@goodandready/dsh-key-rotation 0.8.76 → 0.8.78

package/lib/client-src/20-hooks.js

@@ -0,0 +1,55 @@
+    /** Poll rotation status while the settings section is open (smart polling). */
+    function useRotationStatus() {
+      const [byProvider, setByProvider] = React.useState({});
+      React.useEffect(() => {
+        let alive = true;
+        const pull = () => {
+          if (typeof document !== 'undefined' && document.visibilityState !== 'visible') return;
+          fetch('/dsh-key-rotation/status', { headers: { accept: 'application/json' }, signal: (typeof AbortSignal !== 'undefined' && typeof AbortSignal.timeout === 'function') ? AbortSignal.timeout(8000) : undefined })
+            .then((r) => (r.ok ? r.json() : null))
+            .then((data) => {
+              if (!alive || !data || !Array.isArray(data.providers)) return;
+              const map = {};
+              for (const entry of data.providers) map[entry.provider] = entry;
+              setByProvider(map);
+            })
+            .catch(() => { /* status is optional: card stays a working editor */ });
+        };
+        pull();
+        const id = setInterval(pull, 4000);
+        const onVis = () => { if (typeof document !== 'undefined' && document.visibilityState === 'visible') pull(); };
+        if (typeof document !== 'undefined') document.addEventListener('visibilitychange', onVis);
+        return () => {
+          alive = false;
+          clearInterval(id);
+          if (typeof document !== 'undefined') document.removeEventListener('visibilitychange', onVis);
+        };
+      }, []);
+      return byProvider;
+    }
+
+    /** Latest probe result per key (#219): /sandbox-cache (smart polling). */
+    function useProbeCache() {
+      const [cache, setCache] = React.useState({});
+      React.useEffect(() => {
+        let alive = true;
+        const pull = () => {
+          if (typeof document !== 'undefined' && document.visibilityState !== 'visible') return;
+          fetch('/dsh-key-rotation/sandbox-cache', { headers: { accept: 'application/json' }, signal: (typeof AbortSignal !== 'undefined' && typeof AbortSignal.timeout === 'function') ? AbortSignal.timeout(8000) : undefined })
+            .then((r) => (r.ok ? r.json() : null))
+            .then((data) => { if (alive && data) setCache(data); })
+            .catch(() => { /* cache is non-critical: card works without it */ });
+        };
+        pull();
+        const id = setInterval(pull, 4000);
+        const onVis = () => { if (typeof document !== 'undefined' && document.visibilityState === 'visible') pull(); };
+        if (typeof document !== 'undefined') document.addEventListener('visibilitychange', onVis);
+        return () => {
+          alive = false;
+          clearInterval(id);
+          if (typeof document !== 'undefined') document.removeEventListener('visibilitychange', onVis);
+        };
+      }, []);
+      return cache;
+    }
+

package/lib/client-src/30-utils.js

@@ -0,0 +1,185 @@
+    // formatAgo moved to lib/client-helpers.js for testability — keep local alias for bundle self-containment
+    function formatAgo(t, at) {
+      if (!at) return '';
+      const sec = Math.max(0, Math.round((Date.now() - at) / 1000));
+      if (sec < 60) return t('justNow');
+      if (sec < 3600) return t('minutesAgo').replace('{n}', String(Math.round(sec / 60)));
+      return t('hoursAgo').replace('{n}', String(Math.round(sec / 3600)));
+    }
+
+    // Card layout uses a grid, not ad-hoc inline widths. Fixed widths used to
+    // clip key names and collide actions with the value field, so the name owns
+    // its own row and the meta row shrinks on its own.
+    const CARD_CSS = [
+      '.krot{display:flex;flex-direction:column;gap:20px;max-width:960px;padding:6px 0 24px;box-sizing:border-box}',
+      '.krot-header{display:flex;flex-direction:column;gap:8px;padding-bottom:16px;border-bottom:1px solid var(--dsw-alias-border-l2)}',
+      '.krot-page-title{font-size:20px;font-weight:700;color:var(--dsw-alias-label-primary);display:flex;align-items:center;gap:10px;flex-wrap:wrap}',
+      '.krot-page-sub{font-size:13px;color:var(--dsw-alias-label-secondary);line-height:1.5}',
+      '.krot p{margin:0}',
+      '.krot-hint{font-size:12px;color:var(--dsw-alias-label-secondary);line-height:1.4}',
+      '.krot-err{font-size:13px;color:var(--dsw-alias-state-error-primary);padding:10px 14px;border-radius:8px;background:color-mix(in srgb, var(--dsw-alias-state-error-primary) 10%, transparent);display:flex;align-items:center;gap:8px}',
+      '.krot-label{font-size:13px;font-weight:500;color:var(--dsw-alias-label-primary)}',
+      '.krot-field{display:flex;flex-direction:column;gap:6px}',
+      '.krot-in{background:var(--dsw-alias-bg-layer-2);border:1px solid var(--dsw-alias-border-l2);color:var(--dsw-alias-label-primary);border-radius:8px;padding:0 12px;font-size:13px;height:36px;font-family:inherit;min-width:0;width:100%;box-sizing:border-box;transition:border-color .15s ease}',
+      '.krot-in:focus{outline:none;border-color:var(--dsw-alias-brand-primary)}',
+      '.krot-codes{display:grid;grid-template-columns:repeat(auto-fill,minmax(160px,1fr));gap:8px 14px}',
+      '.krot-code{display:flex;align-items:center;gap:8px;font-size:13px;color:var(--dsw-alias-label-primary);cursor:pointer;user-select:none}',
+      '.krot-section-card{border:1px solid var(--dsw-alias-border-l2);background:var(--dsw-alias-bg-layer-3);border-radius:12px;padding:18px 20px;display:flex;flex-direction:column;gap:14px}',
+      '.krot-section-title{font-size:15px;font-weight:600;color:var(--dsw-alias-label-primary);display:flex;align-items:center;justify-content:space-between;gap:8px}',
+      '.krot-section-desc{font-size:13px;color:var(--dsw-alias-label-secondary);margin-top:-6px;line-height:1.4}',
+      '.krot-row{display:flex;flex-wrap:wrap;gap:10px;align-items:center}',
+      '.krot-grid-2{display:grid;grid-template-columns:repeat(auto-fit,minmax(240px,1fr));gap:14px}',
+      '.krot-grid-3{display:grid;grid-template-columns:repeat(auto-fit,minmax(180px,1fr));gap:12px}',
+      '.krot-stat-box{padding:12px 14px;border:1px solid var(--dsw-alias-border-l2);border-radius:8px;background:var(--dsw-alias-bg-layer-2);display:flex;flex-direction:column;gap:4px}',
+      '.krot-stat-val{font-size:20px;font-weight:700;color:var(--dsw-alias-label-primary)}',
+      '.krot-stat-lbl{font-size:12px;color:var(--dsw-alias-label-secondary)}',
+      '.krot-load-chart{margin:10px 0;padding:10px 12px;border:1px solid var(--dsw-alias-border-l2);border-radius:8px;background:var(--dsw-alias-bg-layer-2)}',
+      '.krot-load-header{display:flex;justify-content:space-between;align-items:center;font-size:12px;color:var(--dsw-alias-label-secondary);margin-bottom:6px}',
+      '.krot-load-bar{display:flex;height:12px;border-radius:999px;overflow:hidden;background:var(--dsw-alias-bg-layer-1);border:1px solid var(--dsw-alias-border-l1)}',
+      '.krot-load-segment{height:100%;transition:width 0.2s ease}',
+      '.krot-load-legend{display:flex;flex-wrap:wrap;gap:8px;margin-top:6px;font-size:11px}',
+      '.krot-load-item{display:inline-flex;align-items:center;gap:4px}',
+      '.krot-load-dot{width:7px;height:7px;border-radius:50%}',
+      '.krot-modal-backdrop{position:fixed;top:0;left:0;right:0;bottom:0;background:var(--dsw-alias-bg-overlay, color-mix(in srgb, var(--dsw-alias-bg-layer-1) 55%, transparent));z-index:9999;display:flex;align-items:center;justify-content:center;backdrop-filter:blur(2px)}',
+      '.krot-modal-card{width:90%;max-width:420px;background:var(--dsw-alias-bg-layer-3);border:1px solid var(--dsw-alias-border-l2);border-radius:12px;box-shadow:0 12px 36px color-mix(in srgb, var(--dsw-alias-bg-layer-1) 28%, transparent);padding:20px;display:flex;flex-direction:column;gap:12px}',
+      '.krot-modal-title{font-size:16px;font-weight:600;color:var(--dsw-alias-label-primary)}',
+      '.krot-modal-desc{font-size:13px;color:var(--dsw-alias-label-secondary);line-height:1.45}',
+      '.krot-modal-actions{display:flex;justify-content:flex-end;gap:10px;margin-top:8px}',
+      '.krot-badge{font-size:12px;padding:3px 10px;border-radius:999px;border:1px solid var(--dsw-alias-border-l2);display:inline-flex;align-items:center;gap:5px;font-weight:500;white-space:nowrap}',
+      '.krot-badge-ok{border-color:var(--dsw-alias-state-success-primary);color:var(--dsw-alias-state-success-primary);background:color-mix(in srgb, var(--dsw-alias-state-success-primary) 8%, transparent)}',
+      '.krot-badge-warn{border-color:var(--dsw-alias-state-warn-primary);color:var(--dsw-alias-state-warn-primary);background:color-mix(in srgb, var(--dsw-alias-state-warn-primary) 8%, transparent)}',
+      '.krot-badge-bad{border-color:var(--dsw-alias-state-error-primary);color:var(--dsw-alias-state-error-primary);background:color-mix(in srgb, var(--dsw-alias-state-error-primary) 8%, transparent)}',
+      '.krot-prov{display:flex;flex-direction:column;gap:12px;border:1px solid var(--dsw-alias-border-l2);border-radius:10px;background:var(--dsw-alias-bg-layer-2);padding:14px 16px}',
+      '.krot-prov-head{display:flex;gap:10px;align-items:center;flex-wrap:wrap}',
+      '.krot-prov-head select{flex:1;min-width:180px}',
+      '.krot-keys{display:flex;flex-direction:column;gap:8px}',
+      '.krot-key{display:grid;grid-template-columns:22px minmax(0,1fr);gap:6px 10px;align-items:center;padding:8px 12px;background:var(--dsw-alias-bg-layer-3);border:1px solid var(--dsw-alias-border-l2);border-radius:8px}',
+      '.krot-num{font-size:12px;font-weight:600;color:var(--dsw-alias-label-tertiary);text-align:right}',
+      '.krot-name{font-size:13px;font-weight:500;color:var(--dsw-alias-label-primary);cursor:default}',
+      '.krot-meta{grid-column:2;display:flex;align-items:center;gap:8px;flex-wrap:wrap}',
+      '.krot-dot{width:8px;height:8px;border-radius:50%;flex:none}',
+      '.krot-state{font-size:12px;color:var(--dsw-alias-label-secondary);font-weight:500}',
+      '.krot-tail{font-size:11px;color:var(--dsw-alias-label-secondary);font-family:ui-monospace,Menlo,Consolas,monospace;background:var(--dsw-alias-bg-layer-1);padding:2px 6px;border-radius:4px;border:1px solid var(--dsw-alias-border-l2)}',
+      '.krot-secret{flex:1;min-width:120px;max-width:220px}',
+      '.krot-acts{display:flex;gap:4px;margin-left:auto;flex:none}',
+      '.krot-btn{appearance:none;font:inherit;cursor:pointer;border:1px solid var(--dsw-alias-border-l2);border-radius:8px;padding:6px 14px;font-size:13px;background:var(--dsw-alias-bg-layer-2);color:var(--dsw-alias-label-primary);font-weight:500;display:inline-flex;align-items:center;justify-content:center;gap:6px;transition:all .15s ease}',
+      '.krot-btn:hover:not(:disabled){background:var(--dsw-alias-bg-layer-4,var(--dsw-alias-bg-layer-2));border-color:var(--dsw-alias-label-dimmed,var(--dsw-alias-border-l2))}',
+      '.krot-btn-primary,.krot-save{background:var(--dsw-alias-label-primary);color:var(--dsw-alias-bg-layer-3);border-color:transparent;font-weight:600}',
+      '.krot-btn-primary:hover:not(:disabled),.krot-save:hover:not(:disabled){background:var(--dsw-alias-label-primary)!important;color:var(--dsw-alias-bg-layer-3)!important;opacity:0.88}',
+      '.krot-btn-danger{color:var(--dsw-alias-state-error-primary);border-color:color-mix(in srgb, var(--dsw-alias-state-error-primary) 30%, transparent)}',
+      '.krot-btn-danger:hover:not(:disabled){background:color-mix(in srgb, var(--dsw-alias-state-error-primary) 12%, transparent)!important;border-color:color-mix(in srgb, var(--dsw-alias-state-error-primary) 50%, transparent)}',
+      '.krot-btn:disabled{opacity:0.45;cursor:not-allowed}',
+      '.krot-foot{display:flex;gap:10px;align-items:center;flex-wrap:wrap}',
+      '.krot-filter-bar{display:flex;gap:8px;margin:4px 0 10px;flex-wrap:wrap}',
+      '.krot-pill{appearance:none;background:var(--dsw-alias-bg-layer-2);border:1px solid var(--dsw-alias-border-l2);border-radius:999px;padding:4px 12px;font-size:12px;font-weight:500;color:var(--dsw-alias-label-secondary);cursor:pointer;transition:all .15s ease}',
+      '.krot-pill:hover{background:var(--dsw-alias-bg-layer-1);color:var(--dsw-alias-label-primary)}',
+      '.krot-pill-active{background:var(--dsw-alias-label-primary);border-color:var(--dsw-alias-label-primary);color:var(--dsw-alias-bg-layer-3)!important;font-weight:600}',
+      '.krot-pill-warn{border-color:color-mix(in srgb, var(--dsw-alias-state-warn-primary) 30%, transparent);color:var(--dsw-alias-state-warn-primary)}',
+      '.krot-pill-err{border-color:color-mix(in srgb, var(--dsw-alias-state-error-primary) 30%, transparent);color:var(--dsw-alias-state-error-primary)}',
+      '.krot-alert-ok{padding:10px 14px;border-radius:8px;background:color-mix(in srgb, var(--dsw-alias-state-success-primary) 10%, transparent);color:var(--dsw-alias-state-success-primary);font-size:13px;display:flex;align-items:center;gap:10px}',
+      '.krot-alert-bad{padding:10px 14px;border-radius:8px;background:color-mix(in srgb, var(--dsw-alias-state-error-primary) 10%, transparent);color:var(--dsw-alias-state-error-primary);font-size:13px;display:flex;align-items:center;gap:10px}',
+      '.krot-event-stream{display:flex;flex-direction:column;gap:6px;margin-top:8px;padding:10px 12px;background:var(--dsw-alias-bg-layer-3);border:1px solid var(--dsw-alias-border-l2);border-radius:8px}',
+      // Per-model token quota editor + runtime meter
+      '.krot-models{margin-top:14px;border-top:1px solid var(--dsw-alias-border-l2);padding-top:12px}',
+      '.krot-models-title{display:flex;align-items:center;gap:8px;font-size:13px;font-weight:600;color:var(--dsw-alias-label-primary);margin-bottom:4px}',
+      '.krot-models-hint{font-size:12px;color:var(--dsw-alias-label-secondary);line-height:1.4;margin:0 0 10px}',
+      '.krot-model{border:1px solid var(--dsw-alias-border-l2);border-radius:8px;padding:10px 12px;margin-bottom:10px;background:var(--dsw-alias-bg-layer-2)}',
+      '.krot-model-head{display:flex;align-items:center;gap:8px;flex-wrap:wrap;margin-bottom:8px}',
+      '.krot-model-tag{font-size:11px;padding:2px 8px;border-radius:10px;background:var(--dsw-alias-bg-layer-3);border:1px solid var(--dsw-alias-border-l2);color:var(--dsw-alias-label-secondary)}',
+      '.krot-limit{width:110px;font-variant-numeric:tabular-nums;text-align:right}',
+      '.krot-qbar{display:inline-block;width:64px;height:6px;background:var(--dsw-alias-bg-layer-3);border-radius:3px;overflow:hidden;vertical-align:middle}',
+      '.krot-qbar-fill{display:block;height:100%;transition:width .2s ease}',
+      '.krot-qmeta{font-size:11px;color:var(--dsw-alias-label-secondary);font-variant-numeric:tabular-nums}',
+      '.krot-q-exhausted{font-size:11px;font-weight:600;color:var(--dsw-alias-state-error-primary)}',
+      '.krot-q-unlimited{font-size:11px;color:var(--dsw-alias-label-tertiary);font-style:italic}',
+      '.krot-event-row{display:flex;align-items:center;gap:8px;font-size:12px;padding:4px 0;border-bottom:1px solid var(--dsw-alias-border-l1)}',
+      '.krot-event-time{font-family:ui-monospace,Menlo,Consolas,monospace;color:var(--dsw-alias-label-tertiary);font-size:11px}',
+      ':root{--krot-chart-4:var(--dsw-alias-brand-primary);--krot-chart-5:var(--dsw-alias-state-error-primary);--krot-chart-6:var(--dsw-alias-state-success-primary)}',
+      '.krot-card{border:1px solid var(--dsw-alias-border-l2);background:var(--dsw-alias-bg-layer-3);border-radius:12px;list-style:none}',
+      '.krot-card-header{appearance:none;width:100%;font:inherit;color:inherit;text-align:left;cursor:pointer;background:0 0;border:0;border-radius:12px;display:flex;align-items:center;gap:12px;padding:14px 16px}',
+      '.krot-card-head-text{display:flex;flex-direction:column;flex:1;gap:4px;min-width:0}',
+      '.krot-card-name{color:var(--dsw-alias-label-primary);font-size:15px;font-weight:600;line-height:1.4}',
+      '.krot-card-description{color:var(--dsw-alias-label-secondary);font-size:13px}',
+      '.krot-card-chevron{margin-left:auto;flex:none;color:var(--dsw-alias-label-tertiary);transition:transform .16s ease;display:flex;align-items:center}.krot-card-chevron-open{transform:rotate(180deg)}',
+      '.krot-card-body{border-top:1px solid var(--dsw-alias-border-l2);margin:0 16px;padding:16px 0 8px}',
+      '.krot-header-chip{display:inline-flex;align-items:center;gap:6px;height:26px;padding:0 10px;border-radius:999px;border:1px solid var(--dsw-alias-border-l2);background:var(--dsw-alias-bg-layer-2);color:var(--dsw-alias-label-primary);font-size:12px;font-weight:600;cursor:pointer;position:relative;user-select:none;transition:all .15s ease}',
+      '.krot-header-chip:hover{background:var(--dsw-alias-interactive-bg-hover,var(--dsw-alias-bg-layer-3));border-color:var(--dsw-alias-border-l1);transform:translateY(-0.5px)}',
+      '.krot-popover{position:absolute;top:calc(100% + 6px);right:0;z-index:10000;min-width:220px;background:var(--dsw-alias-bg-layer-3);border:1px solid var(--dsw-alias-border-l2);border-radius:12px;padding:12px 14px;box-shadow:0 16px 40px color-mix(in srgb, var(--dsw-alias-bg-layer-1) 45%, transparent),0 2px 8px color-mix(in srgb, var(--dsw-alias-bg-layer-1) 15%, transparent);backdrop-filter:blur(16px);-webkit-backdrop-filter:blur(16px);display:flex;flex-direction:column;gap:8px;text-align:left}',
+      '.krot-pop-title{font-size:11px;font-weight:700;letter-spacing:.06em;text-transform:uppercase;color:var(--dsw-alias-label-secondary)}',
+      '.krot-pop-row{display:flex;align-items:center;justify-content:space-between;gap:12px;padding:4px 0}',
+      '.krot-pop-name{font-size:13px;font-weight:600;color:var(--dsw-alias-label-primary);display:flex;align-items:center;gap:8px}',
+      '.krot-pop-count{font-size:12px;font-weight:700;font-variant-numeric:tabular-nums;opacity:.9}',
+    ].join('');
+    const CARD_CSS_ID = 'dsh-key-rotation/section.module.css';
+    if (typeof document !== 'undefined' && !document.getElementById('dsh-key-rotation-full-css')) {
+      const tag = document.createElement('style');
+      tag.id = 'dsh-key-rotation-full-css';
+      tag.dataset.dshPlugin = NS;
+      tag.dataset.pluginCss = CARD_CSS_ID;
+      tag.setAttribute('data-plugin', NS);
+      tag.textContent = CARD_CSS;
+      document.head.appendChild(tag);
+    }
+
+    /**
+     * Env-var name for a newly added key.
+     *
+     * Users no longer type it: the first key of a provider becomes
+     * <PROVIDER>_API_KEY, later keys reuse that root with _2, _3… suffixes.
+     * The root is taken from existing keys so hand-made names keep working,
+     * and uniqueness is checked across ALL providers — otherwise two providers
+     * would silently share one credential.
+     */
+    // nextKeyRef also in lib/client-helpers.js
+    function nextKeyRef(providerId, existingKeys, allRefs) {
+      const fromExisting = (existingKeys || []).find((k) => typeof k === 'string' && k.length > 0);
+      const base = fromExisting
+        ? fromExisting.replace(/_\d+$/, '')
+        : String(providerId || 'provider').toUpperCase().replace(/[^A-Z0-9]+/g, '_').replace(/^_+|_+$/g, '') + '_API_KEY';
+      const taken = new Set(allRefs);
+      if (!taken.has(base)) return base;
+      for (let n = 2; n < 1000; n++) {
+        const candidate = base + '_' + n;
+        if (!taken.has(candidate)) return candidate;
+      }
+      return base + '_' + Date.now();
+    }
+
+    function useActiveLocale(ctx) {
+      return React.useSyncExternalStore(
+        React.useMemo(() => (cb) => (ctx && ctx.locale ? ctx.locale.subscribe(cb) : () => {}), [ctx]),
+        React.useCallback(() => {
+          if (ctx && ctx.locale) {
+            const active = ctx.locale.getSnapshot().active;
+            if (typeof active === 'string' && active) return active;
+          }
+          // Match DSH core: first entry of navigator.languages, else en.
+          if (typeof navigator !== 'undefined') {
+            const langs = (navigator.languages && navigator.languages.length)
+              ? Array.from(navigator.languages)
+              : (navigator.language ? [navigator.language] : []);
+            for (const lang of langs) {
+              const code = String(lang || '').slice(0, 2).toLowerCase();
+              if (code) return code;
+            }
+          }
+          return 'en';
+        }, [ctx])
+      );
+    }
+
+    function makeT(DICT, fallbackKeys) {
+      return (key) => (DICT && DICT[key]) || (fallbackKeys && fallbackKeys[key]) || key;
+    }
+
+    // Prefer the host slot translator (props.t + translation plugins); fall back to en source.
+    function resolveT(props) {
+      const coreT = props && typeof props.t === 'function' ? props.t : null;
+      if (!coreT) return makeT(en, en);
+      return (key) => {
+        const v = coreT(key);
+        return (v && v !== key) ? v : (en[key] || key);
+      };
+    }
+
+

package/lib/client-src/40-components.js

@@ -0,0 +1,346 @@
+    function Sparkline({ points = [], width = 120, height = 22, stroke = 'var(--dsw-alias-brand-primary, currentColor)' }) {
+      if (!Array.isArray(points) || points.length < 2) {
+        return h('svg', { width, height, viewBox: `0 0 ${width} ${height}`, style: { opacity: 0.3 } },
+          h('line', { x1: 0, y1: height / 2, x2: width, y2: height / 2, stroke, strokeWidth: 1, strokeDasharray: '3 3' })
+        );
+      }
+      const min = Math.min(...points);
+      const max = Math.max(...points);
+      const range = max - min || 1;
+      const step = width / (points.length - 1);
+      const coords = points.map((p, i) => {
+        const x = Math.round(i * step * 10) / 10;
+        const y = Math.round((height - ((p - min) / range) * (height - 4) - 2) * 10) / 10;
+        return `${x},${y}`;
+      }).join(' ');
+
+      return h('svg', {
+        width,
+        height,
+        viewBox: `0 0 ${width} ${height}`,
+        style: { display: 'inline-block', verticalAlign: 'middle', overflow: 'visible' },
+      }, h('polyline', {
+        points: coords,
+        fill: 'none',
+        stroke,
+        strokeWidth: 2,
+        strokeLinecap: 'round',
+        strokeLinejoin: 'round',
+      }));
+    }
+
+    function parseBulkKeys(text) {
+      if (!text || typeof text !== 'string') return [];
+      const lines = text.split(/\r?\n/);
+      const result = [];
+      const seen = new Set();
+      for (let raw of lines) {
+        const line = raw.trim();
+        if (!line || line.startsWith('#') || line.startsWith('//')) continue;
+        const envMatch = line.match(/^(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)=(.*)$/);
+        if (envMatch) {
+          const ref = envMatch[1];
+          if (!seen.has(ref)) {
+            seen.add(ref);
+            let weight = 1;
+            const rest = envMatch[2].trim().replace(/^['"]|['"]$/g, '');
+            const wMatch = rest.match(/,\s*(?:weight\s*=\s*)?([0-9]+)$/i);
+            if (wMatch) weight = Math.max(1, parseInt(wMatch[1], 10) || 1);
+            result.push({ ref, weight });
+          }
+          continue;
+        }
+        const parts = line.split(',');
+        const ref = parts[0].trim();
+        if (/^[A-Za-z_][A-Za-z0-9_]*$/.test(ref) && !seen.has(ref)) {
+          seen.add(ref);
+          let weight = 1;
+          if (parts[1]) {
+            const wm = parts[1].trim().match(/(?:weight\s*=\s*)?([0-9]+)/i);
+            if (wm) weight = Math.max(1, parseInt(wm[1], 10) || 1);
+          }
+          result.push({ ref, weight });
+        }
+      }
+      return result;
+    }
+
+    function UpdaterSection({ t }) {
+      const tRef = React.useRef(t);
+      tRef.current = t;
+      const [state, setState] = React.useState({ phase: 'idle', current: '', latest: '', message: '' });
+      const load = React.useCallback(async () => {
+        setState((s) => ({ ...s, phase: 'loading', message: '' }));
+        try {
+          const res = await fetch('/api/dsh-key-rotation/update', { headers: { 'x-dsh-plugin-update': '1' } });
+          const data = await res.json();
+          if (!res.ok) throw new Error(data?.error?.message || (tRef.current ? tRef.current('updateFailed') : 'Update check failed'));
+          setState({
+            phase: data.updateAvailable ? 'available' : 'current',
+            current: data.currentVersion || '',
+            latest: data.latestVersion || '',
+            message: data.updateAvailable ? (tRef.current ? tRef.current('updateAvailable') : '') : (tRef.current ? tRef.current('updateNone') : ''),
+          });
+        } catch (e) {
+          setState({ phase: 'error', current: '', latest: '', message: e?.message || (tRef.current ? tRef.current('updateFailed') : 'Update check failed') });
+        }
+      }, []);
+      React.useEffect(() => { load(); }, [load]);
+      const run = async () => {
+        setState((s) => ({ ...s, phase: 'running', message: t('updateRunning') }));
+        try {
+          const res = await fetch('/api/dsh-key-rotation/update', {
+            method: 'POST',
+            headers: { 'x-dsh-plugin-update': '1', 'content-type': 'application/json' },
+          });
+          const data = await res.json();
+          if (!res.ok) throw new Error(data?.error?.message || t('updateFailed'));
+          setState({
+            phase: 'done',
+            current: data.currentVersion || '',
+            latest: data.installedVersion || data.latestVersion || '',
+            message: t('updateRestart'),
+          });
+        } catch (e) {
+          setState({ phase: 'error', current: '', latest: '', message: e?.message || t('updateFailed') });
+        }
+      };
+      return h('div', { className: 'krot-update', style: { marginTop: 12, paddingTop: 12, borderTop: '1px solid var(--dsw-alias-border-l2)' } },
+        h('div', { style: { display: 'flex', gap: 8, alignItems: 'center', flexWrap: 'wrap' } },
+          h('span', { style: { fontSize: 12, color: 'var(--dsw-alias-label-secondary)' } },
+            t('currentVersion') + ': ' + (state.current || '—')),
+          state.latest ? h('span', { style: { fontSize: 12, color: 'var(--dsw-alias-label-secondary)' } },
+            t('latestVersion') + ': ' + state.latest) : null,
+          h('button', {
+            className: 'krot-btn',
+            type: 'button',
+            disabled: state.phase === 'running' || state.phase === 'loading',
+            onClick: load,
+          }, t('updateCheck')),
+          state.phase === 'available' ? h('button', {
+            className: 'krot-btn krot-btn-primary',
+            type: 'button',
+            disabled: state.phase === 'running',
+            onClick: run,
+          }, t('updateRun')) : null,
+        ),
+        state.message ? h('div', {
+          className: state.phase === 'error' ? 'krot-alert-bad' : state.phase === 'done' ? 'krot-alert-ok' : '',
+          style: { marginTop: 8, fontSize: 12 },
+        }, state.message) : null,
+      );
+    }
+
+    // Provider registration is not part of settingsScope's value. Fetch it
+    // independently, and never turn an unavailable catalog into proof of absence.
+    function useProviderCatalog(enabled = true) {
+      const [catalog, setCatalog] = React.useState({ status: 'loading', providers: [] });
+      const requestRef = React.useRef(null);
+      const reload = React.useCallback(() => {
+        requestRef.current?.abort();
+        if (!enabled) {
+          setCatalog({ status: 'unavailable', providers: [] });
+          return Promise.resolve();
+        }
+        const controller = new AbortController();
+        requestRef.current = controller;
+        setCatalog((s) => ({ ...s, status: 'loading' }));
+        return fetch(CONFIG_PATH, { headers: { accept: 'application/json' }, signal: controller.signal })
+          .then(async (response) => {
+            if (!response.ok) throw new Error('provider catalog unavailable');
+            const data = await response.json();
+            if (!Array.isArray(data?.providers) || !data.providers.every((p) =>
+              p && typeof p.id === 'string' && p.id.length > 0)) {
+              throw new Error('invalid provider catalog');
+            }
+            if (controller.signal.aborted || requestRef.current !== controller) return;
+            setCatalog({ status: 'ready', providers: data.providers.map((p) => ({
+              id: p.id, name: typeof p.name === 'string' ? p.name : p.id,
+            })) });
+          })
+          .catch(() => {
+            if (!controller.signal.aborted && requestRef.current === controller) {
+              setCatalog((s) => ({ ...s, status: 'error' }));
+            }
+          });
+      }, [enabled]);
+      React.useEffect(() => {
+        reload();
+        // A provider may have been installed/enabled while this page was open.
+        window.addEventListener?.('focus', reload);
+        return () => {
+          requestRef.current?.abort();
+          window.removeEventListener?.('focus', reload);
+        };
+      }, [reload]);
+      return { ...catalog, reload };
+    }
+
+    // Services from different core generations are optional at the plugin boundary.
+    // One binding belongs to one Cordis activation, not to each React page mount.
+    function createSettingsSource(ctx) {
+      const listeners = new Set();
+      const candidates = new Map();
+      let value = { kind: null, service: null };
+      const publish = () => {
+        const kind = candidates.has('configForm') ? 'configForm'
+          : candidates.has('settingsScope') ? 'settingsScope' : null;
+        const service = candidates.get(kind) ?? null;
+        if (value.kind === kind && value.service === service) return;
+        value = { kind, service };
+        for (const listener of [...listeners]) listener();
+      };
+      if (typeof ctx?.inject === 'function') {
+        const watch = (name, kind, resolve) => {
+          ctx.inject([name], (owner) => {
+            let service;
+            try { service = resolve(owner.get(name)); } catch (_) { return; }
+            if (!service || typeof service.getSnapshot !== 'function'
+              || typeof service.subscribe !== 'function') return;
+            candidates.set(kind, service);
+            publish();
+            owner.effect(() => () => {
+              if (candidates.get(kind) === service) candidates.delete(kind);
+              publish();
+            });
+          });
+        };
+        watch('configForms', 'configForm', (forms) => forms?.get?.(NS));
+        watch('settingsScope', 'settingsScope', (binder) => binder?.bind?.({ namespace: NS }));
+        if (typeof ctx.effect === 'function') {
+          ctx.effect(() => () => { candidates.clear(); publish(); listeners.clear(); });
+        }
+      }
+      return {
+        getSnapshot: () => value,
+        subscribe: (listener) => { listeners.add(listener); return () => listeners.delete(listener); },
+      };
+    }
+
+    function sameJson(a, b) {
+      if (Object.is(a, b)) return true;
+      if (!a || !b || typeof a !== 'object' || typeof b !== 'object'
+        || Array.isArray(a) !== Array.isArray(b)) return false;
+      const keys = Object.keys(a);
+      return keys.length === Object.keys(b).length
+        && keys.every((key) => Object.prototype.hasOwnProperty.call(b, key) && sameJson(a[key], b[key]));
+    }
+
+    // A redacted, resolved snapshot is not a complete user section. Submit only
+    // changed top-level fields; arrays are intentionally edited atomically.
+    function changedSettingsOps(base, next) {
+      const keys = new Set([...Object.keys(base), ...Object.keys(next)]);
+      return [...keys].filter((key) => !sameJson(base[key], next[key])).map((key) =>
+        next[key] === undefined ? { op: 'unset', path: [key] }
+          : { op: 'set', path: [key], value: next[key] });
+    }
+
+    function requireJson(value, depth = 0) {
+      if (depth > 40) throw new Error('Configuration is nested too deeply');
+      if (value === null || typeof value === 'string' || typeof value === 'boolean') return;
+      if (typeof value === 'number' && Number.isFinite(value)) return;
+      if (Array.isArray(value)) { value.forEach(child => requireJson(child, depth + 1)); return; }
+      if (value && typeof value === 'object') {
+        for (const [key, child] of Object.entries(value)) {
+          if (['__proto__', 'constructor', 'prototype'].includes(key)) throw new Error('Unsafe configuration field');
+          if (child !== undefined) requireJson(child, depth + 1);
+        }
+        return;
+      }
+      throw new Error('Configuration must contain finite, JSON-compatible values');
+    }
+
+
+    function reorderKeys(entry, order) {
+      const next = { ...entry, keys: order.map(index => entry.keys[index]) };
+      for (const [field, fallback] of [['weights', 1], ['expiresAt', 0], ['paused', false], ['revoked', false]]) {
+        if (Array.isArray(entry[field]) && entry[field].length) next[field] = order.map(index => entry[field][index] ?? fallback);
+      }
+      return next;
+    }
+
+    function formatCountdown(ms) {
+      if (!Number.isFinite(ms) || ms <= 0) return '00:00:00';
+      const total = Math.floor(ms / 1000);
+      const h = Math.floor(total / 3600);
+      const m = Math.floor((total % 3600) / 60);
+      const s = total % 60;
+      const pad = (n) => String(n).padStart(2, '0');
+      return pad(h) + ':' + pad(m) + ':' + pad(s);
+    }
+
+    function quotaMapOf(modelEntry) {
+      const out = {};
+      const raw = (modelEntry && typeof modelEntry === 'object' && modelEntry.quotas) || {};
+      if (!raw || typeof raw !== 'object' || Array.isArray(raw)) return out;
+      for (const [ref, value] of Object.entries(raw)) {
+        if (['__proto__', 'constructor', 'prototype'].includes(ref)) continue;
+        const n = typeof value === 'object' && value !== null ? value.tokenLimit : value;
+        const num = typeof n === 'string' ? Number(n.trim() === '' ? NaN : n) : Number(n);
+        if (Number.isFinite(num) && num > 0) out[ref] = { tokenLimit: Math.floor(num) };
+      }
+      return out;
+    }
+
+    function withQuotas(modelEntry, limits) {
+      const quotas = {};
+      for (const [ref, value] of Object.entries(limits ?? {})) {
+        const n = typeof value === 'object' && value !== null ? value.tokenLimit : value;
+        const num = typeof n === 'string' ? Number(n.trim() === '' ? NaN : n) : Number(n);
+        if (!Number.isFinite(num) || num <= 0) continue;
+        quotas[ref] = { tokenLimit: Math.floor(num) };
+      }
+      const next = { ...modelEntry };
+      if (Object.keys(quotas).length === 0) delete next.quotas;
+      else next.quotas = quotas;
+      return next;
+    }
+
+    function modelEntriesOf(entry) {
+      const models = entry && entry.models;
+      if (!models || typeof models !== 'object' || Array.isArray(models)) return [];
+      return Object.entries(models).filter(([, value]) => value && typeof value === 'object' && !Array.isArray(value));
+    }
+
+    function isValidModelId(id) {
+      return typeof id === 'string' && id.trim().length > 0
+        && !['__proto__', 'constructor', 'prototype'].includes(id)
+        && id.length <= 200;
+    }
+
+    function validatePoolDraft(providers) {
+      if (!Array.isArray(providers)) throw new Error('Provider pools must be an array');
+      const names = new Set();
+      for (const entry of providers) {
+        if (!entry || typeof entry.provider !== 'string' || !entry.provider.trim()
+          || names.has(entry.provider) || !Array.isArray(entry.keys)
+          || entry.keys.some(key => typeof key !== 'string' || !/^[A-Za-z_][A-Za-z0-9_]*$/.test(key))
+          || new Set(entry.keys).size !== entry.keys.length) {
+          throw new Error('Choose a unique provider and valid, unique credential reference names');
+        }
+        names.add(entry.provider);
+        for (const [model, mp] of modelEntriesOf(entry)) {
+          if (!isValidModelId(model)) throw new Error('Model ids must be non-empty and safe as configuration keys');
+          if (!Array.isArray(mp.keys)
+            || mp.keys.some(key => typeof key !== 'string' || !/^[A-Za-z_][A-Za-z0-9_]*$/.test(key))
+            || new Set(mp.keys).size !== mp.keys.length) {
+            throw new Error('Each model pool needs valid, unique credential reference names');
+          }
+          for (const ref of Object.keys(quotaMapOf(mp))) {
+            if (!mp.keys.includes(ref)) throw new Error('A model token limit must reference a credential of that model pool');
+          }
+        }
+      }
+    }
+
+    async function settingsResponse(response) {
+      let data;
+      try { data = await response.json(); }
+      catch (_) { throw new Error('Settings response is not valid JSON (HTTP ' + response.status + ')'); }
+      if (!response.ok || data?.error) {
+        throw new Error(data?.error?.message || 'Settings request failed (HTTP ' + response.status + ')');
+      }
+      if (!data || typeof data !== 'object' || Array.isArray(data)) throw new Error('Invalid settings response');
+      return data;
+    }
+