@deepseek-ai/dsh-client-ui-settings-models 0.2.1-alpha.2 → 0.2.1-alpha.3

package/README.i18n.yaml

@@ -18,11 +18,11 @@
   en: db5aaf7f702e1f0c
   zh: 409a78c14fb2b6e3
 /deepseek-ai-dsh-client-ui-settings-models/use-this-package/api-keys:
-  en: c2f2a5c06ef20d5b
-  zh: 49a7eb0b66b4ed53
+  en: f4817eb2e3537ed9
+  zh: e589c193fa85473f
 /deepseek-ai-dsh-client-ui-settings-models/use-this-package/editing-a-provider:
-  en: ec0ba62a4e7185b4
-  zh: 37d1e1e7a3817d12
+  en: eac663a25c60adf9
+  zh: 24450ef377a79e01
 /deepseek-ai-dsh-client-ui-settings-models/use-this-package/adding-and-deleting-providers:
   en: 9d533c65c82cd4a4
   zh: 0a5da334e127c035
@@ -30,8 +30,8 @@
   en: 589397a35f82244e
   zh: 342fbceee2c173a2
 /deepseek-ai-dsh-client-ui-settings-models/use-this-package/extension-slots:
-  en: 65e9d8822b67b6c2
-  zh: 7e83be9defda28ee
+  en: 79f8f80bdaba73cd
+  zh: f4d7496b293fbf81
 /deepseek-ai-dsh-client-ui-settings-models/understand-the-implementation:
   en: a87afbec5e339b36
   zh: 6348c81af7e650e1
@@ -42,8 +42,8 @@
   en: 6e04c00818f014cd
   zh: 2d57f8d8944e67ed
 /deepseek-ai-dsh-client-ui-settings-models/understand-the-implementation/onboarding-coordinator:
-  en: 46dea666dffe8813
-  zh: 6f56fdc365fa3642
+  en: dc515a31212e477a
+  zh: 770ba77cd9a69f73
 /deepseek-ai-dsh-client-ui-settings-models/further-exploration:
   en: 20abd8b98b6c20e2
   zh: 6dfda7955ce5f33f

package/README.md

@@ -41,13 +41,19 @@ Host configuration `credentialOnboarding` defaults to `true`. The Electron prelo
 
 ### API keys
 
-API-key inputs start empty and use `autocomplete="new-password"` to ask browsers not to autofill saved login passwords.
+API-key inputs start empty and use `autocomplete="new-password"` to ask browsers not to autofill saved login passwords. A nonempty draft has the same eye control as masked conversation text: **Show secret** reveals the current input and **Hide secret** masks it. Changing or clearing the input masks it again. Stored credentials are never read into the input.
 
-The primary field on an editor card is a single **API key** input — the page never asks for an environment-variable name. A typed key stores write-only through `credentials.set` under the profile's reference, deriving `<ROUTE>_API_KEY` when the profile has none, and the pi-ai profile records that derivation as `apiKeyEnv`, so `cordis.patch.yml` never carries a key value. Leaving a new pi-ai provider's key blank saves a reference-free profile and preserves provider-native authentication (for example the Bedrock credential chain or Vertex ADC). A row labels API-key state with a green solid dot only when a referenced credential is confirmed configured, and with a red solid dot only when a named reference is confirmed missing. A successful Apply emits a local accessible status message without echoing secret material.
+The primary field on an editor card is a single **API key** input — the page never asks for an environment-variable name. A typed key stores write-only through `credentials.set` under the profile's reference, deriving `<ROUTE>_API_KEY` when the profile has none, and the pi-ai profile records that derivation as `apiKeyEnv`, so `cordis.patch.yml` never carries a key value. Leaving a new pi-ai provider's key blank saves a reference-free profile and preserves provider-native authentication (for example the Bedrock credential chain or Vertex ADC). The field's placeholder and help tooltip use the profile's `apiKeyEnv` when it has one; otherwise they use the credential variables of the route's `nativeAuth`, excluding `baseURLEnv` address variables, in lookup order, as the configurable-provider directory reports them. These display hints omit references containing `oauth` (case-insensitively), and describe saved credentials followed by the displayed environment fallbacks. This presentation filter does not change the [credential resolution order](../../../docs/subsystems/credentials.md#resolution), the adapter's complete environment list, or an explicit reference. A filtered explicit reference still has a usable key input with the plain placeholder and no tooltip. A native route that has no key authentication omits the key field and authentication help entirely; an explicit reference still enables the field. A profile without a reference on a route without `nativeAuth`, such as a hand-declared route, shows the plain key placeholder and no tooltip. A row labels API-key state with a green solid dot only when a referenced credential is confirmed configured, and with a red solid dot only when a named reference is confirmed missing. A successful Apply emits a local accessible status message without echoing secret material.
+
+The editor uses redacted `CredentialInfo` to choose the saved-credential placeholder or environment detection, without displaying a credential-source label. Refreshing the snapshot updates an open editor without a separate probe. The hint never receives a credential value or changes field writability.
 
 ### Editing a provider
 
-The collapsed 自定义设置 fold carries the curated extras: `baseURL` for both families (the deepseek placeholder shows the public endpoint), each adapter's model catalog, and the **display name** and **API protocol** of a pi-ai route the adapter does not ship. Profile `headers` remain deployment configuration in `cordis.patch.yml` or Cordis config and have no Models-page editor. The Provider ID stays fixed: it is the settings key, the name every other namespace and every logged session references, and the stem of a credential reference the page cannot read back to move. Reasoning effort is deliberately not among the editable fields: it is a per-model capability, so a provider-scoped control could only be set to a value some models reject. Each model row edits `id`, optional display `name`, optional `contextWindow`/`maxTokens`, and input types; unrelated model fields survive edits.
+A blank key field offers a saved credential when one is detected, with no status text below the input; otherwise it offers environment authentication. Redacted `credentials.describe` checks distinguish a detected environment reference, no detected variables, and an unconfirmed read. A missing-variable hint uses the warning color and names the first variable to configure. A detected environment reference uses green. Address configuration variables do not count as credentials. Hidden authentication references still participate in detection; a generic detected hint keeps their names hidden. Detection does not validate credentials, test a connection, or inspect provider-managed files such as AWS profiles and Google application-default credentials. A nonempty input shows no authentication status text. The page reads native variable names as well as named references, in batches of at most 64, and never reads their values into the Client.
+
+An endpoint without a fixed catalog default shows the provider's `baseURLEnv` configuration names below the input. A profile endpoint remains the first placeholder choice.
+
+The collapsed 自定义设置 fold carries the curated extras: `baseURL` for both families (the placeholder shows the endpoint the profile resolves to, the public endpoint for deepseek, else the `defaultBaseURL` the configurable-provider directory reports for a pi-ai catalog route), each adapter's model catalog, and the **display name** and **API protocol** of a pi-ai route the adapter does not ship. Profile `headers` remain deployment configuration in `cordis.patch.yml` or Cordis config and have no Models-page editor. The Provider ID stays fixed: it is the settings key, the name every other namespace and every logged session references, and the stem of a credential reference the page cannot read back to move. Reasoning effort is deliberately not among the editable fields: it is a per-model capability, so a provider-scoped control could only be set to a value some models reject. Each model row edits `id`, optional display `name`, optional `contextWindow`/`maxTokens`, and input types; unrelated model fields survive edits.
 
 The DeepSeek card edits the `llm-deepseek` endpoint, credentials, and model catalog. It uses Messages, with the default endpoint placeholder `https://api.deepseek.com/anthropic`.
 
@@ -65,7 +71,7 @@ After the versioned notice step completes, the DeepSeek step projects first-run
 
 The section declares two seats for plugins distributed outside this repository, typed in [`src/client/slot-contract.ts`](src/client/slot-contract.ts) and exported from `./client`. `settings.models.provider-card` (keyed) renders inside every card that shows a directory row — a saved row's card, its first-run setup posture, and the add-provider draft — dispatched with `entryKey = settingsNs` and owner props carrying the row's `ConfigurableProviderView`, its configured state, and its confirmed api-key credential state, so one registration under an adapter family's namespace receives every card of that family, hand-declared routes included; the hand-declared draft card has no directory row yet and dispatches nothing until saved. `settings.models.footer` (list) renders after the rows and the add controls. A registrant activates through `ctx.slots.inject` with a type-only import of this package's `/client` entry; without registrants both seats render nothing.
 
-The Models page includes **DeepSeek Account** (`deepseek-account`, **DeepSeek 账号** in Chinese). Its editor exposes the shared DeepSeek model catalog without API-key or base-URL inputs, and saves that catalog under the account route's own settings section (`llm-deepseek-account` by default), so an account edit never rewrites the `llm-deepseek` section the official route reads. The account row is hidden when its available model catalog is empty, including before sign-in and after sign-out; it returns when account models become available.
+The Models page includes **DeepSeek Account** (`deepseek-account`, **DeepSeek 账号** in Chinese). The row shows a **Signed in** status and offers no editor: the account listing supplies its models, and [model overrides](../../llm/llm-deepseek-account/README.md#use-this-package) live in `cordis.patch.yml`. The account row is hidden when its available model catalog is empty, including before sign-in and after sign-out; it returns when account models become available.
 
 -----
 
@@ -89,7 +95,7 @@ Concurrent `ModelsSettingsStore.load()` callers resolve after the current refres
 
 ### Onboarding coordinator
 
-The notice step owns its exact copy in `src/client/locales.ts` and its acknowledgement version in `src/onboarding-copy.ts`; on loopback it compares and writes `ui-settings-general.welcomeNoticeVersion` through the shared configuration form, and only an explicit Continue records the current version. Users who acknowledged an earlier version see the current notice again. A non-loopback browser cannot use that Host-only namespace, so acknowledgement is process-local and the notice returns after reload. The DeepSeek step targets `deepseek-official` in `llm-deepseek` and renders the existing `ProviderEditor` in credential-only mode inside the shared onboarding modal; `credentials.set` stays the only secret write, and no provider settings are changed.
+The notice step owns its exact copy in `src/client/locales.ts` and its acknowledgement version in `src/onboarding-copy.ts`. Authenticated browsers compare and write `ui-settings-general.welcomeNoticeVersion` through the shared configuration form; only an explicit Continue records the current version, and an unavailable namespace or a refused write leaves the notice unacknowledged. Users who acknowledged an earlier version see the current notice again. The DeepSeek step targets `deepseek-official` in `llm-deepseek` and renders the existing `ProviderEditor` in credential-only mode inside the shared onboarding modal; `credentials.set` stays the only secret write, and no provider settings are changed.
 
 </details>
 

package/README.zh.md

@@ -41,13 +41,19 @@ Host 配置 `credentialOnboarding` 默认为 `true`。Electron preload 标记会
 
 ### API 密钥
 
-API 密钥输入框初始为空，并通过 `autocomplete="new-password"` 请求浏览器不要自动填入已保存的登录密码。
+API 密钥输入框初始为空，并通过 `autocomplete="new-password"` 请求浏览器不要自动填入已保存的登录密码。输入非空时，显示与会话密钥遮罩一致的眼睛按钮：**显示密钥**展示当前输入，**隐藏密钥**重新遮住输入。修改或清空输入后会重新遮住密钥。已保存凭据从不读入输入框。
 
-编辑卡片上的主字段是单独一个 **API 密钥**输入框——页面从不询问环境变量名。键入的密钥经 `credentials.set` 以**只写**方式存入 profile 的引用之下，profile 没有引用时便派生 `<ROUTE>_API_KEY`，pi-ai profile 会把这次派生记录为 `apiKeyEnv`，因此 `cordis.patch.yml` 从不携带密钥值。为新的 pi-ai 提供商留空密钥会保存一个不带引用的 profile，从而保留提供商原生认证（例如 Bedrock 凭据链或 Vertex ADC）。只有确认引用的凭据已配置时，行才会以绿色实心点标示 API 密钥状态；只有确认具名引用缺失时，才会以红色实心点标示。「应用」成功后会发出本地无障碍状态消息，且绝不回显任何机密内容。
+编辑卡片上的主字段是单独一个 **API 密钥**输入框——页面从不询问环境变量名。键入的密钥经 `credentials.set` 以**只写**方式存入 profile 的引用之下，profile 没有引用时便派生 `<ROUTE>_API_KEY`，pi-ai profile 会把这次派生记录为 `apiKeyEnv`，因此 `cordis.patch.yml` 从不携带密钥值。为新的 pi-ai 提供商留空密钥会保存一个不带引用的 profile，从而保留提供商原生认证（例如 Bedrock 凭据链或 Vertex ADC）。profile 有 `apiKeyEnv` 时，字段的占位文字与帮助提示采用该引用；否则按查找顺序采用可配置提供商目录为该路由报告的 `nativeAuth` 凭据变量，并排除 `baseURLEnv` 地址变量。这些显示提示会忽略包含 `oauth` 的引用（不区分大小写），并说明优先使用已保存凭据，其后为显示的环境后备。这项显示过滤不改变[凭据解析顺序](../../../docs/subsystems/credentials.zh.md#resolution)、适配器的完整环境变量列表或显式引用。被过滤的显式引用仍有可用的密钥输入框，使用普通占位文字且不显示帮助提示。没有密钥认证的原生路由不显示密钥字段及认证帮助；显式引用仍会启用该字段。路由没有 `nativeAuth`（例如手动声明的路由）且 profile 没有引用时，显示普通的密钥占位文字，且不显示帮助提示。只有确认引用的凭据已配置时，行才会以绿色实心点标示 API 密钥状态；只有确认具名引用缺失时，才会以红色实心点标示。「应用」成功后会发出本地无障碍状态消息，且绝不回显任何机密内容。
+
+编辑器使用脱敏 `CredentialInfo` 选择已保存凭据的占位文字或环境检测，不显示凭据来源标签。快照刷新会更新打开的编辑器，无需单独探测。提示从不接收凭据值，也不改变字段的可写性。
 
 ### 编辑提供商
 
-收起的「自定义设置」折叠区承载精选的额外字段：两个家族都有 `baseURL`（deepseek 的占位符显示公共端点）、各适配器自己的模型目录，以及适配器未提供的 pi-ai 路由的**显示名称**与 **API 协议**。Profile `headers` 仍是 `cordis.patch.yml` 或 Cordis 配置中的部署配置，Models 页面不提供编辑器。Provider ID 保持固定：它是 settings 的键、其他每个 namespace 与每一条已记录会话引用的名字，也是页面读不回、因而搬不走的凭据引用词干。推理等级刻意不在可编辑字段之列：它是按模型的能力，提供商级的控件只可能被设成某些模型会拒绝的值。每个模型行可编辑 `id`、可选显示 `name`、可选 `contextWindow`/`maxTokens` 和输入类型；无关的模型字段在编辑后仍会保留。
+密钥字段留空时，已检测到已保存凭据则提示使用该凭据，输入框下方不显示状态文字；否则提示使用环境认证。脱敏的 `credentials.describe` 检查区分已检测到环境引用、未检测到变量和读取状态未确认。缺少变量时使用黄色提示，并列出应配置的首个变量名。已检测到环境引用时使用绿色。地址配置变量不计作凭据。隐藏的认证引用仍参与检测；使用不含变量名的通用检测提示。检测不验证凭据、不测试连接，也不检查 AWS profile 或 Google 应用默认凭据等提供商管理的文件。输入非空时，不显示认证状态文字。页面读取原生变量名和具名引用，每批最多 64 项，不将变量值读入 Client。
+
+目录未提供固定默认端点时，输入框下方显示提供方的 `baseURLEnv` 配置变量名。Profile 中的端点仍是占位符的首选。
+
+收起的「自定义设置」折叠区承载精选的额外字段：两个家族都有 `baseURL`（占位符显示 profile 解析出的端点，deepseek 即公共端点；没有时显示可配置提供商目录为 pi-ai 内置路由报告的 `defaultBaseURL`）、各适配器自己的模型目录，以及适配器未提供的 pi-ai 路由的**显示名称**与 **API 协议**。Profile `headers` 仍是 `cordis.patch.yml` 或 Cordis 配置中的部署配置，Models 页面不提供编辑器。Provider ID 保持固定：它是 settings 的键、其他每个 namespace 与每一条已记录会话引用的名字，也是页面读不回、因而搬不走的凭据引用词干。推理等级刻意不在可编辑字段之列：它是按模型的能力，提供商级的控件只可能被设成某些模型会拒绝的值。每个模型行可编辑 `id`、可选显示 `name`、可选 `contextWindow`/`maxTokens` 和输入类型；无关的模型字段在编辑后仍会保留。
 
 `llm-deepseek` 的 DeepSeek 卡片编辑端点、凭据和模型目录。它使用 Messages，默认端点占位符为 `https://api.deepseek.com/anthropic`。
 
@@ -65,7 +71,7 @@ API 密钥输入框初始为空，并通过 `autocomplete="new-password"` 请求
 
 本分区为仓库外分发的插件声明两个席位，类型定义在 [`src/client/slot-contract.ts`](src/client/slot-contract.ts) 并从 `./client` 导出。`settings.models.provider-card`（keyed）渲染在每张展示目录行的卡片内部——已保存行的卡片、其首次运行 setup 形态、以及「添加提供商」草稿卡——以 `entryKey = settingsNs` 分发，owner props 携带该行的 `ConfigurableProviderView`、其 configured 状态与已确认的 api-key 凭据状态，因此以某适配器家族的 namespace 注册一次即可收到该家族的全部卡片，含手工声明的路由；手工声明的草稿卡尚无目录行，保存之前不分发。`settings.models.footer`（list）渲染在行列表与新增控件之后。注册方通过 `ctx.slots.inject` 激活，并以 type-only import 引入本包 `/client` 入口；没有注册方时两个席位均不渲染任何内容。
 
-Models 页面包含 **DeepSeek 账号**（`deepseek-account`，英文为 **DeepSeek Account**）。其编辑器展示共享的 DeepSeek 模型目录，不提供 API Key 或 Base URL 输入框；目录保存到账号路由自己的设置段（默认为 `llm-deepseek-account`），因此账号侧的编辑不会改写 official 路由读取的 `llm-deepseek` 段。账号可用模型目录为空时隐藏账号行，包括登录前和退登后；账号模型恢复可用时重新显示。
+Models 页面包含 **DeepSeek 账号**（`deepseek-account`，英文为 **DeepSeek Account**）。该行显示 **已登录** 状态，不提供编辑器：模型来自账号的模型列表，[模型覆盖](../../llm/llm-deepseek-account/README.zh.md#use-this-package)写在 `cordis.patch.yml` 中。账号可用模型目录为空时隐藏账号行，包括登录前和退登后；账号模型恢复可用时重新显示。
 
 -----
 
@@ -89,7 +95,7 @@ Models 页面包含 **DeepSeek 账号**（`deepseek-account`，英文为 **DeepS
 
 ### 引导协调器
 
-预览版说明在 `src/client/locales.ts` 中持有精确文案，并在 `src/onboarding-copy.ts` 中持有确认版本；回环时它通过既有 settings API 比较并写入 `ui-settings-general.welcomeNoticeVersion`，且只有显式点击「继续」才会记录当前版本。已确认旧版的用户会再次看到当前说明。非回环浏览器无法使用这个仅限宿主的 namespace，因此确认只保留在进程内，刷新后说明会再次出现。DeepSeek 步骤面向 `llm-deepseek` 中的 `deepseek-official`，在共享引导模态框内以仅凭据模式渲染既有 `ProviderEditor`；`credentials.set` 仍是唯一的机密写入，且不改变任何提供商设置。
+预览版说明在 `src/client/locales.ts` 中持有精确文案，并在 `src/onboarding-copy.ts` 中持有确认版本。认证浏览器通过共享配置表单比较并写入 `ui-settings-general.welcomeNoticeVersion`；只有显式点击「继续」才会记录当前版本；命名空间不可用或写入被拒时，声明保持未确认状态。已确认旧版的用户会再次看到当前说明。DeepSeek 步骤面向 `llm-deepseek` 中的 `deepseek-official`，在共享引导模态框内以仅凭据模式渲染既有 `ProviderEditor`；`credentials.set` 仍是唯一的机密写入，且不改变任何提供商设置。
 
 </details>
 

package/lib/client.js

@@ -55,7 +55,7 @@ window.__ModuleLoader__.load({
 		}
 		//#endregion
 		//#region \0dsh-css:/home/runner/work/deepseek-harness/deepseek-harness/packages/client/ui-settings-models/src/client/ModelsSection.module.css.mjs
-		const css$3 = ".zGbnIq_section{max-width:720px;color:var(--dsw-alias-label-primary);flex-direction:column;gap:12px;display:flex}.zGbnIq_title{color:var(--dsw-alias-label-primary);margin:0;font-size:16px;font-weight:500;line-height:24px}.zGbnIq_intro{color:var(--dsw-alias-label-tertiary);margin:0;font-size:14px;line-height:22px}.zGbnIq_notice{color:var(--dsw-alias-state-warn-label);margin:0;font-size:12px;line-height:18px}.zGbnIq_savedNotice{color:var(--dsw-alias-state-success-primary);margin:0;font-size:12px;line-height:18px}.zGbnIq_rows{flex-direction:column;gap:8px;margin:12px 0 0;padding:0;list-style:none;display:flex}.zGbnIq_rowCard{border:.5px solid var(--dsw-alias-settings-card-stroke);background:var(--dsw-alias-settings-card-fill);border-radius:var(--dsw-radius-xl);flex-direction:column;gap:12px;padding:12px 14px;display:flex}.zGbnIq_rowHead{align-items:center;gap:10px;display:flex}.zGbnIq_rowIdentity{align-items:center;gap:6px;min-width:0;display:inline-flex}.zGbnIq_rowName{color:var(--dsw-alias-label-primary);font-size:14px;font-weight:500;line-height:22px}.zGbnIq_rowTag{border:.5px solid var(--dsw-alias-border-l3);border-radius:var(--dsw-radius-xs);color:var(--dsw-alias-label-secondary);flex:none;padding:1px 6px;font-size:11px;line-height:16px}.zGbnIq_credentialDot{box-sizing:border-box;corner-shape:round;border-radius:50%;flex:none;width:8px;height:8px;display:inline-block}.zGbnIq_credentialDotConfigured{background:var(--dsw-alias-state-success-primary)}.zGbnIq_credentialDotMissing{background:var(--dsw-alias-state-error-primary)}.zGbnIq_rowActions{align-items:center;gap:4px;margin-left:auto;display:inline-flex}.zGbnIq_primaryButton,.zGbnIq_secondaryButton,.zGbnIq_addButton{box-sizing:border-box;border-radius:var(--dsw-radius-md);height:36px;font:inherit;cursor:pointer;border:none;justify-content:center;align-items:center;gap:4px;padding:0 14px;font-size:14px;line-height:22px;display:inline-flex}.zGbnIq_primaryButton{background:var(--dsw-alias-button-primary-fill);color:var(--dsw-alias-label-primary-foreground)}.zGbnIq_primaryButton:hover:not(:disabled){background:var(--dsw-alias-button-primary-hover)}.zGbnIq_secondaryButton,.zGbnIq_addButton{border:.5px solid var(--dsw-alias-border-l3);color:var(--dsw-alias-label-primary);background:0 0}.zGbnIq_secondaryButton:hover:not(:disabled),.zGbnIq_addButton:hover:not(:disabled){background:var(--dsw-alias-interactive-bg-hover)}.zGbnIq_secondaryButton:hover:not(:disabled){background:var(--dsw-alias-interactive-bg-hover-solid)}.zGbnIq_dangerButton{box-sizing:border-box;border-radius:var(--dsw-radius-md);height:36px;color:var(--dsw-alias-state-error-primary);font:inherit;cursor:pointer;background:0 0;border:none;justify-content:center;align-items:center;padding:0 14px;font-size:14px;line-height:22px;display:inline-flex}.zGbnIq_dangerButton:hover:not(:disabled){background:var(--dsw-alias-interactive-bg-hover-danger)}.zGbnIq_rowActions .zGbnIq_secondaryButton,.zGbnIq_rowActions .zGbnIq_dangerButton{border-radius:var(--dsw-radius-sm);height:28px;padding:0 10px;font-size:12px;line-height:18px}.zGbnIq_primaryButton:disabled,.zGbnIq_secondaryButton:disabled,.zGbnIq_dangerButton:disabled,.zGbnIq_addButton:disabled,.zGbnIq_linkButton:disabled,.zGbnIq_addModelButton:disabled{opacity:.4;cursor:default}.zGbnIq_primaryButton:focus-visible,.zGbnIq_secondaryButton:focus-visible,.zGbnIq_dangerButton:focus-visible,.zGbnIq_addButton:focus-visible,.zGbnIq_linkButton:focus-visible,.zGbnIq_addModelButton:focus-visible,.zGbnIq_iconButton:focus-visible,.zGbnIq_customizedSummary:focus-visible{box-shadow:0 0 0 2px var(--dsw-focus-ring-color,var(--dsw-alias-state-business-primary));outline:none}.zGbnIq_editor{border-radius:var(--dsw-radius-lg);background:var(--dsw-alias-bg-module-platform);flex-direction:column;gap:14px;padding:14px 16px;display:flex}.zGbnIq_editorHeader{align-items:baseline;gap:8px;display:flex}.zGbnIq_editorTitle{color:var(--dsw-alias-label-primary);font-size:14px;font-weight:500;line-height:22px}.zGbnIq_editorRoute{color:var(--dsw-alias-label-tertiary);font-size:12px;line-height:18px}.zGbnIq_field{flex-direction:column;gap:6px;display:flex}.zGbnIq_fieldLabel{color:var(--dsw-alias-label-secondary);align-items:center;gap:10px;font-size:12px;font-weight:500;line-height:18px;display:inline-flex}.zGbnIq_linkButton{box-sizing:border-box;border-radius:var(--dsw-radius-sm);height:28px;color:var(--dsw-alias-label-tertiary);font:inherit;cursor:pointer;background:0 0;border:none;align-items:center;padding:0 10px;font-size:12px;line-height:18px;display:inline-flex}.zGbnIq_linkButton:hover:not(:disabled){background:var(--dsw-alias-interactive-bg-hover);color:var(--dsw-alias-label-secondary)}.zGbnIq_advancedHint{color:var(--dsw-alias-label-tertiary);margin:0;font-size:12px;line-height:18px}.zGbnIq_editorActions{justify-content:flex-end;gap:8px;display:flex}.zGbnIq_addBlock{flex-direction:column;gap:12px;display:flex}.zGbnIq_addActions{display:flex}.zGbnIq_addButton{border:1px dashed var(--dsw-alias-border-l3);border-radius:var(--dsw-radius-lg);flex:1 1 0;gap:6px;min-width:180px;height:44px}.zGbnIq_addModes{flex-direction:column;align-items:flex-start;gap:8px;display:flex}.zGbnIq_addPanel{flex-direction:column;gap:14px;display:flex}.zGbnIq_addPanel[hidden]{display:none}.zGbnIq_addCard,.zGbnIq_setupCard{border-radius:var(--dsw-radius-lg);background:var(--dsw-alias-bg-module-platform);flex-direction:column;gap:14px;padding:14px 16px;list-style:none;display:flex}.zGbnIq_addCard .zGbnIq_editor,.zGbnIq_setupCard .zGbnIq_editor{background:0 0;padding:0}.zGbnIq_customized{border-top:.5px solid var(--dsw-alias-border-l2);padding-top:10px}.zGbnIq_customizedSummary{border-radius:var(--dsw-radius-sm);cursor:pointer;width:fit-content;color:var(--dsw-alias-label-secondary);align-items:center;gap:6px;margin-left:-4px;padding:2px 4px;font-size:12px;font-weight:500;line-height:18px;list-style:none;display:flex}.zGbnIq_customizedSummary::-webkit-details-marker{display:none}.zGbnIq_customizedSummary:before{content:\"\";border-bottom:1.5px solid;border-right:1.5px solid;width:5px;height:5px;transition:transform .12s;transform:rotate(-45deg)translate(-1px,-1px)}.zGbnIq_customized[open]>.zGbnIq_customizedSummary:before{transform:rotate(45deg)translate(-1px,-1px)}.zGbnIq_customizedSummary:hover{color:var(--dsw-alias-label-primary)}.zGbnIq_customizedBody{flex-direction:column;gap:12px;padding-top:12px;display:flex}.zGbnIq_modelCatalog{border-top:.5px solid var(--dsw-alias-border-l2);flex-direction:column;gap:10px;padding-top:12px;display:flex}.zGbnIq_modelCatalogHeading{flex-direction:column;gap:2px;display:flex}.zGbnIq_modelCatalogTitle{color:var(--dsw-alias-label-secondary);font-size:12px;font-weight:500;line-height:18px}.zGbnIq_modelCatalogMeta,.zGbnIq_modelEmpty{color:var(--dsw-alias-label-tertiary);margin:0;font-size:12px;line-height:18px}.zGbnIq_modelList{flex-direction:column;gap:8px;display:flex}.zGbnIq_modelListHead{justify-content:space-between;align-items:flex-start;gap:12px;display:flex}.zGbnIq_modelEntry{border:.5px solid var(--dsw-alias-border-l4);border-radius:var(--dsw-radius-lg);padding:6px}.zGbnIq_modelRow{grid-template-columns:minmax(0,1.4fr) minmax(0,1fr) auto auto;align-items:center;gap:6px;display:grid}.zGbnIq_iconButton{box-sizing:border-box;border-radius:var(--dsw-radius-sm);width:28px;height:28px;color:var(--dsw-alias-label-tertiary);cursor:pointer;background:0 0;border:none;justify-content:center;align-items:center;display:inline-flex}.zGbnIq_iconButton:hover:not(:disabled){background:var(--dsw-alias-interactive-bg-hover);color:var(--dsw-alias-label-primary)}.zGbnIq_iconButton:disabled{cursor:default;opacity:.4}.zGbnIq_iconButtonDanger:hover:not(:disabled){background:var(--dsw-alias-interactive-bg-hover-danger);color:var(--dsw-alias-state-error-primary)}.zGbnIq_modelAdvanced{grid-template-columns:repeat(2,minmax(0,1fr));gap:8px;padding:8px 4px 2px;display:grid}.zGbnIq_modelField{flex-direction:column;gap:4px;min-width:0;display:flex}.zGbnIq_modelInputTypes{border:none;grid-column:1/-1;min-width:0;margin:0;padding:0}.zGbnIq_modelInputTypes legend{margin-bottom:4px;padding:0}.zGbnIq_modelInputChoices{flex-wrap:wrap;align-items:center;gap:16px;min-height:32px;display:flex}.zGbnIq_modelFieldLabel{color:var(--dsw-alias-label-tertiary);font-size:12px;line-height:18px}.zGbnIq_modelEmpty{border:1px dashed var(--dsw-alias-border-l3);border-radius:var(--dsw-radius-lg);text-align:center;padding:12px}.zGbnIq_addModelButton{box-sizing:border-box;border:.5px solid var(--dsw-alias-border-l3);border-radius:var(--dsw-radius-sm);height:28px;color:var(--dsw-alias-label-primary);font:inherit;cursor:pointer;background:0 0;align-self:flex-start;align-items:center;gap:4px;padding:0 10px;font-size:12px;line-height:18px;display:inline-flex}.zGbnIq_addModelButton:hover:not(:disabled){background:var(--dsw-alias-interactive-bg-hover)}.zGbnIq_input{box-sizing:border-box;border:.5px solid var(--dsw-alias-border-l4);border-radius:var(--dsw-radius-md);width:100%;height:32px;font:inherit;background:var(--dsw-alias-bg-layer-1);color:var(--dsw-alias-label-primary);padding:0 10px;font-size:14px;line-height:22px}select.zGbnIq_input{cursor:pointer;max-width:240px}.zGbnIq_input:focus{border-color:var(--dsw-alias-state-business-primary);outline:none}.zGbnIq_input::placeholder{color:var(--dsw-alias-label-dimmed)}.zGbnIq_input:disabled{opacity:.6;cursor:default}.zGbnIq_selectInput{appearance:none;background-image:url(\"data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='12' height='12' viewBox='0 0 12 12' fill='none'%3E%3Cpath d='M3 4.5L6 7.5L9 4.5' stroke='%2381858C' stroke-width='1.5' stroke-linecap='round' stroke-linejoin='round'/%3E%3C/svg%3E\");background-position:right 12px center;background-repeat:no-repeat;background-size:12px 12px;padding-right:32px}.zGbnIq_error{color:var(--dsw-alias-state-error-primary);margin:0;font-size:12px;line-height:18px}.zGbnIq_deleteDialog{width:min(480px,100%)}.zGbnIq_deleteConfirm:not(:disabled){border-color:var(--dsw-alias-state-error-primary);color:var(--dsw-alias-state-error-primary)}.zGbnIq_deleteConfirm:hover:not(:disabled){background:var(--dsw-alias-interactive-bg-hover-danger)}.zGbnIq_hiddenLabel{clip:rect(0 0 0 0);white-space:nowrap;width:1px;height:1px;position:absolute;overflow:hidden}@media (prefers-reduced-motion:reduce){.zGbnIq_customizedSummary:before,.zGbnIq_switchThumb{transition:none}}.zGbnIq_fetchDialog{--dsh-scrollbar-thumb:var(--dsw-alias-scrollbar-bg-l2);--dsh-scrollbar-thumb-hover:var(--dsw-alias-scrollbar-hover-l2);max-width:520px}.zGbnIq_candidateToolbar{align-items:center;gap:8px;margin-bottom:6px;display:flex}.zGbnIq_candidateSearch{flex:240px;min-width:0}.zGbnIq_candidateList{flex-direction:column;gap:2px;max-height:320px;margin:0;padding:0;list-style:none;display:flex;overflow-y:auto}.zGbnIq_candidate{border-radius:var(--dsw-radius-md)}.zGbnIq_candidateLabel{cursor:pointer;align-items:center;gap:8px;padding:6px 8px;display:flex}.zGbnIq_candidateId{min-width:0;font-family:var(--ds-font-family-code);text-overflow:ellipsis;white-space:nowrap;flex:auto;font-size:13px;overflow:hidden}.zGbnIq_candidateEmpty{color:var(--dsw-alias-label-secondary);text-align:center;margin:24px 0;font-size:13px;line-height:20px}";
+		const css$3 = ".zGbnIq_section{max-width:720px;color:var(--dsw-alias-label-primary);flex-direction:column;gap:12px;display:flex}.zGbnIq_title{color:var(--dsw-alias-label-primary);margin:0;font-size:16px;font-weight:500;line-height:24px}.zGbnIq_intro{color:var(--dsw-alias-label-tertiary);margin:0;font-size:14px;line-height:22px}.zGbnIq_notice{color:var(--dsw-alias-state-warn-label);margin:0;font-size:12px;line-height:18px}.zGbnIq_savedNotice{color:var(--dsw-alias-state-success-primary);margin:0;font-size:12px;line-height:18px}.zGbnIq_rows{flex-direction:column;gap:8px;margin:12px 0 0;padding:0;list-style:none;display:flex}.zGbnIq_rowCard{border:.5px solid var(--dsw-alias-settings-card-stroke);background:var(--dsw-alias-settings-card-fill);border-radius:var(--dsw-radius-xl);flex-direction:column;gap:12px;padding:12px 14px;display:flex}.zGbnIq_rowHead{align-items:center;gap:10px;display:flex}.zGbnIq_rowIdentity{align-items:center;gap:6px;min-width:0;display:inline-flex}.zGbnIq_rowName{color:var(--dsw-alias-label-primary);font-size:14px;font-weight:500;line-height:22px}.zGbnIq_rowTag{border:.5px solid var(--dsw-alias-border-l3);border-radius:var(--dsw-radius-xs);color:var(--dsw-alias-label-secondary);flex:none;padding:1px 6px;font-size:11px;line-height:16px}.zGbnIq_credentialDot{box-sizing:border-box;corner-shape:round;border-radius:50%;flex:none;width:8px;height:8px;display:inline-block}.zGbnIq_credentialDotConfigured{background:var(--dsw-alias-state-success-primary)}.zGbnIq_credentialDotMissing{background:var(--dsw-alias-state-error-primary)}.zGbnIq_accountStatus{color:var(--dsw-alias-state-success-primary);flex:none;align-items:center;gap:6px;font-size:13px;line-height:20px;display:inline-flex}.zGbnIq_rowActions{align-items:center;gap:4px;margin-left:auto;display:inline-flex}.zGbnIq_primaryButton,.zGbnIq_secondaryButton,.zGbnIq_addButton{box-sizing:border-box;border-radius:var(--dsw-radius-md);height:36px;font:inherit;cursor:pointer;border:none;justify-content:center;align-items:center;gap:4px;padding:0 14px;font-size:14px;line-height:22px;display:inline-flex}.zGbnIq_primaryButton{background:var(--dsw-alias-button-primary-fill);color:var(--dsw-alias-label-primary-foreground)}.zGbnIq_primaryButton:hover:not(:disabled){background:var(--dsw-alias-button-primary-hover)}.zGbnIq_secondaryButton,.zGbnIq_addButton{border:.5px solid var(--dsw-alias-border-l3);color:var(--dsw-alias-label-primary);background:0 0}.zGbnIq_secondaryButton:hover:not(:disabled),.zGbnIq_addButton:hover:not(:disabled){background:var(--dsw-alias-interactive-bg-hover)}.zGbnIq_secondaryButton:hover:not(:disabled){background:var(--dsw-alias-interactive-bg-hover-solid)}.zGbnIq_dangerButton{box-sizing:border-box;border-radius:var(--dsw-radius-md);height:36px;color:var(--dsw-alias-state-error-primary);font:inherit;cursor:pointer;background:0 0;border:none;justify-content:center;align-items:center;padding:0 14px;font-size:14px;line-height:22px;display:inline-flex}.zGbnIq_dangerButton:hover:not(:disabled){background:var(--dsw-alias-interactive-bg-hover-danger)}.zGbnIq_rowActions .zGbnIq_secondaryButton,.zGbnIq_rowActions .zGbnIq_dangerButton{border-radius:var(--dsw-radius-sm);height:28px;padding:0 10px;font-size:12px;line-height:18px}.zGbnIq_primaryButton:disabled,.zGbnIq_secondaryButton:disabled,.zGbnIq_dangerButton:disabled,.zGbnIq_addButton:disabled,.zGbnIq_linkButton:disabled,.zGbnIq_addModelButton:disabled{opacity:.4;cursor:default}.zGbnIq_primaryButton:focus-visible,.zGbnIq_secondaryButton:focus-visible,.zGbnIq_dangerButton:focus-visible,.zGbnIq_addButton:focus-visible,.zGbnIq_linkButton:focus-visible,.zGbnIq_addModelButton:focus-visible,.zGbnIq_iconButton:focus-visible,.zGbnIq_customizedSummary:focus-visible{box-shadow:0 0 0 2px var(--dsw-focus-ring-color,var(--dsw-alias-state-business-primary));outline:none}.zGbnIq_editor{border-radius:var(--dsw-radius-lg);background:var(--dsw-alias-bg-module-platform);flex-direction:column;gap:14px;padding:14px 16px;display:flex}.zGbnIq_editorHeader{align-items:baseline;gap:8px;display:flex}.zGbnIq_editorTitle{color:var(--dsw-alias-label-primary);font-size:14px;font-weight:500;line-height:22px}.zGbnIq_editorRoute{color:var(--dsw-alias-label-tertiary);font-size:12px;line-height:18px}.zGbnIq_field{flex-direction:column;gap:6px;display:flex}.zGbnIq_fieldLabel{color:var(--dsw-alias-label-secondary);align-items:center;gap:10px;font-size:12px;font-weight:500;line-height:18px;display:inline-flex}.zGbnIq_helpButton{border:.5px solid var(--dsw-alias-border-l3);corner-shape:round;width:16px;height:16px;color:var(--dsw-alias-label-tertiary);font:inherit;text-align:center;cursor:help;background:0 0;border-radius:50%;padding:0;font-size:11px;line-height:15px}.zGbnIq_helpButton:hover,.zGbnIq_helpButton:focus-visible{color:var(--dsw-alias-label-primary);border-color:var(--dsw-alias-label-tertiary)}.zGbnIq_linkButton{box-sizing:border-box;border-radius:var(--dsw-radius-sm);height:28px;color:var(--dsw-alias-label-tertiary);font:inherit;cursor:pointer;background:0 0;border:none;align-items:center;padding:0 10px;font-size:12px;line-height:18px;display:inline-flex}.zGbnIq_linkButton:hover:not(:disabled){background:var(--dsw-alias-interactive-bg-hover);color:var(--dsw-alias-label-secondary)}.zGbnIq_advancedHint{color:var(--dsw-alias-label-tertiary);margin:0;font-size:12px;line-height:18px}.zGbnIq_editorActions{justify-content:flex-end;gap:8px;display:flex}.zGbnIq_addBlock{flex-direction:column;gap:12px;display:flex}.zGbnIq_addActions{display:flex}.zGbnIq_addButton{border:1px dashed var(--dsw-alias-border-l3);border-radius:var(--dsw-radius-lg);flex:1 1 0;gap:6px;min-width:180px;height:44px}.zGbnIq_addModes{flex-direction:column;align-items:flex-start;gap:8px;display:flex}.zGbnIq_addPanel{flex-direction:column;gap:14px;display:flex}.zGbnIq_addPanel[hidden]{display:none}.zGbnIq_addCard,.zGbnIq_setupCard{border-radius:var(--dsw-radius-lg);background:var(--dsw-alias-bg-module-platform);flex-direction:column;gap:14px;padding:14px 16px;list-style:none;display:flex}.zGbnIq_addCard .zGbnIq_editor,.zGbnIq_setupCard .zGbnIq_editor{background:0 0;padding:0}.zGbnIq_customized{border-top:.5px solid var(--dsw-alias-border-l2);padding-top:10px}.zGbnIq_customizedSummary{border-radius:var(--dsw-radius-sm);cursor:pointer;width:fit-content;color:var(--dsw-alias-label-secondary);align-items:center;gap:6px;margin-left:-4px;padding:2px 4px;font-size:12px;font-weight:500;line-height:18px;list-style:none;display:flex}.zGbnIq_customizedSummary::-webkit-details-marker{display:none}.zGbnIq_customizedSummary:before{content:\"\";border-bottom:1.5px solid;border-right:1.5px solid;width:5px;height:5px;transition:transform .12s;transform:rotate(-45deg)translate(-1px,-1px)}.zGbnIq_customized[open]>.zGbnIq_customizedSummary:before{transform:rotate(45deg)translate(-1px,-1px)}.zGbnIq_customizedSummary:hover{color:var(--dsw-alias-label-primary)}.zGbnIq_customizedBody{flex-direction:column;gap:12px;padding-top:12px;display:flex}.zGbnIq_modelCatalog{border-top:.5px solid var(--dsw-alias-border-l2);flex-direction:column;gap:10px;padding-top:12px;display:flex}.zGbnIq_modelCatalogHeading{flex-direction:column;gap:2px;display:flex}.zGbnIq_modelCatalogTitle{color:var(--dsw-alias-label-secondary);font-size:12px;font-weight:500;line-height:18px}.zGbnIq_modelCatalogMeta,.zGbnIq_modelEmpty{color:var(--dsw-alias-label-tertiary);margin:0;font-size:12px;line-height:18px}.zGbnIq_modelList{flex-direction:column;gap:8px;display:flex}.zGbnIq_modelListHead{justify-content:space-between;align-items:flex-start;gap:12px;display:flex}.zGbnIq_modelEntry{border:.5px solid var(--dsw-alias-border-l4);border-radius:var(--dsw-radius-lg);padding:6px}.zGbnIq_modelRow{grid-template-columns:minmax(0,1.4fr) minmax(0,1fr) auto auto;align-items:center;gap:6px;display:grid}.zGbnIq_iconButton{box-sizing:border-box;border-radius:var(--dsw-radius-sm);width:28px;height:28px;color:var(--dsw-alias-label-tertiary);cursor:pointer;background:0 0;border:none;justify-content:center;align-items:center;display:inline-flex}.zGbnIq_iconButton:hover:not(:disabled){background:var(--dsw-alias-interactive-bg-hover);color:var(--dsw-alias-label-primary)}.zGbnIq_iconButton:disabled{cursor:default;opacity:.4}.zGbnIq_iconButtonDanger:hover:not(:disabled){background:var(--dsw-alias-interactive-bg-hover-danger);color:var(--dsw-alias-state-error-primary)}.zGbnIq_modelAdvanced{grid-template-columns:repeat(2,minmax(0,1fr));gap:8px;padding:8px 4px 2px;display:grid}.zGbnIq_modelField{flex-direction:column;gap:4px;min-width:0;display:flex}.zGbnIq_modelInputTypes{border:none;grid-column:1/-1;min-width:0;margin:0;padding:0}.zGbnIq_modelInputTypes legend{margin-bottom:4px;padding:0}.zGbnIq_modelInputChoices{flex-wrap:wrap;align-items:center;gap:16px;min-height:32px;display:flex}.zGbnIq_modelFieldLabel{color:var(--dsw-alias-label-tertiary);font-size:12px;line-height:18px}.zGbnIq_modelEmpty{border:1px dashed var(--dsw-alias-border-l3);border-radius:var(--dsw-radius-lg);text-align:center;padding:12px}.zGbnIq_addModelButton{box-sizing:border-box;border:.5px solid var(--dsw-alias-border-l3);border-radius:var(--dsw-radius-sm);height:28px;color:var(--dsw-alias-label-primary);font:inherit;cursor:pointer;background:0 0;align-self:flex-start;align-items:center;gap:4px;padding:0 10px;font-size:12px;line-height:18px;display:inline-flex}.zGbnIq_addModelButton:hover:not(:disabled){background:var(--dsw-alias-interactive-bg-hover)}.zGbnIq_input{box-sizing:border-box;border:.5px solid var(--dsw-alias-border-l4);border-radius:var(--dsw-radius-md);width:100%;height:32px;font:inherit;background:var(--dsw-alias-bg-layer-1);color:var(--dsw-alias-label-primary);padding:0 10px;font-size:14px;line-height:22px}select.zGbnIq_input{cursor:pointer;max-width:240px}.zGbnIq_input:focus{border-color:var(--dsw-alias-state-business-primary);outline:none}.zGbnIq_input::placeholder{color:var(--dsw-alias-label-dimmed)}.zGbnIq_input:disabled{opacity:.6;cursor:default}.zGbnIq_keyInput{position:relative}.zGbnIq_keyInputFilled{padding-right:40px}.zGbnIq_keyToggle{border-radius:var(--dsw-radius-md);width:32px;color:var(--dsw-alias-label-secondary);cursor:pointer;background:0 0;border:none;justify-content:center;align-items:center;padding:0;display:inline-flex;position:absolute;inset:1px 1px 1px auto}.zGbnIq_keyToggle:hover:not(:disabled){color:var(--dsw-alias-label-primary)}.zGbnIq_keyToggle:focus-visible{outline:var(--dsw-focus-ring-width) solid var(--dsw-focus-ring-color,var(--dsw-alias-state-business-primary));outline-offset:-2px}.zGbnIq_keyToggle:disabled{opacity:.6;cursor:default}.zGbnIq_selectInput{appearance:none;background-image:url(\"data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='12' height='12' viewBox='0 0 12 12' fill='none'%3E%3Cpath d='M3 4.5L6 7.5L9 4.5' stroke='%2381858C' stroke-width='1.5' stroke-linecap='round' stroke-linejoin='round'/%3E%3C/svg%3E\");background-position:right 12px center;background-repeat:no-repeat;background-size:12px 12px;padding-right:32px}.zGbnIq_error{color:var(--dsw-alias-state-error-primary);margin:0;font-size:12px;line-height:18px}.zGbnIq_deleteDialog{width:min(480px,100%)}.zGbnIq_deleteConfirm:not(:disabled){border-color:var(--dsw-alias-state-error-primary);color:var(--dsw-alias-state-error-primary)}.zGbnIq_deleteConfirm:hover:not(:disabled){background:var(--dsw-alias-interactive-bg-hover-danger)}.zGbnIq_hiddenLabel{clip:rect(0 0 0 0);white-space:nowrap;width:1px;height:1px;position:absolute;overflow:hidden}@media (prefers-reduced-motion:reduce){.zGbnIq_customizedSummary:before,.zGbnIq_switchThumb{transition:none}}.zGbnIq_fetchDialog{--dsh-scrollbar-thumb:var(--dsw-alias-scrollbar-bg-l2);--dsh-scrollbar-thumb-hover:var(--dsw-alias-scrollbar-hover-l2);max-width:520px}.zGbnIq_candidateToolbar{align-items:center;gap:8px;margin-bottom:6px;display:flex}.zGbnIq_candidateSearch{flex:240px;min-width:0}.zGbnIq_candidateList{flex-direction:column;gap:2px;max-height:320px;margin:0;padding:0;list-style:none;display:flex;overflow-y:auto}.zGbnIq_candidate{border-radius:var(--dsw-radius-md)}.zGbnIq_candidateLabel{cursor:pointer;align-items:center;gap:8px;padding:6px 8px;display:flex}.zGbnIq_candidateId{min-width:0;font-family:var(--ds-font-family-code);text-overflow:ellipsis;white-space:nowrap;flex:auto;font-size:13px;overflow:hidden}.zGbnIq_candidateEmpty{color:var(--dsw-alias-label-secondary);text-align:center;margin:24px 0;font-size:13px;line-height:20px}";
 		const tagId$3 = "@deepseek-ai/dsh-client-ui-settings-models/ModelsSection.module.css";
 		if (typeof document !== "undefined" && document.querySelector("style[data-plugin-css=" + JSON.stringify(tagId$3) + "]") === null) {
 			const tag = document.createElement("style");
@@ -65,6 +65,7 @@ window.__ModuleLoader__.load({
 			document.head.appendChild(tag);
 		}
 		var ModelsSection_module_css_default = {
+			"accountStatus": "zGbnIq_accountStatus",
 			"addActions": "zGbnIq_addActions",
 			"addBlock": "zGbnIq_addBlock",
 			"addButton": "zGbnIq_addButton",
@@ -98,11 +99,15 @@ window.__ModuleLoader__.load({
 			"fetchDialog": "zGbnIq_fetchDialog",
 			"field": "zGbnIq_field",
 			"fieldLabel": "zGbnIq_fieldLabel",
+			"helpButton": "zGbnIq_helpButton",
 			"hiddenLabel": "zGbnIq_hiddenLabel",
 			"iconButton": "zGbnIq_iconButton",
 			"iconButtonDanger": "zGbnIq_iconButtonDanger",
 			"input": "zGbnIq_input",
 			"intro": "zGbnIq_intro",
+			"keyInput": "zGbnIq_keyInput",
+			"keyInputFilled": "zGbnIq_keyInputFilled",
+			"keyToggle": "zGbnIq_keyToggle",
 			"linkButton": "zGbnIq_linkButton",
 			"modelAdvanced": "zGbnIq_modelAdvanced",
 			"modelCatalog": "zGbnIq_modelCatalog",
@@ -136,6 +141,55 @@ window.__ModuleLoader__.load({
 			"title": "zGbnIq_title"
 		};
 		//#endregion
+		//#region lib/types/client/ApiKeyInput.js
+		/** Write-only credential input with the same reveal behavior as masked conversation text. */
+		const EYE_CONTOUR = "M1.5 8C2.9 5.25 5.25 3.5 8 3.5C10.75 3.5 13.1 5.25 14.5 8C13.1 10.75 10.75 12.5 8 12.5C5.25 12.5 2.9 10.75 1.5 8Z";
+		const EYE_PATH = `${EYE_CONTOUR}M10 8C10 9.1 9.1 10 8 10C6.9 10 6 9.1 6 8C6 6.9 6.9 6 8 6C9.1 6 10 6.9 10 8Z`;
+		const EYE_OFF_PATH = `${EYE_CONTOUR}M2.5 2.5L13.5 13.5`;
+		/**
+		* Reveal only a nonempty draft; a different value starts masked, as in SecretText.
+		* @param props - current draft, input attributes, and translated control labels.
+		* @returns a password input with an optional reveal button.
+		*/
+		function ApiKeyInput({ value, t, ...props }) {
+			const [revealedValue, setRevealedValue] = (0, react.useState)();
+			const revealed = value.length > 0 && revealedValue === value;
+			return (0, react_jsx_runtime.jsxs)("div", {
+				className: ModelsSection_module_css_default["keyInput"],
+				children: [(0, react_jsx_runtime.jsx)("input", {
+					...props,
+					className: `${ModelsSection_module_css_default["input"]} ${value.length > 0 ? ModelsSection_module_css_default["keyInputFilled"] : ""}`,
+					type: revealed ? "text" : "password",
+					autoComplete: "new-password",
+					value,
+					onChange: (event) => {
+						setRevealedValue(void 0);
+						props.onChange?.(event);
+					}
+				}), value.length === 0 ? null : (0, react_jsx_runtime.jsx)("button", {
+					type: "button",
+					className: ModelsSection_module_css_default["keyToggle"],
+					"aria-label": t(revealed ? "keyHide" : "keyReveal"),
+					"aria-pressed": revealed,
+					disabled: props.disabled,
+					onClick: () => {
+						setRevealedValue(revealed ? void 0 : value);
+					},
+					children: (0, react_jsx_runtime.jsx)("svg", {
+						width: "16",
+						height: "16",
+						viewBox: "0 0 16 16",
+						fill: "none",
+						stroke: "currentColor",
+						strokeWidth: 1.3,
+						strokeLinecap: "round",
+						"aria-hidden": "true",
+						children: (0, react_jsx_runtime.jsx)("path", { d: revealed ? EYE_OFF_PATH : EYE_PATH })
+					})
+				})]
+			});
+		}
+		//#endregion
 		//#region lib/types/client/EditorFooter.js
 		/**
 		* Render one provider card's action row.
@@ -914,6 +968,9 @@ window.__ModuleLoader__.load({
 				settingsPath: [...entry.settingsPath],
 				active: active.has(entry.provider),
 				...entry.declared === void 0 ? {} : { declared: entry.declared },
+				...entry.defaultBaseURL === void 0 ? {} : { defaultBaseURL: entry.defaultBaseURL },
+				...entry.baseURLEnv === void 0 ? {} : { baseURLEnv: entry.baseURLEnv },
+				...entry.nativeAuth === void 0 ? {} : { nativeAuth: entry.nativeAuth },
 				...entry.error === void 0 ? {} : { error: entry.error }
 			}));
 			for (const provider of registered) {
@@ -1041,7 +1098,9 @@ window.__ModuleLoader__.load({
 				}
 				const mirrored = this.describeFace.getSnapshot();
 				if (mirrored.view === void 0) {
-					this.failLoad(mirrored.error ?? "settings are unavailable in this browser");
+					/* v8 ignore next -- SettingsDescribeFace.ensure settles with a view or the read's error */
+					if (mirrored.error === null) throw new Error("settings describe settled with neither a view nor an error");
+					this.failLoad(mirrored.error);
 					return;
 				}
 				const providers = joinProviderDirectory(registered.value, declared.value);
@@ -1062,13 +1121,16 @@ window.__ModuleLoader__.load({
 					const catalog = await this.ctx.remote.session.modelCatalog();
 					for (const row of rows) if (row.entry.provider === "deepseek-account") row.accountAvailable = catalog.ok && catalog.value.groups.some((group) => group.id === "deepseek-account" && group.models.length > 0);
 				}
-				const refs = [...new Set(rows.filter((row) => row.entry.provider !== "deepseek-account").map((row) => row.apiKeyEnv ?? deriveKeyRef(row.entry.provider)))];
-				let credentials = {};
+				const refs = [...new Set(rows.filter((row) => row.entry.provider !== "deepseek-account").flatMap((row) => row.apiKeyEnv === void 0 ? [deriveKeyRef(row.entry.provider), ...row.entry.nativeAuth?.env ?? []] : [row.apiKeyEnv]))];
+				const credentials = {};
 				let credentialError = null;
-				if (refs.length > 0) {
-					const response = await this.ctx.remote.credentials.describe(refs);
-					if (response.ok) credentials = response.value;
-					else credentialError = response.error.message;
+				for (let index = 0; index < refs.length; index += 64) {
+					const response = await this.ctx.remote.credentials.describe(refs.slice(index, index + 64));
+					if (response.ok) Object.assign(credentials, response.value);
+					else {
+						credentialError = response.error.message;
+						break;
+					}
 				}
 				if (generation !== this.generation) return;
 				this.store.update((s) => {
@@ -1083,7 +1145,11 @@ window.__ModuleLoader__.load({
 						return {
 							...row,
 							...named === void 0 ? {} : { credential: named },
-							...derived === void 0 ? {} : { derivedCredential: derived }
+							...derived === void 0 ? {} : { derivedCredential: derived },
+							...credentialError === null ? { credentialChecks: Object.fromEntries((row.apiKeyEnv === void 0 ? row.entry.nativeAuth?.env ?? [] : [row.apiKeyEnv]).flatMap((ref) => {
+								const info = credentials[ref];
+								return info === void 0 ? [] : [[ref, info]];
+							})) } : {}
 						};
 					});
 					s.namespaces = namespaces;
@@ -1401,10 +1467,8 @@ window.__ModuleLoader__.load({
 								className: ModelsSection_module_css_default["fieldLabel"],
 								children: t("keyInput")
 							}),
-							(0, react_jsx_runtime.jsx)("input", {
-								className: ModelsSection_module_css_default["input"],
-								type: "password",
-								autoComplete: "new-password",
+							(0, react_jsx_runtime.jsx)(ApiKeyInput, {
+								t,
 								value: keyDraft,
 								placeholder: t("keyPlaceholder"),
 								"aria-label": t("keyInput"),
@@ -1536,7 +1600,6 @@ window.__ModuleLoader__.load({
 			const { namespace, schema, settingsPath, operations, t } = props;
 			const [draft, setDraft] = (0, react.useState)(() => draftAt(schema, namespace, settingsPath));
 			const [keyDraft, setKeyDraft] = (0, react.useState)("");
-			const [keyState, setKeyState] = (0, react.useState)(void 0);
 			const [busy, setBusy] = (0, react.useState)(false);
 			const [listBusy, setListBusy] = (0, react.useState)(false);
 			const { onBusyChange } = props;
@@ -1558,30 +1621,13 @@ window.__ModuleLoader__.load({
 			]);
 			const fallback = schema.getPath(namespace.value, settingsPath);
 			const disabled = props.readOnly || busy;
-			const accountProvider = props.provider === "deepseek-account";
-			const layout = accountProvider ? "deepseek" : layoutOf(namespace.ns);
+			const layout = layoutOf(namespace.ns);
 			const keyRef = refFor(schema, namespace, settingsPath, props.provider);
 			const protocols = (0, react.useMemo)(() => layout === "pi-ai" ? protocolChoices(namespace, schema) : [], [
 				layout,
 				namespace,
 				schema
 			]);
-			(0, react.useEffect)(() => {
-				if (accountProvider) return;
-				let stale = false;
-				setKeyState(void 0);
-				operations.describeCredential(keyRef).then((described) => {
-					if (stale) return;
-					setKeyState(described);
-				});
-				return () => {
-					stale = true;
-				};
-			}, [
-				operations,
-				keyRef,
-				accountProvider
-			]);
 			const stringAt = (source, key) => {
 				const value = schema.getPath(source, [key]);
 				return typeof value === "string" && value.trim().length > 0 ? value : void 0;
@@ -1663,7 +1709,6 @@ window.__ModuleLoader__.load({
 					props.t("settingsPathUnresolvable")
 				]
 			});
-			const keyLocked = keyState?.writable === false;
 			/**
 			* The catalog beneath the user layer: what the composition entry pinned, or
 			* else the schema default that `resolve` would supply. The effective value
@@ -1687,7 +1732,38 @@ window.__ModuleLoader__.load({
 				const defaultContextWindow = schema.getPath(fallback, ["defaultContextWindow"]);
 				const defaultMaxTokens = schema.getPath(fallback, ["maxTokens"]);
 				const defaultInput = schema.getPath(fallback, ["defaultInput"]);
-				const keyPlaceholder = keyLocked ? t("keyEnvLocked") : keyState?.configured === true && props.credentialRequired !== true ? t("keyStored") : family === "pi-ai" ? t("keyPlaceholderNative") : t("keyPlaceholder");
+				const baseURL = stringAt(fallback, "baseURL") ?? props.defaultBaseURL;
+				const endpointEnv = props.baseURLEnv ?? [];
+				const endpointHint = family === "deepseek" ? t("deepSeekEndpointHint") : baseURL === void 0 && endpointEnv.length > 0 ? t("baseUrlEnvironment").replace("{env}", () => endpointEnv.join(", ")) : void 0;
+				const namedRef = stringAt(fallback, "apiKeyEnv");
+				const nativeAuth = namedRef === void 0 ? props.nativeAuth : void 0;
+				const authRefs = namedRef === void 0 ? (nativeAuth?.env ?? []).filter((ref) => !endpointEnv.includes(ref)) : [namedRef];
+				const visibleRefs = authRefs.filter((ref) => !ref.toLowerCase().includes("oauth"));
+				const keyHint = visibleRefs[0];
+				const checkedRefs = authRefs.map((ref) => [ref, props.credentialChecks?.[ref] ?? (ref === namedRef ? props.credential : void 0)]);
+				const detected = checkedRefs.find(([, info]) => info?.configured === true);
+				const detectedRef = detected?.[0];
+				const detectedVisibleRef = detectedRef === void 0 || !visibleRefs.includes(detectedRef) ? void 0 : detectedRef;
+				const missingRefs = checkedRefs.length > 0 && checkedRefs.every(([, info]) => info?.configured === false);
+				const savedCredential = detected?.[1]?.source === "file";
+				const credentialHint = keyDraft.length > 0 || savedCredential || keyHint === void 0 || props.credentialRequired === true ? void 0 : t(detectedRef === void 0 ? missingRefs ? "keyFallbackMissing" : "keyFallbackUnchecked" : detectedVisibleRef === void 0 ? "keyFallbackDetectedHidden" : "keyFallbackDetected").replace("{hint}", () => detectedVisibleRef ?? keyHint);
+				const keyHelp = visibleRefs.length === 0 ? void 0 : t("keyHelp").replace("{env}", () => visibleRefs.join(" / "));
+				const authHelp = keyHelp === void 0 ? null : (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Tooltip, {
+					label: keyHelp,
+					side: "right",
+					delayMs: 0,
+					focusDelayMs: 0,
+					portal: true,
+					openOnClick: true,
+					children: (0, react_jsx_runtime.jsx)("button", {
+						type: "button",
+						className: ModelsSection_module_css_default["helpButton"],
+						"aria-label": t("authHelp"),
+						children: "?"
+					})
+				});
+				const keylessNativeAuth = nativeAuth?.env.length === 0 && nativeAuth.oauth;
+				const keyPlaceholder = keyHint === void 0 || props.credentialRequired === true ? t("keyPlaceholder") : t(savedCredential ? "keyPlaceholderSaved" : "keyPlaceholderFallback").replace("{hint}", () => keyHint);
 				/** What both family editors take: the rows, whose layer owns them, and the two writes. */
 				const catalogProps = {
 					models,
@@ -1701,33 +1777,32 @@ window.__ModuleLoader__.load({
 						setDraft((current) => schema.deletePath(current, ["models"]));
 					}
 				};
-				if (accountProvider) return (0, react_jsx_runtime.jsx)(DeepSeekModelsEditor, {
-					...catalogProps,
-					defaultContextWindow: typeof defaultContextWindow === "number" ? defaultContextWindow : void 0,
-					defaultMaxTokens: typeof defaultMaxTokens === "number" ? defaultMaxTokens : void 0
-				});
-				return (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [(0, react_jsx_runtime.jsxs)("div", {
+				return (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [keylessNativeAuth ? null : (0, react_jsx_runtime.jsxs)("div", {
 					className: ModelsSection_module_css_default["field"],
 					children: [
-						(0, react_jsx_runtime.jsx)("span", {
+						(0, react_jsx_runtime.jsxs)("span", {
 							className: ModelsSection_module_css_default["fieldLabel"],
-							children: t("keyInput")
+							children: [t("keyInput"), authHelp]
 						}),
-						(0, react_jsx_runtime.jsx)("input", {
-							className: ModelsSection_module_css_default["input"],
-							type: "password",
-							autoComplete: "new-password",
+						(0, react_jsx_runtime.jsx)(ApiKeyInput, {
+							t,
 							value: keyDraft,
 							placeholder: keyPlaceholder,
 							"aria-label": t("keyInput"),
 							"aria-invalid": shownKeyFailure !== void 0,
+							"aria-describedby": credentialHint === void 0 ? void 0 : `${props.provider}-credential-hint`,
 							required: props.credentialRequired === true,
 							autoFocus: props.autoFocusCredential === true,
-							disabled: disabled || keyLocked,
+							disabled,
 							onChange: (event) => {
 								setKeyDraft(event.target.value);
 							}
 						}),
+						credentialHint === void 0 ? null : (0, react_jsx_runtime.jsx)("p", {
+							id: `${props.provider}-credential-hint`,
+							className: ModelsSection_module_css_default[missingRefs ? "notice" : detectedRef === void 0 ? "advancedHint" : "savedNotice"],
+							children: credentialHint
+						}),
 						shownKeyFailure === void 0 ? null : (0, react_jsx_runtime.jsx)("p", {
 							className: ModelsSection_module_css_default["error"],
 							children: t(shownKeyFailure)
@@ -1769,19 +1844,19 @@ window.__ModuleLoader__.load({
 										className: ModelsSection_module_css_default["input"],
 										type: "text",
 										value: stringAt(draft, "baseURL") ?? "",
-										placeholder: family === "deepseek" ? t("deepSeekBaseUrl") : stringAt(fallback, "baseURL") ?? t("baseUrlDefault"),
-										"aria-describedby": family === "deepseek" ? `${props.provider}-endpoint-hint` : void 0,
+										placeholder: family === "deepseek" ? t("deepSeekBaseUrl") : baseURL === void 0 ? t(endpointEnv.length > 0 ? "baseUrlConfigured" : "baseUrlDefault") : t("baseUrlPlaceholder").replace("{url}", () => baseURL),
+										"aria-describedby": endpointHint === void 0 ? void 0 : `${props.provider}-endpoint-hint`,
 										"aria-label": t("baseUrl"),
 										disabled,
 										onChange: (event) => {
 											setField("baseURL", event.target.value === "" ? void 0 : event.target.value);
 										}
 									}),
-									family === "deepseek" ? (0, react_jsx_runtime.jsx)("span", {
+									endpointHint === void 0 ? null : (0, react_jsx_runtime.jsx)("span", {
 										id: `${props.provider}-endpoint-hint`,
 										className: ModelsSection_module_css_default["advancedHint"],
-										children: t("deepSeekEndpointHint")
-									}) : null
+										children: endpointHint
+									})
 								]
 							}),
 							ownsIdentity ? (0, react_jsx_runtime.jsxs)("div", {
@@ -1891,12 +1966,17 @@ window.__ModuleLoader__.load({
 		* post-apply reload.
 		*/
 		/** Render an editor for either the setup posture or an expanded provider row. */
-		function renderProviderEditor({ target, ...props }) {
+		function renderProviderEditor({ target, row, ...props }) {
 			return (0, react_jsx_runtime.jsx)(ProviderEditor, {
 				provider: target.provider,
 				displayName: target.displayName,
 				settingsPath: target.settingsPath,
 				...target.declared === true ? { declared: true } : {},
+				...target.defaultBaseURL === void 0 ? {} : { defaultBaseURL: target.defaultBaseURL },
+				...target.baseURLEnv === void 0 ? {} : { baseURLEnv: target.baseURLEnv },
+				...target.nativeAuth === void 0 ? {} : { nativeAuth: target.nativeAuth },
+				...row.credential === void 0 ? {} : { credential: row.credential },
+				...row.credentialChecks === void 0 ? {} : { credentialChecks: row.credentialChecks },
 				...props
 			});
 		}
@@ -1956,7 +2036,10 @@ window.__ModuleLoader__.load({
 				settingsNs: row.entry.settingsNs,
 				settingsPath: row.entry.settingsPath,
 				...credentialRef === void 0 ? {} : { credentialRef },
-				...row.entry.declared === true ? { declared: true } : {}
+				...row.entry.declared === true ? { declared: true } : {},
+				...row.entry.defaultBaseURL === void 0 ? {} : { defaultBaseURL: row.entry.defaultBaseURL },
+				...row.entry.baseURLEnv === void 0 ? {} : { baseURLEnv: row.entry.baseURLEnv },
+				...row.entry.nativeAuth === void 0 ? {} : { nativeAuth: row.entry.nativeAuth }
 			};
 		}
 		/** Stable visible and accessible identity for one provider target. */
@@ -2178,6 +2261,7 @@ window.__ModuleLoader__.load({
 									error,
 									renderProviderEditor({
 										target,
+										row,
 										namespace,
 										schema,
 										operations,
@@ -2213,6 +2297,13 @@ window.__ModuleLoader__.load({
 													className: ModelsSection_module_css_default["rowTag"],
 													children: t("customTag")
 												}) : null,
+												row.entry.provider === "deepseek-account" ? (0, react_jsx_runtime.jsxs)("span", {
+													className: ModelsSection_module_css_default["accountStatus"],
+													children: [(0, react_jsx_runtime.jsx)("span", {
+														className: `${ModelsSection_module_css_default["credentialDot"]} ${ModelsSection_module_css_default["credentialDotConfigured"]}`,
+														"aria-hidden": "true"
+													}), t("accountSignedIn")]
+												}) : null,
 												credentialConfigured ? (0, react_jsx_runtime.jsx)("span", {
 													className: `${ModelsSection_module_css_default["credentialDot"]} ${ModelsSection_module_css_default["credentialDotConfigured"]}`,
 													role: "img",
@@ -2227,7 +2318,7 @@ window.__ModuleLoader__.load({
 											]
 										}), (0, react_jsx_runtime.jsxs)("span", {
 											className: ModelsSection_module_css_default["rowActions"],
-											children: [(0, react_jsx_runtime.jsx)("button", {
+											children: [row.entry.provider === "deepseek-account" ? null : (0, react_jsx_runtime.jsx)("button", {
 												type: "button",
 												className: ModelsSection_module_css_default["secondaryButton"],
 												"aria-label": providerCopy(t("editProvider"), target),
@@ -2262,6 +2353,7 @@ window.__ModuleLoader__.load({
 									}, { entryKey: row.entry.settingsNs }),
 									open ? renderProviderEditor({
 										target,
+										row,
 										namespace,
 										schema,
 										operations,
@@ -2352,6 +2444,10 @@ window.__ModuleLoader__.load({
 											schema,
 											settingsPath: draft.target.settingsPath,
 											operations,
+											...draft.target.defaultBaseURL === void 0 ? {} : { defaultBaseURL: draft.target.defaultBaseURL },
+											...draft.target.baseURLEnv === void 0 ? {} : { baseURLEnv: draft.target.baseURLEnv },
+											...draft.target.nativeAuth === void 0 ? {} : { nativeAuth: draft.target.nativeAuth },
+											...addRow?.credentialChecks === void 0 ? {} : { credentialChecks: addRow.credentialChecks },
 											t,
 											readOnly: !state.writable,
 											onClose: (changed) => {
@@ -2695,16 +2791,14 @@ window.__ModuleLoader__.load({
 		//#endregion
 		//#region lib/types/client/welcome-store.js
 		/**
-		* Welcome-notice state derived from the welcome settings scope. The scope is
-		* the transport: a loopback browser follows the durable Host section, while a
-		* remote browser's memory-mode scope never answers and the acknowledgement
-		* stays process-local here.
+		* Welcome-notice state derived from the welcome settings scope: the notice
+		* follows the Host section and records its acknowledgement through it.
 		*/
 		/* v8 ignore next 3 -- closed-union default only defends future source widening */
 		function assertNever(_value) {
 			throw new Error("unexpected welcome settings status");
 		}
-		/** Coordinates durable Host acknowledgement or a process-local remote fallback. */
+		/** Coordinates the durable Host acknowledgement. */
 		var WelcomeNoticeStore = class {
 			scope;
 			/** uSES-safe state source shared by the registered welcome step. */
@@ -2713,13 +2807,8 @@ window.__ModuleLoader__.load({
 				acknowledged: false,
 				error: null
 			});
-			localAcknowledged = false;
 			saving = false;
 			following;
-			/**
-			* @param scope - the welcome settings namespace scope; its memory mode is
-			* what keeps a remote browser process-local.
-			*/
 			constructor(scope) {
 				this.scope = scope;
 			}
@@ -2735,17 +2824,12 @@ window.__ModuleLoader__.load({
 				return Promise.resolve();
 			}
 			/**
-			* Persist this copy version, or advance only this process for a remote
-			* browser. Success is judged against the state the write left behind, so a
-			* refused or failed write reports false after its recovery read settles.
-			* @returns true when the selected persistence mode holds the acknowledgement.
+			* Persist this copy version through the scope. Success is judged against the
+			* state the write left behind, so a refused or failed write reports false
+			* after its recovery read settles.
+			* @returns true when the Host holds the acknowledgement.
 			*/
 			async acknowledge() {
-				if (this.scope.getSnapshot().mode === "memory") {
-					this.localAcknowledged = true;
-					this.derive();
-					return true;
-				}
 				this.saving = true;
 				this.store.update((state) => {
 					state.status = "saving";
@@ -2772,14 +2856,6 @@ window.__ModuleLoader__.load({
 			derive() {
 				if (this.saving) return;
 				const scope = this.scope.getSnapshot();
-				if (scope.mode === "memory") {
-					this.store.update((state) => {
-						state.status = "ready";
-						state.acknowledged = this.localAcknowledged;
-						state.error = null;
-					});
-					return;
-				}
 				switch (scope.status) {
 					case "loading":
 						this.store.update((state) => {
@@ -2824,10 +2900,6 @@ window.__ModuleLoader__.load({
 		*/
 		function createModelsOperations(ctx) {
 			return {
-				describeCredential: async (ref) => {
-					const response = await ctx.remote.credentials.describe([ref]);
-					return response.ok ? response.value[ref] : void 0;
-				},
 				storeCredential: async (ref, value) => {
 					const response = await ctx.remote.credentials.set(ref, value);
 					return response.ok ? void 0 : response.error.message;
@@ -2915,19 +2987,30 @@ window.__ModuleLoader__.load({
 			savedProvider: "Saved {provider}.",
 			credentialConfigured: "API key configured",
 			credentialMissing: "API key missing",
+			accountSignedIn: "Signed in",
 			readOnly: "The settings document is read-only in this deployment.",
 			loadFailed: "Loading the provider directory failed",
 			conflict: "Someone else changed these settings while this card was open. Close it and reopen to edit the current values.",
 			retry: "Retry",
 			keyInput: "API key",
+			keyReveal: "Show secret",
+			keyHide: "Hide secret",
 			keyPlaceholder: "Enter your API key",
-			keyPlaceholderNative: "Enter an API key, or leave blank to use environment authentication",
-			keyStored: "Configured — enter a new value to replace",
-			keyEnvLocked: "Provided by the launch environment (read-only)",
+			keyPlaceholderFallback: "Leave blank to use env as auth ({hint})",
+			keyPlaceholderSaved: "Leave blank to use saved credentials",
+			keyFallbackMissing: "Env var not detected. Enter an API key, or configure {hint} in your env.",
+			keyFallbackDetected: "Env var detected. ({hint})",
+			keyFallbackDetectedHidden: "Env var detected.",
+			keyFallbackUnchecked: "Environment credential status has not been confirmed.",
+			keyHelp: "Saved credentials are used first. Environment fallbacks shown here, in order: {env}. Sources are launch environment, $cwd/.env, then $DSH_HOME/.env.",
+			authHelp: "Authentication details",
 			customized: "Customized settings",
 			baseUrl: "Base URL",
-			baseUrlDefault: "Provider default",
-			deepSeekBaseUrl: "https://api.deepseek.com/anthropic",
+			baseUrlDefault: "No default endpoint",
+			baseUrlEnvironment: "Provider endpoint configuration: {env}",
+			baseUrlConfigured: "Provider-configured endpoint",
+			baseUrlPlaceholder: "{url}",
+			deepSeekBaseUrl: "https://api.deepseek.com/anthropic (Default to use DEEPSEEK_BASE_URL)",
 			deepSeekEndpointHint: "Use an API endpoint compatible with Anthropic Messages.",
 			models: "Models",
 			modelsInherited: "Using the adapter defaults",
@@ -3031,19 +3114,30 @@ window.__ModuleLoader__.load({
 			savedProvider: "已保存 {provider}。",
 			credentialConfigured: "API 密钥已配置",
 			credentialMissing: "API 密钥缺失",
+			accountSignedIn: "已登录",
 			readOnly: "当前部署的设置文档为只读。",
 			loadFailed: "加载提供商目录失败",
 			conflict: "这张卡片打开期间，这些设置已被其他地方改动。请关闭后重新打开，在当前值上编辑。",
 			retry: "重试",
 			keyInput: "API 密钥",
+			keyReveal: "显示密钥",
+			keyHide: "隐藏密钥",
 			keyPlaceholder: "输入 API 密钥",
-			keyPlaceholderNative: "输入 API 密钥，或留空使用环境认证",
-			keyStored: "已配置——输入新值可替换",
-			keyEnvLocked: "由启动环境提供（只读）",
+			keyPlaceholderFallback: "留空使用环境认证（{hint}）",
+			keyPlaceholderSaved: "留空使用已保存凭据",
+			keyFallbackMissing: "未检测到环境变量。请填写 API 密钥，或设置环境变量 {hint}。",
+			keyFallbackDetected: "已检测到环境变量（{hint}）",
+			keyFallbackDetectedHidden: "已检测到环境变量",
+			keyFallbackUnchecked: "环境凭据状态尚未确认",
+			keyHelp: "优先使用已保存的凭据。此处显示的环境后备按以下顺序排列：{env}。来源依次为启动环境、$cwd/.env、$DSH_HOME/.env。",
+			authHelp: "认证说明",
 			customized: "自定义设置",
 			baseUrl: "API 地址",
-			baseUrlDefault: "提供商默认",
-			deepSeekBaseUrl: "https://api.deepseek.com/anthropic",
+			baseUrlDefault: "没有默认地址",
+			baseUrlEnvironment: "提供方地址配置：{env}",
+			baseUrlConfigured: "由提供方配置地址",
+			baseUrlPlaceholder: "{url}",
+			deepSeekBaseUrl: "https://api.deepseek.com/anthropic（默认使用环境 DEEPSEEK_BASE_URL）",
 			deepSeekEndpointHint: "请填写兼容 Anthropic Messages 协议的 API 地址。",
 			models: "模型目录",
 			modelsInherited: "正在使用适配器默认模型",

package/lib/types/client/ApiKeyInput.d.ts

@@ -0,0 +1,17 @@
+import type { InputHTMLAttributes, ReactNode } from 'react';
+import type { en } from './locales.ts';
+/** Input attributes and section copy for the current credential draft. */
+interface ApiKeyInputProps extends Omit<InputHTMLAttributes<HTMLInputElement>, 'value' | 'type' | 'className' | 'autoComplete'> {
+    /** Unsaved input; stored credentials are never read into this field. */
+    readonly value: string;
+    /** Section copy, including the same reveal labels as SecretText. */
+    readonly t: (key: keyof typeof en) => string;
+}
+/**
+ * Reveal only a nonempty draft; a different value starts masked, as in SecretText.
+ * @param props - current draft, input attributes, and translated control labels.
+ * @returns a password input with an optional reveal button.
+ */
+export declare function ApiKeyInput({ value, t, ...props }: ApiKeyInputProps): ReactNode;
+export {};
+//# sourceMappingURL=ApiKeyInput.d.ts.map

package/lib/types/client/ProviderEditor.d.ts

@@ -21,7 +21,7 @@
  * see instead of rebuilding the whole subtree from a partial descriptor.
  */
 import type { ReactNode } from 'react';
-import type { SettingsNamespaceView, SettingsPathOpView } from '@deepseek-ai/dsh-api-remotes/client';
+import type { CredentialInfo, LlmNativeAuth, SettingsNamespaceView, SettingsPathOpView } from '@deepseek-ai/dsh-api-remotes/client';
 import type { ModelsOperations } from './operations.ts';
 import type { SettingsSchemaOperations } from './schema-operations.ts';
 import type { en } from './locales.ts';
@@ -49,6 +49,16 @@ export interface ProviderEditorProps {
     settingsPath: readonly string[];
     /** The Host operations this card writes and interrogates through. */
     operations: ModelsOperations;
+    /** Endpoint the route uses when its profile sets no `baseURL`; absent when the adapter reports none. */
+    defaultBaseURL?: string;
+    /** Environment variables used by the provider to construct its endpoint. */
+    baseURLEnv?: readonly string[];
+    /** Authentication the route performs when its profile names no credential reference; absent when the adapter reports none. */
+    nativeAuth?: LlmNativeAuth;
+    /** Redacted state of the profile's named credential reference, from the page snapshot. */
+    credential?: CredentialInfo;
+    /** Redacted checks for the profile's named reference or the provider's native variables. */
+    credentialChecks?: Readonly<Record<string, CredentialInfo>>;
     /** Section copy. */
     t: (key: keyof typeof en) => string;
     /** Disable writes (read-only settings provider). */

package/lib/types/client/WelcomeNotice.d.ts

@@ -7,7 +7,7 @@ import type { en } from './locales.ts';
 /** Registration-side dependencies of {@link WelcomeNotice}. */
 export interface WelcomeNoticeInjected {
     hooks: {
-        /** Durable or process-local acknowledgement state. */
+        /** Durable acknowledgement state. */
         welcome: SnapshotStore<WelcomeNoticeState>;
     };
     /** Welcome acknowledgement controller. */

package/lib/types/client/locales.d.ts

@@ -30,18 +30,29 @@ export declare const en: {
     savedProvider: string;
     credentialConfigured: string;
     credentialMissing: string;
+    accountSignedIn: string;
     readOnly: string;
     loadFailed: string;
     conflict: string;
     retry: string;
     keyInput: string;
+    keyReveal: string;
+    keyHide: string;
     keyPlaceholder: string;
-    keyPlaceholderNative: string;
-    keyStored: string;
-    keyEnvLocked: string;
+    keyPlaceholderFallback: string;
+    keyPlaceholderSaved: string;
+    keyFallbackMissing: string;
+    keyFallbackDetected: string;
+    keyFallbackDetectedHidden: string;
+    keyFallbackUnchecked: string;
+    keyHelp: string;
+    authHelp: string;
     customized: string;
     baseUrl: string;
     baseUrlDefault: string;
+    baseUrlEnvironment: string;
+    baseUrlConfigured: string;
+    baseUrlPlaceholder: string;
     deepSeekBaseUrl: string;
     deepSeekEndpointHint: string;
     models: string;

package/lib/types/client/operations.d.ts

@@ -5,7 +5,7 @@
  * failure codes and Remote namespaces stay in the apply world.
  */
 import type { Context as ClientContext } from '@deepseek-ai/cordis';
-import type { CredentialInfo, LlmDiscoveredModel, LlmModelDiscoveryRequest, SettingsNamespaceView, SettingsPathOpView } from '@deepseek-ai/dsh-api-remotes/client';
+import type { LlmDiscoveredModel, LlmModelDiscoveryRequest, SettingsNamespaceView, SettingsPathOpView } from '@deepseek-ai/dsh-api-remotes/client';
 /** What one namespace write answered. */
 export type SettingsWriteOutcome = 
 /** Committed; the view carries the stored user subtree and the new revision. */
@@ -40,12 +40,6 @@ export type ModelDiscoveryOutcome =
 };
 /** The Host operations the Models page and its cards invoke. */
 export interface ModelsOperations {
-    /**
-     * Read one credential reference's state.
-     * @param ref - credential reference name.
-     * @returns the state, or undefined when the reference is unknown or the read was refused.
-     */
-    describeCredential(ref: string): Promise<CredentialInfo | undefined>;
     /**
      * Store one credential literal under its reference.
      * @param ref - credential reference name.

package/lib/types/client/store.d.ts

@@ -7,7 +7,7 @@
  * re-renders from the next describe, pushed or refetched.
  */
 import type { Context as ClientContext } from '@deepseek-ai/cordis';
-import type { CredentialInfo, LlmConfigurableProvider, LlmProviderInfo, SettingsNamespaceView } from '@deepseek-ai/dsh-api-remotes/client';
+import type { CredentialInfo, LlmConfigurableProvider, LlmNativeAuth, LlmProviderInfo, SettingsNamespaceView } from '@deepseek-ai/dsh-api-remotes/client';
 import type { SnapshotStore } from '@deepseek-ai/dsh-client-store';
 import type { SettingsDescribeFace } from '@deepseek-ai/dsh-client-ui-settings/client';
 import type { SettingsSchemaOperations } from './schema-operations.ts';
@@ -19,6 +19,9 @@ export interface ProviderDirectoryEntry {
     readonly settingsPath: readonly string[];
     readonly active: boolean;
     readonly declared?: boolean;
+    readonly defaultBaseURL?: string;
+    readonly baseURLEnv?: readonly string[];
+    readonly nativeAuth?: LlmNativeAuth;
     readonly error?: string;
 }
 /**
@@ -49,6 +52,8 @@ export interface ProviderRow {
      * own derivation rule.
      */
     derivedCredential?: CredentialInfo;
+    /** Redacted checks for named or native references; absent when their read failed. */
+    credentialChecks?: Readonly<Record<string, CredentialInfo>>;
 }
 /** Page snapshot. */
 export interface ModelsSettingsState {

package/lib/types/client/welcome-store.d.ts

@@ -1,8 +1,6 @@
 /**
- * Welcome-notice state derived from the welcome settings scope. The scope is
- * the transport: a loopback browser follows the durable Host section, while a
- * remote browser's memory-mode scope never answers and the acknowledgement
- * stays process-local here.
+ * Welcome-notice state derived from the welcome settings scope: the notice
+ * follows the Host section and records its acknowledgement through it.
  */
 import { type SnapshotStore } from '@deepseek-ai/dsh-client-store';
 import type { ConfigForm } from '@deepseek-ai/dsh-client-ui-settings/client';
@@ -22,18 +20,13 @@ export type WelcomeSection = Record<string, unknown>;
  * @returns the section object, or an empty one for non-object values.
  */
 export declare function decodeWelcomeSection(section: unknown): WelcomeSection;
-/** Coordinates durable Host acknowledgement or a process-local remote fallback. */
+/** Coordinates the durable Host acknowledgement. */
 export declare class WelcomeNoticeStore {
     private readonly scope;
     /** uSES-safe state source shared by the registered welcome step. */
     readonly store: SnapshotStore<WelcomeNoticeState>;
-    private localAcknowledged;
     private saving;
     private following;
-    /**
-     * @param scope - the welcome settings namespace scope; its memory mode is
-     * what keeps a remote browser process-local.
-     */
     constructor(scope: ConfigForm<WelcomeSection>);
     /**
      * Begin following the bound scope (idempotent) and publish its current answer.
@@ -41,10 +34,10 @@ export declare class WelcomeNoticeStore {
      */
     load(): Promise<void>;
     /**
-     * Persist this copy version, or advance only this process for a remote
-     * browser. Success is judged against the state the write left behind, so a
-     * refused or failed write reports false after its recovery read settles.
-     * @returns true when the selected persistence mode holds the acknowledgement.
+     * Persist this copy version through the scope. Success is judged against the
+     * state the write left behind, so a refused or failed write reports false
+     * after its recovery read settles.
+     * @returns true when the Host holds the acknowledgement.
      */
     acknowledge(): Promise<boolean>;
     /** Stop following the scope. */

package/locale/en.json

@@ -0,0 +1,5 @@
+{
+  "meta": {
+    "title": "ui-settings-models"
+  }
+}

package/locale/zh.json

@@ -0,0 +1,6 @@
+{
+  "meta": {
+    "title": "模型设置界面",
+    "description": "管理模型服务及其接入配置，并提供相关引导。"
+  }
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@deepseek-ai/dsh-client-ui-settings-models",
   "description": "Models settings and shared product-onboarding dialogs over existing settings and credential joins",
-  "version": "0.2.1-alpha.2",
+  "version": "0.2.1-alpha.3",
   "publishConfig": {
     "access": "public"
   },
@@ -23,7 +23,8 @@
       "default": "./lib/client.js"
     },
     "./src/*": "./src/*",
-    "./package.json": "./package.json"
+    "./package.json": "./package.json",
+    "./locale/*.json": "./locale/*.json"
   },
   "dsh": {
     "client": {
@@ -37,29 +38,29 @@
   },
   "license": "MIT",
   "peerDependencies": {
-    "@deepseek-ai/cordis": "~4.0.5-alpha.1"
+    "@deepseek-ai/cordis": "~4.0.5-alpha.2"
   },
   "devDependencies": {
-    "@deepseek-ai/dsh-host-webserver": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-api-remotes": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-client-locale": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-client-store": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-client-test-runtime": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-client-ui-primitives": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-client-ui-settings": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-client-ui-slots": "0.2.1-alpha.2",
-    "@types/react": "~18.3.1",
-    "@deepseek-ai/cordis": "~4.0.5-alpha.1",
+    "@deepseek-ai/dsh-host-webserver": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-api-remotes": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-client-locale": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-client-store": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-client-test-runtime": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-client-ui-primitives": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-client-ui-settings": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-client-ui-slots": "0.2.1-alpha.3",
+    "@deepseek-ai/cordis": "~4.0.5-alpha.2",
     "react": "^18.2.0",
-    "@deepseek-ai/dsh-client-ui-renderer": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-util-values": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-remote-mock": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-client-product-analytics": "0.2.1-alpha.2"
+    "@deepseek-ai/dsh-client-ui-renderer": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-util-values": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-remote-mock": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-client-product-analytics": "0.2.1-alpha.3"
   },
   "dependencies": {
-    "@deepseek-ai/schemastery": "~3.18.5-alpha.1"
+    "@deepseek-ai/schemastery": "~3.18.5-alpha.2"
   },
   "files": [
+    "locale/*.json",
     "lib/index.js",
     "lib/client.js",
     "lib/types/**/*.d.ts"