dsh-mobile 0.6.10 → 0.6.12

package/lib/index.mjs

@@ -64,6 +64,10 @@ var BoundedRateLimiter = class {
 		current.count += 1;
 		return true;
 	}
+	/** Discard entries that no longer identify an eligible key in a trusted, finite key set. */
+	retainKeys(eligible) {
+		for (const key of this.buckets.keys()) if (!eligible.has(key)) this.buckets.delete(key);
+	}
 	/** Current table size, exposed for bounded-state assertions. */
 	get size() {
 		return this.buckets.size;
@@ -104,6 +108,7 @@ var AccessController = class {
 	pairLimiter;
 	devices = [];
 	pairingWindow;
+	pairPending = false;
 	sessions = /* @__PURE__ */ new Map();
 	sessionEndedListeners = /* @__PURE__ */ new Set();
 	mutation = Promise.resolve();
@@ -212,40 +217,52 @@ var AccessController = class {
 			});
 		});
 	}
+	/** Limit invalid guesses by peer without letting them consume a valid one-time secret's admission. */
+	rejectPairingAttempt(sourceKey, now) {
+		if (!this.pairLimiter.take(sourceKey, now)) throw new AccessError(429, "rate_limited");
+		throw new AccessError(401, "authentication_failed");
+	}
 	/** Consume the pairing window exactly once and persist only the device-token digest. */
 	async pair(sourceKey, token, label) {
 		this.requireInitialized();
-		const now = this.now();
-		if (!this.pairLimiter.take(sourceKey, now)) throw new AccessError(429, "rate_limited");
-		if (token.length > 512) throw new AccessError(401, "authentication_failed");
-		return this.exclusive(async () => {
-			const window = this.pairingWindow;
-			if (window === void 0 || window.expiresAt <= now || !matchesDigest(token, window.digest)) {
-				if (window !== void 0 && window.expiresAt <= now) this.pairingWindow = void 0;
-				throw new AccessError(401, "authentication_failed");
-			}
-			this.pairingWindow = void 0;
-			if (this.devices.filter((device) => device.revokedAt === void 0 && device.expiresAt > now).length >= this.options.maxDevices) throw new AccessError(409, "device_limit");
-			const deviceToken = opaqueToken();
-			const device = Object.freeze({
-				id: randomBytes(16).toString("hex"),
-				label: normalizeLabel(label),
-				tokenDigest: digestHex(deviceToken),
-				createdAt: now,
-				expiresAt: now + this.options.deviceTtlMs,
-				lastSeenAt: now,
-				...this.options.pairingInstanceId === void 0 ? {} : { nativeInstanceId: this.options.pairingInstanceId }
-			});
-			const next = [...this.devices.filter((candidate) => candidate.revokedAt === void 0 && candidate.expiresAt > now), device];
-			await this.store.save(this.snapshot(next));
-			this.devices = next;
-			const session = this.createSession(device, now);
-			return Object.freeze({
-				...session,
-				deviceToken,
-				deviceExpiresAt: device.expiresAt
+		const initialNow = this.now();
+		const initialWindow = this.pairingWindow;
+		if (token.length > 512 || initialWindow === void 0 || initialWindow.expiresAt <= initialNow || !matchesDigest(token, initialWindow.digest)) this.rejectPairingAttempt(sourceKey, initialNow);
+		if (this.pairPending) throw new AccessError(429, "rate_limited");
+		this.pairPending = true;
+		try {
+			return await this.exclusive(async () => {
+				const now = this.now();
+				const window = this.pairingWindow;
+				if (window === void 0 || window.expiresAt <= now || !matchesDigest(token, window.digest)) {
+					if (window !== void 0 && window.expiresAt <= now) this.pairingWindow = void 0;
+					this.rejectPairingAttempt(sourceKey, now);
+				}
+				this.pairingWindow = void 0;
+				if (this.devices.filter((device) => device.revokedAt === void 0 && device.expiresAt > now).length >= this.options.maxDevices) throw new AccessError(409, "device_limit");
+				const deviceToken = opaqueToken();
+				const device = Object.freeze({
+					id: randomBytes(16).toString("hex"),
+					label: normalizeLabel(label),
+					tokenDigest: digestHex(deviceToken),
+					createdAt: now,
+					expiresAt: now + this.options.deviceTtlMs,
+					lastSeenAt: now,
+					...this.options.pairingInstanceId === void 0 ? {} : { nativeInstanceId: this.options.pairingInstanceId }
+				});
+				const next = [...this.devices.filter((candidate) => candidate.revokedAt === void 0 && candidate.expiresAt > now), device];
+				await this.store.save(this.snapshot(next));
+				this.devices = next;
+				const session = this.createSession(device, now);
+				return Object.freeze({
+					...session,
+					deviceToken,
+					deviceExpiresAt: device.expiresAt
+				});
 			});
-		});
+		} finally {
+			this.pairPending = false;
+		}
 	}
 	/** Exchange a valid persistent device credential for a new short Session. */
 	async renew(deviceToken) {
@@ -1681,88 +1698,6 @@ var MobileAccessGatewayController = class {
 		return run;
 	}
 };
-//#endregion
-//#region src/client-module-recovery.ts
-const CLIENT_MODULE_RECOVERY_COPY = {
-	zh: {
-		title: "移动页面模块需要调整",
-		explanation: "电脑上的插件或依赖关系已变化，之前保存的模块选择无法加载当前页面。",
-		scope: "可为本设备加载全部模块并重新打开 DSH。不会修改电脑默认设置、其他设备或已安装的插件。",
-		action: "为本设备加载全部模块并重试",
-		working: "正在更新本设备的模块选择…",
-		failed: "未能恢复。请确认电脑和远程通道仍在线，然后重试。"
-	},
-	en: {
-		title: "Mobile page modules need attention",
-		explanation: "The computer’s plugins or dependencies have changed. The saved module selection can no longer load this page.",
-		scope: "Load all modules for this device and reopen DSH. Computer defaults, other devices, and installed plugins are unchanged.",
-		action: "Load all modules for this device and retry",
-		working: "Updating this device’s module selection…",
-		failed: "Could not restore the page. Check that the computer and remote connection are online, then retry."
-	},
-	it: {
-		title: "I moduli della pagina mobile richiedono attenzione",
-		explanation: "I plugin o le dipendenze del computer sono cambiati. La selezione salvata non può più caricare questa pagina.",
-		scope: "Carica tutti i moduli per questo dispositivo e riapri DSH. I predefiniti del computer, gli altri dispositivi e i plugin installati non cambiano.",
-		action: "Carica tutti i moduli per questo dispositivo e riprova",
-		working: "Aggiornamento dei moduli per questo dispositivo…",
-		failed: "Ripristino non riuscito. Verifica che il computer e la connessione remota siano online, poi riprova."
-	}
-};
-/** Render an explicit device-only recovery action without interpolating graph diagnostics or credentials.
-* @param locale - Negotiated browser display language.
-* @returns An owned HTML page which changes no selection until the user activates its button.
-*/
-function renderClientModuleRecoveryPage(locale) {
-	const copy = CLIENT_MODULE_RECOVERY_COPY[locale];
-	return `<!doctype html>
-<html lang="${locale === "zh" ? "zh-CN" : locale}">
-<head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1,viewport-fit=cover">
-<meta name="color-scheme" content="light dark"><title>${copy.title}</title>
-<style>
-body{margin:0;background:Canvas;color:CanvasText;font:16px/1.5 system-ui,sans-serif}
-main{box-sizing:border-box;max-width:640px;margin:32px auto;padding:24px max(24px,env(safe-area-inset-left)) 24px max(24px,env(safe-area-inset-right));overflow-wrap:anywhere}
-h1{font-size:24px;line-height:1.3}button{min-height:48px;max-width:100%;padding:12px 20px;border:1px solid ButtonText;border-radius:12px;background:ButtonFace;color:ButtonText;font:inherit;cursor:pointer}
-button:focus-visible{outline:2px solid Highlight;outline-offset:3px}button:disabled{opacity:.6;cursor:wait}#recovery-status{min-height:1.5em}
-</style></head>
-<body><main><h1>${copy.title}</h1><p>${copy.explanation}</p><p>${copy.scope}</p>
-<button id="load-all-modules" type="button">${copy.action}</button><p id="recovery-status" role="status" aria-live="polite"></p>
-</main><script>${renderClientModuleRecoveryScript(locale)}<\/script></body></html>
-`;
-}
-/** Render the fixed same-origin action; CSRF values are read from the active browser cookie only at user activation.
-* @param locale - Negotiated browser display language.
-* @returns JavaScript that preserves selections on failure and reloads only after an authorized save succeeds.
-*/
-function renderClientModuleRecoveryScript(locale) {
-	const copy = CLIENT_MODULE_RECOVERY_COPY[locale];
-	return `(() => {
-  const button = document.getElementById('load-all-modules')
-  const status = document.getElementById('recovery-status')
-  button.addEventListener('click', async () => {
-    if (button.disabled) return
-    button.disabled = true
-    status.textContent = ${JSON.stringify(copy.working)}
-    try {
-      const values = document.cookie.split(';').map(value => value.trim())
-      const host = values.filter(value => value.startsWith('__Host-dsh_ma_csrf='))
-      const candidates = host.length === 0 ? values.filter(value => value.startsWith('dsh_ma_csrf=')) : host
-      if (candidates.length !== 1) throw new Error('csrf_unavailable')
-      const csrf = candidates[0].slice(candidates[0].indexOf('=') + 1)
-      const response = await fetch('/mobile-access/client-modules', {
-        method: 'POST', credentials: 'same-origin', redirect: 'error', cache: 'no-store',
-        headers: { 'content-type': 'application/json', 'x-dsh-mobile-csrf': csrf },
-        body: JSON.stringify({ excludedClientModules: [] }),
-      })
-      if (!response.ok) throw new Error('recovery_failed')
-      location.reload()
-    } catch {
-      status.textContent = ${JSON.stringify(copy.failed)}
-      button.disabled = false
-    }
-  })
-})()`;
-}
 function unwrapBrackets(hostname) {
 	return hostname.startsWith("[") && hostname.endsWith("]") ? hostname.slice(1, -1) : hostname;
 }
@@ -1979,6 +1914,256 @@ function assertLocalAdminTrust(request, requireBrowserOrigin, authenticateDeskto
 	if (requireBrowserOrigin && site !== void 0 && site !== "same-origin") throw new HttpError(403, "forbidden");
 }
 //#endregion
+//#region src/browser-auth-cookies.ts
+const HOST_SESSION_COOKIE = "__Host-dsh_ma_session";
+const HOST_CSRF_COOKIE = "__Host-dsh_ma_csrf";
+/** Non-secret browser identity; the persistent device credential keeps its narrow renewal path. */
+const HOST_DEVICE_COOKIE = "__Host-dsh_ma_device_id";
+const AUTH_COOKIE_NAMES = /* @__PURE__ */ new Set([
+	SESSION_COOKIE,
+	DEVICE_COOKIE,
+	CSRF_COOKIE,
+	HOST_SESSION_COOKIE,
+	HOST_CSRF_COOKIE,
+	HOST_DEVICE_COOKIE
+]);
+/** Read only gateway authentication cookies, retaining distinct values from different scopes. */
+function browserAuthCookies(header) {
+	if (header === void 0) return /* @__PURE__ */ new Map();
+	if (header.length > 8192) throw new HttpError(401, "authentication_failed");
+	const cookies = /* @__PURE__ */ new Map();
+	for (const part of header.split(";")) {
+		const equals = part.indexOf("=");
+		if (equals <= 0) continue;
+		const name = part.slice(0, equals).trim();
+		if (!AUTH_COOKIE_NAMES.has(name)) continue;
+		const values = cookies.get(name) ?? [];
+		cookies.set(name, values);
+		const value = part.slice(equals + 1).trim();
+		if (!/^[\w\-.~+/=]{1,512}$/u.test(value) || values.includes(value)) continue;
+		values.push(value);
+	}
+	return cookies;
+}
+/** Select exactly one authenticated value; never let cookie order choose between valid identities. */
+function authenticatedCookie(values, authenticate, accepts = () => true) {
+	let selected;
+	for (const value of values) {
+		let result;
+		try {
+			result = authenticate(value);
+		} catch (error) {
+			if (error instanceof AccessError && error.status === 401) continue;
+			throw error;
+		}
+		if (!accepts(result)) continue;
+		if (selected !== void 0) throw new HttpError(401, "authentication_failed");
+		selected = {
+			value,
+			result
+		};
+	}
+	if (selected === void 0) throw new HttpError(401, "authentication_failed");
+	return selected;
+}
+//#endregion
+//#region src/auth-failure-log.ts
+const LOG_INTERVAL_MS = 3e4;
+const MAX_LOGGED_ORIGIN_LENGTH = 512;
+function requestPathCategory(path) {
+	switch (path) {
+		case "/":
+		case "/index.html":
+		case "/api/session/prompt":
+		case "/api/events.mux":
+		case "/api/events.host":
+		case "/api/remote.mux":
+		case "/mobile-access/compat.js":
+		case "/mobile-access/mobile-layout.js":
+		case "/mobile-access/custom.js":
+		case "/mobile-access/custom.css":
+		case "/mobile-access/client-modules":
+		case "/mobile-access/events": return path;
+		default:
+			if (path.startsWith("/api/")) return "/api/*";
+			if (path.startsWith("/mobile-access/extensions/")) return "/mobile-access/extensions/*";
+			if (path.startsWith("/mobile-access/")) return "/mobile-access/*";
+			return "/*";
+	}
+}
+function requestMethod(method) {
+	switch (method) {
+		case "GET":
+		case "HEAD":
+		case "POST":
+		case "PUT":
+		case "PATCH":
+		case "DELETE":
+		case "OPTIONS": return method;
+		default: return "OTHER";
+	}
+}
+function requestEntry(kind, status, request, path, canonicalOrigin, authorization) {
+	let sessionCookie = false;
+	let csrfCookies = 0;
+	for (const cookie of (request.headers.cookie ?? "").split(";")) {
+		const equals = cookie.indexOf("=");
+		if (equals < 0) continue;
+		const name = cookie.slice(0, equals).trim();
+		if (name === "dsh_ma_session" || name === "__Host-dsh_ma_session") sessionCookie = true;
+		if (name === "dsh_ma_csrf" || name === "__Host-dsh_ma_csrf") csrfCookies += 1;
+	}
+	const site = request.headers["sec-fetch-site"];
+	return {
+		kind,
+		status,
+		method: requestMethod(request.method),
+		path: requestPathCategory(path),
+		sessionCookie,
+		csrfHeader: request.headers[CSRF_HEADER] !== void 0,
+		csrfCookies,
+		...canonicalOrigin === void 0 || canonicalOrigin.length > MAX_LOGGED_ORIGIN_LENGTH ? {} : { origin: canonicalOrigin },
+		...site === "same-origin" || site === "same-site" || site === "cross-site" || site === "none" ? { site } : {},
+		...authorization === void 0 ? {} : { device: authorization.deviceId.slice(0, 8) }
+	};
+}
+/**
+* Gateway-owned diagnostic sampling with two fixed slots and no timer or attacker-selected key.
+* Each kind records immediately, then at most once per 30 seconds. Suppressed counts accompany
+* its next recorded request; no credential, request body, arbitrary path or query is retained.
+* The caller supplies the Origin already normalized by its successful request-trust check.
+*/
+var AuthFailureRecorder = class {
+	observe;
+	now;
+	reportObserverFailure;
+	windows = {
+		authorize: {
+			nextLogAt: 0,
+			suppressed: 0
+		},
+		csrf: {
+			nextLogAt: 0,
+			suppressed: 0
+		}
+	};
+	observerFailureReported = false;
+	constructor(observe, now = () => performance.now(), reportObserverFailure = () => {
+		process.emitWarning("Mobile access authentication diagnostics could not be recorded", { code: "DSH_MOBILE_AUTH_LOG_FAILED" });
+	}) {
+		this.observe = observe;
+		this.now = now;
+		this.reportObserverFailure = reportObserverFailure;
+	}
+	/** Record a trusted-request rejection without changing its authentication result or retrying it. */
+	record(kind, status, request, path, canonicalOrigin, authorization) {
+		if (this.observe === void 0) return;
+		const now = this.now();
+		const window = this.windows[kind];
+		if (now < window.nextLogAt) {
+			window.suppressed = Math.min(Number.MAX_SAFE_INTEGER, window.suppressed + 1);
+			return;
+		}
+		const suppressed = window.suppressed;
+		window.nextLogAt = now + LOG_INTERVAL_MS;
+		window.suppressed = 0;
+		try {
+			this.observe({
+				...requestEntry(kind, status, request, path, canonicalOrigin, authorization),
+				...suppressed === 0 ? {} : { suppressed }
+			});
+		} catch (observerError) {
+			if (this.observerFailureReported) return;
+			this.observerFailureReported = true;
+			try {
+				this.reportObserverFailure();
+			} catch (reporterError) {}
+		}
+	}
+};
+//#endregion
+//#region src/client-module-recovery.ts
+const CLIENT_MODULE_RECOVERY_COPY = {
+	zh: {
+		title: "移动页面模块需要调整",
+		explanation: "电脑上的插件或依赖关系已变化，之前保存的模块选择无法加载当前页面。",
+		scope: "可为本设备加载全部模块并重新打开 DSH。不会修改电脑默认设置、其他设备或已安装的插件。",
+		action: "为本设备加载全部模块并重试",
+		working: "正在更新本设备的模块选择…",
+		failed: "未能恢复。请确认电脑和远程通道仍在线，然后重试。"
+	},
+	en: {
+		title: "Mobile page modules need attention",
+		explanation: "The computer’s plugins or dependencies have changed. The saved module selection can no longer load this page.",
+		scope: "Load all modules for this device and reopen DSH. Computer defaults, other devices, and installed plugins are unchanged.",
+		action: "Load all modules for this device and retry",
+		working: "Updating this device’s module selection…",
+		failed: "Could not restore the page. Check that the computer and remote connection are online, then retry."
+	},
+	it: {
+		title: "I moduli della pagina mobile richiedono attenzione",
+		explanation: "I plugin o le dipendenze del computer sono cambiati. La selezione salvata non può più caricare questa pagina.",
+		scope: "Carica tutti i moduli per questo dispositivo e riapri DSH. I predefiniti del computer, gli altri dispositivi e i plugin installati non cambiano.",
+		action: "Carica tutti i moduli per questo dispositivo e riprova",
+		working: "Aggiornamento dei moduli per questo dispositivo…",
+		failed: "Ripristino non riuscito. Verifica che il computer e la connessione remota siano online, poi riprova."
+	}
+};
+/** Render an explicit device-only recovery action without interpolating graph diagnostics or credentials.
+* @param locale - Negotiated browser display language.
+* @returns An owned HTML page which changes no selection until the user activates its button.
+*/
+function renderClientModuleRecoveryPage(locale) {
+	const copy = CLIENT_MODULE_RECOVERY_COPY[locale];
+	return `<!doctype html>
+<html lang="${locale === "zh" ? "zh-CN" : locale}">
+<head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1,viewport-fit=cover">
+<meta name="color-scheme" content="light dark"><title>${copy.title}</title>
+<style>
+body{margin:0;background:Canvas;color:CanvasText;font:16px/1.5 system-ui,sans-serif}
+main{box-sizing:border-box;max-width:640px;margin:32px auto;padding:24px max(24px,env(safe-area-inset-left)) 24px max(24px,env(safe-area-inset-right));overflow-wrap:anywhere}
+h1{font-size:24px;line-height:1.3}button{min-height:48px;max-width:100%;padding:12px 20px;border:1px solid ButtonText;border-radius:12px;background:ButtonFace;color:ButtonText;font:inherit;cursor:pointer}
+button:focus-visible{outline:2px solid Highlight;outline-offset:3px}button:disabled{opacity:.6;cursor:wait}#recovery-status{min-height:1.5em}
+</style></head>
+<body><main><h1>${copy.title}</h1><p>${copy.explanation}</p><p>${copy.scope}</p>
+<button id="load-all-modules" type="button">${copy.action}</button><p id="recovery-status" role="status" aria-live="polite"></p>
+</main><script>${renderClientModuleRecoveryScript(locale)}<\/script></body></html>
+`;
+}
+/** Render the fixed same-origin action; CSRF values are read from the active browser cookie only at user activation.
+* @param locale - Negotiated browser display language.
+* @returns JavaScript that preserves selections on failure and reloads only after an authorized save succeeds.
+*/
+function renderClientModuleRecoveryScript(locale) {
+	const copy = CLIENT_MODULE_RECOVERY_COPY[locale];
+	return `(() => {
+  const button = document.getElementById('load-all-modules')
+  const status = document.getElementById('recovery-status')
+  button.addEventListener('click', async () => {
+    if (button.disabled) return
+    button.disabled = true
+    status.textContent = ${JSON.stringify(copy.working)}
+    try {
+      const values = document.cookie.split(';').map(value => value.trim())
+      const host = values.filter(value => value.startsWith('__Host-dsh_ma_csrf='))
+      const candidates = host.length === 0 ? values.filter(value => value.startsWith('dsh_ma_csrf=')) : host
+      if (candidates.length !== 1) throw new Error('csrf_unavailable')
+      const csrf = candidates[0].slice(candidates[0].indexOf('=') + 1)
+      const response = await fetch('/mobile-access/client-modules', {
+        method: 'POST', credentials: 'same-origin', redirect: 'error', cache: 'no-store',
+        headers: { 'content-type': 'application/json', 'x-dsh-mobile-csrf': csrf },
+        body: JSON.stringify({ excludedClientModules: [] }),
+      })
+      if (!response.ok) throw new Error('recovery_failed')
+      location.reload()
+    } catch {
+      status.textContent = ${JSON.stringify(copy.failed)}
+      button.disabled = false
+    }
+  })
+})()`;
+}
+//#endregion
 //#region src/mobile-compat-bootstrap.ts
 const MOBILE_COMPAT_PATH = `${AUTH_PREFIX}/compat.js`;
 /**
@@ -2076,59 +2261,6 @@ function weakenEntityTag(etag) {
 	return opaque === void 0 ? void 0 : `W/${opaque}`;
 }
 //#endregion
-//#region src/browser-auth-cookies.ts
-const HOST_SESSION_COOKIE = "__Host-dsh_ma_session";
-const HOST_CSRF_COOKIE = "__Host-dsh_ma_csrf";
-/** Non-secret browser identity; the persistent device credential keeps its narrow renewal path. */
-const HOST_DEVICE_COOKIE = "__Host-dsh_ma_device_id";
-const AUTH_COOKIE_NAMES = /* @__PURE__ */ new Set([
-	SESSION_COOKIE,
-	DEVICE_COOKIE,
-	CSRF_COOKIE,
-	HOST_SESSION_COOKIE,
-	HOST_CSRF_COOKIE,
-	HOST_DEVICE_COOKIE
-]);
-/** Read only gateway authentication cookies, retaining distinct values from different scopes. */
-function browserAuthCookies(header) {
-	if (header === void 0) return /* @__PURE__ */ new Map();
-	if (header.length > 8192) throw new HttpError(401, "authentication_failed");
-	const cookies = /* @__PURE__ */ new Map();
-	for (const part of header.split(";")) {
-		const equals = part.indexOf("=");
-		if (equals <= 0) continue;
-		const name = part.slice(0, equals).trim();
-		if (!AUTH_COOKIE_NAMES.has(name)) continue;
-		const values = cookies.get(name) ?? [];
-		cookies.set(name, values);
-		const value = part.slice(equals + 1).trim();
-		if (!/^[\w\-.~+/=]{1,512}$/u.test(value) || values.includes(value)) continue;
-		values.push(value);
-	}
-	return cookies;
-}
-/** Select exactly one authenticated value; never let cookie order choose between valid identities. */
-function authenticatedCookie(values, authenticate, accepts = () => true) {
-	let selected;
-	for (const value of values) {
-		let result;
-		try {
-			result = authenticate(value);
-		} catch (error) {
-			if (error instanceof AccessError && error.status === 401) continue;
-			throw error;
-		}
-		if (!accepts(result)) continue;
-		if (selected !== void 0) throw new HttpError(401, "authentication_failed");
-		selected = {
-			value,
-			result
-		};
-	}
-	if (selected === void 0) throw new HttpError(401, "authentication_failed");
-	return selected;
-}
-//#endregion
 //#region src/websocket-compression.ts
 function payloadBytes(data) {
 	if (Array.isArray(data)) return data.reduce((bytes, part) => bytes + part.byteLength, 0);
@@ -5280,19 +5412,25 @@ var MobileAccessGateway = class {
 	closeTask;
 	removeSessionListener;
 	removeExtensionContentListener;
-	renewLimiter;
-	probeLimiter;
+	renewFailureLimiter;
+	renewDeviceLimiter;
+	renewInFlight = /* @__PURE__ */ new Set();
+	probeFailureLimiter;
+	probeDeviceLimiter;
+	probeInFlight = /* @__PURE__ */ new Set();
 	clientModulePreferences;
 	clientModuleOperations = /* @__PURE__ */ new Set();
 	clientModuleTasks = /* @__PURE__ */ new Set();
 	clientModuleRevocations = /* @__PURE__ */ new Set();
-	constructor(config, store, extensions, upstreamAuthenticatedUrl, extraWebSocketPaths, blockedUpgradeLog, onDiscoveryDegraded, clientModulePreferences) {
+	authFailures;
+	constructor(config, store, extensions, upstreamAuthenticatedUrl, extraWebSocketPaths, blockedUpgradeLog, onDiscoveryDegraded, clientModulePreferences, authFailureLog) {
 		this.config = config;
 		this.extensions = extensions;
 		this.upstreamAuthenticatedUrl = upstreamAuthenticatedUrl;
 		this.extraWebSocketPaths = extraWebSocketPaths;
 		this.blockedUpgradeLog = blockedUpgradeLog;
 		this.onDiscoveryDegraded = onDiscoveryDegraded;
+		this.authFailures = new AuthFailureRecorder(authFailureLog);
 		this.clientModulePreferences = clientModulePreferences ?? new ClientModulePreferenceStore(join(dirname(config.stateFile), `${basename(config.stateFile)}.client-modules.json`), config.excludedClientModules);
 		this.listenerTlsEnabled = config.tls.mode === "provided";
 		this.tlsEnabled = config.publicTls;
@@ -5308,8 +5446,12 @@ var MobileAccessGateway = class {
 			maxPairingAttempts: config.maxPairingAttempts,
 			maxRateLimitKeys: config.maxRateLimitKeys
 		});
-		this.renewLimiter = new BoundedRateLimiter(Math.min(100, config.maxPairingAttempts * 4), config.rateLimitWindowMs, config.maxRateLimitKeys);
-		this.probeLimiter = new BoundedRateLimiter(Math.min(1e3, config.maxDevices * 4), config.rateLimitWindowMs, config.maxRateLimitKeys);
+		const renewLimit = Math.min(100, config.maxPairingAttempts * 4);
+		const probeLimit = Math.min(1e3, config.maxDevices * 4);
+		this.renewFailureLimiter = new BoundedRateLimiter(renewLimit, config.rateLimitWindowMs, config.maxRateLimitKeys);
+		this.renewDeviceLimiter = new BoundedRateLimiter(renewLimit, config.rateLimitWindowMs, config.maxDevices);
+		this.probeFailureLimiter = new BoundedRateLimiter(probeLimit, config.rateLimitWindowMs, config.maxRateLimitKeys);
+		this.probeDeviceLimiter = new BoundedRateLimiter(probeLimit, config.rateLimitWindowMs, config.maxDevices);
 		this.removeSessionListener = this.access.onSessionEnded((authorization, reason) => {
 			if (reason === "revoked") {
 				const cleanup = this.clientModulePreferences.removeDevice(authorization.deviceId).catch(() => {
@@ -5637,6 +5779,27 @@ var MobileAccessGateway = class {
 			maxAgeSeconds: (deviceExpiresAt - Date.now()) / 1e3
 		})]);
 	}
+	/** Separate malformed or invalid requests from device-authenticated work without trusting forwarded addresses. */
+	async withDeviceRequest(request, failureLimiter, deviceLimiter, inFlight, validate, operation) {
+		let device;
+		try {
+			device = await validate();
+		} catch (error) {
+			if ((error instanceof HttpError || error instanceof AccessError) && error.status >= 400 && error.status < 500 && !failureLimiter.take(request.socket.remoteAddress ?? "unknown", Date.now())) throw new HttpError(429, "rate_limited");
+			throw error;
+		}
+		if (inFlight.has(device.deviceId)) throw new HttpError(429, "rate_limited");
+		const now = Date.now();
+		const activeIds = new Set(this.access.listDevices().filter((candidate) => candidate.revokedAt === void 0 && candidate.expiresAt > now).map((candidate) => candidate.id));
+		deviceLimiter.retainKeys(activeIds);
+		if (!deviceLimiter.take(device.deviceId, now)) throw new HttpError(429, "rate_limited");
+		inFlight.add(device.deviceId);
+		try {
+			return await operation(device);
+		} finally {
+			inFlight.delete(device.deviceId);
+		}
+	}
 	async handlePair(request, response) {
 		const body = await readJsonObject(request, MAX_CONTROL_BODY_BYTES);
 		if (typeof body.token !== "string" || body.label !== void 0 && typeof body.label !== "string") throw new HttpError(400, "bad_request");
@@ -5659,21 +5822,28 @@ var MobileAccessGateway = class {
 		}, this.tlsEnabled);
 	}
 	async handleRenew(request, response) {
-		if (!this.renewLimiter.take(request.socket.remoteAddress ?? "unknown", Date.now())) throw new HttpError(429, "rate_limited");
-		await readJsonObject(request, MAX_CONTROL_BODY_BYTES);
-		const cookies = browserAuthCookies(request.headers.cookie);
-		const bindings = this.tlsEnabled ? cookies.get(HOST_DEVICE_COOKIE) : void 0;
-		if (bindings !== void 0 && bindings.length !== 1) throw new HttpError(401, "authentication_failed");
-		const device = authenticatedCookie(cookies.get("dsh_ma_device") ?? [], (token) => this.access.authorizeDevice(token), (candidate) => bindings === void 0 || candidate.deviceId === bindings[0]);
-		const result = await this.access.renew(device.value);
-		this.setSessionCookies(response, result, Date.now());
-		this.setBrowserDeviceBinding(response, result.deviceId, device.result.deviceExpiresAt);
-		sendJson(response, 200, {
-			renewed: true,
-			deviceId: result.deviceId,
-			csrfToken: result.csrfToken,
-			sessionExpiresAt: result.sessionExpiresAt
-		}, this.tlsEnabled);
+		await this.withDeviceRequest(request, this.renewFailureLimiter, this.renewDeviceLimiter, this.renewInFlight, async () => {
+			await readJsonObject(request, MAX_CONTROL_BODY_BYTES);
+			const cookies = browserAuthCookies(request.headers.cookie);
+			const bindings = this.tlsEnabled ? cookies.get(HOST_DEVICE_COOKIE) : void 0;
+			if (bindings !== void 0 && bindings.length !== 1) throw new HttpError(401, "authentication_failed");
+			const device = authenticatedCookie(cookies.get("dsh_ma_device") ?? [], (token) => this.access.authorizeDevice(token), (candidate) => bindings === void 0 || candidate.deviceId === bindings[0]);
+			return {
+				deviceId: device.result.deviceId,
+				token: device.value,
+				credential: device.result
+			};
+		}, async (selected) => {
+			const result = await this.access.renew(selected.token);
+			this.setSessionCookies(response, result, Date.now());
+			this.setBrowserDeviceBinding(response, result.deviceId, selected.credential.deviceExpiresAt);
+			sendJson(response, 200, {
+				renewed: true,
+				deviceId: result.deviceId,
+				csrfToken: result.csrfToken,
+				sessionExpiresAt: result.sessionExpiresAt
+			}, this.tlsEnabled);
+		});
 	}
 	/** CA-backed entries retain their pin; public entries project the authenticated credential's identity. */
 	nativeResponseInstanceId(result) {
@@ -5694,28 +5864,40 @@ var MobileAccessGateway = class {
 		}, this.tlsEnabled);
 	}
 	async handleNativeRenew(request, response) {
-		if (!this.renewLimiter.take(request.socket.remoteAddress ?? "unknown", Date.now())) throw new HttpError(429, "rate_limited");
-		const body = await readJsonObject(request, MAX_CONTROL_BODY_BYTES);
-		if (typeof body.deviceToken !== "string") throw new HttpError(400, "bad_request");
-		const result = await this.access.renew(body.deviceToken);
-		sendJson(response, 200, {
-			instanceId: this.nativeResponseInstanceId(result),
-			deviceId: result.deviceId,
-			sessionToken: result.sessionToken,
-			csrfToken: result.csrfToken,
-			sessionExpiresAt: result.sessionExpiresAt
-		}, this.tlsEnabled);
+		await this.withDeviceRequest(request, this.renewFailureLimiter, this.renewDeviceLimiter, this.renewInFlight, async () => {
+			const body = await readJsonObject(request, MAX_CONTROL_BODY_BYTES);
+			if (typeof body.deviceToken !== "string") throw new HttpError(400, "bad_request");
+			return {
+				deviceId: this.access.authorizeDevice(body.deviceToken).deviceId,
+				token: body.deviceToken
+			};
+		}, async (selected) => {
+			const result = await this.access.renew(selected.token);
+			sendJson(response, 200, {
+				instanceId: this.nativeResponseInstanceId(result),
+				deviceId: result.deviceId,
+				sessionToken: result.sessionToken,
+				csrfToken: result.csrfToken,
+				sessionExpiresAt: result.sessionExpiresAt
+			}, this.tlsEnabled);
+		});
 	}
 	async handleNativeProbe(request, response) {
-		if (!this.probeLimiter.take(request.socket.remoteAddress ?? "unknown", Date.now())) throw new HttpError(429, "rate_limited");
-		const body = await readJsonObject(request, MAX_CONTROL_BODY_BYTES);
-		if (typeof body.deviceToken !== "string") throw new HttpError(400, "bad_request");
-		const result = await this.access.probe(body.deviceToken);
-		sendJson(response, 200, {
-			instanceId: this.nativeResponseInstanceId(result),
-			deviceId: result.deviceId,
-			deviceExpiresAt: result.deviceExpiresAt
-		}, this.tlsEnabled);
+		await this.withDeviceRequest(request, this.probeFailureLimiter, this.probeDeviceLimiter, this.probeInFlight, async () => {
+			const body = await readJsonObject(request, MAX_CONTROL_BODY_BYTES);
+			if (typeof body.deviceToken !== "string") throw new HttpError(400, "bad_request");
+			return {
+				deviceId: this.access.authorizeDevice(body.deviceToken).deviceId,
+				token: body.deviceToken
+			};
+		}, async (selected) => {
+			const result = await this.access.probe(selected.token);
+			sendJson(response, 200, {
+				instanceId: this.nativeResponseInstanceId(result),
+				deviceId: result.deviceId,
+				deviceExpiresAt: result.deviceExpiresAt
+			}, this.tlsEnabled);
+		});
 	}
 	async handleLogout(request, response) {
 		await readJsonObject(request, MAX_CONTROL_BODY_BYTES);
@@ -5879,6 +6061,7 @@ var MobileAccessGateway = class {
 			authorization = this.authorize(request);
 		} catch (error) {
 			const mapped = mapError(error);
+			this.authFailures.record("authorize", mapped.status, request, target.decodedPathname, policy.canonicalOrigin(request.headers.origin));
 			const acceptsHtml = request.headers.accept?.split(",").some((value) => value.trim().split(";", 1)[0] === "text/html") ?? false;
 			const topLevel = request.method === "GET" && acceptsHtml && (request.headers["sec-fetch-dest"] === void 0 || request.headers["sec-fetch-dest"] === "document") && target.decodedPathname !== "/api" && !target.decodedPathname.startsWith("/api/");
 			if (mapped.status === 401 && topLevel) {
@@ -5893,7 +6076,12 @@ var MobileAccessGateway = class {
 			}
 			throw error;
 		}
-		if (isMutation) this.requireCsrf(request, authorization);
+		if (isMutation) try {
+			this.requireCsrf(request, authorization);
+		} catch (error) {
+			this.authFailures.record("csrf", mapError(error).status, request, target.decodedPathname, policy.canonicalOrigin(request.headers.origin), authorization);
+			throw error;
+		}
 		if (clientModules) {
 			if (target.search !== "") throw new HttpError(400, "bad_request");
 			if (request.method !== "GET" && request.method !== "POST") throw new HttpError(405, "method_not_allowed");
@@ -6267,7 +6455,8 @@ var MobileAccessGateway = class {
 					headers: {
 						host: this.config.upstreamOrigin.host,
 						accept: "text/html",
-						"accept-encoding": "identity"
+						"accept-encoding": "identity",
+						"sec-fetch-mode": "same-origin"
 					},
 					agent: false
 				});
@@ -17410,7 +17599,9 @@ async function apply(ctx, config) {
 		}), frpIdentity, candidateConfig.instanceId !== void 0);
 		const candidate = new MobileAccessGateway(resolved, new JsonDeviceStore(resolved.stateFile, resolved.maxDevices), mobileAccess, upstreamLoginUrl, webSocketPaths, blockedUpgradePaths, (source, code) => {
 			logger.warn("%s discovery degraded while DSH remains available: %s", source, code);
-		}, clientModulePreferences);
+		}, clientModulePreferences, (entry) => {
+			logger.warn("auth failure %s", JSON.stringify(entry));
+		});
 		await candidate.start();
 		lanGateway = candidate;
 		const removeTaskSink = taskEventHub.add(candidate);
@@ -17466,7 +17657,9 @@ async function apply(ctx, config) {
 	}
 	const createRemoteGateway = async (publicOrigin, listenPort = 0) => {
 		const resolved = remoteGatewayConfig(template, publicOrigin, remoteDeviceFile, remoteInstanceId, listenPort, instanceId);
-		const candidate = new MobileAccessGateway(resolved, new JsonDeviceStore(resolved.stateFile, resolved.maxDevices), mobileAccess, upstreamLoginUrl, webSocketPaths, blockedUpgradePaths, void 0, clientModulePreferences);
+		const candidate = new MobileAccessGateway(resolved, new JsonDeviceStore(resolved.stateFile, resolved.maxDevices), mobileAccess, upstreamLoginUrl, webSocketPaths, blockedUpgradePaths, void 0, clientModulePreferences, (entry) => {
+			logger.warn("auth failure %s", JSON.stringify(entry));
+		});
 		await candidate.start();
 		return candidate;
 	};