rdsh-gateway 0.10.0 → 0.11.0

package/dist/config.d.ts

@@ -1,4 +1,4 @@
-export type AuthMode = "pair" | "password" | "none";
+export type AuthMode = "password" | "none";
 export type HostMode = "lan" | "cloud" | "join";
 export interface TlsConfig {
     cert: string;
@@ -10,7 +10,6 @@ export interface AuthUser {
 }
 export interface AuthConfig {
     mode: AuthMode;
-    pairCode?: string;
     /** 改密时 +1，用于使旧会话失效 */
     version: number;
     users: AuthUser[];
@@ -56,6 +55,8 @@ export declare const DEFAULT_HOST_CONFIG_PATH: string;
 export declare function resolveConfigPath(cliPath?: string, env?: NodeJS.ProcessEnv): string;
 /** 原子写回配置（tmp + rename，0600）。 */
 export declare function saveConfig(path: string, config: RdshConfig): Promise<void>;
+/** 生成随机访问口令（base64url，8 字节 ≈ 11 字符，满足 feature 15 的 ≥4 位约束）。 */
+export declare function generateAccessCode(): string;
 /** 加载并校验配置；默认路径下文件不存在时尝试迁移旧 config.json，否则返回默认值。 */
 export declare function loadConfig(path: string): Promise<RdshConfig>;
 /** 校验并规范化任意输入（测试/CLI 覆盖复用）。 */

package/dist/config.js

@@ -9,14 +9,16 @@
 import { readFile, writeFile, rename } from "node:fs/promises";
 import { homedir } from "node:os";
 import { join } from "node:path";
+import { randomBytes } from "node:crypto";
 export const DEFAULT_HOST_CONFIG_PATH = join(homedir(), ".rdsh", "host.json");
 /** 旧版 serve 配置（迁移源，保留不删）。 */
 const LEGACY_CONFIG_PATH = join(homedir(), ".rdsh", "config.json");
-const DEFAULT_AUTH = { mode: "pair", version: 1, users: [] };
+const DEFAULT_AUTH = { mode: "none", version: 1, users: [] };
 const DEFAULTS = {
     mode: "lan",
     host: "0.0.0.0",
-    port: 8443,
+    // host 默认端口 = 8442（hub 默认 8443，同机跑 hub+host 不冲突；8443 是 Tomcat/HTTPS 备用口热门号）
+    port: 8442,
     sessionTtlSeconds: 12 * 3600,
     behindProxy: false,
     allowFrom: [],
@@ -34,6 +36,15 @@ export async function saveConfig(path, config) {
     await writeFile(tmp, `${JSON.stringify(config, null, 2)}\n`, { mode: 0o600 });
     await rename(tmp, path);
 }
+/** 生成随机访问口令（base64url，8 字节 ≈ 11 字符，满足 feature 15 的 ≥4 位约束）。 */
+export function generateAccessCode() {
+    return randomBytes(8).toString("base64url");
+}
+/** 旧配置是否使用了已废弃的动态配对码（`auth.mode: "pair"`）。 */
+function isLegacyPairAuth(raw) {
+    const auth = raw?.auth;
+    return auth?.mode === "pair";
+}
 /** 加载并校验配置；默认路径下文件不存在时尝试迁移旧 config.json，否则返回默认值。 */
 export async function loadConfig(path) {
     let raw = {};
@@ -54,7 +65,15 @@ export async function loadConfig(path) {
             }
         }
     }
-    return normalizeConfig(raw, path);
+    const config = normalizeConfig(raw, path);
+    // 迁移：旧 `auth.mode: "pair"` → 生成访问口令并写回（幂等：写回后下次不再命中）
+    if (isLegacyPairAuth(raw) && (config.gateway?.accessCode ?? null) === null) {
+        const code = generateAccessCode();
+        config.gateway = { accessCode: code };
+        await saveConfig(path, config);
+        console.log(`rdsh: 检测到旧配对码配置，已迁移为访问口令（请记录，可用 \`rdsh host gate set\` 修改）：${code}`);
+    }
+    return config;
 }
 /** 读取旧 ~/.rdsh/config.json（不存在 → null；坏 JSON → 抛错）。 */
 async function readLegacyConfig() {
@@ -130,14 +149,16 @@ export function normalizeConfig(raw, source = "config") {
             throw new Error(`${source}: "auth" must be an object`);
         const auth = cfg.auth;
         if (auth.mode !== undefined) {
-            if (auth.mode !== "pair" && auth.mode !== "password" && auth.mode !== "none") {
-                throw new Error(`${source}: "auth.mode" must be pair|password|none`);
+            // 兼容旧配置：`pair`（动态配对码）已废弃，规整为 `none`（无会话认证；直连口门禁由 gateway.accessCode 承担）
+            if (auth.mode === "pair") {
+                out.auth.mode = "none";
+            }
+            else if (auth.mode === "password" || auth.mode === "none") {
+                out.auth.mode = auth.mode;
+            }
+            else {
+                throw new Error(`${source}: "auth.mode" must be password|none`);
             }
-            out.auth.mode = auth.mode;
-        }
-        if (auth.pairCode !== undefined) {
-            assertString(auth.pairCode, "auth.pairCode", source);
-            out.auth.pairCode = auth.pairCode;
         }
         if (auth.version !== undefined) {
             if (!Number.isInteger(auth.version) || auth.version < 1) {

package/dist/direct-secret.d.ts

@@ -0,0 +1,3 @@
+export declare function directSecretPath(dir?: string): string;
+/** 读取或生成直连密钥（32 字节 base64url）；坏文件/过短视为不存在并重新生成。 */
+export declare function loadOrCreateDirectSecret(dir?: string): string;

package/dist/direct-secret.js

@@ -0,0 +1,35 @@
+/**
+ * direct-secret.ts — 直连口专用密钥（per-host 随机密钥，自动生成）。
+ *
+ * 用途（24-direct-first，方案 B）：直连口门禁的 ticket 与会话 cookie 用它签名，
+ * **独立于访问口令（accessCode）**——这样"不设口令"也能启用直连口（ticket 即门禁），
+ * 而口令降级为可选的额外一层。密钥自动生成并持久化到 ~/.rdsh/direct-secret（0600），
+ * 与 E2EE 静态密钥（e2ee-key.json）同一先例。
+ */
+import { randomBytes } from "node:crypto";
+import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+const RDSH_DIR = join(homedir(), ".rdsh");
+const SECRET_FILE_NAME = "direct-secret";
+export function directSecretPath(dir = RDSH_DIR) {
+    return join(dir, SECRET_FILE_NAME);
+}
+/** 读取或生成直连密钥（32 字节 base64url）；坏文件/过短视为不存在并重新生成。 */
+export function loadOrCreateDirectSecret(dir = RDSH_DIR) {
+    const path = directSecretPath(dir);
+    try {
+        const raw = readFileSync(path, "utf8").trim();
+        if (raw.length >= 32)
+            return raw;
+    }
+    catch (err) {
+        if (err.code !== "ENOENT")
+            throw err;
+    }
+    const secret = randomBytes(32).toString("base64url");
+    mkdirSync(dir, { recursive: true });
+    writeFileSync(path, `${secret}\n`, { mode: 0o600 });
+    return secret;
+}
+//# sourceMappingURL=direct-secret.js.map

package/dist/direct-ticket.d.ts

@@ -0,0 +1,5 @@
+export interface DirectTicketManager {
+    mint(): string;
+    consume(ticket: string): boolean;
+}
+export declare function createDirectTicketManager(secret: string, ttlMs?: number): DirectTicketManager;

package/dist/direct-ticket.js

@@ -0,0 +1,42 @@
+/**
+ * direct-ticket.ts — 一次性直连票（R4）：host 经 E2EE 通道随候选下发，客户端拼到直连 URL，
+ * 直连口校验后 303 换会话 cookie（免重输口令）。
+ *
+ * 结构复用访问 cookie 的 HMAC 形式（payload = `${exp}.${nonce}`，key = sha256(secret)），
+ * 额外做**单次消费**（used 集合）与短 TTL（默认 30s）。secret 用访问口令派生，改口令即吊销未用票。
+ */
+import { createHmac, createHash, randomBytes, timingSafeEqual } from "node:crypto";
+export function createDirectTicketManager(secret, ttlMs = 30_000) {
+    const used = new Set();
+    const key = createHash("sha256").update(secret).digest();
+    const hmac = (payload) => createHmac("sha256", key).update(payload).digest("base64url");
+    return {
+        mint() {
+            const exp = Date.now() + ttlMs;
+            const nonce = randomBytes(16).toString("base64url");
+            const payload = `${exp}.${nonce}`;
+            return `${payload}.${hmac(payload)}`;
+        },
+        consume(ticket) {
+            const parts = ticket.split(".");
+            if (parts.length !== 3)
+                return false;
+            const [expStr, nonce, sig] = parts;
+            if (expStr === "" || nonce === "" || sig === "")
+                return false;
+            const exp = Number(expStr);
+            if (!Number.isFinite(exp) || exp <= Date.now())
+                return false;
+            const payload = `${expStr}.${nonce}`;
+            const expected = Buffer.from(hmac(payload));
+            const actual = Buffer.from(sig);
+            if (actual.length !== expected.length || !timingSafeEqual(actual, expected))
+                return false;
+            if (used.has(ticket))
+                return false;
+            used.add(ticket);
+            return true;
+        },
+    };
+}
+//# sourceMappingURL=direct-ticket.js.map

package/dist/direct.d.ts

@@ -0,0 +1,47 @@
+import type { RunningGateway } from "./server.ts";
+import type { TlsMaterial } from "./tls.ts";
+export interface DirectOptions {
+    /** 转发目标 dsh 端口（join 已 spawn 的同一个 dsh；插件形态 = ctx.webServer.port） */
+    dshPort: number;
+    /** 宿主代持的 dsh 会话 cookie（注入转发） */
+    dshAuthCookieHeader?: string | null;
+    /** 直连密钥（per-host 随机，自动生成）；ticket 与会话 cookie 用它签名 */
+    secret: string;
+    /** 访问口令（可选增强层）：非空时直连口额外要求口令（手动访问） */
+    accessCode?: string | null;
+    /** 一次性直连票校验（R4） */
+    consumeTicket?: (ticket: string) => boolean;
+    /** 监听地址，默认 0.0.0.0 */
+    host?: string;
+    /** 监听端口，默认 8442（复用 config.port） */
+    port?: number;
+    keyDir?: string;
+    dshUiCompat?: {
+        trustPairedAsLoopback?: boolean;
+    };
+    configPath?: string;
+    tlsMaterial?: TlsMaterial | null;
+}
+export interface DirectHandle {
+    gateway: RunningGateway;
+    actualPort: number;
+    /** 本机私网 IPv4 候选（IP + 实际端口） */
+    candidates(): {
+        host: string;
+        port: number;
+    }[];
+    stop(): Promise<void>;
+}
+export declare function startDirect(opts: DirectOptions): Promise<DirectHandle>;
+/** 收集本机私网 IPv4 候选（含 link-local；不含公网与 loopback）。 */
+export declare function lanCandidates(port: number): {
+    host: string;
+    port: number;
+}[];
+/** RFC1918 / link-local 判定（严格校验四段十进制）。 */
+export declare function isPrivateIpv4(ip: string): boolean;
+/**
+ * 直连 bootstrap 脚本（注入 DSH 首页）：经 E2EE 取候选 + 直连票，挂到 `window.__rdshDirectInfo`（P2 客户端消费）。
+ * `pageToken` 为 null 时（未设口令）跳过 raw 授权，直接取候选。
+ */
+export declare function directBootstrapScript(pageToken: string | null): string;

package/dist/direct.js

@@ -0,0 +1,79 @@
+/**
+ * direct.ts — 直连口（A 案）：join 进程额外监听的内网端口，转发到**同一个 dsh**。
+ *
+ * 门禁 = **ticket（方案 B）**：直连口始终监听（join 模式），ticket/会话 cookie 用 per-host
+ * 随机密钥（direct-secret）签名，独立于访问口令；口令（accessCode）为可选增强层（手动访问）。
+ * P1 为 http 明文，P3 换 https 自签 + App 指纹固定。候选只下发私网 IPv4。
+ */
+import { networkInterfaces } from "node:os";
+import { startGateway } from "./server.js";
+export async function startDirect(opts) {
+    const gateway = await startGateway({
+        host: opts.host ?? "0.0.0.0",
+        port: opts.port ?? 8442,
+        sessionTtlSeconds: 12 * 3600,
+        dshPort: opts.dshPort,
+        dshAuthCookieHeader: opts.dshAuthCookieHeader ?? null,
+        directSecret: opts.secret,
+        accessCode: opts.accessCode ?? null,
+        consumeTicket: opts.consumeTicket,
+        authMode: "none",
+        keyDir: opts.keyDir,
+        dshUiCompat: opts.dshUiCompat,
+        configPath: opts.configPath,
+        tlsMaterial: opts.tlsMaterial ?? null,
+    });
+    const actualPort = gateway.actualPort;
+    return {
+        gateway,
+        actualPort,
+        candidates: () => lanCandidates(actualPort),
+        stop: async () => {
+            await new Promise((resolve) => gateway.server.close(() => resolve()));
+            gateway.dispose();
+        },
+    };
+}
+/** 收集本机私网 IPv4 候选（含 link-local；不含公网与 loopback）。 */
+export function lanCandidates(port) {
+    const out = [];
+    for (const list of Object.values(networkInterfaces())) {
+        for (const ni of (list ?? [])) {
+            if (ni.family !== "IPv4" || ni.internal)
+                continue;
+            if (!isPrivateIpv4(ni.address))
+                continue;
+            out.push({ host: ni.address, port });
+        }
+    }
+    return out;
+}
+/** RFC1918 / link-local 判定（严格校验四段十进制）。 */
+export function isPrivateIpv4(ip) {
+    const parts = ip.split(".").map(Number);
+    if (parts.length !== 4 || parts.some((n) => !Number.isInteger(n) || n < 0 || n > 255))
+        return false;
+    const [a, b] = parts;
+    return a === 10 || (a === 172 && b >= 16 && b <= 31) || (a === 192 && b === 168) || (a === 169 && b === 254);
+}
+/**
+ * 直连 bootstrap 脚本（注入 DSH 首页）：经 E2EE 取候选 + 直连票，挂到 `window.__rdshDirectInfo`（P2 客户端消费）。
+ * `pageToken` 为 null 时（未设口令）跳过 raw 授权，直接取候选。
+ */
+export function directBootstrapScript(pageToken) {
+    const authorize = pageToken === null
+        ? "Promise.resolve()"
+        : `fetch("/__rdsh/authorize?token=" + encodeURIComponent(${JSON.stringify(pageToken)}), { method: "POST" })`;
+    return `(function () {
+  if (window.__rdshDirectBootstrapped) return;
+  window.__rdshDirectBootstrapped = true;
+  try {
+    ${authorize}
+      .then(function () { return fetch("/__rdsh/direct-candidates"); })
+      .then(function (r) { return r.json(); })
+      .then(function (info) { window.__rdshDirectInfo = info; })
+      .catch(function () {});
+  } catch (e) { /* ignore */ }
+})();`;
+}
+//# sourceMappingURL=direct.js.map

package/dist/gate.d.ts

@@ -0,0 +1,29 @@
+/**
+ * gate.ts — 访问口令（accessCode）门禁的公共组件：challenge 页 + cookie 校验。
+ *
+ * 供隧道口（join.ts 的明文分发器）与直连口（server.ts）共用，避免两份实现漂移。
+ * 对应 req 的「固定口令 / 门禁」（gateway.accessCode，feature 15）。
+ */
+import { GATE_COOKIE, GATE_COOKIE_TTL_MS, signGateCookie, verifyGateCookie, verifyGateCode } from "./access-gate.ts";
+export { GATE_COOKIE, GATE_COOKIE_TTL_MS, signGateCookie, verifyGateCookie, verifyGateCode };
+/** gate challenge 错误态（语言中立 key，gateChallengeHtml 内本地化）。 */
+export type GateError = "wrong" | "locked" | null;
+/** 从 Accept-Language 头取首个语言（数组取首、缺失 undefined）。 */
+export declare function headerAcceptLanguage(headers: Record<string, string | string[] | undefined>): string | undefined;
+/** 从 cookie 头提取 rdsh_gate 值（无则 null）。 */
+export declare function gateCookieFromHeader(cookieHeader: string | string[] | undefined): string | null;
+/** 访问口令 challenge 页（内联，零外部依赖；Accept-Language 含 zh → 中文，否则英文兜底）。 */
+export declare function gateChallengeHtml(hostName: string, actionPath: string, error: GateError, acceptLanguage?: string): string;
+/** 无口令直连的 403 页：ticket 只给 App 用，人肉访问唯一路径 = 设口令；给出两种启动方式各自的口令设置方法。 */
+export declare function directForbiddenHtml(acceptLanguage?: string): string;
+/** 全局失败封顶（直连口有真实客户端 IP，按 IP 维度限流更合理；与 join 的全局封顶保持同量级）。 */
+export interface GateLimiter {
+    /** 是否处于锁定（true = 拒绝校验，直接回 locked challenge）。 */
+    blocked(ip: string): boolean;
+    /** 记录一次失败；达上限后进入锁定。 */
+    fail(ip: string): void;
+    /** 成功清除计数。 */
+    clear(ip: string): void;
+}
+/** 创建 gate 失败限流器：每 IP 连续错 N 次锁定 L 毫秒。 */
+export declare function createGateLimiter(maxFails?: number, lockMs?: number): GateLimiter;

package/dist/gate.js

@@ -0,0 +1,117 @@
+/**
+ * gate.ts — 访问口令（accessCode）门禁的公共组件：challenge 页 + cookie 校验。
+ *
+ * 供隧道口（join.ts 的明文分发器）与直连口（server.ts）共用，避免两份实现漂移。
+ * 对应 req 的「固定口令 / 门禁」（gateway.accessCode，feature 15）。
+ */
+import { GATE_COOKIE, GATE_COOKIE_TTL_MS, signGateCookie, verifyGateCookie, verifyGateCode } from "./access-gate.js";
+export { GATE_COOKIE, GATE_COOKIE_TTL_MS, signGateCookie, verifyGateCookie, verifyGateCode };
+/** 从 Accept-Language 头取首个语言（数组取首、缺失 undefined）。 */
+export function headerAcceptLanguage(headers) {
+    const al = headers["accept-language"];
+    return Array.isArray(al) ? al.join(",") : typeof al === "string" ? al : undefined;
+}
+/** 从 cookie 头提取 rdsh_gate 值（无则 null）。 */
+export function gateCookieFromHeader(cookieHeader) {
+    const s = Array.isArray(cookieHeader) ? cookieHeader.join(";") : typeof cookieHeader === "string" ? cookieHeader : "";
+    for (const part of s.split(";")) {
+        const idx = part.indexOf("=");
+        if (idx <= 0)
+            continue;
+        if (part.slice(0, idx).trim() === GATE_COOKIE)
+            return part.slice(idx + 1).trim();
+    }
+    return null;
+}
+/** HTML 转义（challenge 页内插 hostName/actionPath 防注入；actionPath 已 percent-encoded，此处为纵深防御）。 */
+function escapeHtml(s) {
+    return s
+        .replaceAll("&", "&amp;")
+        .replaceAll("<", "&lt;")
+        .replaceAll(">", "&gt;")
+        .replaceAll('"', "&quot;")
+        .replaceAll("'", "&#39;");
+}
+/** 访问口令 challenge 页（内联，零外部依赖；Accept-Language 含 zh → 中文，否则英文兜底）。 */
+export function gateChallengeHtml(hostName, actionPath, error, acceptLanguage) {
+    const safeHost = escapeHtml(hostName);
+    const safePath = escapeHtml(actionPath);
+    const zh = typeof acceptLanguage === "string" && /zh/i.test(acceptLanguage);
+    const t = zh
+        ? { title: "访问密码", heading: `主机「${safeHost}」受访问密码保护`, note: "此密码由主机所有者设置，hub 无法绕过。", placeholder: "请输入访问密码", submit: "进入", wrong: "访问密码错误", locked: "尝试次数过多，请稍后再试" }
+        : { title: "Access code", heading: `Host "${safeHost}" is protected by an access code`, note: "This code is set by the host owner; the hub cannot bypass it.", placeholder: "Enter access code", submit: "Enter", wrong: "Incorrect access code", locked: "Too many attempts — please try again later" };
+    const errHtml = error === null ? "" : `<p style="color:#dc2626;font-size:13px;margin:10px 0 0">${error === "wrong" ? t.wrong : t.locked}</p>`;
+    return (`<!doctype html><html lang="${zh ? "zh-CN" : "en"}"><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">` +
+        `<title>${t.title}</title>` +
+        `<body style="font-family:system-ui,sans-serif;background:#f6f7f9;margin:0">` +
+        `<div style="max-width:360px;margin:64px auto;background:#fff;border:1px solid #e5e7eb;border-radius:12px;padding:24px">` +
+        `<h1 style="font-size:18px;margin:0 0 8px">${t.heading}</h1>` +
+        `<p style="font-size:13px;color:#6b7280;margin:0 0 16px">${t.note}</p>` +
+        `<form method="POST" action="${safePath}">` +
+        `<input name="gate_code" type="password" autocomplete="off" autofocus placeholder="${t.placeholder}" style="width:100%;box-sizing:border-box;height:38px;border:1px solid #d1d5db;border-radius:8px;padding:0 12px;font-size:14px">` +
+        `<button type="submit" style="width:100%;margin-top:12px;height:38px;border:none;border-radius:8px;background:#2563eb;color:#fff;font-size:14px;cursor:pointer">${t.submit}</button>` +
+        `</form>${errHtml}</div></body></html>`);
+}
+/** 无口令直连的 403 页：ticket 只给 App 用，人肉访问唯一路径 = 设口令；给出两种启动方式各自的口令设置方法。 */
+export function directForbiddenHtml(acceptLanguage) {
+    const zh = typeof acceptLanguage === "string" && /zh/i.test(acceptLanguage);
+    const t = zh
+        ? {
+            title: "直接访问需要设置访问口令",
+            heading: "无法直接访问",
+            note: "为了保护这台主机，直接访问前需要先设置一个访问口令。",
+            how: "如何设置（取决于主机的启动方式）：",
+            opt1: "命令行启动：在主机上执行 rdsh host gate set <口令>",
+            opt2: "插件启动（dsh-web-remote）：在 DSH 的「远程访问」面板里设置访问密码",
+        }
+        : {
+            title: "Direct access requires an access code",
+            heading: "Direct access denied",
+            note: "To protect this host, direct access requires an access code.",
+            how: "How to set it (depends on how the host was started):",
+            opt1: "CLI: run rdsh host gate set <code> on the host",
+            opt2: "Plugin (dsh-web-remote): set the access code in the DSH \"Remote Access\" panel",
+        };
+    return (`<!doctype html><html lang="${zh ? "zh-CN" : "en"}"><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">` +
+        `<title>${t.title}</title>` +
+        `<body style="font-family:system-ui,sans-serif;background:#f6f7f9;margin:0">` +
+        `<div style="max-width:440px;margin:64px auto;background:#fff;border:1px solid #e5e7eb;border-radius:12px;padding:24px">` +
+        `<h1 style="font-size:18px;margin:0 0 8px">${t.heading}</h1>` +
+        `<p style="font-size:13px;color:#6b7280;margin:0 0 12px">${t.note}</p>` +
+        `<p style="font-size:14px;color:#1f2937;margin:0 0 6px">${t.how}</p>` +
+        `<ol style="font-size:14px;color:#1f2937;line-height:1.8;margin:0;padding-left:20px">` +
+        `<li>${escapeHtml(t.opt1)}</li>` +
+        `<li>${escapeHtml(t.opt2)}</li>` +
+        `</ol></div></body></html>`);
+}
+/** 创建 gate 失败限流器：每 IP 连续错 N 次锁定 L 毫秒。 */
+export function createGateLimiter(maxFails = 10, lockMs = 60_000) {
+    const states = new Map();
+    return {
+        blocked(ip) {
+            const s = states.get(ip);
+            if (s === undefined)
+                return false;
+            if (s.lockedUntil > Date.now())
+                return true;
+            if (s.lockedUntil !== 0) {
+                s.lockedUntil = 0;
+                s.fails = 0;
+            }
+            return false;
+        },
+        fail(ip) {
+            const s = states.get(ip) ?? { fails: 0, lockedUntil: 0 };
+            s.fails += 1;
+            if (s.fails >= maxFails) {
+                s.fails = 0;
+                s.lockedUntil = Date.now() + lockMs;
+            }
+            states.set(ip, s);
+        },
+        clear(ip) {
+            states.delete(ip);
+        },
+    };
+}
+//# sourceMappingURL=gate.js.map

package/dist/index.d.ts

@@ -7,14 +7,13 @@ export { serve } from "./serve.ts";
 export type { ServeOptions } from "./serve.ts";
 export { SessionManager, SESSION_COOKIE, sessionTokenFromCookie } from "./session.ts";
 export type { SessionPayload } from "./session.ts";
-export { PairManager } from "./pair.ts";
 export { startGateway } from "./server.ts";
 export type { GatewayOptions, RunningGateway } from "./server.ts";
 export { findDsh, spawnDsh, dshSpawnEnv, RDSH_REMOTE_TTY, checkRemotePickerGraph, remotePickerWarning, exchangeDshSessionCookie, detectDshVersion, compareDshVersions, dshVersionWarning, DSH_COMPAT_MIN, DSH_COMPAT_MAX } from "./spawn-dsh.ts";
 export type { SpawnedDsh } from "./spawn-dsh.ts";
 export { forwardHttp, createUpgradeProxy, rewriteHeadersForDsh } from "./proxy.ts";
 export type { ProxyTarget } from "./proxy.ts";
-export { loadConfig, normalizeConfig, resolveConfigPath, saveConfig, DEFAULT_HOST_CONFIG_PATH } from "./config.ts";
+export { loadConfig, normalizeConfig, resolveConfigPath, saveConfig, generateAccessCode, DEFAULT_HOST_CONFIG_PATH } from "./config.ts";
 export type { RdshConfig, AuthMode, AuthUser, AuthConfig, TlsConfig, HostMode } from "./config.ts";
 export { hashPassword, verifyPassword, UserManager } from "./auth.ts";
 export { ipInCidrs, parseCidr, ipToInt } from "./cidr.ts";
@@ -26,6 +25,11 @@ export type { ServiceSpec } from "./service.ts";
 export declare const NAME = "rdsh-gateway";
 export { join, startJoin, registerJoin, detectInsecure, selfRevoke, patchLoopbackJs } from "./join.ts";
 export type { JoinOptions, RegisterOutcome, JoinState, JoinHooks, StartJoinOptions, JoinHandle } from "./join.ts";
+export { startDirect, lanCandidates, isPrivateIpv4 } from "./direct.ts";
+export type { DirectOptions, DirectHandle } from "./direct.ts";
+export { createDirectTicketManager } from "./direct-ticket.ts";
+export type { DirectTicketManager } from "./direct-ticket.ts";
+export { loadOrCreateDirectSecret, directSecretPath } from "./direct-secret.ts";
 export { readPersistedToken, clearPersistedToken } from "./token-store.ts";
 export { acquireJoinLock, releaseJoinLock, readJoinLock, JOIN_LOCK_PATH } from "./lock.ts";
 export type { JoinLock, JoinLockRole } from "./lock.ts";

package/dist/index.js

@@ -5,11 +5,10 @@
  */
 export { serve } from "./serve.js";
 export { SessionManager, SESSION_COOKIE, sessionTokenFromCookie } from "./session.js";
-export { PairManager } from "./pair.js";
 export { startGateway } from "./server.js";
 export { findDsh, spawnDsh, dshSpawnEnv, RDSH_REMOTE_TTY, checkRemotePickerGraph, remotePickerWarning, exchangeDshSessionCookie, detectDshVersion, compareDshVersions, dshVersionWarning, DSH_COMPAT_MIN, DSH_COMPAT_MAX } from "./spawn-dsh.js";
 export { forwardHttp, createUpgradeProxy, rewriteHeadersForDsh } from "./proxy.js";
-export { loadConfig, normalizeConfig, resolveConfigPath, saveConfig, DEFAULT_HOST_CONFIG_PATH } from "./config.js";
+export { loadConfig, normalizeConfig, resolveConfigPath, saveConfig, generateAccessCode, DEFAULT_HOST_CONFIG_PATH } from "./config.js";
 export { hashPassword, verifyPassword, UserManager } from "./auth.js";
 export { ipInCidrs, parseCidr, ipToInt } from "./cidr.js";
 export { loadTls } from "./tls.js";
@@ -17,6 +16,9 @@ export { loginPageHtml } from "./login-page.js";
 export { installService, uninstallService, serviceStatus, startService, stopService, restartService, systemdUnit, launchdPlist, SERVICE_NAME, JOIN_SERVICE_NAME, HOST_SERVICE_NAME, HUB_SERVICE_NAME } from "./service.js";
 export const NAME = "rdsh-gateway";
 export { join, startJoin, registerJoin, detectInsecure, selfRevoke, patchLoopbackJs } from "./join.js";
+export { startDirect, lanCandidates, isPrivateIpv4 } from "./direct.js";
+export { createDirectTicketManager } from "./direct-ticket.js";
+export { loadOrCreateDirectSecret, directSecretPath } from "./direct-secret.js";
 export { readPersistedToken, clearPersistedToken } from "./token-store.js";
 export { acquireJoinLock, releaseJoinLock, readJoinLock, JOIN_LOCK_PATH } from "./lock.js";
 //# sourceMappingURL=index.js.map

package/dist/join.d.ts

@@ -1,6 +1,17 @@
 import type { IncomingHttpHeaders } from "node:http";
 import type { ProxyTarget } from "./proxy.ts";
 import type { JoinLockRole } from "./lock.ts";
+/**
+ * 页面授权脚本（plain 与 raw 两条 inner dispatcher 共用，禁止各写一份）：
+ * 直连 bootstrap + （设了口令时）raw 门禁解锁 token。
+ *
+ * 为什么 raw 通道也**必须**注入：raw（E2EE）流按设计不向 host 转发任何 cookie，
+ * 页面只能靠这段脚本带 token 请求 `/__rdsh/authorize` 才能把 rawAuthorized 置真；
+ * 漏注入 ⇒ raw 门禁（accessCode 非空时为 fail-closed）永远无法满足 ⇒ 经 E2EE 的
+ * 客户端每个请求都被 CLOSE 403、表现为"一直 connecting"。
+ * （24-direct-first 首版只在 plain 注入，E2EE 客户端因此被锁死；本函数即该回归的单一来源。）
+ */
+export declare function pageAuthorizeScript(accessCode: string | null): string;
 export interface JoinOptions {
     hubUrl: string;
     /** join token（用户级，register 换 host token） */
@@ -20,6 +31,11 @@ export interface JoinOptions {
     gateway?: {
         accessCode?: string | null;
     };
+    /** 直连口（24-direct-first，A 案）：host/port 来自 host.json；缺省不监听 */
+    direct?: {
+        host?: string;
+        port?: number;
+    };
 }
 /** 注册/接入结果：解析出的 host token + 是否需 insecure + 生效的主机名（缺省=机器 hostname）。 */
 export interface RegisterOutcome {
@@ -58,6 +74,14 @@ export interface StartJoinOptions {
     gateway?: {
         accessCode?: string | null;
     };
+    /** 直连相关回调（24-direct-first；提供时启用 raw 门禁 + 候选/直连票端点） */
+    direct?: {
+        candidates: () => {
+            host: string;
+            port: number;
+        }[];
+        mintTicket: () => string;
+    };
     /** 主机名（challenge 页展示；缺省「本主机」） */
     name?: string;
     /** 宿主代持的 dsh 浏览器会话 cookie（`dsh-auth-*`，0.1.2+）；有值时注入隧道→本地转发 */