dsh-plugin-subscription-oauth 0.5.0 → 0.6.0

package/lib/auth/deepseek-balance.d.ts

@@ -0,0 +1,58 @@
+/**
+ * The DeepSeek account's balance, read on the node half.
+ *
+ * The host owns the DeepSeek OAuth grant and its platform endpoint, and exposes a
+ * `deepseekAccount` service with a `getBalance(client)`. The browser cannot call that
+ * service directly — it lives behind the host's Remote controller, not a `/api` fetch
+ * route — so this plugin's node half reads it and serves it over the plugin's own RPC,
+ * the same channel the rest of the chip's data already travels on.
+ *
+ * @module dsh-plugin-subscription-oauth/auth/deepseek-balance
+ */
+import type { FetchFn } from '../http.js';
+/** One currency's wallet, as the platform reports it. */
+export interface DeepSeekWallet {
+    /** ISO currency the balance is denominated in. */
+    currency: 'CNY' | 'USD' | string;
+    /** Remaining balance, as a decimal string. */
+    balance: string;
+}
+/** The DeepSeek account's wallets, normal and bonus. */
+export interface DeepSeekBalance {
+    /** Normal (topped-up) wallets, one per currency. */
+    wallets: readonly DeepSeekWallet[];
+    /** Bonus / promotional wallets, one per currency. */
+    bonusWallets: readonly DeepSeekWallet[];
+}
+/**
+ * The slice of the host's `deepseekAccount` service this module reads.
+ *
+ * Declared locally rather than imported: the host package's published typings differ
+ * across DSH lines, and this plugin only needs this one method.
+ */
+export interface DeepSeekAccountService {
+    getBalance: (client: unknown) => Promise<unknown>;
+}
+/**
+ * Read the DeepSeek account's balance through the host's service.
+ *
+ * @param account - the host's `deepseekAccount` service, when the composition provides
+ * one.
+ * @param client - the client metadata the service expects.
+ * @returns the balance, or undefined when the account is signed out or the read failed.
+ */
+export declare function readDeepSeekBalance(account: DeepSeekAccountService | undefined, client: unknown): Promise<DeepSeekBalance | undefined>;
+/**
+ * Reduce the host service's answer to the wallets the chip shows.
+ *
+ * The service resolves `null` when the account is signed out, `{ status: 'failed' }`
+ * when the read did not complete, and `{ status: 'ready', value: <normal>, bonusWallets }`
+ * on success. Anything else — an unexpected shape from a newer host — is nothing rather
+ * than a wrong figure.
+ *
+ * @param value - the service's raw answer.
+ * @returns the wallets, or undefined when there is nothing usable.
+ */
+export declare function normalizeDeepSeekBalance(value: unknown): DeepSeekBalance | undefined;
+/** A fetch substitute is accepted for symmetry with the other balance readers. */
+export type { FetchFn };

package/lib/auth/deepseek-balance.js

@@ -0,0 +1,63 @@
+/**
+ * The DeepSeek account's balance, read on the node half.
+ *
+ * The host owns the DeepSeek OAuth grant and its platform endpoint, and exposes a
+ * `deepseekAccount` service with a `getBalance(client)`. The browser cannot call that
+ * service directly — it lives behind the host's Remote controller, not a `/api` fetch
+ * route — so this plugin's node half reads it and serves it over the plugin's own RPC,
+ * the same channel the rest of the chip's data already travels on.
+ *
+ * @module dsh-plugin-subscription-oauth/auth/deepseek-balance
+ */
+import { proxiedFetch } from '../http.js';
+/**
+ * Read the DeepSeek account's balance through the host's service.
+ *
+ * @param account - the host's `deepseekAccount` service, when the composition provides
+ * one.
+ * @param client - the client metadata the service expects.
+ * @returns the balance, or undefined when the account is signed out or the read failed.
+ */
+export async function readDeepSeekBalance(account, client) {
+    if (account === undefined)
+        return undefined;
+    let result;
+    try {
+        result = await account.getBalance(client);
+    }
+    catch {
+        return undefined;
+    }
+    return normalizeDeepSeekBalance(result);
+}
+/**
+ * Reduce the host service's answer to the wallets the chip shows.
+ *
+ * The service resolves `null` when the account is signed out, `{ status: 'failed' }`
+ * when the read did not complete, and `{ status: 'ready', value: <normal>, bonusWallets }`
+ * on success. Anything else — an unexpected shape from a newer host — is nothing rather
+ * than a wrong figure.
+ *
+ * @param value - the service's raw answer.
+ * @returns the wallets, or undefined when there is nothing usable.
+ */
+export function normalizeDeepSeekBalance(value) {
+    if (typeof value !== 'object' || value === null)
+        return undefined;
+    const record = value;
+    if (record.status !== 'ready')
+        return undefined;
+    if (!Array.isArray(record.value))
+        return undefined;
+    const wallets = record.value.filter(isWallet);
+    const bonusRaw = record.bonusWallets;
+    const bonusWallets = Array.isArray(bonusRaw) ? bonusRaw.filter(isWallet) : [];
+    return { wallets, bonusWallets };
+}
+/** Narrow one entry to a wallet shape. */
+function isWallet(value) {
+    if (typeof value !== 'object' || value === null)
+        return false;
+    const record = value;
+    return typeof record.currency === 'string' && typeof record.balance === 'string';
+}

package/lib/auth/rpc.d.ts

@@ -5,6 +5,28 @@
  * query does not re-derive how a key is stored.
  */
 export type CredentialResolver = (ref: string) => Promise<string | undefined>;
+/**
+ * The balance a non-subscription provider reports, and how to read it.
+ *
+ * A provider that is not a subscription this plugin serves has no usage windows, so the
+ * chip shows its balance instead. The balance is read by cc-switch's query, which needs
+ * the provider's API key; the provider's profile names that key by reference
+ * (`apiKeyEnv`), and this map is the one place a provider id is tied to that reference.
+ */
+export interface BalanceContext {
+    /** The credential reference each provider id's balance query uses. */
+    readonly credentialRefs: Readonly<Record<string, string>>;
+    /** Resolve one credential reference to its key. */
+    readonly resolveCredential?: CredentialResolver;
+    /**
+     * Resolve the host's DeepSeek account service, read lazily per request.
+     *
+     * The service may register after this plugin applies, so it is resolved when a
+     * balance is actually read, not once at startup. Returns undefined when the
+     * composition has no such service.
+     */
+    readonly resolveDeepSeekAccount?: () => DeepSeekAccountService | undefined;
+}
 /**
  * The host-side transport behind the Settings page.
  *
@@ -17,6 +39,7 @@ export type CredentialResolver = (ref: string) => Promise<string | undefined>;
  * @module dsh-plugin-subscription-oauth/auth/rpc
  */
 import type { Context } from '@deepseek-ai/cordis';
+import type { DeepSeekAccountService } from './deepseek-balance.js';
 import type { RpcResult } from '../protocol.js';
 import type { SubscriptionRegistry } from './registry.js';
 /**
@@ -28,11 +51,11 @@ import type { SubscriptionRegistry } from './registry.js';
  * @param payload - the request's decoded payload.
  * @returns the envelope result.
  */
-export declare function dispatchRpc(registry: SubscriptionRegistry, endpoint: string, payload: unknown, resolveCredential?: CredentialResolver): Promise<RpcResult>;
+export declare function dispatchRpc(registry: SubscriptionRegistry, endpoint: string, payload: unknown, balance?: BalanceContext): Promise<RpcResult>;
 /**
  * Register every endpoint route on the `connection` service, when one exists.
  *
  * @param ctx - the plugin's context.
  * @param registry - the provider routes every route dispatches through.
  */
-export declare function registerSubscriptionRpc(ctx: Context, registry: SubscriptionRegistry): void;
+export declare function registerSubscriptionRpc(ctx: Context, registry: SubscriptionRegistry, balance?: BalanceContext): void;

package/lib/auth/rpc.js

@@ -1,5 +1,6 @@
 import { BAD_REQUEST, ProviderError } from '../errors.js';
 import { queryCcSwitchBalance } from './ccswitch.js';
+import { readDeepSeekBalance } from './deepseek-balance.js';
 import { RPC_ENDPOINTS, RPC_PREFIX } from '../protocol.js';
 /** Wrap a value as a successful envelope result. */
 function success(value) {
@@ -32,6 +33,25 @@ function stringField(payload, field) {
     const trimmed = value.trim();
     return trimmed.length === 0 ? undefined : trimmed;
 }
+/**
+ * Read the client metadata a balance endpoint forwards to the host service.
+ *
+ * The host's account service expects a version / locale / timezone object; a missing or
+ * partial one is tolerated by building a default rather than failing the read.
+ *
+ * @param payload - the request payload.
+ * @returns the client metadata object.
+ */
+function payloadClient(payload) {
+    const record = typeof payload === 'object' && payload !== null ? payload : {};
+    return {
+        version: typeof record.version === 'string' ? record.version : '1',
+        locale: typeof record.locale === 'string' ? record.locale : 'en-US',
+        timezoneOffsetSeconds: typeof record.timezoneOffsetSeconds === 'number'
+            ? record.timezoneOffsetSeconds
+            : 0,
+    };
+}
 /** Read a boolean field from a payload, defaulting to false when absent. */
 function booleanField(payload, field) {
     if (typeof payload !== 'object' || payload === null)
@@ -75,9 +95,9 @@ function requiredProvider(payload, endpoint) {
  * @param payload - the request's decoded payload.
  * @returns the envelope result.
  */
-export async function dispatchRpc(registry, endpoint, payload, resolveCredential) {
+export async function dispatchRpc(registry, endpoint, payload, balance) {
     try {
-        return success(await runEndpoint(registry, endpoint, payload, resolveCredential));
+        return success(await runEndpoint(registry, endpoint, payload, balance));
     }
     catch (error) {
         return failure(error);
@@ -87,7 +107,7 @@ export async function dispatchRpc(registry, endpoint, payload, resolveCredential
  * The endpoint table.
  * @throws {ProviderError} for a request the registry refuses.
  */
-async function runEndpoint(registry, endpoint, payload, resolveCredential) {
+async function runEndpoint(registry, endpoint, payload, balance) {
     switch (endpoint) {
         case 'status':
             return registry.status();
@@ -135,17 +155,26 @@ async function runEndpoint(registry, endpoint, payload, resolveCredential) {
         }
         case 'usage':
             return registry.usage(requiredProvider(payload, endpoint), booleanField(payload, 'force'));
+        case 'deepseek-balance': {
+            // The DeepSeek account's balance, read on the node half through the host's own
+            // account service. The browser cannot call that service directly (it sits behind
+            // the host's Remote controller, not a /api fetch route), so the node half reads it
+            // and serves it here, on the same channel as the rest of the chip's data. The
+            // service is resolved lazily, per request, because it may register after apply.
+            const client = payloadClient(payload);
+            return await readDeepSeekBalance(balance?.resolveDeepSeekAccount?.(), client);
+        }
         case 'ccswitch-balance': {
-            // A manually added provider's balance, by cc-switch's query. The caller names the
-            // credential reference the provider's profile uses (its apiKeyEnv), and the host's
-            // credential service resolves it. No key, or a key the provider does not answer
-            // for, means no balance — never a fabricated zero.
-            if (resolveCredential === undefined)
-                return undefined;
-            const credentialRef = stringField(payload, 'credentialRef');
-            if (credentialRef === undefined)
+            // A non-subscription provider's balance, by cc-switch's query. The caller names
+            // the provider; the configured map turns that into the credential reference the
+            // provider's profile uses, and the host's credential service resolves it. No
+            // entry, no key, or a key the provider does not answer for means no balance —
+            // never a fabricated zero.
+            const provider = requiredProvider(payload, endpoint);
+            const credentialRef = balance?.credentialRefs[provider];
+            if (credentialRef === undefined || balance?.resolveCredential === undefined)
                 return undefined;
-            const apiKey = await resolveCredential(credentialRef);
+            const apiKey = await balance.resolveCredential(credentialRef);
             if (apiKey === undefined)
                 return undefined;
             return await queryCcSwitchBalance({ apiKey });
@@ -157,7 +186,7 @@ async function runEndpoint(registry, endpoint, payload, resolveCredential) {
     }
 }
 /** Build the Fetch route for one endpoint. */
-function rpcRoute(endpoint, registry, resolveCredential) {
+function rpcRoute(endpoint, registry, balance) {
     const method = `${RPC_PREFIX}${endpoint}`;
     return {
         path: `/api/${method}`,
@@ -181,7 +210,7 @@ function rpcRoute(endpoint, registry, resolveCredential) {
             if (envelopeRequest.type !== 'client-request' || envelopeRequest.method !== method) {
                 return rejection(rpcId, 'gateway/bad-request', `${method} received an envelope for another method`, 400);
             }
-            return envelope(rpcId, await dispatchRpc(registry, endpoint, envelopeRequest.payload, resolveCredential));
+            return envelope(rpcId, await dispatchRpc(registry, endpoint, envelopeRequest.payload, balance));
         },
     };
 }
@@ -191,22 +220,15 @@ function rpcRoute(endpoint, registry, resolveCredential) {
  * @param ctx - the plugin's context.
  * @param registry - the provider routes every route dispatches through.
  */
-export function registerSubscriptionRpc(ctx, registry) {
+export function registerSubscriptionRpc(ctx, registry, balance) {
     ctx.inject(['connection'], (connectionCtx) => {
         const connection = connectionCtx.get('connection');
         if (connection === undefined)
             return;
-        // The cc-switch balance endpoint resolves a credential reference through the host's
-        // credential service. It is optional: a composition with no credential service still
-        // serves every other endpoint, and the balance endpoint simply answers nothing.
-        const credentials = connectionCtx.get('credentials');
-        const resolveCredential = credentials?.resolve === undefined
-            ? undefined
-            : async (ref) => (await credentials.resolve?.(ref))?.value;
         const register = (route) => connection.fetch.register(route);
         for (const endpoint of RPC_ENDPOINTS) {
             const method = `${RPC_PREFIX}${endpoint}`;
-            connectionCtx.effect(() => register(rpcRoute(endpoint, registry, resolveCredential)), `dsh-plugin-subscription-oauth: /api/${method} route`);
+            connectionCtx.effect(() => register(rpcRoute(endpoint, registry, balance)), `dsh-plugin-subscription-oauth: /api/${method} route`);
         }
     });
 }

package/lib/client/UsageChip.d.ts

@@ -36,25 +36,15 @@ export interface UsageChipInjected {
      */
     accountBalance: AccountBalanceCall;
     /**
-     * A manually added provider's balance, by cc-switch's query.
+     * A non-subscription provider's balance, by cc-switch's query.
      *
-     * The caller names the credential reference the provider's profile uses (its
-     * `apiKeyEnv`); the host's credential service resolves it, and the node half asks
-     * cc-switch's balance endpoint. It resolves to `undefined` when there is no key or
-     * the provider did not answer.
+     * A provider that is not a subscription this plugin serves has no usage windows to
+     * meter, so the chip shows its balance instead. The caller names the provider; the
+     * server maps it to the credential reference the provider's profile names (`apiKeyEnv`),
+     * resolves that to the API key, and asks cc-switch's balance endpoint. It resolves to
+     * `undefined` when the provider has no balance source or did not answer.
      */
     ccSwitchBalance: CcSwitchBalanceCall;
-    /**
-     * The credential reference a manually added provider's balance query uses, by provider
-     * id.
-     *
-     * A manually added provider is not one this plugin serves and has no account route, so
-     * the only way to read its balance is cc-switch's query, which needs the provider's API
-     * key. That key is named by the provider's profile (`apiKeyEnv`), and the host's
-     * credential service resolves the name; this map is the one place a provider id is tied
-     * to that name. A provider with no entry gets no balance.
-     */
-    ccSwitchCredentialRef: (provider: string) => string | undefined;
 }
 /** One model choice, as the host records it. */
 export interface ModelSelection {
@@ -103,16 +93,18 @@ export interface ChipBalance {
     bonus: boolean;
 }
 /**
- * Reduce the host's account-balance payload to the wallets the chip shows.
+ * Reduce the node half's balance payload to the wallets the chip shows.
  *
  * Bonus wallets are shown after the topped-up ones, so a reader sees their own credit
- * first and any promotional credit as a secondary figure.
+ * first and any promotional credit as a secondary figure. A bonus wallet that holds
+ * nothing is dropped rather than shown as `+¥0`: the platform reports one for every
+ * currency whether or not there is a bonus, and an empty one is noise, not information.
  *
- * @param value - the host's ready balance, or undefined when there is none.
+ * @param value - the node half's balance, or undefined when there is none.
  * @returns the wallets, topped-up first then bonus, or undefined when nothing is usable.
  */
 export declare function balanceOf(value: {
-    value?: readonly {
+    wallets?: readonly {
         currency: string;
         balance: string;
     }[];
@@ -120,8 +112,6 @@ export declare function balanceOf(value: {
         currency: string;
         balance: string;
     }[];
-} | {
-    status: string;
 } | null | undefined): readonly ChipBalance[] | undefined;
 /**
  * Format one wallet for the chip's compact line.
@@ -185,4 +175,4 @@ export declare function formatReset(at: number | undefined, now: number): string
  * @param props - injected RPC caller, copy, and the session's provider reader.
  * @returns the chip, or null when there is nothing true to say.
  */
-export declare function UsageChip({ call, t, isOwnProvider, accountBalance, ccSwitchBalance, ccSwitchCredentialRef, useProjection }: UsageChipInjected & SessionStandardProps): ReactNode;
+export declare function UsageChip({ call, t, isOwnProvider, accountBalance, ccSwitchBalance, useProjection }: UsageChipInjected & SessionStandardProps): ReactNode;

package/lib/client/UsageChip.js

@@ -56,22 +56,25 @@ export function providerOf(projection) {
     return (projection?.next ?? projection?.lastUsed)?.provider;
 }
 /**
- * Reduce the host's account-balance payload to the wallets the chip shows.
+ * Reduce the node half's balance payload to the wallets the chip shows.
  *
  * Bonus wallets are shown after the topped-up ones, so a reader sees their own credit
- * first and any promotional credit as a secondary figure.
+ * first and any promotional credit as a secondary figure. A bonus wallet that holds
+ * nothing is dropped rather than shown as `+¥0`: the platform reports one for every
+ * currency whether or not there is a bonus, and an empty one is noise, not information.
  *
- * @param value - the host's ready balance, or undefined when there is none.
+ * @param value - the node half's balance, or undefined when there is none.
  * @returns the wallets, topped-up first then bonus, or undefined when nothing is usable.
  */
 export function balanceOf(value) {
-    // A failed read or no account (`{status:'failed'}` or `null`) reduces to nothing, as
-    // does a ready payload that names no wallet.
-    if (value === null || value === undefined || !('value' in value) || value.value === undefined)
+    if (value === null || value === undefined)
         return undefined;
     const wallets = [
-        ...value.value.map((wallet) => ({ currency: wallet.currency, balance: wallet.balance, bonus: false })),
-        ...(value.bonusWallets ?? []).map((wallet) => ({ currency: wallet.currency, balance: wallet.balance, bonus: true })),
+        ...(value.wallets ?? []).map((wallet) => ({ currency: wallet.currency, balance: wallet.balance, bonus: false })),
+        // Only a bonus wallet that actually holds something is worth a line.
+        ...(value.bonusWallets ?? [])
+            .filter((wallet) => Number.parseFloat(wallet.balance) > 0)
+            .map((wallet) => ({ currency: wallet.currency, balance: wallet.balance, bonus: true })),
     ];
     return wallets.length === 0 ? undefined : wallets;
 }
@@ -192,7 +195,7 @@ export function formatReset(at, now) {
  * @param props - injected RPC caller, copy, and the session's provider reader.
  * @returns the chip, or null when there is nothing true to say.
  */
-export function UsageChip({ call, t, isOwnProvider, accountBalance, ccSwitchBalance, ccSwitchCredentialRef, useProjection }) {
+export function UsageChip({ call, t, isOwnProvider, accountBalance, ccSwitchBalance, useProjection }) {
     const [reading, setReading] = useState(undefined);
     const [balance, setBalance] = useState(undefined);
     const [ccBalance, setCcBalance] = useState(undefined);
@@ -204,28 +207,24 @@ export function UsageChip({ call, t, isOwnProvider, accountBalance, ccSwitchBala
     // A projection read, so the chip follows the picker: changing the model re-renders it
     // with the new provider instead of waiting for the next unrelated render.
     const selected = useProjection('modelSelection', (value) => providerOf(value));
-    // The DeepSeek account is not one of this plugin's routes, but the host owns its grant
-    // and the balance endpoint, so the chip shows its balance rather than staying silent.
-    // An own route takes the balance read over nothing.
+    // A non-subscription provider has no usage windows to meter, so the chip shows its
+    // balance instead, read by cc-switch's query. The host's account (deepseek-account)
+    // has its own balance source and takes that over cc-switch; a subscription this plugin
+    // serves keeps its usage meter.
     const isDeepSeek = selected === 'deepseek-account';
-    // A manually added provider reads its balance by cc-switch's query, which needs the
-    // provider's API key. The provider's profile names that key by reference, and this map
-    // is the one place a provider id is tied to the reference; a provider with no entry,
-    // or one whose key does not resolve, gets no balance.
-    const ccRef = selected === undefined || isOwnProvider(selected) || isDeepSeek
-        ? undefined
-        : ccSwitchCredentialRef(selected);
-    // Read a manually added provider's balance while it is in force, on the same cadence as
-    // the other reads. It resolves to undefined when there is no key or the provider did
-    // not answer, which leaves the chip silent.
+    const isBalanceProvider = selected !== undefined && !isOwnProvider(selected) && !isDeepSeek;
+    // Read a non-subscription provider's balance while it is in force, on the same cadence
+    // as the other reads. It resolves to undefined when the provider has no balance source
+    // or did not answer, which leaves the chip silent.
     useEffect(() => {
-        if (ccRef === undefined) {
+        if (!isBalanceProvider || selected === undefined) {
             setCcBalance(undefined);
             return;
         }
         let live = true;
+        const target = selected;
         const refresh = () => {
-            void ccSwitchBalance(ccRef)
+            void ccSwitchBalance(target)
                 .then((value) => { if (live)
                 setCcBalance(value === undefined ? undefined : { currency: value.currency, total: value.total }); })
                 .catch(() => { });
@@ -236,7 +235,7 @@ export function UsageChip({ call, t, isOwnProvider, accountBalance, ccSwitchBala
             live = false;
             clearInterval(timer);
         };
-    }, [ccRef, ccSwitchBalance]);
+    }, [isBalanceProvider, selected, ccSwitchBalance]);
     const load = useCallback(async (target) => {
         try {
             const result = await call('usage', { provider: target });
@@ -305,10 +304,10 @@ export function UsageChip({ call, t, isOwnProvider, accountBalance, ccSwitchBala
         document.addEventListener('click', close);
         return () => { document.removeEventListener('click', close); };
     }, [open]);
-    // A manually added provider reads as money too, through cc-switch's query. It shows
-    // the one currency's total the provider answered with, nothing when there is no usable
+    // A non-subscription provider reads as money, through cc-switch's query. It shows the
+    // one currency's total the provider answered with, nothing when there is no usable
     // balance.
-    if (ccRef !== undefined) {
+    if (isBalanceProvider) {
         if (ccBalance === undefined)
             return null;
         const short = shortLabel(selected ?? '', selected ?? '');

package/lib/client/index.js

@@ -31,19 +31,6 @@ const SECTION_ORDER = 92;
  * chip follows them rather than displacing them.
  */
 const CHIP_ORDER = 10;
-/**
- * The credential reference a manually added provider's balance query uses, by provider
- * id.
- *
- * A manually added provider is not one this plugin serves, so the only way to read its
- * balance is cc-switch's query, which needs the provider's API key. The provider's
- * profile names that key by reference (`apiKeyEnv`), and the host's credential service
- * resolves the name; this map is the one place a provider id is tied to that name. A
- * provider with no entry gets no balance.
- */
-const CC_SWITCH_CREDENTIAL_REFS = {
-    huanling: 'HUANLING_API_KEY',
-};
 /**
  * Required services: `slots` carries the registration seat, `connection` the
  * RPC caller, and `locale` the copy dictionaries.
@@ -86,7 +73,6 @@ export function apply(ctx) {
             isOwnProvider: (provider) => OWN_PROVIDER_IDS.has(provider),
             accountBalance: createAccountBalanceCall(connection.rpc),
             ccSwitchBalance: createCcSwitchBalanceCall(connection.rpc),
-            ccSwitchCredentialRef: (provider) => CC_SWITCH_CREDENTIAL_REFS[provider],
         }),
     }, UsageChip));
 }

package/lib/client/subscriptions-rpc.d.ts

@@ -16,9 +16,9 @@ export declare class SubscriptionsRpcError extends Error {
 }
 /** Call one endpoint, unwrapping the transport result. */
 export type SubscriptionsCall = <K extends RpcEndpoint>(endpoint: K, payload: RpcMap[K]['payload']) => Promise<RpcMap[K]['value']>;
-/** A caller for one manually added provider's cc-switch balance. */
+/** A caller for one non-subscription provider's cc-switch balance. */
 export interface CcSwitchBalanceCall {
-    (credentialRef: string): Promise<CcSwitchBalanceResult>;
+    (provider: string): Promise<CcSwitchBalanceResult>;
 }
 /**
  * Bind a caller to one connection's RPC transport.
@@ -27,50 +27,51 @@ export interface CcSwitchBalanceCall {
  */
 export declare function createSubscriptionsCall(rpc: ConnectionHandle['rpc']): SubscriptionsCall;
 /**
- * The DeepSeek account's wallet balances, as the host's account controller reports them.
+ * The DeepSeek account's balance, as the plugin's node half reports it.
  *
- * The controller answers `null` when the account is signed out, `{ status: 'failed' }`
- * when the read did not complete, and `{ status: 'ready', value: <normal wallets>,
- * bonusWallets: <bonus wallets> }` on success.
+ * The node half reads the host's `deepseekAccount` service (which owns the OAuth grant
+ * and the platform endpoint) and serves the wallets here. It answers `undefined` when
+ * the account is signed out or the read failed, so a chip simply does not render.
  */
-export interface HostAccountBalance {
+export interface AccountBalance {
     /** Normal (topped-up) wallets, one per currency. */
-    value: readonly {
+    wallets: readonly {
         currency: string;
         balance: string;
     }[];
     /** Bonus / promotional wallets, one per currency. */
-    bonusWallets?: readonly {
+    bonusWallets: readonly {
         currency: string;
         balance: string;
     }[];
 }
-/** A narrow caller for the host's own account controller. */
+/** A narrow caller for the DeepSeek account's balance. */
 export interface AccountBalanceCall {
-    (): Promise<HostAccountBalance | {
-        status: 'failed';
-    } | null>;
+    (): Promise<AccountBalance | undefined>;
 }
 /**
- * Read the DeepSeek account's balance through the host's own account controller.
+ * Read the DeepSeek account's balance through the plugin's own RPC.
  *
- * The host owns the DeepSeek OAuth grant and the platform endpoint, so this asks it
- * rather than re-deriving either. It returns `null` when the account is signed out or
- * the read fails, so a chip can simply not render in that case.
+ * The browser cannot call the host's account service directly — it sits behind the
+ * host's Remote controller, not a `/api` fetch route — so the node half reads it and
+ * serves it on the plugin's channel, the same one the rest of the chip's data travels.
  *
  * @param rpc - the browser connection's RPC caller.
- * @returns the balance, or null when there is nothing to show.
+ * @returns the balance, or undefined when there is nothing to show.
  */
 export declare function createAccountBalanceCall(rpc: ConnectionHandle['rpc']): AccountBalanceCall;
 /**
  * Read a manually added provider's balance through the plugin's cc-switch endpoint.
  *
  * The caller names the credential reference the provider's profile uses (its
- * `apiKeyEnv`), and the host's credential service resolves it to the API key. The result
+ * Read a non-subscription provider's balance through the plugin's cc-switch endpoint.
+ *
+ * The caller names the provider; the server maps it to the credential reference the
+ * provider's profile names (`apiKeyEnv`) and resolves that to the API key. The result
  * is `undefined` when there is no key or the provider did not answer — never a wrong
  * figure.
  *
  * @param rpc - the browser connection's RPC caller.
- * @returns a narrow caller taking the credential reference.
+ * @returns a narrow caller taking the provider id.
  */
 export declare function createCcSwitchBalanceCall(rpc: ConnectionHandle['rpc']): CcSwitchBalanceCall;