid;
+  grid-template-columns: repeat(2, minmax(0, 1fr));
+  gap: 12px;
+}
+@media (max-width: 560px) {
+  [data-zen-remote="wizard"] .zr-wizard-overviewGrid {
+    grid-template-columns: 1fr;
+  }
+}
+[data-zen-remote="wizard"] .zr-wizard-overviewItem {
+  display: flex;
+  flex-direction: column;
+  gap: 6px;
+  padding: 13px 15px;
+  border-radius: 10px;
+  border: 1px solid var(--dsw-alias-border-l2);
+  background: var(--dsw-alias-bg-layer-3, var(--dsw-alias-bg-module-platform));
+  min-width: 0;
+}
+[data-zen-remote="wizard"] .zr-wizard-overviewHead {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 8px;
+}
+[data-zen-remote="wizard"] .zr-wizard-overviewLabel {
+  font-size: 12px;
+  color: var(--dsw-alias-label-tertiary);
+  margin: 0;
+}
+[data-zen-remote="wizard"] .zr-wizard-overviewValue {
+  display: flex;
+  align-items: center;
+  gap: 7px;
+  font-size: 13.5px;
+  font-weight: 600;
+  color: var(--dsw-alias-label-primary);
+  margin: 0;
+  line-height: 1.45;
+  overflow-wrap: anywhere;
+  word-break: break-word;
+}
+[data-zen-remote="wizard"] .zr-wizard-overviewSub {
+  font-size: 12px;
+  color: var(--dsw-alias-label-secondary);
+  margin: 0;
+  line-height: 1.45;
+  overflow-wrap: anywhere;
+  word-break: break-word;
+}
+[data-zen-remote="wizard"] .zr-wizard-emptyBanner {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 16px;
+  flex-wrap: wrap;
+  padding: 14px 16px;
+  border-radius: 10px;
+  border: 1px dashed var(--dsw-alias-border-l2);
+  background: var(--dsw-alias-bg-layer-3, var(--dsw-alias-bg-module-platform));
+}
+[data-zen-remote="wizard"] .zr-wizard-emptyText {
+  font-size: 12.5px;
+  color: var(--dsw-alias-label-secondary);
+  line-height: 1.5;
+  margin: 0;
+  flex: 1;
+  min-width: 220px;
+}
+
+/* Wizard Modal Dialog (above app chrome, below helper sub-cards) */
+[data-zen-remote="wizard-modal"] {
+  position: fixed;
+  inset: 0;
+  z-index: 950;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  padding: 16px;
+  background: rgba(0, 0, 0, 0.5);
+  backdrop-filter: blur(2px);
+}
+[data-zen-remote="wizard-modal"] .zr-wizard-modalDialog {
+  width: min(680px, calc(100vw - 32px));
+  max-height: min(88vh, 760px);
+  display: flex;
+  flex-direction: column;
+  border-radius: 14px;
+  border: 1px solid var(--dsw-alias-border-l2);
+  background: var(--dsw-alias-bg-layer-2, var(--dsw-alias-bg-module-platform));
+  color: var(--dsw-alias-label-primary);
+  box-shadow: 0 20px 48px rgba(0, 0, 0, 0.28);
+  overflow: hidden;
+}
+[data-zen-remote="wizard-modal"] .zr-wizard-modalHeader {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 12px;
+  padding: 16px 22px 14px;
+}
+[data-zen-remote="wizard-modal"] .zr-wizard-modalTitle {
+  font-size: 15.5px;
+  font-weight: 600;
+  color: var(--dsw-alias-label-primary);
+  margin: 0;
+}
+[data-zen-remote="wizard-modal"] .zr-wizard-modalBody {
+  padding: 18px 22px;
+  overflow-y: auto;
+  display: flex;
+  flex-direction: column;
+  gap: 16px;
+  flex: 1;
+}
+[data-zen-remote="wizard-modal"] .zr-wizard-modalFooter {
+  padding: 14px 22px;
+  border-top: 1px solid var(--dsw-alias-border-l2);
+  background: var(--dsw-alias-bg-layer-2, var(--dsw-alias-bg-module-platform));
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 12px;
+  flex-wrap: wrap;
+}
+
+/* Non-clickable 3-step visual progress indicator */
+[data-zen-remote="wizard"] .zr-wizard-stepper {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 10px;
+  padding: 13px 22px;
+  margin: 0;
+  list-style: none;
+  background: var(--dsw-alias-bg-layer-3, var(--dsw-alias-bg-module-platform));
+  border-top: 1px solid var(--dsw-alias-border-l2);
+  border-bottom: 1px solid var(--dsw-alias-border-l2);
+  user-select: none;
+  pointer-events: none;
+}
+[data-zen-remote="wizard"] .zr-wizard-stepItem {
+  display: flex;
+  align-items: center;
+  gap: 10px;
+  min-width: 0;
+}
+[data-zen-remote="wizard"] .zr-wizard-stepCircle {
+  width: 26px;
+  height: 26px;
+  border-radius: 50%;
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  font-size: 12px;
+  font-weight: 600;
+  border: 1.5px solid var(--dsw-alias-border-l2);
+  background: var(--dsw-alias-bg-layer-2, var(--dsw-alias-bg-module-platform));
+  color: var(--dsw-alias-label-tertiary);
+  flex: none;
+  transition: background-color 160ms ease, border-color 160ms ease, color 160ms ease, box-shadow 160ms ease;
+}
+[data-zen-remote="wizard"] .zr-wizard-stepItem[data-state="current"] .zr-wizard-stepCircle {
+  background: var(--dsw-alias-label-primary);
+  border-color: var(--dsw-alias-label-primary);
+  color: var(--dsw-alias-bg-layer-2, #fff);
+  box-shadow: 0 0 0 3px var(--dsw-alias-border-l2);
+}
+[data-zen-remote="wizard"] .zr-wizard-stepItem[data-state="done"] .zr-wizard-stepCircle {
+  background: var(--dsw-alias-state-success-primary, #16a34a);
+  border-color: var(--dsw-alias-state-success-primary, #16a34a);
+  color: #fff;
+}
+[data-zen-remote="wizard"] .zr-wizard-stepText {
+  display: flex;
+  flex-direction: column;
+  gap: 1px;
+  min-width: 0;
+}
+[data-zen-remote="wizard"] .zr-wizard-stepTag {
+  font-size: 11px;
+  color: var(--dsw-alias-label-tertiary);
+  line-height: 1.2;
+}
+[data-zen-remote="wizard"] .zr-wizard-stepItem[data-state="current"] .zr-wizard-stepTag {
+  color: var(--dsw-alias-label-secondary);
+  font-weight: 500;
+}
+[data-zen-remote="wizard"] .zr-wizard-stepItem[data-state="done"] .zr-wizard-stepTag {
+  color: var(--dsw-alias-state-success-primary, #16a34a);
+}
+[data-zen-remote="wizard"] .zr-wizard-stepName {
+  font-size: 13px;
+  font-weight: 500;
+  color: var(--dsw-alias-label-tertiary);
+  white-space: nowrap;
+  overflow: hidden;
+  text-overflow: ellipsis;
+}
+[data-zen-remote="wizard"] .zr-wizard-stepItem[data-state="current"] .zr-wizard-stepName {
+  color: var(--dsw-alias-label-primary);
+  font-weight: 600;
+}
+[data-zen-remote="wizard"] .zr-wizard-stepItem[data-state="done"] .zr-wizard-stepName {
+  color: var(--dsw-alias-label-secondary);
+}
+[data-zen-remote="wizard"] .zr-wizard-stepConnector {
+  flex: 1;
+  height: 2px;
+  min-width: 18px;
+  border-radius: 2px;
+  background: var(--dsw-alias-border-l2);
+  transition: background-color 200ms ease;
+}
+[data-zen-remote="wizard"] .zr-wizard-stepConnector[data-done="true"] {
+  background: var(--dsw-alias-state-success-primary, #16a34a);
+}
+[data-zen-remote="wizard"] .zr-wizard-stepIntro {
+  font-size: 12.5px;
+  color: var(--dsw-alias-label-secondary);
+  margin: 0;
+  line-height: 1.45;
+}
+
+[data-zen-remote="wizard"] .zr-wizard-body {
+  display: flex;
+  flex-direction: column;
+  gap: 14px;
+}
+
+/* Step 1: 3-column path cards */
+[data-zen-remote="wizard"] .zr-wizard-paths {
+  display: grid;
+  grid-template-columns: repeat(auto-fit, minmax(200px, 1fr));
+  gap: 10px;
+  margin: 0;
+  padding: 0;
+  border: none;
+}
+[data-zen-remote="wizard"] .zr-wizard-path {
+  display: flex;
+  flex-direction: column;
+  gap: 6px;
+  text-align: left;
+  border: 1px solid var(--dsw-alias-border-l2);
+  border-radius: 10px;
+  padding: 12px 14px;
+  background: var(--dsw-alias-bg-layer-3, var(--dsw-alias-bg-module-platform));
+  cursor: pointer;
+  font: inherit;
+  color: inherit;
+  transition: border-color 120ms ease, box-shadow 120ms ease;
+}
+[data-zen-remote="wizard"] .zr-wizard-path:hover:not(:disabled) {
+  border-color: var(--dsw-alias-label-secondary);
+}
+[data-zen-remote="wizard"] .zr-wizard-path[data-selected="true"] {
+  border-color: var(--dsw-alias-label-primary);
+  box-shadow: 0 0 0 1px var(--dsw-alias-label-primary);
+  background: var(--dsw-alias-bg-layer-2, var(--dsw-alias-bg-module-platform));
+}
+[data-zen-remote="wizard"] .zr-wizard-path:disabled {
+  cursor: not-allowed;
+  opacity: 0.55;
+}
+[data-zen-remote="wizard"] .zr-wizard-pathHead {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+}
+[data-zen-remote="wizard"] .zr-wizard-pathRadio {
+  width: 14px;
+  height: 14px;
+  border-radius: 50%;
+  border: 1.5px solid var(--dsw-alias-label-tertiary);
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  flex: none;
+}
+[data-zen-remote="wizard"] .zr-wizard-pathRadio[data-selected="true"] {
+  border-color: var(--dsw-alias-label-primary);
+  background: var(--dsw-alias-label-primary);
+  box-shadow: inset 0 0 0 2.5px var(--dsw-alias-bg-layer-2, var(--dsw-alias-bg-module-platform));
+}
+[data-zen-remote="wizard"] .zr-wizard-pathName {
+  font-size: 13px;
+  font-weight: 600;
+  color: var(--dsw-alias-label-primary);
+  margin: 0;
+}
+[data-zen-remote="wizard"] .zr-wizard-pathDesc {
+  font-size: 12px;
+  color: var(--dsw-alias-label-tertiary);
+  margin: 0;
+  line-height: 1.45;
+}
+[data-zen-remote="wizard"] .zr-wizard-sectionTitle {
+  font-size: 12px;
+  font-weight: 600;
+  color: var(--dsw-alias-label-secondary);
+  margin: 0;
+}
+[data-zen-remote="wizard"] .zr-wizard-roleGrid {
+  display: grid;
+  grid-template-columns: repeat(auto-fit, minmax(220px, 1fr));
+  gap: 10px;
+}
+[data-zen-remote="wizard"] .zr-wizard-checkRow {
+  display: inline-flex;
+  align-items: center;
+  gap: 8px;
+  font-size: 12.5px;
+  color: var(--dsw-alias-label-primary);
+  cursor: pointer;
+  user-select: none;
+}
+[data-zen-remote="wizard"] .zr-wizard-checkRow input[type="checkbox"] {
+  margin: 0;
+  cursor: pointer;
+}
+
+/* Step 2: form controls */
+[data-zen-remote="wizard"] .zr-wizard-selectedBar {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 8px;
+  padding: 8px 12px;
+  border-radius: 8px;
+  border: 1px solid var(--dsw-alias-border-l2);
+  background: var(--dsw-alias-bg-layer-3, var(--dsw-alias-bg-module-platform));
+}
+[data-zen-remote="wizard"] .zr-wizard-selectedLabel {
+  font-size: 12.5px;
+  font-weight: 600;
+  color: var(--dsw-alias-label-primary);
+}
+[data-zen-remote="wizard"] .zr-wizard-formStack {
+  display: flex;
+  flex-direction: column;
+  gap: 12px;
+}
+[data-zen-remote="wizard"] .zr-wizard-formGrid {
+  display: grid;
+  grid-template-columns: 1fr 120px;
+  gap: 12px;
+  align-items: start;
+}
+[data-zen-remote="wizard"] .zr-wizard-field {
+  display: flex;
+  flex-direction: column;
+  gap: 6px;
+}
+[data-zen-remote="wizard"] .zr-wizard-labelRow {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+}
+[data-zen-remote="wizard"] .zr-wizard-label {
+  font-size: 12.5px;
+  font-weight: 500;
+  color: var(--dsw-alias-label-primary);
+  margin: 0;
+}
+[data-zen-remote="wizard"] .zr-wizard-savedTag {
+  font-size: 11px;
+  padding: 1px 7px;
+  border-radius: 999px;
+  border: 1px solid var(--dsw-alias-border-l2);
+  color: var(--dsw-alias-state-success-primary, #16a34a);
+  background: var(--dsw-alias-bg-layer-3, var(--dsw-alias-bg-module-platform));
+}
+[data-zen-remote="wizard"] .zr-wizard-hint {
+  font-size: 12px;
+  color: var(--dsw-alias-label-tertiary);
+  margin: 0;
+  line-height: 1.4;
+}
+[data-zen-remote="wizard"] .zr-wizard-input {
+  height: 34px;
+  font: inherit;
+  font-size: 13px;
+  padding: 0 10px;
+  border: 1px solid var(--dsw-alias-border-l2);
+  border-radius: 8px;
+  background: var(--dsw-alias-bg-layer-3, var(--dsw-alias-bg-module-platform));
+  color: var(--dsw-alias-label-primary);
+  width: 100%;
+  box-sizing: border-box;
+}
+[data-zen-remote="wizard"] code.zr-wizard-input {
+  display: flex;
+  align-items: center;
+  min-height: 36px;
+  height: auto;
+  padding: 6px 12px;
+  font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+  line-height: 1.4;
+  overflow-wrap: anywhere;
+  word-break: break-all;
+}
+[data-zen-remote="wizard"] .zr-wizard-input:focus {
+  outline: none;
+  border-color: var(--dsw-alias-label-primary);
+}
+[data-zen-remote="wizard"] .zr-wizard-row {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  flex-wrap: wrap;
+}
+[data-zen-remote="wizard"] .zr-wizard-link {
+  background: none;
+  border: none;
+  padding: 0;
+  font: inherit;
+  font-size: 12px;
+  color: var(--dsw-alias-label-secondary);
+  cursor: pointer;
+  text-decoration: underline;
+}
+[data-zen-remote="wizard"] .zr-wizard-link:hover:not(:disabled) {
+  color: var(--dsw-alias-label-primary);
+}
+[data-zen-remote="wizard"] .zr-wizard-linkBtn {
+  font: inherit;
+  font-size: 12px;
+  padding: 4px 10px;
+  border-radius: 6px;
+  border: 1px solid var(--dsw-alias-border-l2);
+  background: var(--dsw-alias-bg-layer-3, var(--dsw-alias-bg-module-platform));
+  color: var(--dsw-alias-label-secondary);
+  cursor: pointer;
+}
+[data-zen-remote="wizard"] .zr-wizard-linkBtn:hover:not(:disabled) {
+  color: var(--dsw-alias-label-primary);
+  border-color: var(--dsw-alias-label-secondary);
+}
+
+/* Primary & Secondary action buttons + Footer */
+[data-zen-remote="wizard"] .zr-wizard-footer {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 10px;
+  padding-top: 8px;
+  border-top: 1px solid var(--dsw-alias-border-l2);
+}
+[data-zen-remote="wizard"] .zr-wizard-footerHint {
+  font-size: 12px;
+  color: var(--dsw-alias-label-secondary);
+}
+[data-zen-remote="wizard"] .zr-wizard-btn,
+[data-zen-remote="wizard-card"] .zr-wizard-btn {
+  font: inherit;
+  font-size: 12.5px;
+  font-weight: 500;
+  height: 32px;
+  padding: 0 14px;
+  border-radius: 8px;
+  border: 1px solid var(--dsw-alias-border-l2);
+  background: var(--dsw-alias-bg-layer-3, var(--dsw-alias-bg-module-platform));
+  color: var(--dsw-alias-label-primary);
+  cursor: pointer;
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+}
+[data-zen-remote="wizard"] .zr-wizard-btn:hover:not(:disabled),
+[data-zen-remote="wizard-card"] .zr-wizard-btn:hover:not(:disabled) {
+  border-color: var(--dsw-alias-label-secondary);
+}
+[data-zen-remote="wizard"] .zr-wizard-btnPrimary,
+[data-zen-remote="wizard-card"] .zr-wizard-btnPrimary {
+  background: var(--dsw-alias-label-primary);
+  border-color: var(--dsw-alias-label-primary);
+  color: var(--dsw-alias-bg-layer-2, #fff);
+}
+[data-zen-remote="wizard"] .zr-wizard-btnPrimary:hover:not(:disabled),
+[data-zen-remote="wizard-card"] .zr-wizard-btnPrimary:hover:not(:disabled) {
+  opacity: 0.9;
+}
+[data-zen-remote="wizard"] .zr-wizard-btn:disabled,
+[data-zen-remote="wizard-card"] .zr-wizard-btn:disabled {
+  cursor: not-allowed;
+  opacity: 0.5;
+}
+
+/* Step 3: service control bar, 3-column lights, and QR pairing panel */
+[data-zen-remote="wizard"] .zr-wizard-serviceBar {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 12px;
+  flex-wrap: wrap;
+  padding: 10px 12px;
+  border: 1px solid var(--dsw-alias-border-l2);
+  border-radius: 10px;
+  background: var(--dsw-alias-bg-layer-3, var(--dsw-alias-bg-module-platform));
+}
+[data-zen-remote="wizard"] .zr-wizard-serviceInfo {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  flex-wrap: wrap;
+}
+[data-zen-remote="wizard"] .zr-wizard-lights {
+  display: grid;
+  grid-template-columns: repeat(auto-fit, minmax(180px, 1fr));
+  gap: 8px;
+  margin: 0;
+  padding: 0;
+  list-style: none;
+}
+[data-zen-remote="wizard"] .zr-wizard-light {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 8px;
+  padding: 9px 12px;
+  border-radius: 8px;
+  border: 1px solid var(--dsw-alias-border-l2);
+  background: var(--dsw-alias-bg-layer-3, var(--dsw-alias-bg-module-platform));
+  font-size: 12.5px;
+}
+[data-zen-remote="wizard"] .zr-wizard-lightMain {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  min-width: 0;
+}
+[data-zen-remote="wizard"] .zr-wizard-lightName {
+  color: var(--dsw-alias-label-primary);
+  font-weight: 500;
+}
+[data-zen-remote="wizard"] .zr-wizard-lightState {
+  font-size: 11.5px;
+  color: var(--dsw-alias-label-tertiary);
+}
+[data-zen-remote="wizard"] .zr-wizard-lightState[data-state="pass"] {
+  color: var(--dsw-alias-state-success-primary, #16a34a);
+}
+[data-zen-remote="wizard"] .zr-wizard-lightState[data-state="fail"] {
+  color: var(--dsw-alias-state-error-primary, #d5304f);
+}
+
+[data-zen-remote="wizard"] .zr-wizard-dot {
+  width: 8px;
+  height: 8px;
+  border-radius: 50%;
+  background: var(--dsw-alias-label-tertiary);
+  flex: none;
+}
+[data-zen-remote="wizard"] .zr-wizard-dot[data-state="pass"] {
+  background: var(--dsw-alias-state-success-primary, #16a34a);
+}
+[data-zen-remote="wizard"] .zr-wizard-dot[data-state="fail"] {
+  background: var(--dsw-alias-state-error-primary, #d5304f);
+}
+[data-zen-remote="wizard"] .zr-wizard-dot[data-state="pending"] {
+  background: var(--dsw-alias-state-warning-primary, #b8860b);
+}
+
+[data-zen-remote="wizard"] .zr-wizard-pairPanel {
+  display: flex;
+  align-items: center;
+  gap: 18px;
+  flex-wrap: wrap;
+  padding: 14px;
+  border-radius: 10px;
+  border: 1px solid var(--dsw-alias-border-l2);
+  background: var(--dsw-alias-bg-layer-3, var(--dsw-alias-bg-module-platform));
+}
+[data-zen-remote="wizard"] .zr-wizard-pairMeta {
+  display: flex;
+  flex-direction: column;
+  gap: 4px;
+  flex: 1;
+  min-width: 180px;
+}
+[data-zen-remote="wizard"] .zr-wizard-code {
+  font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+  font-size: 24px;
+  letter-spacing: 4px;
+  font-weight: 600;
+  color: var(--dsw-alias-label-primary);
+  margin: 2px 0;
+}
+[data-zen-remote="wizard"] .zr-wizard-countdown {
+  font-size: 12px;
+  color: var(--dsw-alias-label-secondary);
+  margin: 0;
+}
+[data-zen-remote="wizard"] .zr-wizard-qr {
+  width: 156px;
+  height: 156px;
+  image-rendering: pixelated;
+  border: 1px solid var(--dsw-alias-border-l2);
+  border-radius: 8px;
+  background: #fff;
+  display: block;
+  flex: none;
+}
+[data-zen-remote="wizard"] .zr-wizard-qr[data-usable="false"] {
+  display: none;
+}
+[data-zen-remote="wizard"] .zr-wizard-targetTabs {
+  display: grid;
+  grid-template-columns: repeat(auto-fit, minmax(180px, 1fr));
+  gap: 6px;
+  padding: 4px;
+  border-radius: 9px;
+  border: 1px solid var(--dsw-alias-border-l2);
+  background: var(--dsw-alias-bg-layer-3, var(--dsw-alias-bg-module-platform));
+}
+[data-zen-remote="wizard"] .zr-wizard-targetTab {
+  font: inherit;
+  font-size: 12.5px;
+  font-weight: 500;
+  padding: 7px 12px;
+  border-radius: 6px;
+  border: 1px solid transparent;
+  background: transparent;
+  color: var(--dsw-alias-label-secondary);
+  cursor: pointer;
+  text-align: center;
+}
+[data-zen-remote="wizard"] .zr-wizard-targetTab[data-selected="true"] {
+  background: var(--dsw-alias-bg-layer-2, var(--dsw-alias-bg-module-platform));
+  border-color: var(--dsw-alias-border-l2);
+  color: var(--dsw-alias-label-primary);
+  font-weight: 600;
+}
+[data-zen-remote="wizard"] .zr-wizard-desktopBox,
+[data-zen-remote="wizard"] .zr-wizard-clientBox {
+  display: flex;
+  flex-direction: column;
+  gap: 10px;
+  padding: 14px;
+  border-radius: 10px;
+  border: 1px solid var(--dsw-alias-border-l2);
+  background: var(--dsw-alias-bg-layer-3, var(--dsw-alias-bg-module-platform));
+}
+[data-zen-remote="wizard"] .zr-wizard-deviceList {
+  display: flex;
+  flex-direction: column;
+  gap: 10px;
+  margin: 0;
+  padding: 0;
+  list-style: none;
+}
+[data-zen-remote="wizard"] .zr-wizard-deviceItem {
+  display: flex;
+  flex-direction: column;
+  gap: 8px;
+  padding: 12px 14px;
+  border-radius: 10px;
+  border: 1px solid var(--dsw-alias-border-l2);
+  background: var(--dsw-alias-bg-layer-3, var(--dsw-alias-bg-module-platform));
+  font-size: 12.5px;
+}
+[data-zen-remote="wizard"] .zr-wizard-deviceHead {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 10px;
+  flex-wrap: wrap;
+}
+[data-zen-remote="wizard"] .zr-wizard-deviceTitleRow {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  flex-wrap: wrap;
+  min-width: 0;
+}
+[data-zen-remote="wizard"] .zr-wizard-deviceBadge {
+  font-size: 11px;
+  font-weight: 500;
+  padding: 2px 8px;
+  border-radius: 999px;
+  border: 1px solid var(--dsw-alias-border-l2);
+  background: var(--dsw-alias-bg-layer-2, var(--dsw-alias-bg-module-platform));
+  color: var(--dsw-alias-label-secondary);
+}
+[data-zen-remote="wizard"] .zr-wizard-deviceActions {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  flex-wrap: wrap;
+}
+[data-zen-remote="wizard"] .zr-wizard-select {
+  height: 30px;
+  font: inherit;
+  font-size: 12px;
+  padding: 0 8px;
+  border-radius: 6px;
+  border: 1px solid var(--dsw-alias-border-l2);
+  background: var(--dsw-alias-bg-layer-2, var(--dsw-alias-bg-module-platform));
+  color: var(--dsw-alias-label-primary);
+}
+
+/* The modal card: a body-level overlay, above the app chrome. */
+[data-zen-remote="wizard-card"] {
+  position: fixed;
+  inset: 0;
+  z-index: 1000;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  background: rgba(0, 0, 0, 0.45);
+}
+[data-zen-remote="wizard-card"] .zr-wizard-cardPanel {
+  background: var(--dsw-alias-bg-layer-2, var(--dsw-alias-bg-module-platform));
+  color: var(--dsw-alias-label-primary);
+  border: 1px solid var(--dsw-alias-border-l2);
+  border-radius: 12px;
+  width: min(560px, calc(100vw - 32px));
+  max-height: min(82vh, 660px);
+  overflow: auto;
+  padding: 18px 20px;
+  display: flex;
+  flex-direction: column;
+  gap: 14px;
+}
+[data-zen-remote="wizard-card"] .zr-wizard-cardHeader {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 8px;
+}
+[data-zen-remote="wizard-card"] .zr-wizard-cardTitle {
+  font-size: 15px;
+  font-weight: 600;
+  margin: 0;
+}
+[data-zen-remote="wizard-modal"] .zr-wizard-cardCloseIcon,
+[data-zen-remote="wizard-card"] .zr-wizard-cardCloseIcon {
+  border: none;
+  background: none;
+  color: var(--dsw-alias-label-secondary);
+  font-size: 18px;
+  line-height: 1;
+  padding: 2px 6px;
+  border-radius: 6px;
+  cursor: pointer;
+}
+[data-zen-remote="wizard-modal"] .zr-wizard-cardCloseIcon:hover,
+[data-zen-remote="wizard-card"] .zr-wizard-cardCloseIcon:hover {
+  color: var(--dsw-alias-label-primary);
+}
+[data-zen-remote="wizard-card"] .zr-wizard-cardBody {
+  display: flex;
+  flex-direction: column;
+  gap: 10px;
+}
+[data-zen-remote="wizard-card"] .zr-wizard-cardSteps {
+  display: flex;
+  flex-direction: column;
+  gap: 6px;
+}
+[data-zen-remote="wizard-card"] .zr-wizard-cardSubhead {
+  font-size: 12.5px;
+  font-weight: 600;
+  color: var(--dsw-alias-label-primary);
+  margin: 4px 0 0;
+}
+[data-zen-remote="wizard-card"] .zr-wizard-cardTable {
+  width: 100%;
+  border-collapse: collapse;
+  font-size: 12px;
+  border: 1px solid var(--dsw-alias-border-l2);
+  border-radius: 8px;
+  overflow: hidden;
+}
+[data-zen-remote="wizard-card"] .zr-wizard-cardTable td {
+  padding: 6px 10px;
+  border-bottom: 1px solid var(--dsw-alias-border-l2);
+}
+[data-zen-remote="wizard-card"] .zr-wizard-cardTable tr:last-child td {
+  border-bottom: none;
+}
+[data-zen-remote="wizard-card"] .zr-wizard-cardPerm {
+  font-weight: 500;
+  color: var(--dsw-alias-label-primary);
+  white-space: nowrap;
+}
+[data-zen-remote="wizard-card"] .zr-wizard-cardWhy {
+  color: var(--dsw-alias-label-tertiary);
+}
+[data-zen-remote="wizard-card"] .zr-wizard-cardTabs {
+  display: flex;
+  gap: 6px;
+}
+[data-zen-remote="wizard-card"] .zr-wizard-cardTab {
+  font: inherit;
+  font-size: 12px;
+  font-weight: 500;
+  padding: 4px 12px;
+  border-radius: 999px;
+  border: 1px solid var(--dsw-alias-border-l2);
+  background: var(--dsw-alias-bg-layer-3, var(--dsw-alias-bg-module-platform));
+  color: var(--dsw-alias-label-secondary);
+  cursor: pointer;
+}
+[data-zen-remote="wizard-card"] .zr-wizard-cardTab[data-selected="true"] {
+  color: var(--dsw-alias-bg-layer-2, #fff);
+  background: var(--dsw-alias-label-primary);
+  border-color: var(--dsw-alias-label-primary);
+}
+[data-zen-remote="wizard-card"] .zr-wizard-cardStep {
+  font-size: 12.5px;
+  color: var(--dsw-alias-label-secondary);
+  margin: 0;
+  line-height: 1.45;
+}
+[data-zen-remote="wizard-card"] .zr-wizard-cardCode {
+  font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+  font-size: 12px;
+  white-space: pre;
+  background: var(--dsw-alias-bg-layer-3, rgba(127, 127, 127, 0.12));
+  border: 1px solid var(--dsw-alias-border-l2);
+  border-radius: 8px;
+  padding: 10px 12px;
+  overflow: auto;
+  max-height: 260px;
+  margin: 0;
+}
+[data-zen-remote="wizard-card"] .zr-wizard-field {
+  display: flex;
+  flex-direction: column;
+  gap: 6px;
+}
+[data-zen-remote="wizard-card"] .zr-wizard-label {
+  font-size: 12.5px;
+  font-weight: 500;
+  color: var(--dsw-alias-label-primary);
+}
+[data-zen-remote="wizard-card"] .zr-wizard-input {
+  height: 34px;
+  font: inherit;
+  font-size: 13px;
+  padding: 0 10px;
+  border: 1px solid var(--dsw-alias-border-l2);
+  border-radius: 8px;
+  background: var(--dsw-alias-bg-layer-3, var(--dsw-alias-bg-module-platform));
+  color: var(--dsw-alias-label-primary);
+  width: 100%;
+  box-sizing: border-box;
+}
+[data-zen-remote="wizard-card"] .zr-wizard-cardActions {
+  display: flex;
+  justify-content: flex-end;
+  gap: 8px;
+  padding-top: 8px;
+  border-top: 1px solid var(--dsw-alias-border-l2);
+}
+`;
+};
+__modules["client/wizard/register-wizard.js"] = function (require, module, exports) {
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WIZARD_BUNDLE_KEY = void 0;
+exports.registerGatewayWizard = registerGatewayWizard;
+const settings_form_ts_1 = require("./client-data/settings-form.js");
+const locales_ts_1 = require("./client/locales.js");
+const register_settings_ts_1 = require("./client/settings/register-settings.js");
+const wizard_css_ts_1 = require("./client/wizard/wizard-css.js");
+/** `plugins.bundle.config` key: the bundle's package name. */
+exports.WIZARD_BUNDLE_KEY = 'dsh-zen-remote';
+/**
+ * Register the wizard stylesheet and (lazily, only where the settings
+ * service exists) the bundle detail-page top block.
+ * @param ctx - client root context.
+ * @param section - the block component; a parameter so this module stays
+ *   JSX-free and importable under Node's type stripping.
+ */
+function registerGatewayWizard(ctx, section) {
+    ctx.effect(() => {
+        const tag = document.createElement('style');
+        tag.dataset.plugin = 'dsh-zen-remote-wizard';
+        tag.textContent = wizard_css_ts_1.WIZARD_CSS;
+        document.head.appendChild(tag);
+        return () => { tag.remove(); };
+    }, 'dsh-zen-remote: wizard styles');
+    ctx.inject(['configForms'], (formsCtx) => {
+        const scope = formsCtx.configForms.get(register_settings_ts_1.SETTINGS_ENTRY_ID);
+        // Follow the describe sidecar when available so client-mode pairing can
+        // see whether `deviceToken` is configured (degrades to false in minimal
+        // test harnesses that omit `describe`).
+        const describe = typeof formsCtx.configForms.describe === 'function' ? formsCtx.configForms.describe() : undefined;
+        const secretConfigured = () => {
+            const namespaces = describe?.getSnapshot().view?.namespaces ?? [];
+            const row = namespaces.find((candidate) => candidate.ns === register_settings_ts_1.SETTINGS_ENTRY_ID);
+            return (row?.secrets ?? []).some((secret) => secret.path.length === 1 && secret.path[0] === settings_form_ts_1.DEVICE_TOKEN_FIELD && secret.set);
+        };
+        const config = new settings_form_ts_1.ZenRemoteSettingsForm(scope, secretConfigured);
+        const offDescribe = describe !== undefined ? describe.subscribe(() => { config.refresh(); }) : () => { };
+        formsCtx.effect(() => () => { offDescribe(); config.dispose(); }, 'dsh-zen-remote: wizard form');
+        const saveRowFields = async (fields, options) => {
+            const snapshot = scope.getSnapshot();
+            const ops = [
+                ...Object.entries(fields).map(([key, value]) => ({ op: 'set', path: [key], value })),
+                ...(options?.unset ?? []).map((key) => ({ op: 'unset', path: [key] })),
+            ];
+            await scope.mutate(ops, snapshot.revision);
+        };
+        formsCtx.effect(() => formsCtx.slots.inject('plugins.bundle.config', () => formsCtx.slots.register({
+            name: 'plugins.bundle.config',
+            key: exports.WIZARD_BUNDLE_KEY,
+            locale: locales_ts_1.NS,
+            inject: () => ({ config, saveRowFields }),
+        }, section)), 'dsh-zen-remote: wizard section');
+    });
+}
+};
 __modules["client/RemoteHeaderIcon.js"] = function (require, module, exports) {
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
@@ -19772,6 +23047,8 @@ const share_preview_tsx_1 = require("./client/share/share-preview.js");
 const locales_ts_1 = require("./client/locales.js");
 const SettingsSection_tsx_1 = require("./client/settings/SettingsSection.js");
 const register_settings_ts_1 = require("./client/settings/register-settings.js");
+const GatewayWizard_tsx_1 = require("./client/wizard/GatewayWizard.js");
+const register_wizard_ts_1 = require("./client/wizard/register-wizard.js");
 const RemoteHeaderIcon_tsx_1 = require("./client/RemoteHeaderIcon.js");
 const RemoteShareMenu_tsx_1 = require("./client/RemoteShareMenu.js");
 const shares_ts_1 = require("./client-data/shares.js");
@@ -19832,6 +23109,12 @@ function apply(ctx) {
     // 的按需注入都在 registerSettingsPage 里（那个服务名绝不进顶层的 inject
     // 数组，否则没有该服务的环境整个界面半边都加载不了）。
     (0, register_settings_ts_1.registerSettingsPage)(ctx, SettingsSection_tsx_1.SettingsSection);
+    // GW-10 网关配置引导「让手机连上来」：同样在桌面门之前注册——桌面端 App
+    // 正是主服务端，wizard 恰好是它最有用的入口。部件自身三重门控：subject
+    // 过滤（kind === 'row' && pkg.name === 'dsh-zen-remote'）、保存角色检查
+    // （client 角色不渲染）、viaGateway 时全部操作禁用。样式全部作用在组件
+    // 自身的 data 属性下，≥1024px 的其他页面逐像素不受影响。
+    (0, register_wizard_ts_1.registerGatewayWizard)(ctx, GatewayWizard_tsx_1.GatewayWizard);
     // T33b 会话共享的三个入口里前两个（标题行远程图标、会话右键菜单项）：
     // 同样必须在桌面门之前注册——桌面端 App 就是主服务端，图标和菜单恰好
     // 住在它的标题行与会话菜单里。部件自身按数据降级：shares 路由 404