dsh-connect-trae 3.0.1 → 3.4.0

package/lib/index.js

@@ -4,11 +4,11 @@ import { openAICompletionsApi } from "@earendil-works/pi-ai/api/openai-completio
 import { resolveRetryPolicy } from "@deepseek-ai/dsh-llm";
 import { PiAiAdapter } from "@deepseek-ai/dsh-llm-pi-ai";
 import { readFile, rm, stat } from "node:fs/promises";
-import { createDecipheriv, createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
+import { createDecipheriv, createHash, randomBytes, randomUUID, sign, timingSafeEqual } from "node:crypto";
 import { dirname, join } from "node:path";
 import { withFileLock, writeFileAtomic } from "@deepseek-ai/dsh-atomic-write";
 import { resolveDshHome } from "@deepseek-ai/dsh-home-paths";
-import { cpus, homedir, hostname, release } from "node:os";
+import { cpus, homedir, hostname, release, userInfo } from "node:os";
 import { createServer } from "node:http";
 import { Readable } from "node:stream";
 import { execFile } from "node:child_process";
@@ -478,8 +478,19 @@ const TRAE_ACCOUNTS_REFRESH_PATH = "/plugins/dsh-connect-trae/accounts/refresh";
 */
 const TRAE_ACCOUNT_CREDITS_PATH = "/plugins/dsh-connect-trae/account-credits";
 /**
+* Per-account status (check-in / credits / subscription) for the account table.
+*
+* Each row of the account table reads its OWN state through this route — a CN
+* row carries its check-in state and balance, an ai row its subscription.
+* POST with the accountId in the body: one upstream read per account, paid
+* only when the table is actually shown.
+*/
+const TRAE_ACCOUNT_STATUS_PATH = "/plugins/dsh-connect-trae/account-status";
+/**
 * Plugin-owned daily check-in claim endpoint. POST, loopback-only, and the only
-* route in this plugin that changes upstream account state.
+* route in this plugin that changes upstream account state. The accountId in
+* the body names WHICH account to claim for, so the button can sit in each
+* account row.
 */
 const TRAE_CHECKIN_PATH = "/plugins/dsh-connect-trae/checkin";
 /** Query parameter naming the region a card request addresses. */
@@ -1636,26 +1647,35 @@ var TraeCredentialStore = class {
 };
 //#endregion
 //#region src/refresh.ts
-const REFRESH_CONTRACT = {
+/** Path of the current token-exchange endpoint, relative to the credential host. */
+const TRAE_EXCHANGE_TOKEN_PATH = "/trae/api/v3/oauth/ExchangeToken";
+/** Path of the superseded endpoint; only reachable as the fallback. */
+const TRAE_LEGACY_EXCHANGE_TOKEN_PATH = "/cloudide/api/v3/trae/oauth/ExchangeToken";
+/** Shared desktop ClientID; the current contract also uses it for `cn` / `sg`. */
+const DESKTOP_CLIENT_ID = "ono9krqynydwx5";
+/** SOLO ClientID; every SOLO package uses it, CN and international alike. */
+const SOLO_CLIENT_ID = "en1oxy7wnw8j9n";
+/** The current contract: `/trae/api/v3`, per-edition ClientID, always proofed. */
+const CURRENT_CONTRACT = {
 	cn: {
-		path: "/cloudide/api/v3/trae/oauth/ExchangeToken",
-		clientId: "ono9krqynydwx5",
-		deviceInfo: false
+		path: TRAE_EXCHANGE_TOKEN_PATH,
+		clientId: DESKTOP_CLIENT_ID,
+		platformCode: "IDE_PC"
 	},
 	sg: {
-		path: "/cloudide/api/v3/trae/oauth/ExchangeToken",
-		clientId: "ono9krqynydwx5",
-		deviceInfo: false
+		path: TRAE_EXCHANGE_TOKEN_PATH,
+		clientId: DESKTOP_CLIENT_ID,
+		platformCode: "IDE_PC"
 	},
 	solo: {
-		path: "/cloudide/api/v3/trae/oauth/ExchangeToken",
-		clientId: "ono9krqynydwx5",
-		deviceInfo: false
+		path: TRAE_EXCHANGE_TOKEN_PATH,
+		clientId: SOLO_CLIENT_ID,
+		platformCode: "SOLO_PC"
 	},
 	"solo-sg": {
-		path: "/trae/api/v3/oauth/ExchangeToken",
-		clientId: "en1oxy7wnw8j9n",
-		deviceInfo: true
+		path: TRAE_EXCHANGE_TOKEN_PATH,
+		clientId: SOLO_CLIENT_ID,
+		platformCode: "SOLO_PC"
 	}
 };
 function normalizeHost(host) {
@@ -1663,49 +1683,173 @@ function normalizeHost(host) {
 	if (value === "") throw new Error("Trae refresh host is missing");
 	return value.replace(/\/$/, "");
 }
+/** `OSInfo` value the official client sends (a bare platform word). */
+function osInfo(platform = process.platform) {
+	return platform === "darwin" ? "mac" : platform === "win32" ? "windows" : platform;
+}
 /**
-* Exchange a refresh token for a fresh access token, following the calling
-* edition's verified contract. `device` is only used by editions whose
-* official client sends a DeviceInfo body; when it cannot be resolved the
-* field is omitted rather than sent empty.
+* Build the exact string the official client signs.
+*
+* The separator is a NEWLINE, not a space: the shipped bundle joins the six
+* fields with `.join("\n")`. This is load-bearing rather than cosmetic — a
+* space-joined message of identical fields is rejected with `20403 Token device
+* not match`, which is indistinguishable from a wrong key and sends debugging
+* in entirely the wrong direction.
 */
-async function refreshTraeCredential(credential, signal, device) {
-	const contract = REFRESH_CONTRACT[credential.edition];
-	if (contract === void 0) throw new Error(`Trae ${credential.edition} refresh contract is not verified`);
-	if (credential.refreshToken === void 0) throw new Error("Trae refresh token is missing");
-	const body = {
-		ClientID: contract.clientId,
-		ClientSecret: "-",
-		RefreshToken: credential.refreshToken,
-		UserID: credential.userId
+function traeDeviceProofMessage(input) {
+	return [
+		"POST",
+		input.path,
+		input.clientId,
+		input.refreshToken,
+		String(input.timestamp),
+		input.nonce
+	].join("\n");
+}
+/**
+* Sign a device proof with the install's own private key.
+*
+* `timestamp`/`nonce` are injectable so tests can pin a deterministic signature;
+* the defaults are the whole-second timestamp and 16 random bytes the official
+* client uses.
+*/
+function signTraeDeviceProof(input) {
+	const timestamp = input.timestamp ?? Math.floor(Date.now() / 1e3);
+	const nonce = input.nonce ?? randomBytes(16).toString("hex");
+	const message = traeDeviceProofMessage({
+		path: input.path,
+		clientId: input.clientId,
+		refreshToken: input.refreshToken,
+		timestamp,
+		nonce
+	});
+	return {
+		Signature: sign("sha256", Buffer.from(message), input.privateKeyPEM).toString("base64"),
+		Timestamp: timestamp,
+		Nonce: nonce
 	};
-	if (contract.deviceInfo && device !== void 0) body["DeviceInfo"] = {
+}
+/** The `DeviceInfo` block the current contract sends. */
+function traeDeviceInfoBody(contract, device, platform) {
+	const os = osInfo(platform);
+	return {
 		DeviceID: device.deviceId,
 		MachineID: device.machineId,
-		PlatformCode: credential.edition === "solo-sg" ? "SOLO_PC" : "TRAE",
+		PlatformCode: contract.platformCode,
 		DeviceType: "PC",
-		DeviceName: hostname()
+		...device.deviceName === void 0 ? {} : { DeviceName: device.deviceName },
+		...device.deviceModel === void 0 ? {} : { DeviceModel: device.deviceModel },
+		...device.appVersion === void 0 ? {} : { ClientVersion: device.appVersion },
+		...device.deviceKeyPair === void 0 ? {} : { DevicePublicKey: device.deviceKeyPair.publicKeyPEM },
+		...device.deviceBrand === void 0 ? {} : { DeviceBrand: device.deviceBrand },
+		...device.deviceCpu === void 0 ? {} : { DeviceCPU: device.deviceCpu },
+		OSInfo: os,
+		OSVersion: device.osVersion ?? `${os} ${hostname()}`
 	};
-	const response = await fetch(`${normalizeHost(credential.host)}${contract.path}`, {
-		method: "POST",
-		headers: { "Content-Type": "application/json" },
-		body: JSON.stringify(body),
-		signal: signal ?? AbortSignal.timeout(3e4)
-	});
-	if (!response.ok) throw new Error(`Trae token refresh failed (http ${response.status})`);
-	const result = (await response.json()).Result;
+}
+/** The current contract's complete request body. */
+function currentBody(credential, contract, device) {
+	return {
+		ClientID: contract.clientId,
+		ClientSecret: "",
+		RefreshToken: credential.refreshToken,
+		DeviceInfo: traeDeviceInfoBody(contract, device),
+		DeviceProof: signTraeDeviceProof({
+			path: contract.path,
+			clientId: contract.clientId,
+			refreshToken: credential.refreshToken ?? "",
+			privateKeyPEM: device.deviceKeyPair.privateKeyPEM
+		}),
+		...device.appVersion === void 0 ? {} : { IDEVersion: device.appVersion }
+	};
+}
+/**
+* The superseded shape, kept as a fallback for installs the current contract
+* cannot serve: a machine whose `storage.json` carries no device keypair (an
+* older install that has never refreshed on the new contract, or a CLI-only
+* home) has nothing to sign a proof with.
+*
+* The ClientID split is the SAME one the current contract uses, and that is not
+* a coincidence — it is enforced by the OAuth CLIENT, not by the endpoint: a
+* SOLO-package refresh token is refused by the DESKTOP client with `10101
+* refresh token is not matched to the client`, and vice versa, on this path
+* exactly as on the current one. Verified 2026-10-11 across all four editions:
+* each answers 200 here with its own ClientID and 400 with the other one.
+*
+* The pre-3.1.0 code hardcoded the desktop ClientID on this path, which is why
+* an international SOLO account had no working fallback at all.
+*/
+function legacyBody(credential, clientId) {
+	return {
+		ClientID: clientId,
+		ClientSecret: "-",
+		RefreshToken: credential.refreshToken,
+		UserID: credential.userId
+	};
+}
+/** Parse one ExchangeToken response into an outcome, or throw with the reason. */
+function outcomeOf(payload, label) {
+	const result = payload.Result;
 	const accessToken = typeof result?.["Token"] === "string" ? result["Token"] : "";
-	if (accessToken === "") throw new Error("Trae token refresh returned no token");
+	if (accessToken === "") throw new Error(`${label} returned no token`);
 	const expiry = result?.["TokenExpireAt"];
 	const expiresAtMs = typeof expiry === "number" ? expiry : typeof expiry === "string" ? Date.parse(expiry) : NaN;
-	if (!Number.isFinite(expiresAtMs)) throw new Error("Trae token refresh returned an invalid expiry");
+	if (!Number.isFinite(expiresAtMs)) throw new Error(`${label} returned an invalid expiry`);
 	const refreshToken = typeof result?.["RefreshToken"] === "string" && result["RefreshToken"] !== "" ? result["RefreshToken"] : void 0;
+	const refreshExpiry = result?.["RefreshExpireAt"];
+	const parsedRefreshExpiry = typeof refreshExpiry === "string" ? Date.parse(refreshExpiry) : NaN;
+	const refreshExpiresAtMs = typeof refreshExpiry === "number" && Number.isFinite(refreshExpiry) && refreshExpiry > 0 ? refreshExpiry : Number.isFinite(parsedRefreshExpiry) ? parsedRefreshExpiry : void 0;
 	return {
 		accessToken,
 		...refreshToken === void 0 ? {} : { refreshToken },
-		expiresAtMs
+		expiresAtMs,
+		...refreshExpiresAtMs === void 0 ? {} : { refreshExpiresAtMs }
 	};
 }
+/** POST one refresh body and parse it, labelling failures with the path tried. */
+async function postExchangeToken(host, path, body, signal, label) {
+	const response = await fetch(`${normalizeHost(host)}${path}`, {
+		method: "POST",
+		headers: { "Content-Type": "application/json" },
+		body: JSON.stringify(body),
+		signal: signal ?? AbortSignal.timeout(3e4)
+	});
+	if (!response.ok) throw new Error(`${label} failed (http ${response.status})`);
+	return outcomeOf(await response.json(), label);
+}
+/**
+* Exchange a refresh token for a fresh access token.
+*
+* The CURRENT contract is attempted first whenever it is possible at all — it is
+* what the shipped clients use. It needs the install's device keypair; without
+* one there is nothing to sign, so the request is skipped rather than sent to be
+* rejected with `20405`.
+*
+* The SUPERSEDED contract is then tried as a fallback, which is what keeps older
+* installs and CLI-only machines working; it carries no device block but the
+* SAME per-edition ClientID, because that split belongs to the OAuth client
+* rather than to the endpoint (see {@link legacyBody}). When both are impossible
+* or both fail, the error names every attempt so a "sign in again" verdict is
+* diagnosable rather than mysterious.
+*/
+async function refreshTraeCredential(credential, signal, device) {
+	const contract = CURRENT_CONTRACT[credential.edition];
+	if (contract === void 0) throw new Error(`Trae ${credential.edition} refresh contract is not verified`);
+	if (credential.refreshToken === void 0) throw new Error("Trae refresh token is missing");
+	const attempts = [];
+	if (device?.deviceKeyPair === void 0) attempts.push(`${contract.path}: no device keypair in this install's storage`);
+	else try {
+		return await postExchangeToken(credential.host, contract.path, currentBody(credential, contract, device), signal, "Trae token refresh");
+	} catch (error) {
+		attempts.push(`${contract.path}: ${error instanceof Error ? error.message : String(error)}`);
+	}
+	try {
+		return await postExchangeToken(credential.host, TRAE_LEGACY_EXCHANGE_TOKEN_PATH, legacyBody(credential, contract.clientId), signal, "Trae token refresh (legacy)");
+	} catch (error) {
+		attempts.push(`${TRAE_LEGACY_EXCHANGE_TOKEN_PATH}: ${error instanceof Error ? error.message : String(error)}`);
+	}
+	throw new Error(`Trae token refresh failed — ${attempts.join("; ")}`);
+}
 //#endregion
 //#region src/identity.ts
 function nonEmpty(value) {
@@ -1716,6 +1860,33 @@ function deviceCenterId(storage) {
 	const ids = Object.keys(storage).filter((key) => key.startsWith(prefix)).map((key) => key.slice(25)).filter(Boolean);
 	return ids.length === 1 ? ids[0] : void 0;
 }
+/**
+* Read the install's device keypair out of `storage.json`.
+*
+* Tolerant on purpose: an older install (or one that has never refreshed on the
+* new contract) simply has no keypair, and the caller must still be able to
+* resolve an identity for the chat/usage paths — only a refresh then degrades.
+* A malformed entry is treated as absent rather than failing the read.
+*/
+function deviceKeyPairOf(storage) {
+	const key = Object.keys(storage).find((name) => name.startsWith("iCubeAuthInfo://icube-dc:"));
+	if (key === void 0) return void 0;
+	const encoded = storage[key];
+	if (typeof encoded !== "string" || encoded.trim() === "") return void 0;
+	try {
+		const plaintext = parseTraeAuthValue(encoded);
+		if (typeof plaintext !== "object" || plaintext === null || Array.isArray(plaintext)) return void 0;
+		const value = plaintext;
+		const privateKeyPEM = nonEmpty(value["privateKeyPEM"]);
+		const publicKeyPEM = nonEmpty(value["publicKeyPEM"]);
+		return privateKeyPEM === void 0 || publicKeyPEM === void 0 ? void 0 : {
+			privateKeyPEM,
+			publicKeyPEM
+		};
+	} catch {
+		return;
+	}
+}
 /** Read stable identity from Trae-owned files without generating impersonated IDs. */
 async function readTraeIdentity(candidate, options = {}) {
 	const platform = options.platform ?? process.platform;
@@ -1754,6 +1925,15 @@ async function readTraeIdentity(candidate, options = {}) {
 	const deviceBrand = platform === "darwin" ? nonEmpty(env["TRAE_DEVICE_BRAND"]) : void 0;
 	const deviceCpu = cpus()[0]?.model.split(" ")[0];
 	const osVersion = `${platform === "darwin" ? "macOS" : platform === "win32" ? "Windows" : platform} ${release()}`;
+	const deviceName = (() => {
+		try {
+			return nonEmpty(userInfo().username);
+		} catch {
+			return;
+		}
+	})();
+	const deviceModel = nonEmpty(env["TRAE_DEVICE_MODEL"]);
+	const deviceKeyPair = deviceKeyPairOf(storage);
 	return {
 		edition: candidate.edition,
 		machineId,
@@ -1762,6 +1942,9 @@ async function readTraeIdentity(candidate, options = {}) {
 		...buildVersion === void 0 ? {} : { buildVersion },
 		...deviceBrand === void 0 ? {} : { deviceBrand },
 		...deviceCpu === void 0 ? {} : { deviceCpu },
+		...deviceName === void 0 ? {} : { deviceName },
+		...deviceModel === void 0 ? {} : { deviceModel },
+		...deviceKeyPair === void 0 ? {} : { deviceKeyPair },
 		osVersion,
 		platform
 	};
@@ -3920,6 +4103,21 @@ const TRAE_PAY_BASE = "https://api.trae.cn";
 function asNumber(value) {
 	return typeof value === "number" && Number.isFinite(value) ? value : void 0;
 }
+/**
+* Normalize an upstream epoch to milliseconds.
+*
+* The pack's `end_time` arrives in SECONDS while {@link TraeUsagePack.endTimeMs}
+* names milliseconds. Measured against a live CN account: `1788340660` is
+* 2026-09-02, and reading it as milliseconds would place the pack in 1970 — a
+* date that sorts ahead of every real one and reads as "long expired". The
+* magnitude test is the same one `auth.ts` applies to stored expiry fields, so
+* an upstream that ever switches to milliseconds is passed through instead of
+* being multiplied into the year 57000.
+*/
+function epochToMs(value) {
+	if (value === void 0 || !Number.isFinite(value) || value <= 0) return 0;
+	return value > 0xe8d4a51000 ? value : value * 1e3;
+}
 function parseUsageSnapshot(payload) {
 	const summaryRaw = payload["usage_summary"];
 	const summary = {
@@ -3943,7 +4141,7 @@ function parseUsageSnapshot(payload) {
 		packs.push({
 			displayDesc: typeof pack["display_desc"] === "string" ? pack["display_desc"] : "",
 			entitlementId: typeof base?.["entitlement_id"] === "string" ? base["entitlement_id"] : "",
-			endTimeMs: asNumber(base?.["end_time"]) ?? 0,
+			endTimeMs: epochToMs(asNumber(base?.["end_time"])),
 			currency: asNumber(base?.["currency"]) ?? 0,
 			...availableEndpoint === void 0 ? {} : { availableEndpoint },
 			...creditsLimit === void 0 ? {} : { creditsLimit },
@@ -4220,6 +4418,32 @@ async function readModelTestBody(req) {
 	}
 	return ids;
 }
+/**
+* Read the accountId a per-account route needs from a POST body. A bounded,
+* single-string reader — the same families of guards the model-test body uses,
+* because the claim route here is a state-changing endpoint.
+*/
+async function readAccountBody(req) {
+	const chunks = [];
+	let size = 0;
+	for await (const chunk of req) {
+		const buffer = chunk;
+		size += buffer.byteLength;
+		if (size > 16384) throw new Error("request body too large");
+		chunks.push(buffer);
+	}
+	const text = Buffer.concat(chunks).toString("utf8").trim();
+	if (text === "") throw new Error("empty body");
+	let parsed;
+	try {
+		parsed = JSON.parse(text);
+	} catch {
+		throw new Error("invalid JSON body");
+	}
+	const accountId = typeof parsed === "object" && parsed !== null ? parsed["accountId"] : void 0;
+	if (typeof accountId !== "string" || accountId.trim() === "") throw new Error("body must carry an accountId string");
+	return accountId.trim();
+}
 /** Loopback browser origins only; other devices are refused until trusted origins exist. */
 function loopbackOrigin(req) {
 	const origin = req.headers.origin;
@@ -4232,6 +4456,17 @@ function loopbackOrigin(req) {
 	}
 }
 /**
+* Whether a pack's expiry is one the card can actually use.
+*
+* One predicate, shared by the per-pack projection and the bucket summary, so
+* the two can never disagree about which packs count as dated. `0` and the
+* non-finite values are excluded: a `0` here would read as 1970 and sort ahead
+* of every real date, and `NaN`/`Infinity` are not dates at all.
+*/
+function usableExpiry(endTimeMs) {
+	return typeof endTimeMs === "number" && Number.isFinite(endTimeMs) && endTimeMs > 0;
+}
+/**
 * Map the credit snapshot to the card's compact credit document.
 *
 * Exported so the "is another account usable?" probe (issue #25) derives its
@@ -4239,13 +4474,14 @@ function loopbackOrigin(req) {
 * — a second implementation of the Work/general split would be free to disagree
 * with the number shown next to it.
 */
-function toCredits(snapshot) {
+function toCredits(snapshot, nowMs = Date.now()) {
 	const { totalAmount, consumedAmount } = snapshot.summary;
 	const credit = (value) => Math.round(value * 1e4) / 1e4;
 	const accounts = snapshot.packs.map((pack) => ({
 		displayDesc: pack.displayDesc,
 		remain: credit(Math.max(0, (pack.creditsLimit ?? 0) - (pack.consumedCredits ?? 0))),
-		size: pack.creditsLimit ?? 0
+		size: pack.creditsLimit ?? 0,
+		...usableExpiry(pack.endTimeMs) ? { expiresAtMs: pack.endTimeMs } : {}
 	}));
 	const remaining = (endpoint) => snapshot.packs.filter((pack) => pack.availableEndpoint === endpoint).reduce((sum, pack) => credit(sum + Math.max(0, (pack.creditsLimit ?? 0) - (pack.consumedCredits ?? 0))), 0);
 	return {
@@ -4254,9 +4490,74 @@ function toCredits(snapshot) {
 		available: totalAmount - consumedAmount,
 		workAvailable: remaining(1),
 		generalAvailable: remaining(0),
-		accounts
+		accounts,
+		...summarisePackExpiry(accounts, nowMs)
 	};
 }
+/** Empty bucket, used whenever no pack qualifies. */
+const NO_EXPIRING_CREDIT = {
+	total: 0,
+	packs: 0
+};
+/**
+* Sum the credit lapsing inside `horizonMs` of `nowMs`.
+*
+* Only positive balances count: a lapsed pack with nothing left is not a loss,
+* and including it would make every long-lived account look permanently at
+* risk. Only *future* expiries count too — see {@link expiredPacks}.
+*/
+function expiringWithin(packs, nowMs, horizonMs) {
+	return sumExpiring(packs, (expiresAt) => expiresAt > nowMs && expiresAt - nowMs <= horizonMs);
+}
+/**
+* Sum the credit whose pack has already lapsed but still carries a balance.
+*
+* Kept apart from {@link expiringWithin} because a lapsed pack satisfies every
+* forward-looking horizon at once (`expiresAt - now` is negative, hence "within
+* 24 hours"), which would make a long-dead pack look permanently imminent.
+*/
+function expiredPacks(packs, nowMs) {
+	return sumExpiring(packs, (expiresAt) => expiresAt <= nowMs);
+}
+/** Shared accumulator over packs whose expiry passes `matches`. */
+function sumExpiring(packs, matches) {
+	let total = 0;
+	let count = 0;
+	let earliestExpiresAtMs;
+	for (const pack of packs) {
+		const expiresAt = pack.expiresAtMs;
+		if (!usableExpiry(expiresAt) || pack.remain <= 0) continue;
+		if (!matches(expiresAt)) continue;
+		total += pack.remain;
+		count += 1;
+		if (earliestExpiresAtMs === void 0 || expiresAt < earliestExpiresAtMs) earliestExpiresAtMs = expiresAt;
+	}
+	if (count === 0) return NO_EXPIRING_CREDIT;
+	return {
+		total,
+		packs: count,
+		...earliestExpiresAtMs === void 0 ? {} : { earliestExpiresAtMs }
+	};
+}
+/**
+* Bucket the card's credit by how soon it lapses.
+*
+* Returns no `expiry` at all when not one pack carried a usable end time, so a
+* caller can tell "nothing is expiring" apart from "we were never told when
+* anything expires" — the second must not render as reassurance. Uses the same
+* {@link usableExpiry} predicate as the per-pack projection, so a summary is
+* never produced from a set of dates the card itself would not carry.
+*/
+function summarisePackExpiry(accounts, nowMs) {
+	if (!accounts.some((pack) => usableExpiry(pack.expiresAtMs))) return {};
+	const DAY = 864e5;
+	return { expiry: {
+		within24h: expiringWithin(accounts, nowMs, DAY),
+		within3d: expiringWithin(accounts, nowMs, 3 * DAY),
+		within7d: expiringWithin(accounts, nowMs, 7 * DAY),
+		expired: expiredPacks(accounts, nowMs)
+	} };
+}
 /** Map the check-in answer to the card's compact document. */
 function toCheckin(status) {
 	return {
@@ -4471,6 +4772,33 @@ function registerTraeUsageRoute(ctx, deps) {
 				}
 			}
 		});
+		/**
+		* Per-account status for one row of the card's account table (CN:
+		* check-in + balances; ai: subscription). Read-only, one upstream call per
+		* account, fetched once per table render. `accountId` rides in the query
+		* (a GET, like every other read-only sibling). Absent `accountStateOf`
+		* the route answers 503 so the table degrades to bare rows.
+		*/
+		const disposeAccountStatus = ctx.webServer.register({
+			kind: "exact",
+			path: TRAE_ACCOUNT_STATUS_PATH,
+			handler: async (req, res) => {
+				if (req.method !== "GET") return json(res, 405, { error: "method not allowed" });
+				if (!loopbackOrigin(req)) return json(res, 403, { error: "origin-not-trusted" });
+				if (deps.accountStateOf === void 0) return json(res, 503, { error: "account status unavailable" });
+				const region = requestRegion(req, res);
+				if (region === void 0) return;
+				const accountId = new URL(req.url ?? "/", "http://localhost").searchParams.get("accountId");
+				if (accountId === null || accountId.trim() === "") return json(res, 400, { error: "missing accountId" });
+				try {
+					const state = await deps.accountStateOf(region, accountId);
+					if (state === void 0) return json(res, 404, { error: "unknown account" });
+					json(res, 200, state);
+				} catch (error) {
+					json(res, 500, { error: safeMessage(error) });
+				}
+			}
+		});
 		const disposeAccounts = ctx.webServer.register({
 			kind: "exact",
 			path: TRAE_ACCOUNTS_REFRESH_PATH,
@@ -4566,6 +4894,27 @@ function registerTraeUsageRoute(ctx, deps) {
 				if (region === void 0) return;
 				if (region !== "cn") return json(res, 404, { error: "check-in is not available for the international region" });
 				try {
+					let accountId;
+					try {
+						accountId = await readAccountBody(req);
+					} catch {
+						accountId = void 0;
+					}
+					if (accountId !== void 0) {
+						if (deps.claimCheckinOf === void 0) return json(res, 503, { error: "check-in by account unavailable" });
+						const outcome = await deps.claimCheckinOf(region, accountId);
+						if (outcome === void 0) return json(res, 404, { error: "unknown account" });
+						const { claim, checkin: after } = outcome;
+						const deviceClaimed = claim.code === CHECKIN_DEVICE_ALREADY_CLAIMED;
+						return json(res, 200, {
+							claimed: claim.claimed,
+							alreadyCheckedIn: after.checkedIn,
+							...deviceClaimed ? { deviceCheckedIn: true } : {},
+							code: claim.code,
+							message: claim.message,
+							checkin: toCheckin(after)
+						});
+					}
 					const client = deps.client(region);
 					const current = await client.checkinStatus();
 					if (!current.enabled) return json(res, 409, { error: "check-in is not enabled for this account" });
@@ -4605,6 +4954,7 @@ function registerTraeUsageRoute(ctx, deps) {
 			disposeModelsTest();
 			disposeAccounts();
 			disposeAccountCredits();
+			disposeAccountStatus();
 			disposeUsage();
 		};
 	}, "dsh-connect-trae: Web usage route");
@@ -5026,16 +5376,27 @@ function apply(ctx, config) {
 			}], hint ?? (region === "ai" ? "solo-sg" : "cn"));
 		};
 		/**
-		* Resolution failures degrade to omitting DeviceInfo (its being required
-		* is unverified, docs/INTL_SG_EVIDENCE.md §5) rather than failing the
-		* refresh.
+		* The current refresh contract signs a DeviceProof with the install's own
+		* registered keypair, so every field the server reads must come from the
+		* SAME installation the credential belongs to.
+		*
+		* Resolution failures leave `deviceKeyPair` absent, and the refresh then
+		* degrades to the superseded contract instead of sending an unsigned
+		* request the server answers with `20405 Device proof required`.
 		*/
 		const refreshDeviceSafe = async () => {
 			try {
 				const value = await identity();
 				return {
 					deviceId: value.deviceId,
-					machineId: value.machineId
+					machineId: value.machineId,
+					...value.deviceName === void 0 ? {} : { deviceName: value.deviceName },
+					...value.deviceModel === void 0 ? {} : { deviceModel: value.deviceModel },
+					...value.deviceBrand === void 0 ? {} : { deviceBrand: value.deviceBrand },
+					...value.deviceCpu === void 0 ? {} : { deviceCpu: value.deviceCpu },
+					...value.osVersion === void 0 ? {} : { osVersion: value.osVersion },
+					...value.appVersion === void 0 ? {} : { appVersion: value.appVersion },
+					...value.deviceKeyPair === void 0 ? {} : { deviceKeyPair: value.deviceKeyPair }
 				};
 			} catch {
 				return;
@@ -5093,16 +5454,17 @@ function apply(ctx, config) {
 				ctx.logger.warn("dsh-connect-trae: Raw gateway unavailable; continuing with native SOLO tool-call channel", error);
 			}
 		})();
+		const usageClient = new TraeUsageClient({
+			credential: () => store.resolve(),
+			deviceId: async () => (await identity()).deviceId
+		});
 		stacks[region] = {
 			region,
 			store,
 			catalog,
 			shim,
 			delegating,
-			usageClient: new TraeUsageClient({
-				credential: () => store.resolve(),
-				deviceId: async () => (await identity()).deviceId
-			}),
+			usageClient,
 			/**
 			* Credit balance of one named account, WITHOUT rebinding the store
 			* (issue #25). The card asks this only after it saw the bound account
@@ -5119,6 +5481,39 @@ function apply(ctx, config) {
 				if (credential === void 0) return void 0;
 				return toCredits(await new TraeUsageClient({ credential: async () => credential }).snapshot());
 			},
+			accountStateOf: async (accountId) => {
+				const state = { id: accountId };
+				const selectedCredential = await store.current();
+				const client = selectedCredential !== void 0 && traeAccountId(selectedCredential) === accountId ? usageClient : (() => {
+					const credential = store.credentialOf(accountId);
+					return new TraeUsageClient({
+						credential: async () => credential,
+						deviceId: async () => (await identity()).deviceId
+					});
+				})();
+				if (region === "ai") {
+					state.payStatus = await client.payStatus();
+					return state;
+				}
+				const [snapshot, checkin] = await Promise.allSettled([client.snapshot(), client.checkinStatus()]);
+				if (snapshot.status === "fulfilled") state.credits = toCredits(snapshot.value);
+				if (checkin.status === "fulfilled") state.checkin = toCheckin(checkin.value);
+				return state;
+			},
+			claimCheckinOf: async (accountId) => {
+				const selectedCredential = await store.current();
+				const client = selectedCredential !== void 0 && traeAccountId(selectedCredential) === accountId ? usageClient : (() => {
+					const credential = store.credentialOf(accountId);
+					return new TraeUsageClient({
+						credential: async () => credential,
+						deviceId: async () => (await identity()).deviceId
+					});
+				})();
+				return {
+					claim: await client.claimCheckin(),
+					checkin: await client.checkinStatus()
+				};
+			},
 			discoverModels: async (signal) => {
 				const merged = mergeTraeModelSources(await withDirectoryRetry(() => remoteCatalog.fetchModels(signal)), await solo.fetchModels(signal));
 				wire.callableKeys.clear();
@@ -5222,6 +5617,8 @@ function apply(ctx, config) {
 		probeModels: (region, ids) => stacks[region].probeModels(ids),
 		rawDiagnostic: (region) => stacks[region].rawDiagnostic(),
 		creditsOfAccount: (region, accountId) => stacks[region].creditsOfAccount(accountId),
+		accountStateOf: (region, accountId) => stacks[region].accountStateOf(accountId),
+		claimCheckinOf: (region, accountId) => stacks[region].claimCheckinOf(accountId),
 		liveLogin: (region) => liveLoginOf(region)
 	}));
 	/**
@@ -5412,4 +5809,4 @@ function apply(ctx, config) {
 	});
 }
 //#endregion
-export { Config, FALLBACK_TRAE_MODELS, FALLBACK_TRAE_MODELS_AI, REGION_GATEWAYS, SseDecoder, TRAE_AI_PROVIDER, TRAE_CHECKIN_PATH, TRAE_CN_AGENT_TASK_PATH, TRAE_CN_TITLE_PATH, TRAE_MODELS_TEST_PATH, TRAE_MODEL_DETAIL_FUNCTIONS, TRAE_MODEL_DETAIL_PATH, TRAE_PAY_BASE, TRAE_PROBE_TIMEOUT_MS, TRAE_PROVIDER, TRAE_PROVIDERS, TRAE_PROVIDER_DISPLAY_NAMES, TRAE_RAW_CHAT_V1_PATH, TRAE_RAW_CHAT_V2_PATH, TRAE_REASONING_EFFORTS, TRAE_REGIONS, TRAE_REGION_PARAM, TRAE_SETTINGS_NS, TRAE_SOLO_CHAT_PATH, TRAE_SOLO_FUNCTION, TRAE_SOLO_MODELS_PATH, TRAE_SOLO_REMOTE_BASE, TRAE_STATE_DB_FILENAME, TRAE_STREAM_IDLE_TIMEOUT_MS, TRAE_USAGE_PATH, TRAE_VERSION_CODE_FALLBACK, TraeCatalog, TraeCredentialStore, TraeDelegatingUpstreamClient, TraeFallbackUpstreamClient, TraeGatedUpstreamClient, TraeRawCapabilityController, TraeRawCapabilityState, TraeRawChatUpstreamClient, TraeSoloBridge, TraeSoloRemoteCatalogClient, TraeSoloUpstreamClient, TraeUsageClient, UnconfiguredTraeUpstreamClient, apply, applyContextBudgets, applyImageSelection, applyReasoningEffort, asVolatile, bridgeTraeSoloStream, buildTraeAgentTaskBody, buildTraeCnHeaders, buildTraeFusionRawChatEnvelope, buildTraeModelDetailRequest, buildTraeRawChatDraft, buildTraeRawChatRuntimeConfig, classifyProbeError, classifyProbeResult, classifyTraeRawChatFailure, configuredAccountsOf, createTraeAdapter, createTraeRawGateway, createTraeShim, decodeRawChatChunk, decodeTraeEvent, decryptTraeStorageValue, deriveCatalog, describeIdShape, describeNameShape, discoveredCatalog, fallbackModelsFor, followAppLoginEnabled, hashTraeRawChatArg, identityHeaders, inject, legacyTraeOwnAuthPath, maskUserPath, mergeTraeModelSources, name, nextRegionEnabled, nextRegionSlots, normalizeTraeCredential, normalizeTraeVersionCode, parseObservedModelConfig, parseReasoningCapability, parseTraeAuthValue, parseTraeCachedModel, parseTraeModelExtraConfigLogLine, parseTraeRawChatBehaviorConfig, parseTraeRemoteModel, parseTraeStorageDocument, pickTraeStorageIdentity, prepareSoloBody, probeBody, probeModelsSequentially, probeOneModel, probeTraeRawChatCapability, rawCapabilityDiagnostic, rawCapabilityFingerprint, readTraeCachedModel, readTraeCliIdentity, readTraeIdentity, refreshTraeCredential, regionEnabled, regionEnabledOf, regionOfCredential, regionOfEdition, regionOfHost, regionOfTraeProvider, regionOfTraeStatusUrl, regionOfUserRegion, regionStateOf, registerTraeUsageRoute, resolveTraeIdentity, resolveTraeRawRuntime, sanitizeCatalog, settingsNamespaceOf, traeEndpoint, traeInputModalities, traeModelDisplayName, traeOwnAuthPath, traeRawChatExtraInfo, traeStateDatabaseCandidates, traeStorageCandidates, traeWebUsage, traeWindowsAppNames, unwrapVolatile, unwrapVolatileDeep, withTraeRegion };
+export { Config, FALLBACK_TRAE_MODELS, FALLBACK_TRAE_MODELS_AI, REGION_GATEWAYS, SseDecoder, TRAE_ACCOUNT_STATUS_PATH, TRAE_AI_PROVIDER, TRAE_CHECKIN_PATH, TRAE_CN_AGENT_TASK_PATH, TRAE_CN_TITLE_PATH, TRAE_MODELS_TEST_PATH, TRAE_MODEL_DETAIL_FUNCTIONS, TRAE_MODEL_DETAIL_PATH, TRAE_PAY_BASE, TRAE_PROBE_TIMEOUT_MS, TRAE_PROVIDER, TRAE_PROVIDERS, TRAE_PROVIDER_DISPLAY_NAMES, TRAE_RAW_CHAT_V1_PATH, TRAE_RAW_CHAT_V2_PATH, TRAE_REASONING_EFFORTS, TRAE_REGIONS, TRAE_REGION_PARAM, TRAE_SETTINGS_NS, TRAE_SOLO_CHAT_PATH, TRAE_SOLO_FUNCTION, TRAE_SOLO_MODELS_PATH, TRAE_SOLO_REMOTE_BASE, TRAE_STATE_DB_FILENAME, TRAE_STREAM_IDLE_TIMEOUT_MS, TRAE_USAGE_PATH, TRAE_VERSION_CODE_FALLBACK, TraeCatalog, TraeCredentialStore, TraeDelegatingUpstreamClient, TraeFallbackUpstreamClient, TraeGatedUpstreamClient, TraeRawCapabilityController, TraeRawCapabilityState, TraeRawChatUpstreamClient, TraeSoloBridge, TraeSoloRemoteCatalogClient, TraeSoloUpstreamClient, TraeUsageClient, UnconfiguredTraeUpstreamClient, apply, applyContextBudgets, applyImageSelection, applyReasoningEffort, asVolatile, bridgeTraeSoloStream, buildTraeAgentTaskBody, buildTraeCnHeaders, buildTraeFusionRawChatEnvelope, buildTraeModelDetailRequest, buildTraeRawChatDraft, buildTraeRawChatRuntimeConfig, classifyProbeError, classifyProbeResult, classifyTraeRawChatFailure, configuredAccountsOf, createTraeAdapter, createTraeRawGateway, createTraeShim, decodeRawChatChunk, decodeTraeEvent, decryptTraeStorageValue, deriveCatalog, describeIdShape, describeNameShape, discoveredCatalog, fallbackModelsFor, followAppLoginEnabled, hashTraeRawChatArg, identityHeaders, inject, legacyTraeOwnAuthPath, maskUserPath, mergeTraeModelSources, name, nextRegionEnabled, nextRegionSlots, normalizeTraeCredential, normalizeTraeVersionCode, parseObservedModelConfig, parseReasoningCapability, parseTraeAuthValue, parseTraeCachedModel, parseTraeModelExtraConfigLogLine, parseTraeRawChatBehaviorConfig, parseTraeRemoteModel, parseTraeStorageDocument, pickTraeStorageIdentity, prepareSoloBody, probeBody, probeModelsSequentially, probeOneModel, probeTraeRawChatCapability, rawCapabilityDiagnostic, rawCapabilityFingerprint, readTraeCachedModel, readTraeCliIdentity, readTraeIdentity, refreshTraeCredential, regionEnabled, regionEnabledOf, regionOfCredential, regionOfEdition, regionOfHost, regionOfTraeProvider, regionOfTraeStatusUrl, regionOfUserRegion, regionStateOf, registerTraeUsageRoute, resolveTraeIdentity, resolveTraeRawRuntime, sanitizeCatalog, settingsNamespaceOf, traeEndpoint, traeInputModalities, traeModelDisplayName, traeOwnAuthPath, traeRawChatExtraInfo, traeStateDatabaseCandidates, traeStorageCandidates, traeWebUsage, traeWindowsAppNames, unwrapVolatile, unwrapVolatileDeep, withTraeRegion };