@cortexkit/antigravity-auth-core 2.2.1 → 3.0.1

package/dist/vault-provider-state.js

@@ -0,0 +1,422 @@
+/**
+ * Provider-state file ("sidecar") for vault accounts: non-credential
+ * Antigravity metadata (label, usage, cooldowns, verification, tier,
+ * fingerprint, quota) keyed by the account identity the vault asserted, with
+ * the route, credential and record version that last wrote it.
+ *
+ * The roster (the Claustrum library's non-secret list of vault accounts this
+ * host may route to) keeps only the fields the library defines and drops any
+ * other field when it rewrites the file, so Antigravity's own state lives in
+ * this separate file. Keying by asserted account means a different account
+ * inherits nothing, while the same account keeps its state across token
+ * refreshes. The file never holds a bearer, refresh or enrollment secret, a
+ * receipt or a project (a vault send's project comes from the receipt
+ * Claustrum serves for that send attempt); such input is refused, not
+ * stripped. The fingerprint `sessionToken` is locally generated tracking
+ * metadata, not a credential, and is kept.
+ *
+ * A write holds the roster lock as an ownership guard (the roster is not
+ * rewritten), then this file's lock, re-checks the roster binding and asks the
+ * vault for a fresh receipt for the same version, and re-asserts both locks
+ * just before the atomic rename.
+ *
+ * A write must carry the record version its observation was served under.
+ * Once the vault serves a newer record version, even for the same account,
+ * that write is refused and the observation (usage, quota) is dropped; it is
+ * never re-attributed to the newer version.
+ */
+import { readFile } from 'node:fs/promises';
+import { AccountCodecError, decodeProviderMetadata, decodeQuotaState, encodeProviderMetadata, encodeQuotaState, } from "./account-repository-codecs.js";
+export const VAULT_PROVIDER_STATE_SCHEMA_VERSION = 1;
+/**
+ * File lock (`./fs` `withLock`) a commit holds on the state file, so two
+ * writers cannot interleave their read and rename.
+ */
+export const VAULT_PROVIDER_STATE_LOCK = Object.freeze({
+    name: 'antigravity-vault-state',
+    ttlMs: 10_000,
+    timeoutMs: 10_000,
+    renew: true,
+});
+/**
+ * A refused read or commit. Messages name the field path or step that was
+ * refused, never the stored value.
+ */
+export class VaultProviderStateError extends Error {
+    kind;
+    constructor(kind, message) {
+        super(message);
+        this.name = 'VaultProviderStateError';
+        this.kind = kind;
+    }
+}
+// ---------------------------------------------------------------------------
+// Validation
+// ---------------------------------------------------------------------------
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function isNonEmpty(value) {
+    return typeof value === 'string' && value.trim().length > 0;
+}
+/**
+ * Key names refused anywhere in the file because they hold credentials. Keys
+ * are compared lower-case with punctuation removed, so `access_token`,
+ * `accessToken` and `access-token` all match `accesstoken`.
+ */
+const CREDENTIAL_KEYS = new Set([
+    'access',
+    'accesstoken',
+    'refresh',
+    'refreshtoken',
+    'idtoken',
+    'token',
+    'bearer',
+    'authorization',
+    'apikey',
+    'key',
+    'secret',
+    'clientsecret',
+    'password',
+    'enrollmenttoken',
+    'cookie',
+    'receipt',
+]);
+/**
+ * String values refused anywhere in the file: those starting like a Google
+ * access token (`ya29.`), a Google refresh token (`1//`) or an Authorization
+ * header (`Bearer `).
+ */
+const CREDENTIAL_VALUE = /^(?:ya29\.|1\/\/|bearer\s)/i;
+const PROJECT_KEYS = new Set(['projectid', 'managedprojectid', 'project']);
+function normalizedKey(key) {
+    return key.toLowerCase().replace(/[^a-z0-9]/g, '');
+}
+/**
+ * True for `metadata.fingerprint.sessionToken` and for the same field in each
+ * `metadata.fingerprintHistory` entry: the one token-named field the file may
+ * keep, because it is local tracking metadata.
+ */
+function isFingerprintSessionToken(path) {
+    const n = path.length;
+    if (path[n - 1] !== 'sessionToken' || path[n - 2] !== 'fingerprint')
+        return false;
+    if (n === 3 && path[0] === 'metadata')
+        return true;
+    return n === 5 && path[0] === 'metadata' && path[1] === 'fingerprintHistory';
+}
+function scanForSecrets(value, path) {
+    if (typeof value === 'string') {
+        if (CREDENTIAL_VALUE.test(value.trim()) && !isFingerprintSessionToken(path))
+            throw new VaultProviderStateError('credential-material', `${path.join('.')} holds credential material`);
+        return;
+    }
+    if (Array.isArray(value)) {
+        for (const [index, item] of value.entries())
+            scanForSecrets(item, [...path, `${index}`]);
+        return;
+    }
+    if (!isRecord(value))
+        return;
+    for (const [key, item] of Object.entries(value)) {
+        const next = [...path, key];
+        const name = normalizedKey(key);
+        if (CREDENTIAL_KEYS.has(name) && !isFingerprintSessionToken(next))
+            throw new VaultProviderStateError('credential-material', `${next.join('.')} is a credential field`);
+        if (name === 'sessiontoken' && !isFingerprintSessionToken(next))
+            throw new VaultProviderStateError('credential-material', `${next.join('.')} is a credential field`);
+        if (PROJECT_KEYS.has(name))
+            throw new VaultProviderStateError('project-field', `${next.join('.')} would persist an Antigravity project`);
+        scanForSecrets(item, next);
+    }
+}
+function decodeProvenance(raw, path) {
+    if (!isRecord(raw) ||
+        Object.keys(raw).some((key) => !['routeId', 'credentialId', 'recordVersion'].includes(key)) ||
+        !isNonEmpty(raw.routeId) ||
+        !isNonEmpty(raw.credentialId) ||
+        typeof raw.recordVersion !== 'number' ||
+        !Number.isSafeInteger(raw.recordVersion) ||
+        raw.recordVersion < 0)
+        throw new VaultProviderStateError('malformed', `${path} is not a valid provenance`);
+    return Object.freeze({
+        routeId: raw.routeId,
+        credentialId: raw.credentialId,
+        recordVersion: raw.recordVersion,
+    });
+}
+function codecRefusal(error, path) {
+    if (error instanceof AccountCodecError)
+        throw new VaultProviderStateError('malformed', `${path}: ${error.problem} at ${error.path}`);
+    throw error;
+}
+function decodeExtensions(raw, path) {
+    if (raw === undefined)
+        return undefined;
+    if (!isRecord(raw))
+        throw new VaultProviderStateError('malformed', `${path} must be an object`);
+    return JSON.parse(JSON.stringify(raw));
+}
+/**
+ * Decodes the parts of an account entry an update may set: `metadata`,
+ * `quota` and `extensions` (never `observed`). `stored` is the JSON form read
+ * from the file; `typed` is the in-memory form an update returns, which is
+ * encoded first so both pass the same codec checks.
+ */
+function decodeValue(raw, path, form) {
+    if (!isRecord(raw))
+        throw new VaultProviderStateError('malformed', `${path} must be an object`);
+    for (const key of Object.keys(raw))
+        if (!['metadata', 'quota', 'extensions'].includes(key))
+            throw new VaultProviderStateError('malformed', `${path} has an unknown field`);
+    scanForSecrets(raw, []);
+    const value = {};
+    if (raw.metadata !== undefined) {
+        try {
+            value.metadata = decodeProviderMetadata(form === 'typed'
+                ? encodeProviderMetadata(raw.metadata)
+                : raw.metadata);
+        }
+        catch (error) {
+            codecRefusal(error, `${path}.metadata`);
+        }
+    }
+    if (raw.quota !== undefined) {
+        try {
+            value.quota = decodeQuotaState(form === 'typed'
+                ? encodeQuotaState(raw.quota)
+                : raw.quota);
+        }
+        catch (error) {
+            codecRefusal(error, `${path}.quota`);
+        }
+    }
+    const extensions = decodeExtensions(raw.extensions, `${path}.extensions`);
+    if (extensions)
+        value.extensions = extensions;
+    return value;
+}
+function decodeAccount(raw, path) {
+    if (!isRecord(raw))
+        throw new VaultProviderStateError('malformed', `${path} must be an object`);
+    const { observed, ...rest } = raw;
+    return Object.freeze({
+        observed: decodeProvenance(observed, `${path}.observed`),
+        ...decodeValue(rest, path, 'stored'),
+    });
+}
+/**
+ * Reads a sidecar value. A newer schema, an unknown field, a credential or a
+ * project anywhere in it is refused; nothing is silently dropped.
+ */
+export function decodeVaultProviderState(raw) {
+    if (!isRecord(raw) || typeof raw.schemaVersion !== 'number')
+        throw new VaultProviderStateError('malformed', 'state file is malformed');
+    if (raw.schemaVersion > VAULT_PROVIDER_STATE_SCHEMA_VERSION)
+        throw new VaultProviderStateError('newer-schema', 'state file was written by a newer version');
+    if (raw.schemaVersion !== VAULT_PROVIDER_STATE_SCHEMA_VERSION)
+        throw new VaultProviderStateError('malformed', 'state file version is invalid');
+    for (const key of Object.keys(raw))
+        if (!['schemaVersion', 'accounts', 'extensions'].includes(key))
+            throw new VaultProviderStateError('malformed', 'state file has an unknown field');
+    if (!isRecord(raw.accounts))
+        throw new VaultProviderStateError('malformed', 'accounts must be an object');
+    const accounts = {};
+    for (const [identity, entry] of Object.entries(raw.accounts)) {
+        if (!isNonEmpty(identity))
+            throw new VaultProviderStateError('malformed', 'blank account identity');
+        accounts[identity] = decodeAccount(entry, 'accounts[]');
+    }
+    const extensions = decodeExtensions(raw.extensions, 'extensions');
+    return Object.freeze({
+        schemaVersion: VAULT_PROVIDER_STATE_SCHEMA_VERSION,
+        accounts: Object.freeze(accounts),
+        ...(extensions && { extensions }),
+    });
+}
+function encodeAccount(state) {
+    const out = {
+        observed: {
+            routeId: state.observed.routeId,
+            credentialId: state.observed.credentialId,
+            recordVersion: state.observed.recordVersion,
+        },
+    };
+    if (state.metadata)
+        out.metadata = encodeProviderMetadata(state.metadata);
+    if (state.quota)
+        out.quota = encodeQuotaState(state.quota);
+    if (state.extensions)
+        out.extensions = state.extensions;
+    return out;
+}
+export function encodeVaultProviderState(file) {
+    const accounts = {};
+    for (const [identity, state] of Object.entries(file.accounts))
+        accounts[identity] = encodeAccount(state);
+    const out = {
+        schemaVersion: VAULT_PROVIDER_STATE_SCHEMA_VERSION,
+        accounts,
+    };
+    if (file.extensions)
+        out.extensions = file.extensions;
+    // Decoding what is about to be written enforces the same refusals on writes.
+    decodeVaultProviderState(out);
+    return out;
+}
+const EMPTY_FILE = Object.freeze({
+    schemaVersion: VAULT_PROVIDER_STATE_SCHEMA_VERSION,
+    accounts: Object.freeze({}),
+});
+/** Reads the sidecar; a missing file is an empty one, anything unreadable is refused. */
+export async function readVaultProviderState(statePath) {
+    let text;
+    try {
+        text = await readFile(statePath, 'utf8');
+    }
+    catch (error) {
+        if (isRecord(error) && error.code === 'ENOENT')
+            return EMPTY_FILE;
+        throw error;
+    }
+    let raw;
+    try {
+        raw = JSON.parse(text);
+    }
+    catch {
+        throw new VaultProviderStateError('malformed', 'state file is not JSON');
+    }
+    return decodeVaultProviderState(raw);
+}
+/** The stored state of one asserted account, if any. */
+export function vaultAccountState(file, accountIdentity) {
+    return Object.hasOwn(file.accounts, accountIdentity)
+        ? file.accounts[accountIdentity]
+        : undefined;
+}
+// ---------------------------------------------------------------------------
+// Commit
+// ---------------------------------------------------------------------------
+const ATTRIBUTION_FIELDS = [
+    'accountIdentity',
+    'credentialId',
+    'recordVersion',
+    'routeId',
+];
+/**
+ * Copies an attribution after checking it is a plain object with exactly the
+ * four own data fields, non-blank strings and a non-negative integer version
+ * (a boolean, string or fraction is refused). Later checks use only the copy,
+ * so a getter or a later mutation cannot move the fence.
+ */
+function pinAttribution(raw) {
+    const invalid = () => new VaultProviderStateError('invalid-attribution', 'state commit needs exactly a route, credential, asserted account and record version');
+    if (!isRecord(raw) || Object.getPrototypeOf(raw) !== Object.prototype)
+        throw invalid();
+    const keys = Reflect.ownKeys(raw);
+    if (keys.length !== ATTRIBUTION_FIELDS.length ||
+        !ATTRIBUTION_FIELDS.every((key) => {
+            const field = Object.getOwnPropertyDescriptor(raw, key);
+            return field !== undefined && 'value' in field && field.enumerable;
+        }))
+        throw invalid();
+    const { routeId, credentialId, accountIdentity, recordVersion } = raw;
+    if (!isNonEmpty(routeId) ||
+        !isNonEmpty(credentialId) ||
+        !isNonEmpty(accountIdentity) ||
+        typeof recordVersion !== 'number' ||
+        !Number.isSafeInteger(recordVersion) ||
+        recordVersion < 0)
+        throw invalid();
+    return Object.freeze({
+        routeId,
+        credentialId,
+        accountIdentity,
+        recordVersion,
+    });
+}
+/**
+ * The roster must still route the attributed credential to the attributed
+ * account: the row exists, is enabled, active and not declined, and is
+ * neither stale nor unclaimed. A removed account is never brought back by a
+ * state write.
+ */
+function assertRosterBinding(roster, attribution, claustrum) {
+    const row = roster?.rows.find((entry) => entry.routeId === attribution.routeId);
+    if (!roster ||
+        !row?.enabled ||
+        row.state !== 'active' ||
+        row.stale === true ||
+        row.unclaimed === true ||
+        row.credentialId !== attribution.credentialId ||
+        row.accountIdentity !== attribution.accountIdentity ||
+        claustrum.isDeclined(roster.declined, attribution.credentialId, attribution.accountIdentity))
+        throw new VaultProviderStateError('binding-stale', 'the vault route no longer serves the attributed credential and account');
+}
+export async function commitVaultProviderState(input) {
+    const { claustrum, fs, statePath } = input;
+    const attribution = pinAttribution(input.attribution);
+    const identity = attribution.accountIdentity;
+    return claustrum.mutateVaultRoster(input.rosterPath, async (roster, rosterLock) => {
+        assertRosterBinding(roster, attribution, claustrum);
+        const result = await fs.withLock(statePath, VAULT_PROVIDER_STATE_LOCK, async (stateLock) => {
+            await input.verify(attribution);
+            const file = await readVaultProviderState(statePath);
+            const current = vaultAccountState(file, identity);
+            const requested = input.update(current);
+            if (isRecord(requested) &&
+                typeof requested.then === 'function')
+                throw new VaultProviderStateError('invalid-update', 'a state update must be synchronous');
+            if (requested === undefined)
+                return current
+                    ? { status: 'unchanged', state: current }
+                    : { status: 'unchanged' };
+            const accounts = {
+                ...file.accounts,
+            };
+            let next;
+            if (requested === null) {
+                if (!current)
+                    return { status: 'unchanged' };
+                delete accounts[identity];
+            }
+            else {
+                next = Object.freeze({
+                    observed: Object.freeze({
+                        routeId: attribution.routeId,
+                        credentialId: attribution.credentialId,
+                        recordVersion: attribution.recordVersion,
+                    }),
+                    ...decodeValue(requested, 'update', 'typed'),
+                });
+                accounts[identity] = next;
+            }
+            const encoded = encodeVaultProviderState({ ...file, accounts });
+            try {
+                await fs.writeJsonAtomic(statePath, encoded, {
+                    beforeRename: async () => {
+                        await rosterLock.assertOwned();
+                        await stateLock.assertOwned();
+                    },
+                });
+            }
+            catch (error) {
+                let reloaded;
+                try {
+                    reloaded = vaultAccountState(await readVaultProviderState(statePath), identity);
+                }
+                catch {
+                    reloaded = undefined;
+                }
+                return reloaded
+                    ? { status: 'uncertain', error, state: reloaded }
+                    : { status: 'uncertain', error };
+            }
+            return next
+                ? { status: 'written', state: next }
+                : { status: 'cleared' };
+        });
+        return { result };
+    });
+}
+//# sourceMappingURL=vault-provider-state.js.map

package/dist/vault-provider-state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault-provider-state.js","sourceRoot":"","sources":["../src/vault-provider-state.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAE3C,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,gBAAgB,EAChB,sBAAsB,EACtB,gBAAgB,GACjB,MAAM,gCAAgC,CAAA;AAUvC,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAA;AAEpD;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,MAAM,CAAC,MAAM,CAAC;IACrD,IAAI,EAAE,yBAAyB;IAC/B,KAAK,EAAE,MAAM;IACb,SAAS,EAAE,MAAM;IACjB,KAAK,EAAE,IAAI;CACZ,CAAC,CAAA;AA2GF;;;GAGG;AACH,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IACvC,IAAI,CAA+B;IAE5C,YAAY,IAAmC,EAAE,OAAe;QAC9D,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAA;QACrC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;IAClB,CAAC;CACF;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;AAC7E,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAA;AAC7D,CAAC;AAED;;;;GAIG;AACH,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC9B,QAAQ;IACR,aAAa;IACb,SAAS;IACT,cAAc;IACd,SAAS;IACT,OAAO;IACP,QAAQ;IACR,eAAe;IACf,QAAQ;IACR,KAAK;IACL,QAAQ;IACR,cAAc;IACd,UAAU;IACV,iBAAiB;IACjB,QAAQ;IACR,SAAS;CACV,CAAC,CAAA;AAEF;;;;GAIG;AACH,MAAM,gBAAgB,GAAG,6BAA6B,CAAA;AAEtD,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,kBAAkB,EAAE,SAAS,CAAC,CAAC,CAAA;AAE1E,SAAS,aAAa,CAAC,GAAW;IAChC,OAAO,GAAG,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAA;AACpD,CAAC;AAED;;;;GAIG;AACH,SAAS,yBAAyB,CAAC,IAAuB;IACxD,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAA;IACrB,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,cAAc,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,aAAa;QACjE,OAAO,KAAK,CAAA;IACd,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,UAAU;QAAE,OAAO,IAAI,CAAA;IAClD,OAAO,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,oBAAoB,CAAA;AAC9E,CAAC;AAED,SAAS,cAAc,CAAC,KAAc,EAAE,IAAc;IACpD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC;YACzE,MAAM,IAAI,uBAAuB,CAC/B,qBAAqB,EACrB,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,4BAA4B,CAC9C,CAAA;QACH,OAAM;IACR,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE;YACzC,cAAc,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,CAAA;QAC7C,OAAM;IACR,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAM;IAC5B,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,EAAE,GAAG,CAAC,CAAA;QAC3B,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,CAAA;QAC/B,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC;YAC/D,MAAM,IAAI,uBAAuB,CAC/B,qBAAqB,EACrB,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,wBAAwB,CAC1C,CAAA;QACH,IAAI,IAAI,KAAK,cAAc,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC;YAC7D,MAAM,IAAI,uBAAuB,CAC/B,qBAAqB,EACrB,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,wBAAwB,CAC1C,CAAA;QACH,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC;YACxB,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,uCAAuC,CACzD,CAAA;QACH,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;IAC5B,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAY,EAAE,IAAY;IAClD,IACE,CAAC,QAAQ,CAAC,GAAG,CAAC;QACd,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CACnB,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,cAAc,EAAE,eAAe,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CACrE;QACD,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC;QACxB,CAAC,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC;QAC7B,OAAO,GAAG,CAAC,aAAa,KAAK,QAAQ;QACrC,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,aAAa,CAAC;QACxC,GAAG,CAAC,aAAa,GAAG,CAAC;QAErB,MAAM,IAAI,uBAAuB,CAC/B,WAAW,EACX,GAAG,IAAI,4BAA4B,CACpC,CAAA;IACH,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,YAAY,EAAE,GAAG,CAAC,YAAY;QAC9B,aAAa,EAAE,GAAG,CAAC,aAAa;KACjC,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,KAAc,EAAE,IAAY;IAChD,IAAI,KAAK,YAAY,iBAAiB;QACpC,MAAM,IAAI,uBAAuB,CAC/B,WAAW,EACX,GAAG,IAAI,KAAK,KAAK,CAAC,OAAO,OAAO,KAAK,CAAC,IAAI,EAAE,CAC7C,CAAA;IACH,MAAM,KAAK,CAAA;AACb,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAY,EAAE,IAAY;IAClD,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IACvC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAChB,MAAM,IAAI,uBAAuB,CAAC,WAAW,EAAE,GAAG,IAAI,oBAAoB,CAAC,CAAA;IAC7E,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAe,CAAA;AACtD,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAClB,GAAY,EACZ,IAAY,EACZ,IAAwB;IAExB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAChB,MAAM,IAAI,uBAAuB,CAAC,WAAW,EAAE,GAAG,IAAI,oBAAoB,CAAC,CAAA;IAC7E,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QAChC,IAAI,CAAC,CAAC,UAAU,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;YACpD,MAAM,IAAI,uBAAuB,CAC/B,WAAW,EACX,GAAG,IAAI,uBAAuB,CAC/B,CAAA;IACL,cAAc,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;IACvB,MAAM,KAAK,GAA2B,EAAE,CAAA;IACxC,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,KAAK,CAAC,QAAQ,GAAG,sBAAsB,CACrC,IAAI,KAAK,OAAO;gBACd,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,QAA4B,CAAC;gBAC1D,CAAC,CAAC,GAAG,CAAC,QAAQ,CACjB,CAAA;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,YAAY,CAAC,KAAK,EAAE,GAAG,IAAI,WAAW,CAAC,CAAA;QACzC,CAAC;IACH,CAAC;IACD,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,KAAK,CAAC,KAAK,GAAG,gBAAgB,CAC5B,IAAI,KAAK,OAAO;gBACd,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC,KAAmB,CAAC;gBAC3C,CAAC,CAAC,GAAG,CAAC,KAAK,CACd,CAAA;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,YAAY,CAAC,KAAK,EAAE,GAAG,IAAI,QAAQ,CAAC,CAAA;QACtC,CAAC;IACH,CAAC;IACD,MAAM,UAAU,GAAG,gBAAgB,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,IAAI,aAAa,CAAC,CAAA;IACzE,IAAI,UAAU;QAAE,KAAK,CAAC,UAAU,GAAG,UAAU,CAAA;IAC7C,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,aAAa,CAAC,GAAY,EAAE,IAAY;IAC/C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAChB,MAAM,IAAI,uBAAuB,CAAC,WAAW,EAAE,GAAG,IAAI,oBAAoB,CAAC,CAAA;IAC7E,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,GAAG,CAAA;IACjC,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,QAAQ,EAAE,gBAAgB,CAAC,QAAQ,EAAE,GAAG,IAAI,WAAW,CAAC;QACxD,GAAG,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC;KACrC,CAAC,CAAA;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,GAAY;IACnD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,GAAG,CAAC,aAAa,KAAK,QAAQ;QACzD,MAAM,IAAI,uBAAuB,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAAA;IAC3E,IAAI,GAAG,CAAC,aAAa,GAAG,mCAAmC;QACzD,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,2CAA2C,CAC5C,CAAA;IACH,IAAI,GAAG,CAAC,aAAa,KAAK,mCAAmC;QAC3D,MAAM,IAAI,uBAAuB,CAC/B,WAAW,EACX,+BAA+B,CAChC,CAAA;IACH,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QAChC,IAAI,CAAC,CAAC,eAAe,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;YAC5D,MAAM,IAAI,uBAAuB,CAC/B,WAAW,EACX,iCAAiC,CAClC,CAAA;IACL,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC;QACzB,MAAM,IAAI,uBAAuB,CAAC,WAAW,EAAE,4BAA4B,CAAC,CAAA;IAC9E,MAAM,QAAQ,GAAsC,EAAE,CAAA;IACtD,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7D,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;YACvB,MAAM,IAAI,uBAAuB,CAAC,WAAW,EAAE,wBAAwB,CAAC,CAAA;QAC1E,QAAQ,CAAC,QAAQ,CAAC,GAAG,aAAa,CAAC,KAAK,EAAE,YAAY,CAAC,CAAA;IACzD,CAAC;IACD,MAAM,UAAU,GAAG,gBAAgB,CAAC,GAAG,CAAC,UAAU,EAAE,YAAY,CAAC,CAAA;IACjE,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,aAAa,EAAE,mCAAmC;QAClD,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;QACjC,GAAG,CAAC,UAAU,IAAI,EAAE,UAAU,EAAE,CAAC;KAClC,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,KAAwB;IAC7C,MAAM,GAAG,GAAe;QACtB,QAAQ,EAAE;YACR,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,OAAO;YAC/B,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,YAAY;YACzC,aAAa,EAAE,KAAK,CAAC,QAAQ,CAAC,aAAa;SAC5C;KACF,CAAA;IACD,IAAI,KAAK,CAAC,QAAQ;QAAE,GAAG,CAAC,QAAQ,GAAG,sBAAsB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;IACzE,IAAI,KAAK,CAAC,KAAK;QAAE,GAAG,CAAC,KAAK,GAAG,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IAC1D,IAAI,KAAK,CAAC,UAAU;QAAE,GAAG,CAAC,UAAU,GAAG,KAAK,CAAC,UAAuB,CAAA;IACpE,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,IAA4B;IAE5B,MAAM,QAAQ,GAAe,EAAE,CAAA;IAC/B,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC;QAC3D,QAAQ,CAAC,QAAQ,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,CAAA;IAC3C,MAAM,GAAG,GAAe;QACtB,aAAa,EAAE,mCAAmC;QAClD,QAAQ;KACT,CAAA;IACD,IAAI,IAAI,CAAC,UAAU;QAAE,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAA;IACrD,6EAA6E;IAC7E,wBAAwB,CAAC,GAAG,CAAC,CAAA;IAC7B,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,MAAM,UAAU,GAA2B,MAAM,CAAC,MAAM,CAAC;IACvD,aAAa,EAAE,mCAAmC;IAClD,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;CAC5B,CAAC,CAAA;AAEF,yFAAyF;AACzF,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,SAAiB;IAEjB,IAAI,IAAY,CAAA;IAChB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;IAC1C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,UAAU,CAAA;QACjE,MAAM,KAAK,CAAA;IACb,CAAC;IACD,IAAI,GAAY,CAAA;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,uBAAuB,CAAC,WAAW,EAAE,wBAAwB,CAAC,CAAA;IAC1E,CAAC;IACD,OAAO,wBAAwB,CAAC,GAAG,CAAC,CAAA;AACtC,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,iBAAiB,CAC/B,IAA4B,EAC5B,eAAuB;IAEvB,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC;QAClD,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC;QAChC,CAAC,CAAC,SAAS,CAAA;AACf,CAAC;AAED,8EAA8E;AAC9E,SAAS;AACT,8EAA8E;AAE9E,MAAM,kBAAkB,GAAG;IACzB,iBAAiB;IACjB,cAAc;IACd,eAAe;IACf,SAAS;CACD,CAAA;AAEV;;;;;GAKG;AACH,SAAS,cAAc,CAAC,GAAY;IAClC,MAAM,OAAO,GAAG,GAAG,EAAE,CACnB,IAAI,uBAAuB,CACzB,qBAAqB,EACrB,qFAAqF,CACtF,CAAA;IACH,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,SAAS;QACnE,MAAM,OAAO,EAAE,CAAA;IACjB,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACjC,IACE,IAAI,CAAC,MAAM,KAAK,kBAAkB,CAAC,MAAM;QACzC,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YAChC,MAAM,KAAK,GAAG,MAAM,CAAC,wBAAwB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;YACvD,OAAO,KAAK,KAAK,SAAS,IAAI,OAAO,IAAI,KAAK,IAAI,KAAK,CAAC,UAAU,CAAA;QACpE,CAAC,CAAC;QAEF,MAAM,OAAO,EAAE,CAAA;IACjB,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,GAAG,GAAG,CAAA;IACrE,IACE,CAAC,UAAU,CAAC,OAAO,CAAC;QACpB,CAAC,UAAU,CAAC,YAAY,CAAC;QACzB,CAAC,UAAU,CAAC,eAAe,CAAC;QAC5B,OAAO,aAAa,KAAK,QAAQ;QACjC,CAAC,MAAM,CAAC,aAAa,CAAC,aAAa,CAAC;QACpC,aAAa,GAAG,CAAC;QAEjB,MAAM,OAAO,EAAE,CAAA;IACjB,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,OAAO;QACP,YAAY;QACZ,eAAe;QACf,aAAa;KACd,CAAC,CAAA;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,mBAAmB,CAC1B,MAA+B,EAC/B,WAAkC,EAClC,SAAiC;IAEjC,MAAM,GAAG,GAAG,MAAM,EAAE,IAAI,CAAC,IAAI,CAC3B,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,WAAW,CAAC,OAAO,CACjD,CAAA;IACD,IACE,CAAC,MAAM;QACP,CAAC,GAAG,EAAE,OAAO;QACb,GAAG,CAAC,KAAK,KAAK,QAAQ;QACtB,GAAG,CAAC,KAAK,KAAK,IAAI;QAClB,GAAG,CAAC,SAAS,KAAK,IAAI;QACtB,GAAG,CAAC,YAAY,KAAK,WAAW,CAAC,YAAY;QAC7C,GAAG,CAAC,eAAe,KAAK,WAAW,CAAC,eAAe;QACnD,SAAS,CAAC,UAAU,CAClB,MAAM,CAAC,QAAQ,EACf,WAAW,CAAC,YAAY,EACxB,WAAW,CAAC,eAAe,CAC5B;QAED,MAAM,IAAI,uBAAuB,CAC/B,eAAe,EACf,wEAAwE,CACzE,CAAA;AACL,CAAC;AAmBD,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,KAAoC;IAEpC,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,KAAK,CAAA;IAC1C,MAAM,WAAW,GAAG,cAAc,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;IACrD,MAAM,QAAQ,GAAG,WAAW,CAAC,eAAe,CAAA;IAC5C,OAAO,SAAS,CAAC,iBAAiB,CAChC,KAAK,CAAC,UAAU,EAChB,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE;QAC3B,mBAAmB,CAAC,MAAM,EAAE,WAAW,EAAE,SAAS,CAAC,CAAA;QACnD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,QAAQ,CAC9B,SAAS,EACT,yBAAyB,EACzB,KAAK,EAAE,SAAS,EAA2C,EAAE;YAC3D,MAAM,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;YAC/B,MAAM,IAAI,GAAG,MAAM,sBAAsB,CAAC,SAAS,CAAC,CAAA;YACpD,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;YACjD,MAAM,SAAS,GAAY,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;YAChD,IACE,QAAQ,CAAC,SAAS,CAAC;gBACnB,OAAQ,SAAgC,CAAC,IAAI,KAAK,UAAU;gBAE5D,MAAM,IAAI,uBAAuB,CAC/B,gBAAgB,EAChB,oCAAoC,CACrC,CAAA;YACH,IAAI,SAAS,KAAK,SAAS;gBACzB,OAAO,OAAO;oBACZ,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE;oBACzC,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAA;YAC7B,MAAM,QAAQ,GAAsC;gBAClD,GAAG,IAAI,CAAC,QAAQ;aACjB,CAAA;YACD,IAAI,IAAmC,CAAA;YACvC,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;gBACvB,IAAI,CAAC,OAAO;oBAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAA;gBAC5C,OAAO,QAAQ,CAAC,QAAQ,CAAC,CAAA;YAC3B,CAAC;iBAAM,CAAC;gBACN,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC;oBACnB,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC;wBACtB,OAAO,EAAE,WAAW,CAAC,OAAO;wBAC5B,YAAY,EAAE,WAAW,CAAC,YAAY;wBACtC,aAAa,EAAE,WAAW,CAAC,aAAa;qBACzC,CAAC;oBACF,GAAG,WAAW,CAAC,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC;iBAC7C,CAAC,CAAA;gBACF,QAAQ,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAA;YAC3B,CAAC;YACD,MAAM,OAAO,GAAG,wBAAwB,CAAC,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;YAC/D,IAAI,CAAC;gBACH,MAAM,EAAE,CAAC,eAAe,CAAC,SAAS,EAAE,OAAO,EAAE;oBAC3C,YAAY,EAAE,KAAK,IAAI,EAAE;wBACvB,MAAM,UAAU,CAAC,WAAW,EAAE,CAAA;wBAC9B,MAAM,SAAS,CAAC,WAAW,EAAE,CAAA;oBAC/B,CAAC;iBACF,CAAC,CAAA;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,QAAuC,CAAA;gBAC3C,IAAI,CAAC;oBACH,QAAQ,GAAG,iBAAiB,CAC1B,MAAM,sBAAsB,CAAC,SAAS,CAAC,EACvC,QAAQ,CACT,CAAA;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,QAAQ,GAAG,SAAS,CAAA;gBACtB,CAAC;gBACD,OAAO,QAAQ;oBACb,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE;oBACjD,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,CAAA;YACpC,CAAC;YACD,OAAO,IAAI;gBACT,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE;gBACpC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;QAC3B,CAAC,CACF,CAAA;QACD,OAAO,EAAE,MAAM,EAAE,CAAA;IACnB,CAAC,CACF,CAAA;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cortexkit/antigravity-auth-core",
-  "version": "2.2.1",
+  "version": "3.0.1",
   "description": "Harness-agnostic core for Google Antigravity OAuth: transport, fingerprint, request transforms, accounts, quota",
   "type": "module",
   "license": "MIT",
@@ -17,6 +17,10 @@
       "import": "./dist/index.js",
       "types": "./dist/index.d.ts"
     },
+    "./account-identity": {
+      "types": "./dist/account-identity.d.ts",
+      "import": "./dist/account-identity.js"
+    },
     "./file-lock": {
       "types": "./dist/file-lock.d.ts",
       "import": "./dist/file-lock.js"
@@ -28,6 +32,38 @@
     "./fetch-timeout": {
       "types": "./dist/fetch-timeout.d.ts",
       "import": "./dist/fetch-timeout.js"
+    },
+    "./common-auth/store": {
+      "types": "./dist/common-auth-embedded/store/index.d.ts",
+      "import": "./dist/common-auth-embedded/store/index.js"
+    },
+    "./common-auth/fs": {
+      "types": "./dist/common-auth-embedded/fs/index.d.ts",
+      "import": "./dist/common-auth-embedded/fs/index.js"
+    },
+    "./common-auth/routing": {
+      "types": "./dist/common-auth-embedded/routing/index.d.ts",
+      "import": "./dist/common-auth-embedded/routing/index.js"
+    },
+    "./common-auth/quota": {
+      "types": "./dist/common-auth-embedded/quota/index.d.ts",
+      "import": "./dist/common-auth-embedded/quota/index.js"
+    },
+    "./common-auth/commands": {
+      "types": "./dist/common-auth-embedded/commands/index.d.ts",
+      "import": "./dist/common-auth-embedded/commands/index.js"
+    },
+    "./common-auth/auth-menu": {
+      "types": "./dist/common-auth-embedded/auth-menu/index.d.ts",
+      "import": "./dist/common-auth-embedded/auth-menu/index.js"
+    },
+    "./common-auth/claustrum": {
+      "types": "./dist/common-auth-embedded/claustrum/index.d.ts",
+      "import": "./dist/common-auth-embedded/claustrum/index.js"
+    },
+    "./common-auth/logger": {
+      "types": "./dist/common-auth-embedded/logger/index.d.ts",
+      "import": "./dist/common-auth-embedded/logger/index.js"
     }
   },
   "files": [
@@ -36,12 +72,13 @@
     "LICENSE"
   ],
   "scripts": {
-    "build": "rm -rf dist && tsc -p tsconfig.build.json",
+    "build": "rm -rf dist && tsc -p tsconfig.build.json && bun scripts/copy-common-auth-embedded.mjs",
     "typecheck": "tsc --noEmit",
     "test": "bun test --isolate ./src",
     "prepublishOnly": "bun run build"
   },
   "dependencies": {
+    "@cortexkit/claustrum-client": "0.6.2",
     "xdg-basedir": "^5.1.0",
     "zod": "^4.0.0"
   },