dsh-mobile 0.6.16 → 0.6.18

package/lib/index.d.mts

@@ -323,6 +323,8 @@ interface PluginConfig {
   upstreamOrigin?: string;
   publicAuthorities?: string[];
   allowedCidrs?: string[];
+  /** Extra direct management peers; every non-loopback request still requires DSH authentication. */
+  adminAllowedCidrs?: string[];
   stateFile: string;
   /** Internal persisted on/off preference managed by the DSH plugin card. */
   controlFile: string;
@@ -384,6 +386,7 @@ interface ResolvedGatewayConfig {
   readonly upstreamOrigin: URL;
   readonly authorities: readonly AuthoritySpec[];
   readonly allowedCidrs: readonly ParsedCidr[];
+  readonly adminAllowedCidrs: readonly ParsedCidr[];
   readonly stateFile: string;
   /** Local extension root adjacent to the mobile-access state file. */
   readonly extensionsDir: string;
@@ -432,6 +435,12 @@ interface ClientModuleEntry {
   readonly id: string;
   readonly required: boolean;
   readonly dependencies: readonly string[];
+  /** Source bytes of the upstream bundle, when the Gateway could measure them. */
+  readonly bytes?: number;
+  /** Gzipped bytes the phone would receive, when the Gateway could measure them. */
+  readonly gzipBytes?: number;
+  /** The plugin package's own one-line description, when it could be read. */
+  readonly description?: string;
 }
 /** Selection returned to the computer administrator or the authenticated device. */
 interface ClientModulePreferenceView {
@@ -569,6 +578,18 @@ type HttpFailureEntry = ({
   readonly suppressed?: number;
 };
 //#endregion
+//#region src/api-latency-log.d.ts
+/** One sampled API wait; `durationMs` spans the client's request to response close. */
+type ApiLatencyEntry = {
+  readonly kind: 'api';
+  readonly method: 'GET' | 'HEAD' | 'POST' | 'PUT' | 'PATCH' | 'DELETE' | 'OTHER';
+  readonly path: string;
+  readonly status: number;
+  readonly durationMs: number;
+} & {
+  readonly suppressed?: number;
+};
+//#endregion
 //#region src/upstream-auth-log.d.ts
 /** Fixed outcomes of the Gateway's private DSH launch-token exchange. */
 type UpstreamAuthOutcome = 'accepted' | 'invalid-target' | 'unexpected-status' | 'invalid-cookie' | 'timeout' | 'transport-error';
@@ -1017,6 +1038,7 @@ export declare class MobileAccessGateway {
   private readonly mobileBootBatches;
   private readonly mobileDocumentViews;
   private readonly mobileGraphTasks;
+  private readonly workspaceDirectoryTasks;
   /** Cached upstream bundle byte sizes (HEAD probes), keyed by resource URL. */
   private readonly bootEntrySizeCache;
   private readonly extensionEventListeners;
@@ -1044,15 +1066,20 @@ export declare class MobileAccessGateway {
   private readonly probeDeviceLimiter;
   private readonly probeInFlight;
   private readonly clientModulePreferences;
+  private readonly clientModuleSizeCache;
+  private readonly clientModuleDescriptionCache;
+  private clientModuleMetadataRevision;
+  private clientModuleMeasurementActive;
   private readonly clientModuleOperations;
   private readonly clientModuleTasks;
   private readonly clientModuleRevocations;
   private readonly authFailures;
   private readonly httpFailures;
+  private readonly apiLatency;
   private readonly upstreamAuthDiagnostics;
   constructor(config: ResolvedGatewayConfig, store: DeviceStore, extensions?: MobileAccessService | undefined, upstreamAuthenticatedUrl?: string | undefined, extraWebSocketPaths?: {
     has(pathname: string): boolean;
-  } | undefined, blockedUpgradeLog?: BlockedUpgradePathLog | undefined, onDiscoveryDegraded?: ((source: 'broadcast' | 'mdns', code: string) => void) | undefined, clientModulePreferences?: ClientModulePreferenceStore, authFailureLog?: (entry: AuthFailureEntry) => void, httpFailureLog?: (entry: HttpFailureEntry) => void, upstreamAuthLog?: (entry: UpstreamAuthEntry) => void);
+  } | undefined, blockedUpgradeLog?: BlockedUpgradePathLog | undefined, onDiscoveryDegraded?: ((source: 'broadcast' | 'mdns', code: string) => void) | undefined, clientModulePreferences?: ClientModulePreferenceStore, authFailureLog?: (entry: AuthFailureEntry) => void, httpFailureLog?: (entry: HttpFailureEntry) => void, upstreamAuthLog?: (entry: UpstreamAuthEntry) => void, apiLatencyLog?: (entry: ApiLatencyEntry) => void);
   /** Initialize durable state, validate TLS, and bind the externally reachable listener. */
   start(): Promise<void>;
   /** Install a newly signed provided leaf for future TLS handshakes without dropping sessions. */
@@ -1113,6 +1140,12 @@ export declare class MobileAccessGateway {
    * @returns The installed catalog and effective module selection.
    */
   describeClientModules(deviceId?: string, callerSignal?: AbortSignal): Promise<ClientModulePreferenceView>;
+  /** Measure optional catalog metadata without changing saved module selections.
+   * @param deviceId - Authenticated device identity, or computer defaults when omitted.
+   * @param callerSignal - Cancels measurement and drains its admitted requests.
+   * @returns Current selections with the measurements completed within the budget.
+   */
+  measureClientModules(deviceId?: string, callerSignal?: AbortSignal): Promise<ClientModulePreferenceView>;
   /** Persist a validated device override or computer default.
    * @param excluded - Untrusted module IDs to validate against the current boot graph.
    * @param deviceId - Authenticated device identity; omitted for computer defaults.
@@ -1126,6 +1159,25 @@ export declare class MobileAccessGateway {
    * @returns The catalog and inherited selection.
    */
   resetClientModules(deviceId?: string, callerSignal?: AbortSignal): Promise<ClientModulePreferenceView>;
+  /** Return cached metadata only; catalog reads and saves never start bundle probes. */
+  private describeMobileModulesWithSizes;
+  /** Refresh metadata only after an explicit user action, with bounded concurrency. */
+  private measureMobileModules;
+  /**
+   * Read the installed package description for one catalog module.
+   *
+   * This is best-effort package metadata lookup from the state directory's Node
+   * resolution context and this plugin's dependencies. Unexported or unavailable
+   * package metadata stays unknown; arbitrary paths and subpaths are not read.
+   */
+  private installedModuleDescription;
+  /**
+   * Measure one upstream bundle's source and gzipped size.
+   *
+   * Measurements are cached for ten minutes: the settings panel is opened rarely
+   * and upstream bundle bytes only change on a plugin rebuild or host restart.
+   */
+  private upstreamBundleMeasurement;
   private clientModulePreferenceOperation;
   private fetchAuthenticatedUpstreamIndex;
   private proxyMobileIndex;