dsh-mobile 0.7.1 → 0.8.0

package/lib/index.d.mts

@@ -4,6 +4,7 @@ import { ChildProcessWithoutNullStreams } from "node:child_process";
 import { IncomingMessage } from "node:http";
 import { Readable } from "node:stream";
 import { Context, Service } from "@deepseek-ai/cordis";
+import "zod";
 import { WebRoute } from "@deepseek-ai/dsh-host-webserver";
 //#region src/storage.d.ts
 /** Persistent record containing only a digest of the long-lived device credential. */
@@ -106,6 +107,13 @@ interface DeviceProbeResult {
 }
 /** Why a short-lived Session ended; only device revocation is sent to clients. */
 type SessionEndReason = 'logout' | 'expired' | 'evicted' | 'revoked';
+/** Minimal persistent-device metadata safe for notification authorization decisions. */
+interface PersistentDeviceAuthorization {
+  readonly id: string;
+  readonly expiresAt: number;
+}
+/** Why a persistent-device removal is durably committed. */
+type DeviceRemovalReason = 'revoked' | 'reset';
 /** Safe device metadata returned by the loopback administration API. */
 interface DeviceSummary {
   readonly id: string;
@@ -140,6 +148,7 @@ export declare class AccessController {
   private pairPending;
   private readonly sessions;
   private readonly sessionEndedListeners;
+  private readonly devicesRemovedListeners;
   private mutation;
   private initialized;
   private closing;
@@ -152,6 +161,7 @@ export declare class AccessController {
   private snapshot;
   private nativeIdentity;
   private emitSessionEnded;
+  private emitDevicesRemoved;
   private removeSession;
   private pruneSessions;
   private createSession;
@@ -181,6 +191,11 @@ export declare class AccessController {
   revokeDevice(deviceId: string): Promise<boolean>;
   /** Remove every persistent credential and terminate every active Session. */
   resetDevices(): Promise<void>;
+  /**
+   * Read fresh persistent-device authorization metadata without changing credentials,
+   * last-seen state, Session state, or the backing store.
+   */
+  authorizedDevices(): Promise<readonly PersistentDeviceAuthorization[]>;
   /** Safe metadata for the loopback administration surface. */
   listDevices(): readonly DeviceSummary[];
   /** Pairing status without exposing the one-time secret. */
@@ -190,6 +205,8 @@ export declare class AccessController {
   };
   /** Subscribe gateway resources to Session logout, expiry, eviction, and device revocation. */
   onSessionEnded(listener: (authorization: SessionAuthorization, reason: SessionEndReason) => void): () => void;
+  /** Subscribe to durably committed removal of persistent-device authorization. */
+  onDevicesRemoved(listener: (ids: readonly string[], reason: DeviceRemovalReason) => void): () => void;
   /** Stop new operations, drain durable mutations, then clear volatile credentials. */
   close(): Promise<void>;
   private finishClose;
@@ -995,6 +1012,91 @@ export declare class MobileAccessService extends Service {
 /** Construct the service in a Cordis plugin without importing DSH internals. */
 export declare function createMobileAccessService(ctx: Context): MobileAccessService;
 //#endregion
+//#region src/mobile-push/contracts.d.ts
+type PushCategory = 'question' | 'plan' | 'approval' | 'response' | 'goal' | 'failure' | 'test';
+type PushPreferences = Readonly<Record<Exclude<PushCategory, 'test'>, boolean>>;
+type PushLocale = 'en' | 'zh-CN' | 'it';
+interface PushMutationGuard {
+  readonly ownerGeneration: number;
+  readonly registrationGeneration: number;
+}
+interface PushOwner {
+  readonly scopeId: string;
+  readonly deviceId: string;
+  readonly origin: string;
+}
+interface PushRecipientKey extends PushOwner {
+  readonly installationId: string;
+}
+interface PushSubscriptionData {
+  readonly endpoint: string;
+  readonly keys: {
+    readonly p256dh: string;
+    readonly auth: string;
+  };
+}
+interface PushRegistration extends PushRecipientKey {
+  readonly subscription: PushSubscriptionData;
+  readonly locale: PushLocale;
+  readonly preferences: PushPreferences;
+  readonly generation: number;
+  readonly keyFingerprint: string;
+  readonly enabled: boolean;
+  readonly health: 'ready' | 'suspended' | 'repair-required';
+}
+interface PushTarget {
+  readonly sessionId: string;
+  readonly interaction: 'current' | 'resolved';
+}
+interface PushEnrollment extends PushMutationGuard {
+  readonly installationId: string;
+  readonly subscription: PushSubscriptionData;
+  readonly locale: PushLocale;
+  readonly preferences: PushPreferences;
+  readonly keyFingerprint: string;
+}
+interface PushEnrollmentResult {
+  readonly registration: PushRegistration;
+  readonly mutationGeneration?: number;
+}
+interface PushConfig {
+  readonly available: boolean;
+  readonly publicKey?: string;
+  readonly keyFingerprint?: string;
+  readonly installationId: string;
+  readonly ownerGeneration: number;
+  readonly registrationGeneration: number;
+  readonly status: 'disabled' | 'enabled' | 'suspended' | 'repair-required';
+  readonly preferences: PushPreferences;
+}
+//#endregion
+//#region src/mobile-push/gateway.d.ts
+/** Trusted per-Gateway binding; authorization is freshly loaded from durable device storage. */
+interface PushGatewayOriginBinding {
+  readonly scopeId: string;
+  readonly origin: string;
+  readonly authorizedDevices: () => Promise<readonly PersistentDeviceAuthorization[]>;
+}
+/** Authenticated Gateway facade; ownership fields are derived by trusted server code. */
+interface PushGatewayService {
+  /** Attaches one exact scope/origin lane and returns its idempotent detach disposer. */
+  attachOrigin?(binding: PushGatewayOriginBinding): () => void;
+  /** Persistently removes notification state after a durable device-auth removal. */
+  invalidateDevices?(scopeId: string, deviceIds: readonly string[]): Promise<void>;
+  /** Explicit desktop-admin key reset; does not mutate pairing/device authorization. */
+  reset?(): Promise<void>;
+  config(owner: PushOwner, installationId: string): Promise<PushConfig>;
+  enroll(owner: PushOwner, input: PushEnrollment): Promise<PushEnrollmentResult>;
+  preferences(owner: PushOwner, installationId: string, value: PushPreferences, guard: PushMutationGuard): Promise<PushRegistration>;
+  /** No generation is an unconditional owner disable; ifGeneration is stale-attempt cleanup only. */
+  disable(owner: PushOwner, installationId: string, ifGeneration?: number): Promise<void>;
+  /** Explicit logout disables persistent consent before the session is cleared. */
+  logout(owner: PushOwner): Promise<void>;
+  /** Resolves only an owned, still-valid opaque reference. */
+  test(owner: PushOwner, installationId: string): Promise<void>;
+  resolve(owner: PushOwner, reference: string): Promise<PushTarget | undefined>;
+}
+//#endregion
 //#region src/gateway.d.ts
 /** A graph-selection conflict with a bounded diagnostic safe for authenticated callers. */
 export declare class ClientModuleConflictError extends HttpError {
@@ -1011,6 +1113,7 @@ export declare class MobileAccessGateway {
   private readonly extraWebSocketPaths?;
   private readonly blockedUpgradeLog?;
   private readonly onDiscoveryDegraded?;
+  private readonly pushGateway?;
   readonly access: AccessController;
   private readonly listenerTlsEnabled;
   private readonly tlsEnabled;
@@ -1058,6 +1161,10 @@ export declare class MobileAccessGateway {
   private started;
   private closeTask;
   private readonly removeSessionListener;
+  private readonly removePushDeviceListener;
+  private detachPushOrigin;
+  private readonly pushDeviceRevocations;
+  private readonly pushTestsInFlight;
   private readonly removeExtensionContentListener;
   private readonly renewFailureLimiter;
   private readonly renewDeviceLimiter;
@@ -1079,7 +1186,7 @@ export declare class MobileAccessGateway {
   private readonly upstreamAuthDiagnostics;
   constructor(config: ResolvedGatewayConfig, store: DeviceStore, extensions?: MobileAccessService | undefined, upstreamAuthenticatedUrl?: string | undefined, extraWebSocketPaths?: {
     has(pathname: string): boolean;
-  } | undefined, blockedUpgradeLog?: BlockedUpgradePathLog | undefined, onDiscoveryDegraded?: ((source: 'broadcast' | 'mdns', code: string) => void) | undefined, clientModulePreferences?: ClientModulePreferenceStore, authFailureLog?: (entry: AuthFailureEntry) => void, httpFailureLog?: (entry: HttpFailureEntry) => void, upstreamAuthLog?: (entry: UpstreamAuthEntry) => void, apiLatencyLog?: (entry: ApiLatencyEntry) => void);
+  } | undefined, blockedUpgradeLog?: BlockedUpgradePathLog | undefined, onDiscoveryDegraded?: ((source: 'broadcast' | 'mdns', code: string) => void) | undefined, clientModulePreferences?: ClientModulePreferenceStore, authFailureLog?: (entry: AuthFailureEntry) => void, httpFailureLog?: (entry: HttpFailureEntry) => void, upstreamAuthLog?: (entry: UpstreamAuthEntry) => void, apiLatencyLog?: (entry: ApiLatencyEntry) => void, pushGateway?: PushGatewayService | undefined);
   /** Initialize durable state, validate TLS, and bind the externally reachable listener. */
   start(): Promise<void>;
   /** Install a newly signed provided leaf for future TLS handshakes without dropping sessions. */
@@ -1127,6 +1234,8 @@ export declare class MobileAccessGateway {
   private handleNativePair;
   private handleNativeRenew;
   private handleNativeProbe;
+  private requireFreshPushOwner;
+  private handleMobilePushRequest;
   private handleLogout;
   private handleExternalRequest;
   private handleExtensionRequest;
@@ -1200,6 +1309,20 @@ export declare class MobileAccessGateway {
    * cached for a short window.
    */
   private upstreamBundleSize;
+  /**
+   * Name the compatibility bundle by content, so a reload asks for it by revision.
+   *
+   * The digest is computed from the bytes on every page load rather than memoised on
+   * a modification-time signature: an edit that keeps the length and restores the
+   * timestamp (a build step preserving mtime, a same-size patch) is invisible to such
+   * a signature, and the document would then name a revision the route refuses with
+   * `404` — losing the shim exactly on the old WebViews it exists for. Hashing the
+   * ~78 KB bundle costs far less than the page load it belongs to.
+   *
+   * A missing bundle keeps the plain path, where the route reports the usual `503`
+   * instead of handing the document a URL that cannot exist.
+   */
+  private mobileCompatibilityUrl;
   private serveMobileBootBatch;
   private startMobileBootBatchAssembly;
   private assembleMobileBootBatch;