dsh-mobile 0.4.6 → 0.4.7

package/lib/index.d.mts

@@ -262,6 +262,8 @@ interface PluginConfig {
   mobileLayoutFile?: string;
   /** Standalone browser compatibility bundle used before DSH boot. */
   mobileCompatibilityFile?: string;
+  /** Optional application-phase client package ids omitted only from the mobile boot graph. */
+  excludedClientModules?: string[];
   /** Stable public discovery identifier; it is not an authentication secret. */
   instanceId?: string;
   /** Managed CA certificate offered to the Android installer after fingerprint binding. */
@@ -302,6 +304,7 @@ interface ResolvedGatewayConfig {
   readonly customScriptFile: string;
   readonly mobileLayoutFile: string;
   readonly mobileCompatibilityFile: string;
+  readonly excludedClientModules: readonly string[];
   readonly instanceId: string;
   readonly pairingCaFile?: string;
   readonly tls: TlsConfig;
@@ -589,8 +592,8 @@ declare class MobileAccessService extends Service {
 declare function createMobileAccessService(ctx: Context): MobileAccessService;
 //#endregion
 //#region src/gateway.d.ts
-/** Replace only DSH's layout client module while retaining its complete plugin graph. */
-declare function rewriteMobileIndex(html: string): string;
+/** Rewrite the dedicated mobile graph; exclusions are opt-in and leave stock DSH unchanged. */
+declare function rewriteMobileIndex(html: string, excludedClientModules?: readonly string[]): string;
 /** Authenticated TLS edge in front of the ordinary loopback-only DSH Web server. */
 declare class MobileAccessGateway {
   readonly config: ResolvedGatewayConfig;
@@ -616,6 +619,7 @@ declare class MobileAccessGateway {
   private mdnsError;
   /** Names of the bundled mobile assets that could not be read, if any. */
   private mobileAssetError;
+  private lastModuleExclusionError;
   private bonjour;
   private pairingCaCertificate;
   private listenerPort;

package/lib/index.mjs

@@ -761,6 +761,7 @@ const Config = z.object({
 	customScriptFile: z.string().hidden(),
 	mobileLayoutFile: z.string().hidden(),
 	mobileCompatibilityFile: z.string().hidden(),
+	excludedClientModules: z.array(String).default([]),
 	instanceId: z.string().hidden(),
 	pairingCaFile: z.string().hidden(),
 	initiallyEnabled: z.boolean().hidden().required(),
@@ -797,6 +798,13 @@ function absoluteFile(value, name) {
 	if (typeof value !== "string" || value.length === 0 || !isAbsolute(value)) throw new Error(`${name} must be an absolute file path`);
 	return resolve(value);
 }
+function excludedClientModules(value) {
+	if (value === void 0) return Object.freeze([]);
+	if (!Array.isArray(value) || value.some((id) => typeof id !== "string" || id.length === 0 || id.trim() !== id)) throw new Error("excludedClientModules must be an array of exact, non-empty client module ids");
+	const ids = value;
+	if (new Set(ids).size !== ids.length) throw new Error("excludedClientModules must not contain duplicate ids");
+	return Object.freeze([...ids]);
+}
 /** Resolve the hidden runtime-control file independently from gateway configuration. */
 function parseControlFile(value) {
 	return absoluteFile(value, "controlFile");
@@ -887,6 +895,7 @@ function parseGatewayConfig(raw) {
 		customScriptFile: value.customScriptFile === void 0 ? join(dirname(absoluteFile(value.stateFile, "stateFile")), "mobile.js") : absoluteFile(value.customScriptFile, "customScriptFile"),
 		mobileLayoutFile: value.mobileLayoutFile === void 0 ? fileURLToPath(new URL("./mobile-layout.js", import.meta.url)) : absoluteFile(value.mobileLayoutFile, "mobileLayoutFile"),
 		mobileCompatibilityFile: value.mobileCompatibilityFile === void 0 ? fileURLToPath(new URL("./mobile-compat.js", import.meta.url)) : absoluteFile(value.mobileCompatibilityFile, "mobileCompatibilityFile"),
+		excludedClientModules: excludedClientModules(value.excludedClientModules),
 		instanceId: value.instanceId === void 0 ? createHash("sha256").update(absoluteFile(value.stateFile, "stateFile")).digest("hex") : /^[a-f\d]{64}$/u.test(value.instanceId) ? value.instanceId : (() => {
 			throw new Error("instanceId must be a lowercase SHA-256 value");
 		})(),
@@ -2614,6 +2623,17 @@ const SIDEBAR_MODULE = "@deepseek-ai/dsh-client-ui-sidebar";
 const SETTINGS_MODULE = "@deepseek-ai/dsh-client-ui-settings";
 const API_GATEWAY_MODULE = "@deepseek-ai/dsh-api-gateway";
 const API_REMOTES_MODULE = "@deepseek-ai/dsh-api-remotes";
+const MOBILE_BOOT_CORE_MODULES = /* @__PURE__ */ new Set([
+	MOBILE_CLIENT_MODULE,
+	MOBILE_LAYOUT_MODULE,
+	CONNECTION_MODULE,
+	RUNTIME_MODULE,
+	RENDERER_MODULE,
+	SIDEBAR_MODULE,
+	SETTINGS_MODULE,
+	API_GATEWAY_MODULE,
+	API_REMOTES_MODULE
+]);
 const MOBILE_LAYOUT_DEPENDENCY_PROFILES = Object.freeze([Object.freeze({
 	slots: RUNTIME_MODULE,
 	dependencies: Object.freeze([RUNTIME_MODULE, "@deepseek-ai/dsh-client-ui-theme"])
@@ -2719,13 +2739,49 @@ function revisionedMobileBatchPath(entries) {
 		path: `${MOBILE_BOOT_BATCH_PREFIX}${key}.js`
 	};
 }
+var ExcludedClientModulesError = class extends Error {
+	constructor(message) {
+		super(`excludedClientModules: ${message}`);
+	}
+};
+/** Validate graph edges before removing application rows from both manifest views. */
+function excludeMobileBootEntries(entries, batches, excludedIds) {
+	if (excludedIds.length === 0) return;
+	const excluded = new Set(excludedIds);
+	if (excluded.size !== excludedIds.length) throw new ExcludedClientModulesError("duplicate module ids");
+	const byId = new Map(entries.map((entry) => [entry.id, entry]));
+	const phases = /* @__PURE__ */ new Map();
+	for (const batch of batches) for (const id of batch.entries) {
+		if (phases.has(id)) throw new ExcludedClientModulesError(`upstream module ${id} belongs to multiple batches`);
+		phases.set(id, batch.phase);
+	}
+	for (const entry of entries) if (!phases.has(entry.id)) throw new ExcludedClientModulesError(`upstream module ${entry.id} belongs to no batch`);
+	for (const id of excluded) {
+		const entry = byId.get(id);
+		if (entry === void 0) throw new ExcludedClientModulesError(`module ${id} is not installed in this DSH client graph`);
+		if (MOBILE_BOOT_CORE_MODULES.has(id) || entry.immediately === true || phases.get(id) !== "application") throw new ExcludedClientModulesError(`module ${id} is required for mobile boot or belongs to a bootstrap batch`);
+	}
+	for (const entry of entries) {
+		if (excluded.has(entry.id)) continue;
+		for (const [field, edges] of [["inject", entry.inject], ["external", entry.external]]) {
+			if (edges !== void 0 && (!Array.isArray(edges) || edges.some((id) => typeof id !== "string"))) throw new ExcludedClientModulesError(`upstream module ${entry.id} has malformed ${field} dependencies`);
+			for (const dependency of edges ?? []) {
+				const packageId = dependency.endsWith("/client") ? dependency.slice(0, -7) : dependency;
+				if (excluded.has(packageId)) throw new ExcludedClientModulesError(`module ${entry.id} still depends on excluded module ${packageId}; exclude the dependent too or keep ${packageId}`);
+			}
+		}
+	}
+	entries.splice(0, entries.length, ...entries.filter((entry) => !excluded.has(entry.id)));
+	for (const batch of batches) batch.entries = batch.entries.filter((id) => !excluded.has(id));
+	batches.splice(0, batches.length, ...batches.filter((batch) => batch.entries.length > 0));
+}
 /**
 * Parse one upstream boot manifest and rewire the layout entry onto the
-* gateway-owned layout module. The layout entry's URL and revision become the
-* local `mobile-layout.js` path; the dedicated frontend is authenticated in the
-* gateway, so the requested layout needs no upstream address.
+* gateway-owned layout module. Optional exclusions remove application entries
+* and identify every affected batch for reassembly. The dedicated frontend is
+* authenticated in the gateway, so the layout needs no upstream address.
 */
-function parseMobileBootPlan(html) {
+function parseMobileBootPlan(html, excludedClientModules = []) {
 	const assignment = /(?:window\.__DSH_BOOT__|globalThis\["__DSH_BOOT__"\])\s*=\s*/u.exec(html);
 	if (assignment?.index === void 0) throw new Error("upstream DSH index has no boot manifest");
 	const replaceStart = assignment.index;
@@ -2744,14 +2800,17 @@ function parseMobileBootPlan(html) {
 	layout[0].url = MOBILE_LAYOUT_PATH;
 	layout[0].rev = `dsh-mobile-layout-${DSH_MOBILE_VERSION}`;
 	const parsedBatches = parsed.batches;
-	if (parsedBatches === void 0) return Object.freeze({
-		parsed,
-		entries,
-		slotProvider: dependencyProfile.slots,
-		assignment: assignment[0],
-		replaceStart,
-		replaceEnd: scriptEnd
-	});
+	if (parsedBatches === void 0) {
+		if (excludedClientModules.length > 0) throw new ExcludedClientModulesError("this DSH version has no batched boot manifest; disable exclusions or update DSH");
+		return Object.freeze({
+			parsed,
+			entries,
+			slotProvider: dependencyProfile.slots,
+			assignment: assignment[0],
+			replaceStart,
+			replaceEnd: scriptEnd
+		});
+	}
 	if (!Array.isArray(parsedBatches)) throw new Error("upstream DSH boot manifest batches are malformed");
 	const batches = parsedBatches;
 	const entryById = new Map(entries.map((entry) => [entry.id, entry]));
@@ -2763,15 +2822,26 @@ function parseMobileBootPlan(html) {
 	}
 	if (layoutBatches.length !== 1 || layoutBatches[0]?.phase !== "application") throw new Error("upstream DSH boot manifest has no unique application layout batch");
 	const layoutBatch = layoutBatches[0];
-	const planEntries = layoutBatch.entries.map((id) => {
-		const entry = entryById.get(id);
-		if (entry === void 0 || typeof entry.url !== "string" || typeof entry.rev !== "string") throw new Error("upstream DSH boot manifest batches are malformed");
-		return Object.freeze({
-			id,
-			url: entry.url,
-			rev: entry.rev
-		});
-	});
+	const originalApplicationBatches = batches.filter((batch) => batch.phase === "application").map((batch) => ({
+		...batch,
+		entries: [...batch.entries]
+	}));
+	excludeMobileBootEntries(entries, batches, excludedClientModules);
+	const affectedBatchUrls = new Set(originalApplicationBatches.filter((batch) => batch.entries.some((id) => excludedClientModules.includes(id))).map((batch) => batch.url));
+	const rewrittenBatchEntries = batches.filter((batch) => batch === layoutBatch || batch.phase === "application" && affectedBatchUrls.has(batch.url)).map((batch) => ({
+		batch,
+		entries: [...batch.entries].sort((left, right) => left < right ? -1 : left > right ? 1 : 0).map((id) => {
+			const entry = entryById.get(id);
+			if (entry === void 0 || typeof entry.url !== "string" || typeof entry.rev !== "string") throw new Error("upstream DSH boot manifest batches are malformed");
+			return Object.freeze({
+				id,
+				url: entry.url,
+				rev: entry.rev
+			});
+		})
+	}));
+	const planEntries = rewrittenBatchEntries.find((candidate) => candidate.batch === layoutBatch)?.entries;
+	if (planEntries === void 0) throw new Error("upstream DSH boot manifest lost the application layout batch");
 	return Object.freeze({
 		parsed,
 		entries,
@@ -2781,7 +2851,9 @@ function parseMobileBootPlan(html) {
 		replaceStart,
 		replaceEnd: scriptEnd,
 		layoutBatch,
-		planEntries
+		planEntries,
+		originalApplicationBatches,
+		rewrittenBatchEntries
 	});
 }
 /**
@@ -2840,30 +2912,62 @@ function splitMobileBootBatch(entries, sizes, passThrough) {
 		rows
 	};
 }
+function escapeMobilePreloadAttribute(value) {
+	return value.replaceAll("&", "&amp;").replaceAll("\"", "&quot;").replaceAll("<", "&lt;").replaceAll(">", "&gt;");
+}
+function mobileApplicationPreload(url) {
+	return `<link rel="preload" as="script" href="${escapeMobilePreloadAttribute(url)}">`;
+}
+function preloadAttribute(tag, name) {
+	const match = new RegExp(`(?:^|\\s)${name}\\s*=\\s*(?:"([^"]*)"|'([^']*)')`, "iu").exec(tag);
+	return match?.[1] ?? match?.[2];
+}
+/** Replace only DSH's application-script preloads; bootstrap and unrelated links are untouched. */
+function rewriteMobileApplicationPreloads(html, replacements) {
+	if (replacements.size === 0) return html;
+	const escaped = new Map([...replacements].map(([url, markup]) => [escapeMobilePreloadAttribute(url), markup]));
+	return html.replace(/<link\b[^>]*>/giu, (tag) => {
+		if (!preloadAttribute(tag, "rel")?.split(/\s+/u).includes("preload") || preloadAttribute(tag, "as") !== "script") return tag;
+		return escaped.get(preloadAttribute(tag, "href") ?? "") ?? tag;
+	});
+}
 function rewriteMobileIndexWithBatch(html, options = {}) {
-	const plan = parseMobileBootPlan(html);
+	const plan = parseMobileBootPlan(html, options.excludedClientModules);
 	const remoteSettings = orderAuthenticatedSettings(plan.entries, plan.slotProvider);
 	let batches = [];
-	if (plan.batches !== void 0 && plan.layoutBatch !== void 0 && plan.planEntries !== void 0) {
-		const split = splitMobileBootBatch(plan.planEntries, options.sizes ?? /* @__PURE__ */ new Map(), options.passThrough ?? /* @__PURE__ */ new Set());
-		const at = plan.batches.indexOf(plan.layoutBatch);
-		if (at < 0) throw new Error("upstream DSH boot manifest has no unique application layout batch");
-		plan.batches.splice(at, 1, ...split.rows);
-		batches = Object.freeze(split.plans);
+	let preloadReplacements = /* @__PURE__ */ new Map();
+	if (plan.batches !== void 0 && plan.rewrittenBatchEntries !== void 0) {
+		const rewrites = plan.rewrittenBatchEntries.map(({ batch, entries }) => ({
+			batch,
+			split: splitMobileBootBatch(entries, options.sizes ?? /* @__PURE__ */ new Map(), options.passThrough ?? /* @__PURE__ */ new Set())
+		}));
+		if (rewrites.reduce((count, item) => count + item.split.plans.length, 0) > MAX_MOBILE_BOOT_BATCHES) throw new Error(`upstream DSH mobile boot requires more than ${String(MAX_MOBILE_BOOT_BATCHES)} merged batches`);
+		for (const { batch, split } of rewrites) {
+			const at = plan.batches.indexOf(batch);
+			if (at < 0) throw new Error("upstream DSH boot manifest lost an application batch");
+			plan.batches.splice(at, 1, ...split.rows);
+			batches = [...batches, ...split.plans];
+		}
+		for (const original of plan.originalApplicationBatches ?? []) {
+			const replacement = rewrites.find((item) => item.batch.url === original.url);
+			preloadReplacements.set(original.url, replacement === void 0 ? plan.batches.some((batch) => batch.url === original.url) ? mobileApplicationPreload(original.url) : "" : replacement.split.rows.map((row) => mobileApplicationPreload(row.url)).join(""));
+		}
+		batches = Object.freeze(batches);
 		plan.parsed.rev = createHash("sha256").update(JSON.stringify({
 			entries: plan.entries,
 			batches: plan.batches
 		})).digest("hex").slice(0, 16);
 	}
 	const replacement = `${MOBILE_GATEWAY_REACHABILITY_BOOTSTRAP}${remoteSettings ? MOBILE_AUTHENTICATED_TRANSPORT_BOOTSTRAP : ""}${MOBILE_CSRF_FETCH_BOOTSTRAP}window.__DSH_MOBILE_FRONTEND__="dedicated";${plan.assignment}${JSON.stringify(plan.parsed)};`;
+	const rewritten = `${html.slice(0, plan.replaceStart)}${replacement}${html.slice(plan.replaceEnd)}`;
 	return Object.freeze({
-		html: ensureMobileViewport(ensureMobileCompatibility(`${html.slice(0, plan.replaceStart)}${replacement}${html.slice(plan.replaceEnd)}`)),
+		html: ensureMobileViewport(ensureMobileCompatibility(rewriteMobileApplicationPreloads(rewritten, preloadReplacements))),
 		batches
 	});
 }
-/** Replace only DSH's layout client module while retaining its complete plugin graph. */
-function rewriteMobileIndex(html) {
-	return rewriteMobileIndexWithBatch(html).html;
+/** Rewrite the dedicated mobile graph; exclusions are opt-in and leave stock DSH unchanged. */
+function rewriteMobileIndex(html, excludedClientModules = []) {
+	return rewriteMobileIndexWithBatch(html, { excludedClientModules }).html;
 }
 var ByteLimitTransform = class extends Transform {
 	maximum;
@@ -3307,6 +3411,7 @@ var MobileAccessGateway = class {
 	mdnsError;
 	/** Names of the bundled mobile assets that could not be read, if any. */
 	mobileAssetError;
+	lastModuleExclusionError;
 	bonjour;
 	pairingCaCertificate;
 	listenerPort;
@@ -4276,11 +4381,26 @@ var MobileAccessGateway = class {
 			let body;
 			try {
 				const html = Buffer.concat(chunks).toString("utf8");
-				const plan = parseMobileBootPlan(html);
-				const rewritten = rewriteMobileIndexWithBatch(html, plan.planEntries === void 0 ? {} : await this.resolveMobileBootSizes(plan.planEntries));
+				const plan = parseMobileBootPlan(html, this.config.excludedClientModules);
+				const rewritten = rewriteMobileIndexWithBatch(html, plan.rewrittenBatchEntries === void 0 ? { excludedClientModules: this.config.excludedClientModules } : {
+					...await this.resolveMobileBootSizes(plan.rewrittenBatchEntries.flatMap((batch) => batch.entries)),
+					excludedClientModules: this.config.excludedClientModules
+				});
 				for (const batch of rewritten.batches) this.rememberMobileBootBatch(batch);
 				body = Buffer.from(rewritten.html);
-			} catch {
+			} catch (error) {
+				if (error instanceof ExcludedClientModulesError) {
+					const detail = error.message.replace(/[\r\n]/gu, " ").slice(0, 512);
+					if (detail !== this.lastModuleExclusionError) {
+						this.lastModuleExclusionError = detail;
+						process.emitWarning(detail, { code: "DSH_MOBILE_MODULE_EXCLUSION_INVALID" });
+					}
+					sendJson(response, 409, {
+						error: "excluded_client_modules_invalid",
+						detail
+					}, this.tlsEnabled);
+					return;
+				}
 				throw new HttpError(502, "upstream_unavailable");
 			}
 			const headers = sanitizeResponseHeaders(proxied.headers, this.config.upstreamOrigin);