@agentproto/auth 1.1.1 → 1.2.0

package/README.md

@@ -137,12 +137,16 @@ are Zod-validated at the boundary rather than trusted.
 
 ## Token storage
 
-`token-store.ts` wraps the macOS `security` CLI and **guards the platform** —
-`readKeychainToken` / `writeKeychainToken` throw a clear error on non-macOS hosts
-rather than silently returning `undefined` (which would re-prompt every run).
-Swap this module for libsecret (Linux) / Credential Manager (Windows) to run
-elsewhere. `resolveAccount(account, server)` expands the `{server}` template in a
-`tokenStore.account` spec.
+`token-store.ts` is the platform switch and **guards the platform** —
+`readKeychainToken` / `writeKeychainToken` throw a clear error where no backend
+exists rather than silently returning `undefined` (which would re-prompt every
+run). macOS wraps the `security` CLI; Windows (recap D7) seals one
+DPAPI-protected file per slot under `~/.agentproto/keychain-dpapi/` via .NET
+`ProtectedData` at `CurrentUser` scope through PowerShell — per-user
+encryption, zero npm dependencies, and nothing beyond stock Windows
+(Get-StoredCredential is NOT required). Linux is still unimplemented;
+libsecret would be the equivalent there. `resolveAccount(account, server)`
+expands the `{server}` template in a `tokenStore.account` spec.
 
 ## Credential store
 
@@ -229,6 +233,47 @@ exposure and have `resolveMcpHeaderExposure(exposure, broker)` lay brokered
 headers onto the transport. `secrets` keeps **zero dependency** on `auth`
 through that structural seam. See `@agentproto/secrets`' README.
 
+## Sub-accounts
+
+An *account* (a login or billing identity) can have *sub-accounts* — orgs,
+workspaces, projects — each with its own quota. A profile pins one with the
+optional `subaccount` field, so every pin is a distinct, truthful wallet:
+
+```jsonc
+{ "id": "acme-ws01", "endpoint": "<endpoint>", "method": "api-key",
+  "source": "<account-source>", "subaccount": { "kind": "org", "id": "org_01ABC", "name": "Ws01" } }
+```
+
+`kind` is `[a-z][a-z0-9-]*`; `id` is opaque; `name` is a display label used in
+usage-limit tags. The field is optional and the on-disk store format is
+unchanged. CLI: `agentproto auth profile create <id> --subaccount <kind>:<id>`
+and `agentproto auth subaccounts list <profile|account> [--create [--prefix]]`.
+
+How a pin is *applied* belongs to a provider, never to this package or the
+runtime. A provider implements `SubaccountProvider` and is added with
+`registerSubaccountProvider`:
+
+| Member | Purpose |
+| --- | --- |
+| `id`, `source?`, `endpoints?`, `kinds` | identity, and which accounts it owns (by `source` name, else by endpoint) |
+| `list(account)` | discovery: `{ account, subaccounts: [{kind, id, name}] }` |
+| `resolve(profile, { credential? })` | spawn time: `{ credential?, credentialEnvOverride?, env?, isolateDataHome? }` |
+| `migrateLegacySource?(source)` | read-time migration of a pre-pin provider-encoded `source` into the pin |
+
+A provider throws `SubaccountError` when a pin cannot be listed or resolved; the
+runtime fails the spawn loudly rather than falling back to the account's default
+scope. Providers ship with their adapter and the host registers them (the CLI
+does so for the built-ins).
+
+The registry is process-global and starts EMPTY: a host that uses
+`@agentproto/auth` outside the CLI must call `registerSubaccountProvider` for
+each provider it needs BEFORE creating, reading or spawning pinned profiles.
+Until then, creating a profile with a legacy `opencode-console:<orgId>` source is
+rejected, and a spawn on a pinned profile whose provider is not registered fails
+with `auth_source_unresolved` (it never runs on the account's default scope). A
+pin on a credential-backed profile is accepted at create time even when no
+provider owns its endpoint yet; the clear error comes at spawn time.
+
 ## API surface
 
 | Export | Purpose |
@@ -245,6 +290,8 @@ through that structural seam. See `@agentproto/secrets`' README.
 | `KeychainStore` / `MemoryStore` / `FileStore` / `resolveStoreRef` | built-in backends + ref resolver |
 | `readKeychainToken` / `writeKeychainToken` / `resolveAccount` | Keychain helpers |
 | `guildeAuthProvider` / `BUILTIN_AUTH_PROVIDERS` | shipped builtins |
+| `registerSubaccountProvider` / `findSubaccountProvider` / `listSubaccountProviders` | sub-account provider registry |
+| `SubaccountProvider` / `SubaccountPin` / `SubaccountError` / `parseSubaccountPin` | sub-account contract |
 
 ## License
 

package/dist/index.d.ts

@@ -431,19 +431,23 @@ declare class CeremonyRequiredError extends Error {
 }
 
 /**
- * Keychain helpers — read/write a token in the platform Keychain.
+ * Keychain helpers — read/write a token in the platform key store.
  *
- * Uses the macOS `security` CLI. On non-macOS hosts, callers should swap this
- * module for a platform-appropriate equivalent (libsecret on Linux, Credential
- * Manager on Windows).
+ * Platform switch:
+ * - macOS → the `security` CLI.
+ * - Windows → a DPAPI-protected file per slot (`win-token-store.ts`, .NET
+ *   `ProtectedData` at `CurrentUser` scope via PowerShell; per-user
+ *   encryption, no PowerShell `Get-StoredCredential` module needed).
+ * - Anything else (Linux) → still unsupported; libsecret would be the
+ *   equivalent to bring next.
  */
 /** Substitute `{server}` template in a tokenStore account spec. */
 declare function resolveAccount(account: string | undefined, server: string): string;
-/** Read a token from the Keychain. Returns undefined if not found. */
+/** Read a token from the platform key store. Returns undefined if not found. */
 declare function readKeychainToken(service: string, account: string): Promise<string | undefined>;
-/** Write a token to the Keychain (-U updates in place). */
+/** Write a token to the platform key store (upsert). */
 declare function writeKeychainToken(service: string, account: string, token: string): Promise<void>;
-/** Remove a token from the Keychain. Returns true if an entry was deleted,
+/** Remove a token from the platform key store. Returns true if an entry was deleted,
  *  false when none existed (a delete of an absent entry is not an error —
  *  the desired end state, "no credential at this slot", already holds). */
 declare function deleteKeychainToken(service: string, account: string): Promise<boolean>;
@@ -451,9 +455,10 @@ declare function deleteKeychainToken(service: string, account: string): Promise<
 /**
  * KeychainStore — `CredentialStore` backed by the platform Keychain.
  *
- * Wraps the low-level `token-store.ts` helpers (macOS `security` CLI today).
- * The Keychain only holds one opaque string per entry, so `kind`/`expiresAt`/
- * `metadata` are packed into a small JSON envelope that IS that string.
+ * Wraps the low-level `token-store.ts` helpers (macOS `security` CLI; a
+ * DPAPI-protected file per slot on Windows). The key store only holds one
+ * opaque string per entry, so `kind`/`expiresAt`/`metadata` are packed
+ * into a small JSON envelope that IS that string.
  *
  * Back-compat: an entry written before this store existed (or by any other
  * tool) is a bare token string, not an envelope. `read` falls back to
@@ -604,6 +609,15 @@ interface CostBudget {
     /** Which spend surface the window is summed over. See {@link CostBudgetScope}. */
     scope: CostBudgetScope;
 }
+/** A pinned sub-account of the profile's account: `kind` is free-form (`org`,
+ *  `workspace`, `project`, …) and only meaningful to the provider that owns the
+ *  account (see `subaccounts.ts`). */
+interface SubaccountPin {
+    kind: string;
+    id: string;
+    /** Human-readable name captured at discovery time; informational only. */
+    name?: string;
+}
 /** A named, billing-endpoint-scoped credential reference. */
 interface AuthProfile {
     /** Stable id, unique across all profiles (the `profileRef` a session
@@ -630,6 +644,13 @@ interface AuthProfile {
      *  fresh at spawn time instead. Mutually exclusive with
      *  {@link credentialRef}. */
     source?: string;
+    /** Pins one SUB-ACCOUNT (org / workspace / project / team) of the account this
+     *  profile authenticates as — the account being the {@link credentialRef}'d
+     *  secret or the {@link source}. Each pin is its own wallet; how it is
+     *  applied at spawn is the registered provider's business (`subaccounts.ts`).
+     *  ABSENT ⇒ the account's default scope, byte-identical to a profile that
+     *  predates this field. */
+    subaccount?: SubaccountPin;
     /** Optional human-readable name ("Jeremy Max", "work OpenRouter"). */
     label?: string;
     /** Whole-profile enable/disable. ABSENT (or `false`) ⇒ enabled (today's
@@ -660,6 +681,114 @@ interface AuthProfile {
     origin?: string;
 }
 
+/**
+ * Sub-accounts: an ACCOUNT (a login / billing identity) can have SUB-ACCOUNTS
+ * (org, workspace, project, team) with their own quota and billing. A profile
+ * can pin one ({@link AuthProfile.subaccount}); each pin is a distinct,
+ * truthful wallet. HOW a pin is applied to a spawn — headers, an inline config
+ * block, a scoped token, an isolated data home — is the provider's business.
+ *
+ * This module is the generic seam: the pin type, the {@link SubaccountProvider}
+ * interface, and a process-wide registry. Nothing here (or in any core spawn
+ * path) names a vendor; providers live with their adapter and are registered by
+ * the host (the CLI registers the built-ins at start-up).
+ */
+
+/** Conservative charset for a pin's `kind` — it ends up in CLI args and logs. */
+declare const SUBACCOUNT_KIND_RE: RegExp;
+/** `"org:org_01ABC"` → `{ kind: "org", id: "org_01ABC" }`; split on the FIRST
+ *  colon so an id may itself contain colons. Returns undefined when malformed. */
+declare function parseSubaccountPin(spec: string): SubaccountPin | undefined;
+/** The parent account a provider lists sub-accounts of. */
+interface SubaccountAccountRef {
+    /** Billing endpoint the account authenticates against (`opencode-go`, …). */
+    endpoint: string;
+    /** Source-backed account (the account name a provider owns), no stored secret. */
+    source?: string;
+    /** Credential-backed account: the resolved secret. Never logged or returned. */
+    credential?: string;
+}
+interface DiscoveredSubaccount {
+    kind: string;
+    id: string;
+    name: string;
+}
+interface SubaccountListing {
+    account: {
+        id: string;
+        label?: string;
+    };
+    subaccounts: DiscoveredSubaccount[];
+}
+/** What a provider hands the spawn path for one pinned profile. */
+interface SubaccountResolution {
+    /** Credential to inject, when the provider resolves its own (a source-backed
+     *  account's scoped token). Omitted ⇒ the profile's stored credential stands. */
+    credential?: string;
+    /** Env var the credential is set into INSTEAD of the endpoint's conventional
+     *  key env (the conventional one is then scrubbed). */
+    credentialEnvOverride?: string;
+    /** Extra env set verbatim beside the credential. A value that is a JSON
+     *  object is deep-merged over a same-key value the spawn already carries
+     *  (e.g. a mode's inline config), never clobbering it. */
+    env?: Record<string, string>;
+    /** `false` opts out of the adapter's isolated, login-less data home for this
+     *  spawn; omitted ⇒ whatever the adapter declares applies. */
+    isolateDataHome?: boolean;
+}
+/** Raised by a provider when a sub-account cannot be listed or resolved. The
+ *  runtime maps it onto its own spawn-error codes; the message must never carry
+ *  a secret. */
+declare class SubaccountError extends Error {
+    constructor(message: string);
+}
+interface SubaccountProvider {
+    /** Registry key, unique per provider. */
+    id: string;
+    /** The `source` name that identifies this provider's source-backed accounts
+     *  (`AuthProfile.source`). */
+    source?: string;
+    /** Endpoints whose credential-backed profiles this provider serves. */
+    endpoints?: readonly string[];
+    /** Sub-account kinds this provider understands. */
+    kinds: readonly string[];
+    /** Endpoint a profile created from a discovered sub-account lands on. */
+    defaultEndpoint?: string;
+    /** Default id prefix for profiles created from a discovery (`<prefix>-<name>`). */
+    profilePrefix?: string;
+    /** Discovery: the sub-accounts of `account`. */
+    list(account: SubaccountAccountRef): Promise<SubaccountListing>;
+    /** Spawn-time: how the pinned `profile` is applied. `credential` is the
+     *  profile's stored credential when it has one. */
+    resolve(profile: AuthProfile & {
+        subaccount: SubaccountPin;
+    }, ctx: {
+        credential?: string;
+    }): Promise<SubaccountResolution>;
+    /** Migrate-on-read hook for a profile shape that predates generic pins: a
+     *  legacy `source` string → the account `source` + the pin it encoded. */
+    migrateLegacySource?(source: string): SubaccountPin | undefined;
+}
+/** Register (or replace, by `id`) a provider. Idempotent. */
+declare function registerSubaccountProvider(provider: SubaccountProvider): void;
+/** Remove a provider; returns whether it was registered. Mainly for tests. */
+declare function unregisterSubaccountProvider(id: string): boolean;
+declare function listSubaccountProviders(): SubaccountProvider[];
+declare function getSubaccountProvider(id: string): SubaccountProvider | undefined;
+/** The provider owning an account: by `source` name first, else by `endpoint`
+ *  for a credential-backed account. */
+declare function findSubaccountProvider(account: {
+    source?: string;
+    endpoint?: string;
+}): SubaccountProvider | undefined;
+/**
+ * Migrate-on-read: a profile that carries a legacy provider-encoded `source`
+ * (and no `subaccount`) is returned with the generic shape — `source` reduced
+ * to the account name, the encoded pin lifted into `subaccount`. Any other
+ * profile is returned as-is. Pure over the registry; never writes.
+ */
+declare function migrateLegacySubaccountProfile(profile: AuthProfile): AuthProfile;
+
 /**
  * Named auth-profile store — CRUD over `~/.agentproto/auth-profiles.json`
  * (mode 0600), generalizing `providers-store`'s single-key-per-provider file
@@ -687,6 +816,11 @@ declare const authProfilesFileSchema: z.ZodObject<{
         }>;
         credentialRef: z.ZodOptional<z.ZodString>;
         source: z.ZodOptional<z.ZodString>;
+        subaccount: z.ZodOptional<z.ZodObject<{
+            kind: z.ZodString;
+            id: z.ZodString;
+            name: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>;
         label: z.ZodOptional<z.ZodString>;
         disabled: z.ZodOptional<z.ZodBoolean>;
         models: z.ZodOptional<z.ZodObject<{
@@ -711,6 +845,11 @@ declare const authProfilesFileSchema: z.ZodObject<{
         method: "oauth-bearer" | "api-key";
         credentialRef?: string | undefined;
         source?: string | undefined;
+        subaccount?: {
+            kind: string;
+            id: string;
+            name?: string | undefined;
+        } | undefined;
         label?: string | undefined;
         disabled?: boolean | undefined;
         models?: {
@@ -761,9 +900,9 @@ declare function removeAuthProfile(id: string): Promise<boolean>;
 
 /** Input to {@link createAuthProfile}. `credential` is the raw secret — it is
  *  written to the store and NEVER returned. Exactly one of `credential` /
- *  `source` must be given for an `oauth-bearer` profile; `api-key` always
- *  requires `credential` (a source-backed profile only makes sense for a
- *  self-refreshing subscription bearer). */
+ *  `source` must be given for an `oauth-bearer` profile; `api-key` requires
+ *  `credential`, except for a `source` owned by a registered sub-account
+ *  provider (an account resolved at spawn, pinned to a `subaccount`). */
 interface CreateAuthProfileInput {
     /** Stable id, unique across all profiles. */
     id: string;
@@ -780,6 +919,9 @@ interface CreateAuthProfileInput {
      *  resolved fresh at spawn time instead. Mutually exclusive with
      *  `credential`. */
     source?: string;
+    /** Pin one sub-account (org / workspace / project) of the account — the
+     *  `credential` or the `source`. See `subaccounts.ts`. */
+    subaccount?: SubaccountPin;
     /** Optional human-readable name. */
     label?: string;
     /** Optional explicit credential-store slot. Omitted ⇒ derived from
@@ -801,6 +943,8 @@ interface CreatedAuthProfile {
     credentialRef?: string;
     /** Set for a source-backed profile; absent for a credential-backed one. */
     source?: string;
+    /** The pinned sub-account, when the profile has one. */
+    subaccount?: SubaccountPin;
     label?: string;
     /** Provenance stamped at import time, when given. */
     origin?: string;
@@ -840,6 +984,7 @@ interface ValidatedCreateInput {
     method: AuthMethod;
     credential?: string;
     source?: string;
+    subaccount?: SubaccountPin;
     label?: string;
     credentialRef?: string;
     origin?: string;
@@ -1092,4 +1237,4 @@ declare const BUILTIN_AUTH_PROVIDERS: readonly AuthProviderHandle[];
 declare const SPEC_NAME = "agentauth";
 declare const SPEC_VERSION = "v1";
 
-export { type AdapterAuthManifest, type AuthConfig, type AuthMethod, type AuthProfile, AuthProfileValidationError, type AuthProfilesFile, type AuthProviderDefinition, type AuthProviderFrontmatter, type AuthProviderHandle, type AuthProviderManifest, BUILTIN_AUTH_PROVIDERS, CeremonyRequiredError, type CostBudget, type CostBudgetScope, type CreateAuthProfileInput, type CreatedAuthProfile, CredentialBroker, type CredentialBrokerOptions, type CredentialIdentity, type CredentialStore, type DeletedAuthProfile, type DeviceCodeAuthConfig, type DiscoveredEndpoints, DiscoveryError, FLOW_ENGINES, FileStore, type FlowEngine, type FlowId, type FlowResult, type FlowRunOptions, type InstallConfig, KeychainStore, MemoryStore, type ModelCuration, type PATAuthConfig, type ProfileProvisionDeps, type RefreshAuthProfileModelsResult, type RunFlowOptions, SPEC_NAME, SPEC_VERSION, type ServiceAuthConfig, type StoreRef, type StoredCredential, type TokenStoreSpec, type UpdateAuthProfileInput, type ValidatedCreateInput, addAuthProfile, authConfigSchema, authProfilesPath, authProviderFrontmatterSchema, createAuthProfile, credentialIdentity, defineAuthProvider, deleteAuthProfile, deleteKeychainToken, deriveCredentialRef, discoverEndpoints, eligibleProfiles, fingerprintCredential, getAuthProfile, getAuthProvider, guildeAuthProvider, installConfigSchema, listAuthProfiles, listAuthProviderIds, listAuthProviders, loadAuthProfiles, methodsPresentable, parseAuthProviderManifest, parseAuthProviderManifestRaw, readKeychainToken, refreshAuthProfileModels, registerAuthProvider, removeAuthProfile, resolveAccount, resolveEndpoint, resolveStoreRef, runAuthFlow, setAuthProfileEnabled, setAuthProfileModels, tokenStoreSpecSchema, updateAuthProfile, validateCreateInput, writeKeychainToken };
+export { type AdapterAuthManifest, type AuthConfig, type AuthMethod, type AuthProfile, AuthProfileValidationError, type AuthProfilesFile, type AuthProviderDefinition, type AuthProviderFrontmatter, type AuthProviderHandle, type AuthProviderManifest, BUILTIN_AUTH_PROVIDERS, CeremonyRequiredError, type CostBudget, type CostBudgetScope, type CreateAuthProfileInput, type CreatedAuthProfile, CredentialBroker, type CredentialBrokerOptions, type CredentialIdentity, type CredentialStore, type DeletedAuthProfile, type DeviceCodeAuthConfig, type DiscoveredEndpoints, type DiscoveredSubaccount, DiscoveryError, FLOW_ENGINES, FileStore, type FlowEngine, type FlowId, type FlowResult, type FlowRunOptions, type InstallConfig, KeychainStore, MemoryStore, type ModelCuration, type PATAuthConfig, type ProfileProvisionDeps, type RefreshAuthProfileModelsResult, type RunFlowOptions, SPEC_NAME, SPEC_VERSION, SUBACCOUNT_KIND_RE, type ServiceAuthConfig, type StoreRef, type StoredCredential, type SubaccountAccountRef, SubaccountError, type SubaccountListing, type SubaccountPin, type SubaccountProvider, type SubaccountResolution, type TokenStoreSpec, type UpdateAuthProfileInput, type ValidatedCreateInput, addAuthProfile, authConfigSchema, authProfilesPath, authProviderFrontmatterSchema, createAuthProfile, credentialIdentity, defineAuthProvider, deleteAuthProfile, deleteKeychainToken, deriveCredentialRef, discoverEndpoints, eligibleProfiles, findSubaccountProvider, fingerprintCredential, getAuthProfile, getAuthProvider, getSubaccountProvider, guildeAuthProvider, installConfigSchema, listAuthProfiles, listAuthProviderIds, listAuthProviders, listSubaccountProviders, loadAuthProfiles, methodsPresentable, migrateLegacySubaccountProfile, parseAuthProviderManifest, parseAuthProviderManifestRaw, parseSubaccountPin, readKeychainToken, refreshAuthProfileModels, registerAuthProvider, registerSubaccountProvider, removeAuthProfile, resolveAccount, resolveEndpoint, resolveStoreRef, runAuthFlow, setAuthProfileEnabled, setAuthProfileModels, tokenStoreSpecSchema, unregisterSubaccountProvider, updateAuthProfile, validateCreateInput, writeKeychainToken };

package/dist/index.mjs

@@ -5,9 +5,9 @@ import { createInterface } from 'readline';
 import { execFile } from 'child_process';
 import { promisify } from 'util';
 import { createHash, createDecipheriv, randomBytes, createCipheriv } from 'crypto';
-import { readFile, mkdir, writeFile } from 'fs/promises';
-import { dirname, resolve, join } from 'path';
 import { homedir } from 'os';
+import { dirname, resolve, join } from 'path';
+import { readFile, mkdir, writeFile } from 'fs/promises';
 
 /**
  * @agentproto/auth v0.1.0-alpha
@@ -337,10 +337,72 @@ async function discoverEndpoints(apiBase, opts = {}) {
   }
 }
 var exec = promisify(execFile);
+function dpapiDir(deps) {
+  return join(homedir(), ".agentproto", "keychain-dpapi");
+}
+var FILE_HASH = (service, account) => createHash("sha256").update(`${service}\0${account}`).digest("hex").slice(0, 24);
+function dpapiFile(service, account, deps) {
+  const svc = service.replace(/[^\dA-Za-z._-]/g, "_");
+  const acct = account.replace(/[^\dA-Za-z._-]/g, "_");
+  return join(dpapiDir(), `${svc}__${acct}__${FILE_HASH(service, account)}.dpapi`);
+}
+async function runPowerShell(args, deps) {
+  return exec("powershell", args, { timeout: 15e3 });
+}
+var B64 = (s) => Buffer.from(s, "utf8").toString("base64");
+var DECODE = `$d={param($s)[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($s))};`;
+function buildDpapiWriteCommand(service, account, token, deps) {
+  const file = dpapiFile(service, account);
+  const script = `${DECODE}$ErrorActionPreference='Stop';$p=&$d('${B64(file)}');$raw=[Convert]::FromBase64String('${B64(token)}');Add-Type -AssemblyName System.Security;[IO.Directory]::CreateDirectory([IO.Path]::GetDirectoryName($p))|Out-Null;[IO.File]::WriteAllBytes($p, [Security.Cryptography.ProtectedData]::Protect($raw,$null,[Security.Cryptography.DataProtectionScope]::CurrentUser))`;
+  return { cmd: "powershell", args: ["-NoProfile", "-NonInteractive", "-Command", script] };
+}
+function buildDpapiReadCommand(service, account, deps) {
+  const file = dpapiFile(service, account);
+  const script = `${DECODE}$ErrorActionPreference='Stop';$p=&$d('${B64(file)}');Add-Type -AssemblyName System.Security;$enc=[IO.File]::ReadAllBytes($p);$raw=[Security.Cryptography.ProtectedData]::Unprotect($enc,$null,[Security.Cryptography.DataProtectionScope]::CurrentUser);[Console]::Out.Write([Text.Encoding]::UTF8.GetString($raw))`;
+  return { cmd: "powershell", args: ["-NoProfile", "-NonInteractive", "-Command", script] };
+}
+function buildDpapiDeleteCommand(service, account, deps) {
+  const file = dpapiFile(service, account);
+  const script = `${DECODE}$p=&$d('${B64(file)}');if(Test-Path -LiteralPath $p){Remove-Item -LiteralPath $p -Force;'1'}else{'0'}`;
+  return { cmd: "powershell", args: ["-NoProfile", "-NonInteractive", "-Command", script] };
+}
+function errMsg(err) {
+  const detail = typeof err === "object" && err !== null && "message" in err ? String(err.message) : String(err);
+  return detail.replace(/^Command failed: powershell.*?\n/, "").trim();
+}
+async function writeDpapiToken(service, account, token, deps) {
+  const { args } = buildDpapiWriteCommand(service, account, token);
+  try {
+    await runPowerShell(args, deps);
+  } catch (err) {
+    throw new Error(`agentproto auth: cannot write the Windows DPAPI credential store: ${errMsg(err)}`);
+  }
+}
+async function readDpapiToken(service, account, deps) {
+  const { args } = buildDpapiReadCommand(service, account);
+  try {
+    const { stdout } = await runPowerShell(args, deps);
+    return stdout.trimEnd() || void 0;
+  } catch {
+    return void 0;
+  }
+}
+async function deleteDpapiToken(service, account, deps) {
+  const { args } = buildDpapiDeleteCommand(service, account);
+  try {
+    const { stdout } = await runPowerShell(args, deps);
+    return stdout.trim() === "1";
+  } catch {
+    return false;
+  }
+}
+
+// src/token-store.ts
+var exec2 = promisify(execFile);
 function assertKeychainSupported() {
   if (process.platform !== "darwin") {
     throw new Error(
-      `@agentproto/auth token-store: the Keychain backend only supports macOS (got platform "${process.platform}"). Provide a libsecret (Linux) or Credential Manager (Windows) implementation to run here.`
+      `@agentproto/auth token-store: the Keychain backend only supports macOS and Windows (got platform "${process.platform}"). Provide a libsecret (Linux) implementation to run here.`
     );
   }
 }
@@ -349,9 +411,10 @@ function resolveAccount(account, server) {
   return account.replace("{server}", server);
 }
 async function readKeychainToken(service, account) {
+  if (process.platform === "win32") return readDpapiToken(service, account);
   assertKeychainSupported();
   try {
-    const { stdout } = await exec("security", [
+    const { stdout } = await exec2("security", [
       "find-generic-password",
       "-s",
       service,
@@ -366,8 +429,9 @@ async function readKeychainToken(service, account) {
   }
 }
 async function writeKeychainToken(service, account, token) {
+  if (process.platform === "win32") return writeDpapiToken(service, account, token);
   assertKeychainSupported();
-  await exec("security", [
+  await exec2("security", [
     "add-generic-password",
     "-U",
     "-s",
@@ -381,9 +445,10 @@ async function writeKeychainToken(service, account, token) {
   ]);
 }
 async function deleteKeychainToken(service, account) {
+  if (process.platform === "win32") return deleteDpapiToken(service, account);
   assertKeychainSupported();
   try {
-    await exec("security", [
+    await exec2("security", [
       "delete-generic-password",
       "-s",
       service,
@@ -1183,6 +1248,54 @@ var CredentialBroker = class {
     return headers;
   }
 };
+
+// src/subaccounts.ts
+var SUBACCOUNT_KIND_RE = /^[a-z][a-z0-9-]*$/;
+function parseSubaccountPin(spec) {
+  const at = spec.indexOf(":");
+  if (at <= 0) return void 0;
+  const kind = spec.slice(0, at).trim();
+  const id = spec.slice(at + 1).trim();
+  if (!SUBACCOUNT_KIND_RE.test(kind) || id === "") return void 0;
+  return { kind, id };
+}
+var SubaccountError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "SubaccountError";
+  }
+};
+var providers = /* @__PURE__ */ new Map();
+function registerSubaccountProvider(provider) {
+  providers.set(provider.id, provider);
+}
+function unregisterSubaccountProvider(id) {
+  return providers.delete(id);
+}
+function listSubaccountProviders() {
+  return [...providers.values()];
+}
+function getSubaccountProvider(id) {
+  return providers.get(id);
+}
+function findSubaccountProvider(account) {
+  const all = listSubaccountProviders();
+  if (account.source !== void 0) {
+    return all.find((p) => p.source === account.source) ?? all.find((p) => p.migrateLegacySource?.(account.source) !== void 0);
+  }
+  if (account.endpoint !== void 0) return all.find((p) => p.endpoints?.includes(account.endpoint));
+  return void 0;
+}
+function migrateLegacySubaccountProfile(profile) {
+  if (profile.subaccount !== void 0 || profile.source === void 0) return profile;
+  for (const provider of providers.values()) {
+    const pin = provider.migrateLegacySource?.(profile.source);
+    if (pin !== void 0 && provider.source !== void 0) {
+      return { ...profile, source: provider.source, subaccount: pin };
+    }
+  }
+  return profile;
+}
 var authMethodSchema = z.enum(["oauth-bearer", "api-key"]);
 var modelCurationSchema = z.object({
   mode: z.enum(["all", "allow"]),
@@ -1193,12 +1306,18 @@ var costBudgetSchema = z.object({
   window: z.string(),
   scope: z.enum(["session", "profile"])
 });
+var subaccountPinSchema = z.object({
+  kind: z.string(),
+  id: z.string(),
+  name: z.string().optional()
+});
 var authProfileSchema = z.object({
   id: z.string(),
   vendor: z.string(),
   method: authMethodSchema,
   credentialRef: z.string().optional(),
   source: z.string().optional(),
+  subaccount: subaccountPinSchema.optional(),
   label: z.string().optional(),
   // Additive, back-compat fields — an entry that predates them parses
   // unchanged (both optional), and `endpoint` still shadows the on-disk
@@ -1245,12 +1364,13 @@ async function writeAuthProfiles(file) {
 }
 async function listAuthProfiles(endpoint) {
   const file = await loadAuthProfiles();
-  const all = Object.values(file.profiles);
+  const all = Object.values(file.profiles).map(migrateLegacySubaccountProfile);
   return endpoint === void 0 ? all : all.filter((p) => p.endpoint === endpoint);
 }
 async function getAuthProfile(id) {
   const file = await loadAuthProfiles();
-  return file.profiles[id];
+  const profile = file.profiles[id];
+  return profile ? migrateLegacySubaccountProfile(profile) : void 0;
 }
 async function addAuthProfile(profile) {
   const file = await loadAuthProfiles();
@@ -1295,13 +1415,49 @@ function validateCreateInput(input) {
   }
   const credential = input.credential !== void 0 ? input.credential.trim() : void 0;
   const source = input.source?.trim();
-  if (method === "api-key") {
-    if (source) {
+  let subaccount;
+  if (input.subaccount !== void 0) {
+    const kind = (input.subaccount.kind ?? "").trim();
+    const subId = (input.subaccount.id ?? "").trim();
+    const subName = input.subaccount.name?.trim();
+    if (!SUBACCOUNT_KIND_RE.test(kind) || !subId) {
       throw new AuthProfileValidationError(
-        "source is only supported for oauth-bearer profiles \u2014 api-key profiles require a credential"
+        `subaccount must be "<kind>:<id>" with a lowercase kind (org, workspace, project, \u2026) and a non-empty id`
       );
     }
-    if (!credential) throw new AuthProfileValidationError("credential is required");
+    subaccount = { kind, id: subId, ...subName ? { name: subName } : {} };
+    if (!credential && !source) {
+      throw new AuthProfileValidationError(
+        "a subaccount pin needs a parent account \u2014 give a credential or a source"
+      );
+    }
+  }
+  const provider = source ? findSubaccountProvider({ source }) : void 0;
+  if (subaccount && provider && !provider.kinds.includes(subaccount.kind)) {
+    throw new AuthProfileValidationError(
+      `subaccount kind "${subaccount.kind}" is not supported by "${provider.id}" (supported: ${provider.kinds.join(", ")})`
+    );
+  }
+  if (method === "api-key") {
+    if (source) {
+      if (!provider) {
+        throw new AuthProfileValidationError(
+          `source is only supported for oauth-bearer profiles and for accounts owned by a registered sub-account provider \u2014 api-key profiles otherwise require a credential`
+        );
+      }
+      if (!subaccount && provider.migrateLegacySource?.(source) === void 0) {
+        throw new AuthProfileValidationError(
+          `source "${source}" resolves an account with sub-accounts \u2014 pin one with a subaccount ("<kind>:<id>")`
+        );
+      }
+      if (credential) {
+        throw new AuthProfileValidationError(
+          "give either credential or source, not both \u2014 a source-backed profile stores no secret"
+        );
+      }
+    } else if (!credential) {
+      throw new AuthProfileValidationError("credential is required");
+    }
   } else {
     if (credential && source) {
       throw new AuthProfileValidationError(
@@ -1326,6 +1482,7 @@ function validateCreateInput(input) {
     method,
     ...credential ? { credential } : {},
     ...source ? { source } : {},
+    ...subaccount ? { subaccount } : {},
     ...label ? { label } : {},
     ...credentialRef ? { credentialRef } : {},
     ...origin ? { origin } : {}
@@ -1358,20 +1515,22 @@ async function createAuthProfile(input, deps) {
     );
   }
   if (v.source !== void 0) {
-    const profile2 = {
+    const profile2 = migrateLegacySubaccountProfile({
       id: v.id,
       endpoint: v.endpoint,
       method: v.method,
       source: v.source,
+      ...v.subaccount ? { subaccount: v.subaccount } : {},
       ...v.label ? { label: v.label } : {},
       ...v.origin ? { origin: v.origin } : {}
-    };
+    });
     await deps.addProfile(profile2);
     return {
       id: profile2.id,
       endpoint: profile2.endpoint,
       method: profile2.method,
-      source: v.source,
+      source: profile2.source,
+      ...profile2.subaccount ? { subaccount: profile2.subaccount } : {},
       ...profile2.label ? { label: profile2.label } : {},
       ...profile2.origin ? { origin: profile2.origin } : {}
     };
@@ -1392,6 +1551,7 @@ async function createAuthProfile(input, deps) {
     endpoint: v.endpoint,
     method: v.method,
     credentialRef,
+    ...v.subaccount ? { subaccount: v.subaccount } : {},
     ...v.label ? { label: v.label } : {},
     ...v.origin ? { origin: v.origin } : {}
   };
@@ -1401,6 +1561,7 @@ async function createAuthProfile(input, deps) {
     endpoint: profile.endpoint,
     method: profile.method,
     credentialRef,
+    ...v.subaccount ? { subaccount: v.subaccount } : {},
     ...profile.label ? { label: profile.label } : {},
     ...profile.origin ? { origin: profile.origin } : {},
     fingerprint: fingerprintCredential(credential)
@@ -1561,6 +1722,6 @@ function eligibleProfiles(profiles, manifest, route) {
 var SPEC_NAME = "agentauth";
 var SPEC_VERSION = "v1";
 
-export { AuthProfileValidationError, BUILTIN_AUTH_PROVIDERS, CeremonyRequiredError, CredentialBroker, DiscoveryError, FLOW_ENGINES, FileStore, KeychainStore, MemoryStore, SPEC_NAME, SPEC_VERSION, addAuthProfile, authConfigSchema, authProfilesPath, authProviderFrontmatterSchema, createAuthProfile, credentialIdentity, defineAuthProvider, deleteAuthProfile, deleteKeychainToken, deriveCredentialRef, discoverEndpoints, eligibleProfiles, fingerprintCredential, getAuthProfile, getAuthProvider, guildeAuthProvider, installConfigSchema, listAuthProfiles, listAuthProviderIds, listAuthProviders, loadAuthProfiles, methodsPresentable, parseAuthProviderManifest, parseAuthProviderManifestRaw, readKeychainToken, refreshAuthProfileModels, registerAuthProvider, removeAuthProfile, resolveAccount, resolveEndpoint, resolveStoreRef, runAuthFlow, setAuthProfileEnabled, setAuthProfileModels, tokenStoreSpecSchema, updateAuthProfile, validateCreateInput, writeKeychainToken };
+export { AuthProfileValidationError, BUILTIN_AUTH_PROVIDERS, CeremonyRequiredError, CredentialBroker, DiscoveryError, FLOW_ENGINES, FileStore, KeychainStore, MemoryStore, SPEC_NAME, SPEC_VERSION, SUBACCOUNT_KIND_RE, SubaccountError, addAuthProfile, authConfigSchema, authProfilesPath, authProviderFrontmatterSchema, createAuthProfile, credentialIdentity, defineAuthProvider, deleteAuthProfile, deleteKeychainToken, deriveCredentialRef, discoverEndpoints, eligibleProfiles, findSubaccountProvider, fingerprintCredential, getAuthProfile, getAuthProvider, getSubaccountProvider, guildeAuthProvider, installConfigSchema, listAuthProfiles, listAuthProviderIds, listAuthProviders, listSubaccountProviders, loadAuthProfiles, methodsPresentable, migrateLegacySubaccountProfile, parseAuthProviderManifest, parseAuthProviderManifestRaw, parseSubaccountPin, readKeychainToken, refreshAuthProfileModels, registerAuthProvider, registerSubaccountProvider, removeAuthProfile, resolveAccount, resolveEndpoint, resolveStoreRef, runAuthFlow, setAuthProfileEnabled, setAuthProfileModels, tokenStoreSpecSchema, unregisterSubaccountProvider, updateAuthProfile, validateCreateInput, writeKeychainToken };
 //# sourceMappingURL=index.mjs.map
 //# sourceMappingURL=index.mjs.map