dsh-connect-workbuddy 2.3.0 → 3.0.0

package/lib/{host-heartbeat-Uh8JCXqk.js → host-heartbeat-JODdwFRx.js}

@@ -1494,6 +1494,16 @@ var WorkBuddyCredentialStore = class {
 	desktopPathOverride;
 	accountId;
 	inflight;
+	/**
+	* A RUNTIME account override from the pool's rotation, or undefined.
+	*
+	* Deliberately separate from {@link accountId}, which is the user's persisted
+	* choice. Rotation decides who serves *now*; it must never rewrite what the
+	* user picked, or "turn rotation off" could not restore their selection and
+	* the plugin would be unable to tell the two apart afterwards. Nothing here
+	* is ever written to settings.
+	*/
+	rotatedAccountId;
 	constructor(options) {
 		this.refresh = options.refresh;
 		this.refreshMarginMs = options.refreshMarginMs ?? 3e5;
@@ -1715,10 +1725,28 @@ var WorkBuddyCredentialStore = class {
 	/** The freshest stored credential for the current selection, no refresh. */
 	async current() {
 		const credentials = await this.readAll();
+		if (this.rotatedAccountId !== void 0) {
+			const rotated = credentials.find((credential) => workbuddyAccountId(credential) === this.rotatedAccountId);
+			if (rotated !== void 0) return rotated;
+		}
 		if (this.accountId === void 0) return this.preferred(credentials);
 		return credentials.find((credential) => workbuddyAccountId(credential) === this.accountId);
 	}
 	/**
+	* Set (or clear) the pool's RUNTIME account override.
+	*
+	* Never persists and never touches {@link accountId}: the user's saved choice
+	* is what `clear` restores, which is the whole reason this lives in its own
+	* field. Rotation is off when this is called with `undefined`.
+	*/
+	setRotatedAccount(accountId) {
+		this.rotatedAccountId = accountId;
+	}
+	/** The account the pool is currently rotating to, if any. */
+	rotatedAccount() {
+		return this.rotatedAccountId;
+	}
+	/**
 	* One account's stored credential by id, WITHOUT consulting or changing the
 	* current selection.
 	*
@@ -2258,7 +2286,7 @@ var WorkBuddyCatalog = class {
 //#endregion
 //#region src/version.ts
 /** The npm package version this build was produced from. */
-const WORKBUDDY_CONNECT_VERSION = "2.3.0";
+const WORKBUDDY_CONNECT_VERSION = "3.0.0";
 //#endregion
 //#region src/host-heartbeat.ts
 /**

package/lib/index.d.ts

@@ -237,6 +237,16 @@ declare class WorkBuddyCredentialStore {
   private desktopPathOverride;
   private accountId;
   private inflight;
+  /**
+   * A RUNTIME account override from the pool's rotation, or undefined.
+   *
+   * Deliberately separate from {@link accountId}, which is the user's persisted
+   * choice. Rotation decides who serves *now*; it must never rewrite what the
+   * user picked, or "turn rotation off" could not restore their selection and
+   * the plugin would be unable to tell the two apart afterwards. Nothing here
+   * is ever written to settings.
+   */
+  private rotatedAccountId;
   constructor(options: WorkBuddyStoreOptions);
   /** Whether a credential's login domain belongs to this store's region. */
   private matchesRegion;
@@ -346,6 +356,16 @@ declare class WorkBuddyCredentialStore {
   selectionLost(): Promise<boolean>;
   /** The freshest stored credential for the current selection, no refresh. */
   current(): Promise<WorkBuddyCredential | undefined>;
+  /**
+   * Set (or clear) the pool's RUNTIME account override.
+   *
+   * Never persists and never touches {@link accountId}: the user's saved choice
+   * is what `clear` restores, which is the whole reason this lives in its own
+   * field. Rotation is off when this is called with `undefined`.
+   */
+  setRotatedAccount(accountId: string | undefined): void;
+  /** The account the pool is currently rotating to, if any. */
+  rotatedAccount(): string | undefined;
   /**
    * One account's stored credential by id, WITHOUT consulting or changing the
    * current selection.
@@ -1195,23 +1215,48 @@ declare const WORKBUDDY_CONNECT_VERSION: string;
  * would report every global model as broken.
  */
 declare const PROBE_SYSTEM_PROMPT = "You are a connectivity check. Reply with a single word.";
-/** The one-word user turn; the smallest thing a chat endpoint accepts. */
-declare const PROBE_USER_PROMPT = "ping";
 /**
- * Output cap for a probe. One token is enough to prove the model answers, and
- * keeps the cost negligible: live measurements of `max_tokens: 1` probes
- * reported `credit` between 0 and 0.01, and one such probe left the credit
- * balance unchanged (933 → 933). For scale, a model on that roster bills 0.79+
- * per real reply. The point of the feature is to learn whether a model works
- * while spending as close to nothing as the service allows.
+ * Output cap for a probe. One token is enough to prove the model answers.
+ *
+ * The probe's cost comes from its INPUT, not its output (see
+ * {@link PROBE_INPUT_TOKENS}), so paying for a long completion would add money
+ * without adding signal.
  */
 declare const PROBE_MAX_TOKENS = 1;
+/**
+ * How much input a probe sends, in tokens.
+ *
+ * This is the whole point of the probe, and it is NOT a free choice. The
+ * upstream's rate limit (business code 6004) fires on request SIZE, measured on
+ * 2026-09-29 by varying only the input against one account and one model:
+ *
+ *   | input     | prompt_tokens the upstream counted | result |
+ *   | ---       | ---                                | ---    |
+ *   | ~10       | 38                                 | ok     |
+ *   | ~1,000    | 1,138                              | ok     |
+ *   | ~10,000   | 11,138                             | ok     |
+ *   | ~18,000   | 20,018                             | ok     |
+ *   | ~25,000   | 25,023                             | ok     |
+ *   | ~30,000   | ~32k                               | **429 / 6004** |
+ *
+ * So the threshold sits between 20k and 30k, a SINGLE large request is enough to
+ * trip it (it is not a running total), and each account reports its own reset
+ * time (two accounts at the same moment: `22:20:33` and `00:32:51`).
+ *
+ * A probe that sent a handful of tokens answered "usable" while every real
+ * request in a long conversation was refused — the probe was asking too small a
+ * question. 25k is sized to be a realistic long-conversation payload.
+ */
+declare const PROBE_INPUT_TOKENS = 25000;
 /**
  * Build the request body for one probe.
  *
  * `stream` is forced because the upstream rejects non-streaming chat requests;
  * `prepareChatBody` enforces that too, but sending it explicitly keeps this
  * function's output valid on its own.
+ *
+ * Measured on the built artifact: 112,713 bytes of body, and the upstream
+ * counted `prompt_tokens: 25023` at a cost of `credit: 0.72`.
  */
 declare function probeRequestBody(modelId: string): string;
 /**
@@ -1242,7 +1287,7 @@ interface WorkBuddyProbeResult {
   /** A time the upstream named, in ms. Absent when it named none. */
   retryAtMs?: number;
   /** Where a supplied `retryAtMs` came from, so the card can say so. */
-  retrySource?: 'retry-after' | 'quota-refresh';
+  retrySource?: 'retry-after' | 'upstream-message' | 'quota-refresh';
 }
 /**
  * Parse a `Retry-After` header value into an absolute time.
@@ -1258,24 +1303,29 @@ declare function parseRetryAfter(value: string | null, nowMs: number): number |
 /**
  * The cooldown the upstream stated, if it stated one.
  *
- * Two sources, in order of authority:
+ * Three sources, in order of authority:
  *
  * 1. `Retry-After` on the failure response. This is the upstream naming a time
  *    for THIS request, so it wins.
- * 2. The region's monthly quota refresh point, but ONLY for an out-of-credit
+ * 2. The reset time the upstream writes into its own failure body (see
+ *    {@link parseUpstreamResetAt}). This is the case that actually fires on
+ *    this service: a 429 from the Chinese gateway carries code 6004 and a
+ *    `将在 … 重置` sentence, with no `Retry-After` header at all.
+ * 3. The region's monthly quota refresh point, but ONLY for an out-of-credit
  *    outcome. A quota that resets at a known time is the one case where "when
  *    can I use this again" has a real answer even without a header — and it is
  *    the answer for the most common real limit on this service.
  *
- * A `rate-limited` outcome with neither source returns `{}`, which the card
- * renders as "the upstream did not say when". That is the honest answer: the
- * live probes found no rate-limit metadata in any response at all, so inventing
- * a number here would be pure fiction.
+ * A limited outcome with none of the three returns `{}`, which the card renders
+ * as "the upstream did not say when". That remains the honest answer for a
+ * genuinely timeless failure; inventing a number here would be pure fiction.
  */
 declare function cooldownOf(input: {
   outcome: WorkBuddyProbeOutcome;
   retryAfter: string | null;
   nowMs: number;
+  /** The upstream's own failure text, where a reset sentence may live. */
+  body?: string;
   /** The region's next monthly quota refresh, when the upstream declares one. */
   quotaRefreshAtMs?: number;
 }): Pick<WorkBuddyProbeResult, 'retryAtMs' | 'retrySource'>;
@@ -1314,9 +1364,9 @@ interface WorkBuddyProbeClient {
  * Run one probe for one model and reduce it to the card's row.
  *
  * The successful path drains the SSE stream purely to read the `credit` figure
- * the upstream reports, then discards the rest: the probe's question is "did
- * this model answer", and `max_tokens: 1` means there is nothing else in the
- * stream worth keeping.
+ * the upstream reports, then discards the rest: the question is whether this
+ * model answers a real-sized request, and `max_tokens: 1` means there is nothing
+ * else in the stream worth keeping.
  *
  * Never throws. A probe is a diagnostic the user asked for, so every failure is
  * a RESULT — one dead model must not abort the batch and hide the other rows.
@@ -1331,6 +1381,77 @@ declare function probeModel(input: {
   signal?: AbortSignal;
 }): Promise<WorkBuddyProbeResult>;
 //#endregion
+//#region src/account-pool.d.ts
+/** One account's pool entry: what the picker needs, plus its last measurement. */
+interface WorkBuddyPoolAccount {
+  /** Stable account id (the same one `WorkBuddyAccountChoice` carries). */
+  id: string;
+  /** Human name, or `''` when the desktop app recorded none. */
+  accountName: string;
+}
+/**
+ * What the pool knows about ONE account's last test of the target model.
+ *
+ * `undefined` means "never tested", which is deliberately distinct from every
+ * measured outcome: an untested account is a candidate (the user may want to
+ * use it now) whereas a measured failure is not. Collapsing the two would make
+ * a fresh pool look empty until the first timer tick.
+ */
+interface WorkBuddyPoolProbe {
+  outcome: WorkBuddyProbeOutcome;
+  /** When this measurement was taken, in epoch ms. */
+  atMs: number;
+  /**
+   * When this account may be usable again, when the upstream stated a time.
+   *
+   * Present for a `rate-limited` outcome whose failure body carried a reset
+   * sentence, and for an `out-of-credit` outcome with a known quota refresh.
+   * ABSENT when the upstream named no time — that absence is meaningful and
+   * must never be turned into a locally invented countdown.
+   */
+  retryAtMs?: number;
+}
+/** One account's live credit situation, as the pool ranks it. */
+interface WorkBuddyPoolCredits {
+  total: number;
+  /** Credits expiring within the card's "soon" window (3 days). */
+  expiringSoon: number;
+  /** When the nearest package expires, if any does. */
+  nearestExpiryMs?: number;
+}
+/**
+ * Everything the ranking rule reads about one account. Assembled by the Host
+ * from the credential store, the credits route, and the runtime probe store —
+ * this module only consumes it.
+ */
+interface WorkBuddyPoolMember {
+  account: WorkBuddyPoolAccount;
+  credits?: WorkBuddyPoolCredits;
+  probe?: WorkBuddyPoolProbe;
+  /** When the stored credential expires, used as the final tie-break. */
+  tokenExpiresAtMs?: number;
+}
+//#endregion
+//#region src/account-pool-run.d.ts
+/** One account's check-in outcome. */
+interface WorkBuddyPoolCheckinRow {
+  accountId: string;
+  accountName: string;
+  status: 'claimed' | 'already' | 'failed';
+  /** Credits gained, when the upstream stated a figure. */
+  credit?: number;
+  /** Streak length after the claim, when the upstream stated one. */
+  streakDays?: number;
+  /** The upstream's own words on failure, redacted by the caller. */
+  message?: string;
+}
+/** One account's test outcome. */
+interface WorkBuddyPoolTestRow {
+  accountId: string;
+  accountName: string;
+  result: WorkBuddyProbeResult;
+}
+//#endregion
 //#region src/status-paths.d.ts
 /**
  * Node-free constants and types shared by the Host and browser halves.
@@ -1390,22 +1511,6 @@ declare function regionOfStatusUrl(url: string): WorkBuddyWebRegion | undefined;
 declare function regionEnabledOf(value: unknown, region: WorkBuddyWebRegion): boolean;
 /** Build the next `regions` settings value for a signed-in tab's save. */
 declare function nextRegionSlots<Slot extends object>(regions: unknown, region: WorkBuddyWebRegion, slot: Slot): Record<string, unknown>;
-/**
- * Build the next `regions` settings value for a provider on/off toggle. ONLY
- * the target region's `enabled` flag changes: every other field of that slot
- * (its directory, selection, image opt-ins, context budgets) and every other
- * region's slot are carried over verbatim, so switching a provider off never
- * discards the user's model picks and switching it back on restores them.
- *
- * This is deliberately separate from {@link nextRegionSlots}: that helper
- * writes a whole slot from a signed-in tab's draft, while this one must work
- * for a region that is signed OUT — which is precisely the region a user wants
- * to switch off (no international install, no international account).
- *
- * `value` may be the whole settings section or the `regions` map; the RETURN
- * value is always the `regions` map, i.e. exactly what `settingsScope.set(
- * 'regions', ...)` needs.
- */
 declare function nextRegionEnabled(value: unknown, region: WorkBuddyWebRegion, enabled: boolean): Record<string, unknown>;
 /** One credit package as the upstream returns it, node-free. */
 interface WorkBuddyWebCreditPackage {
@@ -1600,6 +1705,23 @@ type WorkBuddyWebUsage =
   imageModelIds: readonly string[];
   credits?: WorkBuddyWebCredits;
   creditsError?: string;
+  /**
+   * The LAST refresh failed, but the snapshot below is intact.
+   *
+   * A failed usage re-read must not blank the panel. The account picker,
+   * credits, model directory and account pool are all gated on this region
+   * being 'signed-in', so collapsing the whole snapshot into the union's
+   * `{ status: 'error' }` variant (which carries no data at all) hides every
+   * one of them — including a pool the user is midway through editing. It
+   * reads as "the plugin lost my configuration". Carrying the failure as an
+   * overlay keeps the last good directory on screen with a banner above it,
+   * which is also what `creditsError`/`checkinError` already do per section.
+   *
+   * Only ever set on a snapshot that WAS healthy; a region that never loaded
+   * still reports the plain `{ status: 'error' }` so it can show the
+   * sign-in guidance instead of an empty panel.
+   */
+  refreshError?: string;
   checkin?: WorkBuddyWebCheckin;
   checkinError?: string;
   /**
@@ -1610,6 +1732,13 @@ type WorkBuddyWebUsage =
   credentialRejected?: boolean;
   /** Present only alongside {@link credentialRejected}. */
   recovery?: WorkBuddyWebRecovery;
+  /**
+   * This region's account-pool state, when the Host supports it.
+   *
+   * Absent on a Host without pool support, so the card renders no pool
+   * section instead of an empty one.
+   */
+  pool?: WorkBuddyWebPool;
   /**
    * Diagnostic only: whether this Host build's Config carries the volatile
    * markers dsh-settings requires before it will persist any field. Exposed
@@ -1653,15 +1782,129 @@ interface WorkBuddyWebProbeResult {
    * A time the upstream named for using this model again, in ms.
    *
    * ABSENT means the upstream named none, and the card must say exactly that.
-   * The live probes that shaped this feature found no rate-limit metadata in
-   * any response — no `Retry-After`, no `X-RateLimit-*` — so a client-invented
-   * countdown here would be fiction. Only two sources ever fill this:
-   * a real `Retry-After`, or (for an exhausted quota) the region's own quota
-   * refresh point, which the upstream does declare.
+   * A client-invented countdown here would be fiction. Three sources fill it:
+   * a real `Retry-After` header; the reset sentence the upstream writes into
+   * its own failure BODY (`将在 … UTC+8 重置`, which is where this service
+   * actually puts it — its 429s carry no rate-limit header at all); or, for an
+   * exhausted quota, the region's own quota refresh point.
    */
   retryAtMs?: number;
-  /** Which of those two sources supplied {@link retryAtMs}. */
-  retrySource?: 'retry-after' | 'quota-refresh';
+  /** Which of those three sources supplied {@link retryAtMs}. */
+  retrySource?: 'retry-after' | 'upstream-message' | 'quota-refresh';
+}
+/** Why one account is currently out of the pool. */
+type WorkBuddyWebPoolExclusion = 'unusable' | 'rate-limited' | 'out-of-credit' | 'credential-rejected' | 'not-found' | 'unavailable' | 'failed';
+/**
+ * One account's row in the pool, as the card renders it.
+ *
+ * Ties together the three facts the card shows per account — credits, the last
+ * test, and whether it is currently eligible — so the ranking the card displays
+ * comes from ONE Host answer rather than being re-derived in the browser.
+ */
+interface WorkBuddyWebPoolAccount {
+  accountId: string;
+  accountName: string;
+  /** Total remaining credits, absent when the credits route failed. */
+  credits?: number;
+  /** Credits expiring within 3 days. */
+  expiringSoon?: number;
+  /** When the nearest package expires, in ms. */
+  nearestExpiryMs?: number;
+  /** The last test of the target model, absent when never tested. */
+  probe?: {
+    outcome: WorkBuddyWebProbeOutcome;
+    atMs: number;
+    /** Only when the upstream named a time; never invented locally. */
+    retryAtMs?: number;
+  };
+  /** Set when this account cannot serve right now. */
+  excludedBy?: WorkBuddyWebPoolExclusion;
+  /** Whether this is the account currently billing traffic for the region. */
+  current: boolean;
+  /**
+   * Whether the user checked this account into the pool.
+   *
+   * Listed rows include UNCHECKED accounts so the card can offer them to check:
+   * membership is an explicit opt-in, and a user can only opt in to something
+   * they can see. Only checked rows can bill or be batched.
+   */
+  member: boolean;
+  /**
+   * Today's check-in state for this account.
+   *
+   * ABSENT means it was not read — the card must then say so rather than
+   * rendering a definite "not checked in", which would contradict the check-in
+   * result the user just watched succeed.
+   */
+  checkedInToday?: boolean;
+}
+/**
+ * The pool's state for one region.
+ *
+ * `targetModelId`/`targetModelSource` exist so the card can state WHICH model a
+ * test would use and WHERE that choice came from. `none` is a real, common
+ * answer (the CN catalog carries no free model until its first refresh) and the
+ * card must render it as "no free model" rather than silently substituting a
+ * paid one.
+ */
+interface WorkBuddyWebPool {
+  enabled: boolean;
+  rotateByCredits: boolean;
+  autoTestIntervalMinutes: number;
+  /** The model a test would use right now; absent when none can be resolved. */
+  targetModelId?: string;
+  /**
+   * The saved target id that is no longer offered by this region's catalog.
+   *
+   * Present only when {@link targetModelSource} is `'stale'`. The card says so
+   * and offers a way back to automatic, instead of enabling a test button that
+   * would run against a model the upstream does not offer.
+   */
+  staleTargetModelId?: string;
+  /**
+   * Where the target came from. `'stale'` means the SAVED id is no longer in
+   * the catalog — a distinct state from `'none'` (no free model exists),
+   * because the two need opposite advice.
+   */
+  targetModelSource: 'preferred' | 'free' | 'none' | 'stale';
+  /** The account ids the user has checked into this region's pool. */
+  memberAccountIds?: readonly string[];
+  /**
+   * The subset of {@link memberAccountIds} that resolves to a real local
+   * sign-in — i.e. what a batch actually runs on.
+   *
+   * Sent so the card never re-derives it: counting the raw saved list is what
+   * let the UI claim "1 of 1 selected" and enable both buttons while the Host
+   * ran on ZERO accounts and reported success.
+   */
+  effectiveMemberAccountIds?: readonly string[];
+  /**
+   * The account rotation most recently moved billing TO, when it moved.
+   *
+   * Reported so the card can record a switch it did not perform: rotation
+   * happens on the Host (including on a timer), and the card is otherwise
+   * unable to tell a switch from an unchanged state — which would make
+   * "every switch is recorded" a promise the UI could not keep.
+   */
+  rotatedToAccountId?: string;
+  accounts: readonly WorkBuddyWebPoolAccount[];
+  /**
+   * The models a manual target can be chosen from.
+   *
+   * TRIMMED to what the picker renders (id, name, multiplier) rather than the
+   * full `WorkBuddyWebModel` roster: the model table above already ships that
+   * roster in the same document, and this block is re-read on every 60-second
+   * poll, so carrying the full records here duplicated the whole catalog twice
+   * per response for three fields.
+   */
+  catalog?: readonly WorkBuddyWebPoolModel[];
+}
+/** One model as the pool's target picker needs it. */
+interface WorkBuddyWebPoolModel {
+  id: string;
+  name: string;
+  /** Absent when the upstream stated no multiplier (NOT the same as free). */
+  creditMultiplier?: number;
 }
 /**
  * Deep copy of a settings value with every `{get(): T}` live reference replaced
@@ -1731,14 +1974,19 @@ interface WorkBuddyStatusRouteOptions {
    */
   regionEnabled(region: WorkBuddyRegion): boolean;
   /**
-   * Send one minimal request to each named model of a region and report what
+   * Send one real-volume request to each named model of a region and report what
    * came back.
    *
    * Optional: it is the only dependency the card's test button needs, so a Host
    * built without it (or a route mounted for a status-only consumer) simply
    * answers 503 and the button reports that instead of failing the card.
+   *
+   * Every request costs real credits (measured `credit: 0.72` for one probe), so
+   * the card drives this ONE model per click and never as a batch.
    */
-  probeModels?(region: WorkBuddyRegion, modelIds: readonly string[], signal?: AbortSignal): Promise<readonly WorkBuddyWebProbeResult[]>;
+  probeModels?(region: WorkBuddyRegion, modelIds: readonly string[], options?: {
+    signal?: AbortSignal;
+  }): Promise<readonly WorkBuddyWebProbeResult[]>;
   /**
    * The region's next monthly quota refresh, when the upstream declares one.
    *
@@ -1767,6 +2015,82 @@ interface WorkBuddyStatusRouteOptions {
    * probe.
    */
   accountUsable?(region: WorkBuddyRegion, account: WorkBuddyRecoveryCandidate): Promise<boolean>;
+  /**
+   * The region's account pool, assembled on the Host.
+   *
+   * Optional as a whole: a Host built without pool support simply omits it, and
+   * the card then renders no pool section rather than an empty, confusing one.
+   * Inside it, `test` is in turn optional because a batch test is the one part
+   * that needs a working probe dependency.
+   */
+  pool?: WorkBuddyPoolDeps;
+}
+/**
+ * What the pool route needs from the Host.
+ *
+ * Everything is region-scoped because the two regions are parallel stacks: one
+ * region's pool must never see, rank, or bill the other region's accounts.
+ */
+interface WorkBuddyPoolDeps {
+  /** The region's stored preferences, resolved from the Host config. */
+  preferences(region: WorkBuddyRegion): {
+    enabled: boolean;
+    rotateByCredits: boolean;
+    autoTestIntervalMinutes: number;
+    targetModelId: string;
+    memberAccountIds: readonly string[];
+  };
+  /** One region's CHECKED accounts, plus their credits and last measurements. */
+  members(region: WorkBuddyRegion): Promise<readonly WorkBuddyPoolMember[]>;
+  /**
+   * The checked accounts that actually RESOLVE to a local sign-in.
+   *
+   * Cheap by contract (a local scan, no upstream calls), unlike {@link members}
+   * which fetches credits per account. The route's empty-pool guard uses this
+   * so a ghost id — a saved member whose sign-in is gone — is refused with
+   * `no-live-members` (distinct from `no-members`, which means nothing was ever
+   * checked) instead of passing the guard and running a batch over nothing.
+   */
+  effectiveMemberAccountIds?(region: WorkBuddyRegion): Promise<readonly string[]>;
+  /**
+   * The account rotation last redirected billing to, when it did.
+   *
+   * Reported so the card can log a switch that happened on the Host (possibly
+   * on a timer) — without it, "every switch leaves a record" is a promise the
+   * browser half has no way to keep.
+   */
+  rotatedToAccountId?(region: WorkBuddyRegion): Promise<string | undefined>;
+  /**
+   * Today's check-in state per account id.
+   *
+   * Read for the pool's table so the card can state it. Absent (or a missing
+   * entry) means "not read", which the card renders as unknown rather than as a
+   * definite "not checked in" — a claim that would contradict the check-in the
+   * user just performed.
+   */
+  checkedInToday?(region: WorkBuddyRegion): Promise<Readonly<Record<string, boolean>>>;
+  /**
+   * Every local sign-in the pool does NOT cover, so the card can offer them to
+   * check in. Absent means the card lists only pool members.
+   */
+  otherAccounts?(region: WorkBuddyRegion): Promise<readonly {
+    id: string;
+    accountName: string;
+  }[]>;
+  /** The account currently billing traffic for the region, when known. */
+  currentAccountId?(region: WorkBuddyRegion): Promise<string | undefined>;
+  /**
+   * Claim the daily reward for every account of one region.
+   *
+   * Absent means the action answers 503 — the same contract as {@link
+   * WorkBuddyStatusRouteOptions.probeModels}, so a Host without the dependency
+   * reports "unavailable" instead of appearing to succeed.
+   */
+  checkin?(region: WorkBuddyRegion): Promise<readonly WorkBuddyPoolCheckinRow[]>;
+  /** Test every account of one region against the resolved target model. */
+  test?(region: WorkBuddyRegion, modelId: string): Promise<readonly WorkBuddyPoolTestRow[]>;
+  /** The region's live catalog, used to resolve the free target model. */
+  catalog?(region: WorkBuddyRegion): readonly WorkBuddyModelInfo[];
 }
 /**
  * Assemble one region's card document. `region` is the tab the card is on;
@@ -1831,6 +2155,40 @@ interface WorkBuddyRegionState {
   imageModelIds?: string[];
   /** Local DSH context budget per model in this region. */
   contextBudgets?: Record<string, WorkBuddyContextBudget>;
+  /** This region's account-pool preferences (opt-in; see {@link WorkBuddyPoolPreferences}). */
+  pool?: WorkBuddyPoolPreferences;
+}
+/**
+ * One region's account-pool preferences, as stored.
+ *
+ * Every field is a USER CHOICE, which is why the pool's measured facts are not
+ * here: preferences are saved through the card's draft-and-discard path, and a
+ * measurement living in the same slot would be rolled back by the next save.
+ */
+interface WorkBuddyPoolPreferences {
+  /** Whether the pool is active for this region. Opt-in: default false. */
+  enabled?: boolean;
+  /**
+   * Whether the plugin may choose the billed account by credits.
+   *
+   * Opt-in, and mutually exclusive with manual selection: while it is on, the
+   * card disables the account dropdown, because two writers deciding the same
+   * slot is exactly how "the dropdown says A but B is billed" happens.
+   */
+  rotateByCredits?: boolean;
+  /** Minutes between automatic tests; clamped to 5..1440. */
+  autoTestIntervalMinutes?: number;
+  /** Model id to test; `''` means auto-pick a free model from this region. */
+  targetModelId?: string;
+  /**
+   * The account ids checked into this region's pool.
+   *
+   * An EXPLICIT opt-in, and empty by default: the batch actions claim rewards
+   * and spend credits on real accounts, so membership is the user's decision
+   * rather than a consequence of which sign-ins happen to exist. Empty means
+   * the pool covers nothing and both buttons stay disabled.
+   */
+  memberAccountIds?: string[];
 }
 /** Plugin configuration. */
 interface Config {
@@ -1976,4 +2334,4 @@ declare function legacyAttributionRegion(value: Config, accountsFor: (region: Wo
  */
 declare function apply(ctx: Context, config: Config): void;
 //#endregion
-export { CREDENTIAL_REJECTED_CODE, Config, ENCRYPTED_CREDENTIAL_CODE, FALLBACK_WORKBUDDY_MODELS, FALLBACK_WORKBUDDY_MODELS_GLOBAL, NATIVE_MODALITY_BY_MODEL_ID, PROBE_MAX_TOKENS, PROBE_SYSTEM_PROMPT, PROBE_USER_PROMPT, type UpstreamErrorKind, WORKBUDDY_ACCOUNTS_REFRESH_PATH, WORKBUDDY_APP_EXECUTABLE_ENV, WORKBUDDY_AUTH_FILENAME, WORKBUDDY_AUTH_FILE_ENV, WORKBUDDY_CHECKIN_PATH, WORKBUDDY_CONNECT_VERSION, WORKBUDDY_GLOBAL_PROVIDER, WORKBUDDY_HOST_HEARTBEAT_FILENAME, WORKBUDDY_MODELS_REFRESH_PATH, WORKBUDDY_PROBE_PATH, WORKBUDDY_PROVIDER, WORKBUDDY_PROVIDERS, WORKBUDDY_PROVIDER_DISPLAY_NAMES, WORKBUDDY_REGIONS, WORKBUDDY_REGION_PARAM, WORKBUDDY_SETTINGS_NS, WORKBUDDY_STREAM_IDLE_TIMEOUT_MS, WORKBUDDY_USAGE_PATH, type WorkBuddyAccountChoice, type WorkBuddyAdapter, type WorkBuddyAuthStatus, type WorkBuddyCandidateFailure, WorkBuddyCatalog, type WorkBuddyChatResult, type WorkBuddyCredential, type WorkBuddyCredentialRecovery, WorkBuddyCredentialRejectedError, WorkBuddyCredentialStore, type WorkBuddyCreditPackage, type WorkBuddyCredits, WorkBuddyEncryptedCredentialError, type WorkBuddyEncryptedField, type WorkBuddyHostHeartbeat, type WorkBuddyModelInfo, type WorkBuddyNativeModality, type WorkBuddyProbeClient, type WorkBuddyProbeOutcome, type WorkBuddyProbeResult, type WorkBuddyProbeStore, type WorkBuddyReasoning, type WorkBuddyRecoveryCandidate, type WorkBuddyRefreshOutcome, WorkBuddyRegionState, type WorkBuddyShim, type WorkBuddyStatusRouteOptions, type WorkBuddyStoreOptions, WorkBuddyUpstreamClient, type WorkBuddyUpstreamModel, type WorkBuddyUsabilityProbeOptions, apply, asVolatile, authFileName, classifyUpstreamError, clearAtRestKeyCache, clearHostHeartbeat, cooldownOf, createAccountUsabilityProbe, createWorkBuddyAdapter, createWorkBuddyShim, creditOfStream, defaultDesktopAuthCandidates, defaultDesktopAuthDirs, defaultDesktopAuthPath, deriveAtRestKey, deriveAtRestKeyId, deriveCatalog, fallbackModelsFor, fetchAtRestKeyPayload, findWorkbuddyAppExecutable, hasEncryptedCredentialFields, imageDefaultFor, inject, isCredentialRejectedError, isEncryptedCredentialError, isEncryptedFieldWrapper, isHeartbeatProcessAlive, isWorkbuddyBundle, legacyAttributionRegion, legacyWorkbuddyOwnAuthPath, macosBundleExecutable, macosNestedAppBundles, name, nativeModalityOf, nextRegionEnabled, nextRegionSlots, openEncryptedField, outcomeOfFailure, parseCreditMultiplier, parseReasoning, parseRetryAfter, parseUpstreamModel, parseWorkBuddyAuth, prepareChatBody, probeModel, probeRequestBody, probeSucceeded, processStartTimeMs, readAtRestKey, readHostHeartbeat, regionCleared, regionEnabled, regionEnabledOf, regionOf, regionOfProvider, regionOfStatusUrl, regionStateOf, registerWorkBuddyStatusRoute, resolveCredentialRecovery, selectAccountFor, settingsNamespaceOf, toPersistedWorkBuddyModel, unwrapVolatileDeep, withWorkBuddyRegion, workBuddyDisplayName, workBuddyModelInput, workBuddyThinkingLevelMap, workBuddyWebStatus, workbuddyAccountId, workbuddyAppExecutableCandidates, workbuddyHostHeartbeatPath, workbuddyOwnAuthPath, writeHostHeartbeat };
+export { CREDENTIAL_REJECTED_CODE, Config, ENCRYPTED_CREDENTIAL_CODE, FALLBACK_WORKBUDDY_MODELS, FALLBACK_WORKBUDDY_MODELS_GLOBAL, NATIVE_MODALITY_BY_MODEL_ID, PROBE_INPUT_TOKENS, PROBE_MAX_TOKENS, PROBE_SYSTEM_PROMPT, type UpstreamErrorKind, WORKBUDDY_ACCOUNTS_REFRESH_PATH, WORKBUDDY_APP_EXECUTABLE_ENV, WORKBUDDY_AUTH_FILENAME, WORKBUDDY_AUTH_FILE_ENV, WORKBUDDY_CHECKIN_PATH, WORKBUDDY_CONNECT_VERSION, WORKBUDDY_GLOBAL_PROVIDER, WORKBUDDY_HOST_HEARTBEAT_FILENAME, WORKBUDDY_MODELS_REFRESH_PATH, WORKBUDDY_PROBE_PATH, WORKBUDDY_PROVIDER, WORKBUDDY_PROVIDERS, WORKBUDDY_PROVIDER_DISPLAY_NAMES, WORKBUDDY_REGIONS, WORKBUDDY_REGION_PARAM, WORKBUDDY_SETTINGS_NS, WORKBUDDY_STREAM_IDLE_TIMEOUT_MS, WORKBUDDY_USAGE_PATH, type WorkBuddyAccountChoice, type WorkBuddyAdapter, type WorkBuddyAuthStatus, type WorkBuddyCandidateFailure, WorkBuddyCatalog, type WorkBuddyChatResult, type WorkBuddyCredential, type WorkBuddyCredentialRecovery, WorkBuddyCredentialRejectedError, WorkBuddyCredentialStore, type WorkBuddyCreditPackage, type WorkBuddyCredits, WorkBuddyEncryptedCredentialError, type WorkBuddyEncryptedField, type WorkBuddyHostHeartbeat, type WorkBuddyModelInfo, type WorkBuddyNativeModality, WorkBuddyPoolPreferences, type WorkBuddyProbeClient, type WorkBuddyProbeOutcome, type WorkBuddyProbeResult, type WorkBuddyProbeStore, type WorkBuddyReasoning, type WorkBuddyRecoveryCandidate, type WorkBuddyRefreshOutcome, WorkBuddyRegionState, type WorkBuddyShim, type WorkBuddyStatusRouteOptions, type WorkBuddyStoreOptions, WorkBuddyUpstreamClient, type WorkBuddyUpstreamModel, type WorkBuddyUsabilityProbeOptions, apply, asVolatile, authFileName, classifyUpstreamError, clearAtRestKeyCache, clearHostHeartbeat, cooldownOf, createAccountUsabilityProbe, createWorkBuddyAdapter, createWorkBuddyShim, creditOfStream, defaultDesktopAuthCandidates, defaultDesktopAuthDirs, defaultDesktopAuthPath, deriveAtRestKey, deriveAtRestKeyId, deriveCatalog, fallbackModelsFor, fetchAtRestKeyPayload, findWorkbuddyAppExecutable, hasEncryptedCredentialFields, imageDefaultFor, inject, isCredentialRejectedError, isEncryptedCredentialError, isEncryptedFieldWrapper, isHeartbeatProcessAlive, isWorkbuddyBundle, legacyAttributionRegion, legacyWorkbuddyOwnAuthPath, macosBundleExecutable, macosNestedAppBundles, name, nativeModalityOf, nextRegionEnabled, nextRegionSlots, openEncryptedField, outcomeOfFailure, parseCreditMultiplier, parseReasoning, parseRetryAfter, parseUpstreamModel, parseWorkBuddyAuth, prepareChatBody, probeModel, probeRequestBody, probeSucceeded, processStartTimeMs, readAtRestKey, readHostHeartbeat, regionCleared, regionEnabled, regionEnabledOf, regionOf, regionOfProvider, regionOfStatusUrl, regionStateOf, registerWorkBuddyStatusRoute, resolveCredentialRecovery, selectAccountFor, settingsNamespaceOf, toPersistedWorkBuddyModel, unwrapVolatileDeep, withWorkBuddyRegion, workBuddyDisplayName, workBuddyModelInput, workBuddyThinkingLevelMap, workBuddyWebStatus, workbuddyAccountId, workbuddyAppExecutableCandidates, workbuddyHostHeartbeatPath, workbuddyOwnAuthPath, writeHostHeartbeat };