dsh-mobile 0.5.3 → 0.5.5

package/lib/index.d.mts

@@ -151,6 +151,9 @@ export declare class AccessController {
   renew(deviceToken: string): Promise<RenewalResult>;
   /** Validate a persistent device credential without consuming a Session slot. */
   probe(deviceToken: string): Promise<DeviceProbeResult>;
+  /** Validate a device credential without writing state or opening a Session. */
+  authorizeDevice(deviceToken: string): DeviceProbeResult;
+  private requireDevice;
   /** Resolve a short Session Cookie without revealing whether device or Session failed. */
   authorizeSession(sessionToken: string): SessionAuthorization;
   /** Require the Session-bound anti-CSRF value for an authenticated mutation. */
@@ -227,6 +230,24 @@ export declare class RequestTrustPolicy {
 }
 //#endregion
 //#region src/config.d.ts
+/** Optional compression for exact, already authorized WebSocket paths. */
+interface WebSocketCompressionConfig {
+  paths?: string[];
+  maxMessageBytes?: number;
+  maxQueuedBytes?: number;
+  thresholdBytes?: number;
+  concurrencyLimit?: number;
+  level?: number;
+}
+/** Validated compression settings; an empty path list keeps the raw transport. */
+interface ResolvedWebSocketCompressionConfig {
+  readonly paths: readonly string[];
+  readonly maxMessageBytes: number;
+  readonly maxQueuedBytes: number;
+  readonly thresholdBytes: number;
+  readonly concurrencyLimit: number;
+  readonly level: number;
+}
 /** TLS source accepted by the LAN listener. */
 interface ProvidedTlsConfig {
   readonly mode: 'provided';
@@ -265,6 +286,8 @@ interface PluginConfig {
   mobileCompatibilityFile?: string;
   /** Optional application-phase client package ids omitted only from the mobile boot graph. */
   excludedClientModules?: string[];
+  /** Compression is opt-in; it does not authorize additional WebSocket paths. */
+  websocketCompression?: WebSocketCompressionConfig;
   /** Stable public discovery identifier; it is not an authentication secret. */
   instanceId?: string;
   /** Managed CA certificate offered to the Android installer after fingerprint binding. */
@@ -306,6 +329,7 @@ interface ResolvedGatewayConfig {
   readonly mobileLayoutFile: string;
   readonly mobileCompatibilityFile: string;
   readonly excludedClientModules: readonly string[];
+  readonly websocketCompression: ResolvedWebSocketCompressionConfig;
   readonly instanceId: string;
   readonly pairingCaFile?: string;
   readonly tls: TlsConfig;
@@ -690,6 +714,7 @@ export declare class MobileAccessGateway {
   private authorize;
   private requireCsrf;
   private setSessionCookies;
+  private setBrowserDeviceBinding;
   private handlePair;
   private handleRenew;
   private handleNativePair;
@@ -1535,10 +1560,12 @@ export declare class OriginController implements RemoteProviderController {
 /**
  * Pinned cloudflared components fetched only after an explicit user action.
  *
- * Unlike the cpolar archive each artifact IS the executable: there is nothing
- * to unpack, so the download digest and the installed digest are the same pair.
- * `--no-autoupdate` is passed at runtime as well, so the pinned bytes stay the
- * bytes that were verified.
+ * Cloudflare ships bare executables for Windows and Linux but a `.tgz` for
+ * macOS, so an artifact carries two digests: the bytes on the wire
+ * (`downloadBytes`/`downloadSha256`) and the executable that ends up installed
+ * (`executableBytes`/`executableSha256`). For bare artifacts the two pairs are
+ * identical. `--no-autoupdate` is passed at runtime as well, so the pinned
+ * bytes stay the bytes that were verified.
  */
 interface CloudflaredArtifact {
   readonly version: string;
@@ -1548,7 +1575,19 @@ interface CloudflaredArtifact {
   readonly downloadBytes: number;
   readonly downloadSha256: string;
   readonly executableName: string;
-}
+  /** Bytes of the installed executable; equals `downloadBytes` for bare artifacts. */
+  readonly executableBytes: number;
+  readonly executableSha256: string;
+  /** Set when the download is an archive rather than the executable itself. */
+  readonly archive?: CloudflaredArchive;
+}
+interface CloudflaredArchive {
+  readonly format: 'tgz';
+  /** Member basename to install, e.g. `cloudflared`. */
+  readonly member: string;
+}
+/** Pinned official cloudflared release metadata for supported desktop targets. */
+export declare const CLOUDFLARED_COMPONENT_RELEASES: Readonly<Record<string, CloudflaredArtifact>>;
 /**
  * Canonical release metadata. New code should select from
  * {@link CLOUDFLARED_COMPONENT_RELEASES} by platform and architecture; this
@@ -1578,6 +1617,7 @@ interface CloudflaredComponentManagerOptions {
   readonly platform?: NodeJS.Platform;
   readonly arch?: string;
   readonly fetchArtifact?: (url: string, signal: AbortSignal) => Promise<Uint8Array>;
+  readonly extractArtifact?: (archive: string, destination: string, member: string) => Promise<void>;
 }
 /** Owns the optional cloudflared binary inside DSH Mobile state. */
 export declare class CloudflaredComponentManager {
@@ -1591,6 +1631,7 @@ export declare class CloudflaredComponentManager {
   private readonly arch;
   private readonly release;
   private readonly fetchArtifact;
+  private readonly extractArtifact;
   private installed;
   private errorCode;
   private queue;