@undefineds.co/xpod 0.4.20 → 0.4.27

package/node_modules/@undefineds.co/extensions/dist-cjs/paddleocr.js

@@ -0,0 +1,304 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PADDLEOCR_DEFAULT_ENDPOINT = void 0;
+exports.createPaddleOcrReader = createPaddleOcrReader;
+exports.createPaddleOcrExtension = createPaddleOcrExtension;
+const reader_js_1 = require("./reader.js");
+exports.PADDLEOCR_DEFAULT_ENDPOINT = 'https://paddleocr.aistudio-app.com/api/v2/ocr/jobs';
+function createPaddleOcrReader(options) {
+    const id = options.id ?? 'paddleocr';
+    const model = options.model ?? 'PP-OCRv6';
+    return {
+        id,
+        displayName: options.displayName ?? 'PaddleOCR Reader',
+        outputs: ['markdown', 'text', 'structured'],
+        transports: ['remote-http'],
+        supportedSourceSchemes: ['https', 'http', 'file'],
+        supportedMimeTypes: ['application/pdf', 'image/png', 'image/jpeg', 'image/webp', 'image/tiff'],
+        read: async (request, ctx) => {
+            const fetcher = options.fetch ?? globalThis.fetch;
+            if (!fetcher) {
+                throw new reader_js_1.ReaderError('No fetch implementation is available for PaddleOCR reader.', {
+                    code: 'INVALID_INPUT',
+                    retryable: false,
+                });
+            }
+            const payload = await createPaddlePayload(request, model, options.defaultOptions);
+            const response = await fetcher(resolvePaddleEndpoint(options), {
+                method: 'POST',
+                headers: createHeaders(options.apiKey),
+                body: JSON.stringify(payload),
+                signal: ctx.signal,
+            });
+            const body = await readJsonResponse(response);
+            if (!response.ok) {
+                throw new reader_js_1.ReaderError(`PaddleOCR request failed with HTTP ${response.status}.`, {
+                    code: response.status >= 500 || response.status === 429 ? 'PROVIDER_UNAVAILABLE' : 'PROVIDER_REJECTED',
+                    status: response.status,
+                    retryable: response.status >= 500 || response.status === 429,
+                    cause: body,
+                });
+            }
+            return paddleResponseToReadResult(id, model, request, body);
+        },
+    };
+}
+function createPaddleOcrExtension(options) {
+    return (api) => {
+        const reader = createPaddleOcrReader(options);
+        api.reader.register(reader);
+        api.config.registerSchema({
+            id: reader.id,
+            fields: [
+                { name: 'apiKey', type: 'secret', required: true, description: 'Bearer token for the PaddleOCR provider.' },
+                { name: 'model', type: 'string', required: false, description: 'PaddleOCR model or pipeline name.' },
+            ],
+        });
+        api.runtime.registerCapability({
+            id: `${reader.id}-remote-http`,
+            kind: 'remote-http',
+            readerIds: [reader.id],
+            sourceSchemes: ['https', 'http', 'file'],
+        });
+    };
+}
+function resolvePaddleEndpoint(options) {
+    return options.endpoint?.trim() || exports.PADDLEOCR_DEFAULT_ENDPOINT;
+}
+async function createPaddlePayload(request, model, defaultOptions) {
+    const input = request.input ?? sourceToInput(request.source);
+    const file = await inputToPaddleFile(input);
+    return {
+        ...defaultOptions,
+        ...request.options,
+        file,
+        fileType: inferPaddleFileType(input.mimeType ?? input.filename ?? request.source),
+        fileName: input.filename ?? filenameFromUri(request.source),
+        pageRange: request.pages,
+        model: request.model ?? model,
+    };
+}
+function sourceToInput(source) {
+    if (/^https?:\/\//u.test(source)) {
+        return {
+            kind: 'remote-url',
+            url: source,
+            filename: filenameFromUri(source),
+            mimeType: inferMimeType(source),
+        };
+    }
+    if (source.startsWith('file://')) {
+        return {
+            kind: 'local-path',
+            path: decodeURIComponent(source.slice('file://'.length)),
+            filename: filenameFromUri(source),
+            mimeType: inferMimeType(source),
+        };
+    }
+    throw new reader_js_1.ReaderError(`Unsupported PaddleOCR source URI: ${source}`, {
+        code: 'UNSUPPORTED_SOURCE',
+        retryable: false,
+    });
+}
+async function inputToPaddleFile(input) {
+    switch (input.kind) {
+        case 'remote-url':
+            return input.url;
+        case 'bytes':
+            return bytesToBase64(input.bytes);
+        case 'local-path': {
+            const fs = await Promise.resolve().then(() => __importStar(require('node:fs/promises')));
+            return bytesToBase64(await fs.readFile(input.path));
+        }
+        case 'stream':
+            return bytesToBase64(await streamToBytes(input.stream));
+    }
+}
+function createHeaders(apiKey) {
+    const headers = {
+        'Content-Type': 'application/json',
+    };
+    if (apiKey) {
+        headers.Authorization = `Bearer ${apiKey}`;
+    }
+    return headers;
+}
+async function readJsonResponse(response) {
+    const text = await response.text();
+    if (!text) {
+        return {};
+    }
+    try {
+        return JSON.parse(text);
+    }
+    catch (error) {
+        throw new reader_js_1.ReaderError('PaddleOCR returned a non-JSON response.', {
+            code: 'PARSE_FAILED',
+            status: response.status,
+            retryable: response.status >= 500,
+            cause: error,
+        });
+    }
+}
+function paddleResponseToReadResult(readerId, model, request, body) {
+    const entries = extractPaddleEntries(body);
+    const documents = entries.map((entry, index) => paddleEntryToDocument(entry, index, request, model));
+    const markdown = documents.map((document) => document.text).filter(Boolean).join('\n\n');
+    return {
+        reader: readerId,
+        model: request.model ?? model,
+        documents,
+        markdown,
+        text: markdown,
+        raw: body,
+    };
+}
+function extractPaddleEntries(body) {
+    if (!isRecord(body)) {
+        return [];
+    }
+    const candidates = [
+        body.result,
+        body.data,
+        body,
+    ];
+    for (const candidate of candidates) {
+        if (isRecord(candidate) && Array.isArray(candidate.layoutParsingResults)) {
+            return candidate.layoutParsingResults;
+        }
+        if (isRecord(candidate) && Array.isArray(candidate.results)) {
+            return candidate.results;
+        }
+    }
+    return [body];
+}
+function paddleEntryToDocument(entry, index, request, model) {
+    const record = isRecord(entry) ? entry : {};
+    const markdown = isRecord(record.markdown) ? record.markdown : undefined;
+    const text = firstString([
+        markdown?.text,
+        record.markdown,
+        record.text,
+        record.content,
+    ]);
+    const page = firstNumber([
+        record.page,
+        record.pageId,
+        record.pageIndex,
+        record.page_number,
+    ]);
+    return {
+        id: `${request.source}#paddleocr-${index + 1}`,
+        text,
+        metadata: {
+            sourceUri: request.source,
+            page,
+            model: request.model ?? model,
+        },
+        sourceUri: request.source,
+        raw: entry,
+    };
+}
+function firstString(values) {
+    for (const value of values) {
+        if (typeof value === 'string') {
+            return value;
+        }
+    }
+    return '';
+}
+function firstNumber(values) {
+    for (const value of values) {
+        if (typeof value === 'number') {
+            return value;
+        }
+    }
+    return undefined;
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null;
+}
+function inferPaddleFileType(value) {
+    const normalized = value?.toLowerCase() ?? '';
+    if (normalized.includes('pdf') || normalized.endsWith('.pdf')) {
+        return 0;
+    }
+    return 1;
+}
+function inferMimeType(uri) {
+    const clean = uri.split(/[?#]/u)[0]?.toLowerCase() ?? '';
+    if (clean.endsWith('.pdf'))
+        return 'application/pdf';
+    if (clean.endsWith('.png'))
+        return 'image/png';
+    if (clean.endsWith('.jpg') || clean.endsWith('.jpeg'))
+        return 'image/jpeg';
+    if (clean.endsWith('.webp'))
+        return 'image/webp';
+    if (clean.endsWith('.tiff') || clean.endsWith('.tif'))
+        return 'image/tiff';
+    return undefined;
+}
+function filenameFromUri(uri) {
+    const clean = uri.split(/[?#]/u)[0] ?? '';
+    const filename = clean.split('/').filter(Boolean).at(-1);
+    return filename ? decodeURIComponent(filename) : undefined;
+}
+function bytesToBase64(bytes) {
+    return Buffer.from(bytes).toString('base64');
+}
+async function streamToBytes(stream) {
+    const reader = stream.getReader();
+    const chunks = [];
+    let total = 0;
+    while (true) {
+        const { done, value } = await reader.read();
+        if (done) {
+            break;
+        }
+        if (value) {
+            chunks.push(value);
+            total += value.byteLength;
+        }
+    }
+    const result = new Uint8Array(total);
+    let offset = 0;
+    for (const chunk of chunks) {
+        result.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    return result;
+}

package/node_modules/@undefineds.co/extensions/dist-cjs/reader.js

@@ -0,0 +1,44 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ReaderError = void 0;
+exports.readResultText = readResultText;
+exports.mergeDocumentMetadata = mergeDocumentMetadata;
+class ReaderError extends Error {
+    name = 'ReaderError';
+    code;
+    status;
+    retryable;
+    constructor(message, options) {
+        super(message, { cause: options.cause });
+        this.code = options.code;
+        this.status = options.status;
+        this.retryable = options.retryable ?? false;
+    }
+}
+exports.ReaderError = ReaderError;
+function readResultText(result) {
+    if (typeof result.text === 'string') {
+        return result.text;
+    }
+    if (typeof result.markdown === 'string') {
+        return result.markdown;
+    }
+    return result.documents.map((document) => document.text).filter(Boolean).join('\n\n');
+}
+function mergeDocumentMetadata(result, document) {
+    const metadata = {
+        id: document.id,
+        reader: result.reader,
+        model: result.model,
+        sourceUri: document.sourceUri,
+        pageRange: document.pageRange,
+        mimeType: document.mimeType,
+        ...document.metadata,
+    };
+    for (const [key, value] of Object.entries(metadata)) {
+        if (value === undefined) {
+            delete metadata[key];
+        }
+    }
+    return metadata;
+}

package/node_modules/@undefineds.co/extensions/dist-cjs/registry.js

@@ -0,0 +1,99 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createExtensionRegistry = createExtensionRegistry;
+function createExtensionRegistry() {
+    return new InMemoryExtensionRegistry();
+}
+class InMemoryExtensionRegistry {
+    readers = new Map();
+    sourceAccessors = new Map();
+    runtimeCapabilities = new Map();
+    tools = new Map();
+    configSchemas = new Map();
+    install(extension, descriptor) {
+        const api = this.createApi(descriptor);
+        const result = extension(api);
+        if (isPromiseLike(result)) {
+            return result.then(() => undefined);
+        }
+    }
+    getReader(id) {
+        return this.readers.get(id);
+    }
+    listReaders() {
+        return [...this.readers.values()];
+    }
+    getSourceAccessor(id) {
+        return this.sourceAccessors.get(id);
+    }
+    listSourceAccessors() {
+        return [...this.sourceAccessors.values()];
+    }
+    getRuntimeCapability(id) {
+        return this.runtimeCapabilities.get(id);
+    }
+    listRuntimeCapabilities() {
+        return [...this.runtimeCapabilities.values()];
+    }
+    getTool(id) {
+        return this.tools.get(id);
+    }
+    listTools() {
+        return [...this.tools.values()];
+    }
+    getConfigSchema(id) {
+        return this.configSchemas.get(id);
+    }
+    listConfigSchemas() {
+        return [...this.configSchemas.values()];
+    }
+    createApi(descriptor) {
+        const registration = {
+            extensionId: descriptor.id,
+            extensionVersion: descriptor.version,
+        };
+        return {
+            reader: {
+                register: (definition) => {
+                    assertUnique(this.readers, 'reader', definition.id);
+                    this.readers.set(definition.id, { ...definition, ...registration });
+                },
+            },
+            source: {
+                register: (definition) => {
+                    assertUnique(this.sourceAccessors, 'source accessor', definition.id);
+                    this.sourceAccessors.set(definition.id, { ...definition, ...registration });
+                },
+            },
+            runtime: {
+                registerCapability: (definition) => {
+                    assertUnique(this.runtimeCapabilities, 'runtime capability', definition.id);
+                    this.runtimeCapabilities.set(definition.id, { ...definition, ...registration });
+                },
+            },
+            tools: {
+                register: (definition) => {
+                    assertUnique(this.tools, 'tool', definition.id);
+                    this.tools.set(definition.id, { ...definition, ...registration });
+                },
+            },
+            config: {
+                registerSchema: (definition) => {
+                    assertUnique(this.configSchemas, 'config schema', definition.id);
+                    this.configSchemas.set(definition.id, { ...definition, ...registration });
+                },
+            },
+        };
+    }
+}
+function assertUnique(map, label, id) {
+    if (map.has(id)) {
+        throw new Error(`Duplicate ${label} id ${id}`);
+    }
+}
+function isPromiseLike(value) {
+    return typeof value === 'object'
+        && value !== null
+        && 'then' in value
+        && typeof value.then === 'function';
+}

package/node_modules/@undefineds.co/extensions/dist-cjs/types.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/node_modules/@undefineds.co/models/dist/approval.repository.d.ts

@@ -18,3 +18,23 @@ export interface ApprovalClaimResult {
 export type ApprovalClaimDatabase = ControlRequestClaimDatabase<typeof approvalResource>;
 export declare function claimApprovalRequest(db: ApprovalClaimDatabase, input: ApprovalClaimRequest): Promise<ApprovalClaimResult>;
 export declare function isApprovalStatusClaimable(status: unknown): boolean;
+export interface ApprovalDecisionRequest {
+    /** Exact Approval IRI, including its fragment when present. */
+    approval: string;
+    decision: 'approved' | 'rejected';
+    decisionBy: string;
+    authenticatedFetch: typeof fetch;
+    /** Guards a shell/session switch before the one conditional write. */
+    isCurrent?: () => boolean;
+    now?: () => Date;
+}
+export interface ApprovalDecisionResult {
+    status: 'decided' | 'conflict' | 'not_found' | 'not_actionable' | 'unavailable';
+    reason?: string;
+}
+/**
+ * Temporary protocol adapter until drizzle-solid offers exact conditional writes.
+ * The decision is based on the same document version passed to If-Match. Never
+ * retry 412: doing so would overwrite a competing client's terminal decision.
+ */
+export declare function decideApprovalRequest(input: ApprovalDecisionRequest): Promise<ApprovalDecisionResult>;

package/node_modules/@undefineds.co/models/dist/approval.repository.js

@@ -17,3 +17,84 @@ export async function claimApprovalRequest(db, input) {
 export function isApprovalStatusClaimable(status) {
     return isControlRequestStatusClaimable(status);
 }
+/**
+ * Temporary protocol adapter until drizzle-solid offers exact conditional writes.
+ * The decision is based on the same document version passed to If-Match. Never
+ * retry 412: doing so would overwrite a competing client's terminal decision.
+ */
+export async function decideApprovalRequest(input) {
+    const { Parser, Writer, DataFactory } = await import('n3');
+    const { UDFS, RDF } = await import('./namespaces');
+    const approval = new URL(input.approval);
+    const decisionBy = new URL(input.decisionBy);
+    if (![approval, decisionBy].every(url => ['https:', 'http:'].includes(url.protocol) && !url.username && !url.password)) {
+        throw new Error('Approval and decision identity must be HTTP(S) IRIs without credentials.');
+    }
+    if (!['approved', 'rejected'].includes(input.decision))
+        throw new Error('Invalid approval decision.');
+    const subject = approval.href;
+    approval.hash = '';
+    const documentUrl = approval.href;
+    const response = await input.authenticatedFetch(documentUrl, {
+        headers: { accept: 'text/turtle' }, cache: 'no-store', redirect: 'error',
+    });
+    if (response.status === 404)
+        return { status: 'not_found' };
+    if (!response.ok)
+        throw new Error(`Approval read failed: HTTP ${response.status}`);
+    const etag = response.headers.get('etag');
+    const text = await response.text();
+    if (!etag || !/^"[^"\r\n]+"$/.test(etag))
+        return { status: 'unavailable', reason: 'A strong ETag is required for approval decisions.' };
+    if (!response.headers.get('content-type')?.toLowerCase().includes('text/turtle')) {
+        return { status: 'unavailable', reason: 'The approval document must be served as Turtle.' };
+    }
+    const quads = new Parser({ baseIRI: documentUrl }).parse(text);
+    const values = (predicate) => quads.filter(quad => quad.subject.termType === 'NamedNode' && quad.subject.value === subject && quad.predicate.value === predicate).map(quad => quad.object);
+    if (!values(RDF.type).some(term => term.termType === 'NamedNode' && term.value === UDFS.ApprovalRequest))
+        return { status: 'not_found' };
+    const statuses = values(UDFS.status);
+    if (statuses.length !== 1 || statuses[0].termType !== 'Literal' || !['pending', 'handling'].includes(statuses[0].value) || values(UDFS.resolvedAt).length) {
+        return { status: 'not_actionable', reason: 'Approval is already decided or has ambiguous state.' };
+    }
+    const assigned = values(UDFS.assignedTo);
+    if (assigned.some(term => term.termType !== 'NamedNode' || term.value !== decisionBy.href))
+        return { status: 'not_actionable', reason: 'Approval belongs to another decision maker.' };
+    const now = input.now ?? (() => new Date());
+    const expired = () => values(UDFS.expiresAt).some(term => {
+        const expires = Date.parse(term.value);
+        return !Number.isFinite(expires) || expires <= now().getTime();
+    });
+    if (expired())
+        return { status: 'not_actionable', reason: 'Approval has expired.' };
+    const leaseOwners = values(UDFS.leaseOwner);
+    const leaseExpirations = values(UDFS.leaseExpiresAt);
+    if ((leaseOwners.length || leaseExpirations.length) && (leaseOwners.length !== 1 || leaseOwners[0].termType !== 'Literal'
+        || leaseExpirations.length !== 1 || leaseExpirations[0].termType !== 'Literal'
+        || !Number.isFinite(Date.parse(leaseExpirations[0].value))
+        || Date.parse(leaseExpirations[0].value) > now().getTime())) {
+        return { status: 'conflict', reason: 'Approval is being handled by another client.' };
+    }
+    const changed = new Set([UDFS.status, UDFS.decisionBy, UDFS.resolvedAt]);
+    const preserved = quads.filter(quad => quad.subject.value !== subject || !changed.has(quad.predicate.value));
+    const node = DataFactory.namedNode(subject);
+    preserved.push(DataFactory.quad(node, DataFactory.namedNode(UDFS.status), DataFactory.literal(input.decision)), DataFactory.quad(node, DataFactory.namedNode(UDFS.decisionBy), DataFactory.namedNode(decisionBy.href)), DataFactory.quad(node, DataFactory.namedNode(UDFS.resolvedAt), DataFactory.literal(now().toISOString(), DataFactory.namedNode('http://www.w3.org/2001/XMLSchema#dateTime'))));
+    const body = await new Promise((resolve, reject) => {
+        const writer = new Writer({ format: 'Turtle' });
+        writer.addQuads(preserved);
+        writer.end((error, result) => error ? reject(error) : resolve(result));
+    });
+    if (input.isCurrent && !input.isCurrent())
+        return { status: 'not_actionable', reason: 'The current session changed.' };
+    if (expired())
+        return { status: 'not_actionable', reason: 'Approval has expired.' };
+    const result = await input.authenticatedFetch(documentUrl, {
+        method: 'PUT', headers: { 'content-type': 'text/turtle', 'if-match': etag }, body, redirect: 'error',
+    });
+    await result.arrayBuffer();
+    if (result.status === 412)
+        return { status: 'conflict', reason: 'Another client changed the approval. Refresh before deciding again.' };
+    if (!result.ok)
+        throw new Error(`Approval decision failed: HTTP ${result.status}`);
+    return { status: 'decided' };
+}

package/node_modules/@undefineds.co/models/dist/credential.schema.d.ts

@@ -45,6 +45,8 @@ export declare const credentialResource: import("@undefineds.co/drizzle-solid/di
     appliedAt: import("@undefineds.co/drizzle-solid/dist/core/schema").ColumnBuilder<"datetime", null, false, false>;
     failCount: import("@undefineds.co/drizzle-solid/dist/core/schema").ColumnBuilder<"integer", null, false, true>;
     rateLimitResetAt: import("@undefineds.co/drizzle-solid/dist/core/schema").ColumnBuilder<"datetime", null, false, false>;
+    lastFailureCode: import("@undefineds.co/drizzle-solid/dist/core/schema").ColumnBuilder<"string", null, false, false>;
+    lastFailureAt: import("@undefineds.co/drizzle-solid/dist/core/schema").ColumnBuilder<"datetime", null, false, false>;
     oauthRefreshToken: import("@undefineds.co/drizzle-solid/dist/core/schema").ColumnBuilder<"string", null, false, false>;
     oauthAccessToken: import("@undefineds.co/drizzle-solid/dist/core/schema").ColumnBuilder<"string", null, false, false>;
     oauthExpiresAt: import("@undefineds.co/drizzle-solid/dist/core/schema").ColumnBuilder<"datetime", null, false, false>;
@@ -83,6 +85,8 @@ export declare const credentialTable: import("@undefineds.co/drizzle-solid/dist/
     appliedAt: import("@undefineds.co/drizzle-solid/dist/core/schema").ColumnBuilder<"datetime", null, false, false>;
     failCount: import("@undefineds.co/drizzle-solid/dist/core/schema").ColumnBuilder<"integer", null, false, true>;
     rateLimitResetAt: import("@undefineds.co/drizzle-solid/dist/core/schema").ColumnBuilder<"datetime", null, false, false>;
+    lastFailureCode: import("@undefineds.co/drizzle-solid/dist/core/schema").ColumnBuilder<"string", null, false, false>;
+    lastFailureAt: import("@undefineds.co/drizzle-solid/dist/core/schema").ColumnBuilder<"datetime", null, false, false>;
     oauthRefreshToken: import("@undefineds.co/drizzle-solid/dist/core/schema").ColumnBuilder<"string", null, false, false>;
     oauthAccessToken: import("@undefineds.co/drizzle-solid/dist/core/schema").ColumnBuilder<"string", null, false, false>;
     oauthExpiresAt: import("@undefineds.co/drizzle-solid/dist/core/schema").ColumnBuilder<"datetime", null, false, false>;
@@ -121,6 +125,8 @@ export declare const apiKeyCredentialResource: import("@undefineds.co/drizzle-so
     appliedAt: import("@undefineds.co/drizzle-solid/dist/core/schema").ColumnBuilder<"datetime", null, false, false>;
     failCount: import("@undefineds.co/drizzle-solid/dist/core/schema").ColumnBuilder<"integer", null, false, true>;
     rateLimitResetAt: import("@undefineds.co/drizzle-solid/dist/core/schema").ColumnBuilder<"datetime", null, false, false>;
+    lastFailureCode: import("@undefineds.co/drizzle-solid/dist/core/schema").ColumnBuilder<"string", null, false, false>;
+    lastFailureAt: import("@undefineds.co/drizzle-solid/dist/core/schema").ColumnBuilder<"datetime", null, false, false>;
     oauthRefreshToken: import("@undefineds.co/drizzle-solid/dist/core/schema").ColumnBuilder<"string", null, false, false>;
     oauthAccessToken: import("@undefineds.co/drizzle-solid/dist/core/schema").ColumnBuilder<"string", null, false, false>;
     oauthExpiresAt: import("@undefineds.co/drizzle-solid/dist/core/schema").ColumnBuilder<"datetime", null, false, false>;
@@ -159,6 +165,8 @@ export declare const apiKeyCredentialTable: import("@undefineds.co/drizzle-solid
     appliedAt: import("@undefineds.co/drizzle-solid/dist/core/schema").ColumnBuilder<"datetime", null, false, false>;
     failCount: import("@undefineds.co/drizzle-solid/dist/core/schema").ColumnBuilder<"integer", null, false, true>;
     rateLimitResetAt: import("@undefineds.co/drizzle-solid/dist/core/schema").ColumnBuilder<"datetime", null, false, false>;
+    lastFailureCode: import("@undefineds.co/drizzle-solid/dist/core/schema").ColumnBuilder<"string", null, false, false>;
+    lastFailureAt: import("@undefineds.co/drizzle-solid/dist/core/schema").ColumnBuilder<"datetime", null, false, false>;
     oauthRefreshToken: import("@undefineds.co/drizzle-solid/dist/core/schema").ColumnBuilder<"string", null, false, false>;
     oauthAccessToken: import("@undefineds.co/drizzle-solid/dist/core/schema").ColumnBuilder<"string", null, false, false>;
     oauthExpiresAt: import("@undefineds.co/drizzle-solid/dist/core/schema").ColumnBuilder<"datetime", null, false, false>;
@@ -197,6 +205,8 @@ export declare const oauthCredentialResource: import("@undefineds.co/drizzle-sol
     appliedAt: import("@undefineds.co/drizzle-solid/dist/core/schema").ColumnBuilder<"datetime", null, false, false>;
     failCount: import("@undefineds.co/drizzle-solid/dist/core/schema").ColumnBuilder<"integer", null, false, true>;
     rateLimitResetAt: import("@undefineds.co/drizzle-solid/dist/core/schema").ColumnBuilder<"datetime", null, false, false>;
+    lastFailureCode: import("@undefineds.co/drizzle-solid/dist/core/schema").ColumnBuilder<"string", null, false, false>;
+    lastFailureAt: import("@undefineds.co/drizzle-solid/dist/core/schema").ColumnBuilder<"datetime", null, false, false>;
     oauthRefreshToken: import("@undefineds.co/drizzle-solid/dist/core/schema").ColumnBuilder<"string", null, false, false>;
     oauthAccessToken: import("@undefineds.co/drizzle-solid/dist/core/schema").ColumnBuilder<"string", null, false, false>;
     oauthExpiresAt: import("@undefineds.co/drizzle-solid/dist/core/schema").ColumnBuilder<"datetime", null, false, false>;
@@ -235,6 +245,8 @@ export declare const oauthCredentialTable: import("@undefineds.co/drizzle-solid/
     appliedAt: import("@undefineds.co/drizzle-solid/dist/core/schema").ColumnBuilder<"datetime", null, false, false>;
     failCount: import("@undefineds.co/drizzle-solid/dist/core/schema").ColumnBuilder<"integer", null, false, true>;
     rateLimitResetAt: import("@undefineds.co/drizzle-solid/dist/core/schema").ColumnBuilder<"datetime", null, false, false>;
+    lastFailureCode: import("@undefineds.co/drizzle-solid/dist/core/schema").ColumnBuilder<"string", null, false, false>;
+    lastFailureAt: import("@undefineds.co/drizzle-solid/dist/core/schema").ColumnBuilder<"datetime", null, false, false>;
     oauthRefreshToken: import("@undefineds.co/drizzle-solid/dist/core/schema").ColumnBuilder<"string", null, false, false>;
     oauthAccessToken: import("@undefineds.co/drizzle-solid/dist/core/schema").ColumnBuilder<"string", null, false, false>;
     oauthExpiresAt: import("@undefineds.co/drizzle-solid/dist/core/schema").ColumnBuilder<"datetime", null, false, false>;

package/node_modules/@undefineds.co/models/dist/credential.schema.js

@@ -60,6 +60,11 @@ export const credentialResource = podTable("credential", {
     appliedAt: timestamp("appliedAt").predicate(UDFS.appliedAt),
     failCount: integer("failCount").predicate(UDFS.failCount).default(0),
     rateLimitResetAt: timestamp("rateLimitResetAt").predicate(UDFS.rateLimitResetAt),
+    // Stable, non-sensitive failure category supplied by the runtime adapter:
+    // authentication, login_expired, quota_exhausted, authorization, rate_limited,
+    // upstream_unavailable, or provider_error. Never store upstream response text.
+    lastFailureCode: string("lastFailureCode").predicate(UDFS.lastFailureCode),
+    lastFailureAt: timestamp("lastFailureAt").predicate(UDFS.lastFailureAt),
     oauthRefreshToken: string("oauthRefreshToken").predicate(UDFS.oauthRefreshToken),
     oauthAccessToken: string("oauthAccessToken").predicate(UDFS.oauthAccessToken),
     oauthExpiresAt: timestamp("oauthExpiresAt").predicate(UDFS.oauthExpiresAt),

package/node_modules/@undefineds.co/models/dist/index.d.ts

@@ -43,7 +43,7 @@ export { DEFAULT_AGENT_PROVIDERS, type AgentProviderMetadata, type AgentModelOpt
 export { sessionResource, sessionTable, buildRuntimeSessionIri, extractSessionIdFromSessionRef, extractRuntimeSessionId, type SessionStatus, type SessionRow, type SessionInsert, type SessionUpdate, } from './session/index.js';
 export { sessionRepository } from './session.repository.js';
 export { approvalResource, approvalTable, extractApprovalIdFromApprovalRef, type ApprovalRow, type ApprovalInsert, type ApprovalUpdate, } from './approval.schema.js';
-export { claimApprovalRequest, isApprovalStatusClaimable, type ApprovalClaimDatabase, type ApprovalClaimRequest, type ApprovalClaimResult, type ApprovalClaimStatus, } from './approval.repository.js';
+export { claimApprovalRequest, decideApprovalRequest, type ApprovalDecisionRequest, type ApprovalDecisionResult, isApprovalStatusClaimable, type ApprovalClaimDatabase, type ApprovalClaimRequest, type ApprovalClaimResult, type ApprovalClaimStatus, } from './approval.repository.js';
 export { claimControlRequest, isControlRequestStatusClaimable, type ClaimableControlRequestRow, type ControlRequestClaimDatabase, type ControlRequestClaimOptions, type ControlRequestClaimResource, type ControlRequestClaimResult, type ControlRequestClaimRow, type ControlRequestClaimStatus, type ControlRequestClaimUpdate, } from './control-request.repository.js';
 export { auditResource, auditTable, extractAuditIdFromAuditRef, type AuditRow, type AuditInsert, type AuditUpdate, } from './audit.schema.js';
 export { buildAuditDetailRecord, buildAuditPresentation, createResolvedAuthTimestampsIndex, formatAuditActorRole, formatInboxStatusLabel, type AuditPresentation, } from './audit.presentation.js';

package/node_modules/@undefineds.co/models/dist/index.js

@@ -68,7 +68,7 @@ export { sessionResource, sessionTable, buildRuntimeSessionIri, extractSessionId
 export { sessionRepository } from './session.repository.js';
 // Approval / Audit / Grant / Inbox Notification
 export { approvalResource, approvalTable, extractApprovalIdFromApprovalRef, } from './approval.schema.js';
-export { claimApprovalRequest, isApprovalStatusClaimable, } from './approval.repository.js';
+export { claimApprovalRequest, decideApprovalRequest, isApprovalStatusClaimable, } from './approval.repository.js';
 export { claimControlRequest, isControlRequestStatusClaimable, } from './control-request.repository.js';
 export { auditResource, auditTable, extractAuditIdFromAuditRef, } from './audit.schema.js';
 export { buildAuditDetailRecord, buildAuditPresentation, createResolvedAuthTimestampsIndex, formatAuditActorRole, formatInboxStatusLabel, } from './audit.presentation.js';