@undefineds.co/xpod 0.4.3 → 0.4.5

package/dist/api/ai-gateway/providers/ProviderRuntimeAdapter.js

@@ -78,6 +78,7 @@ class OpenAiCompatibleRuntimeAdapter extends BaseProviderRuntimeAdapter {
         this.supportsDeveloperMessages = options.supportsDeveloperMessages ?? true;
         this.allowToolChoiceRequired = options.allowToolChoiceRequired ?? true;
         this.descriptor = options.descriptor;
+        this.resolveModel = options.resolveModel;
         this.reasoningEffortMapper = options.reasoningEffortMapper;
         this.fallbackReasoningBody = options.fallbackReasoningBody;
         this.preserveReasoningContent = options.preserveReasoningContent ?? false;
@@ -145,6 +146,9 @@ class OpenAiCompatibleRuntimeAdapter extends BaseProviderRuntimeAdapter {
         };
     }
     findRegisteredModel(model) {
+        if (this.resolveModel) {
+            return this.resolveModel(this.provider, model);
+        }
         return this.descriptor?.models.find((candidate) => candidate.id === model);
     }
     resolveReasoningEffort(request, model) {
@@ -190,7 +194,7 @@ function toResponsesInputItems(message) {
     const functionCalls = responsesFunctionCallItems(message);
     const messageItem = {
         role: message.role,
-        content: message.content.flatMap(toOpenAiContentPart),
+        content: message.content.flatMap((part) => toOpenAiContentPart(part, message.role)),
         ...(message.name ? { name: message.name } : {}),
     };
     return [
@@ -328,7 +332,7 @@ function toChatCompletionsBody(request, options) {
         ...(options.reasoningEffort ? { reasoning_effort: options.reasoningEffort } : {}),
         messages: [
             ...(request.instructions ? [{ role: 'system', content: request.instructions }] : []),
-            ...request.messages.map((message) => toChatMessage(message, options)),
+            ...mergeAssistantToolMessages(request.messages).map((message) => toChatMessage(message, options)),
         ],
         ...(request.tools.length > 0 ? { tools: request.tools.map(toChatTool) } : {}),
     };
@@ -655,9 +659,9 @@ function classifyProviderStatus(status) {
     }
     return 'provider_error';
 }
-function toOpenAiContentPart(part) {
+function toOpenAiContentPart(part, role) {
     if (part.type === 'text') {
-        return [{ type: 'input_text', text: part.text }];
+        return [{ type: role === 'assistant' ? 'output_text' : 'input_text', text: part.text }];
     }
     return [{
             type: 'input_image',
@@ -687,6 +691,35 @@ function toAnthropicContentPart(part) {
         },
     };
 }
+// Responses emits text and each tool call as separate items in one assistant turn.
+// Chat requires all calls in one message followed immediately by their tool results.
+function mergeAssistantToolMessages(messages) {
+    const merged = [];
+    for (const message of messages) {
+        const previous = merged[merged.length - 1];
+        const previousCalls = previous?.protocolExtensions?.tool_calls;
+        const calls = message.protocolExtensions?.tool_calls;
+        if (previous?.role === 'assistant' && message.role === 'assistant'
+            && (Array.isArray(previousCalls) || Array.isArray(calls))) {
+            merged[merged.length - 1] = {
+                ...previous,
+                content: [...previous.content, ...message.content],
+                protocolExtensions: {
+                    ...previous.protocolExtensions,
+                    ...message.protocolExtensions,
+                    tool_calls: [
+                        ...(Array.isArray(previousCalls) ? previousCalls : []),
+                        ...(Array.isArray(calls) ? calls : []),
+                    ],
+                },
+            };
+        }
+        else {
+            merged.push(message);
+        }
+    }
+    return merged;
+}
 function toChatMessage(message, options) {
     const base = {
         role: message.role,

package/dist/api/ai-gateway/providers/ProviderRuntimeRegistry.js

@@ -16,6 +16,9 @@ class ProviderRuntimeRegistry {
         this.adapters = new Map();
         const registry = options.registry ?? (0, ProviderRegistry_1.createDefaultProviderRegistry)();
         const transport = options.transport ?? new provider_http_transport_1.ProviderHttpTransport();
+        // Discovery replaces registry descriptors after these singleton adapters are created.
+        const resolveModel = (provider, model) => registry.requireProvider(provider)
+            .models.find((candidate) => candidate.id === model);
         this.adapters.set('openai', new OpenAiRuntimeAdapter_1.OpenAiRuntimeAdapter({
             transport,
             provider: registry.requireProvider('openai'),
@@ -23,16 +26,19 @@ class ProviderRuntimeRegistry {
         this.adapters.set('anthropic', new AnthropicRuntimeAdapter_1.AnthropicRuntimeAdapter({ transport }));
         this.adapters.set('kimi', new KimiRuntimeAdapter_1.KimiRuntimeAdapter({
             transport,
+            resolveModel,
             provider: registry.requireProvider('kimi'),
         }));
         this.adapters.set('bailian', new BailianRuntimeAdapter_1.BailianRuntimeAdapter({ transport }));
         this.adapters.set('deepseek', new DeepSeekRuntimeAdapter_1.DeepSeekRuntimeAdapter({
             transport,
+            resolveModel,
             provider: registry.requireProvider('deepseek'),
         }));
         const zhipu = registry.requireProvider('zhipu');
         this.adapters.set('zhipu', new ProviderRuntimeAdapter_1.OpenAiCompatibleRuntimeAdapter({
             transport,
+            resolveModel,
             provider: 'zhipu',
             descriptor: zhipu,
             defaultBaseUrl: zhipu.defaultBaseUrl,
@@ -44,6 +50,7 @@ class ProviderRuntimeRegistry {
         const ollama = registry.requireProvider('ollama');
         this.adapters.set('ollama', new ProviderRuntimeAdapter_1.OpenAiCompatibleRuntimeAdapter({
             transport,
+            resolveModel,
             provider: 'ollama',
             descriptor: ollama,
             defaultBaseUrl: ollama.defaultBaseUrl,

package/dist/api/ai-gateway/quota/SubscriptionQuotaAdapters.js

@@ -88,7 +88,8 @@ class KimiCodeSubscriptionQuotaAdapter extends SubscriptionQuotaAdapter {
     }
     supports(credential) {
         return (credential.offeringId === 'official-subscription' && credential.authMode === 'deviceCodeOAuth')
-            || (credential.offeringId === 'subscription-key' && credential.authMode === 'apiKey');
+            || (credential.offeringId === 'subscription-key'
+                && (credential.authMode === 'apiKey' || credential.authMode === 'deviceCodeOAuth'));
     }
     async fetch(input) {
         const token = bearerFromSecret(input.secret);

package/dist/api/ai-gateway/routing/ModelRouter.js

@@ -4,6 +4,7 @@ exports.ModelRouter = void 0;
 const errors_1 = require("../errors");
 const connect_1 = require("../connect");
 const ProviderRegistry_1 = require("../providers/ProviderRegistry");
+const ModelsDevCatalog_1 = require("../providers/ModelsDevCatalog");
 class ModelRouter {
     constructor(options) {
         this.registry = options.registry;
@@ -537,7 +538,8 @@ function sameModel(left, right) {
 }
 function modelProjection(provider, modelId) {
     const descriptor = provider.models.find((model) => sameModel(model.id, modelId)
-        || (model.aliases ?? []).some((alias) => sameModel(alias, modelId)));
+        || (model.aliases ?? []).some((alias) => sameModel(alias, modelId)))
+        ?? (0, ModelsDevCatalog_1.lookupModelsDevModelDescriptor)((0, ProviderRegistry_1.normalizeProviderId)(provider.id), modelIdentity(modelId));
     return {
         id: modelIdentity(modelId),
         object: 'model',

package/dist/api/container/common.js

@@ -31,6 +31,10 @@ const HostedPodDataAccess_1 = require("../ai-gateway/pod/HostedPodDataAccess");
 const AiGatewayService_1 = require("../ai-gateway/AiGatewayService");
 const PlaintextCredentialVault_1 = require("../ai-gateway/credentials/PlaintextCredentialVault");
 const connect_1 = require("../ai-gateway/connect");
+const LoopbackAuthorizationCallbackReceiver_1 = require("../ai-gateway/connect/LoopbackAuthorizationCallbackReceiver");
+const FileSessionImportAdapter_1 = require("../ai-gateway/connect/FileSessionImportAdapter");
+const SessionImportProfiles_1 = require("../ai-gateway/connect/SessionImportProfiles");
+const ProviderAuthorizationProfiles_1 = require("../ai-gateway/connect/ProviderAuthorizationProfiles");
 const ProviderRegistry_1 = require("../ai-gateway/providers/ProviderRegistry");
 const ModelsDevCatalog_1 = require("../ai-gateway/providers/ModelsDevCatalog");
 const ProviderRuntimeRegistry_1 = require("../ai-gateway/providers/ProviderRuntimeRegistry");
@@ -186,51 +190,37 @@ function registerCommonServices(container) {
             // state, so a process-random signing secret is sufficient by default.
             const signingSecret = config.aiGatewayConnectSigningSecret ?? (0, node_crypto_1.randomBytes)(32).toString('hex');
             const attempts = new connect_1.InMemoryConnectAttemptStore();
+            const registry = (0, ProviderRegistry_1.createDefaultProviderRegistry)({
+                products: (0, ProviderRegistry_1.providerProductsForDeployment)(config.edition),
+            });
+            const adapterOptions = {
+                attempts, credentialRepository, vault, deployment: config.edition, signingSecret,
+            };
+            const callbackReceiver = new LoopbackAuthorizationCallbackReceiver_1.LoopbackAuthorizationCallbackReceiver();
             const adapters = [
-                new connect_1.BrowserAssistedApiKeyConnectAdapter({
-                    provider: 'openai',
-                    consoleUrl: 'https://platform.openai.com/api-keys',
-                    attempts,
-                    credentialRepository,
-                    vault,
-                    deployment: config.edition,
-                    signingSecret,
-                }),
-                new connect_1.BrowserAssistedApiKeyConnectAdapter({
-                    provider: 'anthropic',
-                    consoleUrl: 'https://console.anthropic.com/settings/keys',
-                    attempts,
-                    credentialRepository,
-                    vault,
-                    deployment: config.edition,
-                    signingSecret,
-                }),
-                new connect_1.BrowserAssistedApiKeyConnectAdapter({
-                    provider: 'kimi',
-                    consoleUrl: 'https://platform.moonshot.cn/console/api-keys',
-                    attempts,
-                    credentialRepository,
-                    vault,
-                    deployment: config.edition,
-                    signingSecret,
-                }),
-                new connect_1.BrowserAssistedApiKeyConnectAdapter({
-                    provider: 'bailian',
-                    consoleUrl: 'https://bailian.console.aliyun.com/',
-                    attempts,
-                    credentialRepository,
-                    vault,
-                    deployment: config.edition,
-                    signingSecret,
-                }),
+                ...registry.listProviders()
+                    .filter((provider) => provider.connect?.mode === 'browserAssistedApiKey')
+                    .map((provider) => new connect_1.BrowserAssistedApiKeyConnectAdapter({
+                    ...adapterOptions,
+                    provider: provider.id,
+                    consoleUrl: registry.requireProduct(provider.id).offerings
+                        .find((offering) => offering.kind === 'api-platform')?.consoleUrl
+                        ?? registry.requireProduct(provider.id).offerings[0].consoleUrl,
+                })),
+                ...(config.edition === 'local' ? (0, ProviderAuthorizationProfiles_1.createBrowserOAuthIntegrations)().map((integration) => new connect_1.AuthorizationCodeConnectAdapter({
+                    ...adapterOptions, integration, callbackReceiver,
+                })) : []),
+                ...(0, ProviderAuthorizationProfiles_1.createProviderOAuthIntegrations)().map((integration) => new connect_1.DeviceCodeConnectAdapter({
+                    ...adapterOptions,
+                    integration,
+                })),
             ];
             return new connect_1.ProviderConnectService({
-                registry: (0, ProviderRegistry_1.createDefaultProviderRegistry)({
-                    products: (0, ProviderRegistry_1.providerProductsForDeployment)(config.edition),
-                }),
+                registry,
                 adapters,
                 localSessionImporters: config.edition === 'local'
-                    ? [new connect_1.OpenAiSubscriptionSessionImportAdapter()]
+                    ? [SessionImportProfiles_1.OPENAI_CODEX_SESSION_IMPORT_PROFILE, SessionImportProfiles_1.KIMI_CODE_SESSION_IMPORT_PROFILE]
+                        .map((profile) => new FileSessionImportAdapter_1.FileSessionImportAdapter({ profile }))
                     : [],
                 credentialRepository,
                 vault,

package/dist/api/container/index.js

@@ -130,8 +130,12 @@ function loadConfigFromEnv() {
         ?? (nodeToken
             ? OFFICIAL_CLOUD_IDENTITY_ORIGIN
             : undefined);
-    const cloudApiEndpoint = localSetupState?.cloudApiUrl
-        ?? (oidcIssuer ? (0, oidc_issuer_1.cloudApiEndpointFromIssuer)(oidcIssuer) : undefined);
+    const localIdentityProvider = edition === 'local' && oidcIssuer && solidBaseUrl
+        && new URL(oidcIssuer).origin === new URL(solidBaseUrl).origin;
+    const cloudApiEndpoint = localIdentityProvider
+        ? undefined
+        : localSetupState?.cloudApiUrl
+            ?? (oidcIssuer ? (0, oidc_issuer_1.cloudApiEndpointFromIssuer)(oidcIssuer) : undefined);
     const tunnelProfileState = (0, TunnelProfiles_1.resolveTunnelProfileState)(process.env);
     const managedCloudTunnelProfile = localSetupState?.tunnelProvider === 'cloudflare' && localSetupState.tunnelToken
         ? {

package/dist/api/container/routes.js

@@ -193,6 +193,11 @@ function registerSharedRoutes(container, server) {
         providerModelSelectionService,
         customModelsService: providerCustomModelsService,
         gatewayAccessKeyRepository,
+        validateClientCredential: (apiKey) => container.resolve('authenticator').authenticate({
+            headers: { authorization: `Bearer ${apiKey}` },
+            method: 'POST',
+            url: '/api/ai/gateway/keys',
+        }),
         aiClientConfiguration: aiClientConfigurationService?.capability(),
         aiConnectionInvocationKeyIssuer,
     });
@@ -324,31 +329,9 @@ function resolveAiClientConfigurationService(container, config) {
     if (!capability?.enabled || capability.authority !== 'local-filesystem') {
         return undefined;
     }
-    const modelSelectionService = container.resolve('providerModelSelectionService', { allowUnregistered: true });
-    const providerRegistry = container.resolve('gatewayProviderRegistry', { allowUnregistered: true });
     return new AiClientConfigurationService_1.AiClientConfigurationService({
         homeDir: capability.homeDir,
         backupRoot: capability.backupRoot,
-        ...(modelSelectionService && providerRegistry ? {
-            listActiveModels: async ({ webId, auth }) => {
-                const catalogs = await Promise.allSettled(providerRegistry.listProviders().map(async ({ id: provider }) => (await modelSelectionService.getCatalog({
-                    webId,
-                    provider,
-                    deployment: config.edition,
-                    auth,
-                }))));
-                return catalogs.flatMap((result) => result.status === 'fulfilled'
-                    ? result.value.models
-                        .filter((model) => model.selected && model.availability === 'available')
-                        .map((model) => ({
-                        id: model.id,
-                        provider: result.value.provider,
-                        ...(model.displayName ? { displayName: model.displayName } : {}),
-                        availability: model.availability,
-                    }))
-                    : []);
-            },
-        } : {}),
     });
 }
 function createDynamicEdgeCertificateBridge(config) {

package/dist/api/handlers/AiClientConfigurationHandler.js

@@ -17,7 +17,7 @@ function registerAiClientConfigurationRoutes(server, options) {
         if (!authorizeClientConfig(request, response, 'client-config:read')) {
             return;
         }
-        await sendServiceResult(response, () => options.service.inspect(requireClient(params.client)));
+        await sendServiceResult(response, () => options.service.inspect(requireClient(params.client), request.auth?.type === 'solid' ? request.auth.webId : undefined));
     });
     server.post('/api/ai/client-configuration/:client/plan', async (request, response, params) => {
         if (!requireService(options, response))
@@ -33,6 +33,7 @@ function registerAiClientConfigurationRoutes(server, options) {
             client: requireClient(params.client),
             endpoint: requireString(body.endpoint, 'endpoint'),
             model: optionalString(body.model),
+            activeModels: optionalModelCatalog(body.activeModels),
             auth: request.auth,
             webId: request.auth?.type === 'solid' ? request.auth.webId : optionalString(body.webId),
         }));
@@ -172,6 +173,43 @@ function requireString(value, field) {
 function optionalString(value) {
     return typeof value === 'string' && value.trim() ? value.trim() : undefined;
 }
+function optionalModelCatalog(value) {
+    if (value === undefined)
+        return undefined;
+    const invalid = () => {
+        throw new AiClientConfigurationService_1.AiClientConfigurationError('invalid_request', 'activeModels must contain valid model metadata.', 400);
+    };
+    if (!Array.isArray(value))
+        return invalid();
+    return value.map((entry) => {
+        if (!entry || typeof entry !== 'object' || Array.isArray(entry))
+            return invalid();
+        const model = entry;
+        if (typeof model.id !== 'string' || !model.id.trim() || [...model.id].some((character) => character.charCodeAt(0) < 32))
+            return invalid();
+        if (model.provider !== undefined && (typeof model.provider !== 'string' || !model.provider.trim()))
+            return invalid();
+        if (model.displayName !== undefined && typeof model.displayName !== 'string')
+            return invalid();
+        if (model.availability !== undefined && !['available', 'unavailable', 'statusUnknown'].includes(String(model.availability)))
+            return invalid();
+        if (model.contextWindow !== undefined && (typeof model.contextWindow !== 'number' || !Number.isSafeInteger(model.contextWindow) || model.contextWindow <= 0))
+            return invalid();
+        for (const key of ['inputModalities', 'capabilities']) {
+            if (model[key] !== undefined && (!Array.isArray(model[key]) || !model[key].every((item) => typeof item === 'string')))
+                return invalid();
+        }
+        return {
+            id: model.id.trim(),
+            ...(model.provider !== undefined ? { provider: model.provider.trim() } : {}),
+            ...(model.displayName !== undefined ? { displayName: model.displayName } : {}),
+            ...(model.availability !== undefined ? { availability: model.availability } : {}),
+            ...(model.contextWindow !== undefined ? { contextWindow: model.contextWindow } : {}),
+            ...(model.inputModalities !== undefined ? { inputModalities: model.inputModalities } : {}),
+            ...(model.capabilities !== undefined ? { capabilities: model.capabilities } : {}),
+        };
+    });
+}
 function optionalConfirmation(value) {
     if (!value || typeof value !== 'object' || Array.isArray(value))
         return undefined;

package/dist/api/handlers/AiGatewayManagementHandler.d.ts

@@ -1,4 +1,5 @@
 import type { ApiServer } from '../ApiServer';
+import type { AuthResult } from '../auth/Authenticator';
 import type { GatewayDeployment } from '../ai-gateway/auth/GatewayApiKey';
 import { type GatewayAccessKeyRepository } from '../ai-gateway/auth/GatewayApiKeyAuthenticator';
 import type { ProviderConnectService } from '../ai-gateway/connect';
@@ -22,6 +23,8 @@ export interface AiGatewayManagementHandlerOptions {
         }>;
     };
     gatewayAccessKeyRepository?: GatewayAccessKeyRepository;
+    /** Reuses the configured CSS authenticator; never trusts the claimed registration owner. */
+    validateClientCredential?: (apiKey: string) => Promise<AuthResult>;
     aiClientConfiguration?: AiClientConfigurationCapabilityDescriptor;
     aiConnectionInvocationKeyIssuer?: Pick<AiConnectionsInvocationKeyIssuer, 'issue' | 'issueClientConfiguration'>;
     jsonBodyLimitBytes?: number;