@undefineds.co/xpod 0.4.13 → 0.4.15

package/dist/runtime/Proxy.js

@@ -4,8 +4,10 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.GatewayProxy = void 0;
+exports.forwardedFromOutside = forwardedFromOutside;
 const http_proxy_1 = __importDefault(require("http-proxy"));
 const http_1 = __importDefault(require("http"));
+const node_net_1 = require("node:net");
 const global_logger_factory_1 = require("global-logger-factory");
 const NodeRuntimeHost_1 = require("./host/node/NodeRuntimeHost");
 const GatewayAdminProxyAuth_1 = require("./GatewayAdminProxyAuth");
@@ -58,6 +60,7 @@ class GatewayProxy {
         this.baseUrl = options.baseUrl;
         this.internalAdminAuthSecret = options.internalAdminAuthSecret;
         this.clientRemoteAddressResolver = options.clientRemoteAddressResolver;
+        this.ingressPort = options.ingressPort;
         this.proxy = http_proxy_1.default.createProxyServer({
             xfwd: true,
         });
@@ -87,14 +90,26 @@ class GatewayProxy {
                 outgoing.end(rewritten.body);
             });
         });
-        this.server = http_1.default.createServer(this.handleRequest.bind(this));
+        this.server = this.createListener(false);
+        if (this.ingressPort !== undefined) {
+            this.ingressServer = this.createListener(true);
+        }
         if (options.nativeUpgradeRelay ?? isBunRuntime()) {
             this.nativeUpgradeRelay = new BunNativeUpgradeRelay_1.BunNativeUpgradeRelay({
                 logger: this.logger,
                 fallback: (req, socket, head, target) => this.relayUpgradeWithHttpProxy(req, socket, head, target),
             });
         }
-        this.server.on('upgrade', (req, socket, head) => {
+    }
+    /**
+     * Builds one HTTP listener plus its WebSocket routing.
+     *
+     * `untrustedIngress` marks the listener that tunnels and the P2P data plane
+     * connect to; see `ingressPort`.
+     */
+    createListener(untrustedIngress) {
+        const server = http_1.default.createServer((req, res) => this.handleRequest(req, res, untrustedIngress));
+        server.on('upgrade', (req, socket, head) => {
             this.trackUpgradeSocket(socket);
             const target = this.resolveUpgradeTarget(req.url ?? '/');
             if (!target) {
@@ -107,6 +122,7 @@ class GatewayProxy {
             }
             this.relayUpgradeWithHttpProxy(req, socket, head, target);
         });
+        return server;
     }
     /**
      * Upgraded sockets outlive the HTTP request that created them; they are
@@ -143,6 +159,10 @@ class GatewayProxy {
     async start() {
         await this.runtimeHost.listen(this.server, this.listenEndpoint);
         this.logger.info(`Listening on ${this.runtimeHost.formatListenEndpoint(this.listenEndpoint)}`);
+        if (this.ingressServer) {
+            await this.runtimeHost.listen(this.ingressServer, this.ingressListenEndpoint());
+            this.logger.info(`Ingress listener on 127.0.0.1:${this.ingressPort} (never local)`);
+        }
     }
     async stop() {
         this.nativeUpgradeRelay?.close();
@@ -153,7 +173,10 @@ class GatewayProxy {
         }
         this.upgradeSockets.clear();
         this.proxy.close();
-        await this.closeServer();
+        await this.closeServer(this.server, this.listenEndpoint);
+        if (this.ingressServer) {
+            await this.closeServer(this.ingressServer, this.ingressListenEndpoint());
+        }
     }
     /**
      * Closes the listener with a bounded wait.
@@ -164,8 +187,8 @@ class GatewayProxy {
      * back once a WebSocket was closed from the server side
      * (oven-sh/bun#28396), so waiting forever would block gateway restarts.
      */
-    async closeServer() {
-        const closing = this.runtimeHost.close(this.server, this.listenEndpoint);
+    async closeServer(server, endpoint) {
+        const closing = this.runtimeHost.close(server, endpoint);
         let timer;
         const timedOut = await Promise.race([
             closing.then(() => false),
@@ -182,7 +205,10 @@ class GatewayProxy {
             void closing.catch(() => undefined);
         }
     }
-    handleRequest(req, res) {
+    ingressListenEndpoint() {
+        return this.runtimeHost.createListenEndpoint({ port: this.ingressPort, host: '127.0.0.1' });
+    }
+    handleRequest(req, res, untrustedIngress = false) {
         const url = req.url ?? '/';
         // Route matching must ignore the query string: OIDC callbacks and other
         // product URLs arrive as `/ai-connections?code=...`, and exact-path
@@ -190,12 +216,15 @@ class GatewayProxy {
         const pathname = url.split('?')[0];
         const origin = req.headers.origin;
         const originalRemoteAddress = this.clientRemoteAddressResolver?.(req) ?? req.socket.remoteAddress;
-        const originalClientLoopback = (0, GatewayAdminProxyAuth_1.isLoopbackRemoteAddress)(originalRemoteAddress);
-        const internalPodProxyHeaders = this.verifiedInternalPodProxyHeaders(req, originalClientLoopback);
+        // A loopback peer address only proves the connection came from this machine: tunnels and
+        // the P2P data plane terminate here too. Forwarded-for is what separates them - a local
+        // dev proxy forwards this machine's address, while a provider edge appends the address it
+        // saw, so a request whose right-most forwarder is not loopback came from outside and is
+        // never local, whatever its peer address or headers say.
+        const originalClientLoopback = !untrustedIngress
+            && !forwardedFromOutside(req)
+            && (0, GatewayAdminProxyAuth_1.isLoopbackRemoteAddress)(originalRemoteAddress);
         (0, GatewayAdminProxyAuth_1.stripGatewayAdminProxyHeaders)(req.headers);
-        if (internalPodProxyHeaders) {
-            Object.assign(req.headers, internalPodProxyHeaders);
-        }
         // Store public host for routing before any CSS canonical-host rewrites.
         // External gateways pass the original domain through X-Forwarded-Host;
         // direct/local requests use Host.
@@ -275,7 +304,7 @@ class GatewayProxy {
             if (origin) {
                 this.addCorsHeaders(res, origin);
             }
-            void this.handleInternalApi(req, res);
+            void this.handleInternalApi(req, res, this.hasOperatorAuthority(req, originalClientLoopback));
             return;
         }
         // 2. API Server Routing.
@@ -360,24 +389,6 @@ class GatewayProxy {
             originalClientLoopback,
         }));
     }
-    verifiedInternalPodProxyHeaders(req, originalClientLoopback) {
-        if (!originalClientLoopback || req.url !== '/.internal/pod-data') {
-            return undefined;
-        }
-        const verification = (0, GatewayAdminProxyAuth_1.verifyGatewayAdminProxyHeaders)({
-            headers: req.headers,
-            secret: this.internalAdminAuthSecret,
-            method: req.method,
-            url: req.url,
-        });
-        if (!verification.valid || !verification.originalClientLoopback || !verification.intent || !verification.nonce) {
-            return undefined;
-        }
-        return Object.fromEntries(GatewayAdminProxyAuth_1.GATEWAY_ADMIN_PROXY_HEADERS.flatMap((header) => {
-            const value = req.headers[header];
-            return value === undefined ? [] : [[header, value]];
-        }));
-    }
     isApiHost(hostHeader) {
         const host = this.normalizeHost(hostHeader);
         if (!host) {
@@ -552,11 +563,35 @@ class GatewayProxy {
         res.setHeader('Access-Control-Allow-Headers', CORS_CONFIG.allowedHeaders.join(', '));
         res.setHeader('Access-Control-Expose-Headers', CORS_CONFIG.exposedHeaders.join(', '));
     }
-    async handleInternalApi(req, res) {
+    /**
+     * Whether this request carries operator authority.
+     *
+     * `/service/*` exposes logs and service control, so a caller that only reached the Gateway
+     * through a tunnel must not get it - whatever address it presents. A local caller counts, and
+     * so does a signed gateway admin proxy header, which is how the same machine proves it is the
+     * operator through a local forwarder.
+     */
+    hasOperatorAuthority(req, originalClientLoopback) {
+        if (originalClientLoopback) {
+            return true;
+        }
+        if (!this.internalAdminAuthSecret) {
+            return false;
+        }
+        const verification = (0, GatewayAdminProxyAuth_1.verifyGatewayAdminProxyHeaders)({
+            headers: req.headers,
+            secret: this.internalAdminAuthSecret,
+            method: req.method,
+            url: req.url,
+        });
+        return verification.valid;
+    }
+    async handleInternalApi(req, res, operatorAuthorized) {
         try {
             const reqUrl = req.url ?? '/';
             const parsed = new URL(reqUrl, 'http://localhost');
             const pathname = parsed.pathname;
+            // Status is the entry probe every client uses, and it carries no secrets.
             if (pathname === '/service/status') {
                 const status = this.supervisor.getAllStatus();
                 const cssReady = await this.isCssReady();
@@ -566,6 +601,10 @@ class GatewayProxy {
                 return;
             }
             if (pathname === '/service/logs') {
+                if (!operatorAuthorized) {
+                    sendOperatorRequired(res);
+                    return;
+                }
                 const level = parsed.searchParams.get('level') ?? undefined;
                 const source = parsed.searchParams.get('source') ?? undefined;
                 const limitValue = parsed.searchParams.get('limit');
@@ -581,6 +620,10 @@ class GatewayProxy {
             }
             const restartMatch = /^\/service\/restart\/([^/]+)$/.exec(pathname);
             if (restartMatch && req.method === 'POST') {
+                if (!operatorAuthorized) {
+                    sendOperatorRequired(res);
+                    return;
+                }
                 const service = decodeURIComponent(restartMatch[1]);
                 if (service === 'gateway') {
                     res.writeHead(409, { 'Content-Type': 'application/json' });
@@ -603,6 +646,10 @@ class GatewayProxy {
                 return;
             }
             if (pathname === '/service/stop' && req.method === 'POST') {
+                if (!operatorAuthorized) {
+                    sendOperatorRequired(res);
+                    return;
+                }
                 res.writeHead(200, { 'Content-Type': 'application/json' });
                 res.end(JSON.stringify({ ok: true }));
                 setImmediate(() => {
@@ -655,4 +702,51 @@ exports.GatewayProxy = GatewayProxy;
 function isBunRuntime() {
     return typeof globalThis.Bun !== 'undefined';
 }
+/**
+ * Whether the client-address headers say this request travelled through a forwarder outside
+ * this machine.
+ *
+ * This is the fallback behind the structural gate (the Gateway's tunnel entry listener): a
+ * tunnel pointed at the Gateway port by mistake still must not inherit local trust. Only
+ * headers that carry a client *address* count - `x-forwarded-for`, `x-real-ip` and the
+ * `for=` part of `Forwarded`. `x-forwarded-host`/`x-forwarded-proto` do not: a local dev proxy
+ * sets them for local browsers too, so treating them as evidence would lock the operator out
+ * of their own admin surface.
+ *
+ * The right-most value is the address the last forwarder saw - the one our own handlers append
+ * (`ClusterIngressRouter`, `EdgeNodeProxyHttpHandler`, `PodRoutingHttpHandler`) - so a client
+ * cannot look local by sending its own. An unreadable value is treated as remote.
+ */
+/** Service control and logs are for the operator, not for whoever reached the entry. */
+function sendOperatorRequired(res) {
+    res.writeHead(403, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error: 'Operator access required' }));
+}
+function forwardedFromOutside(req) {
+    const evidence = [
+        ...splitHeaderList(req.headers['x-forwarded-for']),
+        ...splitHeaderList(req.headers['x-real-ip']),
+        ...forwardedForParameters(req.headers.forwarded),
+    ];
+    const last = evidence.at(-1);
+    if (last === undefined) {
+        return false;
+    }
+    return (0, node_net_1.isIP)(last) === 0 || !(0, GatewayAdminProxyAuth_1.isLoopbackRemoteAddress)(last);
+}
+function splitHeaderList(raw) {
+    const value = Array.isArray(raw) ? raw.join(',') : raw;
+    return value?.split(',').map((entry) => entry.trim()).filter(Boolean) ?? [];
+}
+/** The `for=` values of an RFC 7239 `Forwarded` header, in order. */
+function forwardedForParameters(raw) {
+    const value = Array.isArray(raw) ? raw.join(',') : raw;
+    if (!value) {
+        return [];
+    }
+    return value.split(/[;,]/u)
+        .map((part) => /^\s*for\s*=\s*(.+)$/iu.exec(part.trim())?.[1])
+        .filter((entry) => Boolean(entry))
+        .map((entry) => entry.replace(/^"|"$/gu, '').replace(/^\[|\]$/gu, ''));
+}
 //# sourceMappingURL=Proxy.js.map

package/dist/runtime/bootstrap.d.ts

@@ -25,9 +25,30 @@ export interface RuntimeBootstrapState {
     ports: XpodRuntimePorts;
     sockets: XpodRuntimeSockets;
 }
+/**
+ * Address that a co-located runtime service must be reached on when it was bound
+ * to `bindHost`. Wildcard binds are not connectable on every platform, so they
+ * map to their loopback counterpart; any other value (including a hostname such
+ * as `localhost`, which may resolve to IPv6 only) is used as-is, because the
+ * gateway must connect to the very address the service actually bound.
+ */
+export declare function connectHostForBindHost(bindHost?: string): string;
+/** Loopback URL for a runtime service bound to `bindHost`. */
+export declare function localServiceUrl(bindHost: string | undefined, port: number): string;
 export declare function cssAuthModeConfigImports(authMode: AuthMode): string[];
 export declare function resolveRuntimeBootstrap(id: string, options: XpodRuntimeOptions, host: RuntimeHost, platform?: RuntimePlatform): Promise<RuntimeBootstrapState>;
 export declare function buildRuntimeEnv(state: RuntimeBootstrapState, options: XpodRuntimeOptions, envFromFile?: Record<string, string | undefined>): Record<string, string | undefined>;
+/**
+ * Local endpoints the edge agent uses when it serves P2P peer traffic.
+ *
+ * `targetBaseUrl` is where forwarded peer requests are sent: the ingress listener,
+ * which the Gateway never treats as local. `lanBaseUrl` stays on the gateway
+ * listener because other devices on the LAN must be able to reach it.
+ */
+export declare function resolveP2PLocalBaseUrls(state: RuntimeBootstrapState): {
+    targetBaseUrl?: string;
+    lanBaseUrl?: string;
+};
 export declare function buildRuntimeShorthand(runtimeEnv: Record<string, string | undefined>, options: XpodRuntimeOptions, state: RuntimeBootstrapState, baseEnv?: Record<string, string | undefined>): Record<string, string | number | boolean>;
 export declare function createCssRuntimeConfig(state: RuntimeBootstrapState, _open?: boolean, platform?: Pick<RuntimePlatform, 'dirname' | 'ensureDir' | 'joinPath' | 'readTextFile' | 'writeTextFile'>): string;
 export declare function initRuntimeLogger(level: string, platform?: Pick<RuntimePlatform, 'cwd' | 'joinPath'>): void;

package/dist/runtime/bootstrap.js

@@ -3,9 +3,12 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.connectHostForBindHost = connectHostForBindHost;
+exports.localServiceUrl = localServiceUrl;
 exports.cssAuthModeConfigImports = cssAuthModeConfigImports;
 exports.resolveRuntimeBootstrap = resolveRuntimeBootstrap;
 exports.buildRuntimeEnv = buildRuntimeEnv;
+exports.resolveP2PLocalBaseUrls = resolveP2PLocalBaseUrls;
 exports.buildRuntimeShorthand = buildRuntimeShorthand;
 exports.createCssRuntimeConfig = createCssRuntimeConfig;
 exports.initRuntimeLogger = initRuntimeLogger;
@@ -34,6 +37,28 @@ function ensureTrailingSlash(url) {
 function publicHostForBindHost(bindHost) {
     return bindHost === '127.0.0.1' || bindHost === '::1' ? 'localhost' : bindHost;
 }
+/**
+ * Address that a co-located runtime service must be reached on when it was bound
+ * to `bindHost`. Wildcard binds are not connectable on every platform, so they
+ * map to their loopback counterpart; any other value (including a hostname such
+ * as `localhost`, which may resolve to IPv6 only) is used as-is, because the
+ * gateway must connect to the very address the service actually bound.
+ */
+function connectHostForBindHost(bindHost) {
+    const host = bindHost ?? '127.0.0.1';
+    if (host === '0.0.0.0') {
+        return '127.0.0.1';
+    }
+    if (host === '::' || host === '[::]' || host === '::0') {
+        return '::1';
+    }
+    return host;
+}
+/** Loopback URL for a runtime service bound to `bindHost`. */
+function localServiceUrl(bindHost, port) {
+    const host = connectHostForBindHost(bindHost);
+    return `http://${host.includes(':') ? `[${host}]` : host}:${port}`;
+}
 function normalizeWindowsAbsolutePath(filePath) {
     return filePath.replace(/^[\\/]+(?=[A-Za-z]:[\\/])/, '');
 }
@@ -204,6 +229,7 @@ function buildRuntimeEnv(state, options, envFromFile = {}) {
         API_HOST: state.bindHost,
         API_SOCKET_PATH: state.sockets.api,
         XPOD_MAIN_PORT: state.ports.gateway !== undefined ? String(state.ports.gateway) : undefined,
+        XPOD_GATEWAY_INGRESS_PORT: state.ports.ingress !== undefined ? String(state.ports.ingress) : undefined,
         XPOD_GATEWAY_ADMIN_PROXY_AUTH_SECRET: state.gatewayAdminProxyAuthSecret,
         // Auto-provision may write these during API startup. Include them even when
         // undefined so RuntimeEnvironmentSession can restore/clear them afterwards.
@@ -222,11 +248,28 @@ function buildRuntimeEnv(state, options, envFromFile = {}) {
     };
     return (0, AuthMode_1.applyAuthModeEnv)(runtimeEnv, state.cssAuthMode);
 }
+/**
+ * Local endpoints the edge agent uses when it serves P2P peer traffic.
+ *
+ * `targetBaseUrl` is where forwarded peer requests are sent: the ingress listener,
+ * which the Gateway never treats as local. `lanBaseUrl` stays on the gateway
+ * listener because other devices on the LAN must be able to reach it.
+ */
+function resolveP2PLocalBaseUrls(state) {
+    if (state.transport !== 'port' || state.ports.gateway === undefined) {
+        return {};
+    }
+    return {
+        targetBaseUrl: state.ports.ingress === undefined ? undefined : `http://127.0.0.1:${state.ports.ingress}/`,
+        lanBaseUrl: `http://127.0.0.1:${state.ports.gateway}/`,
+    };
+}
 function buildRuntimeShorthand(runtimeEnv, options, state, baseEnv = NodeRuntimePlatform_1.nodeRuntimePlatform.baseEnv) {
     const envValue = (key) => runtimeEnv[key] ?? baseEnv[key];
     const externalOidcIssuer = (0, oidc_issuer_1.resolveExternalOidcIssuer)({
         SOLID_OIDC_ISSUER: envValue('SOLID_OIDC_ISSUER'),
     });
+    const p2pLocalBaseUrls = resolveP2PLocalBaseUrls(state);
     return {
         ...withDefinedEntries([
             ['baseStorageDomain', envValue('CSS_BASE_STORAGE_DOMAIN')],
@@ -249,7 +292,8 @@ function buildRuntimeShorthand(runtimeEnv, options, state, baseEnv = NodeRuntime
             ['nodeId', envValue('XPOD_NODE_ID')],
             ['nodeToken', envValue('XPOD_NODE_TOKEN')],
             ['p2pEnabled', envValue('XPOD_P2P_ENABLED')],
-            ['p2pTargetBaseUrl', envValue('XPOD_P2P_TARGET_BASE_URL')],
+            ['p2pTargetBaseUrl', envValue('XPOD_P2P_TARGET_BASE_URL') ?? p2pLocalBaseUrls.targetBaseUrl],
+            ['p2pLanBaseUrl', envValue('XPOD_P2P_LAN_BASE_URL') ?? p2pLocalBaseUrls.lanBaseUrl],
             ['p2pLabel', envValue('XPOD_P2P_LABEL')],
             ['p2pAcceptIntervalMs', envValue('XPOD_P2P_ACCEPT_INTERVAL_MS')],
             ['p2pConnectTimeoutMs', envValue('XPOD_P2P_CONNECT_TIMEOUT_MS')],

package/dist/runtime/css-process.d.ts

@@ -30,6 +30,7 @@ export declare function buildApiChildEnv(options: {
     apiPort: number;
     mainPort: number;
     cssPort: number;
+    ingressPort?: number;
     baseUrl: string;
     rdfIndexPath?: string;
     authMode?: AuthMode | string;

package/dist/runtime/css-process.js

@@ -271,6 +271,7 @@ function buildApiChildEnv(options) {
         ...(options.externalOidcIssuer ? { oidcIssuer: options.externalOidcIssuer } : {}),
         API_PORT: options.apiPort.toString(),
         XPOD_MAIN_PORT: options.mainPort.toString(),
+        ...(options.ingressPort !== undefined ? { XPOD_GATEWAY_INGRESS_PORT: options.ingressPort.toString() } : {}),
         CSS_PORT: options.cssPort.toString(),
         CSS_BASE_URL: baseUrl,
         ...(options.gatewayAdminProxyAuthSecret ? { XPOD_GATEWAY_ADMIN_PROXY_AUTH_SECRET: options.gatewayAdminProxyAuthSecret } : {}),

package/dist/runtime/host/node/NodeRuntimeHost.js

@@ -23,7 +23,12 @@ class NodeRuntimeHost {
         const gateway = options.gatewayPort ?? await (0, port_finder_1.getFreePort)(options.basePort ?? 5600);
         const css = options.cssPort ?? await (0, port_finder_1.getFreePort)(gateway + 1);
         const api = options.apiPort ?? await (0, port_finder_1.getFreePort)(css + 1);
-        return { gateway, css, api };
+        // Tunnels (and the P2P data plane) terminate here, and this listener never treats a
+        // caller as local whatever headers it carries - that is the gate. Its port is the one
+        // number the user copies into a provider console, so it is predictable rather than
+        // random, and it is what the runtime reports as the tunnel origin.
+        const ingress = options.ingressPort ?? await (0, port_finder_1.findGatewayIngressPort)(gateway);
+        return { gateway, css, api, ingress };
     }
     createListenEndpoint(options) {
         if (options.socketPath) {

package/dist/runtime/host/types.d.ts

@@ -24,12 +24,18 @@ export interface RuntimePortAllocationOptions {
     gatewayPort?: number;
     cssPort?: number;
     apiPort?: number;
+    ingressPort?: number;
     basePort?: number;
 }
 export interface RuntimePorts {
     gateway: number;
     css: number;
     api: number;
+    /**
+     * Loopback-only listener that remote forwarding paths (managed tunnels, P2P
+     * data plane) use as their origin, so their requests never count as local.
+     */
+    ingress: number;
 }
 export interface RuntimeHost {
     readonly name: string;

package/dist/runtime/index.d.ts

@@ -10,7 +10,7 @@ export { createOpenAuthContext, registerManagedRuntimeServices, startApiRuntime,
 export type { RuntimeServices } from './lifecycle';
 export { GatewayProxy } from './Proxy';
 export { createGatewayAdminProxyAuthSecret } from './GatewayAdminProxyAuth';
-export { getFreePort, getFreePortForWildcard } from './port-finder';
+export { findGatewayIngressPort, getEphemeralLoopbackPort, getFreePort, getFreePortForWildcard, requireFreePortForWildcard } from './port-finder';
 export { ensureTrailingSlash, INVALID_CONFIGURATION_PREFIX, validateBaseUrl } from './base-url';
 export type { ValidateBaseUrlOptions } from './base-url';
 export { applyEnv, loadEnvFile } from './env-utils';

package/dist/runtime/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.startXpodRuntime = exports.nodeGatewayRuntimeRunner = exports.NodeGatewayRuntimeRunner = exports.nodeApiRuntimeRunner = exports.NodeApiRuntimeRunner = exports.communitySolidServerCssRunner = exports.CommunitySolidServerCssRunner = exports.registerSocketOriginShims = exports.registerSocketFetchOrigin = exports.nodeRuntimePlatform = exports.NodeRuntimePlatform = exports.nodeRuntimeHost = exports.NodeRuntimeHost = exports.resolveXpodEnvPath = exports.defaultXpodEnvPath = exports.loadEnvFile = exports.applyEnv = exports.validateBaseUrl = exports.INVALID_CONFIGURATION_PREFIX = exports.ensureTrailingSlash = exports.getFreePortForWildcard = exports.getFreePort = exports.createGatewayAdminProxyAuthSecret = exports.GatewayProxy = exports.stopRuntimeServices = exports.startGatewayRuntime = exports.startCssRuntime = exports.startApiRuntime = exports.registerManagedRuntimeServices = exports.createOpenAuthContext = exports.createRuntimeEnvironmentSession = exports.nodeRuntimeDriver = exports.NodeRuntimeDriver = exports.resolveRuntimeBootstrap = exports.initRuntimeLogger = exports.createCssRuntimeConfig = exports.buildRuntimeShorthand = exports.buildRuntimeEnv = exports.ensureBunUndiciCompat = exports.findPackageRoot = exports.PACKAGE_ROOT = void 0;
+exports.startXpodRuntime = exports.nodeGatewayRuntimeRunner = exports.NodeGatewayRuntimeRunner = exports.nodeApiRuntimeRunner = exports.NodeApiRuntimeRunner = exports.communitySolidServerCssRunner = exports.CommunitySolidServerCssRunner = exports.registerSocketOriginShims = exports.registerSocketFetchOrigin = exports.nodeRuntimePlatform = exports.NodeRuntimePlatform = exports.nodeRuntimeHost = exports.NodeRuntimeHost = exports.resolveXpodEnvPath = exports.defaultXpodEnvPath = exports.loadEnvFile = exports.applyEnv = exports.validateBaseUrl = exports.INVALID_CONFIGURATION_PREFIX = exports.ensureTrailingSlash = exports.requireFreePortForWildcard = exports.getFreePortForWildcard = exports.getFreePort = exports.getEphemeralLoopbackPort = exports.findGatewayIngressPort = exports.createGatewayAdminProxyAuthSecret = exports.GatewayProxy = exports.stopRuntimeServices = exports.startGatewayRuntime = exports.startCssRuntime = exports.startApiRuntime = exports.registerManagedRuntimeServices = exports.createOpenAuthContext = exports.createRuntimeEnvironmentSession = exports.nodeRuntimeDriver = exports.NodeRuntimeDriver = exports.resolveRuntimeBootstrap = exports.initRuntimeLogger = exports.createCssRuntimeConfig = exports.buildRuntimeShorthand = exports.buildRuntimeEnv = exports.ensureBunUndiciCompat = exports.findPackageRoot = exports.PACKAGE_ROOT = void 0;
 require("./configure-drizzle-solid");
 var package_root_1 = require("./package-root");
 Object.defineProperty(exports, "PACKAGE_ROOT", { enumerable: true, get: function () { return package_root_1.PACKAGE_ROOT; } });
@@ -30,8 +30,11 @@ Object.defineProperty(exports, "GatewayProxy", { enumerable: true, get: function
 var GatewayAdminProxyAuth_1 = require("./GatewayAdminProxyAuth");
 Object.defineProperty(exports, "createGatewayAdminProxyAuthSecret", { enumerable: true, get: function () { return GatewayAdminProxyAuth_1.createGatewayAdminProxyAuthSecret; } });
 var port_finder_1 = require("./port-finder");
+Object.defineProperty(exports, "findGatewayIngressPort", { enumerable: true, get: function () { return port_finder_1.findGatewayIngressPort; } });
+Object.defineProperty(exports, "getEphemeralLoopbackPort", { enumerable: true, get: function () { return port_finder_1.getEphemeralLoopbackPort; } });
 Object.defineProperty(exports, "getFreePort", { enumerable: true, get: function () { return port_finder_1.getFreePort; } });
 Object.defineProperty(exports, "getFreePortForWildcard", { enumerable: true, get: function () { return port_finder_1.getFreePortForWildcard; } });
+Object.defineProperty(exports, "requireFreePortForWildcard", { enumerable: true, get: function () { return port_finder_1.requireFreePortForWildcard; } });
 var base_url_1 = require("./base-url");
 Object.defineProperty(exports, "ensureTrailingSlash", { enumerable: true, get: function () { return base_url_1.ensureTrailingSlash; } });
 Object.defineProperty(exports, "INVALID_CONFIGURATION_PREFIX", { enumerable: true, get: function () { return base_url_1.INVALID_CONFIGURATION_PREFIX; } });

package/dist/runtime/js-runtime.js

@@ -19,8 +19,15 @@ function findBunExecutable() {
     return result.status === 0 ? result.stdout.trim() || undefined : undefined;
 }
 function jsEntrypointArgs(entrypoint, isBun) {
-    return !isBun && entrypoint.endsWith('.ts')
-        ? ['-r', require.resolve('ts-node/register/transpile-only'), entrypoint]
-        : [entrypoint];
+    if (!isBun) {
+        return entrypoint.endsWith('.ts')
+            ? ['-r', require.resolve('ts-node/register/transpile-only'), entrypoint]
+            : [entrypoint];
+    }
+    // A child service runs on the environment its parent decided for it. Without this, Bun loads
+    // whichever .env files happen to sit in the child's cwd, so a checkout's developer env files
+    // leak into a runtime that was started standalone (`bun run local` already loads them once, for
+    // the parent, on purpose).
+    return ['--no-env-file', entrypoint];
 }
 //# sourceMappingURL=js-runtime.js.map

package/dist/runtime/lifecycle.js

@@ -7,6 +7,7 @@ exports.startApiRuntime = startApiRuntime;
 exports.startGatewayRuntime = startGatewayRuntime;
 exports.stopRuntimeServices = stopRuntimeServices;
 const package_root_1 = require("./package-root");
+const bootstrap_1 = require("./bootstrap");
 const RedisClientLifecycle_1 = require("../storage/redis/RedisClientLifecycle");
 const DEFAULT_SERVICE_STOP_TIMEOUT_MS = 5_000;
 async function stopWithTimeout(name, stop, timeoutMs) {
@@ -80,7 +81,7 @@ async function startCssRuntime({ state, host, runtimeShorthand, supervisor, crea
     }
     else {
         await host.waitForPortReady(state.ports.css, '127.0.0.1');
-        supervisor.addLog('css', 'info', `CSS started (http://127.0.0.1:${state.ports.css})`);
+        supervisor.addLog('css', 'info', `CSS started (${(0, bootstrap_1.localServiceUrl)(state.bindHost, state.ports.css)})`);
     }
     supervisor.setStatus('css', 'running', { startTime: Date.now() });
     return cssApp;
@@ -92,7 +93,7 @@ async function startApiRuntime({ state, host, supervisor, authContext, apiRunner
         authContext: createOpenAuthContext(state.canonicalBaseUrl ?? state.baseUrl, authContext),
         runtimeHost: host,
     });
-    supervisor.addLog('api', 'info', `API started (${state.transport === 'socket' ? `unix://${state.sockets.api}` : `http://127.0.0.1:${state.ports.api}`})`);
+    supervisor.addLog('api', 'info', `API started (${state.transport === 'socket' ? `unix://${state.sockets.api}` : (0, bootstrap_1.localServiceUrl)(state.bindHost, state.ports.api)})`);
     supervisor.setStatus('api', 'running', { startTime: Date.now() });
     return apiService;
 }
@@ -108,9 +109,10 @@ async function startGatewayRuntime({ state, host, supervisor, shutdownHandler, g
         supervisor,
         internalAdminAuthSecret: state.gatewayAdminProxyAuthSecret,
         clientRemoteAddressResolver,
+        ingressPort: state.ports.ingress,
         targets: {
-            css: state.transport === 'socket' ? { socketPath: state.sockets.css } : { url: `http://127.0.0.1:${state.ports.css}` },
-            api: state.transport === 'socket' ? { socketPath: state.sockets.api } : { url: `http://127.0.0.1:${state.ports.api}` },
+            css: state.transport === 'socket' ? { socketPath: state.sockets.css } : { url: (0, bootstrap_1.localServiceUrl)(state.bindHost, state.ports.css) },
+            api: state.transport === 'socket' ? { socketPath: state.sockets.api } : { url: (0, bootstrap_1.localServiceUrl)(state.bindHost, state.ports.api) },
         },
     });
     supervisor.addLog('xpod', 'info', `Gateway started (${state.transport === 'socket' ? `unix://${state.sockets.gateway}` : state.baseUrl})`);

package/dist/runtime/port-finder.d.ts

@@ -1,7 +1,33 @@
+/**
+ * The port a remote tunnel forwards to: the Gateway's tunnel entry.
+ *
+ * It sits a few ports above the Gateway so it is predictable - the user copies this one number
+ * into a provider console and it survives restarts - while staying clear of the block a
+ * neighbouring runtime plans for its own services. When the neighbourhood is busy the caller
+ * gets an OS-assigned port instead of a stolen one; the runtime reports whichever it got.
+ */
+export declare function findGatewayIngressPort(gatewayPort: number): Promise<number>;
 export declare function getFreePort(basePort: number, host?: string, timeoutMs?: number): Promise<number>;
+/**
+ * Loopback port handed out by the OS for a listener that must not collide with ports the
+ * embedding process plans for other services.
+ *
+ * Probing next to the ports this runtime already owns is not safe: a host that allocates
+ * `gateway + 10`/`gateway + 11` (the full integration matrix does) has already reserved
+ * the neighbour of our own `api` port for another runtime, and binding it steals that
+ * runtime's service.
+ */
+export declare function getEphemeralLoopbackPort(): Promise<number>;
 /**
  * Allocates a port for child services that bind wildcard addresses.
  * CSS may bind `::` while the API binds `0.0.0.0`, so probing only localhost
  * can miss an occupied port on the other address family.
  */
+/**
+ * Takes exactly this port or fails.
+ *
+ * A port that a tunnel console forwards to cannot be substituted: `getFreePortForWildcard`
+ * scans upward, which would leave the runtime listening somewhere the tunnel never reaches.
+ */
+export declare function requireFreePortForWildcard(port: number, timeoutMs?: number): Promise<number>;
 export declare function getFreePortForWildcard(basePort: number, timeoutMs?: number): Promise<number>;