@cortexkit/antigravity-auth-core 1.0.0

package/dist/antigravity/oauth.js

@@ -0,0 +1,179 @@
+import { generatePKCE } from "@openauthjs/openauth/pkce";
+import { ANTIGRAVITY_CLIENT_ID, ANTIGRAVITY_CLIENT_SECRET, ANTIGRAVITY_REDIRECT_URI, ANTIGRAVITY_SCOPES, ANTIGRAVITY_ENDPOINT_FALLBACKS, ANTIGRAVITY_LOAD_ENDPOINTS, GEMINI_CLI_HEADERS, } from "../constants.js";
+import { createLogger } from "../logger.js";
+import { calculateTokenExpiry } from "../auth.js";
+import { fetchWithAgyCliTransport } from "../agy-transport.js";
+import { buildAntigravityHarnessBootstrapHeaders, buildAntigravityLoadCodeAssistMetadata, } from "../fingerprint.js";
+const log = createLogger("oauth");
+/**
+ * Refresh an Antigravity OAuth access token using a bare refresh token.
+ * Harness-agnostic: performs only the token POST and returns the new
+ * credentials. Persistence/caching is the caller's responsibility.
+ */
+export async function refreshAntigravityToken(refreshToken) {
+    const startTime = Date.now();
+    const response = await fetch("https://oauth2.googleapis.com/token", {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({
+            grant_type: "refresh_token",
+            refresh_token: refreshToken,
+            client_id: ANTIGRAVITY_CLIENT_ID,
+            client_secret: ANTIGRAVITY_CLIENT_SECRET,
+        }),
+    });
+    if (!response.ok) {
+        const errorText = await response.text().catch(() => "");
+        throw new Error(`Antigravity token refresh failed (${response.status} ${response.statusText})${errorText ? ` - ${errorText}` : ""}`);
+    }
+    const payload = (await response.json());
+    return {
+        access: payload.access_token,
+        refresh: payload.refresh_token ?? refreshToken,
+        expires: calculateTokenExpiry(startTime, payload.expires_in),
+    };
+}
+/**
+ * Encode an object into a URL-safe base64 string.
+ */
+function encodeState(payload) {
+    return Buffer.from(JSON.stringify(payload), "utf8").toString("base64url");
+}
+/**
+ * Decode an OAuth state parameter back into its structured representation.
+ */
+function decodeState(state) {
+    const normalized = state.replace(/-/g, "+").replace(/_/g, "/");
+    const padded = normalized.padEnd(normalized.length + ((4 - normalized.length % 4) % 4), "=");
+    const json = Buffer.from(padded, "base64").toString("utf8");
+    const parsed = JSON.parse(json);
+    if (typeof parsed.verifier !== "string") {
+        throw new Error("Missing PKCE verifier in state");
+    }
+    return {
+        verifier: parsed.verifier,
+        projectId: typeof parsed.projectId === "string" ? parsed.projectId : "",
+    };
+}
+/**
+ * Build the Antigravity OAuth authorization URL including PKCE and optional project metadata.
+ */
+export async function authorizeAntigravity(projectId = "") {
+    const pkce = (await generatePKCE());
+    const url = new URL("https://accounts.google.com/o/oauth2/v2/auth");
+    url.searchParams.set("client_id", ANTIGRAVITY_CLIENT_ID);
+    url.searchParams.set("response_type", "code");
+    url.searchParams.set("redirect_uri", ANTIGRAVITY_REDIRECT_URI);
+    url.searchParams.set("scope", ANTIGRAVITY_SCOPES.join(" "));
+    url.searchParams.set("code_challenge", pkce.challenge);
+    url.searchParams.set("code_challenge_method", "S256");
+    url.searchParams.set("state", encodeState({ verifier: pkce.verifier, projectId: projectId || "" }));
+    url.searchParams.set("access_type", "offline");
+    url.searchParams.set("prompt", "consent");
+    return {
+        url: url.toString(),
+        verifier: pkce.verifier,
+        projectId: projectId || "",
+    };
+}
+async function fetchProjectID(accessToken) {
+    const errors = [];
+    const loadHeaders = buildAntigravityHarnessBootstrapHeaders(accessToken);
+    const loadEndpoints = Array.from(new Set([...ANTIGRAVITY_LOAD_ENDPOINTS, ...ANTIGRAVITY_ENDPOINT_FALLBACKS]));
+    for (const baseEndpoint of loadEndpoints) {
+        try {
+            const url = `${baseEndpoint}/v1internal:loadCodeAssist`;
+            const response = await fetchWithAgyCliTransport(url, {
+                method: "POST",
+                headers: loadHeaders,
+                body: JSON.stringify({ metadata: buildAntigravityLoadCodeAssistMetadata() }),
+            }, { timeoutMs: 10000 });
+            if (!response.ok) {
+                const message = await response.text().catch(() => "");
+                errors.push(`loadCodeAssist ${response.status} at ${baseEndpoint}${message ? `: ${message}` : ""}`);
+                continue;
+            }
+            const data = await response.json();
+            if (typeof data.cloudaicompanionProject === "string" && data.cloudaicompanionProject) {
+                return data.cloudaicompanionProject;
+            }
+            if (data.cloudaicompanionProject &&
+                typeof data.cloudaicompanionProject.id === "string" &&
+                data.cloudaicompanionProject.id) {
+                return data.cloudaicompanionProject.id;
+            }
+            errors.push(`loadCodeAssist missing project id at ${baseEndpoint}`);
+        }
+        catch (e) {
+            errors.push(`loadCodeAssist error at ${baseEndpoint}: ${e instanceof Error ? e.message : String(e)}`);
+        }
+    }
+    if (errors.length) {
+        log.warn("Failed to resolve Antigravity project via loadCodeAssist", { errors: errors.join("; ") });
+    }
+    return "";
+}
+/**
+ * Exchange an authorization code for Antigravity CLI access and refresh tokens.
+ */
+export async function exchangeAntigravity(code, state) {
+    try {
+        const { verifier, projectId } = decodeState(state);
+        const startTime = Date.now();
+        const tokenResponse = await fetch("https://oauth2.googleapis.com/token", {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/x-www-form-urlencoded;charset=UTF-8",
+                "Accept": "*/*",
+                "Accept-Encoding": "gzip, deflate, br",
+                "User-Agent": GEMINI_CLI_HEADERS["User-Agent"],
+            },
+            body: new URLSearchParams({
+                client_id: ANTIGRAVITY_CLIENT_ID,
+                client_secret: ANTIGRAVITY_CLIENT_SECRET,
+                code,
+                grant_type: "authorization_code",
+                redirect_uri: ANTIGRAVITY_REDIRECT_URI,
+                code_verifier: verifier,
+            }),
+        });
+        if (!tokenResponse.ok) {
+            const errorText = await tokenResponse.text();
+            return { type: "failed", error: errorText };
+        }
+        const tokenPayload = (await tokenResponse.json());
+        const userInfoResponse = await fetch("https://www.googleapis.com/oauth2/v1/userinfo?alt=json", {
+            headers: {
+                Authorization: `Bearer ${tokenPayload.access_token}`,
+                "User-Agent": GEMINI_CLI_HEADERS["User-Agent"],
+            },
+        });
+        const userInfo = userInfoResponse.ok
+            ? (await userInfoResponse.json())
+            : {};
+        const refreshToken = tokenPayload.refresh_token;
+        if (!refreshToken) {
+            return { type: "failed", error: "Missing refresh token in response" };
+        }
+        let effectiveProjectId = projectId;
+        if (!effectiveProjectId) {
+            effectiveProjectId = await fetchProjectID(tokenPayload.access_token);
+        }
+        const storedRefresh = `${refreshToken}|${effectiveProjectId || ""}`;
+        return {
+            type: "success",
+            refresh: storedRefresh,
+            access: tokenPayload.access_token,
+            expires: calculateTokenExpiry(startTime, tokenPayload.expires_in),
+            email: userInfo.email,
+            projectId: effectiveProjectId || "",
+        };
+    }
+    catch (error) {
+        return {
+            type: "failed",
+            error: error instanceof Error ? error.message : "Unknown error",
+        };
+    }
+}
+//# sourceMappingURL=oauth.js.map

package/dist/antigravity/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../src/antigravity/oauth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAEzD,OAAO,EACL,qBAAqB,EACrB,yBAAyB,EACzB,wBAAwB,EACxB,kBAAkB,EAClB,8BAA8B,EAC9B,0BAA0B,EAC1B,kBAAkB,GACnB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EACL,uCAAuC,EACvC,sCAAsC,GACvC,MAAM,mBAAmB,CAAC;AAE3B,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;AA6ClC;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,YAAoB;IAEpB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,qCAAqC,EAAE;QAClE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,IAAI,eAAe,CAAC;YACxB,UAAU,EAAE,eAAe;YAC3B,aAAa,EAAE,YAAY;YAC3B,SAAS,EAAE,qBAAqB;YAChC,aAAa,EAAE,yBAAyB;SACzC,CAAC;KACH,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACxD,MAAM,IAAI,KAAK,CACb,qCAAqC,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,IAAI,SAAS,CAAC,CAAC,CAAC,MAAM,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CACpH,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAIrC,CAAC;IAEF,OAAO;QACL,MAAM,EAAE,OAAO,CAAC,YAAY;QAC5B,OAAO,EAAE,OAAO,CAAC,aAAa,IAAI,YAAY;QAC9C,OAAO,EAAE,oBAAoB,CAAC,SAAS,EAAE,OAAO,CAAC,UAAU,CAAC;KAC7D,CAAC;AACJ,CAAC;AAYD;;GAEG;AACH,SAAS,WAAW,CAAC,OAA6B;IAChD,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC5E,CAAC;AAED;;GAEG;AACH,SAAS,WAAW,CAAC,KAAa;IAChC,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC/D,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC7F,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,SAAS,EAAE,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE;KACxE,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,SAAS,GAAG,EAAE;IACvD,MAAM,IAAI,GAAG,CAAC,MAAM,YAAY,EAAE,CAAa,CAAC;IAEhD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,8CAA8C,CAAC,CAAC;IACpE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,qBAAqB,CAAC,CAAC;IACzD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,wBAAwB,CAAC,CAAC;IAC/D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACvD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;IACtD,GAAG,CAAC,YAAY,CAAC,GAAG,CAClB,OAAO,EACP,WAAW,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,IAAI,EAAE,EAAE,CAAC,CACrE,CAAC;IACF,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;IAC/C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAE1C,OAAO;QACL,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE;QACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,SAAS,EAAE,SAAS,IAAI,EAAE;KAC3B,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,WAAmB;IAC/C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,WAAW,GAAG,uCAAuC,CAAC,WAAW,CAAC,CAAC;IAEzE,MAAM,aAAa,GAAG,KAAK,CAAC,IAAI,CAC9B,IAAI,GAAG,CAAS,CAAC,GAAG,0BAA0B,EAAE,GAAG,8BAA8B,CAAC,CAAC,CACpF,CAAC;IAEF,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE,CAAC;QACzC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,GAAG,YAAY,4BAA4B,CAAC;YACxD,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC,GAAG,EAAE;gBACnD,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,WAAW;gBACpB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,sCAAsC,EAAE,EAAE,CAAC;aAC7E,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;YAEzB,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;gBACtD,MAAM,CAAC,IAAI,CACT,kBAAkB,QAAQ,CAAC,MAAM,OAAO,YAAY,GAClD,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC,CAAC,CAAC,EAC7B,EAAE,CACH,CAAC;gBACF,SAAS;YACX,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,IAAI,OAAO,IAAI,CAAC,uBAAuB,KAAK,QAAQ,IAAI,IAAI,CAAC,uBAAuB,EAAE,CAAC;gBACrF,OAAO,IAAI,CAAC,uBAAuB,CAAC;YACtC,CAAC;YACD,IACE,IAAI,CAAC,uBAAuB;gBAC5B,OAAO,IAAI,CAAC,uBAAuB,CAAC,EAAE,KAAK,QAAQ;gBACnD,IAAI,CAAC,uBAAuB,CAAC,EAAE,EAC/B,CAAC;gBACD,OAAO,IAAI,CAAC,uBAAuB,CAAC,EAAE,CAAC;YACzC,CAAC;YAED,MAAM,CAAC,IAAI,CAAC,wCAAwC,YAAY,EAAE,CAAC,CAAC;QACtE,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,CAAC,IAAI,CACT,2BAA2B,YAAY,KACrC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAC3C,EAAE,CACH,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,GAAG,CAAC,IAAI,CAAC,0DAA0D,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACtG,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAY,EACZ,KAAa;IAEb,IAAI,CAAC;QACH,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;QAEnD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,qCAAqC,EAAE;YACvE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,iDAAiD;gBACjE,QAAQ,EAAE,KAAK;gBACf,iBAAiB,EAAE,mBAAmB;gBACtC,YAAY,EAAE,kBAAkB,CAAC,YAAY,CAAC;aAC/C;YACD,IAAI,EAAE,IAAI,eAAe,CAAC;gBACxB,SAAS,EAAE,qBAAqB;gBAChC,aAAa,EAAE,yBAAyB;gBACxC,IAAI;gBACJ,UAAU,EAAE,oBAAoB;gBAChC,YAAY,EAAE,wBAAwB;gBACtC,aAAa,EAAE,QAAQ;aACxB,CAAC;SACH,CAAC,CAAC;QAEH,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC;YACtB,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,CAAC;YAC7C,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;QAC9C,CAAC;QAED,MAAM,YAAY,GAAG,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE,CAA6B,CAAC;QAE9E,MAAM,gBAAgB,GAAG,MAAM,KAAK,CAClC,wDAAwD,EACxD;YACE,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,YAAY,CAAC,YAAY,EAAE;gBACpD,YAAY,EAAE,kBAAkB,CAAC,YAAY,CAAC;aAC/C;SACF,CACF,CAAC;QAEF,MAAM,QAAQ,GAAG,gBAAgB,CAAC,EAAE;YAClC,CAAC,CAAE,CAAC,MAAM,gBAAgB,CAAC,IAAI,EAAE,CAAyB;YAC1D,CAAC,CAAC,EAAE,CAAC;QAEP,MAAM,YAAY,GAAG,YAAY,CAAC,aAAa,CAAC;QAChD,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC;QACxE,CAAC;QAED,IAAI,kBAAkB,GAAG,SAAS,CAAC;QACnC,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACxB,kBAAkB,GAAG,MAAM,cAAc,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;QACvE,CAAC;QAED,MAAM,aAAa,GAAG,GAAG,YAAY,IAAI,kBAAkB,IAAI,EAAE,EAAE,CAAC;QAEpE,OAAO;YACL,IAAI,EAAE,SAAS;YACf,OAAO,EAAE,aAAa;YACtB,MAAM,EAAE,YAAY,CAAC,YAAY;YACjC,OAAO,EAAE,oBAAoB,CAAC,SAAS,EAAE,YAAY,CAAC,UAAU,CAAC;YACjE,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,SAAS,EAAE,kBAAkB,IAAI,EAAE;SACpC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;SAChE,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/auth-types.d.ts

@@ -0,0 +1,26 @@
+export interface OAuthAuthDetails {
+    type: "oauth";
+    refresh: string;
+    access?: string;
+    expires?: number;
+}
+export interface ApiKeyAuthDetails {
+    type: "api_key";
+    key: string;
+}
+export interface NonOAuthAuthDetails {
+    type: string;
+    [key: string]: unknown;
+}
+export type AuthDetails = OAuthAuthDetails | ApiKeyAuthDetails | NonOAuthAuthDetails;
+export type GetAuth = () => Promise<AuthDetails>;
+export interface RefreshParts {
+    refreshToken: string;
+    projectId?: string;
+    managedProjectId?: string;
+}
+export interface ProjectContextResult {
+    auth: OAuthAuthDetails;
+    effectiveProjectId: string;
+}
+//# sourceMappingURL=auth-types.d.ts.map

package/dist/auth-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-types.d.ts","sourceRoot":"","sources":["../src/auth-types.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,OAAO,CAAA;IACb,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,SAAS,CAAA;IACf,GAAG,EAAE,MAAM,CAAA;CACZ;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAA;IACZ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB;AAED,MAAM,MAAM,WAAW,GAAG,gBAAgB,GAAG,iBAAiB,GAAG,mBAAmB,CAAA;AAEpF,MAAM,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,CAAA;AAEhD,MAAM,WAAW,YAAY;IAC3B,YAAY,EAAE,MAAM,CAAA;IACpB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,gBAAgB,CAAA;IACtB,kBAAkB,EAAE,MAAM,CAAA;CAC3B"}

package/dist/auth-types.js

@@ -0,0 +1,3 @@
+// Harness-agnostic auth/credential types shared by core and harness packages.
+export {};
+//# sourceMappingURL=auth-types.js.map

package/dist/auth-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-types.js","sourceRoot":"","sources":["../src/auth-types.ts"],"names":[],"mappings":"AAAA,8EAA8E"}

package/dist/auth.d.ts

@@ -0,0 +1,21 @@
+import type { OAuthAuthDetails, RefreshParts } from "./auth-types.ts";
+export declare function isOAuthAuth(auth: unknown): auth is OAuthAuthDetails;
+/**
+ * Splits a packed refresh string into its constituent refresh token and project IDs.
+ */
+export declare function parseRefreshParts(refresh: string): RefreshParts;
+/**
+ * Serializes refresh token parts into the stored string format.
+ */
+export declare function formatRefreshParts(parts: RefreshParts): string;
+/**
+ * Determines whether an access token is expired or missing, with buffer for clock skew.
+ */
+export declare function accessTokenExpired(auth: OAuthAuthDetails): boolean;
+/**
+ * Calculates absolute expiry timestamp based on a duration.
+ * @param requestTimeMs The local time when the request was initiated
+ * @param expiresInSeconds The duration returned by the server
+ */
+export declare function calculateTokenExpiry(requestTimeMs: number, expiresInSeconds: unknown): number;
+//# sourceMappingURL=auth.d.ts.map

package/dist/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAItE,wBAAgB,WAAW,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,IAAI,gBAAgB,CAEnE;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY,CAO/D;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,YAAY,GAAG,MAAM,CAI9D;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAKlE;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,aAAa,EAAE,MAAM,EAAE,gBAAgB,EAAE,OAAO,GAAG,MAAM,CAO7F"}

package/dist/auth.js

@@ -0,0 +1,46 @@
+const ACCESS_TOKEN_EXPIRY_BUFFER_MS = 60 * 1000;
+export function isOAuthAuth(auth) {
+    return typeof auth === "object" && auth !== null && "type" in auth && auth.type === "oauth";
+}
+/**
+ * Splits a packed refresh string into its constituent refresh token and project IDs.
+ */
+export function parseRefreshParts(refresh) {
+    const [refreshToken = "", projectId = "", managedProjectId = ""] = (refresh ?? "").split("|");
+    return {
+        refreshToken,
+        projectId: projectId || undefined,
+        managedProjectId: managedProjectId || undefined,
+    };
+}
+/**
+ * Serializes refresh token parts into the stored string format.
+ */
+export function formatRefreshParts(parts) {
+    const projectSegment = parts.projectId ?? "";
+    const base = `${parts.refreshToken}|${projectSegment}`;
+    return parts.managedProjectId ? `${base}|${parts.managedProjectId}` : base;
+}
+/**
+ * Determines whether an access token is expired or missing, with buffer for clock skew.
+ */
+export function accessTokenExpired(auth) {
+    if (!auth.access || typeof auth.expires !== "number") {
+        return true;
+    }
+    return auth.expires <= Date.now() + ACCESS_TOKEN_EXPIRY_BUFFER_MS;
+}
+/**
+ * Calculates absolute expiry timestamp based on a duration.
+ * @param requestTimeMs The local time when the request was initiated
+ * @param expiresInSeconds The duration returned by the server
+ */
+export function calculateTokenExpiry(requestTimeMs, expiresInSeconds) {
+    const seconds = typeof expiresInSeconds === "number" ? expiresInSeconds : 3600;
+    // Safety check for bad data - if it's not a positive number, treat as immediately expired
+    if (isNaN(seconds) || seconds <= 0) {
+        return requestTimeMs;
+    }
+    return requestTimeMs + seconds * 1000;
+}
+//# sourceMappingURL=auth.js.map

package/dist/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAEA,MAAM,6BAA6B,GAAG,EAAE,GAAG,IAAI,CAAC;AAEhD,MAAM,UAAU,WAAW,CAAC,IAAa;IACvC,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,MAAM,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,CAAC;AAC9F,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,MAAM,CAAC,YAAY,GAAG,EAAE,EAAE,SAAS,GAAG,EAAE,EAAE,gBAAgB,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9F,OAAO;QACL,YAAY;QACZ,SAAS,EAAE,SAAS,IAAI,SAAS;QACjC,gBAAgB,EAAE,gBAAgB,IAAI,SAAS;KAChD,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAmB;IACpD,MAAM,cAAc,GAAG,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC;IAC7C,MAAM,IAAI,GAAG,GAAG,KAAK,CAAC,YAAY,IAAI,cAAc,EAAE,CAAC;IACvD,OAAO,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,KAAK,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7E,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAsB;IACvD,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QACrD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,6BAA6B,CAAC;AACpE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,aAAqB,EAAE,gBAAyB;IACnF,MAAM,OAAO,GAAG,OAAO,gBAAgB,KAAK,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/E,0FAA0F;IAC1F,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;QACnC,OAAO,aAAa,CAAC;IACvB,CAAC;IACD,OAAO,aAAa,GAAG,OAAO,GAAG,IAAI,CAAC;AACxC,CAAC"}

package/dist/constants.d.ts

@@ -0,0 +1,146 @@
+/**
+ * Constants used for Antigravity OAuth flows and Cloud Code Assist API integration.
+ */
+export declare const ANTIGRAVITY_CLIENT_ID = "1071006060591-tmhssin2h21lcre235vtolojh4g403ep.apps.googleusercontent.com";
+/**
+ * Client secret issued for the Antigravity OAuth application.
+ */
+export declare const ANTIGRAVITY_CLIENT_SECRET = "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";
+/**
+ * Scopes required for Antigravity integrations.
+ */
+export declare const ANTIGRAVITY_SCOPES: readonly string[];
+/**
+ * OAuth redirect URI used by the local CLI callback server.
+ */
+export declare const ANTIGRAVITY_REDIRECT_URI = "http://localhost:51121/oauth-callback";
+/**
+ * Root endpoints for the Antigravity API (in fallback order).
+ * Live agy CLI 1.0.4 traffic uses daily-cloudcode-pa.googleapis.com.
+ */
+export declare const ANTIGRAVITY_ENDPOINT_DAILY = "https://daily-cloudcode-pa.googleapis.com";
+export declare const ANTIGRAVITY_ENDPOINT_AUTOPUSH = "https://autopush-cloudcode-pa.sandbox.googleapis.com";
+export declare const ANTIGRAVITY_ENDPOINT_PROD = "https://cloudcode-pa.googleapis.com";
+/**
+ * Endpoint fallback order (daily → prod).
+ * Autopush removed to reduce unnecessary fallback API calls — it rarely works when daily fails.
+ * Shared across request handling and project discovery to mirror CLIProxy behavior.
+ */
+export declare const ANTIGRAVITY_ENDPOINT_FALLBACKS: readonly ["https://daily-cloudcode-pa.googleapis.com", "https://cloudcode-pa.googleapis.com"];
+/**
+ * Preferred endpoint order for project discovery.
+ * agy CLI probes daily-cloudcode-pa.googleapis.com first.
+ */
+export declare const ANTIGRAVITY_LOAD_ENDPOINTS: readonly ["https://daily-cloudcode-pa.googleapis.com", "https://cloudcode-pa.googleapis.com"];
+/**
+ * Primary endpoint to use (captured agy CLI daily endpoint).
+ */
+export declare const ANTIGRAVITY_ENDPOINT = "https://daily-cloudcode-pa.googleapis.com";
+/**
+ * Gemini CLI endpoint (production).
+ * Used for models without :antigravity suffix.
+ * Same as opencode-gemini-auth's GEMINI_CODE_ASSIST_ENDPOINT.
+ */
+export declare const GEMINI_CLI_ENDPOINT = "https://cloudcode-pa.googleapis.com";
+/**
+ * Hardcoded project id used when Antigravity does not return one (e.g., business/workspace accounts).
+ */
+export declare const ANTIGRAVITY_DEFAULT_PROJECT_ID = "rising-fact-p41fc";
+export declare const ANTIGRAVITY_VERSION_FALLBACK = "1.18.3";
+export declare function getAntigravityVersion(): string;
+/**
+ * Set the runtime Antigravity version. Can only be called once (at startup).
+ * Subsequent calls are silently ignored to prevent accidental mutation.
+ */
+export declare function setAntigravityVersion(version: string): void;
+/** @deprecated Use getAntigravityVersion() for runtime access. */
+export declare const ANTIGRAVITY_VERSION = "1.18.3";
+export declare function getAntigravityHeaders(): HeaderSet & {
+    "Client-Metadata": string;
+};
+/** @deprecated Use getAntigravityHeaders() for runtime access. */
+export declare const ANTIGRAVITY_HEADERS: {
+    readonly "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Antigravity/1.18.3 Chrome/138.0.7204.235 Electron/37.3.1 Safari/537.36";
+    readonly "X-Goog-Api-Client": "google-cloud-sdk vscode_cloudshelleditor/0.1";
+    readonly "Client-Metadata": "{\"ideType\":\"ANTIGRAVITY\",\"platform\":\"WINDOWS\",\"pluginType\":\"GEMINI\"}" | "{\"ideType\":\"ANTIGRAVITY\",\"platform\":\"MACOS\",\"pluginType\":\"GEMINI\"}";
+};
+export declare const GEMINI_CLI_VERSION = "1.0.0";
+/**
+ * Default model used in Gemini CLI User-Agent when no model is specified.
+ */
+export declare const GEMINI_CLI_DEFAULT_MODEL = "gemini-2.5-pro";
+/**
+ * Build Gemini CLI User-Agent string matching the official google-gemini/gemini-cli format.
+ * Format: `GeminiCLI/{version}/{model} ({platform}; {arch})`
+ *
+ * @see https://github.com/google-gemini/gemini-cli
+ */
+export declare function buildGeminiCliUserAgent(model?: string): string;
+/** @deprecated Use buildGeminiCliUserAgent() for runtime access. */
+export declare const GEMINI_CLI_HEADERS: {
+    readonly "User-Agent": "google-api-nodejs-client/9.15.1";
+    readonly "X-Goog-Api-Client": "gl-node/22.17.0";
+    readonly "Client-Metadata": "ideType=IDE_UNSPECIFIED,platform=PLATFORM_UNSPECIFIED,pluginType=GEMINI";
+};
+export type HeaderSet = {
+    "User-Agent": string;
+    "X-Goog-Api-Client"?: string;
+    "Client-Metadata"?: string;
+};
+export declare function getRandomizedHeaders(style: HeaderStyle, model?: string): HeaderSet;
+export type HeaderStyle = "antigravity" | "gemini-cli";
+/**
+ * Provider identifier shared between the plugin loader and credential store.
+ */
+export declare const ANTIGRAVITY_PROVIDER_ID = "google";
+/**
+ * System instruction for Claude tool usage hardening.
+ * Prevents hallucinated parameters by explicitly stating the rules.
+ *
+ * This is injected when tools are present to reduce cases where Claude
+ * uses parameter names from its training data instead of the actual schema.
+ */
+export declare const CLAUDE_TOOL_SYSTEM_INSTRUCTION = "CRITICAL TOOL USAGE INSTRUCTIONS:\nYou are operating in a custom environment where tool definitions differ from your training data.\nYou MUST follow these rules strictly:\n\n1. DO NOT use your internal training data to guess tool parameters\n2. ONLY use the exact parameter structure defined in the tool schema\n3. Parameter names in schemas are EXACT - do not substitute with similar names from your training\n4. Array parameters have specific item types - check the schema's 'items' field for the exact structure\n5. When you see \"STRICT PARAMETERS\" in a tool description, those type definitions override any assumptions\n6. Tool use in agentic workflows is REQUIRED - you must call tools with the exact parameters specified\n\nIf you are unsure about a tool's parameters, YOU MUST read the schema definition carefully.";
+/**
+ * Template for parameter signature injection into tool descriptions.
+ * {params} will be replaced with the actual parameter list.
+ */
+export declare const CLAUDE_DESCRIPTION_PROMPT = "\n\n\u26A0\uFE0F STRICT PARAMETERS: {params}.";
+export declare const EMPTY_SCHEMA_PLACEHOLDER_NAME = "_placeholder";
+export declare const EMPTY_SCHEMA_PLACEHOLDER_DESCRIPTION = "Placeholder. Always pass true.";
+/**
+ * Sentinel value to bypass thought signature validation.
+ *
+ * When a thinking block has an invalid or missing signature (e.g., cache miss,
+ * session mismatch, plugin restart), this sentinel can be injected to skip
+ * validation instead of failing with "Invalid signature in thinking block".
+ *
+ * This is an officially supported Google API feature, used by:
+ * - gemini-cli: https://github.com/google-gemini/gemini-cli
+ * - Google .NET SDK: PredictionServiceChatClient.cs
+ *
+ * @see https://ai.google.dev/gemini-api/docs/thought-signatures
+ */
+export declare const SKIP_THOUGHT_SIGNATURE = "skip_thought_signature_validator";
+/**
+ * Model used for Google Search grounding requests.
+ * Uses gemini-2.5-flash for fast, cost-effective search operations. (3-flash is always at capacity and doesn't support souce citation).
+ */
+export declare const SEARCH_MODEL = "gemini-2.5-flash";
+/**
+ * Thinking budget for deep search (more thorough analysis).
+ */
+export declare const SEARCH_THINKING_BUDGET_DEEP = 16384;
+/**
+ * Thinking budget for fast search (quick results).
+ */
+export declare const SEARCH_THINKING_BUDGET_FAST = 4096;
+/**
+ * Timeout for search requests in milliseconds (60 seconds).
+ */
+export declare const SEARCH_TIMEOUT_MS = 60000;
+/**
+ * System instruction for the Google Search tool.
+ */
+export declare const SEARCH_SYSTEM_INSTRUCTION = "You are an expert web search assistant with access to Google Search and URL analysis tools.\n\nYour capabilities:\n- Use google_search to find real-time information from the web\n- Use url_context to fetch and analyze content from specific URLs when provided\n\nGuidelines:\n- Always provide accurate, well-sourced information\n- Cite your sources when presenting facts\n- If analyzing URLs, extract the most relevant information\n- Be concise but comprehensive in your responses\n- If information is uncertain or conflicting, acknowledge it\n- Focus on answering the user's question directly";
+//# sourceMappingURL=constants.d.ts.map

package/dist/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,eAAO,MAAM,qBAAqB,8EAA8E,CAAC;AAEjH;;GAEG;AACH,eAAO,MAAM,yBAAyB,wCAAwC,CAAC;AAE/E;;GAEG;AACH,eAAO,MAAM,kBAAkB,EAAE,SAAS,MAAM,EAM/C,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,wBAAwB,0CAA0C,CAAC;AAEhF;;;GAGG;AACH,eAAO,MAAM,0BAA0B,8CAA8C,CAAC;AACtF,eAAO,MAAM,6BAA6B,yDAAyD,CAAC;AACpG,eAAO,MAAM,yBAAyB,wCAAwC,CAAC;AAE/E;;;;GAIG;AACH,eAAO,MAAM,8BAA8B,+FAGjC,CAAC;AACX;;;GAGG;AACH,eAAO,MAAM,0BAA0B,+FAG7B,CAAC;AACX;;GAEG;AACH,eAAO,MAAM,oBAAoB,8CAA6B,CAAC;AAE/D;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,wCAA4B,CAAC;AAE7D;;GAEG;AACH,eAAO,MAAM,8BAA8B,sBAAsB,CAAC;AAElE,eAAO,MAAM,4BAA4B,WAAW,CAAC;AAIrD,wBAAgB,qBAAqB,IAAI,MAAM,CAA+B;AAE9E;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAI3D;AAED,kEAAkE;AAClE,eAAO,MAAM,mBAAmB,WAA+B,CAAC;AAEhE,wBAAgB,qBAAqB,IAAI,SAAS,GAAG;IAAE,iBAAiB,EAAE,MAAM,CAAA;CAAE,CAMjF;AAED,kEAAkE;AAClE,eAAO,MAAM,mBAAmB;;;;CAItB,CAAC;AAEX,eAAO,MAAM,kBAAkB,UAAU,CAAC;AAE1C;;GAEG;AACH,eAAO,MAAM,wBAAwB,mBAAmB,CAAC;AAEzD;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAK9D;AAED,oEAAoE;AACpE,eAAO,MAAM,kBAAkB;;;;CAIrB,CAAC;AAOX,MAAM,MAAM,SAAS,GAAG;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,WAAW,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAYlF;AAED,MAAM,MAAM,WAAW,GAAG,aAAa,GAAG,YAAY,CAAC;AAEvD;;GAEG;AACH,eAAO,MAAM,uBAAuB,WAAW,CAAC;AAMhD;;;;;;GAMG;AACH,eAAO,MAAM,8BAA8B,4zBAWiD,CAAC;AAE7F;;;GAGG;AACH,eAAO,MAAM,yBAAyB,kDAAwC,CAAC;AAE/E,eAAO,MAAM,6BAA6B,iBAAiB,CAAC;AAC5D,eAAO,MAAM,oCAAoC,mCAAmC,CAAC;AAErF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,sBAAsB,qCAAqC,CAAC;AAMzE;;;GAGG;AACH,eAAO,MAAM,YAAY,qBAAqB,CAAC;AAE/C;;GAEG;AACH,eAAO,MAAM,2BAA2B,QAAQ,CAAC;AAEjD;;GAEG;AACH,eAAO,MAAM,2BAA2B,OAAO,CAAC;AAEhD;;GAEG;AACH,eAAO,MAAM,iBAAiB,QAAQ,CAAC;AAEvC;;GAEG;AACH,eAAO,MAAM,yBAAyB,qlBAYY,CAAC"}