@undefineds.co/xpod 0.3.69 → 0.3.71-rc.2

package/dist/cli/commands/start.js.map

@@ -1 +1 @@
-{"version":3,"file":"start.js","sourceRoot":"","sources":["../../../src/cli/commands/start.ts"],"names":[],"mappings":";;;;;;AACA,gDAAwB;AACxB,4CAAoB;AACpB,iDAA8C;AAC9C,2CAA2G;AAC3G,2DAKmC;AACnC,2DAAsE;AACtE,2DAAsE;AAWtE,MAAM,cAAc,GAAG,OAAQ,UAAgC,CAAC,GAAG,KAAK,WAAW;IACjF,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,MAAM,CAAC;IAC1C,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;AAErB,SAAS,WAAW,CAAC,OAAe;IAClC,IAAI,CAAC,YAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,OAAO,CAAC,IAAI,CAAC,uBAAuB,OAAO,EAAE,CAAC,CAAC;QAC/C,OAAO;IACT,CAAC;IACD,MAAM,OAAO,GAAG,YAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAClD,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAClD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,OAAO,KAAK,CAAC,CAAC;YAAE,SAAS;QAC7B,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7C,IAAI,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9C,IACE,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC9C,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAC9C,CAAC;YACD,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7B,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QAC3B,CAAC;IACH,CAAC;AACH,CAAC;AAEY,QAAA,YAAY,GAAqC;IAC5D,OAAO,EAAE,OAAO;IAChB,QAAQ,EAAE,qBAAqB;IAC/B,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CACjB,KAAK;SACF,MAAM,CAAC,MAAM,EAAE;QACd,KAAK,EAAE,GAAG;QACV,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC;QAC3B,WAAW,EAAE,UAAU;KACxB,CAAC;SACD,MAAM,CAAC,QAAQ,EAAE;QAChB,KAAK,EAAE,GAAG;QACV,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,wCAAwC;KACtD,CAAC;SACD,MAAM,CAAC,KAAK,EAAE;QACb,KAAK,EAAE,GAAG;QACV,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,mBAAmB;KACjC,CAAC;SACD,MAAM,CAAC,MAAM,EAAE;QACd,KAAK,EAAE,GAAG;QACV,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,cAAc;QAC3B,OAAO,EAAE,IAAI;KACd,CAAC;SACD,MAAM,CAAC,MAAM,EAAE;QACd,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,cAAc;QAC3B,OAAO,EAAE,WAAW;KACrB,CAAC;SACD,MAAM,CAAC,YAAY,EAAE;QACpB,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,IAAI;QACb,WAAW,EAAE,uBAAuB;KACrC,CAAC;IACN,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACtB,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC;QAED,MAAM,QAAQ,GACZ,IAAI,CAAC,IAAI,KAAK,IAAI;YAChB,CAAC,CAAC,IAAI,CAAC,IAAI;YACX,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,MAAM,EAAE,EAAE,CAAC,CAAC;QAExE,IAAI,UAAkB,CAAC;QACvB,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,CAAC;aAAM,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACrB,UAAU,GAAG,cAAI,CAAC,IAAI,CAAC,sBAAY,EAAE,UAAU,IAAI,CAAC,IAAI,OAAO,CAAC,CAAC;QACnE,CAAC;aAAM,CAAC;YACN,UAAU,GAAG,cAAI,CAAC,IAAI,CAAC,sBAAY,EAAE,mBAAmB,CAAC,CAAC;QAC5D,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAA,qBAAW,EAAC,QAAQ,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3D,MAAM,OAAO,GAAG,MAAM,IAAA,qBAAW,EAAC,OAAO,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1D,MAAM,WAAW,GAAG,cAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,0BAA0B,CAAC,CAAC;QAEzE,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,UAAU,IAAI,CAAC,IAAI,IAAI,QAAQ,GAAG,CAAC;QAC/E,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,cAAI,CAAC,IAAI,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC;QAClG,OAAO,CAAC,GAAG,CAAC,kBAAkB,GAAG,YAAY,CAAC;QAE9C,yDAAyD;QACzD,MAAM,kBAAkB,GAAG,IAAA,uCAAyB,EAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAClE,MAAM,QAAQ,GAAG,IAAA,iCAAsB,EAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAErD,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;QAChC,OAAO,CAAC,GAAG,CAAC,cAAc,OAAO,KAAK,IAAI,CAAC,IAAI,IAAI,QAAQ,GAAG,CAAC,CAAC;QAChE,OAAO,CAAC,GAAG,CAAC,sCAAsC,OAAO,EAAE,CAAC,CAAC;QAC7D,OAAO,CAAC,GAAG,CAAC,sCAAsC,OAAO,EAAE,CAAC,CAAC;QAC7D,IAAI,kBAAkB,EAAE,CAAC;YACvB,OAAO,CAAC,GAAG,CAAC,0BAA0B,kBAAkB,EAAE,CAAC,CAAC;QAC9D,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,yBAAyB,QAAQ,EAAE,CAAC,CAAC;QAEjD,MAAM,UAAU,GAAG,IAAI,uBAAU,EAAE,CAAC;QACpC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,uCAAuC,CAAC,CAAC;QAC3E,MAAM,gBAAgB,GAAG,IAAA,yCAA2B,EAAC;YACnD,UAAU;YACV,WAAW;YACX,QAAQ;YACR,kBAAkB;SACnB,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,IAAA,0BAAY,EAAC;YAC3B,SAAS;YACT,UAAU,EAAE,gBAAgB,CAAC,UAAU;YACvC,aAAa,EAAE,sBAAY;YAC3B,OAAO;YACP,OAAO;YACP,kBAAkB;SACnB,CAAC,CAAC;QAEH,UAAU,CAAC,QAAQ,CAAC;YAClB,IAAI,EAAE,KAAK;YACX,OAAO,EAAE,cAAc;YACvB,IAAI,EAAE,OAAO;YACb,GAAG,EAAE,gBAAgB,CAAC,GAAG;YACzB,GAAG,EAAE,IAAA,8BAAgB,EAAC,OAAO,EAAE,OAAO,EAAE,kBAAkB,EAAE,QAAQ,CAAC;SACtE,CAAC,CAAC;QAEH,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC7C,MAAM,OAAO,GAAG,SAAS;YACvB,CAAC,CAAC;gBACE,IAAI;gBACJ,OAAO,CAAC,OAAO,CAAC,iCAAiC,CAAC;gBAClD,cAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,CAAC;aACtD;YACH,CAAC,CAAC,CAAC,cAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;QAE5D,MAAM,2BAA2B,GAAG,IAAA,2CAAiC,GAAE,CAAC;QAExE,UAAU,CAAC,QAAQ,CAAC;YAClB,IAAI,EAAE,KAAK;YACX,OAAO,EAAE,cAAc;YACvB,IAAI,EAAE,OAAO;YACb,GAAG,EAAE,IAAA,8BAAgB,EAAC;gBACpB,OAAO;gBACP,QAAQ;gBACR,OAAO;gBACP,OAAO;gBACP,YAAY;gBACZ,QAAQ;gBACR,kBAAkB;gBAClB,2BAA2B;aAC5B,CAAC;SACH,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,IAAI,sBAAY,CAAC,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE;YAC9D,UAAU,EAAE,IAAI;YAChB,OAAO;YACP,uBAAuB,EAAE,2BAA2B;SACrD,CAAC,CAAC;QACH,KAAK,CAAC,UAAU,CAAC;YACf,GAAG,EAAE,oBAAoB,OAAO,EAAE;YAClC,GAAG,EAAE,oBAAoB,OAAO,EAAE;SACnC,CAAC,CAAC;QAEH,MAAM,UAAU,CAAC,QAAQ,EAAE,CAAC;QAC5B,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;QAEpB,MAAM,QAAQ,GAAG,KAAK,EAAE,MAAc,EAAiB,EAAE;YACvD,OAAO,CAAC,GAAG,CAAC,cAAc,MAAM,oBAAoB,CAAC,CAAC;YACtD,MAAM,UAAU,CAAC,OAAO,EAAE,CAAC;YAC3B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC,CAAC;QAEF,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;QACjD,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;IACjD,CAAC;CACF,CAAC","sourcesContent":["import type { CommandModule } from 'yargs';\nimport path from 'path';\nimport fs from 'fs';\nimport { Supervisor } from '../../supervisor';\nimport { createGatewayAdminProxyAuthSecret, GatewayProxy, getFreePort, PACKAGE_ROOT } from '../../runtime';\nimport {\n  buildApiChildEnv,\n  buildCssArgs,\n  buildCssChildEnv,\n  createCssChildRuntimeConfig,\n} from '../../runtime/css-process';\nimport { resolveExternalOidcIssuer } from '../../runtime/oidc-issuer';\nimport { resolveAuthModeFromEnv } from '../../authorization/AuthMode';\n\ninterface StartArgs {\n  mode?: string;\n  config?: string;\n  env?: string;\n  port: number;\n  host: string;\n  foreground?: boolean;\n}\n\nconst childJsRuntime = typeof (globalThis as { Bun?: unknown }).Bun !== 'undefined'\n  ? (process.env.XPOD_NODE_BINARY ?? 'node')\n  : process.execPath;\n\nfunction loadEnvFile(envPath: string): void {\n  if (!fs.existsSync(envPath)) {\n    console.warn(`Env file not found: ${envPath}`);\n    return;\n  }\n  const content = fs.readFileSync(envPath, 'utf-8');\n  for (const line of content.split('\\n')) {\n    const trimmed = line.trim();\n    if (!trimmed || trimmed.startsWith('#')) continue;\n    const eqIndex = trimmed.indexOf('=');\n    if (eqIndex === -1) continue;\n    const key = trimmed.slice(0, eqIndex).trim();\n    let value = trimmed.slice(eqIndex + 1).trim();\n    if (\n      (value.startsWith('\"') && value.endsWith('\"')) ||\n      (value.startsWith(\"'\") && value.endsWith(\"'\"))\n    ) {\n      value = value.slice(1, -1);\n    }\n    if (!process.env[key]) {\n      process.env[key] = value;\n    }\n  }\n}\n\nexport const startCommand: CommandModule<object, StartArgs> = {\n  command: 'start',\n  describe: 'Start xpod services',\n  builder: (yargs) =>\n    yargs\n      .option('mode', {\n        alias: 'm',\n        type: 'string',\n        choices: ['local', 'cloud'],\n        description: 'Run mode',\n      })\n      .option('config', {\n        alias: 'c',\n        type: 'string',\n        description: 'Path to config file (overrides --mode)',\n      })\n      .option('env', {\n        alias: 'e',\n        type: 'string',\n        description: 'Path to .env file',\n      })\n      .option('port', {\n        alias: 'p',\n        type: 'number',\n        description: 'Gateway port',\n        default: 3000,\n      })\n      .option('host', {\n        type: 'string',\n        description: 'Gateway host',\n        default: 'localhost',\n      })\n      .option('foreground', {\n        type: 'boolean',\n        default: true,\n        description: 'Run in the foreground',\n      }),\n  handler: async (argv) => {\n    if (argv.env) {\n      loadEnvFile(argv.env);\n    }\n\n    const mainPort =\n      argv.port !== 3000\n        ? argv.port\n        : parseInt(process.env.XPOD_PORT ?? process.env.PORT ?? '3000', 10);\n\n    let configPath: string;\n    if (argv.config) {\n      configPath = argv.config;\n    } else if (argv.mode) {\n      configPath = path.join(PACKAGE_ROOT, `config/${argv.mode}.json`);\n    } else {\n      configPath = path.join(PACKAGE_ROOT, 'config/local.json');\n    }\n\n    const cssPort = await getFreePort(mainPort + 1, argv.host);\n    const apiPort = await getFreePort(cssPort + 1, argv.host);\n    const runtimeRoot = path.join(process.cwd(), '.xpod/runtime/legacy-css');\n\n    const baseUrl = process.env.CSS_BASE_URL || `http://${argv.host}:${mainPort}/`;\n    const rdfIndexPath = process.env.CSS_RDF_INDEX_PATH || path.join(runtimeRoot, 'rdf-index.sqlite');\n    process.env.CSS_RDF_INDEX_PATH = rdfIndexPath;\n\n    // SP 模式：oidcIssuer 显式指定外部 IdP；Cloud API 地址不再隐式当作 issuer。\n    const externalOidcIssuer = resolveExternalOidcIssuer(process.env);\n    const authMode = resolveAuthModeFromEnv(process.env);\n\n    console.log('Starting xpod...');\n    console.log(`  Gateway: ${baseUrl} (${argv.host}:${mainPort})`);\n    console.log(`  CSS (internal): http://localhost:${cssPort}`);\n    console.log(`  API (internal): http://localhost:${apiPort}`);\n    if (externalOidcIssuer) {\n      console.log(`  SP mode: Cloud IdP = ${externalOidcIssuer}`);\n    }\n    console.log(`  Authorization mode: ${authMode}`);\n\n    const supervisor = new Supervisor();\n    const cssBinary = require.resolve('@solid/community-server/bin/server.js');\n    const cssRuntimeConfig = createCssChildRuntimeConfig({\n      configPath,\n      runtimeRoot,\n      authMode,\n      externalOidcIssuer,\n    });\n    const cssArgs = buildCssArgs({\n      cssBinary,\n      configPath: cssRuntimeConfig.configPath,\n      cssModuleRoot: PACKAGE_ROOT,\n      cssPort,\n      baseUrl,\n      externalOidcIssuer,\n    });\n\n    supervisor.register({\n      name: 'css',\n      command: childJsRuntime,\n      args: cssArgs,\n      cwd: cssRuntimeConfig.cwd,\n      env: buildCssChildEnv(baseUrl, cssPort, externalOidcIssuer, authMode),\n    });\n\n    const isDevMode = __filename.endsWith('.ts');\n    const apiArgs = isDevMode\n      ? [\n          '-r',\n          require.resolve('ts-node/register/transpile-only'),\n          path.resolve(__dirname, '..', '..', 'api', 'main.ts'),\n        ]\n      : [path.resolve(__dirname, '..', '..', 'api', 'main.js')];\n\n    const gatewayAdminProxyAuthSecret = createGatewayAdminProxyAuthSecret();\n\n    supervisor.register({\n      name: 'api',\n      command: childJsRuntime,\n      args: apiArgs,\n      env: buildApiChildEnv({\n        apiPort,\n        mainPort,\n        cssPort,\n        baseUrl,\n        rdfIndexPath,\n        authMode,\n        externalOidcIssuer,\n        gatewayAdminProxyAuthSecret,\n      }),\n    });\n\n    const proxy = new GatewayProxy(mainPort, supervisor, '0.0.0.0', {\n      exitOnStop: true,\n      baseUrl,\n      internalAdminAuthSecret: gatewayAdminProxyAuthSecret,\n    });\n    proxy.setTargets({\n      css: `http://localhost:${cssPort}`,\n      api: `http://localhost:${apiPort}`,\n    });\n\n    await supervisor.startAll();\n    await proxy.start();\n\n    const shutdown = async (signal: string): Promise<void> => {\n      console.log(`\\nReceived ${signal}, shutting down...`);\n      await supervisor.stopAll();\n      process.exit(0);\n    };\n\n    process.on('SIGTERM', () => shutdown('SIGTERM'));\n    process.on('SIGINT', () => shutdown('SIGINT'));\n  },\n};\n"]}
+{"version":3,"file":"start.js","sourceRoot":"","sources":["../../../src/cli/commands/start.ts"],"names":[],"mappings":";;;;;;AACA,gDAAwB;AACxB,4CAAoB;AACpB,iDAA8C;AAC9C,2CAA2G;AAC3G,2DAKmC;AACnC,2DAAsE;AACtE,2DAAsE;AAWtE,MAAM,cAAc,GAAG,OAAQ,UAAgC,CAAC,GAAG,KAAK,WAAW;IACjF,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,MAAM,CAAC;IAC1C,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;AAErB,SAAS,WAAW,CAAC,OAAe;IAClC,IAAI,CAAC,YAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,OAAO,CAAC,IAAI,CAAC,uBAAuB,OAAO,EAAE,CAAC,CAAC;QAC/C,OAAO;IACT,CAAC;IACD,MAAM,OAAO,GAAG,YAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAClD,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAClD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,OAAO,KAAK,CAAC,CAAC;YAAE,SAAS;QAC7B,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7C,IAAI,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9C,IACE,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC9C,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAC9C,CAAC;YACD,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7B,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QAC3B,CAAC;IACH,CAAC;AACH,CAAC;AAEY,QAAA,YAAY,GAAqC;IAC5D,OAAO,EAAE,OAAO;IAChB,QAAQ,EAAE,qBAAqB;IAC/B,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CACjB,KAAK;SACF,MAAM,CAAC,MAAM,EAAE;QACd,KAAK,EAAE,GAAG;QACV,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC;QAC3B,WAAW,EAAE,UAAU;KACxB,CAAC;SACD,MAAM,CAAC,QAAQ,EAAE;QAChB,KAAK,EAAE,GAAG;QACV,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,wCAAwC;KACtD,CAAC;SACD,MAAM,CAAC,KAAK,EAAE;QACb,KAAK,EAAE,GAAG;QACV,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,mBAAmB;KACjC,CAAC;SACD,MAAM,CAAC,MAAM,EAAE;QACd,KAAK,EAAE,GAAG;QACV,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,cAAc;QAC3B,OAAO,EAAE,IAAI;KACd,CAAC;SACD,MAAM,CAAC,MAAM,EAAE;QACd,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,cAAc;QAC3B,OAAO,EAAE,WAAW;KACrB,CAAC;SACD,MAAM,CAAC,YAAY,EAAE;QACpB,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,IAAI;QACb,WAAW,EAAE,uBAAuB;KACrC,CAAC;IACN,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACtB,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC;QAED,MAAM,QAAQ,GACZ,IAAI,CAAC,IAAI,KAAK,IAAI;YAChB,CAAC,CAAC,IAAI,CAAC,IAAI;YACX,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,MAAM,EAAE,EAAE,CAAC,CAAC;QAExE,IAAI,UAAkB,CAAC;QACvB,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,CAAC;aAAM,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACrB,UAAU,GAAG,cAAI,CAAC,IAAI,CAAC,sBAAY,EAAE,UAAU,IAAI,CAAC,IAAI,OAAO,CAAC,CAAC;QACnE,CAAC;aAAM,CAAC;YACN,UAAU,GAAG,cAAI,CAAC,IAAI,CAAC,sBAAY,EAAE,mBAAmB,CAAC,CAAC;QAC5D,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAA,qBAAW,EAAC,QAAQ,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3D,MAAM,OAAO,GAAG,MAAM,IAAA,qBAAW,EAAC,OAAO,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1D,MAAM,WAAW,GAAG,cAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,0BAA0B,CAAC,CAAC;QAEzE,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,UAAU,IAAI,CAAC,IAAI,IAAI,QAAQ,GAAG,CAAC;QAC/E,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,cAAI,CAAC,IAAI,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC;QAClG,OAAO,CAAC,GAAG,CAAC,kBAAkB,GAAG,YAAY,CAAC;QAE9C,yDAAyD;QACzD,MAAM,kBAAkB,GAAG,IAAA,uCAAyB,EAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAClE,MAAM,QAAQ,GAAG,IAAA,iCAAsB,EAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAErD,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;QAChC,OAAO,CAAC,GAAG,CAAC,cAAc,OAAO,KAAK,IAAI,CAAC,IAAI,IAAI,QAAQ,GAAG,CAAC,CAAC;QAChE,OAAO,CAAC,GAAG,CAAC,sCAAsC,OAAO,EAAE,CAAC,CAAC;QAC7D,OAAO,CAAC,GAAG,CAAC,sCAAsC,OAAO,EAAE,CAAC,CAAC;QAC7D,IAAI,kBAAkB,EAAE,CAAC;YACvB,OAAO,CAAC,GAAG,CAAC,0BAA0B,kBAAkB,EAAE,CAAC,CAAC;QAC9D,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,yBAAyB,QAAQ,EAAE,CAAC,CAAC;QAEjD,MAAM,UAAU,GAAG,IAAI,uBAAU,EAAE,CAAC;QACpC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,uCAAuC,CAAC,CAAC;QAC3E,MAAM,gBAAgB,GAAG,IAAA,yCAA2B,EAAC;YACnD,UAAU;YACV,WAAW;YACX,QAAQ;YACR,kBAAkB;SACnB,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,IAAA,0BAAY,EAAC;YAC3B,SAAS;YACT,UAAU,EAAE,gBAAgB,CAAC,UAAU;YACvC,aAAa,EAAE,sBAAY;YAC3B,OAAO;YACP,OAAO;YACP,kBAAkB;SACnB,CAAC,CAAC;QAEH,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC7C,MAAM,OAAO,GAAG,SAAS;YACvB,CAAC,CAAC;gBACE,IAAI;gBACJ,OAAO,CAAC,OAAO,CAAC,iCAAiC,CAAC;gBAClD,cAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,CAAC;aACtD;YACH,CAAC,CAAC,CAAC,cAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;QAE5D,MAAM,2BAA2B,GAAG,IAAA,2CAAiC,GAAE,CAAC;QAExE,UAAU,CAAC,QAAQ,CAAC;YAClB,IAAI,EAAE,KAAK;YACX,OAAO,EAAE,cAAc;YACvB,IAAI,EAAE,OAAO;YACb,GAAG,EAAE,gBAAgB,CAAC,GAAG;YACzB,GAAG,EAAE,IAAA,8BAAgB,EAAC,OAAO,EAAE,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,OAAO,CAAC,GAAG,EAAE,2BAA2B,CAAC;SAChH,CAAC,CAAC;QAEH,UAAU,CAAC,QAAQ,CAAC;YAClB,IAAI,EAAE,KAAK;YACX,OAAO,EAAE,cAAc;YACvB,IAAI,EAAE,OAAO;YACb,GAAG,EAAE,IAAA,8BAAgB,EAAC;gBACpB,OAAO;gBACP,QAAQ;gBACR,OAAO;gBACP,OAAO;gBACP,YAAY;gBACZ,QAAQ;gBACR,kBAAkB;gBAClB,2BAA2B;aAC5B,CAAC;SACH,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,IAAI,sBAAY,CAAC,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE;YAC9D,UAAU,EAAE,IAAI;YAChB,OAAO;YACP,uBAAuB,EAAE,2BAA2B;SACrD,CAAC,CAAC;QACH,KAAK,CAAC,UAAU,CAAC;YACf,GAAG,EAAE,oBAAoB,OAAO,EAAE;YAClC,GAAG,EAAE,oBAAoB,OAAO,EAAE;SACnC,CAAC,CAAC;QAEH,MAAM,UAAU,CAAC,QAAQ,EAAE,CAAC;QAC5B,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;QAEpB,MAAM,QAAQ,GAAG,KAAK,EAAE,MAAc,EAAiB,EAAE;YACvD,OAAO,CAAC,GAAG,CAAC,cAAc,MAAM,oBAAoB,CAAC,CAAC;YACtD,MAAM,UAAU,CAAC,OAAO,EAAE,CAAC;YAC3B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC,CAAC;QAEF,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;QACjD,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;IACjD,CAAC;CACF,CAAC","sourcesContent":["import type { CommandModule } from 'yargs';\nimport path from 'path';\nimport fs from 'fs';\nimport { Supervisor } from '../../supervisor';\nimport { createGatewayAdminProxyAuthSecret, GatewayProxy, getFreePort, PACKAGE_ROOT } from '../../runtime';\nimport {\n  buildApiChildEnv,\n  buildCssArgs,\n  buildCssChildEnv,\n  createCssChildRuntimeConfig,\n} from '../../runtime/css-process';\nimport { resolveExternalOidcIssuer } from '../../runtime/oidc-issuer';\nimport { resolveAuthModeFromEnv } from '../../authorization/AuthMode';\n\ninterface StartArgs {\n  mode?: string;\n  config?: string;\n  env?: string;\n  port: number;\n  host: string;\n  foreground?: boolean;\n}\n\nconst childJsRuntime = typeof (globalThis as { Bun?: unknown }).Bun !== 'undefined'\n  ? (process.env.XPOD_NODE_BINARY ?? 'node')\n  : process.execPath;\n\nfunction loadEnvFile(envPath: string): void {\n  if (!fs.existsSync(envPath)) {\n    console.warn(`Env file not found: ${envPath}`);\n    return;\n  }\n  const content = fs.readFileSync(envPath, 'utf-8');\n  for (const line of content.split('\\n')) {\n    const trimmed = line.trim();\n    if (!trimmed || trimmed.startsWith('#')) continue;\n    const eqIndex = trimmed.indexOf('=');\n    if (eqIndex === -1) continue;\n    const key = trimmed.slice(0, eqIndex).trim();\n    let value = trimmed.slice(eqIndex + 1).trim();\n    if (\n      (value.startsWith('\"') && value.endsWith('\"')) ||\n      (value.startsWith(\"'\") && value.endsWith(\"'\"))\n    ) {\n      value = value.slice(1, -1);\n    }\n    if (!process.env[key]) {\n      process.env[key] = value;\n    }\n  }\n}\n\nexport const startCommand: CommandModule<object, StartArgs> = {\n  command: 'start',\n  describe: 'Start xpod services',\n  builder: (yargs) =>\n    yargs\n      .option('mode', {\n        alias: 'm',\n        type: 'string',\n        choices: ['local', 'cloud'],\n        description: 'Run mode',\n      })\n      .option('config', {\n        alias: 'c',\n        type: 'string',\n        description: 'Path to config file (overrides --mode)',\n      })\n      .option('env', {\n        alias: 'e',\n        type: 'string',\n        description: 'Path to .env file',\n      })\n      .option('port', {\n        alias: 'p',\n        type: 'number',\n        description: 'Gateway port',\n        default: 3000,\n      })\n      .option('host', {\n        type: 'string',\n        description: 'Gateway host',\n        default: 'localhost',\n      })\n      .option('foreground', {\n        type: 'boolean',\n        default: true,\n        description: 'Run in the foreground',\n      }),\n  handler: async (argv) => {\n    if (argv.env) {\n      loadEnvFile(argv.env);\n    }\n\n    const mainPort =\n      argv.port !== 3000\n        ? argv.port\n        : parseInt(process.env.XPOD_PORT ?? process.env.PORT ?? '3000', 10);\n\n    let configPath: string;\n    if (argv.config) {\n      configPath = argv.config;\n    } else if (argv.mode) {\n      configPath = path.join(PACKAGE_ROOT, `config/${argv.mode}.json`);\n    } else {\n      configPath = path.join(PACKAGE_ROOT, 'config/local.json');\n    }\n\n    const cssPort = await getFreePort(mainPort + 1, argv.host);\n    const apiPort = await getFreePort(cssPort + 1, argv.host);\n    const runtimeRoot = path.join(process.cwd(), '.xpod/runtime/legacy-css');\n\n    const baseUrl = process.env.CSS_BASE_URL || `http://${argv.host}:${mainPort}/`;\n    const rdfIndexPath = process.env.CSS_RDF_INDEX_PATH || path.join(runtimeRoot, 'rdf-index.sqlite');\n    process.env.CSS_RDF_INDEX_PATH = rdfIndexPath;\n\n    // SP 模式：oidcIssuer 显式指定外部 IdP；Cloud API 地址不再隐式当作 issuer。\n    const externalOidcIssuer = resolveExternalOidcIssuer(process.env);\n    const authMode = resolveAuthModeFromEnv(process.env);\n\n    console.log('Starting xpod...');\n    console.log(`  Gateway: ${baseUrl} (${argv.host}:${mainPort})`);\n    console.log(`  CSS (internal): http://localhost:${cssPort}`);\n    console.log(`  API (internal): http://localhost:${apiPort}`);\n    if (externalOidcIssuer) {\n      console.log(`  SP mode: Cloud IdP = ${externalOidcIssuer}`);\n    }\n    console.log(`  Authorization mode: ${authMode}`);\n\n    const supervisor = new Supervisor();\n    const cssBinary = require.resolve('@solid/community-server/bin/server.js');\n    const cssRuntimeConfig = createCssChildRuntimeConfig({\n      configPath,\n      runtimeRoot,\n      authMode,\n      externalOidcIssuer,\n    });\n    const cssArgs = buildCssArgs({\n      cssBinary,\n      configPath: cssRuntimeConfig.configPath,\n      cssModuleRoot: PACKAGE_ROOT,\n      cssPort,\n      baseUrl,\n      externalOidcIssuer,\n    });\n\n    const isDevMode = __filename.endsWith('.ts');\n    const apiArgs = isDevMode\n      ? [\n          '-r',\n          require.resolve('ts-node/register/transpile-only'),\n          path.resolve(__dirname, '..', '..', 'api', 'main.ts'),\n        ]\n      : [path.resolve(__dirname, '..', '..', 'api', 'main.js')];\n\n    const gatewayAdminProxyAuthSecret = createGatewayAdminProxyAuthSecret();\n\n    supervisor.register({\n      name: 'css',\n      command: childJsRuntime,\n      args: cssArgs,\n      cwd: cssRuntimeConfig.cwd,\n      env: buildCssChildEnv(baseUrl, cssPort, externalOidcIssuer, authMode, process.env, gatewayAdminProxyAuthSecret),\n    });\n\n    supervisor.register({\n      name: 'api',\n      command: childJsRuntime,\n      args: apiArgs,\n      env: buildApiChildEnv({\n        apiPort,\n        mainPort,\n        cssPort,\n        baseUrl,\n        rdfIndexPath,\n        authMode,\n        externalOidcIssuer,\n        gatewayAdminProxyAuthSecret,\n      }),\n    });\n\n    const proxy = new GatewayProxy(mainPort, supervisor, '0.0.0.0', {\n      exitOnStop: true,\n      baseUrl,\n      internalAdminAuthSecret: gatewayAdminProxyAuthSecret,\n    });\n    proxy.setTargets({\n      css: `http://localhost:${cssPort}`,\n      api: `http://localhost:${apiPort}`,\n    });\n\n    await supervisor.startAll();\n    await proxy.start();\n\n    const shutdown = async (signal: string): Promise<void> => {\n      console.log(`\\nReceived ${signal}, shutting down...`);\n      await supervisor.stopAll();\n      process.exit(0);\n    };\n\n    process.on('SIGTERM', () => shutdown('SIGTERM'));\n    process.on('SIGINT', () => shutdown('SIGINT'));\n  },\n};\n"]}

package/dist/components/components.jsonld

@@ -34,6 +34,7 @@
     "undefineds:dist/storage/SparqlUpdateResourceStore.jsonld",
     "undefineds:dist/storage/sparql/CompatibilitySparqlEngine.jsonld",
     "undefineds:dist/http/SubgraphSparqlHttpHandler.jsonld",
+    "undefineds:dist/http/InternalPodDataHttpHandler.jsonld",
     "undefineds:dist/http/quota/QuotaAdminHttpHandler.jsonld",
     "undefineds:dist/http/ClusterIngressRouter.jsonld",
     "undefineds:dist/http/ClusterWebSocketConfigurator.jsonld",

package/dist/components/context.jsonld

@@ -555,6 +555,9 @@
           "options_driver": {
             "@id": "undefineds:dist/storage/rdf/PostgresRdfVectorIndex.jsonld#PostgresRdfVectorIndex_options_driver"
           },
+          "options_backend": {
+            "@id": "undefineds:dist/storage/rdf/PostgresRdfVectorIndex.jsonld#PostgresRdfVectorIndex_options_backend"
+          },
           "options_dataDir": {
             "@id": "undefineds:dist/storage/rdf/PostgresRdfVectorIndex.jsonld#PostgresRdfVectorIndex_options_dataDir"
           },
@@ -588,6 +591,9 @@
           "driver": {
             "@id": "undefineds:dist/storage/rdf/PostgresRdfVectorIndex.jsonld#PostgresRdfVectorIndex_options_driver"
           },
+          "backend": {
+            "@id": "undefineds:dist/storage/rdf/PostgresRdfVectorIndex.jsonld#PostgresRdfVectorIndex_options_backend"
+          },
           "dataDir": {
             "@id": "undefineds:dist/storage/rdf/PostgresRdfVectorIndex.jsonld#PostgresRdfVectorIndex_options_dataDir"
           },
@@ -1108,6 +1114,42 @@
           }
         }
       },
+      "InternalPodDataHttpHandler": {
+        "@id": "undefineds:dist/http/InternalPodDataHttpHandler.jsonld#InternalPodDataHttpHandler",
+        "@prefix": true,
+        "@context": {
+          "options_resourceStore": {
+            "@id": "undefineds:dist/http/InternalPodDataHttpHandler.jsonld#InternalPodDataHttpHandler_options_resourceStore"
+          },
+          "options_gatewayAdminProxyAuthSecret": {
+            "@id": "undefineds:dist/http/InternalPodDataHttpHandler.jsonld#InternalPodDataHttpHandler_options_gatewayAdminProxyAuthSecret"
+          },
+          "options_patchBodyParser": {
+            "@id": "undefineds:dist/http/InternalPodDataHttpHandler.jsonld#InternalPodDataHttpHandler_options_patchBodyParser"
+          },
+          "options_baseUrl": {
+            "@id": "undefineds:dist/http/InternalPodDataHttpHandler.jsonld#InternalPodDataHttpHandler_options_baseUrl"
+          },
+          "options_basePath": {
+            "@id": "undefineds:dist/http/InternalPodDataHttpHandler.jsonld#InternalPodDataHttpHandler_options_basePath"
+          },
+          "resourceStore": {
+            "@id": "undefineds:dist/http/InternalPodDataHttpHandler.jsonld#InternalPodDataHttpHandler_options_resourceStore"
+          },
+          "gatewayAdminProxyAuthSecret": {
+            "@id": "undefineds:dist/http/InternalPodDataHttpHandler.jsonld#InternalPodDataHttpHandler_options_gatewayAdminProxyAuthSecret"
+          },
+          "patchBodyParser": {
+            "@id": "undefineds:dist/http/InternalPodDataHttpHandler.jsonld#InternalPodDataHttpHandler_options_patchBodyParser"
+          },
+          "baseUrl": {
+            "@id": "undefineds:dist/http/InternalPodDataHttpHandler.jsonld#InternalPodDataHttpHandler_options_baseUrl"
+          },
+          "basePath": {
+            "@id": "undefineds:dist/http/InternalPodDataHttpHandler.jsonld#InternalPodDataHttpHandler_options_basePath"
+          }
+        }
+      },
       "QuotaAdminHttpHandler": {
         "@id": "undefineds:dist/http/quota/QuotaAdminHttpHandler.jsonld#QuotaAdminHttpHandler",
         "@prefix": true,

package/dist/http/InternalPodDataHttpHandler.d.ts

@@ -0,0 +1,32 @@
+import { HttpHandler, type BodyParser, type HttpHandlerInput, type ResourceStore } from '@solid/community-server';
+export interface InternalPodDataHttpHandlerOptions {
+    resourceStore: ResourceStore;
+    gatewayAdminProxyAuthSecret?: string;
+    patchBodyParser?: BodyParser;
+    baseUrl?: string;
+    basePath?: string;
+}
+export declare class InternalPodDataHttpHandler extends HttpHandler {
+    protected readonly logger: import("global-logger-factory").Logger<unknown>;
+    private readonly resourceStore;
+    private readonly gatewayAdminProxyAuthSecret?;
+    private readonly patchBodyParser?;
+    private readonly deploymentBaseUrl?;
+    private readonly basePath;
+    private readonly seenNonces;
+    constructor(options: InternalPodDataHttpHandlerOptions);
+    canHandle({ request }: HttpHandlerInput): Promise<void>;
+    handle({ request, response }: HttpHandlerInput): Promise<void>;
+    private verifyRequest;
+    private intentMatchesRequest;
+    private isHostedOwnerResource;
+    private isAllowedAiConnectionResource;
+    private delegate;
+    private createRepresentation;
+    private createPatch;
+    private pipeRepresentation;
+    private writeNotFound;
+    private parseUrl;
+    private parseOptionalUrl;
+    private isInsideDeployment;
+}

package/dist/http/InternalPodDataHttpHandler.js

@@ -0,0 +1,258 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.InternalPodDataHttpHandler = void 0;
+const promises_1 = require("node:stream/promises");
+const global_logger_factory_1 = require("global-logger-factory");
+const community_server_1 = require("@solid/community-server");
+const AiConnectionServiceAccess_1 = require("../api/ai-gateway/service-access/AiConnectionServiceAccess");
+const GatewayAdminProxyAuth_1 = require("../runtime/GatewayAdminProxyAuth");
+const ALLOWED_METHODS = new Set(['GET', 'PUT', 'PATCH', 'DELETE']);
+const DEFAULT_NONCE_TTL_MS = 120_000;
+const DEFAULT_NONCE_MAX_ENTRIES = 10_000;
+class InternalPodDataHttpHandler extends community_server_1.HttpHandler {
+    constructor(options) {
+        super();
+        this.logger = (0, global_logger_factory_1.getLoggerFor)(this);
+        this.resourceStore = options.resourceStore;
+        this.gatewayAdminProxyAuthSecret = options.gatewayAdminProxyAuthSecret ?? process.env.XPOD_GATEWAY_ADMIN_PROXY_AUTH_SECRET;
+        this.patchBodyParser = options.patchBodyParser;
+        this.deploymentBaseUrl = this.parseOptionalUrl(options.baseUrl ?? process.env.CSS_BASE_URL);
+        this.basePath = options.basePath ?? '/.internal/pod-data';
+        const nonceOptions = options;
+        this.seenNonces = new BoundedTtlNonceCache({
+            ttlMs: nonceOptions.nonceTtlMs ?? DEFAULT_NONCE_TTL_MS,
+            maxEntries: nonceOptions.nonceMaxEntries ?? DEFAULT_NONCE_MAX_ENTRIES,
+            now: nonceOptions.now,
+        });
+    }
+    async canHandle({ request }) {
+        if (this.parseUrl(request).pathname !== this.basePath) {
+            throw new community_server_1.NotImplementedHttpError('Not an internal Pod data request.');
+        }
+    }
+    async handle({ request, response }) {
+        if (this.parseUrl(request).pathname !== this.basePath) {
+            throw new community_server_1.NotImplementedHttpError('Not an internal Pod data request.');
+        }
+        const intent = this.verifyRequest(request);
+        if (!intent) {
+            this.writeNotFound(response);
+            return;
+        }
+        try {
+            await this.delegate(request, response, intent);
+        }
+        catch (error) {
+            if (isHttpNotFound(error)) {
+                this.writeNotFound(response);
+                return;
+            }
+            throw error;
+        }
+    }
+    verifyRequest(request) {
+        const method = request.method?.toUpperCase();
+        if (!ALLOWED_METHODS.has(method ?? '')) {
+            return undefined;
+        }
+        if (!(0, GatewayAdminProxyAuth_1.isLoopbackRemoteAddress)(request.socket.remoteAddress)) {
+            return undefined;
+        }
+        const verification = (0, GatewayAdminProxyAuth_1.verifyGatewayAdminProxyHeaders)({
+            headers: request.headers,
+            secret: this.gatewayAdminProxyAuthSecret,
+            method,
+            url: request.url,
+        });
+        if (!verification.valid || !verification.originalClientLoopback || !verification.intent || !verification.nonce) {
+            return undefined;
+        }
+        if (!this.intentMatchesRequest(verification.intent, method)) {
+            return undefined;
+        }
+        if (!this.isHostedOwnerResource(verification.intent)) {
+            return undefined;
+        }
+        if (!this.isAllowedAiConnectionResource(verification.intent)) {
+            return undefined;
+        }
+        if (!this.seenNonces.consume(verification.nonce)) {
+            return undefined;
+        }
+        return verification.intent;
+    }
+    intentMatchesRequest(intent, method) {
+        if (intent.method !== method) {
+            return false;
+        }
+        if (intent.scopes.length === 0) {
+            return false;
+        }
+        const requiredScope = method === 'GET' ? 'ai:credentials:read' : 'ai:credentials:write';
+        return intent.scopes.some((scope) => scope === requiredScope ||
+            scope === 'ai:credentials:*' ||
+            scope === 'ai:*');
+    }
+    isHostedOwnerResource(intent) {
+        if (!this.deploymentBaseUrl) {
+            return false;
+        }
+        let ownerUrl;
+        let resourceUrl;
+        try {
+            ownerUrl = new URL(intent.ownerWebId);
+            resourceUrl = new URL(intent.resourceUrl);
+        }
+        catch {
+            return false;
+        }
+        if (!this.isInsideDeployment(ownerUrl) || !this.isInsideDeployment(resourceUrl)) {
+            return false;
+        }
+        const podRoot = hostedPodRootFromOwner(ownerUrl);
+        return podRoot !== undefined &&
+            resourceUrl.origin === podRoot.origin &&
+            resourceUrl.pathname.startsWith(podRoot.pathname);
+    }
+    isAllowedAiConnectionResource(intent) {
+        let resourceUrl;
+        try {
+            resourceUrl = new URL(intent.resourceUrl);
+        }
+        catch {
+            return false;
+        }
+        if (resourceUrl.hash || resourceUrl.search) {
+            return false;
+        }
+        const allowed = (0, AiConnectionServiceAccess_1.createAiConnectionServiceAccess)({
+            ownerWebId: intent.ownerWebId,
+            serviceWebId: intent.ownerWebId,
+        }).resources.map((resource) => resource.url);
+        return allowed.includes(resourceUrl.href);
+    }
+    async delegate(request, response, intent) {
+        const identifier = { path: intent.resourceUrl };
+        switch (intent.method) {
+            case 'GET': {
+                const representation = await this.resourceStore.getRepresentation(identifier, {
+                    type: { 'text/turtle': 1, '*/*': 0.1 },
+                });
+                response.statusCode = 200;
+                response.setHeader('Content-Type', representation.metadata.contentType ?? 'text/turtle');
+                await this.pipeRepresentation(representation, response);
+                return;
+            }
+            case 'PUT': {
+                await this.resourceStore.setRepresentation(identifier, this.createRepresentation(request, intent.resourceUrl));
+                response.statusCode = 204;
+                response.end();
+                return;
+            }
+            case 'PATCH': {
+                await this.resourceStore.modifyResource(identifier, await this.createPatch(request, intent.resourceUrl));
+                response.statusCode = 204;
+                response.end();
+                return;
+            }
+            case 'DELETE': {
+                await this.resourceStore.deleteResource(identifier);
+                response.statusCode = 204;
+                response.end();
+            }
+        }
+    }
+    createRepresentation(request, resourceUrl) {
+        const contentType = firstHeader(request.headers['content-type']) ?? 'text/turtle';
+        return new community_server_1.BasicRepresentation(request, new community_server_1.RepresentationMetadata({ path: resourceUrl }, contentType));
+    }
+    async createPatch(request, resourceUrl) {
+        if (!this.patchBodyParser) {
+            throw new community_server_1.NotImplementedHttpError('Internal Pod data PATCH requires a PatchBodyParser.');
+        }
+        const contentType = firstHeader(request.headers['content-type']) ?? 'application/sparql-update';
+        const metadata = new community_server_1.RepresentationMetadata({ path: resourceUrl }, contentType);
+        return this.patchBodyParser.handleSafe({ request, metadata });
+    }
+    async pipeRepresentation(representation, response) {
+        await (0, promises_1.pipeline)(representation.data, response);
+    }
+    writeNotFound(response) {
+        response.statusCode = 404;
+        response.setHeader('Cache-Control', 'no-store');
+        response.end('Not Found');
+    }
+    parseUrl(request) {
+        return new URL(request.url ?? '/', `http://${request.headers.host ?? 'localhost'}`);
+    }
+    parseOptionalUrl(value) {
+        if (!value) {
+            return undefined;
+        }
+        try {
+            return new URL(ensureTrailingSlash(value));
+        }
+        catch {
+            return undefined;
+        }
+    }
+    isInsideDeployment(url) {
+        return this.deploymentBaseUrl !== undefined &&
+            url.origin === this.deploymentBaseUrl.origin &&
+            url.pathname.startsWith(this.deploymentBaseUrl.pathname);
+    }
+}
+exports.InternalPodDataHttpHandler = InternalPodDataHttpHandler;
+function isHttpNotFound(error) {
+    return typeof error === 'object' &&
+        error !== null &&
+        ('statusCode' in error ? error.statusCode === 404 : error.name === 'NotFoundHttpError');
+}
+function firstHeader(value) {
+    return Array.isArray(value) ? value[0] : value;
+}
+function hostedPodRootFromOwner(ownerUrl) {
+    if (ownerUrl.hash !== '#me') {
+        return undefined;
+    }
+    if (!ownerUrl.pathname.endsWith('/profile/card')) {
+        return undefined;
+    }
+    const podPath = ownerUrl.pathname.slice(0, -'profile/card'.length);
+    if (!podPath || !podPath.endsWith('/')) {
+        return undefined;
+    }
+    return new URL(podPath, ownerUrl.origin);
+}
+function ensureTrailingSlash(value) {
+    return value.endsWith('/') ? value : `${value}/`;
+}
+class BoundedTtlNonceCache {
+    constructor(options) {
+        this.entries = new Map();
+        this.ttlMs = Math.max(1, options.ttlMs);
+        this.maxEntries = Math.max(1, options.maxEntries);
+        this.now = options.now ?? Date.now;
+    }
+    consume(nonce) {
+        const now = this.now();
+        this.pruneExpired(now);
+        if (this.entries.has(nonce)) {
+            return false;
+        }
+        if (this.entries.size >= this.maxEntries) {
+            return false;
+        }
+        this.entries.set(nonce, now + this.ttlMs);
+        return true;
+    }
+    pruneExpired(now) {
+        for (const [nonce, expiresAt] of this.entries) {
+            if (expiresAt > now) {
+                continue;
+            }
+            this.entries.delete(nonce);
+        }
+    }
+}
+//# sourceMappingURL=InternalPodDataHttpHandler.js.map

package/dist/http/InternalPodDataHttpHandler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"InternalPodDataHttpHandler.js","sourceRoot":"","sources":["../../src/http/InternalPodDataHttpHandler.ts"],"names":[],"mappings":";;;AACA,mDAAgD;AAChD,iEAAqD;AACrD,8DAYiC;AACjC,0GAA6G;AAC7G,4EAI0C;AAkB1C,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAE,CAAC,CAAC;AACrE,MAAM,oBAAoB,GAAG,OAAO,CAAC;AACrC,MAAM,yBAAyB,GAAG,MAAM,CAAC;AAEzC,MAAa,0BAA2B,SAAQ,8BAAW;IASzD,YAAmB,OAA0C;QAC3D,KAAK,EAAE,CAAC;QATS,WAAM,GAAG,IAAA,oCAAY,EAAC,IAAI,CAAC,CAAC;QAU7C,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;QAC3C,IAAI,CAAC,2BAA2B,GAAG,OAAO,CAAC,2BAA2B,IAAI,OAAO,CAAC,GAAG,CAAC,oCAAoC,CAAC;QAC3H,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC;QAC/C,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC5F,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,qBAAqB,CAAC;QAC1D,MAAM,YAAY,GAAG,OAAqF,CAAC;QAC3G,IAAI,CAAC,UAAU,GAAG,IAAI,oBAAoB,CAAC;YACzC,KAAK,EAAE,YAAY,CAAC,UAAU,IAAI,oBAAoB;YACtD,UAAU,EAAE,YAAY,CAAC,eAAe,IAAI,yBAAyB;YACrE,GAAG,EAAE,YAAY,CAAC,GAAG;SACtB,CAAC,CAAC;IACL,CAAC;IAEe,KAAK,CAAC,SAAS,CAAC,EAAE,OAAO,EAAoB;QAC3D,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;YACtD,MAAM,IAAI,0CAAuB,CAAC,mCAAmC,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IAEe,KAAK,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAoB;QAClE,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;YACtD,MAAM,IAAI,0CAAuB,CAAC,mCAAmC,CAAC,CAAC;QACzE,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;YAC7B,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QACjD,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,IAAI,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1B,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;gBAC7B,OAAO;YACT,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAEO,aAAa,CAAC,OAAoB;QACxC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC;QAC7C,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;YACvC,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,CAAC,IAAA,+CAAuB,EAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;YAC3D,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,YAAY,GAAG,IAAA,sDAA8B,EAAC;YAClD,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,MAAM,EAAE,IAAI,CAAC,2BAA2B;YACxC,MAAM;YACN,GAAG,EAAE,OAAO,CAAC,GAAG;SACjB,CAAC,CAAC;QACH,IAAI,CAAC,YAAY,CAAC,KAAK,IAAI,CAAC,YAAY,CAAC,sBAAsB,IAAI,CAAC,YAAY,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;YAC/G,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,YAAY,CAAC,MAAM,EAAE,MAA+B,CAAC,EAAE,CAAC;YACrF,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;YACrD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,6BAA6B,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7D,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;YACjD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,YAAY,CAAC,MAAM,CAAC;IAC7B,CAAC;IAEO,oBAAoB,CAAC,MAA+B,EAAE,MAA6B;QACzF,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC7B,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,aAAa,GAAG,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,sBAAsB,CAAC;QACxF,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAClC,KAAK,KAAK,aAAa;YACvB,KAAK,KAAK,kBAAkB;YAC5B,KAAK,KAAK,MAAM,CACjB,CAAC;IACJ,CAAC;IAEO,qBAAqB,CAAC,MAA+B;QAC3D,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC5B,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,QAAa,CAAC;QAClB,IAAI,WAAgB,CAAC;QACrB,IAAI,CAAC;YACH,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YACtC,WAAW,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,EAAE,CAAC;YAChF,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,OAAO,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAC;QACjD,OAAO,OAAO,KAAK,SAAS;YAC1B,WAAW,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;YACrC,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACtD,CAAC;IAEO,6BAA6B,CAAC,MAA+B;QACnE,IAAI,WAAgB,CAAC;QACrB,IAAI,CAAC;YACH,WAAW,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,WAAW,CAAC,IAAI,IAAI,WAAW,CAAC,MAAM,EAAE,CAAC;YAC3C,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,OAAO,GAAG,IAAA,2DAA+B,EAAC;YAC9C,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,YAAY,EAAE,MAAM,CAAC,UAAU;SAChC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC7C,OAAO,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IAC5C,CAAC;IAEO,KAAK,CAAC,QAAQ,CACpB,OAAoB,EACpB,QAAsB,EACtB,MAA+B;QAE/B,MAAM,UAAU,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC;QAChD,QAAQ,MAAM,CAAC,MAAM,EAAE,CAAC;YACtB,KAAK,KAAK,CAAC,CAAC,CAAC;gBACX,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,iBAAiB,CAAC,UAAU,EAAE;oBAC5E,IAAI,EAAE,EAAE,aAAa,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE;iBACvC,CAAC,CAAC;gBACH,QAAQ,CAAC,UAAU,GAAG,GAAG,CAAC;gBAC1B,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,cAAc,CAAC,QAAQ,CAAC,WAAW,IAAI,aAAa,CAAC,CAAC;gBACzF,MAAM,IAAI,CAAC,kBAAkB,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC;gBACxD,OAAO;YACT,CAAC;YACD,KAAK,KAAK,CAAC,CAAC,CAAC;gBACX,MAAM,IAAI,CAAC,aAAa,CAAC,iBAAiB,CAAC,UAAU,EAAE,IAAI,CAAC,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;gBAC/G,QAAQ,CAAC,UAAU,GAAG,GAAG,CAAC;gBAC1B,QAAQ,CAAC,GAAG,EAAE,CAAC;gBACf,OAAO;YACT,CAAC;YACD,KAAK,OAAO,CAAC,CAAC,CAAC;gBACb,MAAM,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,UAAU,EAAE,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;gBACzG,QAAQ,CAAC,UAAU,GAAG,GAAG,CAAC;gBAC1B,QAAQ,CAAC,GAAG,EAAE,CAAC;gBACf,OAAO;YACT,CAAC;YACD,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,MAAM,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;gBACpD,QAAQ,CAAC,UAAU,GAAG,GAAG,CAAC;gBAC1B,QAAQ,CAAC,GAAG,EAAE,CAAC;YACjB,CAAC;QACH,CAAC;IACH,CAAC;IAEO,oBAAoB,CAAC,OAAoB,EAAE,WAAmB;QACpE,MAAM,WAAW,GAAG,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,IAAI,aAAa,CAAC;QAClF,OAAO,IAAI,sCAAmB,CAC5B,OAAO,EACP,IAAI,yCAAsB,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,WAAW,CAAC,CAC/D,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,WAAW,CAAC,OAAoB,EAAE,WAAmB;QACjE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;YAC1B,MAAM,IAAI,0CAAuB,CAAC,qDAAqD,CAAC,CAAC;QAC3F,CAAC;QACD,MAAM,WAAW,GAAG,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,IAAI,2BAA2B,CAAC;QAChG,MAAM,QAAQ,GAAG,IAAI,yCAAsB,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,WAAW,CAAC,CAAC;QAChF,OAAO,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAmB,CAAC;IAClF,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAAC,cAA8B,EAAE,QAAsB;QACrF,MAAM,IAAA,mBAAQ,EAAC,cAAc,CAAC,IAAgB,EAAE,QAAQ,CAAC,CAAC;IAC5D,CAAC;IAEO,aAAa,CAAC,QAAsB;QAC1C,QAAQ,CAAC,UAAU,GAAG,GAAG,CAAC;QAC1B,QAAQ,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAChD,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC5B,CAAC;IAEO,QAAQ,CAAC,OAAoB;QACnC,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,UAAU,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC,CAAC;IACtF,CAAC;IAEO,gBAAgB,CAAC,KAAyB;QAChD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,CAAC;YACH,OAAO,IAAI,GAAG,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAEO,kBAAkB,CAAC,GAAQ;QACjC,OAAO,IAAI,CAAC,iBAAiB,KAAK,SAAS;YACzC,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,iBAAiB,CAAC,MAAM;YAC5C,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC7D,CAAC;CACF;AA/ND,gEA+NC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,OAAO,OAAO,KAAK,KAAK,QAAQ;QAC9B,KAAK,KAAK,IAAI;QACd,CAAC,YAAY,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,KAAK,GAAG,CAAC,CAAC,CAAE,KAA2B,CAAC,IAAI,KAAK,mBAAmB,CAAC,CAAC;AACnH,CAAC;AAED,SAAS,WAAW,CAAC,KAAoC;IACvD,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AACjD,CAAC;AAED,SAAS,sBAAsB,CAAC,QAAa;IAC3C,IAAI,QAAQ,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC5B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;QACjD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;IACnE,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACvC,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAa;IACxC,OAAO,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC;AACnD,CAAC;AAED,MAAM,oBAAoB;IAMxB,YAAmB,OAAkE;QAFpE,YAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;QAGnD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QACxC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;QAClD,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACrC,CAAC;IAEM,OAAO,CAAC,KAAa;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5B,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACzC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1C,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,YAAY,CAAC,GAAW;QAC9B,KAAK,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAC9C,IAAI,SAAS,GAAG,GAAG,EAAE,CAAC;gBACpB,SAAS;YACX,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;CAEF","sourcesContent":["import { Readable } from 'node:stream';\nimport { pipeline } from 'node:stream/promises';\nimport { getLoggerFor } from 'global-logger-factory';\nimport {\n  BasicRepresentation,\n  HttpHandler,\n  NotImplementedHttpError,\n  RepresentationMetadata,\n  type BodyParser,\n  type HttpHandlerInput,\n  type HttpRequest,\n  type HttpResponse,\n  type Patch,\n  type Representation,\n  type ResourceStore,\n} from '@solid/community-server';\nimport { createAiConnectionServiceAccess } from '../api/ai-gateway/service-access/AiConnectionServiceAccess';\nimport {\n  isLoopbackRemoteAddress,\n  verifyGatewayAdminProxyHeaders,\n  type GatewayAdminProxyIntent,\n} from '../runtime/GatewayAdminProxyAuth';\n\nexport interface InternalPodDataHttpHandlerOptions {\n  resourceStore: ResourceStore;\n  gatewayAdminProxyAuthSecret?: string;\n  patchBodyParser?: BodyParser;\n  baseUrl?: string;\n  basePath?: string;\n}\n\ninterface InternalPodDataHttpHandlerNonceOptions {\n  nonceTtlMs?: number;\n  nonceMaxEntries?: number;\n  now?: () => number;\n}\n\ntype InternalPodDataMethod = 'GET' | 'PUT' | 'PATCH' | 'DELETE';\n\nconst ALLOWED_METHODS = new Set([ 'GET', 'PUT', 'PATCH', 'DELETE' ]);\nconst DEFAULT_NONCE_TTL_MS = 120_000;\nconst DEFAULT_NONCE_MAX_ENTRIES = 10_000;\n\nexport class InternalPodDataHttpHandler extends HttpHandler {\n  protected readonly logger = getLoggerFor(this);\n  private readonly resourceStore: ResourceStore;\n  private readonly gatewayAdminProxyAuthSecret?: string;\n  private readonly patchBodyParser?: BodyParser;\n  private readonly deploymentBaseUrl?: URL;\n  private readonly basePath: string;\n  private readonly seenNonces: BoundedTtlNonceCache;\n\n  public constructor(options: InternalPodDataHttpHandlerOptions) {\n    super();\n    this.resourceStore = options.resourceStore;\n    this.gatewayAdminProxyAuthSecret = options.gatewayAdminProxyAuthSecret ?? process.env.XPOD_GATEWAY_ADMIN_PROXY_AUTH_SECRET;\n    this.patchBodyParser = options.patchBodyParser;\n    this.deploymentBaseUrl = this.parseOptionalUrl(options.baseUrl ?? process.env.CSS_BASE_URL);\n    this.basePath = options.basePath ?? '/.internal/pod-data';\n    const nonceOptions = options as InternalPodDataHttpHandlerOptions & InternalPodDataHttpHandlerNonceOptions;\n    this.seenNonces = new BoundedTtlNonceCache({\n      ttlMs: nonceOptions.nonceTtlMs ?? DEFAULT_NONCE_TTL_MS,\n      maxEntries: nonceOptions.nonceMaxEntries ?? DEFAULT_NONCE_MAX_ENTRIES,\n      now: nonceOptions.now,\n    });\n  }\n\n  public override async canHandle({ request }: HttpHandlerInput): Promise<void> {\n    if (this.parseUrl(request).pathname !== this.basePath) {\n      throw new NotImplementedHttpError('Not an internal Pod data request.');\n    }\n  }\n\n  public override async handle({ request, response }: HttpHandlerInput): Promise<void> {\n    if (this.parseUrl(request).pathname !== this.basePath) {\n      throw new NotImplementedHttpError('Not an internal Pod data request.');\n    }\n\n    const intent = this.verifyRequest(request);\n    if (!intent) {\n      this.writeNotFound(response);\n      return;\n    }\n\n    try {\n      await this.delegate(request, response, intent);\n    } catch (error: unknown) {\n      if (isHttpNotFound(error)) {\n        this.writeNotFound(response);\n        return;\n      }\n      throw error;\n    }\n  }\n\n  private verifyRequest(request: HttpRequest): GatewayAdminProxyIntent | undefined {\n    const method = request.method?.toUpperCase();\n    if (!ALLOWED_METHODS.has(method ?? '')) {\n      return undefined;\n    }\n    if (!isLoopbackRemoteAddress(request.socket.remoteAddress)) {\n      return undefined;\n    }\n\n    const verification = verifyGatewayAdminProxyHeaders({\n      headers: request.headers,\n      secret: this.gatewayAdminProxyAuthSecret,\n      method,\n      url: request.url,\n    });\n    if (!verification.valid || !verification.originalClientLoopback || !verification.intent || !verification.nonce) {\n      return undefined;\n    }\n    if (!this.intentMatchesRequest(verification.intent, method as InternalPodDataMethod)) {\n      return undefined;\n    }\n    if (!this.isHostedOwnerResource(verification.intent)) {\n      return undefined;\n    }\n    if (!this.isAllowedAiConnectionResource(verification.intent)) {\n      return undefined;\n    }\n    if (!this.seenNonces.consume(verification.nonce)) {\n      return undefined;\n    }\n    return verification.intent;\n  }\n\n  private intentMatchesRequest(intent: GatewayAdminProxyIntent, method: InternalPodDataMethod): boolean {\n    if (intent.method !== method) {\n      return false;\n    }\n    if (intent.scopes.length === 0) {\n      return false;\n    }\n    const requiredScope = method === 'GET' ? 'ai:credentials:read' : 'ai:credentials:write';\n    return intent.scopes.some((scope) =>\n      scope === requiredScope ||\n      scope === 'ai:credentials:*' ||\n      scope === 'ai:*',\n    );\n  }\n\n  private isHostedOwnerResource(intent: GatewayAdminProxyIntent): boolean {\n    if (!this.deploymentBaseUrl) {\n      return false;\n    }\n\n    let ownerUrl: URL;\n    let resourceUrl: URL;\n    try {\n      ownerUrl = new URL(intent.ownerWebId);\n      resourceUrl = new URL(intent.resourceUrl);\n    } catch {\n      return false;\n    }\n    if (!this.isInsideDeployment(ownerUrl) || !this.isInsideDeployment(resourceUrl)) {\n      return false;\n    }\n\n    const podRoot = hostedPodRootFromOwner(ownerUrl);\n    return podRoot !== undefined &&\n      resourceUrl.origin === podRoot.origin &&\n      resourceUrl.pathname.startsWith(podRoot.pathname);\n  }\n\n  private isAllowedAiConnectionResource(intent: GatewayAdminProxyIntent): boolean {\n    let resourceUrl: URL;\n    try {\n      resourceUrl = new URL(intent.resourceUrl);\n    } catch {\n      return false;\n    }\n    if (resourceUrl.hash || resourceUrl.search) {\n      return false;\n    }\n    const allowed = createAiConnectionServiceAccess({\n      ownerWebId: intent.ownerWebId,\n      serviceWebId: intent.ownerWebId,\n    }).resources.map((resource) => resource.url);\n    return allowed.includes(resourceUrl.href);\n  }\n\n  private async delegate(\n    request: HttpRequest,\n    response: HttpResponse,\n    intent: GatewayAdminProxyIntent,\n  ): Promise<void> {\n    const identifier = { path: intent.resourceUrl };\n    switch (intent.method) {\n      case 'GET': {\n        const representation = await this.resourceStore.getRepresentation(identifier, {\n          type: { 'text/turtle': 1, '*/*': 0.1 },\n        });\n        response.statusCode = 200;\n        response.setHeader('Content-Type', representation.metadata.contentType ?? 'text/turtle');\n        await this.pipeRepresentation(representation, response);\n        return;\n      }\n      case 'PUT': {\n        await this.resourceStore.setRepresentation(identifier, this.createRepresentation(request, intent.resourceUrl));\n        response.statusCode = 204;\n        response.end();\n        return;\n      }\n      case 'PATCH': {\n        await this.resourceStore.modifyResource(identifier, await this.createPatch(request, intent.resourceUrl));\n        response.statusCode = 204;\n        response.end();\n        return;\n      }\n      case 'DELETE': {\n        await this.resourceStore.deleteResource(identifier);\n        response.statusCode = 204;\n        response.end();\n      }\n    }\n  }\n\n  private createRepresentation(request: HttpRequest, resourceUrl: string): Representation {\n    const contentType = firstHeader(request.headers['content-type']) ?? 'text/turtle';\n    return new BasicRepresentation(\n      request,\n      new RepresentationMetadata({ path: resourceUrl }, contentType),\n    );\n  }\n\n  private async createPatch(request: HttpRequest, resourceUrl: string): Promise<Patch> {\n    if (!this.patchBodyParser) {\n      throw new NotImplementedHttpError('Internal Pod data PATCH requires a PatchBodyParser.');\n    }\n    const contentType = firstHeader(request.headers['content-type']) ?? 'application/sparql-update';\n    const metadata = new RepresentationMetadata({ path: resourceUrl }, contentType);\n    return this.patchBodyParser.handleSafe({ request, metadata }) as Promise<Patch>;\n  }\n\n  private async pipeRepresentation(representation: Representation, response: HttpResponse): Promise<void> {\n    await pipeline(representation.data as Readable, response);\n  }\n\n  private writeNotFound(response: HttpResponse): void {\n    response.statusCode = 404;\n    response.setHeader('Cache-Control', 'no-store');\n    response.end('Not Found');\n  }\n\n  private parseUrl(request: HttpRequest): URL {\n    return new URL(request.url ?? '/', `http://${request.headers.host ?? 'localhost'}`);\n  }\n\n  private parseOptionalUrl(value: string | undefined): URL | undefined {\n    if (!value) {\n      return undefined;\n    }\n    try {\n      return new URL(ensureTrailingSlash(value));\n    } catch {\n      return undefined;\n    }\n  }\n\n  private isInsideDeployment(url: URL): boolean {\n    return this.deploymentBaseUrl !== undefined &&\n      url.origin === this.deploymentBaseUrl.origin &&\n      url.pathname.startsWith(this.deploymentBaseUrl.pathname);\n  }\n}\n\nfunction isHttpNotFound(error: unknown): boolean {\n  return typeof error === 'object' &&\n    error !== null &&\n    ('statusCode' in error ? error.statusCode === 404 : (error as { name?: string }).name === 'NotFoundHttpError');\n}\n\nfunction firstHeader(value: string | string[] | undefined): string | undefined {\n  return Array.isArray(value) ? value[0] : value;\n}\n\nfunction hostedPodRootFromOwner(ownerUrl: URL): URL | undefined {\n  if (ownerUrl.hash !== '#me') {\n    return undefined;\n  }\n  if (!ownerUrl.pathname.endsWith('/profile/card')) {\n    return undefined;\n  }\n  const podPath = ownerUrl.pathname.slice(0, -'profile/card'.length);\n  if (!podPath || !podPath.endsWith('/')) {\n    return undefined;\n  }\n  return new URL(podPath, ownerUrl.origin);\n}\n\nfunction ensureTrailingSlash(value: string): string {\n  return value.endsWith('/') ? value : `${value}/`;\n}\n\nclass BoundedTtlNonceCache {\n  private readonly ttlMs: number;\n  private readonly maxEntries: number;\n  private readonly now: () => number;\n  private readonly entries = new Map<string, number>();\n\n  public constructor(options: { ttlMs: number; maxEntries: number; now?: () => number }) {\n    this.ttlMs = Math.max(1, options.ttlMs);\n    this.maxEntries = Math.max(1, options.maxEntries);\n    this.now = options.now ?? Date.now;\n  }\n\n  public consume(nonce: string): boolean {\n    const now = this.now();\n    this.pruneExpired(now);\n    if (this.entries.has(nonce)) {\n      return false;\n    }\n    if (this.entries.size >= this.maxEntries) {\n      return false;\n    }\n    this.entries.set(nonce, now + this.ttlMs);\n    return true;\n  }\n\n  private pruneExpired(now: number): void {\n    for (const [nonce, expiresAt] of this.entries) {\n      if (expiresAt > now) {\n        continue;\n      }\n      this.entries.delete(nonce);\n    }\n  }\n\n}\n"]}