@elizaos/agent 2.0.0-beta.2 → 2.0.11-beta.5

package/packages/agent/src/auth/credentials.js

@@ -1,553 +0,0 @@
-/**
- * Credential storage and token refresh for subscription providers.
- *
- * Credentials live under `~/.eliza/auth/{providerId}/{accountId}.json`
- * (see `account-storage.ts` for the on-disk format and atomic-write
- * details). The `loadCredentials` / `saveCredentials` /
- * `deleteCredentials` / `hasValidCredentials` / `getAccessToken`
- * helpers all default to `accountId="default"` so callers that pre-date
- * multi-account support keep working without changes.
- */
-import { execSync } from "node:child_process";
-import fs from "node:fs";
-import os from "node:os";
-import path from "node:path";
-import { getElizaNamespace, logger, resolveStateDir, resolveUserPath, } from "@elizaos/core";
-import { deleteAccount, listAccounts, loadAccount, migrateLegacySingleAccount, saveAccount, } from "./account-storage.js";
-import { refreshAnthropicToken } from "./anthropic.js";
-import { refreshCodexToken } from "./openai-codex.js";
-import { accountRefreshMutex } from "./refresh-mutex.js";
-import { isCodingPlanKeySubscriptionProvider, isExternalCliSubscriptionProvider, isOAuthSubscriptionProvider, isSubscriptionProvider, isUnavailableSubscriptionProvider, SUBSCRIPTION_PROVIDER_IDS, SUBSCRIPTION_PROVIDER_MAP, SUBSCRIPTION_PROVIDER_METADATA, } from "./types.js";
-const DEFAULT_ACCOUNT_ID = "default";
-/** Buffer before expiry to trigger refresh (5 minutes) */
-const REFRESH_BUFFER_MS = 5 * 60 * 1000;
-const invalidClaudeCodeRefreshTokens = new Set();
-// Run the legacy → per-account migration eagerly at module load. This
-// is cheap when there's nothing to migrate (one `existsSync` per
-// provider) and ensures every code path sees the per-account layout.
-migrateLegacySingleAccount();
-function recordToStored(record) {
-    return {
-        provider: record.providerId,
-        credentials: record.credentials,
-        createdAt: record.createdAt,
-        updatedAt: record.updatedAt,
-    };
-}
-/**
- * Save credentials for a provider account.
- *
- * The `accountId` defaults to `"default"`. New accounts are persisted
- * with `source: "oauth"` and `label: "Default"` (or the existing
- * record's label when overwriting).
- */
-export function saveCredentials(provider, credentials, accountId = DEFAULT_ACCOUNT_ID) {
-    const existing = loadAccount(provider, accountId);
-    const now = Date.now();
-    const record = {
-        id: accountId,
-        providerId: provider,
-        label: existing?.label ??
-            (accountId === DEFAULT_ACCOUNT_ID ? "Default" : accountId),
-        source: existing?.source ?? "oauth",
-        credentials,
-        createdAt: existing?.createdAt ?? now,
-        updatedAt: now,
-        ...(existing?.lastUsedAt !== undefined
-            ? { lastUsedAt: existing.lastUsedAt }
-            : {}),
-        ...(existing?.organizationId !== undefined
-            ? { organizationId: existing.organizationId }
-            : {}),
-        ...(existing?.userId !== undefined ? { userId: existing.userId } : {}),
-        ...(existing?.email !== undefined ? { email: existing.email } : {}),
-    };
-    saveAccount(record);
-}
-/**
- * Load stored credentials for a provider account.
- * Returns `null` when no account is configured for the given id.
- */
-export function loadCredentials(provider, accountId = DEFAULT_ACCOUNT_ID) {
-    const record = loadAccount(provider, accountId);
-    if (!record)
-        return null;
-    return recordToStored(record);
-}
-/**
- * Delete stored credentials for a provider account.
- */
-export function deleteCredentials(provider, accountId = DEFAULT_ACCOUNT_ID) {
-    deleteAccount(provider, accountId);
-}
-/**
- * Delete every stored credential account for a provider.
- */
-export function deleteProviderCredentials(provider) {
-    const accounts = listProviderAccounts(provider);
-    for (const account of accounts) {
-        deleteAccount(provider, account.id);
-    }
-    return accounts.length;
-}
-/**
- * Check if credentials exist and are not expired.
- */
-export function hasValidCredentials(provider, accountId = DEFAULT_ACCOUNT_ID) {
-    const record = loadAccount(provider, accountId);
-    if (!record)
-        return false;
-    return record.credentials.expires > Date.now();
-}
-/**
- * List all accounts configured for a provider.
- */
-export function listProviderAccounts(provider) {
-    return listAccounts(provider);
-}
-/**
- * Get a valid access token, refreshing if needed.
- *
- * Refreshes are serialized per `{provider}:{accountId}` via
- * `accountRefreshMutex` so concurrent callers don't race on the
- * refresh-token grant or the credential file write.
- *
- * Returns `null` when no credentials are stored or the refresh fails.
- */
-export async function getAccessToken(provider, accountId = DEFAULT_ACCOUNT_ID) {
-    if (!isSubscriptionProvider(provider)) {
-        const direct = loadAccount(provider, accountId);
-        if (!direct)
-            return null;
-        if (direct.credentials.expires <= Date.now())
-            return null;
-        return direct.credentials.access;
-    }
-    const initial = loadCredentials(provider, accountId);
-    if (!initial)
-        return null;
-    if (initial.credentials.expires > Date.now() + REFRESH_BUFFER_MS) {
-        return initial.credentials.access;
-    }
-    if (isCodingPlanKeySubscriptionProvider(provider)) {
-        return initial.credentials.expires > Date.now()
-            ? initial.credentials.access
-            : null;
-    }
-    if (isExternalCliSubscriptionProvider(provider) ||
-        isUnavailableSubscriptionProvider(provider)) {
-        logger.info(`[auth] ${provider} is not an importable OAuth credential; use its first-party coding client or supported coding endpoint.`);
-        return null;
-    }
-    return accountRefreshMutex.acquire(`${provider}:${accountId}`, async () => {
-        // Re-read after acquiring the lock — a concurrent caller may have
-        // already refreshed the token, in which case we want the new one.
-        const stored = loadCredentials(provider, accountId);
-        if (!stored)
-            return null;
-        const { credentials } = stored;
-        if (credentials.expires > Date.now() + REFRESH_BUFFER_MS) {
-            return credentials.access;
-        }
-        logger.info(`[auth] Refreshing ${provider} token for account "${accountId}"...`);
-        let refreshed;
-        try {
-            if (provider === "anthropic-subscription") {
-                refreshed = await refreshAnthropicToken(credentials.refresh);
-            }
-            else if (provider === "openai-codex") {
-                refreshed = await refreshCodexToken(credentials.refresh);
-            }
-            else if (!isOAuthSubscriptionProvider(provider)) {
-                logger.error(`[auth] Unknown provider: ${provider}`);
-                return null;
-            }
-            else {
-                logger.error(`[auth] Refresh not implemented for provider: ${provider}`);
-                return null;
-            }
-        }
-        catch (err) {
-            logger.error(`[auth] Failed to refresh ${provider} token for "${accountId}": ${err}`);
-            return null;
-        }
-        saveCredentials(provider, refreshed, accountId);
-        return refreshed.access;
-    });
-}
-function parseCodexCliAuthJson(raw) {
-    try {
-        const data = JSON.parse(raw);
-        if (!data || typeof data !== "object")
-            return null;
-        return data;
-    }
-    catch {
-        return null;
-    }
-}
-function readConfiguredAnthropicSetupToken() {
-    const namespace = getElizaNamespace();
-    const explicitConfig = process.env.ELIZA_CONFIG_PATH?.trim();
-    const configPath = explicitConfig
-        ? resolveUserPath(explicitConfig)
-        : path.join(resolveStateDir(), `${namespace}.json`);
-    try {
-        const parsed = JSON.parse(fs.readFileSync(configPath, "utf-8"));
-        const token = parsed.env?.__anthropicSubscriptionToken;
-        return typeof token === "string" && token.trim() ? token.trim() : null;
-    }
-    catch {
-        return null;
-    }
-}
-function hasCodexCliSubscriptionAuth() {
-    const authPath = path.join(os.homedir(), ".codex", "auth.json");
-    try {
-        const data = parseCodexCliAuthJson(fs.readFileSync(authPath, "utf-8"));
-        if (!data)
-            return false;
-        if (data.tokens?.access_token?.trim())
-            return true;
-        return Boolean(data.OPENAI_API_KEY?.trim() &&
-            data.auth_mode?.trim() &&
-            data.auth_mode.trim().toLowerCase() !== "api-key");
-    }
-    catch {
-        return false;
-    }
-}
-function subscriptionStatusMetadata(provider) {
-    const metadata = SUBSCRIPTION_PROVIDER_METADATA[provider];
-    return {
-        available: metadata.availability !== "unavailable",
-        allowedClient: metadata.allowedClient,
-        loginHint: metadata.setupHint,
-        billingMode: metadata.billingMode,
-        ...(metadata.availabilityReason
-            ? { availabilityReason: metadata.availabilityReason }
-            : {}),
-    };
-}
-function hasCommandOnPath(commandName) {
-    const command = process.platform === "win32" ? "where" : "command -v";
-    try {
-        execSync(`${command} ${commandName}`, {
-            encoding: "utf8",
-            timeout: 1500,
-            stdio: ["ignore", "pipe", "ignore"],
-        });
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-export function getSubscriptionStatus() {
-    const rows = [];
-    for (const provider of SUBSCRIPTION_PROVIDER_IDS) {
-        const metadata = subscriptionStatusMetadata(provider);
-        const accounts = listProviderAccounts(provider);
-        for (const account of accounts) {
-            rows.push({
-                ...metadata,
-                provider,
-                accountId: account.id,
-                label: account.label,
-                configured: true,
-                valid: account.credentials.expires > Date.now(),
-                expiresAt: account.credentials.expires,
-                source: isCodingPlanKeySubscriptionProvider(provider) &&
-                    account.source === "api-key"
-                    ? "coding-plan-key"
-                    : "app",
-            });
-        }
-        // Read the Claude Code OAuth blob exactly once per provider —
-        // `readClaudeCodeOAuthBlob()` shells out to `security` on macOS
-        // and calling it twice doubled the cost of every status poll.
-        const claudeBlob = provider === "anthropic-subscription" ? readClaudeCodeOAuthBlob() : null;
-        if (provider === "anthropic-subscription") {
-            let importedClaudeAuth = null;
-            let claudeSource = null;
-            if (claudeBlob?.accessToken) {
-                importedClaudeAuth = claudeBlob.accessToken;
-                claudeSource = "claude-code-cli";
-            }
-            else {
-                importedClaudeAuth = readConfiguredAnthropicSetupToken();
-                if (importedClaudeAuth)
-                    claudeSource = "setup-token";
-            }
-            if (importedClaudeAuth) {
-                const blobExpiresAt = claudeBlob?.expiresAt ?? null;
-                const blobValid = claudeBlob
-                    ? blobExpiresAt === null || blobExpiresAt > Date.now()
-                    : true;
-                const accountId = claudeSource === "claude-code-cli"
-                    ? "claude-code-cli"
-                    : "setup-token";
-                const label = claudeSource === "claude-code-cli"
-                    ? "Claude Code CLI"
-                    : "Setup Token";
-                rows.push({
-                    ...metadata,
-                    provider,
-                    accountId,
-                    label,
-                    configured: true,
-                    valid: blobValid,
-                    expiresAt: blobExpiresAt,
-                    source: claudeSource,
-                });
-            }
-        }
-        if (provider === "openai-codex" && hasCodexCliSubscriptionAuth()) {
-            rows.push({
-                ...metadata,
-                provider,
-                accountId: "codex-cli",
-                label: "Codex CLI",
-                configured: true,
-                valid: true,
-                expiresAt: null,
-                source: "codex-cli",
-            });
-        }
-        if (provider === "gemini-cli") {
-            const geminiCliDetected = hasCommandOnPath("gemini");
-            rows.push({
-                ...metadata,
-                provider,
-                accountId: "gemini-cli",
-                label: "Gemini CLI",
-                configured: geminiCliDetected,
-                valid: geminiCliDetected,
-                expiresAt: null,
-                source: geminiCliDetected ? "gemini-cli" : null,
-            });
-        }
-        if (provider === "deepseek-coding") {
-            rows.push({
-                ...metadata,
-                provider,
-                accountId: "deepseek-coding",
-                label: "DeepSeek Coding Plan",
-                configured: false,
-                valid: false,
-                expiresAt: null,
-                source: "unavailable",
-            });
-        }
-    }
-    return rows;
-}
-function isClaudeCodeInvalidGrantError(err) {
-    const message = err instanceof Error ? err.message : String(err);
-    return /\binvalid_grant\b/i.test(message);
-}
-/**
- * Try to read a Claude Code OAuth credential blob from disk or the macOS
- * keychain. Does NOT validate expiry — that's the caller's job (so it can
- * decide whether to refresh via the refresh token).
- *
- * Claude Code stores credentials in two places:
- *   - `~/.claude/.credentials.json` (Linux / older macOS installs)
- *   - macOS Keychain entry "Claude Code-credentials" (current macOS)
- *
- * Note that Claude Code's runtime keeps the live access token in memory and
- * refreshes it via the refresh token on demand — the persisted access token
- * will often be expired even though the user is actively using Claude Code.
- * That's why we always need to be ready to refresh.
- */
-function readClaudeCodeOAuthBlob() {
-    const parse = (raw, source) => {
-        try {
-            const parsed = JSON.parse(raw);
-            const oauth = parsed?.claudeAiOauth;
-            if (!oauth)
-                return null;
-            const accessToken = oauth.accessToken ?? oauth.access_token;
-            if (typeof accessToken !== "string" || !accessToken.trim())
-                return null;
-            return {
-                accessToken: accessToken.trim(),
-                refreshToken: oauth.refreshToken ?? oauth.refresh_token ?? null,
-                expiresAt: oauth.expiresAt ?? oauth.expires_at ?? null,
-                source,
-            };
-        }
-        catch {
-            return null;
-        }
-    };
-    // 1. Try ~/.claude/.credentials.json
-    const credPath = path.join(os.homedir(), ".claude", ".credentials.json");
-    try {
-        if (fs.existsSync(credPath)) {
-            const raw = fs.readFileSync(credPath, "utf-8");
-            const blob = parse(raw, "credentials file");
-            if (blob)
-                return blob;
-        }
-    }
-    catch {
-        // Non-fatal
-    }
-    // 2. Try macOS Keychain
-    if (process.platform === "darwin") {
-        try {
-            const raw = execSync('security find-generic-password -s "Claude Code-credentials" -w 2>/dev/null', { encoding: "utf8", timeout: 3000 }).trim();
-            if (raw) {
-                const blob = parse(raw, "keychain");
-                if (blob)
-                    return blob;
-            }
-        }
-        catch {
-            // Keychain not available or no entry
-        }
-    }
-    return null;
-}
-/**
- * Import a usable Anthropic OAuth access token from Claude Code's stored
- * credentials. If the persisted access token is still valid, returns it
- * directly. If it has expired, attempts to refresh via the persisted refresh
- * token. Returns null if no credentials are available, the token is expired
- * with no refresh token, or the refresh fails.
- */
-async function importClaudeCodeOAuthToken() {
-    const blob = readClaudeCodeOAuthBlob();
-    if (!blob)
-        return null;
-    const expired = typeof blob.expiresAt === "number" && blob.expiresAt <= Date.now();
-    if (!expired) {
-        logger.info(`[auth] Imported OAuth token from Claude Code ${blob.source}`);
-        return blob.accessToken;
-    }
-    if (!blob.refreshToken) {
-        logger.info(`[auth] Claude Code OAuth token from ${blob.source} is expired and no refresh token is available. Run "claude auth login" to refresh.`);
-        return null;
-    }
-    const refreshTokenCacheKey = `${blob.source}:${blob.refreshToken}`;
-    if (invalidClaudeCodeRefreshTokens.has(refreshTokenCacheKey)) {
-        return null;
-    }
-    try {
-        const refreshed = await refreshAnthropicToken(blob.refreshToken);
-        logger.info(`[auth] Refreshed Claude Code OAuth token from ${blob.source}`);
-        return refreshed.access;
-    }
-    catch (err) {
-        if (isClaudeCodeInvalidGrantError(err)) {
-            invalidClaudeCodeRefreshTokens.add(refreshTokenCacheKey);
-            logger.info(`[auth] Claude Code OAuth refresh token from ${blob.source} is invalid or revoked. Run "claude auth login" to refresh.`);
-            return null;
-        }
-        logger.warn(`[auth] Failed to refresh expired Claude Code OAuth token from ${blob.source}: ${String(err)}. Run "claude auth login" to refresh.`);
-        return null;
-    }
-}
-/**
- * Apply subscription credentials to the environment.
- * Called at startup to make credentials available to elizaOS plugins.
- *
- * **Claude subscription tokens are NOT applied to the runtime environment.**
- * Anthropic's TOS only permits Claude subscription tokens to be used through
- * the Claude Code CLI itself.  Eliza honours this by keeping the token
- * available for the task-agent orchestrator (which spawns `claude` CLI
- * subprocesses) but never injecting it into `process.env.ANTHROPIC_API_KEY`
- * or installing the stealth fetch interceptor.
- *
- * Codex / ChatGPT subscription tokens are also CLI credentials. They are used
- * by the Codex CLI-backed provider, not injected into `OPENAI_API_KEY`.
- */
-export async function applySubscriptionCredentials(config) {
-    const subscriptionCredentialsDisabled = process.env.ELIZA_DISABLE_SUBSCRIPTION_CREDENTIALS?.trim().toLowerCase();
-    if (subscriptionCredentialsDisabled === "1" ||
-        subscriptionCredentialsDisabled === "true" ||
-        subscriptionCredentialsDisabled === "yes" ||
-        subscriptionCredentialsDisabled === "on") {
-        logger.info("[auth] Subscription credential application disabled by ELIZA_DISABLE_SUBSCRIPTION_CREDENTIALS");
-        return;
-    }
-    // ── Anthropic subscription ──────────────────────────────────────────
-    //
-    // Anthropic subscription tokens (sk-ant-oat*) are restricted to the
-    // Claude Code CLI by Anthropic's TOS. They must NOT be used for direct
-    // API calls from the elizaOS runtime. The subscription token only flows
-    // to spawned coding-agent CLI sessions via the orchestrator plugin
-    // (which ARE Claude Code). If the user has only a subscription and no
-    // API key, the runtime simply won't have an Anthropic provider — they
-    // need an API key or Eliza Cloud for the main agent.
-    const anthropicAccounts = listProviderAccounts("anthropic-subscription");
-    if (anthropicAccounts.length > 0) {
-        const labels = anthropicAccounts
-            .map((a) => `"${a.label}" (${a.id})`)
-            .join(", ");
-        logger.info(`[auth] Anthropic subscription accounts configured: ${labels} — available for coding agents (Claude Code CLI). ` +
-            "Not applied to runtime env. Add an API key or connect Eliza Cloud for the main agent.");
-    }
-    else {
-        const claudeImported = await importClaudeCodeOAuthToken();
-        if (claudeImported) {
-            logger.info("[auth] Anthropic subscription detected via Claude Code CLI — available for coding agents. " +
-                "Not applied to runtime env. Add an API key or connect Eliza Cloud for the main agent.");
-        }
-    }
-    // ── OpenAI Codex subscription ────────────────────────────────────────
-    //
-    // Codex subscriptions power the Codex CLI-backed provider and task-agent
-    // subprocesses. Do not inject their OAuth access tokens into OPENAI_API_KEY:
-    // the normal OpenAI API path expects scoped API keys.
-    const codexAccounts = listProviderAccounts("openai-codex");
-    if (codexAccounts.length > 0) {
-        const labels = codexAccounts
-            .map((a) => `"${a.label}" (${a.id})`)
-            .join(", ");
-        logger.info(`[auth] OpenAI Codex subscription accounts configured: ${labels} — available for Codex CLI-backed coding/model providers. ` +
-            "Not applied to OPENAI_API_KEY; add a direct OpenAI API key for @elizaos/plugin-openai runtime inference.");
-    }
-    else {
-        if (hasCodexCliSubscriptionAuth()) {
-            logger.info("[auth] OpenAI Codex CLI auth detected in ~/.codex/auth.json — available for Codex CLI-backed coding/model providers. " +
-                "Not applied to OPENAI_API_KEY; add a direct OpenAI API key for @elizaos/plugin-openai runtime inference.");
-        }
-    }
-    const geminiAccounts = listProviderAccounts("gemini-cli");
-    if (geminiAccounts.length > 0 || hasCommandOnPath("gemini")) {
-        logger.info("[auth] Gemini CLI subscription surface detected/configured — available only through Gemini CLI task agents. " +
-            "Not applied to GOOGLE_API_KEY or GOOGLE_GENERATIVE_AI_API_KEY.");
-    }
-    for (const provider of ["zai-coding", "kimi-coding"]) {
-        const accounts = listProviderAccounts(provider);
-        if (accounts.length === 0)
-            continue;
-        const labels = accounts.map((a) => `"${a.label}" (${a.id})`).join(", ");
-        const envName = provider === "zai-coding" ? "ZAI_API_KEY" : "MOONSHOT_API_KEY";
-        logger.info(`[auth] ${provider} coding-plan accounts configured: ${labels} — available only for the provider's dedicated coding endpoint. ` +
-            `Not applied to ${envName}.`);
-    }
-    // Auto-set model.primary only for subscription providers that have a runtime
-    // model-provider plugin. CLI-only subscriptions should not point the runtime
-    // at direct API-key plugins.
-    if (config?.agents?.defaults) {
-        const defaults = config.agents.defaults;
-        const provider = defaults.subscriptionProvider;
-        if (provider) {
-            const modelId = SUBSCRIPTION_PROVIDER_MAP[provider];
-            const runtimeApplicable = provider === "openai-codex";
-            if (modelId && runtimeApplicable) {
-                if (!defaults.model) {
-                    defaults.model = { primary: modelId };
-                    logger.info(`[auth] Auto-set model.primary to "${modelId}" from subscription provider`);
-                }
-                else if (!defaults.model.primary) {
-                    defaults.model.primary = modelId;
-                    logger.info(`[auth] Auto-set model.primary to "${modelId}" from subscription provider`);
-                }
-            }
-        }
-    }
-}

package/packages/agent/src/auth/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/auth/index.ts"],"names":[],"mappings":"AAAA,cAAc,sBAAsB,CAAC;AACrC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,0BAA0B,CAAC;AACzC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC;AAClC,cAAc,YAAY,CAAC"}

package/packages/agent/src/auth/oauth-flow.d.ts

@@ -1,106 +0,0 @@
-/**
- * OAuth flow orchestration registry.
- *
- * Wraps the provider-specific programmatic OAuth helpers
- * (`startAnthropicOAuthFlowRaw` from
- * `vendor/pi-oauth/anthropic-login.ts` and the loopback-listener flow
- * in `openai-codex.ts`) with:
- *
- *   - a 5-minute timeout per flow,
- *   - automatic `saveAccount(...)` after token exchange,
- *   - an in-memory registry keyed by `sessionId` so the HTTP API can
- *     stream progress over SSE and the CLI can `await` completion,
- *   - garbage collection 10 minutes after a flow reaches a terminal
- *     state.
- *
- * Both the CLI and the new accounts-routes HTTP endpoints drive flows
- * through this module — there is no direct caller of the vendor-level
- * OAuth helpers anymore.
- */
-import { type AccountCredentialRecord } from "./account-storage.ts";
-import type { SubscriptionProvider } from "./types.ts";
-/** Server-tracked status of an in-flight OAuth flow. */
-export type FlowStatus = "pending" | "success" | "error" | "cancelled" | "timeout";
-export interface FlowState {
-    sessionId: string;
-    providerId: SubscriptionProvider;
-    status: FlowStatus;
-    /** Set on `pending` (so the UI can re-open the browser) and on `success`. */
-    authUrl?: string;
-    /** Anthropic only — the user must paste `code#state`; Codex uses the loopback callback. */
-    needsCodeSubmission: boolean;
-    account?: AccountCredentialRecord;
-    error?: string;
-    startedAt: number;
-    endedAt?: number;
-}
-export interface OAuthFlowHandle {
-    sessionId: string;
-    authUrl: string;
-    /** Codex flows resolve via the loopback listener; Anthropic requires `submitCode`. */
-    needsCodeSubmission: boolean;
-    /** Resolves with the saved AccountCredentialRecord; rejects on cancel/timeout/error. */
-    completion: Promise<{
-        account: AccountCredentialRecord;
-    }>;
-    /** Anthropic only — submit `code#state` from the redirect page. No-op for Codex. */
-    submitCode: (code: string) => void;
-    cancel: (reason?: string) => void;
-}
-interface StartOptions {
-    label: string;
-    accountId?: string;
-    /**
-     * Called after the account is saved on disk. Used by the HTTP
-     * route layer to also write a `LinkedAccountConfig` row into
-     * `eliza.json`. Failures here propagate as flow `error`.
-     */
-    onAccountSaved?: (account: AccountCredentialRecord) => void | Promise<void>;
-}
-/**
- * Start a programmatic Anthropic OAuth flow. Anthropic's redirect URI
- * is hardcoded to `console.anthropic.com/oauth/code/callback` — the
- * UI must surface the auth URL, prompt the user to copy the
- * `code#state` blob, and call `submitCode()` with it. Once the code is
- * submitted, the token exchange runs and the account is persisted.
- */
-export declare function startAnthropicOAuthFlow(opts: StartOptions): Promise<OAuthFlowHandle>;
-/**
- * Start a programmatic Codex OAuth flow. Codex has a loopback listener
- * on :1455, so the user just signs in in the browser and the listener
- * picks up the redirect — `submitCode()` is a no-op. The accountId
- * baked into the JWT is preserved on `LinkedAccountConfig.organizationId`
- * (used by the Codex usage probe via the `ChatGPT-Account-Id` header).
- */
-export declare function startCodexOAuthFlow(opts: StartOptions): Promise<OAuthFlowHandle>;
-export declare function getFlowState(sessionId: string): FlowState | null;
-export declare function getFlowHandle(sessionId: string): OAuthFlowHandle | null;
-/**
- * Subscribe to status updates for a flow. Replays the current state
- * synchronously so SSE consumers always receive an immediate frame.
- * Returns an unsubscribe function.
- */
-export declare function subscribeFlow(sessionId: string, listener: (state: FlowState) => void): () => void;
-export declare function cancelFlow(sessionId: string, reason?: string): boolean;
-export declare function submitFlowCode(sessionId: string, code: string): boolean;
-/**
- * Remove every flow from the registry. Tests use this to reset
- * between cases without resetting the whole module.
- */
-export declare function _resetFlowRegistry(): void;
-/**
- * Test-only helper to seed a synthetic flow without going through the
- * vendor layer. Used by `accounts-routes.test.ts` to assert the SSE
- * surface streams `success` / `error` payloads correctly.
- */
-export declare function _registerSyntheticFlow(args: {
-    sessionId?: string;
-    providerId: SubscriptionProvider;
-    authUrl: string;
-    needsCodeSubmission?: boolean;
-}): {
-    sessionId: string;
-    complete: (state: FlowState) => void;
-};
-export {};
-//# sourceMappingURL=oauth-flow.d.ts.map

package/packages/agent/src/auth/oauth-flow.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth-flow.d.ts","sourceRoot":"","sources":["../../../../../src/auth/oauth-flow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,OAAO,EACL,KAAK,uBAAuB,EAE7B,MAAM,sBAAsB,CAAC;AAG9B,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAMvD,wDAAwD;AACxD,MAAM,MAAM,UAAU,GAClB,SAAS,GACT,SAAS,GACT,OAAO,GACP,WAAW,GACX,SAAS,CAAC;AAEd,MAAM,WAAW,SAAS;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,oBAAoB,CAAC;IACjC,MAAM,EAAE,UAAU,CAAC;IACnB,6EAA6E;IAC7E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2FAA2F;IAC3F,mBAAmB,EAAE,OAAO,CAAC;IAC7B,OAAO,CAAC,EAAE,uBAAuB,CAAC;IAClC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,sFAAsF;IACtF,mBAAmB,EAAE,OAAO,CAAC;IAC7B,wFAAwF;IACxF,UAAU,EAAE,OAAO,CAAC;QAAE,OAAO,EAAE,uBAAuB,CAAA;KAAE,CAAC,CAAC;IAC1D,oFAAoF;IACpF,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACnC,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;CACnC;AAuED,UAAU,YAAY;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,cAAc,CAAC,EAAE,CAAC,OAAO,EAAE,uBAAuB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7E;AAID;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,YAAY,GACjB,OAAO,CAAC,eAAe,CAAC,CAqB1B;AAID;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,YAAY,GACjB,OAAO,CAAC,eAAe,CAAC,CAmB1B;AA2ID,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAGhE;AAED,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI,CAGvE;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAC3B,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,CAAC,KAAK,EAAE,SAAS,KAAK,IAAI,GACnC,MAAM,IAAI,CASZ;AAED,wBAAgB,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAMtE;AAED,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAOvE;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,IAAI,IAAI,CAKzC;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE;IAC3C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,oBAAoB,CAAC;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B,GAAG;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,SAAS,KAAK,IAAI,CAAA;CAAE,CA+B9D"}