ai-fly 0.1.1 → 0.3.0-alpha.2

package/dist/models-dev-2UfQoIpQ.mjs

@@ -0,0 +1,244 @@
+import { t as PRESET_SCHEMA } from "./rpc-contract-5qyWzT5t.mjs";
+import { mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+import { z } from "zod";
+//#region presets/providers.json
+var providers_default = {
+	version: 1,
+	providers: [
+		{
+			"id": "openai",
+			"label": "OpenAI",
+			"apiForm": "openai-completions",
+			"baseUrl": "https://api.openai.com",
+			"keyEnv": "OPENAI_API_KEY",
+			"defaultPort": 4300,
+			"matchDomains": ["api.openai.com"],
+			"routes": [{
+				"forms": ["openai-chat", "openai-responses"],
+				"localPrefix": "/v1",
+				"upstreamPrefix": "/v1"
+			}],
+			"notes": "Official OpenAI API: chat completions + responses under /v1. $env injection expects the full header value, e.g. OPENAI_API_KEY='Bearer <key>'.",
+			"source": "https://models.dev/api.json (@ai-sdk/openai default base URL)"
+		},
+		{
+			"id": "anthropic",
+			"label": "Anthropic (Claude)",
+			"apiForm": "anthropic-messages",
+			"baseUrl": "https://api.anthropic.com",
+			"keyEnv": "ANTHROPIC_API_KEY",
+			"defaultPort": 4301,
+			"matchDomains": ["api.anthropic.com"],
+			"routes": [{
+				"forms": ["anthropic"],
+				"localPrefix": "/v1",
+				"upstreamPrefix": "/v1"
+			}],
+			"notes": "Anthropic Messages API (Claude models). Also the protocol claude-code speaks natively.",
+			"source": "https://models.dev/api.json (@ai-sdk/anthropic default base URL)"
+		},
+		{
+			"id": "deepseek",
+			"label": "DeepSeek",
+			"apiForm": "openai-completions",
+			"baseUrl": "https://api.deepseek.com",
+			"keyEnv": "DEEPSEEK_API_KEY",
+			"defaultPort": 4304,
+			"matchDomains": ["api.deepseek.com"],
+			"routes": [{
+				"forms": ["openai-chat", "openai-responses"],
+				"localPrefix": "/v1",
+				"upstreamPrefix": "/v1"
+			}, {
+				"forms": ["anthropic"],
+				"localPrefix": "/anthropic",
+				"upstreamPrefix": "/anthropic"
+			}],
+			"notes": "OpenAI-compatible at /v1/* (chat completions + responses, codex-ready); Anthropic-compatible surface at /anthropic/* (per vendor docs).",
+			"source": "https://models.dev/api.json + https://api-docs.deepseek.com/guides/anthropic_api"
+		}
+	]
+};
+//#endregion
+//#region presets/models-dev.ts
+/** models.dev api.json 地址（spec 点名）。 */
+const MODELS_DEV_API_URL = "https://models.dev/api.json";
+/** 缓存路径（默认 ~/.aifly/cache/models-dev.json；测试注入）。 */
+function modelsDevCachePath(base = homedir()) {
+	return join(base, ".aifly", "cache", "models-dev.json");
+}
+const CURATED_FILE_SCHEMA = z.strictObject({
+	version: z.literal(1),
+	providers: z.array(PRESET_SCHEMA).min(1)
+});
+/** 精选预设（模块加载即校验；仓库内数据损坏应 fail-fast 而非静默降级）。 */
+function loadCuratedPresets() {
+	return CURATED_FILE_SCHEMA.parse(providers_default).providers;
+}
+/** api.json 中 provider 级条目的最小投影（防御性：多余字段忽略）。 */
+const API_JSON_PROVIDER_SCHEMA = z.object({
+	id: z.string().min(1).max(128),
+	name: z.string().max(256).optional(),
+	/** 显式 base URL（SDK 缺省时缺失——长尾只收录显式 api 的条目）。 */
+	api: z.string().max(2048).optional(),
+	/** 惯用 env 名列表（取首个）。 */
+	env: z.array(z.string().max(256)).max(16).optional(),
+	/** npm 包名（apiForm 归类依据）。 */
+	npm: z.string().max(256).optional(),
+	/** provider 级模型清单（模型/价格 spec：至少 id 与 cost.input/output；缺失视为未知价）。 */
+	models: z.record(z.string().min(1).max(256), z.object({
+		id: z.string().min(1).max(256).optional(),
+		name: z.string().max(512).optional(),
+		cost: z.object({
+			input: z.number().nonnegative().optional(),
+			output: z.number().nonnegative().optional()
+		}).optional()
+	}).passthrough()).optional()
+});
+const API_JSON_SCHEMA = z.record(z.string(), API_JSON_PROVIDER_SCHEMA);
+/** 缓存文件形状：原始 api.json 文本 + 抓取时间。 */
+const CACHE_FILE_SCHEMA = z.strictObject({
+	fetchedAt: z.number().int().min(0),
+	raw: z.string().min(2)
+});
+/**
+* npm 包名 → apiForm 归类（spec：npm 含 openai-compatible→openai-completions、
+* anthropic→anthropic-messages、google→gemini-native、其它归 openai-completions
+* 并标 unverified）。
+*/
+function classifyApiForm(npm) {
+	const pkg = npm ?? "";
+	if (pkg.includes("anthropic")) return {
+		apiForm: "anthropic-messages",
+		unverified: false
+	};
+	if (pkg.includes("google")) return {
+		apiForm: "gemini-native",
+		unverified: false
+	};
+	if (pkg.includes("openai")) return {
+		apiForm: "openai-completions",
+		unverified: false
+	};
+	return {
+		apiForm: "openai-completions",
+		unverified: true
+	};
+}
+/** 长尾 defaultPort：id 的 FNV-1a 哈希映射到 20000..64999（确定性；监听期冲突由端口回退兜底）。 */
+function derivedPortFor(id) {
+	let hash = 2166136261;
+	for (const byte of Buffer.from(id, "utf8")) {
+		hash ^= byte;
+		hash = Math.imul(hash, 16777619) >>> 0;
+	}
+	return 2e4 + hash % 45e3;
+}
+/** 从 api.json 原始文本派生长尾预设（跳过无显式 api 的条目；排除精选集已覆盖的 id）。 */
+function deriveModelsDevPresets(raw, curatedIds) {
+	const parsed = JSON.parse(raw);
+	const providers = API_JSON_SCHEMA.parse(parsed);
+	const out = [];
+	for (const [id, provider] of Object.entries(providers)) {
+		if (provider.api === void 0 || provider.api === "") continue;
+		if (curatedIds.has(id)) continue;
+		if (!/^https?:\/\//.test(provider.api)) continue;
+		const { apiForm, unverified } = classifyApiForm(provider.npm);
+		let host;
+		try {
+			host = new URL(provider.api).hostname;
+		} catch {
+			continue;
+		}
+		const keyEnv = provider.env?.[0];
+		out.push(PRESET_SCHEMA.parse({
+			id,
+			label: provider.name && provider.name !== "" ? provider.name : id,
+			apiForm,
+			baseUrl: provider.api,
+			...keyEnv !== void 0 ? { keyEnv } : {},
+			defaultPort: derivedPortFor(id),
+			matchDomains: [host],
+			source: "models.dev",
+			...unverified ? { unverified: true } : {}
+		}));
+	}
+	return out;
+}
+/** 读取并校验缓存（损坏/不存在返回 undefined）。 */
+function readCache(cachePath) {
+	try {
+		return CACHE_FILE_SCHEMA.parse(JSON.parse(readFileSync(cachePath, "utf8")));
+	} catch {
+		return;
+	}
+}
+/** 原子写缓存（失败静默：缓存写失败不致命）。 */
+function writeCache(cachePath, raw, fetchedAt) {
+	try {
+		mkdirSync(dirname(cachePath), { recursive: true });
+		const tmp = `${cachePath}.tmp-${process.pid.toString(36)}-${Date.now().toString(36)}`;
+		writeFileSync(tmp, `${JSON.stringify({
+			fetchedAt,
+			raw
+		}, void 0, 2)}\n`);
+		renameSync(tmp, cachePath);
+	} catch {}
+}
+/**
+* 取原始 api.json（presets.models 与长尾派生共用的数据面）：TTL 内直接回缓存；
+* 过期/未命中先刷新，失败回退缓存并附错误说明（spec：缓存未命中或已过期时
+* SHALL 先尝试刷新，失败回退缓存）。
+*/
+async function fetchModelsDevRaw(opts = {}) {
+	const now = opts.now ?? Date.now;
+	const cachePath = opts.cachePath ?? modelsDevCachePath();
+	const doFetch = opts.fetchImpl ?? fetch;
+	const cached = readCache(cachePath);
+	if (!opts.force && cached !== void 0 && now() - cached.fetchedAt < 6048e5) return {
+		raw: cached.raw,
+		origin: "cache"
+	};
+	try {
+		const response = await doFetch(MODELS_DEV_API_URL, { headers: { accept: "application/json" } });
+		if (!response.ok) throw new Error(`HTTP ${response.status}`);
+		const raw = await response.text();
+		JSON.parse(raw);
+		writeCache(cachePath, raw, now());
+		return {
+			raw,
+			origin: "fetch"
+		};
+	} catch (err) {
+		const message = err instanceof Error ? err.message : String(err);
+		if (cached !== void 0) return {
+			raw: cached.raw,
+			origin: "cache",
+			error: `fetch failed (${message}); serving cached copy`
+		};
+		return {
+			raw: void 0,
+			origin: "cache",
+			error: `fetch failed (${message}) and no cache available`
+		};
+	}
+}
+/** 拉取（或回退缓存）models.dev 长尾。失败且无可用缓存时返回 error 结果（不抛）。 */
+async function fetchModelsDevPresets(curated, opts = {}) {
+	const result = await fetchModelsDevRaw(opts);
+	const curatedIds = new Set(curated.map((p) => p.id));
+	if (result.raw === void 0) return {
+		presets: [],
+		origin: "cache",
+		...result.error !== void 0 ? { error: result.error } : {}
+	};
+	return {
+		presets: deriveModelsDevPresets(result.raw, curatedIds),
+		origin: result.origin,
+		...result.error !== void 0 ? { error: result.error } : {}
+	};
+}
+//#endregion
+export { loadCuratedPresets as n, modelsDevCachePath as r, fetchModelsDevPresets as t };

package/dist/{mux-xHl9Jrbi.mjs → mux-CS1zhF4W.mjs}

@@ -1,5 +1,5 @@
-import { i as randomZ32 } from "./config-CO3WyW2H.mjs";
-import { a as FRAME_TYPE, d as classifySchemaFailure, f as isKnownFrameType, i as FRAME_HEADER_SCHEMAS, n as ERROR_CODE, o as FRAME_TYPE_NAME } from "./sdk-C6xDRbzg.mjs";
+import { s as randomZ32 } from "./rpc-contract-5qyWzT5t.mjs";
+import { a as FRAME_TYPE_NAME, d as isKnownFrameType, i as FRAME_TYPE, r as FRAME_HEADER_SCHEMAS, t as ERROR_CODE, u as classifySchemaFailure } from "./frames-BDqvhB2Y.mjs";
 //#region src/wire/codec.ts
 const WIRE_MAGIC_PREFIX = "aifly";
 const WIRE_MAGIC = "aifly1";

package/dist/{ports-BQukx7wS.mjs → ports-rRppuBgo.mjs}

@@ -1,6 +1,7 @@
 import { n as UsageError } from "./errors-BGtxPkM7.mjs";
-import { o as parseArgv } from "./config-CO3WyW2H.mjs";
-import { c as consumersRoot, n as ctxHomedir, p as listKeyrings, r as ctxOut, y as setPort } from "./common-4VeA_3wo.mjs";
+import { n as parseArgv } from "./args-CSxXW9eD.mjs";
+import { n as consumersRoot, p as setPort, s as listKeyrings } from "./store-BiTS2FTl.mjs";
+import { n as ctxHomedir, r as ctxOut } from "./common-CgxCXeTt.mjs";
 import { i as validatePortArg, n as desiredPortFor } from "./ports-pI59MtmI.mjs";
 import { homedir } from "node:os";
 //#region src/cli/commands/consumer/ports.ts

package/dist/presets-C73CAMZ6.mjs

@@ -0,0 +1,55 @@
+import { n as UsageError, r as reportCliError } from "./errors-BGtxPkM7.mjs";
+import { n as parseArgv } from "./args-CSxXW9eD.mjs";
+import { t as loadSettings } from "./settings-C1Hb4zwd.mjs";
+import { n as loadCuratedPresets, r as modelsDevCachePath, t as fetchModelsDevPresets } from "./models-dev-2UfQoIpQ.mjs";
+import { homedir } from "node:os";
+//#region src/cli/commands/provider/presets.ts
+const SPEC = { json: { type: "boolean" } };
+async function run(argv, ctx = {}) {
+	try {
+		const home = ctx.homedir ?? homedir();
+		const { options, positionals } = parseArgv(argv, SPEC, { homedir: home });
+		if (positionals.length > 1) throw new UsageError(`error: unexpected argument '${positionals[1]}'`);
+		const query = (positionals[0] ?? "").toLowerCase();
+		const curated = loadCuratedPresets();
+		const settings = loadSettings(home);
+		let longTail = [];
+		let note = "";
+		if (settings.modelsDevEnabled) try {
+			const result = await fetchModelsDevPresets(curated, { cachePath: modelsDevCachePath(home) });
+			if (result.error !== void 0) note = result.error;
+			longTail = result.presets;
+		} catch {
+			note = "models.dev expansion unavailable (offline?)";
+		}
+		else note = "models.dev expansion disabled in settings";
+		const featuredIds = new Set(curated.map((preset) => preset.id));
+		const longTailOnly = longTail.filter((preset) => !featuredIds.has(preset.id));
+		const all = [...curated, ...longTailOnly];
+		const hits = query === "" ? all : all.filter((preset) => `${preset.id} ${preset.label}`.toLowerCase().includes(query));
+		if (options.json === true) {
+			process.stdout.write(`${JSON.stringify(hits.map((p) => ({
+				id: p.id,
+				label: p.label,
+				baseUrl: p.baseUrl,
+				defaultPort: p.defaultPort
+			})), null, 2)}\n`);
+			return 0;
+		}
+		const out = (line) => {
+			process.stdout.write(`${line}\n`);
+		};
+		out(`presets (${hits.length}${query === "" ? "" : ` matching '${positionals[0]}'`})`);
+		for (const preset of hits) {
+			const badge = featuredIds.has(preset.id) ? "featured" : "long-tail";
+			out(`  ${preset.id.padEnd(24)} ${preset.label}  ${preset.baseUrl}  :${preset.defaultPort}  [${badge}]`);
+		}
+		if (note !== "") out(note);
+		out(`use: ai-fly service add <name> --preset <id>`);
+		return 0;
+	} catch (err) {
+		return reportCliError(err);
+	}
+}
+//#endregion
+export { run };

package/dist/proxy-D7VMUVEg.mjs

@@ -0,0 +1,21 @@
+import { n as UsageError } from "./errors-BGtxPkM7.mjs";
+//#region src/sdk.ts
+async function loadSdk() {
+	const candidate = await import("@jixo/opendweb-client-sdk");
+	if (typeof candidate.Fabric === "function") return candidate;
+	const def = candidate.default;
+	if (def !== void 0 && typeof def.Fabric === "function") return def;
+	throw new Error("error: @jixo/opendweb-client-sdk export shape unexpected (no Fabric via named or default interop)");
+}
+//#endregion
+//#region src/cli/proxy.ts
+function resolveHttpProxy(flag, env = process.env.AIFLY_PROXY) {
+	const spec = flag ?? env;
+	if (spec === void 0 || spec === "") return void 0;
+	if (spec === "none") return "none";
+	if (spec === "env") return "from-env";
+	if (!/^https?:\/\//i.test(spec)) throw new UsageError(`error: --proxy expects an http(s):// URL, 'env' or 'none' (got '${spec}')`);
+	return { url: spec };
+}
+//#endregion
+export { loadSdk as n, resolveHttpProxy as t };

package/dist/{revoke-CyrOzc8t.mjs → revoke-CkpvK33Q.mjs}

@@ -1,7 +1,8 @@
 import { n as UsageError, r as reportCliError } from "./errors-BGtxPkM7.mjs";
-import { o as parseArgv } from "./config-CO3WyW2H.mjs";
-import { d as str, l as resolveDataDir, u as resolvedRelayUrls } from "./common-BULbPtYn.mjs";
-import { t as openExistingFabric } from "./serve-DuyQMeJh.mjs";
+import { n as parseArgv } from "./args-CSxXW9eD.mjs";
+import { t as resolveHttpProxy } from "./proxy-D7VMUVEg.mjs";
+import { d as str, l as resolveDataDir, u as resolvedRelayUrls } from "./common-CqxqIg6D.mjs";
+import { t as openExistingFabric } from "./serve-Be4zdKVj.mjs";
 import { homedir } from "node:os";
 //#region src/cli/commands/provider/revoke.ts
 const SPEC = {
@@ -20,7 +21,7 @@ async function run(argv, ctx = {}) {
 		if (endpointId === void 0 || endpointId === "") throw new UsageError("error: revoke requires an <endpointId> argument");
 		if (positionals.length > 1) throw new UsageError(`error: unexpected argument '${positionals[1]}'`);
 		const dataDir = resolveDataDir(str(options.data), home);
-		fabric = await openExistingFabric(dataDir, resolvedRelayUrls(options, home));
+		fabric = await openExistingFabric(dataDir, resolvedRelayUrls(options, home), resolveHttpProxy(void 0));
 		await fabric.revoke(endpointId);
 		process.stdout.write(`member revoked: ${endpointId}\n`);
 		return 0;

package/dist/rewrite-xZHWnyJk.mjs

@@ -0,0 +1,313 @@
+import { a as routeLocalPrefix } from "./rpc-contract-5qyWzT5t.mjs";
+import { n as FORBIDDEN_REQ_HEADER_NAMES } from "./frames-BDqvhB2Y.mjs";
+import { a as parseUpstreamUrl, c as matchRequestPath, o as expandUriTemplate, s as compileMatchPattern } from "./store-CrTUwskE.mjs";
+const ENV_REF_PREFIX = "$env:";
+/** $secret 引用前缀（密钥库名；与 $env 同样按引用整体掩码）。 */
+const SECRET_REF_PREFIX = "$secret:";
+function isEnvRef(value) {
+	return value.startsWith(ENV_REF_PREFIX);
+}
+function isSecretRef(value) {
+	return value.startsWith(SECRET_REF_PREFIX);
+}
+/** 引用型头值（$env:/$secret:）——披露时统一掩码（名与值都不出）。 */
+function isMaskedRef(value) {
+	return isEnvRef(value) || isSecretRef(value);
+}
+/** 前缀重写规则的披露形态：strip:/a 与 append:/b 的组合标记。 */
+function prefixDisclosure(service) {
+	const rewrite = service.rewrite;
+	if (rewrite === void 0) return void 0;
+	const tokens = [];
+	if (rewrite.pathPrefixStrip !== void 0) tokens.push(`strip:${rewrite.pathPrefixStrip}`);
+	if (rewrite.pathPrefixAppend !== void 0) tokens.push(`append:${rewrite.pathPrefixAppend}`);
+	return tokens.length === 0 ? void 0 : tokens.join(" ");
+}
+/** 服务完整配置的脱敏披露（$env 头值 -> ●，变量名不显示）。 */
+function buildServiceDetail(service) {
+	const rewrite = {};
+	if (service.rewrite !== void 0) {
+		if (service.rewrite.hostHeader !== void 0) rewrite.host = service.rewrite.hostHeader;
+		const prefix = prefixDisclosure(service);
+		if (prefix !== void 0) rewrite.prefix = prefix;
+		if (service.rewrite.headerSet !== void 0) rewrite.headerSet = Object.entries(service.rewrite.headerSet).map(([name, value]) => ({
+			name,
+			value: isMaskedRef(value) ? "●" : value
+		}));
+	}
+	return {
+		upstream: service.upstream,
+		match: service.match.map((m) => ({
+			type: m.type,
+			value: m.value
+		})),
+		rewrite,
+		...service.routes !== void 0 && service.routes.length > 0 ? { routes: service.routes.map((r) => r.mode === "pattern" ? {
+			forms: r.forms,
+			mode: "pattern",
+			matchPattern: r.matchPattern,
+			template: r.template
+		} : {
+			forms: r.forms,
+			localPrefix: routeLocalPrefix(r),
+			upstreamPrefix: r.upstreamPrefix ?? ""
+		}) } : {}
+	};
+}
+/** 目录服务条目（含 detail 脱敏披露）。 */
+function buildServiceEntry(service) {
+	return {
+		serviceId: service.serviceId,
+		name: service.name,
+		match: service.match.map((m) => ({
+			type: m.type,
+			value: m.value
+		})),
+		defaultPort: service.defaultPort,
+		detail: buildServiceDetail(service)
+	};
+}
+/**
+* detail 的 ASCII 展示形（CLI status --verbose 用；用户面文案码位 < 128，故 ●
+* 在终端侧替换为 <hidden>——$env 与 $secret 掩码同形，无法区分，用中性词）。
+*/
+function detailDisplayLines(detail) {
+	const lines = [`upstream: ${detail.upstream}`];
+	for (const m of detail.match) lines.push(`match: ${m.type} ${m.value}`);
+	for (const r of detail.routes ?? []) {
+		const forms = r.forms.length > 0 ? ` (${r.forms.join("+")})` : "";
+		if (r.mode === "pattern") lines.push(`route: ${r.matchPattern} => ${r.template}${forms}`);
+		else {
+			const to = r.upstreamPrefix === "" ? "(root)" : r.upstreamPrefix;
+			lines.push(`route: ${r.localPrefix} -> ${to}${forms}`);
+		}
+	}
+	if (detail.rewrite !== void 0) {
+		const r = detail.rewrite;
+		if (r.host !== void 0) lines.push(`host: ${r.host}`);
+		if (r.prefix !== void 0) lines.push(`prefix: ${r.prefix}`);
+		for (const h of r.headerSet ?? []) lines.push(`header-set: ${h.name}: ${h.value === "●" ? "<hidden>" : h.value}`);
+	}
+	return lines;
+}
+//#endregion
+//#region src/provider/rewrite.ts
+/** 拼接/断言失败（protocol_error 语义）。 */
+var RewriteError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "RewriteError";
+	}
+};
+/**
+* 服务声明了路由表但请求路径未命中任何标准前缀（path_not_offered 语义，
+* 消费侧映射 404）：只转发声明的 API 标准面——防 /user、/balance 等
+* 个人信息端点被提供方凭据打穿（Owner 2026-09-10 裁决：路由表即白名单）。
+*/
+var PathNotOfferedError = class extends Error {
+	constructor() {
+		super("path is not offered by this service");
+		this.name = "PathNotOfferedError";
+	}
+};
+/**
+* `$secret:<name>` 引用未命中（secret_missing 语义）：该请求以 ERROR(secret_missing)
+* 拒绝。message 固定——MUST NOT 包含密钥名与值（错误帧会过网）。
+*/
+var SecretMissingError = class extends Error {
+	constructor() {
+		super("referenced secret is missing");
+		this.name = "SecretMissingError";
+	}
+};
+/**
+* 头值解析：literal 原样；`$secret:<name>` 优先于 `$env:` 判定——命中密钥库返回
+* 完整值，未命中（含空名/空值/未注入密钥源）抛 SecretMissingError（不回退空值、
+* 不省略该头）；`$env:<VAR>` 语义保持——空串/未设置返回 undefined（= 省略该头）。
+* 两者可并存于不同头（逐头独立解析）。
+*/
+function resolveHeaderValue(value, env, secrets) {
+	if (value.startsWith("$secret:")) {
+		const name = value.slice(8);
+		const resolved = secrets?.(name);
+		if (resolved === void 0 || resolved === "") throw new SecretMissingError();
+		return resolved;
+	}
+	if (!value.startsWith("$env:")) return value;
+	const name = value.slice(5);
+	if (name === "") return void 0;
+	const resolved = env[name];
+	return resolved === void 0 || resolved === "" ? void 0 : resolved;
+}
+/** 服务声明的全部 $env 变量名（启动横幅 WARNING 用）。 */
+function collectEnvVarNames(service) {
+	const names = /* @__PURE__ */ new Set();
+	const headerSet = service.rewrite?.headerSet;
+	if (headerSet === void 0) return [];
+	for (const value of Object.values(headerSet)) if (value.startsWith("$env:")) {
+		const name = value.slice(5);
+		if (name !== "") names.add(name);
+	}
+	return [...names];
+}
+/** HTTP hop-by-hop / 传输层自管头（普通 HTTP 转发路径剥离；WS 路径另行挑选）。 */
+const HOP_BY_HOP_HEADER_NAMES = /* @__PURE__ */ new Set([
+	"connection",
+	"keep-alive",
+	"proxy-connection",
+	"transfer-encoding",
+	"te",
+	"trailer",
+	"upgrade"
+]);
+/** 帧内头防御性剥离集合（wire schema 已拒绝；此处纵深防御）。 */
+const DEFENSIVE_STRIP = /* @__PURE__ */ new Set([
+	...FORBIDDEN_REQ_HEADER_NAMES,
+	...HOP_BY_HOP_HEADER_NAMES,
+	"content-length"
+]);
+/** 点段规范化（".", ".." 解析；不越出根，前缀断言兜底）。 */
+function normalizeDotSegments(path) {
+	const out = [];
+	for (const seg of path.split("/")) {
+		if (seg === "." || seg === "") continue;
+		if (seg === "..") {
+			out.pop();
+			continue;
+		}
+		out.push(seg);
+	}
+	return `/${out.join("/")}`;
+}
+function splitQuery(raw) {
+	const idx = raw.indexOf("?");
+	return idx < 0 ? {
+		path: raw,
+		query: ""
+	} : {
+		path: raw.slice(0, idx),
+		query: raw.slice(idx + 1)
+	};
+}
+/** 查询值解码（畸形序列原样保留；模板会重新编码）。 */
+function safeDecode(value) {
+	try {
+		return decodeURIComponent(value.replace(/\+/g, "%20"));
+	} catch {
+		return value;
+	}
+}
+/** 查询串 → 变量表（pattern 模板变量域；同名捕获组优先覆盖）。 */
+function parseQueryVars(query) {
+	const vars = {};
+	if (query === "") return vars;
+	for (const pair of query.split("&")) {
+		const eq = pair.indexOf("=");
+		if (eq < 0) {
+			if (pair !== "") vars[pair] = "";
+			continue;
+		}
+		vars[pair.slice(0, eq)] = safeDecode(pair.slice(eq + 1));
+	}
+	return vars;
+}
+/** 帧内 path 的纵深防御检查（schema 层已拒；双保险）。 */
+function assertFramePathShape(path) {
+	if (!path.startsWith("/") || path.startsWith("//") || path.startsWith("/\\")) throw new RewriteError("request path must start with a single '/'");
+	if (path.includes("\\")) throw new RewriteError("request path must not contain backslash");
+	const pathPart = splitQuery(path).path;
+	if (pathPart.includes("://")) throw new RewriteError("request path must not contain a scheme");
+	for (const seg of pathPart.split("/").slice(1)) if (seg === "." || seg === "..") throw new RewriteError("request path must not contain '.' or '..' segments");
+}
+/** connection 头 token 列表包含 upgrade 且 upgrade 头为 websocket（大小写不敏感）。 */
+function isWebSocketUpgradeRequest(headers) {
+	const connection = headers["connection"];
+	const upgrade = headers["upgrade"];
+	if (connection === void 0 || upgrade === void 0) return false;
+	return connection.split(",").map((t) => t.trim().toLowerCase()).includes("upgrade") && upgrade.trim().toLowerCase() === "websocket";
+}
+function buildUpstreamRequest(service, req, env = process.env, secrets) {
+	const upstream = parseUpstreamUrl(service.upstream);
+	assertFramePathShape(req.path);
+	const split = splitQuery(req.path);
+	let requestPath = split.path;
+	let query = split.query;
+	if (service.routes !== void 0 && service.routes.length > 0) {
+		let matched = false;
+		for (const route of service.routes) {
+			if (route.mode === "pattern") {
+				const groups = matchRequestPath(compileMatchPattern(route.matchPattern), requestPath, query);
+				if (groups === null) continue;
+				const vars = {
+					...parseQueryVars(query),
+					...groups
+				};
+				const assembled = expandUriTemplate(route.template, vars);
+				const qIdx = assembled.indexOf("?");
+				if (qIdx >= 0) {
+					requestPath = assembled.slice(0, qIdx);
+					query = assembled.slice(qIdx + 1);
+				} else requestPath = assembled;
+				matched = true;
+				break;
+			}
+			const local = routeLocalPrefix(route);
+			if (!(requestPath === local || requestPath.startsWith(local + "/"))) continue;
+			const rest = requestPath.slice(local.length);
+			const up = route.upstreamPrefix ?? "";
+			requestPath = rest === "" ? up === "" ? "/" : up : `${up}${rest}`;
+			matched = true;
+			break;
+		}
+		if (!matched) throw new PathNotOfferedError();
+	}
+	const strip = service.rewrite?.pathPrefixStrip;
+	if (strip !== void 0 && (requestPath === strip || requestPath.startsWith(strip + "/"))) {
+		requestPath = requestPath.slice(strip.length);
+		if (requestPath === "") requestPath = "/";
+	}
+	const append = service.rewrite?.pathPrefixAppend;
+	if (append !== void 0) {
+		const appendNormalized = normalizeDotSegments(append).replace(/\/+$/, "");
+		if (appendNormalized !== "") requestPath = appendNormalized + (requestPath === "/" ? "/" : requestPath);
+	}
+	const baseNormalized = normalizeDotSegments(upstream.pathname === "" ? "/" : upstream.pathname);
+	const finalPath = normalizeDotSegments(baseNormalized === "/" ? requestPath : `${baseNormalized.replace(/\/+$/, "")}${requestPath}`);
+	let url;
+	try {
+		url = new URL(finalPath + (query === "" ? "" : `?${query}`), upstream);
+	} catch {
+		throw new RewriteError("cannot build upstream URL from service config and request path");
+	}
+	if (url.origin !== upstream.origin) throw new RewriteError(`upstream origin assertion failed (${url.origin} != ${upstream.origin})`);
+	if (!pathHasPrefix(finalPath, baseNormalized)) throw new RewriteError("upstream base path prefix assertion failed");
+	const headers = {};
+	for (const [name, value] of Object.entries(req.headers ?? {})) {
+		if (DEFENSIVE_STRIP.has(name)) continue;
+		headers[name] = value;
+	}
+	if (req.contentType !== void 0 && req.contentType !== "") headers["content-type"] = req.contentType;
+	for (const name of service.rewrite?.headerRemove ?? []) delete headers[name];
+	const headerSet = service.rewrite?.headerSet;
+	if (headerSet !== void 0) for (const [name, value] of Object.entries(headerSet)) {
+		const resolved = resolveHeaderValue(value, env, secrets);
+		if (resolved === void 0) continue;
+		headers[name] = resolved;
+	}
+	const host = service.rewrite?.hostHeader ?? upstream.host;
+	return {
+		url,
+		headers,
+		host,
+		isWebSocketUpgrade: isWebSocketUpgradeRequest(req.headers ?? {})
+	};
+}
+/** 段边界前缀判定：base 为根恒真；否则 final === base 或以 base/ 开头。 */
+function pathHasPrefix(finalPath, basePath) {
+	if (basePath === "/" || basePath === "") return true;
+	if (finalPath === basePath) return true;
+	const base = basePath.endsWith("/") ? basePath.slice(0, -1) : basePath;
+	return finalPath.startsWith(`${base}/`);
+}
+//#endregion
+export { collectEnvVarNames as a, detailDisplayLines as c, buildUpstreamRequest as i, RewriteError as n, buildServiceDetail as o, SecretMissingError as r, buildServiceEntry as s, PathNotOfferedError as t };