@undefineds.co/xpod 0.3.15 → 0.3.17

package/dist/identity/oidc/AutoDetectIdentityProviderHandler.jsonld

@@ -12,7 +12,7 @@
       "extends": [
         "css:dist/server/HttpHandler.jsonld#HttpHandler"
       ],
-      "comment": "Auto-detect Identity Provider Handler  自动检测运行模式： - 如果配置了 oidcIssuer -> SP 模式：禁用本地账户管理 - 如果没有配置 oidcIssuer -> 标准模式：委托给 CSS 默认 Handler",
+      "comment": "Auto-detect Identity Provider Handler  Local SP mode still needs the local `/.account/*` surface: CSS keeps the OIDC interaction and the scoped WebID picker here, while token validation can trust the configured external issuer. Disabling this surface makes LinX fall back to the Cloud issuer and lets Cloud Pods leak into a Local login flow.",
       "parameters": [
         {
           "@id": "undefineds:dist/identity/oidc/AutoDetectIdentityProviderHandler.jsonld#AutoDetectIdentityProviderHandler_options_oidcIssuer",
@@ -25,7 +25,7 @@
               }
             ]
           },
-          "comment": "外部 IdP 的基础 URL，如果提供则启用 SP 模式"
+          "comment": "外部 IdP 的基础 URL，如果提供则启用 Local SP mode."
         },
         {
           "@id": "undefineds:dist/identity/oidc/AutoDetectIdentityProviderHandler.jsonld#AutoDetectIdentityProviderHandler_options_message",
@@ -38,7 +38,7 @@
               }
             ]
           },
-          "comment": "禁用时的消息"
+          "comment": "Message used when no source handler is available."
         },
         {
           "@id": "undefineds:dist/identity/oidc/AutoDetectIdentityProviderHandler.jsonld#AutoDetectIdentityProviderHandler_options_source",
@@ -51,7 +51,7 @@
               }
             ]
           },
-          "comment": "CSS 默认的 IdentityProviderHandler，标准模式下委托给它"
+          "comment": "CSS IdentityProviderHandler that owns account, consent and WebID selection routes."
         }
       ],
       "memberFields": [

package/dist/identity/oidc/AutoDetectOidcHandler.d.ts

@@ -1,8 +1,8 @@
 import { HttpHandler, type HttpHandlerInput } from '@solid/community-server';
 export interface AutoDetectOidcHandlerOptions {
-    /** 外部 IdP 的基础 URL，如果提供则启用 SP 模式 */
+    /** External OIDC issuer base URL used as the trust source for Local SP mode. */
     oidcIssuer?: string;
-    /** 禁用原因说明 */
+    /** Explanation used when this handler declines non-JWKS OIDC routes. */
     message?: string;
     /** JWKS 缓存时间 (ms) */
     cacheMs?: number;
@@ -11,9 +11,13 @@ export interface AutoDetectOidcHandlerOptions {
  * Auto-detect OIDC Handler
  *
  * 自动检测运行模式：
- * - 如果配置了 oidcIssuer -> SP 模式：禁用本地 OIDC，代理外部 IdP 的 JWKS
+ * - 如果配置了 oidcIssuer -> Local SP 模式：只代理外部 issuer 的 JWKS
  * - 如果没有配置 oidcIssuer -> 标准模式：所有 OIDC 请求透传（由 CSS 默认 Handler 处理）
  *
+ * 注意：Local SP 模式不能禁用本地 account/consent。OIDC 交互页面和
+ * scoped WebID picker 必须继续由本地 CSS 提供，否则 Local 登录会退回
+ * Cloud consent 并暴露 Cloud Pod。
+ *
  * 使用方式：在 HTTP pipeline 中替换默认的 OidcHandler
  */
 export declare class AutoDetectOidcHandler extends HttpHandler {
@@ -26,7 +30,7 @@ export declare class AutoDetectOidcHandler extends HttpHandler {
     constructor(options?: AutoDetectOidcHandlerOptions);
     /**
      * 判断是否处理请求
-     * - SP 模式：只处理 JWKS 请求，其他 OIDC 请求返回 501
+     * - Local SP 模式：只处理 JWKS 请求，其他 OIDC 请求透传给 CSS 本地 OIDC handler
      * - 标准模式：不处理任何请求（透传给 CSS 默认 Handler）
      */
     canHandle({ request }: HttpHandlerInput): Promise<void>;

package/dist/identity/oidc/AutoDetectOidcHandler.js

@@ -8,9 +8,13 @@ const community_server_1 = require("@solid/community-server");
  * Auto-detect OIDC Handler
  *
  * 自动检测运行模式：
- * - 如果配置了 oidcIssuer -> SP 模式：禁用本地 OIDC，代理外部 IdP 的 JWKS
+ * - 如果配置了 oidcIssuer -> Local SP 模式：只代理外部 issuer 的 JWKS
  * - 如果没有配置 oidcIssuer -> 标准模式：所有 OIDC 请求透传（由 CSS 默认 Handler 处理）
  *
+ * 注意：Local SP 模式不能禁用本地 account/consent。OIDC 交互页面和
+ * scoped WebID picker 必须继续由本地 CSS 提供，否则 Local 登录会退回
+ * Cloud consent 并暴露 Cloud Pod。
+ *
  * 使用方式：在 HTTP pipeline 中替换默认的 OidcHandler
  */
 class AutoDetectOidcHandler extends community_server_1.HttpHandler {
@@ -19,10 +23,10 @@ class AutoDetectOidcHandler extends community_server_1.HttpHandler {
         this.logger = (0, global_logger_factory_1.getLoggerFor)(this);
         this.oidcIssuer = options.oidcIssuer;
         this.jwksUrl = this.oidcIssuer ? `${this.oidcIssuer.replace(/\/$/, '')}/.oidc/jwks` : undefined;
-        this.message = options.message ?? 'OIDC disabled in storage provider mode';
+        this.message = options.message ?? 'OIDC route handled by local CSS OIDC handler';
         this.cacheMs = options.cacheMs ?? 300000; // 默认 5 分钟
         if (this.oidcIssuer) {
-            this.logger.info(`SP mode enabled, external IdP: ${this.oidcIssuer}, JWKS: ${this.jwksUrl}`);
+            this.logger.info(`Local SP mode enabled, external issuer: ${this.oidcIssuer}, JWKS: ${this.jwksUrl}`);
         }
         else {
             this.logger.info('Standard mode enabled, OIDC requests will pass through');
@@ -30,7 +34,7 @@ class AutoDetectOidcHandler extends community_server_1.HttpHandler {
     }
     /**
      * 判断是否处理请求
-     * - SP 模式：只处理 JWKS 请求，其他 OIDC 请求返回 501
+     * - Local SP 模式：只处理 JWKS 请求，其他 OIDC 请求透传给 CSS 本地 OIDC handler
      * - 标准模式：不处理任何请求（透传给 CSS 默认 Handler）
      */
     async canHandle({ request }) {
@@ -43,9 +47,9 @@ class AutoDetectOidcHandler extends community_server_1.HttpHandler {
         if (!this.jwksUrl) {
             throw new community_server_1.NotImplementedHttpError('Pass through to default OIDC handler');
         }
-        // SP 模式：只有 JWKS 请求可以处理
+        // Local SP 模式：只有 JWKS 请求由这里处理，其它 OIDC 路由交给 CSS 本地 handler
         if (!this.isJwksPath(url)) {
-            throw new community_server_1.NotImplementedHttpError(`External IdP mode: ${this.message}. Authentication handled by external IdP.`);
+            throw new community_server_1.NotImplementedHttpError(`Local SP mode: ${this.message}.`);
         }
     }
     /**

package/dist/identity/oidc/AutoDetectOidcHandler.js.map

@@ -1 +1 @@
-{"version":3,"file":"AutoDetectOidcHandler.js","sourceRoot":"","sources":["../../../src/identity/oidc/AutoDetectOidcHandler.ts"],"names":[],"mappings":";;;AAAA,uCAA+B;AAC/B,iEAAqD;AACrD,8DAKiC;AAgBjC;;;;;;;;GAQG;AACH,MAAa,qBAAsB,SAAQ,8BAAW;IAQpD,YAAY,UAAwC,EAAE;QACpD,KAAK,EAAE,CAAC;QARO,WAAM,GAAG,IAAA,oCAAY,EAAC,IAAI,CAAC,CAAC;QAS3C,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC;QAChG,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,wCAAwC,CAAC;QAC3E,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,MAAM,CAAC,CAAC,UAAU;QAEpD,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kCAAkC,IAAI,CAAC,UAAU,WAAW,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/F,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;IAED;;;;OAIG;IACa,KAAK,CAAC,SAAS,CAAC,EAAE,OAAO,EAAoB;QAC3D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC;QAE9B,gBAAgB;QAChB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,0CAAuB,CAAC,qBAAqB,CAAC,CAAC;QAC3D,CAAC;QAED,8BAA8B;QAC9B,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,0CAAuB,CAAC,sCAAsC,CAAC,CAAC;QAC5E,CAAC;QAED,uBAAuB;QACvB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,0CAAuB,CAC/B,sBAAsB,IAAI,CAAC,OAAO,2CAA2C,CAC9E,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;OAIG;IACa,KAAK,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAoB;QACzD,eAAe;QACf,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,sCAAmB,CAAC,mEAAmE,CAAC,CAAC;QACrG,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;YAEpC,QAAQ,CAAC,UAAU,GAAG,GAAG,CAAC;YAC1B,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;YACvD,QAAQ,CAAC,SAAS,CAAC,eAAe,EAAE,mBAAmB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC;YAC1F,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;YAEnC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAuB,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;YACpE,MAAM,IAAI,sCAAmB,CAAC,8BAA8B,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,SAAS;QACrB,OAAO;QACP,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC5D,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;YAC3C,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QACvC,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtD,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QAExD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE;YACpC,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;SACxC,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;QAC3E,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAyB,CAAC;QAErD,aAAa;QACb,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC7D,CAAC;QAED,OAAO;QACP,IAAI,CAAC,SAAS,GAAG;YACf,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO;SACrC,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,IAAI,CAAC,IAAI,CAAC,MAAM,OAAO,CAAC,CAAC;QAC/D,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACK,UAAU,CAAC,GAAW;QAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACvC,OAAO,CACL,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC;YAC9B,QAAQ,KAAK,mCAAmC;YAChD,QAAQ,KAAK,yCAAyC;YACtD,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAC7B,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,UAAU,CAAC,GAAW;QAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACvC,OAAO,QAAQ,KAAK,aAAa,IAAI,QAAQ,KAAK,kBAAkB,CAAC;IACvE,CAAC;IAED;;OAEG;IACK,WAAW,CAAC,GAAW;QAC7B,IAAI,CAAC;YACH,OAAO,IAAI,cAAG,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,2BAA2B;YAC3B,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;CACF;AAnJD,sDAmJC","sourcesContent":["import { URL } from 'node:url';\nimport { getLoggerFor } from 'global-logger-factory';\nimport {\n  HttpHandler,\n  type HttpHandlerInput,\n  NotImplementedHttpError,\n  InternalServerError,\n} from '@solid/community-server';\n\nexport interface AutoDetectOidcHandlerOptions {\n  /** 外部 IdP 的基础 URL，如果提供则启用 SP 模式 */\n  oidcIssuer?: string;\n  /** 禁用原因说明 */\n  message?: string;\n  /** JWKS 缓存时间 (ms) */\n  cacheMs?: number;\n}\n\ninterface JwksCache {\n  keys: unknown[];\n  expiresAt: number;\n}\n\n/**\n * Auto-detect OIDC Handler\n *\n * 自动检测运行模式：\n * - 如果配置了 oidcIssuer -> SP 模式：禁用本地 OIDC，代理外部 IdP 的 JWKS\n * - 如果没有配置 oidcIssuer -> 标准模式：所有 OIDC 请求透传（由 CSS 默认 Handler 处理）\n *\n * 使用方式：在 HTTP pipeline 中替换默认的 OidcHandler\n */\nexport class AutoDetectOidcHandler extends HttpHandler {\n  private readonly logger = getLoggerFor(this);\n  private readonly oidcIssuer?: string;\n  private readonly jwksUrl?: string;\n  private readonly message: string;\n  private readonly cacheMs: number;\n  private jwksCache?: JwksCache;\n\n  constructor(options: AutoDetectOidcHandlerOptions = {}) {\n    super();\n    this.oidcIssuer = options.oidcIssuer;\n    this.jwksUrl = this.oidcIssuer ? `${this.oidcIssuer.replace(/\\/$/, '')}/.oidc/jwks` : undefined;\n    this.message = options.message ?? 'OIDC disabled in storage provider mode';\n    this.cacheMs = options.cacheMs ?? 300000; // 默认 5 分钟\n\n    if (this.oidcIssuer) {\n      this.logger.info(`SP mode enabled, external IdP: ${this.oidcIssuer}, JWKS: ${this.jwksUrl}`);\n    } else {\n      this.logger.info('Standard mode enabled, OIDC requests will pass through');\n    }\n  }\n\n  /**\n   * 判断是否处理请求\n   * - SP 模式：只处理 JWKS 请求，其他 OIDC 请求返回 501\n   * - 标准模式：不处理任何请求（透传给 CSS 默认 Handler）\n   */\n  public override async canHandle({ request }: HttpHandlerInput): Promise<void> {\n    const url = request.url ?? '';\n\n    // 检查是否是 OIDC 路径\n    if (!this.isOidcPath(url)) {\n      throw new NotImplementedHttpError('Not an OIDC request');\n    }\n\n    // 标准模式：不处理，透传给 CSS 默认 Handler\n    if (!this.jwksUrl) {\n      throw new NotImplementedHttpError('Pass through to default OIDC handler');\n    }\n\n    // SP 模式：只有 JWKS 请求可以处理\n    if (!this.isJwksPath(url)) {\n      throw new NotImplementedHttpError(\n        `External IdP mode: ${this.message}. Authentication handled by external IdP.`\n      );\n    }\n  }\n\n  /**\n   * 处理请求\n   * - SP 模式：代理 JWKS\n   * - 标准模式：不应该到达这里\n   */\n  public override async handle({ response }: HttpHandlerInput): Promise<void> {\n    // 标准模式：不应该到达这里\n    if (!this.jwksUrl) {\n      throw new InternalServerError('AutoDetectOidcHandler should not handle requests in standard mode');\n    }\n\n    try {\n      const jwks = await this.fetchJwks();\n\n      response.statusCode = 200;\n      response.setHeader('Content-Type', 'application/json');\n      response.setHeader('Cache-Control', `public, max-age=${Math.floor(this.cacheMs / 1000)}`);\n      response.end(JSON.stringify(jwks));\n\n      this.logger.debug('JWKS proxy successful');\n    } catch (error) {\n      this.logger.error(`JWKS proxy failed: ${(error as Error).message}`);\n      throw new InternalServerError('Failed to proxy JWKS request', { cause: error });\n    }\n  }\n\n  /**\n   * 获取并缓存 JWKS\n   */\n  private async fetchJwks(): Promise<{ keys: unknown[] }> {\n    // 检查缓存\n    if (this.jwksCache && this.jwksCache.expiresAt > Date.now()) {\n      this.logger.debug('Returning cached JWKS');\n      return { keys: this.jwksCache.keys };\n    }\n\n    if (!this.jwksUrl) {\n      throw new Error('External JWKS URL not configured');\n    }\n\n    this.logger.debug(`Fetching JWKS from ${this.jwksUrl}`);\n\n    const res = await fetch(this.jwksUrl, {\n      headers: { Accept: 'application/json' },\n    });\n\n    if (!res.ok) {\n      throw new Error(`Failed to fetch JWKS: ${res.status} ${res.statusText}`);\n    }\n\n    const jwks = await res.json() as { keys: unknown[] };\n\n    // 验证 JWKS 格式\n    if (!Array.isArray(jwks.keys)) {\n      throw new Error('Invalid JWKS format: missing keys array');\n    }\n\n    // 更新缓存\n    this.jwksCache = {\n      keys: jwks.keys,\n      expiresAt: Date.now() + this.cacheMs,\n    };\n\n    this.logger.debug(`JWKS cached with ${jwks.keys.length} keys`);\n    return jwks;\n  }\n\n  /**\n   * 检查是否是 OIDC 路径\n   */\n  private isOidcPath(url: string): boolean {\n    const pathname = this.getPathname(url);\n    return (\n      pathname.startsWith('/.oidc/') ||\n      pathname === '/.well-known/openid-configuration' ||\n      pathname === '/.well-known/oauth-authorization-server' ||\n      pathname.startsWith('/idp/')\n    );\n  }\n\n  /**\n   * 检查是否是 JWKS 路径\n   */\n  private isJwksPath(url: string): boolean {\n    const pathname = this.getPathname(url);\n    return pathname === '/.oidc/jwks' || pathname === '/.oidc/jwks.json';\n  }\n\n  /**\n   * 从 URL 提取 pathname\n   */\n  private getPathname(url: string): string {\n    try {\n      return new URL(url, 'http://localhost').pathname;\n    } catch {\n      // 如果解析失败，直接返回 url（可能是相对路径）\n      return url.split('?')[0];\n    }\n  }\n}\n"]}
+{"version":3,"file":"AutoDetectOidcHandler.js","sourceRoot":"","sources":["../../../src/identity/oidc/AutoDetectOidcHandler.ts"],"names":[],"mappings":";;;AAAA,uCAA+B;AAC/B,iEAAqD;AACrD,8DAKiC;AAgBjC;;;;;;;;;;;;GAYG;AACH,MAAa,qBAAsB,SAAQ,8BAAW;IAQpD,YAAY,UAAwC,EAAE;QACpD,KAAK,EAAE,CAAC;QARO,WAAM,GAAG,IAAA,oCAAY,EAAC,IAAI,CAAC,CAAC;QAS3C,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC;QAChG,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,8CAA8C,CAAC;QACjF,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,MAAM,CAAC,CAAC,UAAU;QAEpD,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2CAA2C,IAAI,CAAC,UAAU,WAAW,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QACxG,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;IAED;;;;OAIG;IACa,KAAK,CAAC,SAAS,CAAC,EAAE,OAAO,EAAoB;QAC3D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC;QAE9B,gBAAgB;QAChB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,0CAAuB,CAAC,qBAAqB,CAAC,CAAC;QAC3D,CAAC;QAED,8BAA8B;QAC9B,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,0CAAuB,CAAC,sCAAsC,CAAC,CAAC;QAC5E,CAAC;QAED,0DAA0D;QAC1D,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,0CAAuB,CAC/B,kBAAkB,IAAI,CAAC,OAAO,GAAG,CAClC,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;OAIG;IACa,KAAK,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAoB;QACzD,eAAe;QACf,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,sCAAmB,CAAC,mEAAmE,CAAC,CAAC;QACrG,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;YAEpC,QAAQ,CAAC,UAAU,GAAG,GAAG,CAAC;YAC1B,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;YACvD,QAAQ,CAAC,SAAS,CAAC,eAAe,EAAE,mBAAmB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC;YAC1F,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;YAEnC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAuB,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;YACpE,MAAM,IAAI,sCAAmB,CAAC,8BAA8B,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,SAAS;QACrB,OAAO;QACP,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC5D,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;YAC3C,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QACvC,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtD,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QAExD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE;YACpC,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;SACxC,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;QAC3E,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAyB,CAAC;QAErD,aAAa;QACb,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC7D,CAAC;QAED,OAAO;QACP,IAAI,CAAC,SAAS,GAAG;YACf,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO;SACrC,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,IAAI,CAAC,IAAI,CAAC,MAAM,OAAO,CAAC,CAAC;QAC/D,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACK,UAAU,CAAC,GAAW;QAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACvC,OAAO,CACL,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC;YAC9B,QAAQ,KAAK,mCAAmC;YAChD,QAAQ,KAAK,yCAAyC;YACtD,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAC7B,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,UAAU,CAAC,GAAW;QAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACvC,OAAO,QAAQ,KAAK,aAAa,IAAI,QAAQ,KAAK,kBAAkB,CAAC;IACvE,CAAC;IAED;;OAEG;IACK,WAAW,CAAC,GAAW;QAC7B,IAAI,CAAC;YACH,OAAO,IAAI,cAAG,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,2BAA2B;YAC3B,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;CACF;AAnJD,sDAmJC","sourcesContent":["import { URL } from 'node:url';\nimport { getLoggerFor } from 'global-logger-factory';\nimport {\n  HttpHandler,\n  type HttpHandlerInput,\n  NotImplementedHttpError,\n  InternalServerError,\n} from '@solid/community-server';\n\nexport interface AutoDetectOidcHandlerOptions {\n  /** External OIDC issuer base URL used as the trust source for Local SP mode. */\n  oidcIssuer?: string;\n  /** Explanation used when this handler declines non-JWKS OIDC routes. */\n  message?: string;\n  /** JWKS 缓存时间 (ms) */\n  cacheMs?: number;\n}\n\ninterface JwksCache {\n  keys: unknown[];\n  expiresAt: number;\n}\n\n/**\n * Auto-detect OIDC Handler\n *\n * 自动检测运行模式：\n * - 如果配置了 oidcIssuer -> Local SP 模式：只代理外部 issuer 的 JWKS\n * - 如果没有配置 oidcIssuer -> 标准模式：所有 OIDC 请求透传（由 CSS 默认 Handler 处理）\n *\n * 注意：Local SP 模式不能禁用本地 account/consent。OIDC 交互页面和\n * scoped WebID picker 必须继续由本地 CSS 提供，否则 Local 登录会退回\n * Cloud consent 并暴露 Cloud Pod。\n *\n * 使用方式：在 HTTP pipeline 中替换默认的 OidcHandler\n */\nexport class AutoDetectOidcHandler extends HttpHandler {\n  private readonly logger = getLoggerFor(this);\n  private readonly oidcIssuer?: string;\n  private readonly jwksUrl?: string;\n  private readonly message: string;\n  private readonly cacheMs: number;\n  private jwksCache?: JwksCache;\n\n  constructor(options: AutoDetectOidcHandlerOptions = {}) {\n    super();\n    this.oidcIssuer = options.oidcIssuer;\n    this.jwksUrl = this.oidcIssuer ? `${this.oidcIssuer.replace(/\\/$/, '')}/.oidc/jwks` : undefined;\n    this.message = options.message ?? 'OIDC route handled by local CSS OIDC handler';\n    this.cacheMs = options.cacheMs ?? 300000; // 默认 5 分钟\n\n    if (this.oidcIssuer) {\n      this.logger.info(`Local SP mode enabled, external issuer: ${this.oidcIssuer}, JWKS: ${this.jwksUrl}`);\n    } else {\n      this.logger.info('Standard mode enabled, OIDC requests will pass through');\n    }\n  }\n\n  /**\n   * 判断是否处理请求\n   * - Local SP 模式：只处理 JWKS 请求，其他 OIDC 请求透传给 CSS 本地 OIDC handler\n   * - 标准模式：不处理任何请求（透传给 CSS 默认 Handler）\n   */\n  public override async canHandle({ request }: HttpHandlerInput): Promise<void> {\n    const url = request.url ?? '';\n\n    // 检查是否是 OIDC 路径\n    if (!this.isOidcPath(url)) {\n      throw new NotImplementedHttpError('Not an OIDC request');\n    }\n\n    // 标准模式：不处理，透传给 CSS 默认 Handler\n    if (!this.jwksUrl) {\n      throw new NotImplementedHttpError('Pass through to default OIDC handler');\n    }\n\n    // Local SP 模式：只有 JWKS 请求由这里处理，其它 OIDC 路由交给 CSS 本地 handler\n    if (!this.isJwksPath(url)) {\n      throw new NotImplementedHttpError(\n        `Local SP mode: ${this.message}.`\n      );\n    }\n  }\n\n  /**\n   * 处理请求\n   * - SP 模式：代理 JWKS\n   * - 标准模式：不应该到达这里\n   */\n  public override async handle({ response }: HttpHandlerInput): Promise<void> {\n    // 标准模式：不应该到达这里\n    if (!this.jwksUrl) {\n      throw new InternalServerError('AutoDetectOidcHandler should not handle requests in standard mode');\n    }\n\n    try {\n      const jwks = await this.fetchJwks();\n\n      response.statusCode = 200;\n      response.setHeader('Content-Type', 'application/json');\n      response.setHeader('Cache-Control', `public, max-age=${Math.floor(this.cacheMs / 1000)}`);\n      response.end(JSON.stringify(jwks));\n\n      this.logger.debug('JWKS proxy successful');\n    } catch (error) {\n      this.logger.error(`JWKS proxy failed: ${(error as Error).message}`);\n      throw new InternalServerError('Failed to proxy JWKS request', { cause: error });\n    }\n  }\n\n  /**\n   * 获取并缓存 JWKS\n   */\n  private async fetchJwks(): Promise<{ keys: unknown[] }> {\n    // 检查缓存\n    if (this.jwksCache && this.jwksCache.expiresAt > Date.now()) {\n      this.logger.debug('Returning cached JWKS');\n      return { keys: this.jwksCache.keys };\n    }\n\n    if (!this.jwksUrl) {\n      throw new Error('External JWKS URL not configured');\n    }\n\n    this.logger.debug(`Fetching JWKS from ${this.jwksUrl}`);\n\n    const res = await fetch(this.jwksUrl, {\n      headers: { Accept: 'application/json' },\n    });\n\n    if (!res.ok) {\n      throw new Error(`Failed to fetch JWKS: ${res.status} ${res.statusText}`);\n    }\n\n    const jwks = await res.json() as { keys: unknown[] };\n\n    // 验证 JWKS 格式\n    if (!Array.isArray(jwks.keys)) {\n      throw new Error('Invalid JWKS format: missing keys array');\n    }\n\n    // 更新缓存\n    this.jwksCache = {\n      keys: jwks.keys,\n      expiresAt: Date.now() + this.cacheMs,\n    };\n\n    this.logger.debug(`JWKS cached with ${jwks.keys.length} keys`);\n    return jwks;\n  }\n\n  /**\n   * 检查是否是 OIDC 路径\n   */\n  private isOidcPath(url: string): boolean {\n    const pathname = this.getPathname(url);\n    return (\n      pathname.startsWith('/.oidc/') ||\n      pathname === '/.well-known/openid-configuration' ||\n      pathname === '/.well-known/oauth-authorization-server' ||\n      pathname.startsWith('/idp/')\n    );\n  }\n\n  /**\n   * 检查是否是 JWKS 路径\n   */\n  private isJwksPath(url: string): boolean {\n    const pathname = this.getPathname(url);\n    return pathname === '/.oidc/jwks' || pathname === '/.oidc/jwks.json';\n  }\n\n  /**\n   * 从 URL 提取 pathname\n   */\n  private getPathname(url: string): string {\n    try {\n      return new URL(url, 'http://localhost').pathname;\n    } catch {\n      // 如果解析失败，直接返回 url（可能是相对路径）\n      return url.split('?')[0];\n    }\n  }\n}\n"]}

package/dist/identity/oidc/AutoDetectOidcHandler.jsonld

@@ -12,7 +12,7 @@
       "extends": [
         "css:dist/server/HttpHandler.jsonld#HttpHandler"
       ],
-      "comment": "Auto-detect OIDC Handler  自动检测运行模式： - 如果配置了 oidcIssuer -> SP 模式：禁用本地 OIDC，代理外部 IdP 的 JWKS - 如果没有配置 oidcIssuer -> 标准模式：所有 OIDC 请求透传（由 CSS 默认 Handler 处理）  使用方式：在 HTTP pipeline 中替换默认的 OidcHandler",
+      "comment": "Auto-detect OIDC Handler  自动检测运行模式： - 如果配置了 oidcIssuer -> Local SP 模式：只代理外部 issuer 的 JWKS - 如果没有配置 oidcIssuer -> 标准模式：所有 OIDC 请求透传（由 CSS 默认 Handler 处理）  注意：Local SP 模式不能禁用本地 account/consent。OIDC 交互页面和 scoped WebID picker 必须继续由本地 CSS 提供，否则 Local 登录会退回 Cloud consent 并暴露 Cloud Pod。  使用方式：在 HTTP pipeline 中替换默认的 OidcHandler",
       "parameters": [
         {
           "@id": "undefineds:dist/identity/oidc/AutoDetectOidcHandler.jsonld#AutoDetectOidcHandler_options_oidcIssuer",
@@ -25,7 +25,7 @@
               }
             ]
           },
-          "comment": "外部 IdP 的基础 URL，如果提供则启用 SP 模式"
+          "comment": "External OIDC issuer base URL used as the trust source for Local SP mode."
         },
         {
           "@id": "undefineds:dist/identity/oidc/AutoDetectOidcHandler.jsonld#AutoDetectOidcHandler_options_message",
@@ -38,7 +38,7 @@
               }
             ]
           },
-          "comment": "禁用原因说明"
+          "comment": "Explanation used when this handler declines non-JWKS OIDC routes."
         },
         {
           "@id": "undefineds:dist/identity/oidc/AutoDetectOidcHandler.jsonld#AutoDetectOidcHandler_options_cacheMs",

package/dist/runtime/bootstrap.js

@@ -10,6 +10,7 @@ exports.createCssRuntimeConfig = createCssRuntimeConfig;
 exports.initRuntimeLogger = initRuntimeLogger;
 const global_logger_factory_1 = require("global-logger-factory");
 const node_path_1 = __importDefault(require("node:path"));
+const node_url_1 = require("node:url");
 const ConfigurableLoggerFactory_1 = require("../logging/ConfigurableLoggerFactory");
 const package_root_1 = require("./package-root");
 const oidc_issuer_1 = require("./oidc-issuer");
@@ -39,6 +40,9 @@ function toWindowsFileUrl(filePath) {
 function toConfigImportSpecifier(fromFilePath, toFilePath) {
     const normalizedFromPath = normalizeWindowsAbsolutePath(fromFilePath);
     const normalizedToPath = normalizeWindowsAbsolutePath(toFilePath);
+    if (!isWindowsAbsolutePath(normalizedFromPath) && (pathNeedsEscapedFileUrl(normalizedFromPath) || pathNeedsEscapedFileUrl(normalizedToPath))) {
+        return (0, node_url_1.pathToFileURL)(normalizedToPath).href;
+    }
     const useWindowsPaths = isWindowsAbsolutePath(normalizedFromPath) || isWindowsAbsolutePath(normalizedToPath);
     const pathApi = useWindowsPaths ? node_path_1.default.win32 : node_path_1.default.posix;
     const fromDirectoryPath = pathApi.dirname(useWindowsPaths ? normalizedFromPath : fromFilePath);
@@ -52,6 +56,9 @@ function toConfigImportSpecifier(fromFilePath, toFilePath) {
     }
     return `./${relativePath}`;
 }
+function pathNeedsEscapedFileUrl(filePath) {
+    return /\s/.test(filePath);
+}
 function withDefinedEntries(entries) {
     const result = {};
     for (const [key, value] of entries) {

package/dist/runtime/bootstrap.js.map

@@ -1 +1 @@
-{"version":3,"file":"bootstrap.js","sourceRoot":"","sources":["../../src/runtime/bootstrap.ts"],"names":[],"mappings":";;;;;AAuGA,0DAoEC;AAED,0CAgCC;AAED,sDA4CC;AAED,wDAoCC;AAED,8CASC;AA5SD,iEAA+D;AAC/D,0DAA6B;AAC7B,oFAAiF;AACjF,iDAA8C;AAE9C,+CAA6E;AAC7E,6EAA0E;AAyB1E,SAAS,mBAAmB,CAAC,GAAW;IACtC,OAAO,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,CAAC;AAC7C,CAAC;AAED,SAAS,4BAA4B,CAAC,QAAgB;IACpD,OAAO,QAAQ,CAAC,OAAO,CAAC,2BAA2B,EAAE,EAAE,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,qBAAqB,CAAC,QAAgB;IAC7C,OAAO,iBAAiB,CAAC,IAAI,CAAC,4BAA4B,CAAC,QAAQ,CAAC,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAgB;IAC3C,MAAM,cAAc,GAAG,4BAA4B,CAAC,QAAQ,CAAC,CAAC;IAC9D,OAAO,qBAAqB,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,mBAAI,CAAC,KAAK,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACjH,CAAC;AAED,SAAS,gCAAgC,CAAC,SAAiB,EAAE,UAAkB;IAC7E,MAAM,SAAS,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;IACjD,MAAM,UAAU,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;IACnD,OAAO,OAAO,CAAC,SAAS,IAAI,UAAU,IAAI,SAAS,KAAK,UAAU,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAgB;IACxC,MAAM,cAAc,GAAG,4BAA4B,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAClF,OAAO,IAAI,GAAG,CAAC,WAAW,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC;AACnD,CAAC;AAED,SAAS,uBAAuB,CAAC,YAAoB,EAAE,UAAkB;IACvE,MAAM,kBAAkB,GAAG,4BAA4B,CAAC,YAAY,CAAC,CAAC;IACtE,MAAM,gBAAgB,GAAG,4BAA4B,CAAC,UAAU,CAAC,CAAC;IAClE,MAAM,eAAe,GAAG,qBAAqB,CAAC,kBAAkB,CAAC,IAAI,qBAAqB,CAAC,gBAAgB,CAAC,CAAC;IAC7G,MAAM,OAAO,GAAG,eAAe,CAAC,CAAC,CAAC,mBAAI,CAAC,KAAK,CAAC,CAAC,CAAC,mBAAI,CAAC,KAAK,CAAC;IAC1D,MAAM,iBAAiB,GAAG,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;IAC/F,MAAM,UAAU,GAAG,eAAe,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,UAAU,CAAC;IAEnE,IAAI,eAAe,IAAI,gCAAgC,CAAC,iBAAiB,EAAE,UAAU,CAAC,EAAE,CAAC;QACvF,OAAO,gBAAgB,CAAC,UAAU,CAAC,CAAC;IACtC,CAAC;IAED,MAAM,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,iBAAiB,EAAE,UAAU,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACzF,IAAI,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACpE,OAAO,YAAY,CAAC;IACtB,CAAC;IACD,OAAO,KAAK,YAAY,EAAE,CAAC;AAC7B,CAAC;AAED,SAAS,kBAAkB,CAAC,OAA+D;IACzF,MAAM,MAAM,GAA8C,EAAE,CAAC;IAC7D,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;QACnC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACtB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,oBAAoB,CAC3B,KAAa,EACb,WAAiD,yCAAmB;IAEpE,IACE,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC;QAC3B,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC;QAC/B,KAAK,CAAC,UAAU,CAAC,eAAe,CAAC;QACjC,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,EAC5B,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,UAAU,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;AACjD,CAAC;AAEM,KAAK,UAAU,uBAAuB,CAC3C,EAAU,EACV,OAA2B,EAC3B,IAAiB,EACjB,WAA4B,yCAAmB;IAE/C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC;IACrC,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,WAAW,CAAC;IACjD,MAAM,WAAW,GAAG,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,WAAW,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,YAAY,EAAE,cAAc,EAAE,EAAE,CAAC,CAAC,CAAC;IACrI,MAAM,YAAY,GAAG,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,YAAY,IAAI,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;IAC1G,MAAM,cAAc,GAAG,oBAAoB,CAAC,OAAO,CAAC,cAAc,IAAI,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,kBAAkB,CAAC,EAAE,QAAQ,CAAC,CAAC;IACpI,MAAM,YAAY,GAAG,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,YAAY,IAAI,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC,CAAC;IACtH,MAAM,aAAa,GAAG,oBAAoB,CAAC,OAAO,CAAC,aAAa,IAAI,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAC,EAAE,QAAQ,CAAC,CAAC;IACjI,MAAM,UAAU,GAAG,oBAAoB,CAAC,OAAO,CAAC,UAAU,IAAI,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,QAAQ,CAAC,CAAC;IACxH,MAAM,WAAW,GAAG,OAAO,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC7E,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,IAAI,KAAK,CAAC;IACzD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,CAAC,mBAAmB,CAAC,IAAI,MAAM,CAAC;IAEpF,QAAQ,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IAChC,QAAQ,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IAEjC,MAAM,WAAW,GAAG,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IAC9D,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;QAC3B,QAAQ,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IAClC,CAAC;IACD,MAAM,KAAK,GAAqB,SAAS,KAAK,MAAM;QAClD,CAAC,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC;YACzB,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,QAAQ,EAAE,IAAI;SACf,CAAC;QACF,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,OAAO,GAAuB,EAAE,CAAC;IAEvC,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;QAC3B,OAAO,CAAC,OAAO,GAAG,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,iBAAiB,IAAI,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC,CAAC;QACpH,OAAO,CAAC,GAAG,GAAG,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,aAAa,IAAI,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC;QACxG,OAAO,CAAC,GAAG,GAAG,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,aAAa,IAAI,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC;IAC1G,CAAC;IAED,MAAM,OAAO,GAAG,mBAAmB,CACjC,OAAO,CAAC,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ;QACxC,CAAC,CAAC,kBAAkB;QACpB,CAAC,CAAC,UAAU,QAAQ,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC,CAC3C,CAAC;IAEF,OAAO;QACL,EAAE;QACF,IAAI;QACJ,IAAI;QACJ,SAAS;QACT,QAAQ;QACR,WAAW;QACX,YAAY;QACZ,cAAc;QACd,YAAY;QACZ,aAAa;QACb,UAAU;QACV,WAAW;QACX,OAAO;QACP,QAAQ;QACR,OAAO;QACP,WAAW,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS;QAChF,KAAK;QACL,OAAO;KACR,CAAC;AACJ,CAAC;AAED,SAAgB,eAAe,CAC7B,KAA4B,EAC5B,OAA2B,EAC3B,cAAkD,EAAE;IAEpD,MAAM,SAAS,GAAG;QAChB,GAAG,WAAW;QACd,GAAG,OAAO,CAAC,GAAG;KACf,CAAC;IACF,MAAM,kBAAkB,GAAG,IAAA,uCAAyB,EAAC,SAAS,CAAC,CAAC;IAEhE,OAAO;QACL,GAAG,SAAS;QACZ,aAAa,EAAE,KAAK,CAAC,WAAW;QAChC,YAAY,EAAE,KAAK,CAAC,IAAI;QACxB,YAAY,EAAE,KAAK,CAAC,OAAO;QAC3B,kBAAkB,EAAE,kBAAkB;YACpC,CAAC,CAAC,IAAA,+BAAiB,EAAC,kBAAkB,CAAC;YACvC,CAAC,CAAC,GAAG,KAAK,CAAC,OAAO,aAAa;QACjC,kBAAkB,EAAE,KAAK,CAAC,YAAY;QACtC,mBAAmB,EAAE,KAAK,CAAC,cAAc;QACzC,eAAe,EAAE,KAAK,CAAC,cAAc;QACrC,mBAAmB,EAAE,KAAK,CAAC,aAAa;QACxC,YAAY,EAAE,KAAK,CAAC,aAAa;QACjC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;QAC7E,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;QAC7E,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG;QAClC,cAAc,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS;QAC3F,YAAY,EAAE,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM;QAC3C,iBAAiB,EAAE,KAAK,CAAC,QAAQ;KAClC,CAAC;AACJ,CAAC;AAED,SAAgB,qBAAqB,CACnC,UAA8C,EAC9C,OAA2B,EAC3B,KAA4B,EAC5B,UAA8C,yCAAmB,CAAC,OAAO;IAEzE,MAAM,QAAQ,GAAG,CAAC,GAAW,EAAsB,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC;IACtF,MAAM,kBAAkB,GAAG,IAAA,uCAAyB,EAAC;QACnD,UAAU,EAAE,QAAQ,CAAC,YAAY,CAAC;KACnC,CAAC,CAAC;IAEH,OAAO;QACL,GAAG,kBAAkB,CAAC;YACpB,CAAC,mBAAmB,EAAE,QAAQ,CAAC,yBAAyB,CAAC,CAAC;YAC1D,CAAC,gBAAgB,EAAE,QAAQ,CAAC,sBAAsB,CAAC,CAAC;YACpD,CAAC,gBAAgB,EAAE,QAAQ,CAAC,sBAAsB,CAAC,CAAC;YACpD,CAAC,eAAe,EAAE,QAAQ,CAAC,oBAAoB,CAAC,CAAC;YACjD,CAAC,iBAAiB,EAAE,QAAQ,CAAC,uBAAuB,CAAC,CAAC;YACtD,CAAC,aAAa,EAAE,QAAQ,CAAC,kBAAkB,CAAC,CAAC;YAC7C,CAAC,eAAe,EAAE,QAAQ,CAAC,oBAAoB,CAAC,CAAC;YACjD,CAAC,eAAe,EAAE,QAAQ,CAAC,oBAAoB,CAAC,CAAC;YACjD,CAAC,iBAAiB,EAAE,QAAQ,CAAC,uBAAuB,CAAC,IAAI,EAAE,CAAC;YAC5D,CAAC,iBAAiB,EAAE,QAAQ,CAAC,uBAAuB,CAAC,IAAI,KAAK,CAAC;YAC/D,CAAC,qBAAqB,EAAE,QAAQ,CAAC,4BAA4B,CAAC,IAAI,EAAE,CAAC;YACrE,CAAC,qBAAqB,EAAE,QAAQ,CAAC,4BAA4B,CAAC,IAAI,EAAE,CAAC;YACrE,CAAC,YAAY,EAAE,kBAAkB,CAAC;YAClC,CAAC,cAAc,EAAE,QAAQ,CAAC,mBAAmB,CAAC,CAAC;YAC/C,CAAC,QAAQ,EAAE,QAAQ,CAAC,cAAc,CAAC,CAAC;YACpC,CAAC,WAAW,EAAE,QAAQ,CAAC,iBAAiB,CAAC,CAAC;YAC1C,CAAC,cAAc,EAAE,QAAQ,CAAC,oBAAoB,CAAC,CAAC;SACjD,CAAC;QACF,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,QAAQ,EAAE,KAAK,CAAC,WAAW;QAC3B,OAAO,EAAE,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO;QACpD,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,IAAI,KAAK;QACnD,yBAAyB,EAAE,OAAO,CAAC,yBAAyB,IAAI,KAAK;QACrE,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC;KAC7B,CAAC;AACJ,CAAC;AAED,SAAgB,sBAAsB,CACpC,KAA4B,EAC5B,IAAa,EACb,WAA0F,yCAAmB;IAE7G,MAAM,UAAU,GAAG,4BAA4B,CAAC,QAAQ,CAAC,QAAQ,CAAC,2BAAY,EAAE,UAAU,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC;IAC9G,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,MAAM,WAAW,GAAG,4BAA4B,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACpE,MAAM,iBAAiB,GAAG,gCAAgC,CAAC,WAAW,EAAE,UAAU,CAAC;QACjF,CAAC,CAAC,CAAC,GAAG,EAAE;YACN,MAAM,gBAAgB,GAAG,4BAA4B,CAAC,QAAQ,CAAC,QAAQ,CACrE,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,EAC5B,IAAI,EACJ,eAAe,EACf,KAAK,CAAC,EAAE,CACT,CAAC,CAAC;YACH,QAAQ,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;YACrC,OAAO,4BAA4B,CAAC,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,EAAE,yBAAyB,CAAC,CAAC,CAAC;QACtG,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,4BAA4B,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAAC,CAAC;IAC5F,MAAM,cAAc,GAAG,4BAA4B,CAAC,QAAQ,CAAC,QAAQ,CAAC,2BAAY,EAAE,0BAA0B,CAAC,CAAC,CAAC;IACjH,QAAQ,CAAC,aAAa,CAAC,iBAAiB,EAAE,IAAI,CAAC,SAAS,CAAC;QACvD,UAAU,EAAE;YACV,6GAA6G;YAC7G,2GAA2G;SAC5G;QACD,MAAM,EAAE;YACN,uBAAuB,CAAC,iBAAiB,EAAE,UAAU,CAAC;YACtD,uBAAuB,CAAC,iBAAiB,EAAE,cAAc,CAAC;SAC3D;KACF,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAEb,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED,SAAgB,iBAAiB,CAC/B,KAAa,EACb,WAAsD,yCAAmB;IAEzE,MAAM,aAAa,GAAG,IAAI,qDAAyB,CAAC,KAAK,EAAE;QACzD,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,sBAAsB,CAAC;QACnE,YAAY,EAAE,IAAI;KACnB,CAAC,CAAC;IACH,IAAA,8CAAsB,EAAC,aAAa,CAAC,CAAC;AACxC,CAAC","sourcesContent":["import { setGlobalLoggerFactory } from 'global-logger-factory';\nimport path from 'node:path';\nimport { ConfigurableLoggerFactory } from '../logging/ConfigurableLoggerFactory';\nimport { PACKAGE_ROOT } from './package-root';\nimport type { RuntimeHost } from './host/types';\nimport { oidcTokenEndpoint, resolveExternalOidcIssuer } from './oidc-issuer';\nimport { nodeRuntimePlatform } from './platform/node/NodeRuntimePlatform';\nimport type { RuntimePlatform } from './platform/types';\nimport type { XpodRuntimeOptions, XpodRuntimePorts, XpodRuntimeSockets } from './runtime-types';\n\nexport interface RuntimeBootstrapState {\n  id: string;\n  host: RuntimeHost;\n  mode: 'local' | 'cloud';\n  transport: 'socket' | 'port';\n  bindHost: string;\n  runtimeRoot: string;\n  rootFilePath: string;\n  sparqlEndpoint: string;\n  rdfIndexPath: string;\n  identityDbUrl: string;\n  usageDbUrl: string;\n  cssAuthMode: 'acp' | 'acl' | 'allow-all';\n  apiOpen: boolean;\n  logLevel: string;\n  baseUrl: string;\n  envFilePath?: string;\n  ports: XpodRuntimePorts;\n  sockets: XpodRuntimeSockets;\n}\n\nfunction ensureTrailingSlash(url: string): string {\n  return url.endsWith('/') ? url : `${url}/`;\n}\n\nfunction normalizeWindowsAbsolutePath(filePath: string): string {\n  return filePath.replace(/^[\\\\/]+(?=[A-Za-z]:[\\\\/])/, '');\n}\n\nfunction isWindowsAbsolutePath(filePath: string): boolean {\n  return /^[A-Za-z]:[\\\\/]/.test(normalizeWindowsAbsolutePath(filePath));\n}\n\nfunction getWindowsDriveRoot(filePath: string): string | undefined {\n  const normalizedPath = normalizeWindowsAbsolutePath(filePath);\n  return isWindowsAbsolutePath(normalizedPath) ? path.win32.parse(normalizedPath).root.toLowerCase() : undefined;\n}\n\nfunction arePathsOnDifferentWindowsDrives(firstPath: string, secondPath: string): boolean {\n  const firstRoot = getWindowsDriveRoot(firstPath);\n  const secondRoot = getWindowsDriveRoot(secondPath);\n  return Boolean(firstRoot && secondRoot && firstRoot !== secondRoot);\n}\n\nfunction toWindowsFileUrl(filePath: string): string {\n  const normalizedPath = normalizeWindowsAbsolutePath(filePath).replace(/\\\\/g, '/');\n  return new URL(`file:///${normalizedPath}`).href;\n}\n\nfunction toConfigImportSpecifier(fromFilePath: string, toFilePath: string): string {\n  const normalizedFromPath = normalizeWindowsAbsolutePath(fromFilePath);\n  const normalizedToPath = normalizeWindowsAbsolutePath(toFilePath);\n  const useWindowsPaths = isWindowsAbsolutePath(normalizedFromPath) || isWindowsAbsolutePath(normalizedToPath);\n  const pathApi = useWindowsPaths ? path.win32 : path.posix;\n  const fromDirectoryPath = pathApi.dirname(useWindowsPaths ? normalizedFromPath : fromFilePath);\n  const targetPath = useWindowsPaths ? normalizedToPath : toFilePath;\n\n  if (useWindowsPaths && arePathsOnDifferentWindowsDrives(fromDirectoryPath, targetPath)) {\n    return toWindowsFileUrl(targetPath);\n  }\n\n  const relativePath = pathApi.relative(fromDirectoryPath, targetPath).replace(/\\\\/g, '/');\n  if (relativePath.startsWith('./') || relativePath.startsWith('../')) {\n    return relativePath;\n  }\n  return `./${relativePath}`;\n}\n\nfunction withDefinedEntries(entries: Array<[string, string | number | boolean | undefined]>): Record<string, string | number | boolean> {\n  const result: Record<string, string | number | boolean> = {};\n  for (const [key, value] of entries) {\n    if (value !== undefined) {\n      result[key] = value;\n    }\n  }\n  return result;\n}\n\nfunction normalizeDatabaseUrl(\n  value: string,\n  platform: Pick<RuntimePlatform, 'resolvePath'> = nodeRuntimePlatform,\n): string {\n  if (\n    value.startsWith('sqlite:') ||\n    value.startsWith('postgres://') ||\n    value.startsWith('postgresql://') ||\n    value.startsWith('mysql://')\n  ) {\n    return value;\n  }\n  return `sqlite:${platform.resolvePath(value)}`;\n}\n\nexport async function resolveRuntimeBootstrap(\n  id: string,\n  options: XpodRuntimeOptions,\n  host: RuntimeHost,\n  platform: RuntimePlatform = nodeRuntimePlatform,\n): Promise<RuntimeBootstrapState> {\n  const mode = options.mode ?? 'local';\n  const transport = host.resolveTransport(options.transport);\n  const bindHost = options.bindHost ?? '127.0.0.1';\n  const runtimeRoot = platform.resolvePath(options.runtimeRoot ?? platform.joinPath(platform.cwd(), '.test-data', 'xpod-runtime', id));\n  const rootFilePath = platform.resolvePath(options.rootFilePath ?? platform.joinPath(runtimeRoot, 'data'));\n  const sparqlEndpoint = normalizeDatabaseUrl(options.sparqlEndpoint ?? platform.joinPath(runtimeRoot, 'quadstore.sqlite'), platform);\n  const rdfIndexPath = platform.resolvePath(options.rdfIndexPath ?? platform.joinPath(runtimeRoot, 'rdf-index.sqlite'));\n  const identityDbUrl = normalizeDatabaseUrl(options.identityDbUrl ?? platform.joinPath(runtimeRoot, 'identity.sqlite'), platform);\n  const usageDbUrl = normalizeDatabaseUrl(options.usageDbUrl ?? platform.joinPath(runtimeRoot, 'usage.sqlite'), platform);\n  const cssAuthMode = options.authMode ?? (options.open ? 'allow-all' : 'acp');\n  const apiOpen = options.apiOpen ?? options.open ?? false;\n  const logLevel = options.logLevel ?? platform.getEnv('CSS_LOGGING_LEVEL') ?? 'warn';\n\n  platform.ensureDir(runtimeRoot);\n  platform.ensureDir(rootFilePath);\n\n  const socketsRoot = platform.joinPath(runtimeRoot, 'sockets');\n  if (transport === 'socket') {\n    platform.ensureDir(socketsRoot);\n  }\n  const ports: XpodRuntimePorts = transport === 'port'\n    ? await host.allocatePorts({\n      gatewayPort: options.gatewayPort,\n      cssPort: options.cssPort,\n      apiPort: options.apiPort,\n      basePort: 5600,\n    })\n    : {};\n  const sockets: XpodRuntimeSockets = {};\n\n  if (transport === 'socket') {\n    sockets.gateway = platform.resolvePath(options.gatewaySocketPath ?? platform.joinPath(socketsRoot, 'gateway.sock'));\n    sockets.css = platform.resolvePath(options.cssSocketPath ?? platform.joinPath(socketsRoot, 'css.sock'));\n    sockets.api = platform.resolvePath(options.apiSocketPath ?? platform.joinPath(socketsRoot, 'api.sock'));\n  }\n\n  const baseUrl = ensureTrailingSlash(\n    options.baseUrl ?? (transport === 'socket'\n      ? 'http://localhost'\n      : `http://${bindHost}:${ports.gateway}`),\n  );\n\n  return {\n    id,\n    host,\n    mode,\n    transport,\n    bindHost,\n    runtimeRoot,\n    rootFilePath,\n    sparqlEndpoint,\n    rdfIndexPath,\n    identityDbUrl,\n    usageDbUrl,\n    cssAuthMode,\n    apiOpen,\n    logLevel,\n    baseUrl,\n    envFilePath: options.envFile ? platform.resolvePath(options.envFile) : undefined,\n    ports,\n    sockets,\n  };\n}\n\nexport function buildRuntimeEnv(\n  state: RuntimeBootstrapState,\n  options: XpodRuntimeOptions,\n  envFromFile: Record<string, string | undefined> = {},\n): Record<string, string | undefined> {\n  const mergedEnv = {\n    ...envFromFile,\n    ...options.env,\n  };\n  const externalOidcIssuer = resolveExternalOidcIssuer(mergedEnv);\n\n  return {\n    ...mergedEnv,\n    XPOD_ENV_PATH: state.envFilePath,\n    XPOD_EDITION: state.mode,\n    CSS_BASE_URL: state.baseUrl,\n    CSS_TOKEN_ENDPOINT: externalOidcIssuer\n      ? oidcTokenEndpoint(externalOidcIssuer)\n      : `${state.baseUrl}.oidc/token`,\n    CSS_ROOT_FILE_PATH: state.rootFilePath,\n    CSS_SPARQL_ENDPOINT: state.sparqlEndpoint,\n    SPARQL_ENDPOINT: state.sparqlEndpoint,\n    CSS_IDENTITY_DB_URL: state.identityDbUrl,\n    DATABASE_URL: state.identityDbUrl,\n    CSS_PORT: state.ports.css !== undefined ? String(state.ports.css) : undefined,\n    API_PORT: state.ports.api !== undefined ? String(state.ports.api) : undefined,\n    API_HOST: state.bindHost,\n    API_SOCKET_PATH: state.sockets.api,\n    XPOD_MAIN_PORT: state.ports.gateway !== undefined ? String(state.ports.gateway) : undefined,\n    CORS_ORIGINS: new URL(state.baseUrl).origin,\n    CSS_LOGGING_LEVEL: state.logLevel,\n  };\n}\n\nexport function buildRuntimeShorthand(\n  runtimeEnv: Record<string, string | undefined>,\n  options: XpodRuntimeOptions,\n  state: RuntimeBootstrapState,\n  baseEnv: Record<string, string | undefined> = nodeRuntimePlatform.baseEnv,\n): Record<string, string | number | boolean> {\n  const envValue = (key: string): string | undefined => runtimeEnv[key] ?? baseEnv[key];\n  const externalOidcIssuer = resolveExternalOidcIssuer({\n    oidcIssuer: envValue('oidcIssuer'),\n  });\n\n  return {\n    ...withDefinedEntries([\n      ['baseStorageDomain', envValue('CSS_BASE_STORAGE_DOMAIN')],\n      ['minioAccessKey', envValue('CSS_MINIO_ACCESS_KEY')],\n      ['minioSecretKey', envValue('CSS_MINIO_SECRET_KEY')],\n      ['minioEndpoint', envValue('CSS_MINIO_ENDPOINT')],\n      ['minioBucketName', envValue('CSS_MINIO_BUCKET_NAME')],\n      ['redisClient', envValue('CSS_REDIS_CLIENT')],\n      ['redisUsername', envValue('CSS_REDIS_USERNAME')],\n      ['redisPassword', envValue('CSS_REDIS_PASSWORD')],\n      ['emailConfigHost', envValue('CSS_EMAIL_CONFIG_HOST') ?? ''],\n      ['emailConfigPort', envValue('CSS_EMAIL_CONFIG_PORT') ?? '587'],\n      ['emailConfigAuthUser', envValue('CSS_EMAIL_CONFIG_AUTH_USER') ?? ''],\n      ['emailConfigAuthPass', envValue('CSS_EMAIL_CONFIG_AUTH_PASS') ?? ''],\n      ['oidcIssuer', externalOidcIssuer],\n      ['allowedHosts', envValue('CSS_ALLOWED_HOSTS')],\n      ['nodeId', envValue('XPOD_NODE_ID')],\n      ['nodeToken', envValue('XPOD_NODE_TOKEN')],\n      ['serviceToken', envValue('XPOD_SERVICE_TOKEN')],\n    ]),\n    baseUrl: state.baseUrl,\n    rootFilePath: state.rootFilePath,\n    sparqlEndpoint: state.sparqlEndpoint,\n    rdfIndexPath: state.rdfIndexPath,\n    identityDbUrl: state.identityDbUrl,\n    usageDbUrl: state.usageDbUrl,\n    logLevel: state.logLevel,\n    authMode: state.cssAuthMode,\n    edition: state.mode === 'cloud' ? 'server' : 'local',\n    edgeNodesEnabled: options.edgeNodesEnabled ?? false,\n    centerRegistrationEnabled: options.centerRegistrationEnabled ?? false,\n    ...(options.shorthand ?? {}),\n  };\n}\n\nexport function createCssRuntimeConfig(\n  state: RuntimeBootstrapState,\n  open: boolean,\n  platform: Pick<RuntimePlatform, 'dirname' | 'ensureDir' | 'joinPath' | 'writeTextFile'> = nodeRuntimePlatform,\n): string {\n  const configPath = normalizeWindowsAbsolutePath(platform.joinPath(PACKAGE_ROOT, `config/${state.mode}.json`));\n  if (!open) {\n    return configPath;\n  }\n\n  const runtimeRoot = normalizeWindowsAbsolutePath(state.runtimeRoot);\n  const runtimeConfigPath = arePathsOnDifferentWindowsDrives(runtimeRoot, configPath)\n    ? (() => {\n      const runtimeConfigDir = normalizeWindowsAbsolutePath(platform.joinPath(\n        platform.dirname(configPath),\n        '..',\n        '.xpod-runtime',\n        state.id,\n      ));\n      platform.ensureDir(runtimeConfigDir);\n      return normalizeWindowsAbsolutePath(platform.joinPath(runtimeConfigDir, 'css-runtime.config.json'));\n    })()\n    : normalizeWindowsAbsolutePath(platform.joinPath(runtimeRoot, 'css-runtime.config.json'));\n  const openConfigPath = normalizeWindowsAbsolutePath(platform.joinPath(PACKAGE_ROOT, 'config/runtime-open.json'));\n  platform.writeTextFile(runtimeConfigPath, JSON.stringify({\n    '@context': [\n      'https://linkedsoftwaredependencies.org/bundles/npm/@solid/community-server/^8.0.0/components/context.jsonld',\n      'https://linkedsoftwaredependencies.org/bundles/npm/asynchronous-handlers/^1.0.0/components/context.jsonld',\n    ],\n    import: [\n      toConfigImportSpecifier(runtimeConfigPath, configPath),\n      toConfigImportSpecifier(runtimeConfigPath, openConfigPath),\n    ],\n  }, null, 2));\n\n  return runtimeConfigPath;\n}\n\nexport function initRuntimeLogger(\n  level: string,\n  platform: Pick<RuntimePlatform, 'cwd' | 'joinPath'> = nodeRuntimePlatform,\n): void {\n  const loggerFactory = new ConfigurableLoggerFactory(level, {\n    fileName: platform.joinPath(platform.cwd(), 'logs/xpod-%DATE%.log'),\n    showLocation: true,\n  });\n  setGlobalLoggerFactory(loggerFactory);\n}\n"]}
+{"version":3,"file":"bootstrap.js","sourceRoot":"","sources":["../../src/runtime/bootstrap.ts"],"names":[],"mappings":";;;;;AAgHA,0DAoEC;AAED,0CAgCC;AAED,sDA4CC;AAED,wDAoCC;AAED,8CASC;AArTD,iEAA+D;AAC/D,0DAA6B;AAC7B,uCAAyC;AACzC,oFAAiF;AACjF,iDAA8C;AAE9C,+CAA6E;AAC7E,6EAA0E;AAyB1E,SAAS,mBAAmB,CAAC,GAAW;IACtC,OAAO,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,CAAC;AAC7C,CAAC;AAED,SAAS,4BAA4B,CAAC,QAAgB;IACpD,OAAO,QAAQ,CAAC,OAAO,CAAC,2BAA2B,EAAE,EAAE,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,qBAAqB,CAAC,QAAgB;IAC7C,OAAO,iBAAiB,CAAC,IAAI,CAAC,4BAA4B,CAAC,QAAQ,CAAC,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAgB;IAC3C,MAAM,cAAc,GAAG,4BAA4B,CAAC,QAAQ,CAAC,CAAC;IAC9D,OAAO,qBAAqB,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,mBAAI,CAAC,KAAK,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACjH,CAAC;AAED,SAAS,gCAAgC,CAAC,SAAiB,EAAE,UAAkB;IAC7E,MAAM,SAAS,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;IACjD,MAAM,UAAU,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;IACnD,OAAO,OAAO,CAAC,SAAS,IAAI,UAAU,IAAI,SAAS,KAAK,UAAU,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAgB;IACxC,MAAM,cAAc,GAAG,4BAA4B,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAClF,OAAO,IAAI,GAAG,CAAC,WAAW,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC;AACnD,CAAC;AAED,SAAS,uBAAuB,CAAC,YAAoB,EAAE,UAAkB;IACvE,MAAM,kBAAkB,GAAG,4BAA4B,CAAC,YAAY,CAAC,CAAC;IACtE,MAAM,gBAAgB,GAAG,4BAA4B,CAAC,UAAU,CAAC,CAAC;IAClE,IAAI,CAAC,qBAAqB,CAAC,kBAAkB,CAAC,IAAI,CAAC,uBAAuB,CAAC,kBAAkB,CAAC,IAAI,uBAAuB,CAAC,gBAAgB,CAAC,CAAC,EAAE,CAAC;QAC7I,OAAO,IAAA,wBAAa,EAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC;IAC9C,CAAC;IAED,MAAM,eAAe,GAAG,qBAAqB,CAAC,kBAAkB,CAAC,IAAI,qBAAqB,CAAC,gBAAgB,CAAC,CAAC;IAC7G,MAAM,OAAO,GAAG,eAAe,CAAC,CAAC,CAAC,mBAAI,CAAC,KAAK,CAAC,CAAC,CAAC,mBAAI,CAAC,KAAK,CAAC;IAC1D,MAAM,iBAAiB,GAAG,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;IAC/F,MAAM,UAAU,GAAG,eAAe,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,UAAU,CAAC;IAEnE,IAAI,eAAe,IAAI,gCAAgC,CAAC,iBAAiB,EAAE,UAAU,CAAC,EAAE,CAAC;QACvF,OAAO,gBAAgB,CAAC,UAAU,CAAC,CAAC;IACtC,CAAC;IAED,MAAM,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,iBAAiB,EAAE,UAAU,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACzF,IAAI,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACpE,OAAO,YAAY,CAAC;IACtB,CAAC;IACD,OAAO,KAAK,YAAY,EAAE,CAAC;AAC7B,CAAC;AAED,SAAS,uBAAuB,CAAC,QAAgB;IAC/C,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,kBAAkB,CAAC,OAA+D;IACzF,MAAM,MAAM,GAA8C,EAAE,CAAC;IAC7D,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;QACnC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACtB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,oBAAoB,CAC3B,KAAa,EACb,WAAiD,yCAAmB;IAEpE,IACE,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC;QAC3B,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC;QAC/B,KAAK,CAAC,UAAU,CAAC,eAAe,CAAC;QACjC,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,EAC5B,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,UAAU,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;AACjD,CAAC;AAEM,KAAK,UAAU,uBAAuB,CAC3C,EAAU,EACV,OAA2B,EAC3B,IAAiB,EACjB,WAA4B,yCAAmB;IAE/C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC;IACrC,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,WAAW,CAAC;IACjD,MAAM,WAAW,GAAG,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,WAAW,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,YAAY,EAAE,cAAc,EAAE,EAAE,CAAC,CAAC,CAAC;IACrI,MAAM,YAAY,GAAG,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,YAAY,IAAI,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;IAC1G,MAAM,cAAc,GAAG,oBAAoB,CAAC,OAAO,CAAC,cAAc,IAAI,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,kBAAkB,CAAC,EAAE,QAAQ,CAAC,CAAC;IACpI,MAAM,YAAY,GAAG,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,YAAY,IAAI,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC,CAAC;IACtH,MAAM,aAAa,GAAG,oBAAoB,CAAC,OAAO,CAAC,aAAa,IAAI,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAC,EAAE,QAAQ,CAAC,CAAC;IACjI,MAAM,UAAU,GAAG,oBAAoB,CAAC,OAAO,CAAC,UAAU,IAAI,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,QAAQ,CAAC,CAAC;IACxH,MAAM,WAAW,GAAG,OAAO,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC7E,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,IAAI,KAAK,CAAC;IACzD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,CAAC,mBAAmB,CAAC,IAAI,MAAM,CAAC;IAEpF,QAAQ,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IAChC,QAAQ,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IAEjC,MAAM,WAAW,GAAG,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IAC9D,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;QAC3B,QAAQ,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IAClC,CAAC;IACD,MAAM,KAAK,GAAqB,SAAS,KAAK,MAAM;QAClD,CAAC,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC;YACzB,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,QAAQ,EAAE,IAAI;SACf,CAAC;QACF,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,OAAO,GAAuB,EAAE,CAAC;IAEvC,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;QAC3B,OAAO,CAAC,OAAO,GAAG,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,iBAAiB,IAAI,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC,CAAC;QACpH,OAAO,CAAC,GAAG,GAAG,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,aAAa,IAAI,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC;QACxG,OAAO,CAAC,GAAG,GAAG,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,aAAa,IAAI,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC;IAC1G,CAAC;IAED,MAAM,OAAO,GAAG,mBAAmB,CACjC,OAAO,CAAC,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ;QACxC,CAAC,CAAC,kBAAkB;QACpB,CAAC,CAAC,UAAU,QAAQ,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC,CAC3C,CAAC;IAEF,OAAO;QACL,EAAE;QACF,IAAI;QACJ,IAAI;QACJ,SAAS;QACT,QAAQ;QACR,WAAW;QACX,YAAY;QACZ,cAAc;QACd,YAAY;QACZ,aAAa;QACb,UAAU;QACV,WAAW;QACX,OAAO;QACP,QAAQ;QACR,OAAO;QACP,WAAW,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS;QAChF,KAAK;QACL,OAAO;KACR,CAAC;AACJ,CAAC;AAED,SAAgB,eAAe,CAC7B,KAA4B,EAC5B,OAA2B,EAC3B,cAAkD,EAAE;IAEpD,MAAM,SAAS,GAAG;QAChB,GAAG,WAAW;QACd,GAAG,OAAO,CAAC,GAAG;KACf,CAAC;IACF,MAAM,kBAAkB,GAAG,IAAA,uCAAyB,EAAC,SAAS,CAAC,CAAC;IAEhE,OAAO;QACL,GAAG,SAAS;QACZ,aAAa,EAAE,KAAK,CAAC,WAAW;QAChC,YAAY,EAAE,KAAK,CAAC,IAAI;QACxB,YAAY,EAAE,KAAK,CAAC,OAAO;QAC3B,kBAAkB,EAAE,kBAAkB;YACpC,CAAC,CAAC,IAAA,+BAAiB,EAAC,kBAAkB,CAAC;YACvC,CAAC,CAAC,GAAG,KAAK,CAAC,OAAO,aAAa;QACjC,kBAAkB,EAAE,KAAK,CAAC,YAAY;QACtC,mBAAmB,EAAE,KAAK,CAAC,cAAc;QACzC,eAAe,EAAE,KAAK,CAAC,cAAc;QACrC,mBAAmB,EAAE,KAAK,CAAC,aAAa;QACxC,YAAY,EAAE,KAAK,CAAC,aAAa;QACjC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;QAC7E,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;QAC7E,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG;QAClC,cAAc,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS;QAC3F,YAAY,EAAE,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM;QAC3C,iBAAiB,EAAE,KAAK,CAAC,QAAQ;KAClC,CAAC;AACJ,CAAC;AAED,SAAgB,qBAAqB,CACnC,UAA8C,EAC9C,OAA2B,EAC3B,KAA4B,EAC5B,UAA8C,yCAAmB,CAAC,OAAO;IAEzE,MAAM,QAAQ,GAAG,CAAC,GAAW,EAAsB,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC;IACtF,MAAM,kBAAkB,GAAG,IAAA,uCAAyB,EAAC;QACnD,UAAU,EAAE,QAAQ,CAAC,YAAY,CAAC;KACnC,CAAC,CAAC;IAEH,OAAO;QACL,GAAG,kBAAkB,CAAC;YACpB,CAAC,mBAAmB,EAAE,QAAQ,CAAC,yBAAyB,CAAC,CAAC;YAC1D,CAAC,gBAAgB,EAAE,QAAQ,CAAC,sBAAsB,CAAC,CAAC;YACpD,CAAC,gBAAgB,EAAE,QAAQ,CAAC,sBAAsB,CAAC,CAAC;YACpD,CAAC,eAAe,EAAE,QAAQ,CAAC,oBAAoB,CAAC,CAAC;YACjD,CAAC,iBAAiB,EAAE,QAAQ,CAAC,uBAAuB,CAAC,CAAC;YACtD,CAAC,aAAa,EAAE,QAAQ,CAAC,kBAAkB,CAAC,CAAC;YAC7C,CAAC,eAAe,EAAE,QAAQ,CAAC,oBAAoB,CAAC,CAAC;YACjD,CAAC,eAAe,EAAE,QAAQ,CAAC,oBAAoB,CAAC,CAAC;YACjD,CAAC,iBAAiB,EAAE,QAAQ,CAAC,uBAAuB,CAAC,IAAI,EAAE,CAAC;YAC5D,CAAC,iBAAiB,EAAE,QAAQ,CAAC,uBAAuB,CAAC,IAAI,KAAK,CAAC;YAC/D,CAAC,qBAAqB,EAAE,QAAQ,CAAC,4BAA4B,CAAC,IAAI,EAAE,CAAC;YACrE,CAAC,qBAAqB,EAAE,QAAQ,CAAC,4BAA4B,CAAC,IAAI,EAAE,CAAC;YACrE,CAAC,YAAY,EAAE,kBAAkB,CAAC;YAClC,CAAC,cAAc,EAAE,QAAQ,CAAC,mBAAmB,CAAC,CAAC;YAC/C,CAAC,QAAQ,EAAE,QAAQ,CAAC,cAAc,CAAC,CAAC;YACpC,CAAC,WAAW,EAAE,QAAQ,CAAC,iBAAiB,CAAC,CAAC;YAC1C,CAAC,cAAc,EAAE,QAAQ,CAAC,oBAAoB,CAAC,CAAC;SACjD,CAAC;QACF,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,QAAQ,EAAE,KAAK,CAAC,WAAW;QAC3B,OAAO,EAAE,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO;QACpD,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,IAAI,KAAK;QACnD,yBAAyB,EAAE,OAAO,CAAC,yBAAyB,IAAI,KAAK;QACrE,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC;KAC7B,CAAC;AACJ,CAAC;AAED,SAAgB,sBAAsB,CACpC,KAA4B,EAC5B,IAAa,EACb,WAA0F,yCAAmB;IAE7G,MAAM,UAAU,GAAG,4BAA4B,CAAC,QAAQ,CAAC,QAAQ,CAAC,2BAAY,EAAE,UAAU,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC;IAC9G,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,MAAM,WAAW,GAAG,4BAA4B,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACpE,MAAM,iBAAiB,GAAG,gCAAgC,CAAC,WAAW,EAAE,UAAU,CAAC;QACjF,CAAC,CAAC,CAAC,GAAG,EAAE;YACN,MAAM,gBAAgB,GAAG,4BAA4B,CAAC,QAAQ,CAAC,QAAQ,CACrE,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,EAC5B,IAAI,EACJ,eAAe,EACf,KAAK,CAAC,EAAE,CACT,CAAC,CAAC;YACH,QAAQ,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;YACrC,OAAO,4BAA4B,CAAC,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,EAAE,yBAAyB,CAAC,CAAC,CAAC;QACtG,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,4BAA4B,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAAC,CAAC;IAC5F,MAAM,cAAc,GAAG,4BAA4B,CAAC,QAAQ,CAAC,QAAQ,CAAC,2BAAY,EAAE,0BAA0B,CAAC,CAAC,CAAC;IACjH,QAAQ,CAAC,aAAa,CAAC,iBAAiB,EAAE,IAAI,CAAC,SAAS,CAAC;QACvD,UAAU,EAAE;YACV,6GAA6G;YAC7G,2GAA2G;SAC5G;QACD,MAAM,EAAE;YACN,uBAAuB,CAAC,iBAAiB,EAAE,UAAU,CAAC;YACtD,uBAAuB,CAAC,iBAAiB,EAAE,cAAc,CAAC;SAC3D;KACF,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAEb,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED,SAAgB,iBAAiB,CAC/B,KAAa,EACb,WAAsD,yCAAmB;IAEzE,MAAM,aAAa,GAAG,IAAI,qDAAyB,CAAC,KAAK,EAAE;QACzD,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,sBAAsB,CAAC;QACnE,YAAY,EAAE,IAAI;KACnB,CAAC,CAAC;IACH,IAAA,8CAAsB,EAAC,aAAa,CAAC,CAAC;AACxC,CAAC","sourcesContent":["import { setGlobalLoggerFactory } from 'global-logger-factory';\nimport path from 'node:path';\nimport { pathToFileURL } from 'node:url';\nimport { ConfigurableLoggerFactory } from '../logging/ConfigurableLoggerFactory';\nimport { PACKAGE_ROOT } from './package-root';\nimport type { RuntimeHost } from './host/types';\nimport { oidcTokenEndpoint, resolveExternalOidcIssuer } from './oidc-issuer';\nimport { nodeRuntimePlatform } from './platform/node/NodeRuntimePlatform';\nimport type { RuntimePlatform } from './platform/types';\nimport type { XpodRuntimeOptions, XpodRuntimePorts, XpodRuntimeSockets } from './runtime-types';\n\nexport interface RuntimeBootstrapState {\n  id: string;\n  host: RuntimeHost;\n  mode: 'local' | 'cloud';\n  transport: 'socket' | 'port';\n  bindHost: string;\n  runtimeRoot: string;\n  rootFilePath: string;\n  sparqlEndpoint: string;\n  rdfIndexPath: string;\n  identityDbUrl: string;\n  usageDbUrl: string;\n  cssAuthMode: 'acp' | 'acl' | 'allow-all';\n  apiOpen: boolean;\n  logLevel: string;\n  baseUrl: string;\n  envFilePath?: string;\n  ports: XpodRuntimePorts;\n  sockets: XpodRuntimeSockets;\n}\n\nfunction ensureTrailingSlash(url: string): string {\n  return url.endsWith('/') ? url : `${url}/`;\n}\n\nfunction normalizeWindowsAbsolutePath(filePath: string): string {\n  return filePath.replace(/^[\\\\/]+(?=[A-Za-z]:[\\\\/])/, '');\n}\n\nfunction isWindowsAbsolutePath(filePath: string): boolean {\n  return /^[A-Za-z]:[\\\\/]/.test(normalizeWindowsAbsolutePath(filePath));\n}\n\nfunction getWindowsDriveRoot(filePath: string): string | undefined {\n  const normalizedPath = normalizeWindowsAbsolutePath(filePath);\n  return isWindowsAbsolutePath(normalizedPath) ? path.win32.parse(normalizedPath).root.toLowerCase() : undefined;\n}\n\nfunction arePathsOnDifferentWindowsDrives(firstPath: string, secondPath: string): boolean {\n  const firstRoot = getWindowsDriveRoot(firstPath);\n  const secondRoot = getWindowsDriveRoot(secondPath);\n  return Boolean(firstRoot && secondRoot && firstRoot !== secondRoot);\n}\n\nfunction toWindowsFileUrl(filePath: string): string {\n  const normalizedPath = normalizeWindowsAbsolutePath(filePath).replace(/\\\\/g, '/');\n  return new URL(`file:///${normalizedPath}`).href;\n}\n\nfunction toConfigImportSpecifier(fromFilePath: string, toFilePath: string): string {\n  const normalizedFromPath = normalizeWindowsAbsolutePath(fromFilePath);\n  const normalizedToPath = normalizeWindowsAbsolutePath(toFilePath);\n  if (!isWindowsAbsolutePath(normalizedFromPath) && (pathNeedsEscapedFileUrl(normalizedFromPath) || pathNeedsEscapedFileUrl(normalizedToPath))) {\n    return pathToFileURL(normalizedToPath).href;\n  }\n\n  const useWindowsPaths = isWindowsAbsolutePath(normalizedFromPath) || isWindowsAbsolutePath(normalizedToPath);\n  const pathApi = useWindowsPaths ? path.win32 : path.posix;\n  const fromDirectoryPath = pathApi.dirname(useWindowsPaths ? normalizedFromPath : fromFilePath);\n  const targetPath = useWindowsPaths ? normalizedToPath : toFilePath;\n\n  if (useWindowsPaths && arePathsOnDifferentWindowsDrives(fromDirectoryPath, targetPath)) {\n    return toWindowsFileUrl(targetPath);\n  }\n\n  const relativePath = pathApi.relative(fromDirectoryPath, targetPath).replace(/\\\\/g, '/');\n  if (relativePath.startsWith('./') || relativePath.startsWith('../')) {\n    return relativePath;\n  }\n  return `./${relativePath}`;\n}\n\nfunction pathNeedsEscapedFileUrl(filePath: string): boolean {\n  return /\\s/.test(filePath);\n}\n\nfunction withDefinedEntries(entries: Array<[string, string | number | boolean | undefined]>): Record<string, string | number | boolean> {\n  const result: Record<string, string | number | boolean> = {};\n  for (const [key, value] of entries) {\n    if (value !== undefined) {\n      result[key] = value;\n    }\n  }\n  return result;\n}\n\nfunction normalizeDatabaseUrl(\n  value: string,\n  platform: Pick<RuntimePlatform, 'resolvePath'> = nodeRuntimePlatform,\n): string {\n  if (\n    value.startsWith('sqlite:') ||\n    value.startsWith('postgres://') ||\n    value.startsWith('postgresql://') ||\n    value.startsWith('mysql://')\n  ) {\n    return value;\n  }\n  return `sqlite:${platform.resolvePath(value)}`;\n}\n\nexport async function resolveRuntimeBootstrap(\n  id: string,\n  options: XpodRuntimeOptions,\n  host: RuntimeHost,\n  platform: RuntimePlatform = nodeRuntimePlatform,\n): Promise<RuntimeBootstrapState> {\n  const mode = options.mode ?? 'local';\n  const transport = host.resolveTransport(options.transport);\n  const bindHost = options.bindHost ?? '127.0.0.1';\n  const runtimeRoot = platform.resolvePath(options.runtimeRoot ?? platform.joinPath(platform.cwd(), '.test-data', 'xpod-runtime', id));\n  const rootFilePath = platform.resolvePath(options.rootFilePath ?? platform.joinPath(runtimeRoot, 'data'));\n  const sparqlEndpoint = normalizeDatabaseUrl(options.sparqlEndpoint ?? platform.joinPath(runtimeRoot, 'quadstore.sqlite'), platform);\n  const rdfIndexPath = platform.resolvePath(options.rdfIndexPath ?? platform.joinPath(runtimeRoot, 'rdf-index.sqlite'));\n  const identityDbUrl = normalizeDatabaseUrl(options.identityDbUrl ?? platform.joinPath(runtimeRoot, 'identity.sqlite'), platform);\n  const usageDbUrl = normalizeDatabaseUrl(options.usageDbUrl ?? platform.joinPath(runtimeRoot, 'usage.sqlite'), platform);\n  const cssAuthMode = options.authMode ?? (options.open ? 'allow-all' : 'acp');\n  const apiOpen = options.apiOpen ?? options.open ?? false;\n  const logLevel = options.logLevel ?? platform.getEnv('CSS_LOGGING_LEVEL') ?? 'warn';\n\n  platform.ensureDir(runtimeRoot);\n  platform.ensureDir(rootFilePath);\n\n  const socketsRoot = platform.joinPath(runtimeRoot, 'sockets');\n  if (transport === 'socket') {\n    platform.ensureDir(socketsRoot);\n  }\n  const ports: XpodRuntimePorts = transport === 'port'\n    ? await host.allocatePorts({\n      gatewayPort: options.gatewayPort,\n      cssPort: options.cssPort,\n      apiPort: options.apiPort,\n      basePort: 5600,\n    })\n    : {};\n  const sockets: XpodRuntimeSockets = {};\n\n  if (transport === 'socket') {\n    sockets.gateway = platform.resolvePath(options.gatewaySocketPath ?? platform.joinPath(socketsRoot, 'gateway.sock'));\n    sockets.css = platform.resolvePath(options.cssSocketPath ?? platform.joinPath(socketsRoot, 'css.sock'));\n    sockets.api = platform.resolvePath(options.apiSocketPath ?? platform.joinPath(socketsRoot, 'api.sock'));\n  }\n\n  const baseUrl = ensureTrailingSlash(\n    options.baseUrl ?? (transport === 'socket'\n      ? 'http://localhost'\n      : `http://${bindHost}:${ports.gateway}`),\n  );\n\n  return {\n    id,\n    host,\n    mode,\n    transport,\n    bindHost,\n    runtimeRoot,\n    rootFilePath,\n    sparqlEndpoint,\n    rdfIndexPath,\n    identityDbUrl,\n    usageDbUrl,\n    cssAuthMode,\n    apiOpen,\n    logLevel,\n    baseUrl,\n    envFilePath: options.envFile ? platform.resolvePath(options.envFile) : undefined,\n    ports,\n    sockets,\n  };\n}\n\nexport function buildRuntimeEnv(\n  state: RuntimeBootstrapState,\n  options: XpodRuntimeOptions,\n  envFromFile: Record<string, string | undefined> = {},\n): Record<string, string | undefined> {\n  const mergedEnv = {\n    ...envFromFile,\n    ...options.env,\n  };\n  const externalOidcIssuer = resolveExternalOidcIssuer(mergedEnv);\n\n  return {\n    ...mergedEnv,\n    XPOD_ENV_PATH: state.envFilePath,\n    XPOD_EDITION: state.mode,\n    CSS_BASE_URL: state.baseUrl,\n    CSS_TOKEN_ENDPOINT: externalOidcIssuer\n      ? oidcTokenEndpoint(externalOidcIssuer)\n      : `${state.baseUrl}.oidc/token`,\n    CSS_ROOT_FILE_PATH: state.rootFilePath,\n    CSS_SPARQL_ENDPOINT: state.sparqlEndpoint,\n    SPARQL_ENDPOINT: state.sparqlEndpoint,\n    CSS_IDENTITY_DB_URL: state.identityDbUrl,\n    DATABASE_URL: state.identityDbUrl,\n    CSS_PORT: state.ports.css !== undefined ? String(state.ports.css) : undefined,\n    API_PORT: state.ports.api !== undefined ? String(state.ports.api) : undefined,\n    API_HOST: state.bindHost,\n    API_SOCKET_PATH: state.sockets.api,\n    XPOD_MAIN_PORT: state.ports.gateway !== undefined ? String(state.ports.gateway) : undefined,\n    CORS_ORIGINS: new URL(state.baseUrl).origin,\n    CSS_LOGGING_LEVEL: state.logLevel,\n  };\n}\n\nexport function buildRuntimeShorthand(\n  runtimeEnv: Record<string, string | undefined>,\n  options: XpodRuntimeOptions,\n  state: RuntimeBootstrapState,\n  baseEnv: Record<string, string | undefined> = nodeRuntimePlatform.baseEnv,\n): Record<string, string | number | boolean> {\n  const envValue = (key: string): string | undefined => runtimeEnv[key] ?? baseEnv[key];\n  const externalOidcIssuer = resolveExternalOidcIssuer({\n    oidcIssuer: envValue('oidcIssuer'),\n  });\n\n  return {\n    ...withDefinedEntries([\n      ['baseStorageDomain', envValue('CSS_BASE_STORAGE_DOMAIN')],\n      ['minioAccessKey', envValue('CSS_MINIO_ACCESS_KEY')],\n      ['minioSecretKey', envValue('CSS_MINIO_SECRET_KEY')],\n      ['minioEndpoint', envValue('CSS_MINIO_ENDPOINT')],\n      ['minioBucketName', envValue('CSS_MINIO_BUCKET_NAME')],\n      ['redisClient', envValue('CSS_REDIS_CLIENT')],\n      ['redisUsername', envValue('CSS_REDIS_USERNAME')],\n      ['redisPassword', envValue('CSS_REDIS_PASSWORD')],\n      ['emailConfigHost', envValue('CSS_EMAIL_CONFIG_HOST') ?? ''],\n      ['emailConfigPort', envValue('CSS_EMAIL_CONFIG_PORT') ?? '587'],\n      ['emailConfigAuthUser', envValue('CSS_EMAIL_CONFIG_AUTH_USER') ?? ''],\n      ['emailConfigAuthPass', envValue('CSS_EMAIL_CONFIG_AUTH_PASS') ?? ''],\n      ['oidcIssuer', externalOidcIssuer],\n      ['allowedHosts', envValue('CSS_ALLOWED_HOSTS')],\n      ['nodeId', envValue('XPOD_NODE_ID')],\n      ['nodeToken', envValue('XPOD_NODE_TOKEN')],\n      ['serviceToken', envValue('XPOD_SERVICE_TOKEN')],\n    ]),\n    baseUrl: state.baseUrl,\n    rootFilePath: state.rootFilePath,\n    sparqlEndpoint: state.sparqlEndpoint,\n    rdfIndexPath: state.rdfIndexPath,\n    identityDbUrl: state.identityDbUrl,\n    usageDbUrl: state.usageDbUrl,\n    logLevel: state.logLevel,\n    authMode: state.cssAuthMode,\n    edition: state.mode === 'cloud' ? 'server' : 'local',\n    edgeNodesEnabled: options.edgeNodesEnabled ?? false,\n    centerRegistrationEnabled: options.centerRegistrationEnabled ?? false,\n    ...(options.shorthand ?? {}),\n  };\n}\n\nexport function createCssRuntimeConfig(\n  state: RuntimeBootstrapState,\n  open: boolean,\n  platform: Pick<RuntimePlatform, 'dirname' | 'ensureDir' | 'joinPath' | 'writeTextFile'> = nodeRuntimePlatform,\n): string {\n  const configPath = normalizeWindowsAbsolutePath(platform.joinPath(PACKAGE_ROOT, `config/${state.mode}.json`));\n  if (!open) {\n    return configPath;\n  }\n\n  const runtimeRoot = normalizeWindowsAbsolutePath(state.runtimeRoot);\n  const runtimeConfigPath = arePathsOnDifferentWindowsDrives(runtimeRoot, configPath)\n    ? (() => {\n      const runtimeConfigDir = normalizeWindowsAbsolutePath(platform.joinPath(\n        platform.dirname(configPath),\n        '..',\n        '.xpod-runtime',\n        state.id,\n      ));\n      platform.ensureDir(runtimeConfigDir);\n      return normalizeWindowsAbsolutePath(platform.joinPath(runtimeConfigDir, 'css-runtime.config.json'));\n    })()\n    : normalizeWindowsAbsolutePath(platform.joinPath(runtimeRoot, 'css-runtime.config.json'));\n  const openConfigPath = normalizeWindowsAbsolutePath(platform.joinPath(PACKAGE_ROOT, 'config/runtime-open.json'));\n  platform.writeTextFile(runtimeConfigPath, JSON.stringify({\n    '@context': [\n      'https://linkedsoftwaredependencies.org/bundles/npm/@solid/community-server/^8.0.0/components/context.jsonld',\n      'https://linkedsoftwaredependencies.org/bundles/npm/asynchronous-handlers/^1.0.0/components/context.jsonld',\n    ],\n    import: [\n      toConfigImportSpecifier(runtimeConfigPath, configPath),\n      toConfigImportSpecifier(runtimeConfigPath, openConfigPath),\n    ],\n  }, null, 2));\n\n  return runtimeConfigPath;\n}\n\nexport function initRuntimeLogger(\n  level: string,\n  platform: Pick<RuntimePlatform, 'cwd' | 'joinPath'> = nodeRuntimePlatform,\n): void {\n  const loggerFactory = new ConfigurableLoggerFactory(level, {\n    fileName: platform.joinPath(platform.cwd(), 'logs/xpod-%DATE%.log'),\n    showLocation: true,\n  });\n  setGlobalLoggerFactory(loggerFactory);\n}\n"]}

package/dist/runtime/css-process.js

@@ -9,6 +9,7 @@ exports.buildCssArgs = buildCssArgs;
 exports.buildApiChildEnv = buildApiChildEnv;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
+const node_url_1 = require("node:url");
 const oidc_issuer_1 = require("./oidc-issuer");
 /**
  * Build the environment for the CSS child process.
@@ -39,6 +40,9 @@ function isExternalOidcPollutionKey(key) {
         normalized.includes('IDENTITYPROVIDERJWKSURL');
 }
 function toImportSpecifier(fromFilePath, toFilePath) {
+    if (pathNeedsEscapedFileUrl(fromFilePath) || pathNeedsEscapedFileUrl(toFilePath)) {
+        return (0, node_url_1.pathToFileURL)(toFilePath).href;
+    }
     const fromDirectory = node_path_1.default.dirname(fromFilePath);
     const relativePath = node_path_1.default.relative(fromDirectory, toFilePath).replace(/\\/g, '/');
     if (relativePath.startsWith('./') || relativePath.startsWith('../')) {
@@ -46,6 +50,9 @@ function toImportSpecifier(fromFilePath, toFilePath) {
     }
     return `./${relativePath}`;
 }
+function pathNeedsEscapedFileUrl(filePath) {
+    return /\s/.test(filePath);
+}
 function createCssChildRuntimeConfig(options) {
     node_fs_1.default.mkdirSync(options.runtimeRoot, { recursive: true });
     const runtimeConfigPath = node_path_1.default.join(options.runtimeRoot, 'css-child-runtime.config.json');

package/dist/runtime/css-process.js.map

@@ -1 +1 @@
-{"version":3,"file":"css-process.js","sourceRoot":"","sources":["../../src/runtime/css-process.ts"],"names":[],"mappings":";;;;;AAWA,4CAmBC;AAoBD,kEAiCC;AAED,oCAeC;AAED,4CAmBC;AAzHD,sDAAyB;AACzB,0DAA6B;AAC7B,+CAAkD;AAElD;;;;;;GAMG;AACH,SAAgB,gBAAgB,CAC9B,OAAe,EACf,OAAe,EACf,UAAmB,EACnB,UAA6B,OAAO,CAAC,GAAG;IAExC,MAAM,GAAG,GAA2B;QAClC,GAAG,OAAO;QACV,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE;QAC5B,YAAY,EAAE,OAAO;KACI,CAAC;IAE5B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,IAAI,GAAG,KAAK,YAAY,IAAI,0BAA0B,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5D,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,0BAA0B,CAAC,GAAW;IAC7C,MAAM,UAAU,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IAC/D,OAAO,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC;QACtC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC7B,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC;QACjC,UAAU,CAAC,QAAQ,CAAC,qBAAqB,CAAC;QAC1C,UAAU,CAAC,QAAQ,CAAC,yBAAyB,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,iBAAiB,CAAC,YAAoB,EAAE,UAAkB;IACjE,MAAM,aAAa,GAAG,mBAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IACjD,MAAM,YAAY,GAAG,mBAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAClF,IAAI,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACpE,OAAO,YAAY,CAAC;IACtB,CAAC;IACD,OAAO,KAAK,YAAY,EAAE,CAAC;AAC7B,CAAC;AAED,SAAgB,2BAA2B,CAAC,OAI3C;IACC,iBAAE,CAAC,SAAS,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvD,MAAM,iBAAiB,GAAG,mBAAI,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,+BAA+B,CAAC,CAAC;IAC1F,iBAAE,CAAC,aAAa,CAAC,iBAAiB,EAAE,IAAI,CAAC,SAAS,CAAC;QACjD,UAAU,EAAE;YACV,6GAA6G;YAC7G,yGAAyG;YACzG,2GAA2G;SAC5G;QACD,MAAM,EAAE;YACN,iBAAiB,CAAC,iBAAiB,EAAE,OAAO,CAAC,UAAU,CAAC;SACzD;QACD,QAAQ,EAAE,EAAE;KACb,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IAEtB,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;QAC/B,iBAAE,CAAC,aAAa,CAAC,mBAAI,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC;YAC9E,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,kBAAkB;SACzB,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QACtB,iBAAE,CAAC,aAAa,CAAC,mBAAI,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,qCAAqC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC;YACrG,UAAU,EAAE,OAAO,CAAC,kBAAkB;SACvC,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IACxB,CAAC;IAED,OAAO;QACL,UAAU,EAAE,iBAAiB;QAC7B,GAAG,EAAE,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;KAClE,CAAC;AACJ,CAAC;AAED,SAAgB,YAAY,CAAC,OAO5B;IACC,OAAO;QACL,OAAO,CAAC,SAAS;QACjB,IAAI,EAAE,OAAO,CAAC,UAAU;QACxB,IAAI,EAAE,OAAO,CAAC,aAAa;QAC3B,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE;QAChC,IAAI,EAAE,OAAO,CAAC,OAAO;KACtB,CAAC;AACJ,CAAC;AAED,SAAgB,gBAAgB,CAAC,OAOhC;IACC,OAAO;QACL,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC;QACnC,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjF,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE;QACpC,cAAc,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE;QAC3C,gBAAgB,EAAE,oBAAoB,OAAO,CAAC,OAAO,EAAE;QACvD,YAAY,EAAE,OAAO,CAAC,OAAO;QAC7B,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;YAC5C,CAAC,CAAC,IAAA,+BAAiB,EAAC,OAAO,CAAC,kBAAkB,CAAC;YAC/C,CAAC,CAAC,GAAG,OAAO,CAAC,OAAO,aAAa;KACV,CAAC;AAC9B,CAAC","sourcesContent":["import fs from 'node:fs';\nimport path from 'node:path';\nimport { oidcTokenEndpoint } from './oidc-issuer';\n\n/**\n * Build the environment for the CSS child process.\n *\n * `oidcIssuer` is an xpod shorthand value, not a CSS CLI argument.\n * The legacy CSS child process path injects it through a generated\n * Components.js config instead of CSS_* env aliases.\n */\nexport function buildCssChildEnv(\n  baseUrl: string,\n  cssPort: number,\n  oidcIssuer?: string,\n  baseEnv: NodeJS.ProcessEnv = process.env,\n): Record<string, string> {\n  const env: Record<string, string> = {\n    ...baseEnv,\n    CSS_PORT: cssPort.toString(),\n    CSS_BASE_URL: baseUrl,\n  } as Record<string, string>;\n\n  for (const key of Object.keys(env)) {\n    if (key === 'oidcIssuer' || isExternalOidcPollutionKey(key)) {\n      delete env[key];\n    }\n  }\n\n  return env;\n}\n\nfunction isExternalOidcPollutionKey(key: string): boolean {\n  const normalized = key.toUpperCase().replace(/[^A-Z0-9]/g, '');\n  return normalized.includes('OIDCISSUER') ||\n    normalized.includes('IDPURL') ||\n    normalized.includes('IDPJWKSURL') ||\n    normalized.includes('IDENTITYPROVIDERURL') ||\n    normalized.includes('IDENTITYPROVIDERJWKSURL');\n}\n\nfunction toImportSpecifier(fromFilePath: string, toFilePath: string): string {\n  const fromDirectory = path.dirname(fromFilePath);\n  const relativePath = path.relative(fromDirectory, toFilePath).replace(/\\\\/g, '/');\n  if (relativePath.startsWith('./') || relativePath.startsWith('../')) {\n    return relativePath;\n  }\n  return `./${relativePath}`;\n}\n\nexport function createCssChildRuntimeConfig(options: {\n  configPath: string\n  runtimeRoot: string\n  externalOidcIssuer?: string\n}): { configPath: string; cwd?: string } {\n  fs.mkdirSync(options.runtimeRoot, { recursive: true });\n  const runtimeConfigPath = path.join(options.runtimeRoot, 'css-child-runtime.config.json');\n  fs.writeFileSync(runtimeConfigPath, JSON.stringify({\n    '@context': [\n      'https://linkedsoftwaredependencies.org/bundles/npm/@solid/community-server/^8.0.0/components/context.jsonld',\n      'https://linkedsoftwaredependencies.org/bundles/npm/@undefineds.co/xpod/^0.0.0/components/context.jsonld',\n      'https://linkedsoftwaredependencies.org/bundles/npm/asynchronous-handlers/^1.0.0/components/context.jsonld',\n    ],\n    import: [\n      toImportSpecifier(runtimeConfigPath, options.configPath),\n    ],\n    '@graph': [],\n  }, null, 2), 'utf-8');\n\n  if (options.externalOidcIssuer) {\n    fs.writeFileSync(path.join(options.runtimeRoot, 'package.json'), JSON.stringify({\n      private: true,\n      name: 'xpod-css-runtime',\n    }, null, 2), 'utf-8');\n    fs.writeFileSync(path.join(options.runtimeRoot, '.community-solid-server.config.json'), JSON.stringify({\n      oidcIssuer: options.externalOidcIssuer,\n    }, null, 2), 'utf-8');\n  }\n\n  return {\n    configPath: runtimeConfigPath,\n    cwd: options.externalOidcIssuer ? options.runtimeRoot : undefined,\n  };\n}\n\nexport function buildCssArgs(options: {\n  cssBinary: string\n  configPath: string\n  cssModuleRoot: string\n  cssPort: number\n  baseUrl: string\n  externalOidcIssuer?: string\n}): string[] {\n  return [\n    options.cssBinary,\n    '-c', options.configPath,\n    '-m', options.cssModuleRoot,\n    '-p', options.cssPort.toString(),\n    '-b', options.baseUrl,\n  ];\n}\n\nexport function buildApiChildEnv(options: {\n  apiPort: number\n  mainPort: number\n  cssPort: number\n  baseUrl: string\n  externalOidcIssuer?: string\n  baseEnv?: NodeJS.ProcessEnv\n}): Record<string, string> {\n  return {\n    ...(options.baseEnv ?? process.env),\n    ...(options.externalOidcIssuer ? { oidcIssuer: options.externalOidcIssuer } : {}),\n    API_PORT: options.apiPort.toString(),\n    XPOD_MAIN_PORT: options.mainPort.toString(),\n    CSS_INTERNAL_URL: `http://localhost:${options.cssPort}`,\n    CSS_BASE_URL: options.baseUrl,\n    CSS_TOKEN_ENDPOINT: options.externalOidcIssuer\n      ? oidcTokenEndpoint(options.externalOidcIssuer)\n      : `${options.baseUrl}.oidc/token`,\n  } as Record<string, string>;\n}\n"]}
+{"version":3,"file":"css-process.js","sourceRoot":"","sources":["../../src/runtime/css-process.ts"],"names":[],"mappings":";;;;;AAYA,4CAmBC;AA4BD,kEAiCC;AAED,oCAeC;AAED,4CAmBC;AAlID,sDAAyB;AACzB,0DAA6B;AAC7B,uCAAyC;AACzC,+CAAkD;AAElD;;;;;;GAMG;AACH,SAAgB,gBAAgB,CAC9B,OAAe,EACf,OAAe,EACf,UAAmB,EACnB,UAA6B,OAAO,CAAC,GAAG;IAExC,MAAM,GAAG,GAA2B;QAClC,GAAG,OAAO;QACV,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE;QAC5B,YAAY,EAAE,OAAO;KACI,CAAC;IAE5B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,IAAI,GAAG,KAAK,YAAY,IAAI,0BAA0B,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5D,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,0BAA0B,CAAC,GAAW;IAC7C,MAAM,UAAU,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IAC/D,OAAO,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC;QACtC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC7B,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC;QACjC,UAAU,CAAC,QAAQ,CAAC,qBAAqB,CAAC;QAC1C,UAAU,CAAC,QAAQ,CAAC,yBAAyB,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,iBAAiB,CAAC,YAAoB,EAAE,UAAkB;IACjE,IAAI,uBAAuB,CAAC,YAAY,CAAC,IAAI,uBAAuB,CAAC,UAAU,CAAC,EAAE,CAAC;QACjF,OAAO,IAAA,wBAAa,EAAC,UAAU,CAAC,CAAC,IAAI,CAAC;IACxC,CAAC;IAED,MAAM,aAAa,GAAG,mBAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IACjD,MAAM,YAAY,GAAG,mBAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAClF,IAAI,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACpE,OAAO,YAAY,CAAC;IACtB,CAAC;IACD,OAAO,KAAK,YAAY,EAAE,CAAC;AAC7B,CAAC;AAED,SAAS,uBAAuB,CAAC,QAAgB;IAC/C,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AAC7B,CAAC;AAED,SAAgB,2BAA2B,CAAC,OAI3C;IACC,iBAAE,CAAC,SAAS,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvD,MAAM,iBAAiB,GAAG,mBAAI,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,+BAA+B,CAAC,CAAC;IAC1F,iBAAE,CAAC,aAAa,CAAC,iBAAiB,EAAE,IAAI,CAAC,SAAS,CAAC;QACjD,UAAU,EAAE;YACV,6GAA6G;YAC7G,yGAAyG;YACzG,2GAA2G;SAC5G;QACD,MAAM,EAAE;YACN,iBAAiB,CAAC,iBAAiB,EAAE,OAAO,CAAC,UAAU,CAAC;SACzD;QACD,QAAQ,EAAE,EAAE;KACb,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IAEtB,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;QAC/B,iBAAE,CAAC,aAAa,CAAC,mBAAI,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC;YAC9E,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,kBAAkB;SACzB,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QACtB,iBAAE,CAAC,aAAa,CAAC,mBAAI,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,qCAAqC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC;YACrG,UAAU,EAAE,OAAO,CAAC,kBAAkB;SACvC,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IACxB,CAAC;IAED,OAAO;QACL,UAAU,EAAE,iBAAiB;QAC7B,GAAG,EAAE,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;KAClE,CAAC;AACJ,CAAC;AAED,SAAgB,YAAY,CAAC,OAO5B;IACC,OAAO;QACL,OAAO,CAAC,SAAS;QACjB,IAAI,EAAE,OAAO,CAAC,UAAU;QACxB,IAAI,EAAE,OAAO,CAAC,aAAa;QAC3B,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE;QAChC,IAAI,EAAE,OAAO,CAAC,OAAO;KACtB,CAAC;AACJ,CAAC;AAED,SAAgB,gBAAgB,CAAC,OAOhC;IACC,OAAO;QACL,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC;QACnC,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjF,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE;QACpC,cAAc,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE;QAC3C,gBAAgB,EAAE,oBAAoB,OAAO,CAAC,OAAO,EAAE;QACvD,YAAY,EAAE,OAAO,CAAC,OAAO;QAC7B,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;YAC5C,CAAC,CAAC,IAAA,+BAAiB,EAAC,OAAO,CAAC,kBAAkB,CAAC;YAC/C,CAAC,CAAC,GAAG,OAAO,CAAC,OAAO,aAAa;KACV,CAAC;AAC9B,CAAC","sourcesContent":["import fs from 'node:fs';\nimport path from 'node:path';\nimport { pathToFileURL } from 'node:url';\nimport { oidcTokenEndpoint } from './oidc-issuer';\n\n/**\n * Build the environment for the CSS child process.\n *\n * `oidcIssuer` is an xpod shorthand value, not a CSS CLI argument.\n * The legacy CSS child process path injects it through a generated\n * Components.js config instead of CSS_* env aliases.\n */\nexport function buildCssChildEnv(\n  baseUrl: string,\n  cssPort: number,\n  oidcIssuer?: string,\n  baseEnv: NodeJS.ProcessEnv = process.env,\n): Record<string, string> {\n  const env: Record<string, string> = {\n    ...baseEnv,\n    CSS_PORT: cssPort.toString(),\n    CSS_BASE_URL: baseUrl,\n  } as Record<string, string>;\n\n  for (const key of Object.keys(env)) {\n    if (key === 'oidcIssuer' || isExternalOidcPollutionKey(key)) {\n      delete env[key];\n    }\n  }\n\n  return env;\n}\n\nfunction isExternalOidcPollutionKey(key: string): boolean {\n  const normalized = key.toUpperCase().replace(/[^A-Z0-9]/g, '');\n  return normalized.includes('OIDCISSUER') ||\n    normalized.includes('IDPURL') ||\n    normalized.includes('IDPJWKSURL') ||\n    normalized.includes('IDENTITYPROVIDERURL') ||\n    normalized.includes('IDENTITYPROVIDERJWKSURL');\n}\n\nfunction toImportSpecifier(fromFilePath: string, toFilePath: string): string {\n  if (pathNeedsEscapedFileUrl(fromFilePath) || pathNeedsEscapedFileUrl(toFilePath)) {\n    return pathToFileURL(toFilePath).href;\n  }\n\n  const fromDirectory = path.dirname(fromFilePath);\n  const relativePath = path.relative(fromDirectory, toFilePath).replace(/\\\\/g, '/');\n  if (relativePath.startsWith('./') || relativePath.startsWith('../')) {\n    return relativePath;\n  }\n  return `./${relativePath}`;\n}\n\nfunction pathNeedsEscapedFileUrl(filePath: string): boolean {\n  return /\\s/.test(filePath);\n}\n\nexport function createCssChildRuntimeConfig(options: {\n  configPath: string\n  runtimeRoot: string\n  externalOidcIssuer?: string\n}): { configPath: string; cwd?: string } {\n  fs.mkdirSync(options.runtimeRoot, { recursive: true });\n  const runtimeConfigPath = path.join(options.runtimeRoot, 'css-child-runtime.config.json');\n  fs.writeFileSync(runtimeConfigPath, JSON.stringify({\n    '@context': [\n      'https://linkedsoftwaredependencies.org/bundles/npm/@solid/community-server/^8.0.0/components/context.jsonld',\n      'https://linkedsoftwaredependencies.org/bundles/npm/@undefineds.co/xpod/^0.0.0/components/context.jsonld',\n      'https://linkedsoftwaredependencies.org/bundles/npm/asynchronous-handlers/^1.0.0/components/context.jsonld',\n    ],\n    import: [\n      toImportSpecifier(runtimeConfigPath, options.configPath),\n    ],\n    '@graph': [],\n  }, null, 2), 'utf-8');\n\n  if (options.externalOidcIssuer) {\n    fs.writeFileSync(path.join(options.runtimeRoot, 'package.json'), JSON.stringify({\n      private: true,\n      name: 'xpod-css-runtime',\n    }, null, 2), 'utf-8');\n    fs.writeFileSync(path.join(options.runtimeRoot, '.community-solid-server.config.json'), JSON.stringify({\n      oidcIssuer: options.externalOidcIssuer,\n    }, null, 2), 'utf-8');\n  }\n\n  return {\n    configPath: runtimeConfigPath,\n    cwd: options.externalOidcIssuer ? options.runtimeRoot : undefined,\n  };\n}\n\nexport function buildCssArgs(options: {\n  cssBinary: string\n  configPath: string\n  cssModuleRoot: string\n  cssPort: number\n  baseUrl: string\n  externalOidcIssuer?: string\n}): string[] {\n  return [\n    options.cssBinary,\n    '-c', options.configPath,\n    '-m', options.cssModuleRoot,\n    '-p', options.cssPort.toString(),\n    '-b', options.baseUrl,\n  ];\n}\n\nexport function buildApiChildEnv(options: {\n  apiPort: number\n  mainPort: number\n  cssPort: number\n  baseUrl: string\n  externalOidcIssuer?: string\n  baseEnv?: NodeJS.ProcessEnv\n}): Record<string, string> {\n  return {\n    ...(options.baseEnv ?? process.env),\n    ...(options.externalOidcIssuer ? { oidcIssuer: options.externalOidcIssuer } : {}),\n    API_PORT: options.apiPort.toString(),\n    XPOD_MAIN_PORT: options.mainPort.toString(),\n    CSS_INTERNAL_URL: `http://localhost:${options.cssPort}`,\n    CSS_BASE_URL: options.baseUrl,\n    CSS_TOKEN_ENDPOINT: options.externalOidcIssuer\n      ? oidcTokenEndpoint(options.externalOidcIssuer)\n      : `${options.baseUrl}.oidc/token`,\n  } as Record<string, string>;\n}\n"]}

package/dist/storage/accessors/MixDataAccessor.js

@@ -453,6 +453,9 @@ class MixDataAccessor {
     }
     createLocalRdfMetadata(identifier, metadata) {
         const localMetadata = new community_server_1.RepresentationMetadata(metadata);
+        const graphScopedQuads = localMetadata.quads()
+            .filter((quad) => quad.graph.termType !== 'DefaultGraph');
+        localMetadata.removeQuads(graphScopedQuads);
         localMetadata.contentType = this.localRdfContentType(identifier);
         return localMetadata;
     }