@undefineds.co/xpod 0.4.14 → 0.4.15

package/static/settings/assets/{skeleton-CkopNkPB.js → skeleton-DEzA3hc2.js}

@@ -1 +1 @@
-import{j as t,f as n}from"./settings-DKknqu4C.js";function m({className:e,...s}){return t.jsx("div",{className:n("animate-pulse rounded-md bg-muted/50",e),...s})}export{m as S};
+import{j as t,f as n}from"./settings-CyLnISOv.js";function m({className:e,...s}){return t.jsx("div",{className:n("animate-pulse rounded-md bg-muted/50",e),...s})}export{m as S};

package/static/settings/assets/{waypoints-CrqfAftE.js → waypoints-BSdfNvEb.js}

@@ -1 +1 @@
-import{c}from"./settings-DKknqu4C.js";const e=[["rect",{x:"16",y:"16",width:"6",height:"6",rx:"1",key:"4q2zg0"}],["rect",{x:"2",y:"16",width:"6",height:"6",rx:"1",key:"8cvhb9"}],["rect",{x:"9",y:"2",width:"6",height:"6",rx:"1",key:"1egb70"}],["path",{d:"M5 16v-3a1 1 0 0 1 1-1h12a1 1 0 0 1 1 1v3",key:"1jsf9p"}],["path",{d:"M12 12V8",key:"2874zd"}]],r=c("network",e);const t=[["path",{d:"m10.586 5.414-5.172 5.172",key:"4mc350"}],["path",{d:"m18.586 13.414-5.172 5.172",key:"8c96vv"}],["path",{d:"M6 12h12",key:"8npq4p"}],["circle",{cx:"12",cy:"20",r:"2",key:"144qzu"}],["circle",{cx:"12",cy:"4",r:"2",key:"muu5ef"}],["circle",{cx:"20",cy:"12",r:"2",key:"1xzzfp"}],["circle",{cx:"4",cy:"12",r:"2",key:"1hvhnz"}]],h=c("waypoints",t);export{r as N,h as W};
+import{c}from"./settings-CyLnISOv.js";const e=[["rect",{x:"16",y:"16",width:"6",height:"6",rx:"1",key:"4q2zg0"}],["rect",{x:"2",y:"16",width:"6",height:"6",rx:"1",key:"8cvhb9"}],["rect",{x:"9",y:"2",width:"6",height:"6",rx:"1",key:"1egb70"}],["path",{d:"M5 16v-3a1 1 0 0 1 1-1h12a1 1 0 0 1 1 1v3",key:"1jsf9p"}],["path",{d:"M12 12V8",key:"2874zd"}]],r=c("network",e);const t=[["path",{d:"m10.586 5.414-5.172 5.172",key:"4mc350"}],["path",{d:"m18.586 13.414-5.172 5.172",key:"8c96vv"}],["path",{d:"M6 12h12",key:"8npq4p"}],["circle",{cx:"12",cy:"20",r:"2",key:"144qzu"}],["circle",{cx:"12",cy:"4",r:"2",key:"muu5ef"}],["circle",{cx:"20",cy:"12",r:"2",key:"1xzzfp"}],["circle",{cx:"4",cy:"12",r:"2",key:"1hvhnz"}]],h=c("waypoints",t);export{r as N,h as W};

package/static/settings/assets/{workspace-layout-UN6c4qTG.js → workspace-layout-BOQnl_3d.js}

@@ -1 +1 @@
-import{r as t,j as s,f as w}from"./settings-DKknqu4C.js";const y=t.createContext(null);function P(){const e=t.useContext(y);if(!e)throw new Error("useWorkspaceLayout must be used inside TwoPaneLayout");return e}const g="(max-width: 767px)",v={gridTemplateColumns:"210px minmax(0, 1fr)"};function j(e){return e==="context"?"main":e}function C(e){if(typeof window>"u"||typeof window.matchMedia!="function")return()=>{};const a=window.matchMedia(g);return a.addEventListener("change",e),()=>a.removeEventListener("change",e)}function R(){return typeof window>"u"||typeof window.matchMedia!="function"?"split":window.matchMedia(g).matches?"stack":"split"}function L(){return"split"}function M(e){const a=t.useSyncExternalStore(C,R,L);return e==="auto"?a:e}function N({resolvedMode:e,history:a,resolvePane:l}){const[f,m]=t.useState("list"),c=t.useRef(null),b=t.useRef(null),i=t.useRef(null),r=t.useRef(null),u=t.useMemo(()=>({list:b,main:i,context:r}),[]),o=t.useCallback((n,h={})=>{const d=l?.(n)??n;m(d),e==="stack"&&(c.current=d,h.fromHistory||a?.push(d))},[a,l,e]),p=t.useCallback(()=>o("list"),[o]),x=t.useCallback(()=>o("main"),[o]),k=t.useCallback(()=>o("context"),[o]);return t.useLayoutEffect(()=>{if(e!=="stack"){c.current=null;return}const n=c.current;n&&(c.current=null,u[n].current?.focus())},[f,u,e]),t.useLayoutEffect(()=>{if(!(e!=="stack"||!a))return a.subscribe(n=>{o(n,{fromHistory:!0})})},[a,o,e]),{activePane:f,paneRefs:u,openList:p,openMain:x,openContext:k}}function S({listHeader:e,list:a,mainHeader:l,main:f,mode:m="auto",history:c,className:b}){const i=M(m),{activePane:r,paneRefs:u,openList:o,openMain:p,openContext:x}=N({resolvedMode:i,history:c,resolvePane:j}),k=t.useMemo(()=>({mode:i,activePane:r,openList:o,openMain:p,openContext:x}),[r,x,o,p,i]),n=i==="stack",h=n&&r!=="list",d=n&&r!=="main";return s.jsx(y.Provider,{value:k,children:s.jsx("section",{className:w("flex min-h-0 flex-1 flex-col bg-background",b),"data-workspace-layout":"two-pane","data-workspace-mode":i,children:s.jsxs("div",{className:w("grid min-h-0 flex-1",n?"grid-cols-1":null),style:n?void 0:v,"data-workspace-layout-mode":m,"data-workspace-active-pane":r,children:[s.jsxs("aside",{ref:u.list,className:w("min-h-0 flex-col overflow-hidden bg-layout-list-item @container",h?"hidden":"flex",n?"border-r-0":"border-r border-border"),"data-testid":"workspace-list-pane","data-workspace-pane":"list",hidden:h,tabIndex:n?-1:void 0,children:[s.jsx("header",{className:"h-12 shrink-0 border-b border-border bg-layout-list-header","data-workspace-list-header":"true",children:e}),s.jsx("div",{className:"min-h-0 flex-1 overflow-y-auto",children:a})]}),s.jsxs("main",{ref:u.main,className:w("min-h-0 flex-col overflow-hidden bg-layout-content @container",d?"hidden":"flex"),"data-testid":"workspace-main-pane","data-workspace-pane":"main",hidden:d,tabIndex:n?-1:void 0,children:[s.jsx("header",{className:"h-12 shrink-0 border-b border-border bg-layout-content","data-workspace-main-header":"true",children:l}),s.jsxs("div",{className:"min-h-0 flex-1 overflow-y-auto",children:[n?s.jsx("button",{type:"button",className:"inline-flex items-center px-4 py-3 text-sm text-muted-foreground hover:text-foreground",onClick:o,children:"返回列表"}):null,f]})]})]})})})}export{S as T,y as W,P as u};
+import{r as t,j as s,f as w}from"./settings-CyLnISOv.js";const y=t.createContext(null);function P(){const e=t.useContext(y);if(!e)throw new Error("useWorkspaceLayout must be used inside TwoPaneLayout");return e}const g="(max-width: 767px)",v={gridTemplateColumns:"210px minmax(0, 1fr)"};function j(e){return e==="context"?"main":e}function C(e){if(typeof window>"u"||typeof window.matchMedia!="function")return()=>{};const a=window.matchMedia(g);return a.addEventListener("change",e),()=>a.removeEventListener("change",e)}function R(){return typeof window>"u"||typeof window.matchMedia!="function"?"split":window.matchMedia(g).matches?"stack":"split"}function L(){return"split"}function M(e){const a=t.useSyncExternalStore(C,R,L);return e==="auto"?a:e}function N({resolvedMode:e,history:a,resolvePane:l}){const[f,m]=t.useState("list"),c=t.useRef(null),b=t.useRef(null),i=t.useRef(null),r=t.useRef(null),u=t.useMemo(()=>({list:b,main:i,context:r}),[]),o=t.useCallback((n,h={})=>{const d=l?.(n)??n;m(d),e==="stack"&&(c.current=d,h.fromHistory||a?.push(d))},[a,l,e]),p=t.useCallback(()=>o("list"),[o]),x=t.useCallback(()=>o("main"),[o]),k=t.useCallback(()=>o("context"),[o]);return t.useLayoutEffect(()=>{if(e!=="stack"){c.current=null;return}const n=c.current;n&&(c.current=null,u[n].current?.focus())},[f,u,e]),t.useLayoutEffect(()=>{if(!(e!=="stack"||!a))return a.subscribe(n=>{o(n,{fromHistory:!0})})},[a,o,e]),{activePane:f,paneRefs:u,openList:p,openMain:x,openContext:k}}function S({listHeader:e,list:a,mainHeader:l,main:f,mode:m="auto",history:c,className:b}){const i=M(m),{activePane:r,paneRefs:u,openList:o,openMain:p,openContext:x}=N({resolvedMode:i,history:c,resolvePane:j}),k=t.useMemo(()=>({mode:i,activePane:r,openList:o,openMain:p,openContext:x}),[r,x,o,p,i]),n=i==="stack",h=n&&r!=="list",d=n&&r!=="main";return s.jsx(y.Provider,{value:k,children:s.jsx("section",{className:w("flex min-h-0 flex-1 flex-col bg-background",b),"data-workspace-layout":"two-pane","data-workspace-mode":i,children:s.jsxs("div",{className:w("grid min-h-0 flex-1",n?"grid-cols-1":null),style:n?void 0:v,"data-workspace-layout-mode":m,"data-workspace-active-pane":r,children:[s.jsxs("aside",{ref:u.list,className:w("min-h-0 flex-col overflow-hidden bg-layout-list-item @container",h?"hidden":"flex",n?"border-r-0":"border-r border-border"),"data-testid":"workspace-list-pane","data-workspace-pane":"list",hidden:h,tabIndex:n?-1:void 0,children:[s.jsx("header",{className:"h-12 shrink-0 border-b border-border bg-layout-list-header","data-workspace-list-header":"true",children:e}),s.jsx("div",{className:"min-h-0 flex-1 overflow-y-auto",children:a})]}),s.jsxs("main",{ref:u.main,className:w("min-h-0 flex-col overflow-hidden bg-layout-content @container",d?"hidden":"flex"),"data-testid":"workspace-main-pane","data-workspace-pane":"main",hidden:d,tabIndex:n?-1:void 0,children:[s.jsx("header",{className:"h-12 shrink-0 border-b border-border bg-layout-content","data-workspace-main-header":"true",children:l}),s.jsxs("div",{className:"min-h-0 flex-1 overflow-y-auto",children:[n?s.jsx("button",{type:"button",className:"inline-flex items-center px-4 py-3 text-sm text-muted-foreground hover:text-foreground",onClick:o,children:"返回列表"}):null,f]})]})]})})})}export{S as T,y as W,P as u};

package/static/settings/settings.html

@@ -5,7 +5,7 @@
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <script src="/settings/theme-init.js"></script>
     <title>Xpod Settings</title>
-    <script type="module" crossorigin src="/settings/assets/settings-DKknqu4C.js"></script>
+    <script type="module" crossorigin src="/settings/assets/settings-CyLnISOv.js"></script>
     <link rel="stylesheet" crossorigin href="/settings/assets/settings-rk080mvG.css">
   </head>
   <body class="bg-background text-foreground">

package/dist/api/ai-gateway/pod/HostedPodDataAccess.d.ts

@@ -1,31 +0,0 @@
-import type { AuthContext } from '../../auth/AuthContext';
-export interface InternalPodAccessTokenProvider {
-    getTrustedFetch(owner: string, auth?: InternalPodAccessAuthContext, context?: InternalPodAccessRequestContext): Promise<typeof fetch | undefined>;
-}
-export type InternalPodAccessAuthContext = AuthContext | undefined;
-export interface InternalPodAccessRequestContext {
-    /** Opaque label recorded for internal Pod access; no longer grants implicit authorization. */
-    reason?: string;
-    /** Physical Pod root when the identity WebID is hosted by a separate IdP. */
-    podBaseUrl?: string;
-}
-export interface HostedPodDataAccessOptions {
-    cssBaseUrl: string;
-    gatewayAdminProxyAuthSecret?: string;
-    fetch?: typeof fetch;
-    now?: () => number;
-    nonce?: () => string;
-}
-export declare const HOSTED_POD_RAW_BODY_MAX_BYTES: number;
-export declare class HostedPodDataAccess implements InternalPodAccessTokenProvider {
-    private readonly cssBaseUrl;
-    private readonly gatewayAdminProxyAuthSecret?;
-    private readonly fetch;
-    private readonly now;
-    private readonly nonce;
-    constructor(options: HostedPodDataAccessOptions);
-    getTrustedFetch(owner: string, auth?: InternalPodAccessAuthContext, context?: InternalPodAccessRequestContext): Promise<typeof fetch | undefined>;
-    private authorize;
-    private assertHostedAllowedResource;
-    private headersForLoopback;
-}

package/dist/api/ai-gateway/pod/HostedPodDataAccess.js

@@ -1,330 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.HostedPodDataAccess = exports.HOSTED_POD_RAW_BODY_MAX_BYTES = void 0;
-const node_crypto_1 = require("node:crypto");
-const node_crypto_2 = require("node:crypto");
-const node_net_1 = require("node:net");
-const sparqljs_1 = require("sparqljs");
-const AiConnectionsServiceAccess_1 = require("../service-access/AiConnectionsServiceAccess");
-const AiConfigServiceAccess_1 = require("../service-access/AiConfigServiceAccess");
-const GatewayAdminProxyAuth_1 = require("../../../runtime/GatewayAdminProxyAuth");
-const MODEL_QUERY_MAX_BODY_BYTES = 256 * 1024;
-exports.HOSTED_POD_RAW_BODY_MAX_BYTES = 1024 * 1024;
-const INTERNAL_POD_DATA_PATH = '/.internal/pod-data';
-const STRIPPED_CALLER_HEADERS = new Set([
-    'authorization',
-    // The request body is buffered before signing and forwarding. Let fetch
-    // calculate the length for the forwarded bytes instead of retaining the
-    // caller's stream-oriented header.
-    'content-length',
-    'dpop',
-    'cookie',
-]);
-class HostedPodDataAccess {
-    constructor(options) {
-        this.cssBaseUrl = new URL(options.cssBaseUrl);
-        if (!isLoopbackHostname(this.cssBaseUrl.hostname)) {
-            throw new Error('hosted_pod_css_loopback_required');
-        }
-        this.gatewayAdminProxyAuthSecret = options.gatewayAdminProxyAuthSecret ?? process.env.XPOD_GATEWAY_ADMIN_PROXY_AUTH_SECRET;
-        this.fetch = options.fetch ?? fetch;
-        this.now = options.now ?? Date.now;
-        this.nonce = options.nonce ?? node_crypto_1.randomUUID;
-    }
-    async getTrustedFetch(owner, auth, context) {
-        return async (input, init) => {
-            const request = new Request(input, init);
-            const method = normalizeMethod(request.method);
-            const resourceUrl = normalizeResourceUrl(request.url);
-            const body = method === 'POST' ? await readRequestBody(request) : undefined;
-            const forwardedBytes = method === 'PATCH' || method === 'PUT'
-                ? await readRequestBytes(request)
-                : undefined;
-            const authorization = this.authorize({ owner, auth, context, method, resourceUrl, body });
-            const loopbackUrl = new URL(INTERNAL_POD_DATA_PATH, this.cssBaseUrl);
-            const headers = this.headersForLoopback(request.headers, {
-                ownerWebId: owner,
-                ...(context?.podBaseUrl ? { podBaseUrl: context.podBaseUrl } : {}),
-                method,
-                resourceUrl,
-                principalKind: authorization.principalKind,
-                scopes: authorization.scopes,
-                ...(body ? { bodyDigest: body.digest } : {}),
-            });
-            const forwardedBody = method === 'POST'
-                ? body?.bytes
-                : forwardedBytes ?? request.body;
-            try {
-                return await this.fetch(loopbackUrl, {
-                    method,
-                    headers,
-                    body: forwardedBody,
-                    signal: init?.signal ?? request.signal,
-                    ...(forwardedBody instanceof ReadableStream ? { duplex: 'half' } : {}),
-                });
-            }
-            catch (error) {
-                const message = error instanceof Error
-                    ? `${error.message}${error.cause ? `:${String(error.cause)}` : ''}`
-                    : String(error);
-                throw new Error(`hosted_pod_loopback_fetch_failed:${loopbackUrl.href}:${message}`, { cause: error });
-            }
-        };
-    }
-    authorize(input) {
-        this.assertHostedAllowedResource(input.owner, input.resourceUrl, input.method, input.body, input.context?.podBaseUrl);
-        if (!input.auth && input.context?.reason === 'gateway-key-verifier') {
-            return {
-                principalKind: 'gateway-key-verifier',
-                scopes: [input.method === 'PATCH' ? 'ai:gateway-key:touch' : 'ai:gateway-key:verify'],
-            };
-        }
-        if (!input.auth) {
-            throw new Error('hosted_pod_auth_required');
-        }
-        if (input.auth.type !== 'solid') {
-            throw new Error('hosted_pod_solid_principal_required');
-        }
-        if (input.auth.webId !== input.owner) {
-            throw new Error('hosted_pod_owner_mismatch');
-        }
-        return {
-            principalKind: 'solid-user',
-            scopes: [isReadOnlyMethod(input.method, input.resourceUrl, input.owner, input.body, input.context?.podBaseUrl)
-                    ? 'ai:credentials:read'
-                    : 'ai:credentials:write'],
-        };
-    }
-    assertHostedAllowedResource(owner, resourceUrl, method, body, podBaseUrl) {
-        const resource = parseUrl(resourceUrl, 'hosted_pod_resource_url_invalid');
-        const ownerUrl = parseUrl(owner, 'hosted_pod_owner_url_invalid');
-        const podRoot = podBaseUrl
-            ? normalizePodRoot(podBaseUrl)
-            : hostedPodRootFromOwner(ownerUrl);
-        if (!podRoot || resource.origin !== podRoot.origin || !resource.pathname.startsWith(podRoot.pathname)) {
-            throw new Error('hosted_pod_remote_resource');
-        }
-        const modelCollectionPath = `${podRoot.pathname}settings/providers/-/sparql`;
-        const settingsCollectionPath = `${podRoot.pathname}settings/-/sparql`;
-        const storageOwner = new URL('profile/card#me', podRoot).href;
-        const gatewayAccessKeyEndpoint = (0, AiConnectionsServiceAccess_1.isGatewayAccessKeySparqlEndpoint)(storageOwner, resource);
-        if (resource.pathname === modelCollectionPath || resource.pathname === settingsCollectionPath || gatewayAccessKeyEndpoint) {
-            const queryOnlyEndpoint = resource.pathname === modelCollectionPath || gatewayAccessKeyEndpoint;
-            if (resource.hash || (method === 'GET' && !hasExactlyOneSparqlQuery(resource)) ||
-                (method === 'POST' && (resource.search || !body)) ||
-                (queryOnlyEndpoint && method === 'POST' && body?.kind !== 'query')) {
-                throw new Error('hosted_pod_resource_not_allowed');
-            }
-            if (method !== 'GET' && method !== 'POST') {
-                throw new Error('hosted_pod_resource_not_allowed');
-            }
-            return;
-        }
-        if (resource.hash || resource.search) {
-            throw new Error('hosted_pod_resource_not_allowed');
-        }
-        const allowed = (0, AiConnectionsServiceAccess_1.createAiConnectionsServiceAccess)({
-            ownerWebId: storageOwner,
-            serviceWebId: owner,
-        }).resources.map((entry) => entry.url);
-        allowed.push(...(0, AiConfigServiceAccess_1.createAiConfigResourceUrls)(storageOwner));
-        if (!allowed.includes(resource.href)) {
-            throw new Error('hosted_pod_resource_not_allowed');
-        }
-    }
-    headersForLoopback(headers, intent) {
-        const next = new Headers();
-        headers.forEach((value, key) => {
-            const normalized = key.toLowerCase();
-            if (STRIPPED_CALLER_HEADERS.has(normalized)
-                || GatewayAdminProxyAuth_1.GATEWAY_ADMIN_PROXY_HEADERS.includes(normalized)
-                || normalized.startsWith('x-xpod-admin-proxy-')) {
-                return;
-            }
-            next.set(key, value);
-        });
-        if (!this.gatewayAdminProxyAuthSecret) {
-            throw new Error('XPOD_GATEWAY_ADMIN_PROXY_AUTH_SECRET is required for hosted Pod data access');
-        }
-        const marker = (0, GatewayAdminProxyAuth_1.createGatewayAdminProxyHeaders)({
-            secret: this.gatewayAdminProxyAuthSecret,
-            method: intent.method,
-            url: INTERNAL_POD_DATA_PATH,
-            originalClientLoopback: true,
-            issuedAt: this.now(),
-            nonce: this.nonce(),
-            intent,
-        });
-        for (const [key, value] of Object.entries(marker)) {
-            if (value !== undefined) {
-                next.set(key, Array.isArray(value) ? value.join(', ') : String(value));
-            }
-        }
-        return next;
-    }
-}
-exports.HostedPodDataAccess = HostedPodDataAccess;
-function normalizePodRoot(value) {
-    const root = new URL(value);
-    root.search = '';
-    root.hash = '';
-    if (!root.pathname.endsWith('/'))
-        root.pathname += '/';
-    return root;
-}
-function hasExactlyOneSparqlQuery(resource) {
-    const keys = Array.from(resource.searchParams.keys());
-    const query = resource.searchParams.get('query')?.trim();
-    return keys.length === 1 && keys[0] === 'query' && query !== undefined && sparqlKind(query) === 'query';
-}
-function normalizeMethod(method) {
-    const upper = (method ?? 'GET').toUpperCase();
-    if (upper === 'GET' || upper === 'HEAD' || upper === 'POST' || upper === 'PUT' || upper === 'PATCH' || upper === 'DELETE') {
-        return upper;
-    }
-    throw new Error('hosted_pod_method_not_allowed');
-}
-async function readRequestBytes(request, maxBytes = exports.HOSTED_POD_RAW_BODY_MAX_BYTES) {
-    const body = request.body;
-    if (!body) {
-        return undefined;
-    }
-    const reader = body.getReader();
-    const chunks = [];
-    let totalBytes = 0;
-    try {
-        while (true) {
-            const { done, value } = await reader.read();
-            if (done) {
-                break;
-            }
-            const chunk = value instanceof Uint8Array ? value : new Uint8Array(value);
-            if (chunk.byteLength > maxBytes - totalBytes) {
-                try {
-                    await reader.cancel();
-                }
-                catch {
-                    // Preserve the stable size error even if the source cannot cancel cleanly.
-                }
-                throw new Error('hosted_pod_body_too_large');
-            }
-            chunks.push(chunk);
-            totalBytes += chunk.byteLength;
-        }
-    }
-    finally {
-        reader.releaseLock();
-    }
-    const bytes = new Uint8Array(totalBytes);
-    let offset = 0;
-    for (const chunk of chunks) {
-        bytes.set(chunk, offset);
-        offset += chunk.byteLength;
-    }
-    return bytes;
-}
-async function readRequestBody(request) {
-    const bytes = await readRequestBytes(request, MODEL_QUERY_MAX_BODY_BYTES);
-    if (!bytes) {
-        return undefined;
-    }
-    if (bytes.byteLength === 0) {
-        return undefined;
-    }
-    const contentType = request.headers.get('content-type')?.split(';', 1)[0].trim().toLowerCase();
-    let declaredKind;
-    let sparql;
-    if (contentType === 'application/sparql-query') {
-        declaredKind = 'query';
-        sparql = new TextDecoder().decode(bytes).trim();
-    }
-    else if (contentType === 'application/sparql-update') {
-        declaredKind = 'update';
-        sparql = new TextDecoder().decode(bytes).trim();
-    }
-    else if (contentType === 'application/x-www-form-urlencoded') {
-        const params = new URLSearchParams(new TextDecoder().decode(bytes));
-        const keys = Array.from(params.keys());
-        const operation = keys.length === 1 && (keys[0] === 'query' || keys[0] === 'update')
-            ? keys[0]
-            : undefined;
-        if (operation) {
-            declaredKind = operation;
-            sparql = params.get(operation)?.trim();
-        }
-    }
-    if (!declaredKind || !sparql || sparqlKind(sparql) !== declaredKind) {
-        return undefined;
-    }
-    return {
-        kind: declaredKind,
-        sparql,
-        digest: (0, node_crypto_2.createHash)('sha256').update(bytes).digest('hex'),
-        bytes,
-    };
-}
-function sparqlKind(value) {
-    try {
-        const parsed = new sparqljs_1.Parser({ baseIRI: 'urn:xpod:internal-sparql:' }).parse(value);
-        return parsed.type === 'update' ? 'update' : parsed.type === 'query' ? 'query' : undefined;
-    }
-    catch {
-        return undefined;
-    }
-}
-function isReadOnlyMethod(method, resourceUrl, ownerWebId, body, podBaseUrl) {
-    if (method === 'GET' || method === 'HEAD') {
-        return true;
-    }
-    if (method !== 'POST') {
-        return false;
-    }
-    try {
-        const resource = new URL(resourceUrl);
-        const podRoot = podBaseUrl
-            ? normalizePodRoot(podBaseUrl)
-            : hostedPodRootFromOwner(new URL(ownerWebId));
-        if (!podRoot || body?.kind !== 'query') {
-            return false;
-        }
-        const storageOwnerWebId = new URL('profile/card#me', podRoot).href;
-        return resource.pathname === `${podRoot.pathname}settings/providers/-/sparql`
-            || resource.pathname === `${podRoot.pathname}settings/-/sparql`
-            || (0, AiConnectionsServiceAccess_1.isGatewayAccessKeySparqlEndpoint)(storageOwnerWebId, resource);
-    }
-    catch {
-        return false;
-    }
-}
-function normalizeResourceUrl(value) {
-    return new URL(value).href;
-}
-function parseUrl(value, errorCode) {
-    try {
-        return new URL(value);
-    }
-    catch {
-        throw new Error(errorCode);
-    }
-}
-function hostedPodRootFromOwner(ownerUrl) {
-    if (ownerUrl.hash !== '#me' || !ownerUrl.pathname.endsWith('/profile/card')) {
-        return undefined;
-    }
-    const podPath = ownerUrl.pathname.slice(0, -'profile/card'.length);
-    if (!podPath || !podPath.endsWith('/')) {
-        return undefined;
-    }
-    return new URL(podPath, ownerUrl.origin);
-}
-function isLoopbackHostname(hostname) {
-    const normalized = hostname.replace(/^\[|\]$/gu, '').toLowerCase();
-    if (normalized === 'localhost') {
-        return true;
-    }
-    if ((0, node_net_1.isIP)(normalized) === 4) {
-        return normalized.startsWith('127.');
-    }
-    return normalized === '::1';
-}
-//# sourceMappingURL=HostedPodDataAccess.js.map

package/dist/http/InternalPodDataHttpHandler.d.ts

@@ -1,57 +0,0 @@
-import { HttpHandler, type BodyParser, type HttpHandlerInput, type HttpRequest, type HttpResponse, type ResourceStore } from '@solid/community-server';
-export interface InternalPodDataHttpHandlerOptions {
-    resourceStore: ResourceStore;
-    gatewayAdminProxyAuthSecret?: string;
-    patchBodyParser?: BodyParser;
-    sparqlHandler?: InternalPodDataTrustedSparqlHandler;
-    baseUrl?: string;
-    basePath?: string;
-}
-/** Narrow trusted bridge used only after the signed internal intent has been
- * validated. The implementation must re-check the owner/collection boundary. */
-export interface InternalPodDataTrustedSparqlHandler {
-    handleTrustedInternalSelect(input: {
-        ownerWebId: string;
-        endpointUrl: string;
-        query: string;
-        request: HttpRequest;
-        response: HttpResponse;
-    }): Promise<void>;
-    handleTrustedInternalUpdate(input: {
-        ownerWebId: string;
-        endpointUrl: string;
-        query: string;
-        request: HttpRequest;
-        response: HttpResponse;
-    }): Promise<void>;
-}
-export declare class InternalPodDataHttpHandler extends HttpHandler {
-    protected readonly logger: import("global-logger-factory").Logger<unknown>;
-    private readonly resourceStore;
-    private readonly gatewayAdminProxyAuthSecret?;
-    private readonly patchBodyParser?;
-    private readonly sparqlHandler?;
-    private readonly deploymentBaseUrl?;
-    private readonly basePath;
-    private readonly seenNonces;
-    private readonly eTagHandler;
-    private readonly conditionsParser;
-    constructor(options: InternalPodDataHttpHandlerOptions);
-    canHandle({ request }: HttpHandlerInput): Promise<void>;
-    handle({ request, response }: HttpHandlerInput): Promise<void>;
-    private verifyRequest;
-    private logRejectedRequest;
-    private intentMatchesRequest;
-    private isHostedOwnerResource;
-    private isAllowedAiConnectionResource;
-    private delegate;
-    private createRepresentation;
-    private writeETag;
-    private createPatch;
-    private pipeRepresentation;
-    private writeNotFound;
-    private writeEmptyGraph;
-    private requestPathname;
-    private parseOptionalUrl;
-    private isInsideDeployment;
-}