@undefineds.co/xpod 0.4.20 → 0.4.25

package/dist/api/ai-gateway/connect/index.js

@@ -33,6 +33,57 @@ class PodConnectedCredentialRepository {
         this.credentialTemplate = (0, drizzle_solid_1.alias)(models_1.credentialResource, 'credentialTemplate');
         this.aiProviderTemplate = (0, drizzle_solid_1.alias)(models_1.aiProviderResource, 'aiProviderTemplate');
     }
+    async recordSuccess(input) {
+        await this.recordHealth(input, true);
+    }
+    async recordFailure(input) {
+        await this.recordHealth(input, false);
+    }
+    async recordHealth(input, success) {
+        const { db, credential } = await this.dbForOwner(input.webId, input.auth);
+        const key = JSON.stringify([input.webId, input.credentialId]);
+        const previous = credentialUpdateLocks.get(key) ?? Promise.resolve();
+        let release;
+        const pending = new Promise((resolve) => { release = resolve; });
+        credentialUpdateLocks.set(key, pending);
+        await previous;
+        try {
+            const row = await db.findById(credential, input.credentialId);
+            if (!row)
+                return;
+            const current = recordFromCredentialRow(row);
+            // A late request for an old secret must not invalidate its replacement.
+            if (current.webId !== input.webId || current.credentialIri !== input.credentialIri
+                || current.status !== 'active'
+                || (input.expectedVersion !== undefined && input.expectedVersion !== current.version))
+                return;
+            const occurredAt = input.occurredAt ?? new Date();
+            if (Math.max(current.lastFailureAt?.getTime() ?? 0, current.lastUsedAt?.getTime() ?? 0) > occurredAt.getTime())
+                return;
+            const classifications = ['authentication', 'login_expired', 'quota_exhausted', 'authorization', 'rate_limited', 'upstream_unavailable', 'provider_error'];
+            const suppliedCode = input.failureCode ?? 'provider_error';
+            const failureCode = suppliedCode === 'authentication' && current.authMode === 'deviceCodeOAuth'
+                ? 'login_expired' : classifications.includes(suppliedCode) ? suppliedCode : 'provider_error';
+            const authenticationFailed = failureCode === 'authentication' || failureCode === 'login_expired';
+            const health = success ? 'healthy' : authenticationFailed
+                ? current.authMode === 'deviceCodeOAuth' ? 'reauthRequired' : 'invalid'
+                : current.health ?? 'healthy';
+            await db.updateById(credential, input.credentialId, {
+                failCount: success ? 0 : (current.failCount ?? 0) + 1,
+                lastFailureCode: success ? null : failureCode,
+                lastFailureAt: success ? null : occurredAt,
+                rateLimitResetAt: !success && failureCode === 'rate_limited' ? input.rateLimitResetAt ?? null : null,
+                ...(success ? { lastUsedAt: occurredAt, reauthRequired: false } :
+                    failureCode === 'login_expired' ? { reauthRequired: true } : {}),
+                metadata: { ...current.metadata, health },
+            });
+        }
+        finally {
+            release();
+            if (credentialUpdateLocks.get(key) === pending)
+                credentialUpdateLocks.delete(key);
+        }
+    }
     async getCredential(input) {
         const rows = await this.listProviderCredentials(input);
         const requestedId = models_1.aiRuntimeRepository.credentialId(input);
@@ -80,7 +131,8 @@ class PodConnectedCredentialRepository {
                 defaultModel: defaultModelFromMetadata(record.metadata),
                 priority: record.priority ?? 100,
                 health: record.health ?? (record.reauthRequired ? 'reauthRequired' : 'healthy'),
-                quota: { status: 'available' },
+                quota: { status: record.lastFailureCode === 'quota_exhausted' ? 'exhausted' : 'available' },
+                cooldownUntil: record.rateLimitResetAt,
                 encryptedSecret: record.encryptedSecret,
                 version: record.version,
                 runtimeCredential: runtimeCredentialFromMetadata({ ...record.metadata, offeringId }),
@@ -153,6 +205,12 @@ class PodConnectedCredentialRepository {
             deployment: input.deployment,
             version: currentVersion + 1,
         };
+        if (input.patch.health === 'healthy') {
+            merged.lastFailureCode = undefined;
+            merged.lastFailureAt = undefined;
+            merged.rateLimitResetAt = undefined;
+            merged.failCount = 0;
+        }
         if (merged.status === 'revoked' && input.patch.enabled === undefined) {
             merged.enabled = false;
         }
@@ -603,10 +661,10 @@ class BrowserAssistedApiKeyConnectAdapter extends SignedConnectAttemptAdapterBas
     }
     async begin(input) {
         this.assertInput(input, 'browserAssistedApiKey');
+        const url = new URL(typeof this.consoleUrl === 'function' ? this.consoleUrl(input) : this.consoleUrl);
         const now = this.now();
         const expiresAt = new Date(now.getTime() + 5 * 60 * 1000);
         const attempt = await this.createAttempt(input, expiresAt);
-        const url = new URL(this.consoleUrl);
         url.searchParams.set('xpod_connect_attempt', attempt.id);
         url.searchParams.set('xpod_provider', this.provider);
         return {
@@ -2198,6 +2256,10 @@ function publicPoolCredentialSummary(record) {
         baseUrl: stringMetadata(metadata, 'baseUrl'),
         proxyUrl: (0, provider_http_transport_1.redactProviderProxyUrl)(record.proxyUrl ?? stringMetadata(metadata, 'proxyUrl')),
         expiresAt: record.expiresAt?.toISOString(),
+        lastFailureCode: record.lastFailureCode,
+        lastFailureAt: record.lastFailureAt?.toISOString(),
+        rateLimitResetAt: record.rateLimitResetAt?.toISOString(),
+        failCount: record.failCount,
         version: record.version ?? 0,
         quota: metadata.quota ?? metadata.quotaStatus,
     });
@@ -2495,6 +2557,11 @@ function credentialRowFromRecord(record) {
         accountLabel: record.accountLabel,
         label: record.accountLabel,
         reauthRequired: record.reauthRequired ?? false,
+        failCount: record.failCount ?? 0,
+        rateLimitResetAt: record.rateLimitResetAt ?? null,
+        lastFailureCode: record.lastFailureCode ?? null,
+        lastFailureAt: record.lastFailureAt ?? null,
+        lastUsedAt: record.lastUsedAt,
         proxyUrl: (0, provider_http_transport_1.normalizeProviderProxyUrl)(record.proxyUrl ?? stringMetadata(metadata, 'proxyUrl')),
         lastRefreshAt: new Date(),
         metadata,
@@ -2532,6 +2599,11 @@ function recordFromCredentialRow(row) {
         status,
         accountLabel: stringFrom(row.accountLabel) || stringFrom(row.label) || undefined,
         expiresAt: dateFrom(row.expiresAt),
+        failCount: typeof row.failCount === 'number' ? row.failCount : 0,
+        rateLimitResetAt: dateFrom(row.rateLimitResetAt),
+        lastFailureCode: stringFrom(row.lastFailureCode) || undefined,
+        lastFailureAt: dateFrom(row.lastFailureAt),
+        lastUsedAt: dateFrom(row.lastUsedAt),
         scopes: Array.isArray(row.scopes) ? row.scopes.map(String) : undefined,
         version: versionFromRow(row),
         reauthRequired,
@@ -3210,17 +3282,11 @@ function oneTimeOAuthCredential(body, now, expectedVersion, integration, fallbac
     };
 }
 function safeProviderError(body) {
-    const code = stringFrom(body.error);
-    if (SAFE_PROVIDER_ERROR_CODES.has(code)) {
-        return code;
-    }
-    if (!code) {
-        return 'provider_error';
-    }
-    if (code.endsWith('_error')) {
-        return 'provider_error';
-    }
-    return 'provider_error';
+    const error = body.error;
+    const code = stringFrom(error && typeof error === 'object' && !Array.isArray(error)
+        ? error.code
+        : error);
+    return SAFE_PROVIDER_ERROR_CODES.has(code) ? code : 'provider_error';
 }
 const SAFE_PROVIDER_ERROR_CODES = new Set([
     'authorization_pending',
@@ -3228,6 +3294,7 @@ const SAFE_PROVIDER_ERROR_CODES = new Set([
     'expired_token',
     'access_denied',
     'invalid_grant',
+    'invalid_token',
     'invalid_client',
 ]);
 function pendingResult(input, status, intervalSeconds, provider = normalizeProvider(input.provider), offeringId = input.offeringId) {

package/dist/api/ai-gateway/pod/HostedPodRoute.d.ts

@@ -25,10 +25,3 @@ export declare function resolveHostedPodRoute(input: {
  * request stays bound to the URL the caller named.
  */
 export declare function createHostedPodRouteTransport(transport: typeof fetch, route: HostedPodRoute | undefined): Promise<typeof fetch>;
-/**
- * Compiled single-file runtimes unpack their packages into a cache directory and resolve that
- * archive themselves, so a bare specifier is not part of their module map: the import fails with
- * `Cannot find module` and the AI gateway answers 500. The extracted package is a real file, so
- * load it through its own URL when the specifier cannot be resolved.
- */
-export declare function resolveStagedLocalRouteFetch(): string | undefined;

package/dist/api/ai-gateway/pod/HostedPodRoute.js

@@ -1,34 +1,7 @@
 "use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || function (mod) {
-    if (mod && mod.__esModule) return mod;
-    var result = {};
-    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
-    __setModuleDefault(result, mod);
-    return result;
-};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.resolveHostedPodRoute = resolveHostedPodRoute;
 exports.createHostedPodRouteTransport = createHostedPodRouteTransport;
-exports.resolveStagedLocalRouteFetch = resolveStagedLocalRouteFetch;
-const node_fs_1 = require("node:fs");
-const path = __importStar(require("node:path"));
-const node_url_1 = require("node:url");
 const bootstrap_1 = require("../../../runtime/bootstrap");
 /**
  * The route that reaches this deployment's hosted Pods from inside the API sidecar.
@@ -66,49 +39,8 @@ async function createHostedPodRouteTransport(transport, route) {
     return createSolidLocalRouteFetch({ fetch: transport, routes: () => [route] });
 }
 async function importSolidLocalRouteFetch() {
-    // The API runtime is CommonJS while solid-sdk is intentionally ESM-only. Keep the package
-    // boundary and load the SDK without TypeScript lowering import() to require().
-    const dynamicImport = new Function('specifier', 'return import(specifier)');
-    const specifier = '@undefineds.co/solid-sdk/local-route-fetch';
-    try {
-        return await dynamicImport(specifier);
-    }
-    catch (error) {
-        const staged = resolveStagedLocalRouteFetch();
-        if (!staged)
-            throw error;
-        return dynamicImport(staged);
-    }
-}
-/**
- * Compiled single-file runtimes unpack their packages into a cache directory and resolve that
- * archive themselves, so a bare specifier is not part of their module map: the import fails with
- * `Cannot find module` and the AI gateway answers 500. The extracted package is a real file, so
- * load it through its own URL when the specifier cannot be resolved.
- */
-function resolveStagedLocalRouteFetch() {
-    const cacheRoot = process.env.XPOD_BUN_SINGLE_CACHE_DIR?.trim();
-    if (!cacheRoot)
-        return undefined;
-    const relative = path.join('node_modules', '@undefineds.co', 'solid-sdk', 'dist', 'local-route-fetch.js');
-    const candidates = [path.join(cacheRoot, relative)];
-    try {
-        for (const entry of (0, node_fs_1.readdirSync)(cacheRoot)) {
-            candidates.push(path.join(cacheRoot, entry, relative));
-        }
-    }
-    catch {
-        // A missing or unreadable cache root just means there is nothing to fall back to.
-    }
-    for (const candidate of candidates) {
-        try {
-            if ((0, node_fs_1.statSync)(candidate).isFile())
-                return (0, node_url_1.pathToFileURL)(candidate).href;
-        }
-        catch {
-            continue;
-        }
-    }
-    return undefined;
+    // The public CommonJS entry also lets the single-file bundler include this exact SDK
+    // version. Module resolution and initialization failures must retain their original cause.
+    return require('@undefineds.co/solid-sdk/local-route-fetch');
 }
 //# sourceMappingURL=HostedPodRoute.js.map

package/dist/api/ai-gateway/pod/OwnerPodAccess.d.ts

@@ -97,7 +97,6 @@ export declare class OwnerPodAccess implements PodAccessFetchProvider {
      */
     private taskCredentialFetch;
     private credentialFetch;
-    private invalidateOnUnauthorized;
 }
 /**
  * Reason an owner's Pod is out of reach, as a stable code the caller and the UI can act on.

package/dist/api/ai-gateway/pod/OwnerPodAccess.js

@@ -69,37 +69,77 @@ class OwnerPodAccess {
         if (!credential) {
             return undefined;
         }
-        return await this.credentialFetch(owner, credential);
+        const sessionCredential = { ...credential, version: String(credential.version) };
+        return await this.credentialFetch(owner, sessionCredential, async () => {
+            const current = await this.taskCredentials.forRef({
+                credentialRef: credential.credentialRef,
+                ownerWebId: owner,
+                version: credential.version,
+            });
+            if (!current || current.credentialRef !== credential.credentialRef || current.version !== credential.version
+                || current.clientId !== credential.clientId || current.clientSecret !== credential.clientSecret) {
+                this.sessions.invalidate(sessionCredential);
+                throw new Error(`${exports.POD_INTERFACE_KEY_REJECTED}:task_grant_unusable`);
+            }
+        });
     }
-    async credentialFetch(owner, credential) {
-        let session;
-        try {
-            session = await this.sessions.session(credential);
-        }
-        catch (error) {
-            const status = error instanceof SolidSessionFactory_1.SolidSessionError ? error.status : undefined;
-            this.logger.warn(`Pod interface key refused for ${owner}: ${String(error)}`);
-            throw new Error(`${exports.POD_INTERFACE_KEY_REJECTED}:${status ?? 'invalid_response'}`);
-        }
+    async credentialFetch(owner, credential, assertAuthorized) {
+        const currentSession = async () => {
+            try {
+                const session = await this.sessions.session(credential);
+                if (!sameWebIdOwner(session.webId, owner)) {
+                    this.sessions.invalidate(credential, session);
+                    throw new SolidSessionFactory_1.SolidSessionError('token_owner_mismatch');
+                }
+                return session;
+            }
+            catch (error) {
+                const status = error instanceof SolidSessionFactory_1.SolidSessionError ? error.status : undefined;
+                this.logger.warn(`Pod interface key refused for ${owner}: ${String(error)}`);
+                throw new Error(`${exports.POD_INTERFACE_KEY_REJECTED}:${status ?? 'invalid_response'}`);
+            }
+        };
+        // Preserve immediate credential validation at getPodFetch, then check again per request.
+        let session = await currentSession();
         const transport = await (this.transport ??= (0, HostedPodRoute_1.createHostedPodRouteTransport)(this.fetchImpl, this.route));
-        const authenticated = (0, solid_client_authn_core_1.buildAuthenticatedFetch)(session.accessToken, {
-            ...(session.dpopKey ? { dpopKey: session.dpopKey } : {}),
+        const authenticatedFor = (value) => (0, solid_client_authn_core_1.buildAuthenticatedFetch)(value.accessToken, {
+            ...(value.dpopKey ? { dpopKey: value.dpopKey } : {}),
             fetch: transport,
         });
-        return this.invalidateOnUnauthorized(credential, authenticated);
-    }
-    invalidateOnUnauthorized(credential, podFetch) {
+        let authenticated = authenticatedFor(session);
         return async (input, init) => {
-            const response = await podFetch(input, init);
+            await assertAuthorized?.();
+            const requestSession = await currentSession();
+            // Recheck a task grant after a possibly slow exchange, before dispatching its token.
+            await assertAuthorized?.();
+            if (session !== requestSession) {
+                session = requestSession;
+                authenticated = authenticatedFor(session);
+            }
+            const response = await authenticated(input, init);
             if (response.status === 401) {
-                // The token stopped being accepted; the next request exchanges the key again.
-                this.sessions.invalidate(credential);
+                // Return the original rejection; writes are never replayed to try another token.
+                this.sessions.invalidate(credential, requestSession);
             }
             return response;
         };
     }
 }
 exports.OwnerPodAccess = OwnerPodAccess;
+/**
+ * Whether an exchanged token names the owner it was requested for.
+ *
+ * A WebID is a full URI, so identity is the exact URI, fragment included: two fragments on the
+ * same document (`#alice` and `#bob`) are different principals, and a fragmentless document is a
+ * different URI from its `#me` principal. The token must name exactly the owner that was asked for.
+ * Any normalization belongs at the authoritative claim/provisioning/fixture source, never here.
+ */
+function sameWebIdOwner(sessionWebId, owner) {
+    if (!sessionWebId) {
+        return true;
+    }
+    return sessionWebId === owner;
+}
 /**
  * Reason an owner's Pod is out of reach, as a stable code the caller and the UI can act on.
  *

package/dist/api/ai-gateway/providers/AnthropicRuntimeAdapter.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AnthropicRuntimeAdapter = void 0;
+const InvocationMetadata_1 = require("../InvocationMetadata");
 const ProviderRuntimeAdapter_1 = require("./ProviderRuntimeAdapter");
 const ANTHROPIC_BASE_URL = 'https://api.anthropic.com/v1';
 const ANTHROPIC_VERSION = '2023-06-01';
@@ -20,6 +21,7 @@ class AnthropicRuntimeAdapter extends ProviderRuntimeAdapter_1.BaseProviderRunti
             allowCredentialBaseUrl: this.allowCredentialBaseUrl,
         });
         const headers = new Headers({
+            ...(0, InvocationMetadata_1.gatewayInvocationHeaders)(input.invocationMetadata),
             'x-api-key': input.apiKey,
             'anthropic-version': ANTHROPIC_VERSION,
         });

package/dist/api/ai-gateway/providers/BailianRuntimeAdapter.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.BailianRuntimeAdapter = void 0;
+const InvocationMetadata_1 = require("../InvocationMetadata");
 const errors_1 = require("../errors");
 const ProviderRuntimeAdapter_1 = require("./ProviderRuntimeAdapter");
 const ProviderRegistry_1 = require("./ProviderRegistry");
@@ -47,6 +48,7 @@ class BailianRuntimeAdapter extends ProviderRuntimeAdapter_1.BaseProviderRuntime
             yield* (0, ProviderRuntimeAdapter_1.parseCompatibleChatSse)(this.transport.postSse({
                 url: `${baseUrl}/chat/completions`,
                 apiKey: input.apiKey,
+                headers: (0, InvocationMetadata_1.gatewayInvocationHeaders)(input.invocationMetadata),
                 body: (0, ProviderRuntimeAdapter_1.toChatCompletionsBody)(input.request, {
                     reasoningEffort: input.request.reasoning?.effort,
                 }),
@@ -68,6 +70,7 @@ class BailianRuntimeAdapter extends ProviderRuntimeAdapter_1.BaseProviderRuntime
             yield* (0, ProviderRuntimeAdapter_1.parseCompatibleChatSse)(this.transport.postSse({
                 url: `${baseUrl}/chat/completions`,
                 apiKey: input.apiKey,
+                headers: (0, InvocationMetadata_1.gatewayInvocationHeaders)(input.invocationMetadata),
                 body: (0, ProviderRuntimeAdapter_1.toChatCompletionsBody)(input.request, {
                     reasoningEffort: input.request.reasoning?.effort,
                 }),
@@ -107,6 +110,7 @@ class BailianRuntimeAdapter extends ProviderRuntimeAdapter_1.BaseProviderRuntime
             safeBaseUrls: [BAILIAN_CODING_PLAN_BASE_URL],
         });
         const headers = new Headers({
+            ...(0, InvocationMetadata_1.gatewayInvocationHeaders)(input.invocationMetadata),
             'x-api-key': input.apiKey,
         });
         try {

package/dist/api/ai-gateway/providers/OpenAiRuntimeAdapter.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.OpenAiRuntimeAdapter = void 0;
+const InvocationMetadata_1 = require("../InvocationMetadata");
 const ProviderRuntimeAdapter_1 = require("./ProviderRuntimeAdapter");
 const ProviderRegistry_1 = require("./ProviderRegistry");
 const OPENAI_BASE_URL = 'https://api.openai.com/v1';
@@ -21,7 +22,7 @@ class OpenAiRuntimeAdapter extends ProviderRuntimeAdapter_1.BaseProviderRuntimeA
             safeBaseUrls: subscription ? [...this.safeBaseUrls, ProviderRegistry_1.OPENAI_SUBSCRIPTION_BASE_URL] : this.safeBaseUrls,
         });
         try {
-            const headers = new Headers();
+            const headers = new Headers((0, InvocationMetadata_1.gatewayInvocationHeaders)(input.invocationMetadata));
             if (subscription) {
                 const accountId = input.credential?.metadata?.accountId;
                 if (typeof accountId === 'string' && accountId) {

package/dist/api/ai-gateway/providers/ProviderRegistry.d.ts

@@ -1,6 +1,6 @@
 import type { GatewayProtocol } from '../types';
 import { type OfferingAuthorizationMethod } from './OfferingAuthorization';
-export declare const OPENAI_SUBSCRIPTION_BASE_URL = "https://chatgpt.com/backend-api/codex";
+export declare const OPENAI_SUBSCRIPTION_BASE_URL: string;
 export type ProviderId = 'openai' | 'anthropic' | 'kimi' | 'bailian' | 'deepseek' | string;
 export type ProviderProductId = 'openai' | 'anthropic' | 'kimi' | 'bailian' | 'deepseek' | string;
 export type ProviderAuthMode = 'browserAssistedApiKey' | 'authorizationCodeOAuth' | 'deviceCodeOAuth' | 'apiKey' | 'local' | 'connectUnsupported';
@@ -239,13 +239,7 @@ export declare function offeringDeclaresUpstreamCapability(product: string, offe
     protocol: string;
     profile?: string;
 }, credentialAuthMode?: string): boolean;
-/**
- * The provider/offering catalog belongs to `@undefineds.co/ai-connections`: it
- * is content rather than schema, and it carries endpoints, console links and
- * authorization actions that a property-definition package must not own. The
- * descriptors above are the pre-existing copy that is being replaced by that
- * shared catalog; only runtime capability descriptors stay server-side.
- */
+/** Project capability-owned product content; only upstream implementation choices stay here. */
 export declare const DEFAULT_PROVIDER_PRODUCT_DESCRIPTORS: ProviderProductDescriptor[];
 export declare const DEFAULT_PROVIDER_DESCRIPTORS: ProviderDescriptor[];
 export declare function normalizeProviderId(provider: string): string;