@undefineds.co/xpod 0.4.28 → 0.4.30

package/node_modules/@undefineds.co/ai-connections/dist/AiProviderCard.d.ts

@@ -3,7 +3,7 @@ import { type AiOfferingActionError, type AiOfferingQuotaState } from './AiCrede
 export type { AiProviderDefinition } from './controller.js';
 import type { AiProviderDefinition } from './controller.js';
 export type ProviderConnectionState = 'unknown' | 'pending' | 'configured' | 'connected' | 'disconnected' | 'reauthRequired' | 'failed';
-export declare function AiProviderCard({ definition, product, status, accountLabel, attempt, attemptOfferingId, apiKey, baseUrl, busy, disabled, error, quotas, models, verifyPending, onApiKeyChange, onBaseUrlChange, onBeginApiKey, onBeginOffering, onCancelConnect, onBeginBrowser, onSaveApiKey, onDisconnect, onCreateApiKeyCredential, onCreateLocalCredential, onUpdateCredential, onDeleteCredential, onTestCredential, onReorderCredentials, onRefreshQuota, onVerify, onAddModel, onEditModel, onDeleteModel, selectedModelIds, modelSelectionStatus, onModelSelectionChange, onDismissError, }: {
+export declare function AiProviderCard({ definition, product, status, accountLabel, attempt, attemptOfferingId, apiKey, baseUrl, busy, disabled, developerMode, error, quotas, models, verifyPending, onApiKeyChange, onBaseUrlChange, onBeginApiKey, onBeginOffering, onCancelConnect, onBeginBrowser, onSaveApiKey, onDisconnect, onCreateApiKeyCredential, onCreateLocalCredential, onUpdateCredential, onDeleteCredential, onTestCredential, onReorderCredentials, onRefreshQuota, onVerify, onAddModel, onEditModel, onDeleteModel, selectedModelIds, modelSelectionStatus, onModelSelectionChange, onDismissError, }: {
     definition: AiProviderDefinition;
     product?: AiProviderSummary;
     status: ProviderConnectionState;
@@ -14,6 +14,7 @@ export declare function AiProviderCard({ definition, product, status, accountLab
     baseUrl?: string;
     busy: boolean;
     disabled?: boolean;
+    developerMode?: boolean;
     error?: AiOfferingActionError;
     quotas?: Partial<Record<string, AiOfferingQuotaState>>;
     models: AiGatewayModel[];

package/node_modules/@undefineds.co/ai-connections/dist/AiProviderCard.js

@@ -8,7 +8,7 @@ import { AiProviderHeader } from './AiProviderHeader.js';
 import { authorizationMethodsForOffering, isBrowserConnectMethod } from './authorization-methods.js';
 import { AiCredentialPoolSection, } from './AiCredentialPoolSection.js';
 import { AiModelSearchInput, AiModelRow, modelIconTokens, } from './AiModelCatalog.js';
-export function AiProviderCard({ definition, product, status, accountLabel, attempt, attemptOfferingId, apiKey, baseUrl = '', busy, disabled = false, error, quotas, models, verifyPending = false, onApiKeyChange, onBaseUrlChange, onBeginApiKey, onBeginOffering, onCancelConnect, onBeginBrowser, onSaveApiKey, onDisconnect, onCreateApiKeyCredential, onCreateLocalCredential, onUpdateCredential, onDeleteCredential, onTestCredential, onReorderCredentials, onRefreshQuota, onVerify, onAddModel, onEditModel, onDeleteModel, selectedModelIds, modelSelectionStatus, onModelSelectionChange, onDismissError, }) {
+export function AiProviderCard({ definition, product, status, accountLabel, attempt, attemptOfferingId, apiKey, baseUrl = '', busy, disabled = false, developerMode = false, error, quotas, models, verifyPending = false, onApiKeyChange, onBaseUrlChange, onBeginApiKey, onBeginOffering, onCancelConnect, onBeginBrowser, onSaveApiKey, onDisconnect, onCreateApiKeyCredential, onCreateLocalCredential, onUpdateCredential, onDeleteCredential, onTestCredential, onReorderCredentials, onRefreshQuota, onVerify, onAddModel, onEditModel, onDeleteModel, selectedModelIds, modelSelectionStatus, onModelSelectionChange, onDismissError, }) {
     const workbench = product?.offerings.find((offering) => offering.consoleUrl
         && authorizationMethodsForOffering(offering).some(isBrowserConnectMethod))?.consoleUrl;
     const isConfigured = status === 'configured';
@@ -44,7 +44,7 @@ export function AiProviderCard({ definition, product, status, accountLabel, atte
             setLocalSelectedModelIds(nextModelIds);
         onModelSelectionChange?.(definition.id, nextModelIds);
     };
-    return (_jsx(TooltipProvider, { children: _jsxs("div", { className: "space-y-8", children: [_jsx(AiProviderHeader, { name: definition.name, mark: providerMark(definition.id), avatar: getProviderAvatar(definition.id), avatarBackground: getProviderAvatarBackground(definition.id), infoLabel: "\u63D0\u4F9B\u5546\u8BF4\u660E", infoLines: [definition.description, '连接凭据保存在当前 Pod，由 Pod 权限保护。'], link: { href: definition.homeUrl, label: '访问官网' }, links: workbench ? [{ href: workbench, label: '打开工作台' }] : [], badge: (_jsx(Badge, { variant: isConnected || isConfigured ? 'default' : 'secondary', children: connectionStatusLabel(status) })) }), _jsx(AiCredentialPoolSection, { definition: definition, product: product, status: status, accountLabel: accountLabel, attempt: attempt, attemptOfferingId: attemptOfferingId, apiKey: apiKey, baseUrl: baseUrl, busy: busy, disabled: disabled, error: error, suppressError: Boolean(catalogError), quotas: quotas, onApiKeyChange: onApiKeyChange, onBaseUrlChange: onBaseUrlChange, onBeginApiKey: onBeginApiKey, onBeginOffering: onBeginOffering, onCancelConnect: onCancelConnect, onBeginBrowser: onBeginBrowser, onSaveApiKey: onSaveApiKey, onDisconnect: onDisconnect, onCreateApiKeyCredential: product?.offerings.length ? onCreateApiKeyCredential : undefined, onCreateLocalCredential: product?.offerings.length ? onCreateLocalCredential : undefined, onUpdateCredential: onUpdateCredential, onDeleteCredential: onDeleteCredential, onTestCredential: onTestCredential, onReorderCredentials: onReorderCredentials, onRefreshQuota: onRefreshQuota, onDismissError: onDismissError }), _jsxs("section", { className: "space-y-8", children: [_jsxs("div", { "data-testid": "provider-models-header", className: "flex flex-wrap items-center justify-between gap-2", children: [_jsxs("div", { className: "flex min-w-0 flex-wrap items-center gap-x-2 gap-y-1", children: [_jsxs("h3", { className: "flex items-center gap-2 text-sm font-medium text-foreground/90", children: [_jsx(Box, { "aria-hidden": "true", className: "h-4 w-4 text-primary" }), "\u53EF\u7528\u6A21\u578B"] }), _jsxs("span", { className: "text-xs text-muted-foreground", children: ["\u5171 ", catalog.length, " \u00B7 \u5DF2\u52A0\u5165 ", selectedModelCount, " \u00B7 \u5DF2\u5931\u6548 ", unavailableModelCount] }), modelSelectionStatus === 'saving' ? (_jsxs("span", { role: "status", "aria-live": "polite", "aria-atomic": "true", className: "inline-flex items-center gap-1 text-xs text-muted-foreground", children: [_jsx(Loader2, { "aria-hidden": "true", className: "h-3 w-3 animate-spin motion-reduce:animate-none" }), "\u4FDD\u5B58\u4E2D\u2026"] })) : null, modelSelectionStatus === 'saved' ? (_jsxs("span", { role: "status", "aria-live": "polite", "aria-atomic": "true", className: "inline-flex items-center gap-1 text-xs text-muted-foreground", children: [_jsx(Check, { "aria-hidden": "true", className: "h-3 w-3" }), "\u5DF2\u4FDD\u5B58"] })) : null] }), _jsxs("div", { "data-testid": "provider-models-actions", className: "flex w-full flex-wrap items-center gap-2 sm:w-auto sm:flex-nowrap sm:justify-end", children: [(isConfigured || isConnected) && (onVerify || onAddModel) ? (_jsxs(_Fragment, { children: [onAddModel ? (_jsxs(Button, { variant: "outline", size: "sm", className: "h-8 gap-1.5 text-xs", disabled: disabled || busy, onClick: onAddModel, children: [_jsx(Plus, { "aria-hidden": "true", className: "h-3.5 w-3.5" }), "\u6DFB\u52A0\u6A21\u578B"] })) : null, onVerify && models.length > 0 ? (_jsxs(Button, { variant: "outline", size: "sm", className: "h-8 gap-1.5 text-xs", disabled: disabled || busy || verifyPending, onClick: onVerify, children: [verifyPending
+    return (_jsx(TooltipProvider, { children: _jsxs("div", { className: "space-y-8", children: [_jsx(AiProviderHeader, { name: definition.name, mark: providerMark(definition.id), avatar: getProviderAvatar(definition.id), avatarBackground: getProviderAvatarBackground(definition.id), infoLabel: "\u63D0\u4F9B\u5546\u8BF4\u660E", infoLines: [definition.description, '连接凭据保存在当前 Pod，由 Pod 权限保护。'], link: { href: definition.homeUrl, label: '访问官网' }, links: workbench ? [{ href: workbench, label: '打开工作台' }] : [], badge: (_jsx(Badge, { variant: isConnected || isConfigured ? 'default' : 'secondary', children: connectionStatusLabel(status) })) }), _jsx(AiCredentialPoolSection, { definition: definition, product: product, status: status, accountLabel: accountLabel, attempt: attempt, attemptOfferingId: attemptOfferingId, apiKey: apiKey, baseUrl: baseUrl, busy: busy, disabled: disabled, developerMode: developerMode, error: error, suppressError: Boolean(catalogError), quotas: quotas, onApiKeyChange: onApiKeyChange, onBaseUrlChange: onBaseUrlChange, onBeginApiKey: onBeginApiKey, onBeginOffering: onBeginOffering, onCancelConnect: onCancelConnect, onBeginBrowser: onBeginBrowser, onSaveApiKey: onSaveApiKey, onDisconnect: onDisconnect, onCreateApiKeyCredential: product?.offerings.length ? onCreateApiKeyCredential : undefined, onCreateLocalCredential: product?.offerings.length ? onCreateLocalCredential : undefined, onUpdateCredential: onUpdateCredential, onDeleteCredential: onDeleteCredential, onTestCredential: onTestCredential, onReorderCredentials: onReorderCredentials, onRefreshQuota: onRefreshQuota, onDismissError: onDismissError }), _jsxs("section", { className: "space-y-8", children: [_jsxs("div", { "data-testid": "provider-models-header", className: "flex flex-wrap items-center justify-between gap-2", children: [_jsxs("div", { className: "flex min-w-0 flex-wrap items-center gap-x-2 gap-y-1", children: [_jsxs("h3", { className: "flex items-center gap-2 text-sm font-medium text-foreground/90", children: [_jsx(Box, { "aria-hidden": "true", className: "h-4 w-4 text-primary" }), "\u53EF\u7528\u6A21\u578B"] }), _jsxs("span", { className: "text-xs text-muted-foreground", children: ["\u5171 ", catalog.length, " \u00B7 \u5DF2\u52A0\u5165 ", selectedModelCount, " \u00B7 \u5DF2\u5931\u6548 ", unavailableModelCount] }), modelSelectionStatus === 'saving' ? (_jsxs("span", { role: "status", "aria-live": "polite", "aria-atomic": "true", className: "inline-flex items-center gap-1 text-xs text-muted-foreground", children: [_jsx(Loader2, { "aria-hidden": "true", className: "h-3 w-3 animate-spin motion-reduce:animate-none" }), "\u4FDD\u5B58\u4E2D\u2026"] })) : null, modelSelectionStatus === 'saved' ? (_jsxs("span", { role: "status", "aria-live": "polite", "aria-atomic": "true", className: "inline-flex items-center gap-1 text-xs text-muted-foreground", children: [_jsx(Check, { "aria-hidden": "true", className: "h-3 w-3" }), "\u5DF2\u4FDD\u5B58"] })) : null] }), _jsxs("div", { "data-testid": "provider-models-actions", className: "flex w-full flex-wrap items-center gap-2 sm:w-auto sm:flex-nowrap sm:justify-end", children: [(isConfigured || isConnected) && (onVerify || onAddModel) ? (_jsxs(_Fragment, { children: [onAddModel ? (_jsxs(Button, { variant: "outline", size: "sm", className: "h-8 gap-1.5 text-xs", disabled: disabled || busy, onClick: onAddModel, children: [_jsx(Plus, { "aria-hidden": "true", className: "h-3.5 w-3.5" }), "\u6DFB\u52A0\u6A21\u578B"] })) : null, onVerify && models.length > 0 ? (_jsxs(Button, { variant: "outline", size: "sm", className: "h-8 gap-1.5 text-xs", disabled: disabled || busy || verifyPending, onClick: onVerify, children: [verifyPending
                                                             ? _jsx(Loader2, { "aria-hidden": "true", className: "h-3.5 w-3.5 animate-spin" })
                                                             : _jsx(RotateCw, { "aria-hidden": "true", className: "h-3.5 w-3.5" }), verifyPending ? '同步中...' : '刷新模型'] })) : onVerify ? (_jsxs(Button, { variant: "outline", size: "sm", className: "h-8 gap-1.5 text-xs", disabled: disabled || busy || verifyPending, onClick: onVerify, children: [verifyPending
                                                             ? _jsx(Loader2, { "aria-hidden": "true", className: "h-3.5 w-3.5 animate-spin" })

package/node_modules/@undefineds.co/ai-connections/dist/AiProviderHeader.js

@@ -8,5 +8,5 @@ import { AiInfoTooltip } from './AiInfoTooltip.js';
  * anatomy lives here once instead of being re-typed per page.
  */
 export function AiProviderHeader({ name, mark, avatar, avatarBackground, infoLabel, infoLines, link, links = [], badge, }) {
-    return (_jsxs("header", { className: "flex items-start justify-between gap-4", children: [_jsxs("div", { className: "flex items-center gap-3", children: [_jsxs(Avatar, { className: "h-9 w-9 shrink-0 rounded-lg border border-border/50 bg-muted/50 shadow-sm", style: avatarBackground ? { backgroundColor: avatarBackground } : undefined, children: [_jsx(AvatarImage, { src: avatar, className: "object-cover" }), _jsx(AvatarFallback, { className: "rounded-lg bg-transparent text-sm font-bold uppercase text-muted-foreground", children: mark })] }), _jsxs("div", { className: "flex flex-col justify-center gap-0.5", children: [_jsxs("div", { className: "flex items-center gap-2", children: [_jsx("h2", { className: "text-base font-semibold leading-none tracking-tight text-foreground", children: name }), _jsx(AiInfoTooltip, { label: infoLabel, lines: infoLines })] }), _jsx("div", { role: "group", "aria-label": `${name}官方链接`, className: "flex flex-wrap items-center gap-x-3 gap-y-1", children: [link, ...links].map((item) => (_jsxs("a", { href: item.href, target: "_blank", rel: "noopener noreferrer", className: "inline-flex items-center gap-0.5 text-[10px] leading-none text-muted-foreground transition-colors hover:text-primary", children: [item.label, " ", _jsx(ExternalLink, { "aria-hidden": "true", className: "h-2.5 w-2.5" })] }, item.href))) })] })] }), badge] }));
+    return (_jsxs("header", { className: "flex flex-wrap items-start justify-between gap-4", children: [_jsxs("div", { className: "flex min-w-0 items-center gap-3", children: [_jsxs(Avatar, { className: "h-9 w-9 shrink-0 rounded-lg border border-border/50 bg-muted/50 shadow-sm", style: avatarBackground ? { backgroundColor: avatarBackground } : undefined, children: [_jsx(AvatarImage, { src: avatar, className: "object-cover" }), _jsx(AvatarFallback, { className: "rounded-lg bg-transparent text-sm font-bold uppercase text-muted-foreground", children: mark })] }), _jsxs("div", { className: "flex min-w-0 flex-col justify-center gap-0.5", children: [_jsxs("div", { className: "flex min-w-0 items-center gap-2", children: [_jsx("h2", { className: "text-base font-semibold leading-none tracking-tight text-foreground", children: name }), _jsx(AiInfoTooltip, { label: infoLabel, lines: infoLines })] }), _jsx("div", { role: "group", "aria-label": `${name}官方链接`, className: "flex flex-wrap items-center gap-x-3 gap-y-1", children: [link, ...links].map((item) => (_jsxs("a", { href: item.href, target: "_blank", rel: "noopener noreferrer", className: "inline-flex items-center gap-0.5 text-[10px] leading-none text-muted-foreground transition-colors hover:text-primary", children: [item.label, " ", _jsx(ExternalLink, { "aria-hidden": "true", className: "h-2.5 w-2.5" })] }, item.href))) })] })] }), badge ? _jsx("div", { className: "shrink-0 whitespace-nowrap", children: badge }) : null] }));
 }

package/node_modules/@undefineds.co/ai-connections/dist/contract/client/fingerprint.d.ts

@@ -0,0 +1 @@
+export declare function apiKeyFingerprint(apiKey: string): Promise<string | undefined>;

package/node_modules/@undefineds.co/ai-connections/dist/contract/client/fingerprint.js

@@ -0,0 +1,7 @@
+export async function apiKeyFingerprint(apiKey) {
+    const subtle = globalThis.crypto?.subtle;
+    if (!subtle)
+        return undefined;
+    const digest = await subtle.digest('SHA-256', new TextEncoder().encode(apiKey));
+    return [...new Uint8Array(digest)].map((byte) => byte.toString(16).padStart(2, '0')).join('');
+}

package/node_modules/@undefineds.co/ai-connections/dist/contract/client/normalize.d.ts

@@ -1,4 +1,4 @@
-import type { AiConnectAttempt, AiConnectionsCredential, AiConnectionsProvider, AiGatewayModel, AiGatewayCatalogModel, AiProviderAuthorizationMethodsSummary, AiProviderCredentialSummary, AiProviderSummary, CustomProviderModel, GatewayKeyRecord, ProviderModelDiscovery } from './types.js';
+import type { AiConnectAttempt, AiConnectionsCredential, AiConnectionsProvider, AiGatewayModel, AiGatewayCatalogModel, AiProviderAuthorizationMethodsSummary, AiProviderCredentialSummary, AiProviderSummary, CustomProviderModel, ProviderModelDiscovery } from './types.js';
 /**
  * Everything that turns untrusted API payloads, user input and failures into the
  * shapes the rest of the app can rely on: proxy/pod URL normalising, error text,
@@ -38,7 +38,6 @@ export declare class AiConnectionsRequestError extends Error {
 export declare function aiConnectionsErrorCode(payload: unknown): string | undefined;
 export declare function readJson(response: Response): Promise<unknown>;
 export declare function assertProvider(provider: string): asserts provider is AiConnectionsProvider;
-export declare function parseGatewayKeyRecord(value: unknown): GatewayKeyRecord | undefined;
 export declare function parseCustomModelList(value: unknown): CustomProviderModel[];
 export declare function parseGatewayModel(value: unknown): AiGatewayModel | undefined;
 export declare function parseGatewayCatalogModel(value: unknown): AiGatewayCatalogModel | undefined;

package/node_modules/@undefineds.co/ai-connections/dist/contract/client/normalize.js

@@ -101,39 +101,6 @@ export function assertProvider(provider) {
         throw new Error(`Unsupported AI provider: ${provider}`);
     }
 }
-export function parseGatewayKeyRecord(value) {
-    if (!isRecord(value)
-        || typeof value.id !== 'string'
-        || typeof value.owner !== 'string'
-        || !Array.isArray(value.scopes)
-        || !value.scopes.every((scope) => typeof scope === 'string')
-        || typeof value.createdAt !== 'string') {
-        return undefined;
-    }
-    return compactObject({
-        id: value.id,
-        kind: value.kind === 'client-credentials' ? value.kind : undefined,
-        credentialResource: stringValue(value.credentialResource),
-        fingerprint: stringValue(value.fingerprint),
-        owner: value.owner,
-        scopes: value.scopes,
-        createdAt: value.createdAt,
-        expiresAt: stringValue(value.expiresAt),
-        lastUsedAt: stringValue(value.lastUsedAt),
-        disabledAt: stringValue(value.disabledAt),
-        revokedAt: stringValue(value.revokedAt),
-        name: stringValue(value.name),
-        maskedHint: stringValue(value.maskedHint),
-        plaintextAvailable: typeof value.plaintextAvailable === 'boolean' ? value.plaintextAvailable : undefined,
-        // Recorded by the server when the credential was issued/applied; the app
-        // needs them to revoke the CSS credential without a stored secret.
-        clientCredentialId: stringValue(value.clientCredentialId),
-        appliedTo: stringValue(value.appliedTo),
-        appliedOn: stringValue(value.appliedOn),
-        appliedAt: stringValue(value.appliedAt),
-        appliedClients: stringListValue(value.appliedClients),
-    });
-}
 export function parseCustomModelList(value) {
     if (!Array.isArray(value)) {
         throw new Error('AI Connection returned an invalid custom models response');

package/node_modules/@undefineds.co/ai-connections/dist/contract/client/request.d.ts

@@ -4,4 +4,4 @@ import type { AiConnectionsClient, CreateAiConnectionsClientInput } from './type
  * fetch, with every response normalised by `normalize.ts`.
  */
 export declare function resolveAiConnectionsApiBase(podBaseUrl: string): string;
-export declare function createAiConnectionsClient({ webId, podBaseUrl, authenticatedFetch, }: CreateAiConnectionsClientInput): AiConnectionsClient;
+export declare function createAiConnectionsClient({ webId, podBaseUrl, authenticatedFetch, clientCredentials, }: CreateAiConnectionsClientInput): AiConnectionsClient;

package/node_modules/@undefineds.co/ai-connections/dist/contract/client/request.js

@@ -1,4 +1,5 @@
-import { AiConnectionsRequestError, assertProvider, compactObject, isDefined, isRecord, parseAuthorizationMethodsSummary, parseConnectAttempt, parseCredential, parseCustomModelList, parseGatewayKeyRecord, parseGatewayModel, parseGatewayCatalogModel, parseModelDiscovery, parseProviderCredentialSummary, parseProviderSummaries, readJson, sanitizePublicObject, } from './normalize.js';
+import { apiKeyFingerprint } from './fingerprint.js';
+import { AiConnectionsRequestError, assertProvider, compactObject, isDefined, isRecord, parseAuthorizationMethodsSummary, parseConnectAttempt, parseCredential, parseCustomModelList, parseGatewayModel, parseGatewayCatalogModel, parseModelDiscovery, parseProviderCredentialSummary, parseProviderSummaries, readJson, sanitizePublicObject, } from './normalize.js';
 /**
  * The HTTP client itself: one factory over the Pod base URL and an authenticated
  * fetch, with every response normalised by `normalize.ts`.
@@ -10,8 +11,44 @@ export function resolveAiConnectionsApiBase(podBaseUrl) {
     }
     return parsed.origin;
 }
-export function createAiConnectionsClient({ webId, podBaseUrl, authenticatedFetch, }) {
+export function createAiConnectionsClient({ webId, podBaseUrl, authenticatedFetch, clientCredentials, }) {
     const apiBase = resolveAiConnectionsApiBase(podBaseUrl);
+    /**
+     * Xpod key management is Account client-credentials management. A client that
+     * was built without the capability fails closed: it must never fall back to
+     * the Gateway key routes that this product no longer has, and the contract
+     * layer carries the fact (`account_client_credentials_unavailable`) rather
+     * than the sentence the applet shows.
+     */
+    const accountCredentials = () => {
+        if (!clientCredentials) {
+            throw new AiConnectionsRequestError({ code: 'account_client_credentials_unavailable' }, 0);
+        }
+        return clientCredentials;
+    };
+    /**
+     * The wrapper only exists in the session that issued it, so its digest is a
+     * session-local observation: refreshing the Account list must not erase the
+     * ability to verify the exact key just applied, and a reload must not invent
+     * one. Nothing here is persisted; the Account remains the only key index.
+     */
+    const observedFingerprints = new Map();
+    const accountEntryRecord = (entry, options = {}) => ({
+        id: entry.clientId,
+        kind: 'client-credentials',
+        credentialResource: entry.resource,
+        clientCredentialId: entry.clientId,
+        // The digest of the applied wrapper (identical to what the native adapter
+        // reports), never the Account client id: the UI compares the two, so a
+        // browser-side id here would make every verify look like a key change.
+        ...(options.fingerprint ? { fingerprint: options.fingerprint } : {}),
+        // Only the Account-verified WebID counts as ownership. An entry whose
+        // owner is unknown is never relabelled as the selected identity.
+        owner: entry.webId ?? webId,
+        name: options.name ?? entry.label ?? entry.clientId,
+        // The wrapper is only ever visible in the session that created it.
+        plaintextAvailable: false,
+    });
     const request = async (path, method, body, context = {}) => {
         const response = await authenticatedFetch(`${apiBase}${path}`, {
             method,
@@ -19,6 +56,7 @@ export function createAiConnectionsClient({ webId, podBaseUrl, authenticatedFetc
             mode: 'cors',
             headers: {
                 accept: 'application/json',
+                'X-Xpod-Pod-Url': podBaseUrl,
                 ...(body ? { 'content-type': 'application/json' } : {}),
             },
             ...(body ? { body: JSON.stringify(body) } : {}),
@@ -81,30 +119,38 @@ export function createAiConnectionsClient({ webId, podBaseUrl, authenticatedFetc
             return payload.data.map(parseGatewayCatalogModel).filter(isDefined);
         },
         async listGatewayKeys() {
-            const payload = await request('/api/ai/gateway/keys', 'GET');
-            return Array.isArray(payload.data)
-                ? payload.data.map(parseGatewayKeyRecord).filter(isDefined)
-                : [];
+            const entries = await accountCredentials().list();
+            return entries
+                // The Account can own credentials for several WebIDs; this page only
+                // ever shows the selected authenticated identity's rows.
+                .filter((entry) => entry.webId === webId)
+                .map((entry) => accountEntryRecord(entry, { fingerprint: observedFingerprints.get(entry.clientId) }));
         },
         async createGatewayKey(input) {
-            const payload = await request('/api/ai/gateway/keys', 'POST', compactObject(input));
-            if (typeof payload.key !== 'string' || !payload.key) {
-                throw new Error('Xpod did not return the new API Key');
-            }
-            const record = parseGatewayKeyRecord(payload.record);
-            if (!record)
-                throw new Error('Xpod returned an invalid API Key record');
-            return { plaintext: payload.key, record };
-        },
-        async updateGatewayKey(keyId, input) {
-            const payload = await request(`/api/ai/gateway/keys/${encodeURIComponent(keyId)}`, 'PATCH', input);
-            const record = parseGatewayKeyRecord(payload.record);
-            if (!record)
-                throw new Error('Xpod returned an invalid API Key record');
-            return record;
+            const issued = await accountCredentials().create({ name: input.name, webId });
+            const fingerprint = await apiKeyFingerprint(issued.apiKey);
+            if (fingerprint)
+                observedFingerprints.set(issued.clientId, fingerprint);
+            return {
+                plaintext: issued.apiKey,
+                record: {
+                    ...accountEntryRecord({ clientId: issued.clientId, label: input.name, resource: issued.resource, webId }, { name: input.name, fingerprint }),
+                    // The wrapper exists right now, in this session: this row is not the
+                    // "cannot show it again" case the plain list row is.
+                    plaintextAvailable: undefined,
+                    ...(input.appliedTo ? { appliedTo: input.appliedTo } : {}),
+                },
+            };
         },
         async deleteGatewayKey(keyId) {
-            await request(`/api/ai/gateway/keys/${encodeURIComponent(keyId)}`, 'DELETE');
+            const credentials = accountCredentials();
+            const target = (await credentials.list())
+                .find((entry) => entry.clientId === keyId && entry.webId === webId);
+            // The Account is the only key index, so a credential it no longer lists is
+            // a fact the caller reports, not a Pod record this client can recreate.
+            if (!target)
+                throw new AiConnectionsRequestError({ code: 'account_client_credential_not_found' }, 0);
+            await credentials.revoke({ clientId: target.clientId, resource: target.resource, webId });
         },
         async beginConnect(provider, mode, options) {
             return await requestConnect(provider, '/connect/begin', 'POST', compactObject({

package/node_modules/@undefineds.co/ai-connections/dist/contract/client/types.d.ts

@@ -2,7 +2,7 @@ import type { AIModelClass } from '@undefineds.co/models';
 /**
  * Wire and view types of the AI connections API. No behaviour.
  */
-import type { AiConnectionsModelSelection, AiConnectionsOAuthCredential } from '@undefineds.co/extension-sdk/web';
+import type { AiClientCredentialsCapability, AiConnectionsModelSelection, AiConnectionsOAuthCredential } from '@undefineds.co/extension-sdk/web';
 export declare const AI_CONNECTIONS_PROVIDERS: readonly ["openai", "anthropic", "kimi", "bailian", "deepseek", "zhipu", "ollama", "custom"];
 export type AiConnectionsProvider = (typeof AI_CONNECTIONS_PROVIDERS)[number];
 export type AiConnectionsMode = 'browserAssistedApiKey' | 'deviceCodeOAuth' | 'authorizationCodeOAuth' | 'connectUnsupported';
@@ -57,14 +57,32 @@ export interface AiQuotaSnapshot {
     source: string;
     stale?: boolean;
 }
+/**
+ * One row of the Xpod key list as the page renders it.
+ *
+ * The Account owns the credential, so a record carries identity
+ * (`id`/`clientCredentialId`/`credentialResource`) and the label the user gave
+ * it. `lastUsedAt`/`appliedAt`/`expiresAt`/`appliedTo` are session-local
+ * observations or absent: the Account does not own them, and nothing here is a
+ * second key index.
+ */
 export interface GatewayKeyRecord {
     id: string;
     kind?: 'client-credentials';
     credentialResource?: string;
+    /**
+     * Digest of the `sk-` wrapper the known client configuration was written with
+     * (the same value the native adapters report as `apiKeyFingerprint`), never a
+     * secret. It is a session-local observation: the Account owns no wrapper, so a
+     * row restored from the Account list has no digest and cannot be tested. The
+     * credential's equality identity stays `clientCredentialId`.
+     */
     fingerprint?: string;
     owner: string;
-    scopes: string[];
-    createdAt: string;
+    /** Account-owned scopes are not projected here; the wrapper's reach is the Pod. */
+    scopes?: string[];
+    /** Account credits carry no creation timestamp; absent rather than invented. */
+    createdAt?: string;
     expiresAt?: string;
     lastUsedAt?: string;
     disabledAt?: string;
@@ -283,19 +301,22 @@ export interface AiConnectionsClient {
     listGatewayModels?(): Promise<AiGatewayModel[]>;
     /** Complete Gateway directory, including platform routing roles and unattributed entries. */
     listGatewayCatalogModels?(): Promise<AiGatewayCatalogModel[]>;
+    /**
+     * Xpod key management is Account client-credentials management. These three
+     * calls are backed by the host's `AiClientCredentialsCapability` and never by
+     * a Gateway key route: a client without that capability fails closed.
+     *
+     * There is deliberately no enable/disable call - the Account has no such
+     * capability - and no reveal call: the `sk-` wrapper exists only in the create
+     * response and in `plaintexts` for the session that issued it.
+     */
     listGatewayKeys(): Promise<GatewayKeyRecord[]>;
     createGatewayKey(input: {
         name: string;
-        apiKey?: string;
         credentialResource?: string;
-        /** Client application the credential is written into; recorded with the key. */
+        /** Client application the key is meant for; a session-local annotation only. */
         appliedTo?: string;
-        scopes?: string[];
-        expiresAt?: string;
     }): Promise<CreatedGatewayKey>;
-    updateGatewayKey(keyId: string, input: {
-        enabled: boolean;
-    }): Promise<GatewayKeyRecord>;
     deleteGatewayKey(keyId: string): Promise<void>;
     beginConnect(provider: AiConnectionsProvider, mode: AiConnectionsMode, options?: AiConnectionBeginOptions): Promise<AiConnectAttempt>;
     connectStatus(provider: AiConnectionsProvider, attempt: Pick<AiConnectAttempt, 'attemptId' | 'state' | 'signature' | 'offeringId'> & Partial<Pick<AiConnectAttempt, 'mode'>>): Promise<AiConnectAttempt>;
@@ -349,4 +370,10 @@ export interface CreateAiConnectionsClientInput {
     webId: string;
     podBaseUrl: string;
     authenticatedFetch: typeof fetch;
+    /**
+     * The Account client-credentials capability that backs Xpod key management.
+     * Optional at the type level so a Pod-only client still type-checks, but the
+     * three key calls fail closed without it.
+     */
+    clientCredentials?: AiClientCredentialsCapability;
 }

package/node_modules/@undefineds.co/ai-connections/dist/controller.js

@@ -121,11 +121,14 @@ export function createAiConnectionsController(host) {
         return guard;
     };
     const client = authenticated
-        ? createInteractiveAiConnectionsClient(withAccountClientCredentials(createAiConnectionsClient({
+        ? createInteractiveAiConnectionsClient(createAiConnectionsClient({
             webId: sessionSnapshot.webId,
             podBaseUrl: readyPod.current.podUrl,
             authenticatedFetch: host.solid.session.fetch,
-        }), host.capabilities.aiClientCredentials), host.capabilities.aiConnectionsPodStore, liveCredentials, beginProviderLoad)
+            // Account client credentials are the only Xpod key store there is; the
+            // key calls are backed by this capability and never by a Pod route.
+            clientCredentials: host.capabilities.aiClientCredentials,
+        }), host.capabilities.aiConnectionsPodStore, liveCredentials, beginProviderLoad)
         : null;
     let selectedSection = 'keys';
     let selectedProvider = 'openai';
@@ -445,50 +448,6 @@ export function createAiConnectionsController(host) {
     };
     return controller;
 }
-function withAccountClientCredentials(client, credentials) {
-    return {
-        ...client,
-        async createGatewayKey(input) {
-            if (!credentials)
-                throw new Error('当前账号登录状态不支持创建客户端凭据。');
-            const issued = await credentials.create({ name: input.name, webId: client.webId });
-            try {
-                // The wrapper is issued here; the declared purpose and the rest of the
-                // caller's input travel with it so the record keeps where it applies.
-                return await client.createGatewayKey({
-                    ...input,
-                    apiKey: issued.apiKey,
-                    credentialResource: issued.resource,
-                });
-            }
-            catch (cause) {
-                try {
-                    await credentials.revoke({
-                        clientId: clientIdFromApiKey(issued.apiKey), resource: issued.resource, webId: client.webId,
-                    });
-                }
-                catch {
-                    throw new Error('API Key 未能保存到 Pod，且账号凭据撤销失败。该凭据尚未应用到客户端。');
-                }
-                throw cause;
-            }
-        },
-        async deleteGatewayKey(keyId) {
-            const record = (await client.listGatewayKeys()).find((key) => key.id === keyId);
-            if (record?.kind === 'client-credentials') {
-                if (!credentials || !record.clientCredentialId) {
-                    throw new Error('当前账号登录状态无法撤销此客户端凭据，Key 记录已保留。');
-                }
-                const issued = await credentials.list();
-                const target = issued.find((entry) => entry.clientId === record.clientCredentialId);
-                if (!target)
-                    throw new Error('账号服务中已找不到该客户端凭据，请刷新后重试。');
-                await credentials.revoke({ clientId: target.clientId, resource: target.resource, webId: client.webId });
-            }
-            await client.deleteGatewayKey(keyId);
-        },
-    };
-}
 function createInteractiveAiConnectionsClient(operationsClient, podStore, live, beginProviderLoad) {
     const listProviders = async () => {
         const guard = beginProviderLoad();
@@ -1032,11 +991,3 @@ function isDefined(value) {
 function errorMessage(error) {
     return aiConnectionsErrorMessage(error);
 }
-/** The wrapper carries the OIDC client id; parsing it needs no stored secret. */
-function clientIdFromApiKey(apiKey) {
-    const decoded = atob(apiKey.replace(/^sk-/u, ''));
-    const separator = decoded.indexOf(':');
-    if (separator <= 0)
-        throw new Error('客户端凭据格式无效。');
-    return decoded.slice(0, separator);
-}

package/node_modules/@undefineds.co/ai-connections/dist/error-wording.js

@@ -171,10 +171,15 @@ function messageForSafeErrorCode(code, provider) {
             return '模型已获取，但保存到 Pod 失败。请重试同步模型。';
         case 'quota_credential_not_found':
             return '当前身份没有可用的额度凭证。';
+        case 'account_client_credentials_unavailable':
+            // Xpod keys are Account client credentials; a host without the Account
+            // capability has no key surface at all, so the user must re-enter from a
+            // signed-in Account session.
+            return 'Xpod 密钥 需要当前 Account 登录状态：这个客户端没有 Account 客户端凭据能力。';
+        case 'account_client_credential_not_found':
+            return '账号服务中已找不到该客户端凭据，请刷新后重试。';
         case 'credential_secret_unavailable':
             return '当前凭证密钥不可用，请重新保存后再查询额度。';
-        case 'gateway_api_key_plaintext_unavailable':
-            return 'Pod 中未找到此 API Key 的原文，无法复制配置。请创建新的 Key，更新客户端后再删除旧 Key。';
         case 'quota_adapter_not_found':
             return '该接入方式不支持查询官方额度。';
         default: