@undefineds.co/xpod 0.4.13 → 0.4.15

package/dist/identity/drizzle/db.js

@@ -33,6 +33,7 @@ exports.isDatabaseSqlite = isDatabaseSqlite;
 exports.executeQuery = executeQuery;
 exports.executeStatement = executeStatement;
 exports.executePostgresLockedStatements = executePostgresLockedStatements;
+exports.ensurePodInterfaceKeyTable = ensurePodInterfaceKeyTable;
 exports.ensureCloudClusterTables = ensureCloudClusterTables;
 exports.toDbTimestamp = toDbTimestamp;
 exports.fromDbTimestamp = fromDbTimestamp;
@@ -260,6 +261,35 @@ async function executePostgresLockedStatements(db, lockKey, statements) {
         client.release();
     }
 }
+/**
+ * Creates the per-owner interface-key table.
+ *
+ * The table holds the owner's Pod credential, which the runtime needs *before* it can read
+ * anything inside that Pod, so it is created on first use rather than by a Pod-side migration.
+ */
+async function ensurePodInterfaceKeyTable(db) {
+    if (isDatabaseSqlite(db)) {
+        db.run((0, drizzle_orm_1.sql) `
+      CREATE TABLE IF NOT EXISTS identity_pod_interface_key (
+        owner_web_id TEXT PRIMARY KEY,
+        client_id TEXT NOT NULL,
+        sealed_secret TEXT NOT NULL,
+        created_at INTEGER NOT NULL DEFAULT (strftime('%s', 'now')),
+        updated_at INTEGER NOT NULL DEFAULT (strftime('%s', 'now'))
+      )
+    `);
+        return;
+    }
+    await db.execute((0, drizzle_orm_1.sql) `
+    CREATE TABLE IF NOT EXISTS identity_pod_interface_key (
+      owner_web_id TEXT PRIMARY KEY,
+      client_id TEXT NOT NULL,
+      sealed_secret TEXT NOT NULL,
+      created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+      updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+    )
+  `);
+}
 async function ensureCloudClusterTables(db) {
     await ensureDatabaseReady(db);
     if (db && typeof db === 'object') {

package/dist/identity/drizzle/schema.pg.d.ts

@@ -10,3 +10,12 @@ export declare const edgeNodes: any;
  * 用于服务间认证 (Business, Local SP, Cloud, Compute)
  */
 export declare const serviceTokens: any;
+/**
+ * Per-owner interface access key.
+ *
+ * A server-side component acts for a user through that user's own Pod credentials, so the
+ * client id/secret pair - the same kind of key a browser uses on the standard interface - is
+ * remembered here, sealed by the credential vault. It cannot live in the Pod: it is what
+ * grants access to the Pod.
+ */
+export declare const podInterfaceKeys: any;

package/dist/identity/drizzle/schema.pg.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.serviceTokens = exports.edgeNodes = exports.ddnsRecords = exports.usage = void 0;
+exports.podInterfaceKeys = exports.serviceTokens = exports.edgeNodes = exports.ddnsRecords = exports.usage = void 0;
 const pg_core_1 = require("drizzle-orm/pg-core");
 const bigint_1 = require("drizzle-orm/pg-core/columns/bigint");
 const integer_1 = require("drizzle-orm/pg-core/columns/integer");
@@ -79,4 +79,19 @@ exports.serviceTokens = (0, pg_core_1.pgTable)('cluster_service_token', {
     createdAt: (0, pg_core_1.timestamp)('created_at', { withTimezone: true, mode: 'date' }).notNull().defaultNow(),
     expiresAt: (0, pg_core_1.timestamp)('expires_at', { withTimezone: true, mode: 'date' }),
 });
+/**
+ * Per-owner interface access key.
+ *
+ * A server-side component acts for a user through that user's own Pod credentials, so the
+ * client id/secret pair - the same kind of key a browser uses on the standard interface - is
+ * remembered here, sealed by the credential vault. It cannot live in the Pod: it is what
+ * grants access to the Pod.
+ */
+exports.podInterfaceKeys = (0, pg_core_1.pgTable)('identity_pod_interface_key', {
+    ownerWebId: (0, pg_core_1.text)('owner_web_id').primaryKey(),
+    clientId: (0, pg_core_1.text)('client_id').notNull(),
+    sealedSecret: (0, pg_core_1.text)('sealed_secret').notNull(),
+    createdAt: (0, pg_core_1.timestamp)('created_at').notNull().defaultNow(),
+    updatedAt: (0, pg_core_1.timestamp)('updated_at').notNull().defaultNow(),
+});
 //# sourceMappingURL=schema.pg.js.map

package/dist/identity/drizzle/schema.sqlite.d.ts

@@ -1073,3 +1073,109 @@ export declare const serviceTokens: import("drizzle-orm/sqlite-core").SQLiteTabl
     };
     dialect: "sqlite";
 }>;
+/**
+ * Per-owner interface access key.
+ *
+ * A server-side component acts for a user through that user's own Pod credentials, so the
+ * client id/secret pair - the same kind of key a browser uses on the standard interface - is
+ * remembered here, sealed by the credential vault. It cannot live in the Pod: it is what
+ * grants access to the Pod.
+ */
+export declare const podInterfaceKeys: import("drizzle-orm/sqlite-core").SQLiteTableWithColumns<{
+    name: "identity_pod_interface_key";
+    schema: undefined;
+    columns: {
+        ownerWebId: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "owner_web_id";
+            tableName: "identity_pod_interface_key";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        clientId: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "client_id";
+            tableName: "identity_pod_interface_key";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        sealedSecret: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "sealed_secret";
+            tableName: "identity_pod_interface_key";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        createdAt: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "created_at";
+            tableName: "identity_pod_interface_key";
+            dataType: "number";
+            columnType: "SQLiteInteger";
+            data: number;
+            driverParam: number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: true;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        updatedAt: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "updated_at";
+            tableName: "identity_pod_interface_key";
+            dataType: "number";
+            columnType: "SQLiteInteger";
+            data: number;
+            driverParam: number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: true;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: "sqlite";
+}>;

package/dist/identity/drizzle/schema.sqlite.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.serviceTokens = exports.edgeNodes = exports.ddnsRecords = exports.usage = void 0;
+exports.podInterfaceKeys = exports.serviceTokens = exports.edgeNodes = exports.ddnsRecords = exports.usage = void 0;
 const sqlite_core_1 = require("drizzle-orm/sqlite-core");
 exports.usage = (0, sqlite_core_1.sqliteTable)('identity_usage', {
     scopeType: (0, sqlite_core_1.text)('scope_type').notNull(), // 'account' | 'pod'
@@ -79,4 +79,19 @@ exports.serviceTokens = (0, sqlite_core_1.sqliteTable)('cluster_service_token',
     createdAt: (0, sqlite_core_1.integer)('created_at').notNull().$defaultFn(() => Math.floor(Date.now() / 1000)),
     expiresAt: (0, sqlite_core_1.integer)('expires_at'),
 });
+/**
+ * Per-owner interface access key.
+ *
+ * A server-side component acts for a user through that user's own Pod credentials, so the
+ * client id/secret pair - the same kind of key a browser uses on the standard interface - is
+ * remembered here, sealed by the credential vault. It cannot live in the Pod: it is what
+ * grants access to the Pod.
+ */
+exports.podInterfaceKeys = (0, sqlite_core_1.sqliteTable)('identity_pod_interface_key', {
+    ownerWebId: (0, sqlite_core_1.text)('owner_web_id').primaryKey(),
+    clientId: (0, sqlite_core_1.text)('client_id').notNull(),
+    sealedSecret: (0, sqlite_core_1.text)('sealed_secret').notNull(),
+    createdAt: (0, sqlite_core_1.integer)('created_at').notNull().$defaultFn(() => Math.floor(Date.now() / 1000)),
+    updatedAt: (0, sqlite_core_1.integer)('updated_at').notNull().$defaultFn(() => Math.floor(Date.now() / 1000)),
+});
 //# sourceMappingURL=schema.sqlite.js.map

package/dist/index.d.ts

@@ -15,7 +15,6 @@ export type { PostgresRdfTextIndexOptions } from './storage/rdf/PostgresRdfTextI
 export type { PostgresRdfVectorIndexOptions } from './storage/rdf/PostgresRdfVectorIndex';
 export * from './document';
 import { SubgraphSparqlHttpHandler } from './http/SubgraphSparqlHttpHandler';
-import { InternalPodDataHttpHandler } from './http/InternalPodDataHttpHandler';
 import { QuotaAdminHttpHandler } from './http/quota/QuotaAdminHttpHandler';
 import { SparqlUpdateResourceStore } from './storage/SparqlUpdateResourceStore';
 import { ClusterIngressRouter } from './http/ClusterIngressRouter';
@@ -51,6 +50,8 @@ import { SimpleEdgeNodeTunnelManager, NoopEdgeNodeTunnelManager } from './edge/E
 import { FrpTunnelManager } from './edge/FrpTunnelManager';
 import { AcmeCertificateManager } from './edge/acme/AcmeCertificateManager';
 import { EdgeNodeHealthProbeService } from './edge/EdgeNodeHealthProbeService';
+import { assertPublicProbeTarget, createPinnedHeadProbeRequest, isPublicIpAddress } from './edge/ProbeTargetGuard';
+import { createPodOwnershipNodeAccessResolver } from './edge/reachability/NodeAccessResolver';
 import { EdgeNodeAgent } from './edge/EdgeNodeAgent';
 import { EdgeNodeAgentInitializer } from './edge/EdgeNodeAgentInitializer';
 import { EdgeNodeCertificateService } from './service/EdgeNodeCertificateService';
@@ -125,6 +126,6 @@ export type { OwnedWebIdEntry, PodOwnershipResolver, PodOwnershipTarget, CssPodO
 export type { TunnelProvider, TunnelConfig, TunnelSetupOptions, TunnelStatus, } from './tunnel/TunnelProvider';
 export type { SubdomainRegistration, ConnectivityResult, SubdomainServiceOptions, } from './subdomain/SubdomainService';
 export { AppStaticAssetHandler } from './http/AppStaticAssetHandler';
-export { RepresentationPartialConvertingStore, MinioDataAccessor, SolidRdfDataAccessor, MixDataAccessor, ConfigurableLoggerFactory, resolveLogFilePattern, resolveCurrentLogFile, LOG_FILE_PATTERN, SparqlUpdateResourceStore, SubgraphQueryEngine, SubgraphSparqlHttpHandler, InternalPodDataHttpHandler, QuotaAdminHttpHandler, ClusterIngressRouter, ClusterWebSocketConfigurator, EdgeNodeDirectDebugHttpHandler, EdgeNodeProxyHttpHandler, RouterHttpHandler, RouterHttpRoute, TracingHandler, EdgeNodeCertificateHttpHandler, TerminalHttpHandler, DeviceNotificationHub, DeviceNotificationResourceListener, DeviceNotificationWebSocketServer, DeviceNotificationTicketHandler, registerDeviceNotificationRuntime, ReservedSuffixIdentifierGenerator, DrizzleIndexedStorage, LoginMethodGuardStorage, ValidatingIdentityProviderHttpHandler, PostgresKeyValueStorage, RedisKeyValueStorage, SqliteKeyValueStorage, BaseKeyValueStorage, DrizzleQuotaService, NoopQuotaService, HttpEntitlementProvider, NoopEntitlementProvider, PerAccountQuotaStrategy, TencentDnsProvider, EdgeNodeDnsCoordinator, Dns01CertificateProvisioner, SimpleEdgeNodeTunnelManager, NoopEdgeNodeTunnelManager, FrpTunnelManager, EdgeNodeHealthProbeService, EdgeNodeAgent, EdgeNodeAgentInitializer, EdgeNodeCertificateService, AcmeCertificateManager, EdgeNodeModeDetector, ClusterIdentifierStrategy, UsageTrackingStore, CenterNodeRegistrationService, PodRoutingHttpHandler, ReactAppViewHandler, QuintStore, SqliteQuintStore, PgQuintStore, RdfTermDictionary, RdfQuadIndex, Rdf3xIndex, RdfTextIndex, RdfVectorIndex, PostgresRdfTextIndex, PostgresRdfVectorIndex, SolidRdfEngine, LocalQleverNativeSparqlClient, QleverSparqlEngine, RdfQuerySparqlEngine, PostgresRdfEngine, VectorStore, SqliteVectorStore, PostgresVectorStore, VectorHttpHandler, ProviderRegistry, ProviderRegistryImpl, EmbeddingService, EmbeddingServiceImpl, CredentialReader, CredentialReaderImpl, CloudflareTunnelProvider, LocalTunnelProvider, NgrokTunnelProvider, SubdomainService, MultiDomainIdentifierStrategy, SubdomainPodIdentifierStrategy, DisabledOidcHandler, DisabledIdentityProviderHandler, AutoDetectOidcHandler, AutoDetectIdentityProviderHandler, LoopbackClientIdAdapterFactory, RememberedClientGrantStore, RememberedConsentHandler, RememberedClientPromptFactory, SessionBoundIdentityProviderFactory, ScopedPickWebIdHandler, ConfiguredLoopbackDPoPWebIdExtractor, AccountStorageBindingsHandler, CssPodOwnershipResolver, UrlAwareRedisLocker, ProvisionPodCreator, ProvisionPodStore, ProvisionCodeCodec, LocalPodProvisioningService, SqliteSolidFsSyncJournal, RootedSolidFsSyncJournal, LocalRdfAuthorityRecoveryInitializer, ObservableResourceStore, RdfSearchReconciliationIntentSink, };
+export { RepresentationPartialConvertingStore, MinioDataAccessor, SolidRdfDataAccessor, MixDataAccessor, ConfigurableLoggerFactory, resolveLogFilePattern, resolveCurrentLogFile, LOG_FILE_PATTERN, SparqlUpdateResourceStore, SubgraphQueryEngine, SubgraphSparqlHttpHandler, QuotaAdminHttpHandler, ClusterIngressRouter, ClusterWebSocketConfigurator, EdgeNodeDirectDebugHttpHandler, EdgeNodeProxyHttpHandler, RouterHttpHandler, RouterHttpRoute, TracingHandler, EdgeNodeCertificateHttpHandler, TerminalHttpHandler, DeviceNotificationHub, DeviceNotificationResourceListener, DeviceNotificationWebSocketServer, DeviceNotificationTicketHandler, registerDeviceNotificationRuntime, ReservedSuffixIdentifierGenerator, DrizzleIndexedStorage, LoginMethodGuardStorage, ValidatingIdentityProviderHttpHandler, PostgresKeyValueStorage, RedisKeyValueStorage, SqliteKeyValueStorage, BaseKeyValueStorage, DrizzleQuotaService, NoopQuotaService, HttpEntitlementProvider, NoopEntitlementProvider, PerAccountQuotaStrategy, TencentDnsProvider, EdgeNodeDnsCoordinator, Dns01CertificateProvisioner, SimpleEdgeNodeTunnelManager, NoopEdgeNodeTunnelManager, FrpTunnelManager, EdgeNodeHealthProbeService, assertPublicProbeTarget, createPinnedHeadProbeRequest, isPublicIpAddress, createPodOwnershipNodeAccessResolver, EdgeNodeAgent, EdgeNodeAgentInitializer, EdgeNodeCertificateService, AcmeCertificateManager, EdgeNodeModeDetector, ClusterIdentifierStrategy, UsageTrackingStore, CenterNodeRegistrationService, PodRoutingHttpHandler, ReactAppViewHandler, QuintStore, SqliteQuintStore, PgQuintStore, RdfTermDictionary, RdfQuadIndex, Rdf3xIndex, RdfTextIndex, RdfVectorIndex, PostgresRdfTextIndex, PostgresRdfVectorIndex, SolidRdfEngine, LocalQleverNativeSparqlClient, QleverSparqlEngine, RdfQuerySparqlEngine, PostgresRdfEngine, VectorStore, SqliteVectorStore, PostgresVectorStore, VectorHttpHandler, ProviderRegistry, ProviderRegistryImpl, EmbeddingService, EmbeddingServiceImpl, CredentialReader, CredentialReaderImpl, CloudflareTunnelProvider, LocalTunnelProvider, NgrokTunnelProvider, SubdomainService, MultiDomainIdentifierStrategy, SubdomainPodIdentifierStrategy, DisabledOidcHandler, DisabledIdentityProviderHandler, AutoDetectOidcHandler, AutoDetectIdentityProviderHandler, LoopbackClientIdAdapterFactory, RememberedClientGrantStore, RememberedConsentHandler, RememberedClientPromptFactory, SessionBoundIdentityProviderFactory, ScopedPickWebIdHandler, ConfiguredLoopbackDPoPWebIdExtractor, AccountStorageBindingsHandler, CssPodOwnershipResolver, UrlAwareRedisLocker, ProvisionPodCreator, ProvisionPodStore, ProvisionCodeCodec, LocalPodProvisioningService, SqliteSolidFsSyncJournal, RootedSolidFsSyncJournal, LocalRdfAuthorityRecoveryInitializer, ObservableResourceStore, RdfSearchReconciliationIntentSink, };
 export type { ResourceChangeEvent, ResourceChangeListener, ResourceChangeRecorder, } from './storage/ObservableResourceStore';
 export { RdfHandlebarsTemplateEngine } from './util/templates/RdfHandlebarsTemplateEngine';

package/dist/index.js

@@ -14,9 +14,9 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.EdgeNodeAgentInitializer = exports.EdgeNodeAgent = exports.EdgeNodeHealthProbeService = exports.FrpTunnelManager = exports.NoopEdgeNodeTunnelManager = exports.SimpleEdgeNodeTunnelManager = exports.Dns01CertificateProvisioner = exports.EdgeNodeDnsCoordinator = exports.TencentDnsProvider = exports.PerAccountQuotaStrategy = exports.NoopEntitlementProvider = exports.HttpEntitlementProvider = exports.NoopQuotaService = exports.DrizzleQuotaService = exports.BaseKeyValueStorage = exports.SqliteKeyValueStorage = exports.RedisKeyValueStorage = exports.PostgresKeyValueStorage = exports.ValidatingIdentityProviderHttpHandler = exports.LoginMethodGuardStorage = exports.DrizzleIndexedStorage = exports.ReservedSuffixIdentifierGenerator = exports.registerDeviceNotificationRuntime = exports.DeviceNotificationTicketHandler = exports.DeviceNotificationWebSocketServer = exports.DeviceNotificationResourceListener = exports.DeviceNotificationHub = exports.TerminalHttpHandler = exports.EdgeNodeCertificateHttpHandler = exports.TracingHandler = exports.RouterHttpRoute = exports.RouterHttpHandler = exports.EdgeNodeProxyHttpHandler = exports.EdgeNodeDirectDebugHttpHandler = exports.ClusterWebSocketConfigurator = exports.ClusterIngressRouter = exports.QuotaAdminHttpHandler = exports.InternalPodDataHttpHandler = exports.SubgraphSparqlHttpHandler = exports.SubgraphQueryEngine = exports.SparqlUpdateResourceStore = exports.LOG_FILE_PATTERN = exports.resolveCurrentLogFile = exports.resolveLogFilePattern = exports.ConfigurableLoggerFactory = exports.MixDataAccessor = exports.SolidRdfDataAccessor = exports.MinioDataAccessor = exports.RepresentationPartialConvertingStore = exports.AppStaticAssetHandler = void 0;
-exports.ConfiguredLoopbackDPoPWebIdExtractor = exports.ScopedPickWebIdHandler = exports.SessionBoundIdentityProviderFactory = exports.RememberedClientPromptFactory = exports.RememberedConsentHandler = exports.RememberedClientGrantStore = exports.LoopbackClientIdAdapterFactory = exports.AutoDetectIdentityProviderHandler = exports.AutoDetectOidcHandler = exports.DisabledIdentityProviderHandler = exports.DisabledOidcHandler = exports.SubdomainPodIdentifierStrategy = exports.MultiDomainIdentifierStrategy = exports.SubdomainService = exports.NgrokTunnelProvider = exports.LocalTunnelProvider = exports.CloudflareTunnelProvider = exports.CredentialReaderImpl = exports.CredentialReader = exports.EmbeddingServiceImpl = exports.EmbeddingService = exports.ProviderRegistryImpl = exports.ProviderRegistry = exports.VectorHttpHandler = exports.PostgresVectorStore = exports.SqliteVectorStore = exports.VectorStore = exports.PostgresRdfEngine = exports.RdfQuerySparqlEngine = exports.QleverSparqlEngine = exports.LocalQleverNativeSparqlClient = exports.SolidRdfEngine = exports.PostgresRdfVectorIndex = exports.PostgresRdfTextIndex = exports.RdfVectorIndex = exports.RdfTextIndex = exports.Rdf3xIndex = exports.RdfQuadIndex = exports.RdfTermDictionary = exports.PgQuintStore = exports.SqliteQuintStore = exports.QuintStore = exports.ReactAppViewHandler = exports.PodRoutingHttpHandler = exports.CenterNodeRegistrationService = exports.UsageTrackingStore = exports.ClusterIdentifierStrategy = exports.EdgeNodeModeDetector = exports.AcmeCertificateManager = exports.EdgeNodeCertificateService = void 0;
-exports.RdfHandlebarsTemplateEngine = exports.RdfSearchReconciliationIntentSink = exports.ObservableResourceStore = exports.LocalRdfAuthorityRecoveryInitializer = exports.RootedSolidFsSyncJournal = exports.SqliteSolidFsSyncJournal = exports.LocalPodProvisioningService = exports.ProvisionCodeCodec = exports.ProvisionPodStore = exports.ProvisionPodCreator = exports.UrlAwareRedisLocker = exports.CssPodOwnershipResolver = exports.AccountStorageBindingsHandler = void 0;
+exports.isPublicIpAddress = exports.createPinnedHeadProbeRequest = exports.assertPublicProbeTarget = exports.EdgeNodeHealthProbeService = exports.FrpTunnelManager = exports.NoopEdgeNodeTunnelManager = exports.SimpleEdgeNodeTunnelManager = exports.Dns01CertificateProvisioner = exports.EdgeNodeDnsCoordinator = exports.TencentDnsProvider = exports.PerAccountQuotaStrategy = exports.NoopEntitlementProvider = exports.HttpEntitlementProvider = exports.NoopQuotaService = exports.DrizzleQuotaService = exports.BaseKeyValueStorage = exports.SqliteKeyValueStorage = exports.RedisKeyValueStorage = exports.PostgresKeyValueStorage = exports.ValidatingIdentityProviderHttpHandler = exports.LoginMethodGuardStorage = exports.DrizzleIndexedStorage = exports.ReservedSuffixIdentifierGenerator = exports.registerDeviceNotificationRuntime = exports.DeviceNotificationTicketHandler = exports.DeviceNotificationWebSocketServer = exports.DeviceNotificationResourceListener = exports.DeviceNotificationHub = exports.TerminalHttpHandler = exports.EdgeNodeCertificateHttpHandler = exports.TracingHandler = exports.RouterHttpRoute = exports.RouterHttpHandler = exports.EdgeNodeProxyHttpHandler = exports.EdgeNodeDirectDebugHttpHandler = exports.ClusterWebSocketConfigurator = exports.ClusterIngressRouter = exports.QuotaAdminHttpHandler = exports.SubgraphSparqlHttpHandler = exports.SubgraphQueryEngine = exports.SparqlUpdateResourceStore = exports.LOG_FILE_PATTERN = exports.resolveCurrentLogFile = exports.resolveLogFilePattern = exports.ConfigurableLoggerFactory = exports.MixDataAccessor = exports.SolidRdfDataAccessor = exports.MinioDataAccessor = exports.RepresentationPartialConvertingStore = exports.AppStaticAssetHandler = void 0;
+exports.RememberedClientPromptFactory = exports.RememberedConsentHandler = exports.RememberedClientGrantStore = exports.LoopbackClientIdAdapterFactory = exports.AutoDetectIdentityProviderHandler = exports.AutoDetectOidcHandler = exports.DisabledIdentityProviderHandler = exports.DisabledOidcHandler = exports.SubdomainPodIdentifierStrategy = exports.MultiDomainIdentifierStrategy = exports.SubdomainService = exports.NgrokTunnelProvider = exports.LocalTunnelProvider = exports.CloudflareTunnelProvider = exports.CredentialReaderImpl = exports.CredentialReader = exports.EmbeddingServiceImpl = exports.EmbeddingService = exports.ProviderRegistryImpl = exports.ProviderRegistry = exports.VectorHttpHandler = exports.PostgresVectorStore = exports.SqliteVectorStore = exports.VectorStore = exports.PostgresRdfEngine = exports.RdfQuerySparqlEngine = exports.QleverSparqlEngine = exports.LocalQleverNativeSparqlClient = exports.SolidRdfEngine = exports.PostgresRdfVectorIndex = exports.PostgresRdfTextIndex = exports.RdfVectorIndex = exports.RdfTextIndex = exports.Rdf3xIndex = exports.RdfQuadIndex = exports.RdfTermDictionary = exports.PgQuintStore = exports.SqliteQuintStore = exports.QuintStore = exports.ReactAppViewHandler = exports.PodRoutingHttpHandler = exports.CenterNodeRegistrationService = exports.UsageTrackingStore = exports.ClusterIdentifierStrategy = exports.EdgeNodeModeDetector = exports.AcmeCertificateManager = exports.EdgeNodeCertificateService = exports.EdgeNodeAgentInitializer = exports.EdgeNodeAgent = exports.createPodOwnershipNodeAccessResolver = void 0;
+exports.RdfHandlebarsTemplateEngine = exports.RdfSearchReconciliationIntentSink = exports.ObservableResourceStore = exports.LocalRdfAuthorityRecoveryInitializer = exports.RootedSolidFsSyncJournal = exports.SqliteSolidFsSyncJournal = exports.LocalPodProvisioningService = exports.ProvisionCodeCodec = exports.ProvisionPodStore = exports.ProvisionPodCreator = exports.UrlAwareRedisLocker = exports.CssPodOwnershipResolver = exports.AccountStorageBindingsHandler = exports.ConfiguredLoopbackDPoPWebIdExtractor = exports.ScopedPickWebIdHandler = exports.SessionBoundIdentityProviderFactory = void 0;
 require("./runtime/configure-drizzle-solid");
 const RepresentationPartialConvertingStore_1 = require("./storage/RepresentationPartialConvertingStore");
 Object.defineProperty(exports, "RepresentationPartialConvertingStore", { enumerable: true, get: function () { return RepresentationPartialConvertingStore_1.RepresentationPartialConvertingStore; } });
@@ -37,8 +37,6 @@ Object.defineProperty(exports, "SubgraphQueryEngine", { enumerable: true, get: f
 __exportStar(require("./document"), exports);
 const SubgraphSparqlHttpHandler_1 = require("./http/SubgraphSparqlHttpHandler");
 Object.defineProperty(exports, "SubgraphSparqlHttpHandler", { enumerable: true, get: function () { return SubgraphSparqlHttpHandler_1.SubgraphSparqlHttpHandler; } });
-const InternalPodDataHttpHandler_1 = require("./http/InternalPodDataHttpHandler");
-Object.defineProperty(exports, "InternalPodDataHttpHandler", { enumerable: true, get: function () { return InternalPodDataHttpHandler_1.InternalPodDataHttpHandler; } });
 const QuotaAdminHttpHandler_1 = require("./http/quota/QuotaAdminHttpHandler");
 Object.defineProperty(exports, "QuotaAdminHttpHandler", { enumerable: true, get: function () { return QuotaAdminHttpHandler_1.QuotaAdminHttpHandler; } });
 const SparqlUpdateResourceStore_1 = require("./storage/SparqlUpdateResourceStore");
@@ -111,6 +109,12 @@ const AcmeCertificateManager_1 = require("./edge/acme/AcmeCertificateManager");
 Object.defineProperty(exports, "AcmeCertificateManager", { enumerable: true, get: function () { return AcmeCertificateManager_1.AcmeCertificateManager; } });
 const EdgeNodeHealthProbeService_1 = require("./edge/EdgeNodeHealthProbeService");
 Object.defineProperty(exports, "EdgeNodeHealthProbeService", { enumerable: true, get: function () { return EdgeNodeHealthProbeService_1.EdgeNodeHealthProbeService; } });
+const ProbeTargetGuard_1 = require("./edge/ProbeTargetGuard");
+Object.defineProperty(exports, "assertPublicProbeTarget", { enumerable: true, get: function () { return ProbeTargetGuard_1.assertPublicProbeTarget; } });
+Object.defineProperty(exports, "createPinnedHeadProbeRequest", { enumerable: true, get: function () { return ProbeTargetGuard_1.createPinnedHeadProbeRequest; } });
+Object.defineProperty(exports, "isPublicIpAddress", { enumerable: true, get: function () { return ProbeTargetGuard_1.isPublicIpAddress; } });
+const NodeAccessResolver_1 = require("./edge/reachability/NodeAccessResolver");
+Object.defineProperty(exports, "createPodOwnershipNodeAccessResolver", { enumerable: true, get: function () { return NodeAccessResolver_1.createPodOwnershipNodeAccessResolver; } });
 const EdgeNodeAgent_1 = require("./edge/EdgeNodeAgent");
 Object.defineProperty(exports, "EdgeNodeAgent", { enumerable: true, get: function () { return EdgeNodeAgent_1.EdgeNodeAgent; } });
 const EdgeNodeAgentInitializer_1 = require("./edge/EdgeNodeAgentInitializer");

package/dist/main.js

@@ -213,6 +213,11 @@ async function startRuntime(options) {
     (0, runtime_1.validateBaseUrl)({ baseUrl, mainPort, explicit: explicitBaseUrl !== undefined });
     const cssPort = await (0, runtime_1.getFreePortForWildcard)(mainPort + 1);
     const apiPort = await (0, runtime_1.getFreePortForWildcard)(cssPort + 1);
+    // Remote forwarding (managed tunnels, P2P data plane) terminates on this machine, so
+    // its origin is a dedicated ingress port instead of the gateway port: the Gateway
+    // never treats requests accepted there as local. It is an internal loopback detail, so
+    // the OS assigns the port instead of us claiming a neighbour of the planned ports.
+    const ingressPort = await (0, runtime_1.getEphemeralLoopbackPort)();
     const runtimeRoot = path_1.default.join(process.cwd(), '.xpod/runtime/legacy-css');
     const rdfIndexPath = process.env.CSS_RDF_INDEX_PATH || (0, database_url_1.resolveDefaultRdfIndexPath)({
         sparqlEndpoint: process.env.CSS_SPARQL_ENDPOINT ?? process.env.SPARQL_ENDPOINT,
@@ -268,6 +273,7 @@ async function startRuntime(options) {
             apiPort,
             mainPort,
             cssPort,
+            ingressPort,
             baseUrl,
             rdfIndexPath,
             authMode,
@@ -296,6 +302,7 @@ async function startRuntime(options) {
         exitOnStop: true,
         baseUrl,
         internalAdminAuthSecret: gatewayAdminProxyAuthSecret,
+        ingressPort,
     });
     proxy.setTargets({
         css: `http://localhost:${cssPort}`,

package/dist/runtime/GatewayAdminProxyAuth.d.ts

@@ -2,9 +2,8 @@ import type { IncomingHttpHeaders, OutgoingHttpHeaders } from 'node:http';
 export declare const GATEWAY_ADMIN_PROXY_LOOPBACK_HEADER = "x-xpod-admin-proxy-loopback";
 export declare const GATEWAY_ADMIN_PROXY_TIMESTAMP_HEADER = "x-xpod-admin-proxy-timestamp";
 export declare const GATEWAY_ADMIN_PROXY_SIGNATURE_HEADER = "x-xpod-admin-proxy-signature";
-export declare const GATEWAY_ADMIN_PROXY_INTENT_HEADER = "x-xpod-admin-proxy-intent";
 export declare const GATEWAY_ADMIN_PROXY_NONCE_HEADER = "x-xpod-admin-proxy-nonce";
-export declare const GATEWAY_ADMIN_PROXY_HEADERS: readonly ["x-xpod-admin-proxy-loopback", "x-xpod-admin-proxy-timestamp", "x-xpod-admin-proxy-signature", "x-xpod-admin-proxy-intent", "x-xpod-admin-proxy-nonce"];
+export declare const GATEWAY_ADMIN_PROXY_HEADERS: readonly ["x-xpod-admin-proxy-loopback", "x-xpod-admin-proxy-timestamp", "x-xpod-admin-proxy-signature", "x-xpod-admin-proxy-nonce"];
 export declare function createGatewayAdminProxyAuthSecret(): string;
 export interface GatewayAdminProxyMarkerInput {
     secret: string;
@@ -13,27 +12,14 @@ export interface GatewayAdminProxyMarkerInput {
     originalClientLoopback: boolean;
     issuedAt?: number;
     nonce?: string;
-    intent?: GatewayAdminProxyIntent;
 }
 export interface GatewayAdminProxyMarkerVerification {
     present: boolean;
     valid: boolean;
     originalClientLoopback: boolean;
     nonce?: string;
-    intent?: GatewayAdminProxyIntent;
     reason?: string;
 }
-export interface GatewayAdminProxyIntent {
-    ownerWebId: string;
-    /** Physical Pod root when it differs from the identity provider WebID root. */
-    podBaseUrl?: string;
-    method: 'GET' | 'HEAD' | 'POST' | 'PUT' | 'PATCH' | 'DELETE';
-    resourceUrl: string;
-    principalKind: 'solid-user' | 'gateway-key-verifier';
-    scopes: string[];
-    /** SHA-256 hex digest of a POST body. Required for POST intents. */
-    bodyDigest?: string;
-}
 export declare function createGatewayAdminProxyHeaders(input: GatewayAdminProxyMarkerInput): OutgoingHttpHeaders;
 export declare function stripGatewayAdminProxyHeaders(headers: IncomingHttpHeaders): void;
 export declare function isLoopbackRemoteAddress(remoteAddress: string | undefined): boolean;
@@ -44,4 +30,3 @@ export declare function verifyGatewayAdminProxyHeaders(input: {
     url: string | undefined;
     now?: number;
 }): GatewayAdminProxyMarkerVerification;
-export declare function canonicalGatewayAdminProxyIntent(intent: GatewayAdminProxyIntent): string;

package/dist/runtime/GatewayAdminProxyAuth.js

@@ -1,24 +1,21 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.GATEWAY_ADMIN_PROXY_HEADERS = exports.GATEWAY_ADMIN_PROXY_NONCE_HEADER = exports.GATEWAY_ADMIN_PROXY_INTENT_HEADER = exports.GATEWAY_ADMIN_PROXY_SIGNATURE_HEADER = exports.GATEWAY_ADMIN_PROXY_TIMESTAMP_HEADER = exports.GATEWAY_ADMIN_PROXY_LOOPBACK_HEADER = void 0;
+exports.GATEWAY_ADMIN_PROXY_HEADERS = exports.GATEWAY_ADMIN_PROXY_NONCE_HEADER = exports.GATEWAY_ADMIN_PROXY_SIGNATURE_HEADER = exports.GATEWAY_ADMIN_PROXY_TIMESTAMP_HEADER = exports.GATEWAY_ADMIN_PROXY_LOOPBACK_HEADER = void 0;
 exports.createGatewayAdminProxyAuthSecret = createGatewayAdminProxyAuthSecret;
 exports.createGatewayAdminProxyHeaders = createGatewayAdminProxyHeaders;
 exports.stripGatewayAdminProxyHeaders = stripGatewayAdminProxyHeaders;
 exports.isLoopbackRemoteAddress = isLoopbackRemoteAddress;
 exports.verifyGatewayAdminProxyHeaders = verifyGatewayAdminProxyHeaders;
-exports.canonicalGatewayAdminProxyIntent = canonicalGatewayAdminProxyIntent;
 const node_crypto_1 = require("node:crypto");
 const node_net_1 = require("node:net");
 exports.GATEWAY_ADMIN_PROXY_LOOPBACK_HEADER = 'x-xpod-admin-proxy-loopback';
 exports.GATEWAY_ADMIN_PROXY_TIMESTAMP_HEADER = 'x-xpod-admin-proxy-timestamp';
 exports.GATEWAY_ADMIN_PROXY_SIGNATURE_HEADER = 'x-xpod-admin-proxy-signature';
-exports.GATEWAY_ADMIN_PROXY_INTENT_HEADER = 'x-xpod-admin-proxy-intent';
 exports.GATEWAY_ADMIN_PROXY_NONCE_HEADER = 'x-xpod-admin-proxy-nonce';
 exports.GATEWAY_ADMIN_PROXY_HEADERS = [
     exports.GATEWAY_ADMIN_PROXY_LOOPBACK_HEADER,
     exports.GATEWAY_ADMIN_PROXY_TIMESTAMP_HEADER,
     exports.GATEWAY_ADMIN_PROXY_SIGNATURE_HEADER,
-    exports.GATEWAY_ADMIN_PROXY_INTENT_HEADER,
     exports.GATEWAY_ADMIN_PROXY_NONCE_HEADER,
 ];
 const MAX_CLOCK_SKEW_MS = 60_000;
@@ -28,12 +25,10 @@ function createGatewayAdminProxyAuthSecret() {
 function createGatewayAdminProxyHeaders(input) {
     const issuedAt = input.issuedAt ?? Date.now();
     const loopback = input.originalClientLoopback ? '1' : '0';
-    const intent = input.intent ? canonicalGatewayAdminProxyIntent(input.intent) : undefined;
     return {
         [exports.GATEWAY_ADMIN_PROXY_LOOPBACK_HEADER]: loopback,
         [exports.GATEWAY_ADMIN_PROXY_TIMESTAMP_HEADER]: String(issuedAt),
         ...(input.nonce ? { [exports.GATEWAY_ADMIN_PROXY_NONCE_HEADER]: input.nonce } : {}),
-        ...(intent ? { [exports.GATEWAY_ADMIN_PROXY_INTENT_HEADER]: intent } : {}),
         [exports.GATEWAY_ADMIN_PROXY_SIGNATURE_HEADER]: signGatewayAdminProxyMarker({
             secret: input.secret,
             method: input.method,
@@ -41,7 +36,6 @@ function createGatewayAdminProxyHeaders(input) {
             loopback,
             issuedAt,
             nonce: input.nonce,
-            intent,
         }),
     };
 }
@@ -66,7 +60,6 @@ function verifyGatewayAdminProxyHeaders(input) {
     const timestamp = firstHeader(input.headers[exports.GATEWAY_ADMIN_PROXY_TIMESTAMP_HEADER]);
     const signature = firstHeader(input.headers[exports.GATEWAY_ADMIN_PROXY_SIGNATURE_HEADER]);
     const nonce = firstHeader(input.headers[exports.GATEWAY_ADMIN_PROXY_NONCE_HEADER]);
-    const intentHeader = firstHeader(input.headers[exports.GATEWAY_ADMIN_PROXY_INTENT_HEADER]);
     const present = loopback !== undefined || timestamp !== undefined || signature !== undefined;
     if (!present) {
         return { present: false, valid: false, originalClientLoopback: false };
@@ -87,10 +80,6 @@ function verifyGatewayAdminProxyHeaders(input) {
     if (Math.abs((input.now ?? Date.now()) - issuedAt) > MAX_CLOCK_SKEW_MS) {
         return { present: true, valid: false, originalClientLoopback: loopback === '1', reason: 'expired_marker' };
     }
-    const intent = parseGatewayAdminProxyIntent(intentHeader);
-    if (intentHeader !== undefined && !intent) {
-        return { present: true, valid: false, originalClientLoopback: loopback === '1', reason: 'invalid_intent' };
-    }
     const expected = signGatewayAdminProxyMarker({
         secret: input.secret,
         method: input.method,
@@ -98,12 +87,11 @@ function verifyGatewayAdminProxyHeaders(input) {
         loopback,
         issuedAt,
         nonce,
-        intent: intentHeader,
     });
     if (!safeEqual(signature, expected)) {
         return { present: true, valid: false, originalClientLoopback: loopback === '1', reason: 'bad_signature' };
     }
-    return { present: true, valid: true, originalClientLoopback: loopback === '1', nonce, intent };
+    return { present: true, valid: true, originalClientLoopback: loopback === '1', nonce };
 }
 function signGatewayAdminProxyMarker(input) {
     const payload = [
@@ -113,66 +101,9 @@ function signGatewayAdminProxyMarker(input) {
         input.loopback,
         String(input.issuedAt),
         input.nonce ?? '',
-        input.intent ?? '',
     ].join('\n');
     return (0, node_crypto_1.createHmac)('sha256', input.secret).update(payload).digest('base64url');
 }
-function canonicalGatewayAdminProxyIntent(intent) {
-    return JSON.stringify({
-        ownerWebId: intent.ownerWebId,
-        ...(intent.podBaseUrl ? { podBaseUrl: intent.podBaseUrl } : {}),
-        method: intent.method,
-        resourceUrl: intent.resourceUrl,
-        principalKind: intent.principalKind,
-        scopes: [...intent.scopes].sort(),
-        ...(intent.bodyDigest ? { bodyDigest: intent.bodyDigest } : {}),
-    });
-}
-function parseGatewayAdminProxyIntent(value) {
-    if (!value) {
-        return undefined;
-    }
-    try {
-        const parsed = JSON.parse(value);
-        if (typeof parsed.ownerWebId !== 'string' ||
-            typeof parsed.resourceUrl !== 'string' ||
-            (parsed.podBaseUrl !== undefined && !isHttpUrl(parsed.podBaseUrl)) ||
-            (parsed.method !== 'GET' && parsed.method !== 'HEAD' && parsed.method !== 'POST' && parsed.method !== 'PUT' && parsed.method !== 'PATCH' && parsed.method !== 'DELETE') ||
-            (parsed.principalKind !== 'solid-user' && parsed.principalKind !== 'gateway-key-verifier') ||
-            !Array.isArray(parsed.scopes) ||
-            !parsed.scopes.every((scope) => typeof scope === 'string') ||
-            (parsed.bodyDigest !== undefined && !isSha256Hex(parsed.bodyDigest)) ||
-            (parsed.method === 'POST' && !isSha256Hex(parsed.bodyDigest))) {
-            return undefined;
-        }
-        return {
-            ownerWebId: parsed.ownerWebId,
-            ...(parsed.podBaseUrl ? { podBaseUrl: parsed.podBaseUrl } : {}),
-            method: parsed.method,
-            resourceUrl: parsed.resourceUrl,
-            principalKind: parsed.principalKind,
-            scopes: parsed.scopes,
-            ...(parsed.bodyDigest ? { bodyDigest: parsed.bodyDigest } : {}),
-        };
-    }
-    catch {
-        return undefined;
-    }
-}
-function isHttpUrl(value) {
-    if (typeof value !== 'string')
-        return false;
-    try {
-        const url = new URL(value);
-        return url.protocol === 'http:' || url.protocol === 'https:';
-    }
-    catch {
-        return false;
-    }
-}
-function isSha256Hex(value) {
-    return typeof value === 'string' && /^[a-f0-9]{64}$/u.test(value);
-}
 function safeEqual(actual, expected) {
     const actualBuffer = Buffer.from(actual);
     const expectedBuffer = Buffer.from(expected);

package/dist/runtime/Proxy.d.ts

@@ -21,7 +21,22 @@ export declare class GatewayProxy {
     private readonly nativeUpgradeRelay?;
     /** Sockets created by `upgrade` events, dropped on shutdown. */
     private readonly upgradeSockets;
+    /**
+     * Loopback-only listener used as the origin of everything that forwards remote
+     * traffic to this Gateway (managed tunnels, P2P data plane). Requests accepted
+     * there are never treated as local, so a forwarded request cannot inherit the
+     * trust that a real local client has.
+     */
+    private readonly ingressPort?;
+    private ingressServer?;
     constructor(port: number | undefined, supervisor: Supervisor, bindHost?: string, options?: GatewayProxyOptions);
+    /**
+     * Builds one HTTP listener plus its WebSocket routing.
+     *
+     * `untrustedIngress` marks the listener that tunnels and the P2P data plane
+     * connect to; see `ingressPort`.
+     */
+    private createListener;
     /**
      * Upgraded sockets outlive the HTTP request that created them; they are
      * tracked so shutdown can drop them instead of waiting for a long lived
@@ -52,12 +67,12 @@ export declare class GatewayProxy {
      * (oven-sh/bun#28396), so waiting forever would block gateway restarts.
      */
     private closeServer;
+    private ingressListenEndpoint;
     private handleRequest;
     private isApiWebProductPath;
     private shouldRouteToApi;
     private pathnameFromRequestUrl;
     private applyInternalAdminProxyHeaders;
-    private verifiedInternalPodProxyHeaders;
     private isApiHost;
     private configuredApiHosts;
     private hostsFromUrlList;
@@ -78,6 +93,15 @@ export declare class GatewayProxy {
      * Add CORS headers matching CSS CorsHandler configuration
      */
     private addCorsHeaders;
+    /**
+     * Whether this request carries operator authority.
+     *
+     * `/service/*` exposes logs and service control, so a caller that only reached the Gateway
+     * through a tunnel must not get it - whatever address it presents. A local caller counts, and
+     * so does a signed gateway admin proxy header, which is how the same machine proves it is the
+     * operator through a local forwarder.
+     */
+    private hasOperatorAuthority;
     private handleInternalApi;
     private isCssReady;
     private normalizeTarget;
@@ -102,4 +126,11 @@ export interface GatewayProxyOptions {
      * client socket at all.
      */
     nativeUpgradeRelay?: boolean;
+    /**
+     * Port for the loopback-only ingress listener that remote forwarding paths
+     * (managed tunnels, P2P data plane) use as their origin. Omit it when the
+     * Gateway has no remote ingress.
+     */
+    ingressPort?: number;
 }
+export declare function forwardedFromOutside(req: http.IncomingMessage): boolean;