@elizaos/agent 2.0.0-alpha.97 → 2.0.0-beta.1

package/dist/packages/agent/src/auth/credentials.js

@@ -0,0 +1,553 @@
+/**
+ * Credential storage and token refresh for subscription providers.
+ *
+ * Credentials live under `~/.eliza/auth/{providerId}/{accountId}.json`
+ * (see `account-storage.ts` for the on-disk format and atomic-write
+ * details). The `loadCredentials` / `saveCredentials` /
+ * `deleteCredentials` / `hasValidCredentials` / `getAccessToken`
+ * helpers all default to `accountId="default"` so callers that pre-date
+ * multi-account support keep working without changes.
+ */
+import { execSync } from "node:child_process";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { getElizaNamespace, logger, resolveStateDir, resolveUserPath, } from "@elizaos/core";
+import { deleteAccount, listAccounts, loadAccount, migrateLegacySingleAccount, saveAccount, } from "./account-storage.js";
+import { refreshAnthropicToken } from "./anthropic.js";
+import { refreshCodexToken } from "./openai-codex.js";
+import { accountRefreshMutex } from "./refresh-mutex.js";
+import { isCodingPlanKeySubscriptionProvider, isExternalCliSubscriptionProvider, isOAuthSubscriptionProvider, isSubscriptionProvider, isUnavailableSubscriptionProvider, SUBSCRIPTION_PROVIDER_IDS, SUBSCRIPTION_PROVIDER_MAP, SUBSCRIPTION_PROVIDER_METADATA, } from "./types.js";
+const DEFAULT_ACCOUNT_ID = "default";
+/** Buffer before expiry to trigger refresh (5 minutes) */
+const REFRESH_BUFFER_MS = 5 * 60 * 1000;
+const invalidClaudeCodeRefreshTokens = new Set();
+// Run the legacy → per-account migration eagerly at module load. This
+// is cheap when there's nothing to migrate (one `existsSync` per
+// provider) and ensures every code path sees the per-account layout.
+migrateLegacySingleAccount();
+function recordToStored(record) {
+    return {
+        provider: record.providerId,
+        credentials: record.credentials,
+        createdAt: record.createdAt,
+        updatedAt: record.updatedAt,
+    };
+}
+/**
+ * Save credentials for a provider account.
+ *
+ * The `accountId` defaults to `"default"`. New accounts are persisted
+ * with `source: "oauth"` and `label: "Default"` (or the existing
+ * record's label when overwriting).
+ */
+export function saveCredentials(provider, credentials, accountId = DEFAULT_ACCOUNT_ID) {
+    const existing = loadAccount(provider, accountId);
+    const now = Date.now();
+    const record = {
+        id: accountId,
+        providerId: provider,
+        label: existing?.label ??
+            (accountId === DEFAULT_ACCOUNT_ID ? "Default" : accountId),
+        source: existing?.source ?? "oauth",
+        credentials,
+        createdAt: existing?.createdAt ?? now,
+        updatedAt: now,
+        ...(existing?.lastUsedAt !== undefined
+            ? { lastUsedAt: existing.lastUsedAt }
+            : {}),
+        ...(existing?.organizationId !== undefined
+            ? { organizationId: existing.organizationId }
+            : {}),
+        ...(existing?.userId !== undefined ? { userId: existing.userId } : {}),
+        ...(existing?.email !== undefined ? { email: existing.email } : {}),
+    };
+    saveAccount(record);
+}
+/**
+ * Load stored credentials for a provider account.
+ * Returns `null` when no account is configured for the given id.
+ */
+export function loadCredentials(provider, accountId = DEFAULT_ACCOUNT_ID) {
+    const record = loadAccount(provider, accountId);
+    if (!record)
+        return null;
+    return recordToStored(record);
+}
+/**
+ * Delete stored credentials for a provider account.
+ */
+export function deleteCredentials(provider, accountId = DEFAULT_ACCOUNT_ID) {
+    deleteAccount(provider, accountId);
+}
+/**
+ * Delete every stored credential account for a provider.
+ */
+export function deleteProviderCredentials(provider) {
+    const accounts = listProviderAccounts(provider);
+    for (const account of accounts) {
+        deleteAccount(provider, account.id);
+    }
+    return accounts.length;
+}
+/**
+ * Check if credentials exist and are not expired.
+ */
+export function hasValidCredentials(provider, accountId = DEFAULT_ACCOUNT_ID) {
+    const record = loadAccount(provider, accountId);
+    if (!record)
+        return false;
+    return record.credentials.expires > Date.now();
+}
+/**
+ * List all accounts configured for a provider.
+ */
+export function listProviderAccounts(provider) {
+    return listAccounts(provider);
+}
+/**
+ * Get a valid access token, refreshing if needed.
+ *
+ * Refreshes are serialized per `{provider}:{accountId}` via
+ * `accountRefreshMutex` so concurrent callers don't race on the
+ * refresh-token grant or the credential file write.
+ *
+ * Returns `null` when no credentials are stored or the refresh fails.
+ */
+export async function getAccessToken(provider, accountId = DEFAULT_ACCOUNT_ID) {
+    if (!isSubscriptionProvider(provider)) {
+        const direct = loadAccount(provider, accountId);
+        if (!direct)
+            return null;
+        if (direct.credentials.expires <= Date.now())
+            return null;
+        return direct.credentials.access;
+    }
+    const initial = loadCredentials(provider, accountId);
+    if (!initial)
+        return null;
+    if (initial.credentials.expires > Date.now() + REFRESH_BUFFER_MS) {
+        return initial.credentials.access;
+    }
+    if (isCodingPlanKeySubscriptionProvider(provider)) {
+        return initial.credentials.expires > Date.now()
+            ? initial.credentials.access
+            : null;
+    }
+    if (isExternalCliSubscriptionProvider(provider) ||
+        isUnavailableSubscriptionProvider(provider)) {
+        logger.info(`[auth] ${provider} is not an importable OAuth credential; use its first-party coding client or supported coding endpoint.`);
+        return null;
+    }
+    return accountRefreshMutex.acquire(`${provider}:${accountId}`, async () => {
+        // Re-read after acquiring the lock — a concurrent caller may have
+        // already refreshed the token, in which case we want the new one.
+        const stored = loadCredentials(provider, accountId);
+        if (!stored)
+            return null;
+        const { credentials } = stored;
+        if (credentials.expires > Date.now() + REFRESH_BUFFER_MS) {
+            return credentials.access;
+        }
+        logger.info(`[auth] Refreshing ${provider} token for account "${accountId}"...`);
+        let refreshed;
+        try {
+            if (provider === "anthropic-subscription") {
+                refreshed = await refreshAnthropicToken(credentials.refresh);
+            }
+            else if (provider === "openai-codex") {
+                refreshed = await refreshCodexToken(credentials.refresh);
+            }
+            else if (!isOAuthSubscriptionProvider(provider)) {
+                logger.error(`[auth] Unknown provider: ${provider}`);
+                return null;
+            }
+            else {
+                logger.error(`[auth] Refresh not implemented for provider: ${provider}`);
+                return null;
+            }
+        }
+        catch (err) {
+            logger.error(`[auth] Failed to refresh ${provider} token for "${accountId}": ${err}`);
+            return null;
+        }
+        saveCredentials(provider, refreshed, accountId);
+        return refreshed.access;
+    });
+}
+function parseCodexCliAuthJson(raw) {
+    try {
+        const data = JSON.parse(raw);
+        if (!data || typeof data !== "object")
+            return null;
+        return data;
+    }
+    catch {
+        return null;
+    }
+}
+function readConfiguredAnthropicSetupToken() {
+    const namespace = getElizaNamespace();
+    const explicitConfig = process.env.ELIZA_CONFIG_PATH?.trim();
+    const configPath = explicitConfig
+        ? resolveUserPath(explicitConfig)
+        : path.join(resolveStateDir(), `${namespace}.json`);
+    try {
+        const parsed = JSON.parse(fs.readFileSync(configPath, "utf-8"));
+        const token = parsed.env?.__anthropicSubscriptionToken;
+        return typeof token === "string" && token.trim() ? token.trim() : null;
+    }
+    catch {
+        return null;
+    }
+}
+function hasCodexCliSubscriptionAuth() {
+    const authPath = path.join(os.homedir(), ".codex", "auth.json");
+    try {
+        const data = parseCodexCliAuthJson(fs.readFileSync(authPath, "utf-8"));
+        if (!data)
+            return false;
+        if (data.tokens?.access_token?.trim())
+            return true;
+        return Boolean(data.OPENAI_API_KEY?.trim() &&
+            data.auth_mode?.trim() &&
+            data.auth_mode.trim().toLowerCase() !== "api-key");
+    }
+    catch {
+        return false;
+    }
+}
+function subscriptionStatusMetadata(provider) {
+    const metadata = SUBSCRIPTION_PROVIDER_METADATA[provider];
+    return {
+        available: metadata.availability !== "unavailable",
+        allowedClient: metadata.allowedClient,
+        loginHint: metadata.setupHint,
+        billingMode: metadata.billingMode,
+        ...(metadata.availabilityReason
+            ? { availabilityReason: metadata.availabilityReason }
+            : {}),
+    };
+}
+function hasCommandOnPath(commandName) {
+    const command = process.platform === "win32" ? "where" : "command -v";
+    try {
+        execSync(`${command} ${commandName}`, {
+            encoding: "utf8",
+            timeout: 1500,
+            stdio: ["ignore", "pipe", "ignore"],
+        });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export function getSubscriptionStatus() {
+    const rows = [];
+    for (const provider of SUBSCRIPTION_PROVIDER_IDS) {
+        const metadata = subscriptionStatusMetadata(provider);
+        const accounts = listProviderAccounts(provider);
+        for (const account of accounts) {
+            rows.push({
+                ...metadata,
+                provider,
+                accountId: account.id,
+                label: account.label,
+                configured: true,
+                valid: account.credentials.expires > Date.now(),
+                expiresAt: account.credentials.expires,
+                source: isCodingPlanKeySubscriptionProvider(provider) &&
+                    account.source === "api-key"
+                    ? "coding-plan-key"
+                    : "app",
+            });
+        }
+        // Read the Claude Code OAuth blob exactly once per provider —
+        // `readClaudeCodeOAuthBlob()` shells out to `security` on macOS
+        // and calling it twice doubled the cost of every status poll.
+        const claudeBlob = provider === "anthropic-subscription" ? readClaudeCodeOAuthBlob() : null;
+        if (provider === "anthropic-subscription") {
+            let importedClaudeAuth = null;
+            let claudeSource = null;
+            if (claudeBlob?.accessToken) {
+                importedClaudeAuth = claudeBlob.accessToken;
+                claudeSource = "claude-code-cli";
+            }
+            else {
+                importedClaudeAuth = readConfiguredAnthropicSetupToken();
+                if (importedClaudeAuth)
+                    claudeSource = "setup-token";
+            }
+            if (importedClaudeAuth) {
+                const blobExpiresAt = claudeBlob?.expiresAt ?? null;
+                const blobValid = claudeBlob
+                    ? blobExpiresAt === null || blobExpiresAt > Date.now()
+                    : true;
+                const accountId = claudeSource === "claude-code-cli"
+                    ? "claude-code-cli"
+                    : "setup-token";
+                const label = claudeSource === "claude-code-cli"
+                    ? "Claude Code CLI"
+                    : "Setup Token";
+                rows.push({
+                    ...metadata,
+                    provider,
+                    accountId,
+                    label,
+                    configured: true,
+                    valid: blobValid,
+                    expiresAt: blobExpiresAt,
+                    source: claudeSource,
+                });
+            }
+        }
+        if (provider === "openai-codex" && hasCodexCliSubscriptionAuth()) {
+            rows.push({
+                ...metadata,
+                provider,
+                accountId: "codex-cli",
+                label: "Codex CLI",
+                configured: true,
+                valid: true,
+                expiresAt: null,
+                source: "codex-cli",
+            });
+        }
+        if (provider === "gemini-cli") {
+            const geminiCliDetected = hasCommandOnPath("gemini");
+            rows.push({
+                ...metadata,
+                provider,
+                accountId: "gemini-cli",
+                label: "Gemini CLI",
+                configured: geminiCliDetected,
+                valid: geminiCliDetected,
+                expiresAt: null,
+                source: geminiCliDetected ? "gemini-cli" : null,
+            });
+        }
+        if (provider === "deepseek-coding") {
+            rows.push({
+                ...metadata,
+                provider,
+                accountId: "deepseek-coding",
+                label: "DeepSeek Coding Plan",
+                configured: false,
+                valid: false,
+                expiresAt: null,
+                source: "unavailable",
+            });
+        }
+    }
+    return rows;
+}
+function isClaudeCodeInvalidGrantError(err) {
+    const message = err instanceof Error ? err.message : String(err);
+    return /\binvalid_grant\b/i.test(message);
+}
+/**
+ * Try to read a Claude Code OAuth credential blob from disk or the macOS
+ * keychain. Does NOT validate expiry — that's the caller's job (so it can
+ * decide whether to refresh via the refresh token).
+ *
+ * Claude Code stores credentials in two places:
+ *   - `~/.claude/.credentials.json` (Linux / older macOS installs)
+ *   - macOS Keychain entry "Claude Code-credentials" (current macOS)
+ *
+ * Note that Claude Code's runtime keeps the live access token in memory and
+ * refreshes it via the refresh token on demand — the persisted access token
+ * will often be expired even though the user is actively using Claude Code.
+ * That's why we always need to be ready to refresh.
+ */
+function readClaudeCodeOAuthBlob() {
+    const parse = (raw, source) => {
+        try {
+            const parsed = JSON.parse(raw);
+            const oauth = parsed?.claudeAiOauth;
+            if (!oauth)
+                return null;
+            const accessToken = oauth.accessToken ?? oauth.access_token;
+            if (typeof accessToken !== "string" || !accessToken.trim())
+                return null;
+            return {
+                accessToken: accessToken.trim(),
+                refreshToken: oauth.refreshToken ?? oauth.refresh_token ?? null,
+                expiresAt: oauth.expiresAt ?? oauth.expires_at ?? null,
+                source,
+            };
+        }
+        catch {
+            return null;
+        }
+    };
+    // 1. Try ~/.claude/.credentials.json
+    const credPath = path.join(os.homedir(), ".claude", ".credentials.json");
+    try {
+        if (fs.existsSync(credPath)) {
+            const raw = fs.readFileSync(credPath, "utf-8");
+            const blob = parse(raw, "credentials file");
+            if (blob)
+                return blob;
+        }
+    }
+    catch {
+        // Non-fatal
+    }
+    // 2. Try macOS Keychain
+    if (process.platform === "darwin") {
+        try {
+            const raw = execSync('security find-generic-password -s "Claude Code-credentials" -w 2>/dev/null', { encoding: "utf8", timeout: 3000 }).trim();
+            if (raw) {
+                const blob = parse(raw, "keychain");
+                if (blob)
+                    return blob;
+            }
+        }
+        catch {
+            // Keychain not available or no entry
+        }
+    }
+    return null;
+}
+/**
+ * Import a usable Anthropic OAuth access token from Claude Code's stored
+ * credentials. If the persisted access token is still valid, returns it
+ * directly. If it has expired, attempts to refresh via the persisted refresh
+ * token. Returns null if no credentials are available, the token is expired
+ * with no refresh token, or the refresh fails.
+ */
+async function importClaudeCodeOAuthToken() {
+    const blob = readClaudeCodeOAuthBlob();
+    if (!blob)
+        return null;
+    const expired = typeof blob.expiresAt === "number" && blob.expiresAt <= Date.now();
+    if (!expired) {
+        logger.info(`[auth] Imported OAuth token from Claude Code ${blob.source}`);
+        return blob.accessToken;
+    }
+    if (!blob.refreshToken) {
+        logger.info(`[auth] Claude Code OAuth token from ${blob.source} is expired and no refresh token is available. Run "claude auth login" to refresh.`);
+        return null;
+    }
+    const refreshTokenCacheKey = `${blob.source}:${blob.refreshToken}`;
+    if (invalidClaudeCodeRefreshTokens.has(refreshTokenCacheKey)) {
+        return null;
+    }
+    try {
+        const refreshed = await refreshAnthropicToken(blob.refreshToken);
+        logger.info(`[auth] Refreshed Claude Code OAuth token from ${blob.source}`);
+        return refreshed.access;
+    }
+    catch (err) {
+        if (isClaudeCodeInvalidGrantError(err)) {
+            invalidClaudeCodeRefreshTokens.add(refreshTokenCacheKey);
+            logger.info(`[auth] Claude Code OAuth refresh token from ${blob.source} is invalid or revoked. Run "claude auth login" to refresh.`);
+            return null;
+        }
+        logger.warn(`[auth] Failed to refresh expired Claude Code OAuth token from ${blob.source}: ${String(err)}. Run "claude auth login" to refresh.`);
+        return null;
+    }
+}
+/**
+ * Apply subscription credentials to the environment.
+ * Called at startup to make credentials available to elizaOS plugins.
+ *
+ * **Claude subscription tokens are NOT applied to the runtime environment.**
+ * Anthropic's TOS only permits Claude subscription tokens to be used through
+ * the Claude Code CLI itself.  Eliza honours this by keeping the token
+ * available for the task-agent orchestrator (which spawns `claude` CLI
+ * subprocesses) but never injecting it into `process.env.ANTHROPIC_API_KEY`
+ * or installing the stealth fetch interceptor.
+ *
+ * Codex / ChatGPT subscription tokens are also CLI credentials. They are used
+ * by the Codex CLI-backed provider, not injected into `OPENAI_API_KEY`.
+ */
+export async function applySubscriptionCredentials(config) {
+    const subscriptionCredentialsDisabled = process.env.ELIZA_DISABLE_SUBSCRIPTION_CREDENTIALS?.trim().toLowerCase();
+    if (subscriptionCredentialsDisabled === "1" ||
+        subscriptionCredentialsDisabled === "true" ||
+        subscriptionCredentialsDisabled === "yes" ||
+        subscriptionCredentialsDisabled === "on") {
+        logger.info("[auth] Subscription credential application disabled by ELIZA_DISABLE_SUBSCRIPTION_CREDENTIALS");
+        return;
+    }
+    // ── Anthropic subscription ──────────────────────────────────────────
+    //
+    // Anthropic subscription tokens (sk-ant-oat*) are restricted to the
+    // Claude Code CLI by Anthropic's TOS. They must NOT be used for direct
+    // API calls from the elizaOS runtime. The subscription token only flows
+    // to spawned coding-agent CLI sessions via the orchestrator plugin
+    // (which ARE Claude Code). If the user has only a subscription and no
+    // API key, the runtime simply won't have an Anthropic provider — they
+    // need an API key or Eliza Cloud for the main agent.
+    const anthropicAccounts = listProviderAccounts("anthropic-subscription");
+    if (anthropicAccounts.length > 0) {
+        const labels = anthropicAccounts
+            .map((a) => `"${a.label}" (${a.id})`)
+            .join(", ");
+        logger.info(`[auth] Anthropic subscription accounts configured: ${labels} — available for coding agents (Claude Code CLI). ` +
+            "Not applied to runtime env. Add an API key or connect Eliza Cloud for the main agent.");
+    }
+    else {
+        const claudeImported = await importClaudeCodeOAuthToken();
+        if (claudeImported) {
+            logger.info("[auth] Anthropic subscription detected via Claude Code CLI — available for coding agents. " +
+                "Not applied to runtime env. Add an API key or connect Eliza Cloud for the main agent.");
+        }
+    }
+    // ── OpenAI Codex subscription ────────────────────────────────────────
+    //
+    // Codex subscriptions power the Codex CLI-backed provider and task-agent
+    // subprocesses. Do not inject their OAuth access tokens into OPENAI_API_KEY:
+    // the normal OpenAI API path expects scoped API keys.
+    const codexAccounts = listProviderAccounts("openai-codex");
+    if (codexAccounts.length > 0) {
+        const labels = codexAccounts
+            .map((a) => `"${a.label}" (${a.id})`)
+            .join(", ");
+        logger.info(`[auth] OpenAI Codex subscription accounts configured: ${labels} — available for Codex CLI-backed coding/model providers. ` +
+            "Not applied to OPENAI_API_KEY; add a direct OpenAI API key for @elizaos/plugin-openai runtime inference.");
+    }
+    else {
+        if (hasCodexCliSubscriptionAuth()) {
+            logger.info("[auth] OpenAI Codex CLI auth detected in ~/.codex/auth.json — available for Codex CLI-backed coding/model providers. " +
+                "Not applied to OPENAI_API_KEY; add a direct OpenAI API key for @elizaos/plugin-openai runtime inference.");
+        }
+    }
+    const geminiAccounts = listProviderAccounts("gemini-cli");
+    if (geminiAccounts.length > 0 || hasCommandOnPath("gemini")) {
+        logger.info("[auth] Gemini CLI subscription surface detected/configured — available only through Gemini CLI task agents. " +
+            "Not applied to GOOGLE_API_KEY or GOOGLE_GENERATIVE_AI_API_KEY.");
+    }
+    for (const provider of ["zai-coding", "kimi-coding"]) {
+        const accounts = listProviderAccounts(provider);
+        if (accounts.length === 0)
+            continue;
+        const labels = accounts.map((a) => `"${a.label}" (${a.id})`).join(", ");
+        const envName = provider === "zai-coding" ? "ZAI_API_KEY" : "MOONSHOT_API_KEY";
+        logger.info(`[auth] ${provider} coding-plan accounts configured: ${labels} — available only for the provider's dedicated coding endpoint. ` +
+            `Not applied to ${envName}.`);
+    }
+    // Auto-set model.primary only for subscription providers that have a runtime
+    // model-provider plugin. CLI-only subscriptions should not point the runtime
+    // at direct API-key plugins.
+    if (config?.agents?.defaults) {
+        const defaults = config.agents.defaults;
+        const provider = defaults.subscriptionProvider;
+        if (provider) {
+            const modelId = SUBSCRIPTION_PROVIDER_MAP[provider];
+            const runtimeApplicable = provider === "openai-codex";
+            if (modelId && runtimeApplicable) {
+                if (!defaults.model) {
+                    defaults.model = { primary: modelId };
+                    logger.info(`[auth] Auto-set model.primary to "${modelId}" from subscription provider`);
+                }
+                else if (!defaults.model.primary) {
+                    defaults.model.primary = modelId;
+                    logger.info(`[auth] Auto-set model.primary to "${modelId}" from subscription provider`);
+                }
+            }
+        }
+    }
+}

package/dist/packages/agent/src/auth/index.d.ts

@@ -0,0 +1,8 @@
+export * from "./account-storage.ts";
+export * from "./anthropic.ts";
+export * from "./claude-code-stealth.ts";
+export * from "./credentials.ts";
+export * from "./oauth-flow.ts";
+export * from "./openai-codex.ts";
+export * from "./types.ts";
+//# sourceMappingURL=index.d.ts.map

package/dist/packages/agent/src/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/auth/index.ts"],"names":[],"mappings":"AAAA,cAAc,sBAAsB,CAAC;AACrC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,0BAA0B,CAAC;AACzC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC;AAClC,cAAc,YAAY,CAAC"}

package/dist/packages/agent/src/auth/index.js

@@ -0,0 +1,7 @@
+export * from "./account-storage.js";
+export * from "./anthropic.js";
+export * from "./claude-code-stealth.js";
+export * from "./credentials.js";
+export * from "./oauth-flow.js";
+export * from "./openai-codex.js";
+export * from "./types.js";

package/dist/packages/agent/src/auth/oauth-flow.d.ts

@@ -0,0 +1,106 @@
+/**
+ * OAuth flow orchestration registry.
+ *
+ * Wraps the provider-specific programmatic OAuth helpers
+ * (`startAnthropicOAuthFlowRaw` from
+ * `vendor/pi-oauth/anthropic-login.ts` and the loopback-listener flow
+ * in `openai-codex.ts`) with:
+ *
+ *   - a 5-minute timeout per flow,
+ *   - automatic `saveAccount(...)` after token exchange,
+ *   - an in-memory registry keyed by `sessionId` so the HTTP API can
+ *     stream progress over SSE and the CLI can `await` completion,
+ *   - garbage collection 10 minutes after a flow reaches a terminal
+ *     state.
+ *
+ * Both the CLI and the new accounts-routes HTTP endpoints drive flows
+ * through this module — there is no direct caller of the vendor-level
+ * OAuth helpers anymore.
+ */
+import { type AccountCredentialRecord } from "./account-storage.ts";
+import type { SubscriptionProvider } from "./types.ts";
+/** Server-tracked status of an in-flight OAuth flow. */
+export type FlowStatus = "pending" | "success" | "error" | "cancelled" | "timeout";
+export interface FlowState {
+    sessionId: string;
+    providerId: SubscriptionProvider;
+    status: FlowStatus;
+    /** Set on `pending` (so the UI can re-open the browser) and on `success`. */
+    authUrl?: string;
+    /** Anthropic only — the user must paste `code#state`; Codex uses the loopback callback. */
+    needsCodeSubmission: boolean;
+    account?: AccountCredentialRecord;
+    error?: string;
+    startedAt: number;
+    endedAt?: number;
+}
+export interface OAuthFlowHandle {
+    sessionId: string;
+    authUrl: string;
+    /** Codex flows resolve via the loopback listener; Anthropic requires `submitCode`. */
+    needsCodeSubmission: boolean;
+    /** Resolves with the saved AccountCredentialRecord; rejects on cancel/timeout/error. */
+    completion: Promise<{
+        account: AccountCredentialRecord;
+    }>;
+    /** Anthropic only — submit `code#state` from the redirect page. No-op for Codex. */
+    submitCode: (code: string) => void;
+    cancel: (reason?: string) => void;
+}
+interface StartOptions {
+    label: string;
+    accountId?: string;
+    /**
+     * Called after the account is saved on disk. Used by the HTTP
+     * route layer to also write a `LinkedAccountConfig` row into
+     * `eliza.json`. Failures here propagate as flow `error`.
+     */
+    onAccountSaved?: (account: AccountCredentialRecord) => void | Promise<void>;
+}
+/**
+ * Start a programmatic Anthropic OAuth flow. Anthropic's redirect URI
+ * is hardcoded to `console.anthropic.com/oauth/code/callback` — the
+ * UI must surface the auth URL, prompt the user to copy the
+ * `code#state` blob, and call `submitCode()` with it. Once the code is
+ * submitted, the token exchange runs and the account is persisted.
+ */
+export declare function startAnthropicOAuthFlow(opts: StartOptions): Promise<OAuthFlowHandle>;
+/**
+ * Start a programmatic Codex OAuth flow. Codex has a loopback listener
+ * on :1455, so the user just signs in in the browser and the listener
+ * picks up the redirect — `submitCode()` is a no-op. The accountId
+ * baked into the JWT is preserved on `LinkedAccountConfig.organizationId`
+ * (used by the Codex usage probe via the `ChatGPT-Account-Id` header).
+ */
+export declare function startCodexOAuthFlow(opts: StartOptions): Promise<OAuthFlowHandle>;
+export declare function getFlowState(sessionId: string): FlowState | null;
+export declare function getFlowHandle(sessionId: string): OAuthFlowHandle | null;
+/**
+ * Subscribe to status updates for a flow. Replays the current state
+ * synchronously so SSE consumers always receive an immediate frame.
+ * Returns an unsubscribe function.
+ */
+export declare function subscribeFlow(sessionId: string, listener: (state: FlowState) => void): () => void;
+export declare function cancelFlow(sessionId: string, reason?: string): boolean;
+export declare function submitFlowCode(sessionId: string, code: string): boolean;
+/**
+ * Remove every flow from the registry. Tests use this to reset
+ * between cases without resetting the whole module.
+ */
+export declare function _resetFlowRegistry(): void;
+/**
+ * Test-only helper to seed a synthetic flow without going through the
+ * vendor layer. Used by `accounts-routes.test.ts` to assert the SSE
+ * surface streams `success` / `error` payloads correctly.
+ */
+export declare function _registerSyntheticFlow(args: {
+    sessionId?: string;
+    providerId: SubscriptionProvider;
+    authUrl: string;
+    needsCodeSubmission?: boolean;
+}): {
+    sessionId: string;
+    complete: (state: FlowState) => void;
+};
+export {};
+//# sourceMappingURL=oauth-flow.d.ts.map

package/dist/packages/agent/src/auth/oauth-flow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-flow.d.ts","sourceRoot":"","sources":["../../../../../src/auth/oauth-flow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,OAAO,EACL,KAAK,uBAAuB,EAE7B,MAAM,sBAAsB,CAAC;AAG9B,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAMvD,wDAAwD;AACxD,MAAM,MAAM,UAAU,GAClB,SAAS,GACT,SAAS,GACT,OAAO,GACP,WAAW,GACX,SAAS,CAAC;AAEd,MAAM,WAAW,SAAS;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,oBAAoB,CAAC;IACjC,MAAM,EAAE,UAAU,CAAC;IACnB,6EAA6E;IAC7E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2FAA2F;IAC3F,mBAAmB,EAAE,OAAO,CAAC;IAC7B,OAAO,CAAC,EAAE,uBAAuB,CAAC;IAClC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,sFAAsF;IACtF,mBAAmB,EAAE,OAAO,CAAC;IAC7B,wFAAwF;IACxF,UAAU,EAAE,OAAO,CAAC;QAAE,OAAO,EAAE,uBAAuB,CAAA;KAAE,CAAC,CAAC;IAC1D,oFAAoF;IACpF,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACnC,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;CACnC;AAuED,UAAU,YAAY;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,cAAc,CAAC,EAAE,CAAC,OAAO,EAAE,uBAAuB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7E;AAID;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,YAAY,GACjB,OAAO,CAAC,eAAe,CAAC,CAqB1B;AAID;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,YAAY,GACjB,OAAO,CAAC,eAAe,CAAC,CAmB1B;AA2ID,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAGhE;AAED,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI,CAGvE;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAC3B,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,CAAC,KAAK,EAAE,SAAS,KAAK,IAAI,GACnC,MAAM,IAAI,CASZ;AAED,wBAAgB,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAMtE;AAED,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAOvE;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,IAAI,IAAI,CAKzC;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE;IAC3C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,oBAAoB,CAAC;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B,GAAG;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,SAAS,KAAK,IAAI,CAAA;CAAE,CA+B9D"}