ai-fly 0.0.0 → 0.1.0

package/dist/sdk-C6xDRbzg.mjs

@@ -0,0 +1,394 @@
+import { z } from "zod";
+//#region src/wire/frames.ts
+const FRAME_TYPE = {
+	AUTH: 1,
+	AUTH_OK: 2,
+	AUTH_ERR: 3,
+	REQ: 4,
+	REQ_BODY: 5,
+	RESP_META: 6,
+	RESP_CHUNK: 7,
+	RESP_END: 8,
+	ERROR: 9,
+	ABORT: 10,
+	PING: 11,
+	DATA_UP: 12,
+	DATA_DOWN: 13,
+	CLOSE: 14
+};
+/** 类型号 → 名称（日志与误用报错用）。 */
+const FRAME_TYPE_NAME = {
+	[FRAME_TYPE.AUTH]: "AUTH",
+	[FRAME_TYPE.AUTH_OK]: "AUTH_OK",
+	[FRAME_TYPE.AUTH_ERR]: "AUTH_ERR",
+	[FRAME_TYPE.REQ]: "REQ",
+	[FRAME_TYPE.REQ_BODY]: "REQ_BODY",
+	[FRAME_TYPE.RESP_META]: "RESP_META",
+	[FRAME_TYPE.RESP_CHUNK]: "RESP_CHUNK",
+	[FRAME_TYPE.RESP_END]: "RESP_END",
+	[FRAME_TYPE.ERROR]: "ERROR",
+	[FRAME_TYPE.ABORT]: "ABORT",
+	[FRAME_TYPE.PING]: "PING",
+	[FRAME_TYPE.DATA_UP]: "DATA_UP",
+	[FRAME_TYPE.DATA_DOWN]: "DATA_DOWN",
+	[FRAME_TYPE.CLOSE]: "CLOSE"
+};
+function isKnownFrameType(type) {
+	return type in FRAME_TYPE_NAME;
+}
+const ERROR_CODE = {
+	aborted: "aborted",
+	buffer_overflow: "buffer_overflow",
+	idle_timeout: "idle_timeout",
+	unauthorized: "unauthorized",
+	key_all_invalid: "key_all_invalid",
+	unknown_service: "unknown_service",
+	path_not_offered: "path_not_offered",
+	upstream_unreachable: "upstream_unreachable",
+	upstream_status: "upstream_status",
+	secret_missing: "secret_missing",
+	body_too_large: "body_too_large",
+	rate_limited: "rate_limited",
+	quota_exceeded: "quota_exceeded",
+	forbidden_method: "forbidden_method",
+	forbidden_header: "forbidden_header",
+	protocol_version: "protocol_version",
+	protocol_seq: "protocol_seq",
+	protocol_error: "protocol_error",
+	internal: "internal"
+};
+/**
+* 仅 AUTH_OK.rejected 载荷码（spec 明确：这两个码不是 ERROR 帧码）；
+* 归档注释锚点：key_invalid / key_revoked 不得加入 ERROR_CODE。
+*/
+const REJECTED_CODE = {
+	key_invalid: "key_invalid",
+	key_revoked: "key_revoked"
+};
+/** 帧资源上限（spec「帧资源上限」：path / headers 项数 / 键值 / JSON 头总长）。 */
+const STRUCT_LIMITS = {
+	pathMaxBytes: 4096,
+	headersMaxCount: 32,
+	headerNameMaxBytes: 1024,
+	headerValueMaxBytes: 8192,
+	jsonHeaderMaxBytes: 16384
+};
+/** REQ.headers 禁止透传的凭据类 / 归属类头（双向零过桥；spec REQ 条款）。 */
+const FORBIDDEN_REQ_HEADER_NAMES = /* @__PURE__ */ new Set([
+	"authorization",
+	"proxy-authorization",
+	"cookie",
+	"host",
+	"content-type"
+]);
+/** RESP_META.headers 白名单子集（spec 响应下行条款）。 */
+const RESP_META_HEADER_WHITELIST = /* @__PURE__ */ new Set([
+	"x-request-id",
+	"retry-after",
+	"sec-websocket-accept"
+]);
+/** HTTP 方法枚举（REQ.method；越界字符串 → forbidden_method，非字符串 → protocol_error）。 */
+const HTTP_METHODS = [
+	"GET",
+	"HEAD",
+	"POST",
+	"PUT",
+	"PATCH",
+	"DELETE"
+];
+const TEXT_ENCODER = new TextEncoder();
+function byteLen(s) {
+	return TEXT_ENCODER.encode(s).length;
+}
+function isRecord(x) {
+	return typeof x === "object" && x !== null && !Array.isArray(x);
+}
+/** 标识字段（z32 形态：request-id 26 字符 / serviceId 13 / keyId 同族；上限宽松防滥用）。 */
+const Z_ID = z.string().min(1).max(128);
+/** 分片序号：非负整数（缺断/重复由 mux 的期望序号判定，schema 不设上界）。 */
+const Z_SEQ = z.number().int().min(0);
+/** contentType 形态：任意字符串，字节长受单值上限约束（与头值同规）。 */
+const Z_CONTENT_TYPE = z.string().refine((s) => byteLen(s) <= STRUCT_LIMITS.headerValueMaxBytes, { message: `contentType exceeds ${STRUCT_LIMITS.headerValueMaxBytes} bytes` });
+const REQ_PATH_SCHEMA = z.string().superRefine((p, ctx) => {
+	const add = (message) => ctx.addIssue({
+		code: "custom",
+		message,
+		path: ["path"]
+	});
+	if (byteLen(p) > STRUCT_LIMITS.pathMaxBytes) {
+		add(`path exceeds ${STRUCT_LIMITS.pathMaxBytes} bytes`);
+		return;
+	}
+	if (!p.startsWith("/")) {
+		add("path must start with a single '/'");
+		return;
+	}
+	if (p.startsWith("//") || p.startsWith("/\\")) {
+		add("path must not start with '//' or '/\\'");
+		return;
+	}
+	const pathPart = p.split("?", 1)[0];
+	if (pathPart.includes("://")) {
+		add("path must not contain a scheme");
+		return;
+	}
+	for (const seg of pathPart.split("/").slice(1)) if (seg === "." || seg === "..") {
+		add("path must not contain '.' or '..' segments");
+		return;
+	}
+});
+const REQ_HEADERS_SCHEMA = z.record(z.string(), z.string()).superRefine((headers, ctx) => {
+	const names = Object.keys(headers);
+	if (names.length > STRUCT_LIMITS.headersMaxCount) ctx.addIssue({
+		code: "custom",
+		message: `headers exceed ${STRUCT_LIMITS.headersMaxCount} entries`,
+		path: ["headers"]
+	});
+	for (const name of names) {
+		const value = headers[name];
+		if (FORBIDDEN_REQ_HEADER_NAMES.has(name)) {
+			ctx.addIssue({
+				code: "custom",
+				message: `forbidden header: ${name}`,
+				path: ["headers", name]
+			});
+			continue;
+		}
+		if (name !== name.toLowerCase()) ctx.addIssue({
+			code: "custom",
+			message: `header name not lowercase-normalized: ${name}`,
+			path: ["headers", name]
+		});
+		if (byteLen(name) > STRUCT_LIMITS.headerNameMaxBytes) ctx.addIssue({
+			code: "custom",
+			message: `header name exceeds ${STRUCT_LIMITS.headerNameMaxBytes} bytes`,
+			path: ["headers", name]
+		});
+		if (byteLen(value) > STRUCT_LIMITS.headerValueMaxBytes) ctx.addIssue({
+			code: "custom",
+			message: `header value exceeds ${STRUCT_LIMITS.headerValueMaxBytes} bytes`,
+			path: ["headers", name]
+		});
+	}
+});
+const RESP_META_HEADERS_SCHEMA = z.record(z.string(), z.string()).superRefine((headers, ctx) => {
+	const names = Object.keys(headers);
+	if (names.length > STRUCT_LIMITS.headersMaxCount) ctx.addIssue({
+		code: "custom",
+		message: `headers exceed ${STRUCT_LIMITS.headersMaxCount} entries`,
+		path: ["headers"]
+	});
+	for (const name of names) {
+		const value = headers[name];
+		if (!RESP_META_HEADER_WHITELIST.has(name)) {
+			ctx.addIssue({
+				code: "custom",
+				message: `response header not whitelisted: ${name}`,
+				path: ["headers", name]
+			});
+			continue;
+		}
+		if (byteLen(value) > STRUCT_LIMITS.headerValueMaxBytes) ctx.addIssue({
+			code: "custom",
+			message: `header value exceeds ${STRUCT_LIMITS.headerValueMaxBytes} bytes`,
+			path: ["headers", name]
+		});
+	}
+});
+/** match 展示集条目（exact / suffix / regex；纯展示元数据，运行时路由走 serviceId）。 */
+const SERVICE_MATCH_SCHEMA = z.strictObject({
+	type: z.enum([
+		"exact",
+		"suffix",
+		"regex"
+	]),
+	value: z.string().min(1).max(2048)
+});
+/** 服务完整配置的脱敏披露（$env 注入的头值仅显示 ●，变量名不显示）。 */
+const SERVICE_DETAIL_SCHEMA = z.strictObject({
+	upstream: z.string().min(1).max(2048),
+	match: z.array(SERVICE_MATCH_SCHEMA).max(64),
+	rewrite: z.strictObject({
+		host: z.string().min(1).max(2048).optional(),
+		prefix: z.string().min(1).max(2048).optional(),
+		headerSet: z.array(z.strictObject({
+			name: z.string().min(1).max(1024),
+			value: z.string().max(256)
+		})).max(32).optional()
+	}),
+	/** 路径路由披露（M3-r7：prefix/pattern 双模式；forms 为 AI 层标注，可为空）。 */
+	routes: z.array(z.strictObject({
+		forms: z.array(z.enum([
+			"openai-chat",
+			"openai-responses",
+			"anthropic"
+		])).max(3),
+		mode: z.enum(["prefix", "pattern"]).optional(),
+		localPrefix: z.string().max(2048).optional(),
+		upstreamPrefix: z.string().max(2048).optional(),
+		matchPattern: z.string().max(2048).optional(),
+		template: z.string().max(2048).optional()
+	})).max(4).optional()
+});
+const SERVICE_ENTRY_SCHEMA = z.strictObject({
+	serviceId: Z_ID,
+	name: z.string().min(1).max(256),
+	match: z.array(SERVICE_MATCH_SCHEMA).max(64),
+	defaultPort: z.number().int().min(1).max(65535),
+	detail: SERVICE_DETAIL_SCHEMA.optional()
+});
+const GROUP_ENTRY_SCHEMA = z.strictObject({
+	keyId: Z_ID,
+	group: z.string().min(1).max(256),
+	limits: z.strictObject({
+		maxConcurrency: z.number().int().min(1).optional(),
+		dailyRequests: z.number().int().min(1).optional()
+	}),
+	services: z.array(SERVICE_ENTRY_SCHEMA)
+});
+/** AUTH {v, keys[]}：钥环一次呈交（密钥格式细则归 §3 store，wire 层仅防明显垃圾）。 */
+const AUTH_HEADER_SCHEMA = z.strictObject({
+	v: z.literal(1),
+	keys: z.array(z.string().min(8).max(256)).min(1)
+});
+/**
+* AUTH_OK：目录全量载荷（初次授权与 refresh 推送同构；groups ≥1——全无效走 AUTH_ERR）。
+*/
+const AUTH_OK_HEADER_SCHEMA = z.strictObject({
+	v: z.literal(1),
+	alias: z.string().min(1).max(256),
+	relayUrls: z.array(z.string().min(1).max(2048)),
+	groups: z.array(GROUP_ENTRY_SCHEMA).min(1),
+	rejected: z.array(z.strictObject({ code: z.enum([REJECTED_CODE.key_invalid, REJECTED_CODE.key_revoked]) })).max(64).optional(),
+	refresh: z.literal(true).optional()
+});
+/** AUTH_ERR：全部密钥无效（单次即断，由 §3 引擎层执行断开）。 */
+const AUTH_ERR_HEADER_SCHEMA = z.strictObject({
+	v: z.literal(1),
+	code: z.literal(ERROR_CODE.key_all_invalid),
+	message: z.string().max(2048).optional()
+});
+/** REQ {v,id,serviceId,method,path,headers?,contentType?,bodyLen}：body 内联或空。 */
+const REQ_HEADER_SCHEMA = z.strictObject({
+	v: z.literal(1),
+	id: Z_ID,
+	serviceId: Z_ID,
+	method: z.enum(HTTP_METHODS),
+	path: REQ_PATH_SCHEMA,
+	headers: REQ_HEADERS_SCHEMA.optional(),
+	contentType: Z_CONTENT_TYPE.optional(),
+	bodyLen: z.number().int().min(0).max(2 ** 32)
+});
+/** REQ_BODY {id,seq,end}：正文分片续帧（seq 从 0 递增）。 */
+const REQ_BODY_HEADER_SCHEMA = z.strictObject({
+	id: Z_ID,
+	seq: Z_SEQ,
+	end: z.boolean()
+});
+/** RESP_META {id,status,contentType,headers?}：响应元信息（WS 101 时含 accept 头）。 */
+const RESP_META_HEADER_SCHEMA = z.strictObject({
+	id: Z_ID,
+	status: z.number().int().min(100).max(599),
+	contentType: Z_CONTENT_TYPE,
+	headers: RESP_META_HEADERS_SCHEMA.optional()
+});
+/** RESP_CHUNK {id,seq}：响应字节分片。 */
+const RESP_CHUNK_HEADER_SCHEMA = z.strictObject({
+	id: Z_ID,
+	seq: Z_SEQ
+});
+/** RESP_END {id}：成功终结。 */
+const RESP_END_HEADER_SCHEMA = z.strictObject({ id: Z_ID });
+/** ERROR {id?,code,message}：id 可得时携带；message 脱敏（不含密钥与上游凭据）。 */
+const ERROR_HEADER_SCHEMA = z.strictObject({
+	id: Z_ID.optional(),
+	code: z.enum([
+		ERROR_CODE.aborted,
+		ERROR_CODE.buffer_overflow,
+		ERROR_CODE.idle_timeout,
+		ERROR_CODE.unauthorized,
+		ERROR_CODE.key_all_invalid,
+		ERROR_CODE.unknown_service,
+		ERROR_CODE.path_not_offered,
+		ERROR_CODE.upstream_unreachable,
+		ERROR_CODE.upstream_status,
+		ERROR_CODE.secret_missing,
+		ERROR_CODE.body_too_large,
+		ERROR_CODE.rate_limited,
+		ERROR_CODE.quota_exceeded,
+		ERROR_CODE.forbidden_method,
+		ERROR_CODE.forbidden_header,
+		ERROR_CODE.protocol_version,
+		ERROR_CODE.protocol_seq,
+		ERROR_CODE.protocol_error,
+		ERROR_CODE.internal
+	]),
+	message: z.string()
+});
+/** ABORT {id}：使用方本地中止信号（提供方回 ERROR(aborted) 终结）。 */
+const ABORT_HEADER_SCHEMA = z.strictObject({ id: Z_ID });
+/** PING {id}：首字节等待期心跳（提供方 → 使用方，每 30s）。 */
+const PING_HEADER_SCHEMA = z.strictObject({ id: Z_ID });
+/** DATA_UP / DATA_DOWN {v,id,seq}：WS 双向原始字节分片（spec WS 条款字面含 v）。 */
+const DATA_HEADER_SCHEMA = z.strictObject({
+	v: z.literal(1),
+	id: Z_ID,
+	seq: Z_SEQ
+});
+/** CLOSE {id,code?}：WS 终结帧（语义同 RESP_END）。 */
+const CLOSE_HEADER_SCHEMA = z.strictObject({
+	id: Z_ID,
+	code: z.number().int().min(1e3).max(65535).optional()
+});
+/** 类型号 → 头 schema 注册表（mux 入站校验入口）。 */
+const FRAME_HEADER_SCHEMAS = {
+	[FRAME_TYPE.AUTH]: AUTH_HEADER_SCHEMA,
+	[FRAME_TYPE.AUTH_OK]: AUTH_OK_HEADER_SCHEMA,
+	[FRAME_TYPE.AUTH_ERR]: AUTH_ERR_HEADER_SCHEMA,
+	[FRAME_TYPE.REQ]: REQ_HEADER_SCHEMA,
+	[FRAME_TYPE.REQ_BODY]: REQ_BODY_HEADER_SCHEMA,
+	[FRAME_TYPE.RESP_META]: RESP_META_HEADER_SCHEMA,
+	[FRAME_TYPE.RESP_CHUNK]: RESP_CHUNK_HEADER_SCHEMA,
+	[FRAME_TYPE.RESP_END]: RESP_END_HEADER_SCHEMA,
+	[FRAME_TYPE.ERROR]: ERROR_HEADER_SCHEMA,
+	[FRAME_TYPE.ABORT]: ABORT_HEADER_SCHEMA,
+	[FRAME_TYPE.PING]: PING_HEADER_SCHEMA,
+	[FRAME_TYPE.DATA_UP]: DATA_HEADER_SCHEMA,
+	[FRAME_TYPE.DATA_DOWN]: DATA_HEADER_SCHEMA,
+	[FRAME_TYPE.CLOSE]: CLOSE_HEADER_SCHEMA
+};
+/**
+* 依据原始输入对 schema 失败做语义分类：
+* - REQ.method 为字符串但越界 → forbidden_method；非字符串 → protocol_error；
+* - REQ.headers 命中凭据类头（大小写不敏感）→ forbidden_header；
+* - 其余（未知字段、类型非法、path 形态、结构超限、版本字面量）→ protocol_error。
+* 注意：protocol_version 不在此处产生——JSON 头中 v≠1 由 codec 层先行拦截。
+*/
+function classifySchemaFailure(frameType, input) {
+	let id;
+	if (isRecord(input) && typeof input.id === "string") id = input.id;
+	if (isRecord(input) && frameType === FRAME_TYPE.REQ) {
+		const method = input.method;
+		if (typeof method === "string" && !HTTP_METHODS.includes(method)) return withId({ code: "forbidden_method" }, id);
+		const headers = input.headers;
+		if (isRecord(headers)) {
+			for (const key of Object.keys(headers)) if (FORBIDDEN_REQ_HEADER_NAMES.has(key) || FORBIDDEN_REQ_HEADER_NAMES.has(key.toLowerCase())) return withId({ code: "forbidden_header" }, id);
+		}
+	}
+	return withId({ code: "protocol_error" }, id);
+}
+function withId(fail, id) {
+	if (id !== void 0) fail.id = id;
+	return fail;
+}
+//#endregion
+//#region src/sdk.ts
+async function loadSdk() {
+	const candidate = await import("@jixo/opendweb-client-sdk");
+	if (typeof candidate.Fabric === "function") return candidate;
+	const def = candidate.default;
+	if (def !== void 0 && typeof def.Fabric === "function") return def;
+	throw new Error("error: @jixo/opendweb-client-sdk export shape unexpected (no Fabric via named or default interop)");
+}
+//#endregion
+export { FRAME_TYPE as a, REJECTED_CODE as c, classifySchemaFailure as d, isKnownFrameType as f, FRAME_HEADER_SCHEMAS as i, RESP_META_HEADER_WHITELIST as l, ERROR_CODE as n, FRAME_TYPE_NAME as o, FORBIDDEN_REQ_HEADER_NAMES as r, HTTP_METHODS as s, loadSdk as t, SERVICE_ENTRY_SCHEMA as u };