@byokit/openclaw 0.12.0 → 0.14.0

package/dist/auth-store.d.ts

@@ -53,6 +53,8 @@ export declare class AuthStore {
      *  and in `home` exactly the sealed paths — regenerable caches and the directories still holding them are left in place. */
     private remove;
     private sealObjects;
+    /** Re-attach held-back sealed paths a damaged index kept out of the live inventory. */
+    private mergeHeldBack;
     private persist;
     /** `mkdir -p` for a restore target that records the parent of every directory it creates: a new directory
      *  changes its parent's entries, so the parent needs a directory fsync too. Stops at the store root (it exists)
@@ -61,6 +63,12 @@ export declare class AuthStore {
     private restore;
     archives(): Promise<void>;
     prepare(): Promise<void>;
+    /** Re-seal the credential snapshot while the engine runs (removeAccount): it drops the removed profile at once
+     *  instead of waiting for stop, and read() drops the removed agent's sealed objects. Database objects are never
+     *  read here — each keeps its last sealed copy until stop, when persist() seals the live databases. Live files
+     *  stay in place — unlike persist(), nothing is removed and no crash-transition recovery runs, so this never
+     *  deletes the tree a live engine is running on. No-op without a seal or while the store is not active. */
+    reseal(): Promise<void>;
     start(): Promise<void>;
     stop(): Promise<void>;
     offline<T>(task: () => Promise<T>): Promise<T>;

package/dist/auth-store.js

@@ -8,6 +8,8 @@ import { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync,
 import { createHash } from 'node:crypto';
 import { dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
 import { EngineAlreadyRunningError, pidAlive as live } from "./engine-status.js";
+import { damagedAccountMembers, heldBackAgent, removedAccountAgents, sweepOrphans } from "./accounts.js";
+const agentDirOf = (path) => path.startsWith('state/agents/') ? path.split('/')[2] : undefined;
 const encoder = new TextEncoder();
 const archive = (name) => !name.endsWith('.sealed') && (/^(auth-profiles|auth-state|auth|oauth)\.json\.(migrated-.+|sqlite-import\..+\.bak)$/.test(name)
     || name.endsWith('.moved-to-engine'));
@@ -140,6 +142,11 @@ function safePath(path) {
     return typeof path === 'string' && /^(state|home)(\/[^/]+)*$/.test(path)
         && !path.split('/').some((part) => part === '.' || part === '..' || part.includes('\\') || part.includes('\0'));
 }
+// A file the live engine deletes between the directory listing and the read is simply gone: there is nothing to
+// seal, so callers skip it. Every other failure still throws.
+function vanished(error) {
+    return error.code === 'ENOENT';
+}
 function snapshot(text) {
     const s = JSON.parse(text);
     if ((s?.v !== 1 && s?.v !== 2) || !Array.isArray(s.dirs) || !Array.isArray(s.files))
@@ -206,8 +213,9 @@ export class AuthStore {
     cleanup;
     restoring;
     // Object file name -> sha256 of the plaintext payload currently sealed at that file. Kept only in memory: it
-    // never becomes on-disk metadata. Filled by restore() from what is decrypted, refreshed after each successful
-    // seal. A process that never restored starts with an empty map and reseals every object, as before.
+    // never becomes on-disk metadata. Filled by restore() from what is decrypted (except objects in an older wrap
+    // mode), refreshed after each successful seal. A process that never restored starts with an empty map and
+    // reseals every object, as before.
     objectHashes = new Map();
     constructor(privateOptions) {
         this.o = privateOptions;
@@ -315,19 +323,42 @@ export class AuthStore {
         catch {
             throw new AuthStoreUnreadableError('invalid-snapshot');
         }
-        const upgraded = seal.upgrade?.(bytes);
-        if (upgraded) {
-            if (seal.decryptString(Buffer.from(upgraded)) !== text)
-                throw new Error('credential upgrade verification failed');
-            put(this.file, upgraded);
+        // Removed agents leave the sealed store; damaged-index agents stay sealed (held back) until their index is repaired.
+        const gone = removedAccountAgents(this.o.root);
+        const keep = (path) => {
+            const agent = agentDirOf(path);
+            return agent === undefined || !gone.has(agent);
+        };
+        const kept = { v: 1, dirs: saved.dirs.filter(keep), files: saved.files.filter(([path]) => keep(path)) };
+        if (kept.dirs.length !== saved.dirs.length || kept.files.length !== saved.files.length) {
+            this.seal(this.file, JSON.stringify(kept));
+        }
+        else {
+            const upgraded = seal.upgrade?.(bytes);
+            if (upgraded) {
+                if (seal.decryptString(Buffer.from(upgraded)) !== text)
+                    throw new Error('credential upgrade verification failed');
+                put(this.file, upgraded);
+            }
+        }
+        if (gone.size && existsSync(this.objects)) {
+            for (const entry of readdirSync(this.objects)) {
+                const file = join(this.objects, entry);
+                if (keep(this.readObject(file)[0]))
+                    continue;
+                rmSync(file);
+                this.objectHashes.delete(entry);
+            }
         }
-        return saved;
+        return kept;
     }
     readObject(file) {
+        let bytes = Buffer.alloc(0);
         let text = '';
         let entry = null;
         try {
-            text = this.open(readFileSync(file));
+            bytes = readFileSync(file);
+            text = this.open(bytes);
             entry = JSON.parse(text);
         }
         catch (error) {
@@ -340,7 +371,7 @@ export class AuthStore {
         if (!safePath(path) || !apart(path) || typeof data !== 'string' || Buffer.from(data, 'base64').toString('base64') !== data) {
             throw new AuthStoreUnreadableError('invalid-snapshot');
         }
-        return [path, data, text];
+        return [path, data, text, bytes];
     }
     inventory() {
         const dirs = [];
@@ -348,15 +379,41 @@ export class AuthStore {
         const objects = [];
         let total = 0;
         const root = realpathSync(this.o.root);
+        const gone = removedAccountAgents(this.o.root);
+        const damaged = damagedAccountMembers(this.o.root);
         const walk = (path) => {
             const name = relative(this.o.root, path).split('\\').join('/');
+            if (name.startsWith('state/agents/')) {
+                const agent = name.split('/')[2];
+                if (gone.has(agent))
+                    return; // a late refresh never enters a seal
+                if (heldBackAgent(agent, damaged))
+                    return; // damaged index: leave sealed copy; never reseal a late live write
+            }
             if (name.startsWith('home/') && nonCredential(name))
                 return; // regenerable home caches stay on disk; skipping a directory skips its subtree
-            const stat = lstatSync(path);
+            let stat;
+            try {
+                stat = lstatSync(path);
+            }
+            catch (error) {
+                if (vanished(error))
+                    return;
+                throw error;
+            }
             if (stat.isDirectory()) {
                 if (!apart(name))
                     dirs.push(name);
-                for (const child of readdirSync(path).sort())
+                let children;
+                try {
+                    children = readdirSync(path).sort();
+                }
+                catch (error) {
+                    if (vanished(error))
+                        return;
+                    throw error;
+                }
+                for (const child of children)
                     walk(join(path, child));
                 return;
             }
@@ -374,7 +431,14 @@ export class AuthStore {
                 const rel = relative(root, file);
                 if (isAbsolute(rel) || rel === '..' || rel.startsWith(`..${sep}`))
                     return;
-                target = lstatSync(file);
+                try {
+                    target = lstatSync(file);
+                }
+                catch (error) {
+                    if (vanished(error))
+                        return;
+                    throw error;
+                }
             }
             if (!target.isFile())
                 return;
@@ -396,15 +460,44 @@ export class AuthStore {
         return { dirs, files, objects };
     }
     collect() {
+        sweepOrphans(this.o.root, this.o.log);
         const { dirs, files, objects } = this.inventory();
-        for (const dir of dirs)
-            chmodSync(join(this.o.root, dir), 0o700);
-        // Read the checked target, but save the link's path: restore materializes a regular file there.
-        for (const { file } of [...files, ...objects])
-            chmodSync(file, 0o600);
+        for (const dir of dirs) {
+            try {
+                chmodSync(join(this.o.root, dir), 0o700);
+            }
+            catch (error) {
+                if (!vanished(error))
+                    throw error;
+            }
+        }
+        // Read the checked target, but save the link's path: restore materializes a regular file there. A file that
+        // vanishes here is skipped by the same rule as in the listing above.
+        const read = ({ name, file }) => {
+            try {
+                chmodSync(file, 0o600);
+                return [name, readFileSync(file).toString('base64')];
+            }
+            catch (error) {
+                if (vanished(error))
+                    return undefined;
+                throw error;
+            }
+        };
+        const kept = objects.filter(({ file }) => {
+            try {
+                chmodSync(file, 0o600);
+                return true;
+            }
+            catch (error) {
+                if (vanished(error))
+                    return false;
+                throw error;
+            }
+        });
         return {
-            saved: { v: 1, dirs, files: files.map(({ name, file }) => [name, readFileSync(file).toString('base64')]) },
-            objects,
+            saved: { v: 1, dirs, files: files.map(read).filter((entry) => entry !== undefined) },
+            objects: kept,
         };
     }
     /** Remove the live sealed trees: all of `state` (every file there is sealed, as a blob entry or an object),
@@ -431,10 +524,19 @@ export class AuthStore {
         mkdirSync(this.objects, { recursive: true, mode: 0o700 });
         const keep = new Set();
         for (const { name, file } of objects) {
+            let data;
+            try {
+                data = readFileSync(file).toString('base64');
+            }
+            catch (error) {
+                if (vanished(error))
+                    continue;
+                throw error;
+            }
             const object = objectName(name);
             keep.add(object);
             const target = join(this.objects, object);
-            const payload = JSON.stringify({ path: name, data: readFileSync(file).toString('base64') });
+            const payload = JSON.stringify({ path: name, data });
             // An object this process already sealed (or restored) unchanged is not resealed: its plaintext hash is
             // the same and its sealed file is still on disk, so the encrypt + verify + fsyncs are skipped. A changed
             // file, a new one, or one whose sealed file vanished falls through to the normal seal.
@@ -445,10 +547,48 @@ export class AuthStore {
             this.seal(target, payload);
             this.objectHashes.set(object, hash);
         }
+        // Held-back agent objects stay sealed while their index is damaged (inventory skipped their live trees).
+        const damaged = damagedAccountMembers(this.o.root);
+        if (damaged.size) {
+            for (const entry of readdirSync(this.objects)) {
+                if (keep.has(entry))
+                    continue;
+                try {
+                    const agent = agentDirOf(this.readObject(join(this.objects, entry))[0]);
+                    if (agent !== undefined && heldBackAgent(agent, damaged))
+                        keep.add(entry);
+                }
+                catch { /* unreadable object: leave for the next start's auth-store check */ }
+            }
+        }
         for (const entry of readdirSync(this.objects))
             if (!keep.has(entry))
                 rmSync(join(this.objects, entry), { force: true });
     }
+    /** Re-attach held-back sealed paths a damaged index kept out of the live inventory. */
+    mergeHeldBack(previous, saved) {
+        if (!previous)
+            return;
+        const damaged = damagedAccountMembers(this.o.root);
+        if (!damaged.size)
+            return;
+        const held = (path) => {
+            const agent = agentDirOf(path);
+            return agent !== undefined && heldBackAgent(agent, damaged);
+        };
+        const dirs = new Set(saved.dirs);
+        for (const dir of previous.dirs)
+            if (held(dir) && !dirs.has(dir)) {
+                saved.dirs.push(dir);
+                dirs.add(dir);
+            }
+        const files = new Set(saved.files.map(([path]) => path));
+        for (const entry of previous.files)
+            if (held(entry[0]) && !files.has(entry[0])) {
+                saved.files.push(entry);
+                files.add(entry[0]);
+            }
+    }
     async persist() {
         if (!this.o.seal)
             return;
@@ -466,6 +606,7 @@ export class AuthStore {
         // A running engine always leaves files behind (its SQLite stores), so a genuine sign-out still re-seals.
         if (!saved.files.length && !objects.length && previous)
             return;
+        this.mergeHeldBack(previous, saved);
         // The payload is built exactly once; verification decrypts the sealed bytes and compares to it.
         this.seal(this.file, JSON.stringify(saved));
         if (previous?.dirs.some(nonCredential))
@@ -491,19 +632,35 @@ export class AuthStore {
         if (!this.o.seal)
             return;
         const saved = await this.read();
+        const damaged = damagedAccountMembers(this.o.root);
+        const skipHeld = (path) => {
+            const agent = agentDirOf(path);
+            return agent !== undefined && heldBackAgent(agent, damaged);
+        };
         // A crashed host may leave a newer live state; prepare seals that before restore.
         put(this.restoring, encoder.encode('1'));
         const changed = new Set();
         if (saved) {
-            for (const dir of saved.dirs.sort((a, b) => a.split('/').length - b.split('/').length))
+            for (const dir of saved.dirs.sort((a, b) => a.split('/').length - b.split('/').length)) {
+                if (skipHeld(dir))
+                    continue;
                 this.ensureRestoreDirs(join(this.o.root, dir), changed);
-            for (const [path, data] of saved.files)
+            }
+            for (const [path, data] of saved.files) {
+                if (skipHeld(path))
+                    continue;
                 putRestore(join(this.o.root, path), Buffer.from(data, 'base64'), changed);
+            }
         }
         if (existsSync(this.objects)) {
             for (const entry of readdirSync(this.objects)) {
-                const [path, data, payload] = this.readObject(join(this.objects, entry));
-                this.objectHashes.set(entry, objectHash(payload));
+                const [path, data, payload, bytes] = this.readObject(join(this.objects, entry));
+                // An object sealed in an older wrap mode (the adapter would upgrade it, as read() does the main file) gets
+                // no hash, so the next seal reseals it in the current mode even when unchanged.
+                if (!this.o.seal.upgrade?.(bytes))
+                    this.objectHashes.set(entry, objectHash(payload));
+                if (skipHeld(path))
+                    continue;
                 // An object path can be several directories below an existing one, and those directories are not in
                 // `saved.dirs` (they sit in a non-credential subtree). Create them through ensureRestoreDirs so the
                 // parent of every directory this restore creates — not just each object's own directory — is fsynced
@@ -558,6 +715,26 @@ export class AuthStore {
             }
         });
     }
+    /** Re-seal the credential snapshot while the engine runs (removeAccount): it drops the removed profile at once
+     *  instead of waiting for stop, and read() drops the removed agent's sealed objects. Database objects are never
+     *  read here — each keeps its last sealed copy until stop, when persist() seals the live databases. Live files
+     *  stay in place — unlike persist(), nothing is removed and no crash-transition recovery runs, so this never
+     *  deletes the tree a live engine is running on. No-op without a seal or while the store is not active. */
+    async reseal() {
+        return this.serial(async () => {
+            if (!this.o.seal || !this.active)
+                return;
+            const previous = await this.read();
+            const { saved, objects } = this.collect();
+            // Same debris guard as persist(): a running engine always leaves files behind, so an empty live tree
+            // keeps the sealed credentials instead of replacing them with an empty snapshot.
+            if (!saved.files.length && !objects.length && previous)
+                return;
+            this.mergeHeldBack(previous, saved);
+            this.seal(this.file, JSON.stringify(saved));
+            // Database objects stay at their last stop-time seal; only the credential blob is refreshed here.
+        });
+    }
     start() {
         return this.serial(async () => {
             if (this.active)

package/dist/engine.d.ts

@@ -1,3 +1,4 @@
+import { remoteCliHost } from '@byokit/accounts/cli';
 import { AuthStore, AuthStoreSealSizeError } from './auth-store.ts';
 import type { KitOptions } from './kit.ts';
 import type { KitState, ToolSpec } from './types.ts';
@@ -28,6 +29,10 @@ export declare class Engine {
     private starting?;
     readonly authStore: AuthStore;
     private stopping;
+    private stopOwner;
+    private claudeLogin?;
+    private claudeAccounts?;
+    private claudeReset?;
     private credentialsLocked;
     private repaired;
     private prepared?;
@@ -49,11 +54,16 @@ export declare class Engine {
         entry: string;
         env: Record<string, string>;
     };
+    /** The engine's own shutdown signal; aborted by stop() and replaced by the next start(). */
+    get stopSignal(): AbortSignal;
+    nativeClaudeLogin(): ReturnType<typeof remoteCliHost>;
+    resetNativeClaudeLogin(): Promise<void>;
     doctor(timeoutMs: number): {
         status: number | null;
     };
     private verifiedOrphan;
     private recoverOrphan;
+    private sweepAccountOrphans;
     start(): Promise<{
         port: number;
         token: string;

package/dist/engine.js

@@ -1,10 +1,11 @@
 import { spawn, spawnSync } from 'node:child_process';
 import { randomBytes, generateKeyPairSync, randomUUID } from 'node:crypto';
-import { closeSync, existsSync, mkdirSync, openSync, readFileSync, writeFileSync, copyFileSync, rmSync, realpathSync, statSync } from 'node:fs';
+import { accessSync, constants, closeSync, existsSync, mkdirSync, openSync, readFileSync, writeFileSync, copyFileSync, rmSync, realpathSync, statSync } from 'node:fs';
 import { createServer } from 'node:net';
 import { basename, join, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { setTimeout as delay } from 'node:timers/promises';
+import { cliAccounts, remoteCliHost } from '@byokit/accounts/cli';
 import { AuthStore, AuthStoreUnreadableError, AuthStoreSealSizeError } from "./auth-store.js";
 import { EngineAlreadyRunningError, pidAlive, StartedProcesses } from "./engine-status.js";
 import { EnginePatchError, atomic, prepareEngineSet, processStartTime, readPatchSet, sha256, verifyEngineSet } from "./engine-patches.js";
@@ -12,6 +13,7 @@ import { ENGINE_VERSION } from "./constants.js";
 import { appendUsageBoot } from "./usage-boots.js";
 import { reconcileConfig, appRecoveryPrefixes } from "./config.js";
 import { writePlugin, resolveBridge } from "./bridge.js";
+import { sweepOrphans } from "./accounts.js";
 const kitDir = dirname(dirname(fileURLToPath(import.meta.url)));
 const putOnce = (path, data) => { if (!existsSync(path))
     writeFileSync(path, data, { mode: 0o600, flag: 'wx' }); };
@@ -75,6 +77,13 @@ export class Engine {
     starting;
     authStore;
     stopping = false;
+    // Aborted by stop(): a sign-in drive that has not reached its commit point then declines at once, the key paste
+    // included (it has no native host signal of its own). start() replaces it, so an earlier shutdown cannot decline
+    // a later drive.
+    stopOwner = new AbortController();
+    claudeLogin;
+    claudeAccounts;
+    claudeReset;
     credentialsLocked = false;
     repaired = false;
     prepared;
@@ -161,6 +170,7 @@ export class Engine {
         await this.recoverOrphan();
         for (const d of [this.root, ...(!this.o.authSeal ? [join(this.root, 'home'), join(this.root, 'state')] : []), join(this.root, 'tmp'), join(this.root, 'usage'), join(this.root, 'install-home'), join(this.root, 'npm-cache'), join(this.o.stateDir, 'logs')])
             mkdirSync(d, { recursive: true, mode: 0o700 });
+        this.sweepAccountOrphans();
         try {
             await this.authStore.prepare();
             this.credentialsLocked = false;
@@ -283,6 +293,42 @@ export class Engine {
                 BYOKIT_APP_OWNED_SESSION_PREFIXES: JSON.stringify(this.appOwnedSessionPrefixes),
             } };
     }
+    /** The engine's own shutdown signal; aborted by stop() and replaced by the next start(). */
+    get stopSignal() { return this.stopOwner.signal; }
+    nativeClaudeLogin() {
+        if (this.claudeLogin)
+            return this.claudeLogin;
+        const { env } = this.doctorContext();
+        const bin = env.PATH.split(':').map(path => join(path, 'claude')).find(path => { try {
+            accessSync(path, constants.X_OK);
+            return true;
+        }
+        catch {
+            return false;
+        } });
+        const bins = bin ? { claude: bin } : {};
+        // The login runs in its own HOME: CLAUDE_CONFIG_DIR points it at the engine's folder, which accounts refuses as a HOME's default login.
+        for (const dir of ['home', 'login-home'])
+            mkdirSync(join(this.root, dir), { recursive: true, mode: 0o700 });
+        const cli = cliAccounts({ stateDir: this.root, bins, env: { PATH: env.PATH, HOME: join(this.root, 'login-home'), LANG: env.LANG, TMPDIR: env.TMPDIR, XDG_CONFIG_HOME: env.XDG_CONFIG_HOME, XDG_CACHE_HOME: env.XDG_CACHE_HOME, XDG_DATA_HOME: env.XDG_DATA_HOME, XDG_STATE_HOME: env.XDG_STATE_HOME, }, managedFolders: { claude: env.CLAUDE_CONFIG_DIR } });
+        this.claudeAccounts = cli;
+        this.claudeLogin = remoteCliHost({ cli, bins });
+        return this.claudeLogin;
+    }
+    resetNativeClaudeLogin() {
+        if (this.claudeReset)
+            return this.claudeReset;
+        const cli = this.claudeAccounts, host = this.claudeLogin;
+        if (!cli || !host || host.signal.aborted)
+            return Promise.resolve();
+        this.claudeReset = (async () => { for (const row of await cli.list()) {
+            if (host.signal.aborted)
+                return;
+            if (row.provider === 'claude' && row.state === 'ready' && cli.folderOf(row.id) === join(this.root, 'home', '.claude'))
+                await cli.remove(row.id);
+        } })().finally(() => { this.claudeReset = undefined; });
+        return this.claudeReset;
+    }
     doctor(timeoutMs) {
         const { entry, env } = this.doctorContext();
         if (this.o.spawnEngine)
@@ -351,10 +397,24 @@ export class Engine {
             throw occupied();
         // The new store owner now seals crash leftovers under its lock before restoring them.
     }
+    // The account orphan sweep (5.15): a late engine write after a removal cannot be ruled out by a bounded check, so
+    // prepare and the sealed restore remove each `<root>/state/agents/<member>--<hex6>` directory a removal recorded as
+    // gone and no index names, and drop member-store auth profiles a removal recorded as `dropped`. No roster here: the
+    // gateway is down, and no add is in flight while preparing (an entry is written before its agent is created, so an
+    // account being added is named).
+    sweepAccountOrphans() {
+        try {
+            sweepOrphans(this.root, this.o.log);
+        }
+        catch (error) {
+            this.o.log?.(`prepare: orphans are not swept: ${String(error.message).slice(0, 200)}`);
+        }
+    }
     start() {
         if (this.starting)
             return this.starting;
         this.stopping = false;
+        this.stopOwner = new AbortController();
         const pending = this.startOnce();
         this.starting = pending;
         void pending.finally(() => { if (this.starting === pending)
@@ -382,6 +442,7 @@ export class Engine {
                 this.state('failed', 'auth-store-unreadable');
             throw error;
         }
+        this.sweepAccountOrphans();
         try {
             return this.launch();
         }
@@ -499,6 +560,11 @@ export class Engine {
     withAuthStore(task) { return this.authStore.offline(task); }
     async stop() {
         this.stopping = true;
+        this.stopOwner.abort();
+        await this.claudeLogin?.close();
+        await this.claudeReset?.catch(() => { });
+        this.claudeLogin = undefined;
+        this.claudeAccounts = undefined;
         await this.starting?.catch(() => { });
         const child = this.child;
         await this.started.terminate(delay);

package/dist/index.d.ts

@@ -1,10 +1,10 @@
 export { ENGINE_VERSION, OPERATOR_SCOPES, PROTOCOL_VERSION } from './constants.ts';
-export type { Account, AccountId, AccountPick, AccountRef, Approval, CallOptions, Considered, Decision, Defaults, ModelInfo, MoveResult, PickWhy, Room, RoomSpan, RunSelection, SignInState, GatewayEventName, GatewayEventPayload, GatewayMethod, GatewayParams, GatewayResult, GatewayTransport, GateResult, Hello, KitState, KitEventName, KitEventPayload, BrowserPing, LearningCapture, LearningMode, Member, PlanWindow, Route, RunEnd, RunEvent, RunRef, RunSpec, OutputSchema, SchemaOutput, RunUsage, SignInOptions, SignInView, ToolHost, ToolSpec, } from './types.ts';
+export type { Account, AccountId, AccountPick, AccountRef, Approval, CallOptions, Considered, Decision, Defaults, ModelInfo, MoveResult, PickWhy, Room, RoomSpan, RunSelection, SignInState, GatewayEventName, GatewayEventPayload, GatewayMethod, GatewayParams, GatewayResult, GatewayTransport, GateResult, Hello, KitState, KitEventName, KitEventPayload, BrowserPing, LearningCapture, LearningMode, Member, PlanWindow, Route, RunEnd, RunEvent, RunRef, RunSpec, OutputSchema, SchemaOutput, RunUsage, ThinkingAsked, ThinkingReport, ThinkingUsed, SignInOptions, SignInView, ToolHost, ToolSpec, } from './types.ts';
 export type { GatewayMethods } from './generated/methods.ts';
 export type { JsonValue } from './output.ts';
 export type { RouteFacts, RouteView } from './routes.ts';
 export { OpenClawKit, type KitOptions, type RetainedLogin } from './kit.ts';
-export type { AddKeyResult, KeyFailureReason } from './keys.ts';
+export type { AddKeyHandle, AddKeyResult, KeyFailureReason } from './keys.ts';
 export { stateWords, toAccountView, words, type AccountView, type WordKey } from './words.ts';
 export { chooseAccount, consider, resolveSelection, type RoomOf } from './pick.ts';
 export { AuthStoreUnreadableError, AuthStoreSealSizeError } from './auth-store.ts';

package/dist/keys.d.ts

@@ -1,4 +1,5 @@
 import { type ActivationCtx } from './activation.ts';
+import { type RouteView } from './routes.ts';
 import type { Member, ModelInfo } from './types.ts';
 export type KeyFailureReason = 'auth' | 'billing' | 'empty' | 'model' | 'network' | 'engine' | 'inference' | 'busy';
 export type AddKeyResult = {
@@ -7,6 +8,10 @@ export type AddKeyResult = {
     status: 'invalid' | 'not_included' | 'retry';
     reason: KeyFailureReason;
 };
+/** The add resolves like a Promise; `cancel()` stops a pending add and clears any partial key (retry/busy). */
+export type AddKeyHandle = Promise<AddKeyResult> & {
+    cancel(): void;
+};
 export declare function createKeys(ctx: ActivationCtx & {
     root: string;
     ensure(member: Member): Promise<{
@@ -14,6 +19,9 @@ export declare function createKeys(ctx: ActivationCtx & {
     }>;
     restarting?(): boolean;
     prepareOwner(agentId: string): Promise<void>;
+    indexLane(member: Member, route: RouteView): Promise<void>;
+    dropLane(member: Member, provider?: string): Promise<void>;
+    backfillLane(member: Member, model: string | undefined): Promise<void>;
 }): {
     models: (member: Member, o: {
         authChoice: string;
@@ -23,12 +31,15 @@ export declare function createKeys(ctx: ActivationCtx & {
         authChoice: string;
         apiKey: string;
         model?: string;
-    }): Promise<AddKeyResult>;
+    }): AddKeyHandle;
     ready(member: Member, o?: {
         once?: boolean;
     }): Promise<{
         agentId: string;
         model: string;
     } | undefined>;
-    sweep(): Promise<boolean>;
+    remove(member: Member, o?: {
+        provider?: string;
+    }): Promise<void>;
+    sweep(clear: boolean): Promise<boolean>;
 };