ai-fly 0.3.2 → 0.4.0-alpha.10

package/dist/{presets-C73CAMZ6.mjs → presets-DleOUQiT.mjs}

@@ -1,7 +1,7 @@
 import { n as UsageError, r as reportCliError } from "./errors-BGtxPkM7.mjs";
 import { n as parseArgv } from "./args-CSxXW9eD.mjs";
-import { t as loadSettings } from "./settings-C1Hb4zwd.mjs";
-import { n as loadCuratedPresets, r as modelsDevCachePath, t as fetchModelsDevPresets } from "./models-dev-2UfQoIpQ.mjs";
+import { t as loadSettings } from "./settings-XCvAzDK8.mjs";
+import { n as loadCuratedPresets, r as modelsDevCachePath, t as fetchModelsDevPresets } from "./models-dev-CDEyd2k3.mjs";
 import { homedir } from "node:os";
 //#region src/cli/commands/provider/presets.ts
 const SPEC = { json: { type: "boolean" } };

package/dist/{revoke-CkpvK33Q.mjs → revoke-DTFW_EF1.mjs}

@@ -1,8 +1,8 @@
 import { n as UsageError, r as reportCliError } from "./errors-BGtxPkM7.mjs";
 import { n as parseArgv } from "./args-CSxXW9eD.mjs";
 import { t as resolveHttpProxy } from "./proxy-D7VMUVEg.mjs";
-import { d as str, l as resolveDataDir, u as resolvedRelayUrls } from "./common-CqxqIg6D.mjs";
-import { t as openExistingFabric } from "./serve-Be4zdKVj.mjs";
+import { d as str, l as resolveDataDir, u as resolvedRelayUrls } from "./common-C51SAE5f.mjs";
+import { t as openExistingFabric } from "./serve-CY7ZFOFM.mjs";
 import { homedir } from "node:os";
 //#region src/cli/commands/provider/revoke.ts
 const SPEC = {

package/dist/{rewrite-xZHWnyJk.mjs → rewrite-CEzfYH9n.mjs}

@@ -1,6 +1,9 @@
-import { a as routeLocalPrefix } from "./rpc-contract-5qyWzT5t.mjs";
-import { n as FORBIDDEN_REQ_HEADER_NAMES } from "./frames-BDqvhB2Y.mjs";
-import { a as parseUpstreamUrl, c as matchRequestPath, o as expandUriTemplate, s as compileMatchPattern } from "./store-CrTUwskE.mjs";
+import { a as routeLocalPrefix } from "./rpc-contract-cB5SuyQ_.mjs";
+import { n as FORBIDDEN_REQ_HEADER_NAMES } from "./frames-BDz8buix.mjs";
+import { a as parseUpstreamUrl, c as matchRequestPath, o as expandUriTemplate, s as compileMatchPattern } from "./store-EGzVd-dn.mjs";
+import { o as resolveHookValue } from "./hook-CvAMGts4.mjs";
+import "node:module";
+import "node:fs";
 const ENV_REF_PREFIX = "$env:";
 /** $secret 引用前缀（密钥库名；与 $env 同样按引用整体掩码）。 */
 const SECRET_REF_PREFIX = "$secret:";
@@ -32,7 +35,7 @@ function buildServiceDetail(service) {
 		if (prefix !== void 0) rewrite.prefix = prefix;
 		if (service.rewrite.headerSet !== void 0) rewrite.headerSet = Object.entries(service.rewrite.headerSet).map(([name, value]) => ({
 			name,
-			value: isMaskedRef(value) ? "●" : value
+			value: typeof value === "string" ? isMaskedRef(value) ? "●" : value : "●"
 		}));
 	}
 	return {
@@ -121,33 +124,45 @@ var SecretMissingError = class extends Error {
 	}
 };
 /**
-* 头值解析：literal 原样；`$secret:<name>` 优先于 `$env:` 判定——命中密钥库返回
-* 完整值，未命中（含空名/空值/未注入密钥源）抛 SecretMissingError（不回退空值、
-* 不省略该头）；`$env:<VAR>` 语义保持——空串/未设置返回 undefined（= 省略该头）。
-* 两者可并存于不同头（逐头独立解析）。
+* 头值解析（两协议，Owner 裁决 2026-09-12 最终形态）：
+* - string 字面量：原样（空串 = 省略该头）
+* - 对象 = 钩子调用：{ hook: <函数名>, args?, bearer? }——脚本取
+*   ctx.script（service.hooks），缺席时按 args 形态推导内建
+*   （var→env / name→secret / path→file）；经 resolveHookValue 三态取值
+*   （string/Promise 每请求拉取；AsyncIterable 订阅 latest）；bearer 拼
+*   前缀。未命中抛 SecretMissingError（零上游请求；不泄脚本路径与值）。
 */
-function resolveHeaderValue(value, env, secrets) {
-	if (value.startsWith("$secret:")) {
-		const name = value.slice(8);
-		const resolved = secrets?.(name);
-		if (resolved === void 0 || resolved === "") throw new SecretMissingError();
-		return resolved;
+async function resolveHeaderEntry(entry, ctx) {
+	if (typeof entry === "string") return entry === "" ? void 0 : entry;
+	const args = entry.args ?? {};
+	let script = ctx.script;
+	if (script === void 0 || script === "") {
+		if (args.var !== void 0) script = "env";
+		else if (args.name !== void 0) script = "secret";
+		else if (args.path !== void 0) script = "file";
+		else throw new SecretMissingError();
 	}
-	if (!value.startsWith("$env:")) return value;
-	const name = value.slice(5);
-	if (name === "") return void 0;
-	const resolved = env[name];
-	return resolved === void 0 || resolved === "" ? void 0 : resolved;
+	let raw;
+	try {
+		raw = await resolveHookValue(entry.hook, {
+			script,
+			...ctx.home !== void 0 ? { home: ctx.home } : {},
+			...Object.keys(args).length > 0 ? { args } : {},
+			...ctx.secrets !== void 0 ? { secrets: ctx.secrets } : {},
+			...ctx.env !== void 0 ? { env: (n) => ctx.env?.[n] } : {},
+			...ctx.loader !== void 0 ? { loader: ctx.loader } : {}
+		});
+	} catch {
+		throw new SecretMissingError();
+	}
+	return entry.bearer === true ? `Bearer ${raw}` : raw;
 }
-/** 服务声明的全部 $env 变量名（启动横幅 WARNING 用）。 */
+/** 服务声明的 env 钩子变量名（启动横幅 WARNING 用：声明而未设置）。 */
 function collectEnvVarNames(service) {
 	const names = /* @__PURE__ */ new Set();
 	const headerSet = service.rewrite?.headerSet;
 	if (headerSet === void 0) return [];
-	for (const value of Object.values(headerSet)) if (value.startsWith("$env:")) {
-		const name = value.slice(5);
-		if (name !== "") names.add(name);
-	}
+	for (const entry of Object.values(headerSet)) if (typeof entry === "object" && entry.args?.var !== void 0 && (service.hooks === void 0 || service.hooks === "env")) names.add(entry.args.var);
 	return [...names];
 }
 /** HTTP hop-by-hop / 传输层自管头（普通 HTTP 转发路径剥离；WS 路径另行挑选）。 */
@@ -226,7 +241,7 @@ function isWebSocketUpgradeRequest(headers) {
 	if (connection === void 0 || upgrade === void 0) return false;
 	return connection.split(",").map((t) => t.trim().toLowerCase()).includes("upgrade") && upgrade.trim().toLowerCase() === "websocket";
 }
-function buildUpstreamRequest(service, req, env = process.env, secrets) {
+async function buildUpstreamRequest(service, req, env = process.env, secrets) {
 	const upstream = parseUpstreamUrl(service.upstream);
 	assertFramePathShape(req.path);
 	const split = splitQuery(req.path);
@@ -290,7 +305,11 @@ function buildUpstreamRequest(service, req, env = process.env, secrets) {
 	for (const name of service.rewrite?.headerRemove ?? []) delete headers[name];
 	const headerSet = service.rewrite?.headerSet;
 	if (headerSet !== void 0) for (const [name, value] of Object.entries(headerSet)) {
-		const resolved = resolveHeaderValue(value, env, secrets);
+		const resolved = await resolveHeaderEntry(value, {
+			script: service.hooks,
+			env,
+			secrets
+		});
 		if (resolved === void 0) continue;
 		headers[name] = resolved;
 	}

package/dist/{route-test-Oew0CO1U.mjs → route-test-D2LQyX7c.mjs}

@@ -1,6 +1,6 @@
-import { n as ROUTE_LOCAL_PREFIX } from "./rpc-contract-5qyWzT5t.mjs";
-import { t as formProbe } from "./local-test-C3HGjGY3.mjs";
-import { i as buildUpstreamRequest, t as PathNotOfferedError } from "./rewrite-xZHWnyJk.mjs";
+import { n as ROUTE_LOCAL_PREFIX } from "./rpc-contract-cB5SuyQ_.mjs";
+import { t as formProbe } from "./local-test-BZHGo22F.mjs";
+import { i as buildUpstreamRequest, t as PathNotOfferedError } from "./rewrite-CEzfYH9n.mjs";
 //#region src/provider/route-test.ts
 const DEFAULT_TIMEOUT_MS = 2e4;
 const BODY_EXCERPT_MAX = 2e3;
@@ -25,7 +25,7 @@ async function testServiceRoute(input) {
 		bodyLen: 0
 	};
 	try {
-		const plan = buildUpstreamRequest(input.service, req, input.env, input.secrets);
+		const plan = await buildUpstreamRequest(input.service, req, input.env, input.secrets);
 		const response = await fetchImpl(plan.url, {
 			method: "POST",
 			headers: plan.headers,

package/dist/{rpc-contract-5qyWzT5t.mjs → rpc-contract-cB5SuyQ_.mjs}

@@ -95,7 +95,11 @@ const SERVICE_REWRITE_SCHEMA = z.strictObject({
 	hostHeader: z.string().min(1).max(2048).optional(),
 	pathPrefixStrip: z.string().min(1).max(2048).optional(),
 	pathPrefixAppend: z.string().min(1).max(2048).optional(),
-	headerSet: z.record(z.string().min(1).max(1024), z.string().max(8192)).optional(),
+	headerSet: z.record(z.string().min(1).max(1024), z.union([z.string().max(8192), z.strictObject({
+		hook: z.string().min(1).max(128),
+		args: z.record(z.string().min(1).max(128), z.string().max(2048)).optional(),
+		bearer: z.boolean().optional()
+	})])).optional(),
 	headerRemove: z.array(z.string().min(1).max(1024)).max(32).optional()
 });
 const ROUTE_FORM_SCHEMA = z.enum([
@@ -143,6 +147,7 @@ const SERVICE_SCHEMA = z.strictObject({
 	upstream: z.string().min(1).max(2048),
 	rewrite: SERVICE_REWRITE_SCHEMA.optional(),
 	routes: z.array(SERVICE_ROUTE_SCHEMA).max(3).optional(),
+	hooks: z.string().regex(/^[a-z][a-z0-9_-]{0,63}$/).optional(),
 	defaultPort: z.number().int().min(1).max(65535)
 });
 /** services.add 输入（defaultPort 缺省规则的校验在 store，同 CLI）。 */
@@ -152,7 +157,8 @@ const SERVICE_INPUT_SCHEMA = z.strictObject({
 	match: z.array(SERVICE_MATCH_SCHEMA).min(1).max(64),
 	defaultPort: z.number().int().min(1).max(65535).optional(),
 	rewrite: SERVICE_REWRITE_SCHEMA.optional(),
-	routes: z.array(SERVICE_ROUTE_SCHEMA).max(3).optional()
+	routes: z.array(SERVICE_ROUTE_SCHEMA).max(3).optional(),
+	hooks: z.string().regex(/^[a-z][a-z0-9_-]{0,63}$/).optional()
 });
 const GROUP_LIMITS_SCHEMA = z.strictObject({
 	maxConcurrency: z.number().int().min(1).optional(),
@@ -163,12 +169,15 @@ const GROUP_SCHEMA = z.strictObject({
 	serviceIds: z.array(z.string().min(1).max(128)).max(256),
 	limits: GROUP_LIMITS_SCHEMA.optional()
 });
-/** 密钥视图：keyId/分组/时间/状态；哈希与原文一律不进契约（原文仅 issue 时一次性返回）。 */
+/** 密钥视图：keyId/分组/时间/状态 + 名 + 原文（Owner 2026-09-13：随时可
+*  复制——原文随库返回；旧记录只存哈希 → 两字段皆缺省）。 */
 const KEY_VIEW_SCHEMA = z.strictObject({
 	keyId: z.string().min(1).max(128),
 	group: z.string().min(1).max(256),
 	createdAt: z.number().int().min(0),
-	revokedAt: z.number().int().min(0).optional()
+	revokedAt: z.number().int().min(0).optional(),
+	name: z.string().min(1).max(128).optional(),
+	key: z.string().min(8).max(256).optional()
 });
 /** 使用方服务目录条目（AUTH_OK / import 视图；detail 为脱敏披露，$env 值显示 ●）。 */
 const SERVICE_ENTRY_SCHEMA = z.object({
@@ -190,7 +199,11 @@ const SERVICE_ENTRY_SCHEMA = z.object({
 			prefix: z.string().optional(),
 			headerSet: z.array(z.strictObject({
 				name: z.string(),
-				value: z.string()
+				value: z.union([z.string(), z.strictObject({
+					hook: z.string(),
+					args: z.record(z.string(), z.string()).optional(),
+					bearer: z.boolean().optional()
+				})])
 			})).optional()
 		}).optional(),
 		/** 按标准路由披露（消费侧呈现各标准本地 base 与可用性判定）。 */
@@ -228,6 +241,7 @@ const CONSUMER_PROVIDER_STATUS_SCHEMA = z.object({
 });
 const API_FORM_SCHEMA = z.enum([
 	"openai-completions",
+	"openai-responses",
 	"anthropic-messages",
 	"gemini-native"
 ]);
@@ -240,6 +254,14 @@ const PRESET_SCHEMA = z.strictObject({
 	iconId: z.string().min(1).max(128).optional(),
 	/** 惯用环境变量名（仅用于 $env 注入建议与文档；本地运行时模板无此字段）。 */
 	keyEnv: z.string().min(1).max(256).optional(),
+	/** 选中的 hooks 脚本名（applyAsService 透传为服务 hooks 字段）。 */
+	hooks: z.string().regex(/^[a-z][a-z0-9_-]{0,63}$/).optional(),
+	/** 预填 authorization 头的钩子调用对象；优先级：显式 secretName > authHeader > keyEnv。 */
+	authHeader: z.strictObject({
+		hook: z.string().min(1).max(128),
+		args: z.record(z.string().min(1).max(128), z.string().max(2048)).optional(),
+		bearer: z.boolean().optional()
+	}).optional(),
 	/** 使用方本地端口建议（避开 <1024 特权段）。 */
 	defaultPort: z.number().int().min(1024).max(65535),
 	/** 官方域名集（exact/suffix 建议的生成源）。 */
@@ -317,7 +339,11 @@ const SETTINGS_SCHEMA = z.strictObject({
 const SHARE_CREATE_INPUT_SCHEMA = z.strictObject({
 	group: z.string().min(1).max(256),
 	/** TTL 毫秒（1s..30d；缺省 60min——范围校验复用 link.ts 常量语义）。 */
-	ttlMs: z.number().int().min(1e3).max(2592e6).optional()
+	ttlMs: z.number().int().min(1e3).max(2592e6).optional(),
+	/** 复用既有 key（现铸 invite 重发链接；缺省签发新钥）。 */
+	keyId: z.string().min(1).max(128).optional(),
+	/** 新钥名（缺省签发路径下默认 "default"）。 */
+	keyName: z.string().min(1).max(128).optional()
 });
 const PRESET_APPLY_INPUT_SCHEMA = z.strictObject({
 	presetId: z.string().min(1).max(128),
@@ -393,6 +419,32 @@ oc.errors(RpcErrorDefinitions).router({
 				localPrefix: z.string().min(1).max(2048).optional()
 			})).output(SERVICE_TEST_RESULT_SCHEMA)
 		},
+		hooks: {
+			/** hooks 脚本清单（内建 + 用户库；fns = 命名规范发现的钩子函数）。 */
+			list: oc.input(z.object({})).output(z.object({ hooks: z.array(z.strictObject({
+				name: z.string(),
+				source: z.enum(["user", "builtin"]),
+				fns: z.array(z.string())
+			})) })),
+			/** 脚本内容查看（含 path）。 */
+			get: oc.input(z.strictObject({ name: z.string().min(1).max(64) })).output(z.strictObject({
+				name: z.string(),
+				source: z.enum(["user", "builtin"]),
+				path: z.string(),
+				content: z.string()
+			})),
+			/** 安装用户脚本（校验：可加载 + 至少一个导出函数；失败回滚）。 */
+			add: oc.input(z.strictObject({
+				name: z.string().min(1).max(64),
+				content: z.string().min(1).max(65536)
+			})).output(z.strictObject({
+				name: z.string(),
+				path: z.string(),
+				fns: z.array(z.string())
+			})),
+			/** 删除（仅用户库；内建拒绝）。 */
+			remove: oc.input(z.strictObject({ name: z.string().min(1).max(64) })).output(z.object({ removed: z.boolean() }))
+		},
 		secrets: {
 			/** 密钥库清单（仅名称与时间戳；值由设计不跨 RPC）。 */
 			list: oc.input(z.object({})).output(z.object({ secrets: z.array(SECRET_ENTRY_SCHEMA) })),
@@ -429,13 +481,16 @@ oc.errors(RpcErrorDefinitions).router({
 			remove: oc.input(z.strictObject({ name: z.string().min(1).max(256) })).output(z.object({ removed: z.literal(true) }))
 		},
 		keys: {
-			/** 签发（原文仅本次返回；此后只余哈希）。 */
-			issue: oc.input(z.strictObject({ group: z.string().min(1).max(256) })).output(z.object({
+			/** 签发（name 缺省 "default"；原文随库可再取）。 */
+			issue: oc.input(z.strictObject({
+				group: z.string().min(1).max(256),
+				name: z.string().min(1).max(128).optional()
+			})).output(z.object({
 				keyId: z.string(),
 				key: z.string(),
 				createdAt: z.number().int()
 			})),
-			/** 密钥清单（无哈希、无原文）。 */
+			/** 密钥清单（含名与原文——本机 GUI 随时复制；无哈希）。 */
 			list: oc.input(z.object({})).output(z.object({ keys: z.array(KEY_VIEW_SCHEMA) })),
 			/** 撤销（幂等）。 */
 			revoke: oc.input(z.strictObject({ keyId: z.string().min(1).max(128) })).output(z.object({ key: KEY_VIEW_SCHEMA }))

package/dist/{run-3pdPsD8e.mjs → run-D8kgXdId.mjs}

@@ -1,8 +1,8 @@
 import { n as UsageError, r as reportCliError, t as CliError } from "./errors-BGtxPkM7.mjs";
 import { n as parseArgv } from "./args-CSxXW9eD.mjs";
-import { n as consumersRoot, s as listKeyrings } from "./store-CQShpYar.mjs";
-import { a as ringsForRun, i as printListeners, n as ctxHomedir, o as waitForSignals, r as ctxOut, t as createSdkFabricFactory } from "./common-CgxCXeTt.mjs";
-import { n as createFabricProviderTransport, t as startEngine } from "./runtime-DNs9GtGp.mjs";
+import { n as consumersRoot, s as listKeyrings } from "./store-DOFDy1rY.mjs";
+import { a as ringsForRun, i as printListeners, n as ctxHomedir, o as waitForSignals, r as ctxOut, t as createSdkFabricFactory } from "./common-CanLn0Qt.mjs";
+import { n as createFabricProviderTransport, t as startEngine } from "./runtime-C_pLA5F0.mjs";
 import { a as killHard, c as terminateGracefully, i as isAlive, l as writeLastStart, n as daemonDir, o as readLastStart, r as ensureDaemonDir, s as readPid, t as clearPid, u as writePid } from "./daemon-state-CYkiW3SA.mjs";
 import { openSync, readFileSync } from "node:fs";
 import { resolve } from "node:path";

package/dist/{runtime-DNs9GtGp.mjs → runtime-C_pLA5F0.mjs}

@@ -1,6 +1,6 @@
-import { i as FRAME_TYPE, o as HTTP_METHODS } from "./frames-BDqvhB2Y.mjs";
-import { c as loadKeyring, f as saveKeyring, p as setActualPorts, t as applyCatalog, u as reconcileKeyMetadata } from "./store-CQShpYar.mjs";
-import { i as splitBody, n as FabricWireAdapter, t as WireSession } from "./mux-CS1zhF4W.mjs";
+import { i as FRAME_TYPE, o as HTTP_METHODS } from "./frames-BDz8buix.mjs";
+import { c as loadKeyring, f as saveKeyring, p as setActualPorts, t as applyCatalog, u as reconcileKeyMetadata } from "./store-DOFDy1rY.mjs";
+import { i as splitBody, n as FabricWireAdapter, t as WireSession } from "./mux-BaIDugDq.mjs";
 import { n as desiredPortFor, r as listenWithFallback, t as LOOPBACK_HOST } from "./ports-pI59MtmI.mjs";
 import { Hono } from "hono";
 import { createAdaptorServer } from "@hono/node-server";

package/dist/{secret-COdVHzjH.mjs → secret-P2RgHy2h.mjs}

@@ -1,7 +1,7 @@
 import { n as UsageError, r as reportCliError } from "./errors-BGtxPkM7.mjs";
 import { n as parseArgv } from "./args-CSxXW9eD.mjs";
-import { d as str, l as resolveDataDir } from "./common-CqxqIg6D.mjs";
-import { t as SecretsStore } from "./secrets-BYI6ooTJ.mjs";
+import { d as str, l as resolveDataDir } from "./common-C51SAE5f.mjs";
+import { t as SecretsStore } from "./secrets-1Hmddmwy.mjs";
 import { homedir } from "node:os";
 import process from "node:process";
 import { createInterface } from "node:readline";

package/dist/{secrets-BYI6ooTJ.mjs → secrets-1Hmddmwy.mjs}

@@ -1,5 +1,5 @@
-import { r as SECRET_NAME_SCHEMA } from "./rpc-contract-5qyWzT5t.mjs";
-import { i as ensurePrivateDir, n as StoreError, r as atomicWriteFileSync } from "./store-CrTUwskE.mjs";
+import { r as SECRET_NAME_SCHEMA } from "./rpc-contract-cB5SuyQ_.mjs";
+import { i as ensurePrivateDir, n as StoreError, r as atomicWriteFileSync } from "./store-EGzVd-dn.mjs";
 import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { z } from "zod";

package/dist/secrets-C9IYp93v.mjs

@@ -0,0 +1,2 @@
+import { t as SecretsStore } from "./secrets-1Hmddmwy.mjs";
+export { SecretsStore };

package/dist/{serve-DSBlodTF.mjs → serve-B51lmr9M.mjs}

@@ -1,8 +1,8 @@
 import { n as UsageError, r as reportCliError } from "./errors-BGtxPkM7.mjs";
 import { n as parseArgv } from "./args-CSxXW9eD.mjs";
 import { t as resolveHttpProxy } from "./proxy-D7VMUVEg.mjs";
-import { d as str, l as resolveDataDir, u as resolvedRelayUrls } from "./common-CqxqIg6D.mjs";
-import { n as startProviderDaemon } from "./serve-Be4zdKVj.mjs";
+import { d as str, l as resolveDataDir, u as resolvedRelayUrls } from "./common-C51SAE5f.mjs";
+import { n as startProviderDaemon } from "./serve-CY7ZFOFM.mjs";
 import { homedir } from "node:os";
 //#region src/cli/commands/provider/serve.ts
 const SPEC = {

package/dist/{serve-Be4zdKVj.mjs → serve-CY7ZFOFM.mjs}

@@ -1,9 +1,9 @@
-import { c as RESP_META_HEADER_WHITELIST, i as FRAME_TYPE, s as REJECTED_CODE, t as ERROR_CODE } from "./frames-BDqvhB2Y.mjs";
+import { c as RESP_META_HEADER_WHITELIST, i as FRAME_TYPE, s as REJECTED_CODE, t as ERROR_CODE } from "./frames-BDz8buix.mjs";
 import { n as loadSdk } from "./proxy-D7VMUVEg.mjs";
-import { i as ensurePrivateDir, r as atomicWriteFileSync, t as ProviderStore } from "./store-CrTUwskE.mjs";
-import { n as FabricWireAdapter, r as DEFAULT_BODY_CHUNK_BYTES, t as WireSession } from "./mux-CS1zhF4W.mjs";
-import { a as collectEnvVarNames, i as buildUpstreamRequest, n as RewriteError, r as SecretMissingError, s as buildServiceEntry, t as PathNotOfferedError } from "./rewrite-xZHWnyJk.mjs";
-import { t as SecretsStore } from "./secrets-BYI6ooTJ.mjs";
+import { i as ensurePrivateDir, r as atomicWriteFileSync, t as ProviderStore } from "./store-EGzVd-dn.mjs";
+import { n as FabricWireAdapter, r as DEFAULT_BODY_CHUNK_BYTES, t as WireSession } from "./mux-BaIDugDq.mjs";
+import { t as SecretsStore } from "./secrets-1Hmddmwy.mjs";
+import { a as collectEnvVarNames, i as buildUpstreamRequest, n as RewriteError, r as SecretMissingError, s as buildServiceEntry, t as PathNotOfferedError } from "./rewrite-CEzfYH9n.mjs";
 import { appendFileSync, existsSync, readFileSync, readdirSync, watch } from "node:fs";
 import "node:os";
 import { dirname, join } from "node:path";
@@ -533,7 +533,7 @@ function mergeTimeouts(overrides) {
 async function forwardRequest(ctx) {
 	let plan;
 	try {
-		plan = buildUpstreamRequest(ctx.service, ctx.req, ctx.env ?? process.env, ctx.secrets);
+		plan = await buildUpstreamRequest(ctx.service, ctx.req, ctx.env ?? process.env, ctx.secrets);
 	} catch (err) {
 		const code = err instanceof SecretMissingError ? ERROR_CODE.secret_missing : err instanceof PathNotOfferedError ? ERROR_CODE.path_not_offered : ERROR_CODE.protocol_error;
 		const message = err instanceof RewriteError || err instanceof SecretMissingError || err instanceof PathNotOfferedError ? err.message : "request rewrite failed";

package/dist/{service-B5uORhl3.mjs → service-D6TNolyh.mjs}

@@ -1,7 +1,7 @@
 import { n as UsageError, r as reportCliError } from "./errors-BGtxPkM7.mjs";
 import { n as parseArgv } from "./args-CSxXW9eD.mjs";
-import { a as parseMatchSpec, d as str, i as parseHeaderSetSpec, l as resolveDataDir, n as multi, o as parsePortNumber, r as openStore, t as buildRewrite } from "./common-CqxqIg6D.mjs";
-import { n as loadCuratedPresets } from "./models-dev-2UfQoIpQ.mjs";
+import { a as parseMatchSpec, d as str, i as parseHeaderSetSpec, l as resolveDataDir, n as multi, o as parsePortNumber, r as openStore, t as buildRewrite } from "./common-C51SAE5f.mjs";
+import { n as loadCuratedPresets } from "./models-dev-CDEyd2k3.mjs";
 import { homedir } from "node:os";
 //#region src/cli/commands/provider/service.ts
 const SPEC = {
@@ -20,6 +20,7 @@ const SPEC = {
 	route: { type: "multi" },
 	"route-pattern": { type: "multi" },
 	secret: { type: "string" },
+	hooks: { type: "string" },
 	preset: { type: "string" },
 	form: { type: "string" },
 	content: { type: "string" },
@@ -70,10 +71,18 @@ function add(options, positionals, home) {
 		...multi(options["route-pattern"]).map(parseRoutePatternSpec),
 		...preset !== void 0 && options.route === void 0 && options["route-pattern"] === void 0 ? preset.routes ?? [] : []
 	];
+	const hooksOverride = options.hooks !== void 0 ? str(options.hooks) : options.secret !== void 0 ? "secret" : preset?.hooks;
 	const headerSetSpecs = multi(options["header-set"]).map(parseHeaderSetSpec);
 	if (options.secret !== void 0) headerSetSpecs.push({
 		name: "authorization",
-		value: `\$secret:${str(options.secret)}`
+		value: {
+			hook: "authHeader",
+			args: { name: str(options.secret) }
+		}
+	});
+	else if (preset?.authHeader !== void 0 && !headerSetSpecs.some((h) => h.name.toLowerCase() === "authorization")) headerSetSpecs.push({
+		name: "authorization",
+		value: preset.authHeader
 	});
 	const dataDir = resolveDataDir(str(options.data), home);
 	const service = openStore(dataDir).addService({
@@ -82,6 +91,7 @@ function add(options, positionals, home) {
 		match: matchSpecs,
 		...routes.length > 0 ? { routes } : {},
 		defaultPort: options.port === void 0 ? preset?.defaultPort : parsePortNumber(str(options.port), "port"),
+		...hooksOverride !== void 0 ? { hooks: hooksOverride } : {},
 		rewrite: buildRewrite({
 			host: str(options.host),
 			strip: str(options.strip),
@@ -192,7 +202,8 @@ function get(options, positionals, home) {
 		if (service.rewrite.hostHeader !== void 0) rewrite.push(`host: ${service.rewrite.hostHeader}`);
 		if (service.rewrite.pathPrefixStrip !== void 0) rewrite.push(`strip: ${service.rewrite.pathPrefixStrip}`);
 		if (service.rewrite.pathPrefixAppend !== void 0) rewrite.push(`append: ${service.rewrite.pathPrefixAppend}`);
-		for (const [headerName, value] of Object.entries(service.rewrite.headerSet ?? {})) rewrite.push(`header ${headerName}: ${value}`);
+		for (const [headerName, value] of Object.entries(service.rewrite.headerSet ?? {})) rewrite.push(`header ${headerName}: ${humanizeHeaderValue(value)}`);
+		if (service.hooks !== void 0) rewrite.push(`hooks: ${service.hooks}`);
 		for (const headerName of service.rewrite.headerRemove ?? []) rewrite.push(`remove header ${headerName}`);
 		if (rewrite.length > 0) lines.push(`  rewrite    : ${rewrite.join(" | ")}`);
 	}
@@ -203,18 +214,28 @@ function get(options, positionals, home) {
 async function test(options, positionals, home) {
 	const name = positionals[1];
 	if (name === void 0) throw new UsageError("error: service test requires a <name> argument");
-	const formRaw = options.form === void 0 ? "openai-chat" : str(options.form);
-	if (!ROUTE_FORMS.includes(formRaw)) throw new UsageError(`error: --form must be one of ${ROUTE_FORMS.join(", ")}`);
 	const dataDir = resolveDataDir(str(options.data), home);
 	const service = openStore(dataDir).getServiceByName(name);
 	if (service === void 0) throw new UsageError(`error: service '${name}' not found`);
-	const { testServiceRoute } = await import("./route-test-Oew0CO1U.mjs");
-	const { SecretsStore } = await import("./secrets-u19-8EyW.mjs");
+	let formRaw;
+	if (options.form !== void 0) formRaw = str(options.form);
+	else {
+		const localPrefix = options["local-prefix"] !== void 0 ? str(options["local-prefix"]) : void 0;
+		const routes = (service.routes ?? []).filter((r) => r.mode !== "pattern");
+		formRaw = (localPrefix !== void 0 ? routes.find((r) => r.localPrefix === localPrefix) : routes.length === 1 ? routes[0] : void 0)?.forms[0] ?? "openai-chat";
+	}
+	if (!ROUTE_FORMS.includes(formRaw)) throw new UsageError(`error: --form must be one of ${ROUTE_FORMS.join(", ")}`);
+	const { testServiceRoute } = await import("./route-test-D2LQyX7c.mjs");
+	const { SecretsStore } = await import("./secrets-C9IYp93v.mjs");
 	const secretsStore = SecretsStore.open(dataDir);
+	const hitLocalPrefix = options["local-prefix"] !== void 0 ? str(options["local-prefix"]) : (() => {
+		const routes = (service.routes ?? []).filter((r) => r.mode !== "pattern");
+		return routes.length === 1 ? routes[0].localPrefix : void 0;
+	})();
 	const result = await testServiceRoute({
 		service,
 		form: formRaw,
-		...options["local-prefix"] !== void 0 ? { localPrefix: str(options["local-prefix"]) } : {},
+		...hitLocalPrefix !== void 0 ? { localPrefix: hitLocalPrefix } : {},
 		...options.model !== void 0 ? { model: str(options.model) } : {},
 		...options.content !== void 0 ? { content: str(options.content) } : {},
 		secrets: (secretName) => secretsStore.resolve(secretName)?.headerValue
@@ -228,5 +249,11 @@ async function test(options, positionals, home) {
 	if (result.bodyExcerpt !== void 0) out(result.bodyExcerpt.slice(0, 1200));
 	return result.ok ? 0 : 1;
 }
+/** 头值 humanize：字面量原样；钩子调用 `hook <fn>(k=v, …)[ bearer]`。 */
+function humanizeHeaderValue(value) {
+	if (typeof value === "string") return value;
+	const args = Object.entries(value.args ?? {}).map(([k, v]) => `${k}=${v}`).join(", ");
+	return `hook ${value.hook}${args !== "" ? ` (${args})` : ""}${value.bearer === true ? " [bearer]" : ""}`;
+}
 //#endregion
 export { run };

package/dist/{settings-DU0YqNDt.mjs → settings-Rq1zLoxY.mjs}

@@ -1,6 +1,6 @@
 import { n as UsageError, r as reportCliError } from "./errors-BGtxPkM7.mjs";
 import { n as parseArgv } from "./args-CSxXW9eD.mjs";
-import { n as saveSettings, r as settingsPath, t as loadSettings } from "./settings-C1Hb4zwd.mjs";
+import { n as saveSettings, r as settingsPath, t as loadSettings } from "./settings-XCvAzDK8.mjs";
 import { homedir } from "node:os";
 //#region src/cli/commands/settings.ts
 const SPEC = { default: { type: "boolean" } };

package/dist/{settings-C1Hb4zwd.mjs → settings-XCvAzDK8.mjs}

@@ -1,5 +1,5 @@
-import { i as SETTINGS_SCHEMA } from "./rpc-contract-5qyWzT5t.mjs";
-import { i as ensurePrivateDir, r as atomicWriteFileSync } from "./store-CrTUwskE.mjs";
+import { i as SETTINGS_SCHEMA } from "./rpc-contract-cB5SuyQ_.mjs";
+import { i as ensurePrivateDir, r as atomicWriteFileSync } from "./store-EGzVd-dn.mjs";
 import { readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";

package/dist/{share-Cug0944N.mjs → share-DdtbAylA.mjs}

@@ -1,11 +1,11 @@
 import { r as reportCliError, t as CliError } from "./errors-BGtxPkM7.mjs";
 import { n as parseArgv, r as parseDurationMs, t as assertDurationRange } from "./args-CSxXW9eD.mjs";
-import { l as SERVICE_ENTRY_SCHEMA } from "./frames-BDqvhB2Y.mjs";
+import { l as SERVICE_ENTRY_SCHEMA } from "./frames-BDz8buix.mjs";
 import { t as resolveHttpProxy } from "./proxy-D7VMUVEg.mjs";
-import { n as StoreError } from "./store-CrTUwskE.mjs";
-import { c as requireString, d as str, l as resolveDataDir, r as openStore, u as resolvedRelayUrls } from "./common-CqxqIg6D.mjs";
-import { t as openExistingFabric } from "./serve-Be4zdKVj.mjs";
-import { s as buildServiceEntry } from "./rewrite-xZHWnyJk.mjs";
+import { n as StoreError } from "./store-EGzVd-dn.mjs";
+import { c as requireString, d as str, l as resolveDataDir, r as openStore, u as resolvedRelayUrls } from "./common-C51SAE5f.mjs";
+import { t as openExistingFabric } from "./serve-CY7ZFOFM.mjs";
+import { s as buildServiceEntry } from "./rewrite-CEzfYH9n.mjs";
 import { homedir } from "node:os";
 import { z } from "zod";
 //#region src/provider/link.ts
@@ -33,21 +33,32 @@ function encodeShareLink(payload) {
 	return SHARE_LINK_PREFIX + Buffer.from(JSON.stringify(payload), "utf8").toString("base64url");
 }
 /**
-* 构造分享链接：前置检查（组存在且非空）-> 签发新钥（每次 share 一枚；旧钥不可再现）
-* -> 组内服务脱敏视图 -> payload + link + 警告。
+* 构造分享链接：前置检查（组存在且非空）-> key（复用 keyId 指定的已存
+* 原文；缺省签发新钥）-> 组内服务脱敏视图 -> payload + link + 警告。
 */
 function buildShareLink(input) {
 	if (input.store.getGroup(input.group) === void 0) throw new StoreError("not-found", `error: group '${input.group}' not found`);
 	const services = input.store.groupServices(input.group);
 	if (services.length === 0) throw new StoreError("invalid", `error: group '${input.group}' has no services; a share link would be meaningless`);
-	const issued = input.store.issueKey(input.group);
+	let key;
+	let keyId;
+	if (input.keyId !== void 0) {
+		const material = input.store.getKeyMaterial(input.keyId);
+		if (material === void 0) throw new StoreError("invalid", `error: key '${input.keyId}' cannot be shared (missing, revoked, or raw material not stored)`);
+		key = material;
+		keyId = input.keyId;
+	} else {
+		const issued = input.store.issueKey(input.group, input.keyName);
+		key = issued.key;
+		keyId = issued.keyId;
+	}
 	const serviceEntries = services.map(buildServiceEntry);
 	const relayUrls = input.relayUrls === void 0 ? [] : [...input.relayUrls];
 	const payload = {
 		v: 1,
 		invite: input.invite,
-		key: issued.key,
-		keyId: issued.keyId,
+		key,
+		keyId,
 		provider: {
 			alias: input.alias ?? input.store.alias ?? "provider",
 			endpointId: input.endpointId,
@@ -62,7 +73,7 @@ function buildShareLink(input) {
 		payload,
 		link: encodeShareLink(payload),
 		warnings,
-		keyId: issued.keyId
+		keyId
 	};
 }
 //#endregion
@@ -75,7 +86,9 @@ const SPEC = {
 	group: { type: "string" },
 	ttl: { type: "string" },
 	relay: { type: "multi" },
-	"allow-relayless": { type: "boolean" }
+	"allow-relayless": { type: "boolean" },
+	"key-id": { type: "string" },
+	"key-name": { type: "string" }
 };
 async function run(argv, ctx = {}) {
 	let fabric;
@@ -97,7 +110,9 @@ async function run(argv, ctx = {}) {
 			group,
 			invite,
 			endpointId: fabric.endpointId,
-			relayUrls: relayStatus.urls
+			relayUrls: relayStatus.urls,
+			keyId: str(options["key-id"]),
+			keyName: str(options["key-name"])
 		});
 		process.stdout.write([
 			`share link for group '${group}' (keyId ${result.keyId}, ttl ${describeTtl(ttlMs)}):`,

package/dist/{status-SkNsxGnk.mjs → status-DSVQ3YHm.mjs}

@@ -1,9 +1,9 @@
 import { r as reportCliError } from "./errors-BGtxPkM7.mjs";
 import { n as parseArgv } from "./args-CSxXW9eD.mjs";
 import { t as resolveHttpProxy } from "./proxy-D7VMUVEg.mjs";
-import { d as str, l as resolveDataDir, r as openStore, u as resolvedRelayUrls } from "./common-CqxqIg6D.mjs";
-import { t as openExistingFabric } from "./serve-Be4zdKVj.mjs";
-import { c as detailDisplayLines, o as buildServiceDetail } from "./rewrite-xZHWnyJk.mjs";
+import { d as str, l as resolveDataDir, r as openStore, u as resolvedRelayUrls } from "./common-C51SAE5f.mjs";
+import { t as openExistingFabric } from "./serve-CY7ZFOFM.mjs";
+import { c as detailDisplayLines, o as buildServiceDetail } from "./rewrite-CEzfYH9n.mjs";
 import { homedir } from "node:os";
 //#region src/cli/commands/provider/status.ts
 const SPEC = {

package/dist/{status-Bttb9aPj.mjs → status-uE2-kOyK.mjs}

@@ -1,7 +1,7 @@
 import { n as parseArgv } from "./args-CSxXW9eD.mjs";
-import { n as consumersRoot, s as listKeyrings } from "./store-CQShpYar.mjs";
-import { a as ringsForRun, n as ctxHomedir, r as ctxOut, t as createSdkFabricFactory } from "./common-CgxCXeTt.mjs";
-import { n as createFabricProviderTransport, t as startEngine } from "./runtime-DNs9GtGp.mjs";
+import { n as consumersRoot, s as listKeyrings } from "./store-DOFDy1rY.mjs";
+import { a as ringsForRun, n as ctxHomedir, r as ctxOut, t as createSdkFabricFactory } from "./common-CanLn0Qt.mjs";
+import { n as createFabricProviderTransport, t as startEngine } from "./runtime-C_pLA5F0.mjs";
 import { homedir } from "node:os";
 //#region src/cli/commands/consumer/status.ts
 /** 状态显示名（spec 六态）。 */

package/dist/{store-CQShpYar.mjs → store-DOFDy1rY.mjs}

@@ -1,6 +1,6 @@
 import { t as CliError } from "./errors-BGtxPkM7.mjs";
-import { s as randomZ32 } from "./rpc-contract-5qyWzT5t.mjs";
-import { l as SERVICE_ENTRY_SCHEMA } from "./frames-BDqvhB2Y.mjs";
+import { s as randomZ32 } from "./rpc-contract-cB5SuyQ_.mjs";
+import { l as SERVICE_ENTRY_SCHEMA } from "./frames-BDz8buix.mjs";
 import { chmodSync, existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";