dsh-mobile 0.5.3 → 0.5.5

package/lib/index.mjs

@@ -16,6 +16,7 @@ import { promisify } from "node:util";
 import { createGzip, gzip } from "node:zlib";
 import Bonjour from "bonjour-service";
 import * as QRCode from "qrcode";
+import WebSocket, { WebSocketServer } from "ws";
 import { Logger, Service } from "@deepseek-ai/cordis";
 import { connect as connect$1 } from "node:tls";
 import { generate } from "selfsigned";
@@ -241,15 +242,10 @@ var AccessController = class {
 	/** Exchange a valid persistent device credential for a new short Session. */
 	async renew(deviceToken) {
 		this.requireInitialized();
-		if (deviceToken.length > 512) throw new AccessError(401, "authentication_failed");
 		return this.exclusive(async () => {
 			const now = this.now();
-			const tokenDigest = digest(deviceToken);
-			const index = this.devices.findIndex((device) => timingSafeEqual(Buffer.from(device.tokenDigest, "hex"), tokenDigest));
-			const device = this.devices[index];
-			if (device === void 0) throw new AccessError(401, "authentication_failed");
-			if (device.revokedAt !== void 0) throw new AccessError(401, "device_revoked");
-			if (device.expiresAt <= now) throw new AccessError(401, "device_expired");
+			const device = this.requireDevice(deviceToken, now);
+			const index = this.devices.indexOf(device);
 			const updated = Object.freeze({
 				...device,
 				lastSeenAt: now
@@ -264,15 +260,10 @@ var AccessController = class {
 	/** Validate a persistent device credential without consuming a Session slot. */
 	async probe(deviceToken) {
 		this.requireInitialized();
-		if (deviceToken.length > 512) throw new AccessError(401, "authentication_failed");
 		return this.exclusive(async () => {
 			const now = this.now();
-			const tokenDigest = digest(deviceToken);
-			const index = this.devices.findIndex((device) => timingSafeEqual(Buffer.from(device.tokenDigest, "hex"), tokenDigest));
-			const device = this.devices[index];
-			if (device === void 0) throw new AccessError(401, "authentication_failed");
-			if (device.revokedAt !== void 0) throw new AccessError(401, "device_revoked");
-			if (device.expiresAt <= now) throw new AccessError(401, "device_expired");
+			const device = this.requireDevice(deviceToken, now);
+			const index = this.devices.indexOf(device);
 			const updated = Object.freeze({
 				...device,
 				lastSeenAt: now
@@ -287,6 +278,24 @@ var AccessController = class {
 			});
 		});
 	}
+	/** Validate a device credential without writing state or opening a Session. */
+	authorizeDevice(deviceToken) {
+		this.requireInitialized();
+		const device = this.requireDevice(deviceToken, this.now());
+		return Object.freeze({
+			deviceId: device.id,
+			deviceExpiresAt: device.expiresAt
+		});
+	}
+	requireDevice(deviceToken, now) {
+		if (deviceToken.length > 512) throw new AccessError(401, "authentication_failed");
+		const tokenDigest = digest(deviceToken);
+		const device = this.devices.find((candidate) => timingSafeEqual(Buffer.from(candidate.tokenDigest, "hex"), tokenDigest));
+		if (device === void 0) throw new AccessError(401, "authentication_failed");
+		if (device.revokedAt !== void 0) throw new AccessError(401, "device_revoked");
+		if (device.expiresAt <= now) throw new AccessError(401, "device_expired");
+		return device;
+	}
 	/** Resolve a short Session Cookie without revealing whether device or Session failed. */
 	authorizeSession(sessionToken) {
 		this.requireInitialized();
@@ -745,6 +754,112 @@ async function probeTcpReachable(host, port, timeoutMs = 1500) {
 	});
 }
 //#endregion
+//#region src/websocket-paths.ts
+/** Cap the admin-approved extra WebSocket upgrade paths (exact pathnames). */
+const MAX_EXTRA_WEBSOCKET_PATHS = 16;
+const MAX_WEBSOCKET_PATH_LENGTH = 256;
+function fail(code) {
+	throw new Error(code);
+}
+/**
+* Validate one exact pathname for proxying. Query strings are matched at
+* upgrade time, so only the pathname is stored. Rejects anything the
+* gateway cannot match exactly.
+*/
+function validateWebSocketPath(value) {
+	if (typeof value !== "string") fail("websocket_path_invalid");
+	const path = value;
+	if (path.length === 0 || path.length > 256) fail("websocket_path_invalid");
+	if (!path.startsWith("/")) fail("websocket_path_invalid");
+	if (/[\s\u0000-\u001f\u007f#?]/u.test(path)) fail("websocket_path_invalid");
+	if (path.includes("..")) fail("websocket_path_invalid");
+	return path;
+}
+/** Validate a whole replacement list all-or-nothing; duplicates collapse. */
+function normalizeWebSocketPaths(value) {
+	if (!Array.isArray(value)) fail("websocket_paths_invalid");
+	if (value.length > 16) fail("websocket_paths_invalid");
+	const seen = /* @__PURE__ */ new Set();
+	for (const entry of value) {
+		const path = validateWebSocketPath(entry);
+		seen.add(path);
+	}
+	return [...seen];
+}
+/** Cap remembered rejected upgrade paths offered for one-click approval. */
+const MAX_BLOCKED_UPGRADE_PATHS = 32;
+/**
+* In-memory log of rejected third-party upgrade paths, shared by every
+* gateway instance so the approval UI sees attempts on any listener.
+* Bounded and newest-first; a restart clears it (attempts reappear on
+* the next blocked handshake).
+*/
+var BlockedUpgradePathLog = class {
+	entries = /* @__PURE__ */ new Map();
+	record(pathname) {
+		const now = Date.now();
+		const stats = this.entries.get(pathname);
+		if (stats === void 0) {
+			if (this.entries.size >= 32) {
+				let oldest;
+				for (const [path, entry] of this.entries) if (oldest === void 0 || entry.lastSeen < (this.entries.get(oldest)?.lastSeen ?? 0)) oldest = path;
+				if (oldest !== void 0) this.entries.delete(oldest);
+			}
+			this.entries.set(pathname, {
+				attempts: 1,
+				firstSeen: now,
+				lastSeen: now
+			});
+			return;
+		}
+		stats.attempts += 1;
+		stats.lastSeen = now;
+	}
+	report() {
+		return [...this.entries].map(([path, stats]) => ({
+			path,
+			...stats
+		})).sort((a, b) => b.lastSeen - a.lastSeen);
+	}
+};
+/** File-backed store shared by every gateway instance (LAN and remote). */
+var WebSocketPathStore = class {
+	file;
+	paths = /* @__PURE__ */ new Set();
+	loaded = false;
+	constructor(file) {
+		this.file = file;
+	}
+	/** Snapshot for the upgrade check. */
+	has(pathname) {
+		return this.paths.has(pathname);
+	}
+	list() {
+		return [...this.paths];
+	}
+	async load() {
+		if (!this.loaded) {
+			try {
+				const raw = JSON.parse(await readFile(this.file, "utf8"));
+				this.paths = new Set(normalizeWebSocketPaths(raw.paths ?? []));
+			} catch {
+				this.paths = /* @__PURE__ */ new Set();
+			}
+			this.loaded = true;
+		}
+		return this.list();
+	}
+	/** Replace the whole list after validating; persists atomically. */
+	async replace(paths) {
+		const next = normalizeWebSocketPaths([...paths]);
+		await mkdir(dirname(this.file), { recursive: true });
+		await writeFile(this.file, `${JSON.stringify({ paths: next })}\n`, "utf8");
+		this.paths = new Set(next);
+		this.loaded = true;
+		return this.list();
+	}
+};
+//#endregion
 //#region src/config.ts
 /** Loader-facing defaults; {@link parseGatewayConfig} enforces cross-field security rules. */
 const Config = z.object({
@@ -762,6 +877,14 @@ const Config = z.object({
 	mobileLayoutFile: z.string().hidden(),
 	mobileCompatibilityFile: z.string().hidden(),
 	excludedClientModules: z.array(String).default([]),
+	websocketCompression: z.object({
+		paths: z.array(String).default([]),
+		maxMessageBytes: z.natural(),
+		maxQueuedBytes: z.natural(),
+		thresholdBytes: z.natural(),
+		concurrencyLimit: z.natural(),
+		level: z.natural().max(9)
+	}),
 	instanceId: z.string().hidden(),
 	pairingCaFile: z.string().hidden(),
 	initiallyEnabled: z.boolean().hidden().required(),
@@ -790,6 +913,21 @@ function integer(value, name, fallback, minimum, maximum) {
 	if (typeof resolved !== "number" || !Number.isSafeInteger(resolved) || resolved < minimum || resolved > maximum) throw new Error(`${name} must be an integer from ${String(minimum)} through ${String(maximum)}`);
 	return resolved;
 }
+function parseWebSocketCompression(raw) {
+	if (raw !== void 0 && (typeof raw !== "object" || raw === null || Array.isArray(raw))) throw new Error("websocketCompression must be an object");
+	const value = raw ?? {};
+	const maxMessageBytes = integer(value.maxMessageBytes, "websocketCompression.maxMessageBytes", 33554432, 1024, 268435456);
+	const maxQueuedBytes = integer(value.maxQueuedBytes, "websocketCompression.maxQueuedBytes", 67108864, 1024, 268435456);
+	if (maxQueuedBytes < maxMessageBytes + 14) throw new Error("websocketCompression.maxQueuedBytes must cover maxMessageBytes and the frame header");
+	return Object.freeze({
+		paths: Object.freeze(normalizeWebSocketPaths(value.paths ?? [])),
+		maxMessageBytes,
+		maxQueuedBytes,
+		thresholdBytes: integer(value.thresholdBytes, "websocketCompression.thresholdBytes", 1024, 0, maxMessageBytes),
+		concurrencyLimit: integer(value.concurrencyLimit, "websocketCompression.concurrencyLimit", 4, 1, 32),
+		level: integer(value.level, "websocketCompression.level", 3, 0, 9)
+	});
+}
 function stringArray(value, name) {
 	if (!Array.isArray(value) || value.length === 0 || value.some((entry) => typeof entry !== "string")) throw new Error(`${name} must be a non-empty string array`);
 	return value;
@@ -896,6 +1034,7 @@ function parseGatewayConfig(raw) {
 		mobileLayoutFile: value.mobileLayoutFile === void 0 ? fileURLToPath(new URL("./mobile-layout.js", import.meta.url)) : absoluteFile(value.mobileLayoutFile, "mobileLayoutFile"),
 		mobileCompatibilityFile: value.mobileCompatibilityFile === void 0 ? fileURLToPath(new URL("./mobile-compat.js", import.meta.url)) : absoluteFile(value.mobileCompatibilityFile, "mobileCompatibilityFile"),
 		excludedClientModules: excludedClientModules(value.excludedClientModules),
+		websocketCompression: parseWebSocketCompression(value.websocketCompression),
 		instanceId: value.instanceId === void 0 ? createHash("sha256").update(absoluteFile(value.stateFile, "stateFile")).digest("hex") : /^[a-f\d]{64}$/u.test(value.instanceId) ? value.instanceId : (() => {
 			throw new Error("instanceId must be a lowercase SHA-256 value");
 		})(),
@@ -1402,21 +1541,6 @@ async function readJsonObject(request, maximumBytes) {
 	if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) throw new HttpError(400, "bad_request");
 	return parsed;
 }
-/** Strict cookie parser: malformed or duplicate names invalidate the whole header. */
-function parseCookies(header) {
-	if (header === void 0) return /* @__PURE__ */ new Map();
-	if (header.length > 8192) return void 0;
-	const cookies = /* @__PURE__ */ new Map();
-	for (const part of header.split(";")) {
-		const equals = part.indexOf("=");
-		if (equals <= 0) return void 0;
-		const name = part.slice(0, equals).trim();
-		const value = part.slice(equals + 1).trim();
-		if (!/^[!#$%&'*+\-.^_`|~\dA-Za-z]+$/u.test(name) || !/^[\w\-.~+/=]*$/u.test(value) || cookies.has(name)) return;
-		cookies.set(name, value);
-	}
-	return cookies;
-}
 /** Serialize a host-only Cookie with no Domain attribute. */
 function cookie(name, value, options) {
 	const parts = [
@@ -1516,6 +1640,280 @@ function ensureMobileCompatibility(html) {
 	return `${html.slice(0, first.index)}${script}${html.slice(first.index)}`;
 }
 //#endregion
+//#region src/browser-auth-cookies.ts
+const HOST_SESSION_COOKIE = "__Host-dsh_ma_session";
+const HOST_CSRF_COOKIE = "__Host-dsh_ma_csrf";
+/** Non-secret browser identity; the persistent device credential keeps its narrow renewal path. */
+const HOST_DEVICE_COOKIE = "__Host-dsh_ma_device_id";
+const AUTH_COOKIE_NAMES = /* @__PURE__ */ new Set([
+	SESSION_COOKIE,
+	DEVICE_COOKIE,
+	CSRF_COOKIE,
+	HOST_SESSION_COOKIE,
+	HOST_CSRF_COOKIE,
+	HOST_DEVICE_COOKIE
+]);
+/** Read only gateway authentication cookies, retaining distinct values from different scopes. */
+function browserAuthCookies(header) {
+	if (header === void 0) return /* @__PURE__ */ new Map();
+	if (header.length > 8192) throw new HttpError(401, "authentication_failed");
+	const cookies = /* @__PURE__ */ new Map();
+	for (const part of header.split(";")) {
+		const equals = part.indexOf("=");
+		if (equals <= 0) continue;
+		const name = part.slice(0, equals).trim();
+		if (!AUTH_COOKIE_NAMES.has(name)) continue;
+		const values = cookies.get(name) ?? [];
+		cookies.set(name, values);
+		const value = part.slice(equals + 1).trim();
+		if (!/^[\w\-.~+/=]{1,512}$/u.test(value) || values.includes(value)) continue;
+		values.push(value);
+	}
+	return cookies;
+}
+/** Select exactly one authenticated value; never let cookie order choose between valid identities. */
+function authenticatedCookie(values, authenticate, accepts = () => true) {
+	let selected;
+	for (const value of values) {
+		let result;
+		try {
+			result = authenticate(value);
+		} catch (error) {
+			if (error instanceof AccessError && error.status === 401) continue;
+			throw error;
+		}
+		if (!accepts(result)) continue;
+		if (selected !== void 0) throw new HttpError(401, "authentication_failed");
+		selected = {
+			value,
+			result
+		};
+	}
+	if (selected === void 0) throw new HttpError(401, "authentication_failed");
+	return selected;
+}
+//#endregion
+//#region src/websocket-compression.ts
+function payloadBytes(data) {
+	if (Array.isArray(data)) return data.reduce((bytes, part) => bytes + part.byteLength, 0);
+	return data.byteLength;
+}
+function forwardableClose(code) {
+	return code >= 1e3 && code <= 1014 && code !== 1004 && code !== 1005 && code !== 1006 || code >= 3e3 && code <= 4999;
+}
+/**
+* Bridge an authorized HTTP upgrade, negotiating compression only with the client.
+* Errors after acceptance close both legs. Socket destruction by the gateway also
+* releases the ws wrappers, pending compression, and handshake/close timers.
+* @param request - validated browser upgrade request.
+* @param client - gateway-owned client socket, paused during authorization.
+* @param upstream - gateway-owned loopback socket, connecting or connected.
+* @param head - bytes the HTTP parser read after the client's upgrade headers.
+* @param target - validated upstream URL, including the original query.
+* @param upstreamCookie - gateway's signed upstream cookie; browser cookies are discarded.
+* @param options - resolved message, queue, and compression limits.
+* @param handshakeTimeoutMs - maximum handshake and close-handshake duration.
+* @returns fulfillment after both HTTP upgrades are accepted, or rejection before acceptance.
+*/
+function bridgeCompressedWebSocket(request, client, upstream, head, target, upstreamCookie, options, handshakeTimeoutMs) {
+	return new Promise((resolve, reject) => {
+		let incoming;
+		let outgoing;
+		let server;
+		let accepted = false;
+		let stopped = false;
+		let closing = false;
+		let closeTimer;
+		const handshakeTimer = setTimeout(() => {
+			stop(/* @__PURE__ */ new Error("WebSocket bridge handshake timed out"));
+		}, handshakeTimeoutMs);
+		handshakeTimer.unref();
+		const stop = (error) => {
+			if (stopped) return;
+			stopped = true;
+			clearTimeout(handshakeTimer);
+			clearTimeout(closeTimer);
+			if (!accepted) reject(error);
+			incoming?.terminate();
+			outgoing?.terminate();
+			client.destroy();
+			upstream.destroy();
+			server?.close();
+		};
+		const finish = () => {
+			if (incoming?.readyState === WebSocket.CLOSED && outgoing?.readyState === WebSocket.CLOSED) stop(/* @__PURE__ */ new Error("WebSocket bridge closed"));
+		};
+		const beginClose = (code, reason) => {
+			if (!accepted) {
+				stop(new Error(reason));
+				return;
+			}
+			if (stopped || closing) return;
+			closing = true;
+			incoming?.resume();
+			outgoing?.resume();
+			for (const socket of [incoming, outgoing]) if (socket?.readyState === WebSocket.OPEN) socket.close(code, reason);
+			closeTimer = setTimeout(() => {
+				stop(/* @__PURE__ */ new Error("WebSocket bridge close timed out"));
+			}, handshakeTimeoutMs);
+			closeTimer.unref();
+		};
+		const socketError = (error) => {
+			stop(error);
+		};
+		const socketClosed = () => {
+			if (!accepted) stop(/* @__PURE__ */ new Error("WebSocket socket closed before acceptance"));
+		};
+		client.on("error", socketError);
+		upstream.on("error", socketError);
+		client.once("close", socketClosed);
+		upstream.once("close", socketClosed);
+		const wsError = (error) => {
+			if (!accepted) {
+				stop(error);
+				return;
+			}
+			beginClose(error.code === "WS_ERR_UNSUPPORTED_MESSAGE_LENGTH" ? 1009 : 1011, error.code === "WS_ERR_UNSUPPORTED_MESSAGE_LENGTH" ? "Message too large" : "WebSocket bridge failed");
+		};
+		const attachRelay = (source, destination) => {
+			let queuedBytes = 0;
+			const send = (bytes, operation) => {
+				if (stopped || closing) return;
+				if (destination.readyState !== WebSocket.OPEN) {
+					beginClose(1011, "WebSocket peer unavailable");
+					return;
+				}
+				const queued = bytes + 14;
+				if (queued > options.maxQueuedBytes - queuedBytes) {
+					beginClose(1009, "WebSocket queue limit");
+					return;
+				}
+				queuedBytes += queued;
+				source.pause();
+				const complete = (error) => {
+					queuedBytes -= queued;
+					if (error != null) {
+						wsError(error);
+						return;
+					}
+					if (!stopped && !closing && queuedBytes === 0 && source.readyState === WebSocket.OPEN) source.resume();
+				};
+				try {
+					operation(complete);
+				} catch (error) {
+					complete(error instanceof Error ? error : /* @__PURE__ */ new Error("WebSocket forwarding failed"));
+				}
+			};
+			source.on("message", (data, binary) => {
+				const bytes = payloadBytes(data);
+				if (bytes > options.maxMessageBytes) {
+					beginClose(1009, "Message too large");
+					return;
+				}
+				send(bytes, (callback) => {
+					destination.send(data, {
+						binary,
+						compress: destination === incoming
+					}, callback);
+				});
+			});
+			source.on("ping", (data) => {
+				send(data.byteLength, (callback) => {
+					destination.ping(data, void 0, callback);
+				});
+			});
+			source.on("pong", (data) => {
+				send(data.byteLength, (callback) => {
+					destination.pong(data, void 0, callback);
+				});
+			});
+			source.on("close", (code, reason) => {
+				if (stopped) return;
+				if (code === 1006 || !forwardableClose(code) && code !== 1005) {
+					stop(/* @__PURE__ */ new Error("WebSocket peer closed without a valid close frame"));
+					return;
+				}
+				closing = true;
+				destination.resume();
+				if (destination.readyState === WebSocket.OPEN) {
+					if (code === 1005) destination.close();
+					else destination.close(code, reason);
+				}
+				closeTimer ??= setTimeout(() => {
+					stop(/* @__PURE__ */ new Error("WebSocket bridge close timed out"));
+				}, handshakeTimeoutMs);
+				closeTimer.unref();
+				finish();
+			});
+		};
+		try {
+			if (client.destroyed || upstream.destroyed) throw new Error("WebSocket socket is already closed");
+			const protocolHeader = request.headers["sec-websocket-protocol"];
+			const protocols = typeof protocolHeader === "string" ? protocolHeader.split(",").map((protocol) => protocol.trim()) : [];
+			const url = new URL(target);
+			url.protocol = url.protocol === "https:" ? "wss:" : "ws:";
+			outgoing = new WebSocket(url, protocols, {
+				createConnection: () => upstream,
+				handshakeTimeout: handshakeTimeoutMs,
+				perMessageDeflate: false,
+				autoPong: false,
+				followRedirects: false,
+				maxPayload: options.maxMessageBytes,
+				headers: {
+					host: target.host,
+					origin: target.origin,
+					"sec-fetch-site": "same-origin",
+					...upstreamCookie === void 0 ? {} : { cookie: upstreamCookie }
+				}
+			});
+			outgoing.on("error", wsError);
+			outgoing.once("close", () => {
+				if (!accepted) stop(/* @__PURE__ */ new Error("Upstream WebSocket closed before acceptance"));
+				else finish();
+			});
+			outgoing.once("open", () => {
+				if (stopped || client.destroyed) {
+					stop(/* @__PURE__ */ new Error("Client closed before WebSocket acceptance"));
+					return;
+				}
+				upstream.setTimeout(0);
+				server = new WebSocketServer({
+					noServer: true,
+					clientTracking: false,
+					autoPong: false,
+					maxPayload: options.maxMessageBytes,
+					handleProtocols: () => outgoing?.protocol || false,
+					perMessageDeflate: {
+						clientNoContextTakeover: true,
+						serverNoContextTakeover: true,
+						threshold: options.thresholdBytes,
+						concurrencyLimit: options.concurrencyLimit,
+						zlibDeflateOptions: { level: options.level }
+					}
+				});
+				server.on("error", wsError);
+				try {
+					server.handleUpgrade(request, client, head, (socket) => {
+						incoming = socket;
+						incoming.on("error", wsError);
+						incoming.once("close", finish);
+						attachRelay(incoming, outgoing);
+						attachRelay(outgoing, incoming);
+						accepted = true;
+						clearTimeout(handshakeTimer);
+						incoming.resume();
+						resolve();
+					});
+				} catch (error) {
+					stop(error instanceof Error ? error : /* @__PURE__ */ new Error("Client WebSocket upgrade failed"));
+				}
+			});
+		} catch (error) {
+			stop(error instanceof Error ? error : /* @__PURE__ */ new Error("WebSocket bridge setup failed"));
+		}
+	});
+}
+//#endregion
 //#region src/version.ts
 const manifest = createRequire(import.meta.url)("../package.json");
 /** Version of the installed DSH Mobile plugin package. */
@@ -2469,6 +2867,7 @@ function renderPairPage(locale) {
 <html lang="${copy.lang}">
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width,initial-scale=1,viewport-fit=cover">
+<style>input,textarea{font-size:16px}</style>
 <title>${copy.pairTitle}</title>
 <main>
   <h1>${copy.pairHeading}</h1>
@@ -2577,8 +2976,6 @@ function renderLoginScript(locale) {
 //#region src/gateway.ts
 const MAX_CONTROL_BODY_BYTES = 16384;
 const MAX_HEADER_BYTES = 16384;
-const MOBILE_HISTORY_PAGE_MESSAGES = 10;
-const SESSION_HISTORY_PATH = "/api/session.history";
 const DISCOVERY_QUERY = Buffer.from("DSH_MOBILE_DISCOVER_V1", "ascii");
 const DISCOVERY_PROTOCOL = 1;
 const DISCOVERY_INTERVAL_MS = 3e3;
@@ -2664,7 +3061,9 @@ const MOBILE_LAYOUT_DEPENDENCY_PROFILES = Object.freeze([Object.freeze({
 		"@deepseek-ai/dsh-client-ui-theme"
 	])
 })]);
-const MOBILE_CSRF_FETCH_BOOTSTRAP = `(()=>{const nativeFetch=window.fetch.bind(window);window.fetch=(input,init)=>{const source=input instanceof Request?input:undefined;const method=String(init?.method??source?.method??'GET').toUpperCase();if(method==='GET'||method==='HEAD')return nativeFetch(input,init);const raw=typeof input==='string'?input:input instanceof URL?input.href:source?.url;if(raw===undefined||new URL(raw,location.href).origin!==location.origin)return nativeFetch(input,init);const headers=new Headers(init?.headers??source?.headers);if(!headers.has(${JSON.stringify(CSRF_HEADER)})){const prefix=${JSON.stringify(`${CSRF_COOKIE}=`)};const token=document.cookie.split(';').map(value=>value.trim()).find(value=>value.startsWith(prefix))?.slice(prefix.length);if(token!==undefined)headers.set(${JSON.stringify(CSRF_HEADER)},token)}return nativeFetch(input,{...init,headers})};})();`;
+function mobileCsrfFetchBootstrap(cookieName) {
+	return `(()=>{const nativeFetch=window.fetch.bind(window);window.fetch=(input,init)=>{const source=input instanceof Request?input:undefined;const method=String(init?.method??source?.method??'GET').toUpperCase();if(method==='GET'||method==='HEAD')return nativeFetch(input,init);const raw=typeof input==='string'?input:input instanceof URL?input.href:source?.url;if(raw===undefined||new URL(raw,location.href).origin!==location.origin)return nativeFetch(input,init);const headers=new Headers(init?.headers??source?.headers);if(!headers.has(${JSON.stringify(CSRF_HEADER)})){const prefix=${JSON.stringify(`${cookieName}=`)};const values=[...new Set(document.cookie.split(';').map(value=>value.trim()).filter(value=>value.startsWith(prefix)).map(value=>value.slice(prefix.length)))];if(values.length===1)headers.set(${JSON.stringify(CSRF_HEADER)},values[0])}return nativeFetch(input,{...init,headers})};})();`;
+}
 const MOBILE_AUTHENTICATED_TRANSPORT_BOOTSTRAP = `(()=>{if(window.__DSH_TRANSPORT__!==undefined)throw new Error('DSH Mobile cannot replace an existing transport override');window.__DSH_TRANSPORT__={fetch:(input,init)=>window.fetch(input,init),ownsHost:true},window.__DSH_FILE_UPLOAD__={fetch:(input,init)=>window.fetch(input,init)}})();`;
 /** Use this page's gateway health, rather than OS internet validation, for DSH reconnects. */
 const MOBILE_GATEWAY_REACHABILITY_BOOTSTRAP = `(()=>{
@@ -2976,7 +3375,7 @@ function rewriteMobileIndexWithBatch(html, options = {}) {
 			batches: plan.batches
 		})).digest("hex").slice(0, 16);
 	}
-	const replacement = `${MOBILE_GATEWAY_REACHABILITY_BOOTSTRAP}${remoteSettings ? MOBILE_AUTHENTICATED_TRANSPORT_BOOTSTRAP : ""}${MOBILE_CSRF_FETCH_BOOTSTRAP}window.__DSH_MOBILE_FRONTEND__="dedicated";${plan.assignment}${JSON.stringify(plan.parsed)};`;
+	const replacement = `${MOBILE_GATEWAY_REACHABILITY_BOOTSTRAP}${remoteSettings ? MOBILE_AUTHENTICATED_TRANSPORT_BOOTSTRAP : ""}${mobileCsrfFetchBootstrap(options.csrfCookie ?? "dsh_ma_csrf")}window.__DSH_MOBILE_FRONTEND__="dedicated";${plan.assignment}${JSON.stringify(plan.parsed)};`;
 	const rewritten = `${html.slice(0, plan.replaceStart)}${replacement}${html.slice(plan.replaceEnd)}`;
 	return Object.freeze({
 		html: ensureMobileViewport(ensureMobileCompatibility(rewriteMobileApplicationPreloads(rewritten, preloadReplacements))),
@@ -3177,7 +3576,7 @@ function isCompressibleContentType(value) {
 }
 function shouldCompressResponse(request, response) {
 	const pathname = request.url?.split("?", 1)[0] ?? "";
-	return (request.method === "GET" && (pathname.startsWith("/plugins/") || pathname.startsWith("/assets/")) || request.method === "POST" && pathname === SESSION_HISTORY_PATH) && response.statusCode === 200 && request.headers.range === void 0 && response.headers["content-range"] === void 0 && response.headers["content-encoding"] === void 0 && acceptsGzip(request.headers["accept-encoding"]) && isCompressibleContentType(response.headers["content-type"]);
+	return request.method === "GET" && (pathname.startsWith("/plugins/") || pathname.startsWith("/assets/")) && response.statusCode === 200 && request.headers.range === void 0 && response.headers["content-range"] === void 0 && response.headers["content-encoding"] === void 0 && acceptsGzip(request.headers["accept-encoding"]) && isCompressibleContentType(response.headers["content-type"]);
 }
 function revisionedStaticCacheControl(request, statusCode) {
 	if (request.method !== "GET" && request.method !== "HEAD") return void 0;
@@ -3194,39 +3593,12 @@ function revisionedStaticCacheControl(request, statusCode) {
 	if (!(target.pathname.startsWith("/plugins/") && hasRevision) && !(target.pathname.startsWith("/assets/") && (hasRevision || hashedAsset))) return void 0;
 	return "private, max-age=31536000, immutable";
 }
-function isJsonRecord(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function mobileHistoryRequestBody(request, body) {
-	if (request.method !== "POST" || request.url?.split("?", 1)[0] !== SESSION_HISTORY_PATH) return body;
-	let parsed;
-	try {
-		parsed = JSON.parse(body.toString("utf8"));
-	} catch {
-		return body;
-	}
-	if (!isJsonRecord(parsed) || parsed.method !== "session.history" || !isJsonRecord(parsed.payload)) return body;
-	const requested = parsed.payload.maxMessages;
-	if (typeof requested === "number" && Number.isInteger(requested) && requested > 0 && requested <= MOBILE_HISTORY_PAGE_MESSAGES) return body;
-	return Buffer.from(JSON.stringify({
-		...parsed,
-		payload: {
-			...parsed.payload,
-			maxMessages: MOBILE_HISTORY_PAGE_MESSAGES
-		}
-	}));
-}
 function addVaryAcceptEncoding(headers) {
 	const existing = headers.vary;
 	const values = (Array.isArray(existing) ? existing.map((value) => String(value)) : existing === void 0 ? [] : [String(existing)]).flatMap((value) => value.split(",").map((part) => part.trim()).filter(Boolean));
 	if (!values.some((value) => value.toLowerCase() === "accept-encoding")) values.push("Accept-Encoding");
 	headers.vary = values.join(", ");
 }
-function requestCookies(request) {
-	const cookies = parseCookies(request.headers.cookie);
-	if (cookies === void 0) throw new HttpError(401, "authentication_failed");
-	return cookies;
-}
 function mapError(error) {
 	if (error instanceof HttpError) return error;
 	if (error instanceof AccessError) return new HttpError(error.status, error.code);
@@ -3755,9 +4127,9 @@ var MobileAccessGateway = class {
 		return this.policy;
 	}
 	authorize(request) {
-		const sessionToken = requestCookies(request).get(SESSION_COOKIE);
-		if (sessionToken === void 0) throw new HttpError(401, "authentication_failed");
-		return this.access.authorizeSession(sessionToken);
+		const cookies = browserAuthCookies(request.headers.cookie);
+		const name = this.tlsEnabled && cookies.has("__Host-dsh_ma_session") ? HOST_SESSION_COOKIE : SESSION_COOKIE;
+		return authenticatedCookie(cookies.get(name) ?? [], (token) => this.access.authorizeSession(token)).result;
 	}
 	requireCsrf(request, authorization) {
 		const value = headerValue(request.headers, CSRF_HEADER);
@@ -3765,16 +4137,40 @@ var MobileAccessGateway = class {
 	}
 	setSessionCookies(response, result, now) {
 		const maxAge = (result.sessionExpiresAt - now) / 1e3;
-		response.setHeader("Set-Cookie", [cookie(SESSION_COOKIE, result.sessionToken, {
-			tls: this.tlsEnabled,
+		response.setHeader("Set-Cookie", [
+			cookie(SESSION_COOKIE, result.sessionToken, {
+				tls: this.tlsEnabled,
+				httpOnly: true,
+				path: "/",
+				maxAgeSeconds: maxAge
+			}),
+			cookie(CSRF_COOKIE, result.csrfToken, {
+				tls: this.tlsEnabled,
+				httpOnly: false,
+				path: "/",
+				maxAgeSeconds: maxAge
+			}),
+			...this.tlsEnabled ? [cookie(HOST_SESSION_COOKIE, result.sessionToken, {
+				tls: true,
+				httpOnly: true,
+				path: "/",
+				maxAgeSeconds: maxAge
+			}), cookie(HOST_CSRF_COOKIE, result.csrfToken, {
+				tls: true,
+				httpOnly: false,
+				path: "/",
+				maxAgeSeconds: maxAge
+			})] : []
+		]);
+	}
+	setBrowserDeviceBinding(response, deviceId, deviceExpiresAt) {
+		if (!this.tlsEnabled) return;
+		const existing = response.getHeader("Set-Cookie");
+		response.setHeader("Set-Cookie", [...existing, cookie(HOST_DEVICE_COOKIE, deviceId, {
+			tls: true,
 			httpOnly: true,
 			path: "/",
-			maxAgeSeconds: maxAge
-		}), cookie(CSRF_COOKIE, result.csrfToken, {
-			tls: this.tlsEnabled,
-			httpOnly: false,
-			path: "/",
-			maxAgeSeconds: maxAge
+			maxAgeSeconds: (deviceExpiresAt - Date.now()) / 1e3
 		})]);
 	}
 	async handlePair(request, response) {
@@ -3790,6 +4186,7 @@ var MobileAccessGateway = class {
 			path: "/mobile-access/auth/renew",
 			maxAgeSeconds: (result.deviceExpiresAt - now) / 1e3
 		})]);
+		this.setBrowserDeviceBinding(response, result.deviceId, result.deviceExpiresAt);
 		sendJson(response, 201, {
 			paired: true,
 			deviceId: result.deviceId,
@@ -3800,21 +4197,13 @@ var MobileAccessGateway = class {
 	async handleRenew(request, response) {
 		if (!this.renewLimiter.take(request.socket.remoteAddress ?? "unknown", Date.now())) throw new HttpError(429, "rate_limited");
 		await readJsonObject(request, MAX_CONTROL_BODY_BYTES);
-		const deviceToken = requestCookies(request).get(DEVICE_COOKIE);
-		if (deviceToken === void 0) throw new HttpError(401, "authentication_failed");
-		let result;
-		try {
-			result = await this.access.renew(deviceToken);
-		} catch (error) {
-			if (error instanceof AccessError && error.status === 401) response.setHeader("Set-Cookie", cookie(DEVICE_COOKIE, "", {
-				tls: this.tlsEnabled,
-				httpOnly: true,
-				path: "/mobile-access/auth/renew",
-				maxAgeSeconds: 0
-			}));
-			throw error;
-		}
+		const cookies = browserAuthCookies(request.headers.cookie);
+		const bindings = this.tlsEnabled ? cookies.get(HOST_DEVICE_COOKIE) : void 0;
+		if (bindings !== void 0 && bindings.length !== 1) throw new HttpError(401, "authentication_failed");
+		const device = authenticatedCookie(cookies.get("dsh_ma_device") ?? [], (token) => this.access.authorizeDevice(token), (candidate) => bindings === void 0 || candidate.deviceId === bindings[0]);
+		const result = await this.access.renew(device.value);
 		this.setSessionCookies(response, result, Date.now());
+		this.setBrowserDeviceBinding(response, result.deviceId, device.result.deviceExpiresAt);
 		sendJson(response, 200, {
 			renewed: true,
 			deviceId: result.deviceId,
@@ -3865,17 +4254,31 @@ var MobileAccessGateway = class {
 		const authorization = this.authorize(request);
 		this.requireCsrf(request, authorization);
 		this.access.logout(authorization);
-		response.setHeader("Set-Cookie", [cookie(SESSION_COOKIE, "", {
-			tls: this.tlsEnabled,
-			httpOnly: true,
-			path: "/",
-			maxAgeSeconds: 0
-		}), cookie(CSRF_COOKIE, "", {
-			tls: this.tlsEnabled,
-			httpOnly: false,
-			path: "/",
-			maxAgeSeconds: 0
-		})]);
+		response.setHeader("Set-Cookie", [
+			cookie(SESSION_COOKIE, "", {
+				tls: this.tlsEnabled,
+				httpOnly: true,
+				path: "/",
+				maxAgeSeconds: 0
+			}),
+			cookie(CSRF_COOKIE, "", {
+				tls: this.tlsEnabled,
+				httpOnly: false,
+				path: "/",
+				maxAgeSeconds: 0
+			}),
+			...this.tlsEnabled ? [cookie(HOST_SESSION_COOKIE, "", {
+				tls: true,
+				httpOnly: true,
+				path: "/",
+				maxAgeSeconds: 0
+			}), cookie(HOST_CSRF_COOKIE, "", {
+				tls: true,
+				httpOnly: false,
+				path: "/",
+				maxAgeSeconds: 0
+			})] : []
+		]);
 		sendJson(response, 200, { loggedOut: true }, this.tlsEnabled);
 	}
 	async handleExternalRequest(request, response) {
@@ -3994,7 +4397,14 @@ var MobileAccessGateway = class {
 			fallback: void 0
 		} : void 0 : void 0;
 		if (customAsset === void 0 && requestedMobileBootBatch === void 0 && !computerImages && !computerImage && extensionTarget(target.decodedPathname) === void 0 && (target.decodedPathname === "/mobile-access" || target.decodedPathname.startsWith(`/mobile-access/`))) throw new HttpError(404, "not_found");
-		if (request.method !== "GET" && request.method !== "HEAD" && request.method !== "POST" && requestedExtension?.kind !== "route") throw new HttpError(405, "method_not_allowed");
+		if (![
+			"GET",
+			"HEAD",
+			"POST",
+			"PUT",
+			"PATCH",
+			"DELETE"
+		].includes(request.method ?? "") && requestedExtension?.kind !== "route") throw new HttpError(405, "method_not_allowed");
 		let authorization;
 		try {
 			authorization = this.authorize(request);
@@ -4400,9 +4810,15 @@ var MobileAccessGateway = class {
 			try {
 				const html = Buffer.concat(chunks).toString("utf8");
 				const plan = parseMobileBootPlan(html, this.config.excludedClientModules);
-				const rewritten = rewriteMobileIndexWithBatch(html, plan.rewrittenBatchEntries === void 0 ? { excludedClientModules: this.config.excludedClientModules } : {
+				const options = plan.rewrittenBatchEntries === void 0 ? { excludedClientModules: this.config.excludedClientModules } : {
 					...await this.resolveMobileBootSizes(plan.rewrittenBatchEntries.flatMap((batch) => batch.entries)),
 					excludedClientModules: this.config.excludedClientModules
+				};
+				const cookies = browserAuthCookies(request$2.headers.cookie);
+				const csrfCookie = this.tlsEnabled && cookies.has("__Host-dsh_ma_session") ? HOST_CSRF_COOKIE : CSRF_COOKIE;
+				const rewritten = rewriteMobileIndexWithBatch(html, {
+					...options,
+					csrfCookie
 				});
 				for (const batch of rewritten.batches) this.rememberMobileBootBatch(batch);
 				body = Buffer.from(rewritten.html);
@@ -4771,11 +5187,9 @@ var MobileAccessGateway = class {
 		const operation = this.allocateRequest(authorization, response, holder);
 		let bodyDone;
 		try {
-			const bufferedBody = request$3.method === "POST" && request$3.url?.split("?", 1)[0] === SESSION_HISTORY_PATH ? mobileHistoryRequestBody(request$3, await readBoundedBody(request$3, this.config.maxBodyBytes)) : void 0;
 			const upstreamHeaders = sanitizeRequestHeaders(request$3, this.config.upstreamOrigin);
 			const upstreamCookie = await this.upstreamCookieHeader();
 			if (upstreamCookie !== void 0) upstreamHeaders.cookie = upstreamCookie;
-			if (bufferedBody !== void 0) upstreamHeaders["content-length"] = String(bufferedBody.byteLength);
 			const proxied = await new Promise((resolve, reject) => {
 				const upstreamRequest = request({
 					protocol: "http:",
@@ -4792,11 +5206,7 @@ var MobileAccessGateway = class {
 				});
 				upstreamRequest.once("response", resolve);
 				upstreamRequest.once("error", reject);
-				if (bufferedBody === void 0) bodyDone = pipeline(request$3, new ByteLimitTransform(this.config.maxBodyBytes), upstreamRequest);
-				else {
-					upstreamRequest.end(bufferedBody);
-					bodyDone = Promise.resolve();
-				}
+				bodyDone = pipeline(request$3, new ByteLimitTransform(this.config.maxBodyBytes), upstreamRequest);
 				bodyDone.catch(reject);
 			});
 			setSecurityHeaders(response, this.tlsEnabled, "proxied");
@@ -5019,10 +5429,13 @@ var MobileAccessGateway = class {
 			throw new HttpError(400, "bad_request");
 		}
 		if (decodedKey.length !== 16 || decodedKey.toString("base64") !== key) throw new HttpError(400, "bad_request");
-		const authorization = this.authorize(request);
+		let authorization = this.authorize(request);
 		if (this.activeWebSockets.size >= this.config.maxWebSockets) throw new HttpError(429, "busy");
 		const upstreamCookie = await this.upstreamCookieHeader();
 		if (client.destroyed) return;
+		authorization = this.authorize(request);
+		if (this.activeWebSockets.size >= this.config.maxWebSockets) throw new HttpError(429, "busy");
+		const compressed = this.config.websocketCompression.paths.includes(target.decodedPathname);
 		const upstream = connect({
 			host: stripIpv6Brackets(this.config.upstreamOrigin.hostname),
 			port: Number(this.config.upstreamOrigin.port)
@@ -5045,20 +5458,28 @@ var MobileAccessGateway = class {
 		});
 		this.activeWebSockets.set(id, record);
 		const cleanup = () => {
+			if (compressed && (!client.destroyed || !upstream.destroyed)) return;
 			const active = this.activeWebSockets.get(id);
 			if (active !== void 0) clearTimeout(active.timer);
 			this.activeWebSockets.delete(id);
 		};
 		client.once("close", () => {
-			upstream.destroy();
+			if (!compressed) upstream.destroy();
 			cleanup();
 		});
 		upstream.once("close", () => {
-			client.destroy();
+			if (!compressed) client.destroy();
 			cleanup();
 		});
 		upstream.setTimeout(this.config.upstreamTimeoutMs, closeBoth);
 		try {
+			if (compressed) {
+				const compressionTarget = new URL(this.config.upstreamOrigin.href);
+				compressionTarget.pathname = target.pathname;
+				compressionTarget.search = target.search;
+				await bridgeCompressedWebSocket(request, client, upstream, head, compressionTarget, upstreamCookie, this.config.websocketCompression, this.config.upstreamTimeoutMs);
+				return;
+			}
 			await new Promise((resolve, reject) => {
 				const connected = () => {
 					upstream.off("error", failed);
@@ -5357,8 +5778,8 @@ var MemoryDeviceStore = class {
 //#endregion
 //#region src/frp-component.ts
 const FRP_VERSION$1 = "0.70.1";
-const MAX_ARCHIVE_ENTRIES = 128;
-const MAX_ARCHIVE_LIST_BYTES = 262144;
+const MAX_ARCHIVE_ENTRIES$1 = 128;
+const MAX_ARCHIVE_LIST_BYTES$1 = 262144;
 /** Pinned official FRP release metadata for supported desktop targets. */
 const FRP_COMPONENT_RELEASES = Object.freeze(Object.fromEntries([
 	{
@@ -5463,12 +5884,12 @@ async function replaceDirectory(target, candidate) {
 function sha256$2(bytes) {
 	return createHash("sha256").update(bytes).digest("hex");
 }
-async function runCapture(file, args) {
+async function runCapture$1(file, args) {
 	return new Promise((resolveRun, reject) => {
 		execFile(file, [...args], {
 			windowsHide: true,
 			timeout: 12e4,
-			maxBuffer: MAX_ARCHIVE_LIST_BYTES,
+			maxBuffer: MAX_ARCHIVE_LIST_BYTES$1,
 			encoding: "utf8"
 		}, (error, stdout) => {
 			if (error === null) resolveRun(stdout);
@@ -5476,7 +5897,7 @@ async function runCapture(file, args) {
 		});
 	});
 }
-function validatedArchiveEntry(rawEntry) {
+function validatedArchiveEntry$1(rawEntry) {
 	if (rawEntry.length === 0 || rawEntry.includes("\\") || rawEntry.includes("\0") || rawEntry.startsWith("/") || /^[a-zA-Z]:/u.test(rawEntry)) throw new Error("frp_archive_path_invalid");
 	const segments = rawEntry.replace(/\/$/u, "").split("/");
 	if (segments.some((segment) => segment === "" || segment === "." || segment === "..")) throw new Error("frp_archive_path_invalid");
@@ -5484,10 +5905,10 @@ function validatedArchiveEntry(rawEntry) {
 }
 /** Select exactly one nested frpc executable from a safe archive listing. */
 function selectFrpExecutableEntry(entries, executableName) {
-	if (entries.length === 0 || entries.length > MAX_ARCHIVE_ENTRIES) throw new Error("frp_archive_entries_invalid");
+	if (entries.length === 0 || entries.length > MAX_ARCHIVE_ENTRIES$1) throw new Error("frp_archive_entries_invalid");
 	let executableEntry;
 	for (const entry of entries) {
-		const segments = validatedArchiveEntry(entry);
+		const segments = validatedArchiveEntry$1(entry);
 		if (segments.length >= 2 && segments.at(-1) === executableName) {
 			if (executableEntry !== void 0) throw new Error("frp_archive_executable_ambiguous");
 			executableEntry = entry.replace(/\/$/u, "");
@@ -5496,22 +5917,22 @@ function selectFrpExecutableEntry(entries, executableName) {
 	if (executableEntry === void 0) throw new Error("frp_archive_executable_missing");
 	return executableEntry;
 }
-async function defaultExtractArtifact$1(archive, destination, executableName) {
+async function defaultExtractArtifact$2(archive, destination, executableName) {
 	const tar = process.platform === "win32" ? "tar.exe" : "tar";
-	const executableEntry = selectFrpExecutableEntry((await runCapture(tar, ["-tf", archive])).split(/\r?\n/u).filter((entry) => entry.length > 0), executableName);
+	const executableEntry = selectFrpExecutableEntry((await runCapture$1(tar, ["-tf", archive])).split(/\r?\n/u).filter((entry) => entry.length > 0), executableName);
 	const unpacked = join(destination, "archive");
 	await mkdir(unpacked, {
 		recursive: true,
 		mode: 448
 	});
-	await runCapture(tar, [
+	await runCapture$1(tar, [
 		"-xf",
 		archive,
 		"-C",
 		unpacked,
 		executableEntry
 	]);
-	const extracted = join(unpacked, ...validatedArchiveEntry(executableEntry));
+	const extracted = join(unpacked, ...validatedArchiveEntry$1(executableEntry));
 	if (!await regularFile$2(extracted)) throw new Error("frp_archive_executable_invalid");
 	await copyFile(extracted, join(destination, executableName));
 }
@@ -5551,7 +5972,7 @@ async function defaultFetchArtifact$2(artifact, signal) {
 	return bytes;
 }
 async function defaultInspectExecutable(executable) {
-	return (await runCapture(executable, ["--version"])).trim();
+	return (await runCapture$1(executable, ["--version"])).trim();
 }
 /** Owns the optional official frpc binary inside the DSH Mobile state directory. */
 var FrpComponentManager = class {
@@ -5586,7 +6007,7 @@ var FrpComponentManager = class {
 			this.stagingRoot
 		]) if (!inside$2(stateDirectory, child)) throw new Error("frp component path escaped its state directory");
 		this.fetchArtifact = options.fetchArtifact ?? defaultFetchArtifact$2;
-		this.extractArtifact = options.extractArtifact ?? defaultExtractArtifact$1;
+		this.extractArtifact = options.extractArtifact ?? defaultExtractArtifact$2;
 		this.inspectExecutable = options.inspectExecutable ?? defaultInspectExecutable;
 	}
 	/** Inspect the managed executable without relying on global FRP installations. */
@@ -5698,112 +6119,6 @@ var FrpComponentManager = class {
 	}
 };
 //#endregion
-//#region src/websocket-paths.ts
-/** Cap the admin-approved extra WebSocket upgrade paths (exact pathnames). */
-const MAX_EXTRA_WEBSOCKET_PATHS = 16;
-const MAX_WEBSOCKET_PATH_LENGTH = 256;
-function fail(code) {
-	throw new Error(code);
-}
-/**
-* Validate one exact pathname for proxying. Query strings are matched at
-* upgrade time, so only the pathname is stored. Rejects anything the
-* gateway cannot match exactly.
-*/
-function validateWebSocketPath(value) {
-	if (typeof value !== "string") fail("websocket_path_invalid");
-	const path = value;
-	if (path.length === 0 || path.length > 256) fail("websocket_path_invalid");
-	if (!path.startsWith("/")) fail("websocket_path_invalid");
-	if (/[\s\u0000-\u001f\u007f#?]/u.test(path)) fail("websocket_path_invalid");
-	if (path.includes("..")) fail("websocket_path_invalid");
-	return path;
-}
-/** Validate a whole replacement list all-or-nothing; duplicates collapse. */
-function normalizeWebSocketPaths(value) {
-	if (!Array.isArray(value)) fail("websocket_paths_invalid");
-	if (value.length > 16) fail("websocket_paths_invalid");
-	const seen = /* @__PURE__ */ new Set();
-	for (const entry of value) {
-		const path = validateWebSocketPath(entry);
-		seen.add(path);
-	}
-	return [...seen];
-}
-/** Cap remembered rejected upgrade paths offered for one-click approval. */
-const MAX_BLOCKED_UPGRADE_PATHS = 32;
-/**
-* In-memory log of rejected third-party upgrade paths, shared by every
-* gateway instance so the approval UI sees attempts on any listener.
-* Bounded and newest-first; a restart clears it (attempts reappear on
-* the next blocked handshake).
-*/
-var BlockedUpgradePathLog = class {
-	entries = /* @__PURE__ */ new Map();
-	record(pathname) {
-		const now = Date.now();
-		const stats = this.entries.get(pathname);
-		if (stats === void 0) {
-			if (this.entries.size >= 32) {
-				let oldest;
-				for (const [path, entry] of this.entries) if (oldest === void 0 || entry.lastSeen < (this.entries.get(oldest)?.lastSeen ?? 0)) oldest = path;
-				if (oldest !== void 0) this.entries.delete(oldest);
-			}
-			this.entries.set(pathname, {
-				attempts: 1,
-				firstSeen: now,
-				lastSeen: now
-			});
-			return;
-		}
-		stats.attempts += 1;
-		stats.lastSeen = now;
-	}
-	report() {
-		return [...this.entries].map(([path, stats]) => ({
-			path,
-			...stats
-		})).sort((a, b) => b.lastSeen - a.lastSeen);
-	}
-};
-/** File-backed store shared by every gateway instance (LAN and remote). */
-var WebSocketPathStore = class {
-	file;
-	paths = /* @__PURE__ */ new Set();
-	loaded = false;
-	constructor(file) {
-		this.file = file;
-	}
-	/** Snapshot for the upgrade check. */
-	has(pathname) {
-		return this.paths.has(pathname);
-	}
-	list() {
-		return [...this.paths];
-	}
-	async load() {
-		if (!this.loaded) {
-			try {
-				const raw = JSON.parse(await readFile(this.file, "utf8"));
-				this.paths = new Set(normalizeWebSocketPaths(raw.paths ?? []));
-			} catch {
-				this.paths = /* @__PURE__ */ new Set();
-			}
-			this.loaded = true;
-		}
-		return this.list();
-	}
-	/** Replace the whole list after validating; persists atomically. */
-	async replace(paths) {
-		const next = normalizeWebSocketPaths([...paths]);
-		await mkdir(dirname(this.file), { recursive: true });
-		await writeFile(this.file, `${JSON.stringify({ paths: next })}\n`, "utf8");
-		this.paths = new Set(next);
-		this.loaded = true;
-		return this.list();
-	}
-};
-//#endregion
 //#region src/frp-template.ts
 /** Loopback-only HTTP vhost port used between Caddy and frps. */
 const FRP_VHOST_HTTP_PORT = 7080;
@@ -8595,6 +8910,10 @@ async function downloadPinnedArtifact(request) {
 }
 //#endregion
 //#region src/cloudflared-component.ts
+/** Upper bound for `tar -t` output; a pinned release listing is a few lines. */
+const MAX_ARCHIVE_LIST_BYTES = 1048576;
+const MAX_ARCHIVE_ENTRIES = 256;
+const DOWNLOAD_TIMEOUT_MS = 3e5;
 const CLOUDFLARED_VERSION = "2026.9.1";
 /** Pinned official cloudflared release metadata for supported desktop targets. */
 const CLOUDFLARED_COMPONENT_RELEASES = Object.freeze(Object.fromEntries([
@@ -8605,7 +8924,9 @@ const CLOUDFLARED_COMPONENT_RELEASES = Object.freeze(Object.fromEntries([
 		downloadUrl: `https://github.com/cloudflare/cloudflared/releases/download/${CLOUDFLARED_VERSION}/cloudflared-windows-amd64.exe`,
 		downloadBytes: 54976432,
 		downloadSha256: "2837888cc0f5d58f15b6dc478376de90b4d3ba5241c7947455d1e0a0df429712",
-		executableName: "cloudflared.exe"
+		executableName: "cloudflared.exe",
+		executableBytes: 54976432,
+		executableSha256: "2837888cc0f5d58f15b6dc478376de90b4d3ba5241c7947455d1e0a0df429712"
 	},
 	{
 		version: CLOUDFLARED_VERSION,
@@ -8614,7 +8935,9 @@ const CLOUDFLARED_COMPONENT_RELEASES = Object.freeze(Object.fromEntries([
 		downloadUrl: `https://github.com/cloudflare/cloudflared/releases/download/${CLOUDFLARED_VERSION}/cloudflared-linux-amd64`,
 		downloadBytes: 39838488,
 		downloadSha256: "03f1f25d1cc93b9ad6c60569d44060bc4f17ed97075760ed8cfca4b12dcd68cc",
-		executableName: "cloudflared"
+		executableName: "cloudflared",
+		executableBytes: 39838488,
+		executableSha256: "03f1f25d1cc93b9ad6c60569d44060bc4f17ed97075760ed8cfca4b12dcd68cc"
 	},
 	{
 		version: CLOUDFLARED_VERSION,
@@ -8623,7 +8946,39 @@ const CLOUDFLARED_COMPONENT_RELEASES = Object.freeze(Object.fromEntries([
 		downloadUrl: `https://github.com/cloudflare/cloudflared/releases/download/${CLOUDFLARED_VERSION}/cloudflared-linux-arm64`,
 		downloadBytes: 37466252,
 		downloadSha256: "3d97437c71848bd8df68041e12436b484a661d95073ea1937f01a845ce88faa3",
-		executableName: "cloudflared"
+		executableName: "cloudflared",
+		executableBytes: 37466252,
+		executableSha256: "3d97437c71848bd8df68041e12436b484a661d95073ea1937f01a845ce88faa3"
+	},
+	{
+		version: CLOUDFLARED_VERSION,
+		platform: "darwin",
+		arch: "x64",
+		downloadUrl: `https://github.com/cloudflare/cloudflared/releases/download/${CLOUDFLARED_VERSION}/cloudflared-darwin-amd64.tgz`,
+		downloadBytes: 21118723,
+		downloadSha256: "ff0d3b51d5ff70eceef89d6b32145fee985018a2174596a5dbe405e2766e2ac4",
+		executableName: "cloudflared",
+		executableBytes: 41731488,
+		executableSha256: "1ea07ae775b03236bd6be18ca1848d6bdc4af2f4f3bce398823b5a36e5761b75",
+		archive: {
+			format: "tgz",
+			member: "cloudflared"
+		}
+	},
+	{
+		version: CLOUDFLARED_VERSION,
+		platform: "darwin",
+		arch: "arm64",
+		downloadUrl: `https://github.com/cloudflare/cloudflared/releases/download/${CLOUDFLARED_VERSION}/cloudflared-darwin-arm64.tgz`,
+		downloadBytes: 19217478,
+		downloadSha256: "c27ab8fd0aa489449e3d201eb02f957ef460a13b613662928b1b23394bf1bcfe",
+		executableName: "cloudflared",
+		executableBytes: 38893072,
+		executableSha256: "9a0b19f67dc7a3011bc6b972c7ce06a5fcea8784ac6bd599ffa382ea4aeb5a6e",
+		archive: {
+			format: "tgz",
+			member: "cloudflared"
+		}
 	}
 ].map((release) => [`${release.platform}-${release.arch}`, Object.freeze(release)])));
 /**
@@ -8650,6 +9005,60 @@ async function regularFile$1(file, expectedBytes) {
 		throw error;
 	}
 }
+async function runCapture(file, args) {
+	return new Promise((resolveRun, reject) => {
+		execFile(file, [...args], {
+			windowsHide: true,
+			timeout: 12e4,
+			maxBuffer: MAX_ARCHIVE_LIST_BYTES,
+			encoding: "utf8"
+		}, (error, stdout) => {
+			if (error === null) resolveRun(stdout);
+			else reject(error);
+		});
+	});
+}
+/** Reject absolute, traversing, or Windows-shaped archive members. */
+function validatedArchiveEntry(rawEntry) {
+	if (rawEntry.length === 0 || rawEntry.includes("\\") || rawEntry.includes("\0") || rawEntry.startsWith("/") || /^[a-zA-Z]:/u.test(rawEntry)) throw new Error("cloudflared_archive_path_invalid");
+	const segments = rawEntry.replace(/\/$/u, "").split("/");
+	if (segments.some((segment) => segment === "" || segment === "." || segment === "..")) throw new Error("cloudflared_archive_path_invalid");
+	return segments;
+}
+/** Select exactly one archive member named `member`, wherever it sits in the tree. */
+function selectCloudflaredArchiveEntry(entries, member) {
+	if (entries.length === 0 || entries.length > MAX_ARCHIVE_ENTRIES) throw new Error("cloudflared_archive_entries_invalid");
+	let selected;
+	for (const entry of entries) if (validatedArchiveEntry(entry).at(-1) === member) {
+		if (selected !== void 0) throw new Error("cloudflared_archive_executable_ambiguous");
+		selected = entry.replace(/\/$/u, "");
+	}
+	if (selected === void 0) throw new Error("cloudflared_archive_executable_missing");
+	return selected;
+}
+/**
+* Unpack the pinned member out of a `.tgz` using the system `tar`, which ships
+* with Windows 10+, macOS, and every supported Linux base.
+*/
+async function defaultExtractArtifact$1(archive, destination, member) {
+	const tar = process.platform === "win32" ? "tar.exe" : "tar";
+	const selected = selectCloudflaredArchiveEntry((await runCapture(tar, ["-tzf", archive])).split(/\r?\n/u).filter((entry) => entry.length > 0), member);
+	const unpacked = join(destination, "archive");
+	await mkdir(unpacked, {
+		recursive: true,
+		mode: 448
+	});
+	await runCapture(tar, [
+		"-xzf",
+		archive,
+		"-C",
+		unpacked,
+		selected
+	]);
+	const extracted = join(unpacked, ...validatedArchiveEntry(selected));
+	if (!await regularFile$1(extracted)) throw new Error("cloudflared_archive_executable_invalid");
+	await copyFile(extracted, join(destination, member));
+}
 async function defaultFetchArtifact$1(url, signal, expectedBytes) {
 	return downloadPinnedArtifact({
 		url,
@@ -8674,6 +9083,7 @@ var CloudflaredComponentManager = class {
 	arch;
 	release;
 	fetchArtifact;
+	extractArtifact;
 	installed = false;
 	errorCode;
 	queue = Promise.resolve();
@@ -8698,12 +9108,14 @@ var CloudflaredComponentManager = class {
 		]) if (!inside$1(stateDirectory, child)) throw new Error("cloudflared component path escaped its state directory");
 		const release = this.release;
 		this.fetchArtifact = options.fetchArtifact ?? ((url, signal) => defaultFetchArtifact$1(url, signal, release?.downloadBytes ?? 0));
+		this.extractArtifact = options.extractArtifact ?? defaultExtractArtifact$1;
 	}
 	/** Inspect the managed binary without using any global cloudflared state. */
 	async initialize() {
 		const release = this.release;
-		this.installed = release !== void 0 && await regularFile$1(this.executable, release.downloadBytes);
-		if (this.installed && release !== void 0 && await sha256$1(this.executable) !== release.downloadSha256) {
+		this.errorCode = void 0;
+		this.installed = release !== void 0 && await regularFile$1(this.executable, release.executableBytes);
+		if (this.installed && release !== void 0 && await sha256$1(this.executable) !== release.executableSha256) {
 			this.installed = false;
 			this.errorCode = "cloudflared_component_invalid";
 		}
@@ -8716,7 +9128,7 @@ var CloudflaredComponentManager = class {
 			installed: this.installed,
 			version: release.version,
 			downloadBytes: release.downloadBytes,
-			installedBytes: release.downloadBytes,
+			installedBytes: release.executableBytes,
 			sourceUrl: release.downloadUrl,
 			downloadPage: DOWNLOAD_PAGE$1,
 			termsUrl: TERMS_URL$1,
@@ -8738,7 +9150,7 @@ var CloudflaredComponentManager = class {
 				const controller = new AbortController();
 				const timeout = setTimeout(() => {
 					controller.abort();
-				}, 3e5);
+				}, DOWNLOAD_TIMEOUT_MS);
 				timeout.unref();
 				let bytes;
 				try {
@@ -8749,12 +9161,24 @@ var CloudflaredComponentManager = class {
 				if (bytes.byteLength !== release.downloadBytes) throw new Error("cloudflared_download_size_mismatch");
 				if (createHash("sha256").update(bytes).digest("hex") !== release.downloadSha256) throw new Error("cloudflared_download_hash_mismatch");
 				const staged = join(staging, release.executableName);
-				await writeFile(staged, bytes, {
+				if (release.archive === void 0) await writeFile(staged, bytes, {
 					flag: "wx",
 					mode: 384
 				});
+				else {
+					const downloaded = join(staging, `${release.executableName}.download`);
+					await writeFile(downloaded, bytes, {
+						flag: "wx",
+						mode: 384
+					});
+					try {
+						await this.extractArtifact(downloaded, staging, release.archive.member);
+					} finally {
+						await rm(downloaded, { force: true });
+					}
+				}
 				await chmod(staged, 448);
-				if (!await regularFile$1(staged, release.downloadBytes) || await sha256$1(staged) !== release.downloadSha256) throw new Error("cloudflared_executable_hash_mismatch");
+				if (!await regularFile$1(staged, release.executableBytes) || await sha256$1(staged) !== release.executableSha256) throw new Error("cloudflared_executable_hash_mismatch");
 				const candidate = join(this.componentRoot, `.install-${randomBytes(12).toString("hex")}`);
 				await mkdir(candidate, {
 					recursive: true,
@@ -13946,6 +14370,6 @@ async function apply(ctx, config) {
 	}, "dsh-mobile: independent LAN and selectable remote providers with /mobile command");
 }
 //#endregion
-export { AUTH_PREFIX, AccessController, AccessError, BlockedUpgradePathLog, BoundedRateLimiter, CERT_EXPIRING_DAYS, CLOUDFLARED_COMPONENT_RELEASE, CSRF_COOKIE, CSRF_HEADER, CloudflaredComponentManager, CloudflaredController, CloudflaredTunnelStore, Config, DEFAULT_ORIGIN_LISTEN_PORT, FRP_VHOST_HTTP_PORT as DEFAULT_VHOST_HTTP_PORT, FRP_VHOST_HTTP_PORT, DEVICE_COOKIE, EXTENSION_LIMITS, FRP_ATTACH_DISCOVERY_PATH, FRP_ATTACH_LOCAL_DECLARATION, FRP_ATTACH_SELF_SIGNED_DECLARATION, FRP_ATTACH_VPS_DECLARATION, FRP_CADDY_IMPORT_LINE, FRP_CADDY_SNIPPET_MARKER, FRP_CADDY_SNIPPET_PATH, FRP_COMPONENT_RELEASES, FRP_DEFAULT_PROXY_NAME, FRP_DEFAULT_PUBLIC_PORT, FRP_RESERVED_PORTS, FrpComponentManager, FrpConfigStore, FrpController, JsonDeviceStore, JsonMobileAccessControlStore, JsonRemoteProviderStore, LOCAL_ADMIN_PREFIX, MAX_BLOCKED_UPGRADE_PATHS, MAX_EXTRA_WEBSOCKET_PATHS, MAX_WEBSOCKET_PATH_LENGTH, MemoryDeviceStore, MobileAccessGateway, MobileAccessGatewayController, MobileAccessService, MobileExtensionError, OriginConfigStore, OriginController, REMOTE_PROVIDERS, RequestTrustPolicy, SESSION_COOKIE, TASK_EVENT_DEBOUNCE_MS, TaskEventHub, WS_PATHS, WebSocketPathStore, addressAllowed, apply, assertExtensionId, configuredRemoteProvider, createCaddySite, createFrpAttachPlan, createFrpAttachTemplate, createFrpAttachTemplateParts, createFrpServerTemplate, createFrpcToml, createMobileAccessService, createRestrictedFrpServerTemplate, ensureFrpIngressCertificate, evaluateCertificateLifetime, frpAttachVpsParts, frpIngressPaths, frpIngressSelfCheck, frpProxyName, inject, isCloudflaredRegistration, isFrpSelfSignedIngress, isGloballyRoutableIpv4, isLoopbackAddress, issueServerCertificate, mergeSavedCloudflaredTunnelSettings, mergeSavedFrpSettings, mergeSavedFrpTarget, name, normalizeWebSocketPaths, originGatewayConfig, parseAuthority, parseCidr, parseCloudflaredOrigin, parseCloudflaredTunnelSettings, parseControlFile, parseDeviceSnapshot, parseExtensionManifest, parseFrpSettings, parseGatewayConfig, parseMobileAccessControlState, parseOriginSettings, parseRemoteProviderState, probeOriginCertificate, readCertificateRenewal, resolveAuthority, resolveFrpEntryTls, resolveFrpMode, resolveFrpPublicPort, resolveFrpVhostHttpPort, rewriteMobileIndex, validateAttachSettings, validateCloudflaredTunnelHostname, validateCloudflaredTunnelPort, validateCloudflaredTunnelToken, validateFrpEntryTls, validateFrpMode, validateFrpProxyName, validateFrpPublicOrigin, validateFrpPublicPort, validateFrpServerAddress, validateFrpServerPort, validateFrpToken, validateFrpVhostHttpPort, validateOriginAllowedCidrs, validateOriginListenHost, validateOriginListenPort, validateOriginPublicOrigin, validateWebSocketPath, watchTaskCompletions };
+export { AUTH_PREFIX, AccessController, AccessError, BlockedUpgradePathLog, BoundedRateLimiter, CERT_EXPIRING_DAYS, CLOUDFLARED_COMPONENT_RELEASE, CLOUDFLARED_COMPONENT_RELEASES, CSRF_COOKIE, CSRF_HEADER, CloudflaredComponentManager, CloudflaredController, CloudflaredTunnelStore, Config, DEFAULT_ORIGIN_LISTEN_PORT, FRP_VHOST_HTTP_PORT as DEFAULT_VHOST_HTTP_PORT, FRP_VHOST_HTTP_PORT, DEVICE_COOKIE, EXTENSION_LIMITS, FRP_ATTACH_DISCOVERY_PATH, FRP_ATTACH_LOCAL_DECLARATION, FRP_ATTACH_SELF_SIGNED_DECLARATION, FRP_ATTACH_VPS_DECLARATION, FRP_CADDY_IMPORT_LINE, FRP_CADDY_SNIPPET_MARKER, FRP_CADDY_SNIPPET_PATH, FRP_COMPONENT_RELEASES, FRP_DEFAULT_PROXY_NAME, FRP_DEFAULT_PUBLIC_PORT, FRP_RESERVED_PORTS, FrpComponentManager, FrpConfigStore, FrpController, JsonDeviceStore, JsonMobileAccessControlStore, JsonRemoteProviderStore, LOCAL_ADMIN_PREFIX, MAX_BLOCKED_UPGRADE_PATHS, MAX_EXTRA_WEBSOCKET_PATHS, MAX_WEBSOCKET_PATH_LENGTH, MemoryDeviceStore, MobileAccessGateway, MobileAccessGatewayController, MobileAccessService, MobileExtensionError, OriginConfigStore, OriginController, REMOTE_PROVIDERS, RequestTrustPolicy, SESSION_COOKIE, TASK_EVENT_DEBOUNCE_MS, TaskEventHub, WS_PATHS, WebSocketPathStore, addressAllowed, apply, assertExtensionId, configuredRemoteProvider, createCaddySite, createFrpAttachPlan, createFrpAttachTemplate, createFrpAttachTemplateParts, createFrpServerTemplate, createFrpcToml, createMobileAccessService, createRestrictedFrpServerTemplate, ensureFrpIngressCertificate, evaluateCertificateLifetime, frpAttachVpsParts, frpIngressPaths, frpIngressSelfCheck, frpProxyName, inject, isCloudflaredRegistration, isFrpSelfSignedIngress, isGloballyRoutableIpv4, isLoopbackAddress, issueServerCertificate, mergeSavedCloudflaredTunnelSettings, mergeSavedFrpSettings, mergeSavedFrpTarget, name, normalizeWebSocketPaths, originGatewayConfig, parseAuthority, parseCidr, parseCloudflaredOrigin, parseCloudflaredTunnelSettings, parseControlFile, parseDeviceSnapshot, parseExtensionManifest, parseFrpSettings, parseGatewayConfig, parseMobileAccessControlState, parseOriginSettings, parseRemoteProviderState, probeOriginCertificate, readCertificateRenewal, resolveAuthority, resolveFrpEntryTls, resolveFrpMode, resolveFrpPublicPort, resolveFrpVhostHttpPort, rewriteMobileIndex, validateAttachSettings, validateCloudflaredTunnelHostname, validateCloudflaredTunnelPort, validateCloudflaredTunnelToken, validateFrpEntryTls, validateFrpMode, validateFrpProxyName, validateFrpPublicOrigin, validateFrpPublicPort, validateFrpServerAddress, validateFrpServerPort, validateFrpToken, validateFrpVhostHttpPort, validateOriginAllowedCidrs, validateOriginListenHost, validateOriginListenPort, validateOriginPublicOrigin, validateWebSocketPath, watchTaskCompletions };
 
 //# sourceMappingURL=index.mjs.map