dsh-mobile 0.6.13 → 0.6.15

package/lib/index.mjs

@@ -17,6 +17,7 @@ import { promisify } from "node:util";
 import { createGzip, gzip } from "node:zlib";
 import Bonjour from "bonjour-service";
 import * as QRCode from "qrcode";
+import { createParser } from "eventsource-parser";
 import WebSocket, { WebSocketServer } from "ws";
 import { Logger, Service } from "@deepseek-ai/cordis";
 import { Worker } from "node:worker_threads";
@@ -1810,6 +1811,7 @@ function setSecurityHeaders(response, tls, framing = "gateway") {
 		"font-src 'self' data:",
 		"connect-src 'self'",
 		"worker-src 'self' blob:",
+		...proxied ? ["media-src 'self' blob:"] : [],
 		...proxied ? [PROXIED_FRAME_SRC] : []
 	].join("; "));
 	const microphone = proxied ? "microphone=(self)" : "microphone=()";
@@ -1899,6 +1901,7 @@ function assertLocalAdminTrust(request, requireBrowserOrigin, authenticateDeskto
 	if (request.socket.remoteAddress === void 0 || !isLoopbackAddress(request.socket.remoteAddress)) throw new HttpError(403, "forbidden");
 	const host = localAuthority(request.headers.host);
 	if (host === void 0 || !isLocalAdminHostname(host.hostname)) throw new HttpError(403, "forbidden");
+	if (request.method === "OPTIONS") throw new HttpError(403, "forbidden");
 	const site = request.headers["sec-fetch-site"];
 	if (site !== void 0 && site !== "same-origin" && site !== "none") throw new HttpError(403, "forbidden");
 	const origin = request.headers.origin;
@@ -1910,7 +1913,9 @@ function assertLocalAdminTrust(request, requireBrowserOrigin, authenticateDeskto
 		throw new HttpError(403, "forbidden");
 	}
 	const desktopForward = site === void 0 && request.headers["x-dsh-mobile-desktop-admin"] === "dsh-app://app";
-	if (requireBrowserOrigin && origin === void 0 && !(desktopForward && authenticateDesktop())) throw new HttpError(403, "forbidden");
+	const contentType = request.headers["content-type"];
+	const webRequest = request.method === "POST" && (site === void 0 || site === "same-origin") && request.headers["x-dsh-mobile-web-admin"] === "same-origin-json" && request.headers["x-dsh-mobile-desktop-admin"] === void 0 && typeof contentType === "string" && contentType.split(";", 1)[0]?.trim().toLowerCase() === "application/json";
+	if (requireBrowserOrigin && origin === void 0 && !webRequest && !(desktopForward && authenticateDesktop())) throw new HttpError(403, "forbidden");
 	if (requireBrowserOrigin && site !== void 0 && site !== "same-origin") throw new HttpError(403, "forbidden");
 }
 //#endregion
@@ -1968,7 +1973,7 @@ function authenticatedCookie(values, authenticate, accepts = () => true) {
 }
 //#endregion
 //#region src/auth-failure-log.ts
-const LOG_INTERVAL_MS$1 = 3e4;
+const LOG_INTERVAL_MS$2 = 3e4;
 const MAX_LOGGED_ORIGIN_LENGTH = 512;
 function requestPathCategory(path) {
 	switch (path) {
@@ -2065,7 +2070,7 @@ var AuthFailureRecorder = class {
 			return;
 		}
 		const suppressed = window.suppressed;
-		window.nextLogAt = now + LOG_INTERVAL_MS$1;
+		window.nextLogAt = now + LOG_INTERVAL_MS$2;
 		window.suppressed = 0;
 		try {
 			this.observe({
@@ -2119,7 +2124,7 @@ function classifyHttpParserFailure(nodeCode) {
 		parserCode
 	};
 }
-const LOG_INTERVAL_MS = 3e4;
+const LOG_INTERVAL_MS$1 = 3e4;
 /**
 * Per-Gateway diagnostics with three fixed sampling slots and no timers or request-selected keys.
 * Each kind records once immediately, then at most once per 30 seconds with suppressed counts.
@@ -2188,7 +2193,7 @@ var HttpFailureRecorder = class {
 			return;
 		}
 		const suppressed = window.suppressed;
-		window.nextLogAt = now + LOG_INTERVAL_MS;
+		window.nextLogAt = now + LOG_INTERVAL_MS$1;
 		window.suppressed = 0;
 		try {
 			this.observe({
@@ -2205,6 +2210,72 @@ var HttpFailureRecorder = class {
 	}
 };
 //#endregion
+//#region src/upstream-auth-log.ts
+const LOG_INTERVAL_MS = 3e4;
+/** Two fixed sampling slots keep a first failure visible even after a successful exchange. */
+var UpstreamAuthRecorder = class {
+	observe;
+	now;
+	reportObserverFailure;
+	sequence = 0;
+	windows = {
+		success: {
+			nextLogAt: 0,
+			suppressed: 0
+		},
+		failure: {
+			nextLogAt: 0,
+			suppressed: 0
+		}
+	};
+	observerFailureReported = false;
+	constructor(observe, now = () => performance.now(), reportObserverFailure = () => {
+		process.emitWarning("Mobile access upstream authentication diagnostics could not be recorded", { code: "DSH_MOBILE_UPSTREAM_AUTH_LOG_FAILED" });
+	}) {
+		this.observe = observe;
+		this.now = now;
+		this.reportObserverFailure = reportObserverFailure;
+	}
+	/** Begin only a physical exchange, not every consumer sharing its promise or cached Cookie. */
+	begin() {
+		if (this.observe === void 0) return void 0;
+		this.sequence = this.sequence >= Number.MAX_SAFE_INTEGER ? 1 : this.sequence + 1;
+		return {
+			sequence: this.sequence,
+			startedAt: this.now()
+		};
+	}
+	/** Record the completed exchange without changing authentication, retrying it or retaining its inputs. */
+	record(attempt, result) {
+		if (attempt === void 0 || this.observe === void 0) return;
+		const now = this.now();
+		const window = this.windows[result.outcome === "accepted" ? "success" : "failure"];
+		if (now < window.nextLogAt) {
+			window.suppressed = Math.min(Number.MAX_SAFE_INTEGER, window.suppressed + 1);
+			return;
+		}
+		const suppressed = window.suppressed;
+		window.nextLogAt = now + LOG_INTERVAL_MS;
+		window.suppressed = 0;
+		try {
+			this.observe({
+				sequence: attempt.sequence,
+				outcome: result.outcome,
+				stage: result.stage,
+				durationMs: Math.max(0, Math.floor(now - attempt.startedAt)),
+				...result.status === void 0 ? {} : { status: result.status },
+				...suppressed === 0 ? {} : { suppressed }
+			});
+		} catch (observerError) {
+			if (this.observerFailureReported) return;
+			this.observerFailureReported = true;
+			try {
+				this.reportObserverFailure();
+			} catch (reporterError) {}
+		}
+	}
+};
+//#endregion
 //#region src/client-module-recovery.ts
 const CLIENT_MODULE_RECOVERY_COPY = {
 	zh: {
@@ -2384,6 +2455,196 @@ function weakenEntityTag(etag) {
 	return opaque === void 0 ? void 0 : `W/${opaque}`;
 }
 //#endregion
+//#region src/mobile-graph-events.ts
+/** Bounded SSE framing for the dedicated Mobile client graph stream. */
+/** Maximum retained UTF-8 frame/output bytes, with CRLF normalized to LF. */
+const MOBILE_GRAPH_EVENT_MAX_BYTES = 4194304;
+const LINE_FEED = Buffer.from("\n");
+/** Fixed failures contain neither an upstream payload nor a projection exception. */
+var MobileGraphEventError = class extends Error {
+	code;
+	constructor(code) {
+		super(`Mobile graph event stream: ${code}`);
+		this.code = code;
+		this.name = "MobileGraphEventError";
+	}
+};
+var MobileGraphEventTransform = class extends Transform {
+	project;
+	frame = Buffer.allocUnsafe(16384);
+	used = 0;
+	lineBytes = 0;
+	skipLf = false;
+	firstFrame = true;
+	disposed = false;
+	readWait;
+	constructor(project) {
+		super();
+		this.project = project;
+	}
+	_transform(chunk, _encoding, callback) {
+		this.consume(chunk).then(() => callback(), (error) => callback(error));
+	}
+	_read(size) {
+		super._read(size);
+		const waiting = this.readWait;
+		this.readWait = void 0;
+		waiting?.resolve();
+	}
+	_flush(callback) {
+		if (this.used !== 0) {
+			try {
+				this.decodeFrame();
+			} catch {
+				callback(new MobileGraphEventError("invalid_utf8"));
+				return;
+			}
+			callback(new MobileGraphEventError("incomplete_frame"));
+			return;
+		}
+		callback();
+	}
+	_destroy(error, callback) {
+		this.disposed = true;
+		const waiting = this.readWait;
+		this.readWait = void 0;
+		waiting?.reject(error ?? new MobileGraphEventError("stream_closed"));
+		this.frame = Buffer.alloc(0);
+		this.used = 0;
+		callback(error);
+	}
+	requireOpen() {
+		if (this.disposed || this.destroyed) throw new MobileGraphEventError("stream_closed");
+	}
+	append(bytes) {
+		const required = this.used + bytes.length;
+		if (required > 4194304) throw new MobileGraphEventError("frame_too_large");
+		if (required > this.frame.length) {
+			const next = Buffer.allocUnsafe(Math.min(MOBILE_GRAPH_EVENT_MAX_BYTES, Math.max(required, this.frame.length * 2)));
+			this.frame.copy(next, 0, 0, this.used);
+			this.frame = next;
+		}
+		bytes.copy(this.frame, this.used);
+		this.used = required;
+	}
+	async consume(chunk) {
+		let offset = 0;
+		while (offset < chunk.length) {
+			this.requireOpen();
+			if (this.skipLf) {
+				this.skipLf = false;
+				if (chunk[offset] === 10) {
+					offset += 1;
+					continue;
+				}
+			}
+			let contentEnd = offset;
+			while (contentEnd < chunk.length && chunk[contentEnd] !== 13 && chunk[contentEnd] !== 10) contentEnd += 1;
+			const content = chunk.subarray(offset, contentEnd);
+			this.append(content);
+			this.lineBytes += content.length;
+			if (contentEnd === chunk.length) return;
+			this.append(LINE_FEED);
+			this.skipLf = chunk[contentEnd] === 13;
+			const emptyLine = this.lineBytes === 0;
+			this.lineBytes = 0;
+			offset = contentEnd + 1;
+			if (emptyLine) await this.completeFrame();
+		}
+	}
+	decodeFrame() {
+		try {
+			return new TextDecoder("utf-8", {
+				fatal: true,
+				ignoreBOM: true
+			}).decode(this.frame.subarray(0, this.used));
+		} catch {
+			throw new MobileGraphEventError("invalid_utf8");
+		}
+	}
+	async completeFrame() {
+		let text = this.decodeFrame();
+		this.used = 0;
+		if (this.firstFrame) {
+			this.firstFrame = false;
+			if (text.startsWith("")) text = text.slice(1);
+		}
+		let event;
+		createParser({
+			maxBufferSize: MOBILE_GRAPH_EVENT_MAX_BYTES,
+			onEvent: (value) => {
+				event = value;
+			},
+			onError: () => {
+				throw new MobileGraphEventError("invalid_sse");
+			}
+		}).feed(text);
+		const lines = text.split("\n");
+		for (const line of lines) {
+			if (!line.startsWith("event:")) continue;
+			const type = line.slice(line[6] === " " ? 7 : 6);
+			if (type !== "" && type !== "message") throw new MobileGraphEventError("unsupported_event");
+		}
+		if (event === void 0) {
+			await this.forward(Buffer.from(text, "utf8"));
+			return;
+		}
+		if (event.event !== void 0 && event.event !== "message") throw new MobileGraphEventError("unsupported_event");
+		let value;
+		try {
+			value = JSON.parse(event.data);
+		} catch {
+			throw new MobileGraphEventError("invalid_json");
+		}
+		let projected;
+		try {
+			projected = await this.project(value);
+		} catch {
+			throw new MobileGraphEventError("projection_failed");
+		}
+		this.requireOpen();
+		if (projected === void 0) return;
+		let encoded;
+		try {
+			encoded = JSON.stringify(projected);
+		} catch {
+			throw new MobileGraphEventError("invalid_projection");
+		}
+		if (encoded === void 0) throw new MobileGraphEventError("invalid_projection");
+		const metadata = lines.filter((line) => line !== "" && line !== "data" && !line.startsWith("data:"));
+		const result = `${metadata.length === 0 ? "" : `${metadata.join("\n")}\n`}data: ${encoded}\n\n`;
+		if (Buffer.byteLength(result) > 4194304) throw new MobileGraphEventError("frame_too_large");
+		await this.forward(Buffer.from(result, "utf8"));
+	}
+	async forward(frame) {
+		this.requireOpen();
+		if (frame.length === 0 || this.push(frame)) return;
+		await new Promise((resolve, reject) => {
+			this.readWait = {
+				resolve,
+				reject
+			};
+			if (this.destroyed || this.disposed) {
+				this.readWait = void 0;
+				reject(new MobileGraphEventError("stream_closed"));
+			} else if (this.readableLength < this.readableHighWaterMark) {
+				this.readWait = void 0;
+				resolve();
+			}
+		});
+	}
+};
+/**
+* Project each complete JSON message serially without forwarding unprojected data.
+* Comments and valid SSE metadata are retained; only the default message event is supported.
+* Undefined suppresses that message. Malformed, oversized or truncated input terminates the stream.
+* @param project - Projects one message; caller-owned cancellation must stop any external work.
+* @returns A byte-mode Transform that honors downstream backpressure and fences late results after destroy.
+*/
+function createMobileGraphEventTransform(project) {
+	return new MobileGraphEventTransform(project);
+}
+//#endregion
 //#region src/websocket-compression.ts
 function payloadBytes(data) {
 	if (Array.isArray(data)) return data.reduce((bytes, part) => bytes + part.byteLength, 0);
@@ -4660,6 +4921,7 @@ const MDNS_SERVICE_TYPE = "dsh-mobile";
 const MOBILE_LAYOUT_MODULE = "@deepseek-ai/dsh-client-ui-layout";
 const MOBILE_LAYOUT_PATH = `${AUTH_PREFIX}/mobile-layout.js`;
 const MOBILE_BOOT_BATCH_PREFIX = `${AUTH_PREFIX}/mobile-boot/`;
+const MOBILE_DOCUMENT_VIEW_HEADER = "x-dsh-mobile-view";
 const MAX_MOBILE_BOOT_BATCH_BYTES = 33554432;
 const MAX_MOBILE_BOOT_ENTRY_BYTES = 8388608;
 /**
@@ -4741,7 +5003,9 @@ const MOBILE_LAYOUT_DEPENDENCY_PROFILES = Object.freeze([Object.freeze({
 function mobileCsrfFetchBootstrap(cookieName) {
 	return `(()=>{const nativeFetch=window.fetch.bind(window);window.fetch=(input,init)=>{const source=input instanceof Request?input:undefined;const method=String(init?.method??source?.method??'GET').toUpperCase();if(method==='GET'||method==='HEAD')return nativeFetch(input,init);const raw=typeof input==='string'?input:input instanceof URL?input.href:source?.url;if(raw===undefined||new URL(raw,location.href).origin!==location.origin)return nativeFetch(input,init);const headers=new Headers(init?.headers??source?.headers);if(!headers.has(${JSON.stringify(CSRF_HEADER)})){const prefix=${JSON.stringify(`${cookieName}=`)};const values=[...new Set(document.cookie.split(';').map(value=>value.trim()).filter(value=>value.startsWith(prefix)).map(value=>value.slice(prefix.length)))];if(values.length===1)headers.set(${JSON.stringify(CSRF_HEADER)},values[0])}return nativeFetch(input,{...init,headers})};})();`;
 }
-const MOBILE_AUTHENTICATED_TRANSPORT_BOOTSTRAP = `(()=>{if(window.__DSH_TRANSPORT__!==undefined)throw new Error('DSH Mobile cannot replace an existing transport override');window.__DSH_TRANSPORT__={fetch:(input,init)=>window.fetch(input,init),ownsHost:true},window.__DSH_FILE_UPLOAD__={fetch:(input,init)=>window.fetch(input,init)}})();`;
+function mobileAuthenticatedTransportBootstrap(viewId) {
+	return `(()=>{if(window.__DSH_TRANSPORT__!==undefined)throw new Error('DSH Mobile cannot replace an existing transport override');window.__DSH_TRANSPORT__={fetch:${viewId === void 0 ? "(input,init)=>window.fetch(input,init)" : `(input,init)=>{const source=input instanceof Request?input:undefined;const method=String(init?.method??source?.method??'GET').toUpperCase();const raw=typeof input==='string'?input:input instanceof URL?input.href:source?.url;if(raw!==undefined&&method==='GET'){const target=new URL(raw,location.href);if(target.origin===location.origin&&target.pathname==='/plugins/events'){const headers=new Headers(init?.headers??source?.headers);headers.set(${JSON.stringify(MOBILE_DOCUMENT_VIEW_HEADER)},${JSON.stringify(viewId)});return window.fetch(input,{...init,headers})}}return window.fetch(input,init)}`},ownsHost:true},window.__DSH_FILE_UPLOAD__={fetch:(input,init)=>window.fetch(input,init)}})();`;
+}
 /** Use this page's gateway health, rather than OS internet validation, for DSH reconnects. */
 const MOBILE_GATEWAY_REACHABILITY_BOOTSTRAP = `(()=>{
   const view=globalThis;
@@ -4911,6 +5175,14 @@ function parseMobileBootPlan(html, excludedClientModules = []) {
 	const scriptEnd = html.indexOf("<\/script>", valueStart);
 	if (scriptEnd < 0) throw new Error("upstream DSH boot manifest script is incomplete");
 	const source = html.slice(valueStart, scriptEnd).trim().replace(/;$/u, "");
+	return Object.freeze({
+		...parseMobileBootGraph(source, excludedClientModules),
+		assignment: assignment[0],
+		replaceStart,
+		replaceEnd: scriptEnd
+	});
+}
+function parseMobileBootGraph(source, excludedClientModules) {
 	const parsed = JSON.parse(source);
 	if (typeof parsed.rev !== "string" || !Array.isArray(parsed.entries)) throw new Error("upstream DSH boot manifest is malformed");
 	const entries = parsed.entries;
@@ -4927,10 +5199,7 @@ function parseMobileBootPlan(html, excludedClientModules = []) {
 		return Object.freeze({
 			parsed,
 			entries,
-			slotProvider: dependencyProfile.slots,
-			assignment: assignment[0],
-			replaceStart,
-			replaceEnd: scriptEnd
+			slotProvider: dependencyProfile.slots
 		});
 	}
 	if (!Array.isArray(parsedBatches)) throw new Error("upstream DSH boot manifest batches are malformed");
@@ -4969,9 +5238,6 @@ function parseMobileBootPlan(html, excludedClientModules = []) {
 		entries,
 		batches,
 		slotProvider: dependencyProfile.slots,
-		assignment: assignment[0],
-		replaceStart,
-		replaceEnd: scriptEnd,
 		layoutBatch,
 		planEntries,
 		originalApplicationBatches,
@@ -5055,6 +5321,17 @@ function rewriteMobileApplicationPreloads(html, replacements) {
 }
 function rewriteMobileIndexWithBatch(html, options = {}) {
 	const plan = parseMobileBootPlan(html, options.excludedClientModules);
+	const projected = projectMobileBootGraph(plan, options);
+	const transportBootstrap = projected.graphTransport ? mobileAuthenticatedTransportBootstrap(options.viewId) : "";
+	const replacement = `${MOBILE_GATEWAY_REACHABILITY_BOOTSTRAP}${transportBootstrap}${mobileCsrfFetchBootstrap(options.csrfCookie ?? "dsh_ma_csrf")}window.__DSH_MOBILE_FRONTEND__="dedicated";${plan.assignment}${JSON.stringify(plan.parsed)};`;
+	const rewritten = `${html.slice(0, plan.replaceStart)}${replacement}${html.slice(plan.replaceEnd)}`;
+	return Object.freeze({
+		html: ensureMobileGatewayMarker(ensureMobileViewport(ensureMobileCompatibility(rewriteMobileApplicationPreloads(rewritten, projected.preloadReplacements)))),
+		batches: projected.batches,
+		graphTransport: projected.graphTransport
+	});
+}
+function projectMobileBootGraph(plan, options) {
 	const remoteSettings = orderAuthenticatedSettings(plan.entries, plan.slotProvider);
 	let batches = [];
 	let preloadReplacements = /* @__PURE__ */ new Map();
@@ -5080,11 +5357,10 @@ function rewriteMobileIndexWithBatch(html, options = {}) {
 			batches: plan.batches
 		})).digest("hex").slice(0, 16);
 	}
-	const replacement = `${MOBILE_GATEWAY_REACHABILITY_BOOTSTRAP}${remoteSettings ? MOBILE_AUTHENTICATED_TRANSPORT_BOOTSTRAP : ""}${mobileCsrfFetchBootstrap(options.csrfCookie ?? "dsh_ma_csrf")}window.__DSH_MOBILE_FRONTEND__="dedicated";${plan.assignment}${JSON.stringify(plan.parsed)};`;
-	const rewritten = `${html.slice(0, plan.replaceStart)}${replacement}${html.slice(plan.replaceEnd)}`;
 	return Object.freeze({
-		html: ensureMobileGatewayMarker(ensureMobileViewport(ensureMobileCompatibility(rewriteMobileApplicationPreloads(rewritten, preloadReplacements)))),
-		batches
+		batches,
+		preloadReplacements,
+		graphTransport: remoteSettings
 	});
 }
 /** Rewrite the dedicated mobile graph; exclusions are opt-in and leave stock DSH unchanged. */
@@ -5515,6 +5791,8 @@ var MobileAccessGateway = class {
 	activeRequests = /* @__PURE__ */ new Map();
 	activeWebSockets = /* @__PURE__ */ new Map();
 	mobileBootBatches = /* @__PURE__ */ new Map();
+	mobileDocumentViews = /* @__PURE__ */ new Map();
+	mobileGraphTasks = /* @__PURE__ */ new Set();
 	/** Cached upstream bundle byte sizes (HEAD probes), keyed by resource URL. */
 	bootEntrySizeCache = /* @__PURE__ */ new Map();
 	extensionEventListeners = /* @__PURE__ */ new Set();
@@ -5547,7 +5825,8 @@ var MobileAccessGateway = class {
 	clientModuleRevocations = /* @__PURE__ */ new Set();
 	authFailures;
 	httpFailures;
-	constructor(config, store, extensions, upstreamAuthenticatedUrl, extraWebSocketPaths, blockedUpgradeLog, onDiscoveryDegraded, clientModulePreferences, authFailureLog, httpFailureLog) {
+	upstreamAuthDiagnostics;
+	constructor(config, store, extensions, upstreamAuthenticatedUrl, extraWebSocketPaths, blockedUpgradeLog, onDiscoveryDegraded, clientModulePreferences, authFailureLog, httpFailureLog, upstreamAuthLog) {
 		this.config = config;
 		this.extensions = extensions;
 		this.upstreamAuthenticatedUrl = upstreamAuthenticatedUrl;
@@ -5556,6 +5835,7 @@ var MobileAccessGateway = class {
 		this.onDiscoveryDegraded = onDiscoveryDegraded;
 		this.authFailures = new AuthFailureRecorder(authFailureLog);
 		this.httpFailures = new HttpFailureRecorder(httpFailureLog);
+		this.upstreamAuthDiagnostics = new UpstreamAuthRecorder(upstreamAuthLog);
 		this.clientModulePreferences = clientModulePreferences ?? new ClientModulePreferenceStore(join(dirname(config.stateFile), `${basename(config.stateFile)}.client-modules.json`), config.excludedClientModules);
 		this.listenerTlsEnabled = config.tls.mode === "provided";
 		this.tlsEnabled = config.publicTls;
@@ -5578,6 +5858,7 @@ var MobileAccessGateway = class {
 		this.probeFailureLimiter = new BoundedRateLimiter(probeLimit, config.rateLimitWindowMs, config.maxRateLimitKeys);
 		this.probeDeviceLimiter = new BoundedRateLimiter(probeLimit, config.rateLimitWindowMs, config.maxDevices);
 		this.removeSessionListener = this.access.onSessionEnded((authorization, reason) => {
+			for (const view of this.mobileDocumentViews.values()) if (view.sessionKey === authorization.sessionKey) this.removeMobileDocumentView(view);
 			if (reason === "revoked") {
 				const cleanup = this.clientModulePreferences.removeDevice(authorization.deviceId).catch(() => {
 					process.emitWarning("Unable to remove revoked device client preferences", { code: "DSH_MOBILE_PREFERENCE_CLEANUP_FAILED" });
@@ -6209,6 +6490,8 @@ var MobileAccessGateway = class {
 			}
 			throw error;
 		}
+		const viewId = headerValue(request.headers, MOBILE_DOCUMENT_VIEW_HEADER);
+		const documentView = viewId === void 0 ? void 0 : this.requireMobileDocumentView(viewId, authorization, request);
 		if (isMutation) try {
 			this.requireCsrf(request, authorization);
 		} catch (error) {
@@ -6336,7 +6619,7 @@ var MobileAccessGateway = class {
 			return;
 		}
 		if (stockFrontend && target.decodedPathname === "/") request.url = "/";
-		await this.proxyHttp(request, response, authorization);
+		await this.proxyHttp(request, response, authorization, documentView);
 	}
 	async handleExtensionRequest(targetInfo, target, request, response, authorization) {
 		const extensions = this.extensions;
@@ -6568,16 +6851,23 @@ var MobileAccessGateway = class {
 		}
 	}
 	async exchangeUpstreamCookie() {
-		const authenticatedUrl = this.upstreamAuthenticatedUrl;
-		if (authenticatedUrl === void 0) throw new HttpError(502, "upstream_unavailable");
-		let target;
-		try {
-			target = new URL(authenticatedUrl);
-		} catch {
-			throw new HttpError(502, "upstream_unavailable");
-		}
-		if (target.origin !== this.config.upstreamOrigin.origin || target.pathname !== "/" || target.hash !== "" || target.search === "") throw new HttpError(502, "upstream_unavailable");
+		const attempt = this.upstreamAuthDiagnostics.begin();
+		let stage = "target";
+		let outcome = "invalid-target";
+		let status;
+		let timedOut = false;
 		try {
+			const authenticatedUrl = this.upstreamAuthenticatedUrl;
+			if (authenticatedUrl === void 0) throw new HttpError(502, "upstream_unavailable");
+			let target;
+			try {
+				target = new URL(authenticatedUrl);
+			} catch {
+				throw new HttpError(502, "upstream_unavailable");
+			}
+			if (target.origin !== this.config.upstreamOrigin.origin || target.pathname !== "/" || target.hash !== "" || target.search === "") throw new HttpError(502, "upstream_unavailable");
+			stage = "request";
+			outcome = "transport-error";
 			const proxied = await new Promise((resolve, reject) => {
 				const upstreamRequest = request({
 					protocol: "http:",
@@ -6595,27 +6885,46 @@ var MobileAccessGateway = class {
 				});
 				this.upstreamAuthRequest = upstreamRequest;
 				upstreamRequest.setTimeout(this.config.upstreamTimeoutMs, () => {
+					timedOut = true;
 					upstreamRequest.destroy(new HttpError(504, "upstream_timeout"));
 				});
 				upstreamRequest.once("response", resolve);
 				upstreamRequest.once("error", reject);
 				upstreamRequest.end();
 			});
+			stage = "response";
+			status = proxied.statusCode;
 			await new Promise((resolve, reject) => {
 				proxied.once("end", resolve);
 				proxied.once("error", reject);
 				proxied.resume();
 			});
+			if (status !== 303) {
+				outcome = "unexpected-status";
+				throw new HttpError(502, "upstream_unavailable");
+			}
+			stage = "cookie";
+			outcome = "invalid-cookie";
 			const setCookie = proxied.headers["set-cookie"]?.[0];
 			const pair = setCookie?.split(";", 1)[0];
 			const maxAgeText = setCookie === void 0 ? void 0 : /(?:^|;\s*)Max-Age=(\d+)(?:;|$)/iu.exec(setCookie)?.[1];
 			const maxAgeSeconds = maxAgeText === void 0 ? NaN : Number(maxAgeText);
 			const expiresAt = Date.now() + maxAgeSeconds * 1e3;
-			if (proxied.statusCode !== 303 || pair === void 0 || pair.length > 4096 || !UPSTREAM_COOKIE_PAIR.test(pair) || !Number.isSafeInteger(expiresAt) || maxAgeSeconds <= 0) throw new HttpError(502, "upstream_unavailable");
+			if (pair === void 0 || pair.length > 4096 || !UPSTREAM_COOKIE_PAIR.test(pair) || !Number.isSafeInteger(expiresAt) || maxAgeSeconds <= 0) throw new HttpError(502, "upstream_unavailable");
 			this.upstreamCookie = pair;
 			this.upstreamCookieExpiresAt = expiresAt;
+			this.upstreamAuthDiagnostics.record(attempt, {
+				outcome: "accepted",
+				stage,
+				status
+			});
 			return pair;
 		} catch (error) {
+			this.upstreamAuthDiagnostics.record(attempt, {
+				outcome: timedOut || error instanceof HttpError && error.status === 504 ? "timeout" : outcome,
+				stage,
+				...status === void 0 ? {} : { status }
+			});
 			if (error instanceof HttpError) throw error;
 			throw new HttpError(502, "upstream_unavailable");
 		} finally {
@@ -6789,11 +7098,15 @@ var MobileAccessGateway = class {
 					};
 					const cookies = browserAuthCookies(request.headers.cookie);
 					const csrfCookie = this.tlsEnabled && cookies.has("__Host-dsh_ma_session") ? HOST_CSRF_COOKIE : CSRF_COOKIE;
+					const viewId = randomBytes(16).toString("hex");
 					const rewritten = rewriteMobileIndexWithBatch(html, {
 						...options,
-						csrfCookie
+						csrfCookie,
+						viewId
 					});
+					operation.signal.throwIfAborted();
 					for (const batch of rewritten.batches) this.rememberMobileBootBatch(batch);
+					if (rewritten.graphTransport) this.rememberMobileDocumentView(viewId, authorization, excludedClientModules);
 					body = Buffer.from(rewritten.html);
 				} catch (error) {
 					if (error instanceof ExcludedClientModulesError) {
@@ -6845,6 +7158,53 @@ var MobileAccessGateway = class {
 			operation.release();
 		}
 	}
+	removeMobileDocumentView(view) {
+		if (this.mobileDocumentViews.get(view.id) !== view) return;
+		this.mobileDocumentViews.delete(view.id);
+		for (const abort of view.abortStreams) abort();
+		view.abortStreams.clear();
+	}
+	rememberMobileDocumentView(id, authorization, excluded) {
+		for (const view of this.mobileDocumentViews.values()) if (view.expiresAt <= Date.now()) this.removeMobileDocumentView(view);
+		const view = Object.freeze({
+			...authorization,
+			id,
+			excludedClientModules: Object.freeze([...excluded]),
+			abortStreams: /* @__PURE__ */ new Set()
+		});
+		this.mobileDocumentViews.set(id, view);
+		while (this.mobileDocumentViews.size > this.config.maxSessions) {
+			const oldest = this.mobileDocumentViews.values().next().value;
+			if (oldest === void 0) break;
+			this.removeMobileDocumentView(oldest);
+		}
+	}
+	requireMobileDocumentView(id, authorization, request) {
+		const view = /^[a-f0-9]{32}$/u.test(id) ? this.mobileDocumentViews.get(id) : void 0;
+		if (view === void 0 || view.expiresAt <= Date.now() || view.sessionKey !== authorization.sessionKey || view.deviceId !== authorization.deviceId || request.method !== "GET" || parseRequestTarget(request.url).decodedPathname !== "/plugins/events" || request.headers["transfer-encoding"] !== void 0 || request.headers["content-length"] !== void 0 && Number(request.headers["content-length"]) !== 0) throw new HttpError(409, "mobile_document_view_invalid");
+		return view;
+	}
+	async projectMobileDocumentEvent(view, value, signal) {
+		signal.throwIfAborted();
+		if (this.mobileDocumentViews.get(view.id) !== view) throw new HttpError(409, "mobile_document_view_invalid");
+		if (value === null || typeof value !== "object" || Array.isArray(value)) throw new HttpError(502, "upstream_unavailable");
+		const frame = value;
+		if (frame.type === "rebuilt") {
+			if (typeof frame.id !== "string" || typeof frame.rev !== "string") throw new HttpError(502, "upstream_unavailable");
+			return frame.id === MOBILE_LAYOUT_MODULE ? void 0 : frame;
+		}
+		if (frame.type !== "graph" || frame.graph === null || typeof frame.graph !== "object" || Array.isArray(frame.graph)) throw new HttpError(502, "upstream_unavailable");
+		const plan = parseMobileBootGraph(JSON.stringify(frame.graph), view.excludedClientModules);
+		const projected = projectMobileBootGraph(plan, plan.rewrittenBatchEntries === void 0 ? {} : await this.resolveMobileBootSizes(plan.rewrittenBatchEntries.flatMap((batch) => batch.entries), signal));
+		if (!projected.graphTransport) throw new HttpError(502, "upstream_unavailable");
+		signal.throwIfAborted();
+		if (this.mobileDocumentViews.get(view.id) !== view) throw new HttpError(409, "mobile_document_view_invalid");
+		for (const batch of projected.batches) this.rememberMobileBootBatch(batch);
+		return {
+			...frame,
+			graph: plan.parsed
+		};
+	}
 	rememberMobileBootBatch(plan) {
 		const existing = this.mobileBootBatches.get(plan.key);
 		this.mobileBootBatches.delete(plan.key);
@@ -6877,7 +7237,8 @@ var MobileAccessGateway = class {
 				else sizes.set(source, size);
 			}
 		};
-		await Promise.all(Array.from({ length: Math.min(8, candidates.length) }, worker));
+		const failed = (await Promise.allSettled(Array.from({ length: Math.min(8, candidates.length) }, worker))).find((result) => result.status === "rejected");
+		if (failed?.status === "rejected") throw failed.reason;
 		return {
 			sizes,
 			passThrough
@@ -6896,6 +7257,7 @@ var MobileAccessGateway = class {
 		const cached = this.bootEntrySizeCache.get(source);
 		if (cached !== void 0 && Date.now() - cached.at < MOBILE_BOOT_SIZE_CACHE_TTL_MS) return cached.size;
 		let upstreamRequest;
+		let upstreamClosed;
 		const abort = () => {
 			upstreamRequest?.destroy(requestAbortedError());
 		};
@@ -6919,6 +7281,12 @@ var MobileAccessGateway = class {
 					},
 					agent: false
 				});
+				const opened = upstreamRequest;
+				upstreamClosed = new Promise((closed) => {
+					opened.once("close", () => {
+						closed();
+					});
+				});
 				upstreamRequest.setTimeout(this.config.upstreamTimeoutMs, () => {
 					upstreamRequest?.destroy(upstreamTimeoutError());
 				});
@@ -6954,6 +7322,7 @@ var MobileAccessGateway = class {
 		} finally {
 			signal?.removeEventListener("abort", abort);
 			upstreamRequest?.destroy();
+			await upstreamClosed;
 		}
 	}
 	async serveMobileBootBatch(key, request, response, authorization) {
@@ -7152,14 +7521,15 @@ var MobileAccessGateway = class {
 	* One request slot and cancellation signal cover attempts and backoff together.
 	* API requests and requests with bodies are forwarded once.
 	*/
-	async proxyHttp(request, response, authorization) {
+	async proxyHttp(request, response, authorization, documentView) {
 		const declared = request.headers["content-length"];
 		if (declared !== void 0 && (!/^\d+$/u.test(declared) || Number(declared) > this.config.maxBodyBytes)) throw new HttpError(413, "payload_too_large");
 		const replayable = request.method === "GET" && request.headers["transfer-encoding"] === void 0 && (declared === void 0 || Number(declared) === 0) && (request.url?.split("?", 1)[0]?.startsWith("/plugins/") === true || request.url?.split("?", 1)[0]?.startsWith("/assets/") === true);
 		const holder = {};
 		const operation = this.allocateRequest(authorization, response, holder);
+		documentView?.abortStreams.add(operation.abort);
 		const onClose = () => {
-			operation.release();
+			if (documentView === void 0) operation.release();
 			operation.abort();
 		};
 		response.once("close", onClose);
@@ -7169,7 +7539,7 @@ var MobileAccessGateway = class {
 			for (let attempt = 1; attempt <= attempts; attempt++) {
 				operation.signal.throwIfAborted();
 				try {
-					await this.proxyHttpOnce(request, response, holder, operation.signal, replayable);
+					await this.proxyHttpOnce(request, response, holder, operation.signal, replayable, documentView);
 					return;
 				} catch (error) {
 					if (operation.signal.aborted || response.destroyed) return;
@@ -7186,13 +7556,18 @@ var MobileAccessGateway = class {
 			if (!operation.signal.aborted) throw error;
 		} finally {
 			response.removeListener("close", onClose);
+			documentView?.abortStreams.delete(operation.abort);
 			operation.release();
 		}
 	}
-	async proxyHttpOnce(request$2, response, holder, signal, replayable) {
+	async proxyHttpOnce(request$2, response, holder, signal, replayable, documentView) {
 		let bodyDone;
+		const projections = /* @__PURE__ */ new Set();
 		try {
+			const pathname = parseRequestTarget(request$2.url).decodedPathname;
 			const upstreamHeaders = sanitizeRequestHeaders(request$2, this.config.upstreamOrigin);
+			delete upstreamHeaders[MOBILE_DOCUMENT_VIEW_HEADER];
+			if (documentView !== void 0) upstreamHeaders["accept-encoding"] = "identity";
 			if (request$2.headers["transfer-encoding"] !== void 0) upstreamHeaders["transfer-encoding"] = request$2.headers["transfer-encoding"];
 			const upstreamCookie = await this.upstreamCookieHeader();
 			signal.throwIfAborted();
@@ -7211,7 +7586,6 @@ var MobileAccessGateway = class {
 				upstreamRequest.setTimeout(this.config.upstreamTimeoutMs, () => {
 					upstreamRequest.destroy(new HttpError(504, "upstream_timeout"));
 				});
-				const pathname = parseRequestTarget(request$2.url).decodedPathname;
 				if (pathname === "/api" || pathname.startsWith("/api/")) upstreamRequest.once("finish", () => {
 					upstreamRequest.setTimeout(this.config.upstreamApiTimeoutMs);
 				});
@@ -7223,13 +7597,28 @@ var MobileAccessGateway = class {
 					bodyDone.catch(reject);
 				}
 			});
+			const graphEvents = documentView !== void 0 && replayable && pathname === "/plugins/events" && proxied.statusCode === 200 && proxied.headers["content-type"]?.split(";", 1)[0]?.trim().toLowerCase() === "text/event-stream";
+			if (documentView !== void 0 && !graphEvents) {
+				proxied.destroy();
+				throw new HttpError(502, "upstream_unavailable");
+			}
+			if (graphEvents) holder.request?.setTimeout(this.config.upstreamApiTimeoutMs);
 			setSecurityHeaders(response, this.tlsEnabled, "proxied");
 			const headers = sanitizeResponseHeaders(proxied.headers, this.config.upstreamOrigin);
+			if (graphEvents) {
+				if (proxied.headers["content-encoding"] !== void 0 && proxied.headers["content-encoding"] !== "identity") throw new HttpError(502, "upstream_unavailable");
+				delete headers["content-length"];
+				delete headers["content-encoding"];
+				delete headers.etag;
+				delete headers["last-modified"];
+				delete headers["content-range"];
+				delete headers["accept-ranges"];
+			}
 			const statusCode = proxied.statusCode ?? 502;
 			this.httpFailures.recordUpstream(request$2.method, request$2.url?.split("?", 1)[0] ?? "", statusCode);
-			const cacheControl = revisionedStaticCacheControl(request$2, statusCode);
+			const cacheControl = graphEvents ? void 0 : revisionedStaticCacheControl(request$2, statusCode);
 			if (cacheControl !== void 0) headers["cache-control"] = cacheControl;
-			const compressible = canCompressResponse(request$2, proxied);
+			const compressible = !graphEvents && canCompressResponse(request$2, proxied);
 			const compressed = compressible && acceptsGzip(request$2.headers["accept-encoding"]);
 			if (compressible) addVaryAcceptEncoding(headers);
 			if (compressed) {
@@ -7250,7 +7639,18 @@ var MobileAccessGateway = class {
 				addVaryAcceptEncoding(headers);
 			}
 			response.writeHead(statusCode, headers);
-			await Promise.all([bodyDone, compressed && request$2.method !== "HEAD" ? pipeline(proxied, createGzip(), response) : pipeline(proxied, response)]);
+			const eventTransform = !graphEvents || documentView === void 0 ? void 0 : createMobileGraphEventTransform((value) => {
+				const task = this.projectMobileDocumentEvent(documentView, value, signal);
+				projections.add(task);
+				this.mobileGraphTasks.add(task);
+				const settled = () => {
+					projections.delete(task);
+					this.mobileGraphTasks.delete(task);
+				};
+				task.then(settled, settled);
+				return task;
+			});
+			await Promise.all([bodyDone, eventTransform !== void 0 ? pipeline(proxied, eventTransform, response) : compressed && request$2.method !== "HEAD" ? pipeline(proxied, createGzip(), response) : pipeline(proxied, response)]);
 		} catch (error) {
 			holder.request?.destroy();
 			await bodyDone?.catch(() => void 0);
@@ -7258,6 +7658,7 @@ var MobileAccessGateway = class {
 			if (response.headersSent) response.destroy();
 			throw error;
 		} finally {
+			await Promise.allSettled(projections);
 			delete holder.request;
 		}
 	}
@@ -7648,9 +8049,13 @@ var MobileAccessGateway = class {
 		this.upstreamAuthRequest = void 0;
 		this.removeSessionListener();
 		this.pendingDeviceRevocations.clear();
+		for (const view of this.mobileDocumentViews.values()) this.removeMobileDocumentView(view);
 		const accessClose = this.access.close();
 		for (const stored of this.mobileBootBatches.values()) stored.assembly?.controller.abort();
-		for (const request of this.activeRequests.values()) request.abort();
+		for (const request of this.activeRequests.values()) {
+			clearTimeout(request.timer);
+			request.abort();
+		}
 		for (const websocket of this.activeWebSockets.values()) {
 			websocket.client.destroy();
 			websocket.upstream.destroy();
@@ -7675,6 +8080,7 @@ var MobileAccessGateway = class {
 		await accessClose;
 		await Promise.allSettled(this.clientModuleTasks);
 		await Promise.allSettled(this.clientModuleRevocations);
+		await Promise.allSettled(this.mobileGraphTasks);
 		this.activeRequests.clear();
 		this.activeWebSockets.clear();
 		this.connectedSockets.clear();
@@ -11754,12 +12160,16 @@ const MIN_ORIGIN_LISTEN_PORT = 1024;
 const RESERVED_LAN_GATEWAY_PORT$1 = 3443;
 /** DSH's own WebServer port; the plugin cannot function while it is taken. */
 const RESERVED_DSH_WEB_PORT = 3080;
-const PRIVATE_NETWORKS = [
-	"10.0.0.0/8",
-	"172.16.0.0/12",
-	"192.168.0.0/16"
-].map(parseCidr);
-const TRUSTED_NETWORKS = [...PRIVATE_NETWORKS, parseCidr("127.0.0.0/8")];
+const TRUSTED_NETWORKS = [
+	...[
+		"10.0.0.0/8",
+		"172.16.0.0/12",
+		"192.168.0.0/16",
+		"fc00::/7"
+	].map(parseCidr),
+	parseCidr("127.0.0.0/8"),
+	parseCidr("::1/128")
+];
 /** Require a public HTTPS origin; custom external ports are supported. */
 function validateOriginPublicOrigin(value) {
 	if (typeof value !== "string" || value.length > 512 || /[\s\u0000-\u001f\u007f\\@?#]/u.test(value)) throw new Error("origin_public_origin_invalid");
@@ -11781,10 +12191,15 @@ function validateOriginPublicOrigin(value) {
 	if (url.protocol !== "https:" || url.pathname !== "/" || url.username !== "" || url.password !== "" || url.search !== "" || url.hash !== "" || url.port !== "" && Number(url.port) < 1 || (isIP(host) === 4 ? !isGloballyRoutableIpv4(host) : isIP(host) !== 0 || !validHostname)) throw new Error("origin_public_origin_invalid");
 	return url.origin;
 }
-/** Bind only one explicit loopback or RFC1918 IPv4 interface, never all interfaces. */
+/** Bind one explicit loopback, RFC1918 IPv4 or IPv6 ULA interface; zone IDs are unsupported. */
 function validateOriginListenHost(value) {
-	if (typeof value !== "string" || isIP(value) !== 4 || !isLoopbackAddress(value) && !addressAllowed(value, PRIVATE_NETWORKS)) throw new Error("origin_listen_host_invalid");
-	return value;
+	const addressFamily = isIP(value);
+	if (typeof value !== "string" || value.includes("%") || addressFamily === 0 || !addressAllowed(value, TRUSTED_NETWORKS.filter((range) => range.bits === (addressFamily === 6 ? 128 : 32)))) throw new Error("origin_listen_host_invalid");
+	return addressFamily === 6 ? new URL("http://[" + value + "]").hostname.slice(1, -1) : value;
+}
+/** Format a validated backend listener, including the brackets required by IPv6 URLs. */
+function formatOriginBackendOrigin(listenHost, listenPort) {
+	return "http://" + (isIP(listenHost) === 6 ? "[" + listenHost + "]" : listenHost) + ":" + String(listenPort);
 }
 function validateOriginListenPort(value) {
 	if (!Number.isSafeInteger(value) || Number(value) < MIN_ORIGIN_LISTEN_PORT || Number(value) > 65535) throw new Error("origin_listen_port_invalid");
@@ -11793,14 +12208,15 @@ function validateOriginListenPort(value) {
 }
 /** Authorize direct proxy socket peers, not untrusted forwarded client headers. */
 function validateOriginAllowedCidrs(value, listenHost) {
-	const input = value === void 0 && isLoopbackAddress(listenHost) ? ["127.0.0.0/8"] : value;
+	const addressFamily = isIP(listenHost);
+	const input = value === void 0 && isLoopbackAddress(listenHost) ? [addressFamily === 6 ? "::1/128" : "127.0.0.0/8"] : value;
 	if (!Array.isArray(input) || input.length === 0 || input.length > 16) throw new Error("origin_allowed_cidrs_invalid");
 	const cidrs = [];
 	for (const entry of input) {
-		if (typeof entry !== "string" || entry.length > 64 || isIP(entry.split("/")[0] ?? "") !== 4) throw new Error("origin_allowed_cidrs_invalid");
+		if (typeof entry !== "string" || entry.length > 64 || entry.includes("%") || isIP(entry.split("/")[0] ?? "") !== addressFamily) throw new Error("origin_allowed_cidrs_invalid");
 		try {
 			const cidr = parseCidr(entry);
-			if (cidr.bits !== 32 || !TRUSTED_NETWORKS.some((range) => cidr.prefix >= range.prefix && addressAllowed(entry.split("/")[0], [range]))) throw new Error("untrusted CIDR");
+			if (cidr.bits !== (addressFamily === 6 ? 128 : 32) || !TRUSTED_NETWORKS.some((range) => cidr.bits === range.bits && cidr.prefix >= range.prefix && addressAllowed(entry.split("/")[0], [range]))) throw new Error("untrusted CIDR");
 			cidrs.push(cidr.source);
 		} catch {
 			throw new Error("origin_allowed_cidrs_invalid");
@@ -11878,7 +12294,7 @@ var OriginConfigStore = class {
 				listenHost: settings.listenHost,
 				listenPort: settings.listenPort,
 				allowedCidrs: settings.allowedCidrs,
-				backendOrigin: "http://" + settings.listenHost + ":" + String(settings.listenPort)
+				backendOrigin: formatOriginBackendOrigin(settings.listenHost, settings.listenPort)
 			},
 			storagePath: this.stateRoot,
 			...this.errorCode === void 0 ? {} : { errorCode: this.errorCode }
@@ -12038,7 +12454,7 @@ var OriginController = class {
 			enabled: true,
 			state: "ready",
 			origin: settings.publicOrigin,
-			backendOrigin: "http://" + settings.listenHost + ":" + String(gateway.address().port)
+			backendOrigin: formatOriginBackendOrigin(settings.listenHost, gateway.address().port)
 		});
 	}
 	async stop() {
@@ -17737,6 +18153,8 @@ async function apply(ctx, config) {
 			logger.warn("auth failure %s", JSON.stringify(entry));
 		}, (entry) => {
 			logger.warn("http failure %s", JSON.stringify(entry));
+		}, (entry) => {
+			logger.info("upstream auth %s", JSON.stringify(entry));
 		});
 		await candidate.start();
 		lanGateway = candidate;
@@ -17797,6 +18215,8 @@ async function apply(ctx, config) {
 			logger.warn("auth failure %s", JSON.stringify(entry));
 		}, (entry) => {
 			logger.warn("http failure %s", JSON.stringify(entry));
+		}, (entry) => {
+			logger.info("upstream auth %s", JSON.stringify(entry));
 		});
 		await candidate.start();
 		return candidate;
@@ -17817,6 +18237,8 @@ async function apply(ctx, config) {
 			logger.warn("auth failure %s", JSON.stringify(entry));
 		}, (entry) => {
 			logger.warn("http failure %s", JSON.stringify(entry));
+		}, (entry) => {
+			logger.info("upstream auth %s", JSON.stringify(entry));
 		});
 		try {
 			await candidate.start();
@@ -17832,6 +18254,8 @@ async function apply(ctx, config) {
 			logger.warn("auth failure %s", JSON.stringify(entry));
 		}, (entry) => {
 			logger.warn("http failure %s", JSON.stringify(entry));
+		}, (entry) => {
+			logger.info("upstream auth %s", JSON.stringify(entry));
 		});
 		try {
 			await candidate.start();