@agentproto/auth 1.1.2 → 1.2.0

package/README.md

@@ -233,6 +233,47 @@ exposure and have `resolveMcpHeaderExposure(exposure, broker)` lay brokered
 headers onto the transport. `secrets` keeps **zero dependency** on `auth`
 through that structural seam. See `@agentproto/secrets`' README.
 
+## Sub-accounts
+
+An *account* (a login or billing identity) can have *sub-accounts* — orgs,
+workspaces, projects — each with its own quota. A profile pins one with the
+optional `subaccount` field, so every pin is a distinct, truthful wallet:
+
+```jsonc
+{ "id": "acme-ws01", "endpoint": "<endpoint>", "method": "api-key",
+  "source": "<account-source>", "subaccount": { "kind": "org", "id": "org_01ABC", "name": "Ws01" } }
+```
+
+`kind` is `[a-z][a-z0-9-]*`; `id` is opaque; `name` is a display label used in
+usage-limit tags. The field is optional and the on-disk store format is
+unchanged. CLI: `agentproto auth profile create <id> --subaccount <kind>:<id>`
+and `agentproto auth subaccounts list <profile|account> [--create [--prefix]]`.
+
+How a pin is *applied* belongs to a provider, never to this package or the
+runtime. A provider implements `SubaccountProvider` and is added with
+`registerSubaccountProvider`:
+
+| Member | Purpose |
+| --- | --- |
+| `id`, `source?`, `endpoints?`, `kinds` | identity, and which accounts it owns (by `source` name, else by endpoint) |
+| `list(account)` | discovery: `{ account, subaccounts: [{kind, id, name}] }` |
+| `resolve(profile, { credential? })` | spawn time: `{ credential?, credentialEnvOverride?, env?, isolateDataHome? }` |
+| `migrateLegacySource?(source)` | read-time migration of a pre-pin provider-encoded `source` into the pin |
+
+A provider throws `SubaccountError` when a pin cannot be listed or resolved; the
+runtime fails the spawn loudly rather than falling back to the account's default
+scope. Providers ship with their adapter and the host registers them (the CLI
+does so for the built-ins).
+
+The registry is process-global and starts EMPTY: a host that uses
+`@agentproto/auth` outside the CLI must call `registerSubaccountProvider` for
+each provider it needs BEFORE creating, reading or spawning pinned profiles.
+Until then, creating a profile with a legacy `opencode-console:<orgId>` source is
+rejected, and a spawn on a pinned profile whose provider is not registered fails
+with `auth_source_unresolved` (it never runs on the account's default scope). A
+pin on a credential-backed profile is accepted at create time even when no
+provider owns its endpoint yet; the clear error comes at spawn time.
+
 ## API surface
 
 | Export | Purpose |
@@ -249,6 +290,8 @@ through that structural seam. See `@agentproto/secrets`' README.
 | `KeychainStore` / `MemoryStore` / `FileStore` / `resolveStoreRef` | built-in backends + ref resolver |
 | `readKeychainToken` / `writeKeychainToken` / `resolveAccount` | Keychain helpers |
 | `guildeAuthProvider` / `BUILTIN_AUTH_PROVIDERS` | shipped builtins |
+| `registerSubaccountProvider` / `findSubaccountProvider` / `listSubaccountProviders` | sub-account provider registry |
+| `SubaccountProvider` / `SubaccountPin` / `SubaccountError` / `parseSubaccountPin` | sub-account contract |
 
 ## License
 

package/dist/index.d.ts

@@ -609,6 +609,15 @@ interface CostBudget {
     /** Which spend surface the window is summed over. See {@link CostBudgetScope}. */
     scope: CostBudgetScope;
 }
+/** A pinned sub-account of the profile's account: `kind` is free-form (`org`,
+ *  `workspace`, `project`, …) and only meaningful to the provider that owns the
+ *  account (see `subaccounts.ts`). */
+interface SubaccountPin {
+    kind: string;
+    id: string;
+    /** Human-readable name captured at discovery time; informational only. */
+    name?: string;
+}
 /** A named, billing-endpoint-scoped credential reference. */
 interface AuthProfile {
     /** Stable id, unique across all profiles (the `profileRef` a session
@@ -635,6 +644,13 @@ interface AuthProfile {
      *  fresh at spawn time instead. Mutually exclusive with
      *  {@link credentialRef}. */
     source?: string;
+    /** Pins one SUB-ACCOUNT (org / workspace / project / team) of the account this
+     *  profile authenticates as — the account being the {@link credentialRef}'d
+     *  secret or the {@link source}. Each pin is its own wallet; how it is
+     *  applied at spawn is the registered provider's business (`subaccounts.ts`).
+     *  ABSENT ⇒ the account's default scope, byte-identical to a profile that
+     *  predates this field. */
+    subaccount?: SubaccountPin;
     /** Optional human-readable name ("Jeremy Max", "work OpenRouter"). */
     label?: string;
     /** Whole-profile enable/disable. ABSENT (or `false`) ⇒ enabled (today's
@@ -665,6 +681,114 @@ interface AuthProfile {
     origin?: string;
 }
 
+/**
+ * Sub-accounts: an ACCOUNT (a login / billing identity) can have SUB-ACCOUNTS
+ * (org, workspace, project, team) with their own quota and billing. A profile
+ * can pin one ({@link AuthProfile.subaccount}); each pin is a distinct,
+ * truthful wallet. HOW a pin is applied to a spawn — headers, an inline config
+ * block, a scoped token, an isolated data home — is the provider's business.
+ *
+ * This module is the generic seam: the pin type, the {@link SubaccountProvider}
+ * interface, and a process-wide registry. Nothing here (or in any core spawn
+ * path) names a vendor; providers live with their adapter and are registered by
+ * the host (the CLI registers the built-ins at start-up).
+ */
+
+/** Conservative charset for a pin's `kind` — it ends up in CLI args and logs. */
+declare const SUBACCOUNT_KIND_RE: RegExp;
+/** `"org:org_01ABC"` → `{ kind: "org", id: "org_01ABC" }`; split on the FIRST
+ *  colon so an id may itself contain colons. Returns undefined when malformed. */
+declare function parseSubaccountPin(spec: string): SubaccountPin | undefined;
+/** The parent account a provider lists sub-accounts of. */
+interface SubaccountAccountRef {
+    /** Billing endpoint the account authenticates against (`opencode-go`, …). */
+    endpoint: string;
+    /** Source-backed account (the account name a provider owns), no stored secret. */
+    source?: string;
+    /** Credential-backed account: the resolved secret. Never logged or returned. */
+    credential?: string;
+}
+interface DiscoveredSubaccount {
+    kind: string;
+    id: string;
+    name: string;
+}
+interface SubaccountListing {
+    account: {
+        id: string;
+        label?: string;
+    };
+    subaccounts: DiscoveredSubaccount[];
+}
+/** What a provider hands the spawn path for one pinned profile. */
+interface SubaccountResolution {
+    /** Credential to inject, when the provider resolves its own (a source-backed
+     *  account's scoped token). Omitted ⇒ the profile's stored credential stands. */
+    credential?: string;
+    /** Env var the credential is set into INSTEAD of the endpoint's conventional
+     *  key env (the conventional one is then scrubbed). */
+    credentialEnvOverride?: string;
+    /** Extra env set verbatim beside the credential. A value that is a JSON
+     *  object is deep-merged over a same-key value the spawn already carries
+     *  (e.g. a mode's inline config), never clobbering it. */
+    env?: Record<string, string>;
+    /** `false` opts out of the adapter's isolated, login-less data home for this
+     *  spawn; omitted ⇒ whatever the adapter declares applies. */
+    isolateDataHome?: boolean;
+}
+/** Raised by a provider when a sub-account cannot be listed or resolved. The
+ *  runtime maps it onto its own spawn-error codes; the message must never carry
+ *  a secret. */
+declare class SubaccountError extends Error {
+    constructor(message: string);
+}
+interface SubaccountProvider {
+    /** Registry key, unique per provider. */
+    id: string;
+    /** The `source` name that identifies this provider's source-backed accounts
+     *  (`AuthProfile.source`). */
+    source?: string;
+    /** Endpoints whose credential-backed profiles this provider serves. */
+    endpoints?: readonly string[];
+    /** Sub-account kinds this provider understands. */
+    kinds: readonly string[];
+    /** Endpoint a profile created from a discovered sub-account lands on. */
+    defaultEndpoint?: string;
+    /** Default id prefix for profiles created from a discovery (`<prefix>-<name>`). */
+    profilePrefix?: string;
+    /** Discovery: the sub-accounts of `account`. */
+    list(account: SubaccountAccountRef): Promise<SubaccountListing>;
+    /** Spawn-time: how the pinned `profile` is applied. `credential` is the
+     *  profile's stored credential when it has one. */
+    resolve(profile: AuthProfile & {
+        subaccount: SubaccountPin;
+    }, ctx: {
+        credential?: string;
+    }): Promise<SubaccountResolution>;
+    /** Migrate-on-read hook for a profile shape that predates generic pins: a
+     *  legacy `source` string → the account `source` + the pin it encoded. */
+    migrateLegacySource?(source: string): SubaccountPin | undefined;
+}
+/** Register (or replace, by `id`) a provider. Idempotent. */
+declare function registerSubaccountProvider(provider: SubaccountProvider): void;
+/** Remove a provider; returns whether it was registered. Mainly for tests. */
+declare function unregisterSubaccountProvider(id: string): boolean;
+declare function listSubaccountProviders(): SubaccountProvider[];
+declare function getSubaccountProvider(id: string): SubaccountProvider | undefined;
+/** The provider owning an account: by `source` name first, else by `endpoint`
+ *  for a credential-backed account. */
+declare function findSubaccountProvider(account: {
+    source?: string;
+    endpoint?: string;
+}): SubaccountProvider | undefined;
+/**
+ * Migrate-on-read: a profile that carries a legacy provider-encoded `source`
+ * (and no `subaccount`) is returned with the generic shape — `source` reduced
+ * to the account name, the encoded pin lifted into `subaccount`. Any other
+ * profile is returned as-is. Pure over the registry; never writes.
+ */
+declare function migrateLegacySubaccountProfile(profile: AuthProfile): AuthProfile;
+
 /**
  * Named auth-profile store — CRUD over `~/.agentproto/auth-profiles.json`
  * (mode 0600), generalizing `providers-store`'s single-key-per-provider file
@@ -692,6 +816,11 @@ declare const authProfilesFileSchema: z.ZodObject<{
         }>;
         credentialRef: z.ZodOptional<z.ZodString>;
         source: z.ZodOptional<z.ZodString>;
+        subaccount: z.ZodOptional<z.ZodObject<{
+            kind: z.ZodString;
+            id: z.ZodString;
+            name: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>;
         label: z.ZodOptional<z.ZodString>;
         disabled: z.ZodOptional<z.ZodBoolean>;
         models: z.ZodOptional<z.ZodObject<{
@@ -716,6 +845,11 @@ declare const authProfilesFileSchema: z.ZodObject<{
         method: "oauth-bearer" | "api-key";
         credentialRef?: string | undefined;
         source?: string | undefined;
+        subaccount?: {
+            kind: string;
+            id: string;
+            name?: string | undefined;
+        } | undefined;
         label?: string | undefined;
         disabled?: boolean | undefined;
         models?: {
@@ -766,9 +900,9 @@ declare function removeAuthProfile(id: string): Promise<boolean>;
 
 /** Input to {@link createAuthProfile}. `credential` is the raw secret — it is
  *  written to the store and NEVER returned. Exactly one of `credential` /
- *  `source` must be given for an `oauth-bearer` profile; `api-key` always
- *  requires `credential` (a source-backed profile only makes sense for a
- *  self-refreshing subscription bearer). */
+ *  `source` must be given for an `oauth-bearer` profile; `api-key` requires
+ *  `credential`, except for a `source` owned by a registered sub-account
+ *  provider (an account resolved at spawn, pinned to a `subaccount`). */
 interface CreateAuthProfileInput {
     /** Stable id, unique across all profiles. */
     id: string;
@@ -785,6 +919,9 @@ interface CreateAuthProfileInput {
      *  resolved fresh at spawn time instead. Mutually exclusive with
      *  `credential`. */
     source?: string;
+    /** Pin one sub-account (org / workspace / project) of the account — the
+     *  `credential` or the `source`. See `subaccounts.ts`. */
+    subaccount?: SubaccountPin;
     /** Optional human-readable name. */
     label?: string;
     /** Optional explicit credential-store slot. Omitted ⇒ derived from
@@ -806,6 +943,8 @@ interface CreatedAuthProfile {
     credentialRef?: string;
     /** Set for a source-backed profile; absent for a credential-backed one. */
     source?: string;
+    /** The pinned sub-account, when the profile has one. */
+    subaccount?: SubaccountPin;
     label?: string;
     /** Provenance stamped at import time, when given. */
     origin?: string;
@@ -845,6 +984,7 @@ interface ValidatedCreateInput {
     method: AuthMethod;
     credential?: string;
     source?: string;
+    subaccount?: SubaccountPin;
     label?: string;
     credentialRef?: string;
     origin?: string;
@@ -1097,4 +1237,4 @@ declare const BUILTIN_AUTH_PROVIDERS: readonly AuthProviderHandle[];
 declare const SPEC_NAME = "agentauth";
 declare const SPEC_VERSION = "v1";
 
-export { type AdapterAuthManifest, type AuthConfig, type AuthMethod, type AuthProfile, AuthProfileValidationError, type AuthProfilesFile, type AuthProviderDefinition, type AuthProviderFrontmatter, type AuthProviderHandle, type AuthProviderManifest, BUILTIN_AUTH_PROVIDERS, CeremonyRequiredError, type CostBudget, type CostBudgetScope, type CreateAuthProfileInput, type CreatedAuthProfile, CredentialBroker, type CredentialBrokerOptions, type CredentialIdentity, type CredentialStore, type DeletedAuthProfile, type DeviceCodeAuthConfig, type DiscoveredEndpoints, DiscoveryError, FLOW_ENGINES, FileStore, type FlowEngine, type FlowId, type FlowResult, type FlowRunOptions, type InstallConfig, KeychainStore, MemoryStore, type ModelCuration, type PATAuthConfig, type ProfileProvisionDeps, type RefreshAuthProfileModelsResult, type RunFlowOptions, SPEC_NAME, SPEC_VERSION, type ServiceAuthConfig, type StoreRef, type StoredCredential, type TokenStoreSpec, type UpdateAuthProfileInput, type ValidatedCreateInput, addAuthProfile, authConfigSchema, authProfilesPath, authProviderFrontmatterSchema, createAuthProfile, credentialIdentity, defineAuthProvider, deleteAuthProfile, deleteKeychainToken, deriveCredentialRef, discoverEndpoints, eligibleProfiles, fingerprintCredential, getAuthProfile, getAuthProvider, guildeAuthProvider, installConfigSchema, listAuthProfiles, listAuthProviderIds, listAuthProviders, loadAuthProfiles, methodsPresentable, parseAuthProviderManifest, parseAuthProviderManifestRaw, readKeychainToken, refreshAuthProfileModels, registerAuthProvider, removeAuthProfile, resolveAccount, resolveEndpoint, resolveStoreRef, runAuthFlow, setAuthProfileEnabled, setAuthProfileModels, tokenStoreSpecSchema, updateAuthProfile, validateCreateInput, writeKeychainToken };
+export { type AdapterAuthManifest, type AuthConfig, type AuthMethod, type AuthProfile, AuthProfileValidationError, type AuthProfilesFile, type AuthProviderDefinition, type AuthProviderFrontmatter, type AuthProviderHandle, type AuthProviderManifest, BUILTIN_AUTH_PROVIDERS, CeremonyRequiredError, type CostBudget, type CostBudgetScope, type CreateAuthProfileInput, type CreatedAuthProfile, CredentialBroker, type CredentialBrokerOptions, type CredentialIdentity, type CredentialStore, type DeletedAuthProfile, type DeviceCodeAuthConfig, type DiscoveredEndpoints, type DiscoveredSubaccount, DiscoveryError, FLOW_ENGINES, FileStore, type FlowEngine, type FlowId, type FlowResult, type FlowRunOptions, type InstallConfig, KeychainStore, MemoryStore, type ModelCuration, type PATAuthConfig, type ProfileProvisionDeps, type RefreshAuthProfileModelsResult, type RunFlowOptions, SPEC_NAME, SPEC_VERSION, SUBACCOUNT_KIND_RE, type ServiceAuthConfig, type StoreRef, type StoredCredential, type SubaccountAccountRef, SubaccountError, type SubaccountListing, type SubaccountPin, type SubaccountProvider, type SubaccountResolution, type TokenStoreSpec, type UpdateAuthProfileInput, type ValidatedCreateInput, addAuthProfile, authConfigSchema, authProfilesPath, authProviderFrontmatterSchema, createAuthProfile, credentialIdentity, defineAuthProvider, deleteAuthProfile, deleteKeychainToken, deriveCredentialRef, discoverEndpoints, eligibleProfiles, findSubaccountProvider, fingerprintCredential, getAuthProfile, getAuthProvider, getSubaccountProvider, guildeAuthProvider, installConfigSchema, listAuthProfiles, listAuthProviderIds, listAuthProviders, listSubaccountProviders, loadAuthProfiles, methodsPresentable, migrateLegacySubaccountProfile, parseAuthProviderManifest, parseAuthProviderManifestRaw, parseSubaccountPin, readKeychainToken, refreshAuthProfileModels, registerAuthProvider, registerSubaccountProvider, removeAuthProfile, resolveAccount, resolveEndpoint, resolveStoreRef, runAuthFlow, setAuthProfileEnabled, setAuthProfileModels, tokenStoreSpecSchema, unregisterSubaccountProvider, updateAuthProfile, validateCreateInput, writeKeychainToken };

package/dist/index.mjs

@@ -1248,6 +1248,54 @@ var CredentialBroker = class {
     return headers;
   }
 };
+
+// src/subaccounts.ts
+var SUBACCOUNT_KIND_RE = /^[a-z][a-z0-9-]*$/;
+function parseSubaccountPin(spec) {
+  const at = spec.indexOf(":");
+  if (at <= 0) return void 0;
+  const kind = spec.slice(0, at).trim();
+  const id = spec.slice(at + 1).trim();
+  if (!SUBACCOUNT_KIND_RE.test(kind) || id === "") return void 0;
+  return { kind, id };
+}
+var SubaccountError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "SubaccountError";
+  }
+};
+var providers = /* @__PURE__ */ new Map();
+function registerSubaccountProvider(provider) {
+  providers.set(provider.id, provider);
+}
+function unregisterSubaccountProvider(id) {
+  return providers.delete(id);
+}
+function listSubaccountProviders() {
+  return [...providers.values()];
+}
+function getSubaccountProvider(id) {
+  return providers.get(id);
+}
+function findSubaccountProvider(account) {
+  const all = listSubaccountProviders();
+  if (account.source !== void 0) {
+    return all.find((p) => p.source === account.source) ?? all.find((p) => p.migrateLegacySource?.(account.source) !== void 0);
+  }
+  if (account.endpoint !== void 0) return all.find((p) => p.endpoints?.includes(account.endpoint));
+  return void 0;
+}
+function migrateLegacySubaccountProfile(profile) {
+  if (profile.subaccount !== void 0 || profile.source === void 0) return profile;
+  for (const provider of providers.values()) {
+    const pin = provider.migrateLegacySource?.(profile.source);
+    if (pin !== void 0 && provider.source !== void 0) {
+      return { ...profile, source: provider.source, subaccount: pin };
+    }
+  }
+  return profile;
+}
 var authMethodSchema = z.enum(["oauth-bearer", "api-key"]);
 var modelCurationSchema = z.object({
   mode: z.enum(["all", "allow"]),
@@ -1258,12 +1306,18 @@ var costBudgetSchema = z.object({
   window: z.string(),
   scope: z.enum(["session", "profile"])
 });
+var subaccountPinSchema = z.object({
+  kind: z.string(),
+  id: z.string(),
+  name: z.string().optional()
+});
 var authProfileSchema = z.object({
   id: z.string(),
   vendor: z.string(),
   method: authMethodSchema,
   credentialRef: z.string().optional(),
   source: z.string().optional(),
+  subaccount: subaccountPinSchema.optional(),
   label: z.string().optional(),
   // Additive, back-compat fields — an entry that predates them parses
   // unchanged (both optional), and `endpoint` still shadows the on-disk
@@ -1310,12 +1364,13 @@ async function writeAuthProfiles(file) {
 }
 async function listAuthProfiles(endpoint) {
   const file = await loadAuthProfiles();
-  const all = Object.values(file.profiles);
+  const all = Object.values(file.profiles).map(migrateLegacySubaccountProfile);
   return endpoint === void 0 ? all : all.filter((p) => p.endpoint === endpoint);
 }
 async function getAuthProfile(id) {
   const file = await loadAuthProfiles();
-  return file.profiles[id];
+  const profile = file.profiles[id];
+  return profile ? migrateLegacySubaccountProfile(profile) : void 0;
 }
 async function addAuthProfile(profile) {
   const file = await loadAuthProfiles();
@@ -1360,13 +1415,49 @@ function validateCreateInput(input) {
   }
   const credential = input.credential !== void 0 ? input.credential.trim() : void 0;
   const source = input.source?.trim();
-  if (method === "api-key") {
-    if (source) {
+  let subaccount;
+  if (input.subaccount !== void 0) {
+    const kind = (input.subaccount.kind ?? "").trim();
+    const subId = (input.subaccount.id ?? "").trim();
+    const subName = input.subaccount.name?.trim();
+    if (!SUBACCOUNT_KIND_RE.test(kind) || !subId) {
       throw new AuthProfileValidationError(
-        "source is only supported for oauth-bearer profiles \u2014 api-key profiles require a credential"
+        `subaccount must be "<kind>:<id>" with a lowercase kind (org, workspace, project, \u2026) and a non-empty id`
       );
     }
-    if (!credential) throw new AuthProfileValidationError("credential is required");
+    subaccount = { kind, id: subId, ...subName ? { name: subName } : {} };
+    if (!credential && !source) {
+      throw new AuthProfileValidationError(
+        "a subaccount pin needs a parent account \u2014 give a credential or a source"
+      );
+    }
+  }
+  const provider = source ? findSubaccountProvider({ source }) : void 0;
+  if (subaccount && provider && !provider.kinds.includes(subaccount.kind)) {
+    throw new AuthProfileValidationError(
+      `subaccount kind "${subaccount.kind}" is not supported by "${provider.id}" (supported: ${provider.kinds.join(", ")})`
+    );
+  }
+  if (method === "api-key") {
+    if (source) {
+      if (!provider) {
+        throw new AuthProfileValidationError(
+          `source is only supported for oauth-bearer profiles and for accounts owned by a registered sub-account provider \u2014 api-key profiles otherwise require a credential`
+        );
+      }
+      if (!subaccount && provider.migrateLegacySource?.(source) === void 0) {
+        throw new AuthProfileValidationError(
+          `source "${source}" resolves an account with sub-accounts \u2014 pin one with a subaccount ("<kind>:<id>")`
+        );
+      }
+      if (credential) {
+        throw new AuthProfileValidationError(
+          "give either credential or source, not both \u2014 a source-backed profile stores no secret"
+        );
+      }
+    } else if (!credential) {
+      throw new AuthProfileValidationError("credential is required");
+    }
   } else {
     if (credential && source) {
       throw new AuthProfileValidationError(
@@ -1391,6 +1482,7 @@ function validateCreateInput(input) {
     method,
     ...credential ? { credential } : {},
     ...source ? { source } : {},
+    ...subaccount ? { subaccount } : {},
     ...label ? { label } : {},
     ...credentialRef ? { credentialRef } : {},
     ...origin ? { origin } : {}
@@ -1423,20 +1515,22 @@ async function createAuthProfile(input, deps) {
     );
   }
   if (v.source !== void 0) {
-    const profile2 = {
+    const profile2 = migrateLegacySubaccountProfile({
       id: v.id,
       endpoint: v.endpoint,
       method: v.method,
       source: v.source,
+      ...v.subaccount ? { subaccount: v.subaccount } : {},
       ...v.label ? { label: v.label } : {},
       ...v.origin ? { origin: v.origin } : {}
-    };
+    });
     await deps.addProfile(profile2);
     return {
       id: profile2.id,
       endpoint: profile2.endpoint,
       method: profile2.method,
-      source: v.source,
+      source: profile2.source,
+      ...profile2.subaccount ? { subaccount: profile2.subaccount } : {},
       ...profile2.label ? { label: profile2.label } : {},
       ...profile2.origin ? { origin: profile2.origin } : {}
     };
@@ -1457,6 +1551,7 @@ async function createAuthProfile(input, deps) {
     endpoint: v.endpoint,
     method: v.method,
     credentialRef,
+    ...v.subaccount ? { subaccount: v.subaccount } : {},
     ...v.label ? { label: v.label } : {},
     ...v.origin ? { origin: v.origin } : {}
   };
@@ -1466,6 +1561,7 @@ async function createAuthProfile(input, deps) {
     endpoint: profile.endpoint,
     method: profile.method,
     credentialRef,
+    ...v.subaccount ? { subaccount: v.subaccount } : {},
     ...profile.label ? { label: profile.label } : {},
     ...profile.origin ? { origin: profile.origin } : {},
     fingerprint: fingerprintCredential(credential)
@@ -1626,6 +1722,6 @@ function eligibleProfiles(profiles, manifest, route) {
 var SPEC_NAME = "agentauth";
 var SPEC_VERSION = "v1";
 
-export { AuthProfileValidationError, BUILTIN_AUTH_PROVIDERS, CeremonyRequiredError, CredentialBroker, DiscoveryError, FLOW_ENGINES, FileStore, KeychainStore, MemoryStore, SPEC_NAME, SPEC_VERSION, addAuthProfile, authConfigSchema, authProfilesPath, authProviderFrontmatterSchema, createAuthProfile, credentialIdentity, defineAuthProvider, deleteAuthProfile, deleteKeychainToken, deriveCredentialRef, discoverEndpoints, eligibleProfiles, fingerprintCredential, getAuthProfile, getAuthProvider, guildeAuthProvider, installConfigSchema, listAuthProfiles, listAuthProviderIds, listAuthProviders, loadAuthProfiles, methodsPresentable, parseAuthProviderManifest, parseAuthProviderManifestRaw, readKeychainToken, refreshAuthProfileModels, registerAuthProvider, removeAuthProfile, resolveAccount, resolveEndpoint, resolveStoreRef, runAuthFlow, setAuthProfileEnabled, setAuthProfileModels, tokenStoreSpecSchema, updateAuthProfile, validateCreateInput, writeKeychainToken };
+export { AuthProfileValidationError, BUILTIN_AUTH_PROVIDERS, CeremonyRequiredError, CredentialBroker, DiscoveryError, FLOW_ENGINES, FileStore, KeychainStore, MemoryStore, SPEC_NAME, SPEC_VERSION, SUBACCOUNT_KIND_RE, SubaccountError, addAuthProfile, authConfigSchema, authProfilesPath, authProviderFrontmatterSchema, createAuthProfile, credentialIdentity, defineAuthProvider, deleteAuthProfile, deleteKeychainToken, deriveCredentialRef, discoverEndpoints, eligibleProfiles, findSubaccountProvider, fingerprintCredential, getAuthProfile, getAuthProvider, getSubaccountProvider, guildeAuthProvider, installConfigSchema, listAuthProfiles, listAuthProviderIds, listAuthProviders, listSubaccountProviders, loadAuthProfiles, methodsPresentable, migrateLegacySubaccountProfile, parseAuthProviderManifest, parseAuthProviderManifestRaw, parseSubaccountPin, readKeychainToken, refreshAuthProfileModels, registerAuthProvider, registerSubaccountProvider, removeAuthProfile, resolveAccount, resolveEndpoint, resolveStoreRef, runAuthFlow, setAuthProfileEnabled, setAuthProfileModels, tokenStoreSpecSchema, unregisterSubaccountProvider, updateAuthProfile, validateCreateInput, writeKeychainToken };
 //# sourceMappingURL=index.mjs.map
 //# sourceMappingURL=index.mjs.map