dsh-connect-trae 3.7.0 → 3.9.1

package/lib/index.d.ts

@@ -61,6 +61,29 @@ declare function traeStorageCandidates(platform?: NodeJS.Platform, home?: string
 //#region src/region.d.ts
 /** Storage/routing bucket: the CN service or the international (ai) service. */
 type TraeRegion = 'cn' | 'ai';
+/**
+ * One section of the plugin card: a provider the user can switch, bind an
+ * account to, and pick models for, INDEPENDENTLY.
+ *
+ * A panel is not a region. `cn` and `ai` happen to be one-to-one with regions,
+ * but the CN enterprise pool shares the `cn` credential while billing a
+ * different account and serving a different roster — it needs its own switch,
+ * its own account binding and its own model selection, which is exactly what a
+ * panel is. Keeping panels a separate concept from regions is what lets
+ * `enterprise` be handled by the same settings plumbing with no new storage
+ * shape: each panel is just one more slot in the `regions` map.
+ */
+type TraePanel = 'cn' | 'ai' | 'enterprise';
+/** Every panel, in card tab order. */
+declare const TRAE_PANELS: readonly TraePanel[];
+/** The region whose credential/account pool a panel draws on. */
+declare function regionOfPanel(panel: TraePanel): TraeRegion;
+/** The provider id a panel publishes. */
+declare function providerOfPanel(panel: TraePanel): string;
+/** The panel that owns a provider id, or undefined for an unknown id. */
+declare function panelOfProvider(provider: string): TraePanel | undefined;
+/** Narrow a stored settings key to a panel. */
+declare function panelOfKey(value: unknown): TraePanel | undefined;
 /** One region's upstream gateway bases. */
 interface TraeRegionGateways {
   /** Chat + agent API base (the `llm_utils_chat` / raw-chat family). */
@@ -191,8 +214,15 @@ declare function traeInputModalities(model: Pick<TraeModelInfo, 'input'>): TraeI
  * (wire resolution, callable-key filtering) must keep matching the
  * undecorated name; only the model rows handed to DSH (adapter catalog and
  * model discovery) use this decorated name.
+ *
+ * `withRate` is false for the ENTERPRISE panel. The multiplier is a
+ * consumer-pool figure — personal credits per token, read from the consumer
+ * directory — and the tenant pool does not bill against it, so printing it in
+ * the model picker would price a model the tenant is not charged for. The rate
+ * is part of the NAME that reaches DSH, which is why this is a parameter here
+ * and not a rendering decision downstream.
  */
-declare function traeModelDisplayName(model: Pick<TraeModelInfo, 'name' | 'creditMultiplier'>): string;
+declare function traeModelDisplayName(model: Pick<TraeModelInfo, 'name' | 'creditMultiplier'>, withRate?: boolean): string;
 /** Apply the user's explicit image opt-ins plus Trae's own multimodal flag. */
 declare function applyImageSelection(models: readonly TraeModelInfo[], selected: ReadonlySet<string>): TraeModelInfo[];
 /** One row from `get_detail_param`: the authoritative llm_utils_chat wire id + display name. */
@@ -296,167 +326,1036 @@ declare class TraeCatalog {
   set(models: readonly TraeModelInfo[]): void;
 }
 //#endregion
-//#region src/pi-ai-runtime.d.ts
+//#region src/status-paths.d.ts
+/** Plugin-owned usage endpoint consumed by its browser half. */
+declare const TRAE_USAGE_PATH = "/plugins/dsh-connect-trae/usage";
 /**
- * Which `@earendil-works/pi-ai` copy THIS plugin resolves at runtime, and which
- * context shape that copy consumes (issue #27).
- *
- * WHY THIS EXISTS. The plugin declares pi-ai as a peer, so the module it
- * imports is whatever the install provides — and the two generations consume
- * DIFFERENT context shapes:
- *
- * - **modern** (0.86+): every public entry point calls `normalizeContext()`
- *   once, so what reaches a provider is a normalized *transcript*:
- *   `{ messages: [ { role: 'system', content, toolsAdded }, … ] }`. The system
- *   prompt and the tool declarations live ONLY on that leading system message;
- *   the top-level `systemPrompt` / `tools` fields are gone, and the api never
- *   reads them back.
- * - **legacy** (≤0.85): expects `{ systemPrompt, tools, messages }` and has no
- *   branch for a `system` message inside `messages` at all. Its token estimator
- *   crashes on one — `estimateMessageTokens` iterates the string `content`
- *   character by character and reads `.name` off a character — and its wire
- *   converter silently drops it.
- *
- * The mismatch is reachable in BOTH directions, because DSH itself spans both
- * generations (`dsh-llm-pi-ai` ≤0.2.0-rc.1 declares `^0.85.1`; 0.2.0-rc.2 and
- * later declare `^0.87.1`, 0.2.1-alpha.2 declares `^1.0.2`, and 0.2.1-rc.1 —
- * the current desktop host — declares **`^1.1.0`**, which also stopped reading
- * the top-level fields entirely), while this plugin accepts the whole range
- * (`>=0.1.7-rc.1 <0.3.0-0`). Whichever side is newer, the other one is wrong:
- *
- * | host | resolved api | outcome |
- * |---|---|---|
- * | legacy | legacy | fine |
- * | legacy | modern | no crash, but prompt + tools silently LOST |
- * | modern | legacy | CRASH: `Cannot read properties of undefined (reading 'length')` |
- * | modern | modern | fine |
- *
- * THE BOUNDARY IS 0.86, NOT 0.87. Checked against the published tarballs:
- * `dist/utils/transcript.js` — and with it `normalizeContext`, the
- * `role === 'system'` estimator branch, and the switch away from reading
- * `systemPrompt`/`tools` — first appears in **0.86.0**. A `>= 0.87` gate
- * misclassifies 0.86.x as legacy and folds a context the modern api consumes
- * natively, which deletes the only carrier of the prompt and the tools.
+ * Plugin-owned availability probe: POST the model ids to test, get one verdict
+ * per model. Unlike every read-only sibling this route SPENDS quota — a real
+ * (minimal) chat call per model — so it is user-initiated only, and the card
+ * labels the button as consuming a small amount.
+ */
+declare const TRAE_MODELS_TEST_PATH = "/plugins/dsh-connect-trae/models/test";
+/**
+ * Per-account status (check-in / credits / subscription) for the account table.
  *
- * HOW the generation is decided, in order:
+ * Each row of the account table reads its OWN state through this route — a CN
+ * row carries its check-in state and balance, an ai row its subscription.
+ * POST with the accountId in the body: one upstream read per account, paid
+ * only when the table is actually shown.
+ */
+declare const TRAE_ACCOUNT_STATUS_PATH = "/plugins/dsh-connect-trae/account-status";
+/**
+ * Plugin-owned daily check-in claim endpoint. POST, loopback-only, and the only
+ * route in this plugin that changes upstream account state. The accountId in
+ * the body names WHICH account to claim for, so the button can sit in each
+ * account row.
+ */
+declare const TRAE_CHECKIN_PATH = "/plugins/dsh-connect-trae/checkin";
+/**
+ * Outcome vocabulary of one account probe, shared by the Host and the card.
  *
- * 1. **The manifest version** of the copy this plugin resolved. Numeric semver
- *    comparison (`minor >= 86`), so `0.86.0` and the already-shipped `1.x` line
- *    both land on modern, and `0.9.0` correctly sorts below `0.86.0`.
- * 2. **The package's own layout**, when no version could be read: the transcript
- *    module sits at `dist/utils/transcript.js` (the exports map's
- *    `"./utils/*" → "./dist/utils/*.js"` convention is identical in every
- *    published generation, 0.82 through 1.x).
+ * Mirrors `TraePoolOutcome` in `./account-pool.ts`, and is DECLARED again here
+ * rather than imported for the same reason workbuddy repeats it: this module is
+ * the node-free bridge for the browser build target and must not pull in the
+ * Host-side pool module (which imports the credential type). The two lists must
+ * stay in step — the card renders one label per value, and a value Host can send
+ * that the card has no label for renders as the raw token.
  *
- * Both checks are deliberately resolver-independent. `import.meta.resolve()` is
- * NOT used to answer this question: bundler-style resolvers (vite, and equally
- * `vitest` under it) expand the `"./utils/*"` wildcard to a path and return it
- * WITHOUT checking that the file exists, so a probe built on it answers "modern"
- * for 0.85.1 — the exact false positive that would leave issue #27 unfixed while
- * claiming to be capability-based. Reading the package directory cannot be
- * fooled that way.
+ * `plan-gated` is Trae-only (upstream `1005`: this ACCOUNT's plan does not cover
+ * the model) and has no workbuddy counterpart.
+ */
+type TraeWebPoolOutcome = 'ok' | 'rate-limited' |
+/**
+ * The MODEL is loaded, not the account.
  *
- * The version is therefore the primary signal, and it also keeps the gate
- * forward-compatible for free: a future 2.x needs no change here, whereas a
- * file-name check alone would have to know about it.
+ * Kept apart from `rate-limited` because the two need OPPOSITE advice:
+ * `rate-limited` is this account's volume wall (wait, or bill another account),
+ * while `model-busy` follows the model everywhere — every account hits the same
+ * wall, so switching only spends a request per account to learn what the first
+ * already said.
+ */
+'model-busy' | 'out-of-credit' | 'credential-rejected' | 'policy-rejected' | 'plan-gated' | 'unavailable' | 'not-found' | 'failed';
+/** Why one account is currently out of the pool. */
+type TraeWebPoolExclusion = 'unusable' | 'rate-limited' | 'model-busy' | 'out-of-credit' | 'credential-rejected' | 'policy-rejected' | 'plan-gated' | 'not-found' | 'unavailable' | 'failed';
+/**
+ * One account's row in the pool, as the card renders it.
  *
- * @module dsh-connect-trae/pi-ai-runtime
+ * Ties together the three facts the card shows per account — credits, the last
+ * test, and whether it can serve right now — so the ranking the card displays
+ * comes from ONE Host answer rather than being re-derived in the browser. The
+ * browser re-deriving it is how a card ends up calling an excluded account "in
+ * use", which is the inconsistency this document exists to prevent.
  */
-/** The context generation a resolved pi-ai api module speaks. */
-type PiAiGeneration = 'legacy' | 'modern';
-/** What {@link piAiRuntimeInfo} reports about the resolved pi-ai copy. */
-interface PiAiRuntimeInfo {
-  /** `modern` (0.86+: consumes normalized transcripts) or `legacy` (≤0.85 shape). */
-  generation: PiAiGeneration;
-  /** Version of the resolved copy, when the manifest could be read. */
-  version: string | undefined;
-  /** Package directory of the resolved copy, when it could be located. */
-  resolvedFrom: string | undefined;
+interface TraeWebPoolAccount {
+  accountId: string;
+  accountName: string;
+  /** Total remaining credit, absent when this account's balance read failed. */
+  credits?: number;
   /**
-   * Whether the copy could be inspected at all. `false` means pi-ai does not
-   * resolve from this plugin — the normal state of a market install probed
-   * OUTSIDE the DSH host, where the host supplies the module at plugin runtime.
-   * Inside DSH the copy is always inspectable: a nested one shadows host
-   * injection, and without a nested one the host supplies its own.
+   * The GENERAL bucket — the credit this plugin's chat can actually spend.
+   *
+   * Trae-only, because a Trae balance is TWO buckets and SOLO chat only drains
+   * General (measured on the live `available_endpoint` split). A row whose total
+   * looks rich but whose General reads zero cannot serve a request, which is the
+   * same trap workbuddy hit with its expiry rule: a ranking keyed on a figure that
+   * the billing path cannot reach is not a ranking. The card shows both.
    */
-  inspected: boolean;
+  generalAvailable?: number;
+  /** The WORK bucket, kept for display: this plugin's chat never spends it. */
+  workAvailable?: number;
+  /** Credit lapsing inside 3 days. Zero means "measured, nothing at risk". */
+  expiringSoon?: number;
+  /** When the nearest pack lapses, epoch ms. */
+  nearestExpiryMs?: number;
+  /**
+   * This account's stored access token has lapsed, so its balance cannot be read
+   * until it is refreshed or the user signs in again.
+   *
+   * A reason for the dash, not a second dash: without it "0 credit" and "cannot
+   * read the balance" look identical on the card, and only one of them is the
+   * user's problem to fix.
+   */
+  tokenExpired?: boolean;
+  /**
+   * The last test of this account, absent when never tested.
+   *
+   * `modelId` lives INSIDE the measurement rather than being assumed from the
+   * row's current setting: the setting can change after the test, and a result
+   * must keep naming what it actually measured.
+   */
+  probe?: {
+    outcome: TraeWebPoolOutcome;
+    atMs: number;
+    /**
+     * What wrote this measurement, so the card can explain a change the user
+     * watched happen: `test-batch` is a deliberate test, `live-request` is a real
+     * request that failed and overwrote it. ABSENT for records written before the
+     * field existed — the card must then say "unknown", not guess.
+     */
+    source?: 'test-batch' | 'live-request';
+    /** WHICH model this measurement is about; absent = unknown scope. */
+    modelId?: string;
+    /** Only when the upstream named a time; never invented locally. */
+    retryAtMs?: number;
+    /** Upstream's own words, already redacted. Absent on success. */
+    message?: string;
+  };
+  /** Set when this account cannot serve right now. */
+  excludedBy?: TraeWebPoolExclusion;
+  /**
+   * Whether this is the account billing traffic for this panel RIGHT NOW.
+   *
+   * The pool's runtime pick when enabled, else the saved selection. It is the
+   * HOST's answer, not the card's guess: a card that derived "in use" from the
+   * saved setting would contradict the pool after a rotation.
+   */
+  current: boolean;
+  /**
+   * Whether the user checked this account into this panel's pool.
+   *
+   * Listed rows include UNCHECKED accounts so the card can offer them to check:
+   * membership is an explicit opt-in and a user can only opt in to something they
+   * can see. Only checked rows can bill or be batched.
+   */
+  member: boolean;
+  /**
+   * Whether this machine still holds a usable sign-in for the account.
+   *
+   * `false` marks a GHOST: checked or listed, but no local credential resolves, so
+   * a batch can neither test it nor check it in. It is kept as a row (rather than
+   * filtered out) because the only way to stop carrying a broken entry is to see
+   * it and remove it — a filtered row would leave the saved list permanently dirty
+   * with nothing on screen to explain why the pool runs on fewer accounts than the
+   * checkbox count says.
+   */
+  reachable?: boolean;
+  /**
+   * Today's check-in state for this account.
+   *
+   * ABSENT means it was not read — the card must then say so rather than render a
+   * definite "not checked in", which would contradict a claim the user just
+   * watched succeed.
+   */
+  checkedInToday?: boolean;
+  /**
+   * Whether today's check-in is spent on this MACHINE for this account.
+   *
+   * Trae-only, because Trae keys the daily claim to `x-device-id` (code `9095`).
+   * `checkedInToday === false` together with this true is the "switched account"
+   * case the check-in card already documents: this device has no claim left.
+   */
+  deviceCheckedIn?: boolean;
 }
-/** Resolve (once) which pi-ai copy this plugin runs against. */
-declare function piAiRuntimeInfo(): PiAiRuntimeInfo;
 /**
- * The generation decision table, exported so every branch is pinned by tests
- * rather than by a comment here — including the two this development tree can
- * never reach (no local copy, and a copy with no readable version), which are
- * exactly the states a market install founds its gate on.
+ * The pool's state for one panel.
  *
- * @param version - manifest version of the resolved copy, if readable.
- * @param transcriptPresent - whether that copy actually ships
- *   `dist/utils/transcript.js`; `undefined` when nothing was inspected.
+ * `targetModelId`/`targetModelSource` exist so the card can state WHICH model a
+ * test would use and WHERE that choice came from. `none` is a real, common
+ * answer for Trae — the CN static fallback catalog carries no `creditMultiplier`
+ * at all until its first live refresh, and "missing multiplier ≠ free" means the
+ * card must render "no free model" rather than silently substituting a paid one.
  */
-declare function decidePiAiGeneration(version: string | undefined, transcriptPresent: boolean | undefined): PiAiGeneration;
+interface TraeWebPool {
+  enabled: boolean;
+  /**
+   * Whether this panel offers the daily check-in at all.
+   *
+   * Only `cn` does. The ai gateways answer 404 for the whole `/trae/api/v2/ug/*`
+   * family (probed 2026-09-24) and the enterprise panel has no personal reward,
+   * so the card hides the action entirely rather than rendering a button whose
+   * only outcome is a refusal.
+   */
+  checkinSupported: boolean;
+  /** The model a test would use right now; absent when none can be resolved. */
+  targetModelId?: string;
+  /**
+   * Where the target came from. `'stale'` means the SAVED id is no longer in the
+   * catalog — a distinct state from `'none'` (no free model exists), because the
+   * two need opposite advice (offer a way back to automatic / say there is no
+   * free model at all).
+   */
+  targetModelSource: 'preferred' | 'free' | 'none' | 'stale';
+  /**
+   * How much text a pool test sends (0 = the minimal probe). Always a number so
+   * the card's select has a value to show; the saved preference is the default.
+   */
+  probeInputTokens: number;
+  /** The saved target id that this panel's catalog no longer offers. */
+  staleTargetModelId?: string;
+  /** The account ids the user has checked into this panel's pool. */
+  memberAccountIds?: readonly string[];
+  /**
+   * The subset of {@link TraeWebPool.memberAccountIds} that resolves to a real
+   * local credential — i.e. what a batch actually runs on.
+   *
+   * Sent so the card never re-derives it. Counting the raw saved list is what
+   * lets a UI claim "1 of 1 selected" and enable both buttons while the Host ran
+   * on ZERO accounts and reported success.
+   */
+  effectiveMemberAccountIds?: readonly string[];
+  /**
+   * Last measured display name per saved member id, including members that have
+   * since stopped resolving.
+   *
+   * A member whose sign-in disappeared would otherwise be listed as a bare id
+   * and an unexplained count, and the user could not tell WHICH one they unchecked.
+   */
+  memberNames?: Record<string, string>;
+  /** Rows in the Host's ranking order: candidates first, excluded rows last. */
+  accounts: readonly TraeWebPoolAccount[];
+  /**
+   * Why the pool could not pick anybody, when it could not.
+   *
+   * Set when every member is excluded, so the card can explain that traffic is
+   * going to the saved selection rather than leaving the user to assume the pool
+   * is serving the top row.
+   */
+  noCandidate?: TraeWebPoolExclusion | 'empty';
+}
 /**
- * The generation a version string belongs to, or `undefined` when the string
- * cannot be read as a version at all.
+ * The pool's saved preferences for one panel, as stored in `regions[panel].pool`.
  *
- * Only the minor of the `0.x` line matters for the boundary, and `major >= 1`
- * is modern by definition (1.0.x is already in use by `dsh-llm-pi-ai@0.2.1-alpha.2`
- * and consumes transcripts natively).
+ * Declared in the node-free bridge because BOTH halves touch it: the Host reads
+ * it to decide membership and ranking, the card drafts and saves it. Keeping one
+ * declaration is what stops the card from writing a field the Host ignores (or
+ * vice versa) — the failure workbuddy hit when its client and Host each had a
+ * private copy of this shape.
+ *
+ * Every field is optional because this is a user-edited draft: a partially filled
+ * slot must still load, and a missing `enabled` means OFF rather than ON.
  */
-declare function generationOf(version: string | undefined): PiAiGeneration | undefined;
-//#endregion
-//#region src/upstream.d.ts
-type TraeUpstreamErrorKind = 'authentication' | 'hard_credit' | 'soft_rate' | 'not_found' | 'server' | 'client' | 'unconfigured';
-type TraeChatResult = {
-  ok: true;
-  response: Response;
-} | {
-  ok: false;
-  status: number;
-  kind: TraeUpstreamErrorKind;
-  message: string;
-};
-interface TraeUpstreamClient {
-  chatStream(bodyJson: string, signal?: AbortSignal): Promise<TraeChatResult>;
+interface TraePoolPreferences {
+  /** Whether this panel bills through the pool at all. Default OFF. */
+  enabled?: boolean;
+  /**
+   * The model a test batch probes. Absent or `''` means "automatic": pick the
+   * free model (see `pickFreeModel` in `./account-pool.ts`). An id this panel no
+   * longer offers is PRESERVED so the user's choice survives a catalog blip, and
+   * reported as `stale` rather than silently replaced.
+   */
+  targetModelId?: string;
+  /**
+   * The accounts the user checked into this panel's pool, in the order they were
+   * checked.
+   *
+   * Explicit opt-in with NO default: an account never joins the pool because it
+   * exists. Order is only a display hint — the ranking is the Host's.
+   *
+   * A MUTABLE array, not `readonly`: this interface is also the shape the
+   * settings schema declares (`z.array(z.string())`), and the schema rebuilds the
+   * config document on every save — a readonly type there is a compile-time
+   * mismatch that would take the whole Config schema down. Readers still treat it
+   * as immutable; only the owner of a draft copies it.
+   */
+  memberAccountIds?: string[];
+  /**
+   * How much text a pool TEST sends, in tokens. `0` (the default) keeps the
+   * minimal one-word probe.
+   *
+   * Exists because a verdict earned by a one-word request says nothing about the
+   * long turn the user is about to send: an upstream that refuses large requests
+   * answers the small one happily. Padding the probe therefore buys a truthful
+   * "works at my size" answer at the cost of spending real credit per test.
+   */
+  probeInputTokens?: number;
 }
+/** Query parameter naming the region a card request addresses. */
+declare const TRAE_REGION_PARAM = "region";
+/** Every region, in card tab order. */
+declare const TRAE_REGIONS: readonly TraeRegion[];
 /**
- * Safe first-stage upstream. Real Trae traffic stays disabled until one
- * edition-specific endpoint and wire codec are verified with fixtures.
+ * Address one region's status route. The two regions are separate provider
+ * stacks; every card request carries the region whose tab the user is on.
  */
-declare class UnconfiguredTraeUpstreamClient implements TraeUpstreamClient {
-  chatStream(_bodyJson: string, _signal?: AbortSignal): Promise<TraeChatResult>;
-}
-//#endregion
-//#region src/shim.d.ts
-interface ShimLogger {
-  warn(...args: unknown[]): void;
-  error(...args: unknown[]): void;
-}
-interface TraeShim {
-  ready: Promise<void>;
-  baseUrl(): string;
-  token(): string;
-  close(): Promise<void>;
+declare function withTraeRegion(path: string, panel: TraePanel): string;
+/**
+ * Read the region parameter off a status-route URL. Absent means the domestic
+ * tab (`cn`); a present-but-unknown value returns undefined so the route can
+ * answer 400 instead of guessing.
+ */
+declare function regionOfTraeStatusUrl(url: string): TraePanel | undefined;
+/** One credit pack and its remaining credit. */
+interface TraeWebCreditAccount {
+  displayDesc: string;
+  remain: number;
+  size: number;
+  /**
+   * When this pack lapses, in epoch milliseconds, taken from the upstream's own
+   * `end_time`. Absent when the upstream reported no usable time (0 / missing),
+   * so a consumer can tell "no date" apart from "1970".
+   */
+  expiresAtMs?: number;
+  /**
+   * Raw upstream `available_endpoint`: which bucket this pack lives in.
+   *
+   * Measured on the live response — `0` is the GENERAL bucket that SOLO chat
+   * actually spends, `1` is the WORK bucket it cannot reach. The projection
+   * dropped this field until the account pool needed it: the pool ranks accounts
+   * by what they can SERVE, and credit lapsing in the WORK bucket is not a
+   * reason to bill that account first, because nothing here can ever spend it.
+   * Absent, not guessed, when the upstream omits it.
+   */
+  endpoint?: number;
 }
-interface TraeShimOptions {
-  catalog: TraeCatalog;
-  client: TraeUpstreamClient;
-  logger?: ShimLogger;
+/** Credit lapsing inside one horizon, as the card reports it. */
+interface TraeWebExpiringCredits {
+  /** Sum of the contributing packs' remaining credit. */
+  total: number;
+  /** How many packs contribute. */
+  packs: number;
+  /** Soonest expiry among them, epoch milliseconds. */
+  earliestExpiresAtMs?: number;
 }
-declare function createTraeShim(options: TraeShimOptions): TraeShim;
-//#endregion
-//#region src/adapter.d.ts
-/** Provider route this bundle owns for the domestic (CN) gateway. */
-declare const TRAE_PROVIDER = "trae";
 /**
- * Provider route this bundle owns for the international (trae.ai) gateway.
- * Named `-global` to match the plugin family's convention (`workbuddy-global`);
- * the internal region bucket stays `ai`, which is the gateway/protocol name.
- */
-declare const TRAE_AI_PROVIDER = "trae-global";
-/** The provider id each region registers as. */
-declare const TRAE_PROVIDERS: Readonly<Record<TraeRegion, string>>;
-/** Human-readable provider names, shown in the DSH model picker. */
+ * Credit at risk, bucketed by how soon it lapses.
+ *
+ * Only present when at least one pack carried a usable `expiresAtMs` — a card
+ * must never read "we were not told when anything expires" as "nothing is
+ * about to lapse".
+ */
+interface TraeWebCreditExpiry {
+  within24h: TraeWebExpiringCredits;
+  within3d: TraeWebExpiringCredits;
+  within7d: TraeWebExpiringCredits;
+  /** Packs already past their end time but still carrying credit. */
+  expired: TraeWebExpiringCredits;
+}
+/** Aggregated usage/credit answer rendered by the plugin card. */
+interface TraeWebCredits {
+  total: number;
+  consumed: number;
+  available: number;
+  workAvailable: number;
+  generalAvailable: number;
+  accounts: readonly TraeWebCreditAccount[];
+  /**
+   * Credit lapsing soon, for the card's warning banner.
+   *
+   * Derived from the per-pack {@link TraeWebCreditAccount.expiresAtMs} the
+   * `/usage` route already carries, so it costs no extra upstream read.
+   */
+  expiry?: TraeWebCreditExpiry;
+}
+/** Editable Trae model row rendered by the plugin-owned settings card. */
+interface TraeWebModel {
+  id: string;
+  name: string;
+  contextWindow?: number;
+  maxTokens?: number;
+  input?: ('text' | 'image')[];
+  creditMultiplier?: number;
+  reasoningSupported?: boolean;
+  reasoning?: {
+    supported: string[];
+    defaultEffort?: string;
+  };
+  maxContextWindow?: number;
+  /**
+   * Trae's own image-capability flag, as the runtime catalog carries it. The
+   * card renders these rows with their image checkbox already ticked so the
+   * control matches what DSH is actually told (issue #16); absent means the
+   * directory did not declare it, which is not a capability claim either way.
+   */
+  multimodal?: boolean;
+  /**
+   * The availability verdict from the one-click test, when this card session
+   * has run one. Absent = not tested. Deliberately NOT persisted with the
+   * settings: it describes one moment on one account, and a stale verdict shown
+   * as current is worse than a blank field.
+   */
+  probe?: TraeModelProbeVerdict;
+  /** Upstream's own words for the verdict, when it gave any. */
+  probeDetail?: string;
+}
+/**
+ * One model's availability verdict from the one-click test.
+ *
+ * `unknown` is a first-class outcome, not a failure: a timeout, a proxy drop or
+ * a throttle says nothing about the model, and reporting it as unusable would
+ * make the user delete a model that works. Only an upstream refusal is negative.
+ */
+type TraeModelProbeVerdict = 'available' | 'gated' | 'unsupported' | 'rate_limited' | 'auth' | 'unknown';
+/** What the probe route answers with. */
+interface TraeModelsTestResponse {
+  /** One entry per model tested, in the order they were sent. */
+  results: {
+    id: string;
+    verdict: TraeModelProbeVerdict;
+    detail: string;
+  }[];
+  /** Models skipped because the region has no live catalog row for them. */
+  skipped?: string[];
+}
+/**
+ * Daily check-in state rendered below the credit stats.
+ *
+ * The two booleans answer DIFFERENT questions and must never be collapsed into
+ * one "done" flag — doing that was a shipped bug (see CHANGELOG 2.3.1):
+ *
+ *  - `checkedIn` is ACCOUNT-level: today's reward pack exists for this account,
+ *    so there is nothing left to claim and the balance already includes it.
+ *  - `didCheckedIn` is DEVICE-level: this MACHINE already spent its one
+ *    check-in for the day, whichever account spent it. The upstream keys it on
+ *    the `x-device-id` in the request and answers it per device, not per
+ *    account (measured 2026-09-26: the same account and Beijing day answered
+ *    `false` with the header omitted, with a synthetic id, and with another
+ *    install's id, and `true` for the device that actually claimed).
+ *
+ * So `didCheckedIn && !checkedIn` is the "switched account" case: the device's
+ * daily check-in is used up, but THIS account was never rewarded. Claiming
+ * again is refused upstream (business code 9095, "该设备今日已参与签到"), so
+ * the card disables the button — but it must say that, not "claimed today".
+ */
+interface TraeWebCheckin {
+  checkedIn: boolean;
+  didCheckedIn: boolean;
+  credits: number;
+  enabled: boolean;
+  extraCredits?: number;
+}
+/** The claim route's answer, so the card can report a business refusal verbatim. */
+interface TraeWebCheckinClaim {
+  /** False when the upstream answered a non-zero business code (e.g. 9004). */
+  claimed: boolean;
+  /**
+   * True only when THIS ACCOUNT's reward for today already exists, so nothing
+   * was sent upstream. Distinct from {@link TraeWebCheckinClaim.deviceCheckedIn}:
+   * a device that already claimed for another account leaves this false.
+   */
+  alreadyCheckedIn: boolean;
+  /**
+   * True when today's check-in was already spent on this DEVICE (by this or
+   * another account), so no claim was sent or the upstream refused it with
+   * 9095. Not an error: it is the truthful answer to "can this account claim
+   * here today?" — no, and the reason is the machine, not the account.
+   */
+  deviceCheckedIn?: boolean;
+  code?: number;
+  message?: string;
+  /** The refreshed check-in state, present whenever the claim path ran. */
+  checkin?: TraeWebCheckin;
+}
+/** One reward activity rule (name + work/general credits when present). */
+interface TraeWebActivity {
+  activityId: string;
+  enabled: boolean;
+  workCredits?: number;
+  generalCredits?: number;
+}
+interface TraeWebAccount {
+  id: string;
+  accountName: string;
+  edition: 'cn' | 'sg' | 'solo' | 'solo-sg';
+  /**
+   * Whether this account belongs to a Trae tenant, i.e. may bill the enterprise
+   * pool. The enterprise tab lists only these, because the tenant gateway
+   * serves a directory to any CN token but refuses a personal account's chat
+   * with `4019` — so nothing else reveals the difference until a turn fails.
+   */
+  enterprise: boolean;
+  /** Routing bucket of this account, derived from its credential. */
+  region: TraeRegion;
+  source: 'desktop' | 'dsh' | 'cli';
+  tokenExpiresAtMs: number;
+  /**
+   * When this account's REFRESH token expires, when the credential carries one.
+   *
+   * The access token above is renewed automatically — the plugin refreshes it
+   * five minutes before it lapses — so by itself it answers "when does this
+   * need attention", which is "never, while the refresh token lives". The
+   * refresh token is the real horizon: once IT expires the automatic renewal
+   * stops working and the user must sign in to Trae again. Before this field the
+   * card could only say "auto-renewal", which stays true right up to the moment
+   * it silently stops being true.
+   */
+  refreshExpiresAtMs?: number;
+  selected: boolean;
+}
+/**
+ * The account the Trae desktop app is signed in to right now, when it differs
+ * from the one this plugin is bound to (issue #29).
+ *
+ * Reported on the usage document so the card can offer one-click follow without
+ * an extra round trip; also written back on a POST to the accounts refresh
+ * route when the client confirms it saw the hint. Absent whenever the two
+ * agree or the app is not readable — a healthy document carries no extra
+ * fields and the plugin never bills from this value directly: the FOLLOW is a
+ * settings write of `accounts.<region>`, made by the card or by the host's
+ * follow switch, never a silent rebind here.
+ */
+interface TraeWebAppLogin {
+  id: string;
+  accountName: string;
+  edition: 'cn' | 'sg' | 'solo' | 'solo-sg';
+  region: TraeRegion;
+}
+/**
+ * The per-account state shown inside an account row of the card's table.
+ *
+ * Every locally detected account in a region is rendered as a row; the
+ * interesting per-account facts differ by region, which is why this is a union
+ * of the three surfaces the card previously showed only for the BOUND account:
+ *
+ *  - CN rows carry their own check-in state (Trae keys the daily reward per
+ *    ACCOUNT, and the one-per-device tally per DEVICE, see {@link TraeWebCheckin})
+ *    and their Work/General balances.
+ *  - ai rows carry their own subscription / trial status.
+ *
+ * Each field is optional: a read that fails keeps the row visible (perhaps
+ * without a figure) rather than dropping the account and its switch.
+ */
+interface TraeWebAccountState {
+  /** The account this state belongs to. */
+  id: string;
+  /** CN: today's check-in state of this account (absent for ai rows). */
+  checkin?: TraeWebCheckin;
+  /** CN: this account's Work/General balances (absent for ai rows). */
+  credits?: TraeWebCredits;
+  /** ai: this account's subscription / trial status (absent for CN rows). */
+  payStatus?: TraeWebPayStatus;
+}
+interface TraeWebCreditAlternative {
+  id: string;
+  accountName: string;
+  edition: TraeWebAccount['edition'];
+  workAvailable: number;
+  generalAvailable: number;
+}
+/** One probed candidate path and why it did not yield an account. */
+interface TraeWebSearchPath {
+  path: string;
+  edition: 'cn' | 'sg' | 'solo' | 'solo-sg';
+  source: 'desktop' | 'cli';
+  reason: 'missing' | 'unreadable' | 'invalid';
+  message?: string;
+}
+/**
+ * Peel ONE `{get(): T}` live reference, the shape DSH 0.1.7 delivers a
+ * volatile-marked settings field as (see {@link unwrapVolatileDeep}).
+ */
+declare function unwrapVolatile<T>(value: T): T;
+/**
+ * Deep copy of a value with every `{get(): T}` live reference replaced by the
+ * value it resolves to.
+ *
+ * DSH 0.1.7 hands volatile-marked fields back as live references, and a live
+ * reference is still `typeof === 'object'` — so it passes a naive object check
+ * and every lookup on it is `undefined`. Worse, spreading one (`{ ...ref }`)
+ * does NOT read the field: it produces `{ get: <function> }`. Any merge that
+ * spreads a resolved field to preserve its siblings — the card's "write one
+ * region, keep the other" write, or the account map's spread — would otherwise
+ * DROP every sibling and leak a function into the document.
+ *
+ * Both halves therefore unwrap before touching a resolved field. This lives in
+ * the node-free host↔client bridge because the browser half needs it too.
+ *
+ * Non-reference values are recursed into so a nested volatile field is caught
+ * as well; arrays and objects are rebuilt rather than mutated, so the caller's
+ * value is never touched.
+ */
+declare function unwrapVolatileDeep<T>(value: T): T;
+/**
+ * Read the per-region account selections out of a settings value.
+ *
+ * SHARED because `accounts` now has TWO writers: the card, and the composer
+ * panel's account table (2.14.0). Two writers of one field must use one merge
+ * rule, or they drift — and the rule is not obvious.
+ *
+ * Deep-unwraps first: on DSH 0.1.7 a volatile field arrives as a `{get(): T}`
+ * live reference, which passes the `typeof === 'object'` check and would be
+ * returned as if it were the map. Every lookup on it is then `undefined`, and
+ * the merge (`{ ...configured, [region]: id }`) would spread a reference into
+ * `{get: <function>}` — dropping the other region's selection and leaking a
+ * function into the settings document.
+ */
+declare function configuredAccountsOf(configured: unknown): Record<string, string>;
+/**
+ * Whether the host-side "follow the Trae app's sign-in" switch is on (issue
+ * #29). Absent reads as OFF, so an existing configuration keeps the strict
+ * bind it shipped with and the switch is an opt-in — the same opt-out
+ * semantics as {@link regionEnabledOf}, for the same reason: a config written
+ * before this field existed cannot ask for behavior it never declared.
+ *
+ * Reads the whole settings section (or the bare field); deep-unwraps first
+ * because on DSH 0.1.7 a volatile field arrives as a `{get(): T}` live
+ * reference, whose `typeof === 'object'` would otherwise pass a naive check.
+ */
+declare function followAppLoginEnabled(configured: unknown): boolean;
+/**
+ * Build the next `regions` settings value for the card's save. The write
+ * targets ONLY the signed-in account's region slot; every other region's slot
+ * is carried over untouched, so switching accounts never clobbers the other
+ * region's picks. Tolerates any stored shape (absent, non-object) by starting
+ * from an empty document.
+ */
+declare function nextRegionSlots<Slot extends object>(regions: unknown, panel: TraePanel, slot: Slot): Record<string, unknown>;
+/**
+ * Whether one region's provider is switched on. Opt-out semantics: only an
+ * explicit `false` disables it, so a config written before this switch existed
+ * (and the pre-region-split flat fields, which never carry `enabled`) keep both
+ * providers running exactly as before. The Host reads the same rule through
+ * `regionStateOf`, so card and Host can never disagree about a region's state.
+ *
+ * `value` may be the whole settings section or the `regions` map (see
+ * {@link regionsMapOf}).
+ */
+declare function regionEnabledOf(value: unknown, panel: TraePanel): boolean;
+/**
+ * Build the next `regions` settings value for a provider on/off toggle. ONLY
+ * the target region's `enabled` flag changes: every other field of that slot
+ * (its directory, selection, image opt-ins, context budgets) and every other
+ * region's slot are carried over verbatim, so switching a provider off never
+ * discards the user's model picks and switching it back on restores them.
+ *
+ * This is deliberately separate from {@link nextRegionSlots}: that helper
+ * writes a whole slot from a signed-in tab's draft, while this one must work
+ * for a region that is signed OUT — which is precisely the region a user wants
+ * to switch off (no international install, no international account).
+ *
+ * `value` may be the whole settings section or the `regions` map; the RETURN
+ * value is always the `regions` map, i.e. exactly what `settingsScope.set(
+ * 'regions', ...)` needs.
+ */
+declare function nextRegionEnabled(value: unknown, panel: TraePanel, enabled: boolean): Record<string, unknown>;
+/**
+ * The two seats this region's credit readout can occupy.
+ *
+ * `composer` is the composer tool row (`conversation.input.left`); `stats` is
+ * the ambient dock below the composer card (`conversation.composer.dock`),
+ * beside the shell's own round/step/token pills.
+ *
+ * WHY THE SEAT IS A CHOICE AT ALL (learned from dsh-connect-workbuddy issue
+ * #62): the composer tool row is a LIST seat, so it is shared not only with the
+ * shell's own controls but with any other plugin that registers there — and a
+ * list seat cannot promise that every occupant is visible. The report behind
+ * that issue is exactly that: with a third-party plugin installed the readout
+ * stopped appearing. A fixed seat therefore lets one plugin's presence decide
+ * another's, so the seat belongs to the user.
+ *
+ * Named as a union rather than a boolean because a third seat is plausible and
+ * a `showAtTop: boolean` would have to be MIGRATED rather than extended.
+ */
+type TraeCreditPosition = 'composer' | 'stats';
+/**
+ * Which seat one region's readout uses, defaulting to the composer row.
+ *
+ * Anything other than an explicit `'stats'` reads as `'composer'`, which covers
+ * the two cases that matter: a profile written BEFORE this setting existed (the
+ * composer row was the only seat, so an upgrade moves nothing on screen), and a
+ * hand-edited value the schema does not know. Falling back rather than
+ * rendering nowhere is deliberate — an unrecognized value must not make the
+ * readout disappear, which is the very defect this setting exists to fix.
+ *
+ * `value` may be the whole settings section or the `regions` map (see
+ * {@link regionsMapOf}).
+ */
+declare function regionCreditPositionOf(value: unknown, panel: TraePanel): TraeCreditPosition;
+/**
+ * Build the next `regions` settings value for one region's credit seat.
+ *
+ * Same merge rule as every sibling region write: only the target region's
+ * `creditPosition` changes, so a seat change cannot drop that slot's model
+ * directory, selection, budgets or enabled flag, nor touch the other region.
+ *
+ * `value` may be the whole settings section or the `regions` map; the RETURN
+ * value is always the `regions` map, i.e. exactly what `settingsScope.set(
+ * 'regions', ...)` needs.
+ */
+declare function nextRegionCreditPosition(value: unknown, panel: TraePanel, position: TraeCreditPosition): Record<string, unknown>;
+/** Subscription status of an international (ai) account, rendered instead of the CN credit packs. */
+interface TraeWebPayStatus {
+  isDollarUsageBilling: boolean;
+  hasPackage: boolean;
+  isPayFreshman: boolean;
+  inTrial: boolean;
+  trialEndTimeMs: number;
+  enableSoloLite: boolean;
+  enableSoloBuilder: boolean;
+  enableSoloCoder: boolean;
+  enableSoloWeb: boolean;
+  /** Trae's authoritative tier number (`user_pay_identity`); `0` means Free. */
+  payIdentity?: number;
+  /** Trae's authoritative tier label (`user_pay_identity_str`), e.g. `Free`. */
+  payIdentityStr?: string;
+  fission?: {
+    startTimeMs: number;
+    expireTimeMs: number;
+    maxUsage: number;
+  };
+}
+/** The JSON document the plugin card renders. */
+type TraeWebUsage = {
+  status: 'signed-out';
+  accounts: readonly TraeWebAccount[];
+  message?: string;
+  searched?: readonly TraeWebSearchPath[];
+  enabled?: boolean;
+} | {
+  status: 'signed-in';
+  accountId: string;
+  accountName: string;
+  tokenExpiresAtMs: number;
+  /**
+   * When the BOUND account's refresh token expires (absent when the credential
+   * carries none). See {@link TraeWebAccount.refreshExpiresAtMs} — this is the
+   * horizon that actually matters, because the access token above renews
+   * itself until this one lapses.
+   */
+  refreshExpiresAtMs?: number;
+  /** Which per-region model directory and selection this account owns. */
+  region: TraeRegion;
+  /** Whether this region's provider is currently offered to DSH. */
+  enabled?: boolean;
+  accounts: readonly TraeWebAccount[];
+  models: readonly TraeWebModel[];
+  enabledModelIds: readonly string[];
+  rawChat?: {
+    state: 'disabled' | 'unchecked' | 'available' | 'protocol-gated' | 'authentication' | 'credit' | 'rate' | 'transport' | 'server';
+    checkedAtMs?: number;
+    status?: number;
+  };
+  credits?: TraeWebCredits;
+  creditsError?: string;
+  /**
+   * Set when this panel has no readable balance by design, rather than by
+   * failure. Only `enterprise` does: a tenant's spend is not reported by any
+   * endpoint the plugin can reach (every tenant quota path answers 404), so
+   * the figure exists solely in the enterprise console. The card must say so
+   * instead of rendering the consumer packs, which belong to the personal
+   * balance and would be read as the tenant's.
+   */
+  creditsUnavailable?: 'enterprise';
+  /**
+   * Present only when the bound account is out of credit AND another account
+   * on this machine has some (issue #25). The card then offers a one-click
+   * switch instead of leaving a permanently empty panel. Absent in every
+   * other case so a healthy account never pays for the extra read.
+   */
+  alternatives?: readonly TraeWebCreditAlternative[];
+  /**
+   * Present only when the Trae app's CURRENT sign-in differs from the
+   * account this plugin is bound to (issue #29): the card then offers a
+   * one-click follow instead of making the user hunt the account dropdown
+   * after every app-side sign-out. Absent in every other case — a healthy
+   * document costs no extra read beyond the accounts scan the document
+   * already runs.
+   */
+  appLogin?: TraeWebAppLogin;
+  /**
+   * Daily check-in state (CN only). Absent on the international region,
+   * whose check-in surface does not exist — probed 2026-09-24: the
+   * `/trae/api/v2/ug/*` family answers 404 on every ai gateway, so the card
+   * shows no claim button there rather than a button that cannot work.
+   */
+  checkin?: TraeWebCheckin;
+  checkinError?: string;
+  /** Subscription status of an international account (region ai only). */
+  payStatus?: TraeWebPayStatus;
+  payStatusError?: string;
+  /**
+   * This panel's account-pool state, when the Host build supports it.
+   *
+   * Absent on a Host without pool support, so the card renders no pool section
+   * instead of an empty one. Assembled LAST in the status document and never
+   * allowed to fail it: the pool reads per-account credit, and one dead account
+   * must not blank out the panel the user is looking at.
+   */
+  pool?: TraeWebPool;
+} | {
+  status: 'error';
+  message: string;
+};
+//#endregion
+//#region src/pi-ai-runtime.d.ts
+/**
+ * Which `@earendil-works/pi-ai` copy THIS plugin resolves at runtime, and which
+ * context shape that copy consumes (issue #27).
+ *
+ * WHY THIS EXISTS. The plugin declares pi-ai as a peer, so the module it
+ * imports is whatever the install provides — and the two generations consume
+ * DIFFERENT context shapes:
+ *
+ * - **modern** (0.86+): every public entry point calls `normalizeContext()`
+ *   once, so what reaches a provider is a normalized *transcript*:
+ *   `{ messages: [ { role: 'system', content, toolsAdded }, … ] }`. The system
+ *   prompt and the tool declarations live ONLY on that leading system message;
+ *   the top-level `systemPrompt` / `tools` fields are gone, and the api never
+ *   reads them back.
+ * - **legacy** (≤0.85): expects `{ systemPrompt, tools, messages }` and has no
+ *   branch for a `system` message inside `messages` at all. Its token estimator
+ *   crashes on one — `estimateMessageTokens` iterates the string `content`
+ *   character by character and reads `.name` off a character — and its wire
+ *   converter silently drops it.
+ *
+ * The mismatch is reachable in BOTH directions, because DSH itself spans both
+ * generations (`dsh-llm-pi-ai` ≤0.2.0-rc.1 declares `^0.85.1`; 0.2.0-rc.2 and
+ * later declare `^0.87.1`, 0.2.1-alpha.2 declares `^1.0.2`, and 0.2.1-rc.1 —
+ * the current desktop host — declares **`^1.1.0`**, which also stopped reading
+ * the top-level fields entirely), while this plugin accepts the whole range
+ * (`>=0.1.7-rc.1 <0.3.0-0`). Whichever side is newer, the other one is wrong:
+ *
+ * | host | resolved api | outcome |
+ * |---|---|---|
+ * | legacy | legacy | fine |
+ * | legacy | modern | no crash, but prompt + tools silently LOST |
+ * | modern | legacy | CRASH: `Cannot read properties of undefined (reading 'length')` |
+ * | modern | modern | fine |
+ *
+ * THE BOUNDARY IS 0.86, NOT 0.87. Checked against the published tarballs:
+ * `dist/utils/transcript.js` — and with it `normalizeContext`, the
+ * `role === 'system'` estimator branch, and the switch away from reading
+ * `systemPrompt`/`tools` — first appears in **0.86.0**. A `>= 0.87` gate
+ * misclassifies 0.86.x as legacy and folds a context the modern api consumes
+ * natively, which deletes the only carrier of the prompt and the tools.
+ *
+ * HOW the generation is decided, in order:
+ *
+ * 1. **The manifest version** of the copy this plugin resolved. Numeric semver
+ *    comparison (`minor >= 86`), so `0.86.0` and the already-shipped `1.x` line
+ *    both land on modern, and `0.9.0` correctly sorts below `0.86.0`.
+ * 2. **The package's own layout**, when no version could be read: the transcript
+ *    module sits at `dist/utils/transcript.js` (the exports map's
+ *    `"./utils/*" → "./dist/utils/*.js"` convention is identical in every
+ *    published generation, 0.82 through 1.x).
+ *
+ * Both checks are deliberately resolver-independent. `import.meta.resolve()` is
+ * NOT used to answer this question: bundler-style resolvers (vite, and equally
+ * `vitest` under it) expand the `"./utils/*"` wildcard to a path and return it
+ * WITHOUT checking that the file exists, so a probe built on it answers "modern"
+ * for 0.85.1 — the exact false positive that would leave issue #27 unfixed while
+ * claiming to be capability-based. Reading the package directory cannot be
+ * fooled that way.
+ *
+ * The version is therefore the primary signal, and it also keeps the gate
+ * forward-compatible for free: a future 2.x needs no change here, whereas a
+ * file-name check alone would have to know about it.
+ *
+ * @module dsh-connect-trae/pi-ai-runtime
+ */
+/** The context generation a resolved pi-ai api module speaks. */
+type PiAiGeneration = 'legacy' | 'modern';
+/** What {@link piAiRuntimeInfo} reports about the resolved pi-ai copy. */
+interface PiAiRuntimeInfo {
+  /** `modern` (0.86+: consumes normalized transcripts) or `legacy` (≤0.85 shape). */
+  generation: PiAiGeneration;
+  /** Version of the resolved copy, when the manifest could be read. */
+  version: string | undefined;
+  /** Package directory of the resolved copy, when it could be located. */
+  resolvedFrom: string | undefined;
+  /**
+   * Whether the copy could be inspected at all. `false` means pi-ai does not
+   * resolve from this plugin — the normal state of a market install probed
+   * OUTSIDE the DSH host, where the host supplies the module at plugin runtime.
+   * Inside DSH the copy is always inspectable: a nested one shadows host
+   * injection, and without a nested one the host supplies its own.
+   */
+  inspected: boolean;
+}
+/** Resolve (once) which pi-ai copy this plugin runs against. */
+declare function piAiRuntimeInfo(): PiAiRuntimeInfo;
+/**
+ * The generation decision table, exported so every branch is pinned by tests
+ * rather than by a comment here — including the two this development tree can
+ * never reach (no local copy, and a copy with no readable version), which are
+ * exactly the states a market install founds its gate on.
+ *
+ * @param version - manifest version of the resolved copy, if readable.
+ * @param transcriptPresent - whether that copy actually ships
+ *   `dist/utils/transcript.js`; `undefined` when nothing was inspected.
+ */
+declare function decidePiAiGeneration(version: string | undefined, transcriptPresent: boolean | undefined): PiAiGeneration;
+/**
+ * The generation a version string belongs to, or `undefined` when the string
+ * cannot be read as a version at all.
+ *
+ * Only the minor of the `0.x` line matters for the boundary, and `major >= 1`
+ * is modern by definition (1.0.x is already in use by `dsh-llm-pi-ai@0.2.1-alpha.2`
+ * and consumes transcripts natively).
+ */
+declare function generationOf(version: string | undefined): PiAiGeneration | undefined;
+//#endregion
+//#region src/upstream.d.ts
+type TraeUpstreamErrorKind = 'authentication' | 'hard_credit' | 'soft_rate' | 'not_found' | 'server' | 'client' | 'unconfigured';
+type TraeChatResult = {
+  ok: true;
+  response: Response;
+} | {
+  ok: false;
+  status: number;
+  kind: TraeUpstreamErrorKind;
+  message: string;
+};
+interface TraeUpstreamClient {
+  chatStream(bodyJson: string, signal?: AbortSignal): Promise<TraeChatResult>;
+}
+/**
+ * Safe first-stage upstream. Real Trae traffic stays disabled until one
+ * edition-specific endpoint and wire codec are verified with fixtures.
+ */
+declare class UnconfiguredTraeUpstreamClient implements TraeUpstreamClient {
+  chatStream(_bodyJson: string, _signal?: AbortSignal): Promise<TraeChatResult>;
+}
+//#endregion
+//#region src/shim.d.ts
+interface ShimLogger {
+  warn(...args: unknown[]): void;
+  error(...args: unknown[]): void;
+}
+interface TraeShim {
+  ready: Promise<void>;
+  baseUrl(): string;
+  token(): string;
+  /** Bearer secret of one named route (defaults to the first route). */
+  tokenOf(label?: string): string;
+  close(): Promise<void>;
+}
+/** One bearer-authenticated chat route served by the shim. */
+interface TraeShimRoute {
+  /** Stable label used to look the route's secret up (`solo` | `enterprise`). */
+  label: string;
+  client: TraeUpstreamClient;
+  /**
+   * Account-pool hooks for this route (issue #44). Absent means "one fixed
+   * account, no rotation and no failover" — the behaviour before the pool
+   * existed, and still the behaviour when the pool is switched off.
+   */
+  pool?: TraeShimPool;
+}
+/**
+ * What an account pool tells the shim around one chat attempt.
+ *
+ * The shim owns the HTTP surface and the pool owns "who bills", so the two meet
+ * here: the pool may re-point the next request, hand back a client for a
+ * different account after a failure, and hear about failures that only a real
+ * request — not a probe — can produce.
+ *
+ * Every method must resolve rather than throw: a pool failure must never turn a
+ * chat request into a 500 when a plain answer was possible.
+ */
+interface TraeShimPool {
+  /**
+   * Choose the account for this request and report which one it is. Called once,
+   * before the first attempt; `undefined` means "the pool chose nobody", which
+   * leaves the route's own client to bill the bound account.
+   */
+  prepare(): Promise<string | undefined>;
+  /**
+   * The client for the next account worth trying after the current one failed,
+   * or `undefined` when the pool has nothing left to try.
+   *
+   * The returned client must be bound to that account's OWN credential:
+   * failing over is not a rebind, so it must not move the account the user
+   * selected (the same rule per-account probes already follow).
+   */
+  next(tried: readonly string[]): Promise<{
+    accountId: string;
+    client: TraeUpstreamClient;
+  } | undefined>;
+  /** Record a real request's failure against the account that hit it. */
+  failed(accountId: string, kind: TraeUpstreamErrorKind, message: string): Promise<void>;
+  /** One clause naming why no other account can serve, for the error text. */
+  shortfall(tried: readonly string[]): Promise<string | undefined>;
+}
+interface TraeShimOptions {
+  catalog: TraeCatalog;
+  /**
+   * Single-route form, kept for the existing call sites and tests.
+   *
+   * A shim serves exactly as many chat routes as the region publishes provider
+   * ids, and they must not be interchangeable: the consumer and enterprise
+   * pools bill different accounts, so the route is chosen by the bearer token
+   * the adapter was built with, and an unknown token is rejected rather than
+   * defaulting to "some" pool.
+   */
+  client?: TraeUpstreamClient;
+  routes?: readonly TraeShimRoute[];
+  logger?: ShimLogger;
+}
+declare function createTraeShim(options: TraeShimOptions): TraeShim;
+//#endregion
+//#region src/adapter.d.ts
+/** Provider route this bundle owns for the domestic (CN) gateway. */
+declare const TRAE_PROVIDER = "trae";
+/**
+ * Provider route this bundle owns for the CN **enterprise (tenant)** gateway.
+ *
+ * A separate provider id, not a mode switch, because the two pools bill
+ * differently: a tenant account (`tob_online`) is served by BOTH gateways with
+ * the SAME credential, and only the enterprise one draws on the enterprise
+ * pool. Exposing one id would force a per-call guess about who pays.
+ *
+ * It never falls back to the consumer pool: picking this provider is the user
+ * saying "bill the tenant", so a refusal is reported as an error instead of
+ * being silently re-run against the personal quota.
+ */
+declare const TRAE_ENTERPRISE_PROVIDER = "trae-enterprise";
+/**
+ * Provider route this bundle owns for the international (trae.ai) gateway.
+ * Named `-global` to match the plugin family's convention (`workbuddy-global`);
+ * the internal region bucket stays `ai`, which is the gateway/protocol name.
+ */
+declare const TRAE_AI_PROVIDER = "trae-global";
+/** The provider ids one region publishes, in model-picker order. */
+declare const TRAE_PROVIDER_IDS: Readonly<Record<TraeRegion, readonly string[]>>;
+/** Each region's default (first) provider id. */
+declare const TRAE_PROVIDERS: Readonly<Record<TraeRegion, string>>;
+/**
+ * Which chat pool a provider bills against.
+ *
+ * `trae` and `trae-global` keep the behaviour they always had (the consumer
+ * SOLO pool); `trae-enterprise` is the only id that reaches the tenant gateway.
+ */
+type TraeProviderRoute = 'solo' | 'enterprise';
+declare const TRAE_PROVIDER_ROUTES: Readonly<Record<string, TraeProviderRoute>>;
+/** Chat pool a provider id bills against; `undefined` for an unknown id. */
+declare function routeOfTraeProvider(provider: string): TraeProviderRoute | undefined;
+/** Human-readable provider names, shown in the DSH model picker. */
 declare const TRAE_PROVIDER_DISPLAY_NAMES: Readonly<Record<TraeRegion, string>>;
+/** Display name per provider id (the region table above only names the default). */
+declare const TRAE_PROVIDER_ID_DISPLAY_NAMES: Readonly<Record<string, string>>;
+/** Display name of a provider id. */
+declare function displayNameOfTraeProvider(provider: string): string;
 /** Region a provider route id belongs to. */
 declare function regionOfTraeProvider(provider: string): TraeRegion | undefined;
 declare const TRAE_STREAM_IDLE_TIMEOUT_MS = 300000;
@@ -553,6 +1452,14 @@ interface TraeAdapterOptions {
   provider?: string;
   /** pi-ai provider name and profile display name; defaults to the CN name. */
   displayName?: string;
+  /**
+   * Bearer secret this provider presents to the shim.
+   *
+   * A region can publish more than one provider (consumer + enterprise), and
+   * the shim picks the billing pool from that bearer. Defaults to the shim's
+   * first route, which keeps the single-provider case unchanged.
+   */
+  secret?: string;
   resolveAttachments?: () => AttachmentStore | undefined;
   /**
    * Override the resolved pi-ai generation (see {@link withContextAdaptation});
@@ -573,6 +1480,19 @@ interface TraeCredential {
   refreshToken?: string;
   userId: string;
   accountName?: string;
+  /**
+   * Trae tenant this account belongs to (`account.tenant_id`, e.g. `272193024`
+   * for a `tob_online` enterprise), absent for a personal account.
+   *
+   * This is what decides whether the ENTERPRISE pool can serve the account at
+   * all. The tenant gateway accepts any CN token for its DIRECTORY read — a
+   * personal account gets the full 49-model roster back — so "the roster
+   * loaded" proves nothing about billing rights. Its chat endpoint is what
+   * refuses: a personal account answers `4019` (risk control), a tenant account
+   * streams normally. Because the two are indistinguishable from the roster,
+   * the account list itself has to carry the flag.
+   */
+  tenantId?: string;
   host: string;
   /**
    * Region claim from the decrypted storage document (`userRegion.region`,
@@ -603,6 +1523,27 @@ interface TraeCredentialStoreOptions {
    * stores run side by side without seeing each other's accounts.
    */
   region?: TraeRegion;
+  /**
+   * Only consider credentials that belong to a Trae tenant.
+   *
+   * The enterprise panel's store runs with this on: a personal account cannot
+   * bill that pool, and because the tenant gateway still serves it a directory,
+   * binding it here would fail only at the first chat (`4019`). With the flag
+   * set, an explicit binding to a personal account falls through to the preferred
+   * TENANT account instead of being silently honoured.
+   */
+  requireTenant?: boolean;
+  /**
+   * Withhold TENANT (enterprise) accounts from this store's account list.
+   *
+   * Set on the consumer panels: an enterprise login belongs to the enterprise
+   * panel, and offering it here would let a tenant account be bound to the
+   * personal pool without the user ever seeing which pool they picked. A
+   * machine that has ONLY a tenant login still resolves it — an empty list must
+   * not turn a working install into "signed out" — so the filter is applied to
+   * the OFFERED list, never to the resolved credential.
+   */
+  hideTenantAccounts?: boolean;
   /** Legacy single-copy path read as a migration source; injectable for tests. */
   legacyOwnPath?: string;
   refresh: (credential: TraeCredential) => Promise<TraeRefreshOutcome>;
@@ -612,6 +1553,16 @@ interface TraeAccountChoice {
   id: string;
   accountName: string;
   edition: TraeEdition;
+  /**
+   * Whether this account may bill the CN ENTERPRISE pool.
+   *
+   * Derived from the credential's own tenant claim, because nothing else can
+   * tell: the tenant gateway answers a directory read for ANY CN token, so a
+   * personal account looks perfectly serviceable right up to its first chat,
+   * which it answers with `4019`. The enterprise panel filters its account list
+   * and its default binding on this flag.
+   */
+  enterprise: boolean;
   /** Routing bucket of this account (`cn` | `ai`), derived from its credential. */
   region: TraeRegion;
   source: 'desktop' | 'dsh' | 'cli';
@@ -649,17 +1600,60 @@ declare function traeOwnAuthPath(region: TraeRegion): string;
  */
 declare function legacyTraeOwnAuthPath(): string;
 declare function normalizeTraeCredential(raw: unknown, edition: TraeEdition, source: TraeCredential['source']): TraeCredential | undefined;
+/**
+ * Whether this account belongs to a Trae tenant, i.e. may bill the enterprise
+ * pool.
+ *
+ * Evidence (2026-10-17, live): the tenant's own account carries
+ * `account.tenant_id` / `tenant_name` and `scope: 'saas'`; the personal SOLO
+ * account carries neither and reports `scope: 'marscode'`. Only the tenant one
+ * streams on the enterprise gateway — the other answers `4019` risk control.
+ */
+declare function isEnterpriseAccount(credential: Pick<TraeCredential, 'tenantId'> | undefined): boolean;
 declare class TraeCredentialStore {
   private storagePathOverride;
   private edition;
   private accountId;
   private readonly region;
+  private readonly requireTenant;
+  private readonly hideTenantAccounts;
   private readonly ownPathExplicit;
   private readonly legacyOwnPath;
   private readonly legacyOwnPathExplicit;
   private readonly refresh;
   private readonly refreshMarginMs;
   private inflight;
+  /**
+   * In-flight refreshes of individual accounts, one per account id.
+   *
+   * The card reads every member's balance in one poll and each balance can
+   * decide to refresh, so without this dedupe the same account would exchange
+   * its token several times in a second and the last writer would win over a
+   * copy another read already holds.
+   */
+  private readonly inflightByAccount;
+  /**
+   * When a per-account refresh last FAILED, so a dead refresh token is not
+   * exchanged again on every poll.
+   *
+   * The card reads every member's balance on each refresh, and a revoked refresh
+   * token fails forever: without this memo each poll would spend two upstream
+   * calls (the current contract and the superseded one) on an account no retry
+   * can fix. Five minutes keeps a transient network failure cheap to retry while
+   * a revoked sign-in costs almost nothing.
+   */
+  private readonly refreshFailedAtMs;
+  /**
+   * The account the NEXT request should bill, when a pool — not the user's
+   * binding — is choosing (issue #44).
+   *
+   * Runtime only, never persisted: the binding in settings is what a save
+   * writes and what the card's account table reports as selected, while this is
+   * "who serves right now". Keeping them apart is what lets the pool rotate
+   * without silently rewriting the user's choice, and what makes turning the
+   * pool off restore the bound account with no rebind at all.
+   */
+  private rotatedAccountId;
   constructor(options: TraeCredentialStoreOptions);
   /** Whether a credential's own claim belongs to this store's region. */
   private matchesRegion;
@@ -713,7 +1707,80 @@ declare class TraeCredentialStore {
    * binding itself already fell through to the live account.
    */
   liveLogin(): Promise<TraeAccountChoice | undefined>;
+  /**
+   * The accounts this store is willing to OFFER.
+   *
+   * Scoped to who this store may bill:
+   *   - a consumer store withholds tenant accounts (the enterprise pool is a
+   *     separate tab and a separate billing decision), and
+   *   - a tenant store withholds personal accounts (they cannot bill that
+   *     pool; the tenant gateway answers their chat with 4019).
+   *
+   * Either filter backs off when it would hide EVERYTHING, so a machine whose
+   * only login is on the other side keeps working instead of reading as
+   * "signed out".
+   */
+  private offered;
   accounts(): Promise<TraeAccountChoice[]>;
+  /**
+   * The credential this store bills, given every credential it can see.
+   *
+   * This is the ONE resolution rule, and it exists so that `current()` and
+   * `accounts()` cannot disagree: `current()` applies it to `readAll()`, and
+   * `accounts()` applies the SAME verdict to decide which row reads as
+   * `selected`. Deriving that flag independently is exactly how the two drifted
+   * apart — and a card that marks a different account than the one the chat
+   * bills is worse than no card at all, because a press that "saves the
+   * selected account" then rewrites the binding to the account that was only
+   * ever DISPLAYED.
+   *
+   * Order of business:
+   *   1. No binding — the detected default (`preferred`) is in use, chosen from
+   *      the OFFERED list rather than from every login on the machine. A
+   *      consumer store that withholds tenant accounts must not default its
+   *      billing to the tenant pool merely because that login sorts first;
+   *      withholding is a billing decision, not a display detail.
+   *   2. A binding — honour it verbatim, even when the OFFERED list hides that
+   *      account. Resolution is never scoped by `hideTenantAccounts`: the user's
+   *      explicit choice outranks a display filter.
+   *   3. A tenant-scoped store cannot bill through a personal account, and the
+   *      tenant gateway only reveals that at the first chat (`4019`). Honour the
+   *      binding when it is eligible; otherwise fall back to the preferred
+   *      tenant account, which is the one the user's enterprise tab is meant to
+   *      use.
+   *   4. A saved account can disappear when Trae replaces its local login. Do
+   *      NOT silently fall back to a different account: that would bill a
+   *      different account than the one the user explicitly selected. Return
+   *      undefined so the caller surfaces "no signed-in account" and the user
+   *      can re-select, instead of the plugin quietly switching accounts behind
+   *      their back.
+   */
+  private inUse;
+  /**
+   * Point this store at one specific account for the NEXT request, without
+   * touching the user's saved binding (issue #44).
+   *
+   * Called by the account pool before each chat request. `undefined` clears the
+   * override, which is how switching the pool off immediately restores the
+   * binding — no rebind, no settings write, nothing to undo.
+   *
+   * A rotation is a REQUEST, not an assertion: `current()` honours it only when
+   * the account still exists locally and this store's own eligibility rules
+   * allow it, and otherwise falls back to the binding. So a rotation can never
+   * invent a credential that {@link current} would refuse.
+   */
+  setRotatedAccount(accountId: string | undefined): void;
+  /** The rotation currently in effect, for diagnostics and the pool's own card. */
+  rotatedAccount(): string | undefined;
+  /**
+   * The credential a rotation points at, or `undefined` when it cannot be
+   * honoured (the login was removed from this machine, or a tenant-scoped store
+   * refuses a personal account).
+   *
+   * Never substitutes a different account here: the caller then applies the
+   * user's binding, which is the honest answer when the pool's choice is gone.
+   */
+  private rotated;
   current(): Promise<TraeCredential | undefined>;
   /**
    * The stored credential of one specific account, without changing which
@@ -731,6 +1798,22 @@ declare class TraeCredentialStore {
    * fallback, for the same reason {@link current} refuses to fall back.
    */
   credentialOf(accountId: string): Promise<TraeCredential | undefined>;
+  /**
+   * A SPECIFIC account's credential, refreshed when its access token is due.
+   *
+   * {@link credentialOf} is a pure lookup and hands back an expired token as-is,
+   * which is right for the chat path (that request fails honestly) but wrong for
+   * a READ of that account's own data: Trae's access token lives for days while
+   * the refresh token lives for months, so a pooled account the user has not
+   * used this week reads as "no balance" — the card showed a bare `—` for an
+   * account whose refresh token was still good. Only the refresh margin decides
+   * here, and a FAILED refresh still yields the stored credential so the caller
+   * reports the failure it actually hit instead of inventing "not signed in".
+   *
+   * This never touches the binding or the rotation: refreshing account B must
+   * not make B the account the next chat request bills.
+   */
+  resolveCredentialOf(accountId: string): Promise<TraeCredential | undefined>;
   /**
    * Store imported credentials (issue #37), replacing any entry with the same
    * account id and leaving every other entry alone.
@@ -1524,9 +2607,22 @@ interface TraeSoloClientOptions {
   credential(): Promise<TraeCredential>;
   identity(): Promise<TraeIdentity>;
   baseUrl?: string;
+  /**
+   * Which chat gateway this client is pinned to. Omitted = `solo`, the consumer
+   * pool. `enterprise` targets the tenant-billed `console.enterprise` gateway
+   * and stamps the per-call `session_id` it requires (see
+   * {@link TRAE_ENTERPRISE_HOST}).
+   *
+   * Pinned per CLIENT, never chosen per call: a turn must not be able to drift
+   * from the pool the user picked, so the route is fixed when the provider is
+   * built and every request that client makes stays on it.
+   */
+  route?: TraeChatRoute;
   fetchImpl?: typeof fetch;
   log?: (message: string, detail?: unknown) => void;
 }
+/** Which chat pool a client is pinned to. */
+type TraeChatRoute = 'solo' | 'enterprise';
 declare class TraeSoloUpstreamClient {
   private readonly options;
   private readonly fetchImpl;
@@ -1547,9 +2643,22 @@ declare class TraeSoloUpstreamClient {
   /** Merge one function's config list into the shared catalogue (first wins). */
   private collectModels;
   chatStream(bodyJson: string, signal?: AbortSignal, functionName?: string): Promise<TraeChatResult>;
+  /** Chat gateway for this client's pinned route. */
+  private chatBaseOf;
 }
 //#endregion
 //#region src/solo-bridge.d.ts
+/**
+ * One upstream failure as Trae reports it inside a 200 SSE body: an `error`
+ * event, or any event carrying a `code` at or above Trae's error band.
+ */
+interface TraeFailure {
+  code?: number;
+  message: string;
+  extra?: unknown;
+}
+/** A readable message for an in-stream Trae failure, with its code preserved. */
+declare function describeTraeFailure(failure: TraeFailure): string;
 /** Convert Trae's named SSE events into OpenAI chat-completion SSE chunks. */
 declare function bridgeTraeSoloStream(response: Response, model: string): Response;
 /**
@@ -1790,573 +2899,307 @@ declare class TraeUsageClient {
   payStatus(signal?: AbortSignal): Promise<TraePayStatus>;
   /**
    * The Work-credit endpoints are CN-only. The international region is
-   * subscription-based and must read {@link payStatus} instead; guarding here
-   * keeps the card's degraded `creditsError` message diagnosable rather than
-   * letting an ai credential hit an unverified path on its pay gateway.
-   */
-  private requireCnRegion;
-  /** Total entitlements / credits and per-pack breakdown. */
-  snapshot(signal?: AbortSignal): Promise<TraeUsageSnapshot>;
-  /**
-   * Daily check-in status. Read-only, and answered with or without the device
-   * header — the claim is what needs it.
-   *
-   * The read DOES carry the header whenever this installation has one, and
-   * that is deliberate rather than incidental: `did_checked_in` is answered
-   * per device, so omitting the header would make a device that already claimed
-   * today look identical to one that never has (measured 2026-09-26, see
-   * {@link TraeCheckinStatus.didCheckedIn}).
-   */
-  checkinStatus(signal?: AbortSignal): Promise<TraeCheckinStatus>;
-  /**
-   * Claim today's check-in reward. The ONLY state-changing call in this client.
-   *
-   * The upstream is idempotent per Beijing day (verified 2026-09-24: repeating
-   * the call on an already-claimed day answers `code: 0` while the entitlement
-   * total stays byte-identical), so a double click cannot double-grant. The
-   * card and its route still guard, because "cannot double-grant" is a property
-   * of the upstream we verify rather than one we rely on.
-   *
-   * A business refusal arrives as HTTP 200 with a non-zero `code` — most often
-   * `9004` when the request carries no `x-device-id`. That is reported as
-   * `claimed: false` rather than thrown, so the caller can tell "the upstream
-   * refused this" apart from "the request never arrived".
-   */
-  claimCheckin(signal?: AbortSignal): Promise<TraeCheckinClaim>;
-  /** Rewards / activity rules. */
-  activities(signal?: AbortSignal): Promise<TraeActivityRule[]>;
-  /** Convenience: snapshot + check-in + activities in one call (best-effort, non-fatal on missing). */
-  view(signal?: AbortSignal): Promise<TraeUsageView>;
-}
-//#endregion
-//#region src/status-paths.d.ts
-/** Plugin-owned usage endpoint consumed by its browser half. */
-declare const TRAE_USAGE_PATH = "/plugins/dsh-connect-trae/usage";
-/**
- * Plugin-owned availability probe: POST the model ids to test, get one verdict
- * per model. Unlike every read-only sibling this route SPENDS quota — a real
- * (minimal) chat call per model — so it is user-initiated only, and the card
- * labels the button as consuming a small amount.
- */
-declare const TRAE_MODELS_TEST_PATH = "/plugins/dsh-connect-trae/models/test";
-/**
- * Per-account status (check-in / credits / subscription) for the account table.
- *
- * Each row of the account table reads its OWN state through this route — a CN
- * row carries its check-in state and balance, an ai row its subscription.
- * POST with the accountId in the body: one upstream read per account, paid
- * only when the table is actually shown.
- */
-declare const TRAE_ACCOUNT_STATUS_PATH = "/plugins/dsh-connect-trae/account-status";
-/**
- * Plugin-owned daily check-in claim endpoint. POST, loopback-only, and the only
- * route in this plugin that changes upstream account state. The accountId in
- * the body names WHICH account to claim for, so the button can sit in each
- * account row.
- */
-declare const TRAE_CHECKIN_PATH = "/plugins/dsh-connect-trae/checkin";
-/** Query parameter naming the region a card request addresses. */
-declare const TRAE_REGION_PARAM = "region";
-/** Every region, in card tab order. */
-declare const TRAE_REGIONS: readonly TraeRegion[];
-/**
- * Address one region's status route. The two regions are separate provider
- * stacks; every card request carries the region whose tab the user is on.
- */
-declare function withTraeRegion(path: string, region: TraeRegion): string;
-/**
- * Read the region parameter off a status-route URL. Absent means the domestic
- * tab (`cn`); a present-but-unknown value returns undefined so the route can
- * answer 400 instead of guessing.
- */
-declare function regionOfTraeStatusUrl(url: string): TraeRegion | undefined;
-/** One credit pack and its remaining credit. */
-interface TraeWebCreditAccount {
-  displayDesc: string;
-  remain: number;
-  size: number;
-  /**
-   * When this pack lapses, in epoch milliseconds, taken from the upstream's own
-   * `end_time`. Absent when the upstream reported no usable time (0 / missing),
-   * so a consumer can tell "no date" apart from "1970".
-   */
-  expiresAtMs?: number;
-}
-/** Credit lapsing inside one horizon, as the card reports it. */
-interface TraeWebExpiringCredits {
-  /** Sum of the contributing packs' remaining credit. */
-  total: number;
-  /** How many packs contribute. */
-  packs: number;
-  /** Soonest expiry among them, epoch milliseconds. */
-  earliestExpiresAtMs?: number;
-}
-/**
- * Credit at risk, bucketed by how soon it lapses.
- *
- * Only present when at least one pack carried a usable `expiresAtMs` — a card
- * must never read "we were not told when anything expires" as "nothing is
- * about to lapse".
- */
-interface TraeWebCreditExpiry {
-  within24h: TraeWebExpiringCredits;
-  within3d: TraeWebExpiringCredits;
-  within7d: TraeWebExpiringCredits;
-  /** Packs already past their end time but still carrying credit. */
-  expired: TraeWebExpiringCredits;
-}
-/** Aggregated usage/credit answer rendered by the plugin card. */
-interface TraeWebCredits {
-  total: number;
-  consumed: number;
-  available: number;
-  workAvailable: number;
-  generalAvailable: number;
-  accounts: readonly TraeWebCreditAccount[];
-  /**
-   * Credit lapsing soon, for the card's warning banner.
-   *
-   * Derived from the per-pack {@link TraeWebCreditAccount.expiresAtMs} the
-   * `/usage` route already carries, so it costs no extra upstream read.
-   */
-  expiry?: TraeWebCreditExpiry;
-}
-/** Editable Trae model row rendered by the plugin-owned settings card. */
-interface TraeWebModel {
-  id: string;
-  name: string;
-  contextWindow?: number;
-  maxTokens?: number;
-  input?: ('text' | 'image')[];
-  creditMultiplier?: number;
-  reasoningSupported?: boolean;
-  reasoning?: {
-    supported: string[];
-    defaultEffort?: string;
-  };
-  maxContextWindow?: number;
+   * subscription-based and must read {@link payStatus} instead; guarding here
+   * keeps the card's degraded `creditsError` message diagnosable rather than
+   * letting an ai credential hit an unverified path on its pay gateway.
+   */
+  private requireCnRegion;
+  /** Total entitlements / credits and per-pack breakdown. */
+  snapshot(signal?: AbortSignal): Promise<TraeUsageSnapshot>;
   /**
-   * Trae's own image-capability flag, as the runtime catalog carries it. The
-   * card renders these rows with their image checkbox already ticked so the
-   * control matches what DSH is actually told (issue #16); absent means the
-   * directory did not declare it, which is not a capability claim either way.
+   * Daily check-in status. Read-only, and answered with or without the device
+   * header — the claim is what needs it.
+   *
+   * The read DOES carry the header whenever this installation has one, and
+   * that is deliberate rather than incidental: `did_checked_in` is answered
+   * per device, so omitting the header would make a device that already claimed
+   * today look identical to one that never has (measured 2026-09-26, see
+   * {@link TraeCheckinStatus.didCheckedIn}).
    */
-  multimodal?: boolean;
+  checkinStatus(signal?: AbortSignal): Promise<TraeCheckinStatus>;
   /**
-   * The availability verdict from the one-click test, when this card session
-   * has run one. Absent = not tested. Deliberately NOT persisted with the
-   * settings: it describes one moment on one account, and a stale verdict shown
-   * as current is worse than a blank field.
+   * Claim today's check-in reward. The ONLY state-changing call in this client.
+   *
+   * The upstream is idempotent per Beijing day (verified 2026-09-24: repeating
+   * the call on an already-claimed day answers `code: 0` while the entitlement
+   * total stays byte-identical), so a double click cannot double-grant. The
+   * card and its route still guard, because "cannot double-grant" is a property
+   * of the upstream we verify rather than one we rely on.
+   *
+   * A business refusal arrives as HTTP 200 with a non-zero `code` — most often
+   * `9004` when the request carries no `x-device-id`. That is reported as
+   * `claimed: false` rather than thrown, so the caller can tell "the upstream
+   * refused this" apart from "the request never arrived".
    */
-  probe?: TraeModelProbeVerdict;
-  /** Upstream's own words for the verdict, when it gave any. */
-  probeDetail?: string;
+  claimCheckin(signal?: AbortSignal): Promise<TraeCheckinClaim>;
+  /** Rewards / activity rules. */
+  activities(signal?: AbortSignal): Promise<TraeActivityRule[]>;
+  /** Convenience: snapshot + check-in + activities in one call (best-effort, non-fatal on missing). */
+  view(signal?: AbortSignal): Promise<TraeUsageView>;
 }
+//#endregion
+//#region src/account-pool.d.ts
 /**
- * One model's availability verdict from the one-click test.
+ * Which of the pool's writers produced a measurement.
  *
- * `unknown` is a first-class outcome, not a failure: a timeout, a proxy drop or
- * a throttle says nothing about the model, and reporting it as unusable would
- * make the user delete a model that works. Only an upstream refusal is negative.
+ * `test-batch` — the user pressed "test" (or the check-in batch), so the outcome
+ *   is a deliberate measurement of the target model.
+ * `live-request` — a real chat request failed and its failure was recorded so the
+ *   NEXT request starts from a measurement instead of rediscovering the same wall.
+ *
+ * The distinction is diagnostic, not behavioural: both feed the same routing and
+ * cooling logic. It exists so a user who watched an account measure `ok` and
+ * later saw it limited can tell whether that was a later live failure (expected)
+ * or an older value winning (a bug).
  */
-type TraeModelProbeVerdict = 'available' | 'gated' | 'unsupported' | 'rate_limited' | 'auth' | 'unknown';
-/** What the probe route answers with. */
-interface TraeModelsTestResponse {
-  /** One entry per model tested, in the order they were sent. */
-  results: {
-    id: string;
-    verdict: TraeModelProbeVerdict;
-    detail: string;
-  }[];
-  /** Models skipped because the region has no live catalog row for them. */
-  skipped?: string[];
+type TraePoolProbeSource = 'test-batch' | 'live-request';
+/** One account's pool entry: what the picker needs, plus its last measurement. */
+interface TraePoolAccount {
+  /** Stable account id (the same one `TraeWebAccount` carries). */
+  id: string;
+  /** Human name, or `''` when the desktop app recorded none. */
+  accountName: string;
 }
 /**
- * Daily check-in state rendered below the credit stats.
- *
- * The two booleans answer DIFFERENT questions and must never be collapsed into
- * one "done" flag — doing that was a shipped bug (see CHANGELOG 2.3.1):
- *
- *  - `checkedIn` is ACCOUNT-level: today's reward pack exists for this account,
- *    so there is nothing left to claim and the balance already includes it.
- *  - `didCheckedIn` is DEVICE-level: this MACHINE already spent its one
- *    check-in for the day, whichever account spent it. The upstream keys it on
- *    the `x-device-id` in the request and answers it per device, not per
- *    account (measured 2026-09-26: the same account and Beijing day answered
- *    `false` with the header omitted, with a synthetic id, and with another
- *    install's id, and `true` for the device that actually claimed).
+ * What the pool knows about ONE account's last test of the target model.
  *
- * So `didCheckedIn && !checkedIn` is the "switched account" case: the device's
- * daily check-in is used up, but THIS account was never rewarded. Claiming
- * again is refused upstream (business code 9095, "该设备今日已参与签到"), so
- * the card disables the button — but it must say that, not "claimed today".
+ * `undefined` means "never tested", which is deliberately distinct from every
+ * measured outcome: an untested account is a candidate (the user may want to use
+ * it now) whereas a measured failure is not. Collapsing the two would make a
+ * fresh pool look empty until the first test.
  */
-interface TraeWebCheckin {
-  checkedIn: boolean;
-  didCheckedIn: boolean;
-  credits: number;
-  enabled: boolean;
-  extraCredits?: number;
-}
-/** The claim route's answer, so the card can report a business refusal verbatim. */
-interface TraeWebCheckinClaim {
-  /** False when the upstream answered a non-zero business code (e.g. 9004). */
-  claimed: boolean;
+interface TraePoolProbe {
+  outcome: TraePoolOutcome;
+  /** When this measurement was taken, in epoch ms. */
+  atMs: number;
+  /** WHAT WROTE this measurement; absent for records written before it existed. */
+  source?: TraePoolProbeSource;
   /**
-   * True only when THIS ACCOUNT's reward for today already exists, so nothing
-   * was sent upstream. Distinct from {@link TraeWebCheckinClaim.deviceCheckedIn}:
-   * a device that already claimed for another account leaves this false.
+   * When this account may be usable again, when the upstream stated a time.
+   *
+   * Present for a `rate-limited` / `out-of-credit` outcome whose failure carried
+   * a reset sentence. ABSENT when the upstream named no time — that absence is
+   * meaningful and must never be turned into a locally invented countdown.
    */
-  alreadyCheckedIn: boolean;
+  retryAtMs?: number;
   /**
-   * True when today's check-in was already spent on this DEVICE (by this or
-   * another account), so no claim was sent or the upstream refused it with
-   * 9095. Not an error: it is the truthful answer to "can this account claim
-   * here today?" — no, and the reason is the machine, not the account.
+   * The upstream's own words on the failure, already redacted.
+   *
+   * Kept so the card can say WHY an account left the pool instead of repeating
+   * one generic sentence for a DNS failure, a gateway 502 and a cancelled request
+   * alike.
    */
-  deviceCheckedIn?: boolean;
-  code?: number;
   message?: string;
-  /** The refreshed check-in state, present whenever the claim path ran. */
-  checkin?: TraeWebCheckin;
-}
-/** One reward activity rule (name + work/general credits when present). */
-interface TraeWebActivity {
-  activityId: string;
-  enabled: boolean;
-  workCredits?: number;
-  generalCredits?: number;
-}
-interface TraeWebAccount {
-  id: string;
-  accountName: string;
-  edition: 'cn' | 'sg' | 'solo' | 'solo-sg';
-  /** Routing bucket of this account, derived from its credential. */
-  region: TraeRegion;
-  source: 'desktop' | 'dsh' | 'cli';
-  tokenExpiresAtMs: number;
   /**
-   * When this account's REFRESH token expires, when the credential carries one.
+   * WHICH MODEL this measurement is about.
    *
-   * The access token above is renewed automatically — the plugin refreshes it
-   * five minutes before it lapses — so by itself it answers "when does this
-   * need attention", which is "never, while the refresh token lives". The
-   * refresh token is the real horizon: once IT expires the automatic renewal
-   * stops working and the user must sign in to Trae again. Before this field the
-   * card could only say "auto-renewal", which stays true right up to the moment
-   * it silently stops being true.
+   * `1005` (plan gate), `4001` (no SOLO function serves this `config_name`) and
+   * `4011` (throttle) are all ACCOUNT × MODEL conditions: the same credential
+   * answers other models at the same second. A row rendered as plain "可用"
+   * therefore claims more than the measurement says. Storing the model id is what
+   * makes the claim checkable.
+   *
+   * Deliberately NOT inherited when an update omits it — the opposite of
+   * `accountName` and `retryAtMs`. Those describe the ACCOUNT (still true when a
+   * later writer cannot see them); the model describes THIS measurement, and
+   * carrying an older id forward would relabel a fresh measurement with a model
+   * it was not taken on.
    */
-  refreshExpiresAtMs?: number;
-  selected: boolean;
-}
-/**
- * The account the Trae desktop app is signed in to right now, when it differs
- * from the one this plugin is bound to (issue #29).
- *
- * Reported on the usage document so the card can offer one-click follow without
- * an extra round trip; also written back on a POST to the accounts refresh
- * route when the client confirms it saw the hint. Absent whenever the two
- * agree or the app is not readable — a healthy document carries no extra
- * fields and the plugin never bills from this value directly: the FOLLOW is a
- * settings write of `accounts.<region>`, made by the card or by the host's
- * follow switch, never a silent rebind here.
- */
-interface TraeWebAppLogin {
-  id: string;
-  accountName: string;
-  edition: 'cn' | 'sg' | 'solo' | 'solo-sg';
-  region: TraeRegion;
-}
-/**
- * The per-account state shown inside an account row of the card's table.
- *
- * Every locally detected account in a region is rendered as a row; the
- * interesting per-account facts differ by region, which is why this is a union
- * of the three surfaces the card previously showed only for the BOUND account:
- *
- *  - CN rows carry their own check-in state (Trae keys the daily reward per
- *    ACCOUNT, and the one-per-device tally per DEVICE, see {@link TraeWebCheckin})
- *    and their Work/General balances.
- *  - ai rows carry their own subscription / trial status.
- *
- * Each field is optional: a read that fails keeps the row visible (perhaps
- * without a figure) rather than dropping the account and its switch.
- */
-interface TraeWebAccountState {
-  /** The account this state belongs to. */
-  id: string;
-  /** CN: today's check-in state of this account (absent for ai rows). */
-  checkin?: TraeWebCheckin;
-  /** CN: this account's Work/General balances (absent for ai rows). */
-  credits?: TraeWebCredits;
-  /** ai: this account's subscription / trial status (absent for CN rows). */
-  payStatus?: TraeWebPayStatus;
+  modelId?: string;
+  /**
+   * The account's display name AT THE MOMENT IT WAS MEASURED.
+   *
+   * Stored because a saved pool member can outlive its sign-in: once the desktop
+   * app drops a login, that id resolves to no listed account and the card has
+   * nothing left to render for it. The name was in hand at write time and nowhere
+   * afterwards. Snapshots are never refreshed from a LISTING — only a real
+   * measurement writes this.
+   */
+  accountName?: string;
 }
-interface TraeWebCreditAlternative {
+/** One account's live credit situation, as the pool ranks it. */
+interface TraePoolCredits {
+  /** Remaining credit across every pack (`available` of the upstream snapshot). */
+  total: number;
+  /** The Work bucket, kept for display: SOLO chat does NOT spend it. */
+  workAvailable?: number;
+  /** The General bucket, kept for display: this is what SOLO chat spends. */
+  generalAvailable?: number;
+  /** Credits expiring within the card's "soon" window (3 days). */
+  expiringSoon: number;
+  /** When the nearest at-risk pack expires, if any does. */
+  nearestExpiryMs?: number;
+}
+/**
+ * Everything the ranking rule reads about one account. Assembled by the Host from
+ * the credential store, the per-account credit read, and the runtime probe store
+ * — this module only consumes it.
+ */
+interface TraePoolMember {
+  account: TraePoolAccount;
+  credits?: TraePoolCredits;
+  probe?: TraePoolProbe;
+  /** When the stored credential expires, used as the final tie-break. */
+  tokenExpiresAtMs?: number;
+}
+/**
+ * How one account answered the target model.
+ *
+ * The first nine values are the workbuddy taxonomy verbatim so the two cards read
+ * the same. The tenth, `plan-gated`, is Trae-only: upstream `1005` says THIS
+ * account's plan does not cover this model while another account's plan may, and
+ * no amount of waiting changes a plan — so it must not be folded into
+ * `credential-rejected` (which would demand a re-login) nor into
+ * `policy-rejected` (which means a content filter tripped on ONE request).
+ */
+type TraePoolOutcome = 'ok' | 'rate-limited' | 'model-busy' | 'out-of-credit' | 'credential-rejected' | 'policy-rejected' | 'plan-gated' | 'unavailable' | 'not-found' | 'failed';
+//#endregion
+//#region src/model-probe.d.ts
+/** How one model answered. */
+type TraeProbeVerdict = 'available' | 'gated' | 'unsupported' | 'rate_limited' | 'auth' | 'unknown';
+interface TraeProbeResult {
+  /** The model id as the card knows it. */
   id: string;
-  accountName: string;
-  edition: TraeWebAccount['edition'];
-  workAvailable: number;
-  generalAvailable: number;
-}
-/** One probed candidate path and why it did not yield an account. */
-interface TraeWebSearchPath {
-  path: string;
-  edition: 'cn' | 'sg' | 'solo' | 'solo-sg';
-  source: 'desktop' | 'cli';
-  reason: 'missing' | 'unreadable' | 'invalid';
-  message?: string;
-}
-/**
- * Peel ONE `{get(): T}` live reference, the shape DSH 0.1.7 delivers a
- * volatile-marked settings field as (see {@link unwrapVolatileDeep}).
- */
-declare function unwrapVolatile<T>(value: T): T;
-/**
- * Deep copy of a value with every `{get(): T}` live reference replaced by the
- * value it resolves to.
- *
- * DSH 0.1.7 hands volatile-marked fields back as live references, and a live
- * reference is still `typeof === 'object'` — so it passes a naive object check
- * and every lookup on it is `undefined`. Worse, spreading one (`{ ...ref }`)
- * does NOT read the field: it produces `{ get: <function> }`. Any merge that
- * spreads a resolved field to preserve its siblings — the card's "write one
- * region, keep the other" write, or the account map's spread — would otherwise
- * DROP every sibling and leak a function into the document.
- *
- * Both halves therefore unwrap before touching a resolved field. This lives in
- * the node-free host↔client bridge because the browser half needs it too.
- *
- * Non-reference values are recursed into so a nested volatile field is caught
- * as well; arrays and objects are rebuilt rather than mutated, so the caller's
- * value is never touched.
- */
-declare function unwrapVolatileDeep<T>(value: T): T;
-/**
- * Read the per-region account selections out of a settings value.
- *
- * SHARED because `accounts` now has TWO writers: the card, and the composer
- * panel's account table (2.14.0). Two writers of one field must use one merge
- * rule, or they drift — and the rule is not obvious.
- *
- * Deep-unwraps first: on DSH 0.1.7 a volatile field arrives as a `{get(): T}`
- * live reference, which passes the `typeof === 'object'` check and would be
- * returned as if it were the map. Every lookup on it is then `undefined`, and
- * the merge (`{ ...configured, [region]: id }`) would spread a reference into
- * `{get: <function>}` — dropping the other region's selection and leaking a
- * function into the settings document.
- */
-declare function configuredAccountsOf(configured: unknown): Record<string, string>;
-/**
- * Whether the host-side "follow the Trae app's sign-in" switch is on (issue
- * #29). Absent reads as OFF, so an existing configuration keeps the strict
- * bind it shipped with and the switch is an opt-in — the same opt-out
- * semantics as {@link regionEnabledOf}, for the same reason: a config written
- * before this field existed cannot ask for behavior it never declared.
- *
- * Reads the whole settings section (or the bare field); deep-unwraps first
- * because on DSH 0.1.7 a volatile field arrives as a `{get(): T}` live
- * reference, whose `typeof === 'object'` would otherwise pass a naive check.
- */
-declare function followAppLoginEnabled(configured: unknown): boolean;
+  verdict: TraeProbeVerdict;
+  /** Upstream's own words (already translated), or a short note. */
+  detail: string;
+}
 /**
- * Build the next `regions` settings value for the card's save. The write
- * targets ONLY the signed-in account's region slot; every other region's slot
- * is carried over untouched, so switching accounts never clobbers the other
- * region's picks. Tolerates any stored shape (absent, non-object) by starting
- * from an empty document.
+ * How long one probe may take. Trae answers a one-word prompt in a few seconds;
+ * beyond this the answer is not worth waiting for and is reported as unknown.
  */
-declare function nextRegionSlots<Slot extends object>(regions: unknown, region: TraeRegion, slot: Slot): Record<string, unknown>;
+declare const TRAE_PROBE_TIMEOUT_MS = 30000;
 /**
- * Whether one region's provider is switched on. Opt-out semantics: only an
- * explicit `false` disables it, so a config written before this switch existed
- * (and the pre-region-split flat fields, which never carry `enabled`) keep both
- * providers running exactly as before. The Host reads the same rule through
- * `regionStateOf`, so card and Host can never disagree about a region's state.
+ * Classify a failure that arrived as a thrown stream error rather than a
+ * returned result.
  *
- * `value` may be the whole settings section or the `regions` map (see
- * {@link regionsMapOf}).
+ * The bridge errors the stream (instead of returning a result) when a refusal
+ * interrupts an answer that had already started; its message is the same
+ * translated text, so a named code is still decisive. Anything without a
+ * recognised code — an abort, a socket reset, a proxy — stays `unknown`.
  */
-declare function regionEnabledOf(value: unknown, region: TraeRegion): boolean;
+declare function classifyProbeError(message: string): {
+  verdict: TraeProbeVerdict;
+  detail: string;
+};
 /**
- * Build the next `regions` settings value for a provider on/off toggle. ONLY
- * the target region's `enabled` flag changes: every other field of that slot
- * (its directory, selection, image opt-ins, context budgets) and every other
- * region's slot are carried over verbatim, so switching a provider off never
- * discards the user's model picks and switching it back on restores them.
- *
- * This is deliberately separate from {@link nextRegionSlots}: that helper
- * writes a whole slot from a signed-in tab's draft, while this one must work
- * for a region that is signed OUT — which is precisely the region a user wants
- * to switch off (no international install, no international account).
+ * Classify a completed upstream call.
  *
- * `value` may be the whole settings section or the `regions` map; the RETURN
- * value is always the `regions` map, i.e. exactly what `settingsScope.set(
- * 'regions', ...)` needs.
+ * `result` is what `TraeSoloBridge.chatStream` returned, so a refusal that
+ * arrived inside a 200 body has already been turned into a real error result
+ * (and its code translated into `message`) by the bridge — this function only
+ * has to read it back.
  */
-declare function nextRegionEnabled(value: unknown, region: TraeRegion, enabled: boolean): Record<string, unknown>;
+declare function classifyProbeResult(result: TraeChatResult, outputSeen: boolean): {
+  verdict: TraeProbeVerdict;
+  detail: string;
+};
 /**
- * The two seats this region's credit readout can occupy.
- *
- * `composer` is the composer tool row (`conversation.input.left`); `stats` is
- * the ambient dock below the composer card (`conversation.composer.dock`),
- * beside the shell's own round/step/token pills.
+ * The chat call one probe makes.
  *
- * WHY THE SEAT IS A CHOICE AT ALL (learned from dsh-connect-workbuddy issue
- * #62): the composer tool row is a LIST seat, so it is shared not only with the
- * shell's own controls but with any other plugin that registers there — and a
- * list seat cannot promise that every occupant is visible. The report behind
- * that issue is exactly that: with a third-party plugin installed the readout
- * stopped appearing. A fixed seat therefore lets one plugin's presence decide
- * another's, so the seat belongs to the user.
+ * `inputTokens` pads the user turn so the probe carries roughly as much text as
+ * a real conversation. Size matters because an upstream that refuses LARGE
+ * requests will happily answer a one-word probe, and a verdict earned by a
+ * 1-token request says nothing about the 30k-token turn the user is about to
+ * send. `0` keeps the historical minimal probe (one word) — that is the default
+ * because it spends the least credit and answers the question the pool ranks on
+ * ("can this account talk at all").
  *
- * Named as a union rather than a boolean because a third seat is plausible and
- * a `showAtTop: boolean` would have to be MIGRATED rather than extended.
+ * The filler is `x` words: one ASCII word is about one token, so the body size
+ * is predictable (tokens ≈ inputTokens × 2 characters) without a tokenizer.
  */
-type TraeCreditPosition = 'composer' | 'stats';
 /**
- * Which seat one region's readout uses, defaulting to the composer row.
+ * The largest probe this plugin will pad.
  *
- * Anything other than an explicit `'stats'` reads as `'composer'`, which covers
- * the two cases that matter: a profile written BEFORE this setting existed (the
- * composer row was the only seat, so an upgrade moves nothing on screen), and a
- * hand-edited value the schema does not know. Falling back rather than
- * rendering nowhere is deliberate — an unrecognized value must not make the
- * readout disappear, which is the very defect this setting exists to fix.
- *
- * `value` may be the whole settings section or the `regions` map (see
- * {@link regionsMapOf}).
+ * A 100k-token probe is already ~200 KB of JSON; anything above that is a request
+ * the user's real turn would not plausibly reach in this product, and a config
+ * file edited by hand must not turn one "test all" click into a multi-megabyte
+ * upload.
  */
-declare function regionCreditPositionOf(value: unknown, region: TraeRegion): TraeCreditPosition;
+declare const MAX_PROBE_INPUT_TOKENS = 100000;
+declare function probeBody(model: string, inputTokens?: number): string;
 /**
- * Build the next `regions` settings value for one region's credit seat.
- *
- * Same merge rule as every sibling region write: only the target region's
- * `creditPosition` changes, so a seat change cannot drop that slot's model
- * directory, selection, budgets or enabled flag, nor touch the other region.
+ * Probe one model through the bridge the plugin actually chats with, so the
+ * recorded verdict describes the user's real path (same wire resolution, same
+ * function stamping, same error translation).
+ */
+declare function probeOneModel(chat: (body: string, signal?: AbortSignal) => Promise<TraeChatResult>, id: string, timeoutMs?: number, inputTokens?: number): Promise<TraeProbeResult>;
+/**
+ * Probe a list of models ONE AT A TIME.
  *
- * `value` may be the whole settings section or the `regions` map; the RETURN
- * value is always the `regions` map, i.e. exactly what `settingsScope.set(
- * 'regions', ...)` needs.
+ * Sequential on purpose: Trae throttles bursts, and a burst of parallel probes
+ * would manufacture the very `rate_limited`/`unknown` verdicts this feature
+ * must avoid. An authentication failure stops the run — every later probe would
+ * fail the same way, and spending calls to learn that again is waste.
  */
-declare function nextRegionCreditPosition(value: unknown, region: TraeRegion, position: TraeCreditPosition): Record<string, unknown>;
-/** Subscription status of an international (ai) account, rendered instead of the CN credit packs. */
-interface TraeWebPayStatus {
-  isDollarUsageBilling: boolean;
-  hasPackage: boolean;
-  isPayFreshman: boolean;
-  inTrial: boolean;
-  trialEndTimeMs: number;
-  enableSoloLite: boolean;
-  enableSoloBuilder: boolean;
-  enableSoloCoder: boolean;
-  enableSoloWeb: boolean;
-  /** Trae's authoritative tier number (`user_pay_identity`); `0` means Free. */
-  payIdentity?: number;
-  /** Trae's authoritative tier label (`user_pay_identity_str`), e.g. `Free`. */
-  payIdentityStr?: string;
-  fission?: {
-    startTimeMs: number;
-    expireTimeMs: number;
-    maxUsage: number;
-  };
-}
-/** The JSON document the plugin card renders. */
-type TraeWebUsage = {
-  status: 'signed-out';
-  accounts: readonly TraeWebAccount[];
-  message?: string;
-  searched?: readonly TraeWebSearchPath[];
-  enabled?: boolean;
-} | {
-  status: 'signed-in';
+declare function probeModelsSequentially(chat: (body: string, signal?: AbortSignal) => Promise<TraeChatResult>, ids: readonly string[], onResult?: (result: TraeProbeResult, index: number) => void): Promise<TraeProbeResult[]>;
+//#endregion
+//#region src/account-pool-run.d.ts
+/** One account's check-in outcome. */
+interface TraePoolCheckinRow {
   accountId: string;
   accountName: string;
-  tokenExpiresAtMs: number;
-  /**
-   * When the BOUND account's refresh token expires (absent when the credential
-   * carries none). See {@link TraeWebAccount.refreshExpiresAtMs} — this is the
-   * horizon that actually matters, because the access token above renews
-   * itself until this one lapses.
-   */
-  refreshExpiresAtMs?: number;
-  /** Which per-region model directory and selection this account owns. */
-  region: TraeRegion;
-  /** Whether this region's provider is currently offered to DSH. */
-  enabled?: boolean;
-  accounts: readonly TraeWebAccount[];
-  models: readonly TraeWebModel[];
-  enabledModelIds: readonly string[];
-  rawChat?: {
-    state: 'disabled' | 'unchecked' | 'available' | 'protocol-gated' | 'authentication' | 'credit' | 'rate' | 'transport' | 'server';
-    checkedAtMs?: number;
-    status?: number;
-  };
-  credits?: TraeWebCredits;
-  creditsError?: string;
-  /**
-   * Present only when the bound account is out of credit AND another account
-   * on this machine has some (issue #25). The card then offers a one-click
-   * switch instead of leaving a permanently empty panel. Absent in every
-   * other case so a healthy account never pays for the extra read.
-   */
-  alternatives?: readonly TraeWebCreditAlternative[];
-  /**
-   * Present only when the Trae app's CURRENT sign-in differs from the
-   * account this plugin is bound to (issue #29): the card then offers a
-   * one-click follow instead of making the user hunt the account dropdown
-   * after every app-side sign-out. Absent in every other case — a healthy
-   * document costs no extra read beyond the accounts scan the document
-   * already runs.
-   */
-  appLogin?: TraeWebAppLogin;
   /**
-   * Daily check-in state (CN only). Absent on the international region,
-   * whose check-in surface does not exist — probed 2026-09-24: the
-   * `/trae/api/v2/ug/*` family answers 404 on every ai gateway, so the card
-   * shows no claim button there rather than a button that cannot work.
+   * - `claimed` — the upstream accepted today's claim for this account.
+   * - `already` — this ACCOUNT's reward for today already exists, so nothing was sent.
+   * - `device-already` — the MACHINE already spent today (9095). Not an account
+   *   failure and not a success: a truthful "no, this device is used up".
+   * - `disabled` — the upstream's check-in activity is not enabled/active for
+   *   this account. Reported separately rather than as `failed`, because claiming
+   *   is impossible by policy and calling it an error would read as a broken
+   *   plugin.
+   * - `failed` — the request never landed, or the credential could not be read.
    */
-  checkin?: TraeWebCheckin;
-  checkinError?: string;
-  /** Subscription status of an international account (region ai only). */
-  payStatus?: TraeWebPayStatus;
-  payStatusError?: string;
-} | {
-  status: 'error';
-  message: string;
-};
+  status: 'claimed' | 'already' | 'device-already' | 'disabled' | 'failed';
+  /** Credits the upstream says this claim carries, when it stated a figure. */
+  credit?: number;
+  /** The upstream's own words on failure/refusal, redacted by the caller. */
+  message?: string;
+}
+/** One account's test outcome. */
+interface TraePoolTestRow {
+  accountId: string;
+  accountName: string;
+  /** The model this row was probed on — one model per batch, recorded per row. */
+  modelId: string;
+  outcome: TraeProbeResult['verdict'];
+  /** Upstream's own words / the plugin's reading of the code. */
+  detail: string;
+  /** A time the upstream named, when it named one. */
+  retryAtMs?: number;
+}
 //#endregion
 //#region src/web-status.d.ts
 /**
- * Constructor dependencies. Everything region-specific is addressed by the
- * region the request names: the two regions are separate provider stacks, so
+ * Constructor dependencies. Everything panel-specific is addressed by the
+ * panel the request names: the two regions are separate provider stacks, so
  * the card must be served the directory, selection, and credits of the tab the
  * user is on.
  */
 interface TraeUsageRouteOptions {
-  /** The region-scoped credential store backing each region's requests. */
-  store(region: TraeRegion): TraeCredentialStore;
-  /** The region-scoped usage client (CN work credits / international pay status). */
-  client(region: TraeRegion): TraeUsageClient;
+  /** The panel-scoped credential store backing each region's requests. */
+  store(panel: TraePanel): TraeCredentialStore;
+  /** The panel-scoped usage client (CN work credits / international pay status). */
+  client(panel: TraePanel): TraeUsageClient;
   /**
    * CN credit balances of an account OTHER than the bound one, read without
    * changing which account is bound (issue #25). Optional: when absent the
    * exhausted-account hint is simply not offered.
    */
-  creditsOfAccount?(region: TraeRegion, accountId: string): Promise<TraeWebCredits | undefined>;
+  creditsOfAccount?(panel: TraePanel, accountId: string): Promise<TraeWebCredits | undefined>;
   /**
    * Per-account status for one row of the card's account table: CN → check-in
    * + balances, ai → subscription. Read without changing which account is
    * bound. Optional: when absent the account rows show no check-in/credits/
    * subscription figures (the table still lists each account and its switch).
    */
-  accountStateOf?(region: TraeRegion, accountId: string): Promise<TraeWebAccountState | undefined>;
+  accountStateOf?(panel: TraePanel, accountId: string): Promise<TraeWebAccountState | undefined>;
   /**
    * Claim today's check-in reward for ONE named account, without moving the
    * binding. Optional: absent means the per-row claim button is disabled (the
    * check-in surface simply is not offered).
    */
-  claimCheckinOf?(region: TraeRegion, accountId: string): Promise<{
+  claimCheckinOf?(panel: TraePanel, accountId: string): Promise<{
     claim: TraeCheckinClaim;
     checkin: TraeCheckinStatus;
   } | undefined>;
@@ -2367,24 +3210,24 @@ interface TraeUsageRouteOptions {
    * Read-only — the HOST never rebinds from this value; the follow is a
    * settings write, made by the card or by the host's follow switch.
    */
-  liveLogin?(region: TraeRegion): Promise<TraeWebAppLogin | undefined>;
+  liveLogin?(panel: TraePanel): Promise<TraeWebAppLogin | undefined>;
   /** The requested region's last-refreshed raw directory (one entry per upstream model). */
-  displayModels(region: TraeRegion): readonly TraeModelInfo[];
-  /** The user's model selection in the requested region, stored as model id (= Trae name). */
-  enabledModelIds(region: TraeRegion): readonly string[];
+  displayModels(panel: TraePanel): readonly TraeModelInfo[];
+  /** The user's model selection in the requested panel, stored as model id (= Trae name). */
+  enabledModelIds(panel: TraePanel): readonly string[];
   /**
    * Whether the requested region's provider is currently offered to DSH. The
    * card renders this as the tab's on/off checkbox, so the switch reflects the
    * committed settings value rather than a local guess.
    */
-  regionEnabled(region: TraeRegion): boolean;
+  regionEnabled(panel: TraePanel): boolean;
   /** Re-read one region's live directory from the upstream. */
-  discoverModels?(region: TraeRegion, signal?: AbortSignal): Promise<readonly TraeModelInfo[]>;
+  discoverModels?(panel: TraePanel, signal?: AbortSignal): Promise<readonly TraeModelInfo[]>;
   /**
    * Test the given model ids for availability, one real (minimal) chat call
    * each. Present only when the region's chat path is wired.
    */
-  probeModels?(region: TraeRegion, ids: readonly string[]): Promise<{
+  probeModels?(panel: TraePanel, ids: readonly string[]): Promise<{
     results: {
       id: string;
       verdict: string;
@@ -2392,78 +3235,87 @@ interface TraeUsageRouteOptions {
     }[];
     skipped?: string[];
   }>;
-  /** Raw-Chat capability state of the requested region. */
-  rawDiagnostic?(region: TraeRegion): TraeRawDiagnostic;
+  /** Raw-Chat capability state of the requested panel. */
+  rawDiagnostic?(panel: TraePanel): TraeRawDiagnostic;
+  /**
+   * The account pool's host side, when the panel can run one. Optional on
+   * purpose: the pool is an add-on to the status document, and a harness without
+   * it (a test host, or a panel stack that failed to build) must still get a
+   * complete usage answer with no `pool` field.
+   */
+  pool?: TraePoolDeps;
+}
+/**
+ * What the pool surface needs from the Host, addressed by panel.
+ *
+ * The split is deliberate. The card never learns a credential and never writes a
+ * measurement: it sends an ACTION (`checkin` / `test` / `remove`) and reads the
+ * ranking back out of the status document. Everything here is therefore either a
+ * cheap local read (preferences, roster, saved names) or an explicitly user-
+ * triggered spend (the batches). The one thing that must never happen on a GET is
+ * an upstream call made for every row on every poll — the card already lazy-loads
+ * per-account state, so `checkedInToday` is cached and skippable by design.
+ */
+interface TraePoolDeps {
+  /** The panel's saved pool preferences, read from live settings. */
+  preferences(panel: TraePanel): TraePoolPreferences;
+  /**
+   * The full pool membership WITH live credit reads — the expensive version.
+   * Only the status document's own assembly and an explicit batch call it.
+   */
+  members(panel: TraePanel): Promise<readonly TraePoolMember[]>;
+  /**
+   * The checked ids that still resolve to a local sign-in, from a local scan only.
+   * The batch route's empty-pool guard runs this on every request, so it must not
+   * cost an upstream call — {@link members} is not suitable there.
+   */
+  effectiveMemberAccountIds?(panel: TraePanel): Promise<readonly string[]>;
+  /** Last measured display name per saved id, for members whose sign-in is gone. */
+  memberNames?(panel: TraePanel): Promise<Record<string, string>>;
+  /** Local sign-ins the pool does NOT cover, so the card can offer them to check. */
+  otherAccounts?(panel: TraePanel): Promise<readonly TraePoolAccount[]>;
+  /** Which account the request path would bill right now, after applying the pool. */
+  currentAccountId?(panel: TraePanel): Promise<string | undefined>;
+  /** Whether this panel's upstream rewards a daily check-in at all. */
+  checkinSupported?(panel: TraePanel): boolean;
+  /**
+   * Today's check-in state per account, from the cached per-account reads.
+   *
+   * A missing entry means "not read", which the card renders as unknown rather
+   * than as a definite "not checked in". `deviceCheckedIn` is the Trae half of the
+   * pair: the daily claim is keyed to `x-device-id`, so an account can be unpaid
+   * TODAY because this machine already spent its claim on another account.
+   */
+  checkinState?(panel: TraePanel): Promise<Record<string, TraePoolCheckinState>>;
+  /** Run the check-in batch. Persists nothing to settings; drops its own caches. */
+  checkin?(panel: TraePanel): Promise<readonly TraePoolCheckinRow[]>;
+  /** Run the model-availability batch and persist its measurements. */
+  test?(panel: TraePanel, modelId: string, onRow?: (row: TraePoolTestRow) => void): Promise<readonly TraePoolTestRow[]>;
+  /** Probe ONE account against the target model (the row's own test button). */
+  testOne?(panel: TraePanel, accountId: string): Promise<TraePoolTestRow | undefined>;
+  /** Forget an account's measurement — used when the user removes it from the pool. */
+  removeOne?(panel: TraePanel, accountId: string): Promise<boolean>;
+  /** The panel's catalog, the source of the free-model default and the stale check. */
+  catalog?(panel: TraePanel): readonly TraeModelInfo[];
+}
+/** One row's cached check-in facts; see {@link TraePoolDeps.checkinState}. */
+interface TraePoolCheckinState {
+  checkedIn: boolean;
+  deviceCheckedIn?: boolean;
+  /** Whether this account is offered the reward at all; false renders `disabled`. */
+  enabled?: boolean;
 }
 /**
- * Assemble one region's card document. `region` is the tab the card is on; the
- * region-scoped store already answers with only that region's accounts, so the
+ * Assemble one region's card document. `panel` is the tab the card is on; the
+ * panel-scoped store already answers with only that region's accounts, so the
  * document's model slots and account list are that region's by construction.
  * Sign-in state is read-only; credit is a live billing answer whose failure
  * degrades to `creditsError` rather than failing the whole document.
  */
-declare function traeWebUsage(deps: TraeUsageRouteOptions, region: TraeRegion): Promise<TraeWebUsage>;
+declare function traeWebUsage(deps: TraeUsageRouteOptions, panel: TraePanel): Promise<TraeWebUsage>;
 /** Mount the GET usage route on an optional webServer context. */
 declare function registerTraeUsageRoute(ctx: Context$1, deps: TraeUsageRouteOptions): void;
 //#endregion
-//#region src/model-probe.d.ts
-/** How one model answered. */
-type TraeProbeVerdict = 'available' | 'gated' | 'unsupported' | 'rate_limited' | 'auth' | 'unknown';
-interface TraeProbeResult {
-  /** The model id as the card knows it. */
-  id: string;
-  verdict: TraeProbeVerdict;
-  /** Upstream's own words (already translated), or a short note. */
-  detail: string;
-}
-/**
- * How long one probe may take. Trae answers a one-word prompt in a few seconds;
- * beyond this the answer is not worth waiting for and is reported as unknown.
- */
-declare const TRAE_PROBE_TIMEOUT_MS = 30000;
-/**
- * Classify a failure that arrived as a thrown stream error rather than a
- * returned result.
- *
- * The bridge errors the stream (instead of returning a result) when a refusal
- * interrupts an answer that had already started; its message is the same
- * translated text, so a named code is still decisive. Anything without a
- * recognised code — an abort, a socket reset, a proxy — stays `unknown`.
- */
-declare function classifyProbeError(message: string): {
-  verdict: TraeProbeVerdict;
-  detail: string;
-};
-/**
- * Classify a completed upstream call.
- *
- * `result` is what `TraeSoloBridge.chatStream` returned, so a refusal that
- * arrived inside a 200 body has already been turned into a real error result
- * (and its code translated into `message`) by the bridge — this function only
- * has to read it back.
- */
-declare function classifyProbeResult(result: TraeChatResult, outputSeen: boolean): {
-  verdict: TraeProbeVerdict;
-  detail: string;
-};
-/** The minimal chat call one probe makes. */
-declare function probeBody(model: string): string;
-/**
- * Probe one model through the bridge the plugin actually chats with, so the
- * recorded verdict describes the user's real path (same wire resolution, same
- * function stamping, same error translation).
- */
-declare function probeOneModel(chat: (body: string, signal?: AbortSignal) => Promise<TraeChatResult>, id: string, timeoutMs?: number): Promise<TraeProbeResult>;
-/**
- * Probe a list of models ONE AT A TIME.
- *
- * Sequential on purpose: Trae throttles bursts, and a burst of parallel probes
- * would manufacture the very `rate_limited`/`unknown` verdicts this feature
- * must avoid. An authentication failure stops the run — every later probe would
- * fail the same way, and spending calls to learn that again is waste.
- */
-declare function probeModelsSequentially(chat: (body: string, signal?: AbortSignal) => Promise<TraeChatResult>, ids: readonly string[], onResult?: (result: TraeProbeResult, index: number) => void): Promise<TraeProbeResult[]>;
-//#endregion
 //#region src/index.d.ts
 declare const name = "dsh-connect-trae";
 declare const inject: string[];
@@ -2535,6 +3387,15 @@ interface TraeRegionState {
    * beside dsh-connect-workbuddy's rows — so the setting applies here too.
    */
   creditPosition?: TraeCreditPosition;
+  /**
+   * This region's account pool (issue #44), as the card saves it.
+   *
+   * Read through {@link regionStateOf} and written by the card's pool section.
+   * `enabled` absent means OFF: an account pool decides where money is spent, so
+   * it is opt-in and a config written before it existed must keep billing the
+   * account the user picked.
+   */
+  pool?: TraePoolPreferences;
 }
 interface Config {
   authFile?: string;
@@ -2550,7 +3411,7 @@ interface Config {
    * Per-region account selections, keyed `cn` | `ai`. Each region's tab writes
    * its own slot; tokens remain outside settings.
    */
-  accounts?: Partial<Record<TraeRegion, string>>;
+  accounts?: Partial<Record<TraePanel, string>>;
   /**
    * Show the credit readout in the composer tool row: `Trae CN · <n>`, rendered
    * ONLY while the session's selected model belongs to this plugin, clickable
@@ -2593,7 +3454,7 @@ interface Config {
    * expose different rosters, so each keeps its own directory and selection
    * and switching accounts never drops the other region's picks.
    */
-  regions?: Partial<Record<TraeRegion, TraeRegionState>>;
+  regions?: Partial<Record<TraePanel, TraeRegionState>>;
   /**
    * @deprecated Legacy single-slot fields from before the region split. They
    * predate international support and are read as the CN region's state when
@@ -2610,24 +3471,36 @@ interface Config {
   models?: TraeModelInfo[];
 }
 /**
- * One region's saved state. A config written before the region split has only
+ * One panel's saved state. A config written before the region split has only
  * the flat fields: those were always captured from the CN endpoint (the
  * plugin had no international support), so they are read as the CN state and
  * only when no explicit CN slot exists. The ai region never inherits them —
  * that inheritance is exactly the bug where a stale CN directory would be
  * intersected with the international catalog and silently drop the user's
  * picks (the same failure workbuddy fixed with its region split).
+ *
+ * Keyed by PANEL (`cn` | `enterprise` | `ai`), because each panel carries its
+ * own switch, account binding and model selection. `enterprise` has no legacy
+ * equivalent: it starts from an EMPTY state (its own directory, its own model
+ * picks) and never inherits CN's, so switching it on cannot silently activate
+ * a model list the user never chose for the tenant pool.
  */
-declare function regionStateOf(config: Config, region: TraeRegion): TraeRegionState;
+declare function regionStateOf(config: Config, panel: TraePanel): TraeRegionState;
 /**
- * Whether one region's provider is switched on (issue #11). Opt-out semantics:
+ * Whether one panel's provider is switched on (issue #11). Opt-out semantics:
  * only an explicit `false` disables it, so every config written before this
  * switch existed — including the pre-region-split flat fields, which never
  * carry `enabled` — keeps both providers running exactly as before. The card
  * reads the same rule through `regionEnabledOf`, so the two halves can never
  * disagree about a region's state.
+ *
+ * The ENTERPRISE panel is the one deliberate exception: it defaults OFF. A
+ * consumer-only account (`tenant 7o2d894p7dr0o4`) cannot use that pool at all,
+ * so opting every existing user into a second CN provider would put a route in
+ * their model picker that fails on first use. It is switched on from its card
+ * tab, by someone whose account actually belongs to a tenant.
  */
-declare function regionEnabled(config: Config, region: TraeRegion): boolean;
+declare function regionEnabled(config: Config, panel: TraePanel): boolean;
 /**
  * WHERE one region's credit readout sits (learned from workbuddy #62).
  *
@@ -2658,4 +3531,4 @@ declare function asVolatile<S>(schema: S): S;
 declare const Config: z<Config>;
 declare function apply(ctx: Context$1, config: Config): void;
 //#endregion
-export { Config, FALLBACK_TRAE_MODELS, FALLBACK_TRAE_MODELS_AI, type PiAiGeneration, type PiAiRuntimeInfo, REGION_GATEWAYS, type RawChatDelta, type RawChatMessage, type RawChatTool, SseDecoder, type SseEvent, TRAE_ACCOUNT_STATUS_PATH, TRAE_AI_PROVIDER, TRAE_CHECKIN_PATH, TRAE_CN_AGENT_TASK_PATH, TRAE_CN_TITLE_PATH, TRAE_MODELS_TEST_PATH, TRAE_MODEL_DETAIL_FUNCTIONS, TRAE_MODEL_DETAIL_PATH, TRAE_PAY_BASE, TRAE_PROBE_TIMEOUT_MS, TRAE_PROVIDER, TRAE_PROVIDERS, TRAE_PROVIDER_DISPLAY_NAMES, TRAE_RAW_CHAT_V1_PATH, TRAE_RAW_CHAT_V2_PATH, TRAE_REASONING_EFFORTS, TRAE_REGIONS, TRAE_REGION_PARAM, TRAE_SETTINGS_NS, TRAE_SOLO_CHAT_PATH, TRAE_SOLO_FUNCTION, TRAE_SOLO_MODELS_PATH, TRAE_SOLO_REMOTE_BASE, TRAE_STATE_DB_FILENAME, TRAE_STREAM_IDLE_TIMEOUT_MS, TRAE_USAGE_PATH, TRAE_VERSION_CODE_FALLBACK, type TraeActivityRule, type TraeAdapter, type TraeCachedModelConfig, TraeCatalog, type TraeChatResult, type TraeCheckinClaim, type TraeCheckinStatus, type TraeContextBudget, type TraeCredential, TraeCredentialStore, TraeDelegatingUpstreamClient, type TraeDiscoveredModel, type TraeDiscoveredReasoning, type TraeEdition, TraeFallbackUpstreamClient, type TraeFallbackUpstreamOptions, type TraeFusionRawChatEnvelope, TraeGatedUpstreamClient, type TraeGatedUpstreamOptions, type TraeIdentity, type TraeInputModality, type TraeModelDetailRequest, type TraeModelInfo, type TraeModelProbeVerdict, type TraeModelsTestResponse, type TraeObservedModelConfig, type TraeProbeResult, type TraeProbeVerdict, TraeRawCapabilityController, type TraeRawCapabilityControllerOptions, type TraeRawCapabilitySnapshot, TraeRawCapabilityState, type TraeRawChatBehaviorConfig, type TraeRawChatCapability, type TraeRawChatClientOptions, type TraeRawChatConfig, type TraeRawChatFailureReason, type TraeRawChatRuntimeConfig, TraeRawChatUpstreamClient, type TraeRawDiagnostic, type TraeRawDiagnosticState, type TraeRawGateway, type TraeRawGatewayOptions, type TraeRawResolverResult, type TraeReasoningCapability, type TraeReasoningEffort, type TraeRefreshDevice, type TraeRegion, type TraeRegionGateways, TraeRegionState, type TraeShim, TraeSoloBridge, type TraeSoloClientOptions, TraeSoloRemoteCatalogClient, type TraeSoloRemoteCatalogOptions, TraeSoloUpstreamClient, type TraeStorageCandidate, type TraeStreamEvent, type TraeUpstreamClient, TraeUsageClient, type TraeUsageOptions, type TraeUsagePack, type TraeUsageRouteOptions, type TraeUsageSnapshot, type TraeUsageSummary, type TraeUsageView, type TraeWebAccountState, type TraeWebActivity, type TraeWebAppLogin, type TraeWebCheckin, type TraeWebCheckinClaim, type TraeWebCredits, type TraeWebUsage, type TraeWireModel, UnconfiguredTraeUpstreamClient, adaptLegacyPiAiContext, adaptModernPiAiContext, apply, applyContextBudgets, applyImageSelection, applyReasoningEffort, asVolatile, bridgeTraeSoloStream, buildTraeAgentTaskBody, buildTraeCnHeaders, buildTraeFusionRawChatEnvelope, buildTraeModelDetailRequest, buildTraeRawChatDraft, buildTraeRawChatRuntimeConfig, classifyProbeError, classifyProbeResult, classifyTraeRawChatFailure, configuredAccountsOf, createTraeAdapter, createTraeRawGateway, createTraeShim, creditPosition, decidePiAiGeneration, decodeRawChatChunk, decodeTraeEvent, decryptTraeStorageValue, deriveCatalog, describeIdShape, describeNameShape, discoveredCatalog, fallbackModelsFor, followAppLoginEnabled, generationOf, hashTraeRawChatArg, identityHeaders, inject, legacyTraeOwnAuthPath, maskUserPath, mergeTraeModelSources, name, nextRegionCreditPosition, nextRegionEnabled, nextRegionSlots, normalizeTraeCredential, normalizeTraeVersionCode, parseObservedModelConfig, parseReasoningCapability, parseTraeAuthValue, parseTraeCachedModel, parseTraeModelExtraConfigLogLine, parseTraeRawChatBehaviorConfig, parseTraeRemoteModel, parseTraeStorageDocument, piAiRuntimeInfo, pickTraeStorageIdentity, prepareSoloBody, probeBody, probeModelsSequentially, probeOneModel, probeTraeRawChatCapability, rawCapabilityDiagnostic, rawCapabilityFingerprint, readTraeCachedModel, readTraeCliIdentity, readTraeIdentity, refreshTraeCredential, regionCreditPositionOf, regionEnabled, regionEnabledOf, regionOfCredential, regionOfEdition, regionOfHost, regionOfTraeProvider, regionOfTraeStatusUrl, regionOfUserRegion, regionStateOf, registerTraeUsageRoute, resolveTraeIdentity, resolveTraeRawRuntime, sanitizeCatalog, settingsNamespaceOf, traeEndpoint, traeInputModalities, traeModelDisplayName, traeOwnAuthPath, traeRawChatExtraInfo, traeStateDatabaseCandidates, traeStorageCandidates, traeWebUsage, traeWindowsAppNames, unwrapVolatile, unwrapVolatileDeep, withContextAdaptation, withTraeRegion };
+export { Config, FALLBACK_TRAE_MODELS, FALLBACK_TRAE_MODELS_AI, MAX_PROBE_INPUT_TOKENS, type PiAiGeneration, type PiAiRuntimeInfo, REGION_GATEWAYS, type RawChatDelta, type RawChatMessage, type RawChatTool, SseDecoder, type SseEvent, TRAE_ACCOUNT_STATUS_PATH, TRAE_AI_PROVIDER, TRAE_CHECKIN_PATH, TRAE_CN_AGENT_TASK_PATH, TRAE_CN_TITLE_PATH, TRAE_ENTERPRISE_PROVIDER, TRAE_MODELS_TEST_PATH, TRAE_MODEL_DETAIL_FUNCTIONS, TRAE_MODEL_DETAIL_PATH, TRAE_PANELS, TRAE_PAY_BASE, TRAE_PROBE_TIMEOUT_MS, TRAE_PROVIDER, TRAE_PROVIDERS, TRAE_PROVIDER_DISPLAY_NAMES, TRAE_PROVIDER_IDS, TRAE_PROVIDER_ID_DISPLAY_NAMES, TRAE_PROVIDER_ROUTES, TRAE_RAW_CHAT_V1_PATH, TRAE_RAW_CHAT_V2_PATH, TRAE_REASONING_EFFORTS, TRAE_REGIONS, TRAE_REGION_PARAM, TRAE_SETTINGS_NS, TRAE_SOLO_CHAT_PATH, TRAE_SOLO_FUNCTION, TRAE_SOLO_MODELS_PATH, TRAE_SOLO_REMOTE_BASE, TRAE_STATE_DB_FILENAME, TRAE_STREAM_IDLE_TIMEOUT_MS, TRAE_USAGE_PATH, TRAE_VERSION_CODE_FALLBACK, type TraeActivityRule, type TraeAdapter, type TraeCachedModelConfig, TraeCatalog, type TraeChatResult, type TraeCheckinClaim, type TraeCheckinStatus, type TraeContextBudget, type TraeCredential, TraeCredentialStore, TraeDelegatingUpstreamClient, type TraeDiscoveredModel, type TraeDiscoveredReasoning, type TraeEdition, type TraeFailure, TraeFallbackUpstreamClient, type TraeFallbackUpstreamOptions, type TraeFusionRawChatEnvelope, TraeGatedUpstreamClient, type TraeGatedUpstreamOptions, type TraeIdentity, type TraeInputModality, type TraeModelDetailRequest, type TraeModelInfo, type TraeModelProbeVerdict, type TraeModelsTestResponse, type TraeObservedModelConfig, type TraePanel, type TraeProbeResult, type TraeProbeVerdict, type TraeProviderRoute, TraeRawCapabilityController, type TraeRawCapabilityControllerOptions, type TraeRawCapabilitySnapshot, TraeRawCapabilityState, type TraeRawChatBehaviorConfig, type TraeRawChatCapability, type TraeRawChatClientOptions, type TraeRawChatConfig, type TraeRawChatFailureReason, type TraeRawChatRuntimeConfig, TraeRawChatUpstreamClient, type TraeRawDiagnostic, type TraeRawDiagnosticState, type TraeRawGateway, type TraeRawGatewayOptions, type TraeRawResolverResult, type TraeReasoningCapability, type TraeReasoningEffort, type TraeRefreshDevice, type TraeRegion, type TraeRegionGateways, TraeRegionState, type TraeShim, TraeSoloBridge, type TraeSoloClientOptions, TraeSoloRemoteCatalogClient, type TraeSoloRemoteCatalogOptions, TraeSoloUpstreamClient, type TraeStorageCandidate, type TraeStreamEvent, type TraeUpstreamClient, TraeUsageClient, type TraeUsageOptions, type TraeUsagePack, type TraeUsageRouteOptions, type TraeUsageSnapshot, type TraeUsageSummary, type TraeUsageView, type TraeWebAccountState, type TraeWebActivity, type TraeWebAppLogin, type TraeWebCheckin, type TraeWebCheckinClaim, type TraeWebCredits, type TraeWebUsage, type TraeWireModel, UnconfiguredTraeUpstreamClient, adaptLegacyPiAiContext, adaptModernPiAiContext, apply, applyContextBudgets, applyImageSelection, applyReasoningEffort, asVolatile, bridgeTraeSoloStream, buildTraeAgentTaskBody, buildTraeCnHeaders, buildTraeFusionRawChatEnvelope, buildTraeModelDetailRequest, buildTraeRawChatDraft, buildTraeRawChatRuntimeConfig, classifyProbeError, classifyProbeResult, classifyTraeRawChatFailure, configuredAccountsOf, createTraeAdapter, createTraeRawGateway, createTraeShim, creditPosition, decidePiAiGeneration, decodeRawChatChunk, decodeTraeEvent, decryptTraeStorageValue, deriveCatalog, describeIdShape, describeNameShape, describeTraeFailure, discoveredCatalog, displayNameOfTraeProvider, fallbackModelsFor, followAppLoginEnabled, generationOf, hashTraeRawChatArg, identityHeaders, inject, isEnterpriseAccount, legacyTraeOwnAuthPath, maskUserPath, mergeTraeModelSources, name, nextRegionCreditPosition, nextRegionEnabled, nextRegionSlots, normalizeTraeCredential, normalizeTraeVersionCode, panelOfKey, panelOfProvider, parseObservedModelConfig, parseReasoningCapability, parseTraeAuthValue, parseTraeCachedModel, parseTraeModelExtraConfigLogLine, parseTraeRawChatBehaviorConfig, parseTraeRemoteModel, parseTraeStorageDocument, piAiRuntimeInfo, pickTraeStorageIdentity, prepareSoloBody, probeBody, probeModelsSequentially, probeOneModel, probeTraeRawChatCapability, providerOfPanel, rawCapabilityDiagnostic, rawCapabilityFingerprint, readTraeCachedModel, readTraeCliIdentity, readTraeIdentity, refreshTraeCredential, regionCreditPositionOf, regionEnabled, regionEnabledOf, regionOfCredential, regionOfEdition, regionOfHost, regionOfPanel, regionOfTraeProvider, regionOfTraeStatusUrl, regionOfUserRegion, regionStateOf, registerTraeUsageRoute, resolveTraeIdentity, resolveTraeRawRuntime, routeOfTraeProvider, sanitizeCatalog, settingsNamespaceOf, traeEndpoint, traeInputModalities, traeModelDisplayName, traeOwnAuthPath, traeRawChatExtraInfo, traeStateDatabaseCandidates, traeStorageCandidates, traeWebUsage, traeWindowsAppNames, unwrapVolatile, unwrapVolatileDeep, withContextAdaptation, withTraeRegion };