@undefineds.co/xpod 0.4.13 → 0.4.14

package/dist/edge/EdgeNodeDnsCoordinator.d.ts

@@ -19,7 +19,17 @@ export declare class EdgeNodeDnsCoordinator {
     private readonly ttl?;
     private readonly enabled;
     constructor(options: EdgeNodeDnsCoordinatorOptions);
-    synchronize(nodeId: string, metadata: Record<string, unknown>): Promise<void>;
+    /**
+     * Reconciles the DNS record owned by one node.
+     *
+     * `binding` is the control plane's subdomain assignment for that node. When it is
+     * supplied it is authoritative, including when it carries no subdomain: that means the
+     * node owns no record and nothing may be written or deleted. Node-reported metadata is
+     * still consulted for callers whose subdomain is local (`LocalNetworkManager`).
+     */
+    synchronize(nodeId: string, metadata: Record<string, unknown>, binding?: {
+        subdomain?: string;
+    }): Promise<void>;
     private extractDnsHints;
     private extractTunnelEntrypoint;
     private extractString;

package/dist/edge/EdgeNodeDnsCoordinator.js

@@ -11,12 +11,22 @@ class EdgeNodeDnsCoordinator {
         this.ttl = this.normalizeTtl(options.ttl);
         this.enabled = Boolean(this.rootDomain);
     }
-    async synchronize(nodeId, metadata) {
+    /**
+     * Reconciles the DNS record owned by one node.
+     *
+     * `binding` is the control plane's subdomain assignment for that node. When it is
+     * supplied it is authoritative, including when it carries no subdomain: that means the
+     * node owns no record and nothing may be written or deleted. Node-reported metadata is
+     * still consulted for callers whose subdomain is local (`LocalNetworkManager`).
+     */
+    async synchronize(nodeId, metadata, binding) {
         if (!this.enabled) {
             return;
         }
         const hints = this.extractDnsHints(metadata);
-        const subdomain = this.extractString(metadata.subdomain) ?? hints?.subdomain;
+        const subdomain = binding
+            ? this.extractString(binding.subdomain)
+            : this.extractString(metadata.subdomain) ?? hints?.subdomain;
         if (!subdomain) {
             this.logger.debug(`Node ${nodeId} 未提供 subdomain，跳过 DNS 同步。`);
             return;

package/dist/edge/EdgeNodeHealthProbeService.d.ts

@@ -1,10 +1,17 @@
 import { EdgeNodeRepository } from '../identity/drizzle/EdgeNodeRepository';
+import { type HeadProbeRequest, type ResolveAddresses } from './ProbeTargetGuard';
 interface EdgeNodeHealthProbeServiceOptions {
     repository?: EdgeNodeRepository;
     identityDbUrl?: string;
     enabled?: boolean | string;
     timeoutMs?: number | string;
     locations?: string | string[];
+    /** DNS resolution used to validate probe targets; injected in tests. */
+    resolveAddresses?: ResolveAddresses;
+    /** Transport for the direct HEAD probe; injected in tests. */
+    headRequest?: HeadProbeRequest;
+    /** Redirect hops followed while re-validating every target. */
+    maxRedirects?: number;
 }
 export declare class EdgeNodeHealthProbeService {
     private readonly logger;
@@ -12,6 +19,9 @@ export declare class EdgeNodeHealthProbeService {
     private readonly enabled;
     private readonly timeoutMs;
     private readonly locations;
+    private readonly resolveAddresses?;
+    private readonly headRequest;
+    private readonly maxRedirects;
     constructor(options: EdgeNodeHealthProbeServiceOptions);
     probeNode(nodeId: string): Promise<void>;
     private collectCandidates;
@@ -19,6 +29,11 @@ export declare class EdgeNodeHealthProbeService {
     private extractManagedTunnelEndpoint;
     private extractNonEmptyString;
     private ping;
+    /**
+     * Follows redirects by hand so every hop is validated again: a public entry point must
+     * not be able to bounce the probe into a private address.
+     */
+    private probePublicCandidate;
     private toUrl;
     private createRepository;
     private normalizeBoolean;

package/dist/edge/EdgeNodeHealthProbeService.js

@@ -4,6 +4,7 @@ exports.EdgeNodeHealthProbeService = void 0;
 const global_logger_factory_1 = require("global-logger-factory");
 const db_1 = require("../identity/drizzle/db");
 const EdgeNodeRepository_1 = require("../identity/drizzle/EdgeNodeRepository");
+const ProbeTargetGuard_1 = require("./ProbeTargetGuard");
 class EdgeNodeHealthProbeService {
     constructor(options) {
         this.logger = (0, global_logger_factory_1.getLoggerFor)(this);
@@ -11,6 +12,9 @@ class EdgeNodeHealthProbeService {
         this.enabled = this.normalizeBoolean(options.enabled) && Boolean(this.repository);
         this.timeoutMs = this.normalizeTimeout(options.timeoutMs) ?? 3_000;
         this.locations = this.normalizeLocations(options.locations);
+        this.resolveAddresses = options.resolveAddresses;
+        this.headRequest = options.headRequest ?? (0, ProbeTargetGuard_1.createPinnedHeadProbeRequest)();
+        this.maxRedirects = Math.max(0, Math.trunc(options.maxRedirects ?? 3));
     }
     async probeNode(nodeId) {
         if (!this.enabled) {
@@ -87,8 +91,20 @@ class EdgeNodeHealthProbeService {
         if (!url) {
             return { candidate, success: false, error: 'invalid-url', location: location.name, checkedAt: new Date().toISOString() };
         }
-        const controller = new AbortController();
-        const timer = setTimeout(() => controller.abort(), this.timeoutMs);
+        // The candidate comes from node metadata, so Cloud only contacts public targets:
+        // private, loopback, link-local and metadata addresses stay with clients that can
+        // actually reach them.
+        const decision = await (0, ProbeTargetGuard_1.assertPublicProbeTarget)(url, this.resolveAddresses);
+        if (!decision.allowed) {
+            this.logger.debug(`跳过非公网探测目标 ${candidate}: ${decision.reason}`);
+            return {
+                candidate,
+                success: false,
+                error: `blocked-target:${decision.reason}`,
+                location: location.name,
+                checkedAt: new Date().toISOString(),
+            };
+        }
         const started = Date.now();
         try {
             if (location.endpoint) {
@@ -96,10 +112,9 @@ class EdgeNodeHealthProbeService {
                 probeUrl.searchParams.set('target', url.toString());
                 const response = await fetch(probeUrl.toString(), {
                     method: 'GET',
-                    signal: controller.signal,
                     headers: { 'accept': 'application/json' },
+                    signal: AbortSignal.timeout(this.timeoutMs),
                 });
-                clearTimeout(timer);
                 const latencyMs = Date.now() - started;
                 if (!response.ok) {
                     return {
@@ -133,23 +148,18 @@ class EdgeNodeHealthProbeService {
                     };
                 }
             }
-            const response = await fetch(url.toString(), {
-                method: 'HEAD',
-                signal: controller.signal,
-            });
-            clearTimeout(timer);
+            const probe = await this.probePublicCandidate(url, decision.address);
             const latencyMs = Date.now() - started;
             return {
                 candidate,
                 location: location.name,
-                success: response.ok,
+                success: probe.status >= 200 && probe.status < 400,
                 latencyMs,
-                error: response.ok ? undefined : `status:${response.status}`,
+                error: probe.error ?? (probe.status >= 200 && probe.status < 400 ? undefined : `status:${probe.status}`),
                 checkedAt: new Date().toISOString(),
             };
         }
         catch (error) {
-            clearTimeout(timer);
             return {
                 candidate,
                 location: location.name,
@@ -159,6 +169,28 @@ class EdgeNodeHealthProbeService {
             };
         }
     }
+    /**
+     * Follows redirects by hand so every hop is validated again: a public entry point must
+     * not be able to bounce the probe into a private address.
+     */
+    async probePublicCandidate(startUrl, startAddress) {
+        let url = startUrl;
+        let address = startAddress;
+        for (let hop = 0; hop <= this.maxRedirects; hop += 1) {
+            const response = await this.headRequest(url, { address, timeoutMs: this.timeoutMs });
+            if (response.status < 300 || response.status >= 400 || !response.location) {
+                return { status: response.status };
+            }
+            const next = new URL(response.location, url);
+            const decision = await (0, ProbeTargetGuard_1.assertPublicProbeTarget)(next, this.resolveAddresses);
+            if (!decision.allowed) {
+                return { status: 0, error: `blocked-redirect:${decision.reason}` };
+            }
+            url = next;
+            address = decision.address;
+        }
+        return { status: 0, error: 'blocked-redirect:too-many-redirects' };
+    }
     toUrl(value) {
         try {
             return new URL(value);

package/dist/edge/EdgeNodeHealthProbeService.jsonld

@@ -74,6 +74,49 @@
               }
             ]
           }
+        },
+        {
+          "@id": "undefineds:dist/edge/EdgeNodeHealthProbeService.jsonld#EdgeNodeHealthProbeService_options_resolveAddresses",
+          "range": {
+            "@type": "ParameterRangeUnion",
+            "parameterRangeElements": [
+              {
+                "@type": "ParameterRangeWildcard"
+              },
+              {
+                "@type": "ParameterRangeUndefined"
+              }
+            ]
+          },
+          "comment": "DNS resolution used to validate probe targets; injected in tests."
+        },
+        {
+          "@id": "undefineds:dist/edge/EdgeNodeHealthProbeService.jsonld#EdgeNodeHealthProbeService_options_headRequest",
+          "range": {
+            "@type": "ParameterRangeUnion",
+            "parameterRangeElements": [
+              {
+                "@type": "ParameterRangeWildcard"
+              },
+              {
+                "@type": "ParameterRangeUndefined"
+              }
+            ]
+          },
+          "comment": "Transport for the direct HEAD probe; injected in tests."
+        },
+        {
+          "@id": "undefineds:dist/edge/EdgeNodeHealthProbeService.jsonld#EdgeNodeHealthProbeService_options_maxRedirects",
+          "range": {
+            "@type": "ParameterRangeUnion",
+            "parameterRangeElements": [
+              "xsd:number",
+              {
+                "@type": "ParameterRangeUndefined"
+              }
+            ]
+          },
+          "comment": "Redirect hops followed while re-validating every target."
         }
       ],
       "memberFields": [
@@ -97,6 +140,18 @@
           "@id": "undefineds:dist/edge/EdgeNodeHealthProbeService.jsonld#EdgeNodeHealthProbeService__member_locations",
           "memberFieldName": "locations"
         },
+        {
+          "@id": "undefineds:dist/edge/EdgeNodeHealthProbeService.jsonld#EdgeNodeHealthProbeService__member_resolveAddresses",
+          "memberFieldName": "resolveAddresses"
+        },
+        {
+          "@id": "undefineds:dist/edge/EdgeNodeHealthProbeService.jsonld#EdgeNodeHealthProbeService__member_headRequest",
+          "memberFieldName": "headRequest"
+        },
+        {
+          "@id": "undefineds:dist/edge/EdgeNodeHealthProbeService.jsonld#EdgeNodeHealthProbeService__member_maxRedirects",
+          "memberFieldName": "maxRedirects"
+        },
         {
           "@id": "undefineds:dist/edge/EdgeNodeHealthProbeService.jsonld#EdgeNodeHealthProbeService__member_constructor",
           "memberFieldName": "constructor"
@@ -125,6 +180,10 @@
           "@id": "undefineds:dist/edge/EdgeNodeHealthProbeService.jsonld#EdgeNodeHealthProbeService__member_ping",
           "memberFieldName": "ping"
         },
+        {
+          "@id": "undefineds:dist/edge/EdgeNodeHealthProbeService.jsonld#EdgeNodeHealthProbeService__member_probePublicCandidate",
+          "memberFieldName": "probePublicCandidate"
+        },
         {
           "@id": "undefineds:dist/edge/EdgeNodeHealthProbeService.jsonld#EdgeNodeHealthProbeService__member_toUrl",
           "memberFieldName": "toUrl"
@@ -179,6 +238,24 @@
               "value": {
                 "@id": "undefineds:dist/edge/EdgeNodeHealthProbeService.jsonld#EdgeNodeHealthProbeService_options_locations"
               }
+            },
+            {
+              "keyRaw": "resolveAddresses",
+              "value": {
+                "@id": "undefineds:dist/edge/EdgeNodeHealthProbeService.jsonld#EdgeNodeHealthProbeService_options_resolveAddresses"
+              }
+            },
+            {
+              "keyRaw": "headRequest",
+              "value": {
+                "@id": "undefineds:dist/edge/EdgeNodeHealthProbeService.jsonld#EdgeNodeHealthProbeService_options_headRequest"
+              }
+            },
+            {
+              "keyRaw": "maxRedirects",
+              "value": {
+                "@id": "undefineds:dist/edge/EdgeNodeHealthProbeService.jsonld#EdgeNodeHealthProbeService_options_maxRedirects"
+              }
             }
           ]
         }

package/dist/edge/ProbeTargetGuard.d.ts

@@ -0,0 +1,35 @@
+export type ResolveAddresses = (hostname: string) => Promise<string[]>;
+export type ProbeTargetDecision = {
+    allowed: true;
+    address: string;
+} | {
+    allowed: false;
+    reason: string;
+};
+/** Whether an address is a public unicast address a Cloud probe may contact. */
+export declare function isPublicIpAddress(address: string): boolean;
+/** Resolves every address of a probe hostname; injected in tests. */
+export declare function resolveHostAddresses(hostname: string): Promise<string[]>;
+/**
+ * Decides whether a probe target may be contacted.
+ *
+ * Every resolved address has to be public, so a hostname that mixes public and private
+ * records is refused instead of racing whichever record the connection picks.
+ */
+export declare function assertPublicProbeTarget(url: URL, resolveAddresses?: ResolveAddresses): Promise<ProbeTargetDecision>;
+export interface HeadProbeRequestOptions {
+    /** Address the connection is pinned to, already validated by the target policy. */
+    address: string;
+    timeoutMs: number;
+}
+export type HeadProbeRequest = (url: URL, options: HeadProbeRequestOptions) => Promise<{
+    status: number;
+    location?: string;
+}>;
+/**
+ * HEAD request pinned to a validated address.
+ *
+ * Pinning is what makes the DNS check meaningful: without it the client would resolve the
+ * hostname a second time and a rebinding answer could still reach a private address.
+ */
+export declare function createPinnedHeadProbeRequest(): HeadProbeRequest;

package/dist/edge/ProbeTargetGuard.js

@@ -0,0 +1,142 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isPublicIpAddress = isPublicIpAddress;
+exports.resolveHostAddresses = resolveHostAddresses;
+exports.assertPublicProbeTarget = assertPublicProbeTarget;
+exports.createPinnedHeadProbeRequest = createPinnedHeadProbeRequest;
+const node_http_1 = __importDefault(require("node:http"));
+const node_https_1 = __importDefault(require("node:https"));
+const node_net_1 = require("node:net");
+const node_dns_1 = __importDefault(require("node:dns"));
+/**
+ * Address ranges a Cloud probe must never contact: the probe target comes from node
+ * metadata, so without this an edge node could make the cluster fetch its own private
+ * network, loopback services or the cloud metadata endpoint.
+ */
+const BLOCKED_IPV4 = new node_net_1.BlockList();
+for (const [network, prefix] of [
+    ['0.0.0.0', 8],
+    ['10.0.0.0', 8],
+    ['100.64.0.0', 10],
+    ['127.0.0.0', 8],
+    ['169.254.0.0', 16],
+    ['172.16.0.0', 12],
+    ['192.0.0.0', 24],
+    ['192.0.2.0', 24],
+    ['192.168.0.0', 16],
+    ['198.18.0.0', 15],
+    ['198.51.100.0', 24],
+    ['203.0.113.0', 24],
+    ['224.0.0.0', 4],
+    ['240.0.0.0', 4],
+]) {
+    BLOCKED_IPV4.addSubnet(network, prefix, 'ipv4');
+}
+// IPv4-mapped addresses are normalized to IPv4 before checking, so the two families stay
+// in separate lists: a mixed list makes `check(ipv4Address, 'ipv4')` match IPv6 rules.
+const BLOCKED_IPV6 = new node_net_1.BlockList();
+for (const [network, prefix] of [
+    ['::', 128],
+    ['::1', 128],
+    ['64:ff9b::', 96],
+    ['fc00::', 7],
+    ['fe80::', 10],
+    ['ff00::', 8],
+    ['2001:db8::', 32],
+]) {
+    BLOCKED_IPV6.addSubnet(network, prefix, 'ipv6');
+}
+/** Whether an address is a public unicast address a Cloud probe may contact. */
+function isPublicIpAddress(address) {
+    const normalized = normalizeMappedIpv4(address);
+    const family = (0, node_net_1.isIP)(normalized);
+    if (family === 4) {
+        return !BLOCKED_IPV4.check(normalized, 'ipv4');
+    }
+    if (family === 6) {
+        return !BLOCKED_IPV6.check(normalized, 'ipv6');
+    }
+    return false;
+}
+function normalizeMappedIpv4(address) {
+    const match = /^::ffff:(\d{1,3}(?:\.\d{1,3}){3})$/iu.exec(address);
+    return match ? match[1] : address;
+}
+/** Resolves every address of a probe hostname; injected in tests. */
+async function resolveHostAddresses(hostname) {
+    const records = await node_dns_1.default.promises.lookup(hostname, { all: true });
+    return records.map((record) => record.address);
+}
+/**
+ * Decides whether a probe target may be contacted.
+ *
+ * Every resolved address has to be public, so a hostname that mixes public and private
+ * records is refused instead of racing whichever record the connection picks.
+ */
+async function assertPublicProbeTarget(url, resolveAddresses = resolveHostAddresses) {
+    if (url.protocol !== 'http:' && url.protocol !== 'https:') {
+        return { allowed: false, reason: `unsupported-scheme:${url.protocol}` };
+    }
+    const hostname = url.hostname.replace(/^\[/u, '').replace(/\]$/u, '');
+    if ((0, node_net_1.isIP)(hostname) !== 0) {
+        return isPublicIpAddress(hostname)
+            ? { allowed: true, address: hostname }
+            : { allowed: false, reason: `non-public-address:${hostname}` };
+    }
+    let addresses;
+    try {
+        addresses = await resolveAddresses(hostname);
+    }
+    catch (error) {
+        return { allowed: false, reason: `unresolvable:${error.message}` };
+    }
+    if (addresses.length === 0) {
+        return { allowed: false, reason: 'unresolvable' };
+    }
+    const blocked = addresses.find((address) => !isPublicIpAddress(address));
+    if (blocked) {
+        return { allowed: false, reason: `non-public-address:${blocked}` };
+    }
+    return { allowed: true, address: addresses[0] };
+}
+/**
+ * HEAD request pinned to a validated address.
+ *
+ * Pinning is what makes the DNS check meaningful: without it the client would resolve the
+ * hostname a second time and a rebinding answer could still reach a private address.
+ */
+function createPinnedHeadProbeRequest() {
+    return (url, { address, timeoutMs }) => new Promise((resolve, reject) => {
+        const transport = url.protocol === 'https:' ? node_https_1.default : node_http_1.default;
+        const request = transport.request({
+            protocol: url.protocol,
+            hostname: url.hostname,
+            port: url.port || (url.protocol === 'https:' ? 443 : 80),
+            path: `${url.pathname}${url.search}`,
+            method: 'HEAD',
+            timeout: timeoutMs,
+            lookup: (_hostname, options, callback) => {
+                const entry = { address, family: (0, node_net_1.isIP)(address) === 6 ? 6 : 4 };
+                // Node asks for every family when happy-eyeballs is enabled.
+                if (options && typeof options === 'object' && options.all) {
+                    callback(null, [entry]);
+                    return;
+                }
+                callback(null, entry.address, entry.family);
+            },
+        }, (response) => {
+            response.resume();
+            resolve({
+                status: response.statusCode ?? 0,
+                location: typeof response.headers.location === 'string' ? response.headers.location : undefined,
+            });
+        });
+        request.on('timeout', () => request.destroy(new Error('probe-timeout')));
+        request.on('error', reject);
+        request.end();
+    });
+}
+//# sourceMappingURL=ProbeTargetGuard.js.map

package/dist/edge/reachability/NodeAccessResolver.d.ts

@@ -0,0 +1,16 @@
+import type { PodLookupRepository } from '../../identity/drizzle/PodLookupRepository';
+/**
+ * Whether a Solid principal may act on an edge node.
+ *
+ * Reachability sessions expose a node's private candidates, so "is authenticated" is not
+ * enough: the caller has to be related to that node (Pod ownership, or an explicit grant
+ * once one exists).
+ */
+export type NodeAccessResolver = (nodeId: string, webId: string) => Promise<boolean>;
+/**
+ * Authorizes a WebID for a node when one of the node's Pods is owned by that WebID.
+ *
+ * A missing repository resolves to "no access" rather than "no restriction": the caller
+ * decides what to do with an unprovable relationship, and the reachability handler denies.
+ */
+export declare function createPodOwnershipNodeAccessResolver(podLookupRepository: Pick<PodLookupRepository, 'listAllPods'> | undefined): NodeAccessResolver;

package/dist/edge/reachability/NodeAccessResolver.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createPodOwnershipNodeAccessResolver = createPodOwnershipNodeAccessResolver;
+const global_logger_factory_1 = require("global-logger-factory");
+/**
+ * Authorizes a WebID for a node when one of the node's Pods is owned by that WebID.
+ *
+ * A missing repository resolves to "no access" rather than "no restriction": the caller
+ * decides what to do with an unprovable relationship, and the reachability handler denies.
+ */
+function createPodOwnershipNodeAccessResolver(podLookupRepository) {
+    const logger = (0, global_logger_factory_1.getLoggerFor)('NodeAccessResolver');
+    return async (nodeId, webId) => {
+        if (!podLookupRepository) {
+            return false;
+        }
+        try {
+            const pods = await podLookupRepository.listAllPods();
+            return pods.some((pod) => {
+                const hosted = pod.nodeId === nodeId || pod.edgeNodeId === nodeId;
+                return hosted && (pod.webId === webId || (pod.webIds ?? []).includes(webId));
+            });
+        }
+        catch (error) {
+            logger.warn(`Failed to resolve node access for ${nodeId}/${webId}: ${error.message}`);
+            return false;
+        }
+    };
+}
+//# sourceMappingURL=NodeAccessResolver.js.map

package/dist/index.d.ts

@@ -51,6 +51,8 @@ import { SimpleEdgeNodeTunnelManager, NoopEdgeNodeTunnelManager } from './edge/E
 import { FrpTunnelManager } from './edge/FrpTunnelManager';
 import { AcmeCertificateManager } from './edge/acme/AcmeCertificateManager';
 import { EdgeNodeHealthProbeService } from './edge/EdgeNodeHealthProbeService';
+import { assertPublicProbeTarget, createPinnedHeadProbeRequest, isPublicIpAddress } from './edge/ProbeTargetGuard';
+import { createPodOwnershipNodeAccessResolver } from './edge/reachability/NodeAccessResolver';
 import { EdgeNodeAgent } from './edge/EdgeNodeAgent';
 import { EdgeNodeAgentInitializer } from './edge/EdgeNodeAgentInitializer';
 import { EdgeNodeCertificateService } from './service/EdgeNodeCertificateService';
@@ -125,6 +127,6 @@ export type { OwnedWebIdEntry, PodOwnershipResolver, PodOwnershipTarget, CssPodO
 export type { TunnelProvider, TunnelConfig, TunnelSetupOptions, TunnelStatus, } from './tunnel/TunnelProvider';
 export type { SubdomainRegistration, ConnectivityResult, SubdomainServiceOptions, } from './subdomain/SubdomainService';
 export { AppStaticAssetHandler } from './http/AppStaticAssetHandler';
-export { RepresentationPartialConvertingStore, MinioDataAccessor, SolidRdfDataAccessor, MixDataAccessor, ConfigurableLoggerFactory, resolveLogFilePattern, resolveCurrentLogFile, LOG_FILE_PATTERN, SparqlUpdateResourceStore, SubgraphQueryEngine, SubgraphSparqlHttpHandler, InternalPodDataHttpHandler, QuotaAdminHttpHandler, ClusterIngressRouter, ClusterWebSocketConfigurator, EdgeNodeDirectDebugHttpHandler, EdgeNodeProxyHttpHandler, RouterHttpHandler, RouterHttpRoute, TracingHandler, EdgeNodeCertificateHttpHandler, TerminalHttpHandler, DeviceNotificationHub, DeviceNotificationResourceListener, DeviceNotificationWebSocketServer, DeviceNotificationTicketHandler, registerDeviceNotificationRuntime, ReservedSuffixIdentifierGenerator, DrizzleIndexedStorage, LoginMethodGuardStorage, ValidatingIdentityProviderHttpHandler, PostgresKeyValueStorage, RedisKeyValueStorage, SqliteKeyValueStorage, BaseKeyValueStorage, DrizzleQuotaService, NoopQuotaService, HttpEntitlementProvider, NoopEntitlementProvider, PerAccountQuotaStrategy, TencentDnsProvider, EdgeNodeDnsCoordinator, Dns01CertificateProvisioner, SimpleEdgeNodeTunnelManager, NoopEdgeNodeTunnelManager, FrpTunnelManager, EdgeNodeHealthProbeService, EdgeNodeAgent, EdgeNodeAgentInitializer, EdgeNodeCertificateService, AcmeCertificateManager, EdgeNodeModeDetector, ClusterIdentifierStrategy, UsageTrackingStore, CenterNodeRegistrationService, PodRoutingHttpHandler, ReactAppViewHandler, QuintStore, SqliteQuintStore, PgQuintStore, RdfTermDictionary, RdfQuadIndex, Rdf3xIndex, RdfTextIndex, RdfVectorIndex, PostgresRdfTextIndex, PostgresRdfVectorIndex, SolidRdfEngine, LocalQleverNativeSparqlClient, QleverSparqlEngine, RdfQuerySparqlEngine, PostgresRdfEngine, VectorStore, SqliteVectorStore, PostgresVectorStore, VectorHttpHandler, ProviderRegistry, ProviderRegistryImpl, EmbeddingService, EmbeddingServiceImpl, CredentialReader, CredentialReaderImpl, CloudflareTunnelProvider, LocalTunnelProvider, NgrokTunnelProvider, SubdomainService, MultiDomainIdentifierStrategy, SubdomainPodIdentifierStrategy, DisabledOidcHandler, DisabledIdentityProviderHandler, AutoDetectOidcHandler, AutoDetectIdentityProviderHandler, LoopbackClientIdAdapterFactory, RememberedClientGrantStore, RememberedConsentHandler, RememberedClientPromptFactory, SessionBoundIdentityProviderFactory, ScopedPickWebIdHandler, ConfiguredLoopbackDPoPWebIdExtractor, AccountStorageBindingsHandler, CssPodOwnershipResolver, UrlAwareRedisLocker, ProvisionPodCreator, ProvisionPodStore, ProvisionCodeCodec, LocalPodProvisioningService, SqliteSolidFsSyncJournal, RootedSolidFsSyncJournal, LocalRdfAuthorityRecoveryInitializer, ObservableResourceStore, RdfSearchReconciliationIntentSink, };
+export { RepresentationPartialConvertingStore, MinioDataAccessor, SolidRdfDataAccessor, MixDataAccessor, ConfigurableLoggerFactory, resolveLogFilePattern, resolveCurrentLogFile, LOG_FILE_PATTERN, SparqlUpdateResourceStore, SubgraphQueryEngine, SubgraphSparqlHttpHandler, InternalPodDataHttpHandler, QuotaAdminHttpHandler, ClusterIngressRouter, ClusterWebSocketConfigurator, EdgeNodeDirectDebugHttpHandler, EdgeNodeProxyHttpHandler, RouterHttpHandler, RouterHttpRoute, TracingHandler, EdgeNodeCertificateHttpHandler, TerminalHttpHandler, DeviceNotificationHub, DeviceNotificationResourceListener, DeviceNotificationWebSocketServer, DeviceNotificationTicketHandler, registerDeviceNotificationRuntime, ReservedSuffixIdentifierGenerator, DrizzleIndexedStorage, LoginMethodGuardStorage, ValidatingIdentityProviderHttpHandler, PostgresKeyValueStorage, RedisKeyValueStorage, SqliteKeyValueStorage, BaseKeyValueStorage, DrizzleQuotaService, NoopQuotaService, HttpEntitlementProvider, NoopEntitlementProvider, PerAccountQuotaStrategy, TencentDnsProvider, EdgeNodeDnsCoordinator, Dns01CertificateProvisioner, SimpleEdgeNodeTunnelManager, NoopEdgeNodeTunnelManager, FrpTunnelManager, EdgeNodeHealthProbeService, assertPublicProbeTarget, createPinnedHeadProbeRequest, isPublicIpAddress, createPodOwnershipNodeAccessResolver, EdgeNodeAgent, EdgeNodeAgentInitializer, EdgeNodeCertificateService, AcmeCertificateManager, EdgeNodeModeDetector, ClusterIdentifierStrategy, UsageTrackingStore, CenterNodeRegistrationService, PodRoutingHttpHandler, ReactAppViewHandler, QuintStore, SqliteQuintStore, PgQuintStore, RdfTermDictionary, RdfQuadIndex, Rdf3xIndex, RdfTextIndex, RdfVectorIndex, PostgresRdfTextIndex, PostgresRdfVectorIndex, SolidRdfEngine, LocalQleverNativeSparqlClient, QleverSparqlEngine, RdfQuerySparqlEngine, PostgresRdfEngine, VectorStore, SqliteVectorStore, PostgresVectorStore, VectorHttpHandler, ProviderRegistry, ProviderRegistryImpl, EmbeddingService, EmbeddingServiceImpl, CredentialReader, CredentialReaderImpl, CloudflareTunnelProvider, LocalTunnelProvider, NgrokTunnelProvider, SubdomainService, MultiDomainIdentifierStrategy, SubdomainPodIdentifierStrategy, DisabledOidcHandler, DisabledIdentityProviderHandler, AutoDetectOidcHandler, AutoDetectIdentityProviderHandler, LoopbackClientIdAdapterFactory, RememberedClientGrantStore, RememberedConsentHandler, RememberedClientPromptFactory, SessionBoundIdentityProviderFactory, ScopedPickWebIdHandler, ConfiguredLoopbackDPoPWebIdExtractor, AccountStorageBindingsHandler, CssPodOwnershipResolver, UrlAwareRedisLocker, ProvisionPodCreator, ProvisionPodStore, ProvisionCodeCodec, LocalPodProvisioningService, SqliteSolidFsSyncJournal, RootedSolidFsSyncJournal, LocalRdfAuthorityRecoveryInitializer, ObservableResourceStore, RdfSearchReconciliationIntentSink, };
 export type { ResourceChangeEvent, ResourceChangeListener, ResourceChangeRecorder, } from './storage/ObservableResourceStore';
 export { RdfHandlebarsTemplateEngine } from './util/templates/RdfHandlebarsTemplateEngine';

package/dist/index.js

@@ -14,9 +14,9 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.EdgeNodeAgentInitializer = exports.EdgeNodeAgent = exports.EdgeNodeHealthProbeService = exports.FrpTunnelManager = exports.NoopEdgeNodeTunnelManager = exports.SimpleEdgeNodeTunnelManager = exports.Dns01CertificateProvisioner = exports.EdgeNodeDnsCoordinator = exports.TencentDnsProvider = exports.PerAccountQuotaStrategy = exports.NoopEntitlementProvider = exports.HttpEntitlementProvider = exports.NoopQuotaService = exports.DrizzleQuotaService = exports.BaseKeyValueStorage = exports.SqliteKeyValueStorage = exports.RedisKeyValueStorage = exports.PostgresKeyValueStorage = exports.ValidatingIdentityProviderHttpHandler = exports.LoginMethodGuardStorage = exports.DrizzleIndexedStorage = exports.ReservedSuffixIdentifierGenerator = exports.registerDeviceNotificationRuntime = exports.DeviceNotificationTicketHandler = exports.DeviceNotificationWebSocketServer = exports.DeviceNotificationResourceListener = exports.DeviceNotificationHub = exports.TerminalHttpHandler = exports.EdgeNodeCertificateHttpHandler = exports.TracingHandler = exports.RouterHttpRoute = exports.RouterHttpHandler = exports.EdgeNodeProxyHttpHandler = exports.EdgeNodeDirectDebugHttpHandler = exports.ClusterWebSocketConfigurator = exports.ClusterIngressRouter = exports.QuotaAdminHttpHandler = exports.InternalPodDataHttpHandler = exports.SubgraphSparqlHttpHandler = exports.SubgraphQueryEngine = exports.SparqlUpdateResourceStore = exports.LOG_FILE_PATTERN = exports.resolveCurrentLogFile = exports.resolveLogFilePattern = exports.ConfigurableLoggerFactory = exports.MixDataAccessor = exports.SolidRdfDataAccessor = exports.MinioDataAccessor = exports.RepresentationPartialConvertingStore = exports.AppStaticAssetHandler = void 0;
-exports.ConfiguredLoopbackDPoPWebIdExtractor = exports.ScopedPickWebIdHandler = exports.SessionBoundIdentityProviderFactory = exports.RememberedClientPromptFactory = exports.RememberedConsentHandler = exports.RememberedClientGrantStore = exports.LoopbackClientIdAdapterFactory = exports.AutoDetectIdentityProviderHandler = exports.AutoDetectOidcHandler = exports.DisabledIdentityProviderHandler = exports.DisabledOidcHandler = exports.SubdomainPodIdentifierStrategy = exports.MultiDomainIdentifierStrategy = exports.SubdomainService = exports.NgrokTunnelProvider = exports.LocalTunnelProvider = exports.CloudflareTunnelProvider = exports.CredentialReaderImpl = exports.CredentialReader = exports.EmbeddingServiceImpl = exports.EmbeddingService = exports.ProviderRegistryImpl = exports.ProviderRegistry = exports.VectorHttpHandler = exports.PostgresVectorStore = exports.SqliteVectorStore = exports.VectorStore = exports.PostgresRdfEngine = exports.RdfQuerySparqlEngine = exports.QleverSparqlEngine = exports.LocalQleverNativeSparqlClient = exports.SolidRdfEngine = exports.PostgresRdfVectorIndex = exports.PostgresRdfTextIndex = exports.RdfVectorIndex = exports.RdfTextIndex = exports.Rdf3xIndex = exports.RdfQuadIndex = exports.RdfTermDictionary = exports.PgQuintStore = exports.SqliteQuintStore = exports.QuintStore = exports.ReactAppViewHandler = exports.PodRoutingHttpHandler = exports.CenterNodeRegistrationService = exports.UsageTrackingStore = exports.ClusterIdentifierStrategy = exports.EdgeNodeModeDetector = exports.AcmeCertificateManager = exports.EdgeNodeCertificateService = void 0;
-exports.RdfHandlebarsTemplateEngine = exports.RdfSearchReconciliationIntentSink = exports.ObservableResourceStore = exports.LocalRdfAuthorityRecoveryInitializer = exports.RootedSolidFsSyncJournal = exports.SqliteSolidFsSyncJournal = exports.LocalPodProvisioningService = exports.ProvisionCodeCodec = exports.ProvisionPodStore = exports.ProvisionPodCreator = exports.UrlAwareRedisLocker = exports.CssPodOwnershipResolver = exports.AccountStorageBindingsHandler = void 0;
+exports.createPinnedHeadProbeRequest = exports.assertPublicProbeTarget = exports.EdgeNodeHealthProbeService = exports.FrpTunnelManager = exports.NoopEdgeNodeTunnelManager = exports.SimpleEdgeNodeTunnelManager = exports.Dns01CertificateProvisioner = exports.EdgeNodeDnsCoordinator = exports.TencentDnsProvider = exports.PerAccountQuotaStrategy = exports.NoopEntitlementProvider = exports.HttpEntitlementProvider = exports.NoopQuotaService = exports.DrizzleQuotaService = exports.BaseKeyValueStorage = exports.SqliteKeyValueStorage = exports.RedisKeyValueStorage = exports.PostgresKeyValueStorage = exports.ValidatingIdentityProviderHttpHandler = exports.LoginMethodGuardStorage = exports.DrizzleIndexedStorage = exports.ReservedSuffixIdentifierGenerator = exports.registerDeviceNotificationRuntime = exports.DeviceNotificationTicketHandler = exports.DeviceNotificationWebSocketServer = exports.DeviceNotificationResourceListener = exports.DeviceNotificationHub = exports.TerminalHttpHandler = exports.EdgeNodeCertificateHttpHandler = exports.TracingHandler = exports.RouterHttpRoute = exports.RouterHttpHandler = exports.EdgeNodeProxyHttpHandler = exports.EdgeNodeDirectDebugHttpHandler = exports.ClusterWebSocketConfigurator = exports.ClusterIngressRouter = exports.QuotaAdminHttpHandler = exports.InternalPodDataHttpHandler = exports.SubgraphSparqlHttpHandler = exports.SubgraphQueryEngine = exports.SparqlUpdateResourceStore = exports.LOG_FILE_PATTERN = exports.resolveCurrentLogFile = exports.resolveLogFilePattern = exports.ConfigurableLoggerFactory = exports.MixDataAccessor = exports.SolidRdfDataAccessor = exports.MinioDataAccessor = exports.RepresentationPartialConvertingStore = exports.AppStaticAssetHandler = void 0;
+exports.RememberedConsentHandler = exports.RememberedClientGrantStore = exports.LoopbackClientIdAdapterFactory = exports.AutoDetectIdentityProviderHandler = exports.AutoDetectOidcHandler = exports.DisabledIdentityProviderHandler = exports.DisabledOidcHandler = exports.SubdomainPodIdentifierStrategy = exports.MultiDomainIdentifierStrategy = exports.SubdomainService = exports.NgrokTunnelProvider = exports.LocalTunnelProvider = exports.CloudflareTunnelProvider = exports.CredentialReaderImpl = exports.CredentialReader = exports.EmbeddingServiceImpl = exports.EmbeddingService = exports.ProviderRegistryImpl = exports.ProviderRegistry = exports.VectorHttpHandler = exports.PostgresVectorStore = exports.SqliteVectorStore = exports.VectorStore = exports.PostgresRdfEngine = exports.RdfQuerySparqlEngine = exports.QleverSparqlEngine = exports.LocalQleverNativeSparqlClient = exports.SolidRdfEngine = exports.PostgresRdfVectorIndex = exports.PostgresRdfTextIndex = exports.RdfVectorIndex = exports.RdfTextIndex = exports.Rdf3xIndex = exports.RdfQuadIndex = exports.RdfTermDictionary = exports.PgQuintStore = exports.SqliteQuintStore = exports.QuintStore = exports.ReactAppViewHandler = exports.PodRoutingHttpHandler = exports.CenterNodeRegistrationService = exports.UsageTrackingStore = exports.ClusterIdentifierStrategy = exports.EdgeNodeModeDetector = exports.AcmeCertificateManager = exports.EdgeNodeCertificateService = exports.EdgeNodeAgentInitializer = exports.EdgeNodeAgent = exports.createPodOwnershipNodeAccessResolver = exports.isPublicIpAddress = void 0;
+exports.RdfHandlebarsTemplateEngine = exports.RdfSearchReconciliationIntentSink = exports.ObservableResourceStore = exports.LocalRdfAuthorityRecoveryInitializer = exports.RootedSolidFsSyncJournal = exports.SqliteSolidFsSyncJournal = exports.LocalPodProvisioningService = exports.ProvisionCodeCodec = exports.ProvisionPodStore = exports.ProvisionPodCreator = exports.UrlAwareRedisLocker = exports.CssPodOwnershipResolver = exports.AccountStorageBindingsHandler = exports.ConfiguredLoopbackDPoPWebIdExtractor = exports.ScopedPickWebIdHandler = exports.SessionBoundIdentityProviderFactory = exports.RememberedClientPromptFactory = void 0;
 require("./runtime/configure-drizzle-solid");
 const RepresentationPartialConvertingStore_1 = require("./storage/RepresentationPartialConvertingStore");
 Object.defineProperty(exports, "RepresentationPartialConvertingStore", { enumerable: true, get: function () { return RepresentationPartialConvertingStore_1.RepresentationPartialConvertingStore; } });
@@ -111,6 +111,12 @@ const AcmeCertificateManager_1 = require("./edge/acme/AcmeCertificateManager");
 Object.defineProperty(exports, "AcmeCertificateManager", { enumerable: true, get: function () { return AcmeCertificateManager_1.AcmeCertificateManager; } });
 const EdgeNodeHealthProbeService_1 = require("./edge/EdgeNodeHealthProbeService");
 Object.defineProperty(exports, "EdgeNodeHealthProbeService", { enumerable: true, get: function () { return EdgeNodeHealthProbeService_1.EdgeNodeHealthProbeService; } });
+const ProbeTargetGuard_1 = require("./edge/ProbeTargetGuard");
+Object.defineProperty(exports, "assertPublicProbeTarget", { enumerable: true, get: function () { return ProbeTargetGuard_1.assertPublicProbeTarget; } });
+Object.defineProperty(exports, "createPinnedHeadProbeRequest", { enumerable: true, get: function () { return ProbeTargetGuard_1.createPinnedHeadProbeRequest; } });
+Object.defineProperty(exports, "isPublicIpAddress", { enumerable: true, get: function () { return ProbeTargetGuard_1.isPublicIpAddress; } });
+const NodeAccessResolver_1 = require("./edge/reachability/NodeAccessResolver");
+Object.defineProperty(exports, "createPodOwnershipNodeAccessResolver", { enumerable: true, get: function () { return NodeAccessResolver_1.createPodOwnershipNodeAccessResolver; } });
 const EdgeNodeAgent_1 = require("./edge/EdgeNodeAgent");
 Object.defineProperty(exports, "EdgeNodeAgent", { enumerable: true, get: function () { return EdgeNodeAgent_1.EdgeNodeAgent; } });
 const EdgeNodeAgentInitializer_1 = require("./edge/EdgeNodeAgentInitializer");

package/dist/main.js

@@ -213,6 +213,11 @@ async function startRuntime(options) {
     (0, runtime_1.validateBaseUrl)({ baseUrl, mainPort, explicit: explicitBaseUrl !== undefined });
     const cssPort = await (0, runtime_1.getFreePortForWildcard)(mainPort + 1);
     const apiPort = await (0, runtime_1.getFreePortForWildcard)(cssPort + 1);
+    // Remote forwarding (managed tunnels, P2P data plane) terminates on this machine, so
+    // its origin is a dedicated ingress port instead of the gateway port: the Gateway
+    // never treats requests accepted there as local. It is an internal loopback detail, so
+    // the OS assigns the port instead of us claiming a neighbour of the planned ports.
+    const ingressPort = await (0, runtime_1.getEphemeralLoopbackPort)();
     const runtimeRoot = path_1.default.join(process.cwd(), '.xpod/runtime/legacy-css');
     const rdfIndexPath = process.env.CSS_RDF_INDEX_PATH || (0, database_url_1.resolveDefaultRdfIndexPath)({
         sparqlEndpoint: process.env.CSS_SPARQL_ENDPOINT ?? process.env.SPARQL_ENDPOINT,
@@ -268,6 +273,7 @@ async function startRuntime(options) {
             apiPort,
             mainPort,
             cssPort,
+            ingressPort,
             baseUrl,
             rdfIndexPath,
             authMode,
@@ -296,6 +302,7 @@ async function startRuntime(options) {
         exitOnStop: true,
         baseUrl,
         internalAdminAuthSecret: gatewayAdminProxyAuthSecret,
+        ingressPort,
     });
     proxy.setTargets({
         css: `http://localhost:${cssPort}`,