dsh-zen-remote 2.2.9 → 2.3.2

package/lib/types/wizard/cloudflare.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudflare.d.ts","sourceRoot":"","sources":["../../../src/wizard/cloudflare.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAIH,eAAO,MAAM,mBAAmB,yCAAyC,CAAA;AAEzE,MAAM,MAAM,mBAAmB,GAC3B,gBAAgB,GAChB,mBAAmB,GACnB,oBAAoB,GACpB,iBAAiB,GACjB,YAAY,GACZ,QAAQ,CAAA;AAEZ;;;GAGG;AACH,qBAAa,eAAgB,SAAQ,KAAK;IACxC,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAA;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,0EAA0E;IAC1E,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;gBAExB,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAE,MAAM,GAAG,IAAW,EAAE,QAAQ,GAAE,SAAS,MAAM,EAAO,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAOtJ;AA8BD,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;IACxB,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,CAAA;CACf;AAED,yEAAyE;AACzE,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,qBAAqB;IACpC,YAAY,EAAE,OAAO,CAAA;IACrB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CACzB;AAED,MAAM,WAAW,aAAa;IAC5B,0CAA0C;IAC1C,YAAY,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;IACjC,0EAA0E;IAC1E,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IAC3D,mFAAmF;IACnF,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACrF,sEAAsE;IACtE,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAAA;IAClE,4EAA4E;IAC5E,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IACpE,8EAA8E;IAC9E,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACxG,uEAAuE;IACvE,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IACnF,yEAAyE;IACzE,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAAA;IAC5E;;8BAE0B;IAC1B,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAA;CACxE;AAkBD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAKtD;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,oBAAoB,GAAG,aAAa,CAwMhF;AAID,KAAK,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,oBAAoB,EAAE,WAAW,GAAG,SAAS,CAAC,CAAC,CAAA;AAEjF,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAErF;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAEjH;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAE3I;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAExH;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAE1H;AAED,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,IAAI,CAAC,EAAE,aAAa,GACnB,OAAO,CAAC,IAAI,CAAC,CAEf;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAEzI;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAElI;AAED,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAE7H"}

package/lib/types/wizard/cloudflared.d.ts

@@ -0,0 +1,71 @@
+/**
+ * cloudflared process lifecycle (GW-7, 路 C's last mile). The tunnel's
+ * connector runs in the foreground (`tunnel run`) as a child of the DSH
+ * host, managed through the same subprocess service as the gateway child
+ * and the managed Caddy.
+ *
+ * The connector secret NEVER touches argv (visible to every process on
+ * the machine via ps) and is never an environment variable either — it is
+ * written to `<DSH_HOME>/zen-remote-ingress/tunnel-token`, mode 0600,
+ * through a temp-file-then-rename so a crash mid-write can never leave a
+ * half token at the real path, and handed to cloudflared with
+ * `--token-file`.
+ *
+ * Idempotency and cleanup mirror caddy-process.ts: a live child refuses a
+ * second start (stop first to switch tunnels), stop is idempotent, and an
+ * exited child clears its own slot. The host wiring hands stop to
+ * ctx.effect so the row's disposal kills cloudflared too.
+ */
+import { type DownloadProgress } from './binary-io.js';
+import { type BinaryPlatform } from './binary.js';
+import type { SubprocessServiceLike } from './caddy-process.js';
+/** Where the connector secret lives (design.md: 不进 Config 的字段). */
+export declare function tunnelTokenPath(dshHome: string): string;
+/** Whether a non-empty tunnel-token file exists (the projection's boolean
+ * only — GW-fix-4/M1: the manager's EXISTENCE says nothing about whether a
+ * token has been stored). */
+export declare function tunnelTokenConfigured(dshHome: string): boolean;
+/**
+ * Persist the tunnel connector secret: 0600, atomic (write the `.part`
+ * sibling, then rename over the real path).
+ */
+export declare function writeTunnelTokenFile(dshHome: string, token: string): string;
+export interface CloudflaredManagerOptions {
+    /** The host's subprocess service (ctx.subprocess). */
+    subprocess: SubprocessServiceLike;
+    /** `<DSH_HOME>` — the binary and the token file live under it. */
+    dshHome: string;
+    /** Injected transport for the one-time binary download (tests). */
+    fetchImpl?: typeof fetch;
+    /** Forced platform mapping (tests). */
+    platform?: BinaryPlatform;
+    /** Download progress relay (bytes, declared total or null). */
+    onProgress?: DownloadProgress;
+    /** Stdio byte caps for the child, both streams. Default 64 KiB. */
+    maxLogBytes?: number;
+}
+export type CloudflaredStartResult = {
+    ok: true;
+    binaryPath: string;
+    tokenFile: string;
+    alreadyRunning: false;
+} | {
+    ok: false;
+    error: 'already-running' | 'missing-token' | 'download-failed' | 'spawn-failed';
+    detail?: string;
+    installUrl?: string;
+};
+export interface CloudflaredManager {
+    /** Idempotent front door: a live cloudflared refuses a second start. */
+    start(input: {
+        tunnelToken: unknown;
+    }): Promise<CloudflaredStartResult>;
+    /** Idempotent terminate; safe before any start. */
+    stop(): void;
+    /** Whether a child is currently held. */
+    isRunning(): boolean;
+    /** Whether any start has succeeded in this manager's lifetime. */
+    hasStarted(): boolean;
+}
+export declare function createCloudflaredManager(options: CloudflaredManagerOptions): CloudflaredManager;
+//# sourceMappingURL=cloudflared.d.ts.map

package/lib/types/wizard/cloudflared.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudflared.d.ts","sourceRoot":"","sources":["../../../src/wizard/cloudflared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAIH,OAAO,EAAqC,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AACzF,OAAO,EAAc,KAAK,cAAc,EAAE,MAAM,aAAa,CAAA;AAC7D,OAAO,KAAK,EAAE,qBAAqB,EAAwB,MAAM,oBAAoB,CAAA;AAErF,mEAAmE;AACnE,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED;;6BAE6B;AAC7B,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAM9D;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAiB3E;AAED,MAAM,WAAW,yBAAyB;IACxC,sDAAsD;IACtD,UAAU,EAAE,qBAAqB,CAAA;IACjC,kEAAkE;IAClE,OAAO,EAAE,MAAM,CAAA;IACf,mEAAmE;IACnE,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;IACxB,uCAAuC;IACvC,QAAQ,CAAC,EAAE,cAAc,CAAA;IACzB,+DAA+D;IAC/D,UAAU,CAAC,EAAE,gBAAgB,CAAA;IAC7B,mEAAmE;IACnE,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,MAAM,sBAAsB,GAC9B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,KAAK,CAAA;CAAE,GAC1E;IACA,EAAE,EAAE,KAAK,CAAA;IACT,KAAK,EAAE,iBAAiB,GAAG,eAAe,GAAG,iBAAiB,GAAG,cAAc,CAAA;IAC/E,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB,CAAA;AAEH,MAAM,WAAW,kBAAkB;IACjC,wEAAwE;IACxE,KAAK,CAAC,KAAK,EAAE;QAAE,WAAW,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAA;IACvE,mDAAmD;IACnD,IAAI,IAAI,IAAI,CAAA;IACZ,yCAAyC;IACzC,SAAS,IAAI,OAAO,CAAA;IACpB,kEAAkE;IAClE,UAAU,IAAI,OAAO,CAAA;CACtB;AAED,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,yBAAyB,GAAG,kBAAkB,CAgG/F"}

package/lib/types/wizard/probe.d.ts

@@ -0,0 +1,66 @@
+/**
+ * hostPath probe (GW-8): the server machine walks its OWN public URL and
+ * classifies what answers, so the wizard can say something sharper than
+ * "it didn't work" — the pairing page showing up means TLS + proxying to
+ * the gateway both work; the admin surface answering 200 means the proxy
+ * is DROPPING the forwarded headers the gateway trusts; a redirect smells
+ * like Cloudflare Access or a proxy rewriting to a login page.
+ *
+ * Split exactly as the ticket asks: the two `classify*Response` functions
+ * are pure (the check scripts can drive them), `probeHostPath` owns the
+ * fetch I/O — `redirect: 'manual'` so a proxy's 3xx is SEEN, never
+ * followed — with the URL admission reusing client-pairing's
+ * `normalizeServerUrl` (https anywhere; plain http only for the explicit
+ * private-network allowances) and a 10 s ceiling per request.
+ */
+/** What answered on `GET <publicUrl>/`. */
+export type RootClassification = 'gateway-pairing-page' | 'unexpected-401' | 'unexpected-200' | 'redirect' | 'unexpected';
+/** What answered on `GET <publicUrl>/lan-gate/admin`. */
+export type AdminClassification = 'gateway-admin-403' | 'admin-exposed' | 'proxy-403' | 'unexpected';
+/**
+ * `GET /`: the ONE right answer is the gateway's pairing page — 401,
+ * text/html, carrying the claim-endpoint marker the page's own script
+ * posts to. A 200 means the URL belongs to something else entirely.
+ */
+export declare function classifyRootResponse(status: number, contentType: string, body: string): RootClassification;
+/**
+ * `GET /lan-gate/admin`: right is the gateway's own 403 JSON — a public
+ * visitor must not get in. 200 + HTML is the DANGEROUS shape: something
+ * answered with a page, meaning the proxy forwarded without the
+ * forwarded headers and the gateway's local-only wall never saw a
+ * proxied request (the admin page leaked). 403 + HTML smells like
+ * Cloudflare Access interposing its own login.
+ */
+export declare function classifyAdminResponse(status: number, contentType: string, body: string): AdminClassification;
+export interface HostPathReached {
+    kind: 'reached';
+    root: RootClassification;
+    admin: AdminClassification;
+    /** Wall-clock cost of both requests, milliseconds. */
+    ms: number;
+}
+export interface HostPathUnreachable {
+    kind: 'unreachable';
+    /** `invalid-url` / `insecure-http` — the URL never stood a chance;
+     * `timeout` — the 10 s ceiling fired; `network` — DNS, refused, reset. */
+    reason: 'invalid-url' | 'insecure-http' | 'timeout' | 'network';
+    detail?: string;
+    ms: number;
+}
+export type HostPathOutcome = HostPathReached | HostPathUnreachable;
+export interface ProbeOptions {
+    fetchImpl?: typeof fetch;
+    /** Per-request ceiling. Default 10 000 ms (the ticket's value). */
+    timeoutMs?: number;
+    /** Clock for the `ms` measurement (tests). */
+    now?: () => number;
+}
+/**
+ * Probe the machine's public URL from here: both the root path and the
+ * admin surface, never following a redirect. The two requests run
+ * concurrently; the answer carries both classifications and the elapsed
+ * time. Every failure mode is a VALUE (`kind: 'unreachable'`), never a
+ * throw — the wizard routes render whichever verdict arrived.
+ */
+export declare function probeHostPath(publicUrl: unknown, options?: ProbeOptions): Promise<HostPathOutcome>;
+//# sourceMappingURL=probe.d.ts.map

package/lib/types/wizard/probe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"probe.d.ts","sourceRoot":"","sources":["../../../src/wizard/probe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAIH,2CAA2C;AAC3C,MAAM,MAAM,kBAAkB,GAC1B,sBAAsB,GACtB,gBAAgB,GAChB,gBAAgB,GAChB,UAAU,GACV,YAAY,CAAA;AAEhB,yDAAyD;AACzD,MAAM,MAAM,mBAAmB,GAC3B,mBAAmB,GACnB,eAAe,GACf,WAAW,GACX,YAAY,CAAA;AAEhB;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,kBAAkB,CAQ1G;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,mBAAmB,CAkB5G;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,SAAS,CAAA;IACf,IAAI,EAAE,kBAAkB,CAAA;IACxB,KAAK,EAAE,mBAAmB,CAAA;IAC1B,sDAAsD;IACtD,EAAE,EAAE,MAAM,CAAA;CACX;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,aAAa,CAAA;IACnB;8EAC0E;IAC1E,MAAM,EAAE,aAAa,GAAG,eAAe,GAAG,SAAS,GAAG,SAAS,CAAA;IAC/D,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,EAAE,EAAE,MAAM,CAAA;CACX;AAED,MAAM,MAAM,eAAe,GAAG,eAAe,GAAG,mBAAmB,CAAA;AAEnE,MAAM,WAAW,YAAY;IAC3B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;IACxB,mEAAmE;IACnE,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,8CAA8C;IAC9C,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CACnB;AAqBD;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,SAAS,EAAE,OAAO,EAAE,OAAO,GAAE,YAAiB,GAAG,OAAO,CAAC,eAAe,CAAC,CA+B5G"}

package/lib/types/wizard/proxy-snippets.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Reverse-proxy configuration snippets (GW-5, 路 B) — for the user who
+ * ALREADY runs their own proxy, the wizard hands out copy-paste material
+ * instead of managing a process. Everything here is pure text generation:
+ * every interpolated value passes a charset gate (the domain through
+ * config.ts's `hostOf`, the upstream host likewise, the port in [1,
+ * 65535]), so a hostile form value cannot smuggle a directive into
+ * anyone's nginx.
+ *
+ * The upstream port is the gateway's ACTUAL port — the caller reads it
+ * from the running gateway (it may have retried past the configured one),
+ * never from config.
+ */
+export type SnippetResult = {
+    ok: true;
+    text: string;
+} | {
+    ok: false;
+    error: 'bad-domain' | 'bad-upstream-host' | 'bad-upstream-port';
+};
+export interface SnippetInput {
+    /** Public domain the proxy terminates TLS for (bare hostname). */
+    domain: unknown;
+    /** Where the gateway listens — a hostname or IP literal (e.g. the
+     * loopback default). */
+    upstreamHost: unknown;
+    /** The gateway's ACTUAL port. */
+    upstreamPort: unknown;
+}
+/**
+ * nginx: a complete server block. The WebSocket upgrade map sits outside
+ * the server (http-level context) — the snippet says so in a comment, the
+ * user pastes it into the http/server scope their setup offers. Long
+ * idle tunnels need the 3600s read/send timeouts, uploads the 128m
+ * client body cap, and streaming the buffering switch — all three are
+ * the shapes DSH's relay traffic actually needs.
+ */
+export declare function nginxSnippet(input: SnippetInput): SnippetResult;
+/**
+ * Caddy (user-operated, not the wizard-managed one): the site block is
+ * one `reverse_proxy` line — Caddy routes the rest itself.
+ */
+export declare function caddySnippet(input: SnippetInput): SnippetResult;
+export type StepsResult = {
+    ok: true;
+    steps: string[];
+} | {
+    ok: false;
+    error: 'bad-upstream-host' | 'bad-upstream-port';
+};
+/**
+ * Lucky (Web 服务反代) three steps: listen 443, proxy to the upstream,
+ * flip the catch-all switch. Text only — Lucky has no config file format
+ * to generate.
+ */
+export declare function luckySteps(input: {
+    upstreamHost: unknown;
+    upstreamPort: unknown;
+}): StepsResult;
+//# sourceMappingURL=proxy-snippets.d.ts.map

package/lib/types/wizard/proxy-snippets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy-snippets.d.ts","sourceRoot":"","sources":["../../../src/wizard/proxy-snippets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,MAAM,MAAM,aAAa,GACrB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC1B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,YAAY,GAAG,mBAAmB,GAAG,mBAAmB,CAAA;CAAE,CAAA;AAElF,MAAM,WAAW,YAAY;IAC3B,kEAAkE;IAClE,MAAM,EAAE,OAAO,CAAA;IACf;4BACwB;IACxB,YAAY,EAAE,OAAO,CAAA;IACrB,iCAAiC;IACjC,YAAY,EAAE,OAAO,CAAA;CACtB;AAiBD;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,YAAY,GAAG,aAAa,CAiC/D;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,YAAY,GAAG,aAAa,CAW/D;AAED,MAAM,MAAM,WAAW,GACnB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,GAC7B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,mBAAmB,GAAG,mBAAmB,CAAA;CAAE,CAAA;AAEnE;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE;IAAE,YAAY,EAAE,OAAO,CAAC;IAAC,YAAY,EAAE,OAAO,CAAA;CAAE,GAAG,WAAW,CAa/F"}

package/lib/types/wizard/routes.d.ts

@@ -0,0 +1,152 @@
+/**
+ * Wizard route skeleton (GW-4, extended by GW-5): every
+ * `/_dsh/zen-remote/admin/wizard/*` route the gateway wizard serves, with
+ * the security walls applied to ALL of them, in this order:
+ *
+ *   1. `connection.admit` — webServer-registered routes skip DSH's `/api`
+ *      authentication, so each request asks the connection service first;
+ *      its rejection is relayed verbatim (401/403).
+ *   2. The gateway marker. A request wearing `x-zen-remote-via` came
+ *      THROUGH the gateway from a remote device. Unlike the admin status
+ *      route there is no read-only exception: the wizard is a server-owner
+ *      surface, and a remote device gets a flat 403 `via-gateway` — GET
+ *      included. The marker wall runs BEFORE same-origin because a
+ *      forwarded request presents as same-origin (the gateway rewrites
+ *      Origin/Host onto the upstream origin); the marker is the only thing
+ *      identifying it.
+ *   3. `sameOriginPost` for every POST.
+ *
+ * Real routes: `GET /wizard/status` (the sanitized projection from
+ * status.ts — reads only, never mutates) and, since GW-5, `POST
+ * /wizard/trust-proxy` (merge one detected proxy IP into the persisted
+ * `trustedProxies` list). Every other POST under the prefix is a 501
+ * placeholder; later tasks fill those in. GET /status answers from a
+ * per-request config resolution and the injected runtime probe; a throwing
+ * runtime probe degrades to "nothing configured" instead of failing the
+ * read.
+ *
+ * The handler is built by a factory so the tests drive it over a real
+ * socket with mock admit/config (same seam as the admin routes).
+ */
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { AdminAdmission, AdminConfigSnapshot } from '../admin-routes.js';
+import type { ConfigSource } from '../config.js';
+import type { CaddyStartResult } from './caddy-process.js';
+import type { TunnelCheckResult, TunnelSetupResult } from './tunnel-orchestrator.js';
+import { type WizardRuntimeInput } from './status.js';
+import type { VerificationCheckResult, VerificationStartResult } from './verify.js';
+/** Prefix all wizard routes live under (one webServer prefix registration;
+ * the host web server matches longest-prefix-first, so these win over the
+ * plain admin prefix registration). */
+export declare const WIZARD_ROUTE_PREFIX = "/_dsh/zen-remote/admin/wizard";
+/** GET: the sanitized wizard status projection. */
+export declare const WIZARD_STATUS_ROUTE = "/_dsh/zen-remote/admin/wizard/status";
+/** POST `{ip}`: merge one detected reverse-proxy IP into the persisted
+ * trustedProxies (GW-5). */
+export declare const WIZARD_TRUST_PROXY_ROUTE = "/_dsh/zen-remote/admin/wizard/trust-proxy";
+/** POST `{publicUrl}`: start the final verification — mint the web pairing
+ * code (GW-9). GET: poll its status. */
+export declare const WIZARD_VERIFY_ROUTE = "/_dsh/zen-remote/admin/wizard/verify";
+/** POST `{token}`: store the Cloudflare API token 0600 on this machine;
+ * DELETE: stop the consumers and remove it (GW-13a). */
+export declare const WIZARD_CF_TOKEN_ROUTE = "/_dsh/zen-remote/admin/wizard/cf-token";
+/** POST `{token}`: store the cloudflared connector token (GW-13a). */
+export declare const WIZARD_TUNNEL_TOKEN_ROUTE = "/_dsh/zen-remote/admin/wizard/tunnel-token";
+/** POST: start the managed Caddy from the saved row config; POST (stop)
+ * terminates it; GET answers its three-state (GW-13a). */
+export declare const WIZARD_CADDY_START_ROUTE = "/_dsh/zen-remote/admin/wizard/caddy/start";
+export declare const WIZARD_CADDY_STOP_ROUTE = "/_dsh/zen-remote/admin/wizard/caddy/stop";
+export declare const WIZARD_CADDY_STATUS_ROUTE = "/_dsh/zen-remote/admin/wizard/caddy/status";
+/** POST `{domain}`: the zone/account probe the migration card re-checks;
+ * POST `{domain, tunnelId?}`: the full tunnel setup; POST (stop) and GET
+ * (three-state) mirror the Caddy pair (GW-13b). */
+export declare const WIZARD_TUNNEL_CHECK_ROUTE = "/_dsh/zen-remote/admin/wizard/tunnel/check-domain";
+export declare const WIZARD_TUNNEL_SETUP_ROUTE = "/_dsh/zen-remote/admin/wizard/tunnel/setup";
+export declare const WIZARD_TUNNEL_STOP_ROUTE = "/_dsh/zen-remote/admin/wizard/tunnel/stop";
+export declare const WIZARD_TUNNEL_STATUS_ROUTE = "/_dsh/zen-remote/admin/wizard/tunnel/status";
+/** The managed Caddy's three-state. `stopped` means a start happened and
+ * the process has since exited (degraded); `never-started` precedes that. */
+export type CaddyProcessState = 'running' | 'stopped' | 'never-started';
+export interface WizardHandlerOptions {
+    /** The connection service's admit, injected by apply(); tests fake it. */
+    admit: (req: IncomingMessage) => AdminAdmission;
+    /** Fresh resolveConfig() per call — the ingress fields are volatile row
+     * fields and must not go stale. */
+    getConfig: () => AdminConfigSnapshot;
+    /** The live wizard runtime facts (token presence as booleans, process
+     * liveness, the gateway's actual port, probe memories, the untrusted-
+     * proxy detection), read PER REQUEST. MAY be async (the GW-5 wiring
+     * rounds-trips the gateway's own status). MUST be read-only — GET
+     * /status calls it, and a GET never changes state. Absent means
+     * "nothing configured, nothing running"; a throw is degraded to the
+     * same. Later tasks inject the real probe. */
+    getRuntime?: () => WizardRuntimeInput | Promise<WizardRuntimeInput>;
+    /** The trust-proxy persistence (GW-5, GW-fix-2/L2), injected by apply():
+     * the CURRENTLY resolved trustedProxies with its layer, and the atomic
+     * persister for a merged list. `write` re-checks the persisted surface
+     * against `expected` (the value `resolved` answered moments earlier) —
+     * answering false when another writer moved it in between, which the
+     * route turns into a 409 instead of a silent clobber. Absent — a wiring
+     * that predates GW-5 — and the route answers 501 like the other
+     * placeholders. */
+    trustProxy?: {
+        resolved: () => {
+            value: string;
+            source: ConfigSource;
+        };
+        write: (expected: string, list: string) => boolean | Promise<boolean>;
+    };
+    /** The Cloudflare token store (GW-13a), injected by apply(): 0600 files
+     * under the ingress directory. `deleteCfToken` is called AFTER the
+     * callers have stopped the consuming processes. Absent — a wiring that
+     * predates GW-13 — and the routes answer 501. */
+    tokenStore?: {
+        writeCfToken: (token: string) => void;
+        deleteCfToken: () => void;
+        cfTokenConfigured: () => boolean;
+        writeTunnelToken: (token: string) => void;
+    };
+    /** The managed Caddy (GW-13a), injected by apply(). `start` receives the
+     * SAVED row values and the gateway's actual port; the Cloudflare token
+     * comes from the token store inside the wiring (never through routes). */
+    caddy?: {
+        start: (input: {
+            domain: string;
+            httpsPort: number;
+            gatewayPort: number;
+        }) => Promise<CaddyStartResult>;
+        stop: () => void;
+        status: () => CaddyProcessState;
+    };
+    /** The Cloudflare Tunnel orchestration (GW-13b), injected by apply().
+     * `setup` receives the SAVED domain and (when the user adopted an
+     * existing tunnel) its id; the Cloudflare token comes from the token
+     * store inside the wiring. Absent — unwired — and the routes 501. */
+    tunnel?: {
+        checkDomain: (domain: string) => Promise<TunnelCheckResult>;
+        setup: (input: {
+            domain: string;
+            tunnelId?: string;
+        }) => Promise<TunnelSetupResult>;
+        stop: () => void;
+        status: () => CaddyProcessState;
+    };
+    /** The final-verification orchestration (GW-9), injected by apply():
+     * POST mints the pairing code, GET polls the session. Absent — a wiring
+     * that predates GW-9 — and both answer 501 like the placeholders. */
+    verify?: {
+        start: (input: {
+            publicUrl: unknown;
+            probeOnly?: boolean;
+        }) => Promise<VerificationStartResult>;
+        check: () => Promise<VerificationCheckResult>;
+    };
+}
+export type WizardHandler = (req: IncomingMessage, res: ServerResponse) => Promise<void>;
+/**
+ * Build the wizard route handler for one plugin row. The returned handler
+ * owns the full response lifecycle of every request under
+ * {@link WIZARD_ROUTE_PREFIX} and never throws.
+ */
+export declare function createWizardHandler(options: WizardHandlerOptions): WizardHandler;
+//# sourceMappingURL=routes.d.ts.map

package/lib/types/wizard/routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../../src/wizard/routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAChE,OAAO,KAAK,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAA;AAC7E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAIhD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AAC1D,OAAO,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AACpF,OAAO,EAAuB,KAAK,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAC1E,OAAO,KAAK,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAA;AAEnF;;uCAEuC;AACvC,eAAO,MAAM,mBAAmB,kCAAkC,CAAA;AAElE,mDAAmD;AACnD,eAAO,MAAM,mBAAmB,yCAAkC,CAAA;AAElE;4BAC4B;AAC5B,eAAO,MAAM,wBAAwB,8CAAuC,CAAA;AAE5E;wCACwC;AACxC,eAAO,MAAM,mBAAmB,yCAAkC,CAAA;AAElE;wDACwD;AACxD,eAAO,MAAM,qBAAqB,2CAAoC,CAAA;AAEtE,sEAAsE;AACtE,eAAO,MAAM,yBAAyB,+CAAwC,CAAA;AAE9E;0DAC0D;AAC1D,eAAO,MAAM,wBAAwB,8CAAuC,CAAA;AAC5E,eAAO,MAAM,uBAAuB,6CAAsC,CAAA;AAC1E,eAAO,MAAM,yBAAyB,+CAAwC,CAAA;AAE9E;;mDAEmD;AACnD,eAAO,MAAM,yBAAyB,sDAA+C,CAAA;AACrF,eAAO,MAAM,yBAAyB,+CAAwC,CAAA;AAC9E,eAAO,MAAM,wBAAwB,8CAAuC,CAAA;AAC5E,eAAO,MAAM,0BAA0B,gDAAyC,CAAA;AAEhF;6EAC6E;AAC7E,MAAM,MAAM,iBAAiB,GAAG,SAAS,GAAG,SAAS,GAAG,eAAe,CAAA;AAKvE,MAAM,WAAW,oBAAoB;IACnC,0EAA0E;IAC1E,KAAK,EAAE,CAAC,GAAG,EAAE,eAAe,KAAK,cAAc,CAAA;IAC/C;uCACmC;IACnC,SAAS,EAAE,MAAM,mBAAmB,CAAA;IACpC;;;;;;kDAM8C;IAC9C,UAAU,CAAC,EAAE,MAAM,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;IACnE;;;;;;;uBAOmB;IACnB,UAAU,CAAC,EAAE;QACX,QAAQ,EAAE,MAAM;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,YAAY,CAAA;SAAE,CAAA;QACvD,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;KACtE,CAAA;IACD;;;qDAGiD;IACjD,UAAU,CAAC,EAAE;QACX,YAAY,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAA;QACrC,aAAa,EAAE,MAAM,IAAI,CAAA;QACzB,iBAAiB,EAAE,MAAM,OAAO,CAAA;QAChC,gBAAgB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAA;KAC1C,CAAA;IACD;;8EAE0E;IAC1E,KAAK,CAAC,EAAE;QACN,KAAK,EAAE,CAAC,KAAK,EAAE;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAC;YAAC,WAAW,EAAE,MAAM,CAAA;SAAE,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAA;QACvG,IAAI,EAAE,MAAM,IAAI,CAAA;QAChB,MAAM,EAAE,MAAM,iBAAiB,CAAA;KAChC,CAAA;IACD;;;yEAGqE;IACrE,MAAM,CAAC,EAAE;QACP,WAAW,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAA;QAC3D,KAAK,EAAE,CAAC,KAAK,EAAE;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;SAAE,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAA;QACnF,IAAI,EAAE,MAAM,IAAI,CAAA;QAChB,MAAM,EAAE,MAAM,iBAAiB,CAAA;KAChC,CAAA;IACD;;yEAEqE;IACrE,MAAM,CAAC,EAAE;QACP,KAAK,EAAE,CAAC,KAAK,EAAE;YAAE,SAAS,EAAE,OAAO,CAAC;YAAC,SAAS,CAAC,EAAE,OAAO,CAAA;SAAE,KAAK,OAAO,CAAC,uBAAuB,CAAC,CAAA;QAC/F,KAAK,EAAE,MAAM,OAAO,CAAC,uBAAuB,CAAC,CAAA;KAC9C,CAAA;CACF;AAED,MAAM,MAAM,aAAa,GAAG,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;AA8BxF;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,oBAAoB,GAAG,aAAa,CAgWhF"}

package/lib/types/wizard/source-detect.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Reverse-proxy source detection (GW-5), pure logic — the browser-facing
+ * half of the 「检测到反代从 {ip} 连过来，自动信任？」flow.
+ *
+ * The gateway (lib/lan-gate-server.cjs) records the last request that
+ * carried proxy headers from a socket it does NOT trust — almost always
+ * the user's own reverse proxy whose IP never made it into
+ * `trustedProxies` — as `lastForwardedSource: { ip, at }` in its
+ * `/lan-gate/status` answer. {@link detectForwardedSource} lifts that
+ * field out (defensively: the gateway may be old and send nothing), and
+ * {@link mergeProxyList} / {@link normalizeTrustedIp} build the merged
+ * trust list the trust-proxy route persists.
+ *
+ * Pure: no imports, no I/O — the check scripts can drive it directly.
+ */
+/**
+ * The recognized shape of the gateway's `lastForwardedSource`. Everything
+ * else — missing field (an older gateway), junk values — reads as "no
+ * detection".
+ */
+export interface ForwardedSourceInput {
+    ip?: unknown;
+    at?: unknown;
+}
+export interface DetectedForwardedSource {
+    ip: string;
+    at: number;
+}
+/**
+ * Extract the untrusted-proxy detection from one `/lan-gate/status` body.
+ * Returns null when the gateway predates the field or the field is
+ * malformed — a missing detection is the common case, never an error.
+ */
+export declare function detectForwardedSource(gatewayStatus: unknown): DetectedForwardedSource | null;
+/**
+ * One trust-list entry: an IP literal, normalized the way the gateway
+ * normalizes socket peers (`::ffff:` IPv4-in-IPv6 unwrapped). Refuses
+ * anything that is not a plausible IPv4/IPv6 literal — the value goes
+ * into persisted config and later into an exact string comparison
+ * against socket peers, where a hostname or a CIDR would silently never
+ * match.
+ */
+export declare function normalizeTrustedIp(raw: unknown): string | undefined;
+/** Split the comma-separated trustedProxies value into entries. */
+export declare function parseProxyList(value: unknown): string[];
+/**
+ * Append one IP to the comma-separated list, preserving order, skipping
+ * duplicates (the trust-proxy route answers "already trusted" instead of
+ * rewriting). Normalization is the caller's job — the route normalizes
+ * before merging.
+ */
+export declare function mergeProxyList(current: unknown, ip: string): string;
+//# sourceMappingURL=source-detect.d.ts.map

package/lib/types/wizard/source-detect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"source-detect.d.ts","sourceRoot":"","sources":["../../../src/wizard/source-detect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,EAAE,CAAC,EAAE,OAAO,CAAA;IACZ,EAAE,CAAC,EAAE,OAAO,CAAA;CACb;AAED,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,MAAM,CAAA;IACV,EAAE,EAAE,MAAM,CAAA;CACX;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,aAAa,EAAE,OAAO,GAAG,uBAAuB,GAAG,IAAI,CAQ5F;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAcnE;AAED,mEAAmE;AACnE,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,EAAE,CAGvD;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,CAInE"}

package/lib/types/wizard/status.d.ts

@@ -0,0 +1,115 @@
+/**
+ * Wizard status projection (GW-1): declared ingress config + observed
+ * runtime facts → one sanitized JSON shape the browser may see.
+ *
+ * This module is the SECURITY BOUNDARY for everything the wizard surfaces
+ * on `GET /_dsh/zen-remote/admin/wizard/status`. The two properties it must
+ * hold, regardless of what the callers hand it:
+ *
+ *   1. No secret material. The Cloudflare API token and the cloudflared
+ *      tunnel token never enter this module — the runtime side reports only
+ *      `*Configured` booleans (the files live 0600 under
+ *      `<DSH_HOME>/zen-remote-ingress/`, and their contents stay there).
+ *   2. No file paths. The runtime side knows where binaries, token files
+ *      and the Caddyfile live; the projection carries none of it — every
+ *      output field is built from a whitelist below, and input objects are
+ *      never spread through.
+ *
+ * Pure logic on purpose: zero imports, so the check scripts and the tests
+ * can drive it through Node's strip-only type stripping, and the wizard
+ * routes can call it per request without re-resolving anything.
+ *
+ * Every input is coerced defensively. The declared side normally arrives
+ * from `resolveConfig(...).values` (already legal), but the projection is
+ * also the last line of defense for the wire: an off-enum mode answers
+ * `'off'`, a junk port answers the 443 default, a non-string domain answers
+ * `''` — same transparency discipline as the config resolver, applied at
+ * the rendering edge.
+ */
+/** The ingress modes `resolveConfig` can legally produce. */
+export declare const WIZARD_INGRESS_MODES: readonly ["off", "caddy", "external", "cloudflared"];
+export type WizardIngressMode = (typeof WIZARD_INGRESS_MODES)[number];
+/**
+ * The declared slice of the resolved config. Loose (`unknown`) on purpose:
+ * the projection is what guarantees the wire shape, not the caller's typing.
+ */
+export interface WizardDeclaredInput {
+    ingressMode?: unknown;
+    ingressDomain?: unknown;
+    ingressHttpsPort?: unknown;
+    ingressPublicUrl?: unknown;
+}
+/**
+ * One probe / verification memory the wizard back-end keeps. Only these
+ * three fields are recognized; everything else on the record (URLs probed,
+ * error details, headers) is dropped at the boundary.
+ */
+export interface WizardRecordInput {
+    result?: unknown;
+    deviceId?: unknown;
+    at?: unknown;
+}
+/**
+ * The gateway's own detection of an untrusted reverse proxy (GW-5): the
+ * socket peer of the last request that carried proxy headers from an IP
+ * outside `trustedProxies` — almost certainly the user's own proxy, and
+ * the one IP the trust-proxy flow offers to add. Whitelist-projected like
+ * everything else.
+ */
+export interface WizardForwardedSourceInput {
+    ip?: unknown;
+    at?: unknown;
+}
+/**
+ * Runtime facts the wizard back-end observes live. Everything is optional —
+ * a composition that has not started any ingress process simply omits the
+ * fields. Token presence is reported as booleans only; port as the gateway
+ * child's ACTUAL listening port (it may differ from the configured one).
+ */
+export interface WizardRuntimeInput {
+    cfTokenConfigured?: unknown;
+    tunnelTokenConfigured?: unknown;
+    caddyRunning?: unknown;
+    cloudflaredRunning?: unknown;
+    gatewayActualPort?: unknown;
+    lanAddress?: unknown;
+    lastHostProbe?: WizardRecordInput | null;
+    lastExternalVerification?: WizardRecordInput | null;
+    lastForwardedSource?: WizardForwardedSourceInput | null;
+}
+/** One projected probe / verification memory, or null when there is none. */
+export interface WizardStatusRecord {
+    result: string;
+    deviceId: string | null;
+    at: number | null;
+}
+/** One projected untrusted-proxy detection, or null when none is pending. */
+export interface WizardStatusForwardedSource {
+    ip: string;
+    at: number;
+}
+/** The full sanitized status the wizard status route answers with. */
+export interface WizardStatus {
+    ok: true;
+    mode: WizardIngressMode;
+    domain: string;
+    httpsPort: number;
+    publicUrl: string;
+    cfTokenConfigured: boolean;
+    tunnelTokenConfigured: boolean;
+    caddyRunning: boolean;
+    cloudflaredRunning: boolean;
+    gatewayActualPort: number | null;
+    lanAddress?: string;
+    lastHostProbe: WizardStatusRecord | null;
+    lastExternalVerification: WizardStatusRecord | null;
+    lastForwardedSource: WizardStatusForwardedSource | null;
+}
+/**
+ * Build the sanitized wizard status. Both arguments are optional so a
+ * composition can answer before anything is configured; the all-empty
+ * answer is the honest "wizard not started" state (`mode: 'off'`, no ports,
+ * no tokens configured, no memories).
+ */
+export declare function projectWizardStatus(declared?: WizardDeclaredInput, runtime?: WizardRuntimeInput): WizardStatus;
+//# sourceMappingURL=status.d.ts.map

package/lib/types/wizard/status.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../../../src/wizard/status.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,6DAA6D;AAC7D,eAAO,MAAM,oBAAoB,sDAAuD,CAAA;AAExF,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAA;AAErE;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B,gBAAgB,CAAC,EAAE,OAAO,CAAA;CAC3B;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,EAAE,CAAC,EAAE,OAAO,CAAA;CACb;AAED;;;;;;GAMG;AACH,MAAM,WAAW,0BAA0B;IACzC,EAAE,CAAC,EAAE,OAAO,CAAA;IACZ,EAAE,CAAC,EAAE,OAAO,CAAA;CACb;AAED;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAC3B,qBAAqB,CAAC,EAAE,OAAO,CAAA;IAC/B,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB,kBAAkB,CAAC,EAAE,OAAO,CAAA;IAC5B,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAC3B,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB,aAAa,CAAC,EAAE,iBAAiB,GAAG,IAAI,CAAA;IACxC,wBAAwB,CAAC,EAAE,iBAAiB,GAAG,IAAI,CAAA;IACnD,mBAAmB,CAAC,EAAE,0BAA0B,GAAG,IAAI,CAAA;CACxD;AAED,6EAA6E;AAC7E,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,EAAE,EAAE,MAAM,GAAG,IAAI,CAAA;CAClB;AAED,6EAA6E;AAC7E,MAAM,WAAW,2BAA2B;IAC1C,EAAE,EAAE,MAAM,CAAA;IACV,EAAE,EAAE,MAAM,CAAA;CACX;AAED,sEAAsE;AACtE,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,IAAI,CAAA;IACR,IAAI,EAAE,iBAAiB,CAAA;IACvB,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,iBAAiB,EAAE,OAAO,CAAA;IAC1B,qBAAqB,EAAE,OAAO,CAAA;IAC9B,YAAY,EAAE,OAAO,CAAA;IACrB,kBAAkB,EAAE,OAAO,CAAA;IAC3B,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAA;IAChC,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,aAAa,EAAE,kBAAkB,GAAG,IAAI,CAAA;IACxC,wBAAwB,EAAE,kBAAkB,GAAG,IAAI,CAAA;IACnD,mBAAmB,EAAE,2BAA2B,GAAG,IAAI,CAAA;CACxD;AAyCD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,GAAE,mBAAwB,EAAE,OAAO,GAAE,kBAAuB,GAAG,YAAY,CAiBtH"}

package/lib/types/wizard/token-store.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Wizard token storage (GW-13a): the secrets that must never enter the
+ * plugin row or any wire response live as 0600 files under
+ * `<DSH_HOME>/zen-remote-ingress/`, written through a temp-file rename so
+ * a crash mid-write can never leave a half token at the real path. The
+ * tunnel-token half lives in cloudflared.ts (it is the cloudflared
+ * process's own input); this module owns the shared Cloudflare API token.
+ *
+ * Reads answer presence or hand the raw string ONLY to in-process callers
+ * (the Caddy manager's env) — nothing here is ever logged or serialized
+ * into a response.
+ */
+/** `<DSH_HOME>/zen-remote-ingress/cf-api-token`. */
+export declare function cfTokenPath(dshHome: string): string;
+/** Atomic 0600 write (temp sibling + rename), with a direct-write fallback
+ * on Windows if an existing file or antivirus scan refuses `renameSync` with
+ * EPERM/EACCES. */
+export declare function writeCfTokenFile(dshHome: string, token: string): string;
+/** The stored token, or undefined when absent/empty. Callers feed it to the
+ * Caddy manager's environment; it must never reach a response or a log. */
+export declare function readCfTokenFile(dshHome: string): string | undefined;
+/** Whether a non-empty token file exists (the projection's boolean only). */
+export declare function cfTokenConfigured(dshHome: string): boolean;
+/** Delete the stored token (the DELETE route; callers stop the processes
+ * that consume it first). */
+export declare function deleteCfTokenFile(dshHome: string): void;
+//# sourceMappingURL=token-store.d.ts.map

package/lib/types/wizard/token-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-store.d.ts","sourceRoot":"","sources":["../../../src/wizard/token-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAMH,oDAAoD;AACpD,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED;;mBAEmB;AACnB,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAiBvE;AAED;2EAC2E;AAC3E,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAOnE;AAED,6EAA6E;AAC7E,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAM1D;AAED;6BAC6B;AAC7B,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAEvD"}