@undefineds.co/xpod 0.4.3 → 0.4.5

package/dist/api/handlers/AiGatewayManagementHandler.js

@@ -1,11 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.registerAiGatewayManagementRoutes = registerAiGatewayManagementRoutes;
+const node_crypto_1 = require("node:crypto");
 const global_logger_factory_1 = require("global-logger-factory");
 const readBoundedJsonBody_1 = require("../http/readBoundedJsonBody");
 const GatewayPrincipal_1 = require("../ai-gateway/auth/GatewayPrincipal");
-const GatewayApiKey_1 = require("../ai-gateway/auth/GatewayApiKey");
-const GatewayApiKeyAuthenticator_1 = require("../ai-gateway/auth/GatewayApiKeyAuthenticator");
 const models_1 = require("../ai-gateway/models");
 const AiConnectionsServiceAccess_1 = require("../ai-gateway/service-access/AiConnectionsServiceAccess");
 const AiClientConfigurationService_1 = require("../service/AiClientConfigurationService");
@@ -91,31 +90,50 @@ function registerAiGatewayManagementRoutes(server, options) {
         }
         try {
             const auth = request.auth;
-            const owner = (0, GatewayPrincipal_1.ownerWebIdForGatewayKeyManagement)(auth, normalizeOptionalString(body.owner));
+            const owner = auth.type === 'solid' ? (0, GatewayPrincipal_1.ownerWebIdForGatewayKeyManagement)(auth, undefined) : undefined;
             if (!owner) {
                 sendJson(response, 403, { error: 'Gateway API key management requires an owner WebID' });
                 return;
             }
-            const name = normalizeOptionalString(body.name) ?? `Xpod API Key ${new Date().toLocaleString('sv-SE')}`;
-            const keyId = repository.createKeyId?.(owner, options.deployment);
-            const issued = await (0, GatewayApiKey_1.createGatewayApiKey)({
-                deployment: options.deployment,
-                ...(keyId ? { keyId } : {}),
-            });
+            const apiKey = typeof body.apiKey === 'string' ? body.apiKey : '';
+            const credentialResource = validCredentialResource(body.credentialResource);
+            if (!validClientCredentialWrapper(apiKey) || !credentialResource) {
+                sendJson(response, 400, { error: 'A CSS client credential wrapper and Account credential resource are required' });
+                return;
+            }
+            if (!options.validateClientCredential || !repository.createKeyId) {
+                sendJson(response, 503, { error: 'CSS credential registration is unavailable' });
+                return;
+            }
+            const verified = await options.validateClientCredential(apiKey);
+            if (!verified.success || verified.context?.type !== 'solid') {
+                sendJson(response, verified.category === 'service_unavailable' ? 503 : 401, {
+                    error: 'CSS client credential verification failed',
+                });
+                return;
+            }
+            if (verified.context.webId !== owner) {
+                sendJson(response, 403, { error: 'CSS client credential belongs to another WebID' });
+                return;
+            }
+            const name = normalizeOptionalString(body.name) ?? 'Xpod API Key';
+            const keyId = repository.createKeyId(owner, options.deployment);
             const createdAt = new Date();
             const record = await repository.create({
-                id: issued.record.id,
+                id: keyId,
+                kind: 'client-credentials',
                 owner,
-                secretHash: issued.record.secretHash,
-                deployment: issued.record.deployment,
-                scopes: normalizeGatewayScopes(body.scopes),
+                secretHash: '',
+                deployment: options.deployment,
+                scopes: [],
                 createdAt,
                 name,
-                plaintext: issued.plaintext,
+                credentialResource,
+                plaintext: apiKey,
             }, { auth });
             sendJson(response, 201, {
-                key: issued.plaintext,
-                record: publicGatewayAccessKeyRecord(record, true),
+                key: apiKey,
+                record: publicGatewayAccessKeyRecord(record, true, apiKey),
             });
         }
         catch (error) {
@@ -169,6 +187,10 @@ function registerAiGatewayManagementRoutes(server, options) {
                 sendJson(response, 404, { error: 'Gateway API Key not found' });
                 return;
             }
+            if (record.kind === 'client-credentials') {
+                sendJson(response, 409, { error: 'CSS client credentials cannot be suspended through Pod metadata' });
+                return;
+            }
             const updated = await repository.setEnabled(record.id, body.enabled, new Date(), { auth: request.auth });
             if (!updated) {
                 sendJson(response, 404, { error: 'Gateway API Key not found' });
@@ -197,6 +219,8 @@ function registerAiGatewayManagementRoutes(server, options) {
                 sendJson(response, 404, { error: 'Gateway API Key not found' });
                 return;
             }
+            // This removes the saved client configuration only. The Account host
+            // revokes CSS credentials before requesting this companion cleanup.
             await repository.delete(record.id, { auth: request.auth });
             sendJson(response, 200, {
                 deleted: true,
@@ -207,6 +231,14 @@ function registerAiGatewayManagementRoutes(server, options) {
             sendGatewayAccessKeyError(response, error);
         }
     });
+    server.get('/api/ai/connections/authorization-methods', async (request, response) => {
+        if (!authorizeProviderConnect(request, response))
+            return;
+        const connectService = requireConnectService(options, response);
+        if (!connectService)
+            return;
+        sendJson(response, 200, { data: connectService.getAuthorizationMethods() });
+    });
     server.get('/api/ai/connections/providers', async (request, response) => {
         if (!authorizeProviderConnect(request, response)) {
             return;
@@ -443,7 +475,7 @@ function registerAiGatewayManagementRoutes(server, options) {
             return;
         }
         const mode = typeof body.mode === 'string' ? body.mode : undefined;
-        if (mode !== 'browserAssistedApiKey' && mode !== 'deviceCodeOAuth' && mode !== 'connectUnsupported') {
+        if (mode !== 'browserAssistedApiKey' && mode !== 'authorizationCodeOAuth' && mode !== 'deviceCodeOAuth' && mode !== 'connectUnsupported') {
             sendJson(response, 400, { error: 'mode must be a supported Connect mode' });
             return;
         }
@@ -451,17 +483,26 @@ function registerAiGatewayManagementRoutes(server, options) {
         if (!connectService) {
             return;
         }
-        const result = await connectService.begin({
-            webId: request.auth.webId,
-            deployment: options.deployment,
-            provider: params.provider,
-            requestedMode: mode,
-            expectedCredentialVersion: typeof body.expectedCredentialVersion === 'number'
-                ? body.expectedCredentialVersion
-                : undefined,
-            auth: request.auth,
-        });
-        sendJson(response, 200, publicConnectResult(result));
+        try {
+            const result = await connectService.begin({
+                webId: request.auth.webId,
+                deployment: options.deployment,
+                provider: params.provider,
+                requestedMode: mode,
+                ...(normalizeOptionalString(body.offeringId) ? { offeringId: normalizeOptionalString(body.offeringId) } : {}),
+                ...(normalizeOptionalString(body.authorizationMethodId)
+                    ? { authorizationMethodId: normalizeOptionalString(body.authorizationMethodId) }
+                    : {}),
+                expectedCredentialVersion: typeof body.expectedCredentialVersion === 'number'
+                    ? body.expectedCredentialVersion
+                    : undefined,
+                auth: request.auth,
+            });
+            sendJson(response, 200, publicConnectResult(result));
+        }
+        catch (error) {
+            sendLegacyProviderConnectError(response, error);
+        }
     });
     server.get('/api/ai/gateway/providers/:provider/connect/status/:attemptId', async (request, response, params) => {
         if (!authorizeProviderConnect(request, response)) {
@@ -473,16 +514,23 @@ function registerAiGatewayManagementRoutes(server, options) {
         if (!connectService) {
             return;
         }
-        const result = await connectService.status({
-            webId: request.auth.webId,
-            deployment: options.deployment,
-            provider: params.provider,
-            attemptId: decodeURIComponent(params.attemptId),
-            state: url.searchParams.get('state') ?? '',
-            signature: url.searchParams.get('signature') ?? '',
-            auth: request.auth,
-        });
-        sendJson(response, 200, publicConnectResult(result));
+        try {
+            const result = await connectService.status({
+                webId: request.auth.webId,
+                deployment: options.deployment,
+                provider: params.provider,
+                ...(url.searchParams.get('mode') === 'authorizationCodeOAuth' ? { mode: 'authorizationCodeOAuth' } : {}),
+                attemptId: decodeURIComponent(params.attemptId),
+                state: url.searchParams.get('state') ?? '',
+                signature: url.searchParams.get('signature') ?? '',
+                ...(url.searchParams.get('offeringId') ? { offeringId: url.searchParams.get('offeringId') } : {}),
+                auth: request.auth,
+            });
+            sendJson(response, 200, publicConnectResult(result));
+        }
+        catch (error) {
+            sendLegacyProviderConnectError(response, error);
+        }
     });
     server.post('/api/ai/gateway/providers/:provider/connect/complete-api-key', async (request, response, params) => {
         if (!authorizeProviderConnect(request, response)) {
@@ -507,6 +555,7 @@ function registerAiGatewayManagementRoutes(server, options) {
                 webId: request.auth.webId,
                 deployment: options.deployment,
                 provider: params.provider,
+                ...(normalizeOptionalString(body.offeringId) ? { offeringId: normalizeOptionalString(body.offeringId) } : {}),
                 attemptId: stringBody(body.attemptId),
                 state: stringBody(body.state),
                 signature: stringBody(body.signature),
@@ -534,16 +583,50 @@ function registerAiGatewayManagementRoutes(server, options) {
         if (!connectService) {
             return;
         }
-        const result = await connectService.pollDevice({
-            webId: request.auth.webId,
-            deployment: options.deployment,
-            provider: params.provider,
-            attemptId: stringBody(body.attemptId),
-            state: stringBody(body.state),
-            signature: stringBody(body.signature),
-            auth: request.auth,
-        });
-        sendJson(response, 200, publicConnectResult(result));
+        try {
+            const result = await connectService.pollDevice({
+                webId: request.auth.webId,
+                deployment: options.deployment,
+                provider: params.provider,
+                ...(body.mode === 'authorizationCodeOAuth' || body.mode === 'deviceCodeOAuth' ? { mode: body.mode } : {}),
+                attemptId: stringBody(body.attemptId),
+                state: stringBody(body.state),
+                signature: stringBody(body.signature),
+                ...(normalizeOptionalString(body.offeringId) ? { offeringId: normalizeOptionalString(body.offeringId) } : {}),
+                auth: request.auth,
+            });
+            sendJson(response, 200, publicConnectResult(result));
+        }
+        catch (error) {
+            sendLegacyProviderConnectError(response, error);
+        }
+    });
+    server.post('/api/ai/gateway/providers/:provider/connect/cancel', async (request, response, params) => {
+        if (!authorizeProviderConnect(request, response))
+            return;
+        const body = await readJsonObject(request, response, jsonBodyLimitBytes);
+        if (!body)
+            return;
+        const connectService = requireConnectService(options, response);
+        if (!connectService)
+            return;
+        try {
+            const result = await connectService.cancel({
+                webId: request.auth.webId,
+                deployment: options.deployment,
+                provider: params.provider,
+                ...(body.mode === 'authorizationCodeOAuth' || body.mode === 'deviceCodeOAuth' ? { mode: body.mode } : {}),
+                attemptId: stringBody(body.attemptId),
+                state: stringBody(body.state),
+                signature: stringBody(body.signature),
+                ...(normalizeOptionalString(body.offeringId) ? { offeringId: normalizeOptionalString(body.offeringId) } : {}),
+                auth: request.auth,
+            });
+            sendJson(response, 200, publicConnectResult(result));
+        }
+        catch (error) {
+            sendLegacyProviderConnectError(response, error);
+        }
     });
     server.post('/api/ai/gateway/providers/:provider/connect/refresh', async (request, response, params) => {
         if (!authorizeProviderConnect(request, response)) {
@@ -570,9 +653,11 @@ function registerAiGatewayManagementRoutes(server, options) {
                 webId: request.auth.webId,
                 deployment: options.deployment,
                 provider: params.provider,
+                ...(body.mode === 'authorizationCodeOAuth' || body.mode === 'deviceCodeOAuth' ? { mode: body.mode } : {}),
                 credentialId,
                 refreshToken,
                 expectedVersion,
+                ...(normalizeOptionalString(body.offeringId) ? { offeringId: normalizeOptionalString(body.offeringId) } : {}),
                 auth: request.auth,
             });
             sendJson(response, 200, publicConnectResult(result));
@@ -597,6 +682,7 @@ function registerAiGatewayManagementRoutes(server, options) {
                 deployment: options.deployment,
                 provider: params.provider,
                 credentialId: normalizeOptionalString(url.searchParams.get('credentialId')),
+                ...(url.searchParams.get('offeringId') ? { offeringId: url.searchParams.get('offeringId') } : {}),
                 auth: request.auth,
             });
             sendJson(response, 200, { record: record ? publicCredentialRecord(record) : undefined });
@@ -965,6 +1051,7 @@ function requireCredentialPoolManagementService(options, response) {
     return requireConnectService(options, response);
 }
 function markLegacyProviderConnectRoute(response) {
+    response.setHeader('Cache-Control', 'no-store');
     response.setHeader('Deprecation', 'true');
     response.setHeader('Link', '</api/ai/providers>; rel="successor-version"');
 }
@@ -1073,15 +1160,25 @@ function normalizeCustomModelInput(body) {
         ...(capabilities.length > 0 ? { capabilities } : {}),
     };
 }
-function normalizeGatewayScopes(value) {
-    if (!Array.isArray(value)) {
-        return [...GatewayApiKeyAuthenticator_1.DEFAULT_GATEWAY_API_KEY_SCOPES];
-    }
-    const scopes = value
-        .filter((item) => typeof item === 'string')
-        .map((item) => item.trim())
-        .filter(Boolean);
-    return scopes.length ? [...new Set(scopes)] : [...GatewayApiKeyAuthenticator_1.DEFAULT_GATEWAY_API_KEY_SCOPES];
+function validClientCredentialWrapper(value) {
+    if (!value.startsWith('sk-'))
+        return false;
+    const encoded = value.slice(3);
+    const decoded = Buffer.from(encoded, 'base64').toString('utf8');
+    return Buffer.from(decoded, 'utf8').toString('base64') === encoded
+        && /^[^\s\x00-\x1f\x7f:]+:[^\s\x00-\x1f\x7f]+$/u.test(decoded);
+}
+function validCredentialResource(value) {
+    if (typeof value !== 'string')
+        return undefined;
+    try {
+        const url = new URL(value);
+        return ['http:', 'https:'].includes(url.protocol) && !url.username && !url.password && !url.search && !url.hash
+            && url.pathname.startsWith('/.account/') ? url.href : undefined;
+    }
+    catch {
+        return undefined;
+    }
 }
 async function ownedGatewayAccessKey(repository, keyId, auth) {
     if (!keyId) {
@@ -1114,6 +1211,9 @@ function publicGatewayAccessKeyRecord(record, plaintextAvailable, plaintext) {
     const enabled = !record.disabledAt && !record.revokedAt;
     return {
         id: record.id,
+        ...(record.kind ? { kind: record.kind } : {}),
+        ...(record.credentialResource ? { credentialResource: record.credentialResource } : {}),
+        ...(plaintext ? { fingerprint: (0, node_crypto_1.createHash)('sha256').update(plaintext).digest('hex') } : {}),
         owner: record.owner,
         deployment: record.deployment,
         scopes: record.scopes,
@@ -1216,6 +1316,11 @@ function sendCredentialPoolError(response, error) {
         return;
     }
     const message = error instanceof Error ? error.message : String(error);
+    if (message === 'local_session_reauth_required' || message === 'local_session_missing_refresh_token'
+        || message === 'local_session_refresh_failed') {
+        sendJson(response, message === 'local_session_refresh_failed' ? 502 : 409, { error: message });
+        return;
+    }
     if (message === 'credential_version_conflict') {
         sendJson(response, 409, { error: 'credential_version_conflict' });
         return;
@@ -1252,7 +1357,7 @@ function sendGatewayAccessKeyError(response, error) {
         sendJson(response, 500, { error: 'Gateway API Key secret could not be saved' });
         return;
     }
-    logger.error(`Gateway API Key operation failed: ${message}`);
+    logger.error(`Gateway API Key operation failed: ${(0, AiClientConfigurationService_1.redactSecretText)(message)}`);
     sendJson(response, 500, { error: 'Gateway API Key operation failed' });
 }
 function sendLegacyProviderConnectError(response, error) {
@@ -1262,6 +1367,14 @@ function sendLegacyProviderConnectError(response, error) {
         return;
     }
     const message = error instanceof Error ? error.message : String(error);
+    if (/^OAuth refresh failed: (?:invalid_grant|invalid_token)$/u.test(message)) {
+        sendJson(response, 409, { error: 'oauth_session_reauth_required' });
+        return;
+    }
+    if (message.startsWith('OAuth refresh failed:')) {
+        sendJson(response, 502, { error: 'oauth_refresh_failed' });
+        return;
+    }
     if (message === 'credential_version_conflict') {
         sendJson(response, 409, { error: 'credential_version_conflict' });
         return;
@@ -1547,6 +1660,8 @@ function publicConnectResult(value) {
         'webId',
         'encryptedSecret',
         'metadata',
+        'deviceCode',
+        'codeVerifier',
     ].includes(key))
         .map(([key, item]) => [key, publicConnectResult(item)]));
 }

package/dist/api/service/AiClientConfigurationService.d.ts

@@ -1,3 +1,4 @@
+import { type AiClientModelReference } from '@undefineds.co/ai-connections/client-config';
 import type { AuthContext } from '../auth/AuthContext';
 export type AiClientId = 'codex' | 'claude-code' | 'pi' | 'codebuddy';
 export interface AiClientConfigurationCapabilityDescriptor {
@@ -10,6 +11,7 @@ export interface AiClientConfigurationStatus {
     message?: string;
     installed?: boolean;
     configExists?: boolean;
+    appliedKeyFingerprint?: string;
 }
 export interface AiClientConfigurationPlan {
     planId: string;
@@ -44,24 +46,13 @@ export interface AiClientConfigurationServiceOptions {
     }) => Promise<unknown>;
     fetch?: typeof fetch;
     verificationTimeoutMs?: number;
-    /** Current authenticated Gateway projection; never use an unauthenticated HTTP self-fetch. */
-    listActiveModels?: (input: {
-        webId: string;
-        auth: AuthContext;
-    }) => Promise<readonly AiClientVisibleModel[]>;
     launchClient?: (client: AiClientId) => Promise<void>;
 }
-export interface AiClientVisibleModel {
-    id: string;
-    provider?: string;
-    owned_by?: string;
-    displayName?: string;
-    availability?: 'available' | 'unavailable' | 'statusUnknown';
-}
 export interface PlanInput {
     client: AiClientId;
     endpoint: string;
     model?: string;
+    activeModels?: readonly AiClientModelReference[];
     webId?: string;
     auth?: AuthContext;
 }
@@ -93,13 +84,12 @@ export declare class AiClientConfigurationService {
     private readonly backupRoot;
     private readonly now;
     private readonly verifyGateway;
-    private readonly listActiveModels?;
     private readonly launchClient;
     private readonly plans;
     private readonly locks;
     constructor(options?: AiClientConfigurationServiceOptions);
     capability(): AiClientConfigurationCapabilityDescriptor;
-    inspect(client: AiClientId): Promise<AiClientConfigurationStatus>;
+    inspect(client: AiClientId, webId?: string): Promise<AiClientConfigurationStatus>;
     launch(client: AiClientId): Promise<{
         launched: true;
     }>;
@@ -109,7 +99,6 @@ export declare class AiClientConfigurationService {
     }>;
     verify(input: VerifyInput): Promise<AiClientConfigurationStatus>;
     restore(client: AiClientId, webId?: string): Promise<AiClientConfigurationStatus>;
-    private readActiveModels;
     private adapterFor;
     private publicTargets;
     private detectLockTargets;

package/dist/api/service/AiClientConfigurationService.js

@@ -36,7 +36,6 @@ class AiClientConfigurationService {
         this.backupRoot = node_path_1.default.resolve(options.backupRoot ?? node_path_1.default.join(this.homeDir, '.xpod/client-config-backups'));
         this.now = options.now ?? (() => new Date());
         this.verifyGateway = options.verifyGateway ?? createDefaultGatewayVerifier(options.fetch ?? fetch, options.verificationTimeoutMs ?? 8_000);
-        this.listActiveModels = options.listActiveModels;
         this.launchClient = options.launchClient ?? ((client) => launchLocalClient(client, this.homeDir));
     }
     capability() {
@@ -46,18 +45,22 @@ class AiClientConfigurationService {
             manualInstructions: MANUAL_INSTRUCTIONS,
         };
     }
-    async inspect(client) {
+    async inspect(client, webId) {
         const adapter = this.adapterFor(client);
         const detection = await mapAdapterError(() => adapter.detect());
         const inspection = await mapAdapterError(() => adapter.inspect());
         const configured = inspection.ownership === 'owned';
         return {
-            status: configured ? 'configured' : 'notConfigured',
+            status: configured ? inspection.projectionMatches === false ? 'drifted' : 'configured' : 'notConfigured',
+            ...(configured && webId && inspection.webIdHash === (0, client_config_1.hashWebId)(webId) && inspection.apiKeyFingerprint
+                ? { appliedKeyFingerprint: inspection.apiKeyFingerprint } : {}),
             installed: detection.installed,
             configExists: detection.configExists,
-            message: configured
-                ? `${CLIENT_LABELS[client]} is configured for Xpod.`
-                : `${CLIENT_LABELS[client]} is not configured for Xpod.`,
+            message: inspection.projectionMatches === false
+                ? `${CLIENT_LABELS[client]} configuration has changed since it was applied.`
+                : configured
+                    ? `${CLIENT_LABELS[client]} is configured for Xpod.`
+                    : `${CLIENT_LABELS[client]} is not configured for Xpod.`,
         };
     }
     async launch(client) {
@@ -74,20 +77,13 @@ class AiClientConfigurationService {
         const client = requireSupportedClient(input.client);
         const webId = input.webId ?? solidWebId(input.auth)
             ?? 'https://xpod.local/.well-known/ai-client-configuration#owner';
-        const activeModels = await this.readActiveModels(webId, input.auth);
         const profile = {
             endpoint: normalizeEndpoint(input.endpoint),
             gatewayKey: PLAN_SECRET_PLACEHOLDER,
             webId,
             model: input.model,
-            activeModels: activeModels.models,
-            catalogVersion: activeModels.version,
+            activeModels: client === 'codex' ? input.activeModels : undefined,
         };
-        if (client !== 'codex' || profile.model || activeModels.models.length > 0) {
-            await mapAdapterError(async () => {
-                profile.model = (0, client_config_1.resolveActiveModel)(profile);
-            });
-        }
         const adapter = this.adapterFor(client);
         const nativePlan = await mapAdapterError(() => adapter.plan(profile));
         const targets = await this.publicTargets(nativePlan.writes);
@@ -130,22 +126,11 @@ class AiClientConfigurationService {
                     throw new AiClientConfigurationError('configuration_conflict', 'Configuration changed after planning.', 409);
                 }
             }
-            const currentCatalog = await this.readActiveModels(input.webId ?? plan.profile.webId, input.auth);
-            if (currentCatalog.models.length === 0 && (plan.client !== 'codex' || plan.profile.model)) {
-                throw new AiClientConfigurationError('model_not_available', 'The planned model is no longer active in the Xpod Gateway.', 409);
-            }
             const profile = {
                 ...plan.profile,
                 gatewayKey: input.gatewayKey,
                 webId: input.webId ?? plan.profile.webId,
-                activeModels: currentCatalog.models,
-                catalogVersion: currentCatalog.version,
             };
-            if (plan.client !== 'codex' || profile.model || currentCatalog.models.length > 0) {
-                await mapAdapterError(async () => {
-                    profile.model = (0, client_config_1.resolveActiveModel)(profile);
-                });
-            }
             const adapter = this.adapterFor(plan.client);
             const nativePlan = await mapAdapterError(() => adapter.plan(profile));
             await mapAdapterError(() => adapter.apply(nativePlan));
@@ -153,11 +138,13 @@ class AiClientConfigurationService {
             plan.profile = profile;
             plan.nativePlan = nativePlan;
             try {
-                await this.verify({ client: plan.client, planId: plan.planId, webId: profile.webId });
+                const verification = await mapAdapterError(() => adapter.verify(profile));
+                if (!verification.ok)
+                    throw new Error(verification.reason);
             }
             catch {
                 await mapAdapterError(() => adapter.restore(profile.webId));
-                throw new AiClientConfigurationError('verification_failed_restored', 'Gateway verification failed.', 502, { restored: true });
+                throw new AiClientConfigurationError('local_verification_failed_restored', 'Client configuration could not be verified locally.', 500, { restored: true });
             }
             return { applied: true };
         });
@@ -199,42 +186,6 @@ class AiClientConfigurationService {
         }
         return this.inspect(client);
     }
-    async readActiveModels(webId, auth) {
-        if (!this.listActiveModels) {
-            throw new AiClientConfigurationError('model_catalog_unavailable', 'Authenticated Gateway model visibility is not configured for client setup.', 503);
-        }
-        if (!auth) {
-            throw new AiClientConfigurationError('authentication_required', 'Authentication required.', 401);
-        }
-        try {
-            const discovered = await this.listActiveModels({ webId, auth });
-            const models = discovered
-                .filter((model) => typeof model.id === 'string' && model.id.trim())
-                .filter((model) => model.availability === undefined || model.availability === 'available')
-                .map((model) => ({
-                id: model.id.trim(),
-                ...(typeof model.provider === 'string' && model.provider.trim()
-                    ? { provider: model.provider.trim() }
-                    : typeof model.owned_by === 'string' && model.owned_by.trim()
-                        ? { provider: model.owned_by.trim() }
-                        : {}),
-                ...(typeof model.displayName === 'string' && model.displayName.trim()
-                    ? { displayName: model.displayName.trim() }
-                    : {}),
-                availability: 'available',
-            }));
-            const version = hash(JSON.stringify(models.map((model) => ({
-                id: model.id,
-                provider: model.provider,
-            })).sort((left, right) => `${left.provider ?? ''}/${left.id}`.localeCompare(`${right.provider ?? ''}/${right.id}`))));
-            return { version, models };
-        }
-        catch (error) {
-            if (error instanceof AiClientConfigurationError)
-                throw error;
-            throw new AiClientConfigurationError('model_catalog_unavailable', 'Authenticated Gateway model visibility could not be read.', 503);
-        }
-    }
     adapterFor(client) {
         requireSupportedClient(client);
         if (client === 'codex')
@@ -320,7 +271,7 @@ function publicPlan(plan, homeDir) {
                 required: true,
                 token: plan.confirmation.token,
                 targetHash: plan.confirmation.targetHash,
-                message: 'This client may replace the active default model. Re-enter the confirmation token before applying.',
+                message: 'This switches the client connection and keeps a backup of the current configuration. Re-enter the confirmation token before applying.',
             },
         } : {}),
     };
@@ -569,6 +520,8 @@ function runLauncher(command, args) {
 }
 function redactSecretText(input) {
     return input
+        .replace(/("(?:[a-z_]*api[_-]?key|[a-z_]*(?:access|refresh|id|bearer)[_-]?token|client[_-]?secret|password)"\s*:\s*)"(?:\\.|[^"\\])*"/giu, '$1"[redacted]"')
+        .replace(/(\bexperimental_bearer_token\s*=\s*)(?:"(?:\\.|[^"\\])*"|'[^']*')/giu, '$1"[redacted]"')
         .replace(/\/(?:Users|var|tmp|private|home)\/[^\s"',)]+/gu, '[path]')
         .replace(/xpod_[A-Za-z0-9._-]+/gu, '[redacted]')
         .replace(/sk-[A-Za-z0-9._+/=-]+/gu, '[redacted]')

package/dist/cli/commands/start.js

@@ -229,6 +229,8 @@ function resolveChildDatabaseUrl(value, childCwd) {
     return (0, database_url_1.normalizeDatabaseUrl)(trimmed);
 }
 function resolveCanonicalRuntimeBaseUrl(provisionedPublicUrl, configuredBaseUrl, localFallbackUrl) {
+    // A Cloud-issued URL is the canonical Solid identity origin. CSS_BASE_URL is
+    // the canonical origin only for deployments that have no managed identity.
     return provisionedPublicUrl?.trim() || configuredBaseUrl?.trim() || localFallbackUrl;
 }
 function resolveMainPort(cliPort, env, configuredBaseUrl) {

package/dist/components/components.jsonld

@@ -105,6 +105,7 @@
     "undefineds:dist/identity/oidc/RememberedClientGrantStore.jsonld",
     "undefineds:dist/identity/oidc/RememberedConsentHandler.jsonld",
     "undefineds:dist/identity/oidc/RememberedClientPromptFactory.jsonld",
+    "undefineds:dist/identity/oidc/SessionBoundIdentityProviderFactory.jsonld",
     "undefineds:dist/identity/oidc/ScopedPickWebIdHandler.jsonld",
     "undefineds:dist/authentication/ConfiguredLoopbackDPoPWebIdExtractor.jsonld",
     "undefineds:dist/identity/AccountStorageBindingsHandler.jsonld",