dsh-plugin-subscription-oauth 0.4.0 → 0.5.0

package/lib/auth/ccswitch.d.ts

@@ -0,0 +1,36 @@
+/**
+ * The cc-switch balance query, reimplemented for the plugin's node half.
+ *
+ * cc-switch (github.com/farion1231/cc-switch) reads a DeepSeek-compatible provider's
+ * balance with `GET https://api.deepseek.com/user/balance`, an `Authorization: Bearer
+ * <api key>` header, and a 15 s timeout. This is that request, with the URL hardcoded
+ * exactly as cc-switch does — the provider's own base URL is never substituted in.
+ *
+ * The endpoint answers `{ is_available, balance_infos: [{ currency, total_balance, … }] }`,
+ * where a balance is a number or a numeric string. The module reduces that to the one
+ * figure a status chip needs: the first currency's total. Anything else — a missing key,
+ * a non-2xx answer, malformed JSON — resolves to nothing, so the caller shows no balance
+ * rather than a wrong one.
+ *
+ * @module dsh-plugin-subscription-oauth/auth/ccswitch
+ */
+import type { FetchFn } from '../http.js';
+/** One currency's balance, normalised from the endpoint's answer. */
+export interface CcSwitchBalance {
+    /** The currency the balance is denominated in. */
+    currency: string;
+    /** The remaining balance, as a decimal string. */
+    total: string;
+    /** Whether the account reports itself as usable. */
+    available: boolean;
+}
+/**
+ * Query one provider's balance the way cc-switch does.
+ *
+ * @param input - the provider's API key, and optionally a fetch to substitute in tests.
+ * @returns the balance, or undefined when the provider did not answer with one.
+ */
+export declare function queryCcSwitchBalance(input: {
+    apiKey: string;
+    fetchFn?: FetchFn;
+}): Promise<CcSwitchBalance | undefined>;

package/lib/auth/ccswitch.js

@@ -0,0 +1,75 @@
+/**
+ * The cc-switch balance query, reimplemented for the plugin's node half.
+ *
+ * cc-switch (github.com/farion1231/cc-switch) reads a DeepSeek-compatible provider's
+ * balance with `GET https://api.deepseek.com/user/balance`, an `Authorization: Bearer
+ * <api key>` header, and a 15 s timeout. This is that request, with the URL hardcoded
+ * exactly as cc-switch does — the provider's own base URL is never substituted in.
+ *
+ * The endpoint answers `{ is_available, balance_infos: [{ currency, total_balance, … }] }`,
+ * where a balance is a number or a numeric string. The module reduces that to the one
+ * figure a status chip needs: the first currency's total. Anything else — a missing key,
+ * a non-2xx answer, malformed JSON — resolves to nothing, so the caller shows no balance
+ * rather than a wrong one.
+ *
+ * @module dsh-plugin-subscription-oauth/auth/ccswitch
+ */
+import { proxiedFetch } from '../http.js';
+/** Read a balance field that may be a number or a numeric string. */
+function num(value) {
+    if (typeof value === 'number' && Number.isFinite(value))
+        return String(value);
+    if (typeof value === 'string' && value.trim() !== '' && Number.isFinite(Number(value)))
+        return value.trim();
+    return undefined;
+}
+/**
+ * Query one provider's balance the way cc-switch does.
+ *
+ * @param input - the provider's API key, and optionally a fetch to substitute in tests.
+ * @returns the balance, or undefined when the provider did not answer with one.
+ */
+export async function queryCcSwitchBalance(input) {
+    const fetchFn = input.fetchFn ?? proxiedFetch;
+    let response;
+    try {
+        // cc-switch's exact request shape: hardcoded URL, bearer auth, 15 s timeout.
+        response = await fetchFn('https://api.deepseek.com/user/balance', {
+            headers: { authorization: `Bearer ${input.apiKey}`, accept: 'application/json' },
+            signal: AbortSignal.timeout(15_000),
+        });
+    }
+    catch {
+        return undefined;
+    }
+    if (!response.ok)
+        return undefined;
+    let payload;
+    try {
+        payload = await response.json();
+    }
+    catch {
+        return undefined;
+    }
+    if (typeof payload !== 'object' || payload === null)
+        return undefined;
+    const record = payload;
+    const infos = record.balance_infos;
+    if (!Array.isArray(infos))
+        return undefined;
+    for (const raw of infos) {
+        if (typeof raw !== 'object' || raw === null)
+            continue;
+        const info = raw;
+        const total = num(info.total_balance);
+        if (total === undefined)
+            continue;
+        const currency = typeof info.currency === 'string' && info.currency.trim() !== '' ? info.currency.trim() : 'CNY';
+        return {
+            currency,
+            total,
+            available: record.is_available !== false,
+        };
+    }
+    return undefined;
+}

package/lib/auth/rpc.d.ts

@@ -1,3 +1,10 @@
+/**
+ * How one named credential resolves to a value.
+ *
+ * The host's credential service owns this; the RPC layer only calls it, so the balance
+ * query does not re-derive how a key is stored.
+ */
+export type CredentialResolver = (ref: string) => Promise<string | undefined>;
 /**
  * The host-side transport behind the Settings page.
  *
@@ -21,7 +28,7 @@ import type { SubscriptionRegistry } from './registry.js';
  * @param payload - the request's decoded payload.
  * @returns the envelope result.
  */
-export declare function dispatchRpc(registry: SubscriptionRegistry, endpoint: string, payload: unknown): Promise<RpcResult>;
+export declare function dispatchRpc(registry: SubscriptionRegistry, endpoint: string, payload: unknown, resolveCredential?: CredentialResolver): Promise<RpcResult>;
 /**
  * Register every endpoint route on the `connection` service, when one exists.
  *

package/lib/auth/rpc.js

@@ -1,15 +1,5 @@
-/**
- * The host-side transport behind the Settings page.
- *
- * Each endpoint is served as its own `POST /api/subscription-oauth.<endpoint>`
- * Fetch route on the `connection` service. `connection` is deliberately not in
- * the plugin's `inject` list: a headless composition has no connection service,
- * and the provider routes must still work there. Nothing else is registered
- * when it is absent, so the browser half simply finds no routes.
- *
- * @module dsh-plugin-subscription-oauth/auth/rpc
- */
 import { BAD_REQUEST, ProviderError } from '../errors.js';
+import { queryCcSwitchBalance } from './ccswitch.js';
 import { RPC_ENDPOINTS, RPC_PREFIX } from '../protocol.js';
 /** Wrap a value as a successful envelope result. */
 function success(value) {
@@ -85,9 +75,9 @@ function requiredProvider(payload, endpoint) {
  * @param payload - the request's decoded payload.
  * @returns the envelope result.
  */
-export async function dispatchRpc(registry, endpoint, payload) {
+export async function dispatchRpc(registry, endpoint, payload, resolveCredential) {
     try {
-        return success(await runEndpoint(registry, endpoint, payload));
+        return success(await runEndpoint(registry, endpoint, payload, resolveCredential));
     }
     catch (error) {
         return failure(error);
@@ -97,7 +87,7 @@ export async function dispatchRpc(registry, endpoint, payload) {
  * The endpoint table.
  * @throws {ProviderError} for a request the registry refuses.
  */
-async function runEndpoint(registry, endpoint, payload) {
+async function runEndpoint(registry, endpoint, payload, resolveCredential) {
     switch (endpoint) {
         case 'status':
             return registry.status();
@@ -145,6 +135,21 @@ async function runEndpoint(registry, endpoint, payload) {
         }
         case 'usage':
             return registry.usage(requiredProvider(payload, endpoint), booleanField(payload, 'force'));
+        case 'ccswitch-balance': {
+            // A manually added provider's balance, by cc-switch's query. The caller names the
+            // credential reference the provider's profile uses (its apiKeyEnv), and the host's
+            // credential service resolves it. No key, or a key the provider does not answer
+            // for, means no balance — never a fabricated zero.
+            if (resolveCredential === undefined)
+                return undefined;
+            const credentialRef = stringField(payload, 'credentialRef');
+            if (credentialRef === undefined)
+                return undefined;
+            const apiKey = await resolveCredential(credentialRef);
+            if (apiKey === undefined)
+                return undefined;
+            return await queryCcSwitchBalance({ apiKey });
+        }
         case 'reload':
             return registry.reload();
         default:
@@ -152,7 +157,7 @@ async function runEndpoint(registry, endpoint, payload) {
     }
 }
 /** Build the Fetch route for one endpoint. */
-function rpcRoute(endpoint, registry) {
+function rpcRoute(endpoint, registry, resolveCredential) {
     const method = `${RPC_PREFIX}${endpoint}`;
     return {
         path: `/api/${method}`,
@@ -176,7 +181,7 @@ function rpcRoute(endpoint, registry) {
             if (envelopeRequest.type !== 'client-request' || envelopeRequest.method !== method) {
                 return rejection(rpcId, 'gateway/bad-request', `${method} received an envelope for another method`, 400);
             }
-            return envelope(rpcId, await dispatchRpc(registry, endpoint, envelopeRequest.payload));
+            return envelope(rpcId, await dispatchRpc(registry, endpoint, envelopeRequest.payload, resolveCredential));
         },
     };
 }
@@ -191,10 +196,17 @@ export function registerSubscriptionRpc(ctx, registry) {
         const connection = connectionCtx.get('connection');
         if (connection === undefined)
             return;
+        // The cc-switch balance endpoint resolves a credential reference through the host's
+        // credential service. It is optional: a composition with no credential service still
+        // serves every other endpoint, and the balance endpoint simply answers nothing.
+        const credentials = connectionCtx.get('credentials');
+        const resolveCredential = credentials?.resolve === undefined
+            ? undefined
+            : async (ref) => (await credentials.resolve?.(ref))?.value;
         const register = (route) => connection.fetch.register(route);
         for (const endpoint of RPC_ENDPOINTS) {
             const method = `${RPC_PREFIX}${endpoint}`;
-            connectionCtx.effect(() => register(rpcRoute(endpoint, registry)), `dsh-plugin-subscription-oauth: /api/${method} route`);
+            connectionCtx.effect(() => register(rpcRoute(endpoint, registry, resolveCredential)), `dsh-plugin-subscription-oauth: /api/${method} route`);
         }
     });
 }

package/lib/client/UsageChip.d.ts

@@ -17,7 +17,7 @@
  */
 import type { ReactNode } from 'react';
 import type { SessionStandardProps } from '@deepseek-ai/dsh-client-ui-slots';
-import type { SubscriptionsCall } from './subscriptions-rpc.js';
+import type { SubscriptionsCall, AccountBalanceCall, CcSwitchBalanceCall } from './subscriptions-rpc.js';
 import type { ProviderUsage, UsageWindow } from '../protocol.js';
 /** Injected props the chip is registered with. */
 export interface UsageChipInjected {
@@ -27,6 +27,34 @@ export interface UsageChipInjected {
     t: (key: 'usageChipTitle' | 'usageChipFull', values?: Record<string, string | number>) => string;
     /** Whether the provider is one this plugin serves. */
     isOwnProvider: (provider: string) => boolean;
+    /**
+     * The DeepSeek account's balance, when the session uses it.
+     *
+     * The host owns that account's grant and the platform endpoint, so the chip asks the
+     * host rather than re-deriving either. It resolves to `undefined` when the account is
+     * signed out or the read fails, in which case the chip stays silent.
+     */
+    accountBalance: AccountBalanceCall;
+    /**
+     * A manually added provider's balance, by cc-switch's query.
+     *
+     * The caller names the credential reference the provider's profile uses (its
+     * `apiKeyEnv`); the host's credential service resolves it, and the node half asks
+     * cc-switch's balance endpoint. It resolves to `undefined` when there is no key or
+     * the provider did not answer.
+     */
+    ccSwitchBalance: CcSwitchBalanceCall;
+    /**
+     * The credential reference a manually added provider's balance query uses, by provider
+     * id.
+     *
+     * A manually added provider is not one this plugin serves and has no account route, so
+     * the only way to read its balance is cc-switch's query, which needs the provider's API
+     * key. That key is named by the provider's profile (`apiKeyEnv`), and the host's
+     * credential service resolves the name; this map is the one place a provider id is tied
+     * to that name. A provider with no entry gets no balance.
+     */
+    ccSwitchCredentialRef: (provider: string) => string | undefined;
 }
 /** One model choice, as the host records it. */
 export interface ModelSelection {
@@ -65,6 +93,46 @@ export interface ChipReading {
     /** Plan name, when the provider stated one. */
     plan?: string;
 }
+/** One currency's balance, as the host's account controller reports it. */
+export interface ChipBalance {
+    /** The wallet's currency. */
+    currency: string;
+    /** Remaining balance, as a decimal string. */
+    balance: string;
+    /** Whether this is a bonus / promotional wallet rather than topped-up credit. */
+    bonus: boolean;
+}
+/**
+ * Reduce the host's account-balance payload to the wallets the chip shows.
+ *
+ * Bonus wallets are shown after the topped-up ones, so a reader sees their own credit
+ * first and any promotional credit as a secondary figure.
+ *
+ * @param value - the host's ready balance, or undefined when there is none.
+ * @returns the wallets, topped-up first then bonus, or undefined when nothing is usable.
+ */
+export declare function balanceOf(value: {
+    value?: readonly {
+        currency: string;
+        balance: string;
+    }[];
+    bonusWallets?: readonly {
+        currency: string;
+        balance: string;
+    }[];
+} | {
+    status: string;
+} | null | undefined): readonly ChipBalance[] | undefined;
+/**
+ * Format one wallet for the chip's compact line.
+ *
+ * A balance is money, not a percentage, so it renders as `¥6.89` rather than a meter;
+ * the currency prefix keeps two currencies from being mistaken for one sum.
+ *
+ * @param wallet - the wallet to show.
+ * @returns the short form, e.g. `¥6.89` or `+¥2` for a bonus wallet.
+ */
+export declare function formatBalance(wallet: ChipBalance): string;
 /**
  * The short form of a route's name.
  *
@@ -117,4 +185,4 @@ export declare function formatReset(at: number | undefined, now: number): string
  * @param props - injected RPC caller, copy, and the session's provider reader.
  * @returns the chip, or null when there is nothing true to say.
  */
-export declare function UsageChip({ call, t, isOwnProvider, useProjection }: UsageChipInjected & SessionStandardProps): ReactNode;
+export declare function UsageChip({ call, t, isOwnProvider, accountBalance, ccSwitchBalance, ccSwitchCredentialRef, useProjection }: UsageChipInjected & SessionStandardProps): ReactNode;

package/lib/client/UsageChip.js

@@ -55,6 +55,41 @@ const SHORT_WINDOWS = {
 export function providerOf(projection) {
     return (projection?.next ?? projection?.lastUsed)?.provider;
 }
+/**
+ * Reduce the host's account-balance payload to the wallets the chip shows.
+ *
+ * Bonus wallets are shown after the topped-up ones, so a reader sees their own credit
+ * first and any promotional credit as a secondary figure.
+ *
+ * @param value - the host's ready balance, or undefined when there is none.
+ * @returns the wallets, topped-up first then bonus, or undefined when nothing is usable.
+ */
+export function balanceOf(value) {
+    // A failed read or no account (`{status:'failed'}` or `null`) reduces to nothing, as
+    // does a ready payload that names no wallet.
+    if (value === null || value === undefined || !('value' in value) || value.value === undefined)
+        return undefined;
+    const wallets = [
+        ...value.value.map((wallet) => ({ currency: wallet.currency, balance: wallet.balance, bonus: false })),
+        ...(value.bonusWallets ?? []).map((wallet) => ({ currency: wallet.currency, balance: wallet.balance, bonus: true })),
+    ];
+    return wallets.length === 0 ? undefined : wallets;
+}
+/**
+ * Format one wallet for the chip's compact line.
+ *
+ * A balance is money, not a percentage, so it renders as `¥6.89` rather than a meter;
+ * the currency prefix keeps two currencies from being mistaken for one sum.
+ *
+ * @param wallet - the wallet to show.
+ * @returns the short form, e.g. `¥6.89` or `+¥2` for a bonus wallet.
+ */
+export function formatBalance(wallet) {
+    const amount = Number.parseFloat(wallet.balance);
+    const trimmed = Number.isFinite(amount) ? String(Math.round(amount * 100) / 100) : wallet.balance;
+    const symbol = wallet.currency === 'CNY' ? '¥' : wallet.currency === 'USD' ? '$' : `${wallet.currency} `;
+    return `${wallet.bonus ? '+' : ''}${symbol}${trimmed}`;
+}
 /**
  * The short form of a route's name.
  *
@@ -157,8 +192,10 @@ export function formatReset(at, now) {
  * @param props - injected RPC caller, copy, and the session's provider reader.
  * @returns the chip, or null when there is nothing true to say.
  */
-export function UsageChip({ call, t, isOwnProvider, useProjection }) {
+export function UsageChip({ call, t, isOwnProvider, accountBalance, ccSwitchBalance, ccSwitchCredentialRef, useProjection }) {
     const [reading, setReading] = useState(undefined);
+    const [balance, setBalance] = useState(undefined);
+    const [ccBalance, setCcBalance] = useState(undefined);
     const [now, setNow] = useState(() => Date.now());
     const [open, setOpen] = useState(false);
     // The last route that answered, so a switch to a foreign provider leaves the last own
@@ -167,6 +204,39 @@ export function UsageChip({ call, t, isOwnProvider, useProjection }) {
     // A projection read, so the chip follows the picker: changing the model re-renders it
     // with the new provider instead of waiting for the next unrelated render.
     const selected = useProjection('modelSelection', (value) => providerOf(value));
+    // The DeepSeek account is not one of this plugin's routes, but the host owns its grant
+    // and the balance endpoint, so the chip shows its balance rather than staying silent.
+    // An own route takes the balance read over nothing.
+    const isDeepSeek = selected === 'deepseek-account';
+    // A manually added provider reads its balance by cc-switch's query, which needs the
+    // provider's API key. The provider's profile names that key by reference, and this map
+    // is the one place a provider id is tied to the reference; a provider with no entry,
+    // or one whose key does not resolve, gets no balance.
+    const ccRef = selected === undefined || isOwnProvider(selected) || isDeepSeek
+        ? undefined
+        : ccSwitchCredentialRef(selected);
+    // Read a manually added provider's balance while it is in force, on the same cadence as
+    // the other reads. It resolves to undefined when there is no key or the provider did
+    // not answer, which leaves the chip silent.
+    useEffect(() => {
+        if (ccRef === undefined) {
+            setCcBalance(undefined);
+            return;
+        }
+        let live = true;
+        const refresh = () => {
+            void ccSwitchBalance(ccRef)
+                .then((value) => { if (live)
+                setCcBalance(value === undefined ? undefined : { currency: value.currency, total: value.total }); })
+                .catch(() => { });
+        };
+        refresh();
+        const timer = setInterval(refresh, REFRESH_INTERVAL_MS);
+        return () => {
+            live = false;
+            clearInterval(timer);
+        };
+    }, [ccRef, ccSwitchBalance]);
     const load = useCallback(async (target) => {
         try {
             const result = await call('usage', { provider: target });
@@ -179,6 +249,28 @@ export function UsageChip({ call, t, isOwnProvider, useProjection }) {
             return undefined;
         }
     }, [call]);
+    // Read the DeepSeek account's balance while that provider is in force, on the same
+    // cadence as a usage read. It resolves to undefined when the account is signed out or
+    // the read fails, which leaves the chip silent.
+    useEffect(() => {
+        if (!isDeepSeek) {
+            setBalance(undefined);
+            return;
+        }
+        let live = true;
+        const refresh = () => {
+            void accountBalance()
+                .then((value) => { if (live)
+                setBalance(balanceOf(value)); })
+                .catch(() => { });
+        };
+        refresh();
+        const timer = setInterval(refresh, REFRESH_INTERVAL_MS);
+        return () => {
+            live = false;
+            clearInterval(timer);
+        };
+    }, [isDeepSeek, accountBalance]);
     useEffect(() => {
         const target = selected !== undefined && isOwnProvider(selected)
             ? selected
@@ -213,6 +305,29 @@ export function UsageChip({ call, t, isOwnProvider, useProjection }) {
         document.addEventListener('click', close);
         return () => { document.removeEventListener('click', close); };
     }, [open]);
+    // A manually added provider reads as money too, through cc-switch's query. It shows
+    // the one currency's total the provider answered with, nothing when there is no usable
+    // balance.
+    if (ccRef !== undefined) {
+        if (ccBalance === undefined)
+            return null;
+        const short = shortLabel(selected ?? '', selected ?? '');
+        return (_jsxs("span", { className: "dsh-subscription-usage-chip", children: [_jsx("style", { children: usageChipCss }), _jsxs("button", { type: "button", className: "dsh-subscription-usage-chip-trigger", "aria-expanded": open, title: t('usageChipTitle', { provider: selected ?? '' }), onClick: (event) => {
+                        event.stopPropagation();
+                        setOpen((was) => !was);
+                    }, children: [_jsx("span", { className: "dsh-subscription-usage-chip-label", children: short }), _jsx("span", { className: "dsh-subscription-usage-chip-cell", children: _jsx("span", { className: "dsh-subscription-usage-chip-value", children: `${ccBalance.currency === 'CNY' ? '¥' : ccBalance.currency === 'USD' ? '$' : `${ccBalance.currency} `}${ccBalance.total}` }) })] }), open && (_jsxs("span", { className: "dsh-subscription-usage-chip-panel", role: "status", children: [_jsx("span", { className: "dsh-subscription-usage-chip-full", children: t('usageChipFull', { provider: selected ?? '' }) }), _jsx("span", { className: "dsh-subscription-usage-chip-meter", children: _jsxs("span", { className: "dsh-subscription-usage-chip-meterHead", children: [_jsx("span", { children: ccBalance.currency }), _jsx("span", { className: "dsh-subscription-usage-chip-detail", children: ccBalance.total })] }) })] }))] }));
+    }
+    // The DeepSeek account reads as money, not as a percentage, so it takes its own line:
+    // the route abbreviated, then each wallet. An unknown selection leaves the chip silent.
+    if (isDeepSeek) {
+        if (balance === undefined)
+            return null;
+        const short = shortLabel('deepseek-account', 'DeepSeek Account');
+        return (_jsxs("span", { className: "dsh-subscription-usage-chip", children: [_jsx("style", { children: usageChipCss }), _jsxs("button", { type: "button", className: "dsh-subscription-usage-chip-trigger", "aria-expanded": open, title: t('usageChipTitle', { provider: 'DeepSeek Account' }), onClick: (event) => {
+                        event.stopPropagation();
+                        setOpen((was) => !was);
+                    }, children: [_jsx("span", { className: "dsh-subscription-usage-chip-label", children: short }), balance.map((wallet) => (_jsx("span", { className: "dsh-subscription-usage-chip-cell", children: _jsx("span", { className: "dsh-subscription-usage-chip-value", children: formatBalance(wallet) }) }, `${wallet.currency}${wallet.bonus ? ':bonus' : ''}`)))] }), open && (_jsxs("span", { className: "dsh-subscription-usage-chip-panel", role: "status", children: [_jsx("span", { className: "dsh-subscription-usage-chip-full", children: t('usageChipFull', { provider: 'DeepSeek Account' }) }), balance.map((wallet) => (_jsx("span", { className: "dsh-subscription-usage-chip-meter", children: _jsxs("span", { className: "dsh-subscription-usage-chip-meterHead", children: [_jsx("span", { children: `${wallet.bonus ? 'Bonus · ' : ''}${wallet.currency}` }), _jsx("span", { className: "dsh-subscription-usage-chip-detail", children: formatBalance(wallet) })] }) }, `${wallet.currency}${wallet.bonus ? ':bonus' : ''}`)))] }))] }));
+    }
     if (reading === undefined)
         return null;
     const percent = reading.window.usedPercent;

package/lib/client/index.d.ts

@@ -14,7 +14,7 @@ export type { SubscriptionsSectionInjected, SubscriptionsSectionProps } from './
 export type { UsageChipInjected } from './UsageChip.js';
 export type { SubscriptionsKey } from './locales.js';
 export { createSubscriptionsCall, SubscriptionsRpcError } from './subscriptions-rpc.js';
-export type { SubscriptionsCall } from './subscriptions-rpc.js';
+export type { SubscriptionsCall, AccountBalanceCall } from './subscriptions-rpc.js';
 declare module '@deepseek-ai/dsh-client-ui-slots' {
     interface LocaleNamespaceMap {
         /** The Subscriptions settings page copy. */

package/lib/client/index.js

@@ -10,7 +10,7 @@
  */
 import { SubscriptionsSection } from './SubscriptionsSection.js';
 import { UsageChip } from './UsageChip.js';
-import { createSubscriptionsCall } from './subscriptions-rpc.js';
+import { createSubscriptionsCall, createAccountBalanceCall, createCcSwitchBalanceCall } from './subscriptions-rpc.js';
 import { en, zh } from './locales.js';
 export { createSubscriptionsCall, SubscriptionsRpcError } from './subscriptions-rpc.js';
 /**
@@ -31,6 +31,19 @@ const SECTION_ORDER = 92;
  * chip follows them rather than displacing them.
  */
 const CHIP_ORDER = 10;
+/**
+ * The credential reference a manually added provider's balance query uses, by provider
+ * id.
+ *
+ * A manually added provider is not one this plugin serves, so the only way to read its
+ * balance is cc-switch's query, which needs the provider's API key. The provider's
+ * profile names that key by reference (`apiKeyEnv`), and the host's credential service
+ * resolves the name; this map is the one place a provider id is tied to that name. A
+ * provider with no entry gets no balance.
+ */
+const CC_SWITCH_CREDENTIAL_REFS = {
+    huanling: 'HUANLING_API_KEY',
+};
 /**
  * Required services: `slots` carries the registration seat, `connection` the
  * RPC caller, and `locale` the copy dictionaries.
@@ -71,6 +84,9 @@ export function apply(ctx) {
             call,
             t: t,
             isOwnProvider: (provider) => OWN_PROVIDER_IDS.has(provider),
+            accountBalance: createAccountBalanceCall(connection.rpc),
+            ccSwitchBalance: createCcSwitchBalanceCall(connection.rpc),
+            ccSwitchCredentialRef: (provider) => CC_SWITCH_CREDENTIAL_REFS[provider],
         }),
     }, UsageChip));
 }

package/lib/client/subscriptions-rpc.d.ts

@@ -8,7 +8,7 @@
  * @module dsh-plugin-subscription-oauth/client/subscriptions-rpc
  */
 import type { ConnectionHandle } from '@deepseek-ai/dsh-api-remotes/client';
-import type { RpcEndpoint, RpcMap } from '../protocol.js';
+import type { CcSwitchBalanceResult, RpcEndpoint, RpcMap } from '../protocol.js';
 /** A failed call: either the transport rejected or the endpoint answered `ok: false`. */
 export declare class SubscriptionsRpcError extends Error {
     readonly code: string;
@@ -16,9 +16,61 @@ export declare class SubscriptionsRpcError extends Error {
 }
 /** Call one endpoint, unwrapping the transport result. */
 export type SubscriptionsCall = <K extends RpcEndpoint>(endpoint: K, payload: RpcMap[K]['payload']) => Promise<RpcMap[K]['value']>;
+/** A caller for one manually added provider's cc-switch balance. */
+export interface CcSwitchBalanceCall {
+    (credentialRef: string): Promise<CcSwitchBalanceResult>;
+}
 /**
  * Bind a caller to one connection's RPC transport.
  * @param rpc - the browser connection's RPC caller.
  * @returns a typed caller for this plugin's endpoints.
  */
 export declare function createSubscriptionsCall(rpc: ConnectionHandle['rpc']): SubscriptionsCall;
+/**
+ * The DeepSeek account's wallet balances, as the host's account controller reports them.
+ *
+ * The controller answers `null` when the account is signed out, `{ status: 'failed' }`
+ * when the read did not complete, and `{ status: 'ready', value: <normal wallets>,
+ * bonusWallets: <bonus wallets> }` on success.
+ */
+export interface HostAccountBalance {
+    /** Normal (topped-up) wallets, one per currency. */
+    value: readonly {
+        currency: string;
+        balance: string;
+    }[];
+    /** Bonus / promotional wallets, one per currency. */
+    bonusWallets?: readonly {
+        currency: string;
+        balance: string;
+    }[];
+}
+/** A narrow caller for the host's own account controller. */
+export interface AccountBalanceCall {
+    (): Promise<HostAccountBalance | {
+        status: 'failed';
+    } | null>;
+}
+/**
+ * Read the DeepSeek account's balance through the host's own account controller.
+ *
+ * The host owns the DeepSeek OAuth grant and the platform endpoint, so this asks it
+ * rather than re-deriving either. It returns `null` when the account is signed out or
+ * the read fails, so a chip can simply not render in that case.
+ *
+ * @param rpc - the browser connection's RPC caller.
+ * @returns the balance, or null when there is nothing to show.
+ */
+export declare function createAccountBalanceCall(rpc: ConnectionHandle['rpc']): AccountBalanceCall;
+/**
+ * Read a manually added provider's balance through the plugin's cc-switch endpoint.
+ *
+ * The caller names the credential reference the provider's profile uses (its
+ * `apiKeyEnv`), and the host's credential service resolves it to the API key. The result
+ * is `undefined` when there is no key or the provider did not answer — never a wrong
+ * figure.
+ *
+ * @param rpc - the browser connection's RPC caller.
+ * @returns a narrow caller taking the credential reference.
+ */
+export declare function createCcSwitchBalanceCall(rpc: ConnectionHandle['rpc']): CcSwitchBalanceCall;

package/lib/client/subscriptions-rpc.js

@@ -10,6 +10,9 @@
 import { RPC_PREFIX } from '../protocol.js';
 /** The shared channel the node half's routes are mounted on. */
 const CHANNEL = '/api';
+/** The host's own DeepSeek account controller, from which the chip reads a balance. */
+const ACCOUNT_CHANNEL = '/api';
+const ACCOUNT_NAMESPACE = 'account';
 /** A failed call: either the transport rejected or the endpoint answered `ok: false`. */
 export class SubscriptionsRpcError extends Error {
     code;
@@ -42,3 +45,56 @@ export function createSubscriptionsCall(rpc) {
         return result.value;
     };
 }
+/**
+ * Read the DeepSeek account's balance through the host's own account controller.
+ *
+ * The host owns the DeepSeek OAuth grant and the platform endpoint, so this asks it
+ * rather than re-deriving either. It returns `null` when the account is signed out or
+ * the read fails, so a chip can simply not render in that case.
+ *
+ * @param rpc - the browser connection's RPC caller.
+ * @returns the balance, or null when there is nothing to show.
+ */
+export function createAccountBalanceCall(rpc) {
+    return async function call() {
+        let result;
+        try {
+            result = await rpc.call(ACCOUNT_CHANNEL, 'account/getBalance', {
+                version: '1',
+                locale: Intl.DateTimeFormat().resolvedOptions().locale ?? 'en-US',
+                timezoneOffsetSeconds: -new Date().getTimezoneOffset(),
+            });
+        }
+        catch (error) {
+            throw new SubscriptionsRpcError(messageOf(error), 'RPC_TRANSPORT');
+        }
+        if (!result.ok)
+            throw new SubscriptionsRpcError(result.error.message, result.error.code);
+        return result.value;
+    };
+}
+/**
+ * Read a manually added provider's balance through the plugin's cc-switch endpoint.
+ *
+ * The caller names the credential reference the provider's profile uses (its
+ * `apiKeyEnv`), and the host's credential service resolves it to the API key. The result
+ * is `undefined` when there is no key or the provider did not answer — never a wrong
+ * figure.
+ *
+ * @param rpc - the browser connection's RPC caller.
+ * @returns a narrow caller taking the credential reference.
+ */
+export function createCcSwitchBalanceCall(rpc) {
+    return async function call(credentialRef) {
+        let result;
+        try {
+            result = await rpc.call(CHANNEL, `${RPC_PREFIX}ccswitch-balance`, { credentialRef });
+        }
+        catch (error) {
+            throw new SubscriptionsRpcError(messageOf(error), 'RPC_TRANSPORT');
+        }
+        if (!result.ok)
+            throw new SubscriptionsRpcError(result.error.message, result.error.code);
+        return result.value;
+    };
+}