@undefineds.co/xpod 0.4.20 → 0.4.25

package/dist/edge/reachability/TcpP2PDataPlaneTransport.jsonld

@@ -4,10 +4,43 @@
   ],
   "@id": "npmd:@undefineds.co/xpod",
   "components": [
+    {
+      "@id": "undefineds:dist/edge/reachability/TcpP2PDataPlaneTransport.jsonld#P2PDataPlaneSecurityOptions",
+      "@type": "AbstractClass",
+      "requireElement": "P2PDataPlaneSecurityOptions",
+      "comment": "Data plane authentication (audit N03).  Both endpoints must configure the same per-session secret; it is only ever transported over the authenticated signaling API. Each side announces itself with a nonce, derives direction-separated keys, and then seals every frame. A peer without the secret cannot make the other side accept a frame, and a frame cannot be replayed into another session or direction.",
+      "parameters": [],
+      "memberFields": [
+        {
+          "@id": "undefineds:dist/edge/reachability/TcpP2PDataPlaneTransport.jsonld#P2PDataPlaneSecurityOptions__member_role",
+          "memberFieldName": "role"
+        },
+        {
+          "@id": "undefineds:dist/edge/reachability/TcpP2PDataPlaneTransport.jsonld#P2PDataPlaneSecurityOptions__member_sessionId",
+          "memberFieldName": "sessionId"
+        },
+        {
+          "@id": "undefineds:dist/edge/reachability/TcpP2PDataPlaneTransport.jsonld#P2PDataPlaneSecurityOptions__member_secret",
+          "memberFieldName": "secret"
+        },
+        {
+          "@id": "undefineds:dist/edge/reachability/TcpP2PDataPlaneTransport.jsonld#P2PDataPlaneSecurityOptions__member_resolveSessionSecret",
+          "memberFieldName": "resolveSessionSecret"
+        },
+        {
+          "@id": "undefineds:dist/edge/reachability/TcpP2PDataPlaneTransport.jsonld#P2PDataPlaneSecurityOptions__member_handshakeTimeoutMs",
+          "memberFieldName": "handshakeTimeoutMs"
+        }
+      ],
+      "constructorArguments": []
+    },
     {
       "@id": "undefineds:dist/edge/reachability/TcpP2PDataPlaneTransport.jsonld#TcpP2PDataPlaneTransportOptions",
       "@type": "AbstractClass",
       "requireElement": "TcpP2PDataPlaneTransportOptions",
+      "extends": [
+        "undefineds:dist/edge/reachability/P2PDataPlane.jsonld#P2PDataPlaneLimitsOptions"
+      ],
       "parameters": [],
       "memberFields": [
         {
@@ -29,6 +62,10 @@
         {
           "@id": "undefineds:dist/edge/reachability/TcpP2PDataPlaneTransport.jsonld#TcpP2PDataPlaneTransportOptions__member_randomId",
           "memberFieldName": "randomId"
+        },
+        {
+          "@id": "undefineds:dist/edge/reachability/TcpP2PDataPlaneTransport.jsonld#TcpP2PDataPlaneTransportOptions__member_secure",
+          "memberFieldName": "secure"
         }
       ],
       "constructorArguments": []
@@ -53,6 +90,9 @@
       "@id": "undefineds:dist/edge/reachability/TcpP2PDataPlaneTransport.jsonld#TcpP2PDataPlaneServerOptions",
       "@type": "AbstractClass",
       "requireElement": "TcpP2PDataPlaneServerOptions",
+      "extends": [
+        "undefineds:dist/edge/reachability/P2PDataPlane.jsonld#P2PDataPlaneLimitsOptions"
+      ],
       "parameters": [],
       "memberFields": [
         {
@@ -62,6 +102,10 @@
         {
           "@id": "undefineds:dist/edge/reachability/TcpP2PDataPlaneTransport.jsonld#TcpP2PDataPlaneServerOptions__member_host",
           "memberFieldName": "host"
+        },
+        {
+          "@id": "undefineds:dist/edge/reachability/TcpP2PDataPlaneTransport.jsonld#TcpP2PDataPlaneServerOptions__member_secure",
+          "memberFieldName": "secure"
         }
       ],
       "constructorArguments": []
@@ -91,6 +135,9 @@
       "@id": "undefineds:dist/edge/reachability/TcpP2PDataPlaneTransport.jsonld#TcpP2PDataPlaneSocketOptions",
       "@type": "AbstractClass",
       "requireElement": "TcpP2PDataPlaneSocketOptions",
+      "extends": [
+        "undefineds:dist/edge/reachability/P2PDataPlane.jsonld#P2PDataPlaneLimitsOptions"
+      ],
       "parameters": [],
       "memberFields": [
         {
@@ -100,6 +147,10 @@
         {
           "@id": "undefineds:dist/edge/reachability/TcpP2PDataPlaneTransport.jsonld#TcpP2PDataPlaneSocketOptions__member_handler",
           "memberFieldName": "handler"
+        },
+        {
+          "@id": "undefineds:dist/edge/reachability/TcpP2PDataPlaneTransport.jsonld#TcpP2PDataPlaneSocketOptions__member_secure",
+          "memberFieldName": "secure"
         }
       ],
       "constructorArguments": []

package/dist/edge/reachability/TcpP2PSignalingSession.d.ts

@@ -2,6 +2,7 @@ import { type Socket } from 'node:net';
 import type { AccessRoute, P2PCandidateRole, P2PSession, P2PTransportCandidate } from './types';
 import type { P2PSignalingClient } from './P2PSignalingClient';
 import type { P2PDataPlaneHandler } from './P2PDataPlane';
+import type { P2PDataPlaneSecurityOptions } from './TcpP2PDataPlaneTransport';
 import { type TcpP2PDataPlaneSocketHandle, type TcpP2PDataPlaneTransport, type TcpHolePunchPlan, type TcpHolePunchPlanOptions } from './TcpP2PDataPlaneTransport';
 export declare const RAW_TCP_HOLE_PUNCH_TRANSPORT: "raw-tcp-hole-punch";
 export declare const RAW_TCP_HOLE_PUNCH_CAPABILITY: "tcp-punch";
@@ -19,6 +20,8 @@ export interface CreateRawTcpHolePunchCandidatesOptions {
 export interface SignaledRawTcpP2PSessionOptions {
     signaling: P2PSignalingClient;
     clientId: string;
+    /** Overrides the generated per-session data plane secret (tests only). */
+    dataPlaneSecret?: string;
     host?: string;
     address?: string;
     capabilities?: string[];
@@ -33,6 +36,8 @@ export interface SignaledRawTcpP2PSession {
     plan: TcpHolePunchPlan;
     localCandidates: P2PTransportCandidate[];
     rawTcpRoute?: AccessRoute;
+    /** Secret both peers use to seal the data plane (audit N03). */
+    dataPlaneSecret: string;
 }
 export interface AnswerPendingRawTcpP2PSessionsOnceOptions {
     signaling: P2PSignalingClient;
@@ -53,6 +58,8 @@ export interface WaitForRawTcpRemoteCandidatesOptions {
     timeoutMs?: number;
 }
 export interface ConnectRawTcpP2PTransportOptions {
+    /** Data plane authentication; the signaled path always sets it (audit N03). */
+    secure?: P2PDataPlaneSecurityOptions;
     localCandidates: P2PTransportCandidate[];
     remoteCandidates: P2PTransportCandidate[];
     connectTimeoutMs?: number;

package/dist/edge/reachability/TcpP2PSignalingSession.js

@@ -13,6 +13,7 @@ exports.filterRawTcpRemoteCandidates = filterRawTcpRemoteCandidates;
 exports.selectRawTcpP2PRoute = selectRawTcpP2PRoute;
 exports.isRawTcpHolePunchCandidate = isRawTcpHolePunchCandidate;
 const node_net_1 = require("node:net");
+const P2PDataPlaneCrypto_1 = require("./P2PDataPlaneCrypto");
 const TcpP2PDataPlaneTransport_1 = require("./TcpP2PDataPlaneTransport");
 exports.RAW_TCP_HOLE_PUNCH_TRANSPORT = 'raw-tcp-hole-punch';
 exports.RAW_TCP_HOLE_PUNCH_CAPABILITY = 'tcp-punch';
@@ -61,6 +62,7 @@ async function createSignaledRawTcpP2PSession(options) {
         plan,
         candidateIdPrefix: options.candidateIdPrefix,
     });
+    const dataPlaneSecret = options.dataPlaneSecret ?? (0, P2PDataPlaneCrypto_1.createDataPlaneSecret)();
     const request = {
         clientId: options.clientId,
         capabilities: uniqueStrings([
@@ -68,6 +70,7 @@ async function createSignaledRawTcpP2PSession(options) {
             ...(options.capabilities ?? []),
         ]),
         candidates: localCandidates,
+        dataPlaneSecret,
     };
     const session = await options.signaling.createP2PSession(request);
     const effectiveLocalCandidates = localRawTcpCandidatesFromSessionOrFallback(session, localCandidates, 'client', options.clientId, plan.bucket);
@@ -76,6 +79,9 @@ async function createSignaledRawTcpP2PSession(options) {
         plan,
         localCandidates: effectiveLocalCandidates,
         rawTcpRoute: selectRawTcpP2PRoute(session.nodeCandidates),
+        // The API echoes the session back; a node that stripped the secret would otherwise let the
+        // client believe the plane is sealed while the node cannot open a single frame.
+        dataPlaneSecret: session.dataPlaneSecret ?? dataPlaneSecret,
     };
 }
 async function answerPendingRawTcpP2PSessionsOnce(options) {
@@ -159,7 +165,19 @@ async function acceptSignaledRawTcpP2PConnectionOnce(options) {
                 plan,
                 localCandidates: effectiveLocalCandidates,
                 remoteCandidates,
-                socketHandle: (0, TcpP2PDataPlaneTransport_1.attachTcpP2PDataPlaneSocket)({ socket, handler: options.handler }),
+                socketHandle: (0, TcpP2PDataPlaneTransport_1.attachTcpP2PDataPlaneSocket)({
+                    socket,
+                    handler: options.handler,
+                    ...(answeredSession.dataPlaneSecret
+                        ? {
+                            secure: {
+                                role: 'server',
+                                sessionId: answeredSession.sessionId,
+                                secret: answeredSession.dataPlaneSecret,
+                            },
+                        }
+                        : {}),
+                }),
             };
         }
         catch (error) {
@@ -208,6 +226,11 @@ async function connectSignaledRawTcpP2PTransport(options) {
         nowMs: options.nowMs,
         sleepMs: options.sleepMs,
         connectSocket: options.connectSocket,
+        secure: {
+            role: 'client',
+            sessionId: signaled.session.sessionId,
+            secret: signaled.dataPlaneSecret,
+        },
     });
     return {
         ...signaled,
@@ -222,6 +245,7 @@ async function connectRawTcpP2PTransport(options) {
         remotePort: attempt.remotePort,
         socket,
         timeoutMs: options.timeoutMs,
+        ...(options.secure ? { secure: options.secure } : {}),
     });
 }
 async function connectRawTcpP2PSocket(options) {

package/dist/edge/reachability/TcpP2PSignalingSession.jsonld

@@ -63,6 +63,10 @@
           "@id": "undefineds:dist/edge/reachability/TcpP2PSignalingSession.jsonld#SignaledRawTcpP2PSessionOptions__member_clientId",
           "memberFieldName": "clientId"
         },
+        {
+          "@id": "undefineds:dist/edge/reachability/TcpP2PSignalingSession.jsonld#SignaledRawTcpP2PSessionOptions__member_dataPlaneSecret",
+          "memberFieldName": "dataPlaneSecret"
+        },
         {
           "@id": "undefineds:dist/edge/reachability/TcpP2PSignalingSession.jsonld#SignaledRawTcpP2PSessionOptions__member_host",
           "memberFieldName": "host"
@@ -119,6 +123,10 @@
         {
           "@id": "undefineds:dist/edge/reachability/TcpP2PSignalingSession.jsonld#SignaledRawTcpP2PSession__member_rawTcpRoute",
           "memberFieldName": "rawTcpRoute"
+        },
+        {
+          "@id": "undefineds:dist/edge/reachability/TcpP2PSignalingSession.jsonld#SignaledRawTcpP2PSession__member_dataPlaneSecret",
+          "memberFieldName": "dataPlaneSecret"
         }
       ],
       "constructorArguments": []
@@ -203,6 +211,10 @@
       "requireElement": "ConnectRawTcpP2PTransportOptions",
       "parameters": [],
       "memberFields": [
+        {
+          "@id": "undefineds:dist/edge/reachability/TcpP2PSignalingSession.jsonld#ConnectRawTcpP2PTransportOptions__member_secure",
+          "memberFieldName": "secure"
+        },
         {
           "@id": "undefineds:dist/edge/reachability/TcpP2PSignalingSession.jsonld#ConnectRawTcpP2PTransportOptions__member_localCandidates",
           "memberFieldName": "localCandidates"

package/dist/edge/reachability/index.d.ts

@@ -4,6 +4,7 @@ export * from './ReachabilitySessionService';
 export * from './ManagedRouteSelector';
 export * from './CanonicalFetch';
 export * from './P2PDataPlane';
+export * from './P2PDataPlaneCrypto';
 export * from './P2PSignalingClient';
 export * from './TcpP2PDataPlaneTransport';
 export * from './TcpP2PSignalingSession';

package/dist/edge/reachability/index.js

@@ -20,6 +20,7 @@ __exportStar(require("./ReachabilitySessionService"), exports);
 __exportStar(require("./ManagedRouteSelector"), exports);
 __exportStar(require("./CanonicalFetch"), exports);
 __exportStar(require("./P2PDataPlane"), exports);
+__exportStar(require("./P2PDataPlaneCrypto"), exports);
 __exportStar(require("./P2PSignalingClient"), exports);
 __exportStar(require("./TcpP2PDataPlaneTransport"), exports);
 __exportStar(require("./TcpP2PSignalingSession"), exports);

package/dist/edge/reachability/types.d.ts

@@ -51,6 +51,12 @@ export interface P2PSessionRequest {
     owner?: P2PSessionOwner;
     capabilities?: string[];
     candidates?: unknown[];
+    /**
+     * Base64 per-session secret for the data plane (audit N03). The creator generates it; the
+     * signaling API is the only channel that carries it, so a network peer that can reach the
+     * punched port still cannot read or forge frames.
+     */
+    dataPlaneSecret?: string;
 }
 export interface P2PSessionOwner {
     type: 'solid';
@@ -94,6 +100,8 @@ export interface P2PSession {
     capabilities: string[];
     candidates: P2PTransportCandidate[];
     limits?: P2PSessionLimits;
+    /** Present for data planes that authenticate and encrypt their frames (audit N03). */
+    dataPlaneSecret?: string;
 }
 export interface P2PSessionList {
     kind: 'p2p';

package/dist/edge/reachability/types.jsonld

@@ -181,6 +181,10 @@
         {
           "@id": "undefineds:dist/edge/reachability/types.jsonld#P2PSessionRequest__member_candidates",
           "memberFieldName": "candidates"
+        },
+        {
+          "@id": "undefineds:dist/edge/reachability/types.jsonld#P2PSessionRequest__member_dataPlaneSecret",
+          "memberFieldName": "dataPlaneSecret"
         }
       ],
       "constructorArguments": []
@@ -354,6 +358,10 @@
         {
           "@id": "undefineds:dist/edge/reachability/types.jsonld#P2PSession__member_limits",
           "memberFieldName": "limits"
+        },
+        {
+          "@id": "undefineds:dist/edge/reachability/types.jsonld#P2PSession__member_dataPlaneSecret",
+          "memberFieldName": "dataPlaneSecret"
         }
       ],
       "constructorArguments": []

package/dist/http/DeviceNotificationWebSocketServer.d.ts

@@ -15,13 +15,17 @@ export declare class DeviceNotificationWebSocketServer {
     private readonly heartbeatIntervalMs;
     private readonly wss;
     private readonly sockets;
+    private readonly transportSockets;
     private readonly socketConnections;
     private readonly alive;
+    private stopPromise?;
+    private stopping;
+    private readonly activeFrames;
     private heartbeatTimer?;
     constructor(options: DeviceNotificationWebSocketServerOptions);
     attach(server: Server): void;
     handleUpgrade(request: IncomingMessage, socket: Duplex, head: Buffer): void;
-    stop(): void;
+    stop(): Promise<void>;
     private handleFrame;
     private reject;
     private startHeartbeat;

package/dist/http/DeviceNotificationWebSocketServer.js

@@ -7,8 +7,11 @@ class DeviceNotificationWebSocketServer {
     constructor(options) {
         this.wss = new ws_1.WebSocketServer({ noServer: true });
         this.sockets = new Set();
+        this.transportSockets = new Set();
         this.socketConnections = new Map();
         this.alive = new Map();
+        this.stopping = false;
+        this.activeFrames = new Set();
         this.hub = options.hub;
         this.ticketStore = options.ticketStore;
         this.path = options.path ?? '/v1/notifications/ws';
@@ -21,6 +24,10 @@ class DeviceNotificationWebSocketServer {
         });
     }
     handleUpgrade(request, socket, head) {
+        if (this.stopping) {
+            this.reject(socket, 503, 'Server shutting down');
+            return;
+        }
         const url = new URL(request.url ?? '/', `http://${request.headers.host ?? 'localhost'}`);
         if (url.pathname !== this.path) {
             return;
@@ -35,6 +42,8 @@ class DeviceNotificationWebSocketServer {
             this.reject(socket, 401, 'Invalid notification ticket');
             return;
         }
+        this.transportSockets.add(socket);
+        socket.once('close', () => this.transportSockets.delete(socket));
         this.wss.handleUpgrade(request, socket, head, (ws) => {
             this.sockets.add(ws);
             const connection = this.hub.openConnection({
@@ -57,7 +66,10 @@ class DeviceNotificationWebSocketServer {
                 this.alive.set(ws, true);
             });
             ws.on('message', (data) => {
-                void (async () => {
+                if (this.stopping) {
+                    return;
+                }
+                const work = (async () => {
                     try {
                         const frame = (0, device_notification_protocol_1.parseClientFrame)(JSON.parse(data.toString()), {
                             origin: record.origin,
@@ -65,9 +77,13 @@ class DeviceNotificationWebSocketServer {
                         await this.handleFrame(connection.connectionId, frame);
                     }
                     catch (error) {
-                        ws.send((0, device_notification_protocol_1.serializeServerFrame)((0, device_notification_protocol_1.createProtocolErrorFrame)('bad-frame', error.message)));
+                        if (ws.readyState === ws_1.WebSocket.OPEN) {
+                            ws.send((0, device_notification_protocol_1.serializeServerFrame)((0, device_notification_protocol_1.createProtocolErrorFrame)('bad-frame', error.message)));
+                        }
                     }
                 })();
+                this.activeFrames.add(work);
+                void work.then(() => this.activeFrames.delete(work), () => this.activeFrames.delete(work));
             });
             ws.on('close', () => {
                 this.cleanupSocket(ws);
@@ -78,17 +94,29 @@ class DeviceNotificationWebSocketServer {
         });
     }
     stop() {
-        for (const socket of this.sockets) {
-            socket.close();
+        if (this.stopPromise) {
+            return this.stopPromise;
         }
-        this.sockets.clear();
-        this.socketConnections.clear();
-        this.alive.clear();
+        this.stopping = true;
         if (this.heartbeatTimer) {
             clearInterval(this.heartbeatTimer);
             this.heartbeatTimer = undefined;
         }
-        this.wss.close();
+        const channelsClosed = new Promise((resolve, reject) => {
+            // Register before destroying upgraded transports and await real channel
+            // closure. Bun 1.3.8 leaks the native active count when ws.close/terminate
+            // is called first, so shutdown uses the owned raw transport instead.
+            this.wss.close((error) => error ? reject(error) : resolve());
+            for (const socket of this.transportSockets) {
+                socket.destroy();
+            }
+        });
+        this.stopPromise = Promise.all([channelsClosed, ...this.activeFrames]).then(() => {
+            this.sockets.clear();
+            this.socketConnections.clear();
+            this.alive.clear();
+        });
+        return this.stopPromise;
     }
     async handleFrame(connectionId, frame) {
         switch (frame.type) {

package/dist/http/DeviceNotificationWebSocketServer.jsonld

@@ -67,6 +67,10 @@
           "@id": "undefineds:dist/http/DeviceNotificationWebSocketServer.jsonld#DeviceNotificationWebSocketServer__member_sockets",
           "memberFieldName": "sockets"
         },
+        {
+          "@id": "undefineds:dist/http/DeviceNotificationWebSocketServer.jsonld#DeviceNotificationWebSocketServer__member_transportSockets",
+          "memberFieldName": "transportSockets"
+        },
         {
           "@id": "undefineds:dist/http/DeviceNotificationWebSocketServer.jsonld#DeviceNotificationWebSocketServer__member_socketConnections",
           "memberFieldName": "socketConnections"
@@ -75,6 +79,18 @@
           "@id": "undefineds:dist/http/DeviceNotificationWebSocketServer.jsonld#DeviceNotificationWebSocketServer__member_alive",
           "memberFieldName": "alive"
         },
+        {
+          "@id": "undefineds:dist/http/DeviceNotificationWebSocketServer.jsonld#DeviceNotificationWebSocketServer__member_stopPromise",
+          "memberFieldName": "stopPromise"
+        },
+        {
+          "@id": "undefineds:dist/http/DeviceNotificationWebSocketServer.jsonld#DeviceNotificationWebSocketServer__member_stopping",
+          "memberFieldName": "stopping"
+        },
+        {
+          "@id": "undefineds:dist/http/DeviceNotificationWebSocketServer.jsonld#DeviceNotificationWebSocketServer__member_activeFrames",
+          "memberFieldName": "activeFrames"
+        },
         {
           "@id": "undefineds:dist/http/DeviceNotificationWebSocketServer.jsonld#DeviceNotificationWebSocketServer__member_heartbeatTimer",
           "memberFieldName": "heartbeatTimer"

package/dist/http/HeadSafeResponseWriter.d.ts

@@ -0,0 +1,9 @@
+import { BasicResponseWriter, type HttpResponse, type MetadataWriter, type ResponseDescription } from '@solid/community-server';
+/** Writes CSS responses without sending a body for HEAD requests. */
+export declare class HeadSafeResponseWriter extends BasicResponseWriter {
+    constructor(metadataWriter: MetadataWriter);
+    handle(input: {
+        response: HttpResponse;
+        result: ResponseDescription;
+    }): Promise<void>;
+}

package/dist/http/HeadSafeResponseWriter.js

@@ -0,0 +1,22 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HeadSafeResponseWriter = void 0;
+const community_server_1 = require("@solid/community-server");
+/** Writes CSS responses without sending a body for HEAD requests. */
+class HeadSafeResponseWriter extends community_server_1.BasicResponseWriter {
+    constructor(metadataWriter) {
+        super(metadataWriter);
+    }
+    async handle(input) {
+        // Error handlers can generate a body even when the request was HEAD.
+        // Bun's Node HTTP writer streams it, corrupting the proxy's next HTTP frame.
+        if (input.response.req.method === 'HEAD' && input.result.data) {
+            input.result.data.destroy();
+            await super.handle({ ...input, result: { ...input.result, data: undefined } });
+            return;
+        }
+        await super.handle(input);
+    }
+}
+exports.HeadSafeResponseWriter = HeadSafeResponseWriter;
+//# sourceMappingURL=HeadSafeResponseWriter.js.map

package/dist/http/HeadSafeResponseWriter.jsonld

@@ -0,0 +1,39 @@
+{
+  "@context": [
+    "https://linkedsoftwaredependencies.org/bundles/npm/@undefineds.co/xpod/^0.0.0/components/context.jsonld",
+    "https://linkedsoftwaredependencies.org/bundles/npm/@solid/community-server/^8.0.0/components/context.jsonld"
+  ],
+  "@id": "npmd:@undefineds.co/xpod",
+  "components": [
+    {
+      "@id": "undefineds:dist/http/HeadSafeResponseWriter.jsonld#HeadSafeResponseWriter",
+      "@type": "Class",
+      "requireElement": "HeadSafeResponseWriter",
+      "extends": [
+        "css:dist/http/output/BasicResponseWriter.jsonld#BasicResponseWriter"
+      ],
+      "comment": "Writes CSS responses without sending a body for HEAD requests.",
+      "parameters": [
+        {
+          "@id": "undefineds:dist/http/HeadSafeResponseWriter.jsonld#HeadSafeResponseWriter_metadataWriter",
+          "range": "css:dist/http/output/metadata/MetadataWriter.jsonld#MetadataWriter"
+        }
+      ],
+      "memberFields": [
+        {
+          "@id": "undefineds:dist/http/HeadSafeResponseWriter.jsonld#HeadSafeResponseWriter__member_constructor",
+          "memberFieldName": "constructor"
+        },
+        {
+          "@id": "undefineds:dist/http/HeadSafeResponseWriter.jsonld#HeadSafeResponseWriter__member_handle",
+          "memberFieldName": "handle"
+        }
+      ],
+      "constructorArguments": [
+        {
+          "@id": "undefineds:dist/http/HeadSafeResponseWriter.jsonld#HeadSafeResponseWriter_metadataWriter"
+        }
+      ]
+    }
+  ]
+}

package/dist/http/LocalPodDeletionHttpHandler.d.ts

@@ -0,0 +1,21 @@
+import { HttpHandler, type ErrorHandler, type ResponseWriter, type HttpHandlerInput } from '@solid/community-server';
+import type { PodDeletionLifecycleService } from '../service/PodDeletionLifecycleService';
+export interface LocalPodDeletionHttpHandlerOptions {
+    lifecycle: PodDeletionLifecycleService;
+    storageBaseUrl: string;
+    rootFilePath: string;
+    errorHandler: ErrorHandler;
+    responseWriter: ResponseWriter;
+}
+/** Executes only a local root credential or an exact, authenticated Cloud command. */
+export declare class LocalPodDeletionHttpHandler extends HttpHandler {
+    private readonly options;
+    private readonly setupPath;
+    private readonly providerId;
+    private readonly configuredServiceToken?;
+    constructor(options: LocalPodDeletionHttpHandlerOptions);
+    canHandle({ request }: HttpHandlerInput): Promise<void>;
+    handle({ request, response }: HttpHandlerInput): Promise<void>;
+    private execute;
+    private callback;
+}