@wengine-ai/ccr-provider-qoder 0.0.0-stage → 0.2.0

package/README.md

@@ -1,3 +1,55 @@
-# Temporary Holding Version
+# @wengine-ai/ccr-provider-qoder
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Qoder subscription provider plugin for [claude-code-router](https://github.com/wengine-ai/claude-code-router-next), covering both Qoder sites: **qoder.com** (international) and **qoder.cn** (Qoder CN).
+
+## What it provides
+
+Everything below exists once per site; the two sites are independent (own account, own credentials, own models, own quota):
+
+| | international | Qoder CN |
+|---|---|---|
+| managed provider | `qoder-subscription` | `qoder-cn-subscription` |
+| marker credential | `ccr-managed-qoder` | `ccr-managed-qoder-cn` |
+| credential file | `qoder-credentials.json` | `qoder-cn-credentials.json` |
+| fixed chat upstream | `api3.qoder.sh` | `gateway.qoder.com.cn` |
+| admin routes | `/api/qoder/*` | `/api/qoder/cn/*` |
+| transformer | `qoder` | `qoder-cn` |
+
+- **Transformer** (`qoder` / `qoder-cn`): unified → chat-completions request conversion (leading system message, thinking → `reasoning_content`, stable session id → `prompt_cache_key`, reasoning effort passthrough) and strict SSE/JSON response validation (error-frame classification, `[DONE]` integrity, usage mapping). The conversion is site-independent; each managed provider locks its own transformer name.
+- **Managed runtime** (`qoder` / `qoder-cn`): pins that site's fixed chat upstream, routes through the host's subscription dispatcher, owns abort/deadline wiring and the error taxonomy (`qoder_reauth_required`, `qoder_rate_limited` with `retry_after`-derived cooldown, `qoder_upstream_error`). A runtime claims only its own managed provider.
+- **Auth service**: PAT sign-in with the job-token engine, per-site credential file (0600, atomic, size-capped), model sync/visibility, usage reads with a 60s cache, cooling circuit breaker and reconnect.
+- **Admin routes** (loopback-only, per site): status, connect, sync, usage, model visibility, disconnect.
+- **One config protector**: re-locks BOTH managed providers in a single pass and re-adds any of them that vanish from the config.
+- **UI card + locales** (en/zh): one card with two independent sections (Qoder / Qoder CN) — PAT connect form, status, quota windows, model management.
+
+## PAT setup
+
+For the international site:
+
+1. Sign in at [qoder.com](https://qoder.com) and open **Account → Integrations** (`qoder.com/account/integrations`).
+2. Create a personal access token (starts with `pt-`).
+
+For Qoder CN, do the same on [qoder.cn](https://qoder.cn) (the token exchange runs against `openapi.qoder.com.cn`).
+
+Then, in the CCR settings page, open the Qoder card and use the matching section (**Qoder** or **Qoder CN**):
+
+3. Paste the token and press **Connect**. The token is kept only in that site's private credential file and is cleared from the form immediately.
+4. Press **Refresh models** to sync the model list.
+
+Both sections can be connected at the same time; disconnecting one never touches the other.
+
+## Scope limits
+
+- Remote origins are fixed per site: `openapi.qoder.sh` / `api3.qoder.sh` for qoder.com and `openapi.qoder.com.cn` / `gateway.qoder.com.cn` for qoder.cn. No device flow, no campaigns/check-in, no VPC, no QwenWork.
+- Sign-in is PAT-only; the job token is refreshed from its refresh token when present, and a lapsed/absent refresh falls back to PAT re-exchange (a refused PAT marks that site's account expired until you reconnect). The PAT is kept in the plugin's private 0600 credential file.
+
+## Development
+
+```sh
+pnpm install     # standalone package deps
+pnpm vitest run  # fully offline tests (all fetch mocked/injected)
+pnpm tsc --noEmit
+pnpm build       # produces dist/ (self-contained plugin + UI card bundles)
+```
+
+Tests never touch the network: every engine is injected via `options.engine`, every fetch is mocked.

package/dist/README.md

@@ -0,0 +1,55 @@
+# @wengine-ai/ccr-provider-qoder
+
+Qoder subscription provider plugin for [claude-code-router](https://github.com/wengine-ai/claude-code-router-next), covering both Qoder sites: **qoder.com** (international) and **qoder.cn** (Qoder CN).
+
+## What it provides
+
+Everything below exists once per site; the two sites are independent (own account, own credentials, own models, own quota):
+
+| | international | Qoder CN |
+|---|---|---|
+| managed provider | `qoder-subscription` | `qoder-cn-subscription` |
+| marker credential | `ccr-managed-qoder` | `ccr-managed-qoder-cn` |
+| credential file | `qoder-credentials.json` | `qoder-cn-credentials.json` |
+| fixed chat upstream | `api3.qoder.sh` | `gateway.qoder.com.cn` |
+| admin routes | `/api/qoder/*` | `/api/qoder/cn/*` |
+| transformer | `qoder` | `qoder-cn` |
+
+- **Transformer** (`qoder` / `qoder-cn`): unified → chat-completions request conversion (leading system message, thinking → `reasoning_content`, stable session id → `prompt_cache_key`, reasoning effort passthrough) and strict SSE/JSON response validation (error-frame classification, `[DONE]` integrity, usage mapping). The conversion is site-independent; each managed provider locks its own transformer name.
+- **Managed runtime** (`qoder` / `qoder-cn`): pins that site's fixed chat upstream, routes through the host's subscription dispatcher, owns abort/deadline wiring and the error taxonomy (`qoder_reauth_required`, `qoder_rate_limited` with `retry_after`-derived cooldown, `qoder_upstream_error`). A runtime claims only its own managed provider.
+- **Auth service**: PAT sign-in with the job-token engine, per-site credential file (0600, atomic, size-capped), model sync/visibility, usage reads with a 60s cache, cooling circuit breaker and reconnect.
+- **Admin routes** (loopback-only, per site): status, connect, sync, usage, model visibility, disconnect.
+- **One config protector**: re-locks BOTH managed providers in a single pass and re-adds any of them that vanish from the config.
+- **UI card + locales** (en/zh): one card with two independent sections (Qoder / Qoder CN) — PAT connect form, status, quota windows, model management.
+
+## PAT setup
+
+For the international site:
+
+1. Sign in at [qoder.com](https://qoder.com) and open **Account → Integrations** (`qoder.com/account/integrations`).
+2. Create a personal access token (starts with `pt-`).
+
+For Qoder CN, do the same on [qoder.cn](https://qoder.cn) (the token exchange runs against `openapi.qoder.com.cn`).
+
+Then, in the CCR settings page, open the Qoder card and use the matching section (**Qoder** or **Qoder CN**):
+
+3. Paste the token and press **Connect**. The token is kept only in that site's private credential file and is cleared from the form immediately.
+4. Press **Refresh models** to sync the model list.
+
+Both sections can be connected at the same time; disconnecting one never touches the other.
+
+## Scope limits
+
+- Remote origins are fixed per site: `openapi.qoder.sh` / `api3.qoder.sh` for qoder.com and `openapi.qoder.com.cn` / `gateway.qoder.com.cn` for qoder.cn. No device flow, no campaigns/check-in, no VPC, no QwenWork.
+- Sign-in is PAT-only; the job token is refreshed from its refresh token when present, and a lapsed/absent refresh falls back to PAT re-exchange (a refused PAT marks that site's account expired until you reconnect). The PAT is kept in the plugin's private 0600 credential file.
+
+## Development
+
+```sh
+pnpm install     # standalone package deps
+pnpm vitest run  # fully offline tests (all fetch mocked/injected)
+pnpm tsc --noEmit
+pnpm build       # produces dist/ (self-contained plugin + UI card bundles)
+```
+
+Tests never touch the network: every engine is injected via `options.engine`, every fetch is mocked.

package/dist/THIRD_PARTY_NOTICES.md

@@ -0,0 +1,63 @@
+# Third-party notices
+
+`src/vendor/engine.mjs` is a locally modified extracted subset of
+[magpie-community/plugins](https://github.com/magpie-community/plugins),
+`packages/qoder/index.mjs` at commit
+`bace91473b4f113a719a49b7d8ce81fe1f5b5760`, published as
+`@magpie-community/opencode-qoder-auth` version `0.2.40`.
+Only the qoder.com international protocol and PAT authentication subset is
+included. Local modifications provide an injected transport and clock,
+per-engine caches, cancellation, credential renewal notification, and CCR
+error envelopes. Device sign-in, campaigns, VPC and other sites are excluded.
+
+The upstream protocol implementation credits CLIProxyAPI's MIT-licensed
+Qoder support (https://github.com/ufec/CLIProxyAPI), via magpie's internal/qoder.
+
+## magpie-community/plugins license
+
+MIT License
+
+Copyright (c) 2026 magpie-community contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+## CLIProxyAPI license
+
+MIT License
+
+Copyright (c) 2025-2005.9 Luis Pater
+Copyright (c) 2025.9-present Router-For.ME
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/card.js

@@ -0,0 +1,425 @@
+// src/locales.ts
+var qoderLocales = {
+  en: { qoder: {
+    title: "Qoder Subscription",
+    description: "Connects a qoder.com personal access token (PAT). Tokens stay on this machine, are never logged and are cleared from the form after connecting.",
+    cnTitle: "Qoder CN Subscription",
+    cnDescription: "Connects a qoder.cn (Qoder China) personal access token (PAT). Tokens stay on this machine, are never logged and are cleared from the form after connecting.",
+    loading: "Loading\u2026",
+    not_connected: "Not connected",
+    connected: "Connected",
+    expired: "Sign-in lapsed \u2014 reconnect with a fresh PAT",
+    error: "Management request failed",
+    account: "Account",
+    models: "Models",
+    models_count: "{{count}} models",
+    pat: "Personal access token",
+    patPlaceholder: "pt-\u2026",
+    connect: "Connect",
+    sync: "Refresh models",
+    usage: "Refresh quota",
+    unknown: "Quota unknown",
+    stale: "Last known quota (stale)",
+    used: "Allowance",
+    restore_partial: "Partially completed: restored {{count}} of {{total}} models. Management request failed.",
+    hide_partial: "Partially completed: hid {{count}} of {{total}} models. Management request failed.",
+    restore_model: "Restore {{model}}",
+    disconnect: "Disconnect",
+    hide_model: "Hide {{model}}",
+    hidden_models: "Hidden models ({{count}})",
+    restore: "Restore",
+    restore_all: "Restore all",
+    cooling: "Rate limited until",
+    noModels: "Refresh models after connecting",
+    free: "free",
+    refresh: "Refresh status"
+  } },
+  zh: { qoder: {
+    title: "Qoder \u8BA2\u9605",
+    description: "\u4F7F\u7528 qoder.com \u4E2A\u4EBA\u8BBF\u95EE\u4EE4\u724C\uFF08PAT\uFF09\u8FDE\u63A5\u3002\u4EE4\u724C\u4EC5\u4FDD\u5B58\u5728\u672C\u673A\uFF0C\u4E0D\u4F1A\u88AB\u8BB0\u5F55\uFF0C\u8FDE\u63A5\u6210\u529F\u540E\u5373\u4ECE\u8868\u5355\u6E05\u9664\u3002",
+    cnTitle: "Qoder \u56FD\u5185\u7248\u8BA2\u9605",
+    cnDescription: "\u4F7F\u7528 qoder.cn\uFF08Qoder \u56FD\u5185\u7248\uFF09\u4E2A\u4EBA\u8BBF\u95EE\u4EE4\u724C\uFF08PAT\uFF09\u8FDE\u63A5\u3002\u4EE4\u724C\u4EC5\u4FDD\u5B58\u5728\u672C\u673A\uFF0C\u4E0D\u4F1A\u88AB\u8BB0\u5F55\uFF0C\u8FDE\u63A5\u6210\u529F\u540E\u5373\u4ECE\u8868\u5355\u6E05\u9664\u3002",
+    loading: "\u52A0\u8F7D\u4E2D\u2026",
+    not_connected: "\u672A\u8FDE\u63A5",
+    connected: "\u5DF2\u8FDE\u63A5",
+    expired: "\u767B\u5F55\u5DF2\u5931\u6548 \u2014 \u8BF7\u4F7F\u7528\u65B0\u7684 PAT \u91CD\u65B0\u8FDE\u63A5",
+    error: "\u7BA1\u7406\u64CD\u4F5C\u5931\u8D25",
+    account: "\u8D26\u53F7",
+    models: "\u6A21\u578B",
+    models_count: "{{count}} \u4E2A\u6A21\u578B",
+    pat: "\u4E2A\u4EBA\u8BBF\u95EE\u4EE4\u724C",
+    patPlaceholder: "pt-\u2026",
+    connect: "\u8FDE\u63A5",
+    sync: "\u5237\u65B0\u6A21\u578B",
+    usage: "\u5237\u65B0\u989D\u5EA6",
+    unknown: "\u989D\u5EA6\u672A\u77E5",
+    stale: "\u4E0A\u6B21\u989D\u5EA6\uFF08\u5DF2\u8FC7\u671F\uFF09",
+    used: "\u5DF2\u7528\u989D\u5EA6",
+    restore_partial: "\u90E8\u5206\u5B8C\u6210\uFF1A\u5DF2\u6062\u590D {{count}} \u4E2A\u6A21\u578B\uFF0C\u5171 {{total}} \u4E2A\u3002\u7BA1\u7406\u64CD\u4F5C\u5931\u8D25\u3002",
+    hide_partial: "\u90E8\u5206\u5B8C\u6210\uFF1A\u5DF2\u9690\u85CF {{count}} \u4E2A\u6A21\u578B\uFF0C\u5171 {{total}} \u4E2A\u3002\u7BA1\u7406\u64CD\u4F5C\u5931\u8D25\u3002",
+    restore_model: "\u6062\u590D {{model}}",
+    disconnect: "\u65AD\u5F00\u8FDE\u63A5",
+    hide_model: "\u9690\u85CF {{model}}",
+    hidden_models: "\u5DF2\u9690\u85CF\u6A21\u578B\uFF08{{count}}\uFF09",
+    restore: "\u6062\u590D",
+    restore_all: "\u6062\u590D\u5168\u90E8",
+    cooling: "\u9650\u6D41\u81F3",
+    noModels: "\u8FDE\u63A5\u540E\u8BF7\u5237\u65B0\u6A21\u578B",
+    free: "\u514D\u8D39",
+    refresh: "\u5237\u65B0\u72B6\u6001"
+  } }
+};
+
+// src/protocol.ts
+var CHAT_PATH = "/algo/api/v2/service/pro/sse/agent_chat_generation?FetchKeys=llm_model_result&AgentId=agent_common&Encode=1";
+var QODER_SITES = Object.freeze([
+  {
+    id: "qoder",
+    label: "Qoder",
+    openapi: "https://openapi.qoder.sh",
+    api: "https://api3.qoder.sh",
+    web: "https://qoder.com",
+    chatUrl: `https://api3.qoder.sh${CHAT_PATH}`,
+    provider: "qoder-subscription",
+    marker: "ccr-managed-qoder",
+    credentialFile: "qoder-credentials.json",
+    routeBase: "/api/qoder"
+  },
+  {
+    id: "qoder-cn",
+    label: "Qoder CN",
+    openapi: "https://openapi.qoder.com.cn",
+    api: "https://gateway.qoder.com.cn",
+    web: "https://qoder.cn",
+    chatUrl: `https://gateway.qoder.com.cn${CHAT_PATH}`,
+    provider: "qoder-cn-subscription",
+    marker: "ccr-managed-qoder-cn",
+    credentialFile: "qoder-cn-credentials.json",
+    routeBase: "/api/qoder/cn"
+  }
+]);
+var QODER_CHAT = QODER_SITES[0].chatUrl;
+var QODER_PROVIDER = QODER_SITES[0].provider;
+var QODER_MARKER = QODER_SITES[0].marker;
+function qoderSite(site) {
+  return QODER_SITES.find((s) => s.id === site) ?? QODER_SITES[0];
+}
+function qoderCardPrefix(site) {
+  const base = QODER_SITES[0].routeBase;
+  return qoderSite(site).routeBase.slice(base.length);
+}
+function isQoderManaged(p, site = "qoder") {
+  const managedBy = qoderSite(site);
+  const name = p?.name;
+  const owner = typeof name === "string" ? QODER_SITES.find((s) => s.provider === name) : void 0;
+  if (owner) {
+    return owner.id === managedBy.id && (p?.qoder_managed === true || p?.qoderManaged === true || (p?.api_key ?? p?.apiKey) === managedBy.marker);
+  }
+  if (managedBy.id !== QODER_SITES[0].id) return false;
+  return p?.qoder_managed === true || p?.qoderManaged === true;
+}
+function mergeQoderProvider(current, server, site = "qoder") {
+  const managedBy = qoderSite(site);
+  const next = { ...current };
+  const key = Array.isArray(current?.providers) && !Array.isArray(current?.Providers) ? "providers" : "Providers";
+  const managed = (server?.Providers ?? server?.providers ?? []).find((p) => isQoderManaged(p, managedBy.id));
+  const list = [...current?.[key] ?? []];
+  const at = list.findIndex((p) => isQoderManaged(p, managedBy.id));
+  if (at >= 0) {
+    if (managed) list[at] = managed;
+    else list.splice(at, 1);
+  } else if (managed && !list.some((p) => p?.name === managedBy.provider)) list.push(managed);
+  next[key] = list;
+  return next;
+}
+var RETRY_AFTER_MAX_MS = 30 * 6e4;
+
+// src/card-entry.ts
+var mounted = /* @__PURE__ */ new WeakMap();
+function mount(el, props) {
+  unmount(el);
+  const lang = props.locale.toLowerCase().startsWith("zh") ? "zh" : "en";
+  const words = { ...qoderLocales[lang].qoder, ...props.locales?.[lang]?.qoder ?? {} };
+  const sections = QODER_SITES.map((site) => ({ site, prefix: qoderCardPrefix(site.id), error: false, busy: false, draft: "" }));
+  const panels = /* @__PURE__ */ new Map();
+  let disposed = false;
+  const abort = new AbortController();
+  const call = (section, path, body) => props.callApi(`${section.prefix}${path}`, {
+    method: body === void 0 ? "GET" : "POST",
+    ...body === void 0 ? {} : { body: JSON.stringify(body) },
+    signal: abort.signal,
+    timeoutMs: 45e3
+  });
+  const node = (tag, text, cls = "") => {
+    const n = document.createElement(tag);
+    n.textContent = text;
+    n.className = cls;
+    return n;
+  };
+  const CHIP = "inline-flex max-w-full items-center gap-1 break-all whitespace-normal rounded-lg border border-white/5 bg-white/5 px-2 py-0.5 text-[10px] font-bold text-muted-foreground";
+  const CHIP_HIDE = "rounded p-0.5 text-muted-foreground/60 transition-colors hover:bg-white/10 hover:text-foreground disabled:opacity-40";
+  const BUTTON_BASE = "inline-flex items-center justify-center gap-2 whitespace-nowrap rounded-xl text-sm font-semibold ring-offset-background transition-all duration-200 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2 disabled:pointer-events-none disabled:opacity-50 [&_svg]:pointer-events-none [&_svg]:size-4 [&_svg]:shrink-0 active:scale-95";
+  const BUTTON_OUTLINE = "border border-input bg-input/50 backdrop-blur-md shadow-sm hover:bg-input/80 hover:border-primary/50 hover:shadow-md hover:text-accent-foreground";
+  const xIcon = (className) => {
+    const svg = document.createElementNS("http://www.w3.org/2000/svg", "svg");
+    svg.setAttribute("xmlns", "http://www.w3.org/2000/svg");
+    svg.setAttribute("width", "24");
+    svg.setAttribute("height", "24");
+    svg.setAttribute("viewBox", "0 0 24 24");
+    svg.setAttribute("fill", "none");
+    svg.setAttribute("stroke", "currentColor");
+    svg.setAttribute("stroke-width", "2");
+    svg.setAttribute("stroke-linecap", "round");
+    svg.setAttribute("stroke-linejoin", "round");
+    svg.setAttribute("aria-hidden", "true");
+    svg.setAttribute("class", className);
+    for (const d of ["M18 6 6 18", "m6 6 12 12"]) {
+      const path = document.createElementNS("http://www.w3.org/2000/svg", "path");
+      path.setAttribute("d", d);
+      svg.appendChild(path);
+    }
+    return svg;
+  };
+  const format = (key, vars = {}) => String(words[key] ?? key).replace(/\{\{(\w+)\}\}/g, (_, name) => String(vars[name] ?? ""));
+  const sectionBusy = () => disposed || props.disabled || sections.some((s) => s.busy);
+  const sectionWords = (section) => section.site.id === "qoder" ? { title: words.title, description: words.description } : { title: words.cnTitle, description: words.cnDescription };
+  const finish = (section) => {
+    section.busy = false;
+    section.pendingModel = null;
+    section.release?.();
+    section.release = void 0;
+    props.onBusy?.(false);
+    if (!disposed) render();
+  };
+  const refresh = async (section) => {
+    section.status = await call(section, "/status");
+    if (!disposed) render();
+  };
+  const reconcile = (section) => props.refreshConfig?.((current, server) => mergeQoderProvider(current, server, section.site.id));
+  const run = async (section, fn) => {
+    if (disposed || section.busy || props.disabled || !props.acquireManagement) return;
+    const lease = props.acquireManagement();
+    if (!lease) return;
+    section.release = lease;
+    section.busy = true;
+    section.error = false;
+    section.errorMessage = void 0;
+    props.onBusy?.(true);
+    render();
+    try {
+      await fn();
+    } catch {
+      section.error = true;
+    } finally {
+      finish(section);
+    }
+  };
+  const connect = (section, input) => void run(section, async () => {
+    const pat = input.value;
+    try {
+      await call(section, "/connect", { pat });
+      input.value = "";
+      section.draft = "";
+      await reconcile(section);
+      await refresh(section);
+    } catch (e) {
+      input.value = "";
+      section.draft = "";
+      throw e;
+    }
+  });
+  const action = (section, label, fn) => {
+    const button = node("button", words[label], "px-3 py-2 rounded-md bg-secondary text-secondary-foreground hover:bg-secondary/80 disabled:opacity-50");
+    button.disabled = sectionBusy();
+    button.onclick = fn;
+    return button;
+  };
+  const smallButton = (label, extra, fn) => {
+    const button = node("button", label, `${BUTTON_BASE} ${BUTTON_OUTLINE} ${extra}`);
+    button.type = "button";
+    button.disabled = sectionBusy();
+    button.onclick = fn;
+    return button;
+  };
+  const setModelVisibility = (section, ids, hidden) => void run(section, async () => {
+    let completed = 0;
+    try {
+      for (const id of ids) {
+        await call(section, "/models/visibility", { model: id, hidden });
+        completed += 1;
+      }
+    } catch (error) {
+      if (completed > 0) section.errorMessage = format(hidden ? "hide_partial" : "restore_partial", { count: completed, total: ids.length });
+      throw error;
+    } finally {
+      try {
+        await reconcile(section);
+      } finally {
+        await refresh(section);
+      }
+    }
+  });
+  const renderSection = (section) => {
+    const panel = node("div", "", "space-y-3 border-t border-border pt-4 first:border-t-0 first:pt-0");
+    panel.append(
+      node("h3", sectionWords(section).title, "font-semibold text-lg"),
+      node("p", sectionWords(section).description, "text-sm text-muted-foreground")
+    );
+    panel.append(node("p", section.status ? words[section.status.status] ?? words.error : words.loading));
+    if (section.status?.expired) panel.append(node("p", words.expired, "text-destructive"));
+    if (section.status?.account) panel.append(node("p", `${words.account}: ${section.status.account}`));
+    if (section.error) panel.append(node("p", section.errorMessage ?? words.error, "text-destructive"));
+    const buttons = node("div", "", "flex flex-wrap gap-2");
+    if (section.status?.status === "not_connected") {
+      const input = node("input", "", "w-full rounded-md border border-input bg-background px-3 py-2 text-sm");
+      input.type = "password";
+      input.placeholder = words.patPlaceholder;
+      input.autocomplete = "off";
+      input.setAttribute("aria-label", words.pat);
+      input.value = section.draft;
+      input.oninput = () => {
+        section.draft = input.value;
+      };
+      const connectButton = action(section, "connect", () => connect(section, input));
+      input.onkeydown = (e) => {
+        if (e.key === "Enter") connect(section, input);
+      };
+      panel.append(node("p", words.pat, "text-sm font-medium"), input);
+      buttons.append(connectButton);
+    } else if (section.status) {
+      buttons.append(action(section, "sync", () => void run(section, async () => {
+        await call(section, "/sync", {});
+        await reconcile(section);
+        await refresh(section);
+      })));
+      buttons.append(action(section, "usage", () => void run(section, async () => {
+        section.usage = await call(section, "/usage", {});
+      })));
+      buttons.append(action(section, "disconnect", () => void run(section, async () => {
+        await call(section, "/disconnect", {});
+        section.usage = void 0;
+        await reconcile(section);
+        await refresh(section);
+      })));
+    }
+    buttons.append(action(section, "refresh", () => void run(section, () => refresh(section))));
+    panel.append(buttons);
+    const usageLine = node("p", "", "text-sm text-muted-foreground");
+    if (section.usage?.known && Array.isArray(section.usage.windows) && section.usage.windows.length) {
+      usageLine.textContent = `${section.usage.stale ? words.stale : words.used}: ` + section.usage.windows.map((w) => {
+        const name = typeof w?.name === "string" ? w.name.slice(0, 100) : "?";
+        const detail = typeof w?.display === "string" && w.display ? w.display : Number.isFinite(w?.used) ? `${Math.round(w.used)}%` : "?";
+        return `${name}: ${detail}`;
+      }).join(" \xB7 ");
+    } else usageLine.textContent = words.unknown;
+    panel.append(usageLine);
+    if (section.status?.coolingUntil > Date.now()) panel.append(node("p", `${words.cooling}: ${new Date(section.status.coolingUntil).toLocaleString()}`, "text-sm text-muted-foreground"));
+    const models = Array.isArray(section.status?.models) ? section.status.models : [];
+    const visible = models.filter((model) => !model.hidden);
+    const hiddenModels = models.filter((model) => model.hidden);
+    if (section.status?.status === "connected" || models.length) {
+      const count = node("dl", "", "grid max-w-md grid-cols-[auto_minmax(0,1fr)] gap-x-3 gap-y-1 text-xs");
+      count.append(
+        node("dt", words.models, "text-muted-foreground"),
+        node("dd", format("models_count", { count: section.status?.modelCount ?? models.length }), "break-all text-foreground")
+      );
+      panel.append(count);
+    }
+    if (!models.length) panel.append(node("p", words.noModels, "text-sm text-muted-foreground"));
+    if (visible.length) {
+      const chips = node("div", "", "flex flex-wrap gap-2 pt-1");
+      for (const model of visible) {
+        const id = String(model.id);
+        const chip = node("span", id, CHIP);
+        if (model.context) chip.append(node("span", String(model.context), "font-medium text-muted-foreground/60"));
+        if (model.free) chip.append(node("span", words.free, "font-medium text-muted-foreground/60"));
+        const hide = node("button", "", CHIP_HIDE);
+        hide.type = "button";
+        hide.disabled = sectionBusy();
+        hide.setAttribute("aria-label", format("hide_model", { model: id }));
+        hide.setAttribute("aria-busy", String(section.busy && section.pendingModel === id));
+        hide.append(xIcon("h-3 w-3"));
+        hide.onclick = () => {
+          section.pendingModel = id;
+          setModelVisibility(section, [id], true);
+        };
+        chip.append(hide);
+        chips.append(chip);
+      }
+      panel.append(chips);
+    }
+    if (hiddenModels.length) {
+      const details = node("details", "", "max-w-md text-xs text-muted-foreground");
+      details.append(node("summary", format("hidden_models", { count: hiddenModels.length }), "cursor-pointer select-none font-medium"));
+      const list = node("ul", "", "mt-2 space-y-1");
+      for (const model of hiddenModels) {
+        const id = String(model.id);
+        const item = node("li", "", "flex items-center justify-between gap-2");
+        item.append(node("span", id, "break-all font-mono"));
+        const restore = smallButton(
+          words.restore,
+          "h-6 shrink-0 px-2 text-[11px]",
+          () => {
+            section.pendingModel = id;
+            setModelVisibility(section, [id], false);
+          }
+        );
+        restore.setAttribute("aria-label", format("restore_model", { model: id }));
+        item.append(restore);
+        list.append(item);
+      }
+      details.append(list);
+      details.append(smallButton(
+        words.restore_all,
+        "mt-2 h-7 px-2 text-[11px]",
+        () => setModelVisibility(section, hiddenModels.map((model) => String(model.id)), false)
+      ));
+      panel.append(details);
+    }
+    return panel;
+  };
+  const render = () => {
+    if (disposed) return;
+    el.replaceChildren();
+    panels.clear();
+    const card = node("section", "", "glass-card rounded-xl p-5 space-y-4");
+    for (const section of sections) {
+      const panel = renderSection(section);
+      panels.set(section.site.id, panel);
+      card.append(panel);
+    }
+    el.append(card);
+  };
+  const focus = () => {
+    const section = sections.find((s) => props.focusKey === s.site.provider || props.focusKey === s.site.id);
+    const panel = section && panels.get(section.site.id);
+    if (!panel) return;
+    panel.tabIndex = -1;
+    panel.focus();
+    panel.scrollIntoView?.({ block: "nearest" });
+  };
+  const load = (section) => void refresh(section).catch(() => {
+    section.error = true;
+    if (!disposed) render();
+  });
+  const off = props.onHostChange?.(render);
+  mounted.set(el, () => {
+    disposed = true;
+    off?.();
+    abort.abort();
+  });
+  render();
+  focus();
+  for (const section of sections) load(section);
+}
+function unmount(el) {
+  mounted.get(el)?.();
+  mounted.delete(el);
+  el.replaceChildren();
+}
+var card_entry_default = { mount, unmount };
+export {
+  card_entry_default as default,
+  mount,
+  unmount
+};

package/dist/package.json

@@ -0,0 +1,3 @@
+{
+  "type": "module"
+}