@undefineds.co/xpod 0.4.3 → 0.4.5

package/node_modules/@undefineds.co/ai-connections/dist/ai-connections-client.js

@@ -71,7 +71,7 @@ export function createAiConnectionsClient({ webId, podBaseUrl, authenticatedFetc
         });
         const payload = await readJson(response);
         if (!response.ok) {
-            throw new Error(normalizeAiConnectionsErrorMessage(payload, response.status, context));
+            throw new AiConnectionsRequestError(normalizeAiConnectionsErrorMessage(payload, response.status, context), payload);
         }
         return payload;
     };
@@ -83,6 +83,12 @@ export function createAiConnectionsClient({ webId, podBaseUrl, authenticatedFetc
         const payload = await request(`${providerPath(provider)}${path}`, method, body, { provider });
         return parseConnectAttempt(payload, provider);
     };
+    const listGatewayModels = async () => {
+        const payload = await request('/v1/models', 'GET');
+        return Array.isArray(payload.data)
+            ? payload.data.map(parseGatewayModel).filter(isDefined)
+            : [];
+    };
     return {
         webId,
         apiBase,
@@ -93,12 +99,25 @@ export function createAiConnectionsClient({ webId, podBaseUrl, authenticatedFetc
             const payload = await request('/api/ai/providers', 'GET');
             return Array.isArray(payload.data) ? parseProviderSummaries(payload.data) : [];
         },
-        async listModels() {
-            const payload = await request('/v1/models', 'GET');
-            return Array.isArray(payload.data)
-                ? payload.data.map(parseGatewayModel).filter(isDefined)
+        async listAuthorizationMethods() {
+            const response = await authenticatedFetch(`${apiBase}/api/ai/connections/authorization-methods`, {
+                method: 'GET',
+                credentials: 'omit',
+                mode: 'cors',
+                headers: { accept: 'application/json' },
+            });
+            if (response.status === 404)
+                return [];
+            const payload = await readJson(response);
+            if (!response.ok) {
+                throw new Error(normalizeAiConnectionsErrorMessage(payload, response.status));
+            }
+            return isRecord(payload) && Array.isArray(payload.data)
+                ? payload.data.map(parseAuthorizationMethodsSummary).filter(isDefined)
                 : [];
         },
+        listModels: listGatewayModels,
+        listGatewayModels,
         async listGatewayKeys() {
             const payload = await request('/api/ai/gateway/keys', 'GET');
             return Array.isArray(payload.data)
@@ -132,8 +151,12 @@ export function createAiConnectionsClient({ webId, podBaseUrl, authenticatedFetc
         async deleteGatewayKey(keyId) {
             await request(`/api/ai/gateway/keys/${encodeURIComponent(keyId)}`, 'DELETE');
         },
-        async beginConnect(provider, mode) {
-            return await requestConnect(provider, '/connect/begin', 'POST', { mode });
+        async beginConnect(provider, mode, options) {
+            return await requestConnect(provider, '/connect/begin', 'POST', compactObject({
+                mode,
+                offeringId: options?.offeringId,
+                authorizationMethodId: options?.authorizationMethodId,
+            }));
         },
         connectStatus(provider, attempt) {
             if (!attempt.attemptId) {
@@ -143,6 +166,8 @@ export function createAiConnectionsClient({ webId, podBaseUrl, authenticatedFetc
                 state: attempt.state ?? '',
                 signature: attempt.signature ?? '',
             });
+            if (attempt.mode)
+                query.set('mode', attempt.mode);
             return requestConnect(provider, `/connect/status/${encodeURIComponent(attempt.attemptId)}?${query}`, 'GET');
         },
         completeApiKey(provider, attempt, apiKey, accountLabel, baseUrl) {
@@ -150,6 +175,7 @@ export function createAiConnectionsClient({ webId, podBaseUrl, authenticatedFetc
                 attemptId: attempt.attemptId,
                 state: attempt.state,
                 signature: attempt.signature,
+                offeringId: attempt.offeringId,
                 apiKey,
                 accountLabel,
                 baseUrl,
@@ -157,16 +183,29 @@ export function createAiConnectionsClient({ webId, podBaseUrl, authenticatedFetc
         },
         pollDevice(provider, attempt) {
             return requestConnect(provider, '/connect/poll', 'POST', compactObject({
+                mode: attempt.mode,
                 attemptId: attempt.attemptId,
                 state: attempt.state,
                 signature: attempt.signature,
+                offeringId: attempt.offeringId,
             }));
         },
-        refreshOAuthCredential(provider, credentialId, refreshToken, expectedVersion) {
+        cancelConnect(provider, attempt) {
+            return requestConnect(provider, '/connect/cancel', 'POST', compactObject({
+                mode: attempt.mode,
+                attemptId: attempt.attemptId,
+                state: attempt.state,
+                signature: attempt.signature,
+                offeringId: attempt.offeringId,
+            }));
+        },
+        refreshOAuthCredential(provider, credentialId, refreshToken, expectedVersion, offeringId, mode) {
             return requestConnect(provider, '/connect/refresh', 'POST', {
                 credentialId,
                 refreshToken,
                 expectedVersion,
+                ...(offeringId ? { offeringId } : {}),
+                ...(mode ? { mode } : {}),
             });
         },
         async disconnect(provider, credentialId) {
@@ -217,7 +256,7 @@ export function createAiConnectionsClient({ webId, podBaseUrl, authenticatedFetc
             return request(`${providerPath(provider)}/quota/refresh`, 'POST', compactObject(input), { provider });
         },
         async discoverModels(provider, input) {
-            const payload = await request(`${providerPath(provider)}/models/refresh`, 'POST', compactObject({ ...input }), { provider });
+            const payload = await request(`${providerPath(provider)}/models/refresh`, 'POST', compactObject({ ...input }), { provider, authMode: input?.authMode });
             return parseModelDiscovery(payload, provider);
         },
         async saveProviderModel(provider, model) {
@@ -236,6 +275,15 @@ export function createAiConnectionsClient({ webId, podBaseUrl, authenticatedFetc
         },
     };
 }
+export class AiConnectionsRequestError extends Error {
+    constructor(message, payload) {
+        super(message);
+        this.name = 'AiConnectionsRequestError';
+        this.code = errorCodeFromPayload(payload);
+        this.providerStatus = isRecord(payload) && typeof payload.providerStatus === 'number'
+            ? payload.providerStatus : undefined;
+    }
+}
 export function normalizeAiConnectionsThrownError(error) {
     if (error instanceof Error) {
         return normalizeAiConnectionsErrorText(error.message);
@@ -259,7 +307,7 @@ export function normalizeAiConnectionsErrorMessage(payload, status, context = {}
         const providerMessage = isRecord(payload) && typeof payload.providerMessage === 'string'
             ? payload.providerMessage.trim()
             : undefined;
-        return withProviderMessage(modelDiscoveryErrorMessage(providerStatus), providerMessage);
+        return withProviderMessage(modelDiscoveryErrorMessage(providerStatus, context.authMode), providerMessage);
     }
     const coded = code ? messageForSafeErrorCode(code, context.provider) : undefined;
     if (coded)
@@ -294,7 +342,13 @@ export function normalizeAiConnectionsErrorMessage(payload, status, context = {}
         return 'AI Connection service is unavailable.';
     return AI_CONNECTIONS_GENERIC_ERROR_MESSAGE;
 }
+const LOCAL_SESSION_REFRESH_FAILED_MESSAGE = '订阅登录态自动刷新失败，请稍后重试。';
+const LOCAL_SESSION_REAUTH_REQUIRED_MESSAGE = '订阅登录态已失效，请在原客户端重新登录后重读，或使用设备码登录。';
+const OAUTH_MODEL_AUTH_FAILED_MESSAGE = '订阅登录态不可用，请重读登录态或重新登录后再同步模型。';
 const MODEL_DISCOVERY_SAFE_MESSAGES = new Set([
+    OAUTH_MODEL_AUTH_FAILED_MESSAGE,
+    LOCAL_SESSION_REFRESH_FAILED_MESSAGE,
+    LOCAL_SESSION_REAUTH_REQUIRED_MESSAGE,
     '密钥不可用。请检查密钥是否填写正确，或换一个密钥后重试。',
     '模型服务地址不正确。请检查服务地址后重试。',
     '请求太频繁。请稍等一会儿再试。',
@@ -361,6 +415,17 @@ function messageForSafeErrorCode(code, provider) {
             return '该服务地址指向 Xpod 不允许访问的网络，请改用公网 HTTPS 地址。';
         case 'invalid_proxy_url':
             return '代理地址必须是无账号密码的 HTTP 或 HTTPS 地址。';
+        case 'oauth_refresh_failed':
+        case 'oauth_refresh_unavailable':
+        case 'local_session_refresh_failed':
+            return LOCAL_SESSION_REFRESH_FAILED_MESSAGE;
+        case 'oauth_session_reauth_required':
+        case 'oauth_refresh_token_required':
+        case 'local_session_reauth_required':
+        case 'local_session_missing_refresh_token':
+            return LOCAL_SESSION_REAUTH_REQUIRED_MESSAGE;
+        case 'models_persistence_failed':
+            return '模型已获取，但保存到 Pod 失败。请重试同步模型。';
         case 'quota_credential_not_found':
             return '当前身份没有可用的额度凭证。';
         case 'credential_secret_unavailable':
@@ -373,8 +438,10 @@ function messageForSafeErrorCode(code, provider) {
             return undefined;
     }
 }
-function modelDiscoveryErrorMessage(providerStatus) {
+function modelDiscoveryErrorMessage(providerStatus, authMode) {
     if (providerStatus === 401 || providerStatus === 403) {
+        if (authMode === 'deviceCodeOAuth')
+            return OAUTH_MODEL_AUTH_FAILED_MESSAGE;
         return '密钥不可用。请检查密钥是否填写正确，或换一个密钥后重试。';
     }
     if (providerStatus === 404) {
@@ -450,6 +517,9 @@ function parseGatewayKeyRecord(value) {
     }
     return compactObject({
         id: value.id,
+        kind: value.kind === 'client-credentials' ? value.kind : undefined,
+        credentialResource: stringValue(value.credentialResource),
+        fingerprint: stringValue(value.fingerprint),
         owner: value.owner,
         scopes: value.scopes,
         createdAt: value.createdAt,
@@ -498,6 +568,7 @@ function parseGatewayModel(value) {
         ?? providerFromModelId(value.id);
     if (!provider)
         return undefined;
+    const imageInput = isRecord(value.capabilities) ? value.capabilities.imageInput : undefined;
     return compactObject({
         id: value.id,
         provider,
@@ -509,7 +580,8 @@ function parseGatewayModel(value) {
             ? value.protocols.filter((protocol) => typeof protocol === 'string')
             : undefined,
         custom: value.custom === true ? true : undefined,
-        inputModalities: modalitiesFromWire(value.modalities, 'input'),
+        inputModalities: modalitiesFromWire(value.modalities, 'input')
+            ?? (imageInput === true ? ['text', 'image'] : imageInput === false ? ['text'] : undefined),
         outputModalities: modalitiesFromWire(value.modalities, 'output'),
         capabilities: modelCapabilitiesFromWire(value),
     });
@@ -633,6 +705,7 @@ function parseProviderOffering(value) {
         kind: stringValue(value.kind),
         lifecycle: offeringLifecycleValue(value.lifecycle),
         authModes,
+        authorizationMethods: arrayValue(value.authorizationMethods, parseAuthorizationMethod),
         runtimeProviderIds: stringListValue(value.runtimeProviderIds),
         productLabel: stringValue(value.productLabel),
         credentialPrefixHints: stringListValue(value.credentialPrefixHints),
@@ -645,6 +718,53 @@ function parseProviderOffering(value) {
         region: stringValue(value.region),
     });
 }
+function parseAuthorizationMethodsSummary(value) {
+    if (!isRecord(value) || typeof value.offeringId !== 'string' || !value.offeringId)
+        return undefined;
+    const provider = providerValue(value.provider);
+    if (!provider)
+        return undefined;
+    const authorizationMethods = arrayValue(value.authorizationMethods, parseAuthorizationMethod);
+    return {
+        provider,
+        offeringId: value.offeringId,
+        ...(Array.isArray(value.endpoints) ? { endpoints: arrayValue(value.endpoints, parseOfferingEndpoint) } : {}),
+        authorizationMethods,
+    };
+}
+function parseAuthorizationMethod(value) {
+    if (!isRecord(value) || typeof value.id !== 'string' || !value.id)
+        return undefined;
+    const authMode = offeringAuthModeValue(value.authMode);
+    const lifecycle = authorizationMethodLifecycleValue(value.lifecycle);
+    if (!authMode || !lifecycle)
+        return undefined;
+    const connectMode = isConnectMode(value.connectMode) ? value.connectMode : undefined;
+    return compactObject({
+        id: value.id,
+        authMode,
+        connectMode,
+        label: stringValue(value.label) ?? authorizationMethodFallbackLabel(value.id, authMode),
+        lifecycle,
+        reason: stringValue(value.reason),
+    });
+}
+function authorizationMethodLifecycleValue(value) {
+    return value === 'active' || value === 'unavailable' ? value : undefined;
+}
+function authorizationMethodFallbackLabel(id, authMode) {
+    if (id === 'device-code')
+        return '浏览器登录';
+    if (id === 'local-session-import')
+        return '已有登录态';
+    if (id === 'local-service')
+        return '本地服务';
+    if (id === 'api-key' || authMode === 'apiKey')
+        return 'API Key';
+    if (authMode === 'local')
+        return '本地服务';
+    return '浏览器登录';
+}
 function offeringLifecycleValue(value) {
     return value === 'active' || value === 'legacy' || value === 'unavailable'
         ? value
@@ -769,7 +889,7 @@ function legacyCredentialFromSummary(value, provider) {
     const authMode = legacyCredentialAuthMode(value.authMode);
     return compactObject({
         id: stringValue(value.credentialIri) ?? `${provider}:current`,
-        offeringId: legacyOfferingId(authMode),
+        offeringId: legacyOfferingId(provider, authMode),
         authMode,
         label: stringValue(value.accountLabel),
         enabled: value.status === 'connected',
@@ -789,7 +909,9 @@ function legacyCredentialAuthMode(value) {
         return 'deviceCode';
     return 'apiKey';
 }
-function legacyOfferingId(authMode) {
+function legacyOfferingId(provider, authMode) {
+    if (provider === 'kimi' && (authMode === 'deviceCode' || authMode === 'oauth'))
+        return 'subscription-key';
     return authMode === 'deviceCode' || authMode === 'oauth'
         ? 'official-subscription'
         : 'api-platform';
@@ -895,6 +1017,8 @@ function parseConnectAttempt(value, expectedProvider) {
             ? value.apiKeyManagementSupported
             : undefined,
         credentialId: stringValue(value.credentialId),
+        offeringId: stringValue(value.offeringId),
+        authorizationMethodId: stringValue(value.authorizationMethodId),
         oauthCredential: parseOAuthCredential(value.oauthCredential),
         message: stringValue(value.message),
     });
@@ -916,6 +1040,10 @@ function parseOAuthCredential(value) {
         scope: stringValue(value.scope),
         idToken: stringValue(value.idToken),
         accountSubject: stringValue(value.accountSubject),
+        accountId: stringValue(value.accountId),
+        accountLabel: stringValue(value.accountLabel),
+        offeringId: stringValue(value.offeringId),
+        authorizationMethodId: stringValue(value.authorizationMethodId),
         expectedVersion: typeof value.expectedVersion === 'number' ? value.expectedVersion : undefined,
     });
 }
@@ -964,6 +1092,7 @@ function safeHttpUrl(value) {
 function isConnectMode(value) {
     return value === 'browserAssistedApiKey'
         || value === 'deviceCodeOAuth'
+        || value === 'authorizationCodeOAuth'
         || value === 'connectUnsupported';
 }
 function isConnectStatus(value) {

package/node_modules/@undefineds.co/ai-connections/dist/client-config/base-adapter.d.ts

@@ -5,7 +5,21 @@ export declare class AiClientConfigError extends Error {
     readonly code: 'model_catalog_empty' | 'model_catalog_invalid' | 'model_not_available';
     constructor(code: 'model_catalog_empty' | 'model_catalog_invalid' | 'model_not_available', message?: string);
 }
+interface OwnershipState {
+    version: 1;
+    client: string;
+    webIdHash: string;
+    apiKeyFingerprint?: string;
+    projectionHashes?: Record<string, string>;
+    files: Array<{
+        path: string;
+        existed: boolean;
+        backupPath?: string;
+    }>;
+}
 export declare function hashWebId(webId: string): string;
+declare function contentHash(value: string): string;
+export declare const contentFingerprint: typeof contentHash;
 export declare function normalizeV1Endpoint(endpoint: string): string;
 export declare function normalizeMessagesEndpoint(endpoint: string): string;
 export declare function parseJsonObject(content: string | undefined, label: string): Record<string, unknown>;
@@ -26,7 +40,7 @@ export declare function activeModelReferences(profile: AiConnectionsClientProfil
     id: string;
     name: string;
 }>;
-/** Apply catalog validation once at the shared adapter boundary. */
+/** Use supplied model metadata when available; file projection does not require discovery. */
 export declare function normalizeClientProfile(profile: AiConnectionsClientProfile): AiConnectionsClientProfile;
 export declare function stripLegacyXpodObject(value: Record<string, unknown>): void;
 export declare abstract class BaseAiClientConfigAdapter implements AiClientConfigAdapter {
@@ -46,10 +60,12 @@ export declare abstract class BaseAiClientConfigAdapter implements AiClientConfi
     protected abstract verifyProjection(profile: AiConnectionsClientProfile): Promise<ClientVerification>;
     protected abstract restoreFile(filePath: string, current: string | undefined, original: string | undefined, originallyExisted: boolean): Promise<string | null>;
     protected normalizeProfile(profile: AiConnectionsClientProfile): AiConnectionsClientProfile;
+    protected currentApiKeyFingerprint(_current: Map<string, string | undefined>): Promise<string | undefined>;
     protected readOptional(filePath: string): Promise<string | undefined>;
     private validateProfile;
-    private readState;
-    private rejectSymlink;
+    protected readState(): Promise<OwnershipState | undefined>;
+    protected rejectSymlink(filePath: string): Promise<void>;
     private exists;
     private isExecutableOnPath;
 }
+export {};

package/node_modules/@undefineds.co/ai-connections/dist/client-config/base-adapter.js

@@ -13,6 +13,10 @@ export class AiClientConfigError extends Error {
 export function hashWebId(webId) {
     return crypto.createHash('sha256').update(webId.trim(), 'utf8').digest('hex');
 }
+function contentHash(value) {
+    return crypto.createHash('sha256').update(value, 'utf8').digest('hex');
+}
+export const contentFingerprint = contentHash;
 export function normalizeV1Endpoint(endpoint) {
     const normalized = endpoint.trim().replace(/\/+$/, '');
     return normalized.endsWith('/v1') ? normalized : `${normalized}/v1`;
@@ -114,11 +118,11 @@ function normalizeActiveModels(models) {
     }
     return normalized;
 }
-/** Apply catalog validation once at the shared adapter boundary. */
+/** Use supplied model metadata when available; file projection does not require discovery. */
 export function normalizeClientProfile(profile) {
     return {
         ...profile,
-        model: resolveActiveModel(profile),
+        model: profile.activeModels?.length ? resolveActiveModel(profile) : profile.model?.trim() || undefined,
     };
 }
 export function stripLegacyXpodObject(value) {
@@ -144,9 +148,23 @@ export class BaseAiClientConfigAdapter {
     }
     async inspect() {
         const state = await this.readState();
+        let projectionMatches;
+        if (state?.projectionHashes) {
+            projectionMatches = true;
+            for (const filePath of this.configPaths) {
+                await this.rejectSymlink(filePath);
+                const content = await this.readOptional(filePath);
+                if (content === undefined || contentHash(content) !== state.projectionHashes[filePath]) {
+                    projectionMatches = false;
+                }
+            }
+        }
         return {
             ownership: state ? 'owned' : 'unowned',
             ...(state ? { webIdHash: state.webIdHash } : {}),
+            ...(projectionMatches === undefined ? {} : { projectionMatches }),
+            ...(projectionMatches && /^[a-f0-9]{64}$/u.test(state?.apiKeyFingerprint ?? '')
+                ? { apiKeyFingerprint: state.apiKeyFingerprint } : {}),
             configPaths: [...this.configPaths],
         };
     }
@@ -163,8 +181,14 @@ export class BaseAiClientConfigAdapter {
             contents.set(filePath, await this.readOptional(filePath));
         }
         const projected = await this.project(normalizedProfile, contents);
+        for (const filePath of projected.keys()) {
+            if (!contents.has(filePath)) {
+                await this.rejectSymlink(filePath);
+                contents.set(filePath, await this.readOptional(filePath));
+            }
+        }
         const timestamp = Date.now();
-        const files = this.configPaths.map((filePath) => {
+        const files = [...projected.keys()].map((filePath) => {
             const prior = currentState?.files.find((file) => file.path === filePath);
             const existed = contents.get(filePath) !== undefined;
             return prior ?? {
@@ -177,12 +201,14 @@ export class BaseAiClientConfigAdapter {
             path: filePath,
             content,
             backupPath: files.find((file) => file.path === filePath)?.backupPath,
-            createBackup: !currentState && contents.get(filePath) !== undefined,
+            createBackup: !currentState?.files.some((file) => file.path === filePath) && contents.get(filePath) !== undefined,
         }));
         const state = {
             version: 1,
             client: this.client,
             webIdHash: ownerHash,
+            apiKeyFingerprint: contentHash(profileApiKey(normalizedProfile)),
+            projectionHashes: Object.fromEntries([...projected].map(([filePath, content]) => [filePath, contentHash(content)])),
             files,
         };
         writes.push({ path: this.statePath, content: stringifyJson(state) });
@@ -209,10 +235,19 @@ export class BaseAiClientConfigAdapter {
         if (state.webIdHash !== hashWebId(webId)) {
             throw new Error(`${this.client} AI Connection projection is owned by another WebID`);
         }
-        const writes = [];
+        const current = new Map();
         for (const file of state.files) {
             await this.rejectSymlink(file.path);
-            const current = await this.readOptional(file.path);
+            current.set(file.path, await this.readOptional(file.path));
+        }
+        const currentFingerprint = await this.currentApiKeyFingerprint(current);
+        if (state.apiKeyFingerprint &&
+            currentFingerprint &&
+            currentFingerprint !== state.apiKeyFingerprint) {
+            throw new Error(`${this.client} API key changed since projection was applied; refusing restore to avoid data loss`);
+        }
+        const writes = [];
+        for (const file of state.files) {
             let original;
             if (file.existed) {
                 if (!file.backupPath) {
@@ -226,7 +261,7 @@ export class BaseAiClientConfigAdapter {
             }
             writes.push({
                 path: file.path,
-                content: await this.restoreFile(file.path, current, original, file.existed),
+                content: await this.restoreFile(file.path, current.get(file.path), original, file.existed),
             });
         }
         writes.push({ path: this.statePath, content: null });
@@ -235,6 +270,9 @@ export class BaseAiClientConfigAdapter {
     normalizeProfile(profile) {
         return normalizeClientProfile(profile);
     }
+    async currentApiKeyFingerprint(_current) {
+        return undefined;
+    }
     async readOptional(filePath) {
         try {
             return await fs.promises.readFile(filePath, 'utf8');

package/node_modules/@undefineds.co/ai-connections/dist/client-config/codex.d.ts

@@ -1,15 +1,21 @@
 import { BaseAiClientConfigAdapter } from './base-adapter';
-import type { AiConnectionsClientProfile, ClientVerification } from './types';
+import type { AiClientConfigPlan, AiConnectionsClientProfile, ClientInspection, ClientVerification } from './types';
 export interface CodexConfigAdapterOptions {
     homeDir?: string;
 }
 export declare class CodexConfigAdapter extends BaseAiClientConfigAdapter {
     private readonly configPath;
     private readonly authPath;
+    private readonly catalogPath;
+    private readonly nativeModelsPath;
     constructor(options?: CodexConfigAdapterOptions);
     protected normalizeProfile(profile: AiConnectionsClientProfile): AiConnectionsClientProfile;
+    inspect(): Promise<ClientInspection>;
+    plan(profile: AiConnectionsClientProfile): Promise<AiClientConfigPlan>;
+    private ownsLegacyAuth;
     protected project(profile: AiConnectionsClientProfile, current: Map<string, string | undefined>): Promise<Map<string, string>>;
     protected verifyProjection(profile: AiConnectionsClientProfile): Promise<ClientVerification>;
     protected restoreFile(filePath: string, current: string | undefined, original: string | undefined, originallyExisted: boolean): Promise<string | null>;
+    protected currentApiKeyFingerprint(current: Map<string, string | undefined>): Promise<string | undefined>;
     private removeManagedBlock;
 }