dsh-mobile 0.6.7 → 0.6.8

package/lib/index.mjs

@@ -4,7 +4,7 @@ import { basename, dirname, extname, isAbsolute, join, relative, resolve, win32
 import { fileURLToPath, pathToFileURL } from "node:url";
 import z from "@deepseek-ai/schemastery";
 import { connect, createServer } from "node:net";
-import { chmod, copyFile, lstat, mkdir, mkdtemp, open, opendir, readFile, readdir, realpath, rename, rm, rmdir, stat, unlink, writeFile } from "node:fs/promises";
+import { chmod, copyFile, link, lstat, mkdir, mkdtemp, open, opendir, readFile, readdir, realpath, rename, rm, rmdir, stat, unlink, writeFile } from "node:fs/promises";
 import { performance as performance$1 } from "node:perf_hooks";
 import { execFile, spawn } from "node:child_process";
 import { createSocket } from "node:dgram";
@@ -144,10 +144,14 @@ var AccessController = class {
 	}
 	snapshot(devices) {
 		return Object.freeze({
-			version: 1,
+			version: 2,
 			devices: Object.freeze([...devices])
 		});
 	}
+	nativeIdentity(device) {
+		const nativeInstanceId = device.nativeInstanceId ?? this.options.legacyInstanceId ?? this.options.pairingInstanceId;
+		return nativeInstanceId === void 0 ? {} : { nativeInstanceId };
+	}
 	emitSessionEnded(session, reason) {
 		const authorization = Object.freeze({
 			sessionKey: session.key,
@@ -165,7 +169,7 @@ var AccessController = class {
 	pruneSessions(now) {
 		for (const [key, session] of this.sessions) if (session.expiresAt <= now) this.removeSession(key, "expired");
 	}
-	createSession(deviceId, now, deviceExpiresAt) {
+	createSession(device, now) {
 		this.pruneSessions(now);
 		if (this.sessions.size >= this.options.maxSessions) {
 			const oldest = [...this.sessions.values()].sort((left, right) => left.createdAt - right.createdAt)[0];
@@ -176,14 +180,15 @@ var AccessController = class {
 		const key = digestHex(sessionToken);
 		const record = Object.freeze({
 			key,
-			deviceId,
+			deviceId: device.id,
 			csrfDigest: digest$1(csrfToken),
 			createdAt: now,
-			expiresAt: Math.min(now + this.options.sessionTtlMs, deviceExpiresAt)
+			expiresAt: Math.min(now + this.options.sessionTtlMs, device.expiresAt)
 		});
 		this.sessions.set(key, record);
 		return Object.freeze({
-			deviceId,
+			...this.nativeIdentity(device),
+			deviceId: device.id,
 			sessionToken,
 			csrfToken,
 			sessionExpiresAt: record.expiresAt
@@ -228,12 +233,13 @@ var AccessController = class {
 				tokenDigest: digestHex(deviceToken),
 				createdAt: now,
 				expiresAt: now + this.options.deviceTtlMs,
-				lastSeenAt: now
+				lastSeenAt: now,
+				...this.options.pairingInstanceId === void 0 ? {} : { nativeInstanceId: this.options.pairingInstanceId }
 			});
 			const next = [...this.devices.filter((candidate) => candidate.revokedAt === void 0 && candidate.expiresAt > now), device];
 			await this.store.save(this.snapshot(next));
 			this.devices = next;
-			const session = this.createSession(device.id, now, device.expiresAt);
+			const session = this.createSession(device, now);
 			return Object.freeze({
 				...session,
 				deviceToken,
@@ -256,7 +262,7 @@ var AccessController = class {
 			next[index] = updated;
 			await this.store.save(this.snapshot(next));
 			this.devices = next;
-			return this.createSession(device.id, now, device.expiresAt);
+			return this.createSession(device, now);
 		});
 	}
 	/** Validate a persistent device credential without consuming a Session slot. */
@@ -275,6 +281,7 @@ var AccessController = class {
 			await this.store.save(this.snapshot(next));
 			this.devices = next;
 			return Object.freeze({
+				...this.nativeIdentity(device),
 				deviceId: device.id,
 				deviceExpiresAt: device.expiresAt
 			});
@@ -285,6 +292,7 @@ var AccessController = class {
 		this.requireInitialized();
 		const device = this.requireDevice(deviceToken, this.now());
 		return Object.freeze({
+			...this.nativeIdentity(device),
 			deviceId: device.id,
 			deviceExpiresAt: device.expiresAt
 		});
@@ -5289,6 +5297,8 @@ var MobileAccessGateway = class {
 		this.listenerTlsEnabled = config.tls.mode === "provided";
 		this.tlsEnabled = config.publicTls;
 		this.access = new AccessController(store, {
+			pairingInstanceId: config.instanceId,
+			...config.legacyInstanceId === void 0 ? {} : { legacyInstanceId: config.legacyInstanceId },
 			pairingTtlMs: config.pairingTtlMs,
 			deviceTtlMs: config.deviceTtlMs,
 			sessionTtlMs: config.sessionTtlMs,
@@ -5665,12 +5675,16 @@ var MobileAccessGateway = class {
 			sessionExpiresAt: result.sessionExpiresAt
 		}, this.tlsEnabled);
 	}
+	/** CA-backed entries retain their pin; public entries project the authenticated credential's identity. */
+	nativeResponseInstanceId(result) {
+		return this.config.pairingCaFile === void 0 ? result.nativeInstanceId ?? this.config.instanceId : this.config.instanceId;
+	}
 	async handleNativePair(request, response) {
 		const body = await readJsonObject(request, MAX_CONTROL_BODY_BYTES);
 		if (typeof body.token !== "string" || body.label !== void 0 && typeof body.label !== "string") throw new HttpError(400, "bad_request");
 		const result = await this.access.pair(request.socket.remoteAddress ?? "unknown", body.token, body.label);
 		sendJson(response, 201, {
-			instanceId: this.config.instanceId,
+			instanceId: this.nativeResponseInstanceId(result),
 			deviceId: result.deviceId,
 			deviceToken: result.deviceToken,
 			deviceExpiresAt: result.deviceExpiresAt,
@@ -5685,7 +5699,7 @@ var MobileAccessGateway = class {
 		if (typeof body.deviceToken !== "string") throw new HttpError(400, "bad_request");
 		const result = await this.access.renew(body.deviceToken);
 		sendJson(response, 200, {
-			instanceId: this.config.instanceId,
+			instanceId: this.nativeResponseInstanceId(result),
 			deviceId: result.deviceId,
 			sessionToken: result.sessionToken,
 			csrfToken: result.csrfToken,
@@ -5698,7 +5712,7 @@ var MobileAccessGateway = class {
 		if (typeof body.deviceToken !== "string") throw new HttpError(400, "bad_request");
 		const result = await this.access.probe(body.deviceToken);
 		sendJson(response, 200, {
-			instanceId: this.config.instanceId,
+			instanceId: this.nativeResponseInstanceId(result),
 			deviceId: result.deviceId,
 			deviceExpiresAt: result.deviceExpiresAt
 		}, this.tlsEnabled);
@@ -7367,6 +7381,7 @@ function parseDevice(value) {
 	if (typeof record.id !== "string" || !/^[a-f\d]{32}$/u.test(record.id)) throw new Error("device state contains an invalid id");
 	if (typeof record.label !== "string" || record.label.length < 1 || record.label.length > 64 || /[\u0000-\u001f\u007f]/u.test(record.label)) throw new Error("device state contains an invalid label");
 	if (typeof record.tokenDigest !== "string" || !/^[a-f\d]{64}$/u.test(record.tokenDigest)) throw new Error("device state contains an invalid credential digest");
+	if (record.nativeInstanceId !== void 0 && (typeof record.nativeInstanceId !== "string" || !/^[a-f\d]{64}$/u.test(record.nativeInstanceId))) throw new Error("device state contains an invalid native instance id");
 	assertInteger(record.createdAt, "createdAt");
 	assertInteger(record.expiresAt, "expiresAt");
 	assertInteger(record.lastSeenAt, "lastSeenAt");
@@ -7379,6 +7394,7 @@ function parseDevice(value) {
 		createdAt: record.createdAt,
 		expiresAt: record.expiresAt,
 		lastSeenAt: record.lastSeenAt,
+		...record.nativeInstanceId === void 0 ? {} : { nativeInstanceId: record.nativeInstanceId },
 		...record.revokedAt === void 0 ? {} : { revokedAt: record.revokedAt }
 	});
 }
@@ -7386,14 +7402,21 @@ function parseDevice(value) {
 function parseDeviceSnapshot(value, maximumDevices = 256) {
 	if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error("device state must be an object");
 	const snapshot = value;
-	if (snapshot.version !== 1 || !Array.isArray(snapshot.devices) || snapshot.devices.length > maximumDevices) throw new Error("device state has an unsupported version or device count");
+	if (snapshot.version !== 1 && snapshot.version !== 2 || !Array.isArray(snapshot.devices) || snapshot.devices.length > maximumDevices) throw new Error("device state has an unsupported version or device count");
 	const devices = snapshot.devices.map(parseDevice);
 	if (new Set(devices.map((device) => device.id)).size !== devices.length || new Set(devices.map((device) => device.tokenDigest)).size !== devices.length) throw new Error("device state contains duplicate device identities");
 	return Object.freeze({
-		version: 1,
+		version: snapshot.version,
 		devices: Object.freeze(devices)
 	});
 }
+function snapshotForSave(snapshot, maximumDevices) {
+	const validated = parseDeviceSnapshot(snapshot, maximumDevices);
+	return Object.freeze({
+		version: 2,
+		devices: validated.devices
+	});
+}
 /** Atomic JSON implementation with symlink refusal and owner-only file creation. */
 var JsonDeviceStore = class {
 	file;
@@ -7424,7 +7447,7 @@ var JsonDeviceStore = class {
 		return parseDeviceSnapshot(parsed, this.maximumDevices);
 	}
 	async save(snapshot) {
-		const validated = parseDeviceSnapshot(snapshot, this.maximumDevices);
+		const validated = snapshotForSave(snapshot, this.maximumDevices);
 		const directory = dirname(this.file);
 		await mkdir(directory, {
 			recursive: true,
@@ -7468,7 +7491,7 @@ var MemoryDeviceStore = class {
 		return structuredClone(this.snapshot);
 	}
 	async save(snapshot) {
-		this.snapshot = structuredClone(parseDeviceSnapshot(snapshot));
+		this.snapshot = structuredClone(snapshotForSave(snapshot));
 	}
 	/** Return a defensive copy for assertions or administrative export. */
 	inspect() {
@@ -16691,23 +16714,75 @@ async function readInstallationId(file) {
 	await restrictPrivateFile(file);
 	return contents.slice(0, -1);
 }
-/** Keep one random plugin identity across setup changes, restarts, and FRP resets. */
+/** Keep one random plugin identity across setup changes, restarts, and FRP resets; creation requires hard-link support in the state directory. */
 async function loadOrCreateInstallationId(file) {
 	if (!isAbsolute(file)) throw new Error("installation ID path must be absolute");
 	const target = resolve(file);
-	await mkdir(dirname(target), {
-		recursive: true,
-		mode: 448
-	});
+	const directory = dirname(target);
+	await ensureManagedDirectory(directory, directory, "installation_id");
 	try {
-		await writeFile(target, `${randomBytes(32).toString("hex")}\n`, {
-			flag: "wx",
-			mode: 384
-		});
+		return await readInstallationId(target);
 	} catch (error) {
-		if (error.code !== "EEXIST") throw error;
+		if (error.code !== "ENOENT") throw error;
 	}
-	return readInstallationId(target);
+	const temporary = join(directory, `.${basename(target)}.${randomBytes(12).toString("hex")}.tmp`);
+	let created = false;
+	let failure;
+	try {
+		await assertManagedParents(directory, temporary, "installation_id");
+		const handle = await open(temporary, "wx", 384);
+		created = true;
+		let writeFailure;
+		try {
+			await handle.writeFile(`${randomBytes(32).toString("hex")}\n`, "utf8");
+		} catch (error) {
+			writeFailure = error;
+			throw error;
+		} finally {
+			try {
+				await handle.close();
+			} catch (closeError) {
+				if (writeFailure !== void 0) throw new AggregateError([writeFailure, closeError], "installation ID candidate write and close failed");
+				throw closeError;
+			}
+		}
+		await restrictPrivateFile(temporary);
+		await assertManagedParents(directory, target, "installation_id");
+		try {
+			await link(temporary, target);
+		} catch (error) {
+			if (error.code !== "EEXIST") throw new Error("installation ID publication failed; the state filesystem must support hard links", { cause: error });
+		}
+		return await readInstallationId(target);
+	} catch (error) {
+		failure = error;
+		throw error;
+	} finally {
+		if (created) try {
+			await assertManagedParents(directory, temporary, "installation_id");
+			await unlink(temporary);
+		} catch (cleanupError) {
+			if (failure !== void 0) throw new AggregateError([failure, cleanupError], "installation ID publication and temporary cleanup failed");
+			throw cleanupError;
+		}
+	}
+}
+//#endregion
+//#region src/gateway-identity.ts
+/**
+* Use the persisted installation identity for an unpinned, automatically identified entry.
+* @param config - Validated gateway configuration containing the legacy identity.
+* @param installationId - Confirmed random identity read from this installation's state.
+* @param explicitIdentity - Whether the operator supplied the gateway identity.
+* @returns Configuration retaining certificate/operator identities or the new and legacy public identities.
+*/
+function withInstallationIdentity(config, installationId, explicitIdentity) {
+	if (config.pairingCaFile !== void 0 || explicitIdentity) return config;
+	return Object.freeze({
+		...config,
+		instanceId: installationId,
+		legacyInstanceId: config.instanceId
+	});
 }
 //#endregion
 //#region src/lan-setup.ts
@@ -16955,7 +17030,7 @@ async function stableInstanceId(loaded, template) {
 	if (loaded.kind !== "managed") return loaded.config.instanceId ?? template.instanceId;
 	return new X509Certificate(await readFile(loaded.setup.tls.caCertFile)).fingerprint256.replaceAll(":", "").toLowerCase();
 }
-function remoteGatewayConfig(template, publicOrigin, stateFile, instanceId, listenPort = 0) {
+function remoteGatewayConfig(template, publicOrigin, stateFile, instanceId, listenPort = 0, legacyInstanceId) {
 	const origin = new URL(publicOrigin);
 	if (origin.protocol !== "https:" || origin.username !== "" || origin.password !== "" || origin.pathname !== "/" || origin.search !== "" || origin.hash !== "") throw new Error("remote public origin must be an HTTPS origin");
 	const publicAuthority = origin.port === "" ? `${origin.hostname}:443` : origin.host;
@@ -16968,6 +17043,7 @@ function remoteGatewayConfig(template, publicOrigin, stateFile, instanceId, list
 		allowedCidrs: Object.freeze([parseCidr("127.0.0.0/8")]),
 		stateFile,
 		instanceId,
+		...legacyInstanceId === void 0 ? {} : { legacyInstanceId },
 		tls: Object.freeze({ mode: "disabled" }),
 		publicTls: true,
 		discovery: false
@@ -17028,11 +17104,11 @@ async function readFrpIngressTrustAnchor(settings, stateFile, ownedRoot = dirnam
 	}
 }
 /** Reuse remote HTTPS policy while binding a separately validated private HTTP origin. */
-function originGatewayConfig(template, settings, stateFile, instanceId, listenPort = settings.listenPort) {
+function originGatewayConfig(template, settings, stateFile, instanceId, listenPort = settings.listenPort, legacyInstanceId) {
 	const validated = parseOriginSettings(settings);
 	if (listenPort !== 0) validateOriginListenPort(listenPort);
 	return Object.freeze({
-		...remoteGatewayConfig(template, validated.publicOrigin, stateFile, instanceId, listenPort),
+		...remoteGatewayConfig(template, validated.publicOrigin, stateFile, instanceId, listenPort, legacyInstanceId),
 		listenHost: validated.listenHost,
 		allowedCidrs: Object.freeze(validated.allowedCidrs.map(parseCidr))
 	});
@@ -17115,6 +17191,7 @@ async function apply(ctx, config) {
 	const frpComponent = new FrpComponentManager({ stateDirectory });
 	await frpComponent.initialize();
 	const frpIdentity = await loadOrCreateInstallationId(join(stateDirectory, "installation-id"));
+	const remoteInstanceId = loaded.kind === "managed" ? frpIdentity : loaded.config.instanceId ?? frpIdentity;
 	const frpConfig = new FrpConfigStore(join(remoteDirectory, "frp", "config"), frpProxyName(frpIdentity), stateDirectory);
 	await frpConfig.initialize();
 	const originConfig = new OriginConfigStore(join(remoteDirectory, "origin", "config"), stateDirectory);
@@ -17166,10 +17243,10 @@ async function apply(ctx, config) {
 	let trustedNetworksWrite = Promise.resolve();
 	let adminClosing = false;
 	const startGateway = async (candidateConfig) => {
-		const resolved = parseGatewayConfig({
+		const resolved = withInstallationIdentity(parseGatewayConfig({
 			...candidateConfig,
 			upstreamOrigin: template.upstreamOrigin.origin
-		});
+		}), frpIdentity, candidateConfig.instanceId !== void 0);
 		const candidate = new MobileAccessGateway(resolved, new JsonDeviceStore(resolved.stateFile, resolved.maxDevices), mobileAccess, upstreamLoginUrl, webSocketPaths, blockedUpgradePaths, (source, code) => {
 			logger.warn("%s discovery degraded while DSH remains available: %s", source, code);
 		}, clientModulePreferences);
@@ -17227,7 +17304,7 @@ async function apply(ctx, config) {
 		}
 	}
 	const createRemoteGateway = async (publicOrigin, listenPort = 0) => {
-		const resolved = remoteGatewayConfig(template, publicOrigin, remoteDeviceFile, instanceId, listenPort);
+		const resolved = remoteGatewayConfig(template, publicOrigin, remoteDeviceFile, remoteInstanceId, listenPort, instanceId);
 		const candidate = new MobileAccessGateway(resolved, new JsonDeviceStore(resolved.stateFile, resolved.maxDevices), mobileAccess, upstreamLoginUrl, webSocketPaths, blockedUpgradePaths, void 0, clientModulePreferences);
 		await candidate.start();
 		return candidate;
@@ -17254,7 +17331,7 @@ async function apply(ctx, config) {
 		return candidate;
 	};
 	const createOriginGateway = async (settings) => {
-		const resolved = originGatewayConfig(template, settings, remoteDeviceFile, instanceId);
+		const resolved = originGatewayConfig(template, settings, remoteDeviceFile, remoteInstanceId, settings.listenPort, instanceId);
 		const candidate = new MobileAccessGateway(resolved, new JsonDeviceStore(resolved.stateFile, resolved.maxDevices), mobileAccess, upstreamLoginUrl, webSocketPaths, blockedUpgradePaths, void 0, clientModulePreferences);
 		try {
 			await candidate.start();
@@ -17273,7 +17350,7 @@ async function apply(ctx, config) {
 		store: createVolatileRemoteControlStore(),
 		component: caddyComponent,
 		config: caddyConfig,
-		instanceId,
+		instanceId: remoteInstanceId,
 		createGateway: (settings) => createRemoteGateway(settings.publicOrigin)
 	});
 	const originController = new ManagedOriginController({
@@ -17313,7 +17390,7 @@ async function apply(ctx, config) {
 			store: frpStore,
 			executable: frpComponent.executable,
 			config: frpConfig,
-			instanceId,
+			instanceId: remoteInstanceId,
 			createGateway: createFrpGateway,
 			/**
 			* Hand the start-up self-check the CA the app itself pins.