ai-fly 0.4.0-alpha.8 → 0.4.0

package/dist/ai-fly.js

@@ -63,7 +63,7 @@ async function dispatch(command, rest) {
 	const lazy = (load) => {
 		return (argv, ctx) => load().then((m) => m.run([...argv], ctx));
 	};
-	return match(command).with("serve", () => lazy(() => import("./serve-B4f79Eqq.mjs"))(rest)).with("app", async () => {
+	return match(command).with("serve", () => lazy(() => import("./serve-B51lmr9M.mjs"))(rest)).with("app", async () => {
 		const { join, dirname } = await import("node:path");
 		const { fileURLToPath } = await import("node:url");
 		const { spawn } = await import("node:child_process");
@@ -78,17 +78,17 @@ async function dispatch(command, rest) {
 		return await new Promise((resolve) => {
 			child.once("exit", (c) => resolve(c ?? 0));
 		});
-	}).with("daemon", () => lazy(() => import("./daemon-iqO29D7K.mjs"))(rest)).with("presets", () => lazy(() => import("./presets-Do5DWXfQ.mjs"))(rest)).with("hooks", () => lazy(() => import("./hooks-BeBzkBL-.mjs"))(rest)).with("secret", () => lazy(() => import("./secret-Ds6pIoLP.mjs"))(rest)).with("settings", async () => (await import("./settings-CSran7QD.mjs")).runAsSettings(rest, {})).with("relay", async () => (await import("./settings-CSran7QD.mjs")).runAsRelay(rest, {})).with("test", () => lazy(() => import("./test-BERWIlFb.mjs"))(rest)).with("service", () => lazy(() => import("./service-CYkpuJuc.mjs"))(rest)).with("group", () => lazy(() => import("./group-C13I2bCR.mjs"))(rest)).with("share", () => lazy(() => import("./share-B94HhX_b.mjs"))(rest)).with("revoke", () => lazy(() => import("./revoke-6lrZkjN4.mjs"))(rest)).with("join", () => lazy(() => import("./join-BHhCLh9B.mjs"))(rest)).with("import", () => lazy(() => import("./import-BhasJTGS.mjs"))(rest)).with("run", () => lazy(() => import("./run-BLxeLngt.mjs"))(rest)).with("ports", () => lazy(() => import("./ports-DDM5bbJg.mjs"))(rest)).with("forget", () => lazy(() => import("./forget-BIorc8Rx.mjs"))(rest)).with("key", () => {
-		if (rest[0] === "add") return lazy(() => import("./key-DdZsNmo_.mjs"))(rest);
-		return lazy(() => import("./key-DYeTZ7MI.mjs"))(rest);
+	}).with("daemon", () => lazy(() => import("./daemon-BWgyJMyB.mjs"))(rest)).with("presets", () => lazy(() => import("./presets-DleOUQiT.mjs"))(rest)).with("hooks", () => lazy(() => import("./hooks-DUrXA7PL.mjs"))(rest)).with("secret", () => lazy(() => import("./secret-P2RgHy2h.mjs"))(rest)).with("settings", async () => (await import("./settings-Rq1zLoxY.mjs")).runAsSettings(rest, {})).with("relay", async () => (await import("./settings-Rq1zLoxY.mjs")).runAsRelay(rest, {})).with("test", () => lazy(() => import("./test-DW4BF7xJ.mjs"))(rest)).with("service", () => lazy(() => import("./service-D6TNolyh.mjs"))(rest)).with("group", () => lazy(() => import("./group-BdnvRD2t.mjs"))(rest)).with("share", () => lazy(() => import("./share-DdtbAylA.mjs"))(rest)).with("revoke", () => lazy(() => import("./revoke-DTFW_EF1.mjs"))(rest)).with("join", () => lazy(() => import("./join-d-pqyf8e.mjs"))(rest)).with("import", () => lazy(() => import("./import-CTkKGPsa.mjs"))(rest)).with("run", () => lazy(() => import("./run-D8kgXdId.mjs"))(rest)).with("ports", () => lazy(() => import("./ports-TQ4tWmiJ.mjs"))(rest)).with("forget", () => lazy(() => import("./forget-B3KRkHho.mjs"))(rest)).with("key", () => {
+		if (rest[0] === "add") return lazy(() => import("./key-D_66hrWW.mjs"))(rest);
+		return lazy(() => import("./key-CTL_AXOh.mjs"))(rest);
 	}).with("status", async () => {
 		const [scope, ...tail] = rest;
 		const wantProvider = scope === "provider" || scope !== "consumer" && providerDirExists();
 		const wantConsumer = scope === "consumer" || scope !== "provider" && consumersRootExists();
 		const argv = scope === "provider" || scope === "consumer" ? tail : rest;
 		let code = 0;
-		if (wantProvider) code = Math.max(code, await lazy(() => import("./status-BFpr-LHB.mjs"))(argv));
-		if (wantConsumer) code = Math.max(code, await lazy(() => import("./status-C_EI8-b9.mjs"))(argv));
+		if (wantProvider) code = Math.max(code, await lazy(() => import("./status-DSVQ3YHm.mjs"))(argv));
+		if (wantConsumer) code = Math.max(code, await lazy(() => import("./status-uE2-kOyK.mjs"))(argv));
 		if (!wantProvider && !wantConsumer) process.stdout.write("nothing to report: no provider storage and no imported consumers\n");
 		return code;
 	}).otherwise(() => {

package/dist/app/main.js

@@ -134,12 +134,15 @@ const GROUP_SCHEMA = z.strictObject({
 	serviceIds: z.array(z.string().min(1).max(128)).max(256),
 	limits: GROUP_LIMITS_SCHEMA.optional()
 });
-/** 密钥视图：keyId/分组/时间/状态；哈希与原文一律不进契约（原文仅 issue 时一次性返回）。 */
+/** 密钥视图：keyId/分组/时间/状态 + 名 + 原文（Owner 2026-09-13：随时可
+*  复制——原文随库返回；旧记录只存哈希 → 两字段皆缺省）。 */
 const KEY_VIEW_SCHEMA = z.strictObject({
 	keyId: z.string().min(1).max(128),
 	group: z.string().min(1).max(256),
 	createdAt: z.number().int().min(0),
-	revokedAt: z.number().int().min(0).optional()
+	revokedAt: z.number().int().min(0).optional(),
+	name: z.string().min(1).max(128).optional(),
+	key: z.string().min(8).max(256).optional()
 });
 /** 使用方服务目录条目（AUTH_OK / import 视图；detail 为脱敏披露，$env 值显示 ●）。 */
 const SERVICE_ENTRY_SCHEMA$1 = z.object({
@@ -301,7 +304,11 @@ const SETTINGS_SCHEMA = z.strictObject({
 const SHARE_CREATE_INPUT_SCHEMA = z.strictObject({
 	group: z.string().min(1).max(256),
 	/** TTL 毫秒（1s..30d；缺省 60min——范围校验复用 link.ts 常量语义）。 */
-	ttlMs: z.number().int().min(1e3).max(2592e6).optional()
+	ttlMs: z.number().int().min(1e3).max(2592e6).optional(),
+	/** 复用既有 key（现铸 invite 重发链接；缺省签发新钥）。 */
+	keyId: z.string().min(1).max(128).optional(),
+	/** 新钥名（缺省签发路径下默认 "default"）。 */
+	keyName: z.string().min(1).max(128).optional()
 });
 const PRESET_APPLY_INPUT_SCHEMA = z.strictObject({
 	presetId: z.string().min(1).max(128),
@@ -440,13 +447,16 @@ const rpcContract = oc.errors(RpcErrorDefinitions).router({
 			remove: oc.input(z.strictObject({ name: z.string().min(1).max(256) })).output(z.object({ removed: z.literal(true) }))
 		},
 		keys: {
-			/** 签发（原文仅本次返回；此后只余哈希）。 */
-			issue: oc.input(z.strictObject({ group: z.string().min(1).max(256) })).output(z.object({
+			/** 签发（name 缺省 "default"；原文随库可再取）。 */
+			issue: oc.input(z.strictObject({
+				group: z.string().min(1).max(256),
+				name: z.string().min(1).max(128).optional()
+			})).output(z.object({
 				keyId: z.string(),
 				key: z.string(),
 				createdAt: z.number().int()
 			})),
-			/** 密钥清单（无哈希、无原文）。 */
+			/** 密钥清单（含名与原文——本机 GUI 随时复制；无哈希）。 */
 			list: oc.input(z.object({})).output(z.object({ keys: z.array(KEY_VIEW_SCHEMA) })),
 			/** 撤销（幂等）。 */
 			revoke: oc.input(z.strictObject({ keyId: z.string().min(1).max(128) })).output(z.object({ key: KEY_VIEW_SCHEMA }))
@@ -926,9 +936,17 @@ const KEY_STORE_SCHEMA = z.strictObject({
 	keyId: z.string().min(1).max(128),
 	group: z.string().min(1).max(256),
 	hash: z.string().regex(/^[0-9a-f]{64}$/, "key hash must be 64 hex chars"),
+	/** key 名（Owner 裁决 2026-09-13：签发时必填，GUI 分组视图按名展示；
+	*  旧记录无此字段——迁移容忍，GUI 显示为未命名）。 */
+	name: z.string().min(1).max(128).optional(),
+	/** key 原文（Owner 裁决 2026-09-13：可随时复制取代仅签发时可见——本机
+	*  个人工具与密钥库明文同一威胁模型；旧记录只存哈希，无法补录）。 */
+	key: z.string().min(8).max(256).optional(),
 	createdAt: z.number().int().min(0),
 	revokedAt: z.number().int().min(0).optional()
 });
+/** key 名规则（同 SECRET_NAME_SCHEMA 词汇：小写开头，点横杠下划线）。 */
+const KEY_NAME_SCHEMA = /^[a-z0-9][a-z0-9._-]*$/;
 const STORE_FILE_SCHEMA = z.strictObject({
 	revision: z.number().int().min(0),
 	meta: z.strictObject({ alias: z.string().min(1).max(256).optional() }).optional(),
@@ -1164,9 +1182,11 @@ var ProviderStore = class ProviderStore {
 	listKeys() {
 		return this.data.keys.map((k) => ({ ...k }));
 	}
-	/** 签发：原文仅本次返回，存储只落哈希。 */
-	issueKey(groupName) {
+	/** 签发：name 缺省 "default"；原文随记录落库（Owner 2026-09-13：随时
+	*  可复制）。name 是展示标签非身份（keyId 唯一），同组可重名。 */
+	issueKey(groupName, name = "default") {
 		if (this.getGroup(groupName) === void 0) throw new StoreError("not-found", `error: group '${groupName}' not found`);
+		if (!KEY_NAME_SCHEMA.test(name)) throw new StoreError("invalid", "error: key name must match /^[a-z0-9][a-z0-9._-]*$/");
 		let keyId;
 		do
 			keyId = randomZ32(8);
@@ -1177,6 +1197,8 @@ var ProviderStore = class ProviderStore {
 			keyId,
 			group: groupName,
 			hash: hashKeyMaterial(key),
+			name,
+			key,
 			createdAt
 		});
 		this.save();
@@ -1186,6 +1208,12 @@ var ProviderStore = class ProviderStore {
 			createdAt
 		};
 	}
+	/** key 原文取回（旧记录只存哈希 → undefined；撤销/不存在 → undefined）。 */
+	getKeyMaterial(keyId) {
+		const found = this.data.keys.find((k) => k.keyId === keyId);
+		if (found === void 0 || found.revokedAt !== void 0) return void 0;
+		return found.key;
+	}
 	/** 撤销（幂等：已撤销为 no-op）。 */
 	revokeKey(keyId) {
 		const found = this.data.keys.find((k) => k.keyId === keyId);
@@ -6290,21 +6318,32 @@ function previewShareLink(text) {
 	};
 }
 /**
-* 构造分享链接：前置检查（组存在且非空）-> 签发新钥（每次 share 一枚；旧钥不可再现）
-* -> 组内服务脱敏视图 -> payload + link + 警告。
+* 构造分享链接：前置检查（组存在且非空）-> key（复用 keyId 指定的已存
+* 原文；缺省签发新钥）-> 组内服务脱敏视图 -> payload + link + 警告。
 */
 function buildShareLink(input) {
 	if (input.store.getGroup(input.group) === void 0) throw new StoreError("not-found", `error: group '${input.group}' not found`);
 	const services = input.store.groupServices(input.group);
 	if (services.length === 0) throw new StoreError("invalid", `error: group '${input.group}' has no services; a share link would be meaningless`);
-	const issued = input.store.issueKey(input.group);
+	let key;
+	let keyId;
+	if (input.keyId !== void 0) {
+		const material = input.store.getKeyMaterial(input.keyId);
+		if (material === void 0) throw new StoreError("invalid", `error: key '${input.keyId}' cannot be shared (missing, revoked, or raw material not stored)`);
+		key = material;
+		keyId = input.keyId;
+	} else {
+		const issued = input.store.issueKey(input.group, input.keyName);
+		key = issued.key;
+		keyId = issued.keyId;
+	}
 	const serviceEntries = services.map(buildServiceEntry);
 	const relayUrls = input.relayUrls === void 0 ? [] : [...input.relayUrls];
 	const payload = {
 		v: 1,
 		invite: input.invite,
-		key: issued.key,
-		keyId: issued.keyId,
+		key,
+		keyId,
 		provider: {
 			alias: input.alias ?? input.store.alias ?? "provider",
 			endpointId: input.endpointId,
@@ -6319,7 +6358,7 @@ function buildShareLink(input) {
 		payload,
 		link: encodeShareLink(payload),
 		warnings,
-		keyId: issued.keyId
+		keyId
 	};
 }
 //#endregion
@@ -7654,7 +7693,9 @@ function keyView(key) {
 		keyId: key.keyId,
 		group: key.group,
 		createdAt: key.createdAt,
-		...key.revokedAt !== void 0 ? { revokedAt: key.revokedAt } : {}
+		...key.revokedAt !== void 0 ? { revokedAt: key.revokedAt } : {},
+		...key.name !== void 0 ? { name: key.name } : {},
+		...key.key !== void 0 ? { key: key.key } : {}
 	};
 }
 /** 预设 → 服务输入展开（applyAsService 核心：match 从 matchDomains 派生 suffix 规则；
@@ -7813,7 +7854,7 @@ function createRpcRouter(deps) {
 				})
 			},
 			keys: {
-				issue: rpc.provider.keys.issue.handler(({ input }) => host.providerStore().issueKey(input.group)),
+				issue: rpc.provider.keys.issue.handler(({ input }) => host.providerStore().issueKey(input.group, input.name)),
 				list: rpc.provider.keys.list.handler(() => ({ keys: host.providerStore().listKeys().map(keyView) })),
 				revoke: rpc.provider.keys.revoke.handler(({ input }) => ({ key: keyView(host.providerStore().revokeKey(input.keyId)) }))
 			},
@@ -7873,7 +7914,9 @@ function createRpcRouter(deps) {
 					group: input.group,
 					invite,
 					endpointId: daemon.endpointId,
-					relayUrls: relayStatus.urls
+					relayUrls: relayStatus.urls,
+					keyId: input.keyId,
+					keyName: input.keyName
 				});
 				return {
 					link: result.link,

package/dist/{common-B6U1vLFw.mjs → common-C51SAE5f.mjs}

@@ -1,7 +1,7 @@
 import { n as UsageError } from "./errors-BGtxPkM7.mjs";
 import { n as resolveRelayUrls, t as loadConfig } from "./config-BlZnFqx7.mjs";
-import { t as ProviderStore } from "./store-DxU0bd_u.mjs";
-import { t as loadSettings } from "./settings-CY-bC0MJ.mjs";
+import { t as ProviderStore } from "./store-EGzVd-dn.mjs";
+import { t as loadSettings } from "./settings-XCvAzDK8.mjs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 //#region src/cli/commands/provider/common.ts

package/dist/{common-CwlJNk3L.mjs → common-CanLn0Qt.mjs}

@@ -1,6 +1,6 @@
 import { n as resolveRelayUrls, t as loadConfig } from "./config-BlZnFqx7.mjs";
 import { n as loadSdk, t as resolveHttpProxy } from "./proxy-D7VMUVEg.mjs";
-import { t as loadSettings } from "./settings-CY-bC0MJ.mjs";
+import { t as loadSettings } from "./settings-XCvAzDK8.mjs";
 import { homedir } from "node:os";
 //#region src/cli/commands/consumer/common.ts
 function ctxOut(ctx) {

package/dist/{daemon-iqO29D7K.mjs → daemon-BWgyJMyB.mjs}

@@ -1,8 +1,8 @@
 import { n as UsageError, r as reportCliError, t as CliError } from "./errors-BGtxPkM7.mjs";
 import { n as parseArgv } from "./args-CSxXW9eD.mjs";
-import { r as settingsPath, t as loadSettings } from "./settings-CY-bC0MJ.mjs";
+import { r as settingsPath, t as loadSettings } from "./settings-XCvAzDK8.mjs";
 import { a as killHard, c as terminateGracefully, i as isAlive, l as writeLastStart, n as daemonDir, o as readLastStart, r as ensureDaemonDir, s as readPid, t as clearPid, u as writePid } from "./daemon-state-CYkiW3SA.mjs";
-import { r as openStore } from "./common-B6U1vLFw.mjs";
+import { r as openStore } from "./common-C51SAE5f.mjs";
 import { openSync, readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { isAbsolute, resolve } from "node:path";
@@ -99,7 +99,7 @@ async function start(startArgv, home) {
 	process.on("exit", () => {
 		clearPid(home);
 	});
-	const { run: serveRun } = await import("./serve-B4f79Eqq.mjs");
+	const { run: serveRun } = await import("./serve-B51lmr9M.mjs");
 	return serveRun([...startArgv], { homedir: home });
 }
 /** 后台 pid（活性核验；陈旧 pidfile 就地清理返回 null）。 */

package/dist/{forget-BIorc8Rx.mjs → forget-B3KRkHho.mjs}

@@ -1,7 +1,7 @@
 import { n as UsageError } from "./errors-BGtxPkM7.mjs";
 import { n as parseArgv } from "./args-CSxXW9eD.mjs";
-import { d as removeKeyring, n as consumersRoot } from "./store-DCLn0Df-.mjs";
-import { n as ctxHomedir, r as ctxOut } from "./common-CwlJNk3L.mjs";
+import { d as removeKeyring, n as consumersRoot } from "./store-DOFDy1rY.mjs";
+import { n as ctxHomedir, r as ctxOut } from "./common-CanLn0Qt.mjs";
 import { homedir } from "node:os";
 //#region src/cli/commands/consumer/forget.ts
 async function run(argv, ctx = {}) {

package/dist/{group-C13I2bCR.mjs → group-BdnvRD2t.mjs}

@@ -1,6 +1,6 @@
 import { n as UsageError, r as reportCliError } from "./errors-BGtxPkM7.mjs";
 import { n as parseArgv } from "./args-CSxXW9eD.mjs";
-import { d as str, l as resolveDataDir, n as multi, r as openStore, s as parsePositiveInt } from "./common-B6U1vLFw.mjs";
+import { d as str, l as resolveDataDir, n as multi, r as openStore, s as parsePositiveInt } from "./common-C51SAE5f.mjs";
 import { homedir } from "node:os";
 //#region src/cli/commands/provider/group.ts
 const SPEC = {

package/dist/{hooks-BeBzkBL-.mjs → hooks-DUrXA7PL.mjs}

@@ -1,8 +1,8 @@
 import { n as UsageError, r as reportCliError } from "./errors-BGtxPkM7.mjs";
 import { n as parseArgv } from "./args-CSxXW9eD.mjs";
-import { d as str, l as resolveDataDir } from "./common-B6U1vLFw.mjs";
+import { d as str, l as resolveDataDir } from "./common-C51SAE5f.mjs";
 import { a as removeUserHook, i as readHookScript, n as disposeHookSubscriptions, o as resolveHookValue, r as installUserHook, t as discoverHooks } from "./hook-CvAMGts4.mjs";
-import { t as SecretsStore } from "./secrets-bHJBznMX.mjs";
+import { t as SecretsStore } from "./secrets-1Hmddmwy.mjs";
 import { readFileSync } from "node:fs";
 import { homedir } from "node:os";
 //#region src/cli/commands/provider/hooks.ts

package/dist/{import-BhasJTGS.mjs → import-CTkKGPsa.mjs}

@@ -1,9 +1,9 @@
 import { n as UsageError } from "./errors-BGtxPkM7.mjs";
 import { n as parseArgv } from "./args-CSxXW9eD.mjs";
-import { n as consumersRoot, s as listKeyrings } from "./store-DCLn0Df-.mjs";
-import { a as ringsForRun, i as printListeners, n as ctxHomedir, o as waitForSignals, r as ctxOut, t as createSdkFabricFactory } from "./common-CwlJNk3L.mjs";
-import { a as importLink, i as formatLinkPreview, n as decodeShareLink, r as formatKeyringSummary } from "./join-DiVTFi59.mjs";
-import { n as createFabricProviderTransport, t as startEngine } from "./runtime-D8P29hIl.mjs";
+import { n as consumersRoot, s as listKeyrings } from "./store-DOFDy1rY.mjs";
+import { a as ringsForRun, i as printListeners, n as ctxHomedir, o as waitForSignals, r as ctxOut, t as createSdkFabricFactory } from "./common-CanLn0Qt.mjs";
+import { a as importLink, i as formatLinkPreview, n as decodeShareLink, r as formatKeyringSummary } from "./join-BRow9_3-.mjs";
+import { n as createFabricProviderTransport, t as startEngine } from "./runtime-C_pLA5F0.mjs";
 import { homedir } from "node:os";
 //#region src/cli/commands/consumer/import.ts
 async function run(argv, ctx = {}) {

package/dist/{join-DiVTFi59.mjs → join-BRow9_3-.mjs}

@@ -1,7 +1,7 @@
 import { t as CliError } from "./errors-BGtxPkM7.mjs";
-import { o as decodeZ32, s as randomZ32 } from "./rpc-contract-BXviZUtF.mjs";
+import { o as decodeZ32, s as randomZ32 } from "./rpc-contract-cB5SuyQ_.mjs";
 import { l as SERVICE_ENTRY_SCHEMA } from "./frames-BDz8buix.mjs";
-import { a as hasFabricIdentity, c as loadKeyring, f as saveKeyring, h as upsertKey, i as findKeyringDir, l as mergeImportView, o as keyringDir, r as fabricDir } from "./store-DCLn0Df-.mjs";
+import { a as hasFabricIdentity, c as loadKeyring, f as saveKeyring, h as upsertKey, i as findKeyringDir, l as mergeImportView, o as keyringDir, r as fabricDir } from "./store-DOFDy1rY.mjs";
 import { existsSync, mkdirSync, renameSync, rmSync } from "node:fs";
 import { join } from "node:path";
 import { z } from "zod";

package/dist/{join-BHhCLh9B.mjs → join-d-pqyf8e.mjs}

@@ -1,8 +1,8 @@
 import { n as UsageError } from "./errors-BGtxPkM7.mjs";
 import { n as parseArgv } from "./args-CSxXW9eD.mjs";
-import { n as consumersRoot } from "./store-DCLn0Df-.mjs";
-import { n as ctxHomedir, r as ctxOut, t as createSdkFabricFactory } from "./common-CwlJNk3L.mjs";
-import { o as joinDevice } from "./join-DiVTFi59.mjs";
+import { n as consumersRoot } from "./store-DOFDy1rY.mjs";
+import { n as ctxHomedir, r as ctxOut, t as createSdkFabricFactory } from "./common-CanLn0Qt.mjs";
+import { o as joinDevice } from "./join-BRow9_3-.mjs";
 import { homedir } from "node:os";
 //#region src/cli/commands/consumer/join.ts
 async function run(argv, ctx = {}) {

package/dist/{key-DYeTZ7MI.mjs → key-CTL_AXOh.mjs}

@@ -1,6 +1,6 @@
 import { n as UsageError, r as reportCliError } from "./errors-BGtxPkM7.mjs";
 import { n as parseArgv } from "./args-CSxXW9eD.mjs";
-import { c as requireString, d as str, l as resolveDataDir, r as openStore } from "./common-B6U1vLFw.mjs";
+import { c as requireString, d as str, l as resolveDataDir, r as openStore } from "./common-C51SAE5f.mjs";
 import { homedir } from "node:os";
 //#region src/cli/commands/provider/key.ts
 const SPEC = {
@@ -8,11 +8,13 @@ const SPEC = {
 		type: "string",
 		tilde: true
 	},
-	group: { type: "string" }
+	group: { type: "string" },
+	name: { type: "string" }
 };
 const USAGE = `usage:
-  ai-fly key issue --group <name> [--data <dir>]
+  ai-fly key issue --group <name> [--name <keyName>] [--data <dir>]
   ai-fly key list [--data <dir>]
+  ai-fly key show <keyId> [--data <dir>]
   ai-fly key revoke <keyId> [--data <dir>]`;
 async function run(argv, ctx = {}) {
 	try {
@@ -21,22 +23,24 @@ async function run(argv, ctx = {}) {
 		const sub = positionals[0];
 		if (sub === "issue") return issue(options, home);
 		if (sub === "list") return list(options, home);
+		if (sub === "show") return show(options, positionals, home);
 		if (sub === "revoke") return revoke(options, positionals, home);
 		if (sub === void 0) throw new UsageError(USAGE);
-		throw new UsageError(`error: unknown key subcommand '${sub}' (known: issue, list, revoke)`);
+		throw new UsageError(`error: unknown key subcommand '${sub}' (known: issue, list, show, revoke)`);
 	} catch (err) {
 		return reportCliError(err);
 	}
 }
 function issue(options, home) {
 	const group = requireString(str(options.group), "group");
-	const issued = openStore(resolveDataDir(str(options.data), home)).issueKey(group);
+	const name = str(options.name) ?? "default";
+	const issued = openStore(resolveDataDir(str(options.data), home)).issueKey(group, name);
 	process.stdout.write([
-		`key issued for group '${group}'`,
+		`key '${name}' issued for group '${group}'`,
 		`  keyId: ${issued.keyId}`,
 		`  key : ${issued.key}`,
 		"",
-		"This secret is shown only once. Store it now (password manager or share link).",
+		"The raw key is stored locally - re-show it anytime with: ai-fly key show " + issued.keyId,
 		"Revoke with: ai-fly key revoke " + issued.keyId,
 		""
 	].join("\n"));
@@ -51,11 +55,23 @@ function list(options, home) {
 	const lines = [];
 	for (const k of keys) {
 		const status = k.revokedAt === void 0 ? "active" : `revoked at ${new Date(k.revokedAt).toISOString()}`;
-		lines.push(`${k.keyId}  group=${k.group}  created=${new Date(k.createdAt).toISOString()}  ${status}`);
+		const name = k.name ?? "(unnamed)";
+		lines.push(`${k.keyId}  name=${name}  group=${k.group}  created=${new Date(k.createdAt).toISOString()}  ${status}`);
 	}
 	process.stdout.write(`${lines.join("\n")}\n`);
 	return 0;
 }
+function show(options, positionals, home) {
+	const keyId = positionals[1];
+	if (keyId === void 0) throw new UsageError("error: key show requires a <keyId> argument");
+	const material = openStore(resolveDataDir(str(options.data), home)).getKeyMaterial(keyId);
+	if (material === void 0) {
+		process.stdout.write(`key '${keyId}' has no retrievable material (missing, revoked, or issued before raw storage)\n`);
+		return 1;
+	}
+	process.stdout.write(`${material}\n`);
+	return 0;
+}
 function revoke(options, positionals, home) {
 	const keyId = positionals[1];
 	if (keyId === void 0) throw new UsageError("error: key revoke requires a <keyId> argument");

package/dist/{key-DdZsNmo_.mjs → key-D_66hrWW.mjs}

@@ -1,8 +1,8 @@
 import { n as UsageError } from "./errors-BGtxPkM7.mjs";
 import { n as parseArgv } from "./args-CSxXW9eD.mjs";
-import { n as consumersRoot } from "./store-DCLn0Df-.mjs";
-import { n as ctxHomedir, r as ctxOut } from "./common-CwlJNk3L.mjs";
-import { r as formatKeyringSummary, t as addKey } from "./join-DiVTFi59.mjs";
+import { n as consumersRoot } from "./store-DOFDy1rY.mjs";
+import { n as ctxHomedir, r as ctxOut } from "./common-CanLn0Qt.mjs";
+import { r as formatKeyringSummary, t as addKey } from "./join-BRow9_3-.mjs";
 import { homedir } from "node:os";
 //#region src/cli/commands/consumer/key.ts
 async function run(argv, ctx = {}) {

package/dist/{local-test-B1ys1pNo.mjs → local-test-BZHGo22F.mjs}

@@ -1,4 +1,4 @@
-import { n as ROUTE_LOCAL_PREFIX } from "./rpc-contract-BXviZUtF.mjs";
+import { n as ROUTE_LOCAL_PREFIX } from "./rpc-contract-cB5SuyQ_.mjs";
 //#region src/consumer/local-test.ts
 const DEFAULT_TIMEOUT_MS = 2e4;
 const BODY_EXCERPT_MAX = 2e3;

package/dist/{models-dev-DPT_BK_V.mjs → models-dev-CDEyd2k3.mjs}

@@ -1,4 +1,4 @@
-import { t as PRESET_SCHEMA } from "./rpc-contract-BXviZUtF.mjs";
+import { t as PRESET_SCHEMA } from "./rpc-contract-cB5SuyQ_.mjs";
 import { mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";

package/dist/{mux-DlwEK4Tt.mjs → mux-BaIDugDq.mjs}

@@ -1,4 +1,4 @@
-import { s as randomZ32 } from "./rpc-contract-BXviZUtF.mjs";
+import { s as randomZ32 } from "./rpc-contract-cB5SuyQ_.mjs";
 import { a as FRAME_TYPE_NAME, d as isKnownFrameType, i as FRAME_TYPE, r as FRAME_HEADER_SCHEMAS, t as ERROR_CODE, u as classifySchemaFailure } from "./frames-BDz8buix.mjs";
 //#region src/wire/codec.ts
 const WIRE_MAGIC_PREFIX = "aifly";

package/dist/{ports-DDM5bbJg.mjs → ports-TQ4tWmiJ.mjs}

@@ -1,7 +1,7 @@
 import { n as UsageError } from "./errors-BGtxPkM7.mjs";
 import { n as parseArgv } from "./args-CSxXW9eD.mjs";
-import { m as setPort, n as consumersRoot, s as listKeyrings } from "./store-DCLn0Df-.mjs";
-import { n as ctxHomedir, r as ctxOut } from "./common-CwlJNk3L.mjs";
+import { m as setPort, n as consumersRoot, s as listKeyrings } from "./store-DOFDy1rY.mjs";
+import { n as ctxHomedir, r as ctxOut } from "./common-CanLn0Qt.mjs";
 import { i as validatePortArg, n as desiredPortFor } from "./ports-pI59MtmI.mjs";
 import { homedir } from "node:os";
 //#region src/cli/commands/consumer/ports.ts

package/dist/{presets-Do5DWXfQ.mjs → presets-DleOUQiT.mjs}

@@ -1,7 +1,7 @@
 import { n as UsageError, r as reportCliError } from "./errors-BGtxPkM7.mjs";
 import { n as parseArgv } from "./args-CSxXW9eD.mjs";
-import { t as loadSettings } from "./settings-CY-bC0MJ.mjs";
-import { n as loadCuratedPresets, r as modelsDevCachePath, t as fetchModelsDevPresets } from "./models-dev-DPT_BK_V.mjs";
+import { t as loadSettings } from "./settings-XCvAzDK8.mjs";
+import { n as loadCuratedPresets, r as modelsDevCachePath, t as fetchModelsDevPresets } from "./models-dev-CDEyd2k3.mjs";
 import { homedir } from "node:os";
 //#region src/cli/commands/provider/presets.ts
 const SPEC = { json: { type: "boolean" } };

package/dist/{revoke-6lrZkjN4.mjs → revoke-DTFW_EF1.mjs}

@@ -1,8 +1,8 @@
 import { n as UsageError, r as reportCliError } from "./errors-BGtxPkM7.mjs";
 import { n as parseArgv } from "./args-CSxXW9eD.mjs";
 import { t as resolveHttpProxy } from "./proxy-D7VMUVEg.mjs";
-import { d as str, l as resolveDataDir, u as resolvedRelayUrls } from "./common-B6U1vLFw.mjs";
-import { t as openExistingFabric } from "./serve-C8VRRJrt.mjs";
+import { d as str, l as resolveDataDir, u as resolvedRelayUrls } from "./common-C51SAE5f.mjs";
+import { t as openExistingFabric } from "./serve-CY7ZFOFM.mjs";
 import { homedir } from "node:os";
 //#region src/cli/commands/provider/revoke.ts
 const SPEC = {

package/dist/{rewrite-vGrkDZx8.mjs → rewrite-CEzfYH9n.mjs}

@@ -1,6 +1,6 @@
-import { a as routeLocalPrefix } from "./rpc-contract-BXviZUtF.mjs";
+import { a as routeLocalPrefix } from "./rpc-contract-cB5SuyQ_.mjs";
 import { n as FORBIDDEN_REQ_HEADER_NAMES } from "./frames-BDz8buix.mjs";
-import { a as parseUpstreamUrl, c as matchRequestPath, o as expandUriTemplate, s as compileMatchPattern } from "./store-DxU0bd_u.mjs";
+import { a as parseUpstreamUrl, c as matchRequestPath, o as expandUriTemplate, s as compileMatchPattern } from "./store-EGzVd-dn.mjs";
 import { o as resolveHookValue } from "./hook-CvAMGts4.mjs";
 import "node:module";
 import "node:fs";

package/dist/{route-test-DfGzFjKw.mjs → route-test-D2LQyX7c.mjs}

@@ -1,6 +1,6 @@
-import { n as ROUTE_LOCAL_PREFIX } from "./rpc-contract-BXviZUtF.mjs";
-import { t as formProbe } from "./local-test-B1ys1pNo.mjs";
-import { i as buildUpstreamRequest, t as PathNotOfferedError } from "./rewrite-vGrkDZx8.mjs";
+import { n as ROUTE_LOCAL_PREFIX } from "./rpc-contract-cB5SuyQ_.mjs";
+import { t as formProbe } from "./local-test-BZHGo22F.mjs";
+import { i as buildUpstreamRequest, t as PathNotOfferedError } from "./rewrite-CEzfYH9n.mjs";
 //#region src/provider/route-test.ts
 const DEFAULT_TIMEOUT_MS = 2e4;
 const BODY_EXCERPT_MAX = 2e3;

package/dist/{rpc-contract-BXviZUtF.mjs → rpc-contract-cB5SuyQ_.mjs}

@@ -169,12 +169,15 @@ const GROUP_SCHEMA = z.strictObject({
 	serviceIds: z.array(z.string().min(1).max(128)).max(256),
 	limits: GROUP_LIMITS_SCHEMA.optional()
 });
-/** 密钥视图：keyId/分组/时间/状态；哈希与原文一律不进契约（原文仅 issue 时一次性返回）。 */
+/** 密钥视图：keyId/分组/时间/状态 + 名 + 原文（Owner 2026-09-13：随时可
+*  复制——原文随库返回；旧记录只存哈希 → 两字段皆缺省）。 */
 const KEY_VIEW_SCHEMA = z.strictObject({
 	keyId: z.string().min(1).max(128),
 	group: z.string().min(1).max(256),
 	createdAt: z.number().int().min(0),
-	revokedAt: z.number().int().min(0).optional()
+	revokedAt: z.number().int().min(0).optional(),
+	name: z.string().min(1).max(128).optional(),
+	key: z.string().min(8).max(256).optional()
 });
 /** 使用方服务目录条目（AUTH_OK / import 视图；detail 为脱敏披露，$env 值显示 ●）。 */
 const SERVICE_ENTRY_SCHEMA = z.object({
@@ -336,7 +339,11 @@ const SETTINGS_SCHEMA = z.strictObject({
 const SHARE_CREATE_INPUT_SCHEMA = z.strictObject({
 	group: z.string().min(1).max(256),
 	/** TTL 毫秒（1s..30d；缺省 60min——范围校验复用 link.ts 常量语义）。 */
-	ttlMs: z.number().int().min(1e3).max(2592e6).optional()
+	ttlMs: z.number().int().min(1e3).max(2592e6).optional(),
+	/** 复用既有 key（现铸 invite 重发链接；缺省签发新钥）。 */
+	keyId: z.string().min(1).max(128).optional(),
+	/** 新钥名（缺省签发路径下默认 "default"）。 */
+	keyName: z.string().min(1).max(128).optional()
 });
 const PRESET_APPLY_INPUT_SCHEMA = z.strictObject({
 	presetId: z.string().min(1).max(128),
@@ -474,13 +481,16 @@ oc.errors(RpcErrorDefinitions).router({
 			remove: oc.input(z.strictObject({ name: z.string().min(1).max(256) })).output(z.object({ removed: z.literal(true) }))
 		},
 		keys: {
-			/** 签发（原文仅本次返回；此后只余哈希）。 */
-			issue: oc.input(z.strictObject({ group: z.string().min(1).max(256) })).output(z.object({
+			/** 签发（name 缺省 "default"；原文随库可再取）。 */
+			issue: oc.input(z.strictObject({
+				group: z.string().min(1).max(256),
+				name: z.string().min(1).max(128).optional()
+			})).output(z.object({
 				keyId: z.string(),
 				key: z.string(),
 				createdAt: z.number().int()
 			})),
-			/** 密钥清单（无哈希、无原文）。 */
+			/** 密钥清单（含名与原文——本机 GUI 随时复制；无哈希）。 */
 			list: oc.input(z.object({})).output(z.object({ keys: z.array(KEY_VIEW_SCHEMA) })),
 			/** 撤销（幂等）。 */
 			revoke: oc.input(z.strictObject({ keyId: z.string().min(1).max(128) })).output(z.object({ key: KEY_VIEW_SCHEMA }))

package/dist/{run-BLxeLngt.mjs → run-D8kgXdId.mjs}

@@ -1,8 +1,8 @@
 import { n as UsageError, r as reportCliError, t as CliError } from "./errors-BGtxPkM7.mjs";
 import { n as parseArgv } from "./args-CSxXW9eD.mjs";
-import { n as consumersRoot, s as listKeyrings } from "./store-DCLn0Df-.mjs";
-import { a as ringsForRun, i as printListeners, n as ctxHomedir, o as waitForSignals, r as ctxOut, t as createSdkFabricFactory } from "./common-CwlJNk3L.mjs";
-import { n as createFabricProviderTransport, t as startEngine } from "./runtime-D8P29hIl.mjs";
+import { n as consumersRoot, s as listKeyrings } from "./store-DOFDy1rY.mjs";
+import { a as ringsForRun, i as printListeners, n as ctxHomedir, o as waitForSignals, r as ctxOut, t as createSdkFabricFactory } from "./common-CanLn0Qt.mjs";
+import { n as createFabricProviderTransport, t as startEngine } from "./runtime-C_pLA5F0.mjs";
 import { a as killHard, c as terminateGracefully, i as isAlive, l as writeLastStart, n as daemonDir, o as readLastStart, r as ensureDaemonDir, s as readPid, t as clearPid, u as writePid } from "./daemon-state-CYkiW3SA.mjs";
 import { openSync, readFileSync } from "node:fs";
 import { resolve } from "node:path";

package/dist/{runtime-D8P29hIl.mjs → runtime-C_pLA5F0.mjs}

@@ -1,6 +1,6 @@
 import { i as FRAME_TYPE, o as HTTP_METHODS } from "./frames-BDz8buix.mjs";
-import { c as loadKeyring, f as saveKeyring, p as setActualPorts, t as applyCatalog, u as reconcileKeyMetadata } from "./store-DCLn0Df-.mjs";
-import { i as splitBody, n as FabricWireAdapter, t as WireSession } from "./mux-DlwEK4Tt.mjs";
+import { c as loadKeyring, f as saveKeyring, p as setActualPorts, t as applyCatalog, u as reconcileKeyMetadata } from "./store-DOFDy1rY.mjs";
+import { i as splitBody, n as FabricWireAdapter, t as WireSession } from "./mux-BaIDugDq.mjs";
 import { n as desiredPortFor, r as listenWithFallback, t as LOOPBACK_HOST } from "./ports-pI59MtmI.mjs";
 import { Hono } from "hono";
 import { createAdaptorServer } from "@hono/node-server";

package/dist/{secret-Ds6pIoLP.mjs → secret-P2RgHy2h.mjs}

@@ -1,7 +1,7 @@
 import { n as UsageError, r as reportCliError } from "./errors-BGtxPkM7.mjs";
 import { n as parseArgv } from "./args-CSxXW9eD.mjs";
-import { d as str, l as resolveDataDir } from "./common-B6U1vLFw.mjs";
-import { t as SecretsStore } from "./secrets-bHJBznMX.mjs";
+import { d as str, l as resolveDataDir } from "./common-C51SAE5f.mjs";
+import { t as SecretsStore } from "./secrets-1Hmddmwy.mjs";
 import { homedir } from "node:os";
 import process from "node:process";
 import { createInterface } from "node:readline";

package/dist/{secrets-bHJBznMX.mjs → secrets-1Hmddmwy.mjs}

@@ -1,5 +1,5 @@
-import { r as SECRET_NAME_SCHEMA } from "./rpc-contract-BXviZUtF.mjs";
-import { i as ensurePrivateDir, n as StoreError, r as atomicWriteFileSync } from "./store-DxU0bd_u.mjs";
+import { r as SECRET_NAME_SCHEMA } from "./rpc-contract-cB5SuyQ_.mjs";
+import { i as ensurePrivateDir, n as StoreError, r as atomicWriteFileSync } from "./store-EGzVd-dn.mjs";
 import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { z } from "zod";

package/dist/secrets-C9IYp93v.mjs

@@ -0,0 +1,2 @@
+import { t as SecretsStore } from "./secrets-1Hmddmwy.mjs";
+export { SecretsStore };

package/dist/{serve-B4f79Eqq.mjs → serve-B51lmr9M.mjs}

@@ -1,8 +1,8 @@
 import { n as UsageError, r as reportCliError } from "./errors-BGtxPkM7.mjs";
 import { n as parseArgv } from "./args-CSxXW9eD.mjs";
 import { t as resolveHttpProxy } from "./proxy-D7VMUVEg.mjs";
-import { d as str, l as resolveDataDir, u as resolvedRelayUrls } from "./common-B6U1vLFw.mjs";
-import { n as startProviderDaemon } from "./serve-C8VRRJrt.mjs";
+import { d as str, l as resolveDataDir, u as resolvedRelayUrls } from "./common-C51SAE5f.mjs";
+import { n as startProviderDaemon } from "./serve-CY7ZFOFM.mjs";
 import { homedir } from "node:os";
 //#region src/cli/commands/provider/serve.ts
 const SPEC = {