dsh-mobile 0.4.2 → 0.4.4

package/lib/index.mjs

@@ -877,6 +877,17 @@ var FollowingMobileAccessRuntime = class {
 	async initialize(refreshIntervalMs) {
 		await this.refresh();
 		if (refreshIntervalMs === void 0) return;
+		this.beginPolling(refreshIntervalMs);
+	}
+	/**
+	* Arm the refresh poller without requiring an initial selection.
+	* Boot-degraded path: the first selection already failed (e.g. the saved
+	* LAN is down), but later refreshes must still get their chance so a
+	* returning network recovers without a restart. Failures keep flowing to
+	* onRefreshError; close() stays the single teardown.
+	*/
+	beginPolling(refreshIntervalMs) {
+		if (this.timer !== void 0) return;
 		this.timer = setInterval(() => {
 			this.refresh().catch(this.onRefreshError);
 		}, refreshIntervalMs);
@@ -2424,6 +2435,19 @@ const MOBILE_LAYOUT_PATH = `${AUTH_PREFIX}/mobile-layout.js`;
 const MOBILE_BOOT_BATCH_PREFIX = `${AUTH_PREFIX}/mobile-boot/`;
 const MAX_MOBILE_BOOT_BATCH_BYTES = 33554432;
 const MAX_MOBILE_BOOT_ENTRY_BYTES = 8388608;
+/**
+* Per-merged-batch byte budget. One upstream application batch can carry dozens
+* of client bundles whose combined size exceeds the hard batch cap; the layout
+* batch is therefore chunked into multiple merged batches, each kept safely
+* below {@link MAX_MOBILE_BOOT_BATCH_BYTES} so assembly can never reject it.
+*/
+const MOBILE_BOOT_CHUNK_BYTES = 16777216;
+/** Bytes the assembly emits after each entry (`body` plus `\n;\n`). */
+const MOBILE_BOOT_SEPARATOR_BYTES = 3;
+/** Freshness window for cached upstream bundle byte sizes. */
+const MOBILE_BOOT_SIZE_CACHE_TTL_MS = 3e4;
+/** Marker header distinguishing size probes from ordinary proxied bundle fetches. */
+const MOBILE_BOOT_SIZE_PROBE_HEADER = "x-dsh-mobile-size-probe";
 const MAX_MOBILE_BOOT_BATCHES = 8;
 const MOBILE_BOOT_UPSTREAM_ATTEMPTS = 4;
 const MOBILE_BOOT_RETRY_DELAY_MS = 150;
@@ -2508,11 +2532,17 @@ function revisionedMobileBatchPath(entries) {
 		path: `${MOBILE_BOOT_BATCH_PREFIX}${key}.js`
 	};
 }
-function rewriteMobileIndexWithBatch(html) {
+/**
+* Parse one upstream boot manifest and rewire the layout entry onto the
+* gateway-owned layout module. The layout entry's URL and revision become the
+* local `mobile-layout.js` path; the dedicated frontend is authenticated in the
+* gateway, so the requested layout needs no upstream address.
+*/
+function parseMobileBootPlan(html) {
 	const assignment = /(?:window\.__DSH_BOOT__|globalThis\["__DSH_BOOT__"\])\s*=\s*/u.exec(html);
 	if (assignment?.index === void 0) throw new Error("upstream DSH index has no boot manifest");
-	const start = assignment.index;
-	const valueStart = start + assignment[0].length;
+	const replaceStart = assignment.index;
+	const valueStart = replaceStart + assignment[0].length;
 	const scriptEnd = html.indexOf("<\/script>", valueStart);
 	if (scriptEnd < 0) throw new Error("upstream DSH boot manifest script is incomplete");
 	const source = html.slice(valueStart, scriptEnd).trim().replace(/;$/u, "");
@@ -2526,45 +2556,122 @@ function rewriteMobileIndexWithBatch(html) {
 	if (dependencyProfile === void 0) throw new Error("upstream DSH layout module has unsupported dependencies");
 	layout[0].url = MOBILE_LAYOUT_PATH;
 	layout[0].rev = `dsh-mobile-layout-${DSH_MOBILE_VERSION}`;
-	const remoteSettings = orderAuthenticatedSettings(entries, dependencyProfile.slots);
-	let mobileBatch;
-	if (parsed.batches !== void 0) {
-		if (!Array.isArray(parsed.batches)) throw new Error("upstream DSH boot manifest batches are malformed");
-		const batches = parsed.batches;
-		const entryById = new Map(entries.map((entry) => [entry.id, entry]));
-		if (entryById.size !== entries.length) throw new Error("upstream DSH boot manifest has duplicate entries");
-		const layoutBatches = [];
-		for (const batch of batches) {
-			if (batch === null || typeof batch !== "object" || batch.phase !== "bootstrap" && batch.phase !== "application" || typeof batch.url !== "string" || typeof batch.rev !== "string" || !Array.isArray(batch.entries) || batch.entries.length === 0 || batch.entries.some((id) => typeof id !== "string" || !entryById.has(id))) throw new Error("upstream DSH boot manifest batches are malformed");
-			if (batch.entries.includes(MOBILE_LAYOUT_MODULE)) layoutBatches.push(batch);
-		}
-		if (layoutBatches.length !== 1 || layoutBatches[0]?.phase !== "application") throw new Error("upstream DSH boot manifest has no unique application layout batch");
-		const layoutBatch = layoutBatches[0];
-		const planEntries = layoutBatch.entries.map((id) => {
-			const entry = entryById.get(id);
-			if (entry === void 0 || typeof entry.url !== "string" || typeof entry.rev !== "string") throw new Error("upstream DSH boot manifest batches are malformed");
-			return Object.freeze({
-				id,
+	const parsedBatches = parsed.batches;
+	if (parsedBatches === void 0) return Object.freeze({
+		parsed,
+		entries,
+		slotProvider: dependencyProfile.slots,
+		assignment: assignment[0],
+		replaceStart,
+		replaceEnd: scriptEnd
+	});
+	if (!Array.isArray(parsedBatches)) throw new Error("upstream DSH boot manifest batches are malformed");
+	const batches = parsedBatches;
+	const entryById = new Map(entries.map((entry) => [entry.id, entry]));
+	if (entryById.size !== entries.length) throw new Error("upstream DSH boot manifest has duplicate entries");
+	const layoutBatches = [];
+	for (const batch of batches) {
+		if (batch === null || typeof batch !== "object" || batch.phase !== "bootstrap" && batch.phase !== "application" || typeof batch.url !== "string" || typeof batch.rev !== "string" || !Array.isArray(batch.entries) || batch.entries.length === 0 || batch.entries.some((id) => typeof id !== "string" || !entryById.has(id))) throw new Error("upstream DSH boot manifest batches are malformed");
+		if (batch.entries.includes(MOBILE_LAYOUT_MODULE)) layoutBatches.push(batch);
+	}
+	if (layoutBatches.length !== 1 || layoutBatches[0]?.phase !== "application") throw new Error("upstream DSH boot manifest has no unique application layout batch");
+	const layoutBatch = layoutBatches[0];
+	const planEntries = layoutBatch.entries.map((id) => {
+		const entry = entryById.get(id);
+		if (entry === void 0 || typeof entry.url !== "string" || typeof entry.rev !== "string") throw new Error("upstream DSH boot manifest batches are malformed");
+		return Object.freeze({
+			id,
+			url: entry.url,
+			rev: entry.rev
+		});
+	});
+	return Object.freeze({
+		parsed,
+		entries,
+		batches,
+		slotProvider: dependencyProfile.slots,
+		assignment: assignment[0],
+		replaceStart,
+		replaceEnd: scriptEnd,
+		layoutBatch,
+		planEntries
+	});
+}
+/**
+* Partition one upstream application batch into merged batches plus pass-through
+* rows. Every entry whose bundle is at or above the per-entry cap keeps its own
+* upstream `/plugins` row (the gateway proxies it verbatim), because a merged
+* batch cannot carry it. The remaining entries are greedily packed into merged
+* batches under {@link MOBILE_BOOT_CHUNK_BYTES}; the layout module always merges,
+* since its body is the gateway-owned layout file, never an upstream fetch.
+*/
+function splitMobileBootBatch(entries, sizes, passThrough) {
+	const rows = [];
+	const plans = [];
+	let chunk;
+	const flush = () => {
+		if (chunk === void 0 || chunk.entries.length === 0) return;
+		const revision = revisionedMobileBatchPath(chunk.entries);
+		rows.push({
+			phase: "application",
+			url: revision.path,
+			rev: revision.key,
+			entries: chunk.ids
+		});
+		plans.push(Object.freeze({
+			key: revision.key,
+			path: revision.path,
+			entries: Object.freeze(chunk.entries)
+		}));
+		chunk = void 0;
+	};
+	for (const entry of entries) {
+		const size = sizes.get(entry.url);
+		if ((passThrough.has(entry.url) || size !== void 0 && size >= MAX_MOBILE_BOOT_ENTRY_BYTES) && entry.id !== MOBILE_LAYOUT_MODULE) {
+			rows.push({
+				phase: "application",
 				url: entry.url,
-				rev: entry.rev
+				rev: entry.rev,
+				entries: [entry.id]
 			});
-		});
-		const revision = revisionedMobileBatchPath(planEntries);
-		layoutBatch.url = revision.path;
-		layoutBatch.rev = revision.key;
-		mobileBatch = Object.freeze({
-			...revision,
-			entries: Object.freeze(planEntries)
-		});
-		parsed.rev = createHash("sha256").update(JSON.stringify({
-			entries,
-			batches
+			continue;
+		}
+		const bytes = (size ?? 0) + MOBILE_BOOT_SEPARATOR_BYTES;
+		if (chunk !== void 0 && chunk.entries.length > 0 && chunk.bytes + bytes > MOBILE_BOOT_CHUNK_BYTES) flush();
+		chunk ??= {
+			ids: [],
+			entries: [],
+			bytes: 0
+		};
+		chunk.ids.push(entry.id);
+		chunk.entries.push(entry);
+		chunk.bytes += bytes;
+	}
+	flush();
+	return {
+		plans,
+		rows
+	};
+}
+function rewriteMobileIndexWithBatch(html, options = {}) {
+	const plan = parseMobileBootPlan(html);
+	const remoteSettings = orderAuthenticatedSettings(plan.entries, plan.slotProvider);
+	let batches = [];
+	if (plan.batches !== void 0 && plan.layoutBatch !== void 0 && plan.planEntries !== void 0) {
+		const split = splitMobileBootBatch(plan.planEntries, options.sizes ?? /* @__PURE__ */ new Map(), options.passThrough ?? /* @__PURE__ */ new Set());
+		const at = plan.batches.indexOf(plan.layoutBatch);
+		if (at < 0) throw new Error("upstream DSH boot manifest has no unique application layout batch");
+		plan.batches.splice(at, 1, ...split.rows);
+		batches = Object.freeze(split.plans);
+		plan.parsed.rev = createHash("sha256").update(JSON.stringify({
+			entries: plan.entries,
+			batches: plan.batches
 		})).digest("hex").slice(0, 16);
 	}
-	const replacement = `${remoteSettings ? MOBILE_AUTHENTICATED_TRANSPORT_BOOTSTRAP : ""}${MOBILE_CSRF_FETCH_BOOTSTRAP}window.__DSH_MOBILE_FRONTEND__="dedicated";${assignment[0]}${JSON.stringify(parsed)};`;
+	const replacement = `${remoteSettings ? MOBILE_AUTHENTICATED_TRANSPORT_BOOTSTRAP : ""}${MOBILE_CSRF_FETCH_BOOTSTRAP}window.__DSH_MOBILE_FRONTEND__="dedicated";${plan.assignment}${JSON.stringify(plan.parsed)};`;
 	return Object.freeze({
-		html: ensureMobileViewport(ensureMobileCompatibility(`${html.slice(0, start)}${replacement}${html.slice(scriptEnd)}`)),
-		...mobileBatch === void 0 ? {} : { batch: mobileBatch }
+		html: ensureMobileViewport(ensureMobileCompatibility(`${html.slice(0, plan.replaceStart)}${replacement}${html.slice(plan.replaceEnd)}`)),
+		batches
 	});
 }
 /** Replace only DSH's layout client module while retaining its complete plugin graph. */
@@ -2884,6 +2991,13 @@ function discoveryBroadcastTargets(cidrs) {
 	}
 	return [...targets];
 }
+function discoveryFailure(error) {
+	const code = error instanceof Error && typeof error.code === "string" ? error.code : "unknown";
+	return Object.freeze({
+		code,
+		message: error instanceof Error ? error.message : String(error)
+	});
+}
 function extensionTarget(pathname) {
 	const prefix = `${AUTH_PREFIX}/extensions`;
 	if (pathname === prefix || pathname === `${prefix}/` || pathname === `${prefix}/manifest`) return { kind: "manifest" };
@@ -2981,6 +3095,7 @@ var MobileAccessGateway = class {
 	upstreamAuthenticatedUrl;
 	extraWebSocketPaths;
 	blockedUpgradeLog;
+	onDiscoveryDegraded;
 	access;
 	listenerTlsEnabled;
 	tlsEnabled;
@@ -2995,6 +3110,7 @@ var MobileAccessGateway = class {
 	* it, "the phone cannot find this computer" has no diagnosable cause on the host.
 	*/
 	discoveryError;
+	mdnsError;
 	/** Names of the bundled mobile assets that could not be read, if any. */
 	mobileAssetError;
 	bonjour;
@@ -3004,6 +3120,8 @@ var MobileAccessGateway = class {
 	activeRequests = /* @__PURE__ */ new Map();
 	activeWebSockets = /* @__PURE__ */ new Map();
 	mobileBootBatches = /* @__PURE__ */ new Map();
+	/** Cached upstream bundle byte sizes (HEAD probes), keyed by resource URL. */
+	bootEntrySizeCache = /* @__PURE__ */ new Map();
 	extensionEventListeners = /* @__PURE__ */ new Set();
 	extensionEventRevision = 0;
 	taskEventListeners = /* @__PURE__ */ new Set();
@@ -3024,12 +3142,13 @@ var MobileAccessGateway = class {
 	removeExtensionContentListener;
 	renewLimiter;
 	probeLimiter;
-	constructor(config, store, extensions, upstreamAuthenticatedUrl, extraWebSocketPaths, blockedUpgradeLog) {
+	constructor(config, store, extensions, upstreamAuthenticatedUrl, extraWebSocketPaths, blockedUpgradeLog, onDiscoveryDegraded) {
 		this.config = config;
 		this.extensions = extensions;
 		this.upstreamAuthenticatedUrl = upstreamAuthenticatedUrl;
 		this.extraWebSocketPaths = extraWebSocketPaths;
 		this.blockedUpgradeLog = blockedUpgradeLog;
+		this.onDiscoveryDegraded = onDiscoveryDegraded;
 		this.listenerTlsEnabled = config.tls.mode === "provided";
 		this.tlsEnabled = config.publicTls;
 		this.access = new AccessController(store, {
@@ -3143,33 +3262,56 @@ var MobileAccessGateway = class {
 		const socket = createSocket("udp4");
 		this.discoverySocket = socket;
 		const announcement = this.discoveryAnnouncement(port);
+		let binding = true;
+		socket.on("error", (error) => {
+			if (!binding) this.recordBroadcastFailure(error, true);
+		});
+		const sendAnnouncement = (targetPort, address) => {
+			if (this.closing || this.discoveryError !== void 0) return;
+			try {
+				socket.send(announcement, targetPort, address, (error) => {
+					if (error !== null) this.recordBroadcastFailure(error, true);
+				});
+			} catch (error) {
+				this.recordBroadcastFailure(error, true);
+			}
+		};
 		socket.on("message", (message, remote) => {
-			if (this.closing || !message.equals(DISCOVERY_QUERY) || !addressAllowed(remote.address, this.config.allowedCidrs)) return;
-			socket.send(announcement, remote.port, remote.address, () => void 0);
+			if (this.closing || this.discoveryError !== void 0 || !message.equals(DISCOVERY_QUERY) || !addressAllowed(remote.address, this.config.allowedCidrs)) return;
+			sendAnnouncement(remote.port, remote.address);
 		});
 		const bindHost = isIP(this.config.listenHost) === 4 && isLoopbackAddress(this.config.listenHost) ? this.config.listenHost : "0.0.0.0";
 		if (await new Promise((resolve) => {
 			const onBindError = (error) => {
 				socket.off("error", onBindError);
-				this.discoveryError = Object.freeze({
-					code: typeof error.code === "string" ? error.code : "unknown",
-					message: typeof error.message === "string" ? error.message : String(error)
-				});
+				this.recordBroadcastFailure(error, false);
 				resolve(false);
 			};
 			socket.once("error", onBindError);
-			socket.bind(port, bindHost, () => {
-				socket.off("error", onBindError);
-				socket.setBroadcast(true);
-				resolve(true);
-			});
-		})) {
+			try {
+				socket.bind(port, bindHost, () => {
+					socket.off("error", onBindError);
+					binding = false;
+					try {
+						socket.setBroadcast(true);
+						resolve(true);
+					} catch (error) {
+						this.recordBroadcastFailure(error, true);
+						resolve(false);
+					}
+				});
+			} catch (error) {
+				onBindError(error);
+			}
+		}) && this.discoveryError === void 0) {
 			const announce = () => {
-				for (const target of discoveryBroadcastTargets(this.config.allowedCidrs)) socket.send(announcement, port, target, () => void 0);
+				for (const target of discoveryBroadcastTargets(this.config.allowedCidrs)) sendAnnouncement(port, target);
 			};
 			announce();
-			this.discoveryTimer = setInterval(announce, DISCOVERY_INTERVAL_MS);
-			this.discoveryTimer.unref();
+			if (this.discoveryError === void 0) {
+				this.discoveryTimer = setInterval(announce, DISCOVERY_INTERVAL_MS);
+				this.discoveryTimer.unref();
+			}
 		} else {
 			this.discoverySocket = void 0;
 			try {
@@ -3177,8 +3319,12 @@ var MobileAccessGateway = class {
 			} catch {}
 		}
 		const deviceName = discoveryDeviceName();
-		const bonjour = new Bonjour({ disableIPv6: true });
+		const onMdnsError = (error) => {
+			this.recordMdnsFailure(error);
+		};
+		const bonjour = new Bonjour({ disableIPv6: true }, onMdnsError);
 		this.bonjour = bonjour;
+		bonjour.server.mdns.on("error", onMdnsError);
 		bonjour.publish({
 			name: `${deviceName} (${this.config.instanceId.slice(0, 8)})`,
 			type: MDNS_SERVICE_TYPE,
@@ -3194,6 +3340,25 @@ var MobileAccessGateway = class {
 			}
 		});
 	}
+	reportDiscoveryDegraded(source, code) {
+		try {
+			this.onDiscoveryDegraded?.(source, code);
+		} catch (error) {
+			process.emitWarning(`DSH Mobile could not log ${source} discovery error: ${String(error)}`, { code: "DSH_MOBILE_DISCOVERY_LOG_FAILED" });
+		}
+	}
+	recordBroadcastFailure(error, notify) {
+		if (this.closing || this.discoveryError !== void 0) return;
+		this.discoveryError = discoveryFailure(error);
+		if (this.discoveryTimer !== void 0) clearInterval(this.discoveryTimer);
+		this.discoveryTimer = void 0;
+		if (notify) this.reportDiscoveryDegraded("broadcast", this.discoveryError.code);
+	}
+	recordMdnsFailure(error) {
+		if (this.closing || this.mdnsError !== void 0) return;
+		this.mdnsError = discoveryFailure(error);
+		this.reportDiscoveryDegraded("mdns", this.mdnsError.code);
+	}
 	discoveryAnnouncement(port) {
 		return Buffer.from(JSON.stringify({
 			deviceName: discoveryDeviceName(),
@@ -3251,8 +3416,9 @@ var MobileAccessGateway = class {
 	discoveryStatus() {
 		return Object.freeze({
 			broadcast: this.discoverySocket !== void 0 && this.discoveryTimer !== void 0,
-			mdns: this.bonjour !== void 0,
+			mdns: this.bonjour !== void 0 && this.mdnsError === void 0,
 			...this.discoveryError === void 0 ? {} : { errorCode: `discovery_broadcast_${this.discoveryError.code}` },
+			...this.mdnsError === void 0 ? {} : { mdnsErrorCode: `discovery_mdns_${this.mdnsError.code}` },
 			...this.mobileAssetError === void 0 ? {} : { mobileAssetsErrorCode: this.mobileAssetError }
 		});
 	}
@@ -3904,8 +4070,10 @@ var MobileAccessGateway = class {
 			}
 			let body;
 			try {
-				const rewritten = rewriteMobileIndexWithBatch(Buffer.concat(chunks).toString("utf8"));
-				if (rewritten.batch !== void 0) this.rememberMobileBootBatch(rewritten.batch);
+				const html = Buffer.concat(chunks).toString("utf8");
+				const plan = parseMobileBootPlan(html);
+				const rewritten = rewriteMobileIndexWithBatch(html, plan.planEntries === void 0 ? {} : await this.resolveMobileBootSizes(plan.planEntries));
+				for (const batch of rewritten.batches) this.rememberMobileBootBatch(batch);
 				body = Buffer.from(rewritten.html);
 			} catch {
 				throw new HttpError(502, "upstream_unavailable");
@@ -3941,6 +4109,98 @@ var MobileAccessGateway = class {
 			this.mobileBootBatches.delete(oldest);
 		}
 	}
+	/**
+	* Determine which layout-batch entries can share a merged boot batch and which
+	* must pass through. An entry at or above the per-entry cap, or one whose size
+	* could not be probed, keeps its own upstream `/plugins` row: a merged batch
+	* cannot carry it, and an unknown bundle must not risk the whole batch.
+	*/
+	async resolveMobileBootSizes(planEntries) {
+		const sizes = /* @__PURE__ */ new Map();
+		const passThrough = /* @__PURE__ */ new Set();
+		const candidates = planEntries.filter((entry) => entry.id !== MOBILE_LAYOUT_MODULE && entry.url.startsWith("/plugins/"));
+		let cursor = 0;
+		const worker = async () => {
+			while (cursor < candidates.length) {
+				const index = cursor++;
+				const source = candidates[index].url;
+				const size = await this.upstreamBundleSize(source);
+				if (size === void 0 || size >= MAX_MOBILE_BOOT_ENTRY_BYTES) passThrough.add(source);
+				else sizes.set(source, size);
+			}
+		};
+		await Promise.all(Array.from({ length: Math.min(8, candidates.length) }, worker));
+		return {
+			sizes,
+			passThrough
+		};
+	}
+	/**
+	* Measure one upstream bundle by reading its body. The upstream serves
+	* `/plugins` bundles as chunked streams without a Content-Length, so a probe
+	* counts bytes; it aborts instantly past the per-entry cap. Measurements are
+	* cached for a short window.
+	*/
+	async upstreamBundleSize(source) {
+		if (!source.startsWith("/plugins/") || source.includes("#")) return void 0;
+		const cached = this.bootEntrySizeCache.get(source);
+		if (cached !== void 0 && Date.now() - cached.at < MOBILE_BOOT_SIZE_CACHE_TTL_MS) return cached.size;
+		const target = new URL(source, this.config.upstreamOrigin);
+		if (target.origin !== this.config.upstreamOrigin.origin) return void 0;
+		const upstreamCookie = await this.upstreamCookieHeader();
+		let upstreamRequest;
+		try {
+			const proxied = await new Promise((resolve, reject) => {
+				upstreamRequest = request({
+					protocol: "http:",
+					hostname: stripIpv6Brackets(this.config.upstreamOrigin.hostname),
+					port: Number(this.config.upstreamOrigin.port),
+					method: "GET",
+					path: `${target.pathname}${target.search}`,
+					headers: {
+						host: this.config.upstreamOrigin.host,
+						accept: "text/javascript",
+						"accept-encoding": "identity",
+						[MOBILE_BOOT_SIZE_PROBE_HEADER]: "1",
+						...upstreamCookie === void 0 ? {} : { cookie: upstreamCookie }
+					},
+					agent: false
+				});
+				upstreamRequest.setTimeout(this.config.upstreamTimeoutMs, () => {
+					upstreamRequest?.destroy(upstreamTimeoutError());
+				});
+				upstreamRequest.once("response", resolve);
+				upstreamRequest.once("error", reject);
+				upstreamRequest.end();
+			});
+			if (proxied.statusCode !== 200) {
+				proxied.resume();
+				return;
+			}
+			const size = await new Promise((resolve, reject) => {
+				let bytes = 0;
+				proxied.on("data", (chunk) => {
+					bytes += chunk.length;
+					if (bytes > MAX_MOBILE_BOOT_ENTRY_BYTES) {
+						proxied.destroy();
+						resolve(void 0);
+					}
+				});
+				proxied.once("end", () => resolve(bytes));
+				proxied.once("error", reject);
+			});
+			if (size === void 0) return void 0;
+			this.bootEntrySizeCache.set(source, {
+				size,
+				at: Date.now()
+			});
+			return size;
+		} catch {
+			return;
+		} finally {
+			upstreamRequest?.destroy();
+		}
+	}
 	async serveMobileBootBatch(key, request, response, authorization) {
 		if (request.method !== "GET" && request.method !== "HEAD") throw new HttpError(405, "method_not_allowed");
 		const stored = this.mobileBootBatches.get(key);
@@ -4022,7 +4282,7 @@ var MobileAccessGateway = class {
 			}
 		};
 		await Promise.all(Array.from({ length: Math.min(3, plan.entries.length) }, worker));
-		if (bodies.reduce((bytes, body) => bytes + body.byteLength + 2, 0) > MAX_MOBILE_BOOT_BATCH_BYTES) throw new HttpError(502, "upstream_unavailable");
+		if (bodies.reduce((bytes, body) => bytes + body.byteLength + MOBILE_BOOT_SEPARATOR_BYTES, 0) > MAX_MOBILE_BOOT_BATCH_BYTES) throw new HttpError(502, "upstream_unavailable");
 		return Buffer.concat(bodies.flatMap((body) => [body, Buffer.from("\n;\n")]));
 	}
 	/**
@@ -4131,7 +4391,39 @@ var MobileAccessGateway = class {
 			}
 		};
 	}
-	async proxyHttp(request$2, response, authorization) {
+	/**
+	* Proxy one request upstream. Pass-through client bundles (`GET /plugins`)
+	* receive bounded transient retries — the upstream resets a fraction of fresh
+	* connections — matching the resilience the merged-batch assembly already has.
+	* A request is only retried before any byte reached the client.
+	*/
+	async proxyHttp(request, response, authorization) {
+		if (!(request.method === "GET" && request.url?.split("?", 1)[0]?.startsWith("/plugins/") === true)) {
+			try {
+				await this.proxyHttpOnce(request, response, authorization);
+			} catch (error) {
+				if (error instanceof HttpError) throw error;
+				if (response.headersSent) response.destroy();
+				else throw new HttpError(502, "upstream_unavailable");
+			}
+			return;
+		}
+		const delay = (attempt) => new Promise((resolve) => setTimeout(resolve, MOBILE_BOOT_RETRY_DELAY_MS * attempt));
+		for (let attempt = 1; attempt <= MOBILE_BOOT_UPSTREAM_ATTEMPTS; attempt++) try {
+			await this.proxyHttpOnce(request, response, authorization);
+			return;
+		} catch (error) {
+			if (response.headersSent) {
+				response.destroy();
+				return;
+			}
+			if (error instanceof HttpError || !isTransientUpstreamError(error)) throw error instanceof HttpError ? error : new HttpError(502, "upstream_unavailable");
+			if (attempt === MOBILE_BOOT_UPSTREAM_ATTEMPTS) throw new HttpError(502, "upstream_unavailable");
+			await delay(attempt);
+		}
+		throw new HttpError(502, "upstream_unavailable");
+	}
+	async proxyHttpOnce(request$2, response, authorization) {
 		const declared = request$2.headers["content-length"];
 		if (declared !== void 0 && (!/^\d+$/u.test(declared) || Number(declared) > this.config.maxBodyBytes)) throw new HttpError(413, "payload_too_large");
 		const holder = {};
@@ -4185,7 +4477,7 @@ var MobileAccessGateway = class {
 			await bodyDone?.catch(() => void 0);
 			if (error instanceof HttpError) throw error;
 			if (response.headersSent) response.destroy();
-			else throw new HttpError(502, "upstream_unavailable");
+			throw error;
 		} finally {
 			operation.release();
 		}
@@ -6486,10 +6778,23 @@ async function attemptDownload(request) {
 	});
 	const response = first.status >= 300 && first.status < 400 ? await followValidatedRedirect(first, request) : first;
 	if (!response.ok) throw new Error(`${request.errorPrefix}_download_http_${String(response.status)}`);
-	const declared = Number(response.headers.get("content-length"));
-	if (Number.isFinite(declared) && declared !== request.expectedBytes) throw new Error(`${request.errorPrefix}_download_size_mismatch`);
-	const bytes = new Uint8Array(await response.arrayBuffer());
-	if (bytes.byteLength !== request.expectedBytes) throw new Error(`${request.errorPrefix}_download_size_mismatch`);
+	const contentLength = response.headers.get("content-length");
+	if (contentLength !== null && (!/^\d+$/u.test(contentLength) || Number(contentLength) !== request.expectedBytes)) throw new Error(`${request.errorPrefix}_download_size_mismatch`);
+	if (response.body === null) throw new Error(`${request.errorPrefix}_download_size_mismatch`);
+	const bytes = new Uint8Array(request.expectedBytes);
+	const reader = response.body.getReader();
+	let received = 0;
+	while (true) {
+		const chunk = await reader.read();
+		if (chunk.done) break;
+		if (chunk.value.byteLength > bytes.byteLength - received) {
+			await reader.cancel();
+			throw new Error(`${request.errorPrefix}_download_size_mismatch`);
+		}
+		bytes.set(chunk.value, received);
+		received += chunk.value.byteLength;
+	}
+	if (received !== request.expectedBytes) throw new Error(`${request.errorPrefix}_download_size_mismatch`);
 	return bytes;
 }
 /**
@@ -6512,24 +6817,45 @@ async function downloadPinnedArtifact(request) {
 }
 //#endregion
 //#region src/cloudflared-component.ts
+const CLOUDFLARED_VERSION = "2026.9.1";
+/** Pinned official cloudflared release metadata for supported desktop targets. */
+const CLOUDFLARED_COMPONENT_RELEASES = Object.freeze(Object.fromEntries([
+	{
+		version: CLOUDFLARED_VERSION,
+		platform: "win32",
+		arch: "x64",
+		downloadUrl: `https://github.com/cloudflare/cloudflared/releases/download/${CLOUDFLARED_VERSION}/cloudflared-windows-amd64.exe`,
+		downloadBytes: 54976432,
+		downloadSha256: "2837888cc0f5d58f15b6dc478376de90b4d3ba5241c7947455d1e0a0df429712",
+		executableName: "cloudflared.exe"
+	},
+	{
+		version: CLOUDFLARED_VERSION,
+		platform: "linux",
+		arch: "x64",
+		downloadUrl: `https://github.com/cloudflare/cloudflared/releases/download/${CLOUDFLARED_VERSION}/cloudflared-linux-amd64`,
+		downloadBytes: 39838488,
+		downloadSha256: "03f1f25d1cc93b9ad6c60569d44060bc4f17ed97075760ed8cfca4b12dcd68cc",
+		executableName: "cloudflared"
+	},
+	{
+		version: CLOUDFLARED_VERSION,
+		platform: "linux",
+		arch: "arm64",
+		downloadUrl: `https://github.com/cloudflare/cloudflared/releases/download/${CLOUDFLARED_VERSION}/cloudflared-linux-arm64`,
+		downloadBytes: 37466252,
+		downloadSha256: "3d97437c71848bd8df68041e12436b484a661d95073ea1937f01a845ce88faa3",
+		executableName: "cloudflared"
+	}
+].map((release) => [`${release.platform}-${release.arch}`, Object.freeze(release)])));
 /**
-* Pinned cloudflared Windows component fetched only after an explicit user action.
-*
-* Unlike the cpolar archive this artifact IS the executable: there is nothing to
-* unpack, so the download digest and the installed digest are the same pair.
-* `--no-autoupdate` is passed at runtime as well, so the pinned bytes stay the
-* bytes that were verified.
+* Canonical release metadata. New code should select from
+* {@link CLOUDFLARED_COMPONENT_RELEASES} by platform and architecture; this
+* alias preserves the original Windows x64 entry for existing callers.
 */
-const CLOUDFLARED_COMPONENT_RELEASE = Object.freeze({
-	version: "2026.9.1",
-	platform: "win32",
-	arch: "x64",
-	downloadUrl: "https://github.com/cloudflare/cloudflared/releases/download/2026.9.1/cloudflared-windows-amd64.exe",
-	downloadBytes: 54976432,
-	downloadSha256: "2837888cc0f5d58f15b6dc478376de90b4d3ba5241c7947455d1e0a0df429712",
-	downloadPage: "https://github.com/cloudflare/cloudflared/releases",
-	termsUrl: "https://www.cloudflare.com/website-terms/"
-});
+const CLOUDFLARED_COMPONENT_RELEASE = CLOUDFLARED_COMPONENT_RELEASES["win32-x64"];
+const DOWNLOAD_PAGE$1 = "https://github.com/cloudflare/cloudflared/releases";
+const TERMS_URL$1 = "https://www.cloudflare.com/website-terms/";
 function inside$1(parent, child) {
 	const candidate = relative(parent, child);
 	return candidate !== "" && !candidate.startsWith("..") && !isAbsolute(candidate);
@@ -6546,14 +6872,18 @@ async function regularFile$1(file, expectedBytes) {
 		throw error;
 	}
 }
-async function defaultFetchArtifact$1(url, signal) {
+async function defaultFetchArtifact$1(url, signal, expectedBytes) {
 	return downloadPinnedArtifact({
 		url,
-		expectedBytes: CLOUDFLARED_COMPONENT_RELEASE.downloadBytes,
+		expectedBytes,
 		errorPrefix: "cloudflared",
 		signal
 	});
 }
+/** Select the pinned artifact for one host, or undefined where unsupported. */
+function lookupRelease(platform, arch) {
+	return CLOUDFLARED_COMPONENT_RELEASES[`${platform}-${arch}`];
+}
 /** Owns the optional cloudflared binary inside DSH Mobile state. */
 var CloudflaredComponentManager = class {
 	executable;
@@ -6564,6 +6894,7 @@ var CloudflaredComponentManager = class {
 	stagingRoot;
 	platform;
 	arch;
+	release;
 	fetchArtifact;
 	installed = false;
 	errorCode;
@@ -6573,9 +6904,10 @@ var CloudflaredComponentManager = class {
 		if (!isAbsolute(stateDirectory)) throw new Error("cloudflared state directory must be absolute");
 		this.platform = options.platform ?? process.platform;
 		this.arch = options.arch ?? process.arch;
+		this.release = lookupRelease(this.platform, this.arch);
 		this.componentRoot = join(stateDirectory, "components", "cloudflared");
-		this.componentStorage = join(this.componentRoot, CLOUDFLARED_COMPONENT_RELEASE.version);
-		this.executable = join(this.componentStorage, "cloudflared.exe");
+		this.componentStorage = join(this.componentRoot, this.release?.version ?? CLOUDFLARED_VERSION);
+		this.executable = join(this.componentStorage, this.release?.executableName ?? "cloudflared");
 		this.stateRoot = join(stateDirectory, "state", "cloudflared");
 		this.logRoot = join(stateDirectory, "logs", "cloudflared");
 		this.stagingRoot = join(stateDirectory, "staging", "cloudflared");
@@ -6586,27 +6918,30 @@ var CloudflaredComponentManager = class {
 			this.logRoot,
 			this.stagingRoot
 		]) if (!inside$1(stateDirectory, child)) throw new Error("cloudflared component path escaped its state directory");
-		this.fetchArtifact = options.fetchArtifact ?? defaultFetchArtifact$1;
+		const release = this.release;
+		this.fetchArtifact = options.fetchArtifact ?? ((url, signal) => defaultFetchArtifact$1(url, signal, release?.downloadBytes ?? 0));
 	}
 	/** Inspect the managed binary without using any global cloudflared state. */
 	async initialize() {
-		this.installed = await regularFile$1(this.executable, CLOUDFLARED_COMPONENT_RELEASE.downloadBytes);
-		if (this.installed && await sha256$1(this.executable) !== CLOUDFLARED_COMPONENT_RELEASE.downloadSha256) {
+		const release = this.release;
+		this.installed = release !== void 0 && await regularFile$1(this.executable, release.downloadBytes);
+		if (this.installed && release !== void 0 && await sha256$1(this.executable) !== release.downloadSha256) {
 			this.installed = false;
 			this.errorCode = "cloudflared_component_invalid";
 		}
 	}
 	/** Return a safe status that never includes machine-specific account data. */
 	status() {
+		const release = this.release ?? CLOUDFLARED_COMPONENT_RELEASE;
 		return Object.freeze({
-			supported: this.platform === CLOUDFLARED_COMPONENT_RELEASE.platform && this.arch === CLOUDFLARED_COMPONENT_RELEASE.arch,
+			supported: this.release !== void 0,
 			installed: this.installed,
-			version: CLOUDFLARED_COMPONENT_RELEASE.version,
-			downloadBytes: CLOUDFLARED_COMPONENT_RELEASE.downloadBytes,
-			installedBytes: CLOUDFLARED_COMPONENT_RELEASE.downloadBytes,
-			sourceUrl: CLOUDFLARED_COMPONENT_RELEASE.downloadUrl,
-			downloadPage: CLOUDFLARED_COMPONENT_RELEASE.downloadPage,
-			termsUrl: CLOUDFLARED_COMPONENT_RELEASE.termsUrl,
+			version: release.version,
+			downloadBytes: release.downloadBytes,
+			installedBytes: release.downloadBytes,
+			sourceUrl: release.downloadUrl,
+			downloadPage: DOWNLOAD_PAGE$1,
+			termsUrl: TERMS_URL$1,
 			storagePath: this.componentRoot,
 			...this.errorCode === void 0 ? {} : { errorCode: this.errorCode }
 		});
@@ -6614,7 +6949,8 @@ var CloudflaredComponentManager = class {
 	/** Download, verify, and install the pinned cloudflared executable after explicit confirmation. */
 	install() {
 		return this.enqueue(async () => {
-			if (this.platform !== CLOUDFLARED_COMPONENT_RELEASE.platform || this.arch !== CLOUDFLARED_COMPONENT_RELEASE.arch) throw new Error("cloudflared_component_unsupported");
+			const release = this.release;
+			if (release === void 0) throw new Error("cloudflared_component_unsupported");
 			await mkdir(this.stagingRoot, {
 				recursive: true,
 				mode: 448
@@ -6628,26 +6964,26 @@ var CloudflaredComponentManager = class {
 				timeout.unref();
 				let bytes;
 				try {
-					bytes = await this.fetchArtifact(CLOUDFLARED_COMPONENT_RELEASE.downloadUrl, controller.signal);
+					bytes = await this.fetchArtifact(release.downloadUrl, controller.signal);
 				} finally {
 					clearTimeout(timeout);
 				}
-				if (bytes.byteLength !== CLOUDFLARED_COMPONENT_RELEASE.downloadBytes) throw new Error("cloudflared_download_size_mismatch");
-				if (createHash("sha256").update(bytes).digest("hex") !== CLOUDFLARED_COMPONENT_RELEASE.downloadSha256) throw new Error("cloudflared_download_hash_mismatch");
-				const staged = join(staging, "cloudflared.exe");
+				if (bytes.byteLength !== release.downloadBytes) throw new Error("cloudflared_download_size_mismatch");
+				if (createHash("sha256").update(bytes).digest("hex") !== release.downloadSha256) throw new Error("cloudflared_download_hash_mismatch");
+				const staged = join(staging, release.executableName);
 				await writeFile(staged, bytes, {
 					flag: "wx",
 					mode: 384
 				});
 				await chmod(staged, 448);
-				if (!await regularFile$1(staged, CLOUDFLARED_COMPONENT_RELEASE.downloadBytes) || await sha256$1(staged) !== CLOUDFLARED_COMPONENT_RELEASE.downloadSha256) throw new Error("cloudflared_executable_hash_mismatch");
+				if (!await regularFile$1(staged, release.downloadBytes) || await sha256$1(staged) !== release.downloadSha256) throw new Error("cloudflared_executable_hash_mismatch");
 				const candidate = join(this.componentRoot, `.install-${randomBytes(12).toString("hex")}`);
 				await mkdir(candidate, {
 					recursive: true,
 					mode: 448
 				});
-				await copyFile(staged, join(candidate, "cloudflared.exe"));
-				await chmod(join(candidate, "cloudflared.exe"), 448);
+				await copyFile(staged, join(candidate, release.executableName));
+				await chmod(join(candidate, release.executableName), 448);
 				await rm(this.componentStorage, {
 					recursive: true,
 					force: true
@@ -6704,6 +7040,15 @@ const MAX_LOG_BUFFER_BYTES$1 = 65536;
 * looking healthy for longer than a user will wait.
 */
 const START_TIMEOUT_MS$1 = 6e4;
+/**
+* How many startup-timeout rounds a named tunnel may wait through while its
+* connector process is still alive. A rebooted PC often autostarts DSH before
+* Wi-Fi / VPN / DNS is usable; cloudflared retries the edge on its own, so
+* killing it after a single 60 s window turns a slow boot into a manual
+* reconnect loop. An exited connector (bad token, bad config) still fails fast
+* on the first round.
+*/
+const NAMED_STARTUP_ROUNDS = 5;
 const CLOUDFLARED_HOST_SUFFIX = ".trycloudflare.com";
 /**
 * Subdomains Cloudflare reserves for its own control plane.
@@ -6846,6 +7191,7 @@ var CloudflaredController = class {
 	});
 	queue = Promise.resolve();
 	startupTimer;
+	startupRounds = 0;
 	constructor(options) {
 		this.options = options;
 		if (!isAbsolute(options.executable)) throw new Error("cloudflared executable path must be absolute");
@@ -6977,6 +7323,7 @@ var CloudflaredController = class {
 		}
 		this.reservation = reservation;
 		this.buffer = "";
+		this.startupRounds = 0;
 		this.publish({
 			enabled: true,
 			state: "starting"
@@ -7038,11 +7385,32 @@ var CloudflaredController = class {
 			this.child = void 0;
 			if (this.enabled) this.enqueue(() => this.failGeneration(generation, code === 0 ? "cloudflared_stopped" : "cloudflared_exited"));
 		});
+		this.armStartupTimer(generation);
+	}
+	armStartupTimer(generation) {
+		if (this.startupTimer !== void 0) clearTimeout(this.startupTimer);
 		this.startupTimer = setTimeout(() => {
-			this.enqueue(() => this.failGeneration(generation, "cloudflared_start_timeout"));
+			this.enqueue(() => this.checkStartupTimeout(generation));
 		}, this.options.startupTimeoutMs ?? START_TIMEOUT_MS$1);
 		this.startupTimer.unref();
 	}
+	/**
+	* Give a live named connector more time instead of killing it: it retries the
+	* edge on its own and usually registers once the rebooted network is usable.
+	* A dead connector, or an exhausted budget, fails the generation as before.
+	*/
+	async checkStartupTimeout(generation) {
+		if (generation !== this.generation || !this.enabled || this.disposed) return;
+		if (this.latest.state === "ready") return;
+		const childAlive = this.child !== void 0 && this.child.exitCode === null;
+		const budget = this.options.maxStartupRounds ?? NAMED_STARTUP_ROUNDS;
+		if (this.mode === "named" && childAlive && this.startupRounds + 1 < budget) {
+			this.startupRounds += 1;
+			this.armStartupTimer(generation);
+			return;
+		}
+		await this.failGeneration(generation, "cloudflared_start_timeout");
+	}
 	consume(generation, chunk) {
 		if (generation !== this.generation) return;
 		this.buffer += chunk;
@@ -9526,21 +9894,56 @@ var CpolarController = class {
 };
 //#endregion
 //#region src/cpolar-component.ts
-/** Pinned cpolar Windows component fetched only after an explicit user action. */
-const CPOLAR_COMPONENT_RELEASE = Object.freeze({
-	version: "3.3.18",
-	platform: "win32",
-	arch: "x64",
-	downloadUrl: "https://www.cpolar.com/static/downloads/releases/3.3.18/cpolar-stable-windows-amd64-setup.zip",
-	downloadBytes: 7603505,
-	downloadSha256: "fb8cf60289058ee26079f995d2eeea0b21768a742d90c93015afe96e83428830",
-	executableBytes: 19637680,
-	executableSha256: "b2d865ee505e842d22ceca5493a872efa893a79b079a7a8ee2bd3aa5343a5c41",
-	downloadPage: "https://www.cpolar.com/download",
-	signupUrl: "https://dashboard.cpolar.com/signup",
-	dashboardUrl: "https://dashboard.cpolar.com/auth",
-	termsUrl: "https://www.cpolar.com/tos"
-});
+const CPOLAR_VERSION = "3.3.18";
+/** Pinned official cpolar release metadata for supported desktop targets. */
+const CPOLAR_COMPONENT_RELEASES = Object.freeze(Object.fromEntries([
+	{
+		version: CPOLAR_VERSION,
+		platform: "win32",
+		arch: "x64",
+		downloadUrl: `https://www.cpolar.com/static/downloads/releases/${CPOLAR_VERSION}/cpolar-stable-windows-amd64-setup.zip`,
+		downloadBytes: 7603505,
+		downloadSha256: "fb8cf60289058ee26079f995d2eeea0b21768a742d90c93015afe96e83428830",
+		executableName: "cpolar.exe",
+		executableBytes: 19637680,
+		executableSha256: "b2d865ee505e842d22ceca5493a872efa893a79b079a7a8ee2bd3aa5343a5c41",
+		archiveKind: "msi-zip"
+	},
+	{
+		version: CPOLAR_VERSION,
+		platform: "linux",
+		arch: "x64",
+		downloadUrl: `https://www.cpolar.com/static/downloads/releases/${CPOLAR_VERSION}/cpolar-stable-linux-amd64.tar.gz`,
+		downloadBytes: 7404781,
+		downloadSha256: "5cd3320c4369928ccb509c4f5fa2ec3b86151ead77e1b77c1694aa64c43e32e7",
+		executableName: "cpolar",
+		executableBytes: 19328632,
+		executableSha256: "c076e1109372a3f88031841c5989030e49b6871b54aee3260c796da9122dec05",
+		archiveKind: "tar.gz"
+	},
+	{
+		version: CPOLAR_VERSION,
+		platform: "linux",
+		arch: "arm64",
+		downloadUrl: `https://www.cpolar.com/static/downloads/releases/${CPOLAR_VERSION}/cpolar-stable-linux-arm64.tar.gz`,
+		downloadBytes: 6855666,
+		downloadSha256: "8a61a97983f18ae5ffb4b8bac4c9b3d8e2399a6ee101844e7b0b30d7f326157c",
+		executableName: "cpolar",
+		executableBytes: 19017169,
+		executableSha256: "8d76a1b7e518df45f387f107c7a428079c67ecd9b971a2915c53b947ea9b443a",
+		archiveKind: "tar.gz"
+	}
+].map((release) => [`${release.platform}-${release.arch}`, Object.freeze(release)])));
+/**
+* Canonical release metadata. New code should select from
+* {@link CPOLAR_COMPONENT_RELEASES} by platform and architecture; this alias
+* preserves the original Windows x64 entry for existing callers.
+*/
+const CPOLAR_COMPONENT_RELEASE = CPOLAR_COMPONENT_RELEASES["win32-x64"];
+const DOWNLOAD_PAGE = "https://www.cpolar.com/download";
+const SIGNUP_URL = "https://dashboard.cpolar.com/signup";
+const DASHBOARD_URL = "https://dashboard.cpolar.com/auth";
+const TERMS_URL = "https://www.cpolar.com/tos";
 function inside(parent, child) {
 	const candidate = relative(parent, child);
 	return candidate !== "" && !candidate.startsWith("..") && !isAbsolute(candidate);
@@ -9568,15 +9971,15 @@ async function run(file, args) {
 		});
 	});
 }
-async function defaultFetchArtifact(url, signal) {
+async function defaultFetchArtifact(url, signal, expectedBytes) {
 	return downloadPinnedArtifact({
 		url,
-		expectedBytes: CPOLAR_COMPONENT_RELEASE.downloadBytes,
+		expectedBytes,
 		errorPrefix: "cpolar",
 		signal
 	});
 }
-async function defaultExtractArtifact(archive, destination) {
+async function extractWindowsMsi(archive, destination, executableName) {
 	if (process.platform !== "win32") throw new Error("cpolar_component_unsupported");
 	const unpacked = join(destination, "archive");
 	const administrative = join(destination, "administrative");
@@ -9602,9 +10005,29 @@ async function defaultExtractArtifact(archive, destination) {
 		"/qn",
 		`TARGETDIR=${administrative}`
 	]);
-	const executableRelative = (await readdir(administrative, { recursive: true })).find((entry) => basename(entry).toLowerCase() === "cpolar.exe");
+	const executableRelative = (await readdir(administrative, { recursive: true })).find((entry) => basename(entry).toLowerCase() === executableName.toLowerCase());
+	if (executableRelative === void 0) throw new Error("cpolar_executable_missing");
+	await copyFile(join(administrative, executableRelative), join(destination, executableName));
+}
+async function extractLinuxTarball(archive, destination, executableName) {
+	const unpacked = join(destination, "archive");
+	await mkdir(unpacked, {
+		recursive: true,
+		mode: 448
+	});
+	await run(process.platform === "win32" ? "tar.exe" : "tar", [
+		"-xzf",
+		archive,
+		"-C",
+		unpacked
+	]);
+	const executableRelative = (await readdir(unpacked, { recursive: true })).find((entry) => basename(entry).toLowerCase() === executableName.toLowerCase());
 	if (executableRelative === void 0) throw new Error("cpolar_executable_missing");
-	await copyFile(join(administrative, executableRelative), join(destination, "cpolar.exe"));
+	await copyFile(join(unpacked, executableRelative), join(destination, executableName));
+}
+async function defaultExtractArtifact(archive, destination, release) {
+	if (release.archiveKind === "tar.gz") return extractLinuxTarball(archive, destination, release.executableName);
+	return extractWindowsMsi(archive, destination, release.executableName);
 }
 /** Validate a cpolar Authtoken before it crosses the durable-file boundary. */
 function validateCpolarAuthtoken(value) {
@@ -9622,6 +10045,7 @@ var CpolarComponentManager = class {
 	stagingRoot;
 	platform;
 	arch;
+	release;
 	fetchArtifact;
 	extractArtifact;
 	installed = false;
@@ -9633,9 +10057,10 @@ var CpolarComponentManager = class {
 		if (!isAbsolute(stateDirectory)) throw new Error("cpolar state directory must be absolute");
 		this.platform = options.platform ?? process.platform;
 		this.arch = options.arch ?? process.arch;
+		this.release = CPOLAR_COMPONENT_RELEASES[`${this.platform}-${this.arch}`];
 		this.componentRoot = join(stateDirectory, "components", "cpolar");
-		this.componentStorage = join(this.componentRoot, CPOLAR_COMPONENT_RELEASE.version);
-		this.executable = join(this.componentStorage, "cpolar.exe");
+		this.componentStorage = join(this.componentRoot, this.release?.version ?? CPOLAR_VERSION);
+		this.executable = join(this.componentStorage, this.release?.executableName ?? "cpolar");
 		this.stateRoot = join(stateDirectory, "state", "cpolar");
 		this.configFile = join(this.stateRoot, "cpolar.yml");
 		this.logRoot = join(stateDirectory, "logs", "cpolar");
@@ -9647,13 +10072,18 @@ var CpolarComponentManager = class {
 			this.logRoot,
 			this.stagingRoot
 		]) if (!inside(stateDirectory, child)) throw new Error("cpolar component path escaped its state directory");
-		this.fetchArtifact = options.fetchArtifact ?? defaultFetchArtifact;
-		this.extractArtifact = options.extractArtifact ?? defaultExtractArtifact;
+		const release = this.release;
+		this.fetchArtifact = options.fetchArtifact ?? ((url, signal) => defaultFetchArtifact(url, signal, release?.downloadBytes ?? 0));
+		this.extractArtifact = options.extractArtifact ?? ((archive, destination) => {
+			if (release === void 0) throw new Error("cpolar_component_unsupported");
+			return defaultExtractArtifact(archive, destination, release);
+		});
 	}
 	/** Inspect the managed binary and configuration without using global cpolar state. */
 	async initialize() {
-		this.installed = await regularFile(this.executable, CPOLAR_COMPONENT_RELEASE.executableBytes);
-		if (this.installed && await sha256(this.executable) !== CPOLAR_COMPONENT_RELEASE.executableSha256) {
+		const release = this.release;
+		this.installed = release !== void 0 && await regularFile(this.executable, release.executableBytes);
+		if (this.installed && release !== void 0 && await sha256(this.executable) !== release.executableSha256) {
 			this.installed = false;
 			this.errorCode = "cpolar_component_invalid";
 		}
@@ -9662,18 +10092,19 @@ var CpolarComponentManager = class {
 	}
 	/** Return a safe status that never includes the account token. */
 	status() {
+		const release = this.release ?? CPOLAR_COMPONENT_RELEASE;
 		return Object.freeze({
-			supported: this.platform === CPOLAR_COMPONENT_RELEASE.platform && this.arch === CPOLAR_COMPONENT_RELEASE.arch,
+			supported: this.release !== void 0,
 			installed: this.installed,
 			configured: this.configured,
-			version: CPOLAR_COMPONENT_RELEASE.version,
-			downloadBytes: CPOLAR_COMPONENT_RELEASE.downloadBytes,
-			installedBytes: CPOLAR_COMPONENT_RELEASE.executableBytes,
-			sourceUrl: CPOLAR_COMPONENT_RELEASE.downloadUrl,
-			downloadPage: CPOLAR_COMPONENT_RELEASE.downloadPage,
-			signupUrl: CPOLAR_COMPONENT_RELEASE.signupUrl,
-			dashboardUrl: CPOLAR_COMPONENT_RELEASE.dashboardUrl,
-			termsUrl: CPOLAR_COMPONENT_RELEASE.termsUrl,
+			version: release.version,
+			downloadBytes: release.downloadBytes,
+			installedBytes: release.executableBytes,
+			sourceUrl: release.downloadUrl,
+			downloadPage: DOWNLOAD_PAGE,
+			signupUrl: SIGNUP_URL,
+			dashboardUrl: DASHBOARD_URL,
+			termsUrl: TERMS_URL,
 			storagePath: this.componentRoot,
 			...this.errorCode === void 0 ? {} : { errorCode: this.errorCode }
 		});
@@ -9681,7 +10112,8 @@ var CpolarComponentManager = class {
 	/** Download, verify, and administratively extract cpolar after explicit confirmation. */
 	install() {
 		return this.enqueue(async () => {
-			if (this.platform !== CPOLAR_COMPONENT_RELEASE.platform || this.arch !== CPOLAR_COMPONENT_RELEASE.arch) throw new Error("cpolar_component_unsupported");
+			const release = this.release;
+			if (release === void 0) throw new Error("cpolar_component_unsupported");
 			await mkdir(this.stagingRoot, {
 				recursive: true,
 				mode: 448
@@ -9695,26 +10127,26 @@ var CpolarComponentManager = class {
 				timeout.unref();
 				let bytes;
 				try {
-					bytes = await this.fetchArtifact(CPOLAR_COMPONENT_RELEASE.downloadUrl, controller.signal);
+					bytes = await this.fetchArtifact(release.downloadUrl, controller.signal);
 				} finally {
 					clearTimeout(timeout);
 				}
-				if (createHash("sha256").update(bytes).digest("hex") !== CPOLAR_COMPONENT_RELEASE.downloadSha256) throw new Error("cpolar_download_hash_mismatch");
-				const archive = join(staging, "cpolar.zip");
+				if (createHash("sha256").update(bytes).digest("hex") !== release.downloadSha256) throw new Error("cpolar_download_hash_mismatch");
+				const archive = join(staging, release.archiveKind === "tar.gz" ? "cpolar.tar.gz" : "cpolar.zip");
 				await writeFile(archive, bytes, {
 					flag: "wx",
 					mode: 384
 				});
 				await this.extractArtifact(archive, staging);
-				const extracted = join(staging, "cpolar.exe");
-				if (!await regularFile(extracted, CPOLAR_COMPONENT_RELEASE.executableBytes) || await sha256(extracted) !== CPOLAR_COMPONENT_RELEASE.executableSha256) throw new Error("cpolar_executable_hash_mismatch");
+				const extracted = join(staging, release.executableName);
+				if (!await regularFile(extracted, release.executableBytes) || await sha256(extracted) !== release.executableSha256) throw new Error("cpolar_executable_hash_mismatch");
 				const candidate = join(this.componentRoot, `.install-${randomBytes(12).toString("hex")}`);
 				await mkdir(candidate, {
 					recursive: true,
 					mode: 448
 				});
-				await copyFile(extracted, join(candidate, "cpolar.exe"));
-				await chmod(join(candidate, "cpolar.exe"), 448);
+				await copyFile(extracted, join(candidate, release.executableName));
+				await chmod(join(candidate, release.executableName), 448);
 				await rm(this.componentStorage, {
 					recursive: true,
 					force: true
@@ -10404,6 +10836,16 @@ function selectLanNetwork(requestedAddress, requestedInterface, table, preferred
 	if (physicalCandidates.length === 1) return physicalCandidates[0];
 	throw new Error(`more than one LAN address is active; rerun with --address and one of: ${candidates.map((entry) => `${entry.name}=${entry.address}`).join(", ")}`);
 }
+/**
+* True when the failure came from LAN selection (the configured network is
+* gone, nothing is up, or several are) rather than from config/TLS code.
+* Callers use it to degrade (warn + stay down) instead of failing boot.
+* Pinned to the selectLanNetwork message contract — keep in sync.
+*/
+function isNetworkSelectionError(error) {
+	const message = error instanceof Error ? error.message : String(error ?? "");
+	return message.includes("is not connected") || message.includes("no active private LAN address was found") || message.includes("more than one LAN address is active") || message.includes("has more than one private IPv4 address") || message.includes("is not an active private LAN address");
+}
 function assertMatchingCa(certPem, keyPem) {
 	const certificate = new X509Certificate(certPem);
 	if (!certificate.ca || certificate.subject !== certificate.issuer || !certificate.verify(certificate.publicKey)) throw new Error("managed TLS CA must be a self-signed CA certificate");
@@ -10940,7 +11382,9 @@ async function apply(ctx, config) {
 			...candidateConfig,
 			upstreamOrigin: template.upstreamOrigin.origin
 		});
-		const candidate = new MobileAccessGateway(resolved, new JsonDeviceStore(resolved.stateFile, resolved.maxDevices), mobileAccess, upstreamLoginUrl, webSocketPaths, blockedUpgradePaths);
+		const candidate = new MobileAccessGateway(resolved, new JsonDeviceStore(resolved.stateFile, resolved.maxDevices), mobileAccess, upstreamLoginUrl, webSocketPaths, blockedUpgradePaths, (source, code) => {
+			logger.warn("%s discovery degraded while DSH remains available: %s", source, code);
+		});
 		await candidate.start();
 		lanGateway = candidate;
 		const removeTaskSink = taskEventHub.add(candidate);
@@ -10965,7 +11409,14 @@ async function apply(ctx, config) {
 		}, (error) => {
 			process.emitWarning(`DSH Mobile could not follow the current LAN address: ${error instanceof Error ? error.message : String(error)}`, { code: "DSH_MOBILE_NETWORK_REFRESH" });
 		});
-		await following.initialize(2e3);
+		try {
+			await following.initialize(2e3);
+		} catch (error) {
+			if (!isNetworkSelectionError(error)) throw error;
+			const detail = error instanceof Error ? error.message : String(error);
+			process.emitWarning(`DSH Mobile: ${detail}; mobile access stays dormant until the network returns or setup is re-run — DSH itself keeps running.`, { code: "DSH_MOBILE_NETWORK_UNAVAILABLE" });
+			following.beginPolling(2e3);
+		}
 		return following;
 	};
 	const lanControlFile = parseControlFile(config.controlFile);