@cortexkit/antigravity-auth-core 2.2.1 → 3.0.0

package/dist/vault-account-source.d.ts

@@ -0,0 +1,183 @@
+/**
+ * Antigravity accounts served from a Claustrum vault ("custody mode").
+ *
+ * Terms used below:
+ * - roster: the non-secret list of vault accounts this host may route to
+ *   (route id, credential id, account identity, enabled/declined state).
+ * - receipt: what Claustrum serves for one send attempt: a fresh bearer, the
+ *   Antigravity project for the model request, the account identity the vault
+ *   asserted, and the record version it served for the credential.
+ * - host auth slot: the host's own Google credential record. Pi temporarily
+ *   replaces it with a non-secret marker and retains a backup; OpenCode may
+ *   keep its existing login. Neither is read by this vault account source.
+ *
+ * The host passes in the library's public `./claustrum` module; every library
+ * type here is taken from that module's own declarations.
+ *
+ * Rules:
+ * - Each send attempt to Google (each endpoint fallback, each 401 retry,
+ *   quota and profile reads) gets a new admission with a fresh receipt, and
+ *   takes its bearer and project from that receipt only. Nothing is cached or
+ *   refreshed locally.
+ * - Google bearers are opaque: a receipt is accepted only when the vault
+ *   asserted the credential and the account the selected route names. No
+ *   token is parsed for an identity, and API-key credentials are refused.
+ * - Nothing is served unless custody is active. The host's local credentials
+ *   stay dormant: this source never reads or refreshes them.
+ */
+import type { CommonAuthClaustrumModule } from './common-auth-runtime.ts';
+import { type AntigravityVaultHost } from './vault-family.ts';
+import { type AntigravityVaultStateFs, type AntigravityVaultStateUpdate, type VaultProviderStateCommitResult, type VaultStateAttribution } from './vault-provider-state.ts';
+type ClaustrumConsumerClass = CommonAuthClaustrumModule['ClaustrumConsumer'];
+type ClaustrumConsumerInstance = InstanceType<ClaustrumConsumerClass>;
+export type VaultConsumerOptions = ConstructorParameters<ClaustrumConsumerClass>[0];
+export type VaultScopedClient = Awaited<ReturnType<VaultConsumerOptions['connect']>>;
+export type VaultScopedReceipt = Awaited<ReturnType<ClaustrumConsumerInstance['authorize']>>;
+export type VaultRoster = NonNullable<ReturnType<ClaustrumConsumerInstance['snapshot']>>;
+export type VaultRosterRow = VaultRoster['rows'][number];
+export type VaultReporterSource = Parameters<ClaustrumConsumerInstance['reportFailure']>[2];
+export type VaultLogger = NonNullable<VaultConsumerOptions['logger']>;
+/** The consumer methods this source calls. */
+export type VaultClaustrumConsumer = Pick<ClaustrumConsumerInstance, 'snapshot' | 'refresh' | 'start' | 'authorize' | 'reportFailure' | 'decline' | 'accept' | 'close'>;
+/**
+ * The part of `./claustrum` this source uses. The module namespace itself
+ * assigns to it; tests can pass a smaller stand-in.
+ */
+export interface VaultClaustrumPort extends Pick<CommonAuthClaustrumModule, 'decideScopedRetryAfter401' | 'isDeclined' | 'mutateVaultRoster'> {
+    ClaustrumConsumer: new (options: VaultConsumerOptions) => VaultClaustrumConsumer;
+}
+export type AntigravityVaultSourceFailureKind = 'closed' | 'not-active' | 'route-unavailable' | 'api-key-refused' | 'identity-unasserted' | 'identity-contradicted' | 'project-missing' | 'invalid-receipt' | 'not-issued' | 'state-unavailable';
+/**
+ * A refusal by this source before any request reaches Google. Refusals made
+ * by the Claustrum library itself arrive as the library's own errors.
+ */
+export declare class AntigravityVaultSourceError extends Error {
+    readonly kind: AntigravityVaultSourceFailureKind;
+    constructor(kind: AntigravityVaultSourceFailureKind, message: string);
+}
+/**
+ * A selectable vault account: the route plus the credential id and account
+ * identity the roster named when it was captured, before any await. `admit`
+ * refuses the ref once the current roster routes it to another credential or
+ * account.
+ */
+export interface VaultRouteRef {
+    readonly routeId: string;
+    readonly credentialId: string;
+    readonly accountIdentity: string;
+    /** The roster row's display label; may hold personal data. */
+    readonly label: string;
+    readonly email?: string;
+}
+/**
+ * The inputs of one send attempt, all taken from one Claustrum receipt. Use it
+ * for exactly one attempt. `accessToken` is non-enumerable, so spreads and JSON
+ * never copy it.
+ */
+export interface VaultSendAdmission {
+    readonly routeId: string;
+    readonly credentialId: string;
+    readonly accountIdentity: string;
+    /** The record version Claustrum served; a 401 is reported against it. */
+    readonly recordVersion: number;
+    /** Antigravity project to put in the model request body. */
+    readonly projectId: string;
+    readonly accessToken: string;
+    readonly expiresAtMs: number | null;
+}
+export interface VaultSendOptions {
+    /**
+     * Request kind (`model`, `quota`, `profile`). The library logs it with its
+     * decision whether to retry a 401.
+     */
+    site: string;
+    signal?: AbortSignal;
+    reporterSource?: VaultReporterSource;
+}
+export interface AntigravityVaultSourceOptions {
+    claustrum: VaultClaustrumPort;
+    host: AntigravityVaultHost;
+    rosterPath: string;
+    /** Enrollment token file that setup wrote for this host (`host`). */
+    tokenPath: string;
+    connect: () => Promise<VaultScopedClient>;
+    isCustodyActive: () => boolean | Promise<boolean>;
+    /**
+     * How a 401 reached this plugin, passed to Claustrum with the 401 report
+     * that `send` makes.
+     */
+    reporterSource: VaultReporterSource;
+    /**
+     * Credential-free per-account state file (see `vault-provider-state.ts`) and
+     * the `./fs` functions that lock and write it. Without it `commitState` has
+     * nowhere to write and is refused.
+     */
+    state?: {
+        path: string;
+        fs: AntigravityVaultStateFs;
+    };
+    reservedRouteIds?: () => Iterable<string>;
+    routePrefix?: string;
+    onRoster?: (roster: VaultRoster) => void;
+    onError?: (error: unknown) => void;
+    pollIntervalMs?: number;
+    now?: () => number;
+    logger?: VaultLogger;
+}
+export interface AntigravityVaultAccountSource {
+    readonly host: AntigravityVaultHost;
+    start(): void;
+    refresh(): Promise<VaultRoster | undefined>;
+    /** Selectable accounts from the last committed roster. */
+    routes(): VaultRouteRef[];
+    /** A fresh receipt for one physical send on `ref`. */
+    admit(ref: VaultRouteRef, signal?: AbortSignal): Promise<VaultSendAdmission>;
+    /**
+     * Admit and dispatch. When the original response status of the dispatch is
+     * 401, retry once with a fresh receipt only if the vault now serves a newer
+     * version of the same credential and account; a final 401 is reported with
+     * the receipt that dispatch used. When the caller tries another Antigravity
+     * endpoint after a failure, that attempt is a new `send` with a new
+     * admission.
+     */
+    send(ref: VaultRouteRef, dispatch: (admission: VaultSendAdmission, signal?: AbortSignal) => Promise<Response>, options: VaultSendOptions): Promise<Response>;
+    /**
+     * Report to Claustrum that the request sent with `admission` got a 401, so
+     * the vault can mark that served record version bad. Pass the original
+     * response status; only 401 is reported, once per admission, against that
+     * admission's own receipt and record version. Other statuses return false.
+     */
+    reportServedStatus(admission: VaultSendAdmission, status: number, reporterSource?: VaultReporterSource): Promise<boolean>;
+    /**
+     * The non-secret facts that tie an observation (usage, quota) to the send
+     * that produced it: route, credential id, asserted account and served record
+     * version. Carries no token or project; pass it to `commitState`.
+     */
+    attribution(admission: VaultSendAdmission): VaultStateAttribution;
+    /**
+     * Update the account's provider state; see `commitVaultProviderState`. The
+     * write is refused unless the roster and a fresh receipt still show the
+     * attributed credential, account and record version. If the vault has since
+     * served a newer record version, even for the same account, the observation
+     * is dropped rather than attributed to the newer version.
+     */
+    commitState(attribution: VaultStateAttribution, update: AntigravityVaultStateUpdate): Promise<VaultProviderStateCommitResult>;
+    decline(ref: VaultRouteRef): Promise<void>;
+    accept(ref: VaultRouteRef): Promise<void>;
+    /** Close the vault connection; later calls are refused. */
+    close(): void;
+}
+/**
+ * Path of the Claustrum connection file to pass as the client's
+ * `connectionFile`, resolved by `@cortexkit/claustrum-client`'s own
+ * `resolveClaustrumConnectionPath`: `explicit` when given, else the
+ * `SUBC_CONNECTION_FILE` or `CLAUSTRUM_SUBC_CONNECTION` environment variable,
+ * else the client's default path. The client package is imported only when
+ * this is called, so importing core never loads it, and its errors pass
+ * through unchanged. Resolving the path opens no connection and reads no
+ * enrollment or host credential.
+ */
+export declare function resolveClaustrumConnectionPath(explicit?: string): Promise<string>;
+export declare function createAntigravityVaultAccountSource(options: AntigravityVaultSourceOptions): AntigravityVaultAccountSource;
+export {};
+//# sourceMappingURL=vault-account-source.d.ts.map

package/dist/vault-account-source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault-account-source.d.ts","sourceRoot":"","sources":["../src/vault-account-source.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAA;AACzE,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,2BAA2B,EAEhC,KAAK,8BAA8B,EACnC,KAAK,qBAAqB,EAC3B,MAAM,2BAA2B,CAAA;AAMlC,KAAK,sBAAsB,GAAG,yBAAyB,CAAC,mBAAmB,CAAC,CAAA;AAC5E,KAAK,yBAAyB,GAAG,YAAY,CAAC,sBAAsB,CAAC,CAAA;AAErE,MAAM,MAAM,oBAAoB,GAC9B,qBAAqB,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,CAAA;AAClD,MAAM,MAAM,iBAAiB,GAAG,OAAO,CACrC,UAAU,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAC,CAC5C,CAAA;AACD,MAAM,MAAM,kBAAkB,GAAG,OAAO,CACtC,UAAU,CAAC,yBAAyB,CAAC,WAAW,CAAC,CAAC,CACnD,CAAA;AACD,MAAM,MAAM,WAAW,GAAG,WAAW,CACnC,UAAU,CAAC,yBAAyB,CAAC,UAAU,CAAC,CAAC,CAClD,CAAA;AACD,MAAM,MAAM,cAAc,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAA;AACxD,MAAM,MAAM,mBAAmB,GAAG,UAAU,CAC1C,yBAAyB,CAAC,eAAe,CAAC,CAC3C,CAAC,CAAC,CAAC,CAAA;AACJ,MAAM,MAAM,WAAW,GAAG,WAAW,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC,CAAA;AAErE,8CAA8C;AAC9C,MAAM,MAAM,sBAAsB,GAAG,IAAI,CACvC,yBAAyB,EACvB,UAAU,GACV,SAAS,GACT,OAAO,GACP,WAAW,GACX,eAAe,GACf,SAAS,GACT,QAAQ,GACR,OAAO,CACV,CAAA;AAED;;;GAGG;AACH,MAAM,WAAW,kBACf,SAAQ,IAAI,CACV,yBAAyB,EACzB,2BAA2B,GAAG,YAAY,GAAG,mBAAmB,CACjE;IACD,iBAAiB,EAAE,KACjB,OAAO,EAAE,oBAAoB,KAC1B,sBAAsB,CAAA;CAC5B;AAMD,MAAM,MAAM,iCAAiC,GACzC,QAAQ,GACR,YAAY,GACZ,mBAAmB,GACnB,iBAAiB,GACjB,qBAAqB,GACrB,uBAAuB,GACvB,iBAAiB,GACjB,iBAAiB,GACjB,YAAY,GACZ,mBAAmB,CAAA;AAEvB;;;GAGG;AACH,qBAAa,2BAA4B,SAAQ,KAAK;IACpD,QAAQ,CAAC,IAAI,EAAE,iCAAiC,CAAA;gBAEpC,IAAI,EAAE,iCAAiC,EAAE,OAAO,EAAE,MAAM;CAKrE;AAED;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;IAChC,8DAA8D;IAC9D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CACxB;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;IAChC,yEAAyE;IACzE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,4DAA4D;IAC5D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;CACpC;AAED,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,CAAC,EAAE,WAAW,CAAA;IACpB,cAAc,CAAC,EAAE,mBAAmB,CAAA;CACrC;AAED,MAAM,WAAW,6BAA6B;IAC5C,SAAS,EAAE,kBAAkB,CAAA;IAC7B,IAAI,EAAE,oBAAoB,CAAA;IAC1B,UAAU,EAAE,MAAM,CAAA;IAClB,qEAAqE;IACrE,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,MAAM,OAAO,CAAC,iBAAiB,CAAC,CAAA;IACzC,eAAe,EAAE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACjD;;;OAGG;IACH,cAAc,EAAE,mBAAmB,CAAA;IACnC;;;;OAIG;IACH,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,uBAAuB,CAAA;KAAE,CAAA;IACrD,gBAAgB,CAAC,EAAE,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAA;IACzC,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,IAAI,CAAA;IACxC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAA;IAClC,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;IAClB,MAAM,CAAC,EAAE,WAAW,CAAA;CACrB;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAA;IACnC,KAAK,IAAI,IAAI,CAAA;IACb,OAAO,IAAI,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAAA;IAC3C,0DAA0D;IAC1D,MAAM,IAAI,aAAa,EAAE,CAAA;IACzB,sDAAsD;IACtD,KAAK,CAAC,GAAG,EAAE,aAAa,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;IAC5E;;;;;;;OAOG;IACH,IAAI,CACF,GAAG,EAAE,aAAa,EAClB,QAAQ,EAAE,CACR,SAAS,EAAE,kBAAkB,EAC7B,MAAM,CAAC,EAAE,WAAW,KACjB,OAAO,CAAC,QAAQ,CAAC,EACtB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,QAAQ,CAAC,CAAA;IACpB;;;;;OAKG;IACH,kBAAkB,CAChB,SAAS,EAAE,kBAAkB,EAC7B,MAAM,EAAE,MAAM,EACd,cAAc,CAAC,EAAE,mBAAmB,GACnC,OAAO,CAAC,OAAO,CAAC,CAAA;IACnB;;;;OAIG;IACH,WAAW,CAAC,SAAS,EAAE,kBAAkB,GAAG,qBAAqB,CAAA;IACjE;;;;;;OAMG;IACH,WAAW,CACT,WAAW,EAAE,qBAAqB,EAClC,MAAM,EAAE,2BAA2B,GAClC,OAAO,CAAC,8BAA8B,CAAC,CAAA;IAC1C,OAAO,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC1C,MAAM,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACzC,2DAA2D;IAC3D,KAAK,IAAI,IAAI,CAAA;CACd;AAED;;;;;;;;;GASG;AACH,wBAAsB,8BAA8B,CAClD,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC,CAGjB;AAoHD,wBAAgB,mCAAmC,CACjD,OAAO,EAAE,6BAA6B,GACrC,6BAA6B,CAgO/B"}

package/dist/vault-account-source.js

@@ -0,0 +1,296 @@
+/**
+ * Antigravity accounts served from a Claustrum vault ("custody mode").
+ *
+ * Terms used below:
+ * - roster: the non-secret list of vault accounts this host may route to
+ *   (route id, credential id, account identity, enabled/declined state).
+ * - receipt: what Claustrum serves for one send attempt: a fresh bearer, the
+ *   Antigravity project for the model request, the account identity the vault
+ *   asserted, and the record version it served for the credential.
+ * - host auth slot: the host's own Google credential record. Pi temporarily
+ *   replaces it with a non-secret marker and retains a backup; OpenCode may
+ *   keep its existing login. Neither is read by this vault account source.
+ *
+ * The host passes in the library's public `./claustrum` module; every library
+ * type here is taken from that module's own declarations.
+ *
+ * Rules:
+ * - Each send attempt to Google (each endpoint fallback, each 401 retry,
+ *   quota and profile reads) gets a new admission with a fresh receipt, and
+ *   takes its bearer and project from that receipt only. Nothing is cached or
+ *   refreshed locally.
+ * - Google bearers are opaque: a receipt is accepted only when the vault
+ *   asserted the credential and the account the selected route names. No
+ *   token is parsed for an identity, and API-key credentials are refused.
+ * - Nothing is served unless custody is active. The host's local credentials
+ *   stay dormant: this source never reads or refreshes them.
+ */
+import { ANTIGRAVITY_VAULT_FAMILY, ANTIGRAVITY_VAULT_REQUIRE_ASSERTION, } from "./vault-family.js";
+import { commitVaultProviderState, } from "./vault-provider-state.js";
+/**
+ * A refusal by this source before any request reaches Google. Refusals made
+ * by the Claustrum library itself arrive as the library's own errors.
+ */
+export class AntigravityVaultSourceError extends Error {
+    kind;
+    constructor(kind, message) {
+        super(message);
+        this.name = 'AntigravityVaultSourceError';
+        this.kind = kind;
+    }
+}
+/**
+ * Path of the Claustrum connection file to pass as the client's
+ * `connectionFile`, resolved by `@cortexkit/claustrum-client`'s own
+ * `resolveClaustrumConnectionPath`: `explicit` when given, else the
+ * `SUBC_CONNECTION_FILE` or `CLAUSTRUM_SUBC_CONNECTION` environment variable,
+ * else the client's default path. The client package is imported only when
+ * this is called, so importing core never loads it, and its errors pass
+ * through unchanged. Resolving the path opens no connection and reads no
+ * enrollment or host credential.
+ */
+export async function resolveClaustrumConnectionPath(explicit) {
+    const client = await import('@cortexkit/claustrum-client');
+    return client.resolveClaustrumConnectionPath(explicit);
+}
+function isNonEmpty(value) {
+    return typeof value === 'string' && value.trim().length > 0;
+}
+/** Rows whose route, credential and account are all known and serviceable. */
+function routeRefs(roster, isDeclined) {
+    if (!roster)
+        return [];
+    const refs = [];
+    for (const row of roster.rows) {
+        if (!isServiceableRow(row, roster, isDeclined))
+            continue;
+        refs.push(Object.freeze({
+            routeId: row.routeId,
+            credentialId: row.credentialId,
+            accountIdentity: row.accountIdentity,
+            label: row.label,
+            ...(row.email !== undefined && { email: row.email }),
+        }));
+    }
+    return refs;
+}
+function isServiceableRow(row, roster, isDeclined) {
+    return (row.enabled &&
+        row.state === 'active' &&
+        row.credentialType === 'oauth' &&
+        row.stale !== true &&
+        row.unclaimed !== true &&
+        isNonEmpty(row.accountIdentity) &&
+        !isDeclined(roster.declined, row.credentialId, row.accountIdentity));
+}
+/**
+ * Check a receipt against the selected route and turn it into an admission.
+ * Throws before anything is sent when the receipt does not prove the route's
+ * credential and account, or carries no project.
+ */
+function admissionFromReceipt(ref, receipt) {
+    if (receipt.credentialType !== 'oauth')
+        throw new AntigravityVaultSourceError('api-key-refused', 'Antigravity vault routes serve OAuth credentials only');
+    if (receipt.accountIdentitySource !== 'asserted' ||
+        receipt.assertedCredentialId === undefined ||
+        receipt.assertedAccountIdentity === undefined)
+        throw new AntigravityVaultSourceError('identity-unasserted', 'The vault did not assert the credential and account for this send');
+    if (receipt.credentialId !== ref.credentialId ||
+        receipt.assertedCredentialId !== ref.credentialId ||
+        receipt.assertedAccountIdentity !== ref.accountIdentity ||
+        receipt.accountIdentity !== ref.accountIdentity ||
+        receipt.expectedAccountIdentity !== ref.accountIdentity)
+        throw new AntigravityVaultSourceError('identity-contradicted', 'The vault served a different credential or account than the selected route');
+    if (!isNonEmpty(receipt.projectId) || /\s/.test(receipt.projectId))
+        throw new AntigravityVaultSourceError('project-missing', 'The vault served no Antigravity project for this send');
+    if (!isNonEmpty(receipt.accessToken) ||
+        !Number.isSafeInteger(receipt.recordVersion) ||
+        receipt.recordVersion < 0)
+        throw new AntigravityVaultSourceError('invalid-receipt', 'The vault receipt carries no usable token or record version');
+    const admission = {
+        routeId: ref.routeId,
+        credentialId: receipt.credentialId,
+        accountIdentity: receipt.assertedAccountIdentity,
+        recordVersion: receipt.recordVersion,
+        projectId: receipt.projectId,
+        expiresAtMs: receipt.expiresAtMs,
+    };
+    Object.defineProperty(admission, 'accessToken', {
+        value: receipt.accessToken,
+        enumerable: false,
+    });
+    return Object.freeze(admission);
+}
+export function createAntigravityVaultAccountSource(options) {
+    const { claustrum } = options;
+    const consumer = new claustrum.ClaustrumConsumer({
+        rosterPath: options.rosterPath,
+        tokenPath: options.tokenPath,
+        family: { ...ANTIGRAVITY_VAULT_FAMILY },
+        connect: options.connect,
+        isCustodyActive: options.isCustodyActive,
+        requireAssertion: ANTIGRAVITY_VAULT_REQUIRE_ASSERTION,
+        ...(options.reservedRouteIds && {
+            reservedRouteIds: options.reservedRouteIds,
+        }),
+        ...(options.routePrefix !== undefined && {
+            routePrefix: options.routePrefix,
+        }),
+        ...(options.onRoster && { onRoster: options.onRoster }),
+        ...(options.onError && { onError: options.onError }),
+        ...(options.pollIntervalMs !== undefined && {
+            pollIntervalMs: options.pollIntervalMs,
+        }),
+        ...(options.now && { now: options.now }),
+        ...(options.logger && { logger: options.logger }),
+    });
+    const issued = new WeakMap();
+    const isDeclined = claustrum.isDeclined.bind(claustrum);
+    let closed = false;
+    const assertOpen = (signal) => {
+        if (closed)
+            throw new AntigravityVaultSourceError('closed', 'Antigravity vault source is closed');
+        signal?.throwIfAborted();
+    };
+    /** Require approved vault access before obtaining credentials for an operation. */
+    const assertServing = async (signal) => {
+        assertOpen(signal);
+        if (!(await options.isCustodyActive()))
+            throw new AntigravityVaultSourceError('not-active', 'Antigravity vault custody is not active for this host');
+        assertOpen(signal);
+    };
+    /** The ref must still name a serviceable row of the last committed roster. */
+    const assertCurrentRoute = (ref) => {
+        const roster = consumer.snapshot();
+        const row = roster?.rows.find((entry) => entry.routeId === ref.routeId);
+        if (!roster ||
+            !row ||
+            row.credentialId !== ref.credentialId ||
+            row.accountIdentity !== ref.accountIdentity ||
+            !isServiceableRow(row, roster, isDeclined))
+            throw new AntigravityVaultSourceError('route-unavailable', 'The selected vault route is declined, removed or changed');
+    };
+    const admit = async (ref, signal) => {
+        await assertServing(signal);
+        assertCurrentRoute(ref);
+        const receipt = await consumer.authorize(ref.routeId, signal);
+        assertOpen(signal);
+        const admission = admissionFromReceipt(ref, receipt);
+        issued.set(admission, { receipt, reported: false });
+        return admission;
+    };
+    const issuedEntry = (admission) => {
+        const entry = issued.get(admission);
+        if (!entry)
+            throw new AntigravityVaultSourceError('not-issued', 'This admission was not issued by this vault source');
+        return entry;
+    };
+    const reportServedStatus = async (admission, status, reporterSource) => {
+        const entry = issuedEntry(admission);
+        if (status !== 401 || entry.reported)
+            return false;
+        assertOpen();
+        entry.reported = true;
+        await consumer.reportFailure(entry.receipt, 401, reporterSource ?? options.reporterSource);
+        return true;
+    };
+    /**
+     * Fresh proof that the attributed credential, account and record version
+     * are still what the vault serves. The proving receipt's token and project
+     * are dropped here; they never reach a send.
+     */
+    const verifyAttribution = async (attribution) => {
+        await assertServing();
+        // Authorizing without a committed roster would make the consumer discover
+        // and commit one, which takes the roster lock the caller already holds.
+        if (!consumer.snapshot())
+            throw new AntigravityVaultSourceError('state-unavailable', 'No committed vault roster to verify the account against');
+        const ref = {
+            routeId: attribution.routeId,
+            credentialId: attribution.credentialId,
+            accountIdentity: attribution.accountIdentity,
+            label: '',
+        };
+        const proof = admissionFromReceipt(ref, await consumer.authorize(attribution.routeId));
+        if (proof.recordVersion !== attribution.recordVersion)
+            throw new AntigravityVaultSourceError('state-unavailable', 'The vault now serves another record version for this account');
+    };
+    return {
+        host: options.host,
+        start: () => {
+            assertOpen();
+            consumer.start();
+        },
+        refresh: async () => {
+            assertOpen();
+            return consumer.refresh();
+        },
+        routes: () => (closed ? [] : routeRefs(consumer.snapshot(), isDeclined)),
+        admit,
+        send: async (ref, dispatch, sendOptions) => {
+            const signal = sendOptions.signal;
+            let admission = await admit(ref, signal);
+            let response = await dispatch(admission, signal);
+            if (response.status === 401 && !signal?.aborted) {
+                let current;
+                try {
+                    current = await admit(ref, signal);
+                }
+                catch {
+                    // No retry: the original 401 response is kept and reported below
+                    // with the receipt of the dispatch that received it.
+                }
+                const servedReceipt = issuedEntry(admission).receipt;
+                const currentReceipt = current && issuedEntry(current).receipt;
+                if (current &&
+                    claustrum.decideScopedRetryAfter401(sendOptions.site, servedReceipt, currentReceipt, options.logger)) {
+                    await response.body?.cancel().catch(() => { });
+                    admission = current;
+                    response = await dispatch(current, signal);
+                }
+            }
+            if (response.status === 401)
+                await reportServedStatus(admission, 401, sendOptions.reporterSource).catch((error) => options.onError?.(error));
+            return response;
+        },
+        reportServedStatus,
+        attribution: (admission) => {
+            issuedEntry(admission);
+            return Object.freeze({
+                routeId: admission.routeId,
+                credentialId: admission.credentialId,
+                accountIdentity: admission.accountIdentity,
+                recordVersion: admission.recordVersion,
+            });
+        },
+        commitState: async (attribution, update) => {
+            assertOpen();
+            if (!options.state)
+                throw new AntigravityVaultSourceError('state-unavailable', 'No provider-state sidecar is configured for this vault source');
+            return commitVaultProviderState({
+                claustrum,
+                fs: options.state.fs,
+                rosterPath: options.rosterPath,
+                statePath: options.state.path,
+                attribution,
+                verify: verifyAttribution,
+                update,
+            });
+        },
+        decline: async (ref) => {
+            assertOpen();
+            await consumer.decline(ref.routeId);
+        },
+        accept: async (ref) => {
+            assertOpen();
+            await consumer.accept(ref.routeId);
+        },
+        close: () => {
+            if (closed)
+                return;
+            closed = true;
+            consumer.close();
+        },
+    };
+}
+//# sourceMappingURL=vault-account-source.js.map

package/dist/vault-account-source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault-account-source.js","sourceRoot":"","sources":["../src/vault-account-source.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAGH,OAAO,EACL,wBAAwB,EACxB,mCAAmC,GAEpC,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAGL,wBAAwB,GAGzB,MAAM,2BAA2B,CAAA;AAqElC;;;GAGG;AACH,MAAM,OAAO,2BAA4B,SAAQ,KAAK;IAC3C,IAAI,CAAmC;IAEhD,YAAY,IAAuC,EAAE,OAAe;QAClE,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAA;QACzC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;IAClB,CAAC;CACF;AAkID;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,QAAiB;IAEjB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAA;IAC1D,OAAO,MAAM,CAAC,8BAA8B,CAAC,QAAQ,CAAC,CAAA;AACxD,CAAC;AAWD,SAAS,UAAU,CAAC,KAAc;IAChC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAA;AAC7D,CAAC;AAED,8EAA8E;AAC9E,SAAS,SAAS,CAChB,MAA+B,EAC/B,UAA4C;IAE5C,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAA;IACtB,MAAM,IAAI,GAAoB,EAAE,CAAA;IAChC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,CAAC;YAAE,SAAQ;QACxD,IAAI,CAAC,IAAI,CACP,MAAM,CAAC,MAAM,CAAC;YACZ,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,YAAY,EAAE,GAAG,CAAC,YAAY;YAC9B,eAAe,EAAE,GAAG,CAAC,eAAyB;YAC9C,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,GAAG,CAAC,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC;SACrD,CAAC,CACH,CAAA;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,gBAAgB,CACvB,GAAmB,EACnB,MAAmB,EACnB,UAA4C;IAE5C,OAAO,CACL,GAAG,CAAC,OAAO;QACX,GAAG,CAAC,KAAK,KAAK,QAAQ;QACtB,GAAG,CAAC,cAAc,KAAK,OAAO;QAC9B,GAAG,CAAC,KAAK,KAAK,IAAI;QAClB,GAAG,CAAC,SAAS,KAAK,IAAI;QACtB,UAAU,CAAC,GAAG,CAAC,eAAe,CAAC;QAC/B,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,eAAe,CAAC,CACpE,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,oBAAoB,CAC3B,GAAkB,EAClB,OAA2B;IAE3B,IAAI,OAAO,CAAC,cAAc,KAAK,OAAO;QACpC,MAAM,IAAI,2BAA2B,CACnC,iBAAiB,EACjB,uDAAuD,CACxD,CAAA;IACH,IACE,OAAO,CAAC,qBAAqB,KAAK,UAAU;QAC5C,OAAO,CAAC,oBAAoB,KAAK,SAAS;QAC1C,OAAO,CAAC,uBAAuB,KAAK,SAAS;QAE7C,MAAM,IAAI,2BAA2B,CACnC,qBAAqB,EACrB,mEAAmE,CACpE,CAAA;IACH,IACE,OAAO,CAAC,YAAY,KAAK,GAAG,CAAC,YAAY;QACzC,OAAO,CAAC,oBAAoB,KAAK,GAAG,CAAC,YAAY;QACjD,OAAO,CAAC,uBAAuB,KAAK,GAAG,CAAC,eAAe;QACvD,OAAO,CAAC,eAAe,KAAK,GAAG,CAAC,eAAe;QAC/C,OAAO,CAAC,uBAAuB,KAAK,GAAG,CAAC,eAAe;QAEvD,MAAM,IAAI,2BAA2B,CACnC,uBAAuB,EACvB,4EAA4E,CAC7E,CAAA;IACH,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;QAChE,MAAM,IAAI,2BAA2B,CACnC,iBAAiB,EACjB,uDAAuD,CACxD,CAAA;IACH,IACE,CAAC,UAAU,CAAC,OAAO,CAAC,WAAW,CAAC;QAChC,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,aAAa,CAAC;QAC5C,OAAO,CAAC,aAAa,GAAG,CAAC;QAEzB,MAAM,IAAI,2BAA2B,CACnC,iBAAiB,EACjB,6DAA6D,CAC9D,CAAA;IACH,MAAM,SAAS,GAAG;QAChB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,eAAe,EAAE,OAAO,CAAC,uBAAuB;QAChD,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,WAAW,EAAE,OAAO,CAAC,WAAW;KACjC,CAAA;IACD,MAAM,CAAC,cAAc,CAAC,SAAS,EAAE,aAAa,EAAE;QAC9C,KAAK,EAAE,OAAO,CAAC,WAAW;QAC1B,UAAU,EAAE,KAAK;KAClB,CAAC,CAAA;IACF,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAAuB,CAAA;AACvD,CAAC;AAED,MAAM,UAAU,mCAAmC,CACjD,OAAsC;IAEtC,MAAM,EAAE,SAAS,EAAE,GAAG,OAAO,CAAA;IAC7B,MAAM,QAAQ,GAAG,IAAI,SAAS,CAAC,iBAAiB,CAAC;QAC/C,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,MAAM,EAAE,EAAE,GAAG,wBAAwB,EAAE;QACvC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,gBAAgB,EAAE,mCAAmC;QACrD,GAAG,CAAC,OAAO,CAAC,gBAAgB,IAAI;YAC9B,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;SAC3C,CAAC;QACF,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,IAAI;YACvC,WAAW,EAAE,OAAO,CAAC,WAAW;SACjC,CAAC;QACF,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;QACvD,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;QACpD,GAAG,CAAC,OAAO,CAAC,cAAc,KAAK,SAAS,IAAI;YAC1C,cAAc,EAAE,OAAO,CAAC,cAAc;SACvC,CAAC;QACF,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;QACxC,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;KAClD,CAAC,CAAA;IACF,MAAM,MAAM,GAAG,IAAI,OAAO,EAAuC,CAAA;IACjE,MAAM,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IACvD,IAAI,MAAM,GAAG,KAAK,CAAA;IAElB,MAAM,UAAU,GAAG,CAAC,MAAoB,EAAE,EAAE;QAC1C,IAAI,MAAM;YACR,MAAM,IAAI,2BAA2B,CACnC,QAAQ,EACR,oCAAoC,CACrC,CAAA;QACH,MAAM,EAAE,cAAc,EAAE,CAAA;IAC1B,CAAC,CAAA;IAED,mFAAmF;IACnF,MAAM,aAAa,GAAG,KAAK,EAAE,MAAoB,EAAE,EAAE;QACnD,UAAU,CAAC,MAAM,CAAC,CAAA;QAClB,IAAI,CAAC,CAAC,MAAM,OAAO,CAAC,eAAe,EAAE,CAAC;YACpC,MAAM,IAAI,2BAA2B,CACnC,YAAY,EACZ,uDAAuD,CACxD,CAAA;QACH,UAAU,CAAC,MAAM,CAAC,CAAA;IACpB,CAAC,CAAA;IAED,8EAA8E;IAC9E,MAAM,kBAAkB,GAAG,CAAC,GAAkB,EAAE,EAAE;QAChD,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAA;QAClC,MAAM,GAAG,GAAG,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,GAAG,CAAC,OAAO,CAAC,CAAA;QACvE,IACE,CAAC,MAAM;YACP,CAAC,GAAG;YACJ,GAAG,CAAC,YAAY,KAAK,GAAG,CAAC,YAAY;YACrC,GAAG,CAAC,eAAe,KAAK,GAAG,CAAC,eAAe;YAC3C,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,CAAC;YAE1C,MAAM,IAAI,2BAA2B,CACnC,mBAAmB,EACnB,0DAA0D,CAC3D,CAAA;IACL,CAAC,CAAA;IAED,MAAM,KAAK,GAAG,KAAK,EACjB,GAAkB,EAClB,MAAoB,EACS,EAAE;QAC/B,MAAM,aAAa,CAAC,MAAM,CAAC,CAAA;QAC3B,kBAAkB,CAAC,GAAG,CAAC,CAAA;QACvB,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QAC7D,UAAU,CAAC,MAAM,CAAC,CAAA;QAClB,MAAM,SAAS,GAAG,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;QACpD,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAA;QACnD,OAAO,SAAS,CAAA;IAClB,CAAC,CAAA;IAED,MAAM,WAAW,GAAG,CAAC,SAA6B,EAAmB,EAAE;QACrE,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QACnC,IAAI,CAAC,KAAK;YACR,MAAM,IAAI,2BAA2B,CACnC,YAAY,EACZ,oDAAoD,CACrD,CAAA;QACH,OAAO,KAAK,CAAA;IACd,CAAC,CAAA;IAED,MAAM,kBAAkB,GAAG,KAAK,EAC9B,SAA6B,EAC7B,MAAc,EACd,cAAoC,EAClB,EAAE;QACpB,MAAM,KAAK,GAAG,WAAW,CAAC,SAAS,CAAC,CAAA;QACpC,IAAI,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAA;QAClD,UAAU,EAAE,CAAA;QACZ,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAA;QACrB,MAAM,QAAQ,CAAC,aAAa,CAC1B,KAAK,CAAC,OAAO,EACb,GAAG,EACH,cAAc,IAAI,OAAO,CAAC,cAAc,CACzC,CAAA;QACD,OAAO,IAAI,CAAA;IACb,CAAC,CAAA;IAED;;;;OAIG;IACH,MAAM,iBAAiB,GAAG,KAAK,EAAE,WAAkC,EAAE,EAAE;QACrE,MAAM,aAAa,EAAE,CAAA;QACrB,0EAA0E;QAC1E,wEAAwE;QACxE,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE;YACtB,MAAM,IAAI,2BAA2B,CACnC,mBAAmB,EACnB,yDAAyD,CAC1D,CAAA;QACH,MAAM,GAAG,GAAkB;YACzB,OAAO,EAAE,WAAW,CAAC,OAAO;YAC5B,YAAY,EAAE,WAAW,CAAC,YAAY;YACtC,eAAe,EAAE,WAAW,CAAC,eAAe;YAC5C,KAAK,EAAE,EAAE;SACV,CAAA;QACD,MAAM,KAAK,GAAG,oBAAoB,CAChC,GAAG,EACH,MAAM,QAAQ,CAAC,SAAS,CAAC,WAAW,CAAC,OAAO,CAAC,CAC9C,CAAA;QACD,IAAI,KAAK,CAAC,aAAa,KAAK,WAAW,CAAC,aAAa;YACnD,MAAM,IAAI,2BAA2B,CACnC,mBAAmB,EACnB,8DAA8D,CAC/D,CAAA;IACL,CAAC,CAAA;IAED,OAAO;QACL,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,KAAK,EAAE,GAAG,EAAE;YACV,UAAU,EAAE,CAAA;YACZ,QAAQ,CAAC,KAAK,EAAE,CAAA;QAClB,CAAC;QACD,OAAO,EAAE,KAAK,IAAI,EAAE;YAClB,UAAU,EAAE,CAAA;YACZ,OAAO,QAAQ,CAAC,OAAO,EAAE,CAAA;QAC3B,CAAC;QACD,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,UAAU,CAAC,CAAC;QACxE,KAAK;QACL,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE;YACzC,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAA;YACjC,IAAI,SAAS,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;YACxC,IAAI,QAAQ,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;YAChD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;gBAChD,IAAI,OAAuC,CAAA;gBAC3C,IAAI,CAAC;oBACH,OAAO,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;gBACpC,CAAC;gBAAC,MAAM,CAAC;oBACP,iEAAiE;oBACjE,qDAAqD;gBACvD,CAAC;gBACD,MAAM,aAAa,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC,OAAO,CAAA;gBACpD,MAAM,cAAc,GAAG,OAAO,IAAI,WAAW,CAAC,OAAO,CAAC,CAAC,OAAO,CAAA;gBAC9D,IACE,OAAO;oBACP,SAAS,CAAC,yBAAyB,CACjC,WAAW,CAAC,IAAI,EAChB,aAAa,EACb,cAAc,EACd,OAAO,CAAC,MAAM,CACf,EACD,CAAC;oBACD,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;oBAC7C,SAAS,GAAG,OAAO,CAAA;oBACnB,QAAQ,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;gBAC5C,CAAC;YACH,CAAC;YACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;gBACzB,MAAM,kBAAkB,CACtB,SAAS,EACT,GAAG,EACH,WAAW,CAAC,cAAc,CAC3B,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,CAAA;YACvD,OAAO,QAAQ,CAAA;QACjB,CAAC;QACD,kBAAkB;QAClB,WAAW,EAAE,CAAC,SAAS,EAAE,EAAE;YACzB,WAAW,CAAC,SAAS,CAAC,CAAA;YACtB,OAAO,MAAM,CAAC,MAAM,CAAC;gBACnB,OAAO,EAAE,SAAS,CAAC,OAAO;gBAC1B,YAAY,EAAE,SAAS,CAAC,YAAY;gBACpC,eAAe,EAAE,SAAS,CAAC,eAAe;gBAC1C,aAAa,EAAE,SAAS,CAAC,aAAa;aACvC,CAAC,CAAA;QACJ,CAAC;QACD,WAAW,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE;YACzC,UAAU,EAAE,CAAA;YACZ,IAAI,CAAC,OAAO,CAAC,KAAK;gBAChB,MAAM,IAAI,2BAA2B,CACnC,mBAAmB,EACnB,+DAA+D,CAChE,CAAA;YACH,OAAO,wBAAwB,CAAC;gBAC9B,SAAS;gBACT,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE;gBACpB,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI;gBAC7B,WAAW;gBACX,MAAM,EAAE,iBAAiB;gBACzB,MAAM;aACP,CAAC,CAAA;QACJ,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YACrB,UAAU,EAAE,CAAA;YACZ,MAAM,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACrC,CAAC;QACD,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YACpB,UAAU,EAAE,CAAA;YACZ,MAAM,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACpC,CAAC;QACD,KAAK,EAAE,GAAG,EAAE;YACV,IAAI,MAAM;gBAAE,OAAM;YAClB,MAAM,GAAG,IAAI,CAAA;YACb,QAAQ,CAAC,KAAK,EAAE,CAAA;QAClB,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/vault-enrollment-authority.d.ts

@@ -0,0 +1,16 @@
+import { type CommonAuthClaustrumModule } from './common-auth-runtime.ts';
+export type EnrollmentAuthority = 'vault' | 'local' | 'unreadable';
+type EnrollmentPaths = Parameters<CommonAuthClaustrumModule['readClaustrumEnrollmentStatus']>[0];
+type EnrollmentReader = Pick<CommonAuthClaustrumModule, 'enrollmentAuthority'>;
+export declare const VAULT_ACCOUNT_REMEDY = "Vault account access is unavailable. Connect accounts in the vault, or disconnect the vault to use local accounts.";
+/**
+ * The operator's approval to access the vault selects its accounts instead of local OAuth accounts,
+ * regardless of a saved local-mode preference.
+ * An approved record whose token disappeared still excludes local accounts.
+ * Failed reads never authorize local work. Call at the start of each unit of
+ * work; a refresh that already started must finish saving the replacement
+ * OAuth credentials.
+ */
+export declare function enrollmentAuthority(paths: EnrollmentPaths, proposedName: string, reader?: EnrollmentReader): Promise<EnrollmentAuthority>;
+export {};
+//# sourceMappingURL=vault-enrollment-authority.d.ts.map

package/dist/vault-enrollment-authority.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault-enrollment-authority.d.ts","sourceRoot":"","sources":["../src/vault-enrollment-authority.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,yBAAyB,EAE/B,MAAM,0BAA0B,CAAA;AAEjC,MAAM,MAAM,mBAAmB,GAAG,OAAO,GAAG,OAAO,GAAG,YAAY,CAAA;AAClE,KAAK,eAAe,GAAG,UAAU,CAC/B,yBAAyB,CAAC,+BAA+B,CAAC,CAC3D,CAAC,CAAC,CAAC,CAAA;AACJ,KAAK,gBAAgB,GAAG,IAAI,CAAC,yBAAyB,EAAE,qBAAqB,CAAC,CAAA;AAE9E,eAAO,MAAM,oBAAoB,uHACqF,CAAA;AAEtH;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,eAAe,EACtB,YAAY,EAAE,MAAM,EACpB,MAAM,CAAC,EAAE,gBAAgB,GACxB,OAAO,CAAC,mBAAmB,CAAC,CAQ9B"}

package/dist/vault-enrollment-authority.js

@@ -0,0 +1,19 @@
+import { loadCommonAuthClaustrum, } from "./common-auth-runtime.js";
+export const VAULT_ACCOUNT_REMEDY = 'Vault account access is unavailable. Connect accounts in the vault, or disconnect the vault to use local accounts.';
+/**
+ * The operator's approval to access the vault selects its accounts instead of local OAuth accounts,
+ * regardless of a saved local-mode preference.
+ * An approved record whose token disappeared still excludes local accounts.
+ * Failed reads never authorize local work. Call at the start of each unit of
+ * work; a refresh that already started must finish saving the replacement
+ * OAuth credentials.
+ */
+export async function enrollmentAuthority(paths, proposedName, reader) {
+    try {
+        return await (reader ?? (await loadCommonAuthClaustrum())).enrollmentAuthority(paths, proposedName);
+    }
+    catch {
+        return 'unreadable';
+    }
+}
+//# sourceMappingURL=vault-enrollment-authority.js.map

package/dist/vault-enrollment-authority.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault-enrollment-authority.js","sourceRoot":"","sources":["../src/vault-enrollment-authority.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,uBAAuB,GACxB,MAAM,0BAA0B,CAAA;AAQjC,MAAM,CAAC,MAAM,oBAAoB,GAC/B,oHAAoH,CAAA;AAEtH;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,KAAsB,EACtB,YAAoB,EACpB,MAAyB;IAEzB,IAAI,CAAC;QACH,OAAO,MAAM,CACX,MAAM,IAAI,CAAC,MAAM,uBAAuB,EAAE,CAAC,CAC5C,CAAC,mBAAmB,CAAC,KAAK,EAAE,YAAY,CAAC,CAAA;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,YAAY,CAAA;IACrB,CAAC;AACH,CAAC"}

package/dist/vault-family.d.ts

@@ -0,0 +1,11 @@
+export type AntigravityVaultHost = 'opencode' | 'pi';
+export declare const ANTIGRAVITY_VAULT_FAMILY: Readonly<{
+    readonly refreshAdapter: "antigravity";
+    readonly category: "antigravity-native";
+    readonly apiKeys: false;
+}>;
+export declare const ANTIGRAVITY_VAULT_REQUIRE_ASSERTION: true;
+export type AntigravityVaultEnrollmentName = `antigravity-auth-${AntigravityVaultHost}`;
+export declare const ANTIGRAVITY_VAULT_ENROLLMENT_NAMES: Readonly<Record<AntigravityVaultHost, AntigravityVaultEnrollmentName>>;
+export declare function getAntigravityVaultEnrollmentName(host: AntigravityVaultHost): AntigravityVaultEnrollmentName;
+//# sourceMappingURL=vault-family.d.ts.map

package/dist/vault-family.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault-family.d.ts","sourceRoot":"","sources":["../src/vault-family.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,oBAAoB,GAAG,UAAU,GAAG,IAAI,CAAA;AAEpD,eAAO,MAAM,wBAAwB;;;;EAI1B,CAAA;AAEX,eAAO,MAAM,mCAAmC,EAAG,IAAa,CAAA;AAEhE,MAAM,MAAM,8BAA8B,GACxC,oBAAoB,oBAAoB,EAAE,CAAA;AAE5C,eAAO,MAAM,kCAAkC,EAAE,QAAQ,CACvD,MAAM,CAAC,oBAAoB,EAAE,8BAA8B,CAAC,CAI5D,CAAA;AAMF,wBAAgB,iCAAiC,CAC/C,IAAI,EAAE,oBAAoB,GACzB,8BAA8B,CAShC"}

package/dist/vault-family.js

@@ -0,0 +1,24 @@
+export const ANTIGRAVITY_VAULT_FAMILY = Object.freeze({
+    refreshAdapter: 'antigravity',
+    category: 'antigravity-native',
+    apiKeys: false,
+});
+export const ANTIGRAVITY_VAULT_REQUIRE_ASSERTION = true;
+export const ANTIGRAVITY_VAULT_ENROLLMENT_NAMES = Object.freeze({
+    opencode: 'antigravity-auth-opencode',
+    pi: 'antigravity-auth-pi',
+});
+function assertNeverHost(host) {
+    throw new TypeError(`Unsupported Antigravity vault host: ${String(host)}`);
+}
+export function getAntigravityVaultEnrollmentName(host) {
+    switch (host) {
+        case 'opencode':
+            return ANTIGRAVITY_VAULT_ENROLLMENT_NAMES.opencode;
+        case 'pi':
+            return ANTIGRAVITY_VAULT_ENROLLMENT_NAMES.pi;
+        default:
+            return assertNeverHost(host);
+    }
+}
+//# sourceMappingURL=vault-family.js.map

package/dist/vault-family.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault-family.js","sourceRoot":"","sources":["../src/vault-family.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAC,MAAM,CAAC;IACpD,cAAc,EAAE,aAAa;IAC7B,QAAQ,EAAE,oBAAoB;IAC9B,OAAO,EAAE,KAAK;CACN,CAAC,CAAA;AAEX,MAAM,CAAC,MAAM,mCAAmC,GAAG,IAAa,CAAA;AAKhE,MAAM,CAAC,MAAM,kCAAkC,GAE3C,MAAM,CAAC,MAAM,CAAC;IAChB,QAAQ,EAAE,2BAA2B;IACrC,EAAE,EAAE,qBAAqB;CAC1B,CAAC,CAAA;AAEF,SAAS,eAAe,CAAC,IAAW;IAClC,MAAM,IAAI,SAAS,CAAC,uCAAuC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;AAC5E,CAAC;AAED,MAAM,UAAU,iCAAiC,CAC/C,IAA0B;IAE1B,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,UAAU;YACb,OAAO,kCAAkC,CAAC,QAAQ,CAAA;QACpD,KAAK,IAAI;YACP,OAAO,kCAAkC,CAAC,EAAE,CAAA;QAC9C;YACE,OAAO,eAAe,CAAC,IAAI,CAAC,CAAA;IAChC,CAAC;AACH,CAAC"}