@undefineds.co/xpod 0.2.0 → 0.2.2-preview.0

package/dist/cli/lib/secretary-prompt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secretary-prompt.js","sourceRoot":"","sources":["../../../src/cli/lib/secretary-prompt.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAEU,QAAA,uBAAuB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UA2E7B,CAAC","sourcesContent":["/**\n * SecretaryAI system prompt for CLI agent.\n *\n * Reuses the same Pod-access conventions as the server-side default-agent.ts.\n */\n\nexport const SECRETARY_SYSTEM_PROMPT = `你是 SecretaryAI，运行在用户本地的 AI 助手。你可以读写用户的本地文件系统，也可以通过 HTTP 访问用户的 Solid Pod。\n\n## 你的职责\n1. 帮助用户管理本地文件和 Pod 数据\n2. 识别用户消息中的结构化数据并存储到 Pod\n3. 按语义网规范组织数据\n4. 读取本地文件并上传到 Pod\n\n## Pod 访问方式\n使用 curl 访问用户 Pod，鉴权信息已在环境变量中：\n\n### 读取资源\n\\`\\`\\`bash\ncurl -s -H \"Authorization: Bearer $SOLID_TOKEN\" \"$POD_BASE_URL<path>\"\n\\`\\`\\`\n\n### 写入 Turtle 数据\n\\`\\`\\`bash\ncurl -s -X PUT \\\\\n  -H \"Authorization: Bearer $SOLID_TOKEN\" \\\\\n  -H \"Content-Type: text/turtle\" \\\\\n  -d '<turtle-content>' \\\\\n  \"$POD_BASE_URL<path>\"\n\\`\\`\\`\n\n### 写入任意文件\n\\`\\`\\`bash\ncurl -s -X PUT \\\\\n  -H \"Authorization: Bearer $SOLID_TOKEN\" \\\\\n  -H \"Content-Type: <mime-type>\" \\\\\n  --data-binary @<local-file-path> \\\\\n  \"$POD_BASE_URL<path>\"\n\\`\\`\\`\n\n### 创建容器（目录）\n\\`\\`\\`bash\ncurl -s -X PUT \\\\\n  -H \"Authorization: Bearer $SOLID_TOKEN\" \\\\\n  -H \"Content-Type: text/turtle\" \\\\\n  -H \"Link: <http://www.w3.org/ns/ldp#BasicContainer>; rel=\\\\\"type\\\\\"\" \\\\\n  \"$POD_BASE_URL<path>/\"\n\\`\\`\\`\n\n### SPARQL 更新\n\\`\\`\\`bash\ncurl -s -X PATCH \\\\\n  -H \"Authorization: Bearer $SOLID_TOKEN\" \\\\\n  -H \"Content-Type: application/sparql-update\" \\\\\n  -d '<sparql-update>' \\\\\n  \"$POD_BASE_URL<path>\"\n\\`\\`\\`\n\n## 数据收纳能力\n当用户的消息中包含以下类型的信息时，识别并保存到 Pod：\n\n### 联系人\n- 存储位置：/contacts/<name>.ttl\n- 词汇表：vCard (http://www.w3.org/2006/vcard/ns#)\n\n### 日程/事件\n- 存储位置：/calendar/events.ttl\n- 词汇表：schema:Event\n\n### 笔记\n- 存储位置：/notes/<title>.ttl\n- 词汇表：schema:Note\n\n### 文件\n- 用户指定的本地文件 → 读取后上传到 Pod 对应路径\n\n## 交互原则\n1. 识别到结构化数据时，先告知用户将要保存的内容，然后执行\n2. 保存成功后简短告知用户\n3. 读取本地文件时使用 Read tool\n4. 访问 Pod 时使用 Bash tool 执行 curl\n5. 回复使用中文`;\n"]}

package/dist/cli/lib/solid-auth.d.ts

@@ -1,20 +1,31 @@
 /**
  * Solid OIDC authentication helpers for CLI.
  *
- * Uses client_credentials grant to obtain an access token from the
- * CSS OIDC token endpoint, so CLI commands can access Pod resources
- * without email/password.
+ * Two auth channels:
+ * 1. Session (via @inrupt/solid-client-authn-node) — for Pod operations (drizzle-solid)
+ * 2. API Key (sk-xxx format) — for xpod API calls (LLM proxy, etc.)
+ *
+ * The API key is derived from client_id:client_secret and used by xpod's
+ * ClientCredentialsAuthenticator to authenticate API requests.
+ */
+import { Session } from '@inrupt/solid-client-authn-node';
+export { Session } from '@inrupt/solid-client-authn-node';
+export interface PodAuth {
+    session: Session;
+    apiKey: string;
+}
+/**
+ * Authenticate with the Pod server.
+ *
+ * Returns both a Session (for Pod CRUD) and an API key (for xpod API).
  */
+export declare function authenticate(clientId: string, clientSecret: string, oidcIssuer: string): Promise<PodAuth>;
 export interface SolidTokenResult {
     accessToken: string;
     tokenType: string;
     expiresAt: Date;
 }
-/**
- * Exchange client credentials for an access token via the OIDC token endpoint.
- */
+/** @deprecated Use authenticate() instead. */
 export declare function getAccessToken(clientId: string, clientSecret: string, baseUrl: string): Promise<SolidTokenResult | null>;
-/**
- * Perform an authenticated fetch using a Bearer access token.
- */
+/** @deprecated Use session.fetch() from authenticate() instead. */
 export declare function authenticatedFetch(url: string, token: string, init?: RequestInit): Promise<Response>;

package/dist/cli/lib/solid-auth.js

@@ -2,66 +2,80 @@
 /**
  * Solid OIDC authentication helpers for CLI.
  *
- * Uses client_credentials grant to obtain an access token from the
- * CSS OIDC token endpoint, so CLI commands can access Pod resources
- * without email/password.
+ * Two auth channels:
+ * 1. Session (via @inrupt/solid-client-authn-node) — for Pod operations (drizzle-solid)
+ * 2. API Key (sk-xxx format) — for xpod API calls (LLM proxy, etc.)
+ *
+ * The API key is derived from client_id:client_secret and used by xpod's
+ * ClientCredentialsAuthenticator to authenticate API requests.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.Session = void 0;
+exports.authenticate = authenticate;
 exports.getAccessToken = getAccessToken;
 exports.authenticatedFetch = authenticatedFetch;
+const solid_client_authn_node_1 = require("@inrupt/solid-client-authn-node");
+var solid_client_authn_node_2 = require("@inrupt/solid-client-authn-node");
+Object.defineProperty(exports, "Session", { enumerable: true, get: function () { return solid_client_authn_node_2.Session; } });
 /**
- * Discover the OIDC token endpoint from the server's openid-configuration.
+ * Authenticate with the Pod server.
+ *
+ * Returns both a Session (for Pod CRUD) and an API key (for xpod API).
  */
-async function discoverTokenEndpoint(baseUrl) {
-    try {
-        const res = await fetch(`${baseUrl}.well-known/openid-configuration`);
-        if (!res.ok)
-            return null;
-        const data = (await res.json());
-        return data.token_endpoint ?? null;
-    }
-    catch {
-        return null;
+async function authenticate(clientId, clientSecret, oidcIssuer) {
+    // 1. Create Session for Pod operations
+    const session = new solid_client_authn_node_1.Session();
+    await session.login({
+        clientId,
+        clientSecret,
+        oidcIssuer,
+        tokenType: 'Bearer',
+    });
+    if (!session.info.isLoggedIn) {
+        throw new Error('Failed to authenticate with Pod');
     }
+    // 2. Generate API key for xpod API calls
+    // Format: sk-base64(client_id:client_secret)
+    const credentials = `${clientId}:${clientSecret}`;
+    const base64 = Buffer.from(credentials, 'utf-8').toString('base64');
+    const apiKey = `sk-${base64}`;
+    return { session, apiKey };
 }
-/**
- * Exchange client credentials for an access token via the OIDC token endpoint.
- */
+/** @deprecated Use authenticate() instead. */
 async function getAccessToken(clientId, clientSecret, baseUrl) {
-    const tokenEndpoint = await discoverTokenEndpoint(baseUrl);
-    if (!tokenEndpoint) {
-        return null;
-    }
     try {
-        const params = new URLSearchParams({
-            grant_type: 'client_credentials',
-            client_id: clientId,
-            client_secret: clientSecret,
-        });
-        const res = await fetch(tokenEndpoint, {
+        const base = baseUrl.endsWith('/') ? baseUrl : `${baseUrl}/`;
+        const res = await fetch(`${base}.well-known/openid-configuration`);
+        if (!res.ok)
+            return null;
+        const config = (await res.json());
+        if (!config.token_endpoint)
+            return null;
+        const tokenRes = await fetch(config.token_endpoint, {
             method: 'POST',
             headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-            body: params.toString(),
+            body: new URLSearchParams({
+                grant_type: 'client_credentials',
+                client_id: clientId,
+                client_secret: clientSecret,
+            }).toString(),
         });
-        if (!res.ok)
+        if (!tokenRes.ok)
             return null;
-        const data = (await res.json());
+        const data = (await tokenRes.json());
         if (!data.access_token)
             return null;
-        const expiresIn = data.expires_in ?? 3600;
         return {
             accessToken: data.access_token,
-            tokenType: data.token_type ?? 'Bearer',
-            expiresAt: new Date(Date.now() + expiresIn * 1000),
+            tokenType: 'Bearer',
+            expiresAt: new Date(Date.now() + (data.expires_in ?? 3600) * 1000),
         };
     }
     catch {
         return null;
     }
 }
-/**
- * Perform an authenticated fetch using a Bearer access token.
- */
+/** @deprecated Use session.fetch() from authenticate() instead. */
 async function authenticatedFetch(url, token, init) {
     const headers = new Headers(init?.headers);
     headers.set('Authorization', `Bearer ${token}`);

package/dist/cli/lib/solid-auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"solid-auth.js","sourceRoot":"","sources":["../../../src/cli/lib/solid-auth.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;AAyBH,wCA0CC;AAKD,gDAQC;AAxED;;GAEG;AACH,KAAK,UAAU,qBAAqB,CAAC,OAAe;IAClD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,kCAAkC,CAAC,CAAC;QACtE,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAgC,CAAC;QAC/D,OAAO,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,cAAc,CAClC,QAAgB,EAChB,YAAoB,EACpB,OAAe;IAEf,MAAM,aAAa,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC3D,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,UAAU,EAAE,oBAAoB;YAChC,SAAS,EAAE,QAAQ;YACnB,aAAa,EAAE,YAAY;SAC5B,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,aAAa,EAAE;YACrC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE;SACxB,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QAEzB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAI7B,CAAC;QAEF,IAAI,CAAC,IAAI,CAAC,YAAY;YAAE,OAAO,IAAI,CAAC;QAEpC,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC;QAC1C,OAAO;YACL,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,SAAS,EAAE,IAAI,CAAC,UAAU,IAAI,QAAQ;YACtC,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC;SACnD,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,kBAAkB,CACtC,GAAW,EACX,KAAa,EACb,IAAkB;IAElB,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3C,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,KAAK,EAAE,CAAC,CAAC;IAChD,OAAO,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;AAC1C,CAAC","sourcesContent":["/**\n * Solid OIDC authentication helpers for CLI.\n *\n * Uses client_credentials grant to obtain an access token from the\n * CSS OIDC token endpoint, so CLI commands can access Pod resources\n * without email/password.\n */\n\nexport interface SolidTokenResult {\n  accessToken: string;\n  tokenType: string;\n  expiresAt: Date;\n}\n\n/**\n * Discover the OIDC token endpoint from the server's openid-configuration.\n */\nasync function discoverTokenEndpoint(baseUrl: string): Promise<string | null> {\n  try {\n    const res = await fetch(`${baseUrl}.well-known/openid-configuration`);\n    if (!res.ok) return null;\n    const data = (await res.json()) as { token_endpoint?: string };\n    return data.token_endpoint ?? null;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Exchange client credentials for an access token via the OIDC token endpoint.\n */\nexport async function getAccessToken(\n  clientId: string,\n  clientSecret: string,\n  baseUrl: string,\n): Promise<SolidTokenResult | null> {\n  const tokenEndpoint = await discoverTokenEndpoint(baseUrl);\n  if (!tokenEndpoint) {\n    return null;\n  }\n\n  try {\n    const params = new URLSearchParams({\n      grant_type: 'client_credentials',\n      client_id: clientId,\n      client_secret: clientSecret,\n    });\n\n    const res = await fetch(tokenEndpoint, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n      body: params.toString(),\n    });\n\n    if (!res.ok) return null;\n\n    const data = (await res.json()) as {\n      access_token?: string;\n      token_type?: string;\n      expires_in?: number;\n    };\n\n    if (!data.access_token) return null;\n\n    const expiresIn = data.expires_in ?? 3600;\n    return {\n      accessToken: data.access_token,\n      tokenType: data.token_type ?? 'Bearer',\n      expiresAt: new Date(Date.now() + expiresIn * 1000),\n    };\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Perform an authenticated fetch using a Bearer access token.\n */\nexport async function authenticatedFetch(\n  url: string,\n  token: string,\n  init?: RequestInit,\n): Promise<Response> {\n  const headers = new Headers(init?.headers);\n  headers.set('Authorization', `Bearer ${token}`);\n  return fetch(url, { ...init, headers });\n}\n"]}
+{"version":3,"file":"solid-auth.js","sourceRoot":"","sources":["../../../src/cli/lib/solid-auth.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;;AAgBH,oCAyBC;AAaD,wCAkCC;AAGD,gDAQC;AAjGD,6EAA0D;AAE1D,2EAA0D;AAAjD,kHAAA,OAAO,OAAA;AAOhB;;;;GAIG;AACI,KAAK,UAAU,YAAY,CAChC,QAAgB,EAChB,YAAoB,EACpB,UAAkB;IAElB,uCAAuC;IACvC,MAAM,OAAO,GAAG,IAAI,iCAAO,EAAE,CAAC;IAC9B,MAAM,OAAO,CAAC,KAAK,CAAC;QAClB,QAAQ;QACR,YAAY;QACZ,UAAU;QACV,SAAS,EAAE,QAAQ;KACpB,CAAC,CAAC;IAEH,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IAED,yCAAyC;IACzC,6CAA6C;IAC7C,MAAM,WAAW,GAAG,GAAG,QAAQ,IAAI,YAAY,EAAE,CAAC;IAClD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACpE,MAAM,MAAM,GAAG,MAAM,MAAM,EAAE,CAAC;IAE9B,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AAC7B,CAAC;AAYD,8CAA8C;AACvC,KAAK,UAAU,cAAc,CAClC,QAAgB,EAChB,YAAoB,EACpB,OAAe;IAEf,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,GAAG,CAAC;QAC7D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,kCAAkC,CAAC,CAAC;QACnE,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,MAAM,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAgC,CAAC;QACjE,IAAI,CAAC,MAAM,CAAC,cAAc;YAAE,OAAO,IAAI,CAAC;QAExC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE;YAClD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC;gBACxB,UAAU,EAAE,oBAAoB;gBAChC,SAAS,EAAE,QAAQ;gBACnB,aAAa,EAAE,YAAY;aAC5B,CAAC,CAAC,QAAQ,EAAE;SACd,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QAC9B,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAmD,CAAC;QACvF,IAAI,CAAC,IAAI,CAAC,YAAY;YAAE,OAAO,IAAI,CAAC;QAEpC,OAAO;YACL,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,SAAS,EAAE,QAAQ;YACnB,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC;SACnE,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,mEAAmE;AAC5D,KAAK,UAAU,kBAAkB,CACtC,GAAW,EACX,KAAa,EACb,IAAkB;IAElB,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3C,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,KAAK,EAAE,CAAC,CAAC;IAChD,OAAO,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;AAC1C,CAAC","sourcesContent":["/**\n * Solid OIDC authentication helpers for CLI.\n *\n * Two auth channels:\n * 1. Session (via @inrupt/solid-client-authn-node) — for Pod operations (drizzle-solid)\n * 2. API Key (sk-xxx format) — for xpod API calls (LLM proxy, etc.)\n *\n * The API key is derived from client_id:client_secret and used by xpod's\n * ClientCredentialsAuthenticator to authenticate API requests.\n */\n\nimport { Session } from '@inrupt/solid-client-authn-node';\n\nexport { Session } from '@inrupt/solid-client-authn-node';\n\nexport interface PodAuth {\n  session: Session;   // For Pod operations (drizzle-solid)\n  apiKey: string;     // For xpod API calls (sk-xxx format)\n}\n\n/**\n * Authenticate with the Pod server.\n *\n * Returns both a Session (for Pod CRUD) and an API key (for xpod API).\n */\nexport async function authenticate(\n  clientId: string,\n  clientSecret: string,\n  oidcIssuer: string,\n): Promise<PodAuth> {\n  // 1. Create Session for Pod operations\n  const session = new Session();\n  await session.login({\n    clientId,\n    clientSecret,\n    oidcIssuer,\n    tokenType: 'Bearer',\n  });\n\n  if (!session.info.isLoggedIn) {\n    throw new Error('Failed to authenticate with Pod');\n  }\n\n  // 2. Generate API key for xpod API calls\n  // Format: sk-base64(client_id:client_secret)\n  const credentials = `${clientId}:${clientSecret}`;\n  const base64 = Buffer.from(credentials, 'utf-8').toString('base64');\n  const apiKey = `sk-${base64}`;\n\n  return { session, apiKey };\n}\n\n// ============================================================================\n// Legacy API — used by subcommands (backup, config) not yet migrated\n// ============================================================================\n\nexport interface SolidTokenResult {\n  accessToken: string;\n  tokenType: string;\n  expiresAt: Date;\n}\n\n/** @deprecated Use authenticate() instead. */\nexport async function getAccessToken(\n  clientId: string,\n  clientSecret: string,\n  baseUrl: string,\n): Promise<SolidTokenResult | null> {\n  try {\n    const base = baseUrl.endsWith('/') ? baseUrl : `${baseUrl}/`;\n    const res = await fetch(`${base}.well-known/openid-configuration`);\n    if (!res.ok) return null;\n    const config = (await res.json()) as { token_endpoint?: string };\n    if (!config.token_endpoint) return null;\n\n    const tokenRes = await fetch(config.token_endpoint, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n      body: new URLSearchParams({\n        grant_type: 'client_credentials',\n        client_id: clientId,\n        client_secret: clientSecret,\n      }).toString(),\n    });\n\n    if (!tokenRes.ok) return null;\n    const data = (await tokenRes.json()) as { access_token?: string; expires_in?: number };\n    if (!data.access_token) return null;\n\n    return {\n      accessToken: data.access_token,\n      tokenType: 'Bearer',\n      expiresAt: new Date(Date.now() + (data.expires_in ?? 3600) * 1000),\n    };\n  } catch {\n    return null;\n  }\n}\n\n/** @deprecated Use session.fetch() from authenticate() instead. */\nexport async function authenticatedFetch(\n  url: string,\n  token: string,\n  init?: RequestInit,\n): Promise<Response> {\n  const headers = new Headers(init?.headers);\n  headers.set('Authorization', `Bearer ${token}`);\n  return fetch(url, { ...init, headers });\n}\n"]}

package/dist/cli/seed.d.ts

@@ -22,6 +22,12 @@ export interface SeedCredentials {
     podUrl: string;
     issuer: string;
 }
+export interface ResolveSeedCredentialsOptions {
+    seedPath?: string;
+    baseUrl?: string;
+    podName?: string;
+    label?: string;
+}
 /**
  * 加载 seed 配置
  */
@@ -38,6 +44,7 @@ export declare function checkServer(baseUrl: string): Promise<boolean>;
  * 使用 seed 账户登录
  */
 export declare function loginWithSeed(baseUrl: string, email: string, password: string): Promise<string | null>;
+export declare function resolveSeedCredentials(options?: ResolveSeedCredentialsOptions): Promise<SeedCredentials | null>;
 /**
  * seed status 命令
  */

package/dist/cli/seed.js

@@ -37,6 +37,7 @@ exports.loadSeedConfig = loadSeedConfig;
 exports.getBaseUrl = getBaseUrl;
 exports.checkServer = checkServer;
 exports.loginWithSeed = loginWithSeed;
+exports.resolveSeedCredentials = resolveSeedCredentials;
 exports.seedStatus = seedStatus;
 exports.seedCredentials = seedCredentials;
 exports.seedReset = seedReset;
@@ -44,6 +45,9 @@ const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const DEFAULT_SEED_PATH = 'config/seeds/test.json';
 const DEFAULT_BASE_URL = 'http://localhost:3000/';
+function ensureTrailingSlash(value) {
+    return value.endsWith('/') ? value : `${value}/`;
+}
 /**
  * 加载 seed 配置
  */
@@ -71,7 +75,7 @@ function loadSeedConfig(seedPath) {
  */
 function getBaseUrl() {
     const raw = process.env.CSS_BASE_URL || DEFAULT_BASE_URL;
-    return raw.endsWith('/') ? raw : `${raw}/`;
+    return ensureTrailingSlash(raw);
 }
 /**
  * 检查服务是否运行
@@ -137,7 +141,7 @@ async function getAccountControls(baseUrl, token) {
 /**
  * 创建新的 OAuth 客户端凭证
  */
-async function createCredentials(credCreateUrl, token, webId) {
+async function createCredentials(credCreateUrl, token, webId, label) {
     try {
         const response = await fetch(credCreateUrl, {
             method: 'POST',
@@ -147,7 +151,7 @@ async function createCredentials(credCreateUrl, token, webId) {
                 Authorization: `CSS-Account-Token ${token}`,
             },
             body: JSON.stringify({
-                name: `seed-credentials-${Date.now()}`,
+                name: label ? `${label}-${Date.now()}` : `seed-credentials-${Date.now()}`,
                 webId,
             }),
         });
@@ -160,6 +164,58 @@ async function createCredentials(credCreateUrl, token, webId) {
         return null;
     }
 }
+function getPodCandidates(account, preferredPodName) {
+    const names = new Set();
+    if (preferredPodName) {
+        names.add(preferredPodName);
+    }
+    for (const pod of account.pods ?? []) {
+        if (typeof pod?.name === 'string' && pod.name) {
+            names.add(pod.name);
+        }
+    }
+    if (names.size === 0) {
+        names.add('test');
+    }
+    return [...names];
+}
+async function resolveSeedCredentials(options = {}) {
+    const baseUrl = ensureTrailingSlash(options.baseUrl || getBaseUrl());
+    if (!(await checkServer(baseUrl))) {
+        return null;
+    }
+    const accounts = loadSeedConfig(options.seedPath);
+    if (accounts.length === 0) {
+        return null;
+    }
+    for (const account of accounts) {
+        const token = await loginWithSeed(baseUrl, account.email, account.password);
+        if (!token) {
+            continue;
+        }
+        const controls = await getAccountControls(baseUrl, token);
+        if (!controls?.credCreate) {
+            continue;
+        }
+        for (const podName of getPodCandidates(account, options.podName)) {
+            const podUrl = `${baseUrl}${podName}/`;
+            const webId = `${podUrl}profile/card#me`;
+            const creds = await createCredentials(controls.credCreate, token, webId, options.label ?? 'seed-credentials');
+            if (!creds) {
+                continue;
+            }
+            const issuer = await discoverIssuer(baseUrl, webId);
+            return {
+                clientId: creds.id,
+                clientSecret: creds.secret,
+                webId,
+                podUrl,
+                issuer,
+            };
+        }
+    }
+    return null;
+}
 /**
  * 发现 OIDC Issuer
  */
@@ -174,7 +230,10 @@ async function discoverIssuer(baseUrl, webId) {
         }
         const body = await response.text();
         const match = body.match(/<http:\/\/www\.w3\.org\/ns\/solid\/terms#oidcIssuer>\s*<([^>]+)>/);
-        return match ? match[1] : baseUrl;
+        if (!match?.[1]) {
+            return baseUrl;
+        }
+        return ensureTrailingSlash(new URL(match[1], profileUrl).toString());
     }
     catch {
         return baseUrl;
@@ -211,59 +270,11 @@ async function seedStatus(seedPath) {
 async function seedCredentials(seedPath) {
     const baseUrl = getBaseUrl();
     console.log(`Base URL: ${baseUrl}`);
-    // 检查服务
-    if (!(await checkServer(baseUrl))) {
-        console.error('Server is not running. Start with: xpod start');
-        return;
-    }
-    // 加载 seed 配置
-    const accounts = loadSeedConfig(seedPath);
-    if (accounts.length === 0) {
-        console.error('No seed accounts found in config');
-        return;
-    }
-    // 尝试登录
-    let token = null;
-    let activeAccount = null;
-    for (const account of accounts) {
-        console.log(`Trying login: ${account.email}`);
-        token = await loginWithSeed(baseUrl, account.email, account.password);
-        if (token) {
-            activeAccount = account;
-            break;
-        }
-    }
-    if (!token || !activeAccount) {
-        console.error('Failed to login with any seed account');
-        return;
-    }
-    console.log(`Logged in: ${activeAccount.email}`);
-    // 获取控制端点
-    const controls = await getAccountControls(baseUrl, token);
-    if (!controls?.credCreate) {
-        console.error('Failed to get account controls');
-        return;
-    }
-    // 获取或创建 WebID
-    // 假设 seed 账户已有 pod，使用第一个 pod 的 webId
-    const podName = activeAccount.pods?.[0]?.name || 'test';
-    const webId = `${baseUrl}${podName}/profile/card#me`;
-    const podUrl = `${baseUrl}${podName}/`;
-    // 创建凭证
-    console.log('Creating credentials...');
-    const creds = await createCredentials(controls.credCreate, token, webId);
-    if (!creds) {
-        console.error('Failed to create credentials');
+    const result = await resolveSeedCredentials({ seedPath, baseUrl });
+    if (!result) {
+        console.error('Failed to resolve seed credentials');
         return;
     }
-    const issuer = await discoverIssuer(baseUrl, webId);
-    const result = {
-        clientId: creds.id,
-        clientSecret: creds.secret,
-        webId,
-        podUrl,
-        issuer,
-    };
     // 输出
     console.log('\n# Seed Pod Credentials');
     console.log(`CLIENT_ID=${result.clientId}`);

package/dist/cli/seed.js.map

@@ -1 +1 @@
-{"version":3,"file":"seed.js","sourceRoot":"","sources":["../../src/cli/seed.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;;;;;;;;;;;;;;;;;;;;;;;;AA0BH,wCAwBC;AAKD,gCAGC;AAKD,kCASC;AAKD,sCAwBC;AAmGD,gCAsBC;AAQD,0CA6EC;AAOD,8BAkBC;AA1UD,uCAAyB;AACzB,2CAA6B;AAiB7B,MAAM,iBAAiB,GAAG,wBAAwB,CAAC;AACnD,MAAM,gBAAgB,GAAG,wBAAwB,CAAC;AAElD;;GAEG;AACH,SAAgB,cAAc,CAAC,QAAiB;IAC9C,MAAM,UAAU,GAAG,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,iBAAiB,CAAC,CAAC;IAE7G,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QACrD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAEnC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3B,OAAO,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;YAC9C,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,MAAM,CAAC,MAAM,CAClB,CAAC,KAAK,EAAwB,EAAE,CAC9B,OAAO,KAAK,EAAE,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,EAAE,QAAQ,KAAK,QAAQ,CAC1E,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,gCAAgC,KAAK,EAAE,CAAC,CAAC;QACvD,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAgB,UAAU;IACxB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,gBAAgB,CAAC;IACzD,OAAO,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,CAAC;AAC7C,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,WAAW,CAAC,OAAe;IAC/C,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,WAAW,EAAE;YAClD,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;SACxC,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,EAAE,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,aAAa,CACjC,OAAe,EACf,KAAa,EACb,QAAgB;IAEhB,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,0BAA0B,EAAE;YACjE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,MAAM,EAAE,kBAAkB;aAC3B;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;SAC1C,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA+B,CAAC;QACrE,OAAO,MAAM,CAAC,aAAa,IAAI,IAAI,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,kBAAkB,CAC/B,OAAe,EACf,KAAa;IAKb,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,WAAW,EAAE;YAClD,OAAO,EAAE;gBACP,MAAM,EAAE,kBAAkB;gBAC1B,aAAa,EAAE,qBAAqB,KAAK,EAAE;aAC5C;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAOpC,CAAC;QAEF,OAAO;YACL,SAAS,EAAE,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG;YACxC,UAAU,EAAE,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,iBAAiB;SACxD,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,iBAAiB,CAC9B,aAAqB,EACrB,KAAa,EACb,KAAa;IAEb,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,aAAa,EAAE;YAC1C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,MAAM,EAAE,kBAAkB;gBAC1B,aAAa,EAAE,qBAAqB,KAAK,EAAE;aAC5C;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,IAAI,EAAE,oBAAoB,IAAI,CAAC,GAAG,EAAE,EAAE;gBACtC,KAAK;aACN,CAAC;SACH,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAmC,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,cAAc,CAAC,OAAe,EAAE,KAAa;IAC1D,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACvC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,UAAU,EAAE;YACvC,OAAO,EAAE,EAAE,MAAM,EAAE,kCAAkC,EAAE;SACxD,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,kEAAkE,CAAC,CAAC;QAC7F,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC;IACjB,CAAC;AACH,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,UAAU,CAAC,QAAiB;IAChD,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAC7B,OAAO,CAAC,GAAG,CAAC,aAAa,OAAO,EAAE,CAAC,CAAC;IAEpC,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;IAC7C,OAAO,CAAC,GAAG,CAAC,WAAW,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC;IAEhE,MAAM,QAAQ,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC1C,OAAO,CAAC,GAAG,CAAC,kBAAkB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAEjD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,OAAO,CAAC,GAAG,CAAC,OAAO,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QACpC,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;gBAC/B,OAAO,CAAC,GAAG,CAAC,YAAY,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;YACtC,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,CAAC,GAAG,CAAC,iDAAiD,CAAC,CAAC;IACjE,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,eAAe,CAAC,QAAiB;IACrD,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAC7B,OAAO,CAAC,GAAG,CAAC,aAAa,OAAO,EAAE,CAAC,CAAC;IAEpC,OAAO;IACP,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QAClC,OAAO,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;QAC/D,OAAO;IACT,CAAC;IAED,aAAa;IACb,MAAM,QAAQ,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC1C,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;QAClD,OAAO;IACT,CAAC;IAED,OAAO;IACP,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,IAAI,aAAa,GAAuB,IAAI,CAAC;IAE7C,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,OAAO,CAAC,GAAG,CAAC,iBAAiB,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QAC9C,KAAK,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QACtE,IAAI,KAAK,EAAE,CAAC;YACV,aAAa,GAAG,OAAO,CAAC;YACxB,MAAM;QACR,CAAC;IACH,CAAC;IAED,IAAI,CAAC,KAAK,IAAI,CAAC,aAAa,EAAE,CAAC;QAC7B,OAAO,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;QACvD,OAAO;IACT,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,cAAc,aAAa,CAAC,KAAK,EAAE,CAAC,CAAC;IAEjD,SAAS;IACT,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC1D,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,CAAC;QAC1B,OAAO,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;QAChD,OAAO;IACT,CAAC;IAED,cAAc;IACd,qCAAqC;IACrC,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,MAAM,CAAC;IACxD,MAAM,KAAK,GAAG,GAAG,OAAO,GAAG,OAAO,kBAAkB,CAAC;IACrD,MAAM,MAAM,GAAG,GAAG,OAAO,GAAG,OAAO,GAAG,CAAC;IAEvC,OAAO;IACP,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,QAAQ,CAAC,UAAU,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IAEzE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAC9C,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAEpD,MAAM,MAAM,GAAoB;QAC9B,QAAQ,EAAE,KAAK,CAAC,EAAE;QAClB,YAAY,EAAE,KAAK,CAAC,MAAM;QAC1B,KAAK;QACL,MAAM;QACN,MAAM;KACP,CAAC;IAEF,KAAK;IACL,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;IACxC,OAAO,CAAC,GAAG,CAAC,aAAa,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC5C,OAAO,CAAC,GAAG,CAAC,iBAAiB,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;IACpD,OAAO,CAAC,GAAG,CAAC,SAAS,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IACrC,OAAO,CAAC,GAAG,CAAC,UAAU,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IAEvC,gCAAgC;AAClC,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,SAAS,CAAC,QAAiB;IAC/C,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAC7B,OAAO,CAAC,GAAG,CAAC,aAAa,OAAO,EAAE,CAAC,CAAC;IAEpC,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QAClC,OAAO,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;QAC/D,OAAO;IACT,CAAC;IAED,MAAM,QAAQ,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC1C,OAAO,CAAC,GAAG,CAAC,2BAA2B,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAE1D,uBAAuB;IACvB,OAAO,CAAC,GAAG,CAAC,qDAAqD,CAAC,CAAC;IACnE,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;IAC1C,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;IACpC,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;IAC9C,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;AACzC,CAAC","sourcesContent":["/**\n * Seed Pod CLI Module\n *\n * 提供对 seed pod 的管理功能：\n * - status: 查看 seed pod 状态\n * - credentials: 生成测试凭证\n * - reset: 重置 seed pod\n *\n * 安全限制：只能操作 seed 配置中定义的账户，不能操作任意用户。\n */\n\nimport * as fs from 'fs';\nimport * as path from 'path';\nimport { spawn } from 'child_process';\n\nexport interface SeedAccount {\n  email: string;\n  password: string;\n  pods?: Array<{ name: string }>;\n}\n\nexport interface SeedCredentials {\n  clientId: string;\n  clientSecret: string;\n  webId: string;\n  podUrl: string;\n  issuer: string;\n}\n\nconst DEFAULT_SEED_PATH = 'config/seeds/test.json';\nconst DEFAULT_BASE_URL = 'http://localhost:3000/';\n\n/**\n * 加载 seed 配置\n */\nexport function loadSeedConfig(seedPath?: string): SeedAccount[] {\n  const configPath = seedPath || process.env.CSS_SEED_CONFIG || path.resolve(process.cwd(), DEFAULT_SEED_PATH);\n\n  if (!fs.existsSync(configPath)) {\n    return [];\n  }\n\n  try {\n    const content = fs.readFileSync(configPath, 'utf-8');\n    const parsed = JSON.parse(content);\n\n    if (!Array.isArray(parsed)) {\n      console.error('Seed config must be an array');\n      return [];\n    }\n\n    return parsed.filter(\n      (entry): entry is SeedAccount =>\n        typeof entry?.email === 'string' && typeof entry?.password === 'string'\n    );\n  } catch (error) {\n    console.error(`Failed to parse seed config: ${error}`);\n    return [];\n  }\n}\n\n/**\n * 获取服务 Base URL\n */\nexport function getBaseUrl(): string {\n  const raw = process.env.CSS_BASE_URL || DEFAULT_BASE_URL;\n  return raw.endsWith('/') ? raw : `${raw}/`;\n}\n\n/**\n * 检查服务是否运行\n */\nexport async function checkServer(baseUrl: string): Promise<boolean> {\n  try {\n    const response = await fetch(`${baseUrl}.account/`, {\n      headers: { Accept: 'application/json' },\n    });\n    return response.ok;\n  } catch {\n    return false;\n  }\n}\n\n/**\n * 使用 seed 账户登录\n */\nexport async function loginWithSeed(\n  baseUrl: string,\n  email: string,\n  password: string\n): Promise<string | null> {\n  try {\n    const response = await fetch(`${baseUrl}.account/login/password/`, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/json',\n        Accept: 'application/json',\n      },\n      body: JSON.stringify({ email, password }),\n    });\n\n    if (!response.ok) {\n      return null;\n    }\n\n    const result = (await response.json()) as { authorization?: string };\n    return result.authorization ?? null;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * 获取账户控制端点\n */\nasync function getAccountControls(\n  baseUrl: string,\n  token: string\n): Promise<{\n  podCreate?: string;\n  credCreate?: string;\n} | null> {\n  try {\n    const response = await fetch(`${baseUrl}.account/`, {\n      headers: {\n        Accept: 'application/json',\n        Authorization: `CSS-Account-Token ${token}`,\n      },\n    });\n\n    if (!response.ok) {\n      return null;\n    }\n\n    const result = (await response.json()) as {\n      controls?: {\n        account?: {\n          pod?: string;\n          clientCredentials?: string;\n        };\n      };\n    };\n\n    return {\n      podCreate: result.controls?.account?.pod,\n      credCreate: result.controls?.account?.clientCredentials,\n    };\n  } catch {\n    return null;\n  }\n}\n\n/**\n * 创建新的 OAuth 客户端凭证\n */\nasync function createCredentials(\n  credCreateUrl: string,\n  token: string,\n  webId: string\n): Promise<{ id: string; secret: string } | null> {\n  try {\n    const response = await fetch(credCreateUrl, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/json',\n        Accept: 'application/json',\n        Authorization: `CSS-Account-Token ${token}`,\n      },\n      body: JSON.stringify({\n        name: `seed-credentials-${Date.now()}`,\n        webId,\n      }),\n    });\n\n    if (!response.ok) {\n      return null;\n    }\n\n    return (await response.json()) as { id: string; secret: string };\n  } catch {\n    return null;\n  }\n}\n\n/**\n * 发现 OIDC Issuer\n */\nasync function discoverIssuer(baseUrl: string, webId: string): Promise<string> {\n  try {\n    const profileUrl = webId.split('#')[0];\n    const response = await fetch(profileUrl, {\n      headers: { Accept: 'text/turtle, application/ld+json' },\n    });\n\n    if (!response.ok) {\n      return baseUrl;\n    }\n\n    const body = await response.text();\n    const match = body.match(/<http:\\/\\/www\\.w3\\.org\\/ns\\/solid\\/terms#oidcIssuer>\\s*<([^>]+)>/);\n    return match ? match[1] : baseUrl;\n  } catch {\n    return baseUrl;\n  }\n}\n\n/**\n * seed status 命令\n */\nexport async function seedStatus(seedPath?: string): Promise<void> {\n  const baseUrl = getBaseUrl();\n  console.log(`Base URL: ${baseUrl}`);\n\n  const isRunning = await checkServer(baseUrl);\n  console.log(`Server: ${isRunning ? 'running' : 'not running'}`);\n\n  const accounts = loadSeedConfig(seedPath);\n  console.log(`Seed accounts: ${accounts.length}`);\n\n  for (const account of accounts) {\n    console.log(`  - ${account.email}`);\n    if (account.pods) {\n      for (const pod of account.pods) {\n        console.log(`    pod: ${pod.name}`);\n      }\n    }\n  }\n\n  if (!isRunning) {\n    console.log('\\nServer is not running. Start with: xpod start');\n  }\n}\n\n/**\n * seed credentials 命令\n *\n * 生成 seed pod 的测试凭证，输出到控制台。\n * 只能操作 seed 配置中定义的账户。\n */\nexport async function seedCredentials(seedPath?: string): Promise<void> {\n  const baseUrl = getBaseUrl();\n  console.log(`Base URL: ${baseUrl}`);\n\n  // 检查服务\n  if (!(await checkServer(baseUrl))) {\n    console.error('Server is not running. Start with: xpod start');\n    return;\n  }\n\n  // 加载 seed 配置\n  const accounts = loadSeedConfig(seedPath);\n  if (accounts.length === 0) {\n    console.error('No seed accounts found in config');\n    return;\n  }\n\n  // 尝试登录\n  let token: string | null = null;\n  let activeAccount: SeedAccount | null = null;\n\n  for (const account of accounts) {\n    console.log(`Trying login: ${account.email}`);\n    token = await loginWithSeed(baseUrl, account.email, account.password);\n    if (token) {\n      activeAccount = account;\n      break;\n    }\n  }\n\n  if (!token || !activeAccount) {\n    console.error('Failed to login with any seed account');\n    return;\n  }\n\n  console.log(`Logged in: ${activeAccount.email}`);\n\n  // 获取控制端点\n  const controls = await getAccountControls(baseUrl, token);\n  if (!controls?.credCreate) {\n    console.error('Failed to get account controls');\n    return;\n  }\n\n  // 获取或创建 WebID\n  // 假设 seed 账户已有 pod，使用第一个 pod 的 webId\n  const podName = activeAccount.pods?.[0]?.name || 'test';\n  const webId = `${baseUrl}${podName}/profile/card#me`;\n  const podUrl = `${baseUrl}${podName}/`;\n\n  // 创建凭证\n  console.log('Creating credentials...');\n  const creds = await createCredentials(controls.credCreate, token, webId);\n\n  if (!creds) {\n    console.error('Failed to create credentials');\n    return;\n  }\n\n  const issuer = await discoverIssuer(baseUrl, webId);\n\n  const result: SeedCredentials = {\n    clientId: creds.id,\n    clientSecret: creds.secret,\n    webId,\n    podUrl,\n    issuer,\n  };\n\n  // 输出\n  console.log('\\n# Seed Pod Credentials');\n  console.log(`CLIENT_ID=${result.clientId}`);\n  console.log(`CLIENT_SECRET=${result.clientSecret}`);\n  console.log(`WEBID=${result.webId}`);\n  console.log(`ISSUER=${result.issuer}`);\n\n  // Credentials output to console\n}\n\n/**\n * seed reset 命令\n *\n * 重置 seed pod 数据。当前仅输出提示，实际实现需要清理 Pod 数据。\n */\nexport async function seedReset(seedPath?: string): Promise<void> {\n  const baseUrl = getBaseUrl();\n  console.log(`Base URL: ${baseUrl}`);\n\n  if (!(await checkServer(baseUrl))) {\n    console.error('Server is not running. Start with: xpod start');\n    return;\n  }\n\n  const accounts = loadSeedConfig(seedPath);\n  console.log(`Seed accounts to reset: ${accounts.length}`);\n\n  // TODO: 实现实际的 pod 重置逻辑\n  console.log('\\nWarning: seed reset is not fully implemented yet.');\n  console.log('To reset, you may need to:');\n  console.log('  1. Stop the server');\n  console.log('  2. Delete the data directory');\n  console.log('  3. Restart the server');\n}\n"]}
+{"version":3,"file":"seed.js","sourceRoot":"","sources":["../../src/cli/seed.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;;;;;;;;;;;;;;;;;;;;;;;;AAqCH,wCAwBC;AAKD,gCAGC;AAKD,kCASC;AAKD,sCAwBC;AA+FD,wDAmDC;AA8BD,gCAsBC;AAQD,0CAiBC;AAOD,8BAkBC;AAtWD,uCAAyB;AACzB,2CAA6B;AAwB7B,MAAM,iBAAiB,GAAG,wBAAwB,CAAC;AACnD,MAAM,gBAAgB,GAAG,wBAAwB,CAAC;AAElD,SAAS,mBAAmB,CAAC,KAAa;IACxC,OAAO,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC;AACnD,CAAC;AAED;;GAEG;AACH,SAAgB,cAAc,CAAC,QAAiB;IAC9C,MAAM,UAAU,GAAG,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,iBAAiB,CAAC,CAAC;IAE7G,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QACrD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAEnC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3B,OAAO,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;YAC9C,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,MAAM,CAAC,MAAM,CAClB,CAAC,KAAK,EAAwB,EAAE,CAC9B,OAAO,KAAK,EAAE,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,EAAE,QAAQ,KAAK,QAAQ,CAC1E,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,gCAAgC,KAAK,EAAE,CAAC,CAAC;QACvD,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAgB,UAAU;IACxB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,gBAAgB,CAAC;IACzD,OAAO,mBAAmB,CAAC,GAAG,CAAC,CAAC;AAClC,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,WAAW,CAAC,OAAe;IAC/C,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,WAAW,EAAE;YAClD,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;SACxC,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,EAAE,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,aAAa,CACjC,OAAe,EACf,KAAa,EACb,QAAgB;IAEhB,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,0BAA0B,EAAE;YACjE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,MAAM,EAAE,kBAAkB;aAC3B;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;SAC1C,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA+B,CAAC;QACrE,OAAO,MAAM,CAAC,aAAa,IAAI,IAAI,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,kBAAkB,CAC/B,OAAe,EACf,KAAa;IAKb,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,WAAW,EAAE;YAClD,OAAO,EAAE;gBACP,MAAM,EAAE,kBAAkB;gBAC1B,aAAa,EAAE,qBAAqB,KAAK,EAAE;aAC5C;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAOpC,CAAC;QAEF,OAAO;YACL,SAAS,EAAE,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG;YACxC,UAAU,EAAE,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,iBAAiB;SACxD,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,iBAAiB,CAC9B,aAAqB,EACrB,KAAa,EACb,KAAa,EACb,KAAc;IAEd,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,aAAa,EAAE;YAC1C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,MAAM,EAAE,kBAAkB;gBAC1B,aAAa,EAAE,qBAAqB,KAAK,EAAE;aAC5C;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,oBAAoB,IAAI,CAAC,GAAG,EAAE,EAAE;gBACzE,KAAK;aACN,CAAC;SACH,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAmC,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAoB,EAAE,gBAAyB;IACvE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAEhC,IAAI,gBAAgB,EAAE,CAAC;QACrB,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC9B,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;QACrC,IAAI,OAAO,GAAG,EAAE,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9C,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAED,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACrB,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACpB,CAAC;IAED,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;AACpB,CAAC;AAEM,KAAK,UAAU,sBAAsB,CAC1C,UAAyC,EAAE;IAE3C,MAAM,OAAO,GAAG,mBAAmB,CAAC,OAAO,CAAC,OAAO,IAAI,UAAU,EAAE,CAAC,CAAC;IAErE,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QAClC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAClD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC5E,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,SAAS;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC1D,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,CAAC;YAC1B,SAAS;QACX,CAAC;QAED,KAAK,MAAM,OAAO,IAAI,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACjE,MAAM,MAAM,GAAG,GAAG,OAAO,GAAG,OAAO,GAAG,CAAC;YACvC,MAAM,KAAK,GAAG,GAAG,MAAM,iBAAiB,CAAC;YACzC,MAAM,KAAK,GAAG,MAAM,iBAAiB,CACnC,QAAQ,CAAC,UAAU,EACnB,KAAK,EACL,KAAK,EACL,OAAO,CAAC,KAAK,IAAI,kBAAkB,CACpC,CAAC;YAEF,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,SAAS;YACX,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACpD,OAAO;gBACL,QAAQ,EAAE,KAAK,CAAC,EAAE;gBAClB,YAAY,EAAE,KAAK,CAAC,MAAM;gBAC1B,KAAK;gBACL,MAAM;gBACN,MAAM;aACP,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,cAAc,CAAC,OAAe,EAAE,KAAa;IAC1D,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACvC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,UAAU,EAAE;YACvC,OAAO,EAAE,EAAE,MAAM,EAAE,kCAAkC,EAAE;SACxD,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,kEAAkE,CAAC,CAAC;QAC7F,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChB,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,OAAO,mBAAmB,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC;IACjB,CAAC;AACH,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,UAAU,CAAC,QAAiB;IAChD,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAC7B,OAAO,CAAC,GAAG,CAAC,aAAa,OAAO,EAAE,CAAC,CAAC;IAEpC,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;IAC7C,OAAO,CAAC,GAAG,CAAC,WAAW,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC;IAEhE,MAAM,QAAQ,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC1C,OAAO,CAAC,GAAG,CAAC,kBAAkB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAEjD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,OAAO,CAAC,GAAG,CAAC,OAAO,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QACpC,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;gBAC/B,OAAO,CAAC,GAAG,CAAC,YAAY,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;YACtC,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,CAAC,GAAG,CAAC,iDAAiD,CAAC,CAAC;IACjE,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,eAAe,CAAC,QAAiB;IACrD,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAC7B,OAAO,CAAC,GAAG,CAAC,aAAa,OAAO,EAAE,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;IACnE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACpD,OAAO;IACT,CAAC;IAED,KAAK;IACL,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;IACxC,OAAO,CAAC,GAAG,CAAC,aAAa,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC5C,OAAO,CAAC,GAAG,CAAC,iBAAiB,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;IACpD,OAAO,CAAC,GAAG,CAAC,SAAS,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IACrC,OAAO,CAAC,GAAG,CAAC,UAAU,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IAEvC,gCAAgC;AAClC,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,SAAS,CAAC,QAAiB;IAC/C,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAC7B,OAAO,CAAC,GAAG,CAAC,aAAa,OAAO,EAAE,CAAC,CAAC;IAEpC,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QAClC,OAAO,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;QAC/D,OAAO;IACT,CAAC;IAED,MAAM,QAAQ,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC1C,OAAO,CAAC,GAAG,CAAC,2BAA2B,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAE1D,uBAAuB;IACvB,OAAO,CAAC,GAAG,CAAC,qDAAqD,CAAC,CAAC;IACnE,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;IAC1C,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;IACpC,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;IAC9C,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;AACzC,CAAC","sourcesContent":["/**\n * Seed Pod CLI Module\n *\n * 提供对 seed pod 的管理功能：\n * - status: 查看 seed pod 状态\n * - credentials: 生成测试凭证\n * - reset: 重置 seed pod\n *\n * 安全限制：只能操作 seed 配置中定义的账户，不能操作任意用户。\n */\n\nimport * as fs from 'fs';\nimport * as path from 'path';\nimport { spawn } from 'child_process';\n\nexport interface SeedAccount {\n  email: string;\n  password: string;\n  pods?: Array<{ name: string }>;\n}\n\nexport interface SeedCredentials {\n  clientId: string;\n  clientSecret: string;\n  webId: string;\n  podUrl: string;\n  issuer: string;\n}\n\nexport interface ResolveSeedCredentialsOptions {\n  seedPath?: string;\n  baseUrl?: string;\n  podName?: string;\n  label?: string;\n}\n\nconst DEFAULT_SEED_PATH = 'config/seeds/test.json';\nconst DEFAULT_BASE_URL = 'http://localhost:3000/';\n\nfunction ensureTrailingSlash(value: string): string {\n  return value.endsWith('/') ? value : `${value}/`;\n}\n\n/**\n * 加载 seed 配置\n */\nexport function loadSeedConfig(seedPath?: string): SeedAccount[] {\n  const configPath = seedPath || process.env.CSS_SEED_CONFIG || path.resolve(process.cwd(), DEFAULT_SEED_PATH);\n\n  if (!fs.existsSync(configPath)) {\n    return [];\n  }\n\n  try {\n    const content = fs.readFileSync(configPath, 'utf-8');\n    const parsed = JSON.parse(content);\n\n    if (!Array.isArray(parsed)) {\n      console.error('Seed config must be an array');\n      return [];\n    }\n\n    return parsed.filter(\n      (entry): entry is SeedAccount =>\n        typeof entry?.email === 'string' && typeof entry?.password === 'string'\n    );\n  } catch (error) {\n    console.error(`Failed to parse seed config: ${error}`);\n    return [];\n  }\n}\n\n/**\n * 获取服务 Base URL\n */\nexport function getBaseUrl(): string {\n  const raw = process.env.CSS_BASE_URL || DEFAULT_BASE_URL;\n  return ensureTrailingSlash(raw);\n}\n\n/**\n * 检查服务是否运行\n */\nexport async function checkServer(baseUrl: string): Promise<boolean> {\n  try {\n    const response = await fetch(`${baseUrl}.account/`, {\n      headers: { Accept: 'application/json' },\n    });\n    return response.ok;\n  } catch {\n    return false;\n  }\n}\n\n/**\n * 使用 seed 账户登录\n */\nexport async function loginWithSeed(\n  baseUrl: string,\n  email: string,\n  password: string\n): Promise<string | null> {\n  try {\n    const response = await fetch(`${baseUrl}.account/login/password/`, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/json',\n        Accept: 'application/json',\n      },\n      body: JSON.stringify({ email, password }),\n    });\n\n    if (!response.ok) {\n      return null;\n    }\n\n    const result = (await response.json()) as { authorization?: string };\n    return result.authorization ?? null;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * 获取账户控制端点\n */\nasync function getAccountControls(\n  baseUrl: string,\n  token: string\n): Promise<{\n  podCreate?: string;\n  credCreate?: string;\n} | null> {\n  try {\n    const response = await fetch(`${baseUrl}.account/`, {\n      headers: {\n        Accept: 'application/json',\n        Authorization: `CSS-Account-Token ${token}`,\n      },\n    });\n\n    if (!response.ok) {\n      return null;\n    }\n\n    const result = (await response.json()) as {\n      controls?: {\n        account?: {\n          pod?: string;\n          clientCredentials?: string;\n        };\n      };\n    };\n\n    return {\n      podCreate: result.controls?.account?.pod,\n      credCreate: result.controls?.account?.clientCredentials,\n    };\n  } catch {\n    return null;\n  }\n}\n\n/**\n * 创建新的 OAuth 客户端凭证\n */\nasync function createCredentials(\n  credCreateUrl: string,\n  token: string,\n  webId: string,\n  label?: string,\n): Promise<{ id: string; secret: string } | null> {\n  try {\n    const response = await fetch(credCreateUrl, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/json',\n        Accept: 'application/json',\n        Authorization: `CSS-Account-Token ${token}`,\n      },\n      body: JSON.stringify({\n        name: label ? `${label}-${Date.now()}` : `seed-credentials-${Date.now()}`,\n        webId,\n      }),\n    });\n\n    if (!response.ok) {\n      return null;\n    }\n\n    return (await response.json()) as { id: string; secret: string };\n  } catch {\n    return null;\n  }\n}\n\nfunction getPodCandidates(account: SeedAccount, preferredPodName?: string): string[] {\n  const names = new Set<string>();\n\n  if (preferredPodName) {\n    names.add(preferredPodName);\n  }\n\n  for (const pod of account.pods ?? []) {\n    if (typeof pod?.name === 'string' && pod.name) {\n      names.add(pod.name);\n    }\n  }\n\n  if (names.size === 0) {\n    names.add('test');\n  }\n\n  return [...names];\n}\n\nexport async function resolveSeedCredentials(\n  options: ResolveSeedCredentialsOptions = {},\n): Promise<SeedCredentials | null> {\n  const baseUrl = ensureTrailingSlash(options.baseUrl || getBaseUrl());\n\n  if (!(await checkServer(baseUrl))) {\n    return null;\n  }\n\n  const accounts = loadSeedConfig(options.seedPath);\n  if (accounts.length === 0) {\n    return null;\n  }\n\n  for (const account of accounts) {\n    const token = await loginWithSeed(baseUrl, account.email, account.password);\n    if (!token) {\n      continue;\n    }\n\n    const controls = await getAccountControls(baseUrl, token);\n    if (!controls?.credCreate) {\n      continue;\n    }\n\n    for (const podName of getPodCandidates(account, options.podName)) {\n      const podUrl = `${baseUrl}${podName}/`;\n      const webId = `${podUrl}profile/card#me`;\n      const creds = await createCredentials(\n        controls.credCreate,\n        token,\n        webId,\n        options.label ?? 'seed-credentials',\n      );\n\n      if (!creds) {\n        continue;\n      }\n\n      const issuer = await discoverIssuer(baseUrl, webId);\n      return {\n        clientId: creds.id,\n        clientSecret: creds.secret,\n        webId,\n        podUrl,\n        issuer,\n      };\n    }\n  }\n\n  return null;\n}\n\n/**\n * 发现 OIDC Issuer\n */\nasync function discoverIssuer(baseUrl: string, webId: string): Promise<string> {\n  try {\n    const profileUrl = webId.split('#')[0];\n    const response = await fetch(profileUrl, {\n      headers: { Accept: 'text/turtle, application/ld+json' },\n    });\n\n    if (!response.ok) {\n      return baseUrl;\n    }\n\n    const body = await response.text();\n    const match = body.match(/<http:\\/\\/www\\.w3\\.org\\/ns\\/solid\\/terms#oidcIssuer>\\s*<([^>]+)>/);\n    if (!match?.[1]) {\n      return baseUrl;\n    }\n    return ensureTrailingSlash(new URL(match[1], profileUrl).toString());\n  } catch {\n    return baseUrl;\n  }\n}\n\n/**\n * seed status 命令\n */\nexport async function seedStatus(seedPath?: string): Promise<void> {\n  const baseUrl = getBaseUrl();\n  console.log(`Base URL: ${baseUrl}`);\n\n  const isRunning = await checkServer(baseUrl);\n  console.log(`Server: ${isRunning ? 'running' : 'not running'}`);\n\n  const accounts = loadSeedConfig(seedPath);\n  console.log(`Seed accounts: ${accounts.length}`);\n\n  for (const account of accounts) {\n    console.log(`  - ${account.email}`);\n    if (account.pods) {\n      for (const pod of account.pods) {\n        console.log(`    pod: ${pod.name}`);\n      }\n    }\n  }\n\n  if (!isRunning) {\n    console.log('\\nServer is not running. Start with: xpod start');\n  }\n}\n\n/**\n * seed credentials 命令\n *\n * 生成 seed pod 的测试凭证，输出到控制台。\n * 只能操作 seed 配置中定义的账户。\n */\nexport async function seedCredentials(seedPath?: string): Promise<void> {\n  const baseUrl = getBaseUrl();\n  console.log(`Base URL: ${baseUrl}`);\n  const result = await resolveSeedCredentials({ seedPath, baseUrl });\n  if (!result) {\n    console.error('Failed to resolve seed credentials');\n    return;\n  }\n\n  // 输出\n  console.log('\\n# Seed Pod Credentials');\n  console.log(`CLIENT_ID=${result.clientId}`);\n  console.log(`CLIENT_SECRET=${result.clientSecret}`);\n  console.log(`WEBID=${result.webId}`);\n  console.log(`ISSUER=${result.issuer}`);\n\n  // Credentials output to console\n}\n\n/**\n * seed reset 命令\n *\n * 重置 seed pod 数据。当前仅输出提示，实际实现需要清理 Pod 数据。\n */\nexport async function seedReset(seedPath?: string): Promise<void> {\n  const baseUrl = getBaseUrl();\n  console.log(`Base URL: ${baseUrl}`);\n\n  if (!(await checkServer(baseUrl))) {\n    console.error('Server is not running. Start with: xpod start');\n    return;\n  }\n\n  const accounts = loadSeedConfig(seedPath);\n  console.log(`Seed accounts to reset: ${accounts.length}`);\n\n  // TODO: 实现实际的 pod 重置逻辑\n  console.log('\\nWarning: seed reset is not fully implemented yet.');\n  console.log('To reset, you may need to:');\n  console.log('  1. Stop the server');\n  console.log('  2. Delete the data directory');\n  console.log('  3. Restart the server');\n}\n"]}

package/dist/credential/schema/tables.d.ts

@@ -1,31 +1,9 @@
-/**
- * Credential Schema - Pod RDF 表定义
- */
-/**
- * Credential - 凭据存储
- *
- * 存储位置: /settings/credentials.ttl
- *
- * RDF 示例:
- * <#cred-001> a udfs:Credential ;
- *     udfs:provider </settings/ai/providers.ttl#google> ;
- *     udfs:service "ai" ;
- *     udfs:status "active" ;
- *     udfs:apiKey "sk-xxx" ;
- *     udfs:label "Google AI" .
- */
-export declare const Credential: import("@undefineds.co/drizzle-solid/dist/core/schema").PodTableWithColumns<import("@undefineds.co/drizzle-solid/dist/core/schema").ResolvedColumns<{
-    id: import("@undefineds.co/drizzle-solid/dist/core/schema").ColumnBuilder<"string", null, true, false>;
-    provider: import("@undefineds.co/drizzle-solid/dist/core/schema").ColumnBuilder<"uri", null, false, false>;
-    service: import("@undefineds.co/drizzle-solid/dist/core/schema").ColumnBuilder<"string", null, false, false>;
-    status: import("@undefineds.co/drizzle-solid/dist/core/schema").ColumnBuilder<"string", null, false, false>;
-    apiKey: import("@undefineds.co/drizzle-solid/dist/core/schema").ColumnBuilder<"string", null, false, false>;
-    baseUrl: import("@undefineds.co/drizzle-solid/dist/core/schema").ColumnBuilder<"string", null, false, false>;
-    proxyUrl: import("@undefineds.co/drizzle-solid/dist/core/schema").ColumnBuilder<"string", null, false, false>;
-    projectId: import("@undefineds.co/drizzle-solid/dist/core/schema").ColumnBuilder<"string", null, false, false>;
-    organizationId: import("@undefineds.co/drizzle-solid/dist/core/schema").ColumnBuilder<"string", null, false, false>;
-    label: import("@undefineds.co/drizzle-solid/dist/core/schema").ColumnBuilder<"string", null, false, false>;
-    lastUsedAt: import("@undefineds.co/drizzle-solid/dist/core/schema").ColumnBuilder<"datetime", null, false, false>;
-    failCount: import("@undefineds.co/drizzle-solid/dist/core/schema").ColumnBuilder<"integer", null, false, false>;
-    rateLimitResetAt: import("@undefineds.co/drizzle-solid/dist/core/schema").ColumnBuilder<"datetime", null, false, false>;
-}>>;
+export declare const ApiKeyCredential: any;
+export declare const OAuthCredential: any;
+export declare const Credential: any;
+export type ApiKeyCredentialRow = typeof ApiKeyCredential.$inferSelect;
+export type ApiKeyCredentialInsert = typeof ApiKeyCredential.$inferInsert;
+export type OAuthCredentialRow = typeof OAuthCredential.$inferSelect;
+export type OAuthCredentialInsert = typeof OAuthCredential.$inferInsert;
+export type CredentialRow = typeof Credential.$inferSelect;
+export type CredentialInsert = typeof Credential.$inferInsert;

package/dist/credential/schema/tables.js

@@ -1,42 +1,8 @@
 "use strict";
-/**
- * Credential Schema - Pod RDF 表定义
- */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.Credential = void 0;
-const drizzle_solid_1 = require("@undefineds.co/drizzle-solid");
-const vocab_1 = require("../../vocab");
-/**
- * Credential - 凭据存储
- *
- * 存储位置: /settings/credentials.ttl
- *
- * RDF 示例:
- * <#cred-001> a udfs:Credential ;
- *     udfs:provider </settings/ai/providers.ttl#google> ;
- *     udfs:service "ai" ;
- *     udfs:status "active" ;
- *     udfs:apiKey "sk-xxx" ;
- *     udfs:label "Google AI" .
- */
-exports.Credential = (0, drizzle_solid_1.podTable)('Credential', {
-    id: (0, drizzle_solid_1.string)('id').primaryKey(),
-    provider: (0, drizzle_solid_1.uri)('provider'),
-    service: (0, drizzle_solid_1.string)('service'),
-    status: (0, drizzle_solid_1.string)('status'),
-    apiKey: (0, drizzle_solid_1.string)('apiKey'),
-    baseUrl: (0, drizzle_solid_1.string)('baseUrl'),
-    proxyUrl: (0, drizzle_solid_1.string)('proxyUrl'),
-    projectId: (0, drizzle_solid_1.string)('projectId'),
-    organizationId: (0, drizzle_solid_1.string)('organizationId'),
-    label: (0, drizzle_solid_1.string)('label'),
-    lastUsedAt: (0, drizzle_solid_1.datetime)('lastUsedAt'),
-    failCount: (0, drizzle_solid_1.int)('failCount'),
-    rateLimitResetAt: (0, drizzle_solid_1.datetime)('rateLimitResetAt'),
-}, {
-    base: '/settings/credentials.ttl',
-    type: vocab_1.UDFS.Credential,
-    namespace: vocab_1.UDFS_NAMESPACE,
-    subjectTemplate: '#{id}',
-});
+exports.Credential = exports.OAuthCredential = exports.ApiKeyCredential = void 0;
+const models_1 = require("@undefineds.co/models");
+exports.ApiKeyCredential = models_1.apiKeyCredentialTable;
+exports.OAuthCredential = models_1.oauthCredentialTable;
+exports.Credential = models_1.credentialTable;
 //# sourceMappingURL=tables.js.map

package/dist/credential/schema/tables.js.map

@@ -1 +1 @@
-{"version":3,"file":"tables.js","sourceRoot":"","sources":["../../../src/credential/schema/tables.ts"],"names":[],"mappings":";AAAA;;GAEG;;;AAEH,gEAAoF;AACpF,uCAAmD;AAEnD;;;;;;;;;;;;GAYG;AACU,QAAA,UAAU,GAAG,IAAA,wBAAQ,EAChC,YAAY,EACZ;IACE,EAAE,EAAE,IAAA,sBAAM,EAAC,IAAI,CAAC,CAAC,UAAU,EAAE;IAC7B,QAAQ,EAAE,IAAA,mBAAG,EAAC,UAAU,CAAC;IACzB,OAAO,EAAE,IAAA,sBAAM,EAAC,SAAS,CAAC;IAC1B,MAAM,EAAE,IAAA,sBAAM,EAAC,QAAQ,CAAC;IACxB,MAAM,EAAE,IAAA,sBAAM,EAAC,QAAQ,CAAC;IACxB,OAAO,EAAE,IAAA,sBAAM,EAAC,SAAS,CAAC;IAC1B,QAAQ,EAAE,IAAA,sBAAM,EAAC,UAAU,CAAC;IAC5B,SAAS,EAAE,IAAA,sBAAM,EAAC,WAAW,CAAC;IAC9B,cAAc,EAAE,IAAA,sBAAM,EAAC,gBAAgB,CAAC;IACxC,KAAK,EAAE,IAAA,sBAAM,EAAC,OAAO,CAAC;IACtB,UAAU,EAAE,IAAA,wBAAQ,EAAC,YAAY,CAAC;IAClC,SAAS,EAAE,IAAA,mBAAG,EAAC,WAAW,CAAC;IAC3B,gBAAgB,EAAE,IAAA,wBAAQ,EAAC,kBAAkB,CAAC;CAC/C,EACD;IACE,IAAI,EAAE,2BAA2B;IACjC,IAAI,EAAE,YAAI,CAAC,UAAU;IACrB,SAAS,EAAE,sBAAc;IACzB,eAAe,EAAE,OAAO;CACzB,CACF,CAAC","sourcesContent":["/**\n * Credential Schema - Pod RDF 表定义\n */\n\nimport { podTable, string, int, datetime, uri } from '@undefineds.co/drizzle-solid';\nimport { UDFS, UDFS_NAMESPACE } from '../../vocab';\n\n/**\n * Credential - 凭据存储\n *\n * 存储位置: /settings/credentials.ttl\n *\n * RDF 示例:\n * <#cred-001> a udfs:Credential ;\n *     udfs:provider </settings/ai/providers.ttl#google> ;\n *     udfs:service \"ai\" ;\n *     udfs:status \"active\" ;\n *     udfs:apiKey \"sk-xxx\" ;\n *     udfs:label \"Google AI\" .\n */\nexport const Credential = podTable(\n  'Credential',\n  {\n    id: string('id').primaryKey(),\n    provider: uri('provider'),\n    service: string('service'),\n    status: string('status'),\n    apiKey: string('apiKey'),\n    baseUrl: string('baseUrl'),\n    proxyUrl: string('proxyUrl'),\n    projectId: string('projectId'),\n    organizationId: string('organizationId'),\n    label: string('label'),\n    lastUsedAt: datetime('lastUsedAt'),\n    failCount: int('failCount'),\n    rateLimitResetAt: datetime('rateLimitResetAt'),\n  },\n  {\n    base: '/settings/credentials.ttl',\n    type: UDFS.Credential,\n    namespace: UDFS_NAMESPACE,\n    subjectTemplate: '#{id}',\n  },\n);\n\n"]}
+{"version":3,"file":"tables.js","sourceRoot":"","sources":["../../../src/credential/schema/tables.ts"],"names":[],"mappings":";;;AAAA,kDAI+B;AAElB,QAAA,gBAAgB,GAAG,8BAA4B,CAAC;AAChD,QAAA,eAAe,GAAG,6BAA2B,CAAC;AAC9C,QAAA,UAAU,GAAG,wBAAsB,CAAC","sourcesContent":["import {\n  apiKeyCredentialTable,\n  credentialTable,\n  oauthCredentialTable,\n} from '@undefineds.co/models';\n\nexport const ApiKeyCredential = apiKeyCredentialTable as any;\nexport const OAuthCredential = oauthCredentialTable as any;\nexport const Credential = credentialTable as any;\n\nexport type ApiKeyCredentialRow = typeof ApiKeyCredential.$inferSelect;\nexport type ApiKeyCredentialInsert = typeof ApiKeyCredential.$inferInsert;\nexport type OAuthCredentialRow = typeof OAuthCredential.$inferSelect;\nexport type OAuthCredentialInsert = typeof OAuthCredential.$inferInsert;\nexport type CredentialRow = typeof Credential.$inferSelect;\nexport type CredentialInsert = typeof Credential.$inferInsert;\n"]}

package/dist/http/vector/VectorHttpHandler.d.ts

@@ -33,8 +33,10 @@ export declare class VectorHttpHandler extends HttpHandler {
     private handleStatus;
     private handleError;
     private authorizeFor;
+    private authorizeForWithBodyDrain;
     private parseUrl;
     private readJsonBody;
+    private drainRequest;
     private sendJsonResponse;
     private sendErrorResponse;
     private writeOptions;