@undefineds.co/xpod 0.4.19 → 0.4.25

package/dist/provision/LocalPodProvisioningService.js

@@ -4,6 +4,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.LocalPodProvisioningService = void 0;
+const PodDeletionOperationRepository_1 = require("../identity/drizzle/PodDeletionOperationRepository");
 const node_crypto_1 = require("node:crypto");
 const node_fs_1 = require("node:fs");
 const node_path_1 = __importDefault(require("node:path"));
@@ -90,33 +91,74 @@ class LocalPodProvisioningService {
         this.identityDbPath = stripSqlitePrefix(options.identityDbUrl, 'identityDbUrl');
         this.rdfIndexPath = options.rdfIndexPath;
         this.oidcIssuer = options.oidcIssuer ? ensureTrailingSlash(options.oidcIssuer) : undefined;
+        this.hostsProfile = !this.oidcIssuer || new URL(this.oidcIssuer).href === new URL(this.baseUrl).href;
         this.authMode = options.authMode;
     }
     async createPod(input) {
         const podUrl = ensureTrailingSlash(new URL(`${encodeURIComponent(input.podName)}/`, this.baseUrl).toString());
-        const canonicalWebId = new URL('profile/card#me', podUrl).toString();
-        if (input.webId && input.webId !== canonicalWebId) {
-            throw new Error(`WebID must use the provisioned Pod profile: ${canonicalWebId}`);
-        }
-        const webId = canonicalWebId;
-        // The WebID document belongs to this storage provider; authentication still
-        // delegates to the Cloud issuer through solid:oidcIssuer.
+        const webId = this.resolveWebId(input.webId, podUrl);
         const oidcIssuer = this.oidcIssuer ?? this.baseUrl;
         const accountId = stableUuid(`account:${podUrl}:${webId}`);
-        const podId = stableUuid(`pod:${podUrl}:${webId}`);
+        // Each creation is a distinct storage incarnation, even when its URL and WebID are reused.
+        const podId = (0, node_crypto_1.randomUUID)();
         const ownerId = stableUuid(`owner:${podId}:${webId}`);
         const webIdLinkId = stableUuid(`webIdLink:${accountId}:${webId}`);
-        await this.createPodFiles(input.podName, input.initialResources);
-        const quads = this.buildPodQuads({ podUrl, webId, oidcIssuer });
-        this.writeQuints(quads);
-        this.writeRdfIndex(quads);
-        this.writeIdentityIndexes({ accountId, podId, ownerId, webIdLinkId, podUrl, webId });
-        this.logger.info(`Provisioned local pod ${podUrl} for ${webId}`);
-        return { podUrl, webId, accountId, podId };
+        const operations = new PodDeletionOperationRepository_1.PodDeletionOperationRepository(`sqlite:${this.identityDbPath}`);
+        const reservationId = (0, node_crypto_1.randomUUID)();
+        await operations.reserveStorage(podUrl, reservationId, 'create');
+        try {
+            try {
+                await node_fs_1.promises.stat(node_path_1.default.join(this.rootDir, input.podName));
+                throw new Error('Pod already exists');
+            }
+            catch (error) {
+                if (error.code !== 'ENOENT') {
+                    throw error;
+                }
+            }
+            await this.createPodFiles(input.podName, input.initialResources);
+            const quads = this.buildPodQuads({ podUrl, webId, oidcIssuer });
+            this.writeQuints(quads);
+            this.writeRdfIndex(quads);
+            this.writeIdentityIndexes({ accountId, podId, ownerId, webIdLinkId, podUrl, webId });
+            this.logger.info(`Provisioned local pod ${podUrl} for ${webId}`);
+            return { podUrl, webId, accountId, podId };
+        }
+        finally {
+            await operations.releaseStorage(podUrl, reservationId);
+        }
+    }
+    resolveWebId(webId, podUrl) {
+        if (this.hostsProfile) {
+            const canonicalWebId = new URL('profile/card#me', podUrl).toString();
+            if (webId && webId !== canonicalWebId) {
+                throw new Error(`WebID must use the provisioned Pod profile: ${canonicalWebId}`);
+            }
+            return canonicalWebId;
+        }
+        const error = new Error('Managed Local Pod requires a WebID within the Cloud issuer');
+        if (typeof webId !== 'string' || !/^https?:\/\/[^/\\]/iu.test(webId) ||
+            webId.includes('\\') || /[\u0000-\u0020\u007f]/u.test(webId)) {
+            throw error;
+        }
+        let identity;
+        try {
+            identity = new URL(webId);
+        }
+        catch {
+            throw error;
+        }
+        const issuer = new URL(this.oidcIssuer);
+        if (!['http:', 'https:'].includes(identity.protocol) || identity.username || identity.password ||
+            identity.origin !== issuer.origin || !identity.pathname.startsWith(issuer.pathname)) {
+            throw error;
+        }
+        // Cloud owns this identity. Preserve its exact value for owner indexes and receipts.
+        return webId;
     }
     async createPodFiles(podName, initialResources) {
         const podPath = node_path_1.default.join(this.rootDir, podName);
-        await node_fs_1.promises.mkdir(node_path_1.default.join(podPath, 'profile'), { recursive: true });
+        await node_fs_1.promises.mkdir(this.hostsProfile ? node_path_1.default.join(podPath, 'profile') : podPath, { recursive: true });
         if (!initialResources) {
             return;
         }
@@ -213,27 +255,29 @@ class LocalPodProvisioningService {
         };
         out.push(quad(namedNode(root), namedNode(`${LDP}contains`), namedNode(podUrl), rootGraph));
         out.push(quad(namedNode(podUrl), namedNode(`${LDP}contains`), namedNode(authorizationResources.rootResourceUrl), podGraph));
-        out.push(quad(namedNode(podUrl), namedNode(`${LDP}contains`), namedNode(profileUrl), podGraph));
         out.push(quad(namedNode(podUrl), namedNode(`${LDP}contains`), namedNode(settingsUrl), podGraph));
-        out.push(quad(namedNode(profileUrl), namedNode(`${LDP}contains`), namedNode(authorizationResources.profileResourceUrl), profileGraph));
-        out.push(quad(namedNode(profileUrl), namedNode(`${LDP}contains`), namedNode(cardUrl), profileGraph));
-        out.push(quad(namedNode(profileUrl), namedNode(`${LDP}contains`), namedNode(authorizationResources.cardResourceUrl), profileGraph));
         addContainerMeta(root);
         addContainerMeta(podUrl, true);
-        addContainerMeta(profileUrl);
         addDocumentMeta(authorizationResources.rootResourceUrl);
-        addDocumentMeta(authorizationResources.profileResourceUrl);
-        addDocumentMeta(cardUrl);
-        addDocumentMeta(authorizationResources.cardResourceUrl);
-        out.push(quad(namedNode(cardUrl), namedNode(`${RDF}type`), namedNode(`${FOAF}PersonalProfileDocument`), cardGraph));
-        out.push(quad(namedNode(cardUrl), namedNode(`${FOAF}maker`), namedNode(webId), cardGraph));
-        out.push(quad(namedNode(cardUrl), namedNode(`${FOAF}primaryTopic`), namedNode(webId), cardGraph));
-        out.push(quad(namedNode(webId), namedNode(`${RDF}type`), namedNode(`${FOAF}Person`), cardGraph));
-        out.push(quad(namedNode(webId), namedNode(`${SOLID}oidcIssuer`), namedNode(oidcIssuer), cardGraph));
-        out.push(quad(namedNode(webId), namedNode(`${SOLID}storage`), namedNode(podUrl), cardGraph));
-        out.push(quad(namedNode(webId), namedNode(`${SOLID}privateTypeIndex`), namedNode(privateTypeIndexUrl), cardGraph));
+        if (this.hostsProfile) {
+            out.push(quad(namedNode(podUrl), namedNode(`${LDP}contains`), namedNode(profileUrl), podGraph));
+            out.push(quad(namedNode(profileUrl), namedNode(`${LDP}contains`), namedNode(authorizationResources.profileResourceUrl), profileGraph));
+            out.push(quad(namedNode(profileUrl), namedNode(`${LDP}contains`), namedNode(cardUrl), profileGraph));
+            out.push(quad(namedNode(profileUrl), namedNode(`${LDP}contains`), namedNode(authorizationResources.cardResourceUrl), profileGraph));
+            addContainerMeta(profileUrl);
+            addDocumentMeta(authorizationResources.profileResourceUrl);
+            addDocumentMeta(cardUrl);
+            addDocumentMeta(authorizationResources.cardResourceUrl);
+            out.push(quad(namedNode(cardUrl), namedNode(`${RDF}type`), namedNode(`${FOAF}PersonalProfileDocument`), cardGraph));
+            out.push(quad(namedNode(cardUrl), namedNode(`${FOAF}maker`), namedNode(webId), cardGraph));
+            out.push(quad(namedNode(cardUrl), namedNode(`${FOAF}primaryTopic`), namedNode(webId), cardGraph));
+            out.push(quad(namedNode(webId), namedNode(`${RDF}type`), namedNode(`${FOAF}Person`), cardGraph));
+            out.push(quad(namedNode(webId), namedNode(`${SOLID}oidcIssuer`), namedNode(oidcIssuer), cardGraph));
+            out.push(quad(namedNode(webId), namedNode(`${SOLID}storage`), namedNode(podUrl), cardGraph));
+            out.push(quad(namedNode(webId), namedNode(`${SOLID}privateTypeIndex`), namedNode(privateTypeIndexUrl), cardGraph));
+        }
         this.addPrivateTypeIndexQuads(out, privateTypeIndexGraph, privateTypeIndexUrl);
-        out.push(...authorizationResources.quads);
+        out.push(...authorizationResources.quads.filter((entry) => this.hostsProfile || entry.graph.value === authorizationResources.rootResourceUrl));
         return out;
     }
     writeIdentityIndexes(input) {

package/dist/provision/LocalPodProvisioningService.jsonld

@@ -108,6 +108,10 @@
           "@id": "undefineds:dist/provision/LocalPodProvisioningService.jsonld#LocalPodProvisioningService__member_oidcIssuer",
           "memberFieldName": "oidcIssuer"
         },
+        {
+          "@id": "undefineds:dist/provision/LocalPodProvisioningService.jsonld#LocalPodProvisioningService__member_hostsProfile",
+          "memberFieldName": "hostsProfile"
+        },
         {
           "@id": "undefineds:dist/provision/LocalPodProvisioningService.jsonld#LocalPodProvisioningService__member_authMode",
           "memberFieldName": "authMode"
@@ -124,6 +128,10 @@
           "@id": "undefineds:dist/provision/LocalPodProvisioningService.jsonld#LocalPodProvisioningService__member_createPod",
           "memberFieldName": "createPod"
         },
+        {
+          "@id": "undefineds:dist/provision/LocalPodProvisioningService.jsonld#LocalPodProvisioningService__member_resolveWebId",
+          "memberFieldName": "resolveWebId"
+        },
         {
           "@id": "undefineds:dist/provision/LocalPodProvisioningService.jsonld#LocalPodProvisioningService__member_createPodFiles",
           "memberFieldName": "createPodFiles"

package/dist/provision/PodDeletionRoute.d.ts

@@ -0,0 +1,2 @@
+/** Keep destructive provisioning requests on the CSS data/identity lifecycle. */
+export declare function podDeletionRouteName(method: string | undefined, requestUrl: string): string | undefined;

package/dist/provision/PodDeletionRoute.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.podDeletionRouteName = podDeletionRouteName;
+/** Keep destructive provisioning requests on the CSS data/identity lifecycle. */
+function podDeletionRouteName(method, requestUrl) {
+    if (method !== 'DELETE') {
+        return;
+    }
+    const pathname = requestUrl.split('?', 1)[0];
+    return /^\/provision\/pods\/([a-zA-Z0-9_-]{1,64})$/u.exec(pathname)?.[1];
+}
+//# sourceMappingURL=PodDeletionRoute.js.map

package/dist/provision/PodMutationLock.d.ts

@@ -0,0 +1,5 @@
+import type { ResourceIdentifier } from '@solid/community-server';
+/** Separate from resource locks: child writes and Pod deletion share this gate. */
+export declare function podMutationLockIdentifier(storageUrl: string): ResourceIdentifier;
+/** Global SPARQL updates can target any Pod, so they share a server namespace gate. */
+export declare function podMutationNamespaceLockIdentifier(baseUrl: string): ResourceIdentifier;

package/dist/provision/PodMutationLock.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.podMutationLockIdentifier = podMutationLockIdentifier;
+exports.podMutationNamespaceLockIdentifier = podMutationNamespaceLockIdentifier;
+/** Separate from resource locks: child writes and Pod deletion share this gate. */
+function podMutationLockIdentifier(storageUrl) {
+    return { path: `urn:xpod:pod-mutation:${storageUrl}` };
+}
+/** Global SPARQL updates can target any Pod, so they share a server namespace gate. */
+function podMutationNamespaceLockIdentifier(baseUrl) {
+    return { path: `urn:xpod:pod-mutation-namespace:${new URL(baseUrl.replace(/\/?$/u, '/')).href}` };
+}
+//# sourceMappingURL=PodMutationLock.js.map

package/dist/provision/ProvisionPodCreator.d.ts

@@ -1,13 +1,5 @@
-/**
- * ProvisionPodCreator
- *
- * 等位替换 CSS 的 BasePodCreator。
- *
- * 检查 settings 里有没有 provisionCode：
- * - 有 → 解码签名 provision code，核验锁外预创建的 Local Pod 回执，并写入 Account 绑定
- * - 没有 → 委托给原始 BasePodCreator（标准本地创建）
- */
 import { BasePodCreator, type PodCreatorInput, type PodCreatorOutput, type BasePodCreatorArgs, type ResourceStore } from '@solid/community-server';
+import type { CloudProfileCreator } from './CloudProfileCreator';
 export interface ProvisionPodCreatorArgs extends BasePodCreatorArgs {
     /** 与 ProvisionHandler 使用相同的 baseUrl 派生签名密钥 */
     provisionBaseUrl?: string;
@@ -16,11 +8,12 @@ export interface ProvisionPodCreatorArgs extends BasePodCreatorArgs {
     /** Kept in the component signature for config compatibility; Pod storage facts live in CSS account data. */
     identityDbUrl?: string;
     /**
-     * Server-internal resource store. Used only to reconcile native same-server Pod profiles.
-     * Managed Local profiles are created on the Local SP before the Cloud Account lock is entered.
+     * Server-internal resource store used to reconcile native same-server Pod profiles.
+     * Managed Local discovery cards are independently prepared and hosted in Cloud.
      */
     resourceStore?: ResourceStore;
     edgeNodeRepository?: ProvisionReceiptNodeRepository;
+    cloudProfileCreator?: CloudProfileCreator;
 }
 interface ProvisionReceiptNodeRepository {
     getSpNode(nodeId: string): Promise<{
@@ -28,25 +21,28 @@ interface ProvisionReceiptNodeRepository {
     } | undefined>;
 }
 export declare class ProvisionPodCreator extends BasePodCreator {
+    private readonly deletionOperations?;
     private readonly provisionLogger;
     private readonly codec;
     private readonly oidcIssuer?;
     private readonly currentNodeId?;
     private readonly resourceStore?;
     private readonly edgeNodeRepository?;
+    private readonly cloudProfileCreator?;
     constructor(args: ProvisionPodCreatorArgs);
     handle(input: PodCreatorInput): Promise<PodCreatorOutput>;
     private targetsCurrentStorageProvider;
     private resolveRemoteReceiptSecret;
     private handleStandardPodCreate;
+    private createStandardPod;
     private prepareWebIdLink;
     private findExistingWebIdLink;
     /**
      * Reconcile the solid:storage binding in a WebID profile card hosted on this server.
      * CSS remains the sole owner of the native Pod resources and their authorization; Xpod only
      * adds or updates this product-specific relation after CSS has finished creating the Pod.
-     * Standard CSS creation keeps this best-effort. Managed Local-Pod profiles are
-     * created and signed by the Local SP before the Cloud Account resource lock.
+     * Standard CSS creation keeps this best-effort. Managed Local Cloud cards use
+     * CloudProfileCreator and require their discovery binding to succeed.
      */
     private syncProfileStorageBinding;
     private writeProfileStorageBinding;

package/dist/provision/ProvisionPodCreator.js

@@ -1,4 +1,7 @@
 "use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ProvisionPodCreator = void 0;
+const PodDeletionOperationRepository_1 = require("../identity/drizzle/PodDeletionOperationRepository");
 /**
  * ProvisionPodCreator
  *
@@ -8,8 +11,6 @@
  * - 有 → 解码签名 provision code，核验锁外预创建的 Local Pod 回执，并写入 Account 绑定
  * - 没有 → 委托给原始 BasePodCreator（标准本地创建）
  */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.ProvisionPodCreator = void 0;
 const global_logger_factory_1 = require("global-logger-factory");
 const node_stream_1 = require("node:stream");
 const n3_1 = require("n3");
@@ -93,9 +94,11 @@ class ProvisionPodCreator extends community_server_1.BasePodCreator {
     constructor(args) {
         super(args);
         this.provisionLogger = (0, global_logger_factory_1.getLoggerFor)(this);
+        this.deletionOperations = args.identityDbUrl ? new PodDeletionOperationRepository_1.PodDeletionOperationRepository(args.identityDbUrl) : undefined;
         this.oidcIssuer = normalizeOptionalUrl(args.provisionBaseUrl);
         this.currentNodeId = normalizeOptionalString(args.nodeId);
         this.resourceStore = args.resourceStore;
+        this.cloudProfileCreator = args.cloudProfileCreator;
         this.edgeNodeRepository = args.edgeNodeRepository ?? (args.identityDbUrl
             ? new EdgeNodeRepository_1.EdgeNodeRepository((0, db_1.getIdentityDatabase)(args.identityDbUrl))
             : undefined);
@@ -105,6 +108,12 @@ class ProvisionPodCreator extends community_server_1.BasePodCreator {
         if (input.webId !== undefined && (!input.webId || input.webId !== input.webId.trim() || /[\r\n\t]/u.test(input.webId))) {
             throw new community_server_1.BadRequestHttpError('WebID must not contain surrounding whitespace or control characters.');
         }
+        // Managed Local is a storage provider, not a second Account identity authority.
+        // Its data-only creation path is the private provisioning endpoint; native CSS
+        // Pod templates here would mint or duplicate a Local profile even for a Cloud owner.
+        if (this.oidcIssuer && !isSameUrlRoot(this.oidcIssuer, this.baseUrl)) {
+            throw new community_server_1.BadRequestHttpError('Create managed Local Pods through the Cloud Account and Local provisioning endpoint.');
+        }
         const provisionCode = input.settings?.provisionCode;
         if (!provisionCode) {
             return this.handleStandardPodCreate(input);
@@ -121,7 +130,7 @@ class ProvisionPodCreator extends community_server_1.BasePodCreator {
         }
         const targetStorageRoot = buildStorageRoot(payload);
         const canonicalStorageUrl = buildPodUrl(targetStorageRoot, podName);
-        const canonicalWebId = joinUrlPath(canonicalStorageUrl, this.relativeWebIdPath);
+        const localWebId = joinUrlPath(canonicalStorageUrl, this.relativeWebIdPath);
         const tokenOidcIssuer = normalizeUrlRoot(this.oidcIssuer ?? this.baseUrl) ?? this.oidcIssuer ?? this.baseUrl;
         if (this.targetsCurrentStorageProvider(payload, targetStorageRoot)) {
             this.provisionLogger.info(`Provision code targets current SP ${this.baseUrl}${this.currentNodeId ? ` (${this.currentNodeId})` : ''}; creating Pod directly through CSS`);
@@ -130,13 +139,13 @@ class ProvisionPodCreator extends community_server_1.BasePodCreator {
                 linkWebId: !input.webId,
                 oidcIssuer: tokenOidcIssuer,
                 storageUrl: canonicalStorageUrl,
-                webId: input.webId ?? canonicalWebId,
+                webId: input.webId ?? localWebId,
             });
         }
         // CSS Account Pod 创建运行在 6 秒资源锁内。任何 Local/Cloud/P2P 网络请求
         // 都必须在进入此处理器前完成。锁内工作明确限定为：读取本地 SP
-        // receipt secret、HMAC 核验，以及 CSS 原生 WebID-link/Pod account-store
-        // 读写。这里不会读取或改写远端 WebID profile；它已由 Local SP 创建。
+        // receipt secret、HMAC 核验、已由 Cloud Account 准备的身份关联，以及
+        // Cloud card 和远程 Pod 元数据读写。不会访问 Local 或读写 Local profile。
         const receiptSecret = await this.resolveRemoteReceiptSecret(payload.nodeId);
         if (!receiptSecret) {
             throw new community_server_1.BadRequestHttpError('Local Pod preparation could not be verified.');
@@ -153,13 +162,27 @@ class ProvisionPodCreator extends community_server_1.BasePodCreator {
         }
         const webId = input.webId ?? receipt.payload.webId;
         if (receipt.payload.podName !== podName
-            || !isSameWebId(receipt.payload.webId, canonicalWebId)
-            || !isSameWebId(webId, canonicalWebId)
+            || !isSameWebId(receipt.payload.webId, webId)
             || !isSameUrlRoot(receipt.payload.podUrl, canonicalStorageUrl)) {
             throw new community_server_1.BadRequestHttpError('Local Pod preparation could not be verified.');
         }
+        let cloudIdentity;
+        try {
+            const identityUrl = new URL(webId);
+            const cloudBase = new URL(this.baseUrl);
+            cloudIdentity = identityUrl.origin === cloudBase.origin
+                && identityUrl.pathname.startsWith(cloudBase.pathname)
+                && !identityUrl.username && !identityUrl.password;
+        }
+        catch {
+            cloudIdentity = false;
+        }
+        const existingLink = cloudIdentity ? await this.findExistingWebIdLink(webId, input.accountId) : undefined;
+        if (!existingLink || !this.cloudProfileCreator) {
+            throw new community_server_1.BadRequestHttpError('Local Pod preparation could not be verified.');
+        }
         const podUrl = canonicalStorageUrl;
-        // 3. Link the WebID and record the remote Pod in account storage.
+        // 3. Record Local storage for the identity already prepared by this Cloud Account.
         // ProvisionPodStore uses the marker below to persist settings.storage
         // instead of creating a phantom Cloud Pod at settings.base.path.
         const localBase = this.identifierGenerator.generate(podName);
@@ -172,17 +195,18 @@ class ProvisionPodCreator extends community_server_1.BasePodCreator {
             storage: canonicalStorageUrl,
             [ProvisionPodStore_1.XPOD_REMOTE_PROVISIONED]: true,
         };
-        // The signed Local receipt makes this WebID an Xpod-managed identity, so it
-        // is safe to link automatically even though its document lives on the Local SP.
-        const webIdLink = await this.prepareWebIdLink(true, webId, input.accountId, podSettings);
-        podSettings.oidcIssuer = tokenOidcIssuer;
-        const podId = await this.createPod(input.accountId, podSettings, !input.name, webIdLink.cleanupWebIdLink);
+        // Local's signature proves storage preparation, never ownership of an arbitrary WebID.
+        const podId = await this.createPod(input.accountId, podSettings, !input.name, undefined);
+        if (receipt.payload.podId && payload.nodeId && this.deletionOperations) {
+            await this.deletionOperations.bindRemoteGeneration(podId, payload.nodeId, canonicalStorageUrl, receipt.payload.podId);
+        }
+        await this.cloudProfileCreator.finalizeStorageBinding(input.accountId, webId, canonicalStorageUrl);
         this.provisionLogger.info(`Provisioned pod ${podName} on SP ${payload.spUrl}, podUrl: ${podUrl}`);
         return {
             podUrl,
             webId,
             podId,
-            webIdLink: webIdLink.outputWebIdLink,
+            webIdLink: existingLink.id,
         };
     }
     targetsCurrentStorageProvider(payload, targetStorageRoot) {
@@ -198,6 +222,13 @@ class ProvisionPodCreator extends community_server_1.BasePodCreator {
         return spNode?.serviceTokenHash || undefined;
     }
     async handleStandardPodCreate(input, options = {}) {
+        const baseIdentifier = options.baseIdentifier ?? this.generateBaseIdentifier(input.name);
+        const create = () => this.createStandardPod(input, { ...options, baseIdentifier });
+        return this.cloudProfileCreator
+            ? this.cloudProfileCreator.withNamespaceLock(baseIdentifier, create)
+            : create();
+    }
+    async createStandardPod(input, options) {
         const totalStarted = Date.now();
         const baseIdentifier = options.baseIdentifier ?? this.generateBaseIdentifier(input.name);
         const inputSettings = stripProvisionCredentials(input.settings);
@@ -263,8 +294,8 @@ class ProvisionPodCreator extends community_server_1.BasePodCreator {
      * Reconcile the solid:storage binding in a WebID profile card hosted on this server.
      * CSS remains the sole owner of the native Pod resources and their authorization; Xpod only
      * adds or updates this product-specific relation after CSS has finished creating the Pod.
-     * Standard CSS creation keeps this best-effort. Managed Local-Pod profiles are
-     * created and signed by the Local SP before the Cloud Account resource lock.
+     * Standard CSS creation keeps this best-effort. Managed Local Cloud cards use
+     * CloudProfileCreator and require their discovery binding to succeed.
      */
     async syncProfileStorageBinding(webId, storageUrl) {
         try {

package/dist/provision/ProvisionPodCreator.jsonld

@@ -63,7 +63,7 @@
               }
             ]
           },
-          "comment": "Server-internal resource store. Used only to reconcile native same-server Pod profiles. Managed Local profiles are created on the Local SP before the Cloud Account lock is entered."
+          "comment": "Server-internal resource store used to reconcile native same-server Pod profiles. Managed Local discovery cards are independently prepared and hosted in Cloud."
         },
         {
           "@id": "undefineds:dist/provision/ProvisionPodCreator.jsonld#ProvisionPodCreator_args_edgeNodeRepository",
@@ -77,6 +77,18 @@
             ]
           }
         },
+        {
+          "@id": "undefineds:dist/provision/ProvisionPodCreator.jsonld#ProvisionPodCreator_args_cloudProfileCreator",
+          "range": {
+            "@type": "ParameterRangeUnion",
+            "parameterRangeElements": [
+              "undefineds:dist/provision/CloudProfileCreator.jsonld#CloudProfileCreator",
+              {
+                "@type": "ParameterRangeUndefined"
+              }
+            ]
+          }
+        },
         {
           "@id": "undefineds:dist/provision/ProvisionPodCreator.jsonld#ProvisionPodCreator_args_baseUrl",
           "range": "xsd:string",
@@ -104,6 +116,10 @@
         }
       ],
       "memberFields": [
+        {
+          "@id": "undefineds:dist/provision/ProvisionPodCreator.jsonld#ProvisionPodCreator__member_deletionOperations",
+          "memberFieldName": "deletionOperations"
+        },
         {
           "@id": "undefineds:dist/provision/ProvisionPodCreator.jsonld#ProvisionPodCreator__member_provisionLogger",
           "memberFieldName": "provisionLogger"
@@ -128,6 +144,10 @@
           "@id": "undefineds:dist/provision/ProvisionPodCreator.jsonld#ProvisionPodCreator__member_edgeNodeRepository",
           "memberFieldName": "edgeNodeRepository"
         },
+        {
+          "@id": "undefineds:dist/provision/ProvisionPodCreator.jsonld#ProvisionPodCreator__member_cloudProfileCreator",
+          "memberFieldName": "cloudProfileCreator"
+        },
         {
           "@id": "undefineds:dist/provision/ProvisionPodCreator.jsonld#ProvisionPodCreator__member_constructor",
           "memberFieldName": "constructor"
@@ -148,6 +168,10 @@
           "@id": "undefineds:dist/provision/ProvisionPodCreator.jsonld#ProvisionPodCreator__member_handleStandardPodCreate",
           "memberFieldName": "handleStandardPodCreate"
         },
+        {
+          "@id": "undefineds:dist/provision/ProvisionPodCreator.jsonld#ProvisionPodCreator__member_createStandardPod",
+          "memberFieldName": "createStandardPod"
+        },
         {
           "@id": "undefineds:dist/provision/ProvisionPodCreator.jsonld#ProvisionPodCreator__member_prepareWebIdLink",
           "memberFieldName": "prepareWebIdLink"
@@ -199,6 +223,12 @@
                 "@id": "undefineds:dist/provision/ProvisionPodCreator.jsonld#ProvisionPodCreator_args_edgeNodeRepository"
               }
             },
+            {
+              "keyRaw": "cloudProfileCreator",
+              "value": {
+                "@id": "undefineds:dist/provision/ProvisionPodCreator.jsonld#ProvisionPodCreator_args_cloudProfileCreator"
+              }
+            },
             {
               "keyRaw": "baseUrl",
               "value": {

package/dist/provision/ProvisionPodStore.js

@@ -36,15 +36,29 @@ class ProvisionPodStore extends community_server_1.BasePodStore {
         if (!remoteStorageUrl) {
             return super.create(accountId, settings, overwrite);
         }
+        const existing = await this.provisionStorage.find(community_server_1.POD_STORAGE_TYPE, { baseUrl: remoteStorageUrl });
+        if (existing.length) {
+            if (existing.length !== 1 || existing[0].accountId !== accountId ||
+                !(await this.getOwners(existing[0].id))?.some((owner) => owner.webId === settings.webId)) {
+                throw new community_server_1.ConflictHttpError('The remote Pod has different ownership.');
+            }
+            return existing[0].id;
+        }
         const pod = await this.provisionStorage.create(community_server_1.POD_STORAGE_TYPE, {
             baseUrl: remoteStorageUrl,
             accountId,
         });
-        await this.provisionStorage.create(community_server_1.OWNER_STORAGE_TYPE, {
-            podId: pod.id,
-            webId: settings.webId,
-            visible: this.provisionVisible,
-        });
+        try {
+            await this.provisionStorage.create(community_server_1.OWNER_STORAGE_TYPE, {
+                podId: pod.id,
+                webId: settings.webId,
+                visible: this.provisionVisible,
+            });
+        }
+        catch (error) {
+            await this.provisionStorage.delete(community_server_1.POD_STORAGE_TYPE, pod.id);
+            throw error;
+        }
         this.provisionLogger.debug(`Recorded remote Pod ${remoteStorageUrl} for account ${accountId}`);
         return pod.id;
     }

package/dist/provision/ProvisionReceiptCodec.d.ts

@@ -3,6 +3,8 @@ export interface ProvisionReceiptPayload {
     podName: string;
     webId: string;
     podUrl: string;
+    /** Immutable Local storage incarnation; older receipts intentionally lack delete capability. */
+    podId?: string;
     exp: number;
 }
 export interface CreateProvisionReceiptOptions {
@@ -10,6 +12,8 @@ export interface CreateProvisionReceiptOptions {
     podName: string;
     webId: string;
     podUrl: string;
+    /** Immutable Local storage incarnation; older receipts intentionally lack delete capability. */
+    podId?: string;
     expiresAt?: number;
     ttlSeconds?: number;
     now?: () => number;

package/dist/provision/ProvisionReceiptCodec.js

@@ -19,6 +19,7 @@ function createProvisionReceipt(options) {
         podName: options.podName,
         webId: options.webId,
         podUrl: options.podUrl,
+        ...(options.podId ? { podId: options.podId } : {}),
         exp,
     };
     const data = Buffer.from(JSON.stringify(payload), 'utf8').toString('base64url');
@@ -73,6 +74,7 @@ function isValidPayload(value) {
         && payload.webId.length > 0
         && typeof payload.podUrl === 'string'
         && payload.podUrl.length > 0
+        && (payload.podId === undefined || typeof payload.podId === 'string' && payload.podId.length > 0)
         && typeof payload.exp === 'number'
         && Number.isFinite(payload.exp);
 }

package/dist/runtime/GatewayAdminProxyAuth.d.ts

@@ -1,4 +1,4 @@
-import type { IncomingHttpHeaders, OutgoingHttpHeaders } from 'node:http';
+import type { IncomingHttpHeaders } from 'node:http';
 export declare const GATEWAY_ADMIN_PROXY_LOOPBACK_HEADER = "x-xpod-admin-proxy-loopback";
 export declare const GATEWAY_ADMIN_PROXY_TIMESTAMP_HEADER = "x-xpod-admin-proxy-timestamp";
 export declare const GATEWAY_ADMIN_PROXY_SIGNATURE_HEADER = "x-xpod-admin-proxy-signature";
@@ -20,7 +20,7 @@ export interface GatewayAdminProxyMarkerVerification {
     nonce?: string;
     reason?: string;
 }
-export declare function createGatewayAdminProxyHeaders(input: GatewayAdminProxyMarkerInput): OutgoingHttpHeaders;
+export declare function createGatewayAdminProxyHeaders(input: GatewayAdminProxyMarkerInput): Record<string, string>;
 export declare function stripGatewayAdminProxyHeaders(headers: IncomingHttpHeaders): void;
 export declare function isLoopbackRemoteAddress(remoteAddress: string | undefined): boolean;
 export declare function verifyGatewayAdminProxyHeaders(input: {

package/dist/runtime/Proxy.d.ts

@@ -5,6 +5,7 @@ export declare class GatewayProxy {
     private supervisor;
     private readonly logger;
     private proxy;
+    private readonly proxyResponses;
     private server;
     private targets;
     private readonly runtimeHost;
@@ -30,6 +31,7 @@ export declare class GatewayProxy {
     private readonly ingressPort?;
     private ingressServer?;
     constructor(port: number | undefined, supervisor: Supervisor, bindHost?: string, options?: GatewayProxyOptions);
+    private handleProxyError;
     /**
      * Builds one HTTP listener plus its WebSocket routing.
      *