dsh-mobile 0.6.6 → 0.6.8

package/lib/index.d.mts

@@ -14,17 +14,21 @@ interface StoredDevice {
   readonly createdAt: number;
   readonly expiresAt: number;
   readonly lastSeenAt: number;
+  /** Native pairing identity bound to this credential; older records omit it. */
+  readonly nativeInstanceId?: string;
   /** Legacy tombstone accepted on load; AccessController removes it during initialization. */
   readonly revokedAt?: number;
 }
 /** Versioned device state. Raw device and Session credentials are never members. */
 interface DeviceSnapshot {
-  readonly version: 1;
+  readonly version: 1 | 2;
   readonly devices: readonly StoredDevice[];
 }
 /** Persistence seam for device-token digests and revocation metadata. */
 interface DeviceStore {
+  /** Read either supported version without assigning identities to legacy rows. */
   load(): Promise<DeviceSnapshot>;
+  /** Validate and persist version 2, retaining any credential identity bindings. */
   save(snapshot: DeviceSnapshot): Promise<void>;
 }
 /** Validate durable data before it can authorize a device. */
@@ -64,10 +68,15 @@ interface AccessControllerOptions {
   readonly rateLimitWindowMs: number;
   readonly maxPairingAttempts: number;
   readonly maxRateLimitKeys: number;
+  /** Native identity stored with newly paired device credentials. */
+  readonly pairingInstanceId?: string;
+  /** Native response identity for older credentials without a stored binding. */
+  readonly legacyInstanceId?: string;
   readonly now?: () => number;
 }
 /** Values issued once after pairing; only digests survive the response. */
 interface PairingResult {
+  readonly nativeInstanceId?: string;
   readonly deviceId: string;
   readonly deviceToken: string;
   readonly deviceExpiresAt: number;
@@ -77,6 +86,7 @@ interface PairingResult {
 }
 /** Values issued after renewal with the persistent HttpOnly device Cookie. */
 interface RenewalResult {
+  readonly nativeInstanceId?: string;
   readonly deviceId: string;
   readonly sessionToken: string;
   readonly csrfToken: string;
@@ -90,6 +100,7 @@ interface SessionAuthorization {
 }
 /** Result of a persistent-device reachability check without opening a Session. */
 interface DeviceProbeResult {
+  readonly nativeInstanceId?: string;
   readonly deviceId: string;
   readonly deviceExpiresAt: number;
 }
@@ -136,6 +147,7 @@ export declare class AccessController {
   private requireInitialized;
   private exclusive;
   private snapshot;
+  private nativeIdentity;
   private emitSessionEnded;
   private removeSession;
   private pruneSessions;
@@ -333,6 +345,15 @@ interface PluginConfig {
     keyFile?: string;
     caFile?: string;
   };
+  /**
+   * Reserved cpolar subdomain passed through as `cpolar http -subdomain`.
+   *
+   * A compatible account reservation and region are required. Unset or blank values
+   * keep provider-selected allocation; credentials may still expire or be revoked.
+   */
+  cpolarSubdomain?: string;
+  /** cpolar region for `-region`; use the region chosen when reserving the subdomain. */
+  cpolarRegion?: string;
   pairingTtlMs?: number;
   deviceTtlMs?: number;
   sessionTtlMs?: number;
@@ -368,6 +389,8 @@ interface ResolvedGatewayConfig {
   readonly excludedClientModules: readonly string[];
   readonly websocketCompression: ResolvedWebSocketCompressionConfig;
   readonly instanceId: string;
+  /** Identity returned only for authenticated legacy native credentials without a stored binding. */
+  readonly legacyInstanceId?: string;
   readonly pairingCaFile?: string;
   readonly tls: TlsConfig;
   /** Whether the public hop is HTTPS, even when a trusted loopback proxy terminates TLS. */
@@ -664,8 +687,8 @@ declare class ExtensionWorkerHost {
   private cancelStream;
 }
 //#endregion
-//#region src/extensions.d.ts
-/** Maximum sizes enforced at the local-extension filesystem boundary. */
+//#region src/extension-limits.d.ts
+/** Maximum sizes enforced when reading local extension files. */
 export declare const EXTENSION_LIMITS: Readonly<{
   manifest: number;
   script: number;
@@ -675,6 +698,8 @@ export declare const EXTENSION_LIMITS: Readonly<{
   assetBytes: number;
   assetDepth: 8;
 }>;
+//#endregion
+//#region src/extensions.d.ts
 /** A controlled business failure returned by an extension action or route. */
 export declare class MobileExtensionError extends Error {
   readonly code: string;
@@ -989,6 +1014,8 @@ export declare class MobileAccessGateway {
   private setBrowserDeviceBinding;
   private handlePair;
   private handleRenew;
+  /** CA-backed entries retain their pin; public entries project the authenticated credential's identity. */
+  private nativeResponseInstanceId;
   private handleNativePair;
   private handleNativeRenew;
   private handleNativeProbe;
@@ -2281,7 +2308,7 @@ export declare const name = "dsh-mobile";
 /** The stock WebServer serves the control card; Connection authenticates the loopback DSH origin. */
 export declare const inject: string[];
 /** Reuse remote HTTPS policy while binding a separately validated private HTTP origin. */
-export declare function originGatewayConfig(template: ResolvedGatewayConfig, settings: OriginSettings, stateFile: string, instanceId: string, listenPort?: number): ResolvedGatewayConfig;
+export declare function originGatewayConfig(template: ResolvedGatewayConfig, settings: OriginSettings, stateFile: string, instanceId: string, listenPort?: number, legacyInstanceId?: string): ResolvedGatewayConfig;
 /** Mount the resident control route and its optional authenticated LAN gateway. */
 export declare function apply(ctx: Context, config: PluginConfig): Promise<void>;
 //#endregion