dsh-keys-manager 0.0.0 → 0.2.0

package/lib/client.js

@@ -0,0 +1,2106 @@
+/* Keys Manager Client bundle; generated by scripts/build-client.mjs. */
+window.__ModuleLoader__.load({ id: "dsh-keys-manager", factory: (require) => {
+var module = { exports: {} }; var exports = module.exports;
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/client/index.ts
+var index_exports = {};
+__export(index_exports, {
+  apply: () => apply,
+  inject: () => inject
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/client/locales.ts
+var zh = {
+  nav: "\u5BC6\u94A5\u7BA1\u7406",
+  title: "\u5BC6\u94A5\u7BA1\u7406",
+  subtitle: "\u4E3A\u540C\u4E00\u4E2A Provider \u914D\u7F6E\u591A\u4E2A API Key\u3002\u5355\u4F1A\u8BDD\u56FA\u5B9A\u4F7F\u7528\u4E00\u4E2A Key\uFF0C\u65B0\u4F1A\u8BDD\u8F6E\u6362\uFF1B\u5931\u8D25\u540E\u81EA\u52A8\u51B7\u5374\u5E76\u6062\u590D\u3002",
+  search: "\u641C\u7D22 Provider\uFF08\u540D\u79F0\u3001ID \u6216\u73AF\u5883\u53D8\u91CF\uFF09",
+  managed: "\u5DF2\u63A5\u7BA1",
+  available: "\u53EF\u6DFB\u52A0 Providers",
+  managedEmpty: "\u8FD8\u6CA1\u6709\u63A5\u7BA1\u7684 Provider\u3002\u4ECE\u4E0B\u65B9\u9009\u62E9\u4E00\u4E2A\u5F00\u59CB\u3002",
+  availableEmpty: "\u6CA1\u6709\u5339\u914D\u7684 Provider\u3002",
+  keys: "\u5BC6\u94A5",
+  healthy: "\u53EF\u7528",
+  cooling: "\u51B7\u5374\u4E2D",
+  paused: "\u5DF2\u6682\u505C",
+  missing: "\u51ED\u8BC1\u7F3A\u5931",
+  active: "\u6B63\u5E38",
+  unmanaged: "\u672A\u63A5\u7BA1",
+  dshBuiltin: "DSH \u5185\u7F6E",
+  pluginBuiltin: "\u63D2\u4EF6\u5185\u7F6E",
+  customProvider: "\u81EA\u5B9A\u4E49",
+  configured: "\u5DF2\u914D\u7F6E",
+  notConfigured: "\u672A\u914D\u7F6E",
+  adopt: "\u63A5\u7BA1 Provider",
+  adopting: "\u63A5\u7BA1\u4E2D\u2026",
+  release: "\u505C\u6B62\u63A5\u7BA1",
+  releasing: "\u6B63\u5728\u91CA\u653E\u2026",
+  addKey: "\u6DFB\u52A0\u5BC6\u94A5",
+  addKeyTitle: "\u6DFB\u52A0 API Key",
+  alias: "\u522B\u540D",
+  aliasPlaceholder: "\u4F8B\u5982\uFF1A\u4E3B\u7528\u3001\u5907\u7528\u3001Team B",
+  secret: "API Key",
+  secretPlaceholder: "\u7C98\u8D34 Key\uFF1B\u5B83\u5C06\u4FDD\u5B58\u5728\u51ED\u8BC1\u5E93\u4E2D",
+  addKeyHint: "Key \u4F1A\u4FDD\u5B58\u5728 DSH \u51ED\u8BC1\u5E93\u4E2D\uFF0C\u4E4B\u540E\u4E0D\u4F1A\u518D\u663E\u793A\u660E\u6587\u3002",
+  show: "\u663E\u793A",
+  hide: "\u9690\u85CF",
+  save: "\u4FDD\u5B58",
+  saving: "\u4FDD\u5B58\u4E2D\u2026",
+  cancel: "\u53D6\u6D88",
+  rename: "\u6539\u522B\u540D",
+  pause: "\u6682\u505C",
+  resume: "\u6062\u590D",
+  delete: "\u5220\u9664",
+  deleting: "\u5220\u9664\u4E2D\u2026",
+  deleteTitle: "\u5220\u9664\u5BC6\u94A5\u201C{alias}\u201D\uFF1F",
+  deleteBody: "\u5220\u9664\u540E\u8BE5 Key \u4F1A\u4ECE\u51ED\u8BC1\u5E93\u79FB\u9664\u3002\u5982\u679C\u8FD9\u662F\u6700\u540E\u4E00\u4E2A Key\uFF0C\u8BE5 Provider \u5C06\u505C\u6B62\u63A5\u7BA1\u5E76\u6062\u590D\u539F\u6765\u7684 Key \u5F15\u7528\u3002",
+  deleteConfirm: "\u5220\u9664\u5BC6\u94A5",
+  releaseTitle: "\u505C\u6B62\u63A5\u7BA1\u201C{provider}\u201D\uFF1F",
+  releaseBody: "\u63D2\u4EF6\u4F1A\u6062\u590D\u8BE5 Provider \u539F\u6765\u7684 Key \u5F15\u7528\uFF0C\u5E76\u4ECE\u51ED\u8BC1\u5E93\u79FB\u9664\u6240\u6709\u6258\u7BA1 Key\u3002Provider \u914D\u7F6E\u4ECD\u4FDD\u7559\u5728\u6A21\u578B\u8BBE\u7F6E\u4E2D\u3002",
+  releaseBodyCreated: "\u63D2\u4EF6\u4F1A\u79FB\u9664\u5B83\u521B\u5EFA\u7684 Provider \u8DEF\u7531\uFF08\u5305\u62EC\u4E4B\u540E\u5728 Models \u4E2D\u505A\u7684\u4FEE\u6539\uFF09\uFF0C\u5E76\u4ECE\u51ED\u8BC1\u5E93\u79FB\u9664\u6240\u6709\u6258\u7BA1 Key\u3002",
+  releaseConfirm: "\u505C\u6B62\u63A5\u7BA1",
+  lastUsed: "\u6700\u540E\u4F7F\u7528",
+  never: "\u4ECE\u672A\u4F7F\u7528",
+  coolingUntil: "{time} \u6062\u590D",
+  remaining: "\u5269\u4F59 {time}",
+  imported: "\u5DF2\u5BFC\u5165",
+  uses: "\u4F7F\u7528 {n} \u6B21",
+  failures: "\u5931\u8D25 {n} \u6B21",
+  adoptHint: "\u63A5\u7BA1\u540E\uFF0C\u8BE5 Provider \u7684 API Key \u5C06\u7531\u5BC6\u94A5\u7BA1\u7406\u5668\u7EDF\u4E00\u63D0\u4F9B\u3002\u5F53\u524D\u51ED\u8BC1\u4F1A\u5BFC\u5165\u4E3A\u7B2C\u4E00\u4E2A Key\uFF0C\u539F\u5F15\u7528\u4F1A\u4FDD\u7559\u4EE5\u4FBF\u505C\u6B62\u63A5\u7BA1\u65F6\u6062\u590D\u3002",
+  adoptExtraHint: "\u8FD9\u4E2A\u6269\u5C55 Provider \u5C1A\u672A\u914D\u7F6E\u3002\u6DFB\u52A0 Key \u540E\uFF0C\u63D2\u4EF6\u4F1A\u81EA\u52A8\u5B89\u88C5 llm-pi-ai \u8DEF\u7531\uFF0C\u5E76\u4F7F\u7528\u81EA\u52A8\u53D1\u73B0\u6216\u5185\u7F6E\u6A21\u578B\u5217\u8868\u3002",
+  adoptAccountTitle: "\u4F7F\u7528 OAuth \u8D26\u6237\u767B\u5F55\u540E\u5373\u53EF\u4F7F\u7528\u8BE5 Provider\u3002",
+  unsupported: "\u6682\u4E0D\u652F\u6301\u5BC6\u94A5\u6C60",
+  bindingBroken: "Provider \u914D\u7F6E\u5DF2\u4E0D\u518D\u6307\u5411\u5BC6\u94A5\u7BA1\u7406\u5668\u3002\u8BF7\u5148\u505C\u6B62\u63A5\u7BA1\u518D\u91CD\u65B0\u63A5\u7BA1\uFF0C\u6216\u5728\u6A21\u578B\u8BBE\u7F6E\u4E2D\u4FEE\u590D\u8BE5 Provider\u3002",
+  noKeys: "\u8FD8\u6CA1\u6709\u5BC6\u94A5\u3002\u6DFB\u52A0\u4E00\u4E2A\u540E\u5373\u53EF\u4F7F\u7528\u8BE5 Provider\u3002",
+  noKeysAccount: "\u8FD8\u6CA1\u6709\u8D26\u6237\u3002\u6DFB\u52A0\u4E00\u4E2A\u8D26\u6237\u540E\u5373\u53EF\u4F7F\u7528\u8BE5 Provider\u3002",
+  warning: "\u6CE8\u610F",
+  settingsTitle: "\u7B56\u7565",
+  settingsIntro: "\u4EE5\u4E0B\u8BBE\u7F6E\u5BF9\u6240\u6709\u5DF2\u63A5\u7BA1\u7684 Provider \u751F\u6548\u3002",
+  retryCount: "\u5207\u6362 Key \u524D\u91CD\u8BD5\u6B21\u6570",
+  retryHint: "\u540C\u4E00\u4E2A Key \u6700\u591A\u91CD\u8BD5\u8FD9\u4E48\u591A\u6B21\uFF1B\u4E4B\u540E\u8BE5 Key \u8FDB\u5165\u5F02\u5E38\u72B6\u6001\uFF0C\u4F1A\u8BDD\u5207\u6362\u5230\u53E6\u4E00\u4E2A Key\u3002",
+  baseCooldown: "\u521D\u59CB\u51B7\u5374\uFF08\u5206\u949F\uFF09",
+  baseHint: "\u9996\u6B21\u5931\u8D25\u51B7\u5374\u8FD9\u4E48\u4E45\uFF1B\u6062\u590D\u540E\u77ED\u65F6\u95F4\u5185\u518D\u6B21\u5931\u8D25\u4F1A\u7FFB\u500D\u3002",
+  grace: "\u6062\u590D\u89C2\u5BDF\u671F\uFF08\u5206\u949F\uFF09",
+  graceHint: "\u5728\u6062\u590D\u540E\u7684\u8FD9\u4E2A\u65F6\u95F4\u7A97\u53E3\u5185\u518D\u6B21\u5931\u8D25\uFF0C\u4F1A\u63D0\u5347\u4E0B\u4E00\u6B21\u51B7\u5374\u3002",
+  cap: "\u51B7\u5374\u4E0A\u9650\u4E3A 7 \u5929\u3002",
+  strategy: "\u9009\u62E9\u7B56\u7565",
+  strategyBody: "\u6BCF\u4E2A\u4F1A\u8BDD\u56FA\u5B9A\u4E00\u4E2A Key\uFF1B\u65B0\u4F1A\u8BDD\u6309 Round Robin \u53D6\u4E0B\u4E00\u4E2A\u53EF\u7528 Key\u3002\u6682\u505C\u548C\u51B7\u5374\u4E2D\u7684 Key \u4F1A\u88AB\u8DF3\u8FC7\uFF1B\u51B7\u5374\u7ED3\u675F\u540E\u81EA\u52A8\u6062\u590D\u3002",
+  saveSettings: "\u4FDD\u5B58\u7B56\u7565",
+  savingSettings: "\u4FDD\u5B58\u4E2D\u2026",
+  saved: "\u5DF2\u4FDD\u5B58\u3002",
+  writableFalse: "\u5F53\u524D\u914D\u7F6E\u4E3A\u53EA\u8BFB\uFF0C\u65E0\u6CD5\u4FDD\u5B58\u5BC6\u94A5\u53D8\u66F4\u3002",
+  reload: "\u91CD\u8BD5",
+  refresh: "\u5237\u65B0",
+  moreActions: "\u66F4\u591A\u64CD\u4F5C",
+  showAll: "\u663E\u793A\u5168\u90E8 {n} \u4E2A Providers",
+  showLess: "\u6536\u8D77",
+  dismiss: "\u5173\u95ED",
+  loading: "\u52A0\u8F7D\u4E2D\u2026",
+  loadError: "\u65E0\u6CD5\u52A0\u8F7D\u5BC6\u94A5\u7BA1\u7406\u5668\u3002",
+  actionError: "\u64CD\u4F5C\u5931\u8D25\u3002",
+  modelsBadge: "\u7531\u5BC6\u94A5\u7BA1\u7406\u5668\u63A5\u7BA1 \xB7 {n} \u4E2A\u5BC6\u94A5",
+  modelsHint: "\u5728\u63D2\u4EF6 \u2192 \u5BC6\u94A5\u7BA1\u7406\u4E2D\u7F16\u8F91\u5BC6\u94A5\u3002",
+  providerId: "Provider ID",
+  env: "\u73AF\u5883\u53D8\u91CF",
+  baseUrl: "\u7AEF\u70B9",
+  api: "\u534F\u8BAE",
+  models: "\u6A21\u578B",
+  keysSection: "\u5BC6\u94A5",
+  extraSection: "\u6269\u5C55 Providers",
+  noSearch: "\u6362\u4E2A\u5173\u952E\u8BCD\u8BD5\u8BD5\u3002",
+  managedBadge: "\u5DF2\u63A5\u7BA1",
+  timeJustNow: "\u521A\u521A",
+  timeMinutesAgo: "{n} \u5206\u949F\u524D",
+  timeHoursAgo: "{n} \u5C0F\u65F6\u524D",
+  timeDaysAgo: "{n} \u5929\u524D",
+  timeMinutes: "{n} \u5206\u949F",
+  timeHours: "{n} \u5C0F\u65F6",
+  timeDays: "{n} \u5929",
+  timeSeconds: "{n} \u79D2",
+  confirm: "\u786E\u8BA4",
+  close: "\u5173\u95ED",
+  keyStatusActive: "\u6B63\u5E38",
+  keyStatusCooling: "\u51B7\u5374\u4E2D",
+  keyStatusPaused: "\u5DF2\u6682\u505C",
+  keyStatusMissing: "\u51ED\u8BC1\u7F3A\u5931",
+  keyStatusEmpty: "\u6682\u65E0\u5BC6\u94A5",
+  keyStatusUnmanaged: "\u672A\u63A5\u7BA1",
+  providerKeys: "{n} \u4E2A\u5BC6\u94A5",
+  providerKeyOne: "1 \u4E2A\u5BC6\u94A5",
+  countModels: "{n} \u4E2A\u6A21\u578B",
+  storageNote: "Key \u4FDD\u5B58\u5728 DSH \u51ED\u8BC1\u5E93\u4E2D\uFF1B\u5BC6\u94A5\u7BA1\u7406\u5668\u72B6\u6001\u4F4D\u4E8E $DSH_HOME/keys-manager/state.json\uFF0C\u4EC5\u542B\u975E\u654F\u611F\u5143\u6570\u636E\u3002",
+  providerAdopted: "\u5DF2\u63A5\u7BA1\u3002\u539F\u6709\u51ED\u8BC1\u5DF2\u5BFC\u5165\u4E3A\u7B2C\u4E00\u4E2A Key\u3002",
+  summaryText: "\u5DF2\u63A5\u7BA1 {providers} \u4E2A Provider\uFF0C\u5171 {keys} \u4E2A\u5BC6\u94A5 \xB7 \u5355\u4F1A\u8BDD\u56FA\u5B9A + Round Robin",
+  summaryEmpty: "\u5C1A\u672A\u63A5\u7BA1\u4EFB\u4F55 Provider\u3002\u5728\u63D2\u4EF6\u8BE6\u60C5\u4E2D\u641C\u7D22\u5E76\u63A5\u7BA1\u3002",
+  addExtra: "\u6DFB\u52A0\u5E76\u5B89\u88C5",
+  adding: "\u6B63\u5728\u6DFB\u52A0\u2026",
+  discoverHint: "\u4F1A\u81EA\u52A8\u5C1D\u8BD5\u83B7\u53D6\u6A21\u578B\u5217\u8868\uFF1B\u82E5\u7AEF\u70B9\u4E0D\u53EF\u8FBE\uFF0C\u5219\u4F7F\u7528\u5185\u7F6E\u6A21\u578B\u3002",
+  openModels: "\u6253\u5F00\u6A21\u578B\u8BBE\u7F6E",
+  searchResults: "{n} \u4E2A\u5339\u914D",
+  reset: "\u91CD\u7F6E",
+  attention: "\u9700\u8981\u5904\u7406",
+  // OAuth account surface — same values as locale/zh.json (dual source
+  // until the host's dsh-client-locale merge semantics are confirmed).
+  addAccount: "\u6DFB\u52A0\u8D26\u6237",
+  accountIdentity: "\u8D26\u6237",
+  accountProjected: "\u670D\u52A1\u4E2D",
+  accountReauth: "\u91CD\u65B0\u8BA4\u8BC1",
+  accountActivate: "\u8BBE\u4E3A\u5F53\u524D",
+  loginTitle: "\u8D26\u6237\u767B\u5F55",
+  loginPending: "\u7B49\u5F85\u6388\u6743\u2026",
+  loginBrowserOpen: "\u5728\u6D4F\u89C8\u5668\u4E2D\u6253\u5F00",
+  loginPromptTitle: "\u5B8C\u6210\u767B\u5F55",
+  loginPromptSubmit: "\u63D0\u4EA4",
+  loginFailed: "\u767B\u5F55\u5931\u8D25",
+  loginFlowEnded: "\u672C\u6B21\u767B\u5F55\u6D41\u7A0B\u5DF2\u7ED3\u675F\uFF0C\u8BF7\u5173\u95ED\u7A97\u53E3\u540E\u91CD\u65B0\u5F00\u59CB\u3002",
+  loginReady: "\u767B\u5F55\u6210\u529F\u3002",
+  deleteAccountTitle: "\u5220\u9664\u8D26\u6237\u201C{alias}\u201D\uFF1F",
+  deleteAccountBody: "\u8FD9\u4F1A\u4ECE\u51ED\u8BC1\u5E93\u4E2D\u5220\u9664\u8BE5\u8D26\u6237\u4FDD\u5B58\u7684 OAuth \u6388\u6743\u3002\u5982\u679C\u5B83\u662F\u5F53\u524D\u8D26\u6237\uFF0C\u8BE5 Provider \u8DEF\u7531\u5C06\u505C\u7528\u5B83\u5E76\u56DE\u843D\u5230 API-key \u6C60\uFF1BProvider \u4ECD\u4FDD\u6301\u63A5\u7BA1\u72B6\u6001\u3002",
+  deleteAccountBodyNoKeys: "\u8FD9\u4F1A\u4ECE\u51ED\u8BC1\u5E93\u4E2D\u5220\u9664\u8BE5\u8D26\u6237\u4FDD\u5B58\u7684 OAuth \u6388\u6743\u3002\u8BE5\u8DEF\u7531\u6CA1\u6709 API-key \u6C60\uFF0C\u5220\u9664\u540E\u5C06\u505C\u6B62\u670D\u52A1\uFF0C\u76F4\u5230\u91CD\u65B0\u767B\u5F55\u8D26\u6237\u3002"
+};
+var en = {
+  nav: "Keys Manager",
+  title: "Keys Manager",
+  subtitle: "Give one provider several API keys. A session keeps one key; new sessions rotate; failures cool down and recover automatically.",
+  search: "Search providers by name, id, or environment variable",
+  managed: "Managed",
+  available: "Available providers",
+  managedEmpty: "No managed providers yet. Adopt one below to start.",
+  availableEmpty: "No matching providers.",
+  keys: "keys",
+  healthy: "healthy",
+  cooling: "cooling",
+  paused: "paused",
+  missing: "missing",
+  active: "active",
+  unmanaged: "not managed",
+  dshBuiltin: "DSH built-in",
+  pluginBuiltin: "Plugin built-in",
+  customProvider: "Custom",
+  configured: "configured",
+  notConfigured: "not configured",
+  adopt: "Adopt provider",
+  adopting: "Adopting\u2026",
+  release: "Stop managing",
+  releasing: "Releasing\u2026",
+  addKey: "Add key",
+  addKeyTitle: "Add an API key",
+  alias: "Alias",
+  aliasPlaceholder: "e.g. Primary, Backup, Team B",
+  secret: "API key",
+  secretPlaceholder: "Paste the key; it is stored in the credential store",
+  addKeyHint: "The key is stored in the DSH credential store and is never shown again.",
+  show: "Show",
+  hide: "Hide",
+  save: "Save",
+  saving: "Saving\u2026",
+  cancel: "Cancel",
+  rename: "Rename",
+  pause: "Pause",
+  resume: "Resume",
+  delete: "Delete",
+  deleting: "Deleting\u2026",
+  deleteTitle: "Delete key \u201C{alias}\u201D?",
+  deleteBody: "This removes the stored key. If it is the last key, the provider stops being managed and its original key reference is restored.",
+  deleteConfirm: "Delete key",
+  releaseTitle: "Stop managing \u201C{provider}\u201D?",
+  releaseBody: "The plugin restores the provider\u2019s original key reference and removes every managed key from the credential store. The provider configuration stays in Models.",
+  releaseBodyCreated: "The plugin removes the provider route it created (including any later edits made in Models) and removes every managed key from the credential store.",
+  releaseConfirm: "Stop managing",
+  lastUsed: "Last used",
+  never: "Never",
+  coolingUntil: "Recovers {time}",
+  remaining: "{time} left",
+  imported: "Imported",
+  uses: "{n} uses",
+  failures: "{n} failures",
+  adoptHint: "Adopting turns this provider\u2019s API-key source over to Keys Manager. Its current credential is imported as the first key, and the original reference is kept for release.",
+  adoptExtraHint: "This extra provider is not configured yet. Add a key and the plugin installs an llm-pi-ai route with discovered or built-in models.",
+  adoptAccountTitle: "Sign in with an OAuth account to use this provider.",
+  unsupported: "Not available for key pools",
+  bindingBroken: "The provider profile no longer points at Keys Manager. Release and re-adopt it, or repair the provider in Models.",
+  noKeys: "No keys yet. Add one to make this provider usable.",
+  noKeysAccount: "No accounts yet. Add an account to make this provider usable.",
+  warning: "Warning",
+  settingsTitle: "Policy",
+  settingsIntro: "These values apply to every managed provider.",
+  retryCount: "Retries before switching key",
+  retryHint: "The same key is retried this many times; after that the key is marked abnormal and the session moves to another key.",
+  baseCooldown: "Initial cooldown (minutes)",
+  baseHint: "First failure cools a key for this long. Repeated failures shortly after recovery double it.",
+  grace: "Recovery grace (minutes)",
+  graceHint: "A failure within this window after recovery escalates the next cooldown.",
+  cap: "Cooldown is capped at 7 days.",
+  strategy: "Selection strategy",
+  strategyBody: "Each session pins one key. A new session takes the next healthy key in round-robin order. Paused and cooling keys are skipped; cooling keys become available again automatically.",
+  saveSettings: "Save policy",
+  savingSettings: "Saving\u2026",
+  saved: "Saved.",
+  writableFalse: "This profile is read-only. Key changes cannot be saved.",
+  reload: "Retry",
+  refresh: "Refresh",
+  moreActions: "More actions",
+  showAll: "Show all {n} providers",
+  showLess: "Show less",
+  dismiss: "Dismiss",
+  loading: "Loading\u2026",
+  loadError: "Could not load Keys Manager.",
+  actionError: "The operation failed.",
+  modelsBadge: "Managed by Keys Manager \xB7 {n} keys",
+  modelsHint: "Edit keys in Plugins \u2192 Keys Manager.",
+  providerId: "Provider ID",
+  env: "Env",
+  baseUrl: "Endpoint",
+  api: "Protocol",
+  models: "Models",
+  keysSection: "Keys",
+  extraSection: "Extra providers",
+  noSearch: "Try a different search.",
+  managedBadge: "Managed",
+  timeJustNow: "just now",
+  timeMinutesAgo: "{n} min ago",
+  timeHoursAgo: "{n} h ago",
+  timeDaysAgo: "{n} d ago",
+  timeMinutes: "{n} min",
+  timeHours: "{n} h",
+  timeDays: "{n} d",
+  timeSeconds: "{n} s",
+  confirm: "Confirm",
+  close: "Close",
+  keyStatusActive: "Active",
+  keyStatusCooling: "Cooling",
+  keyStatusPaused: "Paused",
+  keyStatusMissing: "Credential missing",
+  keyStatusEmpty: "No keys",
+  keyStatusUnmanaged: "Not managed",
+  providerKeys: "{n} keys",
+  providerKeyOne: "1 key",
+  countModels: "{n} models",
+  storageNote: "Keys live in the DSH credential store; manager state lives at $DSH_HOME/keys-manager/state.json and contains no secret values.",
+  providerAdopted: "Adopted. The existing credential was imported as the first key.",
+  summaryText: "{providers} managed providers \xB7 {keys} keys \xB7 sticky session + round robin",
+  summaryEmpty: "No providers managed yet. Search and adopt one in the plugin page.",
+  addExtra: "Add and install",
+  adding: "Adding\u2026",
+  discoverHint: "The plugin tries endpoint discovery first; if that fails it installs the built-in model list.",
+  openModels: "Open Models",
+  searchResults: "{n} matches",
+  reset: "Reset",
+  attention: "Needs attention",
+  // OAuth account surface — same values as locale/en.json (dual source
+  // until the host's dsh-client-locale merge semantics are confirmed).
+  addAccount: "Add account",
+  accountIdentity: "Account",
+  accountProjected: "Serving provider",
+  accountReauth: "Re-authenticate",
+  accountActivate: "Set active",
+  loginTitle: "Account sign-in",
+  loginPending: "Waiting for authorization\u2026",
+  loginBrowserOpen: "Open in browser",
+  loginPromptTitle: "Complete sign-in",
+  loginPromptSubmit: "Submit",
+  loginFailed: "Login failed",
+  loginFlowEnded: "This sign-in session has ended. Close the dialog and start again.",
+  loginReady: "Signed in.",
+  deleteAccountTitle: "Delete account \u201C{alias}\u201D?",
+  deleteAccountBody: "This removes the account\u2019s stored OAuth grant from the credential store. If it is the active account, the provider route stops serving it and falls back to its API-key pool; the provider stays managed.",
+  deleteAccountBodyNoKeys: "This removes the account\u2019s stored OAuth grant from the credential store. This route has no API-key pool, so it stops serving requests until an account is signed in again."
+};
+var LOCALE_DICTS = { zh, en };
+
+// src/client/runtime.ts
+var import_react = __toESM(require("react"), 1);
+
+// src/client/styles.ts
+var CSS = `
+.km-page{max-width:920px;margin:0 auto;padding:0 0 8px;color:var(--dsw-alias-label-primary);font-size:13.5px;line-height:1.5}
+.km-embedded-head{display:flex;align-items:flex-start;justify-content:space-between;gap:16px;margin:0 0 16px}
+.km-summary{display:grid;grid-template-columns:repeat(4,minmax(0,1fr));gap:10px;margin:0 0 16px;flex:1;min-width:0}
+.km-embedded-head .km-summary{margin:0}
+.km-embedded-actions{display:flex;gap:8px;flex-shrink:0;padding-top:2px}
+.km-summary-line{color:var(--dsw-alias-label-secondary);font-size:12.5px;line-height:1.5}
+.km-stat{display:flex;flex-direction:column;gap:2px;padding:11px 14px;border:1px solid var(--dsw-alias-border-l1);border-radius:10px;background:var(--dsw-alias-bg-layer-1)}
+.km-stat strong{font-size:19px;line-height:1.15;font-weight:650;font-variant-numeric:tabular-nums}
+.km-stat span{color:var(--dsw-alias-label-secondary);font-size:12px}
+.km-search{position:relative;display:flex;align-items:center;margin:0 0 20px}
+.km-search-icon{position:absolute;left:12px;color:var(--dsw-alias-label-secondary);pointer-events:none}
+.km-search-input{width:100%;box-sizing:border-box;padding:10px 38px 10px 36px;border:1px solid var(--dsw-alias-border-l1);border-radius:10px;background:var(--dsw-alias-bg-layer-1);color:var(--dsw-alias-label-primary);font:inherit;outline:none}
+.km-search-input:focus{border-color:var(--dsw-alias-state-business-primary);box-shadow:0 0 0 2px color-mix(in srgb,var(--dsw-alias-state-business-primary) 20%,transparent)}
+.km-search-clear{position:absolute;right:8px;display:inline-flex;align-items:center;justify-content:center;width:26px;height:26px;border:0;border-radius:6px;background:transparent;color:var(--dsw-alias-label-secondary);cursor:pointer}
+.km-search-clear:hover{background:var(--dsw-alias-bg-layer-2);color:var(--dsw-alias-label-primary)}
+.km-section{margin:0 0 22px}
+.km-section-head{display:flex;align-items:baseline;gap:8px;margin:0 0 9px}
+.km-section-title{font-size:14px;font-weight:650;margin:0;letter-spacing:.01em}
+.km-section-count{font-size:12px;color:var(--dsw-alias-label-secondary)}
+.km-provider-list{display:flex;flex-direction:column;gap:8px}
+.km-show-more{display:flex;justify-content:center;padding:8px 0 0}
+.km-card{border:1px solid var(--dsw-alias-border-l1);border-radius:12px;background:var(--dsw-alias-bg-layer-1);overflow:hidden}
+.km-provider-managed{border-color:color-mix(in srgb,var(--dsw-alias-brand-primary) 26%,var(--dsw-alias-border-l1))}
+.km-provider-open{overflow:visible}
+.km-provider-head{display:flex;align-items:center;gap:12px;width:100%;padding:12px 14px;border:0;background:transparent;color:inherit;font:inherit;text-align:left;cursor:pointer}
+.km-provider-head:hover{background:color-mix(in srgb,var(--dsw-alias-label-primary) 3%,transparent)}
+.km-avatar{display:inline-flex;align-items:center;justify-content:center;width:32px;height:32px;flex:0 0 32px;border-radius:9px;background:var(--dsw-alias-bg-layer-2);border:1px solid var(--dsw-alias-border-l1);font-weight:650;font-size:13px;color:var(--dsw-alias-label-secondary)}
+.km-provider-main{display:flex;flex-direction:column;gap:3px;min-width:0;flex:1}
+.km-provider-title-line{display:flex;align-items:center;gap:6px;flex-wrap:wrap;min-width:0}
+.km-provider-name{font-weight:650;font-size:13.5px;white-space:nowrap;overflow:hidden;text-overflow:ellipsis;max-width:360px}
+.km-provider-meta{display:flex;align-items:center;gap:7px;flex-wrap:wrap;color:var(--dsw-alias-label-secondary);font-size:11.5px;min-width:0}
+.km-provider-side{display:flex;align-items:center;gap:9px;flex-shrink:0}
+.km-count{font-size:11.5px;color:var(--dsw-alias-label-secondary);white-space:nowrap}
+.km-chevron{color:var(--dsw-alias-label-secondary);transition:transform .16s ease}
+.km-chevron-open{transform:rotate(180deg)}
+.km-provider-body{border-top:1px solid var(--dsw-alias-border-l1);padding:13px 14px 14px;background:color-mix(in srgb,var(--dsw-alias-bg-layer-2) 40%,transparent)}
+.km-adopt{display:flex;flex-direction:column;gap:12px}
+.km-adopt-copy{display:flex;flex-direction:column;gap:5px;color:var(--dsw-alias-label-secondary);font-size:12.5px}
+.km-adopt-title{color:var(--dsw-alias-label-primary);font-size:12.5px}
+.km-adopt-actions{display:flex;gap:8px;align-items:center}
+.km-meta-line{display:flex;gap:6px;align-items:baseline;flex-wrap:wrap;font-size:11.5px}
+.km-managed-body{display:flex;flex-direction:column;gap:10px}
+.km-managed-toolbar{display:flex;justify-content:space-between;align-items:flex-start;gap:12px;flex-wrap:wrap}
+.km-managed-summary{display:flex;flex-direction:column;gap:2px;min-width:0;font-size:11.5px}
+.km-managed-actions{display:flex;gap:6px;align-items:center;flex-shrink:0}
+.km-keys{display:flex;flex-direction:column;border:1px solid var(--dsw-alias-border-l1);border-radius:9px;background:var(--dsw-alias-bg-layer-1);overflow:visible}
+.km-key-row{position:relative;display:grid;grid-template-columns:minmax(0,1.35fr) minmax(150px,.8fr) minmax(150px,.9fr) 32px;gap:10px;align-items:center;padding:10px 11px;border-top:1px solid var(--dsw-alias-border-l1)}
+.km-key-row:first-child{border-top:0}
+.km-account-row{position:relative;display:grid;grid-template-columns:minmax(0,1.35fr) minmax(150px,.8fr) minmax(150px,.9fr) 32px;gap:10px;align-items:center;padding:10px 11px 10px 14px;border-top:1px solid var(--dsw-alias-border-l1)}
+.km-account-row:first-child{border-top:0}
+.km-account-row::before{content:'';position:absolute;left:0;top:12px;bottom:12px;width:2px;border-radius:1px;background:color-mix(in srgb,var(--dsw-alias-state-business-primary) 55%,transparent)}
+.km-account-glyph{display:inline-flex;align-items:center;justify-content:center;width:22px;height:22px;flex:0 0 22px;border-radius:50%;background:color-mix(in srgb,var(--dsw-alias-state-business-primary) 14%,var(--dsw-alias-bg-layer-2));color:var(--dsw-alias-state-business-primary)}
+.km-key-identity{min-width:0;display:flex;flex-direction:column;gap:2px}
+.km-key-alias-line{display:flex;align-items:center;gap:6px;min-width:0}
+.km-key-alias{font-weight:600;white-space:nowrap;overflow:hidden;text-overflow:ellipsis;max-width:220px}
+.km-key-sub{display:flex;align-items:center;gap:8px;font-size:11px;color:var(--dsw-alias-label-secondary);flex-wrap:wrap}
+.km-key-status{display:flex;flex-direction:column;gap:2px;align-items:flex-start}
+.km-key-last{display:flex;flex-direction:column;gap:2px;min-width:0}
+.km-key-time{font-size:11.5px;color:var(--dsw-alias-label-secondary);font-variant-numeric:tabular-nums}
+.km-key-time.km-warn{color:var(--dsw-alias-state-warn-primary)}
+.km-key-actions{position:relative;display:flex;justify-content:flex-end}
+.km-status{display:inline-flex;align-items:center;gap:5px;padding:2px 7px;border-radius:999px;border:1px solid var(--dsw-alias-border-l1);background:var(--dsw-alias-bg-layer-2);font-size:11px;white-space:nowrap;color:var(--dsw-alias-label-secondary)}
+.km-status-success{color:var(--dsw-alias-state-success-primary);border-color:color-mix(in srgb,var(--dsw-alias-state-success-primary) 26%,var(--dsw-alias-border-l1));background:color-mix(in srgb,var(--dsw-alias-state-success-primary) 8%,transparent)}
+.km-status-warn{color:var(--dsw-alias-state-warn-primary);border-color:color-mix(in srgb,var(--dsw-alias-state-warn-primary) 30%,var(--dsw-alias-border-l1));background:color-mix(in srgb,var(--dsw-alias-state-warn-primary) 8%,transparent)}
+.km-status-error{color:var(--dsw-alias-state-error-primary);border-color:color-mix(in srgb,var(--dsw-alias-state-error-primary) 30%,var(--dsw-alias-border-l1));background:color-mix(in srgb,var(--dsw-alias-state-error-primary) 8%,transparent)}
+.km-status-idle{color:var(--dsw-alias-state-idle-primary)}
+.km-dot{display:inline-block;width:6px;height:6px;border-radius:50%;flex:0 0 6px;background:var(--dsw-alias-state-idle-primary)}
+.km-dot-success{background:var(--dsw-alias-state-success-primary)}
+.km-dot-warn{background:var(--dsw-alias-state-warn-primary)}
+.km-dot-error{background:var(--dsw-alias-state-error-primary)}
+.km-dot-idle{background:var(--dsw-alias-state-idle-primary)}
+.km-dot-sep{color:var(--dsw-alias-label-secondary)}
+.km-tag{display:inline-flex;align-items:center;padding:1px 6px;border-radius:5px;font-size:10.5px;line-height:1.45;color:var(--dsw-alias-label-secondary);background:var(--dsw-alias-bg-layer-2);border:1px solid var(--dsw-alias-border-l1);white-space:nowrap}
+.km-tag-accent{color:var(--dsw-alias-state-business-primary);border-color:color-mix(in srgb,var(--dsw-alias-state-business-primary) 34%,var(--dsw-alias-border-l1));background:var(--dsw-alias-state-business-tertiary)}
+.km-tag-warn{color:var(--dsw-alias-state-warn-primary);border-color:color-mix(in srgb,var(--dsw-alias-state-warn-primary) 30%,var(--dsw-alias-border-l1));background:color-mix(in srgb,var(--dsw-alias-state-warn-primary) 8%,transparent)}
+.km-icon-btn{display:inline-flex;align-items:center;justify-content:center;width:28px;height:28px;border:1px solid transparent;border-radius:7px;background:transparent;color:var(--dsw-alias-label-secondary);cursor:pointer;flex:0 0 auto}
+.km-icon-btn:hover{background:var(--dsw-alias-bg-layer-2);border-color:var(--dsw-alias-border-l1);color:var(--dsw-alias-label-primary)}
+.km-icon-btn:disabled{opacity:.5;cursor:default}
+.km-menu{position:absolute;top:32px;right:0;z-index:20;min-width:138px;padding:4px;border:1px solid var(--dsw-alias-border-l2);border-radius:9px;background:var(--dsw-alias-bg-overlay);box-shadow:0 7px 22px color-mix(in srgb,var(--dsw-alias-label-primary) 14%,transparent)}
+.km-menu-item{display:flex;align-items:center;gap:8px;width:100%;padding:7px 9px;border:0;border-radius:6px;background:transparent;color:var(--dsw-alias-label-primary);font:inherit;font-size:12.5px;text-align:left;cursor:pointer}
+.km-menu-item:hover{background:var(--dsw-alias-bg-layer-2)}
+.km-menu-item:disabled{opacity:.5;cursor:default}
+.km-menu-danger{color:var(--dsw-alias-state-error-primary)}
+.km-menu-sep{height:1px;margin:4px 2px;background:var(--dsw-alias-border-l1)}
+.km-btn{display:inline-flex;align-items:center;justify-content:center;gap:6px;padding:7px 11px;border:1px solid var(--dsw-alias-border-l2);border-radius:8px;background:var(--dsw-alias-bg-layer-1);color:var(--dsw-alias-label-primary);font:inherit;font-size:12.5px;font-weight:550;line-height:1.2;cursor:pointer;white-space:nowrap;transition:opacity .15s ease,background .15s ease}
+.km-btn:hover{background:var(--dsw-alias-bg-layer-2)}
+.km-btn:disabled{opacity:.5;cursor:default}
+.km-btn-primary{background:var(--dsw-alias-label-primary);color:var(--dsw-alias-bg-base);border-color:transparent}
+.km-btn-primary:hover{opacity:.9;background:var(--dsw-alias-label-primary)}
+.km-btn-ghost{background:transparent;border-color:transparent;color:var(--dsw-alias-label-secondary)}
+.km-btn-ghost:hover{background:var(--dsw-alias-bg-layer-2);color:var(--dsw-alias-label-primary)}
+.km-btn-danger{background:var(--dsw-alias-state-error-primary);color:var(--dsw-alias-bg-base);border-color:transparent}
+.km-btn-danger:hover{opacity:.9;background:var(--dsw-alias-state-error-primary)}
+.km-btn-small{padding:5px 8px;font-size:12px;border-radius:7px}
+.km-input{width:100%;box-sizing:border-box;padding:8px 10px;border:1px solid var(--dsw-alias-border-l1);border-radius:8px;background:var(--dsw-alias-bg-layer-1);color:var(--dsw-alias-label-primary);font:inherit;font-size:13px;outline:none}
+.km-input:focus{border-color:var(--dsw-alias-state-business-primary);box-shadow:0 0 0 2px color-mix(in srgb,var(--dsw-alias-state-business-primary) 18%,transparent)}
+.km-input:disabled{opacity:.6}
+select.km-input{appearance:auto}
+.km-form{display:flex;flex-direction:column;gap:10px;padding:12px;border:1px solid var(--dsw-alias-border-l1);border-radius:9px;background:var(--dsw-alias-bg-layer-1)}
+.km-form-lead{display:flex;flex-direction:column;gap:2px}
+.km-form-title{font-weight:650;font-size:12.5px}
+.km-form-grid{display:grid;grid-template-columns:minmax(0,1fr) minmax(0,1.4fr);gap:10px}
+.km-field{display:flex;flex-direction:column;gap:5px;min-width:0}
+.km-field-wide{min-width:0}
+.km-field-label{font-size:11.5px;font-weight:550;color:var(--dsw-alias-label-secondary)}
+.km-field-hint{font-size:11px;color:var(--dsw-alias-label-secondary);line-height:1.45}
+.km-secret{position:relative;display:flex;align-items:center}
+.km-secret-input{padding-right:38px}
+.km-secret-toggle{position:absolute;right:4px;display:inline-flex;align-items:center;justify-content:center;width:28px;height:28px;border:0;border-radius:6px;background:transparent;color:var(--dsw-alias-label-secondary);cursor:pointer}
+.km-secret-toggle:hover{background:var(--dsw-alias-bg-layer-2);color:var(--dsw-alias-label-primary)}
+.km-form-actions{display:flex;justify-content:flex-end;gap:8px}
+.km-rename{display:flex;align-items:center;gap:4px;min-width:0;flex:1 1 auto;max-width:100%}
+.km-rename-input{flex:1 1 auto;width:auto;min-width:60px;padding:4px 7px;font-size:12.5px}
+.km-inline-error{padding:7px 9px;border:1px solid color-mix(in srgb,var(--dsw-alias-state-error-primary) 35%,var(--dsw-alias-border-l1));border-radius:7px;background:color-mix(in srgb,var(--dsw-alias-state-error-primary) 8%,transparent);color:var(--dsw-alias-state-error-primary);font-size:12px;word-break:break-word}
+.km-key-error{grid-column:1/-1;margin-top:-2px}
+.km-notice{display:flex;align-items:flex-start;gap:8px;padding:9px 10px;border:1px solid var(--dsw-alias-border-l1);border-radius:8px;background:var(--dsw-alias-bg-layer-1);color:var(--dsw-alias-label-secondary);font-size:12px}
+.km-notice-icon{flex:0 0 auto;margin-top:1px}
+.km-notice-warn{border-color:color-mix(in srgb,var(--dsw-alias-state-warn-primary) 32%,var(--dsw-alias-border-l1));background:color-mix(in srgb,var(--dsw-alias-state-warn-primary) 7%,transparent)}
+.km-notice-error{border-color:color-mix(in srgb,var(--dsw-alias-state-error-primary) 32%,var(--dsw-alias-border-l1));background:color-mix(in srgb,var(--dsw-alias-state-error-primary) 7%,transparent)}
+.km-notice-body{display:flex;flex-direction:column;gap:2px;min-width:0}
+.km-notice-title{color:var(--dsw-alias-label-primary);font-weight:600;font-size:12px}
+.km-notice-text{line-height:1.5}
+.km-notice-action{flex:0 0 auto}
+.km-empty-keys{padding:12px;border:1px dashed var(--dsw-alias-border-l2);border-radius:8px;color:var(--dsw-alias-label-secondary);font-size:12px}
+.km-empty{display:flex;align-items:center;gap:8px;padding:14px;border:1px dashed var(--dsw-alias-border-l2);border-radius:10px;color:var(--dsw-alias-label-secondary);font-size:12.5px}
+.km-provider-foot{display:flex;justify-content:space-between;gap:10px;align-items:center;margin-top:10px;padding-top:9px;border-top:1px dashed var(--dsw-alias-border-l1);font-size:11px;min-height:15px}
+.km-settings{padding:14px}
+.km-settings-head{display:flex;align-items:flex-start;justify-content:space-between;gap:12px;margin-bottom:12px}
+.km-settings-title{font-size:14px;font-weight:650;margin:0 0 3px}
+.km-settings-intro{margin:0;color:var(--dsw-alias-label-secondary);font-size:12px}
+.km-settings-icon{display:inline-flex;align-items:center;justify-content:center;width:34px;height:34px;border-radius:9px;background:var(--dsw-alias-bg-layer-2);color:var(--dsw-alias-brand-primary);border:1px solid var(--dsw-alias-border-l1)}
+.km-settings-grid{display:grid;grid-template-columns:minmax(0,1fr) minmax(0,1fr) minmax(0,1fr);gap:12px;align-items:start}
+.km-field-note{grid-column:1/-1}
+.km-policy-note{padding:9px 10px;border:1px solid var(--dsw-alias-border-l1);border-radius:8px;background:var(--dsw-alias-bg-layer-2)}
+.km-policy-title{display:flex;align-items:center;gap:6px;font-size:11.5px;font-weight:600;color:var(--dsw-alias-label-primary);margin-bottom:2px}
+.km-policy-note p{margin:0;font-size:11.5px;line-height:1.5}
+.km-settings-actions{display:flex;align-items:center;justify-content:flex-end;gap:10px;margin-top:12px}
+.km-saved{display:inline-flex;align-items:center;gap:4px;color:var(--dsw-alias-state-success-primary);font-size:11.5px}
+.km-banner{display:flex;align-items:flex-start;gap:8px;padding:9px 10px;border-radius:8px;margin:0 0 12px;font-size:12px;line-height:1.5;border:1px solid var(--dsw-alias-border-l1);background:var(--dsw-alias-bg-layer-1)}
+.km-banner-error{border-color:color-mix(in srgb,var(--dsw-alias-state-error-primary) 32%,var(--dsw-alias-border-l1));background:color-mix(in srgb,var(--dsw-alias-state-error-primary) 7%,transparent)}
+.km-banner-warn{border-color:color-mix(in srgb,var(--dsw-alias-state-warn-primary) 32%,var(--dsw-alias-border-l1));background:color-mix(in srgb,var(--dsw-alias-state-warn-primary) 7%,transparent)}
+.km-banner-text{flex:1;min-width:0;word-break:break-word}
+.km-banner-close{display:inline-flex;align-items:center;justify-content:center;width:22px;height:22px;border:0;border-radius:5px;background:transparent;color:var(--dsw-alias-label-secondary);cursor:pointer}
+.km-banner-close:hover{background:var(--dsw-alias-bg-layer-2)}
+.km-loading{display:flex;align-items:center;gap:8px;padding:20px 0;color:var(--dsw-alias-label-secondary);font-size:12.5px}
+.km-load-failure{display:flex;flex-direction:column;gap:10px;align-items:flex-start;padding:18px;border:1px dashed var(--dsw-alias-border-l2);border-radius:10px;color:var(--dsw-alias-label-secondary);font-size:12.5px}
+.km-empty-title{font-weight:600;color:var(--dsw-alias-label-primary)}
+.km-footer{display:flex;align-items:flex-start;gap:6px;padding-top:4px;color:var(--dsw-alias-label-secondary);font-size:11px;line-height:1.5}
+.km-muted{color:var(--dsw-alias-label-secondary)}
+.km-warn{color:var(--dsw-alias-state-warn-primary)}
+.km-mono{font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace;font-size:11px}
+.km-truncate{max-width:100%;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}
+.km-spin{animation:km-spin 1s linear infinite}
+.km-models-note{display:flex;align-items:center;gap:7px;flex-wrap:wrap;margin:8px 0 0;padding:7px 9px;border:1px solid color-mix(in srgb,var(--dsw-alias-brand-primary) 24%,var(--dsw-alias-border-l1));border-radius:7px;background:color-mix(in srgb,var(--dsw-alias-brand-primary) 6%,transparent);font-size:11.5px;color:var(--dsw-alias-label-primary)}
+.km-models-note-warn{border-color:color-mix(in srgb,var(--dsw-alias-state-warn-primary) 30%,var(--dsw-alias-border-l1));background:color-mix(in srgb,var(--dsw-alias-state-warn-primary) 7%,transparent)}
+.km-models-note-text{font-weight:600}
+.km-models-note-hint{color:var(--dsw-alias-label-secondary);font-weight:400}
+.km-modal-backdrop{position:fixed;inset:0;z-index:80;display:flex;align-items:center;justify-content:center;padding:24px;background:color-mix(in srgb,var(--dsw-alias-label-primary) 26%,transparent)}
+.km-modal{width:min(440px,100%);border:1px solid var(--dsw-alias-border-l2);border-radius:12px;background:var(--dsw-alias-bg-overlay);padding:16px;box-shadow:0 18px 48px color-mix(in srgb,var(--dsw-alias-label-primary) 20%,transparent)}
+.km-modal-title{font-weight:650;font-size:14px;margin-bottom:7px}
+.km-modal-body{color:var(--dsw-alias-label-secondary);font-size:12.5px}
+.km-modal-copy{margin:0;line-height:1.55}
+.km-login-flow{display:flex;flex-direction:column;gap:10px}
+.km-login-pending{display:flex;align-items:center;gap:8px;color:var(--dsw-alias-label-secondary);font-size:12.5px}
+.km-login-notices{color:var(--dsw-alias-label-secondary);font-size:12px;line-height:1.5;word-break:break-word}
+.km-login-link{color:var(--dsw-alias-state-business-primary);text-decoration:underline;text-underline-offset:2px}
+.km-login-link:hover{color:var(--dsw-alias-label-primary)}
+.km-login-prompt{display:flex;flex-direction:column;gap:10px;padding-top:2px;border-top:1px dashed var(--dsw-alias-border-l1)}
+.km-login-prompt-title{font-weight:600;font-size:12.5px;color:var(--dsw-alias-label-primary)}
+.km-modal-footer{display:flex;justify-content:flex-end;gap:8px;margin-top:16px}
+@keyframes km-spin{to{transform:rotate(360deg)}}
+@media(max-width:720px){
+  .km-summary{grid-template-columns:repeat(2,minmax(0,1fr))}
+  .km-key-row,.km-account-row{grid-template-columns:minmax(0,1fr) 32px;gap:6px}
+  .km-key-status,.km-key-last{grid-column:1;padding-left:0}
+  .km-key-actions{grid-column:2;grid-row:1}
+  .km-settings-grid{grid-template-columns:1fr}
+  .km-form-grid{grid-template-columns:1fr}
+  .km-provider-side .km-status{display:none}
+  .km-embedded-head{flex-direction:column;gap:10px}
+  .km-embedded-actions{padding-top:0}
+}
+`;
+
+// src/client/runtime.ts
+var RuntimeContext = import_react.default.createContext(null);
+function useRuntime() {
+  const runtime = import_react.default.useContext(RuntimeContext);
+  if (runtime === null) throw new Error("Keys Manager runtime is not mounted");
+  return runtime;
+}
+function useT() {
+  const runtime = useRuntime();
+  const ctx = runtime.ctx;
+  const subscribe = import_react.default.useCallback((listener) => ctx.locale.subscribe(listener), [ctx]);
+  const getSnapshot = import_react.default.useCallback(() => ctx.locale.getSnapshot(), [ctx]);
+  const locale = import_react.default.useSyncExternalStore(subscribe, getSnapshot);
+  return import_react.default.useMemo(() => ctx.locale.bind("dsh-keys-manager"), [ctx, locale.revision]);
+}
+function useLocaleId() {
+  const runtime = useRuntime();
+  const ctx = runtime.ctx;
+  const subscribe = import_react.default.useCallback((listener) => ctx.locale.subscribe(listener), [ctx]);
+  const getSnapshot = import_react.default.useCallback(() => ctx.locale.getSnapshot(), [ctx]);
+  return import_react.default.useSyncExternalStore(subscribe, getSnapshot).active;
+}
+function useStore() {
+  const runtime = useRuntime();
+  return import_react.default.useSyncExternalStore(runtime.store.subscribe, runtime.store.getSnapshot);
+}
+var styleRefs = 0;
+function useStyles() {
+  import_react.default.useEffect(() => {
+    styleRefs += 1;
+    let element = document.getElementById("dsh-keys-manager-styles");
+    if (element === null) {
+      element = document.createElement("style");
+      element.id = "dsh-keys-manager-styles";
+      document.head.appendChild(element);
+    }
+    element.textContent = CSS;
+    return () => {
+      styleRefs -= 1;
+      if (styleRefs <= 0) {
+        styleRefs = 0;
+        element?.remove();
+      }
+    };
+  }, []);
+}
+function wrapComponent(Component, runtime) {
+  return function KeysManagerRuntime(props) {
+    useStyles();
+    return import_react.default.createElement(RuntimeContext.Provider, { value: runtime }, import_react.default.createElement(Component, props));
+  };
+}
+
+// src/client/store.ts
+function messageOf(error) {
+  if (error instanceof Error && error.message.length > 0) return error.message;
+  return String(error);
+}
+function createStore(ctx) {
+  let snapshot = {
+    status: "idle",
+    state: null,
+    error: null,
+    busy: null,
+    now: Date.now()
+  };
+  let loadSequence = 0;
+  let mutationTail = Promise.resolve();
+  let queuedMutations = 0;
+  const listeners = /* @__PURE__ */ new Set();
+  const emit = () => {
+    for (const listener of [...listeners]) {
+      try {
+        listener();
+      } catch {
+      }
+    }
+  };
+  const update = (patch) => {
+    snapshot = { ...snapshot, ...patch };
+    emit();
+  };
+  const rpc = (method, args) => ctx.connection.rpc.call("/api", `keysManager/${method}`, { args });
+  const send = async (method, args, onSuccess) => {
+    queuedMutations += 1;
+    update({ busy: method, error: null });
+    const run = async () => {
+      ++loadSequence;
+      try {
+        const result = await rpc(method, args);
+        if (!result.ok) throw new Error(result.error.message);
+        const outcome = onSuccess(result.value);
+        if (queuedMutations === 1) update({ busy: null });
+        return outcome;
+      } catch (error) {
+        const message = messageOf(error);
+        if (queuedMutations === 1) update({ busy: null, error: message });
+        else update({ error: message });
+        return { ok: false, error: message };
+      } finally {
+        queuedMutations -= 1;
+      }
+    };
+    const next = mutationTail.then(run, run);
+    mutationTail = next.then(() => void 0, () => void 0);
+    return next;
+  };
+  const stateOutcome = (value) => {
+    const state = value;
+    if (queuedMutations === 1) update({ status: "ready", state, now: Date.now(), busy: null, error: null });
+    else update({ status: "ready", state, now: Date.now(), error: null });
+    return { ok: true, value: state };
+  };
+  const rpcRead = async (method, args) => {
+    try {
+      return await rpc(method, args);
+    } catch (error) {
+      return { ok: false, error: { message: messageOf(error) } };
+    }
+  };
+  const attemptOutcome = (value) => {
+    return { ok: true, value: value ?? null };
+  };
+  return {
+    getSnapshot: () => snapshot,
+    subscribe(listener) {
+      listeners.add(listener);
+      return () => listeners.delete(listener);
+    },
+    async load(options = {}) {
+      if (snapshot.busy !== null) return;
+      const request = ++loadSequence;
+      update({ busy: "load", error: options.keepError === true ? snapshot.error : null });
+      try {
+        const result = await rpc("getState", {});
+        if (request !== loadSequence) return;
+        if (!result.ok) throw new Error(result.error.message);
+        update({ status: "ready", state: result.value, now: Date.now(), busy: null, error: null });
+      } catch (error) {
+        if (request !== loadSequence) return;
+        update({ status: snapshot.state !== null ? snapshot.status : "error", busy: null, error: messageOf(error) });
+      }
+    },
+    call(method, args) {
+      return send(method, args, stateOutcome);
+    },
+    beginAccountLogin(provider, alias, targetAccountId) {
+      return send("beginAccountLogin", { provider, alias, targetAccountId }, attemptOutcome);
+    },
+    answerAccountPrompt(attemptId, value) {
+      return send("answerAccountPrompt", { attemptId, value }, () => ({ ok: true, value: null }));
+    },
+    async accountAttempt(attemptId) {
+      const result = await rpcRead("accountAttempt", { attemptId });
+      if (!result.ok) return { ok: false, error: result.error.message };
+      return attemptOutcome(result.value);
+    },
+    async listAccountAttempts() {
+      const result = await rpcRead("listAccountAttempts", {});
+      if (!result.ok) return { ok: false, error: result.error.message };
+      return { ok: true, value: result.value ?? [] };
+    },
+    activateAccount(provider, accountId) {
+      return send("activateAccount", { provider, accountId }, stateOutcome);
+    },
+    removeAccount(provider, accountId) {
+      return send("removeAccount", { provider, accountId }, stateOutcome);
+    },
+    tick() {
+      update({ now: Date.now() });
+      if (snapshot.status === "ready" && snapshot.busy === null) void this.load({ keepError: true });
+    },
+    dismissError() {
+      update({ error: null });
+    }
+  };
+}
+
+// src/client/ui.ts
+var import_react2 = __toESM(require("react"), 1);
+
+// src/client/format.ts
+function cooldownMinutes(ms) {
+  return ms / 6e4;
+}
+function cooldownMs(minutes) {
+  return Math.max(0.5, minutes) * 6e4;
+}
+function graceMinutes(ms) {
+  return ms / 6e4;
+}
+function graceMs(minutes) {
+  return Math.max(0, minutes) * 6e4;
+}
+
+// src/client/ui.ts
+var h = import_react2.default.createElement;
+function cx(...values) {
+  return values.filter(Boolean).join(" ");
+}
+var FOCUSABLE = 'button:not([disabled]), [href], input:not([disabled]), select:not([disabled]), textarea:not([disabled]), [tabindex]:not([tabindex="-1"])';
+function countText(t, count, oneKey, manyKey) {
+  return count === 1 ? t(oneKey) : t(manyKey, { n: count });
+}
+function formatClock(timestamp, locale, t) {
+  if (!timestamp) return t("never");
+  try {
+    return new Intl.DateTimeFormat(locale === "zh" ? "zh-CN" : "en", {
+      month: "2-digit",
+      day: "2-digit",
+      hour: "2-digit",
+      minute: "2-digit"
+    }).format(new Date(timestamp));
+  } catch {
+    return new Date(timestamp).toLocaleString();
+  }
+}
+function relativeTime(timestamp, now, t) {
+  if (!timestamp) return t("never");
+  const diff = Math.max(0, now - timestamp);
+  if (diff < 6e4) return t("timeJustNow");
+  if (diff < 36e5) return t("timeMinutesAgo", { n: Math.floor(diff / 6e4) });
+  if (diff < 864e5) return t("timeHoursAgo", { n: Math.floor(diff / 36e5) });
+  return t("timeDaysAgo", { n: Math.floor(diff / 864e5) });
+}
+function durationText(milliseconds, t) {
+  const ms = Math.max(0, milliseconds);
+  if (ms < 6e4) return t("timeSeconds", { n: Math.max(1, Math.ceil(ms / 1e3)) });
+  if (ms < 36e5) return t("timeMinutes", { n: Math.ceil(ms / 6e4) });
+  if (ms < 864e5) return t("timeHours", { n: Math.ceil(ms / 36e5) });
+  return t("timeDays", { n: Math.ceil(ms / 864e5) });
+}
+function providerInitial(provider) {
+  const source = String(provider?.displayName || provider?.provider || "?").trim();
+  return source.length === 0 ? "?" : source.slice(0, 1).toUpperCase();
+}
+function oauthCapable(provider) {
+  return provider.nativeAuth?.oauth === true && provider.accountSupported !== false;
+}
+function accountIdentityOf(key, provider) {
+  const oauth = key.oauth;
+  if (oauth !== null && oauth !== void 0) {
+    if (oauth.email !== void 0 && oauth.email.length > 0) return oauth.email;
+    if (oauth.accountId !== void 0 && oauth.accountId.length > 0) return oauth.accountId;
+  }
+  return provider.displayName || provider.provider;
+}
+function statusKey(status) {
+  switch (status) {
+    case "active":
+      return "keyStatusActive";
+    case "cooling":
+      return "keyStatusCooling";
+    case "paused":
+      return "keyStatusPaused";
+    case "missing":
+      return "keyStatusMissing";
+    // A managed route with zero keys (round-3 finding 7): "Not managed"
+    // would contradict the Managed badge rendered beside it.
+    case "empty":
+      return "keyStatusEmpty";
+    default:
+      return "keyStatusUnmanaged";
+  }
+}
+function statusTone(status) {
+  switch (status) {
+    case "active":
+      return "success";
+    case "cooling":
+      return "warn";
+    case "paused":
+      return "idle";
+    case "missing":
+      return "error";
+    case "empty":
+      return "idle";
+    default:
+      return "idle";
+  }
+}
+function Icon({ name, size = 16, className }) {
+  const common = {
+    width: size,
+    height: size,
+    viewBox: "0 0 24 24",
+    fill: "none",
+    stroke: "currentColor",
+    strokeWidth: 1.8,
+    strokeLinecap: "round",
+    strokeLinejoin: "round",
+    className,
+    "aria-hidden": true
+  };
+  if (name === "search") return h("svg", common, h("circle", { cx: 11, cy: 11, r: 6.5 }), h("path", { d: "M16 16l4 4" }));
+  if (name === "plus") return h("svg", common, h("path", { d: "M12 5v14M5 12h14" }));
+  if (name === "dots") return h("svg", common, h("circle", { cx: 5, cy: 12, r: 1.2, fill: "currentColor", stroke: "none" }), h("circle", { cx: 12, cy: 12, r: 1.2, fill: "currentColor", stroke: "none" }), h("circle", { cx: 19, cy: 12, r: 1.2, fill: "currentColor", stroke: "none" }));
+  if (name === "chevron") return h("svg", common, h("path", { d: "M6 9l6 6 6-6" }));
+  if (name === "eye") return h("svg", common, h("path", { d: "M2.5 12s3.5-6 9.5-6 9.5 6 9.5 6-3.5 6-9.5 6-9.5-6-9.5-6z" }), h("circle", { cx: 12, cy: 12, r: 2.5 }));
+  if (name === "eyeOff") return h("svg", common, h("path", { d: "M3 3l18 18M10.6 6.2A9.8 9.8 0 0112 6c6 0 9.5 6 9.5 6a17 17 0 01-3.2 3.8M6.2 6.7A16.4 16.4 0 002.5 12s3.5 6 9.5 6a9.7 9.7 0 004.2-.9M9.9 9.9a3 3 0 004.2 4.2" }));
+  if (name === "key") return h("svg", common, h("circle", { cx: 8, cy: 12, r: 3.5 }), h("path", { d: "M11.5 12H21M17 12v3M20 12v2.5" }));
+  if (name === "check") return h("svg", common, h("path", { d: "M5 12.5l4.5 4.5L19 7.5" }));
+  if (name === "pause") return h("svg", common, h("path", { d: "M9 6v12M15 6v12" }));
+  if (name === "play") return h("svg", common, h("path", { d: "M8 5l11 7-11 7V5z" }));
+  if (name === "trash") return h("svg", common, h("path", { d: "M4 7h16M9 7V5h6v2M7 7l1 13h8l1-13M10 11v5M14 11v5" }));
+  if (name === "close") return h("svg", common, h("path", { d: "M6 6l12 12M18 6L6 18" }));
+  if (name === "refresh") return h("svg", common, h("path", { d: "M20 11a8 8 0 10-2.3 6M20 5v6h-6" }));
+  if (name === "warning") return h("svg", common, h("path", { d: "M12 3l9.5 17h-19L12 3zM12 9v5M12 17.2v.1" }));
+  if (name === "shield") return h("svg", common, h("path", { d: "M12 3l8 3v6c0 5-3.5 8-8 9-4.5-1-8-4-8-9V6l8-3zM9 12l2 2 4-4" }));
+  if (name === "user") return h("svg", common, h("circle", { cx: 12, cy: 8, r: 3.6 }), h("path", { d: "M5 20a7 7 0 0114 0" }));
+  return h("svg", common);
+}
+function Button({ variant = "secondary", size = "normal", type = "button", disabled, onClick, children, title }) {
+  return h("button", {
+    type,
+    className: cx("km-btn", `km-btn-${variant}`, size === "small" && "km-btn-small"),
+    disabled,
+    onClick,
+    title
+  }, children);
+}
+function StatusPill({ status, t }) {
+  return h(
+    "span",
+    { className: cx("km-status", `km-status-${statusTone(status)}`) },
+    h("span", { className: cx("km-dot", `km-dot-${statusTone(status)}`) }),
+    h("span", null, t(statusKey(status)))
+  );
+}
+function Notice({ tone = "info", icon = "warning", title, children, action }) {
+  return h(
+    "div",
+    { className: cx("km-notice", `km-notice-${tone}`), role: tone === "error" ? "alert" : "note" },
+    h(Icon, { name: icon, size: 15, className: "km-notice-icon" }),
+    h(
+      "div",
+      { className: "km-notice-body" },
+      title ? h("div", { className: "km-notice-title" }, title) : null,
+      h("div", { className: "km-notice-text" }, children)
+    ),
+    action ? h("div", { className: "km-notice-action" }, action) : null
+  );
+}
+function Modal({ title, children, onClose, footer, busy }) {
+  const dialogRef = import_react2.default.useRef(null);
+  const onCloseRef = import_react2.default.useRef(onClose);
+  const busyRef = import_react2.default.useRef(busy);
+  onCloseRef.current = onClose;
+  busyRef.current = busy;
+  import_react2.default.useEffect(() => {
+    const previous = document.activeElement instanceof HTMLElement ? document.activeElement : null;
+    const dialog = dialogRef.current;
+    const inerted = [];
+    if (dialog !== null) {
+      let node = dialog.parentElement;
+      while (node !== null && node !== document.body) {
+        for (const child of [...node.children]) {
+          if (!(child instanceof HTMLElement) || child === dialog || child.contains(dialog)) continue;
+          if (!child.inert) {
+            child.inert = true;
+            inerted.push(child);
+          }
+        }
+        node = node.parentElement;
+      }
+      const first = dialog.querySelector(FOCUSABLE);
+      (first ?? dialog).focus();
+    }
+    const onKey = (event) => {
+      if (event.key === "Escape" && busyRef.current !== true) {
+        event.preventDefault();
+        onCloseRef.current();
+        return;
+      }
+      if (event.key !== "Tab" || dialog === null) return;
+      const nodes = [...dialog.querySelectorAll(FOCUSABLE)].filter((node) => node.offsetParent !== null);
+      if (nodes.length === 0) {
+        event.preventDefault();
+        dialog.focus();
+        return;
+      }
+      const first = nodes[0];
+      const last = nodes[nodes.length - 1];
+      if (event.shiftKey && document.activeElement === first) {
+        event.preventDefault();
+        last.focus();
+      } else if (!event.shiftKey && document.activeElement === last) {
+        event.preventDefault();
+        first.focus();
+      }
+    };
+    document.addEventListener("keydown", onKey);
+    return () => {
+      document.removeEventListener("keydown", onKey);
+      for (const element of inerted) element.inert = false;
+      if (previous !== null && previous.isConnected) previous.focus();
+    };
+  }, []);
+  return h("div", {
+    className: "km-modal-backdrop",
+    role: "presentation",
+    onMouseDown: (event) => {
+      if (event.target === event.currentTarget && !busy) onClose();
+    }
+  }, h(
+    "div",
+    {
+      className: "km-modal",
+      role: "dialog",
+      "aria-modal": "true",
+      "aria-label": title,
+      tabIndex: -1,
+      ref: dialogRef
+    },
+    h("div", { className: "km-modal-title" }, title),
+    h("div", { className: "km-modal-body" }, children),
+    h("div", { className: "km-modal-footer" }, footer)
+  ));
+}
+function KeyForm({ provider, onDone, autoFocus = false }) {
+  const runtime = useRuntime();
+  const t = useT();
+  const [alias, setAlias] = import_react2.default.useState("");
+  const [value, setValue] = import_react2.default.useState("");
+  const [show, setShow] = import_react2.default.useState(false);
+  const [busy, setBusy] = import_react2.default.useState(false);
+  const [error, setError] = import_react2.default.useState(null);
+  const isExtra = !provider.managed && provider.extra;
+  const disabled = busy || alias.trim().length === 0 || value.trim().length === 0;
+  async function submit(event) {
+    event.preventDefault();
+    if (disabled) return;
+    setBusy(true);
+    setError(null);
+    const method = provider.managed ? "addKey" : "addExtraProvider";
+    const args = provider.managed ? { provider: provider.provider, alias: alias.trim(), value } : { extraId: provider.extraId ?? provider.provider, alias: alias.trim(), value };
+    const result = await runtime.store.call(method, args);
+    setBusy(false);
+    if (!result.ok) {
+      setError(result.error);
+      return;
+    }
+    setAlias("");
+    setValue("");
+    setShow(false);
+    onDone?.();
+  }
+  return h(
+    "form",
+    { className: "km-form", onSubmit: submit },
+    h(
+      "div",
+      { className: "km-form-lead" },
+      h("div", { className: "km-form-title" }, t("addKeyTitle")),
+      h("div", { className: "km-muted" }, isExtra ? t("adoptExtraHint") : t("addKeyHint"))
+    ),
+    h(
+      "div",
+      { className: "km-form-grid" },
+      h(
+        "label",
+        { className: "km-field" },
+        h("span", { className: "km-field-label" }, t("alias")),
+        h("input", {
+          className: "km-input",
+          value: alias,
+          onChange: (event) => setAlias(event.target.value),
+          placeholder: t("aliasPlaceholder"),
+          maxLength: 80,
+          autoFocus: autoFocus || isExtra,
+          disabled: busy
+        })
+      ),
+      h(
+        "label",
+        { className: "km-field km-field-wide" },
+        h("span", { className: "km-field-label" }, t("secret")),
+        h(
+          "div",
+          { className: "km-secret" },
+          h("input", {
+            className: "km-input km-secret-input",
+            type: show ? "text" : "password",
+            value,
+            onChange: (event) => setValue(event.target.value),
+            placeholder: t("secretPlaceholder"),
+            autoComplete: "new-password",
+            spellCheck: false,
+            disabled: busy
+          }),
+          h("button", {
+            type: "button",
+            className: "km-secret-toggle",
+            onClick: () => setShow((current) => !current),
+            disabled: busy,
+            title: show ? t("hide") : t("show")
+          }, h(Icon, { name: show ? "eyeOff" : "eye", size: 15 }))
+        )
+      )
+    ),
+    error !== null ? h("div", { className: "km-inline-error", role: "alert" }, error) : null,
+    h(
+      "div",
+      { className: "km-form-actions" },
+      h(
+        Button,
+        { variant: "primary", type: "submit", disabled },
+        busy ? h(Icon, { name: "refresh", size: 14, className: "km-spin" }) : h(Icon, { name: "plus", size: 14 }),
+        h("span", null, busy ? isExtra ? t("adding") : t("saving") : isExtra ? t("addExtra") : t("save"))
+      )
+    )
+  );
+}
+function KeyRow({ provider, keyRecord, now }) {
+  const key = keyRecord;
+  const runtime = useRuntime();
+  const t = useT();
+  const locale = useLocaleId();
+  const [menu, setMenu] = import_react2.default.useState(false);
+  const [editing, setEditing] = import_react2.default.useState(false);
+  const [alias, setAlias] = import_react2.default.useState(key.alias);
+  const [confirm, setConfirm] = import_react2.default.useState(false);
+  const [busy, setBusy] = import_react2.default.useState(false);
+  const [error, setError] = import_react2.default.useState(null);
+  const rootRef = import_react2.default.useRef(null);
+  import_react2.default.useEffect(() => {
+    setAlias(key.alias);
+  }, [key.alias]);
+  import_react2.default.useEffect(() => {
+    if (!menu) return void 0;
+    const onDown = (event) => {
+      if (rootRef.current !== null && !rootRef.current.contains(event.target)) setMenu(false);
+    };
+    const onKey = (event) => {
+      if (event.key === "Escape") setMenu(false);
+    };
+    document.addEventListener("mousedown", onDown);
+    document.addEventListener("keydown", onKey);
+    return () => {
+      document.removeEventListener("mousedown", onDown);
+      document.removeEventListener("keydown", onKey);
+    };
+  }, [menu]);
+  async function update(patch) {
+    setBusy(true);
+    setError(null);
+    const result = await runtime.store.call("updateKey", { provider: provider.provider, keyId: key.id, patch });
+    setBusy(false);
+    if (!result.ok) setError(result.error);
+    else setEditing(false);
+  }
+  async function submitRename(event) {
+    event.preventDefault();
+    const next = alias.trim();
+    if (next.length === 0 || next === key.alias) {
+      setEditing(false);
+      return;
+    }
+    await update({ alias: next });
+  }
+  async function remove() {
+    setBusy(true);
+    setError(null);
+    const result = await runtime.store.call("deleteKey", { provider: provider.provider, keyId: key.id });
+    setBusy(false);
+    if (!result.ok) setError(result.error);
+    else setConfirm(false);
+  }
+  const cold = key.status === "cooling" && key.cooldownUntil > now;
+  const meta = key.status === "missing" ? t("keyStatusMissing") : key.totalUses > 0 ? t("uses", { n: key.totalUses }) : "";
+  return h(
+    "div",
+    { className: "km-key-row", ref: rootRef },
+    h(
+      "div",
+      { className: "km-key-identity" },
+      h(
+        "div",
+        { className: "km-key-alias-line" },
+        editing ? h(
+          "form",
+          { className: "km-rename", onSubmit: submitRename },
+          h("input", {
+            className: "km-input km-rename-input",
+            "aria-label": t("alias"),
+            value: alias,
+            onChange: (event) => setAlias(event.target.value),
+            maxLength: 80,
+            autoFocus: true,
+            disabled: busy,
+            onKeyDown: (event) => {
+              if (event.key === "Escape") setEditing(false);
+            }
+          }),
+          h("button", { type: "submit", className: "km-icon-btn", disabled: busy, title: t("save") }, h(Icon, { name: "check", size: 15 })),
+          h("button", { type: "button", className: "km-icon-btn", onClick: () => {
+            setEditing(false);
+            setAlias(key.alias);
+          }, title: t("cancel") }, h(Icon, { name: "close", size: 15 }))
+        ) : h("span", { className: "km-key-alias" }, key.alias),
+        key.importedFrom !== null ? h("span", { className: "km-tag" }, t("imported")) : null,
+        key.kind === "oauth" ? h("span", { className: "km-tag" }, "OAuth") : null
+      ),
+      h(
+        "div",
+        { className: "km-key-sub" },
+        h("span", { className: "km-mono km-muted" }, `\u2022\u2022\u2022\u2022 ${key.id.slice(-4)}`),
+        key.totalFailures > 0 ? h("span", { className: "km-muted" }, t("failures", { n: key.totalFailures })) : null
+      )
+    ),
+    h(
+      "div",
+      { className: "km-key-status" },
+      h(StatusPill, { status: key.status, t }),
+      cold ? h("div", { className: "km-key-time km-warn" }, t("coolingUntil", { time: formatClock(key.cooldownUntil, locale, t) })) : null,
+      cold ? h("div", { className: "km-key-time" }, t("remaining", { time: durationText(key.cooldownUntil - now, t) })) : null
+    ),
+    h(
+      "div",
+      { className: "km-key-last" },
+      h("div", { className: "km-key-time" }, `${t("lastUsed")}: ${relativeTime(key.lastUsedAt, now, t)}`),
+      meta ? h("div", { className: "km-key-time km-muted" }, meta) : null
+    ),
+    h(
+      "div",
+      { className: "km-key-actions" },
+      h("button", {
+        type: "button",
+        className: "km-icon-btn",
+        "aria-haspopup": "menu",
+        "aria-expanded": menu,
+        title: t("moreActions"),
+        "aria-label": t("moreActions"),
+        onClick: () => setMenu((current) => !current),
+        disabled: busy
+      }, h(Icon, { name: "dots", size: 17 })),
+      menu ? h(
+        "div",
+        { className: "km-menu", role: "menu" },
+        h("button", { type: "button", className: "km-menu-item", role: "menuitem", onClick: () => {
+          setMenu(false);
+          setEditing(true);
+        } }, h(Icon, { name: "key", size: 15 }), t("rename")),
+        h("button", {
+          type: "button",
+          className: "km-menu-item",
+          role: "menuitem",
+          onClick: () => {
+            setMenu(false);
+            void update({ enabled: !key.enabled });
+          },
+          disabled: busy
+        }, h(Icon, { name: key.enabled ? "pause" : "play", size: 15 }), key.enabled ? t("pause") : t("resume")),
+        h("div", { className: "km-menu-sep" }),
+        h("button", { type: "button", className: "km-menu-item km-menu-danger", role: "menuitem", onClick: () => {
+          setMenu(false);
+          setConfirm(true);
+        }, disabled: busy }, h(Icon, { name: "trash", size: 15 }), t("delete"))
+      ) : null
+    ),
+    error !== null ? h("div", { className: "km-key-error", role: "alert" }, error) : null,
+    confirm ? h(Modal, {
+      title: t("deleteTitle", { alias: key.alias }),
+      onClose: () => setConfirm(false),
+      busy,
+      footer: [
+        h(Button, { key: "cancel", onClick: () => setConfirm(false), disabled: busy }, t("cancel")),
+        h(Button, { key: "delete", variant: "danger", onClick: remove, disabled: busy }, busy ? t("deleting") : t("deleteConfirm"))
+      ]
+    }, h("p", { className: "km-modal-copy" }, t("deleteBody"))) : null
+  );
+}
+function AccountRow({ provider, keyRecord, now, onReauthenticate }) {
+  const runtime = useRuntime();
+  const t = useT();
+  const locale = useLocaleId();
+  const key = keyRecord;
+  const identity = accountIdentityOf(key, provider);
+  const [menu, setMenu] = import_react2.default.useState(false);
+  const [confirm, setConfirm] = import_react2.default.useState(false);
+  const [busy, setBusy] = import_react2.default.useState(false);
+  const [error, setError] = import_react2.default.useState(null);
+  const rootRef = import_react2.default.useRef(null);
+  import_react2.default.useEffect(() => {
+    if (!menu) return void 0;
+    const onDown = (event) => {
+      if (rootRef.current !== null && !rootRef.current.contains(event.target)) setMenu(false);
+    };
+    const onKey = (event) => {
+      if (event.key === "Escape") setMenu(false);
+    };
+    document.addEventListener("mousedown", onDown);
+    document.addEventListener("keydown", onKey);
+    return () => {
+      document.removeEventListener("mousedown", onDown);
+      document.removeEventListener("keydown", onKey);
+    };
+  }, [menu]);
+  async function activate() {
+    setBusy(true);
+    setError(null);
+    const result = await runtime.store.activateAccount(provider.provider, key.id);
+    setBusy(false);
+    if (!result.ok) setError(result.error);
+  }
+  async function remove() {
+    setBusy(true);
+    setError(null);
+    const result = await runtime.store.removeAccount(provider.provider, key.id);
+    setBusy(false);
+    if (!result.ok) setError(result.error);
+    else setConfirm(false);
+  }
+  const cold = key.status === "cooling" && key.cooldownUntil > now;
+  const metaParts = [
+    key.totalUses > 0 ? t("uses", { n: key.totalUses }) : null,
+    key.totalFailures > 0 ? t("failures", { n: key.totalFailures }) : null
+  ].filter((value) => value !== null);
+  return h(
+    "div",
+    { className: "km-account-row", ref: rootRef },
+    h(
+      "div",
+      { className: "km-key-identity" },
+      h(
+        "div",
+        { className: "km-key-alias-line" },
+        h("span", { className: "km-account-glyph", "aria-hidden": true }, h(Icon, { name: "user", size: 13 })),
+        h("span", { className: "km-key-alias" }, identity),
+        h("span", { className: "km-tag km-tag-accent" }, t("accountIdentity")),
+        // Step 6: the row whose grant IS the live projection is badged.
+        key.projected === true ? h("span", { className: "km-tag km-tag-accent" }, t("accountProjected")) : null
+      ),
+      h(
+        "div",
+        { className: "km-key-sub" },
+        h("span", { className: "km-mono km-muted" }, `\u2022\u2022\u2022\u2022 ${key.id.slice(-4)}`)
+      )
+    ),
+    h(
+      "div",
+      { className: "km-key-status" },
+      h(StatusPill, { status: key.status, t }),
+      cold ? h("div", { className: "km-key-time km-warn" }, t("coolingUntil", { time: formatClock(key.cooldownUntil, locale, t) })) : null,
+      cold ? h("div", { className: "km-key-time" }, t("remaining", { time: durationText(key.cooldownUntil - now, t) })) : null
+    ),
+    h(
+      "div",
+      { className: "km-key-last" },
+      h("div", { className: "km-key-time" }, `${t("lastUsed")}: ${relativeTime(key.lastUsedAt, now, t)}`),
+      metaParts.length > 0 ? h(
+        "div",
+        { className: "km-key-time km-muted" },
+        metaParts.map((value, index) => [
+          index > 0 ? h("span", { key: `sep-${index}`, className: "km-dot-sep", "aria-hidden": true }, "\xB7") : null,
+          h("span", { key: `part-${index}` }, value)
+        ])
+      ) : null
+    ),
+    h(
+      "div",
+      { className: "km-key-actions" },
+      h("button", {
+        type: "button",
+        className: "km-icon-btn",
+        "aria-haspopup": "menu",
+        "aria-expanded": menu,
+        title: t("moreActions"),
+        "aria-label": t("moreActions"),
+        onClick: () => setMenu((current) => !current),
+        disabled: busy
+      }, h(Icon, { name: "dots", size: 17 })),
+      menu ? h(
+        "div",
+        { className: "km-menu", role: "menu" },
+        h("button", {
+          type: "button",
+          className: "km-menu-item",
+          role: "menuitem",
+          onClick: () => {
+            setMenu(false);
+            void activate();
+          },
+          // Step 6: the projected row already serves the route; setting it
+          // active again is a no-op, so the entry stays disabled.
+          disabled: busy || key.projected === true
+        }, h(Icon, { name: "check", size: 15 }), t("accountActivate")),
+        h("button", {
+          type: "button",
+          className: "km-menu-item",
+          role: "menuitem",
+          onClick: () => {
+            setMenu(false);
+            onReauthenticate();
+          },
+          disabled: busy
+        }, h(Icon, { name: "refresh", size: 15 }), t("accountReauth")),
+        h("div", { className: "km-menu-sep" }),
+        h("button", { type: "button", className: "km-menu-item km-menu-danger", role: "menuitem", onClick: () => {
+          setMenu(false);
+          setConfirm(true);
+        }, disabled: busy }, h(Icon, { name: "trash", size: 15 }), t("delete"))
+      ) : null
+    ),
+    error !== null ? h("div", { className: "km-key-error", role: "alert" }, error) : null,
+    confirm ? h(Modal, {
+      // SF4: account-specific copy — the grant removal consequence, not a
+      // key-deletion/provider-release promise. Step 8: the key-pool
+      // fallback clause appears only when the route actually has key
+      // support; an OAuth-only route states the real consequence instead.
+      title: t("deleteAccountTitle", { alias: identity }),
+      onClose: () => setConfirm(false),
+      busy,
+      footer: [
+        h(Button, { key: "cancel", onClick: () => setConfirm(false), disabled: busy }, t("cancel")),
+        h(Button, { key: "delete", variant: "danger", onClick: remove, disabled: busy }, busy ? t("deleting") : t("deleteConfirm"))
+      ]
+    }, h("p", { className: "km-modal-copy" }, t(provider.supported === true ? "deleteAccountBody" : "deleteAccountBodyNoKeys"))) : null
+  );
+}
+function ProviderCard({ provider, expanded, onToggle, now }) {
+  const runtime = useRuntime();
+  const t = useT();
+  const [adding, setAdding] = import_react2.default.useState(false);
+  const [adopting, setAdopting] = import_react2.default.useState(false);
+  const [releasing, setReleasing] = import_react2.default.useState(false);
+  const [confirmRelease, setConfirmRelease] = import_react2.default.useState(false);
+  const [login, setLogin] = import_react2.default.useState(null);
+  const [startingLogin, setStartingLogin] = import_react2.default.useState(false);
+  const [error, setError] = import_react2.default.useState(null);
+  const managed = provider.managed;
+  const broken = managed && provider.bindingHealthy === false;
+  const keyCount = provider.keyCount;
+  const warning = provider.warning;
+  const isExtra = provider.extra;
+  const origin = provider.origin ?? (provider.extra ? "plugin" : "dsh");
+  const originLabel = origin === "plugin" ? t("pluginBuiltin") : origin === "dsh" ? t("dshBuiltin") : t("customProvider");
+  const providerMeta = [
+    provider.provider,
+    provider.active ? t("active") : provider.configured ? t("configured") : t("notConfigured"),
+    provider.api ?? null
+  ].filter((value) => Boolean(value));
+  async function adopt() {
+    setAdopting(true);
+    setError(null);
+    const result = await runtime.store.call("adoptProvider", { provider: provider.provider });
+    setAdopting(false);
+    if (!result.ok) setError(result.error);
+  }
+  async function release() {
+    setReleasing(true);
+    setError(null);
+    const result = await runtime.store.call("releaseProvider", { provider: provider.provider });
+    setReleasing(false);
+    if (!result.ok) {
+      setError(result.error);
+      return;
+    }
+    setConfirmRelease(false);
+  }
+  async function openLogin(targetAccountId, alias) {
+    if (startingLogin) return;
+    setStartingLogin(true);
+    setError(null);
+    const result = await runtime.store.beginAccountLogin(provider.provider, alias, targetAccountId);
+    setStartingLogin(false);
+    if (!result.ok) {
+      setError(result.error);
+      return;
+    }
+    if (result.value !== null) setLogin({ attemptId: result.value.id });
+  }
+  async function adoptThenLogin() {
+    if (provider.managed) {
+      await openLogin();
+      return;
+    }
+    setAdopting(true);
+    setError(null);
+    const result = await runtime.store.call("adoptProvider", { provider: provider.provider });
+    setAdopting(false);
+    if (!result.ok) {
+      setError(result.error);
+      return;
+    }
+    await openLogin();
+  }
+  const accountAdoptable = oauthCapable(provider);
+  const adoptable = provider.supported || accountAdoptable;
+  return h(
+    "div",
+    { className: cx("km-card", "km-provider", expanded && "km-provider-open", managed && "km-provider-managed") },
+    h(
+      "button",
+      {
+        type: "button",
+        className: "km-provider-head",
+        onClick: onToggle,
+        "aria-expanded": expanded
+      },
+      h("span", { className: "km-avatar", "aria-hidden": true }, providerInitial(provider)),
+      h(
+        "span",
+        { className: "km-provider-main" },
+        h(
+          "span",
+          { className: "km-provider-title-line" },
+          h("span", { className: "km-provider-name" }, provider.displayName || provider.provider),
+          h("span", { className: "km-tag" }, originLabel),
+          managed ? h("span", { className: "km-tag km-tag-accent" }, t("managedBadge")) : null,
+          !managed && !provider.supported && !accountAdoptable ? h("span", { className: "km-tag km-tag-warn" }, t("unsupported")) : null
+        ),
+        h(
+          "span",
+          { className: "km-provider-meta" },
+          h("span", { className: "km-mono" }, provider.provider),
+          h("span", { className: "km-dot-sep", "aria-hidden": true }, "\xB7"),
+          h("span", null, providerMeta.slice(1).join(" \xB7 ")),
+          provider.env.length > 0 ? h("span", { className: "km-mono km-muted" }, provider.env.join(", ")) : null
+        )
+      ),
+      h(
+        "span",
+        { className: "km-provider-side" },
+        managed ? h("span", { className: "km-count" }, countText(t, keyCount, "providerKeyOne", "providerKeys")) : h("span", { className: "km-count km-muted" }, adoptable ? t("unmanaged") : t("unsupported")),
+        managed ? h(StatusPill, { status: provider.status, t }) : null,
+        h(Icon, { name: "chevron", size: 16, className: cx("km-chevron", expanded && "km-chevron-open") })
+      )
+    ),
+    expanded ? h(
+      "div",
+      { className: "km-provider-body" },
+      error !== null ? h("div", { className: "km-inline-error", role: "alert" }, error) : null,
+      warning !== void 0 || broken ? h(Notice, { tone: "warn", title: t("warning") }, broken ? t("bindingBroken") : warning) : null,
+      !managed ? h(
+        "div",
+        { className: "km-adopt" },
+        h(
+          "div",
+          { className: "km-adopt-copy" },
+          // I-000063: an OAuth-only route is account-adoptable, so its
+          // adopt panel headline must invite sign-in instead of claiming
+          // the provider is unsupported. The unsupported headline remains
+          // only for providers that are neither key- nor account-capable.
+          h(
+            "div",
+            { className: "km-adopt-title" },
+            provider.supported ? t(isExtra ? "adoptExtraHint" : "adoptHint") : accountAdoptable ? t("adoptAccountTitle") : t("unsupported")
+          ),
+          !provider.supported && provider.reason !== void 0 ? h("div", { className: "km-muted" }, provider.reason) : null,
+          provider.apiKeyEnv !== null ? h("div", { className: "km-meta-line" }, h("span", { className: "km-muted" }, `${t("secret")}:`), h("span", { className: "km-mono" }, provider.apiKeyEnv)) : null,
+          provider.baseURL !== null ? h("div", { className: "km-meta-line" }, h("span", { className: "km-muted" }, `${t("baseUrl")}:`), h("span", { className: "km-mono km-truncate" }, provider.baseURL)) : null,
+          provider.models.length > 0 ? h("div", { className: "km-meta-line" }, h("span", { className: "km-muted" }, `${t("models")}:`), h("span", null, t("countModels", { n: provider.models.length }))) : null
+        ),
+        isExtra ? h(KeyForm, { provider, autoFocus: true }) : h(
+          "div",
+          { className: "km-adopt-actions" },
+          h(
+            Button,
+            { variant: "primary", onClick: adopt, disabled: adopting || !adoptable },
+            adopting ? h(Icon, { name: "refresh", size: 14, className: "km-spin" }) : h(Icon, { name: "shield", size: 14 }),
+            h("span", null, adopting ? t("adopting") : t("adopt"))
+          ),
+          // MF1: Add account is reachable from the unmanaged/adopt flow —
+          // adopt (zero keys for OAuth-only routes) then sign in.
+          oauthCapable(provider) ? h(
+            Button,
+            { variant: "secondary", onClick: () => void adoptThenLogin(), disabled: adopting || startingLogin },
+            startingLogin ? h(Icon, { name: "refresh", size: 14, className: "km-spin" }) : h(Icon, { name: "user", size: 14 }),
+            h("span", null, startingLogin ? t("adopting") : t("addAccount"))
+          ) : null
+        )
+      ) : h(
+        "div",
+        { className: "km-managed-body" },
+        h(
+          "div",
+          { className: "km-managed-toolbar" },
+          h(
+            "div",
+            { className: "km-managed-summary" },
+            h("span", { className: "km-mono km-muted" }, `${t("secret")}: ${provider.brokerRef ?? "\u2014"}`),
+            provider.baseURL !== null ? h("span", { className: "km-mono km-muted km-truncate" }, provider.baseURL) : null
+          ),
+          h(
+            "div",
+            { className: "km-managed-actions" },
+            h(
+              Button,
+              { variant: "secondary", size: "small", onClick: () => setAdding((current) => !current), disabled: releasing || !provider.supported, title: provider.supported ? void 0 : provider.reason },
+              h(Icon, { name: "plus", size: 14 }),
+              h("span", null, t("addKey"))
+            ),
+            oauthCapable(provider) ? h(
+              Button,
+              { variant: "secondary", size: "small", onClick: () => void openLogin(), disabled: releasing || startingLogin },
+              h(Icon, { name: "user", size: 14 }),
+              h("span", null, t("addAccount"))
+            ) : null,
+            h(
+              Button,
+              { variant: "ghost", size: "small", onClick: () => setConfirmRelease(true), disabled: releasing },
+              releasing ? t("releasing") : t("release")
+            )
+          )
+        ),
+        adding ? h(KeyForm, { provider, onDone: () => setAdding(false), autoFocus: true }) : null,
+        provider.keys.length === 0 ? h(
+          "div",
+          { className: "km-empty-keys" },
+          h("div", null, provider.supported ? t("noKeys") : oauthCapable(provider) ? t("noKeysAccount") : t("unsupported")),
+          !provider.supported && provider.reason !== void 0 ? h("div", { className: "km-muted" }, provider.reason) : null
+        ) : h("div", { className: "km-keys" }, provider.keys.map((key) => key.kind === "oauth" ? h(AccountRow, { key: key.id, provider, keyRecord: key, now, onReauthenticate: () => void openLogin(key.id, key.alias) }) : h(KeyRow, { key: key.id, provider, keyRecord: key, now })))
+      ),
+      h(
+        "div",
+        { className: "km-provider-foot" },
+        h("span", { className: "km-muted" }, provider.extra ? `${t("api")}: ${provider.api ?? "\u2014"} \xB7 ${t("models")}: ${provider.models.length}` : null),
+        provider.defaultBaseURL !== null ? h("span", { className: "km-mono km-muted km-truncate" }, provider.defaultBaseURL) : null
+      )
+    ) : null,
+    confirmRelease ? h(Modal, {
+      title: t("releaseTitle", { provider: provider.displayName || provider.provider }),
+      onClose: () => setConfirmRelease(false),
+      busy: releasing,
+      footer: [
+        h(Button, { key: "cancel", onClick: () => setConfirmRelease(false), disabled: releasing }, t("cancel")),
+        h(Button, { key: "release", variant: "danger", onClick: release, disabled: releasing }, releasing ? t("releasing") : t("releaseConfirm"))
+      ]
+    }, h("p", { className: "km-modal-copy" }, t(provider.createdProfile === true ? "releaseBodyCreated" : "releaseBody"))) : null,
+    login !== null ? h(LoginDialog, {
+      provider,
+      attemptId: login.attemptId,
+      onClose: () => setLogin(null)
+    }) : null
+  );
+}
+var LOGIN_POLL_MS = 1e3;
+function safeNoticeUrl(url) {
+  if (url === void 0 || url.length === 0) return null;
+  try {
+    const parsed = new URL(url);
+    return parsed.protocol === "http:" || parsed.protocol === "https:" ? url : null;
+  } catch {
+    return null;
+  }
+}
+var LOGIN_POLL_FAILURE_LIMIT = 3;
+function LoginDialog({ provider, attemptId, onClose }) {
+  const runtime = useRuntime();
+  const t = useT();
+  const [attempt, setAttempt] = import_react2.default.useState(null);
+  const [flowEnded, setFlowEnded] = import_react2.default.useState(false);
+  const [pollError, setPollError] = import_react2.default.useState(null);
+  const [answer, setAnswer] = import_react2.default.useState("");
+  const [answering, setAnswering] = import_react2.default.useState(false);
+  const [error, setError] = import_react2.default.useState(null);
+  const pollNowRef = import_react2.default.useRef(null);
+  const onCloseRef = import_react2.default.useRef(onClose);
+  onCloseRef.current = onClose;
+  const prompt = attempt?.prompt;
+  const promptKey = prompt === void 0 ? "" : `${prompt.kind}\0${prompt.message}\0${(prompt.options ?? []).map((option) => option.id).join("\0")}`;
+  import_react2.default.useEffect(() => {
+    const options = prompt !== void 0 && prompt.kind === "select" ? prompt.options : void 0;
+    if (options !== void 0 && options.length > 0) {
+      setAnswer((current) => options.some((option) => option.id === current) ? current : options[0].id);
+      return;
+    }
+    setAnswer("");
+  }, [promptKey]);
+  import_react2.default.useEffect(() => {
+    let stopped = false;
+    let timer;
+    let failures = 0;
+    let pending = 0;
+    let latestUpdatedAt = 0;
+    const isTerminal = (status) => status === "ready" || status === "failed" || status === "cancelled";
+    const poll = async () => {
+      if (stopped) return;
+      pending += 1;
+      try {
+        const result = await runtime.store.accountAttempt(attemptId);
+        if (stopped) return;
+        if (!result.ok) {
+          failures += 1;
+          if (failures >= LOGIN_POLL_FAILURE_LIMIT) {
+            if (timer !== void 0) clearInterval(timer);
+            setPollError(result.error);
+          }
+          return;
+        }
+        failures = 0;
+        if (result.value === null) {
+          if (timer !== void 0) clearInterval(timer);
+          setFlowEnded(true);
+          return;
+        }
+        const view = result.value;
+        if (view.updatedAt < latestUpdatedAt) return;
+        latestUpdatedAt = view.updatedAt;
+        setAttempt((current) => {
+          if (current === null) return view;
+          if (isTerminal(current.status) && !isTerminal(view.status)) return current;
+          if (current.updatedAt > view.updatedAt) return current;
+          if (current.updatedAt === view.updatedAt && current.status === view.status) return current;
+          return view;
+        });
+        if (view.status === "ready") {
+          if (timer !== void 0) clearInterval(timer);
+          await runtime.store.load();
+          if (!stopped) onCloseRef.current();
+          return;
+        }
+        if (view.status === "failed" || view.status === "cancelled") {
+          if (timer !== void 0) clearInterval(timer);
+        }
+      } finally {
+        pending -= 1;
+      }
+    };
+    const pollNow = () => {
+      void poll();
+    };
+    pollNowRef.current = pollNow;
+    void poll();
+    timer = setInterval(() => {
+      if (pending === 0) void poll();
+    }, LOGIN_POLL_MS);
+    return () => {
+      stopped = true;
+      if (timer !== void 0) clearInterval(timer);
+    };
+  }, [attemptId, runtime]);
+  async function submitAnswer(event) {
+    event.preventDefault();
+    const prompt2 = attempt?.prompt;
+    if (prompt2 === void 0 || answering) return;
+    const value = answer.trim();
+    if (value.length === 0) return;
+    setAnswering(true);
+    setError(null);
+    const result = await runtime.store.answerAccountPrompt(attemptId, value);
+    setAnswering(false);
+    if (!result.ok) {
+      setError(result.error);
+      return;
+    }
+    setAnswer("");
+    pollNowRef.current?.();
+  }
+  const lastNotice = attempt !== null && attempt.notices.length > 0 ? attempt.notices[attempt.notices.length - 1] : null;
+  const safeUrl = attempt !== null ? attempt.notices.map((notice) => safeNoticeUrl(notice.url)).reverse().find((url) => url !== null) ?? null : null;
+  const answerable = prompt !== void 0 && !answering && answer.trim().length > 0;
+  let body;
+  if (pollError !== null) {
+    body = h(Notice, { tone: "error", icon: "warning", title: t("loginFailed") }, pollError);
+  } else if (flowEnded) {
+    body = h(Notice, { tone: "warn", icon: "warning" }, t("loginFlowEnded"));
+  } else if (attempt === null || attempt.status === "pending") {
+    body = h(
+      "div",
+      { className: "km-login-flow" },
+      h("div", { className: "km-login-pending" }, h(Icon, { name: "refresh", size: 15, className: "km-spin" }), h("span", null, t("loginPending"))),
+      lastNotice !== null ? h("div", { className: "km-login-notices" }, lastNotice.message) : null,
+      safeUrl !== null ? h(
+        "div",
+        { className: "km-login-notices" },
+        h("a", { className: "km-login-link", href: safeUrl, target: "_blank", rel: "noreferrer" }, t("loginBrowserOpen"))
+      ) : null
+    );
+  } else if (attempt.status === "ready") {
+    body = h("div", { className: "km-login-pending" }, h(Icon, { name: "check", size: 15 }), h("span", null, t("loginReady")));
+  } else if (attempt.status === "failed" || attempt.status === "cancelled") {
+    body = h(Notice, { tone: "error", icon: "warning", title: t("loginFailed") }, attempt.error ?? lastNotice?.message ?? provider.displayName);
+  } else {
+    body = h(
+      "div",
+      { className: "km-login-flow" },
+      lastNotice !== null ? h("div", { className: "km-login-notices" }, lastNotice.message) : null,
+      safeUrl !== null ? h(
+        "div",
+        { className: "km-login-notices" },
+        h("a", { className: "km-login-link", href: safeUrl, target: "_blank", rel: "noreferrer" }, t("loginBrowserOpen"))
+      ) : null,
+      prompt !== void 0 ? h(
+        "form",
+        { className: "km-login-prompt", onSubmit: submitAnswer },
+        h("div", { className: "km-login-prompt-title" }, t("loginPromptTitle")),
+        h(
+          "div",
+          { className: "km-field" },
+          h("span", { className: "km-field-label" }, prompt.message),
+          prompt.kind === "select" && prompt.options !== void 0 ? h("select", {
+            className: "km-input",
+            value: answer,
+            onChange: (event) => setAnswer(event.target.value),
+            disabled: answering,
+            autoFocus: true
+          }, prompt.options.map((option) => h("option", { key: option.id, value: option.id }, option.label))) : h("input", {
+            className: "km-input",
+            type: prompt.kind === "secret" ? "password" : "text",
+            value: answer,
+            onChange: (event) => setAnswer(event.target.value),
+            placeholder: prompt.placeholder,
+            spellCheck: false,
+            disabled: answering,
+            autoFocus: true
+          })
+        ),
+        error !== null ? h("div", { className: "km-inline-error", role: "alert" }, error) : null,
+        h(
+          "div",
+          { className: "km-form-actions" },
+          h(
+            Button,
+            { variant: "primary", type: "submit", disabled: !answerable },
+            answering ? h(Icon, { name: "refresh", size: 14, className: "km-spin" }) : h(Icon, { name: "check", size: 14 }),
+            h("span", null, answering ? t("loginPending") : t("loginPromptSubmit"))
+          )
+        )
+      ) : null
+    );
+  }
+  return h(Modal, {
+    title: t("loginTitle"),
+    onClose,
+    busy: false,
+    footer: h(Button, { onClick: onClose, disabled: answering }, t("close"))
+  }, body);
+}
+function SettingsCard() {
+  const runtime = useRuntime();
+  const t = useT();
+  const snapshot = useStore();
+  const state = snapshot.state;
+  const settings = state?.settings ?? null;
+  const [retry, setRetry] = import_react2.default.useState("2");
+  const [base, setBase] = import_react2.default.useState("5");
+  const [grace, setGrace] = import_react2.default.useState("10");
+  const [busy, setBusy] = import_react2.default.useState(false);
+  const [saved, setSaved] = import_react2.default.useState(false);
+  const [error, setError] = import_react2.default.useState(null);
+  const dirty = import_react2.default.useRef(false);
+  import_react2.default.useEffect(() => {
+    if (settings === null || dirty.current) return;
+    setRetry(String(settings.retryCount));
+    setBase(String(cooldownMinutes(settings.baseCooldownMs)));
+    setGrace(String(graceMinutes(settings.recoveryGraceMs)));
+  }, [settings]);
+  function change(setter) {
+    return (event) => {
+      dirty.current = true;
+      setSaved(false);
+      setter(event.target.value);
+    };
+  }
+  async function save(event) {
+    event.preventDefault();
+    setBusy(true);
+    setError(null);
+    setSaved(false);
+    const result = await runtime.store.call("setSettings", {
+      patch: {
+        retryCount: Number(retry),
+        baseCooldownMs: cooldownMs(Number(base)),
+        recoveryGraceMs: graceMs(Number(grace))
+      }
+    });
+    setBusy(false);
+    if (!result.ok) {
+      setError(result.error);
+      return;
+    }
+    dirty.current = false;
+    setSaved(true);
+  }
+  return h(
+    "form",
+    { className: "km-card km-settings", onSubmit: save },
+    h(
+      "div",
+      { className: "km-settings-head" },
+      h(
+        "div",
+        null,
+        h("h3", { className: "km-settings-title" }, t("settingsTitle")),
+        h("p", { className: "km-settings-intro" }, t("settingsIntro"))
+      ),
+      h("span", { className: "km-settings-icon" }, h(Icon, { name: "shield", size: 20 }))
+    ),
+    h(
+      "div",
+      { className: "km-settings-grid" },
+      h(
+        "label",
+        { className: "km-field" },
+        h("span", { className: "km-field-label" }, t("retryCount")),
+        h(
+          "select",
+          { className: "km-input", value: retry, onChange: change(setRetry), disabled: busy || state?.writable === false },
+          ["1", "2", "3"].map((value) => h("option", { key: value, value }, value))
+        ),
+        h("span", { className: "km-field-hint" }, t("retryHint"))
+      ),
+      h(
+        "label",
+        { className: "km-field" },
+        h("span", { className: "km-field-label" }, t("baseCooldown")),
+        h("input", { className: "km-input", type: "number", min: 0.5, step: "any", value: base, onChange: change(setBase), disabled: busy || state?.writable === false }),
+        h("span", { className: "km-field-hint" }, t("baseHint"))
+      ),
+      h(
+        "label",
+        { className: "km-field" },
+        h("span", { className: "km-field-label" }, t("grace")),
+        h("input", { className: "km-input", type: "number", min: 0, step: "any", value: grace, onChange: change(setGrace), disabled: busy || state?.writable === false }),
+        h("span", { className: "km-field-hint" }, t("graceHint"))
+      ),
+      h(
+        "div",
+        { className: "km-field km-field-note" },
+        h(
+          "div",
+          { className: "km-policy-note" },
+          h("div", { className: "km-policy-title" }, h(Icon, { name: "warning", size: 14 }), t("cap")),
+          h("p", { className: "km-muted" }, t("strategyBody"))
+        )
+      )
+    ),
+    error !== null ? h("div", { className: "km-inline-error", role: "alert" }, error) : null,
+    h(
+      "div",
+      { className: "km-settings-actions" },
+      saved ? h("span", { className: "km-saved" }, h(Icon, { name: "check", size: 14 }), t("saved")) : null,
+      h(
+        Button,
+        { variant: "primary", type: "submit", disabled: busy || state?.writable === false || snapshot.busy !== null },
+        busy ? h(Icon, { name: "refresh", size: 14, className: "km-spin" }) : null,
+        busy ? t("savingSettings") : t("saveSettings")
+      )
+    )
+  );
+}
+function KeysManagerBody() {
+  const runtime = useRuntime();
+  const t = useT();
+  const snapshot = useStore();
+  const state = snapshot.state;
+  const now = snapshot.now;
+  const [query, setQuery] = import_react2.default.useState("");
+  const [showAllAvailable, setShowAllAvailable] = import_react2.default.useState(false);
+  const [expanded, setExpanded] = import_react2.default.useState(() => /* @__PURE__ */ new Set());
+  const loadedRef = import_react2.default.useRef(false);
+  import_react2.default.useEffect(() => {
+    if (loadedRef.current) return;
+    loadedRef.current = true;
+    if (snapshot.status === "idle") void runtime.store.load();
+  }, [runtime, snapshot.status]);
+  const providers = state?.providers ?? [];
+  const normalizedQuery = query.trim().toLowerCase();
+  const matches = (provider) => {
+    if (normalizedQuery.length === 0) return true;
+    const haystack = [
+      provider.displayName,
+      provider.provider,
+      provider.extraId,
+      provider.api,
+      provider.baseURL,
+      ...provider.env
+    ].filter((value) => Boolean(value)).join(" ").toLowerCase();
+    return haystack.includes(normalizedQuery);
+  };
+  const managed = providers.filter((provider) => provider.managed && matches(provider));
+  const available = providers.filter((provider) => !provider.managed && matches(provider));
+  const visibleAvailable = showAllAvailable || normalizedQuery.length > 0 ? available : available.slice(0, 12);
+  function toggle(provider) {
+    setExpanded((current) => {
+      const next = new Set(current);
+      if (next.has(provider)) next.delete(provider);
+      else next.add(provider);
+      return next;
+    });
+  }
+  const loading = snapshot.status === "loading" || snapshot.status === "idle" && state === null;
+  const failed = snapshot.status === "error" || snapshot.status === "ready" && state === null;
+  return h(
+    "div",
+    { className: "km-page" },
+    snapshot.error !== null ? h(
+      "div",
+      { className: "km-banner km-banner-error", role: "alert" },
+      h(Icon, { name: "warning", size: 16 }),
+      h("span", { className: "km-banner-text" }, snapshot.error),
+      h("button", { type: "button", className: "km-banner-close", onClick: () => runtime.store.dismissError(), "aria-label": t("dismiss") }, h(Icon, { name: "close", size: 14 }))
+    ) : null,
+    state !== null && state.warnings.length > 0 ? h(
+      "div",
+      { className: "km-banner km-banner-warn", role: "note" },
+      h(Icon, { name: "warning", size: 16 }),
+      h("div", { className: "km-banner-text" }, state.warnings.map((warning, index) => h("div", { key: index }, warning)))
+    ) : null,
+    state !== null && !state.writable ? h(
+      "div",
+      { className: "km-banner km-banner-warn", role: "note" },
+      h(Icon, { name: "shield", size: 16 }),
+      h("span", { className: "km-banner-text" }, t("writableFalse"))
+    ) : null,
+    h(
+      "div",
+      { className: "km-embedded-head" },
+      h(
+        "div",
+        { className: "km-summary" },
+        h("div", { className: "km-stat" }, h("strong", null, loading ? "\u2014" : state?.managedCount ?? 0), h("span", null, t("managed"))),
+        h("div", { className: "km-stat" }, h("strong", null, loading ? "\u2014" : state?.keyCount ?? 0), h("span", null, t("keys"))),
+        h("div", { className: "km-stat" }, h("strong", null, loading ? "\u2014" : state?.healthyKeyCount ?? 0), h("span", null, t("healthy"))),
+        h("div", { className: "km-stat" }, h("strong", null, loading ? "\u2014" : state?.coolingKeyCount ?? 0), h("span", null, t("cooling")))
+      ),
+      h(
+        "div",
+        { className: "km-embedded-actions" },
+        h(Button, {
+          variant: "ghost",
+          size: "small",
+          onClick: () => void runtime.store.load(),
+          disabled: snapshot.busy !== null,
+          title: t("refresh")
+        }, h(Icon, { name: "refresh", size: 14 }), t("refresh"))
+      )
+    ),
+    h(
+      "div",
+      { className: "km-search" },
+      h(Icon, { name: "search", size: 17, className: "km-search-icon" }),
+      h("input", {
+        className: "km-search-input",
+        value: query,
+        onChange: (event) => setQuery(event.target.value),
+        placeholder: t("search"),
+        type: "search",
+        autoFocus: true,
+        "aria-label": t("search")
+      }),
+      query.length > 0 ? h("button", { type: "button", className: "km-search-clear", onClick: () => setQuery(""), "aria-label": t("reset") }, h(Icon, { name: "close", size: 14 })) : null
+    ),
+    loading ? h("div", { className: "km-loading" }, h(Icon, { name: "refresh", size: 18, className: "km-spin" }), t("loading")) : null,
+    failed ? h(
+      "div",
+      { className: "km-load-failure" },
+      h("div", { className: "km-empty-title" }, t("loadError")),
+      h(Button, { variant: "primary", onClick: () => void runtime.store.load() }, t("reload"))
+    ) : null,
+    !loading && !failed ? h(
+      "section",
+      { className: "km-section" },
+      h(
+        "div",
+        { className: "km-section-head" },
+        h("h2", { className: "km-section-title" }, t("managed")),
+        h("span", { className: "km-section-count" }, managed.length)
+      ),
+      managed.length === 0 ? h("div", { className: "km-empty" }, h(Icon, { name: "key", size: 20 }), h("span", null, t("managedEmpty"))) : h("div", { className: "km-provider-list" }, managed.map((provider) => h(ProviderCard, {
+        key: provider.provider,
+        provider,
+        now,
+        expanded: expanded.has(provider.provider),
+        onToggle: () => toggle(provider.provider)
+      })))
+    ) : null,
+    !loading && !failed ? h(
+      "section",
+      { className: "km-section" },
+      h(
+        "div",
+        { className: "km-section-head" },
+        h("h2", { className: "km-section-title" }, t("available")),
+        h("span", { className: "km-section-count" }, available.length)
+      ),
+      available.length === 0 ? h("div", { className: "km-empty" }, h(Icon, { name: "search", size: 20 }), h("span", null, normalizedQuery.length > 0 ? t("noSearch") : t("availableEmpty"))) : h("div", { className: "km-provider-list" }, visibleAvailable.map((provider) => h(ProviderCard, {
+        key: provider.provider,
+        provider,
+        now,
+        expanded: expanded.has(provider.provider),
+        onToggle: () => toggle(provider.provider)
+      }))),
+      available.length > visibleAvailable.length ? h(
+        "div",
+        { className: "km-show-more" },
+        h(Button, { variant: "ghost", size: "small", onClick: () => setShowAllAvailable(true) }, t("showAll", { n: available.length }))
+      ) : showAllAvailable && available.length > 12 ? h(
+        "div",
+        { className: "km-show-more" },
+        h(Button, { variant: "ghost", size: "small", onClick: () => setShowAllAvailable(false) }, t("showLess"))
+      ) : null
+    ) : null,
+    !loading && !failed ? h("section", { className: "km-section" }, h(SettingsCard)) : null,
+    h(
+      "footer",
+      { className: "km-footer" },
+      h(Icon, { name: "shield", size: 14 }),
+      h("span", null, t("storageNote"))
+    )
+  );
+}
+function KeysManagerCard({ view }) {
+  const t = useT();
+  const snapshot = useStore();
+  if (view === "summary") {
+    const state = snapshot.state;
+    if (state === null) return h("span", { className: "km-summary-line" }, snapshot.status === "error" ? t("loadError") : t("loading"));
+    if (state.managedCount === 0) return h("span", { className: "km-summary-line" }, t("summaryEmpty"));
+    return h("span", { className: "km-summary-line" }, t("summaryText", { providers: state.managedCount, keys: state.keyCount }));
+  }
+  return h(KeysManagerBody);
+}
+function ManagedProviderBadge(props) {
+  const t = useT();
+  const snapshot = useStore();
+  const state = snapshot.state;
+  const providerId = props.provider?.provider;
+  if (state === null || providerId === void 0) return null;
+  const managed = state.providers.find((provider) => provider.provider === providerId && provider.managed);
+  if (managed === void 0) return null;
+  const broken = managed.bindingHealthy === false;
+  return h(
+    "div",
+    { className: cx("km-models-note", broken && "km-models-note-warn"), role: "note" },
+    h("span", { className: cx("km-dot", broken ? "km-dot-warn" : "km-dot-success") }),
+    h("span", { className: "km-models-note-text" }, t("modelsBadge", { n: managed.keyCount })),
+    h("span", { className: "km-models-note-hint" }, broken ? t("bindingBroken") : t("modelsHint"))
+  );
+}
+
+// src/client/index.ts
+var inject = ["slots", "locale", "connection"];
+var NS = "dsh-keys-manager";
+function apply(ctx) {
+  ctx.effect(() => ctx.locale.register(NS, LOCALE_DICTS), "keys-manager: dictionaries");
+  const store = createStore(ctx);
+  const runtime = { ctx, store };
+  ctx.effect(() => {
+    void store.load();
+    let disposed = false;
+    const retry = async () => {
+      for (let attempt = 0; attempt < 4 && !disposed; attempt += 1) {
+        if (store.getSnapshot().status === "ready") return;
+        await new Promise((resolve) => setTimeout(resolve, 600));
+        if (disposed) return;
+        await store.load();
+      }
+    };
+    void retry();
+    const off = ctx.on("connection/reset", () => {
+      void store.load();
+    });
+    const timer = setInterval(() => store.tick(), 3e4);
+    return () => {
+      disposed = true;
+      off();
+      clearInterval(timer);
+    };
+  }, "keys-manager: lifecycle");
+  ctx.slots.inject("plugins.bundle.config", () => ctx.slots.register({
+    name: "plugins.bundle.config",
+    key: "dsh-keys-manager"
+  }, wrapComponent(KeysManagerCard, runtime)));
+  ctx.slots.inject("settings.models.provider-card", () => {
+    const disposers = [
+      ctx.slots.register({ name: "settings.models.provider-card", key: "llm-pi-ai" }, wrapComponent(ManagedProviderBadge, runtime)),
+      ctx.slots.register({ name: "settings.models.provider-card", key: "llm-deepseek-api-key" }, wrapComponent(ManagedProviderBadge, runtime)),
+      ctx.slots.register({ name: "settings.models.provider-card", key: "llm-deepseek" }, wrapComponent(ManagedProviderBadge, runtime))
+    ];
+    return () => {
+      for (const dispose of disposers) dispose();
+    };
+  });
+}
+return module.exports; } });