@dsh-remote/relay 3.1.0 → 3.1.2

package/dist/bundle/main.js

@@ -2279,7 +2279,7 @@ var require_websocket = __commonJS({
     var http = __require("http");
     var net = __require("net");
     var tls = __require("tls");
-    var { randomBytes: randomBytes2, createHash } = __require("crypto");
+    var { randomBytes: randomBytes3, createHash } = __require("crypto");
     var { Duplex, Readable } = __require("stream");
     var { URL: URL2 } = __require("url");
     var PerMessageDeflate2 = require_permessage_deflate();
@@ -2830,7 +2830,7 @@ var require_websocket = __commonJS({
         }
       }
       const defaultPort = isSecure ? 443 : 80;
-      const key = randomBytes2(16).toString("base64");
+      const key = randomBytes3(16).toString("base64");
       const request = isSecure ? https.request : http.request;
       const protocolSet = /* @__PURE__ */ new Set();
       let perMessageDeflate;
@@ -23394,7 +23394,7 @@ function date4(params) {
   return _coercedDate(ZodDate, params);
 }
 
-// node_modules/.pnpm/@dsh-remote+protocol@3.0.4/node_modules/@dsh-remote/protocol/dist/src/wire/limits.js
+// node_modules/.pnpm/@dsh-remote+protocol@3.0.6/node_modules/@dsh-remote/protocol/dist/src/wire/limits.js
 var MAX_RELAY_MESSAGE_BYTES = 1024 * 1024;
 var MAX_CIPHERTEXT_BYTES = MAX_RELAY_MESSAGE_BYTES - 8 * 1024;
 var MAX_IMAGE_ATTACHMENTS = 4;
@@ -23403,7 +23403,7 @@ var MAX_ATTACHMENT_BYTES = 512 * 1024;
 var MAX_ATTACHMENT_TOTAL_BYTES = 512 * 1024;
 var IDEMPOTENCY_WINDOW_MS = 5 * 60 * 1e3;
 
-// node_modules/.pnpm/@dsh-remote+protocol@3.0.4/node_modules/@dsh-remote/protocol/dist/src/wire/frames.js
+// node_modules/.pnpm/@dsh-remote+protocol@3.0.6/node_modules/@dsh-remote/protocol/dist/src/wire/frames.js
 var PROTOCOL_VERSION = 1;
 var MIN_SUPPORTED_PROTOCOL = 1;
 var PAIRING_TOKEN_RE = /^\d{6}$/;
@@ -23855,7 +23855,7 @@ function loadConfig(env, version2) {
 
 // src/server.ts
 import { createServer } from "node:http";
-import { randomUUID as randomUUID2, timingSafeEqual } from "node:crypto";
+import { randomBytes as randomBytes2, randomUUID as randomUUID2, timingSafeEqual } from "node:crypto";
 
 // node_modules/.pnpm/ws@8.22.0/node_modules/ws/wrapper.mjs
 var import_stream = __toESM(require_stream(), 1);
@@ -23867,7 +23867,7 @@ var import_subprotocol = __toESM(require_subprotocol(), 1);
 var import_websocket = __toESM(require_websocket(), 1);
 var import_websocket_server = __toESM(require_websocket_server(), 1);
 
-// node_modules/.pnpm/@dsh-remote+protocol@3.0.4/node_modules/@dsh-remote/protocol/dist/src/identity/ids.js
+// node_modules/.pnpm/@dsh-remote+protocol@3.0.6/node_modules/@dsh-remote/protocol/dist/src/identity/ids.js
 import { randomBytes, randomUUID } from "node:crypto";
 var CONVERSATION_ID_PREFIX = "c_";
 function newConversationId() {
@@ -23877,10 +23877,10 @@ function newHostId() {
   return randomBytes(4).toString("hex");
 }
 
-// node_modules/.pnpm/@dsh-remote+protocol@3.0.4/node_modules/@dsh-remote/protocol/dist/src/platform/sleep.js
+// node_modules/.pnpm/@dsh-remote+protocol@3.0.6/node_modules/@dsh-remote/protocol/dist/src/platform/sleep.js
 var SLEEP_BACKENDS = ["caffeinate", "systemd-inhibit", "unsupported"];
 
-// node_modules/.pnpm/@dsh-remote+protocol@3.0.4/node_modules/@dsh-remote/protocol/dist/src/wire/payloads.js
+// node_modules/.pnpm/@dsh-remote+protocol@3.0.6/node_modules/@dsh-remote/protocol/dist/src/wire/payloads.js
 var SESSION_STATES = [
   "idle",
   "running",
@@ -24291,7 +24291,7 @@ var PAYLOAD_TYPES = {
   evSessionHistory: "ev.session_history"
 };
 
-// node_modules/.pnpm/@dsh-remote+protocol@3.0.4/node_modules/@dsh-remote/protocol/dist/src/wire/registry.js
+// node_modules/.pnpm/@dsh-remote+protocol@3.0.6/node_modules/@dsh-remote/protocol/dist/src/wire/registry.js
 var ENDPOINT_FRAME_NAMES = [
   "hello",
   "pair-begin",
@@ -24383,7 +24383,7 @@ var CAPABILITY_IDS = [
 ];
 var CAPABILITY_SET = new Set(CAPABILITY_IDS);
 
-// node_modules/.pnpm/@dsh-remote+protocol@3.0.4/node_modules/@dsh-remote/protocol/dist/src/wire/negotiate.js
+// node_modules/.pnpm/@dsh-remote+protocol@3.0.6/node_modules/@dsh-remote/protocol/dist/src/wire/negotiate.js
 function negotiateProtocol(peerProtocol, own2 = PROTOCOL_VERSION, min = MIN_SUPPORTED_PROTOCOL) {
   if (peerProtocol === void 0 || peerProtocol === null) {
     return verdictFor(1, own2, min, true);
@@ -24423,13 +24423,13 @@ function verdictFor(peer, own2, min, missing) {
   return { ok: true, version: peer, missing };
 }
 
-// node_modules/.pnpm/@dsh-remote+protocol@3.0.4/node_modules/@dsh-remote/protocol/dist/src/wire/errors.js
+// node_modules/.pnpm/@dsh-remote+protocol@3.0.6/node_modules/@dsh-remote/protocol/dist/src/wire/errors.js
 var WAIT_HINTABLE = /* @__PURE__ */ new Set(["rate_limited", "pair_table_full"]);
 function wantsRetryAfter(code) {
   return typeof code === "string" && WAIT_HINTABLE.has(code);
 }
 
-// node_modules/.pnpm/@dsh-remote+protocol@3.0.4/node_modules/@dsh-remote/protocol/dist/src/wire/outbound.js
+// node_modules/.pnpm/@dsh-remote+protocol@3.0.6/node_modules/@dsh-remote/protocol/dist/src/wire/outbound.js
 function helloOkForClient(clientId, protocol) {
   return { t: "hello-ok", role: "client", clientId, ...protocol === void 0 ? {} : { protocol } };
 }
@@ -24507,7 +24507,7 @@ function encBatchToRelay(sessionId, items) {
   return { t: "enc-batch", sessionId, items: items.map((item) => ({ ...item })) };
 }
 
-// node_modules/.pnpm/@dsh-remote+protocol@3.0.4/node_modules/@dsh-remote/protocol/dist/src/wire/classify.js
+// node_modules/.pnpm/@dsh-remote+protocol@3.0.6/node_modules/@dsh-remote/protocol/dist/src/wire/classify.js
 function frameTypeOf(value) {
   if (typeof value !== "object" || value === null || Array.isArray(value))
     return void 0;
@@ -25147,6 +25147,8 @@ function tokenMatches(expected, got) {
   if (a.length !== b.length) return false;
   return timingSafeEqual(a, b);
 }
+var CLAIM_MIN_INTERVAL_MS = 4e3;
+var CLAIM_TRACK_MAX = 1e4;
 function createRelay(config2) {
   const log = new Log(config2.logLevel);
   const state = new RelayState({ maxPendingPairs: config2.maxPendingPairs });
@@ -25155,10 +25157,24 @@ function createRelay(config2) {
   const pairStatusBudget = new Budget(config2.pairStatusBudgetPerSec);
   const peers = /* @__PURE__ */ new WeakMap();
   let shuttingDown = false;
+  let currentHostToken = config2.hostToken;
+  const lastClaimAt = /* @__PURE__ */ new Map();
   let sweepTimer;
   let pingTimer;
   let lastPingAt = 0;
   let lastCountersAt = 0;
+  function rotateHostToken() {
+    currentHostToken = randomBytes2(24).toString("hex");
+    if (lastClaimAt.size >= CLAIM_TRACK_MAX) {
+      const drop = lastClaimAt.size - CLAIM_TRACK_MAX + 1;
+      let i = 0;
+      for (const key of lastClaimAt.keys()) {
+        lastClaimAt.delete(key);
+        if (++i >= drop) break;
+      }
+    }
+    return currentHostToken;
+  }
   const persistence = { enabled: config2.stateFile !== "", restored: 0, savedAt: 0, writes: 0, failures: 0 };
   if (persistence.enabled) {
     persistence.restored = restoreState(config2.stateFile, state, log, startedAt);
@@ -25284,12 +25300,12 @@ function createRelay(config2) {
     }
     peer.protocol = frame.protocol;
     if (frame.role === "host") {
-      if (!config2.hostToken) {
+      if (!currentHostToken) {
         sendError(peer, "internal", "relay has no host token configured");
         peer.ws.close(1011);
         return;
       }
-      if (!frame.token || !tokenMatches(config2.hostToken, frame.token)) {
+      if (!frame.token || !tokenMatches(currentHostToken, frame.token)) {
         peer.authAttempts += 1;
         log.warn("host auth failed", { attempts: peer.authAttempts });
         sendError(peer, "bad_token");
@@ -25765,6 +25781,31 @@ function createRelay(config2) {
         res.end(JSON.stringify(health()));
         return;
       }
+      if (url2.pathname === "/api/claim-token") {
+        if (req.method !== "POST") {
+          res.statusCode = 405;
+          res.end(JSON.stringify({ error: "use POST" }));
+          return;
+        }
+        if (shuttingDown) {
+          res.statusCode = 503;
+          res.end(JSON.stringify({ error: "shutting_down" }));
+          return;
+        }
+        const now = Date.now();
+        const ip = req.socket.remoteAddress ?? "unknown";
+        const last = lastClaimAt.get(ip) ?? 0;
+        if (now - last < CLAIM_MIN_INTERVAL_MS) {
+          res.statusCode = 429;
+          res.end(JSON.stringify({ error: "too_soon", retryAfterMs: CLAIM_MIN_INTERVAL_MS - (now - last) }));
+          return;
+        }
+        lastClaimAt.set(ip, now);
+        const token = rotateHostToken();
+        log.info("host token claimed", { ip });
+        res.end(JSON.stringify({ token, rotatedAt: new Date(now).toISOString() }));
+        return;
+      }
       if (url2.pathname === "/api/info") {
         res.end(JSON.stringify({ publicUrl: config2.publicUrl, protocol: PROTOCOL_VERSION }));
         return;
@@ -25951,7 +25992,7 @@ function registerSignalHandlers(shutdown) {
 
 // src/main.ts
 function readVersion() {
-  if ("3.1.0") return "3.1.0";
+  if ("3.1.2") return "3.1.2";
   try {
     const pkg = JSON.parse(readFileSync2(new URL("../../package.json", import.meta.url), "utf8"));
     if (typeof pkg.version === "string") return pkg.version;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dsh-remote/relay",
-  "version": "3.1.0",
+  "version": "3.1.2",
   "description": "DSH Remote Control 的零知识 WebSocket 中继：只做路由，不碰载荷明文。可自托管的单文件产物。",
   "type": "module",
   "license": "MIT",