@undefineds.co/xpod 0.4.20 → 0.4.27

package/dist/runtime/port-finder.d.ts

@@ -5,9 +5,21 @@
  * into a provider console and it survives restarts - while staying clear of the block a
  * neighbouring runtime plans for its own services. When the neighbourhood is busy the caller
  * gets an OS-assigned port instead of a stolen one; the runtime reports whichever it got.
+ *
+ * Reserved ports are skipped here too: a group that needs a fixed port has published a
+ * reservation, and a dynamic entry that took it would break that group's tunnel instead of
+ * merely moving its own listener.
+ */
+export declare function findGatewayIngressPort(gatewayPort: number, excluded?: ReadonlySet<number>): Promise<number>;
+/**
+ * The first free port at or above `basePort`.
+ *
+ * Reserved ports are skipped, not merely avoided by convention: a group that needs a fixed port
+ * (the tunnel acceptance's console-owned 5737) publishes a reservation, and every allocator -
+ * the runtime, the test helpers, the integration runners - goes around it instead of racing for
+ * it. That is the difference between "usually fine" and "cannot collide".
  */
-export declare function findGatewayIngressPort(gatewayPort: number): Promise<number>;
-export declare function getFreePort(basePort: number, host?: string, timeoutMs?: number): Promise<number>;
+export declare function getFreePort(basePort: number, host?: string, timeoutMs?: number, excluded?: ReadonlySet<number>): Promise<number>;
 /**
  * Loopback port handed out by the OS for a listener that must not collide with ports the
  * embedding process plans for other services.
@@ -18,6 +30,8 @@ export declare function getFreePort(basePort: number, host?: string, timeoutMs?:
  * runtime's service.
  */
 export declare function getEphemeralLoopbackPort(): Promise<number>;
+/** Tests socket availability on all service addresses, including an explicitly reserved port. */
+export declare function isFreePortForWildcard(port: number, timeoutMs?: number): Promise<boolean>;
 /**
  * Takes exactly this port or fails.
  *
@@ -25,4 +39,10 @@ export declare function getEphemeralLoopbackPort(): Promise<number>;
  * scans upward, which would leave the runtime listening somewhere the tunnel never reaches.
  */
 export declare function requireFreePortForWildcard(port: number, timeoutMs?: number): Promise<number>;
-export declare function getFreePortForWildcard(basePort: number, timeoutMs?: number): Promise<number>;
+/**
+ * Allocates a port for child services that bind wildcard addresses.
+ *
+ * CSS may bind `::` while the API binds `0.0.0.0`, so probing only localhost can miss an
+ * occupied port on the other address family - and a reserved port is skipped either way.
+ */
+export declare function getFreePortForWildcard(basePort: number, timeoutMs?: number, excluded?: ReadonlySet<number>): Promise<number>;

package/dist/runtime/port-finder.js

@@ -6,10 +6,12 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.findGatewayIngressPort = findGatewayIngressPort;
 exports.getFreePort = getFreePort;
 exports.getEphemeralLoopbackPort = getEphemeralLoopbackPort;
+exports.isFreePortForWildcard = isFreePortForWildcard;
 exports.requireFreePortForWildcard = requireFreePortForWildcard;
 exports.getFreePortForWildcard = getFreePortForWildcard;
 const node_net_1 = __importDefault(require("node:net"));
 const node_os_1 = __importDefault(require("node:os"));
+const port_reservations_1 = require("./port-reservations");
 const HIGHEST_PORT = 65_535;
 const PORT_PROBE_TIMEOUT_MS = 1_000;
 const RETRYABLE_PORT_ERRORS = new Set([
@@ -107,18 +109,34 @@ async function canListen(port, host, timeoutMs = PORT_PROBE_TIMEOUT_MS) {
  * into a provider console and it survives restarts - while staying clear of the block a
  * neighbouring runtime plans for its own services. When the neighbourhood is busy the caller
  * gets an OS-assigned port instead of a stolen one; the runtime reports whichever it got.
+ *
+ * Reserved ports are skipped here too: a group that needs a fixed port has published a
+ * reservation, and a dynamic entry that took it would break that group's tunnel instead of
+ * merely moving its own listener.
  */
-async function findGatewayIngressPort(gatewayPort) {
+async function findGatewayIngressPort(gatewayPort, excluded = new Set()) {
     for (let offset = 3; offset < 10; offset += 1) {
         const candidate = gatewayPort + offset;
-        if (await getFreePortForWildcard(candidate) === candidate) {
+        if (await getFreePortForWildcard(candidate, PORT_PROBE_TIMEOUT_MS, excluded) === candidate) {
             return candidate;
         }
     }
-    return await getEphemeralLoopbackPort();
+    return await getFreePortForWildcard(await getEphemeralLoopbackPort(), PORT_PROBE_TIMEOUT_MS, excluded);
 }
-async function getFreePort(basePort, host = '127.0.0.1', timeoutMs = PORT_PROBE_TIMEOUT_MS) {
+/**
+ * The first free port at or above `basePort`.
+ *
+ * Reserved ports are skipped, not merely avoided by convention: a group that needs a fixed port
+ * (the tunnel acceptance's console-owned 5737) publishes a reservation, and every allocator -
+ * the runtime, the test helpers, the integration runners - goes around it instead of racing for
+ * it. That is the difference between "usually fine" and "cannot collide".
+ */
+async function getFreePort(basePort, host = '127.0.0.1', timeoutMs = PORT_PROBE_TIMEOUT_MS, excluded = new Set()) {
+    const reserved = (0, port_reservations_1.reservedPorts)();
     for (let port = basePort; port <= HIGHEST_PORT; port++) {
+        if (reserved.has(port) || excluded.has(port)) {
+            continue;
+        }
         if (await canListen(port, host, timeoutMs)) {
             return port;
         }
@@ -135,21 +153,9 @@ async function getFreePort(basePort, host = '127.0.0.1', timeoutMs = PORT_PROBE_
  * runtime's service.
  */
 async function getEphemeralLoopbackPort() {
-    return await new Promise((resolve, reject) => {
-        const server = node_net_1.default.createServer();
-        server.once('error', reject);
-        server.listen(0, '127.0.0.1', () => {
-            const address = server.address();
-            const port = typeof address === 'object' && address ? address.port : 0;
-            server.close((error) => {
-                if (error) {
-                    reject(error);
-                    return;
-                }
-                resolve(port);
-            });
-        });
-    });
+    // One retry rule for "the OS does not know about reservations", shared with the fixtures that
+    // bind their own server (`listenOnUnreservedPort`).
+    return await (0, port_reservations_1.getUnreservedEphemeralPort)('127.0.0.1');
 }
 function hasIpv6Address() {
     return Object.values(node_os_1.default.networkInterfaces()).some((entries) => entries?.some((entry) => entry.family === 'IPv6'));
@@ -175,6 +181,13 @@ async function firstOccupiedServiceAddress(port, timeoutMs, probeIpv6) {
     }
     return undefined;
 }
+/** Tests socket availability on all service addresses, including an explicitly reserved port. */
+async function isFreePortForWildcard(port, timeoutMs = PORT_PROBE_TIMEOUT_MS) {
+    if (!Number.isInteger(port) || port <= 0 || port > HIGHEST_PORT) {
+        return false;
+    }
+    return await firstOccupiedServiceAddress(port, timeoutMs, hasIpv6Address()) === undefined;
+}
 /**
  * Takes exactly this port or fails.
  *
@@ -192,9 +205,19 @@ async function requireFreePortForWildcard(port, timeoutMs = PORT_PROBE_TIMEOUT_M
     }
     return port;
 }
-async function getFreePortForWildcard(basePort, timeoutMs = PORT_PROBE_TIMEOUT_MS) {
+/**
+ * Allocates a port for child services that bind wildcard addresses.
+ *
+ * CSS may bind `::` while the API binds `0.0.0.0`, so probing only localhost can miss an
+ * occupied port on the other address family - and a reserved port is skipped either way.
+ */
+async function getFreePortForWildcard(basePort, timeoutMs = PORT_PROBE_TIMEOUT_MS, excluded = new Set()) {
     const probeIpv6 = hasIpv6Address();
+    const reserved = (0, port_reservations_1.reservedPorts)();
     for (let port = basePort; port <= HIGHEST_PORT; port++) {
+        if (reserved.has(port) || excluded.has(port)) {
+            continue;
+        }
         if (await firstOccupiedServiceAddress(port, timeoutMs, probeIpv6)) {
             continue;
         }

package/dist/runtime/port-reservations.d.ts

@@ -0,0 +1,86 @@
+/**
+ * Port reservations: one small mechanism that keeps every *other* group off the fixed ports a
+ * group needs.
+ *
+ * The tunnel acceptance has two legs whose origin port is not ours to choose — the Cloudflare
+ * Dashboard's local service port and the SakuraFrp console's `local_port`, both 5737 on the
+ * operator's machine. Those are fixed parameters, so the group that needs them publishes a
+ * reservation, and every port *allocator* in the repo skips reserved ports:
+ *
+ * - allocation helpers in `src/runtime/port-finder.ts` (which is what the runtime, the test
+ *   helpers, `run-integration-full`/`run-integration-lite` and the acceptance harness use);
+ * - the harness's own free-port helpers.
+ *
+ * Two sources, both optional and both additive:
+ * - the `XPOD_RESERVED_PORTS` env var (`"5737,4599"`), for a run that knows its fixed ports;
+ * - one JSON file per reservation under `.test-data/port-reservations/`, for a group that
+ *   holds a port for the duration of a run.
+ *
+ * A reservation is a *claim about the future*, not a lock: it is never enforced against a
+ * process that ignores it. That is deliberate — the network group fails loudly naming whoever
+ * holds its port, and nothing in this repo signals a process it does not own.
+ *
+ * Reservations expire (12h by default) so a crashed run cannot block a port forever.
+ */
+export declare const RESERVED_PORTS_ENV = "XPOD_RESERVED_PORTS";
+export declare const PORT_RESERVATION_DIR_ENV = "XPOD_PORT_RESERVATION_DIR";
+export interface PortReservation {
+    port: number;
+    /** Who holds it: a run id, a harness name, an operator. */
+    owner: string;
+    /** Which group needs the fixed port (`network` for the tunnel acceptance). */
+    group: string;
+    /** ISO timestamp the reservation was written. */
+    reservedAt: string;
+    /** Why this port is fixed, so the next person does not have to guess. */
+    note?: string;
+    /** Where the reservation came from, so a log line can name the source. */
+    source?: 'file' | 'env';
+}
+export declare function portReservationDir(root?: string): string;
+export declare function portReservationFile(port: number, root?: string): string;
+/** Publishes a reservation (idempotent for the same owner and port). */
+export declare function reservePort(reservation: Omit<PortReservation, 'reservedAt'> & {
+    reservedAt?: string;
+}, root?: string): PortReservation;
+/** Removes a reservation this owner wrote; another owner's reservation is left alone. */
+export declare function releasePort(port: number, owner: string, root?: string): boolean;
+export declare function parseReservedPortsEnv(value: string | undefined): number[];
+/** Every reservation in force right now: env var plus unexpired files. */
+export declare function readPortReservations(options?: {
+    env?: Record<string, string | undefined>;
+    root?: string;
+    now?: number;
+    ttlMs?: number;
+}): PortReservation[];
+/** The set every allocator skips. Cheap enough to call once per allocation. */
+export declare function reservedPorts(options?: {
+    env?: Record<string, string | undefined>;
+    root?: string;
+    now?: number;
+}): Set<number>;
+/** The reservation covering a port, when there is one: what a failure message should name. */
+export declare function portReservation(port: number, options?: {
+    env?: Record<string, string | undefined>;
+    root?: string;
+    now?: number;
+}): PortReservation | undefined;
+/** The slice of `net.Server`/`http.Server` this needs, so both can be passed in. */
+export interface ReservingListenable {
+    listen(port: number, host: string, callback: () => void): unknown;
+    address(): {
+        port: number;
+    } | string | null;
+    close(callback?: (error?: Error) => void): unknown;
+    once(event: 'error', listener: (error: Error) => void): unknown;
+}
+/**
+ * Binds a server to an OS-assigned port that is not reserved.
+ *
+ * `listen(0)` hands out whatever the kernel likes, reservations included. Fixtures that bind
+ * their own server therefore come through here: one retry loop, one rule, and a reserved port is
+ * never taken even by accident.
+ */
+export declare function listenOnUnreservedPort(server: ReservingListenable, host?: string, attempts?: number): Promise<number>;
+/** An unreserved OS-assigned port, released again so the caller can bind it itself. */
+export declare function getUnreservedEphemeralPort(host?: string, attempts?: number): Promise<number>;

package/dist/runtime/port-reservations.js

@@ -0,0 +1,183 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PORT_RESERVATION_DIR_ENV = exports.RESERVED_PORTS_ENV = void 0;
+exports.portReservationDir = portReservationDir;
+exports.portReservationFile = portReservationFile;
+exports.reservePort = reservePort;
+exports.releasePort = releasePort;
+exports.parseReservedPortsEnv = parseReservedPortsEnv;
+exports.readPortReservations = readPortReservations;
+exports.reservedPorts = reservedPorts;
+exports.portReservation = portReservation;
+exports.listenOnUnreservedPort = listenOnUnreservedPort;
+exports.getUnreservedEphemeralPort = getUnreservedEphemeralPort;
+const node_fs_1 = require("node:fs");
+const node_net_1 = __importDefault(require("node:net"));
+const node_path_1 = __importDefault(require("node:path"));
+/**
+ * Port reservations: one small mechanism that keeps every *other* group off the fixed ports a
+ * group needs.
+ *
+ * The tunnel acceptance has two legs whose origin port is not ours to choose — the Cloudflare
+ * Dashboard's local service port and the SakuraFrp console's `local_port`, both 5737 on the
+ * operator's machine. Those are fixed parameters, so the group that needs them publishes a
+ * reservation, and every port *allocator* in the repo skips reserved ports:
+ *
+ * - allocation helpers in `src/runtime/port-finder.ts` (which is what the runtime, the test
+ *   helpers, `run-integration-full`/`run-integration-lite` and the acceptance harness use);
+ * - the harness's own free-port helpers.
+ *
+ * Two sources, both optional and both additive:
+ * - the `XPOD_RESERVED_PORTS` env var (`"5737,4599"`), for a run that knows its fixed ports;
+ * - one JSON file per reservation under `.test-data/port-reservations/`, for a group that
+ *   holds a port for the duration of a run.
+ *
+ * A reservation is a *claim about the future*, not a lock: it is never enforced against a
+ * process that ignores it. That is deliberate — the network group fails loudly naming whoever
+ * holds its port, and nothing in this repo signals a process it does not own.
+ *
+ * Reservations expire (12h by default) so a crashed run cannot block a port forever.
+ */
+exports.RESERVED_PORTS_ENV = 'XPOD_RESERVED_PORTS';
+exports.PORT_RESERVATION_DIR_ENV = 'XPOD_PORT_RESERVATION_DIR';
+const DEFAULT_TTL_MS = 12 * 60 * 60 * 1_000;
+const DEFAULT_DIRECTORY = node_path_1.default.join('.test-data', 'port-reservations');
+function portReservationDir(root = process.cwd()) {
+    return process.env[exports.PORT_RESERVATION_DIR_ENV]?.trim() || node_path_1.default.join(root, DEFAULT_DIRECTORY);
+}
+function portReservationFile(port, root = process.cwd()) {
+    return node_path_1.default.join(portReservationDir(root), `${port}.json`);
+}
+/** Publishes a reservation (idempotent for the same owner and port). */
+function reservePort(reservation, root = process.cwd()) {
+    const record = {
+        ...reservation,
+        reservedAt: reservation.reservedAt ?? new Date().toISOString(),
+        source: 'file',
+    };
+    const directory = portReservationDir(root);
+    (0, node_fs_1.mkdirSync)(directory, { recursive: true });
+    (0, node_fs_1.writeFileSync)(portReservationFile(record.port, root), JSON.stringify(record, null, 2), 'utf8');
+    return record;
+}
+/** Removes a reservation this owner wrote; another owner's reservation is left alone. */
+function releasePort(port, owner, root = process.cwd()) {
+    const file = portReservationFile(port, root);
+    const existing = readReservationFile(file);
+    if (!existing) {
+        return false;
+    }
+    if (existing.owner !== owner) {
+        return false;
+    }
+    (0, node_fs_1.rmSync)(file, { force: true });
+    return true;
+}
+function parseReservedPortsEnv(value) {
+    if (!value) {
+        return [];
+    }
+    return value
+        .split(/[\s,]+/u)
+        .map((entry) => Number.parseInt(entry.trim(), 10))
+        .filter((port) => Number.isInteger(port) && port > 0 && port <= 65_535);
+}
+/** Every reservation in force right now: env var plus unexpired files. */
+function readPortReservations(options = {}) {
+    const env = options.env ?? process.env;
+    const root = options.root ?? process.cwd();
+    const now = options.now ?? Date.now();
+    const ttlMs = options.ttlMs ?? DEFAULT_TTL_MS;
+    const reservations = [];
+    // Files first: they carry owner, group and timestamp, so a failure message can name who
+    // reserved the port. The env var only says "this number is spoken for".
+    let entries;
+    try {
+        entries = (0, node_fs_1.readdirSync)(portReservationDir(root));
+    }
+    catch {
+        entries = [];
+    }
+    for (const entry of entries) {
+        if (!entry.endsWith('.json')) {
+            continue;
+        }
+        const record = readReservationFile(node_path_1.default.join(portReservationDir(root), entry));
+        if (!record) {
+            continue;
+        }
+        if (now - Date.parse(record.reservedAt) > ttlMs) {
+            // A crashed run must not block a port forever; expiry is the whole reason for the stamp.
+            continue;
+        }
+        reservations.push({ ...record, source: 'file' });
+    }
+    for (const port of parseReservedPortsEnv(env[exports.RESERVED_PORTS_ENV])) {
+        if (reservations.some((reservation) => reservation.port === port)) {
+            continue;
+        }
+        reservations.push({
+            port,
+            owner: `${exports.RESERVED_PORTS_ENV}`,
+            group: 'env',
+            reservedAt: new Date(now).toISOString(),
+            source: 'env',
+        });
+    }
+    return reservations;
+}
+/** The set every allocator skips. Cheap enough to call once per allocation. */
+function reservedPorts(options = {}) {
+    return new Set(readPortReservations(options).map((reservation) => reservation.port));
+}
+/** The reservation covering a port, when there is one: what a failure message should name. */
+function portReservation(port, options = {}) {
+    return readPortReservations(options).find((reservation) => reservation.port === port);
+}
+function readReservationFile(file) {
+    try {
+        const parsed = JSON.parse((0, node_fs_1.readFileSync)(file, 'utf8'));
+        return typeof parsed?.port === 'number' && typeof parsed?.reservedAt === 'string' ? parsed : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Binds a server to an OS-assigned port that is not reserved.
+ *
+ * `listen(0)` hands out whatever the kernel likes, reservations included. Fixtures that bind
+ * their own server therefore come through here: one retry loop, one rule, and a reserved port is
+ * never taken even by accident.
+ */
+async function listenOnUnreservedPort(server, host = '127.0.0.1', attempts = 8) {
+    const reserved = reservedPorts();
+    for (let attempt = 0; attempt < attempts; attempt += 1) {
+        const port = await new Promise((resolve, reject) => {
+            server.once('error', reject);
+            server.listen(0, host, () => {
+                const address = server.address();
+                resolve(typeof address === 'object' && address ? address.port : 0);
+            });
+        });
+        if (!reserved.has(port)) {
+            return port;
+        }
+        await new Promise((resolve) => server.close(() => resolve()));
+    }
+    throw new Error('the OS only offered reserved ephemeral ports; release a reservation or widen the pool');
+}
+/** An unreserved OS-assigned port, released again so the caller can bind it itself. */
+async function getUnreservedEphemeralPort(host = '127.0.0.1', attempts = 8) {
+    const server = node_net_1.default.createServer();
+    try {
+        return await listenOnUnreservedPort(server, host, attempts);
+    }
+    finally {
+        await new Promise((resolve) => server.close(() => resolve()));
+    }
+}
+//# sourceMappingURL=port-reservations.js.map

package/dist/runtime/runner/node/CommunitySolidServerCssRunner.js

@@ -28,6 +28,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.communitySolidServerCssRunner = exports.CommunitySolidServerCssRunner = void 0;
 exports.createPackageRootPreferredModuleState = createPackageRootPreferredModuleState;
+const ensureSupportedBun_1 = require("../../compat/ensureSupportedBun");
 const node_path_1 = __importDefault(require("node:path"));
 const node_fs_1 = __importDefault(require("node:fs"));
 const componentsjs_1 = require("componentsjs");
@@ -78,6 +79,7 @@ class CommunitySolidServerCssRunner {
         this.name = 'community-solid-server';
     }
     async start(options) {
+        (0, ensureSupportedBun_1.ensureSupportedBun)();
         (0, ensureBunUndiciCompat_1.ensureBunUndiciCompat)(options.packageRoot);
         const moduleState = await createPackageRootPreferredModuleState(options.packageRoot);
         const communitySolidServer = await Promise.resolve().then(() => __importStar(require('@solid/community-server')));

package/dist/runtime/runtime-types.d.ts

@@ -40,6 +40,8 @@ export interface XpodRuntimeOptions {
     gatewayPort?: number;
     cssPort?: number;
     apiPort?: number;
+    /** Internal listener plan; uses the existing gateway ingress, not a new endpoint. */
+    ingressPort?: number;
     gatewaySocketPath?: string;
     cssSocketPath?: string;
     apiSocketPath?: string;

package/dist/runtime/safe-env.d.ts

@@ -4,7 +4,7 @@ export interface AiConnectionsRuntimeConfig {
     apiKey: string;
     model?: string;
 }
-export declare function sanitizeRuntimeEnv(source?: NodeJS.ProcessEnv | Record<string, string | undefined>): Record<string, string>;
+export declare function sanitizeRuntimeEnv(source?: Record<string, string | undefined> | Record<string, string | undefined>): Record<string, string>;
 export declare function requireAiConnectionsRuntimeConfig(input: {
     baseUrl?: string;
     apiKey?: string;

package/dist/runtime/secret-cell-root-key.d.ts

@@ -0,0 +1,7 @@
+import { DeploymentRootKeyProvider } from '../security/secret-cell/DeploymentRootKeyProvider';
+export declare function secretPathForSecretCellDatabase(databaseUrl: string): string | undefined;
+/** Independent from locator keys so rotating one purpose cannot strand another. */
+export declare function resolvePersistentSecretCellRootKey(options: {
+    databaseUrl: string;
+    edition: 'local' | 'cloud';
+}): DeploymentRootKeyProvider;

package/dist/runtime/secret-cell-root-key.js

@@ -0,0 +1,38 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.secretPathForSecretCellDatabase = secretPathForSecretCellDatabase;
+exports.resolvePersistentSecretCellRootKey = resolvePersistentSecretCellRootKey;
+const DeploymentRootKeyProvider_1 = require("../security/secret-cell/DeploymentRootKeyProvider");
+const database_url_1 = require("./database-url");
+const local_secret_file_1 = require("./local-secret-file");
+const LOCAL_KEY_ID = 'local-v1';
+function secretPathForSecretCellDatabase(databaseUrl) {
+    const databasePath = (0, database_url_1.sqliteDatabaseFilePath)(databaseUrl);
+    return databasePath ? (0, local_secret_file_1.localSecretPathForDatabase)(databasePath, 'secret-cell-root-key') : undefined;
+}
+/** Independent from locator keys so rotating one purpose cannot strand another. */
+function resolvePersistentSecretCellRootKey(options) {
+    if (options.edition !== 'local') {
+        throw new Error('XPOD_SECRET_CELL_KEY_ID and XPOD_SECRET_CELL_KEY are required for Cloud SecretCell encryption; configure stable shared root keys across replicas.');
+    }
+    const databasePath = (0, database_url_1.sqliteDatabaseFilePath)(options.databaseUrl);
+    if (!databasePath) {
+        throw new Error('XPOD_SECRET_CELL_KEY_ID and XPOD_SECRET_CELL_KEY are required when the identity database is not file-backed SQLite.');
+    }
+    const encoded = (0, local_secret_file_1.readOrCreateLocalSecret)({
+        databasePath,
+        purpose: 'secret-cell-root-key',
+        label: 'SecretCell root key',
+        isValid: value => /^[A-Za-z0-9_-]{43}$/u.test(value)
+            && Buffer.from(value, 'base64url').byteLength === 32
+            && Buffer.from(value, 'base64url').toString('base64url') === value,
+    });
+    const key = Buffer.from(encoded, 'base64url');
+    try {
+        return new DeploymentRootKeyProvider_1.DeploymentRootKeyProvider({ activeKeyId: LOCAL_KEY_ID, keys: { [LOCAL_KEY_ID]: key } });
+    }
+    finally {
+        key.fill(0);
+    }
+}
+//# sourceMappingURL=secret-cell-root-key.js.map

package/dist/runtime/socket-http.js

@@ -100,7 +100,11 @@ function createPatchedRequest(original, defaultProtocol) {
             return original(input, options, callback);
         }
         const rewritten = rewriteRequestOptions(url, requestOptions, socketPath);
-        return cb ? original(rewritten, cb) : original(rewritten);
+        // A canonical HTTPS origin is carried over the runtime's plain HTTP Unix listener.
+        rewritten.protocol = 'http:';
+        if (defaultProtocol === 'https:')
+            rewritten.agent = undefined;
+        return cb ? originalHttpRequest(rewritten, cb) : originalHttpRequest(rewritten);
     });
 }
 function createPatchedGet(protocol) {

package/dist/runtime/socket-transport.js

@@ -5,13 +5,12 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.requestViaSocket = requestViaSocket;
 const node_http_1 = __importDefault(require("node:http"));
-const node_https_1 = __importDefault(require("node:https"));
 const NULL_BODY_STATUS = new Set([101, 103, 204, 205, 304]);
 async function requestViaSocket(request) {
     return await new Promise((resolve, reject) => {
-        const requester = request.protocol === 'https:' ? node_https_1.default : node_http_1.default;
-        const req = requester.request({
-            protocol: request.protocol,
+        // Registered runtime sockets terminate plain HTTP; HTTPS belongs to the canonical public origin.
+        const req = node_http_1.default.request({
+            protocol: 'http:',
             socketPath: request.socketPath,
             path: request.path,
             method: request.method,

package/dist/runtime/user-env.d.ts

@@ -1,6 +1,6 @@
 export declare function defaultXpodEnvPath({ env, platform, homeDir, }?: {
-    env?: NodeJS.ProcessEnv;
+    env?: Record<string, string | undefined>;
     platform?: NodeJS.Platform;
     homeDir?: string;
 }): string;
-export declare function resolveXpodEnvPath(explicitPath: string | undefined, env?: NodeJS.ProcessEnv): string;
+export declare function resolveXpodEnvPath(explicitPath: string | undefined, env?: Record<string, string | undefined>): string;

package/dist/service/PodDataDeletionService.d.ts

@@ -0,0 +1,28 @@
+import type { AuxiliaryStrategy, ResourceIdentifier } from '@solid/community-server';
+import type { QuintStore } from '../storage/quint/types';
+import type { MixDataAccessor } from '../storage/accessors/MixDataAccessor';
+export interface PodDeletionPlan {
+    baseUrl: string;
+    /** Exact resource addresses, in postorder, including auxiliary resources. */
+    resources: string[];
+}
+/**
+ * Deletes one Pod's data after its caller authenticates and validates ownership.
+ * Account registration/binding removal must happen only after this succeeds.
+ * The caller must persist the prepared plan before mutation, reuse it after
+ * failures, and prevent concurrent writes while a Pod is being removed.
+ */
+export declare class PodDataDeletionService {
+    private readonly dataAccessor;
+    private readonly auxiliaryStrategy;
+    private readonly legacyQuintStore?;
+    constructor(dataAccessor: MixDataAccessor, auxiliaryStrategy: AuxiliaryStrategy, legacyQuintStore?: QuintStore | undefined);
+    prepare(baseUrl: ResourceIdentifier): Promise<PodDeletionPlan>;
+    deletePodData(baseUrl: ResourceIdentifier, plan?: PodDeletionPlan): Promise<void>;
+    /** Local provisioning retains a separate quints mirror; metadata may already be gone on retry. */
+    private deleteLegacyMirror;
+    private validatePlan;
+    private snapshot;
+    private assertWithinPod;
+    private ignoreNotFound;
+}