@undefineds.co/xpod 0.4.10 → 0.4.12

package/node_modules/@undefineds.co/ai-connections/dist/gateway-endpoints.d.ts

@@ -0,0 +1,14 @@
+import type { AiEndpointEntry } from './offering-endpoints';
+/**
+ * The protocols the Xpod gateway serves, as registered by
+ * `src/api/handlers/AiGatewayHandler.ts`:
+ *
+ * - `POST /v1/chat/completions` (OpenAI Chat Completions)
+ * - `POST /v1/responses`        (OpenAI Responses)
+ * - `POST /v1/messages`         (Anthropic Messages)
+ *
+ * Each base URL comes from the same rule the coding-client adapters use, so what
+ * this page advertises is exactly what `AiClientConfigurationService` writes into
+ * a client.
+ */
+export declare function xpodProtocolEndpoints(apiBase: string): AiEndpointEntry[];

package/node_modules/@undefineds.co/ai-connections/dist/gateway-endpoints.js

@@ -0,0 +1,20 @@
+import { normalizeMessagesEndpoint, normalizeV1Endpoint } from './endpoint-urls.js';
+/**
+ * The protocols the Xpod gateway serves, as registered by
+ * `src/api/handlers/AiGatewayHandler.ts`:
+ *
+ * - `POST /v1/chat/completions` (OpenAI Chat Completions)
+ * - `POST /v1/responses`        (OpenAI Responses)
+ * - `POST /v1/messages`         (Anthropic Messages)
+ *
+ * Each base URL comes from the same rule the coding-client adapters use, so what
+ * this page advertises is exactly what `AiClientConfigurationService` writes into
+ * a client.
+ */
+export function xpodProtocolEndpoints(apiBase) {
+    return [
+        { protocol: 'chatCompletions', baseUrl: normalizeV1Endpoint(apiBase) },
+        { protocol: 'responses', baseUrl: normalizeV1Endpoint(apiBase) },
+        { protocol: 'anthropic', baseUrl: normalizeMessagesEndpoint(apiBase) },
+    ];
+}

package/node_modules/@undefineds.co/ai-connections/dist/index.d.ts

@@ -3,7 +3,11 @@ import { type AiConnectionsController } from './controller';
 export * from './ai-connections-client';
 export * from './AiClientConfigurationSection';
 export * from './AiConnectionsPanel';
+export * from './AiCopyButton';
+export * from './AiEndpointList';
 export * from './AiGatewayKeysSection';
+export * from './AiInfoTooltip';
+export * from './AiProviderHeader';
 export * from './AiConnectionsList';
 export * from './AiConnectionsMain';
 export * from './AiConnectionsHeader';
@@ -11,6 +15,10 @@ export * from './AiConnectionsMainHeader';
 export * from './AiCustomProviderDialog';
 export * from './AiModelEditorDialog';
 export * from './controller';
+export * from './collections';
+export * from './credential-storage';
+export * from './endpoint-urls';
+export * from './gateway-endpoints';
 export * from './AiProviderCard';
 export * from './AiCredentialPoolSection';
 export * from './offering-label';

package/node_modules/@undefineds.co/ai-connections/dist/index.js

@@ -9,7 +9,11 @@ import { createElement } from 'react';
 export * from './ai-connections-client.js';
 export * from './AiClientConfigurationSection.js';
 export * from './AiConnectionsPanel.js';
+export * from './AiCopyButton.js';
+export * from './AiEndpointList.js';
 export * from './AiGatewayKeysSection.js';
+export * from './AiInfoTooltip.js';
+export * from './AiProviderHeader.js';
 export * from './AiConnectionsList.js';
 export * from './AiConnectionsMain.js';
 export * from './AiConnectionsHeader.js';
@@ -17,6 +21,10 @@ export * from './AiConnectionsMainHeader.js';
 export * from './AiCustomProviderDialog.js';
 export * from './AiModelEditorDialog.js';
 export * from './controller.js';
+export * from './collections.js';
+export * from './credential-storage.js';
+export * from './endpoint-urls.js';
+export * from './gateway-endpoints.js';
 export * from './AiProviderCard.js';
 export * from './AiCredentialPoolSection.js';
 export * from './offering-label.js';

package/node_modules/@undefineds.co/ai-connections/dist/manifest.js

@@ -14,5 +14,5 @@ export const aiConnectionManifest = validateExtensionManifest({
             }],
     },
     dataModels: [],
-    hostCapabilities: ['navigation.openExternal', 'aiClientConfiguration'],
+    hostCapabilities: ['navigation.openExternal', 'aiClientConfiguration', 'solidNotifications', 'podCollections'],
 });

package/node_modules/@undefineds.co/ai-connections/dist/offering-endpoints.d.ts

@@ -1,5 +1,19 @@
 import type { AiProviderOffering } from './ai-connections-client';
+/** One protocol the user can point a client at: the `protocol → base URL` pair the UI lists. */
+export interface AiEndpointEntry {
+    protocol: string;
+    baseUrl: string;
+}
 /** Endpoint the offering actually talks to: the discovery protocol wins, first endpoint is the fallback. */
 export declare function offeringEndpoint(offering: AiProviderOffering): string | undefined;
 export declare function endpointDisplayValue(value: string): string;
+/**
+ * How a provider's own endpoint is described: by the API it serves.
+ *
+ * Used where the reader is inspecting what an upstream offering speaks. Xpod's
+ * own endpoints are named by {@link compatibleProtocolLabel} instead, because a
+ * client arrives already speaking a protocol rather than asking what Xpod uses.
+ */
 export declare function endpointProtocolLabel(protocol: string): string;
+/** The client protocols Xpod accepts, named the way the client's own docs name them. */
+export declare function compatibleProtocolLabel(protocol: string): string;

package/node_modules/@undefineds.co/ai-connections/dist/offering-endpoints.js

@@ -13,6 +13,13 @@ export function endpointDisplayValue(value) {
         return value;
     }
 }
+/**
+ * How a provider's own endpoint is described: by the API it serves.
+ *
+ * Used where the reader is inspecting what an upstream offering speaks. Xpod's
+ * own endpoints are named by {@link compatibleProtocolLabel} instead, because a
+ * client arrives already speaking a protocol rather than asking what Xpod uses.
+ */
 export function endpointProtocolLabel(protocol) {
     if (protocol === 'responses')
         return 'Responses API';
@@ -22,3 +29,13 @@ export function endpointProtocolLabel(protocol) {
         return 'Anthropic API';
     return protocol;
 }
+/** The client protocols Xpod accepts, named the way the client's own docs name them. */
+export function compatibleProtocolLabel(protocol) {
+    if (protocol === 'responses')
+        return 'OpenAI Responses 兼容';
+    if (protocol === 'chatCompletions')
+        return 'OpenAI Chat 兼容';
+    if (protocol === 'anthropic')
+        return 'Anthropic Messages 兼容';
+    return `${protocol} 兼容`;
+}

package/node_modules/@undefineds.co/ai-connections/dist/provider-catalog.cjs

@@ -39,19 +39,52 @@ var __export = (target, all) => {
 // src/provider-catalog.ts
 var exports_provider_catalog = {};
 __export(exports_provider_catalog, {
+  storedOfferingIdFor: () => storedOfferingIdFor,
   providerOfferings: () => providerOfferings,
   providerName: () => providerName,
   offeringBaseUrl: () => offeringBaseUrl,
   defaultOfferingFor: () => defaultOfferingFor,
   customCompatibilityValue: () => customCompatibilityValue,
+  credentialOfferingMetadata: () => credentialOfferingMetadata,
   PROVIDER_OFFERINGS: () => PROVIDER_OFFERINGS,
   DEFAULT_PROVIDER_OFFERINGS: () => DEFAULT_PROVIDER_OFFERINGS,
-  CUSTOM_DEFAULT_OFFERINGS: () => CUSTOM_DEFAULT_OFFERINGS
+  CUSTOM_DEFAULT_OFFERINGS: () => CUSTOM_DEFAULT_OFFERINGS,
+  BROWSER_LOGIN_METHOD: () => BROWSER_LOGIN_METHOD,
+  API_KEY_METHOD: () => API_KEY_METHOD,
+  AI_CONNECTIONS_PROVIDER_DOCUMENT_IDS: () => AI_CONNECTIONS_PROVIDER_DOCUMENT_IDS
 });
 module.exports = __toCommonJS(exports_provider_catalog);
+
+// src/client/types.ts
+var AI_CONNECTIONS_PROVIDERS = [
+  "openai",
+  "anthropic",
+  "kimi",
+  "bailian",
+  "deepseek",
+  "zhipu",
+  "ollama",
+  "custom"
+];
+
+// src/provider-catalog.ts
 var DEFAULT_PROVIDER_OFFERINGS = [
   { id: "api-platform", label: "API Platform", kind: "api-platform", lifecycle: "active", authModes: ["apiKey"] }
 ];
+var API_KEY_METHOD = {
+  id: "api-key",
+  authMode: "apiKey",
+  label: "添加 API Key",
+  lifecycle: "active"
+};
+var BROWSER_LOGIN_METHOD = {
+  id: "browser-login",
+  authMode: "apiKey",
+  connectMode: "browserAssistedApiKey",
+  label: "浏览器登录",
+  lifecycle: "active"
+};
+var API_KEY_METHODS = [API_KEY_METHOD, BROWSER_LOGIN_METHOD];
 var CUSTOM_DEFAULT_OFFERINGS = [
   {
     id: "openai-compatible",
@@ -119,6 +152,7 @@ var PROVIDER_OFFERINGS = {
       kind: "api-platform",
       lifecycle: "active",
       authModes: ["apiKey"],
+      authorizationMethods: API_KEY_METHODS,
       productLabel: "OpenAI",
       runtimeProviderIds: ["openai"],
       credentialPrefixHints: ["sk-"],
@@ -158,6 +192,7 @@ var PROVIDER_OFFERINGS = {
       kind: "api-platform",
       lifecycle: "active",
       authModes: ["apiKey"],
+      authorizationMethods: API_KEY_METHODS,
       productLabel: "Anthropic",
       runtimeProviderIds: ["anthropic"],
       credentialPrefixHints: ["sk-ant-"],
@@ -255,6 +290,7 @@ var PROVIDER_OFFERINGS = {
       kind: "api-platform",
       lifecycle: "active",
       authModes: ["apiKey"],
+      authorizationMethods: API_KEY_METHODS,
       productLabel: "智谱 AI",
       runtimeProviderIds: ["zhipu"],
       credentialPrefixHints: ["id."],
@@ -272,6 +308,7 @@ var PROVIDER_OFFERINGS = {
       kind: "token-plan",
       lifecycle: "active",
       authModes: ["apiKey"],
+      authorizationMethods: API_KEY_METHODS,
       productLabel: "智谱 AI",
       runtimeProviderIds: ["zhipu"],
       credentialPrefixHints: ["id."],
@@ -292,6 +329,7 @@ function kimiOffering(input) {
     kind: input.kind,
     lifecycle: "active",
     authModes: input.authModes,
+    authorizationMethods: API_KEY_METHODS,
     productLabel: input.productLabel,
     runtimeProviderIds: input.runtimeProviderIds,
     credentialPrefixHints: input.credentialPrefixHints,
@@ -312,6 +350,7 @@ function bailianOffering(input) {
     productLabel: "Alibaba Bailian",
     kind: input.kind,
     authModes: ["apiKey"],
+    authorizationMethods: API_KEY_METHODS,
     runtimeProviderIds: input.runtimeProviderIds,
     credentialPrefixHints: input.credentialPrefixHints,
     consoleUrl: input.consoleUrl,
@@ -350,6 +389,15 @@ function providerOfferings(provider, openAiSubscriptionImportAvailable = false)
     return { ...offering };
   });
 }
+var AI_CONNECTIONS_PROVIDER_DOCUMENT_IDS = AI_CONNECTIONS_PROVIDERS.flatMap((provider) => [
+  provider,
+  ...builtinOfferings(provider).map((offering) => `${provider}-${offering.id}`)
+]);
+function builtinOfferings(provider) {
+  if (provider === "custom")
+    return CUSTOM_DEFAULT_OFFERINGS;
+  return PROVIDER_OFFERINGS[provider] ?? DEFAULT_PROVIDER_OFFERINGS;
+}
 function customCompatibilityValue(value, offeringId) {
   if (value === "anthropic" || offeringId === "anthropic-compatible")
     return "anthropic";
@@ -397,3 +445,22 @@ function offeringBaseUrl(provider, offeringId) {
   const discoveryProtocol = offering.modelDiscovery?.endpointProtocol;
   return offering.endpoints?.find((endpoint) => endpoint.protocol === discoveryProtocol)?.baseUrl ?? offering.endpoints?.[0]?.baseUrl;
 }
+function storedOfferingIdFor(provider, offeringId) {
+  const normalized = offeringId.trim().toLowerCase();
+  if (provider === "bailian") {
+    if (normalized === "token-plan-personal")
+      return "token-plan";
+    if (normalized === "coding-plan-pro")
+      return "coding-plan";
+  }
+  return normalized;
+}
+function credentialOfferingMetadata(input) {
+  return {
+    offeringId: input.offeringId,
+    priority: input.priority ?? 100,
+    enabled: input.enabled ?? true,
+    health: input.health ?? "unknown",
+    ...input.baseUrl ? { baseUrl: input.baseUrl } : {}
+  };
+}

package/node_modules/@undefineds.co/ai-connections/dist/provider-catalog.d.ts

@@ -1,9 +1,83 @@
-import type { AiConnectionsProvider, AiProviderCredentialSummary, AiProviderOffering } from './ai-connections-client';
+import type { AiConnectionsProvider, AiProviderAuthorizationMethod, AiProviderCredentialSummary, AiProviderOffering } from './ai-connections-client';
 export declare const DEFAULT_PROVIDER_OFFERINGS: AiProviderOffering[];
+/**
+ * How an offering accepts a key: typed into Xpod's own form (this entry) or
+ * minted in the provider's console (the browser-assisted entry below). An
+ * offering that declares its actions declares this one too - the catalog is the
+ * single source of the wording, and the server only decides whether the entry is
+ * usable in a given deployment.
+ */
+export declare const API_KEY_METHOD: AiProviderAuthorizationMethod;
+/**
+ * The connect entry that opens the provider's own console so the user signs in
+ * there and mints a key. Which ways in exist is offering data, so the entry is
+ * declared on the offerings that accept a key (`authModes` keeps the mechanical
+ * truth, `apiKey`) instead of on a provider-level label, and it points at the
+ * `consoleUrl` the offering already carries.
+ *
+ * Providers without one say something real by not declaring it: DeepSeek has no
+ * account console to sign into, Ollama is a local service, and `custom` is
+ * configured inside Xpod rather than at a provider.
+ *
+ * The label is 浏览器登录 rather than the legacy 「登录」 because it names the
+ * action the way its siblings do (浏览器登录 / 设备码登录 / 已有登录态); 「登录」
+ * named the provider instead, which is what let a provider-level string claim a
+ * capability no offering declared.
+ */
+export declare const BROWSER_LOGIN_METHOD: AiProviderAuthorizationMethod;
 export declare const CUSTOM_DEFAULT_OFFERINGS: AiProviderOffering[];
 export declare const PROVIDER_OFFERINGS: Partial<Record<AiConnectionsProvider, AiProviderOffering[]>>;
 export declare function providerOfferings(provider: AiConnectionsProvider, openAiSubscriptionImportAvailable?: boolean): AiProviderOffering[];
+/**
+ * Provider documents the AI Connection service is granted access to: the
+ * provider container document plus one document per built-in offering, named
+ * `<provider>-<offeringId>` by the Pod layout.
+ *
+ * This is the single program-side authority for that list. The Gateway's
+ * service-access descriptor and this package's descriptor validator both read
+ * it, so the granted surface and the validator cannot drift from the catalogue
+ * or from each other. Adding an offering to the catalogue adds its document
+ * here, which is exactly the program capability the service is allowed to
+ * reach.
+ */
+export declare const AI_CONNECTIONS_PROVIDER_DOCUMENT_IDS: readonly string[];
 export declare function customCompatibilityValue(value: unknown, offeringId?: string): 'openai' | 'anthropic';
 export declare function providerName(provider: AiConnectionsProvider): string;
 export declare function defaultOfferingFor(provider: AiConnectionsProvider, authMode: AiProviderCredentialSummary['authMode']): string;
 export declare function offeringBaseUrl(provider: AiConnectionsProvider, offeringId?: string): string | undefined;
+/**
+ * The offering id a credential records.
+ *
+ * An offering id is catalog content, so this stores the catalog's own id
+ * (`token-plan`, `coding-plan`, `pay-as-you-go`, …) lower-cased. The bootstrap
+ * naming turned two Bailian ids into document-name variants; those are folded
+ * back so the attribute never carries a storage-layout artefact.
+ *
+ * It lives in the capability package rather than in the Pod adapter that first
+ * needed it: the adapter, the collection runtime and the read emulation in tests
+ * all have to agree on this column, and a second copy would drift on the first
+ * catalog change (AGENTS.md: 目录内容跟能力走, 不得保留第二份副本).
+ */
+export declare function storedOfferingIdFor(provider: AiConnectionsProvider, offeringId: string): string;
+/**
+ * The offering-derived part of a credential row's `metadata`.
+ *
+ * MIGRATION WINDOW: the offering is written both as the credential's
+ * `udfs:offeringId` attribute and inside the `metadata` JSON.
+ * `@undefineds.co/models` releases before the one that declares `offeringId`
+ * persist neither (drizzle-solid drops values whose key is not a declared
+ * column), so a bundle built against such a release would lose it. Drop the
+ * `metadata` copy once every consumer is built against the declaring release and
+ * no reader needs the fallback in `credentialOfferingIdFromRow`.
+ *
+ * Shared for the same reason as {@link storedOfferingIdFor}: a credential's row
+ * has exactly one shape, and the collection would read its own confirmation as a
+ * change if the writer and the projection disagreed on it.
+ */
+export declare function credentialOfferingMetadata(input: {
+    offeringId: string;
+    baseUrl?: string;
+    priority?: number;
+    enabled?: boolean;
+    health?: string;
+}): Record<string, unknown>;

package/node_modules/@undefineds.co/ai-connections/dist/provider-catalog.js

@@ -1,9 +1,48 @@
+import { AI_CONNECTIONS_PROVIDERS } from './client/types.js';
 // Built-in provider and offering catalog. This is the single place that names a
 // provider or an offering; display layers project from it instead of keeping a
 // second copy, which is how the same offering used to appear under two names.
 export const DEFAULT_PROVIDER_OFFERINGS = [
     { id: 'api-platform', label: 'API Platform', kind: 'api-platform', lifecycle: 'active', authModes: ['apiKey'] },
 ];
+/**
+ * How an offering accepts a key: typed into Xpod's own form (this entry) or
+ * minted in the provider's console (the browser-assisted entry below). An
+ * offering that declares its actions declares this one too - the catalog is the
+ * single source of the wording, and the server only decides whether the entry is
+ * usable in a given deployment.
+ */
+export const API_KEY_METHOD = {
+    id: 'api-key',
+    authMode: 'apiKey',
+    label: '添加 API Key',
+    lifecycle: 'active',
+};
+/**
+ * The connect entry that opens the provider's own console so the user signs in
+ * there and mints a key. Which ways in exist is offering data, so the entry is
+ * declared on the offerings that accept a key (`authModes` keeps the mechanical
+ * truth, `apiKey`) instead of on a provider-level label, and it points at the
+ * `consoleUrl` the offering already carries.
+ *
+ * Providers without one say something real by not declaring it: DeepSeek has no
+ * account console to sign into, Ollama is a local service, and `custom` is
+ * configured inside Xpod rather than at a provider.
+ *
+ * The label is 浏览器登录 rather than the legacy 「登录」 because it names the
+ * action the way its siblings do (浏览器登录 / 设备码登录 / 已有登录态); 「登录」
+ * named the provider instead, which is what let a provider-level string claim a
+ * capability no offering declared.
+ */
+export const BROWSER_LOGIN_METHOD = {
+    id: 'browser-login',
+    authMode: 'apiKey',
+    connectMode: 'browserAssistedApiKey',
+    label: '浏览器登录',
+    lifecycle: 'active',
+};
+/** Both ways a key arrives, for an offering whose provider has a console. */
+const API_KEY_METHODS = [API_KEY_METHOD, BROWSER_LOGIN_METHOD];
 export const CUSTOM_DEFAULT_OFFERINGS = [
     {
         id: 'openai-compatible',
@@ -79,6 +118,7 @@ export const PROVIDER_OFFERINGS = {
             kind: 'api-platform',
             lifecycle: 'active',
             authModes: ['apiKey'],
+            authorizationMethods: API_KEY_METHODS,
             productLabel: 'OpenAI',
             runtimeProviderIds: ['openai'],
             credentialPrefixHints: ['sk-'],
@@ -118,6 +158,7 @@ export const PROVIDER_OFFERINGS = {
             kind: 'api-platform',
             lifecycle: 'active',
             authModes: ['apiKey'],
+            authorizationMethods: API_KEY_METHODS,
             productLabel: 'Anthropic',
             runtimeProviderIds: ['anthropic'],
             credentialPrefixHints: ['sk-ant-'],
@@ -217,6 +258,7 @@ export const PROVIDER_OFFERINGS = {
             kind: 'api-platform',
             lifecycle: 'active',
             authModes: ['apiKey'],
+            authorizationMethods: API_KEY_METHODS,
             productLabel: '智谱 AI',
             runtimeProviderIds: ['zhipu'],
             credentialPrefixHints: ['id.'],
@@ -234,6 +276,7 @@ export const PROVIDER_OFFERINGS = {
             kind: 'token-plan',
             lifecycle: 'active',
             authModes: ['apiKey'],
+            authorizationMethods: API_KEY_METHODS,
             productLabel: '智谱 AI',
             runtimeProviderIds: ['zhipu'],
             credentialPrefixHints: ['id.'],
@@ -254,6 +297,7 @@ function kimiOffering(input) {
         kind: input.kind,
         lifecycle: 'active',
         authModes: input.authModes,
+        authorizationMethods: API_KEY_METHODS,
         productLabel: input.productLabel,
         runtimeProviderIds: input.runtimeProviderIds,
         credentialPrefixHints: input.credentialPrefixHints,
@@ -274,6 +318,7 @@ function bailianOffering(input) {
         productLabel: 'Alibaba Bailian',
         kind: input.kind,
         authModes: ['apiKey'],
+        authorizationMethods: API_KEY_METHODS,
         runtimeProviderIds: input.runtimeProviderIds,
         credentialPrefixHints: input.credentialPrefixHints,
         consoleUrl: input.consoleUrl,
@@ -314,6 +359,33 @@ export function providerOfferings(provider, openAiSubscriptionImportAvailable =
         return { ...offering };
     });
 }
+/**
+ * Provider documents the AI Connection service is granted access to: the
+ * provider container document plus one document per built-in offering, named
+ * `<provider>-<offeringId>` by the Pod layout.
+ *
+ * This is the single program-side authority for that list. The Gateway's
+ * service-access descriptor and this package's descriptor validator both read
+ * it, so the granted surface and the validator cannot drift from the catalogue
+ * or from each other. Adding an offering to the catalogue adds its document
+ * here, which is exactly the program capability the service is allowed to
+ * reach.
+ */
+export const AI_CONNECTIONS_PROVIDER_DOCUMENT_IDS = AI_CONNECTIONS_PROVIDERS.flatMap((provider) => [
+    provider,
+    ...builtinOfferings(provider).map((offering) => `${provider}-${offering.id}`),
+]);
+/**
+ * Built-in offerings of one provider as the catalogue declares them. `custom`
+ * keeps its placeholder offerings in their own table because its endpoints are
+ * intentionally invalid; every other provider declares its own list above.
+ * This mirrors the Gateway's `ProviderRegistry.offeringsForProduct`.
+ */
+function builtinOfferings(provider) {
+    if (provider === 'custom')
+        return CUSTOM_DEFAULT_OFFERINGS;
+    return PROVIDER_OFFERINGS[provider] ?? DEFAULT_PROVIDER_OFFERINGS;
+}
 export function customCompatibilityValue(value, offeringId) {
     if (value === 'anthropic' || offeringId === 'anthropic-compatible')
         return 'anthropic';
@@ -362,3 +434,50 @@ export function offeringBaseUrl(provider, offeringId) {
     return offering.endpoints?.find((endpoint) => endpoint.protocol === discoveryProtocol)?.baseUrl
         ?? offering.endpoints?.[0]?.baseUrl;
 }
+/**
+ * The offering id a credential records.
+ *
+ * An offering id is catalog content, so this stores the catalog's own id
+ * (`token-plan`, `coding-plan`, `pay-as-you-go`, …) lower-cased. The bootstrap
+ * naming turned two Bailian ids into document-name variants; those are folded
+ * back so the attribute never carries a storage-layout artefact.
+ *
+ * It lives in the capability package rather than in the Pod adapter that first
+ * needed it: the adapter, the collection runtime and the read emulation in tests
+ * all have to agree on this column, and a second copy would drift on the first
+ * catalog change (AGENTS.md: 目录内容跟能力走, 不得保留第二份副本).
+ */
+export function storedOfferingIdFor(provider, offeringId) {
+    const normalized = offeringId.trim().toLowerCase();
+    if (provider === 'bailian') {
+        if (normalized === 'token-plan-personal')
+            return 'token-plan';
+        if (normalized === 'coding-plan-pro')
+            return 'coding-plan';
+    }
+    return normalized;
+}
+/**
+ * The offering-derived part of a credential row's `metadata`.
+ *
+ * MIGRATION WINDOW: the offering is written both as the credential's
+ * `udfs:offeringId` attribute and inside the `metadata` JSON.
+ * `@undefineds.co/models` releases before the one that declares `offeringId`
+ * persist neither (drizzle-solid drops values whose key is not a declared
+ * column), so a bundle built against such a release would lose it. Drop the
+ * `metadata` copy once every consumer is built against the declaring release and
+ * no reader needs the fallback in `credentialOfferingIdFromRow`.
+ *
+ * Shared for the same reason as {@link storedOfferingIdFor}: a credential's row
+ * has exactly one shape, and the collection would read its own confirmation as a
+ * change if the writer and the projection disagreed on it.
+ */
+export function credentialOfferingMetadata(input) {
+    return {
+        offeringId: input.offeringId,
+        priority: input.priority ?? 100,
+        enabled: input.enabled ?? true,
+        health: input.health ?? 'unknown',
+        ...(input.baseUrl ? { baseUrl: input.baseUrl } : {}),
+    };
+}

package/node_modules/@undefineds.co/ai-connections/dist/provider-visuals.d.ts

@@ -1,3 +1,8 @@
 import type { AiConnectionsProvider } from './ai-connections-client';
+/**
+ * The Xpod shield (`ui/src/assets/xpod-shield.svg`), inlined like the provider
+ * marks: from a coding client's point of view Xpod is just another provider.
+ */
+export declare const XPOD_AVATAR = "data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZpZXdCb3g9IjAgMCA2NCA2NCIgZmlsbD0ibm9uZSI+CiAgPHBhdGgKICAgIGQ9Ik0zMiA3IDUxIDE2LjV2MTMuOGMwIDEyLjQtNy40IDIxLjItMTkgMjcuNy0xMS42LTYuNS0xOS0xNS4zLTE5LTI3LjdWMTYuNUwzMiA3WiIKICAgIHN0cm9rZT0iIzhBNzJCRSIKICAgIHN0cm9rZS13aWR0aD0iNSIKICAgIHN0cm9rZS1saW5lY2FwPSJyb3VuZCIKICAgIHN0cm9rZS1saW5lam9pbj0icm91bmQiCiAgLz4KPC9zdmc+Cg==";
 export declare function getProviderAvatar(provider: AiConnectionsProvider | string): string | undefined;
 export declare function getProviderAvatarBackground(provider: AiConnectionsProvider | string): string | undefined;

package/node_modules/@undefineds.co/ai-connections/dist/provider-visuals.js

@@ -7,6 +7,11 @@ const bailianAvatar = 'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAEAAAABACAY
 const zhipuAvatar = 'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAFoAAABaCAYAAAA4qEECAAAACXBIWXMAACE4AAAhOAFFljFgAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAOdEVYdFNvZnR3YXJlAEZpZ21hnrGWYwAABRxJREFUeAHtnaFTG0EUxh9MLQy1YK4KJMyAT1EoKAYDM23BgKIGFDOFwaFSBQamzIDBdFDgGoMCgQTVGNAM/AF0v8tee9lsQjbZt7m929/MJtcjaciXl7dvv+PuEQUCgYAxfdQBr6+vkbgriTEkRxF4EqOK0dfXd0uGtC20EBeCrovxRYyIik1VjJ9iHAvRq+08oS2hhcgQeJtk9N7f39P19TU9Pj7Sy8sLFYHh4WEaGBigqakpGh0dTXYjystC7J23nt9SaBnFv6iWJuj8/JxOT0/p7u6OigxEX1tbo7m5uWRXRYyvraK7qdBS5N9ijCNy19fX40gO/AeCHx0dxfdUSycTQuwn3WNbCQ2RSxB3eXm5MCnCFKSTw8NDGhsbwz8rQuiPusf163YKkb+LuxIiOYjcGmizsrKSpNOS0O6b7nENES1LN0RzNDMzE094gbdB+ri8vMQmUscHNYXoIvqTGBEmviBy+0Cr/f19bGJua4hqXUT/oRDNHYF8fXV1hc0nEdHv0z+ri2iZNiJMgEFkc5Cvb25usDkktfyHmjrGcYPFSKAzUmuMUnq/KnSEm1BldE4qE0Tp/arQQ8qDA4Y0C9J+CjghCO2IILQjgtCOeEeWgGWYsg3Z2dvbq7Nrl5aWaHp6mmyDUleu+LrCmtBY609OTpIL8MbTIsOM39zcJNug+oIVYQPvUkfKU4gZGRmh3d1d4gCvY6vU9U5o2LZpVldXE+PdKohkW9EMvBJajTDkZY55Qf3W2MAboWHWqCkDx+04wGE726tjL4SGyFtbW3X7cPgItqRt8GFyHBu1VnUgn0mL0CrPz88NbxyRzJGXOVJGgjWh8Uu6MKO4UgbMIHWitYlXk+Hg4GCcMjiwWcrp8EpozlLu5OSEOPFGaJRxKOdsw5mX03ghNGcpx50yErwQGktsjpSBdGFz9deKzAuNSOYwqxDFcABdkWmhOVMGZymnI9NC+1rK6cis0FyrP9UzcUUmhYaRz5EyEMWqZ+KKzAnti5FvSuaE9sXINyVTQvtk5JuSGaF9M/JNyYzQvhn5pmRCaB+NfFN6LrSvRr4pPRXaZyPflJ4K7bORb0rPhPbdyDelJ0Lnwcg3pSdC58HIN8W50Hkx8k1xKnSejHxTnApdlFJOhzOh82bkm+JE6Dwa+aawC51XI98UdqHzauSbwip0no18U9iEzruRb4q1v49WcWnk48JRHK+FD/Ph4YFswCK0KyM/mWi5zm/Ea9lKUdZTh0sjf2Njw9lJpN1iVWiXRj4+TI5TkrmwKrQrI59zouXCmtAujXyubw0nVoR2aeRzTbTcWKk6ZmdnWU5/wyUc0qs/fKDwTTjOZ9Rh8/1YEdpmGdQK1LRZ952bEa5A44ggtCOC0I4IQjtCFTq+5jGHQVMUmmmnFdrHOjUrpLSr69WiCl3BDWrVQGektKum99cJLdtbVNFnRDYHCBiABZXs0dLQfUg3GR7jZnFxkQJmwFSTHKs/0116Hpc2xuXnhxYWFgrf3KZdEM0XFxfYxDw3oTa/aYho2W0hbklULpdjjznQGsWH/6HrMNRWwxv0GcFFpAKNJCLL3GzW8EYyL8Yt/oOzs7P4qxGoBwUDtEkmQKpppsW4KdnBwYG1I8O+AmGVv1mpiDHfrE8WaLfN3ra4+0yyQUDSZg8HTIvSDwArPixGNG32doTA5beeb9I4MqJa1yH0Noyo2FSpVsKVW0Vxmm5aoaJnC+6L1AoVo9JuV85AIBDokr8WvnnavEglMwAAAABJRU5ErkJggg==';
 'data:image/svg+xml;utf8,%3Csvg%20xmlns%3D%27http%3A//www.w3.org/2000/svg%27%20viewBox%3D%270%200%20200%20200%27%3E%3Cdefs%3E%3ClinearGradient%20id%3D%27g%27%20x1%3D%270%27%20y1%3D%270%27%20x2%3D%271%27%20y2%3D%271%27%3E%3Cstop%20offset%3D%270%27%20stop-color%3D%27%237A5CFF%27/%3E%3Cstop%20offset%3D%271%27%20stop-color%3D%27%234A6CF7%27/%3E%3C/linearGradient%3E%3C/defs%3E%3Crect%20width%3D%27200%27%20height%3D%27200%27%20fill%3D%27url%28%23g%29%27/%3E%3Cpath%20fill%3D%27%23FFFFFF%27%20fill-rule%3D%27evenodd%27%20d%3D%27M100%2036%20L156%2068%20L156%20132%20L100%20164%20L44%20132%20L44%2068%20Z%20M100%2064%20C102.5%2086%20114%2097.5%20136%20100%20C114%20102.5%20102.5%20114%20100%20136%20C97.5%20114%2086%20102.5%2064%20100%20C86%2097.5%2097.5%2086%20100%2064%20Z%27/%3E%3C/svg%3E';
 const ollamaAvatar = 'data:image/svg+xml;utf8,%3Csvg%20viewBox%3D%220%200%2024%2024%22%20xmlns%3D%22http%3A//www.w3.org/2000/svg%22%3E%3Cpath%20d%3D%22M16.361%2010.26a.894.894%200%200%200-.558.47l-.072.148.001.207c0%20.193.004.217.059.353.076.193.152.312.291.448.24.238.51.3.872.205a.86.86%200%200%200%20.517-.436.752.752%200%200%200%20.08-.498c-.064-.453-.33-.782-.724-.897a1.06%201.06%200%200%200-.466%200zm-9.203.005c-.305.096-.533.32-.65.639a1.187%201.187%200%200%200-.06.52c.057.309.31.59.598.667.362.095.632.033.872-.205.14-.136.215-.255.291-.448.055-.136.059-.16.059-.353l.001-.207-.072-.148a.894.894%200%200%200-.565-.472%201.02%201.02%200%200%200-.474.007Zm4.184%202c-.131.071-.223.25-.195.383.031.143.157.288.353.407.105.063.112.072.117.136.004.038-.01.146-.029.243-.02.094-.036.194-.036.222.002.074.07.195.143.253.064.052.076.054.255.059.164.005.198.001.264-.03.169-.082.212-.234.15-.525-.052-.243-.042-.28.087-.355.137-.08.281-.219.324-.314a.365.365%200%200%200-.175-.48.394.394%200%200%200-.181-.033c-.126%200-.207.03-.355.124l-.085.053-.053-.032c-.219-.13-.259-.145-.391-.143a.396.396%200%200%200-.193.032zm.39-2.195c-.373.036-.475.05-.654.086-.291.06-.68.195-.951.328-.94.46-1.589%201.226-1.787%202.114-.04.176-.045.234-.045.53%200%20.294.005.357.043.524.264%201.16%201.332%202.017%202.714%202.173.3.033%201.596.033%201.896%200%201.11-.125%202.064-.727%202.493-1.571.114-.226.169-.372.22-.602.039-.167.044-.23.044-.523%200-.297-.005-.355-.045-.531-.288-1.29-1.539-2.304-3.072-2.497a6.873%206.873%200%200%200-.855-.031zm.645.937a3.283%203.283%200%200%201%201.44.514c.223.148.537.458.671.662.166.251.26.508.303.82.02.143.01.251-.043.482-.08.345-.332.705-.672.957a3.115%203.115%200%200%201-.689.348c-.382.122-.632.144-1.525.138-.582-.006-.686-.01-.853-.042-.57-.107-1.022-.334-1.35-.68-.264-.28-.385-.535-.45-.946-.03-.192.025-.509.137-.776.136-.326.488-.73.836-.963.403-.269.934-.46%201.422-.512.187-.02.586-.02.773-.002zm-5.503-11a1.653%201.653%200%200%200-.683.298C5.617.74%205.173%201.666%204.985%202.819c-.07.436-.119%201.04-.119%201.503%200%20.544.064%201.24.155%201.721.02.107.031.202.023.208a8.12%208.12%200%200%201-.187.152%205.324%205.324%200%200%200-.949%201.02%205.49%205.49%200%200%200-.94%202.339%206.625%206.625%200%200%200-.023%201.357c.091.78.325%201.438.727%202.04l.13.195-.037.064c-.269.452-.498%201.105-.605%201.732-.084.496-.095.629-.095%201.294%200%20.67.009.803.088%201.266.095.555.288%201.143.503%201.534.071.128.243.393.264.407.007.003-.014.067-.046.141a7.405%207.405%200%200%200-.548%201.873c-.062.417-.071.552-.071.991%200%20.56.031.832.148%201.279L3.42%2024h1.478l-.05-.091c-.297-.552-.325-1.575-.068-2.597.117-.472.25-.819.498-1.296l.148-.29v-.177c0-.165-.003-.184-.057-.293a.915.915%200%200%200-.194-.25%201.74%201.74%200%200%201-.385-.543c-.424-.92-.506-2.286-.208-3.451.124-.486.329-.918.544-1.154a.787.787%200%200%200%20.223-.531c0-.195-.07-.355-.224-.522a3.136%203.136%200%200%201-.817-1.729c-.14-.96.114-2.005.69-2.834.563-.814%201.353-1.336%202.237-1.475.199-.033.57-.028.776.01.226.04.367.028.512-.041.179-.085.268-.19.374-.431.093-.215.165-.333.36-.576.234-.29.46-.489.822-.729.413-.27.884-.467%201.352-.561.17-.035.25-.04.569-.04.319%200%20.398.005.569.04a4.07%204.07%200%200%201%201.914.997c.117.109.398.457.488.602.034.057.095.177.132.267.105.241.195.346.374.43.14.068.286.082.503.045.343-.058.607-.053.943.016%201.144.23%202.14%201.173%202.581%202.437.385%201.108.276%202.267-.296%203.153-.097.15-.193.27-.333.419-.301.322-.301.722-.001%201.053.493.539.801%201.866.708%203.036-.062.772-.26%201.463-.533%201.854a2.096%202.096%200%200%201-.224.258.916.916%200%200%200-.194.25c-.054.109-.057.128-.057.293v.178l.148.29c.248.476.38.823.498%201.295.253%201.008.231%202.01-.059%202.581a.845.845%200%200%200-.044.098c0%20.006.329.009.732.009h.73l.02-.074.036-.134c.019-.076.057-.3.088-.516.029-.217.029-1.016%200-1.258-.11-.875-.295-1.57-.597-2.226-.032-.074-.053-.138-.046-.141.008-.005.057-.074.108-.152.376-.569.607-1.284.724-2.228.031-.26.031-1.378%200-1.628-.083-.645-.182-1.082-.348-1.525a6.083%206.083%200%200%200-.329-.7l-.038-.064.131-.194c.402-.604.636-1.262.727-2.04a6.625%206.625%200%200%200-.024-1.358%205.512%205.512%200%200%200-.939-2.339%205.325%205.325%200%200%200-.95-1.02%208.097%208.097%200%200%201-.186-.152.692.692%200%200%201%20.023-.208c.208-1.087.201-2.443-.017-3.503-.19-.924-.535-1.658-.98-2.082-.354-.338-.716-.482-1.15-.455-.996.059-1.8%201.205-2.116%203.01a6.805%206.805%200%200%200-.097.726c0%20.036-.007.066-.015.066a.96.96%200%200%201-.149-.078A4.857%204.857%200%200%200%2012%203.03c-.832%200-1.687.243-2.456.698a.958.958%200%200%201-.148.078c-.008%200-.015-.03-.015-.066a6.71%206.71%200%200%200-.097-.725C8.997%201.392%208.337.319%207.46.048a2.096%202.096%200%200%200-.585-.041Zm.293%201.402c.248.197.523.759.682%201.388.03.113.06.244.069.292.007.047.026.152.041.233.067.365.098.76.102%201.24l.002.475-.12.175-.118.178h-.278c-.324%200-.646.041-.954.124l-.238.06c-.033.007-.038-.003-.057-.144a8.438%208.438%200%200%201%20.016-2.323c.124-.788.413-1.501.696-1.711.067-.05.079-.049.157.013zm9.825-.012c.17.126.358.46.498.888.28.854.36%202.028.212%203.145-.019.14-.024.151-.057.144l-.238-.06a3.693%203.693%200%200%200-.954-.124h-.278l-.119-.178-.119-.175.002-.474c.004-.669.066-1.19.214-1.772.157-.623.434-1.185.68-1.382.078-.062.09-.063.159-.012z%22/%3E%3C/svg%3E';
+/**
+ * The Xpod shield (`ui/src/assets/xpod-shield.svg`), inlined like the provider
+ * marks: from a coding client's point of view Xpod is just another provider.
+ */
+export const XPOD_AVATAR = 'data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZpZXdCb3g9IjAgMCA2NCA2NCIgZmlsbD0ibm9uZSI+CiAgPHBhdGgKICAgIGQ9Ik0zMiA3IDUxIDE2LjV2MTMuOGMwIDEyLjQtNy40IDIxLjItMTkgMjcuNy0xMS42LTYuNS0xOS0xNS4zLTE5LTI3LjdWMTYuNUwzMiA3WiIKICAgIHN0cm9rZT0iIzhBNzJCRSIKICAgIHN0cm9rZS13aWR0aD0iNSIKICAgIHN0cm9rZS1saW5lY2FwPSJyb3VuZCIKICAgIHN0cm9rZS1saW5lam9pbj0icm91bmQiCiAgLz4KPC9zdmc+Cg==';
 const providerAvatars = {
     openai: openaiAvatar,
     anthropic: anthropicAvatar,

package/node_modules/@undefineds.co/ai-connections/dist/service-access.js

@@ -1,3 +1,4 @@
+import { AI_CONNECTIONS_PROVIDER_DOCUMENT_IDS } from './provider-catalog.js';
 export const AI_CONNECTIONS_APPLET_ID = 'co.undefineds.ai-connections';
 const KNOWN_RESOURCE_PATHS = {
     providerCredentials: 'settings/credentials.ttl',
@@ -5,33 +6,7 @@ const KNOWN_RESOURCE_PATHS = {
     gatewayAccessKeys: '.data/ai/gateway/access-keys.ttl',
     quotaSnapshots: '.data/ai/gateway/quota.ttl',
 };
-const PROVIDER_DOCUMENT_IDS = [
-    'openai',
-    'openai-official-subscription',
-    'openai-api-platform',
-    'anthropic',
-    'anthropic-official-subscription',
-    'anthropic-api-platform',
-    'kimi',
-    'kimi-subscription-key',
-    'kimi-api-platform',
-    'bailian',
-    'bailian-pay-as-you-go',
-    'bailian-token-plan',
-    'bailian-token-plan-team',
-    'bailian-coding-plan',
-    'deepseek',
-    'deepseek-api-platform',
-    'zhipu',
-    'zhipu-api-platform',
-    'zhipu-coding-plan',
-    'ollama',
-    'ollama-local',
-    'custom',
-    'custom-openai-compatible',
-    'custom-anthropic-compatible',
-];
-const PROVIDER_DOCUMENT_ID_SET = new Set(PROVIDER_DOCUMENT_IDS);
+const PROVIDER_DOCUMENT_ID_SET = new Set(AI_CONNECTIONS_PROVIDER_DOCUMENT_IDS);
 export function parseAiConnectionsServiceAccess(value, currentPodUrl) {
     if (!isRecord(value))
         throw new Error('invalid_descriptor');

package/node_modules/@undefineds.co/ai-connections/package.json

@@ -37,6 +37,7 @@
     "test": "vitest run --config ../../vitest.packages.config.mts"
   },
   "dependencies": {
+    "@undefineds.co/models": "0.2.59",
     "lucide-react": "^0.525.0"
   },
   "peerDependencies": {

package/node_modules/@undefineds.co/extension-sdk/dist/manifest.d.ts

@@ -1,4 +1,4 @@
-export declare const HOST_CAPABILITY_NAMES: readonly ["navigation.openExternal", "aiClientConfiguration"];
+export declare const HOST_CAPABILITY_NAMES: readonly ["navigation.openExternal", "aiClientConfiguration", "solidNotifications", "podCollections"];
 export type HostCapabilityName = (typeof HOST_CAPABILITY_NAMES)[number];
 export type AppletLayoutKind = 'single-pane' | 'two-pane';
 export interface AppletCommandDeclaration {

package/node_modules/@undefineds.co/extension-sdk/dist/manifest.js

@@ -1,6 +1,8 @@
 export const HOST_CAPABILITY_NAMES = [
     'navigation.openExternal',
     'aiClientConfiguration',
+    'solidNotifications',
+    'podCollections',
 ];
 export function deriveAppletRouteId(manifest) {
     const segments = new URL(manifest.appId).pathname.split('/').filter(Boolean);