@undefineds.co/xpod 0.4.18 → 0.4.20

package/dist/edge/reachability/P2PDataPlaneCrypto.jsonld

@@ -1,69 +0,0 @@
-{
-  "@context": [
-    "https://linkedsoftwaredependencies.org/bundles/npm/@undefineds.co/xpod/^0.0.0/components/context.jsonld"
-  ],
-  "@id": "npmd:@undefineds.co/xpod",
-  "components": [
-    {
-      "@id": "undefineds:dist/edge/reachability/P2PDataPlaneCrypto.jsonld#P2PDataPlaneSecurityError",
-      "@type": "Class",
-      "requireElement": "P2PDataPlaneSecurityError",
-      "comment": "Distinct from protocol errors so callers can close the connection instead of retrying.",
-      "parameters": [
-        {
-          "@id": "undefineds:dist/edge/reachability/P2PDataPlaneCrypto.jsonld#P2PDataPlaneSecurityError_message",
-          "range": "xsd:string"
-        }
-      ],
-      "memberFields": [
-        {
-          "@id": "undefineds:dist/edge/reachability/P2PDataPlaneCrypto.jsonld#P2PDataPlaneSecurityError__member_constructor",
-          "memberFieldName": "constructor"
-        }
-      ],
-      "constructorArguments": [
-        {
-          "@id": "undefineds:dist/edge/reachability/P2PDataPlaneCrypto.jsonld#P2PDataPlaneSecurityError_message"
-        }
-      ]
-    },
-    {
-      "@id": "undefineds:dist/edge/reachability/P2PDataPlaneCrypto.jsonld#P2PDataPlaneKeys",
-      "@type": "AbstractClass",
-      "requireElement": "P2PDataPlaneKeys",
-      "parameters": [],
-      "memberFields": [
-        {
-          "@id": "undefineds:dist/edge/reachability/P2PDataPlaneCrypto.jsonld#P2PDataPlaneKeys__member_clientToServer",
-          "memberFieldName": "clientToServer"
-        },
-        {
-          "@id": "undefineds:dist/edge/reachability/P2PDataPlaneCrypto.jsonld#P2PDataPlaneKeys__member_serverToClient",
-          "memberFieldName": "serverToClient"
-        }
-      ],
-      "constructorArguments": []
-    },
-    {
-      "@id": "undefineds:dist/edge/reachability/P2PDataPlaneCrypto.jsonld#SealedDataPlaneFrame",
-      "@type": "AbstractClass",
-      "requireElement": "SealedDataPlaneFrame",
-      "parameters": [],
-      "memberFields": [
-        {
-          "@id": "undefineds:dist/edge/reachability/P2PDataPlaneCrypto.jsonld#SealedDataPlaneFrame__member_sequence",
-          "memberFieldName": "sequence"
-        },
-        {
-          "@id": "undefineds:dist/edge/reachability/P2PDataPlaneCrypto.jsonld#SealedDataPlaneFrame__member_nonce",
-          "memberFieldName": "nonce"
-        },
-        {
-          "@id": "undefineds:dist/edge/reachability/P2PDataPlaneCrypto.jsonld#SealedDataPlaneFrame__member_ciphertext",
-          "memberFieldName": "ciphertext"
-        }
-      ],
-      "constructorArguments": []
-    }
-  ]
-}

package/dist/edge/reachability/RouteValidation.d.ts

@@ -1,29 +0,0 @@
-import type { AccessRoute } from './types';
-/**
- * Route validity, decided locally before anything is dialled.
- *
- * Both selection paths (the managed-client fetch and the best-effort chooser) used to trust
- * whatever the node advertised: an expired access point, a loopback address from another
- * machine, or an unrelated service on the same port could all be selected (audit N06). The
- * rules live here so the two paths cannot drift apart.
- */
-export interface RouteValidityContext {
-    now: Date;
-    /** A caller on another machine cannot use a loopback access point, whatever the node says. */
-    remoteClient: boolean;
-}
-/** Fail closed: an expiry that cannot be parsed is treated as no usable expiry information. */
-export declare function routeUnusableReason(route: AccessRoute, context: RouteValidityContext): string | undefined;
-export declare function isHttpTarget(targetUrl: string): boolean;
-/**
- * Probe an HTTP access point and require evidence that it really is a Solid server.
- *
- * Captured from a running Community Solid Server: `HEAD /.well-known/solid` answers 405 with a
- * `Link` header carrying Solid vocabulary and `x-powered-by: Community Solid Server`. A 404
- * ("no Solid resource here") or 5xx (broken origin) always fails; any other answer still has to
- * carry identity evidence, because the old `status < 500` rule let an unrelated service on the
- * same port pass just by answering.
- */
-export declare function probeSolidWellKnown(targetUrl: string, signal: AbortSignal, fetchImpl?: typeof fetch): Promise<boolean>;
-/** Identity evidence for a `/.well-known/solid` answer. */
-export declare function isSolidWellKnownResponse(response: Response): boolean;

package/dist/edge/reachability/RouteValidation.js

@@ -1,58 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.routeUnusableReason = routeUnusableReason;
-exports.isHttpTarget = isHttpTarget;
-exports.probeSolidWellKnown = probeSolidWellKnown;
-exports.isSolidWellKnownResponse = isSolidWellKnownResponse;
-/** Fail closed: an expiry that cannot be parsed is treated as no usable expiry information. */
-function routeUnusableReason(route, context) {
-    if (context.remoteClient && route.visibility === 'local-only') {
-        return 'loopback-only access point, not usable from a remote client';
-    }
-    if (route.expiresAt === undefined) {
-        return undefined;
-    }
-    const expiresAt = Date.parse(route.expiresAt);
-    if (!Number.isFinite(expiresAt)) {
-        return `unparseable expiresAt "${route.expiresAt}"`;
-    }
-    if (expiresAt <= context.now.getTime()) {
-        return `expired at ${route.expiresAt}`;
-    }
-    return undefined;
-}
-function isHttpTarget(targetUrl) {
-    return targetUrl.startsWith('http://') || targetUrl.startsWith('https://');
-}
-/**
- * Probe an HTTP access point and require evidence that it really is a Solid server.
- *
- * Captured from a running Community Solid Server: `HEAD /.well-known/solid` answers 405 with a
- * `Link` header carrying Solid vocabulary and `x-powered-by: Community Solid Server`. A 404
- * ("no Solid resource here") or 5xx (broken origin) always fails; any other answer still has to
- * carry identity evidence, because the old `status < 500` rule let an unrelated service on the
- * same port pass just by answering.
- */
-async function probeSolidWellKnown(targetUrl, signal, fetchImpl) {
-    const response = await (fetchImpl ?? fetch)(new URL('/.well-known/solid', targetUrl), {
-        method: 'HEAD',
-        signal,
-    });
-    if (response.status === 404 || response.status >= 500) {
-        return false;
-    }
-    return isSolidWellKnownResponse(response);
-}
-/** Identity evidence for a `/.well-known/solid` answer. */
-function isSolidWellKnownResponse(response) {
-    const link = response.headers.get('link') ?? '';
-    if (link.includes('http://www.w3.org/ns/solid/terms#')) {
-        return true;
-    }
-    if (link.includes('rel="acl"') && link.includes('rel="describedby"')) {
-        return true;
-    }
-    const poweredBy = response.headers.get('x-powered-by') ?? '';
-    return /community solid server/iu.test(poweredBy);
-}
-//# sourceMappingURL=RouteValidation.js.map

package/dist/runtime/ingress-occupant.d.ts

@@ -1,39 +0,0 @@
-/**
- * Who holds a port.
- *
- * A tunnel console forwards to a number, not to a process: if something else already listens
- * there, binding "somewhere else" would make the tunnel reach that other process, and killing
- * it is not this runtime's decision to make. So the only thing this module does is *name* the
- * occupant (pid, command line, cwd, start time) so a refused start points at a culprit instead
- * of at a number. Nothing here ever signals a process.
- */
-export interface IngressPortOccupant {
-    pid: number;
-    /** Full command line when it could be read. */
-    command: string;
-    cwd?: string;
-    startedAt?: string;
-}
-export interface IngressPortOccupants {
-    port: number;
-    occupants: IngressPortOccupant[];
-    /**
-     * One line naming every occupant, for an error message. When nothing can be identified it
-     * says so explicitly: "taken by something we cannot name" is a different fact from "free".
-     */
-    description: string;
-}
-export interface IdentifyOccupantsDeps {
-    /** Runs a command and returns stdout. Injected in tests. */
-    exec?: (file: string, args: readonly string[]) => string;
-}
-/**
- * Names every process listening on the port.
- *
- * `lsof` is the portable answer on macOS and most Linux images; `ss` covers Linux hosts
- * without lsof. When neither is available the answer is "an unidentified listener", never a
- * silent success.
- */
-export declare function identifyIngressPortOccupants(port: number, deps?: IdentifyOccupantsDeps): IngressPortOccupants;
-/** One line for an operator: pid, command, cwd and start time of everything on the port. */
-export declare function describeOccupants(port: number, occupants: readonly IngressPortOccupant[], probeFailure?: string): string;

package/dist/runtime/ingress-occupant.js

@@ -1,111 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.identifyIngressPortOccupants = identifyIngressPortOccupants;
-exports.describeOccupants = describeOccupants;
-const node_child_process_1 = require("node:child_process");
-/**
- * Names every process listening on the port.
- *
- * `lsof` is the portable answer on macOS and most Linux images; `ss` covers Linux hosts
- * without lsof. When neither is available the answer is "an unidentified listener", never a
- * silent success.
- */
-function identifyIngressPortOccupants(port, deps = {}) {
-    const exec = deps.exec ?? defaultExec;
-    const pids = new Set();
-    let probeFailure;
-    try {
-        for (const pid of parseLsofPids(exec('lsof', ['-nP', `-iTCP:${port}`, '-sTCP:LISTEN', '-Fp']))) {
-            pids.add(pid);
-        }
-    }
-    catch (error) {
-        probeFailure = `lsof: ${error.message}`;
-    }
-    if (pids.size === 0) {
-        try {
-            for (const pid of parseSsPids(exec('ss', ['-ltnpH', `sport = :${port}`]))) {
-                pids.add(pid);
-            }
-        }
-        catch (error) {
-            probeFailure = probeFailure
-                ? `${probeFailure}; ss: ${error.message}`
-                : `ss: ${error.message}`;
-        }
-    }
-    const occupants = [...pids].map((pid) => describeProcess(pid, exec));
-    return {
-        port,
-        occupants,
-        description: describeOccupants(port, occupants, probeFailure),
-    };
-}
-/** One line for an operator: pid, command, cwd and start time of everything on the port. */
-function describeOccupants(port, occupants, probeFailure) {
-    if (occupants.length === 0) {
-        return probeFailure
-            ? `port ${port} is not bindable and no process could be named (${probeFailure})`
-            : `port ${port} is not bindable and no listener reports it (a transient bind conflict)`;
-    }
-    return occupants.map((occupant) => {
-        const parts = [
-            `pid ${occupant.pid}`,
-            occupant.command || 'command unknown',
-            occupant.cwd ? `cwd ${occupant.cwd}` : undefined,
-            occupant.startedAt ? `started ${occupant.startedAt}` : undefined,
-        ].filter(Boolean);
-        return parts.join(' · ');
-    }).join('; ');
-}
-function defaultExec(file, args) {
-    return (0, node_child_process_1.execFileSync)(file, [...args], { encoding: 'utf8', timeout: 15_000 });
-}
-function parseLsofPids(output) {
-    return output
-        .split('\n')
-        .map((line) => line.trim())
-        .filter((line) => line.startsWith('p'))
-        .map((line) => Number.parseInt(line.slice(1), 10))
-        .filter((pid) => Number.isInteger(pid) && pid > 0);
-}
-function parseSsPids(output) {
-    const pids = new Set();
-    for (const match of output.matchAll(/pid=(\d+)/gu)) {
-        const pid = Number.parseInt(match[1], 10);
-        if (Number.isInteger(pid) && pid > 0) {
-            pids.add(pid);
-        }
-    }
-    return [...pids];
-}
-function describeProcess(pid, exec) {
-    let command = '';
-    let startedAt;
-    try {
-        const line = exec('ps', ['-o', 'lstart=,command=', '-p', String(pid)]).trim();
-        // `lstart` is a fixed 24-character timestamp ("Mon Sep 22 17:28:46 2026"), so the command
-        // starts right after it; anything shorter is a bare command line.
-        const stamp = /^[A-Z][a-z]{2} [A-Z][a-z]{2} {1,2}\d{1,2} \d{2}:\d{2}:\d{2} \d{4}\s+/u.exec(line);
-        if (stamp) {
-            startedAt = stamp[0].trim();
-            command = line.slice(stamp[0].length).trim();
-        }
-        else {
-            command = line;
-        }
-    }
-    catch {
-        // The process may have exited between the port probe and this call.
-    }
-    let cwd;
-    try {
-        const line = exec('lsof', ['-a', '-p', String(pid), '-d', 'cwd', '-Fn']).trim();
-        cwd = line.split('\n').find((entry) => entry.startsWith('n'))?.slice(1).trim() || undefined;
-    }
-    catch {
-        // cwd is optional evidence.
-    }
-    return { pid, command, ...(cwd ? { cwd } : {}), ...(startedAt ? { startedAt } : {}) };
-}
-//# sourceMappingURL=ingress-occupant.js.map

package/dist/runtime/ingress-port.d.ts

@@ -1,89 +0,0 @@
-import { type DeclaredOriginReadResult } from '../tunnel/TunnelDeclaredOrigin';
-/**
- * Where the tunnel entry (the listener every remote forwarder terminates on) is bound.
- *
- * Order, strictest first:
- *   1. an explicit `XPOD_GATEWAY_INGRESS_PORT` — an operator or harness pin is never overridden
- *      and never silently moved to another port;
- *   2. the port the *active* profile's provider console already declares (SakuraFrp
- *      `GET /v4/tunnels` `local_port`; the Cloudflare dashboard's remote configuration read
- *      back through the connector) — adopted when it is free, so the operator does not have to
- *      edit the console to match the runtime;
- *   3. `findGatewayIngressPort(gatewayPort)` — the predictable, dynamic gateway+3..+9 entry.
- *
- * Both strict sources are strict about *being taken*: a port somebody else holds fails the
- * start with the occupant named (pid, command line, cwd). Nothing here signals a process, and
- * nothing silently falls back — a tunnel that forwards to a number must never find a different
- * process listening on it.
- */
-export type IngressPortSource = 'explicit' | 'console-declared' | 'gateway-default';
-export interface IngressProfileLike {
-    id: string;
-    provider: string;
-    credentialEnvKey?: string;
-    credentialConfigured?: boolean;
-}
-/** A port a provider console declares for this runtime's origin. */
-export interface IngressPortDeclaration {
-    profileId: string;
-    provider: string;
-    port: number;
-    readBack: string;
-    scheme?: string;
-}
-export interface IngressPortResolution {
-    port: number;
-    source: IngressPortSource;
-    /** The active profile's declaration that was adopted, when there was one. */
-    declared?: IngressPortDeclaration;
-    /**
-     * Declarations from profiles that are *not* active.
-     *
-     * They are reported because two profiles naming different ports is exactly the confusion
-     * this resolution exists to end; only the active one may decide the listener.
-     */
-    inactiveDeclarations: IngressPortDeclaration[];
-}
-export interface IngressPortLogger {
-    info(message: string): void;
-    warn(message: string): void;
-}
-export interface IngressPortDeps {
-    findDefaultPort(mainPort: number): Promise<number>;
-    isFree(port: number): Promise<boolean>;
-    identifyOccupants(port: number): string;
-    readDeclaredOrigin(profile: IngressProfileLike, options: {
-        env: Record<string, string | undefined>;
-        active: boolean;
-    }): Promise<DeclaredOriginReadResult>;
-    logger: IngressPortLogger;
-}
-export interface IngressPortRequest {
-    mainPort: number;
-    env?: Record<string, string | undefined>;
-    profiles?: readonly IngressProfileLike[];
-    activeProfileId?: string;
-    /** Service ports this run serves (gateway/CSS/API): never a valid tunnel origin. */
-    reservedPorts?: Iterable<number>;
-    deps?: Partial<IngressPortDeps>;
-}
-/** A strict port that could not be taken: the occupant is named, and nothing was signalled. */
-export declare class IngressPortConflictError extends Error {
-    readonly port: number;
-    readonly occupant: string;
-    constructor(port: number, occupant: string);
-}
-export declare function defaultIngressPortDeps(): IngressPortDeps;
-/**
- * Validates a port that came from outside this runtime (an operator pin or a console).
- *
- * Zero, out-of-range and privileged ports are refused with the reason spelled out: binding
- * them either fails later with a bare errno, or needs privileges the runtime should not hold.
- */
-export declare function assertUsableIngressPort(port: number, options: {
-    label: string;
-    reservedPorts?: ReadonlySet<number>;
-}): void;
-/** Reads the explicit pin strictly: present but malformed is an error, not an absent value. */
-export declare function parseExplicitIngressPort(raw: string | undefined): number | undefined;
-export declare function resolveIngressPort(request: IngressPortRequest): Promise<IngressPortResolution>;

package/dist/runtime/ingress-port.js

@@ -1,165 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.IngressPortConflictError = void 0;
-exports.defaultIngressPortDeps = defaultIngressPortDeps;
-exports.assertUsableIngressPort = assertUsableIngressPort;
-exports.parseExplicitIngressPort = parseExplicitIngressPort;
-exports.resolveIngressPort = resolveIngressPort;
-const global_logger_factory_1 = require("global-logger-factory");
-const port_finder_1 = require("./port-finder");
-const ingress_occupant_1 = require("./ingress-occupant");
-const TunnelDeclaredOrigin_1 = require("../tunnel/TunnelDeclaredOrigin");
-const TunnelProviderCatalog_1 = require("../tunnel/TunnelProviderCatalog");
-/** A strict port that could not be taken: the occupant is named, and nothing was signalled. */
-class IngressPortConflictError extends Error {
-    constructor(port, occupant) {
-        super(`tunnel entry port ${port} is already in use by ${occupant}`);
-        this.port = port;
-        this.occupant = occupant;
-        this.name = 'IngressPortConflictError';
-    }
-}
-exports.IngressPortConflictError = IngressPortConflictError;
-function defaultIngressPortDeps() {
-    const logger = (0, global_logger_factory_1.getLoggerFor)('IngressPort');
-    return {
-        findDefaultPort: port_finder_1.findGatewayIngressPort,
-        isFree: port_finder_1.isFreePortForWildcard,
-        identifyOccupants: (port) => (0, ingress_occupant_1.identifyIngressPortOccupants)(port).description,
-        readDeclaredOrigin: async (profile, options) => await (0, TunnelDeclaredOrigin_1.readDeclaredIngressOrigin)(profile, {
-            env: options.env,
-            active: options.active,
-        }),
-        logger: {
-            info: (message) => logger.info(message),
-            warn: (message) => logger.warn(message),
-        },
-    };
-}
-/**
- * Validates a port that came from outside this runtime (an operator pin or a console).
- *
- * Zero, out-of-range and privileged ports are refused with the reason spelled out: binding
- * them either fails later with a bare errno, or needs privileges the runtime should not hold.
- */
-function assertUsableIngressPort(port, options) {
-    if (!Number.isInteger(port) || port <= 0 || port > 65_535) {
-        throw new Error(`${options.label} is not a usable port (expected 1-65535); `
-            + 'a tunnel origin has to be a real port number');
-    }
-    if (port < 1024) {
-        throw new Error(`${options.label} is a privileged port (1-1023); this runtime does not take root `
-            + 'to bind a tunnel origin, so point the tunnel at a port at or above 1024');
-    }
-    if (options.reservedPorts?.has(port)) {
-        throw new Error(`${options.label} is a port this runtime already serves (gateway/CSS/API); `
-            + 'the tunnel entry has to be its own listener, or forwarded traffic would land on another service');
-    }
-}
-/** Reads the explicit pin strictly: present but malformed is an error, not an absent value. */
-function parseExplicitIngressPort(raw) {
-    const trimmed = raw?.trim();
-    if (trimmed === undefined || trimmed === '') {
-        return undefined;
-    }
-    if (!/^\d+$/u.test(trimmed)) {
-        throw new Error(`XPOD_GATEWAY_INGRESS_PORT="${trimmed}" is not a valid port number (expected 1-65535)`);
-    }
-    return Number.parseInt(trimmed, 10);
-}
-async function resolveIngressPort(request) {
-    const deps = { ...defaultIngressPortDeps(), ...request.deps };
-    const env = request.env ?? process.env;
-    const reservedPorts = new Set(request.reservedPorts ?? []);
-    const profiles = request.profiles ?? [];
-    const activeProfileId = request.activeProfileId?.trim();
-    const active = activeProfileId && activeProfileId !== 'none'
-        ? profiles.find((profile) => profile.id === activeProfileId)
-        : undefined;
-    const explicit = parseExplicitIngressPort(env.XPOD_GATEWAY_INGRESS_PORT);
-    if (explicit !== undefined) {
-        assertUsableIngressPort(explicit, {
-            label: `XPOD_GATEWAY_INGRESS_PORT=${explicit}`,
-            reservedPorts,
-        });
-        await requireFree(explicit, `XPOD_GATEWAY_INGRESS_PORT=${explicit}`, deps);
-        deps.logger.info(`Tunnel entry pinned to ${explicit} by XPOD_GATEWAY_INGRESS_PORT `
-            + '(a provider console value is not read while an explicit pin is present)');
-        return { port: explicit, source: 'explicit', inactiveDeclarations: [] };
-    }
-    const inactiveDeclarations = await readInactiveConsoleDeclarations({ profiles, active, env, deps });
-    for (const declaration of inactiveDeclarations) {
-        deps.logger.warn(`profile ${declaration.profileId} (${declaration.provider}) is not active, but its console declares `
-            + `tunnel origin ${declaration.port} (${declaration.readBack}); `
-            + `the active profile is ${active?.id ?? 'none'}, so its entry decides this runtime's listener`);
-    }
-    const activeDescriptor = active ? (0, TunnelProviderCatalog_1.tunnelProviderDescriptor)(active.provider) : undefined;
-    if (active && activeDescriptor?.originOwner === 'console') {
-        const read = await deps.readDeclaredOrigin(active, { env, active: true });
-        if (read.origin) {
-            const label = `the ${activeDescriptor.label} console's declared tunnel origin ${read.origin.port}`;
-            assertUsableIngressPort(read.origin.port, { label, reservedPorts });
-            await requireFree(read.origin.port, label, deps);
-            if (read.origin.scheme && read.origin.scheme !== 'http') {
-                deps.logger.warn(`${activeDescriptor.label} declares the origin as ${read.origin.scheme}://localhost:${read.origin.port}, `
-                    + `but this runtime's tunnel entry speaks plain HTTP; the port is adopted, the scheme is not `
-                    + '(terminate TLS in the provider, or point the console at http://)');
-            }
-            deps.logger.info(`Adopting the ${activeDescriptor.label} console's tunnel origin ${read.origin.port} `
-                + `(${read.origin.readBack}); the operator does not have to edit the console`);
-            return {
-                port: read.origin.port,
-                source: 'console-declared',
-                declared: {
-                    profileId: active.id,
-                    provider: activeDescriptor.id,
-                    port: read.origin.port,
-                    readBack: read.origin.readBack,
-                    ...(read.origin.scheme ? { scheme: read.origin.scheme } : {}),
-                },
-                inactiveDeclarations,
-            };
-        }
-        // The console owns the number, so the runtime cannot invent a different one and still be
-        // reachable. The declaration is unreadable here, which is reported loudly; an explicit pin
-        // (handled above) is the deterministic way out.
-        deps.logger.warn(`the ${activeDescriptor.label} console's tunnel origin could not be read `
-            + `(${read.error ?? 'no reason reported'}); this runtime will serve the default tunnel entry `
-            + 'instead, and the tunnel provider will report its own failure. '
-            + 'Pin XPOD_GATEWAY_INGRESS_PORT to decide the entry explicitly');
-    }
-    const port = await deps.findDefaultPort(request.mainPort);
-    deps.logger.info(`Tunnel entry ${port} chosen from the gateway port ${request.mainPort} (gateway+3..+9, first free port)`);
-    return { port, source: 'gateway-default', inactiveDeclarations };
-}
-/** A strict port is taken as-is or not at all; the occupant is named, never signalled. */
-async function requireFree(port, label, deps) {
-    if (await deps.isFree(port)) {
-        return;
-    }
-    const occupant = deps.identifyOccupants(port);
-    throw new IngressPortConflictError(port, occupant);
-}
-async function readInactiveConsoleDeclarations(input) {
-    const declarations = [];
-    for (const profile of input.profiles) {
-        if (profile.id === input.active?.id) {
-            continue;
-        }
-        if ((0, TunnelProviderCatalog_1.tunnelProviderDescriptor)(profile.provider)?.originOwner !== 'console') {
-            continue;
-        }
-        const read = await input.deps.readDeclaredOrigin(profile, { env: input.env, active: false });
-        if (read.origin) {
-            declarations.push({
-                profileId: profile.id,
-                provider: profile.provider,
-                port: read.origin.port,
-                readBack: read.origin.readBack,
-                ...(read.origin.scheme ? { scheme: read.origin.scheme } : {}),
-            });
-        }
-    }
-    return declarations;
-}
-//# sourceMappingURL=ingress-port.js.map

package/dist/runtime/port-reservations.d.ts

@@ -1,86 +0,0 @@
-/**
- * Port reservations: one small mechanism that keeps every *other* group off the fixed ports a
- * group needs.
- *
- * The tunnel acceptance has two legs whose origin port is not ours to choose — the Cloudflare
- * Dashboard's local service port and the SakuraFrp console's `local_port`, both 5737 on the
- * operator's machine. Those are fixed parameters, so the group that needs them publishes a
- * reservation, and every port *allocator* in the repo skips reserved ports:
- *
- * - allocation helpers in `src/runtime/port-finder.ts` (which is what the runtime, the test
- *   helpers, `run-integration-full`/`run-integration-lite` and the acceptance harness use);
- * - the harness's own free-port helpers.
- *
- * Two sources, both optional and both additive:
- * - the `XPOD_RESERVED_PORTS` env var (`"5737,4599"`), for a run that knows its fixed ports;
- * - one JSON file per reservation under `.test-data/port-reservations/`, for a group that
- *   holds a port for the duration of a run.
- *
- * A reservation is a *claim about the future*, not a lock: it is never enforced against a
- * process that ignores it. That is deliberate — the network group fails loudly naming whoever
- * holds its port, and nothing in this repo signals a process it does not own.
- *
- * Reservations expire (12h by default) so a crashed run cannot block a port forever.
- */
-export declare const RESERVED_PORTS_ENV = "XPOD_RESERVED_PORTS";
-export declare const PORT_RESERVATION_DIR_ENV = "XPOD_PORT_RESERVATION_DIR";
-export interface PortReservation {
-    port: number;
-    /** Who holds it: a run id, a harness name, an operator. */
-    owner: string;
-    /** Which group needs the fixed port (`network` for the tunnel acceptance). */
-    group: string;
-    /** ISO timestamp the reservation was written. */
-    reservedAt: string;
-    /** Why this port is fixed, so the next person does not have to guess. */
-    note?: string;
-    /** Where the reservation came from, so a log line can name the source. */
-    source?: 'file' | 'env';
-}
-export declare function portReservationDir(root?: string): string;
-export declare function portReservationFile(port: number, root?: string): string;
-/** Publishes a reservation (idempotent for the same owner and port). */
-export declare function reservePort(reservation: Omit<PortReservation, 'reservedAt'> & {
-    reservedAt?: string;
-}, root?: string): PortReservation;
-/** Removes a reservation this owner wrote; another owner's reservation is left alone. */
-export declare function releasePort(port: number, owner: string, root?: string): boolean;
-export declare function parseReservedPortsEnv(value: string | undefined): number[];
-/** Every reservation in force right now: env var plus unexpired files. */
-export declare function readPortReservations(options?: {
-    env?: Record<string, string | undefined>;
-    root?: string;
-    now?: number;
-    ttlMs?: number;
-}): PortReservation[];
-/** The set every allocator skips. Cheap enough to call once per allocation. */
-export declare function reservedPorts(options?: {
-    env?: Record<string, string | undefined>;
-    root?: string;
-    now?: number;
-}): Set<number>;
-/** The reservation covering a port, when there is one: what a failure message should name. */
-export declare function portReservation(port: number, options?: {
-    env?: Record<string, string | undefined>;
-    root?: string;
-    now?: number;
-}): PortReservation | undefined;
-/** The slice of `net.Server`/`http.Server` this needs, so both can be passed in. */
-export interface ReservingListenable {
-    listen(port: number, host: string, callback: () => void): unknown;
-    address(): {
-        port: number;
-    } | string | null;
-    close(callback?: (error?: Error) => void): unknown;
-    once(event: 'error', listener: (error: Error) => void): unknown;
-}
-/**
- * Binds a server to an OS-assigned port that is not reserved.
- *
- * `listen(0)` hands out whatever the kernel likes, reservations included. Fixtures that bind
- * their own server therefore come through here: one retry loop, one rule, and a reserved port is
- * never taken even by accident.
- */
-export declare function listenOnUnreservedPort(server: ReservingListenable, host?: string, attempts?: number): Promise<number>;
-/** An unreserved OS-assigned port, released again so the caller can bind it itself. */
-export declare function getUnreservedEphemeralPort(host?: string, attempts?: number): Promise<number>;