ai-fly 0.3.2 → 0.4.0-alpha.10

package/dist/{store-CrTUwskE.mjs → store-EGzVd-dn.mjs}

@@ -1,4 +1,4 @@
-import { n as ROUTE_LOCAL_PREFIX, s as randomZ32 } from "./rpc-contract-5qyWzT5t.mjs";
+import { n as ROUTE_LOCAL_PREFIX, s as randomZ32 } from "./rpc-contract-cB5SuyQ_.mjs";
 import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { z } from "zod";
@@ -189,7 +189,11 @@ const SERVICE_REWRITE_STORE_SCHEMA = z.strictObject({
 	hostHeader: z.string().min(1).max(2048).optional(),
 	pathPrefixStrip: z.string().min(1).max(2048).optional(),
 	pathPrefixAppend: z.string().min(1).max(2048).optional(),
-	headerSet: z.record(z.string().min(1).max(1024), z.string().max(8192)).optional(),
+	headerSet: z.record(z.string().min(1).max(1024), z.union([z.string().max(8192), z.strictObject({
+		hook: z.string().min(1).max(128),
+		args: z.record(z.string().min(1).max(128), z.string().max(2048)).optional(),
+		bearer: z.boolean().optional()
+	})])).optional(),
 	headerRemove: z.array(z.string().min(1).max(1024)).max(32).optional()
 });
 /** 路径路由（M3-r7）：按声明顺序命中的转发规则——prefix 模式（默认，
@@ -213,6 +217,8 @@ const SERVICE_STORE_SCHEMA = z.strictObject({
 	match: z.array(SERVICE_MATCH_STORE_SCHEMA).max(64),
 	upstream: z.string().min(1).max(2048),
 	rewrite: SERVICE_REWRITE_STORE_SCHEMA.optional(),
+	/** 选中的 hooks 脚本名（内建库或 ~/.aifly/hooks/<name>.cjs）。 */
+	hooks: z.string().regex(/^[a-z][a-z0-9_-]{0,63}$/).optional(),
 	routes: z.array(SERVICE_ROUTE_STORE_SCHEMA).max(3).optional(),
 	defaultPort: z.number().int().min(1).max(65535)
 });
@@ -229,9 +235,17 @@ const KEY_STORE_SCHEMA = z.strictObject({
 	keyId: z.string().min(1).max(128),
 	group: z.string().min(1).max(256),
 	hash: z.string().regex(/^[0-9a-f]{64}$/, "key hash must be 64 hex chars"),
+	/** key 名（Owner 裁决 2026-09-13：签发时必填，GUI 分组视图按名展示；
+	*  旧记录无此字段——迁移容忍，GUI 显示为未命名）。 */
+	name: z.string().min(1).max(128).optional(),
+	/** key 原文（Owner 裁决 2026-09-13：可随时复制取代仅签发时可见——本机
+	*  个人工具与密钥库明文同一威胁模型；旧记录只存哈希，无法补录）。 */
+	key: z.string().min(8).max(256).optional(),
 	createdAt: z.number().int().min(0),
 	revokedAt: z.number().int().min(0).optional()
 });
+/** key 名规则（同 SECRET_NAME_SCHEMA 词汇：小写开头，点横杠下划线）。 */
+const KEY_NAME_SCHEMA = /^[a-z0-9][a-z0-9._-]*$/;
 const STORE_FILE_SCHEMA = z.strictObject({
 	revision: z.number().int().min(0),
 	meta: z.strictObject({ alias: z.string().min(1).max(256).optional() }).optional(),
@@ -364,6 +378,7 @@ var ProviderStore = class ProviderStore {
 			match: input.match.map((m) => ({ ...m })),
 			upstream: upstreamUrl.href,
 			rewrite,
+			...input.hooks !== void 0 ? { hooks: input.hooks } : {},
 			...routes !== void 0 ? { routes } : {},
 			defaultPort
 		};
@@ -466,9 +481,11 @@ var ProviderStore = class ProviderStore {
 	listKeys() {
 		return this.data.keys.map((k) => ({ ...k }));
 	}
-	/** 签发：原文仅本次返回，存储只落哈希。 */
-	issueKey(groupName) {
+	/** 签发：name 缺省 "default"；原文随记录落库（Owner 2026-09-13：随时
+	*  可复制）。name 是展示标签非身份（keyId 唯一），同组可重名。 */
+	issueKey(groupName, name = "default") {
 		if (this.getGroup(groupName) === void 0) throw new StoreError("not-found", `error: group '${groupName}' not found`);
+		if (!KEY_NAME_SCHEMA.test(name)) throw new StoreError("invalid", "error: key name must match /^[a-z0-9][a-z0-9._-]*$/");
 		let keyId;
 		do
 			keyId = randomZ32(8);
@@ -479,6 +496,8 @@ var ProviderStore = class ProviderStore {
 			keyId,
 			group: groupName,
 			hash: hashKeyMaterial(key),
+			name,
+			key,
 			createdAt
 		});
 		this.save();
@@ -488,6 +507,12 @@ var ProviderStore = class ProviderStore {
 			createdAt
 		};
 	}
+	/** key 原文取回（旧记录只存哈希 → undefined；撤销/不存在 → undefined）。 */
+	getKeyMaterial(keyId) {
+		const found = this.data.keys.find((k) => k.keyId === keyId);
+		if (found === void 0 || found.revokedAt !== void 0) return void 0;
+		return found.key;
+	}
 	/** 撤销（幂等：已撤销为 no-op）。 */
 	revokeKey(keyId) {
 		const found = this.data.keys.find((k) => k.keyId === keyId);

package/dist/{test-mlaZC1y5.mjs → test-DW4BF7xJ.mjs}

@@ -1,8 +1,8 @@
 import { n as UsageError, r as reportCliError } from "./errors-BGtxPkM7.mjs";
 import { n as parseArgv } from "./args-CSxXW9eD.mjs";
-import { n as consumersRoot, s as listKeyrings } from "./store-CQShpYar.mjs";
+import { n as consumersRoot, s as listKeyrings } from "./store-DOFDy1rY.mjs";
 import { n as desiredPortFor } from "./ports-pI59MtmI.mjs";
-import { n as testLocalService } from "./local-test-C3HGjGY3.mjs";
+import { n as testLocalService } from "./local-test-BZHGo22F.mjs";
 import { homedir } from "node:os";
 //#region src/cli/commands/consumer/test.ts
 const SPEC = {

package/hooks/codex.cjs

@@ -0,0 +1,12 @@
+// 内建 hooks 脚本：codex —— 读 codex CLI 登录态（~/.codex/auth.json）。
+// 钩子清单（按函数名命名规范被发现）：
+// - authHeader(ctx) -> string：ChatGPT Codex backend 的 Bearer 认证头（去前缀裸值，
+//   框架按需拼 "Bearer " 由 headerSet 配置的 bearer 决定——本脚本返回裸 token）。
+module.exports.authHeader = function authHeader({ homedir }) {
+  const { readFileSync } = require("node:fs");
+  const { join } = require("node:path");
+  const auth = JSON.parse(readFileSync(join(homedir, ".codex", "auth.json"), "utf8"));
+  const token = auth && auth.tokens && auth.tokens.access_token;
+  if (typeof token !== "string" || token === "") throw new Error("codex auth.json missing access_token");
+  return token;
+};

package/hooks/env.cjs

@@ -0,0 +1,10 @@
+// 内建 hooks 脚本：env —— 环境变量桥。
+// 钩子清单：
+// - authHeader(ctx) -> string：读 args.var 指定的环境变量（OPENAI_API_KEY 等）。
+module.exports.authHeader = function authHeader({ args, env: ctxEnv }) {
+  const name = args && args.var;
+  if (typeof name !== "string" || name === "") throw new Error("env hook requires args.var");
+  const value = (ctxEnv && ctxEnv(name)) || process.env[name];
+  if (value === undefined || value === "") throw new Error(`env '${name}' unset`);
+  return value;
+};

package/hooks/file.cjs

@@ -0,0 +1,27 @@
+// 内建 hooks 脚本：file —— JSON 文件取值（点径）。
+// 钩子清单：
+// - authHeader(ctx) -> string：读 args.path（支持 ~）+ args.jsonPath（.a.b 风格）；
+//   args.bearer 为 "true"/"1" 时返回值拼 "Bearer " 前缀。
+//   watch 模式示例（返回 AsyncIterable）：unwatchOnClose 实现见文档。
+module.exports.authHeader = function authHeader({ homedir, args }) {
+  const { readFileSync } = require("node:fs");
+  const { join } = require("node:path");
+  const path = args && args.path;
+  const jsonPath = (args && args.jsonPath) || ".";
+  if (typeof path !== "string" || path === "") throw new Error("file hook requires args.path");
+  const abs = path.startsWith("~/") ? join(homedir, path.slice(1)) : path;
+  let doc;
+  try {
+    doc = JSON.parse(readFileSync(abs, "utf8"));
+  } catch {
+    throw new Error("file unreadable or invalid JSON");
+  }
+  let cur = doc;
+  for (const seg of jsonPath.split(".").filter(Boolean)) {
+    if (cur === null || cur === undefined) throw new Error("json path miss");
+    cur = cur[seg];
+  }
+  if (typeof cur !== "string" || cur === "") throw new Error("json path value missing");
+  const bearer = args && (args.bearer === "true" || args.bearer === "1");
+  return bearer ? `Bearer ${cur}` : cur;
+};

package/hooks/secret.cjs

@@ -0,0 +1,11 @@
+// 内建 hooks 脚本：secret —— 密钥库（SecretsStore）桥。
+// 钩子清单：
+// - authHeader(ctx) -> string：读 args.name 指定的密钥（ctx.secrets 访问器；
+//   值只进头不回显——$secret 法则不变）。
+module.exports.authHeader = function authHeader({ args, secrets }) {
+  const name = args && args.name;
+  if (typeof name !== "string" || name === "") throw new Error("secret hook requires args.name");
+  const value = secrets && secrets(name);
+  if (value === undefined || value === "") throw new Error(`secret '${name}' not found`);
+  return value;
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ai-fly",
-  "version": "0.3.2",
+  "version": "0.4.0-alpha.10",
   "description": "ai-fly — peer-to-peer HTTP/WebSocket bridge with AI-ready presets, over OpenDWeb fabric",
   "license": "MIT OR Apache-2.0",
   "type": "module",
@@ -58,7 +58,11 @@
   "files": [
     "dist/*.js",
     "dist/*.mjs",
-    "dist/*.d.ts"
+    "dist/*.d.ts",
+    "dist/app/**",
+    "hooks",
+    "webui/dist",
+    "resources/app-icons"
   ],
   "repository": {
     "type": "git",

package/resources/app-icons/app-icon.json

@@ -0,0 +1,84 @@
+{
+  "schemaVersion": 1,
+  "appIcon": [
+    {
+      "platform": "darwin",
+      "format": "icns",
+      "source": {
+        "type": "file",
+        "path": "app-icon.icns"
+      }
+    },
+    {
+      "platform": "windows",
+      "format": "ico",
+      "source": {
+        "type": "file",
+        "path": "app-icon.ico"
+      }
+    },
+    {
+      "platform": "linux",
+      "format": "png",
+      "size": 16,
+      "source": {
+        "type": "file",
+        "path": "linux/16x16/app-icon.png"
+      }
+    },
+    {
+      "platform": "linux",
+      "format": "png",
+      "size": 32,
+      "source": {
+        "type": "file",
+        "path": "linux/32x32/app-icon.png"
+      }
+    },
+    {
+      "platform": "linux",
+      "format": "png",
+      "size": 48,
+      "source": {
+        "type": "file",
+        "path": "linux/48x48/app-icon.png"
+      }
+    },
+    {
+      "platform": "linux",
+      "format": "png",
+      "size": 64,
+      "source": {
+        "type": "file",
+        "path": "linux/64x64/app-icon.png"
+      }
+    },
+    {
+      "platform": "linux",
+      "format": "png",
+      "size": 128,
+      "source": {
+        "type": "file",
+        "path": "linux/128x128/app-icon.png"
+      }
+    },
+    {
+      "platform": "linux",
+      "format": "png",
+      "size": 256,
+      "source": {
+        "type": "file",
+        "path": "linux/256x256/app-icon.png"
+      }
+    },
+    {
+      "platform": "linux",
+      "format": "png",
+      "size": 512,
+      "source": {
+        "type": "file",
+        "path": "linux/512x512/app-icon.png"
+      }
+    }
+  ]
+}