@undefineds.co/xpod 0.3.58 → 0.3.62

package/dist/api/ai-gateway/credentials/SecretCellCredentialVault.js

@@ -0,0 +1,133 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SecretCellCredentialVault = void 0;
+const CredentialVault_1 = require("./CredentialVault");
+const PREDICATE = 'https://undefineds.co/ns#encryptedSecret';
+const FIELD = 'providerCredentialSecret';
+const SCHEMA_VERSION = 'v1';
+class SecretCellCredentialVault {
+    constructor(options) {
+        this.vault = options.vault;
+    }
+    async seal(principal, credentialIri, provider, secret) {
+        let plaintext;
+        try {
+            plaintext = new TextEncoder().encode(JSON.stringify(secret));
+            const envelope = await this.vault.seal(plaintext, secretCellContext(principal.webId, credentialIri, provider));
+            return encryptedRecordFromEnvelope(envelope);
+        }
+        catch {
+            throw new CredentialVault_1.CredentialVaultError('Credential secret could not be encrypted');
+        }
+        finally {
+            plaintext?.fill(0);
+        }
+    }
+    async open(principal, credentialIri, provider, encrypted) {
+        let plaintext;
+        try {
+            assertCredentialContext(principal.webId, credentialIri, provider, encrypted);
+            plaintext = await this.vault.open(envelopeFromEncryptedRecord(encrypted), secretCellContext(principal.webId, credentialIri, provider));
+            const parsed = JSON.parse(new TextDecoder().decode(plaintext));
+            if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+                throw new Error('decrypted credential secret is not an object');
+            }
+            return parsed;
+        }
+        catch {
+            throw new CredentialVault_1.CredentialVaultError();
+        }
+        finally {
+            plaintext?.fill(0);
+        }
+    }
+    async rewrap(principal, encrypted) {
+        try {
+            assertCredentialContext(principal.webId, encrypted.credentialIri, encrypted.provider, encrypted);
+            const envelope = await this.vault.rewrap(envelopeFromEncryptedRecord(encrypted), secretCellContext(principal.webId, encrypted.credentialIri, encrypted.provider));
+            return encryptedRecordFromEnvelope(envelope);
+        }
+        catch {
+            throw new CredentialVault_1.CredentialVaultError('Credential secret could not be rewrapped');
+        }
+    }
+    needsRewrap(encrypted) {
+        return this.vault.needsRewrap(encrypted.keyId);
+    }
+}
+exports.SecretCellCredentialVault = SecretCellCredentialVault;
+function secretCellContext(ownerWebId, resourceIri, provider) {
+    return {
+        ownerWebId,
+        resourceIri,
+        predicate: PREDICATE,
+        field: FIELD,
+        schemaVersion: SCHEMA_VERSION,
+        provider,
+    };
+}
+function assertCredentialContext(webId, credentialIri, provider, encrypted) {
+    if (encrypted.webId !== webId
+        || encrypted.credentialIri !== credentialIri
+        || encrypted.provider !== provider) {
+        throw new Error('credential encryption context mismatch');
+    }
+}
+function encryptedRecordFromEnvelope(envelope) {
+    return {
+        algorithm: envelope.algorithm,
+        aadPurpose: envelope.aadPurpose,
+        aadVersion: envelope.aadVersion,
+        ciphertext: envelope.ciphertext,
+        nonce: envelope.nonce,
+        webId: envelope.context.ownerWebId,
+        credentialIri: envelope.context.resourceIri,
+        provider: envelope.context.provider ?? '',
+        dekWrapAlgorithm: envelope.wrappedDek.algorithm,
+        keyId: envelope.wrappedDek.keyId,
+        wrappedDek: envelope.wrappedDek.ciphertext,
+        metadata: {
+            secretCellWrapNonce: envelope.wrappedDek.nonce,
+            secretCellWrapPurpose: envelope.wrappedDek.aadPurpose,
+            secretCellWrapVersion: envelope.wrappedDek.aadVersion,
+            predicate: envelope.context.predicate,
+            field: envelope.context.field,
+            schemaVersion: envelope.context.schemaVersion,
+        },
+    };
+}
+function envelopeFromEncryptedRecord(encrypted) {
+    const metadata = encrypted.metadata;
+    if (!metadata?.secretCellWrapNonce
+        || !metadata.secretCellWrapPurpose
+        || !metadata.secretCellWrapVersion
+        || !metadata.predicate
+        || !metadata.field
+        || !metadata.schemaVersion) {
+        throw new Error('SecretCell encrypted record metadata is incomplete');
+    }
+    return {
+        algorithm: encrypted.algorithm,
+        aadPurpose: encrypted.aadPurpose,
+        aadVersion: encrypted.aadVersion,
+        context: {
+            ownerWebId: encrypted.webId,
+            resourceIri: encrypted.credentialIri,
+            predicate: metadata.predicate,
+            field: metadata.field,
+            schemaVersion: metadata.schemaVersion,
+            provider: encrypted.provider,
+        },
+        nonce: encrypted.nonce,
+        ciphertext: encrypted.ciphertext,
+        wrappedDek: {
+            algorithm: encrypted.dekWrapAlgorithm,
+            keyId: encrypted.keyId,
+            aadPurpose: metadata.secretCellWrapPurpose,
+            aadVersion: metadata.secretCellWrapVersion,
+            nonce: metadata.secretCellWrapNonce,
+            ciphertext: encrypted.wrappedDek,
+        },
+    };
+}
+//# sourceMappingURL=SecretCellCredentialVault.js.map

package/dist/api/ai-gateway/credentials/SecretCellCredentialVault.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecretCellCredentialVault.js","sourceRoot":"","sources":["../../../../src/api/ai-gateway/credentials/SecretCellCredentialVault.ts"],"names":[],"mappings":";;;AACA,uDAAyD;AASzD,MAAM,SAAS,GAAG,0CAA0C,CAAC;AAC7D,MAAM,KAAK,GAAG,0BAA0B,CAAC;AACzC,MAAM,cAAc,GAAG,IAAI,CAAC;AAE5B,MAAa,yBAAyB;IAGpC,YAAmB,OAAmC;QACpD,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC7B,CAAC;IAEM,KAAK,CAAC,IAAI,CACf,SAA2B,EAC3B,aAAqB,EACrB,QAAgB,EAChB,MAAsB;QAEtB,IAAI,SAAiC,CAAC;QACtC,IAAI,CAAC;YACH,SAAS,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;YAC7D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CACpC,SAAS,EACT,iBAAiB,CAAC,SAAS,CAAC,KAAK,EAAE,aAAa,EAAE,QAAQ,CAAC,CAC5D,CAAC;YACF,OAAO,2BAA2B,CAAC,QAAQ,CAAC,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,sCAAoB,CAAC,0CAA0C,CAAC,CAAC;QAC7E,CAAC;gBAAS,CAAC;YACT,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,IAAI,CACf,SAA2B,EAC3B,aAAqB,EACrB,QAAgB,EAChB,SAAoC;QAEpC,IAAI,SAAiC,CAAC;QACtC,IAAI,CAAC;YACH,uBAAuB,CAAC,SAAS,CAAC,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;YAC7E,SAAS,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAC/B,2BAA2B,CAAC,SAAS,CAAC,EACtC,iBAAiB,CAAC,SAAS,CAAC,KAAK,EAAE,aAAa,EAAE,QAAQ,CAAC,CAC5D,CAAC;YACF,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;YACxE,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBACnE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;YAClE,CAAC;YACD,OAAO,MAAwB,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,sCAAoB,EAAE,CAAC;QACnC,CAAC;gBAAS,CAAC;YACT,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,MAAM,CACjB,SAA2B,EAC3B,SAAoC;QAEpC,IAAI,CAAC;YACH,uBAAuB,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,aAAa,EAAE,SAAS,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;YACjG,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CACtC,2BAA2B,CAAC,SAAS,CAAC,EACtC,iBAAiB,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,aAAa,EAAE,SAAS,CAAC,QAAQ,CAAC,CAChF,CAAC;YACF,OAAO,2BAA2B,CAAC,QAAQ,CAAC,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,sCAAoB,CAAC,0CAA0C,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;IAEM,WAAW,CAAC,SAAoC;QACrD,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACjD,CAAC;CACF;AAxED,8DAwEC;AAED,SAAS,iBAAiB,CAAC,UAAkB,EAAE,WAAmB,EAAE,QAAgB;IAClF,OAAO;QACL,UAAU;QACV,WAAW;QACX,SAAS,EAAE,SAAS;QACpB,KAAK,EAAE,KAAK;QACZ,aAAa,EAAE,cAAc;QAC7B,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAC9B,KAAa,EACb,aAAqB,EACrB,QAAgB,EAChB,SAAoC;IAEpC,IACE,SAAS,CAAC,KAAK,KAAK,KAAK;WACtB,SAAS,CAAC,aAAa,KAAK,aAAa;WACzC,SAAS,CAAC,QAAQ,KAAK,QAAQ,EAClC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;AACH,CAAC;AAED,SAAS,2BAA2B,CAAC,QAA4B;IAC/D,OAAO;QACL,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,UAAU;QAClC,aAAa,EAAE,QAAQ,CAAC,OAAO,CAAC,WAAW;QAC3C,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE;QACzC,gBAAgB,EAAE,QAAQ,CAAC,UAAU,CAAC,SAAS;QAC/C,KAAK,EAAE,QAAQ,CAAC,UAAU,CAAC,KAAK;QAChC,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC,UAAU;QAC1C,QAAQ,EAAE;YACR,mBAAmB,EAAE,QAAQ,CAAC,UAAU,CAAC,KAAK;YAC9C,qBAAqB,EAAE,QAAQ,CAAC,UAAU,CAAC,UAAU;YACrD,qBAAqB,EAAE,QAAQ,CAAC,UAAU,CAAC,UAAU;YACrD,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,SAAS;YACrC,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,KAAK;YAC7B,aAAa,EAAE,QAAQ,CAAC,OAAO,CAAC,aAAa;SAC9C;KACF,CAAC;AACJ,CAAC;AAED,SAAS,2BAA2B,CAAC,SAAoC;IACvE,MAAM,QAAQ,GAAG,SAAS,CAAC,QAAQ,CAAC;IACpC,IACE,CAAC,QAAQ,EAAE,mBAAmB;WAC3B,CAAC,QAAQ,CAAC,qBAAqB;WAC/B,CAAC,QAAQ,CAAC,qBAAqB;WAC/B,CAAC,QAAQ,CAAC,SAAS;WACnB,CAAC,QAAQ,CAAC,KAAK;WACf,CAAC,QAAQ,CAAC,aAAa,EAC1B,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,OAAO;QACL,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,UAAU,EAAE,SAAS,CAAC,UAA8C;QACpE,UAAU,EAAE,SAAS,CAAC,UAA8C;QACpE,OAAO,EAAE;YACP,UAAU,EAAE,SAAS,CAAC,KAAK;YAC3B,WAAW,EAAE,SAAS,CAAC,aAAa;YACpC,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,aAAa,EAAE,QAAQ,CAAC,aAAa;YACrC,QAAQ,EAAE,SAAS,CAAC,QAAQ;SAC7B;QACD,KAAK,EAAE,SAAS,CAAC,KAAK;QACtB,UAAU,EAAE,SAAS,CAAC,UAAU;QAChC,UAAU,EAAE;YACV,SAAS,EAAE,SAAS,CAAC,gBAAyD;YAC9E,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,UAAU,EAAE,QAAQ,CAAC,qBAA+D;YACpF,UAAU,EAAE,QAAQ,CAAC,qBAA+D;YACpF,KAAK,EAAE,QAAQ,CAAC,mBAAmB;YACnC,UAAU,EAAE,SAAS,CAAC,UAAU;SACjC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type { CredentialVault, GatewayPrincipal, ProviderSecret } from './CredentialVault';\nimport { CredentialVaultError } from './CredentialVault';\nimport type { EncryptedCredentialSecret } from './KeyWrapper';\nimport {\n  SecretCellVault,\n  type SecretCellContext,\n  type SecretCellEnvelope,\n  type SecretCellWrappedDataKey,\n} from '../../../security/secret-cell';\n\nconst PREDICATE = 'https://undefineds.co/ns#encryptedSecret';\nconst FIELD = 'providerCredentialSecret';\nconst SCHEMA_VERSION = 'v1';\n\nexport class SecretCellCredentialVault implements CredentialVault {\n  private readonly vault: SecretCellVault;\n\n  public constructor(options: { vault: SecretCellVault }) {\n    this.vault = options.vault;\n  }\n\n  public async seal(\n    principal: GatewayPrincipal,\n    credentialIri: string,\n    provider: string,\n    secret: ProviderSecret,\n  ): Promise<EncryptedCredentialSecret> {\n    let plaintext: Uint8Array | undefined;\n    try {\n      plaintext = new TextEncoder().encode(JSON.stringify(secret));\n      const envelope = await this.vault.seal(\n        plaintext,\n        secretCellContext(principal.webId, credentialIri, provider),\n      );\n      return encryptedRecordFromEnvelope(envelope);\n    } catch {\n      throw new CredentialVaultError('Credential secret could not be encrypted');\n    } finally {\n      plaintext?.fill(0);\n    }\n  }\n\n  public async open(\n    principal: GatewayPrincipal,\n    credentialIri: string,\n    provider: string,\n    encrypted: EncryptedCredentialSecret,\n  ): Promise<ProviderSecret> {\n    let plaintext: Uint8Array | undefined;\n    try {\n      assertCredentialContext(principal.webId, credentialIri, provider, encrypted);\n      plaintext = await this.vault.open(\n        envelopeFromEncryptedRecord(encrypted),\n        secretCellContext(principal.webId, credentialIri, provider),\n      );\n      const parsed: unknown = JSON.parse(new TextDecoder().decode(plaintext));\n      if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {\n        throw new Error('decrypted credential secret is not an object');\n      }\n      return parsed as ProviderSecret;\n    } catch {\n      throw new CredentialVaultError();\n    } finally {\n      plaintext?.fill(0);\n    }\n  }\n\n  public async rewrap(\n    principal: GatewayPrincipal,\n    encrypted: EncryptedCredentialSecret,\n  ): Promise<EncryptedCredentialSecret> {\n    try {\n      assertCredentialContext(principal.webId, encrypted.credentialIri, encrypted.provider, encrypted);\n      const envelope = await this.vault.rewrap(\n        envelopeFromEncryptedRecord(encrypted),\n        secretCellContext(principal.webId, encrypted.credentialIri, encrypted.provider),\n      );\n      return encryptedRecordFromEnvelope(envelope);\n    } catch {\n      throw new CredentialVaultError('Credential secret could not be rewrapped');\n    }\n  }\n\n  public needsRewrap(encrypted: EncryptedCredentialSecret): boolean {\n    return this.vault.needsRewrap(encrypted.keyId);\n  }\n}\n\nfunction secretCellContext(ownerWebId: string, resourceIri: string, provider: string): SecretCellContext {\n  return {\n    ownerWebId,\n    resourceIri,\n    predicate: PREDICATE,\n    field: FIELD,\n    schemaVersion: SCHEMA_VERSION,\n    provider,\n  };\n}\n\nfunction assertCredentialContext(\n  webId: string,\n  credentialIri: string,\n  provider: string,\n  encrypted: EncryptedCredentialSecret,\n): void {\n  if (\n    encrypted.webId !== webId\n    || encrypted.credentialIri !== credentialIri\n    || encrypted.provider !== provider\n  ) {\n    throw new Error('credential encryption context mismatch');\n  }\n}\n\nfunction encryptedRecordFromEnvelope(envelope: SecretCellEnvelope): EncryptedCredentialSecret {\n  return {\n    algorithm: envelope.algorithm,\n    aadPurpose: envelope.aadPurpose,\n    aadVersion: envelope.aadVersion,\n    ciphertext: envelope.ciphertext,\n    nonce: envelope.nonce,\n    webId: envelope.context.ownerWebId,\n    credentialIri: envelope.context.resourceIri,\n    provider: envelope.context.provider ?? '',\n    dekWrapAlgorithm: envelope.wrappedDek.algorithm,\n    keyId: envelope.wrappedDek.keyId,\n    wrappedDek: envelope.wrappedDek.ciphertext,\n    metadata: {\n      secretCellWrapNonce: envelope.wrappedDek.nonce,\n      secretCellWrapPurpose: envelope.wrappedDek.aadPurpose,\n      secretCellWrapVersion: envelope.wrappedDek.aadVersion,\n      predicate: envelope.context.predicate,\n      field: envelope.context.field,\n      schemaVersion: envelope.context.schemaVersion,\n    },\n  };\n}\n\nfunction envelopeFromEncryptedRecord(encrypted: EncryptedCredentialSecret): SecretCellEnvelope {\n  const metadata = encrypted.metadata;\n  if (\n    !metadata?.secretCellWrapNonce\n    || !metadata.secretCellWrapPurpose\n    || !metadata.secretCellWrapVersion\n    || !metadata.predicate\n    || !metadata.field\n    || !metadata.schemaVersion\n  ) {\n    throw new Error('SecretCell encrypted record metadata is incomplete');\n  }\n  return {\n    algorithm: encrypted.algorithm,\n    aadPurpose: encrypted.aadPurpose as SecretCellEnvelope['aadPurpose'],\n    aadVersion: encrypted.aadVersion as SecretCellEnvelope['aadVersion'],\n    context: {\n      ownerWebId: encrypted.webId,\n      resourceIri: encrypted.credentialIri,\n      predicate: metadata.predicate,\n      field: metadata.field,\n      schemaVersion: metadata.schemaVersion,\n      provider: encrypted.provider,\n    },\n    nonce: encrypted.nonce,\n    ciphertext: encrypted.ciphertext,\n    wrappedDek: {\n      algorithm: encrypted.dekWrapAlgorithm as SecretCellWrappedDataKey['algorithm'],\n      keyId: encrypted.keyId,\n      aadPurpose: metadata.secretCellWrapPurpose as SecretCellWrappedDataKey['aadPurpose'],\n      aadVersion: metadata.secretCellWrapVersion as SecretCellWrappedDataKey['aadVersion'],\n      nonce: metadata.secretCellWrapNonce,\n      ciphertext: encrypted.wrappedDek,\n    },\n  };\n}\n"]}

package/dist/api/ai-gateway/credentials/SecretCellKeyWrapper.d.ts

@@ -0,0 +1,23 @@
+import { type SecretCellVault } from '../../../security/secret-cell';
+import type { KeyWrapContext, KeyWrapper, WrappedDataKey } from './KeyWrapper';
+export interface SecretCellKeyWrapperOptions {
+    vault: SecretCellVault;
+    predicate: string;
+    field: string;
+    schemaVersion: string;
+}
+/**
+ * Compatibility adapter for callers that still compose WebCryptoCredentialVault.
+ * Production container wiring uses SecretCellCredentialVault directly.
+ */
+export declare class SecretCellKeyWrapper implements KeyWrapper {
+    private readonly vault;
+    private readonly predicate;
+    private readonly field;
+    private readonly schemaVersion;
+    constructor(options: SecretCellKeyWrapperOptions);
+    wrapDek(context: KeyWrapContext, dek: Uint8Array): Promise<WrappedDataKey>;
+    unwrapDek(context: KeyWrapContext, wrapped: WrappedDataKey): Promise<Uint8Array>;
+    private toSecretCellContext;
+    private decodeWrappedDataKey;
+}

package/dist/api/ai-gateway/credentials/SecretCellKeyWrapper.js

@@ -0,0 +1,62 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SecretCellKeyWrapper = void 0;
+/**
+ * Compatibility adapter for callers that still compose WebCryptoCredentialVault.
+ * Production container wiring uses SecretCellCredentialVault directly.
+ */
+class SecretCellKeyWrapper {
+    constructor(options) {
+        this.vault = options.vault;
+        this.predicate = options.predicate;
+        this.field = options.field;
+        this.schemaVersion = options.schemaVersion;
+    }
+    async wrapDek(context, dek) {
+        const secretCellContext = this.toSecretCellContext(context);
+        const wrapped = await this.vault.wrapDataKey(dek, secretCellContext);
+        return {
+            algorithm: wrapped.algorithm,
+            keyId: wrapped.keyId,
+            wrappedDek: Buffer.from(JSON.stringify(wrapped)).toString('base64url'),
+            metadata: {
+                aadPurpose: wrapped.aadPurpose,
+                aadVersion: wrapped.aadVersion,
+                nonce: wrapped.nonce,
+                predicate: secretCellContext.predicate,
+                field: secretCellContext.field,
+                schemaVersion: secretCellContext.schemaVersion,
+                provider: secretCellContext.provider ?? '',
+            },
+        };
+    }
+    async unwrapDek(context, wrapped) {
+        if (wrapped.algorithm !== 'xpod-secret-cell-root-hkdf-aes-256-gcm') {
+            throw new Error('unsupported SecretCell key wrapper algorithm');
+        }
+        return await this.vault.unwrapDataKey(this.decodeWrappedDataKey(wrapped), this.toSecretCellContext(context));
+    }
+    toSecretCellContext(context) {
+        return {
+            ownerWebId: context.webId,
+            resourceIri: context.credentialIri,
+            predicate: this.predicate,
+            field: this.field,
+            schemaVersion: this.schemaVersion,
+            provider: context.provider,
+        };
+    }
+    decodeWrappedDataKey(wrapped) {
+        const parsed = JSON.parse(Buffer.from(wrapped.wrappedDek, 'base64url').toString('utf8'));
+        return {
+            algorithm: parsed.algorithm,
+            keyId: parsed.keyId,
+            aadPurpose: parsed.aadPurpose,
+            aadVersion: parsed.aadVersion,
+            nonce: parsed.nonce,
+            ciphertext: parsed.ciphertext,
+        };
+    }
+}
+exports.SecretCellKeyWrapper = SecretCellKeyWrapper;
+//# sourceMappingURL=SecretCellKeyWrapper.js.map

package/dist/api/ai-gateway/credentials/SecretCellKeyWrapper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecretCellKeyWrapper.js","sourceRoot":"","sources":["../../../../src/api/ai-gateway/credentials/SecretCellKeyWrapper.ts"],"names":[],"mappings":";;;AAcA;;;GAGG;AACH,MAAa,oBAAoB;IAM/B,YAAmB,OAAoC;QACrD,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IAC7C,CAAC;IAEM,KAAK,CAAC,OAAO,CAAC,OAAuB,EAAE,GAAe;QAC3D,MAAM,iBAAiB,GAAG,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAC5D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;QACrE,OAAO;YACL,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;YACtE,QAAQ,EAAE;gBACR,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,SAAS,EAAE,iBAAiB,CAAC,SAAS;gBACtC,KAAK,EAAE,iBAAiB,CAAC,KAAK;gBAC9B,aAAa,EAAE,iBAAiB,CAAC,aAAa;gBAC9C,QAAQ,EAAE,iBAAiB,CAAC,QAAQ,IAAI,EAAE;aAC3C;SACF,CAAC;IACJ,CAAC;IAEM,KAAK,CAAC,SAAS,CAAC,OAAuB,EAAE,OAAuB;QACrE,IAAI,OAAO,CAAC,SAAS,KAAK,wCAAwC,EAAE,CAAC;YACnE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAClE,CAAC;QACD,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/G,CAAC;IAEO,mBAAmB,CAAC,OAAuB;QACjD,OAAO;YACL,UAAU,EAAE,OAAO,CAAC,KAAK;YACzB,WAAW,EAAE,OAAO,CAAC,aAAa;YAClC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,QAAQ,EAAE,OAAO,CAAC,QAAQ;SAC3B,CAAC;IACJ,CAAC;IAEO,oBAAoB,CAAC,OAAuB;QAClD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAA6B,CAAC;QACrH,OAAO;YACL,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,UAAU,EAAE,MAAM,CAAC,UAAU;SAC9B,CAAC;IACJ,CAAC;CACF;AA7DD,oDA6DC","sourcesContent":["import {\n  type SecretCellContext,\n  type SecretCellVault,\n  type SecretCellWrappedDataKey,\n} from '../../../security/secret-cell';\nimport type { KeyWrapContext, KeyWrapper, WrappedDataKey } from './KeyWrapper';\n\nexport interface SecretCellKeyWrapperOptions {\n  vault: SecretCellVault;\n  predicate: string;\n  field: string;\n  schemaVersion: string;\n}\n\n/**\n * Compatibility adapter for callers that still compose WebCryptoCredentialVault.\n * Production container wiring uses SecretCellCredentialVault directly.\n */\nexport class SecretCellKeyWrapper implements KeyWrapper {\n  private readonly vault: SecretCellVault;\n  private readonly predicate: string;\n  private readonly field: string;\n  private readonly schemaVersion: string;\n\n  public constructor(options: SecretCellKeyWrapperOptions) {\n    this.vault = options.vault;\n    this.predicate = options.predicate;\n    this.field = options.field;\n    this.schemaVersion = options.schemaVersion;\n  }\n\n  public async wrapDek(context: KeyWrapContext, dek: Uint8Array): Promise<WrappedDataKey> {\n    const secretCellContext = this.toSecretCellContext(context);\n    const wrapped = await this.vault.wrapDataKey(dek, secretCellContext);\n    return {\n      algorithm: wrapped.algorithm,\n      keyId: wrapped.keyId,\n      wrappedDek: Buffer.from(JSON.stringify(wrapped)).toString('base64url'),\n      metadata: {\n        aadPurpose: wrapped.aadPurpose,\n        aadVersion: wrapped.aadVersion,\n        nonce: wrapped.nonce,\n        predicate: secretCellContext.predicate,\n        field: secretCellContext.field,\n        schemaVersion: secretCellContext.schemaVersion,\n        provider: secretCellContext.provider ?? '',\n      },\n    };\n  }\n\n  public async unwrapDek(context: KeyWrapContext, wrapped: WrappedDataKey): Promise<Uint8Array> {\n    if (wrapped.algorithm !== 'xpod-secret-cell-root-hkdf-aes-256-gcm') {\n      throw new Error('unsupported SecretCell key wrapper algorithm');\n    }\n    return await this.vault.unwrapDataKey(this.decodeWrappedDataKey(wrapped), this.toSecretCellContext(context));\n  }\n\n  private toSecretCellContext(context: KeyWrapContext): SecretCellContext {\n    return {\n      ownerWebId: context.webId,\n      resourceIri: context.credentialIri,\n      predicate: this.predicate,\n      field: this.field,\n      schemaVersion: this.schemaVersion,\n      provider: context.provider,\n    };\n  }\n\n  private decodeWrappedDataKey(wrapped: WrappedDataKey): SecretCellWrappedDataKey {\n    const parsed = JSON.parse(Buffer.from(wrapped.wrappedDek, 'base64url').toString('utf8')) as SecretCellWrappedDataKey;\n    return {\n      algorithm: parsed.algorithm,\n      keyId: parsed.keyId,\n      aadPurpose: parsed.aadPurpose,\n      aadVersion: parsed.aadVersion,\n      nonce: parsed.nonce,\n      ciphertext: parsed.ciphertext,\n    };\n  }\n}\n"]}

package/dist/api/ai-gateway/credentials/WebCryptoCredentialVault.d.ts

@@ -0,0 +1,23 @@
+import type { CredentialVault, GatewayPrincipal, ProviderSecret } from './CredentialVault';
+import type { EncryptedCredentialSecret, KeyWrapper } from './KeyWrapper';
+export declare const CREDENTIAL_SECRET_AAD_PURPOSE = "xpod.ai-gateway.credential-secret";
+export declare const CREDENTIAL_SECRET_AAD_VERSION = "v1";
+export interface CredentialVaultLogger {
+    warn(message: string, metadata?: Record<string, unknown>): void;
+}
+export interface WebCryptoCredentialVaultOptions {
+    keyWrapper: KeyWrapper;
+    logger?: CredentialVaultLogger;
+}
+export declare class WebCryptoCredentialVault implements CredentialVault {
+    private readonly keyWrapper;
+    private readonly logger?;
+    constructor(options: WebCryptoCredentialVaultOptions);
+    seal(principal: GatewayPrincipal, credentialIri: string, provider: string, secret: ProviderSecret): Promise<EncryptedCredentialSecret>;
+    open(principal: GatewayPrincipal, credentialIri: string, provider: string, encrypted: EncryptedCredentialSecret): Promise<ProviderSecret>;
+    rewrap(principal: GatewayPrincipal, encrypted: EncryptedCredentialSecret): Promise<EncryptedCredentialSecret>;
+    private createContext;
+    private assertContext;
+    private logOpenFailure;
+    private logRewrapFailure;
+}

package/dist/api/ai-gateway/credentials/WebCryptoCredentialVault.js

@@ -0,0 +1,173 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WebCryptoCredentialVault = exports.CREDENTIAL_SECRET_AAD_VERSION = exports.CREDENTIAL_SECRET_AAD_PURPOSE = void 0;
+const node_crypto_1 = require("node:crypto");
+const CredentialVault_1 = require("./CredentialVault");
+const AES_GCM_ALGORITHM = 'AES-256-GCM';
+const DEK_BYTES = 32;
+const NONCE_BYTES = 12;
+exports.CREDENTIAL_SECRET_AAD_PURPOSE = 'xpod.ai-gateway.credential-secret';
+exports.CREDENTIAL_SECRET_AAD_VERSION = 'v1';
+class WebCryptoCredentialVault {
+    constructor(options) {
+        this.keyWrapper = options.keyWrapper;
+        this.logger = options.logger;
+    }
+    async seal(principal, credentialIri, provider, secret) {
+        const context = this.createContext(principal, credentialIri, provider);
+        const dek = node_crypto_1.webcrypto.getRandomValues(new Uint8Array(DEK_BYTES));
+        const nonce = node_crypto_1.webcrypto.getRandomValues(new Uint8Array(NONCE_BYTES));
+        let plaintext;
+        try {
+            const key = await importAesGcmKey(dek, ['encrypt']);
+            // This byte array is zeroed after encryption. JSON strings and WebCrypto's
+            // internal/native copies are runtime-managed and cannot be reliably wiped.
+            plaintext = new TextEncoder().encode(JSON.stringify(secret));
+            const ciphertext = new Uint8Array(await node_crypto_1.webcrypto.subtle.encrypt({ name: 'AES-GCM', iv: nonce, additionalData: credentialAadFor(context) }, key, plaintext));
+            const wrapped = await this.keyWrapper.wrapDek(context, dek);
+            return {
+                algorithm: AES_GCM_ALGORITHM,
+                aadPurpose: exports.CREDENTIAL_SECRET_AAD_PURPOSE,
+                aadVersion: exports.CREDENTIAL_SECRET_AAD_VERSION,
+                ciphertext: encodeBase64Url(ciphertext),
+                nonce: encodeBase64Url(nonce),
+                webId: context.webId,
+                credentialIri: context.credentialIri,
+                provider: context.provider,
+                dekWrapAlgorithm: wrapped.algorithm,
+                keyId: wrapped.keyId,
+                keyVersion: wrapped.keyVersion,
+                wrappedDek: wrapped.wrappedDek,
+                metadata: wrapped.metadata,
+            };
+        }
+        finally {
+            dek.fill(0);
+            plaintext?.fill(0);
+        }
+    }
+    async open(principal, credentialIri, provider, encrypted) {
+        let dek;
+        let plaintext;
+        try {
+            const context = this.assertContext(principal, credentialIri, provider, encrypted);
+            const wrapped = wrappedDataKeyFromEncrypted(encrypted);
+            dek = await this.keyWrapper.unwrapDek(context, wrapped);
+            const key = await importAesGcmKey(dek, ['decrypt']);
+            plaintext = new Uint8Array(await node_crypto_1.webcrypto.subtle.decrypt({
+                name: 'AES-GCM',
+                iv: decodeBase64Url(encrypted.nonce),
+                additionalData: credentialAadFor(context),
+            }, key, decodeBase64Url(encrypted.ciphertext)));
+            // The decrypted byte array is zeroed after JSON parsing. The decoded JSON
+            // string and parsed object are intentionally short-lived but cannot be
+            // forcibly wiped by JavaScript.
+            const parsed = JSON.parse(new TextDecoder().decode(plaintext));
+            if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+                throw new Error('decrypted credential secret is not an object');
+            }
+            return parsed;
+        }
+        catch (error) {
+            this.logOpenFailure(principal, credentialIri, provider, error);
+            throw new CredentialVault_1.CredentialVaultError();
+        }
+        finally {
+            dek?.fill(0);
+            plaintext?.fill(0);
+        }
+    }
+    async rewrap(principal, encrypted) {
+        let dek;
+        try {
+            const context = this.assertContext(principal, encrypted.credentialIri, encrypted.provider, encrypted);
+            dek = await this.keyWrapper.unwrapDek(context, wrappedDataKeyFromEncrypted(encrypted));
+            const wrapped = await this.keyWrapper.wrapDek(context, dek);
+            return {
+                ...encrypted,
+                dekWrapAlgorithm: wrapped.algorithm,
+                keyId: wrapped.keyId,
+                keyVersion: wrapped.keyVersion,
+                wrappedDek: wrapped.wrappedDek,
+                metadata: wrapped.metadata,
+            };
+        }
+        catch (error) {
+            this.logRewrapFailure(principal, encrypted, error);
+            throw new CredentialVault_1.CredentialVaultError('Credential secret could not be rewrapped');
+        }
+        finally {
+            dek?.fill(0);
+        }
+    }
+    createContext(principal, credentialIri, provider) {
+        return {
+            webId: principal.webId,
+            credentialIri,
+            provider,
+        };
+    }
+    assertContext(principal, credentialIri, provider, encrypted) {
+        const context = this.createContext(principal, credentialIri, provider);
+        if (encrypted.algorithm !== AES_GCM_ALGORITHM
+            || encrypted.aadPurpose !== exports.CREDENTIAL_SECRET_AAD_PURPOSE
+            || encrypted.aadVersion !== exports.CREDENTIAL_SECRET_AAD_VERSION
+            || encrypted.webId !== context.webId
+            || encrypted.credentialIri !== context.credentialIri
+            || encrypted.provider !== context.provider) {
+            throw new Error('credential encryption context mismatch');
+        }
+        return context;
+    }
+    logOpenFailure(principal, credentialIri, provider, error) {
+        this.logger?.warn('Failed to open encrypted credential secret', {
+            webId: principal.webId,
+            credentialIri,
+            provider,
+            reason: safeErrorName(error),
+        });
+    }
+    logRewrapFailure(principal, encrypted, error) {
+        this.logger?.warn('Failed to rewrap encrypted credential secret', {
+            webId: principal.webId,
+            credentialIri: encrypted.credentialIri,
+            provider: encrypted.provider,
+            reason: safeErrorName(error),
+        });
+    }
+}
+exports.WebCryptoCredentialVault = WebCryptoCredentialVault;
+function wrappedDataKeyFromEncrypted(encrypted) {
+    return {
+        algorithm: encrypted.dekWrapAlgorithm,
+        keyId: encrypted.keyId,
+        keyVersion: encrypted.keyVersion,
+        wrappedDek: encrypted.wrappedDek,
+        metadata: encrypted.metadata,
+    };
+}
+function credentialAadFor(context) {
+    return new TextEncoder().encode(JSON.stringify({
+        purpose: exports.CREDENTIAL_SECRET_AAD_PURPOSE,
+        version: exports.CREDENTIAL_SECRET_AAD_VERSION,
+        webId: context.webId,
+        credentialIri: context.credentialIri,
+        provider: context.provider,
+    }));
+}
+async function importAesGcmKey(keyMaterial, usages) {
+    return await node_crypto_1.webcrypto.subtle.importKey('raw', toArrayBuffer(keyMaterial), { name: 'AES-GCM', length: 256 }, false, usages);
+}
+function toArrayBuffer(bytes) {
+    return bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength);
+}
+function encodeBase64Url(bytes) {
+    return Buffer.from(bytes).toString('base64url');
+}
+function decodeBase64Url(value) {
+    return new Uint8Array(Buffer.from(value, 'base64url'));
+}
+function safeErrorName(error) {
+    return error instanceof Error ? error.name : typeof error;
+}
+//# sourceMappingURL=WebCryptoCredentialVault.js.map

package/dist/api/ai-gateway/credentials/WebCryptoCredentialVault.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"WebCryptoCredentialVault.js","sourceRoot":"","sources":["../../../../src/api/ai-gateway/credentials/WebCryptoCredentialVault.ts"],"names":[],"mappings":";;;AAAA,6CAAwC;AAExC,uDAAyD;AAGzD,MAAM,iBAAiB,GAAG,aAAsB,CAAC;AACjD,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,WAAW,GAAG,EAAE,CAAC;AAEV,QAAA,6BAA6B,GAAG,mCAAmC,CAAC;AACpE,QAAA,6BAA6B,GAAG,IAAI,CAAC;AAWlD,MAAa,wBAAwB;IAInC,YAAmB,OAAwC;QACzD,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC/B,CAAC;IAEM,KAAK,CAAC,IAAI,CACf,SAA2B,EAC3B,aAAqB,EACrB,QAAgB,EAChB,MAAsB;QAEtB,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,aAAa,EAAE,QAAQ,CAAC,CAAC;QACvE,MAAM,GAAG,GAAG,uBAAS,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;QACjE,MAAM,KAAK,GAAG,uBAAS,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;QACrE,IAAI,SAAiC,CAAC;QACtC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;YACpD,2EAA2E;YAC3E,2EAA2E;YAC3E,SAAS,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;YAC7D,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC,MAAM,uBAAS,CAAC,MAAM,CAAC,OAAO,CAC9D,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,gBAAgB,CAAC,OAAO,CAAC,EAAE,EACzE,GAAG,EACH,SAAS,CACV,CAAC,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAE5D,OAAO;gBACL,SAAS,EAAE,iBAAiB;gBAC5B,UAAU,EAAE,qCAA6B;gBACzC,UAAU,EAAE,qCAA6B;gBACzC,UAAU,EAAE,eAAe,CAAC,UAAU,CAAC;gBACvC,KAAK,EAAE,eAAe,CAAC,KAAK,CAAC;gBAC7B,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,gBAAgB,EAAE,OAAO,CAAC,SAAS;gBACnC,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,QAAQ,EAAE,OAAO,CAAC,QAAQ;aAC3B,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACZ,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,IAAI,CACf,SAA2B,EAC3B,aAAqB,EACrB,QAAgB,EAChB,SAAoC;QAEpC,IAAI,GAA2B,CAAC;QAChC,IAAI,SAAiC,CAAC;QACtC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;YAClF,MAAM,OAAO,GAAG,2BAA2B,CAAC,SAAS,CAAC,CAAC;YACvD,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACxD,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;YACpD,SAAS,GAAG,IAAI,UAAU,CAAC,MAAM,uBAAS,CAAC,MAAM,CAAC,OAAO,CACvD;gBACE,IAAI,EAAE,SAAS;gBACf,EAAE,EAAE,eAAe,CAAC,SAAS,CAAC,KAAK,CAAC;gBACpC,cAAc,EAAE,gBAAgB,CAAC,OAAO,CAAC;aAC1C,EACD,GAAG,EACH,eAAe,CAAC,SAAS,CAAC,UAAU,CAAC,CACtC,CAAC,CAAC;YACH,0EAA0E;YAC1E,uEAAuE;YACvE,gCAAgC;YAChC,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;YACxE,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBACnE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;YAClE,CAAC;YACD,OAAO,MAAwB,CAAC;QAClC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,aAAa,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;YAC/D,MAAM,IAAI,sCAAoB,EAAE,CAAC;QACnC,CAAC;gBAAS,CAAC;YACT,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;YACb,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,MAAM,CACjB,SAA2B,EAC3B,SAAoC;QAEpC,IAAI,GAA2B,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,SAAS,CAAC,aAAa,EAAE,SAAS,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;YACtG,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,OAAO,EAAE,2BAA2B,CAAC,SAAS,CAAC,CAAC,CAAC;YACvF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAC5D,OAAO;gBACL,GAAG,SAAS;gBACZ,gBAAgB,EAAE,OAAO,CAAC,SAAS;gBACnC,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,QAAQ,EAAE,OAAO,CAAC,QAAQ;aAC3B,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,gBAAgB,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;YACnD,MAAM,IAAI,sCAAoB,CAAC,0CAA0C,CAAC,CAAC;QAC7E,CAAC;gBAAS,CAAC;YACT,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QACf,CAAC;IACH,CAAC;IAEO,aAAa,CACnB,SAA2B,EAC3B,aAAqB,EACrB,QAAgB;QAEhB,OAAO;YACL,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,aAAa;YACb,QAAQ;SACT,CAAC;IACJ,CAAC;IAEO,aAAa,CACnB,SAA2B,EAC3B,aAAqB,EACrB,QAAgB,EAChB,SAAoC;QAEpC,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,aAAa,EAAE,QAAQ,CAAC,CAAC;QACvE,IACE,SAAS,CAAC,SAAS,KAAK,iBAAiB;eACtC,SAAS,CAAC,UAAU,KAAK,qCAA6B;eACtD,SAAS,CAAC,UAAU,KAAK,qCAA6B;eACtD,SAAS,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK;eACjC,SAAS,CAAC,aAAa,KAAK,OAAO,CAAC,aAAa;eACjD,SAAS,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ,EAC1C,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5D,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,cAAc,CACpB,SAA2B,EAC3B,aAAqB,EACrB,QAAgB,EAChB,KAAc;QAEd,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,4CAA4C,EAAE;YAC9D,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,aAAa;YACb,QAAQ;YACR,MAAM,EAAE,aAAa,CAAC,KAAK,CAAC;SAC7B,CAAC,CAAC;IACL,CAAC;IAEO,gBAAgB,CACtB,SAA2B,EAC3B,SAAoC,EACpC,KAAc;QAEd,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,8CAA8C,EAAE;YAChE,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,aAAa,EAAE,SAAS,CAAC,aAAa;YACtC,QAAQ,EAAE,SAAS,CAAC,QAAQ;YAC5B,MAAM,EAAE,aAAa,CAAC,KAAK,CAAC;SAC7B,CAAC,CAAC;IACL,CAAC;CACF;AA9KD,4DA8KC;AAED,SAAS,2BAA2B,CAAC,SAAoC;IACvE,OAAO;QACL,SAAS,EAAE,SAAS,CAAC,gBAAgB;QACrC,KAAK,EAAE,SAAS,CAAC,KAAK;QACtB,UAAU,EAAE,SAAS,CAAC,UAAU;QAChC,UAAU,EAAE,SAAS,CAAC,UAAU;QAChC,QAAQ,EAAE,SAAS,CAAC,QAAQ;KAC7B,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAuB;IAC/C,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;QAC7C,OAAO,EAAE,qCAA6B;QACtC,OAAO,EAAE,qCAA6B;QACtC,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC,CAAC,CAAC;AACN,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,WAAuB,EACvB,MAAkB;IAElB,OAAO,MAAM,uBAAS,CAAC,MAAM,CAAC,SAAS,CACrC,KAAK,EACL,aAAa,CAAC,WAAW,CAAC,EAC1B,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,EAChC,KAAK,EACL,MAAM,CACP,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,KAAiB;IACtC,OAAO,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC;AACnF,CAAC;AAED,SAAS,eAAe,CAAC,KAAiB;IACxC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC;AAC5D,CAAC","sourcesContent":["import { webcrypto } from 'node:crypto';\nimport type { CredentialVault, GatewayPrincipal, ProviderSecret } from './CredentialVault';\nimport { CredentialVaultError } from './CredentialVault';\nimport type { EncryptedCredentialSecret, KeyWrapContext, KeyWrapper, WrappedDataKey } from './KeyWrapper';\n\nconst AES_GCM_ALGORITHM = 'AES-256-GCM' as const;\nconst DEK_BYTES = 32;\nconst NONCE_BYTES = 12;\n\nexport const CREDENTIAL_SECRET_AAD_PURPOSE = 'xpod.ai-gateway.credential-secret';\nexport const CREDENTIAL_SECRET_AAD_VERSION = 'v1';\n\nexport interface CredentialVaultLogger {\n  warn(message: string, metadata?: Record<string, unknown>): void;\n}\n\nexport interface WebCryptoCredentialVaultOptions {\n  keyWrapper: KeyWrapper;\n  logger?: CredentialVaultLogger;\n}\n\nexport class WebCryptoCredentialVault implements CredentialVault {\n  private readonly keyWrapper: KeyWrapper;\n  private readonly logger?: CredentialVaultLogger;\n\n  public constructor(options: WebCryptoCredentialVaultOptions) {\n    this.keyWrapper = options.keyWrapper;\n    this.logger = options.logger;\n  }\n\n  public async seal(\n    principal: GatewayPrincipal,\n    credentialIri: string,\n    provider: string,\n    secret: ProviderSecret,\n  ): Promise<EncryptedCredentialSecret> {\n    const context = this.createContext(principal, credentialIri, provider);\n    const dek = webcrypto.getRandomValues(new Uint8Array(DEK_BYTES));\n    const nonce = webcrypto.getRandomValues(new Uint8Array(NONCE_BYTES));\n    let plaintext: Uint8Array | undefined;\n    try {\n      const key = await importAesGcmKey(dek, ['encrypt']);\n      // This byte array is zeroed after encryption. JSON strings and WebCrypto's\n      // internal/native copies are runtime-managed and cannot be reliably wiped.\n      plaintext = new TextEncoder().encode(JSON.stringify(secret));\n      const ciphertext = new Uint8Array(await webcrypto.subtle.encrypt(\n        { name: 'AES-GCM', iv: nonce, additionalData: credentialAadFor(context) },\n        key,\n        plaintext,\n      ));\n      const wrapped = await this.keyWrapper.wrapDek(context, dek);\n\n      return {\n        algorithm: AES_GCM_ALGORITHM,\n        aadPurpose: CREDENTIAL_SECRET_AAD_PURPOSE,\n        aadVersion: CREDENTIAL_SECRET_AAD_VERSION,\n        ciphertext: encodeBase64Url(ciphertext),\n        nonce: encodeBase64Url(nonce),\n        webId: context.webId,\n        credentialIri: context.credentialIri,\n        provider: context.provider,\n        dekWrapAlgorithm: wrapped.algorithm,\n        keyId: wrapped.keyId,\n        keyVersion: wrapped.keyVersion,\n        wrappedDek: wrapped.wrappedDek,\n        metadata: wrapped.metadata,\n      };\n    } finally {\n      dek.fill(0);\n      plaintext?.fill(0);\n    }\n  }\n\n  public async open(\n    principal: GatewayPrincipal,\n    credentialIri: string,\n    provider: string,\n    encrypted: EncryptedCredentialSecret,\n  ): Promise<ProviderSecret> {\n    let dek: Uint8Array | undefined;\n    let plaintext: Uint8Array | undefined;\n    try {\n      const context = this.assertContext(principal, credentialIri, provider, encrypted);\n      const wrapped = wrappedDataKeyFromEncrypted(encrypted);\n      dek = await this.keyWrapper.unwrapDek(context, wrapped);\n      const key = await importAesGcmKey(dek, ['decrypt']);\n      plaintext = new Uint8Array(await webcrypto.subtle.decrypt(\n        {\n          name: 'AES-GCM',\n          iv: decodeBase64Url(encrypted.nonce),\n          additionalData: credentialAadFor(context),\n        },\n        key,\n        decodeBase64Url(encrypted.ciphertext),\n      ));\n      // The decrypted byte array is zeroed after JSON parsing. The decoded JSON\n      // string and parsed object are intentionally short-lived but cannot be\n      // forcibly wiped by JavaScript.\n      const parsed: unknown = JSON.parse(new TextDecoder().decode(plaintext));\n      if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {\n        throw new Error('decrypted credential secret is not an object');\n      }\n      return parsed as ProviderSecret;\n    } catch (error) {\n      this.logOpenFailure(principal, credentialIri, provider, error);\n      throw new CredentialVaultError();\n    } finally {\n      dek?.fill(0);\n      plaintext?.fill(0);\n    }\n  }\n\n  public async rewrap(\n    principal: GatewayPrincipal,\n    encrypted: EncryptedCredentialSecret,\n  ): Promise<EncryptedCredentialSecret> {\n    let dek: Uint8Array | undefined;\n    try {\n      const context = this.assertContext(principal, encrypted.credentialIri, encrypted.provider, encrypted);\n      dek = await this.keyWrapper.unwrapDek(context, wrappedDataKeyFromEncrypted(encrypted));\n      const wrapped = await this.keyWrapper.wrapDek(context, dek);\n      return {\n        ...encrypted,\n        dekWrapAlgorithm: wrapped.algorithm,\n        keyId: wrapped.keyId,\n        keyVersion: wrapped.keyVersion,\n        wrappedDek: wrapped.wrappedDek,\n        metadata: wrapped.metadata,\n      };\n    } catch (error) {\n      this.logRewrapFailure(principal, encrypted, error);\n      throw new CredentialVaultError('Credential secret could not be rewrapped');\n    } finally {\n      dek?.fill(0);\n    }\n  }\n\n  private createContext(\n    principal: GatewayPrincipal,\n    credentialIri: string,\n    provider: string,\n  ): KeyWrapContext {\n    return {\n      webId: principal.webId,\n      credentialIri,\n      provider,\n    };\n  }\n\n  private assertContext(\n    principal: GatewayPrincipal,\n    credentialIri: string,\n    provider: string,\n    encrypted: EncryptedCredentialSecret,\n  ): KeyWrapContext {\n    const context = this.createContext(principal, credentialIri, provider);\n    if (\n      encrypted.algorithm !== AES_GCM_ALGORITHM\n      || encrypted.aadPurpose !== CREDENTIAL_SECRET_AAD_PURPOSE\n      || encrypted.aadVersion !== CREDENTIAL_SECRET_AAD_VERSION\n      || encrypted.webId !== context.webId\n      || encrypted.credentialIri !== context.credentialIri\n      || encrypted.provider !== context.provider\n    ) {\n      throw new Error('credential encryption context mismatch');\n    }\n    return context;\n  }\n\n  private logOpenFailure(\n    principal: GatewayPrincipal,\n    credentialIri: string,\n    provider: string,\n    error: unknown,\n  ): void {\n    this.logger?.warn('Failed to open encrypted credential secret', {\n      webId: principal.webId,\n      credentialIri,\n      provider,\n      reason: safeErrorName(error),\n    });\n  }\n\n  private logRewrapFailure(\n    principal: GatewayPrincipal,\n    encrypted: EncryptedCredentialSecret,\n    error: unknown,\n  ): void {\n    this.logger?.warn('Failed to rewrap encrypted credential secret', {\n      webId: principal.webId,\n      credentialIri: encrypted.credentialIri,\n      provider: encrypted.provider,\n      reason: safeErrorName(error),\n    });\n  }\n}\n\nfunction wrappedDataKeyFromEncrypted(encrypted: EncryptedCredentialSecret): WrappedDataKey {\n  return {\n    algorithm: encrypted.dekWrapAlgorithm,\n    keyId: encrypted.keyId,\n    keyVersion: encrypted.keyVersion,\n    wrappedDek: encrypted.wrappedDek,\n    metadata: encrypted.metadata,\n  };\n}\n\nfunction credentialAadFor(context: KeyWrapContext): Uint8Array {\n  return new TextEncoder().encode(JSON.stringify({\n    purpose: CREDENTIAL_SECRET_AAD_PURPOSE,\n    version: CREDENTIAL_SECRET_AAD_VERSION,\n    webId: context.webId,\n    credentialIri: context.credentialIri,\n    provider: context.provider,\n  }));\n}\n\nasync function importAesGcmKey(\n  keyMaterial: Uint8Array,\n  usages: KeyUsage[],\n): Promise<CryptoKey> {\n  return await webcrypto.subtle.importKey(\n    'raw',\n    toArrayBuffer(keyMaterial),\n    { name: 'AES-GCM', length: 256 },\n    false,\n    usages,\n  );\n}\n\nfunction toArrayBuffer(bytes: Uint8Array): ArrayBuffer {\n  return bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength);\n}\n\nfunction encodeBase64Url(bytes: Uint8Array): string {\n  return Buffer.from(bytes).toString('base64url');\n}\n\nfunction decodeBase64Url(value: string): Uint8Array {\n  return new Uint8Array(Buffer.from(value, 'base64url'));\n}\n\nfunction safeErrorName(error: unknown): string {\n  return error instanceof Error ? error.name : typeof error;\n}\n"]}

package/dist/api/ai-gateway/errors.d.ts

@@ -0,0 +1,21 @@
+export type GatewayErrorCode = 'invalid_request' | 'invalid_tool_arguments' | 'unsupported_protocol_event' | 'service_access_missing' | 'credential_unavailable' | 'provider_error' | 'internal_error';
+export interface NormalizedGatewayError {
+    error: {
+        code: GatewayErrorCode;
+        message: string;
+        status: number;
+        details?: Record<string, unknown>;
+    };
+}
+export declare class GatewayProtocolError extends Error {
+    readonly code: GatewayErrorCode;
+    readonly status: number;
+    readonly details?: Record<string, unknown>;
+    constructor(message: string, options?: {
+        code?: GatewayErrorCode;
+        status?: number;
+        details?: Record<string, unknown>;
+        cause?: unknown;
+    });
+}
+export declare function normalizeGatewayError(error: unknown): NormalizedGatewayError;

package/dist/api/ai-gateway/errors.js

@@ -0,0 +1,50 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GatewayProtocolError = void 0;
+exports.normalizeGatewayError = normalizeGatewayError;
+class GatewayProtocolError extends Error {
+    constructor(message, options = {}) {
+        super(message);
+        this.name = 'GatewayProtocolError';
+        this.code = options.code ?? 'invalid_request';
+        this.status = options.status ?? 400;
+        this.details = options.details;
+        if (options.cause !== undefined) {
+            this.cause = options.cause;
+        }
+    }
+}
+exports.GatewayProtocolError = GatewayProtocolError;
+function normalizeGatewayError(error) {
+    if (error instanceof GatewayProtocolError) {
+        return {
+            error: {
+                code: error.code,
+                message: error.message,
+                status: error.status,
+                ...(error.details ? { details: error.details } : {}),
+            },
+        };
+    }
+    if (error instanceof Error && error.message === 'service_access_missing') {
+        return {
+            error: {
+                code: 'service_access_missing',
+                message: 'Pod service access is missing or has been revoked',
+                status: 403,
+            },
+        };
+    }
+    const status = typeof error?.status === 'number'
+        ? error.status
+        : 500;
+    const message = error instanceof Error ? error.message : 'Unknown gateway error';
+    return {
+        error: {
+            code: status >= 500 ? 'internal_error' : 'provider_error',
+            message,
+            status,
+        },
+    };
+}
+//# sourceMappingURL=errors.js.map

package/dist/api/ai-gateway/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../src/api/ai-gateway/errors.ts"],"names":[],"mappings":";;;AAwCA,sDAkCC;AAxDD,MAAa,oBAAqB,SAAQ,KAAK;IAK7C,YAAmB,OAAe,EAAE,UAKhC,EAAE;QACJ,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;QACnC,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,iBAAiB,CAAC;QAC9C,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,GAAG,CAAC;QACpC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAC/B,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC/B,IAAoC,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC9D,CAAC;IACH,CAAC;CACF;AApBD,oDAoBC;AAED,SAAgB,qBAAqB,CAAC,KAAc;IAClD,IAAI,KAAK,YAAY,oBAAoB,EAAE,CAAC;QAC1C,OAAO;YACL,KAAK,EAAE;gBACL,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACrD;SACF,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,wBAAwB,EAAE,CAAC;QACzE,OAAO;YACL,KAAK,EAAE;gBACL,IAAI,EAAE,wBAAwB;gBAC9B,OAAO,EAAE,mDAAmD;gBAC5D,MAAM,EAAE,GAAG;aACZ;SACF,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,OAAQ,KAA8B,EAAE,MAAM,KAAK,QAAQ;QACxE,CAAC,CAAE,KAA4B,CAAC,MAAM;QACtC,CAAC,CAAC,GAAG,CAAC;IACR,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC;IAEjF,OAAO;QACL,KAAK,EAAE;YACL,IAAI,EAAE,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB;YACzD,OAAO;YACP,MAAM;SACP;KACF,CAAC;AACJ,CAAC","sourcesContent":["export type GatewayErrorCode =\n  | 'invalid_request'\n  | 'invalid_tool_arguments'\n  | 'unsupported_protocol_event'\n  | 'service_access_missing'\n  | 'credential_unavailable'\n  | 'provider_error'\n  | 'internal_error';\n\nexport interface NormalizedGatewayError {\n  error: {\n    code: GatewayErrorCode;\n    message: string;\n    status: number;\n    details?: Record<string, unknown>;\n  };\n}\n\nexport class GatewayProtocolError extends Error {\n  public readonly code: GatewayErrorCode;\n  public readonly status: number;\n  public readonly details?: Record<string, unknown>;\n\n  public constructor(message: string, options: {\n    code?: GatewayErrorCode;\n    status?: number;\n    details?: Record<string, unknown>;\n    cause?: unknown;\n  } = {}) {\n    super(message);\n    this.name = 'GatewayProtocolError';\n    this.code = options.code ?? 'invalid_request';\n    this.status = options.status ?? 400;\n    this.details = options.details;\n    if (options.cause !== undefined) {\n      (this as Error & { cause?: unknown }).cause = options.cause;\n    }\n  }\n}\n\nexport function normalizeGatewayError(error: unknown): NormalizedGatewayError {\n  if (error instanceof GatewayProtocolError) {\n    return {\n      error: {\n        code: error.code,\n        message: error.message,\n        status: error.status,\n        ...(error.details ? { details: error.details } : {}),\n      },\n    };\n  }\n\n  if (error instanceof Error && error.message === 'service_access_missing') {\n    return {\n      error: {\n        code: 'service_access_missing',\n        message: 'Pod service access is missing or has been revoked',\n        status: 403,\n      },\n    };\n  }\n\n  const status = typeof (error as { status?: unknown })?.status === 'number'\n    ? (error as { status: number }).status\n    : 500;\n  const message = error instanceof Error ? error.message : 'Unknown gateway error';\n\n  return {\n    error: {\n      code: status >= 500 ? 'internal_error' : 'provider_error',\n      message,\n      status,\n    },\n  };\n}\n"]}

package/dist/api/ai-gateway/protocol/ChatCompletionsFrontend.d.ts

@@ -0,0 +1,6 @@
+import { type GatewayEventSerializer, type GatewayProtocolFrontend, type GatewayRequest } from '../types';
+export declare class ChatCompletionsFrontend implements GatewayProtocolFrontend {
+    readonly protocol: "chatCompletions";
+    parseRequest(body: unknown): GatewayRequest;
+    createEventSerializer(): GatewayEventSerializer;
+}