@undefineds.co/xpod 0.4.20 → 0.4.27

package/dist/index.js

@@ -14,10 +14,12 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.isPublicIpAddress = exports.createPinnedHeadProbeRequest = exports.assertPublicProbeTarget = exports.EdgeNodeHealthProbeService = exports.FrpTunnelManager = exports.NoopEdgeNodeTunnelManager = exports.SimpleEdgeNodeTunnelManager = exports.Dns01CertificateProvisioner = exports.EdgeNodeDnsCoordinator = exports.TencentDnsProvider = exports.PerAccountQuotaStrategy = exports.NoopEntitlementProvider = exports.HttpEntitlementProvider = exports.NoopQuotaService = exports.DrizzleQuotaService = exports.BaseKeyValueStorage = exports.SqliteKeyValueStorage = exports.RedisKeyValueStorage = exports.PostgresKeyValueStorage = exports.ValidatingIdentityProviderHttpHandler = exports.LoginMethodGuardStorage = exports.DrizzleIndexedStorage = exports.ReservedSuffixIdentifierGenerator = exports.registerDeviceNotificationRuntime = exports.DeviceNotificationTicketHandler = exports.DeviceNotificationWebSocketServer = exports.DeviceNotificationResourceListener = exports.DeviceNotificationHub = exports.TerminalHttpHandler = exports.EdgeNodeCertificateHttpHandler = exports.TracingHandler = exports.RouterHttpRoute = exports.RouterHttpHandler = exports.EdgeNodeProxyHttpHandler = exports.EdgeNodeDirectDebugHttpHandler = exports.ClusterWebSocketConfigurator = exports.ClusterIngressRouter = exports.QuotaAdminHttpHandler = exports.SubgraphSparqlHttpHandler = exports.SubgraphQueryEngine = exports.SparqlUpdateResourceStore = exports.LOG_FILE_PATTERN = exports.resolveCurrentLogFile = exports.resolveLogFilePattern = exports.ConfigurableLoggerFactory = exports.MixDataAccessor = exports.SolidRdfDataAccessor = exports.MinioDataAccessor = exports.RepresentationPartialConvertingStore = exports.AppStaticAssetHandler = void 0;
-exports.RememberedClientPromptFactory = exports.RememberedConsentHandler = exports.RememberedClientGrantStore = exports.LoopbackClientIdAdapterFactory = exports.AutoDetectIdentityProviderHandler = exports.AutoDetectOidcHandler = exports.DisabledIdentityProviderHandler = exports.DisabledOidcHandler = exports.SubdomainPodIdentifierStrategy = exports.MultiDomainIdentifierStrategy = exports.SubdomainService = exports.NgrokTunnelProvider = exports.LocalTunnelProvider = exports.CloudflareTunnelProvider = exports.CredentialReaderImpl = exports.CredentialReader = exports.EmbeddingServiceImpl = exports.EmbeddingService = exports.ProviderRegistryImpl = exports.ProviderRegistry = exports.VectorHttpHandler = exports.PostgresVectorStore = exports.SqliteVectorStore = exports.VectorStore = exports.PostgresRdfEngine = exports.RdfQuerySparqlEngine = exports.QleverSparqlEngine = exports.LocalQleverNativeSparqlClient = exports.SolidRdfEngine = exports.PostgresRdfVectorIndex = exports.PostgresRdfTextIndex = exports.RdfVectorIndex = exports.RdfTextIndex = exports.Rdf3xIndex = exports.RdfQuadIndex = exports.RdfTermDictionary = exports.PgQuintStore = exports.SqliteQuintStore = exports.QuintStore = exports.ReactAppViewHandler = exports.PodRoutingHttpHandler = exports.CenterNodeRegistrationService = exports.UsageTrackingStore = exports.ClusterIdentifierStrategy = exports.EdgeNodeModeDetector = exports.AcmeCertificateManager = exports.EdgeNodeCertificateService = exports.EdgeNodeAgentInitializer = exports.EdgeNodeAgent = exports.createPodOwnershipNodeAccessResolver = void 0;
-exports.RdfHandlebarsTemplateEngine = exports.RdfSearchReconciliationIntentSink = exports.ObservableResourceStore = exports.LocalRdfAuthorityRecoveryInitializer = exports.RootedSolidFsSyncJournal = exports.SqliteSolidFsSyncJournal = exports.LocalPodProvisioningService = exports.ProvisionCodeCodec = exports.ProvisionPodStore = exports.ProvisionPodCreator = exports.UrlAwareRedisLocker = exports.CssPodOwnershipResolver = exports.AccountStorageBindingsHandler = exports.ConfiguredLoopbackDPoPWebIdExtractor = exports.ScopedPickWebIdHandler = exports.SessionBoundIdentityProviderFactory = void 0;
+exports.SimpleEdgeNodeTunnelManager = exports.Dns01CertificateProvisioner = exports.EdgeNodeDnsCoordinator = exports.TencentDnsProvider = exports.PerAccountQuotaStrategy = exports.NoopEntitlementProvider = exports.HttpEntitlementProvider = exports.NoopQuotaService = exports.DrizzleQuotaService = exports.BaseKeyValueStorage = exports.SqliteKeyValueStorage = exports.RedisKeyValueStorage = exports.PostgresKeyValueStorage = exports.ValidatingIdentityProviderHttpHandler = exports.LoginMethodGuardStorage = exports.DrizzleIndexedStorage = exports.ReservedSuffixIdentifierGenerator = exports.registerDeviceNotificationRuntime = exports.DeviceNotificationTicketHandler = exports.DeviceNotificationWebSocketServer = exports.DeviceNotificationResourceListener = exports.DeviceNotificationHub = exports.TerminalHttpHandler = exports.EdgeNodeCertificateHttpHandler = exports.TracingHandler = exports.RouterHttpRoute = exports.RouterHttpHandler = exports.EdgeNodeProxyHttpHandler = exports.EdgeNodeDirectDebugHttpHandler = exports.ClusterWebSocketConfigurator = exports.ClusterIngressRouter = exports.QuotaAdminHttpHandler = exports.AgentDirectoryHttpHandler = exports.SubgraphSparqlHttpHandler = exports.SubgraphQueryEngine = exports.HeadSafeResponseWriter = exports.StoragePutOperationHandler = exports.StorageETagHandler = exports.HierarchyLockingResourceStore = exports.SparqlUpdateResourceStore = exports.LOG_FILE_PATTERN = exports.resolveCurrentLogFile = exports.resolveLogFilePattern = exports.ConfigurableLoggerFactory = exports.MixDataAccessor = exports.SolidRdfDataAccessor = exports.MinioDataAccessor = exports.RepresentationPartialConvertingStore = exports.AppStaticAssetHandler = exports.LocalPodDeletionHttpHandler = void 0;
+exports.DisabledIdentityProviderHandler = exports.DisabledOidcHandler = exports.SubdomainPodIdentifierStrategy = exports.MultiDomainIdentifierStrategy = exports.SubdomainService = exports.NgrokTunnelProvider = exports.LocalTunnelProvider = exports.CloudflareTunnelProvider = exports.CredentialReaderImpl = exports.CredentialReader = exports.EmbeddingServiceImpl = exports.EmbeddingService = exports.ProviderRegistryImpl = exports.ProviderRegistry = exports.VectorHttpHandler = exports.PostgresVectorStore = exports.SqliteVectorStore = exports.VectorStore = exports.PostgresRdfEngine = exports.RdfQuerySparqlEngine = exports.QleverSparqlEngine = exports.LocalQleverNativeSparqlClient = exports.SolidRdfEngine = exports.PostgresRdfVectorIndex = exports.PostgresRdfTextIndex = exports.RdfVectorIndex = exports.RdfTextIndex = exports.Rdf3xIndex = exports.RdfQuadIndex = exports.RdfTermDictionary = exports.PgQuintStore = exports.SqliteQuintStore = exports.QuintStore = exports.ReactAppViewHandler = exports.PodRoutingHttpHandler = exports.CenterNodeRegistrationService = exports.UsageTrackingStore = exports.ClusterIdentifierStrategy = exports.EdgeNodeModeDetector = exports.AcmeCertificateManager = exports.EdgeNodeCertificateService = exports.EdgeNodeAgentInitializer = exports.EdgeNodeAgent = exports.createPodOwnershipNodeAccessResolver = exports.isPublicIpAddress = exports.createPinnedHeadProbeRequest = exports.assertPublicProbeTarget = exports.EdgeNodeHealthProbeService = exports.FrpTunnelManager = exports.NoopEdgeNodeTunnelManager = void 0;
+exports.CloudProfilePreparationHandler = exports.CloudProfileCreator = exports.RdfHandlebarsTemplateEngine = exports.RdfSearchReconciliationIntentSink = exports.ObservableResourceStore = exports.LocalRdfAuthorityRecoveryInitializer = exports.RootedSolidFsSyncJournal = exports.SqliteSolidFsSyncJournal = exports.LocalPodProvisioningService = exports.ProvisionCodeCodec = exports.ProvisionPodStore = exports.ProvisionPodCreator = exports.UrlAwareRedisLocker = exports.CssPodOwnershipResolver = exports.AccountStorageBindingsHandler = exports.ConfiguredLoopbackDPoPWebIdExtractor = exports.ScopedPickWebIdHandler = exports.SessionBoundIdentityProviderFactory = exports.RememberedClientPromptFactory = exports.RememberedConsentHandler = exports.RememberedClientGrantStore = exports.LoopbackClientIdAdapterFactory = exports.AutoDetectIdentityProviderHandler = exports.AutoDetectOidcHandler = void 0;
 require("./runtime/configure-drizzle-solid");
+var LocalPodDeletionHttpHandler_1 = require("./http/LocalPodDeletionHttpHandler");
+Object.defineProperty(exports, "LocalPodDeletionHttpHandler", { enumerable: true, get: function () { return LocalPodDeletionHttpHandler_1.LocalPodDeletionHttpHandler; } });
 const RepresentationPartialConvertingStore_1 = require("./storage/RepresentationPartialConvertingStore");
 Object.defineProperty(exports, "RepresentationPartialConvertingStore", { enumerable: true, get: function () { return RepresentationPartialConvertingStore_1.RepresentationPartialConvertingStore; } });
 const MinioDataAccessor_1 = require("./storage/accessors/MinioDataAccessor");
@@ -35,12 +37,23 @@ Object.defineProperty(exports, "resolveLogFilePattern", { enumerable: true, get:
 const SubgraphQueryEngine_1 = require("./storage/sparql/SubgraphQueryEngine");
 Object.defineProperty(exports, "SubgraphQueryEngine", { enumerable: true, get: function () { return SubgraphQueryEngine_1.SubgraphQueryEngine; } });
 __exportStar(require("./document"), exports);
+__exportStar(require("./agent-directory/protocol"), exports);
 const SubgraphSparqlHttpHandler_1 = require("./http/SubgraphSparqlHttpHandler");
 Object.defineProperty(exports, "SubgraphSparqlHttpHandler", { enumerable: true, get: function () { return SubgraphSparqlHttpHandler_1.SubgraphSparqlHttpHandler; } });
+const AgentDirectoryHttpHandler_1 = require("./http/agent-directory/AgentDirectoryHttpHandler");
+Object.defineProperty(exports, "AgentDirectoryHttpHandler", { enumerable: true, get: function () { return AgentDirectoryHttpHandler_1.AgentDirectoryHttpHandler; } });
 const QuotaAdminHttpHandler_1 = require("./http/quota/QuotaAdminHttpHandler");
 Object.defineProperty(exports, "QuotaAdminHttpHandler", { enumerable: true, get: function () { return QuotaAdminHttpHandler_1.QuotaAdminHttpHandler; } });
 const SparqlUpdateResourceStore_1 = require("./storage/SparqlUpdateResourceStore");
 Object.defineProperty(exports, "SparqlUpdateResourceStore", { enumerable: true, get: function () { return SparqlUpdateResourceStore_1.SparqlUpdateResourceStore; } });
+const HierarchyLockingResourceStore_1 = require("./storage/HierarchyLockingResourceStore");
+Object.defineProperty(exports, "HierarchyLockingResourceStore", { enumerable: true, get: function () { return HierarchyLockingResourceStore_1.HierarchyLockingResourceStore; } });
+const StorageETagHandler_1 = require("./storage/conditions/StorageETagHandler");
+Object.defineProperty(exports, "StorageETagHandler", { enumerable: true, get: function () { return StorageETagHandler_1.StorageETagHandler; } });
+const StoragePutOperationHandler_1 = require("./http/StoragePutOperationHandler");
+Object.defineProperty(exports, "StoragePutOperationHandler", { enumerable: true, get: function () { return StoragePutOperationHandler_1.StoragePutOperationHandler; } });
+const HeadSafeResponseWriter_1 = require("./http/HeadSafeResponseWriter");
+Object.defineProperty(exports, "HeadSafeResponseWriter", { enumerable: true, get: function () { return HeadSafeResponseWriter_1.HeadSafeResponseWriter; } });
 const ClusterIngressRouter_1 = require("./http/ClusterIngressRouter");
 Object.defineProperty(exports, "ClusterIngressRouter", { enumerable: true, get: function () { return ClusterIngressRouter_1.ClusterIngressRouter; } });
 const ClusterWebSocketConfigurator_1 = require("./http/ClusterWebSocketConfigurator");
@@ -251,4 +264,16 @@ var AppStaticAssetHandler_1 = require("./http/AppStaticAssetHandler");
 Object.defineProperty(exports, "AppStaticAssetHandler", { enumerable: true, get: function () { return AppStaticAssetHandler_1.AppStaticAssetHandler; } });
 var RdfHandlebarsTemplateEngine_1 = require("./util/templates/RdfHandlebarsTemplateEngine");
 Object.defineProperty(exports, "RdfHandlebarsTemplateEngine", { enumerable: true, get: function () { return RdfHandlebarsTemplateEngine_1.RdfHandlebarsTemplateEngine; } });
+__exportStar(require("./identity/PodDeletionInteractionHandler"), exports);
+__exportStar(require("./identity/PodDeletionInventoryHandler"), exports);
+__exportStar(require("./service/PodDeletionLifecycleService"), exports);
+__exportStar(require("./service/PodDataDeletionService"), exports);
+__exportStar(require("./http/PodDeletionMutationGuard"), exports);
+__exportStar(require("./http/PodMutationLockingHttpHandler"), exports);
+__exportStar(require("./storage/locking/PodLifecycleLocker"), exports);
+__exportStar(require("./storage/locking/PodLifecycleRedisLocker"), exports);
+var CloudProfileCreator_1 = require("./provision/CloudProfileCreator");
+Object.defineProperty(exports, "CloudProfileCreator", { enumerable: true, get: function () { return CloudProfileCreator_1.CloudProfileCreator; } });
+var CloudProfilePreparationHandler_1 = require("./identity/CloudProfilePreparationHandler");
+Object.defineProperty(exports, "CloudProfilePreparationHandler", { enumerable: true, get: function () { return CloudProfilePreparationHandler_1.CloudProfilePreparationHandler; } });
 //# sourceMappingURL=index.js.map

package/dist/logging/log-secrets.d.ts

@@ -0,0 +1,2 @@
+export declare function isSecretEnvKey(key: string): boolean;
+export declare function redactConfiguredLogSecrets(message: string, env: Record<string, string | undefined>): string;

package/dist/logging/log-secrets.js

@@ -0,0 +1,35 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isSecretEnvKey = isSecretEnvKey;
+exports.redactConfiguredLogSecrets = redactConfiguredLogSecrets;
+function isSecretEnvKey(key) {
+    const normalized = key.toUpperCase();
+    if (normalized.endsWith('_KEY_PATH') || normalized.endsWith('_CERT_PATH')) {
+        return false;
+    }
+    return (normalized.includes('AUTHTOKEN') ||
+        normalized.endsWith('_TOKEN') ||
+        normalized.endsWith('_SECRET') ||
+        normalized.endsWith('_API_KEY') ||
+        normalized.includes('PASSWORD') ||
+        normalized.includes('CLIENT_SECRET') ||
+        normalized.endsWith('_DB_URL') ||
+        normalized.includes('DATABASE_URL'));
+}
+function escapeRegExp(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+function redactConfiguredLogSecrets(message, env) {
+    let sanitized = message;
+    const secretEntries = Object.entries(env)
+        .filter((entry) => {
+        const [key, value] = entry;
+        return isSecretEnvKey(key) && typeof value === 'string' && value.length >= 6;
+    })
+        .sort((a, b) => b[1].length - a[1].length);
+    for (const [key, value] of secretEntries) {
+        sanitized = sanitized.replace(new RegExp(escapeRegExp(value), 'g'), `[redacted:${key}]`);
+    }
+    return sanitized;
+}
+//# sourceMappingURL=log-secrets.js.map

package/dist/logging/normalize-log.d.ts

@@ -0,0 +1,5 @@
+export type LogLevel = 'debug' | 'info' | 'warn' | 'error';
+export declare function normalizeLog(message: string, fallbackLevel: LogLevel): {
+    message: string;
+    level: LogLevel;
+};

package/dist/logging/normalize-log.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.normalizeLog = normalizeLog;
+const node_util_1 = require("node:util");
+/** CSS/Winston and Components.js headers; message text must never determine its source. */
+const LOGGER_HEADER = /^\d{4}-\d{2}-\d{2}[T ]\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:?\d{2})?\s+(?:\[[^\]\r\n]+\]\s+)+(debug|info|warn|error):(?:\s|$)/u;
+function normalizeLog(message, fallbackLevel) {
+    const plain = (0, node_util_1.stripVTControlCharacters)(message).trim();
+    const level = LOGGER_HEADER.exec(plain)?.[1];
+    return { message: plain, level: level ?? fallbackLevel };
+}
+//# sourceMappingURL=normalize-log.js.map

package/dist/main.js

@@ -4,6 +4,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+const ensureSupportedBun_1 = require("./runtime/compat/ensureSupportedBun");
 require("./runtime/configure-drizzle-solid");
 const crypto_1 = require("crypto");
 const child_process_1 = require("child_process");
@@ -480,6 +481,7 @@ async function commandStop(envPath, timeoutMs = 10000, asJson = false) {
     process.exit(EXIT_INTERNAL_ERROR);
 }
 async function main() {
+    (0, ensureSupportedBun_1.ensureSupportedBun)();
     const rawArgs = (0, helpers_1.hideBin)(process.argv);
     const commandMode = ['run', 'status', 'health', 'stop'].includes(rawArgs[0] ?? '');
     if (!commandMode) {

package/dist/pods/ReservedSuffixIdentifierGenerator.js

@@ -4,12 +4,13 @@ exports.ReservedSuffixIdentifierGenerator = void 0;
 const community_server_1 = require("@solid/community-server");
 const BadRequestHttpError_1 = require("@solid/community-server/dist/util/errors/BadRequestHttpError");
 const StringUtil_1 = require("@solid/community-server/dist/util/StringUtil");
+const ClusterIdentifierStrategy_1 = require("../util/identifiers/ClusterIdentifierStrategy");
 const DEFAULT_RESERVED = ['admin', 'quota', 'signal'];
 class ReservedSuffixIdentifierGenerator {
     constructor(options) {
         const { baseUrl, reserved } = options;
         this.inner = new community_server_1.SuffixIdentifierGenerator(baseUrl);
-        this.reserved = new Set((reserved ?? DEFAULT_RESERVED).map((value) => (0, StringUtil_1.sanitizeUrlPart)(value).toLowerCase()));
+        this.reserved = new Set([...ClusterIdentifierStrategy_1.SERVER_ROOT_SEGMENTS, ...(reserved ?? DEFAULT_RESERVED)].map((value) => (0, StringUtil_1.sanitizeUrlPart)(value).toLowerCase()));
     }
     generate(name) {
         const cleanName = (0, StringUtil_1.sanitizeUrlPart)(name);

package/dist/provision/CloudProfileCreator.d.ts

@@ -0,0 +1,35 @@
+import { type AccountLoginStorage, type IdentifierGenerator, type ReadWriteLocker, type ResourcesGenerator, type ResourceIdentifier, type ResourceStore, type WebIdStore } from '@solid/community-server';
+export interface CloudProfileCreatorOptions {
+    baseUrl: string;
+    /** Existing runtime issuer: an externally managed Local must prepare at Cloud. */
+    oidcIssuer?: string;
+    identifierGenerator: IdentifierGenerator;
+    resourcesGenerator: ResourcesGenerator;
+    resourceStore: ResourceStore;
+    webIdStore: WebIdStore;
+    accountStorage: AccountLoginStorage<Record<string, never>>;
+    resourceLocker: ReadWriteLocker;
+}
+export interface PreparedCloudProfile {
+    webId: string;
+    webIdLink: string;
+}
+export declare class CloudProfileCreator {
+    private readonly options;
+    private readonly logger;
+    private readonly root;
+    private readonly ownsIssuer;
+    private readonly eTags;
+    private readonly patchParser;
+    constructor(options: CloudProfileCreatorOptions);
+    prepare(accountId: string, podName: string): Promise<PreparedCloudProfile>;
+    finalizeStorageBinding(accountId: string, webId: string, storageUrl: string): Promise<void>;
+    /** Native Cloud Pod creation must hold this same lock for its whole check/generate sequence. */
+    withNamespaceLock<T>(base: ResourceIdentifier, action: () => Promise<T>): Promise<T>;
+    private assertIssuer;
+    private cardIdentifier;
+    private assertAccount;
+    private findUniqueLink;
+    private generateCard;
+    private writeNew;
+}

package/dist/provision/CloudProfileCreator.js

@@ -0,0 +1,229 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CloudProfileCreator = void 0;
+const community_server_1 = require("@solid/community-server");
+const LoginStorage_1 = require("@solid/community-server/dist/identity/interaction/account/util/LoginStorage");
+const BaseWebIdStore_1 = require("@solid/community-server/dist/identity/interaction/webid/util/BaseWebIdStore");
+const global_logger_factory_1 = require("global-logger-factory");
+const n3_1 = require("n3");
+class CloudProfileCreator {
+    constructor(options) {
+        this.options = options;
+        this.logger = (0, global_logger_factory_1.getLoggerFor)(this);
+        this.eTags = new community_server_1.BasicETagHandler();
+        this.patchParser = new community_server_1.SparqlUpdateBodyParser();
+        this.root = canonicalRoot(options.baseUrl);
+        this.ownsIssuer = !options.oidcIssuer || canonicalRoot(options.oidcIssuer).href === this.root.href;
+    }
+    async prepare(accountId, podName) {
+        this.assertIssuer();
+        if (!podName || podName.trim() !== podName) {
+            throw new community_server_1.BadRequestHttpError('A profile name is required.');
+        }
+        const base = this.options.identifierGenerator.generate(podName);
+        if (canonicalRoot(base.path).href !== base.path)
+            throw new community_server_1.BadRequestHttpError('Invalid Cloud profile identifier.');
+        const webId = new URL('profile/card#me', base.path).href;
+        const card = this.cardIdentifier(webId);
+        return this.withNamespaceLock(base, async () => {
+            await this.assertAccount(accountId);
+            const link = await this.findUniqueLink(accountId, webId);
+            if (await this.options.resourceStore.hasResource(card)) {
+                if (!link)
+                    throw new community_server_1.ConflictHttpError('The Cloud profile name is already occupied.');
+                // Existing Cloud storage profiles keep all their original resources and permissions.
+                return { webId, webIdLink: link.id };
+            }
+            if (link || await this.options.resourceStore.hasResource(base)) {
+                throw new community_server_1.ConflictHttpError('The Cloud profile namespace is already occupied.');
+            }
+            const generated = await this.generateCard(base, webId, podName);
+            const created = [];
+            try {
+                // These are ordinary LDP containers, never pim:Storage or Account Pod entries.
+                await this.writeNew(base, new community_server_1.BasicRepresentation([], base), created);
+                const parentAuthorization = { path: `${base.path}.${generated.mode}` };
+                const deny = generated.mode === 'acl' ? [] : [
+                    n3_1.DataFactory.quad(n3_1.DataFactory.namedNode(parentAuthorization.path), n3_1.DataFactory.namedNode(RDF_TYPE), n3_1.DataFactory.namedNode(`${ACP}AccessControlResource`)),
+                    n3_1.DataFactory.quad(n3_1.DataFactory.namedNode(parentAuthorization.path), n3_1.DataFactory.namedNode(`${ACP}resource`), n3_1.DataFactory.namedNode(base.path)),
+                ];
+                await this.writeNew(parentAuthorization, new community_server_1.BasicRepresentation(serialize(deny), parentAuthorization, 'text/turtle'), created);
+                const profileContainer = { path: new URL('profile/', base.path).href };
+                await this.writeNew(profileContainer, new community_server_1.BasicRepresentation([], profileContainer), created);
+                await this.writeNew(card, new community_server_1.BasicRepresentation(serialize(generated.card), card, 'text/turtle'), created);
+                const authorization = { path: `${card.path}.${generated.mode}` };
+                await this.writeNew(authorization, new community_server_1.BasicRepresentation(serialize(generated.authorization), authorization, 'text/turtle'), created);
+                const webIdLink = await this.options.webIdStore.create(webId, accountId);
+                return { webId, webIdLink };
+            }
+            catch (error) {
+                // Only resources in this new, locked namespace can be removed. Never touch an existing Pod.
+                for (const identifier of created.reverse()) {
+                    try {
+                        await this.options.resourceStore.deleteResource(identifier);
+                    }
+                    catch (cleanupError) {
+                        if (!community_server_1.NotFoundHttpError.isInstance(cleanupError)) {
+                            this.logger.warn('Cloud profile preparation cleanup failed.');
+                        }
+                    }
+                }
+                throw error;
+            }
+        });
+    }
+    async finalizeStorageBinding(accountId, webId, storageUrl) {
+        this.assertIssuer();
+        const card = this.cardIdentifier(webId);
+        const storage = canonicalRoot(storageUrl).href;
+        if (storage !== storageUrl)
+            throw new community_server_1.BadRequestHttpError('The storage URL must be canonical.');
+        await this.withNamespaceLock({ path: new URL('../', card.path).href }, async () => {
+            await this.assertAccount(accountId);
+            if (!await this.findUniqueLink(accountId, webId)) {
+                throw new community_server_1.ForbiddenHttpError('The Cloud profile does not belong to this Account.');
+            }
+            const representation = await this.options.resourceStore.getRepresentation(card, { type: { 'text/turtle': 1 } });
+            const quads = new n3_1.Parser({ baseIRI: card.path }).parse(await (0, community_server_1.readableToString)(representation.data));
+            const storageValues = new Set([storage]);
+            for (const quad of quads) {
+                if (quad.subject.value === webId && STORAGE_PREDICATES.includes(quad.predicate.value) && quad.object.termType === 'NamedNode') {
+                    storageValues.add(quad.object.value);
+                }
+            }
+            const additions = STORAGE_PREDICATES.flatMap((predicate) => [...storageValues].map((value) => n3_1.DataFactory.quad(n3_1.DataFactory.namedNode(webId), n3_1.DataFactory.namedNode(predicate), n3_1.DataFactory.namedNode(value))));
+            // CSS ETags are second-granular. A whole-document PUT can overwrite an owner edit in
+            // that same second even with If-Match. Add only discovery triples under the native
+            // ResourceStore patch lock; neither owner RDF nor another Pod is ever replaced.
+            const update = `INSERT DATA {\n${serialize(additions)}\n}`;
+            const metadata = new community_server_1.BasicRepresentation('', card, 'application/sparql-update').metadata;
+            const patch = await this.patchParser.handleSafe({
+                // The installed parser consumes only the body stream. This is an internal patch;
+                // no HTTP request or network transport is created.
+                request: (0, community_server_1.guardedStreamFrom)(update),
+                metadata,
+            });
+            await this.options.resourceStore.modifyResource(card, patch, new community_server_1.BasicConditions(this.eTags, { matchesETag: ['*'] }));
+        });
+    }
+    /** Native Cloud Pod creation must hold this same lock for its whole check/generate sequence. */
+    async withNamespaceLock(base, action) {
+        if (!this.ownsIssuer)
+            return action();
+        const namespace = canonicalRoot(base.path);
+        if (namespace.href !== base.path)
+            throw new community_server_1.BadRequestHttpError('Invalid Cloud profile namespace.');
+        // Existing native storage may use another accepted host. It cannot collide with this
+        // issuer's identity namespace and keeps its original creation behavior.
+        if (namespace.origin !== this.root.origin || !namespace.pathname.startsWith(this.root.pathname))
+            return action();
+        // A separate key avoids reacquiring the ResourceStore's canonical lock inside an operation.
+        return this.options.resourceLocker.withWriteLock({ path: `${base.path}#xpod-cloud-profile` }, action);
+    }
+    assertIssuer() {
+        if (!this.ownsIssuer)
+            throw new community_server_1.ForbiddenHttpError('Prepare the identity profile at the Account issuer.');
+    }
+    cardIdentifier(webId) {
+        let url;
+        try {
+            url = new URL(webId);
+        }
+        catch {
+            throw new community_server_1.BadRequestHttpError('Invalid Cloud WebID.');
+        }
+        const relative = url.pathname.slice(this.root.pathname.length);
+        if (url.href !== webId || url.origin !== this.root.origin || !url.pathname.startsWith(this.root.pathname) ||
+            url.username || url.password || url.search || url.hash !== '#me' || !/^[^/]+\/profile\/card$/u.test(relative)) {
+            throw new community_server_1.BadRequestHttpError('Invalid Cloud WebID.');
+        }
+        url.hash = '';
+        return { path: url.href };
+    }
+    async assertAccount(accountId) {
+        if (!accountId || !await this.options.accountStorage.has(LoginStorage_1.ACCOUNT_TYPE, accountId)) {
+            throw new community_server_1.ForbiddenHttpError('The Account does not exist.');
+        }
+    }
+    async findUniqueLink(accountId, webId) {
+        // BaseWebIdStore prevents duplicates only within one Account, so inspect the real global index.
+        const storage = this.options.accountStorage;
+        const links = await storage.find(BaseWebIdStore_1.WEBID_STORAGE_TYPE, { webId });
+        if (!links.length)
+            return undefined;
+        if (links.length !== 1 || links[0].accountId !== accountId || !await this.options.webIdStore.isLinked(webId, accountId)) {
+            throw new community_server_1.ForbiddenHttpError('The Cloud profile has a conflicting Account binding.');
+        }
+        return links[0];
+    }
+    async generateCard(base, webId, name) {
+        const cardUrl = webId.split('#')[0];
+        let card;
+        let authorization;
+        let mode;
+        // The configured CSS generator selects the installed native templates and ACP/WAC mode.
+        // Consume only the identity document and its authorization, dropping every storage resource.
+        for await (const resource of this.options.resourcesGenerator.generate(base, { base, name, webId, oidcIssuer: this.root.href })) {
+            const path = resource.identifier.path;
+            if (path === cardUrl || path === `${cardUrl}.acl` || path === `${cardUrl}.acr`) {
+                const quads = new n3_1.Parser({ baseIRI: path }).parse(await (0, community_server_1.readableToString)(resource.representation.data));
+                if (path === cardUrl) {
+                    card = quads.filter((q) => !(q.subject.value === webId && STORAGE_PREDICATES.includes(q.predicate.value)));
+                }
+                else {
+                    if (mode)
+                        throw new Error('The native profile has multiple authorization modes.');
+                    mode = path.endsWith('.acl') ? 'acl' : 'acr';
+                    authorization = quads;
+                }
+            }
+            else {
+                resource.representation.data.destroy();
+            }
+        }
+        if (!card || !authorization || !mode)
+            throw new Error('The native Cloud profile templates are incomplete.');
+        if (mode === 'acr') {
+            // Native ACP card public-read depends on root inheritance for the owner. This independent
+            // document instead grants owner modes on the card alone, never memberAccessControl.
+            const node = n3_1.DataFactory.namedNode;
+            const q = n3_1.DataFactory.quad;
+            const resource = node(`${cardUrl}.acr#card`);
+            const control = node(`${cardUrl}.acr#profileOwnerAccess`);
+            const policy = node(`${cardUrl}.acr#profileOwnerPolicy`);
+            const matcher = node(`${cardUrl}.acr#profileOwnerMatcher`);
+            authorization.push(q(resource, node(`${ACP}accessControl`), control), q(control, node(RDF_TYPE), node(`${ACP}AccessControl`)), q(control, node(`${ACP}apply`), policy), q(policy, node(RDF_TYPE), node(`${ACP}Policy`)), q(policy, node(`${ACP}anyOf`), matcher), q(matcher, node(RDF_TYPE), node(`${ACP}Matcher`)), q(matcher, node(`${ACP}agent`), node(webId)), ...['Read', 'Write', 'Control'].map((value) => q(policy, node(`${ACP}allow`), node(`${ACL}${value}`))));
+        }
+        return { card, authorization, mode };
+    }
+    async writeNew(identifier, representation, created) {
+        await this.options.resourceStore.setRepresentation(identifier, representation, new community_server_1.BasicConditions(this.eTags, { notMatchesETag: ['*'] }));
+        // A failed precondition belongs to another creator and must never enter cleanup.
+        // A backend reporting an unknown partial write is left intact, rather than guessed away.
+        created.push(identifier);
+    }
+}
+exports.CloudProfileCreator = CloudProfileCreator;
+const RDF_TYPE = 'http://www.w3.org/1999/02/22-rdf-syntax-ns#type';
+const ACP = 'http://www.w3.org/ns/solid/acp#';
+const ACL = 'http://www.w3.org/ns/auth/acl#';
+const STORAGE_PREDICATES = ['http://www.w3.org/ns/solid/terms#storage', 'http://www.w3.org/ns/pim/space#storage'];
+function canonicalRoot(value) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new community_server_1.BadRequestHttpError('Invalid canonical URL.');
+    }
+    if (value.trim() !== value || !['http:', 'https:'].includes(url.protocol) || url.username || url.password || url.search || url.hash) {
+        throw new community_server_1.BadRequestHttpError('Invalid canonical URL.');
+    }
+    if (!url.pathname.endsWith('/'))
+        url.pathname += '/';
+    return url;
+}
+function serialize(quads) {
+    return new n3_1.Writer({ format: 'text/turtle' }).quadsToString(quads);
+}
+//# sourceMappingURL=CloudProfileCreator.js.map

package/dist/provision/CloudProfileCreator.jsonld

@@ -0,0 +1,186 @@
+{
+  "@context": [
+    "https://linkedsoftwaredependencies.org/bundles/npm/@undefineds.co/xpod/^0.0.0/components/context.jsonld",
+    "https://linkedsoftwaredependencies.org/bundles/npm/@solid/community-server/^8.0.0/components/context.jsonld"
+  ],
+  "@id": "npmd:@undefineds.co/xpod",
+  "components": [
+    {
+      "@id": "undefineds:dist/provision/CloudProfileCreator.jsonld#CloudProfileCreator",
+      "@type": "Class",
+      "requireElement": "CloudProfileCreator",
+      "parameters": [
+        {
+          "@id": "undefineds:dist/provision/CloudProfileCreator.jsonld#CloudProfileCreator_options_baseUrl",
+          "range": "xsd:string"
+        },
+        {
+          "@id": "undefineds:dist/provision/CloudProfileCreator.jsonld#CloudProfileCreator_options_oidcIssuer",
+          "range": {
+            "@type": "ParameterRangeUnion",
+            "parameterRangeElements": [
+              "xsd:string",
+              {
+                "@type": "ParameterRangeUndefined"
+              }
+            ]
+          },
+          "comment": "Existing runtime issuer: an externally managed Local must prepare at Cloud."
+        },
+        {
+          "@id": "undefineds:dist/provision/CloudProfileCreator.jsonld#CloudProfileCreator_options_identifierGenerator",
+          "range": "css:dist/pods/generate/IdentifierGenerator.jsonld#IdentifierGenerator"
+        },
+        {
+          "@id": "undefineds:dist/provision/CloudProfileCreator.jsonld#CloudProfileCreator_options_resourcesGenerator",
+          "range": "Resource:sGenerator"
+        },
+        {
+          "@id": "undefineds:dist/provision/CloudProfileCreator.jsonld#CloudProfileCreator_options_resourceStore",
+          "range": "css:dist/storage/ResourceStore.jsonld#ResourceStore"
+        },
+        {
+          "@id": "undefineds:dist/provision/CloudProfileCreator.jsonld#CloudProfileCreator_options_webIdStore",
+          "range": "css:dist/identity/interaction/webid/util/WebIdStore.jsonld#WebIdStore"
+        },
+        {
+          "@id": "undefineds:dist/provision/CloudProfileCreator.jsonld#CloudProfileCreator_options_accountStorage",
+          "range": {
+            "@type": "ParameterRangeGenericComponent",
+            "component": "css:dist/identity/interaction/account/util/LoginStorage.jsonld#LoginStorage",
+            "genericTypeInstances": [
+              {
+                "@type": "ParameterRangeWildcard"
+              }
+            ]
+          }
+        },
+        {
+          "@id": "undefineds:dist/provision/CloudProfileCreator.jsonld#CloudProfileCreator_options_resourceLocker",
+          "range": "css:dist/util/locking/ReadWriteLocker.jsonld#ReadWriteLocker"
+        }
+      ],
+      "memberFields": [
+        {
+          "@id": "undefineds:dist/provision/CloudProfileCreator.jsonld#CloudProfileCreator__member_options",
+          "memberFieldName": "options"
+        },
+        {
+          "@id": "undefineds:dist/provision/CloudProfileCreator.jsonld#CloudProfileCreator__member_logger",
+          "memberFieldName": "logger"
+        },
+        {
+          "@id": "undefineds:dist/provision/CloudProfileCreator.jsonld#CloudProfileCreator__member_root",
+          "memberFieldName": "root"
+        },
+        {
+          "@id": "undefineds:dist/provision/CloudProfileCreator.jsonld#CloudProfileCreator__member_ownsIssuer",
+          "memberFieldName": "ownsIssuer"
+        },
+        {
+          "@id": "undefineds:dist/provision/CloudProfileCreator.jsonld#CloudProfileCreator__member_eTags",
+          "memberFieldName": "eTags"
+        },
+        {
+          "@id": "undefineds:dist/provision/CloudProfileCreator.jsonld#CloudProfileCreator__member_patchParser",
+          "memberFieldName": "patchParser"
+        },
+        {
+          "@id": "undefineds:dist/provision/CloudProfileCreator.jsonld#CloudProfileCreator__member_constructor",
+          "memberFieldName": "constructor"
+        },
+        {
+          "@id": "undefineds:dist/provision/CloudProfileCreator.jsonld#CloudProfileCreator__member_prepare",
+          "memberFieldName": "prepare"
+        },
+        {
+          "@id": "undefineds:dist/provision/CloudProfileCreator.jsonld#CloudProfileCreator__member_finalizeStorageBinding",
+          "memberFieldName": "finalizeStorageBinding"
+        },
+        {
+          "@id": "undefineds:dist/provision/CloudProfileCreator.jsonld#CloudProfileCreator__member_withNamespaceLock",
+          "memberFieldName": "withNamespaceLock"
+        },
+        {
+          "@id": "undefineds:dist/provision/CloudProfileCreator.jsonld#CloudProfileCreator__member_assertIssuer",
+          "memberFieldName": "assertIssuer"
+        },
+        {
+          "@id": "undefineds:dist/provision/CloudProfileCreator.jsonld#CloudProfileCreator__member_cardIdentifier",
+          "memberFieldName": "cardIdentifier"
+        },
+        {
+          "@id": "undefineds:dist/provision/CloudProfileCreator.jsonld#CloudProfileCreator__member_assertAccount",
+          "memberFieldName": "assertAccount"
+        },
+        {
+          "@id": "undefineds:dist/provision/CloudProfileCreator.jsonld#CloudProfileCreator__member_findUniqueLink",
+          "memberFieldName": "findUniqueLink"
+        },
+        {
+          "@id": "undefineds:dist/provision/CloudProfileCreator.jsonld#CloudProfileCreator__member_generateCard",
+          "memberFieldName": "generateCard"
+        },
+        {
+          "@id": "undefineds:dist/provision/CloudProfileCreator.jsonld#CloudProfileCreator__member_writeNew",
+          "memberFieldName": "writeNew"
+        }
+      ],
+      "constructorArguments": [
+        {
+          "@id": "undefineds:dist/provision/CloudProfileCreator.jsonld#CloudProfileCreator_options__constructorArgument",
+          "fields": [
+            {
+              "keyRaw": "baseUrl",
+              "value": {
+                "@id": "undefineds:dist/provision/CloudProfileCreator.jsonld#CloudProfileCreator_options_baseUrl"
+              }
+            },
+            {
+              "keyRaw": "oidcIssuer",
+              "value": {
+                "@id": "undefineds:dist/provision/CloudProfileCreator.jsonld#CloudProfileCreator_options_oidcIssuer"
+              }
+            },
+            {
+              "keyRaw": "identifierGenerator",
+              "value": {
+                "@id": "undefineds:dist/provision/CloudProfileCreator.jsonld#CloudProfileCreator_options_identifierGenerator"
+              }
+            },
+            {
+              "keyRaw": "resourcesGenerator",
+              "value": {
+                "@id": "undefineds:dist/provision/CloudProfileCreator.jsonld#CloudProfileCreator_options_resourcesGenerator"
+              }
+            },
+            {
+              "keyRaw": "resourceStore",
+              "value": {
+                "@id": "undefineds:dist/provision/CloudProfileCreator.jsonld#CloudProfileCreator_options_resourceStore"
+              }
+            },
+            {
+              "keyRaw": "webIdStore",
+              "value": {
+                "@id": "undefineds:dist/provision/CloudProfileCreator.jsonld#CloudProfileCreator_options_webIdStore"
+              }
+            },
+            {
+              "keyRaw": "accountStorage",
+              "value": {
+                "@id": "undefineds:dist/provision/CloudProfileCreator.jsonld#CloudProfileCreator_options_accountStorage"
+              }
+            },
+            {
+              "keyRaw": "resourceLocker",
+              "value": {
+                "@id": "undefineds:dist/provision/CloudProfileCreator.jsonld#CloudProfileCreator_options_resourceLocker"
+              }
+            }
+          ]
+        }
+      ]
+    }
+  ]
+}

package/dist/provision/LocalPodProvisioningService.d.ts

@@ -27,10 +27,12 @@ export declare class LocalPodProvisioningService {
     private readonly identityDbPath;
     private readonly rdfIndexPath?;
     private readonly oidcIssuer?;
+    private readonly hostsProfile;
     private readonly authMode?;
     private readonly sqliteRuntime;
     constructor(options: LocalPodProvisioningServiceOptions);
     createPod(input: LocalPodProvisioningInput): Promise<LocalPodProvisioningResult>;
+    private resolveWebId;
     private createPodFiles;
     private writeQuints;
     private writeRdfIndex;