dsh-keys-manager 0.2.0 → 0.2.2

package/lib/client.js

@@ -175,6 +175,12 @@ var zh = {
   accountProjected: "\u670D\u52A1\u4E2D",
   accountReauth: "\u91CD\u65B0\u8BA4\u8BC1",
   accountActivate: "\u8BBE\u4E3A\u5F53\u524D",
+  testKey: "\u6D4B\u8BD5\u8FDE\u63A5",
+  testRunning: "\u6D4B\u8BD5\u4E2D\u2026",
+  testPassed: "\u8FDE\u63A5\u6B63\u5E38 \xB7 {ms} ms",
+  testFailed: "\u8FDE\u63A5\u5931\u8D25\uFF1A{error}",
+  testTimedOut: "\u6D4B\u8BD5\u8D85\u65F6\uFF0C\u672A\u6536\u5230\u7ED3\u679C",
+  testFailedUnknown: "\u6D4B\u8BD5\u672A\u5B8C\u6210\uFF0C\u672A\u8FD4\u56DE\u539F\u56E0",
   loginTitle: "\u8D26\u6237\u767B\u5F55",
   loginPending: "\u7B49\u5F85\u6388\u6743\u2026",
   loginBrowserOpen: "\u5728\u6D4F\u89C8\u5668\u4E2D\u6253\u5F00",
@@ -185,7 +191,19 @@ var zh = {
   loginReady: "\u767B\u5F55\u6210\u529F\u3002",
   deleteAccountTitle: "\u5220\u9664\u8D26\u6237\u201C{alias}\u201D\uFF1F",
   deleteAccountBody: "\u8FD9\u4F1A\u4ECE\u51ED\u8BC1\u5E93\u4E2D\u5220\u9664\u8BE5\u8D26\u6237\u4FDD\u5B58\u7684 OAuth \u6388\u6743\u3002\u5982\u679C\u5B83\u662F\u5F53\u524D\u8D26\u6237\uFF0C\u8BE5 Provider \u8DEF\u7531\u5C06\u505C\u7528\u5B83\u5E76\u56DE\u843D\u5230 API-key \u6C60\uFF1BProvider \u4ECD\u4FDD\u6301\u63A5\u7BA1\u72B6\u6001\u3002",
-  deleteAccountBodyNoKeys: "\u8FD9\u4F1A\u4ECE\u51ED\u8BC1\u5E93\u4E2D\u5220\u9664\u8BE5\u8D26\u6237\u4FDD\u5B58\u7684 OAuth \u6388\u6743\u3002\u8BE5\u8DEF\u7531\u6CA1\u6709 API-key \u6C60\uFF0C\u5220\u9664\u540E\u5C06\u505C\u6B62\u670D\u52A1\uFF0C\u76F4\u5230\u91CD\u65B0\u767B\u5F55\u8D26\u6237\u3002"
+  deleteAccountBodyNoKeys: "\u8FD9\u4F1A\u4ECE\u51ED\u8BC1\u5E93\u4E2D\u5220\u9664\u8BE5\u8D26\u6237\u4FDD\u5B58\u7684 OAuth \u6388\u6743\u3002\u8BE5\u8DEF\u7531\u6CA1\u6709 API-key \u6C60\uFF0C\u5220\u9664\u540E\u5C06\u505C\u6B62\u670D\u52A1\uFF0C\u76F4\u5230\u91CD\u65B0\u767B\u5F55\u8D26\u6237\u3002",
+  // Transport accounts (llm-omp-transports/<route>): managed beside the
+  // pi-ai pool, so the copy never promises a key-pool fallback.
+  transportAccounts: "\u4F20\u8F93\u8D26\u6237",
+  transportTag: "\u4F20\u8F93",
+  transportSignIn: "\u767B\u5F55",
+  transportExpires: "\u6709\u6548\u671F\u81F3 {time}",
+  transportStatusActive: "\u6B63\u5E38",
+  transportStatusExpired: "\u4EE4\u724C\u5DF2\u8FC7\u671F",
+  transportStatusNeedsReauth: "\u9700\u91CD\u65B0\u767B\u5F55",
+  transportStatusSignedOut: "\u672A\u767B\u5F55",
+  transportRemoveTitle: "\u79FB\u9664 {name} \u4F20\u8F93\u8D26\u6237\uFF1F",
+  transportRemoveBody: "\u8FD9\u4F1A\u4ECE\u51ED\u8BC1\u5E93\u4E2D\u5220\u9664\u8BE5\u4F20\u8F93\u8DEF\u7531\u4FDD\u5B58\u7684\u6388\u6743\uFF0C\u5E76\u53D6\u6D88\u4ECD\u5728\u8FDB\u884C\u7684\u767B\u5F55\uFF1B\u8DEF\u7531\u81EA\u8EAB\u4E0D\u4F1A\u91CD\u5EFA\u5B83\u3002\u8981\u6062\u590D\u670D\u52A1\u9700\u8981\u91CD\u65B0\u767B\u5F55\u3002"
 };
 var en = {
   nav: "Keys Manager",
@@ -323,6 +341,12 @@ var en = {
   accountProjected: "Serving provider",
   accountReauth: "Re-authenticate",
   accountActivate: "Set active",
+  testKey: "Test",
+  testRunning: "Testing\u2026",
+  testPassed: "Test passed \xB7 {ms} ms",
+  testFailed: "Test failed: {error}",
+  testTimedOut: "The test timed out without a result",
+  testFailedUnknown: "The test did not complete and reported no reason",
   loginTitle: "Account sign-in",
   loginPending: "Waiting for authorization\u2026",
   loginBrowserOpen: "Open in browser",
@@ -333,7 +357,18 @@ var en = {
   loginReady: "Signed in.",
   deleteAccountTitle: "Delete account \u201C{alias}\u201D?",
   deleteAccountBody: "This removes the account\u2019s stored OAuth grant from the credential store. If it is the active account, the provider route stops serving it and falls back to its API-key pool; the provider stays managed.",
-  deleteAccountBodyNoKeys: "This removes the account\u2019s stored OAuth grant from the credential store. This route has no API-key pool, so it stops serving requests until an account is signed in again."
+  deleteAccountBodyNoKeys: "This removes the account\u2019s stored OAuth grant from the credential store. This route has no API-key pool, so it stops serving requests until an account is signed in again.",
+  // Transport accounts — same values as locale/en.json.
+  transportAccounts: "Transport accounts",
+  transportTag: "Transport",
+  transportSignIn: "Sign in",
+  transportExpires: "Expires {time}",
+  transportStatusActive: "Active",
+  transportStatusExpired: "Token expired",
+  transportStatusNeedsReauth: "Sign in again",
+  transportStatusSignedOut: "Not signed in",
+  transportRemoveTitle: "Remove the {name} transport account?",
+  transportRemoveBody: "This removes the grant stored for this transport route from the credential store and cancels a sign-in still in progress; the route does not recreate it. Sign in again to restore service."
 };
 var LOCALE_DICTS = { zh, en };
 
@@ -584,6 +619,18 @@ function messageOf(error) {
   if (error instanceof Error && error.message.length > 0) return error.message;
   return String(error);
 }
+var TEST_KEY_DEADLINE_MS = 3e4;
+async function withDeadline(work, ms, label) {
+  let timer;
+  const deadline = new Promise((_, reject) => {
+    timer = setTimeout(() => reject(new Error(`${label} did not answer within ${ms / 1e3}s`)), ms);
+  });
+  try {
+    return await Promise.race([work, deadline]);
+  } finally {
+    if (timer !== void 0) clearTimeout(timer);
+  }
+}
 function createStore(ctx) {
   let snapshot = {
     status: "idle",
@@ -595,6 +642,10 @@ function createStore(ctx) {
   let loadSequence = 0;
   let mutationTail = Promise.resolve();
   let queuedMutations = 0;
+  let activeTests = 0;
+  let testGeneration = 0;
+  let mutationGeneration = 0;
+  let stateDropped = false;
   const listeners = /* @__PURE__ */ new Set();
   const emit = () => {
     for (const listener of [...listeners]) {
@@ -614,6 +665,7 @@ function createStore(ctx) {
     update({ busy: method, error: null });
     const run = async () => {
       ++loadSequence;
+      mutationGeneration = testGeneration;
       try {
         const result = await rpc(method, args);
         if (!result.ok) throw new Error(result.error.message);
@@ -627,6 +679,7 @@ function createStore(ctx) {
         return { ok: false, error: message };
       } finally {
         queuedMutations -= 1;
+        if (queuedMutations === 0) refreshDroppedState();
       }
     };
     const next = mutationTail.then(run, run);
@@ -635,10 +688,21 @@ function createStore(ctx) {
   };
   const stateOutcome = (value) => {
     const state = value;
+    const borrowed = activeTests > 0 || testGeneration !== mutationGeneration;
+    if (borrowed) {
+      if (queuedMutations === 1) update({ busy: null, error: null });
+      else update({ error: null });
+      stateDropped = true;
+      return { ok: true, value: state };
+    }
     if (queuedMutations === 1) update({ status: "ready", state, now: Date.now(), busy: null, error: null });
     else update({ status: "ready", state, now: Date.now(), error: null });
     return { ok: true, value: state };
   };
+  const refreshDroppedState = () => {
+    if (!stateDropped || activeTests > 0 || snapshot.busy !== null) return;
+    void store.load({ keepError: true });
+  };
   const rpcRead = async (method, args) => {
     try {
       return await rpc(method, args);
@@ -649,7 +713,14 @@ function createStore(ctx) {
   const attemptOutcome = (value) => {
     return { ok: true, value: value ?? null };
   };
-  return {
+  const testOutcome = (value) => {
+    const result = value ?? {};
+    return {
+      ok: true,
+      value: { ok: result.ok === true, latencyMs: result.latencyMs ?? 0, ...result.error === void 0 ? {} : { error: result.error } }
+    };
+  };
+  const store = {
     getSnapshot: () => snapshot,
     subscribe(listener) {
       listeners.add(listener);
@@ -658,12 +729,18 @@ function createStore(ctx) {
     async load(options = {}) {
       if (snapshot.busy !== null) return;
       const request = ++loadSequence;
+      const generation = testGeneration;
       update({ busy: "load", error: options.keepError === true ? snapshot.error : null });
       try {
         const result = await rpc("getState", {});
         if (request !== loadSequence) return;
+        if (activeTests > 0 || testGeneration !== generation) {
+          update({ busy: null });
+          return;
+        }
         if (!result.ok) throw new Error(result.error.message);
         update({ status: "ready", state: result.value, now: Date.now(), busy: null, error: null });
+        stateDropped = false;
       } catch (error) {
         if (request !== loadSequence) return;
         update({ status: snapshot.state !== null ? snapshot.status : "error", busy: null, error: messageOf(error) });
@@ -694,6 +771,36 @@ function createStore(ctx) {
     removeAccount(provider, accountId) {
       return send("removeAccount", { provider, accountId }, stateOutcome);
     },
+    async testKey(provider, keyId) {
+      activeTests += 1;
+      ++testGeneration;
+      const request = rpc("testKey", { provider, keyId });
+      let released = false;
+      const release = () => {
+        if (released) return;
+        released = true;
+        activeTests -= 1;
+        testGeneration += 1;
+        refreshDroppedState();
+      };
+      void request.then(release, release);
+      try {
+        const result = await withDeadline(request, TEST_KEY_DEADLINE_MS, "testKey");
+        if (!result.ok) throw new Error(result.error.message);
+        return testOutcome(result.value);
+      } catch (error) {
+        return { ok: false, error: messageOf(error) };
+      }
+    },
+    beginTransportLogin(route) {
+      return send("beginTransportLogin", { provider: route }, attemptOutcome);
+    },
+    activateTransportAccount(route) {
+      return send("activateTransportAccount", { provider: route }, stateOutcome);
+    },
+    removeTransportAccount(route) {
+      return send("removeTransportAccount", { provider: route }, stateOutcome);
+    },
     tick() {
       update({ now: Date.now() });
       if (snapshot.status === "ready" && snapshot.busy === null) void this.load({ keepError: true });
@@ -702,6 +809,7 @@ function createStore(ctx) {
       update({ error: null });
     }
   };
+  return store;
 }
 
 // src/client/ui.ts
@@ -791,6 +899,30 @@ function statusKey(status) {
       return "keyStatusUnmanaged";
   }
 }
+function transportStatusKey(status) {
+  switch (status) {
+    case "active":
+      return "transportStatusActive";
+    case "expired":
+      return "transportStatusExpired";
+    case "needs-reauth":
+      return "transportStatusNeedsReauth";
+    default:
+      return "transportStatusSignedOut";
+  }
+}
+function transportStatusTone(status) {
+  switch (status) {
+    case "active":
+      return "success";
+    case "expired":
+      return "warn";
+    case "needs-reauth":
+      return "error";
+    default:
+      return "idle";
+  }
+}
 function statusTone(status) {
   switch (status) {
     case "active":
@@ -836,6 +968,7 @@ function Icon({ name, size = 16, className }) {
   if (name === "warning") return h("svg", common, h("path", { d: "M12 3l9.5 17h-19L12 3zM12 9v5M12 17.2v.1" }));
   if (name === "shield") return h("svg", common, h("path", { d: "M12 3l8 3v6c0 5-3.5 8-8 9-4.5-1-8-4-8-9V6l8-3zM9 12l2 2 4-4" }));
   if (name === "user") return h("svg", common, h("circle", { cx: 12, cy: 8, r: 3.6 }), h("path", { d: "M5 20a7 7 0 0114 0" }));
+  if (name === "activity") return h("svg", common, h("path", { d: "M3 12h4l2.5-7 4 14 2.5-7h5" }));
   return h("svg", common);
 }
 function Button({ variant = "secondary", size = "normal", type = "button", disabled, onClick, children, title }) {
@@ -1039,6 +1172,35 @@ function KeyForm({ provider, onDone, autoFocus = false }) {
     )
   );
 }
+var ROW_TEST_STYLE = { gridColumn: "1 / -1", marginTop: "-2px" };
+var ROW_TEST_DEADLINE_MS = 3e4;
+async function requestRowTest(store, provider, keyId) {
+  let timer;
+  const deadline = new Promise((resolve) => {
+    timer = setTimeout(() => resolve({ kind: "failed", timedOut: true }), ROW_TEST_DEADLINE_MS);
+  });
+  const answer = store.testKey(provider, keyId).then((outcome) => {
+    if (!outcome.ok) return { kind: "failed", error: outcome.error };
+    if (outcome.value.ok) return { kind: "passed", latencyMs: outcome.value.latencyMs };
+    return { kind: "failed", ...outcome.value.error === void 0 ? {} : { error: outcome.value.error } };
+  });
+  try {
+    return await Promise.race([answer, deadline]);
+  } finally {
+    if (timer !== void 0) clearTimeout(timer);
+  }
+}
+function testLine(test, t) {
+  if (test === null) return null;
+  if (test.kind === "running") {
+    return h("div", { className: "km-key-time km-muted", role: "status", style: ROW_TEST_STYLE }, t("testRunning"));
+  }
+  if (test.kind === "passed") {
+    return h("div", { className: "km-key-time", role: "status", style: ROW_TEST_STYLE }, t("testPassed", { ms: test.latencyMs ?? 0 }));
+  }
+  const detail = test.error !== void 0 && test.error.length > 0 ? test.error : test.timedOut === true ? t("testTimedOut") : t("testFailedUnknown");
+  return h("div", { className: "km-key-time km-warn", role: "status", style: ROW_TEST_STYLE }, t("testFailed", { error: detail }));
+}
 function KeyRow({ provider, keyRecord, now }) {
   const key = keyRecord;
   const runtime = useRuntime();
@@ -1050,6 +1212,7 @@ function KeyRow({ provider, keyRecord, now }) {
   const [confirm, setConfirm] = import_react2.default.useState(false);
   const [busy, setBusy] = import_react2.default.useState(false);
   const [error, setError] = import_react2.default.useState(null);
+  const [test, setTest] = import_react2.default.useState(null);
   const rootRef = import_react2.default.useRef(null);
   import_react2.default.useEffect(() => {
     setAlias(key.alias);
@@ -1094,6 +1257,10 @@ function KeyRow({ provider, keyRecord, now }) {
     if (!result.ok) setError(result.error);
     else setConfirm(false);
   }
+  async function runTest() {
+    setTest({ kind: "running" });
+    setTest(await requestRowTest(runtime.store, provider.provider, key.id));
+  }
   const cold = key.status === "cooling" && key.cooldownUntil > now;
   const meta = key.status === "missing" ? t("keyStatusMissing") : key.totalUses > 0 ? t("uses", { n: key.totalUses }) : "";
   return h(
@@ -1169,6 +1336,16 @@ function KeyRow({ provider, keyRecord, now }) {
           setMenu(false);
           setEditing(true);
         } }, h(Icon, { name: "key", size: 15 }), t("rename")),
+        h("button", {
+          type: "button",
+          className: "km-menu-item",
+          role: "menuitem",
+          onClick: () => {
+            setMenu(false);
+            void runTest();
+          },
+          disabled: busy || test?.kind === "running"
+        }, h(Icon, { name: "activity", size: 15 }), t("testKey")),
         h("button", {
           type: "button",
           className: "km-menu-item",
@@ -1187,6 +1364,7 @@ function KeyRow({ provider, keyRecord, now }) {
       ) : null
     ),
     error !== null ? h("div", { className: "km-key-error", role: "alert" }, error) : null,
+    testLine(test, t),
     confirm ? h(Modal, {
       title: t("deleteTitle", { alias: key.alias }),
       onClose: () => setConfirm(false),
@@ -1208,6 +1386,7 @@ function AccountRow({ provider, keyRecord, now, onReauthenticate }) {
   const [confirm, setConfirm] = import_react2.default.useState(false);
   const [busy, setBusy] = import_react2.default.useState(false);
   const [error, setError] = import_react2.default.useState(null);
+  const [test, setTest] = import_react2.default.useState(null);
   const rootRef = import_react2.default.useRef(null);
   import_react2.default.useEffect(() => {
     if (!menu) return void 0;
@@ -1239,6 +1418,10 @@ function AccountRow({ provider, keyRecord, now, onReauthenticate }) {
     if (!result.ok) setError(result.error);
     else setConfirm(false);
   }
+  async function runTest() {
+    setTest({ kind: "running" });
+    setTest(await requestRowTest(runtime.store, provider.provider, key.id));
+  }
   const cold = key.status === "cooling" && key.cooldownUntil > now;
   const metaParts = [
     key.totalUses > 0 ? t("uses", { n: key.totalUses }) : null,
@@ -1313,6 +1496,16 @@ function AccountRow({ provider, keyRecord, now, onReauthenticate }) {
           // active again is a no-op, so the entry stays disabled.
           disabled: busy || key.projected === true
         }, h(Icon, { name: "check", size: 15 }), t("accountActivate")),
+        h("button", {
+          type: "button",
+          className: "km-menu-item",
+          role: "menuitem",
+          onClick: () => {
+            setMenu(false);
+            void runTest();
+          },
+          disabled: busy || test?.kind === "running"
+        }, h(Icon, { name: "activity", size: 15 }), t("testKey")),
         h("button", {
           type: "button",
           className: "km-menu-item",
@@ -1331,6 +1524,7 @@ function AccountRow({ provider, keyRecord, now, onReauthenticate }) {
       ) : null
     ),
     error !== null ? h("div", { className: "km-key-error", role: "alert" }, error) : null,
+    testLine(test, t),
     confirm ? h(Modal, {
       // SF4: account-specific copy — the grant removal consequence, not a
       // key-deletion/provider-release promise. Step 8: the key-pool
@@ -1346,6 +1540,114 @@ function AccountRow({ provider, keyRecord, now, onReauthenticate }) {
     }, h("p", { className: "km-modal-copy" }, t(provider.supported === true ? "deleteAccountBody" : "deleteAccountBodyNoKeys"))) : null
   );
 }
+function TransportAccountRow({ account }) {
+  const runtime = useRuntime();
+  const t = useT();
+  const locale = useLocaleId();
+  const [busy, setBusy] = import_react2.default.useState(false);
+  const [error, setError] = import_react2.default.useState(null);
+  const [confirm, setConfirm] = import_react2.default.useState(false);
+  const [login, setLogin] = import_react2.default.useState(null);
+  async function signIn() {
+    setBusy(true);
+    setError(null);
+    const result = await runtime.store.beginTransportLogin(account.id);
+    setBusy(false);
+    if (!result.ok) {
+      setError(result.error);
+      return;
+    }
+    if (result.value !== null) setLogin({ attemptId: result.value.id });
+  }
+  async function remove() {
+    setBusy(true);
+    setError(null);
+    const result = await runtime.store.removeTransportAccount(account.id);
+    setBusy(false);
+    if (!result.ok) setError(result.error);
+    else setConfirm(false);
+  }
+  const identity = account.email ?? account.accountId ?? account.displayName;
+  const tone = transportStatusTone(account.status);
+  return h(
+    "div",
+    { className: "km-account-row km-transport-row" },
+    h(
+      "div",
+      { className: "km-key-identity" },
+      h(
+        "div",
+        { className: "km-key-alias-line" },
+        h("span", { className: "km-account-glyph", "aria-hidden": true }, h(Icon, { name: "user", size: 13 })),
+        h("span", { className: "km-key-alias" }, identity),
+        h("span", { className: "km-tag km-tag-accent" }, t("transportTag"))
+      ),
+      // The credential scope, never the payload: the record is the account.
+      h(
+        "div",
+        { className: "km-key-sub" },
+        h("span", { className: "km-mono km-muted" }, account.scope)
+      )
+    ),
+    h(
+      "div",
+      { className: "km-key-status" },
+      h(
+        "span",
+        { className: cx("km-status", `km-status-${tone}`) },
+        h("span", { className: cx("km-dot", `km-dot-${tone}`) }),
+        h("span", null, t(transportStatusKey(account.status)))
+      )
+    ),
+    // The expiry column stays a clock, not a countdown: the route's adapter
+    // renews the grant itself, so "expired" here means "renews on next use".
+    h(
+      "div",
+      { className: "km-key-last" },
+      account.expiresAt === void 0 ? h("div", { className: "km-key-time km-muted" }, t("never")) : h("div", { className: "km-key-time" }, t("transportExpires", { time: formatClock(account.expiresAt, locale, t) }))
+    ),
+    h(
+      "div",
+      { className: "km-key-actions" },
+      h(
+        Button,
+        {
+          size: "small",
+          disabled: busy,
+          onClick: signIn,
+          title: account.active ? t("accountReauth") : t("transportSignIn")
+        },
+        busy ? h(Icon, { name: "refresh", size: 14, className: "km-spin" }) : h(Icon, { name: "refresh", size: 14 }),
+        t(account.active ? "accountReauth" : "transportSignIn")
+      ),
+      // No "Set active" entry: activation would write nothing (the stored grant
+      // already IS the route's live credential), so the host endpoint stays for
+      // API symmetry with the account surface and the row omits a no-effect
+      // control.
+      h(Button, {
+        size: "small",
+        variant: "danger",
+        disabled: busy,
+        onClick: () => setConfirm(true)
+      }, h(Icon, { name: "trash", size: 14 }), t("delete"))
+    ),
+    error !== null ? h("div", { className: "km-key-error", role: "alert" }, error) : null,
+    confirm ? h(Modal, {
+      title: t("transportRemoveTitle", { name: account.displayName }),
+      onClose: () => setConfirm(false),
+      busy,
+      footer: [
+        h(Button, { key: "cancel", onClick: () => setConfirm(false), disabled: busy }, t("cancel")),
+        h(Button, { key: "delete", variant: "danger", onClick: remove, disabled: busy }, busy ? t("deleting") : t("deleteConfirm"))
+      ]
+    }, h("p", { className: "km-modal-copy" }, t("transportRemoveBody"))) : null,
+    login !== null ? h(LoginDialog, {
+      provider: { displayName: account.displayName },
+      attemptId: login.attemptId,
+      onClose: () => setLogin(null)
+    }) : null
+  );
+}
 function ProviderCard({ provider, expanded, onToggle, now }) {
   const runtime = useRuntime();
   const t = useT();
@@ -1885,6 +2187,7 @@ function KeysManagerBody() {
     if (snapshot.status === "idle") void runtime.store.load();
   }, [runtime, snapshot.status]);
   const providers = state?.providers ?? [];
+  const transportAccounts = state?.transportAccounts ?? [];
   const normalizedQuery = query.trim().toLowerCase();
   const matches = (provider) => {
     if (normalizedQuery.length === 0) return true;
@@ -2021,6 +2324,20 @@ function KeysManagerBody() {
         h(Button, { variant: "ghost", size: "small", onClick: () => setShowAllAvailable(false) }, t("showLess"))
       ) : null
     ) : null,
+    !loading && !failed && transportAccounts.length > 0 ? h(
+      "section",
+      { className: "km-section" },
+      h(
+        "div",
+        { className: "km-section-head" },
+        h("h2", { className: "km-section-title" }, t("transportAccounts")),
+        h("span", { className: "km-section-count" }, transportAccounts.length)
+      ),
+      h("div", { className: "km-provider-list" }, transportAccounts.map((account) => h(TransportAccountRow, {
+        key: account.scope,
+        account
+      })))
+    ) : null,
     !loading && !failed ? h("section", { className: "km-section" }, h(SettingsCard)) : null,
     h(
       "footer",

package/lib/domain.d.ts

@@ -94,6 +94,13 @@ export interface ProviderRecord {
     brokerRef: string;
     /** The profile's reference before adoption, restored on release. */
     originalApiKeyEnv: string | null;
+    /**
+     * Adoption found a foreign projection serving the route, so it could not
+     * complete its one-time takeover of `originalApiKeyEnv` (PR review round 40).
+     * The debt survives a restart and is settled by the next projection-change
+     * sync; it never authorises an ordinary repair.
+     */
+    takeoverPending?: boolean;
     /** True when the profile itself was created by adding an extra provider. */
     createdProfile: boolean;
     /** True when a profile existed before adoption. */
@@ -186,6 +193,30 @@ export interface ProviderView {
     keys: KeyView[];
     warning?: string;
 }
+/** Health state a transport account row renders. */
+export type TransportAccountStatus = 'active' | 'expired' | 'needs-reauth' | 'signed-out';
+/**
+ * One `llm-omp-transports/<route>` account held beside the pi-ai pool.
+ *
+ * A transport route keeps exactly one grant record, so a row is either that
+ * record's secret-free view or the route's signed-out placeholder. It never
+ * carries the grant payload itself, and it is never part of a pi-ai
+ * projection: the transports package's own adapter resolves the record.
+ */
+export interface TransportAccountView {
+    /** Provider route the grant serves, e.g. 'cursor'. */
+    id: string;
+    /** The credential record holding the grant, e.g. 'llm-omp-transports/cursor'. */
+    scope: string;
+    displayName: string;
+    email?: string;
+    accountId?: string;
+    /** Epoch ms when the access token expires. */
+    expiresAt?: number;
+    status: TransportAccountStatus;
+    /** Derived from {@link status}: true only while it is `'active'`. */
+    active: boolean;
+}
 /** Complete manager snapshot the UI renders. */
 export interface StateView {
     now: number;
@@ -199,6 +230,22 @@ export interface StateView {
     pausedKeyCount: number;
     bindingsCount: number;
     warnings: string[];
+    /**
+     * Transport accounts managed beside the pi-ai pool. Additive and optional,
+     * so a snapshot from a build without transport support still renders.
+     */
+    transportAccounts?: TransportAccountView[];
+}
+/**
+ * Outcome of one per-row connection test: one minimal request through the
+ * provider route, with no health or selection side effects.
+ */
+export interface KeyTestResult {
+    ok: boolean;
+    /** Wall-clock time of the request that was actually sent. */
+    latencyMs: number;
+    /** Provider failure message, timeout, or the reason no request was sent. */
+    error?: string;
 }
 /** One curated extra built-in provider. */
 export interface ExtraProvider {
@@ -207,6 +254,14 @@ export interface ExtraProvider {
     api: string;
     baseURL: string;
     env: string[];
+    /**
+     * Static request headers this route needs. Maps header name → environment
+     * variable name; each value is resolved from the environment at add time.
+     * Only non-secret metadata headers are supported: values are persisted as
+     * plain profile settings, so a credential-bearing name (`authorization`,
+     * `proxy-authorization`, `cookie`, `x-api-key`, `*-api-key`) is refused.
+     */
+    headerEnv?: Record<string, string>;
     models: ModelRecord[];
 }
 /** Serializable notice captured on an interactive sign-in attempt. */

package/lib/host-types.d.ts

@@ -46,6 +46,18 @@ export interface LlmRuntimeLike {
         name: string;
     }>;
     discoverModels(settingsNs: string, request: DiscoveryRequest, signal: AbortSignal): Promise<DiscoveredModel[]>;
+    /**
+     * One model request through the provider route. The host runs the
+     * `llm/stream` waterfall, so the manager's own stream listener — and the
+     * broker credential wrapper — observe it exactly like a chat request.
+     */
+    stream(options: {
+        provider: string;
+        model: string;
+        messages: readonly unknown[];
+        maxTokens?: number;
+        signal?: AbortSignal;
+    }): AsyncIterable<StreamChunkLike>;
 }
 /** Credential value/source facts returned by the credential seam. */
 export interface CredentialHit {
@@ -126,6 +138,23 @@ export interface CredentialRecordsLike {
     modifyRecord(key: string, mutate: (current: CredentialRecordLike | undefined) => Promise<CredentialRecordLike | undefined>): Promise<CredentialRecordLike | undefined>;
     deleteRecord(key: string): Promise<void>;
 }
+/**
+ * The grant payload the llm-omp transports package writes at
+ * `llm-omp-transports/<route>`. Keys Manager only reads it (list/status) and
+ * deletes the whole record; the payload stays owned by its writer, so this is
+ * a structural shape (the package exports no runtime type for it without
+ * pulling its transport code in).
+ */
+export interface TransportGrantLike {
+    /** Bearer token the route's adapter sends. */
+    access: string;
+    /** Refresh token; absent on a grant that cannot be renewed. */
+    refresh?: string;
+    /** Epoch ms when the access token expires. */
+    expires: number;
+    email?: string;
+    accountId?: string;
+}
 /** One path-addressed settings edit. */
 export type SettingsPathOp = {
     op: 'set';