@undefineds.co/xpod 0.3.67 → 0.3.69

package/dist/api/container/types.d.ts

@@ -190,7 +190,7 @@ export interface ApiContainerCradle {
     authenticator: Authenticator;
     nodeRepo: EdgeNodeRepository;
     serviceTokenRepo: ServiceTokenRepositoryPort;
-    gatewayInternalPodAccess: ClientCredentialsInternalPodAccessTokenProvider;
+    gatewayInternalPodAccess?: ClientCredentialsInternalPodAccessTokenProvider;
     gatewayAccessKeyRepository: GatewayAccessKeyRepository;
     invocationTokenCodec: InvocationTokenCodec;
     aiConnectionInvocationKeyIssuer: AiConnectionInvocationKeyIssuer;

package/dist/api/container/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/api/container/types.ts"],"names":[],"mappings":";AAAA;;;;GAIG","sourcesContent":["/**\n * API Container 依赖类型定义\n *\n * 定义容器中注册的所有服务接口\n */\n\nimport type { ApiServer } from '../ApiServer';\nimport type { AuthMiddleware } from '../middleware/AuthMiddleware';\nimport type { Authenticator } from '../auth/Authenticator';\nimport type { GatewayAccessKeyRepository } from '../ai-gateway/auth/GatewayApiKeyAuthenticator';\nimport type { EdgeNodeRepository } from '../../identity/drizzle/EdgeNodeRepository';\nimport type { ServiceTokenRepositoryPort } from '../../identity/drizzle/ServiceTokenRepository';\nimport type { VercelChatService } from '../service/VercelChatService';\nimport type { SubdomainService } from '../../subdomain/SubdomainService';\nimport type { SubdomainClient } from '../../subdomain/SubdomainClient';\nimport type { DnsProvider } from '../../dns/DnsProvider';\nimport type { TunnelProvider } from '../../tunnel/TunnelProvider';\nimport type { ActiveTunnelProvider, TunnelProfile } from '../../tunnel/TunnelProfiles';\nimport type { AcmeCertificateManager } from '../../edge/acme/AcmeCertificateManager';\nimport type { ClusterCertificateManager } from '../../edge/acme/ClusterCertificateManager';\nimport type { EdgeNodeCertificateCapabilityBridge } from '../../edge/EdgeNodeCertificateCapabilityBridge';\nimport type { IdentityDatabase } from '../../identity/drizzle/db';\nimport type { DdnsRepository } from '../../identity/drizzle/DdnsRepository';\nimport type { PodLookupRepository } from '../../identity/drizzle/PodLookupRepository';\nimport type { AccountRoleRepository } from '../../identity/drizzle/AccountRoleRepository';\nimport type { ChatKitService, AiProvider } from '../chatkit';\nimport type { StoreContext } from '../chatkit/store';\nimport type { PodChatKitStore } from '../chatkit/pod-store';\nimport type { RuntimeHost } from '../../runtime/host/types';\nimport type { ProviderRegistry, EmbeddingService } from '../../ai/service';\nimport type { VectorService } from '../service/VectorService';\nimport type { RdfSearchIndexingService } from '../service/RdfSearchIndexingService';\nimport type { RdfStorageStatsService } from '../service/RdfStorageStatsService';\nimport type { InngestRunExecutionBackend } from '../runs/InngestRunExecutionBackend';\nimport type { RunContextRetriever } from '../runs/RunExecutionBackend';\nimport type { EmbeddedInngestRuntimeConfig } from '../runs/EmbeddedInngestService';\nimport type { RunAuthContextRegistry } from '../runs/RunAuthContextRegistry';\nimport type { TaskAuthBindingService, TaskService, InngestTaskScheduler } from '../tasks';\nimport type { PodMatrixStore } from '../matrix';\nimport type { ClientReconcilerCoordinator, ServerGroupReconcilerService } from '../reconciler';\nimport type { AuthMode } from '../../authorization/AuthMode';\nimport type { RdfEngineLike } from '../../storage/rdf';\nimport type { CredentialVault } from '../ai-gateway/credentials/CredentialVault';\nimport type { ProviderConnectService } from '../ai-gateway/connect';\nimport type { ProviderQuotaService } from '../ai-gateway/quota';\nimport type { AiGatewayService, GatewayCredentialStore } from '../ai-gateway/AiGatewayService';\nimport type { ProviderRuntimeRegistry } from '../ai-gateway/providers/ProviderRuntimeRegistry';\nimport type { ProviderRegistry as GatewayProviderRegistry } from '../ai-gateway/providers/ProviderRegistry';\nimport type { SessionAffinityStore } from '../ai-gateway/routing/SessionAffinityStore';\nimport type { AiConnectionInvocationKeyIssuer } from '../ai-gateway/auth/AiConnectionInvocationKeyIssuer';\nimport type { InvocationTokenCodec } from '../ai-gateway/auth/InvocationTokenCodec';\nimport type { ClientCredentialsInternalPodAccessTokenProvider } from '../ai-gateway/auth/ClientCredentialsInternalPodAccessTokenProvider';\nimport type { AiClientConfigurationService } from '../service/AiClientConfigurationService';\n\n/**\n * 容器配置\n */\nexport interface ApiContainerConfig {\n  /** 运行模式: cloud 持有密钥, local 调用远程 */\n  edition: 'cloud' | 'local';\n\n  /** API Server 端口 */\n  port: number;\n\n  /** API Server 主机 */\n  host: string;\n\n  /** API Server Unix socket 路径 */\n  socketPath?: string;\n\n  /** Runtime host implementation */\n  runtimeHost?: RuntimeHost;\n\n  /** Solid authorization mode used by CSS and SP-local Pod provisioning. */\n  authMode: AuthMode;\n\n  /** RDF term-id index used by CSS LDP structured reads. */\n  rdfIndexPath?: string;\n\n  /** 数据库连接 URL */\n  databaseUrl: string;\n\n  /** RDF/SPARQL facts database connection URL. */\n  sparqlEndpoint?: string;\n\n  /** Route SPARQL reads through an installed native SPARQL provider. */\n  rdfNativeSparqlEnabled?: boolean;\n\n  /** Redis connection URL, used by embedded infrastructure such as Inngest in cloud mode. */\n  redisUrl?: string;\n\n  /** Embedded Inngest runtime configuration. */\n  inngest?: {\n    enabled: boolean;\n    mode?: 'managed' | 'spawn';\n    port?: number;\n    host?: string;\n    baseUrl?: string;\n    eventKey?: string;\n    signingKey?: string;\n    binaryPath?: string;\n    sqliteDir?: string;\n  };\n\n  /** Resolved runtime config passed from API bootstrap after starting/locating Inngest. */\n  inngestRuntimeConfig?: EmbeddedInngestRuntimeConfig;\n\n  /** CORS 允许的源 */\n  corsOrigins: string[];\n\n  /** CSS Token 端点 */\n  cssTokenEndpoint: string;\n  solidBaseUrl?: string;\n\n  /** Gateway locator encryption secret. Internal platform secret; not a user/provider AI credential. */\n  gatewayLocatorSecret?: string;\n  gatewayLocatorKeyId?: string;\n  gatewayPreviousLocatorSecrets?: Array<{ kid: string; secret: string }>;\n\n  /** Internal service client used to read user-owned private Pod gateway-key hashes. */\n  gatewayInternalClientId?: string;\n  gatewayInternalClientSecret?: string;\n\n  /** Runtime-generated secret used only between GatewayProxy and the internal API server for admin ingress evidence. */\n  gatewayAdminProxyAuthSecret?: string;\n\n  /** AI Provider Connect is disabled by default for backwards-compatible startup. */\n  aiGatewayConnectEnabled?: boolean;\n  /** Local filesystem host capability for AI coding-client configuration. Disabled unless explicitly injected. */\n  aiClientConfiguration?: {\n    enabled: boolean;\n    homeDir: string;\n    backupRoot?: string;\n    authority: 'local-filesystem';\n  };\n  /** Platform signing secret for short-lived provider Connect attempts. */\n  aiGatewayConnectSigningSecret?: string;\n  /** Xpod/Moonshot-issued Kimi device-code OAuth client id. Never reuse official CLI ids. */\n  aiGatewayKimiClientId?: string;\n  /** Generic Pod SecretCell credential vault factory, configured by Xpod operations. */\n  secretCellCredentialVaultFactory?: () => CredentialVault;\n  /** Explicit provider endpoint overrides for controlled deployments and local E2E fixtures. */\n  aiGatewayProviderBaseUrls?: Partial<Record<'openai', string>>;\n\n  /** 子域名功能配置 (cloud 模式) */\n  subdomain?: {\n    /** 节点域名根域名 (如 undefineds.site)，有值即启用子域名功能 */\n    baseStorageDomain?: string;\n    cloudflareAccountId?: string;\n    cloudflareApiToken?: string;\n    tencentDnsSecretId?: string;\n    tencentDnsSecretKey?: string;\n  };\n\n  /** Cloud API 端点 (local 托管式，调用 cloud 的子域名 API) */\n  cloudApiEndpoint?: string;\n\n  /** 节点 ID (local 托管式) */\n  nodeId?: string;\n\n  /** 节点 Token (local 托管式，调用 Cloud API 的认证) */\n  nodeToken?: string;\n\n  /** Local SP service token（Cloud 回调 Local、Local 服务级 API 的唯一服务凭据） */\n  serviceToken?: string;\n\n  /** 已签发的 provisionCode（Local 首次注册/刷新后持久化恢复） */\n  provisionCode?: string;\n\n  /** Local canonical public URL（通常来自 CSS_BASE_URL，也可从 setup 恢复） */\n  publicUrl?: string;\n\n  /** Cloud 分配或用户指定的 SP 域名 */\n  spDomain?: string;\n\n  /** Local setup/provision 状态文件路径 */\n  localSetupPath?: string;\n\n  /** Local setup/provision 状态文件中的 provider key */\n  localSetupProviderId?: string;\n\n  /** OIDC Issuer URL (local 托管式，使用 Cloud IdP) */\n  oidcIssuer?: string;\n\n  /** Active tunnel provider after resolving profile selection. */\n  tunnelProvider?: ActiveTunnelProvider;\n\n  /** Recorded tunnel profiles. Only tunnelActiveProfileId/activeTunnelProfile takes effect at runtime. */\n  tunnelProfiles?: TunnelProfile[];\n\n  /** Selected tunnel profile id. */\n  tunnelActiveProfileId?: string;\n\n  /** Selected tunnel profile. */\n  activeTunnelProfile?: TunnelProfile;\n\n  /** Cloudflare Tunnel Token (local 托管式/自管式，启动 cloudflared) */\n  cloudflareTunnelToken?: string;\n\n  /** SakuraFRP Tunnel Token (SAKURA_TUNNEL_TOKEN；local 托管式/自管式，启动 frpc) */\n  sakuraTunnelToken?: string;\n\n  /** ngrok authtoken (local only; not sent to Cloud). */\n  ngrokAuthToken?: string;\n\n  /** Fixed ngrok endpoint/custom domain, e.g. https://example.ngrok-free.dev. */\n  ngrokUrl?: string;\n\n  /** ngrok executable path. */\n  ngrokPath?: string;\n\n  /** 是否接受 Edge 节点注册 (cloud 模式) */\n  edgeNodesEnabled?: boolean;\n}\n\nimport { EdgeNodeDnsCoordinator } from '../../edge/EdgeNodeDnsCoordinator';\nimport { EdgeNodeHealthProbeService } from '../../edge/EdgeNodeHealthProbeService';\nimport { EdgeNodeCapabilityDetector } from '../../edge/EdgeNodeCapabilityDetector';\nimport { LocalNetworkManager } from '../../edge/LocalNetworkManager';\nimport { DdnsManager } from '../../edge/DdnsManager';\n\n/**\n * 容器中注册的所有服务\n */\nexport interface ApiContainerCradle {\n  // 配置\n  config: ApiContainerConfig;\n\n  // 核心服务\n  db: IdentityDatabase;\n  apiServer: ApiServer;\n  authMiddleware: AuthMiddleware;\n  authenticator: Authenticator;\n\n  // 仓库\n  nodeRepo: EdgeNodeRepository;\n  serviceTokenRepo: ServiceTokenRepositoryPort;\n  gatewayInternalPodAccess: ClientCredentialsInternalPodAccessTokenProvider;\n  gatewayAccessKeyRepository: GatewayAccessKeyRepository;\n  invocationTokenCodec: InvocationTokenCodec;\n  aiConnectionInvocationKeyIssuer: AiConnectionInvocationKeyIssuer;\n  aiClientConfigurationService?: AiClientConfigurationService;\n  providerConnectService: ProviderConnectService;\n  providerQuotaService?: ProviderQuotaService;\n  gatewayProviderRegistry: GatewayProviderRegistry;\n  gatewayCredentialStore: GatewayCredentialStore;\n  gatewayRuntimeRegistry: ProviderRuntimeRegistry;\n  gatewaySessionAffinityStore: SessionAffinityStore;\n  aiGatewayService: AiGatewayService;\n\n  // 业务服务\n  chatService: VercelChatService;\n\n  // ChatKit 服务 (OpenAI ChatKit 协议)\n  chatKitStore: PodChatKitStore;\n  chatKitAiProvider: AiProvider;\n  inngestRuntimeConfig: EmbeddedInngestRuntimeConfig | undefined;\n  runAuthContextRegistry: RunAuthContextRegistry;\n  rdfEngine: RdfEngineLike | undefined;\n  runContextRetriever: RunContextRetriever<StoreContext> | undefined;\n  rdfSearchIndexingService: RdfSearchIndexingService | undefined;\n  runExecutionBackend: InngestRunExecutionBackend;\n  taskAuthBindingService: TaskAuthBindingService<StoreContext>;\n  taskService: TaskService<StoreContext>;\n  inngestTaskScheduler: InngestTaskScheduler<StoreContext>;\n  chatKitService: ChatKitService<StoreContext>;\n  matrixStore: PodMatrixStore;\n  clientReconcilerCoordinator: ClientReconcilerCoordinator;\n  serverGroupReconcilerService: ServerGroupReconcilerService;\n  providerRegistry: ProviderRegistry;\n  embeddingService: EmbeddingService;\n  vectorService: VectorService;\n  rdfStorageStatsService: RdfStorageStatsService;\n\n  // Cloud 模式: 身份服务\n  ddnsRepo?: DdnsRepository;\n  podLookupRepo?: PodLookupRepository;\n  accountRoleRepo?: AccountRoleRepository;\n\n  // 子域名相关 (可选，按 edition 注册)\n  // Cloud 模式 或 Local 自管模式\n  dnsProvider?: DnsProvider;\n  dnsCoordinator?: EdgeNodeDnsCoordinator;\n  healthProbeService?: EdgeNodeHealthProbeService;\n  capabilityDetector?: EdgeNodeCapabilityDetector;\n  localNetworkManager?: LocalNetworkManager;\n\n  tunnelProvider?: TunnelProvider;\n  subdomainService?: SubdomainService;\n  // Local 托管式\n  subdomainClient?: SubdomainClient;\n  // Local 托管式 DDNS 管理\n  ddnsManager?: DdnsManager;\n  // Local 托管式/自管式 (启动 cloudflared)\n  localTunnelProvider?: TunnelProvider;\n\n  // Optional runtime certificate managers. Routes only enable TLS status/renewal\n  // when one of these services is explicitly registered by the active profile.\n  edgeNodeCertificateCapabilityBridge?: EdgeNodeCertificateCapabilityBridge;\n  certificateManager?: unknown;\n  acmeCertificateManager?: AcmeCertificateManager;\n  clusterCertificateManager?: ClusterCertificateManager;\n}\n"]}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/api/container/types.ts"],"names":[],"mappings":";AAAA;;;;GAIG","sourcesContent":["/**\n * API Container 依赖类型定义\n *\n * 定义容器中注册的所有服务接口\n */\n\nimport type { ApiServer } from '../ApiServer';\nimport type { AuthMiddleware } from '../middleware/AuthMiddleware';\nimport type { Authenticator } from '../auth/Authenticator';\nimport type { GatewayAccessKeyRepository } from '../ai-gateway/auth/GatewayApiKeyAuthenticator';\nimport type { EdgeNodeRepository } from '../../identity/drizzle/EdgeNodeRepository';\nimport type { ServiceTokenRepositoryPort } from '../../identity/drizzle/ServiceTokenRepository';\nimport type { VercelChatService } from '../service/VercelChatService';\nimport type { SubdomainService } from '../../subdomain/SubdomainService';\nimport type { SubdomainClient } from '../../subdomain/SubdomainClient';\nimport type { DnsProvider } from '../../dns/DnsProvider';\nimport type { TunnelProvider } from '../../tunnel/TunnelProvider';\nimport type { ActiveTunnelProvider, TunnelProfile } from '../../tunnel/TunnelProfiles';\nimport type { AcmeCertificateManager } from '../../edge/acme/AcmeCertificateManager';\nimport type { ClusterCertificateManager } from '../../edge/acme/ClusterCertificateManager';\nimport type { EdgeNodeCertificateCapabilityBridge } from '../../edge/EdgeNodeCertificateCapabilityBridge';\nimport type { IdentityDatabase } from '../../identity/drizzle/db';\nimport type { DdnsRepository } from '../../identity/drizzle/DdnsRepository';\nimport type { PodLookupRepository } from '../../identity/drizzle/PodLookupRepository';\nimport type { AccountRoleRepository } from '../../identity/drizzle/AccountRoleRepository';\nimport type { ChatKitService, AiProvider } from '../chatkit';\nimport type { StoreContext } from '../chatkit/store';\nimport type { PodChatKitStore } from '../chatkit/pod-store';\nimport type { RuntimeHost } from '../../runtime/host/types';\nimport type { ProviderRegistry, EmbeddingService } from '../../ai/service';\nimport type { VectorService } from '../service/VectorService';\nimport type { RdfSearchIndexingService } from '../service/RdfSearchIndexingService';\nimport type { RdfStorageStatsService } from '../service/RdfStorageStatsService';\nimport type { InngestRunExecutionBackend } from '../runs/InngestRunExecutionBackend';\nimport type { RunContextRetriever } from '../runs/RunExecutionBackend';\nimport type { EmbeddedInngestRuntimeConfig } from '../runs/EmbeddedInngestService';\nimport type { RunAuthContextRegistry } from '../runs/RunAuthContextRegistry';\nimport type { TaskAuthBindingService, TaskService, InngestTaskScheduler } from '../tasks';\nimport type { PodMatrixStore } from '../matrix';\nimport type { ClientReconcilerCoordinator, ServerGroupReconcilerService } from '../reconciler';\nimport type { AuthMode } from '../../authorization/AuthMode';\nimport type { RdfEngineLike } from '../../storage/rdf';\nimport type { CredentialVault } from '../ai-gateway/credentials/CredentialVault';\nimport type { ProviderConnectService } from '../ai-gateway/connect';\nimport type { ProviderQuotaService } from '../ai-gateway/quota';\nimport type { AiGatewayService, GatewayCredentialStore } from '../ai-gateway/AiGatewayService';\nimport type { ProviderRuntimeRegistry } from '../ai-gateway/providers/ProviderRuntimeRegistry';\nimport type { ProviderRegistry as GatewayProviderRegistry } from '../ai-gateway/providers/ProviderRegistry';\nimport type { SessionAffinityStore } from '../ai-gateway/routing/SessionAffinityStore';\nimport type { AiConnectionInvocationKeyIssuer } from '../ai-gateway/auth/AiConnectionInvocationKeyIssuer';\nimport type { InvocationTokenCodec } from '../ai-gateway/auth/InvocationTokenCodec';\nimport type { ClientCredentialsInternalPodAccessTokenProvider } from '../ai-gateway/auth/ClientCredentialsInternalPodAccessTokenProvider';\nimport type { AiClientConfigurationService } from '../service/AiClientConfigurationService';\n\n/**\n * 容器配置\n */\nexport interface ApiContainerConfig {\n  /** 运行模式: cloud 持有密钥, local 调用远程 */\n  edition: 'cloud' | 'local';\n\n  /** API Server 端口 */\n  port: number;\n\n  /** API Server 主机 */\n  host: string;\n\n  /** API Server Unix socket 路径 */\n  socketPath?: string;\n\n  /** Runtime host implementation */\n  runtimeHost?: RuntimeHost;\n\n  /** Solid authorization mode used by CSS and SP-local Pod provisioning. */\n  authMode: AuthMode;\n\n  /** RDF term-id index used by CSS LDP structured reads. */\n  rdfIndexPath?: string;\n\n  /** 数据库连接 URL */\n  databaseUrl: string;\n\n  /** RDF/SPARQL facts database connection URL. */\n  sparqlEndpoint?: string;\n\n  /** Route SPARQL reads through an installed native SPARQL provider. */\n  rdfNativeSparqlEnabled?: boolean;\n\n  /** Redis connection URL, used by embedded infrastructure such as Inngest in cloud mode. */\n  redisUrl?: string;\n\n  /** Embedded Inngest runtime configuration. */\n  inngest?: {\n    enabled: boolean;\n    mode?: 'managed' | 'spawn';\n    port?: number;\n    host?: string;\n    baseUrl?: string;\n    eventKey?: string;\n    signingKey?: string;\n    binaryPath?: string;\n    sqliteDir?: string;\n  };\n\n  /** Resolved runtime config passed from API bootstrap after starting/locating Inngest. */\n  inngestRuntimeConfig?: EmbeddedInngestRuntimeConfig;\n\n  /** CORS 允许的源 */\n  corsOrigins: string[];\n\n  /** CSS Token 端点 */\n  cssTokenEndpoint: string;\n  solidBaseUrl?: string;\n\n  /** Gateway locator encryption secret. Internal platform secret; not a user/provider AI credential. */\n  gatewayLocatorSecret?: string;\n  gatewayLocatorKeyId?: string;\n  gatewayPreviousLocatorSecrets?: Array<{ kid: string; secret: string }>;\n\n  /** Internal service client used to read user-owned private Pod gateway-key hashes. */\n  gatewayInternalClientId?: string;\n  gatewayInternalClientSecret?: string;\n\n  /** Runtime-generated secret used only between GatewayProxy and the internal API server for admin ingress evidence. */\n  gatewayAdminProxyAuthSecret?: string;\n\n  /** AI Provider Connect is disabled by default for backwards-compatible startup. */\n  aiGatewayConnectEnabled?: boolean;\n  /** Local filesystem host capability for AI coding-client configuration. Disabled unless explicitly injected. */\n  aiClientConfiguration?: {\n    enabled: boolean;\n    homeDir: string;\n    backupRoot?: string;\n    authority: 'local-filesystem';\n  };\n  /** Platform signing secret for short-lived provider Connect attempts. */\n  aiGatewayConnectSigningSecret?: string;\n  /** Xpod/Moonshot-issued Kimi device-code OAuth client id. Never reuse official CLI ids. */\n  aiGatewayKimiClientId?: string;\n  /** Generic Pod SecretCell credential vault factory, configured by Xpod operations. */\n  secretCellCredentialVaultFactory?: () => CredentialVault;\n  /** Explicit provider endpoint overrides for controlled deployments and local E2E fixtures. */\n  aiGatewayProviderBaseUrls?: Partial<Record<'openai', string>>;\n\n  /** 子域名功能配置 (cloud 模式) */\n  subdomain?: {\n    /** 节点域名根域名 (如 undefineds.site)，有值即启用子域名功能 */\n    baseStorageDomain?: string;\n    cloudflareAccountId?: string;\n    cloudflareApiToken?: string;\n    tencentDnsSecretId?: string;\n    tencentDnsSecretKey?: string;\n  };\n\n  /** Cloud API 端点 (local 托管式，调用 cloud 的子域名 API) */\n  cloudApiEndpoint?: string;\n\n  /** 节点 ID (local 托管式) */\n  nodeId?: string;\n\n  /** 节点 Token (local 托管式，调用 Cloud API 的认证) */\n  nodeToken?: string;\n\n  /** Local SP service token（Cloud 回调 Local、Local 服务级 API 的唯一服务凭据） */\n  serviceToken?: string;\n\n  /** 已签发的 provisionCode（Local 首次注册/刷新后持久化恢复） */\n  provisionCode?: string;\n\n  /** Local canonical public URL（通常来自 CSS_BASE_URL，也可从 setup 恢复） */\n  publicUrl?: string;\n\n  /** Cloud 分配或用户指定的 SP 域名 */\n  spDomain?: string;\n\n  /** Local setup/provision 状态文件路径 */\n  localSetupPath?: string;\n\n  /** Local setup/provision 状态文件中的 provider key */\n  localSetupProviderId?: string;\n\n  /** OIDC Issuer URL (local 托管式，使用 Cloud IdP) */\n  oidcIssuer?: string;\n\n  /** Active tunnel provider after resolving profile selection. */\n  tunnelProvider?: ActiveTunnelProvider;\n\n  /** Recorded tunnel profiles. Only tunnelActiveProfileId/activeTunnelProfile takes effect at runtime. */\n  tunnelProfiles?: TunnelProfile[];\n\n  /** Selected tunnel profile id. */\n  tunnelActiveProfileId?: string;\n\n  /** Selected tunnel profile. */\n  activeTunnelProfile?: TunnelProfile;\n\n  /** Cloudflare Tunnel Token (local 托管式/自管式，启动 cloudflared) */\n  cloudflareTunnelToken?: string;\n\n  /** SakuraFRP Tunnel Token (SAKURA_TUNNEL_TOKEN；local 托管式/自管式，启动 frpc) */\n  sakuraTunnelToken?: string;\n\n  /** ngrok authtoken (local only; not sent to Cloud). */\n  ngrokAuthToken?: string;\n\n  /** Fixed ngrok endpoint/custom domain, e.g. https://example.ngrok-free.dev. */\n  ngrokUrl?: string;\n\n  /** ngrok executable path. */\n  ngrokPath?: string;\n\n  /** 是否接受 Edge 节点注册 (cloud 模式) */\n  edgeNodesEnabled?: boolean;\n}\n\nimport { EdgeNodeDnsCoordinator } from '../../edge/EdgeNodeDnsCoordinator';\nimport { EdgeNodeHealthProbeService } from '../../edge/EdgeNodeHealthProbeService';\nimport { EdgeNodeCapabilityDetector } from '../../edge/EdgeNodeCapabilityDetector';\nimport { LocalNetworkManager } from '../../edge/LocalNetworkManager';\nimport { DdnsManager } from '../../edge/DdnsManager';\n\n/**\n * 容器中注册的所有服务\n */\nexport interface ApiContainerCradle {\n  // 配置\n  config: ApiContainerConfig;\n\n  // 核心服务\n  db: IdentityDatabase;\n  apiServer: ApiServer;\n  authMiddleware: AuthMiddleware;\n  authenticator: Authenticator;\n\n  // 仓库\n  nodeRepo: EdgeNodeRepository;\n  serviceTokenRepo: ServiceTokenRepositoryPort;\n  gatewayInternalPodAccess?: ClientCredentialsInternalPodAccessTokenProvider;\n  gatewayAccessKeyRepository: GatewayAccessKeyRepository;\n  invocationTokenCodec: InvocationTokenCodec;\n  aiConnectionInvocationKeyIssuer: AiConnectionInvocationKeyIssuer;\n  aiClientConfigurationService?: AiClientConfigurationService;\n  providerConnectService: ProviderConnectService;\n  providerQuotaService?: ProviderQuotaService;\n  gatewayProviderRegistry: GatewayProviderRegistry;\n  gatewayCredentialStore: GatewayCredentialStore;\n  gatewayRuntimeRegistry: ProviderRuntimeRegistry;\n  gatewaySessionAffinityStore: SessionAffinityStore;\n  aiGatewayService: AiGatewayService;\n\n  // 业务服务\n  chatService: VercelChatService;\n\n  // ChatKit 服务 (OpenAI ChatKit 协议)\n  chatKitStore: PodChatKitStore;\n  chatKitAiProvider: AiProvider;\n  inngestRuntimeConfig: EmbeddedInngestRuntimeConfig | undefined;\n  runAuthContextRegistry: RunAuthContextRegistry;\n  rdfEngine: RdfEngineLike | undefined;\n  runContextRetriever: RunContextRetriever<StoreContext> | undefined;\n  rdfSearchIndexingService: RdfSearchIndexingService | undefined;\n  runExecutionBackend: InngestRunExecutionBackend;\n  taskAuthBindingService: TaskAuthBindingService<StoreContext>;\n  taskService: TaskService<StoreContext>;\n  inngestTaskScheduler: InngestTaskScheduler<StoreContext>;\n  chatKitService: ChatKitService<StoreContext>;\n  matrixStore: PodMatrixStore;\n  clientReconcilerCoordinator: ClientReconcilerCoordinator;\n  serverGroupReconcilerService: ServerGroupReconcilerService;\n  providerRegistry: ProviderRegistry;\n  embeddingService: EmbeddingService;\n  vectorService: VectorService;\n  rdfStorageStatsService: RdfStorageStatsService;\n\n  // Cloud 模式: 身份服务\n  ddnsRepo?: DdnsRepository;\n  podLookupRepo?: PodLookupRepository;\n  accountRoleRepo?: AccountRoleRepository;\n\n  // 子域名相关 (可选，按 edition 注册)\n  // Cloud 模式 或 Local 自管模式\n  dnsProvider?: DnsProvider;\n  dnsCoordinator?: EdgeNodeDnsCoordinator;\n  healthProbeService?: EdgeNodeHealthProbeService;\n  capabilityDetector?: EdgeNodeCapabilityDetector;\n  localNetworkManager?: LocalNetworkManager;\n\n  tunnelProvider?: TunnelProvider;\n  subdomainService?: SubdomainService;\n  // Local 托管式\n  subdomainClient?: SubdomainClient;\n  // Local 托管式 DDNS 管理\n  ddnsManager?: DdnsManager;\n  // Local 托管式/自管式 (启动 cloudflared)\n  localTunnelProvider?: TunnelProvider;\n\n  // Optional runtime certificate managers. Routes only enable TLS status/renewal\n  // when one of these services is explicitly registered by the active profile.\n  edgeNodeCertificateCapabilityBridge?: EdgeNodeCertificateCapabilityBridge;\n  certificateManager?: unknown;\n  acmeCertificateManager?: AcmeCertificateManager;\n  clusterCertificateManager?: ClusterCertificateManager;\n}\n"]}

package/dist/api/handlers/DeviceNotificationRuntime.d.ts

@@ -0,0 +1,26 @@
+import type { ApiServer } from '../ApiServer';
+import { DeviceNotificationTicketHandler } from './DeviceNotificationTicketHandler';
+import { DeviceNotificationWebSocketServer } from '../../http/DeviceNotificationWebSocketServer';
+import { DeviceNotificationHub } from '../../notifications/DeviceNotificationHub';
+import { DeviceNotificationResourceListener } from '../../notifications/DeviceNotificationResourceListener';
+import { XPOD_NOTIFICATIONS_PROTOCOL } from '../../notifications/device-notification-protocol';
+export interface DeviceNotificationRuntimeOptions {
+    origin: string;
+    ticketEndpoint?: string;
+    webSocketEndpoint?: string;
+    ticketTtlMs?: number;
+    authorizeTopic?: ConstructorParameters<typeof DeviceNotificationHub>[0]['authorizeTopic'];
+}
+export interface DeviceNotificationRuntimeHandle {
+    hub: DeviceNotificationHub;
+    ticketHandler: DeviceNotificationTicketHandler;
+    webSocketServer: DeviceNotificationWebSocketServer;
+    resourceListener: DeviceNotificationResourceListener;
+    descriptor: {
+        protocol: typeof XPOD_NOTIFICATIONS_PROTOCOL;
+        ticketEndpoint: string;
+        webSocketEndpoint: string;
+    };
+    stop(): void;
+}
+export declare function registerDeviceNotificationRuntime(server: ApiServer, options: DeviceNotificationRuntimeOptions): DeviceNotificationRuntimeHandle;

package/dist/api/handlers/DeviceNotificationRuntime.js

@@ -0,0 +1,77 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerDeviceNotificationRuntime = registerDeviceNotificationRuntime;
+const DeviceNotificationTicketHandler_1 = require("./DeviceNotificationTicketHandler");
+const DeviceNotificationWebSocketServer_1 = require("../../http/DeviceNotificationWebSocketServer");
+const DeviceNotificationHub_1 = require("../../notifications/DeviceNotificationHub");
+const DeviceNotificationResourceListener_1 = require("../../notifications/DeviceNotificationResourceListener");
+const ObservableResourceStore_1 = require("../../storage/ObservableResourceStore");
+const device_notification_protocol_1 = require("../../notifications/device-notification-protocol");
+function registerDeviceNotificationRuntime(server, options) {
+    const ticketEndpoint = options.ticketEndpoint ?? '/v1/notifications/tickets';
+    const webSocketEndpoint = options.webSocketEndpoint ?? '/v1/notifications/ws';
+    const descriptor = {
+        protocol: device_notification_protocol_1.XPOD_NOTIFICATIONS_PROTOCOL,
+        ticketEndpoint,
+        webSocketEndpoint,
+    };
+    const hub = new DeviceNotificationHub_1.DeviceNotificationHub({
+        origin: options.origin,
+        authorizeTopic: options.authorizeTopic,
+    });
+    const ticketStore = new DeviceNotificationTicketHandler_1.DeviceNotificationTicketStore();
+    const ticketHandler = new DeviceNotificationTicketHandler_1.DeviceNotificationTicketHandler({
+        origin: options.origin,
+        webSocketEndpoint,
+        ticketTtlMs: options.ticketTtlMs,
+        ticketStore,
+    });
+    const webSocketServer = new DeviceNotificationWebSocketServer_1.DeviceNotificationWebSocketServer({
+        hub,
+        ticketStore,
+        path: webSocketEndpoint,
+    });
+    const resourceListener = new DeviceNotificationResourceListener_1.DeviceNotificationResourceListener({
+        origin: options.origin,
+        hub,
+    });
+    server.addResponseHeaders({
+        'X-Xpod-Notifications': JSON.stringify(descriptor),
+    });
+    server.post(ticketEndpoint, async (request, response) => {
+        await ticketHandler.handle(request, response);
+    });
+    server.get('/.well-known/xpod-notifications', async (_request, response) => {
+        sendJson(response, 200, descriptor);
+    }, { public: true });
+    server.addUpgradeHandler((request, socket, head) => {
+        webSocketServer.handleUpgrade(request, socket, head);
+    });
+    ObservableResourceStore_1.ObservableResourceStore.addGlobalListener(resourceListener);
+    server.addShutdownHandler(() => {
+        webSocketServer.stop();
+        ticketStore.clear();
+        ObservableResourceStore_1.ObservableResourceStore.removeGlobalListener(resourceListener);
+    });
+    return {
+        hub,
+        ticketHandler,
+        webSocketServer,
+        resourceListener,
+        descriptor,
+        stop: () => {
+            webSocketServer.stop();
+            ticketStore.clear();
+            ObservableResourceStore_1.ObservableResourceStore.removeGlobalListener(resourceListener);
+        },
+    };
+}
+function sendJson(response, status, body) {
+    const encoded = JSON.stringify(body);
+    response.writeHead(status, {
+        'Content-Type': 'application/json',
+        'Content-Length': Buffer.byteLength(encoded),
+    });
+    response.end(encoded);
+}
+//# sourceMappingURL=DeviceNotificationRuntime.js.map

package/dist/api/handlers/DeviceNotificationRuntime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DeviceNotificationRuntime.js","sourceRoot":"","sources":["../../../src/api/handlers/DeviceNotificationRuntime.ts"],"names":[],"mappings":";;AA+BA,8EA+DC;AA5FD,uFAAmH;AACnH,oGAAiG;AACjG,qFAAkF;AAClF,+GAA4G;AAC5G,mFAAgF;AAChF,mGAA+F;AAwB/F,SAAgB,iCAAiC,CAC/C,MAAiB,EACjB,OAAyC;IAEzC,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,2BAA2B,CAAC;IAC7E,MAAM,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,IAAI,sBAAsB,CAAC;IAC9E,MAAM,UAAU,GAAkD;QAChE,QAAQ,EAAE,0DAA2B;QACrC,cAAc;QACd,iBAAiB;KAClB,CAAC;IACF,MAAM,GAAG,GAAG,IAAI,6CAAqB,CAAC;QACpC,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,cAAc,EAAE,OAAO,CAAC,cAAc;KACvC,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,IAAI,+DAA6B,EAAE,CAAC;IACxD,MAAM,aAAa,GAAG,IAAI,iEAA+B,CAAC;QACxD,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,iBAAiB;QACjB,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,WAAW;KACZ,CAAC,CAAC;IACH,MAAM,eAAe,GAAG,IAAI,qEAAiC,CAAC;QAC5D,GAAG;QACH,WAAW;QACX,IAAI,EAAE,iBAAiB;KACxB,CAAC,CAAC;IACH,MAAM,gBAAgB,GAAG,IAAI,uEAAkC,CAAC;QAC9D,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,GAAG;KACJ,CAAC,CAAC;IAEH,MAAM,CAAC,kBAAkB,CAAC;QACxB,sBAAsB,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC;KACnD,CAAC,CAAC;IACH,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;QACtD,MAAM,aAAa,CAAC,MAAM,CAAC,OAA+B,EAAE,QAAQ,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;IACH,MAAM,CAAC,GAAG,CAAC,iCAAiC,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE;QACzE,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;IACtC,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IACrB,MAAM,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;QACjD,eAAe,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IACH,iDAAuB,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;IAC5D,MAAM,CAAC,kBAAkB,CAAC,GAAG,EAAE;QAC7B,eAAe,CAAC,IAAI,EAAE,CAAC;QACvB,WAAW,CAAC,KAAK,EAAE,CAAC;QACpB,iDAAuB,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,GAAG;QACH,aAAa;QACb,eAAe;QACf,gBAAgB;QAChB,UAAU;QACV,IAAI,EAAE,GAAG,EAAE;YACT,eAAe,CAAC,IAAI,EAAE,CAAC;YACvB,WAAW,CAAC,KAAK,EAAE,CAAC;YACpB,iDAAuB,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;QACjE,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,QAAwB,EAAE,MAAc,EAAE,IAAa;IACvE,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACrC,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE;QACzB,cAAc,EAAE,kBAAkB;QAClC,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC;KAC7C,CAAC,CAAC;IACH,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AACxB,CAAC","sourcesContent":["import type { ServerResponse } from 'node:http';\nimport type { ApiServer } from '../ApiServer';\nimport { DeviceNotificationTicketHandler, DeviceNotificationTicketStore } from './DeviceNotificationTicketHandler';\nimport { DeviceNotificationWebSocketServer } from '../../http/DeviceNotificationWebSocketServer';\nimport { DeviceNotificationHub } from '../../notifications/DeviceNotificationHub';\nimport { DeviceNotificationResourceListener } from '../../notifications/DeviceNotificationResourceListener';\nimport { ObservableResourceStore } from '../../storage/ObservableResourceStore';\nimport { XPOD_NOTIFICATIONS_PROTOCOL } from '../../notifications/device-notification-protocol';\nimport type { AuthenticatedRequest } from '../middleware/AuthMiddleware';\n\nexport interface DeviceNotificationRuntimeOptions {\n  origin: string;\n  ticketEndpoint?: string;\n  webSocketEndpoint?: string;\n  ticketTtlMs?: number;\n  authorizeTopic?: ConstructorParameters<typeof DeviceNotificationHub>[0]['authorizeTopic'];\n}\n\nexport interface DeviceNotificationRuntimeHandle {\n  hub: DeviceNotificationHub;\n  ticketHandler: DeviceNotificationTicketHandler;\n  webSocketServer: DeviceNotificationWebSocketServer;\n  resourceListener: DeviceNotificationResourceListener;\n  descriptor: {\n    protocol: typeof XPOD_NOTIFICATIONS_PROTOCOL;\n    ticketEndpoint: string;\n    webSocketEndpoint: string;\n  };\n  stop(): void;\n}\n\nexport function registerDeviceNotificationRuntime(\n  server: ApiServer,\n  options: DeviceNotificationRuntimeOptions,\n): DeviceNotificationRuntimeHandle {\n  const ticketEndpoint = options.ticketEndpoint ?? '/v1/notifications/tickets';\n  const webSocketEndpoint = options.webSocketEndpoint ?? '/v1/notifications/ws';\n  const descriptor: DeviceNotificationRuntimeHandle['descriptor'] = {\n    protocol: XPOD_NOTIFICATIONS_PROTOCOL,\n    ticketEndpoint,\n    webSocketEndpoint,\n  };\n  const hub = new DeviceNotificationHub({\n    origin: options.origin,\n    authorizeTopic: options.authorizeTopic,\n  });\n  const ticketStore = new DeviceNotificationTicketStore();\n  const ticketHandler = new DeviceNotificationTicketHandler({\n    origin: options.origin,\n    webSocketEndpoint,\n    ticketTtlMs: options.ticketTtlMs,\n    ticketStore,\n  });\n  const webSocketServer = new DeviceNotificationWebSocketServer({\n    hub,\n    ticketStore,\n    path: webSocketEndpoint,\n  });\n  const resourceListener = new DeviceNotificationResourceListener({\n    origin: options.origin,\n    hub,\n  });\n\n  server.addResponseHeaders({\n    'X-Xpod-Notifications': JSON.stringify(descriptor),\n  });\n  server.post(ticketEndpoint, async (request, response) => {\n    await ticketHandler.handle(request as AuthenticatedRequest, response);\n  });\n  server.get('/.well-known/xpod-notifications', async (_request, response) => {\n    sendJson(response, 200, descriptor);\n  }, { public: true });\n  server.addUpgradeHandler((request, socket, head) => {\n    webSocketServer.handleUpgrade(request, socket, head);\n  });\n  ObservableResourceStore.addGlobalListener(resourceListener);\n  server.addShutdownHandler(() => {\n    webSocketServer.stop();\n    ticketStore.clear();\n    ObservableResourceStore.removeGlobalListener(resourceListener);\n  });\n\n  return {\n    hub,\n    ticketHandler,\n    webSocketServer,\n    resourceListener,\n    descriptor,\n    stop: () => {\n      webSocketServer.stop();\n      ticketStore.clear();\n      ObservableResourceStore.removeGlobalListener(resourceListener);\n    },\n  };\n}\n\nfunction sendJson(response: ServerResponse, status: number, body: unknown): void {\n  const encoded = JSON.stringify(body);\n  response.writeHead(status, {\n    'Content-Type': 'application/json',\n    'Content-Length': Buffer.byteLength(encoded),\n  });\n  response.end(encoded);\n}\n"]}

package/dist/api/handlers/DeviceNotificationTicketHandler.d.ts

@@ -0,0 +1,50 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { AuthContext } from '../auth/AuthContext';
+export interface DeviceNotificationIdentity {
+    webId: string;
+    localPart: string;
+}
+export interface DeviceNotificationTicketRecord {
+    digest: string;
+    identity: DeviceNotificationIdentity;
+    deviceSessionId: string;
+    origin: string;
+    expiresAt: number;
+}
+export declare class DeviceNotificationTicketStore {
+    private readonly records;
+    mint(input: {
+        identity: DeviceNotificationIdentity;
+        deviceSessionId: string;
+        origin: string;
+        ttlMs: number;
+    }): string;
+    consume(ticket: string): DeviceNotificationTicketRecord | undefined;
+    size(): number;
+    clear(): void;
+    private digest;
+}
+export interface DeviceNotificationTicketHandlerOptions {
+    webSocketEndpoint: string;
+    origin: string;
+    ticketTtlMs?: number;
+    ticketStore?: DeviceNotificationTicketStore;
+}
+type TicketRequest = IncomingMessage & {
+    auth?: AuthContext | {
+        webId?: string;
+        localPart?: string;
+    };
+};
+export declare class DeviceNotificationTicketHandler {
+    readonly ticketStore: DeviceNotificationTicketStore;
+    private readonly webSocketEndpoint;
+    private readonly origin;
+    private readonly ticketTtlMs;
+    constructor(options: DeviceNotificationTicketHandlerOptions);
+    handle(request: TicketRequest, response: ServerResponse): Promise<void>;
+    private extractIdentity;
+    private readJson;
+    private sendJson;
+}
+export {};

package/dist/api/handlers/DeviceNotificationTicketHandler.js

@@ -0,0 +1,130 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DeviceNotificationTicketHandler = exports.DeviceNotificationTicketStore = void 0;
+const node_crypto_1 = require("node:crypto");
+class DeviceNotificationTicketStore {
+    constructor() {
+        this.records = new Map();
+    }
+    mint(input) {
+        const ticket = (0, node_crypto_1.randomBytes)(32).toString('base64url');
+        this.records.set(this.digest(ticket), {
+            digest: this.digest(ticket),
+            identity: input.identity,
+            deviceSessionId: input.deviceSessionId,
+            origin: new URL(input.origin).origin,
+            expiresAt: Date.now() + input.ttlMs,
+        });
+        return ticket;
+    }
+    consume(ticket) {
+        const digest = this.digest(ticket);
+        const record = this.records.get(digest);
+        this.records.delete(digest);
+        if (!record || record.expiresAt < Date.now()) {
+            return undefined;
+        }
+        return record;
+    }
+    size() {
+        return this.records.size;
+    }
+    clear() {
+        this.records.clear();
+    }
+    digest(ticket) {
+        return (0, node_crypto_1.createHash)('sha256').update(ticket).digest('hex');
+    }
+}
+exports.DeviceNotificationTicketStore = DeviceNotificationTicketStore;
+class DeviceNotificationTicketHandler {
+    constructor(options) {
+        this.webSocketEndpoint = options.webSocketEndpoint;
+        this.origin = new URL(options.origin).origin;
+        this.ticketTtlMs = options.ticketTtlMs ?? 60_000;
+        this.ticketStore = options.ticketStore ?? new DeviceNotificationTicketStore();
+    }
+    async handle(request, response) {
+        const identity = this.extractIdentity(request);
+        if (!identity) {
+            this.sendJson(response, 401, { error: 'Unauthorized' });
+            return;
+        }
+        const body = await this.readJson(request);
+        const deviceSessionId = typeof body.deviceSessionId === 'string'
+            ? body.deviceSessionId
+            : typeof body.sessionId === 'string'
+                ? body.sessionId
+                : undefined;
+        const origin = typeof body.origin === 'string' ? body.origin : undefined;
+        if (!deviceSessionId || !origin) {
+            this.sendJson(response, 400, { error: 'deviceSessionId and origin are required' });
+            return;
+        }
+        try {
+            if (new URL(origin).origin !== this.origin) {
+                this.sendJson(response, 400, { error: 'origin must match the notification service origin' });
+                return;
+            }
+        }
+        catch {
+            this.sendJson(response, 400, { error: 'origin must be a valid URL' });
+            return;
+        }
+        const ticket = this.ticketStore.mint({
+            identity,
+            deviceSessionId,
+            origin: this.origin,
+            ttlMs: this.ticketTtlMs,
+        });
+        this.sendJson(response, 201, {
+            protocol: 'xpod.notifications.v1',
+            ticket,
+            webSocketEndpoint: this.webSocketEndpoint,
+            expiresInMs: this.ticketTtlMs,
+        });
+    }
+    extractIdentity(request) {
+        const auth = request.auth;
+        const webId = auth && 'webId' in auth && typeof auth.webId === 'string' ? auth.webId : undefined;
+        if (!webId) {
+            return undefined;
+        }
+        return {
+            webId,
+            localPart: auth && 'localPart' in auth && typeof auth.localPart === 'string'
+                ? auth.localPart
+                : deriveLocalPart(webId),
+        };
+    }
+    async readJson(request) {
+        const chunks = [];
+        await new Promise((resolve, reject) => {
+            request.on('data', (chunk) => chunks.push(chunk));
+            request.on('end', () => resolve());
+            request.on('error', reject);
+        });
+        const body = Buffer.concat(chunks).toString('utf8');
+        return body.length > 0 ? JSON.parse(body) : {};
+    }
+    sendJson(response, status, body) {
+        const encoded = JSON.stringify(body);
+        response.writeHead(status, {
+            'Content-Type': 'application/json',
+            'Content-Length': Buffer.byteLength(encoded),
+        });
+        response.end(encoded);
+    }
+}
+exports.DeviceNotificationTicketHandler = DeviceNotificationTicketHandler;
+function deriveLocalPart(webId) {
+    try {
+        const url = new URL(webId);
+        const parts = url.pathname.split('/').filter(Boolean);
+        return parts[0] ?? 'unknown';
+    }
+    catch {
+        return 'unknown';
+    }
+}
+//# sourceMappingURL=DeviceNotificationTicketHandler.js.map

package/dist/api/handlers/DeviceNotificationTicketHandler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DeviceNotificationTicketHandler.js","sourceRoot":"","sources":["../../../src/api/handlers/DeviceNotificationTicketHandler.ts"],"names":[],"mappings":";;;AAAA,6CAAsD;AAiBtD,MAAa,6BAA6B;IAA1C;QACmB,YAAO,GAAG,IAAI,GAAG,EAA0C,CAAC;IAwC/E,CAAC;IAtCQ,IAAI,CAAC,KAKX;QACC,MAAM,MAAM,GAAG,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACrD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE;YACpC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;YAC3B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,MAAM,EAAE,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM;YACpC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,KAAK;SACpC,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC;IAEM,OAAO,CAAC,MAAc;QAC3B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5B,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC7C,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEM,IAAI;QACT,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3B,CAAC;IAEM,KAAK;QACV,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;IAEO,MAAM,CAAC,MAAc;QAC3B,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3D,CAAC;CACF;AAzCD,sEAyCC;AAaD,MAAa,+BAA+B;IAM1C,YAAmB,OAA+C;QAChE,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC;QACnD,IAAI,CAAC,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;QAC7C,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,MAAM,CAAC;QACjD,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,IAAI,6BAA6B,EAAE,CAAC;IAChF,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,OAAsB,EAAE,QAAwB;QAClE,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QAC/C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;YACxD,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC1C,MAAM,eAAe,GAAG,OAAO,IAAI,CAAC,eAAe,KAAK,QAAQ;YAC9D,CAAC,CAAC,IAAI,CAAC,eAAe;YACtB,CAAC,CAAC,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ;gBAClC,CAAC,CAAC,IAAI,CAAC,SAAS;gBAChB,CAAC,CAAC,SAAS,CAAC;QAChB,MAAM,MAAM,GAAG,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;QACzE,IAAI,CAAC,eAAe,IAAI,CAAC,MAAM,EAAE,CAAC;YAChC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,yCAAyC,EAAE,CAAC,CAAC;YACnF,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;gBAC3C,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,mDAAmD,EAAE,CAAC,CAAC;gBAC7F,OAAO;YACT,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC,CAAC;YACtE,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;YACnC,QAAQ;YACR,eAAe;YACf,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,IAAI,CAAC,WAAW;SACxB,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE;YAC3B,QAAQ,EAAE,uBAAuB;YACjC,MAAM;YACN,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,WAAW,EAAE,IAAI,CAAC,WAAW;SAC9B,CAAC,CAAC;IACL,CAAC;IAEO,eAAe,CAAC,OAAsB;QAC5C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QAC1B,MAAM,KAAK,GAAG,IAAI,IAAI,OAAO,IAAI,IAAI,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QACjG,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO;YACL,KAAK;YACL,SAAS,EAAE,IAAI,IAAI,WAAW,IAAI,IAAI,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ;gBAC1E,CAAC,CAAC,IAAI,CAAC,SAAS;gBAChB,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC;SAC3B,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,QAAQ,CAAC,OAAwB;QAC7C,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1C,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YAC1D,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;YACnC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC9B,CAAC,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACpD,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACjD,CAAC;IAEO,QAAQ,CAAC,QAAwB,EAAE,MAAc,EAAE,IAAa;QACtE,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACrC,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE;YACzB,cAAc,EAAE,kBAAkB;YAClC,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC;SAC7C,CAAC,CAAC;QACH,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC;CACF;AAtFD,0EAsFC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACtD,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC","sourcesContent":["import { createHash, randomBytes } from 'node:crypto';\nimport type { IncomingMessage, ServerResponse } from 'node:http';\nimport type { AuthContext } from '../auth/AuthContext';\n\nexport interface DeviceNotificationIdentity {\n  webId: string;\n  localPart: string;\n}\n\nexport interface DeviceNotificationTicketRecord {\n  digest: string;\n  identity: DeviceNotificationIdentity;\n  deviceSessionId: string;\n  origin: string;\n  expiresAt: number;\n}\n\nexport class DeviceNotificationTicketStore {\n  private readonly records = new Map<string, DeviceNotificationTicketRecord>();\n\n  public mint(input: {\n    identity: DeviceNotificationIdentity;\n    deviceSessionId: string;\n    origin: string;\n    ttlMs: number;\n  }): string {\n    const ticket = randomBytes(32).toString('base64url');\n    this.records.set(this.digest(ticket), {\n      digest: this.digest(ticket),\n      identity: input.identity,\n      deviceSessionId: input.deviceSessionId,\n      origin: new URL(input.origin).origin,\n      expiresAt: Date.now() + input.ttlMs,\n    });\n    return ticket;\n  }\n\n  public consume(ticket: string): DeviceNotificationTicketRecord | undefined {\n    const digest = this.digest(ticket);\n    const record = this.records.get(digest);\n    this.records.delete(digest);\n    if (!record || record.expiresAt < Date.now()) {\n      return undefined;\n    }\n    return record;\n  }\n\n  public size(): number {\n    return this.records.size;\n  }\n\n  public clear(): void {\n    this.records.clear();\n  }\n\n  private digest(ticket: string): string {\n    return createHash('sha256').update(ticket).digest('hex');\n  }\n}\n\nexport interface DeviceNotificationTicketHandlerOptions {\n  webSocketEndpoint: string;\n  origin: string;\n  ticketTtlMs?: number;\n  ticketStore?: DeviceNotificationTicketStore;\n}\n\ntype TicketRequest = IncomingMessage & {\n  auth?: AuthContext | { webId?: string; localPart?: string };\n};\n\nexport class DeviceNotificationTicketHandler {\n  public readonly ticketStore: DeviceNotificationTicketStore;\n  private readonly webSocketEndpoint: string;\n  private readonly origin: string;\n  private readonly ticketTtlMs: number;\n\n  public constructor(options: DeviceNotificationTicketHandlerOptions) {\n    this.webSocketEndpoint = options.webSocketEndpoint;\n    this.origin = new URL(options.origin).origin;\n    this.ticketTtlMs = options.ticketTtlMs ?? 60_000;\n    this.ticketStore = options.ticketStore ?? new DeviceNotificationTicketStore();\n  }\n\n  public async handle(request: TicketRequest, response: ServerResponse): Promise<void> {\n    const identity = this.extractIdentity(request);\n    if (!identity) {\n      this.sendJson(response, 401, { error: 'Unauthorized' });\n      return;\n    }\n    const body = await this.readJson(request);\n    const deviceSessionId = typeof body.deviceSessionId === 'string'\n      ? body.deviceSessionId\n      : typeof body.sessionId === 'string'\n        ? body.sessionId\n        : undefined;\n    const origin = typeof body.origin === 'string' ? body.origin : undefined;\n    if (!deviceSessionId || !origin) {\n      this.sendJson(response, 400, { error: 'deviceSessionId and origin are required' });\n      return;\n    }\n    try {\n      if (new URL(origin).origin !== this.origin) {\n        this.sendJson(response, 400, { error: 'origin must match the notification service origin' });\n        return;\n      }\n    } catch {\n      this.sendJson(response, 400, { error: 'origin must be a valid URL' });\n      return;\n    }\n    const ticket = this.ticketStore.mint({\n      identity,\n      deviceSessionId,\n      origin: this.origin,\n      ttlMs: this.ticketTtlMs,\n    });\n    this.sendJson(response, 201, {\n      protocol: 'xpod.notifications.v1',\n      ticket,\n      webSocketEndpoint: this.webSocketEndpoint,\n      expiresInMs: this.ticketTtlMs,\n    });\n  }\n\n  private extractIdentity(request: TicketRequest): DeviceNotificationIdentity | undefined {\n    const auth = request.auth;\n    const webId = auth && 'webId' in auth && typeof auth.webId === 'string' ? auth.webId : undefined;\n    if (!webId) {\n      return undefined;\n    }\n    return {\n      webId,\n      localPart: auth && 'localPart' in auth && typeof auth.localPart === 'string'\n        ? auth.localPart\n        : deriveLocalPart(webId),\n    };\n  }\n\n  private async readJson(request: IncomingMessage): Promise<Record<string, unknown>> {\n    const chunks: Buffer[] = [];\n    await new Promise<void>((resolve, reject) => {\n      request.on('data', (chunk: Buffer) => chunks.push(chunk));\n      request.on('end', () => resolve());\n      request.on('error', reject);\n    });\n    const body = Buffer.concat(chunks).toString('utf8');\n    return body.length > 0 ? JSON.parse(body) : {};\n  }\n\n  private sendJson(response: ServerResponse, status: number, body: unknown): void {\n    const encoded = JSON.stringify(body);\n    response.writeHead(status, {\n      'Content-Type': 'application/json',\n      'Content-Length': Buffer.byteLength(encoded),\n    });\n    response.end(encoded);\n  }\n}\n\nfunction deriveLocalPart(webId: string): string {\n  try {\n    const url = new URL(webId);\n    const parts = url.pathname.split('/').filter(Boolean);\n    return parts[0] ?? 'unknown';\n  } catch {\n    return 'unknown';\n  }\n}\n"]}

package/dist/api/handlers/DeviceNotificationTicketHandler.jsonld

@@ -0,0 +1,117 @@
+{
+  "@context": [
+    "https://linkedsoftwaredependencies.org/bundles/npm/@undefineds.co/xpod/^0.0.0/components/context.jsonld"
+  ],
+  "@id": "npmd:@undefineds.co/xpod",
+  "components": [
+    {
+      "@id": "undefineds:dist/api/handlers/DeviceNotificationTicketHandler.jsonld#DeviceNotificationTicketHandler",
+      "@type": "Class",
+      "requireElement": "DeviceNotificationTicketHandler",
+      "parameters": [
+        {
+          "@id": "undefineds:dist/api/handlers/DeviceNotificationTicketHandler.jsonld#DeviceNotificationTicketHandler_options_webSocketEndpoint",
+          "range": "xsd:string"
+        },
+        {
+          "@id": "undefineds:dist/api/handlers/DeviceNotificationTicketHandler.jsonld#DeviceNotificationTicketHandler_options_origin",
+          "range": "xsd:string"
+        },
+        {
+          "@id": "undefineds:dist/api/handlers/DeviceNotificationTicketHandler.jsonld#DeviceNotificationTicketHandler_options_ticketTtlMs",
+          "range": {
+            "@type": "ParameterRangeUnion",
+            "parameterRangeElements": [
+              "xsd:number",
+              {
+                "@type": "ParameterRangeUndefined"
+              }
+            ]
+          }
+        },
+        {
+          "@id": "undefineds:dist/api/handlers/DeviceNotificationTicketHandler.jsonld#DeviceNotificationTicketHandler_options_ticketStore",
+          "range": {
+            "@type": "ParameterRangeUnion",
+            "parameterRangeElements": [
+              "undefineds:dist/api/handlers/DeviceNotificationTicketHandler.jsonld#DeviceNotificationTicketStore",
+              {
+                "@type": "ParameterRangeUndefined"
+              }
+            ]
+          }
+        }
+      ],
+      "memberFields": [
+        {
+          "@id": "undefineds:dist/api/handlers/DeviceNotificationTicketHandler.jsonld#DeviceNotificationTicketHandler__member_ticketStore",
+          "memberFieldName": "ticketStore",
+          "range": "undefineds:dist/api/handlers/DeviceNotificationTicketHandler.jsonld#DeviceNotificationTicketStore"
+        },
+        {
+          "@id": "undefineds:dist/api/handlers/DeviceNotificationTicketHandler.jsonld#DeviceNotificationTicketHandler__member_webSocketEndpoint",
+          "memberFieldName": "webSocketEndpoint"
+        },
+        {
+          "@id": "undefineds:dist/api/handlers/DeviceNotificationTicketHandler.jsonld#DeviceNotificationTicketHandler__member_origin",
+          "memberFieldName": "origin"
+        },
+        {
+          "@id": "undefineds:dist/api/handlers/DeviceNotificationTicketHandler.jsonld#DeviceNotificationTicketHandler__member_ticketTtlMs",
+          "memberFieldName": "ticketTtlMs"
+        },
+        {
+          "@id": "undefineds:dist/api/handlers/DeviceNotificationTicketHandler.jsonld#DeviceNotificationTicketHandler__member_constructor",
+          "memberFieldName": "constructor"
+        },
+        {
+          "@id": "undefineds:dist/api/handlers/DeviceNotificationTicketHandler.jsonld#DeviceNotificationTicketHandler__member_handle",
+          "memberFieldName": "handle"
+        },
+        {
+          "@id": "undefineds:dist/api/handlers/DeviceNotificationTicketHandler.jsonld#DeviceNotificationTicketHandler__member_extractIdentity",
+          "memberFieldName": "extractIdentity"
+        },
+        {
+          "@id": "undefineds:dist/api/handlers/DeviceNotificationTicketHandler.jsonld#DeviceNotificationTicketHandler__member_readJson",
+          "memberFieldName": "readJson"
+        },
+        {
+          "@id": "undefineds:dist/api/handlers/DeviceNotificationTicketHandler.jsonld#DeviceNotificationTicketHandler__member_sendJson",
+          "memberFieldName": "sendJson"
+        }
+      ],
+      "constructorArguments": [
+        {
+          "@id": "undefineds:dist/api/handlers/DeviceNotificationTicketHandler.jsonld#DeviceNotificationTicketHandler_options__constructorArgument",
+          "fields": [
+            {
+              "keyRaw": "webSocketEndpoint",
+              "value": {
+                "@id": "undefineds:dist/api/handlers/DeviceNotificationTicketHandler.jsonld#DeviceNotificationTicketHandler_options_webSocketEndpoint"
+              }
+            },
+            {
+              "keyRaw": "origin",
+              "value": {
+                "@id": "undefineds:dist/api/handlers/DeviceNotificationTicketHandler.jsonld#DeviceNotificationTicketHandler_options_origin"
+              }
+            },
+            {
+              "keyRaw": "ticketTtlMs",
+              "value": {
+                "@id": "undefineds:dist/api/handlers/DeviceNotificationTicketHandler.jsonld#DeviceNotificationTicketHandler_options_ticketTtlMs"
+              }
+            },
+            {
+              "keyRaw": "ticketStore",
+              "value": {
+                "@id": "undefineds:dist/api/handlers/DeviceNotificationTicketHandler.jsonld#DeviceNotificationTicketHandler_options_ticketStore"
+              }
+            }
+          ]
+        }
+      ]
+    }
+  ]
+}

package/dist/api/runs/InngestRunExecutionBackend.d.ts

@@ -156,7 +156,7 @@ export declare class InngestRunExecutionBackend implements RunExecutionBackend {
         readonly event: "xpod/run.continue_requested";
     }], Omit<Omit<import("inngest").BaseContext<Inngest.Any>, never> & Record<never, never> & {
         logger: import("inngest").Logger;
-    }, "group" | "requestId" | "attempt" | "event" | "events" | "runId" | "step" | "defer" | "jobId" | "maxAttempts"> & import("inngest").FailureEventArgs<EventPayload<any>> & {
+    }, "group" | "requestId" | "event" | "attempt" | "events" | "runId" | "step" | "defer" | "jobId" | "maxAttempts"> & import("inngest").FailureEventArgs<EventPayload<any>> & {
         step: {
             sendEvent: (idOrOptions: import("inngest").StepOptionsOrId, payload: import("inngest").SendEventPayload) => Promise<import("inngest/types").SendEventOutput<import("inngest").ClientOptionsFromInngest<Inngest<import("inngest").ClientOptions>>>>;
             waitForSignal: <TData>(idOrOptions: import("inngest").StepOptionsOrId, opts: {
@@ -337,7 +337,7 @@ export declare class InngestRunExecutionBackend implements RunExecutionBackend {
         readonly event: "xpod/run.continue_requested";
     }], Omit<Omit<import("inngest").BaseContext<Inngest.Any>, never> & Record<never, never> & {
         logger: import("inngest").Logger;
-    }, "group" | "requestId" | "attempt" | "event" | "events" | "runId" | "step" | "defer" | "jobId" | "maxAttempts"> & import("inngest").FailureEventArgs<EventPayload<any>> & {
+    }, "group" | "requestId" | "event" | "attempt" | "events" | "runId" | "step" | "defer" | "jobId" | "maxAttempts"> & import("inngest").FailureEventArgs<EventPayload<any>> & {
         step: {
             sendEvent: (idOrOptions: import("inngest").StepOptionsOrId, payload: import("inngest").SendEventPayload) => Promise<import("inngest/types").SendEventOutput<import("inngest").ClientOptionsFromInngest<Inngest<import("inngest").ClientOptions>>>>;
             waitForSignal: <TData>(idOrOptions: import("inngest").StepOptionsOrId, opts: {

package/dist/api/tasks/InngestTaskScheduler.d.ts

@@ -133,7 +133,7 @@ export declare class InngestTaskScheduler<TContext = StoreContext> {
         readonly event: "xpod/task.materialize_due";
     }], Omit<Omit<import("inngest/types").BaseContext<import("inngest").Inngest.Any>, never> & Record<never, never> & {
         logger: import("inngest").Logger;
-    }, "group" | "requestId" | "attempt" | "event" | "events" | "runId" | "step" | "defer" | "jobId" | "maxAttempts"> & import("inngest/types").FailureEventArgs<EventPayload<any>> & {
+    }, "group" | "requestId" | "event" | "attempt" | "events" | "runId" | "step" | "defer" | "jobId" | "maxAttempts"> & import("inngest/types").FailureEventArgs<EventPayload<any>> & {
         step: {
             sendEvent: (idOrOptions: import("inngest/types").StepOptionsOrId, payload: import("inngest").SendEventPayload) => Promise<import("inngest/types").SendEventOutput<import("inngest").ClientOptionsFromInngest<import("inngest").Inngest<import("inngest/types").ClientOptions>>>>;
             waitForSignal: <TData>(idOrOptions: import("inngest/types").StepOptionsOrId, opts: {
@@ -311,7 +311,7 @@ export declare class InngestTaskScheduler<TContext = StoreContext> {
         readonly event: "xpod/task.materialize_due";
     }], Omit<Omit<import("inngest/types").BaseContext<import("inngest").Inngest.Any>, never> & Record<never, never> & {
         logger: import("inngest").Logger;
-    }, "group" | "requestId" | "attempt" | "event" | "events" | "runId" | "step" | "defer" | "jobId" | "maxAttempts"> & import("inngest/types").FailureEventArgs<EventPayload<any>> & {
+    }, "group" | "requestId" | "event" | "attempt" | "events" | "runId" | "step" | "defer" | "jobId" | "maxAttempts"> & import("inngest/types").FailureEventArgs<EventPayload<any>> & {
         step: {
             sendEvent: (idOrOptions: import("inngest/types").StepOptionsOrId, payload: import("inngest").SendEventPayload) => Promise<import("inngest/types").SendEventOutput<import("inngest").ClientOptionsFromInngest<import("inngest").Inngest<import("inngest/types").ClientOptions>>>>;
             waitForSignal: <TData>(idOrOptions: import("inngest/types").StepOptionsOrId, opts: {
@@ -494,7 +494,7 @@ export declare class InngestTaskScheduler<TContext = StoreContext> {
         readonly event: "xpod/task.event";
     }], Omit<Omit<import("inngest/types").BaseContext<import("inngest").Inngest.Any>, never> & Record<never, never> & {
         logger: import("inngest").Logger;
-    }, "group" | "requestId" | "attempt" | "event" | "events" | "runId" | "step" | "defer" | "jobId" | "maxAttempts"> & import("inngest/types").FailureEventArgs<EventPayload<any>> & {
+    }, "group" | "requestId" | "event" | "attempt" | "events" | "runId" | "step" | "defer" | "jobId" | "maxAttempts"> & import("inngest/types").FailureEventArgs<EventPayload<any>> & {
         step: {
             sendEvent: (idOrOptions: import("inngest/types").StepOptionsOrId, payload: import("inngest").SendEventPayload) => Promise<import("inngest/types").SendEventOutput<import("inngest").ClientOptionsFromInngest<import("inngest").Inngest<import("inngest/types").ClientOptions>>>>;
             waitForSignal: <TData>(idOrOptions: import("inngest/types").StepOptionsOrId, opts: {
@@ -670,7 +670,7 @@ export declare class InngestTaskScheduler<TContext = StoreContext> {
         readonly event: "xpod/task.event";
     }], Omit<Omit<import("inngest/types").BaseContext<import("inngest").Inngest.Any>, never> & Record<never, never> & {
         logger: import("inngest").Logger;
-    }, "group" | "requestId" | "attempt" | "event" | "events" | "runId" | "step" | "defer" | "jobId" | "maxAttempts"> & import("inngest/types").FailureEventArgs<EventPayload<any>> & {
+    }, "group" | "requestId" | "event" | "attempt" | "events" | "runId" | "step" | "defer" | "jobId" | "maxAttempts"> & import("inngest/types").FailureEventArgs<EventPayload<any>> & {
         step: {
             sendEvent: (idOrOptions: import("inngest/types").StepOptionsOrId, payload: import("inngest").SendEventPayload) => Promise<import("inngest/types").SendEventOutput<import("inngest").ClientOptionsFromInngest<import("inngest").Inngest<import("inngest/types").ClientOptions>>>>;
             waitForSignal: <TData>(idOrOptions: import("inngest/types").StepOptionsOrId, opts: {

package/dist/components/components.jsonld

@@ -44,6 +44,10 @@
     "undefineds:dist/http/TracingHandler.jsonld",
     "undefineds:dist/http/admin/EdgeNodeCertificateHttpHandler.jsonld",
     "undefineds:dist/http/terminal/TerminalHttpHandler.jsonld",
+    "undefineds:dist/notifications/DeviceNotificationHub.jsonld",
+    "undefineds:dist/notifications/DeviceNotificationResourceListener.jsonld",
+    "undefineds:dist/http/DeviceNotificationWebSocketServer.jsonld",
+    "undefineds:dist/api/handlers/DeviceNotificationTicketHandler.jsonld",
     "undefineds:dist/pods/ReservedSuffixIdentifierGenerator.jsonld",
     "undefineds:dist/identity/drizzle/DrizzleIndexedStorage.jsonld",
     "undefineds:dist/identity/ValidatingIdentityProviderHttpHandler.jsonld",
@@ -128,6 +132,7 @@
     "undefineds:dist/edge/reachability/TcpP2PSignalingSession.jsonld",
     "undefineds:dist/edge/reachability/ManagedClientFetch.jsonld",
     "undefineds:dist/edge/reachability/ManagedClientP2PSmoke.jsonld",
-    "undefineds:dist/edge/reachability/P2PRealnetAcceptance.jsonld"
+    "undefineds:dist/edge/reachability/P2PRealnetAcceptance.jsonld",
+    "undefineds:dist/notifications/device-notification-protocol.jsonld"
   ]
 }