@undefineds.co/xpod 0.3.57 → 0.3.61

package/dist/api/handlers/PodSettingsHandler.d.ts

@@ -0,0 +1,79 @@
+import { getLoggerFor } from 'global-logger-factory';
+import type { ApiServer } from '../ApiServer';
+import type { PodLookupRepository } from '../../identity/drizzle/PodLookupRepository';
+import type { UsageRepository } from '../../storage/quota/UsageRepository';
+import type { InternalPodAccessTokenProvider } from '../ai-gateway/auth/PodGatewayAccessKeyRepository';
+export interface PodSettingsStatus {
+    identity: {
+        webId: string;
+        podUrl?: string;
+    };
+    storage: PodStorageStatus;
+    aiConnection: PodAiConnectionStatus;
+    generatedAt: string;
+}
+export type PodStorageStatus = {
+    status: 'available';
+    usage: {
+        storageBytes: number;
+        ingressBytes: number;
+        egressBytes: number;
+    };
+    limits: {
+        storageLimitBytes: number | null;
+        bandwidthLimitBps: number | null;
+    };
+    source: 'identity_usage';
+} | {
+    status: 'unsupported' | 'error';
+    reason: string;
+};
+export type PodAiConnectionStatus = {
+    status: 'available';
+    containerUrl?: string;
+    configuredProviders: number;
+    lastSyncAt?: string;
+    source: 'drizzle-solid';
+} | {
+    status: 'unsupported' | 'error';
+    reason: string;
+};
+export interface PodAiConnectionStatusReader {
+    read(input: {
+        webId: string;
+        podUrl?: string;
+    }): Promise<PodAiConnectionStatus>;
+}
+export interface PodSettingsHandlerOptions {
+    podLookupRepository: Pick<PodLookupRepository, 'findByWebId'>;
+    usageRepo: Pick<UsageRepository, 'getPodUsage'>;
+    aiConnectionStatusReader?: PodAiConnectionStatusReader;
+    now?: () => Date;
+    logger?: Pick<ReturnType<typeof getLoggerFor>, 'warn' | 'error'>;
+}
+export declare function registerPodSettingsRoutes(server: ApiServer, options: PodSettingsHandlerOptions): void;
+export declare class DrizzlePodAiConnectionStatusReader implements PodAiConnectionStatusReader {
+    private readonly internalPodAccess?;
+    private readonly dbFactory;
+    constructor(internalPodAccess?: InternalPodAccessTokenProvider | undefined, dbFactory?: (input: {
+        webId: string;
+        podUrl: string;
+        fetch: typeof fetch;
+    }) => Promise<AiConnectionStatusDb>);
+    read({ webId, podUrl }: {
+        webId: string;
+        podUrl?: string;
+    }): Promise<PodAiConnectionStatus>;
+}
+type AiConnectionStatusDb = {
+    init?: (...resources: unknown[]) => Promise<void>;
+    select(): {
+        from(resource: unknown): {
+            where(condition: unknown): {
+                execute(): Promise<unknown[]>;
+            };
+            execute(): Promise<unknown[]>;
+        };
+    };
+};
+export {};

package/dist/api/handlers/PodSettingsHandler.js

@@ -0,0 +1,162 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DrizzlePodAiConnectionStatusReader = void 0;
+exports.registerPodSettingsRoutes = registerPodSettingsRoutes;
+const drizzle_solid_1 = require("@undefineds.co/drizzle-solid");
+const models_1 = require("@undefineds.co/models");
+const global_logger_factory_1 = require("global-logger-factory");
+function registerPodSettingsRoutes(server, options) {
+    const logger = options.logger ?? (0, global_logger_factory_1.getLoggerFor)('PodSettingsHandler');
+    const now = options.now ?? (() => new Date());
+    const aiConnectionStatusReader = options.aiConnectionStatusReader ?? {
+        read: async () => ({ status: 'unsupported', reason: 'not_configured' }),
+    };
+    server.get('/api/pod/settings/status', async (request, response) => {
+        if (!request.auth || request.auth.type !== 'solid') {
+            sendJson(response, 401, { error: 'Authentication required' });
+            return;
+        }
+        const webId = request.auth.webId;
+        try {
+            const pod = await options.podLookupRepository.findByWebId(webId);
+            const podUrl = pod?.storageUrl ?? pod?.baseUrl;
+            const [storage, aiConnection] = await Promise.all([
+                readStorageStatus(options.usageRepo, pod),
+                aiConnectionStatusReader.read({ webId, podUrl }).catch((error) => {
+                    const reason = safeAiConnectionFailureReason(error);
+                    logger.warn(`Failed to read Pod AI Connection status: ${reason}`);
+                    return { status: 'error', reason };
+                }),
+            ]);
+            sendJson(response, 200, {
+                identity: {
+                    webId,
+                    podUrl,
+                },
+                storage,
+                aiConnection,
+                generatedAt: now().toISOString(),
+            });
+        }
+        catch (error) {
+            logger.error(`Failed to read Pod settings status: ${safeLogError(error)}`);
+            sendJson(response, 500, { error: 'Failed to read Pod settings status' });
+        }
+    });
+}
+async function readStorageStatus(usageRepo, pod) {
+    if (!pod) {
+        return { status: 'unsupported', reason: 'pod_not_found' };
+    }
+    let usage;
+    try {
+        usage = await usageRepo.getPodUsage(pod.podId);
+    }
+    catch {
+        return { status: 'error', reason: 'usage_unavailable' };
+    }
+    if (!usage) {
+        return { status: 'unsupported', reason: 'usage_not_available' };
+    }
+    return {
+        status: 'available',
+        usage: {
+            storageBytes: usage.storageBytes,
+            ingressBytes: usage.ingressBytes,
+            egressBytes: usage.egressBytes,
+        },
+        limits: {
+            storageLimitBytes: usage.storageLimitBytes ?? null,
+            bandwidthLimitBps: usage.bandwidthLimitBps ?? null,
+        },
+        source: 'identity_usage',
+    };
+}
+class DrizzlePodAiConnectionStatusReader {
+    constructor(internalPodAccess, dbFactory = createAiConnectionStatusDb) {
+        this.internalPodAccess = internalPodAccess;
+        this.dbFactory = dbFactory;
+    }
+    async read({ webId, podUrl }) {
+        const trustedFetch = await this.internalPodAccess?.getTrustedFetch(webId);
+        if (!trustedFetch) {
+            return { status: 'unsupported', reason: 'not_configured' };
+        }
+        if (!podUrl) {
+            return { status: 'unsupported', reason: 'pod_not_found' };
+        }
+        try {
+            const db = await this.dbFactory({ webId, podUrl, fetch: trustedFetch });
+            await db.init?.(models_1.credentialResource, models_1.indexedFileResource);
+            const credentialRows = await db.select().from(models_1.credentialResource).where((0, drizzle_solid_1.eq)(models_1.credentialResource.status, 'active')).execute();
+            const indexedRows = await db.select().from(models_1.indexedFileResource).execute();
+            const lastSyncAt = latestIso([
+                ...credentialRows.map((row) => row.lastUsedAt ?? row.lastRefreshAt),
+                ...indexedRows.map((row) => row.indexedAt),
+            ]);
+            return {
+                status: 'available',
+                containerUrl: new URL('settings/credentials.ttl', podUrl).toString(),
+                configuredProviders: credentialRows.length,
+                lastSyncAt,
+                source: 'drizzle-solid',
+            };
+        }
+        catch {
+            return { status: 'error', reason: 'ai_connection_unavailable' };
+        }
+    }
+}
+exports.DrizzlePodAiConnectionStatusReader = DrizzlePodAiConnectionStatusReader;
+function createAiConnectionStatusDb(input) {
+    return Promise.resolve((0, drizzle_solid_1.drizzle)({
+        fetch: input.fetch,
+        info: { webId: input.webId, isLoggedIn: true },
+    }, {
+        podUrl: input.podUrl,
+        schema: {
+            credential: models_1.credentialResource,
+            indexedFile: models_1.indexedFileResource,
+        },
+    }));
+}
+function latestIso(values) {
+    const timestamps = values
+        .map((value) => {
+        if (value instanceof Date)
+            return value.getTime();
+        if (typeof value === 'string' || typeof value === 'number') {
+            const parsed = Date.parse(String(value));
+            return Number.isFinite(parsed) ? parsed : undefined;
+        }
+        return undefined;
+    })
+        .filter((value) => value !== undefined);
+    if (timestamps.length === 0) {
+        return undefined;
+    }
+    return new Date(Math.max(...timestamps)).toISOString();
+}
+function sendJson(response, status, data) {
+    response.statusCode = status;
+    response.setHeader('Content-Type', 'application/json');
+    response.end(JSON.stringify(data));
+}
+function safeLogError(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+function safeAiConnectionFailureReason(error) {
+    const message = error instanceof Error ? error.message : String(error);
+    for (const reason of [
+        'service_access_missing',
+        'not_configured',
+        'pod_not_found',
+        'ai_connection_unavailable',
+    ]) {
+        if (message.includes(reason)) {
+            return reason;
+        }
+    }
+    return 'ai_connection_unavailable';
+}
+//# sourceMappingURL=PodSettingsHandler.js.map

package/dist/api/handlers/PodSettingsHandler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PodSettingsHandler.js","sourceRoot":"","sources":["../../../src/api/handlers/PodSettingsHandler.ts"],"names":[],"mappings":";;;AAqEA,8DAwCC;AA5GD,gEAA2D;AAC3D,kDAK+B;AAC/B,iEAAqD;AA6DrD,SAAgB,yBAAyB,CAAC,MAAiB,EAAE,OAAkC;IAC7F,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,IAAA,oCAAY,EAAC,oBAAoB,CAAC,CAAC;IACpE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC9C,MAAM,wBAAwB,GAAG,OAAO,CAAC,wBAAwB,IAAI;QACnE,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAU;KACjF,CAAC;IAEF,MAAM,CAAC,GAAG,CAAC,0BAA0B,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;QACjE,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YACnD,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;YAC9D,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,mBAAmB,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YACjE,MAAM,MAAM,GAAG,GAAG,EAAE,UAAU,IAAI,GAAG,EAAE,OAAO,CAAC;YAC/C,MAAM,CAAC,OAAO,EAAE,YAAY,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBAChD,iBAAiB,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC;gBACzC,wBAAwB,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;oBACxE,MAAM,MAAM,GAAG,6BAA6B,CAAC,KAAK,CAAC,CAAC;oBACpD,MAAM,CAAC,IAAI,CAAC,4CAA4C,MAAM,EAAE,CAAC,CAAC;oBAClE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAW,CAAC;gBAC9C,CAAC,CAAC;aACH,CAAC,CAAC;YAEH,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE;gBACtB,QAAQ,EAAE;oBACR,KAAK;oBACL,MAAM;iBACP;gBACD,OAAO;gBACP,YAAY;gBACZ,WAAW,EAAE,GAAG,EAAE,CAAC,WAAW,EAAE;aACL,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,uCAAuC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC3E,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,SAA+C,EAC/C,GAAgC;IAEhC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAC5D,CAAC;IAED,IAAI,KAAiC,CAAC;IACtC,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAC1D,CAAC;IAED,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IAClE,CAAC;IAED,OAAO;QACL,MAAM,EAAE,WAAW;QACnB,KAAK,EAAE;YACL,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,WAAW,EAAE,KAAK,CAAC,WAAW;SAC/B;QACD,MAAM,EAAE;YACN,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,IAAI,IAAI;YAClD,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,IAAI,IAAI;SACnD;QACD,MAAM,EAAE,gBAAgB;KACzB,CAAC;AACJ,CAAC;AAED,MAAa,kCAAkC;IAC7C,YACmB,iBAAkD,EAClD,YAIqB,0BAA0B;QAL/C,sBAAiB,GAAjB,iBAAiB,CAAiC;QAClD,cAAS,GAAT,SAAS,CAIsC;IAC/D,CAAC;IAEG,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAsC;QACrE,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,eAAe,CAAC,KAAK,CAAC,CAAC;QAC1E,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;QAC7D,CAAC;QACD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;QAC5D,CAAC;QAED,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;YACxE,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,2BAAkB,EAAE,4BAAmB,CAAC,CAAC;YAEzD,MAAM,cAAc,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,2BAAkB,CAAC,CAAC,KAAK,CAAC,IAAA,kBAAE,EAAC,2BAAkB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,EAAqB,CAAC;YAC9I,MAAM,WAAW,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,4BAAmB,CAAC,CAAC,OAAO,EAAsB,CAAC;YAC9F,MAAM,UAAU,GAAG,SAAS,CAAC;gBAC3B,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,aAAa,CAAC;gBACnE,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC;aAC3C,CAAC,CAAC;YAEH,OAAO;gBACL,MAAM,EAAE,WAAW;gBACnB,YAAY,EAAE,IAAI,GAAG,CAAC,0BAA0B,EAAE,MAAM,CAAC,CAAC,QAAQ,EAAE;gBACpE,mBAAmB,EAAE,cAAc,CAAC,MAAM;gBAC1C,UAAU;gBACV,MAAM,EAAE,eAAe;aACxB,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC;QAClE,CAAC;IACH,CAAC;CACF;AAzCD,gFAyCC;AAYD,SAAS,0BAA0B,CAAC,KAInC;IACC,OAAO,OAAO,CAAC,OAAO,CAAC,IAAA,uBAAO,EAAC;QAC7B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE;KACxC,EAAE;QACR,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,MAAM,EAAE;YACN,UAAU,EAAE,2BAAkB;YAC9B,WAAW,EAAE,4BAAmB;SACjC;KACF,CAAoC,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,SAAS,CAAC,MAAiB;IAClC,MAAM,UAAU,GAAG,MAAM;SACtB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACb,IAAI,KAAK,YAAY,IAAI;YAAE,OAAO,KAAK,CAAC,OAAO,EAAE,CAAC;QAClD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACzC,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;QACtD,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;SACD,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;IAC3D,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;AACzD,CAAC;AAED,SAAS,QAAQ,CAAC,QAAwB,EAAE,MAAc,EAAE,IAAa;IACvE,QAAQ,CAAC,UAAU,GAAG,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;IACvD,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,6BAA6B,CAAC,KAAc;IACnD,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,KAAK,MAAM,MAAM,IAAI;QACnB,wBAAwB;QACxB,gBAAgB;QAChB,eAAe;QACf,2BAA2B;KAC5B,EAAE,CAAC;QACF,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7B,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;IACD,OAAO,2BAA2B,CAAC;AACrC,CAAC","sourcesContent":["import type { ServerResponse } from 'node:http';\nimport { drizzle, eq } from '@undefineds.co/drizzle-solid';\nimport {\n  credentialResource,\n  indexedFileResource,\n  type CredentialRow,\n  type IndexedFileRow,\n} from '@undefineds.co/models';\nimport { getLoggerFor } from 'global-logger-factory';\nimport type { ApiServer } from '../ApiServer';\nimport type { AuthenticatedRequest } from '../middleware/AuthMiddleware';\nimport type { PodLookupRepository, PodLookupResult } from '../../identity/drizzle/PodLookupRepository';\nimport type { UsageRepository, PodUsageRecord } from '../../storage/quota/UsageRepository';\nimport type { InternalPodAccessTokenProvider } from '../ai-gateway/auth/PodGatewayAccessKeyRepository';\n\nexport interface PodSettingsStatus {\n  identity: {\n    webId: string;\n    podUrl?: string;\n  };\n  storage: PodStorageStatus;\n  aiConnection: PodAiConnectionStatus;\n  generatedAt: string;\n}\n\nexport type PodStorageStatus =\n  | {\n    status: 'available';\n    usage: {\n      storageBytes: number;\n      ingressBytes: number;\n      egressBytes: number;\n    };\n    limits: {\n      storageLimitBytes: number | null;\n      bandwidthLimitBps: number | null;\n    };\n    source: 'identity_usage';\n  }\n  | {\n    status: 'unsupported' | 'error';\n    reason: string;\n  };\n\nexport type PodAiConnectionStatus =\n  | {\n    status: 'available';\n    containerUrl?: string;\n    configuredProviders: number;\n    lastSyncAt?: string;\n    source: 'drizzle-solid';\n  }\n  | {\n    status: 'unsupported' | 'error';\n    reason: string;\n  };\n\nexport interface PodAiConnectionStatusReader {\n  read(input: { webId: string; podUrl?: string }): Promise<PodAiConnectionStatus>;\n}\n\nexport interface PodSettingsHandlerOptions {\n  podLookupRepository: Pick<PodLookupRepository, 'findByWebId'>;\n  usageRepo: Pick<UsageRepository, 'getPodUsage'>;\n  aiConnectionStatusReader?: PodAiConnectionStatusReader;\n  now?: () => Date;\n  logger?: Pick<ReturnType<typeof getLoggerFor>, 'warn' | 'error'>;\n}\n\nexport function registerPodSettingsRoutes(server: ApiServer, options: PodSettingsHandlerOptions): void {\n  const logger = options.logger ?? getLoggerFor('PodSettingsHandler');\n  const now = options.now ?? (() => new Date());\n  const aiConnectionStatusReader = options.aiConnectionStatusReader ?? {\n    read: async () => ({ status: 'unsupported', reason: 'not_configured' }) as const,\n  };\n\n  server.get('/api/pod/settings/status', async (request, response) => {\n    if (!request.auth || request.auth.type !== 'solid') {\n      sendJson(response, 401, { error: 'Authentication required' });\n      return;\n    }\n\n    const webId = request.auth.webId;\n    try {\n      const pod = await options.podLookupRepository.findByWebId(webId);\n      const podUrl = pod?.storageUrl ?? pod?.baseUrl;\n      const [storage, aiConnection] = await Promise.all([\n        readStorageStatus(options.usageRepo, pod),\n        aiConnectionStatusReader.read({ webId, podUrl }).catch((error: unknown) => {\n          const reason = safeAiConnectionFailureReason(error);\n          logger.warn(`Failed to read Pod AI Connection status: ${reason}`);\n          return { status: 'error', reason } as const;\n        }),\n      ]);\n\n      sendJson(response, 200, {\n        identity: {\n          webId,\n          podUrl,\n        },\n        storage,\n        aiConnection,\n        generatedAt: now().toISOString(),\n      } satisfies PodSettingsStatus);\n    } catch (error) {\n      logger.error(`Failed to read Pod settings status: ${safeLogError(error)}`);\n      sendJson(response, 500, { error: 'Failed to read Pod settings status' });\n    }\n  });\n}\n\nasync function readStorageStatus(\n  usageRepo: Pick<UsageRepository, 'getPodUsage'>,\n  pod: PodLookupResult | undefined,\n): Promise<PodStorageStatus> {\n  if (!pod) {\n    return { status: 'unsupported', reason: 'pod_not_found' };\n  }\n\n  let usage: PodUsageRecord | undefined;\n  try {\n    usage = await usageRepo.getPodUsage(pod.podId);\n  } catch {\n    return { status: 'error', reason: 'usage_unavailable' };\n  }\n\n  if (!usage) {\n    return { status: 'unsupported', reason: 'usage_not_available' };\n  }\n\n  return {\n    status: 'available',\n    usage: {\n      storageBytes: usage.storageBytes,\n      ingressBytes: usage.ingressBytes,\n      egressBytes: usage.egressBytes,\n    },\n    limits: {\n      storageLimitBytes: usage.storageLimitBytes ?? null,\n      bandwidthLimitBps: usage.bandwidthLimitBps ?? null,\n    },\n    source: 'identity_usage',\n  };\n}\n\nexport class DrizzlePodAiConnectionStatusReader implements PodAiConnectionStatusReader {\n  public constructor(\n    private readonly internalPodAccess?: InternalPodAccessTokenProvider,\n    private readonly dbFactory: (input: {\n      webId: string;\n      podUrl: string;\n      fetch: typeof fetch;\n    }) => Promise<AiConnectionStatusDb> = createAiConnectionStatusDb,\n  ) {}\n\n  public async read({ webId, podUrl }: { webId: string; podUrl?: string }): Promise<PodAiConnectionStatus> {\n    const trustedFetch = await this.internalPodAccess?.getTrustedFetch(webId);\n    if (!trustedFetch) {\n      return { status: 'unsupported', reason: 'not_configured' };\n    }\n    if (!podUrl) {\n      return { status: 'unsupported', reason: 'pod_not_found' };\n    }\n\n    try {\n      const db = await this.dbFactory({ webId, podUrl, fetch: trustedFetch });\n      await db.init?.(credentialResource, indexedFileResource);\n\n      const credentialRows = await db.select().from(credentialResource).where(eq(credentialResource.status, 'active')).execute() as CredentialRow[];\n      const indexedRows = await db.select().from(indexedFileResource).execute() as IndexedFileRow[];\n      const lastSyncAt = latestIso([\n        ...credentialRows.map((row) => row.lastUsedAt ?? row.lastRefreshAt),\n        ...indexedRows.map((row) => row.indexedAt),\n      ]);\n\n      return {\n        status: 'available',\n        containerUrl: new URL('settings/credentials.ttl', podUrl).toString(),\n        configuredProviders: credentialRows.length,\n        lastSyncAt,\n        source: 'drizzle-solid',\n      };\n    } catch {\n      return { status: 'error', reason: 'ai_connection_unavailable' };\n    }\n  }\n}\n\ntype AiConnectionStatusDb = {\n  init?: (...resources: unknown[]) => Promise<void>;\n  select(): {\n    from(resource: unknown): {\n      where(condition: unknown): { execute(): Promise<unknown[]> };\n      execute(): Promise<unknown[]>;\n    };\n  };\n};\n\nfunction createAiConnectionStatusDb(input: {\n  webId: string;\n  podUrl: string;\n  fetch: typeof fetch;\n}): Promise<AiConnectionStatusDb> {\n  return Promise.resolve(drizzle({\n    fetch: input.fetch,\n    info: { webId: input.webId, isLoggedIn: true },\n  } as any, {\n    podUrl: input.podUrl,\n    schema: {\n      credential: credentialResource,\n      indexedFile: indexedFileResource,\n    },\n  }) as unknown as AiConnectionStatusDb);\n}\n\nfunction latestIso(values: unknown[]): string | undefined {\n  const timestamps = values\n    .map((value) => {\n      if (value instanceof Date) return value.getTime();\n      if (typeof value === 'string' || typeof value === 'number') {\n        const parsed = Date.parse(String(value));\n        return Number.isFinite(parsed) ? parsed : undefined;\n      }\n      return undefined;\n    })\n    .filter((value): value is number => value !== undefined);\n  if (timestamps.length === 0) {\n    return undefined;\n  }\n  return new Date(Math.max(...timestamps)).toISOString();\n}\n\nfunction sendJson(response: ServerResponse, status: number, data: unknown): void {\n  response.statusCode = status;\n  response.setHeader('Content-Type', 'application/json');\n  response.end(JSON.stringify(data));\n}\n\nfunction safeLogError(error: unknown): string {\n  return error instanceof Error ? error.message : String(error);\n}\n\nfunction safeAiConnectionFailureReason(error: unknown): string {\n  const message = error instanceof Error ? error.message : String(error);\n  for (const reason of [\n    'service_access_missing',\n    'not_configured',\n    'pod_not_found',\n    'ai_connection_unavailable',\n  ]) {\n    if (message.includes(reason)) {\n      return reason;\n    }\n  }\n  return 'ai_connection_unavailable';\n}\n"]}

package/dist/api/handlers/ProvisionHandler.d.ts

@@ -6,7 +6,7 @@
  * POST /provision/nodes  - SP 注册（公开，无需认证）
  *   返回 nodeId、nodeToken、serviceToken、provisionCode（自包含 JWT）
  *
- * provisionCode 是自包含 token，编码了 SP 的 publicUrl 和 serviceToken。
+ * provisionCode 是自包含 token，编码了 SP 的 publicUrl 和短期 serviceAccessToken。
  * CSS 侧的 ProvisionPodCreator 解码后直接回调 SP，不需要查数据库。
  *
  * GET /provision/status  - Local 端 SP 状态查询（公开）
@@ -28,6 +28,8 @@ export interface ProvisionHandlerOptions {
     baseStorageDomain?: string;
     /** provisionCode 有效期（秒），默认 24 小时 */
     provisionCodeTtl?: number;
+    /** Cloud → Local 回调 access token 有效期（秒），默认 15 分钟 */
+    serviceAccessTokenTtl?: number;
 }
 export declare function registerProvisionRoutes(server: ApiServer, options: ProvisionHandlerOptions): void;
 /**

package/dist/api/handlers/ProvisionHandler.js

@@ -7,51 +7,30 @@
  * POST /provision/nodes  - SP 注册（公开，无需认证）
  *   返回 nodeId、nodeToken、serviceToken、provisionCode（自包含 JWT）
  *
- * provisionCode 是自包含 token，编码了 SP 的 publicUrl 和 serviceToken。
+ * provisionCode 是自包含 token，编码了 SP 的 publicUrl 和短期 serviceAccessToken。
  * CSS 侧的 ProvisionPodCreator 解码后直接回调 SP，不需要查数据库。
  *
  * GET /provision/status  - Local 端 SP 状态查询（公开）
  *   返回 SP 配置状态，供 Linx 查询
  */
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || function (mod) {
-    if (mod && mod.__esModule) return mod;
-    var result = {};
-    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
-    __setModuleDefault(result, mod);
-    return result;
-};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.registerProvisionRoutes = registerProvisionRoutes;
 exports.registerProvisionStatusRoute = registerProvisionStatusRoute;
 exports.createLocalSetupProvisionStateWriter = createLocalSetupProvisionStateWriter;
-const fs = __importStar(require("node:fs"));
-const path = __importStar(require("node:path"));
 const node_crypto_1 = require("node:crypto");
 const global_logger_factory_1 = require("global-logger-factory");
 const ProvisionCodeCodec_1 = require("../../provision/ProvisionCodeCodec");
+const ServiceAccessTokenCodec_1 = require("../../provision/ServiceAccessTokenCodec");
+const LocalProvisionState_1 = require("../../provision/LocalProvisionState");
 /** 默认 24 小时 */
 const DEFAULT_TTL = 24 * 60 * 60;
+const DEFAULT_SERVICE_ACCESS_TOKEN_TTL = 15 * 60;
 const PROVISION_STATUS_REFRESH_GRACE_SECONDS = 5 * 60;
 function registerProvisionRoutes(server, options) {
     const logger = (0, global_logger_factory_1.getLoggerFor)('ProvisionHandler');
     const { repository, baseUrl, baseStorageDomain } = options;
     const ttl = options.provisionCodeTtl ?? DEFAULT_TTL;
+    const serviceAccessTokenTtl = options.serviceAccessTokenTtl ?? DEFAULT_SERVICE_ACCESS_TOKEN_TTL;
     const codec = new ProvisionCodeCodec_1.ProvisionCodeCodec(baseUrl);
     /**
      * POST /provision/nodes
@@ -162,13 +141,23 @@ function registerProvisionRoutes(server, options) {
                     subdomain: subdomainPrefix,
                 });
             }
-            // 生成自包含 provisionCode（编码了 SP 信息，CSS 解码后直接回调 SP）
+            // 生成自包含 provisionCode（编码 SP 信息和短期 serviceAccessToken，长期 serviceToken 只保留给 Local 持久化/刷新）
+            const nowSeconds = Math.floor(Date.now() / 1000);
+            const accessTtl = Math.min(ttl, serviceAccessTokenTtl);
+            const serviceAccessTokenExp = nowSeconds + accessTtl;
+            const serviceAccessToken = (0, ServiceAccessTokenCodec_1.createServiceAccessToken)({
+                serviceToken: result.serviceToken,
+                subject: result.nodeId,
+                scopes: ['pod:provision', 'webid:lookup'],
+                expiresAt: serviceAccessTokenExp,
+            });
             const provisionCode = codec.encode({
                 spUrl: provisionSpUrl,
-                serviceToken: result.serviceToken,
+                serviceAccessToken,
+                serviceAccessTokenExp,
                 nodeId: result.nodeId,
                 spDomain,
-                exp: Math.floor(Date.now() / 1000) + ttl,
+                exp: serviceAccessTokenExp,
             });
             logger.info(`Registered SP node ${result.nodeId} at ${provisionSpUrl}${spDomain ? `, spDomain: ${spDomain}` : ''}`);
             const responseBody = {
@@ -415,7 +404,7 @@ function registerProvisionStatusRoute(server, options) {
     };
     let refreshPromise;
     server.get('/provision/status', async (_request, response) => {
-        const registered = Boolean(options.nodeId && options.cloudUrl);
+        const registered = Boolean(options.nodeId && options.nodeToken && options.cloudUrl);
         const body = {
             registered,
         };
@@ -484,13 +473,10 @@ function registerProvisionStatusRoute(server, options) {
     logger.info('Provision status route registered');
 }
 function createLocalSetupProvisionStateWriter(setupPath, providerId) {
-    if (!setupPath?.trim() || !providerId?.trim()) {
-        return undefined;
-    }
-    const targetPath = path.resolve(setupPath);
-    const targetProviderId = providerId.trim();
+    const targetPath = (0, LocalProvisionState_1.resolveLocalSetupPath)(setupPath);
+    const targetProviderId = (0, LocalProvisionState_1.resolveLocalSetupProviderId)(providerId);
     return async (state) => {
-        upsertLocalSetupFile(targetPath, targetProviderId, state);
+        (0, LocalProvisionState_1.upsertLocalProvisionState)(targetPath, targetProviderId, state);
     };
 }
 async function persistProvisionStatusState(options, state, logger) {
@@ -513,57 +499,6 @@ async function persistProvisionStatusState(options, state, logger) {
         logger.warn(`Failed to persist refreshed local provision state: ${error}`);
     }
 }
-function upsertLocalSetupFile(filePath, providerId, state) {
-    const existing = readJsonObjectFile(filePath);
-    const previous = readJsonObject(existing[providerId]);
-    const cloudIdentityUrl = normalizeUrl(state.cloudBaseUrl);
-    const cloudApiUrl = normalizeUrl(state.cloudUrl);
-    const provisionUrl = cloudIdentityUrl
-        ? `${cloudIdentityUrl.replace(/\/+$/u, '')}/.account/?provisionCode=${encodeURIComponent(state.provisionCode)}`
-        : readString(previous.provisionUrl);
-    existing[providerId] = {
-        ...previous,
-        nodeId: state.nodeId,
-        nodeToken: state.nodeToken,
-        serviceToken: state.serviceToken,
-        provisionCode: state.provisionCode,
-        publicUrl: normalizeUrl(state.publicUrl),
-        spDomain: readString(state.spDomain),
-        provisionUrl,
-        cloudIdentityUrl,
-        cloudApiUrl,
-        registeredAt: typeof previous.registeredAt === 'number' && Number.isFinite(previous.registeredAt)
-            ? previous.registeredAt
-            : Date.now(),
-    };
-    fs.mkdirSync(path.dirname(filePath), { recursive: true });
-    fs.writeFileSync(filePath, `${JSON.stringify(existing, null, 2)}\n`, { encoding: 'utf8', mode: 0o600 });
-    try {
-        fs.chmodSync(filePath, 0o600);
-    }
-    catch {
-        // Some filesystems do not support chmod; the local runtime can still proceed.
-    }
-}
-function readJsonObjectFile(filePath) {
-    try {
-        if (!fs.existsSync(filePath)) {
-            return {};
-        }
-        return readJsonObject(JSON.parse(fs.readFileSync(filePath, 'utf8')));
-    }
-    catch {
-        return {};
-    }
-}
-function readJsonObject(value) {
-    return value && typeof value === 'object' && !Array.isArray(value)
-        ? value
-        : {};
-}
-function readString(value) {
-    return typeof value === 'string' && value.trim() ? value.trim() : undefined;
-}
 function canRefreshProvisionStatus(options, state) {
     return Boolean(options.cloudUrl
         && state.nodeId