@undefineds.co/xpod 0.3.58 → 0.3.62

package/dist/api/ai-gateway/auth/AiConnectionInvocationKeyIssuer.js

@@ -0,0 +1,128 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AiConnectionInvocationKeyIssuer = void 0;
+const GatewayApiKeyAuthenticator_1 = require("./GatewayApiKeyAuthenticator");
+const InvocationTokenCodec_1 = require("./InvocationTokenCodec");
+// ACP can remain in an interactive authentication wait for five minutes.
+// Ten minutes covers that boundary plus the resumed turn while retaining a
+// hard fifteen-minute ceiling for every stateless invocation token.
+const DEFAULT_INVOCATION_KEY_TTL_MS = 10 * 60_000;
+const MAX_INVOCATION_KEY_TTL_MS = 15 * 60_000;
+/**
+ * Produces a short-lived stateless Gateway token at the trusted execution
+ * boundary. Nothing is persisted; plaintext exists solely in process memory
+ * and the returned invocation context.
+ */
+class AiConnectionInvocationKeyIssuer {
+    constructor(options) {
+        this.cache = new Map();
+        this.pending = new Map();
+        this.codec = options.codec;
+        this.deployment = options.deployment;
+        this.baseUrl = requireBaseUrl(options.baseUrl);
+        this.audience = (0, InvocationTokenCodec_1.requireCanonicalOrigin)(options.audience ?? new URL(this.baseUrl).origin, 'audience');
+        this.issuer = (0, InvocationTokenCodec_1.requireCanonicalOrigin)(options.issuer ?? this.audience, 'issuer');
+        this.ttlMs = normalizeTtl(options.ttlMs);
+        this.reuseSafetyMarginMs = normalizeSafetyMargin(options.reuseSafetyMarginMs, this.ttlMs);
+        this.maxCacheEntries = normalizeMaxCacheEntries(options.maxCacheEntries);
+        this.now = options.now ?? (() => new Date());
+    }
+    async issue(context) {
+        const auth = requireTrustedSolidAuth(context.auth);
+        const webId = (0, InvocationTokenCodec_1.requireCanonicalWebId)(auth.webId);
+        const now = this.now();
+        const cached = this.cache.get(webId);
+        if (cached && cached.expiresAt.getTime() - now.getTime() >= this.reuseSafetyMarginMs) {
+            return this.toInvocationConfig(cached);
+        }
+        let pending = this.pending.get(webId);
+        if (!pending) {
+            pending = Promise.resolve().then(() => this.createInvocation(webId, now));
+            this.pending.set(webId, pending);
+            const clearPending = () => {
+                if (this.pending.get(webId) === pending) {
+                    this.pending.delete(webId);
+                }
+            };
+            void pending.then(clearPending, clearPending);
+        }
+        const issued = await pending;
+        return this.toInvocationConfig(issued);
+    }
+    createInvocation(webId, createdAt) {
+        this.pruneCache(createdAt);
+        const expiresAt = new Date(createdAt.getTime() + this.ttlMs);
+        const plaintext = this.codec.encode({
+            deployment: this.deployment,
+            audience: this.audience,
+            issuer: this.issuer,
+            webId,
+            scopes: [...GatewayApiKeyAuthenticator_1.DEFAULT_GATEWAY_API_KEY_SCOPES, 'client-config:read', 'client-config:write'],
+            issuedAt: createdAt,
+            expiresAt,
+        });
+        const cached = { plaintext, expiresAt };
+        this.cache.set(webId, cached);
+        return cached;
+    }
+    toInvocationConfig(invocation) {
+        return {
+            baseUrl: this.baseUrl,
+            gatewayKey: invocation.plaintext,
+            expiresAt: invocation.expiresAt.toISOString(),
+        };
+    }
+    pruneCache(now) {
+        for (const [webId, cached] of this.cache) {
+            if (cached.expiresAt.getTime() <= now.getTime()) {
+                this.cache.delete(webId);
+            }
+        }
+        while (this.cache.size >= this.maxCacheEntries) {
+            const oldest = this.cache.keys().next().value;
+            if (!oldest) {
+                break;
+            }
+            this.cache.delete(oldest);
+        }
+    }
+}
+exports.AiConnectionInvocationKeyIssuer = AiConnectionInvocationKeyIssuer;
+function requireTrustedSolidAuth(auth) {
+    if (auth?.type !== 'solid'
+        || typeof auth.webId !== 'string'
+        || auth.webId.trim().length === 0
+        || auth.viaGatewayApiKey === true) {
+        throw new Error('AI Connection invocation key requires an authenticated Solid WebID');
+    }
+    return auth;
+}
+function requireBaseUrl(value) {
+    const normalized = value.trim().replace(/\/+$/u, '');
+    if (!normalized) {
+        throw new Error('AI Connection invocation baseUrl is required');
+    }
+    return normalized;
+}
+function normalizeTtl(value) {
+    const ttlMs = value ?? DEFAULT_INVOCATION_KEY_TTL_MS;
+    if (!Number.isFinite(ttlMs) || ttlMs <= 0 || ttlMs > MAX_INVOCATION_KEY_TTL_MS) {
+        throw new Error(`AI Connection invocation key TTL must be between 1 and ${MAX_INVOCATION_KEY_TTL_MS} milliseconds`);
+    }
+    return ttlMs;
+}
+function normalizeSafetyMargin(value, ttlMs) {
+    const margin = value ?? 30_000;
+    if (!Number.isFinite(margin) || margin < 0 || margin >= ttlMs) {
+        throw new Error('AI Connection invocation key reuse safety margin must be non-negative and less than its TTL');
+    }
+    return margin;
+}
+function normalizeMaxCacheEntries(value) {
+    const entries = value ?? 1_024;
+    if (!Number.isSafeInteger(entries) || entries <= 0 || entries > 100_000) {
+        throw new Error('AI Connection invocation key cache size must be between 1 and 100000');
+    }
+    return entries;
+}
+//# sourceMappingURL=AiConnectionInvocationKeyIssuer.js.map

package/dist/api/ai-gateway/auth/AiConnectionInvocationKeyIssuer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AiConnectionInvocationKeyIssuer.js","sourceRoot":"","sources":["../../../../src/api/ai-gateway/auth/AiConnectionInvocationKeyIssuer.ts"],"names":[],"mappings":";;;AAIA,6EAA8E;AAC9E,iEAAkH;AAElH,yEAAyE;AACzE,2EAA2E;AAC3E,oEAAoE;AACpE,MAAM,6BAA6B,GAAG,EAAE,GAAG,MAAM,CAAC;AAClD,MAAM,yBAAyB,GAAG,EAAE,GAAG,MAAM,CAAC;AAc9C;;;;GAIG;AACH,MAAa,+BAA+B;IAa1C,YAAmB,OAA+C;QAHjD,UAAK,GAAG,IAAI,GAAG,EAA4B,CAAC;QAC5C,YAAO,GAAG,IAAI,GAAG,EAAqC,CAAC;QAGtE,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC/C,IAAI,CAAC,QAAQ,GAAG,IAAA,6CAAsB,EAAC,OAAO,CAAC,QAAQ,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QACrG,IAAI,CAAC,MAAM,GAAG,IAAA,6CAAsB,EAAC,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAChF,IAAI,CAAC,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,CAAC,mBAAmB,GAAG,qBAAqB,CAAC,OAAO,CAAC,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1F,IAAI,CAAC,eAAe,GAAG,wBAAwB,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QACzE,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC/C,CAAC;IAEM,KAAK,CAAC,KAAK,CAAC,OAAqB;QACtC,MAAM,IAAI,GAAG,uBAAuB,CAAC,OAAO,CAAC,IAA+B,CAAC,CAAC;QAC9E,MAAM,KAAK,GAAG,IAAA,4CAAqB,EAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,mBAAmB,EAAE,CAAC;YACrF,OAAO,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;QACzC,CAAC;QACD,IAAI,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;YAC1E,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YACjC,MAAM,YAAY,GAAG,GAAS,EAAE;gBAC9B,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,OAAO,EAAE,CAAC;oBACxC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC7B,CAAC;YACH,CAAC,CAAC;YACF,KAAK,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;QAChD,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC;QAE7B,OAAO,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;IACzC,CAAC;IAEO,gBAAgB,CAAC,KAAa,EAAE,SAAe;QACrD,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAC3B,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7D,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;YAClC,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK;YACL,MAAM,EAAE,CAAC,GAAG,2DAA8B,EAAE,oBAAoB,EAAE,qBAAqB,CAAC;YACxF,QAAQ,EAAE,SAAS;YACnB,SAAS;SACV,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;QACxC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC9B,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,kBAAkB,CAAC,UAA4B;QACrD,OAAO;YACL,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,UAAU,EAAE,UAAU,CAAC,SAAS;YAChC,SAAS,EAAE,UAAU,CAAC,SAAS,CAAC,WAAW,EAAE;SAC9C,CAAC;IACJ,CAAC;IAEO,UAAU,CAAC,GAAS;QAC1B,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACzC,IAAI,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;gBAChD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAA2B,CAAC;YACpE,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM;YACR,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;CACF;AAxFD,0EAwFC;AAOD,SAAS,uBAAuB,CAAC,IAA6B;IAC5D,IACE,IAAI,EAAE,IAAI,KAAK,OAAO;WACnB,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ;WAC9B,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;WAC9B,IAAI,CAAC,gBAAgB,KAAK,IAAI,EACjC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,cAAc,CAAC,KAAa;IACnC,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACrD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,YAAY,CAAC,KAAyB;IAC7C,MAAM,KAAK,GAAG,KAAK,IAAI,6BAA6B,CAAC;IACrD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,KAAK,GAAG,yBAAyB,EAAE,CAAC;QAC/E,MAAM,IAAI,KAAK,CAAC,0DAA0D,yBAAyB,eAAe,CAAC,CAAC;IACtH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAyB,EAAE,KAAa;IACrE,MAAM,MAAM,GAAG,KAAK,IAAI,MAAM,CAAC;IAC/B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,IAAI,KAAK,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,6FAA6F,CAAC,CAAC;IACjH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAyB;IACzD,MAAM,OAAO,GAAG,KAAK,IAAI,KAAK,CAAC;IAC/B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,OAAO,IAAI,CAAC,IAAI,OAAO,GAAG,OAAO,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC","sourcesContent":["import type { AuthContext, SolidAuthContext } from '../../auth/AuthContext';\nimport type { StoreContext } from '../../chatkit/store';\nimport type { AIConnectionInvocationConfig } from '../../../agents/types';\nimport type { GatewayDeployment } from './GatewayApiKey';\nimport { DEFAULT_GATEWAY_API_KEY_SCOPES } from './GatewayApiKeyAuthenticator';\nimport { requireCanonicalOrigin, requireCanonicalWebId, type InvocationTokenCodec } from './InvocationTokenCodec';\n\n// ACP can remain in an interactive authentication wait for five minutes.\n// Ten minutes covers that boundary plus the resumed turn while retaining a\n// hard fifteen-minute ceiling for every stateless invocation token.\nconst DEFAULT_INVOCATION_KEY_TTL_MS = 10 * 60_000;\nconst MAX_INVOCATION_KEY_TTL_MS = 15 * 60_000;\n\nexport interface AiConnectionInvocationKeyIssuerOptions {\n  codec: InvocationTokenCodec;\n  deployment: GatewayDeployment;\n  baseUrl: string;\n  audience?: string;\n  issuer?: string;\n  ttlMs?: number;\n  reuseSafetyMarginMs?: number;\n  maxCacheEntries?: number;\n  now?: () => Date;\n}\n\n/**\n * Produces a short-lived stateless Gateway token at the trusted execution\n * boundary. Nothing is persisted; plaintext exists solely in process memory\n * and the returned invocation context.\n */\nexport class AiConnectionInvocationKeyIssuer {\n  private readonly codec: InvocationTokenCodec;\n  private readonly deployment: GatewayDeployment;\n  private readonly baseUrl: string;\n  private readonly audience: string;\n  private readonly issuer: string;\n  private readonly ttlMs: number;\n  private readonly reuseSafetyMarginMs: number;\n  private readonly maxCacheEntries: number;\n  private readonly now: () => Date;\n  private readonly cache = new Map<string, CachedInvocation>();\n  private readonly pending = new Map<string, Promise<CachedInvocation>>();\n\n  public constructor(options: AiConnectionInvocationKeyIssuerOptions) {\n    this.codec = options.codec;\n    this.deployment = options.deployment;\n    this.baseUrl = requireBaseUrl(options.baseUrl);\n    this.audience = requireCanonicalOrigin(options.audience ?? new URL(this.baseUrl).origin, 'audience');\n    this.issuer = requireCanonicalOrigin(options.issuer ?? this.audience, 'issuer');\n    this.ttlMs = normalizeTtl(options.ttlMs);\n    this.reuseSafetyMarginMs = normalizeSafetyMargin(options.reuseSafetyMarginMs, this.ttlMs);\n    this.maxCacheEntries = normalizeMaxCacheEntries(options.maxCacheEntries);\n    this.now = options.now ?? (() => new Date());\n  }\n\n  public async issue(context: StoreContext): Promise<AIConnectionInvocationConfig> {\n    const auth = requireTrustedSolidAuth(context.auth as AuthContext | undefined);\n    const webId = requireCanonicalWebId(auth.webId);\n    const now = this.now();\n    const cached = this.cache.get(webId);\n    if (cached && cached.expiresAt.getTime() - now.getTime() >= this.reuseSafetyMarginMs) {\n      return this.toInvocationConfig(cached);\n    }\n    let pending = this.pending.get(webId);\n    if (!pending) {\n      pending = Promise.resolve().then(() => this.createInvocation(webId, now));\n      this.pending.set(webId, pending);\n      const clearPending = (): void => {\n        if (this.pending.get(webId) === pending) {\n          this.pending.delete(webId);\n        }\n      };\n      void pending.then(clearPending, clearPending);\n    }\n    const issued = await pending;\n\n    return this.toInvocationConfig(issued);\n  }\n\n  private createInvocation(webId: string, createdAt: Date): CachedInvocation {\n    this.pruneCache(createdAt);\n    const expiresAt = new Date(createdAt.getTime() + this.ttlMs);\n    const plaintext = this.codec.encode({\n      deployment: this.deployment,\n      audience: this.audience,\n      issuer: this.issuer,\n      webId,\n      scopes: [...DEFAULT_GATEWAY_API_KEY_SCOPES, 'client-config:read', 'client-config:write'],\n      issuedAt: createdAt,\n      expiresAt,\n    });\n    const cached = { plaintext, expiresAt };\n    this.cache.set(webId, cached);\n    return cached;\n  }\n\n  private toInvocationConfig(invocation: CachedInvocation): AIConnectionInvocationConfig {\n    return {\n      baseUrl: this.baseUrl,\n      gatewayKey: invocation.plaintext,\n      expiresAt: invocation.expiresAt.toISOString(),\n    };\n  }\n\n  private pruneCache(now: Date): void {\n    for (const [webId, cached] of this.cache) {\n      if (cached.expiresAt.getTime() <= now.getTime()) {\n        this.cache.delete(webId);\n      }\n    }\n    while (this.cache.size >= this.maxCacheEntries) {\n      const oldest = this.cache.keys().next().value as string | undefined;\n      if (!oldest) {\n        break;\n      }\n      this.cache.delete(oldest);\n    }\n  }\n}\n\ninterface CachedInvocation {\n  plaintext: string;\n  expiresAt: Date;\n}\n\nfunction requireTrustedSolidAuth(auth: AuthContext | undefined): SolidAuthContext {\n  if (\n    auth?.type !== 'solid'\n    || typeof auth.webId !== 'string'\n    || auth.webId.trim().length === 0\n    || auth.viaGatewayApiKey === true\n  ) {\n    throw new Error('AI Connection invocation key requires an authenticated Solid WebID');\n  }\n  return auth;\n}\n\nfunction requireBaseUrl(value: string): string {\n  const normalized = value.trim().replace(/\\/+$/u, '');\n  if (!normalized) {\n    throw new Error('AI Connection invocation baseUrl is required');\n  }\n  return normalized;\n}\n\nfunction normalizeTtl(value: number | undefined): number {\n  const ttlMs = value ?? DEFAULT_INVOCATION_KEY_TTL_MS;\n  if (!Number.isFinite(ttlMs) || ttlMs <= 0 || ttlMs > MAX_INVOCATION_KEY_TTL_MS) {\n    throw new Error(`AI Connection invocation key TTL must be between 1 and ${MAX_INVOCATION_KEY_TTL_MS} milliseconds`);\n  }\n  return ttlMs;\n}\n\nfunction normalizeSafetyMargin(value: number | undefined, ttlMs: number): number {\n  const margin = value ?? 30_000;\n  if (!Number.isFinite(margin) || margin < 0 || margin >= ttlMs) {\n    throw new Error('AI Connection invocation key reuse safety margin must be non-negative and less than its TTL');\n  }\n  return margin;\n}\n\nfunction normalizeMaxCacheEntries(value: number | undefined): number {\n  const entries = value ?? 1_024;\n  if (!Number.isSafeInteger(entries) || entries <= 0 || entries > 100_000) {\n    throw new Error('AI Connection invocation key cache size must be between 1 and 100000');\n  }\n  return entries;\n}\n"]}

package/dist/api/ai-gateway/auth/ClientCredentialsInternalPodAccessTokenProvider.d.ts

@@ -0,0 +1,25 @@
+import type { InternalPodAccessTokenProvider } from './PodGatewayAccessKeyRepository';
+export interface ClientCredentialsInternalPodAccessTokenProviderOptions {
+    tokenEndpoint: string;
+    clientId: string;
+    clientSecret: string;
+    fetchImpl?: typeof fetch;
+    now?: () => number;
+}
+export declare class ClientCredentialsInternalPodAccessTokenProvider implements InternalPodAccessTokenProvider {
+    private readonly tokenEndpoint;
+    private readonly clientId;
+    private readonly clientSecret;
+    private readonly fetchImpl;
+    private readonly now;
+    private cachedToken?;
+    private tokenRequest?;
+    private serviceWebId?;
+    constructor(options: ClientCredentialsInternalPodAccessTokenProviderOptions);
+    getTrustedFetch(_owner: string): Promise<typeof fetch | undefined>;
+    getServicePrincipal(): Promise<{
+        webId: string;
+    }>;
+    private getAccessToken;
+    private exchangeToken;
+}

package/dist/api/ai-gateway/auth/ClientCredentialsInternalPodAccessTokenProvider.js

@@ -0,0 +1,91 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ClientCredentialsInternalPodAccessTokenProvider = void 0;
+const TokenIdentity_1 = require("../../auth/TokenIdentity");
+class ClientCredentialsInternalPodAccessTokenProvider {
+    constructor(options) {
+        if (!options.clientId.trim() || !options.clientSecret.trim()) {
+            throw new Error('Gateway internal Pod access client credentials are required');
+        }
+        this.tokenEndpoint = options.tokenEndpoint;
+        this.clientId = options.clientId;
+        this.clientSecret = options.clientSecret;
+        this.fetchImpl = options.fetchImpl ?? fetch;
+        this.now = options.now ?? Date.now;
+    }
+    async getTrustedFetch(_owner) {
+        const token = await this.getAccessToken();
+        return async (input, init) => {
+            const headers = new Headers(init?.headers);
+            if (!headers.has('Authorization')) {
+                headers.set('Authorization', `Bearer ${token.accessToken}`);
+            }
+            return this.fetchImpl(input, { ...init, headers });
+        };
+    }
+    async getServicePrincipal() {
+        const token = await this.getAccessToken();
+        return { webId: token.webId };
+    }
+    async getAccessToken() {
+        const now = this.now();
+        if (this.cachedToken && this.cachedToken.expiresAt - 30_000 > now) {
+            return this.cachedToken;
+        }
+        if (this.tokenRequest) {
+            return this.tokenRequest;
+        }
+        this.tokenRequest = this.exchangeToken(now);
+        try {
+            return await this.tokenRequest;
+        }
+        finally {
+            this.tokenRequest = undefined;
+        }
+    }
+    async exchangeToken(now) {
+        const response = await this.fetchImpl(this.tokenEndpoint, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/x-www-form-urlencoded',
+            },
+            body: new URLSearchParams({
+                grant_type: 'client_credentials',
+                client_id: this.clientId,
+                client_secret: this.clientSecret,
+                scope: 'webid',
+            }),
+        });
+        if (!response.ok) {
+            throw new Error(`Gateway internal Pod token exchange failed: HTTP ${response.status}`);
+        }
+        const body = await response.json();
+        const accessToken = typeof body.access_token === 'string' ? body.access_token : undefined;
+        if (!accessToken) {
+            throw new Error('Gateway internal Pod token response missing access_token');
+        }
+        if (body.token_type !== 'Bearer') {
+            throw new Error('Gateway internal service token must be Bearer');
+        }
+        const tokenWebId = (0, TokenIdentity_1.extractAuthoritativeWebIdFromTokenResponse)(body);
+        if (!tokenWebId) {
+            throw new Error('Gateway internal Pod token response missing authoritative WebID');
+        }
+        if (this.serviceWebId && tokenWebId !== this.serviceWebId) {
+            throw new Error('Gateway internal service WebID changed');
+        }
+        const expiresIn = typeof body.expires_in === 'number' && Number.isFinite(body.expires_in)
+            ? body.expires_in
+            : 300;
+        const token = {
+            accessToken,
+            webId: tokenWebId,
+            expiresAt: now + expiresIn * 1000,
+        };
+        this.serviceWebId = tokenWebId;
+        this.cachedToken = token;
+        return token;
+    }
+}
+exports.ClientCredentialsInternalPodAccessTokenProvider = ClientCredentialsInternalPodAccessTokenProvider;
+//# sourceMappingURL=ClientCredentialsInternalPodAccessTokenProvider.js.map

package/dist/api/ai-gateway/auth/ClientCredentialsInternalPodAccessTokenProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ClientCredentialsInternalPodAccessTokenProvider.js","sourceRoot":"","sources":["../../../../src/api/ai-gateway/auth/ClientCredentialsInternalPodAccessTokenProvider.ts"],"names":[],"mappings":";;;AACA,4DAAsF;AAgBtF,MAAa,+CAA+C;IAU1D,YAAmB,OAA+D;QAChF,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC;YAC7D,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;QACjF,CAAC;QACD,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;QAC3C,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;QACzC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;QAC5C,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACrC,CAAC;IAEM,KAAK,CAAC,eAAe,CAAC,MAAc;QACzC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC1C,OAAO,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YAC3B,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC3C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;gBAClC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;YAC9D,CAAC;YACD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QACrD,CAAC,CAAC;IACJ,CAAC;IAEM,KAAK,CAAC,mBAAmB;QAC9B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC1C,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;IAChC,CAAC;IAEO,KAAK,CAAC,cAAc;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,CAAC,SAAS,GAAG,MAAM,GAAG,GAAG,EAAE,CAAC;YAClE,OAAO,IAAI,CAAC,WAAW,CAAC;QAC1B,CAAC;QACD,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,OAAO,IAAI,CAAC,YAAY,CAAC;QAC3B,CAAC;QAED,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QAC5C,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,YAAY,CAAC;QACjC,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,YAAY,GAAG,SAAS,CAAC;QAChC,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,GAAW;QACrC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE;YACxD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,mCAAmC;aACpD;YACD,IAAI,EAAE,IAAI,eAAe,CAAC;gBACxB,UAAU,EAAE,oBAAoB;gBAChC,SAAS,EAAE,IAAI,CAAC,QAAQ;gBACxB,aAAa,EAAE,IAAI,CAAC,YAAY;gBAChC,KAAK,EAAE,OAAO;aACf,CAAC;SACH,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,oDAAoD,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAA6B,CAAC;QAC9D,MAAM,WAAW,GAAG,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1F,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;QAC9E,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,UAAU,GAAG,IAAA,0DAA0C,EAAC,IAAI,CAAC,CAAC;QACpE,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;QACrF,CAAC;QACD,IAAI,IAAI,CAAC,YAAY,IAAI,UAAU,KAAK,IAAI,CAAC,YAAY,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5D,CAAC;QACD,MAAM,SAAS,GAAG,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC;YACvF,CAAC,CAAC,IAAI,CAAC,UAAU;YACjB,CAAC,CAAC,GAAG,CAAC;QACR,MAAM,KAAK,GAAgB;YACzB,WAAW;YACX,KAAK,EAAE,UAAU;YACjB,SAAS,EAAE,GAAG,GAAG,SAAS,GAAG,IAAI;SAClC,CAAC;QACF,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC;QAC/B,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC;QACzB,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AAjGD,0GAiGC","sourcesContent":["import type { InternalPodAccessTokenProvider } from './PodGatewayAccessKeyRepository';\nimport { extractAuthoritativeWebIdFromTokenResponse } from '../../auth/TokenIdentity';\n\nexport interface ClientCredentialsInternalPodAccessTokenProviderOptions {\n  tokenEndpoint: string;\n  clientId: string;\n  clientSecret: string;\n  fetchImpl?: typeof fetch;\n  now?: () => number;\n}\n\ntype CachedToken = {\n  accessToken: string;\n  webId: string;\n  expiresAt: number;\n};\n\nexport class ClientCredentialsInternalPodAccessTokenProvider implements InternalPodAccessTokenProvider {\n  private readonly tokenEndpoint: string;\n  private readonly clientId: string;\n  private readonly clientSecret: string;\n  private readonly fetchImpl: typeof fetch;\n  private readonly now: () => number;\n  private cachedToken?: CachedToken;\n  private tokenRequest?: Promise<CachedToken>;\n  private serviceWebId?: string;\n\n  public constructor(options: ClientCredentialsInternalPodAccessTokenProviderOptions) {\n    if (!options.clientId.trim() || !options.clientSecret.trim()) {\n      throw new Error('Gateway internal Pod access client credentials are required');\n    }\n    this.tokenEndpoint = options.tokenEndpoint;\n    this.clientId = options.clientId;\n    this.clientSecret = options.clientSecret;\n    this.fetchImpl = options.fetchImpl ?? fetch;\n    this.now = options.now ?? Date.now;\n  }\n\n  public async getTrustedFetch(_owner: string): Promise<typeof fetch | undefined> {\n    const token = await this.getAccessToken();\n    return async (input, init) => {\n      const headers = new Headers(init?.headers);\n      if (!headers.has('Authorization')) {\n        headers.set('Authorization', `Bearer ${token.accessToken}`);\n      }\n      return this.fetchImpl(input, { ...init, headers });\n    };\n  }\n\n  public async getServicePrincipal(): Promise<{ webId: string }> {\n    const token = await this.getAccessToken();\n    return { webId: token.webId };\n  }\n\n  private async getAccessToken(): Promise<CachedToken> {\n    const now = this.now();\n    if (this.cachedToken && this.cachedToken.expiresAt - 30_000 > now) {\n      return this.cachedToken;\n    }\n    if (this.tokenRequest) {\n      return this.tokenRequest;\n    }\n\n    this.tokenRequest = this.exchangeToken(now);\n    try {\n      return await this.tokenRequest;\n    } finally {\n      this.tokenRequest = undefined;\n    }\n  }\n\n  private async exchangeToken(now: number): Promise<CachedToken> {\n    const response = await this.fetchImpl(this.tokenEndpoint, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/x-www-form-urlencoded',\n      },\n      body: new URLSearchParams({\n        grant_type: 'client_credentials',\n        client_id: this.clientId,\n        client_secret: this.clientSecret,\n        scope: 'webid',\n      }),\n    });\n    if (!response.ok) {\n      throw new Error(`Gateway internal Pod token exchange failed: HTTP ${response.status}`);\n    }\n    const body = await response.json() as Record<string, unknown>;\n    const accessToken = typeof body.access_token === 'string' ? body.access_token : undefined;\n    if (!accessToken) {\n      throw new Error('Gateway internal Pod token response missing access_token');\n    }\n    if (body.token_type !== 'Bearer') {\n      throw new Error('Gateway internal service token must be Bearer');\n    }\n    const tokenWebId = extractAuthoritativeWebIdFromTokenResponse(body);\n    if (!tokenWebId) {\n      throw new Error('Gateway internal Pod token response missing authoritative WebID');\n    }\n    if (this.serviceWebId && tokenWebId !== this.serviceWebId) {\n      throw new Error('Gateway internal service WebID changed');\n    }\n    const expiresIn = typeof body.expires_in === 'number' && Number.isFinite(body.expires_in)\n      ? body.expires_in\n      : 300;\n    const token: CachedToken = {\n      accessToken,\n      webId: tokenWebId,\n      expiresAt: now + expiresIn * 1000,\n    };\n    this.serviceWebId = tokenWebId;\n    this.cachedToken = token;\n    return token;\n  }\n}\n"]}

package/dist/api/ai-gateway/auth/GatewayApiKey.d.ts

@@ -0,0 +1,28 @@
+export type GatewayDeployment = 'local' | 'cloud';
+export interface ParsedGatewayApiKey {
+    version: 'v1';
+    deployment: GatewayDeployment;
+    keyId: string;
+    secret: string;
+}
+export interface GatewayApiKeyRecordInput {
+    id: string;
+    secretHash: string;
+    deployment: GatewayDeployment;
+}
+export interface CreatedGatewayApiKey {
+    plaintext: string;
+    secret: string;
+    record: GatewayApiKeyRecordInput;
+}
+export interface CreateGatewayApiKeyInput {
+    deployment: GatewayDeployment;
+    keyId?: string;
+    secret?: string;
+}
+export declare function createGatewayApiKey(input: CreateGatewayApiKeyInput): Promise<CreatedGatewayApiKey>;
+export declare function createGatewayKeyId(): string;
+export declare function formatGatewayApiKey(parsed: ParsedGatewayApiKey): string;
+export declare function parseGatewayApiKey(value: string): ParsedGatewayApiKey | undefined;
+export declare function hashGatewayApiKeySecret(secret: string): Promise<string>;
+export declare function verifyGatewayApiKeySecret(secret: string, encodedHash: string): Promise<boolean>;

package/dist/api/ai-gateway/auth/GatewayApiKey.js

@@ -0,0 +1,162 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createGatewayApiKey = createGatewayApiKey;
+exports.createGatewayKeyId = createGatewayKeyId;
+exports.formatGatewayApiKey = formatGatewayApiKey;
+exports.parseGatewayApiKey = parseGatewayApiKey;
+exports.hashGatewayApiKeySecret = hashGatewayApiKeySecret;
+exports.verifyGatewayApiKeySecret = verifyGatewayApiKeySecret;
+const node_crypto_1 = require("node:crypto");
+const PREFIX = 'xpod_gw';
+const VERSION = 'v1';
+const SECRET_BYTES = 32;
+const KEY_ID_BYTES = 18;
+const SCRYPT_KEY_BYTES = 32;
+const SCRYPT_N = 16_384;
+const SCRYPT_R = 8;
+const SCRYPT_P = 1;
+const SCRYPT_MAXMEM = 32 * 1024 * 1024;
+async function createGatewayApiKey(input) {
+    const keyId = input.keyId ?? createGatewayKeyId();
+    const secret = input.secret ?? randomBase64Url(SECRET_BYTES);
+    const plaintext = formatGatewayApiKey({
+        version: VERSION,
+        deployment: input.deployment,
+        keyId,
+        secret,
+    });
+    return {
+        plaintext,
+        secret,
+        record: {
+            id: keyId,
+            deployment: input.deployment,
+            secretHash: await hashGatewayApiKeySecret(secret),
+        },
+    };
+}
+function createGatewayKeyId() {
+    return `gak_${randomBase64Url(KEY_ID_BYTES)}`;
+}
+function formatGatewayApiKey(parsed) {
+    assertDeployment(parsed.deployment);
+    if (!parsed.keyId || parsed.keyId.includes(' ') || parsed.keyId.includes('/')) {
+        throw new Error('Invalid Gateway API key id');
+    }
+    if (!parsed.secret || !/^[A-Za-z0-9-]+$/.test(parsed.secret)) {
+        throw new Error('Invalid Gateway API key secret');
+    }
+    return `${PREFIX}_${parsed.version}_${parsed.deployment}_${parsed.keyId}_${parsed.secret}`;
+}
+function parseGatewayApiKey(value) {
+    const parts = value.split('_');
+    if (parts.length < 6 || parts[0] !== 'xpod' || parts[1] !== 'gw' || parts[2] !== VERSION) {
+        return undefined;
+    }
+    const deployment = parts[3];
+    if (deployment !== 'local' && deployment !== 'cloud') {
+        return undefined;
+    }
+    const secret = parts[parts.length - 1];
+    const keyId = parts.slice(4, -1).join('_');
+    if (!keyId || !secret || !/^[A-Za-z0-9-]+$/.test(secret)) {
+        return undefined;
+    }
+    return {
+        version: VERSION,
+        deployment,
+        keyId,
+        secret,
+    };
+}
+async function hashGatewayApiKeySecret(secret) {
+    const salt = randomBase64Url(16);
+    const key = await deriveScrypt(secret, salt, SCRYPT_N, SCRYPT_R, SCRYPT_P);
+    return [
+        'scrypt',
+        'v=1',
+        `N=${SCRYPT_N}`,
+        `r=${SCRYPT_R}`,
+        `p=${SCRYPT_P}`,
+        `salt=${salt}`,
+        `key=${key.toString('base64url')}`,
+    ].join('$');
+}
+async function verifyGatewayApiKeySecret(secret, encodedHash) {
+    const parsed = parseScryptHash(encodedHash);
+    if (!parsed) {
+        return false;
+    }
+    let actual;
+    try {
+        actual = await deriveScrypt(secret, parsed.salt, parsed.N, parsed.r, parsed.p);
+    }
+    catch {
+        return false;
+    }
+    const expected = Buffer.from(parsed.key, 'base64url');
+    if (actual.byteLength !== expected.byteLength) {
+        const paddedActual = Buffer.alloc(SCRYPT_KEY_BYTES);
+        const paddedExpected = Buffer.alloc(SCRYPT_KEY_BYTES);
+        actual.copy(paddedActual, 0, 0, Math.min(actual.byteLength, SCRYPT_KEY_BYTES));
+        expected.copy(paddedExpected, 0, 0, Math.min(expected.byteLength, SCRYPT_KEY_BYTES));
+        (0, node_crypto_1.timingSafeEqual)(paddedActual, paddedExpected);
+        return false;
+    }
+    return (0, node_crypto_1.timingSafeEqual)(actual, expected);
+}
+function parseScryptHash(encodedHash) {
+    const parts = encodedHash.split('$');
+    if (parts.length !== 7
+        || parts[0] !== 'scrypt'
+        || parts[1] !== 'v=1'
+        || parts[2] !== `N=${SCRYPT_N}`
+        || parts[3] !== `r=${SCRYPT_R}`
+        || parts[4] !== `p=${SCRYPT_P}`
+        || !parts[5]?.startsWith('salt=')
+        || !parts[6]?.startsWith('key=')) {
+        return undefined;
+    }
+    const salt = parts[5].slice('salt='.length);
+    const key = parts[6].slice('key='.length);
+    if (!isBase64UrlBytes(salt, 16) || !isBase64UrlBytes(key, SCRYPT_KEY_BYTES)) {
+        return undefined;
+    }
+    return { N: SCRYPT_N, r: SCRYPT_R, p: SCRYPT_P, salt, key };
+}
+function isBase64UrlBytes(value, bytes) {
+    if (!/^[A-Za-z0-9_-]+$/.test(value)) {
+        return false;
+    }
+    try {
+        return Buffer.from(value, 'base64url').byteLength === bytes;
+    }
+    catch {
+        return false;
+    }
+}
+async function deriveScrypt(secret, salt, N, r, p) {
+    return await new Promise((resolve, reject) => {
+        (0, node_crypto_1.scrypt)(secret, salt, SCRYPT_KEY_BYTES, {
+            N,
+            r,
+            p,
+            maxmem: SCRYPT_MAXMEM,
+        }, (error, derivedKey) => {
+            if (error) {
+                reject(error);
+                return;
+            }
+            resolve(derivedKey);
+        });
+    });
+}
+function randomBase64Url(bytes) {
+    return (0, node_crypto_1.randomBytes)(bytes).toString('base64url').replaceAll('_', '-');
+}
+function assertDeployment(deployment) {
+    if (deployment !== 'local' && deployment !== 'cloud') {
+        throw new Error(`Invalid Gateway API key deployment: ${deployment}`);
+    }
+}
+//# sourceMappingURL=GatewayApiKey.js.map

package/dist/api/ai-gateway/auth/GatewayApiKey.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"GatewayApiKey.js","sourceRoot":"","sources":["../../../../src/api/ai-gateway/auth/GatewayApiKey.ts"],"names":[],"mappings":";;AAuCA,kDAkBC;AAED,gDAEC;AAGD,kDASC;AAED,gDAoBC;AAED,0DAYC;AAED,8DAqBC;AApID,6CAAmE;AA6BnE,MAAM,MAAM,GAAG,SAAS,CAAC;AACzB,MAAM,OAAO,GAAG,IAAI,CAAC;AACrB,MAAM,YAAY,GAAG,EAAE,CAAC;AACxB,MAAM,YAAY,GAAG,EAAE,CAAC;AACxB,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAC5B,MAAM,QAAQ,GAAG,MAAM,CAAC;AACxB,MAAM,QAAQ,GAAG,CAAC,CAAC;AACnB,MAAM,QAAQ,GAAG,CAAC,CAAC;AACnB,MAAM,aAAa,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAEhC,KAAK,UAAU,mBAAmB,CAAC,KAA+B;IACvE,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,kBAAkB,EAAE,CAAC;IAClD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,eAAe,CAAC,YAAY,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,mBAAmB,CAAC;QACpC,OAAO,EAAE,OAAO;QAChB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,KAAK;QACL,MAAM;KACP,CAAC,CAAC;IACH,OAAO;QACL,SAAS;QACT,MAAM;QACN,MAAM,EAAE;YACN,EAAE,EAAE,KAAK;YACT,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,UAAU,EAAE,MAAM,uBAAuB,CAAC,MAAM,CAAC;SAClD;KACF,CAAC;AACJ,CAAC;AAED,SAAgB,kBAAkB;IAChC,OAAO,OAAO,eAAe,CAAC,YAAY,CAAC,EAAE,CAAC;AAChD,CAAC;AAGD,SAAgB,mBAAmB,CAAC,MAA2B;IAC7D,gBAAgB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACpC,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;AAC7F,CAAC;AAED,SAAgB,kBAAkB,CAAC,KAAa;IAC9C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC;QACzF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IAC5B,IAAI,UAAU,KAAK,OAAO,IAAI,UAAU,KAAK,OAAO,EAAE,CAAC;QACrD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3C,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACzD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO;QACL,OAAO,EAAE,OAAO;QAChB,UAAU;QACV,KAAK;QACL,MAAM;KACP,CAAC;AACJ,CAAC;AAEM,KAAK,UAAU,uBAAuB,CAAC,MAAc;IAC1D,MAAM,IAAI,GAAG,eAAe,CAAC,EAAE,CAAC,CAAC;IACjC,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC3E,OAAO;QACL,QAAQ;QACR,KAAK;QACL,KAAK,QAAQ,EAAE;QACf,KAAK,QAAQ,EAAE;QACf,KAAK,QAAQ,EAAE;QACf,QAAQ,IAAI,EAAE;QACd,OAAO,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE;KACnC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACd,CAAC;AAEM,KAAK,UAAU,yBAAyB,CAAC,MAAc,EAAE,WAAmB;IACjF,MAAM,MAAM,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IACjF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IACtD,IAAI,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU,EAAE,CAAC;QAC9C,MAAM,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACpD,MAAM,cAAc,GAAG,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACtD,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAC,CAAC;QAC/E,QAAQ,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAC,CAAC;QACrF,IAAA,6BAAe,EAAC,YAAY,EAAE,cAAc,CAAC,CAAC;QAC9C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAA,6BAAe,EAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,eAAe,CAAC,WAAmB;IAO1C,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACrC,IACE,KAAK,CAAC,MAAM,KAAK,CAAC;WACf,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ;WACrB,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK;WAClB,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,QAAQ,EAAE;WAC5B,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,QAAQ,EAAE;WAC5B,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,QAAQ,EAAE;WAC5B,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,OAAO,CAAC;WAC9B,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,MAAM,CAAC,EAChC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,gBAAgB,CAAC,EAAE,CAAC;QAC5E,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AAC9D,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa,EAAE,KAAa;IACpD,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACpC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,UAAU,KAAK,KAAK,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,MAAc,EACd,IAAY,EACZ,CAAS,EACT,CAAS,EACT,CAAS;IAET,OAAO,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC3C,IAAA,oBAAM,EAAC,MAAM,EAAE,IAAI,EAAE,gBAAgB,EAAE;YACrC,CAAC;YACD,CAAC;YACD,CAAC;YACD,MAAM,EAAE,aAAa;SACtB,EAAE,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE;YACvB,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,CAAC,KAAK,CAAC,CAAC;gBACd,OAAO;YACT,CAAC;YACD,OAAO,CAAC,UAAU,CAAC,CAAC;QACtB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,OAAO,IAAA,yBAAW,EAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,gBAAgB,CAAC,UAAkB;IAC1C,IAAI,UAAU,KAAK,OAAO,IAAI,UAAU,KAAK,OAAO,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,uCAAuC,UAAU,EAAE,CAAC,CAAC;IACvE,CAAC;AACH,CAAC","sourcesContent":["import { randomBytes, scrypt, timingSafeEqual } from 'node:crypto';\n\nexport type GatewayDeployment = 'local' | 'cloud';\n\nexport interface ParsedGatewayApiKey {\n  version: 'v1';\n  deployment: GatewayDeployment;\n  keyId: string;\n  secret: string;\n}\n\nexport interface GatewayApiKeyRecordInput {\n  id: string;\n  secretHash: string;\n  deployment: GatewayDeployment;\n}\n\nexport interface CreatedGatewayApiKey {\n  plaintext: string;\n  secret: string;\n  record: GatewayApiKeyRecordInput;\n}\n\nexport interface CreateGatewayApiKeyInput {\n  deployment: GatewayDeployment;\n  keyId?: string;\n  secret?: string;\n}\n\nconst PREFIX = 'xpod_gw';\nconst VERSION = 'v1';\nconst SECRET_BYTES = 32;\nconst KEY_ID_BYTES = 18;\nconst SCRYPT_KEY_BYTES = 32;\nconst SCRYPT_N = 16_384;\nconst SCRYPT_R = 8;\nconst SCRYPT_P = 1;\nconst SCRYPT_MAXMEM = 32 * 1024 * 1024;\n\nexport async function createGatewayApiKey(input: CreateGatewayApiKeyInput): Promise<CreatedGatewayApiKey> {\n  const keyId = input.keyId ?? createGatewayKeyId();\n  const secret = input.secret ?? randomBase64Url(SECRET_BYTES);\n  const plaintext = formatGatewayApiKey({\n    version: VERSION,\n    deployment: input.deployment,\n    keyId,\n    secret,\n  });\n  return {\n    plaintext,\n    secret,\n    record: {\n      id: keyId,\n      deployment: input.deployment,\n      secretHash: await hashGatewayApiKeySecret(secret),\n    },\n  };\n}\n\nexport function createGatewayKeyId(): string {\n  return `gak_${randomBase64Url(KEY_ID_BYTES)}`;\n}\n\n\nexport function formatGatewayApiKey(parsed: ParsedGatewayApiKey): string {\n  assertDeployment(parsed.deployment);\n  if (!parsed.keyId || parsed.keyId.includes(' ') || parsed.keyId.includes('/')) {\n    throw new Error('Invalid Gateway API key id');\n  }\n  if (!parsed.secret || !/^[A-Za-z0-9-]+$/.test(parsed.secret)) {\n    throw new Error('Invalid Gateway API key secret');\n  }\n  return `${PREFIX}_${parsed.version}_${parsed.deployment}_${parsed.keyId}_${parsed.secret}`;\n}\n\nexport function parseGatewayApiKey(value: string): ParsedGatewayApiKey | undefined {\n  const parts = value.split('_');\n  if (parts.length < 6 || parts[0] !== 'xpod' || parts[1] !== 'gw' || parts[2] !== VERSION) {\n    return undefined;\n  }\n  const deployment = parts[3];\n  if (deployment !== 'local' && deployment !== 'cloud') {\n    return undefined;\n  }\n  const secret = parts[parts.length - 1];\n  const keyId = parts.slice(4, -1).join('_');\n  if (!keyId || !secret || !/^[A-Za-z0-9-]+$/.test(secret)) {\n    return undefined;\n  }\n  return {\n    version: VERSION,\n    deployment,\n    keyId,\n    secret,\n  };\n}\n\nexport async function hashGatewayApiKeySecret(secret: string): Promise<string> {\n  const salt = randomBase64Url(16);\n  const key = await deriveScrypt(secret, salt, SCRYPT_N, SCRYPT_R, SCRYPT_P);\n  return [\n    'scrypt',\n    'v=1',\n    `N=${SCRYPT_N}`,\n    `r=${SCRYPT_R}`,\n    `p=${SCRYPT_P}`,\n    `salt=${salt}`,\n    `key=${key.toString('base64url')}`,\n  ].join('$');\n}\n\nexport async function verifyGatewayApiKeySecret(secret: string, encodedHash: string): Promise<boolean> {\n  const parsed = parseScryptHash(encodedHash);\n  if (!parsed) {\n    return false;\n  }\n  let actual: Buffer;\n  try {\n    actual = await deriveScrypt(secret, parsed.salt, parsed.N, parsed.r, parsed.p);\n  } catch {\n    return false;\n  }\n  const expected = Buffer.from(parsed.key, 'base64url');\n  if (actual.byteLength !== expected.byteLength) {\n    const paddedActual = Buffer.alloc(SCRYPT_KEY_BYTES);\n    const paddedExpected = Buffer.alloc(SCRYPT_KEY_BYTES);\n    actual.copy(paddedActual, 0, 0, Math.min(actual.byteLength, SCRYPT_KEY_BYTES));\n    expected.copy(paddedExpected, 0, 0, Math.min(expected.byteLength, SCRYPT_KEY_BYTES));\n    timingSafeEqual(paddedActual, paddedExpected);\n    return false;\n  }\n  return timingSafeEqual(actual, expected);\n}\n\nfunction parseScryptHash(encodedHash: string): {\n  N: number;\n  r: number;\n  p: number;\n  salt: string;\n  key: string;\n} | undefined {\n  const parts = encodedHash.split('$');\n  if (\n    parts.length !== 7\n    || parts[0] !== 'scrypt'\n    || parts[1] !== 'v=1'\n    || parts[2] !== `N=${SCRYPT_N}`\n    || parts[3] !== `r=${SCRYPT_R}`\n    || parts[4] !== `p=${SCRYPT_P}`\n    || !parts[5]?.startsWith('salt=')\n    || !parts[6]?.startsWith('key=')\n  ) {\n    return undefined;\n  }\n  const salt = parts[5].slice('salt='.length);\n  const key = parts[6].slice('key='.length);\n  if (!isBase64UrlBytes(salt, 16) || !isBase64UrlBytes(key, SCRYPT_KEY_BYTES)) {\n    return undefined;\n  }\n  return { N: SCRYPT_N, r: SCRYPT_R, p: SCRYPT_P, salt, key };\n}\n\nfunction isBase64UrlBytes(value: string, bytes: number): boolean {\n  if (!/^[A-Za-z0-9_-]+$/.test(value)) {\n    return false;\n  }\n  try {\n    return Buffer.from(value, 'base64url').byteLength === bytes;\n  } catch {\n    return false;\n  }\n}\n\nasync function deriveScrypt(\n  secret: string,\n  salt: string,\n  N: number,\n  r: number,\n  p: number,\n): Promise<Buffer> {\n  return await new Promise((resolve, reject) => {\n    scrypt(secret, salt, SCRYPT_KEY_BYTES, {\n      N,\n      r,\n      p,\n      maxmem: SCRYPT_MAXMEM,\n    }, (error, derivedKey) => {\n      if (error) {\n        reject(error);\n        return;\n      }\n      resolve(derivedKey);\n    });\n  });\n}\n\nfunction randomBase64Url(bytes: number): string {\n  return randomBytes(bytes).toString('base64url').replaceAll('_', '-');\n}\n\nfunction assertDeployment(deployment: string): asserts deployment is GatewayDeployment {\n  if (deployment !== 'local' && deployment !== 'cloud') {\n    throw new Error(`Invalid Gateway API key deployment: ${deployment}`);\n  }\n}\n"]}

package/dist/api/ai-gateway/auth/GatewayApiKeyAuthenticator.d.ts

@@ -0,0 +1,56 @@
+import type { IncomingMessage } from 'node:http';
+import type { Authenticator, AuthResult } from '../../auth/Authenticator';
+import type { AuthContext } from '../../auth/AuthContext';
+import { type GatewayDeployment } from './GatewayApiKey';
+import type { InvocationTokenCodec } from './InvocationTokenCodec';
+export interface GatewayAccessKeyRecord {
+    id: string;
+    owner: string;
+    secretHash: string;
+    deployment: GatewayDeployment;
+    scopes: string[];
+    createdAt: Date;
+    expiresAt?: Date;
+    lastUsedAt?: Date;
+    revokedAt?: Date;
+    name?: string;
+}
+export interface GatewayAccessKeyRepositoryContext {
+    auth?: AuthContext;
+}
+export interface GatewayAccessKeyRepository {
+    createKeyId?(owner: string, deployment: GatewayDeployment): string;
+    create(record: GatewayAccessKeyRecord, context?: GatewayAccessKeyRepositoryContext): Promise<GatewayAccessKeyRecord>;
+    findById(id: string): Promise<GatewayAccessKeyRecord | undefined>;
+    listByOwner(owner: string, context?: GatewayAccessKeyRepositoryContext): Promise<GatewayAccessKeyRecord[]>;
+    revoke(id: string, revokedAt: Date, context?: GatewayAccessKeyRepositoryContext): Promise<GatewayAccessKeyRecord | undefined>;
+    touchLastUsed(id: string, lastUsedAt: Date): Promise<void>;
+}
+export interface GatewayApiKeyAuthenticatorOptions {
+    repository: GatewayAccessKeyRepository;
+    deployment: GatewayDeployment;
+    requiredScopes?: string[];
+    invocationTokenCodec?: InvocationTokenCodec;
+    invocationTokenAudience?: string;
+    invocationTokenIssuer?: string;
+    now?: () => Date;
+    maxClockSkewMs?: number;
+}
+export declare const DEFAULT_GATEWAY_API_KEY_SCOPES: readonly ["models:read", "inference:write"];
+export declare class GatewayApiKeyAuthenticator implements Authenticator {
+    private readonly repository;
+    private readonly deployment;
+    private readonly requiredScopes;
+    private readonly invocationTokenCodec?;
+    private readonly invocationTokenAudience?;
+    private readonly invocationTokenIssuer?;
+    private readonly now;
+    private readonly maxClockSkewMs;
+    private readonly dummyHash;
+    constructor(options: GatewayApiKeyAuthenticatorOptions);
+    canAuthenticate(request: IncomingMessage): boolean;
+    authenticate(request: IncomingMessage): Promise<AuthResult>;
+    private authenticateInvocationToken;
+    private validInvocationClaims;
+    private readBearer;
+}