dsh-keys-manager 0.1.0 → 0.2.0

package/lib/client.js

@@ -97,9 +97,11 @@ var zh = {
   failures: "\u5931\u8D25 {n} \u6B21",
   adoptHint: "\u63A5\u7BA1\u540E\uFF0C\u8BE5 Provider \u7684 API Key \u5C06\u7531\u5BC6\u94A5\u7BA1\u7406\u5668\u7EDF\u4E00\u63D0\u4F9B\u3002\u5F53\u524D\u51ED\u8BC1\u4F1A\u5BFC\u5165\u4E3A\u7B2C\u4E00\u4E2A Key\uFF0C\u539F\u5F15\u7528\u4F1A\u4FDD\u7559\u4EE5\u4FBF\u505C\u6B62\u63A5\u7BA1\u65F6\u6062\u590D\u3002",
   adoptExtraHint: "\u8FD9\u4E2A\u6269\u5C55 Provider \u5C1A\u672A\u914D\u7F6E\u3002\u6DFB\u52A0 Key \u540E\uFF0C\u63D2\u4EF6\u4F1A\u81EA\u52A8\u5B89\u88C5 llm-pi-ai \u8DEF\u7531\uFF0C\u5E76\u4F7F\u7528\u81EA\u52A8\u53D1\u73B0\u6216\u5185\u7F6E\u6A21\u578B\u5217\u8868\u3002",
+  adoptAccountTitle: "\u4F7F\u7528 OAuth \u8D26\u6237\u767B\u5F55\u540E\u5373\u53EF\u4F7F\u7528\u8BE5 Provider\u3002",
   unsupported: "\u6682\u4E0D\u652F\u6301\u5BC6\u94A5\u6C60",
   bindingBroken: "Provider \u914D\u7F6E\u5DF2\u4E0D\u518D\u6307\u5411\u5BC6\u94A5\u7BA1\u7406\u5668\u3002\u8BF7\u5148\u505C\u6B62\u63A5\u7BA1\u518D\u91CD\u65B0\u63A5\u7BA1\uFF0C\u6216\u5728\u6A21\u578B\u8BBE\u7F6E\u4E2D\u4FEE\u590D\u8BE5 Provider\u3002",
   noKeys: "\u8FD8\u6CA1\u6709\u5BC6\u94A5\u3002\u6DFB\u52A0\u4E00\u4E2A\u540E\u5373\u53EF\u4F7F\u7528\u8BE5 Provider\u3002",
+  noKeysAccount: "\u8FD8\u6CA1\u6709\u8D26\u6237\u3002\u6DFB\u52A0\u4E00\u4E2A\u8D26\u6237\u540E\u5373\u53EF\u4F7F\u7528\u8BE5 Provider\u3002",
   warning: "\u6CE8\u610F",
   settingsTitle: "\u7B56\u7565",
   settingsIntro: "\u4EE5\u4E0B\u8BBE\u7F6E\u5BF9\u6240\u6709\u5DF2\u63A5\u7BA1\u7684 Provider \u751F\u6548\u3002",
@@ -150,6 +152,7 @@ var zh = {
   keyStatusCooling: "\u51B7\u5374\u4E2D",
   keyStatusPaused: "\u5DF2\u6682\u505C",
   keyStatusMissing: "\u51ED\u8BC1\u7F3A\u5931",
+  keyStatusEmpty: "\u6682\u65E0\u5BC6\u94A5",
   keyStatusUnmanaged: "\u672A\u63A5\u7BA1",
   providerKeys: "{n} \u4E2A\u5BC6\u94A5",
   providerKeyOne: "1 \u4E2A\u5BC6\u94A5",
@@ -164,7 +167,25 @@ var zh = {
   openModels: "\u6253\u5F00\u6A21\u578B\u8BBE\u7F6E",
   searchResults: "{n} \u4E2A\u5339\u914D",
   reset: "\u91CD\u7F6E",
-  attention: "\u9700\u8981\u5904\u7406"
+  attention: "\u9700\u8981\u5904\u7406",
+  // OAuth account surface — same values as locale/zh.json (dual source
+  // until the host's dsh-client-locale merge semantics are confirmed).
+  addAccount: "\u6DFB\u52A0\u8D26\u6237",
+  accountIdentity: "\u8D26\u6237",
+  accountProjected: "\u670D\u52A1\u4E2D",
+  accountReauth: "\u91CD\u65B0\u8BA4\u8BC1",
+  accountActivate: "\u8BBE\u4E3A\u5F53\u524D",
+  loginTitle: "\u8D26\u6237\u767B\u5F55",
+  loginPending: "\u7B49\u5F85\u6388\u6743\u2026",
+  loginBrowserOpen: "\u5728\u6D4F\u89C8\u5668\u4E2D\u6253\u5F00",
+  loginPromptTitle: "\u5B8C\u6210\u767B\u5F55",
+  loginPromptSubmit: "\u63D0\u4EA4",
+  loginFailed: "\u767B\u5F55\u5931\u8D25",
+  loginFlowEnded: "\u672C\u6B21\u767B\u5F55\u6D41\u7A0B\u5DF2\u7ED3\u675F\uFF0C\u8BF7\u5173\u95ED\u7A97\u53E3\u540E\u91CD\u65B0\u5F00\u59CB\u3002",
+  loginReady: "\u767B\u5F55\u6210\u529F\u3002",
+  deleteAccountTitle: "\u5220\u9664\u8D26\u6237\u201C{alias}\u201D\uFF1F",
+  deleteAccountBody: "\u8FD9\u4F1A\u4ECE\u51ED\u8BC1\u5E93\u4E2D\u5220\u9664\u8BE5\u8D26\u6237\u4FDD\u5B58\u7684 OAuth \u6388\u6743\u3002\u5982\u679C\u5B83\u662F\u5F53\u524D\u8D26\u6237\uFF0C\u8BE5 Provider \u8DEF\u7531\u5C06\u505C\u7528\u5B83\u5E76\u56DE\u843D\u5230 API-key \u6C60\uFF1BProvider \u4ECD\u4FDD\u6301\u63A5\u7BA1\u72B6\u6001\u3002",
+  deleteAccountBodyNoKeys: "\u8FD9\u4F1A\u4ECE\u51ED\u8BC1\u5E93\u4E2D\u5220\u9664\u8BE5\u8D26\u6237\u4FDD\u5B58\u7684 OAuth \u6388\u6743\u3002\u8BE5\u8DEF\u7531\u6CA1\u6709 API-key \u6C60\uFF0C\u5220\u9664\u540E\u5C06\u505C\u6B62\u670D\u52A1\uFF0C\u76F4\u5230\u91CD\u65B0\u767B\u5F55\u8D26\u6237\u3002"
 };
 var en = {
   nav: "Keys Manager",
@@ -224,9 +245,11 @@ var en = {
   failures: "{n} failures",
   adoptHint: "Adopting turns this provider\u2019s API-key source over to Keys Manager. Its current credential is imported as the first key, and the original reference is kept for release.",
   adoptExtraHint: "This extra provider is not configured yet. Add a key and the plugin installs an llm-pi-ai route with discovered or built-in models.",
+  adoptAccountTitle: "Sign in with an OAuth account to use this provider.",
   unsupported: "Not available for key pools",
   bindingBroken: "The provider profile no longer points at Keys Manager. Release and re-adopt it, or repair the provider in Models.",
   noKeys: "No keys yet. Add one to make this provider usable.",
+  noKeysAccount: "No accounts yet. Add an account to make this provider usable.",
   warning: "Warning",
   settingsTitle: "Policy",
   settingsIntro: "These values apply to every managed provider.",
@@ -277,6 +300,7 @@ var en = {
   keyStatusCooling: "Cooling",
   keyStatusPaused: "Paused",
   keyStatusMissing: "Credential missing",
+  keyStatusEmpty: "No keys",
   keyStatusUnmanaged: "Not managed",
   providerKeys: "{n} keys",
   providerKeyOne: "1 key",
@@ -291,7 +315,25 @@ var en = {
   openModels: "Open Models",
   searchResults: "{n} matches",
   reset: "Reset",
-  attention: "Needs attention"
+  attention: "Needs attention",
+  // OAuth account surface — same values as locale/en.json (dual source
+  // until the host's dsh-client-locale merge semantics are confirmed).
+  addAccount: "Add account",
+  accountIdentity: "Account",
+  accountProjected: "Serving provider",
+  accountReauth: "Re-authenticate",
+  accountActivate: "Set active",
+  loginTitle: "Account sign-in",
+  loginPending: "Waiting for authorization\u2026",
+  loginBrowserOpen: "Open in browser",
+  loginPromptTitle: "Complete sign-in",
+  loginPromptSubmit: "Submit",
+  loginFailed: "Login failed",
+  loginFlowEnded: "This sign-in session has ended. Close the dialog and start again.",
+  loginReady: "Signed in.",
+  deleteAccountTitle: "Delete account \u201C{alias}\u201D?",
+  deleteAccountBody: "This removes the account\u2019s stored OAuth grant from the credential store. If it is the active account, the provider route stops serving it and falls back to its API-key pool; the provider stays managed.",
+  deleteAccountBodyNoKeys: "This removes the account\u2019s stored OAuth grant from the credential store. This route has no API-key pool, so it stops serving requests until an account is signed in again."
 };
 var LOCALE_DICTS = { zh, en };
 
@@ -348,6 +390,10 @@ var CSS = `
 .km-keys{display:flex;flex-direction:column;border:1px solid var(--dsw-alias-border-l1);border-radius:9px;background:var(--dsw-alias-bg-layer-1);overflow:visible}
 .km-key-row{position:relative;display:grid;grid-template-columns:minmax(0,1.35fr) minmax(150px,.8fr) minmax(150px,.9fr) 32px;gap:10px;align-items:center;padding:10px 11px;border-top:1px solid var(--dsw-alias-border-l1)}
 .km-key-row:first-child{border-top:0}
+.km-account-row{position:relative;display:grid;grid-template-columns:minmax(0,1.35fr) minmax(150px,.8fr) minmax(150px,.9fr) 32px;gap:10px;align-items:center;padding:10px 11px 10px 14px;border-top:1px solid var(--dsw-alias-border-l1)}
+.km-account-row:first-child{border-top:0}
+.km-account-row::before{content:'';position:absolute;left:0;top:12px;bottom:12px;width:2px;border-radius:1px;background:color-mix(in srgb,var(--dsw-alias-state-business-primary) 55%,transparent)}
+.km-account-glyph{display:inline-flex;align-items:center;justify-content:center;width:22px;height:22px;flex:0 0 22px;border-radius:50%;background:color-mix(in srgb,var(--dsw-alias-state-business-primary) 14%,var(--dsw-alias-bg-layer-2));color:var(--dsw-alias-state-business-primary)}
 .km-key-identity{min-width:0;display:flex;flex-direction:column;gap:2px}
 .km-key-alias-line{display:flex;align-items:center;gap:6px;min-width:0}
 .km-key-alias{font-weight:600;white-space:nowrap;overflow:hidden;text-overflow:ellipsis;max-width:220px}
@@ -458,11 +504,18 @@ select.km-input{appearance:auto}
 .km-modal-title{font-weight:650;font-size:14px;margin-bottom:7px}
 .km-modal-body{color:var(--dsw-alias-label-secondary);font-size:12.5px}
 .km-modal-copy{margin:0;line-height:1.55}
+.km-login-flow{display:flex;flex-direction:column;gap:10px}
+.km-login-pending{display:flex;align-items:center;gap:8px;color:var(--dsw-alias-label-secondary);font-size:12.5px}
+.km-login-notices{color:var(--dsw-alias-label-secondary);font-size:12px;line-height:1.5;word-break:break-word}
+.km-login-link{color:var(--dsw-alias-state-business-primary);text-decoration:underline;text-underline-offset:2px}
+.km-login-link:hover{color:var(--dsw-alias-label-primary)}
+.km-login-prompt{display:flex;flex-direction:column;gap:10px;padding-top:2px;border-top:1px dashed var(--dsw-alias-border-l1)}
+.km-login-prompt-title{font-weight:600;font-size:12.5px;color:var(--dsw-alias-label-primary)}
 .km-modal-footer{display:flex;justify-content:flex-end;gap:8px;margin-top:16px}
 @keyframes km-spin{to{transform:rotate(360deg)}}
 @media(max-width:720px){
   .km-summary{grid-template-columns:repeat(2,minmax(0,1fr))}
-  .km-key-row{grid-template-columns:minmax(0,1fr) 32px;gap:6px}
+  .km-key-row,.km-account-row{grid-template-columns:minmax(0,1fr) 32px;gap:6px}
   .km-key-status,.km-key-last{grid-column:1;padding-left:0}
   .km-key-actions{grid-column:2;grid-row:1}
   .km-settings-grid{grid-template-columns:1fr}
@@ -556,6 +609,46 @@ function createStore(ctx) {
     emit();
   };
   const rpc = (method, args) => ctx.connection.rpc.call("/api", `keysManager/${method}`, { args });
+  const send = async (method, args, onSuccess) => {
+    queuedMutations += 1;
+    update({ busy: method, error: null });
+    const run = async () => {
+      ++loadSequence;
+      try {
+        const result = await rpc(method, args);
+        if (!result.ok) throw new Error(result.error.message);
+        const outcome = onSuccess(result.value);
+        if (queuedMutations === 1) update({ busy: null });
+        return outcome;
+      } catch (error) {
+        const message = messageOf(error);
+        if (queuedMutations === 1) update({ busy: null, error: message });
+        else update({ error: message });
+        return { ok: false, error: message };
+      } finally {
+        queuedMutations -= 1;
+      }
+    };
+    const next = mutationTail.then(run, run);
+    mutationTail = next.then(() => void 0, () => void 0);
+    return next;
+  };
+  const stateOutcome = (value) => {
+    const state = value;
+    if (queuedMutations === 1) update({ status: "ready", state, now: Date.now(), busy: null, error: null });
+    else update({ status: "ready", state, now: Date.now(), error: null });
+    return { ok: true, value: state };
+  };
+  const rpcRead = async (method, args) => {
+    try {
+      return await rpc(method, args);
+    } catch (error) {
+      return { ok: false, error: { message: messageOf(error) } };
+    }
+  };
+  const attemptOutcome = (value) => {
+    return { ok: true, value: value ?? null };
+  };
   return {
     getSnapshot: () => snapshot,
     subscribe(listener) {
@@ -577,32 +670,29 @@ function createStore(ctx) {
       }
     },
     call(method, args) {
-      queuedMutations += 1;
-      update({ busy: method, error: null });
-      const run = async () => {
-        ++loadSequence;
-        try {
-          const result = await rpc(method, args);
-          if (!result.ok) throw new Error(result.error.message);
-          const outcome = { ok: true, value: result.value };
-          if (queuedMutations === 1) {
-            update({ status: "ready", state: result.value, now: Date.now(), busy: null, error: null });
-          } else {
-            update({ status: "ready", state: result.value, now: Date.now(), error: null });
-          }
-          return outcome;
-        } catch (error) {
-          const message = messageOf(error);
-          if (queuedMutations === 1) update({ busy: null, error: message });
-          else update({ error: message });
-          return { ok: false, error: message };
-        } finally {
-          queuedMutations -= 1;
-        }
-      };
-      const next = mutationTail.then(run, run);
-      mutationTail = next.then(() => void 0, () => void 0);
-      return next;
+      return send(method, args, stateOutcome);
+    },
+    beginAccountLogin(provider, alias, targetAccountId) {
+      return send("beginAccountLogin", { provider, alias, targetAccountId }, attemptOutcome);
+    },
+    answerAccountPrompt(attemptId, value) {
+      return send("answerAccountPrompt", { attemptId, value }, () => ({ ok: true, value: null }));
+    },
+    async accountAttempt(attemptId) {
+      const result = await rpcRead("accountAttempt", { attemptId });
+      if (!result.ok) return { ok: false, error: result.error.message };
+      return attemptOutcome(result.value);
+    },
+    async listAccountAttempts() {
+      const result = await rpcRead("listAccountAttempts", {});
+      if (!result.ok) return { ok: false, error: result.error.message };
+      return { ok: true, value: result.value ?? [] };
+    },
+    activateAccount(provider, accountId) {
+      return send("activateAccount", { provider, accountId }, stateOutcome);
+    },
+    removeAccount(provider, accountId) {
+      return send("removeAccount", { provider, accountId }, stateOutcome);
     },
     tick() {
       update({ now: Date.now() });
@@ -672,6 +762,17 @@ function providerInitial(provider) {
   const source = String(provider?.displayName || provider?.provider || "?").trim();
   return source.length === 0 ? "?" : source.slice(0, 1).toUpperCase();
 }
+function oauthCapable(provider) {
+  return provider.nativeAuth?.oauth === true && provider.accountSupported !== false;
+}
+function accountIdentityOf(key, provider) {
+  const oauth = key.oauth;
+  if (oauth !== null && oauth !== void 0) {
+    if (oauth.email !== void 0 && oauth.email.length > 0) return oauth.email;
+    if (oauth.accountId !== void 0 && oauth.accountId.length > 0) return oauth.accountId;
+  }
+  return provider.displayName || provider.provider;
+}
 function statusKey(status) {
   switch (status) {
     case "active":
@@ -682,6 +783,10 @@ function statusKey(status) {
       return "keyStatusPaused";
     case "missing":
       return "keyStatusMissing";
+    // A managed route with zero keys (round-3 finding 7): "Not managed"
+    // would contradict the Managed badge rendered beside it.
+    case "empty":
+      return "keyStatusEmpty";
     default:
       return "keyStatusUnmanaged";
   }
@@ -696,6 +801,8 @@ function statusTone(status) {
       return "idle";
     case "missing":
       return "error";
+    case "empty":
+      return "idle";
     default:
       return "idle";
   }
@@ -728,6 +835,7 @@ function Icon({ name, size = 16, className }) {
   if (name === "refresh") return h("svg", common, h("path", { d: "M20 11a8 8 0 10-2.3 6M20 5v6h-6" }));
   if (name === "warning") return h("svg", common, h("path", { d: "M12 3l9.5 17h-19L12 3zM12 9v5M12 17.2v.1" }));
   if (name === "shield") return h("svg", common, h("path", { d: "M12 3l8 3v6c0 5-3.5 8-8 9-4.5-1-8-4-8-9V6l8-3zM9 12l2 2 4-4" }));
+  if (name === "user") return h("svg", common, h("circle", { cx: 12, cy: 8, r: 3.6 }), h("path", { d: "M5 20a7 7 0 0114 0" }));
   return h("svg", common);
 }
 function Button({ variant = "secondary", size = "normal", type = "button", disabled, onClick, children, title }) {
@@ -1090,6 +1198,154 @@ function KeyRow({ provider, keyRecord, now }) {
     }, h("p", { className: "km-modal-copy" }, t("deleteBody"))) : null
   );
 }
+function AccountRow({ provider, keyRecord, now, onReauthenticate }) {
+  const runtime = useRuntime();
+  const t = useT();
+  const locale = useLocaleId();
+  const key = keyRecord;
+  const identity = accountIdentityOf(key, provider);
+  const [menu, setMenu] = import_react2.default.useState(false);
+  const [confirm, setConfirm] = import_react2.default.useState(false);
+  const [busy, setBusy] = import_react2.default.useState(false);
+  const [error, setError] = import_react2.default.useState(null);
+  const rootRef = import_react2.default.useRef(null);
+  import_react2.default.useEffect(() => {
+    if (!menu) return void 0;
+    const onDown = (event) => {
+      if (rootRef.current !== null && !rootRef.current.contains(event.target)) setMenu(false);
+    };
+    const onKey = (event) => {
+      if (event.key === "Escape") setMenu(false);
+    };
+    document.addEventListener("mousedown", onDown);
+    document.addEventListener("keydown", onKey);
+    return () => {
+      document.removeEventListener("mousedown", onDown);
+      document.removeEventListener("keydown", onKey);
+    };
+  }, [menu]);
+  async function activate() {
+    setBusy(true);
+    setError(null);
+    const result = await runtime.store.activateAccount(provider.provider, key.id);
+    setBusy(false);
+    if (!result.ok) setError(result.error);
+  }
+  async function remove() {
+    setBusy(true);
+    setError(null);
+    const result = await runtime.store.removeAccount(provider.provider, key.id);
+    setBusy(false);
+    if (!result.ok) setError(result.error);
+    else setConfirm(false);
+  }
+  const cold = key.status === "cooling" && key.cooldownUntil > now;
+  const metaParts = [
+    key.totalUses > 0 ? t("uses", { n: key.totalUses }) : null,
+    key.totalFailures > 0 ? t("failures", { n: key.totalFailures }) : null
+  ].filter((value) => value !== null);
+  return h(
+    "div",
+    { className: "km-account-row", ref: rootRef },
+    h(
+      "div",
+      { className: "km-key-identity" },
+      h(
+        "div",
+        { className: "km-key-alias-line" },
+        h("span", { className: "km-account-glyph", "aria-hidden": true }, h(Icon, { name: "user", size: 13 })),
+        h("span", { className: "km-key-alias" }, identity),
+        h("span", { className: "km-tag km-tag-accent" }, t("accountIdentity")),
+        // Step 6: the row whose grant IS the live projection is badged.
+        key.projected === true ? h("span", { className: "km-tag km-tag-accent" }, t("accountProjected")) : null
+      ),
+      h(
+        "div",
+        { className: "km-key-sub" },
+        h("span", { className: "km-mono km-muted" }, `\u2022\u2022\u2022\u2022 ${key.id.slice(-4)}`)
+      )
+    ),
+    h(
+      "div",
+      { className: "km-key-status" },
+      h(StatusPill, { status: key.status, t }),
+      cold ? h("div", { className: "km-key-time km-warn" }, t("coolingUntil", { time: formatClock(key.cooldownUntil, locale, t) })) : null,
+      cold ? h("div", { className: "km-key-time" }, t("remaining", { time: durationText(key.cooldownUntil - now, t) })) : null
+    ),
+    h(
+      "div",
+      { className: "km-key-last" },
+      h("div", { className: "km-key-time" }, `${t("lastUsed")}: ${relativeTime(key.lastUsedAt, now, t)}`),
+      metaParts.length > 0 ? h(
+        "div",
+        { className: "km-key-time km-muted" },
+        metaParts.map((value, index) => [
+          index > 0 ? h("span", { key: `sep-${index}`, className: "km-dot-sep", "aria-hidden": true }, "\xB7") : null,
+          h("span", { key: `part-${index}` }, value)
+        ])
+      ) : null
+    ),
+    h(
+      "div",
+      { className: "km-key-actions" },
+      h("button", {
+        type: "button",
+        className: "km-icon-btn",
+        "aria-haspopup": "menu",
+        "aria-expanded": menu,
+        title: t("moreActions"),
+        "aria-label": t("moreActions"),
+        onClick: () => setMenu((current) => !current),
+        disabled: busy
+      }, h(Icon, { name: "dots", size: 17 })),
+      menu ? h(
+        "div",
+        { className: "km-menu", role: "menu" },
+        h("button", {
+          type: "button",
+          className: "km-menu-item",
+          role: "menuitem",
+          onClick: () => {
+            setMenu(false);
+            void activate();
+          },
+          // Step 6: the projected row already serves the route; setting it
+          // active again is a no-op, so the entry stays disabled.
+          disabled: busy || key.projected === true
+        }, h(Icon, { name: "check", size: 15 }), t("accountActivate")),
+        h("button", {
+          type: "button",
+          className: "km-menu-item",
+          role: "menuitem",
+          onClick: () => {
+            setMenu(false);
+            onReauthenticate();
+          },
+          disabled: busy
+        }, h(Icon, { name: "refresh", size: 15 }), t("accountReauth")),
+        h("div", { className: "km-menu-sep" }),
+        h("button", { type: "button", className: "km-menu-item km-menu-danger", role: "menuitem", onClick: () => {
+          setMenu(false);
+          setConfirm(true);
+        }, disabled: busy }, h(Icon, { name: "trash", size: 15 }), t("delete"))
+      ) : null
+    ),
+    error !== null ? h("div", { className: "km-key-error", role: "alert" }, error) : null,
+    confirm ? h(Modal, {
+      // SF4: account-specific copy — the grant removal consequence, not a
+      // key-deletion/provider-release promise. Step 8: the key-pool
+      // fallback clause appears only when the route actually has key
+      // support; an OAuth-only route states the real consequence instead.
+      title: t("deleteAccountTitle", { alias: identity }),
+      onClose: () => setConfirm(false),
+      busy,
+      footer: [
+        h(Button, { key: "cancel", onClick: () => setConfirm(false), disabled: busy }, t("cancel")),
+        h(Button, { key: "delete", variant: "danger", onClick: remove, disabled: busy }, busy ? t("deleting") : t("deleteConfirm"))
+      ]
+    }, h("p", { className: "km-modal-copy" }, t(provider.supported === true ? "deleteAccountBody" : "deleteAccountBodyNoKeys"))) : null
+  );
+}
 function ProviderCard({ provider, expanded, onToggle, now }) {
   const runtime = useRuntime();
   const t = useT();
@@ -1097,6 +1353,8 @@ function ProviderCard({ provider, expanded, onToggle, now }) {
   const [adopting, setAdopting] = import_react2.default.useState(false);
   const [releasing, setReleasing] = import_react2.default.useState(false);
   const [confirmRelease, setConfirmRelease] = import_react2.default.useState(false);
+  const [login, setLogin] = import_react2.default.useState(null);
+  const [startingLogin, setStartingLogin] = import_react2.default.useState(false);
   const [error, setError] = import_react2.default.useState(null);
   const managed = provider.managed;
   const broken = managed && provider.bindingHealthy === false;
@@ -1128,6 +1386,35 @@ function ProviderCard({ provider, expanded, onToggle, now }) {
     }
     setConfirmRelease(false);
   }
+  async function openLogin(targetAccountId, alias) {
+    if (startingLogin) return;
+    setStartingLogin(true);
+    setError(null);
+    const result = await runtime.store.beginAccountLogin(provider.provider, alias, targetAccountId);
+    setStartingLogin(false);
+    if (!result.ok) {
+      setError(result.error);
+      return;
+    }
+    if (result.value !== null) setLogin({ attemptId: result.value.id });
+  }
+  async function adoptThenLogin() {
+    if (provider.managed) {
+      await openLogin();
+      return;
+    }
+    setAdopting(true);
+    setError(null);
+    const result = await runtime.store.call("adoptProvider", { provider: provider.provider });
+    setAdopting(false);
+    if (!result.ok) {
+      setError(result.error);
+      return;
+    }
+    await openLogin();
+  }
+  const accountAdoptable = oauthCapable(provider);
+  const adoptable = provider.supported || accountAdoptable;
   return h(
     "div",
     { className: cx("km-card", "km-provider", expanded && "km-provider-open", managed && "km-provider-managed") },
@@ -1149,7 +1436,7 @@ function ProviderCard({ provider, expanded, onToggle, now }) {
           h("span", { className: "km-provider-name" }, provider.displayName || provider.provider),
           h("span", { className: "km-tag" }, originLabel),
           managed ? h("span", { className: "km-tag km-tag-accent" }, t("managedBadge")) : null,
-          !managed && !provider.supported ? h("span", { className: "km-tag km-tag-warn" }, t("unsupported")) : null
+          !managed && !provider.supported && !accountAdoptable ? h("span", { className: "km-tag km-tag-warn" }, t("unsupported")) : null
         ),
         h(
           "span",
@@ -1163,7 +1450,7 @@ function ProviderCard({ provider, expanded, onToggle, now }) {
       h(
         "span",
         { className: "km-provider-side" },
-        managed ? h("span", { className: "km-count" }, countText(t, keyCount, "providerKeyOne", "providerKeys")) : h("span", { className: "km-count km-muted" }, provider.supported ? t("unmanaged") : t("unsupported")),
+        managed ? h("span", { className: "km-count" }, countText(t, keyCount, "providerKeyOne", "providerKeys")) : h("span", { className: "km-count km-muted" }, adoptable ? t("unmanaged") : t("unsupported")),
         managed ? h(StatusPill, { status: provider.status, t }) : null,
         h(Icon, { name: "chevron", size: 16, className: cx("km-chevron", expanded && "km-chevron-open") })
       )
@@ -1179,7 +1466,15 @@ function ProviderCard({ provider, expanded, onToggle, now }) {
         h(
           "div",
           { className: "km-adopt-copy" },
-          h("div", { className: "km-adopt-title" }, provider.supported ? t(isExtra ? "adoptExtraHint" : "adoptHint") : t("unsupported")),
+          // I-000063: an OAuth-only route is account-adoptable, so its
+          // adopt panel headline must invite sign-in instead of claiming
+          // the provider is unsupported. The unsupported headline remains
+          // only for providers that are neither key- nor account-capable.
+          h(
+            "div",
+            { className: "km-adopt-title" },
+            provider.supported ? t(isExtra ? "adoptExtraHint" : "adoptHint") : accountAdoptable ? t("adoptAccountTitle") : t("unsupported")
+          ),
           !provider.supported && provider.reason !== void 0 ? h("div", { className: "km-muted" }, provider.reason) : null,
           provider.apiKeyEnv !== null ? h("div", { className: "km-meta-line" }, h("span", { className: "km-muted" }, `${t("secret")}:`), h("span", { className: "km-mono" }, provider.apiKeyEnv)) : null,
           provider.baseURL !== null ? h("div", { className: "km-meta-line" }, h("span", { className: "km-muted" }, `${t("baseUrl")}:`), h("span", { className: "km-mono km-truncate" }, provider.baseURL)) : null,
@@ -1190,10 +1485,18 @@ function ProviderCard({ provider, expanded, onToggle, now }) {
           { className: "km-adopt-actions" },
           h(
             Button,
-            { variant: "primary", onClick: adopt, disabled: adopting || !provider.supported },
+            { variant: "primary", onClick: adopt, disabled: adopting || !adoptable },
             adopting ? h(Icon, { name: "refresh", size: 14, className: "km-spin" }) : h(Icon, { name: "shield", size: 14 }),
             h("span", null, adopting ? t("adopting") : t("adopt"))
-          )
+          ),
+          // MF1: Add account is reachable from the unmanaged/adopt flow —
+          // adopt (zero keys for OAuth-only routes) then sign in.
+          oauthCapable(provider) ? h(
+            Button,
+            { variant: "secondary", onClick: () => void adoptThenLogin(), disabled: adopting || startingLogin },
+            startingLogin ? h(Icon, { name: "refresh", size: 14, className: "km-spin" }) : h(Icon, { name: "user", size: 14 }),
+            h("span", null, startingLogin ? t("adopting") : t("addAccount"))
+          ) : null
         )
       ) : h(
         "div",
@@ -1212,10 +1515,16 @@ function ProviderCard({ provider, expanded, onToggle, now }) {
             { className: "km-managed-actions" },
             h(
               Button,
-              { variant: "secondary", size: "small", onClick: () => setAdding((current) => !current), disabled: releasing },
+              { variant: "secondary", size: "small", onClick: () => setAdding((current) => !current), disabled: releasing || !provider.supported, title: provider.supported ? void 0 : provider.reason },
               h(Icon, { name: "plus", size: 14 }),
               h("span", null, t("addKey"))
             ),
+            oauthCapable(provider) ? h(
+              Button,
+              { variant: "secondary", size: "small", onClick: () => void openLogin(), disabled: releasing || startingLogin },
+              h(Icon, { name: "user", size: 14 }),
+              h("span", null, t("addAccount"))
+            ) : null,
             h(
               Button,
               { variant: "ghost", size: "small", onClick: () => setConfirmRelease(true), disabled: releasing },
@@ -1224,7 +1533,12 @@ function ProviderCard({ provider, expanded, onToggle, now }) {
           )
         ),
         adding ? h(KeyForm, { provider, onDone: () => setAdding(false), autoFocus: true }) : null,
-        provider.keys.length === 0 ? h("div", { className: "km-empty-keys" }, t("noKeys")) : h("div", { className: "km-keys" }, provider.keys.map((key) => h(KeyRow, { key: key.id, provider, keyRecord: key, now })))
+        provider.keys.length === 0 ? h(
+          "div",
+          { className: "km-empty-keys" },
+          h("div", null, provider.supported ? t("noKeys") : oauthCapable(provider) ? t("noKeysAccount") : t("unsupported")),
+          !provider.supported && provider.reason !== void 0 ? h("div", { className: "km-muted" }, provider.reason) : null
+        ) : h("div", { className: "km-keys" }, provider.keys.map((key) => key.kind === "oauth" ? h(AccountRow, { key: key.id, provider, keyRecord: key, now, onReauthenticate: () => void openLogin(key.id, key.alias) }) : h(KeyRow, { key: key.id, provider, keyRecord: key, now })))
       ),
       h(
         "div",
@@ -1241,9 +1555,207 @@ function ProviderCard({ provider, expanded, onToggle, now }) {
         h(Button, { key: "cancel", onClick: () => setConfirmRelease(false), disabled: releasing }, t("cancel")),
         h(Button, { key: "release", variant: "danger", onClick: release, disabled: releasing }, releasing ? t("releasing") : t("releaseConfirm"))
       ]
-    }, h("p", { className: "km-modal-copy" }, t(provider.createdProfile === true ? "releaseBodyCreated" : "releaseBody"))) : null
+    }, h("p", { className: "km-modal-copy" }, t(provider.createdProfile === true ? "releaseBodyCreated" : "releaseBody"))) : null,
+    login !== null ? h(LoginDialog, {
+      provider,
+      attemptId: login.attemptId,
+      onClose: () => setLogin(null)
+    }) : null
   );
 }
+var LOGIN_POLL_MS = 1e3;
+function safeNoticeUrl(url) {
+  if (url === void 0 || url.length === 0) return null;
+  try {
+    const parsed = new URL(url);
+    return parsed.protocol === "http:" || parsed.protocol === "https:" ? url : null;
+  } catch {
+    return null;
+  }
+}
+var LOGIN_POLL_FAILURE_LIMIT = 3;
+function LoginDialog({ provider, attemptId, onClose }) {
+  const runtime = useRuntime();
+  const t = useT();
+  const [attempt, setAttempt] = import_react2.default.useState(null);
+  const [flowEnded, setFlowEnded] = import_react2.default.useState(false);
+  const [pollError, setPollError] = import_react2.default.useState(null);
+  const [answer, setAnswer] = import_react2.default.useState("");
+  const [answering, setAnswering] = import_react2.default.useState(false);
+  const [error, setError] = import_react2.default.useState(null);
+  const pollNowRef = import_react2.default.useRef(null);
+  const onCloseRef = import_react2.default.useRef(onClose);
+  onCloseRef.current = onClose;
+  const prompt = attempt?.prompt;
+  const promptKey = prompt === void 0 ? "" : `${prompt.kind}\0${prompt.message}\0${(prompt.options ?? []).map((option) => option.id).join("\0")}`;
+  import_react2.default.useEffect(() => {
+    const options = prompt !== void 0 && prompt.kind === "select" ? prompt.options : void 0;
+    if (options !== void 0 && options.length > 0) {
+      setAnswer((current) => options.some((option) => option.id === current) ? current : options[0].id);
+      return;
+    }
+    setAnswer("");
+  }, [promptKey]);
+  import_react2.default.useEffect(() => {
+    let stopped = false;
+    let timer;
+    let failures = 0;
+    let pending = 0;
+    let latestUpdatedAt = 0;
+    const isTerminal = (status) => status === "ready" || status === "failed" || status === "cancelled";
+    const poll = async () => {
+      if (stopped) return;
+      pending += 1;
+      try {
+        const result = await runtime.store.accountAttempt(attemptId);
+        if (stopped) return;
+        if (!result.ok) {
+          failures += 1;
+          if (failures >= LOGIN_POLL_FAILURE_LIMIT) {
+            if (timer !== void 0) clearInterval(timer);
+            setPollError(result.error);
+          }
+          return;
+        }
+        failures = 0;
+        if (result.value === null) {
+          if (timer !== void 0) clearInterval(timer);
+          setFlowEnded(true);
+          return;
+        }
+        const view = result.value;
+        if (view.updatedAt < latestUpdatedAt) return;
+        latestUpdatedAt = view.updatedAt;
+        setAttempt((current) => {
+          if (current === null) return view;
+          if (isTerminal(current.status) && !isTerminal(view.status)) return current;
+          if (current.updatedAt > view.updatedAt) return current;
+          if (current.updatedAt === view.updatedAt && current.status === view.status) return current;
+          return view;
+        });
+        if (view.status === "ready") {
+          if (timer !== void 0) clearInterval(timer);
+          await runtime.store.load();
+          if (!stopped) onCloseRef.current();
+          return;
+        }
+        if (view.status === "failed" || view.status === "cancelled") {
+          if (timer !== void 0) clearInterval(timer);
+        }
+      } finally {
+        pending -= 1;
+      }
+    };
+    const pollNow = () => {
+      void poll();
+    };
+    pollNowRef.current = pollNow;
+    void poll();
+    timer = setInterval(() => {
+      if (pending === 0) void poll();
+    }, LOGIN_POLL_MS);
+    return () => {
+      stopped = true;
+      if (timer !== void 0) clearInterval(timer);
+    };
+  }, [attemptId, runtime]);
+  async function submitAnswer(event) {
+    event.preventDefault();
+    const prompt2 = attempt?.prompt;
+    if (prompt2 === void 0 || answering) return;
+    const value = answer.trim();
+    if (value.length === 0) return;
+    setAnswering(true);
+    setError(null);
+    const result = await runtime.store.answerAccountPrompt(attemptId, value);
+    setAnswering(false);
+    if (!result.ok) {
+      setError(result.error);
+      return;
+    }
+    setAnswer("");
+    pollNowRef.current?.();
+  }
+  const lastNotice = attempt !== null && attempt.notices.length > 0 ? attempt.notices[attempt.notices.length - 1] : null;
+  const safeUrl = attempt !== null ? attempt.notices.map((notice) => safeNoticeUrl(notice.url)).reverse().find((url) => url !== null) ?? null : null;
+  const answerable = prompt !== void 0 && !answering && answer.trim().length > 0;
+  let body;
+  if (pollError !== null) {
+    body = h(Notice, { tone: "error", icon: "warning", title: t("loginFailed") }, pollError);
+  } else if (flowEnded) {
+    body = h(Notice, { tone: "warn", icon: "warning" }, t("loginFlowEnded"));
+  } else if (attempt === null || attempt.status === "pending") {
+    body = h(
+      "div",
+      { className: "km-login-flow" },
+      h("div", { className: "km-login-pending" }, h(Icon, { name: "refresh", size: 15, className: "km-spin" }), h("span", null, t("loginPending"))),
+      lastNotice !== null ? h("div", { className: "km-login-notices" }, lastNotice.message) : null,
+      safeUrl !== null ? h(
+        "div",
+        { className: "km-login-notices" },
+        h("a", { className: "km-login-link", href: safeUrl, target: "_blank", rel: "noreferrer" }, t("loginBrowserOpen"))
+      ) : null
+    );
+  } else if (attempt.status === "ready") {
+    body = h("div", { className: "km-login-pending" }, h(Icon, { name: "check", size: 15 }), h("span", null, t("loginReady")));
+  } else if (attempt.status === "failed" || attempt.status === "cancelled") {
+    body = h(Notice, { tone: "error", icon: "warning", title: t("loginFailed") }, attempt.error ?? lastNotice?.message ?? provider.displayName);
+  } else {
+    body = h(
+      "div",
+      { className: "km-login-flow" },
+      lastNotice !== null ? h("div", { className: "km-login-notices" }, lastNotice.message) : null,
+      safeUrl !== null ? h(
+        "div",
+        { className: "km-login-notices" },
+        h("a", { className: "km-login-link", href: safeUrl, target: "_blank", rel: "noreferrer" }, t("loginBrowserOpen"))
+      ) : null,
+      prompt !== void 0 ? h(
+        "form",
+        { className: "km-login-prompt", onSubmit: submitAnswer },
+        h("div", { className: "km-login-prompt-title" }, t("loginPromptTitle")),
+        h(
+          "div",
+          { className: "km-field" },
+          h("span", { className: "km-field-label" }, prompt.message),
+          prompt.kind === "select" && prompt.options !== void 0 ? h("select", {
+            className: "km-input",
+            value: answer,
+            onChange: (event) => setAnswer(event.target.value),
+            disabled: answering,
+            autoFocus: true
+          }, prompt.options.map((option) => h("option", { key: option.id, value: option.id }, option.label))) : h("input", {
+            className: "km-input",
+            type: prompt.kind === "secret" ? "password" : "text",
+            value: answer,
+            onChange: (event) => setAnswer(event.target.value),
+            placeholder: prompt.placeholder,
+            spellCheck: false,
+            disabled: answering,
+            autoFocus: true
+          })
+        ),
+        error !== null ? h("div", { className: "km-inline-error", role: "alert" }, error) : null,
+        h(
+          "div",
+          { className: "km-form-actions" },
+          h(
+            Button,
+            { variant: "primary", type: "submit", disabled: !answerable },
+            answering ? h(Icon, { name: "refresh", size: 14, className: "km-spin" }) : h(Icon, { name: "check", size: 14 }),
+            h("span", null, answering ? t("loginPending") : t("loginPromptSubmit"))
+          )
+        )
+      ) : null
+    );
+  }
+  return h(Modal, {
+    title: t("loginTitle"),
+    onClose,
+    busy: false,
+    footer: h(Button, { onClick: onClose, disabled: answering }, t("close"))
+  }, body);
+}
 function SettingsCard() {
   const runtime = useRuntime();
   const t = useT();