@undefineds.co/xpod 0.4.20 → 0.4.27

package/node_modules/@inrupt/solid-client-authn-core/dist/index.js

@@ -1209,11 +1209,14 @@ function normalizeHTU(audience) {
  * @param dpopKey Key used to sign the token.
  * @returns A JWT that can be used as a DPoP Authorization header.
  */
-async function createDpopHeader(audience, method, dpopKey) {
+async function createDpopHeader(audience, method, dpopKey, accessToken) {
     return new jose.SignJWT({
         htu: normalizeHTU(audience),
         htm: method.toUpperCase(),
         jti: uuid.v4(),
+        ...(accessToken === undefined ? {} : { ath: jose.base64url.encode(
+            new Uint8Array(await globalThis.crypto.subtle.digest("SHA-256", new TextEncoder().encode(accessToken)))
+        ) }),
     })
         .setProtectedHeader({
         alg: PREFERRED_SIGNING_ALG[0],
@@ -1269,7 +1272,7 @@ async function buildDpopFetchOptions(targetUrl, authToken, dpopKey, defaultOptio
     const headers = new Headers(defaultOptions?.headers);
     // Any pre-existing Authorization header should be overriden.
     headers.set("Authorization", `DPoP ${authToken}`);
-    headers.set("DPoP", await createDpopHeader(targetUrl, defaultOptions?.method ?? "get", dpopKey));
+    headers.set("DPoP", await createDpopHeader(targetUrl, defaultOptions?.method ?? "get", dpopKey, authToken));
     return {
         ...defaultOptions,
         headers,
@@ -1324,6 +1327,12 @@ const computeRefreshDelay = (expiresIn) => {
  */
 function buildAuthenticatedFetch(accessToken, options) {
     let currentAccessToken = accessToken;
+    // XPOD_REFRESH_ON_REQUEST: use real expiry even when the proactive timer was suspended.
+    let accessTokenExpiresAt = Date.now() + (options?.expiresIn ?? DEFAULT_EXPIRATION_TIME_SECONDS) * 1000;
+    let refreshBeforeRequest;
+    let refreshInFlight;
+    let refreshTerminated = false;
+    let lastRefreshError;
     let latestTimeout;
     let refreshRetryAttempt = 0;
     const XPOD_REFRESH_RETRY_MAX_DELAY_MS = 60000;
@@ -1333,64 +1342,77 @@ function buildAuthenticatedFetch(accessToken, options) {
     // the first expiration date.
     if (currentRefreshOptions !== undefined) {
         const proactivelyRefreshToken = async () => {
-            try {
-                const { accessToken: refreshedAccessToken, refreshToken, expiresIn, } = await refreshAccessToken(currentRefreshOptions, 
-                // If currentRefreshOptions is defined, options is necessarily defined too.
-                // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
-                options.dpopKey, 
-                // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
-                options.eventEmitter);
-                // Update the tokens in the closure if appropriate.
-                currentAccessToken = refreshedAccessToken;
-                refreshRetryAttempt = 0;
-                if (refreshToken !== undefined) {
-                    currentRefreshOptions.refreshToken = refreshToken;
-                }
-                // Each time the access token is refreshed, we must plan for the next
-                // refresh iteration.
-                clearTimeout(latestTimeout);
-                latestTimeout = setTimeout(proactivelyRefreshToken, computeRefreshDelay(expiresIn) * 1000);
-                // If currentRefreshOptions is defined, options is necessarily defined too.
-                // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
-                options.eventEmitter?.emit(EVENTS.TIMEOUT_SET, latestTimeout);
-            }
-            catch (e) {
-                // It is possible that an underlying library throws an error on refresh flow failure.
-                // If we used a log framework, the error could be logged at the `debug` level,
-                // but otherwise the failure of the refresh flow should not blow up in the user's
-                // face, so we just swallow the error.
-                const terminalProviderError = e instanceof OidcProviderError &&
-                    e.error !== "server_error" &&
-                    e.error !== "temporarily_unavailable";
-                if (terminalProviderError) {
-                    // The OIDC provider refused to refresh the access token and returned an error instead.
-                    /* istanbul ignore next 100% coverage would require testing that nothing
-                        happens here if the emitter is undefined, which is more cumbersome
-                        than what it's worth. */
-                    options?.eventEmitter?.emit(EVENTS.ERROR, e.error, e.errorDescription);
-                    /* istanbul ignore next 100% coverage would require testing that nothing
-                      happens here if the emitter is undefined, which is more cumbersome
-                      than what it's worth. */
-                    options?.eventEmitter?.emit(EVENTS.SESSION_EXPIRED);
-                }
-                const invalidTokenResponse = e instanceof InvalidResponseError &&
-                    e.missingFields.includes("access_token");
-                if (invalidTokenResponse) {
-                    // In this case, the OIDC provider returned a non-standard response, but
-                    // did not specify that it was an error. We cannot refresh nonetheless.
-                    /* istanbul ignore next 100% coverage would require testing that nothing
-                      happens here if the emitter is undefined, which is more cumbersome
-                      than what it's worth. */
-                    options?.eventEmitter?.emit(EVENTS.SESSION_EXPIRED);
-                }
-                if (!terminalProviderError && !invalidTokenResponse) {
-                    const retryDelay = Math.min(1000 * 2 ** refreshRetryAttempt, XPOD_REFRESH_RETRY_MAX_DELAY_MS);
-                    refreshRetryAttempt += 1;
+            if (refreshTerminated) return false;
+            if (refreshInFlight) return refreshInFlight;
+            refreshInFlight = (async () => {
+                try {
+                    const { accessToken: refreshedAccessToken, refreshToken, expiresIn, } = await refreshAccessToken(currentRefreshOptions, 
+                    // If currentRefreshOptions is defined, options is necessarily defined too.
+                    // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+                    options.dpopKey, 
+                    // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+                    options.eventEmitter);
+                    // Update the tokens in the closure if appropriate.
+                    currentAccessToken = refreshedAccessToken;
+                    accessTokenExpiresAt = Date.now() + (expiresIn ?? DEFAULT_EXPIRATION_TIME_SECONDS) * 1000;
+                    refreshRetryAttempt = 0;
+                    if (refreshToken !== undefined) {
+                        currentRefreshOptions.refreshToken = refreshToken;
+                    }
+                    // Each time the access token is refreshed, we must plan for the next
+                    // refresh iteration.
                     clearTimeout(latestTimeout);
-                    latestTimeout = setTimeout(proactivelyRefreshToken, retryDelay);
-                    options?.eventEmitter?.emit(EVENTS.TIMEOUT_SET, latestTimeout);
+                    latestTimeout = setTimeout(proactivelyRefreshToken, computeRefreshDelay(expiresIn) * 1000);
+                    // If currentRefreshOptions is defined, options is necessarily defined too.
+                    // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+                    options.eventEmitter?.emit(EVENTS.TIMEOUT_SET, latestTimeout);
+                    return true;
                 }
-            }
+                catch (e) {
+                    lastRefreshError = e;
+                    // It is possible that an underlying library throws an error on refresh flow failure.
+                    // If we used a log framework, the error could be logged at the `debug` level,
+                    // but otherwise the failure of the refresh flow should not blow up in the user's
+                    // face, so we just swallow the error.
+                    const terminalProviderError = e instanceof OidcProviderError &&
+                        e.error !== "server_error" &&
+                        e.error !== "temporarily_unavailable";
+                    if (terminalProviderError) {
+                        // The OIDC provider refused to refresh the access token and returned an error instead.
+                        /* istanbul ignore next 100% coverage would require testing that nothing
+                            happens here if the emitter is undefined, which is more cumbersome
+                            than what it's worth. */
+                        options?.eventEmitter?.emit(EVENTS.ERROR, e.error, e.errorDescription);
+                        /* istanbul ignore next 100% coverage would require testing that nothing
+                          happens here if the emitter is undefined, which is more cumbersome
+                          than what it's worth. */
+                        options?.eventEmitter?.emit(EVENTS.SESSION_EXPIRED);
+                    }
+                    const invalidTokenResponse = e instanceof InvalidResponseError &&
+                        e.missingFields.includes("access_token");
+                    if (invalidTokenResponse) {
+                        // In this case, the OIDC provider returned a non-standard response, but
+                        // did not specify that it was an error. We cannot refresh nonetheless.
+                        /* istanbul ignore next 100% coverage would require testing that nothing
+                          happens here if the emitter is undefined, which is more cumbersome
+                          than what it's worth. */
+                        options?.eventEmitter?.emit(EVENTS.SESSION_EXPIRED);
+                    }
+                    refreshTerminated = terminalProviderError || invalidTokenResponse;
+                    if (!terminalProviderError && !invalidTokenResponse) {
+                        const retryDelay = Math.min(1000 * 2 ** refreshRetryAttempt, XPOD_REFRESH_RETRY_MAX_DELAY_MS);
+                        refreshRetryAttempt += 1;
+                        clearTimeout(latestTimeout);
+                        latestTimeout = setTimeout(proactivelyRefreshToken, retryDelay);
+                        options?.eventEmitter?.emit(EVENTS.TIMEOUT_SET, latestTimeout);
+                    }
+                    return false;
+                }
+            })().finally(() => { refreshInFlight = undefined; });
+            return refreshInFlight;
+        };
+        refreshBeforeRequest = async () => {
+            if (!await proactivelyRefreshToken()) throw lastRefreshError;
         };
         latestTimeout = setTimeout(proactivelyRefreshToken, 
         // If currentRefreshOptions is defined, options is necessarily defined too.
@@ -1411,6 +1433,9 @@ function buildAuthenticatedFetch(accessToken, options) {
         options.eventEmitter.emit(EVENTS.TIMEOUT_SET, expirationTimeout);
     }
     return async (url, requestInit) => {
+        if (refreshBeforeRequest && Date.now() >= accessTokenExpiresAt) {
+            await refreshBeforeRequest();
+        }
         let response = await makeAuthenticatedRequest(currentAccessToken, url, requestInit, options?.dpopKey, options?.fetch);
         const failedButNotExpectedAuthError = !response.ok && !isExpectedAuthError(response.status);
         if (response.ok || failedButNotExpectedAuthError) {
@@ -1543,3 +1568,5 @@ exports.normalizeScopes = normalizeScopes;
 exports.removeOpenIdParams = removeOpenIdParams;
 exports.saveSessionInfoToStorage = saveSessionInfoToStorage;
 //# sourceMappingURL=index.js.map
+
+// XPOD_INRUPT_RESOURCE_DPOP_ATH

package/node_modules/@inrupt/solid-client-authn-core/dist/index.mjs

@@ -1,4 +1,4 @@
-import { jwtVerify, createRemoteJWKSet, exportJWK, SignJWT, generateKeyPair } from 'jose';
+import { jwtVerify, createRemoteJWKSet, exportJWK, SignJWT, generateKeyPair, base64url } from 'jose';
 import { v4 } from 'uuid';
 
 //
@@ -1207,11 +1207,14 @@ function normalizeHTU(audience) {
  * @param dpopKey Key used to sign the token.
  * @returns A JWT that can be used as a DPoP Authorization header.
  */
-async function createDpopHeader(audience, method, dpopKey) {
+async function createDpopHeader(audience, method, dpopKey, accessToken) {
     return new SignJWT({
         htu: normalizeHTU(audience),
         htm: method.toUpperCase(),
         jti: v4(),
+        ...(accessToken === undefined ? {} : { ath: base64url.encode(
+            new Uint8Array(await globalThis.crypto.subtle.digest("SHA-256", new TextEncoder().encode(accessToken)))
+        ) }),
     })
         .setProtectedHeader({
         alg: PREFERRED_SIGNING_ALG[0],
@@ -1267,7 +1270,7 @@ async function buildDpopFetchOptions(targetUrl, authToken, dpopKey, defaultOptio
     const headers = new Headers(defaultOptions?.headers);
     // Any pre-existing Authorization header should be overriden.
     headers.set("Authorization", `DPoP ${authToken}`);
-    headers.set("DPoP", await createDpopHeader(targetUrl, defaultOptions?.method ?? "get", dpopKey));
+    headers.set("DPoP", await createDpopHeader(targetUrl, defaultOptions?.method ?? "get", dpopKey, authToken));
     return {
         ...defaultOptions,
         headers,
@@ -1322,6 +1325,12 @@ const computeRefreshDelay = (expiresIn) => {
  */
 function buildAuthenticatedFetch(accessToken, options) {
     let currentAccessToken = accessToken;
+    // XPOD_REFRESH_ON_REQUEST: use real expiry even when the proactive timer was suspended.
+    let accessTokenExpiresAt = Date.now() + (options?.expiresIn ?? DEFAULT_EXPIRATION_TIME_SECONDS) * 1000;
+    let refreshBeforeRequest;
+    let refreshInFlight;
+    let refreshTerminated = false;
+    let lastRefreshError;
     let latestTimeout;
     let refreshRetryAttempt = 0;
     const XPOD_REFRESH_RETRY_MAX_DELAY_MS = 60000;
@@ -1331,64 +1340,77 @@ function buildAuthenticatedFetch(accessToken, options) {
     // the first expiration date.
     if (currentRefreshOptions !== undefined) {
         const proactivelyRefreshToken = async () => {
-            try {
-                const { accessToken: refreshedAccessToken, refreshToken, expiresIn, } = await refreshAccessToken(currentRefreshOptions, 
-                // If currentRefreshOptions is defined, options is necessarily defined too.
-                // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
-                options.dpopKey, 
-                // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
-                options.eventEmitter);
-                // Update the tokens in the closure if appropriate.
-                currentAccessToken = refreshedAccessToken;
-                refreshRetryAttempt = 0;
-                if (refreshToken !== undefined) {
-                    currentRefreshOptions.refreshToken = refreshToken;
-                }
-                // Each time the access token is refreshed, we must plan for the next
-                // refresh iteration.
-                clearTimeout(latestTimeout);
-                latestTimeout = setTimeout(proactivelyRefreshToken, computeRefreshDelay(expiresIn) * 1000);
-                // If currentRefreshOptions is defined, options is necessarily defined too.
-                // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
-                options.eventEmitter?.emit(EVENTS.TIMEOUT_SET, latestTimeout);
-            }
-            catch (e) {
-                // It is possible that an underlying library throws an error on refresh flow failure.
-                // If we used a log framework, the error could be logged at the `debug` level,
-                // but otherwise the failure of the refresh flow should not blow up in the user's
-                // face, so we just swallow the error.
-                const terminalProviderError = e instanceof OidcProviderError &&
-                    e.error !== "server_error" &&
-                    e.error !== "temporarily_unavailable";
-                if (terminalProviderError) {
-                    // The OIDC provider refused to refresh the access token and returned an error instead.
-                    /* istanbul ignore next 100% coverage would require testing that nothing
-                        happens here if the emitter is undefined, which is more cumbersome
-                        than what it's worth. */
-                    options?.eventEmitter?.emit(EVENTS.ERROR, e.error, e.errorDescription);
-                    /* istanbul ignore next 100% coverage would require testing that nothing
-                      happens here if the emitter is undefined, which is more cumbersome
-                      than what it's worth. */
-                    options?.eventEmitter?.emit(EVENTS.SESSION_EXPIRED);
-                }
-                const invalidTokenResponse = e instanceof InvalidResponseError &&
-                    e.missingFields.includes("access_token");
-                if (invalidTokenResponse) {
-                    // In this case, the OIDC provider returned a non-standard response, but
-                    // did not specify that it was an error. We cannot refresh nonetheless.
-                    /* istanbul ignore next 100% coverage would require testing that nothing
-                      happens here if the emitter is undefined, which is more cumbersome
-                      than what it's worth. */
-                    options?.eventEmitter?.emit(EVENTS.SESSION_EXPIRED);
-                }
-                if (!terminalProviderError && !invalidTokenResponse) {
-                    const retryDelay = Math.min(1000 * 2 ** refreshRetryAttempt, XPOD_REFRESH_RETRY_MAX_DELAY_MS);
-                    refreshRetryAttempt += 1;
+            if (refreshTerminated) return false;
+            if (refreshInFlight) return refreshInFlight;
+            refreshInFlight = (async () => {
+                try {
+                    const { accessToken: refreshedAccessToken, refreshToken, expiresIn, } = await refreshAccessToken(currentRefreshOptions, 
+                    // If currentRefreshOptions is defined, options is necessarily defined too.
+                    // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+                    options.dpopKey, 
+                    // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+                    options.eventEmitter);
+                    // Update the tokens in the closure if appropriate.
+                    currentAccessToken = refreshedAccessToken;
+                    accessTokenExpiresAt = Date.now() + (expiresIn ?? DEFAULT_EXPIRATION_TIME_SECONDS) * 1000;
+                    refreshRetryAttempt = 0;
+                    if (refreshToken !== undefined) {
+                        currentRefreshOptions.refreshToken = refreshToken;
+                    }
+                    // Each time the access token is refreshed, we must plan for the next
+                    // refresh iteration.
                     clearTimeout(latestTimeout);
-                    latestTimeout = setTimeout(proactivelyRefreshToken, retryDelay);
-                    options?.eventEmitter?.emit(EVENTS.TIMEOUT_SET, latestTimeout);
+                    latestTimeout = setTimeout(proactivelyRefreshToken, computeRefreshDelay(expiresIn) * 1000);
+                    // If currentRefreshOptions is defined, options is necessarily defined too.
+                    // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+                    options.eventEmitter?.emit(EVENTS.TIMEOUT_SET, latestTimeout);
+                    return true;
                 }
-            }
+                catch (e) {
+                    lastRefreshError = e;
+                    // It is possible that an underlying library throws an error on refresh flow failure.
+                    // If we used a log framework, the error could be logged at the `debug` level,
+                    // but otherwise the failure of the refresh flow should not blow up in the user's
+                    // face, so we just swallow the error.
+                    const terminalProviderError = e instanceof OidcProviderError &&
+                        e.error !== "server_error" &&
+                        e.error !== "temporarily_unavailable";
+                    if (terminalProviderError) {
+                        // The OIDC provider refused to refresh the access token and returned an error instead.
+                        /* istanbul ignore next 100% coverage would require testing that nothing
+                            happens here if the emitter is undefined, which is more cumbersome
+                            than what it's worth. */
+                        options?.eventEmitter?.emit(EVENTS.ERROR, e.error, e.errorDescription);
+                        /* istanbul ignore next 100% coverage would require testing that nothing
+                          happens here if the emitter is undefined, which is more cumbersome
+                          than what it's worth. */
+                        options?.eventEmitter?.emit(EVENTS.SESSION_EXPIRED);
+                    }
+                    const invalidTokenResponse = e instanceof InvalidResponseError &&
+                        e.missingFields.includes("access_token");
+                    if (invalidTokenResponse) {
+                        // In this case, the OIDC provider returned a non-standard response, but
+                        // did not specify that it was an error. We cannot refresh nonetheless.
+                        /* istanbul ignore next 100% coverage would require testing that nothing
+                          happens here if the emitter is undefined, which is more cumbersome
+                          than what it's worth. */
+                        options?.eventEmitter?.emit(EVENTS.SESSION_EXPIRED);
+                    }
+                    refreshTerminated = terminalProviderError || invalidTokenResponse;
+                    if (!terminalProviderError && !invalidTokenResponse) {
+                        const retryDelay = Math.min(1000 * 2 ** refreshRetryAttempt, XPOD_REFRESH_RETRY_MAX_DELAY_MS);
+                        refreshRetryAttempt += 1;
+                        clearTimeout(latestTimeout);
+                        latestTimeout = setTimeout(proactivelyRefreshToken, retryDelay);
+                        options?.eventEmitter?.emit(EVENTS.TIMEOUT_SET, latestTimeout);
+                    }
+                    return false;
+                }
+            })().finally(() => { refreshInFlight = undefined; });
+            return refreshInFlight;
+        };
+        refreshBeforeRequest = async () => {
+            if (!await proactivelyRefreshToken()) throw lastRefreshError;
         };
         latestTimeout = setTimeout(proactivelyRefreshToken, 
         // If currentRefreshOptions is defined, options is necessarily defined too.
@@ -1409,6 +1431,9 @@ function buildAuthenticatedFetch(accessToken, options) {
         options.eventEmitter.emit(EVENTS.TIMEOUT_SET, expirationTimeout);
     }
     return async (url, requestInit) => {
+        if (refreshBeforeRequest && Date.now() >= accessTokenExpiresAt) {
+            await refreshBeforeRequest();
+        }
         let response = await makeAuthenticatedRequest(currentAccessToken, url, requestInit, options?.dpopKey, options?.fetch);
         const failedButNotExpectedAuthError = !response.ok && !isExpectedAuthError(response.status);
         if (response.ok || failedButNotExpectedAuthError) {
@@ -1501,3 +1526,5 @@ const mockStorageUtility = (stored, isSecure = false) => {
 
 export { AggregateHandler, AuthorizationCodeWithPkceOidcHandlerBase, ClientAuthentication, ConfigurationError, DEFAULT_SCOPES, EVENTS, GeneralLogoutHandler, IRpLogoutHandler, IWaterfallLogoutHandler, InMemoryStorage, InvalidResponseError, NotImplementedError, OidcProviderError, PREFERRED_SIGNING_ALG, REFRESH_BEFORE_EXPIRATION_SECONDS, SOLID_CLIENT_AUTHN_KEY_PREFIX, SessionInfoManagerBase, StorageUtility, StorageUtilityGetResponse, StorageUtilityMock, USER_SESSION_PREFIX, buildAuthenticatedFetch, clear, createDpopHeader, determineSigningAlg, generateDpopKeyPair, getEndSessionUrl, getSessionIdFromOauthState, getUnauthenticatedSession, getWebidFromTokenPayload, handleRegistration, isKnownClientType, isSupportedTokenType, isValidRedirectUrl, loadOidcContextFromStorage, maybeBuildRpInitiatedLogout, mockStorage, mockStorageUtility, normalizeScopes, removeOpenIdParams, saveSessionInfoToStorage };
 //# sourceMappingURL=index.mjs.map
+
+// XPOD_INRUPT_RESOURCE_DPOP_ATH

package/node_modules/@undefineds.co/ai-connections/dist/AiApiKeyPool.d.ts

@@ -1,6 +1,6 @@
-import type { AiConnectAttempt, AiProviderCredentialSummary, AiProviderOffering } from './contract/ai-connections-client';
-import type { AiProviderDefinition } from './controller';
-import type { ProviderConnectionState } from './AiProviderCard';
+import type { AiConnectAttempt, AiProviderCredentialSummary, AiProviderOffering } from './contract/ai-connections-client.js';
+import type { AiProviderDefinition } from './controller.js';
+import type { ProviderConnectionState } from './AiProviderCard.js';
 export declare function AiApiKeyPool({ definition, offering, createOfferings, status, credentials, attempt, apiKey, baseUrl, busy, disabled, error, onApiKeyChange, onBaseUrlChange, onBeginApiKey, onBeginBrowser, onSaveApiKey, onDisconnect, onCreateApiKeyCredential, onUpdateCredential, initialEditing, initialCreate, onSavingChange, onCloseEdit, }: {
     definition: AiProviderDefinition;
     offering: AiProviderOffering;
@@ -27,6 +27,7 @@ export declare function AiApiKeyPool({ definition, offering, createOfferings, st
         priority: number;
     }) => Promise<void>;
     onUpdateCredential?: (credential: AiProviderCredentialSummary, patch: {
+        apiKey?: string;
         label?: string;
         enabled?: boolean;
         priority?: number;

package/node_modules/@undefineds.co/ai-connections/dist/AiApiKeyPool.js

@@ -1,6 +1,6 @@
 import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
 import { useEffect, useRef, useState } from 'react';
-import { Button, Input, cn } from '@undefineds.co/shared-ui';
+import { Button, Input, NativeSelect, cn } from '@undefineds.co/shared-ui';
 import { ExternalLink, Eye, EyeOff, KeyRound, Loader2, LogOut, Plus, RotateCw } from 'lucide-react';
 import { normalizeProxyUrl } from './contract/ai-connections-client.js';
 import { offeringTitle } from './offering-label.js';
@@ -106,6 +106,7 @@ export function AiApiKeyPool({ definition, offering, createOfferings, status, cr
             onSavingChange?.(true);
             try {
                 await onUpdateCredential(editingCredential, {
+                    ...(poolApiKey.trim() ? { apiKey: poolApiKey.trim() } : {}),
                     label: poolLabel.trim() || undefined,
                     baseUrl: poolBaseUrl.trim() || undefined,
                     ...(proxyChanged ? { proxyUrl: normalizedProxyUrl } : {}),
@@ -122,7 +123,7 @@ export function AiApiKeyPool({ definition, offering, createOfferings, status, cr
             }
         }
     };
-    return (_jsxs("div", { className: cn('space-y-3', formMode && 'w-full'), children: [attempt?.userCode ? (_jsxs("div", { className: "border-l-2 border-primary bg-muted/30 px-3 py-2 text-sm", children: ["\u9A8C\u8BC1\u7801\uFF1A", _jsx("strong", { className: "font-mono", children: attempt.userCode })] })) : null, !initialCreate && !initialEditing ? _jsxs("div", { className: "flex flex-wrap gap-2", children: [onCreateApiKeyCredential && createOfferings.length > 0 ? (_jsxs(Button, { variant: "outline", size: "sm", disabled: busy || disabled || saving, onClick: openCreateForm, children: [_jsx(Plus, { className: "mr-2 h-4 w-4" }), "\u6DFB\u52A0 API Key"] })) : null, hasPoolActions ? null : isConnected ? (_jsxs(_Fragment, { children: [_jsxs(Button, { variant: "outline", size: "sm", disabled: busy || disabled || saving, onClick: onBeginBrowser, children: [busy ? _jsx(Loader2, { className: "mr-2 h-4 w-4 animate-spin" }) : _jsx(RotateCw, { className: "mr-2 h-4 w-4" }), "\u91CD\u65B0\u8FDE\u63A5"] }), _jsxs(Button, { variant: "ghost", size: "sm", disabled: busy || disabled || saving, onClick: onDisconnect, children: [_jsx(LogOut, { className: "mr-2 h-4 w-4" }), "\u65AD\u5F00\u8FDE\u63A5"] })] })) : isConfigured ? (_jsxs(_Fragment, { children: [_jsxs(Button, { variant: "outline", size: "sm", "aria-label": "\u66F4\u65B0 API Key", disabled: busy || disabled || saving, onClick: onBeginApiKey, children: [_jsx(KeyRound, { className: "mr-2 h-4 w-4" }), "\u66F4\u65B0 API Key"] }), _jsx(Button, { variant: "ghost", size: "sm", disabled: busy || disabled || saving, onClick: onDisconnect, children: "\u79FB\u9664\u914D\u7F6E" })] })) : (_jsxs(_Fragment, { children: [browserMethod ? (_jsxs(Button, { variant: "outline", size: "sm", title: browserMethod.lifecycle === 'unavailable' ? browserMethod.reason : undefined, disabled: busy || disabled || saving || browserMethod.lifecycle === 'unavailable', onClick: onBeginBrowser, children: [busy ? _jsx(Loader2, { className: "mr-2 h-4 w-4 animate-spin" }) : _jsx(ExternalLink, { className: "mr-2 h-4 w-4" }), browserMethod.label] })) : null, _jsxs(Button, { variant: "outline", size: "sm", "aria-label": `${definition.name} API Key`, disabled: busy || disabled || saving, onClick: onBeginApiKey, children: [_jsx(KeyRound, { className: "mr-2 h-4 w-4" }), "\u914D\u7F6E API Key"] })] }))] }) : null, formMode ? (_jsxs("div", { className: "space-y-2 rounded-lg border border-border/50 bg-muted/10 p-3", children: [formMode === 'create' && createOfferings.length > 1 ? (_jsxs("label", { className: "block space-y-1 text-xs text-muted-foreground", children: [_jsx("span", { children: "\u5957\u9910 / \u533A\u57DF" }), _jsx("select", { "aria-label": `${definition.name} 套餐 / 区域`, value: createOfferingId, disabled: busy || disabled || saving, onChange: (event) => { setCreateOfferingId(event.target.value); setPoolFormError(undefined); }, className: "h-9 w-full rounded-md border border-input bg-background px-3 text-sm text-foreground", children: createOfferings.map((item) => _jsx("option", { value: item.id, children: offeringTitle(item) }, item.id)) })] })) : null, formMode === 'edit' ? (_jsx(Input, { disabled: busy || disabled || saving, autoComplete: "off", "aria-label": `${definition.name} API Key 标签`, placeholder: "\u540D\u79F0\uFF0C\u4F8B\u5982 Work key", value: poolLabel, onChange: (event) => setPoolLabel(event.target.value) })) : null, formMode === 'create' ? (_jsx(Input, { disabled: busy || disabled || saving, type: showKey ? 'text' : 'password', autoComplete: "new-password", "data-lpignore": "true", "data-1p-ignore": true, "aria-label": `${definition.name} API Key 输入`, placeholder: definition.apiKeyPlaceholder || '从官方控制台复制 API Key', value: poolApiKey, onChange: (event) => setPoolApiKey(event.target.value), className: "font-mono" })) : null, formMode === 'edit' || showAdvanced ? (_jsxs(_Fragment, { children: [_jsx(Input, { disabled: busy || disabled || saving, autoComplete: "off", "data-lpignore": "true", "data-1p-ignore": true, "aria-label": `${definition.name} Base URL 输入`, placeholder: offeringEndpoint(formMode === 'edit' ? offering : formOffering) || definition.defaultBaseUrl || '默认服务地址', value: poolBaseUrl, onChange: (event) => setPoolBaseUrl(event.target.value), className: "font-mono text-xs" }), _jsx(Input, { disabled: busy || disabled || saving, autoComplete: "off", "data-lpignore": "true", "data-1p-ignore": true, "aria-label": `${definition.name} Proxy URL 输入`, placeholder: "http://127.0.0.1:7890", value: poolProxyUrl, onChange: (event) => setPoolProxyUrl(event.target.value), className: "font-mono text-xs" })] })) : null, poolFormError ? _jsx("p", { className: "text-xs text-destructive", children: poolFormError }) : null, _jsxs("div", { className: "flex flex-wrap gap-2", children: [_jsx(Button, { size: "sm", "aria-label": formMode === 'create' ? `保存 ${definition.name} API Key` : '保存凭证', disabled: busy || disabled || saving || (formMode === 'create' && !poolApiKey.trim()), onClick: savePoolForm, children: formMode === 'create' ? '保存 API Key' : '保存凭证' }), _jsx(Button, { variant: "ghost", size: "sm", disabled: saving, onClick: closePoolForm, children: "\u53D6\u6D88" }), formMode === 'create' ? (_jsx(Button, { variant: "ghost", size: "sm", disabled: saving, onClick: () => setShowAdvanced((current) => !current), children: showAdvanced ? '收起高级设置' : '高级设置' })) : null] })] })) : null, apiKeyAttempt && !formMode ? (_jsxs("div", { className: "space-y-2", children: [_jsxs("div", { className: "flex items-center justify-between", children: [_jsx("span", { className: "text-sm font-medium", children: "API Key" }), definition.apiKeyUrl ? (_jsx("a", { href: definition.apiKeyUrl, target: "_blank", rel: "noreferrer", className: "text-xs text-primary hover:underline", children: "\u83B7\u53D6 API Key" })) : null] }), _jsxs("div", { className: "group relative", children: [_jsx(Input, { disabled: busy || disabled || saving, type: showKey ? 'text' : 'password', autoComplete: "new-password", "data-lpignore": "true", "data-1p-ignore": true, "aria-label": `${definition.name} API Key 输入`, placeholder: definition.apiKeyPlaceholder || '从官方控制台复制 API Key', value: apiKey, onChange: (event) => onApiKeyChange(event.target.value), className: "border-border/60 bg-muted/20 pr-10 font-mono transition-colors focus:border-primary/50 focus:bg-background" }), _jsx("div", { className: "absolute bottom-1 right-1 top-1 flex items-center", children: _jsx(Button, { variant: "ghost", size: "icon", className: "h-full w-8 rounded hover:bg-muted", onClick: () => setShowKey((current) => !current), "aria-label": showKey ? '隐藏 API Key' : '显示 API Key', children: showKey
+    return (_jsxs("div", { className: cn('space-y-3', formMode && 'w-full'), children: [attempt?.userCode ? (_jsxs("div", { className: "border-l-2 border-primary bg-muted/30 px-3 py-2 text-sm", children: ["\u9A8C\u8BC1\u7801\uFF1A", _jsx("strong", { className: "font-mono", children: attempt.userCode })] })) : null, !initialCreate && !initialEditing ? _jsxs("div", { className: "flex flex-wrap gap-2", children: [onCreateApiKeyCredential && createOfferings.length > 0 ? (_jsxs(Button, { variant: "outline", size: "sm", disabled: busy || disabled || saving, onClick: openCreateForm, children: [_jsx(Plus, { className: "mr-2 h-4 w-4" }), "\u6DFB\u52A0 API Key"] })) : null, hasPoolActions ? null : isConnected ? (_jsxs(_Fragment, { children: [_jsxs(Button, { variant: "outline", size: "sm", disabled: busy || disabled || saving, onClick: onBeginBrowser, children: [busy ? _jsx(Loader2, { className: "mr-2 h-4 w-4 animate-spin" }) : _jsx(RotateCw, { className: "mr-2 h-4 w-4" }), "\u91CD\u65B0\u8FDE\u63A5"] }), _jsxs(Button, { variant: "ghost", size: "sm", disabled: busy || disabled || saving, onClick: onDisconnect, children: [_jsx(LogOut, { className: "mr-2 h-4 w-4" }), "\u65AD\u5F00\u8FDE\u63A5"] })] })) : isConfigured ? (_jsxs(_Fragment, { children: [_jsxs(Button, { variant: "outline", size: "sm", "aria-label": "\u66F4\u65B0 API Key", disabled: busy || disabled || saving, onClick: onBeginApiKey, children: [_jsx(KeyRound, { className: "mr-2 h-4 w-4" }), "\u66F4\u65B0 API Key"] }), _jsx(Button, { variant: "ghost", size: "sm", disabled: busy || disabled || saving, onClick: onDisconnect, children: "\u79FB\u9664\u914D\u7F6E" })] })) : (_jsxs(_Fragment, { children: [browserMethod ? (_jsxs(Button, { variant: "outline", size: "sm", title: browserMethod.lifecycle === 'unavailable' ? browserMethod.reason : undefined, disabled: busy || disabled || saving || browserMethod.lifecycle === 'unavailable', onClick: onBeginBrowser, children: [busy ? _jsx(Loader2, { className: "mr-2 h-4 w-4 animate-spin" }) : _jsx(ExternalLink, { className: "mr-2 h-4 w-4" }), browserMethod.label] })) : null, _jsxs(Button, { variant: "outline", size: "sm", "aria-label": `${definition.name} API Key`, disabled: busy || disabled || saving, onClick: onBeginApiKey, children: [_jsx(KeyRound, { className: "mr-2 h-4 w-4" }), "\u914D\u7F6E API Key"] })] }))] }) : null, formMode ? (_jsxs("div", { className: "space-y-2 rounded-lg border border-border/50 bg-muted/10 p-3", children: [formMode === 'create' && createOfferings.length > 1 ? (_jsxs("label", { className: "block space-y-1 text-xs text-muted-foreground", children: [_jsx("span", { children: "\u5957\u9910 / \u533A\u57DF" }), _jsx(NativeSelect, { "aria-label": `${definition.name} 套餐 / 区域`, value: createOfferingId, disabled: busy || disabled || saving, onChange: (event) => { setCreateOfferingId(event.target.value); setPoolFormError(undefined); }, className: "h-9", children: createOfferings.map((item) => _jsx("option", { value: item.id, children: offeringTitle(item) }, item.id)) })] })) : null, formMode === 'edit' ? (_jsx(Input, { disabled: busy || disabled || saving, autoComplete: "off", "aria-label": `${definition.name} API Key 标签`, placeholder: "\u540D\u79F0\uFF0C\u4F8B\u5982 Work key", value: poolLabel, onChange: (event) => setPoolLabel(event.target.value) })) : null, formMode === 'create' || formMode === 'edit' ? (_jsx(Input, { disabled: busy || disabled || saving, type: showKey ? 'text' : 'password', autoComplete: "new-password", "data-lpignore": "true", "data-1p-ignore": true, "aria-label": `${definition.name} API Key 输入`, placeholder: formMode === 'edit' ? '留空保留现有 Key，填写以替换' : definition.apiKeyPlaceholder || '从官方控制台复制 API Key', value: poolApiKey, onChange: (event) => setPoolApiKey(event.target.value), className: "font-mono" })) : null, formMode === 'edit' || showAdvanced ? (_jsxs(_Fragment, { children: [_jsx(Input, { disabled: busy || disabled || saving, autoComplete: "off", "data-lpignore": "true", "data-1p-ignore": true, "aria-label": `${definition.name} Base URL 输入`, placeholder: offeringEndpoint(formMode === 'edit' ? offering : formOffering) || definition.defaultBaseUrl || '默认服务地址', value: poolBaseUrl, onChange: (event) => setPoolBaseUrl(event.target.value), className: "font-mono text-xs" }), _jsx(Input, { disabled: busy || disabled || saving, autoComplete: "off", "data-lpignore": "true", "data-1p-ignore": true, "aria-label": `${definition.name} Proxy URL 输入`, placeholder: "http://127.0.0.1:7890", value: poolProxyUrl, onChange: (event) => setPoolProxyUrl(event.target.value), className: "font-mono text-xs" })] })) : null, poolFormError ? _jsx("p", { className: "text-xs text-destructive", children: poolFormError }) : null, _jsxs("div", { className: "flex flex-wrap gap-2", children: [_jsx(Button, { size: "sm", "aria-label": formMode === 'create' ? `保存 ${definition.name} API Key` : '保存凭证', disabled: busy || disabled || saving || (formMode === 'create' && !poolApiKey.trim()), onClick: savePoolForm, children: formMode === 'create' ? '保存 API Key' : '保存凭证' }), _jsx(Button, { variant: "ghost", size: "sm", disabled: saving, onClick: closePoolForm, children: "\u53D6\u6D88" }), formMode === 'create' ? (_jsx(Button, { variant: "ghost", size: "sm", disabled: saving, onClick: () => setShowAdvanced((current) => !current), children: showAdvanced ? '收起高级设置' : '高级设置' })) : null] })] })) : null, apiKeyAttempt && !formMode ? (_jsxs("div", { className: "space-y-2", children: [_jsxs("div", { className: "flex items-center justify-between", children: [_jsx("span", { className: "text-sm font-medium", children: "API Key" }), definition.apiKeyUrl ? (_jsx("a", { href: definition.apiKeyUrl, target: "_blank", rel: "noreferrer", className: "text-xs text-primary hover:underline", children: "\u83B7\u53D6 API Key" })) : null] }), _jsxs("div", { className: "group relative", children: [_jsx(Input, { disabled: busy || disabled || saving, type: showKey ? 'text' : 'password', autoComplete: "new-password", "data-lpignore": "true", "data-1p-ignore": true, "aria-label": `${definition.name} API Key 输入`, placeholder: definition.apiKeyPlaceholder || '从官方控制台复制 API Key', value: apiKey, onChange: (event) => onApiKeyChange(event.target.value), className: "border-border/60 bg-muted/20 pr-10 font-mono transition-colors focus:border-primary/50 focus:bg-background" }), _jsx("div", { className: "absolute bottom-1 right-1 top-1 flex items-center", children: _jsx(Button, { variant: "ghost", size: "icon", className: "h-full w-8 rounded hover:bg-muted", onClick: () => setShowKey((current) => !current), "aria-label": showKey ? '隐藏 API Key' : '显示 API Key', children: showKey
                                         ? _jsx(EyeOff, { className: "h-4 w-4 text-muted-foreground" })
                                         : _jsx(Eye, { className: "h-4 w-4 text-muted-foreground" }) }) })] }), onBaseUrlChange ? (_jsxs("div", { className: "space-y-1.5", children: [_jsx("span", { className: "text-xs font-medium text-muted-foreground", children: "Base URL\uFF08\u9009\u586B\uFF09" }), _jsx(Input, { disabled: busy || disabled || saving, autoComplete: "off", "data-lpignore": "true", "data-1p-ignore": true, "aria-label": `${definition.name} Base URL 输入`, placeholder: definition.defaultBaseUrl || '默认服务地址', value: baseUrl, onChange: (event) => onBaseUrlChange(event.target.value), className: "border-border/60 bg-muted/20 font-mono text-xs transition-colors focus:border-primary/50 focus:bg-background" }), _jsxs("p", { className: "break-all font-mono text-[11px] text-muted-foreground opacity-80", children: [_jsx("span", { className: "mr-1 select-none opacity-50", children: "\u9884\u89C8:" }), (baseUrl.trim() || definition.defaultBaseUrl || '').replace(/\/+$/, ''), "/chat/completions"] })] })) : null, _jsx(Button, { size: "sm", "aria-label": `保存 ${definition.name} API Key`, disabled: !apiKey.trim() || busy || disabled, onClick: onSaveApiKey, children: "\u4FDD\u5B58 API Key" })] })) : null, error ? _jsx("p", { className: "text-sm text-destructive", children: error }) : null] }));
 }

package/node_modules/@undefineds.co/ai-connections/dist/AiAuthorizationActions.d.ts

@@ -1,4 +1,4 @@
-import type { AiConnectionsMode, AiProviderAuthorizationMethod, AiProviderOffering } from './contract/ai-connections-client';
+import type { AiConnectionsMode, AiProviderAuthorizationMethod, AiProviderOffering } from './contract/ai-connections-client.js';
 /**
  * The offering's own entries, one button per declared `authorizationMethod`.
  *

package/node_modules/@undefineds.co/ai-connections/dist/AiClientConfigurationSection.d.ts

@@ -1,5 +1,5 @@
 import type { AiClientConfigurationModel } from '@undefineds.co/extension-sdk/web';
-import { normalizeV1Endpoint } from './contract/endpoint-urls';
+import { normalizeV1Endpoint } from './contract/endpoint-urls.js';
 export declare const AI_CONNECTIONS_CLIENTS: readonly ["codex", "claude-code", "pi", "codebuddy"];
 export type AiConnectionsClientId = (typeof AI_CONNECTIONS_CLIENTS)[number];
 export interface AiClientConfigurationStatus {
@@ -24,6 +24,7 @@ export interface AiClientConfigurationDryRun {
     }>;
 }
 export interface AiClientConfigurationBridge {
+    readonly available?: boolean;
     inspect(client: AiConnectionsClientId): Promise<AiClientConfigurationStatus>;
     plan(input: {
         client: AiConnectionsClientId;

package/node_modules/@undefineds.co/ai-connections/dist/AiClientConfigurationSection.js

@@ -22,10 +22,16 @@ export function AiClientIcon({ client, className = 'h-4 w-4' }) {
 }
 export function AiClientConfigurationSection({ bridge, endpoint, client, createClientCredential, manualApiKey, autoApply = false, compact = false, onComplete, }) {
     const [status, setStatus] = useState({ status: 'notConfigured' });
+    // §7.3 第 5–6 步：密钥结果、配置写入、Gateway 检查、客户端验证分开呈现
+    const [stages, setStages] = useState([]);
     const [dryRun, setDryRun] = useState();
     const [confirmationValue, setConfirmationValue] = useState('');
     const [busy, setBusy] = useState(false);
     const autoApplyStarted = useRef(false);
+    /** §7.3 第 3 步：明确选择为这个客户端新建 Key，还是使用用户已有的 Key。 */
+    const [keySource, setKeySource] = useState('create');
+    /** 写入失败后保留的凭据：重试只重写配置，不再新建 Key（§7.3）。 */
+    const leaseRef = useRef(undefined);
     useEffect(() => {
         setDryRun(undefined);
         setConfirmationValue('');
@@ -58,7 +64,23 @@ export function AiClientConfigurationSection({ bridge, endpoint, client, createC
         let lease;
         let applied = false;
         try {
-            lease = await createClientCredential(client);
+            // 已经有上次失败留下的凭据就沿用，只有第一次才申请
+            lease = leaseRef.current;
+            if (!lease) {
+                lease = await createClientCredential(client);
+                leaseRef.current = lease;
+            }
+            setStages([
+                {
+                    id: 'key',
+                    label: '密钥',
+                    state: 'ok',
+                    detail: '本次使用这个 Xpod Key；重试不会新建 Key。',
+                },
+                { id: 'write', label: '配置写入', state: 'unknown', detail: '正在写入配置…' },
+                { id: 'gateway', label: 'Gateway 检查', state: 'unknown', detail: '本步骤未检查 Xpod 网关。' },
+                { id: 'client', label: '客户端验证', state: 'unknown', detail: '配置已写入，尚未验证客户端。' },
+            ]);
             await bridge.apply({
                 client,
                 planId: plan.planId,
@@ -71,6 +93,10 @@ export function AiClientConfigurationSection({ bridge, endpoint, client, createC
                 } : {}),
             });
             applied = true;
+            leaseRef.current = undefined;
+            setStages((current) => current.map((stage) => (stage.id === 'write'
+                ? { ...stage, state: 'ok', detail: '配置已写入；客户端是否已采用仍未验证。' }
+                : stage)));
             setStatus({ status: 'configured' });
             setDryRun(undefined);
             onComplete?.();
@@ -81,13 +107,13 @@ export function AiClientConfigurationSection({ bridge, endpoint, client, createC
                 recoveryMessage = `${AI_CLIENT_LABELS[client]} 配置失败。请重试。`;
             }
             if (lease && !applied) {
-                try {
-                    await lease.revoke();
-                }
-                catch (revokeError) {
-                    recoveryMessage = `${recoveryMessage}；自动撤销 API Key 失败：${errorMessage(revokeError)}。请在“API KEYS”中手动撤销。`;
-                }
+                // §7.3：写入失败时保留这个 Key 和原任务，重试只重写配置，不重复建 Key；
+                // 用户仍可在 API KEYS 里手动撤销。
+                recoveryMessage = `${recoveryMessage}；已保留本次使用的 Xpod Key，重试只会重新写入配置。`;
             }
+            setStages((current) => current.map((stage) => (stage.id === 'write'
+                ? { ...stage, state: 'failed', detail: recoveryMessage }
+                : stage)));
             setStatus(failedAndRestoredError(error)
                 ? { status: 'failedAndRestored', message: '配置写入失败，已自动恢复原配置。' }
                 : { status: 'unavailable', message: recoveryMessage });
@@ -148,11 +174,14 @@ export function AiClientConfigurationSection({ bridge, endpoint, client, createC
     const confirmation = dryRun?.confirmation;
     const confirmationSatisfied = !confirmation?.required || confirmationValue === confirmation.token;
     const clientLabel = AI_CLIENT_LABELS[client];
-    const manual = !bridge;
+    // 选择「使用已有 Key」时走手动配置路径：本页不申请新凭据，只给可复制的配置
+    const manual = !bridge || keySource === 'existing';
     const manualConfig = manualConfigurationText(client, endpoint, manualApiKey);
-    return (_jsxs("div", { className: compact ? '' : 'overflow-hidden rounded-md border border-border/60', children: [!compact ? _jsxs("div", { className: "flex flex-wrap items-center gap-2 px-3 py-2", children: [_jsx("span", { className: "flex h-8 w-8 shrink-0 items-center justify-center rounded-md bg-muted text-muted-foreground", children: _jsx(AiClientIcon, { client: client }) }), _jsxs("div", { className: "min-w-[10rem] flex-1", children: [_jsx("div", { className: "text-sm font-medium", children: clientLabel }), !manual ? _jsx("div", { className: "mt-0.5 text-xs text-muted-foreground", children: status.message ?? (status.status === 'configured'
+    return (_jsxs("div", { className: compact ? '' : 'overflow-hidden rounded-md border border-border/60', children: [bridge && createClientCredential ? (_jsxs("div", { className: "border-b border-border/60 px-3 py-2", children: [_jsxs("div", { role: "tablist", "aria-label": `${clientLabel} 的 Key 来源`, className: "flex flex-wrap gap-2", children: [_jsx("button", { type: "button", role: "tab", "aria-selected": keySource === 'create', "data-testid": "client-key-source-create", className: `rounded-lg border px-3 py-1 text-xs ${keySource === 'create' ? 'border-primary bg-accent text-accent-foreground' : 'border-border text-foreground hover:bg-accent/60'}`, onClick: () => setKeySource('create'), children: "\u4E3A\u8FD9\u4E2A\u5BA2\u6237\u7AEF\u65B0\u5EFA Key" }), _jsx("button", { type: "button", role: "tab", "aria-selected": keySource === 'existing', "data-testid": "client-key-source-existing", className: `rounded-lg border px-3 py-1 text-xs ${keySource === 'existing' ? 'border-primary bg-accent text-accent-foreground' : 'border-border text-foreground hover:bg-accent/60'}`, onClick: () => setKeySource('existing'), children: "\u4F7F\u7528\u6211\u5DF2\u7ECF\u6709\u7684 Key" })] }), _jsx("p", { className: "mt-1 text-xs text-muted-foreground", children: keySource === 'existing'
+                            ? '本页不会新建 Key：请把已有 Key 粘进客户端配置。共用一个 Key 时，停用它会影响所有使用它的客户端。'
+                            : '会为这个客户端单独创建一个 Key；停用只影响它自己。' })] })) : null, !compact ? _jsxs("div", { className: "flex flex-wrap items-center gap-2 px-3 py-2", children: [_jsx("span", { className: "flex h-8 w-8 shrink-0 items-center justify-center rounded-md bg-muted text-muted-foreground", children: _jsx(AiClientIcon, { client: client }) }), _jsxs("div", { className: "min-w-[10rem] flex-1", children: [_jsx("div", { className: "text-sm font-medium", children: clientLabel }), !manual ? _jsx("div", { className: "mt-0.5 text-xs text-muted-foreground", children: status.message ?? (status.status === 'configured'
                                     ? `${clientLabel} 正在使用 Xpod。`
-                                    : '可自动写入本机配置。') }) : null] }), !manual ? _jsx(Badge, { variant: "secondary", children: statusLabel(status.status) }) : null, manual ? (_jsx(AiCopyButton, { value: manualConfig, label: `${clientLabel} 配置`, variant: "ghost", size: "icon", iconClassName: "h-4 w-4" })) : (_jsxs("div", { className: "flex items-center gap-1", children: [_jsx(Button, { variant: "outline", size: "sm", "aria-label": `配置 ${clientLabel}`, disabled: busy, onClick: () => void plan(), children: "\u914D\u7F6E" }), _jsx(Button, { variant: "ghost", size: "icon", "aria-label": `恢复 ${clientLabel} 配置`, disabled: status.status === 'notConfigured' || busy, onClick: () => void restore(), children: _jsx(RotateCcw, { className: "h-4 w-4" }) })] }))] }) : null, compact && busy ? (_jsxs("div", { className: "py-1 text-xs text-muted-foreground", children: ["\u6B63\u5728\u5E94\u7528 ", clientLabel, " \u914D\u7F6E\u2026"] })) : null, compact && !busy && status.message ? (_jsxs("div", { className: "flex flex-wrap items-center justify-between gap-2 py-1 text-xs text-destructive", children: [_jsx("span", { children: status.message }), _jsx(Button, { variant: "outline", size: "sm", onClick: () => void plan(), children: "\u91CD\u8BD5\u5E94\u7528\u914D\u7F6E" })] })) : null, dryRun ? (_jsxs("div", { className: "space-y-3 border-t border-border/60 bg-muted/20 px-4 py-3", children: [_jsx("div", { className: "text-xs font-medium", children: "\u5C06\u6267\u884C\u4EE5\u4E0B\u66F4\u6539" }), dryRun.changes.map((change) => (_jsxs("div", { className: "text-xs text-muted-foreground", children: [_jsx("span", { className: "font-mono", children: change.target }), ' · ', changeActionLabel(change.action), change.backup ? ' · 创建备份' : ''] }, `${change.target}:${change.action}`))), confirmation?.required ? (_jsxs("div", { className: "space-y-2", children: [confirmation.message ? _jsx("div", { className: "text-xs text-muted-foreground", children: confirmation.message }) : null, _jsxs("div", { className: "text-xs text-muted-foreground", children: ["\u786E\u8BA4\u7801\uFF1A", _jsx("code", { className: "font-mono text-foreground", children: confirmation.token })] }), _jsx(Input, { "aria-label": `输入确认码以应用 ${clientLabel} 配置`, value: confirmationValue, onChange: (event) => setConfirmationValue(event.target.value) })] })) : null, _jsxs("div", { className: "flex gap-2", children: [_jsx(Button, { size: "sm", "aria-label": confirmation?.required
+                                    : '可自动写入本机配置。') }) : null] }), !manual ? _jsx(Badge, { variant: "secondary", children: statusLabel(status.status) }) : null, manual ? (_jsx(AiCopyButton, { value: manualConfig, label: `${clientLabel} 配置`, variant: "ghost", size: "icon", iconClassName: "h-4 w-4" })) : (_jsxs("div", { className: "flex items-center gap-1", children: [_jsx(Button, { variant: "outline", size: "sm", "aria-label": `配置 ${clientLabel}`, disabled: busy, onClick: () => void plan(), children: "\u914D\u7F6E" }), _jsx(Button, { variant: "ghost", size: "icon", "aria-label": `恢复 ${clientLabel} 配置`, disabled: status.status === 'notConfigured' || busy, onClick: () => void restore(), children: _jsx(RotateCcw, { className: "h-4 w-4" }) })] }))] }) : null, compact && busy ? (_jsxs("div", { className: "py-1 text-xs text-muted-foreground", children: ["\u6B63\u5728\u5E94\u7528 ", clientLabel, " \u914D\u7F6E\u2026"] })) : null, compact && !busy && status.message ? (_jsxs("div", { className: "flex flex-wrap items-center justify-between gap-2 py-1 text-xs text-destructive", children: [_jsx("span", { children: status.message }), _jsx(Button, { variant: "outline", size: "sm", onClick: () => void plan(), children: "\u91CD\u8BD5\u5E94\u7528\u914D\u7F6E" })] })) : null, stages.length > 0 ? (_jsx("ul", { "data-testid": "client-setup-stages", className: "space-y-1 border-t border-border/60 px-4 py-3 text-xs", children: stages.map((stage) => (_jsxs("li", { "data-testid": "client-setup-stage", "data-stage": stage.id, "data-stage-state": stage.state, className: "flex gap-2", children: [_jsx("span", { "aria-hidden": "true", children: stage.state === 'ok' ? '✓' : stage.state === 'failed' ? '✕' : '?' }), _jsx("span", { className: "font-medium", children: stage.label }), _jsx("span", { className: "min-w-0 flex-1 text-muted-foreground", children: stage.detail })] }, stage.id))) })) : null, dryRun ? (_jsxs("div", { className: "space-y-3 border-t border-border/60 bg-muted/20 px-4 py-3", children: [_jsx("div", { className: "text-xs font-medium", children: "\u5C06\u6267\u884C\u4EE5\u4E0B\u66F4\u6539" }), dryRun.changes.map((change) => (_jsxs("div", { className: "text-xs text-muted-foreground", children: [_jsx("span", { className: "font-mono", children: change.target }), ' · ', changeActionLabel(change.action), change.backup ? ' · 创建备份' : ''] }, `${change.target}:${change.action}`))), confirmation?.required ? (_jsxs("div", { className: "space-y-2", children: [confirmation.message ? _jsx("div", { className: "text-xs text-muted-foreground", children: confirmation.message }) : null, _jsxs("div", { className: "text-xs text-muted-foreground", children: ["\u786E\u8BA4\u7801\uFF1A", _jsx("code", { className: "font-mono text-foreground", children: confirmation.token })] }), _jsx(Input, { "aria-label": `输入确认码以应用 ${clientLabel} 配置`, value: confirmationValue, onChange: (event) => setConfirmationValue(event.target.value) })] })) : null, _jsxs("div", { className: "flex gap-2", children: [_jsx(Button, { size: "sm", "aria-label": confirmation?.required
                                     ? `确认并应用 ${clientLabel} 配置`
                                     : `应用 ${clientLabel} 配置`, disabled: !createClientCredential || busy || !confirmationSatisfied, onClick: () => void apply(), children: confirmation?.required ? '确认并应用' : '应用配置' }), _jsx(Button, { variant: "ghost", size: "sm", disabled: busy, onClick: () => {
                                     setDryRun(undefined);

package/node_modules/@undefineds.co/ai-connections/dist/AiConnectDialog.d.ts

@@ -1,8 +1,8 @@
-import type { AiConnectAttempt, AiConnectionsMode, AiProviderAuthorizationMethod, AiProviderCredentialSummary, AiProviderOffering } from './contract/ai-connections-client';
-import type { AiProviderDefinition } from './controller';
-import type { ProviderConnectionState } from './AiProviderCard';
-import type { AiOfferingActionError } from './AiCredentialPoolSection';
-import type { AiConnectDialogController } from './useAiConnectDialog';
+import type { AiConnectAttempt, AiConnectionsMode, AiProviderAuthorizationMethod, AiProviderCredentialSummary, AiProviderOffering } from './contract/ai-connections-client.js';
+import type { AiProviderDefinition } from './controller.js';
+import type { ProviderConnectionState } from './AiProviderCard.js';
+import type { AiOfferingActionError } from './AiCredentialPoolSection.js';
+import type { AiConnectDialogController } from './useAiConnectDialog.js';
 /**
  * The connect dialog: one fieldset per offering, each showing whichever step that
  * offering is on - unavailable, waiting for an authorization, failed, or the API
@@ -30,6 +30,7 @@ export declare function AiConnectDialog({ controller, definition, offerings, api
     onSaveApiKey: () => void;
     onDisconnect: (credential?: AiProviderCredentialSummary) => void;
     onUpdateCredential?: (credential: AiProviderCredentialSummary, patch: {
+        apiKey?: string;
         label?: string;
         enabled?: boolean;
         priority?: number;