@cortexkit/antigravity-auth-core 2.2.1 → 3.0.1

package/dist/vault-account-source.js

@@ -0,0 +1,296 @@
+/**
+ * Antigravity accounts served from a Claustrum vault ("custody mode").
+ *
+ * Terms used below:
+ * - roster: the non-secret list of vault accounts this host may route to
+ *   (route id, credential id, account identity, enabled/declined state).
+ * - receipt: what Claustrum serves for one send attempt: a fresh bearer, the
+ *   Antigravity project for the model request, the account identity the vault
+ *   asserted, and the record version it served for the credential.
+ * - host auth slot: the host's own Google credential record. Pi temporarily
+ *   replaces it with a non-secret marker and retains a backup; OpenCode may
+ *   keep its existing login. Neither is read by this vault account source.
+ *
+ * The host passes in the library's public `./claustrum` module; every library
+ * type here is taken from that module's own declarations.
+ *
+ * Rules:
+ * - Each send attempt to Google (each endpoint fallback, each 401 retry,
+ *   quota and profile reads) gets a new admission with a fresh receipt, and
+ *   takes its bearer and project from that receipt only. Nothing is cached or
+ *   refreshed locally.
+ * - Google bearers are opaque: a receipt is accepted only when the vault
+ *   asserted the credential and the account the selected route names. No
+ *   token is parsed for an identity, and API-key credentials are refused.
+ * - Nothing is served unless custody is active. The host's local credentials
+ *   stay dormant: this source never reads or refreshes them.
+ */
+import { ANTIGRAVITY_VAULT_FAMILY, ANTIGRAVITY_VAULT_REQUIRE_ASSERTION, } from "./vault-family.js";
+import { commitVaultProviderState, } from "./vault-provider-state.js";
+/**
+ * A refusal by this source before any request reaches Google. Refusals made
+ * by the Claustrum library itself arrive as the library's own errors.
+ */
+export class AntigravityVaultSourceError extends Error {
+    kind;
+    constructor(kind, message) {
+        super(message);
+        this.name = 'AntigravityVaultSourceError';
+        this.kind = kind;
+    }
+}
+/**
+ * Path of the Claustrum connection file to pass as the client's
+ * `connectionFile`, resolved by `@cortexkit/claustrum-client`'s own
+ * `resolveClaustrumConnectionPath`: `explicit` when given, else the
+ * `SUBC_CONNECTION_FILE` or `CLAUSTRUM_SUBC_CONNECTION` environment variable,
+ * else the client's default path. The client package is imported only when
+ * this is called, so importing core never loads it, and its errors pass
+ * through unchanged. Resolving the path opens no connection and reads no
+ * enrollment or host credential.
+ */
+export async function resolveClaustrumConnectionPath(explicit) {
+    const client = await import('@cortexkit/claustrum-client');
+    return client.resolveClaustrumConnectionPath(explicit);
+}
+function isNonEmpty(value) {
+    return typeof value === 'string' && value.trim().length > 0;
+}
+/** Rows whose route, credential and account are all known and serviceable. */
+function routeRefs(roster, isDeclined) {
+    if (!roster)
+        return [];
+    const refs = [];
+    for (const row of roster.rows) {
+        if (!isServiceableRow(row, roster, isDeclined))
+            continue;
+        refs.push(Object.freeze({
+            routeId: row.routeId,
+            credentialId: row.credentialId,
+            accountIdentity: row.accountIdentity,
+            label: row.label,
+            ...(row.email !== undefined && { email: row.email }),
+        }));
+    }
+    return refs;
+}
+function isServiceableRow(row, roster, isDeclined) {
+    return (row.enabled &&
+        row.state === 'active' &&
+        row.credentialType === 'oauth' &&
+        row.stale !== true &&
+        row.unclaimed !== true &&
+        isNonEmpty(row.accountIdentity) &&
+        !isDeclined(roster.declined, row.credentialId, row.accountIdentity));
+}
+/**
+ * Check a receipt against the selected route and turn it into an admission.
+ * Throws before anything is sent when the receipt does not prove the route's
+ * credential and account, or carries no project.
+ */
+function admissionFromReceipt(ref, receipt) {
+    if (receipt.credentialType !== 'oauth')
+        throw new AntigravityVaultSourceError('api-key-refused', 'Antigravity vault routes serve OAuth credentials only');
+    if (receipt.accountIdentitySource !== 'asserted' ||
+        receipt.assertedCredentialId === undefined ||
+        receipt.assertedAccountIdentity === undefined)
+        throw new AntigravityVaultSourceError('identity-unasserted', 'The vault did not assert the credential and account for this send');
+    if (receipt.credentialId !== ref.credentialId ||
+        receipt.assertedCredentialId !== ref.credentialId ||
+        receipt.assertedAccountIdentity !== ref.accountIdentity ||
+        receipt.accountIdentity !== ref.accountIdentity ||
+        receipt.expectedAccountIdentity !== ref.accountIdentity)
+        throw new AntigravityVaultSourceError('identity-contradicted', 'The vault served a different credential or account than the selected route');
+    if (!isNonEmpty(receipt.projectId) || /\s/.test(receipt.projectId))
+        throw new AntigravityVaultSourceError('project-missing', 'The vault served no Antigravity project for this send');
+    if (!isNonEmpty(receipt.accessToken) ||
+        !Number.isSafeInteger(receipt.recordVersion) ||
+        receipt.recordVersion < 0)
+        throw new AntigravityVaultSourceError('invalid-receipt', 'The vault receipt carries no usable token or record version');
+    const admission = {
+        routeId: ref.routeId,
+        credentialId: receipt.credentialId,
+        accountIdentity: receipt.assertedAccountIdentity,
+        recordVersion: receipt.recordVersion,
+        projectId: receipt.projectId,
+        expiresAtMs: receipt.expiresAtMs,
+    };
+    Object.defineProperty(admission, 'accessToken', {
+        value: receipt.accessToken,
+        enumerable: false,
+    });
+    return Object.freeze(admission);
+}
+export function createAntigravityVaultAccountSource(options) {
+    const { claustrum } = options;
+    const consumer = new claustrum.ClaustrumConsumer({
+        rosterPath: options.rosterPath,
+        tokenPath: options.tokenPath,
+        family: { ...ANTIGRAVITY_VAULT_FAMILY },
+        connect: options.connect,
+        isCustodyActive: options.isCustodyActive,
+        requireAssertion: ANTIGRAVITY_VAULT_REQUIRE_ASSERTION,
+        ...(options.reservedRouteIds && {
+            reservedRouteIds: options.reservedRouteIds,
+        }),
+        ...(options.routePrefix !== undefined && {
+            routePrefix: options.routePrefix,
+        }),
+        ...(options.onRoster && { onRoster: options.onRoster }),
+        ...(options.onError && { onError: options.onError }),
+        ...(options.pollIntervalMs !== undefined && {
+            pollIntervalMs: options.pollIntervalMs,
+        }),
+        ...(options.now && { now: options.now }),
+        ...(options.logger && { logger: options.logger }),
+    });
+    const issued = new WeakMap();
+    const isDeclined = claustrum.isDeclined.bind(claustrum);
+    let closed = false;
+    const assertOpen = (signal) => {
+        if (closed)
+            throw new AntigravityVaultSourceError('closed', 'Antigravity vault source is closed');
+        signal?.throwIfAborted();
+    };
+    /** Require approved vault access before obtaining credentials for an operation. */
+    const assertServing = async (signal) => {
+        assertOpen(signal);
+        if (!(await options.isCustodyActive()))
+            throw new AntigravityVaultSourceError('not-active', 'Antigravity vault custody is not active for this host');
+        assertOpen(signal);
+    };
+    /** The ref must still name a serviceable row of the last committed roster. */
+    const assertCurrentRoute = (ref) => {
+        const roster = consumer.snapshot();
+        const row = roster?.rows.find((entry) => entry.routeId === ref.routeId);
+        if (!roster ||
+            !row ||
+            row.credentialId !== ref.credentialId ||
+            row.accountIdentity !== ref.accountIdentity ||
+            !isServiceableRow(row, roster, isDeclined))
+            throw new AntigravityVaultSourceError('route-unavailable', 'The selected vault route is declined, removed or changed');
+    };
+    const admit = async (ref, signal) => {
+        await assertServing(signal);
+        assertCurrentRoute(ref);
+        const receipt = await consumer.authorize(ref.routeId, signal);
+        assertOpen(signal);
+        const admission = admissionFromReceipt(ref, receipt);
+        issued.set(admission, { receipt, reported: false });
+        return admission;
+    };
+    const issuedEntry = (admission) => {
+        const entry = issued.get(admission);
+        if (!entry)
+            throw new AntigravityVaultSourceError('not-issued', 'This admission was not issued by this vault source');
+        return entry;
+    };
+    const reportServedStatus = async (admission, status, reporterSource) => {
+        const entry = issuedEntry(admission);
+        if (status !== 401 || entry.reported)
+            return false;
+        assertOpen();
+        entry.reported = true;
+        await consumer.reportFailure(entry.receipt, 401, reporterSource ?? options.reporterSource);
+        return true;
+    };
+    /**
+     * Fresh proof that the attributed credential, account and record version
+     * are still what the vault serves. The proving receipt's token and project
+     * are dropped here; they never reach a send.
+     */
+    const verifyAttribution = async (attribution) => {
+        await assertServing();
+        // Authorizing without a committed roster would make the consumer discover
+        // and commit one, which takes the roster lock the caller already holds.
+        if (!consumer.snapshot())
+            throw new AntigravityVaultSourceError('state-unavailable', 'No committed vault roster to verify the account against');
+        const ref = {
+            routeId: attribution.routeId,
+            credentialId: attribution.credentialId,
+            accountIdentity: attribution.accountIdentity,
+            label: '',
+        };
+        const proof = admissionFromReceipt(ref, await consumer.authorize(attribution.routeId));
+        if (proof.recordVersion !== attribution.recordVersion)
+            throw new AntigravityVaultSourceError('state-unavailable', 'The vault now serves another record version for this account');
+    };
+    return {
+        host: options.host,
+        start: () => {
+            assertOpen();
+            consumer.start();
+        },
+        refresh: async () => {
+            assertOpen();
+            return consumer.refresh();
+        },
+        routes: () => (closed ? [] : routeRefs(consumer.snapshot(), isDeclined)),
+        admit,
+        send: async (ref, dispatch, sendOptions) => {
+            const signal = sendOptions.signal;
+            let admission = await admit(ref, signal);
+            let response = await dispatch(admission, signal);
+            if (response.status === 401 && !signal?.aborted) {
+                let current;
+                try {
+                    current = await admit(ref, signal);
+                }
+                catch {
+                    // No retry: the original 401 response is kept and reported below
+                    // with the receipt of the dispatch that received it.
+                }
+                const servedReceipt = issuedEntry(admission).receipt;
+                const currentReceipt = current && issuedEntry(current).receipt;
+                if (current &&
+                    claustrum.decideScopedRetryAfter401(sendOptions.site, servedReceipt, currentReceipt, options.logger)) {
+                    await response.body?.cancel().catch(() => { });
+                    admission = current;
+                    response = await dispatch(current, signal);
+                }
+            }
+            if (response.status === 401)
+                await reportServedStatus(admission, 401, sendOptions.reporterSource).catch((error) => options.onError?.(error));
+            return response;
+        },
+        reportServedStatus,
+        attribution: (admission) => {
+            issuedEntry(admission);
+            return Object.freeze({
+                routeId: admission.routeId,
+                credentialId: admission.credentialId,
+                accountIdentity: admission.accountIdentity,
+                recordVersion: admission.recordVersion,
+            });
+        },
+        commitState: async (attribution, update) => {
+            assertOpen();
+            if (!options.state)
+                throw new AntigravityVaultSourceError('state-unavailable', 'No provider-state sidecar is configured for this vault source');
+            return commitVaultProviderState({
+                claustrum,
+                fs: options.state.fs,
+                rosterPath: options.rosterPath,
+                statePath: options.state.path,
+                attribution,
+                verify: verifyAttribution,
+                update,
+            });
+        },
+        decline: async (ref) => {
+            assertOpen();
+            await consumer.decline(ref.routeId);
+        },
+        accept: async (ref) => {
+            assertOpen();
+            await consumer.accept(ref.routeId);
+        },
+        close: () => {
+            if (closed)
+                return;
+            closed = true;
+            consumer.close();
+        },
+    };
+}
+//# sourceMappingURL=vault-account-source.js.map

package/dist/vault-account-source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault-account-source.js","sourceRoot":"","sources":["../src/vault-account-source.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAGH,OAAO,EACL,wBAAwB,EACxB,mCAAmC,GAEpC,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAGL,wBAAwB,GAGzB,MAAM,2BAA2B,CAAA;AAqElC;;;GAGG;AACH,MAAM,OAAO,2BAA4B,SAAQ,KAAK;IAC3C,IAAI,CAAmC;IAEhD,YAAY,IAAuC,EAAE,OAAe;QAClE,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAA;QACzC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;IAClB,CAAC;CACF;AAkID;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,QAAiB;IAEjB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAA;IAC1D,OAAO,MAAM,CAAC,8BAA8B,CAAC,QAAQ,CAAC,CAAA;AACxD,CAAC;AAWD,SAAS,UAAU,CAAC,KAAc;IAChC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAA;AAC7D,CAAC;AAED,8EAA8E;AAC9E,SAAS,SAAS,CAChB,MAA+B,EAC/B,UAA4C;IAE5C,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAA;IACtB,MAAM,IAAI,GAAoB,EAAE,CAAA;IAChC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,CAAC;YAAE,SAAQ;QACxD,IAAI,CAAC,IAAI,CACP,MAAM,CAAC,MAAM,CAAC;YACZ,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,YAAY,EAAE,GAAG,CAAC,YAAY;YAC9B,eAAe,EAAE,GAAG,CAAC,eAAyB;YAC9C,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,GAAG,CAAC,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC;SACrD,CAAC,CACH,CAAA;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,gBAAgB,CACvB,GAAmB,EACnB,MAAmB,EACnB,UAA4C;IAE5C,OAAO,CACL,GAAG,CAAC,OAAO;QACX,GAAG,CAAC,KAAK,KAAK,QAAQ;QACtB,GAAG,CAAC,cAAc,KAAK,OAAO;QAC9B,GAAG,CAAC,KAAK,KAAK,IAAI;QAClB,GAAG,CAAC,SAAS,KAAK,IAAI;QACtB,UAAU,CAAC,GAAG,CAAC,eAAe,CAAC;QAC/B,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,eAAe,CAAC,CACpE,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,oBAAoB,CAC3B,GAAkB,EAClB,OAA2B;IAE3B,IAAI,OAAO,CAAC,cAAc,KAAK,OAAO;QACpC,MAAM,IAAI,2BAA2B,CACnC,iBAAiB,EACjB,uDAAuD,CACxD,CAAA;IACH,IACE,OAAO,CAAC,qBAAqB,KAAK,UAAU;QAC5C,OAAO,CAAC,oBAAoB,KAAK,SAAS;QAC1C,OAAO,CAAC,uBAAuB,KAAK,SAAS;QAE7C,MAAM,IAAI,2BAA2B,CACnC,qBAAqB,EACrB,mEAAmE,CACpE,CAAA;IACH,IACE,OAAO,CAAC,YAAY,KAAK,GAAG,CAAC,YAAY;QACzC,OAAO,CAAC,oBAAoB,KAAK,GAAG,CAAC,YAAY;QACjD,OAAO,CAAC,uBAAuB,KAAK,GAAG,CAAC,eAAe;QACvD,OAAO,CAAC,eAAe,KAAK,GAAG,CAAC,eAAe;QAC/C,OAAO,CAAC,uBAAuB,KAAK,GAAG,CAAC,eAAe;QAEvD,MAAM,IAAI,2BAA2B,CACnC,uBAAuB,EACvB,4EAA4E,CAC7E,CAAA;IACH,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;QAChE,MAAM,IAAI,2BAA2B,CACnC,iBAAiB,EACjB,uDAAuD,CACxD,CAAA;IACH,IACE,CAAC,UAAU,CAAC,OAAO,CAAC,WAAW,CAAC;QAChC,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,aAAa,CAAC;QAC5C,OAAO,CAAC,aAAa,GAAG,CAAC;QAEzB,MAAM,IAAI,2BAA2B,CACnC,iBAAiB,EACjB,6DAA6D,CAC9D,CAAA;IACH,MAAM,SAAS,GAAG;QAChB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,eAAe,EAAE,OAAO,CAAC,uBAAuB;QAChD,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,WAAW,EAAE,OAAO,CAAC,WAAW;KACjC,CAAA;IACD,MAAM,CAAC,cAAc,CAAC,SAAS,EAAE,aAAa,EAAE;QAC9C,KAAK,EAAE,OAAO,CAAC,WAAW;QAC1B,UAAU,EAAE,KAAK;KAClB,CAAC,CAAA;IACF,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAAuB,CAAA;AACvD,CAAC;AAED,MAAM,UAAU,mCAAmC,CACjD,OAAsC;IAEtC,MAAM,EAAE,SAAS,EAAE,GAAG,OAAO,CAAA;IAC7B,MAAM,QAAQ,GAAG,IAAI,SAAS,CAAC,iBAAiB,CAAC;QAC/C,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,MAAM,EAAE,EAAE,GAAG,wBAAwB,EAAE;QACvC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,gBAAgB,EAAE,mCAAmC;QACrD,GAAG,CAAC,OAAO,CAAC,gBAAgB,IAAI;YAC9B,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;SAC3C,CAAC;QACF,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,IAAI;YACvC,WAAW,EAAE,OAAO,CAAC,WAAW;SACjC,CAAC;QACF,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;QACvD,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;QACpD,GAAG,CAAC,OAAO,CAAC,cAAc,KAAK,SAAS,IAAI;YAC1C,cAAc,EAAE,OAAO,CAAC,cAAc;SACvC,CAAC;QACF,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;QACxC,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;KAClD,CAAC,CAAA;IACF,MAAM,MAAM,GAAG,IAAI,OAAO,EAAuC,CAAA;IACjE,MAAM,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IACvD,IAAI,MAAM,GAAG,KAAK,CAAA;IAElB,MAAM,UAAU,GAAG,CAAC,MAAoB,EAAE,EAAE;QAC1C,IAAI,MAAM;YACR,MAAM,IAAI,2BAA2B,CACnC,QAAQ,EACR,oCAAoC,CACrC,CAAA;QACH,MAAM,EAAE,cAAc,EAAE,CAAA;IAC1B,CAAC,CAAA;IAED,mFAAmF;IACnF,MAAM,aAAa,GAAG,KAAK,EAAE,MAAoB,EAAE,EAAE;QACnD,UAAU,CAAC,MAAM,CAAC,CAAA;QAClB,IAAI,CAAC,CAAC,MAAM,OAAO,CAAC,eAAe,EAAE,CAAC;YACpC,MAAM,IAAI,2BAA2B,CACnC,YAAY,EACZ,uDAAuD,CACxD,CAAA;QACH,UAAU,CAAC,MAAM,CAAC,CAAA;IACpB,CAAC,CAAA;IAED,8EAA8E;IAC9E,MAAM,kBAAkB,GAAG,CAAC,GAAkB,EAAE,EAAE;QAChD,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAA;QAClC,MAAM,GAAG,GAAG,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,GAAG,CAAC,OAAO,CAAC,CAAA;QACvE,IACE,CAAC,MAAM;YACP,CAAC,GAAG;YACJ,GAAG,CAAC,YAAY,KAAK,GAAG,CAAC,YAAY;YACrC,GAAG,CAAC,eAAe,KAAK,GAAG,CAAC,eAAe;YAC3C,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,CAAC;YAE1C,MAAM,IAAI,2BAA2B,CACnC,mBAAmB,EACnB,0DAA0D,CAC3D,CAAA;IACL,CAAC,CAAA;IAED,MAAM,KAAK,GAAG,KAAK,EACjB,GAAkB,EAClB,MAAoB,EACS,EAAE;QAC/B,MAAM,aAAa,CAAC,MAAM,CAAC,CAAA;QAC3B,kBAAkB,CAAC,GAAG,CAAC,CAAA;QACvB,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QAC7D,UAAU,CAAC,MAAM,CAAC,CAAA;QAClB,MAAM,SAAS,GAAG,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;QACpD,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAA;QACnD,OAAO,SAAS,CAAA;IAClB,CAAC,CAAA;IAED,MAAM,WAAW,GAAG,CAAC,SAA6B,EAAmB,EAAE;QACrE,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QACnC,IAAI,CAAC,KAAK;YACR,MAAM,IAAI,2BAA2B,CACnC,YAAY,EACZ,oDAAoD,CACrD,CAAA;QACH,OAAO,KAAK,CAAA;IACd,CAAC,CAAA;IAED,MAAM,kBAAkB,GAAG,KAAK,EAC9B,SAA6B,EAC7B,MAAc,EACd,cAAoC,EAClB,EAAE;QACpB,MAAM,KAAK,GAAG,WAAW,CAAC,SAAS,CAAC,CAAA;QACpC,IAAI,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAA;QAClD,UAAU,EAAE,CAAA;QACZ,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAA;QACrB,MAAM,QAAQ,CAAC,aAAa,CAC1B,KAAK,CAAC,OAAO,EACb,GAAG,EACH,cAAc,IAAI,OAAO,CAAC,cAAc,CACzC,CAAA;QACD,OAAO,IAAI,CAAA;IACb,CAAC,CAAA;IAED;;;;OAIG;IACH,MAAM,iBAAiB,GAAG,KAAK,EAAE,WAAkC,EAAE,EAAE;QACrE,MAAM,aAAa,EAAE,CAAA;QACrB,0EAA0E;QAC1E,wEAAwE;QACxE,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE;YACtB,MAAM,IAAI,2BAA2B,CACnC,mBAAmB,EACnB,yDAAyD,CAC1D,CAAA;QACH,MAAM,GAAG,GAAkB;YACzB,OAAO,EAAE,WAAW,CAAC,OAAO;YAC5B,YAAY,EAAE,WAAW,CAAC,YAAY;YACtC,eAAe,EAAE,WAAW,CAAC,eAAe;YAC5C,KAAK,EAAE,EAAE;SACV,CAAA;QACD,MAAM,KAAK,GAAG,oBAAoB,CAChC,GAAG,EACH,MAAM,QAAQ,CAAC,SAAS,CAAC,WAAW,CAAC,OAAO,CAAC,CAC9C,CAAA;QACD,IAAI,KAAK,CAAC,aAAa,KAAK,WAAW,CAAC,aAAa;YACnD,MAAM,IAAI,2BAA2B,CACnC,mBAAmB,EACnB,8DAA8D,CAC/D,CAAA;IACL,CAAC,CAAA;IAED,OAAO;QACL,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,KAAK,EAAE,GAAG,EAAE;YACV,UAAU,EAAE,CAAA;YACZ,QAAQ,CAAC,KAAK,EAAE,CAAA;QAClB,CAAC;QACD,OAAO,EAAE,KAAK,IAAI,EAAE;YAClB,UAAU,EAAE,CAAA;YACZ,OAAO,QAAQ,CAAC,OAAO,EAAE,CAAA;QAC3B,CAAC;QACD,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,UAAU,CAAC,CAAC;QACxE,KAAK;QACL,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE;YACzC,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAA;YACjC,IAAI,SAAS,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;YACxC,IAAI,QAAQ,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;YAChD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;gBAChD,IAAI,OAAuC,CAAA;gBAC3C,IAAI,CAAC;oBACH,OAAO,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;gBACpC,CAAC;gBAAC,MAAM,CAAC;oBACP,iEAAiE;oBACjE,qDAAqD;gBACvD,CAAC;gBACD,MAAM,aAAa,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC,OAAO,CAAA;gBACpD,MAAM,cAAc,GAAG,OAAO,IAAI,WAAW,CAAC,OAAO,CAAC,CAAC,OAAO,CAAA;gBAC9D,IACE,OAAO;oBACP,SAAS,CAAC,yBAAyB,CACjC,WAAW,CAAC,IAAI,EAChB,aAAa,EACb,cAAc,EACd,OAAO,CAAC,MAAM,CACf,EACD,CAAC;oBACD,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;oBAC7C,SAAS,GAAG,OAAO,CAAA;oBACnB,QAAQ,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;gBAC5C,CAAC;YACH,CAAC;YACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;gBACzB,MAAM,kBAAkB,CACtB,SAAS,EACT,GAAG,EACH,WAAW,CAAC,cAAc,CAC3B,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,CAAA;YACvD,OAAO,QAAQ,CAAA;QACjB,CAAC;QACD,kBAAkB;QAClB,WAAW,EAAE,CAAC,SAAS,EAAE,EAAE;YACzB,WAAW,CAAC,SAAS,CAAC,CAAA;YACtB,OAAO,MAAM,CAAC,MAAM,CAAC;gBACnB,OAAO,EAAE,SAAS,CAAC,OAAO;gBAC1B,YAAY,EAAE,SAAS,CAAC,YAAY;gBACpC,eAAe,EAAE,SAAS,CAAC,eAAe;gBAC1C,aAAa,EAAE,SAAS,CAAC,aAAa;aACvC,CAAC,CAAA;QACJ,CAAC;QACD,WAAW,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE;YACzC,UAAU,EAAE,CAAA;YACZ,IAAI,CAAC,OAAO,CAAC,KAAK;gBAChB,MAAM,IAAI,2BAA2B,CACnC,mBAAmB,EACnB,+DAA+D,CAChE,CAAA;YACH,OAAO,wBAAwB,CAAC;gBAC9B,SAAS;gBACT,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE;gBACpB,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI;gBAC7B,WAAW;gBACX,MAAM,EAAE,iBAAiB;gBACzB,MAAM;aACP,CAAC,CAAA;QACJ,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YACrB,UAAU,EAAE,CAAA;YACZ,MAAM,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACrC,CAAC;QACD,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YACpB,UAAU,EAAE,CAAA;YACZ,MAAM,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACpC,CAAC;QACD,KAAK,EAAE,GAAG,EAAE;YACV,IAAI,MAAM;gBAAE,OAAM;YAClB,MAAM,GAAG,IAAI,CAAA;YACb,QAAQ,CAAC,KAAK,EAAE,CAAA;QAClB,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/vault-enrollment-authority.d.ts

@@ -0,0 +1,16 @@
+import { type CommonAuthClaustrumModule } from './common-auth-runtime.ts';
+export type EnrollmentAuthority = 'vault' | 'local' | 'unreadable';
+type EnrollmentPaths = Parameters<CommonAuthClaustrumModule['readClaustrumEnrollmentStatus']>[0];
+type EnrollmentReader = Pick<CommonAuthClaustrumModule, 'enrollmentAuthority'>;
+export declare const VAULT_ACCOUNT_REMEDY = "Vault account access is unavailable. Connect accounts in the vault, or disconnect the vault to use local accounts.";
+/**
+ * The operator's approval to access the vault selects its accounts instead of local OAuth accounts,
+ * regardless of a saved local-mode preference.
+ * An approved record whose token disappeared still excludes local accounts.
+ * Failed reads never authorize local work. Call at the start of each unit of
+ * work; a refresh that already started must finish saving the replacement
+ * OAuth credentials.
+ */
+export declare function enrollmentAuthority(paths: EnrollmentPaths, proposedName: string, reader?: EnrollmentReader): Promise<EnrollmentAuthority>;
+export {};
+//# sourceMappingURL=vault-enrollment-authority.d.ts.map

package/dist/vault-enrollment-authority.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault-enrollment-authority.d.ts","sourceRoot":"","sources":["../src/vault-enrollment-authority.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,yBAAyB,EAE/B,MAAM,0BAA0B,CAAA;AAEjC,MAAM,MAAM,mBAAmB,GAAG,OAAO,GAAG,OAAO,GAAG,YAAY,CAAA;AAClE,KAAK,eAAe,GAAG,UAAU,CAC/B,yBAAyB,CAAC,+BAA+B,CAAC,CAC3D,CAAC,CAAC,CAAC,CAAA;AACJ,KAAK,gBAAgB,GAAG,IAAI,CAAC,yBAAyB,EAAE,qBAAqB,CAAC,CAAA;AAE9E,eAAO,MAAM,oBAAoB,uHACqF,CAAA;AAEtH;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,eAAe,EACtB,YAAY,EAAE,MAAM,EACpB,MAAM,CAAC,EAAE,gBAAgB,GACxB,OAAO,CAAC,mBAAmB,CAAC,CAQ9B"}

package/dist/vault-enrollment-authority.js

@@ -0,0 +1,19 @@
+import { loadCommonAuthClaustrum, } from "./common-auth-runtime.js";
+export const VAULT_ACCOUNT_REMEDY = 'Vault account access is unavailable. Connect accounts in the vault, or disconnect the vault to use local accounts.';
+/**
+ * The operator's approval to access the vault selects its accounts instead of local OAuth accounts,
+ * regardless of a saved local-mode preference.
+ * An approved record whose token disappeared still excludes local accounts.
+ * Failed reads never authorize local work. Call at the start of each unit of
+ * work; a refresh that already started must finish saving the replacement
+ * OAuth credentials.
+ */
+export async function enrollmentAuthority(paths, proposedName, reader) {
+    try {
+        return await (reader ?? (await loadCommonAuthClaustrum())).enrollmentAuthority(paths, proposedName);
+    }
+    catch {
+        return 'unreadable';
+    }
+}
+//# sourceMappingURL=vault-enrollment-authority.js.map

package/dist/vault-enrollment-authority.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault-enrollment-authority.js","sourceRoot":"","sources":["../src/vault-enrollment-authority.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,uBAAuB,GACxB,MAAM,0BAA0B,CAAA;AAQjC,MAAM,CAAC,MAAM,oBAAoB,GAC/B,oHAAoH,CAAA;AAEtH;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,KAAsB,EACtB,YAAoB,EACpB,MAAyB;IAEzB,IAAI,CAAC;QACH,OAAO,MAAM,CACX,MAAM,IAAI,CAAC,MAAM,uBAAuB,EAAE,CAAC,CAC5C,CAAC,mBAAmB,CAAC,KAAK,EAAE,YAAY,CAAC,CAAA;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,YAAY,CAAA;IACrB,CAAC;AACH,CAAC"}

package/dist/vault-family.d.ts

@@ -0,0 +1,11 @@
+export type AntigravityVaultHost = 'opencode' | 'pi';
+export declare const ANTIGRAVITY_VAULT_FAMILY: Readonly<{
+    readonly refreshAdapter: "antigravity";
+    readonly category: "antigravity-native";
+    readonly apiKeys: false;
+}>;
+export declare const ANTIGRAVITY_VAULT_REQUIRE_ASSERTION: true;
+export type AntigravityVaultEnrollmentName = `antigravity-auth-${AntigravityVaultHost}`;
+export declare const ANTIGRAVITY_VAULT_ENROLLMENT_NAMES: Readonly<Record<AntigravityVaultHost, AntigravityVaultEnrollmentName>>;
+export declare function getAntigravityVaultEnrollmentName(host: AntigravityVaultHost): AntigravityVaultEnrollmentName;
+//# sourceMappingURL=vault-family.d.ts.map

package/dist/vault-family.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault-family.d.ts","sourceRoot":"","sources":["../src/vault-family.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,oBAAoB,GAAG,UAAU,GAAG,IAAI,CAAA;AAEpD,eAAO,MAAM,wBAAwB;;;;EAI1B,CAAA;AAEX,eAAO,MAAM,mCAAmC,EAAG,IAAa,CAAA;AAEhE,MAAM,MAAM,8BAA8B,GACxC,oBAAoB,oBAAoB,EAAE,CAAA;AAE5C,eAAO,MAAM,kCAAkC,EAAE,QAAQ,CACvD,MAAM,CAAC,oBAAoB,EAAE,8BAA8B,CAAC,CAI5D,CAAA;AAMF,wBAAgB,iCAAiC,CAC/C,IAAI,EAAE,oBAAoB,GACzB,8BAA8B,CAShC"}

package/dist/vault-family.js

@@ -0,0 +1,24 @@
+export const ANTIGRAVITY_VAULT_FAMILY = Object.freeze({
+    refreshAdapter: 'antigravity',
+    category: 'antigravity-native',
+    apiKeys: false,
+});
+export const ANTIGRAVITY_VAULT_REQUIRE_ASSERTION = true;
+export const ANTIGRAVITY_VAULT_ENROLLMENT_NAMES = Object.freeze({
+    opencode: 'antigravity-auth-opencode',
+    pi: 'antigravity-auth-pi',
+});
+function assertNeverHost(host) {
+    throw new TypeError(`Unsupported Antigravity vault host: ${String(host)}`);
+}
+export function getAntigravityVaultEnrollmentName(host) {
+    switch (host) {
+        case 'opencode':
+            return ANTIGRAVITY_VAULT_ENROLLMENT_NAMES.opencode;
+        case 'pi':
+            return ANTIGRAVITY_VAULT_ENROLLMENT_NAMES.pi;
+        default:
+            return assertNeverHost(host);
+    }
+}
+//# sourceMappingURL=vault-family.js.map

package/dist/vault-family.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault-family.js","sourceRoot":"","sources":["../src/vault-family.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAC,MAAM,CAAC;IACpD,cAAc,EAAE,aAAa;IAC7B,QAAQ,EAAE,oBAAoB;IAC9B,OAAO,EAAE,KAAK;CACN,CAAC,CAAA;AAEX,MAAM,CAAC,MAAM,mCAAmC,GAAG,IAAa,CAAA;AAKhE,MAAM,CAAC,MAAM,kCAAkC,GAE3C,MAAM,CAAC,MAAM,CAAC;IAChB,QAAQ,EAAE,2BAA2B;IACrC,EAAE,EAAE,qBAAqB;CAC1B,CAAC,CAAA;AAEF,SAAS,eAAe,CAAC,IAAW;IAClC,MAAM,IAAI,SAAS,CAAC,uCAAuC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;AAC5E,CAAC;AAED,MAAM,UAAU,iCAAiC,CAC/C,IAA0B;IAE1B,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,UAAU;YACb,OAAO,kCAAkC,CAAC,QAAQ,CAAA;QACpD,KAAK,IAAI;YACP,OAAO,kCAAkC,CAAC,EAAE,CAAA;QAC9C;YACE,OAAO,eAAe,CAAC,IAAI,CAAC,CAAA;IAChC,CAAC;AACH,CAAC"}

package/dist/vault-provider-state.d.ts

@@ -0,0 +1,162 @@
+/**
+ * Provider-state file ("sidecar") for vault accounts: non-credential
+ * Antigravity metadata (label, usage, cooldowns, verification, tier,
+ * fingerprint, quota) keyed by the account identity the vault asserted, with
+ * the route, credential and record version that last wrote it.
+ *
+ * The roster (the Claustrum library's non-secret list of vault accounts this
+ * host may route to) keeps only the fields the library defines and drops any
+ * other field when it rewrites the file, so Antigravity's own state lives in
+ * this separate file. Keying by asserted account means a different account
+ * inherits nothing, while the same account keeps its state across token
+ * refreshes. The file never holds a bearer, refresh or enrollment secret, a
+ * receipt or a project (a vault send's project comes from the receipt
+ * Claustrum serves for that send attempt); such input is refused, not
+ * stripped. The fingerprint `sessionToken` is locally generated tracking
+ * metadata, not a credential, and is kept.
+ *
+ * A write holds the roster lock as an ownership guard (the roster is not
+ * rewritten), then this file's lock, re-checks the roster binding and asks the
+ * vault for a fresh receipt for the same version, and re-asserts both locks
+ * just before the atomic rename.
+ *
+ * A write must carry the record version its observation was served under.
+ * Once the vault serves a newer record version, even for the same account,
+ * that write is refused and the observation (usage, quota) is dropped; it is
+ * never re-attributed to the newer version.
+ */
+import type { JsonObject, ProviderMetadata, QuotaState } from './account-repository-types.ts';
+import type { CommonAuthFsModule } from './common-auth-runtime.ts';
+import type { VaultClaustrumPort } from './vault-account-source.ts';
+export declare const VAULT_PROVIDER_STATE_SCHEMA_VERSION = 1;
+/**
+ * File lock (`./fs` `withLock`) a commit holds on the state file, so two
+ * writers cannot interleave their read and rename.
+ */
+export declare const VAULT_PROVIDER_STATE_LOCK: Readonly<{
+    name: "antigravity-vault-state";
+    ttlMs: 10000;
+    timeoutMs: 10000;
+    renew: true;
+}>;
+/**
+ * The `./fs` lock and atomic-write functions `commitVaultProviderState`
+ * uses.
+ */
+export type AntigravityVaultStateFs = Pick<CommonAuthFsModule, 'withLock' | 'writeJsonAtomic'>;
+/**
+ * The `./claustrum` functions `commitVaultProviderState` uses: the roster write
+ * lock as an ownership guard and the decline check.
+ */
+export type VaultRosterGuardModule = Pick<VaultClaustrumPort, 'mutateVaultRoster' | 'isDeclined'>;
+/**
+ * Non-secret facts tying an observation (usage, quota) to the send attempt
+ * that produced it: the selected route, the credential id and asserted
+ * account, and the record version Claustrum served. Carries no token and no
+ * project.
+ */
+export interface VaultStateAttribution {
+    readonly routeId: string;
+    readonly credentialId: string;
+    readonly accountIdentity: string;
+    readonly recordVersion: number;
+}
+/**
+ * Provider metadata a vault account may keep. The project fields are left
+ * out because a send's project comes only from the receipt Claustrum serves
+ * for that attempt, and
+ * `enabled` because the roster owns whether an account routes.
+ */
+export type VaultProviderMetadata = Omit<ProviderMetadata, 'projectId' | 'managedProjectId' | 'enabled'>;
+/**
+ * The route, credential and served record version of the send whose
+ * observation last wrote this state. Kept as a record only; never counted or
+ * compared as a local version number.
+ */
+export interface VaultStateProvenance {
+    readonly routeId: string;
+    readonly credentialId: string;
+    readonly recordVersion: number;
+}
+export interface VaultAccountState {
+    readonly observed: VaultStateProvenance;
+    readonly metadata?: VaultProviderMetadata;
+    readonly quota?: QuotaState;
+    readonly extensions?: JsonObject;
+}
+export interface VaultProviderStateFile {
+    readonly schemaVersion: typeof VAULT_PROVIDER_STATE_SCHEMA_VERSION;
+    readonly accounts: Readonly<Record<string, VaultAccountState>>;
+    readonly extensions?: JsonObject;
+}
+/**
+ * What an update asks to store for the account. `observed` is not part of it:
+ * `commitVaultProviderState` sets it from the attribution.
+ */
+export interface VaultAccountStateValue {
+    metadata?: VaultProviderMetadata;
+    quota?: QuotaState;
+    extensions?: JsonObject;
+}
+/**
+ * Computes the account's next state from its current one. The function must
+ * be synchronous and must not start another commit. Return `undefined` to
+ * leave the state as it is and `null` to remove the account's entry.
+ */
+export type AntigravityVaultStateUpdate = (current: VaultAccountState | undefined) => VaultAccountStateValue | null | undefined;
+export type VaultProviderStateCommitResult = {
+    status: 'written';
+    state: VaultAccountState;
+} | {
+    status: 'cleared';
+} | {
+    status: 'unchanged';
+    state?: VaultAccountState;
+}
+/**
+ * The write failed part-way; the file may or may not hold the new state.
+ * The write is not retried. `state` is what a reload of the file found,
+ * when the reload could read it.
+ */
+ | {
+    status: 'uncertain';
+    error: unknown;
+    state?: VaultAccountState;
+};
+export type VaultProviderStateFailureKind = 'invalid-attribution' | 'binding-stale' | 'malformed' | 'newer-schema' | 'credential-material' | 'project-field' | 'invalid-update';
+/**
+ * A refused read or commit. Messages name the field path or step that was
+ * refused, never the stored value.
+ */
+export declare class VaultProviderStateError extends Error {
+    readonly kind: VaultProviderStateFailureKind;
+    constructor(kind: VaultProviderStateFailureKind, message: string);
+}
+/**
+ * Reads a sidecar value. A newer schema, an unknown field, a credential or a
+ * project anywhere in it is refused; nothing is silently dropped.
+ */
+export declare function decodeVaultProviderState(raw: unknown): VaultProviderStateFile;
+export declare function encodeVaultProviderState(file: VaultProviderStateFile): JsonObject;
+/** Reads the sidecar; a missing file is an empty one, anything unreadable is refused. */
+export declare function readVaultProviderState(statePath: string): Promise<VaultProviderStateFile>;
+/** The stored state of one asserted account, if any. */
+export declare function vaultAccountState(file: VaultProviderStateFile, accountIdentity: string): VaultAccountState | undefined;
+export interface CommitVaultProviderStateInput {
+    claustrum: VaultRosterGuardModule;
+    fs: AntigravityVaultStateFs;
+    rosterPath: string;
+    statePath: string;
+    attribution: VaultStateAttribution;
+    /**
+     * Fresh proof, while the roster write lock and the state-file lock are both
+     * held, that custody is still active, the host's stored credential record
+     * is still not a real login, and the vault still serves the attributed
+     * credential, account and record version. Throws to refuse. Must not use
+     * or keep the proving receipt's token or project.
+     */
+    verify: (attribution: VaultStateAttribution) => Promise<void>;
+    update: AntigravityVaultStateUpdate;
+}
+export declare function commitVaultProviderState(input: CommitVaultProviderStateInput): Promise<VaultProviderStateCommitResult>;
+//# sourceMappingURL=vault-provider-state.d.ts.map

package/dist/vault-provider-state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault-provider-state.d.ts","sourceRoot":"","sources":["../src/vault-provider-state.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAWH,OAAO,KAAK,EACV,UAAU,EAEV,gBAAgB,EAChB,UAAU,EACX,MAAM,+BAA+B,CAAA;AACtC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAA;AAClE,OAAO,KAAK,EAAE,kBAAkB,EAAe,MAAM,2BAA2B,CAAA;AAEhF,eAAO,MAAM,mCAAmC,IAAI,CAAA;AAEpD;;;GAGG;AACH,eAAO,MAAM,yBAAyB;;;;;EAKpC,CAAA;AAEF;;;GAGG;AACH,MAAM,MAAM,uBAAuB,GAAG,IAAI,CACxC,kBAAkB,EAClB,UAAU,GAAG,iBAAiB,CAC/B,CAAA;AAED;;;GAGG;AACH,MAAM,MAAM,sBAAsB,GAAG,IAAI,CACvC,kBAAkB,EAClB,mBAAmB,GAAG,YAAY,CACnC,CAAA;AAED;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;CAC/B;AAED;;;;;GAKG;AACH,MAAM,MAAM,qBAAqB,GAAG,IAAI,CACtC,gBAAgB,EAChB,WAAW,GAAG,kBAAkB,GAAG,SAAS,CAC7C,CAAA;AAED;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;CAC/B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAA;IACvC,QAAQ,CAAC,QAAQ,CAAC,EAAE,qBAAqB,CAAA;IACzC,QAAQ,CAAC,KAAK,CAAC,EAAE,UAAU,CAAA;IAC3B,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAA;CACjC;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,aAAa,EAAE,OAAO,mCAAmC,CAAA;IAClE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC,CAAA;IAC9D,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAA;CACjC;AAED;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,EAAE,qBAAqB,CAAA;IAChC,KAAK,CAAC,EAAE,UAAU,CAAA;IAClB,UAAU,CAAC,EAAE,UAAU,CAAA;CACxB;AAED;;;;GAIG;AACH,MAAM,MAAM,2BAA2B,GAAG,CACxC,OAAO,EAAE,iBAAiB,GAAG,SAAS,KACnC,sBAAsB,GAAG,IAAI,GAAG,SAAS,CAAA;AAE9C,MAAM,MAAM,8BAA8B,GACtC;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,iBAAiB,CAAA;CAAE,GAC/C;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,GACrB;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,KAAK,CAAC,EAAE,iBAAiB,CAAA;CAAE;AACpD;;;;GAIG;GACD;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,iBAAiB,CAAA;CAAE,CAAA;AAEtE,MAAM,MAAM,6BAA6B,GACrC,qBAAqB,GACrB,eAAe,GACf,WAAW,GACX,cAAc,GACd,qBAAqB,GACrB,eAAe,GACf,gBAAgB,CAAA;AAEpB;;;GAGG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,QAAQ,CAAC,IAAI,EAAE,6BAA6B,CAAA;gBAEhC,IAAI,EAAE,6BAA6B,EAAE,OAAO,EAAE,MAAM;CAKjE;AAsMD;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,OAAO,GAAG,sBAAsB,CAiC7E;AAgBD,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,sBAAsB,GAC3B,UAAU,CAYZ;AAOD,yFAAyF;AACzF,wBAAsB,sBAAsB,CAC1C,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,sBAAsB,CAAC,CAejC;AAED,wDAAwD;AACxD,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,sBAAsB,EAC5B,eAAe,EAAE,MAAM,GACtB,iBAAiB,GAAG,SAAS,CAI/B;AAwFD,MAAM,WAAW,6BAA6B;IAC5C,SAAS,EAAE,sBAAsB,CAAA;IACjC,EAAE,EAAE,uBAAuB,CAAA;IAC3B,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,EAAE,qBAAqB,CAAA;IAClC;;;;;;OAMG;IACH,MAAM,EAAE,CAAC,WAAW,EAAE,qBAAqB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IAC7D,MAAM,EAAE,2BAA2B,CAAA;CACpC;AAED,wBAAsB,wBAAwB,CAC5C,KAAK,EAAE,6BAA6B,GACnC,OAAO,CAAC,8BAA8B,CAAC,CA4EzC"}