@undefineds.co/xpod 0.3.57 → 0.3.61

package/dist/api/ai-gateway/connect/index.js

@@ -0,0 +1,1061 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ProviderConnectService = exports.DeepSeekConnectAdapter = exports.KimiDeviceCodeConnectAdapter = exports.BrowserAssistedApiKeyConnectAdapter = exports.InMemoryConnectAttemptStore = exports.PodConnectedCredentialRepository = void 0;
+const node_crypto_1 = require("node:crypto");
+const drizzle_solid_1 = require("@undefineds.co/drizzle-solid");
+const models_1 = require("@undefineds.co/models");
+const ProviderRegistry_1 = require("../providers/ProviderRegistry");
+class PodConnectedCredentialRepository {
+    constructor(options = {}) {
+        this.internalPodAccess = options.internalPodAccess;
+        this.providerIds = options.providerIds
+            ?? ProviderRegistry_1.DEFAULT_PROVIDER_DESCRIPTORS.map((provider) => provider.id);
+        this.dbFactory = options.dbFactory ?? createDefaultConnectedCredentialDb;
+        this.credentialTemplate = (0, drizzle_solid_1.alias)(models_1.credentialResource, 'credentialTemplate');
+        this.aiProviderTemplate = (0, drizzle_solid_1.alias)(models_1.aiProviderResource, 'aiProviderTemplate');
+    }
+    async getCredential(input) {
+        const { db, credential } = await this.dbForOwner(input.webId, input.auth);
+        const id = models_1.aiRuntimeRepository.credentialId(input);
+        const row = await db.findById(credential, id);
+        const record = row ? recordFromCredentialRow(row) : undefined;
+        if (!record) {
+            return undefined;
+        }
+        return record;
+    }
+    async getActiveCredential(input) {
+        const record = await this.getCredential(input);
+        return record?.status === 'active' && !record.reauthRequired ? record : undefined;
+    }
+    async listCredentials(input) {
+        const { db, credential } = await this.dbForOwner(input.webId, input.auth);
+        const rows = (await Promise.all(this.providerIds.map(async (provider) => {
+            try {
+                return await db.findById(credential, models_1.aiRuntimeRepository.credentialId({ deployment: input.deployment, provider }));
+            }
+            catch (error) {
+                if (isPodResourceNotFound(error)) {
+                    return null;
+                }
+                throw error;
+            }
+        }))).filter((row) => row !== null);
+        return rows
+            .map(recordFromCredentialRow)
+            .filter((record) => record.webId === input.webId)
+            .filter((record) => record.deployment === input.deployment)
+            .filter((record) => record.status === 'active')
+            .map((record) => ({
+            id: record.id,
+            credentialIri: record.credentialIri,
+            provider: record.provider,
+            authMode: record.authMode,
+            enabled: !record.reauthRequired,
+            models: modelsFromMetadata(record.metadata),
+            defaultModel: defaultModelFromMetadata(record.metadata),
+            priority: priorityFromMetadata(record.metadata),
+            health: record.reauthRequired ? 'reauthRequired' : 'healthy',
+            quota: { status: 'available' },
+            encryptedSecret: record.encryptedSecret,
+            version: record.version,
+            runtimeCredential: runtimeCredentialFromMetadata(record.metadata),
+            metadata: record.metadata,
+        }));
+    }
+    async upsertConnectedCredential(record, context) {
+        const { db, credential } = await this.dbForOwner(record.webId, context?.auth);
+        const existing = await db.findById(credential, record.id);
+        const existingVersion = existing ? versionFromRow(existing) : 0;
+        if (record.expectedVersion !== undefined && record.expectedVersion !== existingVersion) {
+            throw new Error('credential_version_conflict');
+        }
+        const nextVersion = existingVersion + 1;
+        const row = credentialRowFromRecord({
+            ...record,
+            version: nextVersion,
+        });
+        if (existing) {
+            const updated = await db.updateById(credential, record.id, row);
+            return recordFromCredentialRow(updated ?? row);
+        }
+        await db.insert(credential).values(row).execute();
+        return recordFromCredentialRow(row);
+    }
+    async rewrapCredential(input) {
+        const { db, credential } = await this.dbForOwner(input.webId, input.auth);
+        const existing = await db.findById(credential, input.credentialId);
+        if (!existing) {
+            return false;
+        }
+        const current = recordFromCredentialRow(existing);
+        if (current.webId !== input.webId || current.deployment !== input.deployment) {
+            return false;
+        }
+        const currentVersion = versionFromRow(existing);
+        if (input.expectedVersion === undefined || currentVersion !== input.expectedVersion) {
+            return false;
+        }
+        const updated = await db.update(credential)
+            .set({
+            encryptedSecret: JSON.stringify(input.encryptedSecret),
+            wrappedDataKey: input.encryptedSecret.wrappedDek,
+            encryptionAlgorithm: input.encryptedSecret.algorithm,
+            keyVersion: String(currentVersion + 1),
+        })
+            .where((0, drizzle_solid_1.and)((0, drizzle_solid_1.eq)(credential.id, input.credentialId), (0, drizzle_solid_1.eq)(credential.keyVersion, String(input.expectedVersion))))
+            .returning()
+            .execute();
+        return updated.length === 1;
+    }
+    async markReauthRequired(input) {
+        const { db, credential } = await this.dbForOwner(input.webId, input.auth);
+        const id = models_1.aiRuntimeRepository.credentialId(input);
+        const existing = await db.findById(credential, id);
+        if (!existing) {
+            return undefined;
+        }
+        const existingVersion = versionFromRow(existing);
+        if (input.expectedVersion !== undefined && input.expectedVersion !== existingVersion) {
+            throw new Error('credential_version_conflict');
+        }
+        const updated = await db.updateById(credential, id, {
+            reauthRequired: true,
+            status: 'active',
+            keyVersion: String(existingVersion + 1),
+        });
+        return updated ? recordFromCredentialRow(updated) : undefined;
+    }
+    async disconnect(input) {
+        const { db, credential } = await this.dbForOwner(input.webId, input.auth);
+        const id = models_1.aiRuntimeRepository.credentialId(input);
+        const existing = await db.findById(credential, id);
+        if (!existing) {
+            return undefined;
+        }
+        const updated = await db.updateById(credential, id, {
+            status: 'revoked',
+            keyVersion: String(versionFromRow(existing) + 1),
+        });
+        return updated ? recordFromCredentialRow(updated) : undefined;
+    }
+    async dbForOwner(owner, auth) {
+        const trustedFetch = await this.resolveTrustedFetch(owner);
+        const credential = (0, drizzle_solid_1.alias)(this.credentialTemplate, 'credential');
+        const aiProvider = (0, drizzle_solid_1.alias)(this.aiProviderTemplate, 'aiProvider');
+        const db = await this.dbFactory({ owner, auth, fetch: trustedFetch, credential, aiProvider });
+        await db.init?.(credential, aiProvider);
+        return { db, credential };
+    }
+    async resolveTrustedFetch(owner) {
+        const trustedFetch = await this.internalPodAccess?.getTrustedFetch(owner);
+        if (!trustedFetch) {
+            throw new Error('AI Connection service identity is not configured');
+        }
+        return async (input, init) => {
+            const response = await trustedFetch(input, init);
+            if (response.status === 403) {
+                throw new Error('service_access_missing');
+            }
+            return response;
+        };
+    }
+}
+exports.PodConnectedCredentialRepository = PodConnectedCredentialRepository;
+class InMemoryConnectAttemptStore {
+    constructor() {
+        this.attempts = new Map();
+        this.maxAttempts = 1_000;
+    }
+    async create(attempt) {
+        this.pruneExpired(new Date());
+        this.attempts.set(attempt.id, cloneAttempt(attempt));
+        this.pruneBounded();
+        return cloneAttempt(attempt);
+    }
+    async get(id, now) {
+        this.pruneExpired(now ?? new Date(), id);
+        const attempt = this.attempts.get(id);
+        if (attempt && now && attempt.expiresAt.getTime() <= now.getTime()) {
+            this.attempts.delete(id);
+        }
+        return attempt ? cloneAttempt(attempt) : undefined;
+    }
+    async consume(id, now) {
+        this.pruneExpired(now, id);
+        const attempt = this.attempts.get(id);
+        if (!attempt) {
+            throw new Error('Connect attempt not found');
+        }
+        if (attempt.consumedAt) {
+            throw new Error('Connect attempt already consumed');
+        }
+        if (attempt.expiresAt.getTime() <= now.getTime()) {
+            this.attempts.delete(id);
+            throw new Error('Connect attempt expired');
+        }
+        attempt.consumedAt = new Date(now);
+        return cloneAttempt(attempt);
+    }
+    async claimPoll(id, now) {
+        this.pruneExpired(now, id);
+        const attempt = this.attempts.get(id);
+        if (!attempt) {
+            throw new Error('Connect attempt not found');
+        }
+        if (attempt.consumedAt) {
+            throw new Error('Connect attempt already consumed');
+        }
+        if (attempt.expiresAt.getTime() <= now.getTime()) {
+            this.attempts.delete(id);
+            throw new Error('Connect attempt expired');
+        }
+        if (attempt.nextPollAt && attempt.nextPollAt.getTime() > now.getTime()) {
+            return { attempt: cloneAttempt(attempt), claimed: false };
+        }
+        if (attempt.pollClaimedAt) {
+            return { attempt: cloneAttempt(attempt), claimed: false };
+        }
+        attempt.pollClaimedAt = new Date(now);
+        return { attempt: cloneAttempt(attempt), claimed: true };
+    }
+    async updatePollSchedule(id, patch) {
+        const attempt = this.attempts.get(id);
+        if (!attempt || attempt.consumedAt) {
+            return undefined;
+        }
+        attempt.intervalSeconds = patch.intervalSeconds;
+        attempt.currentPollIntervalSeconds = patch.intervalSeconds;
+        attempt.nextPollAt = new Date(patch.nextPollAt);
+        attempt.lastPollStatus = patch.lastPollStatus;
+        attempt.pollClaimedAt = undefined;
+        return cloneAttempt(attempt);
+    }
+    async releasePollClaim(id) {
+        const attempt = this.attempts.get(id);
+        if (attempt) {
+            attempt.pollClaimedAt = undefined;
+        }
+    }
+    pruneExpired(now, exceptId) {
+        for (const [id, attempt] of this.attempts) {
+            if (id !== exceptId && attempt.expiresAt.getTime() <= now.getTime()) {
+                this.attempts.delete(id);
+            }
+        }
+    }
+    pruneBounded() {
+        while (this.attempts.size > this.maxAttempts) {
+            const oldest = this.attempts.keys().next().value;
+            if (typeof oldest !== 'string') {
+                return;
+            }
+            this.attempts.delete(oldest);
+        }
+    }
+}
+exports.InMemoryConnectAttemptStore = InMemoryConnectAttemptStore;
+class BrowserAssistedApiKeyConnectAdapter {
+    constructor(options) {
+        this.provider = normalizeProvider(options.provider);
+        this.consoleUrl = options.consoleUrl;
+        this.attempts = options.attempts;
+        this.credentialRepository = options.credentialRepository;
+        this.vault = options.vault;
+        this.deployment = options.deployment;
+        this.now = options.now ?? (() => new Date());
+        this.randomBytes = options.randomBytes ?? node_crypto_1.randomBytes;
+        this.signingSecret = options.signingSecret;
+    }
+    async begin(input) {
+        this.assertInput(input, 'browserAssistedApiKey');
+        const now = this.now();
+        const expiresAt = new Date(now.getTime() + 5 * 60 * 1000);
+        const attempt = await this.createAttempt(input, expiresAt);
+        const url = new URL(this.consoleUrl);
+        url.searchParams.set('xpod_connect_attempt', attempt.id);
+        url.searchParams.set('xpod_provider', this.provider);
+        return {
+            mode: 'browserAssistedApiKey',
+            status: 'pending',
+            provider: this.provider,
+            deployment: this.deployment,
+            attemptId: attempt.id,
+            state: attempt.state,
+            signature: attempt.signature,
+            expiresAt: expiresAt.toISOString(),
+            authorizationUrl: url.toString(),
+        };
+    }
+    async completeApiKey(input) {
+        if (!input.apiKey.trim()) {
+            throw new Error('API key is required');
+        }
+        const attempt = await this.loadConsumableAttempt(input, 'browserAssistedApiKey');
+        const consumed = await this.attempts.consume(input.attemptId, this.now());
+        const credentialIri = models_1.aiRuntimeRepository.credentialIri(input.webId, {
+            deployment: input.deployment,
+            provider: this.provider,
+        });
+        const encryptedSecret = await this.vault.seal(principal(input.webId), credentialIri, this.provider, { type: 'apiKey', apiKey: input.apiKey });
+        const record = await this.credentialRepository.upsertConnectedCredential({
+            id: models_1.aiRuntimeRepository.credentialId({ deployment: input.deployment, provider: this.provider }),
+            credentialIri,
+            webId: input.webId,
+            provider: this.provider,
+            deployment: input.deployment,
+            authMode: 'apiKey',
+            encryptedSecret,
+            status: 'active',
+            accountLabel: input.accountLabel,
+            expectedVersion: consumed.expectedCredentialVersion,
+        }, { auth: input.auth });
+        return {
+            mode: 'browserAssistedApiKey',
+            status: 'completed',
+            provider: this.provider,
+            deployment: input.deployment,
+            attemptId: attempt.id,
+            credentialId: record.id,
+        };
+    }
+    async status(input) {
+        const attempt = await this.loadAttemptForStatus(input, 'browserAssistedApiKey');
+        return {
+            mode: attempt.mode,
+            status: this.statusForAttempt(attempt),
+            provider: this.provider,
+            deployment: input.deployment,
+            attemptId: attempt.id,
+            expiresAt: attempt.expiresAt.toISOString(),
+        };
+    }
+    async disconnect(input) {
+        return this.credentialRepository.disconnect({
+            webId: input.webId,
+            provider: this.provider,
+            deployment: input.deployment,
+            auth: input.auth,
+        });
+    }
+    async createAttempt(input, expiresAt, extra = {}) {
+        const attemptWithoutSignature = {
+            id: token(this.randomBytes),
+            provider: this.provider,
+            deployment: input.deployment,
+            webId: input.webId,
+            mode: input.requestedMode,
+            state: token(this.randomBytes),
+            expiresAt,
+            expectedCredentialVersion: input.expectedCredentialVersion,
+            ...extra,
+        };
+        const signature = signAttempt(attemptWithoutSignature, this.signingSecret);
+        return this.attempts.create({ ...attemptWithoutSignature, signature });
+    }
+    async loadAttemptForStatus(input, mode) {
+        const attempt = await this.attempts.get(input.attemptId, this.now());
+        if (!attempt) {
+            throw new Error('Connect attempt not found');
+        }
+        if (attempt.webId !== input.webId) {
+            throw new Error('Connect attempt is bound to a different WebID');
+        }
+        if (attempt.deployment !== input.deployment) {
+            throw new Error('Connect attempt is bound to a different deployment');
+        }
+        if (attempt.provider !== normalizeProvider(input.provider)) {
+            throw new Error('Connect attempt is bound to a different provider');
+        }
+        if (attempt.mode !== mode) {
+            throw new Error('Connect attempt mode mismatch');
+        }
+        if (attempt.state !== input.state) {
+            throw new Error('Invalid Connect attempt state');
+        }
+        if (!signatureMatches(input.signature, signAttempt(attempt, this.signingSecret))) {
+            throw new Error('Invalid Connect attempt signature');
+        }
+        return attempt;
+    }
+    async loadConsumableAttempt(input, mode) {
+        const attempt = await this.loadAttemptForStatus(input, mode);
+        if (attempt.expiresAt.getTime() <= this.now().getTime()) {
+            throw new Error('Connect attempt expired');
+        }
+        if (attempt.consumedAt) {
+            throw new Error('Connect attempt already consumed');
+        }
+        return attempt;
+    }
+    statusForAttempt(attempt) {
+        if (attempt.expiresAt.getTime() <= this.now().getTime()) {
+            return 'expired';
+        }
+        return attempt.consumedAt ? 'completed' : 'pending';
+    }
+    assertInput(input, mode) {
+        if (normalizeProvider(input.provider) !== this.provider) {
+            throw new Error('Connect provider mismatch');
+        }
+        if (input.deployment !== this.deployment) {
+            throw new Error('Connect deployment mismatch');
+        }
+        if (input.requestedMode !== mode) {
+            throw new Error('Unsupported Connect mode');
+        }
+        if (!input.webId) {
+            throw new Error('Connect WebID is required');
+        }
+    }
+}
+exports.BrowserAssistedApiKeyConnectAdapter = BrowserAssistedApiKeyConnectAdapter;
+class KimiDeviceCodeConnectAdapter extends BrowserAssistedApiKeyConnectAdapter {
+    constructor(options) {
+        super({
+            ...options,
+            provider: 'kimi',
+            consoleUrl: 'https://kimi.moonshot.cn/device',
+        });
+        this.fetchImpl = options.fetch ?? fetch;
+        this.clientId = options.clientId;
+        this.deviceAuthorizationEndpoint = options.deviceAuthorizationEndpoint ?? 'https://auth.kimi.com/api/oauth/device_authorization';
+        this.tokenEndpoint = options.tokenEndpoint ?? 'https://auth.kimi.com/api/oauth/token';
+        assertKimiEndpoint(this.deviceAuthorizationEndpoint, '/api/oauth/device_authorization');
+        assertKimiEndpoint(this.tokenEndpoint, '/api/oauth/token');
+    }
+    async begin(input) {
+        this.assertInput(input, 'deviceCodeOAuth');
+        const now = this.now();
+        const verifier = token(this.randomBytes);
+        const challenge = codeChallenge(verifier);
+        const response = await this.fetchImpl(this.deviceAuthorizationEndpoint, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            body: new URLSearchParams({
+                client_id: this.clientId,
+                code_challenge: challenge,
+                code_challenge_method: 'S256',
+            }),
+        });
+        const body = await safeJson(response);
+        if (!response.ok) {
+            throw new Error(`Kimi device authorization failed: ${safeProviderError(body)}`);
+        }
+        requireStringField(body, 'device_code');
+        requireStringField(body, 'user_code');
+        requireStringField(body, 'verification_uri_complete');
+        const expiresIn = numberFrom(body.expires_in, 300);
+        const attempt = await this.createAttempt(input, new Date(now.getTime() + expiresIn * 1000), {
+            mode: 'deviceCodeOAuth',
+            codeVerifier: verifier,
+            deviceCode: stringFrom(body.device_code),
+            intervalSeconds: numberFrom(body.interval, 5),
+            currentPollIntervalSeconds: numberFrom(body.interval, 5),
+            nextPollAt: new Date(now.getTime() + numberFrom(body.interval, 5) * 1000),
+        });
+        return {
+            mode: 'deviceCodeOAuth',
+            status: 'pending',
+            provider: 'kimi',
+            deployment: input.deployment,
+            attemptId: attempt.id,
+            state: attempt.state,
+            signature: attempt.signature,
+            expiresAt: attempt.expiresAt.toISOString(),
+            pkceChallenge: challenge,
+            deviceCode: attempt.deviceCode,
+            userCode: stringFrom(body.user_code),
+            verificationUri: stringFrom(body.verification_uri),
+            verificationUriComplete: stringFrom(body.verification_uri_complete),
+            intervalSeconds: attempt.intervalSeconds,
+        };
+    }
+    async pollDevice(input) {
+        const attempt = await this.loadConsumableAttempt(input, 'deviceCodeOAuth');
+        const now = this.nowForConsume();
+        const claim = await this.attempts.claimPoll(input.attemptId, now);
+        if (!claim.claimed) {
+            return pendingResult(input, claim.attempt.lastPollStatus === 'slow_down' ? 'slow_down' : 'authorization_pending', claim.attempt.currentPollIntervalSeconds ?? claim.attempt.intervalSeconds);
+        }
+        try {
+            const response = await this.fetchImpl(this.tokenEndpoint, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+                body: new URLSearchParams({
+                    grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
+                    device_code: attempt.deviceCode ?? '',
+                    client_id: this.clientId,
+                    code_verifier: attempt.codeVerifier ?? '',
+                }),
+            });
+            const body = await safeJson(response);
+            if (!response.ok) {
+                if (body.error === 'authorization_pending' || body.error === 'slow_down') {
+                    const status = body.error;
+                    const intervalSeconds = status === 'slow_down'
+                        ? (attempt.currentPollIntervalSeconds ?? attempt.intervalSeconds ?? 5) + 5
+                        : (attempt.currentPollIntervalSeconds ?? attempt.intervalSeconds ?? 5);
+                    await this.attempts.updatePollSchedule(input.attemptId, {
+                        intervalSeconds,
+                        nextPollAt: new Date(now.getTime() + intervalSeconds * 1000),
+                        lastPollStatus: status,
+                    });
+                    return pendingResult(input, status, intervalSeconds);
+                }
+                if (body.error === 'expired_token') {
+                    await this.attempts.consume(input.attemptId, this.nowForConsume());
+                    return pendingResult(input, 'expired');
+                }
+                throw new Error(`Kimi device token failed: ${safeProviderError(body)}`);
+            }
+            await this.attempts.consume(input.attemptId, this.nowForConsume());
+            requireStringField(body, 'access_token');
+            requireStringField(body, 'refresh_token');
+            const record = await this.storeOAuthCredential(input, body, attempt.expectedCredentialVersion);
+            return {
+                mode: 'deviceCodeOAuth',
+                status: 'completed',
+                provider: 'kimi',
+                deployment: input.deployment,
+                attemptId: input.attemptId,
+                credentialId: record.id,
+            };
+        }
+        catch (error) {
+            await this.attempts.releasePollClaim(input.attemptId);
+            throw error;
+        }
+    }
+    async status(input) {
+        const attempt = await this.loadAttemptForStatus(input, 'deviceCodeOAuth');
+        return {
+            mode: 'deviceCodeOAuth',
+            status: this.statusForAttempt(attempt),
+            provider: 'kimi',
+            deployment: input.deployment,
+            attemptId: attempt.id,
+            expiresAt: attempt.expiresAt.toISOString(),
+            deviceCode: attempt.deviceCode,
+            intervalSeconds: attempt.currentPollIntervalSeconds ?? attempt.intervalSeconds,
+        };
+    }
+    async refresh(input, current, secret) {
+        const refreshToken = stringFrom(secret.refreshToken);
+        if (!refreshToken) {
+            return this.credentialRepository.markReauthRequired({
+                webId: input.webId,
+                provider: 'kimi',
+                deployment: input.deployment,
+                reason: 'missing_refresh_token',
+                expectedVersion: current.version,
+                auth: input.auth,
+            });
+        }
+        const response = await this.fetchImpl(this.tokenEndpoint, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            body: new URLSearchParams({
+                grant_type: 'refresh_token',
+                refresh_token: refreshToken,
+                client_id: this.clientId,
+            }),
+        });
+        const body = await safeJson(response);
+        if (!response.ok) {
+            return this.credentialRepository.markReauthRequired({
+                webId: input.webId,
+                provider: 'kimi',
+                deployment: input.deployment,
+                reason: safeProviderError(body),
+                expectedVersion: current.version,
+                auth: input.auth,
+            });
+        }
+        requireStringField(body, 'access_token');
+        requireStringField(body, 'refresh_token');
+        return this.storeOAuthCredential(input, body, current.version);
+    }
+    async disconnect(input) {
+        return this.credentialRepository.disconnect({
+            webId: input.webId,
+            provider: 'kimi',
+            deployment: input.deployment,
+            auth: input.auth,
+        });
+    }
+    nowForConsume() {
+        return this.now();
+    }
+    async storeOAuthCredential(input, body, expectedVersion) {
+        const credentialIri = models_1.aiRuntimeRepository.credentialIri(input.webId, {
+            deployment: input.deployment,
+            provider: 'kimi',
+        });
+        const expiresAt = expiresAtFrom(body.expires_in, this.now());
+        const secret = {
+            type: 'deviceCodeOAuth',
+            accessToken: stringFrom(body.access_token),
+            refreshToken: stringFrom(body.refresh_token),
+            expiresAt: expiresAt?.toISOString(),
+            scope: stringFrom(body.scope),
+            idToken: stringFrom(body.id_token),
+        };
+        const encryptedSecret = await this.vault.seal(principal(input.webId), credentialIri, 'kimi', secret);
+        return this.credentialRepository.upsertConnectedCredential({
+            id: models_1.aiRuntimeRepository.credentialId({ deployment: input.deployment, provider: 'kimi' }),
+            credentialIri,
+            webId: input.webId,
+            provider: 'kimi',
+            deployment: input.deployment,
+            authMode: 'deviceCodeOAuth',
+            encryptedSecret,
+            status: 'active',
+            expiresAt,
+            expectedVersion,
+            metadata: {
+                authoritativeSubject: decodeJwtSubject(stringFrom(body.id_token)),
+            },
+        }, { auth: input.auth });
+    }
+}
+exports.KimiDeviceCodeConnectAdapter = KimiDeviceCodeConnectAdapter;
+class DeepSeekConnectAdapter {
+    constructor() {
+        this.provider = 'deepseek';
+    }
+    async begin(input) {
+        if (normalizeProvider(input.provider) !== this.provider) {
+            throw new Error('Connect provider mismatch');
+        }
+        return {
+            mode: 'connectUnsupported',
+            status: 'unsupported',
+            provider: 'deepseek',
+            deployment: input.deployment,
+            apiKeyManagementSupported: true,
+            message: 'DeepSeek does not expose a supported third-party browser Connect flow; use authenticated API key management.',
+        };
+    }
+}
+exports.DeepSeekConnectAdapter = DeepSeekConnectAdapter;
+class ProviderConnectService {
+    constructor(options) {
+        this.adapters = new Map();
+        this.registry = options.registry;
+        this.credentialRepository = options.credentialRepository;
+        this.vault = options.vault;
+        for (const adapter of options.adapters) {
+            this.adapters.set(normalizeProvider(adapter.provider), adapter);
+        }
+    }
+    begin(input) {
+        const descriptor = this.registry.requireProvider(input.provider);
+        if (descriptor.connect?.mode !== input.requestedMode) {
+            throw new Error('Requested Connect mode does not match provider capability');
+        }
+        if (descriptor.connect?.configured === false) {
+            return Promise.resolve({
+                mode: descriptor.connect.mode,
+                status: 'unsupported',
+                provider: normalizeProvider(input.provider),
+                deployment: input.deployment,
+                apiKeyManagementSupported: descriptor.connect.apiKeyManagementSupported,
+                message: descriptor.connect.notes?.join(' '),
+            });
+        }
+        return this.requireAdapter(input.provider).begin(input);
+    }
+    async listProviders(input) {
+        return Promise.all(this.registry.listProviders().map(async (descriptor) => {
+            const credential = this.credentialRepository?.getCredential
+                ? await this.credentialRepository.getCredential({
+                    ...input,
+                    provider: descriptor.id,
+                })
+                : await this.credentialRepository?.getActiveCredential({
+                    ...input,
+                    provider: descriptor.id,
+                });
+            const active = credential?.status === 'active';
+            const reauthRequired = active && credential.reauthRequired === true;
+            const modes = Array.from(new Set([
+                ...descriptor.authModes.filter((mode) => mode !== 'connectUnsupported'),
+                ...(descriptor.connect?.apiKeyManagementSupported ? ['apiKey'] : []),
+            ]));
+            return {
+                provider: descriptor.id,
+                status: reauthRequired
+                    ? 'reauthRequired'
+                    : active
+                        ? 'connected'
+                        : 'disconnected',
+                authMode: active ? credential.authMode : undefined,
+                accountLabel: active ? credential.accountLabel : undefined,
+                expiresAt: active ? credential.expiresAt?.toISOString() : undefined,
+                reauthRequired: reauthRequired || undefined,
+                credentialIri: active ? credential.credentialIri : undefined,
+                version: active ? credential.version : undefined,
+                connect: {
+                    modes,
+                    configured: descriptor.connect?.configured !== false,
+                    message: descriptor.connect?.notes?.join(' ') || undefined,
+                },
+            };
+        }));
+    }
+    completeApiKey(input) {
+        const adapter = this.requireAdapter(input.provider);
+        if (!adapter.completeApiKey) {
+            throw new Error('Provider does not support API key Connect completion');
+        }
+        return adapter.completeApiKey(input);
+    }
+    pollDevice(input) {
+        const adapter = this.requireAdapter(input.provider);
+        if (!adapter.pollDevice) {
+            throw new Error('Provider does not support device-code polling');
+        }
+        return adapter.pollDevice(input);
+    }
+    status(input) {
+        const adapter = this.requireAdapter(input.provider);
+        if (!adapter.status) {
+            throw new Error('Provider does not support Connect status');
+        }
+        return adapter.status(input);
+    }
+    refresh(input) {
+        return this.refreshWithRetry(input, 2);
+    }
+    async refreshWithRetry(input, remainingAttempts) {
+        const adapter = this.requireAdapter(input.provider);
+        if (!adapter.refresh) {
+            throw new Error('Provider does not support refresh');
+        }
+        if (!this.credentialRepository || !this.vault) {
+            throw new Error('CredentialVault and PodCredentialRepository are required for provider refresh');
+        }
+        const current = await this.credentialRepository.getActiveCredential(input);
+        if (!current) {
+            throw new Error('Active provider credential not found');
+        }
+        const secret = await this.vault.open({ webId: input.webId }, current.credentialIri, normalizeProvider(input.provider), current.encryptedSecret);
+        try {
+            return await adapter.refresh(input, current, secret);
+        }
+        catch (error) {
+            if (remainingAttempts > 0 && isVersionConflict(error)) {
+                const latest = await this.credentialRepository.getActiveCredential(input);
+                if (latest && latest.version !== current.version && !latest.reauthRequired) {
+                    return latest;
+                }
+                return this.refreshWithRetry(input, remainingAttempts - 1);
+            }
+            throw error;
+        }
+    }
+    disconnect(input) {
+        const adapter = this.requireAdapter(input.provider);
+        if (!adapter.disconnect) {
+            throw new Error('Provider does not support disconnect');
+        }
+        return adapter.disconnect(input);
+    }
+    requireAdapter(provider) {
+        const adapter = this.adapters.get(normalizeProvider(provider));
+        if (!adapter) {
+            throw new Error(`No Connect adapter registered for ${provider}`);
+        }
+        return adapter;
+    }
+}
+exports.ProviderConnectService = ProviderConnectService;
+function token(randomBytes) {
+    return randomBytes(32).toString('base64url');
+}
+function createDefaultConnectedCredentialDb(input) {
+    const credential = input.credential ?? models_1.credentialResource;
+    const aiProvider = input.aiProvider ?? models_1.aiProviderResource;
+    return Promise.resolve((0, drizzle_solid_1.drizzle)({
+        fetch: input.fetch,
+        info: { webId: input.owner, isLoggedIn: true },
+    }, {
+        schema: {
+            credential,
+            aiProvider,
+        },
+    }));
+}
+function credentialRowFromRecord(record) {
+    return {
+        id: record.id,
+        provider: models_1.aiProviderResource.buildId({ id: normalizeProvider(record.provider) }),
+        service: 'ai',
+        authMode: record.authMode,
+        status: record.status,
+        encryptedSecret: JSON.stringify(record.encryptedSecret),
+        wrappedDataKey: record.encryptedSecret.wrappedDek,
+        encryptionAlgorithm: record.encryptedSecret.algorithm,
+        keyVersion: String(record.version ?? 1),
+        scopes: record.scopes ?? [],
+        expiresAt: record.expiresAt,
+        accountLabel: record.accountLabel,
+        label: record.accountLabel,
+        reauthRequired: record.reauthRequired ?? false,
+        lastRefreshAt: new Date(),
+    };
+}
+function recordFromCredentialRow(row) {
+    const encrypted = parseEncryptedSecret(row.encryptedSecret);
+    const id = stringFrom(row.id);
+    const provider = providerFromRelation(stringFrom(row.provider))
+        || providerFromCredentialId(id);
+    const deployment = deploymentFromCredentialId(id);
+    const webId = encrypted.webId;
+    return {
+        id,
+        credentialIri: encrypted.credentialIri,
+        webId,
+        provider,
+        deployment,
+        authMode: stringFrom(row.authMode) === 'deviceCodeOAuth' ? 'deviceCodeOAuth' : 'apiKey',
+        encryptedSecret: encrypted,
+        status: stringFrom(row.status) === 'revoked' ? 'revoked' : 'active',
+        accountLabel: stringFrom(row.accountLabel) || stringFrom(row.label) || undefined,
+        expiresAt: dateFrom(row.expiresAt),
+        scopes: Array.isArray(row.scopes) ? row.scopes.map(String) : undefined,
+        version: versionFromRow(row),
+        reauthRequired: row.reauthRequired === true || row.reauthRequired === 'true',
+        metadata: metadataFromRow(row),
+    };
+}
+function providerFromRelation(value) {
+    if (!value) {
+        return undefined;
+    }
+    const withoutFragment = value.split('#', 1)[0] ?? value;
+    const fileName = withoutFragment.split('/').filter(Boolean).at(-1) ?? withoutFragment;
+    const provider = fileName.replace(/\.ttl$/u, '');
+    return provider ? normalizeProvider(provider) : undefined;
+}
+function isPodResourceNotFound(error) {
+    if (!(error instanceof Error)) {
+        return false;
+    }
+    return /\b404\b|not found/i.test(error.message);
+}
+function metadataFromRow(row) {
+    const value = row.metadata;
+    if (!value) {
+        return undefined;
+    }
+    if (typeof value === 'object' && !Array.isArray(value)) {
+        return value;
+    }
+    if (typeof value === 'string') {
+        try {
+            const parsed = JSON.parse(value);
+            return parsed && typeof parsed === 'object' && !Array.isArray(parsed)
+                ? parsed
+                : undefined;
+        }
+        catch {
+            return undefined;
+        }
+    }
+    return undefined;
+}
+function modelsFromMetadata(metadata) {
+    const value = metadata?.models;
+    return Array.isArray(value) ? value.filter((item) => typeof item === 'string') : undefined;
+}
+function defaultModelFromMetadata(metadata) {
+    const value = metadata?.defaultModel;
+    return typeof value === 'string' ? value : undefined;
+}
+function priorityFromMetadata(metadata) {
+    const value = metadata?.priority;
+    return typeof value === 'number' && Number.isFinite(value) ? value : undefined;
+}
+function runtimeCredentialFromMetadata(metadata) {
+    const value = metadata?.runtimeCredential;
+    return value && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : undefined;
+}
+function parseEncryptedSecret(value) {
+    if (typeof value !== 'string' || !value.trim()) {
+        throw new Error('Credential row is missing encrypted secret payload');
+    }
+    const parsed = JSON.parse(value);
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        throw new Error('Credential row encrypted secret payload is invalid');
+    }
+    return parsed;
+}
+function versionFromRow(row) {
+    const value = row.keyVersion;
+    if (typeof value === 'number' && Number.isFinite(value)) {
+        return value;
+    }
+    if (typeof value === 'string' && value.trim()) {
+        const parsed = Number(value);
+        return Number.isFinite(parsed) ? parsed : 0;
+    }
+    return 0;
+}
+function providerFromCredentialId(id) {
+    const match = /\/([^/#]+)\.ttl#/u.exec(id);
+    return match?.[1] ?? '';
+}
+function deploymentFromCredentialId(id) {
+    return id.includes('#cloud-') ? 'cloud' : 'local';
+}
+function dateFrom(value) {
+    if (value instanceof Date) {
+        return value;
+    }
+    if (typeof value === 'string' || typeof value === 'number') {
+        const parsed = new Date(value);
+        return Number.isNaN(parsed.getTime()) ? undefined : parsed;
+    }
+    return undefined;
+}
+function signAttempt(attempt, secret) {
+    return (0, node_crypto_1.createHmac)('sha256', secret)
+        .update(JSON.stringify({
+        id: attempt.id,
+        provider: attempt.provider,
+        deployment: attempt.deployment,
+        webId: attempt.webId,
+        mode: attempt.mode,
+        state: attempt.state,
+        expiresAt: attempt.expiresAt.toISOString(),
+    }))
+        .digest('base64url');
+}
+function signatureMatches(actual, expected) {
+    const actualBuffer = Buffer.from(actual, 'utf8');
+    const expectedBuffer = Buffer.from(expected, 'utf8');
+    return actualBuffer.length === expectedBuffer.length && (0, node_crypto_1.timingSafeEqual)(actualBuffer, expectedBuffer);
+}
+function codeChallenge(verifier) {
+    return (0, node_crypto_1.createHash)('sha256').update(verifier).digest('base64url');
+}
+function principal(webId) {
+    return { webId };
+}
+function cloneAttempt(attempt) {
+    return {
+        ...attempt,
+        expiresAt: new Date(attempt.expiresAt),
+        consumedAt: attempt.consumedAt ? new Date(attempt.consumedAt) : undefined,
+        nextPollAt: attempt.nextPollAt ? new Date(attempt.nextPollAt) : undefined,
+        pollClaimedAt: attempt.pollClaimedAt ? new Date(attempt.pollClaimedAt) : undefined,
+    };
+}
+function normalizeProvider(provider) {
+    return provider.trim().toLowerCase();
+}
+async function safeJson(response) {
+    const text = await response.text();
+    if (!text) {
+        if (response.ok) {
+            throw new Error('Provider returned an empty JSON response');
+        }
+        return {};
+    }
+    try {
+        const parsed = JSON.parse(text);
+        if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+            if (response.ok) {
+                throw new Error('Provider returned a non-object JSON response');
+            }
+            return {};
+        }
+        return parsed;
+    }
+    catch {
+        if (response.ok) {
+            throw new Error('Provider returned invalid JSON');
+        }
+        return {};
+    }
+}
+function stringFrom(value) {
+    return typeof value === 'string' ? value : '';
+}
+function numberFrom(value, fallback) {
+    return typeof value === 'number' && Number.isFinite(value) ? value : fallback;
+}
+function expiresAtFrom(expiresIn, now) {
+    if (typeof expiresIn !== 'number' || !Number.isFinite(expiresIn)) {
+        return undefined;
+    }
+    return new Date(now.getTime() + expiresIn * 1000);
+}
+function safeProviderError(body) {
+    const code = stringFrom(body.error);
+    if (SAFE_PROVIDER_ERROR_CODES.has(code)) {
+        return code;
+    }
+    if (!code) {
+        return 'provider_error';
+    }
+    if (code.endsWith('_error')) {
+        return 'provider_error';
+    }
+    return 'provider_error';
+}
+const SAFE_PROVIDER_ERROR_CODES = new Set([
+    'authorization_pending',
+    'slow_down',
+    'expired_token',
+    'access_denied',
+    'invalid_grant',
+    'invalid_client',
+]);
+function pendingResult(input, status, intervalSeconds) {
+    return {
+        mode: 'deviceCodeOAuth',
+        status,
+        provider: 'kimi',
+        deployment: input.deployment,
+        attemptId: input.attemptId,
+        intervalSeconds,
+    };
+}
+function assertKimiEndpoint(endpoint, pathname) {
+    const url = new URL(endpoint);
+    if (url.origin !== 'https://auth.kimi.com'
+        || url.pathname !== pathname
+        || url.search
+        || url.hash
+        || url.username
+        || url.password) {
+        throw new Error('Kimi Connect endpoint is not allowlisted');
+    }
+}
+function requireStringField(body, field) {
+    if (typeof body[field] !== 'string' || !body[field].trim()) {
+        throw new Error(`Provider response missing required field: ${field}`);
+    }
+}
+function isVersionConflict(error) {
+    return error instanceof Error && /version_conflict|credential_version_conflict/u.test(error.message);
+}
+function decodeJwtSubject(idToken) {
+    const payload = idToken.split('.')[1];
+    if (!payload) {
+        return undefined;
+    }
+    try {
+        const decoded = JSON.parse(Buffer.from(payload, 'base64url').toString('utf8'));
+        return typeof decoded.sub === 'string' ? decoded.sub : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+//# sourceMappingURL=index.js.map