@huaqiu/dsh-auth 0.1.1

package/lib/client.js

@@ -0,0 +1,1427 @@
+window.__ModuleLoader__.load({
+	id: "@huaqiu/dsh-auth",
+	factory: (require) => {
+		var module = { exports: {} };
+		var exports = module.exports;
+		Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+		let react_jsx_runtime = require("react/jsx-runtime");
+		let react = require("react");
+		let react_dom = require("react-dom");
+		//#region src/client/storage.ts
+		const DEFAULT_STORAGE_KEY = "huaqiu.dsh.auth";
+		function createAuthStorage(storage, key = DEFAULT_STORAGE_KEY) {
+			return {
+				get() {
+					const raw = storage.getItem(key);
+					if (!raw) return null;
+					try {
+						const parsed = JSON.parse(raw);
+						if (!parsed || typeof parsed.token !== "string" || typeof parsed.id !== "string") return null;
+						if (parsed.expiresAt !== void 0 && parsed.expiresAt * 1e3 <= Date.now()) {
+							storage.removeItem(key);
+							return null;
+						}
+						return parsed;
+					} catch {
+						return null;
+					}
+				},
+				set(info) {
+					storage.setItem(key, JSON.stringify(info));
+				},
+				clear() {
+					storage.removeItem(key);
+				}
+			};
+		}
+		//#endregion
+		//#region src/client/transport.ts
+		function createWebServerAuthTransport(base = "/api/v1/huaqiu/auth", doFetch = globalThis.fetch.bind(globalThis)) {
+			return {
+				async pushSession(info) {
+					const res = await doFetch(`${base}/session`, {
+						method: "POST",
+						headers: { "content-type": "application/json" },
+						body: JSON.stringify({
+							token: info.token,
+							userId: info.id,
+							...info.nickname !== void 0 ? { nickname: info.nickname } : {}
+						})
+					});
+					if (!res.ok) throw new Error(`auth push failed: HTTP ${res.status}`);
+				},
+				async pushLogout() {
+					const res = await doFetch(`${base}/logout`, { method: "POST" });
+					if (!res.ok) throw new Error(`auth logout push failed: HTTP ${res.status}`);
+				}
+			};
+		}
+		/**「Go to profile」destination: the eda.cn account page. */
+		const PROFILE_URL = "https://www.eda.cn/account/profile";
+		/**
+		* Build the「Go to profile」URL: the eda.cn account page WITH the access token
+		* in the query, mirroring `hq-eda-ai`'s `UserMenu`
+		* (`/account/profile?token=…&phone=…`).
+		*
+		* The token is always attached: eda.cn consumes it to establish the session
+		* and strips it from the address bar / history itself, so there is nothing to
+		* leak beyond the target site. `encodeURIComponent` is required (not cosmetic):
+		* tokens are base64-ish and may contain `+`, `/` or `=`, and a raw `+` in a
+		* query string decodes to a space, which would corrupt the credential.
+		*/
+		function buildProfileUrl(options) {
+			const phone = options.phone === void 0 || options.phone === null ? "" : String(options.phone);
+			return `${PROFILE_URL}?token=${encodeURIComponent(options.token)}&phone=${encodeURIComponent(phone)}`;
+		}
+		/**
+		* Contract version of the auth.eda.cn embed, shared with the web app
+		* (`hq-eda-ai` LoginDialog) so both send the same cache-busting `v=`.
+		*/
+		const AUTH_IFRAME_VERSION = "20260409";
+		/**
+		* auth.eda.cn's own language ids, keyed by our locale id.
+		*
+		* The embed reads `?locale=`, NOT `lang`: `eda-cn-login/app/layout.tsx` reads
+		* `urlParams.get('locale')` and `components/ui/LanguageContext.tsx`
+		* (`getLangFromUrl`) only accepts the ids in `locales/index.ts` — `cn` and
+		* `en` (`zh` / `zh_CN` are aliased to `cn` there, but we send the canonical
+		* id outright).
+		*
+		* NOTE: `hq-eda-ai`'s `LoginDialog.tsx` sends `lang=zh`, which the embed
+		* IGNORES, so its login card always falls back to whatever the browser asks
+		* for. We send `locale` (what is actually read) and keep `lang` alongside it
+		* for parity with the web app and forward compatibility.
+		*/
+		const AUTH_LOCALE_ID = {
+			zh: "cn",
+			en: "en"
+		};
+		/**
+		* Build the auth.eda.cn embed URL.
+		*
+		* The URL switches between two rendering modes based on `options.fill`:
+		*  - `fill: 'full'` (or `true`) → `fill=full` is sent; the embed's
+		*    `DialogContent` becomes `w-full h-full … rounded-none` and the wrapper
+		*    drops `bg-transparent`, so the embed fills the iframe viewport with
+		*    its own `bg-background`. Use this when the iframe is the surface (e.g.
+		*    the toolview card).
+		*  - any other value (including unset) → no `fill` is sent; the embed stays
+		*    in transparent card mode. The host is responsible for painting a card
+		*    around the iframe so Blink's white base canvas never reaches the user.
+		*/
+		function buildLoginUrl(options = {}) {
+			const url = new URL(options.baseUrl ?? `https://auth.eda.cn/`);
+			url.searchParams.set("v", AUTH_IFRAME_VERSION);
+			if (options.closeOnOutsideClick !== false) url.searchParams.set("clickOutsideToClose", "true");
+			if (options.fill === "full" || options.fill === true) url.searchParams.set("fill", "full");
+			url.searchParams.set("transparent", "true");
+			const lang = options.lang ?? "zh";
+			url.searchParams.set("locale", AUTH_LOCALE_ID[lang]);
+			url.searchParams.set("lang", lang);
+			url.searchParams.set("theme", options.theme ?? "light");
+			return url.toString();
+		}
+		/** Coerce an id field (string or number, as auth.eda.cn sends) to a string. */
+		function stringifyId(value) {
+			if (typeof value === "string" && value.length > 0) return value;
+			if (typeof value === "number" && Number.isFinite(value)) return String(value);
+			return null;
+		}
+		function parseAuthMessage(raw) {
+			let envelope = null;
+			if (typeof raw === "string") try {
+				envelope = JSON.parse(raw);
+			} catch {
+				return null;
+			}
+			else if (raw !== null && typeof raw === "object") envelope = raw;
+			if (!envelope || envelope.category !== 1) return null;
+			const data = envelope.data;
+			if (!data || typeof data !== "object") return null;
+			switch (data.type) {
+				case "update_access_token": {
+					const d = data.data;
+					if (!d || typeof d !== "object") return null;
+					const record = d;
+					const token = typeof record.token === "string" && record.token.length > 0 ? record.token : null;
+					const id = stringifyId(record.userId) ?? stringifyId(record.id);
+					if (!token || !id) return null;
+					const nickname = typeof record.nickname === "string" && record.nickname.length > 0 ? record.nickname : void 0;
+					const avatar = typeof record.headimage === "string" && record.headimage.length > 0 ? record.headimage : typeof record.avatar === "string" && record.avatar.length > 0 ? record.avatar : void 0;
+					const phone = stringifyId(record.phone) ?? void 0;
+					const expiresAt = typeof record.expires_at === "number" ? record.expires_at : void 0;
+					return {
+						kind: "token",
+						info: {
+							id,
+							token,
+							...nickname !== void 0 ? { nickname } : {},
+							...avatar !== void 0 ? { avatar } : {},
+							...phone !== void 0 ? { phone } : {},
+							...expiresAt !== void 0 ? { expiresAt } : {}
+						}
+					};
+				}
+				case "logout": return { kind: "logout" };
+				case "close_dialog": return { kind: "close" };
+				default: return null;
+			}
+		}
+		/** Origin-agnostic envelope parsing. The ONLY entry point for window message events. */
+		function handleAuthMessage(event) {
+			return parseAuthMessage(event.data);
+		}
+		//#endregion
+		//#region src/client/ui/common.tsx
+		/** Best-effort JSON.parse of the tool's text output blocks. */
+		function parseToolResult(block) {
+			if (!block || !Array.isArray(block.content)) return null;
+			const text = block.content.filter((c) => !!c && c.type === "text" && typeof c.text === "string").map((c) => c.text).join("");
+			if (!text) return null;
+			try {
+				const parsed = JSON.parse(text);
+				return parsed && typeof parsed === "object" ? parsed : null;
+			} catch {
+				return null;
+			}
+		}
+		/** True when the parsed result is the auth-gate signal. */
+		function isNeedsAuthResult(result) {
+			return !!result && result.status === "needs_auth";
+		}
+		const LIGHT_CARD_PALETTE = {
+			surface: "var(--dsw-alias-bg-layer-1, #ffffff)",
+			border: "var(--dsw-alias-border-l1, #e4e7ec)",
+			text: "var(--dsw-alias-label-primary, inherit)",
+			muted: "var(--dsw-alias-label-secondary, #5b6472)",
+			success: "var(--dsw-alias-state-success-primary, #1677ff)",
+			danger: "var(--dsw-alias-state-error-primary, #d4380d)"
+		};
+		const DARK_CARD_PALETTE = {
+			surface: "var(--dsw-alias-bg-layer-1, #20242c)",
+			border: "var(--dsw-alias-border-l1, rgba(255, 255, 255, 0.14))",
+			text: "var(--dsw-alias-label-primary, #e6eaf0)",
+			muted: "var(--dsw-alias-label-secondary, #8b95a5)",
+			success: "var(--dsw-alias-state-success-primary, #4cc38a)",
+			danger: "var(--dsw-alias-state-error-primary, #ff7875)"
+		};
+		function cardPalette(dark) {
+			return dark ? DARK_CARD_PALETTE : LIGHT_CARD_PALETTE;
+		}
+		function cardStyle(palette) {
+			return {
+				border: `1px solid ${palette.border}`,
+				borderRadius: 10,
+				padding: "12px 14px",
+				margin: "4px 0",
+				background: palette.surface,
+				color: palette.text,
+				fontFamily: "inherit"
+			};
+		}
+		const TITLE_STYLE = {
+			fontSize: 14,
+			fontWeight: 600,
+			margin: "0 0 6px"
+		};
+		const STATUS_STYLE = {
+			fontSize: 13,
+			margin: "0 0 10px",
+			lineHeight: 1.5
+		};
+		/**
+		* The embedded login iframe: painted with the same surface as the wrapping
+		* card so the login box blends in both schemes.
+		*
+		* Why not `background: transparent`? Blink's `BaseBackgroundColor()` falls
+		* back to WHITE whenever the embedded doc's root element has a transparent
+		* background (and auth.eda.cn's `data-iframe-mode` page is exactly that).
+		* That white canvas shows through wherever the document doesn't paint, which
+		* reads as a glaring white "frame" around the login card in dark mode. Light
+		* mode hid the bug because the white canvas happened to match the light
+		* host. Painting the iframe ELEMENT with the card's surface (DSH alias
+		* `--dsw-alias-bg-layer-1` with a per-scheme fallback) puts a dark sheet in
+		* dark mode and a light sheet in light mode, so the login card sits on a
+		* surface that blends with the host in both schemes.
+		*/
+		function iframeStyle(palette) {
+			return {
+				width: "100%",
+				height: 440,
+				border: `1px solid ${palette.border}`,
+				borderRadius: 8,
+				background: palette.surface,
+				display: "block"
+			};
+		}
+		function StatusLine({ authenticated, nickname, palette, t }) {
+			if (authenticated) return /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+				style: {
+					...STATUS_STYLE,
+					color: palette.success
+				},
+				children: t("card.loggedIn", { nickname: nickname ? t("card.nicknameSep", { nickname }) : "" })
+			});
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+				style: {
+					...STATUS_STYLE,
+					color: palette.danger
+				},
+				children: t("card.loggedOut")
+			});
+		}
+		//#endregion
+		//#region src/client/ui-env.ts
+		/**
+		* Host theme + locale sensing for the client UI.
+		*
+		* The DSH slot system injects React components with PROPS, not the cordis ctx,
+		* so the cards cannot reach `ctx.theme` / `ctx.locale` the way a plugin body
+		* can. Both services do, however, publish their state into the DOM, and that
+		* is what this module reads:
+		*
+		* - THEME — `ui-layout`'s presenter switches `body[data-ds-dark-theme]` from
+		*   the resolved snapshot (`packages/client/ui-layout/src/client/theme-presenter.ts`,
+		*   `DARK_ATTRIBUTE`), so the attribute's presence IS the dark palette. Same
+		*   signal the sibling packages already use
+		*   (`dsh-tool-schematic-gen/src/client/theme.ts`). `prefers-color-scheme` is
+		*   deliberately NOT consulted: DSH resolves `system` itself, and an OS-dark /
+		*   DSH-light combination would then be misdetected.
+		* - LOCALE — `dsh-client-locale` writes `<html lang>` on every locale change
+		*   (`syncDocumentLanguage`: `zh-CN` | `en`). Falling back to the browser's
+		*   own `navigator.languages` keeps the UI usable on hosts without that
+		*   plugin. Chinese is the last resort because this is a Chinese-first app
+		*   (and `hq-eda-ai` defaults to zh: `languageMap[lang] || "zh"`).
+		*
+		* Both are exposed as `useSyncExternalStore` snapshots so every mounted card
+		* re-renders together when the user flips theme or language.
+		*/
+		/** DSH's dark-palette marker, written by ui-layout's theme presenter. */
+		const DARK_ATTRIBUTE = "data-ds-dark-theme";
+		function isDarkDocument() {
+			if (typeof document === "undefined") return false;
+			if (document.body?.hasAttribute("data-ds-dark-theme")) return true;
+			const root = document.documentElement;
+			if (!root) return false;
+			const dataTheme = root.getAttribute("data-theme");
+			if (dataTheme !== null) return dataTheme.toLowerCase() === "dark";
+			return root.classList.contains("dark");
+		}
+		/** `zh-CN`, `zh-Hans`, `en-GB`, … → our locale id (`undefined` = unknown). */
+		function localeFromTag(tag) {
+			if (!tag) return void 0;
+			const primary = tag.toLowerCase().split("-")[0];
+			return primary === "zh" || primary === "en" ? primary : void 0;
+		}
+		function detectLocale() {
+			if (typeof document !== "undefined") {
+				const fromDocument = localeFromTag(document.documentElement?.getAttribute("lang"));
+				if (fromDocument) return fromDocument;
+			}
+			if (typeof navigator !== "undefined" && typeof window !== "undefined") for (const tag of [...navigator.languages ?? [], navigator.language]) {
+				const match = localeFromTag(tag);
+				if (match) return match;
+			}
+			return "zh";
+		}
+		let dark = isDarkDocument();
+		let locale = detectLocale();
+		const listeners$1 = /* @__PURE__ */ new Set();
+		let darkObserver = null;
+		let localeObserver = null;
+		function notify() {
+			for (const listener of [...listeners$1]) try {
+				listener();
+			} catch {}
+		}
+		/** Re-read the DOM and notify only what actually changed. */
+		function syncUiEnv() {
+			let changed = false;
+			const nextDark = isDarkDocument();
+			if (nextDark !== dark) {
+				dark = nextDark;
+				changed = true;
+			}
+			const nextLocale = detectLocale();
+			if (nextLocale !== locale) {
+				locale = nextLocale;
+				changed = true;
+			}
+			if (changed) notify();
+		}
+		/** Start observing (idempotent; also re-reads so no change is missed). */
+		function watch() {
+			if (typeof document === "undefined" || typeof MutationObserver === "undefined") return;
+			if (!darkObserver && document.body) {
+				darkObserver = new MutationObserver(syncUiEnv);
+				darkObserver.observe(document.body, {
+					attributes: true,
+					attributeFilter: [DARK_ATTRIBUTE]
+				});
+			}
+			if (!localeObserver && document.documentElement) {
+				localeObserver = new MutationObserver(syncUiEnv);
+				localeObserver.observe(document.documentElement, {
+					attributes: true,
+					attributeFilter: [
+						"lang",
+						"data-theme",
+						"class"
+					]
+				});
+			}
+			syncUiEnv();
+		}
+		function subscribe(callback) {
+			watch();
+			listeners$1.add(callback);
+			return () => {
+				listeners$1.delete(callback);
+			};
+		}
+		/**
+		* Imperative subscription for non-React consumers (e.g. the login dialog's
+		* backdrop/card DOM). The callback fires on every theme or locale flip.
+		*/
+		function subscribeUiEnv(callback) {
+			return subscribe(callback);
+		}
+		const getDark = () => dark;
+		const getLocale = () => locale;
+		/** Synchronous read of the current host UI locale. */
+		function getCurrentLocale() {
+			return locale;
+		}
+		/** Synchronous read of the current host surface color (matches the palette). */
+		function getCurrentSurfaceColor() {
+			return dark ? "var(--dsw-alias-bg-layer-1, #20242c)" : "var(--dsw-alias-bg-layer-1, #ffffff)";
+		}
+		/** `true` while the host renders the dark palette. */
+		function useIsDark() {
+			return (0, react.useSyncExternalStore)(subscribe, getDark, getDark);
+		}
+		/** The host UI language. */
+		function useLocale() {
+			return (0, react.useSyncExternalStore)(subscribe, getLocale, getLocale);
+		}
+		/** Release the observers (called from `apply()`'s disposer). */
+		function disposeUiEnv() {
+			darkObserver?.disconnect();
+			localeObserver?.disconnect();
+			darkObserver = null;
+			localeObserver = null;
+			listeners$1.clear();
+		}
+		//#endregion
+		//#region src/client/i18n.ts
+		/**
+		* zh / en copy for every user-visible string of the auth UI (sidebar trigger,
+		* account menu, login tool card).
+		*
+		* Kept self-contained rather than registered into DSH's `ctx.locale`
+		* namespace — same call the sibling packages made
+		* (`dsh-tool-symbol-footprint/src/client/i18n.ts`) — because the slot system
+		* hands components props, not ctx, and a missing namespace would leave the UI
+		* blank. `en` is typed as `Record<AuthCopyKey, string>`, so a key added to one
+		* language without the other is a COMPILE error (bilingual balance enforced at
+		* build time, mirroring DSH's own locale registry).
+		*
+		* The en「Go to profile」/「Log out」wording is the one the sidebar spec asks
+		* for; the zh side follows `hq-eda-ai`'s `locales/cn.ts` (个人中心 / 退出登录).
+		*/
+		const zh = {
+			"sidebar.login": "华秋EDA AI登录",
+			"sidebar.loginTitle": "登录华秋 EDA AI（eda.cn）账号",
+			"sidebar.accountTitle": "华秋 EDA AI 账号",
+			"sidebar.account": "华秋EDA AI · 已登录",
+			"menu.profile": "个人中心",
+			"menu.logout": "退出登录",
+			"card.title": "华秋 EDA AI（eda.cn）登录",
+			"card.desc": "工具「{tool}」需要登录华秋 EDA AI 账号才能继续。请在下方的登录框完成登录（或点击左侧「华秋EDA AI登录」按钮）；登录完成后，回复助手「已登录，请重试」，助手会自动重新调用该工具。",
+			"card.loggedIn": "✓ 已登录{nickname} —— 现在可以回复助手「已登录，请重试」，助手会重新调用工具。",
+			"card.loggedOut": "未登录 —— 请在上方登录华秋 EDA AI（eda.cn）账号，或点击左侧「华秋EDA AI登录」按钮；登录完成后让助手重试。",
+			"card.tool": "工具：{tool}",
+			"card.empty": "(无输出)",
+			"card.nicknameSep": "：{nickname}",
+			"dialog.close": "关闭"
+		};
+		const COPY = {
+			zh,
+			en: {
+				"sidebar.login": "Huaqiu EDA AI login",
+				"sidebar.loginTitle": "Sign in to your Huaqiu EDA AI (eda.cn) account",
+				"sidebar.accountTitle": "Huaqiu EDA AI account",
+				"sidebar.account": "Huaqiu EDA AI · signed in",
+				"menu.profile": "Go to profile",
+				"menu.logout": "Log out",
+				"card.title": "Huaqiu EDA AI (eda.cn) login",
+				"card.desc": "Tool \"{tool}\" needs a Huaqiu EDA AI account. Complete the login below (or use the Huaqiu EDA AI button in the sidebar), then reply \"I have logged in, please retry\" so the assistant can retry the tool.",
+				"card.loggedIn": "✓ Logged in{nickname} — reply \"I have logged in, please retry\" and the assistant will retry the tool.",
+				"card.loggedOut": "Not logged in — sign in above, or use the Huaqiu EDA AI button in the sidebar, then ask the assistant to retry.",
+				"card.tool": "Tool: {tool}",
+				"card.empty": "(no output)",
+				"card.nicknameSep": ": {nickname}",
+				"dialog.close": "Close"
+			}
+		};
+		Object.keys(zh);
+		/**
+		* Look a key up, interpolating `{name}` placeholders.
+		*
+		* Chain: active locale → zh (the source of truth) → the key itself, so a
+		* missing translation stays VISIBLE instead of blanking the UI.
+		*/
+		function translate(locale, key, params) {
+			const template = COPY[locale]?.[key] ?? COPY.zh[key] ?? key;
+			if (!params) return template;
+			return template.replace(/\{(\w+)\}/g, (match, name) => name in params ? String(params[name]) : match);
+		}
+		/** Translate bound to one locale (stable for the lifetime of that locale). */
+		function createT(locale) {
+			return (key, params) => translate(locale, key, params);
+		}
+		/** Translate bound to the host UI language, re-created when it changes. */
+		function useT() {
+			const locale = useLocale();
+			return (0, react.useMemo)(() => createT(locale), [locale]);
+		}
+		//#endregion
+		//#region src/client/ui/login-dialog.ts
+		/**
+		* The sidebar login dialog — a real modal (backdrop + centered card + iframe).
+		*
+		* WHY A DIALOG AND NOT A FULL-VIEWPORT IFRAME
+		*
+		* The embed (`auth.eda.cn`) reads only two URL params: `fill` and
+		* `clickOutsideToClose`. With `fill !== 'full'` it sets
+		* `data-iframe-mode="true"` on `<html>` and the CSS rule
+		* `html[data-iframe-mode=true], html[data-iframe-mode=true] body { background: 0 0 !important }`
+		* makes its root transparent — but the page wrapper still uses a
+		* `grid-rows-[20px_1fr_20px]` layout, so the 20px strips above/below the
+		* card are empty and show through to whatever is behind the iframe. Behind
+		* the iframe element, with no background set, Blink falls back to a WHITE
+		* base background canvas. That white is what was reading as a "white frame
+		* around the login card in dark mode" (and was invisibly there in light
+		* mode, blending with the white host).
+		*
+		* The two ways out:
+		*   1. Paint the iframe element with a color → in a full-viewport iframe
+		*      that blanks the whole app with that color (light surface = white
+		*      blocks the light host; dark surface = dark blocks the dark host).
+		*   2. Make the iframe CARD-SIZED and put it inside a host-painted card,
+		*      so the iframe's background can be `transparent` and the card's
+		*      surface shows through wherever the embedded doc is transparent.
+		*      This is the pattern the toolview card already uses
+		*      (`needs-auth-toolview.tsx`) and the pattern `hq-eda-ai`'s
+		*      `LoginDialog.tsx` uses.
+		*
+		* We use (2): a fixed full-viewport backdrop (semi-transparent black) +
+		* centered card (host surface bg) + the iframe (transparent inner doc,
+		* card surface as element bg so Blink's white canvas never reaches the
+		* user). Click on the backdrop, the × button, Escape, or the auth embed's
+		* own `close_dialog` postMessage closes the dialog.
+		*/
+		/** Aria / data attribute names — stable so tests and CSS can target them. */
+		const DIALOG_OVERLAY_ATTR = "data-hq-auth-dialog";
+		const DIALOG_CARD_ATTR = "data-hq-auth-dialog-card";
+		const DIALOG_IFRAME_ATTR = "data-hq-auth-dialog-iframe";
+		const DIALOG_CLOSE_ATTR = "data-hq-auth-dialog-close";
+		/**
+		* Iframe height. Tuned to the auth.eda.cn login form's actual painted height
+		* (≈390px at 768px width, measured with a magenta iframe element background
+		* so the embedded doc's transparent 20px top/bottom strips are obvious). The
+		* shared constant lives in `./common.jsx` so the dialog and the toolview
+		* card stay in lock-step.
+		*/
+		const IFRAME_HEIGHT = 440;
+		const CARD_MAX_WIDTH = 768;
+		let container = null;
+		let unsubscribe$1 = null;
+		let onCloseRequested = null;
+		/**
+		* Open the login dialog. Idempotent: a second call while open is a no-op
+		* (mirrors the client-side `if (iframe) return` guard). `onClose` fires
+		* whenever the dialog closes for ANY reason (backdrop click, Escape, close
+		* button, postMessage, programmatic close) — the auth client uses it to
+		* unblock its own `isOpen` state.
+		*/
+		function openLoginDialog(options = {}, onClose) {
+			if (container) return;
+			syncUiEnv();
+			const locale = options.lang ?? getCurrentLocale();
+			const root = document.createElement("div");
+			root.setAttribute(DIALOG_OVERLAY_ATTR, "");
+			root.style.cssText = [
+				"position:fixed",
+				"inset:0",
+				"width:100vw",
+				"height:100vh",
+				"border:0",
+				"z-index:2147483647",
+				"background:rgba(0, 0, 0, 0.55)",
+				"display:flex",
+				"align-items:center",
+				"justify-content:center",
+				"box-sizing:border-box"
+			].join(";");
+			const card = document.createElement("div");
+			card.setAttribute(DIALOG_CARD_ATTR, "");
+			const applyCardColors = () => {
+				const surface = getCurrentSurfaceColor();
+				card.style.cssText = [
+					`width:min(100vw, ${CARD_MAX_WIDTH}px)`,
+					`height:min(90vh, ${IFRAME_HEIGHT}px)`,
+					"border-radius:12px",
+					"box-shadow:0 24px 48px rgba(0, 0, 0, 0.32)",
+					"position:relative",
+					"box-sizing:border-box",
+					`background:${surface}`,
+					"display:flex",
+					"flex-direction:column"
+				].join(";");
+			};
+			applyCardColors();
+			const closeButton = document.createElement("button");
+			closeButton.setAttribute(DIALOG_CLOSE_ATTR, "");
+			closeButton.type = "button";
+			closeButton.setAttribute("aria-label", translate(locale, "dialog.close"));
+			closeButton.title = translate(locale, "dialog.close");
+			closeButton.textContent = "×";
+			closeButton.style.cssText = [
+				"position:absolute",
+				"top:6px",
+				"right:10px",
+				"width:28px",
+				"height:28px",
+				"border:0",
+				"background:transparent",
+				"color:var(--dsw-alias-label-secondary, #5b6472)",
+				"font-size:22px",
+				"line-height:1",
+				"cursor:pointer",
+				"border-radius:6px",
+				"padding:0"
+			].join(";");
+			closeButton.addEventListener("click", closeLoginDialog);
+			const iframe = document.createElement("iframe");
+			iframe.setAttribute(DIALOG_IFRAME_ATTR, "");
+			iframe.src = buildLoginUrl({
+				lang: options.lang,
+				theme: options.theme
+			});
+			iframe.title = translate(locale, "card.title");
+			iframe.allow = "clipboard-write";
+			iframe.style.cssText = [
+				"width:100%",
+				`height:${IFRAME_HEIGHT}px`,
+				"border:0",
+				"border-radius:8px",
+				`background:${getCurrentSurfaceColor()}`,
+				"display:block",
+				"flex:0 0 auto"
+			].join(";");
+			card.appendChild(closeButton);
+			card.appendChild(iframe);
+			root.appendChild(card);
+			document.body.appendChild(root);
+			root.addEventListener("mousedown", backdropMouseDown);
+			card.addEventListener("mousedown", stopPropagation);
+			document.addEventListener("keydown", onKeyDown);
+			unsubscribe$1 = subscribeUiEnv(() => {
+				if (!container) return;
+				applyCardColors();
+				iframe.style.background = getCurrentSurfaceColor();
+				closeButton.title = translate(getCurrentLocale(), "dialog.close");
+				closeButton.setAttribute("aria-label", closeButton.title);
+			});
+			container = root;
+			onCloseRequested = onClose ?? null;
+		}
+		/** Programmatic close (used by the auth client after a successful login). */
+		function closeLoginDialog() {
+			if (!container) return;
+			container.remove();
+			container = null;
+			document.removeEventListener("keydown", onKeyDown);
+			unsubscribe$1?.();
+			unsubscribe$1 = null;
+			const cb = onCloseRequested;
+			onCloseRequested = null;
+			cb?.();
+		}
+		/** True while the dialog is mounted. */
+		function isLoginDialogOpen() {
+			return container !== null;
+		}
+		function backdropMouseDown(event) {
+			if (event.target === container) closeLoginDialog();
+		}
+		function stopPropagation(event) {
+			event.stopPropagation();
+		}
+		function onKeyDown(event) {
+			if (event.key === "Escape") {
+				event.stopPropagation();
+				closeLoginDialog();
+			}
+		}
+		//#endregion
+		//#region src/client/client.ts
+		/**
+		* Auth client core — the Phase 0A POC logic, factored as a testable factory.
+		* `apply()` in index.ts wires this to the real window/document/localStorage.
+		*/
+		function createAuthClient(deps) {
+			deps.trustedOrigin;
+			deps.loginUrl;
+			const { storage, transport } = deps;
+			const listeners = /* @__PURE__ */ new Set();
+			const emit = (info) => {
+				for (const listener of listeners) listener(info);
+			};
+			const closeIframe = () => {
+				if (isLoginDialogOpen()) closeLoginDialog();
+			};
+			/**
+			* Open the login dialog (backdrop + centered card + auth.eda.cn iframe).
+			*
+			* The dialog is ALWAYS transparent (no `transparent` option exists): the
+			* embedded doc sets its own root to `background: transparent` (we never
+			* send `fill=full`), and the iframe sits inside a host-painted card so
+			* Blink's white base canvas never reaches the user. See the long header
+			* in `ui/login-dialog.ts` for the full why.
+			*/
+			const openIframe = (options = {}) => {
+				if (isLoginDialogOpen()) return;
+				openLoginDialog({
+					...options.lang ? { lang: options.lang } : {},
+					...options.theme ? { theme: options.theme } : {}
+				}, () => {});
+			};
+			const auth = {
+				isAuthenticated: () => storage.get() !== null,
+				getAccessToken: async () => storage.get()?.token ?? null,
+				getUserInfo: async () => storage.get(),
+				login: async (options) => openIframe(options ?? {}),
+				logout: async () => {
+					storage.clear();
+					try {
+						await transport.pushLogout();
+					} catch {}
+					emit(null);
+					closeIframe();
+				},
+				onAuthStateChanged: (listener) => {
+					listeners.add(listener);
+					return () => listeners.delete(listener);
+				}
+			};
+			const handleMessageEvent = (event) => {
+				const msg = handleAuthMessage(event);
+				if (!msg) return;
+				if (msg.kind === "token") {
+					storage.set(msg.info);
+					transport.pushSession(msg.info).catch(() => {});
+					emit(msg.info);
+					closeIframe();
+				} else if (msg.kind === "logout") {
+					storage.clear();
+					emit(null);
+					transport.pushLogout().catch(() => {});
+					closeIframe();
+				} else if (msg.kind === "close") closeIframe();
+			};
+			const onWindowMessage = (event) => {
+				handleMessageEvent({
+					origin: event.origin,
+					data: event.data
+				});
+			};
+			deps.windowLike.addEventListener("message", onWindowMessage);
+			const restore = async () => {
+				const restored = storage.get();
+				if (restored) try {
+					await transport.pushSession(restored);
+				} catch {}
+			};
+			return {
+				auth,
+				handleMessageEvent,
+				restore,
+				/**
+				* Re-push the persisted credential to the node half. Healing path: the
+				* node keeps auth in memory, so a `dsh web` restart (or a failed first
+				* push) drops it while the browser still has the token. Callers re-sync on
+				* focus / visibilitychange / login-card mount so the tool gate reflects
+				* the actual browser login without requiring a page reload.
+				*/
+				async syncNow() {
+					const info = storage.get();
+					if (!info) return;
+					try {
+						await transport.pushSession(info);
+					} catch {}
+				},
+				dispose() {
+					deps.windowLike.removeEventListener("message", onWindowMessage);
+					closeIframe();
+				}
+			};
+		}
+		//#endregion
+		//#region src/client/auth-state.ts
+		/** Snapshot for one credential payload (`null` = logged out). */
+		function stateOf(info) {
+			if (!info) return { authenticated: false };
+			return {
+				authenticated: true,
+				...info.nickname ? { nickname: info.nickname } : {},
+				...info.avatar ? { avatar: info.avatar } : {},
+				...info.token ? { token: info.token } : {},
+				...info.phone ? { phone: info.phone } : {}
+			};
+		}
+		let auth = null;
+		let state = { authenticated: false };
+		const listeners = /* @__PURE__ */ new Set();
+		let unsubscribe = null;
+		let syncNow = null;
+		function setState(next) {
+			state = next;
+			for (const l of listeners) l();
+		}
+		/** Attach the singleton auth capability and push the initial snapshot. */
+		function registerAuth(a) {
+			auth = a;
+			unsubscribe = a.onAuthStateChanged((info) => {
+				setState(stateOf(info));
+			});
+			a.getUserInfo().then((info) => setState(stateOf(info))).catch(() => setState({ authenticated: false }));
+		}
+		/** The live auth capability (for login()/logout() from components). */
+		function getAuth() {
+			return auth;
+		}
+		/** Current snapshot, for `useSyncExternalStore`'s getSnapshot. */
+		function getAuthState() {
+			return state;
+		}
+		/** Subscribe, for `useSyncExternalStore`'s subscribe. */
+		function subscribeAuth(callback) {
+			listeners.add(callback);
+			return () => listeners.delete(callback);
+		}
+		/** Register the node re-sync hook (wired in apply(); called by the login card on mount). */
+		function registerAuthSync(fn) {
+			syncNow = fn;
+		}
+		/** Re-push the persisted credential to the node half, if one is available. */
+		function syncAuthNow() {
+			syncNow?.();
+		}
+		function disposeAuth() {
+			unsubscribe?.();
+			unsubscribe = null;
+			auth = null;
+			syncNow = null;
+			listeners.clear();
+			state = { authenticated: false };
+		}
+		//#endregion
+		//#region src/client/ui/needs-auth-toolview.tsx
+		/**
+		* Keyed `tool.call.toolview` renderer for the Huaqiu EDA tools.
+		*
+		* When a Huaqiu tool returns `status: "needs_auth"`, this card renders the
+		* login human-in-the-loop step: an embedded auth.eda.cn login iframe plus a
+		* live login-state line. The singleton auth client's `message` listener
+		* already receives the postMessage from this same-origin iframe, caches the
+		* credential and pushes it to the node service, so after the user logs in the
+		* card flips to「已登录」and the model can retry the tool.
+		*
+		* The embed is the second of the two FULL login surfaces (the other is the
+		* sidebar overlay): it uses the same `buildLoginUrl()` contract — always
+		* transparent — and passes the host's language and color scheme.
+		*
+		* For any other result it renders a faithful JSON fallback (the generic row
+		* that this keyed entry replaces), so nothing is lost for successful calls.
+		*/
+		const DESC_STYLE = {
+			fontSize: 13,
+			margin: "0 0 10px",
+			lineHeight: 1.5
+		};
+		function JsonFallback({ toolName, block }) {
+			const result = (0, react.useMemo)(() => parseToolResult(block), [block]);
+			const dark = useIsDark();
+			const t = useT();
+			const palette = cardPalette(dark);
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+				style: cardStyle(palette),
+				children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+					style: TITLE_STYLE,
+					children: t("card.tool", { tool: toolName })
+				}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("pre", {
+					style: {
+						margin: 0,
+						fontSize: 12,
+						whiteSpace: "pre-wrap",
+						wordBreak: "break-word",
+						maxHeight: 320,
+						overflow: "auto"
+					},
+					children: result ? JSON.stringify(result, null, 2) : t("card.empty")
+				})]
+			});
+		}
+		function LoginCard({ toolName }) {
+			const authState = (0, react.useSyncExternalStore)(subscribeAuth, getAuthState);
+			const iframeRef = (0, react.useRef)(null);
+			const dark = useIsDark();
+			const locale = useLocale();
+			const t = useT();
+			const palette = cardPalette(dark);
+			(0, react.useEffect)(() => {
+				syncAuthNow();
+			}, [toolName]);
+			const src = (0, react.useMemo)(() => buildLoginUrl({
+				fill: "full",
+				lang: locale,
+				theme: dark ? "dark" : "light"
+			}), [locale, dark]);
+			const remountKey = `${locale}|${dark ? "d" : "l"}`;
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+				style: cardStyle(palette),
+				children: [
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+						style: TITLE_STYLE,
+						children: t("card.title")
+					}),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+						style: {
+							...DESC_STYLE,
+							color: palette.muted
+						},
+						children: t("card.desc", { tool: toolName })
+					}),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)(StatusLine, {
+						authenticated: authState.authenticated,
+						nickname: authState.nickname,
+						palette,
+						t
+					}),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("iframe", {
+						ref: iframeRef,
+						src,
+						title: t("card.title"),
+						style: iframeStyle(palette),
+						allow: "clipboard-write"
+					}, remountKey)
+				]
+			});
+		}
+		const HuaqiuToolView = (0, react.memo)(function HuaqiuToolView(props) {
+			const { toolName, block } = props;
+			if (isNeedsAuthResult((0, react.useMemo)(() => parseToolResult(block), [block]))) return /* @__PURE__ */ (0, react_jsx_runtime.jsx)(LoginCard, { toolName });
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsx)(JsonFallback, {
+				toolName,
+				block
+			});
+		});
+		//#endregion
+		//#region src/client/ui/hq-icon.tsx
+		function HQ_ICON({ size = 24, color = "#1a81c4", title }) {
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("svg", {
+				xmlns: "http://www.w3.org/2000/svg",
+				viewBox: "0 0 40 40",
+				width: size,
+				height: size,
+				role: title ? "img" : void 0,
+				"aria-hidden": title ? void 0 : true,
+				focusable: "false",
+				style: {
+					display: "block",
+					flex: "0 0 auto"
+				},
+				children: [
+					title ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("title", { children: title }) : null,
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("path", {
+						fill: color,
+						fillRule: "evenodd",
+						d: "M29.71,30a2.75,2.75,0,1,0,2.75,2.74A2.74,2.74,0,0,0,29.71,30Z"
+					}),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("path", {
+						fill: color,
+						fillRule: "evenodd",
+						d: "M26.59,10.49H13.41a5.93,5.93,0,0,0-5.91,5.9V29.58a5.93,5.93,0,0,0,5.91,5.91H26.85a4,4,0,0,1-1.13-2.78,4.43,4.43,0,0,1,.1-.9H13.41a2.23,2.23,0,0,1-2.22-2.22V16.39a2.23,2.23,0,0,1,2.22-2.21H26.59a2.23,2.23,0,0,1,2.22,2.21V28.81a4.43,4.43,0,0,1,.9-.1,4,4,0,0,1,2.78,1.13,2.26,2.26,0,0,0,0-.26V16.39A5.93,5.93,0,0,0,26.59,10.49Z"
+					}),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("path", {
+						fill: color,
+						fillRule: "evenodd",
+						d: "M26.38,27.52V18.46a1.85,1.85,0,0,0-1.85-1.85h0a1.84,1.84,0,0,0-1.84,1.85v2.68H17.31V18.46a1.84,1.84,0,0,0-1.84-1.85h0a1.85,1.85,0,0,0-1.85,1.85v9.06a1.85,1.85,0,0,0,1.85,1.85h0a1.84,1.84,0,0,0,1.84-1.85V24.83h5.38v2.69a1.84,1.84,0,0,0,1.84,1.85h0A1.85,1.85,0,0,0,26.38,27.52Z"
+					}),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("circle", {
+						fill: color,
+						cx: "20",
+						cy: "5.04",
+						r: "2.86"
+					}),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("rect", {
+						fill: color,
+						x: "19",
+						y: "5.04",
+						width: "2",
+						height: "6.7"
+					}),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("path", {
+						fill: color,
+						d: "M6.37,17.71a4.89,4.89,0,0,0,0,9.78Z"
+					}),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("path", {
+						fill: color,
+						d: "M33.63,17.71a4.89,4.89,0,1,1,0,9.78Z"
+					})
+				]
+			});
+		}
+		//#endregion
+		//#region src/client/ui/sidebar-action.tsx
+		/**
+		* `sidebar.footer.action` entry: the Huaqiu EDA account trigger at the bottom
+		* of the DSH sidebar (beside Settings).
+		*
+		* - Not logged in: shows the HQ icon and opens the login dialog through
+		*   `auth.login({ lang, theme })` — a real modal (backdrop + centered card +
+		*   auth.eda.cn iframe) that is ALWAYS TRANSPARENT in the embed itself
+		*   (`fill=full` is never sent, see `lib.ts#buildLoginUrl`), and the card
+		*   surface masks Blink's white base canvas so the login card floats over
+		*   the dimmed app in both light and dark themes. `lang`/`theme` follow the
+		*   host UI. Click on the backdrop, the × button, or Escape closes it, and
+		*   auth.eda.cn's own `close_dialog` postMessage closes it as well.
+		* - Logged in: the trigger becomes the user's AVATAR (`headimage` from the
+		*   auth.eda.cn payload, HQ icon while it is missing/fails to load) and a click
+		*   opens a context menu with「Go to profile」(the eda.cn account page, with
+		*   the access token) and「Log out」— the same shape as `hq-eda-ai`'s
+		*   `UserMenu`, portalled to `document.body` with fixed positioning so the
+		*   sidebar's `overflow: hidden` can never clip it.
+		*
+		* THEMING: colors prefer DSH's `--dsw-alias-*` tokens (so a custom host theme
+		* is honored) and fall back to an explicit light/dark pair chosen from
+		* `useIsDark()`; the two paths cannot disagree, because ui-layout's presenter
+		* writes `body[data-ds-dark-theme]` from the very snapshot that installs those
+		* tokens.
+		*/
+		const AVATAR_SIZE = 26;
+		const ICON_SIZE = 22;
+		const LIGHT_PALETTE = {
+			surface: "var(--dsw-alias-bg-overlay, #ffffff)",
+			border: "var(--dsw-alias-border-l1, #e4e7ec)",
+			text: "var(--dsw-alias-label-primary, #3a4356)",
+			muted: "var(--dsw-alias-label-secondary, #8a94a6)",
+			hover: "var(--dsw-alias-interactive-bg-hover, #f5f7fa)",
+			danger: "var(--dsw-alias-state-error-primary, #d4380d)",
+			dangerHover: "rgba(216, 56, 13, 0.08)",
+			avatarBg: "var(--dsw-alias-bg-layer-2, #eef2f7)",
+			shadow: "0 12px 32px rgba(15, 23, 42, 0.16)"
+		};
+		const DARK_PALETTE = {
+			surface: "var(--dsw-alias-bg-overlay, #20242c)",
+			border: "var(--dsw-alias-border-l1, rgba(255, 255, 255, 0.14))",
+			text: "var(--dsw-alias-label-primary, #e6eaf0)",
+			muted: "var(--dsw-alias-label-secondary, #8b95a5)",
+			hover: "var(--dsw-alias-interactive-bg-hover, rgba(255, 255, 255, 0.08))",
+			danger: "var(--dsw-alias-state-error-primary, #ff7875)",
+			dangerHover: "rgba(255, 120, 117, 0.14)",
+			avatarBg: "var(--dsw-alias-bg-layer-2, rgba(255, 255, 255, 0.10))",
+			shadow: "0 12px 32px rgba(0, 0, 0, 0.46)"
+		};
+		const TRIGGER_BASE = {
+			width: "100%",
+			display: "flex",
+			alignItems: "center",
+			gap: 8,
+			padding: "8px 12px",
+			border: "none",
+			borderRadius: 8,
+			background: "transparent",
+			fontSize: 13,
+			fontWeight: 500,
+			cursor: "pointer",
+			textAlign: "left",
+			whiteSpace: "nowrap",
+			overflow: "hidden"
+		};
+		const MENU_BASE = {
+			position: "fixed",
+			zIndex: 2147483e3,
+			minWidth: 184,
+			padding: 6,
+			borderWidth: 1,
+			borderStyle: "solid",
+			borderRadius: 12,
+			fontFamily: "inherit",
+			fontSize: 13
+		};
+		const MENU_HEADER_BASE = {
+			padding: "6px 10px 8px",
+			fontSize: 12,
+			overflow: "hidden",
+			textOverflow: "ellipsis",
+			whiteSpace: "nowrap"
+		};
+		const MENU_ITEM_BASE = {
+			display: "flex",
+			alignItems: "center",
+			gap: 8,
+			width: "100%",
+			padding: "8px 10px",
+			border: "none",
+			borderRadius: 8,
+			background: "transparent",
+			font: "inherit",
+			fontSize: 13,
+			textAlign: "left",
+			cursor: "pointer"
+		};
+		/**
+		* One menu row. Hover is tracked in state: the client bundle ships no CSS
+		* file, so inline styles cannot express `:hover`.
+		*/
+		function MenuItem({ label, icon, danger, palette, onSelect }) {
+			const [hovered, setHovered] = (0, react.useState)(false);
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("button", {
+				type: "button",
+				role: "menuitem",
+				style: {
+					...MENU_ITEM_BASE,
+					color: danger ? palette.danger : palette.text,
+					background: hovered ? danger ? palette.dangerHover : palette.hover : "transparent"
+				},
+				onMouseEnter: () => setHovered(true),
+				onMouseLeave: () => setHovered(false),
+				onClick: onSelect,
+				children: [icon, /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { children: label })]
+			});
+		}
+		function UserIcon() {
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("svg", {
+				xmlns: "http://www.w3.org/2000/svg",
+				width: 15,
+				height: 15,
+				viewBox: "0 0 24 24",
+				fill: "none",
+				stroke: "currentColor",
+				strokeWidth: 2,
+				strokeLinecap: "round",
+				strokeLinejoin: "round",
+				"aria-hidden": true,
+				style: { flex: "0 0 auto" },
+				children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("path", { d: "M19 21v-2a4 4 0 0 0-4-4H9a4 4 0 0 0-4 4v2" }), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("circle", {
+					cx: "12",
+					cy: "7",
+					r: "4"
+				})]
+			});
+		}
+		function LogoutIcon() {
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("svg", {
+				xmlns: "http://www.w3.org/2000/svg",
+				width: 15,
+				height: 15,
+				viewBox: "0 0 24 24",
+				fill: "none",
+				stroke: "currentColor",
+				strokeWidth: 2,
+				strokeLinecap: "round",
+				strokeLinejoin: "round",
+				"aria-hidden": true,
+				style: { flex: "0 0 auto" },
+				children: [
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("path", { d: "M9 21H5a2 2 0 0 1-2-2V5a2 2 0 0 1 2-2h4" }),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("polyline", { points: "16 17 21 12 16 7" }),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("line", {
+						x1: "21",
+						x2: "9",
+						y1: "12",
+						y2: "12"
+					})
+				]
+			});
+		}
+		const HuaqiuAuthSidebarAction = (0, react.memo)(function HuaqiuAuthSidebarAction({ wide }) {
+			const authState = (0, react.useSyncExternalStore)(subscribeAuth, getAuthState);
+			const auth = getAuth();
+			const dark = useIsDark();
+			const locale = useLocale();
+			const t = useT();
+			const [menuOpen, setMenuOpen] = (0, react.useState)(false);
+			const [menuStyle, setMenuStyle] = (0, react.useState)(null);
+			const [avatarBroken, setAvatarBroken] = (0, react.useState)(false);
+			const [hovered, setHovered] = (0, react.useState)(false);
+			const triggerRef = (0, react.useRef)(null);
+			const menuRef = (0, react.useRef)(null);
+			const palette = dark ? DARK_PALETTE : LIGHT_PALETTE;
+			const authenticated = authState.authenticated;
+			const avatar = authenticated && !avatarBroken ? authState.avatar : void 0;
+			const showLabel = wide !== false;
+			(0, react.useEffect)(() => {
+				setAvatarBroken(false);
+			}, [authState.avatar]);
+			(0, react.useEffect)(() => {
+				if (!authenticated) setMenuOpen(false);
+			}, [authenticated]);
+			(0, react.useLayoutEffect)(() => {
+				if (!menuOpen || !triggerRef.current) return;
+				const rect = triggerRef.current.getBoundingClientRect();
+				setMenuStyle({
+					...MENU_BASE,
+					background: palette.surface,
+					borderColor: palette.border,
+					color: palette.text,
+					boxShadow: palette.shadow,
+					left: Math.max(8, Math.round(rect.left)),
+					bottom: Math.max(8, Math.round(window.innerHeight - rect.top + 8)),
+					...wide ? { width: Math.round(rect.width) } : {}
+				});
+			}, [
+				menuOpen,
+				wide,
+				avatar,
+				palette
+			]);
+			(0, react.useEffect)(() => {
+				if (!menuOpen) return;
+				const onPointerDown = (event) => {
+					const target = event.target;
+					if (triggerRef.current?.contains(target)) return;
+					if (menuRef.current?.contains(target)) return;
+					setMenuOpen(false);
+				};
+				const onKeyDown = (event) => {
+					if (event.key === "Escape") setMenuOpen(false);
+				};
+				const dismiss = () => setMenuOpen(false);
+				document.addEventListener("mousedown", onPointerDown);
+				document.addEventListener("keydown", onKeyDown);
+				window.addEventListener("resize", dismiss);
+				window.addEventListener("scroll", dismiss, true);
+				return () => {
+					document.removeEventListener("mousedown", onPointerDown);
+					document.removeEventListener("keydown", onKeyDown);
+					window.removeEventListener("resize", dismiss);
+					window.removeEventListener("scroll", dismiss, true);
+				};
+			}, [menuOpen]);
+			if (!auth) return null;
+			/**
+			*「Go to profile」always carries the token, so eda.cn can establish the
+			* session in the opened tab (it hides the token itself — see
+			* `lib.ts#buildProfileUrl`). The snapshot normally has it; fall back to the
+			* client so a stale snapshot can never open an unauthenticated tab.
+			*/
+			const openProfile = () => {
+				setMenuOpen(false);
+				(async () => {
+					const info = authState.token ? {
+						token: authState.token,
+						phone: authState.phone
+					} : await auth.getUserInfo().then((i) => i ? {
+						token: i.token,
+						phone: i.phone
+					} : null).catch(() => null);
+					if (!info?.token) return;
+					window.open(buildProfileUrl(info), "_blank", "noopener,noreferrer");
+				})();
+			};
+			const label = authenticated ? authState.nickname ?? t("sidebar.account") : t("sidebar.login");
+			const title = authenticated ? t("sidebar.accountTitle") : t("sidebar.loginTitle");
+			const triggerBackground = menuOpen || hovered ? palette.hover : "transparent";
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+				style: {
+					position: "relative",
+					width: "100%"
+				},
+				children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("button", {
+					ref: triggerRef,
+					type: "button",
+					"aria-haspopup": "menu",
+					"aria-expanded": menuOpen,
+					onClick: () => {
+						if (!authenticated) {
+							auth.login({
+								lang: locale,
+								theme: dark ? "dark" : "light"
+							});
+							return;
+						}
+						setMenuOpen((open) => !open);
+					},
+					onMouseEnter: () => setHovered(true),
+					onMouseLeave: () => setHovered(false),
+					style: {
+						...TRIGGER_BASE,
+						color: palette.text,
+						padding: wide ? "8px 12px" : "8px 6px",
+						background: triggerBackground
+					},
+					title,
+					children: [avatar ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+						style: {
+							flex: "0 0 auto",
+							width: AVATAR_SIZE,
+							height: AVATAR_SIZE,
+							borderRadius: "50%",
+							overflow: "hidden",
+							background: palette.avatarBg,
+							display: "block"
+						},
+						children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)("img", {
+							src: avatar,
+							alt: "",
+							width: AVATAR_SIZE,
+							height: AVATAR_SIZE,
+							onError: () => setAvatarBroken(true),
+							style: {
+								width: "100%",
+								height: "100%",
+								objectFit: "cover",
+								display: "block"
+							}
+						})
+					}) : /* @__PURE__ */ (0, react_jsx_runtime.jsx)(HQ_ICON, { size: ICON_SIZE }), showLabel ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+						style: {
+							overflow: "hidden",
+							textOverflow: "ellipsis"
+						},
+						children: label
+					}) : null]
+				}), menuOpen && menuStyle ? (0, react_dom.createPortal)(/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+					ref: menuRef,
+					role: "menu",
+					style: menuStyle,
+					children: [
+						authState.nickname ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+							style: {
+								...MENU_HEADER_BASE,
+								color: palette.muted
+							},
+							title: authState.nickname,
+							children: authState.nickname
+						}) : null,
+						/* @__PURE__ */ (0, react_jsx_runtime.jsx)(MenuItem, {
+							label: t("menu.profile"),
+							icon: /* @__PURE__ */ (0, react_jsx_runtime.jsx)(UserIcon, {}),
+							palette,
+							onSelect: openProfile
+						}),
+						/* @__PURE__ */ (0, react_jsx_runtime.jsx)(MenuItem, {
+							label: t("menu.logout"),
+							icon: /* @__PURE__ */ (0, react_jsx_runtime.jsx)(LogoutIcon, {}),
+							danger: true,
+							palette,
+							onSelect: () => {
+								setMenuOpen(false);
+								auth.logout();
+							}
+						})
+					]
+				}), document.body) : null]
+			});
+		});
+		//#endregion
+		//#region src/client/index.tsx
+		/**
+		* `@huaqiu/dsh-auth` — browser half (the Phase 0A POC).
+		*
+		* Opens the auth.eda.cn login page in an overlay iframe, STRICTLY validates
+		* the postMessage origin, caches credentials in localStorage (reload restore),
+		* and pushes them to the node half over the plugin-owned webServer routes.
+		* Provides the client-side `huaqiuAuth` service mirroring the node surface.
+		*
+		* On top of the credential flow it wires the two UI surfaces the login UX
+		* needs:
+		*   - `sidebar.footer.action` — a persistent 华秋EDA login entrypoint at the
+		*     bottom of the sidebar (login/logout, live state).
+		*   - `tool.call.toolview` (keyed per Huaqiu tool) — when a node tool returns
+		*     `status: "needs_auth"` the tool card becomes the login HIT: an embedded
+		*     auth.eda.cn iframe + login-state line, so login is a step of the
+		*     conversation instead of a dead error the agent has to relay.
+		*/
+		/**
+		* Client cordis inject: REAL service names only (the loader maps these to
+		* `ctx.inject([...])` dependencies). The `slots` registry service comes from
+		* `@deepseek-ai/dsh-client-ui-slots`; it is required to register the toolview
+		* and sidebar entries. The PACKAGE-level `dsh.client.inject` in package.json
+		* (graph ordering) stays as-is and is NOT this export.
+		*/
+		const inject = ["slots"];
+		/**
+		* Huaqiu tools that still surface the auth login card via this plugin.
+		*
+		* Currently EMPTY: all five Huaqiu tools now own their keyed HIT cards in
+		* their own plugins (`@huaqiu/dsh-tool-symbol-footprint` for the three
+		* symbol/footprint generators, `@huaqiu/dsh-tool-schematic-gen` for the two
+		* schematic/system generators), and each renders its own inline login card for
+		* `needs_auth`. Keeping the toolview keys here would double-register the same
+		* `tool.call.toolview` slot with an ambiguous winner.
+		*
+		* The auth plugin remains the credential owner: the `huaqiuAuth` client
+		* service, the sidebar login entrypoint and the webServer credential channel.
+		*/
+		const AUTH_TOOL_NAMES = [];
+		function apply(ctx) {
+			const client = createAuthClient({
+				storage: createAuthStorage(localStorage),
+				transport: createWebServerAuthTransport(),
+				windowLike: window,
+				documentLike: document
+			});
+			const disposers = [];
+			const disposeProvide = ctx.provide?.("huaqiuAuth", { auth: client.auth });
+			registerAuth(client.auth);
+			registerAuthSync(() => {
+				client.syncNow();
+			});
+			client.restore();
+			disposers.push(client.auth.onAuthStateChanged((info) => {
+				client.syncNow();
+			}));
+			const sync = () => {
+				client.syncNow();
+			};
+			window.addEventListener("focus", sync);
+			document.addEventListener("visibilitychange", sync);
+			disposers.push(() => {
+				window.removeEventListener("focus", sync);
+				document.removeEventListener("visibilitychange", sync);
+			});
+			const slots = ctx.slots;
+			if (slots && typeof slots.inject === "function" && typeof slots.register === "function") {
+				for (const toolName of AUTH_TOOL_NAMES) disposers.push(slots.inject("tool.call.toolview", () => slots.register({
+					name: "tool.call.toolview",
+					key: toolName
+				}, HuaqiuToolView)));
+				disposers.push(slots.inject("sidebar.footer.action", () => slots.register({
+					name: "sidebar.footer.action",
+					id: "huaqiu-auth"
+				}, HuaqiuAuthSidebarAction)));
+			}
+			return () => {
+				for (const dispose of disposers) try {
+					dispose();
+				} catch {}
+				disposeProvide?.();
+				client.dispose();
+				disposeAuth();
+				disposeUiEnv();
+			};
+		}
+		//#endregion
+		exports.AUTH_TOOL_NAMES = AUTH_TOOL_NAMES;
+		exports.apply = apply;
+		exports.inject = inject;
+		return module.exports;
+	}
+});
+
+//# sourceMappingURL=client.js.map