dsh-keys-manager 0.2.1 → 0.2.3

package/lib/client.js

@@ -44,9 +44,20 @@ var zh = {
   title: "\u5BC6\u94A5\u7BA1\u7406",
   subtitle: "\u4E3A\u540C\u4E00\u4E2A Provider \u914D\u7F6E\u591A\u4E2A API Key\u3002\u5355\u4F1A\u8BDD\u56FA\u5B9A\u4F7F\u7528\u4E00\u4E2A Key\uFF0C\u65B0\u4F1A\u8BDD\u8F6E\u6362\uFF1B\u5931\u8D25\u540E\u81EA\u52A8\u51B7\u5374\u5E76\u6062\u590D\u3002",
   search: "\u641C\u7D22 Provider\uFF08\u540D\u79F0\u3001ID \u6216\u73AF\u5883\u53D8\u91CF\uFF09",
+  filterAll: "\u5168\u90E8",
+  filterBuiltin: "\u5185\u7F6E",
+  filterPlugin: "\u63D2\u4EF6",
+  filterOauth: "\u652F\u6301 OAuth",
+  filterTransport: "\u4F20\u8F93",
+  filterGroup: "\u7B5B\u9009",
+  // Unattributed requests (I-000120, D8): the compass's fixed copy, shared
+  // with the filter plan's dictionary task — one pair, never a second.
+  unattributed: "{n} \u65E0\u5F52\u5C5E",
+  unattributedHint: "\u8BE5\u8DEF\u7531\u5728\u5F52\u5C5E\u8BFB\u53D6\u5C1A\u672A\u843D\u5730\uFF08\u6216\u5DF2\u5931\u8D25\uFF09\u671F\u95F4\u5E94\u7B54\u7684\u6D41\u5C1D\u8BD5\u6570\uFF1B\u5931\u8D25\u8F6C\u79FB\u91CD\u8BD5\u4F1A\u5404\u8BA1\u4E00\u6B21\uFF0C\u6545\u5355\u4E2A\u8BF7\u6C42\u53EF\u80FD\u88AB\u8BA1\u591A\u6B21\u3002\u8BFB\u53D6\u5B8C\u6210\u5F52\u5C5E\u540E\u6E05\u96F6\u3002",
   managed: "\u5DF2\u63A5\u7BA1",
   available: "\u53EF\u6DFB\u52A0 Providers",
   managedEmpty: "\u8FD8\u6CA1\u6709\u63A5\u7BA1\u7684 Provider\u3002\u4ECE\u4E0B\u65B9\u9009\u62E9\u4E00\u4E2A\u5F00\u59CB\u3002",
+  managedFilteredEmpty: "\u5F53\u524D\u7B5B\u9009\u4E0B\u6CA1\u6709\u5DF2\u63A5\u7BA1\u7684 Provider\u3002",
   availableEmpty: "\u6CA1\u6709\u5339\u914D\u7684 Provider\u3002",
   keys: "\u5BC6\u94A5",
   healthy: "\u53EF\u7528",
@@ -175,6 +186,12 @@ var zh = {
   accountProjected: "\u670D\u52A1\u4E2D",
   accountReauth: "\u91CD\u65B0\u8BA4\u8BC1",
   accountActivate: "\u8BBE\u4E3A\u5F53\u524D",
+  testKey: "\u6D4B\u8BD5\u8FDE\u63A5",
+  testRunning: "\u6D4B\u8BD5\u4E2D\u2026",
+  testPassed: "\u8FDE\u63A5\u6B63\u5E38 \xB7 {ms} ms",
+  testFailed: "\u8FDE\u63A5\u5931\u8D25\uFF1A{error}",
+  testTimedOut: "\u6D4B\u8BD5\u8D85\u65F6\uFF0C\u672A\u6536\u5230\u7ED3\u679C",
+  testFailedUnknown: "\u6D4B\u8BD5\u672A\u5B8C\u6210\uFF0C\u672A\u8FD4\u56DE\u539F\u56E0",
   loginTitle: "\u8D26\u6237\u767B\u5F55",
   loginPending: "\u7B49\u5F85\u6388\u6743\u2026",
   loginBrowserOpen: "\u5728\u6D4F\u89C8\u5668\u4E2D\u6253\u5F00",
@@ -185,16 +202,38 @@ var zh = {
   loginReady: "\u767B\u5F55\u6210\u529F\u3002",
   deleteAccountTitle: "\u5220\u9664\u8D26\u6237\u201C{alias}\u201D\uFF1F",
   deleteAccountBody: "\u8FD9\u4F1A\u4ECE\u51ED\u8BC1\u5E93\u4E2D\u5220\u9664\u8BE5\u8D26\u6237\u4FDD\u5B58\u7684 OAuth \u6388\u6743\u3002\u5982\u679C\u5B83\u662F\u5F53\u524D\u8D26\u6237\uFF0C\u8BE5 Provider \u8DEF\u7531\u5C06\u505C\u7528\u5B83\u5E76\u56DE\u843D\u5230 API-key \u6C60\uFF1BProvider \u4ECD\u4FDD\u6301\u63A5\u7BA1\u72B6\u6001\u3002",
-  deleteAccountBodyNoKeys: "\u8FD9\u4F1A\u4ECE\u51ED\u8BC1\u5E93\u4E2D\u5220\u9664\u8BE5\u8D26\u6237\u4FDD\u5B58\u7684 OAuth \u6388\u6743\u3002\u8BE5\u8DEF\u7531\u6CA1\u6709 API-key \u6C60\uFF0C\u5220\u9664\u540E\u5C06\u505C\u6B62\u670D\u52A1\uFF0C\u76F4\u5230\u91CD\u65B0\u767B\u5F55\u8D26\u6237\u3002"
+  deleteAccountBodyNoKeys: "\u8FD9\u4F1A\u4ECE\u51ED\u8BC1\u5E93\u4E2D\u5220\u9664\u8BE5\u8D26\u6237\u4FDD\u5B58\u7684 OAuth \u6388\u6743\u3002\u8BE5\u8DEF\u7531\u6CA1\u6709 API-key \u6C60\uFF0C\u5220\u9664\u540E\u5C06\u505C\u6B62\u670D\u52A1\uFF0C\u76F4\u5230\u91CD\u65B0\u767B\u5F55\u8D26\u6237\u3002",
+  // Transport accounts (llm-omp-transports/<route>): managed beside the
+  // pi-ai pool, so the copy never promises a key-pool fallback.
+  transportEmpty: "\u8FD8\u6CA1\u6709\u4F20\u8F93\u8D26\u6237\u3002",
+  transportProviderHint: "\u8BE5\u8DEF\u7531\u7531\u4F20\u8F93\u63D2\u4EF6\u63D0\u4F9B\uFF0C\u51ED\u8BC1\u5C31\u5728\u672C\u5361\u7247\u4E2D\u7BA1\u7406\u3002",
+  transportTag: "\u4F20\u8F93",
+  transportSignIn: "\u767B\u5F55",
+  transportExpires: "\u6709\u6548\u671F\u81F3 {time}",
+  transportStatusActive: "\u6B63\u5E38",
+  transportStatusExpired: "\u4EE4\u724C\u5DF2\u8FC7\u671F",
+  transportStatusNeedsReauth: "\u9700\u91CD\u65B0\u767B\u5F55",
+  transportStatusSignedOut: "\u672A\u767B\u5F55",
+  transportRemoveTitle: "\u79FB\u9664 {name} \u4F20\u8F93\u8D26\u6237\uFF1F",
+  transportRemoveBody: "\u8FD9\u4F1A\u4ECE\u51ED\u8BC1\u5E93\u4E2D\u5220\u9664\u8BE5\u4F20\u8F93\u8DEF\u7531\u4FDD\u5B58\u7684\u6388\u6743\uFF0C\u5E76\u53D6\u6D88\u4ECD\u5728\u8FDB\u884C\u7684\u767B\u5F55\uFF1B\u8DEF\u7531\u81EA\u8EAB\u4E0D\u4F1A\u91CD\u5EFA\u5B83\u3002\u8981\u6062\u590D\u670D\u52A1\u9700\u8981\u91CD\u65B0\u767B\u5F55\u3002"
 };
 var en = {
   nav: "Keys Manager",
   title: "Keys Manager",
   subtitle: "Give one provider several API keys. A session keeps one key; new sessions rotate; failures cool down and recover automatically.",
   search: "Search providers by name, id, or environment variable",
+  filterAll: "All",
+  filterBuiltin: "Built-in",
+  filterPlugin: "Plugin",
+  filterOauth: "OAuth-capable",
+  filterTransport: "Transport",
+  filterGroup: "Filters",
+  unattributed: "{n} unattributed",
+  unattributedHint: "Stream attempts this route served with no account owner because its ownership read had not landed (or had failed). A failover retry is a new attempt, so one request can be counted more than once. The count clears when a read attributes the route.",
   managed: "Managed",
   available: "Available providers",
   managedEmpty: "No managed providers yet. Adopt one below to start.",
+  managedFilteredEmpty: "No managed providers match the current filter.",
   availableEmpty: "No matching providers.",
   keys: "keys",
   healthy: "healthy",
@@ -323,6 +362,12 @@ var en = {
   accountProjected: "Serving provider",
   accountReauth: "Re-authenticate",
   accountActivate: "Set active",
+  testKey: "Test",
+  testRunning: "Testing\u2026",
+  testPassed: "Test passed \xB7 {ms} ms",
+  testFailed: "Test failed: {error}",
+  testTimedOut: "The test timed out without a result",
+  testFailedUnknown: "The test did not complete and reported no reason",
   loginTitle: "Account sign-in",
   loginPending: "Waiting for authorization\u2026",
   loginBrowserOpen: "Open in browser",
@@ -333,7 +378,19 @@ var en = {
   loginReady: "Signed in.",
   deleteAccountTitle: "Delete account \u201C{alias}\u201D?",
   deleteAccountBody: "This removes the account\u2019s stored OAuth grant from the credential store. If it is the active account, the provider route stops serving it and falls back to its API-key pool; the provider stays managed.",
-  deleteAccountBodyNoKeys: "This removes the account\u2019s stored OAuth grant from the credential store. This route has no API-key pool, so it stops serving requests until an account is signed in again."
+  deleteAccountBodyNoKeys: "This removes the account\u2019s stored OAuth grant from the credential store. This route has no API-key pool, so it stops serving requests until an account is signed in again.",
+  // Transport accounts — same values as locale/en.json.
+  transportEmpty: "No transport accounts yet.",
+  transportProviderHint: "Served by a transport plugin: its credential is managed inside this card.",
+  transportTag: "Transport",
+  transportSignIn: "Sign in",
+  transportExpires: "Expires {time}",
+  transportStatusActive: "Active",
+  transportStatusExpired: "Token expired",
+  transportStatusNeedsReauth: "Sign in again",
+  transportStatusSignedOut: "Not signed in",
+  transportRemoveTitle: "Remove the {name} transport account?",
+  transportRemoveBody: "This removes the grant stored for this transport route from the credential store and cancels a sign-in still in progress; the route does not recreate it. Sign in again to restore service."
 };
 var LOCALE_DICTS = { zh, en };
 
@@ -351,6 +408,13 @@ var CSS = `
 .km-stat{display:flex;flex-direction:column;gap:2px;padding:11px 14px;border:1px solid var(--dsw-alias-border-l1);border-radius:10px;background:var(--dsw-alias-bg-layer-1)}
 .km-stat strong{font-size:19px;line-height:1.15;font-weight:650;font-variant-numeric:tabular-nums}
 .km-stat span{color:var(--dsw-alias-label-secondary);font-size:12px}
+.km-filters{display:flex;flex-wrap:wrap;gap:8px;margin:0 0 12px}
+.km-chip{display:inline-flex;align-items:center;gap:6px;padding:5px 11px;border:1px solid var(--dsw-alias-border-l1);border-radius:999px;background:var(--dsw-alias-bg-layer-1);color:var(--dsw-alias-label-secondary);font:inherit;font-size:12.5px;cursor:pointer}
+.km-chip:hover{background:var(--dsw-alias-bg-layer-2);color:var(--dsw-alias-label-primary)}
+.km-chip:focus-visible{border-color:var(--dsw-alias-state-business-primary);box-shadow:0 0 0 2px color-mix(in srgb,var(--dsw-alias-state-business-primary) 20%,transparent)}
+.km-chip-on{border-color:color-mix(in srgb,var(--dsw-alias-state-business-primary) 55%,var(--dsw-alias-border-l1));background:color-mix(in srgb,var(--dsw-alias-state-business-primary) 12%,var(--dsw-alias-bg-layer-1));color:var(--dsw-alias-label-primary)}
+.km-chip-count{font-size:11.5px;color:var(--dsw-alias-label-secondary);font-variant-numeric:tabular-nums}
+.km-chip-on .km-chip-count{color:inherit}
 .km-search{position:relative;display:flex;align-items:center;margin:0 0 20px}
 .km-search-icon{position:absolute;left:12px;color:var(--dsw-alias-label-secondary);pointer-events:none}
 .km-search-input{width:100%;box-sizing:border-box;padding:10px 38px 10px 36px;border:1px solid var(--dsw-alias-border-l1);border-radius:10px;background:var(--dsw-alias-bg-layer-1);color:var(--dsw-alias-label-primary);font:inherit;outline:none}
@@ -584,6 +648,18 @@ function messageOf(error) {
   if (error instanceof Error && error.message.length > 0) return error.message;
   return String(error);
 }
+var TEST_KEY_DEADLINE_MS = 3e4;
+async function withDeadline(work, ms, label) {
+  let timer;
+  const deadline = new Promise((_, reject) => {
+    timer = setTimeout(() => reject(new Error(`${label} did not answer within ${ms / 1e3}s`)), ms);
+  });
+  try {
+    return await Promise.race([work, deadline]);
+  } finally {
+    if (timer !== void 0) clearTimeout(timer);
+  }
+}
 function createStore(ctx) {
   let snapshot = {
     status: "idle",
@@ -595,6 +671,10 @@ function createStore(ctx) {
   let loadSequence = 0;
   let mutationTail = Promise.resolve();
   let queuedMutations = 0;
+  let activeTests = 0;
+  let testGeneration = 0;
+  let mutationGeneration = 0;
+  let stateDropped = false;
   const listeners = /* @__PURE__ */ new Set();
   const emit = () => {
     for (const listener of [...listeners]) {
@@ -614,6 +694,7 @@ function createStore(ctx) {
     update({ busy: method, error: null });
     const run = async () => {
       ++loadSequence;
+      mutationGeneration = testGeneration;
       try {
         const result = await rpc(method, args);
         if (!result.ok) throw new Error(result.error.message);
@@ -627,6 +708,7 @@ function createStore(ctx) {
         return { ok: false, error: message };
       } finally {
         queuedMutations -= 1;
+        if (queuedMutations === 0) refreshDroppedState();
       }
     };
     const next = mutationTail.then(run, run);
@@ -635,10 +717,21 @@ function createStore(ctx) {
   };
   const stateOutcome = (value) => {
     const state = value;
+    const borrowed = activeTests > 0 || testGeneration !== mutationGeneration;
+    if (borrowed) {
+      if (queuedMutations === 1) update({ busy: null, error: null });
+      else update({ error: null });
+      stateDropped = true;
+      return { ok: true, value: state };
+    }
     if (queuedMutations === 1) update({ status: "ready", state, now: Date.now(), busy: null, error: null });
     else update({ status: "ready", state, now: Date.now(), error: null });
     return { ok: true, value: state };
   };
+  const refreshDroppedState = () => {
+    if (!stateDropped || activeTests > 0 || snapshot.busy !== null) return;
+    void store.load({ keepError: true });
+  };
   const rpcRead = async (method, args) => {
     try {
       return await rpc(method, args);
@@ -649,7 +742,14 @@ function createStore(ctx) {
   const attemptOutcome = (value) => {
     return { ok: true, value: value ?? null };
   };
-  return {
+  const testOutcome = (value) => {
+    const result = value ?? {};
+    return {
+      ok: true,
+      value: { ok: result.ok === true, latencyMs: result.latencyMs ?? 0, ...result.error === void 0 ? {} : { error: result.error } }
+    };
+  };
+  const store = {
     getSnapshot: () => snapshot,
     subscribe(listener) {
       listeners.add(listener);
@@ -658,12 +758,18 @@ function createStore(ctx) {
     async load(options = {}) {
       if (snapshot.busy !== null) return;
       const request = ++loadSequence;
+      const generation = testGeneration;
       update({ busy: "load", error: options.keepError === true ? snapshot.error : null });
       try {
         const result = await rpc("getState", {});
         if (request !== loadSequence) return;
+        if (activeTests > 0 || testGeneration !== generation) {
+          update({ busy: null });
+          return;
+        }
         if (!result.ok) throw new Error(result.error.message);
         update({ status: "ready", state: result.value, now: Date.now(), busy: null, error: null });
+        stateDropped = false;
       } catch (error) {
         if (request !== loadSequence) return;
         update({ status: snapshot.state !== null ? snapshot.status : "error", busy: null, error: messageOf(error) });
@@ -694,6 +800,36 @@ function createStore(ctx) {
     removeAccount(provider, accountId) {
       return send("removeAccount", { provider, accountId }, stateOutcome);
     },
+    async testKey(provider, keyId) {
+      activeTests += 1;
+      ++testGeneration;
+      const request = rpc("testKey", { provider, keyId });
+      let released = false;
+      const release = () => {
+        if (released) return;
+        released = true;
+        activeTests -= 1;
+        testGeneration += 1;
+        refreshDroppedState();
+      };
+      void request.then(release, release);
+      try {
+        const result = await withDeadline(request, TEST_KEY_DEADLINE_MS, "testKey");
+        if (!result.ok) throw new Error(result.error.message);
+        return testOutcome(result.value);
+      } catch (error) {
+        return { ok: false, error: messageOf(error) };
+      }
+    },
+    beginTransportLogin(route) {
+      return send("beginTransportLogin", { provider: route }, attemptOutcome);
+    },
+    activateTransportAccount(route) {
+      return send("activateTransportAccount", { provider: route }, stateOutcome);
+    },
+    removeTransportAccount(route) {
+      return send("removeTransportAccount", { provider: route }, stateOutcome);
+    },
     tick() {
       update({ now: Date.now() });
       if (snapshot.status === "ready" && snapshot.busy === null) void this.load({ keepError: true });
@@ -702,6 +838,7 @@ function createStore(ctx) {
       update({ error: null });
     }
   };
+  return store;
 }
 
 // src/client/ui.ts
@@ -765,6 +902,37 @@ function providerInitial(provider) {
 function oauthCapable(provider) {
   return provider.nativeAuth?.oauth === true && provider.accountSupported !== false;
 }
+function originOf(provider) {
+  return provider.origin ?? (provider.extra ? "plugin" : "dsh");
+}
+var FILTER_CHIPS = [
+  { value: "all", label: "filterAll" },
+  { value: "builtin", label: "filterBuiltin" },
+  { value: "plugin", label: "filterPlugin" },
+  { value: "oauth", label: "filterOauth" },
+  { value: "transport", label: "filterTransport" }
+];
+function matchesFilter(provider, filter) {
+  switch (filter) {
+    case "transport":
+      return provider.transport === true;
+    case "builtin":
+      return provider.transport !== true && originOf(provider) === "dsh";
+    case "plugin":
+      return provider.transport !== true && originOf(provider) === "plugin";
+    case "oauth":
+      return provider.transport !== true && oauthCapable(provider);
+    default:
+      return true;
+  }
+}
+function orphanTransportAccounts(providers, transportAccounts) {
+  return transportAccounts.filter((account) => !providers.some((provider) => provider.transport === true && provider.provider === account.id));
+}
+function managedEntryCount(providers, transportAccounts) {
+  const cards = providers.filter((provider) => provider.managed || provider.transport === true).length;
+  return cards + orphanTransportAccounts(providers, transportAccounts).length;
+}
 function accountIdentityOf(key, provider) {
   const oauth = key.oauth;
   if (oauth !== null && oauth !== void 0) {
@@ -791,6 +959,30 @@ function statusKey(status) {
       return "keyStatusUnmanaged";
   }
 }
+function transportStatusKey(status) {
+  switch (status) {
+    case "active":
+      return "transportStatusActive";
+    case "expired":
+      return "transportStatusExpired";
+    case "needs-reauth":
+      return "transportStatusNeedsReauth";
+    default:
+      return "transportStatusSignedOut";
+  }
+}
+function transportStatusTone(status) {
+  switch (status) {
+    case "active":
+      return "success";
+    case "expired":
+      return "warn";
+    case "needs-reauth":
+      return "error";
+    default:
+      return "idle";
+  }
+}
 function statusTone(status) {
   switch (status) {
     case "active":
@@ -836,6 +1028,7 @@ function Icon({ name, size = 16, className }) {
   if (name === "warning") return h("svg", common, h("path", { d: "M12 3l9.5 17h-19L12 3zM12 9v5M12 17.2v.1" }));
   if (name === "shield") return h("svg", common, h("path", { d: "M12 3l8 3v6c0 5-3.5 8-8 9-4.5-1-8-4-8-9V6l8-3zM9 12l2 2 4-4" }));
   if (name === "user") return h("svg", common, h("circle", { cx: 12, cy: 8, r: 3.6 }), h("path", { d: "M5 20a7 7 0 0114 0" }));
+  if (name === "activity") return h("svg", common, h("path", { d: "M3 12h4l2.5-7 4 14 2.5-7h5" }));
   return h("svg", common);
 }
 function Button({ variant = "secondary", size = "normal", type = "button", disabled, onClick, children, title }) {
@@ -1039,6 +1232,35 @@ function KeyForm({ provider, onDone, autoFocus = false }) {
     )
   );
 }
+var ROW_TEST_STYLE = { gridColumn: "1 / -1", marginTop: "-2px" };
+var ROW_TEST_DEADLINE_MS = 3e4;
+async function requestRowTest(store, provider, keyId) {
+  let timer;
+  const deadline = new Promise((resolve) => {
+    timer = setTimeout(() => resolve({ kind: "failed", timedOut: true }), ROW_TEST_DEADLINE_MS);
+  });
+  const answer = store.testKey(provider, keyId).then((outcome) => {
+    if (!outcome.ok) return { kind: "failed", error: outcome.error };
+    if (outcome.value.ok) return { kind: "passed", latencyMs: outcome.value.latencyMs };
+    return { kind: "failed", ...outcome.value.error === void 0 ? {} : { error: outcome.value.error } };
+  });
+  try {
+    return await Promise.race([answer, deadline]);
+  } finally {
+    if (timer !== void 0) clearTimeout(timer);
+  }
+}
+function testLine(test, t) {
+  if (test === null) return null;
+  if (test.kind === "running") {
+    return h("div", { className: "km-key-time km-muted", role: "status", style: ROW_TEST_STYLE }, t("testRunning"));
+  }
+  if (test.kind === "passed") {
+    return h("div", { className: "km-key-time", role: "status", style: ROW_TEST_STYLE }, t("testPassed", { ms: test.latencyMs ?? 0 }));
+  }
+  const detail = test.error !== void 0 && test.error.length > 0 ? test.error : test.timedOut === true ? t("testTimedOut") : t("testFailedUnknown");
+  return h("div", { className: "km-key-time km-warn", role: "status", style: ROW_TEST_STYLE }, t("testFailed", { error: detail }));
+}
 function KeyRow({ provider, keyRecord, now }) {
   const key = keyRecord;
   const runtime = useRuntime();
@@ -1050,6 +1272,7 @@ function KeyRow({ provider, keyRecord, now }) {
   const [confirm, setConfirm] = import_react2.default.useState(false);
   const [busy, setBusy] = import_react2.default.useState(false);
   const [error, setError] = import_react2.default.useState(null);
+  const [test, setTest] = import_react2.default.useState(null);
   const rootRef = import_react2.default.useRef(null);
   import_react2.default.useEffect(() => {
     setAlias(key.alias);
@@ -1094,6 +1317,10 @@ function KeyRow({ provider, keyRecord, now }) {
     if (!result.ok) setError(result.error);
     else setConfirm(false);
   }
+  async function runTest() {
+    setTest({ kind: "running" });
+    setTest(await requestRowTest(runtime.store, provider.provider, key.id));
+  }
   const cold = key.status === "cooling" && key.cooldownUntil > now;
   const meta = key.status === "missing" ? t("keyStatusMissing") : key.totalUses > 0 ? t("uses", { n: key.totalUses }) : "";
   return h(
@@ -1169,6 +1396,16 @@ function KeyRow({ provider, keyRecord, now }) {
           setMenu(false);
           setEditing(true);
         } }, h(Icon, { name: "key", size: 15 }), t("rename")),
+        h("button", {
+          type: "button",
+          className: "km-menu-item",
+          role: "menuitem",
+          onClick: () => {
+            setMenu(false);
+            void runTest();
+          },
+          disabled: busy || test?.kind === "running"
+        }, h(Icon, { name: "activity", size: 15 }), t("testKey")),
         h("button", {
           type: "button",
           className: "km-menu-item",
@@ -1187,6 +1424,7 @@ function KeyRow({ provider, keyRecord, now }) {
       ) : null
     ),
     error !== null ? h("div", { className: "km-key-error", role: "alert" }, error) : null,
+    testLine(test, t),
     confirm ? h(Modal, {
       title: t("deleteTitle", { alias: key.alias }),
       onClose: () => setConfirm(false),
@@ -1208,6 +1446,7 @@ function AccountRow({ provider, keyRecord, now, onReauthenticate }) {
   const [confirm, setConfirm] = import_react2.default.useState(false);
   const [busy, setBusy] = import_react2.default.useState(false);
   const [error, setError] = import_react2.default.useState(null);
+  const [test, setTest] = import_react2.default.useState(null);
   const rootRef = import_react2.default.useRef(null);
   import_react2.default.useEffect(() => {
     if (!menu) return void 0;
@@ -1239,6 +1478,10 @@ function AccountRow({ provider, keyRecord, now, onReauthenticate }) {
     if (!result.ok) setError(result.error);
     else setConfirm(false);
   }
+  async function runTest() {
+    setTest({ kind: "running" });
+    setTest(await requestRowTest(runtime.store, provider.provider, key.id));
+  }
   const cold = key.status === "cooling" && key.cooldownUntil > now;
   const metaParts = [
     key.totalUses > 0 ? t("uses", { n: key.totalUses }) : null,
@@ -1313,6 +1556,16 @@ function AccountRow({ provider, keyRecord, now, onReauthenticate }) {
           // active again is a no-op, so the entry stays disabled.
           disabled: busy || key.projected === true
         }, h(Icon, { name: "check", size: 15 }), t("accountActivate")),
+        h("button", {
+          type: "button",
+          className: "km-menu-item",
+          role: "menuitem",
+          onClick: () => {
+            setMenu(false);
+            void runTest();
+          },
+          disabled: busy || test?.kind === "running"
+        }, h(Icon, { name: "activity", size: 15 }), t("testKey")),
         h("button", {
           type: "button",
           className: "km-menu-item",
@@ -1331,6 +1584,7 @@ function AccountRow({ provider, keyRecord, now, onReauthenticate }) {
       ) : null
     ),
     error !== null ? h("div", { className: "km-key-error", role: "alert" }, error) : null,
+    testLine(test, t),
     confirm ? h(Modal, {
       // SF4: account-specific copy — the grant removal consequence, not a
       // key-deletion/provider-release promise. Step 8: the key-pool
@@ -1346,7 +1600,115 @@ function AccountRow({ provider, keyRecord, now, onReauthenticate }) {
     }, h("p", { className: "km-modal-copy" }, t(provider.supported === true ? "deleteAccountBody" : "deleteAccountBodyNoKeys"))) : null
   );
 }
-function ProviderCard({ provider, expanded, onToggle, now }) {
+function TransportAccountRow({ account }) {
+  const runtime = useRuntime();
+  const t = useT();
+  const locale = useLocaleId();
+  const [busy, setBusy] = import_react2.default.useState(false);
+  const [error, setError] = import_react2.default.useState(null);
+  const [confirm, setConfirm] = import_react2.default.useState(false);
+  const [login, setLogin] = import_react2.default.useState(null);
+  async function signIn() {
+    setBusy(true);
+    setError(null);
+    const result = await runtime.store.beginTransportLogin(account.id);
+    setBusy(false);
+    if (!result.ok) {
+      setError(result.error);
+      return;
+    }
+    if (result.value !== null) setLogin({ attemptId: result.value.id });
+  }
+  async function remove() {
+    setBusy(true);
+    setError(null);
+    const result = await runtime.store.removeTransportAccount(account.id);
+    setBusy(false);
+    if (!result.ok) setError(result.error);
+    else setConfirm(false);
+  }
+  const identity = account.email ?? account.accountId ?? account.displayName;
+  const tone = transportStatusTone(account.status);
+  return h(
+    "div",
+    { className: "km-account-row km-transport-row" },
+    h(
+      "div",
+      { className: "km-key-identity" },
+      h(
+        "div",
+        { className: "km-key-alias-line" },
+        h("span", { className: "km-account-glyph", "aria-hidden": true }, h(Icon, { name: "user", size: 13 })),
+        h("span", { className: "km-key-alias" }, identity),
+        h("span", { className: "km-tag km-tag-accent" }, t("transportTag"))
+      ),
+      // The credential scope, never the payload: the record is the account.
+      h(
+        "div",
+        { className: "km-key-sub" },
+        h("span", { className: "km-mono km-muted" }, account.scope)
+      )
+    ),
+    h(
+      "div",
+      { className: "km-key-status" },
+      h(
+        "span",
+        { className: cx("km-status", `km-status-${tone}`) },
+        h("span", { className: cx("km-dot", `km-dot-${tone}`) }),
+        h("span", null, t(transportStatusKey(account.status)))
+      )
+    ),
+    // The expiry column stays a clock, not a countdown: the route's adapter
+    // renews the grant itself, so "expired" here means "renews on next use".
+    h(
+      "div",
+      { className: "km-key-last" },
+      account.expiresAt === void 0 ? h("div", { className: "km-key-time km-muted" }, t("never")) : h("div", { className: "km-key-time" }, t("transportExpires", { time: formatClock(account.expiresAt, locale, t) }))
+    ),
+    h(
+      "div",
+      { className: "km-key-actions" },
+      h(
+        Button,
+        {
+          size: "small",
+          disabled: busy,
+          onClick: signIn,
+          title: account.active ? t("accountReauth") : t("transportSignIn")
+        },
+        busy ? h(Icon, { name: "refresh", size: 14, className: "km-spin" }) : h(Icon, { name: "refresh", size: 14 }),
+        t(account.active ? "accountReauth" : "transportSignIn")
+      ),
+      // No "Set active" entry: activation would write nothing (the stored grant
+      // already IS the route's live credential), so the host endpoint stays for
+      // API symmetry with the account surface and the row omits a no-effect
+      // control.
+      h(Button, {
+        size: "small",
+        variant: "danger",
+        disabled: busy,
+        onClick: () => setConfirm(true)
+      }, h(Icon, { name: "trash", size: 14 }), t("delete"))
+    ),
+    error !== null ? h("div", { className: "km-key-error", role: "alert" }, error) : null,
+    confirm ? h(Modal, {
+      title: t("transportRemoveTitle", { name: account.displayName }),
+      onClose: () => setConfirm(false),
+      busy,
+      footer: [
+        h(Button, { key: "cancel", onClick: () => setConfirm(false), disabled: busy }, t("cancel")),
+        h(Button, { key: "delete", variant: "danger", onClick: remove, disabled: busy }, busy ? t("deleting") : t("deleteConfirm"))
+      ]
+    }, h("p", { className: "km-modal-copy" }, t("transportRemoveBody"))) : null,
+    login !== null ? h(LoginDialog, {
+      provider: { displayName: account.displayName },
+      attemptId: login.attemptId,
+      onClose: () => setLogin(null)
+    }) : null
+  );
+}
+function ProviderCard({ provider, expanded, onToggle, now, transportAccount }) {
   const runtime = useRuntime();
   const t = useT();
   const [adding, setAdding] = import_react2.default.useState(false);
@@ -1361,11 +1723,15 @@ function ProviderCard({ provider, expanded, onToggle, now }) {
   const keyCount = provider.keyCount;
   const warning = provider.warning;
   const isExtra = provider.extra;
-  const origin = provider.origin ?? (provider.extra ? "plugin" : "dsh");
-  const originLabel = origin === "plugin" ? t("pluginBuiltin") : origin === "dsh" ? t("dshBuiltin") : t("customProvider");
+  const transport = provider.transport === true;
+  const origin = originOf(provider);
+  const originLabel = transport || origin === "plugin" ? t("pluginBuiltin") : origin === "dsh" ? t("dshBuiltin") : t("customProvider");
   const providerMeta = [
     provider.provider,
-    provider.active ? t("active") : provider.configured ? t("configured") : t("notConfigured"),
+    // `active`/`configured` are read off the route's profile or the host's
+    // provider list, neither of which describes a transport route: its state
+    // is the account row it carries (signed out when the host lists none).
+    transport ? t(transportStatusKey(transportAccount?.status ?? "signed-out")) : provider.active ? t("active") : provider.configured ? t("configured") : t("notConfigured"),
     provider.api ?? null
   ].filter((value) => Boolean(value));
   async function adopt() {
@@ -1435,8 +1801,9 @@ function ProviderCard({ provider, expanded, onToggle, now }) {
           { className: "km-provider-title-line" },
           h("span", { className: "km-provider-name" }, provider.displayName || provider.provider),
           h("span", { className: "km-tag" }, originLabel),
+          transport ? h("span", { className: "km-tag km-tag-accent" }, t("transportTag")) : null,
           managed ? h("span", { className: "km-tag km-tag-accent" }, t("managedBadge")) : null,
-          !managed && !provider.supported && !accountAdoptable ? h("span", { className: "km-tag km-tag-warn" }, t("unsupported")) : null
+          !transport && !managed && !provider.supported && !accountAdoptable ? h("span", { className: "km-tag km-tag-warn" }, t("unsupported")) : null
         ),
         h(
           "span",
@@ -1450,7 +1817,14 @@ function ProviderCard({ provider, expanded, onToggle, now }) {
       h(
         "span",
         { className: "km-provider-side" },
-        managed ? h("span", { className: "km-count" }, countText(t, keyCount, "providerKeyOne", "providerKeys")) : h("span", { className: "km-count km-muted" }, adoptable ? t("unmanaged") : t("unsupported")),
+        // I-000120 / D8: requests this route served without an attributed
+        // account. Rendered only above zero, and the visible label carries the
+        // count so it is the accessible name; the hint stays a description.
+        (provider.unattributedRequests ?? 0) > 0 ? h("span", {
+          className: "km-tag km-tag-warn km-unattributed",
+          title: t("unattributedHint")
+        }, t("unattributed", { n: provider.unattributedRequests ?? 0 })) : null,
+        transport ? null : managed ? h("span", { className: "km-count" }, countText(t, keyCount, "providerKeyOne", "providerKeys")) : h("span", { className: "km-count km-muted" }, adoptable ? t("unmanaged") : t("unsupported")),
         managed ? h(StatusPill, { status: provider.status, t }) : null,
         h(Icon, { name: "chevron", size: 16, className: cx("km-chevron", expanded && "km-chevron-open") })
       )
@@ -1460,7 +1834,9 @@ function ProviderCard({ provider, expanded, onToggle, now }) {
       { className: "km-provider-body" },
       error !== null ? h("div", { className: "km-inline-error", role: "alert" }, error) : null,
       warning !== void 0 || broken ? h(Notice, { tone: "warn", title: t("warning") }, broken ? t("bindingBroken") : warning) : null,
-      !managed ? h(
+      // A transport route has no adopt step and no key pool: its whole
+      // credential surface is the one account row its own plugin serves.
+      transport ? transportAccount !== void 0 ? h(TransportAccountRow, { account: transportAccount }) : h("div", { className: "km-muted" }, t("transportProviderHint")) : !managed ? h(
         "div",
         { className: "km-adopt" },
         h(
@@ -1876,6 +2252,7 @@ function KeysManagerBody() {
   const state = snapshot.state;
   const now = snapshot.now;
   const [query, setQuery] = import_react2.default.useState("");
+  const [filter, setFilter] = import_react2.default.useState("all");
   const [showAllAvailable, setShowAllAvailable] = import_react2.default.useState(false);
   const [expanded, setExpanded] = import_react2.default.useState(() => /* @__PURE__ */ new Set());
   const loadedRef = import_react2.default.useRef(false);
@@ -1885,6 +2262,7 @@ function KeysManagerBody() {
     if (snapshot.status === "idle") void runtime.store.load();
   }, [runtime, snapshot.status]);
   const providers = state?.providers ?? [];
+  const transportAccounts = state?.transportAccounts ?? [];
   const normalizedQuery = query.trim().toLowerCase();
   const matches = (provider) => {
     if (normalizedQuery.length === 0) return true;
@@ -1898,9 +2276,23 @@ function KeysManagerBody() {
     ].filter((value) => Boolean(value)).join(" ").toLowerCase();
     return haystack.includes(normalizedQuery);
   };
-  const managed = providers.filter((provider) => provider.managed && matches(provider));
-  const available = providers.filter((provider) => !provider.managed && matches(provider));
+  const managed = providers.filter((provider) => (provider.managed || provider.transport === true) && matchesFilter(provider, filter) && matches(provider));
+  const available = providers.filter((provider) => !provider.managed && provider.transport !== true && matchesFilter(provider, filter) && matches(provider));
   const visibleAvailable = showAllAvailable || normalizedQuery.length > 0 ? available : available.slice(0, 12);
+  const matchesAccount = (account) => {
+    if (normalizedQuery.length === 0) return true;
+    const haystack = [account.id, account.scope, account.displayName].join(" ").toLowerCase();
+    return haystack.includes(normalizedQuery);
+  };
+  const orphanAccounts = orphanTransportAccounts(providers, transportAccounts).filter(matchesAccount);
+  const visibleOrphans = filter === "all" || filter === "transport" ? orphanAccounts : [];
+  const filterCount = (value) => {
+    const searchable = providers.filter(matches);
+    if (value === "all") return searchable.length + orphanAccounts.length;
+    if (value === "transport") return searchable.filter((provider) => provider.transport === true).length + orphanAccounts.length;
+    return searchable.filter((provider) => matchesFilter(provider, value)).length;
+  };
+  const managedHiddenByChip = filter !== "all" && providers.some((provider) => provider.managed || provider.transport === true);
   function toggle(provider) {
     setExpanded((current) => {
       const next = new Set(current);
@@ -1939,7 +2331,7 @@ function KeysManagerBody() {
       h(
         "div",
         { className: "km-summary" },
-        h("div", { className: "km-stat" }, h("strong", null, loading ? "\u2014" : state?.managedCount ?? 0), h("span", null, t("managed"))),
+        h("div", { className: "km-stat" }, h("strong", null, loading ? "\u2014" : managedEntryCount(providers, transportAccounts)), h("span", null, t("managed"))),
         h("div", { className: "km-stat" }, h("strong", null, loading ? "\u2014" : state?.keyCount ?? 0), h("span", null, t("keys"))),
         h("div", { className: "km-stat" }, h("strong", null, loading ? "\u2014" : state?.healthyKeyCount ?? 0), h("span", null, t("healthy"))),
         h("div", { className: "km-stat" }, h("strong", null, loading ? "\u2014" : state?.coolingKeyCount ?? 0), h("span", null, t("cooling")))
@@ -1956,6 +2348,26 @@ function KeysManagerBody() {
         }, h(Icon, { name: "refresh", size: 14 }), t("refresh"))
       )
     ),
+    // Quick filter: single select, view state only, composed with the text
+    // search below. Counts are derived per predicate from the snapshot.
+    !loading && !failed ? h("div", {
+      className: "km-filters",
+      role: "group",
+      "aria-label": t("filterGroup")
+    }, FILTER_CHIPS.map(
+      (chip) => h(
+        "button",
+        {
+          key: chip.value,
+          type: "button",
+          className: cx("km-chip", `km-chip-${chip.value}`, filter === chip.value && "km-chip-on"),
+          "aria-pressed": filter === chip.value,
+          onClick: () => setFilter(chip.value)
+        },
+        h("span", { className: "km-chip-label" }, t(chip.label)),
+        h("span", { className: "km-chip-count" }, filterCount(chip.value))
+      )
+    )) : null,
     h(
       "div",
       { className: "km-search" },
@@ -1985,15 +2397,29 @@ function KeysManagerBody() {
         "div",
         { className: "km-section-head" },
         h("h2", { className: "km-section-title" }, t("managed")),
-        h("span", { className: "km-section-count" }, managed.length)
+        // What is below it, like the available section: the tile above keeps
+        // the global total.
+        h("span", { className: "km-section-count" }, managed.length + visibleOrphans.length)
       ),
-      managed.length === 0 ? h("div", { className: "km-empty" }, h(Icon, { name: "key", size: 20 }), h("span", null, t("managedEmpty"))) : h("div", { className: "km-provider-list" }, managed.map((provider) => h(ProviderCard, {
+      // The placeholder only when the section renders neither a card nor a row
+      // the active chip selects.
+      managed.length === 0 && visibleOrphans.length === 0 ? h("div", { className: "km-empty" }, h(Icon, { name: "key", size: 20 }), h(
+        "span",
+        null,
+        normalizedQuery.length > 0 ? t("noSearch") : filter === "transport" ? t("transportEmpty") : managedHiddenByChip ? t("managedFilteredEmpty") : t("managedEmpty")
+      )) : null,
+      managed.length > 0 ? h("div", { className: "km-provider-list" }, managed.map((provider) => h(ProviderCard, {
         key: provider.provider,
         provider,
         now,
+        transportAccount: provider.transport === true ? transportAccounts.find((account) => account.id === provider.provider) : void 0,
         expanded: expanded.has(provider.provider),
         onToggle: () => toggle(provider.provider)
-      })))
+      }))) : null,
+      visibleOrphans.length > 0 ? h("div", { className: "km-provider-list" }, visibleOrphans.map((account) => h(TransportAccountRow, {
+        key: account.scope,
+        account
+      }))) : null
     ) : null,
     !loading && !failed ? h(
       "section",
@@ -2036,8 +2462,9 @@ function KeysManagerCard({ view }) {
   if (view === "summary") {
     const state = snapshot.state;
     if (state === null) return h("span", { className: "km-summary-line" }, snapshot.status === "error" ? t("loadError") : t("loading"));
-    if (state.managedCount === 0) return h("span", { className: "km-summary-line" }, t("summaryEmpty"));
-    return h("span", { className: "km-summary-line" }, t("summaryText", { providers: state.managedCount, keys: state.keyCount }));
+    const managed = managedEntryCount(state.providers, state.transportAccounts ?? []);
+    if (managed === 0) return h("span", { className: "km-summary-line" }, t("summaryEmpty"));
+    return h("span", { className: "km-summary-line" }, t("summaryText", { providers: managed, keys: state.keyCount }));
   }
   return h(KeysManagerBody);
 }