dsh-qoder-connect 0.2.6 → 0.2.7

package/lib/index.d.ts

@@ -87,26 +87,56 @@ declare const QODER_GLOBAL_AUTH_PATH = "/plugins/dsh-qoder-connect/global/auth";
  * One action the PAT route accepts.
  *
  * `save-pat` validates the pasted token against the variant's region and, only
- * on success, persists it; `clear` removes the stored credential. There is no
- * device flow and no credential import: the token is the whole auth surface.
+ * on success, appends it to the saved list and makes it active; `activate`
+ * switches to another saved entry; `remove` deletes one saved entry; `clear`
+ * removes every saved credential. There is no device flow and no credential
+ * import: the token is the whole auth surface.
+ *
+ * All of these are writes — `activate` changes which account signs later
+ * requests — so the route requires the in-process key even for the two that do
+ * not touch a token's bytes.
  */
-type QoderAuthAction = 'save-pat' | 'clear';
+type QoderAuthAction = 'save-pat' | 'activate' | 'remove' | 'clear';
 /** Request body accepted by the PAT route. */
 interface QoderAuthRequest {
   action: QoderAuthAction;
   /** The token to validate and store; required for `save-pat`. */
   pat?: string;
+  /** Optional display label for a saved entry; `save-pat` only. */
+  label?: string;
+  /** Target saved entry; required for `activate` and `remove`. */
+  id?: string;
 }
 /** Where the credential in effect came from. */
 type QoderCredentialSource = 'card' | 'env' | 'cli';
 /**
- * Redacted summary of one variant's PAT.
+ * One saved PAT, redacted for the switch select.
+ *
+ * Never the token itself: the id is a one-way hash prefix, the label is
+ * display copy, and the tail is the last four characters — enough to tell two
+ * saved tokens apart, not enough to misuse one.
+ */
+interface QoderPatProfile {
+  id: string;
+  /** Optional display label supplied when the token was saved. */
+  label?: string;
+  /** Last four characters of the token. */
+  patTail?: string;
+  /** When this token was saved, epoch milliseconds. */
+  savedAtMs?: number;
+}
+/**
+ * Redacted summary of one variant's active PAT.
  *
  * Never the token itself: the browser half displays where the credential came
  * from, when it was saved, and the last four characters — enough to tell two
  * tokens apart, not enough to misuse one.
  */
 interface QoderPatSummary {
+  /** Local id of the saved entry in effect; absent for the environment token. */
+  id?: string;
+  /** Display label of the saved entry in effect, when it carries one. */
+  label?: string;
   source: QoderCredentialSource;
   /** When the stored token was saved, epoch milliseconds; absent for env fallback. */
   savedAtMs?: number;
@@ -255,6 +285,16 @@ type QoderWebStatus = {
   region?: QoderRegion;
   /** Redacted summary of the PAT in effect. */
   pat?: QoderPatSummary;
+  /**
+   * Every saved token for this variant, newest first, redacted.
+   *
+   * One entry means the card has nothing to switch; two or more render the
+   * account select. The list is variant-scoped, like the credential file
+   * itself: a token minted for one region is never offered to the other.
+   */
+  patProfiles?: readonly QoderPatProfile[];
+  /** The saved entry in effect; absent when the token comes from the environment. */
+  activePatId?: string;
   credits?: QoderWebCredits;
   creditsError?: string;
   /** The models the plugin serves, as catalog snapshots. */
@@ -388,12 +428,27 @@ declare const QODER_AUTH_FILENAME = ".qoder-auth.json";
 interface AuthLogger {
   warn?(...args: unknown[]): void;
 }
+/** One saved credential, as the file stores it. */
+interface QoderCredentialEntry {
+  /** Stable local id (a one-way hash prefix of the token). */
+  id: string;
+  pat: string;
+  region: QoderRegion;
+  /** When the stored token was saved, epoch milliseconds. */
+  savedAtMs?: number;
+  /** Optional display label; never sent upstream. */
+  label?: string;
+}
 /** Runtime credential, timestamps in epoch milliseconds. */
 interface QoderCredential {
+  /** Local id of the saved entry; absent for an environment token. */
+  id?: string;
   pat: string;
   region: QoderRegion;
   /** When the stored token was saved; absent for environment-sourced tokens. */
   savedAtMs?: number;
+  /** Display label, when the saved entry carries one. */
+  label?: string;
   source: QoderCredentialSource;
 }
 /** Read-only sign-in summary for status, the PAT route, and doctor output. */
@@ -407,6 +462,10 @@ interface QoderAuthStatus {
   reason?: string;
   /** Absolute path of the credential file this store owns. */
   filePath: string;
+  /** Every saved token for this variant, newest first, redacted. */
+  profiles?: readonly QoderPatProfile[];
+  /** The entry id in effect, when a saved entry is active. */
+  activeId?: string;
 }
 /** Constructor options. */
 interface QoderStoreOptions {
@@ -418,13 +477,21 @@ interface QoderStoreOptions {
 }
 /** Last four characters of a token, for display. */
 declare function patTail(pat: string): string | undefined;
+/**
+ * Stable local id for one token.
+ *
+ * A PAT is a bearer secret, so the id is a one-way hash prefix rather than
+ * any suffix of it: surfaces that show the id (the select, status documents,
+ * logs) leak nothing usable, while two saves of the same token still resolve
+ * to the same entry.
+ */
+declare function qoderCredentialId(pat: string): string;
 /**
  * Stable identity key for a credential, used by probe records and saved
  * catalogs.
  *
- * A PAT is a bearer secret, so the key is its one-way hash rather than any
- * suffix of it: surfaces that show the key (cards, JSON diagnostics) leak
- * nothing usable, while two reads of the same token still correlate locally.
+ * Deliberately wider than the local id: these keys address stored data, not
+ * UI, and 16 hex characters keep two tokens from ever sharing a bucket.
  */
 declare function qoderCredentialIdentity(credential: Pick<QoderCredential, 'pat'>): string;
 declare class QoderCredentialStore {
@@ -439,10 +506,11 @@ declare class QoderCredentialStore {
   /**
    * The credential currently in effect, or `undefined` when there is none.
    *
-   * Resolution order: the plugin-owned file, then the arm's environment
-   * variable (only when no file exists — a saved token always wins over a
-   * stray env), then nothing. There is no refresh and no expiry check: a PAT
-   * lives until revoked.
+   * Resolution order: the active saved entry (or the first one when the
+   * pointer is stale), then the arm's environment variable (only when no
+   * saved entry exists — a saved token always wins over a stray env), then
+   * nothing. There is no refresh and no expiry check: a PAT lives until
+   * revoked.
    */
   current(): Promise<QoderCredential | undefined>;
   /**
@@ -455,12 +523,48 @@ declare class QoderCredentialStore {
   resolve(): Promise<QoderCredential>;
   /** The token in effect as a bare string, rejecting when there is none. */
   patPromise(): Promise<string>;
+  /** Every saved entry (tokens included; host-side callers only). */
+  entries(): Promise<readonly QoderCredentialEntry[]>;
   /**
-   * Persist a token for this variant. The caller is responsible for having
-   * validated it against the region first (`validateApiKey` upstream).
+   * Add a token and make it active.
+   *
+   * Re-saving an existing token updates that entry (its saved time, and its
+   * label when one is supplied) instead of appending a duplicate — the id is
+   * derived from the token, so "same PAT" is the same entry by construction.
+   * The caller is responsible for having validated the token against the
+   * region first (`validateApiKey` upstream).
+   *
+   * @param pat - the token to store.
+   * @param label - optional display label for the select row.
+   * @returns the stored entry.
+   */
+  add(pat: string, label?: string): Promise<QoderCredentialEntry>;
+  /**
+   * Make one saved entry active.
+   *
+   * @param id - the entry id.
+   * @returns the activated entry, or `undefined` when no entry has that id.
+   */
+  activate(id: string): Promise<QoderCredentialEntry | undefined>;
+  /**
+   * Remove one saved entry.
+   *
+   * The active pointer moves to the first remaining entry; removing the last
+   * entry deletes the file, exactly like {@link clear} — a saved token is the
+   * only thing that shadows the environment fallback.
+   *
+   * @param id - the entry id.
+   * @returns the removed entry, or `undefined` when no entry has that id.
+   */
+  remove(id: string): Promise<QoderCredentialEntry | undefined>;
+  /**
+   * Persist a token for this variant and make it active.
+   *
+   * Kept for the CLI and older call sites: it is {@link add} behind the
+   * runtime-credential shape they expect.
    */
   save(pat: string, source?: QoderCredentialSource): Promise<QoderCredential>;
-  /** Remove the stored credential. A missing file is not an error. */
+  /** Remove every stored credential. A missing file is not an error. */
   clear(): Promise<void>;
   /** Alias kept for call-site readability (`logout` is just clearing). */
   logout(): Promise<void>;
@@ -470,7 +574,7 @@ declare class QoderCredentialStore {
   private pendingLegacyReason;
   private fromEnvironment;
   private readOwn;
-  private writeOwn;
+  private writeDocument;
 }
 /**
  * The plugin-owned credential path for one variant's default filename.
@@ -1146,6 +1250,15 @@ declare class QoderProbeStore {
   set(modelId: string, record: QoderProbeRecord): void;
   /** Drop every record; used by the card's explicit "clear" action. */
   clear(): void;
+  /**
+   * Drop every record that belongs to one account, leaving the other saved
+   * accounts' observations intact.
+   *
+   * Used when a saved token is removed: its detected effort levels are that
+   * account's data, and no other account can use them. A plain {@link clear}
+   * here would erase the observations of every account the user still has.
+   */
+  clearFor(account: string): void;
   /** Every record currently held, for status display. */
   all(): Readonly<Record<string, QoderProbeRecord>>;
   /** Build a record stamped with this store's clock, version, and account. */
@@ -1346,22 +1459,27 @@ declare class QoderProbeService {
 }
 //#endregion
 //#region src/auth-route.d.ts
-/** Outcome of a save attempt: stored, or refused with a stable reason. */
+/** Outcome of a save/activate/remove attempt: stored, or refused with a stable reason. */
 type QoderAuthSaveResult = {
   ok: true;
   status: QoderAuthStatus;
 } | {
   ok: false;
-  error: 'qoder_invalid_pat' | 'qoder_missing_pat';
+  error: 'qoder_invalid_pat' | 'qoder_missing_pat' | 'qoder_unknown_pat';
 };
 /** Constructor dependencies. */
 interface QoderAuthRouteOptions {
   /**
    * Validate one pasted token against this variant's region and, only on
-   * success, persist it. The route never decides validity itself.
+   * success, persist it and make it active. The route never decides validity
+   * itself.
    */
-  save: (pat: string) => Promise<QoderAuthSaveResult>;
-  /** Remove the stored credential. */
+  save: (pat: string, label?: string) => Promise<QoderAuthSaveResult>;
+  /** Switch to one already-saved token. */
+  activate: (id: string) => Promise<QoderAuthSaveResult>;
+  /** Remove one saved token; the host moves the active pointer. */
+  remove: (id: string) => Promise<QoderAuthSaveResult>;
+  /** Remove every saved token (`logout`). */
   clear: () => Promise<void>;
   /**
    * Route path to mount. Defaults to the China variant's path so callers that
@@ -1375,7 +1493,7 @@ declare function createAuthKey(): string;
  * The PAT route's handler, extracted so tests can mount it on a bare server
  * with a known key.
  *
- * @param deps - the save/clear operations for one variant.
+ * @param deps - the save/activate/remove/clear operations for one variant.
  * @param key - the in-process control key this route requires.
  * @returns the Node request handler.
  */
@@ -1568,4 +1686,4 @@ declare const QUOTA_SECTION_KEYS: readonly ["sidebarQuotaCN", "sidebarQuotaGloba
  */
 declare function apply(ctx: Context, config: Config): void;
 //#endregion
-export { CHINA_VARIANT, CN_SECTION_KEYS, Config, FALLBACK_QODER_MODELS, GLOBAL_SECTION_KEYS, GLOBAL_VARIANT, KIND_STATUS, PROBE_EFFORT_CANDIDATES, type ProbeAttempt, type ProbeOutcome, type ProbeSender, QODER_AUTH_FILENAME, QODER_AUTH_PATH, QODER_DATA_DIR_ENV, QODER_DATA_DIR_NAME, QODER_GLOBAL_AUTH_PATH, QODER_GLOBAL_PROBE_PATH, QODER_GLOBAL_SETTINGS_NS, QODER_GLOBAL_STATUS_PATH, QODER_HOST_HEARTBEAT_FILENAME, QODER_PAT_ENV_CN, QODER_PAT_ENV_GLOBAL, QODER_PROBE_FILENAME, QODER_PROBE_PATH, QODER_PROVIDER, QODER_QUOTA_SETTINGS_NS, QODER_SETTINGS_NS, QODER_STATUS_PATH, QODER_STREAM_IDLE_TIMEOUT_MS, QODER_VARIANTS, QUOTA_POLL_DEFAULT_MS, QUOTA_POLL_MIN_MS, QUOTA_SECTION_KEYS, type QoderAdapter, type QoderAuthRequest, type QoderAuthRouteOptions, type QoderAuthSaveResult, type QoderAuthStatus, QoderCatalog, type QoderCatalogFetch, type QoderCatalogModelSnapshot, QoderCatalogStore, type QoderCatalogStoreOptions, type QoderChatResult, type QoderCredential, QoderCredentialStore, type QoderCreditAccount, type QoderCredits, type QoderEffort, type QoderHostHeartbeat, type QoderModelBilling, type QoderModelInfo, type QoderModelReasoning, type QoderPatSummary, type QoderProbeAction, type QoderProbeRecord, QoderProbeService, type QoderProbeStatus, QoderProbeStore, type QoderProbeValidation, type QoderShim, QoderUpstreamClient, type QoderVariant, type QoderVariantId, type QoderWebCatalog, type QoderWebCreditAccount, type QoderWebCredits, type QoderWebProbeModel, type QoderWebProbeSection, type QoderWebStatus, type ShimLogger, type UpstreamErrorKind, apply, classifyUpstreamError, clearHostHeartbeat, createAuthKey, createQoderAdapter, createQoderShim, fingerprintModel, inject, isHeartbeatProcessAlive, kindFromQoderFailure, modelInfoOf, name, normalizeCredits, patTail, probeModel, processStartTimeMs, qoderAuthHandler, qoderCatalogPath, qoderCredentialIdentity, qoderHostHeartbeatPath, qoderOwnAuthPath, qoderPluginDataDir, qoderProbePath, randomSentinel, readHostHeartbeat, registerQoderAuthRoute, variantFor };
+export { CHINA_VARIANT, CN_SECTION_KEYS, Config, FALLBACK_QODER_MODELS, GLOBAL_SECTION_KEYS, GLOBAL_VARIANT, KIND_STATUS, PROBE_EFFORT_CANDIDATES, type ProbeAttempt, type ProbeOutcome, type ProbeSender, QODER_AUTH_FILENAME, QODER_AUTH_PATH, QODER_DATA_DIR_ENV, QODER_DATA_DIR_NAME, QODER_GLOBAL_AUTH_PATH, QODER_GLOBAL_PROBE_PATH, QODER_GLOBAL_SETTINGS_NS, QODER_GLOBAL_STATUS_PATH, QODER_HOST_HEARTBEAT_FILENAME, QODER_PAT_ENV_CN, QODER_PAT_ENV_GLOBAL, QODER_PROBE_FILENAME, QODER_PROBE_PATH, QODER_PROVIDER, QODER_QUOTA_SETTINGS_NS, QODER_SETTINGS_NS, QODER_STATUS_PATH, QODER_STREAM_IDLE_TIMEOUT_MS, QODER_VARIANTS, QUOTA_POLL_DEFAULT_MS, QUOTA_POLL_MIN_MS, QUOTA_SECTION_KEYS, type QoderAdapter, type QoderAuthRequest, type QoderAuthRouteOptions, type QoderAuthSaveResult, type QoderAuthStatus, QoderCatalog, type QoderCatalogFetch, type QoderCatalogModelSnapshot, QoderCatalogStore, type QoderCatalogStoreOptions, type QoderChatResult, type QoderCredential, type QoderCredentialEntry, QoderCredentialStore, type QoderCreditAccount, type QoderCredits, type QoderEffort, type QoderHostHeartbeat, type QoderModelBilling, type QoderModelInfo, type QoderModelReasoning, type QoderPatProfile, type QoderPatSummary, type QoderProbeAction, type QoderProbeRecord, QoderProbeService, type QoderProbeStatus, QoderProbeStore, type QoderProbeValidation, type QoderShim, QoderUpstreamClient, type QoderVariant, type QoderVariantId, type QoderWebCatalog, type QoderWebCreditAccount, type QoderWebCredits, type QoderWebProbeModel, type QoderWebProbeSection, type QoderWebStatus, type ShimLogger, type UpstreamErrorKind, apply, classifyUpstreamError, clearHostHeartbeat, createAuthKey, createQoderAdapter, createQoderShim, fingerprintModel, inject, isHeartbeatProcessAlive, kindFromQoderFailure, modelInfoOf, name, normalizeCredits, patTail, probeModel, processStartTimeMs, qoderAuthHandler, qoderCatalogPath, qoderCredentialId, qoderCredentialIdentity, qoderHostHeartbeatPath, qoderOwnAuthPath, qoderPluginDataDir, qoderProbePath, randomSentinel, readHostHeartbeat, registerQoderAuthRoute, variantFor };

package/lib/index.js

@@ -1,7 +1,7 @@
-import { A as QoderCatalog, B as QODER_PAT_ENV_GLOBAL, C as getMachineId, D as QoderCatalogStore, E as randomSentinel, F as QODER_PROBE_PATH, G as QODER_DATA_DIR_ENV, H as patTail, I as QODER_SETTINGS_FACE_PATH, J as qoderMachineIdPath, K as QODER_DATA_DIR_NAME, L as QODER_STATUS_PATH, M as QODER_GLOBAL_AUTH_PATH, N as QODER_GLOBAL_PROBE_PATH, O as qoderCatalogPath, P as QODER_GLOBAL_STATUS_PATH, R as QODER_AUTH_FILENAME, S as utc8WallClock, T as probeModel, U as qoderCredentialIdentity, V as QoderCredentialStore, W as qoderOwnAuthPath, X as qoderStateDir, Y as qoderPluginDataDir, _ as modelInfoOf, a as QODER_HOST_HEARTBEAT_FILENAME, b as createQoderTransport, c as processStartTimeMs, d as writeHostHeartbeat, f as QODER_CONNECT_VERSION, g as kindFromQoderFailure, h as classifyUpstreamError, i as variantFor, j as QODER_AUTH_PATH, k as FALLBACK_QODER_MODELS, l as qoderHostHeartbeatPath, m as QoderUpstreamClient, n as GLOBAL_VARIANT, o as clearHostHeartbeat, p as KIND_STATUS, q as configurePluginPaths, r as QODER_VARIANTS, s as isHeartbeatProcessAlive, t as CHINA_VARIANT, u as readHostHeartbeat, v as normalizeCredits, w as PROBE_EFFORT_CANDIDATES, x as formatUtc8Date, y as validateApiKey, z as QODER_PAT_ENV_CN } from "./variants-COxX6r1j.js";
+import { $ as configurePluginPaths, A as probeModel, B as QODER_PROBE_PATH, C as normalizeCredits, D as utc8WallClock, E as formatUtc8Date, F as QoderCatalog, G as QODER_PAT_ENV_GLOBAL, H as QODER_STATUS_PATH, I as QODER_AUTH_PATH, J as qoderCredentialId, K as QoderCredentialStore, L as QODER_GLOBAL_AUTH_PATH, M as QoderCatalogStore, N as qoderCatalogPath, O as getMachineId, P as FALLBACK_QODER_MODELS, Q as QODER_DATA_DIR_NAME, R as QODER_GLOBAL_PROBE_PATH, S as modelInfoOf, T as createQoderTransport, U as QODER_AUTH_FILENAME, V as QODER_SETTINGS_FACE_PATH, W as QODER_PAT_ENV_CN, X as qoderOwnAuthPath, Y as qoderCredentialIdentity, Z as QODER_DATA_DIR_ENV, _ as qoderProbePath, a as QODER_HOST_HEARTBEAT_FILENAME, b as classifyUpstreamError, c as processStartTimeMs, d as writeHostHeartbeat, et as qoderMachineIdPath, f as QODER_CONNECT_VERSION, g as newestFirst, h as fingerprintModel, i as variantFor, j as randomSentinel, k as PROBE_EFFORT_CANDIDATES, l as qoderHostHeartbeatPath, m as QoderProbeStore, n as GLOBAL_VARIANT, o as clearHostHeartbeat, p as QODER_PROBE_FILENAME, q as patTail, r as QODER_VARIANTS, s as isHeartbeatProcessAlive, t as CHINA_VARIANT, tt as qoderPluginDataDir, u as readHostHeartbeat, v as KIND_STATUS, w as validateApiKey, x as kindFromQoderFailure, y as QoderUpstreamClient, z as QODER_GLOBAL_STATUS_PATH } from "./variants-B_ZzENbC.js";
 import z from "@deepseek-ai/schemastery";
-import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
-import { dirname, join, resolve } from "node:path";
+import { randomBytes, timingSafeEqual } from "node:crypto";
+import { dirname, join } from "node:path";
 import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
 import { createProvider } from "@earendil-works/pi-ai";
 import { openAICompletionsApi } from "@earendil-works/pi-ai/api/openai-completions.lazy";
@@ -60,7 +60,8 @@ function originIsLoopback(origin) {
 //#endregion
 //#region src/auth-route.ts
 /**
-* PAT route: saves (validate-then-persist) or clears one variant's token.
+* PAT route: saves (validate-then-persist), switches, removes, or clears the
+* tokens of one variant.
 *
 * The state-changing endpoints the plugin exposes share one guard shape — a
 * loopback Host and Origin, plus the in-process key the card receives with its
@@ -111,9 +112,20 @@ function parseRequest(text) {
 	if (action === "save-pat") {
 		const pat = wrapped["pat"];
 		if (typeof pat !== "string" || pat.trim() === "") return void 0;
+		const label = wrapped["label"];
+		if (label !== void 0 && (typeof label !== "string" || label.length > 200)) return void 0;
 		return {
 			action,
-			pat
+			pat,
+			...label === void 0 ? {} : { label }
+		};
+	}
+	if (action === "activate" || action === "remove") {
+		const id = wrapped["id"];
+		if (typeof id !== "string" || id.trim() === "") return void 0;
+		return {
+			action,
+			id: id.trim()
 		};
 	}
 }
@@ -143,7 +155,7 @@ function keyMatches$1(expected, presented) {
 * The PAT route's handler, extracted so tests can mount it on a bare server
 * with a known key.
 *
-* @param deps - the save/clear operations for one variant.
+* @param deps - the save/activate/remove/clear operations for one variant.
 * @param key - the in-process control key this route requires.
 * @returns the Node request handler.
 */
@@ -177,7 +189,15 @@ function qoderAuthHandler(deps, key) {
 				json$2(res, 200, { ok: true });
 				return;
 			}
-			json$2(res, 200, await deps.save(request.pat));
+			if (request.action === "activate") {
+				json$2(res, 200, await deps.activate(request.id));
+				return;
+			}
+			if (request.action === "remove") {
+				json$2(res, 200, await deps.remove(request.id));
+				return;
+			}
+			json$2(res, 200, await deps.save(request.pat, request.label));
 		} catch (error) {
 			json$2(res, 200, {
 				ok: false,
@@ -683,203 +703,6 @@ function createQoderShim(options) {
 	};
 }
 //#endregion
-//#region src/probe-store.ts
-/**
-* Local record of reasoning-effort probes.
-*
-* What this stores is an *observation*, never a claim about the upstream: a
-* model's row is only consulted when the catalog carries no explicit
-* `supportedEfforts` set, and it always loses to a declared set. The plan this
-* implements (`docs/reasoning-effort-probe-plan.md` §5) requires that a result
-* is invalidated whenever the model's catalog row changes, so every record
-* carries a fingerprint of the fields the probe depended on.
-*
-* The file lives in the plugin's own state directory, never beside the
-* product's files, and carries no token, prompt, or response body — only
-* model ids, effort spellings, and timestamps.
-*
-* @module dsh-qoder-connect/probe-store
-*/
-/** Basename of the China variant's probe record inside the plugin's state dir. */
-const QODER_PROBE_FILENAME = ".qoder-probe.json";
-/** On-disk format this reader accepts; other versions are discarded. */
-const PROBE_FORMAT_VERSION = 1;
-/**
-* How long an observation stays usable. Conservative on purpose: the plan's
-* whole argument is that upstream metadata moves fast, so a result that has
-* outlived its fingerprint's usefulness should not quietly keep granting a
-* picker entry.
-*/
-const DEFAULT_TTL_MS = 12096e5;
-/**
-* Plugin-owned probe record path inside the plugin's state directory.
-*
-* One file per variant. The two regions serve overlapping model ids with
-* different entitlements, and {@link fingerprintModel} covers only
-* `id`/`reasoning`/`supportsImages` — never the provider — so a single shared
-* file would let one variant's observation answer for the other. The paths
-* differ; the format does not.
-*/
-function qoderProbePath(filename = QODER_PROBE_FILENAME) {
-	return join(qoderStateDir(), filename);
-}
-/**
-* Fingerprint the catalog fields a probe depends on.
-*
-* Deliberately excludes display-only fields (`name`, `billing`, `contextWindow`)
-* so a rename or a rate relabel does not throw away a valid observation, and
-* deliberately includes the whole reasoning object so any change to the
-* declared shape re-probes.
-*/
-function fingerprintModel(info) {
-	const basis = JSON.stringify({
-		id: info.id,
-		reasoning: info.reasoning ?? null,
-		supportsImages: info.supportsImages ?? null
-	});
-	return createHash("sha256").update(basis).digest("hex").slice(0, 16);
-}
-/** Read-and-validate the documents on disk; anything malformed reads as empty. */
-function readDocument(path) {
-	if (!existsSync(path)) return void 0;
-	let parsed;
-	try {
-		parsed = JSON.parse(readFileSync(path, "utf8"));
-	} catch {
-		return;
-	}
-	if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return void 0;
-	const wrapped = parsed;
-	if (wrapped["version"] !== PROBE_FORMAT_VERSION) return void 0;
-	const records = wrapped["records"];
-	if (typeof records !== "object" || records === null || Array.isArray(records)) return void 0;
-	return parsed;
-}
-/** One record's shape check; a bad row is dropped rather than trusted. */
-function isRecord(value) {
-	if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
-	const wrapped = value;
-	const validation = wrapped["validation"];
-	if (validation !== "validating" && validation !== "non-validating" && validation !== "unknown") return false;
-	if (typeof wrapped["fingerprint"] !== "string") return false;
-	if (typeof wrapped["probedAtMs"] !== "number" || !Number.isFinite(wrapped["probedAtMs"])) return false;
-	if (typeof wrapped["pluginVersion"] !== "string") return false;
-	const efforts = wrapped["efforts"];
-	if (!Array.isArray(efforts) || efforts.some((effort) => typeof effort !== "string")) return false;
-	return true;
-}
-/**
-* The plugin's probe records: read once, written atomically, never trusted
-* across a fingerprint change or past the TTL.
-*/
-var QoderProbeStore = class {
-	path;
-	ttlMs;
-	pluginVersion;
-	now;
-	records;
-	constructor(options) {
-		const opts = typeof options === "string" ? {
-			path: options,
-			pluginVersion: "0.0.0"
-		} : options;
-		this.path = opts.path ?? qoderProbePath();
-		this.ttlMs = opts.ttlMs ?? DEFAULT_TTL_MS;
-		this.pluginVersion = opts.pluginVersion;
-		this.now = opts.now ?? (() => Date.now());
-	}
-	/** Resolved state-file path, for the CLI and tests. */
-	filePath() {
-		return this.path;
-	}
-	load() {
-		if (this.records === void 0) {
-			const document = readDocument(this.path);
-			const records = {};
-			for (const [id, record] of Object.entries(document?.records ?? {})) if (isRecord(record)) records[id] = record;
-			this.records = records;
-		}
-		return this.records;
-	}
-	/**
-	* The usable record for a model, or `undefined` when there is none, it is
-	* expired, it was taken against a different catalog row, or it belongs to a
-	* different account.
-	*
-	* @param account - the account in effect, as `uid:enterpriseId`. Records are
-	*   only returned for the account that produced them.
-	*/
-	get(modelId, fingerprint, account) {
-		const record = this.load()[modelId];
-		if (record === void 0) return void 0;
-		if (record.fingerprint !== fingerprint) return void 0;
-		if (record.account !== account) return void 0;
-		if (this.now() - record.probedAtMs > this.ttlMs) return void 0;
-		return record;
-	}
-	/**
-	* Store one observation. Only a decisive answer (`validating` /
-	* `non-validating`) replaces an existing decisive record: a transient
-	* `unknown` must not erase knowledge the user already paid for.
-	*/
-	set(modelId, record) {
-		const records = this.load();
-		const existing = records[modelId];
-		if (record.validation === "unknown" && existing !== void 0 && existing.fingerprint === record.fingerprint && existing.validation !== "unknown") return;
-		records[modelId] = record;
-		this.persist();
-	}
-	/** Drop every record; used by the card's explicit "clear" action. */
-	clear() {
-		this.records = {};
-		this.persist();
-	}
-	/** Every record currently held, for status display. */
-	all() {
-		return { ...this.load() };
-	}
-	/** Build a record stamped with this store's clock, version, and account. */
-	record(fingerprint, validation, efforts, account) {
-		return {
-			fingerprint,
-			validation,
-			efforts: validation === "validating" ? [...efforts] : [],
-			probedAtMs: this.now(),
-			pluginVersion: this.pluginVersion,
-			account
-		};
-	}
-	/**
-	* Write through a temporary file and rename, so a crash mid-write cannot
-	* leave a half-parsed document that reads as "no records" and silently drops
-	* every observation.
-	*/
-	persist() {
-		const directory = dirname(this.path);
-		try {
-			if (!existsSync(directory)) mkdirSync(directory, { recursive: true });
-			const document = {
-				version: PROBE_FORMAT_VERSION,
-				records: this.load()
-			};
-			const temporary = resolve(`${this.path}.tmp`);
-			writeFileSync(temporary, `${JSON.stringify(document, null, 2)}\n`, { mode: 384 });
-			renameSync(temporary, this.path);
-		} catch {}
-	}
-};
-/**
-* Order observations newest-first for display.
-*
-* The store keeps insertion order so the file reads chronologically, but the
-* card wants the most recent detection at the top: a sweep the user just ran
-* should not appear below every earlier one, which is what appending to an
-* insertion-ordered list does.
-*/
-function newestFirst(records) {
-	return [...records].sort((a, b) => b.probedAt - a.probedAt);
-}
-//#endregion
 //#region src/probe-service.ts
 /**
 * Serial probe runner. One instance is shared by the manual API and any
@@ -1070,6 +893,8 @@ async function qoderWebStatus(deps) {
 		status: "signed-in",
 		...authStatus.region === void 0 ? {} : { region: authStatus.region },
 		...authStatus.pat === void 0 ? {} : { pat: authStatus.pat },
+		...authStatus.profiles === void 0 ? {} : { patProfiles: authStatus.profiles },
+		...authStatus.activeId === void 0 ? {} : { activePatId: authStatus.activeId },
 		...deps.authKey === void 0 ? {} : { authKey: deps.authKey }
 	};
 	const modelsField = deps.models().map(modelSnapshot);
@@ -2687,10 +2512,7 @@ function apply(ctx, config) {
 		runtime.catalogGeneration += 1;
 		runtime.inflightFetch?.controller.abort();
 		runtime.inflightFetch = void 0;
-		if (hadCredential && known !== identity) {
-			runtime.probeStore.clear();
-			runtime.invalidate();
-		}
+		if (hadCredential && known !== identity) runtime.invalidate();
 		if (identity === void 0) {
 			if (known !== void 0) runtime.savedCatalogs.delete(known);
 			runtime.catalog.set(runtime.fallback);
@@ -2765,13 +2587,13 @@ function apply(ctx, config) {
 			});
 			registerQoderAuthRoute(webCtx, {
 				path: runtime.variant.authPath,
-				save: async (pat) => {
+				save: async (pat, label) => {
 					if (!await validateApiKey(pat, runtime.variant.region)) return {
 						ok: false,
 						error: "qoder_invalid_pat"
 					};
-					const credential = await runtime.store.save(pat);
-					const identity = credentialIdentity(credential);
+					const entry = await runtime.store.add(pat, label);
+					const identity = credentialIdentity(entry);
 					adoptIdentity(runtime, identity);
 					await fetchCatalog(runtime, identity);
 					return {
@@ -2779,7 +2601,45 @@ function apply(ctx, config) {
 						status: await runtime.store.status()
 					};
 				},
+				activate: async (id) => {
+					const entry = await runtime.store.activate(id);
+					if (entry === void 0) return {
+						ok: false,
+						error: "qoder_unknown_pat"
+					};
+					const identity = credentialIdentity(entry);
+					adoptIdentity(runtime, identity);
+					detach(ctx, fetchCatalog(runtime, identity), `${runtime.variant.id} catalog refresh after switch`);
+					return {
+						ok: true,
+						status: await runtime.store.status()
+					};
+				},
+				remove: async (id) => {
+					const removed = await runtime.store.remove(id);
+					if (removed === void 0) return {
+						ok: false,
+						error: "qoder_unknown_pat"
+					};
+					const finished = credentialIdentity(removed);
+					runtime.probeStore.clearFor(finished);
+					runtime.savedCatalogs.delete(finished);
+					const active = await runtime.store.current().catch(() => void 0);
+					const identity = active === void 0 ? void 0 : credentialIdentity(active);
+					adoptIdentity(runtime, identity);
+					if (identity !== void 0) detach(ctx, fetchCatalog(runtime, identity), `${runtime.variant.id} catalog refresh after removal`);
+					return {
+						ok: true,
+						status: await runtime.store.status()
+					};
+				},
 				clear: async () => {
+					const saved = await runtime.store.entries().catch(() => []);
+					for (const entry of saved) {
+						const identity = credentialIdentity(entry);
+						runtime.probeStore.clearFor(identity);
+						runtime.savedCatalogs.delete(identity);
+					}
 					await runtime.store.clear();
 					adoptIdentity(runtime, void 0);
 				}
@@ -3097,4 +2957,4 @@ function apply(ctx, config) {
 	}), "variant startup");
 }
 //#endregion
-export { CHINA_VARIANT, CN_SECTION_KEYS, Config, FALLBACK_QODER_MODELS, GLOBAL_SECTION_KEYS, GLOBAL_VARIANT, KIND_STATUS, PROBE_EFFORT_CANDIDATES, QODER_AUTH_FILENAME, QODER_AUTH_PATH, QODER_DATA_DIR_ENV, QODER_DATA_DIR_NAME, QODER_GLOBAL_AUTH_PATH, QODER_GLOBAL_PROBE_PATH, QODER_GLOBAL_SETTINGS_NS, QODER_GLOBAL_STATUS_PATH, QODER_HOST_HEARTBEAT_FILENAME, QODER_PAT_ENV_CN, QODER_PAT_ENV_GLOBAL, QODER_PROBE_FILENAME, QODER_PROBE_PATH, QODER_PROVIDER, QODER_QUOTA_SETTINGS_NS, QODER_SETTINGS_NS, QODER_STATUS_PATH, QODER_STREAM_IDLE_TIMEOUT_MS, QODER_VARIANTS, QUOTA_POLL_DEFAULT_MS, QUOTA_POLL_MIN_MS, QUOTA_SECTION_KEYS, QoderCatalog, QoderCatalogStore, QoderCredentialStore, QoderProbeService, QoderProbeStore, QoderUpstreamClient, apply, classifyUpstreamError, clearHostHeartbeat, createAuthKey, createQoderAdapter, createQoderShim, fingerprintModel, inject, isHeartbeatProcessAlive, kindFromQoderFailure, modelInfoOf, name, normalizeCredits, patTail, probeModel, processStartTimeMs, qoderAuthHandler, qoderCatalogPath, qoderCredentialIdentity, qoderHostHeartbeatPath, qoderOwnAuthPath, qoderPluginDataDir, qoderProbePath, randomSentinel, readHostHeartbeat, registerQoderAuthRoute, variantFor };
+export { CHINA_VARIANT, CN_SECTION_KEYS, Config, FALLBACK_QODER_MODELS, GLOBAL_SECTION_KEYS, GLOBAL_VARIANT, KIND_STATUS, PROBE_EFFORT_CANDIDATES, QODER_AUTH_FILENAME, QODER_AUTH_PATH, QODER_DATA_DIR_ENV, QODER_DATA_DIR_NAME, QODER_GLOBAL_AUTH_PATH, QODER_GLOBAL_PROBE_PATH, QODER_GLOBAL_SETTINGS_NS, QODER_GLOBAL_STATUS_PATH, QODER_HOST_HEARTBEAT_FILENAME, QODER_PAT_ENV_CN, QODER_PAT_ENV_GLOBAL, QODER_PROBE_FILENAME, QODER_PROBE_PATH, QODER_PROVIDER, QODER_QUOTA_SETTINGS_NS, QODER_SETTINGS_NS, QODER_STATUS_PATH, QODER_STREAM_IDLE_TIMEOUT_MS, QODER_VARIANTS, QUOTA_POLL_DEFAULT_MS, QUOTA_POLL_MIN_MS, QUOTA_SECTION_KEYS, QoderCatalog, QoderCatalogStore, QoderCredentialStore, QoderProbeService, QoderProbeStore, QoderUpstreamClient, apply, classifyUpstreamError, clearHostHeartbeat, createAuthKey, createQoderAdapter, createQoderShim, fingerprintModel, inject, isHeartbeatProcessAlive, kindFromQoderFailure, modelInfoOf, name, normalizeCredits, patTail, probeModel, processStartTimeMs, qoderAuthHandler, qoderCatalogPath, qoderCredentialId, qoderCredentialIdentity, qoderHostHeartbeatPath, qoderOwnAuthPath, qoderPluginDataDir, qoderProbePath, randomSentinel, readHostHeartbeat, registerQoderAuthRoute, variantFor };