@byokit/openclaw 0.13.0 → 0.14.2

package/dist/approvals.js

@@ -1,6 +1,6 @@
 // Native approvals: exec.approval.*, plugin.approval.* and question.* surfaced through the same Approval shape (5.9, O5).
 import { randomBytes } from 'node:crypto';
-import { MEMBER_ID } from "./members.js";
+import { MEMBER_ID } from './members.js';
 const strip = (a) => {
     const { native, ...approval } = a;
     void native;

package/dist/auth-status.js

@@ -1,6 +1,6 @@
 import { statSync } from 'node:fs';
 import { join } from 'node:path';
-import { signedInProviders, USABLE } from "./runs.js";
+import { signedInProviders, USABLE } from './runs.js';
 /** Native Claude login stays in Claude Code. The pin's profile status does not include this synthetic auth;
  * setup detection asks the CLI itself, without handing credentials to the kit. */
 export async function authStatus(request, agentId, refresh = false, native = false) {

package/dist/auth-store.d.ts

@@ -53,6 +53,8 @@ export declare class AuthStore {
      *  and in `home` exactly the sealed paths — regenerable caches and the directories still holding them are left in place. */
     private remove;
     private sealObjects;
+    /** Re-attach held-back sealed paths a damaged index kept out of the live inventory. */
+    private mergeHeldBack;
     private persist;
     /** `mkdir -p` for a restore target that records the parent of every directory it creates: a new directory
      *  changes its parent's entries, so the parent needs a directory fsync too. Stops at the store root (it exists)

package/dist/auth-store.js

@@ -7,8 +7,9 @@
 import { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, rmdirSync, writeFileSync, closeSync, fsyncSync, openSync } from 'node:fs';
 import { createHash } from 'node:crypto';
 import { dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
-import { EngineAlreadyRunningError, pidAlive as live } from "./engine-status.js";
-import { removedAccountAgents, sweepOrphans } from "./accounts.js";
+import { EngineAlreadyRunningError, pidAlive as live } from './engine-status.js';
+import { damagedAccountMembers, heldBackAgent, removedAccountAgents, sweepOrphans } from './accounts.js';
+const agentDirOf = (path) => path.startsWith('state/agents/') ? path.split('/')[2] : undefined;
 const encoder = new TextEncoder();
 const archive = (name) => !name.endsWith('.sealed') && (/^(auth-profiles|auth-state|auth|oauth)\.json\.(migrated-.+|sqlite-import\..+\.bak)$/.test(name)
     || name.endsWith('.moved-to-engine'));
@@ -322,8 +323,12 @@ export class AuthStore {
         catch {
             throw new AuthStoreUnreadableError('invalid-snapshot');
         }
+        // Removed agents leave the sealed store; damaged-index agents stay sealed (held back) until their index is repaired.
         const gone = removedAccountAgents(this.o.root);
-        const keep = (path) => !path.startsWith('state/agents/') || !gone.has(path.split('/')[2]);
+        const keep = (path) => {
+            const agent = agentDirOf(path);
+            return agent === undefined || !gone.has(agent);
+        };
         const kept = { v: 1, dirs: saved.dirs.filter(keep), files: saved.files.filter(([path]) => keep(path)) };
         if (kept.dirs.length !== saved.dirs.length || kept.files.length !== saved.files.length) {
             this.seal(this.file, JSON.stringify(kept));
@@ -375,10 +380,16 @@ export class AuthStore {
         let total = 0;
         const root = realpathSync(this.o.root);
         const gone = removedAccountAgents(this.o.root);
+        const damaged = damagedAccountMembers(this.o.root);
         const walk = (path) => {
             const name = relative(this.o.root, path).split('\\').join('/');
-            if (name.startsWith('state/agents/') && gone.has(name.split('/')[2]))
-                return; // a late refresh never enters a seal
+            if (name.startsWith('state/agents/')) {
+                const agent = name.split('/')[2];
+                if (gone.has(agent))
+                    return; // a late refresh never enters a seal
+                if (heldBackAgent(agent, damaged))
+                    return; // damaged index: leave sealed copy; never reseal a late live write
+            }
             if (name.startsWith('home/') && nonCredential(name))
                 return; // regenerable home caches stay on disk; skipping a directory skips its subtree
             let stat;
@@ -449,7 +460,7 @@ export class AuthStore {
         return { dirs, files, objects };
     }
     collect() {
-        sweepOrphans(this.o.root);
+        sweepOrphans(this.o.root, this.o.log);
         const { dirs, files, objects } = this.inventory();
         for (const dir of dirs) {
             try {
@@ -536,10 +547,48 @@ export class AuthStore {
             this.seal(target, payload);
             this.objectHashes.set(object, hash);
         }
+        // Held-back agent objects stay sealed while their index is damaged (inventory skipped their live trees).
+        const damaged = damagedAccountMembers(this.o.root);
+        if (damaged.size) {
+            for (const entry of readdirSync(this.objects)) {
+                if (keep.has(entry))
+                    continue;
+                try {
+                    const agent = agentDirOf(this.readObject(join(this.objects, entry))[0]);
+                    if (agent !== undefined && heldBackAgent(agent, damaged))
+                        keep.add(entry);
+                }
+                catch { /* unreadable object: leave for the next start's auth-store check */ }
+            }
+        }
         for (const entry of readdirSync(this.objects))
             if (!keep.has(entry))
                 rmSync(join(this.objects, entry), { force: true });
     }
+    /** Re-attach held-back sealed paths a damaged index kept out of the live inventory. */
+    mergeHeldBack(previous, saved) {
+        if (!previous)
+            return;
+        const damaged = damagedAccountMembers(this.o.root);
+        if (!damaged.size)
+            return;
+        const held = (path) => {
+            const agent = agentDirOf(path);
+            return agent !== undefined && heldBackAgent(agent, damaged);
+        };
+        const dirs = new Set(saved.dirs);
+        for (const dir of previous.dirs)
+            if (held(dir) && !dirs.has(dir)) {
+                saved.dirs.push(dir);
+                dirs.add(dir);
+            }
+        const files = new Set(saved.files.map(([path]) => path));
+        for (const entry of previous.files)
+            if (held(entry[0]) && !files.has(entry[0])) {
+                saved.files.push(entry);
+                files.add(entry[0]);
+            }
+    }
     async persist() {
         if (!this.o.seal)
             return;
@@ -557,6 +606,7 @@ export class AuthStore {
         // A running engine always leaves files behind (its SQLite stores), so a genuine sign-out still re-seals.
         if (!saved.files.length && !objects.length && previous)
             return;
+        this.mergeHeldBack(previous, saved);
         // The payload is built exactly once; verification decrypts the sealed bytes and compares to it.
         this.seal(this.file, JSON.stringify(saved));
         if (previous?.dirs.some(nonCredential))
@@ -582,14 +632,25 @@ export class AuthStore {
         if (!this.o.seal)
             return;
         const saved = await this.read();
+        const damaged = damagedAccountMembers(this.o.root);
+        const skipHeld = (path) => {
+            const agent = agentDirOf(path);
+            return agent !== undefined && heldBackAgent(agent, damaged);
+        };
         // A crashed host may leave a newer live state; prepare seals that before restore.
         put(this.restoring, encoder.encode('1'));
         const changed = new Set();
         if (saved) {
-            for (const dir of saved.dirs.sort((a, b) => a.split('/').length - b.split('/').length))
+            for (const dir of saved.dirs.sort((a, b) => a.split('/').length - b.split('/').length)) {
+                if (skipHeld(dir))
+                    continue;
                 this.ensureRestoreDirs(join(this.o.root, dir), changed);
-            for (const [path, data] of saved.files)
+            }
+            for (const [path, data] of saved.files) {
+                if (skipHeld(path))
+                    continue;
                 putRestore(join(this.o.root, path), Buffer.from(data, 'base64'), changed);
+            }
         }
         if (existsSync(this.objects)) {
             for (const entry of readdirSync(this.objects)) {
@@ -598,6 +659,8 @@ export class AuthStore {
                 // no hash, so the next seal reseals it in the current mode even when unchanged.
                 if (!this.o.seal.upgrade?.(bytes))
                     this.objectHashes.set(entry, objectHash(payload));
+                if (skipHeld(path))
+                    continue;
                 // An object path can be several directories below an existing one, and those directories are not in
                 // `saved.dirs` (they sit in a non-credential subtree). Create them through ensureRestoreDirs so the
                 // parent of every directory this restore creates — not just each object's own directory — is fsynced
@@ -667,7 +730,9 @@ export class AuthStore {
             // keeps the sealed credentials instead of replacing them with an empty snapshot.
             if (!saved.files.length && !objects.length && previous)
                 return;
+            this.mergeHeldBack(previous, saved);
             this.seal(this.file, JSON.stringify(saved));
+            // Database objects stay at their last stop-time seal; only the credential blob is refreshed here.
         });
     }
     start() {

package/dist/bridge.js

@@ -3,7 +3,7 @@ import { randomBytes } from 'node:crypto';
 import { existsSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { createServer } from 'node:net';
 import { rm } from 'node:fs/promises';
-import { words } from "./words.js";
+import { words } from './words.js';
 /** Newline-framed JSON, one request per connection; anything larger is not a gate request. */
 const FRAME_CAP = 1_000_000;
 /**

package/dist/browser/host.js

@@ -1,8 +1,8 @@
 // Internal host runtime (5.17). Production handoff is deliberately unprotected until W7/O17 qualification.
 import { randomBytes } from 'node:crypto';
-import { BrowserStoreError, checkUrl, validOrigin } from "./store.js";
-import { validateVerifiers, verifySignIn } from "./verify.js";
-import { dispatchResume, newResume, recoverResume } from "./resume.js";
+import { BrowserStoreError, checkUrl, validOrigin } from './store.js';
+import { validateVerifiers, verifySignIn } from './verify.js';
+import { dispatchResume, newResume, recoverResume } from './resume.js';
 export class SignInRefused extends Error {
     why;
     constructor(why) { super(`sign-in refused: ${why}`); this.why = why; }

package/dist/browser/verify.js

@@ -1,4 +1,4 @@
-import { checkUrl, validOrigin } from "./store.js";
+import { checkUrl, validOrigin } from './store.js';
 export function validateVerifiers(verifiers) {
     for (const v of verifiers) {
         validOrigin(v.origin);

package/dist/config.js

@@ -1,6 +1,6 @@
 import { dirname, join } from 'node:path';
-import { routes } from "./routes.js";
-import { MEMBER_ID, KEY_PREFIX, BASE_AGENT, keyAgentId } from "./members.js";
+import { routes } from './routes.js';
+import { MEMBER_ID, KEY_PREFIX, BASE_AGENT, keyAgentId } from './members.js';
 const object = (v) => !!v && typeof v === 'object' && !Array.isArray(v);
 const merge = (a, b) => {
     for (const [k, v] of Object.entries(b))

package/dist/constants.d.ts

@@ -1,4 +1,4 @@
 export declare const ENGINE_VERSION = "2026.8.35";
 export declare const PROTOCOL_VERSION = 4;
 export declare const LIVE_CATALOGS: string[];
-export declare const OPERATOR_SCOPES: readonly ["operator.read", "operator.write", "operator.admin", "operator.approvals", "operator.questions", "operator.pairing", "operator.talk"];
+export declare const OPERATOR_SCOPES: readonly ['operator.read', 'operator.write', 'operator.admin', 'operator.approvals', 'operator.questions', 'operator.pairing', 'operator.talk'];

package/dist/day-usage.js

@@ -1,5 +1,5 @@
 // Portable additive day reader. No host files, pricing guesses or side totals for persisted turns.
-import { agentUsageOf } from "./usage.js";
+import { agentUsageOf } from './usage.js';
 const object = (v) => !!v && typeof v === 'object' && !Array.isArray(v);
 const count = (v) => typeof v === 'number' && Number.isFinite(v) && v >= 0;
 const text = (v) => typeof v === 'string' && v.length > 0 && v.length <= 512;

package/dist/device.js

@@ -1,7 +1,7 @@
 import { openBoxFromSeed, boxKeyPairFromSeed } from '@byokit/seal';
-import { memberOf } from "./attribution.js";
-import { toAccountView } from "./words.js";
-import { b64urlDecode, b64urlEncode, openNotice } from "./notices.js";
+import { memberOf } from './attribution.js';
+import { toAccountView } from './words.js';
+import { b64urlDecode, b64urlEncode, openNotice } from './notices.js';
 /**
  * The host ended a stream with its own words (e.g. a refusal). Portable twin of link's PublicLinkError:
  * same shape ({ code: 'failed', sealed: true }) so a screen can show .message the same way. A device-side
@@ -418,8 +418,8 @@ export function openclawDevice(link) {
     };
 }
 // Portable, re-exported by ./device (7.3).
-export { openNotice } from "./notices.js";
-export { readAgentUsage, agentUsageOf } from "./usage.js";
-export { readAgentDayUsage } from "./day-usage.js";
+export { openNotice } from './notices.js';
+export { readAgentUsage, agentUsageOf } from './usage.js';
+export { readAgentDayUsage } from './day-usage.js';
 // The kit's sentences, so a phone or browser shows the same words the computer does (5.14).
-export { stateWords, toAccountView, words } from "./words.js";
+export { stateWords, toAccountView, words } from './words.js';

package/dist/engine.d.ts

@@ -1,6 +1,10 @@
+import { remoteCliHost } from '@byokit/accounts/cli';
 import { AuthStore, AuthStoreSealSizeError } from './auth-store.ts';
 import type { KitOptions } from './kit.ts';
 import type { KitState, ToolSpec } from './types.ts';
+/** The app's stateDir as an absolute path with no symlinked ancestor (macOS /tmp and /var are symlinks):
+ * the native Claude login's accounts store refuses any other, so a relative or symlinked stateDir failed it. */
+export declare function canonicalStateDir(dir: string): string;
 export type EngineOptions = Pick<KitOptions, 'stateDir' | 'engineDir' | 'npmPath' | 'enginePath' | 'config' | 'offered' | 'appOwnedSessions' | 'installPolicy' | 'log' | 'bridge' | 'authSeal'> & {
     pluginId: string;
     tools: ToolSpec[];
@@ -28,6 +32,10 @@ export declare class Engine {
     private starting?;
     readonly authStore: AuthStore;
     private stopping;
+    private stopOwner;
+    private claudeLogin?;
+    private claudeAccounts?;
+    private claudeReset?;
     private credentialsLocked;
     private repaired;
     private prepared?;
@@ -49,6 +57,10 @@ export declare class Engine {
         entry: string;
         env: Record<string, string>;
     };
+    /** The engine's own shutdown signal; aborted by stop() and replaced by the next start(). */
+    get stopSignal(): AbortSignal;
+    nativeClaudeLogin(): ReturnType<typeof remoteCliHost>;
+    resetNativeClaudeLogin(): Promise<void>;
     doctor(timeoutMs: number): {
         status: number | null;
     };

package/dist/engine.js

@@ -1,18 +1,31 @@
 import { spawn, spawnSync } from 'node:child_process';
 import { randomBytes, generateKeyPairSync, randomUUID } from 'node:crypto';
-import { closeSync, existsSync, mkdirSync, openSync, readFileSync, writeFileSync, copyFileSync, rmSync, realpathSync, statSync } from 'node:fs';
+import { accessSync, constants, closeSync, existsSync, mkdirSync, openSync, readFileSync, writeFileSync, copyFileSync, rmSync, realpathSync, statSync } from 'node:fs';
 import { createServer } from 'node:net';
-import { basename, join, dirname } from 'node:path';
+import { basename, join, dirname, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { setTimeout as delay } from 'node:timers/promises';
-import { AuthStore, AuthStoreUnreadableError, AuthStoreSealSizeError } from "./auth-store.js";
-import { EngineAlreadyRunningError, pidAlive, StartedProcesses } from "./engine-status.js";
-import { EnginePatchError, atomic, prepareEngineSet, processStartTime, readPatchSet, sha256, verifyEngineSet } from "./engine-patches.js";
-import { ENGINE_VERSION } from "./constants.js";
-import { appendUsageBoot } from "./usage-boots.js";
-import { reconcileConfig, appRecoveryPrefixes } from "./config.js";
-import { writePlugin, resolveBridge } from "./bridge.js";
-import { sweepOrphans } from "./accounts.js";
+import { cliAccounts, remoteCliHost } from '@byokit/accounts/cli';
+import { AuthStore, AuthStoreUnreadableError, AuthStoreSealSizeError } from './auth-store.js';
+import { EngineAlreadyRunningError, pidAlive, StartedProcesses } from './engine-status.js';
+import { EnginePatchError, atomic, prepareEngineSet, processStartTime, readPatchSet, sha256, verifyEngineSet } from './engine-patches.js';
+import { ENGINE_VERSION } from './constants.js';
+import { appendUsageBoot } from './usage-boots.js';
+import { reconcileConfig, appRecoveryPrefixes } from './config.js';
+import { writePlugin, resolveBridge } from './bridge.js';
+import { sweepOrphans } from './accounts.js';
+/** The app's stateDir as an absolute path with no symlinked ancestor (macOS /tmp and /var are symlinks):
+ * the native Claude login's accounts store refuses any other, so a relative or symlinked stateDir failed it. */
+export function canonicalStateDir(dir) {
+    const path = resolve(dir);
+    try {
+        return realpathSync(path);
+    }
+    catch {
+        const parent = dirname(path);
+        return parent === path ? path : join(canonicalStateDir(parent), basename(path));
+    }
+}
 const kitDir = dirname(dirname(fileURLToPath(import.meta.url)));
 const putOnce = (path, data) => { if (!existsSync(path))
     writeFileSync(path, data, { mode: 0o600, flag: 'wx' }); };
@@ -76,6 +89,13 @@ export class Engine {
     starting;
     authStore;
     stopping = false;
+    // Aborted by stop(): a sign-in drive that has not reached its commit point then declines at once, the key paste
+    // included (it has no native host signal of its own). start() replaces it, so an earlier shutdown cannot decline
+    // a later drive.
+    stopOwner = new AbortController();
+    claudeLogin;
+    claudeAccounts;
+    claudeReset;
     credentialsLocked = false;
     repaired = false;
     prepared;
@@ -87,6 +107,7 @@ export class Engine {
     appOwnedSessionPrefixes;
     constructor(o) {
         this.appOwnedSessionPrefixes = appRecoveryPrefixes(o.appOwnedSessions);
+        o = { ...o, stateDir: canonicalStateDir(o.stateDir) };
         this.o = o;
         const bridge = resolveBridge(o.bridge);
         this.root = join(o.stateDir, 'openclaw');
@@ -285,6 +306,42 @@ export class Engine {
                 BYOKIT_APP_OWNED_SESSION_PREFIXES: JSON.stringify(this.appOwnedSessionPrefixes),
             } };
     }
+    /** The engine's own shutdown signal; aborted by stop() and replaced by the next start(). */
+    get stopSignal() { return this.stopOwner.signal; }
+    nativeClaudeLogin() {
+        if (this.claudeLogin)
+            return this.claudeLogin;
+        const { env } = this.doctorContext();
+        const bin = env.PATH.split(':').map(path => join(path, 'claude')).find(path => { try {
+            accessSync(path, constants.X_OK);
+            return true;
+        }
+        catch {
+            return false;
+        } });
+        const bins = bin ? { claude: bin } : {};
+        // The login runs in its own HOME: CLAUDE_CONFIG_DIR points it at the engine's folder, which accounts refuses as a HOME's default login.
+        for (const dir of ['home', 'login-home'])
+            mkdirSync(join(this.root, dir), { recursive: true, mode: 0o700 });
+        const cli = cliAccounts({ stateDir: this.root, bins, env: { PATH: env.PATH, HOME: join(this.root, 'login-home'), LANG: env.LANG, TMPDIR: env.TMPDIR, XDG_CONFIG_HOME: env.XDG_CONFIG_HOME, XDG_CACHE_HOME: env.XDG_CACHE_HOME, XDG_DATA_HOME: env.XDG_DATA_HOME, XDG_STATE_HOME: env.XDG_STATE_HOME, }, managedFolders: { claude: env.CLAUDE_CONFIG_DIR } });
+        this.claudeAccounts = cli;
+        this.claudeLogin = remoteCliHost({ cli, bins });
+        return this.claudeLogin;
+    }
+    resetNativeClaudeLogin() {
+        if (this.claudeReset)
+            return this.claudeReset;
+        const cli = this.claudeAccounts, host = this.claudeLogin;
+        if (!cli || !host || host.signal.aborted)
+            return Promise.resolve();
+        this.claudeReset = (async () => { for (const row of await cli.list()) {
+            if (host.signal.aborted)
+                return;
+            if (row.provider === 'claude' && row.state === 'ready' && cli.folderOf(row.id) === join(this.root, 'home', '.claude'))
+                await cli.remove(row.id);
+        } })().finally(() => { this.claudeReset = undefined; });
+        return this.claudeReset;
+    }
     doctor(timeoutMs) {
         const { entry, env } = this.doctorContext();
         if (this.o.spawnEngine)
@@ -355,11 +412,12 @@ export class Engine {
     }
     // The account orphan sweep (5.15): a late engine write after a removal cannot be ruled out by a bounded check, so
     // prepare and the sealed restore remove each `<root>/state/agents/<member>--<hex6>` directory a removal recorded as
-    // gone and no index names. No roster here: the gateway is down, and no add is in flight while preparing (an entry
-    // is written before its agent is created, so an account being added is named).
+    // gone and no index names, and drop member-store auth profiles a removal recorded as `dropped`. No roster here: the
+    // gateway is down, and no add is in flight while preparing (an entry is written before its agent is created, so an
+    // account being added is named).
     sweepAccountOrphans() {
         try {
-            sweepOrphans(this.root);
+            sweepOrphans(this.root, this.o.log);
         }
         catch (error) {
             this.o.log?.(`prepare: orphans are not swept: ${String(error.message).slice(0, 200)}`);
@@ -369,6 +427,7 @@ export class Engine {
         if (this.starting)
             return this.starting;
         this.stopping = false;
+        this.stopOwner = new AbortController();
         const pending = this.startOnce();
         this.starting = pending;
         void pending.finally(() => { if (this.starting === pending)
@@ -514,6 +573,11 @@ export class Engine {
     withAuthStore(task) { return this.authStore.offline(task); }
     async stop() {
         this.stopping = true;
+        this.stopOwner.abort();
+        await this.claudeLogin?.close();
+        await this.claudeReset?.catch(() => { });
+        this.claudeLogin = undefined;
+        this.claudeAccounts = undefined;
         await this.starting?.catch(() => { });
         const child = this.child;
         await this.started.terminate(delay);

package/dist/index.d.ts

@@ -1,10 +1,10 @@
 export { ENGINE_VERSION, OPERATOR_SCOPES, PROTOCOL_VERSION } from './constants.ts';
-export type { Account, AccountId, AccountPick, AccountRef, Approval, CallOptions, Considered, Decision, Defaults, ModelInfo, MoveResult, PickWhy, Room, RoomSpan, RunSelection, SignInState, GatewayEventName, GatewayEventPayload, GatewayMethod, GatewayParams, GatewayResult, GatewayTransport, GateResult, Hello, KitState, KitEventName, KitEventPayload, BrowserPing, LearningCapture, LearningMode, Member, PlanWindow, Route, RunEnd, RunEvent, RunRef, RunSpec, OutputSchema, SchemaOutput, RunUsage, SignInOptions, SignInView, ToolHost, ToolSpec, } from './types.ts';
+export type { Account, AccountId, AccountPick, AccountRef, Approval, CallOptions, Considered, Decision, Defaults, ModelInfo, MoveResult, PickWhy, Room, RoomSpan, RunSelection, SignInState, GatewayEventName, GatewayEventPayload, GatewayMethod, GatewayParams, GatewayResult, GatewayTransport, GateResult, Hello, KitState, KitEventName, KitEventPayload, BrowserPing, LearningCapture, LearningMode, Member, PlanWindow, Route, RunEnd, RunEvent, RunRef, RunSpec, OutputSchema, SchemaOutput, RunUsage, ThinkingAsked, ThinkingReport, ThinkingUsed, SignInOptions, SignInView, ToolHost, ToolSpec, } from './types.ts';
 export type { GatewayMethods } from './generated/methods.ts';
 export type { JsonValue } from './output.ts';
 export type { RouteFacts, RouteView } from './routes.ts';
 export { OpenClawKit, type KitOptions, type RetainedLogin } from './kit.ts';
-export type { AddKeyResult, KeyFailureReason } from './keys.ts';
+export type { AddKeyHandle, AddKeyResult, KeyFailureReason } from './keys.ts';
 export { stateWords, toAccountView, words, type AccountView, type WordKey } from './words.ts';
 export { chooseAccount, consider, resolveSelection, type RoomOf } from './pick.ts';
 export { AuthStoreUnreadableError, AuthStoreSealSizeError } from './auth-store.ts';

package/dist/index.js

@@ -1,10 +1,10 @@
 // @byokit/openclaw — the OpenClaw runtime kit, host side (docs/runtime-kits.md 5.3). Entries: `.` (this),
 // `./device` (portable), `./link` (Node host-side adapter), `./testing` (fakes and contract suite).
-export { ENGINE_VERSION, OPERATOR_SCOPES, PROTOCOL_VERSION } from "./constants.js";
-export { OpenClawKit } from "./kit.js";
-export { stateWords, toAccountView, words } from "./words.js";
-export { chooseAccount, consider, resolveSelection } from "./pick.js";
-export { AuthStoreUnreadableError, AuthStoreSealSizeError } from "./auth-store.js";
-export { EngineAlreadyRunningError } from "./engine-status.js";
-export { readAgentDayUsage } from "./day-usage.js";
-export { readAgentUsage, agentUsageOf } from "./usage.js";
+export { ENGINE_VERSION, OPERATOR_SCOPES, PROTOCOL_VERSION } from './constants.js';
+export { OpenClawKit } from './kit.js';
+export { stateWords, toAccountView, words } from './words.js';
+export { chooseAccount, consider, resolveSelection } from './pick.js';
+export { AuthStoreUnreadableError, AuthStoreSealSizeError } from './auth-store.js';
+export { EngineAlreadyRunningError } from './engine-status.js';
+export { readAgentDayUsage } from './day-usage.js';
+export { readAgentUsage, agentUsageOf } from './usage.js';

package/dist/keys.d.ts

@@ -1,4 +1,5 @@
 import { type ActivationCtx } from './activation.ts';
+import { type RouteView } from './routes.ts';
 import type { Member, ModelInfo } from './types.ts';
 export type KeyFailureReason = 'auth' | 'billing' | 'empty' | 'model' | 'network' | 'engine' | 'inference' | 'busy';
 export type AddKeyResult = {
@@ -7,6 +8,10 @@ export type AddKeyResult = {
     status: 'invalid' | 'not_included' | 'retry';
     reason: KeyFailureReason;
 };
+/** The add resolves like a Promise; `cancel()` stops a pending add and clears any partial key (retry/busy). */
+export type AddKeyHandle = Promise<AddKeyResult> & {
+    cancel(): void;
+};
 export declare function createKeys(ctx: ActivationCtx & {
     root: string;
     ensure(member: Member): Promise<{
@@ -14,6 +19,12 @@ export declare function createKeys(ctx: ActivationCtx & {
     }>;
     restarting?(): boolean;
     prepareOwner(agentId: string): Promise<void>;
+    indexLane(member: Member, route: RouteView): Promise<void>;
+    dropLane(member: Member, provider?: string): Promise<void>;
+    backfillLane(member: Member, model: string | undefined): Promise<void>;
+    /** The provider config headers a live-catalog key's calls and probes must carry (`null` clears them),
+     *  written through the kit's own config patch. The Go workspace header is the one user. */
+    setProviderHeaders(provider: string, headers: Record<string, string> | null): Promise<void>;
 }): {
     models: (member: Member, o: {
         authChoice: string;
@@ -23,12 +34,16 @@ export declare function createKeys(ctx: ActivationCtx & {
         authChoice: string;
         apiKey: string;
         model?: string;
-    }): Promise<AddKeyResult>;
+        orgId?: string;
+    }): AddKeyHandle;
     ready(member: Member, o?: {
         once?: boolean;
     }): Promise<{
         agentId: string;
         model: string;
     } | undefined>;
-    sweep(): Promise<boolean>;
+    remove(member: Member, o?: {
+        provider?: string;
+    }): Promise<void>;
+    sweep(clear: boolean): Promise<boolean>;
 };