@mangoc/dsh-sub2api-sync 0.0.0-stage → 0.1.0

package/lib/index.js

@@ -0,0 +1,2836 @@
+import { credentialRef } from "@deepseek-ai/dsh-credentials";
+import z from "@deepseek-ai/schemastery";
+import { readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+//#region src/types.ts
+const PLATFORMS = [
+	"anthropic",
+	"openai",
+	"gemini",
+	"antigravity",
+	"grok",
+	"kimi",
+	"zhipu",
+	"deepseek",
+	"composite"
+];
+const DEFAULT_PROVIDER_NAME_TEMPLATE = "{siteName}({keyName})";
+const API_PROTOCOLS = [
+	"openai-completions",
+	"openai-responses",
+	"anthropic-messages"
+];
+const ROUTE_PREFIX = "sub2api-";
+/** A new-shape route suffix: 10 lowercase hex chars (40-bit SHA-256 truncation). */
+const SLUG_ROUTE = /^sub2api-[0-9a-f]{10}$/;
+/** A legacy route suffix: the raw panel key id (pre-rev.5 deployments). */
+const LEGACY_ROUTE = /^sub2api-\d+$/;
+const OWNED_ROUTE = /^(?:sub2api-[0-9a-f]{10}|sub2api-\d+)$/;
+function isOwnedRoute(route) {
+	return OWNED_ROUTE.test(route);
+}
+function sha256Hex(input) {
+	const data = new TextEncoder().encode(input);
+	const bitLength = data.length * 8;
+	const padded = new Uint8Array((data.length + 8 >> 6) + 1 << 6);
+	padded.set(data);
+	padded[data.length] = 128;
+	const view = new DataView(padded.buffer);
+	view.setUint32(padded.length - 8, Math.floor(bitLength / 4294967296));
+	view.setUint32(padded.length - 4, bitLength >>> 0);
+	let h0 = 1779033703, h1 = 3144134277, h2 = 1013904242, h3 = 2773480762;
+	let h4 = 1359893119, h5 = 2600822924, h6 = 528734635, h7 = 1541459225;
+	const w = new Uint32Array(64);
+	const rotr = (x, n) => (x >>> n | x << 32 - n) >>> 0;
+	for (let offset = 0; offset < padded.length; offset += 64) {
+		for (let i = 0; i < 16; i++) w[i] = view.getUint32(offset + i * 4);
+		for (let i = 16; i < 64; i++) {
+			const s0 = rotr(w[i - 15], 7) ^ rotr(w[i - 15], 18) ^ w[i - 15] >>> 3;
+			const s1 = rotr(w[i - 2], 17) ^ rotr(w[i - 2], 19) ^ w[i - 2] >>> 10;
+			w[i] = w[i - 16] + s0 + w[i - 7] + s1 >>> 0;
+		}
+		let a = h0, b = h1, c = h2, d = h3, e = h4, f = h5, g = h6, h = h7;
+		for (let i = 0; i < 64; i++) {
+			const s1 = rotr(e, 6) ^ rotr(e, 11) ^ rotr(e, 25);
+			const ch = e & f ^ ~e & g;
+			const t1 = h + s1 + ch + SHA256_K[i] + w[i] >>> 0;
+			const s0 = rotr(a, 2) ^ rotr(a, 13) ^ rotr(a, 22);
+			const maj = a & b ^ a & c ^ b & c;
+			const t2 = s0 + maj >>> 0;
+			h = g;
+			g = f;
+			f = e;
+			e = d + t1 >>> 0;
+			d = c;
+			c = b;
+			b = a;
+			a = t1 + t2 >>> 0;
+		}
+		h0 = h0 + a >>> 0;
+		h1 = h1 + b >>> 0;
+		h2 = h2 + c >>> 0;
+		h3 = h3 + d >>> 0;
+		h4 = h4 + e >>> 0;
+		h5 = h5 + f >>> 0;
+		h6 = h6 + g >>> 0;
+		h7 = h7 + h >>> 0;
+	}
+	return [
+		h0,
+		h1,
+		h2,
+		h3,
+		h4,
+		h5,
+		h6,
+		h7
+	].map((word) => word.toString(16).padStart(8, "0")).join("");
+}
+/** Round constants for SHA-256 (FIPS 180-4 §4.2.2). */
+const SHA256_K = new Uint32Array([
+	1116352408,
+	1899447441,
+	3049323471,
+	3921009573,
+	961987163,
+	1508970993,
+	2453635748,
+	2870763221,
+	3624381080,
+	310598401,
+	607225278,
+	1426881987,
+	1925078388,
+	2162078206,
+	2614888103,
+	3248222580,
+	3835390401,
+	4022224774,
+	264347078,
+	604807628,
+	770255983,
+	1249150122,
+	1555081692,
+	1996064986,
+	2554220882,
+	2821834349,
+	2952996808,
+	3210313671,
+	3336571891,
+	3584528711,
+	113926993,
+	338241895,
+	666307205,
+	773529912,
+	1294757372,
+	1396182291,
+	1695183700,
+	1986661051,
+	2177026350,
+	2456956037,
+	2730485921,
+	2820302411,
+	3259730800,
+	3345764771,
+	3516065817,
+	3600352804,
+	4094571909,
+	275423344,
+	430227734,
+	506948616,
+	659060556,
+	883997877,
+	958139571,
+	1322822218,
+	1537002063,
+	1747873779,
+	1955562222,
+	2024104815,
+	2227730452,
+	2361852424,
+	2428436474,
+	2756734187,
+	3204031479,
+	3329325298
+]);
+function keyRouteSlug(baseURL, keyId) {
+	return sha256Hex(`${instanceKey(baseURL)}\n${keyId}`).slice(0, 10);
+}
+function routeForKey(baseURL, keyId) {
+	return `${ROUTE_PREFIX}${keyRouteSlug(baseURL, keyId)}`;
+}
+function suffixOfRoute(route) {
+	if (SLUG_ROUTE.test(route) || LEGACY_ROUTE.test(route)) return route.slice(ROUTE_PREFIX.length);
+	return undefined;
+}
+function legacyKeyIdOfRoute(route) {
+	if (!LEGACY_ROUTE.test(route)) return undefined;
+	const id = Number(route.slice(ROUTE_PREFIX.length));
+	return Number.isSafeInteger(id) && id > 0 ? id : undefined;
+}
+function hashString(input) {
+	let hash = 2166136261;
+	for (let index = 0; index < input.length; index++) {
+		hash ^= input.charCodeAt(index);
+		hash = Math.imul(hash, 16777619);
+	}
+	return hash >>> 0 || 1;
+}
+function instanceKey(baseURL) {
+	return baseURL.trim().replace(/\/+$/, "").toLowerCase();
+}
+function panelTokenRef(baseURL) {
+	return `DSH_SUB2API_TOKEN_${hashString(instanceKey(baseURL))}`;
+}
+function panelRefreshRef(baseURL) {
+	return `DSH_SUB2API_REFRESH_${hashString(instanceKey(baseURL))}`;
+}
+function panelPasswordRef(baseURL) {
+	return `DSH_SUB2API_PASSWORD_${hashString(instanceKey(baseURL))}`;
+}
+function oauthTokenRef(baseURL) {
+	return `DSH_SUB2API_OAUTH_TOKEN_${hashString(instanceKey(baseURL))}`;
+}
+function oauthRefreshRef(baseURL) {
+	return `DSH_SUB2API_OAUTH_REFRESH_${hashString(instanceKey(baseURL))}`;
+}
+function routeKeyRef(route) {
+	const suffix = suffixOfRoute(route);
+	if (suffix === undefined) throw new Error(`sub2api-sync: "${route}" 不是本插件的路由名`);
+	return `DSH_SUB2API_KEY_${suffix}`;
+}
+function legacyKeyRef(keyId) {
+	return `DSH_SUB2API_KEY_${keyId}`;
+}
+function parseGroupId(input) {
+	if (typeof input === "number") return Number.isSafeInteger(input) && input > 0 ? input : undefined;
+	if (typeof input !== "string") return undefined;
+	if (!/^\d+$/.test(input)) return undefined;
+	const id = Number(input);
+	return Number.isSafeInteger(id) && id > 0 ? id : undefined;
+}
+
+//#endregion
+//#region src/protocols.ts
+const SUB2API_RETRY_POLICY = {
+	mode: "normal",
+	maxRetries: 5,
+	retryableCodes: [
+		"RATE_LIMIT",
+		"SERVER",
+		"TIMEOUT",
+		"TRANSPORT",
+		"EMPTY_RESPONSE"
+	],
+	backoff: {
+		initialDelayMs: 1e3,
+		maxDelayMs: 12e4,
+		jitterRatio: .2
+	}
+};
+function guessPlatformFromModels(modelIds) {
+	const families = new Set();
+	for (const raw of modelIds) {
+		const id = raw.toLowerCase();
+		if (/(^|[/:.-])claude/.test(id)) families.add("anthropic");
+else if (/(^|[/:.-])(gpt|o[1345]|codex|chatgpt)/.test(id)) families.add("openai");
+else if (/(^|[/:.-])grok/.test(id)) families.add("grok");
+else if (/(^|[/:.-])gemini/.test(id)) families.add("gemini");
+else if (/(^|[/:.-])(kimi|moonshot)/.test(id) || /(^|[/:.-])k[23]($|[.:.-])/.test(id)) families.add("kimi");
+else if (/(^|[/:.-])(glm|chatglm|cogview|cogvideo)/.test(id)) families.add("zhipu");
+else if (/(^|[/:.-])deepseek/.test(id)) families.add("deepseek");
+else families.add("unknown");
+	}
+	const known = [...families].filter((family) => family !== "unknown");
+	if (known.length === 0) return undefined;
+	return known.length === 1 ? known[0] : "composite";
+}
+function protocolForPlatform(platform) {
+	switch (platform) {
+		case "anthropic": return "anthropic-messages";
+		case "openai":
+		case "grok":
+		case "kimi":
+		case "zhipu":
+		case "deepseek": return "openai-responses";
+		case "gemini":
+		case "antigravity":
+		case "composite": return "openai-completions";
+		default: return undefined;
+	}
+}
+function renderProviderName(template, keyName, siteName) {
+	const site = siteName !== undefined && siteName.length > 0 ? siteName : "sub2api";
+	if (template !== undefined && template.length > 0 && (template.includes("{keyName}") || template.includes("{siteName}"))) return template.replaceAll("{siteName}", site).replaceAll("{keyName}", keyName);
+	return `${site}(${keyName})`;
+}
+function baseURLForProtocol(instance, protocol) {
+	const cleaned = instance.trim().replace(/\/+$/, "");
+	if (protocol === "anthropic-messages") return cleaned.replace(/\/v1$/i, "");
+	return /\/v1$/i.test(cleaned) ? cleaned : `${cleaned}/v1`;
+}
+const THINKING_LEVELS = [
+	"off",
+	"minimal",
+	"low",
+	"medium",
+	"high",
+	"xhigh",
+	"max"
+];
+function buildProviderProfile(input) {
+	const compat = input.template?.compat;
+	const reasoning = input.template?.reasoningEfforts;
+	return {
+		displayName: input.displayName.length > 0 ? input.displayName : `Group ${input.groupId}`,
+		apiKeyEnv: input.apiKeyEnv,
+		api: input.protocol,
+		baseURL: baseURLForProtocol(input.instance, input.protocol),
+		models: input.models.map((model) => ({
+			id: model.id,
+			...model.name !== undefined ? { name: model.name } : {},
+			...model.contextWindow !== undefined ? { contextWindow: model.contextWindow } : {},
+			...model.maxTokens !== undefined ? { maxTokens: model.maxTokens } : {},
+			...model.imageInput === true ? { input: ["text", "image"] } : {},
+			...compat !== undefined ? { compat: { ...compat } } : {},
+			...reasoning === false ? { reasoningEfforts: false } : reasoning !== undefined ? { reasoningEfforts: { ...reasoning } } : model.reasoningEfforts !== undefined ? { reasoningEfforts: { ...model.reasoningEfforts } } : {}
+		})),
+		...input.template?.reasoning !== undefined ? { reasoning: input.template.reasoning } : {},
+		defaultContextWindow: 128e3,
+		defaultMaxTokens: 8192,
+		defaultInput: ["text"],
+		retryPolicy: {
+			...SUB2API_RETRY_POLICY,
+			retryableCodes: [...SUB2API_RETRY_POLICY.retryableCodes],
+			backoff: { ...SUB2API_RETRY_POLICY.backoff }
+		}
+	};
+}
+
+//#endregion
+//#region src/config.ts
+const apiProtocolSchema = z.union([
+	z.const("openai-completions"),
+	z.const("openai-responses"),
+	z.const("anthropic-messages")
+]);
+const Config = z.object({
+	baseURL: z.string().volatile(),
+	email: z.string().volatile(),
+	providerNameTemplate: z.string().default(DEFAULT_PROVIDER_NAME_TEMPLATE).volatile(),
+	selectedKeys: z.array(z.number().step(1)).default([]).volatile(),
+	modelListOverrides: z.dict(z.array(z.string())).default({}).volatile(),
+	protocolOverrides: z.dict(apiProtocolSchema).default({}).volatile(),
+	routeKeyIds: z.dict(z.number().step(1)).default({}).volatile(),
+	compatTemplate: z.object({
+		compat: z.dict(z.any()),
+		reasoningEfforts: z.union([z.const(false), z.dict(z.union([z.string(), z.const(null)]))]),
+		reasoning: z.union([
+			z.const("off"),
+			z.const("minimal"),
+			z.const("low"),
+			z.const("medium"),
+			z.const("high"),
+			z.const("xhigh"),
+			z.const("max")
+		])
+	}).volatile(),
+	enrichModelMeta: z.boolean().default(true).volatile(),
+	keyQuota: z.number().volatile(),
+	keyExpiresInDays: z.number().step(1).volatile(),
+	deleteOrphanKeys: z.boolean().default(false).volatile(),
+	syncIntervalMs: z.number().step(1).volatile(),
+	allowRemoteActions: z.boolean().default(false).volatile()
+});
+/** Unwrap one live cell into its current snapshot; plain values pass through. */
+function unwrap$1(field) {
+	if (field !== null && typeof field === "object" && typeof field.get === "function") return field.get();
+	return field;
+}
+function readConfig(config) {
+	return Object.fromEntries(Object.entries(config).map(([key, field]) => [key, unwrap$1(field)]));
+}
+function validateConfig(config) {
+	if (config.baseURL !== undefined && config.baseURL.length > 0 && !/^https?:\/\//i.test(config.baseURL.trim())) throw new Error("sub2api-sync: baseURL 必须以 http(s):// 开头");
+	const compat = config.compatTemplate;
+	if (compat?.reasoning !== undefined && !THINKING_LEVELS.includes(compat.reasoning)) throw new Error(`sub2api-sync: compatTemplate.reasoning 必须是 ${THINKING_LEVELS.join("/")} 之一`);
+	const template = config.providerNameTemplate;
+	if (template !== undefined && template.length > 0 && !template.includes("{keyName}") && !template.includes("{siteName}")) throw new Error("sub2api-sync: providerNameTemplate 必须包含 {keyName} 或 {siteName} 占位符");
+	for (const id of config.selectedKeys ?? []) if (!Number.isSafeInteger(id) || id <= 0) throw new Error(`sub2api-sync: selectedKeys 含非法 key id ${String(id)}`);
+}
+
+//#endregion
+//#region src/client.ts
+function gatewayApiRoot(baseURL) {
+	const cleaned = (baseURL ?? "").trim().replace(/\/+$/, "");
+	if (cleaned.length === 0) return "";
+	return /\/v1$/i.test(cleaned) ? cleaned : `${cleaned}/v1`;
+}
+var Sub2apiClient = class {
+	root;
+	fetchImpl;
+	constructor(options) {
+		const base = options.baseURL?.trim() ?? "";
+		if (!/^https?:\/\//i.test(base)) throw new Error("sub2api: baseURL 必须是 http(s) 地址");
+		this.root = gatewayApiRoot(base);
+		const fetchImpl = options.fetchImpl ?? globalThis.fetch;
+		if (fetchImpl === undefined) throw new Error("sub2api: 当前环境没有 fetch 可用");
+		this.fetchImpl = fetchImpl.bind(globalThis);
+	}
+	/**
+	* Discover the model ids one relay key can serve (`GET /v1/models`). The
+	* gateway answers an OpenAI-style list whose element shape varies per
+	* platform — grok embeds reasoning fields, a `client_version` query
+	* switches to the Codex manifest — so the reader takes `id` and tolerates
+	* everything else (verified: `handler/gateway_handler.go`).
+	*/
+	async listModels(relayKey, options) {
+		const response = await this.fetchImpl(`${this.root}/models`, {
+			headers: { authorization: `Bearer ${relayKey}` },
+			signal: options?.signal
+		});
+		if (!response.ok) throw new Error(`sub2api 网关 GET ${this.root}/models 返回 HTTP ${response.status}${await refusalDetail(response)}`);
+		const payload = await response.json();
+		return readModelList(payload);
+	}
+};
+async function refusalDetail(response) {
+	let payload;
+	try {
+		payload = await response.json();
+	} catch {
+		return "";
+	}
+	if (typeof payload !== "object" || payload === null) return "";
+	const record = payload;
+	const nested = typeof record.error === "object" && record.error !== null ? record.error : undefined;
+	const message = [nested?.message, record.message].find((candidate) => typeof candidate === "string" && candidate.length > 0);
+	const code = [nested?.code, record.code].find((candidate) => typeof candidate === "string" && candidate.length > 0);
+	if (message === undefined && code === undefined) return "";
+	const label = code !== undefined && message !== undefined && message !== code ? `${code}: ${message}` : code ?? message ?? "";
+	return label.length > 0 ? `（${label}）` : "";
+}
+function readModelList(payload) {
+	const data = payload?.data;
+	if (!Array.isArray(data)) throw new Error("sub2api 网关 /models 响应不是模型列表（缺少 data 数组）");
+	const models = [];
+	for (const item of data) {
+		if (typeof item !== "object" || item === null) continue;
+		const id = item.id;
+		if (typeof id !== "string" || id.length === 0) continue;
+		const displayName = item.display_name;
+		models.push({
+			id,
+			...typeof displayName === "string" && displayName.length > 0 && displayName !== id ? { displayName } : {}
+		});
+	}
+	return models;
+}
+
+//#endregion
+//#region src/enrich.ts
+const SNAPSHOT_PATH = join(dirname(fileURLToPath(import.meta.url)), "../data/models-dev.snapshot.json");
+const SOURCE_URL = "https://models.dev/api.json";
+const TTL = 864e5;
+const EFFORT_VOCABULARY = [
+	"none",
+	"minimal",
+	"low",
+	"medium",
+	"high",
+	"xhigh",
+	"max"
+];
+const FIRST_PARTY_PROVIDERS = new Set([
+	"openai",
+	"anthropic",
+	"google",
+	"deepseek",
+	"xai",
+	"moonshotai",
+	"moonshotai-cn",
+	"kimi-code-plan-cn",
+	"kimi-code-plan-global",
+	"zhipuai",
+	"zhipuai-coding-plan",
+	"zai",
+	"zai-coding-plan",
+	"alibaba",
+	"alibaba-cn",
+	"alibaba-coding-plan",
+	"alibaba-coding-plan-cn",
+	"alibaba-token-plan",
+	"alibaba-token-plan-cn",
+	"minimax",
+	"minimax-cn",
+	"minimax-coding-plan",
+	"minimax-cn-coding-plan",
+	"stepfun",
+	"stepfun-ai",
+	"stepfun-step-plan",
+	"stepfun-ai-step-plan",
+	"xiaomi",
+	"xiaomi-token-plan-ams",
+	"xiaomi-token-plan-cn",
+	"xiaomi-token-plan-sgp",
+	"longcat",
+	"volcengine",
+	"volcengine-coding-plan",
+	"tencent-coding-plan",
+	"tencent-token-plan",
+	"tencent-tokenhub",
+	"mistral",
+	"cohere",
+	"ai21",
+	"upstage",
+	"sarvam",
+	"google-vertex",
+	"google-vertex-anthropic",
+	"amazon-bedrock",
+	"azure",
+	"azure-cognitive-services",
+	"snowflake-cortex",
+	"watsonx",
+	"github-copilot"
+]);
+/**
+* One model's effort levels from `reasoning_options`, normalized to the
+* vocabulary in canonical order (`none` kept — it becomes pi-ai's `off`).
+* `undefined` when the entry carries no effort options: toggle/budget-only
+* reasoning cannot travel through `reasoningEfforts` (its wire shape is a
+* boolean flag or a numeric budget, not an effort string).
+*/
+function effortLevelsOf(model) {
+	const options = model.reasoning_options;
+	if (!Array.isArray(options)) return undefined;
+	const seen = new Set();
+	for (const option of options) {
+		if (option === null || typeof option !== "object") continue;
+		const record = option;
+		if (record.type !== "effort" || !Array.isArray(record.values)) continue;
+		for (const value of record.values) if (typeof value === "string" && EFFORT_VOCABULARY.includes(value)) seen.add(value);
+	}
+	if (seen.size === 0) return undefined;
+	return EFFORT_VOCABULARY.filter((level) => seen.has(level));
+}
+/**
+* Build the pi-ai `reasoningEfforts` map from normalized levels: same-name
+* passthrough (pi-ai's default wire spelling), `none` → `off: null` (dispatch
+* sends nothing). `undefined` when nothing remains beyond `off` — pi-ai rejects
+* a map that offers no thinking level.
+*/
+function reasoningEffortsOf(levels) {
+	const map = {};
+	let beyondOff = false;
+	for (const level of levels) if (level === "none") map.off = null;
+else {
+		map[level] = level;
+		beyondOff = true;
+	}
+	return beyondOff ? map : undefined;
+}
+function displayNameOf(raw, id) {
+	if (typeof raw !== "string") return undefined;
+	const name$1 = raw.trim().replace(/\s*\(latest\)$/i, "").trim();
+	if (name$1.length === 0) return undefined;
+	if (id !== undefined && name$1.toLowerCase() === id.toLowerCase()) return undefined;
+	return name$1;
+}
+/** Defensive snapshot re-normalization (already normalized by the generator). */
+function effortsMetaOf(levels) {
+	if (!Array.isArray(levels)) return undefined;
+	const normalized = EFFORT_VOCABULARY.filter((level) => levels.includes(level));
+	return reasoningEffortsOf(normalized);
+}
+/** Levels every source claims, in canonical order; empty when they disagree. */
+function intersectLevels(sources) {
+	if (sources.length === 0) return [];
+	const [first, ...rest] = sources;
+	return first.filter((level) => rest.every((source) => source.includes(level)));
+}
+/** Attach the resolved efforts map to an id's meta, creating the entry if new. */
+function attachEfforts(index, key, sources) {
+	const map = reasoningEffortsOf(intersectLevels(sources));
+	if (map === undefined) return;
+	const meta = index.get(key) ?? {};
+	meta.reasoningEfforts = map;
+	index.set(key, meta);
+}
+let networkCache;
+let bundledCache;
+function parseSnapshot(raw) {
+	const index = new Map();
+	let parsed;
+	try {
+		parsed = JSON.parse(raw);
+	} catch {
+		return index;
+	}
+	const models = parsed?.models;
+	if (models === null || models === undefined || typeof models !== "object") return index;
+	for (const [id, tuple] of Object.entries(models)) {
+		if (!Array.isArray(tuple)) continue;
+		const [context, output, image, reasoning, levels, name$1] = tuple;
+		const efforts = effortsMetaOf(levels);
+		index.set(id.toLowerCase(), {
+			...typeof context === "number" && context > 0 ? { contextWindow: context } : {},
+			...typeof output === "number" && output > 0 ? { maxTokens: output } : {},
+			...image === 1 ? { imageInput: true } : {},
+			...reasoning === 1 ? { reasoningModel: true } : {},
+			...efforts !== undefined ? { reasoningEfforts: efforts } : {},
+			...typeof name$1 === "string" && name$1.length > 0 ? { name: name$1 } : {}
+		});
+	}
+	return index;
+}
+function parseCatalog(catalog) {
+	const index = new Map();
+	if (catalog === null || typeof catalog !== "object") return index;
+	const firstPartySources = new Map();
+	const aggregatorSources = new Map();
+	const firstPartyNames = new Map();
+	const aggregatorNames = new Map();
+	const firstPartyIds = new Set();
+	for (const [providerName, provider] of Object.entries(catalog)) {
+		if (provider === null || typeof provider !== "object") continue;
+		const models = provider.models;
+		if (models === null || typeof models !== "object") continue;
+		const firstParty = FIRST_PARTY_PROVIDERS.has(providerName);
+		for (const [id, raw] of Object.entries(models)) {
+			if (raw === null || typeof raw !== "object") continue;
+			const model = raw;
+			const limit = model.limit ?? undefined;
+			const modalities = model.modalities ?? undefined;
+			const context = limit?.context;
+			const output = limit?.output;
+			const input = modalities?.input;
+			const image = Array.isArray(input) && input.includes("image") || model.attachment === true;
+			const key = id.toLowerCase();
+			if (firstParty) firstPartyIds.add(key);
+			const levels = effortLevelsOf(model);
+			if (levels !== undefined) {
+				const sources = firstParty ? firstPartySources : aggregatorSources;
+				const group = sources.get(key);
+				if (group === undefined) sources.set(key, [levels]);
+else group.push(levels);
+			}
+			const displayName = displayNameOf(model.name, key);
+			if (displayName !== undefined) {
+				const names = firstParty ? firstPartyNames : aggregatorNames;
+				if (!names.has(key)) names.set(key, displayName);
+			}
+			const current = index.get(key);
+			const next = {
+				...typeof context === "number" && context > 0 ? { contextWindow: context } : {},
+				...typeof output === "number" && output > 0 ? { maxTokens: output } : {},
+				...image ? { imageInput: true } : {},
+				...model.reasoning === true ? { reasoningModel: true } : {}
+			};
+			if (current === undefined) {
+				if (next.contextWindow !== undefined || next.maxTokens !== undefined || next.imageInput === true || next.reasoningModel === true) index.set(key, next);
+				continue;
+			}
+			index.set(key, {
+				contextWindow: pickGreater(current.contextWindow, next.contextWindow),
+				maxTokens: pickGreater(current.maxTokens, next.maxTokens),
+				imageInput: current.imageInput === true || next.imageInput === true,
+				reasoningModel: current.reasoningModel === true || next.reasoningModel === true
+			});
+		}
+	}
+	for (const [key, sources] of firstPartySources) attachEfforts(index, key, sources);
+	for (const [key, sources] of aggregatorSources) if (!firstPartyIds.has(key)) attachEfforts(index, key, sources);
+	const attachName = (key, name$1, override) => {
+		const meta = index.get(key);
+		if (meta === undefined) {
+			index.set(key, { name: name$1 });
+			return;
+		}
+		if (meta.name !== undefined && !override) return;
+		meta.name = name$1;
+		index.set(key, meta);
+	};
+	for (const [key, name$1] of aggregatorNames) attachName(key, name$1, false);
+	for (const [key, name$1] of firstPartyNames) attachName(key, name$1, true);
+	return index;
+}
+function pickGreater(a, b) {
+	if (a === undefined) return b;
+	if (b === undefined) return a;
+	return Math.max(a, b);
+}
+function bundledIndex() {
+	bundledCache ??= (() => {
+		try {
+			return parseSnapshot(readFileSync(SNAPSHOT_PATH, "utf8"));
+		} catch {
+			return new Map();
+		}
+	})();
+	return bundledCache;
+}
+async function loadModelIndex(options) {
+	const now = (options.now ?? Date.now)();
+	if (networkCache !== undefined && now - networkCache.at < TTL) return networkCache.index;
+	if (options.enrich) try {
+		const doFetch = options.fetchImpl ?? globalThis.fetch;
+		if (doFetch === undefined) throw new Error("no fetch available");
+		const response = await doFetch(SOURCE_URL);
+		if (!response.ok) throw new Error(`HTTP ${response.status}`);
+		const catalog = await response.json();
+		const index = parseCatalog(catalog);
+		networkCache = {
+			index,
+			at: now
+		};
+		return index;
+	} catch {}
+	const bundled = bundledIndex();
+	if (options.enrich) networkCache = {
+		index: bundled,
+		at: now
+	};
+	return bundled;
+}
+
+//#endregion
+//#region src/engine.ts
+const PI_AI_NS = "llm-pi-ai";
+const OWN_NS = "sub2api-sync";
+function createSyncReportStore() {
+	let report;
+	let at;
+	return {
+		record: (value) => {
+			report = value;
+			at = Date.now();
+		},
+		clear: () => {
+			report = undefined;
+			at = undefined;
+		},
+		report: () => report,
+		at: () => at
+	};
+}
+var Sub2apiSyncError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "Sub2apiSyncError";
+	}
+};
+function isSettingsConflict(error) {
+	const shape = error;
+	return shape?.code === "SETTINGS_CONFLICT" || shape?.name === "SettingsConflictError";
+}
+function messageOf(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+/** Order-insensitive JSON comparison — profiles are plain JSON values. */
+function deepEqual(a, b) {
+	if (a === b) return true;
+	if (typeof a !== typeof b) return false;
+	if (a === null || b === null) return false;
+	if (Array.isArray(a) || Array.isArray(b)) {
+		if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length) return false;
+		return a.every((item, index) => deepEqual(item, b[index]));
+	}
+	if (typeof a === "object") {
+		const left = a;
+		const right = b;
+		const leftKeys = Object.keys(left);
+		const rightKeys = Object.keys(right);
+		if (leftKeys.length !== rightKeys.length) return false;
+		return leftKeys.every((key) => key in right && deepEqual(left[key], right[key]));
+	}
+	return false;
+}
+function resolveTargets(config, keyRows) {
+	const byId = new Map(keyRows.map((key) => [key.id, key]));
+	const targets = [];
+	for (const id of config.selectedKeys ?? []) {
+		const key = byId.get(id);
+		if (key === undefined) {
+			targets.push({
+				invalid: id,
+				error: `key #${id} 在面板不存在（可能已删除）——请在 Keys 卡刷新后重新勾选`
+			});
+			continue;
+		}
+		targets.push({ key });
+	}
+	return targets;
+}
+var Sub2apiSyncEngine = class {
+	settings;
+	credentials;
+	gateway;
+	fetchImpl;
+	modelIndexLoader;
+	siteName;
+	queue = Promise.resolve();
+	running = false;
+	constructor(options) {
+		this.settings = options.settings;
+		this.credentials = options.credentials;
+		this.gateway = options.gateway;
+		this.fetchImpl = options.fetchImpl;
+		this.modelIndexLoader = options.loadModelIndex ?? loadModelIndex;
+		this.siteName = options.siteName;
+	}
+	/** Whether a sync is currently executing (UI busy marker). */
+	isRunning() {
+		return this.running;
+	}
+	/**
+	* Run one sync. At most one runs at a time — later callers queue behind
+	* the previous one (the settings-card button, the tool, and the timer all
+	* share this queue).
+	*/
+	sync(config, keyIds) {
+		const run = this.queue.then(() => this.runSync(config, keyIds), () => this.runSync(config, keyIds));
+		this.queue = run.then(() => undefined, () => undefined);
+		return run;
+	}
+	async runSync(config, keyIds) {
+		this.running = true;
+		try {
+			return await this.syncNow(config, keyIds);
+		} finally {
+			this.running = false;
+		}
+	}
+	async syncNow(config, selection) {
+		const instance = config.baseURL?.trim() ?? "";
+		if (!/^https?:\/\//i.test(instance)) throw new Sub2apiSyncError("sub2api-sync: baseURL 未配置或不是 http(s) 地址");
+		const entries = [];
+		const desired = new Map();
+		const { groups, keyRows } = await this.gateway.use(async (panel, token) => {
+			const groupList = await panel.listAvailableGroups(token);
+			const rows = [];
+			for (let page = 1; page <= 10; page++) {
+				const result = await panel.listKeys(token, {
+					page,
+					pageSize: 100
+				});
+				rows.push(...result.items);
+				if (page >= result.pages || result.items.length === 0) break;
+			}
+			return {
+				groups: groupList,
+				keyRows: rows
+			};
+		});
+		const groupById = new Map(groups.map((group) => [group.id, group]));
+		const modelIndex = await this.modelIndexLoader({
+			enrich: config.enrichModelMeta !== false,
+			...this.fetchImpl !== undefined ? { fetchImpl: this.fetchImpl } : {}
+		}).catch(() => new Map());
+		const site = await this.siteName?.().catch(() => undefined);
+		const syncWarnings = [];
+		const effective = {
+			...config,
+			selectedKeys: selection ?? config.selectedKeys
+		};
+		for (const target of resolveTargets(effective, keyRows)) {
+			if ("invalid" in target) {
+				entries.push({
+					groupId: target.invalid,
+					route: `${target.invalid}`,
+					action: "failed",
+					error: target.error,
+					invalid: true
+				});
+				continue;
+			}
+			const key = target.key;
+			const route = routeForKey(instance, key.id);
+			try {
+				const group = groupById.get(key.groupId);
+				if (group === undefined) throw new Sub2apiSyncError(`key #${key.id}（${key.name}）的分组 ${key.groupId} 在面板不可用`);
+				const { profile, warnings: profileWarnings } = await this.buildKeyProfile(config, key, group, instance, modelIndex, site);
+				desired.set(route, profile);
+				syncWarnings.push(...profileWarnings);
+				entries.push({
+					groupId: group.id,
+					route,
+					keyId: key.id,
+					displayName: profile.displayName,
+					action: "unchanged",
+					models: profile.models?.length ?? 0
+				});
+			} catch (error) {
+				entries.push({
+					groupId: key.groupId,
+					route,
+					keyId: key.id,
+					action: "failed",
+					error: messageOf(error)
+				});
+			}
+		}
+		let attempts = 0;
+		const removed = [];
+		let ops = [];
+		let routeActions = new Map();
+		for (;;) {
+			attempts++;
+			const now = this.readCurrentProviders();
+			const plan = planOps(now, desired);
+			ops = plan.ops;
+			routeActions = plan.actions;
+			removed.length = 0;
+			for (const op of ops) if (op.op === "unset") removed.push(op.path[1]);
+			const revision = this.revisionOf(PI_AI_NS);
+			try {
+				if (ops.length > 0) await this.settings.mutate(PI_AI_NS, ops, revision);
+				break;
+			} catch (error) {
+				if (isSettingsConflict(error) && attempts < 3) continue;
+				throw error;
+			}
+		}
+		for (const entry of entries) {
+			const action = routeActions.get(entry.route);
+			if (action !== undefined) entry.action = action;
+		}
+		const keyIdByRoute = new Map(keyRows.map((row) => [routeForKey(instance, row.id), row.id]));
+		const warnings = [...syncWarnings];
+		for (const route of removed) {
+			try {
+				await this.credentials.unset(routeKeyRef(route));
+			} catch (error) {
+				warnings.push(`key ${route} 的凭据清理失败：${messageOf(error)}`);
+			}
+			const keyId = keyIdByRoute.get(route) ?? legacyKeyIdOfRoute(route);
+			if (config.deleteOrphanKeys === true && keyId !== undefined) try {
+				await this.gateway.use((panel, token) => panel.deleteKey(token, keyId));
+			} catch (error) {
+				warnings.push(`key ${route} 的远端撤销失败：${messageOf(error)}`);
+			}
+		}
+		try {
+			const mapOps = [];
+			for (const entry of entries) if (entry.keyId !== undefined && entry.action !== "failed") mapOps.push({
+				op: "set",
+				path: ["routeKeyIds", entry.route],
+				value: entry.keyId
+			});
+			for (const route of removed) mapOps.push({
+				op: "unset",
+				path: ["routeKeyIds", route]
+			});
+			if (mapOps.length > 0) await this.settings.mutate(OWN_NS, mapOps, this.revisionOf(OWN_NS));
+		} catch {}
+		return {
+			entries,
+			removed,
+			writes: ops.length,
+			attempts,
+			warnings
+		};
+	}
+	/** Protocol + models + naming for one selected key; the plaintext comes
+	* from the panel row when present, else from the stored credential. */
+	async buildKeyProfile(config, key, group, instance, modelIndex, site) {
+		const protocol = protocolForPlatformWithOverride(group.platform, config.protocolOverrides?.[String(group.id)]);
+		if (protocol === undefined) throw new Sub2apiSyncError(`key #${key.id}（${key.name}）所属分组 ${group.id} 的平台 "${group.platform}" 没有协议映射（可用 protocolOverrides 显式指定）`);
+		const route = routeForKey(instance, key.id);
+		const ref = routeKeyRef(route);
+		const usable = (value) => value !== undefined && value.length > 0 && !value.includes("****");
+		let source = "panel";
+		let revealFailure;
+		let plaintext = key.key;
+		if (!usable(plaintext)) {
+			plaintext = undefined;
+			const stored = await this.credentials.resolve(ref);
+			if (usable(stored?.value)) {
+				plaintext = stored?.value;
+				source = "stored";
+			} else if (stored?.value !== undefined) await this.credentials.unset(ref).catch(() => undefined);
+		}
+		if (!usable(plaintext) && ref !== legacyKeyRef(key.id)) {
+			const legacy = await this.credentials.resolve(legacyKeyRef(key.id));
+			if (usable(legacy?.value)) {
+				plaintext = legacy?.value;
+				source = "legacy";
+			} else if (legacy?.value !== undefined) await this.credentials.unset(legacyKeyRef(key.id)).catch(() => undefined);
+		}
+		if (!usable(plaintext)) try {
+			const revealed = await this.gateway.use((panel, token) => panel.revealKey(token, key.id));
+			plaintext = !usable(revealed.key) ? undefined : revealed.key;
+			if (plaintext === undefined) revealFailure = "reveal 未返回可用明文";
+		} catch (error) {
+			revealFailure = messageOf(error);
+		}
+		if (!usable(plaintext)) {
+			const revealNote = revealFailure !== undefined ? `；reveal 接口也失败：${revealFailure}` : "";
+			throw new Sub2apiSyncError(`key #${key.id}（${key.name}）拿不到明文（面板列表不回明文且凭据库没有可用存底${revealNote}）——请在面板删除这把 key 后用插件「创建 key」重建，重建时会自动保存明文`);
+		}
+		let models;
+		try {
+			models = await this.discoverModels(config, group.id, instance, plaintext);
+		} catch (error) {
+			if (source !== "stored" && source !== "legacy" || !/HTTP 401(?![0-9])/.test(messageOf(error))) throw error;
+			await this.credentials.unset(ref).catch(() => undefined);
+			if (ref !== legacyKeyRef(key.id)) await this.credentials.unset(legacyKeyRef(key.id)).catch(() => undefined);
+			let revealed;
+			try {
+				revealed = (await this.gateway.use((panel, token) => panel.revealKey(token, key.id)))?.key;
+			} catch (revealError) {
+				throw new Sub2apiSyncError(`${messageOf(error)}；本地存底已作废，但 reveal 也失败：${messageOf(revealError)}——请在面板删除这把 key 后用插件「创建 key」重建`);
+			}
+			if (revealed === undefined || revealed.length === 0 || revealed.includes("****")) throw new Sub2apiSyncError(`${messageOf(error)}；本地存底已作废，但 reveal 未返回明文——请在面板删除这把 key 后用插件「创建 key」重建`);
+			plaintext = revealed;
+			models = await this.discoverModels(config, group.id, instance, plaintext);
+		}
+		if (this.credentials.resolve !== undefined) {
+			const stored = await this.credentials.resolve(ref);
+			if (stored?.value !== plaintext) await this.credentials.set(ref, plaintext);
+		}
+		const enriched = models.map((model) => enrichModel(model, modelIndex));
+		let template = config.compatTemplate;
+		const warnings = [];
+		const requestedDefault = template?.reasoning;
+		if (requestedDefault !== undefined) {
+			const lacking = enriched.filter((model) => {
+				const wire = model.reasoningEfforts?.[requestedDefault];
+				return model.reasoningEfforts === undefined || wire === undefined || wire === null;
+			}).map((model) => model.id);
+			if (lacking.length > 0) {
+				template = {
+					...template,
+					reasoning: undefined
+				};
+				const preview = lacking.length > 5 ? `${lacking.slice(0, 5).join("、")} 等` : lacking.join("、");
+				warnings.push(`compatTemplate.reasoning=${requestedDefault} 未写入默认档位：${lacking.length} 个模型不支持该档位（${preview}）——未手动选择档位的请求会被拒绝，故整组回退为不设默认`);
+			}
+		}
+		return {
+			profile: buildProviderProfile({
+				groupId: group.id,
+				displayName: renderProviderName(config.providerNameTemplate, key.name, site),
+				protocol,
+				instance,
+				models: enriched,
+				apiKeyEnv: ref,
+				template
+			}),
+			warnings
+		};
+	}
+	/**
+	* Model source precedence: a non-empty `modelListOverrides` entry is the
+	* user's explicit selection from the card picker and wins outright (no
+	* fetch — the entry contains exactly the chosen ids). Otherwise discover
+	* via `/v1/models`; discovery failure falls back to the overrides loudly.
+	*/
+	async discoverModels(config, groupId, instance, relayKey) {
+		const selection = config.modelListOverrides?.[String(groupId)] ?? [];
+		if (selection.length > 0) return selection.map((id) => ({ id }));
+		try {
+			const client = new Sub2apiClient({
+				baseURL: instance,
+				fetchImpl: this.fetchImpl
+			});
+			return await client.listModels(relayKey);
+		} catch (error) {
+			throw new Sub2apiSyncError(`分组 ${groupId} 模型发现失败：${messageOf(error)}；且未配置 modelListOverrides 兜底`);
+		}
+	}
+	readCurrentProviders() {
+		const descriptor = this.settings.describe().find((candidate) => candidate.ns === PI_AI_NS);
+		if (descriptor === undefined) throw new Sub2apiSyncError("llm-pi-ai 设置条目未激活——需要 dsh-llm-pi-ai 挂载后才能写入 provider 路由");
+		const providers = descriptor.value?.providers;
+		if (providers === undefined || providers === null) return {};
+		if (typeof providers !== "object" || Array.isArray(providers)) throw new Sub2apiSyncError("llm-pi-ai.providers 形状异常（不是对象）");
+		return providers;
+	}
+	revisionOf(ns) {
+		const descriptor = this.settings.describe().find((candidate) => candidate.ns === ns);
+		if (descriptor === undefined) throw new Sub2apiSyncError(`设置命名空间 "${ns}" 未注册，无法取得 revision`);
+		return descriptor.revision;
+	}
+};
+/** Attach the enriched facts (display name, capacity, efforts) to one discovered model. */
+function enrichModel(model, index) {
+	const meta = index.get(model.id.toLowerCase());
+	if (meta === undefined) return { id: model.id };
+	return {
+		id: model.id,
+		...meta.name !== undefined ? { name: meta.name } : {},
+		...meta.contextWindow !== undefined ? { contextWindow: meta.contextWindow } : {},
+		...meta.maxTokens !== undefined ? { maxTokens: meta.maxTokens } : {},
+		...meta.imageInput === true ? { imageInput: true } : {},
+		...meta.reasoningEfforts !== undefined ? { reasoningEfforts: { ...meta.reasoningEfforts } } : {}
+	};
+}
+/** Platform mapping with a per-group override applied last. */
+function protocolForPlatformWithOverride(platform, override) {
+	return override ?? protocolForPlatform(platform);
+}
+/** Pure diff of one current/desired snapshot → ops plus per-route actions. */
+function planOps(current, desired) {
+	const ops = [];
+	const actions = new Map();
+	const routes = new Set([...Object.keys(current).filter(isOwnedRoute), ...desired.keys()]);
+	for (const route of routes) {
+		const want = desired.get(route);
+		const have = current[route];
+		if (want !== undefined) if (have === undefined) {
+			ops.push({
+				op: "set",
+				path: ["providers", route],
+				value: want
+			});
+			actions.set(route, "created");
+		} else if (!deepEqual(have, want)) {
+			ops.push({
+				op: "set",
+				path: ["providers", route],
+				value: want
+			});
+			actions.set(route, "updated");
+		} else actions.set(route, "unchanged");
+else if (isOwnedRoute(route)) {
+			ops.push({
+				op: "unset",
+				path: ["providers", route]
+			});
+			actions.set(route, "unchanged");
+		}
+	}
+	return {
+		ops,
+		actions
+	};
+}
+
+//#endregion
+//#region src/icon.ts
+/** How long a resolved icon URL is trusted before re-reading the HTML. */
+const URL_TTL_MS = 6e5;
+/** Discovery + byte fetches cap, so an offline instance cannot stall callers. */
+const TIMEOUT_MS = 2500;
+/** Refuse to proxy absurd payloads. */
+const MAX_BYTES = 1e6;
+/** Sub2api's backend always appends this suffix to the rewritten title. */
+const TITLE_SUFFIX = " - AI API Gateway";
+/** Header layout guard: site names beyond this render truncated anyway. */
+const MAX_TITLE_LENGTH = 60;
+function pickIconHref(html$1) {
+	for (const match of html$1.matchAll(/<link\b[^>]*>/gi)) {
+		const tag = match[0];
+		const rel = attr(tag, "rel")?.toLowerCase() ?? "";
+		if (!rel.split(/\s+/).includes("icon") || rel.includes("mask")) continue;
+		const href = attr(tag, "href");
+		if (href === undefined || href.length === 0) continue;
+		return href.replace(/&amp;/gi, "&");
+	}
+	return undefined;
+}
+function parseSiteTitle(html$1) {
+	const match = /<title\b[^>]*>([^<]*)<\/title>/i.exec(html$1);
+	if (match === null) return undefined;
+	const decoded = match[1].replace(/&amp;/gi, "&").replace(/&lt;/gi, "<").replace(/&gt;/gi, ">").replace(/&quot;/gi, "\"").replace(/&#39;/gi, "'").trim();
+	const stripped = decoded.toLowerCase().endsWith(TITLE_SUFFIX.toLowerCase()) ? decoded.slice(0, decoded.length - TITLE_SUFFIX.length).trim() : decoded;
+	if (stripped.length === 0) return undefined;
+	return stripped.length > MAX_TITLE_LENGTH ? `${stripped.slice(0, MAX_TITLE_LENGTH)}…` : stripped;
+}
+/** One attribute value out of a tag string (double/single/unquoted). */
+function attr(tag, name$1) {
+	const pattern = new RegExp(`\\b${name$1}\\s*=\\s*(?:"([^"]*)"|'([^']*)'|([^\\s>]+))`, "i");
+	const match = pattern.exec(tag);
+	return match?.[1] ?? match?.[2] ?? match?.[3];
+}
+/** Fetch with a hard timeout; doubles (tests) may ignore the signal. */
+async function fetchCapped(url, fetchImpl) {
+	const controller = new AbortController();
+	const timer = setTimeout(() => {
+		controller.abort();
+	}, TIMEOUT_MS);
+	try {
+		return await fetchImpl(url, {
+			signal: controller.signal,
+			redirect: "follow"
+		});
+	} finally {
+		clearTimeout(timer);
+	}
+}
+/** Resolve the icon URL + site title from one instance's root HTML. */
+async function probeInstance(base, fetchImpl) {
+	const fallback = { iconUrl: `${base}/favicon.ico` };
+	try {
+		const response = await fetchCapped(`${base}/`, fetchImpl);
+		const type = response.headers.get("content-type") ?? "";
+		if (!response.ok || !(/text\/html/i.test(type) || type.length === 0)) return fallback;
+		const html$1 = await response.text();
+		const href = pickIconHref(html$1);
+		const iconUrl = href !== undefined ? (() => {
+			try {
+				return new URL(href, `${base}/`).toString();
+			} catch {
+				return fallback.iconUrl;
+			}
+		})() : fallback.iconUrl;
+		return {
+			iconUrl,
+			title: parseSiteTitle(html$1)
+		};
+	} catch {
+		return fallback;
+	}
+}
+/** Guess a content type from the URL extension when upstream omits it. */
+function guessContentType(url) {
+	const path = new URL(url).pathname.toLowerCase();
+	if (path.endsWith(".svg")) return "image/svg+xml";
+	if (path.endsWith(".png")) return "image/png";
+	if (path.endsWith(".jpg") || path.endsWith(".jpeg")) return "image/jpeg";
+	if (path.endsWith(".webp")) return "image/webp";
+	if (path.endsWith(".gif")) return "image/gif";
+	return "image/x-icon";
+}
+function createInstanceProbe(options = {}) {
+	const fetchImpl = options.fetchImpl ?? globalThis.fetch;
+	const cache = new Map();
+	const metaOf = async (instance) => {
+		const base = instance.trim().replace(/\/+$/, "");
+		if (!/^https?:\/\//i.test(base)) return undefined;
+		const now = Date.now();
+		const hit = cache.get(base);
+		if (hit !== undefined && now - hit.at < URL_TTL_MS) return hit.meta;
+		const meta = await probeInstance(base, fetchImpl);
+		cache.set(base, {
+			meta,
+			at: now
+		});
+		return meta;
+	};
+	return {
+		icon: async (instance) => {
+			const meta = await metaOf(instance);
+			if (meta === undefined) return undefined;
+			try {
+				const response = await fetchCapped(meta.iconUrl, fetchImpl);
+				if (!response.ok) return undefined;
+				const body = Buffer.from(await response.arrayBuffer());
+				if (body.length === 0 || body.length > MAX_BYTES) return undefined;
+				const upstream = response.headers.get("content-type")?.split(";")[0]?.trim() ?? "";
+				return {
+					contentType: upstream.length > 0 ? upstream : guessContentType(meta.iconUrl),
+					body
+				};
+			} catch {
+				return undefined;
+			}
+		},
+		siteName: async (instance) => (await metaOf(instance))?.title
+	};
+}
+
+//#endregion
+//#region src/oauth.ts
+const OAUTH_CLIENT_ID = "dsh-sub2api-sync";
+const OAUTH_CALLBACK_PATH = "/plugins/dsh-sub2api-sync/oauth/callback";
+const OAUTH_ATTEMPT_TTL_MS = 6e5;
+function oauthScopesFor(deleteOrphanKeys) {
+	return deleteOrphanKeys === true ? "openid profile groups:read keys:read keys:create keys:revoke" : "openid profile groups:read keys:read keys:create";
+}
+var OAuthError = class extends Error {
+	code;
+	constructor(code, message) {
+		super(message);
+		this.name = "OAuthError";
+		this.code = code;
+	}
+};
+const discoveryCache = new Map();
+const DISCOVERY_TTL_MS = 3e5;
+function absoluteHttpUrl(value) {
+	if (typeof value !== "string" || value.length === 0) return undefined;
+	try {
+		const url = new URL(value);
+		return url.protocol === "http:" || url.protocol === "https:" ? url.toString().replace(/\/$/, "") : undefined;
+	} catch {
+		return undefined;
+	}
+}
+async function discoverOAuthEndpoints(instance, fetchImpl = globalThis.fetch, now = Date.now()) {
+	const key = instance.trim().replace(/\/+$/, "").toLowerCase();
+	const cached = discoveryCache.get(key);
+	if (cached !== undefined && now - cached.fetchedAt < DISCOVERY_TTL_MS) {
+		if (cached.endpoints !== undefined) return cached.endpoints;
+		throw new OAuthError("discovery_failed", "sub2api OAuth 发现失败（此前已失败，稍后重试）");
+	}
+	const base = instance.trim().replace(/\/+$/, "");
+	const candidates = [`${base}/.well-known/oauth-authorization-server`, `${base}/api/v1/oauth/.well-known`];
+	let endpoints;
+	let lastError = "";
+	for (const candidate of candidates) try {
+		const response = await fetchImpl(candidate, { headers: { accept: "application/json" } });
+		if (!response.ok) {
+			lastError = `HTTP ${response.status} at ${candidate}`;
+			continue;
+		}
+		const payload = await response.json();
+		const authorizationEndpoint = absoluteHttpUrl(payload.authorization_endpoint);
+		const tokenEndpoint = absoluteHttpUrl(payload.token_endpoint);
+		if (authorizationEndpoint === undefined || tokenEndpoint === undefined) {
+			lastError = `incomplete metadata at ${candidate}`;
+			continue;
+		}
+		const revocationEndpoint = absoluteHttpUrl(payload.revocation_endpoint);
+		endpoints = {
+			authorizationEndpoint,
+			tokenEndpoint,
+			...revocationEndpoint !== undefined ? { revocationEndpoint } : {}
+		};
+		break;
+	} catch (error) {
+		lastError = `${candidate}: ${error instanceof Error ? error.message : String(error)}`;
+	}
+	discoveryCache.set(key, {
+		endpoints,
+		fetchedAt: now
+	});
+	if (endpoints === undefined) throw new OAuthError("discovery_failed", `sub2api OAuth 发现失败：${lastError}`);
+	return endpoints;
+}
+function resetDiscoveryCache() {
+	discoveryCache.clear();
+}
+function randomBase64url(bytes) {
+	const buffer = new Uint8Array(bytes);
+	crypto.getRandomValues(buffer);
+	let binary = "";
+	for (const byte of buffer) binary += String.fromCharCode(byte);
+	return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+async function createPkcePair() {
+	const verifier = randomBase64url(48);
+	const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
+	let binary = "";
+	for (const byte of new Uint8Array(digest)) binary += String.fromCharCode(byte);
+	const challenge = btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+	return {
+		verifier,
+		challenge
+	};
+}
+function loopbackCallbackOrigin(origin) {
+	let parsed;
+	try {
+		parsed = new URL(origin);
+	} catch {
+		throw new OAuthError("invalid_request", "无法解析回调地址 origin");
+	}
+	const host = parsed.hostname.toLowerCase();
+	if (host !== "127.0.0.1" && host !== "::1" && host !== "[::1]") throw new OAuthError("invalid_request", `OAuth 回调只支持本机回环地址（127.0.0.1 / ::1），当前 origin 是 ${parsed.host} —— 请在本机页面上发起网页授权`);
+	return `${parsed.protocol}//${parsed.host}${OAUTH_CALLBACK_PATH}`;
+}
+function buildAuthorizeUrl(endpoints, input) {
+	const url = new URL(endpoints.authorizationEndpoint);
+	url.searchParams.set("response_type", "code");
+	url.searchParams.set("client_id", OAUTH_CLIENT_ID);
+	url.searchParams.set("redirect_uri", input.redirectUri);
+	url.searchParams.set("scope", input.scope);
+	url.searchParams.set("state", input.state);
+	url.searchParams.set("code_challenge", input.challenge);
+	url.searchParams.set("code_challenge_method", "S256");
+	return url.toString();
+}
+function readTokenPair$1(payload) {
+	if (typeof payload !== "object" || payload === null) throw new OAuthError("server_error", "token 端点响应形状异常");
+	const record = payload;
+	if (typeof record.error === "string" && record.error.length > 0) throw new OAuthError(record.error, `token 端点返回错误：${record.error}`);
+	const accessToken = record.access_token;
+	if (typeof accessToken !== "string" || accessToken.length === 0) throw new OAuthError("server_error", "token 端点响应缺少 access_token");
+	const refreshToken = record.refresh_token;
+	const expiresIn = record.expires_in;
+	const scope = record.scope;
+	return {
+		accessToken,
+		...typeof refreshToken === "string" && refreshToken.length > 0 ? { refreshToken } : {},
+		...typeof expiresIn === "number" ? { expiresIn } : {},
+		...typeof scope === "string" && scope.length > 0 ? { scope } : {}
+	};
+}
+async function tokenRequest(tokenEndpoint, params, fetchImpl) {
+	const response = await fetchImpl(tokenEndpoint, {
+		method: "POST",
+		headers: {
+			"content-type": "application/x-www-form-urlencoded",
+			accept: "application/json"
+		},
+		body: new URLSearchParams(params).toString()
+	});
+	let payload;
+	try {
+		payload = await response.json();
+	} catch {
+		throw new OAuthError("server_error", `token 端点响应不是 JSON（HTTP ${response.status}）`);
+	}
+	if (!response.ok) {
+		const code = payload?.error;
+		throw new OAuthError(typeof code === "string" ? code : "server_error", `token 端点失败（HTTP ${response.status}）`);
+	}
+	return readTokenPair$1(payload);
+}
+function exchangeAuthorizationCode(endpoints, input, fetchImpl = globalThis.fetch) {
+	return tokenRequest(endpoints.tokenEndpoint, {
+		grant_type: "authorization_code",
+		client_id: OAUTH_CLIENT_ID,
+		code: input.code,
+		redirect_uri: input.redirectUri,
+		code_verifier: input.verifier
+	}, fetchImpl);
+}
+function refreshAccessToken(endpoints, refreshToken, fetchImpl = globalThis.fetch) {
+	return tokenRequest(endpoints.tokenEndpoint, {
+		grant_type: "refresh_token",
+		client_id: OAUTH_CLIENT_ID,
+		refresh_token: refreshToken
+	}, fetchImpl);
+}
+async function revokeToken(endpoints, token, fetchImpl = globalThis.fetch) {
+	if (endpoints.revocationEndpoint === undefined) return;
+	await fetchImpl(endpoints.revocationEndpoint, {
+		method: "POST",
+		headers: {
+			"content-type": "application/x-www-form-urlencoded",
+			accept: "application/json"
+		},
+		body: new URLSearchParams({ token }).toString()
+	}).catch(() => undefined);
+}
+var OAuthAttemptStore = class {
+	attempts = new Map();
+	byState = new Map();
+	constructor(ttlMs = OAUTH_ATTEMPT_TTL_MS) {
+		this.ttlMs = ttlMs;
+	}
+	create(input, now = Date.now()) {
+		const attempt = {
+			id: randomBase64url(24),
+			state: randomBase64url(32),
+			verifier: input.verifier,
+			redirectUri: input.redirectUri,
+			scope: input.scope,
+			phase: "pending",
+			createdAt: now
+		};
+		this.attempts.set(attempt.id, attempt);
+		this.byState.set(attempt.state, attempt.id);
+		return attempt;
+	}
+	expired(attempt, now) {
+		return now - attempt.createdAt > this.ttlMs;
+	}
+	/**
+	* Take the attempt for one browser redirect — single-use: the `state`
+	* binding is consumed by this call, so a replayed redirect finds nothing.
+	* The attempt itself stays in the registry for status polls by id until
+	* it settles or expires.
+	*/
+	takeByState(state, now = Date.now()) {
+		const id = this.byState.get(state);
+		if (id === undefined) return undefined;
+		this.byState.delete(state);
+		const attempt = this.attempts.get(id);
+		if (attempt === undefined) return undefined;
+		if (attempt.phase !== "pending" || this.expired(attempt, now)) {
+			this.drop(attempt);
+			return undefined;
+		}
+		return attempt;
+	}
+	/** Mark a consumed attempt terminal (keeps it readable for status polls). */
+	settle(id, phase, error) {
+		const attempt = this.attempts.get(id);
+		if (attempt === undefined) return;
+		attempt.phase = phase;
+		if (error !== undefined) attempt.error = error;
+	}
+	/** Read-only projection for the dialog's poll; unknown id → undefined. */
+	peek(id, now = Date.now()) {
+		const attempt = this.attempts.get(id);
+		if (attempt === undefined) return undefined;
+		if (this.expired(attempt, now)) {
+			this.drop(attempt);
+			return undefined;
+		}
+		return {
+			phase: attempt.phase,
+			...attempt.error !== undefined ? { error: attempt.error } : {}
+		};
+	}
+	cancel(id) {
+		const attempt = this.attempts.get(id);
+		if (attempt === undefined) return false;
+		this.drop(attempt);
+		return true;
+	}
+	drop(attempt) {
+		this.attempts.delete(attempt.id);
+		this.byState.delete(attempt.state);
+	}
+};
+function callbackPageHtml(outcome, message, lang = "zh") {
+	const copy = {
+		zh: {
+			successTitle: "授权成功",
+			failureTitle: "授权失败",
+			openApp: "打开应用",
+			htmlLang: "zh"
+		},
+		en: {
+			successTitle: "Authorization complete",
+			failureTitle: "Authorization failed",
+			openApp: "Open app",
+			htmlLang: "en"
+		}
+	}[lang];
+	const title = outcome === "success" ? copy.successTitle : copy.failureTitle;
+	const detail = message.replace(/[&<>"']/g, (ch) => `&#${ch.charCodeAt(0)};`);
+	const styles = `
+  body { font-family: system-ui, -apple-system, "PingFang SC", sans-serif; display: flex; min-height: 100vh;
+         margin: 0; background: #fff; color: #1a1a1e; }
+  .side { flex: 1 1 65%; display: flex; align-items: center; justify-content: center; min-width: 0; }
+  main { text-align: center; max-width: 30rem; padding: 2.5rem 1.5rem; }
+  .brand { display: flex; align-items: center; justify-content: center; gap: 0.55rem; margin-bottom: 4rem; }
+  .wordmark { font-size: 1.65rem; font-weight: 700; letter-spacing: -0.02em; }
+  .badge { background: #1a1a1e; color: #fff; font-size: 0.7rem; font-weight: 700; letter-spacing: 0.08em;
+           padding: 0.3rem 0.55rem; border-radius: 0.4rem; }
+  h1 { font-size: 1.5rem; font-weight: 600; margin: 0 0 1rem; }
+  p { font-size: 0.95rem; color: #8a8f9c; line-height: 1.7; margin: 0; }
+  .fail { color: #d54941; }
+  .art { flex: 1 1 35%; min-width: 0; display: flex; align-items: center; color: #fff;
+         background: radial-gradient(120% 90% at 78% 18%, rgba(255,255,255,0.26) 0%, rgba(255,255,255,0) 55%),
+                     linear-gradient(155deg, #6b7c92 0%, #46586e 38%, #2c3b4f 72%, #1f2b3a 100%); }
+  .art p { color: #fff; font-size: 1.75rem; line-height: 1.8; font-weight: 500; margin: 0; padding: 0 4.5rem;
+           max-width: 34rem; text-align: left; }
+  @media (max-width: 56rem) { .art { display: none; } }`;
+	const brand = `<div class="brand" aria-hidden="true"><span class="wordmark">Sub2API</span><span class="badge">SYNC</span></div>`;
+	const art = `<div class="art" aria-hidden="true"><p>欢迎对话 DeepSeek Harness，<br>共探智能上限</p></div>`;
+	if (outcome !== "success") return `<!doctype html>
+<html lang="${copy.htmlLang}">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>${title}</title>
+<style>${styles}</style>
+</head>
+<body>
+<div class="side">
+<main>
+  ${brand}
+  <h1>${title}</h1>
+  <p class="fail">${detail}</p>
+</main>
+</div>
+${art}
+<script>try { setTimeout(function () { window.close() }, 1500) } catch (e) {}</script>
+</body>
+</html>`;
+	return `<!doctype html>
+<html lang="${copy.htmlLang}">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>${title}</title>
+<style>${styles}
+  button { margin-top: 3rem; font: inherit; font-size: 0.95rem; padding: 0.85rem 2.4rem; border-radius: 0.75rem;
+           border: 0; background: #1a1a1e; color: #fff; cursor: pointer; }
+  button:hover { background: #33343a; }
+</style>
+</head>
+<body>
+<div class="side">
+<main>
+  ${brand}
+  <h1>${title}</h1>
+  <p>${detail}</p>
+  <button type="button" id="s2s-back">${copy.openApp}</button>
+</main>
+</div>
+${art}
+<script>
+(function () {
+  function pullApp() {
+    try {
+      var frame = document.createElement('iframe');
+      frame.style.display = 'none';
+      frame.src = 'dsh://open';
+      document.body.appendChild(frame);
+      setTimeout(function () { frame.remove() }, 4000);
+    } catch (e) {}
+  }
+  setTimeout(pullApp, 800);
+  var button = document.getElementById('s2s-back');
+  if (button) button.addEventListener('click', function () { location.href = 'dsh://open' });
+  try { setTimeout(function () { window.close() }, 30000) } catch (e) {}
+})();
+</script>
+</body>
+</html>`;
+}
+
+//#endregion
+//#region src/panel.ts
+var PanelError = class extends Error {
+	status;
+	code;
+	constructor(status, message, code) {
+		super(message);
+		this.name = "PanelError";
+		this.status = status;
+		this.code = code;
+	}
+};
+/** The deployment's display timezone for the panel's list endpoints. */
+function timeZoneOf() {
+	try {
+		return Intl.DateTimeFormat().resolvedOptions().timeZone || "UTC";
+	} catch {
+		return "UTC";
+	}
+}
+/** Extract the envelope payload or throw a loud PanelError. */
+function unwrap(response, payload) {
+	const envelope = payload;
+	if (envelope === null || envelope === undefined || typeof envelope !== "object") throw new PanelError(response.status, `面板响应不是标准信封（HTTP ${response.status}）`);
+	const code = envelope.code;
+	if (code !== 0 && code !== "0") {
+		const message = typeof envelope.message === "string" && envelope.message.length > 0 ? envelope.message : "未知错误";
+		throw new PanelError(response.status, `面板错误：${message}（code=${String(code)}）`, code);
+	}
+	return envelope.data;
+}
+/** Best-effort captcha interception check (A4: contract still unverified). */
+function looksLikeCaptcha(status, payload) {
+	if (status !== 403 && status !== 400) return false;
+	const text = JSON.stringify(payload ?? "").toLowerCase();
+	return text.includes("turnstile") || text.includes("captcha");
+}
+async function readBody(response) {
+	const text = await response.text().catch(() => "");
+	if (text.length === 0) return undefined;
+	try {
+		return JSON.parse(text);
+	} catch {
+		return text;
+	}
+}
+/** Loud failure for non-envelope HTTP failures (Cloudflare pages, 500s, …). */
+async function fail(response, what) {
+	const payload = await readBody(response);
+	const message = typeof payload === "string" && payload.length > 0 ? payload.slice(0, 200) : payload?.message;
+	const hint = response.status === 403 ? "（若实例前置 Cloudflare，检查 /api/v1/* 的 WAF 放行规则）" : "";
+	throw new PanelError(response.status, `${what} 失败：HTTP ${response.status} ${typeof message === "string" ? message : ""}${hint}`);
+}
+/** Tolerant group reader. */
+function readGroup(item) {
+	if (typeof item !== "object" || item === null) return undefined;
+	const record = item;
+	const id = record.id;
+	const name$1 = record.name;
+	if (typeof id !== "number" || !Number.isSafeInteger(id) || typeof name$1 !== "string") return undefined;
+	return {
+		id,
+		name: name$1,
+		...typeof record.description === "string" ? { description: record.description } : {},
+		platform: typeof record.platform === "string" ? record.platform : "",
+		...typeof record.rate_multiplier === "number" ? { rateMultiplier: record.rate_multiplier } : {},
+		...typeof record.status === "string" ? { status: record.status } : {},
+		...typeof record.is_exclusive === "boolean" ? { isExclusive: record.is_exclusive } : {},
+		...typeof record.claude_code_only === "boolean" ? { claudeCodeOnly: record.claude_code_only } : {}
+	};
+}
+/** Tolerant key reader; plaintext kept verbatim when present. */
+function readKey(item) {
+	if (typeof item !== "object" || item === null) return undefined;
+	const record = item;
+	const id = record.id;
+	const name$1 = record.name;
+	const groupId = record.group_id;
+	if (typeof id !== "number" || !Number.isSafeInteger(id) || typeof name$1 !== "string") return undefined;
+	if (typeof groupId !== "number" || !Number.isSafeInteger(groupId)) return undefined;
+	return {
+		id,
+		name: name$1,
+		groupId,
+		...typeof record.key === "string" ? { key: record.key } : {},
+		...typeof record.status === "string" ? { status: record.status } : {},
+		...typeof record.quota === "number" ? { quota: record.quota } : {},
+		...typeof record.expires_at === "string" ? { expiresAt: record.expires_at } : {}
+	};
+}
+function readTokenPair(data) {
+	if (typeof data !== "object" || data === null) throw new PanelError(500, "登录响应缺少 data");
+	const record = data;
+	const accessToken = record.access_token;
+	if (typeof accessToken !== "string" || accessToken.length === 0) throw new PanelError(500, "登录响应缺少 access_token");
+	const refreshToken = record.refresh_token;
+	return {
+		accessToken,
+		...typeof refreshToken === "string" && refreshToken.length > 0 ? { refreshToken } : {}
+	};
+}
+var PanelClient = class {
+	baseURL;
+	fetchImpl;
+	constructor(options) {
+		const base = options.baseURL.trim().replace(/\/+$/, "");
+		if (!/^https?:\/\//i.test(base)) throw new Error("sub2api: baseURL 必须是 http(s) 地址");
+		this.baseURL = base;
+		const fetchImpl = options.fetchImpl ?? globalThis.fetch;
+		if (fetchImpl === undefined) throw new Error("sub2api: 当前环境没有 fetch 可用");
+		this.fetchImpl = fetchImpl.bind(globalThis);
+	}
+	async call(token, method, path, body) {
+		const response = await this.fetchImpl(`${this.baseURL}/api/v1${path}`, {
+			method,
+			headers: {
+				"content-type": "application/json",
+				accept: "application/json",
+				"x-user-ui-request": "1",
+				...token !== undefined ? { authorization: `Bearer ${token}` } : {}
+			},
+			...body !== undefined ? { body: JSON.stringify(body) } : {}
+		});
+		const payload = await readBody(response);
+		if (!response.ok) {
+			if (looksLikeCaptcha(response.status, payload)) {
+				const message = payload?.message;
+				throw Object.assign(new PanelError(response.status, `实例开启了人机验证（Turnstile/TCaptcha）——请改用「网页授权」通道`, "captcha"), {
+					kind: "captcha",
+					detail: typeof message === "string" ? message : undefined
+				});
+			}
+			if (typeof payload === "object" && payload !== null && payload.code !== undefined) unwrap(response, payload);
+			await fail(response, `面板 ${method} ${path}`);
+		}
+		return unwrap(response, payload);
+	}
+	/** Password login; classifies 2FA and captcha outcomes. */
+	async login(email, password) {
+		let payload;
+		try {
+			payload = await this.call(undefined, "POST", "/auth/login", {
+				email,
+				password
+			});
+		} catch (error) {
+			if (error instanceof PanelError) throw error;
+			throw error;
+		}
+		const data = payload;
+		if (data !== null && typeof data === "object" && data.requires_2fa === true) {
+			const tempToken = data.temp_token;
+			if (typeof tempToken !== "string" || tempToken.length === 0) throw new PanelError(500, "2FA 响应缺少 temp_token");
+			return {
+				kind: "2fa",
+				tempToken
+			};
+		}
+		const tokens = readTokenPair(payload);
+		return {
+			kind: "ok",
+			accessToken: tokens.accessToken,
+			refreshToken: tokens.refreshToken
+		};
+	}
+	/** Second factor for the pending login. */
+	async login2FA(tempToken, totpCode) {
+		const payload = await this.call(undefined, "POST", "/auth/login/2fa", {
+			temp_token: tempToken,
+			totp_code: totpCode
+		});
+		return readTokenPair(payload);
+	}
+	/** Exchange a refresh token for a fresh pair. */
+	async refresh(refreshToken) {
+		const payload = await this.call(undefined, "POST", "/auth/refresh", { refresh_token: refreshToken });
+		return readTokenPair(payload);
+	}
+	/** Groups the account can bind; `data` is a bare array. */
+	async listAvailableGroups(token) {
+		const data = await this.call(token, "GET", "/groups/available");
+		if (!Array.isArray(data)) throw new PanelError(500, "groups/available 响应不是数组");
+		return data.map(readGroup).filter((group) => group !== undefined);
+	}
+	/**
+	* One page of the panel's native key listing (newest first upstream:
+	* `sort_by=created_at&sort_order=desc`, mirroring the console call shape).
+	* Callers that need every key walk `pages` themselves.
+	*/
+	async listKeys(token, options) {
+		const page = options?.page ?? 1;
+		const pageSize = options?.pageSize ?? 20;
+		const query = new URLSearchParams({
+			page: String(page),
+			page_size: String(pageSize),
+			sort_by: options?.sortBy ?? "created_at",
+			sort_order: options?.sortOrder ?? "desc",
+			timezone: timeZoneOf()
+		});
+		if (options?.groupId !== undefined) query.set("group_id", String(options.groupId));
+		const data = await this.call(token, "GET", `/keys?${query.toString()}`);
+		const record = data;
+		const items = record?.items;
+		if (!Array.isArray(items)) throw new PanelError(500, "keys 响应缺少 items 数组");
+		const mapped = items.map(readKey).filter((key) => key !== undefined);
+		const total = typeof record?.total === "number" ? record.total : mapped.length;
+		const pages = typeof record?.pages === "number" && record.pages > 0 ? record.pages : Math.max(1, Math.ceil(total / pageSize));
+		return {
+			items: mapped,
+			total,
+			pages
+		};
+	}
+	/** Create one relay key. */
+	async createKey(token, input) {
+		const payload = await this.call(token, "POST", "/keys", {
+			name: input.name,
+			group_id: input.groupId,
+			...input.quota !== undefined && input.quota > 0 ? { quota: input.quota } : {},
+			...input.expiresinDays !== undefined && input.expiresinDays > 0 ? { expires_in_days: input.expiresinDays } : {}
+		});
+		const key = readKey(payload);
+		if (key === undefined) throw new PanelError(500, "创建 key 响应形状异常");
+		return key;
+	}
+	/** Revoke one relay key. */
+	async deleteKey(token, id) {
+		await this.call(token, "DELETE", `/keys/${id}`);
+	}
+	/**
+	* Controlled plaintext reveal for one client-owned relay key (OAuth only):
+	* the regular OAuth list/get answers are masked, this endpoint is the
+	* documented exception — same ownership checks server-side, audited.
+	*/
+	async revealKey(token, id) {
+		const payload = await this.call(token, "POST", `/keys/${id}/reveal`);
+		const key = readKey(payload);
+		if (key === undefined) throw new PanelError(500, "reveal 响应形状异常");
+		return key;
+	}
+	/**
+	* The signed-in account's panel identity via the OAuth userinfo endpoint
+	* (`GET /auth/me`, scope `profile` — the plugin always requests it). The
+	* richer `/user/profile` sits OUTSIDE the OAuth token's path whitelist
+	* (`requiredOAuthScope`: only /auth/me, /groups/*, /keys/*) and answers
+	* 403 INSUFFICIENT_SCOPE for OAuth sessions. Fields: username, email,
+	* balance — all optional.
+	*/
+	async getProfile(token) {
+		const payload = await this.call(token, "GET", "/auth/me");
+		if (payload === null || typeof payload !== "object") throw new PanelError(500, "profile 响应形状异常");
+		const data = payload;
+		const pick = (key) => {
+			const value = data[key];
+			return typeof value === "string" && value.trim().length > 0 ? value.trim() : undefined;
+		};
+		const balance = data.balance;
+		return {
+			username: pick("username"),
+			email: pick("email"),
+			...typeof balance === "number" && Number.isFinite(balance) ? { balance } : {}
+		};
+	}
+	/** OAuth token exchange against the discovered provider (host-side only). */
+	async oauthTokenExchange(endpoints, input) {
+		return exchangeAuthorizationCode(endpoints, input, this.fetchImpl);
+	}
+	/** OAuth discovery passthrough for route handlers that need endpoints. */
+	async discoverOAuth() {
+		return discoverOAuthEndpoints(this.baseURL, this.fetchImpl);
+	}
+};
+var PanelGateway = class {
+	baseURLSource;
+	credentials;
+	fetchImpl;
+	pending2FA;
+	refreshInFlight;
+	oauthRefreshInFlight;
+	constructor(options) {
+		this.baseURLSource = options.baseURL;
+		this.credentials = options.credentials;
+		this.fetchImpl = options.fetchImpl;
+		this.onAuthLost = options.onAuthLost;
+	}
+	/**
+	* Fired when the panel session is definitively gone — no refresh token, or
+	* the refresh call itself was refused. Never on network failures. The host
+	* hooks this to purge the site's sync state (logout/expiry policy).
+	*/
+	onAuthLost;
+	/** The instance address, re-read per call so a baseURL edit takes effect. */
+	get baseURL() {
+		return typeof this.baseURLSource === "function" ? this.baseURLSource() : this.baseURLSource;
+	}
+	client() {
+		return new PanelClient({
+			baseURL: this.baseURL,
+			fetchImpl: this.fetchImpl
+		});
+	}
+	tokenRef() {
+		return panelTokenRef(this.baseURL);
+	}
+	refreshRef() {
+		return panelRefreshRef(this.baseURL);
+	}
+	oauthAccessRef() {
+		return oauthTokenRef(this.baseURL);
+	}
+	oauthRefresh() {
+		return oauthRefreshRef(this.baseURL);
+	}
+	/** Current auth state; email rides the caller's config, not credentials. */
+	async authState(email) {
+		const oauthAccess = await this.credentials.resolve(this.oauthAccessRef());
+		if (oauthAccess !== undefined && oauthAccess.value.length > 0) return {
+			signedIn: true,
+			kind: "oauth",
+			...email !== undefined && email.length > 0 ? { email } : {}
+		};
+		const access = await this.credentials.resolve(this.tokenRef());
+		if (access === undefined || access.value.length === 0) return {
+			signedIn: false,
+			kind: "none"
+		};
+		return {
+			signedIn: true,
+			kind: "panel",
+			...email !== undefined && email.length > 0 ? { email } : {}
+		};
+	}
+	/** Password login; stores the pair and the password for silent re-login. */
+	async login(email, password) {
+		const outcome = await this.client().login(email, password);
+		if (outcome.kind === "2fa") {
+			this.pending2FA = {
+				tempToken: outcome.tempToken,
+				email
+			};
+			return outcome;
+		}
+		if (outcome.kind === "captcha") return outcome;
+		await this.storeTokens(outcome.accessToken, outcome.refreshToken);
+		return outcome;
+	}
+	/** Complete the pending 2FA login. */
+	async login2FA(code) {
+		const pending = this.pending2FA;
+		if (pending === undefined) throw new Error("sub2api-sync: 没有待完成的 2FA 登录——请先发起登录");
+		const tokens = await this.client().login2FA(pending.tempToken, code);
+		await this.storeTokens(tokens.accessToken, tokens.refreshToken);
+		this.pending2FA = undefined;
+	}
+	/** Sign out: revoke OAuth tokens server-side when present, then drop both channels' secrets. */
+	async logout() {
+		await this.oauthSignOut();
+		await this.credentials.unset(this.tokenRef());
+		await this.credentials.unset(this.refreshRef());
+		this.pending2FA = undefined;
+	}
+	/**
+	* Run one authed panel call. Tokens resolve per channel — OAuth access
+	* token first, then the panel JWT — and a 401 triggers a single-flight
+	* refresh (channel-appropriate) and exactly one retry before failing loud.
+	*/
+	async use(fn) {
+		const oauthAccess = await this.credentials.resolve(this.oauthAccessRef());
+		if (oauthAccess !== undefined && oauthAccess.value.length > 0) {
+			const panel$1 = this.client();
+			try {
+				return await fn(panel$1, oauthAccess.value);
+			} catch (error) {
+				const status = error instanceof PanelError ? error.status : undefined;
+				if (status !== 401) throw error;
+				const token = await this.refreshOAuthSingleFlight();
+				return await fn(panel$1, token);
+			}
+		}
+		const access = await this.credentials.resolve(this.tokenRef());
+		if (access === undefined || access.value.length === 0) throw new Error("sub2api-sync: 尚未登录 sub2api 面板——请先在设置卡完成登录");
+		const panel = this.client();
+		try {
+			return await fn(panel, access.value);
+		} catch (error) {
+			const status = error instanceof PanelError ? error.status : undefined;
+			if (status !== 401) throw error;
+			const token = await this.refreshSingleFlight();
+			return await fn(panel, token);
+		}
+	}
+	/** Store the pair from a completed browser authorization (C2). */
+	async storeOAuthTokens(pair) {
+		await this.credentials.set(this.oauthAccessRef(), pair.accessToken);
+		if (pair.refreshToken !== undefined) await this.credentials.set(this.oauthRefresh(), pair.refreshToken);
+else await this.credentials.unset(this.oauthRefresh());
+	}
+	/** Revoke OAuth tokens at the provider (best effort) and drop the stored secrets. */
+	async oauthSignOut() {
+		const access = await this.credentials.resolve(this.oauthAccessRef());
+		const refresh = await this.credentials.resolve(this.oauthRefresh());
+		if (access !== undefined || refresh !== undefined) try {
+			const endpoints = await discoverOAuthEndpoints(this.baseURL, this.fetchImpl);
+			if (refresh !== undefined) await revokeToken(endpoints, refresh.value, this.fetchImpl);
+			if (access !== undefined) await revokeToken(endpoints, access.value, this.fetchImpl);
+		} catch {}
+		await this.credentials.unset(this.oauthAccessRef());
+		await this.credentials.unset(this.oauthRefresh());
+	}
+	/** Single-flight OAuth refresh (rotating); concurrent 401s share one wire call. */
+	refreshOAuthSingleFlight() {
+		this.oauthRefreshInFlight ??= this.refreshOAuth().finally(() => {
+			this.oauthRefreshInFlight = undefined;
+		});
+		return this.oauthRefreshInFlight;
+	}
+	async refreshOAuth() {
+		const stored = await this.credentials.resolve(this.oauthRefresh());
+		if (stored === undefined || stored.value.length === 0) {
+			await this.credentials.unset(this.oauthAccessRef());
+			this.onAuthLost?.();
+			throw new Error("sub2api-sync: OAuth 登录已过期且无 refresh token——请重新进行网页授权");
+		}
+		try {
+			const endpoints = await discoverOAuthEndpoints(this.baseURL, this.fetchImpl);
+			const pair = await refreshAccessToken(endpoints, stored.value, this.fetchImpl);
+			await this.storeOAuthTokens(pair);
+			return pair.accessToken;
+		} catch (error) {
+			await this.credentials.unset(this.oauthAccessRef());
+			await this.credentials.unset(this.oauthRefresh());
+			this.onAuthLost?.();
+			const reason = error instanceof Error ? error.message : String(error);
+			throw new Error(`sub2api-sync: OAuth 登录已过期且刷新失败——请重新进行网页授权（${reason}）`);
+		}
+	}
+	/** Single-flight refresh; concurrent 401s share one wire call. */
+	refreshSingleFlight() {
+		this.refreshInFlight ??= this.doRefresh().finally(() => {
+			this.refreshInFlight = undefined;
+		});
+		return this.refreshInFlight;
+	}
+	async doRefresh() {
+		const stored = await this.credentials.resolve(this.refreshRef());
+		if (stored === undefined || stored.value.length === 0) {
+			await this.credentials.unset(this.tokenRef());
+			this.onAuthLost?.();
+			throw new Error("sub2api-sync: 登录已过期且无 refresh token——请重新登录");
+		}
+		try {
+			const tokens = await this.client().refresh(stored.value);
+			await this.storeTokens(tokens.accessToken, tokens.refreshToken);
+			return tokens.accessToken;
+		} catch (error) {
+			await this.credentials.unset(this.tokenRef());
+			await this.credentials.unset(this.refreshRef());
+			this.onAuthLost?.();
+			const reason = error instanceof Error ? error.message : String(error);
+			throw new Error(`sub2api-sync: 登录已过期且刷新失败——请重新登录（${reason}）`);
+		}
+	}
+	async storeTokens(accessToken, refreshToken) {
+		await this.credentials.set(this.tokenRef(), accessToken);
+		if (refreshToken !== undefined) await this.credentials.set(this.refreshRef(), refreshToken);
+else await this.credentials.unset(this.refreshRef());
+	}
+};
+
+//#endregion
+//#region src/routes.ts
+function callbackLangOf(acceptLanguage) {
+	const first = acceptLanguage?.split(",")[0]?.trim().toLowerCase() ?? "";
+	return first.startsWith("en") ? "en" : "zh";
+}
+const ROUTES = {
+	sync: "/plugins/dsh-sub2api-sync/sync",
+	status: "/plugins/dsh-sub2api-sync/status",
+	login: "/plugins/dsh-sub2api-sync/login",
+	login2fa: "/plugins/dsh-sub2api-sync/login/2fa",
+	logout: "/plugins/dsh-sub2api-sync/logout",
+	groups: "/plugins/dsh-sub2api-sync/groups",
+	keys: "/plugins/dsh-sub2api-sync/keys",
+	icon: "/plugins/dsh-sub2api-sync/icon",
+	site: "/plugins/dsh-sub2api-sync/site",
+	account: "/plugins/dsh-sub2api-sync/account",
+	resetSync: "/plugins/dsh-sub2api-sync/reset-sync",
+	removeKey: "/plugins/dsh-sub2api-sync/remove-key",
+	oauthStart: "/plugins/dsh-sub2api-sync/oauth/start",
+	oauthProbe: "/plugins/dsh-sub2api-sync/oauth/probe",
+	oauthCallback: "/plugins/dsh-sub2api-sync/oauth/callback",
+	oauthStatus: "/plugins/dsh-sub2api-sync/oauth/status",
+	oauthCancel: "/plugins/dsh-sub2api-sync/oauth/cancel"
+};
+function trustedRequest(req, allowRemote = false) {
+	const remote = req.socket.remoteAddress;
+	if (remote === undefined) return false;
+	const loopback = remote === "127.0.0.1" || remote === "::1" || remote === "::ffff:127.0.0.1";
+	const privatePeer = loopback || allowRemote && isPrivateAddress(remote);
+	if (!privatePeer) return false;
+	if (req.headers["sec-fetch-site"] === "cross-site") return false;
+	const host = req.headers.host;
+	if (host === undefined) return false;
+	const origin = req.headers.origin;
+	if (origin === undefined) return true;
+	try {
+		return new URL(origin).host === new URL(`http://${host}`).host;
+	} catch {
+		return false;
+	}
+}
+/** RFC 1918 / ULA ranges only — never public addresses. */
+function isPrivateAddress(address) {
+	const ipv4 = /^::ffff:(\d+\.\d+\.\d+\.\d+)$/.exec(address)?.[1] ?? address;
+	const v4 = /^(\d+)\.(\d+)\.(\d+)\.(\d+)$/.exec(ipv4);
+	if (v4 !== null) {
+		const [a, b] = [Number(v4[1]), Number(v4[2])];
+		if (a === 10 || a === 127) return true;
+		if (a === 172 && b >= 16 && b <= 31) return true;
+		if (a === 192 && b === 168) return true;
+		return false;
+	}
+	const lowered = address.toLowerCase();
+	if (lowered === "::1") return true;
+	return lowered.startsWith("fc") || lowered.startsWith("fd");
+}
+async function readJson(req) {
+	const chunks = [];
+	for await (const chunk of req) chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+	const text = Buffer.concat(chunks).toString("utf8").trim();
+	if (text.length === 0) return {};
+	const value = JSON.parse(text);
+	return typeof value === "object" && value !== null && !Array.isArray(value) ? value : {};
+}
+function json(res, status, value) {
+	res.writeHead(status, {
+		"content-type": "application/json; charset=utf-8",
+		"cache-control": "no-store",
+		"x-content-type-options": "nosniff"
+	});
+	res.end(JSON.stringify(value));
+}
+/** The browser-facing hand-back page for the provider's redirect. */
+function html(res, body) {
+	res.writeHead(200, {
+		"content-type": "text/html; charset=utf-8",
+		"cache-control": "no-store",
+		"x-content-type-options": "nosniff"
+	});
+	res.end(body);
+}
+/** The harness origin this request arrived on (host + proto, no path). */
+function requestOrigin(req) {
+	const forwarded = req.headers["x-forwarded-proto"];
+	const proto = (Array.isArray(forwarded) ? forwarded[0] : forwarded) ?? "http";
+	const host = req.headers.host ?? "127.0.0.1";
+	return `${proto}://${host}`;
+}
+function safeMessage(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+function conflictStatus(error) {
+	const shape = error;
+	return shape?.code === "SETTINGS_CONFLICT" || shape?.name === "SettingsConflictError" ? 409 : undefined;
+}
+function registerRoutes(ctx, deps) {
+	ctx.inject(["webServer"], (webCtx) => {
+		const route = (path, handler) => {
+			webCtx.webServer.register({
+				kind: "exact",
+				path,
+				handler
+			});
+		};
+		const guard = (req, res) => {
+			if (!trustedRequest(req, deps.allowRemote())) {
+				json(res, 403, { error: "forbidden" });
+				return false;
+			}
+			return true;
+		};
+		const method = (expected, req, res) => {
+			if (req.method !== expected) {
+				json(res, 405, { error: "method not allowed" });
+				return false;
+			}
+			return true;
+		};
+		route(ROUTES.status, async (req, res) => {
+			if (!guard(req, res)) return;
+			if (!method("GET", req, res)) return;
+			const auth = await deps.authState();
+			json(res, 200, {
+				ok: true,
+				auth,
+				instance: deps.instance(),
+				syncRunning: deps.isSyncRunning(),
+				routes: deps.ownedRoutes(),
+				lastReport: deps.lastReport(),
+				lastReportAt: deps.lastReportAt()
+			});
+		});
+		route(ROUTES.sync, async (req, res) => {
+			if (!guard(req, res)) return;
+			if (!method("POST", req, res)) return;
+			try {
+				const body = await readJson(req).catch(() => ({}));
+				const keyIds = Array.isArray(body.keyIds) ? body.keyIds.filter((id) => typeof id === "number" && Number.isSafeInteger(id) && id > 0) : undefined;
+				const report = await deps.sync(keyIds);
+				json(res, 200, {
+					ok: true,
+					report
+				});
+			} catch (error) {
+				json(res, conflictStatus(error) ?? 500, {
+					ok: false,
+					error: safeMessage(error)
+				});
+			}
+		});
+		route(ROUTES.login, async (req, res) => {
+			if (!guard(req, res)) return;
+			if (!method("POST", req, res)) return;
+			let body;
+			try {
+				body = await readJson(req);
+			} catch {
+				return json(res, 400, { error: "invalid JSON body" });
+			}
+			const email = typeof body.email === "string" ? body.email.trim() : "";
+			const password = typeof body.password === "string" ? body.password : undefined;
+			if (email.length === 0) return json(res, 400, { error: "email 必填" });
+			try {
+				json(res, 200, await deps.login(email, password));
+			} catch (error) {
+				const kind = error?.kind;
+				json(res, 400, {
+					ok: false,
+					error: safeMessage(error),
+					...kind === "captcha" ? { kind: "captcha" } : {}
+				});
+			}
+		});
+		route(ROUTES.login2fa, async (req, res) => {
+			if (!guard(req, res)) return;
+			if (!method("POST", req, res)) return;
+			let body;
+			try {
+				body = await readJson(req);
+			} catch {
+				return json(res, 400, { error: "invalid JSON body" });
+			}
+			const code = typeof body.code === "string" ? body.code.trim() : "";
+			if (!/^\d{6}$/.test(code)) return json(res, 400, { error: "code 必须是 6 位数字" });
+			try {
+				await deps.login2FA(code);
+				json(res, 200, {
+					ok: true,
+					kind: "ok"
+				});
+			} catch (error) {
+				json(res, 400, {
+					ok: false,
+					error: safeMessage(error)
+				});
+			}
+		});
+		route(ROUTES.logout, async (req, res) => {
+			if (!guard(req, res)) return;
+			if (!method("POST", req, res)) return;
+			try {
+				await deps.logout();
+				json(res, 200, { ok: true });
+			} catch (error) {
+				json(res, 500, {
+					ok: false,
+					error: safeMessage(error)
+				});
+			}
+		});
+		route(ROUTES.groups, async (req, res) => {
+			if (!guard(req, res)) return;
+			if (!method("GET", req, res)) return;
+			try {
+				json(res, 200, {
+					ok: true,
+					groups: await deps.listGroups()
+				});
+			} catch (error) {
+				json(res, 400, {
+					ok: false,
+					error: safeMessage(error)
+				});
+			}
+		});
+		route(ROUTES.keys, async (req, res) => {
+			if (!guard(req, res)) return;
+			if (req.method === "GET") {
+				try {
+					const url = new URL(req.url ?? "/", "http://localhost");
+					const rawPage = Number(url.searchParams.get("page") ?? "1");
+					const rawSize = Number(url.searchParams.get("pageSize") ?? "5");
+					const page = Number.isSafeInteger(rawPage) && rawPage > 0 ? rawPage : 1;
+					const pageSize = Number.isSafeInteger(rawSize) && rawSize > 0 ? Math.min(rawSize, 50) : 5;
+					const result = await deps.listKeys(page, pageSize);
+					json(res, 200, {
+						ok: true,
+						keys: result.keys,
+						total: result.total,
+						pages: result.pages
+					});
+				} catch (error) {
+					json(res, 400, {
+						ok: false,
+						error: safeMessage(error)
+					});
+				}
+				return;
+			}
+			if (!method("POST", req, res)) return;
+			try {
+				const body = await readJson(req);
+				const groupId = parseGroupIdFrom(body.groupId);
+				const name$1 = typeof body.name === "string" ? body.name.trim() : "";
+				if (groupId === undefined) return json(res, 400, {
+					ok: false,
+					error: "groupId 必须是正整数分组 id"
+				});
+				if (name$1.length === 0 || name$1.length > 128) return json(res, 400, {
+					ok: false,
+					error: "key 名称必须是 1-128 个字符"
+				});
+				json(res, 200, {
+					ok: true,
+					key: await deps.createKey({
+						groupId,
+						name: name$1
+					})
+				});
+			} catch (error) {
+				json(res, 400, {
+					ok: false,
+					error: safeMessage(error)
+				});
+			}
+		});
+		route(ROUTES.icon, async (req, res) => {
+			if (!guard(req, res)) return;
+			if (!method("GET", req, res)) return;
+			const icon = await deps.icon().catch(() => undefined);
+			if (icon === undefined) return json(res, 404, { error: "icon unavailable" });
+			res.writeHead(200, {
+				"content-type": icon.contentType,
+				"cache-control": "private, max-age=600",
+				"x-content-type-options": "nosniff"
+			});
+			res.end(icon.body);
+		});
+		route(ROUTES.site, async (req, res) => {
+			if (!guard(req, res)) return;
+			if (!method("GET", req, res)) return;
+			const name$1 = await deps.siteName().catch(() => undefined);
+			json(res, 200, {
+				ok: true,
+				name: name$1
+			});
+		});
+		route(ROUTES.account, async (req, res) => {
+			if (!guard(req, res)) return;
+			if (!method("GET", req, res)) return;
+			try {
+				const profile = await deps.account();
+				json(res, 200, {
+					ok: true,
+					...profile?.username !== undefined ? { username: profile.username } : {},
+					...profile?.email !== undefined ? { email: profile.email } : {},
+					...profile?.balance !== undefined ? { balance: profile.balance } : {}
+				});
+			} catch (error) {
+				json(res, 200, {
+					ok: true,
+					error: safeMessage(error)
+				});
+			}
+		});
+		route(ROUTES.resetSync, async (req, res) => {
+			if (!guard(req, res)) return;
+			if (!method("POST", req, res)) return;
+			try {
+				const body = await readJson(req);
+				const previous = typeof body.previousBaseURL === "string" && body.previousBaseURL.length > 0 ? body.previousBaseURL : undefined;
+				await deps.resetSync(previous);
+				json(res, 200, { ok: true });
+			} catch (error) {
+				json(res, 500, {
+					ok: false,
+					error: safeMessage(error)
+				});
+			}
+		});
+		route(ROUTES.removeKey, async (req, res) => {
+			if (!guard(req, res)) return;
+			if (!method("POST", req, res)) return;
+			try {
+				const body = await readJson(req);
+				const keyId = parseGroupIdFrom(body.keyId);
+				if (keyId === undefined) return json(res, 400, {
+					ok: false,
+					error: "keyId 必须是正整数 key id"
+				});
+				await deps.removeSyncedKey(keyId);
+				json(res, 200, { ok: true });
+			} catch (error) {
+				json(res, 500, {
+					ok: false,
+					error: safeMessage(error)
+				});
+			}
+		});
+		route(ROUTES.oauthStart, async (req, res) => {
+			if (!guard(req, res)) return;
+			if (!method("POST", req, res)) return;
+			try {
+				const started = await deps.oauthStart(requestOrigin(req));
+				json(res, 200, {
+					ok: true,
+					attemptId: started.attemptId,
+					authorizeUrl: started.authorizeUrl
+				});
+			} catch (error) {
+				json(res, 400, {
+					ok: false,
+					error: safeMessage(error)
+				});
+			}
+		});
+		route(ROUTES.oauthProbe, async (req, res) => {
+			if (!guard(req, res)) return;
+			if (!method("GET", req, res)) return;
+			const url = new URL(req.url ?? "/", "http://localhost");
+			const address = url.searchParams.get("address") ?? "";
+			let supported = false;
+			if (/^https?:\/\//i.test(address.trim())) supported = await deps.oauthProbe(address).catch(() => false);
+			json(res, 200, {
+				ok: true,
+				supported
+			});
+		});
+		route(ROUTES.oauthCallback, async (req, res) => {
+			if (!method("GET", req, res)) return;
+			try {
+				const query = new URL(req.url ?? "/", "http://localhost").searchParams;
+				const answer = await deps.oauthCallback(query, callbackLangOf(req.headers["accept-language"]));
+				html(res, answer.html);
+			} catch (error) {
+				html(res, oauthFailurePage(safeMessage(error)));
+			}
+		});
+		route(ROUTES.oauthStatus, async (req, res) => {
+			if (!guard(req, res)) return;
+			if (!method("GET", req, res)) return;
+			try {
+				const url = new URL(req.url ?? "/", "http://localhost");
+				const attemptId = url.searchParams.get("attempt") ?? undefined;
+				json(res, 200, await deps.oauthStatus(attemptId));
+			} catch (error) {
+				json(res, 400, {
+					ok: false,
+					error: safeMessage(error)
+				});
+			}
+		});
+		route(ROUTES.oauthCancel, async (req, res) => {
+			if (!guard(req, res)) return;
+			if (!method("POST", req, res)) return;
+			try {
+				const body = await readJson(req);
+				if (typeof body.attemptId !== "string" || body.attemptId.length === 0) return json(res, 400, {
+					ok: false,
+					error: "attemptId 必填"
+				});
+				await deps.oauthCancel(body.attemptId);
+				json(res, 200, { ok: true });
+			} catch (error) {
+				json(res, 400, {
+					ok: false,
+					error: safeMessage(error)
+				});
+			}
+		});
+	});
+}
+/** Standalone failure page when the callback handler itself throws. Inline on
+* purpose: routes.ts rides the client bundle, so it must not value-import
+* the host-only oauth module. */
+function oauthFailurePage(message) {
+	const detail = message.replace(/[&<>"']/g, (ch) => `&#${ch.charCodeAt(0)};`);
+	return `<!doctype html><html lang="zh"><head><meta charset="utf-8"><title>授权失败 · Authorization failed</title></head><body><main><h1>授权失败 · Authorization failed</h1><p>${detail}</p></main></body></html>`;
+}
+/** Shared group-id parser over route input (number or decimal string). */
+function parseGroupIdFrom(input) {
+	if (typeof input === "number") return Number.isSafeInteger(input) && input > 0 ? input : undefined;
+	if (typeof input !== "string") return undefined;
+	if (!/^\d+$/.test(input)) return undefined;
+	const id = Number(input);
+	return Number.isSafeInteger(id) && id > 0 ? id : undefined;
+}
+function describeOwnedRoutes(section) {
+	const providers = section?.providers ?? {};
+	const routes = [];
+	for (const [route, profile] of Object.entries(providers)) {
+		if (!isOwnedRoute(route)) continue;
+		const models = profile?.models ?? [];
+		routes.push({
+			route,
+			displayName: profile?.displayName,
+			api: profile?.api,
+			models: models.length,
+			modelsPreview: models.slice(0, 20).map((model) => model.id)
+		});
+	}
+	return routes;
+}
+
+//#endregion
+//#region src/index.ts
+const name = "sub2api-sync";
+const inject = ["settings", "credentials"];
+function apply(ctx, config) {
+	const source = () => readConfig(config);
+	const judge = () => {
+		try {
+			validateConfig(source());
+		} catch (error) {
+			ctx.logger.error(error);
+		}
+	};
+	judge();
+	/** Conflict-retried write into the llm-pi-ai section (purge path mirrors
+	* the engine's conflict policy without touching its queue). */
+	const mutatePiAi = async (ops) => {
+		let attempts = 0;
+		for (;;) {
+			attempts++;
+			const revision = ctx.settings.describe().find((descriptor) => descriptor.ns === PI_AI_NS)?.revision;
+			if (revision === undefined) throw new Error("sub2api-sync: llm-pi-ai 设置条目未注册");
+			try {
+				await ctx.settings.mutate(PI_AI_NS, ops, revision);
+				return;
+			} catch (error) {
+				const shape = error;
+				const conflict = shape?.code === "SETTINGS_CONFLICT" || shape?.name === "SettingsConflictError";
+				if (conflict && attempts < 3) continue;
+				throw error;
+			}
+		}
+	};
+	const credentials = {
+		resolve: (ref) => ctx.credentials.resolve(credentialRef(ref)),
+		set: (ref, value) => ctx.credentials.set(credentialRef(ref), value),
+		unset: (ref) => ctx.credentials.unset(credentialRef(ref))
+	};
+	const reports = createSyncReportStore();
+	/**
+	* Purge this plugin's sync state: every owned provider route leaves the
+	* llm-pi-ai section and its relay-key credential is dropped. Logout,
+	* definitive auth loss, and instance switches all funnel here.
+	*/
+	const purgeSyncState = async () => {
+		reports.clear();
+		const section = ctx.settings.describe().find((descriptor) => descriptor.ns === PI_AI_NS)?.value;
+		const routes = describeOwnedRoutes(section).map((route) => route.route);
+		if (routes.length > 0) await mutatePiAi(routes.map((route) => ({
+			op: "unset",
+			path: ["providers", route]
+		})));
+		for (const route of routes) await credentials.unset(routeKeyRef(route)).catch(() => undefined);
+		await mutateOwn([{
+			op: "unset",
+			path: ["routeKeyIds"]
+		}]).catch(() => undefined);
+	};
+	/** Drop one instance's unreachable panel secrets (token/refresh/OAuth pair). */
+	const dropInstanceSecrets = async (baseURL) => {
+		for (const ref of [
+			panelTokenRef(baseURL),
+			panelRefreshRef(baseURL),
+			oauthTokenRef(baseURL),
+			oauthRefreshRef(baseURL)
+		]) await credentials.unset(ref).catch(() => undefined);
+	};
+	const gateway = new PanelGateway({
+		baseURL: () => source().baseURL?.trim() ?? "",
+		credentials,
+		onAuthLost: () => void purgeSyncState().catch(() => undefined)
+	});
+	const engine = new Sub2apiSyncEngine({
+		settings: ctx.settings,
+		credentials,
+		gateway,
+		siteName: () => instanceProbe.siteName(instance())
+	});
+	const ownRevision = () => ctx.settings.describe().find((descriptor) => descriptor.ns === OWN_NS)?.revision;
+	/** Conflict-retried write into this plugin's own section (best effort). */
+	const mutateOwn = async (ops) => {
+		let attempts = 0;
+		for (;;) {
+			attempts++;
+			const revision = ownRevision();
+			if (revision === undefined) throw new Error("sub2api-sync: 自身 settings 命名空间未注册");
+			try {
+				await ctx.settings.mutate(OWN_NS, ops, revision);
+				return;
+			} catch (error) {
+				const shape = error;
+				const conflict = shape?.code === "SETTINGS_CONFLICT" || shape?.name === "SettingsConflictError";
+				if (conflict && attempts < 3) continue;
+				throw error;
+			}
+		}
+	};
+	const instance = () => source().baseURL?.trim() ?? "";
+	const instanceProbe = createInstanceProbe();
+	const oauthAttempts = new OAuthAttemptStore();
+	const deps = {
+		instance,
+		authState: () => gateway.authState(source().email),
+		login: async (email, password) => {
+			let pwd = password;
+			if (pwd === undefined || pwd.length === 0) pwd = (await credentials.resolve(panelPasswordRef(instance())))?.value;
+			if (pwd === undefined || pwd.length === 0) throw new Error("请输入面板密码（首次登录后密码会保存到凭据存储，之后可免输入）");
+			if (password !== undefined && password.length > 0) await credentials.set(panelPasswordRef(instance()), password);
+			await mutateOwn([{
+				op: "set",
+				path: ["email"],
+				value: email
+			}]).catch(() => undefined);
+			const outcome = await gateway.login(email, pwd);
+			if (outcome.kind === "2fa") return {
+				ok: true,
+				kind: "2fa",
+				requires2FA: true
+			};
+			return {
+				ok: true,
+				kind: "ok"
+			};
+		},
+		login2FA: (code) => gateway.login2FA(code),
+		logout: async () => {
+			await gateway.logout();
+			await purgeSyncState().catch(() => undefined);
+		},
+		listGroups: async () => {
+			const groups = await gateway.use((panel, token) => panel.listAvailableGroups(token));
+			return groups.map((group) => ({
+				id: group.id,
+				name: group.name,
+				platform: group.platform,
+				status: group.status,
+				rateMultiplier: group.rateMultiplier,
+				isExclusive: group.isExclusive,
+				claudeCodeOnly: group.claudeCodeOnly,
+				enabled: false
+			}));
+		},
+		sync: async (keyIds) => {
+			const report = await engine.sync(source(), keyIds);
+			reports.record(report);
+			return report;
+		},
+		lastReport: () => reports.report(),
+		lastReportAt: () => reports.at(),
+		listKeys: async (page, pageSize) => {
+			const result = await gateway.use((panel, token) => panel.listKeys(token, {
+				page,
+				pageSize
+			}));
+			return {
+				keys: result.items.map((key) => ({
+					id: key.id,
+					name: key.name,
+					groupId: key.groupId,
+					...key.status !== undefined ? { status: key.status } : {}
+				})),
+				total: result.total,
+				pages: result.pages
+			};
+		},
+		createKey: async (input) => {
+			const config$1 = source();
+			const key = await gateway.use((panel, token) => panel.createKey(token, {
+				name: input.name,
+				groupId: input.groupId,
+				...config$1.keyQuota !== undefined ? { quota: config$1.keyQuota } : {},
+				...config$1.keyExpiresInDays !== undefined ? { expiresinDays: config$1.keyExpiresInDays } : {}
+			}));
+			const baseURL = config$1.baseURL?.trim() ?? "";
+			if (key.key !== undefined && key.key.length > 0 && !key.key.includes("****") && /^https?:\/\//i.test(baseURL)) await credentials.set(routeKeyRef(routeForKey(baseURL, key.id)), key.key).catch(() => undefined);
+			return {
+				id: key.id,
+				name: key.name,
+				groupId: key.groupId,
+				...key.status !== undefined ? { status: key.status } : {}
+			};
+		},
+		isSyncRunning: () => engine.isRunning(),
+		icon: () => instanceProbe.icon(instance()),
+		siteName: () => instanceProbe.siteName(instance()),
+		account: () => gateway.use((panel, token) => panel.getProfile(token)),
+		resetSync: async (previousBaseURL) => {
+			await purgeSyncState();
+			if (previousBaseURL !== undefined && previousBaseURL.trim().length > 0) await dropInstanceSecrets(previousBaseURL);
+		},
+		removeSyncedKey: async (keyId) => {
+			const baseURL = instance();
+			if (!/^https?:\/\//i.test(baseURL)) throw new Error("sub2api-sync: baseURL 未配置或不是 http(s) 地址");
+			const entry = reports.report()?.entries.find((candidate) => candidate.keyId === keyId && candidate.invalid !== true);
+			const route = entry?.route ?? routeForKey(baseURL, keyId);
+			if (!isOwnedRoute(route)) throw new Error(`sub2api-sync: 路由 ${route} 不在本插件的所有权边界内`);
+			await mutatePiAi([{
+				op: "unset",
+				path: ["providers", route]
+			}]);
+			await credentials.unset(routeKeyRef(route)).catch(() => undefined);
+			await mutateOwn([{
+				op: "unset",
+				path: ["routeKeyIds", route]
+			}]).catch(() => undefined);
+			const current = reports.report();
+			if (current !== undefined && current.entries.some((candidate) => candidate.route === route)) reports.record({
+				...current,
+				entries: current.entries.filter((candidate) => candidate.route !== route),
+				removed: [...current.removed, route],
+				writes: current.writes + 1
+			});
+		},
+		ownedRoutes: () => {
+			const descriptors = ctx.settings.describe();
+			const routes = describeOwnedRoutes(descriptors.find((descriptor) => descriptor.ns === PI_AI_NS)?.value);
+			const map = (descriptors.find((descriptor) => descriptor.ns === OWN_NS)?.value)?.routeKeyIds ?? {};
+			return routes.map((route) => map[route.route] !== undefined ? {
+				...route,
+				keyId: map[route.route]
+			} : route);
+		},
+		allowRemote: () => source().allowRemoteActions === true,
+		oauthProbe: async (address) => {
+			try {
+				await discoverOAuthEndpoints(address);
+				return true;
+			} catch {
+				resetDiscoveryCache();
+				return false;
+			}
+		},
+		oauthStart: async (callbackOrigin) => {
+			const instanceValue = instance();
+			if (!/^https?:\/\//i.test(instanceValue)) throw new Error("请先填写 sub2api 实例地址，再发起网页授权");
+			const redirectUri = loopbackCallbackOrigin(callbackOrigin);
+			const endpoints = await discoverOAuthEndpoints(instanceValue);
+			const { verifier, challenge } = await createPkcePair();
+			const attempt = oauthAttempts.create({
+				verifier,
+				redirectUri,
+				scope: oauthScopesFor(source().deleteOrphanKeys)
+			});
+			const authorizeUrl = buildAuthorizeUrl(endpoints, {
+				redirectUri,
+				scope: attempt.scope,
+				state: attempt.state,
+				challenge
+			});
+			return {
+				attemptId: attempt.id,
+				authorizeUrl
+			};
+		},
+		oauthCallback: async (query, lang = "zh") => {
+			const state = query.get("state") ?? "";
+			const attempt = state.length > 0 ? oauthAttempts.takeByState(state) : undefined;
+			if (attempt === undefined) return { html: callbackPageHtml("failure", "授权请求不存在、已过期或已被使用——请回到应用重新发起网页授权", lang) };
+			const providerError = query.get("error");
+			if (providerError !== null && providerError.length > 0) {
+				const description = query.get("error_description") ?? "";
+				oauthAttempts.settle(attempt.id, "failed", providerError);
+				return { html: callbackPageHtml("failure", `授权被拒绝（${providerError}）${description.length > 0 ? `：${description}` : ""}`, lang) };
+			}
+			const code = query.get("code") ?? "";
+			if (code.length === 0) {
+				oauthAttempts.settle(attempt.id, "failed", "回调缺少授权码");
+				return { html: callbackPageHtml("failure", "授权回调缺少授权码（code）——请回到应用重新发起", lang) };
+			}
+			try {
+				const endpoints = await discoverOAuthEndpoints(instance());
+				const pair = await exchangeAuthorizationCode(endpoints, {
+					code,
+					redirectUri: attempt.redirectUri,
+					verifier: attempt.verifier
+				});
+				await gateway.storeOAuthTokens(pair);
+				oauthAttempts.settle(attempt.id, "completed");
+				const successMessage = lang === "en" ? "You can close this page and return to the desktop app to continue." : "你可以关闭此页面，返回桌面端继续工作。";
+				return { html: callbackPageHtml("success", successMessage, lang) };
+			} catch (cause) {
+				const message = cause instanceof Error ? cause.message : String(cause);
+				oauthAttempts.settle(attempt.id, "failed", message);
+				return { html: callbackPageHtml("failure", message, lang) };
+			}
+		},
+		oauthStatus: async (attemptId) => {
+			const attempt = attemptId !== undefined ? oauthAttempts.peek(attemptId) : undefined;
+			const email = source().email;
+			return {
+				ok: true,
+				attempt,
+				auth: await gateway.authState(email)
+			};
+		},
+		oauthCancel: async (attemptId) => {
+			oauthAttempts.cancel(attemptId);
+		}
+	};
+	registerRoutes(ctx, deps);
+	let timer;
+	let armedFor;
+	const disarm = () => {
+		if (timer !== undefined) clearInterval(timer);
+		timer = undefined;
+		armedFor = undefined;
+	};
+	const arm = () => {
+		const interval = source().syncIntervalMs;
+		if (interval === undefined || interval < 6e4) {
+			disarm();
+			return;
+		}
+		if (armedFor === interval) return;
+		disarm();
+		timer = setInterval(() => {
+			if (engine.isRunning()) return;
+			void engine.sync(source()).catch((error) => ctx.logger.error(error));
+		}, interval);
+		armedFor = interval;
+	};
+	arm();
+	ctx.on("loader/volatile-update", () => {
+		judge();
+		arm();
+	});
+	ctx.effect(() => () => disarm());
+}
+
+//#endregion
+export { API_PROTOCOLS, Config, DEFAULT_PROVIDER_NAME_TEMPLATE, OAUTH_CALLBACK_PATH, OAUTH_CLIENT_ID, OAuthAttemptStore, OAuthError, OWN_NS, PI_AI_NS, PLATFORMS, PanelClient, PanelError, PanelGateway, ROUTES, SUB2API_RETRY_POLICY, Sub2apiSyncEngine, Sub2apiSyncError, apply, baseURLForProtocol, buildAuthorizeUrl, buildProviderProfile, callbackLangOf, callbackPageHtml, createPkcePair, discoverOAuthEndpoints, exchangeAuthorizationCode, guessPlatformFromModels, inject, instanceKey, isOwnedRoute, legacyKeyIdOfRoute, legacyKeyRef, loopbackCallbackOrigin, name, oauthRefreshRef, oauthScopesFor, oauthTokenRef, panelPasswordRef, panelRefreshRef, panelTokenRef, parseGroupId, protocolForPlatform, refreshAccessToken, renderProviderName, revokeToken, routeForKey, routeKeyRef, trustedRequest, validateConfig };