@elizaos/agent 2.0.0-beta.2 → 2.0.11-beta.5

package/api/x-relay-routes.js

@@ -0,0 +1,141 @@
+/**
+ * X relay route.
+ *
+ * Proxies local LifeOps X calls through Eliza Cloud so the desktop app can
+ * stay credential-light while Cloud handles billing and provider access.
+ *
+ * The relay is intentionally thin: auth + proxy + 402 preservation only.
+ */
+import { sendJsonError } from "@elizaos/core";
+import { normalizeCloudSiteUrl, sendJson } from "@elizaos/shared";
+const PROXY_TIMEOUT_MS = 30_000;
+const MAX_BODY_BYTES = 1_048_576;
+const X_RELAY_PATH_RE = /^\/api\/cloud\/x(\/.*)$/;
+let cloudHelpersPromise = null;
+function getCloudHelpers() {
+    if (!cloudHelpersPromise) {
+        cloudHelpersPromise = import("@elizaos/plugin-elizacloud");
+    }
+    return cloudHelpersPromise;
+}
+function _isCloudAuthApiKeyService(value) {
+    return (value != null &&
+        typeof value.isAuthenticated ===
+            "function");
+}
+function _normalizeCloudApiKey(value) {
+    if (typeof value !== "string")
+        return null;
+    const trimmed = value.trim();
+    if (!trimmed || trimmed.toUpperCase() === "[REDACTED]")
+        return null;
+    return trimmed;
+}
+async function resolveProxyApiKey(state) {
+    const cloudAuth = state.runtime
+        ? state.runtime.getService("CLOUD_AUTH")
+        : null;
+    const { isCloudAuthApiKeyService, normalizeCloudApiKey, resolveCloudApiKey } = await getCloudHelpers();
+    const runtimeApiKey = isCloudAuthApiKeyService(cloudAuth) && cloudAuth.isAuthenticated() === true
+        ? normalizeCloudApiKey(cloudAuth.getApiKey?.())
+        : null;
+    return runtimeApiKey ?? resolveCloudApiKey(state.config, state.runtime);
+}
+function buildAuthHeaders(config, apiKey) {
+    const headers = {
+        Accept: "application/json",
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${apiKey}`,
+    };
+    const serviceKey = config.cloud?.serviceKey?.trim();
+    if (serviceKey) {
+        headers["X-Service-Key"] = serviceKey;
+    }
+    return headers;
+}
+function readBody(req) {
+    return new Promise((resolve, reject) => {
+        const chunks = [];
+        let size = 0;
+        req.on("data", (chunk) => {
+            size += chunk.length;
+            if (size > MAX_BODY_BYTES) {
+                reject(new Error("Request body too large"));
+                return;
+            }
+            chunks.push(chunk);
+        });
+        req.on("end", () => resolve(chunks.length > 0 ? Buffer.concat(chunks).toString("utf-8") : undefined));
+        req.on("error", reject);
+    });
+}
+async function readJsonResponse(response) {
+    return response.json().catch(async () => ({
+        success: response.ok,
+        error: await response.text().catch(() => "X relay request failed"),
+    }));
+}
+function buildUpstreamPath(pathname) {
+    const match = X_RELAY_PATH_RE.exec(pathname);
+    if (!match) {
+        throw new Error("Invalid X relay path");
+    }
+    return `/api/v1/x${match[1] ?? ""}`;
+}
+export async function handleXRelayRoute(req, res, pathname, method, state) {
+    if (!pathname.startsWith("/api/cloud/x/")) {
+        return false;
+    }
+    if (method !== "GET" && method !== "POST") {
+        sendJsonError(res, "Unsupported X relay method", 405);
+        return true;
+    }
+    const apiKey = await resolveProxyApiKey(state);
+    if (!apiKey) {
+        sendJsonError(res, "Not connected to Eliza Cloud. Sign in to use X relays.", 401);
+        return true;
+    }
+    const baseUrl = normalizeCloudSiteUrl(state.config.cloud?.baseUrl);
+    const { validateCloudBaseUrl } = await getCloudHelpers();
+    const urlError = await validateCloudBaseUrl(baseUrl);
+    if (urlError) {
+        sendJsonError(res, urlError, 502);
+        return true;
+    }
+    let body;
+    if (method === "POST") {
+        try {
+            body = await readBody(req);
+        }
+        catch (error) {
+            sendJsonError(res, error instanceof Error ? error.message : "Failed to read body", 413);
+            return true;
+        }
+    }
+    const fullUrl = new URL(req.url ?? pathname, "http://localhost");
+    const upstreamUrl = `${baseUrl}${buildUpstreamPath(pathname)}${fullUrl.search}`;
+    const upstreamResponse = await fetch(upstreamUrl, {
+        method,
+        headers: buildAuthHeaders(state.config, apiKey),
+        body,
+        redirect: "manual",
+        signal: AbortSignal.timeout(PROXY_TIMEOUT_MS),
+    });
+    if (upstreamResponse.status === 402) {
+        const wwwAuth = upstreamResponse.headers.get("www-authenticate");
+        const contentType = upstreamResponse.headers.get("content-type");
+        const bodyText = await upstreamResponse.text().catch(() => "");
+        if (wwwAuth) {
+            res.setHeader("WWW-Authenticate", wwwAuth);
+        }
+        if (contentType) {
+            res.setHeader("Content-Type", contentType);
+        }
+        res.statusCode = 402;
+        res.end(bodyText);
+        return true;
+    }
+    const payload = await readJsonResponse(upstreamResponse);
+    sendJson(res, payload, upstreamResponse.status);
+    return true;
+}

package/api/zip-utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"zip-utils.d.ts","sourceRoot":"","sources":["../../src/api/zip-utils.ts"],"names":[],"mappings":"AAAA,UAAU,aAAa;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,MAAM,CAAC;IACnC,KAAK,CAAC,EAAE,IAAI,CAAC;CACd;AA0DD,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,aAAa,EAAE,GAAG,MAAM,CAmEjE"}

package/auth/account-storage.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Per-account credential storage.
+ *
+ * Layout: `<stateDir>/auth/{providerId}/{accountId}.json` (mode 0600,
+ * atomic writes). Multiple accounts per provider are supported.
+ *
+ */
+import { type AccountCredentialProvider, type OAuthCredentials } from "./types.ts";
+export interface AccountCredentialRecord {
+    /** accountId, e.g. "default" or a uuid */
+    id: string;
+    providerId: AccountCredentialProvider;
+    /** user-facing name (e.g. "Personal", "Work") */
+    label: string;
+    source: "oauth" | "api-key";
+    /**
+     * Existing OAuth credential blob — `{ access, refresh, expires }`
+     * for OAuth accounts; for `api-key` accounts only `access` is
+     * meaningful (refresh is the empty string and expires is `0` /
+     * a distant-expiry sentinel by convention of the caller).
+     */
+    credentials: OAuthCredentials;
+    createdAt: number;
+    updatedAt: number;
+    lastUsedAt?: number;
+    organizationId?: string;
+    userId?: string;
+    email?: string;
+}
+export declare function listAccounts(provider: AccountCredentialProvider): AccountCredentialRecord[];
+export declare function loadAccount(provider: AccountCredentialProvider, accountId: string): AccountCredentialRecord | null;
+export declare function saveAccount(record: AccountCredentialRecord): void;
+export declare function deleteAccount(provider: AccountCredentialProvider, accountId: string): void;
+export declare function touchAccount(provider: AccountCredentialProvider, accountId: string): void;
+//# sourceMappingURL=account-storage.d.ts.map

package/auth/account-storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-storage.d.ts","sourceRoot":"","sources":["../../src/auth/account-storage.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,OAAO,EAEL,KAAK,yBAAyB,EAC9B,KAAK,gBAAgB,EACtB,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,uBAAuB;IACtC,0CAA0C;IAC1C,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,yBAAyB,CAAC;IACtC,iDAAiD;IACjD,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,OAAO,GAAG,SAAS,CAAC;IAC5B;;;;;OAKG;IACH,WAAW,EAAE,gBAAgB,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AA6CD,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,yBAAyB,GAClC,uBAAuB,EAAE,CAkC3B;AAED,wBAAgB,WAAW,CACzB,QAAQ,EAAE,yBAAyB,EACnC,SAAS,EAAE,MAAM,GAChB,uBAAuB,GAAG,IAAI,CA6BhC;AAED,wBAAgB,WAAW,CAAC,MAAM,EAAE,uBAAuB,GAAG,IAAI,CAUjE;AAED,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,yBAAyB,EACnC,SAAS,EAAE,MAAM,GAChB,IAAI,CAUN;AAED,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,yBAAyB,EACnC,SAAS,EAAE,MAAM,GAChB,IAAI,CAQN"}

package/auth/account-storage.js

@@ -0,0 +1,135 @@
+/**
+ * Per-account credential storage.
+ *
+ * Layout: `<stateDir>/auth/{providerId}/{accountId}.json` (mode 0600,
+ * atomic writes). Multiple accounts per provider are supported.
+ *
+ */
+import fs from "node:fs";
+import path from "node:path";
+import { logger, resolveStateDir } from "@elizaos/core";
+import { writeJsonAtomicSync } from "../utils/atomic-json.js";
+import { ACCOUNT_CREDENTIAL_PROVIDER_IDS, } from "./types.js";
+function authRoot() {
+    return path.join(process.env.ELIZA_HOME || resolveStateDir(), "auth");
+}
+function providerDir(provider) {
+    return path.join(authRoot(), provider);
+}
+function accountFile(provider, accountId) {
+    return path.join(providerDir(provider), `${accountId}.json`);
+}
+function ensureProviderDir(provider) {
+    const dir = providerDir(provider);
+    if (!fs.existsSync(dir)) {
+        fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    }
+}
+function isAccountCredentialRecord(value) {
+    if (!value || typeof value !== "object")
+        return false;
+    const v = value;
+    return (typeof v.id === "string" &&
+        typeof v.providerId === "string" &&
+        ACCOUNT_CREDENTIAL_PROVIDER_IDS.includes(v.providerId) &&
+        typeof v.label === "string" &&
+        (v.source === "oauth" || v.source === "api-key") &&
+        typeof v.credentials === "object" &&
+        v.credentials !== null &&
+        typeof v.credentials.access === "string" &&
+        typeof v.createdAt === "number" &&
+        typeof v.updatedAt === "number");
+}
+export function listAccounts(provider) {
+    const dir = providerDir(provider);
+    if (!fs.existsSync(dir))
+        return [];
+    const entries = fs.readdirSync(dir);
+    const records = [];
+    for (const entry of entries) {
+        if (!entry.endsWith(".json"))
+            continue;
+        if (entry.endsWith(".tmp.json") || entry.endsWith(".json.tmp"))
+            continue;
+        const filePath = path.join(dir, entry);
+        let parsed;
+        try {
+            parsed = JSON.parse(fs.readFileSync(filePath, "utf-8"));
+        }
+        catch (err) {
+            logger.warn(`[auth] Skipping malformed credential file ${filePath}: ${String(err)}`);
+            continue;
+        }
+        if (!isAccountCredentialRecord(parsed)) {
+            logger.warn(`[auth] Skipping credential file ${filePath} — wrong shape`);
+            continue;
+        }
+        if (parsed.providerId !== provider) {
+            logger.warn(`[auth] Credential file ${filePath} declares providerId="${parsed.providerId}", expected "${provider}" — skipping`);
+            continue;
+        }
+        records.push(parsed);
+    }
+    records.sort((a, b) => a.createdAt - b.createdAt);
+    return records;
+}
+export function loadAccount(provider, accountId) {
+    const file = accountFile(provider, accountId);
+    let raw;
+    try {
+        raw = fs.readFileSync(file, "utf-8");
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return null;
+        throw err;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (err) {
+        logger.warn(`[auth] Credential file ${file} is malformed JSON: ${String(err)}`);
+        return null;
+    }
+    if (!isAccountCredentialRecord(parsed)) {
+        logger.warn(`[auth] Credential file ${file} has wrong shape`);
+        return null;
+    }
+    if (parsed.providerId !== provider || parsed.id !== accountId) {
+        logger.warn(`[auth] Credential file ${file} provider/id mismatch (got ${parsed.providerId}/${parsed.id})`);
+        return null;
+    }
+    return parsed;
+}
+export function saveAccount(record) {
+    ensureProviderDir(record.providerId);
+    const next = {
+        ...record,
+        updatedAt: Date.now(),
+    };
+    writeJsonAtomicSync(accountFile(record.providerId, record.id), next);
+    logger.info(`[auth] Saved ${record.providerId} account "${record.id}" (label="${record.label}")`);
+}
+export function deleteAccount(provider, accountId) {
+    const file = accountFile(provider, accountId);
+    try {
+        fs.unlinkSync(file);
+        logger.info(`[auth] Deleted ${provider} account "${accountId}"`);
+    }
+    catch (err) {
+        if (err.code !== "ENOENT") {
+            throw err;
+        }
+    }
+}
+export function touchAccount(provider, accountId) {
+    const existing = loadAccount(provider, accountId);
+    if (!existing)
+        return;
+    const next = {
+        ...existing,
+        lastUsedAt: Date.now(),
+    };
+    writeJsonAtomicSync(accountFile(provider, accountId), next);
+}

package/auth/anthropic.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"anthropic.d.ts","sourceRoot":"","sources":["../../src/auth/anthropic.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAMnD,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,+EAA+E;IAC/E,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACnC,4DAA4D;IAC5D,WAAW,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;CACxC;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,aAAa,CAAC,CA0BlE;AAED;;GAEG;AACH,wBAAsB,qBAAqB,CACzC,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,gBAAgB,CAAC,CAE3B"}

package/auth/claude-code-stealth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-code-stealth.d.ts","sourceRoot":"","sources":["../../src/auth/claude-code-stealth.ts"],"names":[],"mappings":"AA2DA,wBAAgB,wCAAwC,IAAI,IAAI,CA8F/D"}

package/auth/claude-code-stealth.js

@@ -0,0 +1,114 @@
+import { logger } from "@elizaos/core";
+const STEALTH_GUARD = Symbol.for("eliza.claudeCodeStealthInstalled");
+const CLAUDE_CODE_VERSION = "2.1.92";
+const CLAUDE_CODE_SYSTEM_PREFIX = "You are Claude Code, Anthropic's official CLI for Claude.";
+const ANTHROPIC_BETA = "claude-code-20250219,oauth-2025-04-20,interleaved-thinking-2025-05-14,context-management-2025-06-27,prompt-caching-scope-2026-01-05,advanced-tool-use-2025-11-20,effort-2025-11-24";
+function isSetupToken(value) {
+    return typeof value === "string" && value.startsWith("sk-ant-oat");
+}
+function getUrl(input) {
+    try {
+        if (typeof input === "string") {
+            return new URL(input);
+        }
+        if (input instanceof URL) {
+            return input;
+        }
+        return new URL(input.url);
+    }
+    catch {
+        return null;
+    }
+}
+function addSystemPrefix(body) {
+    const prefix = {
+        type: "text",
+        text: CLAUDE_CODE_SYSTEM_PREFIX,
+    };
+    if (Array.isArray(body.system)) {
+        const hasPrefix = body.system.some((block) => block.text?.startsWith("You are Claude Code"));
+        if (!hasPrefix) {
+            body.system.unshift(prefix);
+        }
+    }
+    else if (typeof body.system === "string") {
+        body.system = [prefix, { type: "text", text: body.system }];
+    }
+    else {
+        body.system = [prefix];
+    }
+    return body;
+}
+export function installClaudeCodeStealthFetchInterceptor() {
+    if (globalThis[STEALTH_GUARD]) {
+        return;
+    }
+    const originalFetch = globalThis.fetch.bind(globalThis);
+    const stealthFetch = async function stealthFetch(input, init) {
+        const url = getUrl(input);
+        if (url?.hostname !== "api.anthropic.com") {
+            return originalFetch(input, init);
+        }
+        const request = input instanceof Request ? input : null;
+        const headers = new Headers(init?.headers ?? request?.headers ?? undefined);
+        const apiKey = headers.get("x-api-key");
+        const authHeader = headers.get("authorization");
+        const bearerToken = authHeader?.startsWith("Bearer ")
+            ? authHeader.slice(7)
+            : null;
+        const setupToken = isSetupToken(apiKey)
+            ? apiKey
+            : isSetupToken(bearerToken)
+                ? bearerToken
+                : null;
+        if (!setupToken) {
+            return originalFetch(input, init);
+        }
+        // Add beta=true query param so the API serves the latest model versions
+        // (matches what claude-cli does, required for opus access).
+        if (!url.searchParams.has("beta")) {
+            url.searchParams.set("beta", "true");
+        }
+        headers.delete("x-api-key");
+        headers.set("authorization", `Bearer ${setupToken}`);
+        headers.set("anthropic-beta", ANTHROPIC_BETA);
+        headers.set("user-agent", `claude-cli/${CLAUDE_CODE_VERSION} (external, cli)`);
+        headers.set("x-app", "cli");
+        let body = init?.body ?? request?.body;
+        if (typeof body === "string") {
+            try {
+                const parsed = JSON.parse(body);
+                body = JSON.stringify(addSystemPrefix(parsed));
+            }
+            catch {
+                logger.debug("[stealth] Anthropic request body was not JSON; skipping system prefix");
+            }
+        }
+        const nextInit = {
+            ...init,
+            headers,
+            body: init ? body : undefined,
+        };
+        if (request && !init) {
+            const nextRequest = new Request(url.toString(), {
+                method: request.method,
+                headers,
+                body: typeof body === "string" ? body : undefined,
+            });
+            return originalFetch(nextRequest);
+        }
+        if (process.env.ELIZA_STEALTH_DEBUG && typeof body === "string") {
+            const modelMatch = body.match(/"model":"([^"]+)"/);
+            if (modelMatch) {
+                logger.debug(`[stealth] anthropic model=${modelMatch[1]}`);
+            }
+        }
+        return originalFetch(url.toString(), nextInit);
+    };
+    const sourceFetch = globalThis.fetch;
+    if ("preconnect" in sourceFetch) {
+        stealthFetch.preconnect = sourceFetch.preconnect;
+    }
+    globalThis.fetch = stealthFetch;
+    globalThis[STEALTH_GUARD] = true;
+}

package/auth/credentials.d.ts

@@ -0,0 +1,131 @@
+/**
+ * Credential storage and token refresh for subscription providers.
+ *
+ * Credentials live under `<stateDir>/auth/{providerId}/{accountId}.json`
+ * (see `account-storage.ts` for the on-disk format and atomic-write
+ * details). The `loadCredentials` / `saveCredentials` /
+ * `deleteCredentials` / `hasValidCredentials` / `getAccessToken`
+ * helpers all default to `accountId="default"` so callers that pre-date
+ * multi-account support keep working without changes.
+ */
+import type { SubscriptionCredentialSource } from "@elizaos/shared";
+import { type AccountCredentialRecord } from "./account-storage.ts";
+import { type AccountCredentialProvider, type OAuthCredentials, type StoredCredentials, type SubscriptionProvider } from "./types.ts";
+/**
+ * Save credentials for a provider account.
+ *
+ * The `accountId` defaults to `"default"`. New accounts are persisted
+ * with `source: "oauth"` and `label: "Default"` (or the existing
+ * record's label when overwriting).
+ */
+export declare function saveCredentials(provider: SubscriptionProvider, credentials: OAuthCredentials, accountId?: string): void;
+/**
+ * Load stored credentials for a provider account.
+ * Returns `null` when no account is configured for the given id.
+ */
+export declare function loadCredentials(provider: SubscriptionProvider, accountId?: string): StoredCredentials | null;
+/**
+ * Delete stored credentials for a provider account.
+ */
+export declare function deleteCredentials(provider: SubscriptionProvider, accountId?: string): void;
+/**
+ * Delete every stored credential account for a provider.
+ */
+export declare function deleteProviderCredentials(provider: AccountCredentialProvider): number;
+/**
+ * Check if credentials exist and are not expired.
+ */
+export declare function hasValidCredentials(provider: AccountCredentialProvider, accountId?: string): boolean;
+/**
+ * List all accounts configured for a provider.
+ */
+export declare function listProviderAccounts(provider: AccountCredentialProvider): AccountCredentialRecord[];
+/**
+ * Get a valid access token, refreshing if needed.
+ *
+ * Refreshes are serialized per `{provider}:{accountId}` via
+ * `accountRefreshMutex` so concurrent callers don't race on the
+ * refresh-token grant or the credential file write.
+ *
+ * Returns `null` when no credentials are stored or the refresh fails.
+ */
+export declare function getAccessToken(provider: AccountCredentialProvider, accountId?: string): Promise<string | null>;
+export type { SubscriptionCredentialSource } from "@elizaos/shared";
+/**
+ * Per-account subscription status row used by the dashboard / API.
+ *
+ * One row is emitted per stored account for each provider. CLI- /
+ * setup-token-derived sources also produce a row with a synthetic
+ * `accountId` (e.g. `"claude-code-cli"`); those rows are read-only
+ * (they cannot be deleted via `DELETE /api/subscription/{provider}`).
+ */
+export interface SubscriptionAccountStatus {
+    provider: SubscriptionProvider;
+    accountId: string;
+    label: string;
+    configured: boolean;
+    valid: boolean;
+    expiresAt: number | null;
+    source: SubscriptionCredentialSource;
+    available?: boolean;
+    availabilityReason?: string;
+    allowedClient?: string;
+    loginHint?: string;
+    billingMode?: "subscription-coding-plan" | "subscription-coding-cli";
+}
+export declare function getSubscriptionStatus(): SubscriptionAccountStatus[];
+interface SubscriptionCredentialConfig {
+    agents?: {
+        defaults?: {
+            subscriptionProvider?: string;
+            model?: {
+                primary?: string;
+            };
+        };
+    };
+}
+/**
+ * Local-only, synchronous part of subscription credential application.
+ *
+ * Reads stored accounts from disk and derives `model.primary` for runtime
+ * subscription providers (currently only `openai-codex`). Performs no network
+ * I/O, so it is safe to await on the blocking boot path. The network-touching
+ * Claude Code OAuth import is handled separately by
+ * {@link applySubscriptionCredentialsDeferred}.
+ *
+ * None of the Anthropic / Codex / Gemini / coding-plan branches mutate `config`
+ * or `process.env` — they are purely informational logging. The only config
+ * mutation is the `openai-codex` `model.primary` derivation below.
+ */
+export declare function applySubscriptionCredentialsLocal(config?: SubscriptionCredentialConfig): void;
+/**
+ * Apply subscription credentials to the environment.
+ * Called at startup to make credentials available to elizaOS plugins.
+ *
+ * Combines the local-only model.primary derivation
+ * ({@link applySubscriptionCredentialsLocal}) with the network-touching Claude
+ * Code OAuth probe ({@link applySubscriptionCredentialsDeferred}). The cold-boot
+ * path calls the two halves separately so the network probe can run off the
+ * blocking path; other callers (API routes, hot reload) use this combined form.
+ *
+ * **Claude subscription tokens are NOT applied to the runtime environment.**
+ * Anthropic's TOS only permits Claude subscription tokens to be used through
+ * the Claude Code CLI itself. Eliza honours this by keeping the token
+ * available for the task-agent orchestrator (which spawns `claude` CLI
+ * subprocesses) but never injecting it into `process.env.ANTHROPIC_API_KEY`.
+ *
+ * Codex / ChatGPT subscription tokens are also CLI credentials. They are used
+ * by the Codex CLI-backed provider, not injected into `OPENAI_API_KEY`.
+ */
+export declare function applySubscriptionCredentials(config?: SubscriptionCredentialConfig): Promise<void>;
+/**
+ * Deferred, network-touching part of subscription credential application.
+ *
+ * When no stored Anthropic subscription account exists, this probes for a
+ * Claude Code CLI OAuth token (which may require a network refresh) so it can
+ * log that a subscription is available for coding agents. It mutates neither
+ * `config` nor `process.env` — the token stays reserved for spawned Claude
+ * Code CLI sessions — so it can run off the blocking boot path.
+ */
+export declare function applySubscriptionCredentialsDeferred(): Promise<void>;
+//# sourceMappingURL=credentials.d.ts.map

package/auth/credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../src/auth/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAYH,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,iBAAiB,CAAC;AACpE,OAAO,EACL,KAAK,uBAAuB,EAK7B,MAAM,sBAAsB,CAAC;AAI9B,OAAO,EACL,KAAK,yBAAyB,EAM9B,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EAItB,KAAK,oBAAoB,EAC1B,MAAM,YAAY,CAAC;AAiBpB;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,oBAAoB,EAC9B,WAAW,EAAE,gBAAgB,EAC7B,SAAS,GAAE,MAA2B,GACrC,IAAI,CAiCN;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,oBAAoB,EAC9B,SAAS,GAAE,MAA2B,GACrC,iBAAiB,GAAG,IAAI,CAI1B;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,oBAAoB,EAC9B,SAAS,GAAE,MAA2B,GACrC,IAAI,CAEN;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,yBAAyB,GAClC,MAAM,CAMR;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,yBAAyB,EACnC,SAAS,GAAE,MAA2B,GACrC,OAAO,CAIT;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,yBAAyB,GAClC,uBAAuB,EAAE,CAE3B;AAED;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAClC,QAAQ,EAAE,yBAAyB,EACnC,SAAS,GAAE,MAA2B,GACrC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAmExB;AAuDD,YAAY,EAAE,4BAA4B,EAAE,MAAM,iBAAiB,CAAC;AAEpE;;;;;;;GAOG;AACH,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,OAAO,CAAC;IACpB,KAAK,EAAE,OAAO,CAAC;IACf,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,EAAE,4BAA4B,CAAC;IACrC,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,0BAA0B,GAAG,yBAAyB,CAAC;CACtE;AAkCD,wBAAgB,qBAAqB,IAAI,yBAAyB,EAAE,CA2GnE;AA+ID,UAAU,4BAA4B;IACpC,MAAM,CAAC,EAAE;QACP,QAAQ,CAAC,EAAE;YAAE,oBAAoB,CAAC,EAAE,MAAM,CAAC;YAAC,KAAK,CAAC,EAAE;gBAAE,OAAO,CAAC,EAAE,MAAM,CAAA;aAAE,CAAA;SAAE,CAAC;KAC5E,CAAC;CACH;AAaD;;;;;;;;;;;;GAYG;AACH,wBAAgB,iCAAiC,CAC/C,MAAM,CAAC,EAAE,4BAA4B,GACpC,IAAI,CAiGN;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,4BAA4B,CAChD,MAAM,CAAC,EAAE,4BAA4B,GACpC,OAAO,CAAC,IAAI,CAAC,CAGf;AAED;;;;;;;;GAQG;AACH,wBAAsB,oCAAoC,IAAI,OAAO,CAAC,IAAI,CAAC,CAY1E"}