dsh-mobile 0.6.7 → 0.6.9

package/lib/index.d.mts

@@ -14,17 +14,21 @@ interface StoredDevice {
   readonly createdAt: number;
   readonly expiresAt: number;
   readonly lastSeenAt: number;
+  /** Native pairing identity bound to this credential; older records omit it. */
+  readonly nativeInstanceId?: string;
   /** Legacy tombstone accepted on load; AccessController removes it during initialization. */
   readonly revokedAt?: number;
 }
 /** Versioned device state. Raw device and Session credentials are never members. */
 interface DeviceSnapshot {
-  readonly version: 1;
+  readonly version: 1 | 2;
   readonly devices: readonly StoredDevice[];
 }
 /** Persistence seam for device-token digests and revocation metadata. */
 interface DeviceStore {
+  /** Read either supported version without assigning identities to legacy rows. */
   load(): Promise<DeviceSnapshot>;
+  /** Validate and persist version 2, retaining any credential identity bindings. */
   save(snapshot: DeviceSnapshot): Promise<void>;
 }
 /** Validate durable data before it can authorize a device. */
@@ -64,10 +68,15 @@ interface AccessControllerOptions {
   readonly rateLimitWindowMs: number;
   readonly maxPairingAttempts: number;
   readonly maxRateLimitKeys: number;
+  /** Native identity stored with newly paired device credentials. */
+  readonly pairingInstanceId?: string;
+  /** Native response identity for older credentials without a stored binding. */
+  readonly legacyInstanceId?: string;
   readonly now?: () => number;
 }
 /** Values issued once after pairing; only digests survive the response. */
 interface PairingResult {
+  readonly nativeInstanceId?: string;
   readonly deviceId: string;
   readonly deviceToken: string;
   readonly deviceExpiresAt: number;
@@ -77,6 +86,7 @@ interface PairingResult {
 }
 /** Values issued after renewal with the persistent HttpOnly device Cookie. */
 interface RenewalResult {
+  readonly nativeInstanceId?: string;
   readonly deviceId: string;
   readonly sessionToken: string;
   readonly csrfToken: string;
@@ -90,6 +100,7 @@ interface SessionAuthorization {
 }
 /** Result of a persistent-device reachability check without opening a Session. */
 interface DeviceProbeResult {
+  readonly nativeInstanceId?: string;
   readonly deviceId: string;
   readonly deviceExpiresAt: number;
 }
@@ -136,6 +147,7 @@ export declare class AccessController {
   private requireInitialized;
   private exclusive;
   private snapshot;
+  private nativeIdentity;
   private emitSessionEnded;
   private removeSession;
   private pruneSessions;
@@ -377,6 +389,8 @@ interface ResolvedGatewayConfig {
   readonly excludedClientModules: readonly string[];
   readonly websocketCompression: ResolvedWebSocketCompressionConfig;
   readonly instanceId: string;
+  /** Identity returned only for authenticated legacy native credentials without a stored binding. */
+  readonly legacyInstanceId?: string;
   readonly pairingCaFile?: string;
   readonly tls: TlsConfig;
   /** Whether the public hop is HTTPS, even when a trusted loopback proxy terminates TLS. */
@@ -1000,6 +1014,8 @@ export declare class MobileAccessGateway {
   private setBrowserDeviceBinding;
   private handlePair;
   private handleRenew;
+  /** CA-backed entries retain their pin; public entries project the authenticated credential's identity. */
+  private nativeResponseInstanceId;
   private handleNativePair;
   private handleNativeRenew;
   private handleNativeProbe;
@@ -2292,7 +2308,7 @@ export declare const name = "dsh-mobile";
 /** The stock WebServer serves the control card; Connection authenticates the loopback DSH origin. */
 export declare const inject: string[];
 /** Reuse remote HTTPS policy while binding a separately validated private HTTP origin. */
-export declare function originGatewayConfig(template: ResolvedGatewayConfig, settings: OriginSettings, stateFile: string, instanceId: string, listenPort?: number): ResolvedGatewayConfig;
+export declare function originGatewayConfig(template: ResolvedGatewayConfig, settings: OriginSettings, stateFile: string, instanceId: string, listenPort?: number, legacyInstanceId?: string): ResolvedGatewayConfig;
 /** Mount the resident control route and its optional authenticated LAN gateway. */
 export declare function apply(ctx: Context, config: PluginConfig): Promise<void>;
 //#endregion