@jeffusion/bungee-core 5.15.0 → 5.15.2

package/dist/plugins/key-access/ui/KeyPolicy.svelte

@@ -2,7 +2,6 @@
   import { onMount } from 'svelte';
   import { isLoading, _, locale } from 'svelte-i18n';
   import { getPluginText } from '$utils/plugin-i18n';
-  import * as Tooltip from '$components/ui/tooltip';
   import { requestPluginControl, ApiError } from '$api/client';
   import { getConfigSnapshot } from '$api/config';
   import { PluginsAPI } from '$api/plugins';
@@ -14,11 +13,12 @@
   let tab = $state('keys'), keys = $state<ApiKey[]>([]), routes = $state<{id:string;path:string}[]>([]), protectedIds = $state<string[]>([]);
   let loading = $state(true), busy = $state(false), error = $state<Message | null>(null), status = $state<Message | null>(null), ready = $state(false), inactive = $state(false);
   let createOpen = $state(false), policyOpen = $state(false), secretOpen = $state(false), deleteOpen = $state(false);
-  let target = $state<ApiKey | null>(null), name = $state(''), expires = $state(''), allRoutes = $state(false), allowed = $state<string[]>([]), models = $state(''), review = $state(false);
+  let target = $state<ApiKey | null>(null), name = $state(''), expires = $state(''), allRoutes = $state(false), allowed = $state<string[]>([]), models = $state('');
   let secret = $state(''), copied = $state(false), secretStatus = $state<Message | null>(null), policyLoading = $state(false), policyReady = $state(false);
   let routeConfigOpen = $state(false), selectedRoute = $state<{id:string;path:string}|null>(null);
-  let pendingRouteKey = $state<ApiKey|null>(null);
   let routeKeyBindings = $state<Record<string,{id:string;name:string}[]>>({});
+  let unrestrictedKeyIds = $state<string[]>([]);
+  const isKeyApplied = (routeId:string, keyId:string) => unrestrictedKeyIds.includes(keyId) || !!routeKeyBindings[routeId]?.some(key => key.id === keyId);
   type Message = { key: string; values?: Record<string, string | number | string[] | Message>; append?: Message };
   const message = (key: string, values?: Message['values']): Message => ({ key, values });
   const t = (key: string, values?: Record<string, string | number>) => $isLoading ? '' : getPluginText(key, pluginName, (id, options) => $_(id, { ...options, values }));
@@ -32,11 +32,9 @@
     constructor(content: Message) { super(content.key); this.content = content; }
   }
   const keyStatusText = (key: ApiKey) => t(keyStatus(key) === '有效' ? 'ui.keyActive' : keyStatus(key) === '已过期' ? 'ui.keyExpired' : 'ui.keyRevoked');
-  function publicBlockedReason(id:string) { const bindings = routeKeyBindings[id] ?? []; return protectedIds.includes(id) && bindings.length ? message('ui.publicBlockedReason', { keys: bindings.map(key => key.name) }) : null; }
   function errorMessage(e: unknown): Message {
     if (e instanceof LocalizedError) return e.content;
     if (e instanceof ApiError && (e.body as any)?.error === 'key_name_exists') return message('ui.keyNameExists');
-    if (e instanceof ApiError && (e.body as any)?.error === 'route_has_api_keys') return message('ui.routeHasKeys');
     if (e instanceof ApiError && (e.body as any)?.persisted) return message('ui.persistedPending');
     if (e instanceof ApiError) {
       const code = (e.body as any)?.error;
@@ -51,7 +49,6 @@
     return message('ui.operationFailed');
   }
   const guard = latestRequest();
-  let selectedPublic = $derived(routes.filter(route => (allRoutes || allowed.includes(route.id)) && !protectedIds.includes(route.id)));
   const control = <T,>(path:string,method:'GET'|'PUT',body?:unknown) => requestPluginControl<T>(pluginName,path,method,body);
   function failure(e:unknown) { if (e instanceof ApiError && (e.body as any)?.ready === false) ready = false; error = errorMessage(e); }
   async function refresh() {
@@ -61,15 +58,15 @@
       keys = credentials.keys; routes = config.config.logical_configuration.routes.map(route => ({id:route.id,path:route.path}));
       inactive = !plugins.find(plugin => plugin.name === pluginName)?.enabled;
       if (inactive) { ready = false; status = message('ui.inactive'); return; }
-      const protection = await control<{protectedRouteIds:string[];routeKeyBindings:Record<string,{id:string;name:string}[]>;ready?:boolean}>('/routes','GET');
-      protectedIds = protection.protectedRouteIds; routeKeyBindings = protection.routeKeyBindings; ready = protection.ready !== false;
+      const protection = await control<{protectedRouteIds:string[];routeKeyBindings:Record<string,{id:string;name:string}[]>;unrestrictedKeyIds?:string[];ready?:boolean}>('/routes','GET');
+      protectedIds = protection.protectedRouteIds; routeKeyBindings = protection.routeKeyBindings; unrestrictedKeyIds = protection.unrestrictedKeyIds ?? []; ready = protection.ready !== false;
       status = ready ? null : message('ui.configurationPending');
     } catch(e) { ready = false; failure(e); } finally { loading = false; }
   }
   onMount(() => { void refresh(); return () => guard.invalidate(); });
-  function newKey(routeId?:string) { if (secretOpen) return; name = ''; expires = ''; allRoutes = false; allowed = routeId ? [routeId] : []; models = ''; review = false; error = null; createOpen = true; }
+  function newKey(routeId?:string) { if (secretOpen) return; name = ''; expires = ''; allRoutes = false; allowed = routeId ? [routeId] : []; models = ''; error = null; createOpen = true; }
   async function edit(key:ApiKey) {
-    target = key; name = key.name; expires = localDate(key.expiresAt); copied = false; policyOpen = true; policyLoading = true; policyReady = false; error = null; review = false;
+    target = key; name = key.name; expires = localDate(key.expiresAt); copied = false; policyOpen = true; policyLoading = true; policyReady = false; error = null;
     const generation = guard.begin();
     try {
       const result = await control<{value:{routes:string[]|null;models:string[]|null}|null}>(`/keys/${encodeURIComponent(key.id)}`,'GET');
@@ -77,18 +74,14 @@
       allRoutes = result.value?.routes == null; allowed = result.value?.routes ?? []; models = result.value?.models?.join('\n') ?? ''; policyReady = true;
     } catch(e) { if (guard.current(generation)) failure(e); } finally { if (guard.current(generation)) policyLoading = false; }
   }
-  async function applyRouteKey(key:ApiKey, confirmed=false) {
+  async function applyRouteKey(key:ApiKey) {
     if (busy || !selectedRoute) return;
-    if (!protectedIds.includes(selectedRoute.id) && !confirmed) { pendingRouteKey = key; return; }
     busy = true; error = null;
     try {
-      const result = await control<{protectedRouteIds:string[];routeKeyBindings:Record<string,{id:string;name:string}[]>;ready?:boolean;published?:boolean}>('/route-key','PUT',{routeId:selectedRoute.id,keyId:key.id,protect:confirmed});
-      protectedIds = result.protectedRouteIds; routeKeyBindings = result.routeKeyBindings; ready = result.ready !== false;
-      status = message(publicationMessage(result)); routeConfigOpen = false; pendingRouteKey = null;
-    } catch(e) {
-      if (e instanceof ApiError && (e.body as any)?.error === 'route_protection_confirmation_required') pendingRouteKey = key;
-      else failure(e);
-    } finally { busy = false; }
+      const result = await control<{protectedRouteIds:string[];routeKeyBindings:Record<string,{id:string;name:string}[]>;unrestrictedKeyIds?:string[];ready?:boolean;published?:boolean}>('/route-key','PUT',{routeId:selectedRoute.id,keyId:key.id});
+      protectedIds = result.protectedRouteIds; routeKeyBindings = result.routeKeyBindings; unrestrictedKeyIds = result.unrestrictedKeyIds ?? []; ready = result.ready !== false;
+      status = message(publicationMessage(result)); routeConfigOpen = false;
+    } catch(e) { failure(e); } finally { busy = false; }
   }
   function toggleRoute(id:string,checked:boolean) { allowed = checked ? [...allowed,id] : allowed.filter(value => value !== id); }
   function localDate(value:number|null) { return value === null ? '' : new Date(value - new Date(value).getTimezoneOffset()*60000).toISOString().slice(0,16); }
@@ -110,22 +103,13 @@
     const result = includeDetails ? await keysApi.update(id,{name,expiresAt:expiration(),...scope}) : await control<{ready?:boolean;published?:boolean}>(`/keys/${encodeURIComponent(id)}`,'PUT',scope);
     if ('key' in result) { const key = result.key as ApiKey; keys = keys.map(item => item.id === id ? key : item); target = key; }
     if (result.ready === false || result.published === false) throw new LocalizedError(message('ui.keyRoutesPending'));
-    if (selectedPublic.length) {
-      try {
-        const result = await control<{protectedRouteIds:string[];ready?:boolean;published?:boolean}>('/routes','PUT',{protectedRouteIds:[...new Set([...protectedIds,...selectedPublic.map(route => route.id)])]});
-        protectedIds = result.protectedRouteIds;
-        if (result.ready === false || result.published === false) throw new LocalizedError(message('ui.protectionPending'));
-      } catch (e) { throw new LocalizedError(message('ui.keySavedProtectionIncomplete', { reason: errorMessage(e) })); }
-    }
-    const protection = await control<{protectedRouteIds:string[];routeKeyBindings:Record<string,{id:string;name:string}[]>}>('/routes','GET');
-    protectedIds = protection.protectedRouteIds; routeKeyBindings = protection.routeKeyBindings;
+    const protection = await control<{protectedRouteIds:string[];routeKeyBindings:Record<string,{id:string;name:string}[]>;unrestrictedKeyIds?:string[]}>('/routes','GET');
+    protectedIds = protection.protectedRouteIds; routeKeyBindings = protection.routeKeyBindings; unrestrictedKeyIds = protection.unrestrictedKeyIds ?? [];
   }
   async function create(event:SubmitEvent) {
     event.preventDefault(); if (busy) return;
     const expiresAt = expires ? new Date(expires).getTime() : null;
     if (expiresAt !== null && (!Number.isFinite(expiresAt) || expiresAt <= Date.now())) { error = message('ui.expirationFuture'); return; }
-    if (selectedPublic.length && !review) { review = true; error = null; return; }
-    const protectionCount = selectedPublic.length;
     busy = true; error = null; status = null; secretStatus = null;
     let stage = 'ui.stageCreate';
     try {
@@ -138,7 +122,7 @@
       if (created.ready === false || created.published === false) { ready = false; secretStatus = message('ui.createdPending'); return; }
       stage = 'ui.stageSavePolicy';
       await savePolicy(created.key.id);
-      secretStatus = message(protectionCount ? 'ui.createdProtected' : 'ui.createdPublic');
+      secretStatus = message('ui.createdPublic');
       status = secretStatus;
     } catch(e) { failure(e); if (secret) secretStatus = message('ui.createdIncomplete', { stage: message(stage), reason: error ?? message('ui.operationFailed') }); }
     finally { busy = false; }
@@ -146,16 +130,14 @@
   async function update(event:SubmitEvent) {
     event.preventDefault(); if (busy || policyLoading || !policyReady || !target) return;
     try { expiration(); } catch(e) { failure(e); return; }
-    if (selectedPublic.length && !review) { review = true; error = null; return; }
     busy = true; error = null; status = null;
     try { await savePolicy(target.id,true); policyOpen = false; status = message('ui.policyPublished'); }
     catch(e) { failure(e); } finally { busy = false; }
   }
   async function protect(id:string,checked:boolean) {
     if (busy) return;
-    if (!checked && publicBlockedReason(id)) { error = publicBlockedReason(id); return; }
     busy = true; error = null; status = null;
-    try { const result = await control<{protectedRouteIds:string[];routeKeyBindings:Record<string,{id:string;name:string}[]>;ready?:boolean;published?:boolean}>('/routes','PUT',{protectedRouteIds:checked ? [...new Set([...protectedIds,id])] : protectedIds.filter(value => value !== id)}); protectedIds = result.protectedRouteIds; routeKeyBindings = result.routeKeyBindings; status = message(publicationMessage(result)); ready = result.ready !== false; }
+    try { const result = await control<{protectedRouteIds:string[];routeKeyBindings:Record<string,{id:string;name:string}[]>;unrestrictedKeyIds?:string[];ready?:boolean;published?:boolean}>('/routes','PUT',{protectedRouteIds:checked ? [...new Set([...protectedIds,id])] : protectedIds.filter(value => value !== id)}); protectedIds = result.protectedRouteIds; routeKeyBindings = result.routeKeyBindings; unrestrictedKeyIds = result.unrestrictedKeyIds ?? []; status = message(publicationMessage(result)); ready = result.ready !== false; }
     catch(e) { await refresh(); failure(e); } finally { busy = false; }
   }
   async function removeKey() {
@@ -178,26 +160,8 @@
   {:else}
     <PanelCard title={t('ui.routeAccess')} tag={t('ui.routeCount', { count: routes.length })}>
       <p class="text-sm text-zinc-400 mb-4">{t('ui.routeHelp')}</p>
-      {#if loading}<LoadingIndicator label={t('ui.loadingRoutes')} height="sm" />{:else if !routes.length}<p class="text-sm text-zinc-400">{t('ui.noRoutes')}</p>{:else}<div class="overflow-x-auto"><table class="w-full text-left text-sm"><thead class="text-zinc-400"><tr><th class="px-2 py-3">{t('ui.route')}</th><th class="px-2 py-3">{t('ui.public')}</th><th class="px-2 py-3">{t('ui.actions')}</th></tr></thead><tbody>{#each routes as route (route.id)}<tr class="border-t border-carbon-600"><td class="px-2 py-3 font-mono">{route.path}</td><td class="px-2 py-3">{#if publicBlockedReason(route.id)}
-        <Tooltip.Root openDelay={200} closeOnEscape>
-          <Tooltip.Trigger asChild let:builder>
-            <!-- Disabled controls cannot receive focus; the group exposes their explanation to keyboard users. -->
-            <!-- svelte-ignore a11y_no_noninteractive_tabindex -->
-            <span {...builder} use:builder.action tabindex="0" role="group" aria-label={t('ui.cannotMakePublic', { path: route.path })} class="inline-flex outline-none focus-visible:ring-2 focus-visible:ring-nexus-500">
-              <BSwitch checked={false} description={t('ui.isRoutePublic', { path: route.path })} disabled />
-            </span>
-          </Tooltip.Trigger>
-          <Tooltip.Content class="max-w-xs break-words" side="top">
-            <div class="space-y-2">
-              <p class="font-semibold">{t('ui.publicBlockedTitle')}</p>
-              <ul class="list-disc pl-4 space-y-1">{#each routeKeyBindings[route.id] ?? [] as key (key.id)}<li>{key.name}</li>{/each}</ul>
-              <p class="text-carbon-300">{t('ui.publicBlockedHelp')}</p>
-            </div>
-          </Tooltip.Content>
-        </Tooltip.Root>
-      {:else}
-        <BSwitch checked={!protectedIds.includes(route.id)} description={t('ui.isRoutePublic', { path: route.path })} disabled={busy || loading || !ready} onchange={isPublic => protect(route.id,!isPublic)} />
-      {/if}</td><td class="px-2 py-3"><button class="nx-btn-ghost nx-btn-sm" disabled={busy || loading || !ready || secretOpen} onclick={() => { selectedRoute = route; pendingRouteKey = null; error = null; routeConfigOpen = true; }}>{t('ui.configureKey')}</button></td></tr>{/each}</tbody></table></div>{/if}
+      {#if loading}<LoadingIndicator label={t('ui.loadingRoutes')} height="sm" />{:else if !routes.length}<p class="text-sm text-zinc-400">{t('ui.noRoutes')}</p>{:else}<div class="overflow-x-auto"><table class="w-full text-left text-sm"><thead class="text-zinc-400"><tr><th class="px-2 py-3">{t('ui.route')}</th><th class="px-2 py-3">{t('ui.public')}</th><th class="px-2 py-3">{t('ui.actions')}</th></tr></thead><tbody>{#each routes as route (route.id)}<tr class="border-t border-carbon-600"><td class="px-2 py-3 font-mono">{route.path}</td><td class="px-2 py-3"><BSwitch checked={!protectedIds.includes(route.id)} description={t('ui.isRoutePublic', { path: route.path })} disabled={busy || loading || !ready} onchange={isPublic => protect(route.id,!isPublic)} />
+      </td><td class="px-2 py-3"><button class="nx-btn-ghost nx-btn-sm" disabled={busy || loading || !ready || secretOpen} onclick={() => { selectedRoute = route; error = null; routeConfigOpen = true; }}>{t('ui.configureKey')}</button></td></tr>{/each}</tbody></table></div>{/if}
     </PanelCard>
   {/if}
 </div>
@@ -213,12 +177,12 @@
       {#each routes as route (route.id)}
         <label class="flex min-h-11 cursor-pointer items-center justify-between gap-3 px-3 py-2 hover:bg-carbon-700">
           <span class="flex min-w-0 items-center gap-3"><input type="checkbox" class="accent-nexus-500" checked={allRoutes || allowed.includes(route.id)} disabled={busy || policyLoading || allRoutes} onchange={event => toggleRoute(route.id,event.currentTarget.checked)} /><span class="font-mono text-sm text-zinc-200 break-all">{route.path}</span></span>
-          <StatusBadge variant={protectedIds.includes(route.id) ? 'active' : (allRoutes || allowed.includes(route.id)) ? 'standby' : 'muted'}>{protectedIds.includes(route.id) ? t('ui.requiresKey') : (allRoutes || allowed.includes(route.id)) ? t('ui.publicToProtected') : t('ui.publicRoute')}</StatusBadge>
+          <StatusBadge variant={protectedIds.includes(route.id) ? 'active' : 'muted'}>{protectedIds.includes(route.id) ? t('ui.requiresKey') : t('ui.publicRoute')}</StatusBadge>
         </label>
       {:else}<p class="p-3 text-sm text-zinc-400">{t('ui.createRoutesFirst')}</p>{/each}
       {#each allowed.filter(id => !routes.some(route => route.id === id)) as id}<label class="flex gap-2 p-3 text-sm text-amber-400"><input type="checkbox" checked disabled={busy} onchange={() => allowed = allowed.filter(value => value !== id)} />{t('ui.deletedRoute', { id })}</label>{/each}
     </div>{/if}
-    {#if selectedPublic.length}<p class="text-sm text-amber-400">{t('ui.selectedPublicWarning', { count: selectedPublic.length })}</p>{:else if !allRoutes && !allowed.length}<p class="text-sm text-zinc-400">{t('ui.noRoutesSelected')}</p>{/if}
+    {#if !allRoutes && !allowed.length}<p class="text-sm text-zinc-400">{t('ui.noRoutesSelected')}</p>{/if}
   </fieldset>
   <fieldset class="space-y-2 border-t border-carbon-600 pt-4">
     <legend class="nx-field-label">{t('ui.modelScopeOptional')}</legend>
@@ -226,30 +190,20 @@
     <p class="text-sm text-zinc-400">{t('ui.modelsHelp')}</p>
   </fieldset>
 {/snippet}
-{#snippet reviewChanges()}
-  <div class="space-y-4" role="region" aria-label={t('ui.reviewTitle')}>
-    <p class="text-sm text-zinc-200">{t('ui.reviewWarning', { count: selectedPublic.length })}</p>
-    <div class="border border-carbon-600 divide-y divide-carbon-600">{#each selectedPublic as route (route.id)}<div class="flex flex-wrap items-center justify-between gap-3 p-3"><span class="font-mono text-sm text-zinc-200 break-all">{route.path}</span><StatusBadge variant="standby">{t('ui.publicToProtected')}</StatusBadge></div>{/each}</div>
-    <p class="text-sm text-zinc-400">{t('ui.reviewHelp')}</p>
-    <dl class="grid grid-cols-[auto_1fr] gap-x-4 gap-y-2 text-sm"><dt class="text-zinc-400">{t('ui.keyName')}</dt><dd class="text-zinc-200 break-all">{name}</dd><dt class="text-zinc-400">{t('ui.modelScope')}</dt><dd class="text-zinc-200 whitespace-pre-wrap break-all">{models.trim() || t('ui.allModels')}</dd></dl>
-  </div>
-{/snippet}
-<IndustrialDialog bind:open={createOpen} title={review ? t('ui.reviewTitle') : t('ui.createKey')} description={review ? t('ui.createReviewHelp') : t('ui.createHelp')} width="48rem" {busy} scrollBody>
+<IndustrialDialog bind:open={createOpen} title={t('ui.createKey')} description={t('ui.createHelp')} width="48rem" {busy} scrollBody>
   {#snippet body()}
     <form id="create-api-key" class="space-y-5" onsubmit={create}>
-      {#if review}{@render reviewChanges()}{:else}
-        {@render basicFields()}
-        {@render routeFields()}
-      {/if}
+      {@render basicFields()}
+      {@render routeFields()}
       {#if error}<p role="alert" class="text-sm text-red-400">{displayMessage(error)}</p>{/if}
     </form>
   {/snippet}
-  {#snippet footer()}{#if review}<button class="nx-btn-ghost" disabled={busy} onclick={() => review = false}>{t('ui.back')}</button>{/if}<button class="nx-btn-ghost" disabled={busy} onclick={() => { createOpen = false; review = false; }}>{t('ui.cancel')}</button><button class="nx-btn-primary" form="create-api-key" disabled={busy}>{busy ? t('ui.saving') : !review && selectedPublic.length ? t('ui.next') : t('ui.save')}</button>{/snippet}
+  {#snippet footer()}<button class="nx-btn-ghost" disabled={busy} onclick={() => { createOpen = false; }}>{t('ui.cancel')}</button><button class="nx-btn-primary" form="create-api-key" disabled={busy}>{busy ? t('ui.saving') : t('ui.save')}</button>{/snippet}
 </IndustrialDialog>
-<IndustrialDialog bind:open={policyOpen} title={review ? t('ui.reviewTitle') : t('ui.editKey', { name: target?.name ?? '' })} description={review ? t('ui.editReviewHelp') : t('ui.editHelp')} width="48rem" {busy} scrollBody onOpenChange={open => { if (!open) { guard.invalidate(); } }}>
-  {#snippet body()}{#if policyLoading}<LoadingIndicator label={t('ui.loadingPolicy')} height="sm" />{:else}<form id="key-route-policy" class="space-y-5" onsubmit={update}>{#if review}{@render reviewChanges()}{:else}{@render basicFields()}
-      {@render routeFields()}{/if}{#if error}<p role="alert" class="text-sm text-red-400">{displayMessage(error)}</p>{/if}</form>{/if}{/snippet}
-  {#snippet footer()}{#if review}<button class="nx-btn-ghost" disabled={busy} onclick={() => review = false}>{t('ui.back')}</button>{/if}<button class="nx-btn-ghost" disabled={busy} onclick={() => { policyOpen = false; review = false; guard.invalidate(); }}>{t('ui.cancel')}</button><button class="nx-btn-primary" form="key-route-policy" disabled={busy || policyLoading || !policyReady || !target || target.revokedAt !== null}>{busy ? t('ui.saving') : !review && selectedPublic.length ? t('ui.next') : t('ui.save')}</button>{/snippet}
+<IndustrialDialog bind:open={policyOpen} title={t('ui.editKey', { name: target?.name ?? '' })} description={t('ui.editHelp')} width="48rem" {busy} scrollBody onOpenChange={open => { if (!open) { guard.invalidate(); } }}>
+  {#snippet body()}{#if policyLoading}<LoadingIndicator label={t('ui.loadingPolicy')} height="sm" />{:else}<form id="key-route-policy" class="space-y-5" onsubmit={update}>{@render basicFields()}
+      {@render routeFields()}{#if error}<p role="alert" class="text-sm text-red-400">{displayMessage(error)}</p>{/if}</form>{/if}{/snippet}
+  {#snippet footer()}<button class="nx-btn-ghost" disabled={busy} onclick={() => { policyOpen = false; guard.invalidate(); }}>{t('ui.cancel')}</button><button class="nx-btn-primary" form="key-route-policy" disabled={busy || policyLoading || !policyReady || !target || target.revokedAt !== null}>{busy ? t('ui.saving') : t('ui.save')}</button>{/snippet}
 </IndustrialDialog>
 <IndustrialDialog bind:open={secretOpen} title={t('ui.viewKey')} description={t('ui.viewHelp')} busy={busy} onOpenChange={open => { if (!open) { secret = ''; secretStatus = null; guard.invalidate(); } }}>
   {#snippet body()}{#if secret}<code class="block select-all break-all border border-carbon-600 bg-carbon-950 p-3 font-mono text-zinc-200">{secret}</code>{:else if busy}<LoadingIndicator label={t('ui.loadingKeys')} height="sm" />{/if}{#if secretStatus}<p role="status" class="text-sm text-zinc-300 mt-3">{displayMessage(secretStatus)}</p>{/if}{#if copied}<p class="text-sm text-emerald-400 mt-3">{t('ui.copied')}</p>{/if}{/snippet}
@@ -262,9 +216,6 @@
 
 <IndustrialDialog bind:open={routeConfigOpen} title={t('ui.configureKey')} description={t('ui.configureDescription', { path: selectedRoute?.path ?? '' })} {busy} scrollBody>
   {#snippet body()}
-    {#if pendingRouteKey}
-      <p class="text-sm text-zinc-200">{#each t('ui.applyRouteWarning', { path: '\uE000', name: '\uE001' }).split(/(\uE000|\uE001)/) as part}{#if part === '\uE000'}<strong>{selectedRoute?.path}</strong>{:else if part === '\uE001'}<strong>{pendingRouteKey.name}</strong>{:else}{part}{/if}{/each}</p>
-    {:else}
     <div class="space-y-4">
       <button class="nx-btn-primary" disabled={busy} onclick={() => { routeConfigOpen = false; newKey(selectedRoute?.id); }}>{t('ui.newKey')}</button>
       <div class="space-y-2">
@@ -274,14 +225,13 @@
           {#each keys.filter(key => key.revokedAt === null) as key (key.id)}
             <div class="flex items-center justify-between gap-3 py-3">
               <div class="min-w-0"><p class="text-sm text-zinc-200 break-all">{key.name}</p><p class="font-mono text-xs text-zinc-400">{key.prefix}… · {keyStatusText(key)}</p></div>
-              <button class="nx-btn-ghost nx-btn-sm" disabled={busy || !!routeKeyBindings[selectedRoute?.id ?? '']?.some(item => item.id === key.id)} onclick={() => void applyRouteKey(key)}>{routeKeyBindings[selectedRoute?.id ?? '']?.some(item => item.id === key.id) ? t('ui.applied') : t('ui.apply')}</button>
+              <button class="nx-btn-ghost nx-btn-sm" disabled={busy || isKeyApplied(selectedRoute?.id ?? '',key.id)} onclick={() => void applyRouteKey(key)}>{isKeyApplied(selectedRoute?.id ?? '',key.id) ? t('ui.applied') : t('ui.apply')}</button>
             </div>
           {:else}<p class="py-3 text-sm text-zinc-400">{t('ui.noUsableKeys')}</p>{/each}
         </div>
       </div>
     </div>
-    {/if}
     {#if error}<p role="alert" class="text-sm text-red-400 mt-3">{displayMessage(error)}</p>{/if}
   {/snippet}
-  {#snippet footer()}<button class="nx-btn-ghost" disabled={busy} onclick={() => routeConfigOpen = false}>{t('ui.cancel')}</button>{#if pendingRouteKey}<button class="nx-btn-primary" disabled={busy} onclick={() => pendingRouteKey && applyRouteKey(pendingRouteKey,true)}>{busy ? t('ui.saving') : t('ui.apply')}</button>{/if}{/snippet}
+  {#snippet footer()}<button class="nx-btn-ghost" disabled={busy} onclick={() => routeConfigOpen = false}>{t('ui.cancel')}</button>{/snippet}
 </IndustrialDialog>

package/dist/plugins/local-accounts/manifest.json

@@ -76,9 +76,15 @@
         "capability": "self.password"
       }
     ],
-    "navigation": [],
-    "settings": "/settings",
-    "nativeSettingsComponent": "LocalAccountsSettings"
+    "navigation": [
+      {
+        "label": "metadata.name",
+        "path": "/settings",
+        "component": "LocalAccountsSettings",
+        "icon": "manage_accounts",
+        "target": "header"
+      }
+    ]
   },
   "metadata": {
     "name": "metadata.name",
@@ -88,10 +94,10 @@
   "configSchema": [],
   "translations": {
     "zh-CN": {
-      "metadata.name": "管理认证",
+      "metadata.name": "认证管理",
       "metadata.description": "可选的单管理员账号密码认证",
       "login.title": "账号登录",
-      "login.description": "使用管理认证插件中设置的唯一管理员账号。",
+      "login.description": "使用认证管理插件中设置的唯一管理员账号。",
       "login.username": "账号",
       "login.password": "密码",
       "login.busy": "正在建立登录会话…",
@@ -122,7 +128,7 @@
       "settings.accountTag": "账号",
       "settings.passwordTag": "密码",
       "settings.loading": "正在读取管理员账号",
-      "settings.accountDescription": "管理认证使用此唯一管理员账号。停用插件后恢复匿名管理访问。",
+      "settings.accountDescription": "认证管理使用此唯一管理员账号。停用插件后恢复匿名管理访问。",
       "settings.passwordTitle": "修改登录密码",
       "settings.passwordDescription": "修改后当前登录会话失效，需要重新登录。",
       "settings.currentPassword": "当前密码",
@@ -151,7 +157,7 @@
       "session.reload": "重新读取"
     },
     "en": {
-      "metadata.name": "Management authentication",
+      "metadata.name": "Authentication Management",
       "metadata.description": "Optional username and password authentication for a single administrator",
       "login.title": "Account sign-in",
       "login.description": "Use the sole administrator account configured in the management authentication plugin.",

package/dist/plugins/token-budget/manifest.json

@@ -91,8 +91,15 @@
         }
       }
     ],
-    "settings": "/settings",
-    "nativeSettingsComponent": "TokenBudgetKeyPolicy"
+    "navigation": [
+      {
+        "label": "metadata.name",
+        "path": "/settings",
+        "component": "TokenBudgetKeyPolicy",
+        "icon": "shield",
+        "target": "header"
+      }
+    ]
   },
   "metadata": {
     "name": "metadata.name",
@@ -191,7 +198,7 @@
       "status.exhausted": "Budget exhausted"
     },
     "zh-CN": {
-      "metadata.name": "Token 预算",
+      "metadata.name": "Token预算",
       "plugin.description": "按 Key 设置 UTC 每日、每周、每月或累计 Token 与美元预算，并查看计量账本。",
       "ui.key": "API Key",
       "ui.search": "搜索 API Key",
@@ -218,7 +225,7 @@
       "status.unlimited": "不限制",
       "reason.notReady": "插件尚未就绪，暂不可修改。",
       "ui.title": "API Key 预算",
-      "ui.tag": "Token 预算",
+      "ui.tag": "Token预算",
       "ui.description": "为每个 API Key 设置 Token 或 USD 预算，按每日、每周、每月或累计限制。未配置的 Key 不受预算限制。",
       "ui.behavior": "额度用尽后拒绝新请求；已接纳请求继续，最终用量可能超过额度。",
       "ui.loading": "正在读取预算",

package/dist/plugins/token-budget/ui/KeyPolicy.svelte

@@ -82,7 +82,7 @@
       <div class="flex flex-wrap items-center gap-3">
         <label class="flex-1 min-w-0"><span class="sr-only">{t('ui.search')}</span><Input placeholder={t('ui.searchPlaceholder')} bind:value={search} /></label>
         <button class="nx-btn-ghost" disabled={loading || saving} onclick={refresh}>{t('ui.refresh')}</button>
-        <a class="nx-btn-ghost" href="/#/plugins/key-access/settings">{t('ui.manageKeys')}</a>
+        <a class="nx-btn-ghost" href="/#/extensions/key-access/settings">{t('ui.manageKeys')}</a>
       </div>
     </div>
     {#if feedback}<p role="status" class="text-sm text-emerald-400 mb-3">{t(feedback)}</p>{/if}

package/dist/plugins/token-stats/manifest.json

@@ -178,8 +178,6 @@
       "ui.input": "Input",
       "ui.output": "Output",
       "ui.estimatedCostUsd": "Est. cost · USD",
-      "ui.includesEstimate": "incl. estimate",
-      "ui.reportingIncomplete": "Some usage records were lost. Reported totals may be incomplete.",
       "ui.unknownValue": "Unknown",
       "ui.unknownModel": "Unknown model",
       "ui.otherModels": "Other",
@@ -293,8 +291,6 @@
       "ui.input": "输入",
       "ui.output": "输出",
       "ui.estimatedCostUsd": "费用估算 · USD",
-      "ui.includesEstimate": "含估算",
-      "ui.reportingIncomplete": "部分用量记录丢失，统计总量可能不完整。",
       "ui.unknownValue": "未知",
       "ui.unknownModel": "未知模型",
       "ui.otherModels": "其他",
@@ -353,7 +349,7 @@
       "settings.mappingUnavailable": "目标模型已不在价格目录中，费用将显示未知；请选择其他模型或移除此映射。",
       "widgets.overview.title": "Token 概览",
       "widgets.time.title": "Token 趋势",
-      "page.title": "Token 统计",
+      "page.title": "Token统计",
       "page.viewModels": "查看模型统计",
       "ui.refresh": "刷新",
       "ui.previousInterval": "较上个{interval}",

package/dist/plugins/token-stats/ui/TokenStatsChart.svelte

@@ -23,7 +23,7 @@
   $effect(() => {
     const report = onHeaderChange;
     const header = { summary: selectedRange, refresh: { label: t('ui.refresh'), busy: state.busy,
-      disabled: !resource, run: () => { void resource?.refresh(); } } };
+      disabled: !resource, run: () => { void resource?.refresh(); } }, actions: headerActions };
     untrack(() => report?.(header));
   });
   onMount(() => {
@@ -32,6 +32,10 @@
   });
 </script>
 
+{#snippet headerActions()}
+  <a href={`/#/extensions/${pluginName}/statistics`} class="inline-flex shrink-0 items-center gap-1 whitespace-nowrap text-[11px] text-zinc-400 hover:text-nexus-300 hover:underline">{t('page.viewModels')} <span>→</span></a>
+{/snippet}
+
 <div class="flex h-full min-h-0 flex-col gap-2" data-testid="plugin-widget-token-stats">
   {#if state.error}<p role="alert" class="shrink-0 text-xs text-red-300">{t('ui.loadFailed')}</p>{/if}
   {#if state.busy && !state.data}
@@ -45,5 +49,4 @@
       <div class="min-h-0 flex-1"><UsageTimeChart stats={state.data} range={selectedRange} refreshedAt={state.refreshedAt} {pluginName} /></div>
     {/if}
   {/if}
-  <a href={`/#/extensions/${pluginName}/statistics`} class="shrink-0 self-end text-[11px] text-zinc-400 hover:text-nexus-300 hover:underline">{t('page.viewModels')} →</a>
 </div>

package/dist/plugins/token-stats/ui/TokenStatsMetric.svelte

@@ -3,10 +3,9 @@
   import { isLoading } from 'svelte-i18n';
   import { _, formatCompactNumber, type TimeRange } from '@bungee/plugin-sdk';
   import { getPluginText } from '$utils/plugin-i18n';
-  import { LoadingIndicator } from '$components/industrial';
   import KpiTrendValue from '$components/industrial/KpiTrendValue.svelte';
   import type { NativeWidgetHeaderChange } from '$components/native-widgets/widget-header';
-  import { estimatedTokens, formatEstimatedUsd, formatTokenCount, usagePresentation } from './labels';
+  import { formatEstimatedUsd, formatTokenCount, usagePresentation } from './labels';
   import { getStatsResource } from './stats';
   import type { StatsState, StatsResource } from './stats-resource';
   import { overviewTrends } from './overview-trends';
@@ -40,6 +39,11 @@
 </script>
 
 {#snippet trendFooter()}
+  {#if state.error}
+    <p role="alert" class="text-xs text-red-300">{t('ui.loadFailed')}</p>
+  {:else if usage?.state === 'empty'}
+    <p class="text-[10px] text-zinc-400" data-testid="token-stats-empty">{t('ui.noData')}</p>
+  {:else}
   <div class="overview-trends w-full" data-testid="token-stats-overview-trends">
     {#each trends as item}
       {@const value = item.isNew ? t('ui.newActivity') : item.percent == null ? '—' : `${item.percent >= 0 ? '+' : ''}${item.percent.toFixed(1)}%`}
@@ -50,14 +54,13 @@
       </div>
     {/each}
   </div>
+  {/if}
 {/snippet}
 
-<div class="kpi-metric-row w-full min-w-0" data-testid="token-stats-overview">
-  {#if state.busy && !state.data}
-    <LoadingIndicator size="sm" height="sm" label={t('ui.loading')} />
-  {:else if state.error && !state.data}
-    <p role="alert" class="text-xs text-red-300">{t('ui.loadFailed')}</p>
-  {:else}
+<!-- Keep the same intrinsic metric geometry while requests are pending or fail.
+     Desktop GridStack derives its shared row height from this content. -->
+<div class="kpi-metric-row w-full min-w-0" data-testid="token-stats-overview" aria-busy={state.busy}>
+  {#if state.busy && !state.data}<span role="status" class="sr-only">{t('ui.loading')}</span>{/if}
     <div class="kpi-metric-row overview-metrics">
       {#each ['input', 'output', 'cost'] as metric}
         {@const fullValue = metric === 'cost' ? formatEstimatedUsd(state.data?.estimatedCostUsd)
@@ -69,16 +72,9 @@
         <div class="min-w-0" data-testid={`token-stats-metric-${metric}`}>
           <div class="nx-label mb-2">{t(metric === 'cost' ? 'ui.estimatedCostUsd' : `ui.${metric}`)}</div>
           <div class="overview-value nx-metric text-zinc-50" title={fullValue} aria-label={fullValue}>{value}</div>
-          {#if metric !== 'cost' && state.data && (estimatedTokens(state.data, metric as 'input' | 'output') ?? 0) > 0}
-            <p class="mt-1 text-[10px] text-zinc-400">{t('ui.includesEstimate')}</p>
-          {/if}
         </div>
       {/each}
     </div>
-    {#if state.data?.reportingIncomplete}<p role="status" class="mt-2 text-xs text-amber-300">{t('ui.reportingIncomplete')}</p>{/if}
-    {#if state.error}<p role="alert" class="mt-2 text-xs text-red-300">{t('ui.loadFailed')}</p>
-    {:else if usage?.state === 'empty'}<p class="mt-2 text-[10px] text-zinc-400" data-testid="token-stats-empty">{t('ui.noData')}</p>{/if}
-  {/if}
 </div>
 
 <style>

package/dist/plugins/token-stats/ui/TokenStatsPage.svelte

@@ -97,9 +97,6 @@
       <span>{t('ui.loadFailed')}</span><Button variant="ghost" size="sm" onclick={refresh} disabled={busy}>{t('page.retry')}</Button>
     </div>
   {/if}
-  {#if models.data?.reportingIncomplete || time.data?.reportingIncomplete}
-    <p role="status" class="border-l-2 border-amber-500 px-3 py-2 text-xs text-amber-300">{t('ui.reportingIncomplete')}</p>
-  {/if}
   {#if models.busy && !models.data}
     <LoadingIndicator label={t('ui.loading')} height="sm" />
   {:else if models.data}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jeffusion/bungee-core",
-  "version": "5.15.0",
+  "version": "5.15.2",
   "description": "Bungee reverse proxy core engine",
   "main": "./dist/main.js",
   "types": "./dist/main.d.ts",
@@ -12,7 +12,7 @@
     "test": "bun test"
   },
   "dependencies": {
-    "@jeffusion/bungee-types": "^5.15.0",
+    "@jeffusion/bungee-types": "^5.15.2",
     "@types/lodash-es": "^4.17.12",
     "acorn": "^8.15.0",
     "canonicalize": "3.0.0",