@undefineds.co/xpod 0.4.15 → 0.4.16

package/dist/api/chatkit/pod-store.js

@@ -22,6 +22,7 @@ const store_1 = require("../runs/store");
 const schema_3 = require("../tasks/schema");
 const store_2 = require("../tasks/store");
 const TaskAuthBinding_1 = require("../tasks/TaskAuthBinding");
+const CallerPodAccess_1 = require("../ai-gateway/auth/CallerPodAccess");
 const OwnerPodAccess_1 = require("../ai-gateway/pod/OwnerPodAccess");
 const AuthContext_1 = require("../auth/AuthContext");
 const provider_1 = require("../../ai/schema/provider");
@@ -85,6 +86,10 @@ class PodChatKitStore {
     // =========================================================================
     /**
      * 获取认证后的 drizzle 实例 (缓存到 context 中)
+     *
+     * The Pod holds the only copy of this data, so a caller without a usable Pod credential is
+     * told why instead of being handed an empty result: a chat screen that answers "no threads"
+     * for a Pod it could not open reports a state the user cannot act on.
      */
     async getDb(context) {
         // Check if we already have a cached db in context
@@ -95,7 +100,7 @@ class PodChatKitStore {
         const auth = context.auth;
         if (!auth || !(0, AuthContext_1.isSolidAuth)(auth) || !auth.webId) {
             this.logger.warn('No valid solid auth in context, cannot access Pod');
-            return null;
+            throw new Error(CallerPodAccess_1.CALLER_POD_ACCESS_UNAVAILABLE);
         }
         // One credential path for every caller: the owner's own Pod key, exchanged for a
         // token this process can prove, or the caller's reusable token.
@@ -105,11 +110,12 @@ class PodChatKitStore {
         }
         catch (error) {
             this.logger.error(`Failed to obtain Pod access for ${auth.webId}: ${error}`);
-            return null;
+            throw error;
         }
         if (!podFetch) {
-            this.logger.warn(`No usable Pod credential for ${auth.webId}: ${(0, OwnerPodAccess_1.podAccessError)(auth.webId, auth)}`);
-            return null;
+            const reason = (0, OwnerPodAccess_1.podAccessError)(auth.webId, auth);
+            this.logger.warn(`No usable Pod credential for ${auth.webId}: ${reason}`);
+            throw new Error(reason);
         }
         const db = (0, drizzle_solid_1.drizzle)({ fetch: podFetch, info: { webId: auth.webId, isLoggedIn: true } }, { schema });
         this.logger.info(`Initializing tables for Pod: ${auth.webId}`);
@@ -469,9 +475,6 @@ class PodChatKitStore {
      */
     async ensureChat(chatId, context) {
         const db = await this.getDb(context);
-        if (!db) {
-            throw new Error('Cannot access Pod: invalid credentials');
-        }
         const webId = this.getWebId(context);
         const chatResourceId = this.buildChatResourceId(chatId);
         const surfaceId = this.chatSurfaceIdFromResourceId(chatResourceId) ?? chatId;
@@ -920,9 +923,6 @@ class PodChatKitStore {
     }
     async selectMessagesForThread(thread, context) {
         const db = await this.getDb(context);
-        if (!db) {
-            return [];
-        }
         const resolvedThread = await this.resolveThreadRef(thread, context);
         const records = await db.select()
             .from(schema_1.Message)
@@ -983,9 +983,6 @@ class PodChatKitStore {
             return cached;
         }
         const db = await this.getDb(context);
-        if (!db) {
-            throw new Error('Cannot access Pod: invalid credentials');
-        }
         const resolvedThread = await this.resolveThreadRef(thread, context);
         const threadRecord = await db.findByIri(schema_1.Thread, resolvedThread.thread);
         if (!threadRecord) {
@@ -1002,9 +999,6 @@ class PodChatKitStore {
     }
     async saveThread(thread, context) {
         const db = await this.getDb(context);
-        if (!db) {
-            throw new Error('Cannot access Pod: invalid credentials');
-        }
         const now = new Date().toISOString();
         const parent = this.resolveThreadParent(thread, context);
         const commandKind = parent.commandKind;
@@ -1064,9 +1058,6 @@ class PodChatKitStore {
     }
     async loadThreads(limit, after, order, context) {
         const db = await this.getDb(context);
-        if (!db) {
-            return { data: [], has_more: false };
-        }
         try {
             const threads = await models_1.threadRepository.list(db);
             const metadataById = new Map();
@@ -1109,9 +1100,6 @@ class PodChatKitStore {
     async deleteThread(thread, context) {
         const resolvedThread = await this.resolveThreadRef(thread, context);
         const db = await this.getDb(context);
-        if (!db) {
-            throw new Error('Cannot access Pod: invalid credentials');
-        }
         // 删除关联到此 Thread 的消息
         try {
             await db.delete(schema_1.Message).where((0, drizzle_solid_1.eq)(schema_1.Message.thread, resolvedThread.thread));
@@ -1174,9 +1162,6 @@ class PodChatKitStore {
     }
     async addThreadItem(thread, item, context) {
         const db = await this.getDb(context);
-        if (!db) {
-            throw new Error('Cannot access Pod: invalid credentials');
-        }
         const resolvedThread = await this.resolveThreadRef(thread, context);
         const itemResourceId = this.buildMessageResourceId({
             id: item.id,
@@ -1294,9 +1279,6 @@ class PodChatKitStore {
     }
     async saveItem(thread, item, context) {
         const db = await this.getDb(context);
-        if (!db) {
-            throw new Error('Cannot access Pod: invalid credentials');
-        }
         const resolvedThread = await this.resolveThreadRef(thread, context);
         // 准备更新数据
         let content = '';
@@ -1442,9 +1424,6 @@ WHERE { ${deletePatterns.join(' ')} }
     }
     async loadItem(thread, itemId, context) {
         const db = await this.getDb(context);
-        if (!db) {
-            throw new Error('Cannot access Pod: invalid credentials');
-        }
         const resolvedThread = await this.resolveThreadRef(thread, context);
         const messages = (await this.selectMessagesForThread(thread, context))
             .filter((message) => message.id === itemId);
@@ -1478,9 +1457,6 @@ WHERE { ${deletePatterns.join(' ')} }
     // =========================================================================
     async saveRun(run, context) {
         const db = await this.getDb(context);
-        if (!db) {
-            throw new Error('Cannot access Pod: invalid credentials');
-        }
         run.id = (0, store_1.buildRunResourceId)(run);
         const existing = await db.findById(schema_2.Run, run.id);
         const values = {
@@ -1513,9 +1489,6 @@ WHERE { ${deletePatterns.join(' ')} }
     }
     async loadRun(id, context) {
         const db = await this.getDb(context);
-        if (!db) {
-            throw new Error('Cannot access Pod: invalid credentials');
-        }
         const record = await db.findById(schema_2.Run, id);
         if (!record) {
             throw new Error(`Run not found: ${id}`);
@@ -1524,9 +1497,6 @@ WHERE { ${deletePatterns.join(' ')} }
     }
     async listRuns(options, context) {
         const db = await this.getDb(context);
-        if (!db) {
-            throw new Error('Cannot access Pod: invalid credentials');
-        }
         const conditions = [];
         if (options.task) {
             conditions.push((0, drizzle_solid_1.eq)(schema_2.Run.task, options.task));
@@ -1551,9 +1521,6 @@ WHERE { ${deletePatterns.join(' ')} }
     }
     async appendRunStep(event, context) {
         const db = await this.getDb(context);
-        if (!db) {
-            throw new Error('Cannot access Pod: invalid credentials');
-        }
         if (!(0, store_1.isRunResourceId)(event.runId)) {
             throw new Error(`RunStep runId must be a complete Run resource id: ${event.runId}`);
         }
@@ -1570,9 +1537,6 @@ WHERE { ${deletePatterns.join(' ')} }
     }
     async loadRunSteps(runId, context) {
         const db = await this.getDb(context);
-        if (!db) {
-            throw new Error('Cannot access Pod: invalid credentials');
-        }
         if (!(0, store_1.isRunResourceId)(runId)) {
             throw new Error(`loadRunSteps requires a base-relative Run id: ${runId}`);
         }
@@ -1613,9 +1577,6 @@ WHERE { ${deletePatterns.join(' ')} }
             return undefined;
         }
         const db = await this.getDb(context);
-        if (!db) {
-            throw new Error('Cannot access Pod: invalid credentials');
-        }
         const updatedAt = this.timestampToIso(input.now);
         const expectedLease = run.leaseOwner
             ? (0, drizzle_solid_1.eq)(schema_2.Run.leaseOwner, run.leaseOwner)
@@ -1642,9 +1603,6 @@ WHERE { ${deletePatterns.join(' ')} }
     }
     async releaseClientToolContinuation(claim, now, context) {
         const db = await this.getDb(context);
-        if (!db) {
-            throw new Error('Cannot access Pod: invalid credentials');
-        }
         const released = await db.update(schema_2.Run)
             .set({
             status: schema_2.RunStatus.WAITING_INPUT,
@@ -1674,9 +1632,6 @@ WHERE { ${deletePatterns.join(' ')} }
     // =========================================================================
     async saveTask(task, context) {
         const db = await this.getDb(context);
-        if (!db) {
-            throw new Error('Cannot access Pod: invalid credentials');
-        }
         task.id = (0, store_2.buildTaskResourceId)(task.id);
         const existing = await db.findById(schema_3.Task, task.id);
         const metadata = this.withXpodMetadata(this.withTaskAuthBindingMetadata(task.metadata, task.authBinding), {
@@ -1709,9 +1664,6 @@ WHERE { ${deletePatterns.join(' ')} }
     }
     async loadTask(taskId, context) {
         const db = await this.getDb(context);
-        if (!db) {
-            throw new Error('Cannot access Pod: invalid credentials');
-        }
         const record = await db.findById(schema_3.Task, taskId);
         if (!record) {
             throw new Error(`Task not found: ${taskId}`);
@@ -1720,9 +1672,6 @@ WHERE { ${deletePatterns.join(' ')} }
     }
     async listTasks(options, context) {
         const db = await this.getDb(context);
-        if (!db) {
-            throw new Error('Cannot access Pod: invalid credentials');
-        }
         const records = await db.select().from(schema_3.Task);
         const dueAt = options.dueAt ?? (0, types_1.nowTimestamp)();
         let tasks = records.map((record) => this.taskRecordToData(record));
@@ -1743,9 +1692,6 @@ WHERE { ${deletePatterns.join(' ')} }
     }
     async saveTaskAuthCredential(input, context) {
         const db = await this.getDb(context);
-        if (!db) {
-            throw new Error('Cannot access Pod: invalid credentials');
-        }
         const values = {
             service: TaskAuthBinding_1.TASK_AUTH_CREDENTIAL_SERVICE,
             status: types_2.CredentialStatus.ACTIVE,
@@ -1774,9 +1720,6 @@ WHERE { ${deletePatterns.join(' ')} }
     }
     async loadTaskAuthCredential(id, context) {
         const db = await this.getDb(context);
-        if (!db) {
-            throw new Error('Cannot access Pod: invalid credentials');
-        }
         const credential = await db.findById(tables_1.Credential, id);
         if (!credential || credential.service !== TaskAuthBinding_1.TASK_AUTH_CREDENTIAL_SERVICE) {
             return undefined;
@@ -2147,9 +2090,6 @@ WHERE { ${deletePatterns.join(' ')} }
     }
     async getAiConfig(context) {
         const db = await this.getDb(context);
-        if (!db) {
-            return undefined;
-        }
         this.ensurePodBaseUrlCache(context, db);
         try {
             try {
@@ -2210,9 +2150,6 @@ WHERE { ${deletePatterns.join(' ')} }
     }
     async getReaderConfig(context, preferredProviderId = 'paddleocr') {
         const db = await this.getDb(context);
-        if (!db) {
-            return undefined;
-        }
         try {
             const [providers, models, credentials] = await Promise.all([
                 db.select().from(provider_1.Provider),
@@ -2233,9 +2170,6 @@ WHERE { ${deletePatterns.join(' ')} }
     }
     async listAvailableModels(context) {
         const db = await this.getDb(context);
-        if (!db) {
-            return [];
-        }
         const config = await this.getAiConfig(context);
         if (!config) {
             return [];
@@ -2306,10 +2240,6 @@ WHERE { ${deletePatterns.join(' ')} }
      */
     async updateCredentialStatus(context, credentialId, status, options) {
         const db = await this.getDb(context);
-        if (!db) {
-            this.logger.debug('Cannot update credential status: no db available');
-            return;
-        }
         try {
             const updateData = { status };
             if (options?.rateLimitResetAt) {
@@ -2334,9 +2264,6 @@ WHERE { ${deletePatterns.join(' ')} }
      */
     async recordCredentialSuccess(context, credentialId) {
         const db = await this.getDb(context);
-        if (!db) {
-            return;
-        }
         try {
             await db.updateById(tables_1.Credential, credentialId, {
                 lastUsedAt: new Date(),

package/dist/api/container/common.js

@@ -17,6 +17,7 @@ const AccountRoleRepository_1 = require("../../identity/drizzle/AccountRoleRepos
 const ServiceTokenRepository_1 = require("../../identity/drizzle/ServiceTokenRepository");
 const LocalSetupServiceTokenRepository_1 = require("../../setup/LocalSetupServiceTokenRepository");
 const SolidTokenAuthenticator_1 = require("../auth/SolidTokenAuthenticator");
+const SolidSessionFactory_1 = require("../auth/SolidSessionFactory");
 const ClientCredentialsAuthenticator_1 = require("../auth/ClientCredentialsAuthenticator");
 const NodeTokenAuthenticator_1 = require("../auth/NodeTokenAuthenticator");
 const ServiceTokenAuthenticator_1 = require("../auth/ServiceTokenAuthenticator");
@@ -29,8 +30,11 @@ const GatewayKeyLocatorCodec_1 = require("../ai-gateway/auth/GatewayKeyLocatorCo
 const PodGatewayAccessKeyRepository_1 = require("../ai-gateway/auth/PodGatewayAccessKeyRepository");
 const OwnerPodAccess_1 = require("../ai-gateway/pod/OwnerPodAccess");
 const HostedPodRoute_1 = require("../ai-gateway/pod/HostedPodRoute");
+const TaskCredentialDatabase_1 = require("../tasks/TaskCredentialDatabase");
+const TaskCredentialStore_1 = require("../tasks/TaskCredentialStore");
 const PodInterfaceKeyRepository_1 = require("../../identity/drizzle/PodInterfaceKeyRepository");
 const PodInterfaceKeyStore_1 = require("../ai-gateway/pod/PodInterfaceKeyStore");
+const PodInterfaceKeyMigration_1 = require("../tasks/PodInterfaceKeyMigration");
 const AiGatewayService_1 = require("../ai-gateway/AiGatewayService");
 const PlaintextCredentialVault_1 = require("../ai-gateway/credentials/PlaintextCredentialVault");
 const AiCredentialSecretDecoder_1 = require("../ai-gateway/credentials/AiCredentialSecretDecoder");
@@ -142,14 +146,47 @@ function registerCommonServices(container) {
                 scopes: ['quota:write', 'usage:read', 'account:manage', 'network:read', 'network:write'],
             });
         }).singleton(),
-        ownerPodAccess: (0, awilix_1.asFunction)(({ config, db }) => {
-            return new OwnerPodAccess_1.OwnerPodAccess({
+        legacyPodKeyMigration: (0, awilix_1.asFunction)(({ config, db, taskCredentialStore }) => {
+            const issuer = config.solidBaseUrl ?? config.publicUrl;
+            if (!taskCredentialStore || !issuer) {
+                return undefined;
+            }
+            return async () => await (0, PodInterfaceKeyMigration_1.migratePodInterfaceKeysToTaskCredentials)({
                 keys: new PodInterfaceKeyStore_1.PodInterfaceKeyStore({
                     repository: new PodInterfaceKeyRepository_1.PodInterfaceKeyRepository(db),
                     vault: credentialVaultForConfig(config),
                 }),
+                taskCredentials: taskCredentialStore,
+                issuer,
+            });
+        }).singleton(),
+        taskCredentialStore: (0, awilix_1.asFunction)(({ config }) => {
+            // No root key means no encrypted store: a credential that cannot be sealed is not kept.
+            const vault = config.secretCellVaultFactory?.();
+            if (!vault) {
+                return undefined;
+            }
+            const url = (0, TaskCredentialDatabase_1.resolveTaskCredentialDatabaseUrl)({
+                identityDatabaseUrl: config.databaseUrl,
+                configuredUrl: config.taskDatabaseUrl,
+            });
+            return new TaskCredentialStore_1.TaskCredentialStore({ database: (0, TaskCredentialDatabase_1.getTaskCredentialDatabase)(url), vault });
+        }).singleton(),
+        solidSessions: (0, awilix_1.asFunction)(({ config }) => {
+            return new SolidSessionFactory_1.SolidSessionFactory({
                 tokenEndpoint: config.cssTokenEndpoint,
                 publicBaseUrl: config.solidBaseUrl,
+            });
+        }).singleton(),
+        ownerPodAccess: (0, awilix_1.asFunction)(({ config, solidSessions, taskCredentialStore }) => {
+            // Background work uses the owner's task-layer grant; a request uses the credential its
+            // caller brought. Nothing is read from a deployment-held key any more.
+            const issuer = config.solidBaseUrl ?? config.publicUrl;
+            return new OwnerPodAccess_1.OwnerPodAccess({
+                sessions: solidSessions,
+                ...(taskCredentialStore && issuer
+                    ? { taskCredentials: (0, TaskCredentialStore_1.createTaskCredentialSource)({ store: taskCredentialStore, issuer }) }
+                    : {}),
                 route: (0, HostedPodRoute_1.resolveHostedPodRoute)({
                     canonicalBaseUrl: config.solidBaseUrl,
                     // API_HOST is the address the runtime bound its services to; XPOD_MAIN_PORT is the
@@ -466,7 +503,7 @@ function registerCommonServices(container) {
                 registry: cradle.gatewayProviderRegistry,
             });
         }).singleton(),
-        authenticator: (0, awilix_1.asFunction)(({ nodeRepo, serviceTokenRepo, invocationTokenCodec, gatewayAccessKeyRepository, config, }) => {
+        authenticator: (0, awilix_1.asFunction)(({ nodeRepo, serviceTokenRepo, invocationTokenCodec, gatewayAccessKeyRepository, solidSessions, config, }) => {
             const solidAuthenticator = new SolidTokenAuthenticator_1.SolidTokenAuthenticator({
                 resolveAccountId: async (webId) => webId,
                 publicBaseUrl: config.solidBaseUrl,
@@ -475,8 +512,7 @@ function registerCommonServices(container) {
                 internalBaseUrl: resolveHostedPodCssBaseUrl(),
             });
             const clientCredAuthenticator = new ClientCredentialsAuthenticator_1.ClientCredentialsAuthenticator({
-                tokenEndpoint: config.cssTokenEndpoint,
-                publicBaseUrl: config.solidBaseUrl,
+                sessions: solidSessions,
             });
             const nodeTokenAuthenticator = new NodeTokenAuthenticator_1.NodeTokenAuthenticator({
                 repository: nodeRepo,
@@ -558,9 +594,15 @@ function registerCommonServices(container) {
         runAuthContextRegistry: (0, awilix_1.asFunction)(() => {
             return new RunAuthContextRegistry_1.RunAuthContextRegistry();
         }).singleton(),
-        taskAuthBindingService: (0, awilix_1.asFunction)(({ chatKitStore }) => {
+        taskAuthBindingService: (0, awilix_1.asFunction)(({ chatKitStore, taskCredentialStore, config }) => {
+            const issuer = config.solidBaseUrl ?? config.publicUrl;
             return new tasks_1.TaskAuthBindingService({
                 repository: chatKitStore,
+                // Unattended runs take their credential from the task layer; the Pod-stored credential
+                // stays the fallback until every binding names a grant.
+                ...(taskCredentialStore && issuer
+                    ? { taskCredentials: (0, TaskCredentialStore_1.createTaskCredentialSource)({ store: taskCredentialStore, issuer }) }
+                    : {}),
             });
         }).singleton(),
         rdfEngine: (0, awilix_1.asFunction)(({ config }) => {

package/dist/api/container/index.d.ts

@@ -5,6 +5,7 @@
  */
 import { type AwilixContainer } from 'awilix';
 import type { ApiContainerCradle, ApiContainerConfig } from './types';
+import { DeploymentRootKeyProvider } from '../../security/secret-cell';
 export type { ApiContainerCradle, ApiContainerConfig } from './types';
 /**
  * 创建 API 容器
@@ -14,3 +15,10 @@ export declare function createApiContainer(config: ApiContainerConfig): AwilixCo
  * 从环境变量读取配置
  */
 export declare function loadConfigFromEnv(): ApiContainerConfig;
+/**
+ * The deployment's root key material, shared by every component that seals secrets at rest.
+ *
+ * Configuration is all-or-nothing: a key id without a key (or the reverse) is a deployment mistake
+ * rather than a reason to fall back to plaintext.
+ */
+export declare function loadDeploymentRootKeyProvider(env: NodeJS.ProcessEnv): DeploymentRootKeyProvider | undefined;

package/dist/api/container/index.js

@@ -30,6 +30,7 @@ var __importStar = (this && this.__importStar) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createApiContainer = createApiContainer;
 exports.loadConfigFromEnv = loadConfigFromEnv;
+exports.loadDeploymentRootKeyProvider = loadDeploymentRootKeyProvider;
 const awilix_1 = require("awilix");
 const node_crypto_1 = require("node:crypto");
 const fs = __importStar(require("node:fs"));
@@ -122,8 +123,15 @@ function loadConfigFromEnv() {
     const nodeToken = process.env.XPOD_NODE_TOKEN ?? localSetupState?.nodeToken;
     const serviceToken = process.env.XPOD_SERVICE_TOKEN ?? localSetupState?.serviceToken;
     const solidBaseUrl = normalizeOptionalUrl(process.env.CSS_BASE_URL);
+    // A remembered issuer that only loopback can serve is residue: nothing in this process listens
+    // there, so adopting it would point every login (and token exchange) at a dead port. Explicit
+    // configuration still wins, including an intentional loopback one.
+    const rememberedIssuer = localSetupState?.cloudIdentityUrl;
+    if (rememberedIssuer && (0, oidc_issuer_1.isLoopbackIssuer)(rememberedIssuer)) {
+        console.warn(`[Local] Ignoring the remembered identity issuer ${rememberedIssuer}: nothing serves it on this machine`);
+    }
     const oidcIssuer = (0, oidc_issuer_1.resolveExternalOidcIssuer)(process.env)
-        ?? localSetupState?.cloudIdentityUrl
+        ?? (rememberedIssuer && !(0, oidc_issuer_1.isLoopbackIssuer)(rememberedIssuer) ? rememberedIssuer : undefined)
         ?? (edition === 'cloud'
             ? solidBaseUrl
             : undefined)
@@ -147,6 +155,7 @@ function loadConfigFromEnv() {
         }
         : undefined;
     const secretCellCredentialVaultFactory = loadSecretCellCredentialVaultFactory(process.env);
+    const deploymentRootKeys = loadDeploymentRootKeyProvider(process.env);
     const openAiGatewayBaseUrl = normalizeOptionalBaseUrl(process.env.XPOD_AI_GATEWAY_OPENAI_BASE_URL);
     const aiClientConfiguration = edition === 'local'
         ? loadAiClientConfiguration(process.env)
@@ -174,6 +183,8 @@ function loadConfigFromEnv() {
         aiGatewaySessionAffinitySecret: process.env.XPOD_AI_GATEWAY_SESSION_AFFINITY_SECRET,
         gatewayAdminProxyAuthSecret: process.env.XPOD_GATEWAY_ADMIN_PROXY_AUTH_SECRET,
         secretCellCredentialVaultFactory,
+        secretCellVaultFactory: deploymentRootKeys ? () => new secret_cell_1.SecretCellVault({ rootKeys: deploymentRootKeys }) : undefined,
+        taskDatabaseUrl: process.env.CSS_TASK_DB_URL,
         aiGatewayConnectSigningSecret: process.env.XPOD_AI_GATEWAY_CONNECT_SIGNING_SECRET,
         aiGatewayKimiOAuthIntegrationId: process.env.XPOD_AI_GATEWAY_KIMI_OAUTH_INTEGRATION_ID,
         aiGatewayKimiOAuthClientId: process.env.XPOD_AI_GATEWAY_KIMI_OAUTH_CLIENT_ID,
@@ -255,6 +266,16 @@ function nonEmptyEnv(value) {
     return trimmed || undefined;
 }
 function loadSecretCellCredentialVaultFactory(env) {
+    const rootKeys = loadDeploymentRootKeyProvider(env);
+    return rootKeys ? () => new SecretCellCredentialVault_1.SecretCellCredentialVault({ vault: new secret_cell_1.SecretCellVault({ rootKeys }) }) : undefined;
+}
+/**
+ * The deployment's root key material, shared by every component that seals secrets at rest.
+ *
+ * Configuration is all-or-nothing: a key id without a key (or the reverse) is a deployment mistake
+ * rather than a reason to fall back to plaintext.
+ */
+function loadDeploymentRootKeyProvider(env) {
     const activeKeyId = env.XPOD_SECRET_CELL_KEY_ID?.trim();
     const activeKey = env.XPOD_SECRET_CELL_KEY;
     const previousKeysJson = env.XPOD_SECRET_CELL_PREVIOUS_KEYS;
@@ -289,11 +310,7 @@ function loadSecretCellCredentialVaultFactory(env) {
             keys[keyId] = (0, secret_cell_1.parseDeploymentRootKeyConfig)(value);
         }
     }
-    return () => new SecretCellCredentialVault_1.SecretCellCredentialVault({
-        vault: new secret_cell_1.SecretCellVault({
-            rootKeys: new secret_cell_1.DeploymentRootKeyProvider({ activeKeyId, keys }),
-        }),
-    });
+    return new secret_cell_1.DeploymentRootKeyProvider({ activeKeyId, keys });
 }
 function assertSecretCellKeyId(value, variable) {
     if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(value)) {

package/dist/api/container/routes.js

@@ -65,6 +65,7 @@ const QuotaHandler_1 = require("../handlers/QuotaHandler");
 const UsageHandler_1 = require("../handlers/UsageHandler");
 const RdfStatsHandler_1 = require("../handlers/RdfStatsHandler");
 const AiGatewayManagementHandler_1 = require("../handlers/AiGatewayManagementHandler");
+const TaskCredentialHandler_1 = require("../handlers/TaskCredentialHandler");
 const AiClientConfigurationHandler_1 = require("../handlers/AiClientConfigurationHandler");
 const DeviceNotificationRuntime_1 = require("../handlers/DeviceNotificationRuntime");
 const AiClientConfigurationService_1 = require("../service/AiClientConfigurationService");
@@ -113,8 +114,9 @@ function registerHealthRoutes(server) {
     (0, DashboardHandler_1.registerDashboardRoutes)(server, { staticDir });
     const settingsStaticDir = path.resolve(runtime_1.PACKAGE_ROOT, 'static/settings');
     (0, SettingsHandler_1.registerSettingsRoutes)(server, { staticDir: settingsStaticDir });
-    const authCallbackStaticDir = path.resolve(runtime_1.PACKAGE_ROOT, 'static/auth-callback');
-    (0, AuthCallbackHandler_1.registerAuthCallbackRoutes)(server, { staticDir: authCallbackStaticDir });
+    // The callback entry is part of the settings build (one browser engine, one asset set), so its
+    // HTML and theme bootstrap are served from the settings directory.
+    (0, AuthCallbackHandler_1.registerAuthCallbackRoutes)(server, { staticDir: settingsStaticDir });
 }
 /**
  * 共享路由 (cloud 和 local 都有)
@@ -196,7 +198,7 @@ function registerSharedRoutes(container, server) {
         providerModelSelectionService,
         customModelsService: providerCustomModelsService,
         gatewayAccessKeyRepository,
-        podInterfaceKeys: ownerPodAccess,
+        invalidateClientCredential: (clientId) => container.resolve('solidSessions').invalidateClientCredential(clientId),
         validateClientCredential: (apiKey) => container.resolve('authenticator').authenticate({
             headers: { authorization: `Bearer ${apiKey}` },
             method: 'POST',
@@ -208,6 +210,15 @@ function registerSharedRoutes(container, server) {
     (0, AiClientConfigurationHandler_1.registerAiClientConfigurationRoutes)(server, {
         service: aiClientConfigurationService,
     });
+    (0, TaskCredentialHandler_1.registerTaskCredentialRoutes)(server, {
+        taskCredentials: container.resolve('taskCredentialStore', { allowUnregistered: true }),
+        clientCredentialIssuer: config.solidBaseUrl ?? config.publicUrl,
+        validateClientCredential: (apiKey) => container.resolve('authenticator').authenticate({
+            headers: { authorization: `Bearer ${apiKey}` },
+            method: 'POST',
+            url: '/api/ai/task-credentials',
+        }),
+    });
     const notificationOrigin = config.publicUrl ?? config.solidBaseUrl ?? process.env.CSS_BASE_URL ?? `http://${config.host === '0.0.0.0' ? '127.0.0.1' : config.host}:${config.port}`;
     (0, DeviceNotificationRuntime_1.registerDeviceNotificationRuntime)(server, {
         origin: notificationOrigin,
@@ -224,7 +235,12 @@ function registerSharedRoutes(container, server) {
     const ftsRebuildAvailable = Boolean(ownerPodAccess && rdfEngine?.indexTextSource);
     const vectorRebuildAvailable = Boolean(ownerPodAccess && rdfSearchIndexingService && chatKitStore.createTrustedContext);
     const rebuildFts = async (owner) => {
-        const trustedFetch = await ownerPodAccess.getPodFetch(owner.webId, { podBaseUrl: owner.podUrl });
+        // Background work uses the owner's task-layer grant: the rebuild is exactly the kind of run
+        // that happens while nobody is watching.
+        const trustedFetch = await ownerPodAccess.getPodFetch(owner.webId, {
+            podBaseUrl: owner.podUrl,
+            taskCredential: { ownerGrant: true },
+        });
         if (!trustedFetch || !rdfEngine?.indexTextSource)
             throw new Error('fts_rebuild_unavailable');
         const result = await new PodSearchIndexRebuilder_1.PodSearchIndexRebuilder({
@@ -237,7 +253,10 @@ function registerSharedRoutes(container, server) {
             throw new Error('fts_rebuild_incomplete');
     };
     const rebuildVector = async (owner) => {
-        const trustedFetch = await ownerPodAccess.getPodFetch(owner.webId, { podBaseUrl: owner.podUrl });
+        const trustedFetch = await ownerPodAccess.getPodFetch(owner.webId, {
+            podBaseUrl: owner.podUrl,
+            taskCredential: { ownerGrant: true },
+        });
         if (!trustedFetch || !rdfSearchIndexingService)
             throw new Error('vector_rebuild_unavailable');
         const context = await chatKitStore.createTrustedContext({ ...owner, fetch: trustedFetch });

package/dist/api/container/types.d.ts

@@ -6,6 +6,10 @@
 import type { ApiServer } from '../ApiServer';
 import type { AuthMiddleware } from '../middleware/AuthMiddleware';
 import type { Authenticator } from '../auth/Authenticator';
+import type { SolidSessionFactory } from '../auth/SolidSessionFactory';
+import type { SecretCellVault } from '../../security/secret-cell';
+import type { TaskCredentialStore } from '../tasks/TaskCredentialStore';
+import type { PodInterfaceKeyMigrationResult } from '../tasks/PodInterfaceKeyMigration';
 import type { EdgeNodeRepository } from '../../identity/drizzle/EdgeNodeRepository';
 import type { ServiceTokenRepositoryPort } from '../../identity/drizzle/ServiceTokenRepository';
 import type { VercelChatService } from '../service/VercelChatService';
@@ -78,6 +82,17 @@ export interface ApiContainerConfig {
     databaseUrl: string;
     /** RDF/SPARQL facts database connection URL. */
     sparqlEndpoint?: string;
+    /**
+     * Where the task layer keeps its own credentials. Defaults to a sibling of the identity
+     * database, so the two stores are separate files in local mode.
+     */
+    taskDatabaseUrl?: string;
+    /**
+     * Deployment root key material for secrets that must be encrypted at rest (task credentials).
+     * Absent means the deployment configured no key, and those features report themselves unconfigured
+     * instead of falling back to plaintext.
+     */
+    secretCellVaultFactory?: () => SecretCellVault;
     /** Route SPARQL reads through an installed native SPARQL provider. */
     rdfNativeSparqlEnabled?: boolean;
     /** Redis connection URL, used by embedded infrastructure such as Inngest in cloud mode. */
@@ -204,7 +219,24 @@ export interface ApiContainerCradle {
     authenticator: Authenticator;
     nodeRepo: EdgeNodeRepository;
     serviceTokenRepo: ServiceTokenRepositoryPort;
+    /**
+     * Exchanges Solid client credentials for tokens, once per credential.
+     *
+     * Shared by inbound authentication and outbound Pod access so one credential yields one
+     * exchange and keeps the key its token is bound to.
+     */
+    solidSessions: SolidSessionFactory;
     ownerPodAccess: OwnerPodAccess;
+    /**
+     * The task layer's credential store. Present only when the deployment has root key material:
+     * a credential that cannot be encrypted is not stored at all.
+     */
+    taskCredentialStore?: TaskCredentialStore;
+    /**
+     * Moves rows out of the API-side owner-key table into the task layer. Defined only when the task
+     * layer can store them; safe to call on every boot.
+     */
+    legacyPodKeyMigration?: () => Promise<PodInterfaceKeyMigrationResult>;
     invocationTokenCodec?: InvocationTokenCodec;
     gatewayAccessKeyRepository?: GatewayAccessKeyRepository;
     aiConnectionInvocationKeyIssuer?: AiConnectionsInvocationKeyIssuer;

package/dist/api/handlers/AiGatewayManagementHandler.d.ts

@@ -6,7 +6,6 @@ import type { ProviderConnectService } from '../ai-gateway/connect';
 import type { ProviderModelSelectionService } from '../ai-gateway/models/ProviderModelSelectionService';
 import type { ProviderQuotaService } from '../ai-gateway/quota';
 import { type ProviderCustomModelsService, type ProviderModelsService } from '../ai-gateway/models';
-import type { PodInterfaceKeyGrant } from '../ai-gateway/pod/PodInterfaceKeyStore';
 import type { AiConnectionsInvocationKeyIssuer } from '../ai-gateway/auth/AiConnectionsInvocationKeyIssuer';
 import { type AiClientConfigurationCapabilityDescriptor } from '../service/AiClientConfigurationService';
 export interface AiGatewayManagementHandlerOptions {
@@ -27,10 +26,11 @@ export interface AiGatewayManagementHandlerOptions {
     /** Reuses the configured CSS authenticator; never trusts the claimed registration owner. */
     validateClientCredential?: (apiKey: string) => Promise<AuthResult>;
     /**
-     * Server-side Pod access for the owner. The wrapper being registered is the owner's own
-     * interface key, so registering it is also the moment Xpod is granted its use.
+     * Forget sessions cached for a client whose registration is gone. Revocation happens at the
+     * issuer, so deleting the record is the moment this process learns the credential must stop
+     * being accepted - without it a revoked API Key keeps working until its token expires.
      */
-    podInterfaceKeys?: PodInterfaceKeyGrant;
+    invalidateClientCredential?: (clientId: string) => void;
     aiClientConfiguration?: AiClientConfigurationCapabilityDescriptor;
     aiConnectionInvocationKeyIssuer?: Pick<AiConnectionsInvocationKeyIssuer, 'issue' | 'issueClientConfiguration'>;
     jsonBodyLimitBytes?: number;