@byokit/openclaw 0.10.0 → 0.11.0

package/CHANGELOG.md

@@ -2,6 +2,16 @@
 
 ## Unreleased
 
+## 0.11.0 (2026-10-12)
+
+- Dependency update: pins @byokit/ui 0.7.0.
+- Dependency update: pins @byokit/secrets 0.5.1.
+- Dependency update: pins @byokit/discover 0.8.0.
+- Dependency update: pins @byokit/relay 0.6.1.
+- Dependency update: pins @byokit/pair 0.10.0.
+
+- FEAT: `byokit.accounts` seals an agent's own sign-ins (list/seal/ready/adopt/clear), loaded as the `plugin/accounts.js` gateway method; a failed `adopt` rolls the model and both profile stores back so no partial move or dangling pin survives, a self-adopt is refused, and the fake gateway mirrors every branch.
+
 ## 0.10.0 (2026-10-11)
 
 - Dependency update: pins @byokit/discover 0.7.0.

package/dist/accounts.d.ts

@@ -0,0 +1,16 @@
+import { createLocks } from './locks.ts';
+import type { Account, AccountId, Defaults, GatewayTransport, Member } from './types.ts';
+export declare function createAccounts(ctx: {
+    request: GatewayTransport['request'];
+    root: string;
+    ensure(member: Member): Promise<{
+        agentId: string;
+        workspace: string;
+    }>;
+    locks: ReturnType<typeof createLocks>;
+}): {
+    list(member: Member): Promise<Account[]>;
+    rename(member: Member, id: AccountId, name: string): Promise<Account>;
+    defaults(member: Member): Promise<Defaults>;
+    setDefaults(member: Member, d: Defaults): Promise<void>;
+};

package/dist/accounts.js

@@ -0,0 +1,222 @@
+// The per-member account index (5.15, O14 step S5): `<root>/accounts/<member>.json` (0600, whole-file temp
+// plus rename) is the only kit state: `{ v: 1, accounts: { [id]: { agent, name, route, addedAt, until?, model?,
+// who? } }, defaults }`. No credential, token, email or engine line. Listing, rename and defaults live here;
+// add, remove, models, room, pick and move arrive in later steps.
+import { chmodSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { randomUUID } from 'node:crypto';
+import { join } from 'node:path';
+import { KEY_PREFIX, MEMBER_ID } from "./members.js";
+import { routes, routeFor } from "./routes.js";
+const ACCOUNT_AGENT = /^[a-z][a-z0-9-]{0,31}--[0-9a-f]{6}$/;
+const usable = (status) => status === 'ok' || status === 'expiring' || status === 'static';
+const empty = () => ({ v: 1, accounts: {}, defaults: {} });
+const validEntry = (v) => !!v && typeof v === 'object'
+    && typeof v.agent === 'string' && typeof v.name === 'string'
+    && typeof v.route === 'string' && Number.isFinite(v.addedAt)
+    && (v.until === undefined || Number.isFinite(v.until))
+    && (v.model === undefined || typeof v.model === 'string')
+    && (v.who === undefined || typeof v.who === 'string');
+export function createAccounts(ctx) {
+    const path = (member) => join(ctx.root, 'accounts', `${member}.json`);
+    const check = (member) => {
+        if (!MEMBER_ID.test(member) || member.startsWith(KEY_PREFIX))
+            throw new Error(`invalid member id: ${member}`);
+    };
+    const read = (member) => {
+        let text;
+        try {
+            text = readFileSync(path(member), 'utf8');
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                return empty();
+            throw error;
+        }
+        const file = JSON.parse(text);
+        if (!file || typeof file !== 'object' || file.v !== 1)
+            return empty();
+        const accounts = {};
+        for (const [id, entry] of Object.entries(file.accounts ?? {}))
+            if (validEntry(entry))
+                accounts[id] = entry;
+        const raw = file.defaults && typeof file.defaults === 'object' ? file.defaults : {};
+        const defaults = {};
+        if (typeof raw.account === 'string')
+            defaults.account = raw.account;
+        if (typeof raw.model === 'string')
+            defaults.model = raw.model;
+        if (typeof raw.auto === 'boolean')
+            defaults.auto = raw.auto;
+        return { v: 1, accounts, defaults };
+    };
+    const write = (member, file) => {
+        mkdirSync(join(ctx.root, 'accounts'), { recursive: true, mode: 0o700 });
+        const tmp = `${path(member)}.${randomUUID()}.tmp`;
+        writeFileSync(tmp, JSON.stringify(file, null, 2) + '\n');
+        chmodSync(tmp, 0o600);
+        try {
+            renameSync(tmp, path(member));
+            chmodSync(path(member), 0o600);
+        }
+        finally {
+            rmSync(tmp, { force: true });
+        }
+    };
+    const metaOf = (choice) => {
+        const row = routes().find((r) => r.choice === choice);
+        if (row && (row.billing === 'subscription' || row.billing === 'api'))
+            return { label: row.label, billing: row.billing };
+        return { label: choice, billing: 'subscription' };
+    };
+    const synthesizedRoute = (provider) => routeFor(provider, 'browser')?.choice
+        ?? routes().find((r) => r.provider === provider && r.billing === 'subscription')?.choice
+        ?? provider;
+    const rosterOf = () => ctx.request('agents.list')
+        .then((r) => new Set(r.agents.map((a) => a.id)), () => new Set());
+    const profilesOf = (agentId) => ctx.request('byokit.accounts', { action: 'list', agentId })
+        .then((r) => Array.isArray(r.profiles) ? r.profiles : [], () => []);
+    const stateOf = (route, status, until) => {
+        if (!routes().some((r) => r.choice === route))
+            return 'not_included';
+        if (until !== undefined && until > Date.now())
+            return 'resting';
+        if (!status)
+            return 'signed_out';
+        return usable(status) ? 'ready' : status === 'expired' ? 'needs_again' : 'signed_out';
+    };
+    // Lock-free row builder over one snapshot: mutates `file` (synthesized entries, `who` backfill, dropped
+    // dangling default) and reports whether it did. Callers own the locking.
+    const build = async (member, agentId, file, roster, memberProfiles) => {
+        let dirty = false;
+        const byProvider = new Map();
+        for (const p of memberProfiles) {
+            if (typeof p.provider !== 'string' || !p.provider)
+                continue;
+            byProvider.set(p.provider, [...(byProvider.get(p.provider) ?? []), p]);
+        }
+        const memberRows = [];
+        const seen = new Set();
+        for (const [provider, profiles] of [...byProvider.entries()].sort(([a], [b]) => a < b ? -1 : 1)) {
+            let entry = file.accounts[provider];
+            if (!entry || entry.agent !== agentId) {
+                const route = entry?.agent === agentId && typeof entry.route === 'string' ? entry.route : synthesizedRoute(provider);
+                const same = Object.values(file.accounts).filter((e) => e.agent === agentId).length;
+                entry = { agent: agentId, name: `${metaOf(route).label} ${same + 1}`, route, addedAt: 0 };
+                file.accounts[provider] = entry;
+                dirty = true;
+            }
+            if (!entry.who && typeof profiles[0]?.who === 'string') {
+                entry.who = profiles[0].who;
+                dirty = true;
+            }
+            const meta = metaOf(entry.route);
+            memberRows.push({ id: provider, provider, route: entry.route, name: entry.name, label: meta.label,
+                billing: meta.billing, state: stateOf(entry.route, profiles[0]?.status, entry.until),
+                ...(entry.until !== undefined ? { until: entry.until } : {}), addedAt: entry.addedAt });
+            seen.add(provider);
+        }
+        for (const [id, entry] of Object.entries(file.accounts)) {
+            if (entry.agent !== agentId || id.includes('.') || seen.has(id))
+                continue;
+            const stale = metaOf(entry.route);
+            memberRows.push({ id, provider: id, route: entry.route, name: entry.name, label: stale.label,
+                billing: stale.billing, state: stateOf(entry.route, undefined, entry.until),
+                ...(entry.until !== undefined ? { until: entry.until } : {}), addedAt: entry.addedAt });
+        }
+        // Account agents: only what the index names, with exactly `<member>--<hex6>` shape. An unindexed
+        // agent of that shape is never listed, and an entry whose agent is gone is not listed either.
+        const agentRows = [];
+        for (const [id, entry] of Object.entries(file.accounts)) {
+            if (entry.agent === agentId || !ACCOUNT_AGENT.test(entry.agent) || !entry.agent.startsWith(`${member}--`))
+                continue;
+            if (!roster.has(entry.agent))
+                continue;
+            const provider = id.split('.')[0];
+            const meta = metaOf(entry.route);
+            const profiles = await profilesOf(entry.agent);
+            agentRows.push({ id, provider, route: entry.route, name: entry.name, label: meta.label,
+                billing: meta.billing, state: stateOf(entry.route, profiles[0]?.status, entry.until),
+                ...(entry.until !== undefined ? { until: entry.until } : {}), addedAt: entry.addedAt });
+        }
+        memberRows.sort((a, b) => a.addedAt - b.addedAt || (a.id < b.id ? -1 : 1));
+        agentRows.sort((a, b) => a.addedAt - b.addedAt);
+        const rows = [...memberRows, ...agentRows];
+        if (file.defaults.account !== undefined && !rows.some((r) => r.id === file.defaults.account)) {
+            delete file.defaults.account;
+            dirty = true;
+        }
+        return { rows, dirty };
+    };
+    const gather = (agentId) => Promise.all([rosterOf(), profilesOf(agentId)]);
+    const buildRows = async (member, agentId) => {
+        const file = read(member);
+        const [roster, profiles] = await gather(agentId);
+        return { ...(await build(member, agentId, file, roster, profiles)), file };
+    };
+    async function list(member) {
+        check(member);
+        const { agentId } = await ctx.ensure(member);
+        const first = await ctx.locks.shared(agentId, () => buildRows(member, agentId));
+        if (!first.dirty)
+            return first.rows;
+        // A write is needed (synthesized entry, `who` backfill or dropped default): redo it under the
+        // exclusive lock so two first-lists cannot interleave their read-modify-write.
+        return ctx.locks.exclusive([agentId], async () => {
+            const { rows, dirty, file } = await buildRows(member, agentId);
+            if (dirty)
+                write(member, file);
+            return rows;
+        });
+    }
+    async function rename(member, id, name) {
+        check(member);
+        if (typeof name !== 'string')
+            throw new Error('renameAccount: name is empty');
+        const trimmed = name.trim();
+        if (!trimmed || trimmed.length > 100 || /[\u0000-\u001f\u007f]/.test(trimmed))
+            throw new Error('renameAccount: name is empty');
+        const { agentId } = await ctx.ensure(member);
+        if (!(await list(member)).some((r) => r.id === id))
+            throw new Error(`unknown account: ${id}`);
+        await ctx.locks.exclusive([agentId], async () => {
+            const file = read(member);
+            const entry = file.accounts[id];
+            if (!entry)
+                throw new Error(`unknown account: ${id}`);
+            entry.name = trimmed;
+            write(member, file);
+        });
+        const done = (await list(member)).find((r) => r.id === id);
+        if (!done)
+            throw new Error(`unknown account: ${id}`);
+        return done;
+    }
+    async function defaults(member) {
+        await list(member);
+        return read(member).defaults;
+    }
+    async function setDefaults(member, d) {
+        check(member);
+        if (!d || typeof d !== 'object')
+            throw new Error('setDefaults: defaults are invalid');
+        if (d.account !== undefined && typeof d.account !== 'string')
+            throw new Error('setDefaults: defaults are invalid');
+        if (d.model !== undefined && typeof d.model !== 'string')
+            throw new Error('setDefaults: defaults are invalid');
+        if (d.auto !== undefined && typeof d.auto !== 'boolean')
+            throw new Error('setDefaults: defaults are invalid');
+        const { agentId } = await ctx.ensure(member);
+        return ctx.locks.exclusive([agentId], async () => {
+            const file = read(member);
+            const next = {};
+            if (d.account !== undefined)
+                next.account = d.account;
+            if (d.model !== undefined)
+                next.model = d.model;
+            if (d.auto !== undefined)
+                next.auto = d.auto;
+            write(member, { ...file, defaults: next });
+        });
+    }
+    return { list, rename, defaults, setDefaults };
+}

package/dist/auth-store.js

@@ -54,7 +54,27 @@ function put(path, bytes) {
 // containing directory in `changed` instead of fsyncing it now. restore() fsyncs each distinct directory
 // once after every file is written, so a restore still makes each rename durable before it removes the
 // restoring marker, without one directory fsync per object. seal() and the stop path keep put().
+// When the live file already holds the exact bytes at the restore mode, the write (and its file fsync,
+// rename and directory fsync) is skipped: nothing on disk changes, so there is nothing to make durable.
+// Size is compared before reading; any read error (or a missing, changed or different-mode file) writes.
+function sameLiveFile(path, bytes) {
+    try {
+        const stat = lstatSync(path);
+        if (!stat.isFile())
+            return false;
+        if ((stat.mode & 0o777) !== 0o600)
+            return false;
+        if (stat.size !== bytes.length)
+            return false;
+        return readFileSync(path).equals(Buffer.from(bytes));
+    }
+    catch {
+        return false;
+    }
+}
 function putRestore(path, bytes, changed) {
+    if (sameLiveFile(path, bytes))
+        return;
     mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
     const tmp = `${path}.sealing-${process.pid}`;
     try {

package/dist/engine.js

@@ -256,7 +256,7 @@ export class Engine {
         const pluginDir = join(this.root, 'plugin');
         mkdirSync(pluginDir, { recursive: true, mode: 0o700 });
         // The shipped plugin follows the kit on every prepare too: a state dir from an older kit must not keep its gate.
-        for (const f of ['package.json', 'index.js', 'keys.js', 'usage.js']) {
+        for (const f of ['package.json', 'index.js', 'keys.js', 'usage.js', 'accounts.js']) {
             const source = join(kitDir, 'plugin', f);
             putChanged(join(pluginDir, f), readFileSync(source, 'utf8'));
         }

package/dist/kit.d.ts

@@ -2,7 +2,7 @@ import type { SealingAdapter } from '@byokit/secrets';
 import { type AddKeyResult } from './keys.ts';
 import { type RouteView } from './routes.ts';
 import type { BrowserHost, BrowserOptions } from './browser.ts';
-import type { Approval, CallOptions, Decision, GatewayMethod, GatewayParams, GatewayResult, GatewayTransport, Hello, KitState, KitEventName, KitEventPayload, LearningCapture, LearningMode, Member, RunEnd, RunEvent, RunSpec, OutputSchema, SchemaOutput, SignInOptions, SignInView, ToolHost, ToolSpec } from './types.ts';
+import type { Account, AccountId, Approval, CallOptions, Decision, Defaults, GatewayMethod, GatewayParams, GatewayResult, GatewayTransport, Hello, KitState, KitEventName, KitEventPayload, LearningCapture, LearningMode, Member, RunEnd, RunEvent, RunSpec, OutputSchema, SchemaOutput, SignInOptions, SignInView, ToolHost, ToolSpec } from './types.ts';
 export type KitOptions = {
     stateDir: string;
     authSeal?: SealingAdapter;
@@ -54,6 +54,8 @@ export declare class OpenClawKit {
     private transport?;
     private greeting?;
     private members?;
+    private readonly locks;
+    private accountsCtl?;
     private readonly bridge;
     private readonly keys;
     private readonly admission;
@@ -110,6 +112,10 @@ export declare class OpenClawKit {
         done: Promise<SignInView>;
     };
     signOut(member: Member, provider: string): Promise<void>;
+    accounts(member: Member): Promise<Account[]>;
+    renameAccount(member: Member, id: AccountId, name: string): Promise<Account>;
+    defaults(member: Member): Promise<Defaults>;
+    setDefaults(member: Member, d: Defaults): Promise<void>;
     /** Save an explicitly supplied API key (billed per use) in this member's separate key agent. */
     addKey(agentId: Member, o: {
         authChoice: string;

package/dist/kit.js

@@ -10,6 +10,8 @@ import { Engine, refusedOnly } from "./engine.js";
 import { AuthStoreSealSizeError } from "./auth-store.js";
 import { gatewayTransport } from "./transport.js";
 import { createMembers } from "./members.js";
+import { createAccounts } from "./accounts.js";
+import { createLocks } from "./locks.js";
 import { keyAgentId, KEY_PREFIX, MEMBER_ID } from "./members.js";
 import { confirmRetainedLogin as confirmLogin, migrateRetainedLogin as migrateLogin } from "./migrate.js";
 import { createRuns, signedInProviders } from "./runs.js";
@@ -429,6 +431,8 @@ export class OpenClawKit {
     transport;
     greeting;
     members;
+    locks = createLocks();
+    accountsCtl;
     // One bridge and one approval surface per kit: listeners and run registrations survive reconnects (B3).
     // Only the socket itself is per-connection. Approvals always reaches the live transport through this.request().
     bridge;
@@ -741,6 +745,8 @@ export class OpenClawKit {
                 if (!operatorMethods.has(name) && !nodeMethods.has(name))
                     this.o.log?.(`gateway has unknown method: ${name}`);
             this.members = createMembers({ request: transport.request.bind(transport), root: this.engine.root });
+            this.accountsCtl = createAccounts({ request: transport.request.bind(transport), root: this.engine.root,
+                ensure: (member) => this.ensureMember(member), locks: this.locks });
             // The fail-closed tool bridge feeds the kit's single Approval surface (5.9, O5).
             await this.bridge.start();
             this.off.push(transport.onEvent((e) => this.approvalsCtl.handleEvent(e)));
@@ -789,6 +795,7 @@ export class OpenClawKit {
         this.transport = undefined;
         this.greeting = undefined;
         this.members = undefined;
+        this.accountsCtl = undefined;
         this.browserPolicySessions.clear();
         this.bridge.stop();
         await transport?.stop();
@@ -919,6 +926,28 @@ export class OpenClawKit {
     signOut(member, provider) {
         return engineSignOut(this.signInCtx(), member, provider);
     }
+    // accounts (5.15, O14 step S5): the per-member index with listing, defaults and rename. Adding,
+    // removing, models, room, pick and move arrive in later steps.
+    accounts(member) {
+        if (!this.accountsCtl)
+            return Promise.reject(new Error('gateway not ready'));
+        return this.accountsCtl.list(member);
+    }
+    renameAccount(member, id, name) {
+        if (!this.accountsCtl)
+            return Promise.reject(new Error('gateway not ready'));
+        return this.accountsCtl.rename(member, id, name);
+    }
+    defaults(member) {
+        if (!this.accountsCtl)
+            return Promise.reject(new Error('gateway not ready'));
+        return this.accountsCtl.defaults(member);
+    }
+    setDefaults(member, d) {
+        if (!this.accountsCtl)
+            return Promise.reject(new Error('gateway not ready'));
+        return this.accountsCtl.setDefaults(member, d);
+    }
     /** Save an explicitly supplied API key (billed per use) in this member's separate key agent. */
     addKey(agentId, o) {
         return this.keys.add(agentId, o);

package/dist/locks.d.ts

@@ -0,0 +1,5 @@
+export declare function createLocks(): {
+    shared<T>(agentId: string, work: () => Promise<T>): Promise<T>;
+    exclusive<T>(agentIds: string[], work: () => Promise<T>): Promise<T>;
+    live(agentId: string): boolean;
+};

package/dist/locks.js

@@ -0,0 +1,85 @@
+export function createLocks() {
+    const slots = new Map();
+    const slot = (id) => {
+        let s = slots.get(id);
+        if (!s) {
+            s = { readers: 0, writer: false, queue: [] };
+            slots.set(id, s);
+        }
+        return s;
+    };
+    // FIFO: an exclusive waiter blocks later shared waiters until the readers ahead of it drain.
+    const pump = (s) => {
+        if (s.writer)
+            return;
+        const head = s.queue[0];
+        if (!head)
+            return;
+        if (head.mode === 'exclusive') {
+            if (s.readers === 0) {
+                s.queue.shift();
+                s.writer = true;
+                head.grant();
+            }
+            return;
+        }
+        while (s.queue[0]?.mode === 'shared') {
+            const w = s.queue.shift();
+            s.readers++;
+            w.grant();
+        }
+    };
+    const acquire = (id, mode) => {
+        const s = slot(id);
+        if (mode === 'shared' && !s.writer && s.queue.every((w) => w.mode === 'shared')) {
+            s.readers++;
+            return Promise.resolve();
+        }
+        if (mode === 'exclusive' && !s.writer && s.readers === 0 && s.queue.length === 0) {
+            s.writer = true;
+            return Promise.resolve();
+        }
+        return new Promise((grant) => {
+            s.queue.push(mode === 'exclusive' ? { mode, grant: () => { s.writer = true; grant(); } } : { mode, grant });
+            pump(s);
+        });
+    };
+    const release = (id, mode) => {
+        const s = slot(id);
+        if (mode === 'shared')
+            s.readers = Math.max(0, s.readers - 1);
+        else
+            s.writer = false;
+        pump(s);
+        if (s.readers === 0 && !s.writer && s.queue.length === 0)
+            slots.delete(id);
+    };
+    return {
+        async shared(agentId, work) {
+            await acquire(agentId, 'shared');
+            try {
+                return await work();
+            }
+            finally {
+                release(agentId, 'shared');
+            }
+        },
+        async exclusive(agentIds, work) {
+            // Sorted so two exclusive takes over overlapping sets cannot deadlock each other.
+            const ids = [...new Set(agentIds)].sort();
+            for (const id of ids)
+                await acquire(id, 'exclusive');
+            try {
+                return await work();
+            }
+            finally {
+                for (const id of [...ids].reverse())
+                    release(id, 'exclusive');
+            }
+        },
+        live(agentId) {
+            const s = slots.get(agentId);
+            return !!s && (s.readers > 0 || s.writer);
+        },
+    };
+}

package/dist/testing/contract.js

@@ -18,7 +18,6 @@ const REQUIRED_METHODS = [
     'plugin.approval.resolve', 'question.resolve', 'wizard.cancel', 'wizard.next',
 ];
 // Driven by the kit but not advertised in hello (O11 probe, e.g. sessions.steer): routable, just not listed.
-// The engine job's generated.test.ts audits the full generated table against hello instead of asserting it here.
 const REQUIRED_EVENTS = [
     'agent',
     'exec.approval.requested', 'exec.approval.resolved',

package/dist/testing/fake-gateway.js

@@ -2,7 +2,7 @@
 // `new OpenClawKit({ transport: fake.factory, spawnEngine: false, ... })` or drive `fake.transport.request`
 // directly. No engine, no network, no account.
 import { connect } from 'node:net';
-import { randomUUID } from 'node:crypto';
+import { createHash, randomUUID } from 'node:crypto';
 import { readFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { ENGINE_VERSION, PROTOCOL_VERSION } from "../constants.js";
@@ -23,6 +23,12 @@ const EVENTS = [
 /** Window between a run's last event and its completion, so an abort issued on the text event still lands. */
 const ABORT_WINDOW_MS = 25;
 const BRIDGE_TIMEOUT_MS = 30_000;
+// The plugin's accounts.js status thresholds: auth selection's refresh margin and auth-health's oauth warn window.
+const EXPIRING_MS = 300_000;
+const OAUTH_WARN_MS = 86_400_000;
+// The plugin's account agent shape (D9) and agent id shape, as plugin/accounts.js tests them.
+const ACCOUNT_AGENT = /--[0-9a-f]{6}$/;
+const AGENT_ID = /^[a-z][a-z0-9-]{0,31}$/;
 const isPlainObject = (v) => typeof v === 'object' && v !== null && !Array.isArray(v);
 function mergeInto(target, patch) {
     for (const [key, value] of Object.entries(patch)) {
@@ -100,6 +106,9 @@ export function fakeGateway(script, o) {
     const handlers = new Map();
     const agents = new Map();
     const keys = new Map();
+    const profiles = new Map();
+    const orders = new Map();
+    const models = new Map();
     const wizards = new Map();
     const runs = new Map();
     const configBox = { hash: 'hash-1', config: {} };
@@ -114,10 +123,92 @@ export function fakeGateway(script, o) {
             agent.workspace = workspace;
         return agent;
     };
-    const signInAgent = (id, provider) => {
+    const storeOf = (id) => {
+        let store = profiles.get(id);
+        if (!store) {
+            store = {};
+            profiles.set(id, store);
+        }
+        return store;
+    };
+    const orderOf = (id) => {
+        let order = orders.get(id);
+        if (!order) {
+            order = {};
+            orders.set(id, order);
+        }
+        return order;
+    };
+    // As the plugin's accounts.js: `who` only exists for an OAuth profile that stores a provider account id.
+    const whoOf = (credential) => credential.type === 'oauth' && typeof credential.accountId === 'string' && credential.accountId.length > 0
+        ? createHash('sha256').update(`${credential.provider}\n${credential.accountId}`).digest('hex').slice(0, 16) : undefined;
+    const hasSecret = (value, ref) => (typeof value === 'string' && value.length > 0) || (!!ref && typeof ref === 'object' && !Array.isArray(ref));
+    // The plugin's token expiry state (credential-state.ts): missing, invalid, expired, or valid.
+    const expiryState = (expires, now) => {
+        if (expires === undefined)
+            return 'missing';
+        if (typeof expires !== 'number' || !Number.isFinite(expires) || expires <= 0 || expires > 8.64e13)
+            return 'invalid';
+        return expires <= now ? 'expired' : 'valid';
+    };
+    // The plugin's profile status (auth-health.ts) from the credential alone: static, ok, expiring, expired or missing.
+    const statusOf = (credential, now) => {
+        if (credential.type === 'api_key')
+            return hasSecret(credential.key, credential.keyRef) ? 'static' : 'missing';
+        if (credential.type === 'token') {
+            if (!hasSecret(credential.token, credential.tokenRef))
+                return 'missing';
+            const state = expiryState(credential.expires, now);
+            if (state === 'invalid')
+                return 'missing';
+            if (state === 'expired')
+                return 'expired';
+            if (credential.expires === undefined)
+                return 'static';
+            return credential.expires - now <= EXPIRING_MS ? 'expiring' : 'ok';
+        }
+        if (!hasSecret(credential.access, undefined) && !hasSecret(credential.refresh, undefined))
+            return 'missing';
+        const expires = credential.expires;
+        const state = expiryState(expires, now);
+        if (state === 'invalid' || state === 'missing')
+            return 'missing';
+        if (state === 'expired')
+            return 'expired';
+        return expires - now <= OAUTH_WARN_MS ? 'expiring' : 'ok';
+    };
+    const entryPrimaryOf = (id) => {
+        const entries = configBox.config.agents?.entries;
+        const entry = entries?.[id];
+        const ref = entry?.model;
+        if (typeof ref === 'string')
+            return ref;
+        if (isPlainObject(ref) && typeof ref.primary === 'string')
+            return ref.primary;
+        return undefined;
+    };
+    const primaryOfId = (id) => entryPrimaryOf(id) ?? models.get(id);
+    const setPrimaryOfId = (id, primary) => {
+        models.set(id, primary);
+        const entries = configBox.config.agents?.entries;
+        const entry = entries?.[id];
+        if (entry && isPlainObject(entry)) {
+            const current = entry.model;
+            if (isPlainObject(current))
+                current.primary = primary;
+            else
+                entry.model = primary;
+        }
+    };
+    const signInAgent = (id, provider, extra) => {
         const agent = ensureAgent(id);
         if (!agent.providers.includes(provider))
             agent.providers.push(provider);
+        // The pin names the first profile of a provider `<provider>:default` and points the agent's model at it.
+        storeOf(id)[`${provider}:default`] = { provider, type: 'oauth', status: 'ok', access: 'fake-access',
+            refresh: 'fake-refresh', expires: Date.now() + 30 * 86_400_000, accountId: `fake-${id}`, ...extra };
+        orderOf(id)[provider] = [`${provider}:default`];
+        setPrimaryOfId(id, `${provider}/default@${provider}:default`);
     };
     // Every transport the factory made; events fan out to all of them, drop() closes all of them.
     const live = new Set();
@@ -223,10 +314,20 @@ export function fakeGateway(script, o) {
             return { id };
         },
         // One profile per signed-in provider, `<provider>:default`, as the pin lists an agent's own profiles.
-        'models.authStatus': (p) => ({
-            providers: (agents.get(String(p?.agentId ?? 'main'))?.providers ?? []).map((provider) => ({ provider,
-                profiles: [{ profileId: `${provider}:default`, type: 'oauth', status: 'ok' }] })),
-        }),
+        'models.authStatus': (p) => {
+            const id = String(p?.agentId ?? 'main');
+            const store = storeOf(id);
+            const now = Date.now();
+            return {
+                providers: (agents.get(id)?.providers ?? []).map((provider) => {
+                    const profileId = `${provider}:default`;
+                    const credential = store[profileId];
+                    return { provider,
+                        profiles: [{ profileId, type: credential?.type ?? 'oauth',
+                                status: credential ? statusOf(credential, now) : 'ok' }] };
+                }),
+            };
+        },
         'models.authLogout': (p) => {
             const agent = agents.get(String(p?.agentId ?? 'main'));
             // The pin refuses a profileIds list naming a profile the agent does not hold.
@@ -235,6 +336,17 @@ export function fakeGateway(script, o) {
                 throw new Error('profileIds contain unavailable auth profiles');
             if (agent)
                 agent.providers = agent.providers.filter((provider) => provider !== p.provider);
+            const store = profiles.get(String(p.agentId ?? 'main'));
+            if (store)
+                for (const profileId of Object.keys(store))
+                    if (store[profileId].provider === p.provider)
+                        delete store[profileId];
+            const order = orders.get(String(p.agentId ?? 'main'));
+            if (order)
+                delete order[String(p.provider)];
+            const pin = models.get(String(p.agentId ?? 'main'));
+            if (typeof pin === 'string' && pin.includes(`@${String(p.provider)}:`))
+                models.delete(String(p.agentId ?? 'main'));
             if (keys.get(String(p.agentId))?.provider === p.provider)
                 keys.delete(String(p.agentId));
             return {};
@@ -255,6 +367,102 @@ export function fakeGateway(script, o) {
             }
             return { ok: key.sealed, ...(key.sealed ? { model: key.model } : {}) };
         },
+        // Account sealing (5.15): the same five actions, branches and refusals the shipped plugin method serves.
+        'byokit.accounts': (p) => {
+            const action = String(p.action ?? '');
+            const entries = configBox.config.agents?.entries;
+            const known = (id) => Boolean(id) && AGENT_ID.test(id) && ((Boolean(entries) && id in entries) || agents.has(id));
+            if (action === 'adopt') {
+                const from = String(p.from), to = String(p.to), provider = String(p.provider);
+                if (from === to || !known(from) || !known(to))
+                    return { ok: false };
+                if (typeof p.who !== 'string' || !p.who)
+                    return { ok: false };
+                const fromOrder = orderOf(from), named = fromOrder[provider] ?? [];
+                const fromId = named.length === 1 ? named[0] : undefined;
+                const credential = fromId ? storeOf(from)[fromId] : undefined;
+                if (!fromId || !credential || credential.provider !== provider || whoOf(credential) !== p.who)
+                    return { ok: false };
+                const target = primaryOfId(to);
+                if (typeof target !== 'string')
+                    return { ok: false };
+                const toStore = storeOf(to), toOrder = orderOf(to);
+                for (const [otherId, other] of Object.entries(toStore))
+                    if (ACCOUNT_AGENT.test(to) ? otherId !== fromId : other.provider === provider && otherId !== fromId)
+                        delete toStore[otherId];
+                toStore[fromId] = credential;
+                toOrder[provider] = [fromId];
+                if (!ensureAgent(to).providers.includes(provider))
+                    ensureAgent(to).providers.push(provider);
+                delete storeOf(from)[fromId];
+                if (fromOrder[provider]) {
+                    fromOrder[provider] = fromOrder[provider].filter((x) => x !== fromId);
+                    if (!fromOrder[provider].length)
+                        delete fromOrder[provider];
+                }
+                if (!Object.values(storeOf(from)).some((c) => c.provider === provider))
+                    ensureAgent(from).providers = ensureAgent(from).providers.filter((x) => x !== provider);
+                const cut = target.lastIndexOf('@');
+                setPrimaryOfId(to, `${cut > 0 ? target.slice(0, cut) : target}@${fromId}`);
+                return { ok: true };
+            }
+            const id = String(p.agentId ?? '');
+            if (!known(id))
+                return { ok: false };
+            const store = storeOf(id), order = orderOf(id);
+            if (action === 'list')
+                return { ok: true, profiles: Object.entries(store).map(([profileId, credential]) => ({ provider: credential.provider,
+                        profileId, type: credential.type, status: statusOf(credential, Date.now()), ...(whoOf(credential) ? { who: whoOf(credential) } : {}) })) };
+            if (action === 'clear') {
+                profiles.set(id, {});
+                orders.set(id, {});
+                const cleared = agents.get(id);
+                if (cleared)
+                    cleared.providers = [];
+                return { ok: true };
+            }
+            if (action === 'ready') {
+                const provider = String(p.provider ?? '');
+                const named = order[provider] ?? [];
+                const credential = named.length === 1 ? store[named[0]] : undefined;
+                if (!provider || !credential || credential.provider !== provider)
+                    return { ok: false };
+                const status = statusOf(credential, Date.now());
+                if (status === 'missing' || status === 'expired')
+                    return { ok: false };
+                return { ok: true, type: credential.type, ...(typeof credential.expires === 'number' ? { expiresAt: credential.expires } : {}),
+                    ...(whoOf(credential) ? { who: whoOf(credential) } : {}) };
+            }
+            if (action === 'seal') {
+                const primary = primaryOfId(id) ?? '';
+                const at = primary.lastIndexOf('@');
+                if (at < 1)
+                    return { ok: false };
+                const profileId = primary.slice(at + 1);
+                const credential = store[profileId];
+                const account = ACCOUNT_AGENT.test(id);
+                if (!credential || credential.provider !== p.provider || (!account && credential.type === 'api_key'))
+                    return { ok: false };
+                for (const [otherId, other] of Object.entries(store))
+                    if (account ? otherId !== profileId : other.provider === p.provider && otherId !== profileId)
+                        delete store[otherId];
+                // An account agent's whole order is replaced; a member's keeps its other providers, as plugin/accounts.js does.
+                const provider = String(p.provider);
+                if (account)
+                    orders.set(id, { [provider]: [profileId] });
+                else
+                    order[provider] = [profileId];
+                const sealedAgent = agents.get(id);
+                if (sealedAgent) {
+                    if (account)
+                        sealedAgent.providers = [provider];
+                    else if (!sealedAgent.providers.includes(provider))
+                        sealedAgent.providers.push(provider);
+                }
+                return { ok: true, ...(whoOf(credential) ? { who: whoOf(credential) } : {}) };
+            }
+            return { ok: false };
+        },
         'openclaw.setup.activate': (p) => {
             if (p.kind !== 'api-key')
                 throw new Error('only the API-key setup path is simulated');
@@ -397,8 +605,7 @@ export function fakeGateway(script, o) {
     const hello = () => ({
         protocol: PROTOCOL_VERSION,
         server: { version: ENGINE_VERSION },
-        // The methods the fake serves. The generated tables are type-only until O2 ships runtime names; O11's
-        // generated.test.ts cross-checks the real engine's hello against the committed tables.
+        // The methods the fake serves. The generated tables are type-only until O2 ships runtime names.
         methods: [...handlers.keys()].sort(),
         events: [...EVENTS],
     });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@byokit/openclaw",
-  "version": "0.10.0",
+  "version": "0.11.0",
   "description": "The OpenClaw runtime kit: the pinned engine's full operator surface with plain-words helpers for members, sign-in, runs and approvals.",
   "license": "Apache-2.0",
   "type": "module",
@@ -60,17 +60,17 @@
     "prepack": "tsc -b && node ../../scripts/fix-words-dts.cjs"
   },
   "dependencies": {
-    "@byokit/pair": "0.9.0",
-    "@byokit/relay": "0.6.0",
-    "@byokit/discover": "0.7.0",
+    "@byokit/pair": "0.10.0",
+    "@byokit/relay": "0.6.1",
+    "@byokit/discover": "0.8.0",
     "@byokit/seal": "0.3.0",
-    "@byokit/secrets": "0.5.0",
+    "@byokit/secrets": "0.5.1",
     "@openclaw/gateway-client": "2026.8.35",
     "@openclaw/gateway-protocol": "2026.8.35",
     "ws": "8.22.0"
   },
   "devDependencies": {
-    "@byokit/ui": "0.6.0"
+    "@byokit/ui": "0.7.0"
   },
   "publishConfig": {
     "access": "public"

package/plugin/accounts.js

@@ -0,0 +1,224 @@
+// Account sealing (5.15, O14): the gateway method `byokit.accounts` over one agent's own auth-profile store.
+// list/seal/ready/adopt/clear. Runs beside the other plugin methods; no credential value ever crosses an answer.
+// `who` is a one-way identity: the first 16 hex digits of sha256(`<provider>\n<accountId>`), so the account id
+// itself never leaves the engine.
+import { createHash } from 'node:crypto';
+import { isDeepStrictEqual } from 'node:util';
+
+// Local-only store I/O (as keys.js): never read through inherited auth and never sync an external CLI.
+const LOCAL = { filterExternalAuthProfiles: false, syncExternalCli: false };
+// An account agent is `<member>--<6 hex>` (D9); a member id never contains `--`.
+const ACCOUNT_AGENT = /--[0-9a-f]{6}$/;
+const AGENT_ID = /^[a-z][a-z0-9-]{0,31}$/;
+const EXPIRING_MS = 300_000;      // auth selection's refresh margin: at or under this, a token is "expiring"
+const OAUTH_WARN_MS = 86_400_000; // auth-health's default oauth warn window: a day out is still "expiring"
+
+const object = (v) => !!v && typeof v === 'object' && !Array.isArray(v);
+const primaryOf = (entry) => {
+  const ref = entry?.model;
+  return typeof ref === 'string' ? ref : object(ref) && typeof ref.primary === 'string' ? ref.primary : undefined;
+};
+const hasSecret = (value, ref) => (typeof value === 'string' && value.length > 0) || object(ref);
+/** The sign-in identity for an OAuth profile that stores the provider's account id; api_key/token never have one. */
+const whoOf = (credential) => credential?.type === 'oauth' && typeof credential.accountId === 'string' && credential.accountId.length > 0
+  ? createHash('sha256').update(`${credential.provider}\n${credential.accountId}`).digest('hex').slice(0, 16) : undefined;
+/** The engine's token expiry state (credential-state.ts): missing, invalid, expired, or valid. */
+const expiryState = (expires, now) => {
+  if (expires === undefined) return 'missing';
+  if (typeof expires !== 'number' || !Number.isFinite(expires) || expires <= 0 || expires > 8.64e13) return 'invalid';
+  return expires <= now ? 'expired' : 'valid';
+};
+/** The engine's profile status (auth-health.ts), from the credential alone: static, ok, expiring, expired or missing. */
+const statusOf = (credential, now) => {
+  if (credential.type === 'api_key') return hasSecret(credential.key, credential.keyRef) ? 'static' : 'missing';
+  if (credential.type === 'token') {
+    if (!hasSecret(credential.token, credential.tokenRef)) return 'missing';
+    const state = expiryState(credential.expires, now);
+    if (state === 'invalid') return 'missing';
+    if (state === 'expired') return 'expired';
+    if (credential.expires === undefined) return 'static';
+    return credential.expires - now <= EXPIRING_MS ? 'expiring' : 'ok';
+  }
+  if (!hasSecret(credential.access, undefined) && !hasSecret(credential.refresh, undefined)) return 'missing';
+  const state = expiryState(credential.expires, now);
+  if (state === 'invalid' || state === 'missing') return 'missing';
+  if (state === 'expired') return 'expired';
+  return credential.expires - now <= OAUTH_WARN_MS ? 'expiring' : 'ok';
+};
+
+/** A read (`fn` returns nothing) or a write when `fn` sets `store.changed`. Resolves the store, or null on lock contention. */
+function withStore(updateAuthProfileStoreWithLock, agentDir, fn) {
+  return updateAuthProfileStoreWithLock({ agentDir, saveOptions: LOCAL, updater(store) { return fn(store); } });
+}
+/** Keep only `profileId` of `provider`; on an account agent drop every other provider too. */
+const sealProfiles = (profiles, provider, profileId, account) => account
+  ? { [profileId]: { ...profiles[profileId] } }
+  : Object.fromEntries(Object.entries(profiles).filter(([id, p]) => p.provider !== provider || id === profileId));
+
+export function registerAccounts(api) {
+  api.registerGatewayMethod('byokit.accounts', async ({ params, respond }) => {
+    // Every failure answers { ok: false }; no engine error or store contents ever leave this method.
+    try { respond(true, await handle(params)); }
+    catch { respond(true, { ok: false }); }
+  }, { scope: 'operator.admin' });
+}
+
+async function handle(params) {
+  const { readFile } = await import('node:fs/promises');
+  const config = JSON.parse(await readFile(process.env.OPENCLAW_CONFIG_PATH, 'utf8'));
+  const { resolveAgentDir } = await import('openclaw/plugin-sdk/agent-runtime');
+  const { updateAuthProfileStoreWithLock } = await import('openclaw/plugin-sdk/provider-auth');
+  // adopt names both agents itself: it is the one action that does not address a single agent.
+  if (params?.action === 'adopt') return adopt(params, config, resolveAgentDir, updateAuthProfileStoreWithLock);
+
+  const agentId = params?.agentId;
+  if (typeof agentId !== 'string' || !AGENT_ID.test(agentId)) return { ok: false };
+  const entry = config.agents?.entries?.[agentId];
+  if (!entry) return { ok: false };
+  const agentDir = resolveAgentDir(config, agentId);
+  const read = (fn) => withStore(updateAuthProfileStoreWithLock, agentDir, fn);
+
+  if (params.action === 'list') {
+    const now = Date.now();
+    let rows;
+    const store = await read((s) => {
+      rows = Object.entries(s.profiles ?? {}).map(([profileId, credential]) => {
+        const row = { provider: credential.provider, profileId, type: credential.type, status: statusOf(credential, now) };
+        const who = whoOf(credential);
+        if (who) row.who = who;
+        return row;
+      });
+    });
+    return store && rows ? { ok: true, profiles: rows } : { ok: false };
+  }
+
+  if (params.action === 'ready') {
+    const provider = params.provider;
+    if (typeof provider !== 'string' || !provider) return { ok: false };
+    const now = Date.now();
+    let answer;
+    const store = await read((s) => {
+      const order = s.order?.[provider];
+      const profileId = Array.isArray(order) && order.length === 1 ? order[0] : undefined;
+      const credential = profileId ? s.profiles?.[profileId] : undefined;
+      if (!credential || credential.provider !== provider) return;
+      const status = statusOf(credential, now);
+      if (status === 'missing' || status === 'expired') return;
+      answer = { type: credential.type };
+      if (typeof credential.expires === 'number') answer.expiresAt = credential.expires;
+      const who = whoOf(credential);
+      if (who) answer.who = who;
+    });
+    return store && answer ? { ok: true, ...answer } : { ok: false };
+  }
+
+  if (params.action === 'seal') {
+    const provider = params.provider;
+    if (typeof provider !== 'string' || !provider) return { ok: false };
+    const primary = primaryOf(entry);
+    const at = typeof primary === 'string' ? primary.lastIndexOf('@') : -1;
+    if (at < 1) return { ok: false };
+    const profileId = primary.slice(at + 1);
+    const account = ACCOUNT_AGENT.test(agentId);
+    let who;
+    let sealed = false;
+    const store = await updateAuthProfileStoreWithLock({ agentDir, saveOptions: LOCAL, updater(s) {
+      const credential = s.profiles?.[profileId];
+      // No such profile, or the named profile belongs to another provider; on a member agent an api_key is refused.
+      if (!credential || credential.provider !== provider || (!account && credential.type === 'api_key')) return false;
+      who = whoOf(credential);
+      s.profiles = sealProfiles(s.profiles, provider, profileId, account);
+      s.order = account ? { [provider]: [profileId] } : { ...(s.order ?? {}), [provider]: [profileId] };
+      if (object(s.lastGood) && provider in s.lastGood) delete s.lastGood[provider];
+      sealed = true;
+      return true;
+    } });
+    return store && sealed ? { ok: true, ...(who ? { who } : {}) } : { ok: false };
+  }
+
+  if (params.action === 'clear') {
+    const cleared = await updateAuthProfileStoreWithLock({ agentDir, saveOptions: LOCAL, updater(s) {
+      s.profiles = {}; s.order = {}; delete s.lastGood; return true;
+    } });
+    return cleared ? { ok: true } : { ok: false };
+  }
+
+  return { ok: false };
+}
+
+/** Move `from`'s sealed profile of `provider` into `to` and point `to`'s model at it, or answer { ok: false } with both
+ * stores and the model as they were. The three writes are separate transactions, so any failure after the first is
+ * undone in reverse: a partial move (or a model pin to a profile no store holds) must never outlive the answer. */
+async function adopt(params, config, resolveAgentDir, updateAuthProfileStoreWithLock) {
+  const { from, to, provider, who } = params;
+  if (typeof from !== 'string' || !AGENT_ID.test(from) || typeof to !== 'string' || !AGENT_ID.test(to)
+    || typeof provider !== 'string' || !provider || typeof who !== 'string' || !who) return { ok: false };
+  if (from === to) return { ok: false };
+  if (!config.agents?.entries?.[from] || !config.agents?.entries?.[to]) return { ok: false };
+  const fromDir = resolveAgentDir(config, from);
+  const toDir = resolveAgentDir(config, to);
+  // from's sealed profile (order[provider] names exactly it) must carry exactly this who, or nothing changes.
+  let fromId;
+  let moved;
+  await withStore(updateAuthProfileStoreWithLock, fromDir, (s) => {
+    const order = s.order?.[provider];
+    fromId = Array.isArray(order) && order.length === 1 ? order[0] : undefined;
+    const credential = fromId ? s.profiles?.[fromId] : undefined;
+    if (credential && credential.provider === provider && whoOf(credential) === who) moved = credential;
+  });
+  if (!moved) return { ok: false };
+  // The model's current primary names the shape (string or object) and the base ref the new pin keeps.
+  const target = primaryOf(config.agents.entries[to]);
+  if (typeof target !== 'string') return { ok: false };
+  const cut = target.lastIndexOf('@');
+  const base = cut > 0 ? target.slice(0, cut) : target;
+  const { updateConfig } = await import('openclaw/plugin-sdk/config-runtime');
+  const { setAgentEffectiveModelPrimary } = await import('openclaw/plugin-sdk/agent-runtime');
+  const pin = (primary) => updateConfig((cfg) => { setAgentEffectiveModelPrimary(cfg, to, primary, { forceAgent: true }); return cfg; });
+
+  const account = ACCOUNT_AGENT.test(to);
+  let pre;
+  const restoreTo = () => updateAuthProfileStoreWithLock({ agentDir: toDir, saveOptions: LOCAL, updater(s) {
+    s.profiles = pre.profiles;
+    if (pre.order === undefined) delete s.order; else s.order = pre.order;
+    if (pre.lastGood === undefined) delete s.lastGood; else s.lastGood = pre.lastGood;
+    return true;
+  } });
+  try {
+    // Rewrite to's model primary @ suffix to from's sealed id before any store move: the pin would otherwise keep
+    // pinning the profile we are about to delete.
+    await pin(`${base}@${fromId}`);
+    // Move the record unchanged into to's store, sealed to it (dropping to's old profile of provider), then clear it
+    // from from. The grant stays shared; each agent holds only its own view (D11).
+    const sealed = await updateAuthProfileStoreWithLock({ agentDir: toDir, saveOptions: LOCAL, updater(s) {
+      pre = { profiles: s.profiles, order: s.order, lastGood: object(s.lastGood) ? { ...s.lastGood } : s.lastGood };
+      s.profiles = { ...sealProfiles(s.profiles, provider, fromId, account), [fromId]: moved };
+      s.order = { ...(s.order ?? {}), [provider]: [fromId] };
+      if (object(s.lastGood) && provider in s.lastGood) delete s.lastGood[provider];
+      return true;
+    } });
+    if (!sealed) { await pin(target); return { ok: false }; }
+    let clearedOk = false;
+    const cleared = await updateAuthProfileStoreWithLock({ agentDir: fromDir, saveOptions: LOCAL, updater(s) {
+      // A refresh between the read and this clear must not be deleted with the stale snapshot: refuse when the
+      // live record no longer equals the moved one (a who check alone would miss it; the account id never
+      // changes on refresh), and the caller rolls the move back.
+      if (!isDeepStrictEqual(s.profiles?.[fromId], moved)) return false;
+      if (s.profiles) delete s.profiles[fromId];
+      if (s.order?.[provider]) {
+        s.order[provider] = s.order[provider].filter((id) => id !== fromId);
+        if (!s.order[provider].length) delete s.order[provider];
+      }
+      clearedOk = true;
+      return true;
+    } });
+    if (cleared && clearedOk) return { ok: true };
+    await restoreTo();
+    await pin(target);
+    return { ok: false };
+  } catch {
+    await pin(target).catch(() => {});
+    if (pre) await restoreTo().catch(() => {});
+    return { ok: false };
+  }
+}

package/plugin/index.js

@@ -5,6 +5,7 @@ import { connect } from 'node:net';
 import { readFileSync } from 'node:fs';
 import { registerKeys } from './keys.js';
 import { registerUsage } from './usage.js';
+import { registerAccounts } from './accounts.js';
 
 /** TypeBox's Kind is a global symbol, so these schemas are valid TypeBox without importing typebox. */
 const Kind = Symbol.for('TypeBox.Kind');
@@ -146,7 +147,7 @@ export default {
     jsonSchema: { type: 'object', additionalProperties: false, properties: {} },
   },
   register(api) {
-    if (api.registerGatewayMethod) { registerKeys(api); registerUsage(api); }
+    if (api.registerGatewayMethod) { registerKeys(api); registerUsage(api); registerAccounts(api); }
     if (BROWSER) {
       if (typeof api.registerAgentToolResultMiddleware !== 'function') throw new Error('browser result protection unavailable');
       api.registerAgentToolResultMiddleware(async (event, ctx) => {