@undefineds.co/xpod 0.1.0-local.202602081751

package/dist/api/auth/SolidTokenAuthenticator.js

@@ -0,0 +1,144 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SolidTokenAuthenticator = void 0;
+const access_token_verifier_1 = require("@solid/access-token-verifier");
+const global_logger_factory_1 = require("global-logger-factory");
+/**
+ * Authenticator for Solid access tokens (Bearer or DPoP).
+ */
+class SolidTokenAuthenticator {
+    constructor(options = {}) {
+        this.logger = (0, global_logger_factory_1.getLoggerFor)(this);
+        this.verify = (0, access_token_verifier_1.createSolidTokenVerifier)();
+        this.resolveAccountId = options.resolveAccountId;
+    }
+    canAuthenticate(request) {
+        const auth = request.headers.authorization;
+        if (!auth) {
+            return false;
+        }
+        const [scheme, token] = auth.split(' ');
+        if (!scheme || !token) {
+            return false;
+        }
+        if (scheme !== 'Bearer' && scheme !== 'DPoP') {
+            return false;
+        }
+        return this.isJwt(token.trim());
+    }
+    async authenticate(request) {
+        const authorization = request.headers.authorization;
+        if (!authorization) {
+            return { success: false, error: 'Missing Authorization header' };
+        }
+        const [scheme, rawToken] = authorization.split(' ');
+        const dpopRaw = request.headers.dpop;
+        const dpopHeader = Array.isArray(dpopRaw) ? dpopRaw[0] : dpopRaw;
+        if (scheme === 'DPoP' && !dpopHeader) {
+            return { success: false, error: 'Missing DPoP header' };
+        }
+        try {
+            // Build the request URL for verification
+            const method = (request.method ?? 'GET');
+            const url = this.buildRequestUrl(request);
+            console.log(`[SolidTokenAuthenticator] Verifying DPoP for URL: ${url}, method: ${method}, host header: ${request.headers.host}, x-forwarded-host: ${request.headers['x-forwarded-host']}`);
+            const dpopOptions = dpopHeader ? {
+                header: dpopHeader,
+                method,
+                url,
+            } : undefined;
+            const payload = await this.verify(authorization, dpopOptions);
+            const webId = this.extractWebId(payload);
+            if (!webId) {
+                return { success: false, error: 'Token missing webId claim' };
+            }
+            const clientId = this.extractString(payload, 'client_id') ??
+                this.extractString(payload, 'azp');
+            let accountId;
+            if (this.resolveAccountId) {
+                try {
+                    accountId = await this.resolveAccountId(webId);
+                }
+                catch (error) {
+                    this.logger.warn(`Failed to resolve accountId for webId ${webId}: ${error}`);
+                }
+            }
+            const context = {
+                type: 'solid',
+                webId,
+                accountId,
+                clientId,
+                accessToken: rawToken?.trim(),
+                tokenType: scheme === 'DPoP' ? 'DPoP' : 'Bearer',
+            };
+            this.logger.debug(`Authenticated Solid token for webId: ${webId}`);
+            return { success: true, context };
+        }
+        catch (error) {
+            this.logger.warn(`Solid token verification failed: ${error}`);
+            return { success: false, error: 'Invalid Solid token' };
+        }
+    }
+    buildRequestUrl(request) {
+        const host = this.getHost(request);
+        const proto = this.getProtocol(request);
+        const prefix = this.getForwardedPrefix(request);
+        const path = request.url ?? '/';
+        const fullPath = prefix ? this.joinPaths(prefix, path) : path;
+        return `${proto}://${host}${fullPath}`;
+    }
+    getProtocol(request) {
+        const forwarded = request.headers['x-forwarded-proto'];
+        if (forwarded) {
+            const proto = Array.isArray(forwarded) ? forwarded[0] : forwarded;
+            return proto?.split(',')[0]?.trim() ?? 'http';
+        }
+        // Default to http for local development
+        return 'http';
+    }
+    getHost(request) {
+        const forwarded = request.headers['x-forwarded-host'];
+        if (forwarded) {
+            const raw = Array.isArray(forwarded) ? forwarded[0] : forwarded;
+            const host = raw?.split(',')[0]?.trim();
+            if (host) {
+                return host;
+            }
+        }
+        return request.headers.host ?? 'localhost';
+    }
+    getForwardedPrefix(request) {
+        const forwarded = request.headers['x-forwarded-prefix'];
+        if (!forwarded) {
+            return undefined;
+        }
+        const raw = Array.isArray(forwarded) ? forwarded[0] : forwarded;
+        const prefix = raw?.split(',')[0]?.trim();
+        return prefix && prefix !== '/' ? prefix : undefined;
+    }
+    joinPaths(prefix, path) {
+        const normalizedPrefix = prefix.endsWith('/') ? prefix.slice(0, -1) : prefix;
+        const normalizedPath = path.startsWith('/') ? path : `/${path}`;
+        if (!normalizedPrefix) {
+            return normalizedPath;
+        }
+        return `${normalizedPrefix}${normalizedPath}`;
+    }
+    isJwt(token) {
+        return /^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(token);
+    }
+    extractWebId(payload) {
+        return this.extractString(payload, 'webid') ??
+            this.extractString(payload, 'webId') ??
+            this.extractString(payload, 'sub');
+    }
+    extractString(obj, key) {
+        const value = obj[key];
+        if (typeof value === 'string' && value.trim().length > 0) {
+            return value.trim();
+        }
+        return undefined;
+    }
+}
+exports.SolidTokenAuthenticator = SolidTokenAuthenticator;
+//# sourceMappingURL=SolidTokenAuthenticator.js.map

package/dist/api/auth/SolidTokenAuthenticator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SolidTokenAuthenticator.js","sourceRoot":"","sources":["../../../src/api/auth/SolidTokenAuthenticator.ts"],"names":[],"mappings":";;;AACA,wEAAwE;AACxE,iEAAqD;AAWrD;;GAEG;AACH,MAAa,uBAAuB;IAKlC,YAAmB,UAA0C,EAAE;QAJ9C,WAAM,GAAG,IAAA,oCAAY,EAAC,IAAI,CAAC,CAAC;QAC5B,WAAM,GAAG,IAAA,gDAAwB,GAAE,CAAC;QAInD,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC;IACnD,CAAC;IAEM,eAAe,CAAC,OAAwB;QAC7C,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QAC3C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;YACtB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YAC7C,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAClC,CAAC;IAEM,KAAK,CAAC,YAAY,CAAC,OAAwB;QAChD,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QACpD,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC;QACnE,CAAC;QAED,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACpD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;QACrC,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QACjE,IAAI,MAAM,KAAK,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;YACrC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;QAC1D,CAAC;QAED,IAAI,CAAC;YACH,yCAAyC;YACzC,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,KAAK,CAAqE,CAAC;YAC7G,MAAM,GAAG,GAAG,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;YAE1C,OAAO,CAAC,GAAG,CAAC,qDAAqD,GAAG,aAAa,MAAM,kBAAkB,OAAO,CAAC,OAAO,CAAC,IAAI,uBAAuB,OAAO,CAAC,OAAO,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;YAE3L,MAAM,WAAW,GAAG,UAAU,CAAC,CAAC,CAAC;gBAC/B,MAAM,EAAE,UAAU;gBAClB,MAAM;gBACN,GAAG;aACJ,CAAC,CAAC,CAAC,SAAS,CAAC;YAEd,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,WAAW,CAAuC,CAAC;YAEpG,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;YACzC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC;YAChE,CAAC;YAED,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,WAAW,CAAC;gBACxC,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAEpD,IAAI,SAA6B,CAAC;YAClC,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBAC1B,IAAI,CAAC;oBACH,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;gBACjD,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yCAAyC,KAAK,KAAK,KAAK,EAAE,CAAC,CAAC;gBAC/E,CAAC;YACH,CAAC;YAED,MAAM,OAAO,GAAqB;gBAChC,IAAI,EAAE,OAAO;gBACb,KAAK;gBACL,SAAS;gBACT,QAAQ;gBACR,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAE;gBAC7B,SAAS,EAAE,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;aACjD,CAAC;YAEF,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,wCAAwC,KAAK,EAAE,CAAC,CAAC;YACnE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oCAAoC,KAAK,EAAE,CAAC,CAAC;YAC9D,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;QAC1D,CAAC;IACH,CAAC;IAEO,eAAe,CAAC,OAAwB;QAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAChD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC;QAChC,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9D,OAAO,GAAG,KAAK,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC;IACzC,CAAC;IAEO,WAAW,CAAC,OAAwB;QAC1C,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;QACvD,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAClE,OAAO,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,MAAM,CAAC;QAChD,CAAC;QACD,wCAAwC;QACxC,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,OAAO,CAAC,OAAwB;QACtC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;QACtD,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAChE,MAAM,IAAI,GAAG,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;YACxC,IAAI,IAAI,EAAE,CAAC;gBACT,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW,CAAC;IAC7C,CAAC;IAEO,kBAAkB,CAAC,OAAwB;QACjD,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;QACxD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAChE,MAAM,MAAM,GAAG,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;QAC1C,OAAO,MAAM,IAAI,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IACvD,CAAC;IAEO,SAAS,CAAC,MAAc,EAAE,IAAY;QAC5C,MAAM,gBAAgB,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QAC7E,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;QAChE,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,OAAO,cAAc,CAAC;QACxB,CAAC;QACD,OAAO,GAAG,gBAAgB,GAAG,cAAc,EAAE,CAAC;IAChD,CAAC;IAEO,KAAK,CAAC,KAAa;QACzB,OAAO,kDAAkD,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxE,CAAC;IAEO,YAAY,CAAC,OAAgC;QACnD,OAAO,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC;YACpC,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC;YACpC,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC5C,CAAC;IAEO,aAAa,CAAC,GAA4B,EAAE,GAAW;QAC7D,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzD,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;QACtB,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;CACF;AAzJD,0DAyJC","sourcesContent":["import type { IncomingMessage } from 'node:http';\nimport { createSolidTokenVerifier } from '@solid/access-token-verifier';\nimport { getLoggerFor } from 'global-logger-factory';\nimport type { Authenticator, AuthResult } from './Authenticator';\nimport type { SolidAuthContext } from './AuthContext';\n\nexport interface SolidTokenAuthenticatorOptions {\n  /**\n   * Function to resolve accountId from webId (optional)\n   */\n  resolveAccountId?: (webId: string) => Promise<string | undefined>;\n}\n\n/**\n * Authenticator for Solid access tokens (Bearer or DPoP).\n */\nexport class SolidTokenAuthenticator implements Authenticator {\n  private readonly logger = getLoggerFor(this);\n  private readonly verify = createSolidTokenVerifier();\n  private readonly resolveAccountId?: (webId: string) => Promise<string | undefined>;\n\n  public constructor(options: SolidTokenAuthenticatorOptions = {}) {\n    this.resolveAccountId = options.resolveAccountId;\n  }\n\n  public canAuthenticate(request: IncomingMessage): boolean {\n    const auth = request.headers.authorization;\n    if (!auth) {\n      return false;\n    }\n    const [scheme, token] = auth.split(' ');\n    if (!scheme || !token) {\n      return false;\n    }\n    if (scheme !== 'Bearer' && scheme !== 'DPoP') {\n      return false;\n    }\n    return this.isJwt(token.trim());\n  }\n\n  public async authenticate(request: IncomingMessage): Promise<AuthResult> {\n    const authorization = request.headers.authorization;\n    if (!authorization) {\n      return { success: false, error: 'Missing Authorization header' };\n    }\n\n    const [scheme, rawToken] = authorization.split(' ');\n    const dpopRaw = request.headers.dpop;\n    const dpopHeader = Array.isArray(dpopRaw) ? dpopRaw[0] : dpopRaw;\n    if (scheme === 'DPoP' && !dpopHeader) {\n      return { success: false, error: 'Missing DPoP header' };\n    }\n\n    try {\n      // Build the request URL for verification\n      const method = (request.method ?? 'GET') as 'GET' | 'POST' | 'PUT' | 'DELETE' | 'PATCH' | 'HEAD' | 'OPTIONS';\n      const url = this.buildRequestUrl(request);\n\n      console.log(`[SolidTokenAuthenticator] Verifying DPoP for URL: ${url}, method: ${method}, host header: ${request.headers.host}, x-forwarded-host: ${request.headers['x-forwarded-host']}`);\n\n      const dpopOptions = dpopHeader ? {\n        header: dpopHeader,\n        method,\n        url,\n      } : undefined;\n\n      const payload = await this.verify(authorization, dpopOptions) as unknown as Record<string, unknown>;\n\n      const webId = this.extractWebId(payload);\n      if (!webId) {\n        return { success: false, error: 'Token missing webId claim' };\n      }\n\n      const clientId = this.extractString(payload, 'client_id') ?? \n                       this.extractString(payload, 'azp');\n\n      let accountId: string | undefined;\n      if (this.resolveAccountId) {\n        try {\n          accountId = await this.resolveAccountId(webId);\n        } catch (error) {\n          this.logger.warn(`Failed to resolve accountId for webId ${webId}: ${error}`);\n        }\n      }\n\n      const context: SolidAuthContext = {\n        type: 'solid',\n        webId,\n        accountId,\n        clientId,\n        accessToken: rawToken?.trim(),\n        tokenType: scheme === 'DPoP' ? 'DPoP' : 'Bearer',\n      };\n\n      this.logger.debug(`Authenticated Solid token for webId: ${webId}`);\n      return { success: true, context };\n    } catch (error) {\n      this.logger.warn(`Solid token verification failed: ${error}`);\n      return { success: false, error: 'Invalid Solid token' };\n    }\n  }\n\n  private buildRequestUrl(request: IncomingMessage): string {\n    const host = this.getHost(request);\n    const proto = this.getProtocol(request);\n    const prefix = this.getForwardedPrefix(request);\n    const path = request.url ?? '/';\n    const fullPath = prefix ? this.joinPaths(prefix, path) : path;\n    return `${proto}://${host}${fullPath}`;\n  }\n\n  private getProtocol(request: IncomingMessage): string {\n    const forwarded = request.headers['x-forwarded-proto'];\n    if (forwarded) {\n      const proto = Array.isArray(forwarded) ? forwarded[0] : forwarded;\n      return proto?.split(',')[0]?.trim() ?? 'http';\n    }\n    // Default to http for local development\n    return 'http';\n  }\n\n  private getHost(request: IncomingMessage): string {\n    const forwarded = request.headers['x-forwarded-host'];\n    if (forwarded) {\n      const raw = Array.isArray(forwarded) ? forwarded[0] : forwarded;\n      const host = raw?.split(',')[0]?.trim();\n      if (host) {\n        return host;\n      }\n    }\n    return request.headers.host ?? 'localhost';\n  }\n\n  private getForwardedPrefix(request: IncomingMessage): string | undefined {\n    const forwarded = request.headers['x-forwarded-prefix'];\n    if (!forwarded) {\n      return undefined;\n    }\n    const raw = Array.isArray(forwarded) ? forwarded[0] : forwarded;\n    const prefix = raw?.split(',')[0]?.trim();\n    return prefix && prefix !== '/' ? prefix : undefined;\n  }\n\n  private joinPaths(prefix: string, path: string): string {\n    const normalizedPrefix = prefix.endsWith('/') ? prefix.slice(0, -1) : prefix;\n    const normalizedPath = path.startsWith('/') ? path : `/${path}`;\n    if (!normalizedPrefix) {\n      return normalizedPath;\n    }\n    return `${normalizedPrefix}${normalizedPath}`;\n  }\n\n  private isJwt(token: string): boolean {\n    return /^[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+$/.test(token);\n  }\n\n  private extractWebId(payload: Record<string, unknown>): string | undefined {\n    return this.extractString(payload, 'webid') ??\n           this.extractString(payload, 'webId') ??\n           this.extractString(payload, 'sub');\n  }\n\n  private extractString(obj: Record<string, unknown>, key: string): string | undefined {\n    const value = obj[key];\n    if (typeof value === 'string' && value.trim().length > 0) {\n      return value.trim();\n    }\n    return undefined;\n  }\n}\n"]}

package/dist/api/auth/index.d.ts

@@ -0,0 +1,5 @@
+export * from './Authenticator';
+export * from './AuthContext';
+export * from './SolidTokenAuthenticator';
+export * from './ClientCredentialsAuthenticator';
+export * from './MultiAuthenticator';

package/dist/api/auth/index.js

@@ -0,0 +1,23 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./Authenticator"), exports);
+__exportStar(require("./AuthContext"), exports);
+__exportStar(require("./SolidTokenAuthenticator"), exports);
+__exportStar(require("./ClientCredentialsAuthenticator"), exports);
+// export * from './NodeTokenAuthenticator';  // TODO: Fix later
+__exportStar(require("./MultiAuthenticator"), exports);
+//# sourceMappingURL=index.js.map

package/dist/api/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/api/auth/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,kDAAgC;AAChC,gDAA8B;AAC9B,4DAA0C;AAC1C,mEAAiD;AACjD,gEAAgE;AAChE,uDAAqC","sourcesContent":["export * from './Authenticator';\nexport * from './AuthContext';\nexport * from './SolidTokenAuthenticator';\nexport * from './ClientCredentialsAuthenticator';\n// export * from './NodeTokenAuthenticator';  // TODO: Fix later\nexport * from './MultiAuthenticator';\n"]}

package/dist/api/chatkit/ai-provider.d.ts

@@ -0,0 +1,44 @@
+/**
+ * AI Provider Adapter
+ *
+ * Adapts existing AI services to the ChatKit AiProvider interface.
+ * Includes 429 rate limit handling with credential status backfill.
+ */
+import type { AiProvider } from './service';
+import type { PodChatKitStore } from './pod-store';
+export interface VercelAiProviderOptions {
+    store: PodChatKitStore;
+}
+/**
+ * Vercel AI SDK based provider
+ *
+ * Uses PodChatKitStore to get AI provider settings from Pod.
+ * Reuses the same Session cached in StoreContext.
+ */
+export declare class VercelAiProvider implements AiProvider {
+    private readonly logger;
+    private readonly store;
+    constructor(options: VercelAiProviderOptions);
+    /**
+     * Stream a response for the given messages
+     */
+    streamResponse(messages: Array<{
+        role: 'system' | 'user' | 'assistant';
+        content: string;
+    }>, options?: {
+        model?: string;
+        temperature?: number;
+        maxTokens?: number;
+        context?: unknown;
+    }): AsyncIterable<string>;
+    /**
+     * Check if error is a 429 rate limit error
+     */
+    private isRateLimitError;
+    /**
+     * Handle 429 rate limit error by updating credential status
+     */
+    private handleRateLimitError;
+    private getProviderConfig;
+    private createProvider;
+}

package/dist/api/chatkit/ai-provider.js

@@ -0,0 +1,157 @@
+"use strict";
+/**
+ * AI Provider Adapter
+ *
+ * Adapts existing AI services to the ChatKit AiProvider interface.
+ * Includes 429 rate limit handling with credential status backfill.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.VercelAiProvider = void 0;
+const openai_1 = require("@ai-sdk/openai");
+const ai_1 = require("ai");
+const global_logger_factory_1 = require("global-logger-factory");
+const undici_1 = require("undici");
+const AuthContext_1 = require("../auth/AuthContext");
+const types_1 = require("../../credential/schema/types");
+// Create a proxy-aware fetch function
+function createProxyFetch(proxyUrl) {
+    const agent = new undici_1.ProxyAgent(proxyUrl);
+    return (url, init) => fetch(url, { ...init, dispatcher: agent });
+}
+/**
+ * Vercel AI SDK based provider
+ *
+ * Uses PodChatKitStore to get AI provider settings from Pod.
+ * Reuses the same Session cached in StoreContext.
+ */
+class VercelAiProvider {
+    constructor(options) {
+        this.logger = (0, global_logger_factory_1.getLoggerFor)(this);
+        this.store = options.store;
+    }
+    /**
+     * Stream a response for the given messages
+     */
+    async *streamResponse(messages, options) {
+        // Get context (contains auth and cached session)
+        const context = options?.context;
+        const auth = context?.auth;
+        const userId = auth ? ((0, AuthContext_1.getWebId)(auth) ?? (0, AuthContext_1.getAccountId)(auth) ?? 'anonymous') : 'anonymous';
+        // 从 Pod 获取配置（复用 context 中缓存的 Session）
+        const config = await this.getProviderConfig(context);
+        const model = options?.model ?? config.defaultModel ?? 'gemini-3-flash-preview';
+        this.logger.debug(`Streaming response for ${userId}, model: ${model}`);
+        const provider = this.createProvider(config);
+        try {
+            const result = (0, ai_1.streamText)({
+                model: provider.chat(model),
+                messages: messages,
+                temperature: options?.temperature,
+                maxTokens: options?.maxTokens,
+            });
+            // Stream text chunks
+            for await (const chunk of result.textStream) {
+                yield chunk;
+            }
+        }
+        catch (error) {
+            // Handle 429 rate limit errors
+            if (this.isRateLimitError(error)) {
+                await this.handleRateLimitError(error, context, config.credentialId);
+            }
+            throw error;
+        }
+    }
+    /**
+     * Check if error is a 429 rate limit error
+     */
+    isRateLimitError(error) {
+        if (error instanceof ai_1.APICallError) {
+            return error.statusCode === 429;
+        }
+        // Check for generic error with status
+        if (error && typeof error === 'object') {
+            const err = error;
+            return err.status === 429 || err.statusCode === 429 || err.code === 'rate_limit_exceeded';
+        }
+        return false;
+    }
+    /**
+     * Handle 429 rate limit error by updating credential status
+     */
+    async handleRateLimitError(error, context, credentialId) {
+        if (!context || !credentialId) {
+            this.logger.debug('Cannot update credential status: missing context or credentialId');
+            return;
+        }
+        // Parse Retry-After header if available
+        let rateLimitResetAt;
+        if (error instanceof ai_1.APICallError && error.responseHeaders) {
+            const retryAfter = error.responseHeaders['retry-after'];
+            if (retryAfter) {
+                const seconds = parseInt(retryAfter, 10);
+                if (!isNaN(seconds)) {
+                    rateLimitResetAt = new Date(Date.now() + seconds * 1000);
+                }
+                else {
+                    // Try parsing as HTTP date
+                    const date = new Date(retryAfter);
+                    if (!isNaN(date.getTime())) {
+                        rateLimitResetAt = date;
+                    }
+                }
+            }
+        }
+        // Default to 60 seconds if no Retry-After header
+        if (!rateLimitResetAt) {
+            rateLimitResetAt = new Date(Date.now() + 60 * 1000);
+        }
+        this.logger.warn(`Rate limited for credential ${credentialId}, reset at ${rateLimitResetAt.toISOString()}`);
+        try {
+            await this.store.updateCredentialStatus(context, credentialId, types_1.CredentialStatus.RATE_LIMITED, {
+                rateLimitResetAt,
+                incrementFailCount: true,
+            });
+        }
+        catch (updateError) {
+            this.logger.error(`Failed to update credential status: ${updateError}`);
+        }
+    }
+    async getProviderConfig(context) {
+        let config;
+        if (context) {
+            try {
+                config = await this.store.getAiConfig(context);
+                this.logger.debug(`Pod config: ${JSON.stringify(config)}`);
+            }
+            catch (error) {
+                this.logger.warn(`Failed to get Pod config, falling back to env: ${error}`);
+                config = undefined;
+            }
+        }
+        // Priority: Pod Config > Environment Variable > Default (Ollama)
+        let baseURL = config?.baseUrl || process.env.XPOD_AI_BASE_URL;
+        let apiKey = config?.apiKey || process.env.XPOD_AI_API_KEY;
+        const proxy = config?.proxyUrl;
+        // Special handling for Google/Gemini
+        if (!baseURL && !apiKey && process.env.GOOGLE_API_KEY) {
+            baseURL = 'https://generativelanguage.googleapis.com/v1beta/openai';
+            apiKey = process.env.GOOGLE_API_KEY;
+        }
+        // Default to local Ollama
+        baseURL = baseURL || 'http://localhost:11434/v1';
+        apiKey = apiKey || 'ollama';
+        return { baseURL, apiKey, proxy, credentialId: config?.credentialId };
+    }
+    createProvider(config) {
+        const { baseURL, apiKey, proxy } = config;
+        this.logger.debug(`Using AI Provider: ${baseURL} (proxy: ${proxy || 'none'})`);
+        const options = { baseURL, apiKey };
+        if (proxy) {
+            options.fetch = createProxyFetch(proxy);
+        }
+        return (0, openai_1.createOpenAI)(options);
+    }
+}
+exports.VercelAiProvider = VercelAiProvider;
+//# sourceMappingURL=ai-provider.js.map

package/dist/api/chatkit/ai-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai-provider.js","sourceRoot":"","sources":["../../../src/api/chatkit/ai-provider.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AAEH,2CAA8C;AAC9C,2BAA8C;AAC9C,iEAAqD;AACrD,mCAAoC;AAKpC,qDAA6D;AAC7D,yDAAiE;AAEjE,sCAAsC;AACtC,SAAS,gBAAgB,CAAC,QAAgB;IACxC,MAAM,KAAK,GAAG,IAAI,mBAAU,CAAC,QAAQ,CAAC,CAAC;IACvC,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,KAAK,EAAS,CAAC,CAAC;AAC1E,CAAC;AAMD;;;;;GAKG;AACH,MAAa,gBAAgB;IAI3B,YAAmB,OAAgC;QAHlC,WAAM,GAAG,IAAA,oCAAY,EAAC,IAAI,CAAC,CAAC;QAI3C,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC7B,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,CAAC,cAAc,CAC1B,QAA2E,EAC3E,OAKC;QAED,iDAAiD;QACjD,MAAM,OAAO,GAAG,OAAO,EAAE,OAAmC,CAAC;QAC7D,MAAM,IAAI,GAAG,OAAO,EAAE,IAA+B,CAAC;QACtD,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAA,sBAAQ,EAAC,IAAI,CAAC,IAAI,IAAA,0BAAY,EAAC,IAAI,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;QAE1F,sCAAsC;QACtC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QACrD,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,IAAI,MAAM,CAAC,YAAY,IAAI,wBAAwB,CAAC;QAEhF,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,0BAA0B,MAAM,YAAY,KAAK,EAAE,CAAC,CAAC;QAEvE,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAE7C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAA,eAAU,EAAC;gBACxB,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;gBAC3B,QAAQ,EAAE,QAAe;gBACzB,WAAW,EAAE,OAAO,EAAE,WAAW;gBACjC,SAAS,EAAE,OAAO,EAAE,SAAS;aACvB,CAAC,CAAC;YAEV,qBAAqB;YACrB,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;gBAC5C,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,+BAA+B;YAC/B,IAAI,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;gBACjC,MAAM,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;YACvE,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACK,gBAAgB,CAAC,KAAc;QACrC,IAAI,KAAK,YAAY,iBAAY,EAAE,CAAC;YAClC,OAAO,KAAK,CAAC,UAAU,KAAK,GAAG,CAAC;QAClC,CAAC;QACD,sCAAsC;QACtC,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACvC,MAAM,GAAG,GAAG,KAAY,CAAC;YACzB,OAAO,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,qBAAqB,CAAC;QAC5F,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,oBAAoB,CAChC,KAAc,EACd,OAAiC,EACjC,YAAgC;QAEhC,IAAI,CAAC,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC;YAC9B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,kEAAkE,CAAC,CAAC;YACtF,OAAO;QACT,CAAC;QAED,wCAAwC;QACxC,IAAI,gBAAkC,CAAC;QACvC,IAAI,KAAK,YAAY,iBAAY,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;YAC3D,MAAM,UAAU,GAAG,KAAK,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC;YACxD,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,OAAO,GAAG,QAAQ,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;gBACzC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;oBACpB,gBAAgB,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,GAAG,IAAI,CAAC,CAAC;gBAC3D,CAAC;qBAAM,CAAC;oBACN,2BAA2B;oBAC3B,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC;oBAClC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;wBAC3B,gBAAgB,GAAG,IAAI,CAAC;oBAC1B,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,iDAAiD;QACjD,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,gBAAgB,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QACtD,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,+BAA+B,YAAY,cAAc,gBAAgB,CAAC,WAAW,EAAE,EAAE,CAC1F,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC,OAAO,EAAE,YAAY,EAAE,wBAAgB,CAAC,YAAY,EAAE;gBAC5F,gBAAgB;gBAChB,kBAAkB,EAAE,IAAI;aACzB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,WAAW,EAAE,CAAC;YACrB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,uCAAuC,WAAW,EAAE,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAAC,OAAiC;QAO/D,IAAI,MAAuE,CAAC;QAE5E,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;gBAC/C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC7D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kDAAkD,KAAK,EAAE,CAAC,CAAC;gBAC5E,MAAM,GAAG,SAAS,CAAC;YACrB,CAAC;QACH,CAAC;QAED,iEAAiE;QACjE,IAAI,OAAO,GAAG,MAAM,EAAE,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;QAC9D,IAAI,MAAM,GAAG,MAAM,EAAE,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;QAC3D,MAAM,KAAK,GAAG,MAAM,EAAE,QAAQ,CAAC;QAE/B,qCAAqC;QACrC,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC;YACtD,OAAO,GAAG,yDAAyD,CAAC;YACpE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;QACtC,CAAC;QAED,0BAA0B;QAC1B,OAAO,GAAG,OAAO,IAAI,2BAA2B,CAAC;QACjD,MAAM,GAAG,MAAM,IAAI,QAAQ,CAAC;QAE5B,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IACxE,CAAC;IAEO,cAAc,CAAC,MAA2D;QAChF,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;QAE1C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,OAAO,YAAY,KAAK,IAAI,MAAM,GAAG,CAAC,CAAC;QAE/E,MAAM,OAAO,GAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QACzC,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,CAAC,KAAK,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAC1C,CAAC;QAED,OAAO,IAAA,qBAAY,EAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;CACF;AAxKD,4CAwKC","sourcesContent":["/**\n * AI Provider Adapter\n *\n * Adapts existing AI services to the ChatKit AiProvider interface.\n * Includes 429 rate limit handling with credential status backfill.\n */\n\nimport { createOpenAI } from '@ai-sdk/openai';\nimport { streamText, APICallError } from 'ai';\nimport { getLoggerFor } from 'global-logger-factory';\nimport { ProxyAgent } from 'undici';\nimport type { AiProvider } from './service';\nimport type { StoreContext } from './store';\nimport type { PodChatKitStore } from './pod-store';\nimport type { AuthContext } from '../auth/AuthContext';\nimport { getWebId, getAccountId } from '../auth/AuthContext';\nimport { CredentialStatus } from '../../credential/schema/types';\n\n// Create a proxy-aware fetch function\nfunction createProxyFetch(proxyUrl: string): typeof fetch {\n  const agent = new ProxyAgent(proxyUrl);\n  return (url, init) => fetch(url, { ...init, dispatcher: agent } as any);\n}\n\nexport interface VercelAiProviderOptions {\n  store: PodChatKitStore;\n}\n\n/**\n * Vercel AI SDK based provider\n *\n * Uses PodChatKitStore to get AI provider settings from Pod.\n * Reuses the same Session cached in StoreContext.\n */\nexport class VercelAiProvider implements AiProvider {\n  private readonly logger = getLoggerFor(this);\n  private readonly store: PodChatKitStore;\n\n  public constructor(options: VercelAiProviderOptions) {\n    this.store = options.store;\n  }\n\n  /**\n   * Stream a response for the given messages\n   */\n  public async *streamResponse(\n    messages: Array<{ role: 'system' | 'user' | 'assistant'; content: string }>,\n    options?: {\n      model?: string;\n      temperature?: number;\n      maxTokens?: number;\n      context?: unknown;\n    },\n  ): AsyncIterable<string> {\n    // Get context (contains auth and cached session)\n    const context = options?.context as StoreContext | undefined;\n    const auth = context?.auth as AuthContext | undefined;\n    const userId = auth ? (getWebId(auth) ?? getAccountId(auth) ?? 'anonymous') : 'anonymous';\n\n    // 从 Pod 获取配置（复用 context 中缓存的 Session）\n    const config = await this.getProviderConfig(context);\n    const model = options?.model ?? config.defaultModel ?? 'gemini-3-flash-preview';\n\n    this.logger.debug(`Streaming response for ${userId}, model: ${model}`);\n\n    const provider = this.createProvider(config);\n\n    try {\n      const result = streamText({\n        model: provider.chat(model),\n        messages: messages as any,\n        temperature: options?.temperature,\n        maxTokens: options?.maxTokens,\n      } as any);\n\n      // Stream text chunks\n      for await (const chunk of result.textStream) {\n        yield chunk;\n      }\n    } catch (error) {\n      // Handle 429 rate limit errors\n      if (this.isRateLimitError(error)) {\n        await this.handleRateLimitError(error, context, config.credentialId);\n      }\n      throw error;\n    }\n  }\n\n  /**\n   * Check if error is a 429 rate limit error\n   */\n  private isRateLimitError(error: unknown): boolean {\n    if (error instanceof APICallError) {\n      return error.statusCode === 429;\n    }\n    // Check for generic error with status\n    if (error && typeof error === 'object') {\n      const err = error as any;\n      return err.status === 429 || err.statusCode === 429 || err.code === 'rate_limit_exceeded';\n    }\n    return false;\n  }\n\n  /**\n   * Handle 429 rate limit error by updating credential status\n   */\n  private async handleRateLimitError(\n    error: unknown,\n    context: StoreContext | undefined,\n    credentialId: string | undefined,\n  ): Promise<void> {\n    if (!context || !credentialId) {\n      this.logger.debug('Cannot update credential status: missing context or credentialId');\n      return;\n    }\n\n    // Parse Retry-After header if available\n    let rateLimitResetAt: Date | undefined;\n    if (error instanceof APICallError && error.responseHeaders) {\n      const retryAfter = error.responseHeaders['retry-after'];\n      if (retryAfter) {\n        const seconds = parseInt(retryAfter, 10);\n        if (!isNaN(seconds)) {\n          rateLimitResetAt = new Date(Date.now() + seconds * 1000);\n        } else {\n          // Try parsing as HTTP date\n          const date = new Date(retryAfter);\n          if (!isNaN(date.getTime())) {\n            rateLimitResetAt = date;\n          }\n        }\n      }\n    }\n\n    // Default to 60 seconds if no Retry-After header\n    if (!rateLimitResetAt) {\n      rateLimitResetAt = new Date(Date.now() + 60 * 1000);\n    }\n\n    this.logger.warn(\n      `Rate limited for credential ${credentialId}, reset at ${rateLimitResetAt.toISOString()}`,\n    );\n\n    try {\n      await this.store.updateCredentialStatus(context, credentialId, CredentialStatus.RATE_LIMITED, {\n        rateLimitResetAt,\n        incrementFailCount: true,\n      });\n    } catch (updateError) {\n      this.logger.error(`Failed to update credential status: ${updateError}`);\n    }\n  }\n\n  private async getProviderConfig(context: StoreContext | undefined): Promise<{\n    baseURL: string;\n    apiKey: string;\n    proxy?: string;\n    defaultModel?: string;\n    credentialId?: string;\n  }> {\n    let config: Awaited<ReturnType<PodChatKitStore['getAiConfig']>> | undefined;\n\n    if (context) {\n      try {\n        config = await this.store.getAiConfig(context);\n        this.logger.debug(`Pod config: ${JSON.stringify(config)}`);\n      } catch (error) {\n        this.logger.warn(`Failed to get Pod config, falling back to env: ${error}`);\n        config = undefined;\n      }\n    }\n\n    // Priority: Pod Config > Environment Variable > Default (Ollama)\n    let baseURL = config?.baseUrl || process.env.XPOD_AI_BASE_URL;\n    let apiKey = config?.apiKey || process.env.XPOD_AI_API_KEY;\n    const proxy = config?.proxyUrl;\n\n    // Special handling for Google/Gemini\n    if (!baseURL && !apiKey && process.env.GOOGLE_API_KEY) {\n      baseURL = 'https://generativelanguage.googleapis.com/v1beta/openai';\n      apiKey = process.env.GOOGLE_API_KEY;\n    }\n\n    // Default to local Ollama\n    baseURL = baseURL || 'http://localhost:11434/v1';\n    apiKey = apiKey || 'ollama';\n\n    return { baseURL, apiKey, proxy, credentialId: config?.credentialId };\n  }\n\n  private createProvider(config: { baseURL: string; apiKey: string; proxy?: string }) {\n    const { baseURL, apiKey, proxy } = config;\n\n    this.logger.debug(`Using AI Provider: ${baseURL} (proxy: ${proxy || 'none'})`);\n\n    const options: any = { baseURL, apiKey };\n    if (proxy) {\n      options.fetch = createProxyFetch(proxy);\n    }\n\n    return createOpenAI(options);\n  }\n}\n"]}

package/dist/api/chatkit/index.d.ts

@@ -0,0 +1,11 @@
+/**
+ * ChatKit Module
+ *
+ * OpenAI ChatKit protocol implementation for xpod-api-server.
+ */
+export * from './types';
+export { Chat, Thread, Message, ChatStatus, MessageRole, MessageStatus, type ChatRecord, type ThreadRecord, type MessageRecord, type ChatStatusType, type MessageRoleType, type MessageStatusType, } from './schema';
+export { type ChatKitStore, type StoreContext, InMemoryStore } from './store';
+export { PodChatKitStore, type PodChatKitStoreOptions } from './pod-store';
+export { ChatKitService, type AiProvider, type ChatKitServiceOptions, type StreamingResult, type NonStreamingResult, type ChatKitResult } from './service';
+export { VercelAiProvider, type VercelAiProviderOptions } from './ai-provider';

package/dist/api/chatkit/index.js

@@ -0,0 +1,44 @@
+"use strict";
+/**
+ * ChatKit Module
+ *
+ * OpenAI ChatKit protocol implementation for xpod-api-server.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.VercelAiProvider = exports.ChatKitService = exports.PodChatKitStore = exports.InMemoryStore = exports.MessageStatus = exports.MessageRole = exports.ChatStatus = exports.Message = exports.Thread = exports.Chat = void 0;
+// Types
+__exportStar(require("./types"), exports);
+// Schema
+var schema_1 = require("./schema");
+Object.defineProperty(exports, "Chat", { enumerable: true, get: function () { return schema_1.Chat; } });
+Object.defineProperty(exports, "Thread", { enumerable: true, get: function () { return schema_1.Thread; } });
+Object.defineProperty(exports, "Message", { enumerable: true, get: function () { return schema_1.Message; } });
+Object.defineProperty(exports, "ChatStatus", { enumerable: true, get: function () { return schema_1.ChatStatus; } });
+Object.defineProperty(exports, "MessageRole", { enumerable: true, get: function () { return schema_1.MessageRole; } });
+Object.defineProperty(exports, "MessageStatus", { enumerable: true, get: function () { return schema_1.MessageStatus; } });
+// Store
+var store_1 = require("./store");
+Object.defineProperty(exports, "InMemoryStore", { enumerable: true, get: function () { return store_1.InMemoryStore; } });
+var pod_store_1 = require("./pod-store");
+Object.defineProperty(exports, "PodChatKitStore", { enumerable: true, get: function () { return pod_store_1.PodChatKitStore; } });
+// Service
+var service_1 = require("./service");
+Object.defineProperty(exports, "ChatKitService", { enumerable: true, get: function () { return service_1.ChatKitService; } });
+// AI Provider
+var ai_provider_1 = require("./ai-provider");
+Object.defineProperty(exports, "VercelAiProvider", { enumerable: true, get: function () { return ai_provider_1.VercelAiProvider; } });
+//# sourceMappingURL=index.js.map

package/dist/api/chatkit/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/api/chatkit/index.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;;;;;;;;;;;;;;;AAEH,QAAQ;AACR,0CAAwB;AAExB,SAAS;AACT,mCAakB;AAZhB,8FAAA,IAAI,OAAA;AACJ,gGAAA,MAAM,OAAA;AACN,iGAAA,OAAO,OAAA;AACP,oGAAA,UAAU,OAAA;AACV,qGAAA,WAAW,OAAA;AACX,uGAAA,aAAa,OAAA;AASf,QAAQ;AACR,iCAA8E;AAA/B,sGAAA,aAAa,OAAA;AAC5D,yCAA2E;AAAlE,4GAAA,eAAe,OAAA;AAExB,UAAU;AACV,qCAA2J;AAAlJ,yGAAA,cAAc,OAAA;AAEvB,cAAc;AACd,6CAA+E;AAAtE,+GAAA,gBAAgB,OAAA","sourcesContent":["/**\n * ChatKit Module\n * \n * OpenAI ChatKit protocol implementation for xpod-api-server.\n */\n\n// Types\nexport * from './types';\n\n// Schema\nexport {\n  Chat,\n  Thread,\n  Message,\n  ChatStatus,\n  MessageRole,\n  MessageStatus,\n  type ChatRecord,\n  type ThreadRecord,\n  type MessageRecord,\n  type ChatStatusType,\n  type MessageRoleType,\n  type MessageStatusType,\n} from './schema';\n\n// Store\nexport { type ChatKitStore, type StoreContext, InMemoryStore } from './store';\nexport { PodChatKitStore, type PodChatKitStoreOptions } from './pod-store';\n\n// Service\nexport { ChatKitService, type AiProvider, type ChatKitServiceOptions, type StreamingResult, type NonStreamingResult, type ChatKitResult } from './service';\n\n// AI Provider\nexport { VercelAiProvider, type VercelAiProviderOptions } from './ai-provider';\n"]}

package/dist/api/chatkit/pod-store.d.ts

@@ -0,0 +1,154 @@
+/**
+ * Pod-based ChatKit Store
+ *
+ * 将 ChatKit 数据存储到 Solid Pod。
+ *
+ * 存储结构:
+ * /.data/chat/{chatId}/
+ *   index.ttl
+ *     #this                           # Chat (meeting:LongChat)
+ *     #{threadId}                     # Thread (sioc:Thread)
+ *   {yyyy}/{MM}/{dd}/messages.ttl     # Messages (meeting:Message)
+ */
+import type { ChatKitStore, StoreContext } from './store';
+import type { ThreadMetadata, ThreadItem, Attachment, Page, StoreItemType } from './types';
+import { CredentialStatus } from '../../credential/schema/types';
+export interface PodChatKitStoreOptions {
+    tokenEndpoint: string;
+}
+/**
+ * Pod-based ChatKit Store implementation
+ *
+ * 数据模型映射：
+ * - ChatKit thread = Thread (sioc:Thread)
+ * - ChatKit thread item = Message (meeting:Message)
+ * - Chat (meeting:LongChat) 是容器/Agent，通过 metadata.chat_id 暴露
+ *
+ * 每个 Thread 属于一个 Chat 容器。默认使用 'default' Chat。
+ */
+export declare class PodChatKitStore implements ChatKitStore<StoreContext> {
+    private readonly logger;
+    private readonly tokenEndpoint;
+    /** 默认 Chat 容器 ID */
+    private static readonly DEFAULT_CHAT_ID;
+    constructor(options: PodChatKitStoreOptions);
+    /**
+     * 获取认证后的 drizzle 实例 (缓存到 context 中)
+     */
+    private getDb;
+    /**
+     * 从 context 获取 webId
+     */
+    private getWebId;
+    /**
+     * 将 ThreadStatus 对象转为字符串
+     */
+    private statusToString;
+    /**
+     * 将字符串转为 ThreadStatus 对象
+     */
+    private stringToStatus;
+    /**
+     * 从 ThreadMetadata.metadata 中获取 chat_id，如果没有则返回默认值
+     */
+    private getChatIdFromMetadata;
+    /**
+     * 确保 Chat 容器存在，如果不存在则创建
+     */
+    private ensureChat;
+    /**
+     * 将 ThreadRecord 转为 ThreadMetadata
+     * 包含 metadata.chat_id 暴露 Chat 容器 ID
+     */
+    private threadRecordToMetadata;
+    /**
+     * 将 MessageRecord 转为 ThreadItem
+     * thread_id 返回 Message 所属的 Thread ID
+     */
+    private messageRecordToItem;
+    /**
+     * 从 Thread 获取 chatId（提取纯 ID）
+     */
+    private extractChatId;
+    /**
+     * 获取 Thread 的 chatId
+     * 先从缓存获取，如果没有再查询数据库
+     */
+    private getThreadChatId;
+    /**
+     * 缓存 Thread -> chatId 映射
+     */
+    private cacheThreadChatId;
+    /**
+     * 从缓存获取 Thread 的 chatId
+     */
+    private getCachedThreadChatId;
+    /**
+     * 缓存完整的 Thread metadata
+     */
+    private cacheThreadMetadata;
+    /**
+     * 从缓存获取 Thread metadata
+     */
+    private getCachedThreadMetadata;
+    generateThreadId(_context: StoreContext): string;
+    generateItemId(itemType: StoreItemType, _thread: ThreadMetadata, _context: StoreContext): string;
+    loadThread(threadId: string, context: StoreContext): Promise<ThreadMetadata>;
+    saveThread(thread: ThreadMetadata, context: StoreContext): Promise<void>;
+    loadThreads(limit: number, after: string | undefined, order: string, context: StoreContext): Promise<Page<ThreadMetadata>>;
+    deleteThread(threadId: string, context: StoreContext): Promise<void>;
+    loadThreadItems(threadId: string, after: string | undefined, limit: number, order: string, context: StoreContext): Promise<Page<ThreadItem>>;
+    addThreadItem(threadId: string, item: ThreadItem, context: StoreContext): Promise<void>;
+    private recentlyCreatedIds;
+    saveItem(threadId: string, item: ThreadItem, context: StoreContext): Promise<void>;
+    /**
+     * 直接使用 SPARQL UPDATE PATCH 更新消息内容
+     * 避免 drizzle-solid UPDATE 的 bug
+     */
+    private directPatchMessage;
+    loadItem(threadId: string, itemId: string, context: StoreContext): Promise<ThreadItem>;
+    deleteThreadItem(threadId: string, itemId: string, context: StoreContext): Promise<void>;
+    saveAttachment(attachment: Attachment, _context: StoreContext): Promise<void>;
+    loadAttachment(attachmentId: string, _context: StoreContext): Promise<Attachment>;
+    deleteAttachment(attachmentId: string, _context: StoreContext): Promise<void>;
+    /**
+     * AI 配置结果
+     */
+    static readonly AiConfigResult: {
+        new (): {
+            providerId: string;
+            baseUrl: string;
+            proxyUrl?: string;
+            apiKey: string;
+            credentialId: string;
+        };
+    };
+    /**
+     * 从 Pod 获取 AI 配置（Provider + Credential）
+     * 复用已缓存的 Session，避免重复登录
+     */
+    getAiConfig(context: StoreContext): Promise<{
+        providerId: string;
+        baseUrl: string;
+        proxyUrl?: string;
+        apiKey: string;
+        credentialId: string;
+    } | undefined>;
+    /**
+     * 更新凭据状态（如 429 限流）
+     * 复用已缓存的 Session
+     */
+    updateCredentialStatus(context: StoreContext, credentialId: string, status: CredentialStatus, options?: {
+        rateLimitResetAt?: Date;
+        incrementFailCount?: boolean;
+    }): Promise<void>;
+    /**
+     * 记录凭据使用成功（重置 failCount，更新 lastUsedAt）
+     */
+    recordCredentialSuccess(context: StoreContext, credentialId: string): Promise<void>;
+    /**
+     * 从 provider URI 提取 ID
+     * e.g., "http://localhost:3000/test/settings/ai/providers.ttl#google" -> "google"
+     */
+    private extractProviderId;
+}