@undefineds.co/xpod 0.4.19 → 0.4.25

package/dist/identity/ValidatingIdentityProviderHttpHandler.js

@@ -165,34 +165,53 @@ class ValidatingIdentityProviderHttpHandler extends community_server_1.Operation
      * belongs to, never another one.
      */
     async findSessionAccount(request) {
-        if (!this.sessionExtractor) {
-            return undefined;
-        }
         // Only a DPoP-bound session may name an Account. A Bearer token is replayable, so accepting
         // one here would let anybody who copied it mint Account authority from a Pod credential.
         if (!/^DPoP /iu.test(request.headers.authorization ?? '')) {
             return undefined;
         }
+        if (!this.sessionExtractor) {
+            this.logger.warn('Host session Account authorization rejected: extractor_missing');
+            return undefined;
+        }
         let credentials;
         try {
             credentials = await this.sessionExtractor.handleSafe(request);
         }
-        catch (error) {
+        catch {
             // No session at all, or one this deployment does not accept: stay anonymous.
-            this.logger.debug(`No host session credentials: ${(0, community_server_1.createErrorMessage)(error)}`);
+            this.logger.warn('Host session Account authorization rejected: verification_failed');
             return undefined;
         }
         const webId = credentials.agent?.webId;
         const clientId = credentials.client?.clientId;
-        if (!webId || !clientId || !this.hostClientIds.includes(clientId)) {
+        if (!webId) {
+            this.logger.warn('Host session Account authorization rejected: webid_missing');
+            return undefined;
+        }
+        if (!clientId) {
+            this.logger.warn('Host session Account authorization rejected: client_missing');
+            return undefined;
+        }
+        if (!this.hostClientIds.includes(clientId)) {
+            this.logger.warn('Host session Account authorization rejected: client_not_host');
             return undefined;
         }
         const links = await this.accountStorage.find(community_server_1.WEBID_STORAGE_TYPE, { webId });
-        const accountId = links
+        const accountIds = new Set(links
             .map((link) => link.accountId)
-            .find((value) => typeof value === 'string' && value !== '');
-        if (!accountId) {
-            this.logger.debug(`WebID ${webId} is not linked to an Account.`);
+            .filter((value) => typeof value === 'string' && value !== ''));
+        if (accountIds.size === 0) {
+            this.logger.warn('Host session Account authorization rejected: webid_not_linked');
+            return undefined;
+        }
+        if (accountIds.size !== 1) {
+            this.logger.warn('Host session Account authorization rejected: webid_link_ambiguous');
+            return undefined;
+        }
+        const [accountId] = accountIds;
+        if (!await this.accountStorage.has(ACCOUNT_TYPE, accountId)) {
+            this.logger.warn('Host session Account authorization rejected: account_missing');
             return undefined;
         }
         return accountId;

package/dist/identity/drizzle/EdgeNodeRepository.d.ts

@@ -72,6 +72,18 @@ export declare class EdgeNodeRepository {
         lastConnectivityCheck?: Date;
     } | undefined>;
     mergeNodeMetadata(nodeId: string, patch: Record<string, unknown>): Promise<void>;
+    /**
+     * Compare-and-swap on the whole `metadata` blob.
+     *
+     * Reachability state (sessions, candidates) lives inside that blob, so a read-modify-write
+     * silently drops whatever another writer committed in between — the lost update the audit
+     * calls out as N07. This write only lands when the stored value is still the one the caller
+     * read; `false` means somebody else won and the caller must re-read and re-apply.
+     *
+     * The comparison is on the serialized payload. Two equivalent-but-differently-ordered
+     * payloads therefore fail the swap, which costs a retry but can never lose a write.
+     */
+    updateNodeMetadataAtomic(nodeId: string, expected: Record<string, unknown> | null, next: Record<string, unknown>): Promise<boolean>;
     getNodeMetadata(nodeId: string): Promise<{
         nodeId: string;
         metadata: Record<string, unknown> | null;
@@ -180,5 +192,10 @@ export declare class EdgeNodeRepository {
     /**
      * Get SP node info by nodeId.
      */
+    /** Resolve a registered SP by its canonical root, never by a client supplied hostname claim. */
+    findSpNodeByStorageUrl(storageUrl: string): Promise<{
+        nodeId: string;
+        publicUrl: string;
+    } | undefined>;
     getSpNode(nodeId: string): Promise<SpNodeInfo | undefined>;
 }

package/dist/identity/drizzle/EdgeNodeRepository.js

@@ -152,6 +152,43 @@ class EdgeNodeRepository {
       WHERE id = ${nodeId}
     `);
     }
+    /**
+     * Compare-and-swap on the whole `metadata` blob.
+     *
+     * Reachability state (sessions, candidates) lives inside that blob, so a read-modify-write
+     * silently drops whatever another writer committed in between — the lost update the audit
+     * calls out as N07. This write only lands when the stored value is still the one the caller
+     * read; `false` means somebody else won and the caller must re-read and re-apply.
+     *
+     * The comparison is on the serialized payload. Two equivalent-but-differently-ordered
+     * payloads therefore fail the swap, which costs a retry but can never lose a write.
+     */
+    async updateNodeMetadataAtomic(nodeId, expected, next) {
+        await this.ready;
+        const payload = JSON.stringify(next);
+        const expectedPayload = expected === null ? null : JSON.stringify(expected);
+        const ts = (0, db_1.toDbTimestamp)(this.db, new Date());
+        const changed = await (0, db_1.executeStatementWithCount)(this.db, expectedPayload === null
+            ? (0, drizzle_orm_1.sql) `
+          UPDATE cluster_node
+          SET metadata = ${payload},
+              updated_at = ${ts}
+          WHERE id = ${nodeId} AND metadata IS NULL
+        `
+            : (0, drizzle_orm_1.sql) `
+          UPDATE cluster_node
+          SET metadata = ${payload},
+              updated_at = ${ts}
+          WHERE id = ${nodeId} AND metadata = ${expectedPayload}
+        `);
+        if (typeof changed === 'number') {
+            return changed > 0;
+        }
+        // A driver that reports no row count cannot answer "did my write land": verify instead of
+        // assuming, so a lost race is retried rather than reported as success.
+        const stored = await this.getNodeMetadata(nodeId);
+        return JSON.stringify(stored?.metadata ?? null) === payload;
+    }
     async getNodeMetadata(nodeId) {
         await this.ready;
         const result = await (0, db_1.executeQuery)(this.db, (0, drizzle_orm_1.sql) `
@@ -550,6 +587,30 @@ class EdgeNodeRepository {
     /**
      * Get SP node info by nodeId.
      */
+    /** Resolve a registered SP by its canonical root, never by a client supplied hostname claim. */
+    async findSpNodeByStorageUrl(storageUrl) {
+        await this.ready;
+        const result = await (0, db_1.executeQuery)(this.db, (0, drizzle_orm_1.sql) `
+      SELECT id, public_url FROM cluster_node WHERE node_type = 'sp' AND public_url IS NOT NULL
+    `);
+        const storage = new URL(storageUrl);
+        const matches = result.rows.filter((row) => {
+            try {
+                const root = new URL(row.public_url);
+                const rootPath = root.pathname.replace(/\/?$/u, '/');
+                const relative = storage.pathname.slice(rootPath.length);
+                return storage.origin === root.origin && storage.pathname.startsWith(rootPath) &&
+                    /^[a-zA-Z0-9_-]{1,64}\/$/u.test(relative);
+            }
+            catch {
+                return false;
+            }
+        });
+        if (matches.length !== 1) {
+            return undefined;
+        }
+        return { nodeId: String(matches[0].id), publicUrl: matches[0].public_url };
+    }
     async getSpNode(nodeId) {
         await this.ready;
         const result = await (0, db_1.executeQuery)(this.db, (0, drizzle_orm_1.sql) `

package/dist/identity/drizzle/PodDeletionOperationRepository.d.ts

@@ -0,0 +1,64 @@
+import type { PodDeletionPlan } from '../../service/PodDataDeletionService';
+export interface PodDeletionTarget {
+    accountId: string;
+    podId: string;
+    storageUrl: string;
+    nodeId: string;
+    ownerWebIds?: string[];
+    remotePodId?: string;
+}
+export interface PodDeletionOperation extends PodDeletionTarget {
+    operationId: string;
+    action: 'delete-pod';
+    state: 'pending' | 'claimed' | 'completed';
+    expiresAt: number;
+    plan?: PodDeletionPlan;
+}
+export interface PodDeletionAuthorization {
+    challengeId: string;
+    accountId: string;
+    podId: string;
+    nodeId: string;
+    storageUrl: string;
+    expiresAt: number;
+    returnUrl: string;
+}
+/** Cross-process durable target records. State changes are SQL compare-and-set. */
+export declare class PodDeletionOperationRepository {
+    private readonly db;
+    private readonly ready;
+    constructor(identityDbUrl: string);
+    private initialize;
+    createAuthorization(target: Omit<PodDeletionAuthorization, 'challengeId' | 'expiresAt'>): Promise<{
+        challenge: string;
+        details: PodDeletionAuthorization;
+    }>;
+    authorizationDetails(challenge: string, nodeId: string): Promise<PodDeletionAuthorization | undefined>;
+    /** The unique Pod generation insert is both nonce consumption and capability creation: no get/delete gap. */
+    authorizeGeneration(challenge: string, nodeId: string, remotePodId: string): Promise<boolean>;
+    reserveStorage(storageUrl: string, operationId: string, kind: 'create' | 'delete'): Promise<void>;
+    releaseStorage(storageUrl: string, operationId: string): Promise<void>;
+    create(target: PodDeletionTarget): Promise<{
+        operation: PodDeletionOperation;
+        grant: string;
+    }>;
+    bindRemoteGeneration(podId: string, nodeId: string, storageUrl: string, remotePodId: string): Promise<void>;
+    remoteGeneration(podId: string, nodeId: string, storageUrl: string): Promise<string | undefined>;
+    blocksNamespaceMutation(baseUrl: string): Promise<boolean>;
+    namespaceDeletionRevision(baseUrl: string): Promise<string>;
+    blocksMutation(resourceUrl: string): Promise<boolean>;
+    renewGrant(operationId: string): Promise<{
+        operation: PodDeletionOperation;
+        grant: string;
+    }>;
+    acknowledge(operationId: string, nodeId: string, grant: string, storageUrl: string): Promise<boolean>;
+    /** Import the authenticated command once on the Local runtime. */
+    createLocal(target: PodDeletionTarget, operationId: string): Promise<PodDeletionOperation>;
+    find(accountId: string, podId: string): Promise<PodDeletionOperation | undefined>;
+    get(operationId: string): Promise<PodDeletionOperation | undefined>;
+    /** Only the authenticated node and exact grant can claim; repeated claims return the same immutable target. */
+    claim(operationId: string, nodeId: string, grant: string): Promise<PodDeletionOperation | undefined>;
+    /** Persist the complete snapshot before the first destructive operation. */
+    savePlan(operationId: string, plan: PodDeletionPlan): Promise<PodDeletionOperation>;
+    complete(operationId: string): Promise<void>;
+}

package/dist/identity/drizzle/PodDeletionOperationRepository.js

@@ -0,0 +1,241 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PodDeletionOperationRepository = void 0;
+const node_crypto_1 = require("node:crypto");
+const drizzle_orm_1 = require("drizzle-orm");
+const db_1 = require("./db");
+/** Cross-process durable target records. State changes are SQL compare-and-set. */
+class PodDeletionOperationRepository {
+    constructor(identityDbUrl) {
+        this.db = (0, db_1.getIdentityDatabase)(identityDbUrl);
+        this.ready = this.initialize();
+    }
+    async initialize() {
+        const statements = [
+            `CREATE TABLE IF NOT EXISTS pod_deletion_authorization (
+        challenge_id TEXT PRIMARY KEY, token_hash TEXT NOT NULL, payload TEXT NOT NULL
+      )`,
+            `CREATE TABLE IF NOT EXISTS pod_deletion_operation (
+        operation_id TEXT PRIMARY KEY, account_id TEXT NOT NULL, pod_id TEXT NOT NULL,
+        grant_hash TEXT NOT NULL, state TEXT NOT NULL, payload TEXT NOT NULL,
+        UNIQUE(account_id, pod_id)
+      )`,
+            `CREATE TABLE IF NOT EXISTS pod_remote_generation (
+        pod_id TEXT PRIMARY KEY, node_id TEXT NOT NULL, storage_url TEXT NOT NULL, remote_pod_id TEXT NOT NULL
+      )`,
+            `CREATE TABLE IF NOT EXISTS pod_lifecycle_reservation (
+        storage_url TEXT PRIMARY KEY, operation_id TEXT NOT NULL, kind TEXT NOT NULL
+      )`,
+        ];
+        if ((0, db_1.isDatabaseSqlite)(this.db)) {
+            for (const statement of statements) {
+                await (0, db_1.executeStatement)(this.db, drizzle_orm_1.sql.raw(statement));
+            }
+        }
+        else {
+            await (0, db_1.executePostgresLockedStatements)(this.db, 1_936_528_504, statements);
+        }
+    }
+    async createAuthorization(target) {
+        await this.ready;
+        const token = (0, node_crypto_1.randomBytes)(32).toString('base64url');
+        const details = { ...target, challengeId: (0, node_crypto_1.randomUUID)(), expiresAt: Date.now() + 300_000 };
+        await (0, db_1.executeStatement)(this.db, (0, drizzle_orm_1.sql) `INSERT INTO pod_deletion_authorization(challenge_id,token_hash,payload)
+      VALUES (${details.challengeId},${hash(token)},${JSON.stringify(details)})`);
+        return { challenge: `${details.challengeId}.${token}`, details };
+    }
+    async authorizationDetails(challenge, nodeId) {
+        await this.ready;
+        const [id, token, extra] = challenge.split('.');
+        if (!id || !token || extra || !/^[a-zA-Z0-9_-]{43}$/u.test(token)) {
+            return;
+        }
+        const rows = await (0, db_1.executeQuery)(this.db, (0, drizzle_orm_1.sql) `SELECT payload FROM pod_deletion_authorization
+      WHERE challenge_id=${id} AND token_hash=${hash(token)}`);
+        const details = rows.rows[0] ? JSON.parse(rows.rows[0].payload) : undefined;
+        return details && details.nodeId === nodeId && details.expiresAt > Date.now() ? details : undefined;
+    }
+    /** The unique Pod generation insert is both nonce consumption and capability creation: no get/delete gap. */
+    async authorizeGeneration(challenge, nodeId, remotePodId) {
+        const details = await this.authorizationDetails(challenge, nodeId);
+        if (!details || !remotePodId) {
+            return false;
+        }
+        const [id, token] = challenge.split('.');
+        const result = await (0, db_1.executeQuery)(this.db, (0, drizzle_orm_1.sql) `INSERT INTO pod_remote_generation(pod_id,node_id,storage_url,remote_pod_id)
+      SELECT ${details.podId},${nodeId},${details.storageUrl},${remotePodId}
+      FROM pod_deletion_authorization auth_challenge
+      WHERE auth_challenge.challenge_id=${id} AND auth_challenge.token_hash=${hash(token)}
+        AND auth_challenge.payload=${JSON.stringify(details)} AND ${details.expiresAt} > ${Date.now()}
+        AND NOT EXISTS (SELECT 1 FROM pod_deletion_operation WHERE pod_id=${details.podId})
+        AND EXISTS (SELECT 1 FROM identity_store WHERE container='pod' AND id=${details.podId}
+          AND ${(0, db_1.jsonFieldEquals)(this.db, 'accountId', details.accountId)} AND ${(0, db_1.jsonFieldEquals)(this.db, 'baseUrl', details.storageUrl)})
+      ON CONFLICT(pod_id) DO NOTHING RETURNING pod_id`);
+        return result.rows.length === 1;
+    }
+    async reserveStorage(storageUrl, operationId, kind) {
+        await this.ready;
+        await (0, db_1.executeStatement)(this.db, (0, drizzle_orm_1.sql) `INSERT INTO pod_lifecycle_reservation(storage_url, operation_id, kind)
+      VALUES (${storageUrl}, ${operationId}, ${kind}) ON CONFLICT DO NOTHING`);
+        const result = await (0, db_1.executeQuery)(this.db, (0, drizzle_orm_1.sql) `SELECT operation_id, kind FROM pod_lifecycle_reservation WHERE storage_url = ${storageUrl}`);
+        if (result.rows[0]?.operation_id !== operationId || result.rows[0]?.kind !== kind) {
+            throw new Error('Pod lifecycle operation already in progress');
+        }
+    }
+    async releaseStorage(storageUrl, operationId) {
+        await this.ready;
+        await (0, db_1.executeStatement)(this.db, (0, drizzle_orm_1.sql) `DELETE FROM pod_lifecycle_reservation WHERE storage_url = ${storageUrl} AND operation_id = ${operationId}`);
+    }
+    async create(target) {
+        await this.ready;
+        const grant = (0, node_crypto_1.randomBytes)(32).toString('base64url');
+        const operation = {
+            ...target, operationId: (0, node_crypto_1.randomUUID)(), action: 'delete-pod', state: 'pending', expiresAt: Date.now() + 300_000,
+        };
+        const result = await (0, db_1.executeQuery)(this.db, (0, drizzle_orm_1.sql) `INSERT INTO pod_deletion_operation
+      (operation_id, account_id, pod_id, grant_hash, state, payload)
+      VALUES (${operation.operationId}, ${target.accountId}, ${target.podId}, ${hash(grant)}, 'pending', ${JSON.stringify(operation)})
+      ON CONFLICT(account_id, pod_id) DO NOTHING RETURNING payload`);
+        if (!result.rows.length) {
+            throw new Error('Pod deletion operation already exists');
+        }
+        return { operation, grant };
+    }
+    async bindRemoteGeneration(podId, nodeId, storageUrl, remotePodId) {
+        await this.ready;
+        await (0, db_1.executeStatement)(this.db, (0, drizzle_orm_1.sql) `INSERT INTO pod_remote_generation(pod_id,node_id,storage_url,remote_pod_id)
+      VALUES (${podId},${nodeId},${storageUrl},${remotePodId}) ON CONFLICT(pod_id) DO NOTHING`);
+    }
+    async remoteGeneration(podId, nodeId, storageUrl) {
+        await this.ready;
+        const result = await (0, db_1.executeQuery)(this.db, (0, drizzle_orm_1.sql) `SELECT remote_pod_id FROM pod_remote_generation
+      WHERE pod_id=${podId} AND node_id=${nodeId} AND storage_url=${storageUrl}`);
+        return result.rows[0]?.remote_pod_id;
+    }
+    async blocksNamespaceMutation(baseUrl) {
+        await this.ready;
+        const result = await (0, db_1.executeQuery)(this.db, (0, drizzle_orm_1.sql) `SELECT payload FROM pod_deletion_operation WHERE state <> 'completed'`);
+        return result.rows.some((row) => JSON.parse(row.payload).storageUrl.startsWith(baseUrl));
+    }
+    async namespaceDeletionRevision(baseUrl) {
+        await this.ready;
+        const result = await (0, db_1.executeQuery)(this.db, (0, drizzle_orm_1.sql) `SELECT payload FROM pod_deletion_operation`);
+        return result.rows.map((row) => JSON.parse(row.payload))
+            .filter((operation) => operation.storageUrl.startsWith(baseUrl))
+            .map((operation) => `${operation.operationId}:${operation.state}`).sort().join('\n');
+    }
+    async blocksMutation(resourceUrl) {
+        await this.ready;
+        const result = await (0, db_1.executeQuery)(this.db, (0, drizzle_orm_1.sql) `SELECT payload FROM pod_deletion_operation WHERE state <> 'completed'`);
+        return result.rows.some((row) => resourceUrl.startsWith(JSON.parse(row.payload).storageUrl));
+    }
+    async renewGrant(operationId) {
+        const existing = await this.get(operationId);
+        if (!existing || existing.state === 'completed') {
+            throw new Error('Deletion grant cannot be renewed');
+        }
+        const grant = (0, node_crypto_1.randomBytes)(32).toString('base64url');
+        const operation = { ...existing, expiresAt: Date.now() + 300_000 };
+        const result = await (0, db_1.executeQuery)(this.db, (0, drizzle_orm_1.sql) `UPDATE pod_deletion_operation
+      SET grant_hash = ${hash(grant)}, payload = ${JSON.stringify(operation)}
+      WHERE operation_id = ${operationId} AND payload = ${JSON.stringify(existing)} RETURNING operation_id`);
+        if (!result.rows.length) {
+            throw new Error('Deletion grant changed concurrently');
+        }
+        return { operation, grant };
+    }
+    async acknowledge(operationId, nodeId, grant, storageUrl) {
+        const existing = await this.get(operationId);
+        if (!existing || existing.nodeId !== nodeId || existing.storageUrl !== storageUrl) {
+            return false;
+        }
+        const completed = { ...existing, state: 'completed' };
+        const result = await (0, db_1.executeQuery)(this.db, (0, drizzle_orm_1.sql) `UPDATE pod_deletion_operation
+      SET state = 'completed', payload = ${JSON.stringify(completed)}
+      WHERE operation_id = ${operationId} AND grant_hash = ${hash(grant)} AND state IN ('claimed', 'completed')
+      RETURNING operation_id`);
+        return result.rows.length === 1;
+    }
+    /** Import the authenticated command once on the Local runtime. */
+    async createLocal(target, operationId) {
+        await this.ready;
+        const existing = await this.get(operationId);
+        if (existing) {
+            if (existing.storageUrl !== target.storageUrl || existing.nodeId !== target.nodeId) {
+                throw new Error('Deletion operation target mismatch');
+            }
+            return existing;
+        }
+        const operation = {
+            ...target, operationId, action: 'delete-pod', state: 'pending', expiresAt: Number.MAX_SAFE_INTEGER,
+        };
+        await (0, db_1.executeStatement)(this.db, (0, drizzle_orm_1.sql) `INSERT INTO pod_deletion_operation
+      (operation_id, account_id, pod_id, grant_hash, state, payload)
+      VALUES (${operationId}, ${target.accountId}, ${target.podId}, '', 'pending', ${JSON.stringify(operation)})
+      ON CONFLICT DO NOTHING`);
+        const stored = await this.get(operationId);
+        if (!stored || stored.storageUrl !== target.storageUrl) {
+            throw new Error('Pod deletion already in progress');
+        }
+        return stored;
+    }
+    async find(accountId, podId) {
+        await this.ready;
+        const result = await (0, db_1.executeQuery)(this.db, (0, drizzle_orm_1.sql) `SELECT payload FROM pod_deletion_operation
+      WHERE account_id = ${accountId} AND pod_id = ${podId}`);
+        return result.rows[0] ? JSON.parse(result.rows[0].payload) : undefined;
+    }
+    async get(operationId) {
+        await this.ready;
+        const result = await (0, db_1.executeQuery)(this.db, (0, drizzle_orm_1.sql) `SELECT payload FROM pod_deletion_operation
+      WHERE operation_id = ${operationId}`);
+        return result.rows[0] ? JSON.parse(result.rows[0].payload) : undefined;
+    }
+    /** Only the authenticated node and exact grant can claim; repeated claims return the same immutable target. */
+    async claim(operationId, nodeId, grant) {
+        await this.ready;
+        const existing = await this.get(operationId);
+        if (!existing || existing.nodeId !== nodeId || existing.expiresAt < Date.now()) {
+            return;
+        }
+        const claimed = { ...existing, state: 'claimed' };
+        const result = await (0, db_1.executeQuery)(this.db, (0, drizzle_orm_1.sql) `UPDATE pod_deletion_operation
+      SET state = 'claimed', payload = ${JSON.stringify(claimed)}
+      WHERE operation_id = ${operationId} AND grant_hash = ${hash(grant)} AND state IN ('pending', 'claimed')
+      RETURNING payload`);
+        return result.rows[0] ? JSON.parse(result.rows[0].payload) : undefined;
+    }
+    /** Persist the complete snapshot before the first destructive operation. */
+    async savePlan(operationId, plan) {
+        const existing = await this.get(operationId);
+        if (!existing || existing.state === 'completed' || plan.baseUrl !== existing.storageUrl) {
+            throw new Error('Invalid Pod deletion operation plan');
+        }
+        if (existing.plan) {
+            return existing;
+        }
+        const updated = { ...existing, plan, state: 'claimed' };
+        await (0, db_1.executeStatement)(this.db, (0, drizzle_orm_1.sql) `UPDATE pod_deletion_operation SET payload = ${JSON.stringify(updated)}, state = 'claimed'
+      WHERE operation_id = ${operationId} AND payload = ${JSON.stringify(existing)}`);
+        return (await this.get(operationId));
+    }
+    async complete(operationId) {
+        const existing = await this.get(operationId);
+        if (!existing) {
+            throw new Error('Unknown Pod deletion operation');
+        }
+        if (existing.state === 'completed') {
+            return;
+        }
+        const completed = { ...existing, state: 'completed' };
+        const result = await (0, db_1.executeQuery)(this.db, (0, drizzle_orm_1.sql) `UPDATE pod_deletion_operation
+      SET state = 'completed', payload = ${JSON.stringify(completed)}
+      WHERE operation_id = ${operationId} AND state = 'claimed' AND payload = ${JSON.stringify(existing)} RETURNING operation_id`);
+        if (!result.rows.length) {
+            throw new Error('Pod deletion operation changed concurrently');
+        }
+    }
+}
+exports.PodDeletionOperationRepository = PodDeletionOperationRepository;
+function hash(value) { return (0, node_crypto_1.createHash)('sha256').update(value).digest('hex'); }
+//# sourceMappingURL=PodDeletionOperationRepository.js.map

package/dist/identity/drizzle/db.d.ts

@@ -57,6 +57,14 @@ export declare function executeQuery<T = Record<string, unknown>>(db: IdentityDa
  * Works uniformly across PostgreSQL and SQLite.
  */
 export declare function executeStatement(db: IdentityDatabase, query: SQL): Promise<void>;
+/**
+ * Execute a statement and report how many rows it changed.
+ *
+ * Optimistic concurrency (compare-and-swap) has to tell an applied write from a rejected one,
+ * which `executeStatement` throws away. Returns `undefined` when the driver reports no count,
+ * in which case callers must verify the stored value themselves instead of assuming success.
+ */
+export declare function executeStatementWithCount(db: IdentityDatabase, query: SQL): Promise<number | undefined>;
 export declare function executePostgresLockedStatements(db: IdentityDatabase, lockKey: number, statements: string[]): Promise<void>;
 /**
  * Creates the per-owner interface-key table.

package/dist/identity/drizzle/db.js

@@ -32,6 +32,7 @@ exports.closeAllIdentityConnections = closeAllIdentityConnections;
 exports.isDatabaseSqlite = isDatabaseSqlite;
 exports.executeQuery = executeQuery;
 exports.executeStatement = executeStatement;
+exports.executeStatementWithCount = executeStatementWithCount;
 exports.executePostgresLockedStatements = executePostgresLockedStatements;
 exports.ensurePodInterfaceKeyTable = ensurePodInterfaceKeyTable;
 exports.ensureCloudClusterTables = ensureCloudClusterTables;
@@ -229,6 +230,22 @@ async function executeStatement(db, query) {
     // PostgreSQL: db.execute() works for statements too
     await db.execute(query);
 }
+/**
+ * Execute a statement and report how many rows it changed.
+ *
+ * Optimistic concurrency (compare-and-swap) has to tell an applied write from a rejected one,
+ * which `executeStatement` throws away. Returns `undefined` when the driver reports no count,
+ * in which case callers must verify the stored value themselves instead of assuming success.
+ */
+async function executeStatementWithCount(db, query) {
+    await ensureDatabaseReady(db);
+    if (isDatabaseSqlite(db)) {
+        const result = db.run(query);
+        return typeof result?.changes === 'number' ? result.changes : undefined;
+    }
+    const result = await db.execute(query);
+    return typeof result?.rowCount === 'number' ? result.rowCount : undefined;
+}
 async function executePostgresLockedStatements(db, lockKey, statements) {
     await ensureDatabaseReady(db);
     if (isDatabaseSqlite(db)) {

package/dist/index.d.ts

@@ -1,4 +1,5 @@
 import './runtime/configure-drizzle-solid';
+export { LocalPodDeletionHttpHandler } from './http/LocalPodDeletionHttpHandler';
 import { RepresentationPartialConvertingStore } from './storage/RepresentationPartialConvertingStore';
 import { MinioDataAccessor } from './storage/accessors/MinioDataAccessor';
 import { SolidRdfDataAccessor } from './storage/accessors/SolidRdfDataAccessor';
@@ -14,9 +15,15 @@ export type { PostgresRdfEngineOptions } from './storage/rdf/PostgresRdfEngine';
 export type { PostgresRdfTextIndexOptions } from './storage/rdf/PostgresRdfTextIndex';
 export type { PostgresRdfVectorIndexOptions } from './storage/rdf/PostgresRdfVectorIndex';
 export * from './document';
+export * from './agent-directory/protocol';
 import { SubgraphSparqlHttpHandler } from './http/SubgraphSparqlHttpHandler';
+import { AgentDirectoryHttpHandler } from './http/agent-directory/AgentDirectoryHttpHandler';
 import { QuotaAdminHttpHandler } from './http/quota/QuotaAdminHttpHandler';
 import { SparqlUpdateResourceStore } from './storage/SparqlUpdateResourceStore';
+import { HierarchyLockingResourceStore } from './storage/HierarchyLockingResourceStore';
+import { StorageETagHandler } from './storage/conditions/StorageETagHandler';
+import { StoragePutOperationHandler } from './http/StoragePutOperationHandler';
+import { HeadSafeResponseWriter } from './http/HeadSafeResponseWriter';
 import { ClusterIngressRouter } from './http/ClusterIngressRouter';
 import { ClusterWebSocketConfigurator } from './http/ClusterWebSocketConfigurator';
 import { EdgeNodeDirectDebugHttpHandler } from './http/EdgeNodeDirectDebugHttpHandler';
@@ -126,6 +133,16 @@ export type { OwnedWebIdEntry, PodOwnershipResolver, PodOwnershipTarget, CssPodO
 export type { TunnelProvider, TunnelConfig, TunnelSetupOptions, TunnelStatus, } from './tunnel/TunnelProvider';
 export type { SubdomainRegistration, ConnectivityResult, SubdomainServiceOptions, } from './subdomain/SubdomainService';
 export { AppStaticAssetHandler } from './http/AppStaticAssetHandler';
-export { RepresentationPartialConvertingStore, MinioDataAccessor, SolidRdfDataAccessor, MixDataAccessor, ConfigurableLoggerFactory, resolveLogFilePattern, resolveCurrentLogFile, LOG_FILE_PATTERN, SparqlUpdateResourceStore, SubgraphQueryEngine, SubgraphSparqlHttpHandler, QuotaAdminHttpHandler, ClusterIngressRouter, ClusterWebSocketConfigurator, EdgeNodeDirectDebugHttpHandler, EdgeNodeProxyHttpHandler, RouterHttpHandler, RouterHttpRoute, TracingHandler, EdgeNodeCertificateHttpHandler, TerminalHttpHandler, DeviceNotificationHub, DeviceNotificationResourceListener, DeviceNotificationWebSocketServer, DeviceNotificationTicketHandler, registerDeviceNotificationRuntime, ReservedSuffixIdentifierGenerator, DrizzleIndexedStorage, LoginMethodGuardStorage, ValidatingIdentityProviderHttpHandler, PostgresKeyValueStorage, RedisKeyValueStorage, SqliteKeyValueStorage, BaseKeyValueStorage, DrizzleQuotaService, NoopQuotaService, HttpEntitlementProvider, NoopEntitlementProvider, PerAccountQuotaStrategy, TencentDnsProvider, EdgeNodeDnsCoordinator, Dns01CertificateProvisioner, SimpleEdgeNodeTunnelManager, NoopEdgeNodeTunnelManager, FrpTunnelManager, EdgeNodeHealthProbeService, assertPublicProbeTarget, createPinnedHeadProbeRequest, isPublicIpAddress, createPodOwnershipNodeAccessResolver, EdgeNodeAgent, EdgeNodeAgentInitializer, EdgeNodeCertificateService, AcmeCertificateManager, EdgeNodeModeDetector, ClusterIdentifierStrategy, UsageTrackingStore, CenterNodeRegistrationService, PodRoutingHttpHandler, ReactAppViewHandler, QuintStore, SqliteQuintStore, PgQuintStore, RdfTermDictionary, RdfQuadIndex, Rdf3xIndex, RdfTextIndex, RdfVectorIndex, PostgresRdfTextIndex, PostgresRdfVectorIndex, SolidRdfEngine, LocalQleverNativeSparqlClient, QleverSparqlEngine, RdfQuerySparqlEngine, PostgresRdfEngine, VectorStore, SqliteVectorStore, PostgresVectorStore, VectorHttpHandler, ProviderRegistry, ProviderRegistryImpl, EmbeddingService, EmbeddingServiceImpl, CredentialReader, CredentialReaderImpl, CloudflareTunnelProvider, LocalTunnelProvider, NgrokTunnelProvider, SubdomainService, MultiDomainIdentifierStrategy, SubdomainPodIdentifierStrategy, DisabledOidcHandler, DisabledIdentityProviderHandler, AutoDetectOidcHandler, AutoDetectIdentityProviderHandler, LoopbackClientIdAdapterFactory, RememberedClientGrantStore, RememberedConsentHandler, RememberedClientPromptFactory, SessionBoundIdentityProviderFactory, ScopedPickWebIdHandler, ConfiguredLoopbackDPoPWebIdExtractor, AccountStorageBindingsHandler, CssPodOwnershipResolver, UrlAwareRedisLocker, ProvisionPodCreator, ProvisionPodStore, ProvisionCodeCodec, LocalPodProvisioningService, SqliteSolidFsSyncJournal, RootedSolidFsSyncJournal, LocalRdfAuthorityRecoveryInitializer, ObservableResourceStore, RdfSearchReconciliationIntentSink, };
+export { RepresentationPartialConvertingStore, MinioDataAccessor, SolidRdfDataAccessor, MixDataAccessor, ConfigurableLoggerFactory, resolveLogFilePattern, resolveCurrentLogFile, LOG_FILE_PATTERN, SparqlUpdateResourceStore, HierarchyLockingResourceStore, StorageETagHandler, StoragePutOperationHandler, HeadSafeResponseWriter, SubgraphQueryEngine, SubgraphSparqlHttpHandler, AgentDirectoryHttpHandler, QuotaAdminHttpHandler, ClusterIngressRouter, ClusterWebSocketConfigurator, EdgeNodeDirectDebugHttpHandler, EdgeNodeProxyHttpHandler, RouterHttpHandler, RouterHttpRoute, TracingHandler, EdgeNodeCertificateHttpHandler, TerminalHttpHandler, DeviceNotificationHub, DeviceNotificationResourceListener, DeviceNotificationWebSocketServer, DeviceNotificationTicketHandler, registerDeviceNotificationRuntime, ReservedSuffixIdentifierGenerator, DrizzleIndexedStorage, LoginMethodGuardStorage, ValidatingIdentityProviderHttpHandler, PostgresKeyValueStorage, RedisKeyValueStorage, SqliteKeyValueStorage, BaseKeyValueStorage, DrizzleQuotaService, NoopQuotaService, HttpEntitlementProvider, NoopEntitlementProvider, PerAccountQuotaStrategy, TencentDnsProvider, EdgeNodeDnsCoordinator, Dns01CertificateProvisioner, SimpleEdgeNodeTunnelManager, NoopEdgeNodeTunnelManager, FrpTunnelManager, EdgeNodeHealthProbeService, assertPublicProbeTarget, createPinnedHeadProbeRequest, isPublicIpAddress, createPodOwnershipNodeAccessResolver, EdgeNodeAgent, EdgeNodeAgentInitializer, EdgeNodeCertificateService, AcmeCertificateManager, EdgeNodeModeDetector, ClusterIdentifierStrategy, UsageTrackingStore, CenterNodeRegistrationService, PodRoutingHttpHandler, ReactAppViewHandler, QuintStore, SqliteQuintStore, PgQuintStore, RdfTermDictionary, RdfQuadIndex, Rdf3xIndex, RdfTextIndex, RdfVectorIndex, PostgresRdfTextIndex, PostgresRdfVectorIndex, SolidRdfEngine, LocalQleverNativeSparqlClient, QleverSparqlEngine, RdfQuerySparqlEngine, PostgresRdfEngine, VectorStore, SqliteVectorStore, PostgresVectorStore, VectorHttpHandler, ProviderRegistry, ProviderRegistryImpl, EmbeddingService, EmbeddingServiceImpl, CredentialReader, CredentialReaderImpl, CloudflareTunnelProvider, LocalTunnelProvider, NgrokTunnelProvider, SubdomainService, MultiDomainIdentifierStrategy, SubdomainPodIdentifierStrategy, DisabledOidcHandler, DisabledIdentityProviderHandler, AutoDetectOidcHandler, AutoDetectIdentityProviderHandler, LoopbackClientIdAdapterFactory, RememberedClientGrantStore, RememberedConsentHandler, RememberedClientPromptFactory, SessionBoundIdentityProviderFactory, ScopedPickWebIdHandler, ConfiguredLoopbackDPoPWebIdExtractor, AccountStorageBindingsHandler, CssPodOwnershipResolver, UrlAwareRedisLocker, ProvisionPodCreator, ProvisionPodStore, ProvisionCodeCodec, LocalPodProvisioningService, SqliteSolidFsSyncJournal, RootedSolidFsSyncJournal, LocalRdfAuthorityRecoveryInitializer, ObservableResourceStore, RdfSearchReconciliationIntentSink, };
 export type { ResourceChangeEvent, ResourceChangeListener, ResourceChangeRecorder, } from './storage/ObservableResourceStore';
 export { RdfHandlebarsTemplateEngine } from './util/templates/RdfHandlebarsTemplateEngine';
+export * from './identity/PodDeletionInteractionHandler';
+export * from './identity/PodDeletionInventoryHandler';
+export * from './service/PodDeletionLifecycleService';
+export * from './service/PodDataDeletionService';
+export * from './http/PodDeletionMutationGuard';
+export * from './http/PodMutationLockingHttpHandler';
+export * from './storage/locking/PodLifecycleLocker';
+export * from './storage/locking/PodLifecycleRedisLocker';
+export { CloudProfileCreator } from './provision/CloudProfileCreator';
+export { CloudProfilePreparationHandler } from './identity/CloudProfilePreparationHandler';