@undefineds.co/xpod 0.4.29 → 0.4.30

package/dist/api/ai-gateway/service-access/AiConnectionsServiceAccess.js

@@ -2,21 +2,11 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AI_CONNECTIONS_PROVIDER_DOCUMENT_IDS = exports.AI_CONNECTIONS_APPLET_ID = void 0;
 exports.createAiConnectionsServiceAccess = createAiConnectionsServiceAccess;
-exports.resolveGatewayAccessKeyResourceUrl = resolveGatewayAccessKeyResourceUrl;
-exports.resolveGatewayAccessKeySecretResourceUrl = resolveGatewayAccessKeySecretResourceUrl;
-exports.resolveGatewayAccessKeySparqlEndpoint = resolveGatewayAccessKeySparqlEndpoint;
-exports.isGatewayAccessKeySparqlEndpoint = isGatewayAccessKeySparqlEndpoint;
 const drizzle_solid_1 = require("@undefineds.co/drizzle-solid");
 const provider_catalog_1 = require("@undefineds.co/ai-connections/provider-catalog");
 Object.defineProperty(exports, "AI_CONNECTIONS_PROVIDER_DOCUMENT_IDS", { enumerable: true, get: function () { return provider_catalog_1.AI_CONNECTIONS_PROVIDER_DOCUMENT_IDS; } });
-const models_1 = require("@undefineds.co/models");
+const service_access_resources_1 = require("@undefineds.co/ai-connections/service-access-resources");
 exports.AI_CONNECTIONS_APPLET_ID = 'co.undefineds.ai-connections';
-const declaredResourceBases = new WeakMap([
-    [models_1.credentialResource, declaredResourceBase(models_1.credentialResource)],
-    [models_1.aiProviderResource, declaredResourceBase(models_1.aiProviderResource)],
-    [models_1.gatewayAccessKeyResource, declaredResourceBase(models_1.gatewayAccessKeyResource)],
-    [models_1.quotaSnapshotResource, declaredResourceBase(models_1.quotaSnapshotResource)],
-]);
 function createAiConnectionsServiceAccess(input) {
     return {
         appletId: exports.AI_CONNECTIONS_APPLET_ID,
@@ -24,62 +14,17 @@ function createAiConnectionsServiceAccess(input) {
             webId: input.serviceWebId,
             label: 'Xpod AI Connection',
         },
-        resources: [
-            ['providerCredentials', resourceUrl(input.ownerWebId, models_1.credentialResource, input.podBaseUrl)],
-            ['providerDefinitions', resourceUrl(input.ownerWebId, models_1.aiProviderResource, input.podBaseUrl)],
-            ['gatewayAccessKeys', resolveGatewayAccessKeyResourceUrl(input.ownerWebId, input.podBaseUrl)],
-            ['gatewayAccessKeySecrets', resolveGatewayAccessKeySecretResourceUrl(input.ownerWebId, input.podBaseUrl), 'application/json'],
-            ['quotaSnapshots', resourceUrl(input.ownerWebId, models_1.quotaSnapshotResource, input.podBaseUrl)],
-            ...provider_catalog_1.AI_CONNECTIONS_PROVIDER_DOCUMENT_IDS.map((provider) => [
-                `providerDocument:${provider}`,
-                providerDocumentUrl(input.ownerWebId, provider, input.podBaseUrl),
-            ]),
-        ].map(([id, url, mediaType]) => ({
+        resources: service_access_resources_1.AI_CONNECTIONS_SERVICE_RESOURCE_IDS.map(id => ({
             id,
-            url,
-            mediaType: mediaType ?? 'text/turtle',
+            ...requiredResourceLocation(id, input.ownerWebId, input.podBaseUrl),
             access: { read: true, append: true, write: true },
         })),
     };
 }
-function resolveGatewayAccessKeyResourceUrl(ownerWebId, podBaseUrl) {
-    return resourceUrl(ownerWebId, models_1.gatewayAccessKeyResource, podBaseUrl);
-}
-function resolveGatewayAccessKeySecretResourceUrl(ownerWebId, podBaseUrl) {
-    const podRoot = `${(podBaseUrl ?? (0, drizzle_solid_1.resolvePodBaseUrl)(ownerWebId)).replace(/\/$/u, '')}/`;
-    return new URL('.data/ai/gateway/access-key-secrets.json', podRoot).href;
-}
-function resolveGatewayAccessKeySparqlEndpoint(ownerWebId, podBaseUrl) {
-    return `${resolveGatewayAccessKeyResourceUrl(ownerWebId, podBaseUrl).replace(/\/$/u, '')}/-/sparql`;
-}
-function isGatewayAccessKeySparqlEndpoint(ownerWebId, resourceUrlValue) {
-    try {
-        const resource = typeof resourceUrlValue === 'string' ? new URL(resourceUrlValue) : resourceUrlValue;
-        const endpoint = new URL(resolveGatewayAccessKeySparqlEndpoint(ownerWebId));
-        return resource.origin === endpoint.origin && resource.pathname === endpoint.pathname;
-    }
-    catch {
-        return false;
-    }
-}
-function resourceUrl(ownerWebId, resource, podBaseUrl) {
-    const podRoot = `${(podBaseUrl ?? (0, drizzle_solid_1.resolvePodBaseUrl)(ownerWebId)).replace(/\/$/u, '')}/`;
-    const resourcePath = declaredResourceBases.get(resource);
-    if (!resourcePath) {
-        throw new Error('AI Connection resource is missing an immutable declared base');
-    }
-    const documentPath = resource.buildId({ id: '__service_access__' }).split('#')[0];
-    return new URL(`${resourcePath}/${documentPath}`.replace(/^\/+/u, ''), podRoot).href;
-}
-function providerDocumentUrl(ownerWebId, provider, podBaseUrl) {
-    const podRoot = `${(podBaseUrl ?? (0, drizzle_solid_1.resolvePodBaseUrl)(ownerWebId)).replace(/\/$/u, '')}/`;
-    return new URL(`settings/providers/${provider}.ttl`, podRoot).href;
-}
-function declaredResourceBase(resource) {
-    const base = resource.config?.base?.replace(/^\/+|\/+$/gu, '');
-    if (!base) {
-        throw new Error('AI Connection resource is missing a declared base');
-    }
-    return base;
+function requiredResourceLocation(id, ownerWebId, podBaseUrl) {
+    const location = (0, service_access_resources_1.resolveAiConnectionsServiceResource)(id, podBaseUrl ?? (0, drizzle_solid_1.resolvePodBaseUrl)(ownerWebId));
+    if (!location)
+        throw new Error('AI Connection resource is not declared');
+    return location;
 }
 //# sourceMappingURL=AiConnectionsServiceAccess.js.map

package/dist/api/auth/AuthContext.d.ts

@@ -9,6 +9,10 @@
  */
 export interface SolidAuthContext {
     type: 'solid';
+    /** Untrusted current-Pod selection hint; only the shared storage adapter may verify it. */
+    requestedPodUrl?: string;
+    /** Trusted Pod capability scope, from authenticated signed claims or a verified key DB. */
+    authorizedPodUrl?: string;
     webId: string;
     accountId?: string;
     clientId?: string;

package/dist/api/auth/ClientCredentialsAuthenticator.js

@@ -72,19 +72,25 @@ class ClientCredentialsAuthenticator {
                 // Non sk- format is intentionally unsupported; Xpod does not keep an API key mirror table.
                 return { success: false, error: 'Invalid client credentials wrapper: must start with sk-' };
             }
-            // One exchange per credential: the factory keeps the token together with the DPoP key it
-            // is bound to, so outbound Pod access reuses this session instead of exchanging again.
+            // Admission revalidates the wrapper against the issuer that owns it, on every request: a
+            // session cached for a previous request is not proof that this credential is still
+            // registered. The factory publishes the fresh session, so this same request's outbound Pod
+            // access reuses that token and its DPoP key instead of exchanging a second time.
             let session;
             try {
-                session = await this.sessions.session({ clientId, clientSecret });
+                session = await this.sessions.admit({ clientId, clientSecret });
             }
             catch (error) {
                 const status = error instanceof SolidSessionFactory_1.SolidSessionError ? error.status : undefined;
-                const unavailable = status === undefined || status >= 500;
+                // The issuer being unreachable, failing, or rate limiting us is not a statement about the
+                // credential. Only a definitive refusal (the 400/401/403 the factory treats as such) is an
+                // invalid credential; everything else is retryable availability, so it is reported as 503
+                // rather than telling the caller its key is dead.
+                const unavailable = status === undefined || status >= 500 || status === 429;
                 this.logger.warn(`Client credentials exchange failed for ${clientId.slice(0, 8)}...: ${String(error)}`);
                 return unavailable
                     ? { success: false, error: 'Token exchange temporarily unavailable', category: 'service_unavailable', statusCode: 503, cause: error }
-                    : { success: false, error: `Token exchange failed: ${status ?? 'unknown'}`, cause: error };
+                    : { success: false, error: `Token exchange failed: ${status ?? 'unknown'}`, category: 'invalid_credentials', statusCode: 401, cause: error };
             }
             if (!session.webId) {
                 return { success: false, error: 'Could not determine webId from token response' };

package/dist/api/auth/SolidSessionFactory.d.ts

@@ -34,11 +34,14 @@ export interface SolidSessionFactoryOptions {
     maxEntries?: number;
 }
 /**
- * Exchanges CSS client credentials for Solid tokens, once per credential.
+ * Exchanges CSS client credentials for Solid tokens.
  *
- * Inbound authentication and outbound Pod access share this cache, so one request that arrives
- * with an `sk-` wrapper and then reads the Pod performs a single token exchange and keeps the
- * key the token is bound to. Cache identity is the issuer, the complete credential and its
+ * Inbound admission is a fresh exchange with the issuer on every request: a session in this cache
+ * proves only that some earlier exchange succeeded, never that the credential is still
+ * registered. The cache serves the outbound side - one request that arrives with an `sk-` wrapper
+ * and then reads the Pod reuses the token its own admission just obtained instead of exchanging
+ * the same credential a second time, and repeated Pod work keeps a live token and the key it is
+ * bound to until it is spent. Cache identity is the issuer, the complete credential and its
  * version - never just the owner or the client id, which are public identification rather than
  * authentication evidence.
  */
@@ -53,9 +56,40 @@ export declare class SolidSessionFactory {
     /** Cache keys per client id, so a revoked credential can be forgotten without its secret. */
     private readonly keysByClientId;
     private readonly clientIdByKey;
+    /**
+     * Monotonic per-client invalidation counter. `admit` reads it before its exchange and only
+     * publishes the result while it is unchanged, so a success that resolves after a revocation
+     * cannot hand the outbound cache authority the revocation just took away. It is not a
+     * revocation record and never admits anything: every request still proves its own credential
+     * with a fresh exchange.
+     */
+    private readonly invalidationSeq;
+    /** In-flight `admit` calls per client id, so a counter is kept only while it guards one. */
+    private readonly admissionsInFlight;
     constructor(options: SolidSessionFactoryOptions);
     /** A usable session for this credential, exchanging it when the cached one is spent. */
     session(credential: SolidClientCredential): Promise<SolidSession>;
+    /**
+     * Admit an inbound request that presents these client credentials.
+     *
+     * Admission is always a fresh exchange with the issuer that owns the credential. A cached token
+     * proves that some earlier exchange succeeded; it is not evidence that the credential is still
+     * registered, so it must never stand in for present authority. A credential deleted from its
+     * Account has to stop opening the gateway on the very next request, not whenever the last token
+     * it obtained happens to expire.
+     *
+     * The fresh session is published to the cache, so the rest of this request - reaching the
+     * owner's Pod - finds that same token and the DPoP key it is bound to instead of exchanging the
+     * same credential a second time. Concurrent inbound requests deliberately do not share each
+     * other's exchange, for the same reason they do not share a cached token: each has to prove the
+     * credential itself.
+     *
+     * The publishing is conditional on the credential not having been invalidated while the
+     * exchange was in flight. A success the issuer returned before a revocation is not present
+     * authority, so it is handed to this caller - already-authorized work is not torn down - but it
+     * is not written into the cache that later Pod access reads.
+     */
+    admit(credential: SolidClientCredential): Promise<SolidSession>;
     /**
      * Forget every cached session for one client.
      *
@@ -64,6 +98,18 @@ export declare class SolidSessionFactory {
      * authenticating the wrapper until it expires, and a deleted API Key looks like it still works.
      */
     invalidateClientCredential(clientId: string): void;
+    /**
+     * Mark a credential as definitively invalidated without deleting anything yet: the counter makes
+     * an in-flight exchange that resolves later decline to publish its result. Removed as soon as no
+     * admission for the client is still in flight, so it carries no state past its purpose.
+     */
+    private bumpInvalidation;
+    private releaseAdmission;
+    /**
+     * Drop the counter once no admission can still be racing it. While one is in flight the counter
+     * has to survive so that admission declines to republish; afterwards it is dead weight.
+     */
+    private pruneInvalidation;
     private remember;
     /** Drop one cache entry and its client-id index, whichever path removed it. */
     private forgetKey;

package/dist/api/auth/SolidSessionFactory.js

@@ -10,11 +10,14 @@ const TOKEN_EXPIRY_SKEW_MS = 30_000;
 const DEFAULT_TOKEN_LIFETIME_SECONDS = 300;
 const DEFAULT_MAX_ENTRIES = 256;
 /**
- * Exchanges CSS client credentials for Solid tokens, once per credential.
+ * Exchanges CSS client credentials for Solid tokens.
  *
- * Inbound authentication and outbound Pod access share this cache, so one request that arrives
- * with an `sk-` wrapper and then reads the Pod performs a single token exchange and keeps the
- * key the token is bound to. Cache identity is the issuer, the complete credential and its
+ * Inbound admission is a fresh exchange with the issuer on every request: a session in this cache
+ * proves only that some earlier exchange succeeded, never that the credential is still
+ * registered. The cache serves the outbound side - one request that arrives with an `sk-` wrapper
+ * and then reads the Pod reuses the token its own admission just obtained instead of exchanging
+ * the same credential a second time, and repeated Pod work keeps a live token and the key it is
+ * bound to until it is spent. Cache identity is the issuer, the complete credential and its
  * version - never just the owner or the client id, which are public identification rather than
  * authentication evidence.
  */
@@ -26,6 +29,16 @@ class SolidSessionFactory {
         /** Cache keys per client id, so a revoked credential can be forgotten without its secret. */
         this.keysByClientId = new Map();
         this.clientIdByKey = new Map();
+        /**
+         * Monotonic per-client invalidation counter. `admit` reads it before its exchange and only
+         * publishes the result while it is unchanged, so a success that resolves after a revocation
+         * cannot hand the outbound cache authority the revocation just took away. It is not a
+         * revocation record and never admits anything: every request still proves its own credential
+         * with a fresh exchange.
+         */
+        this.invalidationSeq = new Map();
+        /** In-flight `admit` calls per client id, so a counter is kept only while it guards one. */
+        this.admissionsInFlight = new Map();
         this.route = (0, TokenEndpointRoute_1.resolveTokenEndpointRoute)(options.tokenEndpoint, options.publicBaseUrl);
         this.fetchImpl = options.fetch ?? fetch;
         this.now = options.now ?? Date.now;
@@ -58,6 +71,59 @@ class SolidSessionFactory {
         this.pending.set(key, pending);
         return promise;
     }
+    /**
+     * Admit an inbound request that presents these client credentials.
+     *
+     * Admission is always a fresh exchange with the issuer that owns the credential. A cached token
+     * proves that some earlier exchange succeeded; it is not evidence that the credential is still
+     * registered, so it must never stand in for present authority. A credential deleted from its
+     * Account has to stop opening the gateway on the very next request, not whenever the last token
+     * it obtained happens to expire.
+     *
+     * The fresh session is published to the cache, so the rest of this request - reaching the
+     * owner's Pod - finds that same token and the DPoP key it is bound to instead of exchanging the
+     * same credential a second time. Concurrent inbound requests deliberately do not share each
+     * other's exchange, for the same reason they do not share a cached token: each has to prove the
+     * credential itself.
+     *
+     * The publishing is conditional on the credential not having been invalidated while the
+     * exchange was in flight. A success the issuer returned before a revocation is not present
+     * authority, so it is handed to this caller - already-authorized work is not torn down - but it
+     * is not written into the cache that later Pod access reads.
+     */
+    async admit(credential) {
+        const key = cacheKey(this.route, credential);
+        const clientId = credential.clientId;
+        const capturedSeq = this.invalidationSeq.get(clientId) ?? 0;
+        this.admissionsInFlight.set(clientId, (this.admissionsInFlight.get(clientId) ?? 0) + 1);
+        let session;
+        try {
+            session = await this.exchange(credential);
+        }
+        catch (error) {
+            // A definitive refusal means this credential is gone, so the session cached under it is
+            // stale evidence and goes with it. An outage says nothing about the credential, so the
+            // cache is left alone and the caller hears 503 instead of 401.
+            try {
+                if (isCredentialRefusal(error)) {
+                    this.invalidate(credential);
+                }
+            }
+            finally {
+                this.releaseAdmission(clientId);
+            }
+            throw error;
+        }
+        try {
+            if ((this.invalidationSeq.get(clientId) ?? 0) === capturedSeq) {
+                this.remember(key, clientId, session);
+            }
+        }
+        finally {
+            this.releaseAdmission(clientId);
+        }
+        return session;
+    }
     /**
      * Forget every cached session for one client.
      *
@@ -66,6 +132,7 @@ class SolidSessionFactory {
      * authenticating the wrapper until it expires, and a deleted API Key looks like it still works.
      */
     invalidateClientCredential(clientId) {
+        this.bumpInvalidation(clientId);
         const keys = this.keysByClientId.get(clientId);
         for (const key of keys ?? []) {
             this.forgetKey(key);
@@ -75,6 +142,35 @@ class SolidSessionFactory {
                 this.pending.delete(key);
             }
         }
+        this.pruneInvalidation(clientId);
+    }
+    /**
+     * Mark a credential as definitively invalidated without deleting anything yet: the counter makes
+     * an in-flight exchange that resolves later decline to publish its result. Removed as soon as no
+     * admission for the client is still in flight, so it carries no state past its purpose.
+     */
+    bumpInvalidation(clientId) {
+        this.invalidationSeq.set(clientId, (this.invalidationSeq.get(clientId) ?? 0) + 1);
+    }
+    releaseAdmission(clientId) {
+        const remaining = (this.admissionsInFlight.get(clientId) ?? 1) - 1;
+        if (remaining > 0) {
+            this.admissionsInFlight.set(clientId, remaining);
+        }
+        else {
+            this.admissionsInFlight.delete(clientId);
+        }
+        this.pruneInvalidation(clientId);
+    }
+    /**
+     * Drop the counter once no admission can still be racing it. While one is in flight the counter
+     * has to survive so that admission declines to republish; afterwards it is dead weight.
+     */
+    pruneInvalidation(clientId) {
+        if (this.admissionsInFlight.has(clientId)) {
+            return;
+        }
+        this.invalidationSeq.delete(clientId);
     }
     remember(key, clientId, session) {
         this.sessions.set(key, session);
@@ -113,8 +209,10 @@ class SolidSessionFactory {
         if (expectedSession && this.sessions.get(key) !== expectedSession) {
             return;
         }
+        this.bumpInvalidation(credential.clientId);
         this.pending.delete(key);
         this.forgetKey(key);
+        this.pruneInvalidation(credential.clientId);
     }
     async exchange(credential) {
         const dpopKey = await (0, solid_client_authn_core_1.generateDpopKeyPair)();
@@ -172,6 +270,18 @@ function cacheKey(route, credential) {
 function fingerprintSecret(secret) {
     return (0, node_crypto_1.createHash)('sha256').update(secret).digest('hex');
 }
+/**
+ * Whether the issuer definitively refused the credential itself, rather than failing to answer.
+ *
+ * Only 400, 401 and 403 mean "this credential is not registered any more". Everything else is not
+ * evidence about the credential: a 5xx, a 429, a network error or an unparseable response is an
+ * outage or a rate limit of the issuer, and reporting that as a revoked key would both mislead the
+ * caller and throw away a session that is still perfectly good.
+ */
+function isCredentialRefusal(error) {
+    const status = error instanceof SolidSessionError ? error.status : undefined;
+    return status === 400 || status === 401 || status === 403;
+}
 function pruneOldest(cache, limit, onEvict) {
     while (cache.size > limit) {
         const oldest = cache.keys().next();

package/dist/api/chatkit/pod-store.d.ts

@@ -5,7 +5,7 @@ import { type RunListOptions, type RunRecordData, type RunStepRecordData, type R
 import { type TaskListOptions, type TaskRecordData, type TaskStore } from '../tasks/store';
 import { type TaskAuthBindingRepository } from '../tasks/TaskAuthBinding';
 import { type PodAccessFetchProvider } from '../ai-gateway/pod/OwnerPodAccess';
-import type { PodBaseUrlResolver } from '../ai-gateway/pod/PodBaseUrlResolver';
+import { type PodBaseUrlResolver } from '../ai-gateway/pod/PodBaseUrlResolver';
 import { type AiCredentialSecretDecoder } from '../../ai/service/AiCredentialSecret';
 import { CredentialStatus } from '../../credential/schema/types';
 import { type ServerGroupReconcilerService } from '../reconciler';
@@ -59,6 +59,13 @@ export declare class PodChatKitStore implements ChatKitStore<StoreContext>, RunS
      */
     private getDb;
     private openDb;
+    /**
+     * Resolve the request's authoritative Pod root, or `undefined` when this deployment has no
+     * binding resolver to consult. Reporting a missing binding is left to the caller so the
+     * credential path can be classified first.
+     */
+    private resolveContextPodBaseUrl;
+    private requireContextPodBaseUrl;
     /** Stable identity of the credential binding behind a cached database, without secrets. */
     private podCredentialBinding;
     /**

package/dist/api/chatkit/pod-store.js

@@ -28,6 +28,7 @@ const store_2 = require("../tasks/store");
 const TaskAuthBinding_1 = require("../tasks/TaskAuthBinding");
 const CallerPodAccess_1 = require("../ai-gateway/auth/CallerPodAccess");
 const OwnerPodAccess_1 = require("../ai-gateway/pod/OwnerPodAccess");
+const PodBaseUrlResolver_1 = require("../ai-gateway/pod/PodBaseUrlResolver");
 const AuthContext_1 = require("../auth/AuthContext");
 const provider_1 = require("../../ai/schema/provider");
 const model_1 = require("../../ai/schema/model");
@@ -114,6 +115,13 @@ class PodChatKitStore {
             if (expectedAuth && expectedAuth !== this.podCredentialBinding(context)) {
                 throw new Error('Authoritative Pod credential binding changed on cached context');
             }
+            const auth = context.auth;
+            if (auth?.type === 'solid' && (auth.requestedPodUrl || auth.authorizedPodUrl)) {
+                const selectedRoot = await this.requireContextPodBaseUrl(context, auth);
+                if (!boundRoot || selectedRoot !== boundRoot) {
+                    throw new Error('Authoritative Pod storage binding changed on cached context');
+                }
+            }
             this.logger.debug('Using cached db from context');
             return cachedDb;
         }
@@ -123,8 +131,12 @@ class PodChatKitStore {
         // it never outlives the request or crosses credentials.
         const inFlight = context._cachedDbPromise;
         if (inFlight) {
+            if (context._cachedDbPromiseAuth !== this.podCredentialBinding(context)) {
+                throw new Error('Authoritative Pod credential binding changed while opening database');
+            }
             return inFlight;
         }
+        context._cachedDbPromiseAuth = this.podCredentialBinding(context);
         const opening = this.openDb(context);
         context._cachedDbPromise = opening;
         try {
@@ -133,6 +145,7 @@ class PodChatKitStore {
         finally {
             if (context._cachedDbPromise === opening) {
                 delete context._cachedDbPromise;
+                delete context._cachedDbPromiseAuth;
             }
         }
     }
@@ -142,6 +155,11 @@ class PodChatKitStore {
             this.logger.warn('No valid solid auth in context, cannot access Pod');
             throw new Error(CallerPodAccess_1.CALLER_POD_ACCESS_UNAVAILABLE);
         }
+        const credentialBinding = this.podCredentialBinding(context);
+        // A missing authoritative binding is a storage failure, but it must not decide the diagnosis
+        // for a caller whose credential path is already unusable: resolve it here, then reject only
+        // after Pod access has reported why no usable credential exists.
+        const podBaseUrl = await this.resolveContextPodBaseUrl(context, auth);
         // One credential path for every caller: the owner's own Pod key, exchanged for a
         // token this process can prove, or the caller's reusable token. Unattended work carries a
         // task-layer grant, which is forwarded so the Pod fetch is bound to that exact grant.
@@ -150,6 +168,7 @@ class PodChatKitStore {
         try {
             podFetch = await this.podAccess?.getPodFetch(auth.webId, {
                 auth,
+                podBaseUrl,
                 ...(taskCredential ? { taskCredential } : {}),
             });
         }
@@ -162,11 +181,12 @@ class PodChatKitStore {
             this.logger.warn(`No usable Pod credential for ${auth.webId}: ${reason}`);
             throw new Error(reason);
         }
-        const podBaseUrl = this.readExplicitPodBaseUrl(context)
-            ?? this.normalizePodBaseUrl(await this.podBaseUrlResolver?.(auth.webId));
         if (!podBaseUrl) {
             throw new Error('Authoritative Pod storage binding unavailable');
         }
+        if (credentialBinding !== this.podCredentialBinding(context)) {
+            throw new Error('Authoritative Pod credential binding changed while opening database');
+        }
         const db = (0, drizzle_solid_1.drizzle)({ fetch: podFetch, info: { webId: auth.webId, isLoggedIn: true } }, { schema, podUrl: podBaseUrl });
         this.logger.info(`Initializing tables for Pod: ${auth.webId}`);
         try {
@@ -176,13 +196,42 @@ class PodChatKitStore {
         catch (initError) {
             this.logger.error(`Failed to init tables: ${initError}`);
         }
+        if (credentialBinding !== this.podCredentialBinding(context)) {
+            throw new Error('Authoritative Pod credential binding changed while opening database');
+        }
         context._cachedDb = db;
         context._cachedFetch = podFetch;
         context._cachedWebId = auth.webId;
-        context._cachedAuth = this.podCredentialBinding(context);
+        context._cachedAuth = credentialBinding;
         this.ensurePodBaseUrlCache(context, db);
         return db;
     }
+    /**
+     * Resolve the request's authoritative Pod root, or `undefined` when this deployment has no
+     * binding resolver to consult. Reporting a missing binding is left to the caller so the
+     * credential path can be classified first.
+     */
+    async resolveContextPodBaseUrl(context, auth) {
+        const explicitRoot = this.readExplicitPodBaseUrl(context);
+        // Explicit internal contexts already carry a verified binding. A request selection or
+        // capability must still intersect that binding through the shared ownership resolver.
+        if (explicitRoot && !auth.requestedPodUrl && !auth.authorizedPodUrl)
+            return explicitRoot;
+        if (!this.podBaseUrlResolver)
+            return undefined;
+        const selectedRoot = this.normalizePodBaseUrl(await (0, PodBaseUrlResolver_1.resolveOwnerPodBaseUrl)(auth.webId, this.podBaseUrlResolver, auth));
+        if (explicitRoot && selectedRoot !== explicitRoot) {
+            throw new Error('Authoritative Pod storage binding conflicts with request');
+        }
+        return selectedRoot;
+    }
+    async requireContextPodBaseUrl(context, auth) {
+        const root = await this.resolveContextPodBaseUrl(context, auth);
+        if (!root) {
+            throw new Error('Authoritative Pod storage binding unavailable');
+        }
+        return root;
+    }
     /** Stable identity of the credential binding behind a cached database, without secrets. */
     podCredentialBinding(context) {
         const auth = context.auth;
@@ -190,6 +239,8 @@ class PodChatKitStore {
         return JSON.stringify({
             webId: auth && (0, AuthContext_1.isSolidAuth)(auth) ? auth.webId : null,
             clientId: auth && (0, AuthContext_1.isSolidAuth)(auth) ? auth.clientId ?? null : null,
+            requestedPodUrl: auth && (0, AuthContext_1.isSolidAuth)(auth) ? auth.requestedPodUrl ?? null : null,
+            authorizedPodUrl: auth && (0, AuthContext_1.isSolidAuth)(auth) ? auth.authorizedPodUrl ?? null : null,
             taskCredential: task
                 ? { ref: task.credentialRef ?? null, version: task.version ?? null, ownerGrant: task.ownerGrant ?? null }
                 : null,