@undefineds.co/xpod 0.4.29 → 0.4.30

package/dist/api/handlers/AiGatewayManagementHandler.js

@@ -1,13 +1,12 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.registerAiGatewayManagementRoutes = registerAiGatewayManagementRoutes;
-const node_crypto_1 = require("node:crypto");
+const PodBaseUrlResolver_1 = require("../ai-gateway/pod/PodBaseUrlResolver");
 const global_logger_factory_1 = require("global-logger-factory");
 const readBoundedJsonBody_1 = require("../http/readBoundedJsonBody");
 const GatewayPrincipal_1 = require("../ai-gateway/auth/GatewayPrincipal");
 const models_1 = require("../ai-gateway/models");
 const AiConnectionsServiceAccess_1 = require("../ai-gateway/service-access/AiConnectionsServiceAccess");
-const OwnerPodAccess_1 = require("../ai-gateway/pod/OwnerPodAccess");
 const PodAccessFailureResponse_1 = require("./PodAccessFailureResponse");
 const AiClientConfigurationService_1 = require("../service/AiClientConfigurationService");
 const errors_1 = require("../ai-gateway/errors");
@@ -35,14 +34,29 @@ function registerAiGatewayManagementRoutes(server, options) {
                     logger.warn('Local AI Connection service identity is unavailable; using the authenticated WebID for this interactive request');
                 }
             }
+            const selectedPod = request.headers['x-xpod-pod-url'];
+            if (Array.isArray(selectedPod)) {
+                throw new errors_1.GatewayProtocolError('Provide exactly one X-Xpod-Pod-Url', { status: 400 });
+            }
+            if (!options.podBaseUrlResolver)
+                throw new Error('Pod storage binding resolver is unavailable');
+            const podBaseUrl = await (0, PodBaseUrlResolver_1.resolveOwnerPodBaseUrl)(request.auth.webId, options.podBaseUrlResolver, {
+                ...request.auth,
+                ...(selectedPod ? { requestedPodUrl: selectedPod } : {}),
+            });
+            if (!podBaseUrl) {
+                throw new errors_1.GatewayProtocolError('No owned Pod storage binding is available', { status: 404, code: 'service_access_missing' });
+            }
             const descriptor = (0, AiConnectionsServiceAccess_1.createAiConnectionsServiceAccess)({
                 ownerWebId: request.auth.webId,
                 serviceWebId: service.webId,
+                podBaseUrl,
             });
+            const boundAuth = { ...request.auth, authorizedPodUrl: podBaseUrl };
             const invocation = options.aiConnectionInvocationKeyIssuer
-                ? await options.aiConnectionInvocationKeyIssuer.issue({ auth: request.auth })
+                ? await options.aiConnectionInvocationKeyIssuer.issue({ auth: boundAuth })
                 : undefined;
-            const aiClientConfiguration = await withAiClientConfigurationInvocation(options.aiClientConfiguration ?? (0, AiClientConfigurationService_1.unavailableAiClientConfigurationCapability)(), options.aiConnectionInvocationKeyIssuer, request.auth);
+            const aiClientConfiguration = await withAiClientConfigurationInvocation(options.aiClientConfiguration ?? (0, AiClientConfigurationService_1.unavailableAiClientConfigurationCapability)(), options.aiConnectionInvocationKeyIssuer, boundAuth);
             logger.debug(`Issuing AI Connection service access for ${request.auth.webId}; invocation=${Boolean(invocation)}`);
             sendJson(response, 200, {
                 ...descriptor,
@@ -54,172 +68,6 @@ function registerAiGatewayManagementRoutes(server, options) {
             sendAiConnectionsServiceAccessError(response, error);
         }
     });
-    server.get('/api/ai/gateway/keys', async (request, response) => {
-        if (!authorizeGatewayKeyManagement(request, response)) {
-            return;
-        }
-        const repository = requireGatewayAccessKeyRepository(options, response);
-        if (!repository) {
-            return;
-        }
-        try {
-            const auth = request.auth;
-            const owner = (0, GatewayPrincipal_1.ownerWebIdForGatewayKeyManagement)(auth, undefined);
-            if (!owner) {
-                sendJson(response, 403, { error: 'Gateway API key management requires an owner WebID' });
-                return;
-            }
-            const records = await repository.listByOwner(owner, { auth });
-            // Issued credentials keep no copy of the wrapper, so the list can only
-            // report where each one is in effect.
-            sendJson(response, 200, {
-                data: records.map((record) => publicGatewayAccessKeyRecord(record, false)),
-            });
-        }
-        catch (error) {
-            sendGatewayAccessKeyError(response, error);
-        }
-    });
-    server.post('/api/ai/gateway/keys', async (request, response) => {
-        if (!authorizeGatewayKeyManagement(request, response)) {
-            return;
-        }
-        const repository = requireGatewayAccessKeyRepository(options, response);
-        if (!repository) {
-            return;
-        }
-        const body = await readJsonObject(request, response, jsonBodyLimitBytes);
-        if (!body) {
-            return;
-        }
-        try {
-            const auth = request.auth;
-            const owner = auth.type === 'solid' ? (0, GatewayPrincipal_1.ownerWebIdForGatewayKeyManagement)(auth, undefined) : undefined;
-            if (!owner) {
-                sendJson(response, 403, { error: 'Gateway API key management requires an owner WebID' });
-                return;
-            }
-            const apiKey = typeof body.apiKey === 'string' ? body.apiKey : '';
-            if (!validClientCredentialWrapper(apiKey)) {
-                sendJson(response, 400, { error: 'A CSS client credential wrapper is required' });
-                return;
-            }
-            if (!options.validateClientCredential || !repository.createKeyId) {
-                sendJson(response, 503, { error: 'CSS credential registration is unavailable' });
-                return;
-            }
-            const verified = await options.validateClientCredential(apiKey);
-            if (!verified.success || verified.context?.type !== 'solid') {
-                sendJson(response, verified.category === 'service_unavailable' ? 503 : 401, {
-                    error: 'CSS client credential verification failed',
-                });
-                return;
-            }
-            if (verified.context.webId !== owner) {
-                sendJson(response, 403, { error: 'CSS client credential belongs to another WebID' });
-                return;
-            }
-            // Registering an application is about that application's own credential - where it is in
-            // effect, and how to revoke it. Background Pod access is a separate, explicit grant the user
-            // makes where they manage index/embedding work (`POST /api/ai/task-credentials`), so nothing
-            // about it is written here.
-            const name = normalizeOptionalString(body.name) ?? 'Xpod API Key';
-            const keyId = repository.createKeyId(owner, options.deployment);
-            const createdAt = new Date();
-            const record = await repository.create({
-                id: keyId,
-                kind: 'client-credentials',
-                owner,
-                secretHash: '',
-                deployment: options.deployment,
-                scopes: [],
-                createdAt,
-                name,
-                // The CSS label is the OIDC client id inside the wrapper; keeping it is
-                // what lets a later destroy find the credential at CSS.
-                clientCredentialId: verified.context.clientId,
-                appliedTo: normalizeOptionalString(body.appliedTo),
-                appliedOn: normalizeOptionalString(body.appliedOn),
-            }, { auth });
-            sendJson(response, 201, {
-                // The only time the wrapper leaves Xpod: the caller applies it now.
-                key: apiKey,
-                record: publicGatewayAccessKeyRecord(record, false, apiKey),
-            });
-        }
-        catch (error) {
-            sendGatewayAccessKeyError(response, error);
-        }
-    });
-    server.patch('/api/ai/gateway/keys/:keyId', async (request, response, params) => {
-        if (!authorizeGatewayKeyManagement(request, response)) {
-            return;
-        }
-        const repository = requireGatewayAccessKeyRepository(options, response);
-        if (!repository) {
-            return;
-        }
-        const body = await readJsonObject(request, response, jsonBodyLimitBytes);
-        if (!body) {
-            return;
-        }
-        if (typeof body.enabled !== 'boolean') {
-            sendJson(response, 400, { error: 'enabled must be a boolean' });
-            return;
-        }
-        try {
-            const record = await ownedGatewayAccessKey(repository, params.keyId, request.auth);
-            if (!record) {
-                sendJson(response, 404, { error: 'Gateway API Key not found' });
-                return;
-            }
-            if (record.kind === 'client-credentials') {
-                sendJson(response, 409, { error: 'CSS client credentials cannot be suspended through Pod metadata' });
-                return;
-            }
-            const updated = await repository.setEnabled(record.id, body.enabled, new Date(), { auth: request.auth });
-            if (!updated) {
-                sendJson(response, 404, { error: 'Gateway API Key not found' });
-                return;
-            }
-            const plaintext = await repository.revealPlaintext(updated.id, { auth: request.auth });
-            sendJson(response, 200, {
-                record: publicGatewayAccessKeyRecord(updated, Boolean(plaintext)),
-            });
-        }
-        catch (error) {
-            sendGatewayAccessKeyError(response, error);
-        }
-    });
-    server.delete('/api/ai/gateway/keys/:keyId', async (request, response, params) => {
-        if (!authorizeGatewayKeyManagement(request, response)) {
-            return;
-        }
-        const repository = requireGatewayAccessKeyRepository(options, response);
-        if (!repository) {
-            return;
-        }
-        try {
-            const record = await ownedGatewayAccessKey(repository, params.keyId, request.auth);
-            if (!record) {
-                sendJson(response, 404, { error: 'Gateway API Key not found' });
-                return;
-            }
-            // This removes the saved client configuration only. The Account host
-            // revokes CSS credentials before requesting this companion cleanup.
-            await repository.delete(record.id, { auth: request.auth });
-            if (record.clientCredentialId) {
-                options.invalidateClientCredential?.(record.clientCredentialId);
-            }
-            sendJson(response, 200, {
-                deleted: true,
-                record: publicGatewayAccessKeyRecord(record, false),
-            });
-        }
-        catch (error) {
-            sendGatewayAccessKeyError(response, error);
-        }
-    });
     server.get('/api/ai/connections/authorization-methods', async (request, response) => {
         if (!authorizeProviderConnect(request, response))
             return;
@@ -980,9 +828,6 @@ function authorizeManagementCaller(request, response, options) {
         }
         return true;
     }
-    if (options.allowServiceGatewayKeyManagement && (0, GatewayPrincipal_1.canManageGatewayKeys)(auth)) {
-        return true;
-    }
     sendJson(response, 403, { error: options.nonSolidPrincipalError });
     return false;
 }
@@ -1015,20 +860,6 @@ function authorizeProviderModels(request, response) {
         nonSolidPrincipalError: 'Provider model management requires the current Solid identity',
     });
 }
-function authorizeGatewayKeyManagement(request, response) {
-    return authorizeManagementCaller(request, response, {
-        gatewayKeyPrincipalError: 'Gateway API keys cannot manage Gateway API keys',
-        nonSolidPrincipalError: 'Gateway API key management requires the current Solid identity',
-        allowServiceGatewayKeyManagement: true,
-    });
-}
-function requireGatewayAccessKeyRepository(options, response) {
-    if (!options.gatewayAccessKeyRepository) {
-        sendJson(response, 503, { error: 'Gateway API Key repository is not configured' });
-        return undefined;
-    }
-    return options.gatewayAccessKeyRepository;
-}
 function requireConnectService(options, response) {
     if (!options.connectService) {
         sendJson(response, 503, { error: 'AI provider Connect service is not configured' });
@@ -1149,55 +980,6 @@ function normalizeCustomModelInput(body) {
         ...(capabilities.length > 0 ? { capabilities } : {}),
     };
 }
-function validClientCredentialWrapper(value) {
-    if (!value.startsWith('sk-'))
-        return false;
-    const encoded = value.slice(3);
-    const decoded = Buffer.from(encoded, 'base64').toString('utf8');
-    return Buffer.from(decoded, 'utf8').toString('base64') === encoded
-        && /^[^\s\x00-\x1f\x7f:]+:[^\s\x00-\x1f\x7f]+$/u.test(decoded);
-}
-async function ownedGatewayAccessKey(repository, keyId, auth) {
-    if (!keyId) {
-        return undefined;
-    }
-    const record = await repository.findById(keyId, { auth });
-    if (!record) {
-        return undefined;
-    }
-    const owner = (0, GatewayPrincipal_1.ownerWebIdForGatewayKeyManagement)(auth, record.owner);
-    return owner && owner === record.owner ? record : undefined;
-}
-function publicGatewayAccessKeyRecord(record, plaintextAvailable, plaintext) {
-    const suffix = plaintext?.slice(-8) ?? record.plaintext?.slice(-8) ?? record.id.slice(-8);
-    const enabled = !record.disabledAt && !record.revokedAt;
-    return {
-        id: record.id,
-        ...(record.kind ? { kind: record.kind } : {}),
-        ...(record.credentialResource ? { credentialResource: record.credentialResource } : {}),
-        ...(plaintext ? { fingerprint: (0, node_crypto_1.createHash)('sha256').update(plaintext).digest('hex') } : {}),
-        owner: record.owner,
-        deployment: record.deployment,
-        scopes: record.scopes,
-        createdAt: record.createdAt.toISOString(),
-        ...(record.expiresAt ? { expiresAt: record.expiresAt.toISOString() } : {}),
-        ...(record.lastUsedAt ? { lastUsedAt: record.lastUsedAt.toISOString() } : {}),
-        ...(record.disabledAt ? { disabledAt: record.disabledAt.toISOString() } : {}),
-        ...(record.revokedAt ? { revokedAt: record.revokedAt.toISOString() } : {}),
-        ...(record.name ? { name: record.name } : {}),
-        // The CSS client id is what a later destroy needs; the applied state says
-        // where the wrapper was written.
-        ...(record.clientCredentialId ? { clientCredentialId: record.clientCredentialId } : {}),
-        ...(record.status ? { status: record.status } : {}),
-        ...(record.appliedTo ? { appliedTo: record.appliedTo } : {}),
-        ...(record.appliedOn ? { appliedOn: record.appliedOn } : {}),
-        ...(record.appliedAt ? { appliedAt: record.appliedAt.toISOString() } : {}),
-        enabled,
-        plaintextAvailable,
-        suffix,
-        maskedHint: `••••••••${suffix}`,
-    };
-}
 function normalizeCredentialPatch(body) {
     const patch = {};
     if (Object.prototype.hasOwnProperty.call(body, 'apiKey')) {
@@ -1357,28 +1139,6 @@ function sendCredentialPoolError(response, error) {
     logger.error(`Provider credential pool operation failed: ${message}`);
     sendJson(response, 500, { error: 'Provider credential pool operation failed' });
 }
-function sendGatewayAccessKeyError(response, error) {
-    const message = error instanceof Error ? error.message : String(error);
-    if ((0, OwnerPodAccess_1.isPodAccessFailure)(message)) {
-        logger.warn(`Gateway API Key operation refused: ${(0, AiClientConfigurationService_1.redactSecretText)(message)}`);
-        sendJson(response, 403, { error: 'service_access_missing' });
-        return;
-    }
-    if (message === 'caller_owner_mismatch') {
-        sendJson(response, 403, { error: 'Gateway API Key owner mismatch' });
-        return;
-    }
-    if (message === 'caller_pod_access_unavailable') {
-        sendJson(response, 401, { error: 'Authentication required' });
-        return;
-    }
-    if (message === 'gateway_key_secret_write_failed') {
-        sendJson(response, 500, { error: 'Gateway API Key secret could not be saved' });
-        return;
-    }
-    logger.error(`Gateway API Key operation failed: ${(0, AiClientConfigurationService_1.redactSecretText)(message)}`);
-    sendJson(response, 500, { error: 'Gateway API Key operation failed' });
-}
 function sendLegacyProviderConnectError(response, error) {
     // A Pod this caller cannot open has to answer with the code callers already act on
     // (`service_access_missing`), not as an internal failure: the retry with the caller's own

package/dist/api/middleware/AuthMiddleware.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AuthMiddleware = void 0;
+const PodBaseUrlResolver_1 = require("../ai-gateway/pod/PodBaseUrlResolver");
 const global_logger_factory_1 = require("global-logger-factory");
 /**
  * Middleware that handles authentication for API requests
@@ -39,7 +40,34 @@ class AuthMiddleware {
             return false;
         }
         // Attach auth context to request
-        request.auth = result.context;
+        const requestedPodUrl = request.headers['x-xpod-pod-url'];
+        if (Array.isArray(requestedPodUrl)) {
+            response.statusCode = 400;
+            response.setHeader('Content-Type', 'application/json');
+            response.end(JSON.stringify({ error: 'invalid_request', message: 'Provide exactly one X-Xpod-Pod-Url' }));
+            return false;
+        }
+        if (requestedPodUrl !== undefined) {
+            try {
+                (0, PodBaseUrlResolver_1.normalizeVerifiedPodRoot)(requestedPodUrl);
+            }
+            catch {
+                response.statusCode = 400;
+                response.setHeader('Content-Type', 'application/json');
+                response.end(JSON.stringify({ error: 'invalid_request', message: 'Invalid X-Xpod-Pod-Url' }));
+                return false;
+            }
+        }
+        if (requestedPodUrl !== undefined && result.context?.type === 'solid'
+            && (result.context.viaGatewayApiKey || result.context.internalInvocation)
+            && !result.context.authorizedPodUrl) {
+            // The existing browser fetch reacquires an invocation on 401 using its Solid session.
+            this.sendUnauthorized(response, 'A Pod-bound invocation is required');
+            return false;
+        }
+        request.auth = result.context?.type === 'solid' && requestedPodUrl !== undefined
+            ? { ...result.context, requestedPodUrl }
+            : result.context;
         return true;
     }
     sendUnauthorized(response, message) {

package/dist/api/runs/PiAgentRuntimeDriver.js

@@ -960,7 +960,12 @@ class PiAgentRuntimeDriver {
         // Keep a native dynamic import so the CommonJS build can lazily load pi's
         // ESM-only package instead of requiring it during CSS component discovery.
         const nativeImport = new Function('specifier', 'return import(specifier)');
-        PiAgentRuntimeDriver.sdkPromise = nativeImport('@mariozechner/pi-coding-agent');
+        // Compiled Bun cannot resolve this bare specifier in its extracted runtime
+        // (the Components.js adapter has the same constraint). Use the staged ESM
+        // entry directly; ordinary JS installs can still resolve a hoisted package.
+        const stagedEntry = path.join(package_root_1.PACKAGE_ROOT, 'node_modules', '@mariozechner/pi-coding-agent', 'dist', 'index.js');
+        PiAgentRuntimeDriver.sdkPromise = nativeImport(fs.existsSync(stagedEntry)
+            ? (0, node_url_1.pathToFileURL)(stagedEntry).href : '@mariozechner/pi-coding-agent');
         return PiAgentRuntimeDriver.sdkPromise;
     }
 }

package/dist/cli/index.js

@@ -120,7 +120,8 @@ async function main() {
             : await Promise.resolve().then(() => __importStar(require('@solid/community-server')));
         ensureBunCommunitySolidServerJwkCompat(css);
         const { AppRunner } = css;
-        await new AppRunner().runCli(process.argv);
+        const { createPackageRootPreferredAppRunner } = await Promise.resolve().then(() => __importStar(require('../runtime/runner/node/CommunitySolidServerCssRunner')));
+        await createPackageRootPreferredAppRunner(AppRunner, package_root_1.PACKAGE_ROOT).runCli(process.argv);
         return;
     }
     const wantsRootHelp = argv.length === 0 || argv[0] === 'help' || argv[0] === '--help' || argv[0] === '-h';

package/dist/identity/oidc/PodOwnershipResolver.js

@@ -63,7 +63,7 @@ class CssPodOwnershipResolver {
             return [];
         }
         const entries = [];
-        const resolvedWebIds = new Set();
+        const resolvedBindings = new Set();
         for (const pod of pods ?? []) {
             if (!pod || typeof pod.id !== 'string' || typeof pod.baseUrl !== 'string' || pod.baseUrl.length === 0) {
                 continue;
@@ -81,16 +81,19 @@ class CssPodOwnershipResolver {
             }
             for (const owner of owners ?? []) {
                 const webId = owner?.webId;
-                if (!isWebIdString(webId) || !candidates.has(webId) || resolvedWebIds.has(webId)) {
+                if (!isWebIdString(webId) || !candidates.has(webId)) {
                     continue;
                 }
                 const storageUrl = ensureTrailingSlash(pod.baseUrl);
+                const bindingKey = ownedBindingKey(webId, storageUrl);
+                if (resolvedBindings.has(bindingKey))
+                    continue;
                 entries.push({
                     webId,
                     storageUrl,
                     storageMode: deriveStorageMode(webId, storageUrl),
                 });
-                resolvedWebIds.add(webId);
+                resolvedBindings.add(bindingKey);
             }
         }
         return entries;
@@ -156,7 +159,7 @@ class CssPodOwnershipResolver {
                 return [];
             }
             const allowedWebIds = new Set(candidates);
-            const resolvedWebIds = new Set();
+            const resolvedBindings = new Set();
             const entries = [];
             for (const entry of body.entries) {
                 if (!isRecord(entry)
@@ -166,7 +169,7 @@ class CssPodOwnershipResolver {
                     this.warnRemoteFailure();
                     return [];
                 }
-                if (!allowedWebIds.has(entry.webId) || resolvedWebIds.has(entry.webId)) {
+                if (!allowedWebIds.has(entry.webId)) {
                     continue;
                 }
                 const podUrl = entry.podUrl;
@@ -175,12 +178,15 @@ class CssPodOwnershipResolver {
                     continue;
                 }
                 const storageUrl = ensureTrailingSlash(entry.storageUrl);
+                const bindingKey = ownedBindingKey(entry.webId, storageUrl);
+                if (resolvedBindings.has(bindingKey))
+                    continue;
                 entries.push({
                     webId: entry.webId,
                     storageUrl,
                     storageMode: deriveStorageMode(entry.webId, storageUrl),
                 });
-                resolvedWebIds.add(entry.webId);
+                resolvedBindings.add(bindingKey);
             }
             return entries;
         }
@@ -248,6 +254,10 @@ function hasManagedRoute(target) {
         && target.routeAccessTokenExp
         && target.nodeId);
 }
+/** Exact verified identity/storage pair; URI delimiters never collapse distinct bindings. */
+function ownedBindingKey(webId, storageUrl) {
+    return JSON.stringify([webId, storageUrl]);
+}
 /**
  * Derives the same cloud/local/custom classification used by scoped consent.
  */

package/dist/runtime/ingress-port.d.ts

@@ -9,7 +9,10 @@ import { type DeclaredOriginReadResult } from '../tunnel/TunnelDeclaredOrigin';
  *      `GET /v4/tunnels` `local_port`; the Cloudflare dashboard's remote configuration read
  *      back through the connector) — adopted when it is free, so the operator does not have to
  *      edit the console to match the runtime;
- *   3. `findGatewayIngressPort(gatewayPort)` — the predictable, dynamic gateway+3..+9 entry.
+ *   3. `findGatewayIngressPort(gatewayPort, reservedPorts)` — the predictable, dynamic
+ *      gateway+3..+9 entry. It skips the gateway/CSS/API ports this run serves itself, because
+ *      the tunnel entry is the one port an operator copies into a provider console: a number a
+ *      sibling service binds later must never be the address a tunnel forwards to.
  *
  * Both strict sources are strict about *being taken*: a port somebody else holds fails the
  * start with the occupant named (pid, command line, cwd). Nothing here signals a process, and
@@ -49,7 +52,11 @@ export interface IngressPortLogger {
     warn(message: string): void;
 }
 export interface IngressPortDeps {
-    findDefaultPort(mainPort: number): Promise<number>;
+    /**
+     * The dynamic gateway-derived entry. `excluded` carries this run's own service ports so the
+     * default scan cannot hand back a port a sibling service is about to bind.
+     */
+    findDefaultPort(mainPort: number, excluded: ReadonlySet<number>): Promise<number>;
     isFree(port: number): Promise<boolean>;
     identifyOccupants(port: number): string;
     readDeclaredOrigin(profile: IngressProfileLike, options: {

package/dist/runtime/ingress-port.js

@@ -128,8 +128,13 @@ async function resolveIngressPort(request) {
             + 'instead, and the tunnel provider will report its own failure. '
             + 'Pin XPOD_GATEWAY_INGRESS_PORT to decide the entry explicitly');
     }
-    const port = await deps.findDefaultPort(request.mainPort);
-    deps.logger.info(`Tunnel entry ${port} chosen from the gateway port ${request.mainPort} (gateway+3..+9, first free port)`);
+    // The dynamic entry is the only source derived from a *planned* neighbourhood, so it is the
+    // only one that has to be told which of those numbers this run has already claimed. Without
+    // it the scan can pick the API port that has been chosen but not bound yet, and the Gateway
+    // then proxies its own API traffic into its tunnel ingress in a loop.
+    const port = await deps.findDefaultPort(request.mainPort, reservedPorts);
+    deps.logger.info(`Tunnel entry ${port} chosen from the gateway port ${request.mainPort} `
+        + '(gateway+3..+9, first free port outside this runtime\'s own service ports)');
     return { port, source: 'gateway-default', inactiveDeclarations };
 }
 /** A strict port is taken as-is or not at all; the occupant is named, never signalled. */

package/dist/runtime/local-secret-file.d.ts

@@ -1,4 +1,4 @@
-export type LocalSecretPurpose = 'gateway-locator-secret' | 'secret-cell-root-key';
+export type LocalSecretPurpose = 'secret-cell-root-key';
 export declare function localSecretPathForDatabase(databasePath: string, purpose: LocalSecretPurpose): string;
 /** Publish complete private key files without replacing an existing identity. */
 export declare function readOrCreateLocalSecret(options: {

package/dist/runtime/runner/node/CommunitySolidServerCssRunner.d.ts

@@ -1,7 +1,9 @@
-import type { App } from '@solid/community-server';
+import type { App, AppRunner } from '@solid/community-server';
 import { type IModuleState } from 'componentsjs';
 import type { CssRuntimeRunner, CssRuntimeRunnerStartOptions } from '../types';
 export declare function createPackageRootPreferredModuleState(packageRoot: string): Promise<IModuleState>;
+/** Keep CSS's CLI parsing and startup while supplying the extracted dependency state. */
+export declare function createPackageRootPreferredAppRunner(Runner: typeof AppRunner, packageRoot: string): AppRunner;
 export declare class CommunitySolidServerCssRunner implements CssRuntimeRunner {
     readonly name = "community-solid-server";
     start(options: CssRuntimeRunnerStartOptions): Promise<App>;

package/dist/runtime/runner/node/CommunitySolidServerCssRunner.js

@@ -28,16 +28,46 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.communitySolidServerCssRunner = exports.CommunitySolidServerCssRunner = void 0;
 exports.createPackageRootPreferredModuleState = createPackageRootPreferredModuleState;
+exports.createPackageRootPreferredAppRunner = createPackageRootPreferredAppRunner;
 const ensureSupportedBun_1 = require("../../compat/ensureSupportedBun");
 const node_path_1 = __importDefault(require("node:path"));
 const node_fs_1 = __importDefault(require("node:fs"));
 const componentsjs_1 = require("componentsjs");
 const ensureBunUndiciCompat_1 = require("../../compat/ensureBunUndiciCompat");
+/** The compiled archive owns its complete Components.js dependency tree. */
+class ExtractedPackageModuleStateBuilder extends componentsjs_1.ModuleStateBuilder {
+    buildNodeModuleImportPaths(mainModulePath) {
+        return [mainModulePath];
+    }
+}
 async function createPackageRootPreferredModuleState(packageRoot) {
-    const moduleState = await new componentsjs_1.ModuleStateBuilder().buildModuleState(require, packageRoot);
+    const extracted = process.env.XPOD_BUN_SINGLE_RUNTIME === '1';
+    const builder = extracted ? new ExtractedPackageModuleStateBuilder() : new componentsjs_1.ModuleStateBuilder();
+    const moduleState = await builder.buildModuleState(require, packageRoot);
+    if (extracted && moduleState.nodeModulePaths.some(directory => {
+        const relative = node_path_1.default.relative(moduleState.mainModulePath, directory);
+        return relative === '..' || relative.startsWith(`..${node_path_1.default.sep}`) || node_path_1.default.isAbsolute(relative);
+    })) {
+        throw new Error('Extracted Components dependency is outside its packaged runtime');
+    }
     preferMainPackageComponents(moduleState);
     return moduleState;
 }
+/** Keep CSS's CLI parsing and startup while supplying the extracted dependency state. */
+function createPackageRootPreferredAppRunner(Runner, packageRoot) {
+    if (process.env.XPOD_BUN_SINGLE_RUNTIME !== '1') {
+        return new Runner();
+    }
+    return new class extends Runner {
+        async create(input = {}) {
+            const moduleState = await createPackageRootPreferredModuleState(packageRoot);
+            return super.create({
+                ...input,
+                loaderProperties: { ...input.loaderProperties, mainModulePath: packageRoot, moduleState },
+            });
+        }
+    }();
+}
 function preferMainPackageComponents(moduleState) {
     const packageRoot = moduleState.mainModulePath;
     const packageJson = moduleState.packageJsons[packageRoot];

package/node_modules/@undefineds.co/ai-connections/dist/AiConnectionsPanel.d.ts

@@ -7,6 +7,8 @@ export interface AiConnectionsPanelProps {
     onAuthorizeService?: () => Promise<void>;
     /** Disable when the embedding application already renders shared-ui Toaster. */
     renderToaster?: boolean;
+    /** Reveals read-only interface addresses (design §4.1); off by default. */
+    developerMode?: boolean;
     openExternal?: (url: string) => void | Promise<void>;
     clientConfigurationBridge?: AiClientConfigurationBridge;
     selectedSection?: AiConnectionsWorkspaceSection;
@@ -33,4 +35,4 @@ export interface AiConnectionsPanelProps {
      */
     liveCredentialRows?: readonly CredentialRow[];
 }
-export declare function AiConnectionsPanel({ client, onAuthorizeService, renderToaster, openExternal, clientConfigurationBridge, selectedSection, selectedProvider, selectedCredentialId, providerSummaries: providerSummariesInput, providerProducts, providerLoadError, providerLoading, onProviderStateChange, onModelSelectionChange, liveRevision, liveCredentialRows, }: AiConnectionsPanelProps): import("react").JSX.Element;
+export declare function AiConnectionsPanel({ client, onAuthorizeService, renderToaster, developerMode, openExternal, clientConfigurationBridge, selectedSection, selectedProvider, selectedCredentialId, providerSummaries: providerSummariesInput, providerProducts, providerLoadError, providerLoading, onProviderStateChange, onModelSelectionChange, liveRevision, liveCredentialRows, }: AiConnectionsPanelProps): import("react").JSX.Element;