@undefineds.co/xpod 0.3.58 → 0.3.62

package/dist/api/ai-gateway/auth/InvocationTokenCodec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"InvocationTokenCodec.js","sourceRoot":"","sources":["../../../../src/api/ai-gateway/auth/InvocationTokenCodec.ts"],"names":[],"mappings":";;;AAwLA,wDAmBC;AAyBD,sDAgBC;AApPD,6CAAwF;AAIxF,MAAM,MAAM,GAAG,aAAa,CAAC;AAC7B,MAAM,WAAW,GAAG,qCAAqC,CAAC;AAC1D,MAAM,WAAW,GAAG,EAAE,CAAC;AACvB,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAC/B,MAAM,oBAAoB,GAAG,KAAK,CAAC;AACnC,MAAM,UAAU,GAAG,EAAE,GAAG,MAAM,CAAC;AAC/B,MAAM,UAAU,GAAG,CAAC,CAAC;AAoCrB,MAAa,uBAAuB;IAIlC,YAAmB,OAAuC;QAFzC,SAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;QAGhD,IAAI,CAAC,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC9C,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChD,KAAK,MAAM,QAAQ,IAAI,OAAO,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;YAC9C,MAAM,UAAU,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;YAC7C,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClC,MAAM,IAAI,KAAK,CAAC,sCAAsC,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC;YAC1E,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IAEM,MAAM,CAAC,KAA2B;QACvC,MAAM,KAAK,GAAG,qBAAqB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACjD,MAAM,QAAQ,GAAG,sBAAsB,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACpE,MAAM,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC9D,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC3C,MAAM,QAAQ,GAAG,gBAAgB,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC9D,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QACjE,IAAI,SAAS,IAAI,QAAQ,IAAI,SAAS,GAAG,QAAQ,GAAG,UAAU,EAAE,CAAC;YAC/D,MAAM,IAAI,KAAK,CAAC,8CAA8C,UAAU,eAAe,CAAC,CAAC;QAC3F,CAAC;QACD,MAAM,OAAO,GAAG;YACd,CAAC,EAAE,CAAC;YACJ,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG;YACpB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,GAAG,EAAE,QAAQ;YACb,GAAG,EAAE,MAAM;YACX,KAAK;YACL,MAAM;YACN,GAAG,EAAE,QAAQ;YACb,GAAG,EAAE,SAAS;YACd,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;SACxD,CAAC;QACF,MAAM,KAAK,GAAG,IAAA,yBAAW,EAAC,WAAW,CAAC,CAAC;QACvC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,WAAW,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;QAC7D,MAAM,MAAM,GAAG,IAAA,4BAAc,EAAC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACrE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACnB,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;YAC/B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;YAC9C,MAAM,CAAC,KAAK,EAAE;SACf,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAChC,OAAO;YACL,MAAM;YACN,IAAI,CAAC,MAAM,CAAC,GAAG;YACf,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC;YAC3B,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC;YAChC,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC;SAC1B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACd,CAAC;IAEM,MAAM,CAAC,KAAa;QACzB,IAAI,KAAK,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;YACpC,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;YAC9C,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACrB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/B,IACE,CAAC,GAAG;eACD,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAClE,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,wBAAwB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACjD,MAAM,UAAU,GAAG,wBAAwB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACtD,MAAM,GAAG,GAAG,wBAAwB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAC/C,IAAI,CAAC,KAAK,IAAI,CAAC,UAAU,IAAI,CAAC,GAAG,EAAE,CAAC;gBAClC,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,IACE,KAAK,CAAC,MAAM,KAAK,WAAW;mBACzB,UAAU,CAAC,MAAM,KAAK,CAAC;mBACvB,UAAU,CAAC,MAAM,GAAG,oBAAoB;mBACxC,GAAG,CAAC,MAAM,KAAK,EAAE,EACpB,CAAC;gBACD,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,MAAM,QAAQ,GAAG,IAAA,8BAAgB,EAAC,aAAa,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;YAC7D,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,WAAW,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC;YACtD,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACzB,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YACjF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAA4B,CAAC;YACjF,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;YACxC,IACE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,mDAAmD;;oBAEtE,MAAM,CAAC,CAAC,KAAK,CAAC;mBACX,MAAM,CAAC,GAAG,KAAK,GAAG;mBAClB,CAAC,MAAM,CAAC,UAAU,KAAK,OAAO,IAAI,MAAM,CAAC,UAAU,KAAK,OAAO,CAAC;mBAChE,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;mBAC9B,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;mBAC9B,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ;mBAChC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;mBAC7B,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;mBAC9B,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;mBAC9B,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;mBAC9B,CAAC,0BAA0B,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAC/C,CAAC;gBACD,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,MAAM,QAAQ,GAAG,sBAAsB,CAAC,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;YAChE,MAAM,MAAM,GAAG,sBAAsB,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YAC5D,MAAM,KAAK,GAAG,qBAAqB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAClD,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC5C,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC1C,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC3C,IAAI,SAAS,IAAI,QAAQ,IAAI,SAAS,GAAG,QAAQ,GAAG,UAAU,EAAE,CAAC;gBAC/D,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,OAAO;gBACL,OAAO,EAAE,CAAC;gBACV,GAAG;gBACH,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,QAAQ;gBACR,MAAM;gBACN,KAAK;gBACL,MAAM;gBACN,QAAQ,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC;gBAC5B,SAAS,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC;gBAC9B,GAAG,EAAE,MAAM,CAAC,GAAG;aAChB,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;CACF;AAvID,0DAuIC;AAED,SAAgB,sBAAsB,CAAC,KAAa,EAAE,IAAI,GAAG,QAAQ;IACnE,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,oBAAoB,IAAI,qCAAqC,CAAC,CAAC;IACjF,CAAC;IACD,IACE,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC;WACpD,GAAG,CAAC,QAAQ;WACZ,GAAG,CAAC,QAAQ;WACZ,GAAG,CAAC,QAAQ,KAAK,GAAG;WACpB,GAAG,CAAC,MAAM;WACV,GAAG,CAAC,IAAI;WACR,GAAG,CAAC,MAAM,KAAK,KAAK,EACvB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,oBAAoB,IAAI,qCAAqC,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,CAAC;AACpB,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAa;IAC7C,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IAChD,OAAO,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AACvE,CAAC;AAED,SAAS,eAAe,CAAC,KAA8B;IACrD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,oCAAoC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IACD,OAAO;QACL,GAAG;QACH,GAAG,EAAE,IAAA,wBAAU,EAAC,QAAQ,CAAC;aACtB,MAAM,CAAC,GAAG,WAAW,IAAI,EAAE,MAAM,CAAC;aAClC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC;aAC5B,MAAM,EAAE;aACR,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC;KAC1B,CAAC;AACJ,CAAC;AAED,SAAgB,qBAAqB,CAAC,KAAa;IACjD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,IACE,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC;WACpD,GAAG,CAAC,QAAQ;WACZ,GAAG,CAAC,QAAQ;WACZ,GAAG,CAAC,IAAI,KAAK,KAAK,EACrB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC;AAClB,CAAC;AAED,SAAS,aAAa,CAAC,KAAgB;IACrC,IACE,KAAK,CAAC,MAAM,KAAK,CAAC;WACf,KAAK,CAAC,MAAM,GAAG,UAAU;WACzB,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,oCAAoC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;WACrG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,EACvC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAa,CAAC;AAChC,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAW,EAAE,IAAY;IACjD,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC;IAClC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,oBAAoB,IAAI,aAAa,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC","sourcesContent":["import { createCipheriv, createDecipheriv, createHash, randomBytes } from 'node:crypto';\nimport type { GatewayDeployment } from './GatewayApiKey';\nimport type { GatewayKeyLocatorSecret } from './GatewayKeyLocatorCodec';\n\nconst PREFIX = 'xpod_inv_v1';\nconst AAD_CONTEXT = 'xpod:gateway:internal-invocation:v1';\nconst NONCE_BYTES = 12;\nconst KEY_BYTES = 32;\nconst MAX_TOKEN_LENGTH = 8_192;\nconst MAX_CIPHERTEXT_BYTES = 4_096;\nconst MAX_TTL_MS = 15 * 60_000;\nconst MAX_SCOPES = 8;\n\nexport interface InvocationTokenClaims {\n  version: 1;\n  kid: string;\n  deployment: GatewayDeployment;\n  audience: string;\n  issuer: string;\n  webId: string;\n  scopes: string[];\n  issuedAt: Date;\n  expiresAt: Date;\n  jti: string;\n}\n\nexport interface InvocationTokenInput {\n  deployment: GatewayDeployment;\n  audience: string;\n  issuer: string;\n  webId: string;\n  scopes: string[];\n  issuedAt: Date;\n  expiresAt: Date;\n  jti?: string;\n}\n\nexport interface InvocationTokenCodec {\n  encode(input: InvocationTokenInput): string;\n  decode(token: string): InvocationTokenClaims | undefined;\n}\n\nexport interface AesInvocationTokenCodecOptions {\n  active: GatewayKeyLocatorSecret;\n  previous?: GatewayKeyLocatorSecret[];\n}\n\nexport class AesInvocationTokenCodec implements InvocationTokenCodec {\n  private readonly active: { kid: string; key: Buffer };\n  private readonly ring = new Map<string, Buffer>();\n\n  public constructor(options: AesInvocationTokenCodecOptions) {\n    this.active = normalizeSecret(options.active);\n    this.ring.set(this.active.kid, this.active.key);\n    for (const previous of options.previous ?? []) {\n      const normalized = normalizeSecret(previous);\n      if (this.ring.has(normalized.kid)) {\n        throw new Error(`Duplicate invocation token key id: ${normalized.kid}`);\n      }\n      this.ring.set(normalized.kid, normalized.key);\n    }\n  }\n\n  public encode(input: InvocationTokenInput): string {\n    const webId = requireCanonicalWebId(input.webId);\n    const audience = requireCanonicalOrigin(input.audience, 'audience');\n    const issuer = requireCanonicalOrigin(input.issuer, 'issuer');\n    const scopes = requireScopes(input.scopes);\n    const issuedAt = requireTimestamp(input.issuedAt, 'issuedAt');\n    const expiresAt = requireTimestamp(input.expiresAt, 'expiresAt');\n    if (expiresAt <= issuedAt || expiresAt - issuedAt > MAX_TTL_MS) {\n      throw new Error(`Invocation token TTL must be between 1 and ${MAX_TTL_MS} milliseconds`);\n    }\n    const payload = {\n      v: 1,\n      kid: this.active.kid,\n      deployment: input.deployment,\n      aud: audience,\n      iss: issuer,\n      webId,\n      scopes,\n      iat: issuedAt,\n      exp: expiresAt,\n      jti: input.jti ?? randomBytes(18).toString('base64url'),\n    };\n    const nonce = randomBytes(NONCE_BYTES);\n    const aad = Buffer.from(`${AAD_CONTEXT}.${this.active.kid}`);\n    const cipher = createCipheriv('aes-256-gcm', this.active.key, nonce);\n    cipher.setAAD(aad);\n    const ciphertext = Buffer.concat([\n      cipher.update(JSON.stringify(payload), 'utf8'),\n      cipher.final(),\n    ]);\n    const tag = cipher.getAuthTag();\n    return [\n      PREFIX,\n      this.active.kid,\n      nonce.toString('base64url'),\n      ciphertext.toString('base64url'),\n      tag.toString('base64url'),\n    ].join('.');\n  }\n\n  public decode(token: string): InvocationTokenClaims | undefined {\n    if (token.length > MAX_TOKEN_LENGTH) {\n      return undefined;\n    }\n    const parts = token.split('.');\n    if (parts.length !== 5 || parts[0] !== PREFIX) {\n      return undefined;\n    }\n    const kid = parts[1];\n    const key = this.ring.get(kid);\n    if (\n      !key\n      || !parts.slice(1).every((part) => /^[A-Za-z0-9_-]+$/u.test(part))\n    ) {\n      return undefined;\n    }\n    try {\n      const nonce = decodeCanonicalBase64Url(parts[2]);\n      const ciphertext = decodeCanonicalBase64Url(parts[3]);\n      const tag = decodeCanonicalBase64Url(parts[4]);\n      if (!nonce || !ciphertext || !tag) {\n        return undefined;\n      }\n      if (\n        nonce.length !== NONCE_BYTES\n        || ciphertext.length === 0\n        || ciphertext.length > MAX_CIPHERTEXT_BYTES\n        || tag.length !== 16\n      ) {\n        return undefined;\n      }\n      const decipher = createDecipheriv('aes-256-gcm', key, nonce);\n      decipher.setAAD(Buffer.from(`${AAD_CONTEXT}.${kid}`));\n      decipher.setAuthTag(tag);\n      const plaintext = Buffer.concat([decipher.update(ciphertext), decipher.final()]);\n      const parsed = JSON.parse(plaintext.toString('utf8')) as Record<string, unknown>;\n      const keys = Object.keys(parsed).sort();\n      if (\n        keys.join(',') !== 'aud,deployment,exp,iat,iss,jti,kid,scopes,v,webId'\n        ||\n        parsed.v !== 1\n        || parsed.kid !== kid\n        || (parsed.deployment !== 'local' && parsed.deployment !== 'cloud')\n        || typeof parsed.aud !== 'string'\n        || typeof parsed.iss !== 'string'\n        || typeof parsed.webId !== 'string'\n        || !Array.isArray(parsed.scopes)\n        || typeof parsed.iat !== 'number'\n        || typeof parsed.exp !== 'number'\n        || typeof parsed.jti !== 'string'\n        || !/^[A-Za-z0-9_-]{16,128}$/u.test(parsed.jti)\n      ) {\n        return undefined;\n      }\n      const audience = requireCanonicalOrigin(parsed.aud, 'audience');\n      const issuer = requireCanonicalOrigin(parsed.iss, 'issuer');\n      const webId = requireCanonicalWebId(parsed.webId);\n      const scopes = requireScopes(parsed.scopes);\n      const issuedAt = requireEpoch(parsed.iat);\n      const expiresAt = requireEpoch(parsed.exp);\n      if (expiresAt <= issuedAt || expiresAt - issuedAt > MAX_TTL_MS) {\n        return undefined;\n      }\n      return {\n        version: 1,\n        kid,\n        deployment: parsed.deployment,\n        audience,\n        issuer,\n        webId,\n        scopes,\n        issuedAt: new Date(issuedAt),\n        expiresAt: new Date(expiresAt),\n        jti: parsed.jti,\n      };\n    } catch {\n      return undefined;\n    }\n  }\n}\n\nexport function requireCanonicalOrigin(value: string, name = 'origin'): string {\n  let url: URL;\n  try {\n    url = new URL(value);\n  } catch {\n    throw new Error(`Invocation token ${name} must be a canonical HTTP(S) origin`);\n  }\n  if (\n    (url.protocol !== 'https:' && url.protocol !== 'http:')\n    || url.username\n    || url.password\n    || url.pathname !== '/'\n    || url.search\n    || url.hash\n    || url.origin !== value\n  ) {\n    throw new Error(`Invocation token ${name} must be a canonical HTTP(S) origin`);\n  }\n  return url.origin;\n}\n\nfunction decodeCanonicalBase64Url(value: string): Buffer | undefined {\n  const decoded = Buffer.from(value, 'base64url');\n  return decoded.toString('base64url') === value ? decoded : undefined;\n}\n\nfunction normalizeSecret(input: GatewayKeyLocatorSecret): { kid: string; key: Buffer } {\n  const kid = input.kid.trim();\n  if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/u.test(kid)) {\n    throw new Error('Invocation token key id is invalid');\n  }\n  if (!input.secret.trim()) {\n    throw new Error('Invocation token secret is required');\n  }\n  return {\n    kid,\n    key: createHash('sha256')\n      .update(`${AAD_CONTEXT}\\0`, 'utf8')\n      .update(input.secret, 'utf8')\n      .digest()\n      .subarray(0, KEY_BYTES),\n  };\n}\n\nexport function requireCanonicalWebId(value: string): string {\n  let url: URL;\n  try {\n    url = new URL(value);\n  } catch {\n    throw new Error('Invocation token WebID must be a canonical HTTP(S) URL');\n  }\n  if (\n    (url.protocol !== 'https:' && url.protocol !== 'http:')\n    || url.username\n    || url.password\n    || url.href !== value\n  ) {\n    throw new Error('Invocation token WebID must be a canonical HTTP(S) URL');\n  }\n  return url.href;\n}\n\nfunction requireScopes(value: unknown[]): string[] {\n  if (\n    value.length === 0\n    || value.length > MAX_SCOPES\n    || value.some((scope) => typeof scope !== 'string' || !/^[a-z][a-z0-9-]*:[a-z][a-z0-9-]*$/u.test(scope))\n    || new Set(value).size !== value.length\n  ) {\n    throw new Error('Invocation token scopes are invalid');\n  }\n  return [...value] as string[];\n}\n\nfunction requireTimestamp(value: Date, name: string): number {\n  const timestamp = value.getTime();\n  if (!Number.isSafeInteger(timestamp) || timestamp < 0) {\n    throw new Error(`Invocation token ${name} is invalid`);\n  }\n  return timestamp;\n}\n\nfunction requireEpoch(value: number): number {\n  if (!Number.isSafeInteger(value) || value < 0) {\n    throw new Error('Invocation token timestamp is invalid');\n  }\n  return value;\n}\n"]}

package/dist/api/ai-gateway/auth/PodGatewayAccessKeyRepository.d.ts

@@ -0,0 +1,54 @@
+import { gatewayAccessKeyResource, type GatewayAccessKeyRow } from '@undefineds.co/models';
+import type { AuthContext } from '../../auth/AuthContext';
+import { type GatewayKeyLocatorCodec } from './GatewayKeyLocatorCodec';
+import { type GatewayAccessKeyRecord, type GatewayAccessKeyRepository, type GatewayAccessKeyRepositoryContext } from './GatewayApiKeyAuthenticator';
+import type { GatewayDeployment } from './GatewayApiKey';
+type GatewayAccessKeyDb = {
+    init?: (...resources: unknown[]) => Promise<void>;
+    insert(resource: typeof gatewayAccessKeyResource): {
+        values(value: unknown): {
+            execute(): Promise<unknown[]>;
+        };
+    };
+    select(): {
+        from(resource: typeof gatewayAccessKeyResource): {
+            where(condition: unknown): {
+                execute(): Promise<GatewayAccessKeyRow[]>;
+            };
+        };
+    };
+    findById<TRow>(resource: typeof gatewayAccessKeyResource, id: string): Promise<TRow | null>;
+    findByIri<TRow>(resource: typeof gatewayAccessKeyResource, iri: string): Promise<TRow | null>;
+    updateById<TRow>(resource: typeof gatewayAccessKeyResource, id: string, patch: unknown): Promise<TRow | null>;
+};
+type GatewayAccessKeyResource = typeof gatewayAccessKeyResource;
+export interface PodGatewayAccessKeyRepositoryOptions {
+    locatorCodec: GatewayKeyLocatorCodec;
+    internalPodAccess?: InternalPodAccessTokenProvider;
+    dbFactory?: (input: {
+        owner: string;
+        auth?: AuthContext;
+        fetch: typeof fetch;
+        resource?: GatewayAccessKeyResource;
+        listResource?: GatewayAccessKeyResource;
+    }) => Promise<GatewayAccessKeyDb>;
+}
+export interface InternalPodAccessTokenProvider {
+    getTrustedFetch(owner: string): Promise<typeof fetch | undefined>;
+}
+export declare class PodGatewayAccessKeyRepository implements GatewayAccessKeyRepository {
+    private readonly dbFactory;
+    private readonly locatorCodec;
+    private readonly internalPodAccess?;
+    private readonly usesDefaultDbFactory;
+    constructor(options: PodGatewayAccessKeyRepositoryOptions);
+    createKeyId(owner: string, deployment: GatewayDeployment): string;
+    create(record: GatewayAccessKeyRecord, context?: GatewayAccessKeyRepositoryContext): Promise<GatewayAccessKeyRecord>;
+    findById(id: string): Promise<GatewayAccessKeyRecord | undefined>;
+    listByOwner(owner: string, context?: GatewayAccessKeyRepositoryContext): Promise<GatewayAccessKeyRecord[]>;
+    revoke(id: string, revokedAt: Date, context?: GatewayAccessKeyRepositoryContext): Promise<GatewayAccessKeyRecord | undefined>;
+    touchLastUsed(id: string, lastUsedAt: Date): Promise<void>;
+    private dbForOwner;
+    private resolveTrustedFetch;
+}
+export {};

package/dist/api/ai-gateway/auth/PodGatewayAccessKeyRepository.js

@@ -0,0 +1,152 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PodGatewayAccessKeyRepository = void 0;
+const drizzle_solid_1 = require("@undefineds.co/drizzle-solid");
+const models_1 = require("@undefineds.co/models");
+const GatewayKeyLocatorCodec_1 = require("./GatewayKeyLocatorCodec");
+class PodGatewayAccessKeyRepository {
+    constructor(options) {
+        this.locatorCodec = options.locatorCodec;
+        this.internalPodAccess = options.internalPodAccess;
+        this.usesDefaultDbFactory = options.dbFactory === undefined;
+        this.dbFactory = options.dbFactory ?? createDefaultGatewayAccessKeyDb;
+    }
+    createKeyId(owner, deployment) {
+        return (0, GatewayKeyLocatorCodec_1.createGatewayKeyLocator)(owner, deployment, this.locatorCodec);
+    }
+    async create(record, context) {
+        const { db, resource } = await this.dbForOwner(record.owner, context);
+        const valid = models_1.aiGatewayRepository.validateAccessKey(toGatewayAccessKeyInsert(record));
+        await db.insert(resource).values(valid).execute();
+        return recordFromRow(valid);
+    }
+    async findById(id) {
+        const locator = this.locatorCodec.decode(id);
+        if (!locator) {
+            return undefined;
+        }
+        const { db, resource } = await this.dbForOwner(locator.owner);
+        const row = await db.findById(resource, gatewayAccessKeyStorageId(id));
+        return row ? recordFromRow(row) : undefined;
+    }
+    async listByOwner(owner, context) {
+        const { db, listResource } = await this.dbForOwner(owner, context);
+        const rows = await db
+            .select()
+            .from(listResource)
+            .where((0, drizzle_solid_1.eq)(listResource.owner, owner))
+            .execute();
+        return rows.map(recordFromRow).sort((a, b) => b.createdAt.getTime() - a.createdAt.getTime());
+    }
+    async revoke(id, revokedAt, context) {
+        const locator = this.locatorCodec.decode(id);
+        if (!locator) {
+            return undefined;
+        }
+        const { db, resource } = await this.dbForOwner(locator.owner, context);
+        const row = await db.updateById(resource, gatewayAccessKeyStorageId(id), { revokedAt });
+        return row ? recordFromRow(row) : undefined;
+    }
+    async touchLastUsed(id, lastUsedAt) {
+        const locator = this.locatorCodec.decode(id);
+        if (!locator) {
+            return;
+        }
+        const { db, resource } = await this.dbForOwner(locator.owner);
+        await db.updateById(resource, gatewayAccessKeyStorageId(id), { lastUsedAt });
+    }
+    async dbForOwner(owner, context) {
+        const trustedFetch = await this.resolveTrustedFetch(owner);
+        const resource = models_1.gatewayAccessKeyResource;
+        const listResource = this.usesDefaultDbFactory
+            ? createGatewayAccessKeyResource(owner)
+            : models_1.gatewayAccessKeyResource;
+        const db = await this.dbFactory({
+            owner,
+            auth: context?.auth,
+            fetch: trustedFetch,
+            resource,
+            listResource,
+        });
+        await db.init?.(resource, listResource);
+        return { db, resource, listResource };
+    }
+    async resolveTrustedFetch(owner) {
+        const trustedFetch = await this.internalPodAccess?.getTrustedFetch(owner);
+        if (!trustedFetch) {
+            throw new Error('AI Connection service identity is not configured');
+        }
+        return async (input, init) => {
+            const response = await trustedFetch(input, init);
+            if (response.status === 403) {
+                throw new Error('service_access_missing');
+            }
+            return response;
+        };
+    }
+}
+exports.PodGatewayAccessKeyRepository = PodGatewayAccessKeyRepository;
+function createDefaultGatewayAccessKeyDb(input) {
+    const resource = input.resource ?? models_1.gatewayAccessKeyResource;
+    const listResource = input.listResource ?? resource;
+    return Promise.resolve((0, drizzle_solid_1.drizzle)({
+        fetch: input.fetch,
+        info: { webId: input.owner, isLoggedIn: true },
+    }, {
+        schema: {
+            gatewayAccessKey: resource,
+            gatewayAccessKeyList: listResource,
+        },
+    }));
+}
+function createGatewayAccessKeyResource(owner) {
+    const resource = (0, drizzle_solid_1.alias)(models_1.gatewayAccessKeyResource, 'gatewayAccessKeyList');
+    resource.setSparqlEndpoint(`${(0, drizzle_solid_1.resolvePodBaseUrl)(owner).replace(/\/$/u, '')}/-/sparql`);
+    return resource;
+}
+function toGatewayAccessKeyInsert(record) {
+    return {
+        id: gatewayAccessKeyStorageId(record.id),
+        owner: record.owner,
+        secretHash: record.secretHash,
+        deployment: record.deployment,
+        scopes: record.scopes,
+        createdAt: record.createdAt,
+        expiresAt: record.expiresAt,
+        lastUsedAt: record.lastUsedAt,
+        revokedAt: record.revokedAt,
+        name: record.name,
+    };
+}
+function recordFromRow(row) {
+    return {
+        id: gatewayAccessKeyLocatorFromStorageId(String(row.id)),
+        owner: String(row.owner),
+        secretHash: String(row.secretHash),
+        deployment: row.deployment === 'local' ? 'local' : 'cloud',
+        scopes: Array.isArray(row.scopes) ? row.scopes.map(String) : [],
+        createdAt: toDate(row.createdAt) ?? new Date(0),
+        expiresAt: toDate(row.expiresAt),
+        lastUsedAt: toDate(row.lastUsedAt),
+        revokedAt: toDate(row.revokedAt),
+        name: typeof row.name === 'string' ? row.name : undefined,
+    };
+}
+function gatewayAccessKeyStorageId(locator) {
+    return models_1.gatewayAccessKeyResource.buildId({ id: locator });
+}
+function gatewayAccessKeyLocatorFromStorageId(id) {
+    const fragment = id.lastIndexOf('#');
+    return fragment >= 0 ? id.slice(fragment + 1) : id;
+}
+function toDate(value) {
+    if (value instanceof Date) {
+        return value;
+    }
+    if (typeof value === 'string' || typeof value === 'number') {
+        const parsed = new Date(value);
+        return Number.isNaN(parsed.getTime()) ? undefined : parsed;
+    }
+    return undefined;
+}
+//# sourceMappingURL=PodGatewayAccessKeyRepository.js.map

package/dist/api/ai-gateway/auth/PodGatewayAccessKeyRepository.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PodGatewayAccessKeyRepository.js","sourceRoot":"","sources":["../../../../src/api/ai-gateway/auth/PodGatewayAccessKeyRepository.ts"],"names":[],"mappings":";;;AAAA,gEAAqF;AACrF,kDAI+B;AAE/B,qEAAgG;AAyChG,MAAa,6BAA6B;IAMxC,YAAmB,OAA6C;QAC9D,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;QACzC,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC;QACnD,IAAI,CAAC,oBAAoB,GAAG,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC;QAC5D,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,+BAA+B,CAAC;IACxE,CAAC;IAEM,WAAW,CAAC,KAAa,EAAE,UAA6B;QAC7D,OAAO,IAAA,gDAAuB,EAAC,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IACvE,CAAC;IAEM,KAAK,CAAC,MAAM,CACjB,MAA8B,EAC9B,OAA2C;QAE3C,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACtE,MAAM,KAAK,GAAG,4BAAmB,CAAC,iBAAiB,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC,CAAC;QACtF,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;QAClD,OAAO,aAAa,CAAC,KAA4B,CAAC,CAAC;IACrD,CAAC;IAEM,KAAK,CAAC,QAAQ,CAAC,EAAU;QAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC9D,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAsB,QAAQ,EAAE,yBAAyB,CAAC,EAAE,CAAC,CAAC,CAAC;QAC5F,OAAO,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9C,CAAC;IAEM,KAAK,CAAC,WAAW,CACtB,KAAa,EACb,OAA2C;QAE3C,MAAM,EAAE,EAAE,EAAE,YAAY,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACnE,MAAM,IAAI,GAAG,MAAM,EAAE;aAClB,MAAM,EAAE;aACR,IAAI,CAAC,YAAY,CAAC;aAClB,KAAK,CAAC,IAAA,kBAAE,EAAC,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;aACpC,OAAO,EAAE,CAAC;QACb,OAAO,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/F,CAAC;IAEM,KAAK,CAAC,MAAM,CACjB,EAAU,EACV,SAAe,EACf,OAA2C;QAE3C,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACvE,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,UAAU,CAC7B,QAAQ,EACR,yBAAyB,CAAC,EAAE,CAAC,EAC7B,EAAE,SAAS,EAAE,CACd,CAAC;QACF,OAAO,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9C,CAAC;IAEM,KAAK,CAAC,aAAa,CAAC,EAAU,EAAE,UAAgB;QACrD,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QACD,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC9D,MAAM,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,yBAAyB,CAAC,EAAE,CAAC,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;IAC/E,CAAC;IAEO,KAAK,CAAC,UAAU,CACtB,KAAa,EACb,OAA2C;QAM3C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAC3D,MAAM,QAAQ,GAAG,iCAAwB,CAAC;QAC1C,MAAM,YAAY,GAAG,IAAI,CAAC,oBAAoB;YAC5C,CAAC,CAAC,8BAA8B,CAAC,KAAK,CAAC;YACvC,CAAC,CAAC,iCAAwB,CAAC;QAC7B,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC;YAC9B,KAAK;YACL,IAAI,EAAE,OAAO,EAAE,IAAI;YACnB,KAAK,EAAE,YAAY;YACnB,QAAQ;YACR,YAAY;SACb,CAAC,CAAC;QACH,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QACxC,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;IACxC,CAAC;IAEO,KAAK,CAAC,mBAAmB,CAAC,KAAa;QAC7C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,eAAe,CAAC,KAAK,CAAC,CAAC;QAC1E,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,CAAC;QACD,OAAO,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YAC3B,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YACjD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC5B,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;YAC5C,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC,CAAC;IACJ,CAAC;CACF;AAlHD,sEAkHC;AAED,SAAS,+BAA+B,CAAC,KAMxC;IACC,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,iCAAwB,CAAC;IAC5D,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,IAAI,QAAQ,CAAC;IACpD,OAAO,OAAO,CAAC,OAAO,CAAC,IAAA,uBAAO,EAC5B;QACE,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE;KACxC,EACR;QACE,MAAM,EAAE;YACN,gBAAgB,EAAE,QAAQ;YAC1B,oBAAoB,EAAE,YAAY;SACnC;KACF,CAC+B,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,8BAA8B,CAAC,KAAa;IACnD,MAAM,QAAQ,GAAG,IAAA,qBAAK,EAAC,iCAAwB,EAAE,sBAAsB,CAAC,CAAC;IACzE,QAAQ,CAAC,iBAAiB,CAAC,GAAG,IAAA,iCAAiB,EAAC,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC;IACvF,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,wBAAwB,CAAC,MAA8B;IAC9D,OAAO;QACL,EAAE,EAAE,yBAAyB,CAAC,MAAM,CAAC,EAAE,CAAC;QACxC,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,IAAI,EAAE,MAAM,CAAC,IAAI;KAClB,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,GAAwB;IAC7C,OAAO;QACL,EAAE,EAAE,oCAAoC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACxD,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;QACxB,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC;QAClC,UAAU,EAAE,GAAG,CAAC,UAAU,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO;QAC1D,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE;QAC/D,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC;QAC/C,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC;QAChC,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC;QAClC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC;QAChC,IAAI,EAAE,OAAQ,GAAW,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAE,GAAW,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;KAC5E,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAAC,OAAe;IAChD,OAAO,iCAAwB,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,oCAAoC,CAAC,EAAU;IACtD,MAAM,QAAQ,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACrC,OAAO,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACrD,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC5B,IAAI,KAAK,YAAY,IAAI,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC3D,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/B,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;IAC7D,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC","sourcesContent":["import { alias, drizzle, eq, resolvePodBaseUrl } from '@undefineds.co/drizzle-solid';\nimport {\n  aiGatewayRepository,\n  gatewayAccessKeyResource,\n  type GatewayAccessKeyRow,\n} from '@undefineds.co/models';\nimport type { AuthContext } from '../../auth/AuthContext';\nimport { createGatewayKeyLocator, type GatewayKeyLocatorCodec } from './GatewayKeyLocatorCodec';\nimport {\n  type GatewayAccessKeyRecord,\n  type GatewayAccessKeyRepository,\n  type GatewayAccessKeyRepositoryContext,\n} from './GatewayApiKeyAuthenticator';\nimport type { GatewayDeployment } from './GatewayApiKey';\n\ntype GatewayAccessKeyDb = {\n  init?: (...resources: unknown[]) => Promise<void>;\n  insert(resource: typeof gatewayAccessKeyResource): {\n    values(value: unknown): { execute(): Promise<unknown[]> };\n  };\n  select(): {\n    from(resource: typeof gatewayAccessKeyResource): {\n      where(condition: unknown): { execute(): Promise<GatewayAccessKeyRow[]> };\n    };\n  };\n  findById<TRow>(resource: typeof gatewayAccessKeyResource, id: string): Promise<TRow | null>;\n  findByIri<TRow>(resource: typeof gatewayAccessKeyResource, iri: string): Promise<TRow | null>;\n  updateById<TRow>(resource: typeof gatewayAccessKeyResource, id: string, patch: unknown): Promise<TRow | null>;\n};\n\ntype GatewayAccessKeyResource = typeof gatewayAccessKeyResource;\n\nexport interface PodGatewayAccessKeyRepositoryOptions {\n  locatorCodec: GatewayKeyLocatorCodec;\n  internalPodAccess?: InternalPodAccessTokenProvider;\n  dbFactory?: (input: {\n    owner: string;\n    auth?: AuthContext;\n    fetch: typeof fetch;\n    resource?: GatewayAccessKeyResource;\n    listResource?: GatewayAccessKeyResource;\n  }) => Promise<GatewayAccessKeyDb>;\n}\n\nexport interface InternalPodAccessTokenProvider {\n  getTrustedFetch(owner: string): Promise<typeof fetch | undefined>;\n}\n\nexport class PodGatewayAccessKeyRepository implements GatewayAccessKeyRepository {\n  private readonly dbFactory: NonNullable<PodGatewayAccessKeyRepositoryOptions['dbFactory']>;\n  private readonly locatorCodec: GatewayKeyLocatorCodec;\n  private readonly internalPodAccess?: InternalPodAccessTokenProvider;\n  private readonly usesDefaultDbFactory: boolean;\n\n  public constructor(options: PodGatewayAccessKeyRepositoryOptions) {\n    this.locatorCodec = options.locatorCodec;\n    this.internalPodAccess = options.internalPodAccess;\n    this.usesDefaultDbFactory = options.dbFactory === undefined;\n    this.dbFactory = options.dbFactory ?? createDefaultGatewayAccessKeyDb;\n  }\n\n  public createKeyId(owner: string, deployment: GatewayDeployment): string {\n    return createGatewayKeyLocator(owner, deployment, this.locatorCodec);\n  }\n\n  public async create(\n    record: GatewayAccessKeyRecord,\n    context?: GatewayAccessKeyRepositoryContext,\n  ): Promise<GatewayAccessKeyRecord> {\n    const { db, resource } = await this.dbForOwner(record.owner, context);\n    const valid = aiGatewayRepository.validateAccessKey(toGatewayAccessKeyInsert(record));\n    await db.insert(resource).values(valid).execute();\n    return recordFromRow(valid as GatewayAccessKeyRow);\n  }\n\n  public async findById(id: string): Promise<GatewayAccessKeyRecord | undefined> {\n    const locator = this.locatorCodec.decode(id);\n    if (!locator) {\n      return undefined;\n    }\n    const { db, resource } = await this.dbForOwner(locator.owner);\n    const row = await db.findById<GatewayAccessKeyRow>(resource, gatewayAccessKeyStorageId(id));\n    return row ? recordFromRow(row) : undefined;\n  }\n\n  public async listByOwner(\n    owner: string,\n    context?: GatewayAccessKeyRepositoryContext,\n  ): Promise<GatewayAccessKeyRecord[]> {\n    const { db, listResource } = await this.dbForOwner(owner, context);\n    const rows = await db\n      .select()\n      .from(listResource)\n      .where(eq(listResource.owner, owner))\n      .execute();\n    return rows.map(recordFromRow).sort((a, b) => b.createdAt.getTime() - a.createdAt.getTime());\n  }\n\n  public async revoke(\n    id: string,\n    revokedAt: Date,\n    context?: GatewayAccessKeyRepositoryContext,\n  ): Promise<GatewayAccessKeyRecord | undefined> {\n    const locator = this.locatorCodec.decode(id);\n    if (!locator) {\n      return undefined;\n    }\n    const { db, resource } = await this.dbForOwner(locator.owner, context);\n    const row = await db.updateById<GatewayAccessKeyRow>(\n      resource,\n      gatewayAccessKeyStorageId(id),\n      { revokedAt },\n    );\n    return row ? recordFromRow(row) : undefined;\n  }\n\n  public async touchLastUsed(id: string, lastUsedAt: Date): Promise<void> {\n    const locator = this.locatorCodec.decode(id);\n    if (!locator) {\n      return;\n    }\n    const { db, resource } = await this.dbForOwner(locator.owner);\n    await db.updateById(resource, gatewayAccessKeyStorageId(id), { lastUsedAt });\n  }\n\n  private async dbForOwner(\n    owner: string,\n    context?: GatewayAccessKeyRepositoryContext,\n  ): Promise<{\n    db: GatewayAccessKeyDb;\n    resource: GatewayAccessKeyResource;\n    listResource: GatewayAccessKeyResource;\n  }> {\n    const trustedFetch = await this.resolveTrustedFetch(owner);\n    const resource = gatewayAccessKeyResource;\n    const listResource = this.usesDefaultDbFactory\n      ? createGatewayAccessKeyResource(owner)\n      : gatewayAccessKeyResource;\n    const db = await this.dbFactory({\n      owner,\n      auth: context?.auth,\n      fetch: trustedFetch,\n      resource,\n      listResource,\n    });\n    await db.init?.(resource, listResource);\n    return { db, resource, listResource };\n  }\n\n  private async resolveTrustedFetch(owner: string): Promise<typeof fetch> {\n    const trustedFetch = await this.internalPodAccess?.getTrustedFetch(owner);\n    if (!trustedFetch) {\n      throw new Error('AI Connection service identity is not configured');\n    }\n    return async (input, init) => {\n      const response = await trustedFetch(input, init);\n      if (response.status === 403) {\n        throw new Error('service_access_missing');\n      }\n      return response;\n    };\n  }\n}\n\nfunction createDefaultGatewayAccessKeyDb(input: {\n  owner: string;\n  auth?: AuthContext;\n  fetch: typeof fetch;\n  resource?: GatewayAccessKeyResource;\n  listResource?: GatewayAccessKeyResource;\n}): Promise<GatewayAccessKeyDb> {\n  const resource = input.resource ?? gatewayAccessKeyResource;\n  const listResource = input.listResource ?? resource;\n  return Promise.resolve(drizzle(\n    {\n      fetch: input.fetch,\n      info: { webId: input.owner, isLoggedIn: true },\n    } as any,\n    {\n      schema: {\n        gatewayAccessKey: resource,\n        gatewayAccessKeyList: listResource,\n      },\n    },\n  ) as unknown as GatewayAccessKeyDb);\n}\n\nfunction createGatewayAccessKeyResource(owner: string): GatewayAccessKeyResource {\n  const resource = alias(gatewayAccessKeyResource, 'gatewayAccessKeyList');\n  resource.setSparqlEndpoint(`${resolvePodBaseUrl(owner).replace(/\\/$/u, '')}/-/sparql`);\n  return resource;\n}\n\nfunction toGatewayAccessKeyInsert(record: GatewayAccessKeyRecord): Record<string, unknown> {\n  return {\n    id: gatewayAccessKeyStorageId(record.id),\n    owner: record.owner,\n    secretHash: record.secretHash,\n    deployment: record.deployment,\n    scopes: record.scopes,\n    createdAt: record.createdAt,\n    expiresAt: record.expiresAt,\n    lastUsedAt: record.lastUsedAt,\n    revokedAt: record.revokedAt,\n    name: record.name,\n  };\n}\n\nfunction recordFromRow(row: GatewayAccessKeyRow): GatewayAccessKeyRecord {\n  return {\n    id: gatewayAccessKeyLocatorFromStorageId(String(row.id)),\n    owner: String(row.owner),\n    secretHash: String(row.secretHash),\n    deployment: row.deployment === 'local' ? 'local' : 'cloud',\n    scopes: Array.isArray(row.scopes) ? row.scopes.map(String) : [],\n    createdAt: toDate(row.createdAt) ?? new Date(0),\n    expiresAt: toDate(row.expiresAt),\n    lastUsedAt: toDate(row.lastUsedAt),\n    revokedAt: toDate(row.revokedAt),\n    name: typeof (row as any).name === 'string' ? (row as any).name : undefined,\n  };\n}\n\nfunction gatewayAccessKeyStorageId(locator: string): string {\n  return gatewayAccessKeyResource.buildId({ id: locator });\n}\n\nfunction gatewayAccessKeyLocatorFromStorageId(id: string): string {\n  const fragment = id.lastIndexOf('#');\n  return fragment >= 0 ? id.slice(fragment + 1) : id;\n}\n\nfunction toDate(value: unknown): Date | undefined {\n  if (value instanceof Date) {\n    return value;\n  }\n  if (typeof value === 'string' || typeof value === 'number') {\n    const parsed = new Date(value);\n    return Number.isNaN(parsed.getTime()) ? undefined : parsed;\n  }\n  return undefined;\n}\n"]}

package/dist/api/ai-gateway/connect/index.d.ts

@@ -0,0 +1,367 @@
+import { aiProviderResource, credentialResource } from '@undefineds.co/models';
+import type { EncryptedCredentialSecret } from '../credentials/KeyWrapper';
+import type { CredentialVault, ProviderSecret } from '../credentials/CredentialVault';
+import type { GatewayDeployment } from '../auth/GatewayApiKey';
+import type { ProviderRegistry } from '../providers/ProviderRegistry';
+import type { AuthContext } from '../../auth/AuthContext';
+import type { InternalPodAccessTokenProvider } from '../auth/PodGatewayAccessKeyRepository';
+export type ConnectMode = 'browserAssistedApiKey' | 'deviceCodeOAuth' | 'connectUnsupported';
+export type ConnectAttemptStatus = 'pending' | 'authorization_pending' | 'slow_down' | 'completed' | 'expired' | 'unsupported';
+export interface ConnectBeginInput {
+    webId: string;
+    deployment: GatewayDeployment;
+    provider: string;
+    requestedMode: ConnectMode;
+    expectedCredentialVersion?: number;
+    auth?: AuthContext;
+}
+export interface ConnectBeginResult {
+    mode: ConnectMode;
+    status: ConnectAttemptStatus;
+    provider: string;
+    deployment: GatewayDeployment;
+    attemptId?: string;
+    state?: string;
+    signature?: string;
+    expiresAt?: string;
+    authorizationUrl?: string;
+    pkceChallenge?: string;
+    deviceCode?: string;
+    userCode?: string;
+    verificationUri?: string;
+    verificationUriComplete?: string;
+    intervalSeconds?: number;
+    apiKeyManagementSupported?: boolean;
+    credentialId?: string;
+    message?: string;
+}
+export interface CompleteApiKeyInput {
+    webId: string;
+    deployment: GatewayDeployment;
+    provider: string;
+    attemptId: string;
+    state: string;
+    signature: string;
+    apiKey: string;
+    accountLabel?: string;
+    auth?: AuthContext;
+}
+export interface PollDeviceInput {
+    webId: string;
+    deployment: GatewayDeployment;
+    provider: string;
+    attemptId: string;
+    state: string;
+    signature: string;
+    auth?: AuthContext;
+}
+export interface RefreshInput {
+    webId: string;
+    deployment: GatewayDeployment;
+    provider: string;
+    auth?: AuthContext;
+}
+export interface DisconnectInput {
+    webId: string;
+    deployment: GatewayDeployment;
+    provider: string;
+    auth?: AuthContext;
+}
+export interface ConnectCredentialRecord {
+    id: string;
+    credentialIri: string;
+    webId: string;
+    provider: string;
+    deployment: GatewayDeployment;
+    authMode: 'apiKey' | 'deviceCodeOAuth';
+    encryptedSecret: EncryptedCredentialSecret;
+    status: 'active' | 'revoked';
+    accountLabel?: string;
+    expiresAt?: Date;
+    scopes?: string[];
+    expectedVersion?: number;
+    version?: number;
+    reauthRequired?: boolean;
+    metadata?: Record<string, unknown>;
+}
+export interface PodCredentialRepository {
+    getCredential?(input: {
+        webId: string;
+        provider: string;
+        deployment: GatewayDeployment;
+        auth?: AuthContext;
+    }): Promise<ConnectCredentialRecord | undefined>;
+    getActiveCredential(input: {
+        webId: string;
+        provider: string;
+        deployment: GatewayDeployment;
+        auth?: AuthContext;
+    }): Promise<ConnectCredentialRecord | undefined>;
+    upsertConnectedCredential(record: ConnectCredentialRecord, context?: {
+        auth?: AuthContext;
+    }): Promise<ConnectCredentialRecord>;
+    rewrapCredential?(input: {
+        webId: string;
+        deployment: GatewayDeployment;
+        credentialId: string;
+        expectedVersion?: number;
+        encryptedSecret: EncryptedCredentialSecret;
+        auth?: AuthContext;
+    }): Promise<boolean>;
+    markReauthRequired(input: {
+        webId: string;
+        provider: string;
+        deployment: GatewayDeployment;
+        reason: string;
+        expectedVersion?: number;
+        auth?: AuthContext;
+    }): Promise<ConnectCredentialRecord | undefined>;
+    disconnect(input: DisconnectInput): Promise<ConnectCredentialRecord | undefined>;
+}
+type ConnectedCredentialDb = {
+    init?: (...resources: unknown[]) => Promise<void>;
+    insert(resource: typeof credentialResource): {
+        values(value: unknown): {
+            execute(): Promise<unknown[]>;
+        };
+    };
+    select(): {
+        from(resource: typeof credentialResource): {
+            where(condition: unknown): {
+                execute(): Promise<Record<string, unknown>[]>;
+            };
+        };
+    };
+    findById<TRow>(resource: typeof credentialResource, id: string): Promise<TRow | null>;
+    updateById<TRow>(resource: typeof credentialResource, id: string, patch: unknown): Promise<TRow | null>;
+    update(resource: typeof credentialResource): {
+        set(patch: unknown): {
+            where(condition: unknown): {
+                returning(): {
+                    execute(): Promise<Record<string, unknown>[]>;
+                };
+            };
+        };
+    };
+};
+export interface PodConnectedCredentialRepositoryOptions {
+    internalPodAccess?: InternalPodAccessTokenProvider;
+    providerIds?: string[];
+    dbFactory?: (input: {
+        owner: string;
+        auth?: AuthContext;
+        fetch: typeof fetch;
+        credential?: typeof credentialResource;
+        aiProvider?: typeof aiProviderResource;
+    }) => Promise<ConnectedCredentialDb>;
+}
+export declare class PodConnectedCredentialRepository implements PodCredentialRepository {
+    private readonly dbFactory;
+    private readonly internalPodAccess?;
+    private readonly providerIds;
+    private readonly credentialTemplate;
+    private readonly aiProviderTemplate;
+    constructor(options?: PodConnectedCredentialRepositoryOptions);
+    getCredential(input: {
+        webId: string;
+        provider: string;
+        deployment: GatewayDeployment;
+        auth?: AuthContext;
+    }): Promise<ConnectCredentialRecord | undefined>;
+    getActiveCredential(input: {
+        webId: string;
+        provider: string;
+        deployment: GatewayDeployment;
+        auth?: AuthContext;
+    }): Promise<ConnectCredentialRecord | undefined>;
+    listCredentials(input: {
+        webId: string;
+        deployment: GatewayDeployment;
+        auth?: AuthContext;
+    }): Promise<Array<{
+        id: string;
+        credentialIri: string;
+        provider: string;
+        authMode: 'apiKey' | 'deviceCodeOAuth';
+        enabled: boolean;
+        priority?: number;
+        models?: string[];
+        defaultModel?: string;
+        health?: 'healthy' | 'reauthRequired' | 'disabled' | 'error';
+        quota?: {
+            status: 'available' | 'unsupported' | 'exhausted' | 'error';
+        };
+        encryptedSecret: EncryptedCredentialSecret;
+        version?: number;
+        runtimeCredential?: Record<string, unknown>;
+        metadata?: Record<string, unknown>;
+    }>>;
+    upsertConnectedCredential(record: ConnectCredentialRecord, context?: {
+        auth?: AuthContext;
+    }): Promise<ConnectCredentialRecord>;
+    rewrapCredential(input: {
+        webId: string;
+        deployment: GatewayDeployment;
+        credentialId: string;
+        expectedVersion?: number;
+        encryptedSecret: EncryptedCredentialSecret;
+        auth?: AuthContext;
+    }): Promise<boolean>;
+    markReauthRequired(input: {
+        webId: string;
+        provider: string;
+        deployment: GatewayDeployment;
+        reason: string;
+        expectedVersion?: number;
+        auth?: AuthContext;
+    }): Promise<ConnectCredentialRecord | undefined>;
+    disconnect(input: DisconnectInput): Promise<ConnectCredentialRecord | undefined>;
+    private dbForOwner;
+    private resolveTrustedFetch;
+}
+export interface ProviderConnectAdapter {
+    readonly provider: string;
+    begin(input: ConnectBeginInput): Promise<ConnectBeginResult>;
+    status?(input: PollDeviceInput): Promise<ConnectBeginResult>;
+    completeApiKey?(input: CompleteApiKeyInput): Promise<ConnectBeginResult>;
+    pollDevice?(input: PollDeviceInput): Promise<ConnectBeginResult>;
+    refresh?(input: RefreshInput, current: ConnectCredentialRecord, secret: ProviderSecret): Promise<ConnectCredentialRecord | undefined>;
+    disconnect?(input: DisconnectInput): Promise<ConnectCredentialRecord | undefined>;
+}
+interface ConnectAttempt {
+    id: string;
+    provider: string;
+    deployment: GatewayDeployment;
+    webId: string;
+    mode: ConnectMode;
+    state: string;
+    signature: string;
+    expiresAt: Date;
+    consumedAt?: Date;
+    expectedCredentialVersion?: number;
+    codeVerifier?: string;
+    deviceCode?: string;
+    intervalSeconds?: number;
+    currentPollIntervalSeconds?: number;
+    nextPollAt?: Date;
+    pollClaimedAt?: Date;
+    lastPollStatus?: ConnectAttemptStatus;
+}
+interface PollClaimResult {
+    attempt: ConnectAttempt;
+    claimed: boolean;
+}
+export declare class InMemoryConnectAttemptStore {
+    private readonly attempts;
+    private readonly maxAttempts;
+    create(attempt: ConnectAttempt): Promise<ConnectAttempt>;
+    get(id: string, now?: Date): Promise<ConnectAttempt | undefined>;
+    consume(id: string, now: Date): Promise<ConnectAttempt>;
+    claimPoll(id: string, now: Date): Promise<PollClaimResult>;
+    updatePollSchedule(id: string, patch: {
+        intervalSeconds: number;
+        nextPollAt: Date;
+        lastPollStatus: ConnectAttemptStatus;
+    }): Promise<ConnectAttempt | undefined>;
+    releasePollClaim(id: string): Promise<void>;
+    private pruneExpired;
+    private pruneBounded;
+}
+export interface BrowserAssistedApiKeyConnectAdapterOptions {
+    provider: string;
+    consoleUrl: string;
+    attempts: InMemoryConnectAttemptStore;
+    credentialRepository: PodCredentialRepository;
+    vault: CredentialVault;
+    deployment: GatewayDeployment;
+    now?: () => Date;
+    randomBytes?: (bytes: number) => Buffer;
+    signingSecret: string;
+}
+export declare class BrowserAssistedApiKeyConnectAdapter implements ProviderConnectAdapter {
+    readonly provider: string;
+    private readonly consoleUrl;
+    protected readonly attempts: InMemoryConnectAttemptStore;
+    protected readonly credentialRepository: PodCredentialRepository;
+    protected readonly vault: CredentialVault;
+    protected readonly deployment: GatewayDeployment;
+    protected readonly now: () => Date;
+    protected readonly randomBytes: (bytes: number) => Buffer;
+    private readonly signingSecret;
+    constructor(options: BrowserAssistedApiKeyConnectAdapterOptions);
+    begin(input: ConnectBeginInput): Promise<ConnectBeginResult>;
+    completeApiKey(input: CompleteApiKeyInput): Promise<ConnectBeginResult>;
+    status(input: PollDeviceInput): Promise<ConnectBeginResult>;
+    disconnect(input: DisconnectInput): Promise<ConnectCredentialRecord | undefined>;
+    protected createAttempt(input: ConnectBeginInput, expiresAt: Date, extra?: Partial<ConnectAttempt>): Promise<ConnectAttempt>;
+    protected loadAttemptForStatus(input: PollDeviceInput, mode: ConnectMode): Promise<ConnectAttempt>;
+    protected loadConsumableAttempt(input: PollDeviceInput, mode: ConnectMode): Promise<ConnectAttempt>;
+    protected statusForAttempt(attempt: ConnectAttempt): ConnectAttemptStatus;
+    protected assertInput(input: ConnectBeginInput, mode: ConnectMode): void;
+}
+export interface KimiDeviceCodeConnectAdapterOptions extends Omit<BrowserAssistedApiKeyConnectAdapterOptions, 'provider' | 'consoleUrl'> {
+    fetch?: typeof fetch;
+    clientId: string;
+    deviceAuthorizationEndpoint?: string;
+    tokenEndpoint?: string;
+}
+export declare class KimiDeviceCodeConnectAdapter extends BrowserAssistedApiKeyConnectAdapter {
+    private readonly fetchImpl;
+    private readonly clientId;
+    private readonly deviceAuthorizationEndpoint;
+    private readonly tokenEndpoint;
+    constructor(options: KimiDeviceCodeConnectAdapterOptions);
+    begin(input: ConnectBeginInput): Promise<ConnectBeginResult>;
+    pollDevice(input: PollDeviceInput): Promise<ConnectBeginResult>;
+    status(input: PollDeviceInput): Promise<ConnectBeginResult>;
+    refresh(input: RefreshInput, current: ConnectCredentialRecord, secret: ProviderSecret): Promise<ConnectCredentialRecord | undefined>;
+    disconnect(input: DisconnectInput): Promise<ConnectCredentialRecord | undefined>;
+    private nowForConsume;
+    private storeOAuthCredential;
+}
+export declare class DeepSeekConnectAdapter implements ProviderConnectAdapter {
+    readonly provider = "deepseek";
+    begin(input: ConnectBeginInput): Promise<ConnectBeginResult>;
+}
+export interface ProviderConnectServiceOptions {
+    registry: ProviderRegistry;
+    adapters: ProviderConnectAdapter[];
+    credentialRepository?: PodCredentialRepository;
+    vault?: CredentialVault;
+}
+export interface ProviderConnectionSummary {
+    provider: string;
+    status: 'connected' | 'disconnected' | 'reauthRequired';
+    authMode?: 'apiKey' | 'deviceCodeOAuth';
+    accountLabel?: string;
+    expiresAt?: string;
+    reauthRequired?: boolean;
+    credentialIri?: string;
+    version?: number;
+    connect: {
+        modes: string[];
+        configured: boolean;
+        message?: string;
+    };
+}
+export declare class ProviderConnectService {
+    private readonly registry;
+    private readonly credentialRepository?;
+    private readonly vault?;
+    private readonly adapters;
+    constructor(options: ProviderConnectServiceOptions);
+    begin(input: ConnectBeginInput): Promise<ConnectBeginResult>;
+    listProviders(input: {
+        webId: string;
+        deployment: GatewayDeployment;
+        auth?: AuthContext;
+    }): Promise<ProviderConnectionSummary[]>;
+    completeApiKey(input: CompleteApiKeyInput): Promise<ConnectBeginResult>;
+    pollDevice(input: PollDeviceInput): Promise<ConnectBeginResult>;
+    status(input: PollDeviceInput): Promise<ConnectBeginResult>;
+    refresh(input: RefreshInput): Promise<ConnectCredentialRecord | undefined>;
+    private refreshWithRetry;
+    disconnect(input: DisconnectInput): Promise<ConnectCredentialRecord | undefined>;
+    private requireAdapter;
+}
+export {};