@undefineds.co/xpod 0.4.29 → 0.4.30

package/static/settings/auth-callback.html

@@ -6,9 +6,9 @@
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <script src="/settings/theme-init.js"></script>
     <title>正在完成 Xpod 登录</title>
-    <script type="module" crossorigin src="/settings/assets/auth-callback-GIBYEz_7.js"></script>
-    <link rel="modulepreload" crossorigin href="/settings/assets/XpodThemeProvider-DK3pIdRG.js">
-    <link rel="stylesheet" crossorigin href="/settings/assets/XpodThemeProvider-CbJ-JkrI.css">
+    <script type="module" crossorigin src="/settings/assets/auth-callback-PWS7okI8.js"></script>
+    <link rel="modulepreload" crossorigin href="/settings/assets/XpodThemeProvider-rUdAw66p.js">
+    <link rel="stylesheet" crossorigin href="/settings/assets/XpodThemeProvider-hSOBxPcP.css">
   </head>
   <body class="bg-background text-foreground">
     <div id="root"></div>

package/static/settings/settings.html

@@ -6,9 +6,9 @@
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <script src="/settings/theme-init.js"></script>
     <title>Xpod · 工作台</title>
-    <script type="module" crossorigin src="/settings/assets/settings-CyQPih1O.js"></script>
-    <link rel="modulepreload" crossorigin href="/settings/assets/XpodThemeProvider-DK3pIdRG.js">
-    <link rel="stylesheet" crossorigin href="/settings/assets/XpodThemeProvider-CbJ-JkrI.css">
+    <script type="module" crossorigin src="/settings/assets/settings-CpoDG_Qr.js"></script>
+    <link rel="modulepreload" crossorigin href="/settings/assets/XpodThemeProvider-rUdAw66p.js">
+    <link rel="stylesheet" crossorigin href="/settings/assets/XpodThemeProvider-hSOBxPcP.css">
   </head>
   <body class="bg-background text-foreground">
     <div id="root"></div>

package/dist/api/ai-gateway/auth/GatewayApiKey.d.ts

@@ -1,28 +0,0 @@
-export type GatewayDeployment = 'local' | 'cloud';
-export interface ParsedGatewayApiKey {
-    version: 'v1';
-    deployment: GatewayDeployment;
-    keyId: string;
-    secret: string;
-}
-export interface GatewayApiKeyRecordInput {
-    id: string;
-    secretHash: string;
-    deployment: GatewayDeployment;
-}
-export interface CreatedGatewayApiKey {
-    plaintext: string;
-    secret: string;
-    record: GatewayApiKeyRecordInput;
-}
-export interface CreateGatewayApiKeyInput {
-    deployment: GatewayDeployment;
-    keyId?: string;
-    secret?: string;
-}
-export declare function createGatewayApiKey(input: CreateGatewayApiKeyInput): Promise<CreatedGatewayApiKey>;
-export declare function createGatewayKeyId(): string;
-export declare function formatGatewayApiKey(parsed: ParsedGatewayApiKey): string;
-export declare function parseGatewayApiKey(value: string): ParsedGatewayApiKey | undefined;
-export declare function hashGatewayApiKeySecret(secret: string): Promise<string>;
-export declare function verifyGatewayApiKeySecret(secret: string, encodedHash: string): Promise<boolean>;

package/dist/api/ai-gateway/auth/GatewayApiKey.js

@@ -1,162 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createGatewayApiKey = createGatewayApiKey;
-exports.createGatewayKeyId = createGatewayKeyId;
-exports.formatGatewayApiKey = formatGatewayApiKey;
-exports.parseGatewayApiKey = parseGatewayApiKey;
-exports.hashGatewayApiKeySecret = hashGatewayApiKeySecret;
-exports.verifyGatewayApiKeySecret = verifyGatewayApiKeySecret;
-const node_crypto_1 = require("node:crypto");
-const PREFIX = 'xpod_gw';
-const VERSION = 'v1';
-const SECRET_BYTES = 32;
-const KEY_ID_BYTES = 18;
-const SCRYPT_KEY_BYTES = 32;
-const SCRYPT_N = 16_384;
-const SCRYPT_R = 8;
-const SCRYPT_P = 1;
-const SCRYPT_MAXMEM = 32 * 1024 * 1024;
-async function createGatewayApiKey(input) {
-    const keyId = input.keyId ?? createGatewayKeyId();
-    const secret = input.secret ?? randomBase64Url(SECRET_BYTES);
-    const plaintext = formatGatewayApiKey({
-        version: VERSION,
-        deployment: input.deployment,
-        keyId,
-        secret,
-    });
-    return {
-        plaintext,
-        secret,
-        record: {
-            id: keyId,
-            deployment: input.deployment,
-            secretHash: await hashGatewayApiKeySecret(secret),
-        },
-    };
-}
-function createGatewayKeyId() {
-    return `gak_${randomBase64Url(KEY_ID_BYTES)}`;
-}
-function formatGatewayApiKey(parsed) {
-    assertDeployment(parsed.deployment);
-    if (!parsed.keyId || parsed.keyId.includes(' ') || parsed.keyId.includes('/')) {
-        throw new Error('Invalid Gateway API key id');
-    }
-    if (!parsed.secret || !/^[A-Za-z0-9-]+$/.test(parsed.secret)) {
-        throw new Error('Invalid Gateway API key secret');
-    }
-    return `${PREFIX}_${parsed.version}_${parsed.deployment}_${parsed.keyId}_${parsed.secret}`;
-}
-function parseGatewayApiKey(value) {
-    const parts = value.split('_');
-    if (parts.length < 6 || parts[0] !== 'xpod' || parts[1] !== 'gw' || parts[2] !== VERSION) {
-        return undefined;
-    }
-    const deployment = parts[3];
-    if (deployment !== 'local' && deployment !== 'cloud') {
-        return undefined;
-    }
-    const secret = parts[parts.length - 1];
-    const keyId = parts.slice(4, -1).join('_');
-    if (!keyId || !secret || !/^[A-Za-z0-9-]+$/.test(secret)) {
-        return undefined;
-    }
-    return {
-        version: VERSION,
-        deployment,
-        keyId,
-        secret,
-    };
-}
-async function hashGatewayApiKeySecret(secret) {
-    const salt = randomBase64Url(16);
-    const key = await deriveScrypt(secret, salt, SCRYPT_N, SCRYPT_R, SCRYPT_P);
-    return [
-        'scrypt',
-        'v=1',
-        `N=${SCRYPT_N}`,
-        `r=${SCRYPT_R}`,
-        `p=${SCRYPT_P}`,
-        `salt=${salt}`,
-        `key=${key.toString('base64url')}`,
-    ].join('$');
-}
-async function verifyGatewayApiKeySecret(secret, encodedHash) {
-    const parsed = parseScryptHash(encodedHash);
-    if (!parsed) {
-        return false;
-    }
-    let actual;
-    try {
-        actual = await deriveScrypt(secret, parsed.salt, parsed.N, parsed.r, parsed.p);
-    }
-    catch {
-        return false;
-    }
-    const expected = Buffer.from(parsed.key, 'base64url');
-    if (actual.byteLength !== expected.byteLength) {
-        const paddedActual = Buffer.alloc(SCRYPT_KEY_BYTES);
-        const paddedExpected = Buffer.alloc(SCRYPT_KEY_BYTES);
-        actual.copy(paddedActual, 0, 0, Math.min(actual.byteLength, SCRYPT_KEY_BYTES));
-        expected.copy(paddedExpected, 0, 0, Math.min(expected.byteLength, SCRYPT_KEY_BYTES));
-        (0, node_crypto_1.timingSafeEqual)(paddedActual, paddedExpected);
-        return false;
-    }
-    return (0, node_crypto_1.timingSafeEqual)(actual, expected);
-}
-function parseScryptHash(encodedHash) {
-    const parts = encodedHash.split('$');
-    if (parts.length !== 7
-        || parts[0] !== 'scrypt'
-        || parts[1] !== 'v=1'
-        || parts[2] !== `N=${SCRYPT_N}`
-        || parts[3] !== `r=${SCRYPT_R}`
-        || parts[4] !== `p=${SCRYPT_P}`
-        || !parts[5]?.startsWith('salt=')
-        || !parts[6]?.startsWith('key=')) {
-        return undefined;
-    }
-    const salt = parts[5].slice('salt='.length);
-    const key = parts[6].slice('key='.length);
-    if (!isBase64UrlBytes(salt, 16) || !isBase64UrlBytes(key, SCRYPT_KEY_BYTES)) {
-        return undefined;
-    }
-    return { N: SCRYPT_N, r: SCRYPT_R, p: SCRYPT_P, salt, key };
-}
-function isBase64UrlBytes(value, bytes) {
-    if (!/^[A-Za-z0-9_-]+$/.test(value)) {
-        return false;
-    }
-    try {
-        return Buffer.from(value, 'base64url').byteLength === bytes;
-    }
-    catch {
-        return false;
-    }
-}
-async function deriveScrypt(secret, salt, N, r, p) {
-    return await new Promise((resolve, reject) => {
-        (0, node_crypto_1.scrypt)(secret, salt, SCRYPT_KEY_BYTES, {
-            N,
-            r,
-            p,
-            maxmem: SCRYPT_MAXMEM,
-        }, (error, derivedKey) => {
-            if (error) {
-                reject(error);
-                return;
-            }
-            resolve(derivedKey);
-        });
-    });
-}
-function randomBase64Url(bytes) {
-    return (0, node_crypto_1.randomBytes)(bytes).toString('base64url').replaceAll('_', '-');
-}
-function assertDeployment(deployment) {
-    if (deployment !== 'local' && deployment !== 'cloud') {
-        throw new Error(`Invalid Gateway API key deployment: ${deployment}`);
-    }
-}
-//# sourceMappingURL=GatewayApiKey.js.map

package/dist/api/ai-gateway/auth/GatewayKeyLocatorCodec.d.ts

@@ -1,26 +0,0 @@
-import type { GatewayDeployment } from './GatewayApiKey';
-export interface GatewayKeyLocatorPayload {
-    owner: string;
-    keyId: string;
-    deployment: GatewayDeployment;
-}
-export interface GatewayKeyLocatorCodec {
-    encode(payload: GatewayKeyLocatorPayload): string;
-    decode(locator: string): GatewayKeyLocatorPayload | undefined;
-}
-export interface GatewayKeyLocatorSecret {
-    kid: string;
-    secret: string;
-}
-export interface AesGatewayKeyLocatorCodecOptions {
-    active: GatewayKeyLocatorSecret;
-    previous?: GatewayKeyLocatorSecret[];
-}
-export declare class AesGatewayKeyLocatorCodec implements GatewayKeyLocatorCodec {
-    private readonly active;
-    private readonly ring;
-    constructor(secretOrOptions: string | AesGatewayKeyLocatorCodecOptions);
-    encode(payload: GatewayKeyLocatorPayload): string;
-    decode(locator: string): GatewayKeyLocatorPayload | undefined;
-}
-export declare function createGatewayKeyLocator(owner: string, deployment: GatewayDeployment, codec: GatewayKeyLocatorCodec): string;

package/dist/api/ai-gateway/auth/GatewayKeyLocatorCodec.js

@@ -1,97 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.AesGatewayKeyLocatorCodec = void 0;
-exports.createGatewayKeyLocator = createGatewayKeyLocator;
-const node_crypto_1 = require("node:crypto");
-const PREFIX = 'gakv1';
-const NONCE_BYTES = 12;
-const KEY_BYTES = 32;
-class AesGatewayKeyLocatorCodec {
-    constructor(secretOrOptions) {
-        this.ring = new Map();
-        const options = typeof secretOrOptions === 'string'
-            ? { active: { kid: 'default', secret: secretOrOptions } }
-            : secretOrOptions;
-        this.active = normalizeSecret(options.active);
-        this.ring.set(this.active.kid, this.active.key);
-        for (const previous of options.previous ?? []) {
-            const normalized = normalizeSecret(previous);
-            if (this.ring.has(normalized.kid)) {
-                throw new Error(`Duplicate Gateway key locator key id: ${normalized.kid}`);
-            }
-            this.ring.set(normalized.kid, normalized.key);
-        }
-    }
-    encode(payload) {
-        const nonce = (0, node_crypto_1.randomBytes)(NONCE_BYTES);
-        const aad = Buffer.from(`${PREFIX}.${this.active.kid}`);
-        const cipher = (0, node_crypto_1.createCipheriv)('aes-256-gcm', this.active.key, nonce);
-        cipher.setAAD(aad);
-        const plaintext = Buffer.from(JSON.stringify(payload), 'utf8');
-        const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);
-        const tag = cipher.getAuthTag();
-        return [
-            PREFIX,
-            this.active.kid,
-            nonce.toString('base64url'),
-            ciphertext.toString('base64url'),
-            tag.toString('base64url'),
-        ].join('.');
-    }
-    decode(locator) {
-        const parts = locator.split('.');
-        if (parts.length !== 5 || parts[0] !== PREFIX) {
-            return undefined;
-        }
-        const kid = parts[1];
-        const key = this.ring.get(kid);
-        if (!key) {
-            return undefined;
-        }
-        try {
-            const nonce = Buffer.from(parts[2], 'base64url');
-            const ciphertext = Buffer.from(parts[3], 'base64url');
-            const tag = Buffer.from(parts[4], 'base64url');
-            const decipher = (0, node_crypto_1.createDecipheriv)('aes-256-gcm', key, nonce);
-            decipher.setAAD(Buffer.from(`${PREFIX}.${kid}`));
-            decipher.setAuthTag(tag);
-            const plaintext = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
-            const parsed = JSON.parse(plaintext.toString('utf8'));
-            if (typeof parsed.owner !== 'string'
-                || typeof parsed.keyId !== 'string'
-                || (parsed.deployment !== 'local' && parsed.deployment !== 'cloud')) {
-                return undefined;
-            }
-            return {
-                owner: parsed.owner,
-                keyId: parsed.keyId,
-                deployment: parsed.deployment,
-            };
-        }
-        catch {
-            return undefined;
-        }
-    }
-}
-exports.AesGatewayKeyLocatorCodec = AesGatewayKeyLocatorCodec;
-function normalizeSecret(input) {
-    const kid = input.kid.trim();
-    if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.test(kid)) {
-        throw new Error('Gateway key locator key id is invalid');
-    }
-    if (!input.secret.trim()) {
-        throw new Error('Gateway key locator secret is required');
-    }
-    return {
-        kid,
-        key: (0, node_crypto_1.createHash)('sha256').update(input.secret).digest().subarray(0, KEY_BYTES),
-    };
-}
-function createGatewayKeyLocator(owner, deployment, codec) {
-    return codec.encode({
-        owner,
-        deployment,
-        keyId: `gak_${(0, node_crypto_1.randomBytes)(18).toString('base64url')}`,
-    });
-}
-//# sourceMappingURL=GatewayKeyLocatorCodec.js.map

package/dist/api/ai-gateway/auth/PodGatewayAccessKeyRepository.d.ts

@@ -1,67 +0,0 @@
-import { credentialResource, gatewayAccessKeyResource, type GatewayAccessKeyRow } from '@undefineds.co/models';
-import type { AuthContext } from '../../auth/AuthContext';
-import { type PodAccessFetchProvider } from '../pod/OwnerPodAccess';
-import { type PodBaseUrlResolver } from '../pod/PodBaseUrlResolver';
-import { type GatewayKeyLocatorCodec } from './GatewayKeyLocatorCodec';
-import { type GatewayAccessKeyRecord, type GatewayAccessKeyRepository, type GatewayAccessKeyRepositoryContext } from './GatewayApiKeyAuthenticator';
-import type { GatewayDeployment } from './GatewayApiKey';
-/** Schema resources this repository reads and writes in the owner's Pod. */
-type PodSchemaResource = typeof gatewayAccessKeyResource | typeof credentialResource;
-type GatewayAccessKeyDb = {
-    init?: (...resources: unknown[]) => Promise<void>;
-    insert(resource: PodSchemaResource): {
-        values(value: unknown): {
-            execute(): Promise<unknown[]>;
-        };
-    };
-    select(): {
-        from(resource: PodSchemaResource): {
-            where(condition: unknown): {
-                execute(): Promise<GatewayAccessKeyRow[]>;
-            };
-        };
-    };
-    findById<TRow>(resource: PodSchemaResource, id: string): Promise<TRow | null>;
-    findByIri<TRow>(resource: PodSchemaResource, iri: string): Promise<TRow | null>;
-    updateById<TRow>(resource: PodSchemaResource, id: string, patch: unknown): Promise<TRow | null>;
-    updateByIri?<TRow>(resource: PodSchemaResource, iri: string, patch: unknown): Promise<TRow | null>;
-    deleteById?(resource: PodSchemaResource, id: string): Promise<unknown>;
-};
-type GatewayAccessKeyResource = typeof gatewayAccessKeyResource;
-export interface PodGatewayAccessKeyRepositoryOptions {
-    locatorCodec: GatewayKeyLocatorCodec;
-    podAccess?: PodAccessFetchProvider;
-    podBaseUrlResolver?: PodBaseUrlResolver;
-    dbFactory?: (input: {
-        owner: string;
-        auth?: AuthContext;
-        fetch: typeof fetch;
-        podUrl: string;
-        resource?: GatewayAccessKeyResource;
-        listResource?: GatewayAccessKeyResource;
-        credentialListResource?: typeof credentialResource;
-    }) => Promise<GatewayAccessKeyDb>;
-}
-export declare class PodGatewayAccessKeyRepository implements GatewayAccessKeyRepository {
-    private readonly dbFactory;
-    private readonly locatorCodec;
-    private readonly podAccess?;
-    private readonly podBaseUrlResolver?;
-    private readonly usesDefaultDbFactory;
-    constructor(options: PodGatewayAccessKeyRepositoryOptions);
-    createKeyId(owner: string, deployment: GatewayDeployment): string;
-    create(record: GatewayAccessKeyRecord, context?: GatewayAccessKeyRepositoryContext): Promise<GatewayAccessKeyRecord>;
-    findById(id: string, context?: GatewayAccessKeyRepositoryContext): Promise<GatewayAccessKeyRecord | undefined>;
-    listByOwner(owner: string, context?: GatewayAccessKeyRepositoryContext): Promise<GatewayAccessKeyRecord[]>;
-    setEnabled(id: string, enabled: boolean, changedAt: Date, context?: GatewayAccessKeyRepositoryContext): Promise<GatewayAccessKeyRecord | undefined>;
-    revoke(id: string, revokedAt: Date, context?: GatewayAccessKeyRepositoryContext): Promise<GatewayAccessKeyRecord | undefined>;
-    delete(id: string, context?: GatewayAccessKeyRepositoryContext): Promise<boolean>;
-    revealPlaintext(id: string, context?: GatewayAccessKeyRepositoryContext): Promise<string | undefined>;
-    touchLastUsed(id: string, lastUsedAt: Date, context?: GatewayAccessKeyRepositoryContext): Promise<void>;
-    private dbForOwner;
-    private resolveTrustedFetch;
-    private wrapPodFetch;
-}
-/** Derived provider id of the built-in Xpod gateway provider; no provider row is persisted. */
-export declare function clientCredentialProviderId(): string;
-export {};