@undefineds.co/xpod 0.4.18 → 0.4.20

package/dist/api/runtime.js

@@ -10,7 +10,6 @@ const ConfigurableLoggerFactory_1 = require("../logging/ConfigurableLoggerFactor
 const log_file_1 = require("../logging/log-file");
 const container_1 = require("./container");
 const routes_1 = require("./container/routes");
-const background_service_supervisor_1 = require("./background-service-supervisor");
 const OpenAuthMiddleware_1 = require("./middleware/OpenAuthMiddleware");
 const EmbeddedInngestService_1 = require("./runs/EmbeddedInngestService");
 const LocalProvisionState_1 = require("../provision/LocalProvisionState");
@@ -365,13 +364,6 @@ function resolveTunnelIngressPort(env = process.env) {
     }
     return 3000;
 }
-/**
- * 后台服务由 supervisor 接管（审计 N18）。
- *
- * 此前每个服务只 start 一次，失败只写日志：开机时断网、provider 抖动的隧道会一直躺着，
- * 跑着跑着死掉的也没人发现。现在启动失败按退避重试，起来之后按间隔复查存活。
- */
-const backgroundSupervisors = [];
 async function startBackgroundServices(container, logger) {
     try {
         const localNetworkManager = container.resolve('localNetworkManager', { allowUnregistered: true });
@@ -385,18 +377,8 @@ async function startBackgroundServices(container, logger) {
     try {
         const ddnsManager = container.resolve('ddnsManager', { allowUnregistered: true });
         if (ddnsManager) {
-            const supervisor = new background_service_supervisor_1.BackgroundServiceSupervisor({
-                name: 'ddns',
-                start: async () => {
-                    await ddnsManager.start();
-                },
-                stop: async () => {
-                    ddnsManager.stop?.();
-                },
-                logger,
-            });
-            backgroundSupervisors.push(supervisor);
-            supervisor.start();
+            await ddnsManager.start();
+            logger.info('DDNS Manager started');
         }
     }
     catch (error) {
@@ -406,25 +388,13 @@ async function startBackgroundServices(container, logger) {
         const localTunnelProvider = container.resolve('localTunnelProvider', { allowUnregistered: true });
         if (localTunnelProvider) {
             logger.info('Starting local tunnel provider...');
-            const supervisor = new background_service_supervisor_1.BackgroundServiceSupervisor({
-                name: `tunnel:${String(localTunnelProvider.name ?? 'local')}`,
-                start: async () => {
-                    const config = await localTunnelProvider.setup({
-                        subdomain: 'local',
-                        localPort: resolveTunnelIngressPort(),
-                        localProtocol: 'http',
-                    });
-                    await localTunnelProvider.start(config);
-                },
-                stop: async () => {
-                    await localTunnelProvider.stop?.();
-                },
-                // 隧道进程退出后 provider 自己知道状态，supervisor 据此重启。
-                isRunning: () => Boolean(localTunnelProvider.getStatus?.().running),
-                logger,
+            const config = await localTunnelProvider.setup({
+                subdomain: 'local',
+                localPort: resolveTunnelIngressPort(),
+                localProtocol: 'http',
             });
-            backgroundSupervisors.push(supervisor);
-            supervisor.start();
+            await localTunnelProvider.start(config);
+            logger.info('Local tunnel provider started');
         }
     }
     catch (error) {
@@ -432,10 +402,12 @@ async function startBackgroundServices(container, logger) {
     }
 }
 async function stopBackgroundServices(container) {
-    // 先停监督器：否则一次关停会被自己排的重试撤销（ddns/tunnel 的 stop 由它们负责调用）。
-    while (backgroundSupervisors.length > 0) {
-        const supervisor = backgroundSupervisors.pop();
-        await supervisor?.stop();
+    try {
+        const ddnsManager = container.resolve('ddnsManager', { allowUnregistered: true });
+        ddnsManager?.stop();
+    }
+    catch {
+        // ignore shutdown errors
     }
     try {
         const localNetworkManager = container.resolve('localNetworkManager', { allowUnregistered: true });
@@ -444,8 +416,13 @@ async function stopBackgroundServices(container) {
     catch {
         // ignore shutdown errors
     }
-    // The tunnel provider's stop is owned by its supervisor above; stopping it twice would kill
-    // the same process twice and make the shutdown path look like it did more than it did.
+    try {
+        const localTunnelProvider = container.resolve('localTunnelProvider', { allowUnregistered: true });
+        await localTunnelProvider?.stop();
+    }
+    catch {
+        // ignore shutdown errors
+    }
 }
 async function stopApiRuntimeServices(container) {
     try {

package/dist/cli/commands/start.d.ts

@@ -13,19 +13,26 @@ export declare const startCommand: CommandModule<object, StartArgs>;
 /**
  * Where remote-forwarded traffic lands on this machine.
  *
- * The decision (explicit pin → the active profile's console declaration → the gateway-derived
- * entry) lives in `src/runtime/ingress-port.ts`, together with the strict "taken means taken"
- * check and the occupant naming. This only reports the outcome, so the startup banner says
- * whether the entry was pinned, adopted from a console, or derived from the gateway port.
+ * Order: explicit `XPOD_GATEWAY_INGRESS_PORT` → the active SakuraFrp tunnel's assigned local
+ * port → an OS-assigned loopback port. The first two are strict, because a tunnel that
+ * forwards to a specific port cannot follow us somewhere else.
  */
-export declare function describeIngressDecision(ingress: {
-    port: number;
-    source: string;
-    declared?: {
+/**
+ * The port a remote tunnel forwards to: the Gateway's tunnel entry.
+ *
+ * It is derived from the Gateway port by the same rule the runtime uses, so the CLI can hand
+ * it to the managed edge agent before the runtime binds it. A console that forwards somewhere
+ * else is a mismatch the tunnel provider reports from its own read-back - the runtime never
+ * moves its gate to match a console.
+ */
+export declare function resolveIngressPort(provisionedConfig: {
+    tunnelProfiles?: Array<{
+        id: string;
         provider: string;
-        readBack: string;
-    };
-}): string;
+        credentialEnvKey?: string;
+    }>;
+    tunnelActiveProfileId?: string;
+}, mainPort: number): Promise<number>;
 export declare function resolveCliOidcIssuer(env: Record<string, string | undefined>, provisionedIssuer?: string, edition?: string): string | undefined;
 export declare function resolveManagedEdgeAgentConfig(config: Pick<ReturnType<typeof loadConfigFromEnv>, 'cloudApiEndpoint' | 'nodeId' | 'nodeToken'>, gatewayPort: number, ingressPort?: number, runtimeEnv?: Record<string, string | undefined>): {
     signalEndpoint: string;

package/dist/cli/commands/start.js

@@ -4,7 +4,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.startCommand = void 0;
-exports.describeIngressDecision = describeIngressDecision;
+exports.resolveIngressPort = resolveIngressPort;
 exports.resolveCliOidcIssuer = resolveCliOidcIssuer;
 exports.resolveManagedEdgeAgentConfig = resolveManagedEdgeAgentConfig;
 exports.resolveChildDatabaseUrl = resolveChildDatabaseUrl;
@@ -16,7 +16,7 @@ const fs_1 = __importDefault(require("fs"));
 const global_logger_factory_1 = require("global-logger-factory");
 const supervisor_1 = require("../../supervisor");
 const runtime_1 = require("../../runtime");
-const ingress_port_1 = require("../../runtime/ingress-port");
+const SakuraFrpTunnelProvider_1 = require("../../tunnel/SakuraFrpTunnelProvider");
 const css_process_1 = require("../../runtime/css-process");
 const oidc_issuer_1 = require("../../runtime/oidc-issuer");
 const AuthMode_1 = require("../../authorization/AuthMode");
@@ -107,30 +107,17 @@ exports.startCommand = {
         const cssPort = await (0, runtime_1.getFreePortForWildcard)(requestedCssPort);
         const requestedApiPort = resolveServicePort(process.env.API_PORT, cssPort + 1, new Set([mainPort, cssPort]));
         const apiPort = await (0, runtime_1.getFreePortForWildcard)(requestedApiPort);
-        // Remote forwarding (managed tunnels, P2P data plane) terminates on this machine, so its
-        // origin is a dedicated ingress port instead of the gateway port: the Gateway never treats
-        // requests accepted there as local.
-        //
-        // Order (see `resolveIngressPort`): an explicit `XPOD_GATEWAY_INGRESS_PORT` wins; otherwise
-        // the *active* profile's provider console decides — for a console-owned tunnel the runtime
-        // adopts the port that console already declares (SakuraFrp's `local_port`, the Cloudflare
-        // dashboard's remote configuration read back through the connector) instead of asking the
-        // operator to edit the console; only an entry nobody declares is derived from the gateway
-        // port (gateway+3..+9).
-        //
-        // Both strict sources are strict: a port that somebody else holds fails the start with the
-        // occupant named (pid, command line, cwd), and nothing is ever signalled or silently moved
-        // to another port - the tunnel forwards to a number, so it must find this runtime there.
-        const ingress = await (0, ingress_port_1.resolveIngressPort)({
-            mainPort,
-            env: process.env,
-            profiles: provisionedConfig.tunnelProfiles ?? [],
-            ...(provisionedConfig.tunnelActiveProfileId
-                ? { activeProfileId: provisionedConfig.tunnelActiveProfileId }
-                : {}),
-            reservedPorts: [mainPort, cssPort, apiPort],
-        });
-        const ingressPort = ingress.port;
+        // Remote forwarding (managed tunnels, P2P data plane) terminates on this machine, so
+        // its origin is a dedicated ingress port instead of the gateway port: the Gateway
+        // never treats requests accepted there as local. An explicit override is honoured;
+        // otherwise the OS assigns a loopback port, because neighbouring ports may already
+        // belong to another service this deployment planned.
+        // The port is a fact of whichever tunnel forwards to us: an explicit override pins it,
+        // and the SakuraFrp console's own 本地端口 is read back from the provider, so the
+        // operator never types the same number twice. Only an unmanaged ingress is ephemeral.
+        // A pinned port is taken as-is: silently moving it would leave the tunnel pointing at a
+        // port nobody listens on.
+        const ingressPort = await resolveIngressPort(provisionedConfig, mainPort);
         // Published so the API can tell the operator which address a tunnel must forward to.
         process.env.XPOD_GATEWAY_INGRESS_PORT = String(ingressPort);
         const runtimeRoot = path_1.default.join(process.cwd(), '.xpod/runtime/legacy-css');
@@ -156,7 +143,6 @@ exports.startCommand = {
         console.log(`  Gateway: ${baseUrl} (${argv.host}:${mainPort})`);
         console.log(`  CSS (internal): http://localhost:${cssPort}`);
         console.log(`  API (internal): http://localhost:${apiPort}`);
-        console.log(`  Tunnel entry: http://127.0.0.1:${ingressPort} — ${describeIngressDecision(ingress)}`);
         if (externalOidcIssuer) {
             console.log(`  SP mode: Cloud IdP = ${externalOidcIssuer}`);
         }
@@ -249,27 +235,46 @@ exports.startCommand = {
 /**
  * Where remote-forwarded traffic lands on this machine.
  *
- * The decision (explicit pin → the active profile's console declaration → the gateway-derived
- * entry) lives in `src/runtime/ingress-port.ts`, together with the strict "taken means taken"
- * check and the occupant naming. This only reports the outcome, so the startup banner says
- * whether the entry was pinned, adopted from a console, or derived from the gateway port.
+ * Order: explicit `XPOD_GATEWAY_INGRESS_PORT` → the active SakuraFrp tunnel's assigned local
+ * port → an OS-assigned loopback port. The first two are strict, because a tunnel that
+ * forwards to a specific port cannot follow us somewhere else.
  */
-function describeIngressDecision(ingress) {
-    if (ingress.source === 'explicit') {
-        return `pinned by XPOD_GATEWAY_INGRESS_PORT`;
-    }
-    if (ingress.source === 'console-declared' && ingress.declared) {
-        return `adopted from the ${ingress.declared.provider} console (${ingress.declared.readBack})`;
+/**
+ * The port a remote tunnel forwards to: the Gateway's tunnel entry.
+ *
+ * It is derived from the Gateway port by the same rule the runtime uses, so the CLI can hand
+ * it to the managed edge agent before the runtime binds it. A console that forwards somewhere
+ * else is a mismatch the tunnel provider reports from its own read-back - the runtime never
+ * moves its gate to match a console.
+ */
+async function resolveIngressPort(provisionedConfig, mainPort) {
+    const port = await (0, runtime_1.findGatewayIngressPort)(mainPort);
+    const active = provisionedConfig.tunnelProfiles?.find((profile) => profile.id === provisionedConfig.tunnelActiveProfileId) ?? provisionedConfig.tunnelProfiles?.find((profile) => profile.provider === 'sakura_frp');
+    if (active?.provider === 'sakura_frp') {
+        const credential = active.credentialEnvKey
+            ? process.env[active.credentialEnvKey] ?? process.env.SAKURA_TUNNEL_TOKEN
+            : process.env.SAKURA_TUNNEL_TOKEN;
+        const assigned = await (0, SakuraFrpTunnelProvider_1.resolveSakuraAssignedLocalPort)(credential);
+        if (assigned !== undefined && assigned !== port) {
+            (0, global_logger_factory_1.getLoggerFor)('XpodStart').warn(`The Sakura console forwards to local port ${assigned}, but this runtime's tunnel entry is ${port}; `
+                + `update the tunnel's local port in the console to ${port}`);
+        }
     }
-    return 'derived from the gateway port (gateway+3..+9)';
+    return port;
 }
 function resolveCliOidcIssuer(env, provisionedIssuer, edition) {
-    // A remembered loopback issuer is residue from a run that served it; this one does not, so the
-    // local edition falls back to the Cloud identity instead of a port with no listener.
-    const remembered = (0, oidc_issuer_1.isLoopbackIssuer)(provisionedIssuer) ? undefined : provisionedIssuer;
-    return (0, oidc_issuer_1.resolveExternalOidcIssuer)(env)
-        ?? (0, oidc_issuer_1.resolveExternalOidcIssuer)({ SOLID_OIDC_ISSUER: remembered })
-        ?? (edition === 'local' ? oidc_issuer_1.DEFAULT_LOCAL_OIDC_ISSUER : undefined);
+    const explicit = (0, oidc_issuer_1.resolveExternalOidcIssuer)(env);
+    if (explicit) {
+        return explicit;
+    }
+    // A remembered issuer is residue from an earlier run, so it only counts when the
+    // network can still serve it. Adopting a loopback one points every login at a port
+    // with no listener - and the identity origin must never become this machine's port.
+    const remembered = (0, oidc_issuer_1.resolveExternalOidcIssuer)({ SOLID_OIDC_ISSUER: provisionedIssuer });
+    if (remembered && !(0, oidc_issuer_1.isLoopbackIssuer)(remembered)) {
+        return remembered;
+    }
+    return edition === 'local' ? oidc_issuer_1.DEFAULT_LOCAL_OIDC_ISSUER : undefined;
 }
 function resolveManagedEdgeAgentConfig(config, gatewayPort, ingressPort, runtimeEnv = {}) {
     if (!config.cloudApiEndpoint || !config.nodeId || !config.nodeToken) {

package/dist/cli/commands/stop.js

@@ -39,17 +39,11 @@ exports.stopCommand = {
         }
         try {
             const res = await fetch(`${baseUrl}/service/status`);
-            // 503 means the gateway is reachable but degraded (a supervised child is down or gave up).
-            // Stopping a half-dead instance must stay possible, so only other failures are fatal.
-            const degraded = res.status === 503;
-            if (!res.ok && !degraded) {
+            if (!res.ok) {
                 throw new output_1.CliCommandError('server_not_reachable', 'Service not reachable or already stopped.', 1, {
                     status: res.status,
                 });
             }
-            if (degraded && !argv.json) {
-                console.log('Instance is degraded (a supervised service is not running); stopping it anyway.');
-            }
             const statuses = (await res.json());
             const running = statuses.filter((s) => s.status === 'running');
             if (running.length === 0) {

package/dist/components/components.jsonld

@@ -132,13 +132,13 @@
     "undefineds:dist/api/reconciler/ClientReconcilerCoordinator.jsonld",
     "undefineds:dist/api/reconciler/WakeAgentQueue.jsonld",
     "undefineds:dist/api/reconciler/ServerGroupReconcilerService.jsonld",
+    "undefineds:dist/api/reconciler/AgentWakeRuntimeService.jsonld",
     "undefineds:dist/edge/reachability/types.jsonld",
     "undefineds:dist/edge/reachability/RouteSetBuilder.jsonld",
     "undefineds:dist/edge/reachability/ReachabilitySessionService.jsonld",
     "undefineds:dist/edge/reachability/ManagedRouteSelector.jsonld",
     "undefineds:dist/edge/reachability/CanonicalFetch.jsonld",
     "undefineds:dist/edge/reachability/P2PDataPlane.jsonld",
-    "undefineds:dist/edge/reachability/P2PDataPlaneCrypto.jsonld",
     "undefineds:dist/edge/reachability/P2PSignalingClient.jsonld",
     "undefineds:dist/edge/reachability/TcpP2PDataPlaneTransport.jsonld",
     "undefineds:dist/edge/reachability/TcpP2PSignalingSession.jsonld",

package/dist/components/context.jsonld

@@ -2955,10 +2955,6 @@
           "options_cloudflaredPath": {
             "@id": "undefineds:dist/tunnel/LocalTunnelProvider.jsonld#LocalTunnelProvider_options_cloudflaredPath"
           },
-          "options_env": {
-            "@id": "undefineds:dist/tunnel/LocalTunnelProvider.jsonld#LocalTunnelProvider_options_env",
-            "@container": "@list"
-          },
           "options_connectTimeoutMs": {
             "@id": "undefineds:dist/tunnel/LocalTunnelProvider.jsonld#LocalTunnelProvider_options_connectTimeoutMs"
           },
@@ -2971,10 +2967,6 @@
           "cloudflaredPath": {
             "@id": "undefineds:dist/tunnel/LocalTunnelProvider.jsonld#LocalTunnelProvider_options_cloudflaredPath"
           },
-          "env": {
-            "@id": "undefineds:dist/tunnel/LocalTunnelProvider.jsonld#LocalTunnelProvider_options_env",
-            "@container": "@list"
-          },
           "connectTimeoutMs": {
             "@id": "undefineds:dist/tunnel/LocalTunnelProvider.jsonld#LocalTunnelProvider_options_connectTimeoutMs"
           }
@@ -2993,10 +2985,6 @@
           "options_ngrokPath": {
             "@id": "undefineds:dist/tunnel/NgrokTunnelProvider.jsonld#NgrokTunnelProvider_options_ngrokPath"
           },
-          "options_env": {
-            "@id": "undefineds:dist/tunnel/NgrokTunnelProvider.jsonld#NgrokTunnelProvider_options_env",
-            "@container": "@list"
-          },
           "options_agentApiUrl": {
             "@id": "undefineds:dist/tunnel/NgrokTunnelProvider.jsonld#NgrokTunnelProvider_options_agentApiUrl"
           },
@@ -3012,10 +3000,6 @@
           "ngrokPath": {
             "@id": "undefineds:dist/tunnel/NgrokTunnelProvider.jsonld#NgrokTunnelProvider_options_ngrokPath"
           },
-          "env": {
-            "@id": "undefineds:dist/tunnel/NgrokTunnelProvider.jsonld#NgrokTunnelProvider_options_env",
-            "@container": "@list"
-          },
           "agentApiUrl": {
             "@id": "undefineds:dist/tunnel/NgrokTunnelProvider.jsonld#NgrokTunnelProvider_options_agentApiUrl"
           },
@@ -3906,13 +3890,32 @@
       "InMemoryWakeAgentQueue": {
         "@id": "undefineds:dist/api/reconciler/WakeAgentQueue.jsonld#InMemoryWakeAgentQueue",
         "@prefix": true,
-        "@context": {}
+        "@context": {
+          "options": {
+            "@id": "undefineds:dist/api/reconciler/WakeAgentQueue.jsonld#InMemoryWakeAgentQueue_options"
+          }
+        }
       },
       "WakeAgentEnqueueResult": {
         "@id": "undefineds:dist/api/reconciler/WakeAgentQueue.jsonld#WakeAgentEnqueueResult",
         "@prefix": true,
         "@context": {}
       },
+      "WakeAgentClaimOptions": {
+        "@id": "undefineds:dist/api/reconciler/WakeAgentQueue.jsonld#WakeAgentClaimOptions",
+        "@prefix": true,
+        "@context": {}
+      },
+      "WakeAgentLeaseReference": {
+        "@id": "undefineds:dist/api/reconciler/WakeAgentQueue.jsonld#WakeAgentLeaseReference",
+        "@prefix": true,
+        "@context": {}
+      },
+      "WakeAgentFailureOptions": {
+        "@id": "undefineds:dist/api/reconciler/WakeAgentQueue.jsonld#WakeAgentFailureOptions",
+        "@prefix": true,
+        "@context": {}
+      },
       "WakeAgentQueue": {
         "@id": "undefineds:dist/api/reconciler/WakeAgentQueue.jsonld#WakeAgentQueue",
         "@prefix": true,
@@ -3947,6 +3950,38 @@
         "@prefix": true,
         "@context": {}
       },
+      "AgentWakeRuntimeService": {
+        "@id": "undefineds:dist/api/reconciler/AgentWakeRuntimeService.jsonld#AgentWakeRuntimeService",
+        "@prefix": true,
+        "@context": {
+          "queue": {
+            "@id": "undefineds:dist/api/reconciler/AgentWakeRuntimeService.jsonld#AgentWakeRuntimeService_queue"
+          },
+          "backend": {
+            "@id": "undefineds:dist/api/reconciler/AgentWakeRuntimeService.jsonld#AgentWakeRuntimeService_backend"
+          }
+        }
+      },
+      "AgentWakeRequest": {
+        "@id": "undefineds:dist/api/reconciler/AgentWakeRuntimeService.jsonld#AgentWakeRequest",
+        "@prefix": true,
+        "@context": {}
+      },
+      "AgentWakeLeaseRequest": {
+        "@id": "undefineds:dist/api/reconciler/AgentWakeRuntimeService.jsonld#AgentWakeLeaseRequest",
+        "@prefix": true,
+        "@context": {}
+      },
+      "AgentWakeResult": {
+        "@id": "undefineds:dist/api/reconciler/AgentWakeRuntimeService.jsonld#AgentWakeResult",
+        "@prefix": true,
+        "@context": {}
+      },
+      "AgentWakeRuntimeBackend": {
+        "@id": "undefineds:dist/api/reconciler/AgentWakeRuntimeService.jsonld#AgentWakeRuntimeBackend",
+        "@prefix": true,
+        "@context": {}
+      },
       "AccessRoute": {
         "@id": "undefineds:dist/edge/reachability/types.jsonld#AccessRoute",
         "@prefix": true,
@@ -4026,16 +4061,6 @@
           }
         }
       },
-      "InvalidP2PSessionRequestError": {
-        "@id": "undefineds:dist/edge/reachability/ReachabilitySessionService.jsonld#InvalidP2PSessionRequestError",
-        "@prefix": true,
-        "@context": {}
-      },
-      "NodeMetadataConflictError": {
-        "@id": "undefineds:dist/edge/reachability/ReachabilitySessionService.jsonld#NodeMetadataConflictError",
-        "@prefix": true,
-        "@context": {}
-      },
       "P2PActiveSessionLimitExceededError": {
         "@id": "undefineds:dist/edge/reachability/ReachabilitySessionService.jsonld#P2PActiveSessionLimitExceededError",
         "@prefix": true,
@@ -4076,21 +4101,11 @@
         "@prefix": true,
         "@context": {}
       },
-      "P2PDataPlaneRequestOptions": {
-        "@id": "undefineds:dist/edge/reachability/P2PDataPlane.jsonld#P2PDataPlaneRequestOptions",
-        "@prefix": true,
-        "@context": {}
-      },
       "P2PDataPlaneTransport": {
         "@id": "undefineds:dist/edge/reachability/P2PDataPlane.jsonld#P2PDataPlaneTransport",
         "@prefix": true,
         "@context": {}
       },
-      "P2PDataPlaneLimitsOptions": {
-        "@id": "undefineds:dist/edge/reachability/P2PDataPlane.jsonld#P2PDataPlaneLimitsOptions",
-        "@prefix": true,
-        "@context": {}
-      },
       "P2PDataPlaneFetchOptions": {
         "@id": "undefineds:dist/edge/reachability/P2PDataPlane.jsonld#P2PDataPlaneFetchOptions",
         "@prefix": true,
@@ -4106,25 +4121,6 @@
         "@prefix": true,
         "@context": {}
       },
-      "P2PDataPlaneSecurityError": {
-        "@id": "undefineds:dist/edge/reachability/P2PDataPlaneCrypto.jsonld#P2PDataPlaneSecurityError",
-        "@prefix": true,
-        "@context": {
-          "message": {
-            "@id": "undefineds:dist/edge/reachability/P2PDataPlaneCrypto.jsonld#P2PDataPlaneSecurityError_message"
-          }
-        }
-      },
-      "P2PDataPlaneKeys": {
-        "@id": "undefineds:dist/edge/reachability/P2PDataPlaneCrypto.jsonld#P2PDataPlaneKeys",
-        "@prefix": true,
-        "@context": {}
-      },
-      "SealedDataPlaneFrame": {
-        "@id": "undefineds:dist/edge/reachability/P2PDataPlaneCrypto.jsonld#SealedDataPlaneFrame",
-        "@prefix": true,
-        "@context": {}
-      },
       "P2PSignalingClientOptions": {
         "@id": "undefineds:dist/edge/reachability/P2PSignalingClient.jsonld#P2PSignalingClientOptions",
         "@prefix": true,
@@ -4140,11 +4136,6 @@
         "@prefix": true,
         "@context": {}
       },
-      "P2PDataPlaneSecurityOptions": {
-        "@id": "undefineds:dist/edge/reachability/TcpP2PDataPlaneTransport.jsonld#P2PDataPlaneSecurityOptions",
-        "@prefix": true,
-        "@context": {}
-      },
       "TcpP2PDataPlaneTransportOptions": {
         "@id": "undefineds:dist/edge/reachability/TcpP2PDataPlaneTransport.jsonld#TcpP2PDataPlaneTransportOptions",
         "@prefix": true,

package/dist/dns/cloudflare/CloudflareDnsProvider.d.ts

@@ -31,18 +31,9 @@ export declare class CloudflareDnsProvider implements ListableDnsProvider {
      */
     private getZoneId;
     /**
-     * 查找现有 DNS 记录。
-     *
-     * `type` 与 `value` 都会下推到 API 查询里，返回**全部**匹配项而不是 `response[0]`：
-     * 调用方要按类型判断能不能动这条记录，靠“第一条”猜类型正是 N14 的成因。
+     * 查找现有 DNS 记录
      */
-    private findRecords;
     private findRecord;
-    /**
-     * 是否与目标类型互斥：CNAME 不能与任何其他记录共存（RFC 1034），其余组合（含 TXT 与
-     * A/AAAA、MX 与 A/AAAA）都可以并存。
-     */
-    private static isMutuallyExclusive;
     /**
      * 调用 Cloudflare API
      */