@undefineds.co/xpod 0.3.69 → 0.3.71-rc.2

package/node_modules/@undefineds.co/ai-connection/dist/AiConnectionPanel.js

@@ -7,13 +7,13 @@ import { Check, Copy, KeyRound, Loader2, Trash2, } from 'lucide-react';
 import { AI_CLIENT_LABELS, AiClientConfigurationSection, } from './AiClientConfigurationSection.js';
 import { AiProviderCard, } from './AiProviderCard.js';
 const EMPTY_PROVIDER_SUMMARIES = {};
-export function AiConnectionPanel({ client, openExternal = openExternalUrl, clientConfigurationBridge, selectedProvider, providerSummaries: providerSummariesInput = EMPTY_PROVIDER_SUMMARIES, providerLoadError, serviceAccessGranted = false, onProviderStateChange, }) {
-    const [keys, setKeys] = useState([]);
-    const [keysLoading, setKeysLoading] = useState(true);
-    const [keyName, setKeyName] = useState('');
-    const [creatingKey, setCreatingKey] = useState(false);
-    const [oneTimeKey, setOneTimeKey] = useState();
-    const [keyError, setKeyError] = useState();
+export function AiConnectionPanel({ client, openExternal = openExternalUrl, clientConfigurationBridge, clientCredentialManager, selectedProvider, providerSummaries: providerSummariesInput = EMPTY_PROVIDER_SUMMARIES, providerLoadError, serviceAccessGranted = false, onProviderStateChange, }) {
+    const [credentials, setCredentials] = useState([]);
+    const [credentialsLoading, setCredentialsLoading] = useState(Boolean(clientCredentialManager));
+    const [credentialName, setCredentialName] = useState('');
+    const [creatingCredential, setCreatingCredential] = useState(false);
+    const [oneTimeCredential, setOneTimeCredential] = useState();
+    const [credentialError, setCredentialError] = useState();
     const [connectionStates, setConnectionStates] = useState({});
     const [models, setModels] = useState([]);
     const [attempts, setAttempts] = useState({});
@@ -37,20 +37,26 @@ export function AiConnectionPanel({ client, openExternal = openExternalUrl, clie
     }, [providerSummariesInput]);
     useEffect(() => {
         let active = true;
-        setKeysLoading(true);
-        void client.listGatewayKeys()
-            .then((records) => {
-            if (active)
-                setKeys(records);
-        })
-            .catch((error) => {
-            if (active)
-                setKeyError(errorMessage(error));
-        })
-            .finally(() => {
-            if (active)
-                setKeysLoading(false);
-        });
+        if (clientCredentialManager) {
+            setCredentialsLoading(true);
+            void clientCredentialManager.list()
+                .then((records) => {
+                if (active)
+                    setCredentials(records);
+            })
+                .catch((error) => {
+                if (active)
+                    setCredentialError(errorMessage(error));
+            })
+                .finally(() => {
+                if (active)
+                    setCredentialsLoading(false);
+            });
+        }
+        else {
+            setCredentialsLoading(false);
+            setCredentials([]);
+        }
         void client.listModels()
             .then((availableModels) => {
             if (active)
@@ -58,13 +64,13 @@ export function AiConnectionPanel({ client, openExternal = openExternalUrl, clie
         })
             .catch((error) => {
             if (active)
-                setKeyError(errorMessage(error));
+                setCredentialError(errorMessage(error));
         });
         return () => {
             active = false;
             pollingGeneration.current += 1;
         };
-    }, [client]);
+    }, [client, clientCredentialManager]);
     const setBusy = (provider, value) => {
         setBusyProviders((current) => ({ ...current, [provider]: value }));
     };
@@ -200,75 +206,83 @@ export function AiConnectionPanel({ client, openExternal = openExternalUrl, clie
             setBusy(provider, false);
         }
     };
-    const createKey = async () => {
-        if (!serviceAccessGranted)
+    const createCredential = async () => {
+        if (!serviceAccessGranted || !clientCredentialManager)
             return;
-        setCreatingKey(true);
-        setKeyError(undefined);
-        setOneTimeKey(undefined);
+        setCreatingCredential(true);
+        setCredentialError(undefined);
+        setOneTimeCredential(undefined);
         try {
-            const created = await client.createGatewayKey({
-                ...(keyName.trim() ? { name: keyName.trim() } : {}),
+            const created = await clientCredentialManager.create({
+                name: credentialName.trim() || 'AI Connection',
+                webId: client.webId,
             });
-            setOneTimeKey(created.plaintext);
-            setKeys((current) => [created.record, ...current]);
-            setKeyName('');
+            setOneTimeCredential({
+                clientId: created.clientId,
+                clientSecret: created.clientSecret,
+                apiKey: created.apiKey,
+            });
+            setCredentials((current) => [
+                created,
+                ...current.filter((record) => record.resourceUrl !== created.resourceUrl),
+            ]);
+            setCredentialName('');
         }
         catch (error) {
-            setKeyError(errorMessage(error));
+            setCredentialError(errorMessage(error));
         }
         finally {
-            setCreatingKey(false);
+            setCreatingCredential(false);
         }
     };
-    const revokeKey = async (keyId) => {
-        if (!serviceAccessGranted)
+    const revokeCredential = async (credential) => {
+        if (!serviceAccessGranted || !clientCredentialManager)
             return;
-        setKeyError(undefined);
+        setCredentialError(undefined);
         try {
-            const record = await client.revokeGatewayKey(keyId);
-            setKeys((current) => current.map((item) => item.id === keyId
-                ? (record ?? { ...item, revokedAt: new Date().toISOString() })
-                : item));
+            await clientCredentialManager.revoke(credential.resourceUrl);
+            setCredentials((current) => current.filter((item) => item.resourceUrl !== credential.resourceUrl));
         }
         catch (error) {
-            setKeyError(errorMessage(error));
+            setCredentialError(errorMessage(error));
         }
     };
-    const copyOneTimeKey = async () => {
-        if (!oneTimeKey)
+    const copyOneTimeApiKey = async () => {
+        if (!oneTimeCredential)
             return;
-        await navigator.clipboard?.writeText(oneTimeKey);
+        await navigator.clipboard?.writeText(oneTimeCredential.apiKey);
         setCopied(true);
     };
-    const createManagedGatewayKey = useCallback(async (targetClient) => {
+    const createManagedClientCredential = useCallback(async (targetClient) => {
         if (!serviceAccessGranted) {
             throw new Error('AI Connection service access is not granted');
         }
-        const created = await client.createGatewayKey({
+        if (!clientCredentialManager) {
+            throw new Error('Client Credentials are not available in this host');
+        }
+        const created = await clientCredentialManager.create({
             name: `AI Connection · ${AI_CLIENT_LABELS[targetClient]}`,
+            webId: client.webId,
         });
-        setKeys((current) => [
-            created.record,
-            ...current.filter((record) => record.id !== created.record.id),
+        setCredentials((current) => [
+            created,
+            ...current.filter((record) => record.resourceUrl !== created.resourceUrl),
         ]);
         return {
-            gatewayKey: created.plaintext,
+            apiKey: created.apiKey,
             revoke: async () => {
-                await client.revokeGatewayKey(created.record.id);
-                setKeys((current) => current.map((record) => record.id === created.record.id
-                    ? { ...record, revokedAt: new Date().toISOString() }
-                    : record));
+                await clientCredentialManager.revoke(created.resourceUrl);
+                setCredentials((current) => current.filter((record) => record.resourceUrl !== created.resourceUrl));
             },
         };
-    }, [client, serviceAccessGranted]);
+    }, [client.webId, clientCredentialManager, serviceAccessGranted]);
     return (_jsxs("div", { className: "mx-auto w-full max-w-3xl px-6 py-6", children: [_jsxs("section", { children: [providerLoadError ? (_jsxs("p", { className: "mb-4 rounded-md border border-destructive/30 px-3 py-2 text-sm text-destructive", children: ["Provider \u72B6\u6001\u8BFB\u53D6\u5931\u8D25\uFF1A", providerLoadError] })) : null, PROVIDERS.filter((definition) => definition.id === (selectedProvider ?? 'openai')).map((definition) => (_jsx(AiProviderCard, { definition: definition, status: connectionStates[definition.id] ?? 'unknown', accountLabel: providerSummariesInput[definition.id]?.accountLabel, attempt: attempts[definition.id], apiKey: apiKeyInputs[definition.id] ?? '', busy: Boolean(busyProviders[definition.id]), disabled: !serviceAccessGranted, error: providerErrors[definition.id], quota: quotas[definition.id], models: models.filter((model) => model.provider === definition.id), onApiKeyChange: (value) => setApiKeyInputs((current) => ({
                             ...current,
                             [definition.id]: value,
-                        })), onBeginApiKey: () => void beginApiKey(definition.id), onBeginBrowser: () => void beginBrowserConnect(definition), onSaveApiKey: () => void saveApiKey(definition), onDisconnect: () => void disconnect(definition.id), onRefreshQuota: () => void refreshQuota(definition.id) }, definition.id)))] }), _jsxs("details", { className: "border-t border-border/60 py-5", children: [_jsx("summary", { className: "cursor-pointer list-none text-sm font-medium", children: "\u5BA2\u6237\u7AEF\u63A5\u5165" }), _jsxs("div", { className: "mt-4 space-y-6", children: [_jsx(AiClientConfigurationSection, { bridge: clientConfigurationBridge, endpoint: client.apiBase, createGatewayKey: createManagedGatewayKey }), _jsxs("details", { className: "border-t border-border/60 pt-4", children: [_jsx("summary", { className: "cursor-pointer text-sm font-medium text-muted-foreground", children: "\u9AD8\u7EA7\uFF1AGateway Keys" }), _jsx("div", { className: "mt-3", children: _jsxs(Card, { children: [_jsxs(CardHeader, { children: [_jsxs(CardTitle, { className: "flex items-center gap-2 text-base", children: [_jsx(KeyRound, { className: "h-4 w-4" }), "Gateway Keys"] }), _jsx(CardDescription, { children: "\u7F16\u7801\u5BA2\u6237\u7AEF\u53EA\u4F7F\u7528 Gateway Key\uFF1B\u65B0\u5BC6\u94A5\u660E\u6587\u4EC5\u5728\u521B\u5EFA\u540E\u663E\u793A\u4E00\u6B21\u3002" })] }), _jsxs(CardContent, { className: "space-y-4", children: [_jsxs("div", { className: "flex gap-2", children: [_jsx(Input, { "aria-label": "Gateway Key \u540D\u79F0", placeholder: "\u540D\u79F0\uFF0C\u4F8B\u5982 Codex", value: keyName, onChange: (event) => setKeyName(event.target.value) }), _jsxs(Button, { onClick: () => void createKey(), disabled: creatingKey || !serviceAccessGranted, children: [creatingKey ? _jsx(Loader2, { className: "mr-2 h-4 w-4 animate-spin" }) : _jsx(KeyRound, { className: "mr-2 h-4 w-4" }), "\u521B\u5EFA Gateway Key"] })] }), oneTimeKey ? (_jsxs("div", { className: "space-y-3 rounded-lg border border-amber-500/30 bg-amber-500/5 p-4", children: [_jsx("p", { className: "text-sm font-medium", children: "\u8BF7\u7ACB\u5373\u4FDD\u5B58\uFF1B\u5173\u95ED\u540E\u65E0\u6CD5\u518D\u6B21\u67E5\u770B\u3002" }), _jsx("code", { className: "block overflow-x-auto rounded bg-background p-3 text-xs", children: oneTimeKey }), _jsxs("div", { className: "flex flex-wrap gap-2", children: [_jsxs(Button, { variant: "outline", size: "sm", onClick: () => void copyOneTimeKey(), children: [copied ? _jsx(Check, { className: "mr-2 h-4 w-4" }) : _jsx(Copy, { className: "mr-2 h-4 w-4" }), copied ? '已复制' : '复制'] }), _jsx(Button, { size: "sm", onClick: () => {
-                                                                                setOneTimeKey(undefined);
+                        })), onBeginApiKey: () => void beginApiKey(definition.id), onBeginBrowser: () => void beginBrowserConnect(definition), onSaveApiKey: () => void saveApiKey(definition), onDisconnect: () => void disconnect(definition.id), onRefreshQuota: () => void refreshQuota(definition.id) }, definition.id)))] }), _jsxs("details", { className: "border-t border-border/60 py-5", children: [_jsx("summary", { className: "cursor-pointer list-none text-sm font-medium", children: "\u5BA2\u6237\u7AEF\u63A5\u5165" }), _jsxs("div", { className: "mt-4 space-y-6", children: [_jsx(AiClientConfigurationSection, { bridge: clientConfigurationBridge, endpoint: client.apiBase, createClientCredential: createManagedClientCredential }), _jsxs("details", { className: "border-t border-border/60 pt-4", children: [_jsx("summary", { className: "cursor-pointer text-sm font-medium text-muted-foreground", children: "Client Credentials" }), _jsx("div", { className: "mt-3", children: _jsxs(Card, { children: [_jsxs(CardHeader, { children: [_jsxs(CardTitle, { className: "flex items-center gap-2 text-base", children: [_jsx(KeyRound, { className: "h-4 w-4" }), "Client Credentials"] }), _jsxs(CardDescription, { children: ["\u4E3A Codex\u3001Claude Code\u3001Pi\u3001CodeBuddy \u521B\u5EFA Solid Client Credentials\u3002API Key \u4E3A ", _jsx("code", { children: "sk-base64(client_id:client_secret)" }), "\uFF0C\u53EA\u5728\u521B\u5EFA\u540E\u663E\u793A\u4E00\u6B21\u3002"] })] }), _jsxs(CardContent, { className: "space-y-4", children: [!clientCredentialManager ? (_jsxs("div", { className: "rounded-lg border border-amber-500/30 bg-amber-500/5 p-4 text-sm text-muted-foreground", children: ["\u5F53\u524D Host \u6CA1\u6709\u63D0\u4F9B account-controls Client Credentials capability\u3002", _jsx("a", { className: "ml-1 underline", href: "/.account/", children: "\u6253\u5F00 Account Developer Access" }), ' ', "\u624B\u52A8\u521B\u5EFA API Key\u3002"] })) : null, _jsxs("div", { className: "flex gap-2", children: [_jsx(Input, { "aria-label": "Client Credential \u540D\u79F0", placeholder: "\u540D\u79F0\uFF0C\u4F8B\u5982 Codex", value: credentialName, onChange: (event) => setCredentialName(event.target.value) }), _jsxs(Button, { onClick: () => void createCredential(), disabled: creatingCredential || !serviceAccessGranted || !clientCredentialManager, children: [creatingCredential ? _jsx(Loader2, { className: "mr-2 h-4 w-4 animate-spin" }) : _jsx(KeyRound, { className: "mr-2 h-4 w-4" }), "\u521B\u5EFA Client Credential"] })] }), oneTimeCredential ? (_jsxs("div", { className: "space-y-3 rounded-lg border border-amber-500/30 bg-amber-500/5 p-4", children: [_jsx("p", { className: "text-sm font-medium", children: "\u8BF7\u7ACB\u5373\u4FDD\u5B58\uFF1B\u5173\u95ED\u540E\u65E0\u6CD5\u518D\u6B21\u67E5\u770B\u3002" }), _jsxs("div", { className: "space-y-2 rounded bg-background p-3 text-xs", children: [_jsxs("div", { children: [_jsx("span", { className: "text-muted-foreground", children: "Client ID: " }), _jsx("code", { children: oneTimeCredential.clientId })] }), _jsxs("div", { children: [_jsx("span", { className: "text-muted-foreground", children: "Client Secret: " }), _jsx("code", { children: oneTimeCredential.clientSecret })] }), _jsxs("div", { children: [_jsx("span", { className: "text-muted-foreground", children: "API Key: " }), _jsx("code", { children: oneTimeCredential.apiKey })] })] }), _jsxs("div", { className: "flex flex-wrap gap-2", children: [_jsxs(Button, { variant: "outline", size: "sm", onClick: () => void copyOneTimeApiKey(), children: [copied ? _jsx(Check, { className: "mr-2 h-4 w-4" }) : _jsx(Copy, { className: "mr-2 h-4 w-4" }), copied ? '已复制' : '复制 API Key'] }), _jsx(Button, { size: "sm", onClick: () => {
+                                                                                setOneTimeCredential(undefined);
                                                                                 setCopied(false);
-                                                                            }, children: "\u6211\u5DF2\u4FDD\u5B58\uFF0C\u9690\u85CF\u5BC6\u94A5" })] })] })) : null, keyError ? _jsx("p", { className: "text-sm text-destructive", children: keyError }) : null, keysLoading ? (_jsxs("div", { className: "flex items-center gap-2 text-sm text-muted-foreground", children: [_jsx(Loader2, { className: "h-4 w-4 animate-spin" }), "\u6B63\u5728\u8BFB\u53D6 Gateway Keys"] })) : keys.length === 0 ? (_jsx("p", { className: "text-sm text-muted-foreground", children: "\u5C1A\u672A\u521B\u5EFA Gateway Key\u3002" })) : (_jsx("div", { className: "space-y-2", children: keys.map((key) => (_jsxs("div", { className: "flex items-center justify-between gap-3 rounded-lg border p-3", children: [_jsxs("div", { className: "min-w-0", children: [_jsx("div", { className: "truncate text-sm font-medium", children: key.name || key.id }), _jsxs("div", { className: "mt-1 text-xs text-muted-foreground", children: [key.scopes.join(' · '), key.revokedAt ? ' · 已撤销' : ''] })] }), _jsx(Button, { variant: "ghost", size: "icon", "aria-label": `撤销 ${key.name || key.id}`, disabled: Boolean(key.revokedAt) || !serviceAccessGranted, onClick: () => void revokeKey(key.id), children: _jsx(Trash2, { className: "h-4 w-4" }) })] }, key.id))) }))] })] }) })] })] })] })] }));
+                                                                            }, children: "\u6211\u5DF2\u4FDD\u5B58\uFF0C\u9690\u85CF\u5BC6\u94A5" })] })] })) : null, credentialError ? _jsx("p", { className: "text-sm text-destructive", children: credentialError }) : null, credentialsLoading ? (_jsxs("div", { className: "flex items-center gap-2 text-sm text-muted-foreground", children: [_jsx(Loader2, { className: "h-4 w-4 animate-spin" }), "\u6B63\u5728\u8BFB\u53D6 Client Credentials"] })) : credentials.length === 0 ? (_jsx("p", { className: "text-sm text-muted-foreground", children: "\u5C1A\u672A\u521B\u5EFA Client Credential\u3002" })) : (_jsx("div", { className: "space-y-2", children: credentials.map((credential) => (_jsxs("div", { className: "flex items-center justify-between gap-3 rounded-lg border p-3", children: [_jsxs("div", { className: "min-w-0", children: [_jsx("div", { className: "truncate text-sm font-medium", children: credential.id }), _jsx("div", { className: "mt-1 text-xs text-muted-foreground", children: credential.webId ?? client.webId })] }), _jsx(Button, { variant: "ghost", size: "icon", "aria-label": `撤销 ${credential.id}`, disabled: !serviceAccessGranted || !clientCredentialManager, onClick: () => void revokeCredential(credential), children: _jsx(Trash2, { className: "h-4 w-4" }) })] }, credential.resourceUrl))) }))] })] }) })] })] })] })] }));
 }
 async function pollDeviceConnect(client, provider, initial, generation, generationRef, callbacks) {
     let attempt = initial;

package/node_modules/@undefineds.co/ai-connection/dist/ai-connection-client.d.ts

@@ -49,16 +49,6 @@ export interface AiQuotaSnapshot {
     source: string;
     stale?: boolean;
 }
-export interface GatewayKeyRecord {
-    id: string;
-    owner: string;
-    scopes: string[];
-    createdAt: string;
-    expiresAt?: string;
-    lastUsedAt?: string;
-    revokedAt?: string;
-    name?: string;
-}
 export interface AiGatewayModel {
     id: string;
     provider: AiConnectionProvider;
@@ -66,10 +56,6 @@ export interface AiGatewayModel {
     contextWindow?: number;
     protocols?: string[];
 }
-export interface CreatedGatewayKey {
-    plaintext: string;
-    record: GatewayKeyRecord;
-}
 export interface AiProviderConnectionSummary {
     provider: AiConnectionProvider;
     status: 'connected' | 'disconnected' | 'reauthRequired';
@@ -91,13 +77,6 @@ export interface AiConnectionClient {
     getServiceAccess(): Promise<unknown>;
     listProviders(): Promise<AiProviderConnectionSummary[]>;
     listModels(): Promise<AiGatewayModel[]>;
-    listGatewayKeys(): Promise<GatewayKeyRecord[]>;
-    createGatewayKey(input: {
-        name?: string;
-        scopes?: string[];
-        expiresAt?: string;
-    }): Promise<CreatedGatewayKey>;
-    revokeGatewayKey(keyId: string): Promise<GatewayKeyRecord | undefined>;
     beginConnect(provider: AiConnectionProvider, mode: AiConnectionMode): Promise<AiConnectAttempt>;
     connectStatus(provider: AiConnectionProvider, attempt: Pick<AiConnectAttempt, 'attemptId' | 'state' | 'signature'>): Promise<AiConnectAttempt>;
     completeApiKey(provider: AiConnectionProvider, attempt: Pick<AiConnectAttempt, 'attemptId' | 'state' | 'signature'>, apiKey: string, accountLabel?: string): Promise<AiConnectAttempt>;

package/node_modules/@undefineds.co/ai-connection/dist/ai-connection-client.js

@@ -58,27 +58,6 @@ export function createAiConnectionClient({ webId, podBaseUrl, authenticatedFetch
                 ? payload.data.map(parseGatewayModel).filter(isDefined)
                 : [];
         },
-        async listGatewayKeys() {
-            const payload = await request('/api/ai/gateway/keys', 'GET');
-            return Array.isArray(payload.data)
-                ? payload.data.map(parseGatewayKeyRecord).filter(isDefined)
-                : [];
-        },
-        async createGatewayKey(input) {
-            const payload = await request('/api/ai/gateway/keys', 'POST', compactObject(input));
-            if (typeof payload.key !== 'string' || !payload.key) {
-                throw new Error('AI Connection did not return the one-time Gateway key');
-            }
-            const record = parseGatewayKeyRecord(payload.record);
-            if (!record) {
-                throw new Error('AI Connection returned an invalid Gateway key record');
-            }
-            return { plaintext: payload.key, record };
-        },
-        async revokeGatewayKey(keyId) {
-            const payload = await request(`/api/ai/gateway/keys/${encodeURIComponent(keyId)}`, 'DELETE');
-            return parseGatewayKeyRecord(payload.record);
-        },
         async beginConnect(provider, mode) {
             return await requestConnect(provider, '/connect/begin', 'POST', { mode });
         },
@@ -229,26 +208,6 @@ function assertProvider(provider) {
         throw new Error(`Unsupported AI provider: ${provider}`);
     }
 }
-function parseGatewayKeyRecord(value) {
-    if (!isRecord(value)
-        || typeof value.id !== 'string'
-        || typeof value.owner !== 'string'
-        || !Array.isArray(value.scopes)
-        || !value.scopes.every((scope) => typeof scope === 'string')
-        || typeof value.createdAt !== 'string') {
-        return undefined;
-    }
-    return compactObject({
-        id: value.id,
-        owner: value.owner,
-        scopes: value.scopes,
-        createdAt: value.createdAt,
-        expiresAt: stringValue(value.expiresAt),
-        lastUsedAt: stringValue(value.lastUsedAt),
-        revokedAt: stringValue(value.revokedAt),
-        name: stringValue(value.name),
-    });
-}
 function parseGatewayModel(value) {
     if (!isRecord(value) || typeof value.id !== 'string')
         return undefined;

package/node_modules/@undefineds.co/ai-connection/dist/client-config/base-adapter.d.ts

@@ -6,6 +6,7 @@ export declare function normalizeMessagesEndpoint(endpoint: string): string;
 export declare function parseJsonObject(content: string | undefined, label: string): Record<string, unknown>;
 export declare function stringifyJson(value: unknown): string;
 export declare function looksLikePreviousXpodValue(value: unknown): boolean;
+export declare function profileApiKey(profile: AiConnectionClientProfile): string;
 export declare function stripLegacyXpodObject(value: Record<string, unknown>): void;
 export declare abstract class BaseAiClientConfigAdapter implements AiClientConfigAdapter {
     protected readonly client: string;

package/node_modules/@undefineds.co/ai-connection/dist/client-config/base-adapter.js

@@ -35,6 +35,11 @@ export function looksLikePreviousXpodValue(value) {
         value.includes('/api/ai') ||
         value.includes('xpod.'));
 }
+export function profileApiKey(profile) {
+    const legacyField = ['gateway', 'Key'].join('');
+    const value = profile.apiKey ?? profile[legacyField];
+    return typeof value === 'string' ? value : '';
+}
 export function stripLegacyXpodObject(value) {
     const legacy = value.xpod;
     if (legacy && typeof legacy === 'object' && !Array.isArray(legacy)) {
@@ -158,8 +163,8 @@ export class BaseAiClientConfigAdapter {
     validateProfile(profile) {
         if (!profile.endpoint.trim())
             throw new Error('AI Connection endpoint is required');
-        if (!profile.gatewayKey.trim())
-            throw new Error('AI Connection Gateway key is required');
+        if (!profileApiKey(profile).trim())
+            throw new Error('AI Connection API key is required');
         if (!profile.webId.trim())
             throw new Error('Current WebID is required');
     }

package/node_modules/@undefineds.co/ai-connection/dist/client-config/codex.js

@@ -1,7 +1,7 @@
 import * as fs from 'node:fs';
 import * as os from 'node:os';
 import * as path from 'node:path';
-import { BaseAiClientConfigAdapter, looksLikePreviousXpodValue, normalizeV1Endpoint, parseJsonObject, stringifyJson, } from './base-adapter.js';
+import { BaseAiClientConfigAdapter, looksLikePreviousXpodValue, normalizeV1Endpoint, parseJsonObject, profileApiKey, stringifyJson, } from './base-adapter.js';
 const START = '# >>> xpod-ai-connection managed';
 const END = '# <<< xpod-ai-connection managed';
 export class CodexConfigAdapter extends BaseAiClientConfigAdapter {
@@ -34,7 +34,7 @@ export class CodexConfigAdapter extends BaseAiClientConfigAdapter {
             '',
         ].join('\n');
         const auth = parseJsonObject(current.get(this.authPath), 'Codex auth.json');
-        auth.OPENAI_API_KEY = profile.gatewayKey;
+        auth.OPENAI_API_KEY = profileApiKey(profile);
         return new Map([
             [this.configPath, `${config}${config ? '\n\n' : ''}${block}`],
             [this.authPath, stringifyJson(auth)],
@@ -46,7 +46,7 @@ export class CodexConfigAdapter extends BaseAiClientConfigAdapter {
             const auth = parseJsonObject(await fs.promises.readFile(this.authPath, 'utf8'), 'Codex auth.json');
             const ok = config.includes('model_provider = "xpod"') &&
                 config.includes(`base_url = ${JSON.stringify(normalizeV1Endpoint(profile.endpoint))}`) &&
-                auth.OPENAI_API_KEY === profile.gatewayKey;
+                auth.OPENAI_API_KEY === profileApiKey(profile);
             return ok ? { ok: true } : { ok: false, reason: 'Codex projection differs from the requested connection' };
         }
         catch (error) {

package/node_modules/@undefineds.co/ai-connection/dist/client-config/index.cjs

@@ -44,6 +44,7 @@ var exports_client_config = {};
 __export(exports_client_config, {
   stripLegacyXpodObject: () => stripLegacyXpodObject,
   stringifyJson: () => stringifyJson,
+  profileApiKey: () => profileApiKey,
   parseJsonObject: () => parseJsonObject,
   normalizeV1Endpoint: () => normalizeV1Endpoint,
   normalizeMessagesEndpoint: () => normalizeMessagesEndpoint,
@@ -242,6 +243,11 @@ function stringifyJson(value) {
 function looksLikePreviousXpodValue(value) {
   return typeof value === "string" && (value.includes("xpod") || value.includes("/api/ai") || value.includes("xpod."));
 }
+function profileApiKey(profile) {
+  const legacyField = ["gateway", "Key"].join("");
+  const value = profile.apiKey ?? profile[legacyField];
+  return typeof value === "string" ? value : "";
+}
 function stripLegacyXpodObject(value) {
   const legacy = value.xpod;
   if (legacy && typeof legacy === "object" && !Array.isArray(legacy)) {
@@ -370,8 +376,8 @@ class BaseAiClientConfigAdapter {
   validateProfile(profile) {
     if (!profile.endpoint.trim())
       throw new Error("AI Connection endpoint is required");
-    if (!profile.gatewayKey.trim())
-      throw new Error("AI Connection Gateway key is required");
+    if (!profileApiKey(profile).trim())
+      throw new Error("AI Connection API key is required");
     if (!profile.webId.trim())
       throw new Error("Current WebID is required");
   }
@@ -454,7 +460,7 @@ class CodexConfigAdapter extends BaseAiClientConfigAdapter {
     ].join(`
 `);
     const auth = parseJsonObject(current.get(this.authPath), "Codex auth.json");
-    auth.OPENAI_API_KEY = profile.gatewayKey;
+    auth.OPENAI_API_KEY = profileApiKey(profile);
     return new Map([
       [this.configPath, `${config}${config ? `
 
@@ -466,7 +472,7 @@ class CodexConfigAdapter extends BaseAiClientConfigAdapter {
     try {
       const config = await fs3.promises.readFile(this.configPath, "utf8");
       const auth = parseJsonObject(await fs3.promises.readFile(this.authPath, "utf8"), "Codex auth.json");
-      const ok = config.includes('model_provider = "xpod"') && config.includes(`base_url = ${JSON.stringify(normalizeV1Endpoint(profile.endpoint))}`) && auth.OPENAI_API_KEY === profile.gatewayKey;
+      const ok = config.includes('model_provider = "xpod"') && config.includes(`base_url = ${JSON.stringify(normalizeV1Endpoint(profile.endpoint))}`) && auth.OPENAI_API_KEY === profileApiKey(profile);
       return ok ? { ok: true } : { ok: false, reason: "Codex projection differs from the requested connection" };
     } catch (error) {
       return { ok: false, reason: String(error) };
@@ -549,7 +555,7 @@ class JsonEnvAdapter extends BaseAiClientConfigAdapter {
     const beforeEnv = isObject(before.env) ? before.env : {};
     for (const key of Object.keys(this.envProjection({
       endpoint: "https://owned.invalid",
-      gatewayKey: "owned",
+      apiKey: "owned",
       webId: "https://owned.invalid/profile#me"
     }))) {
       if (Object.prototype.hasOwnProperty.call(beforeEnv, key) && !looksLikePreviousXpodValue(beforeEnv[key])) {
@@ -575,7 +581,7 @@ class ClaudeCodeConfigAdapter extends JsonEnvAdapter {
     const settingsPath = path4.join(options.homeDir ?? os2.homedir(), ".claude", "settings.json");
     super("claude-code", settingsPath, (profile) => ({
       ANTHROPIC_BASE_URL: normalizeMessagesEndpoint(profile.endpoint),
-      ANTHROPIC_AUTH_TOKEN: profile.gatewayKey
+      ANTHROPIC_AUTH_TOKEN: profileApiKey(profile)
     }));
   }
 }
@@ -585,7 +591,7 @@ class CodeBuddyConfigAdapter extends JsonEnvAdapter {
     const settingsPath = path4.join(options.homeDir ?? os2.homedir(), ".codebuddy", "settings.json");
     super("codebuddy", settingsPath, (profile) => ({
       CODEBUDDY_BASE_URL: normalizeV1Endpoint(profile.endpoint),
-      CODEBUDDY_API_KEY: profile.gatewayKey
+      CODEBUDDY_API_KEY: profileApiKey(profile)
     }));
   }
 }
@@ -613,7 +619,7 @@ class PiConfigAdapter extends BaseAiClientConfigAdapter {
     settings.defaultModel = model;
     providers.xpod = {
       baseUrl: normalizeV1Endpoint(profile.endpoint),
-      apiKey: profile.gatewayKey,
+      apiKey: profileApiKey(profile),
       authHeader: true,
       api: "openai-responses",
       models: [{ id: model, name: model }]
@@ -628,7 +634,7 @@ class PiConfigAdapter extends BaseAiClientConfigAdapter {
     try {
       const models = parseJsonObject(await fs5.promises.readFile(this.modelsPath, "utf8"), "Pi models.json");
       const xpod = models.providers?.xpod;
-      const ok = xpod?.baseUrl === normalizeV1Endpoint(profile.endpoint) && xpod.apiKey === profile.gatewayKey;
+      const ok = xpod?.baseUrl === normalizeV1Endpoint(profile.endpoint) && xpod.apiKey === profileApiKey(profile);
       return ok ? { ok: true } : { ok: false, reason: "Pi projection differs from the requested connection" };
     } catch (error) {
       return { ok: false, reason: String(error) };

package/node_modules/@undefineds.co/ai-connection/dist/client-config/json-env-adapter.js

@@ -1,7 +1,7 @@
 import * as fs from 'node:fs';
 import * as os from 'node:os';
 import * as path from 'node:path';
-import { BaseAiClientConfigAdapter, looksLikePreviousXpodValue, normalizeMessagesEndpoint, normalizeV1Endpoint, parseJsonObject, stringifyJson, stripLegacyXpodObject, } from './base-adapter.js';
+import { BaseAiClientConfigAdapter, looksLikePreviousXpodValue, normalizeMessagesEndpoint, normalizeV1Endpoint, parseJsonObject, profileApiKey, stringifyJson, stripLegacyXpodObject, } from './base-adapter.js';
 class JsonEnvAdapter extends BaseAiClientConfigAdapter {
     constructor(client, settingsPath, envProjection) {
         super(client, client === 'claude-code' ? 'claude' : 'codebuddy', [settingsPath], path.dirname(settingsPath));
@@ -40,7 +40,7 @@ class JsonEnvAdapter extends BaseAiClientConfigAdapter {
         const beforeEnv = isObject(before.env) ? before.env : {};
         for (const key of Object.keys(this.envProjection({
             endpoint: 'https://owned.invalid',
-            gatewayKey: 'owned',
+            apiKey: 'owned',
             webId: 'https://owned.invalid/profile#me',
         }))) {
             if (Object.prototype.hasOwnProperty.call(beforeEnv, key) && !looksLikePreviousXpodValue(beforeEnv[key])) {
@@ -67,7 +67,7 @@ export class ClaudeCodeConfigAdapter extends JsonEnvAdapter {
         const settingsPath = path.join(options.homeDir ?? os.homedir(), '.claude', 'settings.json');
         super('claude-code', settingsPath, (profile) => ({
             ANTHROPIC_BASE_URL: normalizeMessagesEndpoint(profile.endpoint),
-            ANTHROPIC_AUTH_TOKEN: profile.gatewayKey,
+            ANTHROPIC_AUTH_TOKEN: profileApiKey(profile),
         }));
     }
 }
@@ -76,7 +76,7 @@ export class CodeBuddyConfigAdapter extends JsonEnvAdapter {
         const settingsPath = path.join(options.homeDir ?? os.homedir(), '.codebuddy', 'settings.json');
         super('codebuddy', settingsPath, (profile) => ({
             CODEBUDDY_BASE_URL: normalizeV1Endpoint(profile.endpoint),
-            CODEBUDDY_API_KEY: profile.gatewayKey,
+            CODEBUDDY_API_KEY: profileApiKey(profile),
         }));
     }
 }

package/node_modules/@undefineds.co/ai-connection/dist/client-config/pi.js

@@ -1,7 +1,7 @@
 import * as fs from 'node:fs';
 import * as os from 'node:os';
 import * as path from 'node:path';
-import { BaseAiClientConfigAdapter, looksLikePreviousXpodValue, normalizeV1Endpoint, parseJsonObject, stringifyJson, stripLegacyXpodObject, } from './base-adapter.js';
+import { BaseAiClientConfigAdapter, looksLikePreviousXpodValue, normalizeV1Endpoint, parseJsonObject, profileApiKey, stringifyJson, stripLegacyXpodObject, } from './base-adapter.js';
 export class PiConfigAdapter extends BaseAiClientConfigAdapter {
     constructor(options = {}) {
         const dir = path.join(options.homeDir ?? os.homedir(), '.pi', 'agent');
@@ -22,7 +22,7 @@ export class PiConfigAdapter extends BaseAiClientConfigAdapter {
         settings.defaultModel = model;
         providers.xpod = {
             baseUrl: normalizeV1Endpoint(profile.endpoint),
-            apiKey: profile.gatewayKey,
+            apiKey: profileApiKey(profile),
             authHeader: true,
             api: 'openai-responses',
             models: [{ id: model, name: model }],
@@ -38,7 +38,7 @@ export class PiConfigAdapter extends BaseAiClientConfigAdapter {
             const models = parseJsonObject(await fs.promises.readFile(this.modelsPath, 'utf8'), 'Pi models.json');
             const xpod = models.providers?.xpod;
             const ok = xpod?.baseUrl === normalizeV1Endpoint(profile.endpoint) &&
-                xpod.apiKey === profile.gatewayKey;
+                xpod.apiKey === profileApiKey(profile);
             return ok ? { ok: true } : { ok: false, reason: 'Pi projection differs from the requested connection' };
         }
         catch (error) {

package/node_modules/@undefineds.co/ai-connection/dist/client-config/types.d.ts

@@ -1,6 +1,6 @@
 export interface AiConnectionClientProfile {
     endpoint: string;
-    gatewayKey: string;
+    apiKey?: string;
     webId: string;
     model?: string;
 }

package/node_modules/@undefineds.co/ai-connection/dist/controller.d.ts

@@ -1,4 +1,4 @@
-import type { WebExtensionHost, WebExtensionSessionStatus, WebExtensionSolidPodStatus } from '@undefineds.co/extension-sdk/web';
+import type { AiClientCredentialManager, WebExtensionHost, WebExtensionSessionStatus, WebExtensionSolidPodStatus } from '@undefineds.co/extension-sdk/web';
 import { type AiConnectionClient, type AiConnectionProvider, type AiProviderConnectionSummary } from './ai-connection-client';
 import type { AiClientConfigurationBridge } from './AiClientConfigurationSection';
 export interface AiProviderDefinition {
@@ -18,6 +18,7 @@ export interface AiConnectionController {
     readonly login: () => Promise<void>;
     readonly openExternal: (url: string) => Promise<void>;
     readonly clientConfigurationBridge?: AiClientConfigurationBridge;
+    readonly clientCredentialManager?: AiClientCredentialManager;
     readonly selectedProvider: AiConnectionProvider;
     readonly searchQuery: string;
     readonly providerStates: Partial<Record<AiConnectionProvider, ProviderProductState>>;

package/node_modules/@undefineds.co/ai-connection/dist/controller.js

@@ -47,6 +47,7 @@ export function createAiConnectionController(host) {
         login: host.solid.requireLogin,
         openExternal: host.navigation.openExternal,
         clientConfigurationBridge: host.capabilities.aiClientConfiguration,
+        clientCredentialManager: host.capabilities.aiClientCredentials,
         get selectedProvider() {
             return selectedProvider;
         },

package/node_modules/@undefineds.co/ai-connection/dist/service-access.js

@@ -2,7 +2,6 @@ export const AI_CONNECTION_APPLET_ID = 'co.undefineds.ai-connection';
 const KNOWN_RESOURCE_IDS = new Set([
     'providerCredentials',
     'providerDefinitions',
-    'gatewayAccessKeys',
     'quotaSnapshots',
 ]);
 export function parseAiConnectionServiceAccess(value, currentPodUrl) {

package/node_modules/@undefineds.co/extension-sdk/dist/web.d.ts

@@ -38,7 +38,7 @@ export interface AiClientConfigurationCapability {
     apply(input: {
         client: AiClientId;
         planId: string;
-        gatewayKey: string;
+        apiKey: string;
         confirmation?: {
             token: string;
             targetHash: string;
@@ -52,6 +52,26 @@ export interface AiClientConfigurationCapability {
     }): Promise<AiClientConfigurationStatus>;
     restore(client: AiClientId): Promise<AiClientConfigurationStatus>;
 }
+export interface AiClientCredentialRecord {
+    id: string;
+    resourceUrl: string;
+    webId?: string;
+}
+export interface CreatedAiClientCredential extends AiClientCredentialRecord {
+    clientId: string;
+    clientSecret: string;
+    apiKey: string;
+}
+export interface AiClientCredentialManager {
+    readonly available?: boolean;
+    readonly accountUrl?: string;
+    list(): Promise<AiClientCredentialRecord[]>;
+    create(input: {
+        name: string;
+        webId: string;
+    }): Promise<CreatedAiClientCredential>;
+    revoke(resourceUrl: string): Promise<void>;
+}
 export type WebExtensionSolidPodStatus = 'unavailable' | 'opening' | 'ready' | 'error';
 export type WebExtensionSolidSession = Readonly<Pick<SolidSessionRuntime, 'fetch' | 'getSnapshot' | 'subscribe'>>;
 export type WebExtensionSolidPod<Database = unknown> = {
@@ -105,6 +125,7 @@ export interface WebExtensionNavigationCapability {
 }
 export interface WebExtensionHostCapabilities {
     aiClientConfiguration?: AiClientConfigurationCapability;
+    aiClientCredentials?: AiClientCredentialManager;
 }
 export interface WebExtensionHost<Database = unknown> {
     readonly solid: WebExtensionSolidCapability<Database>;