dsh-plugin-subscription-oauth 0.6.1 → 0.7.0

package/lib/auth/ccswitch.d.ts

@@ -24,13 +24,38 @@ export interface CcSwitchBalance {
     /** Whether the account reports itself as usable. */
     available: boolean;
 }
+/**
+ * Query the balance endpoint some OpenAI-compatible providers expose at `{base}/v1/usage`.
+ *
+ * huanling is one: it answers `GET {base}/v1/usage` with `{ remaining, unit, … }`, which is
+ * the figure cc-switch shows for it. This is the provider's own shape, not cc-switch's
+ * `balance_infos`, so it is read separately. The base has any trailing `/v1` stripped before
+ * the path is added, so both `https://api.huanling.icu` and `https://api.huanling.icu/v1`
+ * resolve to the same `{base}/v1/usage`.
+ *
+ * @param input - the provider's API key and base URL.
+ * @returns the balance, or undefined when the provider did not answer with one.
+ */
+export declare function queryUsageBalance(input: {
+    apiKey: string;
+    baseUrl: string;
+    fetchFn?: FetchFn;
+}): Promise<CcSwitchBalance | undefined>;
 /**
  * Query one provider's balance the way cc-switch does.
  *
- * @param input - the provider's API key, and optionally a fetch to substitute in tests.
+ * cc-switch reads a DeepSeek-compatible provider's balance with `GET <base>/user/balance`
+ * and a bearer API key. For the official DeepSeek that base is `api.deepseek.com`, so the
+ * path is effectively hardcoded there; for a provider the user added through a custom
+ * endpoint (like huanling), the same path is read against that provider's own base URL,
+ * which is the only place its balance can live.
+ *
+ * @param input - the provider's API key and base URL.
  * @returns the balance, or undefined when the provider did not answer with one.
  */
 export declare function queryCcSwitchBalance(input: {
     apiKey: string;
+    /** The provider's own base URL; `https://api.deepseek.com` for the official one. */
+    baseUrl: string;
     fetchFn?: FetchFn;
 }): Promise<CcSwitchBalance | undefined>;

package/lib/auth/ccswitch.js

@@ -23,18 +23,75 @@ function num(value) {
         return value.trim();
     return undefined;
 }
+/**
+ * Query the balance endpoint some OpenAI-compatible providers expose at `{base}/v1/usage`.
+ *
+ * huanling is one: it answers `GET {base}/v1/usage` with `{ remaining, unit, … }`, which is
+ * the figure cc-switch shows for it. This is the provider's own shape, not cc-switch's
+ * `balance_infos`, so it is read separately. The base has any trailing `/v1` stripped before
+ * the path is added, so both `https://api.huanling.icu` and `https://api.huanling.icu/v1`
+ * resolve to the same `{base}/v1/usage`.
+ *
+ * @param input - the provider's API key and base URL.
+ * @returns the balance, or undefined when the provider did not answer with one.
+ */
+export async function queryUsageBalance(input) {
+    const fetchFn = input.fetchFn ?? proxiedFetch;
+    const base = input.baseUrl.replace(/\/+$/, '').replace(/\/v1$/i, '');
+    const url = `${base}/v1/usage`;
+    let response;
+    try {
+        response = await fetchFn(url, {
+            headers: { authorization: `Bearer ${input.apiKey}`, accept: 'application/json' },
+            signal: AbortSignal.timeout(15_000),
+        });
+    }
+    catch {
+        return undefined;
+    }
+    if (!response.ok)
+        return undefined;
+    let payload;
+    try {
+        payload = await response.json();
+    }
+    catch {
+        return undefined;
+    }
+    if (typeof payload !== 'object' || payload === null)
+        return undefined;
+    const record = payload;
+    const total = num(record.remaining);
+    if (total === undefined)
+        return undefined;
+    const currency = typeof record.unit === 'string' && record.unit.trim() !== '' ? record.unit.trim() : 'USD';
+    return {
+        currency,
+        total,
+        available: record.isValid !== false && record.is_active !== false,
+    };
+}
 /**
  * Query one provider's balance the way cc-switch does.
  *
- * @param input - the provider's API key, and optionally a fetch to substitute in tests.
+ * cc-switch reads a DeepSeek-compatible provider's balance with `GET <base>/user/balance`
+ * and a bearer API key. For the official DeepSeek that base is `api.deepseek.com`, so the
+ * path is effectively hardcoded there; for a provider the user added through a custom
+ * endpoint (like huanling), the same path is read against that provider's own base URL,
+ * which is the only place its balance can live.
+ *
+ * @param input - the provider's API key and base URL.
  * @returns the balance, or undefined when the provider did not answer with one.
  */
 export async function queryCcSwitchBalance(input) {
     const fetchFn = input.fetchFn ?? proxiedFetch;
+    // Resolve `<base>/user/balance` without doubling or dropping the path: a base that
+    // already ends in `/v1` keeps it, since that is the path the OpenAI-compatible wire
+    // uses and the balance endpoint lives beside it.
+    const url = `${input.baseUrl.replace(/\/+$/, '')}/user/balance`;
     let response;
     try {
-        // cc-switch's exact request shape: hardcoded URL, bearer auth, 15 s timeout.
-        response = await fetchFn('https://api.deepseek.com/user/balance', {
+        response = await fetchFn(url, {
             headers: { authorization: `Bearer ${input.apiKey}`, accept: 'application/json' },
             signal: AbortSignal.timeout(15_000),
         });

package/lib/auth/rpc.d.ts

@@ -16,6 +16,8 @@ export type CredentialResolver = (ref: string) => Promise<string | undefined>;
 export interface BalanceContext {
     /** The credential reference each provider id's balance query uses. */
     readonly credentialRefs: Readonly<Record<string, string>>;
+    /** The base URL each provider id's balance query reads, when it is not DeepSeek's own. */
+    readonly baseUrls: Readonly<Record<string, string>>;
     /** Resolve one credential reference to its key. */
     readonly resolveCredential?: CredentialResolver;
     /**

package/lib/auth/rpc.js

@@ -1,5 +1,5 @@
 import { BAD_REQUEST, ProviderError } from '../errors.js';
-import { queryCcSwitchBalance } from './ccswitch.js';
+import { queryCcSwitchBalance, queryUsageBalance } from './ccswitch.js';
 import { readDeepSeekBalance } from './deepseek-balance.js';
 import { RPC_ENDPOINTS, RPC_PREFIX } from '../protocol.js';
 /** Wrap a value as a successful envelope result. */
@@ -165,11 +165,12 @@ async function runEndpoint(registry, endpoint, payload, balance) {
             return await readDeepSeekBalance(balance?.resolveDeepSeekAccount?.(), client);
         }
         case 'ccswitch-balance': {
-            // A non-subscription provider's balance, by cc-switch's query. The caller names
-            // the provider; the configured map turns that into the credential reference the
-            // provider's profile uses, and the host's credential service resolves it. No
-            // entry, no key, or a key the provider does not answer for means no balance —
-            // never a fabricated zero.
+            // A non-subscription provider's balance, by cc-switch's query against the provider's
+            // own base URL. The caller names the provider; the configured map turns that into
+            // the credential reference the provider's profile uses and the base URL that profile
+            // connects to, and the host's credential service resolves the reference. No entry,
+            // no key, or a key the provider does not answer for means no balance — never a
+            // fabricated zero.
             const provider = requiredProvider(payload, endpoint);
             const credentialRef = balance?.credentialRefs[provider];
             if (credentialRef === undefined || balance?.resolveCredential === undefined)
@@ -177,7 +178,12 @@ async function runEndpoint(registry, endpoint, payload, balance) {
             const apiKey = await balance.resolveCredential(credentialRef);
             if (apiKey === undefined)
                 return undefined;
-            return await queryCcSwitchBalance({ apiKey });
+            const baseUrl = balance?.baseUrls[provider] ?? 'https://api.deepseek.com';
+            // A provider that answers the OpenAI-compatible `/v1/usage` (the shape cc-switch's
+            // custom template reads, `{ remaining, unit }`) is asked that first; one that
+            // answers the DeepSeek `balance_infos` shape is asked that as a fallback.
+            return await queryUsageBalance({ apiKey, baseUrl })
+                ?? await queryCcSwitchBalance({ apiKey, baseUrl });
         }
         case 'reload':
             return registry.reload();

package/lib/index.d.ts

@@ -45,16 +45,22 @@ export interface Config {
      */
     auto?: boolean;
     /**
-     * The credential reference a non-subscription provider's balance query uses, by
-     * provider id.
+     * The balance source a non-subscription provider uses, by provider id.
      *
      * A provider that is not a subscription this plugin serves has no usage windows to
      * meter, so the chip shows its balance instead — read by cc-switch's query, which needs
-     * the provider's API key. The provider's profile names that key by reference
-     * (`apiKeyEnv`), and the host's credential service resolves the name; this map is the
-     * one place a provider id is tied to that reference. A provider with no entry, or
-     * whose key does not resolve, gets no balance and the chip stays silent.
+     * the provider's API key and its own base URL (the balance endpoint lives beside the
+     * provider's OpenAI-compatible wire, not on DeepSeek's). Each entry names the
+     * credential reference the provider's profile uses (`apiKeyEnv`) and the base URL that
+     * profile connects to; the host's credential service resolves the reference. A provider
+     * with no entry, or whose key does not resolve, gets no balance and the chip stays
+     * silent.
      */
+    balanceSources?: Record<string, {
+        credentialRef: string;
+        baseUrl: string;
+    }>;
+    /** @deprecated Use {@link balanceSources}, which carries the base URL too. */
     balanceCredentialRefs?: Record<string, string>;
 }
 /** Configuration schema, with the config file's own defaults applied. */

package/lib/index.js

@@ -42,6 +42,8 @@ export const Config = z.object({
     defaultModel: z.string().default(KIMI_DEFAULT_MODEL),
     extraModels: z.array(z.string()).default([]),
     auto: z.boolean().default(true),
+    balanceSources: z.dict(z.object({ credentialRef: z.string(), baseUrl: z.string() })).default({}),
+    balanceCredentialRefs: z.dict(z.string()).default({}),
 });
 /**
  * Register every configured provider route, its credential store, and — when
@@ -188,13 +190,18 @@ export function apply(ctx, config = {}) {
         handles.set(route.id, handle);
         ctx.effect(() => () => handle(), `${name}: ${route.id} provider route`);
     }
-    // A non-subscription provider's balance is read by cc-switch's query, which needs the
-    // provider's API key. The provider's profile names that key by reference (`apiKeyEnv`),
-    // and the configured map ties a provider id to that reference; the host's credential
-    // service resolves it. The map lives in server config because that is where the rest
-    // of the plugin's wiring is, and the client learns a provider's balance by id, never
-    // by its credential reference.
-    const credentialRefs = config.balanceCredentialRefs ?? {};
+    // A non-subscription provider's balance is read by cc-switch's query against the
+    // provider's own base URL (the balance endpoint lives beside its OpenAI-compatible
+    // wire, not on DeepSeek's), which needs the provider's API key. Each configured source
+    // names the credential reference the provider's profile uses (`apiKeyEnv`) and the base
+    // URL that profile connects to; the host's credential service resolves the reference.
+    const balanceSources = config.balanceSources ?? {};
+    const credentialRefs = { ...config.balanceCredentialRefs };
+    const baseUrls = {};
+    for (const [provider, source] of Object.entries(balanceSources)) {
+        credentialRefs[provider] = source.credentialRef;
+        baseUrls[provider] = source.baseUrl;
+    }
     // The DeepSeek account's balance is read on the node half through the host's
     // `deepseekAccount` service; the browser reaches it through the plugin's own RPC, the
     // same channel as the rest of the chip's data. The service is read lazily, per request
@@ -202,6 +209,7 @@ export function apply(ctx, config = {}) {
     // without it still serves every other endpoint, and the balance endpoint answers nothing.
     const balanceContext = {
         credentialRefs,
+        baseUrls,
         resolveDeepSeekAccount: () => {
             try {
                 return ctx.get('deepseekAccount');
@@ -213,7 +221,20 @@ export function apply(ctx, config = {}) {
         resolveCredential: async (ref) => {
             try {
                 const credentials = ctx.get('credentials');
-                return (await credentials?.resolve?.(ref))?.value;
+                const hit = await credentials?.resolve?.(ref);
+                // The resolve answer is `{ value, source }`; an env-var source may name the var
+                // rather than carry the value, so both are considered before giving up.
+                if (typeof hit === 'object' && hit !== null) {
+                    const record = hit;
+                    if (typeof record.value === 'string' && record.value.trim() !== '')
+                        return record.value;
+                    if (typeof record.source === 'string') {
+                        const fromEnv = process.env[record.source];
+                        if (typeof fromEnv === 'string' && fromEnv.trim() !== '')
+                            return fromEnv;
+                    }
+                }
+                return undefined;
             }
             catch {
                 return undefined;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-plugin-subscription-oauth",
-  "version": "0.6.1",
+  "version": "0.7.0",
   "description": "Use subscription accounts as DeepSeek Harness LLM providers — Kimi Code (OAuth device flow), Grok / X Premium (OIDC + PKCE), Google Antigravity (Google OAuth + Cloud Code Assist) and GLM / BigModel (ZCode's browser sign-in) — with per-model visibility, drag-to-reorder Auto fallback and plan quotas from the web Settings page",
   "license": "MIT",
   "author": "EricFL1998",