@undefineds.co/xpod 0.4.20 → 0.4.25

package/dist/api/handlers/AdminHandler.js

@@ -7,11 +7,9 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ALLOWED_ADMIN_CONFIG_KEYS = void 0;
-exports.isAdminSecretEnvKey = isAdminSecretEnvKey;
+exports.sanitizeLogMessage = exports.isAdminSecretEnvKey = exports.ALLOWED_ADMIN_CONFIG_KEYS = void 0;
 exports.sanitizeEnvForRead = sanitizeEnvForRead;
 exports.createAllowedAdminConfigPatch = createAllowedAdminConfigPatch;
-exports.sanitizeLogMessage = sanitizeLogMessage;
 exports.isAdminMutationAllowed = isAdminMutationAllowed;
 exports.createAdminServicesCapabilities = createAdminServicesCapabilities;
 exports.readDurableAdminEnvironment = readDurableAdminEnvironment;
@@ -26,6 +24,8 @@ const fs_2 = require("fs");
 const readline_1 = require("readline");
 const runtime_1 = require("../../runtime");
 const log_file_1 = require("../../logging/log-file");
+const normalize_log_1 = require("../../logging/normalize-log");
+const log_secrets_1 = require("../../logging/log-secrets");
 const TunnelProviderCatalog_1 = require("../../tunnel/TunnelProviderCatalog");
 const TunnelProfiles_1 = require("../../tunnel/TunnelProfiles");
 const GatewayAdminProxyAuth_1 = require("../../runtime/GatewayAdminProxyAuth");
@@ -84,25 +84,13 @@ exports.ALLOWED_ADMIN_CONFIG_KEYS = [
     'CSS_SHOW_STACK_TRACE',
 ];
 const ALLOWED_ADMIN_CONFIG_KEY_SET = new Set(exports.ALLOWED_ADMIN_CONFIG_KEYS);
-function isAdminSecretEnvKey(key) {
-    const normalized = key.toUpperCase();
-    if (normalized.endsWith('_KEY_PATH') || normalized.endsWith('_CERT_PATH')) {
-        return false;
-    }
-    return (normalized.includes('AUTHTOKEN') ||
-        normalized.endsWith('_TOKEN') ||
-        normalized.endsWith('_SECRET') ||
-        normalized.endsWith('_API_KEY') ||
-        normalized.includes('PASSWORD') ||
-        normalized.includes('CLIENT_SECRET') ||
-        normalized.endsWith('_DB_URL') ||
-        normalized.includes('DATABASE_URL'));
-}
+var log_secrets_2 = require("../../logging/log-secrets");
+Object.defineProperty(exports, "isAdminSecretEnvKey", { enumerable: true, get: function () { return log_secrets_2.isSecretEnvKey; } });
 function sanitizeEnvForRead(env) {
     const sanitized = {};
     const secrets = {};
     for (const [key, value] of Object.entries(env)) {
-        if (isAdminSecretEnvKey(key)) {
+        if ((0, log_secrets_1.isSecretEnvKey)(key)) {
             secrets[key] = { configured: Boolean(value) };
             continue;
         }
@@ -116,30 +104,19 @@ function createAllowedAdminConfigPatch(input) {
         if (!ALLOWED_ADMIN_CONFIG_KEY_SET.has(key) && !(0, TunnelProviderCatalog_1.isTunnelProfileCredentialEnvKey)(key)) {
             continue;
         }
-        if (isAdminSecretEnvKey(key) && !value) {
+        if ((0, log_secrets_1.isSecretEnvKey)(key) && !value) {
             continue;
         }
         patch[key] = value;
     }
     return patch;
 }
-function escapeRegExp(value) {
-    return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-}
-function sanitizeLogMessage(message, env) {
-    let sanitized = message;
-    const secretEntries = Object.entries(env)
-        .filter(([key, value]) => isAdminSecretEnvKey(key) && value.length >= 6)
-        .sort((a, b) => b[1].length - a[1].length);
-    for (const [key, value] of secretEntries) {
-        sanitized = sanitized.replace(new RegExp(escapeRegExp(value), 'g'), `[redacted:${key}]`);
-    }
-    return sanitized;
-}
+var log_secrets_3 = require("../../logging/log-secrets");
+Object.defineProperty(exports, "sanitizeLogMessage", { enumerable: true, get: function () { return log_secrets_3.redactConfiguredLogSecrets; } });
 function sanitizeLogEntry(entry, env) {
     return {
         ...entry,
-        message: sanitizeLogMessage(entry.message, env),
+        message: (0, log_secrets_1.redactConfiguredLogSecrets)(entry.message, env),
     };
 }
 function safeTokenEquals(actual, expected) {
@@ -156,6 +133,9 @@ function isAdminMutationAllowed(req, options = {}) {
         safeTokenEquals(providedToken, configuredToken)) {
         return true;
     }
+    if (options.allowLoopback === false) {
+        return false;
+    }
     const peerLoopback = (0, GatewayAdminProxyAuth_1.isLoopbackRemoteAddress)(req.socket?.remoteAddress);
     const proxyMarker = (0, GatewayAdminProxyAuth_1.verifyGatewayAdminProxyHeaders)({
         headers: req.headers,
@@ -164,7 +144,10 @@ function isAdminMutationAllowed(req, options = {}) {
         url: req.url,
     });
     if (proxyMarker.present) {
-        return peerLoopback && proxyMarker.valid && proxyMarker.originalClientLoopback;
+        // Unix peers have no IP address. Only the Gateway's authenticated provenance
+        // can authorize that transport; an unsigned Unix request stays untrusted.
+        const unixPeer = Boolean(req.socket && req.socket.remoteAddress === undefined);
+        return (peerLoopback || unixPeer) && proxyMarker.valid && proxyMarker.originalClientLoopback;
     }
     return peerLoopback;
 }
@@ -529,9 +512,8 @@ function registerAdminRoutes(server, options = {}) {
     function addLog(level, source, message) {
         const entry = {
             timestamp: new Date().toISOString(),
-            level,
             source,
-            message: message.trim(),
+            ...(0, normalize_log_1.normalizeLog)(message, level),
         };
         logBuffer.push(entry);
         if (logBuffer.length > MAX_LOG_BUFFER) {
@@ -541,13 +523,19 @@ function registerAdminRoutes(server, options = {}) {
     // Intercept stdout
     process.stdout.write = (chunk, ...args) => {
         const message = chunk.toString();
-        addLog('info', 'xpod', message);
+        for (const line of message.split('\n')) {
+            if (line.trim())
+                addLog('info', 'api', line);
+        }
         return originalStdoutWrite(chunk, ...args);
     };
     // Intercept stderr
     process.stderr.write = (chunk, ...args) => {
         const message = chunk.toString();
-        addLog('error', 'xpod', message);
+        for (const line of message.split('\n')) {
+            if (line.trim())
+                addLog('error', 'api', line);
+        }
         return originalStderrWrite(chunk, ...args);
     };
     // GET /api/admin/logs - Get recent logs
@@ -637,7 +625,7 @@ function registerAdminRoutes(server, options = {}) {
             const lastLines = fileLogs.slice(-lines);
             sendJson(res, 200, {
                 file: logPath,
-                lines: lastLines.map((line) => sanitizeLogMessage(line, env)),
+                lines: lastLines.map((line) => (0, log_secrets_1.redactConfiguredLogSecrets)(line, env)),
             });
         }
         catch (error) {

package/dist/api/handlers/AiConfigHandler.d.ts

@@ -41,6 +41,14 @@ export type AiConfigPolicyPatch = {
     lifecycle?: Partial<AiConfigPolicy['lifecycle']>;
 };
 export interface AiConfigCapabilities {
+    /** Deployment policy, projected from the same authority that validates assignments. */
+    embeddingModels?: {
+        restricted: boolean;
+        allowed: Array<{
+            provider: string;
+            model: string;
+        }>;
+    };
     textBackends: Array<'fts5' | 'postgres-fts'>;
     vectorBackends: Array<'vec' | 'pgvector'>;
     rebuildSupported: boolean;
@@ -99,5 +107,9 @@ export interface AiConfigHandlerOptions {
      * Cloud runtimes only accept models the ai-gateway catalog provides.
      */
     embeddingModelPolicy?: EmbeddingModelPolicy;
+    embeddingModels?: () => Array<{
+        provider: string;
+        model: string;
+    }>;
 }
 export declare function registerAiConfigRoutes(server: ApiServer, options: AiConfigHandlerOptions): void;

package/dist/api/handlers/AiConfigHandler.js

@@ -19,9 +19,6 @@ function registerAiConfigRoutes(server, options) {
             });
         }
         catch (error) {
-            // A caller whose Pod credential cannot be replayed (a DPoP session) is refused, not
-            // broken: the session retries with its own client credential only when it sees this
-            // stable 403, so reporting it as an internal error would strand the read.
             if ((0, PodAccessFailureResponse_1.sendPodAccessFailure)(response, error))
                 return;
             sendJson(response, 500, { error: 'Failed to read AI Config' });
@@ -89,7 +86,9 @@ function registerAiConfigRoutes(server, options) {
         try {
             sendJson(response, 202, { job: await options.lifecycle.schedule({ ...owner, target }) });
         }
-        catch {
+        catch (error) {
+            if ((0, PodAccessFailureResponse_1.sendPodAccessFailure)(response, error))
+                return;
             sendJson(response, 500, { error: 'Failed to schedule index rebuild' });
         }
     });
@@ -231,7 +230,10 @@ function defaultCapabilities() {
 function resolveCapabilities(options) {
     const capabilities = options.capabilities?.() ?? defaultCapabilities();
     const rebuildTargets = options.lifecycle?.supportedTargets() ?? [];
-    return { ...capabilities, rebuildSupported: rebuildTargets.length > 0, rebuildTargets };
+    return { ...capabilities, rebuildSupported: rebuildTargets.length > 0, rebuildTargets, embeddingModels: {
+            restricted: options.embeddingModelPolicy?.isEnforced() ?? false,
+            allowed: (options.embeddingModels?.() ?? []).filter(model => options.embeddingModelPolicy?.isAllowed(model) ?? true),
+        } };
 }
 function emptyLifecycle(configurationVersion) { return { configurationVersion, pending: 0, recent: [] }; }
 function parseRebuildTarget(value) {

package/dist/api/handlers/AiGatewayHandler.js

@@ -5,6 +5,7 @@ exports.registerAiGatewayRoutes = registerAiGatewayRoutes;
 const global_logger_factory_1 = require("global-logger-factory");
 const readBoundedJsonBody_1 = require("../http/readBoundedJsonBody");
 const errors_1 = require("../ai-gateway/errors");
+const InvocationMetadata_1 = require("../ai-gateway/InvocationMetadata");
 const DEFAULT_JSON_BODY_LIMIT_BYTES = 2 * 1024 * 1024;
 function registerAiGatewayRoutes(server, options) {
     const handler = new AiGatewayHandler(options);
@@ -37,6 +38,7 @@ class AiGatewayHandler {
         const abort = () => controller.abort();
         response.once('close', abort);
         try {
+            const invocationMetadata = (0, InvocationMetadata_1.readGatewayInvocationMetadata)(request.headers, request.rawHeaders);
             const stream = isStreamRequest(bodyResult.value);
             if (!stream) {
                 const result = await this.service.complete({
@@ -44,6 +46,7 @@ class AiGatewayHandler {
                     protocol,
                     body: bodyResult.value,
                     signal: controller.signal,
+                    invocationMetadata,
                 });
                 sendJson(response, 200, result);
                 this.logInference({
@@ -62,6 +65,7 @@ class AiGatewayHandler {
                 protocol,
                 body: bodyResult.value,
                 signal: controller.signal,
+                invocationMetadata,
             });
             const outcome = await this.sendEventStream(response, execution.frontend, execution.events);
             this.logInference({ protocol, model, stream: true, startedAt, ...outcome });

package/dist/api/handlers/AiGatewayManagementHandler.js

@@ -1454,6 +1454,10 @@ function sendModelsError(response, error) {
         return;
     }
     const message = error instanceof Error ? error.message : String(error);
+    if (message === 'provider_request_timeout') {
+        sendJson(response, 504, { error: 'provider_request_timeout' });
+        return;
+    }
     if (message === 'models_credential_not_found') {
         sendJson(response, 404, { error: 'Provider credential not found for current identity' });
         return;
@@ -1634,6 +1638,10 @@ function publicCredentialPoolCredential(value) {
         enabled: record.enabled ?? (record.status ? record.status === 'active' : undefined),
         priority: record.priority ?? numberMetadata(metadata, 'priority'),
         health: record.health ?? stringMetadata(metadata, 'health'),
+        lastFailureCode: record.lastFailureCode,
+        lastFailureAt: record.lastFailureAt,
+        rateLimitResetAt: record.rateLimitResetAt,
+        failCount: record.failCount,
         maskedHint: record.maskedHint ?? stringMetadata(metadata, 'maskedHint'),
         expiresAt: record.expiresAt instanceof Date ? record.expiresAt.toISOString() : record.expiresAt,
         baseUrl: record.baseUrl ?? stringMetadata(metadata, 'baseUrl'),

package/dist/api/handlers/DeviceNotificationRuntime.d.ts

@@ -21,6 +21,6 @@ export interface DeviceNotificationRuntimeHandle {
         ticketEndpoint: string;
         webSocketEndpoint: string;
     };
-    stop(): void;
+    stop(): Promise<void>;
 }
 export declare function registerDeviceNotificationRuntime(server: ApiServer, options: DeviceNotificationRuntimeOptions): DeviceNotificationRuntimeHandle;

package/dist/api/handlers/DeviceNotificationRuntime.js

@@ -48,22 +48,19 @@ function registerDeviceNotificationRuntime(server, options) {
         webSocketServer.handleUpgrade(request, socket, head);
     });
     ObservableResourceStore_1.ObservableResourceStore.addGlobalListener(resourceListener);
-    server.addShutdownHandler(() => {
-        webSocketServer.stop();
+    const stop = () => {
         ticketStore.clear();
         ObservableResourceStore_1.ObservableResourceStore.removeGlobalListener(resourceListener);
-    });
+        return webSocketServer.stop();
+    };
+    server.addShutdownHandler(stop);
     return {
         hub,
         ticketHandler,
         webSocketServer,
         resourceListener,
         descriptor,
-        stop: () => {
-            webSocketServer.stop();
-            ticketStore.clear();
-            ObservableResourceStore_1.ObservableResourceStore.removeGlobalListener(resourceListener);
-        },
+        stop,
     };
 }
 function sendJson(response, status, body) {

package/dist/api/handlers/InngestHandler.d.ts

@@ -7,5 +7,12 @@ export interface InngestHandlerOptions {
     backend: InngestRunExecutionBackend;
     taskScheduler?: InngestTaskScheduler<StoreContext>;
     runtimeConfig?: EmbeddedInngestRuntimeConfig;
+    /**
+     * Shared secret the Gateway uses to sign its internal proxy marker. Required
+     * to keep the spawned dev executor's unsigned callback local: the dev Inngest
+     * SDK skips signature validation, so this route must reject a callback that
+     * the Gateway reports came from a non-loopback (tunnelled/P2P) client.
+     */
+    gatewayAdminProxyAuthSecret?: string;
 }
 export declare function registerInngestRoutes(server: ApiServer, options: InngestHandlerOptions): void;

package/dist/api/handlers/InngestHandler.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.registerInngestRoutes = registerInngestRoutes;
 const node_1 = require("inngest/node");
+const GatewayAdminProxyAuth_1 = require("../../runtime/GatewayAdminProxyAuth");
 function registerInngestRoutes(server, options) {
     if (options.runtimeConfig?.enabled !== true) {
         return;
@@ -18,10 +19,54 @@ function registerInngestRoutes(server, options) {
         serveOrigin: functionEndpoint?.origin,
         servePath: functionEndpoint?.pathname,
     });
+    // A managed executor signs its callbacks, so the SDK itself rejects anything
+    // unsigned or forged. The spawned `inngest dev` executor cannot sign, so the
+    // dev route must prove the caller is local instead; otherwise the public
+    // callback route would let any client that reaches the Gateway execute Runs.
+    const authorizeDevCallback = options.runtimeConfig.mode === 'spawn'
+        ? createDevCallbackAuthorizer(options.gatewayAdminProxyAuthSecret)
+        : undefined;
     const routeHandler = async (req, res) => {
+        if (authorizeDevCallback && !authorizeDevCallback(req, res)) {
+            return;
+        }
         handler(req, res);
     };
     server.all('/api/inngest', routeHandler, { public: true });
     server.all('/api/inngest/*path', routeHandler, { public: true });
 }
+function createDevCallbackAuthorizer(secret) {
+    return (req, res) => {
+        // Trust model mirrors ConfiguredLoopbackDPoPWebIdExtractor.trustedLocalRouteTransport.
+        // A present marker is authoritative: accept it only when the Gateway's HMAC
+        // verifies AND it reports the original client as loopback. The default
+        // non-Windows transport is a Unix domain socket where req.socket.remoteAddress
+        // is undefined, so a legitimate signed local Gateway callback has a marker
+        // but no peer address - requiring both would reject it.
+        const marker = (0, GatewayAdminProxyAuth_1.verifyGatewayAdminProxyHeaders)({
+            headers: req.headers,
+            secret,
+            method: req.method,
+            url: req.url,
+        });
+        if (marker.present) {
+            if (marker.valid && marker.originalClientLoopback) {
+                return true;
+            }
+            return denyDevCallback(res);
+        }
+        // No marker: only a direct TCP loopback caller may be the dev executor.
+        // A non-loopback peer (or a socket with no peer address) is not local.
+        if ((0, GatewayAdminProxyAuth_1.isLoopbackRemoteAddress)(req.socket?.remoteAddress)) {
+            return true;
+        }
+        return denyDevCallback(res);
+    };
+}
+function denyDevCallback(res) {
+    res.statusCode = 403;
+    res.setHeader('Content-Type', 'application/json');
+    res.end(JSON.stringify({ error: 'Inngest dev callback is restricted to the local executor' }));
+    return false;
+}
 //# sourceMappingURL=InngestHandler.js.map

package/dist/api/handlers/NetworkSettingsHandler.d.ts

@@ -1,4 +1,7 @@
 import { getLoggerFor } from 'global-logger-factory';
+import { type EndpointReachabilityResult } from '../network/EndpointReachabilityProbe';
+import { type TunnelClientInspection } from '../../tunnel/TunnelClientManager';
+import type { TunnelProviderId } from '../../tunnel/TunnelProviderCatalog';
 import type { ApiServer } from '../ApiServer';
 import type { AuthContext } from '../auth/AuthContext';
 import { type TunnelProviderDescriptor } from '../../tunnel/TunnelProviderCatalog';
@@ -109,7 +112,15 @@ export interface NetworkDiagnosticCheckResult {
     label: string;
     status: DiagnosticStatus;
     detail?: string;
-    durationMs?: number;
+    /**
+     * How long the check itself took — **not** a network latency (audit N12).
+     *
+     * These checks read local state (is an address configured, what does the TLS/DNS/tunnel
+     * capability say); a duration here says nothing about reachability, so it is named after the
+     * check and consumers must not render it as a round-trip time. A real probe would have to add
+     * its own measurement.
+     */
+    checkDurationMs?: number;
     checkedAt?: string;
 }
 export interface NetworkDiagnosticCheck {
@@ -150,6 +161,25 @@ export interface NetworkPublicAddressReaderOptions {
 }
 export interface NetworkSettingsHandlerOptions {
     endpoint: string | (() => string | undefined);
+    /**
+     * On-demand reachability probe for the declared public entry (audit N12).
+     *
+     * It runs only when the operator triggers a diagnose pass — never on a timer — and defaults to
+     * the public-address-only probe; tests inject a stub.
+     */
+    endpointReachabilityProbe?: (endpoint: string) => Promise<EndpointReachabilityResult>;
+    /**
+     * Tunnel-client plugin actions for the settings page (audit N16): list where each provider's
+     * client would come from, and install one on request. Injectable for tests.
+     */
+    tunnelClients?: {
+        inspectAll: () => Promise<TunnelClientInspection[]>;
+        install: (provider: TunnelProviderId) => Promise<{
+            installedPath: string;
+            version?: string;
+            sourceUrl: string;
+        }>;
+    };
     localAddresses?: () => string[];
     lanAddresses?: () => string[];
     publicAddresses?: () => string[];

package/dist/api/handlers/NetworkSettingsHandler.js

@@ -12,6 +12,8 @@ exports.createCertificateCapability = createCertificateCapability;
 exports.redactSecretText = redactSecretText;
 const node_os_1 = require("node:os");
 const global_logger_factory_1 = require("global-logger-factory");
+const EndpointReachabilityProbe_1 = require("../network/EndpointReachabilityProbe");
+const TunnelClientManager_1 = require("../../tunnel/TunnelClientManager");
 const readBoundedJsonBody_1 = require("../http/readBoundedJsonBody");
 const AdminHandler_1 = require("./AdminHandler");
 const TunnelProviderCatalog_1 = require("../../tunnel/TunnelProviderCatalog");
@@ -66,6 +68,46 @@ function registerNetworkSettingsRoutes(server, options) {
             sendJson(response, 500, { error: 'Failed to run network diagnostics' });
         }
     }, { optionalAuth: true });
+    // The tunnel-client plugin actions live next to the tunnel configuration they serve: one
+    // "check" that says where each client comes from, one "download" that installs it (N16).
+    server.get('/api/network/settings/tunnel-clients', async (request, response) => {
+        if (!await requireNetworkPermission(request, response, authorizer, 'read', options.internalAdminAuthSecret)) {
+            return;
+        }
+        try {
+            const manager = options.tunnelClients ?? new TunnelClientManager_1.TunnelClientManager();
+            sendJson(response, 200, { clients: await manager.inspectAll() });
+        }
+        catch (error) {
+            logger.error(`Failed to inspect tunnel clients: ${redactSecretText(error)}`);
+            sendJson(response, 500, { error: 'Failed to inspect tunnel clients' });
+        }
+    }, { optionalAuth: true });
+    server.post('/api/network/settings/tunnel-clients/:provider/install', async (request, response, params) => {
+        const provider = String(params?.provider ?? '');
+        const known = ['ngrok', 'cloudflare', 'sakura_frp', 'frp'].includes(provider);
+        if (!known) {
+            sendJson(response, 404, { error: `Unknown tunnel provider: ${provider}` });
+            return;
+        }
+        if (!await requireNetworkPermission(request, response, authorizer, 'write', options.internalAdminAuthSecret)) {
+            return;
+        }
+        try {
+            const manager = options.tunnelClients ?? new TunnelClientManager_1.TunnelClientManager();
+            const installed = await manager.install(provider);
+            sendJson(response, 200, {
+                installed,
+                clients: await manager.inspectAll(),
+            });
+        }
+        catch (error) {
+            // A refused download is a normal answer (no pinned asset), not a server fault.
+            const message = redactSecretText(error);
+            logger.warn(`Tunnel client install refused for ${provider}: ${message}`);
+            sendJson(response, 400, { error: message });
+        }
+    }, { optionalAuth: true });
     if (options.certificateRenewer) {
         server.post('/api/network/settings/certificate/renew', async (request, response) => {
             if (!await requireNetworkPermission(request, response, authorizer, 'write', options.internalAdminAuthSecret)) {
@@ -344,6 +386,28 @@ function buildDefaultDiagnostics(options, logger) {
                     : { status: 'unsupported', detail: 'endpoint_unavailable' };
             },
         },
+        {
+            // Only runs because the operator asked for a diagnose pass; it never polls. The verdict
+            // is deliberately "from this node": a node reaching its own public entry says nothing
+            // about a remote user's path (NAT hairpin), so the wording keeps that distinction.
+            id: 'endpoint-reachability',
+            label: 'Endpoint reachability from this node',
+            run: async () => {
+                const endpoint = normalizeEndpoint(resolveValue(options.endpoint));
+                if (!endpoint) {
+                    return { status: 'unsupported', detail: 'endpoint_unavailable' };
+                }
+                const probe = options.endpointReachabilityProbe ?? EndpointReachabilityProbe_1.probeEndpointReachability;
+                const result = await probe(endpoint);
+                if (result.verdict === 'reachable-from-this-node') {
+                    return { status: 'ok', detail: result.detail };
+                }
+                if (result.verdict === 'blocked') {
+                    return { status: 'unsupported', detail: result.detail };
+                }
+                return { status: 'warning', detail: result.detail };
+            },
+        },
         {
             id: 'tls',
             label: 'TLS',
@@ -363,7 +427,7 @@ function buildDefaultDiagnostics(options, logger) {
 }
 async function runDiagnostic(check, logger) {
     const startedAt = Date.now();
-    const evidence = () => ({ durationMs: Math.max(0, Date.now() - startedAt), checkedAt: new Date().toISOString() });
+    const evidence = () => ({ checkDurationMs: Math.max(0, Date.now() - startedAt), checkedAt: new Date().toISOString() });
     try {
         const result = await check.run();
         if (typeof result === 'string') {
@@ -382,14 +446,23 @@ async function runDiagnostic(check, logger) {
         return { id: check.id, label: check.label, status: 'error', detail: redactSecretText(error), ...evidence() };
     }
 }
+/**
+ * Maps a provider capability onto a diagnostic level.
+ *
+ * Only statuses that positively mean "verified" become `ok`, and known-bad ones become `error`
+ * (an invalid or expired certificate is a failure, not something to warn about). Anything else
+ * stays a warning: a status we cannot place must never be rendered as a pass (audit N12).
+ */
+const VERIFIED_CAPABILITY_STATUSES = new Set(['active', 'valid', 'synced', 'direct', 'ready']);
+const FAILED_CAPABILITY_STATUSES = new Set(['error', 'invalid', 'failed', 'expired', 'untrusted', 'mismatch']);
 function capabilityToDiagnostic(capability) {
     if (!capability.supported) {
         return { status: 'unsupported', detail: capability.status };
     }
-    if (capability.status === 'active' || capability.status === 'valid' || capability.status === 'synced' || capability.status === 'direct') {
+    if (VERIFIED_CAPABILITY_STATUSES.has(capability.status)) {
         return { status: 'ok', detail: capability.status };
     }
-    if (capability.status === 'error') {
+    if (FAILED_CAPABILITY_STATUSES.has(capability.status)) {
         return { status: 'error', detail: capability.status };
     }
     return { status: 'warning', detail: capability.status };

package/dist/api/handlers/PodAccessFailureResponse.d.ts

@@ -1,4 +1,5 @@
 import type { ServerResponse } from 'node:http';
+import type { RouteHandler } from '../ApiServer';
 /** The wire code callers already report when Xpod cannot open the Pod for them. */
 export declare const SERVICE_ACCESS_MISSING = "service_access_missing";
 export interface PodAccessFailureResponse {
@@ -20,4 +21,4 @@ export declare function sendPodAccessFailure(response: ServerResponse, error: un
  *
  * Anything else keeps propagating, so unrelated bugs are not reported as missing Pod access.
  */
-export declare function guardPodAccessRoute<T extends (...args: any[]) => Promise<unknown>>(handler: T): T;
+export declare function guardPodAccessRoute(handler: RouteHandler): RouteHandler;

package/dist/api/handlers/PodAccessFailureResponse.js

@@ -45,16 +45,15 @@ function sendPodAccessFailure(response, error) {
  * Anything else keeps propagating, so unrelated bugs are not reported as missing Pod access.
  */
 function guardPodAccessRoute(handler) {
-    return (async (...args) => {
+    return async (request, response, params) => {
         try {
-            await handler(...args);
+            await handler(request, response, params);
         }
         catch (error) {
-            const response = args[1];
-            if (!response || !sendPodAccessFailure(response, error)) {
+            if (!sendPodAccessFailure(response, error)) {
                 throw error;
             }
         }
-    });
+    };
 }
 //# sourceMappingURL=PodAccessFailureResponse.js.map

package/dist/api/handlers/PodDeletionGrantHandler.d.ts

@@ -0,0 +1,9 @@
+import type { PodLookupRepository } from '../../identity/drizzle/PodLookupRepository';
+import type { EdgeNodeRepository } from '../../identity/drizzle/EdgeNodeRepository';
+import type { ApiServer } from '../ApiServer';
+import type { NodeTokenAuthenticator } from '../auth/NodeTokenAuthenticator';
+import type { PodDeletionOperationRepository } from '../../identity/drizzle/PodDeletionOperationRepository';
+export declare function registerPodDeletionGrantRoutes(server: ApiServer, operations: PodDeletionOperationRepository, authenticator: NodeTokenAuthenticator, authorization?: {
+    pods: PodLookupRepository;
+    nodes: EdgeNodeRepository;
+}): void;