@undefineds.co/xpod 0.4.14 → 0.4.15

package/dist/runtime/GatewayAdminProxyAuth.js

@@ -1,24 +1,21 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.GATEWAY_ADMIN_PROXY_HEADERS = exports.GATEWAY_ADMIN_PROXY_NONCE_HEADER = exports.GATEWAY_ADMIN_PROXY_INTENT_HEADER = exports.GATEWAY_ADMIN_PROXY_SIGNATURE_HEADER = exports.GATEWAY_ADMIN_PROXY_TIMESTAMP_HEADER = exports.GATEWAY_ADMIN_PROXY_LOOPBACK_HEADER = void 0;
+exports.GATEWAY_ADMIN_PROXY_HEADERS = exports.GATEWAY_ADMIN_PROXY_NONCE_HEADER = exports.GATEWAY_ADMIN_PROXY_SIGNATURE_HEADER = exports.GATEWAY_ADMIN_PROXY_TIMESTAMP_HEADER = exports.GATEWAY_ADMIN_PROXY_LOOPBACK_HEADER = void 0;
 exports.createGatewayAdminProxyAuthSecret = createGatewayAdminProxyAuthSecret;
 exports.createGatewayAdminProxyHeaders = createGatewayAdminProxyHeaders;
 exports.stripGatewayAdminProxyHeaders = stripGatewayAdminProxyHeaders;
 exports.isLoopbackRemoteAddress = isLoopbackRemoteAddress;
 exports.verifyGatewayAdminProxyHeaders = verifyGatewayAdminProxyHeaders;
-exports.canonicalGatewayAdminProxyIntent = canonicalGatewayAdminProxyIntent;
 const node_crypto_1 = require("node:crypto");
 const node_net_1 = require("node:net");
 exports.GATEWAY_ADMIN_PROXY_LOOPBACK_HEADER = 'x-xpod-admin-proxy-loopback';
 exports.GATEWAY_ADMIN_PROXY_TIMESTAMP_HEADER = 'x-xpod-admin-proxy-timestamp';
 exports.GATEWAY_ADMIN_PROXY_SIGNATURE_HEADER = 'x-xpod-admin-proxy-signature';
-exports.GATEWAY_ADMIN_PROXY_INTENT_HEADER = 'x-xpod-admin-proxy-intent';
 exports.GATEWAY_ADMIN_PROXY_NONCE_HEADER = 'x-xpod-admin-proxy-nonce';
 exports.GATEWAY_ADMIN_PROXY_HEADERS = [
     exports.GATEWAY_ADMIN_PROXY_LOOPBACK_HEADER,
     exports.GATEWAY_ADMIN_PROXY_TIMESTAMP_HEADER,
     exports.GATEWAY_ADMIN_PROXY_SIGNATURE_HEADER,
-    exports.GATEWAY_ADMIN_PROXY_INTENT_HEADER,
     exports.GATEWAY_ADMIN_PROXY_NONCE_HEADER,
 ];
 const MAX_CLOCK_SKEW_MS = 60_000;
@@ -28,12 +25,10 @@ function createGatewayAdminProxyAuthSecret() {
 function createGatewayAdminProxyHeaders(input) {
     const issuedAt = input.issuedAt ?? Date.now();
     const loopback = input.originalClientLoopback ? '1' : '0';
-    const intent = input.intent ? canonicalGatewayAdminProxyIntent(input.intent) : undefined;
     return {
         [exports.GATEWAY_ADMIN_PROXY_LOOPBACK_HEADER]: loopback,
         [exports.GATEWAY_ADMIN_PROXY_TIMESTAMP_HEADER]: String(issuedAt),
         ...(input.nonce ? { [exports.GATEWAY_ADMIN_PROXY_NONCE_HEADER]: input.nonce } : {}),
-        ...(intent ? { [exports.GATEWAY_ADMIN_PROXY_INTENT_HEADER]: intent } : {}),
         [exports.GATEWAY_ADMIN_PROXY_SIGNATURE_HEADER]: signGatewayAdminProxyMarker({
             secret: input.secret,
             method: input.method,
@@ -41,7 +36,6 @@ function createGatewayAdminProxyHeaders(input) {
             loopback,
             issuedAt,
             nonce: input.nonce,
-            intent,
         }),
     };
 }
@@ -66,7 +60,6 @@ function verifyGatewayAdminProxyHeaders(input) {
     const timestamp = firstHeader(input.headers[exports.GATEWAY_ADMIN_PROXY_TIMESTAMP_HEADER]);
     const signature = firstHeader(input.headers[exports.GATEWAY_ADMIN_PROXY_SIGNATURE_HEADER]);
     const nonce = firstHeader(input.headers[exports.GATEWAY_ADMIN_PROXY_NONCE_HEADER]);
-    const intentHeader = firstHeader(input.headers[exports.GATEWAY_ADMIN_PROXY_INTENT_HEADER]);
     const present = loopback !== undefined || timestamp !== undefined || signature !== undefined;
     if (!present) {
         return { present: false, valid: false, originalClientLoopback: false };
@@ -87,10 +80,6 @@ function verifyGatewayAdminProxyHeaders(input) {
     if (Math.abs((input.now ?? Date.now()) - issuedAt) > MAX_CLOCK_SKEW_MS) {
         return { present: true, valid: false, originalClientLoopback: loopback === '1', reason: 'expired_marker' };
     }
-    const intent = parseGatewayAdminProxyIntent(intentHeader);
-    if (intentHeader !== undefined && !intent) {
-        return { present: true, valid: false, originalClientLoopback: loopback === '1', reason: 'invalid_intent' };
-    }
     const expected = signGatewayAdminProxyMarker({
         secret: input.secret,
         method: input.method,
@@ -98,12 +87,11 @@ function verifyGatewayAdminProxyHeaders(input) {
         loopback,
         issuedAt,
         nonce,
-        intent: intentHeader,
     });
     if (!safeEqual(signature, expected)) {
         return { present: true, valid: false, originalClientLoopback: loopback === '1', reason: 'bad_signature' };
     }
-    return { present: true, valid: true, originalClientLoopback: loopback === '1', nonce, intent };
+    return { present: true, valid: true, originalClientLoopback: loopback === '1', nonce };
 }
 function signGatewayAdminProxyMarker(input) {
     const payload = [
@@ -113,66 +101,9 @@ function signGatewayAdminProxyMarker(input) {
         input.loopback,
         String(input.issuedAt),
         input.nonce ?? '',
-        input.intent ?? '',
     ].join('\n');
     return (0, node_crypto_1.createHmac)('sha256', input.secret).update(payload).digest('base64url');
 }
-function canonicalGatewayAdminProxyIntent(intent) {
-    return JSON.stringify({
-        ownerWebId: intent.ownerWebId,
-        ...(intent.podBaseUrl ? { podBaseUrl: intent.podBaseUrl } : {}),
-        method: intent.method,
-        resourceUrl: intent.resourceUrl,
-        principalKind: intent.principalKind,
-        scopes: [...intent.scopes].sort(),
-        ...(intent.bodyDigest ? { bodyDigest: intent.bodyDigest } : {}),
-    });
-}
-function parseGatewayAdminProxyIntent(value) {
-    if (!value) {
-        return undefined;
-    }
-    try {
-        const parsed = JSON.parse(value);
-        if (typeof parsed.ownerWebId !== 'string' ||
-            typeof parsed.resourceUrl !== 'string' ||
-            (parsed.podBaseUrl !== undefined && !isHttpUrl(parsed.podBaseUrl)) ||
-            (parsed.method !== 'GET' && parsed.method !== 'HEAD' && parsed.method !== 'POST' && parsed.method !== 'PUT' && parsed.method !== 'PATCH' && parsed.method !== 'DELETE') ||
-            (parsed.principalKind !== 'solid-user' && parsed.principalKind !== 'gateway-key-verifier') ||
-            !Array.isArray(parsed.scopes) ||
-            !parsed.scopes.every((scope) => typeof scope === 'string') ||
-            (parsed.bodyDigest !== undefined && !isSha256Hex(parsed.bodyDigest)) ||
-            (parsed.method === 'POST' && !isSha256Hex(parsed.bodyDigest))) {
-            return undefined;
-        }
-        return {
-            ownerWebId: parsed.ownerWebId,
-            ...(parsed.podBaseUrl ? { podBaseUrl: parsed.podBaseUrl } : {}),
-            method: parsed.method,
-            resourceUrl: parsed.resourceUrl,
-            principalKind: parsed.principalKind,
-            scopes: parsed.scopes,
-            ...(parsed.bodyDigest ? { bodyDigest: parsed.bodyDigest } : {}),
-        };
-    }
-    catch {
-        return undefined;
-    }
-}
-function isHttpUrl(value) {
-    if (typeof value !== 'string')
-        return false;
-    try {
-        const url = new URL(value);
-        return url.protocol === 'http:' || url.protocol === 'https:';
-    }
-    catch {
-        return false;
-    }
-}
-function isSha256Hex(value) {
-    return typeof value === 'string' && /^[a-f0-9]{64}$/u.test(value);
-}
 function safeEqual(actual, expected) {
     const actualBuffer = Buffer.from(actual);
     const expectedBuffer = Buffer.from(expected);

package/dist/runtime/Proxy.d.ts

@@ -73,7 +73,6 @@ export declare class GatewayProxy {
     private shouldRouteToApi;
     private pathnameFromRequestUrl;
     private applyInternalAdminProxyHeaders;
-    private verifiedInternalPodProxyHeaders;
     private isApiHost;
     private configuredApiHosts;
     private hostsFromUrlList;
@@ -94,6 +93,15 @@ export declare class GatewayProxy {
      * Add CORS headers matching CSS CorsHandler configuration
      */
     private addCorsHeaders;
+    /**
+     * Whether this request carries operator authority.
+     *
+     * `/service/*` exposes logs and service control, so a caller that only reached the Gateway
+     * through a tunnel must not get it - whatever address it presents. A local caller counts, and
+     * so does a signed gateway admin proxy header, which is how the same machine proves it is the
+     * operator through a local forwarder.
+     */
+    private hasOperatorAuthority;
     private handleInternalApi;
     private isCssReady;
     private normalizeTarget;
@@ -125,3 +133,4 @@ export interface GatewayProxyOptions {
      */
     ingressPort?: number;
 }
+export declare function forwardedFromOutside(req: http.IncomingMessage): boolean;

package/dist/runtime/Proxy.js

@@ -4,8 +4,10 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.GatewayProxy = void 0;
+exports.forwardedFromOutside = forwardedFromOutside;
 const http_proxy_1 = __importDefault(require("http-proxy"));
 const http_1 = __importDefault(require("http"));
+const node_net_1 = require("node:net");
 const global_logger_factory_1 = require("global-logger-factory");
 const NodeRuntimeHost_1 = require("./host/node/NodeRuntimeHost");
 const GatewayAdminProxyAuth_1 = require("./GatewayAdminProxyAuth");
@@ -214,15 +216,15 @@ class GatewayProxy {
         const pathname = url.split('?')[0];
         const origin = req.headers.origin;
         const originalRemoteAddress = this.clientRemoteAddressResolver?.(req) ?? req.socket.remoteAddress;
-        // A loopback peer address only proves the connection came from this machine. Managed
-        // tunnels and the P2P data plane terminate here too, so anything that arrived through
-        // a remote forwarding path is never local, whatever its peer address or headers say.
-        const originalClientLoopback = !untrustedIngress && (0, GatewayAdminProxyAuth_1.isLoopbackRemoteAddress)(originalRemoteAddress);
-        const internalPodProxyHeaders = this.verifiedInternalPodProxyHeaders(req, originalClientLoopback);
+        // A loopback peer address only proves the connection came from this machine: tunnels and
+        // the P2P data plane terminate here too. Forwarded-for is what separates them - a local
+        // dev proxy forwards this machine's address, while a provider edge appends the address it
+        // saw, so a request whose right-most forwarder is not loopback came from outside and is
+        // never local, whatever its peer address or headers say.
+        const originalClientLoopback = !untrustedIngress
+            && !forwardedFromOutside(req)
+            && (0, GatewayAdminProxyAuth_1.isLoopbackRemoteAddress)(originalRemoteAddress);
         (0, GatewayAdminProxyAuth_1.stripGatewayAdminProxyHeaders)(req.headers);
-        if (internalPodProxyHeaders) {
-            Object.assign(req.headers, internalPodProxyHeaders);
-        }
         // Store public host for routing before any CSS canonical-host rewrites.
         // External gateways pass the original domain through X-Forwarded-Host;
         // direct/local requests use Host.
@@ -302,7 +304,7 @@ class GatewayProxy {
             if (origin) {
                 this.addCorsHeaders(res, origin);
             }
-            void this.handleInternalApi(req, res);
+            void this.handleInternalApi(req, res, this.hasOperatorAuthority(req, originalClientLoopback));
             return;
         }
         // 2. API Server Routing.
@@ -387,24 +389,6 @@ class GatewayProxy {
             originalClientLoopback,
         }));
     }
-    verifiedInternalPodProxyHeaders(req, originalClientLoopback) {
-        if (!originalClientLoopback || req.url !== '/.internal/pod-data') {
-            return undefined;
-        }
-        const verification = (0, GatewayAdminProxyAuth_1.verifyGatewayAdminProxyHeaders)({
-            headers: req.headers,
-            secret: this.internalAdminAuthSecret,
-            method: req.method,
-            url: req.url,
-        });
-        if (!verification.valid || !verification.originalClientLoopback || !verification.intent || !verification.nonce) {
-            return undefined;
-        }
-        return Object.fromEntries(GatewayAdminProxyAuth_1.GATEWAY_ADMIN_PROXY_HEADERS.flatMap((header) => {
-            const value = req.headers[header];
-            return value === undefined ? [] : [[header, value]];
-        }));
-    }
     isApiHost(hostHeader) {
         const host = this.normalizeHost(hostHeader);
         if (!host) {
@@ -579,11 +563,35 @@ class GatewayProxy {
         res.setHeader('Access-Control-Allow-Headers', CORS_CONFIG.allowedHeaders.join(', '));
         res.setHeader('Access-Control-Expose-Headers', CORS_CONFIG.exposedHeaders.join(', '));
     }
-    async handleInternalApi(req, res) {
+    /**
+     * Whether this request carries operator authority.
+     *
+     * `/service/*` exposes logs and service control, so a caller that only reached the Gateway
+     * through a tunnel must not get it - whatever address it presents. A local caller counts, and
+     * so does a signed gateway admin proxy header, which is how the same machine proves it is the
+     * operator through a local forwarder.
+     */
+    hasOperatorAuthority(req, originalClientLoopback) {
+        if (originalClientLoopback) {
+            return true;
+        }
+        if (!this.internalAdminAuthSecret) {
+            return false;
+        }
+        const verification = (0, GatewayAdminProxyAuth_1.verifyGatewayAdminProxyHeaders)({
+            headers: req.headers,
+            secret: this.internalAdminAuthSecret,
+            method: req.method,
+            url: req.url,
+        });
+        return verification.valid;
+    }
+    async handleInternalApi(req, res, operatorAuthorized) {
         try {
             const reqUrl = req.url ?? '/';
             const parsed = new URL(reqUrl, 'http://localhost');
             const pathname = parsed.pathname;
+            // Status is the entry probe every client uses, and it carries no secrets.
             if (pathname === '/service/status') {
                 const status = this.supervisor.getAllStatus();
                 const cssReady = await this.isCssReady();
@@ -593,6 +601,10 @@ class GatewayProxy {
                 return;
             }
             if (pathname === '/service/logs') {
+                if (!operatorAuthorized) {
+                    sendOperatorRequired(res);
+                    return;
+                }
                 const level = parsed.searchParams.get('level') ?? undefined;
                 const source = parsed.searchParams.get('source') ?? undefined;
                 const limitValue = parsed.searchParams.get('limit');
@@ -608,6 +620,10 @@ class GatewayProxy {
             }
             const restartMatch = /^\/service\/restart\/([^/]+)$/.exec(pathname);
             if (restartMatch && req.method === 'POST') {
+                if (!operatorAuthorized) {
+                    sendOperatorRequired(res);
+                    return;
+                }
                 const service = decodeURIComponent(restartMatch[1]);
                 if (service === 'gateway') {
                     res.writeHead(409, { 'Content-Type': 'application/json' });
@@ -630,6 +646,10 @@ class GatewayProxy {
                 return;
             }
             if (pathname === '/service/stop' && req.method === 'POST') {
+                if (!operatorAuthorized) {
+                    sendOperatorRequired(res);
+                    return;
+                }
                 res.writeHead(200, { 'Content-Type': 'application/json' });
                 res.end(JSON.stringify({ ok: true }));
                 setImmediate(() => {
@@ -682,4 +702,51 @@ exports.GatewayProxy = GatewayProxy;
 function isBunRuntime() {
     return typeof globalThis.Bun !== 'undefined';
 }
+/**
+ * Whether the client-address headers say this request travelled through a forwarder outside
+ * this machine.
+ *
+ * This is the fallback behind the structural gate (the Gateway's tunnel entry listener): a
+ * tunnel pointed at the Gateway port by mistake still must not inherit local trust. Only
+ * headers that carry a client *address* count - `x-forwarded-for`, `x-real-ip` and the
+ * `for=` part of `Forwarded`. `x-forwarded-host`/`x-forwarded-proto` do not: a local dev proxy
+ * sets them for local browsers too, so treating them as evidence would lock the operator out
+ * of their own admin surface.
+ *
+ * The right-most value is the address the last forwarder saw - the one our own handlers append
+ * (`ClusterIngressRouter`, `EdgeNodeProxyHttpHandler`, `PodRoutingHttpHandler`) - so a client
+ * cannot look local by sending its own. An unreadable value is treated as remote.
+ */
+/** Service control and logs are for the operator, not for whoever reached the entry. */
+function sendOperatorRequired(res) {
+    res.writeHead(403, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error: 'Operator access required' }));
+}
+function forwardedFromOutside(req) {
+    const evidence = [
+        ...splitHeaderList(req.headers['x-forwarded-for']),
+        ...splitHeaderList(req.headers['x-real-ip']),
+        ...forwardedForParameters(req.headers.forwarded),
+    ];
+    const last = evidence.at(-1);
+    if (last === undefined) {
+        return false;
+    }
+    return (0, node_net_1.isIP)(last) === 0 || !(0, GatewayAdminProxyAuth_1.isLoopbackRemoteAddress)(last);
+}
+function splitHeaderList(raw) {
+    const value = Array.isArray(raw) ? raw.join(',') : raw;
+    return value?.split(',').map((entry) => entry.trim()).filter(Boolean) ?? [];
+}
+/** The `for=` values of an RFC 7239 `Forwarded` header, in order. */
+function forwardedForParameters(raw) {
+    const value = Array.isArray(raw) ? raw.join(',') : raw;
+    if (!value) {
+        return [];
+    }
+    return value.split(/[;,]/u)
+        .map((part) => /^\s*for\s*=\s*(.+)$/iu.exec(part.trim())?.[1])
+        .filter((entry) => Boolean(entry))
+        .map((entry) => entry.replace(/^"|"$/gu, '').replace(/^\[|\]$/gu, ''));
+}
 //# sourceMappingURL=Proxy.js.map

package/dist/runtime/bootstrap.d.ts

@@ -25,6 +25,16 @@ export interface RuntimeBootstrapState {
     ports: XpodRuntimePorts;
     sockets: XpodRuntimeSockets;
 }
+/**
+ * Address that a co-located runtime service must be reached on when it was bound
+ * to `bindHost`. Wildcard binds are not connectable on every platform, so they
+ * map to their loopback counterpart; any other value (including a hostname such
+ * as `localhost`, which may resolve to IPv6 only) is used as-is, because the
+ * gateway must connect to the very address the service actually bound.
+ */
+export declare function connectHostForBindHost(bindHost?: string): string;
+/** Loopback URL for a runtime service bound to `bindHost`. */
+export declare function localServiceUrl(bindHost: string | undefined, port: number): string;
 export declare function cssAuthModeConfigImports(authMode: AuthMode): string[];
 export declare function resolveRuntimeBootstrap(id: string, options: XpodRuntimeOptions, host: RuntimeHost, platform?: RuntimePlatform): Promise<RuntimeBootstrapState>;
 export declare function buildRuntimeEnv(state: RuntimeBootstrapState, options: XpodRuntimeOptions, envFromFile?: Record<string, string | undefined>): Record<string, string | undefined>;

package/dist/runtime/bootstrap.js

@@ -3,6 +3,8 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.connectHostForBindHost = connectHostForBindHost;
+exports.localServiceUrl = localServiceUrl;
 exports.cssAuthModeConfigImports = cssAuthModeConfigImports;
 exports.resolveRuntimeBootstrap = resolveRuntimeBootstrap;
 exports.buildRuntimeEnv = buildRuntimeEnv;
@@ -35,6 +37,28 @@ function ensureTrailingSlash(url) {
 function publicHostForBindHost(bindHost) {
     return bindHost === '127.0.0.1' || bindHost === '::1' ? 'localhost' : bindHost;
 }
+/**
+ * Address that a co-located runtime service must be reached on when it was bound
+ * to `bindHost`. Wildcard binds are not connectable on every platform, so they
+ * map to their loopback counterpart; any other value (including a hostname such
+ * as `localhost`, which may resolve to IPv6 only) is used as-is, because the
+ * gateway must connect to the very address the service actually bound.
+ */
+function connectHostForBindHost(bindHost) {
+    const host = bindHost ?? '127.0.0.1';
+    if (host === '0.0.0.0') {
+        return '127.0.0.1';
+    }
+    if (host === '::' || host === '[::]' || host === '::0') {
+        return '::1';
+    }
+    return host;
+}
+/** Loopback URL for a runtime service bound to `bindHost`. */
+function localServiceUrl(bindHost, port) {
+    const host = connectHostForBindHost(bindHost);
+    return `http://${host.includes(':') ? `[${host}]` : host}:${port}`;
+}
 function normalizeWindowsAbsolutePath(filePath) {
     return filePath.replace(/^[\\/]+(?=[A-Za-z]:[\\/])/, '');
 }

package/dist/runtime/host/node/NodeRuntimeHost.js

@@ -23,9 +23,11 @@ class NodeRuntimeHost {
         const gateway = options.gatewayPort ?? await (0, port_finder_1.getFreePort)(options.basePort ?? 5600);
         const css = options.cssPort ?? await (0, port_finder_1.getFreePort)(gateway + 1);
         const api = options.apiPort ?? await (0, port_finder_1.getFreePort)(css + 1);
-        // The ingress listener is an internal detail of this runtime, so it takes an
-        // OS-assigned port instead of claiming the neighbour of a planned service port.
-        const ingress = options.ingressPort ?? await (0, port_finder_1.getEphemeralLoopbackPort)();
+        // Tunnels (and the P2P data plane) terminate here, and this listener never treats a
+        // caller as local whatever headers it carries - that is the gate. Its port is the one
+        // number the user copies into a provider console, so it is predictable rather than
+        // random, and it is what the runtime reports as the tunnel origin.
+        const ingress = options.ingressPort ?? await (0, port_finder_1.findGatewayIngressPort)(gateway);
         return { gateway, css, api, ingress };
     }
     createListenEndpoint(options) {

package/dist/runtime/index.d.ts

@@ -10,7 +10,7 @@ export { createOpenAuthContext, registerManagedRuntimeServices, startApiRuntime,
 export type { RuntimeServices } from './lifecycle';
 export { GatewayProxy } from './Proxy';
 export { createGatewayAdminProxyAuthSecret } from './GatewayAdminProxyAuth';
-export { getEphemeralLoopbackPort, getFreePort, getFreePortForWildcard, readPortFile, requireFreePortForWildcard, resolveStableLoopbackPort } from './port-finder';
+export { findGatewayIngressPort, getEphemeralLoopbackPort, getFreePort, getFreePortForWildcard, requireFreePortForWildcard } from './port-finder';
 export { ensureTrailingSlash, INVALID_CONFIGURATION_PREFIX, validateBaseUrl } from './base-url';
 export type { ValidateBaseUrlOptions } from './base-url';
 export { applyEnv, loadEnvFile } from './env-utils';

package/dist/runtime/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.startXpodRuntime = exports.nodeGatewayRuntimeRunner = exports.NodeGatewayRuntimeRunner = exports.nodeApiRuntimeRunner = exports.NodeApiRuntimeRunner = exports.communitySolidServerCssRunner = exports.CommunitySolidServerCssRunner = exports.registerSocketOriginShims = exports.registerSocketFetchOrigin = exports.nodeRuntimePlatform = exports.NodeRuntimePlatform = exports.nodeRuntimeHost = exports.NodeRuntimeHost = exports.resolveXpodEnvPath = exports.defaultXpodEnvPath = exports.loadEnvFile = exports.applyEnv = exports.validateBaseUrl = exports.INVALID_CONFIGURATION_PREFIX = exports.ensureTrailingSlash = exports.resolveStableLoopbackPort = exports.requireFreePortForWildcard = exports.readPortFile = exports.getFreePortForWildcard = exports.getFreePort = exports.getEphemeralLoopbackPort = exports.createGatewayAdminProxyAuthSecret = exports.GatewayProxy = exports.stopRuntimeServices = exports.startGatewayRuntime = exports.startCssRuntime = exports.startApiRuntime = exports.registerManagedRuntimeServices = exports.createOpenAuthContext = exports.createRuntimeEnvironmentSession = exports.nodeRuntimeDriver = exports.NodeRuntimeDriver = exports.resolveRuntimeBootstrap = exports.initRuntimeLogger = exports.createCssRuntimeConfig = exports.buildRuntimeShorthand = exports.buildRuntimeEnv = exports.ensureBunUndiciCompat = exports.findPackageRoot = exports.PACKAGE_ROOT = void 0;
+exports.startXpodRuntime = exports.nodeGatewayRuntimeRunner = exports.NodeGatewayRuntimeRunner = exports.nodeApiRuntimeRunner = exports.NodeApiRuntimeRunner = exports.communitySolidServerCssRunner = exports.CommunitySolidServerCssRunner = exports.registerSocketOriginShims = exports.registerSocketFetchOrigin = exports.nodeRuntimePlatform = exports.NodeRuntimePlatform = exports.nodeRuntimeHost = exports.NodeRuntimeHost = exports.resolveXpodEnvPath = exports.defaultXpodEnvPath = exports.loadEnvFile = exports.applyEnv = exports.validateBaseUrl = exports.INVALID_CONFIGURATION_PREFIX = exports.ensureTrailingSlash = exports.requireFreePortForWildcard = exports.getFreePortForWildcard = exports.getFreePort = exports.getEphemeralLoopbackPort = exports.findGatewayIngressPort = exports.createGatewayAdminProxyAuthSecret = exports.GatewayProxy = exports.stopRuntimeServices = exports.startGatewayRuntime = exports.startCssRuntime = exports.startApiRuntime = exports.registerManagedRuntimeServices = exports.createOpenAuthContext = exports.createRuntimeEnvironmentSession = exports.nodeRuntimeDriver = exports.NodeRuntimeDriver = exports.resolveRuntimeBootstrap = exports.initRuntimeLogger = exports.createCssRuntimeConfig = exports.buildRuntimeShorthand = exports.buildRuntimeEnv = exports.ensureBunUndiciCompat = exports.findPackageRoot = exports.PACKAGE_ROOT = void 0;
 require("./configure-drizzle-solid");
 var package_root_1 = require("./package-root");
 Object.defineProperty(exports, "PACKAGE_ROOT", { enumerable: true, get: function () { return package_root_1.PACKAGE_ROOT; } });
@@ -30,12 +30,11 @@ Object.defineProperty(exports, "GatewayProxy", { enumerable: true, get: function
 var GatewayAdminProxyAuth_1 = require("./GatewayAdminProxyAuth");
 Object.defineProperty(exports, "createGatewayAdminProxyAuthSecret", { enumerable: true, get: function () { return GatewayAdminProxyAuth_1.createGatewayAdminProxyAuthSecret; } });
 var port_finder_1 = require("./port-finder");
+Object.defineProperty(exports, "findGatewayIngressPort", { enumerable: true, get: function () { return port_finder_1.findGatewayIngressPort; } });
 Object.defineProperty(exports, "getEphemeralLoopbackPort", { enumerable: true, get: function () { return port_finder_1.getEphemeralLoopbackPort; } });
 Object.defineProperty(exports, "getFreePort", { enumerable: true, get: function () { return port_finder_1.getFreePort; } });
 Object.defineProperty(exports, "getFreePortForWildcard", { enumerable: true, get: function () { return port_finder_1.getFreePortForWildcard; } });
-Object.defineProperty(exports, "readPortFile", { enumerable: true, get: function () { return port_finder_1.readPortFile; } });
 Object.defineProperty(exports, "requireFreePortForWildcard", { enumerable: true, get: function () { return port_finder_1.requireFreePortForWildcard; } });
-Object.defineProperty(exports, "resolveStableLoopbackPort", { enumerable: true, get: function () { return port_finder_1.resolveStableLoopbackPort; } });
 var base_url_1 = require("./base-url");
 Object.defineProperty(exports, "ensureTrailingSlash", { enumerable: true, get: function () { return base_url_1.ensureTrailingSlash; } });
 Object.defineProperty(exports, "INVALID_CONFIGURATION_PREFIX", { enumerable: true, get: function () { return base_url_1.INVALID_CONFIGURATION_PREFIX; } });

package/dist/runtime/js-runtime.js

@@ -19,8 +19,15 @@ function findBunExecutable() {
     return result.status === 0 ? result.stdout.trim() || undefined : undefined;
 }
 function jsEntrypointArgs(entrypoint, isBun) {
-    return !isBun && entrypoint.endsWith('.ts')
-        ? ['-r', require.resolve('ts-node/register/transpile-only'), entrypoint]
-        : [entrypoint];
+    if (!isBun) {
+        return entrypoint.endsWith('.ts')
+            ? ['-r', require.resolve('ts-node/register/transpile-only'), entrypoint]
+            : [entrypoint];
+    }
+    // A child service runs on the environment its parent decided for it. Without this, Bun loads
+    // whichever .env files happen to sit in the child's cwd, so a checkout's developer env files
+    // leak into a runtime that was started standalone (`bun run local` already loads them once, for
+    // the parent, on purpose).
+    return ['--no-env-file', entrypoint];
 }
 //# sourceMappingURL=js-runtime.js.map

package/dist/runtime/lifecycle.js

@@ -7,6 +7,7 @@ exports.startApiRuntime = startApiRuntime;
 exports.startGatewayRuntime = startGatewayRuntime;
 exports.stopRuntimeServices = stopRuntimeServices;
 const package_root_1 = require("./package-root");
+const bootstrap_1 = require("./bootstrap");
 const RedisClientLifecycle_1 = require("../storage/redis/RedisClientLifecycle");
 const DEFAULT_SERVICE_STOP_TIMEOUT_MS = 5_000;
 async function stopWithTimeout(name, stop, timeoutMs) {
@@ -80,7 +81,7 @@ async function startCssRuntime({ state, host, runtimeShorthand, supervisor, crea
     }
     else {
         await host.waitForPortReady(state.ports.css, '127.0.0.1');
-        supervisor.addLog('css', 'info', `CSS started (http://127.0.0.1:${state.ports.css})`);
+        supervisor.addLog('css', 'info', `CSS started (${(0, bootstrap_1.localServiceUrl)(state.bindHost, state.ports.css)})`);
     }
     supervisor.setStatus('css', 'running', { startTime: Date.now() });
     return cssApp;
@@ -92,7 +93,7 @@ async function startApiRuntime({ state, host, supervisor, authContext, apiRunner
         authContext: createOpenAuthContext(state.canonicalBaseUrl ?? state.baseUrl, authContext),
         runtimeHost: host,
     });
-    supervisor.addLog('api', 'info', `API started (${state.transport === 'socket' ? `unix://${state.sockets.api}` : `http://127.0.0.1:${state.ports.api}`})`);
+    supervisor.addLog('api', 'info', `API started (${state.transport === 'socket' ? `unix://${state.sockets.api}` : (0, bootstrap_1.localServiceUrl)(state.bindHost, state.ports.api)})`);
     supervisor.setStatus('api', 'running', { startTime: Date.now() });
     return apiService;
 }
@@ -110,8 +111,8 @@ async function startGatewayRuntime({ state, host, supervisor, shutdownHandler, g
         clientRemoteAddressResolver,
         ingressPort: state.ports.ingress,
         targets: {
-            css: state.transport === 'socket' ? { socketPath: state.sockets.css } : { url: `http://127.0.0.1:${state.ports.css}` },
-            api: state.transport === 'socket' ? { socketPath: state.sockets.api } : { url: `http://127.0.0.1:${state.ports.api}` },
+            css: state.transport === 'socket' ? { socketPath: state.sockets.css } : { url: (0, bootstrap_1.localServiceUrl)(state.bindHost, state.ports.css) },
+            api: state.transport === 'socket' ? { socketPath: state.sockets.api } : { url: (0, bootstrap_1.localServiceUrl)(state.bindHost, state.ports.api) },
         },
     });
     supervisor.addLog('xpod', 'info', `Gateway started (${state.transport === 'socket' ? `unix://${state.sockets.gateway}` : state.baseUrl})`);

package/dist/runtime/port-finder.d.ts

@@ -1,3 +1,12 @@
+/**
+ * The port a remote tunnel forwards to: the Gateway's tunnel entry.
+ *
+ * It sits a few ports above the Gateway so it is predictable - the user copies this one number
+ * into a provider console and it survives restarts - while staying clear of the block a
+ * neighbouring runtime plans for its own services. When the neighbourhood is busy the caller
+ * gets an OS-assigned port instead of a stolen one; the runtime reports whichever it got.
+ */
+export declare function findGatewayIngressPort(gatewayPort: number): Promise<number>;
 export declare function getFreePort(basePort: number, host?: string, timeoutMs?: number): Promise<number>;
 /**
  * Loopback port handed out by the OS for a listener that must not collide with ports the
@@ -9,19 +18,6 @@ export declare function getFreePort(basePort: number, host?: string, timeoutMs?:
  * runtime's service.
  */
 export declare function getEphemeralLoopbackPort(): Promise<number>;
-/**
- * The ingress port this deployment should keep using.
- *
- * Remote tunnels forward to a port the operator typed into a provider console, so an
- * OS-assigned port would invalidate that copy on every restart. The port is remembered in
- * the runtime state directory; if something else took it meanwhile, a new one is chosen and
- * persisted — the caller reports the change so the stale console value can be corrected.
- */
-export declare function resolveStableLoopbackPort(stateFile: string): Promise<{
-    port: number;
-    changed: boolean;
-}>;
-export declare function readPortFile(stateFile: string): number | undefined;
 /**
  * Allocates a port for child services that bind wildcard addresses.
  * CSS may bind `::` while the API binds `0.0.0.0`, so probing only localhost

package/dist/runtime/port-finder.js

@@ -3,16 +3,13 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.findGatewayIngressPort = findGatewayIngressPort;
 exports.getFreePort = getFreePort;
 exports.getEphemeralLoopbackPort = getEphemeralLoopbackPort;
-exports.resolveStableLoopbackPort = resolveStableLoopbackPort;
-exports.readPortFile = readPortFile;
 exports.requireFreePortForWildcard = requireFreePortForWildcard;
 exports.getFreePortForWildcard = getFreePortForWildcard;
 const node_net_1 = __importDefault(require("node:net"));
 const node_os_1 = __importDefault(require("node:os"));
-const node_fs_1 = require("node:fs");
-const node_path_1 = require("node:path");
 const HIGHEST_PORT = 65_535;
 const PORT_PROBE_TIMEOUT_MS = 1_000;
 const RETRYABLE_PORT_ERRORS = new Set([
@@ -103,6 +100,23 @@ async function canListen(port, host, timeoutMs = PORT_PROBE_TIMEOUT_MS) {
         server.listen(port, host);
     });
 }
+/**
+ * The port a remote tunnel forwards to: the Gateway's tunnel entry.
+ *
+ * It sits a few ports above the Gateway so it is predictable - the user copies this one number
+ * into a provider console and it survives restarts - while staying clear of the block a
+ * neighbouring runtime plans for its own services. When the neighbourhood is busy the caller
+ * gets an OS-assigned port instead of a stolen one; the runtime reports whichever it got.
+ */
+async function findGatewayIngressPort(gatewayPort) {
+    for (let offset = 3; offset < 10; offset += 1) {
+        const candidate = gatewayPort + offset;
+        if (await getFreePortForWildcard(candidate) === candidate) {
+            return candidate;
+        }
+    }
+    return await getEphemeralLoopbackPort();
+}
 async function getFreePort(basePort, host = '127.0.0.1', timeoutMs = PORT_PROBE_TIMEOUT_MS) {
     for (let port = basePort; port <= HIGHEST_PORT; port++) {
         if (await canListen(port, host, timeoutMs)) {
@@ -137,39 +151,6 @@ async function getEphemeralLoopbackPort() {
         });
     });
 }
-/**
- * The ingress port this deployment should keep using.
- *
- * Remote tunnels forward to a port the operator typed into a provider console, so an
- * OS-assigned port would invalidate that copy on every restart. The port is remembered in
- * the runtime state directory; if something else took it meanwhile, a new one is chosen and
- * persisted — the caller reports the change so the stale console value can be corrected.
- */
-async function resolveStableLoopbackPort(stateFile) {
-    const remembered = readPortFile(stateFile);
-    if (remembered !== undefined && await canListen(remembered, '127.0.0.1')) {
-        return { port: remembered, changed: false };
-    }
-    const port = await getEphemeralLoopbackPort();
-    try {
-        (0, node_fs_1.mkdirSync)((0, node_path_1.dirname)(stateFile), { recursive: true });
-        (0, node_fs_1.writeFileSync)(stateFile, `${port}\n`);
-    }
-    catch {
-        // A deployment without a writable state directory still gets a working port; it just
-        // cannot promise the same one next time.
-    }
-    return { port, changed: remembered !== undefined };
-}
-function readPortFile(stateFile) {
-    try {
-        const port = Number.parseInt((0, node_fs_1.readFileSync)(stateFile, 'utf8').trim(), 10);
-        return Number.isInteger(port) && port > 0 && port <= 65535 ? port : undefined;
-    }
-    catch {
-        return undefined;
-    }
-}
 function hasIpv6Address() {
     return Object.values(node_os_1.default.networkInterfaces()).some((entries) => entries?.some((entry) => entry.family === 'IPv6'));
 }