@undefineds.co/xpod 0.4.28 → 0.4.30

package/dist/api/ai-gateway/connect/FileSessionImportAdapter.js

@@ -6,6 +6,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.FileSessionImportAdapter = void 0;
 const node_fs_1 = require("node:fs");
 const node_os_1 = __importDefault(require("node:os"));
+const node_path_1 = __importDefault(require("node:path"));
 const DEFAULT_MAX_SESSION_FILE_BYTES = 256 * 1024;
 class FileSessionImportAdapter {
     constructor(options) {
@@ -13,6 +14,7 @@ class FileSessionImportAdapter {
         this.provider = options.profile.provider;
         this.offeringId = options.profile.offeringId;
         this.homeDir = options.homeDir ?? node_os_1.default.homedir();
+        this.env = options.env ?? process.env;
         this.readFile = options.readFile ?? node_fs_1.promises.readFile;
         this.maxBytes = options.maxBytes ?? DEFAULT_MAX_SESSION_FILE_BYTES;
     }
@@ -20,9 +22,19 @@ class FileSessionImportAdapter {
         if (input.deployment !== 'local') {
             throw new Error('local_session_import_unavailable_in_cloud');
         }
-        const raw = await this.readSessionFile(this.profile.resolvePath(this.homeDir));
+        const filePath = this.profile.resolvePath(this.homeDir, this.env);
+        const raw = await this.readSessionFile(filePath);
         const payload = parseJsonObject(raw);
-        return this.profile.importSession(payload);
+        const result = this.profile.importSession(payload);
+        return {
+            ...result,
+            // The profile declares the path; the adapter reports the file it actually read so the
+            // path can never drift from the metadata the way a duplicated literal did before.
+            metadata: withoutUndefined({
+                ...result.metadata,
+                sessionPath: homeRelativePath(this.homeDir, filePath),
+            }),
+        };
     }
     async readSessionFile(filePath) {
         let raw;
@@ -30,7 +42,7 @@ class FileSessionImportAdapter {
             raw = await this.readFile(filePath, 'utf8');
         }
         catch (error) {
-            if (isErrno(error, 'ENOENT')) {
+            if (isErrno(error, 'ENOENT') || isErrno(error, 'ENOTDIR')) {
                 throw new Error('local_session_file_missing');
             }
             throw new Error('local_session_file_read_failed');
@@ -42,6 +54,11 @@ class FileSessionImportAdapter {
     }
 }
 exports.FileSessionImportAdapter = FileSessionImportAdapter;
+/** `~/…` form for files under the home directory; undefined for any other location. */
+function homeRelativePath(homeDir, filePath) {
+    const prefix = homeDir.endsWith(node_path_1.default.sep) ? homeDir : `${homeDir}${node_path_1.default.sep}`;
+    return filePath.startsWith(prefix) ? `~${node_path_1.default.sep}${filePath.slice(prefix.length)}` : undefined;
+}
 function parseJsonObject(raw) {
     let parsed;
     try {
@@ -60,4 +77,7 @@ function isErrno(error, code) {
         && 'code' in error
         && error.code === code;
 }
+function withoutUndefined(input) {
+    return Object.fromEntries(Object.entries(input).filter(([, value]) => value !== undefined));
+}
 //# sourceMappingURL=FileSessionImportAdapter.js.map

package/dist/api/ai-gateway/connect/SessionImportProfiles.d.ts

@@ -1,9 +1,17 @@
 import type { LocalSessionImportResult } from './FileSessionImportAdapter';
+/**
+ * Declarative description of one local session file location.
+ *
+ * The profile owns the path because each CLI has its own data-directory contract. The adapter
+ * stays provider-agnostic: it resolves exactly one path and reads it. `env` exists so a profile can
+ * honour an override the installed CLI itself defines; Xpod never adds an environment option of its
+ * own, and an explicitly configured override is authoritative (no stale-account fallback).
+ */
 export interface SessionImportProfile {
     id: string;
     provider: string;
     offeringId: string;
-    resolvePath(homeDir: string): string;
+    resolvePath(homeDir: string, env: NodeJS.ProcessEnv): string;
     importSession(payload: Record<string, unknown>): LocalSessionImportResult;
 }
 export declare const OPENAI_CODEX_SESSION_IMPORT_PROFILE: SessionImportProfile;

package/dist/api/ai-gateway/connect/SessionImportProfiles.js

@@ -16,7 +16,10 @@ exports.KIMI_CODE_SESSION_IMPORT_PROFILE = {
     id: 'kimi-code-credentials-json',
     provider: 'kimi',
     offeringId: 'subscription-key',
-    resolvePath: (homeDir) => node_path_1.default.join(homeDir, '.kimi', 'credentials', 'kimi-code.json'),
+    // The installed Kimi CLI resolves its data directory as KIMI_CODE_HOME ?? ~/.kimi-code and keeps
+    // credentials at <dataDir>/credentials/<name>.json. A configured KIMI_CODE_HOME is authoritative:
+    // it must not fall back to the default directory or to another subscriber's account.
+    resolvePath: (homeDir, env) => node_path_1.default.join(stringValue(env?.KIMI_CODE_HOME) ?? node_path_1.default.join(homeDir, '.kimi-code'), 'credentials', 'kimi-code.json'),
     importSession: importKimiCodeSession,
 };
 function importOpenAiCodexSession(payload) {
@@ -42,7 +45,6 @@ function importOpenAiCodexSession(payload) {
         accountLabel: accountId ? `OpenAI Subscription ${accountId}` : 'OpenAI Subscription',
         metadata: withoutUndefined({
             source: 'local-codex-auth-json',
-            sessionPath: '~/.codex/auth.json',
             authMode,
             accountId,
         }),
@@ -72,7 +74,6 @@ function importKimiCodeSession(payload) {
         accountLabel: 'Kimi Subscription',
         metadata: {
             source: 'local-kimi-code-credentials-json',
-            sessionPath: '~/.kimi/credentials/kimi-code.json',
         },
     };
 }

package/dist/api/ai-gateway/connect/index.d.ts

@@ -195,6 +195,11 @@ export interface PodCredentialRepository {
         provider: string;
         deployment: GatewayDeployment;
         reason: string;
+        /**
+         * Selects the exact credential row. Callers that know which credential failed must pass it so
+         * an invalid_grant on one credential can never mark a sibling credential of the same provider.
+         */
+        credentialId?: string;
         expectedVersion?: number;
         auth?: AuthContext;
     }): Promise<ConnectCredentialRecord | undefined>;
@@ -289,6 +294,7 @@ export declare class PodConnectedCredentialRepository implements PodCredentialRe
         cooldownUntil?: Date;
         encryptedSecret: EncryptedCredentialSecret;
         version?: number;
+        expiresAt?: Date;
         runtimeCredential?: Record<string, unknown>;
         metadata?: Record<string, unknown>;
     }>>;
@@ -330,6 +336,7 @@ export declare class PodConnectedCredentialRepository implements PodCredentialRe
         provider: string;
         deployment: GatewayDeployment;
         reason: string;
+        credentialId?: string;
         expectedVersion?: number;
         auth?: AuthContext;
     }): Promise<ConnectCredentialRecord | undefined>;
@@ -683,6 +690,39 @@ export declare class ProviderConnectService {
     }): Promise<AiProviderCredentialSummary>;
     private importLocalCredential;
     private refreshImportedSecret;
+    /**
+     * Exchanges the stored refresh token for a live session. Shared by import-time and use-time
+     * renewal; typed reauth failures stay distinguishable so callers can mark the credential.
+     */
+    private refreshCallerOwnedSecret;
+    /**
+     * Shared credential lifecycle recovery, called by the inference path when a stored OAuth session
+     * is expired or was just rejected upstream.
+     *
+     * Renewal re-reads the credential row inside a per-credential lock (concurrent callers
+     * coalesce), prefers the declared local session source when the live file still belongs to the
+     * same subscriber, falls back to the stored refresh token, and persists to the SAME row through
+     * the existing CAS update so user settings survive. API keys and local providers keep the
+     * existing path: they report "not renewable" instead of being special-cased by provider id.
+     *
+     * Returns whether a retry with the now-stored credential is worthwhile.
+     */
+    renewCredential(input: {
+        webId: string;
+        deployment: GatewayDeployment;
+        provider: string;
+        credentialId: string;
+        observedVersion?: number;
+        reason: 'expired' | 'authentication_failed';
+        auth?: AuthContext;
+    }): Promise<boolean>;
+    /**
+     * On-demand re-read of the declared local session source for an imported credential: the CLI
+     * that owns the file may have rotated it since import. The live session is adopted only when it
+     * is unexpired, still belongs to the same subscriber, and does not narrow the granted scopes the
+     * stored credential relies on.
+     */
+    private adoptLiveImportedSession;
     updateCredential(input: ProviderCredentialQuery & {
         credentialId: string;
         expectedVersion: number;

package/dist/api/ai-gateway/connect/index.js

@@ -23,6 +23,12 @@ var LoopbackAuthorizationCallbackReceiver_1 = require("./LoopbackAuthorizationCa
 Object.defineProperty(exports, "LoopbackAuthorizationCallbackReceiver", { enumerable: true, get: function () { return LoopbackAuthorizationCallbackReceiver_1.LoopbackAuthorizationCallbackReceiver; } });
 const CREDENTIAL_COLLECTION_QUERY_UNSUPPORTED = 'credential_collection_query_unsupported';
 const credentialUpdateLocks = new Map();
+/**
+ * Serializes on-demand session renewals per (webId, credential) so concurrent in-flight requests
+ * coalesce into a single provider refresh. Separate from `credentialUpdateLocks` because the
+ * renewal body persists through the CAS update path, which takes that lock itself.
+ */
+const credentialRenewalLocks = new Map();
 class PodConnectedCredentialRepository {
     constructor(options = {}) {
         this.podAccess = options.podAccess;
@@ -108,7 +114,7 @@ class PodConnectedCredentialRepository {
             .filter((record) => record.status === 'active')
             .filter((record) => normalizeProvider(record.provider) !== '')
             .filter((record) => providerAllowedByConfiguredIds(record.provider, enabledProviderIds));
-        const podBaseUrl = await (0, PodBaseUrlResolver_1.resolveOwnerPodBaseUrl)(input.webId, this.podBaseUrlResolver);
+        const podBaseUrl = await (0, PodBaseUrlResolver_1.resolveOwnerPodBaseUrl)(input.webId, this.podBaseUrlResolver, input.auth);
         const hydrated = await this.withSelectedModels(db, aiProvider, aiModel, filtered, input.webId, podBaseUrl, podFetch);
         return hydrated
             .sort(compareCredentialRecords)
@@ -135,6 +141,7 @@ class PodConnectedCredentialRepository {
                 cooldownUntil: record.rateLimitResetAt,
                 encryptedSecret: record.encryptedSecret,
                 version: record.version,
+                expiresAt: record.expiresAt,
                 runtimeCredential: runtimeCredentialFromMetadata({ ...record.metadata, offeringId }),
                 metadata: {
                     ...record.metadata,
@@ -258,7 +265,7 @@ class PodConnectedCredentialRepository {
             .filter((record) => record.webId === input.webId)
             .filter((record) => providerMatchesQuery(record.provider, input.provider, providerIds))
             .filter((record) => input.includeRevoked || record.status === 'active');
-        const podBaseUrl = await (0, PodBaseUrlResolver_1.resolveOwnerPodBaseUrl)(input.webId, this.podBaseUrlResolver);
+        const podBaseUrl = await (0, PodBaseUrlResolver_1.resolveOwnerPodBaseUrl)(input.webId, this.podBaseUrlResolver, input.auth);
         return (await this.withSelectedModels(db, aiProvider, aiModel, filtered, input.webId, podBaseUrl, podFetch))
             .sort(compareCredentialRecords);
     }
@@ -331,7 +338,11 @@ class PodConnectedCredentialRepository {
         return updated !== null;
     }
     async markReauthRequired(input) {
-        const current = await this.getActiveCredential(input);
+        // An explicit credentialId pins the exact row; without it the previous single-active-credential
+        // behaviour is preserved for callers that only know the provider.
+        const current = input.credentialId
+            ? await this.getCredentialById({ ...input, credentialId: input.credentialId })
+            : await this.getActiveCredential(input);
         if (!current) {
             return undefined;
         }
@@ -425,7 +436,7 @@ class PodConnectedCredentialRepository {
     }
     async dbForOwner(owner, auth) {
         const credential = (0, drizzle_solid_1.alias)(this.credentialTemplate, 'credential');
-        const podUrl = await (0, PodBaseUrlResolver_1.resolveOwnerPodBaseUrl)(owner, this.podBaseUrlResolver);
+        const podUrl = await (0, PodBaseUrlResolver_1.resolveOwnerPodBaseUrl)(owner, this.podBaseUrlResolver, auth);
         const trustedFetch = await this.resolveTrustedFetch(owner, auth, podUrl);
         const podBaseUrl = podUrl.replace(/\/$/u, '');
         const settingsSparqlEndpoint = `${podBaseUrl}/settings/-/sparql`;
@@ -1841,6 +1852,13 @@ class ProviderConnectService {
         if ((dateFrom(secret.expiresAt)?.getTime() ?? Infinity) > Date.now()) {
             return { ...secret, ...metadataWithoutUndefined({ ...kimiAccountIdentityHint(input.provider, secret.accessToken) }) };
         }
+        return this.refreshCallerOwnedSecret(secret, input);
+    }
+    /**
+     * Exchanges the stored refresh token for a live session. Shared by import-time and use-time
+     * renewal; typed reauth failures stay distinguishable so callers can mark the credential.
+     */
+    async refreshCallerOwnedSecret(secret, input) {
         if (typeof secret.refreshToken !== 'string' || !secret.refreshToken) {
             throw new Error('local_session_missing_refresh_token');
         }
@@ -1862,6 +1880,163 @@ class ProviderConnectService {
         }
         return { ...result, ...metadataWithoutUndefined({ ...kimiAccountIdentityHint(input.provider, result.accessToken) }) };
     }
+    /**
+     * Shared credential lifecycle recovery, called by the inference path when a stored OAuth session
+     * is expired or was just rejected upstream.
+     *
+     * Renewal re-reads the credential row inside a per-credential lock (concurrent callers
+     * coalesce), prefers the declared local session source when the live file still belongs to the
+     * same subscriber, falls back to the stored refresh token, and persists to the SAME row through
+     * the existing CAS update so user settings survive. API keys and local providers keep the
+     * existing path: they report "not renewable" instead of being special-cased by provider id.
+     *
+     * Returns whether a retry with the now-stored credential is worthwhile.
+     */
+    async renewCredential(input) {
+        if (!this.credentialRepository || !this.vault)
+            return false;
+        const provider = normalizeProvider(input.provider);
+        return withCredentialRenewalLock(JSON.stringify([input.webId, input.credentialId]), async () => {
+            const current = await this.credentialRepository.getCredentialById({
+                webId: input.webId,
+                provider,
+                deployment: input.deployment,
+                credentialId: input.credentialId,
+                auth: input.auth,
+            });
+            // A revoked or deliberately disabled credential must not be renewed back into service.
+            if (!current || current.status !== 'active' || current.enabled === false)
+                return false;
+            if (current.authMode !== 'deviceCodeOAuth')
+                return false;
+            const secret = await this.vault.open({ webId: input.webId }, current.credentialIri, provider, current.encryptedSecret);
+            const valid = (dateFrom(secret.expiresAt)?.getTime() ?? Infinity) > Date.now();
+            const versionChanged = input.observedVersion !== undefined && current.version !== input.observedVersion;
+            if (valid) {
+                // A concurrent caller already renewed this exact row: tell the caller to reload and retry.
+                if (versionChanged)
+                    return true;
+                // Nothing to renew for a session that is genuinely still valid.
+                if (input.reason === 'expired')
+                    return false;
+                // `authentication_failed` with a still-"valid" token: fall through and refresh it.
+            }
+            const offeringId = current.offeringId ?? defaultOfferingFor(provider, current.authMode);
+            // Live-file adoption is reserved for credentials proven imported by the existing fingerprint
+            // contract. A separately device-authorized grant must use its own refresh token instead of
+            // silently inheriting whatever session the host CLI currently holds.
+            const imported = typeof secret.importedSessionFingerprint === 'string';
+            let next = imported
+                ? await this.adoptLiveImportedSession({
+                    provider,
+                    offeringId,
+                    stored: secret,
+                    storedScopes: current.scopes,
+                    deployment: input.deployment,
+                    rejectUnchangedAccessToken: input.reason === 'authentication_failed',
+                })
+                : undefined;
+            if (!next) {
+                try {
+                    next = await this.refreshCallerOwnedSecret(secret, {
+                        webId: input.webId,
+                        deployment: input.deployment,
+                        provider,
+                        offeringId,
+                        credentialId: current.id,
+                        expectedVersion: current.version ?? 0,
+                        auth: input.auth,
+                    });
+                }
+                catch (error) {
+                    if (!(error instanceof Error) || error.message !== 'local_session_reauth_required') {
+                        return false;
+                    }
+                    await this.credentialRepository.markReauthRequired({
+                        webId: input.webId,
+                        provider,
+                        deployment: input.deployment,
+                        reason: 'invalid_grant',
+                        credentialId: current.id,
+                        expectedVersion: current.version,
+                        auth: input.auth,
+                    });
+                    throw new errors_1.GatewayProtocolError('Provider session requires re-authorization', {
+                        code: 'credential_unavailable',
+                        status: 401,
+                        details: { provider, credentialId: current.id, reauthRequired: true },
+                    });
+                }
+            }
+            // A "renewal" that would re-store the very token the provider just rejected is not a renewal;
+            // leave the row alone so the caller does not retry with an unchanged rejected token.
+            if (input.reason === 'authentication_failed' && next.accessToken === secret.accessToken) {
+                return false;
+            }
+            const health = current.health === 'disabled' ? 'disabled' : 'healthy';
+            const updated = await this.credentialRepository.updateCredential({
+                webId: input.webId,
+                provider,
+                deployment: input.deployment,
+                credentialId: current.id,
+                expectedVersion: current.version,
+                auth: input.auth,
+                patch: {
+                    encryptedSecret: await this.vault.seal({ webId: input.webId }, current.credentialIri, provider, next),
+                    expiresAt: dateFrom(next.expiresAt),
+                    scopes: scopeListFromSecret(next),
+                    reauthRequired: false,
+                    health,
+                    metadata: metadataWithoutUndefined({
+                        ...current.metadata,
+                        accountId: next.accountId,
+                        authoritativeSubject: next.accountSubject,
+                        offeringId,
+                        health,
+                    }),
+                },
+            });
+            return Boolean(updated);
+        });
+    }
+    /**
+     * On-demand re-read of the declared local session source for an imported credential: the CLI
+     * that owns the file may have rotated it since import. The live session is adopted only when it
+     * is unexpired, still belongs to the same subscriber, and does not narrow the granted scopes the
+     * stored credential relies on.
+     */
+    async adoptLiveImportedSession(input) {
+        const importer = input.offeringId
+            ? this.localSessionImporters.get(localSessionImporterKey(input.provider, input.offeringId))
+            : undefined;
+        if (!importer)
+            return undefined;
+        let imported;
+        try {
+            imported = await importer.importSession({ deployment: input.deployment });
+        }
+        catch {
+            // A missing or unreadable live file must not block the stored refresh token.
+            return undefined;
+        }
+        if ((dateFrom(imported.secret.expiresAt)?.getTime() ?? 0) <= Date.now())
+            return undefined;
+        // Re-reading a file that still holds the token the provider just rejected is not a renewal;
+        // the caller must fall back to the declared refresh token instead.
+        if (input.rejectUnchangedAccessToken && imported.secret.accessToken === input.stored.accessToken) {
+            return undefined;
+        }
+        if (!sameImportedSession(input.provider, input.stored, imported.secret))
+            return undefined;
+        const liveScopes = scopeListFromSecret(imported.secret);
+        if (input.storedScopes?.length
+            && !input.storedScopes.every((scope) => liveScopes?.includes(scope)))
+            return undefined;
+        return {
+            ...imported.secret,
+            importedSessionFingerprint: importedSessionFingerprint(imported.secret),
+        };
+    }
     async updateCredential(input) {
         this.requireProvidedProvider(input.deployment, input.provider);
         this.assertEndpointIsProvided({
@@ -3563,6 +3738,21 @@ function offeringMatchesAuthMode(offeringAuthModes, authMode) {
         return offeringAuthModes.includes('local');
     return offeringAuthModes.includes('oauth') || offeringAuthModes.includes('deviceCode');
 }
+async function withCredentialRenewalLock(key, operation) {
+    const previous = credentialRenewalLocks.get(key) ?? Promise.resolve();
+    let release;
+    const pending = new Promise((resolve) => { release = resolve; });
+    credentialRenewalLocks.set(key, pending);
+    await previous;
+    try {
+        return await operation();
+    }
+    finally {
+        release();
+        if (credentialRenewalLocks.get(key) === pending)
+            credentialRenewalLocks.delete(key);
+    }
+}
 async function updateByCredentialIdAndVersion(params) {
     const { owner, db, credential, credentialId, expectedVersion, patch } = params;
     const key = JSON.stringify([owner, credentialId]);

package/dist/api/ai-gateway/models/PodModelSelectionRepository.js

@@ -313,7 +313,7 @@ class PodModelSelectionRepository {
     async dbForOwner(owner, auth) {
         assertOwnerWebId(owner);
         assertAuthOwner(owner, auth);
-        const podUrl = await (0, PodBaseUrlResolver_1.resolveOwnerPodBaseUrl)(owner, this.podBaseUrlResolver);
+        const podUrl = await (0, PodBaseUrlResolver_1.resolveOwnerPodBaseUrl)(owner, this.podBaseUrlResolver, auth);
         const trustedFetch = await this.podAccess?.getPodFetch(owner, {
             ...(auth ? { auth } : {}),
             podBaseUrl: podUrl,

package/dist/api/ai-gateway/pod/OwnerPodAccess.js

@@ -173,6 +173,11 @@ function podAccessError(owner, auth) {
  */
 function isPodAccessFailure(message) {
     return message === 'service_access_missing'
+        || message === 'Authoritative Pod storage binding ambiguous'
+        || message === 'Authoritative Pod credential binding changed on cached context'
+        || message === 'Authoritative Pod credential binding changed while opening database'
+        || message === 'Authoritative Pod storage binding changed on cached context'
+        || message === 'Authoritative Pod storage binding conflicts with request'
         || message.startsWith(exports.POD_INTERFACE_KEY_MISSING)
         || message.startsWith(exports.POD_INTERFACE_KEY_REJECTED)
         || message.startsWith(CallerPodAccess_1.CALLER_DPOP_REPLAY_UNSUPPORTED)

package/dist/api/ai-gateway/pod/PodBaseUrlResolver.d.ts

@@ -1,2 +1,11 @@
-export type PodBaseUrlResolver = (webId: string) => Promise<string | undefined>;
-export declare function resolveOwnerPodBaseUrl(webId: string, resolver?: PodBaseUrlResolver): Promise<string>;
+import type { AuthContext } from '../../auth/AuthContext';
+import type { PodLookupRepository } from '../../../identity/drizzle/PodLookupRepository';
+export type PodBaseUrlResolver = ((webId: string, requestedPodUrl?: string) => Promise<string | undefined>) & {
+    /** Canonical roots registered to the exact owner, for bounded verifier lookups only. */
+    ownedPodUrls?: (webId: string) => Promise<string[]>;
+};
+export declare function resolveOwnerPodBindings(webId: string, resolver?: PodBaseUrlResolver): Promise<string[]>;
+export declare function resolveOwnerPodBaseUrl(webId: string, resolver?: PodBaseUrlResolver, auth?: AuthContext): Promise<string>;
+/** Only repository-verified ownership and storage bindings may authorize a selected Pod. */
+export declare function createOwnerPodBaseUrlResolver(repository: Pick<PodLookupRepository, 'findByWebId' | 'findAllByWebId'> | undefined, selection?: 'first' | 'unique'): PodBaseUrlResolver;
+export declare function normalizeVerifiedPodRoot(value: string): string;

package/dist/api/ai-gateway/pod/PodBaseUrlResolver.js

@@ -1,21 +1,83 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveOwnerPodBindings = resolveOwnerPodBindings;
 exports.resolveOwnerPodBaseUrl = resolveOwnerPodBaseUrl;
+exports.createOwnerPodBaseUrlResolver = createOwnerPodBaseUrlResolver;
+exports.normalizeVerifiedPodRoot = normalizeVerifiedPodRoot;
 const drizzle_solid_1 = require("@undefineds.co/drizzle-solid");
-async function resolveOwnerPodBaseUrl(webId, resolver) {
-    const resolved = await resolver?.(webId);
-    return normalizePodBaseUrl(resolved ?? (0, drizzle_solid_1.resolvePodBaseUrl)(webId));
+async function resolveOwnerPodBindings(webId, resolver) {
+    if (!resolver)
+        throw new Error('service_access_missing');
+    if (resolver.ownedPodUrls)
+        return resolver.ownedPodUrls(webId);
+    const root = await resolver(webId);
+    return root ? [normalizeVerifiedPodRoot(root)] : [];
 }
-function normalizePodBaseUrl(value) {
+async function resolveOwnerPodBaseUrl(webId, resolver, auth) {
+    const solidAuth = auth?.type === 'solid' ? auth : undefined;
+    if (solidAuth && solidAuth.webId !== webId)
+        throw new Error('caller_owner_mismatch');
+    const requested = solidAuth?.requestedPodUrl;
+    const authorized = solidAuth?.authorizedPodUrl;
+    if (requested && (solidAuth?.viaGatewayApiKey || solidAuth?.internalInvocation) && !authorized) {
+        throw new Error('service_access_missing');
+    }
+    const selected = requested ?? authorized;
+    const resolved = await resolver?.(webId, selected);
+    if ((resolver || selected) && !resolved)
+        throw new Error('service_access_missing');
+    const podUrl = normalizeVerifiedPodRoot(resolved ?? (0, drizzle_solid_1.resolvePodBaseUrl)(webId));
+    if (authorized && podUrl !== normalizeVerifiedPodRoot(authorized))
+        throw new Error('service_access_missing');
+    return podUrl;
+}
+/** Only repository-verified ownership and storage bindings may authorize a selected Pod. */
+function createOwnerPodBaseUrlResolver(repository, selection = 'first') {
+    const resolver = async (webId, requestedPodUrl) => {
+        const pods = selection === 'unique' || requestedPodUrl !== undefined
+            ? await repository?.findAllByWebId(webId) ?? []
+            : [await repository?.findByWebId(webId)];
+        if (requestedPodUrl !== undefined) {
+            const requested = normalizeVerifiedPodRoot(requestedPodUrl);
+            const owned = pods.filter(pod => [pod?.storageUrl, pod?.baseUrl].some(root => root !== undefined && normalizeVerifiedPodRoot(root) === requested));
+            const roots = new Set(owned.flatMap(pod => {
+                const root = pod?.storageUrl ?? pod?.baseUrl;
+                return root ? [normalizeVerifiedPodRoot(root)] : [];
+            }));
+            if (roots.size > 1)
+                throw new Error('Authoritative Pod storage binding ambiguous');
+            return roots.values().next().value;
+        }
+        const roots = pods.flatMap(pod => {
+            const root = pod?.storageUrl ?? pod?.baseUrl;
+            return root ? [root] : [];
+        });
+        if (selection === 'first')
+            return roots[0];
+        const normalized = new Set(roots.map(normalizeVerifiedPodRoot));
+        if (normalized.size > 1)
+            throw new Error('Authoritative Pod storage binding ambiguous');
+        return normalized.values().next().value;
+    };
+    resolver.ownedPodUrls = async (webId) => {
+        const pods = await repository?.findAllByWebId(webId) ?? [];
+        return [...new Set(pods.flatMap(pod => {
+                const root = pod.storageUrl ?? pod.baseUrl;
+                return root ? [normalizeVerifiedPodRoot(root)] : [];
+            }))];
+    };
+    return resolver;
+}
+function normalizeVerifiedPodRoot(value) {
     const url = new URL(value);
-    if (url.protocol !== 'http:' && url.protocol !== 'https:') {
-        throw new TypeError('Pod storage URL must use http or https');
+    if (value !== value.trim() || /[\s\\?#]/u.test(value)
+        || !['http:', 'https:'].includes(url.protocol) || url.username || url.password) {
+        throw new Error('Invalid Pod storage binding');
     }
-    url.hash = '';
-    url.search = '';
-    if (!url.pathname.endsWith('/')) {
+    if (!url.pathname.endsWith('/'))
         url.pathname += '/';
-    }
+    if (url.href !== (value.endsWith('/') ? value : `${value}/`))
+        throw new Error('Invalid Pod storage binding');
     return url.href;
 }
 //# sourceMappingURL=PodBaseUrlResolver.js.map

package/dist/api/ai-gateway/quota/ProviderQuotaAdapter.js

@@ -398,7 +398,7 @@ class PodQuotaSnapshotRepository {
         return { ...snapshot, stale: false };
     }
     async dbForOwner(owner, auth) {
-        const podUrl = await (0, PodBaseUrlResolver_1.resolveOwnerPodBaseUrl)(owner, this.podBaseUrlResolver);
+        const podUrl = await (0, PodBaseUrlResolver_1.resolveOwnerPodBaseUrl)(owner, this.podBaseUrlResolver, auth);
         const trustedFetch = await this.resolveTrustedFetch(owner, auth, podUrl);
         const db = await this.dbFactory({ owner, auth, fetch: trustedFetch, podUrl });
         await db.init?.(models_1.quotaSnapshotResource);

package/dist/api/ai-gateway/routing/ModelRouter.d.ts

@@ -135,6 +135,13 @@ export declare class ModelRouter {
     private selectExplicitCredential;
     private selectCredential;
     private isCredentialUsable;
+    /**
+     * Whether a credential candidate is currently eligible on its own availability signals:
+     * enabled, healthy and not quota-exhausted. Routing, model visibility and the gateway's
+     * post-renewal reload share this predicate so a row disabled or marked reauth-required between
+     * a credential lifecycle write and its next use is never handed to the provider runtime.
+     */
+    isCredentialEligible(candidate: GatewayCredentialCandidate): boolean;
     private effectiveCooldownUntil;
     private credentialMatchesProvider;
     private routeProviderIdForCredential;

package/dist/api/ai-gateway/routing/ModelRouter.js

@@ -426,13 +426,7 @@ class ModelRouter {
         return usable[0];
     }
     async isCredentialUsable(input, candidate, model) {
-        if (!candidate.enabled) {
-            return false;
-        }
-        if (candidate.health && candidate.health !== 'healthy') {
-            return false;
-        }
-        if (candidate.quota?.status === 'exhausted') {
+        if (!this.isCredentialEligible(candidate)) {
             return false;
         }
         const cooldownUntil = await this.effectiveCooldownUntil(input, candidate);
@@ -441,6 +435,17 @@ class ModelRouter {
         }
         return credentialSupportsModel(candidate, model);
     }
+    /**
+     * Whether a credential candidate is currently eligible on its own availability signals:
+     * enabled, healthy and not quota-exhausted. Routing, model visibility and the gateway's
+     * post-renewal reload share this predicate so a row disabled or marked reauth-required between
+     * a credential lifecycle write and its next use is never handed to the provider runtime.
+     */
+    isCredentialEligible(candidate) {
+        return candidate.enabled
+            && (!candidate.health || candidate.health === 'healthy')
+            && candidate.quota?.status !== 'exhausted';
+    }
     async effectiveCooldownUntil(input, candidate) {
         const storedCooldown = await this.affinityStore.getCooldown({
             deployment: input.deployment,
@@ -545,9 +550,7 @@ class ModelRouter {
         return models;
     }
     isCredentialModelVisible(candidate) {
-        return candidate.enabled
-            && (!candidate.health || candidate.health === 'healthy')
-            && candidate.quota?.status !== 'exhausted'
+        return this.isCredentialEligible(candidate)
             && (!candidate.cooldownUntil || candidate.cooldownUntil.getTime() <= this.now().getTime());
     }
     /**

package/dist/api/ai-gateway/service-access/AiConnectionsServiceAccess.d.ts

@@ -17,7 +17,7 @@ export interface AiConnectionsServiceAccessDescriptor {
     resources: AiConnectionsServiceAccessResource[];
 }
 export interface AiConnectionsServiceAccessResource {
-    id: 'providerCredentials' | 'providerDefinitions' | 'gatewayAccessKeys' | 'gatewayAccessKeySecrets' | 'quotaSnapshots' | `providerDocument:${string}`;
+    id: 'providerCredentials' | 'providerDefinitions' | 'quotaSnapshots' | `providerDocument:${string}`;
     url: string;
     mediaType: 'text/turtle' | 'application/json';
     access: {
@@ -33,7 +33,3 @@ export declare function createAiConnectionsServiceAccess(input: {
     serviceWebId: string;
     podBaseUrl?: string;
 }): AiConnectionsServiceAccessDescriptor;
-export declare function resolveGatewayAccessKeyResourceUrl(ownerWebId: string, podBaseUrl?: string): string;
-export declare function resolveGatewayAccessKeySecretResourceUrl(ownerWebId: string, podBaseUrl?: string): string;
-export declare function resolveGatewayAccessKeySparqlEndpoint(ownerWebId: string, podBaseUrl?: string): string;
-export declare function isGatewayAccessKeySparqlEndpoint(ownerWebId: string, resourceUrlValue: URL | string): boolean;