@undefineds.co/xpod 0.2.0 → 0.2.2-preview.0

package/dist/cli/lib/credentials-store.d.ts

@@ -1,12 +1,21 @@
+export type AuthType = 'client_credentials' | 'oidc_oauth';
 export interface StoredConfig {
     url: string;
     webId: string;
+    authType: AuthType;
 }
-export interface StoredSecrets {
+export interface ClientCredentialsSecrets {
     clientId: string;
     clientSecret: string;
 }
-export interface StoredCredentials extends StoredConfig, StoredSecrets {
+export interface OidcOAuthSecrets {
+    oidcRefreshToken: string;
+    oidcAccessToken: string;
+    oidcExpiresAt: string;
+}
+export type StoredSecrets = ClientCredentialsSecrets | OidcOAuthSecrets;
+export interface StoredCredentials extends StoredConfig {
+    secrets: StoredSecrets;
 }
 export declare function getConfigPath(): string;
 export declare function getSecretsPath(): string;
@@ -15,3 +24,15 @@ export declare function loadConfig(): StoredConfig | null;
 export declare function loadSecrets(): StoredSecrets | null;
 export declare function loadCredentials(): StoredCredentials | null;
 export declare function clearCredentials(): void;
+export declare function isClientCredentials(secrets: StoredSecrets): secrets is ClientCredentialsSecrets;
+export declare function isOidcOAuth(secrets: StoredSecrets): secrets is OidcOAuthSecrets;
+/**
+ * Get client credentials from stored credentials.
+ * Returns null if using OAuth instead of client credentials.
+ */
+export declare function getClientCredentials(creds: StoredCredentials): ClientCredentialsSecrets | null;
+/**
+ * Get OAuth credentials from stored credentials.
+ * Returns null if using client credentials instead of OAuth.
+ */
+export declare function getOAuthCredentials(creds: StoredCredentials): OidcOAuthSecrets | null;

package/dist/cli/lib/credentials-store.js

@@ -7,6 +7,10 @@ exports.loadConfig = loadConfig;
 exports.loadSecrets = loadSecrets;
 exports.loadCredentials = loadCredentials;
 exports.clearCredentials = clearCredentials;
+exports.isClientCredentials = isClientCredentials;
+exports.isOidcOAuth = isOidcOAuth;
+exports.getClientCredentials = getClientCredentials;
+exports.getOAuthCredentials = getOAuthCredentials;
 /**
  * CLI credential storage split into two files:
  *
@@ -29,10 +33,10 @@ function saveCredentials(creds) {
     const dir = xpodDir();
     (0, fs_1.mkdirSync)(dir, { recursive: true });
     const configPath = getConfigPath();
-    (0, fs_1.writeFileSync)(configPath, JSON.stringify({ url: creds.url, webId: creds.webId }, null, 2) + '\n', 'utf-8');
+    (0, fs_1.writeFileSync)(configPath, JSON.stringify({ url: creds.url, webId: creds.webId, authType: creds.authType }, null, 2) + '\n', 'utf-8');
     (0, fs_1.chmodSync)(configPath, 0o644);
     const secretsPath = getSecretsPath();
-    (0, fs_1.writeFileSync)(secretsPath, JSON.stringify({ clientId: creds.clientId, clientSecret: creds.clientSecret }, null, 2) + '\n', 'utf-8');
+    (0, fs_1.writeFileSync)(secretsPath, JSON.stringify(creds.secrets, null, 2) + '\n', 'utf-8');
     (0, fs_1.chmodSync)(secretsPath, 0o600);
 }
 function readJson(filePath) {
@@ -46,15 +50,29 @@ function readJson(filePath) {
 function loadConfig() {
     const data = readJson(getConfigPath());
     if (data && typeof data.url === 'string' && typeof data.webId === 'string') {
-        return { url: data.url, webId: data.webId };
+        const authType = data.authType || 'client_credentials';
+        return { url: data.url, webId: data.webId, authType };
     }
     return null;
 }
 function loadSecrets() {
     const data = readJson(getSecretsPath());
-    if (data && typeof data.clientId === 'string' && typeof data.clientSecret === 'string') {
+    if (!data)
+        return null;
+    // Try Client Credentials format
+    if (typeof data.clientId === 'string' && typeof data.clientSecret === 'string') {
         return { clientId: data.clientId, clientSecret: data.clientSecret };
     }
+    // Try OIDC OAuth format
+    if (typeof data.oidcRefreshToken === 'string' &&
+        typeof data.oidcAccessToken === 'string' &&
+        typeof data.oidcExpiresAt === 'string') {
+        return {
+            oidcRefreshToken: data.oidcRefreshToken,
+            oidcAccessToken: data.oidcAccessToken,
+            oidcExpiresAt: data.oidcExpiresAt,
+        };
+    }
     return null;
 }
 function loadCredentials() {
@@ -62,7 +80,7 @@ function loadCredentials() {
     const secrets = loadSecrets();
     if (!config || !secrets)
         return null;
-    return { ...config, ...secrets };
+    return { ...config, secrets };
 }
 function clearCredentials() {
     for (const p of [getConfigPath(), getSecretsPath()]) {
@@ -70,4 +88,33 @@ function clearCredentials() {
             (0, fs_1.unlinkSync)(p);
     }
 }
+// ============================================================================
+// Helper functions for type-safe access
+// ============================================================================
+function isClientCredentials(secrets) {
+    return 'clientId' in secrets && 'clientSecret' in secrets;
+}
+function isOidcOAuth(secrets) {
+    return 'oidcRefreshToken' in secrets;
+}
+/**
+ * Get client credentials from stored credentials.
+ * Returns null if using OAuth instead of client credentials.
+ */
+function getClientCredentials(creds) {
+    if (isClientCredentials(creds.secrets)) {
+        return creds.secrets;
+    }
+    return null;
+}
+/**
+ * Get OAuth credentials from stored credentials.
+ * Returns null if using client credentials instead of OAuth.
+ */
+function getOAuthCredentials(creds) {
+    if (isOidcOAuth(creds.secrets)) {
+        return creds.secrets;
+    }
+    return null;
+}
 //# sourceMappingURL=credentials-store.js.map

package/dist/cli/lib/credentials-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"credentials-store.js","sourceRoot":"","sources":["../../../src/cli/lib/credentials-store.ts"],"names":[],"mappings":";;AA0BA,sCAEC;AAED,wCAEC;AAED,0CAWC;AAUD,gCAMC;AAED,kCAMC;AAED,0CAKC;AAED,4CAIC;AAlFD;;;;;GAKG;AACH,2BAA+F;AAC/F,+BAA4B;AAC5B,2BAA6B;AAc7B,SAAS,OAAO;IACd,OAAO,IAAA,WAAI,EAAC,IAAA,YAAO,GAAE,EAAE,OAAO,CAAC,CAAC;AAClC,CAAC;AAED,SAAgB,aAAa;IAC3B,OAAO,IAAA,WAAI,EAAC,OAAO,EAAE,EAAE,aAAa,CAAC,CAAC;AACxC,CAAC;AAED,SAAgB,cAAc;IAC5B,OAAO,IAAA,WAAI,EAAC,OAAO,EAAE,EAAE,cAAc,CAAC,CAAC;AACzC,CAAC;AAED,SAAgB,eAAe,CAAC,KAAwB;IACtD,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,IAAA,cAAS,EAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAEpC,MAAM,UAAU,GAAG,aAAa,EAAE,CAAC;IACnC,IAAA,kBAAa,EAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3G,IAAA,cAAS,EAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAE7B,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;IACrC,IAAA,kBAAa,EAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;IACpI,IAAA,cAAS,EAAC,WAAW,EAAE,KAAK,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,QAAQ,CAAI,QAAgB;IACnC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAA,iBAAY,EAAC,QAAQ,EAAE,OAAO,CAAC,CAAM,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAgB,UAAU;IACxB,MAAM,IAAI,GAAG,QAAQ,CAA0B,aAAa,EAAE,CAAC,CAAC;IAChE,IAAI,IAAI,IAAI,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC3E,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;IAC9C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAgB,WAAW;IACzB,MAAM,IAAI,GAAG,QAAQ,CAA0B,cAAc,EAAE,CAAC,CAAC;IACjE,IAAI,IAAI,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;QACvF,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC;IACtE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAgB,eAAe;IAC7B,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;IAC9B,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,EAAE,GAAG,MAAM,EAAE,GAAG,OAAO,EAAE,CAAC;AACnC,CAAC;AAED,SAAgB,gBAAgB;IAC9B,KAAK,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,cAAc,EAAE,CAAC,EAAE,CAAC;QACpD,IAAI,IAAA,eAAU,EAAC,CAAC,CAAC;YAAE,IAAA,eAAU,EAAC,CAAC,CAAC,CAAC;IACnC,CAAC;AACH,CAAC","sourcesContent":["/**\n * CLI credential storage split into two files:\n *\n *   ~/.xpod/config.json   — base config (url, webId), chmod 644\n *   ~/.xpod/secrets.json  — secrets (clientId, clientSecret), chmod 600\n */\nimport { mkdirSync, writeFileSync, readFileSync, unlinkSync, chmodSync, existsSync } from 'fs';\nimport { join } from 'path';\nimport { homedir } from 'os';\n\nexport interface StoredConfig {\n  url: string;\n  webId: string;\n}\n\nexport interface StoredSecrets {\n  clientId: string;\n  clientSecret: string;\n}\n\nexport interface StoredCredentials extends StoredConfig, StoredSecrets {}\n\nfunction xpodDir(): string {\n  return join(homedir(), '.xpod');\n}\n\nexport function getConfigPath(): string {\n  return join(xpodDir(), 'config.json');\n}\n\nexport function getSecretsPath(): string {\n  return join(xpodDir(), 'secrets.json');\n}\n\nexport function saveCredentials(creds: StoredCredentials): void {\n  const dir = xpodDir();\n  mkdirSync(dir, { recursive: true });\n\n  const configPath = getConfigPath();\n  writeFileSync(configPath, JSON.stringify({ url: creds.url, webId: creds.webId }, null, 2) + '\\n', 'utf-8');\n  chmodSync(configPath, 0o644);\n\n  const secretsPath = getSecretsPath();\n  writeFileSync(secretsPath, JSON.stringify({ clientId: creds.clientId, clientSecret: creds.clientSecret }, null, 2) + '\\n', 'utf-8');\n  chmodSync(secretsPath, 0o600);\n}\n\nfunction readJson<T>(filePath: string): T | null {\n  try {\n    return JSON.parse(readFileSync(filePath, 'utf-8')) as T;\n  } catch {\n    return null;\n  }\n}\n\nexport function loadConfig(): StoredConfig | null {\n  const data = readJson<Record<string, unknown>>(getConfigPath());\n  if (data && typeof data.url === 'string' && typeof data.webId === 'string') {\n    return { url: data.url, webId: data.webId };\n  }\n  return null;\n}\n\nexport function loadSecrets(): StoredSecrets | null {\n  const data = readJson<Record<string, unknown>>(getSecretsPath());\n  if (data && typeof data.clientId === 'string' && typeof data.clientSecret === 'string') {\n    return { clientId: data.clientId, clientSecret: data.clientSecret };\n  }\n  return null;\n}\n\nexport function loadCredentials(): StoredCredentials | null {\n  const config = loadConfig();\n  const secrets = loadSecrets();\n  if (!config || !secrets) return null;\n  return { ...config, ...secrets };\n}\n\nexport function clearCredentials(): void {\n  for (const p of [getConfigPath(), getSecretsPath()]) {\n    if (existsSync(p)) unlinkSync(p);\n  }\n}\n"]}
+{"version":3,"file":"credentials-store.js","sourceRoot":"","sources":["../../../src/cli/lib/credentials-store.ts"],"names":[],"mappings":";;AAuCA,sCAEC;AAED,wCAEC;AAED,0CAeC;AAUD,gCAOC;AAED,kCAuBC;AAED,0CAKC;AAED,4CAIC;AAMD,kDAEC;AAED,kCAEC;AAMD,oDAKC;AAMD,kDAKC;AAvJD;;;;;GAKG;AACH,2BAA+F;AAC/F,+BAA4B;AAC5B,2BAA6B;AA2B7B,SAAS,OAAO;IACd,OAAO,IAAA,WAAI,EAAC,IAAA,YAAO,GAAE,EAAE,OAAO,CAAC,CAAC;AAClC,CAAC;AAED,SAAgB,aAAa;IAC3B,OAAO,IAAA,WAAI,EAAC,OAAO,EAAE,EAAE,aAAa,CAAC,CAAC;AACxC,CAAC;AAED,SAAgB,cAAc;IAC5B,OAAO,IAAA,WAAI,EAAC,OAAO,EAAE,EAAE,cAAc,CAAC,CAAC;AACzC,CAAC;AAED,SAAgB,eAAe,CAAC,KAAwB;IACtD,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,IAAA,cAAS,EAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAEpC,MAAM,UAAU,GAAG,aAAa,EAAE,CAAC;IACnC,IAAA,kBAAa,EACX,UAAU,EACV,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAChG,OAAO,CACR,CAAC;IACF,IAAA,cAAS,EAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAE7B,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;IACrC,IAAA,kBAAa,EAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;IACnF,IAAA,cAAS,EAAC,WAAW,EAAE,KAAK,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,QAAQ,CAAI,QAAgB;IACnC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAA,iBAAY,EAAC,QAAQ,EAAE,OAAO,CAAC,CAAM,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAgB,UAAU;IACxB,MAAM,IAAI,GAAG,QAAQ,CAA0B,aAAa,EAAE,CAAC,CAAC;IAChE,IAAI,IAAI,IAAI,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC3E,MAAM,QAAQ,GAAI,IAAI,CAAC,QAAqB,IAAI,oBAAoB,CAAC;QACrE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,CAAC;IACxD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAgB,WAAW;IACzB,MAAM,IAAI,GAAG,QAAQ,CAA0B,cAAc,EAAE,CAAC,CAAC;IACjE,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,gCAAgC;IAChC,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;QAC/E,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC;IACtE,CAAC;IAED,wBAAwB;IACxB,IACE,OAAO,IAAI,CAAC,gBAAgB,KAAK,QAAQ;QACzC,OAAO,IAAI,CAAC,eAAe,KAAK,QAAQ;QACxC,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ,EACtC,CAAC;QACD,OAAO;YACL,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,aAAa,EAAE,IAAI,CAAC,aAAa;SAClC,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAgB,eAAe;IAC7B,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;IAC9B,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,CAAC;AAChC,CAAC;AAED,SAAgB,gBAAgB;IAC9B,KAAK,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,cAAc,EAAE,CAAC,EAAE,CAAC;QACpD,IAAI,IAAA,eAAU,EAAC,CAAC,CAAC;YAAE,IAAA,eAAU,EAAC,CAAC,CAAC,CAAC;IACnC,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,wCAAwC;AACxC,+EAA+E;AAE/E,SAAgB,mBAAmB,CAAC,OAAsB;IACxD,OAAO,UAAU,IAAI,OAAO,IAAI,cAAc,IAAI,OAAO,CAAC;AAC5D,CAAC;AAED,SAAgB,WAAW,CAAC,OAAsB;IAChD,OAAO,kBAAkB,IAAI,OAAO,CAAC;AACvC,CAAC;AAED;;;GAGG;AACH,SAAgB,oBAAoB,CAAC,KAAwB;IAC3D,IAAI,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,OAAO,KAAK,CAAC,OAAO,CAAC;IACvB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,SAAgB,mBAAmB,CAAC,KAAwB;IAC1D,IAAI,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC,OAAO,CAAC;IACvB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC","sourcesContent":["/**\n * CLI credential storage split into two files:\n *\n *   ~/.xpod/config.json   — base config (url, webId), chmod 644\n *   ~/.xpod/secrets.json  — secrets (clientId, clientSecret), chmod 600\n */\nimport { mkdirSync, writeFileSync, readFileSync, unlinkSync, chmodSync, existsSync } from 'fs';\nimport { join } from 'path';\nimport { homedir } from 'os';\n\nexport type AuthType = 'client_credentials' | 'oidc_oauth';\n\nexport interface StoredConfig {\n  url: string;\n  webId: string;\n  authType: AuthType;\n}\n\nexport interface ClientCredentialsSecrets {\n  clientId: string;\n  clientSecret: string;\n}\n\nexport interface OidcOAuthSecrets {\n  oidcRefreshToken: string;\n  oidcAccessToken: string;\n  oidcExpiresAt: string;\n}\n\nexport type StoredSecrets = ClientCredentialsSecrets | OidcOAuthSecrets;\n\nexport interface StoredCredentials extends StoredConfig {\n  secrets: StoredSecrets;\n}\n\nfunction xpodDir(): string {\n  return join(homedir(), '.xpod');\n}\n\nexport function getConfigPath(): string {\n  return join(xpodDir(), 'config.json');\n}\n\nexport function getSecretsPath(): string {\n  return join(xpodDir(), 'secrets.json');\n}\n\nexport function saveCredentials(creds: StoredCredentials): void {\n  const dir = xpodDir();\n  mkdirSync(dir, { recursive: true });\n\n  const configPath = getConfigPath();\n  writeFileSync(\n    configPath,\n    JSON.stringify({ url: creds.url, webId: creds.webId, authType: creds.authType }, null, 2) + '\\n',\n    'utf-8'\n  );\n  chmodSync(configPath, 0o644);\n\n  const secretsPath = getSecretsPath();\n  writeFileSync(secretsPath, JSON.stringify(creds.secrets, null, 2) + '\\n', 'utf-8');\n  chmodSync(secretsPath, 0o600);\n}\n\nfunction readJson<T>(filePath: string): T | null {\n  try {\n    return JSON.parse(readFileSync(filePath, 'utf-8')) as T;\n  } catch {\n    return null;\n  }\n}\n\nexport function loadConfig(): StoredConfig | null {\n  const data = readJson<Record<string, unknown>>(getConfigPath());\n  if (data && typeof data.url === 'string' && typeof data.webId === 'string') {\n    const authType = (data.authType as AuthType) || 'client_credentials';\n    return { url: data.url, webId: data.webId, authType };\n  }\n  return null;\n}\n\nexport function loadSecrets(): StoredSecrets | null {\n  const data = readJson<Record<string, unknown>>(getSecretsPath());\n  if (!data) return null;\n\n  // Try Client Credentials format\n  if (typeof data.clientId === 'string' && typeof data.clientSecret === 'string') {\n    return { clientId: data.clientId, clientSecret: data.clientSecret };\n  }\n\n  // Try OIDC OAuth format\n  if (\n    typeof data.oidcRefreshToken === 'string' &&\n    typeof data.oidcAccessToken === 'string' &&\n    typeof data.oidcExpiresAt === 'string'\n  ) {\n    return {\n      oidcRefreshToken: data.oidcRefreshToken,\n      oidcAccessToken: data.oidcAccessToken,\n      oidcExpiresAt: data.oidcExpiresAt,\n    };\n  }\n\n  return null;\n}\n\nexport function loadCredentials(): StoredCredentials | null {\n  const config = loadConfig();\n  const secrets = loadSecrets();\n  if (!config || !secrets) return null;\n  return { ...config, secrets };\n}\n\nexport function clearCredentials(): void {\n  for (const p of [getConfigPath(), getSecretsPath()]) {\n    if (existsSync(p)) unlinkSync(p);\n  }\n}\n\n// ============================================================================\n// Helper functions for type-safe access\n// ============================================================================\n\nexport function isClientCredentials(secrets: StoredSecrets): secrets is ClientCredentialsSecrets {\n  return 'clientId' in secrets && 'clientSecret' in secrets;\n}\n\nexport function isOidcOAuth(secrets: StoredSecrets): secrets is OidcOAuthSecrets {\n  return 'oidcRefreshToken' in secrets;\n}\n\n/**\n * Get client credentials from stored credentials.\n * Returns null if using OAuth instead of client credentials.\n */\nexport function getClientCredentials(creds: StoredCredentials): ClientCredentialsSecrets | null {\n  if (isClientCredentials(creds.secrets)) {\n    return creds.secrets;\n  }\n  return null;\n}\n\n/**\n * Get OAuth credentials from stored credentials.\n * Returns null if using client credentials instead of OAuth.\n */\nexport function getOAuthCredentials(creds: StoredCredentials): OidcOAuthSecrets | null {\n  if (isOidcOAuth(creds.secrets)) {\n    return creds.secrets;\n  }\n  return null;\n}\n"]}

package/dist/cli/lib/ensure-ai-credentials.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Ensure AI credentials helper
+ *
+ * 在 agent 启动前检查是否有 AI credentials，如果没有则提示用户登录。
+ */
+import type { Session } from '@inrupt/solid-client-authn-node';
+/**
+ * 确保用户有 AI credentials，如果没有则提示
+ *
+ * @param session - Solid session
+ * @returns true if credentials exist, false if user skipped setup
+ */
+export declare function ensureAiCredentials(session: Session): Promise<boolean>;

package/dist/cli/lib/ensure-ai-credentials.js

@@ -0,0 +1,40 @@
+"use strict";
+/**
+ * Ensure AI credentials helper
+ *
+ * 在 agent 启动前检查是否有 AI credentials，如果没有则提示用户登录。
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ensureAiCredentials = ensureAiCredentials;
+const pod_ai_config_1 = require("./pod-ai-config");
+const prompt_1 = require("./prompt");
+/**
+ * 确保用户有 AI credentials，如果没有则提示
+ *
+ * @param session - Solid session
+ * @returns true if credentials exist, false if user skipped setup
+ */
+async function ensureAiCredentials(session) {
+    // 检查是否已有 AI credentials
+    const existingConfig = await (0, pod_ai_config_1.loadPodAiConfig)(session);
+    if (existingConfig) {
+        return true; // 已有配置，直接返回
+    }
+    // 没有配置，提示用户
+    console.log('\n💡 No AI credentials found in your Pod.');
+    console.log('The agent will use the platform default provider.');
+    console.log('');
+    console.log('To use your own AI provider, you can:');
+    console.log('  • Run: xpod login codebuddy');
+    console.log('  • Run: xpod config set --provider openai --api-key YOUR_KEY');
+    console.log('');
+    const choice = await (0, prompt_1.promptText)('Continue with default provider? (Y/n): ');
+    if (choice.toLowerCase() === 'n') {
+        console.log('\nPlease configure an AI provider first:');
+        console.log('  xpod login codebuddy');
+        console.log('  xpod config set --provider openai --api-key YOUR_KEY\n');
+        return false;
+    }
+    return true; // 用户选择继续使用默认 provider
+}
+//# sourceMappingURL=ensure-ai-credentials.js.map

package/dist/cli/lib/ensure-ai-credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ensure-ai-credentials.js","sourceRoot":"","sources":["../../../src/cli/lib/ensure-ai-credentials.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;AAYH,kDA0BC;AAnCD,mDAAkD;AAClD,qCAAsC;AAEtC;;;;;GAKG;AACI,KAAK,UAAU,mBAAmB,CAAC,OAAgB;IACxD,wBAAwB;IACxB,MAAM,cAAc,GAAG,MAAM,IAAA,+BAAe,EAAC,OAAO,CAAC,CAAC;IACtD,IAAI,cAAc,EAAE,CAAC;QACnB,OAAO,IAAI,CAAC,CAAC,YAAY;IAC3B,CAAC;IAED,YAAY;IACZ,OAAO,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC;IACzD,OAAO,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAC;IACjE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC;IACrD,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;IAC7C,OAAO,CAAC,GAAG,CAAC,+DAA+D,CAAC,CAAC;IAC7E,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhB,MAAM,MAAM,GAAG,MAAM,IAAA,mBAAU,EAAC,yCAAyC,CAAC,CAAC;IAE3E,IAAI,MAAM,CAAC,WAAW,EAAE,KAAK,GAAG,EAAE,CAAC;QACjC,OAAO,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC;QACxD,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;QACtC,OAAO,CAAC,GAAG,CAAC,0DAA0D,CAAC,CAAC;QACxE,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,IAAI,CAAC,CAAC,sBAAsB;AACrC,CAAC","sourcesContent":["/**\n * Ensure AI credentials helper\n *\n * 在 agent 启动前检查是否有 AI credentials，如果没有则提示用户登录。\n */\n\nimport type { Session } from '@inrupt/solid-client-authn-node';\nimport { loadPodAiConfig } from './pod-ai-config';\nimport { promptText } from './prompt';\n\n/**\n * 确保用户有 AI credentials，如果没有则提示\n *\n * @param session - Solid session\n * @returns true if credentials exist, false if user skipped setup\n */\nexport async function ensureAiCredentials(session: Session): Promise<boolean> {\n  // 检查是否已有 AI credentials\n  const existingConfig = await loadPodAiConfig(session);\n  if (existingConfig) {\n    return true; // 已有配置，直接返回\n  }\n\n  // 没有配置，提示用户\n  console.log('\\n💡 No AI credentials found in your Pod.');\n  console.log('The agent will use the platform default provider.');\n  console.log('');\n  console.log('To use your own AI provider, you can:');\n  console.log('  • Run: xpod login codebuddy');\n  console.log('  • Run: xpod config set --provider openai --api-key YOUR_KEY');\n  console.log('');\n\n  const choice = await promptText('Continue with default provider? (Y/n): ');\n\n  if (choice.toLowerCase() === 'n') {\n    console.log('\\nPlease configure an AI provider first:');\n    console.log('  xpod login codebuddy');\n    console.log('  xpod config set --provider openai --api-key YOUR_KEY\\n');\n    return false;\n  }\n\n  return true; // 用户选择继续使用默认 provider\n}\n"]}

package/dist/cli/lib/import/db-connector.js

@@ -9,6 +9,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.connectDb = connectDb;
 exports.detectDbType = detectDbType;
 const pg_1 = require("pg");
+const SqliteRuntime_1 = require("../../../storage/SqliteRuntime");
 /**
  * Connect to a database and return a unified DbConnection.
  */
@@ -19,7 +20,7 @@ async function connectDb(source) {
         case 'sqlite':
             if (source.encryption) {
                 throw new Error('Encrypted SQLite is not yet supported. ' +
-                    'Install better-sqlite3-multiple-ciphers and update db-connector.ts.');
+                    'Add an encrypted SQLite runtime backend before enabling this path.');
             }
             return connectSqlite(source.connectionString);
         default:
@@ -48,13 +49,11 @@ async function connectPostgres(connectionString) {
 // SQLite
 // ============================================
 async function connectSqlite(filePath) {
-    // eslint-disable-next-line @typescript-eslint/no-require-imports
-    const Database = require('better-sqlite3');
-    const db = new Database(filePath, { readonly: true });
+    const sqliteRuntime = (0, SqliteRuntime_1.getSqliteRuntime)();
+    const db = sqliteRuntime.openDatabase(filePath, { readonly: true });
     return {
         async *query(sql) {
-            const stmt = db.prepare(sql);
-            for (const row of stmt.iterate()) {
+            for (const row of db.prepare(sql).iterate()) {
                 yield row;
             }
         },

package/dist/cli/lib/import/db-connector.js.map

@@ -1 +1 @@
-{"version":3,"file":"db-connector.js","sourceRoot":"","sources":["../../../../src/cli/lib/import/db-connector.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;AAQH,8BAeC;AAmDD,oCAKC;AA7ED,2BAAwC;AAGxC;;GAEG;AACI,KAAK,UAAU,SAAS,CAAC,MAAgB;IAC9C,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,UAAU;YACb,OAAO,eAAe,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAClD,KAAK,QAAQ;YACX,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;gBACtB,MAAM,IAAI,KAAK,CACb,yCAAyC;oBACzC,qEAAqE,CACtE,CAAC;YACJ,CAAC;YACD,OAAO,aAAa,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAChD;YACE,MAAM,IAAI,KAAK,CAAC,8BAA8B,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACjE,CAAC;AACH,CAAC;AAED,+CAA+C;AAC/C,aAAa;AACb,+CAA+C;AAE/C,KAAK,UAAU,eAAe,CAAC,gBAAwB;IACrD,MAAM,MAAM,GAAG,IAAI,WAAQ,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAClD,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;IAEvB,OAAO;QACL,KAAK,CAAC,CAAC,KAAK,CAAC,GAAW;YACtB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACvC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;gBAC9B,MAAM,GAAU,CAAC;YACnB,CAAC;QACH,CAAC;QACD,KAAK,CAAC,KAAK;YACT,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC;QACrB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,+CAA+C;AAC/C,SAAS;AACT,+CAA+C;AAE/C,KAAK,UAAU,aAAa,CAAC,QAAgB;IAC3C,iEAAiE;IACjE,MAAM,QAAQ,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC3C,MAAM,EAAE,GAAG,IAAI,QAAQ,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAEtD,OAAO;QACL,KAAK,CAAC,CAAC,KAAK,CAAC,GAAW;YACtB,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC7B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;gBACjC,MAAM,GAAU,CAAC;YACnB,CAAC;QACH,CAAC;QACD,KAAK,CAAC,KAAK;YACT,EAAE,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;QAC3B,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAgB,YAAY,CAAC,gBAAwB;IACnD,IAAI,gBAAgB,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,gBAAgB,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;QAC/F,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC","sourcesContent":["/**\n * Unified database connector for PostgreSQL and SQLite.\n *\n * Provides a common async-iterable interface over query results.\n * Encrypted SQLite support is stubbed for future implementation.\n */\n\nimport { Client as PgClient } from 'pg';\nimport type { DbConnection, DbSource, Row } from './types';\n\n/**\n * Connect to a database and return a unified DbConnection.\n */\nexport async function connectDb(source: DbSource): Promise<DbConnection> {\n  switch (source.type) {\n    case 'postgres':\n      return connectPostgres(source.connectionString);\n    case 'sqlite':\n      if (source.encryption) {\n        throw new Error(\n          'Encrypted SQLite is not yet supported. ' +\n          'Install better-sqlite3-multiple-ciphers and update db-connector.ts.',\n        );\n      }\n      return connectSqlite(source.connectionString);\n    default:\n      throw new Error(`Unsupported database type: ${source.type}`);\n  }\n}\n\n// ============================================\n// PostgreSQL\n// ============================================\n\nasync function connectPostgres(connectionString: string): Promise<DbConnection> {\n  const client = new PgClient({ connectionString });\n  await client.connect();\n\n  return {\n    async *query(sql: string): AsyncIterable<Row> {\n      const result = await client.query(sql);\n      for (const row of result.rows) {\n        yield row as Row;\n      }\n    },\n    async close() {\n      await client.end();\n    },\n  };\n}\n\n// ============================================\n// SQLite\n// ============================================\n\nasync function connectSqlite(filePath: string): Promise<DbConnection> {\n  // eslint-disable-next-line @typescript-eslint/no-require-imports\n  const Database = require('better-sqlite3');\n  const db = new Database(filePath, { readonly: true });\n\n  return {\n    async *query(sql: string): AsyncIterable<Row> {\n      const stmt = db.prepare(sql);\n      for (const row of stmt.iterate()) {\n        yield row as Row;\n      }\n    },\n    async close() {\n      db.close();\n      return Promise.resolve();\n    },\n  };\n}\n\n/**\n * Detect database type from a connection string.\n * - Starts with \"postgres://\" or \"postgresql://\" → postgres\n * - Otherwise → sqlite (treat as file path)\n */\nexport function detectDbType(connectionString: string): DbSource['type'] {\n  if (connectionString.startsWith('postgres://') || connectionString.startsWith('postgresql://')) {\n    return 'postgres';\n  }\n  return 'sqlite';\n}\n"]}
+{"version":3,"file":"db-connector.js","sourceRoot":"","sources":["../../../../src/cli/lib/import/db-connector.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;AASH,8BAeC;AAiDD,oCAKC;AA5ED,2BAAwC;AAExC,kEAAkE;AAElE;;GAEG;AACI,KAAK,UAAU,SAAS,CAAC,MAAgB;IAC9C,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,UAAU;YACb,OAAO,eAAe,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAClD,KAAK,QAAQ;YACX,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;gBACtB,MAAM,IAAI,KAAK,CACb,yCAAyC;oBACzC,oEAAoE,CACrE,CAAC;YACJ,CAAC;YACD,OAAO,aAAa,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAChD;YACE,MAAM,IAAI,KAAK,CAAC,8BAA8B,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACjE,CAAC;AACH,CAAC;AAED,+CAA+C;AAC/C,aAAa;AACb,+CAA+C;AAE/C,KAAK,UAAU,eAAe,CAAC,gBAAwB;IACrD,MAAM,MAAM,GAAG,IAAI,WAAQ,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAClD,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;IAEvB,OAAO;QACL,KAAK,CAAC,CAAC,KAAK,CAAC,GAAW;YACtB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACvC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;gBAC9B,MAAM,GAAU,CAAC;YACnB,CAAC;QACH,CAAC;QACD,KAAK,CAAC,KAAK;YACT,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC;QACrB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,+CAA+C;AAC/C,SAAS;AACT,+CAA+C;AAE/C,KAAK,UAAU,aAAa,CAAC,QAAgB;IAC3C,MAAM,aAAa,GAAG,IAAA,gCAAgB,GAAE,CAAC;IACzC,MAAM,EAAE,GAAG,aAAa,CAAC,YAAY,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAEpE,OAAO;QACL,KAAK,CAAC,CAAC,KAAK,CAAC,GAAW;YACtB,KAAK,MAAM,GAAG,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;gBAC5C,MAAM,GAAU,CAAC;YACnB,CAAC;QACH,CAAC;QACD,KAAK,CAAC,KAAK;YACT,EAAE,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;QAC3B,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAgB,YAAY,CAAC,gBAAwB;IACnD,IAAI,gBAAgB,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,gBAAgB,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;QAC/F,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC","sourcesContent":["/**\n * Unified database connector for PostgreSQL and SQLite.\n *\n * Provides a common async-iterable interface over query results.\n * Encrypted SQLite support is stubbed for future implementation.\n */\n\nimport { Client as PgClient } from 'pg';\nimport type { DbConnection, DbSource, Row } from './types';\nimport { getSqliteRuntime } from '../../../storage/SqliteRuntime';\n\n/**\n * Connect to a database and return a unified DbConnection.\n */\nexport async function connectDb(source: DbSource): Promise<DbConnection> {\n  switch (source.type) {\n    case 'postgres':\n      return connectPostgres(source.connectionString);\n    case 'sqlite':\n      if (source.encryption) {\n        throw new Error(\n          'Encrypted SQLite is not yet supported. ' +\n          'Add an encrypted SQLite runtime backend before enabling this path.',\n        );\n      }\n      return connectSqlite(source.connectionString);\n    default:\n      throw new Error(`Unsupported database type: ${source.type}`);\n  }\n}\n\n// ============================================\n// PostgreSQL\n// ============================================\n\nasync function connectPostgres(connectionString: string): Promise<DbConnection> {\n  const client = new PgClient({ connectionString });\n  await client.connect();\n\n  return {\n    async *query(sql: string): AsyncIterable<Row> {\n      const result = await client.query(sql);\n      for (const row of result.rows) {\n        yield row as Row;\n      }\n    },\n    async close() {\n      await client.end();\n    },\n  };\n}\n\n// ============================================\n// SQLite\n// ============================================\n\nasync function connectSqlite(filePath: string): Promise<DbConnection> {\n  const sqliteRuntime = getSqliteRuntime();\n  const db = sqliteRuntime.openDatabase(filePath, { readonly: true });\n\n  return {\n    async *query(sql: string): AsyncIterable<Row> {\n      for (const row of db.prepare(sql).iterate()) {\n        yield row as Row;\n      }\n    },\n    async close() {\n      db.close();\n      return Promise.resolve();\n    },\n  };\n}\n\n/**\n * Detect database type from a connection string.\n * - Starts with \"postgres://\" or \"postgresql://\" → postgres\n * - Otherwise → sqlite (treat as file path)\n */\nexport function detectDbType(connectionString: string): DbSource['type'] {\n  if (connectionString.startsWith('postgres://') || connectionString.startsWith('postgresql://')) {\n    return 'postgres';\n  }\n  return 'sqlite';\n}\n"]}

package/dist/cli/lib/import/pod-writer.d.ts

@@ -2,8 +2,8 @@
  * Write Turtle data to a Solid Pod.
  *
  * Supports two granularity modes:
- * - per-table: PUT the entire Turtle string as a single resource
- * - per-row:   PUT each row as a separate .ttl resource under a container
+ * - document: all triples in one resource
+ * - fragment: one resource per subject
  *
  * Reuses css-account.ts for authentication.
  */

package/dist/cli/lib/import/pod-writer.js

@@ -3,8 +3,8 @@
  * Write Turtle data to a Solid Pod.
  *
  * Supports two granularity modes:
- * - per-table: PUT the entire Turtle string as a single resource
- * - per-row:   PUT each row as a separate .ttl resource under a container
+ * - document: all triples in one resource
+ * - fragment: one resource per subject
  *
  * Reuses css-account.ts for authentication.
  */

package/dist/cli/lib/import/pod-writer.js.map

@@ -1 +1 @@
-{"version":3,"file":"pod-writer.js","sourceRoot":"","sources":["../../../../src/cli/lib/import/pod-writer.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;AAkBH,gCAiCC;AAKD,8BAoBC;AA1ED,gDAAoD;AAapD;;GAEG;AACI,KAAK,UAAU,UAAU,CAAC,IAAa;IAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,OAAO,GAAG,CAAC;IAE/E,IAAI,CAAC,CAAC,MAAM,IAAA,yBAAW,EAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,0BAA0B,OAAO,EAAE,CAAC,CAAC;IACvD,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,IAAA,mBAAK,EAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC9D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IAED,oCAAoC;IACpC,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,WAAW,EAAE;QACpD,OAAO,EAAE;YACP,MAAM,EAAE,kBAAkB;YAC1B,aAAa,EAAE,qBAAqB,KAAK,EAAE;SAC5C;KACF,CAAC,CAAC;IAEH,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IAED,MAAM,WAAW,GAAG,CAAC,MAAM,UAAU,CAAC,IAAI,EAAE,CAAsC,CAAC;IACnF,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC;IAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAEzD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAC3B,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,SAAS,CAC7B,GAAe,EACf,UAAkB,EAClB,MAAc;IAEd,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC;IAE5D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAC3B,MAAM,EAAE,KAAK;QACb,OAAO,EAAE;YACP,cAAc,EAAE,aAAa;YAC7B,aAAa,EAAE,qBAAqB,GAAG,CAAC,KAAK,EAAE;SAChD;QACD,IAAI,EAAE,MAAM;KACb,CAAC,CAAC;IAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,OAAO,GAAG,YAAY,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAC5E,CAAC;AACH,CAAC","sourcesContent":["/**\n * Write Turtle data to a Solid Pod.\n *\n * Supports two granularity modes:\n * - per-table: PUT the entire Turtle string as a single resource\n * - per-row:   PUT each row as a separate .ttl resource under a container\n *\n * Reuses css-account.ts for authentication.\n */\n\nimport { login, checkServer } from '../css-account';\n\nexport interface PodAuth {\n  baseUrl: string;\n  email: string;\n  password: string;\n}\n\ninterface PodContext {\n  token: string;\n  podUrl: string;\n}\n\n/**\n * Authenticate and resolve the Pod URL.\n */\nexport async function resolvePod(auth: PodAuth): Promise<PodContext> {\n  const baseUrl = auth.baseUrl.endsWith('/') ? auth.baseUrl : `${auth.baseUrl}/`;\n\n  if (!(await checkServer(baseUrl))) {\n    throw new Error(`Cannot reach server at ${baseUrl}`);\n  }\n\n  const token = await login(auth.email, auth.password, baseUrl);\n  if (!token) {\n    throw new Error('Login failed. Check email/password.');\n  }\n\n  // Resolve pod URL from account info\n  const accountRes = await fetch(`${baseUrl}.account/`, {\n    headers: {\n      Accept: 'application/json',\n      Authorization: `CSS-Account-Token ${token}`,\n    },\n  });\n\n  if (!accountRes.ok) {\n    throw new Error('Failed to get account info.');\n  }\n\n  const accountData = (await accountRes.json()) as { pods?: Record<string, string> };\n  const pods = accountData.pods;\n  const podUrl = pods ? Object.values(pods)[0] : undefined;\n\n  if (!podUrl) {\n    throw new Error('No pod found for this account.');\n  }\n\n  return { token, podUrl };\n}\n\n/**\n * PUT a Turtle document to a Pod resource path.\n */\nexport async function putTurtle(\n  ctx: PodContext,\n  targetPath: string,\n  turtle: string,\n): Promise<void> {\n  const url = `${ctx.podUrl}${targetPath.replace(/^\\//, '')}`;\n\n  const res = await fetch(url, {\n    method: 'PUT',\n    headers: {\n      'Content-Type': 'text/turtle',\n      Authorization: `CSS-Account-Token ${ctx.token}`,\n    },\n    body: turtle,\n  });\n\n  if (!res.ok) {\n    const text = await res.text();\n    throw new Error(`PUT ${url} failed: ${res.status} ${text.slice(0, 200)}`);\n  }\n}\n"]}
+{"version":3,"file":"pod-writer.js","sourceRoot":"","sources":["../../../../src/cli/lib/import/pod-writer.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;AAkBH,gCAiCC;AAKD,8BAoBC;AA1ED,gDAAoD;AAapD;;GAEG;AACI,KAAK,UAAU,UAAU,CAAC,IAAa;IAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,OAAO,GAAG,CAAC;IAE/E,IAAI,CAAC,CAAC,MAAM,IAAA,yBAAW,EAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,0BAA0B,OAAO,EAAE,CAAC,CAAC;IACvD,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,IAAA,mBAAK,EAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC9D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IAED,oCAAoC;IACpC,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,WAAW,EAAE;QACpD,OAAO,EAAE;YACP,MAAM,EAAE,kBAAkB;YAC1B,aAAa,EAAE,qBAAqB,KAAK,EAAE;SAC5C;KACF,CAAC,CAAC;IAEH,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IAED,MAAM,WAAW,GAAG,CAAC,MAAM,UAAU,CAAC,IAAI,EAAE,CAAsC,CAAC;IACnF,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC;IAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAEzD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAC3B,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,SAAS,CAC7B,GAAe,EACf,UAAkB,EAClB,MAAc;IAEd,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC;IAE5D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAC3B,MAAM,EAAE,KAAK;QACb,OAAO,EAAE;YACP,cAAc,EAAE,aAAa;YAC7B,aAAa,EAAE,qBAAqB,GAAG,CAAC,KAAK,EAAE;SAChD;QACD,IAAI,EAAE,MAAM;KACb,CAAC,CAAC;IAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,OAAO,GAAG,YAAY,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAC5E,CAAC;AACH,CAAC","sourcesContent":["/**\n * Write Turtle data to a Solid Pod.\n *\n * Supports two granularity modes:\n * - document: all triples in one resource\n * - fragment: one resource per subject\n *\n * Reuses css-account.ts for authentication.\n */\n\nimport { login, checkServer } from '../css-account';\n\nexport interface PodAuth {\n  baseUrl: string;\n  email: string;\n  password: string;\n}\n\ninterface PodContext {\n  token: string;\n  podUrl: string;\n}\n\n/**\n * Authenticate and resolve the Pod URL.\n */\nexport async function resolvePod(auth: PodAuth): Promise<PodContext> {\n  const baseUrl = auth.baseUrl.endsWith('/') ? auth.baseUrl : `${auth.baseUrl}/`;\n\n  if (!(await checkServer(baseUrl))) {\n    throw new Error(`Cannot reach server at ${baseUrl}`);\n  }\n\n  const token = await login(auth.email, auth.password, baseUrl);\n  if (!token) {\n    throw new Error('Login failed. Check email/password.');\n  }\n\n  // Resolve pod URL from account info\n  const accountRes = await fetch(`${baseUrl}.account/`, {\n    headers: {\n      Accept: 'application/json',\n      Authorization: `CSS-Account-Token ${token}`,\n    },\n  });\n\n  if (!accountRes.ok) {\n    throw new Error('Failed to get account info.');\n  }\n\n  const accountData = (await accountRes.json()) as { pods?: Record<string, string> };\n  const pods = accountData.pods;\n  const podUrl = pods ? Object.values(pods)[0] : undefined;\n\n  if (!podUrl) {\n    throw new Error('No pod found for this account.');\n  }\n\n  return { token, podUrl };\n}\n\n/**\n * PUT a Turtle document to a Pod resource path.\n */\nexport async function putTurtle(\n  ctx: PodContext,\n  targetPath: string,\n  turtle: string,\n): Promise<void> {\n  const url = `${ctx.podUrl}${targetPath.replace(/^\\//, '')}`;\n\n  const res = await fetch(url, {\n    method: 'PUT',\n    headers: {\n      'Content-Type': 'text/turtle',\n      Authorization: `CSS-Account-Token ${ctx.token}`,\n    },\n    body: turtle,\n  });\n\n  if (!res.ok) {\n    const text = await res.text();\n    throw new Error(`PUT ${url} failed: ${res.status} ${text.slice(0, 200)}`);\n  }\n}\n"]}

package/dist/cli/lib/import/types.d.ts

@@ -51,15 +51,10 @@ export type DbType = 'postgres' | 'sqlite';
 export interface DbSource {
     type: DbType;
     connectionString: string;
-    encryption?: {
-        cipher: string;
-        key: string;
-    };
+    encryption?: unknown;
 }
-export type Granularity = 'per-table' | 'per-row';
 export interface ImportOptions {
     dryRun: boolean;
-    granularity: Granularity;
     baseIri?: string;
     /** Target path inside the Pod (e.g. "data/contacts.ttl") */
     targetPath: string;

package/dist/cli/lib/import/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../src/cli/lib/import/types.ts"],"names":[],"mappings":";AAAA;;;;GAIG","sourcesContent":["/**\n * Core types for the xpod import pipeline.\n *\n * Based on R2RML (rr:) with udfs: namespace extensions for filtering.\n */\n\n// ============================================\n// Mapping types\n// ============================================\n\nexport interface ObjectMap {\n  column?: string;\n  template?: string;\n  constant?: string;\n  datatype?: string;\n  language?: string;\n}\n\nexport interface PredicateObjectMap {\n  predicate: string;\n  objectMap: ObjectMap;\n}\n\nexport interface SubjectMap {\n  template: string;\n  class?: string;\n}\n\nexport interface LogicalTable {\n  tableName?: string;\n  sqlQuery?: string;\n}\n\nexport interface FilterWhitelistEntry {\n  column: string;\n  values: string[];\n}\n\nexport interface FilterBlacklistEntry {\n  column: string;\n  values: string[];\n}\n\nexport interface FilterTimeRange {\n  column: string;\n  after?: string;\n  before?: string;\n}\n\nexport interface Filters {\n  whitelist?: FilterWhitelistEntry[];\n  blacklist?: FilterBlacklistEntry[];\n  timeRange?: FilterTimeRange;\n}\n\nexport interface TriplesMap {\n  id: string;\n  logicalTable: LogicalTable;\n  subjectMap: SubjectMap;\n  predicateObjectMaps: PredicateObjectMap[];\n  filters?: Filters;\n}\n\n// ============================================\n// Data source types\n// ============================================\n\nexport type DbType = 'postgres' | 'sqlite';\n\nexport interface DbSource {\n  type: DbType;\n  connectionString: string;\n  encryption?: {\n    cipher: string;\n    key: string;\n  };\n}\n\n// ============================================\n// Import configuration\n// ============================================\n\nexport type Granularity = 'per-table' | 'per-row';\n\nexport interface ImportOptions {\n  dryRun: boolean;\n  granularity: Granularity;\n  baseIri?: string;\n  /** Target path inside the Pod (e.g. \"data/contacts.ttl\") */\n  targetPath: string;\n}\n\n/** A single row returned from a database query */\nexport type Row = Record<string, unknown>;\n\n/** Unified database connection interface */\nexport interface DbConnection {\n  query(sql: string): AsyncIterable<Row>;\n  close(): Promise<void>;\n}\n"]}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../src/cli/lib/import/types.ts"],"names":[],"mappings":";AAAA;;;;GAIG","sourcesContent":["/**\n * Core types for the xpod import pipeline.\n *\n * Based on R2RML (rr:) with udfs: namespace extensions for filtering.\n */\n\n// ============================================\n// Mapping types\n// ============================================\n\nexport interface ObjectMap {\n  column?: string;\n  template?: string;\n  constant?: string;\n  datatype?: string;\n  language?: string;\n}\n\nexport interface PredicateObjectMap {\n  predicate: string;\n  objectMap: ObjectMap;\n}\n\nexport interface SubjectMap {\n  template: string;\n  class?: string;\n}\n\nexport interface LogicalTable {\n  tableName?: string;\n  sqlQuery?: string;\n}\n\nexport interface FilterWhitelistEntry {\n  column: string;\n  values: string[];\n}\n\nexport interface FilterBlacklistEntry {\n  column: string;\n  values: string[];\n}\n\nexport interface FilterTimeRange {\n  column: string;\n  after?: string;\n  before?: string;\n}\n\nexport interface Filters {\n  whitelist?: FilterWhitelistEntry[];\n  blacklist?: FilterBlacklistEntry[];\n  timeRange?: FilterTimeRange;\n}\n\nexport interface TriplesMap {\n  id: string;\n  logicalTable: LogicalTable;\n  subjectMap: SubjectMap;\n  predicateObjectMaps: PredicateObjectMap[];\n  filters?: Filters;\n}\n\n// ============================================\n// Data source types\n// ============================================\n\nexport type DbType = 'postgres' | 'sqlite';\n\nexport interface DbSource {\n  type: DbType;\n  connectionString: string;\n  encryption?: unknown;\n}\n\n// ============================================\n// Import configuration\n// ============================================\n\nexport interface ImportOptions {\n  dryRun: boolean;\n  baseIri?: string;\n  /** Target path inside the Pod (e.g. \"data/contacts.ttl\") */\n  targetPath: string;\n}\n\n/** A single row returned from a database query */\nexport type Row = Record<string, unknown>;\n\n/** Unified database connection interface */\nexport interface DbConnection {\n  query(sql: string): AsyncIterable<Row>;\n  close(): Promise<void>;\n}\n"]}

package/dist/cli/lib/model-manager.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Get available AI models based on configured providers.
+ *
+ * Queries the user's Pod for configured AI providers and returns
+ * the list of available models from each provider.
+ */
+import type { Session } from '@inrupt/solid-client-authn-node';
+export interface AvailableModel {
+    id: string;
+    name: string;
+    provider: string;
+    providerName: string;
+    description?: string;
+    contextWindow?: number;
+    maxTokens?: number;
+}
+/**
+ * Get all available models from configured providers.
+ *
+ * Returns models from:
+ * 1. Providers with active API key credentials
+ * 2. Providers with active OAuth credentials
+ * 3. Platform default models (from xpod API)
+ */
+export declare function getAvailableModels(session: Session, xpodUrl: string): Promise<AvailableModel[]>;
+/**
+ * Get a specific model by ID.
+ */
+export declare function getModelById(session: Session, xpodUrl: string, modelId: string): Promise<AvailableModel | null>;
+/**
+ * List available models (for CLI display).
+ */
+export declare function listAvailableModels(session: Session, xpodUrl: string): Promise<void>;
+/**
+ * Add a custom model to the user's Pod.
+ */
+export declare function addCustomModel(session: Session, xpodUrl: string, modelId: string): Promise<void>;