dsh-mobile 0.6.14 → 0.6.16

package/lib/index.mjs

@@ -17,6 +17,7 @@ import { promisify } from "node:util";
 import { createGzip, gzip } from "node:zlib";
 import Bonjour from "bonjour-service";
 import * as QRCode from "qrcode";
+import { createParser } from "eventsource-parser";
 import WebSocket, { WebSocketServer } from "ws";
 import { Logger, Service } from "@deepseek-ai/cordis";
 import { Worker } from "node:worker_threads";
@@ -1810,6 +1811,7 @@ function setSecurityHeaders(response, tls, framing = "gateway") {
 		"font-src 'self' data:",
 		"connect-src 'self'",
 		"worker-src 'self' blob:",
+		...proxied ? ["media-src 'self' blob:"] : [],
 		...proxied ? [PROXIED_FRAME_SRC] : []
 	].join("; "));
 	const microphone = proxied ? "microphone=(self)" : "microphone=()";
@@ -1899,6 +1901,7 @@ function assertLocalAdminTrust(request, requireBrowserOrigin, authenticateDeskto
 	if (request.socket.remoteAddress === void 0 || !isLoopbackAddress(request.socket.remoteAddress)) throw new HttpError(403, "forbidden");
 	const host = localAuthority(request.headers.host);
 	if (host === void 0 || !isLocalAdminHostname(host.hostname)) throw new HttpError(403, "forbidden");
+	if (request.method === "OPTIONS") throw new HttpError(403, "forbidden");
 	const site = request.headers["sec-fetch-site"];
 	if (site !== void 0 && site !== "same-origin" && site !== "none") throw new HttpError(403, "forbidden");
 	const origin = request.headers.origin;
@@ -1910,7 +1913,9 @@ function assertLocalAdminTrust(request, requireBrowserOrigin, authenticateDeskto
 		throw new HttpError(403, "forbidden");
 	}
 	const desktopForward = site === void 0 && request.headers["x-dsh-mobile-desktop-admin"] === "dsh-app://app";
-	if (requireBrowserOrigin && origin === void 0 && !(desktopForward && authenticateDesktop())) throw new HttpError(403, "forbidden");
+	const contentType = request.headers["content-type"];
+	const webRequest = request.method === "POST" && (site === void 0 || site === "same-origin") && request.headers["x-dsh-mobile-web-admin"] === "same-origin-json" && request.headers["x-dsh-mobile-desktop-admin"] === void 0 && typeof contentType === "string" && contentType.split(";", 1)[0]?.trim().toLowerCase() === "application/json";
+	if (requireBrowserOrigin && origin === void 0 && !webRequest && !(desktopForward && authenticateDesktop())) throw new HttpError(403, "forbidden");
 	if (requireBrowserOrigin && site !== void 0 && site !== "same-origin") throw new HttpError(403, "forbidden");
 }
 //#endregion
@@ -1968,7 +1973,7 @@ function authenticatedCookie(values, authenticate, accepts = () => true) {
 }
 //#endregion
 //#region src/auth-failure-log.ts
-const LOG_INTERVAL_MS$1 = 3e4;
+const LOG_INTERVAL_MS$2 = 3e4;
 const MAX_LOGGED_ORIGIN_LENGTH = 512;
 function requestPathCategory(path) {
 	switch (path) {
@@ -2065,7 +2070,7 @@ var AuthFailureRecorder = class {
 			return;
 		}
 		const suppressed = window.suppressed;
-		window.nextLogAt = now + LOG_INTERVAL_MS$1;
+		window.nextLogAt = now + LOG_INTERVAL_MS$2;
 		window.suppressed = 0;
 		try {
 			this.observe({
@@ -2119,7 +2124,7 @@ function classifyHttpParserFailure(nodeCode) {
 		parserCode
 	};
 }
-const LOG_INTERVAL_MS = 3e4;
+const LOG_INTERVAL_MS$1 = 3e4;
 /**
 * Per-Gateway diagnostics with three fixed sampling slots and no timers or request-selected keys.
 * Each kind records once immediately, then at most once per 30 seconds with suppressed counts.
@@ -2188,7 +2193,7 @@ var HttpFailureRecorder = class {
 			return;
 		}
 		const suppressed = window.suppressed;
-		window.nextLogAt = now + LOG_INTERVAL_MS;
+		window.nextLogAt = now + LOG_INTERVAL_MS$1;
 		window.suppressed = 0;
 		try {
 			this.observe({
@@ -2205,6 +2210,72 @@ var HttpFailureRecorder = class {
 	}
 };
 //#endregion
+//#region src/upstream-auth-log.ts
+const LOG_INTERVAL_MS = 3e4;
+/** Two fixed sampling slots keep a first failure visible even after a successful exchange. */
+var UpstreamAuthRecorder = class {
+	observe;
+	now;
+	reportObserverFailure;
+	sequence = 0;
+	windows = {
+		success: {
+			nextLogAt: 0,
+			suppressed: 0
+		},
+		failure: {
+			nextLogAt: 0,
+			suppressed: 0
+		}
+	};
+	observerFailureReported = false;
+	constructor(observe, now = () => performance.now(), reportObserverFailure = () => {
+		process.emitWarning("Mobile access upstream authentication diagnostics could not be recorded", { code: "DSH_MOBILE_UPSTREAM_AUTH_LOG_FAILED" });
+	}) {
+		this.observe = observe;
+		this.now = now;
+		this.reportObserverFailure = reportObserverFailure;
+	}
+	/** Begin only a physical exchange, not every consumer sharing its promise or cached Cookie. */
+	begin() {
+		if (this.observe === void 0) return void 0;
+		this.sequence = this.sequence >= Number.MAX_SAFE_INTEGER ? 1 : this.sequence + 1;
+		return {
+			sequence: this.sequence,
+			startedAt: this.now()
+		};
+	}
+	/** Record the completed exchange without changing authentication, retrying it or retaining its inputs. */
+	record(attempt, result) {
+		if (attempt === void 0 || this.observe === void 0) return;
+		const now = this.now();
+		const window = this.windows[result.outcome === "accepted" ? "success" : "failure"];
+		if (now < window.nextLogAt) {
+			window.suppressed = Math.min(Number.MAX_SAFE_INTEGER, window.suppressed + 1);
+			return;
+		}
+		const suppressed = window.suppressed;
+		window.nextLogAt = now + LOG_INTERVAL_MS;
+		window.suppressed = 0;
+		try {
+			this.observe({
+				sequence: attempt.sequence,
+				outcome: result.outcome,
+				stage: result.stage,
+				durationMs: Math.max(0, Math.floor(now - attempt.startedAt)),
+				...result.status === void 0 ? {} : { status: result.status },
+				...suppressed === 0 ? {} : { suppressed }
+			});
+		} catch (observerError) {
+			if (this.observerFailureReported) return;
+			this.observerFailureReported = true;
+			try {
+				this.reportObserverFailure();
+			} catch (reporterError) {}
+		}
+	}
+};
+//#endregion
 //#region src/client-module-recovery.ts
 const CLIENT_MODULE_RECOVERY_COPY = {
 	zh: {
@@ -2384,6 +2455,196 @@ function weakenEntityTag(etag) {
 	return opaque === void 0 ? void 0 : `W/${opaque}`;
 }
 //#endregion
+//#region src/mobile-graph-events.ts
+/** Bounded SSE framing for the dedicated Mobile client graph stream. */
+/** Maximum retained UTF-8 frame/output bytes, with CRLF normalized to LF. */
+const MOBILE_GRAPH_EVENT_MAX_BYTES = 4194304;
+const LINE_FEED = Buffer.from("\n");
+/** Fixed failures contain neither an upstream payload nor a projection exception. */
+var MobileGraphEventError = class extends Error {
+	code;
+	constructor(code) {
+		super(`Mobile graph event stream: ${code}`);
+		this.code = code;
+		this.name = "MobileGraphEventError";
+	}
+};
+var MobileGraphEventTransform = class extends Transform {
+	project;
+	frame = Buffer.allocUnsafe(16384);
+	used = 0;
+	lineBytes = 0;
+	skipLf = false;
+	firstFrame = true;
+	disposed = false;
+	readWait;
+	constructor(project) {
+		super();
+		this.project = project;
+	}
+	_transform(chunk, _encoding, callback) {
+		this.consume(chunk).then(() => callback(), (error) => callback(error));
+	}
+	_read(size) {
+		super._read(size);
+		const waiting = this.readWait;
+		this.readWait = void 0;
+		waiting?.resolve();
+	}
+	_flush(callback) {
+		if (this.used !== 0) {
+			try {
+				this.decodeFrame();
+			} catch {
+				callback(new MobileGraphEventError("invalid_utf8"));
+				return;
+			}
+			callback(new MobileGraphEventError("incomplete_frame"));
+			return;
+		}
+		callback();
+	}
+	_destroy(error, callback) {
+		this.disposed = true;
+		const waiting = this.readWait;
+		this.readWait = void 0;
+		waiting?.reject(error ?? new MobileGraphEventError("stream_closed"));
+		this.frame = Buffer.alloc(0);
+		this.used = 0;
+		callback(error);
+	}
+	requireOpen() {
+		if (this.disposed || this.destroyed) throw new MobileGraphEventError("stream_closed");
+	}
+	append(bytes) {
+		const required = this.used + bytes.length;
+		if (required > 4194304) throw new MobileGraphEventError("frame_too_large");
+		if (required > this.frame.length) {
+			const next = Buffer.allocUnsafe(Math.min(MOBILE_GRAPH_EVENT_MAX_BYTES, Math.max(required, this.frame.length * 2)));
+			this.frame.copy(next, 0, 0, this.used);
+			this.frame = next;
+		}
+		bytes.copy(this.frame, this.used);
+		this.used = required;
+	}
+	async consume(chunk) {
+		let offset = 0;
+		while (offset < chunk.length) {
+			this.requireOpen();
+			if (this.skipLf) {
+				this.skipLf = false;
+				if (chunk[offset] === 10) {
+					offset += 1;
+					continue;
+				}
+			}
+			let contentEnd = offset;
+			while (contentEnd < chunk.length && chunk[contentEnd] !== 13 && chunk[contentEnd] !== 10) contentEnd += 1;
+			const content = chunk.subarray(offset, contentEnd);
+			this.append(content);
+			this.lineBytes += content.length;
+			if (contentEnd === chunk.length) return;
+			this.append(LINE_FEED);
+			this.skipLf = chunk[contentEnd] === 13;
+			const emptyLine = this.lineBytes === 0;
+			this.lineBytes = 0;
+			offset = contentEnd + 1;
+			if (emptyLine) await this.completeFrame();
+		}
+	}
+	decodeFrame() {
+		try {
+			return new TextDecoder("utf-8", {
+				fatal: true,
+				ignoreBOM: true
+			}).decode(this.frame.subarray(0, this.used));
+		} catch {
+			throw new MobileGraphEventError("invalid_utf8");
+		}
+	}
+	async completeFrame() {
+		let text = this.decodeFrame();
+		this.used = 0;
+		if (this.firstFrame) {
+			this.firstFrame = false;
+			if (text.startsWith("")) text = text.slice(1);
+		}
+		let event;
+		createParser({
+			maxBufferSize: MOBILE_GRAPH_EVENT_MAX_BYTES,
+			onEvent: (value) => {
+				event = value;
+			},
+			onError: () => {
+				throw new MobileGraphEventError("invalid_sse");
+			}
+		}).feed(text);
+		const lines = text.split("\n");
+		for (const line of lines) {
+			if (!line.startsWith("event:")) continue;
+			const type = line.slice(line[6] === " " ? 7 : 6);
+			if (type !== "" && type !== "message") throw new MobileGraphEventError("unsupported_event");
+		}
+		if (event === void 0) {
+			await this.forward(Buffer.from(text, "utf8"));
+			return;
+		}
+		if (event.event !== void 0 && event.event !== "message") throw new MobileGraphEventError("unsupported_event");
+		let value;
+		try {
+			value = JSON.parse(event.data);
+		} catch {
+			throw new MobileGraphEventError("invalid_json");
+		}
+		let projected;
+		try {
+			projected = await this.project(value);
+		} catch {
+			throw new MobileGraphEventError("projection_failed");
+		}
+		this.requireOpen();
+		if (projected === void 0) return;
+		let encoded;
+		try {
+			encoded = JSON.stringify(projected);
+		} catch {
+			throw new MobileGraphEventError("invalid_projection");
+		}
+		if (encoded === void 0) throw new MobileGraphEventError("invalid_projection");
+		const metadata = lines.filter((line) => line !== "" && line !== "data" && !line.startsWith("data:"));
+		const result = `${metadata.length === 0 ? "" : `${metadata.join("\n")}\n`}data: ${encoded}\n\n`;
+		if (Buffer.byteLength(result) > 4194304) throw new MobileGraphEventError("frame_too_large");
+		await this.forward(Buffer.from(result, "utf8"));
+	}
+	async forward(frame) {
+		this.requireOpen();
+		if (frame.length === 0 || this.push(frame)) return;
+		await new Promise((resolve, reject) => {
+			this.readWait = {
+				resolve,
+				reject
+			};
+			if (this.destroyed || this.disposed) {
+				this.readWait = void 0;
+				reject(new MobileGraphEventError("stream_closed"));
+			} else if (this.readableLength < this.readableHighWaterMark) {
+				this.readWait = void 0;
+				resolve();
+			}
+		});
+	}
+};
+/**
+* Project each complete JSON message serially without forwarding unprojected data.
+* Comments and valid SSE metadata are retained; only the default message event is supported.
+* Undefined suppresses that message. Malformed, oversized or truncated input terminates the stream.
+* @param project - Projects one message; caller-owned cancellation must stop any external work.
+* @returns A byte-mode Transform that honors downstream backpressure and fences late results after destroy.
+*/
+function createMobileGraphEventTransform(project) {
+	return new MobileGraphEventTransform(project);
+}
+//#endregion
 //#region src/websocket-compression.ts
 function payloadBytes(data) {
 	if (Array.isArray(data)) return data.reduce((bytes, part) => bytes + part.byteLength, 0);
@@ -4650,6 +4911,26 @@ function renderLoginScript(locale) {
 `;
 }
 //#endregion
+//#region src/browser-ui-locale.ts
+const UI_LOCALE_COOKIE = "dsh_ma_ui_locale";
+/** Read presentation data only; malformed or ambiguous cookies keep browser negotiation. */
+function readBrowserUiLocale(cookieHeader) {
+	if (cookieHeader === void 0 || cookieHeader.length > 8192) return void 0;
+	let locale;
+	for (const part of cookieHeader.split(";")) {
+		const separator = part.indexOf("=");
+		if ((separator === -1 ? part : part.slice(0, separator)).trim() !== UI_LOCALE_COOKIE) continue;
+		const value = separator === -1 ? "" : part.slice(separator + 1).trim();
+		if (locale !== void 0 || value !== "en" && value !== "zh" && value !== "it") return void 0;
+		locale = value;
+	}
+	return locale;
+}
+/** Prefer the last DSH display language over the browser's default language. */
+function resolveBrowserUiLocale(cookieHeader, acceptLanguage) {
+	return readBrowserUiLocale(cookieHeader) ?? resolveAuthPageLocale(acceptLanguage);
+}
+//#endregion
 //#region src/gateway.ts
 const MAX_CONTROL_BODY_BYTES = 16384;
 const MAX_HEADER_BYTES = 16384;
@@ -4660,6 +4941,7 @@ const MDNS_SERVICE_TYPE = "dsh-mobile";
 const MOBILE_LAYOUT_MODULE = "@deepseek-ai/dsh-client-ui-layout";
 const MOBILE_LAYOUT_PATH = `${AUTH_PREFIX}/mobile-layout.js`;
 const MOBILE_BOOT_BATCH_PREFIX = `${AUTH_PREFIX}/mobile-boot/`;
+const MOBILE_DOCUMENT_VIEW_HEADER = "x-dsh-mobile-view";
 const MAX_MOBILE_BOOT_BATCH_BYTES = 33554432;
 const MAX_MOBILE_BOOT_ENTRY_BYTES = 8388608;
 /**
@@ -4741,7 +5023,9 @@ const MOBILE_LAYOUT_DEPENDENCY_PROFILES = Object.freeze([Object.freeze({
 function mobileCsrfFetchBootstrap(cookieName) {
 	return `(()=>{const nativeFetch=window.fetch.bind(window);window.fetch=(input,init)=>{const source=input instanceof Request?input:undefined;const method=String(init?.method??source?.method??'GET').toUpperCase();if(method==='GET'||method==='HEAD')return nativeFetch(input,init);const raw=typeof input==='string'?input:input instanceof URL?input.href:source?.url;if(raw===undefined||new URL(raw,location.href).origin!==location.origin)return nativeFetch(input,init);const headers=new Headers(init?.headers??source?.headers);if(!headers.has(${JSON.stringify(CSRF_HEADER)})){const prefix=${JSON.stringify(`${cookieName}=`)};const values=[...new Set(document.cookie.split(';').map(value=>value.trim()).filter(value=>value.startsWith(prefix)).map(value=>value.slice(prefix.length)))];if(values.length===1)headers.set(${JSON.stringify(CSRF_HEADER)},values[0])}return nativeFetch(input,{...init,headers})};})();`;
 }
-const MOBILE_AUTHENTICATED_TRANSPORT_BOOTSTRAP = `(()=>{if(window.__DSH_TRANSPORT__!==undefined)throw new Error('DSH Mobile cannot replace an existing transport override');window.__DSH_TRANSPORT__={fetch:(input,init)=>window.fetch(input,init),ownsHost:true},window.__DSH_FILE_UPLOAD__={fetch:(input,init)=>window.fetch(input,init)}})();`;
+function mobileAuthenticatedTransportBootstrap(viewId) {
+	return `(()=>{if(window.__DSH_TRANSPORT__!==undefined)throw new Error('DSH Mobile cannot replace an existing transport override');window.__DSH_TRANSPORT__={fetch:${viewId === void 0 ? "(input,init)=>window.fetch(input,init)" : `(input,init)=>{const source=input instanceof Request?input:undefined;const method=String(init?.method??source?.method??'GET').toUpperCase();const raw=typeof input==='string'?input:input instanceof URL?input.href:source?.url;if(raw!==undefined&&method==='GET'){const target=new URL(raw,location.href);if(target.origin===location.origin&&target.pathname==='/plugins/events'){const headers=new Headers(init?.headers??source?.headers);headers.set(${JSON.stringify(MOBILE_DOCUMENT_VIEW_HEADER)},${JSON.stringify(viewId)});return window.fetch(input,{...init,headers})}}return window.fetch(input,init)}`},ownsHost:true},window.__DSH_FILE_UPLOAD__={fetch:(input,init)=>window.fetch(input,init)}})();`;
+}
 /** Use this page's gateway health, rather than OS internet validation, for DSH reconnects. */
 const MOBILE_GATEWAY_REACHABILITY_BOOTSTRAP = `(()=>{
   const view=globalThis;
@@ -4911,6 +5195,14 @@ function parseMobileBootPlan(html, excludedClientModules = []) {
 	const scriptEnd = html.indexOf("<\/script>", valueStart);
 	if (scriptEnd < 0) throw new Error("upstream DSH boot manifest script is incomplete");
 	const source = html.slice(valueStart, scriptEnd).trim().replace(/;$/u, "");
+	return Object.freeze({
+		...parseMobileBootGraph(source, excludedClientModules),
+		assignment: assignment[0],
+		replaceStart,
+		replaceEnd: scriptEnd
+	});
+}
+function parseMobileBootGraph(source, excludedClientModules) {
 	const parsed = JSON.parse(source);
 	if (typeof parsed.rev !== "string" || !Array.isArray(parsed.entries)) throw new Error("upstream DSH boot manifest is malformed");
 	const entries = parsed.entries;
@@ -4927,10 +5219,7 @@ function parseMobileBootPlan(html, excludedClientModules = []) {
 		return Object.freeze({
 			parsed,
 			entries,
-			slotProvider: dependencyProfile.slots,
-			assignment: assignment[0],
-			replaceStart,
-			replaceEnd: scriptEnd
+			slotProvider: dependencyProfile.slots
 		});
 	}
 	if (!Array.isArray(parsedBatches)) throw new Error("upstream DSH boot manifest batches are malformed");
@@ -4969,9 +5258,6 @@ function parseMobileBootPlan(html, excludedClientModules = []) {
 		entries,
 		batches,
 		slotProvider: dependencyProfile.slots,
-		assignment: assignment[0],
-		replaceStart,
-		replaceEnd: scriptEnd,
 		layoutBatch,
 		planEntries,
 		originalApplicationBatches,
@@ -5055,6 +5341,17 @@ function rewriteMobileApplicationPreloads(html, replacements) {
 }
 function rewriteMobileIndexWithBatch(html, options = {}) {
 	const plan = parseMobileBootPlan(html, options.excludedClientModules);
+	const projected = projectMobileBootGraph(plan, options);
+	const transportBootstrap = projected.graphTransport ? mobileAuthenticatedTransportBootstrap(options.viewId) : "";
+	const replacement = `${MOBILE_GATEWAY_REACHABILITY_BOOTSTRAP}${transportBootstrap}${mobileCsrfFetchBootstrap(options.csrfCookie ?? "dsh_ma_csrf")}window.__DSH_MOBILE_FRONTEND__="dedicated";${plan.assignment}${JSON.stringify(plan.parsed)};`;
+	const rewritten = `${html.slice(0, plan.replaceStart)}${replacement}${html.slice(plan.replaceEnd)}`;
+	return Object.freeze({
+		html: ensureMobileGatewayMarker(ensureMobileViewport(ensureMobileCompatibility(rewriteMobileApplicationPreloads(rewritten, projected.preloadReplacements)))),
+		batches: projected.batches,
+		graphTransport: projected.graphTransport
+	});
+}
+function projectMobileBootGraph(plan, options) {
 	const remoteSettings = orderAuthenticatedSettings(plan.entries, plan.slotProvider);
 	let batches = [];
 	let preloadReplacements = /* @__PURE__ */ new Map();
@@ -5080,11 +5377,10 @@ function rewriteMobileIndexWithBatch(html, options = {}) {
 			batches: plan.batches
 		})).digest("hex").slice(0, 16);
 	}
-	const replacement = `${MOBILE_GATEWAY_REACHABILITY_BOOTSTRAP}${remoteSettings ? MOBILE_AUTHENTICATED_TRANSPORT_BOOTSTRAP : ""}${mobileCsrfFetchBootstrap(options.csrfCookie ?? "dsh_ma_csrf")}window.__DSH_MOBILE_FRONTEND__="dedicated";${plan.assignment}${JSON.stringify(plan.parsed)};`;
-	const rewritten = `${html.slice(0, plan.replaceStart)}${replacement}${html.slice(plan.replaceEnd)}`;
 	return Object.freeze({
-		html: ensureMobileGatewayMarker(ensureMobileViewport(ensureMobileCompatibility(rewriteMobileApplicationPreloads(rewritten, preloadReplacements)))),
-		batches
+		batches,
+		preloadReplacements,
+		graphTransport: remoteSettings
 	});
 }
 /** Rewrite the dedicated mobile graph; exclusions are opt-in and leave stock DSH unchanged. */
@@ -5515,6 +5811,8 @@ var MobileAccessGateway = class {
 	activeRequests = /* @__PURE__ */ new Map();
 	activeWebSockets = /* @__PURE__ */ new Map();
 	mobileBootBatches = /* @__PURE__ */ new Map();
+	mobileDocumentViews = /* @__PURE__ */ new Map();
+	mobileGraphTasks = /* @__PURE__ */ new Set();
 	/** Cached upstream bundle byte sizes (HEAD probes), keyed by resource URL. */
 	bootEntrySizeCache = /* @__PURE__ */ new Map();
 	extensionEventListeners = /* @__PURE__ */ new Set();
@@ -5547,7 +5845,8 @@ var MobileAccessGateway = class {
 	clientModuleRevocations = /* @__PURE__ */ new Set();
 	authFailures;
 	httpFailures;
-	constructor(config, store, extensions, upstreamAuthenticatedUrl, extraWebSocketPaths, blockedUpgradeLog, onDiscoveryDegraded, clientModulePreferences, authFailureLog, httpFailureLog) {
+	upstreamAuthDiagnostics;
+	constructor(config, store, extensions, upstreamAuthenticatedUrl, extraWebSocketPaths, blockedUpgradeLog, onDiscoveryDegraded, clientModulePreferences, authFailureLog, httpFailureLog, upstreamAuthLog) {
 		this.config = config;
 		this.extensions = extensions;
 		this.upstreamAuthenticatedUrl = upstreamAuthenticatedUrl;
@@ -5556,6 +5855,7 @@ var MobileAccessGateway = class {
 		this.onDiscoveryDegraded = onDiscoveryDegraded;
 		this.authFailures = new AuthFailureRecorder(authFailureLog);
 		this.httpFailures = new HttpFailureRecorder(httpFailureLog);
+		this.upstreamAuthDiagnostics = new UpstreamAuthRecorder(upstreamAuthLog);
 		this.clientModulePreferences = clientModulePreferences ?? new ClientModulePreferenceStore(join(dirname(config.stateFile), `${basename(config.stateFile)}.client-modules.json`), config.excludedClientModules);
 		this.listenerTlsEnabled = config.tls.mode === "provided";
 		this.tlsEnabled = config.publicTls;
@@ -5578,6 +5878,7 @@ var MobileAccessGateway = class {
 		this.probeFailureLimiter = new BoundedRateLimiter(probeLimit, config.rateLimitWindowMs, config.maxRateLimitKeys);
 		this.probeDeviceLimiter = new BoundedRateLimiter(probeLimit, config.rateLimitWindowMs, config.maxDevices);
 		this.removeSessionListener = this.access.onSessionEnded((authorization, reason) => {
+			for (const view of this.mobileDocumentViews.values()) if (view.sessionKey === authorization.sessionKey) this.removeMobileDocumentView(view);
 			if (reason === "revoked") {
 				const cleanup = this.clientModulePreferences.removeDevice(authorization.deviceId).catch(() => {
 					process.emitWarning("Unable to remove revoked device client preferences", { code: "DSH_MOBILE_PREFERENCE_CLEANUP_FAILED" });
@@ -5976,12 +6277,17 @@ var MobileAccessGateway = class {
 	nativeResponseInstanceId(result) {
 		return this.config.pairingCaFile === void 0 ? result.nativeInstanceId ?? this.config.instanceId : this.config.instanceId;
 	}
+	/** Older Apps require exact wire keys; expose this hint only to explicit opt-in clients after authentication. */
+	nativeResponseInstallationIdentity(request) {
+		return this.config.installationId === void 0 || request.headers["x-dsh-mobile-capabilities"] !== "installation-id" ? {} : { installationId: this.config.installationId };
+	}
 	async handleNativePair(request, response) {
 		const body = await readJsonObject(request, MAX_CONTROL_BODY_BYTES);
 		if (typeof body.token !== "string" || body.label !== void 0 && typeof body.label !== "string") throw new HttpError(400, "bad_request");
 		const result = await this.access.pair(request.socket.remoteAddress ?? "unknown", body.token, body.label);
 		sendJson(response, 201, {
 			instanceId: this.nativeResponseInstanceId(result),
+			...this.nativeResponseInstallationIdentity(request),
 			deviceId: result.deviceId,
 			deviceToken: result.deviceToken,
 			deviceExpiresAt: result.deviceExpiresAt,
@@ -6002,6 +6308,7 @@ var MobileAccessGateway = class {
 			const result = await this.access.renew(selected.token);
 			sendJson(response, 200, {
 				instanceId: this.nativeResponseInstanceId(result),
+				...this.nativeResponseInstallationIdentity(request),
 				deviceId: result.deviceId,
 				sessionToken: result.sessionToken,
 				csrfToken: result.csrfToken,
@@ -6021,6 +6328,7 @@ var MobileAccessGateway = class {
 			const result = await this.access.probe(selected.token);
 			sendJson(response, 200, {
 				instanceId: this.nativeResponseInstanceId(result),
+				...this.nativeResponseInstallationIdentity(request),
 				deviceId: result.deviceId,
 				deviceExpiresAt: result.deviceExpiresAt
 			}, this.tlsEnabled);
@@ -6109,9 +6417,9 @@ var MobileAccessGateway = class {
 		if (target.search === "" && request.method === "GET" && (target.decodedPathname === `/mobile-access/pair` || target.decodedPathname === `/mobile-access/pair.js`)) {
 			if (!this.access.pairingStatus().open) throw new HttpError(404, "not_found");
 			const languageHeader = request.headers["accept-language"];
-			const locale = resolveAuthPageLocale(typeof languageHeader === "string" ? languageHeader : void 0);
+			const locale = resolveBrowserUiLocale(request.headers.cookie, typeof languageHeader === "string" ? languageHeader : void 0);
 			setSecurityHeaders(response, this.tlsEnabled);
-			response.setHeader("Vary", "Accept-Language");
+			response.setHeader("Vary", "Accept-Language, Cookie");
 			const body = target.decodedPathname.endsWith(".js") ? renderPairScript(locale) : renderPairPage(locale);
 			response.writeHead(200, {
 				"Content-Type": target.decodedPathname.endsWith(".js") ? "text/javascript; charset=utf-8" : "text/html; charset=utf-8",
@@ -6123,9 +6431,9 @@ var MobileAccessGateway = class {
 		if (request.method === "GET" && (target.decodedPathname === `/mobile-access/login` || target.decodedPathname === `/mobile-access/login.js`)) {
 			if (target.decodedPathname.endsWith(".js") && target.search !== "") throw new HttpError(400, "bad_request");
 			const languageHeader = request.headers["accept-language"];
-			const locale = resolveAuthPageLocale(typeof languageHeader === "string" ? languageHeader : void 0);
+			const locale = resolveBrowserUiLocale(request.headers.cookie, typeof languageHeader === "string" ? languageHeader : void 0);
 			setSecurityHeaders(response, this.tlsEnabled);
-			response.setHeader("Vary", "Accept-Language");
+			response.setHeader("Vary", "Accept-Language, Cookie");
 			const body = target.decodedPathname.endsWith(".js") ? renderLoginScript(locale) : renderLoginPage(locale);
 			response.writeHead(200, {
 				"Content-Type": target.decodedPathname.endsWith(".js") ? "text/javascript; charset=utf-8" : "text/html; charset=utf-8",
@@ -6209,6 +6517,8 @@ var MobileAccessGateway = class {
 			}
 			throw error;
 		}
+		const viewId = headerValue(request.headers, MOBILE_DOCUMENT_VIEW_HEADER);
+		const documentView = viewId === void 0 ? void 0 : this.requireMobileDocumentView(viewId, authorization, request);
 		if (isMutation) try {
 			this.requireCsrf(request, authorization);
 		} catch (error) {
@@ -6336,7 +6646,7 @@ var MobileAccessGateway = class {
 			return;
 		}
 		if (stockFrontend && target.decodedPathname === "/") request.url = "/";
-		await this.proxyHttp(request, response, authorization);
+		await this.proxyHttp(request, response, authorization, documentView);
 	}
 	async handleExtensionRequest(targetInfo, target, request, response, authorization) {
 		const extensions = this.extensions;
@@ -6568,16 +6878,23 @@ var MobileAccessGateway = class {
 		}
 	}
 	async exchangeUpstreamCookie() {
-		const authenticatedUrl = this.upstreamAuthenticatedUrl;
-		if (authenticatedUrl === void 0) throw new HttpError(502, "upstream_unavailable");
-		let target;
-		try {
-			target = new URL(authenticatedUrl);
-		} catch {
-			throw new HttpError(502, "upstream_unavailable");
-		}
-		if (target.origin !== this.config.upstreamOrigin.origin || target.pathname !== "/" || target.hash !== "" || target.search === "") throw new HttpError(502, "upstream_unavailable");
+		const attempt = this.upstreamAuthDiagnostics.begin();
+		let stage = "target";
+		let outcome = "invalid-target";
+		let status;
+		let timedOut = false;
 		try {
+			const authenticatedUrl = this.upstreamAuthenticatedUrl;
+			if (authenticatedUrl === void 0) throw new HttpError(502, "upstream_unavailable");
+			let target;
+			try {
+				target = new URL(authenticatedUrl);
+			} catch {
+				throw new HttpError(502, "upstream_unavailable");
+			}
+			if (target.origin !== this.config.upstreamOrigin.origin || target.pathname !== "/" || target.hash !== "" || target.search === "") throw new HttpError(502, "upstream_unavailable");
+			stage = "request";
+			outcome = "transport-error";
 			const proxied = await new Promise((resolve, reject) => {
 				const upstreamRequest = request({
 					protocol: "http:",
@@ -6595,27 +6912,46 @@ var MobileAccessGateway = class {
 				});
 				this.upstreamAuthRequest = upstreamRequest;
 				upstreamRequest.setTimeout(this.config.upstreamTimeoutMs, () => {
+					timedOut = true;
 					upstreamRequest.destroy(new HttpError(504, "upstream_timeout"));
 				});
 				upstreamRequest.once("response", resolve);
 				upstreamRequest.once("error", reject);
 				upstreamRequest.end();
 			});
+			stage = "response";
+			status = proxied.statusCode;
 			await new Promise((resolve, reject) => {
 				proxied.once("end", resolve);
 				proxied.once("error", reject);
 				proxied.resume();
 			});
+			if (status !== 303) {
+				outcome = "unexpected-status";
+				throw new HttpError(502, "upstream_unavailable");
+			}
+			stage = "cookie";
+			outcome = "invalid-cookie";
 			const setCookie = proxied.headers["set-cookie"]?.[0];
 			const pair = setCookie?.split(";", 1)[0];
 			const maxAgeText = setCookie === void 0 ? void 0 : /(?:^|;\s*)Max-Age=(\d+)(?:;|$)/iu.exec(setCookie)?.[1];
 			const maxAgeSeconds = maxAgeText === void 0 ? NaN : Number(maxAgeText);
 			const expiresAt = Date.now() + maxAgeSeconds * 1e3;
-			if (proxied.statusCode !== 303 || pair === void 0 || pair.length > 4096 || !UPSTREAM_COOKIE_PAIR.test(pair) || !Number.isSafeInteger(expiresAt) || maxAgeSeconds <= 0) throw new HttpError(502, "upstream_unavailable");
+			if (pair === void 0 || pair.length > 4096 || !UPSTREAM_COOKIE_PAIR.test(pair) || !Number.isSafeInteger(expiresAt) || maxAgeSeconds <= 0) throw new HttpError(502, "upstream_unavailable");
 			this.upstreamCookie = pair;
 			this.upstreamCookieExpiresAt = expiresAt;
+			this.upstreamAuthDiagnostics.record(attempt, {
+				outcome: "accepted",
+				stage,
+				status
+			});
 			return pair;
 		} catch (error) {
+			this.upstreamAuthDiagnostics.record(attempt, {
+				outcome: timedOut || error instanceof HttpError && error.status === 504 ? "timeout" : outcome,
+				stage,
+				...status === void 0 ? {} : { status }
+			});
 			if (error instanceof HttpError) throw error;
 			throw new HttpError(502, "upstream_unavailable");
 		} finally {
@@ -6789,11 +7125,15 @@ var MobileAccessGateway = class {
 					};
 					const cookies = browserAuthCookies(request.headers.cookie);
 					const csrfCookie = this.tlsEnabled && cookies.has("__Host-dsh_ma_session") ? HOST_CSRF_COOKIE : CSRF_COOKIE;
+					const viewId = randomBytes(16).toString("hex");
 					const rewritten = rewriteMobileIndexWithBatch(html, {
 						...options,
-						csrfCookie
+						csrfCookie,
+						viewId
 					});
+					operation.signal.throwIfAborted();
 					for (const batch of rewritten.batches) this.rememberMobileBootBatch(batch);
+					if (rewritten.graphTransport) this.rememberMobileDocumentView(viewId, authorization, excludedClientModules);
 					body = Buffer.from(rewritten.html);
 				} catch (error) {
 					if (error instanceof ExcludedClientModulesError) {
@@ -6845,6 +7185,53 @@ var MobileAccessGateway = class {
 			operation.release();
 		}
 	}
+	removeMobileDocumentView(view) {
+		if (this.mobileDocumentViews.get(view.id) !== view) return;
+		this.mobileDocumentViews.delete(view.id);
+		for (const abort of view.abortStreams) abort();
+		view.abortStreams.clear();
+	}
+	rememberMobileDocumentView(id, authorization, excluded) {
+		for (const view of this.mobileDocumentViews.values()) if (view.expiresAt <= Date.now()) this.removeMobileDocumentView(view);
+		const view = Object.freeze({
+			...authorization,
+			id,
+			excludedClientModules: Object.freeze([...excluded]),
+			abortStreams: /* @__PURE__ */ new Set()
+		});
+		this.mobileDocumentViews.set(id, view);
+		while (this.mobileDocumentViews.size > this.config.maxSessions) {
+			const oldest = this.mobileDocumentViews.values().next().value;
+			if (oldest === void 0) break;
+			this.removeMobileDocumentView(oldest);
+		}
+	}
+	requireMobileDocumentView(id, authorization, request) {
+		const view = /^[a-f0-9]{32}$/u.test(id) ? this.mobileDocumentViews.get(id) : void 0;
+		if (view === void 0 || view.expiresAt <= Date.now() || view.sessionKey !== authorization.sessionKey || view.deviceId !== authorization.deviceId || request.method !== "GET" || parseRequestTarget(request.url).decodedPathname !== "/plugins/events" || request.headers["transfer-encoding"] !== void 0 || request.headers["content-length"] !== void 0 && Number(request.headers["content-length"]) !== 0) throw new HttpError(409, "mobile_document_view_invalid");
+		return view;
+	}
+	async projectMobileDocumentEvent(view, value, signal) {
+		signal.throwIfAborted();
+		if (this.mobileDocumentViews.get(view.id) !== view) throw new HttpError(409, "mobile_document_view_invalid");
+		if (value === null || typeof value !== "object" || Array.isArray(value)) throw new HttpError(502, "upstream_unavailable");
+		const frame = value;
+		if (frame.type === "rebuilt") {
+			if (typeof frame.id !== "string" || typeof frame.rev !== "string") throw new HttpError(502, "upstream_unavailable");
+			return frame.id === MOBILE_LAYOUT_MODULE ? void 0 : frame;
+		}
+		if (frame.type !== "graph" || frame.graph === null || typeof frame.graph !== "object" || Array.isArray(frame.graph)) throw new HttpError(502, "upstream_unavailable");
+		const plan = parseMobileBootGraph(JSON.stringify(frame.graph), view.excludedClientModules);
+		const projected = projectMobileBootGraph(plan, plan.rewrittenBatchEntries === void 0 ? {} : await this.resolveMobileBootSizes(plan.rewrittenBatchEntries.flatMap((batch) => batch.entries), signal));
+		if (!projected.graphTransport) throw new HttpError(502, "upstream_unavailable");
+		signal.throwIfAborted();
+		if (this.mobileDocumentViews.get(view.id) !== view) throw new HttpError(409, "mobile_document_view_invalid");
+		for (const batch of projected.batches) this.rememberMobileBootBatch(batch);
+		return {
+			...frame,
+			graph: plan.parsed
+		};
+	}
 	rememberMobileBootBatch(plan) {
 		const existing = this.mobileBootBatches.get(plan.key);
 		this.mobileBootBatches.delete(plan.key);
@@ -6877,7 +7264,8 @@ var MobileAccessGateway = class {
 				else sizes.set(source, size);
 			}
 		};
-		await Promise.all(Array.from({ length: Math.min(8, candidates.length) }, worker));
+		const failed = (await Promise.allSettled(Array.from({ length: Math.min(8, candidates.length) }, worker))).find((result) => result.status === "rejected");
+		if (failed?.status === "rejected") throw failed.reason;
 		return {
 			sizes,
 			passThrough
@@ -6896,6 +7284,7 @@ var MobileAccessGateway = class {
 		const cached = this.bootEntrySizeCache.get(source);
 		if (cached !== void 0 && Date.now() - cached.at < MOBILE_BOOT_SIZE_CACHE_TTL_MS) return cached.size;
 		let upstreamRequest;
+		let upstreamClosed;
 		const abort = () => {
 			upstreamRequest?.destroy(requestAbortedError());
 		};
@@ -6919,6 +7308,12 @@ var MobileAccessGateway = class {
 					},
 					agent: false
 				});
+				const opened = upstreamRequest;
+				upstreamClosed = new Promise((closed) => {
+					opened.once("close", () => {
+						closed();
+					});
+				});
 				upstreamRequest.setTimeout(this.config.upstreamTimeoutMs, () => {
 					upstreamRequest?.destroy(upstreamTimeoutError());
 				});
@@ -6954,6 +7349,7 @@ var MobileAccessGateway = class {
 		} finally {
 			signal?.removeEventListener("abort", abort);
 			upstreamRequest?.destroy();
+			await upstreamClosed;
 		}
 	}
 	async serveMobileBootBatch(key, request, response, authorization) {
@@ -7152,14 +7548,15 @@ var MobileAccessGateway = class {
 	* One request slot and cancellation signal cover attempts and backoff together.
 	* API requests and requests with bodies are forwarded once.
 	*/
-	async proxyHttp(request, response, authorization) {
+	async proxyHttp(request, response, authorization, documentView) {
 		const declared = request.headers["content-length"];
 		if (declared !== void 0 && (!/^\d+$/u.test(declared) || Number(declared) > this.config.maxBodyBytes)) throw new HttpError(413, "payload_too_large");
 		const replayable = request.method === "GET" && request.headers["transfer-encoding"] === void 0 && (declared === void 0 || Number(declared) === 0) && (request.url?.split("?", 1)[0]?.startsWith("/plugins/") === true || request.url?.split("?", 1)[0]?.startsWith("/assets/") === true);
 		const holder = {};
 		const operation = this.allocateRequest(authorization, response, holder);
+		documentView?.abortStreams.add(operation.abort);
 		const onClose = () => {
-			operation.release();
+			if (documentView === void 0) operation.release();
 			operation.abort();
 		};
 		response.once("close", onClose);
@@ -7169,7 +7566,7 @@ var MobileAccessGateway = class {
 			for (let attempt = 1; attempt <= attempts; attempt++) {
 				operation.signal.throwIfAborted();
 				try {
-					await this.proxyHttpOnce(request, response, holder, operation.signal, replayable);
+					await this.proxyHttpOnce(request, response, holder, operation.signal, replayable, documentView);
 					return;
 				} catch (error) {
 					if (operation.signal.aborted || response.destroyed) return;
@@ -7186,13 +7583,18 @@ var MobileAccessGateway = class {
 			if (!operation.signal.aborted) throw error;
 		} finally {
 			response.removeListener("close", onClose);
+			documentView?.abortStreams.delete(operation.abort);
 			operation.release();
 		}
 	}
-	async proxyHttpOnce(request$2, response, holder, signal, replayable) {
+	async proxyHttpOnce(request$2, response, holder, signal, replayable, documentView) {
 		let bodyDone;
+		const projections = /* @__PURE__ */ new Set();
 		try {
+			const pathname = parseRequestTarget(request$2.url).decodedPathname;
 			const upstreamHeaders = sanitizeRequestHeaders(request$2, this.config.upstreamOrigin);
+			delete upstreamHeaders[MOBILE_DOCUMENT_VIEW_HEADER];
+			if (documentView !== void 0) upstreamHeaders["accept-encoding"] = "identity";
 			if (request$2.headers["transfer-encoding"] !== void 0) upstreamHeaders["transfer-encoding"] = request$2.headers["transfer-encoding"];
 			const upstreamCookie = await this.upstreamCookieHeader();
 			signal.throwIfAborted();
@@ -7211,7 +7613,6 @@ var MobileAccessGateway = class {
 				upstreamRequest.setTimeout(this.config.upstreamTimeoutMs, () => {
 					upstreamRequest.destroy(new HttpError(504, "upstream_timeout"));
 				});
-				const pathname = parseRequestTarget(request$2.url).decodedPathname;
 				if (pathname === "/api" || pathname.startsWith("/api/")) upstreamRequest.once("finish", () => {
 					upstreamRequest.setTimeout(this.config.upstreamApiTimeoutMs);
 				});
@@ -7223,13 +7624,28 @@ var MobileAccessGateway = class {
 					bodyDone.catch(reject);
 				}
 			});
+			const graphEvents = documentView !== void 0 && replayable && pathname === "/plugins/events" && proxied.statusCode === 200 && proxied.headers["content-type"]?.split(";", 1)[0]?.trim().toLowerCase() === "text/event-stream";
+			if (documentView !== void 0 && !graphEvents) {
+				proxied.destroy();
+				throw new HttpError(502, "upstream_unavailable");
+			}
+			if (graphEvents) holder.request?.setTimeout(this.config.upstreamApiTimeoutMs);
 			setSecurityHeaders(response, this.tlsEnabled, "proxied");
 			const headers = sanitizeResponseHeaders(proxied.headers, this.config.upstreamOrigin);
+			if (graphEvents) {
+				if (proxied.headers["content-encoding"] !== void 0 && proxied.headers["content-encoding"] !== "identity") throw new HttpError(502, "upstream_unavailable");
+				delete headers["content-length"];
+				delete headers["content-encoding"];
+				delete headers.etag;
+				delete headers["last-modified"];
+				delete headers["content-range"];
+				delete headers["accept-ranges"];
+			}
 			const statusCode = proxied.statusCode ?? 502;
 			this.httpFailures.recordUpstream(request$2.method, request$2.url?.split("?", 1)[0] ?? "", statusCode);
-			const cacheControl = revisionedStaticCacheControl(request$2, statusCode);
+			const cacheControl = graphEvents ? void 0 : revisionedStaticCacheControl(request$2, statusCode);
 			if (cacheControl !== void 0) headers["cache-control"] = cacheControl;
-			const compressible = canCompressResponse(request$2, proxied);
+			const compressible = !graphEvents && canCompressResponse(request$2, proxied);
 			const compressed = compressible && acceptsGzip(request$2.headers["accept-encoding"]);
 			if (compressible) addVaryAcceptEncoding(headers);
 			if (compressed) {
@@ -7250,7 +7666,18 @@ var MobileAccessGateway = class {
 				addVaryAcceptEncoding(headers);
 			}
 			response.writeHead(statusCode, headers);
-			await Promise.all([bodyDone, compressed && request$2.method !== "HEAD" ? pipeline(proxied, createGzip(), response) : pipeline(proxied, response)]);
+			const eventTransform = !graphEvents || documentView === void 0 ? void 0 : createMobileGraphEventTransform((value) => {
+				const task = this.projectMobileDocumentEvent(documentView, value, signal);
+				projections.add(task);
+				this.mobileGraphTasks.add(task);
+				const settled = () => {
+					projections.delete(task);
+					this.mobileGraphTasks.delete(task);
+				};
+				task.then(settled, settled);
+				return task;
+			});
+			await Promise.all([bodyDone, eventTransform !== void 0 ? pipeline(proxied, eventTransform, response) : compressed && request$2.method !== "HEAD" ? pipeline(proxied, createGzip(), response) : pipeline(proxied, response)]);
 		} catch (error) {
 			holder.request?.destroy();
 			await bodyDone?.catch(() => void 0);
@@ -7258,6 +7685,7 @@ var MobileAccessGateway = class {
 			if (response.headersSent) response.destroy();
 			throw error;
 		} finally {
+			await Promise.allSettled(projections);
 			delete holder.request;
 		}
 	}
@@ -7648,9 +8076,13 @@ var MobileAccessGateway = class {
 		this.upstreamAuthRequest = void 0;
 		this.removeSessionListener();
 		this.pendingDeviceRevocations.clear();
+		for (const view of this.mobileDocumentViews.values()) this.removeMobileDocumentView(view);
 		const accessClose = this.access.close();
 		for (const stored of this.mobileBootBatches.values()) stored.assembly?.controller.abort();
-		for (const request of this.activeRequests.values()) request.abort();
+		for (const request of this.activeRequests.values()) {
+			clearTimeout(request.timer);
+			request.abort();
+		}
 		for (const websocket of this.activeWebSockets.values()) {
 			websocket.client.destroy();
 			websocket.upstream.destroy();
@@ -7675,6 +8107,7 @@ var MobileAccessGateway = class {
 		await accessClose;
 		await Promise.allSettled(this.clientModuleTasks);
 		await Promise.allSettled(this.clientModuleRevocations);
+		await Promise.allSettled(this.mobileGraphTasks);
 		this.activeRequests.clear();
 		this.activeWebSockets.clear();
 		this.connectedSockets.clear();
@@ -17264,16 +17697,20 @@ async function loadOrCreateInstallationId(file) {
 //#endregion
 //#region src/gateway-identity.ts
 /**
-* Use the persisted installation identity for an unpinned, automatically identified entry.
+* Attach the authenticated installation identity while retaining existing entry identity rules.
 * @param config - Validated gateway configuration containing the legacy identity.
 * @param installationId - Confirmed random identity read from this installation's state.
 * @param explicitIdentity - Whether the operator supplied the gateway identity.
 * @returns Configuration retaining certificate/operator identities or the new and legacy public identities.
 */
 function withInstallationIdentity(config, installationId, explicitIdentity) {
-	if (config.pairingCaFile !== void 0 || explicitIdentity) return config;
+	if (config.pairingCaFile !== void 0 || explicitIdentity) return Object.freeze({
+		...config,
+		installationId
+	});
 	return Object.freeze({
 		...config,
+		installationId,
 		instanceId: installationId,
 		legacyInstanceId: config.instanceId
 	});
@@ -17659,10 +18096,10 @@ async function apply(ctx, config) {
 	const dshVersion = installedDshVersion();
 	const loaded = await loadSetup(config);
 	const mobileAccess = createMobileAccessService(ctx);
-	const template = loopbackTemplate(loaded, ctx.webServer.port);
-	const upstreamLoginUrl = upstreamAuthenticatedUrl(ctx, template.upstreamOrigin);
-	const instanceId = await stableInstanceId(loaded, template);
-	const stateDirectory = dirname(template.stateFile);
+	const baseTemplate = loopbackTemplate(loaded, ctx.webServer.port);
+	const upstreamLoginUrl = upstreamAuthenticatedUrl(ctx, baseTemplate.upstreamOrigin);
+	const instanceId = await stableInstanceId(loaded, baseTemplate);
+	const stateDirectory = dirname(baseTemplate.stateFile);
 	const logFile = await installMobileFileLogger(ctx, stateDirectory);
 	const logger = ctx.logger("dsh-mobile");
 	logger.info("logging initialized file=%s", logFile);
@@ -17685,6 +18122,10 @@ async function apply(ctx, config) {
 	const frpComponent = new FrpComponentManager({ stateDirectory });
 	await frpComponent.initialize();
 	const frpIdentity = await loadOrCreateInstallationId(join(stateDirectory, "installation-id"));
+	const template = Object.freeze({
+		...baseTemplate,
+		installationId: frpIdentity
+	});
 	const remoteInstanceId = loaded.kind === "managed" ? frpIdentity : loaded.config.instanceId ?? frpIdentity;
 	const frpConfig = new FrpConfigStore(join(remoteDirectory, "frp", "config"), frpProxyName(frpIdentity), stateDirectory);
 	await frpConfig.initialize();
@@ -17747,6 +18188,8 @@ async function apply(ctx, config) {
 			logger.warn("auth failure %s", JSON.stringify(entry));
 		}, (entry) => {
 			logger.warn("http failure %s", JSON.stringify(entry));
+		}, (entry) => {
+			logger.info("upstream auth %s", JSON.stringify(entry));
 		});
 		await candidate.start();
 		lanGateway = candidate;
@@ -17807,6 +18250,8 @@ async function apply(ctx, config) {
 			logger.warn("auth failure %s", JSON.stringify(entry));
 		}, (entry) => {
 			logger.warn("http failure %s", JSON.stringify(entry));
+		}, (entry) => {
+			logger.info("upstream auth %s", JSON.stringify(entry));
 		});
 		await candidate.start();
 		return candidate;
@@ -17827,6 +18272,8 @@ async function apply(ctx, config) {
 			logger.warn("auth failure %s", JSON.stringify(entry));
 		}, (entry) => {
 			logger.warn("http failure %s", JSON.stringify(entry));
+		}, (entry) => {
+			logger.info("upstream auth %s", JSON.stringify(entry));
 		});
 		try {
 			await candidate.start();
@@ -17842,6 +18289,8 @@ async function apply(ctx, config) {
 			logger.warn("auth failure %s", JSON.stringify(entry));
 		}, (entry) => {
 			logger.warn("http failure %s", JSON.stringify(entry));
+		}, (entry) => {
+			logger.info("upstream auth %s", JSON.stringify(entry));
 		});
 		try {
 			await candidate.start();