dsh-zen-remote 2.2.9 → 2.3.2

package/lib/wizard/source-detect.js

@@ -0,0 +1,77 @@
+/**
+ * Reverse-proxy source detection (GW-5), pure logic — the browser-facing
+ * half of the 「检测到反代从 {ip} 连过来，自动信任？」flow.
+ *
+ * The gateway (lib/lan-gate-server.cjs) records the last request that
+ * carried proxy headers from a socket it does NOT trust — almost always
+ * the user's own reverse proxy whose IP never made it into
+ * `trustedProxies` — as `lastForwardedSource: { ip, at }` in its
+ * `/lan-gate/status` answer. {@link detectForwardedSource} lifts that
+ * field out (defensively: the gateway may be old and send nothing), and
+ * {@link mergeProxyList} / {@link normalizeTrustedIp} build the merged
+ * trust list the trust-proxy route persists.
+ *
+ * Pure: no imports, no I/O — the check scripts can drive it directly.
+ */
+/**
+ * Extract the untrusted-proxy detection from one `/lan-gate/status` body.
+ * Returns null when the gateway predates the field or the field is
+ * malformed — a missing detection is the common case, never an error.
+ */
+export function detectForwardedSource(gatewayStatus) {
+    if (gatewayStatus === null || typeof gatewayStatus !== 'object')
+        return null;
+    const source = gatewayStatus.lastForwardedSource;
+    if (source === null || typeof source !== 'object')
+        return null;
+    const { ip, at } = source;
+    if (typeof ip !== 'string' || ip === '')
+        return null;
+    if (typeof at !== 'number' || !Number.isFinite(at))
+        return null;
+    return { ip, at };
+}
+/**
+ * One trust-list entry: an IP literal, normalized the way the gateway
+ * normalizes socket peers (`::ffff:` IPv4-in-IPv6 unwrapped). Refuses
+ * anything that is not a plausible IPv4/IPv6 literal — the value goes
+ * into persisted config and later into an exact string comparison
+ * against socket peers, where a hostname or a CIDR would silently never
+ * match.
+ */
+export function normalizeTrustedIp(raw) {
+    if (typeof raw !== 'string')
+        return undefined;
+    const value = raw.trim();
+    if (value === '')
+        return undefined;
+    // IPv4-in-IPv6 form the gateway itself strips from socket peers.
+    const unwrapped = value.toLowerCase().startsWith('::ffff:') ? value.slice(7) : value;
+    if (/^\d{1,3}(?:\.\d{1,3}){3}$/.test(unwrapped)) {
+        return unwrapped.split('.').every((part) => Number(part) <= 255) ? unwrapped : undefined;
+    }
+    // IPv6: hex groups and colons only, at least one colon, no zone index.
+    if (/^[0-9a-f:]+$/i.test(unwrapped) && unwrapped.includes(':') && !unwrapped.includes('%')) {
+        return unwrapped.toLowerCase();
+    }
+    return undefined;
+}
+/** Split the comma-separated trustedProxies value into entries. */
+export function parseProxyList(value) {
+    if (typeof value !== 'string')
+        return [];
+    return value.split(',').map((entry) => entry.trim()).filter((entry) => entry !== '');
+}
+/**
+ * Append one IP to the comma-separated list, preserving order, skipping
+ * duplicates (the trust-proxy route answers "already trusted" instead of
+ * rewriting). Normalization is the caller's job — the route normalizes
+ * before merging.
+ */
+export function mergeProxyList(current, ip) {
+    const entries = parseProxyList(current);
+    if (entries.includes(ip))
+        return entries.join(',');
+    return [...entries, ip].join(',');
+}
+//# sourceMappingURL=source-detect.js.map

package/lib/wizard/source-detect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"source-detect.js","sourceRoot":"","sources":["../../src/wizard/source-detect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAiBH;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,aAAsB;IAC1D,IAAI,aAAa,KAAK,IAAI,IAAI,OAAO,aAAa,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IAC5E,MAAM,MAAM,GAAI,aAAmD,CAAC,mBAAmB,CAAA;IACvF,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IAC9D,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,MAA8B,CAAA;IACjD,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,IAAI,CAAA;IACpD,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAAE,OAAO,IAAI,CAAA;IAC/D,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,CAAA;AACnB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAY;IAC7C,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAA;IAC7C,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAA;IACxB,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,SAAS,CAAA;IAClC,iEAAiE;IACjE,MAAM,SAAS,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;IACpF,IAAI,2BAA2B,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAChD,OAAO,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAA;IAC1F,CAAC;IACD,uEAAuE;IACvE,IAAI,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3F,OAAO,SAAS,CAAC,WAAW,EAAE,CAAA;IAChC,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAA;IACxC,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC,CAAA;AACtF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,OAAgB,EAAE,EAAU;IACzD,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAA;IACvC,IAAI,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAAE,OAAO,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAClD,OAAO,CAAC,GAAG,OAAO,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AACnC,CAAC"}

package/lib/wizard/status.js

@@ -0,0 +1,94 @@
+/**
+ * Wizard status projection (GW-1): declared ingress config + observed
+ * runtime facts → one sanitized JSON shape the browser may see.
+ *
+ * This module is the SECURITY BOUNDARY for everything the wizard surfaces
+ * on `GET /_dsh/zen-remote/admin/wizard/status`. The two properties it must
+ * hold, regardless of what the callers hand it:
+ *
+ *   1. No secret material. The Cloudflare API token and the cloudflared
+ *      tunnel token never enter this module — the runtime side reports only
+ *      `*Configured` booleans (the files live 0600 under
+ *      `<DSH_HOME>/zen-remote-ingress/`, and their contents stay there).
+ *   2. No file paths. The runtime side knows where binaries, token files
+ *      and the Caddyfile live; the projection carries none of it — every
+ *      output field is built from a whitelist below, and input objects are
+ *      never spread through.
+ *
+ * Pure logic on purpose: zero imports, so the check scripts and the tests
+ * can drive it through Node's strip-only type stripping, and the wizard
+ * routes can call it per request without re-resolving anything.
+ *
+ * Every input is coerced defensively. The declared side normally arrives
+ * from `resolveConfig(...).values` (already legal), but the projection is
+ * also the last line of defense for the wire: an off-enum mode answers
+ * `'off'`, a junk port answers the 443 default, a non-string domain answers
+ * `''` — same transparency discipline as the config resolver, applied at
+ * the rendering edge.
+ */
+/** The ingress modes `resolveConfig` can legally produce. */
+export const WIZARD_INGRESS_MODES = ['off', 'caddy', 'external', 'cloudflared'];
+function modeOf(value) {
+    return typeof value === 'string' && WIZARD_INGRESS_MODES.includes(value)
+        ? value
+        : 'off';
+}
+function stringOf(value) {
+    return typeof value === 'string' ? value : '';
+}
+function portOf(value) {
+    return typeof value === 'number' && Number.isInteger(value) && value >= 1 && value <= 65535 ? value : null;
+}
+/**
+ * Project one probe / verification memory down to its three wire fields.
+ * A record without a string `result` is not a memory — it answers null, so
+ * a corrupt runtime entry can never render as a half-valid verdict.
+ */
+function recordOf(input) {
+    if (input === null || input === undefined || typeof input !== 'object')
+        return null;
+    const { result, deviceId, at } = input;
+    if (typeof result !== 'string' || result === '')
+        return null;
+    return {
+        result,
+        deviceId: typeof deviceId === 'string' && deviceId !== '' ? deviceId : null,
+        at: typeof at === 'number' && Number.isFinite(at) ? at : null,
+    };
+}
+/** Project one untrusted-proxy detection down to its two wire fields. */
+function forwardedSourceOf(input) {
+    if (input === null || input === undefined || typeof input !== 'object')
+        return null;
+    const { ip, at } = input;
+    if (typeof ip !== 'string' || ip === '')
+        return null;
+    if (typeof at !== 'number' || !Number.isFinite(at))
+        return null;
+    return { ip, at };
+}
+/**
+ * Build the sanitized wizard status. Both arguments are optional so a
+ * composition can answer before anything is configured; the all-empty
+ * answer is the honest "wizard not started" state (`mode: 'off'`, no ports,
+ * no tokens configured, no memories).
+ */
+export function projectWizardStatus(declared = {}, runtime = {}) {
+    return {
+        ok: true,
+        mode: modeOf(declared.ingressMode),
+        domain: stringOf(declared.ingressDomain),
+        httpsPort: portOf(declared.ingressHttpsPort) ?? 443,
+        publicUrl: stringOf(declared.ingressPublicUrl),
+        cfTokenConfigured: runtime.cfTokenConfigured === true,
+        tunnelTokenConfigured: runtime.tunnelTokenConfigured === true,
+        caddyRunning: runtime.caddyRunning === true,
+        cloudflaredRunning: runtime.cloudflaredRunning === true,
+        gatewayActualPort: portOf(runtime.gatewayActualPort),
+        ...(typeof runtime.lanAddress === 'string' && runtime.lanAddress !== '' ? { lanAddress: runtime.lanAddress } : {}),
+        lastHostProbe: recordOf(runtime.lastHostProbe),
+        lastExternalVerification: recordOf(runtime.lastExternalVerification),
+        lastForwardedSource: forwardedSourceOf(runtime.lastForwardedSource),
+    };
+}
+//# sourceMappingURL=status.js.map

package/lib/wizard/status.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"status.js","sourceRoot":"","sources":["../../src/wizard/status.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,6DAA6D;AAC7D,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,aAAa,CAAU,CAAA;AAuFxF,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAK,oBAA0C,CAAC,QAAQ,CAAC,KAAK,CAAC;QAC7F,CAAC,CAAE,KAA2B;QAC9B,CAAC,CAAC,KAAK,CAAA;AACX,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAA;AAC/C,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;AAC5G,CAAC;AAED;;;;GAIG;AACH,SAAS,QAAQ,CAAC,KAA2C;IAC3D,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IACnF,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAG,KAAK,CAAA;IACtC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,EAAE;QAAE,OAAO,IAAI,CAAA;IAC5D,OAAO;QACL,MAAM;QACN,QAAQ,EAAE,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI;QAC3E,EAAE,EAAE,OAAO,EAAE,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI;KAC9D,CAAA;AACH,CAAC;AAED,yEAAyE;AACzE,SAAS,iBAAiB,CAAC,KAAoD;IAC7E,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IACnF,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,KAAK,CAAA;IACxB,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,IAAI,CAAA;IACpD,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAAE,OAAO,IAAI,CAAA;IAC/D,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,CAAA;AACnB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,WAAgC,EAAE,EAAE,UAA8B,EAAE;IACtG,OAAO;QACL,EAAE,EAAE,IAAI;QACR,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC;QAClC,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC;QACxC,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,GAAG;QACnD,SAAS,EAAE,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QAC9C,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,KAAK,IAAI;QACrD,qBAAqB,EAAE,OAAO,CAAC,qBAAqB,KAAK,IAAI;QAC7D,YAAY,EAAE,OAAO,CAAC,YAAY,KAAK,IAAI;QAC3C,kBAAkB,EAAE,OAAO,CAAC,kBAAkB,KAAK,IAAI;QACvD,iBAAiB,EAAE,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC;QACpD,GAAG,CAAC,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ,IAAI,OAAO,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClH,aAAa,EAAE,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC;QAC9C,wBAAwB,EAAE,QAAQ,CAAC,OAAO,CAAC,wBAAwB,CAAC;QACpE,mBAAmB,EAAE,iBAAiB,CAAC,OAAO,CAAC,mBAAmB,CAAC;KACpE,CAAA;AACH,CAAC"}

package/lib/wizard/token-store.js

@@ -0,0 +1,71 @@
+/**
+ * Wizard token storage (GW-13a): the secrets that must never enter the
+ * plugin row or any wire response live as 0600 files under
+ * `<DSH_HOME>/zen-remote-ingress/`, written through a temp-file rename so
+ * a crash mid-write can never leave a half token at the real path. The
+ * tunnel-token half lives in cloudflared.ts (it is the cloudflared
+ * process's own input); this module owns the shared Cloudflare API token.
+ *
+ * Reads answer presence or hand the raw string ONLY to in-process callers
+ * (the Caddy manager's env) — nothing here is ever logged or serialized
+ * into a response.
+ */
+import { mkdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { ingressDir } from './binary.js';
+/** `<DSH_HOME>/zen-remote-ingress/cf-api-token`. */
+export function cfTokenPath(dshHome) {
+    return join(ingressDir(dshHome), 'cf-api-token');
+}
+/** Atomic 0600 write (temp sibling + rename), with a direct-write fallback
+ * on Windows if an existing file or antivirus scan refuses `renameSync` with
+ * EPERM/EACCES. */
+export function writeCfTokenFile(dshHome, token) {
+    const finalPath = cfTokenPath(dshHome);
+    const partPath = `${finalPath}.part`;
+    try {
+        mkdirSync(ingressDir(dshHome), { recursive: true });
+        writeFileSync(partPath, token, { mode: 0o600 });
+        try {
+            renameSync(partPath, finalPath);
+        }
+        catch {
+            writeFileSync(finalPath, token, { mode: 0o600 });
+            rmSync(partPath, { force: true });
+        }
+    }
+    catch (error) {
+        rmSync(partPath, { force: true });
+        throw error;
+    }
+    return finalPath;
+}
+/** The stored token, or undefined when absent/empty. Callers feed it to the
+ * Caddy manager's environment; it must never reach a response or a log. */
+export function readCfTokenFile(dshHome) {
+    try {
+        const token = readRaw(dshHome);
+        return token.trim() === '' ? undefined : token;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Whether a non-empty token file exists (the projection's boolean only). */
+export function cfTokenConfigured(dshHome) {
+    try {
+        return statSync(cfTokenPath(dshHome)).isFile() && readRaw(dshHome).trim() !== '';
+    }
+    catch {
+        return false;
+    }
+}
+/** Delete the stored token (the DELETE route; callers stop the processes
+ * that consume it first). */
+export function deleteCfTokenFile(dshHome) {
+    rmSync(cfTokenPath(dshHome), { force: true });
+}
+function readRaw(dshHome) {
+    return readFileSync(cfTokenPath(dshHome), 'utf8');
+}
+//# sourceMappingURL=token-store.js.map

package/lib/wizard/token-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-store.js","sourceRoot":"","sources":["../../src/wizard/token-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAC9F,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAExC,oDAAoD;AACpD,MAAM,UAAU,WAAW,CAAC,OAAe;IACzC,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,cAAc,CAAC,CAAA;AAClD,CAAC;AAED;;mBAEmB;AACnB,MAAM,UAAU,gBAAgB,CAAC,OAAe,EAAE,KAAa;IAC7D,MAAM,SAAS,GAAG,WAAW,CAAC,OAAO,CAAC,CAAA;IACtC,MAAM,QAAQ,GAAG,GAAG,SAAS,OAAO,CAAA;IACpC,IAAI,CAAC;QACH,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACnD,aAAa,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QAC/C,IAAI,CAAC;YACH,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,aAAa,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;YAChD,MAAM,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QACnC,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QACjC,MAAM,KAAK,CAAA;IACb,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;2EAC2E;AAC3E,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;QAC9B,OAAO,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAA;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,IAAI,CAAC;QACH,OAAO,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAA;IAClF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED;6BAC6B;AAC7B,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;AAC/C,CAAC;AAED,SAAS,OAAO,CAAC,OAAe;IAC9B,OAAO,YAAY,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAA;AACnD,CAAC"}

package/lib/wizard/tunnel-orchestrator.js

@@ -0,0 +1,155 @@
+/**
+ * Tunnel orchestration (GW-13b, 路 C's autopilot): one call drives the
+ * whole Cloudflare-side setup the design promises — zone/account lookup
+ * (through the ancestor-chain check), tunnel create-or-adopt, ingress
+ * configuration against the gateway's ACTUAL port, the proxied CNAME,
+ * and the cloudflared child.
+ *
+ * Rules the review and the design pin down:
+ *
+ *   - **已有同名隧道**：the first setup pass answers `tunnel-conflict`
+ *     with the same-name list; the UI lets the user pick one and re-runs
+ *     with `tunnelId`, which adopts the existing tunnel through the token
+ *     endpoint instead of creating anything.
+ *   - **模式切换**：starting the tunnel stops the managed Caddy first
+ *     (`stopCaddy`) — never two ingress processes at once.
+ *   - The connector token travels from the Cloudflare answer into the
+ *     0600 token file and the child's `--token-file`; it never reaches a
+ *     response or a log.
+ *   - Every failure is a VALUE with a stable `reason` the UI maps to
+ *     locale copy; CloudflareError codes map losslessly (`cf-*` → the
+ *     orchestration's own reasons), unknown ones degrade to `api`.
+ */
+import { hostOf } from '../config.js';
+import { createCloudflareApi } from './cloudflare.js';
+import { writeTunnelTokenFile } from './cloudflared.js';
+/** The tunnel name the wizard mints and looks for. */
+export const TUNNEL_NAME = 'dsh-zen-remote';
+/** CloudflareError.code → the orchestration's reason vocabulary. */
+function mapCloudflareError(error) {
+    if (error !== null && typeof error === 'object' && 'code' in error) {
+        const code = error.code;
+        const detail = error.message;
+        if (code === 'cf-auth-failed')
+            return { ok: false, reason: 'auth', detail: String(detail ?? '') };
+        if (code === 'cf-network')
+            return { ok: false, reason: 'network', detail: String(detail ?? '') };
+        if (code === 'cf-zone-not-found')
+            return { ok: false, reason: 'zone-not-found' };
+    }
+    return { ok: false, reason: 'api', detail: String(error?.message ?? error) };
+}
+/**
+ * Drive the whole tunnel setup. Throws nothing — every outcome is a value.
+ */
+export async function setupTunnel(options, input) {
+    const token = options.readToken();
+    if (token === undefined || token.trim() === '')
+        return { ok: false, reason: 'no-token' };
+    const host = hostOf(input.domain);
+    if (host === undefined)
+        return { ok: false, reason: 'bad-domain' };
+    const api = options.apiFactory !== undefined
+        ? options.apiFactory(token)
+        : createCloudflareApi({ token, fetchImpl: options.fetchImpl });
+    // Zone + account: the ancestor-chain check answers both in one verdict.
+    let zoneId;
+    let accountId;
+    try {
+        const check = await api.checkDomainOnCloudflare(host);
+        if (!check.onCloudflare || check.zoneId === null || check.accountId === null) {
+            return { ok: false, reason: 'zone-not-found' };
+        }
+        zoneId = check.zoneId;
+        accountId = check.accountId;
+    }
+    catch (error) {
+        return mapCloudflareError(error);
+    }
+    // Tunnel: adopt the user's choice, or create a fresh one — but a fresh
+    // create refuses when same-name tunnels already exist (the UI offers the
+    // list; the re-run carries `tunnelId`).
+    let tunnelId;
+    let tunnelToken;
+    try {
+        if (input.tunnelId !== undefined && input.tunnelId !== '') {
+            tunnelId = input.tunnelId;
+            tunnelToken = await api.getTunnelToken(accountId, tunnelId);
+        }
+        else {
+            const existing = await api.listTunnels(accountId);
+            const sameName = existing.filter((tunnel) => tunnel.name === TUNNEL_NAME);
+            if (sameName.length > 0)
+                return { ok: false, reason: 'tunnel-conflict', existing: sameName };
+            const created = await api.createTunnel(accountId, TUNNEL_NAME);
+            tunnelId = created.id;
+            tunnelToken = created.token;
+        }
+    }
+    catch (error) {
+        return mapCloudflareError(error);
+    }
+    const gatewayPort = await options.gatewayPort();
+    // The ingress mapping: the public hostname serves the local gateway.
+    try {
+        await api.configureIngress(accountId, tunnelId, host, `http://127.0.0.1:${gatewayPort}`);
+    }
+    catch (error) {
+        return mapCloudflareError(error);
+    }
+    // DNS idempotence next (GW-fix-4/M3): an existing CNAME for this name
+    // pointing at the SAME tunnel is a no-op; pointing elsewhere is a real
+    // conflict we refuse instead of silently overwriting.
+    try {
+        const existing = await api.listDnsRecords(zoneId, host);
+        const prior = existing.find((record) => record.name === host);
+        if (prior !== undefined) {
+            const expected = `${tunnelId}.cfargotunnel.com`;
+            if (prior.content !== expected) {
+                return { ok: false, reason: 'dns-conflict', detail: prior.content };
+            }
+        }
+        else {
+            await api.createDnsRecord(zoneId, host, `${tunnelId}.cfargotunnel.com`);
+        }
+    }
+    catch (error) {
+        return mapCloudflareError(error);
+    }
+    // L1: the Cloudflare half is DONE — only now stop the managed Caddy and
+    // start the tunnel, so a failed API call leaves the old path untouched.
+    options.cloudflared.stopCaddy();
+    // Connector secret → 0600 file → child.
+    let tokenFile;
+    try {
+        tokenFile = writeTunnelTokenFile(options.dshHome, tunnelToken);
+    }
+    catch (error) {
+        return { ok: false, reason: 'spawn-failed', detail: String(error?.message ?? error) };
+    }
+    const started = await options.cloudflared.start({ tunnelToken });
+    if (!started.ok) {
+        return { ok: false, reason: 'spawn-failed', detail: started.error };
+    }
+    return { ok: true, tunnelId, publicUrl: `https://${host}`, tokenFile };
+}
+export async function checkDomainOnCloudflare(options, domain) {
+    const token = options.readToken();
+    if (token === undefined || token.trim() === '')
+        return { ok: false, reason: 'no-token' };
+    const host = hostOf(domain);
+    if (host === undefined)
+        return { ok: false, reason: 'bad-domain' };
+    const api = options.apiFactory !== undefined
+        ? options.apiFactory(token)
+        : createCloudflareApi({ token, fetchImpl: options.fetchImpl });
+    try {
+        const check = await api.checkDomainOnCloudflare(host);
+        return { ok: true, onCloudflare: check.onCloudflare, zoneId: check.zoneId, accountId: check.accountId };
+    }
+    catch (error) {
+        const mapped = mapCloudflareError(error);
+        return { ok: false, reason: mapped.reason === 'auth' ? 'auth' : mapped.reason === 'network' ? 'network' : 'api', detail: mapped.detail };
+    }
+}
+//# sourceMappingURL=tunnel-orchestrator.js.map

package/lib/wizard/tunnel-orchestrator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tunnel-orchestrator.js","sourceRoot":"","sources":["../../src/wizard/tunnel-orchestrator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AACrC,OAAO,EAAE,mBAAmB,EAAoD,MAAM,iBAAiB,CAAA;AACvG,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAA;AAEvD,sDAAsD;AACtD,MAAM,CAAC,MAAM,WAAW,GAAG,gBAAgB,CAAA;AAwC3C,oEAAoE;AACpE,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAI,KAAK,EAAE,CAAC;QACnE,MAAM,IAAI,GAAI,KAA4B,CAAC,IAAI,CAAA;QAC/C,MAAM,MAAM,GAAI,KAA+B,CAAC,OAAO,CAAA;QACvD,IAAI,IAAI,KAAK,gBAAgB;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAA;QACjG,IAAI,IAAI,KAAK,YAAY;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAA;QAChG,IAAI,IAAI,KAAK,mBAAmB;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAA;IAClF,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAE,KAAe,EAAE,OAAO,IAAI,KAAK,CAAC,EAAE,CAAA;AACzF,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAkC,EAAE,KAAuB;IAC3F,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,EAAE,CAAA;IACjC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAA;IACxF,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IACjC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,CAAA;IAElE,MAAM,GAAG,GAAkB,OAAO,CAAC,UAAU,KAAK,SAAS;QACzD,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC;QAC3B,CAAC,CAAC,mBAAmB,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAA;IAEhE,wEAAwE;IACxE,IAAI,MAAc,CAAA;IAClB,IAAI,SAAiB,CAAA;IACrB,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAA;QACrD,IAAI,CAAC,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YAC7E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAA;QAChD,CAAC;QACD,MAAM,GAAG,KAAK,CAAC,MAAM,CAAA;QACrB,SAAS,GAAG,KAAK,CAAC,SAAS,CAAA;IAC7B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAA;IAClC,CAAC;IAED,uEAAuE;IACvE,yEAAyE;IACzE,wCAAwC;IACxC,IAAI,QAAgB,CAAA;IACpB,IAAI,WAAmB,CAAA;IACvB,IAAI,CAAC;QACH,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,KAAK,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;YAC1D,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAA;YACzB,WAAW,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;QAC7D,CAAC;aAAM,CAAC;YACN,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC,CAAA;YACjD,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,WAAW,CAAC,CAAA;YACzE,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAA;YAC5F,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,YAAY,CAAC,SAAS,EAAE,WAAW,CAAC,CAAA;YAC9D,QAAQ,GAAG,OAAO,CAAC,EAAE,CAAA;YACrB,WAAW,GAAG,OAAO,CAAC,KAAK,CAAA;QAC7B,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAA;IAClC,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,WAAW,EAAE,CAAA;IAE/C,qEAAqE;IACrE,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,gBAAgB,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,oBAAoB,WAAW,EAAE,CAAC,CAAA;IAC1F,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAA;IAClC,CAAC;IAED,sEAAsE;IACtE,uEAAuE;IACvE,sDAAsD;IACtD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;QACvD,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC,CAAA;QAC7D,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,QAAQ,GAAG,GAAG,QAAQ,mBAAmB,CAAA;YAC/C,IAAI,KAAK,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAC/B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,CAAA;YACrE,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,CAAC,eAAe,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,QAAQ,mBAAmB,CAAC,CAAA;QACzE,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAA;IAClC,CAAC;IAED,wEAAwE;IACxE,wEAAwE;IACxE,OAAO,CAAC,WAAW,CAAC,SAAS,EAAE,CAAA;IAE/B,wCAAwC;IACxC,IAAI,SAAiB,CAAA;IACrB,IAAI,CAAC;QACH,SAAS,GAAG,oBAAoB,CAAC,OAAO,CAAC,OAAO,EAAE,WAAW,CAAC,CAAA;IAChE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,CAAE,KAAe,EAAE,OAAO,IAAI,KAAK,CAAC,EAAE,CAAA;IAClG,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,CAAC,CAAA;IAChE,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,OAAO,CAAC,KAAK,EAAE,CAAA;IACrE,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,IAAI,EAAE,EAAE,SAAS,EAAE,CAAA;AACxE,CAAC;AAUD,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,OAAkF,EAAE,MAAc;IAC9I,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,EAAE,CAAA;IACjC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAA;IACxF,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAA;IAC3B,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,CAAA;IAClE,MAAM,GAAG,GAAkB,OAAO,CAAC,UAAU,KAAK,SAAS;QACzD,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC;QAC3B,CAAC,CAAC,mBAAmB,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAA;IAChE,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAA;QACrD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAA;IACzG,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAA;QACxC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAA;IAC1I,CAAC;AACH,CAAC"}

package/lib/wizard/verify.js

@@ -0,0 +1,171 @@
+/**
+ * Final-verification orchestration (GW-9): the wizard's last mile, where
+ * 「完成」 means a real phone really paired through the real public URL —
+ * never a green light from internal checks alone (设计: 不做已联通的假绿灯).
+ *
+ * The flow, spread over two entry points the UI drives:
+ *
+ *   start({ publicUrl }): runtime ready? → walk the public URL
+ *   (GW-8's probe; BOTH the pairing page and the admin-403 shape must be
+ *   right) → snapshot the gateway's device ids (the baseline) → mint a WEB
+ *   pairing code → remember the session IN MEMORY and answer with the
+ *   code, the URL and the expiry. The code never touches the row config,
+ *   and minting it restarts nothing — trustedProxies changes are what
+ *   restart the gateway, and any such change invalidates the session
+ *   instead (the config fingerprint below).
+ *
+ *   check(): re-read the gateway status. A device id the baseline did not
+ *   have is a freshly paired phone; the gateway's lastWebClaim record must
+ *   name THAT device with secure === true (the proxy passed
+ *   X-Forwarded-Proto: https through, so the issued cookie carries the
+ *   Secure flag). All green → pass. The claim recorded an insecure cookie →
+ *   cookie-insecure. Past the code's expiry → code-expired. Anything else →
+ *   pending, keep polling.
+ *
+ * The session binds to a CONFIG FINGERPRINT (ingressMode, domain,
+ * httpsPort, publicUrl, the gateway's ACTUAL port, host, trustedProxies):
+ * any of those moving between start and check answers stale and discards
+ * the session, because the verification proved a URL that no longer exists.
+ * The session is deliberately memory-only — a row reload (which a
+ * trustedProxies change causes) builds a fresh manager and the session is
+ * gone, exactly the same verdict the fingerprint would have produced.
+ */
+import { normalizeServerUrl } from '../client-pairing.js';
+import { probeHostPath } from './probe.js';
+/**
+ * The config fingerprint a session binds to: any drift between start and
+ * check means the verified URL is no longer the deployed URL.
+ */
+export function verificationFingerprint(values, gatewayPort) {
+    return JSON.stringify({
+        ingressMode: values.ingressMode,
+        ingressDomain: values.ingressDomain,
+        ingressHttpsPort: values.ingressHttpsPort,
+        ingressPublicUrl: values.ingressPublicUrl,
+        gatewayPort,
+        host: values.host,
+        trustedProxies: values.trustedProxies,
+    });
+}
+export function createVerificationManager(options) {
+    const fetchImpl = options.fetchImpl ?? fetch;
+    const timeoutMs = options.timeoutMs ?? 5000;
+    const now = options.now ?? Date.now;
+    let session = null;
+    /** One loopback gateway call AS the local machine. Answer status+body or
+     * null on any failure — every caller degrades, none throws. */
+    const callGateway = async (method, path, payload) => {
+        try {
+            const response = await fetchImpl(`${options.gatewayBase}${path}`, {
+                method,
+                headers: payload === undefined ? undefined : { 'Content-Type': 'application/json' },
+                ...(payload === undefined ? {} : { body: JSON.stringify(payload) }),
+                signal: AbortSignal.timeout(timeoutMs),
+            });
+            const body = await response.json();
+            return { status: response.status, body };
+        }
+        catch {
+            return null;
+        }
+    };
+    const readStatus = async () => {
+        const reply = await callGateway('GET', '/lan-gate/status');
+        if (reply === null || reply.status < 200 || reply.status >= 300)
+            return null;
+        const body = reply.body;
+        if (body === null || typeof body !== 'object')
+            return null;
+        const deviceIds = Array.isArray(body.devices)
+            ? body.devices.map((device) => (device !== null && typeof device === 'object' ? device.id : undefined))
+                .filter((id) => typeof id === 'string')
+            : [];
+        const port = typeof body.port === 'number' ? body.port : null;
+        const claim = body.lastWebClaim;
+        const lastWebClaim = claim !== null && typeof claim === 'object'
+            ? {
+                id: typeof claim.id === 'string' ? claim.id : '',
+                secure: claim.secure === true,
+                at: typeof claim.at === 'number' ? claim.at : 0,
+            }
+            : null;
+        return { deviceIds, port, lastWebClaim };
+    };
+    return {
+        async start({ publicUrl, probeOnly }) {
+            if (typeof publicUrl !== 'string' || publicUrl.trim() === '')
+                return { ok: false, reason: 'no-public-url' };
+            // Same admission as the probe: https anywhere, plain http only into
+            // the private-network allowances. The URL the phone will open must
+            // be one this machine is willing to verify at all.
+            const normalized = normalizeServerUrl(publicUrl);
+            if (!normalized.ok)
+                return { ok: false, reason: 'bad-public-url', detail: normalized.reason };
+            if ((await options.runtimeReady?.()) === false)
+                return { ok: false, reason: 'runtime-not-ready' };
+            const statusBefore = await readStatus();
+            if (statusBefore === null)
+                return { ok: false, reason: 'gateway-unreachable' };
+            const outcome = await (options.probe ?? probeHostPath)(normalized.url);
+            if (outcome.kind !== 'reached' || outcome.root !== 'gateway-pairing-page' || outcome.admin !== 'gateway-admin-403') {
+                return { ok: false, reason: 'probe-failed', detail: outcome };
+            }
+            if (probeOnly === true) {
+                return { ok: true, pairingCode: '', publicUrl: normalized.url, expiresAt: 0 };
+            }
+            const pair = await callGateway('POST', '/lan-gate/pair', { role: 'web' });
+            const pairBody = pair?.body;
+            if (pair === null || pair.status < 200 || pair.status >= 300 || pairBody?.ok !== true || typeof pairBody.code !== 'string' || typeof pairBody.expiresAt !== 'number') {
+                return { ok: false, reason: 'pair-refused', detail: pair === null ? null : pair.status };
+            }
+            session = {
+                publicUrl: normalized.url,
+                code: pairBody.code,
+                expiresAt: pairBody.expiresAt,
+                knownDeviceIds: new Set(statusBefore.deviceIds),
+                fingerprint: verificationFingerprint(options.getValues(), statusBefore.port),
+            };
+            return { ok: true, pairingCode: session.code, publicUrl: session.publicUrl, expiresAt: session.expiresAt };
+        },
+        async check() {
+            if (session === null)
+                return { result: 'not-started' };
+            const status = await readStatus();
+            if (status === null)
+                return { result: 'pending' };
+            // The verified URL must still BE the deployed URL: a config or
+            // gateway-port drift discards the session outright.
+            if (verificationFingerprint(options.getValues(), status.port) !== session.fingerprint) {
+                session = null;
+                return { result: 'stale' };
+            }
+            // New devices first, expiry second: the claim itself proves the code
+            // was still valid when it was redeemed, so a poll that lands moments
+            // past the expiry must not swallow a pass.
+            const newcomers = status.deviceIds.filter((id) => !session.knownDeviceIds.has(id));
+            if (newcomers.length > 0) {
+                const deviceId = newcomers[newcomers.length - 1];
+                const claim = status.lastWebClaim;
+                if (claim !== null && claim.id === deviceId) {
+                    const isHttps = session.publicUrl.startsWith('https://');
+                    session = null;
+                    // Plain http:// LAN/Tailscale pairing does not sit behind a TLS
+                    // reverse proxy and intentionally issues a non-Secure cookie.
+                    if (isHttps && !claim.secure)
+                        return { result: 'cookie-insecure', deviceId };
+                    return { result: 'pass', deviceId, at: claim.at };
+                }
+                // A claim record that has not surfaced (or names a different,
+                // later claim): keep polling rather than bless an unverified cookie.
+                return { result: 'pending' };
+            }
+            if (now() >= session.expiresAt) {
+                session = null;
+                return { result: 'code-expired' };
+            }
+            return { result: 'pending' };
+        },
+        hasSession: () => session !== null,
+    };
+}
+//# sourceMappingURL=verify.js.map

package/lib/wizard/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../src/wizard/verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAGH,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AACzD,OAAO,EAAE,aAAa,EAAwB,MAAM,YAAY,CAAA;AA8ChE;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAAuB,EAAE,WAA0B;IACzF,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,WAAW;QACX,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,cAAc,EAAE,MAAM,CAAC,cAAc;KACtC,CAAC,CAAA;AACJ,CAAC;AAmBD,MAAM,UAAU,yBAAyB,CAAC,OAAmC;IAC3E,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAA;IAC5C,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,CAAA;IAC3C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAA;IACnC,IAAI,OAAO,GAA+B,IAAI,CAAA;IAE9C;mEAC+D;IAC/D,MAAM,WAAW,GAAG,KAAK,EAAE,MAAsB,EAAE,IAAY,EAAE,OAAiB,EAAqD,EAAE;QACvI,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,EAAE,EAAE;gBAChE,MAAM;gBACN,OAAO,EAAE,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBACnF,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;gBACnE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;aACvC,CAAC,CAAA;YACF,MAAM,IAAI,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;YAC3C,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,CAAA;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC,CAAA;IAED,MAAM,UAAU,GAAG,KAAK,IAAuC,EAAE;QAC/D,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAA;QAC1D,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG;YAAE,OAAO,IAAI,CAAA;QAC5E,MAAM,IAAI,GAAG,KAAK,CAAC,IAAqE,CAAA;QACxF,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAA;QAC1D,MAAM,SAAS,GAAa,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;YACrD,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAE,MAA2B,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;iBACxH,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,OAAO,EAAE,KAAK,QAAQ,CAAC;YACzD,CAAC,CAAC,EAAE,CAAA;QACN,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAA;QAC7D,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAA;QAC/B,MAAM,YAAY,GAAG,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;YAC9D,CAAC,CAAC;gBACE,EAAE,EAAE,OAAQ,KAA0B,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAE,KAAwB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE;gBAC1F,MAAM,EAAG,KAA8B,CAAC,MAAM,KAAK,IAAI;gBACvD,EAAE,EAAE,OAAQ,KAA0B,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAE,KAAwB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;aAC1F;YACH,CAAC,CAAC,IAAI,CAAA;QACR,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,CAAA;IAC1C,CAAC,CAAA;IAED,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE;YAClC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAA;YAC3G,oEAAoE;YACpE,mEAAmE;YACnE,mDAAmD;YACnD,MAAM,UAAU,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAA;YAChD,IAAI,CAAC,UAAU,CAAC,EAAE;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAA;YAE7F,IAAI,CAAC,MAAM,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,KAAK,KAAK;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAA;YAEjG,MAAM,YAAY,GAAG,MAAM,UAAU,EAAE,CAAA;YACvC,IAAI,YAAY,KAAK,IAAI;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAA;YAE9E,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,aAAa,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;YACtE,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,KAAK,sBAAsB,IAAI,OAAO,CAAC,KAAK,KAAK,mBAAmB,EAAE,CAAC;gBACnH,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,CAAA;YAC/D,CAAC;YAED,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;gBACvB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,SAAS,EAAE,UAAU,CAAC,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,CAAA;YAC/E,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE,gBAAgB,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;YACzE,MAAM,QAAQ,GAAG,IAAI,EAAE,IAAyE,CAAA;YAChG,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,EAAE,EAAE,KAAK,IAAI,IAAI,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,QAAQ,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;gBACrK,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,CAAA;YAC1F,CAAC;YAED,OAAO,GAAG;gBACR,SAAS,EAAE,UAAU,CAAC,GAAG;gBACzB,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,SAAS,EAAE,QAAQ,CAAC,SAAS;gBAC7B,cAAc,EAAE,IAAI,GAAG,CAAC,YAAY,CAAC,SAAS,CAAC;gBAC/C,WAAW,EAAE,uBAAuB,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,YAAY,CAAC,IAAI,CAAC;aAC7E,CAAA;YACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAA;QAC5G,CAAC;QAED,KAAK,CAAC,KAAK;YACT,IAAI,OAAO,KAAK,IAAI;gBAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAA;YACtD,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAA;YACjC,IAAI,MAAM,KAAK,IAAI;gBAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;YACjD,+DAA+D;YAC/D,oDAAoD;YACpD,IAAI,uBAAuB,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,WAAW,EAAE,CAAC;gBACtF,OAAO,GAAG,IAAI,CAAA;gBACd,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAA;YAC5B,CAAC;YACD,qEAAqE;YACrE,qEAAqE;YACrE,2CAA2C;YAC3C,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAQ,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;YACnF,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACzB,MAAM,QAAQ,GAAG,SAAS,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;gBAChD,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,CAAA;gBACjC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;oBAC5C,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,UAAU,CAAC,UAAU,CAAC,CAAA;oBACxD,OAAO,GAAG,IAAI,CAAA;oBACd,gEAAgE;oBAChE,8DAA8D;oBAC9D,IAAI,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM;wBAAE,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,QAAQ,EAAE,CAAA;oBAC5E,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAA;gBACnD,CAAC;gBACD,8DAA8D;gBAC9D,qEAAqE;gBACrE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;YAC9B,CAAC;YACD,IAAI,GAAG,EAAE,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;gBAC/B,OAAO,GAAG,IAAI,CAAA;gBACd,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAA;YACnC,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;QAC9B,CAAC;QAED,UAAU,EAAE,GAAG,EAAE,CAAC,OAAO,KAAK,IAAI;KACnC,CAAA;AACH,CAAC"}