@undefineds.co/xpod 0.4.11 → 0.4.13

package/node_modules/@undefineds.co/{ai-connections → ai-connections-core}/dist/client/normalize.d.ts

@@ -8,7 +8,6 @@ import type { AiConnectAttempt, AiConnectionsCredential, AiConnectionsProvider,
  * within this module family. The published surface is the explicit list in
  * `ai-connections-client.ts`, not this file.
  */
-export declare const AI_CONNECTIONS_GENERIC_ERROR_MESSAGE = "AI Connection request failed. Please try again.";
 /**
  * Validate and normalize a user supplied upstream proxy URL. Proxy credentials
  * are intentionally rejected because proxy auth is not stored in the Pod
@@ -16,16 +15,27 @@ export declare const AI_CONNECTIONS_GENERIC_ERROR_MESSAGE = "AI Connection reque
  */
 export declare function normalizeProxyUrl(value: string | undefined | null): string | undefined;
 export declare function redactProxyUrl(value: string | undefined | null): string | undefined;
+/**
+ * A failed AI Connection request.
+ *
+ * It carries the facts a caller needs to decide what to say - the wire code, the
+ * upstream status, the payload itself - and a diagnostic message that names the
+ * code. The sentence a user reads is the applet's (`error-wording.ts`): a shared
+ * client must not pick the wording for whoever happens to render it.
+ */
 export declare class AiConnectionsRequestError extends Error {
     readonly code?: string;
+    readonly status: number;
     readonly providerStatus?: number;
-    constructor(message: string, payload: unknown);
+    readonly payload: unknown;
+    readonly provider?: string;
+    readonly authMode?: string;
+    constructor(payload: unknown, status: number, context?: {
+        provider?: string;
+        authMode?: string;
+    });
 }
-export declare function normalizeAiConnectionsThrownError(error: unknown): string;
-export declare function normalizeAiConnectionsErrorMessage(payload: unknown, status: number, context?: {
-    provider?: AiConnectionsProvider;
-    authMode?: 'apiKey' | 'deviceCodeOAuth' | 'local';
-}): string;
+export declare function aiConnectionsErrorCode(payload: unknown): string | undefined;
 export declare function readJson(response: Response): Promise<unknown>;
 export declare function assertProvider(provider: string): asserts provider is AiConnectionsProvider;
 export declare function parseGatewayKeyRecord(value: unknown): GatewayKeyRecord | undefined;

package/node_modules/@undefineds.co/{ai-connections → ai-connections-core}/dist/client/normalize.js

@@ -8,7 +8,6 @@ import { AI_CONNECTIONS_PROVIDERS } from './types.js';
  * within this module family. The published surface is the explicit list in
  * `ai-connections-client.ts`, not this file.
  */
-export const AI_CONNECTIONS_GENERIC_ERROR_MESSAGE = 'AI Connection request failed. Please try again.';
 /**
  * Validate and normalize a user supplied upstream proxy URL. Proxy credentials
  * are intentionally rejected because proxy auth is not stored in the Pod
@@ -49,109 +48,29 @@ export function redactProxyUrl(value) {
     parsed.hash = '';
     return parsed.href.replace(/\/$/u, '');
 }
+/**
+ * A failed AI Connection request.
+ *
+ * It carries the facts a caller needs to decide what to say - the wire code, the
+ * upstream status, the payload itself - and a diagnostic message that names the
+ * code. The sentence a user reads is the applet's (`error-wording.ts`): a shared
+ * client must not pick the wording for whoever happens to render it.
+ */
 export class AiConnectionsRequestError extends Error {
-    constructor(message, payload) {
-        super(message);
+    constructor(payload, status, context = {}) {
+        const code = aiConnectionsErrorCode(payload);
+        super(code ? `AI Connection request failed: ${code}` : `AI Connection request failed (HTTP ${status})`);
         this.name = 'AiConnectionsRequestError';
-        this.code = errorCodeFromPayload(payload);
+        this.code = code;
+        this.status = status;
         this.providerStatus = isRecord(payload) && typeof payload.providerStatus === 'number'
             ? payload.providerStatus : undefined;
+        this.payload = payload;
+        this.provider = context.provider;
+        this.authMode = context.authMode;
     }
 }
-export function normalizeAiConnectionsThrownError(error) {
-    if (error instanceof Error) {
-        return normalizeAiConnectionsErrorText(error.message);
-    }
-    return normalizeAiConnectionsErrorText(String(error));
-}
-export function normalizeAiConnectionsErrorMessage(payload, status, context = {}) {
-    const code = errorCodeFromPayload(payload);
-    if (code === 'provider_models_response_error') {
-        const message = isRecord(payload) && typeof payload.message === 'string'
-            ? sanitizeProviderResponseMessage(payload.message)
-            : undefined;
-        if (message)
-            return message;
-        return '模型列表获取失败。请检查密钥、服务地址或网络后重试。';
-    }
-    if (code === 'provider_models_fetch_failed') {
-        const providerStatus = isRecord(payload) && typeof payload.providerStatus === 'number'
-            ? payload.providerStatus
-            : undefined;
-        const providerMessage = isRecord(payload) && typeof payload.providerMessage === 'string'
-            ? payload.providerMessage.trim()
-            : undefined;
-        return withProviderMessage(modelDiscoveryErrorMessage(providerStatus, context.authMode), providerMessage);
-    }
-    const coded = code ? messageForSafeErrorCode(code, context.provider) : undefined;
-    if (coded)
-        return coded;
-    const text = isRecord(payload) && typeof payload.error === 'string'
-        ? payload.error
-        : undefined;
-    if (text) {
-        const exact = messageForSafeErrorCode(text, context.provider);
-        if (exact)
-            return exact;
-        if (text === 'AI Connection service identity is unavailable') {
-            return text;
-        }
-        if (text === 'Provider credential not found for current identity') {
-            return '当前身份没有可用的额度凭证。';
-        }
-        if (text === 'Provider quota adapter not found' || text === 'Provider quota lookup failed') {
-            return '该接入方式不支持查询官方额度。';
-        }
-    }
-    if (status === 401)
-        return 'Please sign in again to continue.';
-    if (status === 403)
-        return 'AI Connection permission was denied.';
-    if (status === 404 && context.provider) {
-        return `${providerLabel(context.provider)} connection is not configured.`;
-    }
-    if (status === 429)
-        return 'AI Connection is rate limited. Please try again later.';
-    if (status === 503)
-        return 'AI Connection service is unavailable.';
-    return AI_CONNECTIONS_GENERIC_ERROR_MESSAGE;
-}
-const LOCAL_SESSION_REFRESH_FAILED_MESSAGE = '订阅登录态自动刷新失败，请稍后重试。';
-const LOCAL_SESSION_REAUTH_REQUIRED_MESSAGE = '订阅登录态已失效，请在原客户端重新登录后重读，或使用设备码登录。';
-const OAUTH_MODEL_AUTH_FAILED_MESSAGE = '订阅登录态不可用，请重读登录态或重新登录后再同步模型。';
-const MODEL_DISCOVERY_SAFE_MESSAGES = new Set([
-    OAUTH_MODEL_AUTH_FAILED_MESSAGE,
-    LOCAL_SESSION_REFRESH_FAILED_MESSAGE,
-    LOCAL_SESSION_REAUTH_REQUIRED_MESSAGE,
-    '密钥不可用。请检查密钥是否填写正确，或换一个密钥后重试。',
-    '模型服务地址不正确。请检查服务地址后重试。',
-    '请求太频繁。请稍等一会儿再试。',
-    '模型服务暂时没有响应。请稍后重试。',
-    '模型列表获取失败。请检查密钥、服务地址或网络后重试。',
-]);
-function normalizeAiConnectionsErrorText(message) {
-    if (message.startsWith('provider_models_response_error:')) {
-        return sanitizeProviderResponseMessage(message.slice('provider_models_response_error:'.length))
-            ?? '模型列表获取失败。请检查密钥、服务地址或网络后重试。';
-    }
-    const exact = messageForSafeErrorCode(message);
-    if (exact)
-        return exact;
-    const prefix = message.split(':', 1)[0]?.trim();
-    const prefixed = prefix ? messageForSafeErrorCode(prefix) : undefined;
-    if (prefixed)
-        return prefixed;
-    if (message === 'AI Connection service identity is unavailable')
-        return message;
-    if (MODEL_DISCOVERY_SAFE_MESSAGES.has(message))
-        return message;
-    if (isModelDiscoveryMessageWithProviderDetail(message))
-        return message;
-    if (message.startsWith('invalid_'))
-        return 'AI Connection returned an invalid response.';
-    return AI_CONNECTIONS_GENERIC_ERROR_MESSAGE;
-}
-function errorCodeFromPayload(payload) {
+export function aiConnectionsErrorCode(payload) {
     if (!isRecord(payload))
         return undefined;
     if (typeof payload.code === 'string')
@@ -163,107 +82,6 @@ function errorCodeFromPayload(payload) {
     }
     return undefined;
 }
-function messageForSafeErrorCode(code, provider) {
-    switch (code.trim().toLowerCase().replace(/-/g, '_')) {
-        case 'not_configured':
-        case 'notconfigured':
-            return provider
-                ? `${providerLabel(provider)} connection is not configured.`
-                : 'AI provider connection is not configured.';
-        case 'unsupported':
-            return provider
-                ? `${providerLabel(provider)} does not support this operation.`
-                : 'This AI Connection operation is not supported.';
-        case 'service_identity_unavailable':
-            return 'AI Connection service identity is unavailable';
-        case 'unauthorized':
-            return 'Please sign in again to continue.';
-        case 'forbidden':
-        case 'permission_denied':
-            return 'AI Connection permission was denied.';
-        case 'rate_limited':
-            return 'AI Connection is rate limited. Please try again later.';
-        case 'service_unavailable':
-            return 'AI Connection service is unavailable.';
-        case 'unsafe_provider_base_url':
-            return '该服务地址指向 Xpod 不允许访问的网络，请改用公网 HTTPS 地址。';
-        case 'invalid_proxy_url':
-            return '代理地址必须是无账号密码的 HTTP 或 HTTPS 地址。';
-        case 'oauth_refresh_failed':
-        case 'oauth_refresh_unavailable':
-        case 'local_session_refresh_failed':
-            return LOCAL_SESSION_REFRESH_FAILED_MESSAGE;
-        case 'oauth_session_reauth_required':
-        case 'oauth_refresh_token_required':
-        case 'local_session_reauth_required':
-        case 'local_session_missing_refresh_token':
-            return LOCAL_SESSION_REAUTH_REQUIRED_MESSAGE;
-        case 'models_persistence_failed':
-            return '模型已获取，但保存到 Pod 失败。请重试同步模型。';
-        case 'quota_credential_not_found':
-            return '当前身份没有可用的额度凭证。';
-        case 'credential_secret_unavailable':
-            return '当前凭证密钥不可用，请重新保存后再查询额度。';
-        case 'gateway_api_key_plaintext_unavailable':
-            return 'Pod 中未找到此 API Key 的原文，无法复制配置。请创建新的 Key，更新客户端后再删除旧 Key。';
-        case 'quota_adapter_not_found':
-            return '该接入方式不支持查询官方额度。';
-        default:
-            return undefined;
-    }
-}
-function modelDiscoveryErrorMessage(providerStatus, authMode) {
-    if (providerStatus === 401 || providerStatus === 403) {
-        if (authMode === 'deviceCodeOAuth')
-            return OAUTH_MODEL_AUTH_FAILED_MESSAGE;
-        return '密钥不可用。请检查密钥是否填写正确，或换一个密钥后重试。';
-    }
-    if (providerStatus === 404) {
-        return '模型服务地址不正确。请检查服务地址后重试。';
-    }
-    if (providerStatus === 429) {
-        return '请求太频繁。请稍等一会儿再试。';
-    }
-    if (providerStatus !== undefined && providerStatus >= 500) {
-        return '模型服务暂时没有响应。请稍后重试。';
-    }
-    return '模型列表获取失败。请检查密钥、服务地址或网络后重试。';
-}
-function withProviderMessage(message, providerMessage) {
-    const sanitized = providerMessage ? sanitizeProviderResponseMessage(providerMessage) : undefined;
-    if (!sanitized)
-        return message;
-    return `${message} 上游返回：${sanitized}`;
-}
-function isModelDiscoveryMessageWithProviderDetail(message) {
-    const marker = ' 上游返回：';
-    const index = message.indexOf(marker);
-    if (index <= 0)
-        return false;
-    return MODEL_DISCOVERY_SAFE_MESSAGES.has(message.slice(0, index));
-}
-function sanitizeProviderResponseMessage(value) {
-    const sanitized = value
-        .replace(/[\u0000-\u001f\u007f]/gu, ' ')
-        .replace(/\bBearer\s+[^\s,;]+/giu, 'Bearer [REDACTED]')
-        .replace(/(?:sk|id)[._-][A-Za-z0-9._-]{8,}/gu, '[REDACTED]')
-        .replace(/https?:\/\/[^\s]+/giu, '[URL]')
-        .trim()
-        .slice(0, 240);
-    return sanitized || undefined;
-}
-function providerLabel(provider) {
-    switch (provider) {
-        case 'openai': return 'OpenAI';
-        case 'anthropic': return 'Anthropic';
-        case 'kimi': return 'Kimi';
-        case 'bailian': return 'Bailian';
-        case 'deepseek': return 'DeepSeek';
-        case 'zhipu': return 'Zhipu';
-        case 'ollama': return 'Ollama';
-        case 'custom': return 'Custom';
-    }
-}
 export async function readJson(response) {
     const text = await response.text();
     if (!text)
@@ -386,10 +204,21 @@ function modelCapabilitiesFromWire(value) {
     const capabilities = [];
     if (value.capabilities.imageInput === true)
         capabilities.push('image');
+    // Only what a model can do for the caller earns a mark. `parallelToolCalls`
+    // refines tool calling and `promptCaching` is a transport optimisation, so
+    // neither becomes a marker of its own.
     if (value.capabilities.toolCalls === true)
         capabilities.push('tool_call');
     if (value.capabilities.reasoningEffort === true)
         capabilities.push('reasoning');
+    // A curated tier marker, not a measurement: the catalog has no latency data,
+    // so a model is only "fast" because the catalog says so.
+    if (value.capabilities.fast === true)
+        capabilities.push('fast');
+    // Catalog-provided embedding models carry the capability as an object flag, the
+    // same way the AI Config embedding assignment reads them.
+    if (value.capabilities.embedding === true)
+        capabilities.push('embedding');
     return capabilities.length > 0 ? capabilities : undefined;
 }
 function isPlatformModelId(modelId) {
@@ -524,7 +353,7 @@ function parseAuthorizationMethod(value) {
         id: value.id,
         authMode,
         connectMode,
-        label: stringValue(value.label) ?? authorizationMethodFallbackLabel(value.id, authMode),
+        label: stringValue(value.label),
         lifecycle,
         reason: stringValue(value.reason),
     });
@@ -532,19 +361,6 @@ function parseAuthorizationMethod(value) {
 function authorizationMethodLifecycleValue(value) {
     return value === 'active' || value === 'unavailable' ? value : undefined;
 }
-function authorizationMethodFallbackLabel(id, authMode) {
-    if (id === 'device-code')
-        return '设备码登录';
-    if (id === 'local-session-import')
-        return '已有登录态';
-    if (id === 'local-service')
-        return '本地服务';
-    if (id === 'api-key' || authMode === 'apiKey')
-        return 'API Key';
-    if (authMode === 'local')
-        return '本地服务';
-    return '浏览器登录';
-}
 function offeringLifecycleValue(value) {
     return value === 'active' || value === 'legacy' || value === 'unavailable'
         ? value
@@ -835,12 +651,18 @@ export function parseModelDiscovery(value, expectedProvider) {
         .map((item) => {
         if (!isRecord(item) || typeof item.id !== 'string' || !item.id)
             return undefined;
+        const capabilities = Array.isArray(item.capabilities)
+            ? item.capabilities.filter((cap) => typeof cap === 'string')
+            : undefined;
+        const modelType = discoveredModelType(item.modelType);
         return compactObject({
             id: item.id,
             displayName: stringValue(item.displayName),
-            capabilities: Array.isArray(item.capabilities)
-                ? item.capabilities.filter((cap) => typeof cap === 'string')
-                : undefined,
+            // A provider that declares capabilities sends them; otherwise the type
+            // is the only evidence a row has, and an embedding model without it is
+            // listed as if it were a chat model.
+            capabilities: capabilities ?? (modelType === 'embedding' ? ['embedding'] : undefined),
+            modelType,
         });
     })
         .filter(isDefined);
@@ -855,6 +677,16 @@ export function parseModelDiscovery(value, expectedProvider) {
 export function compactObject(value) {
     return Object.fromEntries(Object.entries(value).filter(([, item]) => item !== undefined));
 }
+/**
+ * Only the two classes the Pod stores survive the wire.
+ *
+ * A server that sends anything else (an older release, a provider's own
+ * vocabulary) leaves the row untyped, which reads as a chat model - never as a
+ * value the AI config write would reject.
+ */
+function discoveredModelType(value) {
+    return value === 'chat' || value === 'embedding' ? value : undefined;
+}
 function stringValue(value) {
     return typeof value === 'string' ? value : undefined;
 }

package/node_modules/@undefineds.co/{ai-connections → ai-connections-core}/dist/client/request.js

@@ -1,4 +1,4 @@
-import { AiConnectionsRequestError, assertProvider, compactObject, isDefined, isRecord, normalizeAiConnectionsErrorMessage, parseAuthorizationMethodsSummary, parseConnectAttempt, parseCredential, parseCustomModelList, parseGatewayKeyRecord, parseGatewayModel, parseModelDiscovery, parseProviderCredentialSummary, parseProviderSummaries, readJson, sanitizePublicObject, } from './normalize.js';
+import { AiConnectionsRequestError, assertProvider, compactObject, isDefined, isRecord, parseAuthorizationMethodsSummary, parseConnectAttempt, parseCredential, parseCustomModelList, parseGatewayKeyRecord, parseGatewayModel, parseModelDiscovery, parseProviderCredentialSummary, parseProviderSummaries, readJson, sanitizePublicObject, } from './normalize.js';
 /**
  * The HTTP client itself: one factory over the Pod base URL and an authenticated
  * fetch, with every response normalised by `normalize.ts`.
@@ -25,7 +25,7 @@ export function createAiConnectionsClient({ webId, podBaseUrl, authenticatedFetc
         });
         const payload = await readJson(response);
         if (!response.ok) {
-            throw new AiConnectionsRequestError(normalizeAiConnectionsErrorMessage(payload, response.status, context), payload);
+            throw new AiConnectionsRequestError(payload, response.status, context);
         }
         return payload;
     };
@@ -64,7 +64,7 @@ export function createAiConnectionsClient({ webId, podBaseUrl, authenticatedFetc
                 return [];
             const payload = await readJson(response);
             if (!response.ok) {
-                throw new Error(normalizeAiConnectionsErrorMessage(payload, response.status));
+                throw new AiConnectionsRequestError(payload, response.status);
             }
             return isRecord(payload) && Array.isArray(payload.data)
                 ? payload.data.map(parseAuthorizationMethodsSummary).filter(isDefined)

package/node_modules/@undefineds.co/{ai-connections → ai-connections-core}/dist/client/types.d.ts

@@ -85,6 +85,13 @@ export interface CreatedGatewayKey {
 }
 export interface AiGatewayModel extends AiConnectionsModelSelection {
     provider: AiConnectionsProvider;
+    /**
+     * What kind of model this row is, when the Pod or the provider catalog knows.
+     *
+     * Rows read from the Pod carry it as their own column; the settings list shows
+     * it as the same capability mark the Gateway projection uses.
+     */
+    modelType?: DiscoveredProviderModelType;
     /** Owning credential for providers that allow multiple independent custom endpoints. */
     credentialId?: string;
     displayName?: string;
@@ -96,10 +103,21 @@ export interface AiGatewayModel extends AiConnectionsModelSelection {
     outputModalities?: string[];
     capabilities?: string[];
 }
+/**
+ * What the provider's own model list said a model is.
+ *
+ * Two values only, because that is the distinction the product acts on and the
+ * only one the Pod can store: the server infers it
+ * (`ProviderModelType.inferProviderModelType`) and the Pod row keeps it, so an
+ * embedding model stays selectable for embedding instead of being stored as an
+ * ordinary chat model.
+ */
+export type DiscoveredProviderModelType = 'chat' | 'embedding';
 export interface DiscoveredProviderModel {
     id: string;
     displayName?: string;
     capabilities?: string[];
+    modelType?: DiscoveredProviderModelType;
 }
 export interface CustomProviderModel {
     id: string;
@@ -117,12 +135,23 @@ export interface ProviderModelDiscovery {
     observedAt: string;
     source: string;
 }
-export type AiProviderAuthorizationMethodId = 'device-code' | 'local-session-import' | 'api-key' | 'local-service' | string;
+export type AiProviderAuthorizationMethodId = 'device-code' | 'local-session-import' | 'api-key' | 'local-service'
+/** Opens the provider console to sign in and mint the key the entry then stores. */
+ | 'browser-login'
+/** Starts an authorization-code browser sign-in and waits for the local callback. */
+ | 'browser-oauth' | string;
 export interface AiProviderAuthorizationMethod {
     id: AiProviderAuthorizationMethodId;
     authMode: 'oauth' | 'deviceCode' | 'local' | 'apiKey';
     connectMode?: AiConnectionsMode;
-    label: string;
+    /**
+     * The wording the entry is shown under. Optional on purpose: the shared core
+     * names the action by `id` and the applet supplies the wording, so a payload
+     * carrying none is still a complete contract. A provider the user configured
+     * may declare its own wording here, which is what keeps a custom entry from
+     * rendering under a built-in name.
+     */
+    label?: string;
     lifecycle: 'active' | 'unavailable';
     reason?: string;
 }

package/node_modules/@undefineds.co/{ai-connections → ai-connections-core}/dist/client-config/base-adapter.d.ts

@@ -20,8 +20,7 @@ interface OwnershipState {
 export declare function hashWebId(webId: string): string;
 declare function contentHash(value: string): string;
 export declare const contentFingerprint: typeof contentHash;
-export declare function normalizeV1Endpoint(endpoint: string): string;
-export declare function normalizeMessagesEndpoint(endpoint: string): string;
+export { normalizeMessagesEndpoint, normalizeV1Endpoint } from '../endpoint-urls';
 export declare function parseJsonObject(content: string | undefined, label: string): Record<string, unknown>;
 export declare function stringifyJson(value: unknown): string;
 export declare function looksLikePreviousXpodValue(value: unknown): boolean;
@@ -68,4 +67,3 @@ export declare abstract class BaseAiClientConfigAdapter implements AiClientConfi
     private exists;
     private isExecutableOnPath;
 }
-export {};

package/node_modules/@undefineds.co/{ai-connections → ai-connections-core}/dist/client-config/base-adapter.js

@@ -17,13 +17,9 @@ function contentHash(value) {
     return crypto.createHash('sha256').update(value, 'utf8').digest('hex');
 }
 export const contentFingerprint = contentHash;
-export function normalizeV1Endpoint(endpoint) {
-    const normalized = endpoint.trim().replace(/\/+$/, '');
-    return normalized.endsWith('/v1') ? normalized : `${normalized}/v1`;
-}
-export function normalizeMessagesEndpoint(endpoint) {
-    return endpoint.trim().replace(/\/+$/, '').replace(/\/v1$/, '');
-}
+// The base-URL rules are shared with the UI (see src/endpoint-urls.ts); they are
+// re-exported here so adapters keep importing them from one place.
+export { normalizeMessagesEndpoint, normalizeV1Endpoint } from '../endpoint-urls.js';
 export function parseJsonObject(content, label) {
     if (!content?.trim())
         return {};

package/node_modules/@undefineds.co/{ai-connections → ai-connections-core}/dist/client-config/index.cjs

@@ -269,6 +269,15 @@ class AiClientConfigTransaction {
   }
 }
 
+// src/endpoint-urls.ts
+function normalizeV1Endpoint(endpoint) {
+  const normalized = endpoint.trim().replace(/\/+$/, "");
+  return normalized.endsWith("/v1") ? normalized : `${normalized}/v1`;
+}
+function normalizeMessagesEndpoint(endpoint) {
+  return endpoint.trim().replace(/\/+$/, "").replace(/\/v1$/, "");
+}
+
 // src/client-config/base-adapter.ts
 class AiClientConfigError extends Error {
   code;
@@ -285,13 +294,6 @@ function contentHash(value) {
   return crypto2.createHash("sha256").update(value, "utf8").digest("hex");
 }
 var contentFingerprint = contentHash;
-function normalizeV1Endpoint(endpoint) {
-  const normalized = endpoint.trim().replace(/\/+$/, "");
-  return normalized.endsWith("/v1") ? normalized : `${normalized}/v1`;
-}
-function normalizeMessagesEndpoint(endpoint) {
-  return endpoint.trim().replace(/\/+$/, "").replace(/\/v1$/, "");
-}
 function parseJsonObject(content, label) {
   if (!content?.trim())
     return {};

package/node_modules/@undefineds.co/ai-connections-core/dist/credential-storage.d.ts

@@ -0,0 +1,59 @@
+export interface CredentialSecretEnvelopeInput {
+    webId: string;
+    provider: string;
+    /** The credential's resource IRI (`credentialResource.buildIri(podUrl, { id })`). */
+    credentialIri: string;
+    secret: Record<string, unknown>;
+}
+/**
+ * The `encryptedSecret` payload for a credential row.
+ *
+ * `PLAINTEXT` means "not encrypted at rest yet", not "no envelope": the read
+ * side verifies the envelope's owner (`webId`), provider and credential IRI
+ * before handing the secret to a provider request, so a row copied between
+ * credentials (or between accounts) never yields a usable secret.
+ */
+export declare function credentialSecretEnvelope(input: CredentialSecretEnvelopeInput): string;
+export interface CredentialSecretReadInput {
+    webId: string;
+    provider: string;
+    credentialIri: string;
+    envelope: unknown;
+}
+/** `undefined` unless the envelope belongs to this account, provider and credential. */
+export declare function decodeCredentialSecret(input: CredentialSecretReadInput): Record<string, unknown> | undefined;
+/**
+ * The provider relation a catalog credential declares (`provider`):
+ * `providers/openai.ttl` in resource terms, `openai.ttl` as the stored value.
+ *
+ * A custom instance owns its own provider document, so there the relation is
+ * derived from the credential's own id.
+ */
+export declare function credentialProviderRelation(provider: string): string;
+export declare function customCredentialProviderRelation(credentialId: string): string;
+/**
+ * The row key of a new credential: the `{id}` slot of the descriptor's
+ * `resourceIdPattern`, which is the credential's identity (never a display
+ * name).
+ *
+ * Two writers create credential rows - `XpodAiConnectionsPodStore` for a plain
+ * page, and the collection layer when a live collection creates the row
+ * optimistically - and a row key that differed between them would produce two
+ * credentials where the user asked for one, so the shape is declared once here.
+ */
+export declare function credentialRowKeyFor(provider: string, authMode: 'apiKey' | 'local'): string;
+/**
+ * The provider a credential row key declares, for rows whose `provider` relation
+ * is missing: a credential is keyed `<provider>-<uuid>` (see
+ * {@link credentialRowKeyFor}), and a custom instance is keyed `custom-…`.
+ *
+ * A key reaches us in either of two shapes - the bare `resourceIdPattern` slot
+ * (`openai-<uuid>`) or a full resource id (`custom-instance-abc.ttl#this`). The
+ * provider lives in the document segment in both, never in the fragment, so the
+ * fragment must not be the part that gets inspected.
+ */
+export declare function providerOfCredentialKey(key: string): string | undefined;
+/** `providers/openai.ttl#this` → `openai.ttl#this` (document-relative reference). */
+export declare function providerResourceReference(value: string | undefined): string | undefined;
+/** `providers/openai.ttl#this` → `openai` (the document name minus `.ttl`). */
+export declare function providerResourceKey(value: string | undefined): string | undefined;