@undefineds.co/xpod 0.4.11 → 0.4.12

package/node_modules/@undefineds.co/ai-connections/dist/controller.js

@@ -1,18 +1,37 @@
 import { useSyncExternalStore } from 'react';
 import { AI_CONNECTIONS_PROVIDERS, AiConnectionsRequestError, createAiConnectionsClient, normalizeAiConnectionsThrownError, } from './ai-connections-client.js';
+import { credentialCollectionRuntime, } from './collections.js';
+/**
+ * Provider pages explain themselves through the header's ⓘ tooltip, so each
+ * description is one line of the same shape — where the models come from and how
+ * this deployment can be authorized — instead of a restatement of the name.
+ *
+ * Connect actions are deliberately absent here: which ways in exist is offering
+ * data (`authorizationMethods`), derived by the server per offering, and a
+ * provider-level label is exactly how a page could offer a 「登录」 no offering
+ * declares.
+ */
 export const PROVIDERS = [
-    { id: 'openai', name: 'OpenAI', browserMode: 'browserAssistedApiKey', browserLabel: '登录', description: 'OpenAI 模型与编码能力', homeUrl: 'https://openai.com', apiKeyUrl: 'https://platform.openai.com/api-keys', apiKeyPlaceholder: 'sk-...', defaultBaseUrl: 'https://api.openai.com/v1' },
-    { id: 'anthropic', name: 'Anthropic', browserMode: 'browserAssistedApiKey', browserLabel: '登录', description: 'Claude 模型与编码能力', homeUrl: 'https://www.anthropic.com', apiKeyUrl: 'https://console.anthropic.com/settings/keys', apiKeyPlaceholder: 'sk-ant-...', defaultBaseUrl: 'https://api.anthropic.com' },
-    { id: 'kimi', name: 'Kimi', browserMode: 'browserAssistedApiKey', browserLabel: '登录', description: 'Moonshot AI 模型服务', homeUrl: 'https://www.moonshot.cn', apiKeyUrl: 'https://platform.moonshot.cn/console/api-keys', apiKeyPlaceholder: 'sk-...', defaultBaseUrl: 'https://api.moonshot.cn/v1' },
-    { id: 'bailian', name: '百炼', browserMode: 'browserAssistedApiKey', browserLabel: '登录', description: '阿里云百炼模型服务', homeUrl: 'https://www.aliyun.com/product/bailian', apiKeyUrl: 'https://bailian.console.aliyun.com/#/api-key', apiKeyPlaceholder: 'sk-...', defaultBaseUrl: 'https://dashscope.aliyuncs.com/compatible-mode/v1' },
-    { id: 'deepseek', name: 'DeepSeek', browserMode: 'connectUnsupported', browserLabel: '不支持登录', description: 'DeepSeek 模型服务', homeUrl: 'https://www.deepseek.com', apiKeyUrl: 'https://platform.deepseek.com/api_keys', apiKeyPlaceholder: 'sk-...', defaultBaseUrl: 'https://api.deepseek.com/v1' },
-    { id: 'zhipu', name: '智谱 AI', browserMode: 'browserAssistedApiKey', browserLabel: '登录', description: '智谱 AI / GLM 模型服务', homeUrl: 'https://open.bigmodel.cn', apiKeyUrl: 'https://open.bigmodel.cn/usercenter/apikeys', apiKeyPlaceholder: 'id.secret-...', defaultBaseUrl: 'https://open.bigmodel.cn/api/paas/v4' },
-    { id: 'ollama', name: 'Ollama', browserMode: 'connectUnsupported', browserLabel: '本地服务', description: '本地 Ollama 模型服务', homeUrl: 'https://ollama.com', defaultBaseUrl: 'http://localhost:11434/v1' },
-    { id: 'custom', name: 'Custom', browserMode: 'browserAssistedApiKey', browserLabel: '配置', description: 'OpenAI / Anthropic 兼容的自定义模型服务', homeUrl: 'https://undefineds.co', apiKeyPlaceholder: 'sk-...', defaultBaseUrl: 'https://example.com/v1' },
+    { id: 'openai', name: 'OpenAI', description: 'OpenAI 官方 GPT 与推理模型，支持 API Key 与订阅导入。', homeUrl: 'https://openai.com', apiKeyUrl: 'https://platform.openai.com/api-keys', apiKeyPlaceholder: 'sk-...', defaultBaseUrl: 'https://api.openai.com/v1' },
+    { id: 'anthropic', name: 'Anthropic', description: 'Anthropic 官方 Claude 模型，支持 API Key 与订阅导入。', homeUrl: 'https://www.anthropic.com', apiKeyUrl: 'https://console.anthropic.com/settings/keys', apiKeyPlaceholder: 'sk-ant-...', defaultBaseUrl: 'https://api.anthropic.com' },
+    { id: 'kimi', name: 'Kimi', description: '月之暗面 Kimi 模型，支持账号订阅、编码套餐与开放平台。', homeUrl: 'https://www.moonshot.cn', apiKeyUrl: 'https://platform.moonshot.cn/console/api-keys', apiKeyPlaceholder: 'sk-...', defaultBaseUrl: 'https://api.moonshot.cn/v1' },
+    { id: 'bailian', name: '百炼', description: '阿里云百炼的通义千问等模型，提供按量与多种套餐。', homeUrl: 'https://www.aliyun.com/product/bailian', apiKeyUrl: 'https://bailian.console.aliyun.com/#/api-key', apiKeyPlaceholder: 'sk-...', defaultBaseUrl: 'https://dashscope.aliyuncs.com/compatible-mode/v1' },
+    { id: 'deepseek', name: 'DeepSeek', description: 'DeepSeek 官方模型，API Key 接入，接口兼容 OpenAI。', homeUrl: 'https://www.deepseek.com', apiKeyUrl: 'https://platform.deepseek.com/api_keys', apiKeyPlaceholder: 'sk-...', defaultBaseUrl: 'https://api.deepseek.com/v1' },
+    { id: 'zhipu', name: '智谱 AI', description: '智谱 GLM 系列模型，支持 API Key 与 GLM 编码套餐。', homeUrl: 'https://open.bigmodel.cn', apiKeyUrl: 'https://open.bigmodel.cn/usercenter/apikeys', apiKeyPlaceholder: 'id.secret-...', defaultBaseUrl: 'https://open.bigmodel.cn/api/paas/v4' },
+    { id: 'ollama', name: 'Ollama', description: '运行在本机的 Ollama 模型，无需 API Key，仅本机可达。', homeUrl: 'https://ollama.com', defaultBaseUrl: 'http://localhost:11434/v1' },
+    { id: 'custom', name: 'Custom', description: '任意 OpenAI 或 Anthropic 兼容服务，自填地址与 API Key。', homeUrl: 'https://undefineds.co', apiKeyPlaceholder: 'sk-...', defaultBaseUrl: 'https://example.com/v1' },
 ];
 export const AI_CONNECTIONS_PINNED_SECTIONS = [
-    { id: 'keys', label: 'API Keys', title: 'API KEYS' },
+    { id: 'keys', label: 'Xpod', title: 'API KEYS' },
 ];
+/**
+ * Coalescing window for Pod change signals.
+ *
+ * A notification only says "this document changed", so a burst of writes must
+ * cost one re-read, not one per write; the first signal arms a fixed window and
+ * everything arriving inside it is absorbed.
+ */
+export const TABLE_CHANGE_COALESCE_MS = 75;
 if (PROVIDERS.map((provider) => provider.id).join(',') !== AI_CONNECTIONS_PROVIDERS.join(',')) {
     throw new Error('AI Connection provider UI is out of sync with the client catalog');
 }
@@ -24,6 +43,28 @@ export function createAiConnectionsController(host) {
     const readyPod = pod?.status === 'ready' ? pod : undefined;
     const authenticated = sessionSnapshot.status === 'authenticated'
         && readyPod !== undefined;
+    /**
+     * The live credentials table, when the host offers one.
+     *
+     * Declaring it here (and not in a page) is what keeps one table to one
+     * collection: the page reads the same instance the client writes through.
+     *
+     * It is declared *asynchronously* and lands in `credentials` (+ `credentialRows`
+     * and `credentialMutations`): the collection layer is loaded on demand through
+     * `collections.credentialCollectionRuntime()` - the table declaration, the row
+     * read and the credential writes all live in that chunk - so the applet renders
+     * from the store first and upgrades to live rows when the collection's first
+     * read is back. When the host offers no `podCollections` capability at all the
+     * collection never lands and the controller behaves exactly as before
+     * (`docs/pod-collections.md` §8.9).
+     */
+    let credentials;
+    let credentialRows;
+    let credentialMutations;
+    const liveCredentials = {
+        collection: () => credentials,
+        mutations: () => credentialMutations,
+    };
     let providerLoadGeneration = 0;
     let providerLoadPromise;
     let providerLoadOperation;
@@ -81,7 +122,7 @@ export function createAiConnectionsController(host) {
             webId: sessionSnapshot.webId,
             podBaseUrl: readyPod.current.podUrl,
             authenticatedFetch: host.solid.session.fetch,
-        }), host.capabilities.aiClientCredentials), host.capabilities.aiConnectionsPodStore, beginProviderLoad)
+        }), host.capabilities.aiClientCredentials), host.capabilities.aiConnectionsPodStore, liveCredentials, beginProviderLoad)
         : null;
     let selectedSection = 'keys';
     let selectedProvider = 'openai';
@@ -92,10 +133,164 @@ export function createAiConnectionsController(host) {
     let providerLoadError;
     const listeners = new Set();
     const notify = () => listeners.forEach((listener) => listener());
+    const notifications = host.capabilities.solidNotifications;
+    const podStore = host.capabilities.aiConnectionsPodStore;
+    /** Release function per watched topic document; one entry per document. */
+    const tableSubscriptions = new Map();
+    let pageTableHolds = 0;
+    let liveUpdates = currentLiveUpdates();
+    let liveRevision = 0;
+    let coalesceTimer;
+    function scheduleLiveRefresh() {
+        if (coalesceTimer !== undefined)
+            return;
+        coalesceTimer = setTimeout(() => {
+            coalesceTimer = undefined;
+            liveRevision += 1;
+            notify();
+        }, TABLE_CHANGE_COALESCE_MS);
+    }
+    /**
+     * The documents the open page renders *and* this controller refreshes; a table
+     * is one document, never a row.
+     *
+     * One table has exactly one refresh path. The credentials table is owned by
+     * the collection when the host exposes one - the collection subscribes to the
+     * same notification primitive with the same document - so it is left out here;
+     * without a collection it stays on this path, exactly as before. The open
+     * provider's document is always this path's (P4 moves it).
+     */
+    function pageTableDocuments() {
+        if (!podStore)
+            return [];
+        const documents = new Set();
+        const credentialsDocument = credentials ? undefined : podStore.credentialsTableDocument?.();
+        if (credentialsDocument)
+            documents.add(credentialsDocument);
+        if (selectedSection === 'provider') {
+            const provider = podStore.providerTableDocument?.(selectedProvider, selectedCredentialId);
+            if (provider)
+                documents.add(provider);
+        }
+        return [...documents];
+    }
+    function releaseTableSubscriptions() {
+        for (const [document, release] of tableSubscriptions) {
+            tableSubscriptions.delete(document);
+            release();
+        }
+    }
+    function syncTableSubscriptions() {
+        if (!notifications || pageTableHolds === 0)
+            return;
+        const wanted = new Set(pageTableDocuments());
+        for (const [document, release] of tableSubscriptions) {
+            if (wanted.has(document))
+                continue;
+            tableSubscriptions.delete(document);
+            release();
+        }
+        for (const document of wanted) {
+            if (tableSubscriptions.has(document))
+                continue;
+            tableSubscriptions.set(document, notifications.watch(document, scheduleLiveRefresh));
+        }
+    }
+    /**
+     * The availability signal the page shows.
+     *
+     * With a live collection the page's truth is the *collection's* sync state,
+     * not the transport's global state: `live` only when the table's own feed is
+     * established and the transport is actually pushing. Without one, this is the
+     * transport's state, exactly as before.
+     */
+    function currentLiveUpdates() {
+        const transport = notifications ? notifications.getState() : 'unavailable';
+        if (!credentials || !host.capabilities.podCollections)
+            return transport;
+        const sync = host.capabilities.podCollections.syncState(credentials.collection);
+        if (sync === 'unavailable' || sync === 'degraded' || transport === 'unavailable') {
+            return 'unavailable';
+        }
+        return sync === 'live' && transport === 'live' ? 'live' : 'idle';
+    }
+    notifications?.subscribeState(() => {
+        const next = currentLiveUpdates();
+        if (next === liveUpdates)
+            return;
+        liveUpdates = next;
+        notify();
+    });
+    host.capabilities.podCollections?.subscribeSyncState(() => {
+        const next = currentLiveUpdates();
+        if (next === liveUpdates)
+            return;
+        liveUpdates = next;
+        notify();
+    });
+    /**
+     * The page's live rows: re-read from the collection when it changes, and
+     * `undefined` until its first read lands (or forever, when there is no
+     * collection). One snapshot object per change keeps `useSyncExternalStore`
+     * stable between reads.
+     */
+    function publishCredentialRows() {
+        const collection = credentials?.collection;
+        const next = collection?.isReady()
+            ? collection.toArray
+            : undefined;
+        if (next === credentialRows)
+            return;
+        credentialRows = next;
+        notify();
+    }
+    /**
+     * Adopt the host's credentials collection once the lazy layer has it.
+     *
+     * Three things change at once, and they have to change together: the rows the
+     * page renders (from the collection's own change feed and status), the
+     * credential mutations (the client dispatches to them from now on), and the
+     * fallback table watch - the credentials document leaves the controller's
+     * `liveRevision` path because the collection now owns that table, which has to
+     * happen by releasing the subscription the controller opened before the
+     * collection arrived.
+     */
+    function adoptCredentials(loaded, mutations) {
+        credentials = loaded;
+        credentialMutations = mutations;
+        const collection = loaded.collection;
+        // The collection is owned by the host capability and lives as long as the
+        // session; these two subscriptions live with it rather than with the page.
+        collection.subscribeChanges(() => publishCredentialRows());
+        collection.on('status:change', () => publishCredentialRows());
+        publishCredentialRows();
+        syncTableSubscriptions();
+        notify();
+    }
+    // A host that offers no collection never fetches the layer: the capability is
+    // checked before the dynamic import, not inside it.
+    if (authenticated && sessionSnapshot.webId && host.capabilities.podCollections) {
+        void credentialCollectionRuntime()
+            .then(async (runtime) => {
+            const loaded = await runtime.openCredentialCollection(host);
+            if (!loaded || !podStore)
+                return;
+            adoptCredentials(loaded, runtime.collectionCredentialMutations(loaded, podStore));
+        })
+            // No collection layer (chunk unavailable, layout underivable, table
+            // undefined): the page keeps the store's own reads, as before.
+            .catch(() => undefined);
+    }
     const controller = {
         client,
         openExternal: host.navigation.openExternal,
         clientConfigurationBridge: host.capabilities.aiClientConfiguration,
+        get credentialsCollection() {
+            return credentials?.collection;
+        },
+        get credentialRows() {
+            return credentialRows;
+        },
         get selectedSection() {
             return selectedSection;
         },
@@ -117,10 +312,32 @@ export function createAiConnectionsController(host) {
         get providerLoadError() {
             return providerLoadError;
         },
+        get liveUpdates() {
+            return liveUpdates;
+        },
+        get liveRevision() {
+            return liveRevision;
+        },
+        watchPageTables() {
+            pageTableHolds += 1;
+            syncTableSubscriptions();
+            let released = false;
+            return () => {
+                if (released)
+                    return;
+                released = true;
+                pageTableHolds -= 1;
+                if (pageTableHolds > 0)
+                    return;
+                pageTableHolds = 0;
+                releaseTableSubscriptions();
+            };
+        },
         selectSection(section) {
             if (selectedSection === section)
                 return;
             selectedSection = section;
+            syncTableSubscriptions();
             notify();
         },
         selectProvider(provider, credentialId) {
@@ -132,6 +349,7 @@ export function createAiConnectionsController(host) {
             selectedSection = 'provider';
             selectedProvider = provider;
             selectedCredentialId = nextCredentialId;
+            syncTableSubscriptions();
             notify();
         },
         selectFirstUnconfiguredProvider() {
@@ -255,7 +473,7 @@ function withAccountClientCredentials(client, credentials) {
         },
     };
 }
-function createInteractiveAiConnectionsClient(operationsClient, podStore, beginProviderLoad) {
+function createInteractiveAiConnectionsClient(operationsClient, podStore, live, beginProviderLoad) {
     const listProviders = async () => {
         const guard = beginProviderLoad();
         try {
@@ -327,7 +545,7 @@ function createInteractiveAiConnectionsClient(operationsClient, podStore, beginP
         }
         return { credential, secret, didRefresh };
     };
-    return {
+    const storeClient = {
         ...operationsClient,
         listProviders,
         listModels: podStore.listModels
@@ -556,6 +774,35 @@ function createInteractiveAiConnectionsClient(operationsClient, podStore, beginP
             ? async (provider, modelIds, credentialId) => podStore.saveModelSelection(provider, modelIds, credentialId)
             : operationsClient.saveModelSelection,
     };
+    /**
+     * With a live credentials collection, credential writes go through it: the
+     * page sees them immediately, they roll back on rejection, and the document's
+     * own echo reconciles instead of overwriting.
+     *
+     * The collection may not be there yet (the layer loads lazily) and may never
+     * be (a host without the capability), so this dispatches per call: until the
+     * table lands, every write is the store's own, exactly as before.
+     *
+     * Reads of credentials stay in `listProviders` for now (it also carries
+     * providers and models); the page renders the credential lists from the
+     * collection's rows, and the store's summary of the same row is only the
+     * enrichment for attributes the descriptor cannot project.
+     */
+    const credentialStore = {
+        createApiKeyCredential: (provider, input) => live.mutations()?.createApiKeyCredential(provider, input)
+            ?? storeClient.createApiKeyCredential(provider, input),
+        // Two local-connection flows are account/Gateway operations, not Pod rows.
+        createLocalCredential: (provider, input) => (input.authorizationMethodId === 'local-session-import'
+            || (!input.authorizationMethodId && input.offeringId === 'official-subscription')
+            ? storeClient.createLocalCredential(provider, input)
+            : live.mutations()?.createLocalCredential(provider, input)
+                ?? storeClient.createLocalCredential(provider, input)),
+        updateProviderCredential: (provider, credentialId, input) => live.mutations()?.updateProviderCredential(provider, credentialId, input)
+            ?? storeClient.updateProviderCredential(provider, credentialId, input),
+        deleteProviderCredential: (provider, credentialId) => live.mutations()?.deleteProviderCredential(provider, credentialId)
+            ?? storeClient.deleteProviderCredential(provider, credentialId),
+    };
+    return { ...storeClient, ...credentialStore };
 }
 export function useSelectedSection(controller) {
     return useSyncExternalStore(controller.subscribe, () => controller.selectedSection ?? 'provider', () => controller.selectedSection ?? 'provider');
@@ -575,12 +822,33 @@ export function useProviderStates(controller) {
 export function useProviderSummaries(controller) {
     return useSyncExternalStore(controller.subscribe, () => legacySummariesFor(controller.providerSummaries), () => legacySummariesFor(controller.providerSummaries));
 }
+/**
+ * Providers this deployment offers, as reported by the server.
+ *
+ * Cloud answers with the operator-designated providers only (no self-hosted
+ * `custom`, no local daemon), so the settings surface cannot offer a provider the
+ * deployment does not provide. Before the first successful load this is
+ * `undefined`, which keeps every provider visible (Local behavior).
+ */
+export function useAvailableProviders(controller) {
+    const summaries = useProviderSummaries(controller);
+    const ids = Object.keys(summaries);
+    return ids.length > 0 ? ids : undefined;
+}
 export function useProviderProducts(controller) {
     return useSyncExternalStore(controller.subscribe, () => controller.providerSummaries, () => controller.providerSummaries);
 }
 export function useProviderLoadError(controller) {
     return useSyncExternalStore(controller.subscribe, () => controller.providerLoadError, () => controller.providerLoadError);
 }
+/** Whether live Pod updates are on, for a status affordance that stays small. */
+export function useLiveUpdates(controller) {
+    return useSyncExternalStore(controller.subscribe, () => controller.liveUpdates, () => controller.liveUpdates);
+}
+/** Advances once per coalesced burst of Pod changes; drives page re-reads. */
+export function useLiveRevision(controller) {
+    return useSyncExternalStore(controller.subscribe, () => controller.liveRevision, () => controller.liveRevision);
+}
 function productStateFromProvider(product) {
     if (!product || product.status === 'unconfigured' || product.status === 'unavailable') {
         return 'unconfigured';
@@ -660,14 +928,15 @@ function mergeAuthorizationMethodsIntoProviders(providers, methods) {
             const capability = methodsByOffering.get(`${provider.id}:${offering.id}`);
             if (!capability)
                 return offering;
+            // The server's list is authoritative, an empty one included: it omits a
+            // connect entry this build has not implemented, and that omission has to
+            // survive the merge rather than fall back to deriving one from `authModes`.
             const authorizationMethods = capability.authorizationMethods;
             return {
                 ...offering,
                 ...(capability.endpoints ? { endpoints: capability.endpoints } : {}),
-                ...(authorizationMethods.length ? {
-                    authorizationMethods,
-                    authModes: mergeAuthModes(offering.authModes, authorizationMethods.map((method) => method.authMode)),
-                } : {}),
+                authorizationMethods,
+                authModes: mergeAuthModes(offering.authModes, authorizationMethods.map((method) => method.authMode)),
             };
         }),
     }));

package/node_modules/@undefineds.co/ai-connections/dist/credential-labels.d.ts

@@ -5,6 +5,11 @@ export declare function credentialDisplayLabel(credential: AiProviderCredentialS
 /** Account names are shown inside a pool; only the domain stays readable. */
 export declare function maskAccountLabel(value: string): string;
 export declare function healthLabel(health: AiProviderCredentialSummary['health']): string;
+/**
+ * Tone of one credential row: the tint the row carries and the colour of its
+ * health dot. The row's border and dividers belong to the list container now, so
+ * the tone is a background rather than a box.
+ */
 export declare function healthTone(health: AiProviderCredentialSummary['health']): {
     row: string;
     dot: string;

package/node_modules/@undefineds.co/ai-connections/dist/credential-labels.js

@@ -36,12 +36,17 @@ export function healthLabel(health) {
         return '已过期';
     return '错误';
 }
+/**
+ * Tone of one credential row: the tint the row carries and the colour of its
+ * health dot. The row's border and dividers belong to the list container now, so
+ * the tone is a background rather than a box.
+ */
 export function healthTone(health) {
     if (health === 'healthy') {
-        return { row: 'border-emerald-500/40 bg-emerald-500/5', dot: 'bg-emerald-500' };
+        return { row: 'bg-emerald-500/5', dot: 'bg-emerald-500' };
     }
     if (health === 'unknown') {
-        return { row: 'border-border/50 bg-background', dot: 'bg-muted-foreground/50' };
+        return { row: 'bg-background', dot: 'bg-muted-foreground/50' };
     }
-    return { row: 'border-destructive/40 bg-destructive/5', dot: 'bg-destructive' };
+    return { row: 'bg-destructive/5', dot: 'bg-destructive' };
 }

package/node_modules/@undefineds.co/ai-connections/dist/credential-storage.d.ts

@@ -0,0 +1,59 @@
+export interface CredentialSecretEnvelopeInput {
+    webId: string;
+    provider: string;
+    /** The credential's resource IRI (`credentialResource.buildIri(podUrl, { id })`). */
+    credentialIri: string;
+    secret: Record<string, unknown>;
+}
+/**
+ * The `encryptedSecret` payload for a credential row.
+ *
+ * `PLAINTEXT` means "not encrypted at rest yet", not "no envelope": the read
+ * side verifies the envelope's owner (`webId`), provider and credential IRI
+ * before handing the secret to a provider request, so a row copied between
+ * credentials (or between accounts) never yields a usable secret.
+ */
+export declare function credentialSecretEnvelope(input: CredentialSecretEnvelopeInput): string;
+export interface CredentialSecretReadInput {
+    webId: string;
+    provider: string;
+    credentialIri: string;
+    envelope: unknown;
+}
+/** `undefined` unless the envelope belongs to this account, provider and credential. */
+export declare function decodeCredentialSecret(input: CredentialSecretReadInput): Record<string, unknown> | undefined;
+/**
+ * The provider relation a catalog credential declares (`provider`):
+ * `providers/openai.ttl` in resource terms, `openai.ttl` as the stored value.
+ *
+ * A custom instance owns its own provider document, so there the relation is
+ * derived from the credential's own id.
+ */
+export declare function credentialProviderRelation(provider: string): string;
+export declare function customCredentialProviderRelation(credentialId: string): string;
+/**
+ * The row key of a new credential: the `{id}` slot of the descriptor's
+ * `resourceIdPattern`, which is the credential's identity (never a display
+ * name).
+ *
+ * Two writers create credential rows - `XpodAiConnectionsPodStore` for a plain
+ * page, and the collection layer when a live collection creates the row
+ * optimistically - and a row key that differed between them would produce two
+ * credentials where the user asked for one, so the shape is declared once here.
+ */
+export declare function credentialRowKeyFor(provider: string, authMode: 'apiKey' | 'local'): string;
+/**
+ * The provider a credential row key declares, for rows whose `provider` relation
+ * is missing: a credential is keyed `<provider>-<uuid>` (see
+ * {@link credentialRowKeyFor}), and a custom instance is keyed `custom-…`.
+ *
+ * A key reaches us in either of two shapes - the bare `resourceIdPattern` slot
+ * (`openai-<uuid>`) or a full resource id (`custom-instance-abc.ttl#this`). The
+ * provider lives in the document segment in both, never in the fragment, so the
+ * fragment must not be the part that gets inspected.
+ */
+export declare function providerOfCredentialKey(key: string): string | undefined;
+/** `providers/openai.ttl#this` → `openai.ttl#this` (document-relative reference). */
+export declare function providerResourceReference(value: string | undefined): string | undefined;
+/** `providers/openai.ttl#this` → `openai` (the document name minus `.ttl`). */
+export declare function providerResourceKey(value: string | undefined): string | undefined;

package/node_modules/@undefineds.co/ai-connections/dist/credential-storage.js

@@ -0,0 +1,131 @@
+import { aiProviderResource } from '@undefineds.co/models';
+import { AI_CONNECTIONS_PROVIDERS } from './client/types.js';
+/**
+ * Storage-shape rules for AI credential rows: the secret envelope, the provider
+ * relation a credential declares, and the provider resource key.
+ *
+ * They live in the capability package, not in the Pod adapter that happens to
+ * use them: `@undefineds.co/ai-connections` owns what a credential row looks
+ * like, and `ui/src/extensions/XpodAiConnectionsPodStore.ts` is one adapter over
+ * it. Keeping one copy is what lets the collection layer write the same rows the
+ * adapter reads - a second copy would drift on the first format change.
+ */
+/** Base64 of the UTF-8 JSON, so the envelope stays a single string literal. */
+function encodeBase64Json(value) {
+    const bytes = new TextEncoder().encode(JSON.stringify(value));
+    let binary = '';
+    for (const byte of bytes)
+        binary += String.fromCharCode(byte);
+    return btoa(binary);
+}
+function decodeBase64Json(value) {
+    const binary = atob(value);
+    const bytes = Uint8Array.from(binary, (character) => character.charCodeAt(0));
+    return JSON.parse(new TextDecoder().decode(bytes));
+}
+/**
+ * The `encryptedSecret` payload for a credential row.
+ *
+ * `PLAINTEXT` means "not encrypted at rest yet", not "no envelope": the read
+ * side verifies the envelope's owner (`webId`), provider and credential IRI
+ * before handing the secret to a provider request, so a row copied between
+ * credentials (or between accounts) never yields a usable secret.
+ */
+export function credentialSecretEnvelope(input) {
+    return JSON.stringify({
+        algorithm: 'PLAINTEXT',
+        encoding: 'base64',
+        ciphertext: encodeBase64Json(input.secret),
+        webId: input.webId,
+        credentialIri: input.credentialIri,
+        provider: input.provider,
+    });
+}
+/** `undefined` unless the envelope belongs to this account, provider and credential. */
+export function decodeCredentialSecret(input) {
+    if (typeof input.envelope !== 'string' || !input.envelope.trim())
+        return undefined;
+    try {
+        const envelope = JSON.parse(input.envelope);
+        if (envelope.algorithm !== 'PLAINTEXT'
+            || envelope.webId !== input.webId
+            || envelope.provider !== input.provider
+            || envelope.credentialIri !== input.credentialIri) {
+            return undefined;
+        }
+        const secret = envelope.encoding === 'base64'
+            ? decodeBase64Json(String(envelope.ciphertext))
+            : JSON.parse(String(envelope.ciphertext));
+        return typeof secret === 'object' && secret !== null && !Array.isArray(secret)
+            ? secret
+            : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * The provider relation a catalog credential declares (`provider`):
+ * `providers/openai.ttl` in resource terms, `openai.ttl` as the stored value.
+ *
+ * A custom instance owns its own provider document, so there the relation is
+ * derived from the credential's own id.
+ */
+export function credentialProviderRelation(provider) {
+    return aiProviderResource.buildId({ id: provider });
+}
+export function customCredentialProviderRelation(credentialId) {
+    return aiProviderResource.buildId({ id: `custom-instance-${encodeURIComponent(credentialId)}.ttl#this` });
+}
+/**
+ * The row key of a new credential: the `{id}` slot of the descriptor's
+ * `resourceIdPattern`, which is the credential's identity (never a display
+ * name).
+ *
+ * Two writers create credential rows - `XpodAiConnectionsPodStore` for a plain
+ * page, and the collection layer when a live collection creates the row
+ * optimistically - and a row key that differed between them would produce two
+ * credentials where the user asked for one, so the shape is declared once here.
+ */
+export function credentialRowKeyFor(provider, authMode) {
+    const suffix = crypto.randomUUID();
+    return authMode === 'local' ? `${provider}-local-${suffix}` : `${provider}-${suffix}`;
+}
+/**
+ * The provider a credential row key declares, for rows whose `provider` relation
+ * is missing: a credential is keyed `<provider>-<uuid>` (see
+ * {@link credentialRowKeyFor}), and a custom instance is keyed `custom-…`.
+ *
+ * A key reaches us in either of two shapes - the bare `resourceIdPattern` slot
+ * (`openai-<uuid>`) or a full resource id (`custom-instance-abc.ttl#this`). The
+ * provider lives in the document segment in both, never in the fragment, so the
+ * fragment must not be the part that gets inspected.
+ */
+export function providerOfCredentialKey(key) {
+    const document = (key.split('#', 1)[0] ?? key).split('/').filter(Boolean).at(-1) ?? '';
+    const name = document.endsWith('.ttl') ? document.slice(0, -'.ttl'.length) : document;
+    if (!name)
+        return undefined;
+    if (name.startsWith('custom-') || name === 'custom')
+        return 'custom';
+    return AI_CONNECTIONS_PROVIDERS.find((provider) => name === provider || name.startsWith(`${provider}-`));
+}
+/** `providers/openai.ttl#this` → `openai.ttl#this` (document-relative reference). */
+export function providerResourceReference(value) {
+    if (!value)
+        return undefined;
+    const withoutFragment = value.split('#', 1)[0] ?? value;
+    const fileName = withoutFragment.split('/').filter(Boolean).at(-1) ?? withoutFragment;
+    if (!fileName)
+        return undefined;
+    const document = fileName.endsWith('.ttl') ? fileName : `${fileName}.ttl`;
+    const fragmentIndex = value.indexOf('#');
+    return fragmentIndex < 0 ? document : `${document}${value.slice(fragmentIndex)}`;
+}
+/** `providers/openai.ttl#this` → `openai` (the document name minus `.ttl`). */
+export function providerResourceKey(value) {
+    const reference = providerResourceReference(value);
+    if (!reference)
+        return undefined;
+    return (reference.split('#', 1)[0] ?? reference).replace(/\.ttl$/u, '');
+}

package/node_modules/@undefineds.co/ai-connections/dist/endpoint-urls.d.ts

@@ -0,0 +1,15 @@
+/**
+ * The endpoint shape rules every consumer shares: the coding-client adapters
+ * (`client-config/base-adapter.ts`) and the UI both point clients at the same
+ * Xpod base URL, so the `/v1` rule lives here once and nowhere else.
+ *
+ * This module must stay dependency-free: it is bundled into the Web applet and
+ * imported by the Node-side configuration service.
+ */
+/** OpenAI-compatible base: the client appends `/chat/completions` or `/responses` itself. */
+export declare function normalizeV1Endpoint(endpoint: string): string;
+/**
+ * Anthropic base: `ANTHROPIC_BASE_URL` is the host; the client appends
+ * `/v1/messages`, so a trailing `/v1` has to come off rather than stay on.
+ */
+export declare function normalizeMessagesEndpoint(endpoint: string): string;

package/node_modules/@undefineds.co/ai-connections/dist/endpoint-urls.js

@@ -0,0 +1,20 @@
+/**
+ * The endpoint shape rules every consumer shares: the coding-client adapters
+ * (`client-config/base-adapter.ts`) and the UI both point clients at the same
+ * Xpod base URL, so the `/v1` rule lives here once and nowhere else.
+ *
+ * This module must stay dependency-free: it is bundled into the Web applet and
+ * imported by the Node-side configuration service.
+ */
+/** OpenAI-compatible base: the client appends `/chat/completions` or `/responses` itself. */
+export function normalizeV1Endpoint(endpoint) {
+    const normalized = endpoint.trim().replace(/\/+$/, '');
+    return normalized.endsWith('/v1') ? normalized : `${normalized}/v1`;
+}
+/**
+ * Anthropic base: `ANTHROPIC_BASE_URL` is the host; the client appends
+ * `/v1/messages`, so a trailing `/v1` has to come off rather than stay on.
+ */
+export function normalizeMessagesEndpoint(endpoint) {
+    return endpoint.trim().replace(/\/+$/, '').replace(/\/v1$/, '');
+}