@goodandready/dsh-key-rotation 0.8.65 → 0.8.67

package/lib/client.js

@@ -104,6 +104,11 @@ window.__ModuleLoader__.load({
       presetNone: 'No canonical preset for this provider',
       detectedLimitsLabel: 'Upstream: {rpm} RPM · {tpm} TPM',
       trafficSmoothingLabel: 'Traffic Smoothing (Burst)',
+      balanceLabel: 'Balance: {amt} {curr}',
+      balanceEmpty: 'Balance Empty (Paused)',
+      balanceCheckBtn: '💰 Check Balance',
+      checkingBalance: 'Checking…',
+      upstreamResetIn: '⚡ Reset in {time} (header)',
       pauseKey: 'Pause key from rotation',
       resumeKey: 'Resume key rotation',
       sparklineTraffic: 'Traffic Trend',
@@ -256,6 +261,28 @@ window.__ModuleLoader__.load({
       autoImportBtn: '1-Click Auto-Import',
       autoImportSuccess: 'Imported {n} keys into rotation pools',
       autoImporting: 'Importing…',
+      quickSkip: 'Skip',
+      quickSkipTitle: 'Skip to next key in pool',
+      quickReset: 'Reset',
+      quickResetTitle: 'Reset cooldowns and circuit breaker for active provider',
+      quickPause: 'Pause',
+      quickPauseTitle: 'Pause or resume active key',
+      exportConfig: 'Export Pools',
+      importConfig: 'Import Pools',
+      exportSafe: 'Masked (Safe for sharing)',
+      exportFull: 'Full Backup (Includes secrets)',
+      exportWithPassphrase: 'Encrypted with passphrase',
+      importMode: 'Import Mode',
+      importMerge: 'Merge with existing pools',
+      importReplace: 'Replace entire pool configuration',
+      importPreview: 'Preview Diff',
+      importApply: 'Apply Configuration',
+      importSuccess: 'Configuration successfully imported and applied',
+      exportSuccess: 'Configuration exported successfully',
+      passphraseLabel: 'Passphrase (optional)',
+      passphrasePlaceholder: 'Enter master passphrase for encryption/decryption',
+      jsonConfigPlaceholder: 'Paste JSON configuration here or choose a file...',
+      previewSummary: 'Diff: {created} new providers, {updated} updated providers, {keys} keys ({added} new).',
     };
 
     const zh = {
@@ -311,6 +338,11 @@ window.__ModuleLoader__.load({
       presetNone: '未找到该提供商预设规则',
       detectedLimitsLabel: '上游限制：{rpm} RPM · {tpm} TPM',
       trafficSmoothingLabel: '流量平滑 (突发并发)',
+      balanceLabel: '余额：{amt} {curr}',
+      balanceEmpty: '余额不足已暂停',
+      balanceCheckBtn: '💰 检查余额',
+      checkingBalance: '查询中…',
+      upstreamResetIn: '⚡ {time}后重置 (上游头信息)',
       pauseKey: '暂停此密钥轮换',
       resumeKey: '恢复此密钥轮换',
       sparklineTraffic: '流量趋势',
@@ -462,6 +494,28 @@ window.__ModuleLoader__.load({
       autoImportBtn: '一键自动导入',
       autoImportSuccess: '成功导入 {n} 个密钥到轮换池',
       autoImporting: '正在导入…',
+      quickSkip: '跳过',
+      quickSkipTitle: '跳过并轮换到池中下一个密钥',
+      quickReset: '重置',
+      quickResetTitle: '重置当前提供商的冷却时间与断路器',
+      quickPause: '暂停',
+      quickPauseTitle: '暂停或恢复当前正在使用的密钥',
+      exportConfig: '导出密钥池',
+      importConfig: '导入密钥池',
+      exportSafe: '脱敏导出 (安全分享)',
+      exportFull: '完整备份 (包含密钥)',
+      exportWithPassphrase: '使用密码加密导出',
+      importMode: '导入模式',
+      importMerge: '与现有密钥池合并',
+      importReplace: '覆盖现有全部密钥池配置',
+      importPreview: '预览差异',
+      importApply: '应用配置',
+      importSuccess: '配置已成功导入并生效',
+      exportSuccess: '配置导出成功',
+      passphraseLabel: '加密密码 (可选)',
+      passphrasePlaceholder: '输入用于加密/解密的主密码',
+      jsonConfigPlaceholder: '在此粘贴 JSON 配置或选择文件...',
+      previewSummary: '差异: 新增 {created} 个提供商, 更新 {updated} 个提供商, 包含 {keys} 个密钥 (新增 {added} 个)。',
     };
 
     // Codes worth switching on. Host list is DEFAULT_SWITCH_CODES; config may
@@ -1176,6 +1230,111 @@ window.__ModuleLoader__.load({
 
       // Test Matrix State (#490)
       const [testMatrixRunning, setTestMatrixRunning] = React.useState(false);
+      const [exportModal, setExportModal] = React.useState(false);
+      const [exportMasked, setExportMasked] = React.useState(true);
+      const [exportPassphrase, setExportPassphrase] = React.useState('');
+      const [exportError, setExportError] = React.useState('');
+      const [importModal, setImportModal] = React.useState(false);
+      const [importText, setImportText] = React.useState('');
+      const [importPassphrase, setImportPassphrase] = React.useState('');
+      const [importMode, setImportMode] = React.useState('merge');
+      const [importPreview, setImportPreview] = React.useState(null);
+      const [importError, setImportError] = React.useState('');
+      const [importRunning, setImportRunning] = React.useState(false);
+
+      const runExport = async () => {
+        setExportError('');
+        try {
+          const q = new URLSearchParams();
+          q.set('masked', exportMasked ? 'true' : 'false');
+          if (exportPassphrase.trim()) q.set('passphrase', exportPassphrase.trim());
+          const res = await fetch(`/dsh-key-rotation/export?${q.toString()}`, {
+            headers: { accept: 'application/json' },
+            signal: (typeof AbortSignal !== 'undefined' && typeof AbortSignal.timeout === 'function') ? AbortSignal.timeout(10000) : undefined,
+          });
+          const data = await res.json();
+          if (!res.ok || !data.ok) throw new Error(data?.error?.message || 'Export failed');
+          const blob = new Blob([JSON.stringify(data, null, 2)], { type: 'application/json' });
+          const url = URL.createObjectURL(blob);
+          const a = document.createElement('a');
+          a.href = url;
+          a.download = `dsh-key-rotation-${exportMasked ? 'masked' : 'full'}-${Date.now()}.json`;
+          a.click();
+          URL.revokeObjectURL(url);
+          setExportModal(false);
+        } catch (err) {
+          setExportError(String(err?.message ?? err));
+        }
+      };
+
+      const runImportPreview = async () => {
+        setImportError('');
+        setImportPreview(null);
+        setImportRunning(true);
+        try {
+          let parsed;
+          try { parsed = JSON.parse(importText); } catch (_) { throw new Error('Invalid JSON format'); }
+          const res = await fetch('/dsh-key-rotation/config-import', {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json', accept: 'application/json' },
+            body: JSON.stringify({
+              config: parsed.config || (parsed.providers ? parsed : undefined),
+              ciphertext: parsed.ciphertext,
+              salt: parsed.salt,
+              iv: parsed.iv,
+              tag: parsed.tag,
+              encrypted: parsed.encrypted,
+              passphrase: importPassphrase.trim() || undefined,
+              mode: importMode,
+              dryRun: true,
+            }),
+            signal: (typeof AbortSignal !== 'undefined' && typeof AbortSignal.timeout === 'function') ? AbortSignal.timeout(10000) : undefined,
+          });
+          const data = await res.json();
+          if (!res.ok || !data.ok) throw new Error(data?.error?.message || 'Import preview failed');
+          setImportPreview(data.preview);
+        } catch (err) {
+          setImportError(String(err?.message ?? err));
+        } finally {
+          setImportRunning(false);
+        }
+      };
+
+      const runImportApply = async () => {
+        setImportError('');
+        setImportRunning(true);
+        try {
+          let parsed;
+          try { parsed = JSON.parse(importText); } catch (_) { throw new Error('Invalid JSON format'); }
+          const res = await fetch('/dsh-key-rotation/config-import', {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json', accept: 'application/json' },
+            body: JSON.stringify({
+              config: parsed.config || (parsed.providers ? parsed : undefined),
+              ciphertext: parsed.ciphertext,
+              salt: parsed.salt,
+              iv: parsed.iv,
+              tag: parsed.tag,
+              encrypted: parsed.encrypted,
+              passphrase: importPassphrase.trim() || undefined,
+              mode: importMode,
+              dryRun: false,
+            }),
+            signal: (typeof AbortSignal !== 'undefined' && typeof AbortSignal.timeout === 'function') ? AbortSignal.timeout(10000) : undefined,
+          });
+          const data = await res.json();
+          if (!res.ok || !data.ok) throw new Error(data?.error?.message || 'Import apply failed');
+          setImportModal(false);
+          setImportPreview(null);
+          setImportText('');
+          void load();
+        } catch (err) {
+          setImportError(String(err?.message ?? err));
+        } finally {
+          setImportRunning(false);
+        }
+      };
+
       const [testMatrixResults, setTestMatrixResults] = React.useState(null);
       const [testMatrixModal, setTestMatrixModal] = React.useState(false);
 
@@ -1567,6 +1726,26 @@ window.__ModuleLoader__.load({
 
       const [validating, setValidating] = React.useState('');
       const [presetNotice, setPresetNotice] = React.useState('');
+      const [checkingBalance, setCheckingBalance] = React.useState('');
+      const checkBalances = async (pIndex, provName) => {
+        setCheckingBalance(provName);
+        try {
+          const r = await fetch('/dsh-key-rotation/balance', {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ provider: provName }),
+            signal: (typeof AbortSignal !== 'undefined' && typeof AbortSignal.timeout === 'function') ? AbortSignal.timeout(15000) : undefined,
+          });
+          const data = await r.json();
+          if (data && data.ok) {
+            load();
+          }
+        } catch (err) {
+          setSecretError(String(err?.message || err));
+        } finally {
+          setCheckingBalance('');
+        }
+      };
       const applyPreset = async (pIndex, provName) => {
         try {
           const r = await fetch('/dsh-key-rotation/preset-limits?provider=' + encodeURIComponent(provName));
@@ -2162,6 +2341,18 @@ window.__ModuleLoader__.load({
           if (info && info.broken) {
             meta.push(h('button', { key: 'rt', className: 'krot-btn', onClick: () => retestBroken(key), title: t('retestBroken') }, t('retestBroken')));
           }
+          if (info && info.balance) {
+            const b = info.balance;
+            const isZero = b.isAvailable === false || (typeof b.total === 'number' && b.total <= 0);
+            const cur = b.currency || '';
+            const amtStr = typeof b.total === 'number' ? b.total.toFixed(2) : String(b.total || 0);
+            meta.push(h('span', {
+              key: 'bal',
+              className: 'krot-tail' + (isZero ? ' krot-badge-bad' : ''),
+              title: isZero ? t('balanceEmpty') : ('Upstream balance: ' + amtStr + ' ' + cur),
+              style: isZero ? { color: 'var(--dsw-alias-state-error-primary)', fontWeight: 700 } : undefined,
+            }, '💰 ' + amtStr + (cur ? (' ' + cur) : '')));
+          }
           if (info && info.detectedLimits) {
             const dl = info.detectedLimits;
             const parts = [];
@@ -2509,6 +2700,10 @@ window.__ModuleLoader__.load({
               danger: false,
               onConfirm: () => doReset(entry.provider),
             }), { disabled: !(providerStatus && providerStatus.switches > 0) || resetting === entry.provider, title: t('resetCooldown') }),
+            btn(checkingBalance === entry.provider ? t('checkingBalance') : ('💰 ' + t('balanceCheckBtn')), () => checkBalances(pIndex, entry.provider), {
+              disabled: Boolean(checkingBalance) || !entry.provider.trim(),
+              title: t('balanceCheckBtn'),
+            }),
             btn(testAllProvider === entry.provider ? (testingProgress[entry.provider] ? t('testingAllProgress').replace('{n}', testingProgress[entry.provider].split('/')[0]).replace('{total}', testingProgress[entry.provider].split('/')[1]) : t('testing')) : t('testAll'), () => doTestAll(entry.provider), { disabled: Boolean(testing || testAllProvider), title: t('testAll') }),
             exportCsv,
           ),
@@ -2736,7 +2931,91 @@ window.__ModuleLoader__.load({
           h('span', null, '💾 ' + t('sectionBackup')),
         ),
         h('div', { className: 'krot-section-desc' }, t('sectionBackupDesc')),
-        h('div', { className: 'krot-row' },
+        exportModal ? h('div', { className: 'krot-box', style: { marginBottom: '12px', padding: '12px', border: '1px solid var(--dsw-alias-border-l2)', borderRadius: '6px', background: 'var(--dsw-alias-bg-hover)' } },
+          h('div', { style: { fontWeight: 600, marginBottom: '8px' } }, '📥 ' + (t('exportConfig') || 'Export Pools')),
+          h('label', { style: { display: 'flex', alignItems: 'center', gap: '6px', fontSize: '13px', cursor: 'pointer', marginBottom: '8px' } },
+            h('input', { type: 'checkbox', checked: exportMasked, onChange: (e) => setExportMasked(e.target.checked) }),
+            t('exportSafe') || 'Masked (Safe for sharing)'
+          ),
+          h('div', { style: { display: 'flex', flexDirection: 'column', gap: '4px', marginBottom: '10px' } },
+            h('span', { style: { fontSize: '12px', color: 'var(--dsw-alias-label-secondary)' } }, t('passphraseLabel') || 'Passphrase (optional)'),
+            h('input', {
+              type: 'password',
+              className: 'krot-input',
+              value: exportPassphrase,
+              onChange: (e) => setExportPassphrase(e.target.value),
+              placeholder: t('passphrasePlaceholder') || 'Enter passphrase for AES-256-GCM encryption',
+              style: { maxWidth: '360px' }
+            })
+          ),
+          exportError ? h('div', { className: 'krot-alert krot-alert-bad', style: { marginBottom: '8px' } }, exportError) : null,
+          h('div', { style: { display: 'flex', gap: '8px' } },
+            btn('⬇️ ' + (t('exportConfig') || 'Download JSON'), runExport, { primary: true }),
+            btn(t('cancel'), () => setExportModal(false))
+          )
+        ) : null,
+        importModal ? h('div', { className: 'krot-box', style: { marginBottom: '12px', padding: '12px', border: '1px solid var(--dsw-alias-border-l2)', borderRadius: '6px', background: 'var(--dsw-alias-bg-hover)' } },
+          h('div', { style: { fontWeight: 600, marginBottom: '8px' } }, '📤 ' + (t('importConfig') || 'Import Pools')),
+          h('div', { style: { display: 'flex', gap: '8px', alignItems: 'center', marginBottom: '8px' } },
+            h('label', { className: 'krot-btn', style: { cursor: 'pointer', fontSize: '12px' } },
+              '📁 Choose File',
+              h('input', {
+                type: 'file',
+                accept: '.json',
+                style: { display: 'none' },
+                onChange: (e) => {
+                  const file = e.target.files?.[0];
+                  if (!file) return;
+                  const reader = new FileReader();
+                  reader.onload = (ev) => { setImportText(String(ev.target?.result || '')); };
+                  reader.readAsText(file);
+                }
+              })
+            ),
+            h('span', { style: { fontSize: '12px', opacity: 0.7 } }, 'or paste JSON below')
+          ),
+          h('textarea', {
+            className: 'krot-input',
+            rows: 6,
+            value: importText,
+            onChange: (e) => { setImportText(e.target.value); setImportPreview(null); },
+            placeholder: t('jsonConfigPlaceholder') || 'Paste JSON configuration here...',
+            style: { width: '100%', fontFamily: 'monospace', fontSize: '11px', marginBottom: '8px' }
+          }),
+          h('div', { style: { display: 'flex', gap: '16px', alignItems: 'center', marginBottom: '8px' } },
+            h('label', { style: { display: 'flex', alignItems: 'center', gap: '4px', fontSize: '12px' } },
+              h('input', { type: 'radio', name: 'importMode', checked: importMode === 'merge', onChange: () => setImportMode('merge') }),
+              t('importMerge') || 'Merge'
+            ),
+            h('label', { style: { display: 'flex', alignItems: 'center', gap: '4px', fontSize: '12px' } },
+              h('input', { type: 'radio', name: 'importMode', checked: importMode === 'replace', onChange: () => setImportMode('replace') }),
+              t('importReplace') || 'Replace'
+            )
+          ),
+          h('div', { style: { display: 'flex', flexDirection: 'column', gap: '4px', marginBottom: '10px' } },
+            h('span', { style: { fontSize: '12px', color: 'var(--dsw-alias-label-secondary)' } }, t('passphraseLabel') || 'Passphrase (if encrypted)'),
+            h('input', {
+              type: 'password',
+              className: 'krot-input',
+              value: importPassphrase,
+              onChange: (e) => setImportPassphrase(e.target.value),
+              placeholder: t('passphrasePlaceholder') || 'Enter passphrase for decryption',
+              style: { maxWidth: '360px' }
+            })
+          ),
+          importError ? h('div', { className: 'krot-alert krot-alert-bad', style: { marginBottom: '8px' } }, importError) : null,
+          importPreview ? h('div', { className: 'krot-alert krot-alert-ok', style: { marginBottom: '8px', fontSize: '12px' } },
+            `Preview: ${importPreview.createdProviders?.length || 0} created, ${importPreview.updatedProviders?.length || 0} updated, ${importPreview.keysAdded || 0} keys added, ${importPreview.totalKeys || 0} total keys.`
+          ) : null,
+          h('div', { style: { display: 'flex', gap: '8px' } },
+            btn('🔍 ' + (t('importPreview') || 'Preview Diff'), runImportPreview, { disabled: !importText.trim() || importRunning }),
+            btn('✅ ' + (t('importApply') || 'Apply Configuration'), runImportApply, { primary: true, disabled: !importText.trim() || importRunning }),
+            btn(t('cancel'), () => { setImportModal(false); setImportPreview(null); })
+          )
+        ) : null,
+        h('div', { className: 'krot-row', style: { display: 'flex', gap: '8px', flexWrap: 'wrap' } },
+          btn('📥 ' + (t('exportConfig') || 'Export Pools'), () => { setExportModal((v) => !v); setImportModal(false); }, { primary: exportModal }),
+          btn('📤 ' + (t('importConfig') || 'Import Pools'), () => { setImportModal((v) => !v); setExportModal(false); }, { primary: importModal }),
           btn(t('exportPools'), () => {
             const data = JSON.stringify(val.providers ?? [], null, 2);
             const blob = new Blob([data], { type: 'application/json' });
@@ -2955,31 +3234,34 @@ window.__ModuleLoader__.load({
 
 
 
-    // (issue 201) header chip: one dot + counts for all pools. Green = all healthy,
-    // amber = some keys cooling, red = a pool fully exhausted. Click opens the
-    // same summary the floating dashboard shows.
+    // (issue 201, #499) header chip: one dot + counts for all pools. Green = all healthy,
+    // amber = some keys cooling, red = a pool fully exhausted. Click opens quick actions popover.
     function KeyRotationHeaderChip(props) {
       const t = resolveT(props);
       const [snap, setSnap] = React.useState(null);
       const [open, setOpen] = React.useState(false);
       const [, setTick] = React.useState(0);
+      const [busy, setBusy] = React.useState(false);
       const ref = React.useRef(null);
 
+      const load = () => {
+        if (typeof document !== 'undefined' && document.visibilityState !== 'visible') return;
+        fetch('/dsh-key-rotation/health', {
+          headers: { accept: 'application/json' },
+          credentials: 'same-origin',
+          signal: (typeof AbortSignal !== 'undefined' && typeof AbortSignal.timeout === 'function') ? AbortSignal.timeout(8000) : undefined
+        })
+          .then((r) => (r.ok ? r.json() : null))
+          .then((d) => { if (d) setSnap(d); })
+          .catch((e) => { void e; });
+      };
+
       React.useEffect(() => {
-        let alive = true;
-        const load = () => {
-          if (typeof document !== 'undefined' && document.visibilityState !== 'visible') return;
-          fetch('/dsh-key-rotation/health', { headers: { accept: 'application/json' }, credentials: 'same-origin', signal: (typeof AbortSignal !== 'undefined' && typeof AbortSignal.timeout === 'function') ? AbortSignal.timeout(8000) : undefined })
-            .then((r) => (r.ok ? r.json() : null))
-            .then((d) => { if (alive) setSnap(d); })
-            .catch((e) => { void e; });
-        };
         load();
         const id = setInterval(load, 5000);
         const onVis = () => { if (typeof document !== 'undefined' && document.visibilityState === 'visible') load(); };
         if (typeof document !== 'undefined') document.addEventListener('visibilitychange', onVis);
         return () => {
-          alive = false;
           clearInterval(id);
           if (typeof document !== 'undefined') document.removeEventListener('visibilitychange', onVis);
         };
@@ -3001,6 +3283,21 @@ window.__ModuleLoader__.load({
         return () => document.removeEventListener('click', onDocClick);
       }, [open]);
 
+      const runAction = (action, provider, keyRef) => {
+        setBusy(true);
+        fetch('/dsh-key-rotation/quick-action', {
+          method: 'POST',
+          headers: { 'content-type': 'application/json', accept: 'application/json' },
+          body: JSON.stringify({ action, provider, ref: keyRef }),
+          credentials: 'same-origin',
+          signal: (typeof AbortSignal !== 'undefined' && typeof AbortSignal.timeout === 'function') ? AbortSignal.timeout(5000) : undefined,
+        })
+          .then((r) => r.json())
+          .then(() => { load(); })
+          .catch((err) => { void err; })
+          .finally(() => { setBusy(false); });
+      };
+
       let settingsVal = null;
       try {
         const sSnap = props?.settingsSource?.getSnapshot?.()?.service?.getSnapshot?.();
@@ -3030,17 +3327,45 @@ window.__ModuleLoader__.load({
           label,
           h('span', { style: { fontSize: '9px', opacity: 0.6 } }, open ? '▲' : '▼')
         ),
-        open ? h('div', { className: 'krot-popover' },
+        open ? h('div', { className: 'krot-popover', style: { minWidth: '220px' } },
           h('div', { className: 'krot-pop-title' }, t('headerPoolsTitle')),
           !poolEntries.length ? h('div', { style: { fontSize: '12px', color: 'var(--dsw-alias-label-tertiary)' } }, t('noActivePools')) : null,
           poolEntries.map(([name, p]) => {
             const c = p.exhausted ? 'var(--dsw-alias-state-error-primary)' : (p.healthy < p.total ? 'var(--dsw-alias-state-warn-primary)' : 'var(--dsw-alias-state-success-primary)');
-            return h('div', { key: name, className: 'krot-pop-row' },
-              h('div', { className: 'krot-pop-name' },
-                h('span', { style: { width: '7px', height: '7px', borderRadius: '50%', background: c, flex: 'none' } }),
-                name
+            const provName = p.providerName || name;
+            const tail = p.lastUsedTail;
+            return h('div', { key: name, className: 'krot-pop-row', style: { display: 'flex', flexDirection: 'column', gap: '4px', padding: '6px 0', borderBottom: '1px solid var(--dsw-alias-border-subtle)' } },
+              h('div', { style: { display: 'flex', justifyContent: 'space-between', alignItems: 'center' } },
+                h('div', { className: 'krot-pop-name' },
+                  h('span', { style: { width: '7px', height: '7px', borderRadius: '50%', background: c, flex: 'none' } }),
+                  name,
+                  tail ? h('span', { style: { marginLeft: '6px', fontSize: '11px', color: 'var(--dsw-alias-label-tertiary)', fontFeatureSettings: '"tnum"', fontFamily: 'monospace' } }, `...${tail}`) : null
+                ),
+                h('div', { className: 'krot-pop-count', style: { color: c, fontWeight: 600 } }, `${p.healthy}/${p.total}`)
               ),
-              h('div', { className: 'krot-pop-count', style: { color: c } }, `${p.healthy}/${p.total}`)
+              h('div', { style: { display: 'flex', gap: '4px', marginTop: '2px' } },
+                h('button', {
+                  type: 'button',
+                  disabled: busy,
+                  onClick: (e) => { e.stopPropagation(); runAction('skip', provName, p.lastUsed); },
+                  title: t('quickSkipTitle'),
+                  style: { padding: '2px 6px', fontSize: '11px', borderRadius: '4px', border: '1px solid var(--dsw-alias-border-subtle)', background: 'transparent', cursor: 'pointer', color: 'inherit' }
+                }, `⏭️ ${t('quickSkip')}`),
+                h('button', {
+                  type: 'button',
+                  disabled: busy,
+                  onClick: (e) => { e.stopPropagation(); runAction('reset', provName, p.lastUsed); },
+                  title: t('quickResetTitle'),
+                  style: { padding: '2px 6px', fontSize: '11px', borderRadius: '4px', border: '1px solid var(--dsw-alias-border-subtle)', background: 'transparent', cursor: 'pointer', color: 'inherit' }
+                }, `🔄 ${t('quickReset')}`),
+                h('button', {
+                  type: 'button',
+                  disabled: busy || !p.lastUsed,
+                  onClick: (e) => { e.stopPropagation(); runAction('pause', provName, p.lastUsed); },
+                  title: t('quickPauseTitle'),
+                  style: { padding: '2px 6px', fontSize: '11px', borderRadius: '4px', border: '1px solid var(--dsw-alias-border-subtle)', background: 'transparent', cursor: 'pointer', color: 'inherit' }
+                }, `⏸️ ${t('quickPause')}`)
+              )
             );
           })
         ) : null

package/lib/ops-balance.js

@@ -0,0 +1,147 @@
+// lib/ops-balance.js — operational HTTP routes for balance inspection (#495).
+
+import {
+  json,
+  readJson,
+} from './http-bridge.js';
+import {
+  isTrustedBridgeRequest,
+  isValidRef,
+} from './pool.js';
+import { BALANCE_PATH } from './ops-paths.js';
+import { inspectBalanceForRef } from './balance-inspector.js';
+import { pushEvent } from './notify-events.js';
+
+export function registerBalanceRoutes(ctx, deps) {
+  const {
+    poolState,
+    buildRuntime,
+  } = deps;
+
+  ctx.effect(() => ctx.webServer.register({
+    kind: 'exact',
+    path: BALANCE_PATH,
+    handler: async (req, res) => {
+      if (!isTrustedBridgeRequest(req)) {
+        json(res, 403, { ok: false, error: 'Forbidden' });
+        return;
+      }
+
+      const urlObj = new URL(req.url, 'http://127.0.0.1');
+
+      // GET: Query single key or provider cached balances
+      if (req.method === 'GET') {
+        const ref = urlObj.searchParams.get('ref');
+        const provider = urlObj.searchParams.get('provider');
+
+        if (ref) {
+          const runtime = buildRuntime();
+          const targetPool = provider ? runtime.pools?.find((p) => p.provider === provider) : null;
+          const pool = targetPool ?? runtime.poolByRef?.get(ref);
+          const cached = pool?.state?.balances?.get(ref) ?? null;
+
+          if (urlObj.searchParams.get('refresh') === 'true' && provider) {
+            const inspectRes = await inspectBalanceForRef(ctx, ref, provider);
+            if (inspectRes.ok) {
+              if (pool && pool.state) {
+                if (!pool.state.balances) pool.state.balances = new Map();
+                pool.state.balances.set(ref, { ...inspectRes, at: Date.now() });
+
+                // Check soft pause
+                applyBalanceState(pool, ref, inspectRes);
+              }
+              json(res, 200, { ok: true, ref, balance: inspectRes });
+              return;
+            }
+            json(res, 200, { ok: false, ref, error: inspectRes.error, cached });
+            return;
+          }
+
+          json(res, 200, { ok: true, ref, balance: cached });
+          return;
+        }
+
+        // Return all cached balances
+        const out = {};
+        if (poolState && typeof poolState.forEach === 'function') {
+          poolState.forEach((st, provName) => {
+            if (st && st.balances instanceof Map) {
+              for (const [k, v] of st.balances) {
+                out[k] = v;
+              }
+            }
+          });
+        }
+        json(res, 200, { ok: true, balances: out });
+        return;
+      }
+
+      // POST: Trigger refresh of balances for a provider or key list
+      if (req.method === 'POST') {
+        const body = await readJson(req);
+        const provider = body?.provider;
+        const ref = body?.ref;
+        const testValue = body?.value;
+
+        if (ref && provider) {
+          const inspectRes = await inspectBalanceForRef(ctx, ref, provider, { testValue });
+          const runtime = buildRuntime();
+          const pool = runtime.pools?.find((p) => p.provider === provider) ?? runtime.poolByRef?.get(ref);
+
+          if (inspectRes.ok && pool && pool.state) {
+            if (!pool.state.balances) pool.state.balances = new Map();
+            pool.state.balances.set(ref, { ...inspectRes, at: Date.now() });
+            applyBalanceState(pool, ref, inspectRes);
+          }
+
+          json(res, inspectRes.ok ? 200 : 400, { ok: inspectRes.ok, ref, balance: inspectRes });
+          return;
+        }
+
+        if (provider) {
+          const runtime = buildRuntime();
+          const pool = runtime.pools?.find((p) => p.provider === provider);
+          if (!pool || !Array.isArray(pool.refs) || pool.refs.length === 0) {
+            json(res, 404, { ok: false, error: `Provider '${provider}' not found or has no keys` });
+            return;
+          }
+
+          const results = {};
+          for (const kRef of pool.refs) {
+            const r = await inspectBalanceForRef(ctx, kRef, provider);
+            results[kRef] = r;
+            if (r.ok && pool.state) {
+              if (!pool.state.balances) pool.state.balances = new Map();
+              pool.state.balances.set(kRef, { ...r, at: Date.now() });
+              applyBalanceState(pool, kRef, r);
+            }
+          }
+          json(res, 200, { ok: true, provider, balances: results });
+          return;
+        }
+
+        json(res, 400, { ok: false, error: 'ref or provider required' });
+        return;
+      }
+
+      json(res, 405, { ok: false, error: 'Method Not Allowed' });
+    },
+  }), 'dsh-key-rotation: balance routes');
+}
+
+function applyBalanceState(pool, ref, balanceRes) {
+  if (!pool || !pool.state) return;
+  const isZero = balanceRes.isAvailable === false || (typeof balanceRes.total === 'number' && balanceRes.total <= 0);
+
+  if (isZero) {
+    if (!pool.state.pausedRefs) pool.state.pausedRefs = new Set();
+    if (pool.state.pausedRefs instanceof Set) pool.state.pausedRefs.add(ref);
+    if (!pool.state.pauseReasons) pool.state.pauseReasons = new Map();
+    pool.state.pauseReasons.set(ref, 'EMPTY_BALANCE_PAUSED');
+    pushEvent(pool, ref, 'BALANCE_EMPTY', 0);
+  } else if (pool.state.pauseReasons?.get?.(ref) === 'EMPTY_BALANCE_PAUSED') {
+    if (pool.state.pausedRefs instanceof Set) pool.state.pausedRefs.delete(ref);
+    pool.state.pauseReasons.delete(ref);
+    pushEvent(pool, ref, 'BALANCE_RESTORED', 0);
+  }
+}