@tool-bridge/server 0.3.0 → 0.4.0

package/dist/{airtable-V6446SVY.js → airtable-K3I4W27V.js}

@@ -1,14 +1,16 @@
 import {
   createProviderPlugin,
-  guardedFetch,
   requireApiKey,
   upstreamError
-} from "./chunk-CSJEZHQO.js";
-import "./chunk-K7FVSFUX.js";
+} from "./chunk-TKKRVFMK.js";
+import {
+  guardedFetch
+} from "./chunk-CYTI7JDJ.js";
+import "./chunk-XE34TXY6.js";
 import {
   TBError,
   external_exports
-} from "./chunk-JLTYA2B3.js";
+} from "./chunk-F4O6ZRH7.js";
 import "./chunk-MLKGABMK.js";
 
 // ../plugins/src/airtable/api.ts

package/dist/{alt_text_generator_ai-HV7JZPDT.js → alt_text_generator_ai-NE5YYNW3.js}

@@ -1,14 +1,16 @@
 import {
   createProviderPlugin,
-  guardedFetch,
   requireApiKey,
   upstreamError
-} from "./chunk-CSJEZHQO.js";
-import "./chunk-K7FVSFUX.js";
+} from "./chunk-TKKRVFMK.js";
+import {
+  guardedFetch
+} from "./chunk-CYTI7JDJ.js";
+import "./chunk-XE34TXY6.js";
 import {
   TBError,
   external_exports
-} from "./chunk-JLTYA2B3.js";
+} from "./chunk-F4O6ZRH7.js";
 import "./chunk-MLKGABMK.js";
 
 // ../plugins/src/alt_text_generator_ai/schema.ts

package/dist/{amap-TTTVB6WS.js → amap-C2Y347XH.js}

@@ -1,14 +1,16 @@
 import {
   createProviderPlugin,
-  guardedFetch,
   requireApiKey,
   upstreamError
-} from "./chunk-CSJEZHQO.js";
-import "./chunk-K7FVSFUX.js";
+} from "./chunk-TKKRVFMK.js";
+import {
+  guardedFetch
+} from "./chunk-CYTI7JDJ.js";
+import "./chunk-XE34TXY6.js";
 import {
   TBError,
   external_exports
-} from "./chunk-JLTYA2B3.js";
+} from "./chunk-F4O6ZRH7.js";
 import "./chunk-MLKGABMK.js";
 
 // ../plugins/src/amap/api.ts

package/dist/{anthropic-JH3RA363.js → anthropic-HEEOKRI7.js}

@@ -1,14 +1,16 @@
 import {
   createProviderPlugin,
-  guardedFetch,
   requireApiKey,
   upstreamError
-} from "./chunk-CSJEZHQO.js";
-import "./chunk-K7FVSFUX.js";
+} from "./chunk-TKKRVFMK.js";
+import {
+  guardedFetch
+} from "./chunk-CYTI7JDJ.js";
+import "./chunk-XE34TXY6.js";
 import {
   TBError,
   external_exports
-} from "./chunk-JLTYA2B3.js";
+} from "./chunk-F4O6ZRH7.js";
 import "./chunk-MLKGABMK.js";
 
 // ../plugins/src/anthropic/api.ts

package/dist/{apify-ETNN7ITU.js → apify-4SCWADEP.js}

@@ -1,14 +1,16 @@
 import {
   createProviderPlugin,
-  guardedFetch,
   requireApiKey,
   upstreamError
-} from "./chunk-CSJEZHQO.js";
-import "./chunk-K7FVSFUX.js";
+} from "./chunk-TKKRVFMK.js";
+import {
+  guardedFetch
+} from "./chunk-CYTI7JDJ.js";
+import "./chunk-XE34TXY6.js";
 import {
   TBError,
   external_exports
-} from "./chunk-JLTYA2B3.js";
+} from "./chunk-F4O6ZRH7.js";
 import "./chunk-MLKGABMK.js";
 
 // ../plugins/src/apify/api.ts

package/dist/{brave_search-3DDR2MMB.js → brave_search-UDLPBEMQ.js}

@@ -1,14 +1,16 @@
 import {
   createProviderPlugin,
-  guardedFetch,
   requireApiKey,
   upstreamError
-} from "./chunk-CSJEZHQO.js";
-import "./chunk-K7FVSFUX.js";
+} from "./chunk-TKKRVFMK.js";
+import {
+  guardedFetch
+} from "./chunk-CYTI7JDJ.js";
+import "./chunk-XE34TXY6.js";
 import {
   TBError,
   external_exports
-} from "./chunk-JLTYA2B3.js";
+} from "./chunk-F4O6ZRH7.js";
 import "./chunk-MLKGABMK.js";
 
 // ../plugins/src/brave_search/api.ts

package/dist/{chunk-CSJEZHQO.js → chunk-CYTI7JDJ.js}

@@ -1,80 +1,6 @@
-import {
-  createPlugin
-} from "./chunk-K7FVSFUX.js";
 import {
   TBError
-} from "./chunk-JLTYA2B3.js";
-
-// ../plugins/src/_runtime/plugin.ts
-function requireApiKey(ctx, service) {
-  const key = ctx.upstreamAuth;
-  if (key === void 0 || key === "") {
-    throw new TBError(
-      "unavailable",
-      `${service} \u9700\u8981 API key:\u7ED9\u6302\u8F7D\u8282\u70B9\u914D config.authRef \u6307\u5411\u5DF2\u5B58\u5165 system/secret \u7684\u51ED\u8BC1`
-    );
-  }
-  return key;
-}
-function requireCredential(ctx, service, field) {
-  const values = ctx.credentials;
-  if (values === void 0) {
-    throw new TBError(
-      "unavailable",
-      `${service} \u9700\u8981\u591A\u5B57\u6BB5\u51ED\u8BC1:\u7ED9\u6302\u8F7D\u8282\u70B9\u914D config.authRef \u6307\u5411\u5DF2\u5B58\u5165 system/secret \u7684\u51ED\u8BC1(\u7528 \`tb secret set <name> --field ...\` \u5199\u5165)`
-    );
-  }
-  const value = values[field];
-  if (value === void 0 || value === "") {
-    throw new TBError("internal", `${service} \u7684\u51ED\u8BC1\u5B57\u6BB5 '${field}' \u672A\u5728 credentialFields \u91CC\u58F0\u660E`);
-  }
-  return value;
-}
-function createProviderPlugin(input) {
-  const names = Object.keys(input.actions);
-  const handlerNames = Object.keys(input.handlers);
-  const missing = names.filter((name) => !handlerNames.includes(name));
-  const extra = handlerNames.filter((name) => !names.includes(name));
-  if (missing.length > 0 || extra.length > 0) {
-    throw new Error(
-      `action \u8868\u4E0E handler \u8868\u4E0D\u543B\u5408:\u7F3A handler [${missing.join(", ")}];\u591A\u4F59 handler [${extra.join(", ")}]`
-    );
-  }
-  const plugin = createPlugin({ token: (env) => env.PLUGIN_TOKEN });
-  const tools = plugin.tools(input.exportId ?? "actions", { description: input.description });
-  if (input.oauth !== void 0) tools.oauth(input.oauth);
-  if (input.credentialFields !== void 0) tools.credentials(input.credentialFields);
-  for (const name of names) {
-    tools.register(name, input.actions[name], (args, ctx) => input.handlers[name](args, {
-      upstreamAuth: ctx.upstreamAuth,
-      credentials: ctx.credentials,
-      config: ctx.mountConfig
-    }));
-  }
-  if (input.credentialProbe !== void 0) {
-    const effect = input.actions[input.credentialProbe]?.effect;
-    if (effect !== "read") {
-      throw new Error(
-        `credentialProbe '${input.credentialProbe}' \u7684 effect \u662F '${effect ?? "\u672A\u58F0\u660E"}', \u63A2\u9488\u5FC5\u987B\u662F read \u2014\u2014 \u6302\u8F7D\u65F6\u4F1A\u771F\u5B9E\u8C03\u7528\u5B83`
-      );
-    }
-    tools.probeCredentialWith(input.credentialProbe);
-  }
-  return plugin;
-}
-
-// ../plugins/src/_runtime/upstreamError.ts
-function upstreamError(status, message) {
-  if (status === 401) {
-    return new TBError("permission_denied", message, { httpStatus: 401 });
-  }
-  if (status === 403) return new TBError("permission_denied", message);
-  if (status === 404) return new TBError("not_found", message);
-  if (status === 409) return new TBError("conflict", message);
-  if (status === 429) return new TBError("rate_limited", message, { retryable: true });
-  if (status >= 500) return new TBError("unavailable", message, { retryable: true });
-  return new TBError("invalid_argument", message);
-}
+} from "./chunk-F4O6ZRH7.js";
 
 // ../plugins/src/_runtime/ipPolicy.ts
 function parseIpv4(value) {
@@ -186,10 +112,10 @@ var CROSS_ORIGIN_STRIPPED_HEADERS = [
 function looksLikeCredentialHeader(name) {
   return /(?:^|-)(?:api[-_]?key|key|token|secret|auth)(?:$|-)/i.test(name);
 }
-function stripCredentials(headers) {
+function stripCredentials(headers, sensitiveHeaders) {
   const next = new Headers(headers);
   for (const [name] of headers) {
-    if (CROSS_ORIGIN_STRIPPED_HEADERS.includes(name.toLowerCase()) || looksLikeCredentialHeader(name)) {
+    if (CROSS_ORIGIN_STRIPPED_HEADERS.includes(name.toLowerCase()) || looksLikeCredentialHeader(name) || sensitiveHeaders.has(name.toLowerCase())) {
       next.delete(name);
     }
   }
@@ -219,7 +145,11 @@ function assertPublicHttpUrl(value) {
   return url;
 }
 function createGuardedFetch(options = {}) {
+  const crossOriginRedirect = options.crossOriginRedirect ?? "follow";
   const maxRedirects = options.maxRedirects ?? MAX_REDIRECTS;
+  const sensitiveHeaders = new Set(
+    (options.sensitiveHeaders ?? []).map((name) => name.toLowerCase())
+  );
   return async function guardedFetch2(input, init) {
     const transport = options.fetch ?? globalThis.fetch;
     const initial = input instanceof Request ? input.url : String(input);
@@ -234,7 +164,11 @@ function createGuardedFetch(options = {}) {
       }
       const previousOrigin = new URL(request.url).origin;
       url = assertPublicHttpUrl(new URL(location, url));
-      const headers = url.origin === previousOrigin ? request.headers : stripCredentials(request.headers);
+      const crossesOrigin = url.origin !== previousOrigin;
+      if (crossesOrigin && crossOriginRedirect === "error") {
+        throw new EgressBlockedError("\u643A\u5E26\u654F\u611F\u4FE1\u606F\u7684\u51FA\u7AD9\u8BF7\u6C42\u4E0D\u5141\u8BB8\u8DE8\u6E90\u91CD\u5B9A\u5411");
+      }
+      const headers = !crossesOrigin ? request.headers : stripCredentials(request.headers, sensitiveHeaders);
       const downgrade = response.status === 303 || (response.status === 301 || response.status === 302) && request.method !== "GET";
       request = downgrade ? new Request(url, { method: "GET", headers, redirect: "manual" }) : new Request(url, { ...request, headers, redirect: "manual" });
     }
@@ -243,10 +177,7 @@ function createGuardedFetch(options = {}) {
 var guardedFetch = createGuardedFetch();
 
 export {
-  requireApiKey,
-  requireCredential,
-  createProviderPlugin,
-  upstreamError,
   assertPublicHttpUrl,
+  createGuardedFetch,
   guardedFetch
 };

package/dist/{chunk-JLTYA2B3.js → chunk-F4O6ZRH7.js}

@@ -15083,23 +15083,53 @@ var NODE_KIND_BY_PROFILE = {
   "tools/v1": "tool",
   "context/v1": "context"
 };
+function projectExportAuth(exported) {
+  if (exported.oauth !== void 0) return { kind: "oauth" };
+  if (exported.credentialFields !== void 0) {
+    return { kind: "fields", fields: exported.credentialFields };
+  }
+  if (exported.auth?.kind === "none") return { kind: "none" };
+  return {
+    kind: "single",
+    // 兼容旧 descriptor:未显式声明 auth 时沿用“单值但可留空”。
+    required: exported.auth?.required ?? false,
+    ...exported.auth?.label !== void 0 ? { label: exported.auth.label } : {},
+    ...exported.auth?.description !== void 0 ? { description: exported.auth.description } : {}
+  };
+}
 function projectListItem(entry) {
   const exports = entry.describe.exports;
   const kinds = /* @__PURE__ */ new Set();
+  const exportKinds = {};
+  const exportDetails = {};
   for (const e of exports) {
     const kind = NODE_KIND_BY_PROFILE[e.profile];
-    if (kind !== void 0) kinds.add(kind);
+    if (kind !== void 0) {
+      kinds.add(kind);
+      exportKinds[e.id] = kind;
+      exportDetails[e.id] = {
+        id: e.id,
+        kind,
+        auth: projectExportAuth(e),
+        ...e.description !== void 0 ? { description: e.description } : {},
+        ...e.mountConfigFields !== void 0 ? { mountConfigFields: e.mountConfigFields } : {}
+      };
+    }
   }
   const withFields = exports.find((e) => e.credentialFields !== void 0);
+  const withMountConfig = exports.find((e) => e.mountConfigFields !== void 0);
   const description = exports.find((e) => e.description !== void 0)?.description;
   return {
     id: entry.id,
     digest: entry.digest,
     exports: exports.map((e) => e.id),
+    exportKinds,
+    exportDetails,
     nodeKinds: [...kinds].sort(),
     needsOAuth: exports.some((e) => e.oauth !== void 0),
     ...description !== void 0 ? { description } : {},
-    ...withFields?.credentialFields !== void 0 ? { credentialFields: withFields.credentialFields } : {}
+    ...withFields?.credentialFields !== void 0 ? { credentialFields: withFields.credentialFields } : {},
+    ...withMountConfig?.mountConfigFields !== void 0 ? { mountConfigFields: withMountConfig.mountConfigFields } : {}
   };
 }
 function matches2(item, query) {
@@ -15396,6 +15426,15 @@ function optionalMethodsForCapabilities(capabilities) {
   return methods;
 }
 var EXPORT_ID_RE = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+var exportAuthSchema = external_exports.discriminatedUnion("kind", [
+  external_exports.object({ kind: external_exports.literal("none") }),
+  external_exports.object({
+    kind: external_exports.literal("single"),
+    description: external_exports.string().optional(),
+    label: external_exports.string().optional(),
+    required: external_exports.boolean().optional()
+  })
+]);
 var exportSchema = external_exports.object({
   id: external_exports.string().regex(EXPORT_ID_RE, "export id \u987B\u4E3A [A-Za-z0-9._-] \u4E14\u4E0D\u4EE5\u6807\u70B9\u5F00\u5934"),
   profile: external_exports.enum(PLUGIN_PROFILES),
@@ -15403,17 +15442,19 @@ var exportSchema = external_exports.object({
   /** context/v1:实际提供的动词;tools/v1 由运行时 List 发现,可省。 */
   methods: external_exports.array(external_exports.string()).optional(),
   capabilities: external_exports.array(external_exports.string()).optional(),
+  /** export 的单值/无凭证声明;多字段与 OAuth 继续由各自字段表达。 */
+  auth: exportAuthSchema.optional(),
   /**
    * tools/v1 可选:一个**只读、零副作用、无必填入参**的工具名,平台在挂载时拿它做一次
    * 真实调用来验证 `authRef` 指向的凭证可用(见 `credentialProbe` 的类型注释)。
    */
   credentialProbe: external_exports.string().optional(),
   /**
-   * 多字段凭证的字段声明(仅 tools/v1)。声明了它,平台就知道该 secret 存的是一个 JSON
+   * 多字段凭证的字段声明(tools/v1)。声明了它,平台就知道该 secret 存的是一个 JSON
    * 对象而非单值,并在挂载时校验字段齐全 —— 见 `credentialFields` 的类型注释。
    */
   /**
-   * provider 型 OAuth2 的声明(仅 tools/v1)。声明了它,平台就托管授权码流程:
+   * provider 型 OAuth2 的声明(tools/v1)。声明了它,平台就托管授权码流程:
    * `POST /<path>/~authorize` 发起、回调兑换、调用时自动刷新,插件只拿到 access token。
    */
   oauth: pluginOAuthSchema.optional(),
@@ -15424,6 +15465,17 @@ var exportSchema = external_exports.object({
     required: external_exports.boolean().optional(),
     /** 敏感字段:管理面不回显、日志不打印。缺省按敏感处理(fail safe)。 */
     secret: external_exports.boolean().optional()
+  })).min(1).optional(),
+  /**
+   * 非凭证的挂载配置字段(如 baseUrl / instanceUrl / region)。声明了它,平台就知道
+   * 该 export 挂载时还需要哪些 `providerConfig`,管理面据此渲染带标签的输入框而不是让
+   * 用户对着一个自由 k=v 框猜 —— 见 `mountConfigFields` 的类型注释。
+   */
+  mountConfigFields: external_exports.array(external_exports.object({
+    key: external_exports.string().regex(/^[A-Za-z_][\w]*$/, "\u5B57\u6BB5\u540D\u987B\u4E3A\u5408\u6CD5\u6807\u8BC6\u7B26"),
+    label: external_exports.string().optional(),
+    description: external_exports.string().optional(),
+    required: external_exports.boolean().optional()
   })).min(1).optional()
 });
 var describeSchema = external_exports.object({
@@ -15453,6 +15505,20 @@ function validatePluginContract(input) {
       throw new TBError("invalid_argument", `plugin '${manifest.id}' \u7684 export id \u91CD\u590D:'${exported.id}'`);
     }
     seen.add(exported.id);
+    if (exported.auth !== void 0) {
+      if (exported.oauth !== void 0 || exported.credentialFields !== void 0) {
+        throw new TBError(
+          "invalid_argument",
+          `plugin '${manifest.id}' export '${exported.id}' \u7684 auth \u4E0D\u80FD\u4E0E oauth/credentialFields \u540C\u65F6\u58F0\u660E`
+        );
+      }
+      if (exported.auth.kind === "none" && exported.credentialProbe !== void 0) {
+        throw new TBError(
+          "invalid_argument",
+          `plugin '${manifest.id}' export '${exported.id}' \u58F0\u660E auth:none,\u4E0D\u80FD\u518D\u58F0\u660E credentialProbe`
+        );
+      }
+    }
     if (exported.credentialProbe !== void 0 && exported.profile !== "tools/v1") {
       throw new TBError(
         "invalid_argument",
@@ -15497,6 +15563,18 @@ function validatePluginContract(input) {
         keys.add(field.key);
       }
     }
+    if (exported.mountConfigFields !== void 0) {
+      const keys = /* @__PURE__ */ new Set();
+      for (const field of exported.mountConfigFields) {
+        if (keys.has(field.key)) {
+          throw new TBError(
+            "invalid_argument",
+            `plugin '${manifest.id}' export '${exported.id}' \u7684 mountConfigFields \u6709\u91CD\u590D\u5B57\u6BB5 '${field.key}'`
+          );
+        }
+        keys.add(field.key);
+      }
+    }
     if (exported.profile === "context/v1") {
       const known = new Set(CONTEXT_METHODS);
       const unknown2 = (exported.methods ?? []).filter((m) => !known.has(m));

package/dist/{chunk-KGYJEEBI.js → chunk-OKQUN7BC.js}

@@ -130,7 +130,7 @@ import {
   url,
   validatePath,
   virtualizeTools
-} from "./chunk-JLTYA2B3.js";
+} from "./chunk-F4O6ZRH7.js";
 
 // src/config.ts
 var DEFAULT_PORT = 8787;
@@ -650,53 +650,6 @@ function createS3ObjectStore(cfg, opts) {
   };
 }
 
-// ../app/src/deviceNodes.ts
-function tbErrorFromBody(body) {
-  return new TBError(body.code, body.message, { retryable: body.retryable });
-}
-function requireDevice(deps) {
-  if (deps.device === void 0) {
-    throw TBError.unimplemented("device capability disabled: no device transport");
-  }
-  return deps.device;
-}
-async function invokeDevice(deps, deviceId, req) {
-  const id = crypto.randomUUID();
-  const body = await requireDevice(deps).invoke(deviceId, { id, ...req });
-  if (!body || !("ok" in body)) {
-    throw new TBError("unavailable", "device session returned invalid result");
-  }
-  if (body.ok) return body.value;
-  throw tbErrorFromBody(body.error);
-}
-function deviceMarkerOf(pc) {
-  if (pc === void 0 || typeof pc.deviceId !== "string" || typeof pc.mountPath !== "string") {
-    return null;
-  }
-  return {
-    deviceId: pc.deviceId,
-    mountPath: pc.mountPath,
-    ...Array.isArray(pc.cmds) ? { cmds: pc.cmds } : {}
-  };
-}
-function deviceToolMarker(node) {
-  if (node.kind !== "tool" || node.config?.kind !== "tool") return null;
-  return deviceMarkerOf(node.config.providerConfig);
-}
-function relativeDevicePath(nodePath, mountPath) {
-  if (nodePath.startsWith(`${mountPath}/`)) return nodePath.slice(mountPath.length + 1);
-  throw new TBError("invalid_argument", `device \u8282\u70B9 '${nodePath}' \u4E0D\u5728\u6302\u8F7D '${mountPath}' \u4E0B`);
-}
-function assertNoDeviceMarker(config) {
-  const pc = config.providerConfig;
-  if (pc !== null && typeof pc === "object" && deviceMarkerOf(pc) !== null) {
-    throw new TBError(
-      "invalid_argument",
-      "providerConfig \u7684 device \u8F6C\u53D1\u6807\u8BB0\u7531\u7F51\u5173\u4EE3\u5199,\u4E0D\u5F97\u7ECF\u6CE8\u518C\u9762\u643A\u5E26"
-    );
-  }
-}
-
 // ../app/src/providers/toolCache.ts
 var KEY_PREFIX = "toolcache:";
 function toolCacheKey(path) {
@@ -992,6 +945,53 @@ var SearchSynchronizer = class {
 // ../app/src/deps.ts
 var TOOL_CACHE_TTL_DEFAULT = 300;
 
+// ../app/src/deviceNodes.ts
+function tbErrorFromBody(body) {
+  return new TBError(body.code, body.message, { retryable: body.retryable });
+}
+function requireDevice(deps) {
+  if (deps.device === void 0) {
+    throw TBError.unimplemented("device capability disabled: no device transport");
+  }
+  return deps.device;
+}
+async function invokeDevice(deps, deviceId, req) {
+  const id = crypto.randomUUID();
+  const body = await requireDevice(deps).invoke(deviceId, { id, ...req });
+  if (!body || !("ok" in body)) {
+    throw new TBError("unavailable", "device session returned invalid result");
+  }
+  if (body.ok) return body.value;
+  throw tbErrorFromBody(body.error);
+}
+function deviceMarkerOf(pc) {
+  if (pc === void 0 || typeof pc.deviceId !== "string" || typeof pc.mountPath !== "string") {
+    return null;
+  }
+  return {
+    deviceId: pc.deviceId,
+    mountPath: pc.mountPath,
+    ...Array.isArray(pc.cmds) ? { cmds: pc.cmds } : {}
+  };
+}
+function deviceToolMarker(node) {
+  if (node.kind !== "tool" || node.config?.kind !== "tool") return null;
+  return deviceMarkerOf(node.config.providerConfig);
+}
+function relativeDevicePath(nodePath, mountPath) {
+  if (nodePath.startsWith(`${mountPath}/`)) return nodePath.slice(mountPath.length + 1);
+  throw new TBError("invalid_argument", `device \u8282\u70B9 '${nodePath}' \u4E0D\u5728\u6302\u8F7D '${mountPath}' \u4E0B`);
+}
+function assertNoDeviceMarker(config) {
+  const pc = config.providerConfig;
+  if (pc !== null && typeof pc === "object" && deviceMarkerOf(pc) !== null) {
+    throw new TBError(
+      "invalid_argument",
+      "providerConfig \u7684 device \u8F6C\u53D1\u6807\u8BB0\u7531\u7F51\u5173\u4EE3\u5199,\u4E0D\u5F97\u7ECF\u6CE8\u518C\u9762\u643A\u5E26"
+    );
+  }
+}
+
 // ../app/src/providers/http.ts
 function toSpec(t) {
   const spec = { name: t.name, description: t.description, effect: effectFor(t) };
@@ -19265,6 +19265,47 @@ function mountCallContext(ctx, mountPath, providerConfig, exportId) {
     ...exportId !== void 0 ? { exportId } : {}
   };
 }
+async function assertPluginMountContract(exported, config, deps) {
+  const providerConfig = config.providerConfig ?? {};
+  const missingConfig = (exported.mountConfigFields ?? []).filter((field) => {
+    if (field.required !== true) return false;
+    const value = providerConfig[field.key];
+    return value === void 0 || value === null || typeof value === "string" && value.trim() === "";
+  }).map((field) => field.key);
+  if (missingConfig.length > 0) {
+    throw new TBError(
+      "invalid_argument",
+      `plugin export '${exported.id}' \u7F3A\u5C11\u5FC5\u586B providerConfig:${missingConfig.join(", ")}`
+    );
+  }
+  const authRef = typeof config.authRef === "string" && config.authRef.trim() !== "" ? config.authRef.trim() : void 0;
+  if (exported.auth?.kind === "none") {
+    if (authRef !== void 0) {
+      throw new TBError(
+        "invalid_argument",
+        `plugin export '${exported.id}' \u58F0\u660E auth:none,\u4E0D\u5F97\u7ED1\u5B9A authRef`
+      );
+    }
+    return;
+  }
+  const requiresAuth = exported.oauth !== void 0 || exported.credentialFields !== void 0 || exported.auth?.kind === "single" && exported.auth.required === true;
+  if (requiresAuth && authRef === void 0) {
+    throw new TBError(
+      "invalid_argument",
+      `plugin export '${exported.id}' \u9700\u8981 authRef`
+    );
+  }
+  if (authRef === void 0) return;
+  const raw = await deps.secrets.resolve(authRef);
+  if (raw === void 0) {
+    throw new TBError("invalid_argument", `secret '${authRef}' \u4E0D\u5B58\u5728\u6216\u65E0\u6CD5\u89E3\u5BC6`);
+  }
+  if (exported.credentialFields !== void 0) {
+    parseCredentialValues(raw, exported.credentialFields);
+  } else if (exported.oauth !== void 0) {
+    parseCredentialValues(raw, [...OAUTH_CLIENT_FIELDS]);
+  }
+}
 async function providerAccessTokenFor(opts) {
   const encryptionKey = opts.deps.encryptionKey;
   if (encryptionKey === void 0) {
@@ -19452,13 +19493,11 @@ async function assertToolConfig(config, deps, ctx, mountPath) {
     typeof exportId === "string" ? exportId : void 0
   );
   const authRef = config.authRef;
-  if (exported.credentialFields !== void 0 && typeof authRef === "string") {
-    const raw = await deps.secrets.resolve(authRef);
-    if (raw === void 0) {
-      throw new TBError("invalid_argument", `secret '${authRef}' \u4E0D\u5B58\u5728\u6216\u65E0\u6CD5\u89E3\u5BC6`);
-    }
-    parseCredentialValues(raw, exported.credentialFields);
-  }
+  await assertPluginMountContract(
+    exported,
+    config,
+    deps
+  );
   if (exported.credentialProbe === void 0 || typeof authRef !== "string" || ctx === void 0 || mountPath === void 0 || exported.oauth !== void 0) {
     return;
   }
@@ -19713,7 +19752,14 @@ async function assertContextConfig(config, deps) {
   assertNoDeviceMarker(config);
   const cfg = config;
   if (cfg.provider !== "r2" && cfg.provider !== "s3") {
-    await requirePluginExport(deps, cfg.provider, "context", "context", cfg.export);
+    const { export: exported } = await requirePluginExport(
+      deps,
+      cfg.provider,
+      "context",
+      "context",
+      cfg.export
+    );
+    await assertPluginMountContract(exported, cfg, deps);
     return;
   }
   if (cfg.provider === "s3") {
@@ -38291,7 +38337,7 @@ import { join as join4 } from "path";
 // package.json
 var package_default = {
   name: "@tool-bridge/server",
-  version: "0.3.0",
+  version: "0.4.0",
   description: "tool-bridge self-hosted server: run the HTBP gateway on Node with SQLite persistence, filesystem object storage and WebSocket device channel \u2014 single container via docker run",
   type: "module",
   license: "MIT",