@undefineds.co/xpod 0.3.57 → 0.3.61

package/dist/extensions/PodCredentialResolver.js

@@ -0,0 +1,139 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PodGenericCredentialReader = exports.PodCredentialResolver = void 0;
+const drizzle_solid_1 = require("@undefineds.co/drizzle-solid");
+const CredentialReaderImpl_1 = require("../ai/service/CredentialReaderImpl");
+const tables_1 = require("../credential/schema/tables");
+const types_1 = require("../credential/schema/types");
+const genericCredentialSchema = {
+    credential: tables_1.Credential,
+};
+class PodCredentialResolver {
+    constructor(options = {}) {
+        this.credentialReader = options.credentialReader ?? new CredentialReaderImpl_1.CredentialReaderImpl();
+        this.genericCredentialReader = options.genericCredentialReader ?? new PodGenericCredentialReader();
+    }
+    async resolve(input, context) {
+        const service = input.service ?? 'ai';
+        if (service !== 'ai') {
+            return this.genericCredentialReader.getCredential({ ...input, service }, context);
+        }
+        const credential = await this.credentialReader.getAiCredential(context.podBaseUrl, input.provider, context.fetch, context.webId, { credentialId: input.credentialId });
+        if (!credential?.apiKey) {
+            return null;
+        }
+        return {
+            service,
+            capability: input.capability,
+            provider: credential.provider,
+            credentialId: credential.credentialId ?? input.credentialId,
+            apiKey: credential.apiKey,
+            baseUrl: credential.baseUrl,
+            proxyUrl: credential.proxyUrl,
+        };
+    }
+}
+exports.PodCredentialResolver = PodCredentialResolver;
+class PodGenericCredentialReader {
+    async getCredential(input, context) {
+        const service = input.service ?? 'ai';
+        const session = {
+            info: { isLoggedIn: true, webId: context.webId },
+            fetch: context.fetch,
+        };
+        const db = (0, drizzle_solid_1.drizzle)(session, { schema: genericCredentialSchema });
+        const credentials = await db.select().from(tables_1.Credential).where((0, drizzle_solid_1.and)((0, drizzle_solid_1.eq)(tables_1.Credential.service, service), (0, drizzle_solid_1.eq)(tables_1.Credential.status, types_1.CredentialStatus.ACTIVE)));
+        const credential = selectGenericCredential(credentials, input.provider, input.credentialId);
+        if (!credential) {
+            return null;
+        }
+        return {
+            service,
+            capability: input.capability,
+            provider: normalizeProviderId(credential.provider) || input.provider,
+            credentialId: normalizeCredentialId(credential.id ?? credential['@id']) || input.credentialId,
+            apiKey: typeof credential.apiKey === 'string' ? credential.apiKey : undefined,
+            accessToken: typeof credential.oauthAccessToken === 'string' ? credential.oauthAccessToken : undefined,
+            refreshToken: typeof credential.oauthRefreshToken === 'string' ? credential.oauthRefreshToken : undefined,
+            expiresAt: credential.oauthExpiresAt,
+            baseUrl: typeof credential.baseUrl === 'string' ? credential.baseUrl : undefined,
+            proxyUrl: typeof credential.proxyUrl === 'string' ? credential.proxyUrl : undefined,
+            metadata: credentialMetadata(credential),
+        };
+    }
+}
+exports.PodGenericCredentialReader = PodGenericCredentialReader;
+function selectGenericCredential(credentials, provider, credentialId) {
+    const normalizedProvider = normalizeProviderId(provider);
+    const normalizedCredentialId = normalizeCredentialId(credentialId);
+    return [...credentials]
+        .filter((credential) => {
+        if (normalizedCredentialId && !matchesCredentialId(credential, normalizedCredentialId)) {
+            return false;
+        }
+        return normalizeProviderId(credential?.provider) === normalizedProvider;
+    })
+        .sort(compareCredentialPriority)[0];
+}
+function compareCredentialPriority(left, right) {
+    const defaultDelta = Number(isTruthy(right?.isDefault)) - Number(isTruthy(left?.isDefault));
+    if (defaultDelta !== 0)
+        return defaultDelta;
+    const failDelta = (left?.failCount ?? 0) - (right?.failCount ?? 0);
+    if (failDelta !== 0)
+        return failDelta;
+    const usedDelta = timestamp(right?.lastUsedAt) - timestamp(left?.lastUsedAt);
+    if (usedDelta !== 0)
+        return usedDelta;
+    return normalizeCredentialId(left?.id ?? left?.['@id']).localeCompare(normalizeCredentialId(right?.id ?? right?.['@id']));
+}
+function matchesCredentialId(credential, requestedId) {
+    return normalizeCredentialId(credential?.id) === requestedId
+        || normalizeCredentialId(credential?.['@id']) === requestedId;
+}
+function normalizeProviderId(value) {
+    if (typeof value !== 'string')
+        return '';
+    const trimmed = value.trim();
+    if (!trimmed)
+        return '';
+    if (trimmed.includes('#'))
+        return trimmed.split('#').pop() || trimmed;
+    const clean = trimmed.replace(/\/$/u, '');
+    const tail = clean.split('/').filter(Boolean).pop() ?? clean;
+    return tail.endsWith('.ttl') ? tail.slice(0, -4) : tail;
+}
+function normalizeCredentialId(value) {
+    if (typeof value !== 'string')
+        return '';
+    const trimmed = value.trim();
+    if (!trimmed)
+        return '';
+    if (trimmed.includes('#'))
+        return trimmed.split('#').pop() || trimmed;
+    const clean = trimmed.replace(/\/$/u, '');
+    return clean.split('/').filter(Boolean).pop() ?? clean;
+}
+function isTruthy(value) {
+    return value === true || value === 'true' || value === 1 || value === '1';
+}
+function timestamp(value) {
+    if (value instanceof Date)
+        return value.getTime();
+    if (typeof value === 'number' && Number.isFinite(value))
+        return value;
+    if (typeof value === 'string' && value.trim()) {
+        const parsed = Date.parse(value);
+        return Number.isFinite(parsed) ? parsed : 0;
+    }
+    return 0;
+}
+function credentialMetadata(credential) {
+    const metadata = {};
+    if (typeof credential.projectId === 'string' && credential.projectId)
+        metadata.projectId = credential.projectId;
+    if (typeof credential.organizationId === 'string' && credential.organizationId)
+        metadata.organizationId = credential.organizationId;
+    return Object.keys(metadata).length > 0 ? metadata : undefined;
+}
+//# sourceMappingURL=PodCredentialResolver.js.map

package/dist/extensions/PodCredentialResolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PodCredentialResolver.js","sourceRoot":"","sources":["../../src/extensions/PodCredentialResolver.ts"],"names":[],"mappings":";;;AAAA,gEAAgE;AAChE,6EAA0E;AAE1E,wDAAyD;AACzD,sDAA8D;AAG9D,MAAM,uBAAuB,GAAG;IAC9B,UAAU,EAAE,mBAAU;CACvB,CAAC;AAqBF,MAAa,qBAAqB;IAIhC,YAAmB,UAAwC,EAAE;QAC3D,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,IAAI,2CAAoB,EAAE,CAAC;QAC/E,IAAI,CAAC,uBAAuB,GAAG,OAAO,CAAC,uBAAuB,IAAI,IAAI,0BAA0B,EAAE,CAAC;IACrG,CAAC;IAEM,KAAK,CAAC,OAAO,CAAC,KAA6B,EAAE,OAAyB;QAC3E,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC;QACtC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,OAAO,IAAI,CAAC,uBAAuB,CAAC,aAAa,CAAC,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC;QACpF,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,eAAe,CAC5D,OAAO,CAAC,UAAU,EAClB,KAAK,CAAC,QAAQ,EACd,OAAO,CAAC,KAAK,EACb,OAAO,CAAC,KAAK,EACb,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CACrC,CAAC;QACF,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO;YACL,OAAO;YACP,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,YAAY,EAAE,UAAU,CAAC,YAAY,IAAI,KAAK,CAAC,YAAY;YAC3D,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,OAAO,EAAE,UAAU,CAAC,OAAO;YAC3B,QAAQ,EAAE,UAAU,CAAC,QAAQ;SAC9B,CAAC;IACJ,CAAC;CACF;AApCD,sDAoCC;AAED,MAAa,0BAA0B;IAC9B,KAAK,CAAC,aAAa,CAAC,KAA6B,EAAE,OAAyB;QACjF,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC;QACtC,MAAM,OAAO,GAAG;YACd,IAAI,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE;YAChD,KAAK,EAAE,OAAO,CAAC,KAAK;SACrB,CAAC;QACF,MAAM,EAAE,GAAQ,IAAA,uBAAO,EAAC,OAAO,EAAE,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC,CAAC;QACtE,MAAM,WAAW,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,mBAAU,CAAC,CAAC,KAAK,CAAC,IAAA,mBAAG,EAC9D,IAAA,kBAAE,EAAC,mBAAU,CAAC,OAAO,EAAE,OAAO,CAAC,EAC/B,IAAA,kBAAE,EAAC,mBAAU,CAAC,MAAM,EAAE,wBAAgB,CAAC,MAAM,CAAC,CAC/C,CAAC,CAAC;QACH,MAAM,UAAU,GAAG,uBAAuB,CAAC,WAAW,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QAC5F,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO;YACL,OAAO;YACP,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,QAAQ,EAAE,mBAAmB,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,QAAQ;YACpE,YAAY,EAAE,qBAAqB,CAAC,UAAU,CAAC,EAAE,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,YAAY;YAC7F,MAAM,EAAE,OAAO,UAAU,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;YAC7E,WAAW,EAAE,OAAO,UAAU,CAAC,gBAAgB,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS;YACtG,YAAY,EAAE,OAAO,UAAU,CAAC,iBAAiB,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS;YACzG,SAAS,EAAE,UAAU,CAAC,cAAc;YACpC,OAAO,EAAE,OAAO,UAAU,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;YAChF,QAAQ,EAAE,OAAO,UAAU,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;YACnF,QAAQ,EAAE,kBAAkB,CAAC,UAAU,CAAC;SACzC,CAAC;IACJ,CAAC;CACF;AA/BD,gEA+BC;AAED,SAAS,uBAAuB,CAAC,WAAkB,EAAE,QAAgB,EAAE,YAAqB;IAC1F,MAAM,kBAAkB,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IACzD,MAAM,sBAAsB,GAAG,qBAAqB,CAAC,YAAY,CAAC,CAAC;IACnE,OAAO,CAAC,GAAG,WAAW,CAAC;SACpB,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE;QACrB,IAAI,sBAAsB,IAAI,CAAC,mBAAmB,CAAC,UAAU,EAAE,sBAAsB,CAAC,EAAE,CAAC;YACvF,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,mBAAmB,CAAC,UAAU,EAAE,QAAQ,CAAC,KAAK,kBAAkB,CAAC;IAC1E,CAAC,CAAC;SACD,IAAI,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,yBAAyB,CAAC,IAAS,EAAE,KAAU;IACtD,MAAM,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;IAC5F,IAAI,YAAY,KAAK,CAAC;QAAE,OAAO,YAAY,CAAC;IAC5C,MAAM,SAAS,GAAG,CAAC,IAAI,EAAE,SAAS,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,IAAI,CAAC,CAAC,CAAC;IACnE,IAAI,SAAS,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACtC,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,EAAE,UAAU,CAAC,GAAG,SAAS,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAC7E,IAAI,SAAS,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACtC,OAAO,qBAAqB,CAAC,IAAI,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,qBAAqB,CAAC,KAAK,EAAE,EAAE,IAAI,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC5H,CAAC;AAED,SAAS,mBAAmB,CAAC,UAAe,EAAE,WAAmB;IAC/D,OAAO,qBAAqB,CAAC,UAAU,EAAE,EAAE,CAAC,KAAK,WAAW;WACvD,qBAAqB,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,WAAW,CAAC;AAClE,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IACzC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IACxB,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,OAAO,CAAC;IACtE,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,IAAI,KAAK,CAAC;IAC7D,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1D,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IACxB,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,OAAO,CAAC;IACtE,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC1C,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,IAAI,KAAK,CAAC;AACzD,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,GAAG,CAAC;AAC5E,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,KAAK,YAAY,IAAI;QAAE,OAAO,KAAK,CAAC,OAAO,EAAE,CAAC;IAClD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACjC,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,kBAAkB,CAAC,UAAe;IACzC,MAAM,QAAQ,GAA4B,EAAE,CAAC;IAC7C,IAAI,OAAO,UAAU,CAAC,SAAS,KAAK,QAAQ,IAAI,UAAU,CAAC,SAAS;QAAE,QAAQ,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;IAChH,IAAI,OAAO,UAAU,CAAC,cAAc,KAAK,QAAQ,IAAI,UAAU,CAAC,cAAc;QAAE,QAAQ,CAAC,cAAc,GAAG,UAAU,CAAC,cAAc,CAAC;IACpI,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;AACjE,CAAC","sourcesContent":["import { drizzle, and, eq } from '@undefineds.co/drizzle-solid';\nimport { CredentialReaderImpl } from '../ai/service/CredentialReaderImpl';\nimport type { AiCredential } from '../ai/service/types';\nimport { Credential } from '../credential/schema/tables';\nimport { CredentialStatus } from '../credential/schema/types';\nimport type { CredentialResolveInput, CredentialResolver, ExtensionContext, ExtensionFetch, ResolvedCredential } from './types';\n\nconst genericCredentialSchema = {\n  credential: Credential,\n};\n\nexport interface CredentialReaderLike {\n  getAiCredential(\n    podBaseUrl: string,\n    providerId: string,\n    authenticatedFetch: ExtensionFetch,\n    webId?: string,\n    options?: { credentialId?: string },\n  ): Promise<AiCredential | null>;\n}\n\nexport interface PodCredentialResolverOptions {\n  credentialReader?: CredentialReaderLike;\n  genericCredentialReader?: GenericCredentialReaderLike;\n}\n\nexport interface GenericCredentialReaderLike {\n  getCredential(input: CredentialResolveInput, context: ExtensionContext): Promise<ResolvedCredential | null>;\n}\n\nexport class PodCredentialResolver implements CredentialResolver {\n  private readonly credentialReader: CredentialReaderLike;\n  private readonly genericCredentialReader: GenericCredentialReaderLike;\n\n  public constructor(options: PodCredentialResolverOptions = {}) {\n    this.credentialReader = options.credentialReader ?? new CredentialReaderImpl();\n    this.genericCredentialReader = options.genericCredentialReader ?? new PodGenericCredentialReader();\n  }\n\n  public async resolve(input: CredentialResolveInput, context: ExtensionContext): Promise<ResolvedCredential | null> {\n    const service = input.service ?? 'ai';\n    if (service !== 'ai') {\n      return this.genericCredentialReader.getCredential({ ...input, service }, context);\n    }\n\n    const credential = await this.credentialReader.getAiCredential(\n      context.podBaseUrl,\n      input.provider,\n      context.fetch,\n      context.webId,\n      { credentialId: input.credentialId },\n    );\n    if (!credential?.apiKey) {\n      return null;\n    }\n\n    return {\n      service,\n      capability: input.capability,\n      provider: credential.provider,\n      credentialId: credential.credentialId ?? input.credentialId,\n      apiKey: credential.apiKey,\n      baseUrl: credential.baseUrl,\n      proxyUrl: credential.proxyUrl,\n    };\n  }\n}\n\nexport class PodGenericCredentialReader implements GenericCredentialReaderLike {\n  public async getCredential(input: CredentialResolveInput, context: ExtensionContext): Promise<ResolvedCredential | null> {\n    const service = input.service ?? 'ai';\n    const session = {\n      info: { isLoggedIn: true, webId: context.webId },\n      fetch: context.fetch,\n    };\n    const db: any = drizzle(session, { schema: genericCredentialSchema });\n    const credentials = await db.select().from(Credential).where(and(\n      eq(Credential.service, service),\n      eq(Credential.status, CredentialStatus.ACTIVE),\n    ));\n    const credential = selectGenericCredential(credentials, input.provider, input.credentialId);\n    if (!credential) {\n      return null;\n    }\n\n    return {\n      service,\n      capability: input.capability,\n      provider: normalizeProviderId(credential.provider) || input.provider,\n      credentialId: normalizeCredentialId(credential.id ?? credential['@id']) || input.credentialId,\n      apiKey: typeof credential.apiKey === 'string' ? credential.apiKey : undefined,\n      accessToken: typeof credential.oauthAccessToken === 'string' ? credential.oauthAccessToken : undefined,\n      refreshToken: typeof credential.oauthRefreshToken === 'string' ? credential.oauthRefreshToken : undefined,\n      expiresAt: credential.oauthExpiresAt,\n      baseUrl: typeof credential.baseUrl === 'string' ? credential.baseUrl : undefined,\n      proxyUrl: typeof credential.proxyUrl === 'string' ? credential.proxyUrl : undefined,\n      metadata: credentialMetadata(credential),\n    };\n  }\n}\n\nfunction selectGenericCredential(credentials: any[], provider: string, credentialId?: string): any | undefined {\n  const normalizedProvider = normalizeProviderId(provider);\n  const normalizedCredentialId = normalizeCredentialId(credentialId);\n  return [...credentials]\n    .filter((credential) => {\n      if (normalizedCredentialId && !matchesCredentialId(credential, normalizedCredentialId)) {\n        return false;\n      }\n      return normalizeProviderId(credential?.provider) === normalizedProvider;\n    })\n    .sort(compareCredentialPriority)[0];\n}\n\nfunction compareCredentialPriority(left: any, right: any): number {\n  const defaultDelta = Number(isTruthy(right?.isDefault)) - Number(isTruthy(left?.isDefault));\n  if (defaultDelta !== 0) return defaultDelta;\n  const failDelta = (left?.failCount ?? 0) - (right?.failCount ?? 0);\n  if (failDelta !== 0) return failDelta;\n  const usedDelta = timestamp(right?.lastUsedAt) - timestamp(left?.lastUsedAt);\n  if (usedDelta !== 0) return usedDelta;\n  return normalizeCredentialId(left?.id ?? left?.['@id']).localeCompare(normalizeCredentialId(right?.id ?? right?.['@id']));\n}\n\nfunction matchesCredentialId(credential: any, requestedId: string): boolean {\n  return normalizeCredentialId(credential?.id) === requestedId\n    || normalizeCredentialId(credential?.['@id']) === requestedId;\n}\n\nfunction normalizeProviderId(value: unknown): string {\n  if (typeof value !== 'string') return '';\n  const trimmed = value.trim();\n  if (!trimmed) return '';\n  if (trimmed.includes('#')) return trimmed.split('#').pop() || trimmed;\n  const clean = trimmed.replace(/\\/$/u, '');\n  const tail = clean.split('/').filter(Boolean).pop() ?? clean;\n  return tail.endsWith('.ttl') ? tail.slice(0, -4) : tail;\n}\n\nfunction normalizeCredentialId(value: unknown): string {\n  if (typeof value !== 'string') return '';\n  const trimmed = value.trim();\n  if (!trimmed) return '';\n  if (trimmed.includes('#')) return trimmed.split('#').pop() || trimmed;\n  const clean = trimmed.replace(/\\/$/u, '');\n  return clean.split('/').filter(Boolean).pop() ?? clean;\n}\n\nfunction isTruthy(value: unknown): boolean {\n  return value === true || value === 'true' || value === 1 || value === '1';\n}\n\nfunction timestamp(value: unknown): number {\n  if (value instanceof Date) return value.getTime();\n  if (typeof value === 'number' && Number.isFinite(value)) return value;\n  if (typeof value === 'string' && value.trim()) {\n    const parsed = Date.parse(value);\n    return Number.isFinite(parsed) ? parsed : 0;\n  }\n  return 0;\n}\n\nfunction credentialMetadata(credential: any): Record<string, unknown> | undefined {\n  const metadata: Record<string, unknown> = {};\n  if (typeof credential.projectId === 'string' && credential.projectId) metadata.projectId = credential.projectId;\n  if (typeof credential.organizationId === 'string' && credential.organizationId) metadata.organizationId = credential.organizationId;\n  return Object.keys(metadata).length > 0 ? metadata : undefined;\n}\n"]}

package/dist/extensions/index.d.ts

@@ -0,0 +1,3 @@
+export * from './types';
+export * from './PodCredentialResolver';
+export * from './ExtensionRuntime';

package/dist/extensions/index.js

@@ -0,0 +1,20 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./types"), exports);
+__exportStar(require("./PodCredentialResolver"), exports);
+__exportStar(require("./ExtensionRuntime"), exports);
+//# sourceMappingURL=index.js.map

package/dist/extensions/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/extensions/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,0CAAwB;AACxB,0DAAwC;AACxC,qDAAmC","sourcesContent":["export * from './types';\nexport * from './PodCredentialResolver';\nexport * from './ExtensionRuntime';\n"]}

package/dist/extensions/types.d.ts

@@ -0,0 +1,73 @@
+import type { ReadResult } from '@undefineds.co/extensions';
+export type ExtensionFetch = (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
+export type ExtensionCapability = 'chat' | 'embedding' | 'reader' | string;
+export type ModelUri = string;
+export type CredentialUri = string;
+export type SourceUri = string;
+export interface ExtensionEvent {
+    type: 'extension.completed' | 'extension.failed';
+    capability: ExtensionCapability;
+    provider?: string;
+    model?: string;
+    latencyMs?: number;
+    usage?: Record<string, unknown>;
+    error?: string;
+}
+export interface ExtensionContext {
+    webId: string;
+    podBaseUrl: string;
+    fetch: ExtensionFetch;
+    signal?: AbortSignal;
+    emit?: (event: ExtensionEvent) => void;
+}
+export interface CredentialResolveInput {
+    provider: string;
+    credentialId?: string;
+    service?: string;
+    capability?: string;
+    /** Durable model resource URI/IRI that selected this provider. */
+    model?: ModelUri;
+}
+export interface ResolvedCredential {
+    provider: string;
+    credentialId?: string;
+    service?: string;
+    capability?: string;
+    apiKey?: string;
+    accessToken?: string;
+    refreshToken?: string;
+    expiresAt?: string | Date;
+    baseUrl?: string;
+    proxyUrl?: string;
+    metadata?: Record<string, unknown>;
+}
+export interface CredentialResolver {
+    resolve(input: CredentialResolveInput, context: ExtensionContext): Promise<ResolvedCredential | null>;
+}
+export interface ExtensionReadInput {
+    /** Durable Model URI/IRI. Provider and provider-native model id are derived from this. */
+    model: ModelUri;
+    /** Optional durable Credential URI/IRI. If omitted, resolver chooses provider default. */
+    credential?: CredentialUri;
+    /** Source URI. Metadata is resolved by source/host layers, not supplied as the primary API. */
+    source: SourceUri;
+    output?: 'text' | 'markdown' | 'structured';
+    pages?: string;
+    options?: Record<string, unknown>;
+    signal?: AbortSignal;
+}
+export interface ExtensionEmbedInput {
+    /** Durable Model URI/IRI. Provider and provider-native model id are derived from this. */
+    model: ModelUri;
+    /** Optional durable Credential URI/IRI. If omitted, resolver chooses provider default. */
+    credential?: CredentialUri;
+    texts: string[];
+}
+export interface ExtensionEmbedResult {
+    vectors: number[][];
+    usage?: Record<string, unknown>;
+}
+export interface ExtensionRuntime {
+    read(context: ExtensionContext, input: ExtensionReadInput): Promise<ReadResult>;
+    embed(context: ExtensionContext, input: ExtensionEmbedInput): Promise<ExtensionEmbedResult>;
+}

package/dist/extensions/types.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=types.js.map

package/dist/extensions/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/extensions/types.ts"],"names":[],"mappings":"","sourcesContent":["import type { ReadResult } from '@undefineds.co/extensions';\n\nexport type ExtensionFetch = (input: string | URL | Request, init?: RequestInit) => Promise<Response>;\n\nexport type ExtensionCapability = 'chat' | 'embedding' | 'reader' | string;\nexport type ModelUri = string;\nexport type CredentialUri = string;\nexport type SourceUri = string;\n\nexport interface ExtensionEvent {\n  type: 'extension.completed' | 'extension.failed';\n  capability: ExtensionCapability;\n  provider?: string;\n  model?: string;\n  latencyMs?: number;\n  usage?: Record<string, unknown>;\n  error?: string;\n}\n\nexport interface ExtensionContext {\n  webId: string;\n  podBaseUrl: string;\n  fetch: ExtensionFetch;\n  signal?: AbortSignal;\n  emit?: (event: ExtensionEvent) => void;\n}\n\nexport interface CredentialResolveInput {\n  provider: string;\n  credentialId?: string;\n  service?: string;\n  capability?: string;\n  /** Durable model resource URI/IRI that selected this provider. */\n  model?: ModelUri;\n}\n\nexport interface ResolvedCredential {\n  provider: string;\n  credentialId?: string;\n  service?: string;\n  capability?: string;\n  apiKey?: string;\n  accessToken?: string;\n  refreshToken?: string;\n  expiresAt?: string | Date;\n  baseUrl?: string;\n  proxyUrl?: string;\n  metadata?: Record<string, unknown>;\n}\n\nexport interface CredentialResolver {\n  resolve(input: CredentialResolveInput, context: ExtensionContext): Promise<ResolvedCredential | null>;\n}\n\nexport interface ExtensionReadInput {\n  /** Durable Model URI/IRI. Provider and provider-native model id are derived from this. */\n  model: ModelUri;\n  /** Optional durable Credential URI/IRI. If omitted, resolver chooses provider default. */\n  credential?: CredentialUri;\n  /** Source URI. Metadata is resolved by source/host layers, not supplied as the primary API. */\n  source: SourceUri;\n  output?: 'text' | 'markdown' | 'structured';\n  pages?: string;\n  options?: Record<string, unknown>;\n  signal?: AbortSignal;\n}\n\nexport interface ExtensionEmbedInput {\n  /** Durable Model URI/IRI. Provider and provider-native model id are derived from this. */\n  model: ModelUri;\n  /** Optional durable Credential URI/IRI. If omitted, resolver chooses provider default. */\n  credential?: CredentialUri;\n  texts: string[];\n}\n\nexport interface ExtensionEmbedResult {\n  vectors: number[][];\n  usage?: Record<string, unknown>;\n}\n\nexport interface ExtensionRuntime {\n  read(context: ExtensionContext, input: ExtensionReadInput): Promise<ReadResult>;\n  embed(context: ExtensionContext, input: ExtensionEmbedInput): Promise<ExtensionEmbedResult>;\n}\n"]}

package/dist/http/SubgraphSparqlHttpHandler.d.ts

@@ -2,6 +2,7 @@ import { HttpHandler } from '@solid/community-server';
 import type { HttpHandlerInput } from '@solid/community-server';
 import type { CredentialsExtractor, PermissionReader, Authorizer } from '@solid/community-server';
 import { SubgraphQueryEngine } from '../storage/sparql/SubgraphQueryEngine';
+import { MixDataAccessor } from '../storage/accessors/MixDataAccessor';
 interface SubgraphSparqlHttpHandlerOptions {
     /** @deprecated Use sidecarPath instead */
     resourceSuffix?: string;
@@ -23,12 +24,14 @@ export declare class SubgraphSparqlHttpHandler extends HttpHandler {
     private readonly podLookup?;
     private readonly usageRepo?;
     private readonly defaultBandwidthLimit?;
+    private readonly updateAuthority?;
     private readonly generator;
     private static readonly XSD_STRING;
-    constructor(queryEngine: SubgraphQueryEngine, credentialsExtractor: CredentialsExtractor, permissionReader: PermissionReader, authorizer: Authorizer, options?: SubgraphSparqlHttpHandlerOptions);
+    constructor(queryEngine: SubgraphQueryEngine, credentialsExtractor: CredentialsExtractor, permissionReader: PermissionReader, authorizer: Authorizer, options?: SubgraphSparqlHttpHandlerOptions, updateAuthority?: MixDataAccessor);
     canHandle({ request }: HttpHandlerInput): Promise<void>;
     handle({ request, response }: HttpHandlerInput): Promise<void>;
     private sendErrorResponse;
+    private acceptsJson;
     private executeSelect;
     private executeAsk;
     private executeConstruct;
@@ -41,12 +44,23 @@ export declare class SubgraphSparqlHttpHandler extends HttpHandler {
     private recordBandwidth;
     private normalizeLimit;
     private normalizeBandwidthDelta;
+    private resolveReadAccessScope;
+    private resolveReadAccessScopeForCredentials;
     private authorizeFor;
+    private canAuthorizeFor;
+    private authorizeIdentifier;
     private inspectUpdateGraphs;
     private inspectQuads;
     private inspectPatterns;
     private assertGraphInScope;
     private assertGraphTermInScope;
+    private addWriteTarget;
+    private readLoadDocument;
+    private rewriteLoadUpdate;
+    private rewriteLoadedDocumentUpdate;
+    private rewriteClearGraphUpdate;
+    private rewriteGraphCopyUpdate;
+    private resourceUrlForGraphValue;
     /**
      * Rewrites INSERT/DELETE/INSERT+DELETE that target the default graph (or BGP without GRAPH)
      * so they write to the resource graph (graphIri).
@@ -65,6 +79,11 @@ export declare class SubgraphSparqlHttpHandler extends HttpHandler {
     private static literalToNQuads;
     private static escapeLiteral;
     private isInsertDeleteOperation;
+    private isLoadOperation;
+    private isClearGraphOperation;
+    private isDropGraphOperation;
+    private isGraphCopyOperation;
+    private isCreateGraphOperation;
     private getRequestId;
     private isSqliteUrl;
 }