@undefineds.co/xpod 0.4.17 → 0.4.19

package/dist/edge/reachability/TcpP2PDataPlaneTransport.jsonld

@@ -4,43 +4,10 @@
   ],
   "@id": "npmd:@undefineds.co/xpod",
   "components": [
-    {
-      "@id": "undefineds:dist/edge/reachability/TcpP2PDataPlaneTransport.jsonld#P2PDataPlaneSecurityOptions",
-      "@type": "AbstractClass",
-      "requireElement": "P2PDataPlaneSecurityOptions",
-      "comment": "Data plane authentication (audit N03).  Both endpoints must configure the same per-session secret; it is only ever transported over the authenticated signaling API. Each side announces itself with a nonce, derives direction-separated keys, and then seals every frame. A peer without the secret cannot make the other side accept a frame, and a frame cannot be replayed into another session or direction.",
-      "parameters": [],
-      "memberFields": [
-        {
-          "@id": "undefineds:dist/edge/reachability/TcpP2PDataPlaneTransport.jsonld#P2PDataPlaneSecurityOptions__member_role",
-          "memberFieldName": "role"
-        },
-        {
-          "@id": "undefineds:dist/edge/reachability/TcpP2PDataPlaneTransport.jsonld#P2PDataPlaneSecurityOptions__member_sessionId",
-          "memberFieldName": "sessionId"
-        },
-        {
-          "@id": "undefineds:dist/edge/reachability/TcpP2PDataPlaneTransport.jsonld#P2PDataPlaneSecurityOptions__member_secret",
-          "memberFieldName": "secret"
-        },
-        {
-          "@id": "undefineds:dist/edge/reachability/TcpP2PDataPlaneTransport.jsonld#P2PDataPlaneSecurityOptions__member_resolveSessionSecret",
-          "memberFieldName": "resolveSessionSecret"
-        },
-        {
-          "@id": "undefineds:dist/edge/reachability/TcpP2PDataPlaneTransport.jsonld#P2PDataPlaneSecurityOptions__member_handshakeTimeoutMs",
-          "memberFieldName": "handshakeTimeoutMs"
-        }
-      ],
-      "constructorArguments": []
-    },
     {
       "@id": "undefineds:dist/edge/reachability/TcpP2PDataPlaneTransport.jsonld#TcpP2PDataPlaneTransportOptions",
       "@type": "AbstractClass",
       "requireElement": "TcpP2PDataPlaneTransportOptions",
-      "extends": [
-        "undefineds:dist/edge/reachability/P2PDataPlane.jsonld#P2PDataPlaneLimitsOptions"
-      ],
       "parameters": [],
       "memberFields": [
         {
@@ -62,10 +29,6 @@
         {
           "@id": "undefineds:dist/edge/reachability/TcpP2PDataPlaneTransport.jsonld#TcpP2PDataPlaneTransportOptions__member_randomId",
           "memberFieldName": "randomId"
-        },
-        {
-          "@id": "undefineds:dist/edge/reachability/TcpP2PDataPlaneTransport.jsonld#TcpP2PDataPlaneTransportOptions__member_secure",
-          "memberFieldName": "secure"
         }
       ],
       "constructorArguments": []
@@ -90,9 +53,6 @@
       "@id": "undefineds:dist/edge/reachability/TcpP2PDataPlaneTransport.jsonld#TcpP2PDataPlaneServerOptions",
       "@type": "AbstractClass",
       "requireElement": "TcpP2PDataPlaneServerOptions",
-      "extends": [
-        "undefineds:dist/edge/reachability/P2PDataPlane.jsonld#P2PDataPlaneLimitsOptions"
-      ],
       "parameters": [],
       "memberFields": [
         {
@@ -102,10 +62,6 @@
         {
           "@id": "undefineds:dist/edge/reachability/TcpP2PDataPlaneTransport.jsonld#TcpP2PDataPlaneServerOptions__member_host",
           "memberFieldName": "host"
-        },
-        {
-          "@id": "undefineds:dist/edge/reachability/TcpP2PDataPlaneTransport.jsonld#TcpP2PDataPlaneServerOptions__member_secure",
-          "memberFieldName": "secure"
         }
       ],
       "constructorArguments": []
@@ -135,9 +91,6 @@
       "@id": "undefineds:dist/edge/reachability/TcpP2PDataPlaneTransport.jsonld#TcpP2PDataPlaneSocketOptions",
       "@type": "AbstractClass",
       "requireElement": "TcpP2PDataPlaneSocketOptions",
-      "extends": [
-        "undefineds:dist/edge/reachability/P2PDataPlane.jsonld#P2PDataPlaneLimitsOptions"
-      ],
       "parameters": [],
       "memberFields": [
         {
@@ -147,10 +100,6 @@
         {
           "@id": "undefineds:dist/edge/reachability/TcpP2PDataPlaneTransport.jsonld#TcpP2PDataPlaneSocketOptions__member_handler",
           "memberFieldName": "handler"
-        },
-        {
-          "@id": "undefineds:dist/edge/reachability/TcpP2PDataPlaneTransport.jsonld#TcpP2PDataPlaneSocketOptions__member_secure",
-          "memberFieldName": "secure"
         }
       ],
       "constructorArguments": []

package/dist/edge/reachability/TcpP2PSignalingSession.d.ts

@@ -2,7 +2,6 @@ import { type Socket } from 'node:net';
 import type { AccessRoute, P2PCandidateRole, P2PSession, P2PTransportCandidate } from './types';
 import type { P2PSignalingClient } from './P2PSignalingClient';
 import type { P2PDataPlaneHandler } from './P2PDataPlane';
-import type { P2PDataPlaneSecurityOptions } from './TcpP2PDataPlaneTransport';
 import { type TcpP2PDataPlaneSocketHandle, type TcpP2PDataPlaneTransport, type TcpHolePunchPlan, type TcpHolePunchPlanOptions } from './TcpP2PDataPlaneTransport';
 export declare const RAW_TCP_HOLE_PUNCH_TRANSPORT: "raw-tcp-hole-punch";
 export declare const RAW_TCP_HOLE_PUNCH_CAPABILITY: "tcp-punch";
@@ -20,8 +19,6 @@ export interface CreateRawTcpHolePunchCandidatesOptions {
 export interface SignaledRawTcpP2PSessionOptions {
     signaling: P2PSignalingClient;
     clientId: string;
-    /** Overrides the generated per-session data plane secret (tests only). */
-    dataPlaneSecret?: string;
     host?: string;
     address?: string;
     capabilities?: string[];
@@ -36,8 +33,6 @@ export interface SignaledRawTcpP2PSession {
     plan: TcpHolePunchPlan;
     localCandidates: P2PTransportCandidate[];
     rawTcpRoute?: AccessRoute;
-    /** Secret both peers use to seal the data plane (audit N03). */
-    dataPlaneSecret: string;
 }
 export interface AnswerPendingRawTcpP2PSessionsOnceOptions {
     signaling: P2PSignalingClient;
@@ -58,8 +53,6 @@ export interface WaitForRawTcpRemoteCandidatesOptions {
     timeoutMs?: number;
 }
 export interface ConnectRawTcpP2PTransportOptions {
-    /** Data plane authentication; the signaled path always sets it (audit N03). */
-    secure?: P2PDataPlaneSecurityOptions;
     localCandidates: P2PTransportCandidate[];
     remoteCandidates: P2PTransportCandidate[];
     connectTimeoutMs?: number;

package/dist/edge/reachability/TcpP2PSignalingSession.js

@@ -13,7 +13,6 @@ exports.filterRawTcpRemoteCandidates = filterRawTcpRemoteCandidates;
 exports.selectRawTcpP2PRoute = selectRawTcpP2PRoute;
 exports.isRawTcpHolePunchCandidate = isRawTcpHolePunchCandidate;
 const node_net_1 = require("node:net");
-const P2PDataPlaneCrypto_1 = require("./P2PDataPlaneCrypto");
 const TcpP2PDataPlaneTransport_1 = require("./TcpP2PDataPlaneTransport");
 exports.RAW_TCP_HOLE_PUNCH_TRANSPORT = 'raw-tcp-hole-punch';
 exports.RAW_TCP_HOLE_PUNCH_CAPABILITY = 'tcp-punch';
@@ -62,7 +61,6 @@ async function createSignaledRawTcpP2PSession(options) {
         plan,
         candidateIdPrefix: options.candidateIdPrefix,
     });
-    const dataPlaneSecret = options.dataPlaneSecret ?? (0, P2PDataPlaneCrypto_1.createDataPlaneSecret)();
     const request = {
         clientId: options.clientId,
         capabilities: uniqueStrings([
@@ -70,7 +68,6 @@ async function createSignaledRawTcpP2PSession(options) {
             ...(options.capabilities ?? []),
         ]),
         candidates: localCandidates,
-        dataPlaneSecret,
     };
     const session = await options.signaling.createP2PSession(request);
     const effectiveLocalCandidates = localRawTcpCandidatesFromSessionOrFallback(session, localCandidates, 'client', options.clientId, plan.bucket);
@@ -79,9 +76,6 @@ async function createSignaledRawTcpP2PSession(options) {
         plan,
         localCandidates: effectiveLocalCandidates,
         rawTcpRoute: selectRawTcpP2PRoute(session.nodeCandidates),
-        // The API echoes the session back; a node that stripped the secret would otherwise let the
-        // client believe the plane is sealed while the node cannot open a single frame.
-        dataPlaneSecret: session.dataPlaneSecret ?? dataPlaneSecret,
     };
 }
 async function answerPendingRawTcpP2PSessionsOnce(options) {
@@ -165,19 +159,7 @@ async function acceptSignaledRawTcpP2PConnectionOnce(options) {
                 plan,
                 localCandidates: effectiveLocalCandidates,
                 remoteCandidates,
-                socketHandle: (0, TcpP2PDataPlaneTransport_1.attachTcpP2PDataPlaneSocket)({
-                    socket,
-                    handler: options.handler,
-                    ...(answeredSession.dataPlaneSecret
-                        ? {
-                            secure: {
-                                role: 'server',
-                                sessionId: answeredSession.sessionId,
-                                secret: answeredSession.dataPlaneSecret,
-                            },
-                        }
-                        : {}),
-                }),
+                socketHandle: (0, TcpP2PDataPlaneTransport_1.attachTcpP2PDataPlaneSocket)({ socket, handler: options.handler }),
             };
         }
         catch (error) {
@@ -226,11 +208,6 @@ async function connectSignaledRawTcpP2PTransport(options) {
         nowMs: options.nowMs,
         sleepMs: options.sleepMs,
         connectSocket: options.connectSocket,
-        secure: {
-            role: 'client',
-            sessionId: signaled.session.sessionId,
-            secret: signaled.dataPlaneSecret,
-        },
     });
     return {
         ...signaled,
@@ -245,7 +222,6 @@ async function connectRawTcpP2PTransport(options) {
         remotePort: attempt.remotePort,
         socket,
         timeoutMs: options.timeoutMs,
-        ...(options.secure ? { secure: options.secure } : {}),
     });
 }
 async function connectRawTcpP2PSocket(options) {

package/dist/edge/reachability/TcpP2PSignalingSession.jsonld

@@ -63,10 +63,6 @@
           "@id": "undefineds:dist/edge/reachability/TcpP2PSignalingSession.jsonld#SignaledRawTcpP2PSessionOptions__member_clientId",
           "memberFieldName": "clientId"
         },
-        {
-          "@id": "undefineds:dist/edge/reachability/TcpP2PSignalingSession.jsonld#SignaledRawTcpP2PSessionOptions__member_dataPlaneSecret",
-          "memberFieldName": "dataPlaneSecret"
-        },
         {
           "@id": "undefineds:dist/edge/reachability/TcpP2PSignalingSession.jsonld#SignaledRawTcpP2PSessionOptions__member_host",
           "memberFieldName": "host"
@@ -123,10 +119,6 @@
         {
           "@id": "undefineds:dist/edge/reachability/TcpP2PSignalingSession.jsonld#SignaledRawTcpP2PSession__member_rawTcpRoute",
           "memberFieldName": "rawTcpRoute"
-        },
-        {
-          "@id": "undefineds:dist/edge/reachability/TcpP2PSignalingSession.jsonld#SignaledRawTcpP2PSession__member_dataPlaneSecret",
-          "memberFieldName": "dataPlaneSecret"
         }
       ],
       "constructorArguments": []
@@ -211,10 +203,6 @@
       "requireElement": "ConnectRawTcpP2PTransportOptions",
       "parameters": [],
       "memberFields": [
-        {
-          "@id": "undefineds:dist/edge/reachability/TcpP2PSignalingSession.jsonld#ConnectRawTcpP2PTransportOptions__member_secure",
-          "memberFieldName": "secure"
-        },
         {
           "@id": "undefineds:dist/edge/reachability/TcpP2PSignalingSession.jsonld#ConnectRawTcpP2PTransportOptions__member_localCandidates",
           "memberFieldName": "localCandidates"

package/dist/edge/reachability/index.d.ts

@@ -4,7 +4,6 @@ export * from './ReachabilitySessionService';
 export * from './ManagedRouteSelector';
 export * from './CanonicalFetch';
 export * from './P2PDataPlane';
-export * from './P2PDataPlaneCrypto';
 export * from './P2PSignalingClient';
 export * from './TcpP2PDataPlaneTransport';
 export * from './TcpP2PSignalingSession';

package/dist/edge/reachability/index.js

@@ -20,7 +20,6 @@ __exportStar(require("./ReachabilitySessionService"), exports);
 __exportStar(require("./ManagedRouteSelector"), exports);
 __exportStar(require("./CanonicalFetch"), exports);
 __exportStar(require("./P2PDataPlane"), exports);
-__exportStar(require("./P2PDataPlaneCrypto"), exports);
 __exportStar(require("./P2PSignalingClient"), exports);
 __exportStar(require("./TcpP2PDataPlaneTransport"), exports);
 __exportStar(require("./TcpP2PSignalingSession"), exports);

package/dist/edge/reachability/types.d.ts

@@ -51,12 +51,6 @@ export interface P2PSessionRequest {
     owner?: P2PSessionOwner;
     capabilities?: string[];
     candidates?: unknown[];
-    /**
-     * Base64 per-session secret for the data plane (audit N03). The creator generates it; the
-     * signaling API is the only channel that carries it, so a network peer that can reach the
-     * punched port still cannot read or forge frames.
-     */
-    dataPlaneSecret?: string;
 }
 export interface P2PSessionOwner {
     type: 'solid';
@@ -100,8 +94,6 @@ export interface P2PSession {
     capabilities: string[];
     candidates: P2PTransportCandidate[];
     limits?: P2PSessionLimits;
-    /** Present for data planes that authenticate and encrypt their frames (audit N03). */
-    dataPlaneSecret?: string;
 }
 export interface P2PSessionList {
     kind: 'p2p';

package/dist/edge/reachability/types.jsonld

@@ -181,10 +181,6 @@
         {
           "@id": "undefineds:dist/edge/reachability/types.jsonld#P2PSessionRequest__member_candidates",
           "memberFieldName": "candidates"
-        },
-        {
-          "@id": "undefineds:dist/edge/reachability/types.jsonld#P2PSessionRequest__member_dataPlaneSecret",
-          "memberFieldName": "dataPlaneSecret"
         }
       ],
       "constructorArguments": []
@@ -358,10 +354,6 @@
         {
           "@id": "undefineds:dist/edge/reachability/types.jsonld#P2PSession__member_limits",
           "memberFieldName": "limits"
-        },
-        {
-          "@id": "undefineds:dist/edge/reachability/types.jsonld#P2PSession__member_dataPlaneSecret",
-          "memberFieldName": "dataPlaneSecret"
         }
       ],
       "constructorArguments": []

package/dist/identity/ValidatingIdentityProviderHttpHandler.d.ts

@@ -1,7 +1,8 @@
 import { OperationHttpHandler, type InteractionHandler, type OperationHttpHandlerInput, type ProviderFactory, type ResponseDescription } from '@solid/community-server';
-import type { CookieStore } from '@solid/community-server';
+import type { CookieStore, CredentialsExtractor } from '@solid/community-server';
 interface AccountExistenceStorage {
     has: (type: string, id: string) => Promise<boolean>;
+    find: (type: string, query: Record<string, unknown>) => Promise<Array<Record<string, unknown>>>;
 }
 export interface ValidatingIdentityProviderHttpHandlerArgs {
     /**
@@ -26,6 +27,24 @@ export interface ValidatingIdentityProviderHttpHandlerArgs {
      * the local cookie store must be left untouched instead of expired.
      */
     externalAccountIssuer?: string;
+    /**
+     * Reads the caller's own already-verified credentials.
+     *
+     * The Account cookie is issued on the account authority's own origin, so a page the Xpod
+     * Gateway serves cannot present it. What that page does hold is the WebID session Xpod signed
+     * it in with, which names the same Account whenever the WebID is one the Account already linked.
+     *
+     * This is CSS's own request-scoped extractor, so that session's DPoP proof is verified once for
+     * the whole request. Verifying the same proof again would be a replay and always fail, which is
+     * exactly what the `jti` guard is for - including when this handler asks.
+     */
+    sessionExtractor?: CredentialsExtractor;
+    /**
+     * OIDC clients whose Solid session may name its own Account. Defaults to the
+     * client the Xpod host itself logs in with, so a third-party Solid app holding a
+     * token for the same WebID can never turn it into Account authority.
+     */
+    hostClientIds?: string[];
 }
 /**
  * CSS-compatible IdP operation handler that drops stale account cookies.
@@ -41,6 +60,8 @@ export declare class ValidatingIdentityProviderHttpHandler extends OperationHttp
     private readonly handler;
     private readonly accountStorage;
     private readonly externalAccountIssuer?;
+    private readonly sessionExtractor?;
+    private readonly hostClientIds;
     constructor(args: ValidatingIdentityProviderHttpHandlerArgs);
     handle({ operation, request, response }: OperationHttpHandlerInput): Promise<ResponseDescription>;
     private findAccountCookies;
@@ -48,5 +69,15 @@ export declare class ValidatingIdentityProviderHttpHandler extends OperationHttp
     private findBrowserAccountCookie;
     private normalizeAccountCookie;
     private findValidAccount;
+    /**
+     * Names the Account that owns the WebID of the caller's own Solid session.
+     *
+     * The session is only accepted when its DPoP proof verifies and its client is one
+     * the Xpod host itself logs in with, so holding somebody's token is not enough and
+     * a third-party app cannot spend its own token here. The Account is then read from
+     * CSS's own WebID links: a session can only ever reach the Account it already
+     * belongs to, never another one.
+     */
+    private findSessionAccount;
 }
 export {};

package/dist/identity/ValidatingIdentityProviderHttpHandler.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.ValidatingIdentityProviderHttpHandler = void 0;
 const global_logger_factory_1 = require("global-logger-factory");
 const community_server_1 = require("@solid/community-server");
+const RememberedClientGrantStore_1 = require("./oidc/RememberedClientGrantStore");
 const ACCOUNT_TYPE = 'account';
 const ACCOUNT_COOKIE_NAME = 'css-account';
 const ACCOUNT_TOKEN_AUTHORIZATION_SCHEME = 'CSS-Account-Token ';
@@ -22,6 +23,8 @@ class ValidatingIdentityProviderHttpHandler extends community_server_1.Operation
         this.handler = args.handler;
         this.accountStorage = args.accountStorage;
         this.externalAccountIssuer = args.externalAccountIssuer;
+        this.sessionExtractor = args.sessionExtractor;
+        this.hostClientIds = args.hostClientIds ?? [RememberedClientGrantStore_1.XPOD_DESKTOP_CLIENT_ID];
     }
     async handle({ operation, request, response }) {
         // The browser sends the native, path-scoped signed cookie for this URL.
@@ -54,8 +57,15 @@ class ValidatingIdentityProviderHttpHandler extends community_server_1.Operation
         const authorizationCookie = this.findAuthorizationAccountCookie(request);
         const cookies = this.findAccountCookies(operation, authorizationCookie, browserCookie);
         const { accountId, selectedCookie, expiredCookie } = await this.findValidAccount(cookies, browserCookie);
+        // An Account cookie stays authoritative; the host's own Solid session is the
+        // second source, for pages that hold a WebID but never saw the account origin.
+        const sessionAccountId = accountId ?? await this.findSessionAccount(request);
         const normalizedOperation = this.normalizeAccountCookie(operation, selectedCookie);
-        const representation = await this.handler.handleSafe({ operation: normalizedOperation, oidcInteraction, accountId });
+        const representation = await this.handler.handleSafe({
+            operation: normalizedOperation,
+            oidcInteraction,
+            accountId: sessionAccountId,
+        });
         if (expiredCookie && !representation.metadata?.has(community_server_1.SOLID_HTTP.terms.accountCookie)) {
             const metadata = new community_server_1.RepresentationMetadata(representation.metadata);
             metadata.set(community_server_1.SOLID_HTTP.terms.accountCookie, expiredCookie);
@@ -145,6 +155,48 @@ class ValidatingIdentityProviderHttpHandler extends community_server_1.Operation
         }
         return { accountId: selectedAccountId, selectedCookie, expiredCookie };
     }
+    /**
+     * Names the Account that owns the WebID of the caller's own Solid session.
+     *
+     * The session is only accepted when its DPoP proof verifies and its client is one
+     * the Xpod host itself logs in with, so holding somebody's token is not enough and
+     * a third-party app cannot spend its own token here. The Account is then read from
+     * CSS's own WebID links: a session can only ever reach the Account it already
+     * belongs to, never another one.
+     */
+    async findSessionAccount(request) {
+        if (!this.sessionExtractor) {
+            return undefined;
+        }
+        // Only a DPoP-bound session may name an Account. A Bearer token is replayable, so accepting
+        // one here would let anybody who copied it mint Account authority from a Pod credential.
+        if (!/^DPoP /iu.test(request.headers.authorization ?? '')) {
+            return undefined;
+        }
+        let credentials;
+        try {
+            credentials = await this.sessionExtractor.handleSafe(request);
+        }
+        catch (error) {
+            // No session at all, or one this deployment does not accept: stay anonymous.
+            this.logger.debug(`No host session credentials: ${(0, community_server_1.createErrorMessage)(error)}`);
+            return undefined;
+        }
+        const webId = credentials.agent?.webId;
+        const clientId = credentials.client?.clientId;
+        if (!webId || !clientId || !this.hostClientIds.includes(clientId)) {
+            return undefined;
+        }
+        const links = await this.accountStorage.find(community_server_1.WEBID_STORAGE_TYPE, { webId });
+        const accountId = links
+            .map((link) => link.accountId)
+            .find((value) => typeof value === 'string' && value !== '');
+        if (!accountId) {
+            this.logger.debug(`WebID ${webId} is not linked to an Account.`);
+            return undefined;
+        }
+        return accountId;
+    }
 }
 exports.ValidatingIdentityProviderHttpHandler = ValidatingIdentityProviderHttpHandler;
 //# sourceMappingURL=ValidatingIdentityProviderHttpHandler.js.map

package/dist/identity/ValidatingIdentityProviderHttpHandler.jsonld

@@ -46,6 +46,35 @@
             ]
           },
           "comment": "External account authority (Cloud+Local mode). When set, account cookies are issued and validated by the remote authority, so cookies unknown to the local cookie store must be left untouched instead of expired."
+        },
+        {
+          "@id": "undefineds:dist/identity/ValidatingIdentityProviderHttpHandler.jsonld#ValidatingIdentityProviderHttpHandler_args_sessionExtractor",
+          "range": {
+            "@type": "ParameterRangeUnion",
+            "parameterRangeElements": [
+              "css:dist/authentication/CredentialsExtractor.jsonld#CredentialsExtractor",
+              {
+                "@type": "ParameterRangeUndefined"
+              }
+            ]
+          },
+          "comment": "Reads the caller's own already-verified credentials.  The Account cookie is issued on the account authority's own origin, so a page the Xpod Gateway serves cannot present it. What that page does hold is the WebID session Xpod signed it in with, which names the same Account whenever the WebID is one the Account already linked.  This is CSS's own request-scoped extractor, so that session's DPoP proof is verified once for the whole request. Verifying the same proof again would be a replay and always fail, which is exactly what the `jti` guard is for - including when this handler asks."
+        },
+        {
+          "@id": "undefineds:dist/identity/ValidatingIdentityProviderHttpHandler.jsonld#ValidatingIdentityProviderHttpHandler_args_hostClientIds",
+          "range": {
+            "@type": "ParameterRangeUnion",
+            "parameterRangeElements": [
+              {
+                "@type": "ParameterRangeArray",
+                "parameterRangeValue": "xsd:string"
+              },
+              {
+                "@type": "ParameterRangeUndefined"
+              }
+            ]
+          },
+          "comment": "OIDC clients whose Solid session may name its own Account. Defaults to the client the Xpod host itself logs in with, so a third-party Solid app holding a token for the same WebID can never turn it into Account authority."
         }
       ],
       "memberFields": [
@@ -76,6 +105,14 @@
           "@id": "undefineds:dist/identity/ValidatingIdentityProviderHttpHandler.jsonld#ValidatingIdentityProviderHttpHandler__member_externalAccountIssuer",
           "memberFieldName": "externalAccountIssuer"
         },
+        {
+          "@id": "undefineds:dist/identity/ValidatingIdentityProviderHttpHandler.jsonld#ValidatingIdentityProviderHttpHandler__member_sessionExtractor",
+          "memberFieldName": "sessionExtractor"
+        },
+        {
+          "@id": "undefineds:dist/identity/ValidatingIdentityProviderHttpHandler.jsonld#ValidatingIdentityProviderHttpHandler__member_hostClientIds",
+          "memberFieldName": "hostClientIds"
+        },
         {
           "@id": "undefineds:dist/identity/ValidatingIdentityProviderHttpHandler.jsonld#ValidatingIdentityProviderHttpHandler__member_constructor",
           "memberFieldName": "constructor"
@@ -103,6 +140,10 @@
         {
           "@id": "undefineds:dist/identity/ValidatingIdentityProviderHttpHandler.jsonld#ValidatingIdentityProviderHttpHandler__member_findValidAccount",
           "memberFieldName": "findValidAccount"
+        },
+        {
+          "@id": "undefineds:dist/identity/ValidatingIdentityProviderHttpHandler.jsonld#ValidatingIdentityProviderHttpHandler__member_findSessionAccount",
+          "memberFieldName": "findSessionAccount"
         }
       ],
       "constructorArguments": [
@@ -138,6 +179,18 @@
               "value": {
                 "@id": "undefineds:dist/identity/ValidatingIdentityProviderHttpHandler.jsonld#ValidatingIdentityProviderHttpHandler_args_externalAccountIssuer"
               }
+            },
+            {
+              "keyRaw": "sessionExtractor",
+              "value": {
+                "@id": "undefineds:dist/identity/ValidatingIdentityProviderHttpHandler.jsonld#ValidatingIdentityProviderHttpHandler_args_sessionExtractor"
+              }
+            },
+            {
+              "keyRaw": "hostClientIds",
+              "value": {
+                "@id": "undefineds:dist/identity/ValidatingIdentityProviderHttpHandler.jsonld#ValidatingIdentityProviderHttpHandler_args_hostClientIds"
+              }
             }
           ]
         }

package/dist/identity/drizzle/EdgeNodeRepository.d.ts

@@ -72,18 +72,6 @@ export declare class EdgeNodeRepository {
         lastConnectivityCheck?: Date;
     } | undefined>;
     mergeNodeMetadata(nodeId: string, patch: Record<string, unknown>): Promise<void>;
-    /**
-     * Compare-and-swap on the whole `metadata` blob.
-     *
-     * Reachability state (sessions, candidates) lives inside that blob, so a read-modify-write
-     * silently drops whatever another writer committed in between — the lost update the audit
-     * calls out as N07. This write only lands when the stored value is still the one the caller
-     * read; `false` means somebody else won and the caller must re-read and re-apply.
-     *
-     * The comparison is on the serialized payload. Two equivalent-but-differently-ordered
-     * payloads therefore fail the swap, which costs a retry but can never lose a write.
-     */
-    updateNodeMetadataAtomic(nodeId: string, expected: Record<string, unknown> | null, next: Record<string, unknown>): Promise<boolean>;
     getNodeMetadata(nodeId: string): Promise<{
         nodeId: string;
         metadata: Record<string, unknown> | null;

package/dist/identity/drizzle/EdgeNodeRepository.js

@@ -152,43 +152,6 @@ class EdgeNodeRepository {
       WHERE id = ${nodeId}
     `);
     }
-    /**
-     * Compare-and-swap on the whole `metadata` blob.
-     *
-     * Reachability state (sessions, candidates) lives inside that blob, so a read-modify-write
-     * silently drops whatever another writer committed in between — the lost update the audit
-     * calls out as N07. This write only lands when the stored value is still the one the caller
-     * read; `false` means somebody else won and the caller must re-read and re-apply.
-     *
-     * The comparison is on the serialized payload. Two equivalent-but-differently-ordered
-     * payloads therefore fail the swap, which costs a retry but can never lose a write.
-     */
-    async updateNodeMetadataAtomic(nodeId, expected, next) {
-        await this.ready;
-        const payload = JSON.stringify(next);
-        const expectedPayload = expected === null ? null : JSON.stringify(expected);
-        const ts = (0, db_1.toDbTimestamp)(this.db, new Date());
-        const changed = await (0, db_1.executeStatementWithCount)(this.db, expectedPayload === null
-            ? (0, drizzle_orm_1.sql) `
-          UPDATE cluster_node
-          SET metadata = ${payload},
-              updated_at = ${ts}
-          WHERE id = ${nodeId} AND metadata IS NULL
-        `
-            : (0, drizzle_orm_1.sql) `
-          UPDATE cluster_node
-          SET metadata = ${payload},
-              updated_at = ${ts}
-          WHERE id = ${nodeId} AND metadata = ${expectedPayload}
-        `);
-        if (typeof changed === 'number') {
-            return changed > 0;
-        }
-        // A driver that reports no row count cannot answer "did my write land": verify instead of
-        // assuming, so a lost race is retried rather than reported as success.
-        const stored = await this.getNodeMetadata(nodeId);
-        return JSON.stringify(stored?.metadata ?? null) === payload;
-    }
     async getNodeMetadata(nodeId) {
         await this.ready;
         const result = await (0, db_1.executeQuery)(this.db, (0, drizzle_orm_1.sql) `

package/dist/identity/drizzle/PodLookupRepository.js

@@ -33,10 +33,11 @@ class PodLookupRepository {
         let bestMatch;
         let bestLength = 0;
         for (const pod of pods) {
-            const candidateBase = pod.storageUrl ?? pod.baseUrl;
-            if (resourcePath.startsWith(candidateBase) && candidateBase.length > bestLength) {
-                bestMatch = pod;
-                bestLength = candidateBase.length;
+            for (const candidateBase of [pod.baseUrl, pod.storageUrl]) {
+                if (candidateBase && resourcePath.startsWith(candidateBase) && candidateBase.length > bestLength) {
+                    bestMatch = pod;
+                    bestLength = candidateBase.length;
+                }
             }
         }
         return bestMatch;

package/dist/identity/drizzle/db.d.ts

@@ -57,14 +57,6 @@ export declare function executeQuery<T = Record<string, unknown>>(db: IdentityDa
  * Works uniformly across PostgreSQL and SQLite.
  */
 export declare function executeStatement(db: IdentityDatabase, query: SQL): Promise<void>;
-/**
- * Execute a statement and report how many rows it changed.
- *
- * Optimistic concurrency (compare-and-swap) has to tell an applied write from a rejected one,
- * which `executeStatement` throws away. Returns `undefined` when the driver reports no count,
- * in which case callers must verify the stored value themselves instead of assuming success.
- */
-export declare function executeStatementWithCount(db: IdentityDatabase, query: SQL): Promise<number | undefined>;
 export declare function executePostgresLockedStatements(db: IdentityDatabase, lockKey: number, statements: string[]): Promise<void>;
 /**
  * Creates the per-owner interface-key table.

package/dist/identity/drizzle/db.js

@@ -32,7 +32,6 @@ exports.closeAllIdentityConnections = closeAllIdentityConnections;
 exports.isDatabaseSqlite = isDatabaseSqlite;
 exports.executeQuery = executeQuery;
 exports.executeStatement = executeStatement;
-exports.executeStatementWithCount = executeStatementWithCount;
 exports.executePostgresLockedStatements = executePostgresLockedStatements;
 exports.ensurePodInterfaceKeyTable = ensurePodInterfaceKeyTable;
 exports.ensureCloudClusterTables = ensureCloudClusterTables;
@@ -230,22 +229,6 @@ async function executeStatement(db, query) {
     // PostgreSQL: db.execute() works for statements too
     await db.execute(query);
 }
-/**
- * Execute a statement and report how many rows it changed.
- *
- * Optimistic concurrency (compare-and-swap) has to tell an applied write from a rejected one,
- * which `executeStatement` throws away. Returns `undefined` when the driver reports no count,
- * in which case callers must verify the stored value themselves instead of assuming success.
- */
-async function executeStatementWithCount(db, query) {
-    await ensureDatabaseReady(db);
-    if (isDatabaseSqlite(db)) {
-        const result = db.run(query);
-        return typeof result?.changes === 'number' ? result.changes : undefined;
-    }
-    const result = await db.execute(query);
-    return typeof result?.rowCount === 'number' ? result.rowCount : undefined;
-}
 async function executePostgresLockedStatements(db, lockKey, statements) {
     await ensureDatabaseReady(db);
     if (isDatabaseSqlite(db)) {