dsh-mobile 0.4.1 → 0.4.3

package/lib/index.d.mts

@@ -12,6 +12,7 @@ interface StoredDevice {
   readonly createdAt: number;
   readonly expiresAt: number;
   readonly lastSeenAt: number;
+  /** Legacy tombstone accepted on load; AccessController removes it during initialization. */
   readonly revokedAt?: number;
 }
 /** Versioned device state. Raw device and Session credentials are never members. */
@@ -154,7 +155,7 @@ declare class AccessController {
   assertCsrf(authorization: SessionAuthorization, csrfToken: string | undefined): void;
   /** End one short Session and notify the gateway to abort its attached work. */
   logout(authorization: SessionAuthorization): void;
-  /** Persist revocation, then end every Session owned by that device. */
+  /** Durably delete the device, then end every Session owned by that device. */
   revokeDevice(deviceId: string): Promise<boolean>;
   /** Remove every persistent credential and terminate every active Session. */
   resetDevices(): Promise<void>;
@@ -258,6 +259,8 @@ interface PluginConfig {
   customScriptFile?: string;
   /** Internal dedicated mobile layout browser bundle. */
   mobileLayoutFile?: string;
+  /** Standalone browser compatibility bundle used before DSH boot. */
+  mobileCompatibilityFile?: string;
   /** Stable public discovery identifier; it is not an authentication secret. */
   instanceId?: string;
   /** Managed CA certificate offered to the Android installer after fingerprint binding. */
@@ -297,6 +300,7 @@ interface ResolvedGatewayConfig {
   readonly customCssFile: string;
   readonly customScriptFile: string;
   readonly mobileLayoutFile: string;
+  readonly mobileCompatibilityFile: string;
   readonly instanceId: string;
   readonly pairingCaFile?: string;
   readonly tls: TlsConfig;
@@ -600,6 +604,15 @@ declare class MobileAccessGateway {
   private server;
   private discoverySocket;
   private discoveryTimer;
+  /**
+   * Why broadcast discovery is unavailable, if it is. Windows keeps separate TCP and
+   * UDP port-exclusion tables, so the port the OS handed the TCP listener can be
+   * refused for UDP. That degradation is survivable but must stay observable: without
+   * it, "the phone cannot find this computer" has no diagnosable cause on the host.
+   */
+  private discoveryError;
+  /** Names of the bundled mobile assets that could not be read, if any. */
+  private mobileAssetError;
   private bonjour;
   private pairingCaCertificate;
   private listenerPort;
@@ -607,6 +620,8 @@ declare class MobileAccessGateway {
   private readonly activeRequests;
   private readonly activeWebSockets;
   private readonly mobileBootBatches;
+  /** Cached upstream bundle byte sizes (HEAD probes), keyed by resource URL. */
+  private readonly bootEntrySizeCache;
   private readonly extensionEventListeners;
   private extensionEventRevision;
   private readonly taskEventListeners;
@@ -642,6 +657,19 @@ declare class MobileAccessGateway {
     port: number;
     origin: string;
   };
+  /**
+   * Report which discovery channels this gateway actually owns.
+   *
+   * Broadcast discovery degrades on its own when its UDP port cannot be bound, so
+   * callers need to tell "discovery is off" from "discovery was never attempted".
+   * mDNS is published independently and is unaffected by that failure.
+   */
+  discoveryStatus(): {
+    readonly broadcast: boolean;
+    readonly mdns: boolean;
+    readonly errorCode?: string;
+    readonly mobileAssetsErrorCode?: string;
+  };
   private requirePolicy;
   private authorize;
   private requireCsrf;
@@ -660,6 +688,20 @@ declare class MobileAccessGateway {
   private exchangeUpstreamCookie;
   private proxyMobileIndex;
   private rememberMobileBootBatch;
+  /**
+   * Determine which layout-batch entries can share a merged boot batch and which
+   * must pass through. An entry at or above the per-entry cap, or one whose size
+   * could not be probed, keeps its own upstream `/plugins` row: a merged batch
+   * cannot carry it, and an unknown bundle must not risk the whole batch.
+   */
+  private resolveMobileBootSizes;
+  /**
+   * Measure one upstream bundle by reading its body. The upstream serves
+   * `/plugins` bundles as chunked streams without a Content-Length, so a probe
+   * counts bytes; it aborts instantly past the per-entry cap. Measurements are
+   * cached for a short window.
+   */
+  private upstreamBundleSize;
   private serveMobileBootBatch;
   private startMobileBootBatchAssembly;
   private assembleMobileBootBatch;
@@ -677,7 +719,14 @@ declare class MobileAccessGateway {
   private readUpstreamClientBundleWithRetry;
   private readUpstreamClientBundle;
   private allocateRequest;
+  /**
+   * Proxy one request upstream. Pass-through client bundles (`GET /plugins`)
+   * receive bounded transient retries — the upstream resets a fraction of fresh
+   * connections — matching the resilience the merged-batch assembly already has.
+   * A request is only retried before any byte reached the client.
+   */
   private proxyHttp;
+  private proxyHttpOnce;
   private abortSessionResources;
   private broadcastExtensionChange;
   /** Fan a completed task to every phone holding this gateway's event stream. */
@@ -858,12 +907,13 @@ declare class FrpConfigStore {
 //#endregion
 //#region src/remote.d.ts
 /** Remote transports supported by the desktop plugin and Android client. */
-type RemoteProvider = 'tailscale' | 'cpolar' | 'frp';
+type RemoteProvider = 'tailscale' | 'cpolar' | 'cloudflared' | 'frp' | 'origin';
 /** Common safe status returned by every remote provider controller. */
 interface RemoteProviderStatus {
   readonly enabled: boolean;
   readonly state: string;
   readonly origin?: string;
+  readonly backendOrigin?: string;
   readonly loginUrl?: string;
   readonly setupUrl?: string;
   readonly errorCode?: string;
@@ -883,6 +933,7 @@ interface RemoteProviderState {
   readonly version: 1;
   readonly provider: RemoteProvider;
 }
+declare const REMOTE_PROVIDERS: readonly RemoteProvider[];
 /** Validate the provider selection loaded across the filesystem boundary. */
 declare function parseRemoteProviderState(value: unknown): RemoteProviderState;
 /** Atomic selection store whose absent-file state uses the configured default. */
@@ -957,6 +1008,350 @@ declare class FrpController implements RemoteProviderController {
   private stopProcessAndGateway;
 }
 //#endregion
+//#region src/origin-proxy-config.d.ts
+declare const DEFAULT_ORIGIN_LISTEN_PORT = 3444;
+/** A private HTTP listener behind a user-managed HTTPS reverse proxy. */
+interface OriginSettings {
+  readonly version: 1;
+  readonly publicOrigin: string;
+  readonly listenHost: string;
+  readonly listenPort: number;
+  readonly allowedCidrs: readonly string[];
+}
+/** Configuration metadata returned only to the local desktop control UI. */
+interface OriginConfigurationStatus {
+  readonly configured: boolean;
+  readonly publicOrigin?: string;
+  readonly listenHost?: string;
+  readonly listenPort?: number;
+  readonly allowedCidrs?: readonly string[];
+  readonly backendOrigin?: string;
+  readonly storagePath: string;
+  readonly errorCode?: string;
+}
+/** Require a public HTTPS origin; custom external ports are supported. */
+declare function validateOriginPublicOrigin(value: unknown): string;
+/** Bind only one explicit loopback or RFC1918 IPv4 interface, never all interfaces. */
+declare function validateOriginListenHost(value: unknown): string;
+declare function validateOriginListenPort(value: unknown): number;
+/** Authorize direct proxy socket peers, not untrusted forwarded client headers. */
+declare function validateOriginAllowedCidrs(value: unknown, listenHost: string): readonly string[];
+/** Validate both saved settings and local administrative requests. */
+declare function parseOriginSettings(value: unknown): OriginSettings;
+/** Owns only origin settings; shared paired-device storage is never removed. */
+declare class OriginConfigStore {
+  readonly stateRoot: string;
+  readonly settingsFile: string;
+  private settingsValue;
+  private errorCode;
+  constructor(stateDirectory: string);
+  initialize(): Promise<void>;
+  status(): OriginConfigurationStatus;
+  settings(): OriginSettings | undefined;
+  configure(value: unknown): Promise<OriginConfigurationStatus>;
+  purge(): Promise<OriginConfigurationStatus>;
+}
+//#endregion
+//#region src/origin-proxy.d.ts
+type OriginState = 'off' | 'unavailable' | 'starting' | 'ready' | 'error';
+/** Ready means the private listener is ready, not that public ingress was tested. */
+interface OriginStatus {
+  readonly enabled: boolean;
+  readonly state: OriginState;
+  readonly origin?: string;
+  readonly backendOrigin?: string;
+  readonly errorCode?: string;
+}
+interface OriginControllerOptions {
+  readonly store: MobileAccessControlStore;
+  readonly config: OriginConfigStore;
+  readonly createGateway: (settings: OriginSettings) => Promise<MobileAccessGateway>;
+  readonly onStatus?: (status: OriginStatus) => void;
+}
+/** Owns an authenticated HTTP gateway, with no tunnel process or public network probes. */
+declare class OriginController implements RemoteProviderController {
+  private readonly options;
+  private enabled;
+  private initialized;
+  private disposed;
+  private gatewayValue;
+  private latest;
+  private queue;
+  constructor(options: OriginControllerOptions);
+  initialize(): Promise<void>;
+  gateway(): MobileAccessGateway | undefined;
+  status(): OriginStatus;
+  setEnabled(enabled: boolean): Promise<OriginStatus>;
+  reconnect(): Promise<OriginStatus>;
+  /** Reset the switch, retaining both settings and shared remote device pairings. */
+  reset(): Promise<OriginStatus>;
+  /** Stop the listener without changing the durable switch. */
+  close(): Promise<void>;
+  private assertAvailable;
+  private enqueue;
+  private publish;
+  private start;
+  private stop;
+}
+//#endregion
+//#region src/cloudflared-component.d.ts
+/**
+ * Pinned cloudflared components fetched only after an explicit user action.
+ *
+ * Unlike the cpolar archive each artifact IS the executable: there is nothing
+ * to unpack, so the download digest and the installed digest are the same pair.
+ * `--no-autoupdate` is passed at runtime as well, so the pinned bytes stay the
+ * bytes that were verified.
+ */
+interface CloudflaredArtifact {
+  readonly version: string;
+  readonly platform: NodeJS.Platform;
+  readonly arch: string;
+  readonly downloadUrl: string;
+  readonly downloadBytes: number;
+  readonly downloadSha256: string;
+  readonly executableName: string;
+}
+/**
+ * Canonical release metadata. New code should select from
+ * {@link CLOUDFLARED_COMPONENT_RELEASES} by platform and architecture; this
+ * alias preserves the original Windows x64 entry for existing callers.
+ */
+declare const CLOUDFLARED_COMPONENT_RELEASE: CloudflaredArtifact;
+/**
+ * Public, credential-free description of the managed cloudflared component.
+ *
+ * There is deliberately no `configured` flag: a quick tunnel needs no account,
+ * token, or DNS record, so installation is the only precondition.
+ */
+interface CloudflaredComponentStatus {
+  readonly supported: boolean;
+  readonly installed: boolean;
+  readonly version: string;
+  readonly downloadBytes: number;
+  readonly installedBytes: number;
+  readonly sourceUrl: string;
+  readonly downloadPage: string;
+  readonly termsUrl: string;
+  readonly storagePath: string;
+  readonly errorCode?: string;
+}
+interface CloudflaredComponentManagerOptions {
+  readonly stateDirectory: string;
+  readonly platform?: NodeJS.Platform;
+  readonly arch?: string;
+  readonly fetchArtifact?: (url: string, signal: AbortSignal) => Promise<Uint8Array>;
+}
+/** Owns the optional cloudflared binary inside DSH Mobile state. */
+declare class CloudflaredComponentManager {
+  readonly executable: string;
+  readonly componentRoot: string;
+  readonly componentStorage: string;
+  readonly stateRoot: string;
+  readonly logRoot: string;
+  private readonly stagingRoot;
+  private readonly platform;
+  private readonly arch;
+  private readonly release;
+  private readonly fetchArtifact;
+  private installed;
+  private errorCode;
+  private queue;
+  constructor(options: CloudflaredComponentManagerOptions);
+  /** Inspect the managed binary without using any global cloudflared state. */
+  initialize(): Promise<void>;
+  /** Return a safe status that never includes machine-specific account data. */
+  status(): CloudflaredComponentStatus;
+  /** Download, verify, and install the pinned cloudflared executable after explicit confirmation. */
+  install(): Promise<CloudflaredComponentStatus>;
+  /** Remove every cloudflared file owned by DSH Mobile without touching global state. */
+  purge(): Promise<CloudflaredComponentStatus>;
+  private enqueue;
+}
+//#endregion
+//#region src/cloudflared-tunnel.d.ts
+/** Which tunnel flavour the cloudflared provider runs. */
+type CloudflaredTunnelMode = 'quick' | 'named';
+/**
+ * Cloudflared provider configuration.
+ *
+ * A quick tunnel owns nothing durable: cloudflared allocates a random hostname
+ * and a random forward port every start. A named tunnel instead runs with an
+ * account token, and its public hostname is routed by Cloudflare to the local
+ * port recorded here, so that port must stay stable across restarts.
+ */
+type CloudflaredTunnelSettings = {
+  readonly version: 1;
+  readonly mode: 'quick';
+} | {
+  readonly version: 1;
+  readonly mode: 'named';
+  readonly token: string;
+  readonly hostname: string;
+  readonly port: number;
+};
+/** Configuration metadata safe to hand to the desktop panel; never the token. */
+interface CloudflaredTunnelStatus {
+  readonly mode: CloudflaredTunnelMode;
+  readonly configured: boolean;
+  readonly hostname?: string;
+  readonly port?: number;
+  readonly storagePath: string;
+  readonly errorCode?: string;
+}
+/**
+ * Validate the public hostname Cloudflare routes to this tunnel.
+ *
+ * The name must be a real DNS name, not an IP literal or a wildcard, and it
+ * cannot sit under Cloudflare's own control-plane suffixes: `trycloudflare.com`
+ * belongs to quick tunnels, and a `cfargotunnel.com` name is the routing target
+ * rather than a routable public address.
+ */
+declare function validateCloudflaredTunnelHostname(value: unknown): string;
+/** Validate the stable loopback port Cloudflare's ingress forwards to. */
+declare function validateCloudflaredTunnelPort(value: unknown): number;
+/**
+ * Validate a connector token before durable storage.
+ *
+ * A token is a base64url-encoded JSON blob that carries the account, tunnel id
+ * and tunnel secret; the provider passes it through the environment rather than
+ * the command line, and it is never returned to any client.
+ */
+declare function validateCloudflaredTunnelToken(value: unknown): string;
+/** Parse tunnel settings at the request and filesystem boundaries. */
+declare function parseCloudflaredTunnelSettings(value: unknown): CloudflaredTunnelSettings;
+/**
+ * Merge a partial panel request with the saved named-tunnel settings so a blank
+ * field keeps its stored value. The token in particular is write-only, so the
+ * panel submits an empty string to mean "keep the existing connector token".
+ */
+declare function mergeSavedCloudflaredTunnelSettings(partial: Readonly<Record<string, unknown>>, saved: CloudflaredTunnelSettings | undefined): CloudflaredTunnelSettings;
+/** Owns the private cloudflared tunnel configuration for one DSH installation. */
+declare class CloudflaredTunnelStore {
+  readonly stateRoot: string;
+  readonly settingsFile: string;
+  private settingsValue;
+  private errorCode;
+  constructor(stateDirectory: string);
+  /** Load private settings while rejecting links, oversized files and unknown fields. */
+  initialize(): Promise<void>;
+  /** Return configuration metadata without exposing the connector token. */
+  status(): CloudflaredTunnelStatus;
+  /** Return private settings only to the provider lifecycle. */
+  settings(): CloudflaredTunnelSettings;
+  /** Atomically replace the tunnel configuration. */
+  configure(value: unknown): Promise<CloudflaredTunnelStatus>;
+  /** Forget a named tunnel and its connector token. */
+  purge(): Promise<CloudflaredTunnelStatus>;
+}
+//#endregion
+//#region src/cloudflared.d.ts
+/** Product-facing states for the optional cloudflared remote transport. */
+type CloudflaredState = 'off' | 'unavailable' | 'starting' | 'connecting' | 'ready' | 'error';
+/** Safe cloudflared state returned only through the loopback DSH control route. */
+interface CloudflaredStatus {
+  readonly enabled: boolean;
+  readonly state: CloudflaredState;
+  readonly origin?: string;
+  readonly errorCode?: string;
+}
+/** Inputs for one cloudflared process and its authenticated DSH gateway. */
+interface CloudflaredControllerOptions {
+  readonly store: MobileAccessControlStore;
+  readonly executable: string;
+  /** Named-tunnel configuration; quick tunnels are used when it reports quick mode. */
+  readonly tunnel: {
+    settings(): CloudflaredTunnelSettings;
+  };
+  readonly createGateway: (origin: string, listenPort: number) => Promise<MobileAccessGateway>;
+  readonly onStatus?: (status: CloudflaredStatus) => void;
+  /** Liveness bound for one startup-timeout round; defaults to the product timeout. */
+  readonly startupTimeoutMs?: number;
+  /**
+   * Total startup-timeout rounds before a live named connector is given up on;
+   * defaults to NAMED_STARTUP_ROUNDS. Quick tunnels always use a single round.
+   */
+  readonly maxStartupRounds?: number;
+  readonly spawnProcess?: (executable: string, args: readonly string[], environment: NodeJS.ProcessEnv) => ChildProcessWithoutNullStreams;
+}
+/**
+ * Extract a validated public HTTPS origin from one cloudflared output line.
+ *
+ * Quick tunnels print the public hostname inside a decorated banner, so the
+ * candidate is taken from the line and then re-parsed as a URL: a lookalike such
+ * as `https://x.trycloudflare.com.evil.test` fails the hostname check instead of
+ * being truncated into an accepted origin.
+ */
+declare function parseCloudflaredOrigin(line: string): string | undefined;
+/**
+ * Whether one cloudflared log line reports an established edge connection.
+ *
+ * A named tunnel prints no banner, so registration is the only signal that the
+ * connector reached Cloudflare and the public hostname can serve traffic. Both
+ * the current and the older wording are accepted; anything else is ignored so a
+ * chatty log line cannot be mistaken for readiness.
+ */
+declare function isCloudflaredRegistration(line: string): boolean;
+/**
+ * Owns an installed cloudflared client and a provider-specific DSH remote gateway.
+ *
+ * Quick tunnels allocate a random hostname and a random forward port on every
+ * start. Named tunnels instead read an account token and a stable public
+ * hostname from the tunnel store, forward to the configured loopback port, and
+ * learn readiness from the connector's registration line rather than a banner.
+ */
+declare class CloudflaredController implements RemoteProviderController {
+  private readonly options;
+  private enabled;
+  private initialized;
+  private disposed;
+  private child;
+  private gatewayValue;
+  private reservation;
+  private generation;
+  private buffer;
+  private mode;
+  private namedOrigin;
+  private latest;
+  private queue;
+  private startupTimer;
+  private startupRounds;
+  constructor(options: CloudflaredControllerOptions);
+  /** Restore the remembered cloudflared switch independently from LAN and other providers. */
+  initialize(): Promise<void>;
+  /** Return the active cloudflared-backed DSH gateway. */
+  gateway(): MobileAccessGateway | undefined;
+  /** Return state safe for the desktop control UI. */
+  status(): CloudflaredStatus;
+  /** Enable or disable cloudflared without changing LAN or other provider state. */
+  setEnabled(enabled: boolean): Promise<CloudflaredStatus>;
+  /** Restart cloudflared and allocate a fresh quick tunnel. */
+  reconnect(): Promise<CloudflaredStatus>;
+  /** Disable cloudflared without deleting the installed component. */
+  reset(): Promise<CloudflaredStatus>;
+  /** Stop owned resources without changing the remembered switch. */
+  close(): Promise<void>;
+  private enqueue;
+  private publish;
+  private start;
+  private armStartupTimer;
+  /**
+   * Give a live named connector more time instead of killing it: it retries the
+   * edge on its own and usually registers once the rebooted network is usable.
+   * A dead connector, or an exhausted budget, fails the generation as before.
+   */
+  private checkStartupTimeout;
+  private consume;
+  /** Mark a named tunnel ready once the connector has registered with the edge. */
+  private confirmNamedReady;
+  private attachGateway;
+  /** Replace the gateway authority when a quick tunnel restarts on a new hostname. */
+  private rotateGateway;
+  private failGeneration;
+  private stop;
+  private stopProcessAndGateway;
+}
+//#endregion
 //#region src/task-events.d.ts
 /**
  * Host-side task-completion fan-out for phone notifications.
@@ -1025,8 +1420,10 @@ declare class TaskEventHub {
 declare const name = "dsh-mobile";
 /** The stock WebServer serves the control card; Connection authenticates the loopback DSH origin. */
 declare const inject: string[];
+/** Reuse remote HTTPS policy while binding a separately validated private HTTP origin. */
+declare function originGatewayConfig(template: ResolvedGatewayConfig, settings: OriginSettings, stateFile: string, instanceId: string, listenPort?: number): ResolvedGatewayConfig;
 /** Mount the resident control route and its optional authenticated LAN gateway. */
 declare function apply(ctx: Context, config: PluginConfig): Promise<void>;
 //#endregion
-export { AUTH_PREFIX, AccessController, type AccessControllerOptions, AccessError, type AuthoritySpec, type BlockedUpgradePathEntry, BlockedUpgradePathLog, BoundedRateLimiter, CSRF_COOKIE, CSRF_HEADER, Config, FRP_VHOST_HTTP_PORT as DEFAULT_VHOST_HTTP_PORT, FRP_VHOST_HTTP_PORT, DEVICE_COOKIE, type DeviceProbeResult, type DeviceSnapshot, type DeviceStore, type DeviceSummary, type DisabledTlsConfig, EXTENSION_LIMITS, FRP_CADDY_IMPORT_LINE, FRP_CADDY_SNIPPET_MARKER, FRP_CADDY_SNIPPET_PATH, FRP_COMPONENT_RELEASES, FrpComponentManager, type FrpComponentStatus, FrpConfigStore, type FrpConfigurationStatus, FrpController, type FrpControllerOptions, type FrpSettings, type FrpState, type FrpStatus, JsonDeviceStore, JsonMobileAccessControlStore, JsonRemoteProviderStore, LOCAL_ADMIN_PREFIX, type LocalExtensionManifest, MAX_BLOCKED_UPGRADE_PATHS, MAX_EXTRA_WEBSOCKET_PATHS, MAX_WEBSOCKET_PATH_LENGTH, MemoryDeviceStore, type MobileAccessControlState, type MobileAccessControlStore, MobileAccessGateway, MobileAccessGatewayController, type MobileAccessService as MobileAccessRegistry, MobileAccessService, type MobileAccessRuntime, type MobileActionContext, type MobileExtensionClientEntry, type MobileExtensionDefinition, MobileExtensionError, type MobileExtensionManifest, type MobileExtensionStatus, type MobileHostAction, type MobileHostRoute, type MobileRouteRequest, type MobileRouteResponse, type PairingResult, type ParsedCidr, type PluginConfig, type ProvidedTlsConfig, type RemoteProvider, type RemoteProviderController, type RemoteProviderState, type RemoteProviderStatus, type RenewalResult, RequestTrustPolicy, type ResolvedGatewayConfig, SESSION_COOKIE, type SessionAuthorization, type SessionEndReason, type StoredDevice, TASK_EVENT_DEBOUNCE_MS, type TaskCompletionEvent, type TaskEventContext, TaskEventHub, type TaskEventSession, type TaskEventSink, type TaskEventWatcherOptions, type TaskTurnEvent, type TlsConfig, WS_PATHS, WebSocketPathStore, addressAllowed, apply, assertExtensionId, configuredRemoteProvider, createCaddySite, createFrpServerTemplate, createFrpcToml, createMobileAccessService, createRestrictedFrpServerTemplate, inject, isGloballyRoutableIpv4, isLoopbackAddress, mergeSavedFrpSettings, mergeSavedFrpTarget, name, normalizeWebSocketPaths, parseAuthority, parseCidr, parseControlFile, parseDeviceSnapshot, parseExtensionManifest, parseFrpSettings, parseGatewayConfig, parseMobileAccessControlState, parseRemoteProviderState, resolveAuthority, rewriteMobileIndex, validateFrpPublicOrigin, validateFrpServerAddress, validateFrpServerPort, validateFrpToken, validateWebSocketPath, watchTaskCompletions };
+export { AUTH_PREFIX, AccessController, type AccessControllerOptions, AccessError, type AuthoritySpec, type BlockedUpgradePathEntry, BlockedUpgradePathLog, BoundedRateLimiter, CLOUDFLARED_COMPONENT_RELEASE, CSRF_COOKIE, CSRF_HEADER, CloudflaredComponentManager, type CloudflaredComponentStatus, CloudflaredController, type CloudflaredControllerOptions, type CloudflaredState, type CloudflaredStatus, type CloudflaredTunnelMode, type CloudflaredTunnelSettings, type CloudflaredTunnelStatus, CloudflaredTunnelStore, Config, DEFAULT_ORIGIN_LISTEN_PORT, FRP_VHOST_HTTP_PORT as DEFAULT_VHOST_HTTP_PORT, FRP_VHOST_HTTP_PORT, DEVICE_COOKIE, type DeviceProbeResult, type DeviceSnapshot, type DeviceStore, type DeviceSummary, type DisabledTlsConfig, EXTENSION_LIMITS, FRP_CADDY_IMPORT_LINE, FRP_CADDY_SNIPPET_MARKER, FRP_CADDY_SNIPPET_PATH, FRP_COMPONENT_RELEASES, FrpComponentManager, type FrpComponentStatus, FrpConfigStore, type FrpConfigurationStatus, FrpController, type FrpControllerOptions, type FrpSettings, type FrpState, type FrpStatus, JsonDeviceStore, JsonMobileAccessControlStore, JsonRemoteProviderStore, LOCAL_ADMIN_PREFIX, type LocalExtensionManifest, MAX_BLOCKED_UPGRADE_PATHS, MAX_EXTRA_WEBSOCKET_PATHS, MAX_WEBSOCKET_PATH_LENGTH, MemoryDeviceStore, type MobileAccessControlState, type MobileAccessControlStore, MobileAccessGateway, MobileAccessGatewayController, type MobileAccessService as MobileAccessRegistry, MobileAccessService, type MobileAccessRuntime, type MobileActionContext, type MobileExtensionClientEntry, type MobileExtensionDefinition, MobileExtensionError, type MobileExtensionManifest, type MobileExtensionStatus, type MobileHostAction, type MobileHostRoute, type MobileRouteRequest, type MobileRouteResponse, OriginConfigStore, type OriginConfigurationStatus, OriginController, type OriginControllerOptions, type OriginSettings, type OriginState, type OriginStatus, type PairingResult, type ParsedCidr, type PluginConfig, type ProvidedTlsConfig, REMOTE_PROVIDERS, type RemoteProvider, type RemoteProviderController, type RemoteProviderState, type RemoteProviderStatus, type RenewalResult, RequestTrustPolicy, type ResolvedGatewayConfig, SESSION_COOKIE, type SessionAuthorization, type SessionEndReason, type StoredDevice, TASK_EVENT_DEBOUNCE_MS, type TaskCompletionEvent, type TaskEventContext, TaskEventHub, type TaskEventSession, type TaskEventSink, type TaskEventWatcherOptions, type TaskTurnEvent, type TlsConfig, WS_PATHS, WebSocketPathStore, addressAllowed, apply, assertExtensionId, configuredRemoteProvider, createCaddySite, createFrpServerTemplate, createFrpcToml, createMobileAccessService, createRestrictedFrpServerTemplate, inject, isCloudflaredRegistration, isGloballyRoutableIpv4, isLoopbackAddress, mergeSavedCloudflaredTunnelSettings, mergeSavedFrpSettings, mergeSavedFrpTarget, name, normalizeWebSocketPaths, originGatewayConfig, parseAuthority, parseCidr, parseCloudflaredOrigin, parseCloudflaredTunnelSettings, parseControlFile, parseDeviceSnapshot, parseExtensionManifest, parseFrpSettings, parseGatewayConfig, parseMobileAccessControlState, parseOriginSettings, parseRemoteProviderState, resolveAuthority, rewriteMobileIndex, validateCloudflaredTunnelHostname, validateCloudflaredTunnelPort, validateCloudflaredTunnelToken, validateFrpPublicOrigin, validateFrpServerAddress, validateFrpServerPort, validateFrpToken, validateOriginAllowedCidrs, validateOriginListenHost, validateOriginListenPort, validateOriginPublicOrigin, validateWebSocketPath, watchTaskCompletions };
 //# sourceMappingURL=index.d.mts.map