dsh-mobile 0.4.2 → 0.4.3

package/lib/index.d.mts

@@ -620,6 +620,8 @@ declare class MobileAccessGateway {
   private readonly activeRequests;
   private readonly activeWebSockets;
   private readonly mobileBootBatches;
+  /** Cached upstream bundle byte sizes (HEAD probes), keyed by resource URL. */
+  private readonly bootEntrySizeCache;
   private readonly extensionEventListeners;
   private extensionEventRevision;
   private readonly taskEventListeners;
@@ -686,6 +688,20 @@ declare class MobileAccessGateway {
   private exchangeUpstreamCookie;
   private proxyMobileIndex;
   private rememberMobileBootBatch;
+  /**
+   * Determine which layout-batch entries can share a merged boot batch and which
+   * must pass through. An entry at or above the per-entry cap, or one whose size
+   * could not be probed, keeps its own upstream `/plugins` row: a merged batch
+   * cannot carry it, and an unknown bundle must not risk the whole batch.
+   */
+  private resolveMobileBootSizes;
+  /**
+   * Measure one upstream bundle by reading its body. The upstream serves
+   * `/plugins` bundles as chunked streams without a Content-Length, so a probe
+   * counts bytes; it aborts instantly past the per-entry cap. Measurements are
+   * cached for a short window.
+   */
+  private upstreamBundleSize;
   private serveMobileBootBatch;
   private startMobileBootBatchAssembly;
   private assembleMobileBootBatch;
@@ -703,7 +719,14 @@ declare class MobileAccessGateway {
   private readUpstreamClientBundleWithRetry;
   private readUpstreamClientBundle;
   private allocateRequest;
+  /**
+   * Proxy one request upstream. Pass-through client bundles (`GET /plugins`)
+   * receive bounded transient retries — the upstream resets a fraction of fresh
+   * connections — matching the resilience the merged-batch assembly already has.
+   * A request is only retried before any byte reached the client.
+   */
   private proxyHttp;
+  private proxyHttpOnce;
   private abortSessionResources;
   private broadcastExtensionChange;
   /** Fan a completed task to every phone holding this gateway's event stream. */
@@ -1073,23 +1096,28 @@ declare class OriginController implements RemoteProviderController {
 //#endregion
 //#region src/cloudflared-component.d.ts
 /**
- * Pinned cloudflared Windows component fetched only after an explicit user action.
+ * Pinned cloudflared components fetched only after an explicit user action.
  *
- * Unlike the cpolar archive this artifact IS the executable: there is nothing to
- * unpack, so the download digest and the installed digest are the same pair.
+ * Unlike the cpolar archive each artifact IS the executable: there is nothing
+ * to unpack, so the download digest and the installed digest are the same pair.
  * `--no-autoupdate` is passed at runtime as well, so the pinned bytes stay the
  * bytes that were verified.
  */
-declare const CLOUDFLARED_COMPONENT_RELEASE: Readonly<{
-  version: "2026.9.1";
-  platform: "win32";
-  arch: "x64";
-  downloadUrl: "https://github.com/cloudflare/cloudflared/releases/download/2026.9.1/cloudflared-windows-amd64.exe";
-  downloadBytes: 54976432;
-  downloadSha256: "2837888cc0f5d58f15b6dc478376de90b4d3ba5241c7947455d1e0a0df429712";
-  downloadPage: "https://github.com/cloudflare/cloudflared/releases";
-  termsUrl: "https://www.cloudflare.com/website-terms/";
-}>;
+interface CloudflaredArtifact {
+  readonly version: string;
+  readonly platform: NodeJS.Platform;
+  readonly arch: string;
+  readonly downloadUrl: string;
+  readonly downloadBytes: number;
+  readonly downloadSha256: string;
+  readonly executableName: string;
+}
+/**
+ * Canonical release metadata. New code should select from
+ * {@link CLOUDFLARED_COMPONENT_RELEASES} by platform and architecture; this
+ * alias preserves the original Windows x64 entry for existing callers.
+ */
+declare const CLOUDFLARED_COMPONENT_RELEASE: CloudflaredArtifact;
 /**
  * Public, credential-free description of the managed cloudflared component.
  *
@@ -1124,6 +1152,7 @@ declare class CloudflaredComponentManager {
   private readonly stagingRoot;
   private readonly platform;
   private readonly arch;
+  private readonly release;
   private readonly fetchArtifact;
   private installed;
   private errorCode;
@@ -1236,8 +1265,13 @@ interface CloudflaredControllerOptions {
   };
   readonly createGateway: (origin: string, listenPort: number) => Promise<MobileAccessGateway>;
   readonly onStatus?: (status: CloudflaredStatus) => void;
-  /** Liveness bound for one quick-tunnel allocation; defaults to the product timeout. */
+  /** Liveness bound for one startup-timeout round; defaults to the product timeout. */
   readonly startupTimeoutMs?: number;
+  /**
+   * Total startup-timeout rounds before a live named connector is given up on;
+   * defaults to NAMED_STARTUP_ROUNDS. Quick tunnels always use a single round.
+   */
+  readonly maxStartupRounds?: number;
   readonly spawnProcess?: (executable: string, args: readonly string[], environment: NodeJS.ProcessEnv) => ChildProcessWithoutNullStreams;
 }
 /**
@@ -1281,6 +1315,7 @@ declare class CloudflaredController implements RemoteProviderController {
   private latest;
   private queue;
   private startupTimer;
+  private startupRounds;
   constructor(options: CloudflaredControllerOptions);
   /** Restore the remembered cloudflared switch independently from LAN and other providers. */
   initialize(): Promise<void>;
@@ -1299,6 +1334,13 @@ declare class CloudflaredController implements RemoteProviderController {
   private enqueue;
   private publish;
   private start;
+  private armStartupTimer;
+  /**
+   * Give a live named connector more time instead of killing it: it retries the
+   * edge on its own and usually registers once the rebooted network is usable.
+   * A dead connector, or an exhausted budget, fails the generation as before.
+   */
+  private checkStartupTimeout;
   private consume;
   /** Mark a named tunnel ready once the connector has registered with the edge. */
   private confirmNamedReady;