dsh-mobile 0.6.14 → 0.6.16

package/lib/index.d.mts

@@ -370,7 +370,7 @@ interface PluginConfig {
   maxBodyBytes?: number;
   /** Transport, upload, static-response and WebSocket-handshake idle timeout. */
   upstreamTimeoutMs?: number;
-  /** Authenticated /api response idle timeout after upload; zero disables it. */
+  /** Authenticated /api response and established DSH plugin-event stream idle timeout; zero disables it. */
   upstreamApiTimeoutMs?: number;
   rateLimitWindowMs?: number;
   maxPairingAttempts?: number;
@@ -394,6 +394,8 @@ interface ResolvedGatewayConfig {
   readonly excludedClientModules: readonly string[];
   readonly websocketCompression: ResolvedWebSocketCompressionConfig;
   readonly instanceId: string;
+  /** Plugin-wide installation identity, disclosed only after native authentication. */
+  readonly installationId?: string;
   /** Identity returned only for authenticated legacy native credentials without a stored binding. */
   readonly legacyInstanceId?: string;
   readonly pairingCaFile?: string;
@@ -567,6 +569,21 @@ type HttpFailureEntry = ({
   readonly suppressed?: number;
 };
 //#endregion
+//#region src/upstream-auth-log.d.ts
+/** Fixed outcomes of the Gateway's private DSH launch-token exchange. */
+type UpstreamAuthOutcome = 'accepted' | 'invalid-target' | 'unexpected-status' | 'invalid-cookie' | 'timeout' | 'transport-error';
+/** Exchange metadata only: no URL, header, Cookie, Token or raw error is retained. */
+interface UpstreamAuthEntry {
+  readonly sequence: number;
+  readonly outcome: UpstreamAuthOutcome;
+  readonly stage: 'target' | 'request' | 'response' | 'cookie';
+  readonly durationMs: number;
+  /** Upstream HTTP status after headers arrive, not the phone-facing failure status. */
+  readonly status?: number;
+  /** Earlier exchanges with the same success/failure category omitted by sampling. */
+  readonly suppressed?: number;
+}
+//#endregion
 //#region src/http-security.d.ts
 export declare const DEVICE_COOKIE = "dsh_ma_device";
 export declare const SESSION_COOKIE = "dsh_ma_session";
@@ -998,6 +1015,8 @@ export declare class MobileAccessGateway {
   private readonly activeRequests;
   private readonly activeWebSockets;
   private readonly mobileBootBatches;
+  private readonly mobileDocumentViews;
+  private readonly mobileGraphTasks;
   /** Cached upstream bundle byte sizes (HEAD probes), keyed by resource URL. */
   private readonly bootEntrySizeCache;
   private readonly extensionEventListeners;
@@ -1030,9 +1049,10 @@ export declare class MobileAccessGateway {
   private readonly clientModuleRevocations;
   private readonly authFailures;
   private readonly httpFailures;
+  private readonly upstreamAuthDiagnostics;
   constructor(config: ResolvedGatewayConfig, store: DeviceStore, extensions?: MobileAccessService | undefined, upstreamAuthenticatedUrl?: string | undefined, extraWebSocketPaths?: {
     has(pathname: string): boolean;
-  } | undefined, blockedUpgradeLog?: BlockedUpgradePathLog | undefined, onDiscoveryDegraded?: ((source: 'broadcast' | 'mdns', code: string) => void) | undefined, clientModulePreferences?: ClientModulePreferenceStore, authFailureLog?: (entry: AuthFailureEntry) => void, httpFailureLog?: (entry: HttpFailureEntry) => void);
+  } | undefined, blockedUpgradeLog?: BlockedUpgradePathLog | undefined, onDiscoveryDegraded?: ((source: 'broadcast' | 'mdns', code: string) => void) | undefined, clientModulePreferences?: ClientModulePreferenceStore, authFailureLog?: (entry: AuthFailureEntry) => void, httpFailureLog?: (entry: HttpFailureEntry) => void, upstreamAuthLog?: (entry: UpstreamAuthEntry) => void);
   /** Initialize durable state, validate TLS, and bind the externally reachable listener. */
   start(): Promise<void>;
   /** Install a newly signed provided leaf for future TLS handshakes without dropping sessions. */
@@ -1075,6 +1095,8 @@ export declare class MobileAccessGateway {
   private handleRenew;
   /** CA-backed entries retain their pin; public entries project the authenticated credential's identity. */
   private nativeResponseInstanceId;
+  /** Older Apps require exact wire keys; expose this hint only to explicit opt-in clients after authentication. */
+  private nativeResponseInstallationIdentity;
   private handleNativePair;
   private handleNativeRenew;
   private handleNativeProbe;
@@ -1107,6 +1129,10 @@ export declare class MobileAccessGateway {
   private clientModulePreferenceOperation;
   private fetchAuthenticatedUpstreamIndex;
   private proxyMobileIndex;
+  private removeMobileDocumentView;
+  private rememberMobileDocumentView;
+  private requireMobileDocumentView;
+  private projectMobileDocumentEvent;
   private rememberMobileBootBatch;
   /**
    * Determine which layout-batch entries can share a merged boot batch and which