ai-fly 0.4.0-alpha.8 → 0.4.0

package/dist/{serve-C8VRRJrt.mjs → serve-CY7ZFOFM.mjs}

@@ -1,9 +1,9 @@
 import { c as RESP_META_HEADER_WHITELIST, i as FRAME_TYPE, s as REJECTED_CODE, t as ERROR_CODE } from "./frames-BDz8buix.mjs";
 import { n as loadSdk } from "./proxy-D7VMUVEg.mjs";
-import { i as ensurePrivateDir, r as atomicWriteFileSync, t as ProviderStore } from "./store-DxU0bd_u.mjs";
-import { n as FabricWireAdapter, r as DEFAULT_BODY_CHUNK_BYTES, t as WireSession } from "./mux-DlwEK4Tt.mjs";
-import { t as SecretsStore } from "./secrets-bHJBznMX.mjs";
-import { a as collectEnvVarNames, i as buildUpstreamRequest, n as RewriteError, r as SecretMissingError, s as buildServiceEntry, t as PathNotOfferedError } from "./rewrite-vGrkDZx8.mjs";
+import { i as ensurePrivateDir, r as atomicWriteFileSync, t as ProviderStore } from "./store-EGzVd-dn.mjs";
+import { n as FabricWireAdapter, r as DEFAULT_BODY_CHUNK_BYTES, t as WireSession } from "./mux-BaIDugDq.mjs";
+import { t as SecretsStore } from "./secrets-1Hmddmwy.mjs";
+import { a as collectEnvVarNames, i as buildUpstreamRequest, n as RewriteError, r as SecretMissingError, s as buildServiceEntry, t as PathNotOfferedError } from "./rewrite-CEzfYH9n.mjs";
 import { appendFileSync, existsSync, readFileSync, readdirSync, watch } from "node:fs";
 import "node:os";
 import { dirname, join } from "node:path";

package/dist/{service-CYkpuJuc.mjs → service-D6TNolyh.mjs}

@@ -1,7 +1,7 @@
 import { n as UsageError, r as reportCliError } from "./errors-BGtxPkM7.mjs";
 import { n as parseArgv } from "./args-CSxXW9eD.mjs";
-import { a as parseMatchSpec, d as str, i as parseHeaderSetSpec, l as resolveDataDir, n as multi, o as parsePortNumber, r as openStore, t as buildRewrite } from "./common-B6U1vLFw.mjs";
-import { n as loadCuratedPresets } from "./models-dev-DPT_BK_V.mjs";
+import { a as parseMatchSpec, d as str, i as parseHeaderSetSpec, l as resolveDataDir, n as multi, o as parsePortNumber, r as openStore, t as buildRewrite } from "./common-C51SAE5f.mjs";
+import { n as loadCuratedPresets } from "./models-dev-CDEyd2k3.mjs";
 import { homedir } from "node:os";
 //#region src/cli/commands/provider/service.ts
 const SPEC = {
@@ -225,8 +225,8 @@ async function test(options, positionals, home) {
 		formRaw = (localPrefix !== void 0 ? routes.find((r) => r.localPrefix === localPrefix) : routes.length === 1 ? routes[0] : void 0)?.forms[0] ?? "openai-chat";
 	}
 	if (!ROUTE_FORMS.includes(formRaw)) throw new UsageError(`error: --form must be one of ${ROUTE_FORMS.join(", ")}`);
-	const { testServiceRoute } = await import("./route-test-DfGzFjKw.mjs");
-	const { SecretsStore } = await import("./secrets-G2HTT66T.mjs");
+	const { testServiceRoute } = await import("./route-test-D2LQyX7c.mjs");
+	const { SecretsStore } = await import("./secrets-C9IYp93v.mjs");
 	const secretsStore = SecretsStore.open(dataDir);
 	const hitLocalPrefix = options["local-prefix"] !== void 0 ? str(options["local-prefix"]) : (() => {
 		const routes = (service.routes ?? []).filter((r) => r.mode !== "pattern");

package/dist/{settings-CSran7QD.mjs → settings-Rq1zLoxY.mjs}

@@ -1,6 +1,6 @@
 import { n as UsageError, r as reportCliError } from "./errors-BGtxPkM7.mjs";
 import { n as parseArgv } from "./args-CSxXW9eD.mjs";
-import { n as saveSettings, r as settingsPath, t as loadSettings } from "./settings-CY-bC0MJ.mjs";
+import { n as saveSettings, r as settingsPath, t as loadSettings } from "./settings-XCvAzDK8.mjs";
 import { homedir } from "node:os";
 //#region src/cli/commands/settings.ts
 const SPEC = { default: { type: "boolean" } };

package/dist/{settings-CY-bC0MJ.mjs → settings-XCvAzDK8.mjs}

@@ -1,5 +1,5 @@
-import { i as SETTINGS_SCHEMA } from "./rpc-contract-BXviZUtF.mjs";
-import { i as ensurePrivateDir, r as atomicWriteFileSync } from "./store-DxU0bd_u.mjs";
+import { i as SETTINGS_SCHEMA } from "./rpc-contract-cB5SuyQ_.mjs";
+import { i as ensurePrivateDir, r as atomicWriteFileSync } from "./store-EGzVd-dn.mjs";
 import { readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";

package/dist/{share-B94HhX_b.mjs → share-DdtbAylA.mjs}

@@ -2,10 +2,10 @@ import { r as reportCliError, t as CliError } from "./errors-BGtxPkM7.mjs";
 import { n as parseArgv, r as parseDurationMs, t as assertDurationRange } from "./args-CSxXW9eD.mjs";
 import { l as SERVICE_ENTRY_SCHEMA } from "./frames-BDz8buix.mjs";
 import { t as resolveHttpProxy } from "./proxy-D7VMUVEg.mjs";
-import { n as StoreError } from "./store-DxU0bd_u.mjs";
-import { c as requireString, d as str, l as resolveDataDir, r as openStore, u as resolvedRelayUrls } from "./common-B6U1vLFw.mjs";
-import { t as openExistingFabric } from "./serve-C8VRRJrt.mjs";
-import { s as buildServiceEntry } from "./rewrite-vGrkDZx8.mjs";
+import { n as StoreError } from "./store-EGzVd-dn.mjs";
+import { c as requireString, d as str, l as resolveDataDir, r as openStore, u as resolvedRelayUrls } from "./common-C51SAE5f.mjs";
+import { t as openExistingFabric } from "./serve-CY7ZFOFM.mjs";
+import { s as buildServiceEntry } from "./rewrite-CEzfYH9n.mjs";
 import { homedir } from "node:os";
 import { z } from "zod";
 //#region src/provider/link.ts
@@ -33,21 +33,32 @@ function encodeShareLink(payload) {
 	return SHARE_LINK_PREFIX + Buffer.from(JSON.stringify(payload), "utf8").toString("base64url");
 }
 /**
-* 构造分享链接：前置检查（组存在且非空）-> 签发新钥（每次 share 一枚；旧钥不可再现）
-* -> 组内服务脱敏视图 -> payload + link + 警告。
+* 构造分享链接：前置检查（组存在且非空）-> key（复用 keyId 指定的已存
+* 原文；缺省签发新钥）-> 组内服务脱敏视图 -> payload + link + 警告。
 */
 function buildShareLink(input) {
 	if (input.store.getGroup(input.group) === void 0) throw new StoreError("not-found", `error: group '${input.group}' not found`);
 	const services = input.store.groupServices(input.group);
 	if (services.length === 0) throw new StoreError("invalid", `error: group '${input.group}' has no services; a share link would be meaningless`);
-	const issued = input.store.issueKey(input.group);
+	let key;
+	let keyId;
+	if (input.keyId !== void 0) {
+		const material = input.store.getKeyMaterial(input.keyId);
+		if (material === void 0) throw new StoreError("invalid", `error: key '${input.keyId}' cannot be shared (missing, revoked, or raw material not stored)`);
+		key = material;
+		keyId = input.keyId;
+	} else {
+		const issued = input.store.issueKey(input.group, input.keyName);
+		key = issued.key;
+		keyId = issued.keyId;
+	}
 	const serviceEntries = services.map(buildServiceEntry);
 	const relayUrls = input.relayUrls === void 0 ? [] : [...input.relayUrls];
 	const payload = {
 		v: 1,
 		invite: input.invite,
-		key: issued.key,
-		keyId: issued.keyId,
+		key,
+		keyId,
 		provider: {
 			alias: input.alias ?? input.store.alias ?? "provider",
 			endpointId: input.endpointId,
@@ -62,7 +73,7 @@ function buildShareLink(input) {
 		payload,
 		link: encodeShareLink(payload),
 		warnings,
-		keyId: issued.keyId
+		keyId
 	};
 }
 //#endregion
@@ -75,7 +86,9 @@ const SPEC = {
 	group: { type: "string" },
 	ttl: { type: "string" },
 	relay: { type: "multi" },
-	"allow-relayless": { type: "boolean" }
+	"allow-relayless": { type: "boolean" },
+	"key-id": { type: "string" },
+	"key-name": { type: "string" }
 };
 async function run(argv, ctx = {}) {
 	let fabric;
@@ -97,7 +110,9 @@ async function run(argv, ctx = {}) {
 			group,
 			invite,
 			endpointId: fabric.endpointId,
-			relayUrls: relayStatus.urls
+			relayUrls: relayStatus.urls,
+			keyId: str(options["key-id"]),
+			keyName: str(options["key-name"])
 		});
 		process.stdout.write([
 			`share link for group '${group}' (keyId ${result.keyId}, ttl ${describeTtl(ttlMs)}):`,

package/dist/{status-BFpr-LHB.mjs → status-DSVQ3YHm.mjs}

@@ -1,9 +1,9 @@
 import { r as reportCliError } from "./errors-BGtxPkM7.mjs";
 import { n as parseArgv } from "./args-CSxXW9eD.mjs";
 import { t as resolveHttpProxy } from "./proxy-D7VMUVEg.mjs";
-import { d as str, l as resolveDataDir, r as openStore, u as resolvedRelayUrls } from "./common-B6U1vLFw.mjs";
-import { t as openExistingFabric } from "./serve-C8VRRJrt.mjs";
-import { c as detailDisplayLines, o as buildServiceDetail } from "./rewrite-vGrkDZx8.mjs";
+import { d as str, l as resolveDataDir, r as openStore, u as resolvedRelayUrls } from "./common-C51SAE5f.mjs";
+import { t as openExistingFabric } from "./serve-CY7ZFOFM.mjs";
+import { c as detailDisplayLines, o as buildServiceDetail } from "./rewrite-CEzfYH9n.mjs";
 import { homedir } from "node:os";
 //#region src/cli/commands/provider/status.ts
 const SPEC = {

package/dist/{status-C_EI8-b9.mjs → status-uE2-kOyK.mjs}

@@ -1,7 +1,7 @@
 import { n as parseArgv } from "./args-CSxXW9eD.mjs";
-import { n as consumersRoot, s as listKeyrings } from "./store-DCLn0Df-.mjs";
-import { a as ringsForRun, n as ctxHomedir, r as ctxOut, t as createSdkFabricFactory } from "./common-CwlJNk3L.mjs";
-import { n as createFabricProviderTransport, t as startEngine } from "./runtime-D8P29hIl.mjs";
+import { n as consumersRoot, s as listKeyrings } from "./store-DOFDy1rY.mjs";
+import { a as ringsForRun, n as ctxHomedir, r as ctxOut, t as createSdkFabricFactory } from "./common-CanLn0Qt.mjs";
+import { n as createFabricProviderTransport, t as startEngine } from "./runtime-C_pLA5F0.mjs";
 import { homedir } from "node:os";
 //#region src/cli/commands/consumer/status.ts
 /** 状态显示名（spec 六态）。 */

package/dist/{store-DCLn0Df-.mjs → store-DOFDy1rY.mjs}

@@ -1,5 +1,5 @@
 import { t as CliError } from "./errors-BGtxPkM7.mjs";
-import { s as randomZ32 } from "./rpc-contract-BXviZUtF.mjs";
+import { s as randomZ32 } from "./rpc-contract-cB5SuyQ_.mjs";
 import { l as SERVICE_ENTRY_SCHEMA } from "./frames-BDz8buix.mjs";
 import { chmodSync, existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";

package/dist/{store-DxU0bd_u.mjs → store-EGzVd-dn.mjs}

@@ -1,4 +1,4 @@
-import { n as ROUTE_LOCAL_PREFIX, s as randomZ32 } from "./rpc-contract-BXviZUtF.mjs";
+import { n as ROUTE_LOCAL_PREFIX, s as randomZ32 } from "./rpc-contract-cB5SuyQ_.mjs";
 import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { z } from "zod";
@@ -235,9 +235,17 @@ const KEY_STORE_SCHEMA = z.strictObject({
 	keyId: z.string().min(1).max(128),
 	group: z.string().min(1).max(256),
 	hash: z.string().regex(/^[0-9a-f]{64}$/, "key hash must be 64 hex chars"),
+	/** key 名（Owner 裁决 2026-09-13：签发时必填，GUI 分组视图按名展示；
+	*  旧记录无此字段——迁移容忍，GUI 显示为未命名）。 */
+	name: z.string().min(1).max(128).optional(),
+	/** key 原文（Owner 裁决 2026-09-13：可随时复制取代仅签发时可见——本机
+	*  个人工具与密钥库明文同一威胁模型；旧记录只存哈希，无法补录）。 */
+	key: z.string().min(8).max(256).optional(),
 	createdAt: z.number().int().min(0),
 	revokedAt: z.number().int().min(0).optional()
 });
+/** key 名规则（同 SECRET_NAME_SCHEMA 词汇：小写开头，点横杠下划线）。 */
+const KEY_NAME_SCHEMA = /^[a-z0-9][a-z0-9._-]*$/;
 const STORE_FILE_SCHEMA = z.strictObject({
 	revision: z.number().int().min(0),
 	meta: z.strictObject({ alias: z.string().min(1).max(256).optional() }).optional(),
@@ -473,9 +481,11 @@ var ProviderStore = class ProviderStore {
 	listKeys() {
 		return this.data.keys.map((k) => ({ ...k }));
 	}
-	/** 签发：原文仅本次返回，存储只落哈希。 */
-	issueKey(groupName) {
+	/** 签发：name 缺省 "default"；原文随记录落库（Owner 2026-09-13：随时
+	*  可复制）。name 是展示标签非身份（keyId 唯一），同组可重名。 */
+	issueKey(groupName, name = "default") {
 		if (this.getGroup(groupName) === void 0) throw new StoreError("not-found", `error: group '${groupName}' not found`);
+		if (!KEY_NAME_SCHEMA.test(name)) throw new StoreError("invalid", "error: key name must match /^[a-z0-9][a-z0-9._-]*$/");
 		let keyId;
 		do
 			keyId = randomZ32(8);
@@ -486,6 +496,8 @@ var ProviderStore = class ProviderStore {
 			keyId,
 			group: groupName,
 			hash: hashKeyMaterial(key),
+			name,
+			key,
 			createdAt
 		});
 		this.save();
@@ -495,6 +507,12 @@ var ProviderStore = class ProviderStore {
 			createdAt
 		};
 	}
+	/** key 原文取回（旧记录只存哈希 → undefined；撤销/不存在 → undefined）。 */
+	getKeyMaterial(keyId) {
+		const found = this.data.keys.find((k) => k.keyId === keyId);
+		if (found === void 0 || found.revokedAt !== void 0) return void 0;
+		return found.key;
+	}
 	/** 撤销（幂等：已撤销为 no-op）。 */
 	revokeKey(keyId) {
 		const found = this.data.keys.find((k) => k.keyId === keyId);

package/dist/{test-BERWIlFb.mjs → test-DW4BF7xJ.mjs}

@@ -1,8 +1,8 @@
 import { n as UsageError, r as reportCliError } from "./errors-BGtxPkM7.mjs";
 import { n as parseArgv } from "./args-CSxXW9eD.mjs";
-import { n as consumersRoot, s as listKeyrings } from "./store-DCLn0Df-.mjs";
+import { n as consumersRoot, s as listKeyrings } from "./store-DOFDy1rY.mjs";
 import { n as desiredPortFor } from "./ports-pI59MtmI.mjs";
-import { n as testLocalService } from "./local-test-B1ys1pNo.mjs";
+import { n as testLocalService } from "./local-test-BZHGo22F.mjs";
 import { homedir } from "node:os";
 //#region src/cli/commands/consumer/test.ts
 const SPEC = {

package/hooks/codex.cjs

@@ -0,0 +1,12 @@
+// 内建 hooks 脚本：codex —— 读 codex CLI 登录态（~/.codex/auth.json）。
+// 钩子清单（按函数名命名规范被发现）：
+// - authHeader(ctx) -> string：ChatGPT Codex backend 的 Bearer 认证头（去前缀裸值，
+//   框架按需拼 "Bearer " 由 headerSet 配置的 bearer 决定——本脚本返回裸 token）。
+module.exports.authHeader = function authHeader({ homedir }) {
+  const { readFileSync } = require("node:fs");
+  const { join } = require("node:path");
+  const auth = JSON.parse(readFileSync(join(homedir, ".codex", "auth.json"), "utf8"));
+  const token = auth && auth.tokens && auth.tokens.access_token;
+  if (typeof token !== "string" || token === "") throw new Error("codex auth.json missing access_token");
+  return token;
+};

package/hooks/env.cjs

@@ -0,0 +1,10 @@
+// 内建 hooks 脚本：env —— 环境变量桥。
+// 钩子清单：
+// - authHeader(ctx) -> string：读 args.var 指定的环境变量（OPENAI_API_KEY 等）。
+module.exports.authHeader = function authHeader({ args, env: ctxEnv }) {
+  const name = args && args.var;
+  if (typeof name !== "string" || name === "") throw new Error("env hook requires args.var");
+  const value = (ctxEnv && ctxEnv(name)) || process.env[name];
+  if (value === undefined || value === "") throw new Error(`env '${name}' unset`);
+  return value;
+};

package/hooks/file.cjs

@@ -0,0 +1,27 @@
+// 内建 hooks 脚本：file —— JSON 文件取值（点径）。
+// 钩子清单：
+// - authHeader(ctx) -> string：读 args.path（支持 ~）+ args.jsonPath（.a.b 风格）；
+//   args.bearer 为 "true"/"1" 时返回值拼 "Bearer " 前缀。
+//   watch 模式示例（返回 AsyncIterable）：unwatchOnClose 实现见文档。
+module.exports.authHeader = function authHeader({ homedir, args }) {
+  const { readFileSync } = require("node:fs");
+  const { join } = require("node:path");
+  const path = args && args.path;
+  const jsonPath = (args && args.jsonPath) || ".";
+  if (typeof path !== "string" || path === "") throw new Error("file hook requires args.path");
+  const abs = path.startsWith("~/") ? join(homedir, path.slice(1)) : path;
+  let doc;
+  try {
+    doc = JSON.parse(readFileSync(abs, "utf8"));
+  } catch {
+    throw new Error("file unreadable or invalid JSON");
+  }
+  let cur = doc;
+  for (const seg of jsonPath.split(".").filter(Boolean)) {
+    if (cur === null || cur === undefined) throw new Error("json path miss");
+    cur = cur[seg];
+  }
+  if (typeof cur !== "string" || cur === "") throw new Error("json path value missing");
+  const bearer = args && (args.bearer === "true" || args.bearer === "1");
+  return bearer ? `Bearer ${cur}` : cur;
+};

package/hooks/secret.cjs

@@ -0,0 +1,11 @@
+// 内建 hooks 脚本：secret —— 密钥库（SecretsStore）桥。
+// 钩子清单：
+// - authHeader(ctx) -> string：读 args.name 指定的密钥（ctx.secrets 访问器；
+//   值只进头不回显——$secret 法则不变）。
+module.exports.authHeader = function authHeader({ args, secrets }) {
+  const name = args && args.name;
+  if (typeof name !== "string" || name === "") throw new Error("secret hook requires args.name");
+  const value = secrets && secrets(name);
+  if (value === undefined || value === "") throw new Error(`secret '${name}' not found`);
+  return value;
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ai-fly",
-  "version": "0.4.0-alpha.8",
+  "version": "0.4.0",
   "description": "ai-fly — peer-to-peer HTTP/WebSocket bridge with AI-ready presets, over OpenDWeb fabric",
   "license": "MIT OR Apache-2.0",
   "type": "module",
@@ -60,6 +60,7 @@
     "dist/*.mjs",
     "dist/*.d.ts",
     "dist/app/**",
+    "hooks",
     "webui/dist",
     "resources/app-icons"
   ],