@undefineds.co/xpod 0.3.57 → 0.3.61

package/dist/api/ai-gateway/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/api/ai-gateway/types.ts"],"names":[],"mappings":";;;AAwEA,sCAKC;AAED,8CAEC;AAED,oCAEC;AAED,4CAaC;AAED,kCAsBC;AAED,sDAoEC;AAED,gEAiBC;AAED,gEAiBC;AAED,sDAsBC;AAED,4CAeC;AAED,0DAgBC;AAED,4EAgBC;AAED,gEAOC;AAkED,4CAKC;AArYD,qCAAgD;AAwEhD,SAAgB,aAAa,CAAC,KAAc,EAAE,OAAe;IAC3D,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,6BAAoB,CAAC,GAAG,OAAO,oBAAoB,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,KAAgC,CAAC;AAC1C,CAAC;AAED,SAAgB,iBAAiB,CAAC,KAAc;IAC9C,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED,SAAgB,YAAY,CAAC,KAAc;IACzC,OAAO,KAAK,KAAK,IAAI,CAAC;AACxB,CAAC;AAED,SAAgB,gBAAgB,CAC9B,IAA6B,EAC7B,QAAyB,EACzB,cAAiC;IAEjC,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC;IAC3C,MAAM,SAAS,GAA4B,EAAE,CAAC;IAC9C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,SAAS,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACzB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAC5E,CAAC;AAED,SAAgB,WAAW,CAAC,KAAc;IACxC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,KAAK;aAChB,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YACZ,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC7B,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAQ,IAA2B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC9F,OAAQ,IAAyB,CAAC,IAAI,CAAC;YACzC,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC,CAAC;aACD,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;QACxD,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACzD,CAAC;IACD,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;QAClB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED,SAAgB,qBAAqB,CAAC,OAAgB,EAAE,QAAyB;IAC/E,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAChC,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,IAAI,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAC3C,OAAO,qBAAqB,CAAC,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QAClC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9C,CAAC;IAED,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,EAAwB,EAAE;QACpD,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACxC,CAAC;QACD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtC,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,MAAM,MAAM,GAAG,IAA+B,CAAC;QAC/C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACzB,IACE,IAAI,KAAK,MAAM;eACZ,IAAI,KAAK,YAAY;eACrB,IAAI,KAAK,aAAa,EACzB,CAAC;YACD,MAAM,IAAI,GAAG,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC5C,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,CAAC;QAED,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;YACzB,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,CAAC;YAClC,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBACjC,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;YACvC,CAAC;YACD,IAAI,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC7C,MAAM,KAAK,GAAG,QAAmC,CAAC;gBAClD,OAAO,CAAC;wBACN,IAAI,EAAE,OAAO;wBACb,QAAQ,EAAE,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC;wBACtC,MAAM,EAAE,iBAAiB,CAAC,KAAK,CAAC,MAAM,CAAC;qBACxC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;YAC3B,OAAO,CAAC;oBACN,IAAI,EAAE,OAAO;oBACb,QAAQ,EAAE,iBAAiB,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,iBAAiB,CAAC,MAAM,CAAC,OAAO,CAAC;oBAClF,MAAM,EAAE,iBAAiB,CAAC,MAAM,CAAC,MAAM,CAAC;iBACzC,CAAC,CAAC;QACL,CAAC;QAED,IAAI,IAAI,KAAK,OAAO,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;YACjD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;YAC7B,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACzC,MAAM,KAAK,GAAG,MAAiC,CAAC;gBAChD,OAAO,CAAC;wBACN,IAAI,EAAE,OAAO;wBACb,SAAS,EAAE,iBAAiB,CAAC,KAAK,CAAC,UAAU,CAAC;wBAC9C,IAAI,EAAE,iBAAiB,CAAC,KAAK,CAAC,IAAI,CAAC;qBACpC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAgB,0BAA0B,CAAC,IAAa;IACtD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtC,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,MAAM,GAAG,IAA+B,CAAC;IAC/C,MAAM,IAAI,GAAG,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO;QACL,IAAI,EAAE,UAAU;QAChB,IAAI;QACJ,WAAW,EAAE,iBAAiB,CAAC,MAAM,CAAC,WAAW,CAAC;QAClD,WAAW,EAAE,MAAM,CAAC,UAAU,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ;YACrE,CAAC,CAAC,MAAM,CAAC,UAAqC;YAC9C,CAAC,CAAC,SAAS;KACd,CAAC;AACJ,CAAC;AAED,SAAgB,0BAA0B,CAAC,IAAa;IACtD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtC,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,MAAM,GAAG,IAA+B,CAAC;IAC/C,MAAM,IAAI,GAAG,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO;QACL,IAAI,EAAE,UAAU;QAChB,IAAI;QACJ,WAAW,EAAE,iBAAiB,CAAC,MAAM,CAAC,WAAW,CAAC;QAClD,WAAW,EAAE,MAAM,CAAC,YAAY,IAAI,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ;YACzE,CAAC,CAAC,MAAM,CAAC,YAAuC;YAChD,CAAC,CAAC,SAAS;KACd,CAAC;AACJ,CAAC;AAED,SAAgB,qBAAqB,CAAC,IAAa;IACjD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtC,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,MAAM,GAAG,IAA+B,CAAC;IAC/C,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC;IAC3B,IAAI,CAAC,EAAE,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;QAClC,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,cAAc,GAAG,EAA6B,CAAC;IACrD,MAAM,IAAI,GAAG,iBAAiB,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;IACpD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO;QACL,IAAI,EAAE,UAAU;QAChB,IAAI;QACJ,WAAW,EAAE,iBAAiB,CAAC,cAAc,CAAC,WAAW,CAAC;QAC1D,WAAW,EAAE,cAAc,CAAC,UAAU,IAAI,OAAO,cAAc,CAAC,UAAU,KAAK,QAAQ;YACrF,CAAC,CAAC,cAAc,CAAC,UAAqC;YACtD,CAAC,CAAC,SAAS;KACd,CAAC;AACJ,CAAC;AAED,SAAgB,gBAAgB,CAAC,OAAgB,EAAE,QAAyB;IAC1E,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC5C,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,MAAM,GAAG,OAAkC,CAAC;IAClD,MAAM,IAAI,GAAG,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO;QACL,IAAI,EAAE,IAA8B;QACpC,OAAO,EAAE,qBAAqB,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC;QACxD,IAAI,EAAE,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC;QACpC,UAAU,EAAE,iBAAiB,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,iBAAiB,CAAC,MAAM,CAAC,WAAW,CAAC;KAC5F,CAAC;AACJ,CAAC;AAED,SAAgB,uBAAuB,CAAC,KAAmB;IACzD,OAAO;QACL,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,GAAG,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClF,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,GAAG,CACD,KAAK,CAAC,eAAe,KAAK,SAAS,IAAI,KAAK,CAAC,gBAAgB,KAAK,SAAS;YACzE,CAAC,CAAC;gBACE,oBAAoB,EAAE;oBACpB,GAAG,CAAC,KAAK,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACxF,GAAG,CAAC,KAAK,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,KAAK,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAChG;aACF;YACH,CAAC,CAAC,EAAE,CACP;KACF,CAAC;AACJ,CAAC;AAED,SAAgB,gCAAgC,CAAC,KAAmB;IAClE,OAAO;QACL,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,GAAG,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtF,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,GAAG,CACD,KAAK,CAAC,eAAe,KAAK,SAAS,IAAI,KAAK,CAAC,gBAAgB,KAAK,SAAS;YACzE,CAAC,CAAC;gBACE,qBAAqB,EAAE;oBACrB,GAAG,CAAC,KAAK,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACxF,GAAG,CAAC,KAAK,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,KAAK,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAChG;aACF;YACH,CAAC,CAAC,EAAE,CACP;KACF,CAAC;AACJ,CAAC;AAED,SAAgB,0BAA0B,CAAC,KAAmB;IAC5D,OAAO;QACL,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,GAAG,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClF,GAAG,CAAC,KAAK,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,uBAAuB,EAAE,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClG,GAAG,CAAC,KAAK,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,2BAA2B,EAAE,KAAK,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzG,CAAC;AACJ,CAAC;AAED,MAAa,mBAAmB;IAAhC;QACmB,WAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;QACnC,gBAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;QACjD,cAAS,GAAG,CAAC,CAAC;IA2DxB,CAAC;IAzDQ,KAAK;QACV,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACpB,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC;IACrB,CAAC;IAEM,KAAK,CAAC,MAAc;QACzB,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAClC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YAC7C,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC;QACtB,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC9B,CAAC;QACD,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC3C,CAAC;IAEM,MAAM,CAAC,MAAc,EAAE,KAAa;QACzC,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;QACpE,OAAO,KAAK,CAAC;IACf,CAAC;IAEM,YAAY,CAAC,MAAc;QAChC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAC5B,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACvC,CAAC;IAEM,QAAQ,CAAC,MAAc;QAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,CAAC;YACH,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,6BAAoB,CAAC,6CAA6C,EAAE;gBAC5E,IAAI,EAAE,wBAAwB;gBAC9B,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,MAAM,EAAE;gBACnB,KAAK,EAAE,KAAK;aACb,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC3B,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAChC,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,cAAc,CAAC,MAAc;QACnC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,6BAAoB,CAAC,iDAAiD,EAAE;gBAChF,IAAI,EAAE,wBAAwB;gBAC9B,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,MAAM,EAAE;aACpB,CAAC,CAAC;QACL,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AA9DD,kDA8DC;AAED,SAAgB,gBAAgB,CAAC,KAAmB;IAClD,MAAM,IAAI,6BAAoB,CAAC,8BAA8B,KAAK,CAAC,IAAI,EAAE,EAAE;QACzE,IAAI,EAAE,4BAA4B;QAClC,MAAM,EAAE,GAAG;KACZ,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { GatewayProtocolError } from './errors';\n\nexport type GatewayProtocol = 'responses' | 'anthropic' | 'chatCompletions';\n\nexport type GatewayMessageRole = 'system' | 'developer' | 'user' | 'assistant' | 'tool';\n\nexport type GatewayContentPart =\n  | { type: 'text'; text: string }\n  | { type: 'image'; imageUrl?: string; mediaType?: string; data?: string; detail?: string };\n\nexport interface GatewayMessage {\n  role: GatewayMessageRole;\n  content: GatewayContentPart[];\n  name?: string;\n  toolCallId?: string;\n  protocolExtensions?: Record<string, unknown>;\n}\n\nexport interface GatewayTool {\n  type: 'function';\n  name: string;\n  description?: string;\n  inputSchema?: Record<string, unknown>;\n  protocolExtensions?: Record<string, unknown>;\n}\n\nexport interface GatewayReasoningOptions {\n  effort?: string;\n  exposeSummary?: boolean;\n}\n\nexport interface GatewayUsage {\n  inputTokens?: number;\n  outputTokens?: number;\n  totalTokens?: number;\n  cacheReadTokens?: number;\n  cacheWriteTokens?: number;\n}\n\nexport interface GatewayRequest {\n  model: string;\n  instructions?: string;\n  messages: GatewayMessage[];\n  tools: GatewayTool[];\n  reasoning?: GatewayReasoningOptions;\n  maxOutputTokens?: number;\n  previousResponseId?: string;\n  stream: boolean;\n  protocolExtensions: Partial<Record<GatewayProtocol, Record<string, unknown>>>;\n}\n\nexport type GatewayEvent =\n  | { type: 'response.started'; id: string }\n  | { type: 'text.delta'; text: string }\n  | { type: 'reasoning.delta'; text: string }\n  | { type: 'reasoning.signature'; provider: string; signature: string }\n  | { type: 'tool.started'; callId: string; name: string }\n  | { type: 'tool.arguments.delta'; callId: string; delta: string }\n  | { type: 'tool.completed'; callId: string }\n  | { type: 'usage'; usage: GatewayUsage }\n  | { type: 'response.completed'; finishReason: string };\n\nexport interface GatewayEventSerializer {\n  serializeEvent(event: GatewayEvent): Record<string, unknown> | Record<string, unknown>[];\n}\n\nexport interface GatewayProtocolFrontend {\n  readonly protocol: GatewayProtocol;\n  parseRequest(body: unknown): GatewayRequest;\n  createEventSerializer(): GatewayEventSerializer;\n}\n\nexport function requireObject(value: unknown, context: string): Record<string, unknown> {\n  if (!value || typeof value !== 'object' || Array.isArray(value)) {\n    throw new GatewayProtocolError(`${context} must be an object`);\n  }\n  return value as Record<string, unknown>;\n}\n\nexport function stringOrUndefined(value: unknown): string | undefined {\n  return typeof value === 'string' ? value : undefined;\n}\n\nexport function booleanValue(value: unknown): boolean {\n  return value === true;\n}\n\nexport function extractExtension(\n  body: Record<string, unknown>,\n  protocol: GatewayProtocol,\n  normalizedKeys: readonly string[],\n): Partial<Record<GatewayProtocol, Record<string, unknown>>> {\n  const normalized = new Set(normalizedKeys);\n  const extension: Record<string, unknown> = {};\n  for (const [key, value] of Object.entries(body)) {\n    if (!normalized.has(key)) {\n      extension[key] = value;\n    }\n  }\n  return Object.keys(extension).length > 0 ? { [protocol]: extension } : {};\n}\n\nexport function extractText(value: unknown): string | undefined {\n  if (typeof value === 'string') {\n    return value;\n  }\n  if (Array.isArray(value)) {\n    const parts = value\n      .map((item) => {\n        if (typeof item === 'string') {\n          return item;\n        }\n        if (item && typeof item === 'object' && typeof (item as { text?: unknown }).text === 'string') {\n          return (item as { text: string }).text;\n        }\n        return undefined;\n      })\n      .filter((item): item is string => item !== undefined);\n    return parts.length > 0 ? parts.join('\\n') : undefined;\n  }\n  if (value == null) {\n    return undefined;\n  }\n  return String(value);\n}\n\nexport function normalizeContentParts(content: unknown, protocol: GatewayProtocol): GatewayContentPart[] {\n  if (typeof content === 'string') {\n    return [{ type: 'text', text: content }];\n  }\n\n  if (!Array.isArray(content)) {\n    if (content && typeof content === 'object') {\n      return normalizeContentParts([content], protocol);\n    }\n    const text = extractText(content);\n    return text ? [{ type: 'text', text }] : [];\n  }\n\n  return content.flatMap((part): GatewayContentPart[] => {\n    if (typeof part === 'string') {\n      return [{ type: 'text', text: part }];\n    }\n    if (!part || typeof part !== 'object') {\n      return [];\n    }\n    const record = part as Record<string, unknown>;\n    const type = record.type;\n    if (\n      type === 'text'\n      || type === 'input_text'\n      || type === 'output_text'\n    ) {\n      const text = stringOrUndefined(record.text);\n      return text ? [{ type: 'text', text }] : [];\n    }\n\n    if (type === 'image_url') {\n      const imageUrl = record.image_url;\n      if (typeof imageUrl === 'string') {\n        return [{ type: 'image', imageUrl }];\n      }\n      if (imageUrl && typeof imageUrl === 'object') {\n        const image = imageUrl as Record<string, unknown>;\n        return [{\n          type: 'image',\n          imageUrl: stringOrUndefined(image.url),\n          detail: stringOrUndefined(image.detail),\n        }];\n      }\n    }\n\n    if (type === 'input_image') {\n      return [{\n        type: 'image',\n        imageUrl: stringOrUndefined(record.image_url) ?? stringOrUndefined(record.file_id),\n        detail: stringOrUndefined(record.detail),\n      }];\n    }\n\n    if (type === 'image' && protocol === 'anthropic') {\n      const source = record.source;\n      if (source && typeof source === 'object') {\n        const image = source as Record<string, unknown>;\n        return [{\n          type: 'image',\n          mediaType: stringOrUndefined(image.media_type),\n          data: stringOrUndefined(image.data),\n        }];\n      }\n    }\n\n    return [];\n  });\n}\n\nexport function normalizeToolFromResponses(tool: unknown): GatewayTool | undefined {\n  if (!tool || typeof tool !== 'object') {\n    return undefined;\n  }\n  const record = tool as Record<string, unknown>;\n  const name = stringOrUndefined(record.name);\n  if (!name) {\n    return undefined;\n  }\n  return {\n    type: 'function',\n    name,\n    description: stringOrUndefined(record.description),\n    inputSchema: record.parameters && typeof record.parameters === 'object'\n      ? record.parameters as Record<string, unknown>\n      : undefined,\n  };\n}\n\nexport function normalizeToolFromAnthropic(tool: unknown): GatewayTool | undefined {\n  if (!tool || typeof tool !== 'object') {\n    return undefined;\n  }\n  const record = tool as Record<string, unknown>;\n  const name = stringOrUndefined(record.name);\n  if (!name) {\n    return undefined;\n  }\n  return {\n    type: 'function',\n    name,\n    description: stringOrUndefined(record.description),\n    inputSchema: record.input_schema && typeof record.input_schema === 'object'\n      ? record.input_schema as Record<string, unknown>\n      : undefined,\n  };\n}\n\nexport function normalizeToolFromChat(tool: unknown): GatewayTool | undefined {\n  if (!tool || typeof tool !== 'object') {\n    return undefined;\n  }\n  const record = tool as Record<string, unknown>;\n  const fn = record.function;\n  if (!fn || typeof fn !== 'object') {\n    return undefined;\n  }\n  const functionRecord = fn as Record<string, unknown>;\n  const name = stringOrUndefined(functionRecord.name);\n  if (!name) {\n    return undefined;\n  }\n  return {\n    type: 'function',\n    name,\n    description: stringOrUndefined(functionRecord.description),\n    inputSchema: functionRecord.parameters && typeof functionRecord.parameters === 'object'\n      ? functionRecord.parameters as Record<string, unknown>\n      : undefined,\n  };\n}\n\nexport function normalizeMessage(message: unknown, protocol: GatewayProtocol): GatewayMessage | undefined {\n  if (!message || typeof message !== 'object') {\n    return undefined;\n  }\n  const record = message as Record<string, unknown>;\n  const role = stringOrUndefined(record.role);\n  if (!role) {\n    return undefined;\n  }\n  return {\n    role: role as GatewayMessage['role'],\n    content: normalizeContentParts(record.content, protocol),\n    name: stringOrUndefined(record.name),\n    toolCallId: stringOrUndefined(record.tool_call_id) ?? stringOrUndefined(record.tool_use_id),\n  };\n}\n\nexport function mapGatewayUsageToOpenAi(usage: GatewayUsage): Record<string, unknown> {\n  return {\n    ...(usage.inputTokens !== undefined ? { input_tokens: usage.inputTokens } : {}),\n    ...(usage.outputTokens !== undefined ? { output_tokens: usage.outputTokens } : {}),\n    ...(usage.totalTokens !== undefined ? { total_tokens: usage.totalTokens } : {}),\n    ...(\n      usage.cacheReadTokens !== undefined || usage.cacheWriteTokens !== undefined\n        ? {\n            input_tokens_details: {\n              ...(usage.cacheReadTokens !== undefined ? { cached_tokens: usage.cacheReadTokens } : {}),\n              ...(usage.cacheWriteTokens !== undefined ? { cache_write_tokens: usage.cacheWriteTokens } : {}),\n            },\n          }\n        : {}\n    ),\n  };\n}\n\nexport function mapGatewayUsageToChatCompletions(usage: GatewayUsage): Record<string, unknown> {\n  return {\n    ...(usage.inputTokens !== undefined ? { prompt_tokens: usage.inputTokens } : {}),\n    ...(usage.outputTokens !== undefined ? { completion_tokens: usage.outputTokens } : {}),\n    ...(usage.totalTokens !== undefined ? { total_tokens: usage.totalTokens } : {}),\n    ...(\n      usage.cacheReadTokens !== undefined || usage.cacheWriteTokens !== undefined\n        ? {\n            prompt_tokens_details: {\n              ...(usage.cacheReadTokens !== undefined ? { cached_tokens: usage.cacheReadTokens } : {}),\n              ...(usage.cacheWriteTokens !== undefined ? { cache_write_tokens: usage.cacheWriteTokens } : {}),\n            },\n          }\n        : {}\n    ),\n  };\n}\n\nexport function mapGatewayUsageToAnthropic(usage: GatewayUsage): Record<string, unknown> {\n  return {\n    ...(usage.inputTokens !== undefined ? { input_tokens: usage.inputTokens } : {}),\n    ...(usage.outputTokens !== undefined ? { output_tokens: usage.outputTokens } : {}),\n    ...(usage.cacheReadTokens !== undefined ? { cache_read_input_tokens: usage.cacheReadTokens } : {}),\n    ...(usage.cacheWriteTokens !== undefined ? { cache_creation_input_tokens: usage.cacheWriteTokens } : {}),\n  };\n}\n\nexport class ToolArgumentTracker {\n  private readonly chunks = new Map<string, string>();\n  private readonly toolIndexes = new Map<string, number>();\n  private nextIndex = 0;\n\n  public reset(): void {\n    this.chunks.clear();\n    this.toolIndexes.clear();\n    this.nextIndex = 0;\n  }\n\n  public start(callId: string): number {\n    if (!this.toolIndexes.has(callId)) {\n      this.toolIndexes.set(callId, this.nextIndex);\n      this.nextIndex += 1;\n    }\n    if (!this.chunks.has(callId)) {\n      this.chunks.set(callId, '');\n    }\n    return this.toolIndexes.get(callId) ?? 0;\n  }\n\n  public append(callId: string, delta: string): number {\n    const index = this.requireStarted(callId);\n    this.chunks.set(callId, `${this.chunks.get(callId) ?? ''}${delta}`);\n    return index;\n  }\n\n  public argumentsFor(callId: string): string {\n    this.requireStarted(callId);\n    return this.chunks.get(callId) ?? '';\n  }\n\n  public complete(callId: string): number {\n    const index = this.requireStarted(callId);\n    const value = this.chunks.get(callId) ?? '';\n    try {\n      JSON.parse(value || '{}');\n    } catch (error) {\n      throw new GatewayProtocolError('Completed tool arguments must be valid JSON', {\n        code: 'invalid_tool_arguments',\n        status: 400,\n        details: { callId },\n        cause: error,\n      });\n    }\n    this.chunks.delete(callId);\n    this.toolIndexes.delete(callId);\n    return index;\n  }\n\n  private requireStarted(callId: string): number {\n    const index = this.toolIndexes.get(callId);\n    if (index === undefined || !this.chunks.has(callId)) {\n      throw new GatewayProtocolError('Tool arguments event received before tool start', {\n        code: 'invalid_tool_arguments',\n        status: 400,\n        details: { callId },\n      });\n    }\n    return index;\n  }\n}\n\nexport function unsupportedEvent(event: GatewayEvent): never {\n  throw new GatewayProtocolError(`Unsupported gateway event: ${event.type}`, {\n    code: 'unsupported_protocol_event',\n    status: 500,\n  });\n}\n"]}

package/dist/api/auth/AuthContext.d.ts

@@ -3,7 +3,7 @@
  *
  * Authenticated caller context.
  * - Solid Token: user provides Bearer or DPoP token
- * - CSS client credentials: third-party provides client_id/client_secret,
+ * - CSS client credentials wrapper: third-party provides client_id/client_secret,
  *   API Server exchanges them for a Solid token
  * - Node Token: edge node provides node API key
  */
@@ -17,8 +17,18 @@ export interface SolidAuthContext {
     accessToken?: string;
     tokenType?: 'Bearer' | 'DPoP';
     dpopProof?: string;
-    /** Whether this was authenticated via the sk-* client credentials wrapper */
+    /** Whether this was authenticated via the sk-* CSS client credentials wrapper */
     viaApiKey?: boolean;
+    /** Whether this was authenticated via an Xpod Gateway API key. */
+    viaGatewayApiKey?: boolean;
+    /** Whether this principal came from a stateless internal runtime invocation token. */
+    internalInvocation?: boolean;
+    /** Opaque Gateway API key id, present only for gateway-key principals. */
+    gatewayKeyId?: string;
+    /** SHA-256 fingerprint of the authenticated Gateway bearer key, never the raw key. */
+    gatewayKeyFingerprint?: string;
+    /** Gateway/API scopes bound to the authenticated principal. */
+    scopes?: string[];
 }
 export interface NodeAuthContext {
     type: 'node';
@@ -49,6 +59,11 @@ export declare function getAccountId(ctx: AuthContext): string | undefined;
 export declare function getNodeId(ctx: AuthContext): string | undefined;
 export declare function isServiceAuth(ctx: AuthContext): ctx is ServiceAuthContext;
 /**
- * Check if a service auth context has the required scope
+ * Check if a service auth context has the required scope.
  */
 export declare function hasScope(ctx: AuthContext, scope: string): boolean;
+/**
+ * Gateway API keys carry explicit API scopes. Normal Solid callers remain
+ * authorized by the Solid layer and are not narrowed here.
+ */
+export declare function hasGatewayScope(ctx: AuthContext, scope: string): boolean;

package/dist/api/auth/AuthContext.js

@@ -4,7 +4,7 @@
  *
  * Authenticated caller context.
  * - Solid Token: user provides Bearer or DPoP token
- * - CSS client credentials: third-party provides client_id/client_secret,
+ * - CSS client credentials wrapper: third-party provides client_id/client_secret,
  *   API Server exchanges them for a Solid token
  * - Node Token: edge node provides node API key
  */
@@ -17,6 +17,7 @@ exports.getAccountId = getAccountId;
 exports.getNodeId = getNodeId;
 exports.isServiceAuth = isServiceAuth;
 exports.hasScope = hasScope;
+exports.hasGatewayScope = hasGatewayScope;
 function isSolidAuth(ctx) {
     return ctx.type === 'solid';
 }
@@ -54,9 +55,19 @@ function isServiceAuth(ctx) {
     return ctx.type === 'service';
 }
 /**
- * Check if a service auth context has the required scope
+ * Check if a service auth context has the required scope.
  */
 function hasScope(ctx, scope) {
     return ctx.type === 'service' && ctx.scopes.includes(scope);
 }
+/**
+ * Gateway API keys carry explicit API scopes. Normal Solid callers remain
+ * authorized by the Solid layer and are not narrowed here.
+ */
+function hasGatewayScope(ctx, scope) {
+    if (ctx.type !== 'solid' || ctx.viaGatewayApiKey !== true) {
+        return true;
+    }
+    return ctx.scopes?.includes(scope) === true;
+}
 //# sourceMappingURL=AuthContext.js.map

package/dist/api/auth/AuthContext.js.map

@@ -1 +1 @@
-{"version":3,"file":"AuthContext.js","sourceRoot":"","sources":["../../../src/api/auth/AuthContext.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;AA+BH,kCAEC;AAED,gCAEC;AAKD,4BAEC;AAKD,wCAEC;AAKD,oCAQC;AAED,8BAEC;AAED,sCAEC;AAKD,4BAEC;AAhDD,SAAgB,WAAW,CAAC,GAAgB;IAC1C,OAAO,GAAG,CAAC,IAAI,KAAK,OAAO,CAAC;AAC9B,CAAC;AAED,SAAgB,UAAU,CAAC,GAAgB;IACzC,OAAO,GAAG,CAAC,IAAI,KAAK,MAAM,CAAC;AAC7B,CAAC;AAED;;GAEG;AACH,SAAgB,QAAQ,CAAC,GAAgB;IACvC,OAAO,GAAG,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACtD,CAAC;AAED;;GAEG;AACH,SAAgB,cAAc,CAAC,GAAgB;IAC7C,OAAO,GAAG,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5D,CAAC;AAED;;GAEG;AACH,SAAgB,YAAY,CAAC,GAAgB;IAC3C,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACzB,OAAO,GAAG,CAAC,SAAS,CAAC;IACvB,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QACxB,OAAO,GAAG,CAAC,SAAS,CAAC;IACvB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAgB,SAAS,CAAC,GAAgB;IACxC,OAAO,GAAG,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AACtD,CAAC;AAED,SAAgB,aAAa,CAAC,GAAgB;IAC5C,OAAO,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC;AAChC,CAAC;AAED;;GAEG;AACH,SAAgB,QAAQ,CAAC,GAAgB,EAAE,KAAa;IACtD,OAAO,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC9D,CAAC","sourcesContent":["/**\n * Authentication context representing the authenticated caller\n * \n * Authenticated caller context.\n * - Solid Token: user provides Bearer or DPoP token\n * - CSS client credentials: third-party provides client_id/client_secret,\n *   API Server exchanges them for a Solid token\n * - Node Token: edge node provides node API key\n */\n\nexport interface SolidAuthContext {\n  type: 'solid';\n  webId: string;\n  accountId?: string;\n  clientId?: string;\n  clientSecret?: string;  // For client credentials auth\n  displayName?: string;\n  accessToken?: string;\n  tokenType?: 'Bearer' | 'DPoP';\n  dpopProof?: string;\n  /** Whether this was authenticated via the sk-* client credentials wrapper */\n  viaApiKey?: boolean;\n}\n\nexport interface NodeAuthContext {\n  type: 'node';\n  nodeId: string;\n  accountId?: string;\n}\n\nexport interface ServiceAuthContext {\n  type: 'service';\n  serviceType: 'local' | 'business' | 'cloud' | 'compute';\n  serviceId: string;\n  scopes: string[];\n}\n\nexport type AuthContext = SolidAuthContext | NodeAuthContext | ServiceAuthContext;\n\nexport function isSolidAuth(ctx: AuthContext): ctx is SolidAuthContext {\n  return ctx.type === 'solid';\n}\n\nexport function isNodeAuth(ctx: AuthContext): ctx is NodeAuthContext {\n  return ctx.type === 'node';\n}\n\n/**\n * Get webId from auth context\n */\nexport function getWebId(ctx: AuthContext): string | undefined {\n  return ctx.type === 'solid' ? ctx.webId : undefined;\n}\n\n/**\n * Get display name from auth context\n */\nexport function getDisplayName(ctx: AuthContext): string | undefined {\n  return ctx.type === 'solid' ? ctx.displayName : undefined;\n}\n\n/**\n * Get accountId from auth context (if available)\n */\nexport function getAccountId(ctx: AuthContext): string | undefined {\n  if (ctx.type === 'solid') {\n    return ctx.accountId;\n  }\n  if (ctx.type === 'node') {\n    return ctx.accountId;\n  }\n  return undefined;\n}\n\nexport function getNodeId(ctx: AuthContext): string | undefined {\n  return ctx.type === 'node' ? ctx.nodeId : undefined;\n}\n\nexport function isServiceAuth(ctx: AuthContext): ctx is ServiceAuthContext {\n  return ctx.type === 'service';\n}\n\n/**\n * Check if a service auth context has the required scope\n */\nexport function hasScope(ctx: AuthContext, scope: string): boolean {\n  return ctx.type === 'service' && ctx.scopes.includes(scope);\n}\n"]}
+{"version":3,"file":"AuthContext.js","sourceRoot":"","sources":["../../../src/api/auth/AuthContext.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;AAyCH,kCAEC;AAED,gCAEC;AAKD,4BAEC;AAKD,wCAEC;AAKD,oCAQC;AAED,8BAEC;AAED,sCAEC;AAKD,4BAEC;AAMD,0CAKC;AA3DD,SAAgB,WAAW,CAAC,GAAgB;IAC1C,OAAO,GAAG,CAAC,IAAI,KAAK,OAAO,CAAC;AAC9B,CAAC;AAED,SAAgB,UAAU,CAAC,GAAgB;IACzC,OAAO,GAAG,CAAC,IAAI,KAAK,MAAM,CAAC;AAC7B,CAAC;AAED;;GAEG;AACH,SAAgB,QAAQ,CAAC,GAAgB;IACvC,OAAO,GAAG,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACtD,CAAC;AAED;;GAEG;AACH,SAAgB,cAAc,CAAC,GAAgB;IAC7C,OAAO,GAAG,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5D,CAAC;AAED;;GAEG;AACH,SAAgB,YAAY,CAAC,GAAgB;IAC3C,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACzB,OAAO,GAAG,CAAC,SAAS,CAAC;IACvB,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QACxB,OAAO,GAAG,CAAC,SAAS,CAAC;IACvB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAgB,SAAS,CAAC,GAAgB;IACxC,OAAO,GAAG,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AACtD,CAAC;AAED,SAAgB,aAAa,CAAC,GAAgB;IAC5C,OAAO,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC;AAChC,CAAC;AAED;;GAEG;AACH,SAAgB,QAAQ,CAAC,GAAgB,EAAE,KAAa;IACtD,OAAO,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC9D,CAAC;AAED;;;GAGG;AACH,SAAgB,eAAe,CAAC,GAAgB,EAAE,KAAa;IAC7D,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,IAAI,GAAG,CAAC,gBAAgB,KAAK,IAAI,EAAE,CAAC;QAC1D,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC;AAC9C,CAAC","sourcesContent":["/**\n * Authentication context representing the authenticated caller\n * \n * Authenticated caller context.\n * - Solid Token: user provides Bearer or DPoP token\n * - CSS client credentials wrapper: third-party provides client_id/client_secret,\n *   API Server exchanges them for a Solid token\n * - Node Token: edge node provides node API key\n */\n\nexport interface SolidAuthContext {\n  type: 'solid';\n  webId: string;\n  accountId?: string;\n  clientId?: string;\n  clientSecret?: string;  // For client credentials auth\n  displayName?: string;\n  accessToken?: string;\n  tokenType?: 'Bearer' | 'DPoP';\n  dpopProof?: string;\n  /** Whether this was authenticated via the sk-* CSS client credentials wrapper */\n  viaApiKey?: boolean;\n  /** Whether this was authenticated via an Xpod Gateway API key. */\n  viaGatewayApiKey?: boolean;\n  /** Whether this principal came from a stateless internal runtime invocation token. */\n  internalInvocation?: boolean;\n  /** Opaque Gateway API key id, present only for gateway-key principals. */\n  gatewayKeyId?: string;\n  /** SHA-256 fingerprint of the authenticated Gateway bearer key, never the raw key. */\n  gatewayKeyFingerprint?: string;\n  /** Gateway/API scopes bound to the authenticated principal. */\n  scopes?: string[];\n}\n\nexport interface NodeAuthContext {\n  type: 'node';\n  nodeId: string;\n  accountId?: string;\n}\n\nexport interface ServiceAuthContext {\n  type: 'service';\n  serviceType: 'local' | 'business' | 'cloud' | 'compute';\n  serviceId: string;\n  scopes: string[];\n}\n\nexport type AuthContext = SolidAuthContext | NodeAuthContext | ServiceAuthContext;\n\nexport function isSolidAuth(ctx: AuthContext): ctx is SolidAuthContext {\n  return ctx.type === 'solid';\n}\n\nexport function isNodeAuth(ctx: AuthContext): ctx is NodeAuthContext {\n  return ctx.type === 'node';\n}\n\n/**\n * Get webId from auth context\n */\nexport function getWebId(ctx: AuthContext): string | undefined {\n  return ctx.type === 'solid' ? ctx.webId : undefined;\n}\n\n/**\n * Get display name from auth context\n */\nexport function getDisplayName(ctx: AuthContext): string | undefined {\n  return ctx.type === 'solid' ? ctx.displayName : undefined;\n}\n\n/**\n * Get accountId from auth context (if available)\n */\nexport function getAccountId(ctx: AuthContext): string | undefined {\n  if (ctx.type === 'solid') {\n    return ctx.accountId;\n  }\n  if (ctx.type === 'node') {\n    return ctx.accountId;\n  }\n  return undefined;\n}\n\nexport function getNodeId(ctx: AuthContext): string | undefined {\n  return ctx.type === 'node' ? ctx.nodeId : undefined;\n}\n\nexport function isServiceAuth(ctx: AuthContext): ctx is ServiceAuthContext {\n  return ctx.type === 'service';\n}\n\n/**\n * Check if a service auth context has the required scope.\n */\nexport function hasScope(ctx: AuthContext, scope: string): boolean {\n  return ctx.type === 'service' && ctx.scopes.includes(scope);\n}\n\n/**\n * Gateway API keys carry explicit API scopes. Normal Solid callers remain\n * authorized by the Solid layer and are not narrowed here.\n */\nexport function hasGatewayScope(ctx: AuthContext, scope: string): boolean {\n  if (ctx.type !== 'solid' || ctx.viaGatewayApiKey !== true) {\n    return true;\n  }\n  return ctx.scopes?.includes(scope) === true;\n}\n"]}

package/dist/api/auth/Authenticator.d.ts

@@ -7,6 +7,9 @@ export interface AuthResult {
     success: boolean;
     context?: AuthContext;
     error?: string;
+    category?: 'invalid_credentials' | 'forbidden' | 'service_unavailable';
+    statusCode?: 401 | 403 | 503;
+    cause?: unknown;
 }
 /**
  * Base interface for authenticators

package/dist/api/auth/Authenticator.js.map

@@ -1 +1 @@
-{"version":3,"file":"Authenticator.js","sourceRoot":"","sources":["../../../src/api/auth/Authenticator.ts"],"names":[],"mappings":"","sourcesContent":["import type { IncomingMessage } from 'node:http';\nimport type { AuthContext } from './AuthContext';\n\n/**\n * Result of authentication attempt\n */\nexport interface AuthResult {\n  success: boolean;\n  context?: AuthContext;\n  error?: string;\n}\n\n/**\n * Base interface for authenticators\n */\nexport interface Authenticator {\n  /**\n   * Check if this authenticator can handle the request\n   */\n  canAuthenticate(request: IncomingMessage): boolean;\n\n  /**\n   * Attempt to authenticate the request\n   */\n  authenticate(request: IncomingMessage): Promise<AuthResult>;\n}\n"]}
+{"version":3,"file":"Authenticator.js","sourceRoot":"","sources":["../../../src/api/auth/Authenticator.ts"],"names":[],"mappings":"","sourcesContent":["import type { IncomingMessage } from 'node:http';\nimport type { AuthContext } from './AuthContext';\n\n/**\n * Result of authentication attempt\n */\nexport interface AuthResult {\n  success: boolean;\n  context?: AuthContext;\n  error?: string;\n  category?: 'invalid_credentials' | 'forbidden' | 'service_unavailable';\n  statusCode?: 401 | 403 | 503;\n  cause?: unknown;\n}\n\n/**\n * Base interface for authenticators\n */\nexport interface Authenticator {\n  /**\n   * Check if this authenticator can handle the request\n   */\n  canAuthenticate(request: IncomingMessage): boolean;\n\n  /**\n   * Attempt to authenticate the request\n   */\n  authenticate(request: IncomingMessage): Promise<AuthResult>;\n}\n"]}

package/dist/api/auth/ClientCredentialsAuthenticator.d.ts

@@ -20,12 +20,12 @@ export interface ClientCredentialsAuthenticatorOptions {
     tokenEndpoint: string;
 }
 /**
- * Authenticator for CSS client credentials in sk-xxx transport format.
+ * Authenticator for CSS client credentials wrapped in sk-xxx transport format.
  *
  * Format: sk-base64(client_id:client_secret)
  *
  * This authenticator:
- * 1. Decodes the transport token to get client_id and client_secret
+ * 1. Decodes the wrapper to get client_id and client_secret
  * 2. Exchanges them for a Solid Token via CSS token endpoint
  * 3. Extracts webId from the token response
  * 4. Returns a SolidAuthContext
@@ -38,9 +38,5 @@ export declare class ClientCredentialsAuthenticator implements Authenticator {
     canAuthenticate(request: IncomingMessage): boolean;
     authenticate(request: IncomingMessage): Promise<AuthResult>;
     private exchangeForToken;
-    /**
-     * Extract webId from JWT access token
-     */
-    private extractWebIdFromJwt;
     private isJwt;
 }

package/dist/api/auth/ClientCredentialsAuthenticator.js

@@ -2,13 +2,14 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ClientCredentialsAuthenticator = void 0;
 const global_logger_factory_1 = require("global-logger-factory");
+const TokenIdentity_1 = require("./TokenIdentity");
 /**
- * Authenticator for CSS client credentials in sk-xxx transport format.
+ * Authenticator for CSS client credentials wrapped in sk-xxx transport format.
  *
  * Format: sk-base64(client_id:client_secret)
  *
  * This authenticator:
- * 1. Decodes the transport token to get client_id and client_secret
+ * 1. Decodes the wrapper to get client_id and client_secret
  * 2. Exchanges them for a Solid Token via CSS token endpoint
  * 3. Extracts webId from the token response
  * 4. Returns a SolidAuthContext
@@ -24,7 +25,7 @@ class ClientCredentialsAuthenticator {
         if (!auth?.startsWith('Bearer ')) {
             return false;
         }
-        // If there's a DPoP header, it's a Solid Token, not a client credentials wrapper
+        // If there's a DPoP header, it's a Solid Token, not a client credentials wrapper.
         if (request.headers.dpop) {
             return false;
         }
@@ -42,7 +43,7 @@ class ClientCredentialsAuthenticator {
         }
         const token = authorization.slice(7).trim();
         if (!token) {
-            return { success: false, error: 'Empty API Key' };
+            return { success: false, error: 'Empty client credentials wrapper' };
         }
         try {
             let clientId;
@@ -54,21 +55,21 @@ class ClientCredentialsAuthenticator {
                     const decoded = Buffer.from(base64, 'base64').toString('utf-8');
                     const colonIndex = decoded.indexOf(':');
                     if (colonIndex === -1) {
-                        return { success: false, error: 'Invalid API Key format: missing colon separator' };
+                        return { success: false, error: 'Invalid client credentials wrapper: missing colon separator' };
                     }
                     clientId = decoded.slice(0, colonIndex);
                     clientSecret = decoded.slice(colonIndex + 1);
                     if (!clientId || !clientSecret) {
-                        return { success: false, error: 'Invalid API Key format: empty client_id or client_secret' };
+                        return { success: false, error: 'Invalid client credentials wrapper: empty client_id or client_secret' };
                     }
                 }
                 catch {
-                    return { success: false, error: 'Invalid API Key encoding' };
+                    return { success: false, error: 'Invalid client credentials wrapper encoding' };
                 }
             }
             else {
                 // Non sk- format is intentionally unsupported; Xpod does not keep an API key mirror table.
-                return { success: false, error: 'Invalid API Key format: must start with sk-' };
+                return { success: false, error: 'Invalid client credentials wrapper: must start with sk-' };
             }
             // Check cache first
             if (this.tokenCache) {
@@ -111,11 +112,11 @@ class ClientCredentialsAuthenticator {
                 tokenType: tokenResult.tokenType ?? 'Bearer',
                 viaApiKey: true,
             };
-            this.logger.debug(`Authenticated API Key for webId: ${tokenResult.webId}`);
+            this.logger.debug(`Authenticated client credentials for webId: ${tokenResult.webId}`);
             return { success: true, context };
         }
         catch (error) {
-            this.logger.error(`API Key authentication error: ${error}`);
+            this.logger.error(`Client credentials authentication error: ${error}`);
             return { success: false, error: 'Authentication failed' };
         }
     }
@@ -148,10 +149,7 @@ class ClientCredentialsAuthenticator {
             }
             const data = await response.json();
             // Extract webId from token response or decode from JWT
-            let webId = data.webid;
-            if (!webId && data.access_token) {
-                webId = this.extractWebIdFromJwt(data.access_token);
-            }
+            const webId = (0, TokenIdentity_1.extractAuthoritativeWebIdFromTokenResponse)(data);
             if (!webId) {
                 return { success: false, error: 'Could not determine webId from token response' };
             }
@@ -171,22 +169,6 @@ class ClientCredentialsAuthenticator {
             return { success: false, error: 'Token exchange failed' };
         }
     }
-    /**
-     * Extract webId from JWT access token
-     */
-    extractWebIdFromJwt(jwt) {
-        try {
-            const parts = jwt.split('.');
-            if (parts.length !== 3) {
-                return undefined;
-            }
-            const payload = JSON.parse(Buffer.from(parts[1], 'base64').toString('utf-8'));
-            return payload.webid || payload.webId || payload.sub;
-        }
-        catch {
-            return undefined;
-        }
-    }
     isJwt(token) {
         return /^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(token);
     }

package/dist/api/auth/ClientCredentialsAuthenticator.js.map

@@ -1 +1 @@
-{"version":3,"file":"ClientCredentialsAuthenticator.js","sourceRoot":"","sources":["../../../src/api/auth/ClientCredentialsAuthenticator.ts"],"names":[],"mappings":";;;AACA,iEAAqD;AA+BrD;;;;;;;;;;GAUG;AACH,MAAa,8BAA8B;IAKzC,YAAmB,OAA8C;QAJhD,WAAM,GAAG,IAAA,oCAAY,EAAC,IAAI,CAAC,CAAC;QAK3C,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IAC7C,CAAC;IAEM,eAAe,CAAC,OAAwB;QAC7C,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QAC3C,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACjC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,iFAAiF;QACjF,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YACzB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,KAAK,CAAC;QACf,CAAC;QACD,8CAA8C;QAC9C,OAAO,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACvD,CAAC;IAEM,KAAK,CAAC,YAAY,CAAC,OAAwB;QAChD,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QACpD,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC;QAC3D,CAAC;QAED,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC;QACpD,CAAC;QAED,IAAI,CAAC;YACH,IAAI,QAAgB,CAAC;YACrB,IAAI,YAAoB,CAAC;YAEzB,+DAA+D;YAC/D,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC5B,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAC9B,IAAI,CAAC;oBACH,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;oBAChE,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;oBACxC,IAAI,UAAU,KAAK,CAAC,CAAC,EAAE,CAAC;wBACtB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,iDAAiD,EAAE,CAAC;oBACtF,CAAC;oBACD,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;oBACxC,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;oBAE7C,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,EAAE,CAAC;wBAC/B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,0DAA0D,EAAE,CAAC;oBAC/F,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC;gBAC/D,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,2FAA2F;gBAC3F,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,6CAA6C,EAAE,CAAC;YAClF,CAAC;YAED,oBAAoB;YACpB,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gBACpB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBACnD,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;oBAC5C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,0BAA0B,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;oBACvE,OAAO;wBACL,OAAO,EAAE,IAAI;wBACb,OAAO,EAAE;4BACP,IAAI,EAAE,OAAO;4BACb,KAAK,EAAE,MAAM,CAAC,KAAK;4BACnB,SAAS,EAAE,MAAM,CAAC,KAAK;4BACvB,QAAQ;4BACR,YAAY;4BACZ,WAAW,EAAE,MAAM,CAAC,KAAK;4BACzB,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,QAAQ;4BACvC,SAAS,EAAE,IAAI;yBAChB;qBACF,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,qCAAqC;YACrC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oCAAoC,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;YAC5E,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;YACxE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,kCAAkC,WAAW,CAAC,OAAO,WAAW,WAAW,CAAC,KAAK,WAAW,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC;YAEnI,IAAI,CAAC,WAAW,CAAC,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;gBACrE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,IAAI,uBAAuB,EAAE,CAAC;YACjF,CAAC;YAED,kBAAkB;YAClB,IAAI,IAAI,CAAC,UAAU,IAAI,WAAW,CAAC,SAAS,EAAE,CAAC;gBAC7C,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CACvB,QAAQ,EACR,WAAW,CAAC,KAAM,EAClB,WAAW,CAAC,KAAK,EACjB,WAAW,CAAC,SAAS,EACrB,WAAW,CAAC,SAAS,CACtB,CAAC;YACJ,CAAC;YAED,MAAM,OAAO,GAAqB;gBAChC,IAAI,EAAE,OAAO;gBACb,KAAK,EAAE,WAAW,CAAC,KAAK;gBACxB,SAAS,EAAE,WAAW,CAAC,KAAK;gBAC5B,QAAQ;gBACR,YAAY;gBACZ,WAAW,EAAE,WAAW,CAAC,KAAK;gBAC9B,SAAS,EAAE,WAAW,CAAC,SAAS,IAAI,QAAQ;gBAC5C,SAAS,EAAE,IAAI;aAChB,CAAC;YAEF,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oCAAoC,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC;YAC3E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,KAAK,EAAE,CAAC,CAAC;YAC5D,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC;QAC5D,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,QAAgB,EAAE,YAAoB;QAQnE,6BAA6B;QAC7B,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,aAAa,EAAE,CAAC;YAC3C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qCAAqC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;YACjF,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,KAAK,EAAE,aAAa,QAAQ,EAAE;gBAC9B,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC;aAC1C,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,aAAa,EAAE;gBAC/C,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,mCAAmC;iBACpD;gBACD,IAAI,EAAE,IAAI,eAAe,CAAC;oBACxB,UAAU,EAAE,oBAAoB;oBAChC,SAAS,EAAE,QAAQ;oBACnB,aAAa,EAAE,YAAY;iBAC5B,CAAC;aACH,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACpC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0BAA0B,QAAQ,CAAC,MAAM,IAAI,KAAK,EAAE,CAAC,CAAC;gBACvE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,0BAA0B,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YAChF,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAK/B,CAAC;YAEF,uDAAuD;YACvD,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;YACvB,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;gBAChC,KAAK,GAAG,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACtD,CAAC;YAED,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,+CAA+C,EAAE,CAAC;YACpF,CAAC;YAED,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU;gBAC/B,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI,GAAG,KAAK,CAAC,CAAC,eAAe;gBACvE,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,iBAAiB;YAErD,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,KAAK,EAAE,IAAI,CAAC,YAAY;gBACxB,SAAS,EAAE,IAAI,CAAC,UAAU,EAAE,WAAW,EAAE,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;gBACxE,KAAK;gBACL,SAAS;aACV,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,yBAAyB,KAAK,EAAE,CAAC,CAAC;YACpD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC;QAC5D,CAAC;IACH,CAAC;IAED;;OAEG;IACK,mBAAmB,CAAC,GAAW;QACrC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;YAC9E,OAAO,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,KAAa;QACzB,OAAO,kDAAkD,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxE,CAAC;CACF;AAvND,wEAuNC","sourcesContent":["import type { IncomingMessage } from 'node:http';\nimport { getLoggerFor } from 'global-logger-factory';\nimport type { Authenticator, AuthResult } from './Authenticator';\nimport type { SolidAuthContext } from './AuthContext';\n\n/**\n * Interface for token cache\n */\nexport interface TokenCache {\n  get(clientId: string): Promise<{\n    token: string;\n    tokenType?: 'Bearer' | 'DPoP';\n    webId: string;\n    expiresAt: Date;\n  } | undefined>;\n  set(\n    clientId: string,\n    token: string,\n    webId: string,\n    expiresAt: Date,\n    tokenType?: 'Bearer' | 'DPoP',\n  ): Promise<void>;\n}\n\nexport interface ClientCredentialsAuthenticatorOptions {\n  tokenCache?: TokenCache;\n  /**\n   * CSS token endpoint URL\n   */\n  tokenEndpoint: string;\n}\n\n/**\n * Authenticator for CSS client credentials in sk-xxx transport format.\n * \n * Format: sk-base64(client_id:client_secret)\n * \n * This authenticator:\n * 1. Decodes the transport token to get client_id and client_secret\n * 2. Exchanges them for a Solid Token via CSS token endpoint\n * 3. Extracts webId from the token response\n * 4. Returns a SolidAuthContext\n */\nexport class ClientCredentialsAuthenticator implements Authenticator {\n  private readonly logger = getLoggerFor(this);\n  private readonly tokenCache?: TokenCache;\n  private readonly tokenEndpoint: string;\n\n  public constructor(options: ClientCredentialsAuthenticatorOptions) {\n    this.tokenCache = options.tokenCache;\n    this.tokenEndpoint = options.tokenEndpoint;\n  }\n\n  public canAuthenticate(request: IncomingMessage): boolean {\n    const auth = request.headers.authorization;\n    if (!auth?.startsWith('Bearer ')) {\n      return false;\n    }\n    // If there's a DPoP header, it's a Solid Token, not a client credentials wrapper\n    if (request.headers.dpop) {\n      return false;\n    }\n    const token = auth.slice(7).trim();\n    if (!token) {\n      return false;\n    }\n    // Only handle sk-xxx format or non-JWT tokens\n    return token.startsWith('sk-') || !this.isJwt(token);\n  }\n\n  public async authenticate(request: IncomingMessage): Promise<AuthResult> {\n    const authorization = request.headers.authorization;\n    if (!authorization?.startsWith('Bearer ')) {\n      return { success: false, error: 'Missing Bearer token' };\n    }\n\n    const token = authorization.slice(7).trim();\n    if (!token) {\n      return { success: false, error: 'Empty API Key' };\n    }\n\n    try {\n      let clientId: string;\n      let clientSecret: string;\n\n      // Parse sk-xxx format (base64 encoded client_id:client_secret)\n      if (token.startsWith('sk-')) {\n        const base64 = token.slice(3);\n        try {\n          const decoded = Buffer.from(base64, 'base64').toString('utf-8');\n          const colonIndex = decoded.indexOf(':');\n          if (colonIndex === -1) {\n            return { success: false, error: 'Invalid API Key format: missing colon separator' };\n          }\n          clientId = decoded.slice(0, colonIndex);\n          clientSecret = decoded.slice(colonIndex + 1);\n          \n          if (!clientId || !clientSecret) {\n            return { success: false, error: 'Invalid API Key format: empty client_id or client_secret' };\n          }\n        } catch {\n          return { success: false, error: 'Invalid API Key encoding' };\n        }\n      } else {\n        // Non sk- format is intentionally unsupported; Xpod does not keep an API key mirror table.\n        return { success: false, error: 'Invalid API Key format: must start with sk-' };\n      }\n\n      // Check cache first\n      if (this.tokenCache) {\n        const cached = await this.tokenCache.get(clientId);\n        if (cached && cached.expiresAt > new Date()) {\n          this.logger.debug(`Using cached token for ${clientId.slice(0, 8)}...`);\n          return {\n            success: true,\n            context: {\n              type: 'solid',\n              webId: cached.webId,\n              accountId: cached.webId,\n              clientId,\n              clientSecret,\n              accessToken: cached.token,\n              tokenType: cached.tokenType ?? 'Bearer',\n              viaApiKey: true,\n            },\n          };\n        }\n      }\n\n      // Exchange for token at CSS endpoint\n      this.logger.debug(`Exchanging client credentials at ${this.tokenEndpoint}`);\n      const tokenResult = await this.exchangeForToken(clientId, clientSecret);\n      this.logger.debug(`Token exchange result: success=${tokenResult.success}, webId=${tokenResult.webId}, error=${tokenResult.error}`);\n      \n      if (!tokenResult.success || !tokenResult.webId || !tokenResult.token) {\n        return { success: false, error: tokenResult.error || 'Token exchange failed' };\n      }\n\n      // Cache the token\n      if (this.tokenCache && tokenResult.expiresAt) {\n        await this.tokenCache.set(\n          clientId,\n          tokenResult.token!,\n          tokenResult.webId,\n          tokenResult.expiresAt,\n          tokenResult.tokenType,\n        );\n      }\n\n      const context: SolidAuthContext = {\n        type: 'solid',\n        webId: tokenResult.webId,\n        accountId: tokenResult.webId,\n        clientId,\n        clientSecret,\n        accessToken: tokenResult.token,\n        tokenType: tokenResult.tokenType ?? 'Bearer',\n        viaApiKey: true,\n      };\n\n      this.logger.debug(`Authenticated API Key for webId: ${tokenResult.webId}`);\n      return { success: true, context };\n    } catch (error) {\n      this.logger.error(`API Key authentication error: ${error}`);\n      return { success: false, error: 'Authentication failed' };\n    }\n  }\n\n  private async exchangeForToken(clientId: string, clientSecret: string): Promise<{\n    success: boolean;\n    token?: string;\n    tokenType?: 'Bearer' | 'DPoP';\n    webId?: string;\n    expiresAt?: Date;\n    error?: string;\n  }> {\n    // 开发模式：跳过 CSS token exchange\n    if (process.env.NODE_ENV === 'development') {\n      this.logger.warn(`[DEV] Skipping token exchange for ${clientId.slice(0, 8)}...`);\n      return {\n        success: true,\n        token: `dev-token-${clientId}`,\n        expiresAt: new Date(Date.now() + 3600000),\n      };\n    }\n\n    try {\n      const response = await fetch(this.tokenEndpoint, {\n        method: 'POST',\n        headers: {\n          'Content-Type': 'application/x-www-form-urlencoded',\n        },\n        body: new URLSearchParams({\n          grant_type: 'client_credentials',\n          client_id: clientId,\n          client_secret: clientSecret,\n        }),\n      });\n\n      if (!response.ok) {\n        const error = await response.text();\n        this.logger.warn(`Token exchange failed: ${response.status} ${error}`);\n        return { success: false, error: `Token exchange failed: ${response.status}` };\n      }\n\n      const data = await response.json() as {\n        access_token: string;\n        expires_in?: number;\n        token_type: string;\n        webid?: string;  // CSS returns webid in response\n      };\n\n      // Extract webId from token response or decode from JWT\n      let webId = data.webid;\n      if (!webId && data.access_token) {\n        webId = this.extractWebIdFromJwt(data.access_token);\n      }\n\n      if (!webId) {\n        return { success: false, error: 'Could not determine webId from token response' };\n      }\n\n      const expiresAt = data.expires_in\n        ? new Date(Date.now() + data.expires_in * 1000 - 60000) // 1 min buffer\n        : new Date(Date.now() + 3600000); // Default 1 hour\n\n      return {\n        success: true,\n        token: data.access_token,\n        tokenType: data.token_type?.toUpperCase() === 'DPOP' ? 'DPoP' : 'Bearer',\n        webId,\n        expiresAt,\n      };\n    } catch (error) {\n      this.logger.error(`Token exchange error: ${error}`);\n      return { success: false, error: 'Token exchange failed' };\n    }\n  }\n\n  /**\n   * Extract webId from JWT access token\n   */\n  private extractWebIdFromJwt(jwt: string): string | undefined {\n    try {\n      const parts = jwt.split('.');\n      if (parts.length !== 3) {\n        return undefined;\n      }\n      const payload = JSON.parse(Buffer.from(parts[1], 'base64').toString('utf-8'));\n      return payload.webid || payload.webId || payload.sub;\n    } catch {\n      return undefined;\n    }\n  }\n\n  private isJwt(token: string): boolean {\n    return /^[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+$/.test(token);\n  }\n}\n"]}
+{"version":3,"file":"ClientCredentialsAuthenticator.js","sourceRoot":"","sources":["../../../src/api/auth/ClientCredentialsAuthenticator.ts"],"names":[],"mappings":";;;AACA,iEAAqD;AAGrD,mDAA6E;AA6B7E;;;;;;;;;;GAUG;AACH,MAAa,8BAA8B;IAKzC,YAAmB,OAA8C;QAJhD,WAAM,GAAG,IAAA,oCAAY,EAAC,IAAI,CAAC,CAAC;QAK3C,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IAC7C,CAAC;IAEM,eAAe,CAAC,OAAwB;QAC7C,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QAC3C,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACjC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,kFAAkF;QAClF,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YACzB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,KAAK,CAAC;QACf,CAAC;QACD,8CAA8C;QAC9C,OAAO,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACvD,CAAC;IAEM,KAAK,CAAC,YAAY,CAAC,OAAwB;QAChD,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QACpD,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC;QAC3D,CAAC;QAED,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,kCAAkC,EAAE,CAAC;QACvE,CAAC;QAED,IAAI,CAAC;YACH,IAAI,QAAgB,CAAC;YACrB,IAAI,YAAoB,CAAC;YAEzB,+DAA+D;YAC/D,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC5B,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAC9B,IAAI,CAAC;oBACH,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;oBAChE,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;oBACxC,IAAI,UAAU,KAAK,CAAC,CAAC,EAAE,CAAC;wBACtB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,6DAA6D,EAAE,CAAC;oBAClG,CAAC;oBACD,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;oBACxC,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;oBAE7C,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,EAAE,CAAC;wBAC/B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,sEAAsE,EAAE,CAAC;oBAC3G,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,6CAA6C,EAAE,CAAC;gBAClF,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,2FAA2F;gBAC3F,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,yDAAyD,EAAE,CAAC;YAC9F,CAAC;YAED,oBAAoB;YACpB,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gBACpB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBACnD,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;oBAC5C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,0BAA0B,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;oBACvE,OAAO;wBACL,OAAO,EAAE,IAAI;wBACb,OAAO,EAAE;4BACP,IAAI,EAAE,OAAO;4BACb,KAAK,EAAE,MAAM,CAAC,KAAK;4BACnB,SAAS,EAAE,MAAM,CAAC,KAAK;4BACvB,QAAQ;4BACR,YAAY;4BACZ,WAAW,EAAE,MAAM,CAAC,KAAK;4BACzB,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,QAAQ;4BACvC,SAAS,EAAE,IAAI;yBAChB;qBACF,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,qCAAqC;YACrC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oCAAoC,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;YAC5E,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;YACxE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,kCAAkC,WAAW,CAAC,OAAO,WAAW,WAAW,CAAC,KAAK,WAAW,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC;YAEnI,IAAI,CAAC,WAAW,CAAC,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;gBACrE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,IAAI,uBAAuB,EAAE,CAAC;YACjF,CAAC;YAED,kBAAkB;YAClB,IAAI,IAAI,CAAC,UAAU,IAAI,WAAW,CAAC,SAAS,EAAE,CAAC;gBAC7C,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CACvB,QAAQ,EACR,WAAW,CAAC,KAAM,EAClB,WAAW,CAAC,KAAK,EACjB,WAAW,CAAC,SAAS,EACrB,WAAW,CAAC,SAAS,CACtB,CAAC;YACJ,CAAC;YAED,MAAM,OAAO,GAAqB;gBAChC,IAAI,EAAE,OAAO;gBACb,KAAK,EAAE,WAAW,CAAC,KAAK;gBACxB,SAAS,EAAE,WAAW,CAAC,KAAK;gBAC5B,QAAQ;gBACR,YAAY;gBACZ,WAAW,EAAE,WAAW,CAAC,KAAK;gBAC9B,SAAS,EAAE,WAAW,CAAC,SAAS,IAAI,QAAQ;gBAC5C,SAAS,EAAE,IAAI;aAChB,CAAC;YAEF,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,+CAA+C,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC;YACtF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,4CAA4C,KAAK,EAAE,CAAC,CAAC;YACvE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC;QAC5D,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,QAAgB,EAAE,YAAoB;QAQnE,6BAA6B;QAC7B,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,aAAa,EAAE,CAAC;YAC3C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qCAAqC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;YACjF,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,KAAK,EAAE,aAAa,QAAQ,EAAE;gBAC9B,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC;aAC1C,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,aAAa,EAAE;gBAC/C,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,mCAAmC;iBACpD;gBACD,IAAI,EAAE,IAAI,eAAe,CAAC;oBACxB,UAAU,EAAE,oBAAoB;oBAChC,SAAS,EAAE,QAAQ;oBACnB,aAAa,EAAE,YAAY;iBAC5B,CAAC;aACH,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACpC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0BAA0B,QAAQ,CAAC,MAAM,IAAI,KAAK,EAAE,CAAC,CAAC;gBACvE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,0BAA0B,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YAChF,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAK/B,CAAC;YAEF,uDAAuD;YACvD,MAAM,KAAK,GAAG,IAAA,0DAA0C,EAAC,IAAI,CAAC,CAAC;YAE/D,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,+CAA+C,EAAE,CAAC;YACpF,CAAC;YAED,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU;gBAC/B,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI,GAAG,KAAK,CAAC,CAAC,eAAe;gBACvE,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,iBAAiB;YAErD,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,KAAK,EAAE,IAAI,CAAC,YAAY;gBACxB,SAAS,EAAE,IAAI,CAAC,UAAU,EAAE,WAAW,EAAE,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;gBACxE,KAAK;gBACL,SAAS;aACV,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,yBAAyB,KAAK,EAAE,CAAC,CAAC;YACpD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC;QAC5D,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,KAAa;QACzB,OAAO,kDAAkD,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxE,CAAC;CACF;AApMD,wEAoMC","sourcesContent":["import type { IncomingMessage } from 'node:http';\nimport { getLoggerFor } from 'global-logger-factory';\nimport type { Authenticator, AuthResult } from './Authenticator';\nimport type { SolidAuthContext } from './AuthContext';\nimport { extractAuthoritativeWebIdFromTokenResponse } from './TokenIdentity';\n\n/**\n * Interface for token cache\n */\nexport interface TokenCache {\n  get(clientId: string): Promise<{\n    token: string;\n    tokenType?: 'Bearer' | 'DPoP';\n    webId: string;\n    expiresAt: Date;\n  } | undefined>;\n  set(\n    clientId: string,\n    token: string,\n    webId: string,\n    expiresAt: Date,\n    tokenType?: 'Bearer' | 'DPoP',\n  ): Promise<void>;\n}\n\nexport interface ClientCredentialsAuthenticatorOptions {\n  tokenCache?: TokenCache;\n  /**\n   * CSS token endpoint URL\n   */\n  tokenEndpoint: string;\n}\n\n/**\n * Authenticator for CSS client credentials wrapped in sk-xxx transport format.\n * \n * Format: sk-base64(client_id:client_secret)\n * \n * This authenticator:\n * 1. Decodes the wrapper to get client_id and client_secret\n * 2. Exchanges them for a Solid Token via CSS token endpoint\n * 3. Extracts webId from the token response\n * 4. Returns a SolidAuthContext\n */\nexport class ClientCredentialsAuthenticator implements Authenticator {\n  private readonly logger = getLoggerFor(this);\n  private readonly tokenCache?: TokenCache;\n  private readonly tokenEndpoint: string;\n\n  public constructor(options: ClientCredentialsAuthenticatorOptions) {\n    this.tokenCache = options.tokenCache;\n    this.tokenEndpoint = options.tokenEndpoint;\n  }\n\n  public canAuthenticate(request: IncomingMessage): boolean {\n    const auth = request.headers.authorization;\n    if (!auth?.startsWith('Bearer ')) {\n      return false;\n    }\n    // If there's a DPoP header, it's a Solid Token, not a client credentials wrapper.\n    if (request.headers.dpop) {\n      return false;\n    }\n    const token = auth.slice(7).trim();\n    if (!token) {\n      return false;\n    }\n    // Only handle sk-xxx format or non-JWT tokens\n    return token.startsWith('sk-') || !this.isJwt(token);\n  }\n\n  public async authenticate(request: IncomingMessage): Promise<AuthResult> {\n    const authorization = request.headers.authorization;\n    if (!authorization?.startsWith('Bearer ')) {\n      return { success: false, error: 'Missing Bearer token' };\n    }\n\n    const token = authorization.slice(7).trim();\n    if (!token) {\n      return { success: false, error: 'Empty client credentials wrapper' };\n    }\n\n    try {\n      let clientId: string;\n      let clientSecret: string;\n\n      // Parse sk-xxx format (base64 encoded client_id:client_secret)\n      if (token.startsWith('sk-')) {\n        const base64 = token.slice(3);\n        try {\n          const decoded = Buffer.from(base64, 'base64').toString('utf-8');\n          const colonIndex = decoded.indexOf(':');\n          if (colonIndex === -1) {\n            return { success: false, error: 'Invalid client credentials wrapper: missing colon separator' };\n          }\n          clientId = decoded.slice(0, colonIndex);\n          clientSecret = decoded.slice(colonIndex + 1);\n          \n          if (!clientId || !clientSecret) {\n            return { success: false, error: 'Invalid client credentials wrapper: empty client_id or client_secret' };\n          }\n        } catch {\n          return { success: false, error: 'Invalid client credentials wrapper encoding' };\n        }\n      } else {\n        // Non sk- format is intentionally unsupported; Xpod does not keep an API key mirror table.\n        return { success: false, error: 'Invalid client credentials wrapper: must start with sk-' };\n      }\n\n      // Check cache first\n      if (this.tokenCache) {\n        const cached = await this.tokenCache.get(clientId);\n        if (cached && cached.expiresAt > new Date()) {\n          this.logger.debug(`Using cached token for ${clientId.slice(0, 8)}...`);\n          return {\n            success: true,\n            context: {\n              type: 'solid',\n              webId: cached.webId,\n              accountId: cached.webId,\n              clientId,\n              clientSecret,\n              accessToken: cached.token,\n              tokenType: cached.tokenType ?? 'Bearer',\n              viaApiKey: true,\n            },\n          };\n        }\n      }\n\n      // Exchange for token at CSS endpoint\n      this.logger.debug(`Exchanging client credentials at ${this.tokenEndpoint}`);\n      const tokenResult = await this.exchangeForToken(clientId, clientSecret);\n      this.logger.debug(`Token exchange result: success=${tokenResult.success}, webId=${tokenResult.webId}, error=${tokenResult.error}`);\n      \n      if (!tokenResult.success || !tokenResult.webId || !tokenResult.token) {\n        return { success: false, error: tokenResult.error || 'Token exchange failed' };\n      }\n\n      // Cache the token\n      if (this.tokenCache && tokenResult.expiresAt) {\n        await this.tokenCache.set(\n          clientId,\n          tokenResult.token!,\n          tokenResult.webId,\n          tokenResult.expiresAt,\n          tokenResult.tokenType,\n        );\n      }\n\n      const context: SolidAuthContext = {\n        type: 'solid',\n        webId: tokenResult.webId,\n        accountId: tokenResult.webId,\n        clientId,\n        clientSecret,\n        accessToken: tokenResult.token,\n        tokenType: tokenResult.tokenType ?? 'Bearer',\n        viaApiKey: true,\n      };\n\n      this.logger.debug(`Authenticated client credentials for webId: ${tokenResult.webId}`);\n      return { success: true, context };\n    } catch (error) {\n      this.logger.error(`Client credentials authentication error: ${error}`);\n      return { success: false, error: 'Authentication failed' };\n    }\n  }\n\n  private async exchangeForToken(clientId: string, clientSecret: string): Promise<{\n    success: boolean;\n    token?: string;\n    tokenType?: 'Bearer' | 'DPoP';\n    webId?: string;\n    expiresAt?: Date;\n    error?: string;\n  }> {\n    // 开发模式：跳过 CSS token exchange\n    if (process.env.NODE_ENV === 'development') {\n      this.logger.warn(`[DEV] Skipping token exchange for ${clientId.slice(0, 8)}...`);\n      return {\n        success: true,\n        token: `dev-token-${clientId}`,\n        expiresAt: new Date(Date.now() + 3600000),\n      };\n    }\n\n    try {\n      const response = await fetch(this.tokenEndpoint, {\n        method: 'POST',\n        headers: {\n          'Content-Type': 'application/x-www-form-urlencoded',\n        },\n        body: new URLSearchParams({\n          grant_type: 'client_credentials',\n          client_id: clientId,\n          client_secret: clientSecret,\n        }),\n      });\n\n      if (!response.ok) {\n        const error = await response.text();\n        this.logger.warn(`Token exchange failed: ${response.status} ${error}`);\n        return { success: false, error: `Token exchange failed: ${response.status}` };\n      }\n\n      const data = await response.json() as {\n        access_token: string;\n        expires_in?: number;\n        token_type: string;\n        webid?: string;  // CSS returns webid in response\n      };\n\n      // Extract webId from token response or decode from JWT\n      const webId = extractAuthoritativeWebIdFromTokenResponse(data);\n\n      if (!webId) {\n        return { success: false, error: 'Could not determine webId from token response' };\n      }\n\n      const expiresAt = data.expires_in\n        ? new Date(Date.now() + data.expires_in * 1000 - 60000) // 1 min buffer\n        : new Date(Date.now() + 3600000); // Default 1 hour\n\n      return {\n        success: true,\n        token: data.access_token,\n        tokenType: data.token_type?.toUpperCase() === 'DPOP' ? 'DPoP' : 'Bearer',\n        webId,\n        expiresAt,\n      };\n    } catch (error) {\n      this.logger.error(`Token exchange error: ${error}`);\n      return { success: false, error: 'Token exchange failed' };\n    }\n  }\n\n  private isJwt(token: string): boolean {\n    return /^[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+$/.test(token);\n  }\n}\n"]}

package/dist/api/auth/SolidTokenAuthenticator.d.ts

@@ -5,6 +5,8 @@ export interface SolidTokenAuthenticatorOptions {
      * Function to resolve accountId from webId (optional)
      */
     resolveAccountId?: (webId: string) => Promise<string | undefined>;
+    publicBaseUrl?: string;
+    internalBaseUrl?: string;
 }
 /**
  * Authenticator for Solid access tokens (Bearer or DPoP).

package/dist/api/auth/SolidTokenAuthenticator.js

@@ -2,15 +2,102 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SolidTokenAuthenticator = void 0;
 const access_token_verifier_1 = require("@solid/access-token-verifier");
+const IssuerKeySetCache_1 = require("@solid/access-token-verifier/dist/class/IssuerKeySetCache");
+const WebIDIssuersCache_1 = require("@solid/access-token-verifier/dist/class/WebIDIssuersCache");
 const global_logger_factory_1 = require("global-logger-factory");
+const jose_1 = require("jose");
+const n3_1 = require("n3");
+const SOLID_OIDC_ISSUER = n3_1.DataFactory.namedNode('http://www.w3.org/ns/solid/terms#oidcIssuer');
+class FetchWebIdIssuersCache extends WebIDIssuersCache_1.WebIDIssuersCache {
+    constructor(publicOrigin, internalOrigin) {
+        super();
+        this.publicOrigin = publicOrigin;
+        this.internalOrigin = internalOrigin;
+        this.resolved = new Map();
+    }
+    async getIssuers(webId) {
+        const cached = this.resolved.get(webId);
+        if (cached) {
+            return cached;
+        }
+        const target = this.internalUrl(webId);
+        const response = await fetch(target, {
+            headers: { Accept: 'text/turtle' },
+            signal: AbortSignal.timeout(10_000),
+        });
+        if (!response.ok) {
+            throw new Error(`WebID dereference failed: HTTP ${response.status}`);
+        }
+        const baseIRI = response.url || webId;
+        const store = new n3_1.Store(new n3_1.Parser({ baseIRI }).parse(await response.text()));
+        const issuers = store
+            .getObjects(n3_1.DataFactory.namedNode(webId), SOLID_OIDC_ISSUER, null)
+            .map((term) => term.value);
+        this.resolved.set(webId, issuers);
+        return issuers;
+    }
+    internalUrl(value) {
+        const url = new URL(value);
+        if (this.publicOrigin && this.internalOrigin && url.origin === this.publicOrigin) {
+            return new URL(`${url.pathname}${url.search}`, this.internalOrigin).href;
+        }
+        return url.href;
+    }
+}
+class FetchIssuerKeySetCache extends IssuerKeySetCache_1.IssuerKeySetCache {
+    constructor(publicOrigin, internalOrigin) {
+        super();
+        this.publicOrigin = publicOrigin;
+        this.internalOrigin = internalOrigin;
+        this.resolved = new Map();
+    }
+    async getKeySet(issuer) {
+        const cached = this.resolved.get(issuer);
+        if (cached) {
+            return cached;
+        }
+        const logicalConfigurationUrl = new URL('.well-known/openid-configuration', issuer.endsWith('/') ? issuer : `${issuer}/`);
+        const configurationTarget = this.internalUrl(logicalConfigurationUrl);
+        const configurationResponse = await fetch(configurationTarget, {
+            headers: { Accept: 'application/json' },
+            signal: AbortSignal.timeout(10_000),
+        });
+        if (!configurationResponse.ok) {
+            throw new Error(`OIDC issuer configuration failed: HTTP ${configurationResponse.status}`);
+        }
+        const configuration = await configurationResponse.json();
+        if (typeof configuration.jwks_uri !== 'string') {
+            throw new Error('OIDC issuer configuration is missing jwks_uri');
+        }
+        const keySetTarget = this.internalUrl(new URL(configuration.jwks_uri));
+        const keySetResponse = await fetch(keySetTarget, {
+            headers: { Accept: 'application/json' },
+            signal: AbortSignal.timeout(10_000),
+        });
+        if (!keySetResponse.ok) {
+            throw new Error(`OIDC issuer JWKS failed: HTTP ${keySetResponse.status}`);
+        }
+        const keySet = (0, jose_1.createLocalJWKSet)(await keySetResponse.json());
+        this.resolved.set(issuer, keySet);
+        return keySet;
+    }
+    internalUrl(url) {
+        if (this.publicOrigin && this.internalOrigin && url.origin === this.publicOrigin) {
+            return new URL(`${url.pathname}${url.search}`, this.internalOrigin);
+        }
+        return url;
+    }
+}
 /**
  * Authenticator for Solid access tokens (Bearer or DPoP).
  */
 class SolidTokenAuthenticator {
     constructor(options = {}) {
         this.logger = (0, global_logger_factory_1.getLoggerFor)(this);
-        this.verify = (0, access_token_verifier_1.createSolidTokenVerifier)();
         this.resolveAccountId = options.resolveAccountId;
+        const publicOrigin = options.publicBaseUrl ? new URL(options.publicBaseUrl).origin : undefined;
+        const internalOrigin = options.internalBaseUrl ? new URL(options.internalBaseUrl).origin : undefined;
+        this.verify = (0, access_token_verifier_1.createSolidTokenVerifier)(undefined, new FetchIssuerKeySetCache(publicOrigin, internalOrigin), new FetchWebIdIssuersCache(publicOrigin, internalOrigin));
     }
     canAuthenticate(request) {
         const auth = request.headers.authorization;
@@ -41,7 +128,6 @@ class SolidTokenAuthenticator {
             // Build the request URL for verification
             const method = (request.method ?? 'GET');
             const url = this.buildRequestUrl(request);
-            console.log(`[SolidTokenAuthenticator] Verifying DPoP for URL: ${url}, method: ${method}, host header: ${request.headers.host}, x-forwarded-host: ${request.headers['x-forwarded-host']}`);
             const dpopOptions = dpopHeader ? {
                 header: dpopHeader,
                 method,

package/dist/api/auth/SolidTokenAuthenticator.js.map

@@ -1 +1 @@
-{"version":3,"file":"SolidTokenAuthenticator.js","sourceRoot":"","sources":["../../../src/api/auth/SolidTokenAuthenticator.ts"],"names":[],"mappings":";;;AACA,wEAAwE;AACxE,iEAAqD;AAWrD;;GAEG;AACH,MAAa,uBAAuB;IAKlC,YAAmB,UAA0C,EAAE;QAJ9C,WAAM,GAAG,IAAA,oCAAY,EAAC,IAAI,CAAC,CAAC;QAC5B,WAAM,GAAG,IAAA,gDAAwB,GAAE,CAAC;QAInD,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC;IACnD,CAAC;IAEM,eAAe,CAAC,OAAwB;QAC7C,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QAC3C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;YACtB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YAC7C,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAClC,CAAC;IAEM,KAAK,CAAC,YAAY,CAAC,OAAwB;QAChD,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QACpD,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC;QACnE,CAAC;QAED,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACpD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;QACrC,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QACjE,IAAI,MAAM,KAAK,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;YACrC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;QAC1D,CAAC;QAED,IAAI,CAAC;YACH,yCAAyC;YACzC,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,KAAK,CAAqE,CAAC;YAC7G,MAAM,GAAG,GAAG,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;YAE1C,OAAO,CAAC,GAAG,CAAC,qDAAqD,GAAG,aAAa,MAAM,kBAAkB,OAAO,CAAC,OAAO,CAAC,IAAI,uBAAuB,OAAO,CAAC,OAAO,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;YAE3L,MAAM,WAAW,GAAG,UAAU,CAAC,CAAC,CAAC;gBAC/B,MAAM,EAAE,UAAU;gBAClB,MAAM;gBACN,GAAG;aACJ,CAAC,CAAC,CAAC,SAAS,CAAC;YAEd,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,WAAW,CAAuC,CAAC;YAEpG,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;YACzC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC;YAChE,CAAC;YAED,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,WAAW,CAAC;gBACxC,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAEpD,IAAI,SAA6B,CAAC;YAClC,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBAC1B,IAAI,CAAC;oBACH,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;gBACjD,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yCAAyC,KAAK,KAAK,KAAK,EAAE,CAAC,CAAC;gBAC/E,CAAC;YACH,CAAC;YAED,MAAM,OAAO,GAAqB;gBAChC,IAAI,EAAE,OAAO;gBACb,KAAK;gBACL,SAAS;gBACT,QAAQ;gBACR,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAE;gBAC7B,SAAS,EAAE,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;gBAChD,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE;aAC9B,CAAC;YAEF,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,wCAAwC,KAAK,EAAE,CAAC,CAAC;YACnE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oCAAoC,KAAK,EAAE,CAAC,CAAC;YAC9D,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;QAC1D,CAAC;IACH,CAAC;IAEO,eAAe,CAAC,OAAwB;QAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAChD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC;QAChC,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9D,OAAO,GAAG,KAAK,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC;IACzC,CAAC;IAEO,WAAW,CAAC,OAAwB;QAC1C,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;QACvD,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAClE,OAAO,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,MAAM,CAAC;QAChD,CAAC;QACD,wCAAwC;QACxC,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,OAAO,CAAC,OAAwB;QACtC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;QACtD,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAChE,MAAM,IAAI,GAAG,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;YACxC,IAAI,IAAI,EAAE,CAAC;gBACT,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW,CAAC;IAC7C,CAAC;IAEO,kBAAkB,CAAC,OAAwB;QACjD,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;QACxD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAChE,MAAM,MAAM,GAAG,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;QAC1C,OAAO,MAAM,IAAI,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IACvD,CAAC;IAEO,SAAS,CAAC,MAAc,EAAE,IAAY;QAC5C,MAAM,gBAAgB,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QAC7E,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;QAChE,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,OAAO,cAAc,CAAC;QACxB,CAAC;QACD,OAAO,GAAG,gBAAgB,GAAG,cAAc,EAAE,CAAC;IAChD,CAAC;IAEO,KAAK,CAAC,KAAa;QACzB,OAAO,kDAAkD,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxE,CAAC;IAEO,YAAY,CAAC,OAAgC;QACnD,OAAO,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC;YACpC,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC;YACpC,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC5C,CAAC;IAEO,aAAa,CAAC,GAA4B,EAAE,GAAW;QAC7D,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzD,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;QACtB,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;CACF;AA1JD,0DA0JC","sourcesContent":["import type { IncomingMessage } from 'node:http';\nimport { createSolidTokenVerifier } from '@solid/access-token-verifier';\nimport { getLoggerFor } from 'global-logger-factory';\nimport type { Authenticator, AuthResult } from './Authenticator';\nimport type { SolidAuthContext } from './AuthContext';\n\nexport interface SolidTokenAuthenticatorOptions {\n  /**\n   * Function to resolve accountId from webId (optional)\n   */\n  resolveAccountId?: (webId: string) => Promise<string | undefined>;\n}\n\n/**\n * Authenticator for Solid access tokens (Bearer or DPoP).\n */\nexport class SolidTokenAuthenticator implements Authenticator {\n  private readonly logger = getLoggerFor(this);\n  private readonly verify = createSolidTokenVerifier();\n  private readonly resolveAccountId?: (webId: string) => Promise<string | undefined>;\n\n  public constructor(options: SolidTokenAuthenticatorOptions = {}) {\n    this.resolveAccountId = options.resolveAccountId;\n  }\n\n  public canAuthenticate(request: IncomingMessage): boolean {\n    const auth = request.headers.authorization;\n    if (!auth) {\n      return false;\n    }\n    const [scheme, token] = auth.split(' ');\n    if (!scheme || !token) {\n      return false;\n    }\n    if (scheme !== 'Bearer' && scheme !== 'DPoP') {\n      return false;\n    }\n    return this.isJwt(token.trim());\n  }\n\n  public async authenticate(request: IncomingMessage): Promise<AuthResult> {\n    const authorization = request.headers.authorization;\n    if (!authorization) {\n      return { success: false, error: 'Missing Authorization header' };\n    }\n\n    const [scheme, rawToken] = authorization.split(' ');\n    const dpopRaw = request.headers.dpop;\n    const dpopHeader = Array.isArray(dpopRaw) ? dpopRaw[0] : dpopRaw;\n    if (scheme === 'DPoP' && !dpopHeader) {\n      return { success: false, error: 'Missing DPoP header' };\n    }\n\n    try {\n      // Build the request URL for verification\n      const method = (request.method ?? 'GET') as 'GET' | 'POST' | 'PUT' | 'DELETE' | 'PATCH' | 'HEAD' | 'OPTIONS';\n      const url = this.buildRequestUrl(request);\n\n      console.log(`[SolidTokenAuthenticator] Verifying DPoP for URL: ${url}, method: ${method}, host header: ${request.headers.host}, x-forwarded-host: ${request.headers['x-forwarded-host']}`);\n\n      const dpopOptions = dpopHeader ? {\n        header: dpopHeader,\n        method,\n        url,\n      } : undefined;\n\n      const payload = await this.verify(authorization, dpopOptions) as unknown as Record<string, unknown>;\n\n      const webId = this.extractWebId(payload);\n      if (!webId) {\n        return { success: false, error: 'Token missing webId claim' };\n      }\n\n      const clientId = this.extractString(payload, 'client_id') ?? \n                       this.extractString(payload, 'azp');\n\n      let accountId: string | undefined;\n      if (this.resolveAccountId) {\n        try {\n          accountId = await this.resolveAccountId(webId);\n        } catch (error) {\n          this.logger.warn(`Failed to resolve accountId for webId ${webId}: ${error}`);\n        }\n      }\n\n      const context: SolidAuthContext = {\n        type: 'solid',\n        webId,\n        accountId,\n        clientId,\n        accessToken: rawToken?.trim(),\n        tokenType: scheme === 'DPoP' ? 'DPoP' : 'Bearer',\n        dpopProof: dpopHeader?.trim(),\n      };\n\n      this.logger.debug(`Authenticated Solid token for webId: ${webId}`);\n      return { success: true, context };\n    } catch (error) {\n      this.logger.warn(`Solid token verification failed: ${error}`);\n      return { success: false, error: 'Invalid Solid token' };\n    }\n  }\n\n  private buildRequestUrl(request: IncomingMessage): string {\n    const host = this.getHost(request);\n    const proto = this.getProtocol(request);\n    const prefix = this.getForwardedPrefix(request);\n    const path = request.url ?? '/';\n    const fullPath = prefix ? this.joinPaths(prefix, path) : path;\n    return `${proto}://${host}${fullPath}`;\n  }\n\n  private getProtocol(request: IncomingMessage): string {\n    const forwarded = request.headers['x-forwarded-proto'];\n    if (forwarded) {\n      const proto = Array.isArray(forwarded) ? forwarded[0] : forwarded;\n      return proto?.split(',')[0]?.trim() ?? 'http';\n    }\n    // Default to http for local development\n    return 'http';\n  }\n\n  private getHost(request: IncomingMessage): string {\n    const forwarded = request.headers['x-forwarded-host'];\n    if (forwarded) {\n      const raw = Array.isArray(forwarded) ? forwarded[0] : forwarded;\n      const host = raw?.split(',')[0]?.trim();\n      if (host) {\n        return host;\n      }\n    }\n    return request.headers.host ?? 'localhost';\n  }\n\n  private getForwardedPrefix(request: IncomingMessage): string | undefined {\n    const forwarded = request.headers['x-forwarded-prefix'];\n    if (!forwarded) {\n      return undefined;\n    }\n    const raw = Array.isArray(forwarded) ? forwarded[0] : forwarded;\n    const prefix = raw?.split(',')[0]?.trim();\n    return prefix && prefix !== '/' ? prefix : undefined;\n  }\n\n  private joinPaths(prefix: string, path: string): string {\n    const normalizedPrefix = prefix.endsWith('/') ? prefix.slice(0, -1) : prefix;\n    const normalizedPath = path.startsWith('/') ? path : `/${path}`;\n    if (!normalizedPrefix) {\n      return normalizedPath;\n    }\n    return `${normalizedPrefix}${normalizedPath}`;\n  }\n\n  private isJwt(token: string): boolean {\n    return /^[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+$/.test(token);\n  }\n\n  private extractWebId(payload: Record<string, unknown>): string | undefined {\n    return this.extractString(payload, 'webid') ??\n           this.extractString(payload, 'webId') ??\n           this.extractString(payload, 'sub');\n  }\n\n  private extractString(obj: Record<string, unknown>, key: string): string | undefined {\n    const value = obj[key];\n    if (typeof value === 'string' && value.trim().length > 0) {\n      return value.trim();\n    }\n    return undefined;\n  }\n}\n"]}
+{"version":3,"file":"SolidTokenAuthenticator.js","sourceRoot":"","sources":["../../../src/api/auth/SolidTokenAuthenticator.ts"],"names":[],"mappings":";;;AACA,wEAAwE;AACxE,iGAA8F;AAC9F,iGAA8F;AAC9F,iEAAqD;AACrD,+BAAiF;AACjF,2BAAgD;AAIhD,MAAM,iBAAiB,GAAG,gBAAW,CAAC,SAAS,CAAC,6CAA6C,CAAC,CAAC;AAE/F,MAAM,sBAAuB,SAAQ,qCAAiB;IAGpD,YACmB,YAAqB,EACrB,cAAuB;QAExC,KAAK,EAAE,CAAC;QAHS,iBAAY,GAAZ,YAAY,CAAS;QACrB,mBAAc,GAAd,cAAc,CAAS;QAJzB,aAAQ,GAAG,IAAI,GAAG,EAAoB,CAAC;IAOxD,CAAC;IAEe,KAAK,CAAC,UAAU,CAAC,KAAa;QAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACxC,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACvC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE;YACnC,OAAO,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE;YAClC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,kCAAkC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,IAAI,KAAK,CAAC;QACtC,MAAM,KAAK,GAAG,IAAI,UAAK,CAAC,IAAI,WAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAC9E,MAAM,OAAO,GAAG,KAAK;aAClB,UAAU,CAAC,gBAAW,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,iBAAiB,EAAE,IAAI,CAAC;aACjE,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAClC,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,WAAW,CAAC,KAAa;QAC/B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,cAAc,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,YAAY,EAAE,CAAC;YACjF,OAAO,IAAI,GAAG,CAAC,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC;QAC3E,CAAC;QACD,OAAO,GAAG,CAAC,IAAI,CAAC;IAClB,CAAC;CACF;AAED,MAAM,sBAAuB,SAAQ,qCAAiB;IAGpD,YACmB,YAAqB,EACrB,cAAuB;QAExC,KAAK,EAAE,CAAC;QAHS,iBAAY,GAAZ,YAAY,CAAS;QACrB,mBAAc,GAAd,cAAc,CAAS;QAJzB,aAAQ,GAAG,IAAI,GAAG,EAAiD,CAAC;IAOrF,CAAC;IAEe,KAAK,CAAC,SAAS,CAAC,MAAc;QAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,MAAM,uBAAuB,GAAG,IAAI,GAAG,CACrC,kCAAkC,EAClC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,CAC7C,CAAC;QACF,MAAM,mBAAmB,GAAG,IAAI,CAAC,WAAW,CAAC,uBAAuB,CAAC,CAAC;QACtE,MAAM,qBAAqB,GAAG,MAAM,KAAK,CAAC,mBAAmB,EAAE;YAC7D,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;YACvC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,CAAC,CAAC;QACH,IAAI,CAAC,qBAAqB,CAAC,EAAE,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,0CAA0C,qBAAqB,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5F,CAAC;QACD,MAAM,aAAa,GAAG,MAAM,qBAAqB,CAAC,IAAI,EAA4B,CAAC;QACnF,IAAI,OAAO,aAAa,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC;QACvE,MAAM,cAAc,GAAG,MAAM,KAAK,CAAC,YAAY,EAAE;YAC/C,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;YACvC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,CAAC,CAAC;QACH,IAAI,CAAC,cAAc,CAAC,EAAE,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,iCAAiC,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,MAAM,GAAG,IAAA,wBAAiB,EAC9B,MAAM,cAAc,CAAC,IAAI,EAAmB,CACO,CAAC;QACtD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAClC,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,WAAW,CAAC,GAAQ;QAC1B,IAAI,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,cAAc,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,YAAY,EAAE,CAAC;YACjF,OAAO,IAAI,GAAG,CAAC,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;QACtE,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;CACF;AAWD;;GAEG;AACH,MAAa,uBAAuB;IAKlC,YAAmB,UAA0C,EAAE;QAJ9C,WAAM,GAAG,IAAA,oCAAY,EAAC,IAAI,CAAC,CAAC;QAK3C,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC;QACjD,MAAM,YAAY,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/F,MAAM,cAAc,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;QACrG,IAAI,CAAC,MAAM,GAAG,IAAA,gDAAwB,EACpC,SAAS,EACT,IAAI,sBAAsB,CAAC,YAAY,EAAE,cAAc,CAAC,EACxD,IAAI,sBAAsB,CAAC,YAAY,EAAE,cAAc,CAAC,CACzD,CAAC;IACJ,CAAC;IAEM,eAAe,CAAC,OAAwB;QAC7C,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QAC3C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;YACtB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YAC7C,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAClC,CAAC;IAEM,KAAK,CAAC,YAAY,CAAC,OAAwB;QAChD,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QACpD,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC;QACnE,CAAC;QAED,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACpD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;QACrC,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QACjE,IAAI,MAAM,KAAK,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;YACrC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;QAC1D,CAAC;QAED,IAAI,CAAC;YACH,yCAAyC;YACzC,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,KAAK,CAAqE,CAAC;YAC7G,MAAM,GAAG,GAAG,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;YAE1C,MAAM,WAAW,GAAG,UAAU,CAAC,CAAC,CAAC;gBAC/B,MAAM,EAAE,UAAU;gBAClB,MAAM;gBACN,GAAG;aACJ,CAAC,CAAC,CAAC,SAAS,CAAC;YAEd,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,WAAW,CAAuC,CAAC;YAEpG,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;YACzC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC;YAChE,CAAC;YAED,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,WAAW,CAAC;gBACxC,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAEpD,IAAI,SAA6B,CAAC;YAClC,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBAC1B,IAAI,CAAC;oBACH,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;gBACjD,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yCAAyC,KAAK,KAAK,KAAK,EAAE,CAAC,CAAC;gBAC/E,CAAC;YACH,CAAC;YAED,MAAM,OAAO,GAAqB;gBAChC,IAAI,EAAE,OAAO;gBACb,KAAK;gBACL,SAAS;gBACT,QAAQ;gBACR,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAE;gBAC7B,SAAS,EAAE,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;gBAChD,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE;aAC9B,CAAC;YAEF,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,wCAAwC,KAAK,EAAE,CAAC,CAAC;YACnE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oCAAoC,KAAK,EAAE,CAAC,CAAC;YAC9D,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;QAC1D,CAAC;IACH,CAAC;IAEO,eAAe,CAAC,OAAwB;QAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAChD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC;QAChC,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9D,OAAO,GAAG,KAAK,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC;IACzC,CAAC;IAEO,WAAW,CAAC,OAAwB;QAC1C,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;QACvD,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAClE,OAAO,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,MAAM,CAAC;QAChD,CAAC;QACD,wCAAwC;QACxC,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,OAAO,CAAC,OAAwB;QACtC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;QACtD,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAChE,MAAM,IAAI,GAAG,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;YACxC,IAAI,IAAI,EAAE,CAAC;gBACT,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW,CAAC;IAC7C,CAAC;IAEO,kBAAkB,CAAC,OAAwB;QACjD,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;QACxD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAChE,MAAM,MAAM,GAAG,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;QAC1C,OAAO,MAAM,IAAI,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IACvD,CAAC;IAEO,SAAS,CAAC,MAAc,EAAE,IAAY;QAC5C,MAAM,gBAAgB,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QAC7E,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;QAChE,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,OAAO,cAAc,CAAC;QACxB,CAAC;QACD,OAAO,GAAG,gBAAgB,GAAG,cAAc,EAAE,CAAC;IAChD,CAAC;IAEO,KAAK,CAAC,KAAa;QACzB,OAAO,kDAAkD,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxE,CAAC;IAEO,YAAY,CAAC,OAAgC;QACnD,OAAO,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC;YACpC,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC;YACpC,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC5C,CAAC;IAEO,aAAa,CAAC,GAA4B,EAAE,GAAW;QAC7D,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzD,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;QACtB,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;CACF;AA/JD,0DA+JC","sourcesContent":["import type { IncomingMessage } from 'node:http';\nimport { createSolidTokenVerifier } from '@solid/access-token-verifier';\nimport { IssuerKeySetCache } from '@solid/access-token-verifier/dist/class/IssuerKeySetCache';\nimport { WebIDIssuersCache } from '@solid/access-token-verifier/dist/class/WebIDIssuersCache';\nimport { getLoggerFor } from 'global-logger-factory';\nimport { createLocalJWKSet, createRemoteJWKSet, type JSONWebKeySet } from 'jose';\nimport { DataFactory, Parser, Store } from 'n3';\nimport type { Authenticator, AuthResult } from './Authenticator';\nimport type { SolidAuthContext } from './AuthContext';\n\nconst SOLID_OIDC_ISSUER = DataFactory.namedNode('http://www.w3.org/ns/solid/terms#oidcIssuer');\n\nclass FetchWebIdIssuersCache extends WebIDIssuersCache {\n  private readonly resolved = new Map<string, string[]>();\n\n  public constructor(\n    private readonly publicOrigin?: string,\n    private readonly internalOrigin?: string,\n  ) {\n    super();\n  }\n\n  public override async getIssuers(webId: string): Promise<string[]> {\n    const cached = this.resolved.get(webId);\n    if (cached) {\n      return cached;\n    }\n\n    const target = this.internalUrl(webId);\n    const response = await fetch(target, {\n      headers: { Accept: 'text/turtle' },\n      signal: AbortSignal.timeout(10_000),\n    });\n    if (!response.ok) {\n      throw new Error(`WebID dereference failed: HTTP ${response.status}`);\n    }\n    const baseIRI = response.url || webId;\n    const store = new Store(new Parser({ baseIRI }).parse(await response.text()));\n    const issuers = store\n      .getObjects(DataFactory.namedNode(webId), SOLID_OIDC_ISSUER, null)\n      .map((term) => term.value);\n    this.resolved.set(webId, issuers);\n    return issuers;\n  }\n\n  private internalUrl(value: string): string {\n    const url = new URL(value);\n    if (this.publicOrigin && this.internalOrigin && url.origin === this.publicOrigin) {\n      return new URL(`${url.pathname}${url.search}`, this.internalOrigin).href;\n    }\n    return url.href;\n  }\n}\n\nclass FetchIssuerKeySetCache extends IssuerKeySetCache {\n  private readonly resolved = new Map<string, ReturnType<typeof createRemoteJWKSet>>();\n\n  public constructor(\n    private readonly publicOrigin?: string,\n    private readonly internalOrigin?: string,\n  ) {\n    super();\n  }\n\n  public override async getKeySet(issuer: string): Promise<ReturnType<typeof createRemoteJWKSet>> {\n    const cached = this.resolved.get(issuer);\n    if (cached) {\n      return cached;\n    }\n\n    const logicalConfigurationUrl = new URL(\n      '.well-known/openid-configuration',\n      issuer.endsWith('/') ? issuer : `${issuer}/`,\n    );\n    const configurationTarget = this.internalUrl(logicalConfigurationUrl);\n    const configurationResponse = await fetch(configurationTarget, {\n      headers: { Accept: 'application/json' },\n      signal: AbortSignal.timeout(10_000),\n    });\n    if (!configurationResponse.ok) {\n      throw new Error(`OIDC issuer configuration failed: HTTP ${configurationResponse.status}`);\n    }\n    const configuration = await configurationResponse.json() as { jwks_uri?: unknown };\n    if (typeof configuration.jwks_uri !== 'string') {\n      throw new Error('OIDC issuer configuration is missing jwks_uri');\n    }\n    const keySetTarget = this.internalUrl(new URL(configuration.jwks_uri));\n    const keySetResponse = await fetch(keySetTarget, {\n      headers: { Accept: 'application/json' },\n      signal: AbortSignal.timeout(10_000),\n    });\n    if (!keySetResponse.ok) {\n      throw new Error(`OIDC issuer JWKS failed: HTTP ${keySetResponse.status}`);\n    }\n    const keySet = createLocalJWKSet(\n      await keySetResponse.json() as JSONWebKeySet,\n    ) as unknown as ReturnType<typeof createRemoteJWKSet>;\n    this.resolved.set(issuer, keySet);\n    return keySet;\n  }\n\n  private internalUrl(url: URL): URL {\n    if (this.publicOrigin && this.internalOrigin && url.origin === this.publicOrigin) {\n      return new URL(`${url.pathname}${url.search}`, this.internalOrigin);\n    }\n    return url;\n  }\n}\n\nexport interface SolidTokenAuthenticatorOptions {\n  /**\n   * Function to resolve accountId from webId (optional)\n   */\n  resolveAccountId?: (webId: string) => Promise<string | undefined>;\n  publicBaseUrl?: string;\n  internalBaseUrl?: string;\n}\n\n/**\n * Authenticator for Solid access tokens (Bearer or DPoP).\n */\nexport class SolidTokenAuthenticator implements Authenticator {\n  private readonly logger = getLoggerFor(this);\n  private readonly verify: ReturnType<typeof createSolidTokenVerifier>;\n  private readonly resolveAccountId?: (webId: string) => Promise<string | undefined>;\n\n  public constructor(options: SolidTokenAuthenticatorOptions = {}) {\n    this.resolveAccountId = options.resolveAccountId;\n    const publicOrigin = options.publicBaseUrl ? new URL(options.publicBaseUrl).origin : undefined;\n    const internalOrigin = options.internalBaseUrl ? new URL(options.internalBaseUrl).origin : undefined;\n    this.verify = createSolidTokenVerifier(\n      undefined,\n      new FetchIssuerKeySetCache(publicOrigin, internalOrigin),\n      new FetchWebIdIssuersCache(publicOrigin, internalOrigin),\n    );\n  }\n\n  public canAuthenticate(request: IncomingMessage): boolean {\n    const auth = request.headers.authorization;\n    if (!auth) {\n      return false;\n    }\n    const [scheme, token] = auth.split(' ');\n    if (!scheme || !token) {\n      return false;\n    }\n    if (scheme !== 'Bearer' && scheme !== 'DPoP') {\n      return false;\n    }\n    return this.isJwt(token.trim());\n  }\n\n  public async authenticate(request: IncomingMessage): Promise<AuthResult> {\n    const authorization = request.headers.authorization;\n    if (!authorization) {\n      return { success: false, error: 'Missing Authorization header' };\n    }\n\n    const [scheme, rawToken] = authorization.split(' ');\n    const dpopRaw = request.headers.dpop;\n    const dpopHeader = Array.isArray(dpopRaw) ? dpopRaw[0] : dpopRaw;\n    if (scheme === 'DPoP' && !dpopHeader) {\n      return { success: false, error: 'Missing DPoP header' };\n    }\n\n    try {\n      // Build the request URL for verification\n      const method = (request.method ?? 'GET') as 'GET' | 'POST' | 'PUT' | 'DELETE' | 'PATCH' | 'HEAD' | 'OPTIONS';\n      const url = this.buildRequestUrl(request);\n\n      const dpopOptions = dpopHeader ? {\n        header: dpopHeader,\n        method,\n        url,\n      } : undefined;\n\n      const payload = await this.verify(authorization, dpopOptions) as unknown as Record<string, unknown>;\n\n      const webId = this.extractWebId(payload);\n      if (!webId) {\n        return { success: false, error: 'Token missing webId claim' };\n      }\n\n      const clientId = this.extractString(payload, 'client_id') ?? \n                       this.extractString(payload, 'azp');\n\n      let accountId: string | undefined;\n      if (this.resolveAccountId) {\n        try {\n          accountId = await this.resolveAccountId(webId);\n        } catch (error) {\n          this.logger.warn(`Failed to resolve accountId for webId ${webId}: ${error}`);\n        }\n      }\n\n      const context: SolidAuthContext = {\n        type: 'solid',\n        webId,\n        accountId,\n        clientId,\n        accessToken: rawToken?.trim(),\n        tokenType: scheme === 'DPoP' ? 'DPoP' : 'Bearer',\n        dpopProof: dpopHeader?.trim(),\n      };\n\n      this.logger.debug(`Authenticated Solid token for webId: ${webId}`);\n      return { success: true, context };\n    } catch (error) {\n      this.logger.warn(`Solid token verification failed: ${error}`);\n      return { success: false, error: 'Invalid Solid token' };\n    }\n  }\n\n  private buildRequestUrl(request: IncomingMessage): string {\n    const host = this.getHost(request);\n    const proto = this.getProtocol(request);\n    const prefix = this.getForwardedPrefix(request);\n    const path = request.url ?? '/';\n    const fullPath = prefix ? this.joinPaths(prefix, path) : path;\n    return `${proto}://${host}${fullPath}`;\n  }\n\n  private getProtocol(request: IncomingMessage): string {\n    const forwarded = request.headers['x-forwarded-proto'];\n    if (forwarded) {\n      const proto = Array.isArray(forwarded) ? forwarded[0] : forwarded;\n      return proto?.split(',')[0]?.trim() ?? 'http';\n    }\n    // Default to http for local development\n    return 'http';\n  }\n\n  private getHost(request: IncomingMessage): string {\n    const forwarded = request.headers['x-forwarded-host'];\n    if (forwarded) {\n      const raw = Array.isArray(forwarded) ? forwarded[0] : forwarded;\n      const host = raw?.split(',')[0]?.trim();\n      if (host) {\n        return host;\n      }\n    }\n    return request.headers.host ?? 'localhost';\n  }\n\n  private getForwardedPrefix(request: IncomingMessage): string | undefined {\n    const forwarded = request.headers['x-forwarded-prefix'];\n    if (!forwarded) {\n      return undefined;\n    }\n    const raw = Array.isArray(forwarded) ? forwarded[0] : forwarded;\n    const prefix = raw?.split(',')[0]?.trim();\n    return prefix && prefix !== '/' ? prefix : undefined;\n  }\n\n  private joinPaths(prefix: string, path: string): string {\n    const normalizedPrefix = prefix.endsWith('/') ? prefix.slice(0, -1) : prefix;\n    const normalizedPath = path.startsWith('/') ? path : `/${path}`;\n    if (!normalizedPrefix) {\n      return normalizedPath;\n    }\n    return `${normalizedPrefix}${normalizedPath}`;\n  }\n\n  private isJwt(token: string): boolean {\n    return /^[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+$/.test(token);\n  }\n\n  private extractWebId(payload: Record<string, unknown>): string | undefined {\n    return this.extractString(payload, 'webid') ??\n           this.extractString(payload, 'webId') ??\n           this.extractString(payload, 'sub');\n  }\n\n  private extractString(obj: Record<string, unknown>, key: string): string | undefined {\n    const value = obj[key];\n    if (typeof value === 'string' && value.trim().length > 0) {\n      return value.trim();\n    }\n    return undefined;\n  }\n}\n"]}

package/dist/api/auth/TokenIdentity.d.ts

@@ -0,0 +1,6 @@
+export type TokenIdentityResponse = {
+    access_token?: unknown;
+    webid?: unknown;
+    webId?: unknown;
+};
+export declare function extractAuthoritativeWebIdFromTokenResponse(response: TokenIdentityResponse): string | undefined;

package/dist/api/auth/TokenIdentity.js

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.extractAuthoritativeWebIdFromTokenResponse = extractAuthoritativeWebIdFromTokenResponse;
+function extractAuthoritativeWebIdFromTokenResponse(response) {
+    const bodyWebId = extractString(response.webid) ?? extractString(response.webId);
+    if (bodyWebId) {
+        return bodyWebId;
+    }
+    const accessToken = extractString(response.access_token);
+    if (!accessToken) {
+        return undefined;
+    }
+    return extractWebIdFromJwtPayload(accessToken);
+}
+function extractWebIdFromJwtPayload(jwt) {
+    try {
+        const parts = jwt.split('.');
+        if (parts.length !== 3 || !parts[1]) {
+            return undefined;
+        }
+        const payload = JSON.parse(Buffer.from(parts[1], 'base64url').toString('utf-8'));
+        return extractString(payload.webid) ?? extractString(payload.webId) ?? extractString(payload.sub);
+    }
+    catch {
+        return undefined;
+    }
+}
+function extractString(value) {
+    return typeof value === 'string' && value.length > 0 ? value : undefined;
+}
+//# sourceMappingURL=TokenIdentity.js.map