ai-fly 0.4.0-alpha.2 → 0.4.0-alpha.3

package/dist/ai-fly.js

@@ -62,7 +62,7 @@ async function dispatch(command, rest) {
 	const lazy = (load) => {
 		return (argv, ctx) => load().then((m) => m.run([...argv], ctx));
 	};
-	return match(command).with("serve", () => lazy(() => import("./serve-FjBsmK5n.mjs"))(rest)).with("app", async () => {
+	return match(command).with("serve", () => lazy(() => import("./serve-CRcqQR0j.mjs"))(rest)).with("app", async () => {
 		const { join, dirname } = await import("node:path");
 		const { fileURLToPath } = await import("node:url");
 		const { spawn } = await import("node:child_process");
@@ -77,7 +77,7 @@ async function dispatch(command, rest) {
 		return await new Promise((resolve) => {
 			child.once("exit", (c) => resolve(c ?? 0));
 		});
-	}).with("daemon", () => lazy(() => import("./daemon-C4kj0IwL.mjs"))(rest)).with("presets", () => lazy(() => import("./presets-DRO5N4Vm.mjs"))(rest)).with("secret", () => lazy(() => import("./secret-DKN75Vry.mjs"))(rest)).with("settings", async () => (await import("./settings-Dho5hk5Z.mjs")).runAsSettings(rest, {})).with("relay", async () => (await import("./settings-Dho5hk5Z.mjs")).runAsRelay(rest, {})).with("test", () => lazy(() => import("./test-Dxkkc-KN.mjs"))(rest)).with("service", () => lazy(() => import("./service-DnQhGK4m.mjs"))(rest)).with("group", () => lazy(() => import("./group-CjwGDch3.mjs"))(rest)).with("share", () => lazy(() => import("./share-DpQPO1eC.mjs"))(rest)).with("revoke", () => lazy(() => import("./revoke-CXTcFgoT.mjs"))(rest)).with("join", () => lazy(() => import("./join-BJMcNGV-.mjs"))(rest)).with("import", () => lazy(() => import("./import-Zy3LL_PR.mjs"))(rest)).with("run", () => lazy(() => import("./run-W7DBz_bR.mjs"))(rest)).with("ports", () => lazy(() => import("./ports-Csv91JOD.mjs"))(rest)).with("forget", () => lazy(() => import("./forget-oMwM-SsU.mjs"))(rest)).with("key", () => {
+	}).with("daemon", () => lazy(() => import("./daemon-CuxLimRD.mjs"))(rest)).with("presets", () => lazy(() => import("./presets-DRO5N4Vm.mjs"))(rest)).with("secret", () => lazy(() => import("./secret-DKN75Vry.mjs"))(rest)).with("settings", async () => (await import("./settings-Dho5hk5Z.mjs")).runAsSettings(rest, {})).with("relay", async () => (await import("./settings-Dho5hk5Z.mjs")).runAsRelay(rest, {})).with("test", () => lazy(() => import("./test-Dxkkc-KN.mjs"))(rest)).with("service", () => lazy(() => import("./service-CJq7aSR0.mjs"))(rest)).with("group", () => lazy(() => import("./group-CjwGDch3.mjs"))(rest)).with("share", () => lazy(() => import("./share-D7ChVNte.mjs"))(rest)).with("revoke", () => lazy(() => import("./revoke-h1X8Xr_T.mjs"))(rest)).with("join", () => lazy(() => import("./join-BJMcNGV-.mjs"))(rest)).with("import", () => lazy(() => import("./import-Zy3LL_PR.mjs"))(rest)).with("run", () => lazy(() => import("./run-W7DBz_bR.mjs"))(rest)).with("ports", () => lazy(() => import("./ports-Csv91JOD.mjs"))(rest)).with("forget", () => lazy(() => import("./forget-oMwM-SsU.mjs"))(rest)).with("key", () => {
 		if (rest[0] === "add") return lazy(() => import("./key-BcNxtRJx.mjs"))(rest);
 		return lazy(() => import("./key-TP7lZeqW.mjs"))(rest);
 	}).with("status", async () => {
@@ -86,7 +86,7 @@ async function dispatch(command, rest) {
 		const wantConsumer = scope === "consumer" || scope !== "provider" && consumersRootExists();
 		const argv = scope === "provider" || scope === "consumer" ? tail : rest;
 		let code = 0;
-		if (wantProvider) code = Math.max(code, await lazy(() => import("./status-Ce-lxy52.mjs"))(argv));
+		if (wantProvider) code = Math.max(code, await lazy(() => import("./status-0NYOen8x.mjs"))(argv));
 		if (wantConsumer) code = Math.max(code, await lazy(() => import("./status-BaRyycxh.mjs"))(argv));
 		if (!wantProvider && !wantConsumer) process.stdout.write("nothing to report: no provider storage and no imported consumers\n");
 		return code;

package/dist/app/main.js

@@ -1,3 +1,4 @@
+import { createRequire } from "node:module";
 import { appendFileSync, chmodSync, existsSync, mkdirSync, promises, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statSync, watch, writeFileSync } from "node:fs";
 import { homedir, platform } from "node:os";
 import path, { dirname, isAbsolute, join, resolve } from "node:path";
@@ -2624,6 +2625,41 @@ function evalJsonPath(root, jsonPath) {
 	}
 	return cur;
 }
+function parseScriptRef(value) {
+	let body = value.slice(8);
+	let bearer = false;
+	if (body.endsWith("?bearer")) {
+		bearer = true;
+		body = body.slice(0, -7);
+	}
+	if (body === "") return null;
+	return {
+		path: body,
+		bearer
+	};
+}
+/**
+* 默认脚本凭据源：createRequire 同步加载 CJS 模块并返回其导出——
+* 函数导出由 resolveHeaderValue 每请求调用（值按调用计算，token 刷新即刻生效）；
+* 脚本文件本身的修改需重启 daemon（require 缓存，跨 Node/Bun/Deno 一致）。
+* 信任模型与 $cmd 等价：脚本以 ai-fly 同权限执行宿主 IO（无 VM 隔离——
+* node:vm 非安全边界且 Bun/Deno 支持残缺，Owner 裁决 2026-09-12 取简方案）。
+*/
+const defaultScriptCredentialSource = (modulePath) => {
+	try {
+		return createRequire(import.meta.url)(modulePath);
+	} catch {
+		return;
+	}
+};
+/** 脚本导出归一：函数 / {default: fn} 取函数；其余视为无效（undefined）。 */
+function scriptExportFn(mod) {
+	if (typeof mod === "function") return mod;
+	if (mod !== null && typeof mod === "object" && "default" in mod) {
+		const d = mod.default;
+		if (typeof d === "function") return d;
+	}
+}
 /** 默认文件凭据源：读文件 + JSON 解析 + 点径求值（仅字符串值；`~` 已在上层展开）。 */
 const defaultFileCredentialSource = (path, jsonPath) => {
 	let raw;
@@ -2649,7 +2685,7 @@ const defaultFileCredentialSource = (path, jsonPath) => {
 * `$env:<VAR>` 语义保持——空串/未设置返回 undefined（= 省略该头）。
 * 各源可并存于不同头（逐头独立解析）。
 */
-function resolveHeaderValue(value, env, secrets, files = defaultFileCredentialSource) {
+function resolveHeaderValue(value, env, secrets, files = defaultFileCredentialSource, scripts = defaultScriptCredentialSource) {
 	if (value.startsWith("$secret:")) {
 		const name = value.slice(8);
 		const resolved = secrets?.(name);
@@ -2663,6 +2699,20 @@ function resolveHeaderValue(value, env, secrets, files = defaultFileCredentialSo
 		if (resolved === void 0 || resolved === "") throw new SecretMissingError();
 		return ref.bearer ? `Bearer ${resolved}` : resolved;
 	}
+	if (value.startsWith("$script:")) {
+		const ref = parseScriptRef(value);
+		if (ref === null) throw new SecretMissingError();
+		const fn = scriptExportFn(scripts(ref.path.startsWith("~/") ? join(homedir(), ref.path.slice(1)) : ref.path));
+		if (fn === void 0) throw new SecretMissingError();
+		let resolved;
+		try {
+			resolved = fn({ homedir: homedir() });
+		} catch {
+			throw new SecretMissingError();
+		}
+		if (typeof resolved !== "string" || resolved === "") throw new SecretMissingError();
+		return ref.bearer ? `Bearer ${resolved}` : resolved;
+	}
 	if (!value.startsWith("$env:")) return value;
 	const name = value.slice(5);
 	if (name === "") return void 0;

package/dist/{daemon-C4kj0IwL.mjs → daemon-CuxLimRD.mjs}

@@ -99,7 +99,7 @@ async function start(startArgv, home) {
 	process.on("exit", () => {
 		clearPid(home);
 	});
-	const { run: serveRun } = await import("./serve-FjBsmK5n.mjs");
+	const { run: serveRun } = await import("./serve-CRcqQR0j.mjs");
 	return serveRun([...startArgv], { homedir: home });
 }
 /** 后台 pid（活性核验；陈旧 pidfile 就地清理返回 null）。 */

package/dist/{revoke-CXTcFgoT.mjs → revoke-h1X8Xr_T.mjs}

@@ -2,7 +2,7 @@ import { n as UsageError, r as reportCliError } from "./errors-BGtxPkM7.mjs";
 import { n as parseArgv } from "./args-CSxXW9eD.mjs";
 import { t as resolveHttpProxy } from "./proxy-D7VMUVEg.mjs";
 import { d as str, l as resolveDataDir, u as resolvedRelayUrls } from "./common-BwKEJKOZ.mjs";
-import { t as openExistingFabric } from "./serve-GRJthOwO.mjs";
+import { t as openExistingFabric } from "./serve-B61VHcLi.mjs";
 import { homedir } from "node:os";
 //#region src/cli/commands/provider/revoke.ts
 const SPEC = {

package/dist/{rewrite-BL3jNnFZ.mjs → rewrite-WI8Ly8RX.mjs}

@@ -1,6 +1,7 @@
 import { a as routeLocalPrefix } from "./rpc-contract-CdiRZhUn.mjs";
 import { n as FORBIDDEN_REQ_HEADER_NAMES } from "./frames-BDqvhB2Y.mjs";
 import { a as parseUpstreamUrl, c as matchRequestPath, o as expandUriTemplate, s as compileMatchPattern } from "./store-YUMvMCBg.mjs";
+import { createRequire } from "node:module";
 import { readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
@@ -164,6 +165,41 @@ function evalJsonPath(root, jsonPath) {
 	}
 	return cur;
 }
+function parseScriptRef(value) {
+	let body = value.slice(8);
+	let bearer = false;
+	if (body.endsWith("?bearer")) {
+		bearer = true;
+		body = body.slice(0, -7);
+	}
+	if (body === "") return null;
+	return {
+		path: body,
+		bearer
+	};
+}
+/**
+* 默认脚本凭据源：createRequire 同步加载 CJS 模块并返回其导出——
+* 函数导出由 resolveHeaderValue 每请求调用（值按调用计算，token 刷新即刻生效）；
+* 脚本文件本身的修改需重启 daemon（require 缓存，跨 Node/Bun/Deno 一致）。
+* 信任模型与 $cmd 等价：脚本以 ai-fly 同权限执行宿主 IO（无 VM 隔离——
+* node:vm 非安全边界且 Bun/Deno 支持残缺，Owner 裁决 2026-09-12 取简方案）。
+*/
+const defaultScriptCredentialSource = (modulePath) => {
+	try {
+		return createRequire(import.meta.url)(modulePath);
+	} catch {
+		return;
+	}
+};
+/** 脚本导出归一：函数 / {default: fn} 取函数；其余视为无效（undefined）。 */
+function scriptExportFn(mod) {
+	if (typeof mod === "function") return mod;
+	if (mod !== null && typeof mod === "object" && "default" in mod) {
+		const d = mod.default;
+		if (typeof d === "function") return d;
+	}
+}
 /** 默认文件凭据源：读文件 + JSON 解析 + 点径求值（仅字符串值；`~` 已在上层展开）。 */
 const defaultFileCredentialSource = (path, jsonPath) => {
 	let raw;
@@ -189,7 +225,7 @@ const defaultFileCredentialSource = (path, jsonPath) => {
 * `$env:<VAR>` 语义保持——空串/未设置返回 undefined（= 省略该头）。
 * 各源可并存于不同头（逐头独立解析）。
 */
-function resolveHeaderValue(value, env, secrets, files = defaultFileCredentialSource) {
+function resolveHeaderValue(value, env, secrets, files = defaultFileCredentialSource, scripts = defaultScriptCredentialSource) {
 	if (value.startsWith("$secret:")) {
 		const name = value.slice(8);
 		const resolved = secrets?.(name);
@@ -203,6 +239,20 @@ function resolveHeaderValue(value, env, secrets, files = defaultFileCredentialSo
 		if (resolved === void 0 || resolved === "") throw new SecretMissingError();
 		return ref.bearer ? `Bearer ${resolved}` : resolved;
 	}
+	if (value.startsWith("$script:")) {
+		const ref = parseScriptRef(value);
+		if (ref === null) throw new SecretMissingError();
+		const fn = scriptExportFn(scripts(ref.path.startsWith("~/") ? join(homedir(), ref.path.slice(1)) : ref.path));
+		if (fn === void 0) throw new SecretMissingError();
+		let resolved;
+		try {
+			resolved = fn({ homedir: homedir() });
+		} catch {
+			throw new SecretMissingError();
+		}
+		if (typeof resolved !== "string" || resolved === "") throw new SecretMissingError();
+		return ref.bearer ? `Bearer ${resolved}` : resolved;
+	}
 	if (!value.startsWith("$env:")) return value;
 	const name = value.slice(5);
 	if (name === "") return void 0;

package/dist/{route-test-DqKRThLp.mjs → route-test-D9Y4QmJn.mjs}

@@ -1,6 +1,6 @@
 import { n as ROUTE_LOCAL_PREFIX } from "./rpc-contract-CdiRZhUn.mjs";
 import { t as formProbe } from "./local-test-DbpiPEsD.mjs";
-import { i as buildUpstreamRequest, t as PathNotOfferedError } from "./rewrite-BL3jNnFZ.mjs";
+import { i as buildUpstreamRequest, t as PathNotOfferedError } from "./rewrite-WI8Ly8RX.mjs";
 //#region src/provider/route-test.ts
 const DEFAULT_TIMEOUT_MS = 2e4;
 const BODY_EXCERPT_MAX = 2e3;

package/dist/{serve-GRJthOwO.mjs → serve-B61VHcLi.mjs}

@@ -2,7 +2,7 @@ import { c as RESP_META_HEADER_WHITELIST, i as FRAME_TYPE, s as REJECTED_CODE, t
 import { n as loadSdk } from "./proxy-D7VMUVEg.mjs";
 import { i as ensurePrivateDir, r as atomicWriteFileSync, t as ProviderStore } from "./store-YUMvMCBg.mjs";
 import { n as FabricWireAdapter, r as DEFAULT_BODY_CHUNK_BYTES, t as WireSession } from "./mux-BEXBL7rE.mjs";
-import { a as collectEnvVarNames, i as buildUpstreamRequest, n as RewriteError, r as SecretMissingError, s as buildServiceEntry, t as PathNotOfferedError } from "./rewrite-BL3jNnFZ.mjs";
+import { a as collectEnvVarNames, i as buildUpstreamRequest, n as RewriteError, r as SecretMissingError, s as buildServiceEntry, t as PathNotOfferedError } from "./rewrite-WI8Ly8RX.mjs";
 import { t as SecretsStore } from "./secrets-DFdwYE_V.mjs";
 import { appendFileSync, existsSync, readFileSync, readdirSync, watch } from "node:fs";
 import "node:os";

package/dist/{serve-FjBsmK5n.mjs → serve-CRcqQR0j.mjs}

@@ -2,7 +2,7 @@ import { n as UsageError, r as reportCliError } from "./errors-BGtxPkM7.mjs";
 import { n as parseArgv } from "./args-CSxXW9eD.mjs";
 import { t as resolveHttpProxy } from "./proxy-D7VMUVEg.mjs";
 import { d as str, l as resolveDataDir, u as resolvedRelayUrls } from "./common-BwKEJKOZ.mjs";
-import { n as startProviderDaemon } from "./serve-GRJthOwO.mjs";
+import { n as startProviderDaemon } from "./serve-B61VHcLi.mjs";
 import { homedir } from "node:os";
 //#region src/cli/commands/provider/serve.ts
 const SPEC = {

package/dist/{service-DnQhGK4m.mjs → service-CJq7aSR0.mjs}

@@ -218,7 +218,7 @@ async function test(options, positionals, home) {
 		formRaw = (localPrefix !== void 0 ? routes.find((r) => r.localPrefix === localPrefix) : routes.length === 1 ? routes[0] : void 0)?.forms[0] ?? "openai-chat";
 	}
 	if (!ROUTE_FORMS.includes(formRaw)) throw new UsageError(`error: --form must be one of ${ROUTE_FORMS.join(", ")}`);
-	const { testServiceRoute } = await import("./route-test-DqKRThLp.mjs");
+	const { testServiceRoute } = await import("./route-test-D9Y4QmJn.mjs");
 	const { SecretsStore } = await import("./secrets-BKKxR3iB.mjs");
 	const secretsStore = SecretsStore.open(dataDir);
 	const hitLocalPrefix = options["local-prefix"] !== void 0 ? str(options["local-prefix"]) : (() => {

package/dist/{share-DpQPO1eC.mjs → share-D7ChVNte.mjs}

@@ -4,8 +4,8 @@ import { l as SERVICE_ENTRY_SCHEMA } from "./frames-BDqvhB2Y.mjs";
 import { t as resolveHttpProxy } from "./proxy-D7VMUVEg.mjs";
 import { n as StoreError } from "./store-YUMvMCBg.mjs";
 import { c as requireString, d as str, l as resolveDataDir, r as openStore, u as resolvedRelayUrls } from "./common-BwKEJKOZ.mjs";
-import { t as openExistingFabric } from "./serve-GRJthOwO.mjs";
-import { s as buildServiceEntry } from "./rewrite-BL3jNnFZ.mjs";
+import { t as openExistingFabric } from "./serve-B61VHcLi.mjs";
+import { s as buildServiceEntry } from "./rewrite-WI8Ly8RX.mjs";
 import { homedir } from "node:os";
 import { z } from "zod";
 //#region src/provider/link.ts

package/dist/{status-Ce-lxy52.mjs → status-0NYOen8x.mjs}

@@ -2,8 +2,8 @@ import { r as reportCliError } from "./errors-BGtxPkM7.mjs";
 import { n as parseArgv } from "./args-CSxXW9eD.mjs";
 import { t as resolveHttpProxy } from "./proxy-D7VMUVEg.mjs";
 import { d as str, l as resolveDataDir, r as openStore, u as resolvedRelayUrls } from "./common-BwKEJKOZ.mjs";
-import { t as openExistingFabric } from "./serve-GRJthOwO.mjs";
-import { c as detailDisplayLines, o as buildServiceDetail } from "./rewrite-BL3jNnFZ.mjs";
+import { t as openExistingFabric } from "./serve-B61VHcLi.mjs";
+import { c as detailDisplayLines, o as buildServiceDetail } from "./rewrite-WI8Ly8RX.mjs";
 import { homedir } from "node:os";
 //#region src/cli/commands/provider/status.ts
 const SPEC = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ai-fly",
-  "version": "0.4.0-alpha.2",
+  "version": "0.4.0-alpha.3",
   "description": "ai-fly — peer-to-peer HTTP/WebSocket bridge with AI-ready presets, over OpenDWeb fabric",
   "license": "MIT OR Apache-2.0",
   "type": "module",