@elizaos/agent 2.0.0-alpha.97 → 2.0.0-beta.1

package/dist/packages/agent/src/auth/account-storage.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Per-account credential storage.
+ *
+ * Layout: `~/.eliza/auth/{providerId}/{accountId}.json` (mode 0600,
+ * atomic writes). Multiple accounts per provider are supported.
+ *
+ * Migration: on first read of a provider, if the legacy single-file
+ * `~/.eliza/auth/{providerId}.json` exists and the per-account
+ * directory does not, the legacy file is moved to
+ * `<dir>/default.json` and the legacy file is removed.
+ */
+import { type AccountCredentialProvider, type OAuthCredentials, type SubscriptionProvider } from "./types.ts";
+export interface AccountCredentialRecord {
+    /** accountId, e.g. "default" or a uuid */
+    id: string;
+    providerId: AccountCredentialProvider;
+    /** user-facing name (e.g. "Personal", "Work") */
+    label: string;
+    source: "oauth" | "api-key";
+    /**
+     * Existing OAuth credential blob — `{ access, refresh, expires }`
+     * for OAuth accounts; for `api-key` accounts only `access` is
+     * meaningful (refresh is the empty string and expires is `0` /
+     * a far-future sentinel by convention of the caller).
+     */
+    credentials: OAuthCredentials;
+    createdAt: number;
+    updatedAt: number;
+    lastUsedAt?: number;
+    organizationId?: string;
+    userId?: string;
+    email?: string;
+}
+/**
+ * Run the legacy → per-account migration for both known subscription
+ * providers. Idempotent: each provider migrates at most once per
+ * process. Returns the providers that were actually migrated this
+ * call.
+ */
+export declare function migrateLegacySingleAccount(): {
+    migrated: SubscriptionProvider[];
+};
+export declare function listAccounts(provider: AccountCredentialProvider): AccountCredentialRecord[];
+export declare function loadAccount(provider: AccountCredentialProvider, accountId: string): AccountCredentialRecord | null;
+export declare function saveAccount(record: AccountCredentialRecord): void;
+export declare function deleteAccount(provider: AccountCredentialProvider, accountId: string): void;
+export declare function touchAccount(provider: AccountCredentialProvider, accountId: string): void;
+//# sourceMappingURL=account-storage.d.ts.map

package/dist/packages/agent/src/auth/account-storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-storage.d.ts","sourceRoot":"","sources":["../../../../../src/auth/account-storage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAOH,OAAO,EAEL,KAAK,yBAAyB,EAE9B,KAAK,gBAAgB,EAErB,KAAK,oBAAoB,EAC1B,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,uBAAuB;IACtC,0CAA0C;IAC1C,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,yBAAyB,CAAC;IACtC,iDAAiD;IACjD,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,OAAO,GAAG,SAAS,CAAC;IAC5B;;;;;OAKG;IACH,WAAW,EAAE,gBAAgB,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAmID;;;;;GAKG;AACH,wBAAgB,0BAA0B,IAAI;IAC5C,QAAQ,EAAE,oBAAoB,EAAE,CAAC;CAClC,CAOA;AAQD,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,yBAAyB,GAClC,uBAAuB,EAAE,CAyC3B;AAED,wBAAgB,WAAW,CACzB,QAAQ,EAAE,yBAAyB,EACnC,SAAS,EAAE,MAAM,GAChB,uBAAuB,GAAG,IAAI,CAkChC;AAED,wBAAgB,WAAW,CAAC,MAAM,EAAE,uBAAuB,GAAG,IAAI,CAUjE;AAED,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,yBAAyB,EACnC,SAAS,EAAE,MAAM,GAChB,IAAI,CAUN;AAED,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,yBAAyB,EACnC,SAAS,EAAE,MAAM,GAChB,IAAI,CAQN"}

package/dist/packages/agent/src/auth/account-storage.js

@@ -0,0 +1,229 @@
+/**
+ * Per-account credential storage.
+ *
+ * Layout: `~/.eliza/auth/{providerId}/{accountId}.json` (mode 0600,
+ * atomic writes). Multiple accounts per provider are supported.
+ *
+ * Migration: on first read of a provider, if the legacy single-file
+ * `~/.eliza/auth/{providerId}.json` exists and the per-account
+ * directory does not, the legacy file is moved to
+ * `<dir>/default.json` and the legacy file is removed.
+ */
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { logger } from "@elizaos/core";
+import { writeJsonAtomicSync } from "../utils/atomic-json.js";
+import { ACCOUNT_CREDENTIAL_PROVIDER_IDS, isSubscriptionProvider, SUBSCRIPTION_PROVIDER_IDS, } from "./types.js";
+function authRoot() {
+    return path.join(process.env.ELIZA_HOME || path.join(os.homedir(), ".eliza"), "auth");
+}
+function providerDir(provider) {
+    return path.join(authRoot(), provider);
+}
+function legacyProviderFile(provider) {
+    return path.join(authRoot(), `${provider}.json`);
+}
+function accountFile(provider, accountId) {
+    return path.join(providerDir(provider), `${accountId}.json`);
+}
+function ensureProviderDir(provider) {
+    const dir = providerDir(provider);
+    if (!fs.existsSync(dir)) {
+        fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    }
+}
+function isAccountCredentialRecord(value) {
+    if (!value || typeof value !== "object")
+        return false;
+    const v = value;
+    return (typeof v.id === "string" &&
+        typeof v.providerId === "string" &&
+        ACCOUNT_CREDENTIAL_PROVIDER_IDS.includes(v.providerId) &&
+        typeof v.label === "string" &&
+        (v.source === "oauth" || v.source === "api-key") &&
+        typeof v.credentials === "object" &&
+        v.credentials !== null &&
+        typeof v.credentials.access === "string" &&
+        typeof v.createdAt === "number" &&
+        typeof v.updatedAt === "number");
+}
+const migratedProviders = new Set();
+let migrationRunAtLeastOnce = false;
+function migrateProvider(provider) {
+    if (migratedProviders.has(provider))
+        return false;
+    migratedProviders.add(provider);
+    const dir = providerDir(provider);
+    const legacy = legacyProviderFile(provider);
+    if (!fs.existsSync(legacy))
+        return false;
+    if (fs.existsSync(dir)) {
+        // Per-account directory already exists — leave the legacy file
+        // alone (operator may be mid-migration). Don't auto-delete.
+        return false;
+    }
+    let parsed = null;
+    try {
+        const raw = fs.readFileSync(legacy, "utf-8");
+        parsed = JSON.parse(raw);
+    }
+    catch (err) {
+        logger.warn(`[auth] Failed to read legacy credential file for migration ${legacy}: ${String(err)}`);
+        return false;
+    }
+    if (!parsed ||
+        typeof parsed !== "object" ||
+        !parsed.credentials ||
+        typeof parsed.credentials.access !== "string") {
+        logger.warn(`[auth] Legacy credential file ${legacy} is malformed — skipping migration`);
+        return false;
+    }
+    const now = Date.now();
+    const record = {
+        id: "default",
+        providerId: provider,
+        label: "Default",
+        source: "oauth",
+        credentials: parsed.credentials,
+        createdAt: typeof parsed.createdAt === "number" ? parsed.createdAt : now,
+        updatedAt: typeof parsed.updatedAt === "number" ? parsed.updatedAt : now,
+    };
+    ensureProviderDir(provider);
+    writeJsonAtomicSync(accountFile(provider, "default"), record);
+    // Atomic-ish delete: rename to a side path first so a concurrent
+    // reader sees either the legacy file or nothing — then unlink.
+    const removed = `${legacy}.migrated-${now}`;
+    try {
+        fs.renameSync(legacy, removed);
+        fs.unlinkSync(removed);
+    }
+    catch (err) {
+        logger.warn(`[auth] Failed to remove legacy credential file ${legacy} after migration: ${String(err)}`);
+    }
+    logger.info(`[auth] Migrated legacy ${provider} credentials to per-account store as "default"`);
+    return true;
+}
+/**
+ * Run the legacy → per-account migration for both known subscription
+ * providers. Idempotent: each provider migrates at most once per
+ * process. Returns the providers that were actually migrated this
+ * call.
+ */
+export function migrateLegacySingleAccount() {
+    migrationRunAtLeastOnce = true;
+    const migrated = [];
+    for (const p of SUBSCRIPTION_PROVIDER_IDS) {
+        if (migrateProvider(p))
+            migrated.push(p);
+    }
+    return { migrated };
+}
+function ensureMigrationOnce() {
+    if (!migrationRunAtLeastOnce) {
+        migrateLegacySingleAccount();
+    }
+}
+export function listAccounts(provider) {
+    ensureMigrationOnce();
+    // Run provider-specific migration too in case a new provider was
+    // added after the first global pass.
+    if (isSubscriptionProvider(provider)) {
+        migrateProvider(provider);
+    }
+    const dir = providerDir(provider);
+    if (!fs.existsSync(dir))
+        return [];
+    const entries = fs.readdirSync(dir);
+    const records = [];
+    for (const entry of entries) {
+        if (!entry.endsWith(".json"))
+            continue;
+        if (entry.endsWith(".tmp.json") || entry.endsWith(".json.tmp"))
+            continue;
+        const filePath = path.join(dir, entry);
+        let parsed;
+        try {
+            parsed = JSON.parse(fs.readFileSync(filePath, "utf-8"));
+        }
+        catch (err) {
+            logger.warn(`[auth] Skipping malformed credential file ${filePath}: ${String(err)}`);
+            continue;
+        }
+        if (!isAccountCredentialRecord(parsed)) {
+            logger.warn(`[auth] Skipping credential file ${filePath} — wrong shape`);
+            continue;
+        }
+        if (parsed.providerId !== provider) {
+            logger.warn(`[auth] Credential file ${filePath} declares providerId="${parsed.providerId}", expected "${provider}" — skipping`);
+            continue;
+        }
+        records.push(parsed);
+    }
+    records.sort((a, b) => a.createdAt - b.createdAt);
+    return records;
+}
+export function loadAccount(provider, accountId) {
+    ensureMigrationOnce();
+    if (isSubscriptionProvider(provider)) {
+        migrateProvider(provider);
+    }
+    const file = accountFile(provider, accountId);
+    let raw;
+    try {
+        raw = fs.readFileSync(file, "utf-8");
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return null;
+        throw err;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (err) {
+        logger.warn(`[auth] Credential file ${file} is malformed JSON: ${String(err)}`);
+        return null;
+    }
+    if (!isAccountCredentialRecord(parsed)) {
+        logger.warn(`[auth] Credential file ${file} has wrong shape`);
+        return null;
+    }
+    if (parsed.providerId !== provider || parsed.id !== accountId) {
+        logger.warn(`[auth] Credential file ${file} provider/id mismatch (got ${parsed.providerId}/${parsed.id})`);
+        return null;
+    }
+    return parsed;
+}
+export function saveAccount(record) {
+    ensureProviderDir(record.providerId);
+    const next = {
+        ...record,
+        updatedAt: Date.now(),
+    };
+    writeJsonAtomicSync(accountFile(record.providerId, record.id), next);
+    logger.info(`[auth] Saved ${record.providerId} account "${record.id}" (label="${record.label}")`);
+}
+export function deleteAccount(provider, accountId) {
+    const file = accountFile(provider, accountId);
+    try {
+        fs.unlinkSync(file);
+        logger.info(`[auth] Deleted ${provider} account "${accountId}"`);
+    }
+    catch (err) {
+        if (err.code !== "ENOENT") {
+            throw err;
+        }
+    }
+}
+export function touchAccount(provider, accountId) {
+    const existing = loadAccount(provider, accountId);
+    if (!existing)
+        return;
+    const next = {
+        ...existing,
+        lastUsedAt: Date.now(),
+    };
+    writeJsonAtomicSync(accountFile(provider, accountId), next);
+}

package/dist/packages/agent/src/auth/anthropic.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Anthropic OAuth flow (Claude Pro/Max subscription)
+ *
+ * Uses inlined PKCE + token exchange (vendored OAuth helpers).
+ * The callback API is adapted to a start/exchange pattern for HTTP route handlers.
+ */
+import type { OAuthCredentials } from "./types.ts";
+export interface AnthropicFlow {
+    authUrl: string;
+    /** Provide the authorization code (format: code#state) to complete the flow */
+    submitCode: (code: string) => void;
+    /** Resolves with credentials once submitCode() is called */
+    credentials: Promise<OAuthCredentials>;
+}
+/**
+ * Start the Anthropic OAuth flow.
+ * Returns an auth URL and a way to submit the code + get credentials.
+ */
+export declare function startAnthropicLogin(): Promise<AnthropicFlow>;
+/**
+ * Refresh an expired Anthropic token.
+ */
+export declare function refreshAnthropicToken(refreshToken: string): Promise<OAuthCredentials>;
+//# sourceMappingURL=anthropic.d.ts.map

package/dist/packages/agent/src/auth/anthropic.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"anthropic.d.ts","sourceRoot":"","sources":["../../../../../src/auth/anthropic.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAMnD,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,+EAA+E;IAC/E,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACnC,4DAA4D;IAC5D,WAAW,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;CACxC;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,aAAa,CAAC,CA0BlE;AAED;;GAEG;AACH,wBAAsB,qBAAqB,CACzC,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,gBAAgB,CAAC,CAE3B"}

package/dist/packages/agent/src/auth/anthropic.js

@@ -0,0 +1,38 @@
+/**
+ * Anthropic OAuth flow (Claude Pro/Max subscription)
+ *
+ * Uses inlined PKCE + token exchange (vendored OAuth helpers).
+ * The callback API is adapted to a start/exchange pattern for HTTP route handlers.
+ */
+import { loginAnthropic as loginAnthropicFlow, refreshAnthropicToken as refreshAnthropicTokenFlow, } from "./vendor/pi-oauth/anthropic-login.js";
+/**
+ * Start the Anthropic OAuth flow.
+ * Returns an auth URL and a way to submit the code + get credentials.
+ */
+export async function startAnthropicLogin() {
+    let authUrl = "";
+    let resolveCode = null;
+    let resolveUrlReady = null;
+    const codePromise = new Promise((resolve) => {
+        resolveCode = resolve;
+    });
+    const urlReady = new Promise((resolve) => {
+        resolveUrlReady = resolve;
+    });
+    const credentials = loginAnthropicFlow((url) => {
+        authUrl = url;
+        resolveUrlReady?.();
+    }, () => codePromise);
+    await urlReady;
+    return {
+        authUrl,
+        submitCode: (code) => resolveCode?.(code),
+        credentials,
+    };
+}
+/**
+ * Refresh an expired Anthropic token.
+ */
+export async function refreshAnthropicToken(refreshToken) {
+    return refreshAnthropicTokenFlow(refreshToken);
+}

package/dist/packages/agent/src/auth/claude-code-stealth-preload.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=claude-code-stealth-preload.d.ts.map

package/dist/packages/agent/src/auth/claude-code-stealth-preload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-code-stealth-preload.d.ts","sourceRoot":"","sources":["../../../../../src/auth/claude-code-stealth-preload.ts"],"names":[],"mappings":""}

package/dist/packages/agent/src/auth/claude-code-stealth-preload.js

@@ -0,0 +1,2 @@
+import { installClaudeCodeStealthFetchInterceptor } from "./claude-code-stealth.js";
+installClaudeCodeStealthFetchInterceptor();

package/dist/packages/agent/src/auth/claude-code-stealth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-code-stealth.d.ts","sourceRoot":"","sources":["../../../../../src/auth/claude-code-stealth.ts"],"names":[],"mappings":"AA0DA,wBAAgB,wCAAwC,IAAI,IAAI,CA+F/D"}

package/dist/packages/agent/src/auth/claude-code-stealth.js

@@ -0,0 +1,116 @@
+import { logger } from "@elizaos/core";
+const STEALTH_GUARD = Symbol.for("eliza.claudeCodeStealthInstalled");
+const CLAUDE_CODE_VERSION = "2.1.92";
+const CLAUDE_CODE_SYSTEM_PREFIX = "You are Claude Code, Anthropic's official CLI for Claude.";
+const ANTHROPIC_BETA = "claude-code-20250219,oauth-2025-04-20,interleaved-thinking-2025-05-14,context-management-2025-06-27,prompt-caching-scope-2026-01-05,advanced-tool-use-2025-11-20,effort-2025-11-24";
+function isSetupToken(value) {
+    return typeof value === "string" && value.startsWith("sk-ant-oat");
+}
+function getUrl(input) {
+    try {
+        if (typeof input === "string") {
+            return new URL(input);
+        }
+        if (input instanceof URL) {
+            return input;
+        }
+        return new URL(input.url);
+    }
+    catch {
+        return null;
+    }
+}
+function addSystemPrefix(body) {
+    if (!body || typeof body !== "object") {
+        return body;
+    }
+    const next = body;
+    const prefix = { type: "text", text: CLAUDE_CODE_SYSTEM_PREFIX };
+    if (Array.isArray(next.system)) {
+        const hasPrefix = next.system.some((block) => block?.text?.startsWith("You are Claude Code"));
+        if (!hasPrefix) {
+            next.system.unshift(prefix);
+        }
+    }
+    else if (typeof next.system === "string") {
+        next.system = [prefix, { type: "text", text: next.system }];
+    }
+    else {
+        next.system = [prefix];
+    }
+    return next;
+}
+export function installClaudeCodeStealthFetchInterceptor() {
+    if (globalThis[STEALTH_GUARD]) {
+        return;
+    }
+    const originalFetch = globalThis.fetch.bind(globalThis);
+    const stealthFetch = async function stealthFetch(input, init) {
+        const url = getUrl(input);
+        if (!url || url.hostname !== "api.anthropic.com") {
+            return originalFetch(input, init);
+        }
+        const request = input instanceof Request ? input : null;
+        const headers = new Headers(init?.headers ?? request?.headers ?? undefined);
+        const apiKey = headers.get("x-api-key");
+        const authHeader = headers.get("authorization");
+        const bearerToken = authHeader?.startsWith("Bearer ")
+            ? authHeader.slice(7)
+            : null;
+        const setupToken = isSetupToken(apiKey)
+            ? apiKey
+            : isSetupToken(bearerToken)
+                ? bearerToken
+                : null;
+        if (!setupToken) {
+            return originalFetch(input, init);
+        }
+        // Add beta=true query param so the API serves the latest model versions
+        // (matches what claude-cli does, required for opus access).
+        if (!url.searchParams.has("beta")) {
+            url.searchParams.set("beta", "true");
+        }
+        headers.delete("x-api-key");
+        headers.set("authorization", `Bearer ${setupToken}`);
+        headers.set("anthropic-beta", ANTHROPIC_BETA);
+        headers.set("user-agent", `claude-cli/${CLAUDE_CODE_VERSION} (external, cli)`);
+        headers.set("x-app", "cli");
+        let body = init?.body ?? request?.body;
+        if (typeof body === "string") {
+            try {
+                const parsed = JSON.parse(body);
+                const updated = addSystemPrefix(parsed);
+                body = JSON.stringify(updated);
+            }
+            catch {
+                logger.debug("[stealth] Anthropic request body was not JSON; skipping system prefix");
+            }
+        }
+        const nextInit = {
+            ...init,
+            headers,
+            body: init ? body : undefined,
+        };
+        if (request && !init) {
+            const nextRequest = new Request(url.toString(), {
+                method: request.method,
+                headers,
+                body: typeof body === "string" ? body : undefined,
+            });
+            return originalFetch(nextRequest);
+        }
+        if (process.env.ELIZA_STEALTH_DEBUG && typeof body === "string") {
+            const modelMatch = body.match(/"model":"([^"]+)"/);
+            if (modelMatch) {
+                logger.debug(`[stealth] anthropic model=${modelMatch[1]}`);
+            }
+        }
+        return originalFetch(url.toString(), nextInit);
+    };
+    const sourceFetch = globalThis.fetch;
+    if ("preconnect" in sourceFetch) {
+        stealthFetch.preconnect = sourceFetch.preconnect;
+    }
+    globalThis.fetch = stealthFetch;
+    globalThis[STEALTH_GUARD] = true;
+}

package/dist/packages/agent/src/auth/credentials.d.ts

@@ -0,0 +1,100 @@
+/**
+ * Credential storage and token refresh for subscription providers.
+ *
+ * Credentials live under `~/.eliza/auth/{providerId}/{accountId}.json`
+ * (see `account-storage.ts` for the on-disk format and atomic-write
+ * details). The `loadCredentials` / `saveCredentials` /
+ * `deleteCredentials` / `hasValidCredentials` / `getAccessToken`
+ * helpers all default to `accountId="default"` so callers that pre-date
+ * multi-account support keep working without changes.
+ */
+import { type AccountCredentialRecord } from "./account-storage.ts";
+import { type AccountCredentialProvider, type OAuthCredentials, type StoredCredentials, type SubscriptionProvider } from "./types.ts";
+/**
+ * Save credentials for a provider account.
+ *
+ * The `accountId` defaults to `"default"`. New accounts are persisted
+ * with `source: "oauth"` and `label: "Default"` (or the existing
+ * record's label when overwriting).
+ */
+export declare function saveCredentials(provider: SubscriptionProvider, credentials: OAuthCredentials, accountId?: string): void;
+/**
+ * Load stored credentials for a provider account.
+ * Returns `null` when no account is configured for the given id.
+ */
+export declare function loadCredentials(provider: SubscriptionProvider, accountId?: string): StoredCredentials | null;
+/**
+ * Delete stored credentials for a provider account.
+ */
+export declare function deleteCredentials(provider: SubscriptionProvider, accountId?: string): void;
+/**
+ * Delete every stored credential account for a provider.
+ */
+export declare function deleteProviderCredentials(provider: AccountCredentialProvider): number;
+/**
+ * Check if credentials exist and are not expired.
+ */
+export declare function hasValidCredentials(provider: AccountCredentialProvider, accountId?: string): boolean;
+/**
+ * List all accounts configured for a provider.
+ */
+export declare function listProviderAccounts(provider: AccountCredentialProvider): AccountCredentialRecord[];
+/**
+ * Get a valid access token, refreshing if needed.
+ *
+ * Refreshes are serialized per `{provider}:{accountId}` via
+ * `accountRefreshMutex` so concurrent callers don't race on the
+ * refresh-token grant or the credential file write.
+ *
+ * Returns `null` when no credentials are stored or the refresh fails.
+ */
+export declare function getAccessToken(provider: AccountCredentialProvider, accountId?: string): Promise<string | null>;
+export type SubscriptionCredentialSource = "app" | "claude-code-cli" | "setup-token" | "codex-cli" | "gemini-cli" | "coding-plan-key" | "unavailable" | null;
+/**
+ * Per-account subscription status row used by the dashboard / API.
+ *
+ * One row is emitted per stored account for each provider. CLI- /
+ * setup-token-derived sources also produce a row with a synthetic
+ * `accountId` (e.g. `"claude-code-cli"`); those rows are read-only
+ * (they cannot be deleted via `DELETE /api/subscription/{provider}`).
+ */
+export interface SubscriptionAccountStatus {
+    provider: SubscriptionProvider;
+    accountId: string;
+    label: string;
+    configured: boolean;
+    valid: boolean;
+    expiresAt: number | null;
+    source: SubscriptionCredentialSource;
+    available?: boolean;
+    availabilityReason?: string;
+    allowedClient?: string;
+    loginHint?: string;
+    billingMode?: "subscription-coding-plan" | "subscription-coding-cli";
+}
+export declare function getSubscriptionStatus(): SubscriptionAccountStatus[];
+/**
+ * Apply subscription credentials to the environment.
+ * Called at startup to make credentials available to elizaOS plugins.
+ *
+ * **Claude subscription tokens are NOT applied to the runtime environment.**
+ * Anthropic's TOS only permits Claude subscription tokens to be used through
+ * the Claude Code CLI itself.  Eliza honours this by keeping the token
+ * available for the task-agent orchestrator (which spawns `claude` CLI
+ * subprocesses) but never injecting it into `process.env.ANTHROPIC_API_KEY`
+ * or installing the stealth fetch interceptor.
+ *
+ * Codex / ChatGPT subscription tokens are also CLI credentials. They are used
+ * by the Codex CLI-backed provider, not injected into `OPENAI_API_KEY`.
+ */
+export declare function applySubscriptionCredentials(config?: {
+    agents?: {
+        defaults?: {
+            subscriptionProvider?: string;
+            model?: {
+                primary?: string;
+            };
+        };
+    };
+}): Promise<void>;
+//# sourceMappingURL=credentials.d.ts.map

package/dist/packages/agent/src/auth/credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../../../../src/auth/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAYH,OAAO,EACL,KAAK,uBAAuB,EAM7B,MAAM,sBAAsB,CAAC;AAI9B,OAAO,EACL,KAAK,yBAAyB,EAM9B,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EAItB,KAAK,oBAAoB,EAC1B,MAAM,YAAY,CAAC;AAsBpB;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,oBAAoB,EAC9B,WAAW,EAAE,gBAAgB,EAC7B,SAAS,GAAE,MAA2B,GACrC,IAAI,CAuBN;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,oBAAoB,EAC9B,SAAS,GAAE,MAA2B,GACrC,iBAAiB,GAAG,IAAI,CAI1B;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,oBAAoB,EAC9B,SAAS,GAAE,MAA2B,GACrC,IAAI,CAEN;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,yBAAyB,GAClC,MAAM,CAMR;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,yBAAyB,EACnC,SAAS,GAAE,MAA2B,GACrC,OAAO,CAIT;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,yBAAyB,GAClC,uBAAuB,EAAE,CAE3B;AAED;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAClC,QAAQ,EAAE,yBAAyB,EACnC,SAAS,GAAE,MAA2B,GACrC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAqExB;AAuDD,MAAM,MAAM,4BAA4B,GACpC,KAAK,GACL,iBAAiB,GACjB,aAAa,GACb,WAAW,GACX,YAAY,GACZ,iBAAiB,GACjB,aAAa,GACb,IAAI,CAAC;AAET;;;;;;;GAOG;AACH,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,OAAO,CAAC;IACpB,KAAK,EAAE,OAAO,CAAC;IACf,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,EAAE,4BAA4B,CAAC;IACrC,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,0BAA0B,GAAG,yBAAyB,CAAC;CACtE;AAkCD,wBAAgB,qBAAqB,IAAI,yBAAyB,EAAE,CA2GnE;AA+ID;;;;;;;;;;;;;GAaG;AACH,wBAAsB,4BAA4B,CAAC,MAAM,CAAC,EAAE;IAC1D,MAAM,CAAC,EAAE;QACP,QAAQ,CAAC,EAAE;YAAE,oBAAoB,CAAC,EAAE,MAAM,CAAC;YAAC,KAAK,CAAC,EAAE;gBAAE,OAAO,CAAC,EAAE,MAAM,CAAA;aAAE,CAAA;SAAE,CAAC;KAC5E,CAAC;CACH,GAAG,OAAO,CAAC,IAAI,CAAC,CAgHhB"}