@undefineds.co/xpod 0.4.3 → 0.4.5

package/dist/api/ai-gateway/connect/index.d.ts

@@ -2,21 +2,26 @@ import { aiModelResource, aiProviderResource, credentialResource } from '@undefi
 import type { EncryptedCredentialSecret } from '../credentials/KeyWrapper';
 import type { CredentialVault, ProviderSecret } from '../credentials/CredentialVault';
 import type { GatewayDeployment } from '../auth/InvocationTokenCodec';
-import { type ProviderRegistry } from '../providers/ProviderRegistry';
+import { type ProviderOfferingEndpointDescriptor, type ProviderRegistry } from '../providers/ProviderRegistry';
+import type { OfferingAuthorizationMethod } from '../providers/OfferingAuthorization';
 import type { AuthContext } from '../../auth/AuthContext';
 import type { InternalPodAccessTokenProvider } from '../pod/HostedPodDataAccess';
 import { type PodBaseUrlResolver } from '../pod/PodBaseUrlResolver';
-import type { OAuthIntegration } from './OAuthIntegrationRegistry';
+import type { AuthorizationCodeCallbackReceiver } from './LoopbackAuthorizationCallbackReceiver';
+import type { AuthorizationCodeOAuthIntegration, DeviceCodeOAuthIntegration, OAuthConnectMode } from './DeviceCodeProtocol';
 import type { LocalSessionImportAdapter } from './OpenAiSubscriptionSessionImportAdapter';
 export { OAuthConnectCredentialStore } from './OAuthConnectAdapter';
-export { OAuthIntegrationRegistry, requireKimiOAuthClientId, type OAuthIntegration } from './OAuthIntegrationRegistry';
+export { OAuthIntegrationRegistry, requireTrustedOAuthIntegration, type AuthorizationCodeOAuthIntegration, type DeviceCodeOAuthIntegration, type DeviceCodeProtocolDescriptor, type OAuthConnectMode, type OAuthIntegration, } from './OAuthIntegrationRegistry';
 export { OpenAiSubscriptionSessionImportAdapter, type LocalSessionImportAdapter, type LocalSessionImportResult, } from './OpenAiSubscriptionSessionImportAdapter';
-export type ConnectMode = 'browserAssistedApiKey' | 'deviceCodeOAuth' | 'connectUnsupported';
-export type ConnectAttemptStatus = 'pending' | 'authorization_pending' | 'slow_down' | 'completed' | 'expired' | 'unsupported';
+export { LoopbackAuthorizationCallbackReceiver, type AuthorizationCodeCallbackReceiver, } from './LoopbackAuthorizationCallbackReceiver';
+export type ConnectMode = 'browserAssistedApiKey' | OAuthConnectMode | 'connectUnsupported';
+export type ConnectAttemptStatus = 'pending' | 'authorization_pending' | 'slow_down' | 'completed' | 'expired' | 'denied' | 'cancelled' | 'unsupported';
 export interface ConnectBeginInput {
     webId: string;
     deployment: GatewayDeployment;
     provider: string;
+    offeringId?: string;
+    authorizationMethodId?: string;
     requestedMode: ConnectMode;
     expectedCredentialVersion?: number;
     auth?: AuthContext;
@@ -25,6 +30,7 @@ export interface ConnectBeginResult {
     mode: ConnectMode;
     status: ConnectAttemptStatus;
     provider: string;
+    offeringId?: string;
     deployment: GatewayDeployment;
     attemptId?: string;
     state?: string;
@@ -49,12 +55,17 @@ export interface OneTimeOAuthCredential {
     scope?: string;
     idToken?: string;
     accountSubject?: string;
+    accountLabel?: string;
+    accountId?: string;
+    offeringId?: string;
+    authorizationMethodId?: string;
     expectedVersion?: number;
 }
 export interface CompleteApiKeyInput {
     webId: string;
     deployment: GatewayDeployment;
     provider: string;
+    offeringId?: string;
     attemptId: string;
     state: string;
     signature: string;
@@ -67,6 +78,8 @@ export interface PollDeviceInput {
     webId: string;
     deployment: GatewayDeployment;
     provider: string;
+    offeringId?: string;
+    mode?: OAuthConnectMode;
     attemptId: string;
     state: string;
     signature: string;
@@ -76,6 +89,8 @@ export interface RefreshInput {
     webId: string;
     deployment: GatewayDeployment;
     provider: string;
+    offeringId?: string;
+    mode?: OAuthConnectMode;
     credentialId?: string;
     auth?: AuthContext;
 }
@@ -83,11 +98,13 @@ export interface CallerOwnedOAuthRefreshInput extends RefreshInput {
     credentialId: string;
     refreshToken: string;
     expectedVersion: number;
+    authorizationMethodId?: string;
 }
 export interface DisconnectInput {
     webId: string;
     deployment: GatewayDeployment;
     provider: string;
+    offeringId?: string;
     credentialId?: string;
     auth?: AuthContext;
 }
@@ -312,6 +329,9 @@ export declare class PodConnectedCredentialRepository implements PodCredentialRe
 }
 export interface ProviderConnectAdapter {
     readonly provider: string;
+    readonly offeringId?: string;
+    readonly mode?: ConnectMode;
+    readonly authorizationMethodId?: string;
     begin(input: ConnectBeginInput): Promise<ConnectBeginResult>;
     status?(input: PollDeviceInput): Promise<ConnectBeginResult>;
     completeApiKey?(input: CompleteApiKeyInput): Promise<ConnectBeginResult>;
@@ -319,6 +339,7 @@ export interface ProviderConnectAdapter {
     refresh?(input: RefreshInput, current: ConnectCredentialRecord, secret: ProviderSecret): Promise<ConnectCredentialRecord | undefined>;
     refreshCallerOwned?(input: CallerOwnedOAuthRefreshInput): Promise<ConnectBeginResult>;
     disconnect?(input: DisconnectInput): Promise<ConnectCredentialRecord | undefined>;
+    cancel?(input: PollDeviceInput): Promise<ConnectBeginResult>;
 }
 interface ConnectAttempt {
     id: string;
@@ -326,6 +347,8 @@ interface ConnectAttempt {
     deployment: GatewayDeployment;
     webId: string;
     mode: ConnectMode;
+    offeringId?: string;
+    authorizationMethodId?: string;
     state: string;
     signature: string;
     expiresAt: Date;
@@ -333,11 +356,13 @@ interface ConnectAttempt {
     expectedCredentialVersion?: number;
     codeVerifier?: string;
     deviceCode?: string;
+    userCode?: string;
     intervalSeconds?: number;
     currentPollIntervalSeconds?: number;
     nextPollAt?: Date;
     pollClaimedAt?: Date;
     lastPollStatus?: ConnectAttemptStatus;
+    terminalStatus?: Extract<ConnectAttemptStatus, 'denied' | 'cancelled' | 'expired'>;
 }
 interface PollClaimResult {
     attempt: ConnectAttempt;
@@ -348,7 +373,7 @@ export declare class InMemoryConnectAttemptStore {
     private readonly maxAttempts;
     create(attempt: ConnectAttempt): Promise<ConnectAttempt>;
     get(id: string, now?: Date): Promise<ConnectAttempt | undefined>;
-    consume(id: string, now: Date): Promise<ConnectAttempt>;
+    consume(id: string, now: Date, terminalStatus?: Extract<ConnectAttemptStatus, 'denied' | 'cancelled' | 'expired'>): Promise<ConnectAttempt>;
     claimPoll(id: string, now: Date): Promise<PollClaimResult>;
     updatePollSchedule(id: string, patch: {
         intervalSeconds: number;
@@ -359,9 +384,8 @@ export declare class InMemoryConnectAttemptStore {
     private pruneExpired;
     private pruneBounded;
 }
-export interface BrowserAssistedApiKeyConnectAdapterOptions {
+export interface SignedConnectAttemptAdapterOptions {
     provider: string;
-    consoleUrl: string;
     attempts: InMemoryConnectAttemptStore;
     credentialRepository: PodCredentialRepository;
     vault: CredentialVault;
@@ -370,9 +394,8 @@ export interface BrowserAssistedApiKeyConnectAdapterOptions {
     randomBytes?: (bytes: number) => Buffer;
     signingSecret: string;
 }
-export declare class BrowserAssistedApiKeyConnectAdapter implements ProviderConnectAdapter {
+declare abstract class SignedConnectAttemptAdapterBase {
     readonly provider: string;
-    private readonly consoleUrl;
     protected readonly attempts: InMemoryConnectAttemptStore;
     protected readonly credentialRepository: PodCredentialRepository;
     protected readonly vault: CredentialVault;
@@ -380,39 +403,97 @@ export declare class BrowserAssistedApiKeyConnectAdapter implements ProviderConn
     protected readonly now: () => Date;
     protected readonly randomBytes: (bytes: number) => Buffer;
     private readonly signingSecret;
-    constructor(options: BrowserAssistedApiKeyConnectAdapterOptions);
-    begin(input: ConnectBeginInput): Promise<ConnectBeginResult>;
-    completeApiKey(input: CompleteApiKeyInput): Promise<ConnectBeginResult>;
-    status(input: PollDeviceInput): Promise<ConnectBeginResult>;
-    disconnect(input: DisconnectInput): Promise<ConnectCredentialRecord | undefined>;
+    protected constructor(options: SignedConnectAttemptAdapterOptions);
     protected createAttempt(input: ConnectBeginInput, expiresAt: Date, extra?: Partial<ConnectAttempt>): Promise<ConnectAttempt>;
     protected loadAttemptForStatus(input: PollDeviceInput, mode: ConnectMode): Promise<ConnectAttempt>;
     protected loadConsumableAttempt(input: PollDeviceInput, mode: ConnectMode): Promise<ConnectAttempt>;
     protected statusForAttempt(attempt: ConnectAttempt): ConnectAttemptStatus;
     protected assertInput(input: ConnectBeginInput, mode: ConnectMode): void;
 }
-export interface KimiDeviceCodeConnectAdapterOptions extends Omit<BrowserAssistedApiKeyConnectAdapterOptions, 'provider' | 'consoleUrl'> {
+export interface BrowserAssistedApiKeyConnectAdapterOptions extends SignedConnectAttemptAdapterOptions {
+    consoleUrl: string;
+}
+export declare class BrowserAssistedApiKeyConnectAdapter extends SignedConnectAttemptAdapterBase implements ProviderConnectAdapter {
+    readonly mode: ConnectMode;
+    private readonly consoleUrl;
+    constructor(options: BrowserAssistedApiKeyConnectAdapterOptions);
+    begin(input: ConnectBeginInput): Promise<ConnectBeginResult>;
+    completeApiKey(input: CompleteApiKeyInput): Promise<ConnectBeginResult>;
+    status(input: PollDeviceInput): Promise<ConnectBeginResult>;
+    disconnect(input: DisconnectInput): Promise<ConnectCredentialRecord | undefined>;
+}
+export interface DeviceCodeConnectAdapterOptions extends Omit<SignedConnectAttemptAdapterOptions, 'provider'> {
     fetch?: typeof fetch;
-    oauthIntegration: OAuthIntegration;
-    deviceAuthorizationEndpoint?: string;
-    tokenEndpoint?: string;
+    integration: DeviceCodeOAuthIntegration;
+    requestTimeoutMs?: number;
 }
-export declare class KimiDeviceCodeConnectAdapter extends BrowserAssistedApiKeyConnectAdapter {
+export declare class DeviceCodeConnectAdapter extends SignedConnectAttemptAdapterBase {
+    readonly offeringId: string;
+    readonly mode: ConnectMode;
+    readonly authorizationMethodId = "device-code";
     private readonly fetchImpl;
+    private readonly integration;
     private readonly clientId;
-    private readonly deviceAuthorizationEndpoint;
-    private readonly tokenEndpoint;
+    private readonly protocol;
     private readonly oauthCredentials;
-    constructor(options: KimiDeviceCodeConnectAdapterOptions);
+    private readonly requestTimeoutMs;
+    constructor(options: DeviceCodeConnectAdapterOptions);
     begin(input: ConnectBeginInput): Promise<ConnectBeginResult>;
     pollDevice(input: PollDeviceInput): Promise<ConnectBeginResult>;
+    private pendingPollStatus;
     status(input: PollDeviceInput): Promise<ConnectBeginResult>;
+    cancel(input: PollDeviceInput): Promise<ConnectBeginResult>;
     refresh(input: RefreshInput, current: ConnectCredentialRecord, secret: ProviderSecret): Promise<ConnectCredentialRecord | undefined>;
     refreshCallerOwned(input: CallerOwnedOAuthRefreshInput): Promise<ConnectBeginResult>;
     disconnect(input: DisconnectInput): Promise<ConnectCredentialRecord | undefined>;
     private nowForConsume;
     private updateOAuthCredential;
     private findOAuthCredential;
+    private resolveTokenBody;
+    private providerRequest;
+    private assertOfferingInput;
+    private assertAuthorizationMethodInput;
+    private assertAttemptOffering;
+    private assertStoredOffering;
+    private isProviderOAuthCredential;
+}
+export interface AuthorizationCodeConnectAdapterOptions extends Omit<SignedConnectAttemptAdapterOptions, 'provider'> {
+    fetch?: typeof fetch;
+    integration: AuthorizationCodeOAuthIntegration;
+    callbackReceiver: AuthorizationCodeCallbackReceiver;
+    requestTimeoutMs?: number;
+}
+export declare class AuthorizationCodeConnectAdapter extends SignedConnectAttemptAdapterBase {
+    readonly offeringId: string;
+    readonly mode: ConnectMode;
+    readonly authorizationMethodId = "browser-oauth";
+    private readonly fetchImpl;
+    private readonly integration;
+    private readonly clientId;
+    private readonly callbackReceiver;
+    private readonly oauthCredentials;
+    private readonly requestTimeoutMs;
+    private readonly callbacks;
+    constructor(options: AuthorizationCodeConnectAdapterOptions);
+    begin(input: ConnectBeginInput): Promise<ConnectBeginResult>;
+    pollDevice(input: PollDeviceInput): Promise<ConnectBeginResult>;
+    status(input: PollDeviceInput): Promise<ConnectBeginResult>;
+    cancel(input: PollDeviceInput): Promise<ConnectBeginResult>;
+    refreshCallerOwned(input: CallerOwnedOAuthRefreshInput): Promise<ConnectBeginResult>;
+    refresh(input: RefreshInput, current: ConnectCredentialRecord, secret: ProviderSecret): Promise<ConnectCredentialRecord | undefined>;
+    disconnect(input: DisconnectInput): Promise<ConnectCredentialRecord | undefined>;
+    private authorizationUrl;
+    private exchangeAuthorizationCode;
+    private updateOAuthCredential;
+    private findOAuthCredential;
+    private providerRequest;
+    private assertOfferingInput;
+    private assertAuthorizationMethodInput;
+    private assertAttemptOffering;
+    private assertStoredOffering;
+    private isProviderOAuthCredential;
+    private loadAuthorizationAttempt;
+    private closeCallback;
 }
 export declare class DeepSeekConnectAdapter implements ProviderConnectAdapter {
     readonly provider = "deepseek";
@@ -479,6 +560,7 @@ export interface AiProviderPoolSummary {
         kind?: string;
         lifecycle: 'active' | 'legacy' | 'unavailable';
         authModes?: string[];
+        authorizationMethods?: OfferingAuthorizationMethod[];
         runtimeProviderIds?: string[];
         productLabel: string;
         credentialPrefixHints: string[];
@@ -504,6 +586,12 @@ export interface AiProviderPoolSummary {
     credentials: AiProviderCredentialSummary[];
     selectedModels: AiGatewayModelSummary[];
 }
+export interface ProviderOfferingAuthorizationMethodsSummary {
+    provider: string;
+    offeringId: string;
+    authorizationMethods: OfferingAuthorizationMethod[];
+    endpoints?: ProviderOfferingEndpointDescriptor[];
+}
 export interface ProviderCredentialTestModelsService {
     list(input: {
         webId: string;
@@ -520,6 +608,7 @@ export interface ProviderCredentialTestModelsService {
     }>;
 }
 export declare class ProviderConnectService {
+    private static readonly localImportLocks;
     private readonly registry;
     private readonly credentialRepository?;
     private readonly vault?;
@@ -527,6 +616,7 @@ export declare class ProviderConnectService {
     private readonly localSessionImporters;
     constructor(options: ProviderConnectServiceOptions);
     begin(input: ConnectBeginInput): Promise<ConnectBeginResult>;
+    getAuthorizationMethods(): ProviderOfferingAuthorizationMethodsSummary[];
     listProviders(input: {
         webId: string;
         deployment: GatewayDeployment;
@@ -559,6 +649,8 @@ export declare class ProviderConnectService {
         priority?: number;
         auth?: AuthContext;
     }): Promise<AiProviderCredentialSummary>;
+    private importLocalCredential;
+    private refreshImportedSecret;
     updateCredential(input: ProviderCredentialQuery & {
         credentialId: string;
         expectedVersion: number;
@@ -595,8 +687,18 @@ export declare class ProviderConnectService {
     refreshCallerOwned(input: CallerOwnedOAuthRefreshInput): Promise<ConnectBeginResult>;
     private refreshWithRetry;
     disconnect(input: DisconnectInput): Promise<ConnectCredentialRecord | undefined>;
+    cancel(input: PollDeviceInput): Promise<ConnectBeginResult>;
+    private runAttemptOperation;
+    private requireOAuthRefreshAdapter;
     private getRefreshCredential;
     private requireAdapter;
+    private requireAdapterForAttemptStatus;
+    private requireAdapterForDisconnect;
+    private findAdapter;
+    private findAdapterCandidates;
+    private requireConnectOffering;
+    private offeringSupportsConnectMode;
+    private authorizationMethodUnavailableReason;
 }
 export interface CustomProviderModel {
     id: string;