@undefineds.co/xpod 0.4.28 → 0.4.30

package/dist/api/container/common.js

@@ -11,7 +11,6 @@ const MatrixEventJournal_1 = require("../matrix/MatrixEventJournal");
 const awilix_1 = require("awilix");
 const node_crypto_1 = require("node:crypto");
 const global_logger_factory_1 = require("global-logger-factory");
-const gateway_locator_secret_1 = require("../../runtime/gateway-locator-secret");
 const db_1 = require("../../identity/drizzle/db");
 const EdgeNodeRepository_1 = require("../../identity/drizzle/EdgeNodeRepository");
 const UsageRepository_1 = require("../../storage/quota/UsageRepository");
@@ -28,8 +27,7 @@ const InvocationTokenAuthenticator_1 = require("../ai-gateway/auth/InvocationTok
 const AiConnectionsInvocationKeyIssuer_1 = require("../ai-gateway/auth/AiConnectionsInvocationKeyIssuer");
 const InvocationTokenCodec_1 = require("../ai-gateway/auth/InvocationTokenCodec");
 const GatewayApiKeyAuthenticator_1 = require("../ai-gateway/auth/GatewayApiKeyAuthenticator");
-const GatewayKeyLocatorCodec_1 = require("../ai-gateway/auth/GatewayKeyLocatorCodec");
-const PodGatewayAccessKeyRepository_1 = require("../ai-gateway/auth/PodGatewayAccessKeyRepository");
+const PodBaseUrlResolver_1 = require("../ai-gateway/pod/PodBaseUrlResolver");
 const OwnerPodAccess_1 = require("../ai-gateway/pod/OwnerPodAccess");
 const HostedPodRoute_1 = require("../ai-gateway/pod/HostedPodRoute");
 const TaskCredentialDatabase_1 = require("../tasks/TaskCredentialDatabase");
@@ -75,6 +73,7 @@ const tasks_1 = require("../tasks");
 const service_1 = require("../../ai/service");
 const rdf_1 = require("./rdf");
 const EdgeNodeCertificateCapabilityBridge_1 = require("../../edge/EdgeNodeCertificateCapabilityBridge");
+const logger = (0, global_logger_factory_1.getLoggerFor)('ApiContainer');
 function resolveCssServiceBaseUrl() {
     return `http://127.0.0.1:${process.env.CSS_PORT ?? '3000'}/`;
 }
@@ -117,43 +116,15 @@ function resolveAiConnectionsRuntimeBaseUrl(config) {
 function resolveAiConnectionsAudience(config) {
     return new URL(resolveAiConnectionsBaseUrl(config)).origin;
 }
-function resolveGatewayLocatorSecret(config) {
-    if (config.gatewayLocatorSecret?.trim()) {
-        return config.gatewayLocatorSecret;
-    }
-    return (0, gateway_locator_secret_1.resolvePersistentGatewayLocatorSecret)({
-        databaseUrl: config.databaseUrl,
-        edition: config.edition,
-    });
-}
 function podBaseUrlResolver(cradle, selection = 'first') {
-    return async (webId) => {
-        const pods = selection === 'unique'
-            ? await cradle.podLookupRepo?.findAllByWebId(webId) ?? []
-            : [await cradle.podLookupRepo?.findByWebId(webId)];
-        const roots = pods.flatMap(pod => {
-            const root = pod?.storageUrl ?? pod?.baseUrl;
-            return root ? [root] : [];
-        });
-        if (selection === 'first')
-            return roots[0];
-        const normalized = new Set(roots.map(root => {
-            const url = new URL(root);
-            if (!['http:', 'https:'].includes(url.protocol) || url.username || url.password || url.search || url.hash) {
-                throw new Error('Invalid Pod storage binding');
-            }
-            return url.href.replace(/\/+$/u, '');
-        }));
-        if (normalized.size > 1)
-            throw new Error('Authoritative Pod storage binding ambiguous');
-        return normalized.values().next().value;
-    };
+    return (0, PodBaseUrlResolver_1.createOwnerPodBaseUrlResolver)(cradle.podLookupRepo, selection);
 }
 /**
  * 注册共享服务到容器
  */
 function registerCommonServices(container) {
     container.register({
+        aiConnectionsPodBaseUrlResolver: (0, awilix_1.asFunction)((cradle) => podBaseUrlResolver(cradle, 'unique')).singleton(),
         // 数据库
         db: (0, awilix_1.asFunction)(({ config }) => {
             return (0, db_1.getIdentityDatabase)(config.databaseUrl);
@@ -247,20 +218,6 @@ function registerCommonServices(container) {
                 },
             });
         }).singleton(),
-        gatewayAccessKeyRepository: (0, awilix_1.asFunction)((cradle) => {
-            const { config, ownerPodAccess } = cradle;
-            return new PodGatewayAccessKeyRepository_1.PodGatewayAccessKeyRepository({
-                locatorCodec: new GatewayKeyLocatorCodec_1.AesGatewayKeyLocatorCodec({
-                    active: {
-                        kid: config.gatewayLocatorKeyId ?? 'active',
-                        secret: resolveGatewayLocatorSecret(config),
-                    },
-                    previous: config.gatewayPreviousLocatorSecrets,
-                }),
-                podAccess: ownerPodAccess,
-                podBaseUrlResolver: podBaseUrlResolver(cradle),
-            });
-        }).singleton(),
         aiConnectionInvocationKeyIssuer: (0, awilix_1.asFunction)((cradle) => {
             const { config } = cradle;
             return new AiConnectionsInvocationKeyIssuer_1.AiConnectionsInvocationKeyIssuer({
@@ -281,7 +238,7 @@ function registerCommonServices(container) {
             const { config } = cradle;
             const credentialRepository = new connect_1.PodConnectedCredentialRepository({
                 podAccess: cradle.ownerPodAccess,
-                podBaseUrlResolver: podBaseUrlResolver(cradle),
+                podBaseUrlResolver: cradle.aiConnectionsPodBaseUrlResolver,
             });
             const vault = credentialVaultForConfig(config);
             // AI Gateway Connect has no on/off switch: installing ai-connections
@@ -370,16 +327,31 @@ function registerCommonServices(container) {
         })).singleton(),
         gatewayCredentialStore: (0, awilix_1.asFunction)((cradle) => {
             const { ownerPodAccess } = cradle;
-            return new connect_1.PodConnectedCredentialRepository({
+            const store = new connect_1.PodConnectedCredentialRepository({
                 podAccess: ownerPodAccess,
-                podBaseUrlResolver: podBaseUrlResolver(cradle),
+                podBaseUrlResolver: cradle.aiConnectionsPodBaseUrlResolver,
+            });
+            // Use-time OAuth renewal belongs to the shared credential lifecycle: inference only asks the
+            // store for a usable session. Delegated lazily to the composed Connect service so the
+            // container keeps no construction-time cycle, and the hook stays absent for stores that
+            // cannot renew.
+            return Object.assign(store, {
+                renewCredential: (input) => cradle.providerConnectService.renewCredential({
+                    webId: input.webId,
+                    deployment: input.deployment,
+                    provider: input.provider,
+                    credentialId: input.credentialId,
+                    observedVersion: input.observedVersion,
+                    reason: input.reason,
+                    auth: input.auth,
+                }),
             });
         }).singleton(),
         podModelSelectionRepository: (0, awilix_1.asFunction)((cradle) => {
             const { ownerPodAccess } = cradle;
             return new PodModelSelectionRepository_1.PodModelSelectionRepository({
                 podAccess: ownerPodAccess,
-                podBaseUrlResolver: podBaseUrlResolver(cradle),
+                podBaseUrlResolver: cradle.aiConnectionsPodBaseUrlResolver,
             });
         }).singleton(),
         providerModelSelectionService: (0, awilix_1.asFunction)((cradle) => {
@@ -387,7 +359,7 @@ function registerCommonServices(container) {
             return new ProviderModelSelectionService_1.ProviderModelSelectionService({
                 credentialRepository: new connect_1.PodConnectedCredentialRepository({
                     podAccess: ownerPodAccess,
-                    podBaseUrlResolver: podBaseUrlResolver(cradle),
+                    podBaseUrlResolver: cradle.aiConnectionsPodBaseUrlResolver,
                 }),
                 selectionRepository: podModelSelectionRepository,
                 providerRegistry: gatewayProviderRegistry,
@@ -466,11 +438,11 @@ function registerCommonServices(container) {
             return new quota_1.ProviderQuotaService({
                 repository: new quota_1.PodQuotaSnapshotRepository({
                     podAccess,
-                    podBaseUrlResolver: podBaseUrlResolver(cradle),
+                    podBaseUrlResolver: cradle.aiConnectionsPodBaseUrlResolver,
                 }),
                 credentialRepository: new connect_1.PodConnectedCredentialRepository({
                     podAccess,
-                    podBaseUrlResolver: podBaseUrlResolver(cradle),
+                    podBaseUrlResolver: cradle.aiConnectionsPodBaseUrlResolver,
                 }),
                 vault: credentialVaultForConfig(config),
                 providerRegistry: cradle.gatewayProviderRegistry,
@@ -498,7 +470,7 @@ function registerCommonServices(container) {
             return new models_1.ProviderModelsService({
                 credentialRepository: new connect_1.PodConnectedCredentialRepository({
                     podAccess,
-                    podBaseUrlResolver: podBaseUrlResolver(cradle),
+                    podBaseUrlResolver: cradle.aiConnectionsPodBaseUrlResolver,
                 }),
                 vault: credentialVaultForConfig(config),
                 providerRegistry: registry,
@@ -563,13 +535,13 @@ function registerCommonServices(container) {
             return new models_1.ProviderCustomModelsService({
                 credentialRepository: new connect_1.PodConnectedCredentialRepository({
                     podAccess: cradle.ownerPodAccess,
-                    podBaseUrlResolver: podBaseUrlResolver(cradle),
+                    podBaseUrlResolver: cradle.aiConnectionsPodBaseUrlResolver,
                 }),
                 embeddingModelPolicy: cradle.embeddingModelPolicy,
                 registry: cradle.gatewayProviderRegistry,
             });
         }).singleton(),
-        authenticator: (0, awilix_1.asFunction)(({ nodeRepo, serviceTokenRepo, invocationTokenCodec, gatewayAccessKeyRepository, solidSessions, config, }) => {
+        authenticator: (0, awilix_1.asFunction)(({ nodeRepo, serviceTokenRepo, invocationTokenCodec, solidSessions, config, }) => {
             const solidAuthenticator = new SolidTokenAuthenticator_1.SolidTokenAuthenticator({
                 resolveAccountId: async (webId) => webId,
                 publicBaseUrl: config.solidBaseUrl,
@@ -593,8 +565,10 @@ function registerCommonServices(container) {
                     audience: resolveAiConnectionsAudience(config),
                 })
                 : undefined;
+            // Verifies the AI-Connections invocation tokens that carry `models:read` / `inference:write`
+            // for the model gateway. It no longer accepts `xpod_gw_v1.*` Gateway API Keys: those are
+            // gone, so such a bearer now falls through to the client-credentials authenticator.
             const gatewayApiKeyAuthenticator = new GatewayApiKeyAuthenticator_1.GatewayApiKeyAuthenticator({
-                repository: gatewayAccessKeyRepository,
                 deployment: config.edition,
                 invocationTokenCodec,
                 invocationTokenAudience: resolveAiConnectionsAudience(config),
@@ -604,7 +578,7 @@ function registerCommonServices(container) {
                 // inference tokens, so route-scoped authentication must run before the
                 // generic client-credentials authenticator claims the bearer.
                 // Order: Solid DPoP → Service Token → Node Token →
-                // Client Configuration Invocation → Gateway API Key → Client Credentials.
+                // Client Configuration Invocation → Inference Invocation → Client Credentials.
                 // Agent execution is scoped by ChatKit thread/workspace and Run state, not standalone Agent JWTs.
                 authenticators: [
                     solidAuthenticator,
@@ -630,7 +604,7 @@ function registerCommonServices(container) {
             const { config, ownerPodAccess, serverGroupReconcilerService } = cradle;
             return new chatkit_1.PodChatKitStore({
                 podAccess: ownerPodAccess,
-                podBaseUrlResolver: podBaseUrlResolver(cradle, 'unique'),
+                podBaseUrlResolver: cradle.aiConnectionsPodBaseUrlResolver,
                 serverGroupReconcilerService,
                 deployment: config.edition,
                 credentialSecretDecoder: (0, AiCredentialSecretDecoder_1.createAiCredentialSecretDecoder)({

package/dist/api/container/index.js

@@ -189,9 +189,6 @@ function loadConfigFromEnv() {
         aiConnectionInvocationSecret: process.env.XPOD_AI_CONNECTION_INVOCATION_SECRET,
         aiConnectionInvocationKeyId: process.env.XPOD_AI_CONNECTION_INVOCATION_KEY_ID,
         aiConnectionPreviousInvocationSecrets: parsePreviousInvocationSecrets(process.env.XPOD_AI_CONNECTION_PREVIOUS_INVOCATION_SECRETS),
-        gatewayLocatorSecret: process.env.XPOD_GATEWAY_LOCATOR_SECRET,
-        gatewayLocatorKeyId: process.env.XPOD_GATEWAY_LOCATOR_KEY_ID,
-        gatewayPreviousLocatorSecrets: parsePreviousInvocationSecrets(process.env.XPOD_GATEWAY_PREVIOUS_LOCATOR_SECRETS),
         aiGatewaySessionAffinitySecret: process.env.XPOD_AI_GATEWAY_SESSION_AFFINITY_SECRET,
         gatewayAdminProxyAuthSecret: process.env.XPOD_GATEWAY_ADMIN_PROXY_AUTH_SECRET,
         ...(deploymentRootKeys ? secretCellVaultFactories(() => deploymentRootKeys) : {}),

package/dist/api/container/routes.js

@@ -150,7 +150,6 @@ function registerSharedRoutes(container, server) {
     const rdfSearchIndexingService = container.resolve('rdfSearchIndexingService', { allowUnregistered: true });
     const ownerPodAccess = container.resolve('ownerPodAccess');
     const aiConnectionInvocationKeyIssuer = container.resolve('aiConnectionInvocationKeyIssuer');
-    const gatewayAccessKeyRepository = container.resolve('gatewayAccessKeyRepository', { allowUnregistered: true });
     const providerConnectService = container.resolve('providerConnectService');
     const providerQuotaService = container.resolve('providerQuotaService', { allowUnregistered: true });
     const providerModelsService = container.resolve('providerModelsService', { allowUnregistered: true });
@@ -219,18 +218,12 @@ function registerSharedRoutes(container, server) {
     });
     (0, AiGatewayManagementHandler_1.registerAiGatewayManagementRoutes)(server, {
         deployment: config.edition,
+        podBaseUrlResolver: container.resolve('aiConnectionsPodBaseUrlResolver'),
         connectService: providerConnectService,
         quotaService: providerQuotaService,
         modelsService: providerModelsService,
         providerModelSelectionService,
         customModelsService: providerCustomModelsService,
-        gatewayAccessKeyRepository,
-        invalidateClientCredential: (clientId) => container.resolve('solidSessions').invalidateClientCredential(clientId),
-        validateClientCredential: (apiKey) => container.resolve('authenticator').authenticate({
-            headers: { authorization: `Bearer ${apiKey}` },
-            method: 'POST',
-            url: '/api/ai/gateway/keys',
-        }),
         aiClientConfiguration: aiClientConfigurationService?.capability(),
         aiConnectionInvocationKeyIssuer,
     });

package/dist/api/container/types.d.ts

@@ -1,3 +1,4 @@
+import type { PodBaseUrlResolver } from '../ai-gateway/pod/PodBaseUrlResolver';
 /**
  * API Container 依赖类型定义
  *
@@ -56,7 +57,6 @@ import type { SessionAffinityStore } from '../ai-gateway/routing/SessionAffinity
 import type { AiConnectionsInvocationKeyIssuer } from '../ai-gateway/auth/AiConnectionsInvocationKeyIssuer';
 import type { InvocationTokenCodec } from '../ai-gateway/auth/InvocationTokenCodec';
 import type { OwnerPodAccess } from '../ai-gateway/pod/OwnerPodAccess';
-import type { GatewayAccessKeyRepository } from '../ai-gateway/auth/GatewayApiKeyAuthenticator';
 import type { PodModelSelectionRepository } from '../ai-gateway/models/PodModelSelectionRepository';
 import type { ProviderModelSelectionService } from '../ai-gateway/models/ProviderModelSelectionService';
 import type { AiClientConfigurationService } from '../service/AiClientConfigurationService';
@@ -125,13 +125,6 @@ export interface ApiContainerConfig {
         kid: string;
         secret: string;
     }>;
-    /** Durable Gateway API Key locator signing config. */
-    gatewayLocatorSecret?: string;
-    gatewayLocatorKeyId?: string;
-    gatewayPreviousLocatorSecrets?: Array<{
-        kid: string;
-        secret: string;
-    }>;
     aiGatewaySessionAffinitySecret?: string;
     /** Runtime-generated secret used only between GatewayProxy and the internal API server for admin ingress evidence. */
     gatewayAdminProxyAuthSecret?: string;
@@ -240,8 +233,8 @@ export interface ApiContainerCradle {
      */
     legacyPodKeyMigration?: () => Promise<PodInterfaceKeyMigrationResult>;
     invocationTokenCodec?: InvocationTokenCodec;
-    gatewayAccessKeyRepository?: GatewayAccessKeyRepository;
     aiConnectionInvocationKeyIssuer?: AiConnectionsInvocationKeyIssuer;
+    aiConnectionsPodBaseUrlResolver: PodBaseUrlResolver;
     aiClientConfigurationService?: AiClientConfigurationService;
     providerConnectService: ProviderConnectService;
     providerQuotaService?: ProviderQuotaService;

package/dist/api/container/types.js

@@ -1,8 +1,3 @@
 "use strict";
-/**
- * API Container 依赖类型定义
- *
- * 定义容器中注册的所有服务接口
- */
 Object.defineProperty(exports, "__esModule", { value: true });
 //# sourceMappingURL=types.js.map

package/dist/api/handlers/AiGatewayManagementHandler.d.ts

@@ -1,7 +1,6 @@
+import { type PodBaseUrlResolver } from '../ai-gateway/pod/PodBaseUrlResolver';
 import type { ApiServer } from '../ApiServer';
-import type { AuthResult } from '../auth/Authenticator';
-import type { GatewayDeployment } from '../ai-gateway/auth/GatewayApiKey';
-import { type GatewayAccessKeyRepository } from '../ai-gateway/auth/GatewayApiKeyAuthenticator';
+import type { GatewayDeployment } from '../ai-gateway/auth/InvocationTokenCodec';
 import type { ProviderConnectService } from '../ai-gateway/connect';
 import type { ProviderModelSelectionService } from '../ai-gateway/models/ProviderModelSelectionService';
 import type { ProviderQuotaService } from '../ai-gateway/quota';
@@ -10,6 +9,8 @@ import type { AiConnectionsInvocationKeyIssuer } from '../ai-gateway/auth/AiConn
 import { type AiClientConfigurationCapabilityDescriptor } from '../service/AiClientConfigurationService';
 export interface AiGatewayManagementHandlerOptions {
     deployment: GatewayDeployment;
+    /** The storage adapter verifies ownership and an optional current-Pod selection. */
+    podBaseUrlResolver?: PodBaseUrlResolver;
     connectService?: ProviderConnectService;
     quotaService?: ProviderQuotaService;
     modelsService?: ProviderModelsService;
@@ -22,15 +23,6 @@ export interface AiGatewayManagementHandlerOptions {
             webId: string;
         }>;
     };
-    gatewayAccessKeyRepository?: GatewayAccessKeyRepository;
-    /** Reuses the configured CSS authenticator; never trusts the claimed registration owner. */
-    validateClientCredential?: (apiKey: string) => Promise<AuthResult>;
-    /**
-     * Forget sessions cached for a client whose registration is gone. Revocation happens at the
-     * issuer, so deleting the record is the moment this process learns the credential must stop
-     * being accepted - without it a revoked API Key keeps working until its token expires.
-     */
-    invalidateClientCredential?: (clientId: string) => void;
     aiClientConfiguration?: AiClientConfigurationCapabilityDescriptor;
     aiConnectionInvocationKeyIssuer?: Pick<AiConnectionsInvocationKeyIssuer, 'issue' | 'issueClientConfiguration'>;
     jsonBodyLimitBytes?: number;