dsh-connect-trae 3.8.1 → 3.9.1

package/lib/index.d.ts

@@ -326,6 +326,787 @@ declare class TraeCatalog {
   set(models: readonly TraeModelInfo[]): void;
 }
 //#endregion
+//#region src/status-paths.d.ts
+/** Plugin-owned usage endpoint consumed by its browser half. */
+declare const TRAE_USAGE_PATH = "/plugins/dsh-connect-trae/usage";
+/**
+ * Plugin-owned availability probe: POST the model ids to test, get one verdict
+ * per model. Unlike every read-only sibling this route SPENDS quota — a real
+ * (minimal) chat call per model — so it is user-initiated only, and the card
+ * labels the button as consuming a small amount.
+ */
+declare const TRAE_MODELS_TEST_PATH = "/plugins/dsh-connect-trae/models/test";
+/**
+ * Per-account status (check-in / credits / subscription) for the account table.
+ *
+ * Each row of the account table reads its OWN state through this route — a CN
+ * row carries its check-in state and balance, an ai row its subscription.
+ * POST with the accountId in the body: one upstream read per account, paid
+ * only when the table is actually shown.
+ */
+declare const TRAE_ACCOUNT_STATUS_PATH = "/plugins/dsh-connect-trae/account-status";
+/**
+ * Plugin-owned daily check-in claim endpoint. POST, loopback-only, and the only
+ * route in this plugin that changes upstream account state. The accountId in
+ * the body names WHICH account to claim for, so the button can sit in each
+ * account row.
+ */
+declare const TRAE_CHECKIN_PATH = "/plugins/dsh-connect-trae/checkin";
+/**
+ * Outcome vocabulary of one account probe, shared by the Host and the card.
+ *
+ * Mirrors `TraePoolOutcome` in `./account-pool.ts`, and is DECLARED again here
+ * rather than imported for the same reason workbuddy repeats it: this module is
+ * the node-free bridge for the browser build target and must not pull in the
+ * Host-side pool module (which imports the credential type). The two lists must
+ * stay in step — the card renders one label per value, and a value Host can send
+ * that the card has no label for renders as the raw token.
+ *
+ * `plan-gated` is Trae-only (upstream `1005`: this ACCOUNT's plan does not cover
+ * the model) and has no workbuddy counterpart.
+ */
+type TraeWebPoolOutcome = 'ok' | 'rate-limited' |
+/**
+ * The MODEL is loaded, not the account.
+ *
+ * Kept apart from `rate-limited` because the two need OPPOSITE advice:
+ * `rate-limited` is this account's volume wall (wait, or bill another account),
+ * while `model-busy` follows the model everywhere — every account hits the same
+ * wall, so switching only spends a request per account to learn what the first
+ * already said.
+ */
+'model-busy' | 'out-of-credit' | 'credential-rejected' | 'policy-rejected' | 'plan-gated' | 'unavailable' | 'not-found' | 'failed';
+/** Why one account is currently out of the pool. */
+type TraeWebPoolExclusion = 'unusable' | 'rate-limited' | 'model-busy' | 'out-of-credit' | 'credential-rejected' | 'policy-rejected' | 'plan-gated' | 'not-found' | 'unavailable' | 'failed';
+/**
+ * One account's row in the pool, as the card renders it.
+ *
+ * Ties together the three facts the card shows per account — credits, the last
+ * test, and whether it can serve right now — so the ranking the card displays
+ * comes from ONE Host answer rather than being re-derived in the browser. The
+ * browser re-deriving it is how a card ends up calling an excluded account "in
+ * use", which is the inconsistency this document exists to prevent.
+ */
+interface TraeWebPoolAccount {
+  accountId: string;
+  accountName: string;
+  /** Total remaining credit, absent when this account's balance read failed. */
+  credits?: number;
+  /**
+   * The GENERAL bucket — the credit this plugin's chat can actually spend.
+   *
+   * Trae-only, because a Trae balance is TWO buckets and SOLO chat only drains
+   * General (measured on the live `available_endpoint` split). A row whose total
+   * looks rich but whose General reads zero cannot serve a request, which is the
+   * same trap workbuddy hit with its expiry rule: a ranking keyed on a figure that
+   * the billing path cannot reach is not a ranking. The card shows both.
+   */
+  generalAvailable?: number;
+  /** The WORK bucket, kept for display: this plugin's chat never spends it. */
+  workAvailable?: number;
+  /** Credit lapsing inside 3 days. Zero means "measured, nothing at risk". */
+  expiringSoon?: number;
+  /** When the nearest pack lapses, epoch ms. */
+  nearestExpiryMs?: number;
+  /**
+   * This account's stored access token has lapsed, so its balance cannot be read
+   * until it is refreshed or the user signs in again.
+   *
+   * A reason for the dash, not a second dash: without it "0 credit" and "cannot
+   * read the balance" look identical on the card, and only one of them is the
+   * user's problem to fix.
+   */
+  tokenExpired?: boolean;
+  /**
+   * The last test of this account, absent when never tested.
+   *
+   * `modelId` lives INSIDE the measurement rather than being assumed from the
+   * row's current setting: the setting can change after the test, and a result
+   * must keep naming what it actually measured.
+   */
+  probe?: {
+    outcome: TraeWebPoolOutcome;
+    atMs: number;
+    /**
+     * What wrote this measurement, so the card can explain a change the user
+     * watched happen: `test-batch` is a deliberate test, `live-request` is a real
+     * request that failed and overwrote it. ABSENT for records written before the
+     * field existed — the card must then say "unknown", not guess.
+     */
+    source?: 'test-batch' | 'live-request';
+    /** WHICH model this measurement is about; absent = unknown scope. */
+    modelId?: string;
+    /** Only when the upstream named a time; never invented locally. */
+    retryAtMs?: number;
+    /** Upstream's own words, already redacted. Absent on success. */
+    message?: string;
+  };
+  /** Set when this account cannot serve right now. */
+  excludedBy?: TraeWebPoolExclusion;
+  /**
+   * Whether this is the account billing traffic for this panel RIGHT NOW.
+   *
+   * The pool's runtime pick when enabled, else the saved selection. It is the
+   * HOST's answer, not the card's guess: a card that derived "in use" from the
+   * saved setting would contradict the pool after a rotation.
+   */
+  current: boolean;
+  /**
+   * Whether the user checked this account into this panel's pool.
+   *
+   * Listed rows include UNCHECKED accounts so the card can offer them to check:
+   * membership is an explicit opt-in and a user can only opt in to something they
+   * can see. Only checked rows can bill or be batched.
+   */
+  member: boolean;
+  /**
+   * Whether this machine still holds a usable sign-in for the account.
+   *
+   * `false` marks a GHOST: checked or listed, but no local credential resolves, so
+   * a batch can neither test it nor check it in. It is kept as a row (rather than
+   * filtered out) because the only way to stop carrying a broken entry is to see
+   * it and remove it — a filtered row would leave the saved list permanently dirty
+   * with nothing on screen to explain why the pool runs on fewer accounts than the
+   * checkbox count says.
+   */
+  reachable?: boolean;
+  /**
+   * Today's check-in state for this account.
+   *
+   * ABSENT means it was not read — the card must then say so rather than render a
+   * definite "not checked in", which would contradict a claim the user just
+   * watched succeed.
+   */
+  checkedInToday?: boolean;
+  /**
+   * Whether today's check-in is spent on this MACHINE for this account.
+   *
+   * Trae-only, because Trae keys the daily claim to `x-device-id` (code `9095`).
+   * `checkedInToday === false` together with this true is the "switched account"
+   * case the check-in card already documents: this device has no claim left.
+   */
+  deviceCheckedIn?: boolean;
+}
+/**
+ * The pool's state for one panel.
+ *
+ * `targetModelId`/`targetModelSource` exist so the card can state WHICH model a
+ * test would use and WHERE that choice came from. `none` is a real, common
+ * answer for Trae — the CN static fallback catalog carries no `creditMultiplier`
+ * at all until its first live refresh, and "missing multiplier ≠ free" means the
+ * card must render "no free model" rather than silently substituting a paid one.
+ */
+interface TraeWebPool {
+  enabled: boolean;
+  /**
+   * Whether this panel offers the daily check-in at all.
+   *
+   * Only `cn` does. The ai gateways answer 404 for the whole `/trae/api/v2/ug/*`
+   * family (probed 2026-09-24) and the enterprise panel has no personal reward,
+   * so the card hides the action entirely rather than rendering a button whose
+   * only outcome is a refusal.
+   */
+  checkinSupported: boolean;
+  /** The model a test would use right now; absent when none can be resolved. */
+  targetModelId?: string;
+  /**
+   * Where the target came from. `'stale'` means the SAVED id is no longer in the
+   * catalog — a distinct state from `'none'` (no free model exists), because the
+   * two need opposite advice (offer a way back to automatic / say there is no
+   * free model at all).
+   */
+  targetModelSource: 'preferred' | 'free' | 'none' | 'stale';
+  /**
+   * How much text a pool test sends (0 = the minimal probe). Always a number so
+   * the card's select has a value to show; the saved preference is the default.
+   */
+  probeInputTokens: number;
+  /** The saved target id that this panel's catalog no longer offers. */
+  staleTargetModelId?: string;
+  /** The account ids the user has checked into this panel's pool. */
+  memberAccountIds?: readonly string[];
+  /**
+   * The subset of {@link TraeWebPool.memberAccountIds} that resolves to a real
+   * local credential — i.e. what a batch actually runs on.
+   *
+   * Sent so the card never re-derives it. Counting the raw saved list is what
+   * lets a UI claim "1 of 1 selected" and enable both buttons while the Host ran
+   * on ZERO accounts and reported success.
+   */
+  effectiveMemberAccountIds?: readonly string[];
+  /**
+   * Last measured display name per saved member id, including members that have
+   * since stopped resolving.
+   *
+   * A member whose sign-in disappeared would otherwise be listed as a bare id
+   * and an unexplained count, and the user could not tell WHICH one they unchecked.
+   */
+  memberNames?: Record<string, string>;
+  /** Rows in the Host's ranking order: candidates first, excluded rows last. */
+  accounts: readonly TraeWebPoolAccount[];
+  /**
+   * Why the pool could not pick anybody, when it could not.
+   *
+   * Set when every member is excluded, so the card can explain that traffic is
+   * going to the saved selection rather than leaving the user to assume the pool
+   * is serving the top row.
+   */
+  noCandidate?: TraeWebPoolExclusion | 'empty';
+}
+/**
+ * The pool's saved preferences for one panel, as stored in `regions[panel].pool`.
+ *
+ * Declared in the node-free bridge because BOTH halves touch it: the Host reads
+ * it to decide membership and ranking, the card drafts and saves it. Keeping one
+ * declaration is what stops the card from writing a field the Host ignores (or
+ * vice versa) — the failure workbuddy hit when its client and Host each had a
+ * private copy of this shape.
+ *
+ * Every field is optional because this is a user-edited draft: a partially filled
+ * slot must still load, and a missing `enabled` means OFF rather than ON.
+ */
+interface TraePoolPreferences {
+  /** Whether this panel bills through the pool at all. Default OFF. */
+  enabled?: boolean;
+  /**
+   * The model a test batch probes. Absent or `''` means "automatic": pick the
+   * free model (see `pickFreeModel` in `./account-pool.ts`). An id this panel no
+   * longer offers is PRESERVED so the user's choice survives a catalog blip, and
+   * reported as `stale` rather than silently replaced.
+   */
+  targetModelId?: string;
+  /**
+   * The accounts the user checked into this panel's pool, in the order they were
+   * checked.
+   *
+   * Explicit opt-in with NO default: an account never joins the pool because it
+   * exists. Order is only a display hint — the ranking is the Host's.
+   *
+   * A MUTABLE array, not `readonly`: this interface is also the shape the
+   * settings schema declares (`z.array(z.string())`), and the schema rebuilds the
+   * config document on every save — a readonly type there is a compile-time
+   * mismatch that would take the whole Config schema down. Readers still treat it
+   * as immutable; only the owner of a draft copies it.
+   */
+  memberAccountIds?: string[];
+  /**
+   * How much text a pool TEST sends, in tokens. `0` (the default) keeps the
+   * minimal one-word probe.
+   *
+   * Exists because a verdict earned by a one-word request says nothing about the
+   * long turn the user is about to send: an upstream that refuses large requests
+   * answers the small one happily. Padding the probe therefore buys a truthful
+   * "works at my size" answer at the cost of spending real credit per test.
+   */
+  probeInputTokens?: number;
+}
+/** Query parameter naming the region a card request addresses. */
+declare const TRAE_REGION_PARAM = "region";
+/** Every region, in card tab order. */
+declare const TRAE_REGIONS: readonly TraeRegion[];
+/**
+ * Address one region's status route. The two regions are separate provider
+ * stacks; every card request carries the region whose tab the user is on.
+ */
+declare function withTraeRegion(path: string, panel: TraePanel): string;
+/**
+ * Read the region parameter off a status-route URL. Absent means the domestic
+ * tab (`cn`); a present-but-unknown value returns undefined so the route can
+ * answer 400 instead of guessing.
+ */
+declare function regionOfTraeStatusUrl(url: string): TraePanel | undefined;
+/** One credit pack and its remaining credit. */
+interface TraeWebCreditAccount {
+  displayDesc: string;
+  remain: number;
+  size: number;
+  /**
+   * When this pack lapses, in epoch milliseconds, taken from the upstream's own
+   * `end_time`. Absent when the upstream reported no usable time (0 / missing),
+   * so a consumer can tell "no date" apart from "1970".
+   */
+  expiresAtMs?: number;
+  /**
+   * Raw upstream `available_endpoint`: which bucket this pack lives in.
+   *
+   * Measured on the live response — `0` is the GENERAL bucket that SOLO chat
+   * actually spends, `1` is the WORK bucket it cannot reach. The projection
+   * dropped this field until the account pool needed it: the pool ranks accounts
+   * by what they can SERVE, and credit lapsing in the WORK bucket is not a
+   * reason to bill that account first, because nothing here can ever spend it.
+   * Absent, not guessed, when the upstream omits it.
+   */
+  endpoint?: number;
+}
+/** Credit lapsing inside one horizon, as the card reports it. */
+interface TraeWebExpiringCredits {
+  /** Sum of the contributing packs' remaining credit. */
+  total: number;
+  /** How many packs contribute. */
+  packs: number;
+  /** Soonest expiry among them, epoch milliseconds. */
+  earliestExpiresAtMs?: number;
+}
+/**
+ * Credit at risk, bucketed by how soon it lapses.
+ *
+ * Only present when at least one pack carried a usable `expiresAtMs` — a card
+ * must never read "we were not told when anything expires" as "nothing is
+ * about to lapse".
+ */
+interface TraeWebCreditExpiry {
+  within24h: TraeWebExpiringCredits;
+  within3d: TraeWebExpiringCredits;
+  within7d: TraeWebExpiringCredits;
+  /** Packs already past their end time but still carrying credit. */
+  expired: TraeWebExpiringCredits;
+}
+/** Aggregated usage/credit answer rendered by the plugin card. */
+interface TraeWebCredits {
+  total: number;
+  consumed: number;
+  available: number;
+  workAvailable: number;
+  generalAvailable: number;
+  accounts: readonly TraeWebCreditAccount[];
+  /**
+   * Credit lapsing soon, for the card's warning banner.
+   *
+   * Derived from the per-pack {@link TraeWebCreditAccount.expiresAtMs} the
+   * `/usage` route already carries, so it costs no extra upstream read.
+   */
+  expiry?: TraeWebCreditExpiry;
+}
+/** Editable Trae model row rendered by the plugin-owned settings card. */
+interface TraeWebModel {
+  id: string;
+  name: string;
+  contextWindow?: number;
+  maxTokens?: number;
+  input?: ('text' | 'image')[];
+  creditMultiplier?: number;
+  reasoningSupported?: boolean;
+  reasoning?: {
+    supported: string[];
+    defaultEffort?: string;
+  };
+  maxContextWindow?: number;
+  /**
+   * Trae's own image-capability flag, as the runtime catalog carries it. The
+   * card renders these rows with their image checkbox already ticked so the
+   * control matches what DSH is actually told (issue #16); absent means the
+   * directory did not declare it, which is not a capability claim either way.
+   */
+  multimodal?: boolean;
+  /**
+   * The availability verdict from the one-click test, when this card session
+   * has run one. Absent = not tested. Deliberately NOT persisted with the
+   * settings: it describes one moment on one account, and a stale verdict shown
+   * as current is worse than a blank field.
+   */
+  probe?: TraeModelProbeVerdict;
+  /** Upstream's own words for the verdict, when it gave any. */
+  probeDetail?: string;
+}
+/**
+ * One model's availability verdict from the one-click test.
+ *
+ * `unknown` is a first-class outcome, not a failure: a timeout, a proxy drop or
+ * a throttle says nothing about the model, and reporting it as unusable would
+ * make the user delete a model that works. Only an upstream refusal is negative.
+ */
+type TraeModelProbeVerdict = 'available' | 'gated' | 'unsupported' | 'rate_limited' | 'auth' | 'unknown';
+/** What the probe route answers with. */
+interface TraeModelsTestResponse {
+  /** One entry per model tested, in the order they were sent. */
+  results: {
+    id: string;
+    verdict: TraeModelProbeVerdict;
+    detail: string;
+  }[];
+  /** Models skipped because the region has no live catalog row for them. */
+  skipped?: string[];
+}
+/**
+ * Daily check-in state rendered below the credit stats.
+ *
+ * The two booleans answer DIFFERENT questions and must never be collapsed into
+ * one "done" flag — doing that was a shipped bug (see CHANGELOG 2.3.1):
+ *
+ *  - `checkedIn` is ACCOUNT-level: today's reward pack exists for this account,
+ *    so there is nothing left to claim and the balance already includes it.
+ *  - `didCheckedIn` is DEVICE-level: this MACHINE already spent its one
+ *    check-in for the day, whichever account spent it. The upstream keys it on
+ *    the `x-device-id` in the request and answers it per device, not per
+ *    account (measured 2026-09-26: the same account and Beijing day answered
+ *    `false` with the header omitted, with a synthetic id, and with another
+ *    install's id, and `true` for the device that actually claimed).
+ *
+ * So `didCheckedIn && !checkedIn` is the "switched account" case: the device's
+ * daily check-in is used up, but THIS account was never rewarded. Claiming
+ * again is refused upstream (business code 9095, "该设备今日已参与签到"), so
+ * the card disables the button — but it must say that, not "claimed today".
+ */
+interface TraeWebCheckin {
+  checkedIn: boolean;
+  didCheckedIn: boolean;
+  credits: number;
+  enabled: boolean;
+  extraCredits?: number;
+}
+/** The claim route's answer, so the card can report a business refusal verbatim. */
+interface TraeWebCheckinClaim {
+  /** False when the upstream answered a non-zero business code (e.g. 9004). */
+  claimed: boolean;
+  /**
+   * True only when THIS ACCOUNT's reward for today already exists, so nothing
+   * was sent upstream. Distinct from {@link TraeWebCheckinClaim.deviceCheckedIn}:
+   * a device that already claimed for another account leaves this false.
+   */
+  alreadyCheckedIn: boolean;
+  /**
+   * True when today's check-in was already spent on this DEVICE (by this or
+   * another account), so no claim was sent or the upstream refused it with
+   * 9095. Not an error: it is the truthful answer to "can this account claim
+   * here today?" — no, and the reason is the machine, not the account.
+   */
+  deviceCheckedIn?: boolean;
+  code?: number;
+  message?: string;
+  /** The refreshed check-in state, present whenever the claim path ran. */
+  checkin?: TraeWebCheckin;
+}
+/** One reward activity rule (name + work/general credits when present). */
+interface TraeWebActivity {
+  activityId: string;
+  enabled: boolean;
+  workCredits?: number;
+  generalCredits?: number;
+}
+interface TraeWebAccount {
+  id: string;
+  accountName: string;
+  edition: 'cn' | 'sg' | 'solo' | 'solo-sg';
+  /**
+   * Whether this account belongs to a Trae tenant, i.e. may bill the enterprise
+   * pool. The enterprise tab lists only these, because the tenant gateway
+   * serves a directory to any CN token but refuses a personal account's chat
+   * with `4019` — so nothing else reveals the difference until a turn fails.
+   */
+  enterprise: boolean;
+  /** Routing bucket of this account, derived from its credential. */
+  region: TraeRegion;
+  source: 'desktop' | 'dsh' | 'cli';
+  tokenExpiresAtMs: number;
+  /**
+   * When this account's REFRESH token expires, when the credential carries one.
+   *
+   * The access token above is renewed automatically — the plugin refreshes it
+   * five minutes before it lapses — so by itself it answers "when does this
+   * need attention", which is "never, while the refresh token lives". The
+   * refresh token is the real horizon: once IT expires the automatic renewal
+   * stops working and the user must sign in to Trae again. Before this field the
+   * card could only say "auto-renewal", which stays true right up to the moment
+   * it silently stops being true.
+   */
+  refreshExpiresAtMs?: number;
+  selected: boolean;
+}
+/**
+ * The account the Trae desktop app is signed in to right now, when it differs
+ * from the one this plugin is bound to (issue #29).
+ *
+ * Reported on the usage document so the card can offer one-click follow without
+ * an extra round trip; also written back on a POST to the accounts refresh
+ * route when the client confirms it saw the hint. Absent whenever the two
+ * agree or the app is not readable — a healthy document carries no extra
+ * fields and the plugin never bills from this value directly: the FOLLOW is a
+ * settings write of `accounts.<region>`, made by the card or by the host's
+ * follow switch, never a silent rebind here.
+ */
+interface TraeWebAppLogin {
+  id: string;
+  accountName: string;
+  edition: 'cn' | 'sg' | 'solo' | 'solo-sg';
+  region: TraeRegion;
+}
+/**
+ * The per-account state shown inside an account row of the card's table.
+ *
+ * Every locally detected account in a region is rendered as a row; the
+ * interesting per-account facts differ by region, which is why this is a union
+ * of the three surfaces the card previously showed only for the BOUND account:
+ *
+ *  - CN rows carry their own check-in state (Trae keys the daily reward per
+ *    ACCOUNT, and the one-per-device tally per DEVICE, see {@link TraeWebCheckin})
+ *    and their Work/General balances.
+ *  - ai rows carry their own subscription / trial status.
+ *
+ * Each field is optional: a read that fails keeps the row visible (perhaps
+ * without a figure) rather than dropping the account and its switch.
+ */
+interface TraeWebAccountState {
+  /** The account this state belongs to. */
+  id: string;
+  /** CN: today's check-in state of this account (absent for ai rows). */
+  checkin?: TraeWebCheckin;
+  /** CN: this account's Work/General balances (absent for ai rows). */
+  credits?: TraeWebCredits;
+  /** ai: this account's subscription / trial status (absent for CN rows). */
+  payStatus?: TraeWebPayStatus;
+}
+interface TraeWebCreditAlternative {
+  id: string;
+  accountName: string;
+  edition: TraeWebAccount['edition'];
+  workAvailable: number;
+  generalAvailable: number;
+}
+/** One probed candidate path and why it did not yield an account. */
+interface TraeWebSearchPath {
+  path: string;
+  edition: 'cn' | 'sg' | 'solo' | 'solo-sg';
+  source: 'desktop' | 'cli';
+  reason: 'missing' | 'unreadable' | 'invalid';
+  message?: string;
+}
+/**
+ * Peel ONE `{get(): T}` live reference, the shape DSH 0.1.7 delivers a
+ * volatile-marked settings field as (see {@link unwrapVolatileDeep}).
+ */
+declare function unwrapVolatile<T>(value: T): T;
+/**
+ * Deep copy of a value with every `{get(): T}` live reference replaced by the
+ * value it resolves to.
+ *
+ * DSH 0.1.7 hands volatile-marked fields back as live references, and a live
+ * reference is still `typeof === 'object'` — so it passes a naive object check
+ * and every lookup on it is `undefined`. Worse, spreading one (`{ ...ref }`)
+ * does NOT read the field: it produces `{ get: <function> }`. Any merge that
+ * spreads a resolved field to preserve its siblings — the card's "write one
+ * region, keep the other" write, or the account map's spread — would otherwise
+ * DROP every sibling and leak a function into the document.
+ *
+ * Both halves therefore unwrap before touching a resolved field. This lives in
+ * the node-free host↔client bridge because the browser half needs it too.
+ *
+ * Non-reference values are recursed into so a nested volatile field is caught
+ * as well; arrays and objects are rebuilt rather than mutated, so the caller's
+ * value is never touched.
+ */
+declare function unwrapVolatileDeep<T>(value: T): T;
+/**
+ * Read the per-region account selections out of a settings value.
+ *
+ * SHARED because `accounts` now has TWO writers: the card, and the composer
+ * panel's account table (2.14.0). Two writers of one field must use one merge
+ * rule, or they drift — and the rule is not obvious.
+ *
+ * Deep-unwraps first: on DSH 0.1.7 a volatile field arrives as a `{get(): T}`
+ * live reference, which passes the `typeof === 'object'` check and would be
+ * returned as if it were the map. Every lookup on it is then `undefined`, and
+ * the merge (`{ ...configured, [region]: id }`) would spread a reference into
+ * `{get: <function>}` — dropping the other region's selection and leaking a
+ * function into the settings document.
+ */
+declare function configuredAccountsOf(configured: unknown): Record<string, string>;
+/**
+ * Whether the host-side "follow the Trae app's sign-in" switch is on (issue
+ * #29). Absent reads as OFF, so an existing configuration keeps the strict
+ * bind it shipped with and the switch is an opt-in — the same opt-out
+ * semantics as {@link regionEnabledOf}, for the same reason: a config written
+ * before this field existed cannot ask for behavior it never declared.
+ *
+ * Reads the whole settings section (or the bare field); deep-unwraps first
+ * because on DSH 0.1.7 a volatile field arrives as a `{get(): T}` live
+ * reference, whose `typeof === 'object'` would otherwise pass a naive check.
+ */
+declare function followAppLoginEnabled(configured: unknown): boolean;
+/**
+ * Build the next `regions` settings value for the card's save. The write
+ * targets ONLY the signed-in account's region slot; every other region's slot
+ * is carried over untouched, so switching accounts never clobbers the other
+ * region's picks. Tolerates any stored shape (absent, non-object) by starting
+ * from an empty document.
+ */
+declare function nextRegionSlots<Slot extends object>(regions: unknown, panel: TraePanel, slot: Slot): Record<string, unknown>;
+/**
+ * Whether one region's provider is switched on. Opt-out semantics: only an
+ * explicit `false` disables it, so a config written before this switch existed
+ * (and the pre-region-split flat fields, which never carry `enabled`) keep both
+ * providers running exactly as before. The Host reads the same rule through
+ * `regionStateOf`, so card and Host can never disagree about a region's state.
+ *
+ * `value` may be the whole settings section or the `regions` map (see
+ * {@link regionsMapOf}).
+ */
+declare function regionEnabledOf(value: unknown, panel: TraePanel): boolean;
+/**
+ * Build the next `regions` settings value for a provider on/off toggle. ONLY
+ * the target region's `enabled` flag changes: every other field of that slot
+ * (its directory, selection, image opt-ins, context budgets) and every other
+ * region's slot are carried over verbatim, so switching a provider off never
+ * discards the user's model picks and switching it back on restores them.
+ *
+ * This is deliberately separate from {@link nextRegionSlots}: that helper
+ * writes a whole slot from a signed-in tab's draft, while this one must work
+ * for a region that is signed OUT — which is precisely the region a user wants
+ * to switch off (no international install, no international account).
+ *
+ * `value` may be the whole settings section or the `regions` map; the RETURN
+ * value is always the `regions` map, i.e. exactly what `settingsScope.set(
+ * 'regions', ...)` needs.
+ */
+declare function nextRegionEnabled(value: unknown, panel: TraePanel, enabled: boolean): Record<string, unknown>;
+/**
+ * The two seats this region's credit readout can occupy.
+ *
+ * `composer` is the composer tool row (`conversation.input.left`); `stats` is
+ * the ambient dock below the composer card (`conversation.composer.dock`),
+ * beside the shell's own round/step/token pills.
+ *
+ * WHY THE SEAT IS A CHOICE AT ALL (learned from dsh-connect-workbuddy issue
+ * #62): the composer tool row is a LIST seat, so it is shared not only with the
+ * shell's own controls but with any other plugin that registers there — and a
+ * list seat cannot promise that every occupant is visible. The report behind
+ * that issue is exactly that: with a third-party plugin installed the readout
+ * stopped appearing. A fixed seat therefore lets one plugin's presence decide
+ * another's, so the seat belongs to the user.
+ *
+ * Named as a union rather than a boolean because a third seat is plausible and
+ * a `showAtTop: boolean` would have to be MIGRATED rather than extended.
+ */
+type TraeCreditPosition = 'composer' | 'stats';
+/**
+ * Which seat one region's readout uses, defaulting to the composer row.
+ *
+ * Anything other than an explicit `'stats'` reads as `'composer'`, which covers
+ * the two cases that matter: a profile written BEFORE this setting existed (the
+ * composer row was the only seat, so an upgrade moves nothing on screen), and a
+ * hand-edited value the schema does not know. Falling back rather than
+ * rendering nowhere is deliberate — an unrecognized value must not make the
+ * readout disappear, which is the very defect this setting exists to fix.
+ *
+ * `value` may be the whole settings section or the `regions` map (see
+ * {@link regionsMapOf}).
+ */
+declare function regionCreditPositionOf(value: unknown, panel: TraePanel): TraeCreditPosition;
+/**
+ * Build the next `regions` settings value for one region's credit seat.
+ *
+ * Same merge rule as every sibling region write: only the target region's
+ * `creditPosition` changes, so a seat change cannot drop that slot's model
+ * directory, selection, budgets or enabled flag, nor touch the other region.
+ *
+ * `value` may be the whole settings section or the `regions` map; the RETURN
+ * value is always the `regions` map, i.e. exactly what `settingsScope.set(
+ * 'regions', ...)` needs.
+ */
+declare function nextRegionCreditPosition(value: unknown, panel: TraePanel, position: TraeCreditPosition): Record<string, unknown>;
+/** Subscription status of an international (ai) account, rendered instead of the CN credit packs. */
+interface TraeWebPayStatus {
+  isDollarUsageBilling: boolean;
+  hasPackage: boolean;
+  isPayFreshman: boolean;
+  inTrial: boolean;
+  trialEndTimeMs: number;
+  enableSoloLite: boolean;
+  enableSoloBuilder: boolean;
+  enableSoloCoder: boolean;
+  enableSoloWeb: boolean;
+  /** Trae's authoritative tier number (`user_pay_identity`); `0` means Free. */
+  payIdentity?: number;
+  /** Trae's authoritative tier label (`user_pay_identity_str`), e.g. `Free`. */
+  payIdentityStr?: string;
+  fission?: {
+    startTimeMs: number;
+    expireTimeMs: number;
+    maxUsage: number;
+  };
+}
+/** The JSON document the plugin card renders. */
+type TraeWebUsage = {
+  status: 'signed-out';
+  accounts: readonly TraeWebAccount[];
+  message?: string;
+  searched?: readonly TraeWebSearchPath[];
+  enabled?: boolean;
+} | {
+  status: 'signed-in';
+  accountId: string;
+  accountName: string;
+  tokenExpiresAtMs: number;
+  /**
+   * When the BOUND account's refresh token expires (absent when the credential
+   * carries none). See {@link TraeWebAccount.refreshExpiresAtMs} — this is the
+   * horizon that actually matters, because the access token above renews
+   * itself until this one lapses.
+   */
+  refreshExpiresAtMs?: number;
+  /** Which per-region model directory and selection this account owns. */
+  region: TraeRegion;
+  /** Whether this region's provider is currently offered to DSH. */
+  enabled?: boolean;
+  accounts: readonly TraeWebAccount[];
+  models: readonly TraeWebModel[];
+  enabledModelIds: readonly string[];
+  rawChat?: {
+    state: 'disabled' | 'unchecked' | 'available' | 'protocol-gated' | 'authentication' | 'credit' | 'rate' | 'transport' | 'server';
+    checkedAtMs?: number;
+    status?: number;
+  };
+  credits?: TraeWebCredits;
+  creditsError?: string;
+  /**
+   * Set when this panel has no readable balance by design, rather than by
+   * failure. Only `enterprise` does: a tenant's spend is not reported by any
+   * endpoint the plugin can reach (every tenant quota path answers 404), so
+   * the figure exists solely in the enterprise console. The card must say so
+   * instead of rendering the consumer packs, which belong to the personal
+   * balance and would be read as the tenant's.
+   */
+  creditsUnavailable?: 'enterprise';
+  /**
+   * Present only when the bound account is out of credit AND another account
+   * on this machine has some (issue #25). The card then offers a one-click
+   * switch instead of leaving a permanently empty panel. Absent in every
+   * other case so a healthy account never pays for the extra read.
+   */
+  alternatives?: readonly TraeWebCreditAlternative[];
+  /**
+   * Present only when the Trae app's CURRENT sign-in differs from the
+   * account this plugin is bound to (issue #29): the card then offers a
+   * one-click follow instead of making the user hunt the account dropdown
+   * after every app-side sign-out. Absent in every other case — a healthy
+   * document costs no extra read beyond the accounts scan the document
+   * already runs.
+   */
+  appLogin?: TraeWebAppLogin;
+  /**
+   * Daily check-in state (CN only). Absent on the international region,
+   * whose check-in surface does not exist — probed 2026-09-24: the
+   * `/trae/api/v2/ug/*` family answers 404 on every ai gateway, so the card
+   * shows no claim button there rather than a button that cannot work.
+   */
+  checkin?: TraeWebCheckin;
+  checkinError?: string;
+  /** Subscription status of an international account (region ai only). */
+  payStatus?: TraeWebPayStatus;
+  payStatusError?: string;
+  /**
+   * This panel's account-pool state, when the Host build supports it.
+   *
+   * Absent on a Host without pool support, so the card renders no pool section
+   * instead of an empty one. Assembled LAST in the status document and never
+   * allowed to fail it: the pool reads per-account credit, and one dead account
+   * must not blank out the panel the user is looking at.
+   */
+  pool?: TraeWebPool;
+} | {
+  status: 'error';
+  message: string;
+};
+//#endregion
 //#region src/pi-ai-runtime.d.ts
 /**
  * Which `@earendil-works/pi-ai` copy THIS plugin resolves at runtime, and which
@@ -474,6 +1255,47 @@ interface TraeShimRoute {
   /** Stable label used to look the route's secret up (`solo` | `enterprise`). */
   label: string;
   client: TraeUpstreamClient;
+  /**
+   * Account-pool hooks for this route (issue #44). Absent means "one fixed
+   * account, no rotation and no failover" — the behaviour before the pool
+   * existed, and still the behaviour when the pool is switched off.
+   */
+  pool?: TraeShimPool;
+}
+/**
+ * What an account pool tells the shim around one chat attempt.
+ *
+ * The shim owns the HTTP surface and the pool owns "who bills", so the two meet
+ * here: the pool may re-point the next request, hand back a client for a
+ * different account after a failure, and hear about failures that only a real
+ * request — not a probe — can produce.
+ *
+ * Every method must resolve rather than throw: a pool failure must never turn a
+ * chat request into a 500 when a plain answer was possible.
+ */
+interface TraeShimPool {
+  /**
+   * Choose the account for this request and report which one it is. Called once,
+   * before the first attempt; `undefined` means "the pool chose nobody", which
+   * leaves the route's own client to bill the bound account.
+   */
+  prepare(): Promise<string | undefined>;
+  /**
+   * The client for the next account worth trying after the current one failed,
+   * or `undefined` when the pool has nothing left to try.
+   *
+   * The returned client must be bound to that account's OWN credential:
+   * failing over is not a rebind, so it must not move the account the user
+   * selected (the same rule per-account probes already follow).
+   */
+  next(tried: readonly string[]): Promise<{
+    accountId: string;
+    client: TraeUpstreamClient;
+  } | undefined>;
+  /** Record a real request's failure against the account that hit it. */
+  failed(accountId: string, kind: TraeUpstreamErrorKind, message: string): Promise<void>;
+  /** One clause naming why no other account can serve, for the error text. */
+  shortfall(tried: readonly string[]): Promise<string | undefined>;
 }
 interface TraeShimOptions {
   catalog: TraeCatalog;
@@ -801,6 +1623,37 @@ declare class TraeCredentialStore {
   private readonly refresh;
   private readonly refreshMarginMs;
   private inflight;
+  /**
+   * In-flight refreshes of individual accounts, one per account id.
+   *
+   * The card reads every member's balance in one poll and each balance can
+   * decide to refresh, so without this dedupe the same account would exchange
+   * its token several times in a second and the last writer would win over a
+   * copy another read already holds.
+   */
+  private readonly inflightByAccount;
+  /**
+   * When a per-account refresh last FAILED, so a dead refresh token is not
+   * exchanged again on every poll.
+   *
+   * The card reads every member's balance on each refresh, and a revoked refresh
+   * token fails forever: without this memo each poll would spend two upstream
+   * calls (the current contract and the superseded one) on an account no retry
+   * can fix. Five minutes keeps a transient network failure cheap to retry while
+   * a revoked sign-in costs almost nothing.
+   */
+  private readonly refreshFailedAtMs;
+  /**
+   * The account the NEXT request should bill, when a pool — not the user's
+   * binding — is choosing (issue #44).
+   *
+   * Runtime only, never persisted: the binding in settings is what a save
+   * writes and what the card's account table reports as selected, while this is
+   * "who serves right now". Keeping them apart is what lets the pool rotate
+   * without silently rewriting the user's choice, and what makes turning the
+   * pool off restore the bound account with no rebind at all.
+   */
+  private rotatedAccountId;
   constructor(options: TraeCredentialStoreOptions);
   /** Whether a credential's own claim belongs to this store's region. */
   private matchesRegion;
@@ -903,6 +1756,31 @@ declare class TraeCredentialStore {
    *      their back.
    */
   private inUse;
+  /**
+   * Point this store at one specific account for the NEXT request, without
+   * touching the user's saved binding (issue #44).
+   *
+   * Called by the account pool before each chat request. `undefined` clears the
+   * override, which is how switching the pool off immediately restores the
+   * binding — no rebind, no settings write, nothing to undo.
+   *
+   * A rotation is a REQUEST, not an assertion: `current()` honours it only when
+   * the account still exists locally and this store's own eligibility rules
+   * allow it, and otherwise falls back to the binding. So a rotation can never
+   * invent a credential that {@link current} would refuse.
+   */
+  setRotatedAccount(accountId: string | undefined): void;
+  /** The rotation currently in effect, for diagnostics and the pool's own card. */
+  rotatedAccount(): string | undefined;
+  /**
+   * The credential a rotation points at, or `undefined` when it cannot be
+   * honoured (the login was removed from this machine, or a tenant-scoped store
+   * refuses a personal account).
+   *
+   * Never substitutes a different account here: the caller then applies the
+   * user's binding, which is the honest answer when the pool's choice is gone.
+   */
+  private rotated;
   current(): Promise<TraeCredential | undefined>;
   /**
    * The stored credential of one specific account, without changing which
@@ -919,7 +1797,23 @@ declare class TraeCredentialStore {
    * `accountId` is left untouched. An unknown id yields undefined rather than a
    * fallback, for the same reason {@link current} refuses to fall back.
    */
-  credentialOf(accountId: string): Promise<TraeCredential | undefined>;
+  credentialOf(accountId: string): Promise<TraeCredential | undefined>;
+  /**
+   * A SPECIFIC account's credential, refreshed when its access token is due.
+   *
+   * {@link credentialOf} is a pure lookup and hands back an expired token as-is,
+   * which is right for the chat path (that request fails honestly) but wrong for
+   * a READ of that account's own data: Trae's access token lives for days while
+   * the refresh token lives for months, so a pooled account the user has not
+   * used this week reads as "no balance" — the card showed a bare `—` for an
+   * account whose refresh token was still good. Only the refresh margin decides
+   * here, and a FAILED refresh still yields the stored credential so the caller
+   * reports the failure it actually hit instead of inventing "not signed in".
+   *
+   * This never touches the binding or the rotation: refreshing account B must
+   * not make B the account the next chat request bills.
+   */
+  resolveCredentialOf(accountId: string): Promise<TraeCredential | undefined>;
   /**
    * Store imported credentials (issue #37), replacing any entry with the same
    * account id and leaving every other entry alone.
@@ -1957,605 +2851,323 @@ interface TraeCheckinClaim {
 interface TraeActivityRule {
   activityId: string;
   enabled: boolean;
-  activityType: number;
-  startTimeMs: number;
-  endTimeMs: number;
-  workExtra?: Record<string, unknown>;
-}
-interface TraeUsageView {
-  snapshot: TraeUsageSnapshot;
-  checkin: TraeCheckinStatus;
-  activities: TraeActivityRule[];
-}
-/**
- * A client for the verified Trae usage/credits endpoints.
- *
- * Every method is read-only except {@link TraeUsageClient.claimCheckin}, which
- * claims the daily check-in reward — the one deliberate mutation, requested by
- * the user from the card and guarded before it is sent.
- */
-declare class TraeUsageClient {
-  private readonly options;
-  private readonly fetchImpl;
-  private readonly baseUrl;
-  private readonly timeoutMs;
-  constructor(options: TraeUsageOptions);
-  /** Region of the current credential; `cn` when unresolvable. */
-  private currentRegion;
-  /**
-   * Pay base for the current credential's region. An explicit baseUrl (tests,
-   * diagnostics) pins the endpoint; otherwise CN uses `api.trae.cn` and the
-   * international region its own verified pay gateway.
-   */
-  private payBase;
-  /**
-   * Device id for the check-in routes, or undefined when the machine's
-   * installation identity cannot be read. Best-effort on purpose: a missing
-   * identity must not break the read-only status query, which the upstream
-   * answers with or without the header.
-   */
-  private deviceIdHeader;
-  private authedHeaders;
-  private post;
-  /**
-   * Subscription/pay status of an international (ai) account. The CN region
-   * never calls this (its contract is unverified there); the ai region uses
-   * this instead of the Work-credit `snapshot`.
-   */
-  payStatus(signal?: AbortSignal): Promise<TraePayStatus>;
-  /**
-   * The Work-credit endpoints are CN-only. The international region is
-   * subscription-based and must read {@link payStatus} instead; guarding here
-   * keeps the card's degraded `creditsError` message diagnosable rather than
-   * letting an ai credential hit an unverified path on its pay gateway.
-   */
-  private requireCnRegion;
-  /** Total entitlements / credits and per-pack breakdown. */
-  snapshot(signal?: AbortSignal): Promise<TraeUsageSnapshot>;
-  /**
-   * Daily check-in status. Read-only, and answered with or without the device
-   * header — the claim is what needs it.
-   *
-   * The read DOES carry the header whenever this installation has one, and
-   * that is deliberate rather than incidental: `did_checked_in` is answered
-   * per device, so omitting the header would make a device that already claimed
-   * today look identical to one that never has (measured 2026-09-26, see
-   * {@link TraeCheckinStatus.didCheckedIn}).
-   */
-  checkinStatus(signal?: AbortSignal): Promise<TraeCheckinStatus>;
-  /**
-   * Claim today's check-in reward. The ONLY state-changing call in this client.
-   *
-   * The upstream is idempotent per Beijing day (verified 2026-09-24: repeating
-   * the call on an already-claimed day answers `code: 0` while the entitlement
-   * total stays byte-identical), so a double click cannot double-grant. The
-   * card and its route still guard, because "cannot double-grant" is a property
-   * of the upstream we verify rather than one we rely on.
-   *
-   * A business refusal arrives as HTTP 200 with a non-zero `code` — most often
-   * `9004` when the request carries no `x-device-id`. That is reported as
-   * `claimed: false` rather than thrown, so the caller can tell "the upstream
-   * refused this" apart from "the request never arrived".
-   */
-  claimCheckin(signal?: AbortSignal): Promise<TraeCheckinClaim>;
-  /** Rewards / activity rules. */
-  activities(signal?: AbortSignal): Promise<TraeActivityRule[]>;
-  /** Convenience: snapshot + check-in + activities in one call (best-effort, non-fatal on missing). */
-  view(signal?: AbortSignal): Promise<TraeUsageView>;
-}
-//#endregion
-//#region src/status-paths.d.ts
-/** Plugin-owned usage endpoint consumed by its browser half. */
-declare const TRAE_USAGE_PATH = "/plugins/dsh-connect-trae/usage";
-/**
- * Plugin-owned availability probe: POST the model ids to test, get one verdict
- * per model. Unlike every read-only sibling this route SPENDS quota — a real
- * (minimal) chat call per model — so it is user-initiated only, and the card
- * labels the button as consuming a small amount.
- */
-declare const TRAE_MODELS_TEST_PATH = "/plugins/dsh-connect-trae/models/test";
-/**
- * Per-account status (check-in / credits / subscription) for the account table.
- *
- * Each row of the account table reads its OWN state through this route — a CN
- * row carries its check-in state and balance, an ai row its subscription.
- * POST with the accountId in the body: one upstream read per account, paid
- * only when the table is actually shown.
- */
-declare const TRAE_ACCOUNT_STATUS_PATH = "/plugins/dsh-connect-trae/account-status";
-/**
- * Plugin-owned daily check-in claim endpoint. POST, loopback-only, and the only
- * route in this plugin that changes upstream account state. The accountId in
- * the body names WHICH account to claim for, so the button can sit in each
- * account row.
- */
-declare const TRAE_CHECKIN_PATH = "/plugins/dsh-connect-trae/checkin";
-/** Query parameter naming the region a card request addresses. */
-declare const TRAE_REGION_PARAM = "region";
-/** Every region, in card tab order. */
-declare const TRAE_REGIONS: readonly TraeRegion[];
-/**
- * Address one region's status route. The two regions are separate provider
- * stacks; every card request carries the region whose tab the user is on.
- */
-declare function withTraeRegion(path: string, panel: TraePanel): string;
-/**
- * Read the region parameter off a status-route URL. Absent means the domestic
- * tab (`cn`); a present-but-unknown value returns undefined so the route can
- * answer 400 instead of guessing.
- */
-declare function regionOfTraeStatusUrl(url: string): TraePanel | undefined;
-/** One credit pack and its remaining credit. */
-interface TraeWebCreditAccount {
-  displayDesc: string;
-  remain: number;
-  size: number;
-  /**
-   * When this pack lapses, in epoch milliseconds, taken from the upstream's own
-   * `end_time`. Absent when the upstream reported no usable time (0 / missing),
-   * so a consumer can tell "no date" apart from "1970".
-   */
-  expiresAtMs?: number;
-}
-/** Credit lapsing inside one horizon, as the card reports it. */
-interface TraeWebExpiringCredits {
-  /** Sum of the contributing packs' remaining credit. */
-  total: number;
-  /** How many packs contribute. */
-  packs: number;
-  /** Soonest expiry among them, epoch milliseconds. */
-  earliestExpiresAtMs?: number;
-}
-/**
- * Credit at risk, bucketed by how soon it lapses.
- *
- * Only present when at least one pack carried a usable `expiresAtMs` — a card
- * must never read "we were not told when anything expires" as "nothing is
- * about to lapse".
- */
-interface TraeWebCreditExpiry {
-  within24h: TraeWebExpiringCredits;
-  within3d: TraeWebExpiringCredits;
-  within7d: TraeWebExpiringCredits;
-  /** Packs already past their end time but still carrying credit. */
-  expired: TraeWebExpiringCredits;
-}
-/** Aggregated usage/credit answer rendered by the plugin card. */
-interface TraeWebCredits {
-  total: number;
-  consumed: number;
-  available: number;
-  workAvailable: number;
-  generalAvailable: number;
-  accounts: readonly TraeWebCreditAccount[];
-  /**
-   * Credit lapsing soon, for the card's warning banner.
-   *
-   * Derived from the per-pack {@link TraeWebCreditAccount.expiresAtMs} the
-   * `/usage` route already carries, so it costs no extra upstream read.
-   */
-  expiry?: TraeWebCreditExpiry;
-}
-/** Editable Trae model row rendered by the plugin-owned settings card. */
-interface TraeWebModel {
-  id: string;
-  name: string;
-  contextWindow?: number;
-  maxTokens?: number;
-  input?: ('text' | 'image')[];
-  creditMultiplier?: number;
-  reasoningSupported?: boolean;
-  reasoning?: {
-    supported: string[];
-    defaultEffort?: string;
-  };
-  maxContextWindow?: number;
-  /**
-   * Trae's own image-capability flag, as the runtime catalog carries it. The
-   * card renders these rows with their image checkbox already ticked so the
-   * control matches what DSH is actually told (issue #16); absent means the
-   * directory did not declare it, which is not a capability claim either way.
-   */
-  multimodal?: boolean;
-  /**
-   * The availability verdict from the one-click test, when this card session
-   * has run one. Absent = not tested. Deliberately NOT persisted with the
-   * settings: it describes one moment on one account, and a stale verdict shown
-   * as current is worse than a blank field.
-   */
-  probe?: TraeModelProbeVerdict;
-  /** Upstream's own words for the verdict, when it gave any. */
-  probeDetail?: string;
-}
-/**
- * One model's availability verdict from the one-click test.
- *
- * `unknown` is a first-class outcome, not a failure: a timeout, a proxy drop or
- * a throttle says nothing about the model, and reporting it as unusable would
- * make the user delete a model that works. Only an upstream refusal is negative.
- */
-type TraeModelProbeVerdict = 'available' | 'gated' | 'unsupported' | 'rate_limited' | 'auth' | 'unknown';
-/** What the probe route answers with. */
-interface TraeModelsTestResponse {
-  /** One entry per model tested, in the order they were sent. */
-  results: {
-    id: string;
-    verdict: TraeModelProbeVerdict;
-    detail: string;
-  }[];
-  /** Models skipped because the region has no live catalog row for them. */
-  skipped?: string[];
-}
-/**
- * Daily check-in state rendered below the credit stats.
- *
- * The two booleans answer DIFFERENT questions and must never be collapsed into
- * one "done" flag — doing that was a shipped bug (see CHANGELOG 2.3.1):
- *
- *  - `checkedIn` is ACCOUNT-level: today's reward pack exists for this account,
- *    so there is nothing left to claim and the balance already includes it.
- *  - `didCheckedIn` is DEVICE-level: this MACHINE already spent its one
- *    check-in for the day, whichever account spent it. The upstream keys it on
- *    the `x-device-id` in the request and answers it per device, not per
- *    account (measured 2026-09-26: the same account and Beijing day answered
- *    `false` with the header omitted, with a synthetic id, and with another
- *    install's id, and `true` for the device that actually claimed).
- *
- * So `didCheckedIn && !checkedIn` is the "switched account" case: the device's
- * daily check-in is used up, but THIS account was never rewarded. Claiming
- * again is refused upstream (business code 9095, "该设备今日已参与签到"), so
- * the card disables the button — but it must say that, not "claimed today".
- */
-interface TraeWebCheckin {
-  checkedIn: boolean;
-  didCheckedIn: boolean;
-  credits: number;
-  enabled: boolean;
-  extraCredits?: number;
+  activityType: number;
+  startTimeMs: number;
+  endTimeMs: number;
+  workExtra?: Record<string, unknown>;
 }
-/** The claim route's answer, so the card can report a business refusal verbatim. */
-interface TraeWebCheckinClaim {
-  /** False when the upstream answered a non-zero business code (e.g. 9004). */
-  claimed: boolean;
+interface TraeUsageView {
+  snapshot: TraeUsageSnapshot;
+  checkin: TraeCheckinStatus;
+  activities: TraeActivityRule[];
+}
+/**
+ * A client for the verified Trae usage/credits endpoints.
+ *
+ * Every method is read-only except {@link TraeUsageClient.claimCheckin}, which
+ * claims the daily check-in reward — the one deliberate mutation, requested by
+ * the user from the card and guarded before it is sent.
+ */
+declare class TraeUsageClient {
+  private readonly options;
+  private readonly fetchImpl;
+  private readonly baseUrl;
+  private readonly timeoutMs;
+  constructor(options: TraeUsageOptions);
+  /** Region of the current credential; `cn` when unresolvable. */
+  private currentRegion;
   /**
-   * True only when THIS ACCOUNT's reward for today already exists, so nothing
-   * was sent upstream. Distinct from {@link TraeWebCheckinClaim.deviceCheckedIn}:
-   * a device that already claimed for another account leaves this false.
+   * Pay base for the current credential's region. An explicit baseUrl (tests,
+   * diagnostics) pins the endpoint; otherwise CN uses `api.trae.cn` and the
+   * international region its own verified pay gateway.
    */
-  alreadyCheckedIn: boolean;
+  private payBase;
   /**
-   * True when today's check-in was already spent on this DEVICE (by this or
-   * another account), so no claim was sent or the upstream refused it with
-   * 9095. Not an error: it is the truthful answer to "can this account claim
-   * here today?" — no, and the reason is the machine, not the account.
+   * Device id for the check-in routes, or undefined when the machine's
+   * installation identity cannot be read. Best-effort on purpose: a missing
+   * identity must not break the read-only status query, which the upstream
+   * answers with or without the header.
    */
-  deviceCheckedIn?: boolean;
-  code?: number;
-  message?: string;
-  /** The refreshed check-in state, present whenever the claim path ran. */
-  checkin?: TraeWebCheckin;
-}
-/** One reward activity rule (name + work/general credits when present). */
-interface TraeWebActivity {
-  activityId: string;
-  enabled: boolean;
-  workCredits?: number;
-  generalCredits?: number;
-}
-interface TraeWebAccount {
-  id: string;
-  accountName: string;
-  edition: 'cn' | 'sg' | 'solo' | 'solo-sg';
+  private deviceIdHeader;
+  private authedHeaders;
+  private post;
   /**
-   * Whether this account belongs to a Trae tenant, i.e. may bill the enterprise
-   * pool. The enterprise tab lists only these, because the tenant gateway
-   * serves a directory to any CN token but refuses a personal account's chat
-   * with `4019` — so nothing else reveals the difference until a turn fails.
+   * Subscription/pay status of an international (ai) account. The CN region
+   * never calls this (its contract is unverified there); the ai region uses
+   * this instead of the Work-credit `snapshot`.
    */
-  enterprise: boolean;
-  /** Routing bucket of this account, derived from its credential. */
-  region: TraeRegion;
-  source: 'desktop' | 'dsh' | 'cli';
-  tokenExpiresAtMs: number;
+  payStatus(signal?: AbortSignal): Promise<TraePayStatus>;
   /**
-   * When this account's REFRESH token expires, when the credential carries one.
+   * The Work-credit endpoints are CN-only. The international region is
+   * subscription-based and must read {@link payStatus} instead; guarding here
+   * keeps the card's degraded `creditsError` message diagnosable rather than
+   * letting an ai credential hit an unverified path on its pay gateway.
+   */
+  private requireCnRegion;
+  /** Total entitlements / credits and per-pack breakdown. */
+  snapshot(signal?: AbortSignal): Promise<TraeUsageSnapshot>;
+  /**
+   * Daily check-in status. Read-only, and answered with or without the device
+   * header — the claim is what needs it.
    *
-   * The access token above is renewed automatically — the plugin refreshes it
-   * five minutes before it lapses — so by itself it answers "when does this
-   * need attention", which is "never, while the refresh token lives". The
-   * refresh token is the real horizon: once IT expires the automatic renewal
-   * stops working and the user must sign in to Trae again. Before this field the
-   * card could only say "auto-renewal", which stays true right up to the moment
-   * it silently stops being true.
+   * The read DOES carry the header whenever this installation has one, and
+   * that is deliberate rather than incidental: `did_checked_in` is answered
+   * per device, so omitting the header would make a device that already claimed
+   * today look identical to one that never has (measured 2026-09-26, see
+   * {@link TraeCheckinStatus.didCheckedIn}).
    */
-  refreshExpiresAtMs?: number;
-  selected: boolean;
+  checkinStatus(signal?: AbortSignal): Promise<TraeCheckinStatus>;
+  /**
+   * Claim today's check-in reward. The ONLY state-changing call in this client.
+   *
+   * The upstream is idempotent per Beijing day (verified 2026-09-24: repeating
+   * the call on an already-claimed day answers `code: 0` while the entitlement
+   * total stays byte-identical), so a double click cannot double-grant. The
+   * card and its route still guard, because "cannot double-grant" is a property
+   * of the upstream we verify rather than one we rely on.
+   *
+   * A business refusal arrives as HTTP 200 with a non-zero `code` — most often
+   * `9004` when the request carries no `x-device-id`. That is reported as
+   * `claimed: false` rather than thrown, so the caller can tell "the upstream
+   * refused this" apart from "the request never arrived".
+   */
+  claimCheckin(signal?: AbortSignal): Promise<TraeCheckinClaim>;
+  /** Rewards / activity rules. */
+  activities(signal?: AbortSignal): Promise<TraeActivityRule[]>;
+  /** Convenience: snapshot + check-in + activities in one call (best-effort, non-fatal on missing). */
+  view(signal?: AbortSignal): Promise<TraeUsageView>;
 }
+//#endregion
+//#region src/account-pool.d.ts
 /**
- * The account the Trae desktop app is signed in to right now, when it differs
- * from the one this plugin is bound to (issue #29).
+ * Which of the pool's writers produced a measurement.
  *
- * Reported on the usage document so the card can offer one-click follow without
- * an extra round trip; also written back on a POST to the accounts refresh
- * route when the client confirms it saw the hint. Absent whenever the two
- * agree or the app is not readable — a healthy document carries no extra
- * fields and the plugin never bills from this value directly: the FOLLOW is a
- * settings write of `accounts.<region>`, made by the card or by the host's
- * follow switch, never a silent rebind here.
+ * `test-batch` — the user pressed "test" (or the check-in batch), so the outcome
+ *   is a deliberate measurement of the target model.
+ * `live-request` — a real chat request failed and its failure was recorded so the
+ *   NEXT request starts from a measurement instead of rediscovering the same wall.
+ *
+ * The distinction is diagnostic, not behavioural: both feed the same routing and
+ * cooling logic. It exists so a user who watched an account measure `ok` and
+ * later saw it limited can tell whether that was a later live failure (expected)
+ * or an older value winning (a bug).
  */
-interface TraeWebAppLogin {
+type TraePoolProbeSource = 'test-batch' | 'live-request';
+/** One account's pool entry: what the picker needs, plus its last measurement. */
+interface TraePoolAccount {
+  /** Stable account id (the same one `TraeWebAccount` carries). */
   id: string;
+  /** Human name, or `''` when the desktop app recorded none. */
   accountName: string;
-  edition: 'cn' | 'sg' | 'solo' | 'solo-sg';
-  region: TraeRegion;
 }
 /**
- * The per-account state shown inside an account row of the card's table.
- *
- * Every locally detected account in a region is rendered as a row; the
- * interesting per-account facts differ by region, which is why this is a union
- * of the three surfaces the card previously showed only for the BOUND account:
- *
- *  - CN rows carry their own check-in state (Trae keys the daily reward per
- *    ACCOUNT, and the one-per-device tally per DEVICE, see {@link TraeWebCheckin})
- *    and their Work/General balances.
- *  - ai rows carry their own subscription / trial status.
+ * What the pool knows about ONE account's last test of the target model.
  *
- * Each field is optional: a read that fails keeps the row visible (perhaps
- * without a figure) rather than dropping the account and its switch.
+ * `undefined` means "never tested", which is deliberately distinct from every
+ * measured outcome: an untested account is a candidate (the user may want to use
+ * it now) whereas a measured failure is not. Collapsing the two would make a
+ * fresh pool look empty until the first test.
  */
-interface TraeWebAccountState {
-  /** The account this state belongs to. */
-  id: string;
-  /** CN: today's check-in state of this account (absent for ai rows). */
-  checkin?: TraeWebCheckin;
-  /** CN: this account's Work/General balances (absent for ai rows). */
-  credits?: TraeWebCredits;
-  /** ai: this account's subscription / trial status (absent for CN rows). */
-  payStatus?: TraeWebPayStatus;
+interface TraePoolProbe {
+  outcome: TraePoolOutcome;
+  /** When this measurement was taken, in epoch ms. */
+  atMs: number;
+  /** WHAT WROTE this measurement; absent for records written before it existed. */
+  source?: TraePoolProbeSource;
+  /**
+   * When this account may be usable again, when the upstream stated a time.
+   *
+   * Present for a `rate-limited` / `out-of-credit` outcome whose failure carried
+   * a reset sentence. ABSENT when the upstream named no time — that absence is
+   * meaningful and must never be turned into a locally invented countdown.
+   */
+  retryAtMs?: number;
+  /**
+   * The upstream's own words on the failure, already redacted.
+   *
+   * Kept so the card can say WHY an account left the pool instead of repeating
+   * one generic sentence for a DNS failure, a gateway 502 and a cancelled request
+   * alike.
+   */
+  message?: string;
+  /**
+   * WHICH MODEL this measurement is about.
+   *
+   * `1005` (plan gate), `4001` (no SOLO function serves this `config_name`) and
+   * `4011` (throttle) are all ACCOUNT × MODEL conditions: the same credential
+   * answers other models at the same second. A row rendered as plain "可用"
+   * therefore claims more than the measurement says. Storing the model id is what
+   * makes the claim checkable.
+   *
+   * Deliberately NOT inherited when an update omits it — the opposite of
+   * `accountName` and `retryAtMs`. Those describe the ACCOUNT (still true when a
+   * later writer cannot see them); the model describes THIS measurement, and
+   * carrying an older id forward would relabel a fresh measurement with a model
+   * it was not taken on.
+   */
+  modelId?: string;
+  /**
+   * The account's display name AT THE MOMENT IT WAS MEASURED.
+   *
+   * Stored because a saved pool member can outlive its sign-in: once the desktop
+   * app drops a login, that id resolves to no listed account and the card has
+   * nothing left to render for it. The name was in hand at write time and nowhere
+   * afterwards. Snapshots are never refreshed from a LISTING — only a real
+   * measurement writes this.
+   */
+  accountName?: string;
 }
-interface TraeWebCreditAlternative {
+/** One account's live credit situation, as the pool ranks it. */
+interface TraePoolCredits {
+  /** Remaining credit across every pack (`available` of the upstream snapshot). */
+  total: number;
+  /** The Work bucket, kept for display: SOLO chat does NOT spend it. */
+  workAvailable?: number;
+  /** The General bucket, kept for display: this is what SOLO chat spends. */
+  generalAvailable?: number;
+  /** Credits expiring within the card's "soon" window (3 days). */
+  expiringSoon: number;
+  /** When the nearest at-risk pack expires, if any does. */
+  nearestExpiryMs?: number;
+}
+/**
+ * Everything the ranking rule reads about one account. Assembled by the Host from
+ * the credential store, the per-account credit read, and the runtime probe store
+ * — this module only consumes it.
+ */
+interface TraePoolMember {
+  account: TraePoolAccount;
+  credits?: TraePoolCredits;
+  probe?: TraePoolProbe;
+  /** When the stored credential expires, used as the final tie-break. */
+  tokenExpiresAtMs?: number;
+}
+/**
+ * How one account answered the target model.
+ *
+ * The first nine values are the workbuddy taxonomy verbatim so the two cards read
+ * the same. The tenth, `plan-gated`, is Trae-only: upstream `1005` says THIS
+ * account's plan does not cover this model while another account's plan may, and
+ * no amount of waiting changes a plan — so it must not be folded into
+ * `credential-rejected` (which would demand a re-login) nor into
+ * `policy-rejected` (which means a content filter tripped on ONE request).
+ */
+type TraePoolOutcome = 'ok' | 'rate-limited' | 'model-busy' | 'out-of-credit' | 'credential-rejected' | 'policy-rejected' | 'plan-gated' | 'unavailable' | 'not-found' | 'failed';
+//#endregion
+//#region src/model-probe.d.ts
+/** How one model answered. */
+type TraeProbeVerdict = 'available' | 'gated' | 'unsupported' | 'rate_limited' | 'auth' | 'unknown';
+interface TraeProbeResult {
+  /** The model id as the card knows it. */
   id: string;
-  accountName: string;
-  edition: TraeWebAccount['edition'];
-  workAvailable: number;
-  generalAvailable: number;
-}
-/** One probed candidate path and why it did not yield an account. */
-interface TraeWebSearchPath {
-  path: string;
-  edition: 'cn' | 'sg' | 'solo' | 'solo-sg';
-  source: 'desktop' | 'cli';
-  reason: 'missing' | 'unreadable' | 'invalid';
-  message?: string;
+  verdict: TraeProbeVerdict;
+  /** Upstream's own words (already translated), or a short note. */
+  detail: string;
 }
 /**
- * Peel ONE `{get(): T}` live reference, the shape DSH 0.1.7 delivers a
- * volatile-marked settings field as (see {@link unwrapVolatileDeep}).
- */
-declare function unwrapVolatile<T>(value: T): T;
-/**
- * Deep copy of a value with every `{get(): T}` live reference replaced by the
- * value it resolves to.
- *
- * DSH 0.1.7 hands volatile-marked fields back as live references, and a live
- * reference is still `typeof === 'object'` — so it passes a naive object check
- * and every lookup on it is `undefined`. Worse, spreading one (`{ ...ref }`)
- * does NOT read the field: it produces `{ get: <function> }`. Any merge that
- * spreads a resolved field to preserve its siblings — the card's "write one
- * region, keep the other" write, or the account map's spread — would otherwise
- * DROP every sibling and leak a function into the document.
- *
- * Both halves therefore unwrap before touching a resolved field. This lives in
- * the node-free host↔client bridge because the browser half needs it too.
- *
- * Non-reference values are recursed into so a nested volatile field is caught
- * as well; arrays and objects are rebuilt rather than mutated, so the caller's
- * value is never touched.
- */
-declare function unwrapVolatileDeep<T>(value: T): T;
-/**
- * Read the per-region account selections out of a settings value.
- *
- * SHARED because `accounts` now has TWO writers: the card, and the composer
- * panel's account table (2.14.0). Two writers of one field must use one merge
- * rule, or they drift — and the rule is not obvious.
- *
- * Deep-unwraps first: on DSH 0.1.7 a volatile field arrives as a `{get(): T}`
- * live reference, which passes the `typeof === 'object'` check and would be
- * returned as if it were the map. Every lookup on it is then `undefined`, and
- * the merge (`{ ...configured, [region]: id }`) would spread a reference into
- * `{get: <function>}` — dropping the other region's selection and leaking a
- * function into the settings document.
+ * How long one probe may take. Trae answers a one-word prompt in a few seconds;
+ * beyond this the answer is not worth waiting for and is reported as unknown.
  */
-declare function configuredAccountsOf(configured: unknown): Record<string, string>;
+declare const TRAE_PROBE_TIMEOUT_MS = 30000;
 /**
- * Whether the host-side "follow the Trae app's sign-in" switch is on (issue
- * #29). Absent reads as OFF, so an existing configuration keeps the strict
- * bind it shipped with and the switch is an opt-in — the same opt-out
- * semantics as {@link regionEnabledOf}, for the same reason: a config written
- * before this field existed cannot ask for behavior it never declared.
+ * Classify a failure that arrived as a thrown stream error rather than a
+ * returned result.
  *
- * Reads the whole settings section (or the bare field); deep-unwraps first
- * because on DSH 0.1.7 a volatile field arrives as a `{get(): T}` live
- * reference, whose `typeof === 'object'` would otherwise pass a naive check.
- */
-declare function followAppLoginEnabled(configured: unknown): boolean;
-/**
- * Build the next `regions` settings value for the card's save. The write
- * targets ONLY the signed-in account's region slot; every other region's slot
- * is carried over untouched, so switching accounts never clobbers the other
- * region's picks. Tolerates any stored shape (absent, non-object) by starting
- * from an empty document.
+ * The bridge errors the stream (instead of returning a result) when a refusal
+ * interrupts an answer that had already started; its message is the same
+ * translated text, so a named code is still decisive. Anything without a
+ * recognised code — an abort, a socket reset, a proxy — stays `unknown`.
  */
-declare function nextRegionSlots<Slot extends object>(regions: unknown, panel: TraePanel, slot: Slot): Record<string, unknown>;
+declare function classifyProbeError(message: string): {
+  verdict: TraeProbeVerdict;
+  detail: string;
+};
 /**
- * Whether one region's provider is switched on. Opt-out semantics: only an
- * explicit `false` disables it, so a config written before this switch existed
- * (and the pre-region-split flat fields, which never carry `enabled`) keep both
- * providers running exactly as before. The Host reads the same rule through
- * `regionStateOf`, so card and Host can never disagree about a region's state.
+ * Classify a completed upstream call.
  *
- * `value` may be the whole settings section or the `regions` map (see
- * {@link regionsMapOf}).
+ * `result` is what `TraeSoloBridge.chatStream` returned, so a refusal that
+ * arrived inside a 200 body has already been turned into a real error result
+ * (and its code translated into `message`) by the bridge — this function only
+ * has to read it back.
  */
-declare function regionEnabledOf(value: unknown, panel: TraePanel): boolean;
+declare function classifyProbeResult(result: TraeChatResult, outputSeen: boolean): {
+  verdict: TraeProbeVerdict;
+  detail: string;
+};
 /**
- * Build the next `regions` settings value for a provider on/off toggle. ONLY
- * the target region's `enabled` flag changes: every other field of that slot
- * (its directory, selection, image opt-ins, context budgets) and every other
- * region's slot are carried over verbatim, so switching a provider off never
- * discards the user's model picks and switching it back on restores them.
+ * The chat call one probe makes.
  *
- * This is deliberately separate from {@link nextRegionSlots}: that helper
- * writes a whole slot from a signed-in tab's draft, while this one must work
- * for a region that is signed OUT — which is precisely the region a user wants
- * to switch off (no international install, no international account).
+ * `inputTokens` pads the user turn so the probe carries roughly as much text as
+ * a real conversation. Size matters because an upstream that refuses LARGE
+ * requests will happily answer a one-word probe, and a verdict earned by a
+ * 1-token request says nothing about the 30k-token turn the user is about to
+ * send. `0` keeps the historical minimal probe (one word) — that is the default
+ * because it spends the least credit and answers the question the pool ranks on
+ * ("can this account talk at all").
  *
- * `value` may be the whole settings section or the `regions` map; the RETURN
- * value is always the `regions` map, i.e. exactly what `settingsScope.set(
- * 'regions', ...)` needs.
+ * The filler is `x` words: one ASCII word is about one token, so the body size
+ * is predictable (tokens ≈ inputTokens × 2 characters) without a tokenizer.
  */
-declare function nextRegionEnabled(value: unknown, panel: TraePanel, enabled: boolean): Record<string, unknown>;
 /**
- * The two seats this region's credit readout can occupy.
- *
- * `composer` is the composer tool row (`conversation.input.left`); `stats` is
- * the ambient dock below the composer card (`conversation.composer.dock`),
- * beside the shell's own round/step/token pills.
- *
- * WHY THE SEAT IS A CHOICE AT ALL (learned from dsh-connect-workbuddy issue
- * #62): the composer tool row is a LIST seat, so it is shared not only with the
- * shell's own controls but with any other plugin that registers there — and a
- * list seat cannot promise that every occupant is visible. The report behind
- * that issue is exactly that: with a third-party plugin installed the readout
- * stopped appearing. A fixed seat therefore lets one plugin's presence decide
- * another's, so the seat belongs to the user.
+ * The largest probe this plugin will pad.
  *
- * Named as a union rather than a boolean because a third seat is plausible and
- * a `showAtTop: boolean` would have to be MIGRATED rather than extended.
+ * A 100k-token probe is already ~200 KB of JSON; anything above that is a request
+ * the user's real turn would not plausibly reach in this product, and a config
+ * file edited by hand must not turn one "test all" click into a multi-megabyte
+ * upload.
  */
-type TraeCreditPosition = 'composer' | 'stats';
+declare const MAX_PROBE_INPUT_TOKENS = 100000;
+declare function probeBody(model: string, inputTokens?: number): string;
 /**
- * Which seat one region's readout uses, defaulting to the composer row.
- *
- * Anything other than an explicit `'stats'` reads as `'composer'`, which covers
- * the two cases that matter: a profile written BEFORE this setting existed (the
- * composer row was the only seat, so an upgrade moves nothing on screen), and a
- * hand-edited value the schema does not know. Falling back rather than
- * rendering nowhere is deliberate — an unrecognized value must not make the
- * readout disappear, which is the very defect this setting exists to fix.
- *
- * `value` may be the whole settings section or the `regions` map (see
- * {@link regionsMapOf}).
+ * Probe one model through the bridge the plugin actually chats with, so the
+ * recorded verdict describes the user's real path (same wire resolution, same
+ * function stamping, same error translation).
  */
-declare function regionCreditPositionOf(value: unknown, panel: TraePanel): TraeCreditPosition;
+declare function probeOneModel(chat: (body: string, signal?: AbortSignal) => Promise<TraeChatResult>, id: string, timeoutMs?: number, inputTokens?: number): Promise<TraeProbeResult>;
 /**
- * Build the next `regions` settings value for one region's credit seat.
- *
- * Same merge rule as every sibling region write: only the target region's
- * `creditPosition` changes, so a seat change cannot drop that slot's model
- * directory, selection, budgets or enabled flag, nor touch the other region.
+ * Probe a list of models ONE AT A TIME.
  *
- * `value` may be the whole settings section or the `regions` map; the RETURN
- * value is always the `regions` map, i.e. exactly what `settingsScope.set(
- * 'regions', ...)` needs.
+ * Sequential on purpose: Trae throttles bursts, and a burst of parallel probes
+ * would manufacture the very `rate_limited`/`unknown` verdicts this feature
+ * must avoid. An authentication failure stops the run — every later probe would
+ * fail the same way, and spending calls to learn that again is waste.
  */
-declare function nextRegionCreditPosition(value: unknown, panel: TraePanel, position: TraeCreditPosition): Record<string, unknown>;
-/** Subscription status of an international (ai) account, rendered instead of the CN credit packs. */
-interface TraeWebPayStatus {
-  isDollarUsageBilling: boolean;
-  hasPackage: boolean;
-  isPayFreshman: boolean;
-  inTrial: boolean;
-  trialEndTimeMs: number;
-  enableSoloLite: boolean;
-  enableSoloBuilder: boolean;
-  enableSoloCoder: boolean;
-  enableSoloWeb: boolean;
-  /** Trae's authoritative tier number (`user_pay_identity`); `0` means Free. */
-  payIdentity?: number;
-  /** Trae's authoritative tier label (`user_pay_identity_str`), e.g. `Free`. */
-  payIdentityStr?: string;
-  fission?: {
-    startTimeMs: number;
-    expireTimeMs: number;
-    maxUsage: number;
-  };
-}
-/** The JSON document the plugin card renders. */
-type TraeWebUsage = {
-  status: 'signed-out';
-  accounts: readonly TraeWebAccount[];
-  message?: string;
-  searched?: readonly TraeWebSearchPath[];
-  enabled?: boolean;
-} | {
-  status: 'signed-in';
+declare function probeModelsSequentially(chat: (body: string, signal?: AbortSignal) => Promise<TraeChatResult>, ids: readonly string[], onResult?: (result: TraeProbeResult, index: number) => void): Promise<TraeProbeResult[]>;
+//#endregion
+//#region src/account-pool-run.d.ts
+/** One account's check-in outcome. */
+interface TraePoolCheckinRow {
   accountId: string;
   accountName: string;
-  tokenExpiresAtMs: number;
-  /**
-   * When the BOUND account's refresh token expires (absent when the credential
-   * carries none). See {@link TraeWebAccount.refreshExpiresAtMs} — this is the
-   * horizon that actually matters, because the access token above renews
-   * itself until this one lapses.
-   */
-  refreshExpiresAtMs?: number;
-  /** Which per-region model directory and selection this account owns. */
-  region: TraeRegion;
-  /** Whether this region's provider is currently offered to DSH. */
-  enabled?: boolean;
-  accounts: readonly TraeWebAccount[];
-  models: readonly TraeWebModel[];
-  enabledModelIds: readonly string[];
-  rawChat?: {
-    state: 'disabled' | 'unchecked' | 'available' | 'protocol-gated' | 'authentication' | 'credit' | 'rate' | 'transport' | 'server';
-    checkedAtMs?: number;
-    status?: number;
-  };
-  credits?: TraeWebCredits;
-  creditsError?: string;
-  /**
-   * Set when this panel has no readable balance by design, rather than by
-   * failure. Only `enterprise` does: a tenant's spend is not reported by any
-   * endpoint the plugin can reach (every tenant quota path answers 404), so
-   * the figure exists solely in the enterprise console. The card must say so
-   * instead of rendering the consumer packs, which belong to the personal
-   * balance and would be read as the tenant's.
-   */
-  creditsUnavailable?: 'enterprise';
-  /**
-   * Present only when the bound account is out of credit AND another account
-   * on this machine has some (issue #25). The card then offers a one-click
-   * switch instead of leaving a permanently empty panel. Absent in every
-   * other case so a healthy account never pays for the extra read.
-   */
-  alternatives?: readonly TraeWebCreditAlternative[];
-  /**
-   * Present only when the Trae app's CURRENT sign-in differs from the
-   * account this plugin is bound to (issue #29): the card then offers a
-   * one-click follow instead of making the user hunt the account dropdown
-   * after every app-side sign-out. Absent in every other case — a healthy
-   * document costs no extra read beyond the accounts scan the document
-   * already runs.
-   */
-  appLogin?: TraeWebAppLogin;
   /**
-   * Daily check-in state (CN only). Absent on the international region,
-   * whose check-in surface does not exist — probed 2026-09-24: the
-   * `/trae/api/v2/ug/*` family answers 404 on every ai gateway, so the card
-   * shows no claim button there rather than a button that cannot work.
-   */
-  checkin?: TraeWebCheckin;
-  checkinError?: string;
-  /** Subscription status of an international account (region ai only). */
-  payStatus?: TraeWebPayStatus;
-  payStatusError?: string;
-} | {
-  status: 'error';
-  message: string;
-};
+   * - `claimed` — the upstream accepted today's claim for this account.
+   * - `already` — this ACCOUNT's reward for today already exists, so nothing was sent.
+   * - `device-already` — the MACHINE already spent today (9095). Not an account
+   *   failure and not a success: a truthful "no, this device is used up".
+   * - `disabled` — the upstream's check-in activity is not enabled/active for
+   *   this account. Reported separately rather than as `failed`, because claiming
+   *   is impossible by policy and calling it an error would read as a broken
+   *   plugin.
+   * - `failed` — the request never landed, or the credential could not be read.
+   */
+  status: 'claimed' | 'already' | 'device-already' | 'disabled' | 'failed';
+  /** Credits the upstream says this claim carries, when it stated a figure. */
+  credit?: number;
+  /** The upstream's own words on failure/refusal, redacted by the caller. */
+  message?: string;
+}
+/** One account's test outcome. */
+interface TraePoolTestRow {
+  accountId: string;
+  accountName: string;
+  /** The model this row was probed on — one model per batch, recorded per row. */
+  modelId: string;
+  outcome: TraeProbeResult['verdict'];
+  /** Upstream's own words / the plugin's reading of the code. */
+  detail: string;
+  /** A time the upstream named, when it named one. */
+  retryAtMs?: number;
+}
 //#endregion
 //#region src/web-status.d.ts
 /**
@@ -2625,6 +3237,73 @@ interface TraeUsageRouteOptions {
   }>;
   /** Raw-Chat capability state of the requested panel. */
   rawDiagnostic?(panel: TraePanel): TraeRawDiagnostic;
+  /**
+   * The account pool's host side, when the panel can run one. Optional on
+   * purpose: the pool is an add-on to the status document, and a harness without
+   * it (a test host, or a panel stack that failed to build) must still get a
+   * complete usage answer with no `pool` field.
+   */
+  pool?: TraePoolDeps;
+}
+/**
+ * What the pool surface needs from the Host, addressed by panel.
+ *
+ * The split is deliberate. The card never learns a credential and never writes a
+ * measurement: it sends an ACTION (`checkin` / `test` / `remove`) and reads the
+ * ranking back out of the status document. Everything here is therefore either a
+ * cheap local read (preferences, roster, saved names) or an explicitly user-
+ * triggered spend (the batches). The one thing that must never happen on a GET is
+ * an upstream call made for every row on every poll — the card already lazy-loads
+ * per-account state, so `checkedInToday` is cached and skippable by design.
+ */
+interface TraePoolDeps {
+  /** The panel's saved pool preferences, read from live settings. */
+  preferences(panel: TraePanel): TraePoolPreferences;
+  /**
+   * The full pool membership WITH live credit reads — the expensive version.
+   * Only the status document's own assembly and an explicit batch call it.
+   */
+  members(panel: TraePanel): Promise<readonly TraePoolMember[]>;
+  /**
+   * The checked ids that still resolve to a local sign-in, from a local scan only.
+   * The batch route's empty-pool guard runs this on every request, so it must not
+   * cost an upstream call — {@link members} is not suitable there.
+   */
+  effectiveMemberAccountIds?(panel: TraePanel): Promise<readonly string[]>;
+  /** Last measured display name per saved id, for members whose sign-in is gone. */
+  memberNames?(panel: TraePanel): Promise<Record<string, string>>;
+  /** Local sign-ins the pool does NOT cover, so the card can offer them to check. */
+  otherAccounts?(panel: TraePanel): Promise<readonly TraePoolAccount[]>;
+  /** Which account the request path would bill right now, after applying the pool. */
+  currentAccountId?(panel: TraePanel): Promise<string | undefined>;
+  /** Whether this panel's upstream rewards a daily check-in at all. */
+  checkinSupported?(panel: TraePanel): boolean;
+  /**
+   * Today's check-in state per account, from the cached per-account reads.
+   *
+   * A missing entry means "not read", which the card renders as unknown rather
+   * than as a definite "not checked in". `deviceCheckedIn` is the Trae half of the
+   * pair: the daily claim is keyed to `x-device-id`, so an account can be unpaid
+   * TODAY because this machine already spent its claim on another account.
+   */
+  checkinState?(panel: TraePanel): Promise<Record<string, TraePoolCheckinState>>;
+  /** Run the check-in batch. Persists nothing to settings; drops its own caches. */
+  checkin?(panel: TraePanel): Promise<readonly TraePoolCheckinRow[]>;
+  /** Run the model-availability batch and persist its measurements. */
+  test?(panel: TraePanel, modelId: string, onRow?: (row: TraePoolTestRow) => void): Promise<readonly TraePoolTestRow[]>;
+  /** Probe ONE account against the target model (the row's own test button). */
+  testOne?(panel: TraePanel, accountId: string): Promise<TraePoolTestRow | undefined>;
+  /** Forget an account's measurement — used when the user removes it from the pool. */
+  removeOne?(panel: TraePanel, accountId: string): Promise<boolean>;
+  /** The panel's catalog, the source of the free-model default and the stale check. */
+  catalog?(panel: TraePanel): readonly TraeModelInfo[];
+}
+/** One row's cached check-in facts; see {@link TraePoolDeps.checkinState}. */
+interface TraePoolCheckinState {
+  checkedIn: boolean;
+  deviceCheckedIn?: boolean;
+  /** Whether this account is offered the reward at all; false renders `disabled`. */
+  enabled?: boolean;
 }
 /**
  * Assemble one region's card document. `panel` is the tab the card is on; the
@@ -2637,64 +3316,6 @@ declare function traeWebUsage(deps: TraeUsageRouteOptions, panel: TraePanel): Pr
 /** Mount the GET usage route on an optional webServer context. */
 declare function registerTraeUsageRoute(ctx: Context$1, deps: TraeUsageRouteOptions): void;
 //#endregion
-//#region src/model-probe.d.ts
-/** How one model answered. */
-type TraeProbeVerdict = 'available' | 'gated' | 'unsupported' | 'rate_limited' | 'auth' | 'unknown';
-interface TraeProbeResult {
-  /** The model id as the card knows it. */
-  id: string;
-  verdict: TraeProbeVerdict;
-  /** Upstream's own words (already translated), or a short note. */
-  detail: string;
-}
-/**
- * How long one probe may take. Trae answers a one-word prompt in a few seconds;
- * beyond this the answer is not worth waiting for and is reported as unknown.
- */
-declare const TRAE_PROBE_TIMEOUT_MS = 30000;
-/**
- * Classify a failure that arrived as a thrown stream error rather than a
- * returned result.
- *
- * The bridge errors the stream (instead of returning a result) when a refusal
- * interrupts an answer that had already started; its message is the same
- * translated text, so a named code is still decisive. Anything without a
- * recognised code — an abort, a socket reset, a proxy — stays `unknown`.
- */
-declare function classifyProbeError(message: string): {
-  verdict: TraeProbeVerdict;
-  detail: string;
-};
-/**
- * Classify a completed upstream call.
- *
- * `result` is what `TraeSoloBridge.chatStream` returned, so a refusal that
- * arrived inside a 200 body has already been turned into a real error result
- * (and its code translated into `message`) by the bridge — this function only
- * has to read it back.
- */
-declare function classifyProbeResult(result: TraeChatResult, outputSeen: boolean): {
-  verdict: TraeProbeVerdict;
-  detail: string;
-};
-/** The minimal chat call one probe makes. */
-declare function probeBody(model: string): string;
-/**
- * Probe one model through the bridge the plugin actually chats with, so the
- * recorded verdict describes the user's real path (same wire resolution, same
- * function stamping, same error translation).
- */
-declare function probeOneModel(chat: (body: string, signal?: AbortSignal) => Promise<TraeChatResult>, id: string, timeoutMs?: number): Promise<TraeProbeResult>;
-/**
- * Probe a list of models ONE AT A TIME.
- *
- * Sequential on purpose: Trae throttles bursts, and a burst of parallel probes
- * would manufacture the very `rate_limited`/`unknown` verdicts this feature
- * must avoid. An authentication failure stops the run — every later probe would
- * fail the same way, and spending calls to learn that again is waste.
- */
-declare function probeModelsSequentially(chat: (body: string, signal?: AbortSignal) => Promise<TraeChatResult>, ids: readonly string[], onResult?: (result: TraeProbeResult, index: number) => void): Promise<TraeProbeResult[]>;
-//#endregion
 //#region src/index.d.ts
 declare const name = "dsh-connect-trae";
 declare const inject: string[];
@@ -2766,6 +3387,15 @@ interface TraeRegionState {
    * beside dsh-connect-workbuddy's rows — so the setting applies here too.
    */
   creditPosition?: TraeCreditPosition;
+  /**
+   * This region's account pool (issue #44), as the card saves it.
+   *
+   * Read through {@link regionStateOf} and written by the card's pool section.
+   * `enabled` absent means OFF: an account pool decides where money is spent, so
+   * it is opt-in and a config written before it existed must keep billing the
+   * account the user picked.
+   */
+  pool?: TraePoolPreferences;
 }
 interface Config {
   authFile?: string;
@@ -2901,4 +3531,4 @@ declare function asVolatile<S>(schema: S): S;
 declare const Config: z<Config>;
 declare function apply(ctx: Context$1, config: Config): void;
 //#endregion
-export { Config, FALLBACK_TRAE_MODELS, FALLBACK_TRAE_MODELS_AI, type PiAiGeneration, type PiAiRuntimeInfo, REGION_GATEWAYS, type RawChatDelta, type RawChatMessage, type RawChatTool, SseDecoder, type SseEvent, TRAE_ACCOUNT_STATUS_PATH, TRAE_AI_PROVIDER, TRAE_CHECKIN_PATH, TRAE_CN_AGENT_TASK_PATH, TRAE_CN_TITLE_PATH, TRAE_ENTERPRISE_PROVIDER, TRAE_MODELS_TEST_PATH, TRAE_MODEL_DETAIL_FUNCTIONS, TRAE_MODEL_DETAIL_PATH, TRAE_PANELS, TRAE_PAY_BASE, TRAE_PROBE_TIMEOUT_MS, TRAE_PROVIDER, TRAE_PROVIDERS, TRAE_PROVIDER_DISPLAY_NAMES, TRAE_PROVIDER_IDS, TRAE_PROVIDER_ID_DISPLAY_NAMES, TRAE_PROVIDER_ROUTES, TRAE_RAW_CHAT_V1_PATH, TRAE_RAW_CHAT_V2_PATH, TRAE_REASONING_EFFORTS, TRAE_REGIONS, TRAE_REGION_PARAM, TRAE_SETTINGS_NS, TRAE_SOLO_CHAT_PATH, TRAE_SOLO_FUNCTION, TRAE_SOLO_MODELS_PATH, TRAE_SOLO_REMOTE_BASE, TRAE_STATE_DB_FILENAME, TRAE_STREAM_IDLE_TIMEOUT_MS, TRAE_USAGE_PATH, TRAE_VERSION_CODE_FALLBACK, type TraeActivityRule, type TraeAdapter, type TraeCachedModelConfig, TraeCatalog, type TraeChatResult, type TraeCheckinClaim, type TraeCheckinStatus, type TraeContextBudget, type TraeCredential, TraeCredentialStore, TraeDelegatingUpstreamClient, type TraeDiscoveredModel, type TraeDiscoveredReasoning, type TraeEdition, type TraeFailure, TraeFallbackUpstreamClient, type TraeFallbackUpstreamOptions, type TraeFusionRawChatEnvelope, TraeGatedUpstreamClient, type TraeGatedUpstreamOptions, type TraeIdentity, type TraeInputModality, type TraeModelDetailRequest, type TraeModelInfo, type TraeModelProbeVerdict, type TraeModelsTestResponse, type TraeObservedModelConfig, type TraePanel, type TraeProbeResult, type TraeProbeVerdict, type TraeProviderRoute, TraeRawCapabilityController, type TraeRawCapabilityControllerOptions, type TraeRawCapabilitySnapshot, TraeRawCapabilityState, type TraeRawChatBehaviorConfig, type TraeRawChatCapability, type TraeRawChatClientOptions, type TraeRawChatConfig, type TraeRawChatFailureReason, type TraeRawChatRuntimeConfig, TraeRawChatUpstreamClient, type TraeRawDiagnostic, type TraeRawDiagnosticState, type TraeRawGateway, type TraeRawGatewayOptions, type TraeRawResolverResult, type TraeReasoningCapability, type TraeReasoningEffort, type TraeRefreshDevice, type TraeRegion, type TraeRegionGateways, TraeRegionState, type TraeShim, TraeSoloBridge, type TraeSoloClientOptions, TraeSoloRemoteCatalogClient, type TraeSoloRemoteCatalogOptions, TraeSoloUpstreamClient, type TraeStorageCandidate, type TraeStreamEvent, type TraeUpstreamClient, TraeUsageClient, type TraeUsageOptions, type TraeUsagePack, type TraeUsageRouteOptions, type TraeUsageSnapshot, type TraeUsageSummary, type TraeUsageView, type TraeWebAccountState, type TraeWebActivity, type TraeWebAppLogin, type TraeWebCheckin, type TraeWebCheckinClaim, type TraeWebCredits, type TraeWebUsage, type TraeWireModel, UnconfiguredTraeUpstreamClient, adaptLegacyPiAiContext, adaptModernPiAiContext, apply, applyContextBudgets, applyImageSelection, applyReasoningEffort, asVolatile, bridgeTraeSoloStream, buildTraeAgentTaskBody, buildTraeCnHeaders, buildTraeFusionRawChatEnvelope, buildTraeModelDetailRequest, buildTraeRawChatDraft, buildTraeRawChatRuntimeConfig, classifyProbeError, classifyProbeResult, classifyTraeRawChatFailure, configuredAccountsOf, createTraeAdapter, createTraeRawGateway, createTraeShim, creditPosition, decidePiAiGeneration, decodeRawChatChunk, decodeTraeEvent, decryptTraeStorageValue, deriveCatalog, describeIdShape, describeNameShape, describeTraeFailure, discoveredCatalog, displayNameOfTraeProvider, fallbackModelsFor, followAppLoginEnabled, generationOf, hashTraeRawChatArg, identityHeaders, inject, isEnterpriseAccount, legacyTraeOwnAuthPath, maskUserPath, mergeTraeModelSources, name, nextRegionCreditPosition, nextRegionEnabled, nextRegionSlots, normalizeTraeCredential, normalizeTraeVersionCode, panelOfKey, panelOfProvider, parseObservedModelConfig, parseReasoningCapability, parseTraeAuthValue, parseTraeCachedModel, parseTraeModelExtraConfigLogLine, parseTraeRawChatBehaviorConfig, parseTraeRemoteModel, parseTraeStorageDocument, piAiRuntimeInfo, pickTraeStorageIdentity, prepareSoloBody, probeBody, probeModelsSequentially, probeOneModel, probeTraeRawChatCapability, providerOfPanel, rawCapabilityDiagnostic, rawCapabilityFingerprint, readTraeCachedModel, readTraeCliIdentity, readTraeIdentity, refreshTraeCredential, regionCreditPositionOf, regionEnabled, regionEnabledOf, regionOfCredential, regionOfEdition, regionOfHost, regionOfPanel, regionOfTraeProvider, regionOfTraeStatusUrl, regionOfUserRegion, regionStateOf, registerTraeUsageRoute, resolveTraeIdentity, resolveTraeRawRuntime, routeOfTraeProvider, sanitizeCatalog, settingsNamespaceOf, traeEndpoint, traeInputModalities, traeModelDisplayName, traeOwnAuthPath, traeRawChatExtraInfo, traeStateDatabaseCandidates, traeStorageCandidates, traeWebUsage, traeWindowsAppNames, unwrapVolatile, unwrapVolatileDeep, withContextAdaptation, withTraeRegion };
+export { Config, FALLBACK_TRAE_MODELS, FALLBACK_TRAE_MODELS_AI, MAX_PROBE_INPUT_TOKENS, type PiAiGeneration, type PiAiRuntimeInfo, REGION_GATEWAYS, type RawChatDelta, type RawChatMessage, type RawChatTool, SseDecoder, type SseEvent, TRAE_ACCOUNT_STATUS_PATH, TRAE_AI_PROVIDER, TRAE_CHECKIN_PATH, TRAE_CN_AGENT_TASK_PATH, TRAE_CN_TITLE_PATH, TRAE_ENTERPRISE_PROVIDER, TRAE_MODELS_TEST_PATH, TRAE_MODEL_DETAIL_FUNCTIONS, TRAE_MODEL_DETAIL_PATH, TRAE_PANELS, TRAE_PAY_BASE, TRAE_PROBE_TIMEOUT_MS, TRAE_PROVIDER, TRAE_PROVIDERS, TRAE_PROVIDER_DISPLAY_NAMES, TRAE_PROVIDER_IDS, TRAE_PROVIDER_ID_DISPLAY_NAMES, TRAE_PROVIDER_ROUTES, TRAE_RAW_CHAT_V1_PATH, TRAE_RAW_CHAT_V2_PATH, TRAE_REASONING_EFFORTS, TRAE_REGIONS, TRAE_REGION_PARAM, TRAE_SETTINGS_NS, TRAE_SOLO_CHAT_PATH, TRAE_SOLO_FUNCTION, TRAE_SOLO_MODELS_PATH, TRAE_SOLO_REMOTE_BASE, TRAE_STATE_DB_FILENAME, TRAE_STREAM_IDLE_TIMEOUT_MS, TRAE_USAGE_PATH, TRAE_VERSION_CODE_FALLBACK, type TraeActivityRule, type TraeAdapter, type TraeCachedModelConfig, TraeCatalog, type TraeChatResult, type TraeCheckinClaim, type TraeCheckinStatus, type TraeContextBudget, type TraeCredential, TraeCredentialStore, TraeDelegatingUpstreamClient, type TraeDiscoveredModel, type TraeDiscoveredReasoning, type TraeEdition, type TraeFailure, TraeFallbackUpstreamClient, type TraeFallbackUpstreamOptions, type TraeFusionRawChatEnvelope, TraeGatedUpstreamClient, type TraeGatedUpstreamOptions, type TraeIdentity, type TraeInputModality, type TraeModelDetailRequest, type TraeModelInfo, type TraeModelProbeVerdict, type TraeModelsTestResponse, type TraeObservedModelConfig, type TraePanel, type TraeProbeResult, type TraeProbeVerdict, type TraeProviderRoute, TraeRawCapabilityController, type TraeRawCapabilityControllerOptions, type TraeRawCapabilitySnapshot, TraeRawCapabilityState, type TraeRawChatBehaviorConfig, type TraeRawChatCapability, type TraeRawChatClientOptions, type TraeRawChatConfig, type TraeRawChatFailureReason, type TraeRawChatRuntimeConfig, TraeRawChatUpstreamClient, type TraeRawDiagnostic, type TraeRawDiagnosticState, type TraeRawGateway, type TraeRawGatewayOptions, type TraeRawResolverResult, type TraeReasoningCapability, type TraeReasoningEffort, type TraeRefreshDevice, type TraeRegion, type TraeRegionGateways, TraeRegionState, type TraeShim, TraeSoloBridge, type TraeSoloClientOptions, TraeSoloRemoteCatalogClient, type TraeSoloRemoteCatalogOptions, TraeSoloUpstreamClient, type TraeStorageCandidate, type TraeStreamEvent, type TraeUpstreamClient, TraeUsageClient, type TraeUsageOptions, type TraeUsagePack, type TraeUsageRouteOptions, type TraeUsageSnapshot, type TraeUsageSummary, type TraeUsageView, type TraeWebAccountState, type TraeWebActivity, type TraeWebAppLogin, type TraeWebCheckin, type TraeWebCheckinClaim, type TraeWebCredits, type TraeWebUsage, type TraeWireModel, UnconfiguredTraeUpstreamClient, adaptLegacyPiAiContext, adaptModernPiAiContext, apply, applyContextBudgets, applyImageSelection, applyReasoningEffort, asVolatile, bridgeTraeSoloStream, buildTraeAgentTaskBody, buildTraeCnHeaders, buildTraeFusionRawChatEnvelope, buildTraeModelDetailRequest, buildTraeRawChatDraft, buildTraeRawChatRuntimeConfig, classifyProbeError, classifyProbeResult, classifyTraeRawChatFailure, configuredAccountsOf, createTraeAdapter, createTraeRawGateway, createTraeShim, creditPosition, decidePiAiGeneration, decodeRawChatChunk, decodeTraeEvent, decryptTraeStorageValue, deriveCatalog, describeIdShape, describeNameShape, describeTraeFailure, discoveredCatalog, displayNameOfTraeProvider, fallbackModelsFor, followAppLoginEnabled, generationOf, hashTraeRawChatArg, identityHeaders, inject, isEnterpriseAccount, legacyTraeOwnAuthPath, maskUserPath, mergeTraeModelSources, name, nextRegionCreditPosition, nextRegionEnabled, nextRegionSlots, normalizeTraeCredential, normalizeTraeVersionCode, panelOfKey, panelOfProvider, parseObservedModelConfig, parseReasoningCapability, parseTraeAuthValue, parseTraeCachedModel, parseTraeModelExtraConfigLogLine, parseTraeRawChatBehaviorConfig, parseTraeRemoteModel, parseTraeStorageDocument, piAiRuntimeInfo, pickTraeStorageIdentity, prepareSoloBody, probeBody, probeModelsSequentially, probeOneModel, probeTraeRawChatCapability, providerOfPanel, rawCapabilityDiagnostic, rawCapabilityFingerprint, readTraeCachedModel, readTraeCliIdentity, readTraeIdentity, refreshTraeCredential, regionCreditPositionOf, regionEnabled, regionEnabledOf, regionOfCredential, regionOfEdition, regionOfHost, regionOfPanel, regionOfTraeProvider, regionOfTraeStatusUrl, regionOfUserRegion, regionStateOf, registerTraeUsageRoute, resolveTraeIdentity, resolveTraeRawRuntime, routeOfTraeProvider, sanitizeCatalog, settingsNamespaceOf, traeEndpoint, traeInputModalities, traeModelDisplayName, traeOwnAuthPath, traeRawChatExtraInfo, traeStateDatabaseCandidates, traeStorageCandidates, traeWebUsage, traeWindowsAppNames, unwrapVolatile, unwrapVolatileDeep, withContextAdaptation, withTraeRegion };