dsh-connect-trae 3.6.1 → 3.8.1

package/lib/index.d.ts

@@ -61,6 +61,29 @@ declare function traeStorageCandidates(platform?: NodeJS.Platform, home?: string
 //#region src/region.d.ts
 /** Storage/routing bucket: the CN service or the international (ai) service. */
 type TraeRegion = 'cn' | 'ai';
+/**
+ * One section of the plugin card: a provider the user can switch, bind an
+ * account to, and pick models for, INDEPENDENTLY.
+ *
+ * A panel is not a region. `cn` and `ai` happen to be one-to-one with regions,
+ * but the CN enterprise pool shares the `cn` credential while billing a
+ * different account and serving a different roster — it needs its own switch,
+ * its own account binding and its own model selection, which is exactly what a
+ * panel is. Keeping panels a separate concept from regions is what lets
+ * `enterprise` be handled by the same settings plumbing with no new storage
+ * shape: each panel is just one more slot in the `regions` map.
+ */
+type TraePanel = 'cn' | 'ai' | 'enterprise';
+/** Every panel, in card tab order. */
+declare const TRAE_PANELS: readonly TraePanel[];
+/** The region whose credential/account pool a panel draws on. */
+declare function regionOfPanel(panel: TraePanel): TraeRegion;
+/** The provider id a panel publishes. */
+declare function providerOfPanel(panel: TraePanel): string;
+/** The panel that owns a provider id, or undefined for an unknown id. */
+declare function panelOfProvider(provider: string): TraePanel | undefined;
+/** Narrow a stored settings key to a panel. */
+declare function panelOfKey(value: unknown): TraePanel | undefined;
 /** One region's upstream gateway bases. */
 interface TraeRegionGateways {
   /** Chat + agent API base (the `llm_utils_chat` / raw-chat family). */
@@ -191,8 +214,15 @@ declare function traeInputModalities(model: Pick<TraeModelInfo, 'input'>): TraeI
  * (wire resolution, callable-key filtering) must keep matching the
  * undecorated name; only the model rows handed to DSH (adapter catalog and
  * model discovery) use this decorated name.
+ *
+ * `withRate` is false for the ENTERPRISE panel. The multiplier is a
+ * consumer-pool figure — personal credits per token, read from the consumer
+ * directory — and the tenant pool does not bill against it, so printing it in
+ * the model picker would price a model the tenant is not charged for. The rate
+ * is part of the NAME that reaches DSH, which is why this is a parameter here
+ * and not a rendering decision downstream.
  */
-declare function traeModelDisplayName(model: Pick<TraeModelInfo, 'name' | 'creditMultiplier'>): string;
+declare function traeModelDisplayName(model: Pick<TraeModelInfo, 'name' | 'creditMultiplier'>, withRate?: boolean): string;
 /** Apply the user's explicit image opt-ins plus Trae's own multimodal flag. */
 declare function applyImageSelection(models: readonly TraeModelInfo[], selected: ReadonlySet<string>): TraeModelInfo[];
 /** One row from `get_detail_param`: the authoritative llm_utils_chat wire id + display name. */
@@ -319,9 +349,10 @@ declare class TraeCatalog {
  *
  * The mismatch is reachable in BOTH directions, because DSH itself spans both
  * generations (`dsh-llm-pi-ai` ≤0.2.0-rc.1 declares `^0.85.1`; 0.2.0-rc.2 and
- * later declare `^0.87.1`, 0.2.1-alpha.2 declares `^1.0.2`), while this plugin
- * accepts the whole range (`>=0.1.7-rc.1 <0.3.0-0`). Whichever side is newer,
- * the other one is wrong:
+ * later declare `^0.87.1`, 0.2.1-alpha.2 declares `^1.0.2`, and 0.2.1-rc.1 —
+ * the current desktop host — declares **`^1.1.0`**, which also stopped reading
+ * the top-level fields entirely), while this plugin accepts the whole range
+ * (`>=0.1.7-rc.1 <0.3.0-0`). Whichever side is newer, the other one is wrong:
  *
  * | host | resolved api | outcome |
  * |---|---|---|
@@ -434,11 +465,29 @@ interface TraeShim {
   ready: Promise<void>;
   baseUrl(): string;
   token(): string;
+  /** Bearer secret of one named route (defaults to the first route). */
+  tokenOf(label?: string): string;
   close(): Promise<void>;
 }
+/** One bearer-authenticated chat route served by the shim. */
+interface TraeShimRoute {
+  /** Stable label used to look the route's secret up (`solo` | `enterprise`). */
+  label: string;
+  client: TraeUpstreamClient;
+}
 interface TraeShimOptions {
   catalog: TraeCatalog;
-  client: TraeUpstreamClient;
+  /**
+   * Single-route form, kept for the existing call sites and tests.
+   *
+   * A shim serves exactly as many chat routes as the region publishes provider
+   * ids, and they must not be interchangeable: the consumer and enterprise
+   * pools bill different accounts, so the route is chosen by the bearer token
+   * the adapter was built with, and an unknown token is rejected rather than
+   * defaulting to "some" pool.
+   */
+  client?: TraeUpstreamClient;
+  routes?: readonly TraeShimRoute[];
   logger?: ShimLogger;
 }
 declare function createTraeShim(options: TraeShimOptions): TraeShim;
@@ -446,16 +495,45 @@ declare function createTraeShim(options: TraeShimOptions): TraeShim;
 //#region src/adapter.d.ts
 /** Provider route this bundle owns for the domestic (CN) gateway. */
 declare const TRAE_PROVIDER = "trae";
+/**
+ * Provider route this bundle owns for the CN **enterprise (tenant)** gateway.
+ *
+ * A separate provider id, not a mode switch, because the two pools bill
+ * differently: a tenant account (`tob_online`) is served by BOTH gateways with
+ * the SAME credential, and only the enterprise one draws on the enterprise
+ * pool. Exposing one id would force a per-call guess about who pays.
+ *
+ * It never falls back to the consumer pool: picking this provider is the user
+ * saying "bill the tenant", so a refusal is reported as an error instead of
+ * being silently re-run against the personal quota.
+ */
+declare const TRAE_ENTERPRISE_PROVIDER = "trae-enterprise";
 /**
  * Provider route this bundle owns for the international (trae.ai) gateway.
  * Named `-global` to match the plugin family's convention (`workbuddy-global`);
  * the internal region bucket stays `ai`, which is the gateway/protocol name.
  */
 declare const TRAE_AI_PROVIDER = "trae-global";
-/** The provider id each region registers as. */
+/** The provider ids one region publishes, in model-picker order. */
+declare const TRAE_PROVIDER_IDS: Readonly<Record<TraeRegion, readonly string[]>>;
+/** Each region's default (first) provider id. */
 declare const TRAE_PROVIDERS: Readonly<Record<TraeRegion, string>>;
+/**
+ * Which chat pool a provider bills against.
+ *
+ * `trae` and `trae-global` keep the behaviour they always had (the consumer
+ * SOLO pool); `trae-enterprise` is the only id that reaches the tenant gateway.
+ */
+type TraeProviderRoute = 'solo' | 'enterprise';
+declare const TRAE_PROVIDER_ROUTES: Readonly<Record<string, TraeProviderRoute>>;
+/** Chat pool a provider id bills against; `undefined` for an unknown id. */
+declare function routeOfTraeProvider(provider: string): TraeProviderRoute | undefined;
 /** Human-readable provider names, shown in the DSH model picker. */
 declare const TRAE_PROVIDER_DISPLAY_NAMES: Readonly<Record<TraeRegion, string>>;
+/** Display name per provider id (the region table above only names the default). */
+declare const TRAE_PROVIDER_ID_DISPLAY_NAMES: Readonly<Record<string, string>>;
+/** Display name of a provider id. */
+declare function displayNameOfTraeProvider(provider: string): string;
 /** Region a provider route id belongs to. */
 declare function regionOfTraeProvider(provider: string): TraeRegion | undefined;
 declare const TRAE_STREAM_IDLE_TIMEOUT_MS = 300000;
@@ -494,13 +572,17 @@ declare function adaptLegacyPiAiContext(context: Context): Context;
  * transcript a MODERN (0.86+) api consumes — the reverse mismatch, and just as
  * silent.
  *
- * WHY. DSH spans both generations (`dsh-llm-pi-ai` ≤0.2.0-rc.1 pins `^0.85.1`)
+ * WHY. DSH spans both generations (`dsh-llm-pi-ai` ≤0.2.0-rc.1 pins `^0.85.1`,
+ * while the 0.2.1-rc.1 desktop host pins `^1.1.0` and still emits the legacy
+ * envelope from its own `piContext()`)
  * while this plugin may resolve a newer copy than its host. A LEGACY host never
  * normalizes, so it hands the api the legacy shape; a modern api reads the
  * prompt from a leading system message and the tools from its `toolsAdded`, and
  * never looks at the top-level fields — so both are dropped without a sound.
  * Verified against the published tarballs: the request that reaches the wire
- * carries no system turn and `tools: []`.
+ * carries no system turn and `tools: []`. This is exactly the shape that
+ * `dsh-llm-pi-ai@0.2.1-rc.1` + `pi-ai@1.1.0` would hit unaided, which is why
+ * the wire-level matrix in `tests/pi-ai-context.spec.ts` pins both directions.
  *
  * Identity for anything already in transcript shape, and for a context with
  * neither a prompt nor tools (pi-ai's own `createInitialSystemMessage` returns
@@ -518,6 +600,27 @@ declare function adaptModernPiAiContext(context: Context): Context;
  * no context and are passed through untouched, and each adapter function is an
  * identity unless the context is actually the other generation's shape. So a
  * healthy install does one `Array.some` per request.
+ *
+ * THE CAST IS THE CONTRACT (pi-ai 1.1.0). From 1.1.0 `ProviderStreams` takes
+ * `TranscriptContext`, a BRANDED type whose `unique symbol` member only
+ * `normalizeContext()` can produce — so a `Context` is no longer assignable and
+ * `tsc` reports `TS2345` at both call sites below. The brand cannot be acquired
+ * honestly here, for two reasons that are both deliberate:
+ *
+ * 1. This wrapper sits BELOW the normalizer. `Models.stream()`/`streamSimple()`
+ *    call `normalizeContext()` and hand a real transcript to the provider;
+ *    `createProvider()` passes it straight through to `api.stream`. So on the
+ *    modern path `adapt()` is an identity and the value already IS a branded
+ *    transcript at runtime — the type just cannot see it across that boundary.
+ * 2. The legacy path REQUIRES an unbranded shape. pi-ai ≤0.85 has no
+ *    `normalizeContext` and no transcript type at all, so its api expects
+ *    exactly the `{ systemPrompt, tools, messages }` object `adapt()` returns.
+ *
+ * So the value handed to `api` is "a context of the generation that api
+ * speaks", which no single edition's declared type names. Casting at this one
+ * boundary is what makes both generations expressible; deriving the type from
+ * the resolved copy instead would make the wrapper uncompilable against the
+ * other generation, which is the whole point of having it.
  */
 declare function withContextAdaptation(api: ProviderStreams, generation: PiAiGeneration): ProviderStreams;
 interface TraeAdapterOptions {
@@ -527,6 +630,14 @@ interface TraeAdapterOptions {
   provider?: string;
   /** pi-ai provider name and profile display name; defaults to the CN name. */
   displayName?: string;
+  /**
+   * Bearer secret this provider presents to the shim.
+   *
+   * A region can publish more than one provider (consumer + enterprise), and
+   * the shim picks the billing pool from that bearer. Defaults to the shim's
+   * first route, which keeps the single-provider case unchanged.
+   */
+  secret?: string;
   resolveAttachments?: () => AttachmentStore | undefined;
   /**
    * Override the resolved pi-ai generation (see {@link withContextAdaptation});
@@ -547,6 +658,19 @@ interface TraeCredential {
   refreshToken?: string;
   userId: string;
   accountName?: string;
+  /**
+   * Trae tenant this account belongs to (`account.tenant_id`, e.g. `272193024`
+   * for a `tob_online` enterprise), absent for a personal account.
+   *
+   * This is what decides whether the ENTERPRISE pool can serve the account at
+   * all. The tenant gateway accepts any CN token for its DIRECTORY read — a
+   * personal account gets the full 49-model roster back — so "the roster
+   * loaded" proves nothing about billing rights. Its chat endpoint is what
+   * refuses: a personal account answers `4019` (risk control), a tenant account
+   * streams normally. Because the two are indistinguishable from the roster,
+   * the account list itself has to carry the flag.
+   */
+  tenantId?: string;
   host: string;
   /**
    * Region claim from the decrypted storage document (`userRegion.region`,
@@ -577,6 +701,27 @@ interface TraeCredentialStoreOptions {
    * stores run side by side without seeing each other's accounts.
    */
   region?: TraeRegion;
+  /**
+   * Only consider credentials that belong to a Trae tenant.
+   *
+   * The enterprise panel's store runs with this on: a personal account cannot
+   * bill that pool, and because the tenant gateway still serves it a directory,
+   * binding it here would fail only at the first chat (`4019`). With the flag
+   * set, an explicit binding to a personal account falls through to the preferred
+   * TENANT account instead of being silently honoured.
+   */
+  requireTenant?: boolean;
+  /**
+   * Withhold TENANT (enterprise) accounts from this store's account list.
+   *
+   * Set on the consumer panels: an enterprise login belongs to the enterprise
+   * panel, and offering it here would let a tenant account be bound to the
+   * personal pool without the user ever seeing which pool they picked. A
+   * machine that has ONLY a tenant login still resolves it — an empty list must
+   * not turn a working install into "signed out" — so the filter is applied to
+   * the OFFERED list, never to the resolved credential.
+   */
+  hideTenantAccounts?: boolean;
   /** Legacy single-copy path read as a migration source; injectable for tests. */
   legacyOwnPath?: string;
   refresh: (credential: TraeCredential) => Promise<TraeRefreshOutcome>;
@@ -586,6 +731,16 @@ interface TraeAccountChoice {
   id: string;
   accountName: string;
   edition: TraeEdition;
+  /**
+   * Whether this account may bill the CN ENTERPRISE pool.
+   *
+   * Derived from the credential's own tenant claim, because nothing else can
+   * tell: the tenant gateway answers a directory read for ANY CN token, so a
+   * personal account looks perfectly serviceable right up to its first chat,
+   * which it answers with `4019`. The enterprise panel filters its account list
+   * and its default binding on this flag.
+   */
+  enterprise: boolean;
   /** Routing bucket of this account (`cn` | `ai`), derived from its credential. */
   region: TraeRegion;
   source: 'desktop' | 'dsh' | 'cli';
@@ -623,11 +778,23 @@ declare function traeOwnAuthPath(region: TraeRegion): string;
  */
 declare function legacyTraeOwnAuthPath(): string;
 declare function normalizeTraeCredential(raw: unknown, edition: TraeEdition, source: TraeCredential['source']): TraeCredential | undefined;
+/**
+ * Whether this account belongs to a Trae tenant, i.e. may bill the enterprise
+ * pool.
+ *
+ * Evidence (2026-10-17, live): the tenant's own account carries
+ * `account.tenant_id` / `tenant_name` and `scope: 'saas'`; the personal SOLO
+ * account carries neither and reports `scope: 'marscode'`. Only the tenant one
+ * streams on the enterprise gateway — the other answers `4019` risk control.
+ */
+declare function isEnterpriseAccount(credential: Pick<TraeCredential, 'tenantId'> | undefined): boolean;
 declare class TraeCredentialStore {
   private storagePathOverride;
   private edition;
   private accountId;
   private readonly region;
+  private readonly requireTenant;
+  private readonly hideTenantAccounts;
   private readonly ownPathExplicit;
   private readonly legacyOwnPath;
   private readonly legacyOwnPathExplicit;
@@ -687,7 +854,55 @@ declare class TraeCredentialStore {
    * binding itself already fell through to the live account.
    */
   liveLogin(): Promise<TraeAccountChoice | undefined>;
+  /**
+   * The accounts this store is willing to OFFER.
+   *
+   * Scoped to who this store may bill:
+   *   - a consumer store withholds tenant accounts (the enterprise pool is a
+   *     separate tab and a separate billing decision), and
+   *   - a tenant store withholds personal accounts (they cannot bill that
+   *     pool; the tenant gateway answers their chat with 4019).
+   *
+   * Either filter backs off when it would hide EVERYTHING, so a machine whose
+   * only login is on the other side keeps working instead of reading as
+   * "signed out".
+   */
+  private offered;
   accounts(): Promise<TraeAccountChoice[]>;
+  /**
+   * The credential this store bills, given every credential it can see.
+   *
+   * This is the ONE resolution rule, and it exists so that `current()` and
+   * `accounts()` cannot disagree: `current()` applies it to `readAll()`, and
+   * `accounts()` applies the SAME verdict to decide which row reads as
+   * `selected`. Deriving that flag independently is exactly how the two drifted
+   * apart — and a card that marks a different account than the one the chat
+   * bills is worse than no card at all, because a press that "saves the
+   * selected account" then rewrites the binding to the account that was only
+   * ever DISPLAYED.
+   *
+   * Order of business:
+   *   1. No binding — the detected default (`preferred`) is in use, chosen from
+   *      the OFFERED list rather than from every login on the machine. A
+   *      consumer store that withholds tenant accounts must not default its
+   *      billing to the tenant pool merely because that login sorts first;
+   *      withholding is a billing decision, not a display detail.
+   *   2. A binding — honour it verbatim, even when the OFFERED list hides that
+   *      account. Resolution is never scoped by `hideTenantAccounts`: the user's
+   *      explicit choice outranks a display filter.
+   *   3. A tenant-scoped store cannot bill through a personal account, and the
+   *      tenant gateway only reveals that at the first chat (`4019`). Honour the
+   *      binding when it is eligible; otherwise fall back to the preferred
+   *      tenant account, which is the one the user's enterprise tab is meant to
+   *      use.
+   *   4. A saved account can disappear when Trae replaces its local login. Do
+   *      NOT silently fall back to a different account: that would bill a
+   *      different account than the one the user explicitly selected. Return
+   *      undefined so the caller surfaces "no signed-in account" and the user
+   *      can re-select, instead of the plugin quietly switching accounts behind
+   *      their back.
+   */
+  private inUse;
   current(): Promise<TraeCredential | undefined>;
   /**
    * The stored credential of one specific account, without changing which
@@ -1498,9 +1713,22 @@ interface TraeSoloClientOptions {
   credential(): Promise<TraeCredential>;
   identity(): Promise<TraeIdentity>;
   baseUrl?: string;
+  /**
+   * Which chat gateway this client is pinned to. Omitted = `solo`, the consumer
+   * pool. `enterprise` targets the tenant-billed `console.enterprise` gateway
+   * and stamps the per-call `session_id` it requires (see
+   * {@link TRAE_ENTERPRISE_HOST}).
+   *
+   * Pinned per CLIENT, never chosen per call: a turn must not be able to drift
+   * from the pool the user picked, so the route is fixed when the provider is
+   * built and every request that client makes stays on it.
+   */
+  route?: TraeChatRoute;
   fetchImpl?: typeof fetch;
   log?: (message: string, detail?: unknown) => void;
 }
+/** Which chat pool a client is pinned to. */
+type TraeChatRoute = 'solo' | 'enterprise';
 declare class TraeSoloUpstreamClient {
   private readonly options;
   private readonly fetchImpl;
@@ -1521,9 +1749,22 @@ declare class TraeSoloUpstreamClient {
   /** Merge one function's config list into the shared catalogue (first wins). */
   private collectModels;
   chatStream(bodyJson: string, signal?: AbortSignal, functionName?: string): Promise<TraeChatResult>;
+  /** Chat gateway for this client's pinned route. */
+  private chatBaseOf;
 }
 //#endregion
 //#region src/solo-bridge.d.ts
+/**
+ * One upstream failure as Trae reports it inside a 200 SSE body: an `error`
+ * event, or any event carrying a `code` at or above Trae's error band.
+ */
+interface TraeFailure {
+  code?: number;
+  message: string;
+  extra?: unknown;
+}
+/** A readable message for an in-stream Trae failure, with its code preserved. */
+declare function describeTraeFailure(failure: TraeFailure): string;
 /** Convert Trae's named SSE events into OpenAI chat-completion SSE chunks. */
 declare function bridgeTraeSoloStream(response: Response, model: string): Response;
 /**
@@ -1837,13 +2078,13 @@ declare const TRAE_REGIONS: readonly TraeRegion[];
  * Address one region's status route. The two regions are separate provider
  * stacks; every card request carries the region whose tab the user is on.
  */
-declare function withTraeRegion(path: string, region: TraeRegion): string;
+declare function withTraeRegion(path: string, panel: TraePanel): string;
 /**
  * Read the region parameter off a status-route URL. Absent means the domestic
  * tab (`cn`); a present-but-unknown value returns undefined so the route can
  * answer 400 instead of guessing.
  */
-declare function regionOfTraeStatusUrl(url: string): TraeRegion | undefined;
+declare function regionOfTraeStatusUrl(url: string): TraePanel | undefined;
 /** One credit pack and its remaining credit. */
 interface TraeWebCreditAccount {
   displayDesc: string;
@@ -2005,6 +2246,13 @@ interface TraeWebAccount {
   id: string;
   accountName: string;
   edition: 'cn' | 'sg' | 'solo' | 'solo-sg';
+  /**
+   * Whether this account belongs to a Trae tenant, i.e. may bill the enterprise
+   * pool. The enterprise tab lists only these, because the tenant gateway
+   * serves a directory to any CN token but refuses a personal account's chat
+   * with `4019` — so nothing else reveals the difference until a turn fails.
+   */
+  enterprise: boolean;
   /** Routing bucket of this account, derived from its credential. */
   region: TraeRegion;
   source: 'desktop' | 'dsh' | 'cli';
@@ -2140,7 +2388,7 @@ declare function followAppLoginEnabled(configured: unknown): boolean;
  * region's picks. Tolerates any stored shape (absent, non-object) by starting
  * from an empty document.
  */
-declare function nextRegionSlots<Slot extends object>(regions: unknown, region: TraeRegion, slot: Slot): Record<string, unknown>;
+declare function nextRegionSlots<Slot extends object>(regions: unknown, panel: TraePanel, slot: Slot): Record<string, unknown>;
 /**
  * Whether one region's provider is switched on. Opt-out semantics: only an
  * explicit `false` disables it, so a config written before this switch existed
@@ -2151,7 +2399,7 @@ declare function nextRegionSlots<Slot extends object>(regions: unknown, region:
  * `value` may be the whole settings section or the `regions` map (see
  * {@link regionsMapOf}).
  */
-declare function regionEnabledOf(value: unknown, region: TraeRegion): boolean;
+declare function regionEnabledOf(value: unknown, panel: TraePanel): boolean;
 /**
  * Build the next `regions` settings value for a provider on/off toggle. ONLY
  * the target region's `enabled` flag changes: every other field of that slot
@@ -2168,7 +2416,7 @@ declare function regionEnabledOf(value: unknown, region: TraeRegion): boolean;
  * value is always the `regions` map, i.e. exactly what `settingsScope.set(
  * 'regions', ...)` needs.
  */
-declare function nextRegionEnabled(value: unknown, region: TraeRegion, enabled: boolean): Record<string, unknown>;
+declare function nextRegionEnabled(value: unknown, panel: TraePanel, enabled: boolean): Record<string, unknown>;
 /**
  * The two seats this region's credit readout can occupy.
  *
@@ -2201,7 +2449,7 @@ type TraeCreditPosition = 'composer' | 'stats';
  * `value` may be the whole settings section or the `regions` map (see
  * {@link regionsMapOf}).
  */
-declare function regionCreditPositionOf(value: unknown, region: TraeRegion): TraeCreditPosition;
+declare function regionCreditPositionOf(value: unknown, panel: TraePanel): TraeCreditPosition;
 /**
  * Build the next `regions` settings value for one region's credit seat.
  *
@@ -2213,7 +2461,7 @@ declare function regionCreditPositionOf(value: unknown, region: TraeRegion): Tra
  * value is always the `regions` map, i.e. exactly what `settingsScope.set(
  * 'regions', ...)` needs.
  */
-declare function nextRegionCreditPosition(value: unknown, region: TraeRegion, position: TraeCreditPosition): Record<string, unknown>;
+declare function nextRegionCreditPosition(value: unknown, panel: TraePanel, position: TraeCreditPosition): Record<string, unknown>;
 /** Subscription status of an international (ai) account, rendered instead of the CN credit packs. */
 interface TraeWebPayStatus {
   isDollarUsageBilling: boolean;
@@ -2268,6 +2516,15 @@ type TraeWebUsage = {
   };
   credits?: TraeWebCredits;
   creditsError?: string;
+  /**
+   * Set when this panel has no readable balance by design, rather than by
+   * failure. Only `enterprise` does: a tenant's spend is not reported by any
+   * endpoint the plugin can reach (every tenant quota path answers 404), so
+   * the figure exists solely in the enterprise console. The card must say so
+   * instead of rendering the consumer packs, which belong to the personal
+   * balance and would be read as the tenant's.
+   */
+  creditsUnavailable?: 'enterprise';
   /**
    * Present only when the bound account is out of credit AND another account
    * on this machine has some (issue #25). The card then offers a one-click
@@ -2302,35 +2559,35 @@ type TraeWebUsage = {
 //#endregion
 //#region src/web-status.d.ts
 /**
- * Constructor dependencies. Everything region-specific is addressed by the
- * region the request names: the two regions are separate provider stacks, so
+ * Constructor dependencies. Everything panel-specific is addressed by the
+ * panel the request names: the two regions are separate provider stacks, so
  * the card must be served the directory, selection, and credits of the tab the
  * user is on.
  */
 interface TraeUsageRouteOptions {
-  /** The region-scoped credential store backing each region's requests. */
-  store(region: TraeRegion): TraeCredentialStore;
-  /** The region-scoped usage client (CN work credits / international pay status). */
-  client(region: TraeRegion): TraeUsageClient;
+  /** The panel-scoped credential store backing each region's requests. */
+  store(panel: TraePanel): TraeCredentialStore;
+  /** The panel-scoped usage client (CN work credits / international pay status). */
+  client(panel: TraePanel): TraeUsageClient;
   /**
    * CN credit balances of an account OTHER than the bound one, read without
    * changing which account is bound (issue #25). Optional: when absent the
    * exhausted-account hint is simply not offered.
    */
-  creditsOfAccount?(region: TraeRegion, accountId: string): Promise<TraeWebCredits | undefined>;
+  creditsOfAccount?(panel: TraePanel, accountId: string): Promise<TraeWebCredits | undefined>;
   /**
    * Per-account status for one row of the card's account table: CN → check-in
    * + balances, ai → subscription. Read without changing which account is
    * bound. Optional: when absent the account rows show no check-in/credits/
    * subscription figures (the table still lists each account and its switch).
    */
-  accountStateOf?(region: TraeRegion, accountId: string): Promise<TraeWebAccountState | undefined>;
+  accountStateOf?(panel: TraePanel, accountId: string): Promise<TraeWebAccountState | undefined>;
   /**
    * Claim today's check-in reward for ONE named account, without moving the
    * binding. Optional: absent means the per-row claim button is disabled (the
    * check-in surface simply is not offered).
    */
-  claimCheckinOf?(region: TraeRegion, accountId: string): Promise<{
+  claimCheckinOf?(panel: TraePanel, accountId: string): Promise<{
     claim: TraeCheckinClaim;
     checkin: TraeCheckinStatus;
   } | undefined>;
@@ -2341,24 +2598,24 @@ interface TraeUsageRouteOptions {
    * Read-only — the HOST never rebinds from this value; the follow is a
    * settings write, made by the card or by the host's follow switch.
    */
-  liveLogin?(region: TraeRegion): Promise<TraeWebAppLogin | undefined>;
+  liveLogin?(panel: TraePanel): Promise<TraeWebAppLogin | undefined>;
   /** The requested region's last-refreshed raw directory (one entry per upstream model). */
-  displayModels(region: TraeRegion): readonly TraeModelInfo[];
-  /** The user's model selection in the requested region, stored as model id (= Trae name). */
-  enabledModelIds(region: TraeRegion): readonly string[];
+  displayModels(panel: TraePanel): readonly TraeModelInfo[];
+  /** The user's model selection in the requested panel, stored as model id (= Trae name). */
+  enabledModelIds(panel: TraePanel): readonly string[];
   /**
    * Whether the requested region's provider is currently offered to DSH. The
    * card renders this as the tab's on/off checkbox, so the switch reflects the
    * committed settings value rather than a local guess.
    */
-  regionEnabled(region: TraeRegion): boolean;
+  regionEnabled(panel: TraePanel): boolean;
   /** Re-read one region's live directory from the upstream. */
-  discoverModels?(region: TraeRegion, signal?: AbortSignal): Promise<readonly TraeModelInfo[]>;
+  discoverModels?(panel: TraePanel, signal?: AbortSignal): Promise<readonly TraeModelInfo[]>;
   /**
    * Test the given model ids for availability, one real (minimal) chat call
    * each. Present only when the region's chat path is wired.
    */
-  probeModels?(region: TraeRegion, ids: readonly string[]): Promise<{
+  probeModels?(panel: TraePanel, ids: readonly string[]): Promise<{
     results: {
       id: string;
       verdict: string;
@@ -2366,17 +2623,17 @@ interface TraeUsageRouteOptions {
     }[];
     skipped?: string[];
   }>;
-  /** Raw-Chat capability state of the requested region. */
-  rawDiagnostic?(region: TraeRegion): TraeRawDiagnostic;
+  /** Raw-Chat capability state of the requested panel. */
+  rawDiagnostic?(panel: TraePanel): TraeRawDiagnostic;
 }
 /**
- * Assemble one region's card document. `region` is the tab the card is on; the
- * region-scoped store already answers with only that region's accounts, so the
+ * Assemble one region's card document. `panel` is the tab the card is on; the
+ * panel-scoped store already answers with only that region's accounts, so the
  * document's model slots and account list are that region's by construction.
  * Sign-in state is read-only; credit is a live billing answer whose failure
  * degrades to `creditsError` rather than failing the whole document.
  */
-declare function traeWebUsage(deps: TraeUsageRouteOptions, region: TraeRegion): Promise<TraeWebUsage>;
+declare function traeWebUsage(deps: TraeUsageRouteOptions, panel: TraePanel): Promise<TraeWebUsage>;
 /** Mount the GET usage route on an optional webServer context. */
 declare function registerTraeUsageRoute(ctx: Context$1, deps: TraeUsageRouteOptions): void;
 //#endregion
@@ -2524,7 +2781,7 @@ interface Config {
    * Per-region account selections, keyed `cn` | `ai`. Each region's tab writes
    * its own slot; tokens remain outside settings.
    */
-  accounts?: Partial<Record<TraeRegion, string>>;
+  accounts?: Partial<Record<TraePanel, string>>;
   /**
    * Show the credit readout in the composer tool row: `Trae CN · <n>`, rendered
    * ONLY while the session's selected model belongs to this plugin, clickable
@@ -2567,7 +2824,7 @@ interface Config {
    * expose different rosters, so each keeps its own directory and selection
    * and switching accounts never drops the other region's picks.
    */
-  regions?: Partial<Record<TraeRegion, TraeRegionState>>;
+  regions?: Partial<Record<TraePanel, TraeRegionState>>;
   /**
    * @deprecated Legacy single-slot fields from before the region split. They
    * predate international support and are read as the CN region's state when
@@ -2584,24 +2841,36 @@ interface Config {
   models?: TraeModelInfo[];
 }
 /**
- * One region's saved state. A config written before the region split has only
+ * One panel's saved state. A config written before the region split has only
  * the flat fields: those were always captured from the CN endpoint (the
  * plugin had no international support), so they are read as the CN state and
  * only when no explicit CN slot exists. The ai region never inherits them —
  * that inheritance is exactly the bug where a stale CN directory would be
  * intersected with the international catalog and silently drop the user's
  * picks (the same failure workbuddy fixed with its region split).
+ *
+ * Keyed by PANEL (`cn` | `enterprise` | `ai`), because each panel carries its
+ * own switch, account binding and model selection. `enterprise` has no legacy
+ * equivalent: it starts from an EMPTY state (its own directory, its own model
+ * picks) and never inherits CN's, so switching it on cannot silently activate
+ * a model list the user never chose for the tenant pool.
  */
-declare function regionStateOf(config: Config, region: TraeRegion): TraeRegionState;
+declare function regionStateOf(config: Config, panel: TraePanel): TraeRegionState;
 /**
- * Whether one region's provider is switched on (issue #11). Opt-out semantics:
+ * Whether one panel's provider is switched on (issue #11). Opt-out semantics:
  * only an explicit `false` disables it, so every config written before this
  * switch existed — including the pre-region-split flat fields, which never
  * carry `enabled` — keeps both providers running exactly as before. The card
  * reads the same rule through `regionEnabledOf`, so the two halves can never
  * disagree about a region's state.
+ *
+ * The ENTERPRISE panel is the one deliberate exception: it defaults OFF. A
+ * consumer-only account (`tenant 7o2d894p7dr0o4`) cannot use that pool at all,
+ * so opting every existing user into a second CN provider would put a route in
+ * their model picker that fails on first use. It is switched on from its card
+ * tab, by someone whose account actually belongs to a tenant.
  */
-declare function regionEnabled(config: Config, region: TraeRegion): boolean;
+declare function regionEnabled(config: Config, panel: TraePanel): boolean;
 /**
  * WHERE one region's credit readout sits (learned from workbuddy #62).
  *
@@ -2632,4 +2901,4 @@ declare function asVolatile<S>(schema: S): S;
 declare const Config: z<Config>;
 declare function apply(ctx: Context$1, config: Config): void;
 //#endregion
-export { Config, FALLBACK_TRAE_MODELS, FALLBACK_TRAE_MODELS_AI, type PiAiGeneration, type PiAiRuntimeInfo, REGION_GATEWAYS, type RawChatDelta, type RawChatMessage, type RawChatTool, SseDecoder, type SseEvent, TRAE_ACCOUNT_STATUS_PATH, TRAE_AI_PROVIDER, TRAE_CHECKIN_PATH, TRAE_CN_AGENT_TASK_PATH, TRAE_CN_TITLE_PATH, TRAE_MODELS_TEST_PATH, TRAE_MODEL_DETAIL_FUNCTIONS, TRAE_MODEL_DETAIL_PATH, TRAE_PAY_BASE, TRAE_PROBE_TIMEOUT_MS, TRAE_PROVIDER, TRAE_PROVIDERS, TRAE_PROVIDER_DISPLAY_NAMES, TRAE_RAW_CHAT_V1_PATH, TRAE_RAW_CHAT_V2_PATH, TRAE_REASONING_EFFORTS, TRAE_REGIONS, TRAE_REGION_PARAM, TRAE_SETTINGS_NS, TRAE_SOLO_CHAT_PATH, TRAE_SOLO_FUNCTION, TRAE_SOLO_MODELS_PATH, TRAE_SOLO_REMOTE_BASE, TRAE_STATE_DB_FILENAME, TRAE_STREAM_IDLE_TIMEOUT_MS, TRAE_USAGE_PATH, TRAE_VERSION_CODE_FALLBACK, type TraeActivityRule, type TraeAdapter, type TraeCachedModelConfig, TraeCatalog, type TraeChatResult, type TraeCheckinClaim, type TraeCheckinStatus, type TraeContextBudget, type TraeCredential, TraeCredentialStore, TraeDelegatingUpstreamClient, type TraeDiscoveredModel, type TraeDiscoveredReasoning, type TraeEdition, TraeFallbackUpstreamClient, type TraeFallbackUpstreamOptions, type TraeFusionRawChatEnvelope, TraeGatedUpstreamClient, type TraeGatedUpstreamOptions, type TraeIdentity, type TraeInputModality, type TraeModelDetailRequest, type TraeModelInfo, type TraeModelProbeVerdict, type TraeModelsTestResponse, type TraeObservedModelConfig, type TraeProbeResult, type TraeProbeVerdict, TraeRawCapabilityController, type TraeRawCapabilityControllerOptions, type TraeRawCapabilitySnapshot, TraeRawCapabilityState, type TraeRawChatBehaviorConfig, type TraeRawChatCapability, type TraeRawChatClientOptions, type TraeRawChatConfig, type TraeRawChatFailureReason, type TraeRawChatRuntimeConfig, TraeRawChatUpstreamClient, type TraeRawDiagnostic, type TraeRawDiagnosticState, type TraeRawGateway, type TraeRawGatewayOptions, type TraeRawResolverResult, type TraeReasoningCapability, type TraeReasoningEffort, type TraeRefreshDevice, type TraeRegion, type TraeRegionGateways, TraeRegionState, type TraeShim, TraeSoloBridge, type TraeSoloClientOptions, TraeSoloRemoteCatalogClient, type TraeSoloRemoteCatalogOptions, TraeSoloUpstreamClient, type TraeStorageCandidate, type TraeStreamEvent, type TraeUpstreamClient, TraeUsageClient, type TraeUsageOptions, type TraeUsagePack, type TraeUsageRouteOptions, type TraeUsageSnapshot, type TraeUsageSummary, type TraeUsageView, type TraeWebAccountState, type TraeWebActivity, type TraeWebAppLogin, type TraeWebCheckin, type TraeWebCheckinClaim, type TraeWebCredits, type TraeWebUsage, type TraeWireModel, UnconfiguredTraeUpstreamClient, adaptLegacyPiAiContext, adaptModernPiAiContext, apply, applyContextBudgets, applyImageSelection, applyReasoningEffort, asVolatile, bridgeTraeSoloStream, buildTraeAgentTaskBody, buildTraeCnHeaders, buildTraeFusionRawChatEnvelope, buildTraeModelDetailRequest, buildTraeRawChatDraft, buildTraeRawChatRuntimeConfig, classifyProbeError, classifyProbeResult, classifyTraeRawChatFailure, configuredAccountsOf, createTraeAdapter, createTraeRawGateway, createTraeShim, creditPosition, decidePiAiGeneration, decodeRawChatChunk, decodeTraeEvent, decryptTraeStorageValue, deriveCatalog, describeIdShape, describeNameShape, discoveredCatalog, fallbackModelsFor, followAppLoginEnabled, generationOf, hashTraeRawChatArg, identityHeaders, inject, legacyTraeOwnAuthPath, maskUserPath, mergeTraeModelSources, name, nextRegionCreditPosition, nextRegionEnabled, nextRegionSlots, normalizeTraeCredential, normalizeTraeVersionCode, parseObservedModelConfig, parseReasoningCapability, parseTraeAuthValue, parseTraeCachedModel, parseTraeModelExtraConfigLogLine, parseTraeRawChatBehaviorConfig, parseTraeRemoteModel, parseTraeStorageDocument, piAiRuntimeInfo, pickTraeStorageIdentity, prepareSoloBody, probeBody, probeModelsSequentially, probeOneModel, probeTraeRawChatCapability, rawCapabilityDiagnostic, rawCapabilityFingerprint, readTraeCachedModel, readTraeCliIdentity, readTraeIdentity, refreshTraeCredential, regionCreditPositionOf, regionEnabled, regionEnabledOf, regionOfCredential, regionOfEdition, regionOfHost, regionOfTraeProvider, regionOfTraeStatusUrl, regionOfUserRegion, regionStateOf, registerTraeUsageRoute, resolveTraeIdentity, resolveTraeRawRuntime, sanitizeCatalog, settingsNamespaceOf, traeEndpoint, traeInputModalities, traeModelDisplayName, traeOwnAuthPath, traeRawChatExtraInfo, traeStateDatabaseCandidates, traeStorageCandidates, traeWebUsage, traeWindowsAppNames, unwrapVolatile, unwrapVolatileDeep, withContextAdaptation, withTraeRegion };
+export { Config, FALLBACK_TRAE_MODELS, FALLBACK_TRAE_MODELS_AI, type PiAiGeneration, type PiAiRuntimeInfo, REGION_GATEWAYS, type RawChatDelta, type RawChatMessage, type RawChatTool, SseDecoder, type SseEvent, TRAE_ACCOUNT_STATUS_PATH, TRAE_AI_PROVIDER, TRAE_CHECKIN_PATH, TRAE_CN_AGENT_TASK_PATH, TRAE_CN_TITLE_PATH, TRAE_ENTERPRISE_PROVIDER, TRAE_MODELS_TEST_PATH, TRAE_MODEL_DETAIL_FUNCTIONS, TRAE_MODEL_DETAIL_PATH, TRAE_PANELS, TRAE_PAY_BASE, TRAE_PROBE_TIMEOUT_MS, TRAE_PROVIDER, TRAE_PROVIDERS, TRAE_PROVIDER_DISPLAY_NAMES, TRAE_PROVIDER_IDS, TRAE_PROVIDER_ID_DISPLAY_NAMES, TRAE_PROVIDER_ROUTES, TRAE_RAW_CHAT_V1_PATH, TRAE_RAW_CHAT_V2_PATH, TRAE_REASONING_EFFORTS, TRAE_REGIONS, TRAE_REGION_PARAM, TRAE_SETTINGS_NS, TRAE_SOLO_CHAT_PATH, TRAE_SOLO_FUNCTION, TRAE_SOLO_MODELS_PATH, TRAE_SOLO_REMOTE_BASE, TRAE_STATE_DB_FILENAME, TRAE_STREAM_IDLE_TIMEOUT_MS, TRAE_USAGE_PATH, TRAE_VERSION_CODE_FALLBACK, type TraeActivityRule, type TraeAdapter, type TraeCachedModelConfig, TraeCatalog, type TraeChatResult, type TraeCheckinClaim, type TraeCheckinStatus, type TraeContextBudget, type TraeCredential, TraeCredentialStore, TraeDelegatingUpstreamClient, type TraeDiscoveredModel, type TraeDiscoveredReasoning, type TraeEdition, type TraeFailure, TraeFallbackUpstreamClient, type TraeFallbackUpstreamOptions, type TraeFusionRawChatEnvelope, TraeGatedUpstreamClient, type TraeGatedUpstreamOptions, type TraeIdentity, type TraeInputModality, type TraeModelDetailRequest, type TraeModelInfo, type TraeModelProbeVerdict, type TraeModelsTestResponse, type TraeObservedModelConfig, type TraePanel, type TraeProbeResult, type TraeProbeVerdict, type TraeProviderRoute, TraeRawCapabilityController, type TraeRawCapabilityControllerOptions, type TraeRawCapabilitySnapshot, TraeRawCapabilityState, type TraeRawChatBehaviorConfig, type TraeRawChatCapability, type TraeRawChatClientOptions, type TraeRawChatConfig, type TraeRawChatFailureReason, type TraeRawChatRuntimeConfig, TraeRawChatUpstreamClient, type TraeRawDiagnostic, type TraeRawDiagnosticState, type TraeRawGateway, type TraeRawGatewayOptions, type TraeRawResolverResult, type TraeReasoningCapability, type TraeReasoningEffort, type TraeRefreshDevice, type TraeRegion, type TraeRegionGateways, TraeRegionState, type TraeShim, TraeSoloBridge, type TraeSoloClientOptions, TraeSoloRemoteCatalogClient, type TraeSoloRemoteCatalogOptions, TraeSoloUpstreamClient, type TraeStorageCandidate, type TraeStreamEvent, type TraeUpstreamClient, TraeUsageClient, type TraeUsageOptions, type TraeUsagePack, type TraeUsageRouteOptions, type TraeUsageSnapshot, type TraeUsageSummary, type TraeUsageView, type TraeWebAccountState, type TraeWebActivity, type TraeWebAppLogin, type TraeWebCheckin, type TraeWebCheckinClaim, type TraeWebCredits, type TraeWebUsage, type TraeWireModel, UnconfiguredTraeUpstreamClient, adaptLegacyPiAiContext, adaptModernPiAiContext, apply, applyContextBudgets, applyImageSelection, applyReasoningEffort, asVolatile, bridgeTraeSoloStream, buildTraeAgentTaskBody, buildTraeCnHeaders, buildTraeFusionRawChatEnvelope, buildTraeModelDetailRequest, buildTraeRawChatDraft, buildTraeRawChatRuntimeConfig, classifyProbeError, classifyProbeResult, classifyTraeRawChatFailure, configuredAccountsOf, createTraeAdapter, createTraeRawGateway, createTraeShim, creditPosition, decidePiAiGeneration, decodeRawChatChunk, decodeTraeEvent, decryptTraeStorageValue, deriveCatalog, describeIdShape, describeNameShape, describeTraeFailure, discoveredCatalog, displayNameOfTraeProvider, fallbackModelsFor, followAppLoginEnabled, generationOf, hashTraeRawChatArg, identityHeaders, inject, isEnterpriseAccount, legacyTraeOwnAuthPath, maskUserPath, mergeTraeModelSources, name, nextRegionCreditPosition, nextRegionEnabled, nextRegionSlots, normalizeTraeCredential, normalizeTraeVersionCode, panelOfKey, panelOfProvider, parseObservedModelConfig, parseReasoningCapability, parseTraeAuthValue, parseTraeCachedModel, parseTraeModelExtraConfigLogLine, parseTraeRawChatBehaviorConfig, parseTraeRemoteModel, parseTraeStorageDocument, piAiRuntimeInfo, pickTraeStorageIdentity, prepareSoloBody, probeBody, probeModelsSequentially, probeOneModel, probeTraeRawChatCapability, providerOfPanel, rawCapabilityDiagnostic, rawCapabilityFingerprint, readTraeCachedModel, readTraeCliIdentity, readTraeIdentity, refreshTraeCredential, regionCreditPositionOf, regionEnabled, regionEnabledOf, regionOfCredential, regionOfEdition, regionOfHost, regionOfPanel, regionOfTraeProvider, regionOfTraeStatusUrl, regionOfUserRegion, regionStateOf, registerTraeUsageRoute, resolveTraeIdentity, resolveTraeRawRuntime, routeOfTraeProvider, sanitizeCatalog, settingsNamespaceOf, traeEndpoint, traeInputModalities, traeModelDisplayName, traeOwnAuthPath, traeRawChatExtraInfo, traeStateDatabaseCandidates, traeStorageCandidates, traeWebUsage, traeWindowsAppNames, unwrapVolatile, unwrapVolatileDeep, withContextAdaptation, withTraeRegion };