@undefineds.co/xpod 0.4.13 → 0.4.15

package/dist/api/chatkit/pod-store.js

@@ -22,6 +22,7 @@ const store_1 = require("../runs/store");
 const schema_3 = require("../tasks/schema");
 const store_2 = require("../tasks/store");
 const TaskAuthBinding_1 = require("../tasks/TaskAuthBinding");
+const OwnerPodAccess_1 = require("../ai-gateway/pod/OwnerPodAccess");
 const AuthContext_1 = require("../auth/AuthContext");
 const provider_1 = require("../../ai/schema/provider");
 const model_1 = require("../../ai/schema/model");
@@ -60,7 +61,7 @@ class PodChatKitStore {
         this.logger = (0, global_logger_factory_1.getLoggerFor)(this);
         // Track recently created message IDs to avoid SELECT cache timing issues
         this.recentlyCreatedIds = new Set();
-        this.tokenEndpoint = options.tokenEndpoint;
+        this.podAccess = options.podAccess;
         this.credentialSecretDecoder = options.credentialSecretDecoder ?? AiCredentialSecret_1.defaultAiCredentialSecretDecoder;
         this.deployment = options.deployment;
         this.serverGroupReconcilerService = options.serverGroupReconcilerService;
@@ -92,110 +93,38 @@ class PodChatKitStore {
             return context._cachedDb;
         }
         const auth = context.auth;
-        if (!auth || !(0, AuthContext_1.isSolidAuth)(auth)) {
+        if (!auth || !(0, AuthContext_1.isSolidAuth)(auth) || !auth.webId) {
             this.logger.warn('No valid solid auth in context, cannot access Pod');
             return null;
         }
-        // Preferred path: directly use caller's Solid access token.
-        if (auth.accessToken && auth.webId) {
-            try {
-                if (auth.tokenType === 'DPoP') {
-                    this.logger.warn('Using DPoP access token without proof key; Pod access may fail if issuer enforces DPoP proof');
-                }
-                this.logger.info(`[getDb] Using access token path for webId: ${auth.webId}`);
-                const authFetch = this.createAccessTokenFetch(auth.accessToken, auth.tokenType);
-                const db = (0, drizzle_solid_1.drizzle)({ fetch: authFetch, info: { webId: auth.webId, isLoggedIn: true } }, { schema });
-                this.logger.info(`Initializing tables for Pod (access token): ${auth.webId}`);
-                try {
-                    await db.init(schema_1.Chat, schema_1.Thread, schema_1.Message, schema_2.Run, schema_2.RunStep, schema_3.Task, config_1.AIConfig, tables_1.Credential);
-                    this.logger.info('Tables initialized successfully');
-                }
-                catch (initError) {
-                    this.logger.error(`Failed to init tables: ${initError}`);
-                }
-                context._cachedDb = db;
-                context._cachedFetch = authFetch;
-                context._cachedWebId = auth.webId;
-                this.ensurePodBaseUrlCache(context, db, auth.webId);
-                return db;
-            }
-            catch (error) {
-                this.logger.error(`Failed to get Pod db with access token: ${error}`);
-                return null;
-            }
-        }
-        if (!auth.clientId || !auth.clientSecret) {
-            this.logger.warn('No accessToken and no valid client credentials in context, cannot access Pod');
-            return null;
-        }
-        // Fallback path: exchange client credentials for an access token directly.
-        this.logger.info(`[getDb] Using client credentials path for clientId: ${auth.clientId}`);
+        // One credential path for every caller: the owner's own Pod key, exchanged for a
+        // token this process can prove, or the caller's reusable token.
+        let podFetch;
         try {
-            const token = await this.getClientCredentialsAccessToken(auth.clientId, auth.clientSecret);
-            const webId = auth.webId ?? this.getWebId(context);
-            if (!webId) {
-                throw new Error('Missing webId for client credentials auth');
-            }
-            this.logger.info(`[getDb] Client credentials token acquired, webId: ${webId}`);
-            const db = (0, drizzle_solid_1.drizzle)({ fetch: this.createAccessTokenFetch(token.accessToken, token.tokenType), info: { webId, isLoggedIn: true } }, { schema });
-            const authFetch = this.createAccessTokenFetch(token.accessToken, token.tokenType);
-            this.logger.info(`Initializing tables for Pod: ${webId}`);
-            try {
-                await db.init(schema_1.Chat, schema_1.Thread, schema_1.Message, schema_2.Run, schema_2.RunStep, schema_3.Task, config_1.AIConfig, tables_1.Credential);
-                this.logger.info('Tables initialized successfully');
-            }
-            catch (initError) {
-                this.logger.error(`Failed to init tables: ${initError}`);
-            }
-            context._cachedDb = db;
-            context._cachedFetch = authFetch;
-            context._cachedWebId = webId;
-            this.ensurePodBaseUrlCache(context, db, webId);
-            context._cachedAccessToken = token.accessToken;
-            context._cachedTokenType = token.tokenType;
-            return db;
+            podFetch = await this.podAccess?.getPodFetch(auth.webId, { auth });
         }
         catch (error) {
-            this.logger.error(`Failed to get Pod db: ${error}`);
+            this.logger.error(`Failed to obtain Pod access for ${auth.webId}: ${error}`);
             return null;
         }
-    }
-    async getClientCredentialsAccessToken(clientId, clientSecret) {
-        const response = await fetch(this.tokenEndpoint, {
-            method: 'POST',
-            headers: {
-                'Content-Type': 'application/x-www-form-urlencoded',
-            },
-            body: new URLSearchParams({
-                grant_type: 'client_credentials',
-                client_id: clientId,
-                client_secret: clientSecret,
-            }),
-        });
-        if (!response.ok) {
-            throw new Error(`Client credentials token request failed: ${response.status} ${await response.text().catch(() => '')}`);
+        if (!podFetch) {
+            this.logger.warn(`No usable Pod credential for ${auth.webId}: ${(0, OwnerPodAccess_1.podAccessError)(auth.webId, auth)}`);
+            return null;
         }
-        const token = await response.json();
-        if (!token.access_token) {
-            throw new Error(`Client credentials token response missing access_token: ${JSON.stringify(token)}`);
+        const db = (0, drizzle_solid_1.drizzle)({ fetch: podFetch, info: { webId: auth.webId, isLoggedIn: true } }, { schema });
+        this.logger.info(`Initializing tables for Pod: ${auth.webId}`);
+        try {
+            await db.init(schema_1.Chat, schema_1.Thread, schema_1.Message, schema_2.Run, schema_2.RunStep, schema_3.Task, config_1.AIConfig, tables_1.Credential);
+            this.logger.info('Tables initialized successfully');
         }
-        return {
-            accessToken: token.access_token,
-            tokenType: token.token_type?.toUpperCase() === 'DPOP' ? 'DPoP' : 'Bearer',
-        };
-    }
-    createAccessTokenFetch(accessToken, tokenType) {
-        const scheme = tokenType ?? 'Bearer';
-        return async (input, init) => {
-            const headers = new Headers(init?.headers);
-            if (!headers.has('Authorization')) {
-                headers.set('Authorization', `${scheme} ${accessToken}`);
-            }
-            return fetch(input, {
-                ...init,
-                headers,
-            });
-        };
+        catch (initError) {
+            this.logger.error(`Failed to init tables: ${initError}`);
+        }
+        context._cachedDb = db;
+        context._cachedFetch = podFetch;
+        context._cachedWebId = auth.webId;
+        this.ensurePodBaseUrlCache(context, db, auth.webId);
+        return db;
     }
     /**
      * 从 context 获取 webId

package/dist/api/container/common.js

@@ -27,7 +27,10 @@ const InvocationTokenCodec_1 = require("../ai-gateway/auth/InvocationTokenCodec"
 const GatewayApiKeyAuthenticator_1 = require("../ai-gateway/auth/GatewayApiKeyAuthenticator");
 const GatewayKeyLocatorCodec_1 = require("../ai-gateway/auth/GatewayKeyLocatorCodec");
 const PodGatewayAccessKeyRepository_1 = require("../ai-gateway/auth/PodGatewayAccessKeyRepository");
-const HostedPodDataAccess_1 = require("../ai-gateway/pod/HostedPodDataAccess");
+const OwnerPodAccess_1 = require("../ai-gateway/pod/OwnerPodAccess");
+const HostedPodRoute_1 = require("../ai-gateway/pod/HostedPodRoute");
+const PodInterfaceKeyRepository_1 = require("../../identity/drizzle/PodInterfaceKeyRepository");
+const PodInterfaceKeyStore_1 = require("../ai-gateway/pod/PodInterfaceKeyStore");
 const AiGatewayService_1 = require("../ai-gateway/AiGatewayService");
 const PlaintextCredentialVault_1 = require("../ai-gateway/credentials/PlaintextCredentialVault");
 const AiCredentialSecretDecoder_1 = require("../ai-gateway/credentials/AiCredentialSecretDecoder");
@@ -139,10 +142,21 @@ function registerCommonServices(container) {
                 scopes: ['quota:write', 'usage:read', 'account:manage', 'network:read', 'network:write'],
             });
         }).singleton(),
-        hostedPodDataAccess: (0, awilix_1.asFunction)(({ config }) => {
-            return new HostedPodDataAccess_1.HostedPodDataAccess({
-                cssBaseUrl: resolveHostedPodCssBaseUrl(),
-                gatewayAdminProxyAuthSecret: config.gatewayAdminProxyAuthSecret,
+        ownerPodAccess: (0, awilix_1.asFunction)(({ config, db }) => {
+            return new OwnerPodAccess_1.OwnerPodAccess({
+                keys: new PodInterfaceKeyStore_1.PodInterfaceKeyStore({
+                    repository: new PodInterfaceKeyRepository_1.PodInterfaceKeyRepository(db),
+                    vault: credentialVaultForConfig(config),
+                }),
+                tokenEndpoint: config.cssTokenEndpoint,
+                publicBaseUrl: config.solidBaseUrl,
+                route: (0, HostedPodRoute_1.resolveHostedPodRoute)({
+                    canonicalBaseUrl: config.solidBaseUrl,
+                    // API_HOST is the address the runtime bound its services to; XPOD_MAIN_PORT is the
+                    // Gateway's. Both are read here, while the runtime still has its environment applied.
+                    gatewayHost: process.env.API_HOST,
+                    gatewayPort: process.env.XPOD_MAIN_PORT,
+                }),
             });
         }).singleton(),
         invocationTokenCodec: (0, awilix_1.asFunction)(() => {
@@ -156,7 +170,7 @@ function registerCommonServices(container) {
             });
         }).singleton(),
         gatewayAccessKeyRepository: (0, awilix_1.asFunction)((cradle) => {
-            const { config, hostedPodDataAccess } = cradle;
+            const { config, ownerPodAccess } = cradle;
             return new PodGatewayAccessKeyRepository_1.PodGatewayAccessKeyRepository({
                 locatorCodec: new GatewayKeyLocatorCodec_1.AesGatewayKeyLocatorCodec({
                     active: {
@@ -165,7 +179,7 @@ function registerCommonServices(container) {
                     },
                     previous: config.gatewayPreviousLocatorSecrets,
                 }),
-                internalPodAccess: hostedPodDataAccess,
+                podAccess: ownerPodAccess,
                 podBaseUrlResolver: podBaseUrlResolver(cradle),
             });
         }).singleton(),
@@ -180,9 +194,8 @@ function registerCommonServices(container) {
         }).singleton(),
         providerConnectService: (0, awilix_1.asFunction)((cradle) => {
             const { config } = cradle;
-            const internalPodAccess = cradle.hostedPodDataAccess;
             const credentialRepository = new connect_1.PodConnectedCredentialRepository({
-                internalPodAccess,
+                podAccess: cradle.ownerPodAccess,
                 podBaseUrlResolver: podBaseUrlResolver(cradle),
             });
             const vault = credentialVaultForConfig(config);
@@ -253,24 +266,24 @@ function registerCommonServices(container) {
             systemProxy: config.edition === 'local' ? (0, provider_http_transport_1.discoverSystemProviderProxy)() : undefined,
         })).singleton(),
         gatewayCredentialStore: (0, awilix_1.asFunction)((cradle) => {
-            const { hostedPodDataAccess } = cradle;
+            const { ownerPodAccess } = cradle;
             return new connect_1.PodConnectedCredentialRepository({
-                internalPodAccess: hostedPodDataAccess,
+                podAccess: ownerPodAccess,
                 podBaseUrlResolver: podBaseUrlResolver(cradle),
             });
         }).singleton(),
         podModelSelectionRepository: (0, awilix_1.asFunction)((cradle) => {
-            const { hostedPodDataAccess } = cradle;
+            const { ownerPodAccess } = cradle;
             return new PodModelSelectionRepository_1.PodModelSelectionRepository({
-                internalPodAccess: hostedPodDataAccess,
+                podAccess: ownerPodAccess,
                 podBaseUrlResolver: podBaseUrlResolver(cradle),
             });
         }).singleton(),
         providerModelSelectionService: (0, awilix_1.asFunction)((cradle) => {
-            const { config, gatewayProviderRegistry, hostedPodDataAccess, podModelSelectionRepository, providerModelsService, } = cradle;
+            const { config, gatewayProviderRegistry, ownerPodAccess, podModelSelectionRepository, providerModelsService, } = cradle;
             return new ProviderModelSelectionService_1.ProviderModelSelectionService({
                 credentialRepository: new connect_1.PodConnectedCredentialRepository({
-                    internalPodAccess: hostedPodDataAccess,
+                    podAccess: ownerPodAccess,
                     podBaseUrlResolver: podBaseUrlResolver(cradle),
                 }),
                 selectionRepository: podModelSelectionRepository,
@@ -346,14 +359,14 @@ function registerCommonServices(container) {
         }).singleton(),
         providerQuotaService: (0, awilix_1.asFunction)((cradle) => {
             const { config } = cradle;
-            const internalPodAccess = cradle.hostedPodDataAccess;
+            const podAccess = cradle.ownerPodAccess;
             return new quota_1.ProviderQuotaService({
                 repository: new quota_1.PodQuotaSnapshotRepository({
-                    internalPodAccess,
+                    podAccess,
                     podBaseUrlResolver: podBaseUrlResolver(cradle),
                 }),
                 credentialRepository: new connect_1.PodConnectedCredentialRepository({
-                    internalPodAccess,
+                    podAccess,
                     podBaseUrlResolver: podBaseUrlResolver(cradle),
                 }),
                 vault: credentialVaultForConfig(config),
@@ -373,7 +386,7 @@ function registerCommonServices(container) {
         }).singleton(),
         providerModelsService: (0, awilix_1.asFunction)((cradle) => {
             const { config } = cradle;
-            const internalPodAccess = cradle.hostedPodDataAccess;
+            const podAccess = cradle.ownerPodAccess;
             const registry = cradle.gatewayProviderRegistry;
             const safeBaseUrls = (provider) => [
                 ...registry.requireProvider(provider).safeBaseUrls,
@@ -381,7 +394,7 @@ function registerCommonServices(container) {
             ];
             return new models_1.ProviderModelsService({
                 credentialRepository: new connect_1.PodConnectedCredentialRepository({
-                    internalPodAccess,
+                    podAccess,
                     podBaseUrlResolver: podBaseUrlResolver(cradle),
                 }),
                 vault: credentialVaultForConfig(config),
@@ -446,7 +459,7 @@ function registerCommonServices(container) {
         providerCustomModelsService: (0, awilix_1.asFunction)((cradle) => {
             return new models_1.ProviderCustomModelsService({
                 credentialRepository: new connect_1.PodConnectedCredentialRepository({
-                    internalPodAccess: cradle.hostedPodDataAccess,
+                    podAccess: cradle.ownerPodAccess,
                     podBaseUrlResolver: podBaseUrlResolver(cradle),
                 }),
                 embeddingModelPolicy: cradle.embeddingModelPolicy,
@@ -511,9 +524,9 @@ function registerCommonServices(container) {
             });
         }).singleton(),
         // ChatKit 存储与服务
-        chatKitStore: (0, awilix_1.asFunction)(({ config, serverGroupReconcilerService }) => {
+        chatKitStore: (0, awilix_1.asFunction)(({ config, ownerPodAccess, serverGroupReconcilerService }) => {
             return new chatkit_1.PodChatKitStore({
-                tokenEndpoint: config.cssTokenEndpoint,
+                podAccess: ownerPodAccess,
                 serverGroupReconcilerService,
                 deployment: config.edition,
                 credentialSecretDecoder: (0, AiCredentialSecretDecoder_1.createAiCredentialSecretDecoder)({

package/dist/api/container/index.js

@@ -232,6 +232,7 @@ function loadConfigFromEnv() {
         ngrokAuthToken: process.env.NGROK_AUTHTOKEN,
         ngrokUrl: process.env.NGROK_URL,
         ngrokPath: process.env.NGROK_BIN,
+        frpcPath: process.env.FRPC_BIN,
         // Edge 节点管理 (cloud 模式)
         edgeNodesEnabled: process.env.XPOD_EDGE_NODES_ENABLED === 'true',
     };

package/dist/api/container/local.js

@@ -10,11 +10,13 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.registerLocalServices = registerLocalServices;
 const awilix_1 = require("awilix");
 const SubdomainClient_1 = require("../../subdomain/SubdomainClient");
+const AutoTunnelProvider_1 = require("../../tunnel/AutoTunnelProvider");
 const LocalTunnelProvider_1 = require("../../tunnel/LocalTunnelProvider");
 const NgrokTunnelProvider_1 = require("../../tunnel/NgrokTunnelProvider");
 const SakuraFrpTunnelProvider_1 = require("../../tunnel/SakuraFrpTunnelProvider");
 const DEFAULT_CLOUD_API_ENDPOINT = 'https://api.undefineds.co';
 const CloudflareDnsProvider_1 = require("../../dns/cloudflare/CloudflareDnsProvider");
+const TencentDnsProvider_1 = require("../../dns/tencent/TencentDnsProvider");
 const SubdomainService_1 = require("../../subdomain/SubdomainService");
 const EdgeNodeDnsCoordinator_1 = require("../../edge/EdgeNodeDnsCoordinator");
 const EdgeNodeCapabilityDetector_1 = require("../../edge/EdgeNodeCapabilityDetector");
@@ -27,7 +29,7 @@ const PodLookupRepository_1 = require("../../identity/drizzle/PodLookupRepositor
  */
 function registerLocalServices(container) {
     const config = container.resolve('config');
-    const { cloudApiEndpoint, nodeId, nodeToken, cloudflareTunnelToken, sakuraTunnelToken, ngrokAuthToken, ngrokUrl, ngrokPath, subdomain: subdomainConfig, } = config;
+    const { cloudApiEndpoint, nodeId, nodeToken, cloudflareTunnelToken, sakuraTunnelToken, ngrokAuthToken, ngrokUrl, ngrokPath, frpcPath, subdomain: subdomainConfig, } = config;
     container.register({
         podLookupRepo: (0, awilix_1.asFunction)(({ db }) => {
             return new PodLookupRepository_1.PodLookupRepository(db);
@@ -42,47 +44,86 @@ function registerLocalServices(container) {
         ngrokUrl,
     });
     const activeTunnelProvider = activeTunnel.provider;
-    if (activeTunnelProvider === 'ngrok') {
-        container.register({
-            localTunnelProvider: (0, awilix_1.asFunction)(() => {
-                return new NgrokTunnelProvider_1.NgrokTunnelProvider({
-                    authtoken: ngrokAuthToken,
-                    url: activeTunnel.profile?.publicUrl ?? ngrokUrl,
-                    ngrokPath,
-                });
-            }).singleton(),
-        });
-        console.log('[Local] Tunnel provider registered (ngrok configured)');
-    }
-    else if (activeTunnelProvider === 'cloudflare') {
+    // The settings page stores one credential per profile; the provider-global env key is
+    // only the legacy fallback. Without this the profile's own secret never reached the
+    // provider and the tunnel could not start even though the profile looked configured.
+    const activeCredential = activeTunnel.profile?.credentialEnvKey
+        ? readCredential(process.env[activeTunnel.profile.credentialEnvKey])
+        : undefined;
+    // Every provider the operator has credentials for is a candidate; which one
+    // can reach its control plane is a property of the network, so an implicit
+    // selection is settled by readiness instead of by list order. An explicitly
+    // pinned profile or provider still starts exactly that one - including when it
+    // has no credential, because then its own failure is the answer the operator
+    // needs rather than a silently absent provider.
+    const profileFor = (provider) => (config.tunnelProfiles ?? []).find((entry) => entry.provider === provider);
+    const profileCredential = (provider) => {
+        const key = profileFor(provider)?.credentialEnvKey;
+        return key ? readCredential(process.env[key]) : undefined;
+    };
+    const credentialFor = (provider) => (activeTunnelProvider === provider ? activeCredential : undefined) ?? profileCredential(provider);
+    const candidates = [
+        {
+            id: 'ngrok',
+            provider: 'ngrok',
+            configured: Boolean(credentialFor('ngrok') ?? ngrokAuthToken ?? ngrokUrl),
+            create: () => new NgrokTunnelProvider_1.NgrokTunnelProvider({
+                authtoken: credentialFor('ngrok') ?? ngrokAuthToken,
+                url: profileFor('ngrok')?.publicUrl ?? ngrokUrl,
+                ngrokPath,
+            }),
+        },
+        {
+            id: 'cloudflare',
+            provider: 'cloudflare',
+            configured: Boolean(credentialFor('cloudflare') ?? cloudflareTunnelToken),
+            create: () => new LocalTunnelProvider_1.LocalTunnelProvider({
+                tunnelToken: (credentialFor('cloudflare') ?? cloudflareTunnelToken),
+                publicUrl: profileFor('cloudflare')?.publicUrl,
+            }),
+        },
+        {
+            id: 'sakura_frp',
+            provider: 'sakura_frp',
+            configured: Boolean(credentialFor('sakura_frp') ?? sakuraTunnelToken),
+            create: () => new SakuraFrpTunnelProvider_1.SakuraFrpTunnelProvider({
+                token: (credentialFor('sakura_frp') ?? sakuraTunnelToken),
+                publicUrl: profileFor('sakura_frp')?.publicUrl,
+                frpcPath,
+            }),
+        },
+    ];
+    const pinnedProvider = config.tunnelActiveProfileId || config.tunnelProvider || process.env.XPOD_TUNNEL_PROVIDER
+        ? activeTunnelProvider
+        : undefined;
+    const selected = pinnedProvider
+        ? candidates.filter((candidate) => candidate.provider === pinnedProvider)
+        : candidates.filter((candidate) => candidate.configured);
+    if (selected.length === 1) {
+        const [only] = selected;
         container.register({
-            localTunnelProvider: (0, awilix_1.asFunction)(() => {
-                return new LocalTunnelProvider_1.LocalTunnelProvider({
-                    tunnelToken: cloudflareTunnelToken,
-                    publicUrl: activeTunnel.profile?.publicUrl,
-                });
-            }).singleton(),
+            localTunnelProvider: (0, awilix_1.asFunction)(only.create).singleton(),
         });
-        console.log('[Local] Tunnel provider registered (CLOUDFLARE_TUNNEL_TOKEN configured)');
+        console.log(`[Local] Tunnel provider registered (${only.id} configured)`);
     }
-    else if (activeTunnelProvider === 'sakura_frp') {
+    else if (selected.length > 1) {
         container.register({
-            localTunnelProvider: (0, awilix_1.asFunction)(() => {
-                return new SakuraFrpTunnelProvider_1.SakuraFrpTunnelProvider({
-                    token: sakuraTunnelToken,
-                    publicUrl: activeTunnel.profile?.publicUrl,
-                });
-            }).singleton(),
+            localTunnelProvider: (0, awilix_1.asFunction)(() => new AutoTunnelProvider_1.AutoTunnelProvider({
+                candidates: selected.map((candidate) => ({
+                    id: candidate.id,
+                    provider: candidate.create(),
+                })),
+            })).singleton(),
         });
-        console.log('[Local] Tunnel provider registered (SAKURA_TUNNEL_TOKEN configured)');
+        console.log(`[Local] Tunnel providers registered (auto: ${selected.map((candidate) => candidate.id).join(', ')})`);
     }
     // 2. 自适应 DNS 管理 (Self-Hosted DNS)
     // 如果配置了 Cloudflare API Token 和 Base Domain，启用本地 DNS 管理
     const apiToken = subdomainConfig?.cloudflareApiToken;
     // 在 Local 模式下，强制使用 CSS_BASE_URL 作为域名来源
     // 简化用户配置心智
-    let baseDomain;
-    if (process.env.CSS_BASE_URL) {
+    let baseDomain = process.env.XPOD_DNS_DOMAIN?.trim() || undefined;
+    if (!baseDomain && process.env.CSS_BASE_URL) {
         try {
             const url = new URL(process.env.CSS_BASE_URL);
             baseDomain = url.hostname;
@@ -93,14 +134,20 @@ function registerLocalServices(container) {
     }
     // DEBUG: 打印变量状态
     console.log(`[Local] Debug: apiToken=${apiToken ? '***' : 'undefined'}, baseDomain=${baseDomain}, CSS_BASE_URL=${process.env.CSS_BASE_URL}`);
-    if (apiToken && baseDomain) {
-        console.log('[Local] Self-hosted DNS mode detected (IPv6 Ready)');
+    // The settings page lets an operator pick the DNS provider, so the runtime honours that
+    // choice instead of always wiring Cloudflare and ignoring a saved "tencent".
+    const dnsProviderId = process.env.XPOD_DNS_PROVIDER?.trim().toLowerCase() || 'cloudflare';
+    const tencentDnsToken = process.env.XPOD_TENCENT_DNS_TOKEN?.trim();
+    const tencentDnsTokenId = process.env.XPOD_TENCENT_DNS_TOKEN_ID?.trim();
+    const dnsCredentialReady = dnsProviderId === 'tencent' ? Boolean(tencentDnsToken) : Boolean(apiToken);
+    if (dnsCredentialReady && baseDomain) {
+        console.log(`[Local] Self-hosted DNS mode detected (provider: ${dnsProviderId})`);
         container.register({
-            // DNS Provider
+            // DNS Provider: one axis, the selected implementation.
             dnsProvider: (0, awilix_1.asFunction)(() => {
-                return new CloudflareDnsProvider_1.CloudflareDnsProvider({
-                    apiToken: apiToken,
-                });
+                return dnsProviderId === 'tencent'
+                    ? new TencentDnsProvider_1.TencentDnsProvider({ tokenId: tencentDnsTokenId, token: tencentDnsToken })
+                    : new CloudflareDnsProvider_1.CloudflareDnsProvider({ apiToken: apiToken });
             }).singleton(),
             // DNS Coordinator (DnsMaintainer)
             dnsCoordinator: (0, awilix_1.asFunction)(({ dnsProvider }) => {
@@ -230,6 +277,10 @@ function resolveActiveLocalTunnel(options) {
         }),
     };
 }
+/** A credential only counts when it actually carries a value. */
+function readCredential(value) {
+    return typeof value === 'string' && value.trim() ? value.trim() : undefined;
+}
 function resolveLocalTunnelProvider(options) {
     const explicit = options.explicit?.trim().toLowerCase();
     if (explicit) {

package/dist/api/container/routes.js

@@ -33,6 +33,8 @@ exports.resolveCloudSignalApiUrl = resolveCloudSignalApiUrl;
 exports.resolveLocalStorageProviderBaseUrl = resolveLocalStorageProviderBaseUrl;
 const EdgeNodeSignalHandler_1 = require("../handlers/EdgeNodeSignalHandler");
 const ReachabilityHandler_1 = require("../handlers/ReachabilityHandler");
+const NodeAccessResolver_1 = require("../../edge/reachability/NodeAccessResolver");
+const RouteSetBuilder_1 = require("../../edge/reachability/RouteSetBuilder");
 const NodeHandler_1 = require("../handlers/NodeHandler");
 const ChatHandler_1 = require("../handlers/ChatHandler");
 const SubdomainHandler_1 = require("../handlers/SubdomainHandler");
@@ -130,7 +132,7 @@ function registerSharedRoutes(container, server) {
     const rdfStorageStatsService = container.resolve('rdfStorageStatsService');
     const rdfEngine = container.resolve('rdfEngine', { allowUnregistered: true });
     const rdfSearchIndexingService = container.resolve('rdfSearchIndexingService', { allowUnregistered: true });
-    const hostedPodDataAccess = container.resolve('hostedPodDataAccess');
+    const ownerPodAccess = container.resolve('ownerPodAccess');
     const aiConnectionInvocationKeyIssuer = container.resolve('aiConnectionInvocationKeyIssuer');
     const gatewayAccessKeyRepository = container.resolve('gatewayAccessKeyRepository', { allowUnregistered: true });
     const providerConnectService = container.resolve('providerConnectService');
@@ -162,6 +164,7 @@ function registerSharedRoutes(container, server) {
         repository: nodeRepo,
         baseStorageDomain: config.subdomain?.baseStorageDomain,
         apiBaseUrl: config.cloudApiEndpoint ?? process.env.CSS_BASE_URL,
+        canAccessNode: (0, NodeAccessResolver_1.createPodOwnershipNodeAccessResolver)(podLookupRepository),
     });
     (0, NodeHandler_1.registerNodeRoutes)(server, { repository: nodeRepo });
     const aiGatewayService = container.resolve('aiGatewayService');
@@ -193,6 +196,7 @@ function registerSharedRoutes(container, server) {
         providerModelSelectionService,
         customModelsService: providerCustomModelsService,
         gatewayAccessKeyRepository,
+        podInterfaceKeys: ownerPodAccess,
         validateClientCredential: (apiKey) => container.resolve('authenticator').authenticate({
             headers: { authorization: `Bearer ${apiKey}` },
             method: 'POST',
@@ -212,15 +216,15 @@ function registerSharedRoutes(container, server) {
     (0, PodSettingsHandler_1.registerPodSettingsRoutes)(server, {
         podLookupRepository,
         usageRepo: new UsageRepository_1.UsageRepository(container.resolve('db')),
-        aiConnectionStatusReader: new PodSettingsHandler_1.DrizzlePodAiConnectionsStatusReader(hostedPodDataAccess, config.edition),
+        aiConnectionStatusReader: new PodSettingsHandler_1.DrizzlePodAiConnectionsStatusReader(ownerPodAccess, config.edition),
     });
     const aiConfigStore = new AiConfigStore_1.DrizzlePodAiConfigStore({
-        internalPodAccess: hostedPodDataAccess,
+        podAccess: ownerPodAccess,
     });
-    const ftsRebuildAvailable = Boolean(hostedPodDataAccess && rdfEngine?.indexTextSource);
-    const vectorRebuildAvailable = Boolean(hostedPodDataAccess && rdfSearchIndexingService && chatKitStore.createTrustedContext);
+    const ftsRebuildAvailable = Boolean(ownerPodAccess && rdfEngine?.indexTextSource);
+    const vectorRebuildAvailable = Boolean(ownerPodAccess && rdfSearchIndexingService && chatKitStore.createTrustedContext);
     const rebuildFts = async (owner) => {
-        const trustedFetch = await hostedPodDataAccess.getTrustedFetch(owner.webId, undefined, { podBaseUrl: owner.podUrl });
+        const trustedFetch = await ownerPodAccess.getPodFetch(owner.webId, { podBaseUrl: owner.podUrl });
         if (!trustedFetch || !rdfEngine?.indexTextSource)
             throw new Error('fts_rebuild_unavailable');
         const result = await new PodSearchIndexRebuilder_1.PodSearchIndexRebuilder({
@@ -233,7 +237,7 @@ function registerSharedRoutes(container, server) {
             throw new Error('fts_rebuild_incomplete');
     };
     const rebuildVector = async (owner) => {
-        const trustedFetch = await hostedPodDataAccess.getTrustedFetch(owner.webId, undefined, { podBaseUrl: owner.podUrl });
+        const trustedFetch = await ownerPodAccess.getPodFetch(owner.webId, { podBaseUrl: owner.podUrl });
         if (!trustedFetch || !rdfSearchIndexingService)
             throw new Error('vector_rebuild_unavailable');
         const context = await chatKitStore.createTrustedContext({ ...owner, fetch: trustedFetch });
@@ -521,6 +525,8 @@ function registerLocalRoutes(container, server) {
     // SP 状态查询 (供 Linx 查询 SP 配置状态)
     try {
         const config = container.resolve('config');
+        const statusTunnelProvider = (container.resolve('localTunnelProvider', { allowUnregistered: true })
+            ?? container.resolve('tunnelProvider', { allowUnregistered: true }));
         (0, ProvisionHandler_1.registerProvisionStatusRoute)(server, {
             cloudUrl: config.cloudApiEndpoint,
             nodeId: config.nodeId,
@@ -536,7 +542,35 @@ function registerLocalRoutes(container, server) {
                 ?? process.env.SAKURA_TOKEN,
             cloudBaseUrl: config.oidcIssuer || config.cloudApiEndpoint,
             provisionCode: process.env.XPOD_PROVISION_CODE ?? config.provisionCode,
+            // A configured tunnel only becomes a public route once its provider
+            // reports a proxy-ready endpoint; clients use this to decide whether a
+            // canonical request can leave the machine at all.
+            readPublicRoute: () => {
+                if (!statusTunnelProvider) {
+                    return { configured: false, available: false };
+                }
+                const status = statusTunnelProvider.getStatus();
+                const endpoint = status.endpoint ?? statusTunnelProvider.getEndpoint();
+                return {
+                    configured: true,
+                    available: Boolean(status.connected),
+                    ...(statusTunnelProvider.name ? { provider: statusTunnelProvider.name } : {}),
+                    ...(endpoint ? { endpoint } : {}),
+                };
+            },
             persistState: (0, ProvisionHandler_1.createLocalSetupProvisionStateWriter)(config.localSetupPath, config.localSetupProviderId),
+            // A client ranks access points by where it stands, so the node reports the
+            // paths it can prove: its canonical public route, plus the tunnel endpoint
+            // whenever a provider confirms one that is not simply the canonical URL.
+            readAccessRoutes: () => {
+                const status = statusTunnelProvider?.getStatus();
+                const publicUrl = process.env.XPOD_PUBLIC_URL ?? config.publicUrl ?? process.env.CSS_BASE_URL;
+                return (0, RouteSetBuilder_1.buildPublicAccessRoutes)({
+                    canonicalUrl: publicUrl,
+                    publicRouteAvailable: Boolean(status?.connected),
+                    tunnelEndpoint: status?.endpoint ?? statusTunnelProvider?.getEndpoint(),
+                });
+            },
         });
         console.log('[Local] Provision status route registered (/provision/status)');
     }

package/dist/api/container/types.d.ts

@@ -51,7 +51,7 @@ import type { ProviderRegistry as GatewayProviderRegistry } from '../ai-gateway/
 import type { SessionAffinityStore } from '../ai-gateway/routing/SessionAffinityStore';
 import type { AiConnectionsInvocationKeyIssuer } from '../ai-gateway/auth/AiConnectionsInvocationKeyIssuer';
 import type { InvocationTokenCodec } from '../ai-gateway/auth/InvocationTokenCodec';
-import type { InternalPodAccessTokenProvider } from '../ai-gateway/pod/HostedPodDataAccess';
+import type { OwnerPodAccess } from '../ai-gateway/pod/OwnerPodAccess';
 import type { GatewayAccessKeyRepository } from '../ai-gateway/auth/GatewayApiKeyAuthenticator';
 import type { PodModelSelectionRepository } from '../ai-gateway/models/PodModelSelectionRepository';
 import type { ProviderModelSelectionService } from '../ai-gateway/models/ProviderModelSelectionService';
@@ -183,6 +183,8 @@ export interface ApiContainerConfig {
     ngrokUrl?: string;
     /** ngrok executable path. */
     ngrokPath?: string;
+    /** frpc executable path (FRPC_BIN); the SakuraFrp build is required, not the generic one. */
+    frpcPath?: string;
     /** 是否接受 Edge 节点注册 (cloud 模式) */
     edgeNodesEnabled?: boolean;
 }
@@ -202,7 +204,7 @@ export interface ApiContainerCradle {
     authenticator: Authenticator;
     nodeRepo: EdgeNodeRepository;
     serviceTokenRepo: ServiceTokenRepositoryPort;
-    hostedPodDataAccess: InternalPodAccessTokenProvider;
+    ownerPodAccess: OwnerPodAccess;
     invocationTokenCodec?: InvocationTokenCodec;
     gatewayAccessKeyRepository?: GatewayAccessKeyRepository;
     aiConnectionInvocationKeyIssuer?: AiConnectionsInvocationKeyIssuer;