@undefineds.co/xpod 0.4.19 → 0.4.25

package/node_modules/@inrupt/solid-client-authn-core/dist/index.mjs

@@ -1,4 +1,4 @@
-import { jwtVerify, createRemoteJWKSet, exportJWK, SignJWT, generateKeyPair } from 'jose';
+import { jwtVerify, createRemoteJWKSet, exportJWK, SignJWT, generateKeyPair, base64url } from 'jose';
 import { v4 } from 'uuid';
 
 //
@@ -1207,11 +1207,14 @@ function normalizeHTU(audience) {
  * @param dpopKey Key used to sign the token.
  * @returns A JWT that can be used as a DPoP Authorization header.
  */
-async function createDpopHeader(audience, method, dpopKey) {
+async function createDpopHeader(audience, method, dpopKey, accessToken) {
     return new SignJWT({
         htu: normalizeHTU(audience),
         htm: method.toUpperCase(),
         jti: v4(),
+        ...(accessToken === undefined ? {} : { ath: base64url.encode(
+            new Uint8Array(await globalThis.crypto.subtle.digest("SHA-256", new TextEncoder().encode(accessToken)))
+        ) }),
     })
         .setProtectedHeader({
         alg: PREFERRED_SIGNING_ALG[0],
@@ -1267,7 +1270,7 @@ async function buildDpopFetchOptions(targetUrl, authToken, dpopKey, defaultOptio
     const headers = new Headers(defaultOptions?.headers);
     // Any pre-existing Authorization header should be overriden.
     headers.set("Authorization", `DPoP ${authToken}`);
-    headers.set("DPoP", await createDpopHeader(targetUrl, defaultOptions?.method ?? "get", dpopKey));
+    headers.set("DPoP", await createDpopHeader(targetUrl, defaultOptions?.method ?? "get", dpopKey, authToken));
     return {
         ...defaultOptions,
         headers,
@@ -1322,6 +1325,12 @@ const computeRefreshDelay = (expiresIn) => {
  */
 function buildAuthenticatedFetch(accessToken, options) {
     let currentAccessToken = accessToken;
+    // XPOD_REFRESH_ON_REQUEST: use real expiry even when the proactive timer was suspended.
+    let accessTokenExpiresAt = Date.now() + (options?.expiresIn ?? DEFAULT_EXPIRATION_TIME_SECONDS) * 1000;
+    let refreshBeforeRequest;
+    let refreshInFlight;
+    let refreshTerminated = false;
+    let lastRefreshError;
     let latestTimeout;
     let refreshRetryAttempt = 0;
     const XPOD_REFRESH_RETRY_MAX_DELAY_MS = 60000;
@@ -1331,64 +1340,77 @@ function buildAuthenticatedFetch(accessToken, options) {
     // the first expiration date.
     if (currentRefreshOptions !== undefined) {
         const proactivelyRefreshToken = async () => {
-            try {
-                const { accessToken: refreshedAccessToken, refreshToken, expiresIn, } = await refreshAccessToken(currentRefreshOptions, 
-                // If currentRefreshOptions is defined, options is necessarily defined too.
-                // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
-                options.dpopKey, 
-                // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
-                options.eventEmitter);
-                // Update the tokens in the closure if appropriate.
-                currentAccessToken = refreshedAccessToken;
-                refreshRetryAttempt = 0;
-                if (refreshToken !== undefined) {
-                    currentRefreshOptions.refreshToken = refreshToken;
-                }
-                // Each time the access token is refreshed, we must plan for the next
-                // refresh iteration.
-                clearTimeout(latestTimeout);
-                latestTimeout = setTimeout(proactivelyRefreshToken, computeRefreshDelay(expiresIn) * 1000);
-                // If currentRefreshOptions is defined, options is necessarily defined too.
-                // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
-                options.eventEmitter?.emit(EVENTS.TIMEOUT_SET, latestTimeout);
-            }
-            catch (e) {
-                // It is possible that an underlying library throws an error on refresh flow failure.
-                // If we used a log framework, the error could be logged at the `debug` level,
-                // but otherwise the failure of the refresh flow should not blow up in the user's
-                // face, so we just swallow the error.
-                const terminalProviderError = e instanceof OidcProviderError &&
-                    e.error !== "server_error" &&
-                    e.error !== "temporarily_unavailable";
-                if (terminalProviderError) {
-                    // The OIDC provider refused to refresh the access token and returned an error instead.
-                    /* istanbul ignore next 100% coverage would require testing that nothing
-                        happens here if the emitter is undefined, which is more cumbersome
-                        than what it's worth. */
-                    options?.eventEmitter?.emit(EVENTS.ERROR, e.error, e.errorDescription);
-                    /* istanbul ignore next 100% coverage would require testing that nothing
-                      happens here if the emitter is undefined, which is more cumbersome
-                      than what it's worth. */
-                    options?.eventEmitter?.emit(EVENTS.SESSION_EXPIRED);
-                }
-                const invalidTokenResponse = e instanceof InvalidResponseError &&
-                    e.missingFields.includes("access_token");
-                if (invalidTokenResponse) {
-                    // In this case, the OIDC provider returned a non-standard response, but
-                    // did not specify that it was an error. We cannot refresh nonetheless.
-                    /* istanbul ignore next 100% coverage would require testing that nothing
-                      happens here if the emitter is undefined, which is more cumbersome
-                      than what it's worth. */
-                    options?.eventEmitter?.emit(EVENTS.SESSION_EXPIRED);
-                }
-                if (!terminalProviderError && !invalidTokenResponse) {
-                    const retryDelay = Math.min(1000 * 2 ** refreshRetryAttempt, XPOD_REFRESH_RETRY_MAX_DELAY_MS);
-                    refreshRetryAttempt += 1;
+            if (refreshTerminated) return false;
+            if (refreshInFlight) return refreshInFlight;
+            refreshInFlight = (async () => {
+                try {
+                    const { accessToken: refreshedAccessToken, refreshToken, expiresIn, } = await refreshAccessToken(currentRefreshOptions, 
+                    // If currentRefreshOptions is defined, options is necessarily defined too.
+                    // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+                    options.dpopKey, 
+                    // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+                    options.eventEmitter);
+                    // Update the tokens in the closure if appropriate.
+                    currentAccessToken = refreshedAccessToken;
+                    accessTokenExpiresAt = Date.now() + (expiresIn ?? DEFAULT_EXPIRATION_TIME_SECONDS) * 1000;
+                    refreshRetryAttempt = 0;
+                    if (refreshToken !== undefined) {
+                        currentRefreshOptions.refreshToken = refreshToken;
+                    }
+                    // Each time the access token is refreshed, we must plan for the next
+                    // refresh iteration.
                     clearTimeout(latestTimeout);
-                    latestTimeout = setTimeout(proactivelyRefreshToken, retryDelay);
-                    options?.eventEmitter?.emit(EVENTS.TIMEOUT_SET, latestTimeout);
+                    latestTimeout = setTimeout(proactivelyRefreshToken, computeRefreshDelay(expiresIn) * 1000);
+                    // If currentRefreshOptions is defined, options is necessarily defined too.
+                    // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+                    options.eventEmitter?.emit(EVENTS.TIMEOUT_SET, latestTimeout);
+                    return true;
                 }
-            }
+                catch (e) {
+                    lastRefreshError = e;
+                    // It is possible that an underlying library throws an error on refresh flow failure.
+                    // If we used a log framework, the error could be logged at the `debug` level,
+                    // but otherwise the failure of the refresh flow should not blow up in the user's
+                    // face, so we just swallow the error.
+                    const terminalProviderError = e instanceof OidcProviderError &&
+                        e.error !== "server_error" &&
+                        e.error !== "temporarily_unavailable";
+                    if (terminalProviderError) {
+                        // The OIDC provider refused to refresh the access token and returned an error instead.
+                        /* istanbul ignore next 100% coverage would require testing that nothing
+                            happens here if the emitter is undefined, which is more cumbersome
+                            than what it's worth. */
+                        options?.eventEmitter?.emit(EVENTS.ERROR, e.error, e.errorDescription);
+                        /* istanbul ignore next 100% coverage would require testing that nothing
+                          happens here if the emitter is undefined, which is more cumbersome
+                          than what it's worth. */
+                        options?.eventEmitter?.emit(EVENTS.SESSION_EXPIRED);
+                    }
+                    const invalidTokenResponse = e instanceof InvalidResponseError &&
+                        e.missingFields.includes("access_token");
+                    if (invalidTokenResponse) {
+                        // In this case, the OIDC provider returned a non-standard response, but
+                        // did not specify that it was an error. We cannot refresh nonetheless.
+                        /* istanbul ignore next 100% coverage would require testing that nothing
+                          happens here if the emitter is undefined, which is more cumbersome
+                          than what it's worth. */
+                        options?.eventEmitter?.emit(EVENTS.SESSION_EXPIRED);
+                    }
+                    refreshTerminated = terminalProviderError || invalidTokenResponse;
+                    if (!terminalProviderError && !invalidTokenResponse) {
+                        const retryDelay = Math.min(1000 * 2 ** refreshRetryAttempt, XPOD_REFRESH_RETRY_MAX_DELAY_MS);
+                        refreshRetryAttempt += 1;
+                        clearTimeout(latestTimeout);
+                        latestTimeout = setTimeout(proactivelyRefreshToken, retryDelay);
+                        options?.eventEmitter?.emit(EVENTS.TIMEOUT_SET, latestTimeout);
+                    }
+                    return false;
+                }
+            })().finally(() => { refreshInFlight = undefined; });
+            return refreshInFlight;
+        };
+        refreshBeforeRequest = async () => {
+            if (!await proactivelyRefreshToken()) throw lastRefreshError;
         };
         latestTimeout = setTimeout(proactivelyRefreshToken, 
         // If currentRefreshOptions is defined, options is necessarily defined too.
@@ -1409,6 +1431,9 @@ function buildAuthenticatedFetch(accessToken, options) {
         options.eventEmitter.emit(EVENTS.TIMEOUT_SET, expirationTimeout);
     }
     return async (url, requestInit) => {
+        if (refreshBeforeRequest && Date.now() >= accessTokenExpiresAt) {
+            await refreshBeforeRequest();
+        }
         let response = await makeAuthenticatedRequest(currentAccessToken, url, requestInit, options?.dpopKey, options?.fetch);
         const failedButNotExpectedAuthError = !response.ok && !isExpectedAuthError(response.status);
         if (response.ok || failedButNotExpectedAuthError) {
@@ -1501,3 +1526,5 @@ const mockStorageUtility = (stored, isSecure = false) => {
 
 export { AggregateHandler, AuthorizationCodeWithPkceOidcHandlerBase, ClientAuthentication, ConfigurationError, DEFAULT_SCOPES, EVENTS, GeneralLogoutHandler, IRpLogoutHandler, IWaterfallLogoutHandler, InMemoryStorage, InvalidResponseError, NotImplementedError, OidcProviderError, PREFERRED_SIGNING_ALG, REFRESH_BEFORE_EXPIRATION_SECONDS, SOLID_CLIENT_AUTHN_KEY_PREFIX, SessionInfoManagerBase, StorageUtility, StorageUtilityGetResponse, StorageUtilityMock, USER_SESSION_PREFIX, buildAuthenticatedFetch, clear, createDpopHeader, determineSigningAlg, generateDpopKeyPair, getEndSessionUrl, getSessionIdFromOauthState, getUnauthenticatedSession, getWebidFromTokenPayload, handleRegistration, isKnownClientType, isSupportedTokenType, isValidRedirectUrl, loadOidcContextFromStorage, maybeBuildRpInitiatedLogout, mockStorage, mockStorageUtility, normalizeScopes, removeOpenIdParams, saveSessionInfoToStorage };
 //# sourceMappingURL=index.mjs.map
+
+// XPOD_INRUPT_RESOURCE_DPOP_ATH

package/node_modules/@undefineds.co/ai-connections/dist/AiApiKeyPool.d.ts

@@ -1,6 +1,6 @@
-import type { AiConnectAttempt, AiProviderCredentialSummary, AiProviderOffering } from './contract/ai-connections-client';
-import type { AiProviderDefinition } from './controller';
-import type { ProviderConnectionState } from './AiProviderCard';
+import type { AiConnectAttempt, AiProviderCredentialSummary, AiProviderOffering } from './contract/ai-connections-client.js';
+import type { AiProviderDefinition } from './controller.js';
+import type { ProviderConnectionState } from './AiProviderCard.js';
 export declare function AiApiKeyPool({ definition, offering, createOfferings, status, credentials, attempt, apiKey, baseUrl, busy, disabled, error, onApiKeyChange, onBaseUrlChange, onBeginApiKey, onBeginBrowser, onSaveApiKey, onDisconnect, onCreateApiKeyCredential, onUpdateCredential, initialEditing, initialCreate, onSavingChange, onCloseEdit, }: {
     definition: AiProviderDefinition;
     offering: AiProviderOffering;

package/node_modules/@undefineds.co/ai-connections/dist/AiApiKeyPool.js

@@ -1,6 +1,6 @@
 import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
 import { useEffect, useRef, useState } from 'react';
-import { Button, Input, cn } from '@undefineds.co/shared-ui';
+import { Button, Input, NativeSelect, cn } from '@undefineds.co/shared-ui';
 import { ExternalLink, Eye, EyeOff, KeyRound, Loader2, LogOut, Plus, RotateCw } from 'lucide-react';
 import { normalizeProxyUrl } from './contract/ai-connections-client.js';
 import { offeringTitle } from './offering-label.js';
@@ -122,7 +122,7 @@ export function AiApiKeyPool({ definition, offering, createOfferings, status, cr
             }
         }
     };
-    return (_jsxs("div", { className: cn('space-y-3', formMode && 'w-full'), children: [attempt?.userCode ? (_jsxs("div", { className: "border-l-2 border-primary bg-muted/30 px-3 py-2 text-sm", children: ["\u9A8C\u8BC1\u7801\uFF1A", _jsx("strong", { className: "font-mono", children: attempt.userCode })] })) : null, !initialCreate && !initialEditing ? _jsxs("div", { className: "flex flex-wrap gap-2", children: [onCreateApiKeyCredential && createOfferings.length > 0 ? (_jsxs(Button, { variant: "outline", size: "sm", disabled: busy || disabled || saving, onClick: openCreateForm, children: [_jsx(Plus, { className: "mr-2 h-4 w-4" }), "\u6DFB\u52A0 API Key"] })) : null, hasPoolActions ? null : isConnected ? (_jsxs(_Fragment, { children: [_jsxs(Button, { variant: "outline", size: "sm", disabled: busy || disabled || saving, onClick: onBeginBrowser, children: [busy ? _jsx(Loader2, { className: "mr-2 h-4 w-4 animate-spin" }) : _jsx(RotateCw, { className: "mr-2 h-4 w-4" }), "\u91CD\u65B0\u8FDE\u63A5"] }), _jsxs(Button, { variant: "ghost", size: "sm", disabled: busy || disabled || saving, onClick: onDisconnect, children: [_jsx(LogOut, { className: "mr-2 h-4 w-4" }), "\u65AD\u5F00\u8FDE\u63A5"] })] })) : isConfigured ? (_jsxs(_Fragment, { children: [_jsxs(Button, { variant: "outline", size: "sm", "aria-label": "\u66F4\u65B0 API Key", disabled: busy || disabled || saving, onClick: onBeginApiKey, children: [_jsx(KeyRound, { className: "mr-2 h-4 w-4" }), "\u66F4\u65B0 API Key"] }), _jsx(Button, { variant: "ghost", size: "sm", disabled: busy || disabled || saving, onClick: onDisconnect, children: "\u79FB\u9664\u914D\u7F6E" })] })) : (_jsxs(_Fragment, { children: [browserMethod ? (_jsxs(Button, { variant: "outline", size: "sm", title: browserMethod.lifecycle === 'unavailable' ? browserMethod.reason : undefined, disabled: busy || disabled || saving || browserMethod.lifecycle === 'unavailable', onClick: onBeginBrowser, children: [busy ? _jsx(Loader2, { className: "mr-2 h-4 w-4 animate-spin" }) : _jsx(ExternalLink, { className: "mr-2 h-4 w-4" }), browserMethod.label] })) : null, _jsxs(Button, { variant: "outline", size: "sm", "aria-label": `${definition.name} API Key`, disabled: busy || disabled || saving, onClick: onBeginApiKey, children: [_jsx(KeyRound, { className: "mr-2 h-4 w-4" }), "\u914D\u7F6E API Key"] })] }))] }) : null, formMode ? (_jsxs("div", { className: "space-y-2 rounded-lg border border-border/50 bg-muted/10 p-3", children: [formMode === 'create' && createOfferings.length > 1 ? (_jsxs("label", { className: "block space-y-1 text-xs text-muted-foreground", children: [_jsx("span", { children: "\u5957\u9910 / \u533A\u57DF" }), _jsx("select", { "aria-label": `${definition.name} 套餐 / 区域`, value: createOfferingId, disabled: busy || disabled || saving, onChange: (event) => { setCreateOfferingId(event.target.value); setPoolFormError(undefined); }, className: "h-9 w-full rounded-md border border-input bg-background px-3 text-sm text-foreground", children: createOfferings.map((item) => _jsx("option", { value: item.id, children: offeringTitle(item) }, item.id)) })] })) : null, formMode === 'edit' ? (_jsx(Input, { disabled: busy || disabled || saving, autoComplete: "off", "aria-label": `${definition.name} API Key 标签`, placeholder: "\u540D\u79F0\uFF0C\u4F8B\u5982 Work key", value: poolLabel, onChange: (event) => setPoolLabel(event.target.value) })) : null, formMode === 'create' ? (_jsx(Input, { disabled: busy || disabled || saving, type: showKey ? 'text' : 'password', autoComplete: "new-password", "data-lpignore": "true", "data-1p-ignore": true, "aria-label": `${definition.name} API Key 输入`, placeholder: definition.apiKeyPlaceholder || '从官方控制台复制 API Key', value: poolApiKey, onChange: (event) => setPoolApiKey(event.target.value), className: "font-mono" })) : null, formMode === 'edit' || showAdvanced ? (_jsxs(_Fragment, { children: [_jsx(Input, { disabled: busy || disabled || saving, autoComplete: "off", "data-lpignore": "true", "data-1p-ignore": true, "aria-label": `${definition.name} Base URL 输入`, placeholder: offeringEndpoint(formMode === 'edit' ? offering : formOffering) || definition.defaultBaseUrl || '默认服务地址', value: poolBaseUrl, onChange: (event) => setPoolBaseUrl(event.target.value), className: "font-mono text-xs" }), _jsx(Input, { disabled: busy || disabled || saving, autoComplete: "off", "data-lpignore": "true", "data-1p-ignore": true, "aria-label": `${definition.name} Proxy URL 输入`, placeholder: "http://127.0.0.1:7890", value: poolProxyUrl, onChange: (event) => setPoolProxyUrl(event.target.value), className: "font-mono text-xs" })] })) : null, poolFormError ? _jsx("p", { className: "text-xs text-destructive", children: poolFormError }) : null, _jsxs("div", { className: "flex flex-wrap gap-2", children: [_jsx(Button, { size: "sm", "aria-label": formMode === 'create' ? `保存 ${definition.name} API Key` : '保存凭证', disabled: busy || disabled || saving || (formMode === 'create' && !poolApiKey.trim()), onClick: savePoolForm, children: formMode === 'create' ? '保存 API Key' : '保存凭证' }), _jsx(Button, { variant: "ghost", size: "sm", disabled: saving, onClick: closePoolForm, children: "\u53D6\u6D88" }), formMode === 'create' ? (_jsx(Button, { variant: "ghost", size: "sm", disabled: saving, onClick: () => setShowAdvanced((current) => !current), children: showAdvanced ? '收起高级设置' : '高级设置' })) : null] })] })) : null, apiKeyAttempt && !formMode ? (_jsxs("div", { className: "space-y-2", children: [_jsxs("div", { className: "flex items-center justify-between", children: [_jsx("span", { className: "text-sm font-medium", children: "API Key" }), definition.apiKeyUrl ? (_jsx("a", { href: definition.apiKeyUrl, target: "_blank", rel: "noreferrer", className: "text-xs text-primary hover:underline", children: "\u83B7\u53D6 API Key" })) : null] }), _jsxs("div", { className: "group relative", children: [_jsx(Input, { disabled: busy || disabled || saving, type: showKey ? 'text' : 'password', autoComplete: "new-password", "data-lpignore": "true", "data-1p-ignore": true, "aria-label": `${definition.name} API Key 输入`, placeholder: definition.apiKeyPlaceholder || '从官方控制台复制 API Key', value: apiKey, onChange: (event) => onApiKeyChange(event.target.value), className: "border-border/60 bg-muted/20 pr-10 font-mono transition-colors focus:border-primary/50 focus:bg-background" }), _jsx("div", { className: "absolute bottom-1 right-1 top-1 flex items-center", children: _jsx(Button, { variant: "ghost", size: "icon", className: "h-full w-8 rounded hover:bg-muted", onClick: () => setShowKey((current) => !current), "aria-label": showKey ? '隐藏 API Key' : '显示 API Key', children: showKey
+    return (_jsxs("div", { className: cn('space-y-3', formMode && 'w-full'), children: [attempt?.userCode ? (_jsxs("div", { className: "border-l-2 border-primary bg-muted/30 px-3 py-2 text-sm", children: ["\u9A8C\u8BC1\u7801\uFF1A", _jsx("strong", { className: "font-mono", children: attempt.userCode })] })) : null, !initialCreate && !initialEditing ? _jsxs("div", { className: "flex flex-wrap gap-2", children: [onCreateApiKeyCredential && createOfferings.length > 0 ? (_jsxs(Button, { variant: "outline", size: "sm", disabled: busy || disabled || saving, onClick: openCreateForm, children: [_jsx(Plus, { className: "mr-2 h-4 w-4" }), "\u6DFB\u52A0 API Key"] })) : null, hasPoolActions ? null : isConnected ? (_jsxs(_Fragment, { children: [_jsxs(Button, { variant: "outline", size: "sm", disabled: busy || disabled || saving, onClick: onBeginBrowser, children: [busy ? _jsx(Loader2, { className: "mr-2 h-4 w-4 animate-spin" }) : _jsx(RotateCw, { className: "mr-2 h-4 w-4" }), "\u91CD\u65B0\u8FDE\u63A5"] }), _jsxs(Button, { variant: "ghost", size: "sm", disabled: busy || disabled || saving, onClick: onDisconnect, children: [_jsx(LogOut, { className: "mr-2 h-4 w-4" }), "\u65AD\u5F00\u8FDE\u63A5"] })] })) : isConfigured ? (_jsxs(_Fragment, { children: [_jsxs(Button, { variant: "outline", size: "sm", "aria-label": "\u66F4\u65B0 API Key", disabled: busy || disabled || saving, onClick: onBeginApiKey, children: [_jsx(KeyRound, { className: "mr-2 h-4 w-4" }), "\u66F4\u65B0 API Key"] }), _jsx(Button, { variant: "ghost", size: "sm", disabled: busy || disabled || saving, onClick: onDisconnect, children: "\u79FB\u9664\u914D\u7F6E" })] })) : (_jsxs(_Fragment, { children: [browserMethod ? (_jsxs(Button, { variant: "outline", size: "sm", title: browserMethod.lifecycle === 'unavailable' ? browserMethod.reason : undefined, disabled: busy || disabled || saving || browserMethod.lifecycle === 'unavailable', onClick: onBeginBrowser, children: [busy ? _jsx(Loader2, { className: "mr-2 h-4 w-4 animate-spin" }) : _jsx(ExternalLink, { className: "mr-2 h-4 w-4" }), browserMethod.label] })) : null, _jsxs(Button, { variant: "outline", size: "sm", "aria-label": `${definition.name} API Key`, disabled: busy || disabled || saving, onClick: onBeginApiKey, children: [_jsx(KeyRound, { className: "mr-2 h-4 w-4" }), "\u914D\u7F6E API Key"] })] }))] }) : null, formMode ? (_jsxs("div", { className: "space-y-2 rounded-lg border border-border/50 bg-muted/10 p-3", children: [formMode === 'create' && createOfferings.length > 1 ? (_jsxs("label", { className: "block space-y-1 text-xs text-muted-foreground", children: [_jsx("span", { children: "\u5957\u9910 / \u533A\u57DF" }), _jsx(NativeSelect, { "aria-label": `${definition.name} 套餐 / 区域`, value: createOfferingId, disabled: busy || disabled || saving, onChange: (event) => { setCreateOfferingId(event.target.value); setPoolFormError(undefined); }, className: "h-9", children: createOfferings.map((item) => _jsx("option", { value: item.id, children: offeringTitle(item) }, item.id)) })] })) : null, formMode === 'edit' ? (_jsx(Input, { disabled: busy || disabled || saving, autoComplete: "off", "aria-label": `${definition.name} API Key 标签`, placeholder: "\u540D\u79F0\uFF0C\u4F8B\u5982 Work key", value: poolLabel, onChange: (event) => setPoolLabel(event.target.value) })) : null, formMode === 'create' ? (_jsx(Input, { disabled: busy || disabled || saving, type: showKey ? 'text' : 'password', autoComplete: "new-password", "data-lpignore": "true", "data-1p-ignore": true, "aria-label": `${definition.name} API Key 输入`, placeholder: definition.apiKeyPlaceholder || '从官方控制台复制 API Key', value: poolApiKey, onChange: (event) => setPoolApiKey(event.target.value), className: "font-mono" })) : null, formMode === 'edit' || showAdvanced ? (_jsxs(_Fragment, { children: [_jsx(Input, { disabled: busy || disabled || saving, autoComplete: "off", "data-lpignore": "true", "data-1p-ignore": true, "aria-label": `${definition.name} Base URL 输入`, placeholder: offeringEndpoint(formMode === 'edit' ? offering : formOffering) || definition.defaultBaseUrl || '默认服务地址', value: poolBaseUrl, onChange: (event) => setPoolBaseUrl(event.target.value), className: "font-mono text-xs" }), _jsx(Input, { disabled: busy || disabled || saving, autoComplete: "off", "data-lpignore": "true", "data-1p-ignore": true, "aria-label": `${definition.name} Proxy URL 输入`, placeholder: "http://127.0.0.1:7890", value: poolProxyUrl, onChange: (event) => setPoolProxyUrl(event.target.value), className: "font-mono text-xs" })] })) : null, poolFormError ? _jsx("p", { className: "text-xs text-destructive", children: poolFormError }) : null, _jsxs("div", { className: "flex flex-wrap gap-2", children: [_jsx(Button, { size: "sm", "aria-label": formMode === 'create' ? `保存 ${definition.name} API Key` : '保存凭证', disabled: busy || disabled || saving || (formMode === 'create' && !poolApiKey.trim()), onClick: savePoolForm, children: formMode === 'create' ? '保存 API Key' : '保存凭证' }), _jsx(Button, { variant: "ghost", size: "sm", disabled: saving, onClick: closePoolForm, children: "\u53D6\u6D88" }), formMode === 'create' ? (_jsx(Button, { variant: "ghost", size: "sm", disabled: saving, onClick: () => setShowAdvanced((current) => !current), children: showAdvanced ? '收起高级设置' : '高级设置' })) : null] })] })) : null, apiKeyAttempt && !formMode ? (_jsxs("div", { className: "space-y-2", children: [_jsxs("div", { className: "flex items-center justify-between", children: [_jsx("span", { className: "text-sm font-medium", children: "API Key" }), definition.apiKeyUrl ? (_jsx("a", { href: definition.apiKeyUrl, target: "_blank", rel: "noreferrer", className: "text-xs text-primary hover:underline", children: "\u83B7\u53D6 API Key" })) : null] }), _jsxs("div", { className: "group relative", children: [_jsx(Input, { disabled: busy || disabled || saving, type: showKey ? 'text' : 'password', autoComplete: "new-password", "data-lpignore": "true", "data-1p-ignore": true, "aria-label": `${definition.name} API Key 输入`, placeholder: definition.apiKeyPlaceholder || '从官方控制台复制 API Key', value: apiKey, onChange: (event) => onApiKeyChange(event.target.value), className: "border-border/60 bg-muted/20 pr-10 font-mono transition-colors focus:border-primary/50 focus:bg-background" }), _jsx("div", { className: "absolute bottom-1 right-1 top-1 flex items-center", children: _jsx(Button, { variant: "ghost", size: "icon", className: "h-full w-8 rounded hover:bg-muted", onClick: () => setShowKey((current) => !current), "aria-label": showKey ? '隐藏 API Key' : '显示 API Key', children: showKey
                                         ? _jsx(EyeOff, { className: "h-4 w-4 text-muted-foreground" })
                                         : _jsx(Eye, { className: "h-4 w-4 text-muted-foreground" }) }) })] }), onBaseUrlChange ? (_jsxs("div", { className: "space-y-1.5", children: [_jsx("span", { className: "text-xs font-medium text-muted-foreground", children: "Base URL\uFF08\u9009\u586B\uFF09" }), _jsx(Input, { disabled: busy || disabled || saving, autoComplete: "off", "data-lpignore": "true", "data-1p-ignore": true, "aria-label": `${definition.name} Base URL 输入`, placeholder: definition.defaultBaseUrl || '默认服务地址', value: baseUrl, onChange: (event) => onBaseUrlChange(event.target.value), className: "border-border/60 bg-muted/20 font-mono text-xs transition-colors focus:border-primary/50 focus:bg-background" }), _jsxs("p", { className: "break-all font-mono text-[11px] text-muted-foreground opacity-80", children: [_jsx("span", { className: "mr-1 select-none opacity-50", children: "\u9884\u89C8:" }), (baseUrl.trim() || definition.defaultBaseUrl || '').replace(/\/+$/, ''), "/chat/completions"] })] })) : null, _jsx(Button, { size: "sm", "aria-label": `保存 ${definition.name} API Key`, disabled: !apiKey.trim() || busy || disabled, onClick: onSaveApiKey, children: "\u4FDD\u5B58 API Key" })] })) : null, error ? _jsx("p", { className: "text-sm text-destructive", children: error }) : null] }));
 }

package/node_modules/@undefineds.co/ai-connections/dist/AiAuthorizationActions.d.ts

@@ -1,4 +1,4 @@
-import type { AiConnectionsMode, AiProviderAuthorizationMethod, AiProviderOffering } from './contract/ai-connections-client';
+import type { AiConnectionsMode, AiProviderAuthorizationMethod, AiProviderOffering } from './contract/ai-connections-client.js';
 /**
  * The offering's own entries, one button per declared `authorizationMethod`.
  *

package/node_modules/@undefineds.co/ai-connections/dist/AiClientConfigurationSection.d.ts

@@ -1,5 +1,5 @@
 import type { AiClientConfigurationModel } from '@undefineds.co/extension-sdk/web';
-import { normalizeV1Endpoint } from './contract/endpoint-urls';
+import { normalizeV1Endpoint } from './contract/endpoint-urls.js';
 export declare const AI_CONNECTIONS_CLIENTS: readonly ["codex", "claude-code", "pi", "codebuddy"];
 export type AiConnectionsClientId = (typeof AI_CONNECTIONS_CLIENTS)[number];
 export interface AiClientConfigurationStatus {
@@ -24,6 +24,7 @@ export interface AiClientConfigurationDryRun {
     }>;
 }
 export interface AiClientConfigurationBridge {
+    readonly available?: boolean;
     inspect(client: AiConnectionsClientId): Promise<AiClientConfigurationStatus>;
     plan(input: {
         client: AiConnectionsClientId;

package/node_modules/@undefineds.co/ai-connections/dist/AiClientConfigurationSection.js

@@ -22,10 +22,16 @@ export function AiClientIcon({ client, className = 'h-4 w-4' }) {
 }
 export function AiClientConfigurationSection({ bridge, endpoint, client, createClientCredential, manualApiKey, autoApply = false, compact = false, onComplete, }) {
     const [status, setStatus] = useState({ status: 'notConfigured' });
+    // §7.3 第 5–6 步：密钥结果、配置写入、Gateway 检查、客户端验证分开呈现
+    const [stages, setStages] = useState([]);
     const [dryRun, setDryRun] = useState();
     const [confirmationValue, setConfirmationValue] = useState('');
     const [busy, setBusy] = useState(false);
     const autoApplyStarted = useRef(false);
+    /** §7.3 第 3 步：明确选择为这个客户端新建 Key，还是使用用户已有的 Key。 */
+    const [keySource, setKeySource] = useState('create');
+    /** 写入失败后保留的凭据：重试只重写配置，不再新建 Key（§7.3）。 */
+    const leaseRef = useRef(undefined);
     useEffect(() => {
         setDryRun(undefined);
         setConfirmationValue('');
@@ -58,7 +64,23 @@ export function AiClientConfigurationSection({ bridge, endpoint, client, createC
         let lease;
         let applied = false;
         try {
-            lease = await createClientCredential(client);
+            // 已经有上次失败留下的凭据就沿用，只有第一次才申请
+            lease = leaseRef.current;
+            if (!lease) {
+                lease = await createClientCredential(client);
+                leaseRef.current = lease;
+            }
+            setStages([
+                {
+                    id: 'key',
+                    label: '密钥',
+                    state: 'ok',
+                    detail: '本次使用这个 Xpod Key；重试不会新建 Key。',
+                },
+                { id: 'write', label: '配置写入', state: 'unknown', detail: '正在写入配置…' },
+                { id: 'gateway', label: 'Gateway 检查', state: 'unknown', detail: '本步骤未检查 Xpod 网关。' },
+                { id: 'client', label: '客户端验证', state: 'unknown', detail: '配置已写入，尚未验证客户端。' },
+            ]);
             await bridge.apply({
                 client,
                 planId: plan.planId,
@@ -71,6 +93,10 @@ export function AiClientConfigurationSection({ bridge, endpoint, client, createC
                 } : {}),
             });
             applied = true;
+            leaseRef.current = undefined;
+            setStages((current) => current.map((stage) => (stage.id === 'write'
+                ? { ...stage, state: 'ok', detail: '配置已写入；客户端是否已采用仍未验证。' }
+                : stage)));
             setStatus({ status: 'configured' });
             setDryRun(undefined);
             onComplete?.();
@@ -81,13 +107,13 @@ export function AiClientConfigurationSection({ bridge, endpoint, client, createC
                 recoveryMessage = `${AI_CLIENT_LABELS[client]} 配置失败。请重试。`;
             }
             if (lease && !applied) {
-                try {
-                    await lease.revoke();
-                }
-                catch (revokeError) {
-                    recoveryMessage = `${recoveryMessage}；自动撤销 API Key 失败：${errorMessage(revokeError)}。请在“API KEYS”中手动撤销。`;
-                }
+                // §7.3：写入失败时保留这个 Key 和原任务，重试只重写配置，不重复建 Key；
+                // 用户仍可在 API KEYS 里手动撤销。
+                recoveryMessage = `${recoveryMessage}；已保留本次使用的 Xpod Key，重试只会重新写入配置。`;
             }
+            setStages((current) => current.map((stage) => (stage.id === 'write'
+                ? { ...stage, state: 'failed', detail: recoveryMessage }
+                : stage)));
             setStatus(failedAndRestoredError(error)
                 ? { status: 'failedAndRestored', message: '配置写入失败，已自动恢复原配置。' }
                 : { status: 'unavailable', message: recoveryMessage });
@@ -148,11 +174,14 @@ export function AiClientConfigurationSection({ bridge, endpoint, client, createC
     const confirmation = dryRun?.confirmation;
     const confirmationSatisfied = !confirmation?.required || confirmationValue === confirmation.token;
     const clientLabel = AI_CLIENT_LABELS[client];
-    const manual = !bridge;
+    // 选择「使用已有 Key」时走手动配置路径：本页不申请新凭据，只给可复制的配置
+    const manual = !bridge || keySource === 'existing';
     const manualConfig = manualConfigurationText(client, endpoint, manualApiKey);
-    return (_jsxs("div", { className: compact ? '' : 'overflow-hidden rounded-md border border-border/60', children: [!compact ? _jsxs("div", { className: "flex flex-wrap items-center gap-2 px-3 py-2", children: [_jsx("span", { className: "flex h-8 w-8 shrink-0 items-center justify-center rounded-md bg-muted text-muted-foreground", children: _jsx(AiClientIcon, { client: client }) }), _jsxs("div", { className: "min-w-[10rem] flex-1", children: [_jsx("div", { className: "text-sm font-medium", children: clientLabel }), !manual ? _jsx("div", { className: "mt-0.5 text-xs text-muted-foreground", children: status.message ?? (status.status === 'configured'
+    return (_jsxs("div", { className: compact ? '' : 'overflow-hidden rounded-md border border-border/60', children: [bridge && createClientCredential ? (_jsxs("div", { className: "border-b border-border/60 px-3 py-2", children: [_jsxs("div", { role: "tablist", "aria-label": `${clientLabel} 的 Key 来源`, className: "flex flex-wrap gap-2", children: [_jsx("button", { type: "button", role: "tab", "aria-selected": keySource === 'create', "data-testid": "client-key-source-create", className: `rounded-lg border px-3 py-1 text-xs ${keySource === 'create' ? 'border-primary bg-accent text-accent-foreground' : 'border-border text-foreground hover:bg-accent/60'}`, onClick: () => setKeySource('create'), children: "\u4E3A\u8FD9\u4E2A\u5BA2\u6237\u7AEF\u65B0\u5EFA Key" }), _jsx("button", { type: "button", role: "tab", "aria-selected": keySource === 'existing', "data-testid": "client-key-source-existing", className: `rounded-lg border px-3 py-1 text-xs ${keySource === 'existing' ? 'border-primary bg-accent text-accent-foreground' : 'border-border text-foreground hover:bg-accent/60'}`, onClick: () => setKeySource('existing'), children: "\u4F7F\u7528\u6211\u5DF2\u7ECF\u6709\u7684 Key" })] }), _jsx("p", { className: "mt-1 text-xs text-muted-foreground", children: keySource === 'existing'
+                            ? '本页不会新建 Key：请把已有 Key 粘进客户端配置。共用一个 Key 时，停用它会影响所有使用它的客户端。'
+                            : '会为这个客户端单独创建一个 Key；停用只影响它自己。' })] })) : null, !compact ? _jsxs("div", { className: "flex flex-wrap items-center gap-2 px-3 py-2", children: [_jsx("span", { className: "flex h-8 w-8 shrink-0 items-center justify-center rounded-md bg-muted text-muted-foreground", children: _jsx(AiClientIcon, { client: client }) }), _jsxs("div", { className: "min-w-[10rem] flex-1", children: [_jsx("div", { className: "text-sm font-medium", children: clientLabel }), !manual ? _jsx("div", { className: "mt-0.5 text-xs text-muted-foreground", children: status.message ?? (status.status === 'configured'
                                     ? `${clientLabel} 正在使用 Xpod。`
-                                    : '可自动写入本机配置。') }) : null] }), !manual ? _jsx(Badge, { variant: "secondary", children: statusLabel(status.status) }) : null, manual ? (_jsx(AiCopyButton, { value: manualConfig, label: `${clientLabel} 配置`, variant: "ghost", size: "icon", iconClassName: "h-4 w-4" })) : (_jsxs("div", { className: "flex items-center gap-1", children: [_jsx(Button, { variant: "outline", size: "sm", "aria-label": `配置 ${clientLabel}`, disabled: busy, onClick: () => void plan(), children: "\u914D\u7F6E" }), _jsx(Button, { variant: "ghost", size: "icon", "aria-label": `恢复 ${clientLabel} 配置`, disabled: status.status === 'notConfigured' || busy, onClick: () => void restore(), children: _jsx(RotateCcw, { className: "h-4 w-4" }) })] }))] }) : null, compact && busy ? (_jsxs("div", { className: "py-1 text-xs text-muted-foreground", children: ["\u6B63\u5728\u5E94\u7528 ", clientLabel, " \u914D\u7F6E\u2026"] })) : null, compact && !busy && status.message ? (_jsxs("div", { className: "flex flex-wrap items-center justify-between gap-2 py-1 text-xs text-destructive", children: [_jsx("span", { children: status.message }), _jsx(Button, { variant: "outline", size: "sm", onClick: () => void plan(), children: "\u91CD\u8BD5\u5E94\u7528\u914D\u7F6E" })] })) : null, dryRun ? (_jsxs("div", { className: "space-y-3 border-t border-border/60 bg-muted/20 px-4 py-3", children: [_jsx("div", { className: "text-xs font-medium", children: "\u5C06\u6267\u884C\u4EE5\u4E0B\u66F4\u6539" }), dryRun.changes.map((change) => (_jsxs("div", { className: "text-xs text-muted-foreground", children: [_jsx("span", { className: "font-mono", children: change.target }), ' · ', changeActionLabel(change.action), change.backup ? ' · 创建备份' : ''] }, `${change.target}:${change.action}`))), confirmation?.required ? (_jsxs("div", { className: "space-y-2", children: [confirmation.message ? _jsx("div", { className: "text-xs text-muted-foreground", children: confirmation.message }) : null, _jsxs("div", { className: "text-xs text-muted-foreground", children: ["\u786E\u8BA4\u7801\uFF1A", _jsx("code", { className: "font-mono text-foreground", children: confirmation.token })] }), _jsx(Input, { "aria-label": `输入确认码以应用 ${clientLabel} 配置`, value: confirmationValue, onChange: (event) => setConfirmationValue(event.target.value) })] })) : null, _jsxs("div", { className: "flex gap-2", children: [_jsx(Button, { size: "sm", "aria-label": confirmation?.required
+                                    : '可自动写入本机配置。') }) : null] }), !manual ? _jsx(Badge, { variant: "secondary", children: statusLabel(status.status) }) : null, manual ? (_jsx(AiCopyButton, { value: manualConfig, label: `${clientLabel} 配置`, variant: "ghost", size: "icon", iconClassName: "h-4 w-4" })) : (_jsxs("div", { className: "flex items-center gap-1", children: [_jsx(Button, { variant: "outline", size: "sm", "aria-label": `配置 ${clientLabel}`, disabled: busy, onClick: () => void plan(), children: "\u914D\u7F6E" }), _jsx(Button, { variant: "ghost", size: "icon", "aria-label": `恢复 ${clientLabel} 配置`, disabled: status.status === 'notConfigured' || busy, onClick: () => void restore(), children: _jsx(RotateCcw, { className: "h-4 w-4" }) })] }))] }) : null, compact && busy ? (_jsxs("div", { className: "py-1 text-xs text-muted-foreground", children: ["\u6B63\u5728\u5E94\u7528 ", clientLabel, " \u914D\u7F6E\u2026"] })) : null, compact && !busy && status.message ? (_jsxs("div", { className: "flex flex-wrap items-center justify-between gap-2 py-1 text-xs text-destructive", children: [_jsx("span", { children: status.message }), _jsx(Button, { variant: "outline", size: "sm", onClick: () => void plan(), children: "\u91CD\u8BD5\u5E94\u7528\u914D\u7F6E" })] })) : null, stages.length > 0 ? (_jsx("ul", { "data-testid": "client-setup-stages", className: "space-y-1 border-t border-border/60 px-4 py-3 text-xs", children: stages.map((stage) => (_jsxs("li", { "data-testid": "client-setup-stage", "data-stage": stage.id, "data-stage-state": stage.state, className: "flex gap-2", children: [_jsx("span", { "aria-hidden": "true", children: stage.state === 'ok' ? '✓' : stage.state === 'failed' ? '✕' : '?' }), _jsx("span", { className: "font-medium", children: stage.label }), _jsx("span", { className: "min-w-0 flex-1 text-muted-foreground", children: stage.detail })] }, stage.id))) })) : null, dryRun ? (_jsxs("div", { className: "space-y-3 border-t border-border/60 bg-muted/20 px-4 py-3", children: [_jsx("div", { className: "text-xs font-medium", children: "\u5C06\u6267\u884C\u4EE5\u4E0B\u66F4\u6539" }), dryRun.changes.map((change) => (_jsxs("div", { className: "text-xs text-muted-foreground", children: [_jsx("span", { className: "font-mono", children: change.target }), ' · ', changeActionLabel(change.action), change.backup ? ' · 创建备份' : ''] }, `${change.target}:${change.action}`))), confirmation?.required ? (_jsxs("div", { className: "space-y-2", children: [confirmation.message ? _jsx("div", { className: "text-xs text-muted-foreground", children: confirmation.message }) : null, _jsxs("div", { className: "text-xs text-muted-foreground", children: ["\u786E\u8BA4\u7801\uFF1A", _jsx("code", { className: "font-mono text-foreground", children: confirmation.token })] }), _jsx(Input, { "aria-label": `输入确认码以应用 ${clientLabel} 配置`, value: confirmationValue, onChange: (event) => setConfirmationValue(event.target.value) })] })) : null, _jsxs("div", { className: "flex gap-2", children: [_jsx(Button, { size: "sm", "aria-label": confirmation?.required
                                     ? `确认并应用 ${clientLabel} 配置`
                                     : `应用 ${clientLabel} 配置`, disabled: !createClientCredential || busy || !confirmationSatisfied, onClick: () => void apply(), children: confirmation?.required ? '确认并应用' : '应用配置' }), _jsx(Button, { variant: "ghost", size: "sm", disabled: busy, onClick: () => {
                                     setDryRun(undefined);

package/node_modules/@undefineds.co/ai-connections/dist/AiConnectDialog.d.ts

@@ -1,8 +1,8 @@
-import type { AiConnectAttempt, AiConnectionsMode, AiProviderAuthorizationMethod, AiProviderCredentialSummary, AiProviderOffering } from './contract/ai-connections-client';
-import type { AiProviderDefinition } from './controller';
-import type { ProviderConnectionState } from './AiProviderCard';
-import type { AiOfferingActionError } from './AiCredentialPoolSection';
-import type { AiConnectDialogController } from './useAiConnectDialog';
+import type { AiConnectAttempt, AiConnectionsMode, AiProviderAuthorizationMethod, AiProviderCredentialSummary, AiProviderOffering } from './contract/ai-connections-client.js';
+import type { AiProviderDefinition } from './controller.js';
+import type { ProviderConnectionState } from './AiProviderCard.js';
+import type { AiOfferingActionError } from './AiCredentialPoolSection.js';
+import type { AiConnectDialogController } from './useAiConnectDialog.js';
 /**
  * The connect dialog: one fieldset per offering, each showing whichever step that
  * offering is on - unavailable, waiting for an authorization, failed, or the API

package/node_modules/@undefineds.co/ai-connections/dist/AiConnectDialog.js

@@ -1,7 +1,7 @@
-import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { jsx as _jsx, Fragment as _Fragment, jsxs as _jsxs } from "react/jsx-runtime";
 import { Button, Dialog, DialogContent, DialogHeader, DialogTitle, LoginConnectingView, LoginFailureView, } from '@undefineds.co/shared-ui';
-import { offeringTitle } from './offering-label.js';
-import { authorizationMethodsForOffering, connectModeForMethod, isApiKeyMethod, isOAuthMethod, isOAuthMode, isPendingAttempt, modeForOffering, } from './authorization-methods.js';
+import { offeringTitle, offeringUnavailableMessage } from './offering-label.js';
+import { authorizationMethodsForOffering, connectModeForMethod, isApiKeyMethod, isBrowserConnectMethod, isOAuthMethod, isOAuthMode, isPendingAttempt, modeForOffering, } from './authorization-methods.js';
 import { AiApiKeyPool } from './AiApiKeyPool.js';
 /**
  * The connect dialog: one fieldset per offering, each showing whichever step that
@@ -22,7 +22,10 @@ export function AiConnectDialog({ controller, definition, offerings, apiOffering
                     signature: attempt.signature, ...(attempt.offeringId ? { offeringId: attempt.offeringId } : {}) });
             }
             controller.close();
-        }, children: _jsxs(DialogContent, { className: "max-h-[85vh] overflow-y-auto sm:max-w-lg", "aria-describedby": undefined, children: [_jsx(DialogHeader, { children: _jsx(DialogTitle, { children: controller.title }) }), _jsx("div", { className: "space-y-5", "aria-label": "\u6DFB\u52A0\u8FDE\u63A5", children: dialogOfferings.map((offering) => {
+        }, children: _jsxs(DialogContent, { className: "max-h-[85vh] overflow-y-auto sm:max-w-lg", "aria-describedby": undefined, children: [_jsx(DialogHeader, { children: _jsx(DialogTitle, { children: controller.title }) }), _jsx("div", { className: "space-y-5", "aria-label": "\u6DFB\u52A0\u8FDE\u63A5", children: controller.choosingConsole ? _jsxs(_Fragment, { children: [_jsx("p", { className: "text-sm text-muted-foreground", children: "\u6253\u5F00\u670D\u52A1\u5546\u63A7\u5236\u53F0\u521B\u5EFA API Key\uFF0C\u518D\u56DE\u5230 Xpod \u586B\u5199\u3002\u6B64\u5165\u53E3\u4E0D\u4F1A\u8FDB\u884C\u8D26\u53F7\u6388\u6743\u3002" }), offerings.map((offering) => {
+                                const method = authorizationMethodsForOffering(offering).find(isBrowserConnectMethod);
+                                return method ? _jsx(Button, { variant: "outline", className: "w-full", disabled: busy || disabled || method.lifecycle !== 'active', title: method.reason, onClick: () => controller.beginBrowser(offering, method), children: offeringTitle(offering) }, offering.id) : null;
+                            })] }) : dialogOfferings.map((offering) => {
                         const otherAuthorizationPending = isPendingAttempt(attempt) && isOAuthMode(attempt?.mode)
                             && (attemptOfferingId ?? attempt?.offeringId) !== offering.id;
                         const actionDisabled = disabled || saving || otherAuthorizationPending;
@@ -36,9 +39,7 @@ export function AiConnectDialog({ controller, definition, offerings, apiOffering
                         const attemptedMode = authorizationError?.mode ?? offeringAttempt?.mode ?? (attemptedMethod ? connectModeForMethod(attemptedMethod) : modeForOffering(offering));
                         const offeringError = error?.offeringId === offering.id ? error.message : undefined;
                         if (offering.lifecycle === 'unavailable' && activeMethods.length === 0) {
-                            return _jsxs("fieldset", { "data-create-offering": offering.id, className: "space-y-2 border-t border-border/50 pt-3 first:border-t-0 first:pt-0", children: [_jsx("legend", { className: "px-1 text-sm font-medium", children: offeringTitle(offering) }), _jsx("p", { className: "text-xs text-muted-foreground", children: offering.kind === 'oauth-subscription'
-                                            ? '暂不可用：账号订阅需在 Xpod 桌面版中导入本机客户端（如 Codex CLI）的登录态，浏览器中无法完成。'
-                                            : '暂不可用：该接入方式尚未提供可用的连接流程。' })] }, offering.id);
+                            return _jsxs("fieldset", { "data-create-offering": offering.id, className: "space-y-2 border-t border-border/50 pt-3 first:border-t-0 first:pt-0", children: [_jsx("legend", { className: "px-1 text-sm font-medium", children: offeringTitle(offering) }), _jsx("p", { className: "text-xs text-muted-foreground", children: offeringUnavailableMessage(offering) })] }, offering.id);
                         }
                         const failedAuthorizationMode = authorizationError?.mode;
                         if (offeringError && isOAuthMode(failedAuthorizationMode)) {
@@ -59,6 +60,6 @@ export function AiConnectDialog({ controller, definition, offerings, apiOffering
                                             controller.close();
                                         }, children: "\u53D6\u6D88\u8FDE\u63A5" })] }, offering.id);
                         }
-                        return _jsxs("fieldset", { "data-create-offering": offering.id, disabled: actionDisabled, className: "space-y-3 border-t border-border/50 pt-3 first:border-t-0 first:pt-0", "aria-label": `${offeringTitle(offering)}接入操作`, children: [_jsx("legend", { className: "px-1 text-sm font-medium", children: offeringTitle(offering) }), supportsApiKey ? _jsx(AiApiKeyPool, { definition: definition, offering: offering, status: status, createOfferings: [offering], initialCreate: !editing, credentials: credentials, initialEditing: editing?.offeringId === offering.id ? editing : undefined, onCloseEdit: controller.close, onSavingChange: controller.setSaving, attempt: offeringAttempt ?? (attempt?.mode === 'browserAssistedApiKey' ? attempt : undefined), apiKey: apiKey, baseUrl: baseUrl, busy: busy, disabled: actionDisabled, onApiKeyChange: onApiKeyChange, onBaseUrlChange: onBaseUrlChange, onBeginApiKey: onBeginApiKey, onBeginBrowser: onBeginBrowser, onSaveApiKey: onSaveApiKey, onDisconnect: onDisconnect, onUpdateCredential: onUpdateCredential, onCreateApiKeyCredential: onCreateApiKeyCredential }, `${offering.id}:${editing?.id ?? ''}`) : null, authorizationOfferingId && !offeringError ? _jsx(LoginConnectingView, { title: "\u6B63\u5728\u8FDE\u63A5", detail: "\u6B63\u5728\u542F\u52A8\u6388\u6743\uFF0C\u8BF7\u7A0D\u5019\u3002", providerLabel: offeringTitle(offering), providerHost: definition.name }) : null, offeringError ? _jsx("p", { className: "w-full text-sm text-destructive", children: offeringError }) : null] }, offering.id);
+                        return _jsxs("fieldset", { "data-create-offering": offering.id, disabled: actionDisabled, className: "space-y-3 border-t border-border/50 pt-3 first:border-t-0 first:pt-0", "aria-label": `${offeringTitle(offering)}接入操作`, children: [_jsx("legend", { className: "px-1 text-sm font-medium", children: offeringTitle(offering) }), supportsApiKey && authorizationOfferingId ? _jsx("p", { className: "text-sm text-muted-foreground", children: "\u8BF7\u5728\u63A7\u5236\u53F0\u521B\u5EFA API Key\uFF0C\u518D\u8FD4\u56DE\u6B64\u5904\u586B\u5199\uFF1B\u65E0\u9700\u7B49\u5F85\u7F51\u9875\u6388\u6743\u3002" }) : null, supportsApiKey ? _jsx(AiApiKeyPool, { definition: definition, offering: offering, status: status, createOfferings: [offering], initialCreate: !editing, credentials: credentials, initialEditing: editing?.offeringId === offering.id ? editing : undefined, onCloseEdit: controller.close, onSavingChange: controller.setSaving, attempt: offeringAttempt ?? (!attemptOfferingId && !attempt?.offeringId && attempt?.mode === 'browserAssistedApiKey' ? attempt : undefined), apiKey: apiKey, baseUrl: baseUrl, busy: busy, disabled: actionDisabled, onApiKeyChange: onApiKeyChange, onBaseUrlChange: onBaseUrlChange, onBeginApiKey: onBeginApiKey, onBeginBrowser: onBeginBrowser, onSaveApiKey: onSaveApiKey, onDisconnect: onDisconnect, onUpdateCredential: onUpdateCredential, onCreateApiKeyCredential: onCreateApiKeyCredential }, `${offering.id}:${editing?.id ?? ''}`) : null, authorizationOfferingId && !supportsApiKey && !offeringError ? _jsx(LoginConnectingView, { title: "\u6B63\u5728\u8FDE\u63A5", detail: "\u6B63\u5728\u542F\u52A8\u6388\u6743\uFF0C\u8BF7\u7A0D\u5019\u3002", providerLabel: offeringTitle(offering), providerHost: definition.name }) : null, offeringError ? _jsx("p", { className: "w-full text-sm text-destructive", children: offeringError }) : null] }, offering.id);
                     }) }), dialogError ? _jsx("p", { role: "alert", className: "text-sm text-destructive", children: dialogError }) : null] }) }));
 }

package/node_modules/@undefineds.co/ai-connections/dist/AiConnectionsHeader.d.ts

@@ -1,3 +1,3 @@
 import type { AppletSlotProps } from '@undefineds.co/extension-sdk/web';
-import { type AiConnectionsController } from './controller';
+import { type AiConnectionsController } from './controller.js';
 export declare function AiConnectionsHeader({ controller, }: AppletSlotProps<AiConnectionsController>): import("react").JSX.Element;

package/node_modules/@undefineds.co/ai-connections/dist/AiConnectionsHeader.js

@@ -1,6 +1,6 @@
 import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
-import { Button, Input } from '@undefineds.co/shared-ui';
-import { Plus, Search } from 'lucide-react';
+import { Button, SearchInput } from '@undefineds.co/shared-ui';
+import { Plus } from 'lucide-react';
 import { useState } from 'react';
 import { AiCustomProviderDialog } from './AiCustomProviderDialog.js';
 import { useProviderSearch, } from './controller.js';
@@ -11,7 +11,7 @@ export function AiConnectionsHeader({ controller, }) {
     const [customProviderError, setCustomProviderError] = useState();
     const saveCustomProvider = async (value) => {
         if (!controller.client) {
-            setCustomProviderError('请先登录后再添加自定义 Provider。');
+            setCustomProviderError('请先登录后再添加自定义服务商。');
             return;
         }
         setSavingCustomProvider(true);
@@ -39,5 +39,5 @@ export function AiConnectionsHeader({ controller, }) {
             setSavingCustomProvider(false);
         }
     };
-    return (_jsxs(_Fragment, { children: [_jsxs("div", { className: "flex h-full min-w-0 items-center gap-2 px-3", children: [_jsxs("div", { className: "relative min-w-0 flex-1", children: [_jsx(Search, { "aria-hidden": "true", className: "pointer-events-none absolute left-2.5 top-1/2 h-3.5 w-3.5 -translate-y-1/2 text-muted-foreground" }), _jsx(Input, { type: "search", "aria-label": "\u641C\u7D22 Provider", placeholder: "\u641C\u7D22 Provider", value: searchQuery, onChange: (event) => controller.setSearchQuery(event.target.value), className: "h-8 border-transparent bg-muted/50 pl-8 text-xs focus-visible:bg-background" })] }), _jsx(Button, { type: "button", variant: "ghost", size: "icon", className: "h-8 w-8 shrink-0", "aria-label": "\u6DFB\u52A0 AI Connection", title: "\u6DFB\u52A0 AI Connection", onClick: () => setCustomDialogOpen(true), children: _jsx(Plus, { className: "h-4 w-4", "aria-hidden": "true" }) })] }), _jsx(AiCustomProviderDialog, { open: customDialogOpen, saving: savingCustomProvider, error: customProviderError, onOpenChange: setCustomDialogOpen, onSave: (value) => void saveCustomProvider(value) })] }));
+    return (_jsxs(_Fragment, { children: [_jsxs("div", { className: "flex h-full min-w-0 items-center gap-2 px-3", children: [_jsx("div", { className: "relative min-w-0 flex-1", children: _jsx(SearchInput, { "aria-label": "\u641C\u7D22\u670D\u52A1\u5546", value: searchQuery, onChange: (event) => controller.setSearchQuery(event.target.value) }) }), _jsx(Button, { type: "button", variant: "ghost", size: "icon", className: "h-8 w-8 shrink-0", "aria-label": "\u6DFB\u52A0 AI Connection", title: "\u6DFB\u52A0 AI Connection", onClick: () => setCustomDialogOpen(true), children: _jsx(Plus, { className: "h-4 w-4", "aria-hidden": "true" }) })] }), _jsx(AiCustomProviderDialog, { open: customDialogOpen, saving: savingCustomProvider, error: customProviderError, onOpenChange: setCustomDialogOpen, onSave: (value) => void saveCustomProvider(value) })] }));
 }

package/node_modules/@undefineds.co/ai-connections/dist/AiConnectionsList.d.ts

@@ -1,4 +1,4 @@
-import type { AiConnectionsController } from './controller';
+import type { AiConnectionsController } from './controller.js';
 export declare function AiConnectionsList({ controller }: {
     controller: AiConnectionsController;
 }): import("react").JSX.Element;

package/node_modules/@undefineds.co/ai-connections/dist/AiConnectionsList.js

@@ -1,6 +1,6 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { useContext, useRef } from 'react';
-import { Avatar, AvatarFallback, AvatarImage, cn } from '@undefineds.co/shared-ui';
+import { Avatar, AvatarFallback, AvatarImage, InlineNotice, StatusDot, cn } from '@undefineds.co/shared-ui';
 import { WorkspaceLayoutContext } from '@undefineds.co/extension-sdk/react';
 import { XPOD_AVATAR, getProviderAvatar, getProviderAvatarBackground } from './provider-visuals.js';
 import { AI_CONNECTIONS_PINNED_SECTIONS, PROVIDERS, useAvailableProviders, useProviderLoadError, useProviderProducts, useProviderSearch, useProviderStates, useSelectedCredentialId, useSelectedProvider, useSelectedSection, } from './controller.js';
@@ -26,9 +26,10 @@ export function AiConnectionsList({ controller }) {
     const providers = searchQuery
         ? providerItems.filter((provider) => providerDisplayName(provider, providerProducts).toLocaleLowerCase().includes(searchQuery))
         : providerItems;
+    const shownProviders = providers;
     const items = [
         ...AI_CONNECTIONS_PINNED_SECTIONS.map((section) => ({ kind: 'section', id: section.id, label: section.label })),
-        ...providers.map((provider) => ({ kind: 'provider', provider })),
+        ...shownProviders.map((provider) => ({ kind: 'provider', provider })),
     ];
     const optionRefs = useRef([]);
     const selectedIndex = items.findIndex((item) => item.kind === 'section'
@@ -42,17 +43,17 @@ export function AiConnectionsList({ controller }) {
         if (workspace?.mode === 'stack')
             workspace.openMain();
     };
-    return (_jsxs("div", { role: "listbox", "aria-label": "AI \u670D\u52A1", "aria-orientation": "vertical", className: "py-2", children: [_jsx("section", { className: "mb-3", "aria-label": "API Keys", children: items.filter((item) => item.kind === 'section').map((item) => {
+    return (_jsxs("div", { role: "listbox", "aria-label": "AI \u670D\u52A1", "aria-orientation": "vertical", className: "py-2", children: [_jsx("section", { className: "mb-3", "aria-label": "Xpod \u5BC6\u94A5", children: items.filter((item) => item.kind === 'section').map((item) => {
                     const index = items.indexOf(item);
                     return (_jsxs(WorkspaceOption, { index: index, selected: selectedSection === item.id, tabbable: selectedIndex === index || (selectedIndex < 0 && index === 0), label: item.label, optionRefs: optionRefs, onActivate: () => activate(item), onMove: (nextIndex) => moveSelection(items, nextIndex, controller, optionRefs), children: [_jsx(PinnedMark, { section: item.id }), _jsx("span", { className: cn('min-w-0 flex-1 truncate text-sm font-medium', selectedSection === item.id ? 'text-foreground' : 'text-foreground/80'), children: item.label })] }, item.id));
-                }) }), _jsxs("section", { children: [_jsx("h2", { className: "px-5 py-1 text-[11px] font-semibold uppercase tracking-wider text-muted-foreground", children: "Provider" }), providers.map((provider) => {
+                }) }), _jsxs("section", { "data-testid": "ai-provider-section", children: [_jsx("div", { className: "flex items-center justify-between gap-2 px-5 py-1", children: _jsx("h2", { className: "text-[11px] font-semibold uppercase tracking-wider text-muted-foreground", children: "\u670D\u52A1\u5546" }) }), shownProviders.map((provider) => {
                         const index = items.findIndex((item) => item.kind === 'provider'
                             && item.provider.id === provider.id
                             && item.provider.credentialId === provider.credentialId);
                         const selected = selectedSection === 'provider' && selectedProvider === provider.id && provider.credentialId === selectedCredentialId;
                         const state = providerStates[provider.id] ?? 'loading';
                         return (_jsxs(WorkspaceOption, { index: index, selected: selected, tabbable: selected || (selectedIndex < 0 && index === 0), label: providerDisplayName(provider, providerProducts), describedBy: `ai-connections-provider-${provider.id}-${provider.credentialId ?? 'default'}-status`, optionRefs: optionRefs, onActivate: () => activate({ kind: 'provider', provider }), onMove: (nextIndex) => moveSelection(items, nextIndex, controller, optionRefs), children: [_jsxs(Avatar, { className: "h-9 w-9 shrink-0 rounded-md border border-border/20", style: getProviderAvatarBackground(provider.id) ? { backgroundColor: getProviderAvatarBackground(provider.id) } : undefined, children: [_jsx(AvatarImage, { src: getProviderAvatar(provider.id), className: "object-cover" }), _jsx(AvatarFallback, { className: "rounded-md bg-muted text-[10px] font-bold uppercase text-muted-foreground", children: providerMark(provider.id) })] }), _jsx("span", { className: cn('min-w-0 flex-1 truncate text-sm font-medium', selected ? 'text-foreground' : 'text-foreground/80'), children: providerDisplayName(provider, providerProducts) }), _jsx(ProviderStateIndicator, { state: state, statusId: `ai-connections-provider-${provider.id}-${provider.credentialId ?? 'default'}-status` })] }, `${provider.id}:${provider.credentialId ?? 'default'}`));
-                    }), providers.length === 0 ? (_jsx("p", { className: "p-8 text-center text-xs text-muted-foreground", children: "\u65E0\u7ED3\u679C" })) : null] }), providerLoadError ? (_jsxs("p", { className: "px-4 py-2 text-xs text-destructive", children: ["Provider \u72B6\u6001\u8BFB\u53D6\u5931\u8D25\uFF1A", providerLoadError] })) : null] }));
+                    }), shownProviders.length === 0 ? (_jsx("p", { className: "p-8 text-center text-xs text-muted-foreground", children: "\u65E0\u7ED3\u679C" })) : null] }), providerLoadError ? (_jsx("div", { className: "px-4 py-2", children: _jsxs(InlineNotice, { tone: "destructive", role: "alert", className: "text-xs", children: ["\u8FDE\u63A5\u72B6\u6001\u8BFB\u53D6\u5931\u8D25\uFF1A", providerLoadError] }) })) : null] }));
 }
 function WorkspaceOption({ index, selected, tabbable, label, describedBy, statusId, optionRefs, onActivate, onMove, children, }) {
     const handleKeyDown = (event) => {
@@ -98,7 +99,7 @@ function PinnedMark({ section: _section }) {
 }
 function ProviderStateIndicator({ state, statusId, }) {
     const active = state === 'configured' || state === 'connected';
-    return (_jsxs("span", { id: statusId, role: "status", "aria-live": "polite", className: "flex shrink-0 items-center gap-1.5", children: [active ? _jsx("span", { className: "h-2 w-2 rounded-full bg-primary", "aria-hidden": "true" }) : null, _jsx("span", { className: "text-[11px] font-normal text-muted-foreground", children: providerStateLabel(state) })] }));
+    return (_jsxs("span", { id: statusId, role: "status", "aria-live": "polite", className: "flex shrink-0 items-center gap-1.5", children: [active ? _jsx(StatusDot, { tone: "info" }) : null, _jsx("span", { className: "text-[11px] font-normal text-muted-foreground", children: providerStateLabel(state) })] }));
 }
 function providerMark(provider) {
     switch (provider) {

package/node_modules/@undefineds.co/ai-connections/dist/AiConnectionsMain.d.ts

@@ -1,4 +1,4 @@
-import { type AiConnectionsController } from './controller';
+import { type AiConnectionsController } from './controller.js';
 /**
  * The page's live credentials table.
  *

package/node_modules/@undefineds.co/ai-connections/dist/AiConnectionsMain.js

@@ -60,9 +60,9 @@ function AiConnectionsMainBody({ controller, renderToaster, liveCredentialRows,
         return () => controller.cancelProviderLoads();
     }, [controller, liveRevision]);
     if (!controller.client) {
-        return (_jsxs("section", { role: "alert", "aria-label": "AI Connections unavailable", children: [_jsx("h2", { children: "AI Connections \u5C1A\u672A\u5C31\u7EEA" }), _jsx("p", { children: "\u5BBF\u4E3B\u9700\u8981\u5148\u63D0\u4F9B\u5DF2\u767B\u5F55\u7684 WebID \u548C\u53EF\u7528\u7684 Pod\u3002" })] }));
+        return (_jsxs("section", { role: "alert", "aria-label": "AI \u8FDE\u63A5\u5C1A\u672A\u5C31\u7EEA", children: [_jsx("h2", { children: "AI \u8FDE\u63A5\u5C1A\u672A\u5C31\u7EEA" }), _jsx("p", { children: "\u5BBF\u4E3B\u9700\u8981\u5148\u63D0\u4F9B\u5DF2\u767B\u5F55\u7684 WebID \u548C\u53EF\u7528\u7684 Pod\u3002" })] }));
     }
-    return (_jsx("section", { role: "region", "aria-label": regionLabel, children: _jsx(AiConnectionsPanel, { client: controller.client, renderToaster: renderToaster, clientConfigurationBridge: controller.clientConfigurationBridge, selectedSection: selectedSection, selectedProvider: selectedProvider, selectedCredentialId: selectedCredentialId, openExternal: controller.openExternal, providerSummaries: providerSummaries, providerProducts: scopedProducts, providerLoadError: providerLoadError, providerLoading: !providerProducts[selectedProvider] && !providerLoadError, onProviderStateChange: controller.setProviderState, liveRevision: liveRevision, liveCredentialRows: liveCredentialRows }) }));
+    return (_jsx("section", { role: "region", "aria-label": regionLabel, children: _jsx(AiConnectionsPanel, { client: controller.client, onAuthorizeService: controller.authorizeService, renderToaster: renderToaster, clientConfigurationBridge: controller.clientConfigurationBridge, selectedSection: selectedSection, selectedProvider: selectedProvider, selectedCredentialId: selectedCredentialId, openExternal: controller.openExternal, providerSummaries: providerSummaries, providerProducts: scopedProducts, providerLoadError: providerLoadError, providerLoading: !providerProducts[selectedProvider] && !providerLoadError, onProviderStateChange: controller.setProviderState, liveRevision: liveRevision, liveCredentialRows: liveCredentialRows }) }));
 }
 function scopedCustomOfferings(product, credential) {
     if (!credential)

package/node_modules/@undefineds.co/ai-connections/dist/AiConnectionsMainHeader.d.ts

@@ -1,3 +1,3 @@
 import type { AppletSlotProps } from '@undefineds.co/extension-sdk/web';
-import { type AiConnectionsController } from './controller';
+import { type AiConnectionsController } from './controller.js';
 export declare function AiConnectionsMainHeader({ controller, }: AppletSlotProps<AiConnectionsController>): import("react").JSX.Element;