@cortexkit/opencode-antigravity-auth 2.2.1 → 3.0.0

package/dist/types/src/hooks/auto-update-checker/index.d.ts

@@ -0,0 +1,34 @@
+import type { AutoUpdateCheckerOptions } from './types.js';
+interface PluginClient {
+    tui: {
+        showToast(options: {
+            body: {
+                title?: string;
+                message: string;
+                variant: 'info' | 'warning' | 'success' | 'error';
+                duration?: number;
+            };
+        }): Promise<unknown>;
+    };
+}
+interface SessionCreatedEvent {
+    type: 'session.created';
+    properties?: {
+        info?: {
+            parentID?: string;
+        };
+    };
+}
+type PluginEvent = SessionCreatedEvent | {
+    type: string;
+    properties?: unknown;
+};
+export declare function createAutoUpdateCheckerHook(client: PluginClient, directory: string, options?: AutoUpdateCheckerOptions): {
+    event: ({ event }: {
+        event: PluginEvent;
+    }) => void;
+};
+export { invalidateCache, invalidatePackage } from './cache.js';
+export { checkForUpdate, getCachedVersion, getLatestVersion } from './checker.js';
+export type { AutoUpdateCheckerOptions, UpdateCheckResult } from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/types/src/hooks/auto-update-checker/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/hooks/auto-update-checker/index.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,SAAS,CAAA;AAEvD,UAAU,YAAY;IACpB,GAAG,EAAE;QACH,SAAS,CAAC,OAAO,EAAE;YACjB,IAAI,EAAE;gBACJ,KAAK,CAAC,EAAE,MAAM,CAAA;gBACd,OAAO,EAAE,MAAM,CAAA;gBACf,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,GAAG,OAAO,CAAA;gBACjD,QAAQ,CAAC,EAAE,MAAM,CAAA;aAClB,CAAA;SACF,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;KACrB,CAAA;CACF;AAED,UAAU,mBAAmB;IAC3B,IAAI,EAAE,iBAAiB,CAAA;IACvB,UAAU,CAAC,EAAE;QACX,IAAI,CAAC,EAAE;YACL,QAAQ,CAAC,EAAE,MAAM,CAAA;SAClB,CAAA;KACF,CAAA;CACF;AAED,KAAK,WAAW,GAAG,mBAAmB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,CAAA;AAE/E,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,YAAY,EACpB,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,wBAA6B;uBAOjB;QAAE,KAAK,EAAE,WAAW,CAAA;KAAE;EA4B5C;AAuHD,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAA;AAC5D,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AAC9E,YAAY,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAA"}

package/dist/types/src/hooks/auto-update-checker/logging.d.ts

@@ -0,0 +1,3 @@
+export declare function formatAutoUpdateLogMessage(message: string): string;
+export declare function logAutoUpdate(message: string): void;
+//# sourceMappingURL=logging.d.ts.map

package/dist/types/src/hooks/auto-update-checker/logging.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logging.d.ts","sourceRoot":"","sources":["../../../../../src/hooks/auto-update-checker/logging.ts"],"names":[],"mappings":"AAIA,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAElE;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAEnD"}

package/dist/types/src/hooks/auto-update-checker/types.d.ts

@@ -0,0 +1,25 @@
+export interface NpmDistTags {
+    latest: string;
+    [key: string]: string;
+}
+export interface OpencodeConfig {
+    plugin?: string[];
+    [key: string]: unknown;
+}
+export interface PackageJson {
+    version: string;
+    name?: string;
+    [key: string]: unknown;
+}
+export interface UpdateCheckResult {
+    needsUpdate: boolean;
+    currentVersion: string | null;
+    latestVersion: string | null;
+    isLocalDev: boolean;
+    isPinned: boolean;
+}
+export interface AutoUpdateCheckerOptions {
+    showStartupToast?: boolean;
+    autoUpdate?: boolean;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types/src/hooks/auto-update-checker/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/hooks/auto-update-checker/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAA;IACd,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;IACjB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB;AAED,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,OAAO,CAAA;IACpB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,UAAU,EAAE,OAAO,CAAA;IACnB,QAAQ,EAAE,OAAO,CAAA;CAClB;AAED,MAAM,WAAW,wBAAwB;IACvC,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B,UAAU,CAAC,EAAE,OAAO,CAAA;CACrB"}

package/dist/types/src/logging/provider-key-policy.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Structured provider logs fully mask credential and account-correlating keys.
+ * Event IDs and diagnostic fields are intentionally not classified as secrets.
+ * The public logger supplies lowercase keys with hyphens/underscores removed.
+ * Keeping this policy dependency-free lets the TUI use it without loading any
+ * provider state, storage, debug streams or OAuth code.
+ */
+export declare function isProviderSecretKey(normalizedKey: string): boolean;
+//# sourceMappingURL=provider-key-policy.d.ts.map

package/dist/types/src/logging/provider-key-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-key-policy.d.ts","sourceRoot":"","sources":["../../../../src/logging/provider-key-policy.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAIlE"}

package/dist/types/src/plugin/account-access.d.ts

@@ -0,0 +1,214 @@
+import { type AccountRepository, type AccountRow, type RowRef } from '@cortexkit/antigravity-auth-core';
+import type { AntigravityTokenExchangeResult } from '../antigravity/oauth.js';
+import { type AccountAccessBlock, type VerificationProbeResult } from './account-blocks.js';
+import { fetchWithAgyCliTransport } from './agy-transport.js';
+import type { AccountMetadataV3, AccountStorageV4 } from './storage.js';
+import { refreshAccessToken } from './token.js';
+import type { PluginClient } from './types.js';
+export type { VerificationProbeResult };
+export interface AccountIdentity {
+    refreshToken?: string;
+    email?: string;
+}
+export interface AccountAccessStore {
+    load(): Promise<AccountStorageV4 | null>;
+    mutate(mutate: (current: AccountStorageV4) => AccountStorageV4 | undefined | Promise<AccountStorageV4 | undefined>): Promise<AccountStorageV4>;
+    clear(): Promise<void>;
+    persistAccountPool(results: Array<Extract<AntigravityTokenExchangeResult, {
+        type: 'success';
+    }>>, replaceAll: boolean): Promise<void>;
+    /**
+     * Which source serves the location's accounts: the pool file before
+     * migration, else the account store's repository. Absent: the pool file.
+     */
+    source?(): Promise<'pool-file' | AccountRepository>;
+}
+export interface AccountAccessPrompt {
+    selectAccount(accounts: Array<{
+        email?: string;
+        index: number;
+    }>): Promise<number | undefined>;
+    confirmOpenVerificationUrl(): Promise<boolean>;
+}
+export interface AccountAccessService {
+    loadAccounts(): Promise<AccountStorageV4 | null>;
+    mutateAccounts(mutate: (current: AccountStorageV4) => AccountStorageV4 | undefined | Promise<AccountStorageV4 | undefined>): Promise<AccountStorageV4>;
+    clearAccounts(): Promise<void>;
+    persistAccountPool(results: Array<Extract<AntigravityTokenExchangeResult, {
+        type: 'success';
+    }>>, replaceAll: boolean): Promise<void>;
+    verifyAccount(account: {
+        refreshToken: string;
+        email?: string;
+        projectId?: string;
+        managedProjectId?: string;
+    }): Promise<VerificationProbeResult>;
+    applyVerificationResult(identity: AccountIdentity, result: VerificationProbeResult): Promise<void>;
+    clearAccessBlocks(identity: AccountIdentity, enableIfBlocked?: boolean): Promise<{
+        changed: boolean;
+        wasAccessBlocked: boolean;
+    }>;
+    selectAccount(accounts: Array<{
+        email?: string;
+        index: number;
+    }>): Promise<number | undefined>;
+    openVerificationUrl(url: string): Promise<boolean>;
+    /** The store's `source`: the pool file, or the account store's repository. */
+    source(): Promise<'pool-file' | AccountRepository>;
+    /**
+     * The ref-addressed access operations over the account store's
+     * repository, with this service's prompt, browser and transport. Store-mode
+     * callers use these instead of the pool-file operations above.
+     */
+    repositoryAccess(repository: AccountRepository): RepositoryAccountAccessService;
+}
+interface AccountAccessDependencies {
+    refreshAccessToken: typeof refreshAccessToken;
+    transport: typeof fetchWithAgyCliTransport;
+}
+interface CreateAccountAccessServiceOptions {
+    client: PluginClient;
+    providerId: string;
+    store: AccountAccessStore;
+    openBrowser(url: string): Promise<boolean>;
+    prompt: AccountAccessPrompt;
+    dependencies?: Partial<AccountAccessDependencies>;
+}
+export declare function normalizeGoogleVerificationUrl(rawUrl: string): string | undefined;
+export declare function selectBestVerificationUrl(urls: string[]): string | undefined;
+export declare function extractAccountAccessErrorDetails(bodyText: string): {
+    validationRequired: boolean;
+    accountIneligible: boolean;
+    message?: string;
+    verifyUrl?: string;
+};
+export declare function buildAccountAccessProbeRequest(projectId: string): Record<string, unknown>;
+export declare function interpretAccountAccessProbeResponse(response: Response): Promise<VerificationProbeResult>;
+type VerificationStoredAccount = AccountMetadataV3;
+export declare function markStoredAccountVerificationRequired(account: VerificationStoredAccount, reason: string, verifyUrl?: string): boolean;
+export declare function markStoredAccountIneligible(account: VerificationStoredAccount, reason: string): boolean;
+export declare function clearStoredAccountAccessBlocks(account: VerificationStoredAccount, enableIfBlocked?: boolean): {
+    changed: boolean;
+    wasAccessBlocked: boolean;
+};
+export declare function createAccountAccessService({ client, providerId, store, openBrowser, prompt, dependencies, }: CreateAccountAccessServiceOptions): AccountAccessService;
+/** Exact text shown when a re-authentication lost its row. */
+export declare const ACCOUNT_CHANGED_DURING_REAUTHORIZATION_MESSAGE = "Account changed during reauthorization. Reopen the account dialog.";
+/**
+ * Thrown when a re-authentication cannot land on the row it was started
+ * for: the row was removed, re-added or given another credential since the
+ * dialog captured it, or the browser signed in to a different account than
+ * the row holds. Nothing is written.
+ */
+export declare class AccountChangedDuringReauthorizationError extends Error {
+    readonly rowId: string;
+    constructor(rowId: string, options?: {
+        cause?: unknown;
+    });
+}
+/**
+ * Thrown when the account store cannot list accounts (pending migration or
+ * management operation, unreadable file). Nothing falls back to the pool
+ * file or to an empty list.
+ */
+export declare class AccountStoreUnavailableError extends Error {
+    readonly status: 'pending-migration' | 'management-pending' | 'error';
+    constructor(status: AccountStoreUnavailableError['status'], detail: string);
+}
+/**
+ * One account as an access dialog shows it. `ref` is captured when the list
+ * is read; every later action on the entry uses it, never the position, so
+ * an entry whose row was reordered, removed or re-authenticated meanwhile
+ * is refused rather than redirected to whatever row sits there now.
+ */
+export interface AccountAccessView {
+    ref: RowRef;
+    /** Roster position at read time; presentation only. */
+    index: number;
+    email?: string;
+    label?: string;
+    enabled: boolean;
+    block: AccountAccessBlock;
+    projectId?: string;
+    managedProjectId?: string;
+}
+export type VerificationOutcome = {
+    /** The probe ran with a bearer refreshed for exactly `ref`. */
+    status: 'probed';
+    ref: RowRef;
+    result: VerificationProbeResult;
+    observedAt: number;
+} | {
+    /** No bearer was obtained; nothing about access was learnt. */
+    status: 'not-probed';
+    ref: RowRef;
+    result: Extract<VerificationProbeResult, {
+        status: 'error';
+    }>;
+};
+export type AccessVerdictOutcome = {
+    status: 'applied';
+    ref: RowRef;
+    declined: boolean;
+}
+/** The probe proved nothing about access, so nothing was written. */
+ | {
+    status: 'no-verdict';
+}
+/** The row no longer holds the probed credential; nothing was written. */
+ | {
+    status: 'stale';
+    rowId: string;
+};
+export interface RepositoryAccountAccessService {
+    listAccounts(): Promise<AccountAccessView[]>;
+    verifyAccount(account: Pick<AccountAccessView, 'ref'>): Promise<VerificationOutcome>;
+    applyVerificationResult(outcome: VerificationOutcome, options?: {
+        enableIfBlocked?: boolean;
+    }): Promise<AccessVerdictOutcome>;
+    reauthorizeAccount(expected: RowRef, result: Extract<AntigravityTokenExchangeResult, {
+        type: 'success';
+    }>): Promise<{
+        ref: RowRef;
+    }>;
+    selectAccount(accounts: Array<{
+        email?: string;
+        index: number;
+    }>): Promise<number | undefined>;
+    openVerificationUrl(url: string): Promise<boolean>;
+}
+interface CreateRepositoryAccountAccessServiceOptions {
+    repository: AccountRepository;
+    openBrowser(url: string): Promise<boolean>;
+    prompt: AccountAccessPrompt;
+    now?: () => number;
+    transport?: typeof fetchWithAgyCliTransport;
+}
+/**
+ * A pool-file shaped view of account-store rows, for menus and listings that
+ * still render the pool-file record. Each view's position equals the row's
+ * index in `rows`, so a caller that keeps `rows[i].ref` beside it acts on
+ * the exact row the user picked. The view is for display; it is never
+ * written back.
+ */
+export declare function storageViewOfRows(rows: readonly AccountRow[]): AccountStorageV4;
+/**
+ * The access service over the account repository. Every operation names its
+ * row by the `RowRef` captured when the account list was read:
+ * - verification refreshes the bearer through `AccountRepository.refresh`
+ *   on that ref (the stored credential, fenced by the store), never with a
+ *   token copied out of an earlier read;
+ * - the verdict is recorded with `recordAccessVerdict` on the ref the
+ *   refresh confirmed, timestamped when the answer arrived, so a late
+ *   verdict cannot undo newer evidence and a verdict about a replaced or
+ *   re-added credential is refused;
+ * - re-authentication replaces the credential of exactly that ref
+ *   (`replaceCredential`), keeping a user's disabled choice.
+ */
+export declare function createRepositoryAccountAccessService({ repository, openBrowser, prompt, now, transport, }: CreateRepositoryAccountAccessServiceOptions): RepositoryAccountAccessService;
+export declare function promptAccountIndexForVerification(accounts: Array<{
+    email?: string;
+    index: number;
+}>): Promise<number | undefined>;
+export declare function promptOpenVerificationUrl(): Promise<boolean>;
+//# sourceMappingURL=account-access.d.ts.map

package/dist/types/src/plugin/account-access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-access.d.ts","sourceRoot":"","sources":["../../../../src/plugin/account-access.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,iBAAiB,EAEtB,KAAK,UAAU,EACf,KAAK,MAAM,EAEZ,MAAM,kCAAkC,CAAA;AACzC,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,sBAAsB,CAAA;AAK1E,OAAO,EACL,KAAK,kBAAkB,EAMvB,KAAK,uBAAuB,EAC7B,MAAM,kBAAkB,CAAA;AAMzB,OAAO,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAA;AAG1D,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AACpE,OAAO,EAAgC,kBAAkB,EAAE,MAAM,SAAS,CAAA;AAC1E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAE3C,YAAY,EAAE,uBAAuB,EAAE,CAAA;AAEvC,MAAM,WAAW,eAAe;IAC9B,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,IAAI,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAA;IACxC,MAAM,CACJ,MAAM,EAAE,CACN,OAAO,EAAE,gBAAgB,KACtB,gBAAgB,GAAG,SAAS,GAAG,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,GACxE,OAAO,CAAC,gBAAgB,CAAC,CAAA;IAC5B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;IACtB,kBAAkB,CAChB,OAAO,EAAE,KAAK,CACZ,OAAO,CAAC,8BAA8B,EAAE;QAAE,IAAI,EAAE,SAAS,CAAA;KAAE,CAAC,CAC7D,EACD,UAAU,EAAE,OAAO,GAClB,OAAO,CAAC,IAAI,CAAC,CAAA;IAChB;;;OAGG;IACH,MAAM,CAAC,IAAI,OAAO,CAAC,WAAW,GAAG,iBAAiB,CAAC,CAAA;CACpD;AAED,MAAM,WAAW,mBAAmB;IAClC,aAAa,CACX,QAAQ,EAAE,KAAK,CAAC;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,GACjD,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAA;IAC9B,0BAA0B,IAAI,OAAO,CAAC,OAAO,CAAC,CAAA;CAC/C;AAED,MAAM,WAAW,oBAAoB;IACnC,YAAY,IAAI,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAA;IAChD,cAAc,CACZ,MAAM,EAAE,CACN,OAAO,EAAE,gBAAgB,KACtB,gBAAgB,GAAG,SAAS,GAAG,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,GACxE,OAAO,CAAC,gBAAgB,CAAC,CAAA;IAC5B,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;IAC9B,kBAAkB,CAChB,OAAO,EAAE,KAAK,CACZ,OAAO,CAAC,8BAA8B,EAAE;QAAE,IAAI,EAAE,SAAS,CAAA;KAAE,CAAC,CAC7D,EACD,UAAU,EAAE,OAAO,GAClB,OAAO,CAAC,IAAI,CAAC,CAAA;IAChB,aAAa,CAAC,OAAO,EAAE;QACrB,YAAY,EAAE,MAAM,CAAA;QACpB,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB,gBAAgB,CAAC,EAAE,MAAM,CAAA;KAC1B,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAA;IACpC,uBAAuB,CACrB,QAAQ,EAAE,eAAe,EACzB,MAAM,EAAE,uBAAuB,GAC9B,OAAO,CAAC,IAAI,CAAC,CAAA;IAChB,iBAAiB,CACf,QAAQ,EAAE,eAAe,EACzB,eAAe,CAAC,EAAE,OAAO,GACxB,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,gBAAgB,EAAE,OAAO,CAAA;KAAE,CAAC,CAAA;IAC3D,aAAa,CACX,QAAQ,EAAE,KAAK,CAAC;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,GACjD,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAA;IAC9B,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAClD,8EAA8E;IAC9E,MAAM,IAAI,OAAO,CAAC,WAAW,GAAG,iBAAiB,CAAC,CAAA;IAClD;;;;OAIG;IACH,gBAAgB,CACd,UAAU,EAAE,iBAAiB,GAC5B,8BAA8B,CAAA;CAClC;AAED,UAAU,yBAAyB;IACjC,kBAAkB,EAAE,OAAO,kBAAkB,CAAA;IAC7C,SAAS,EAAE,OAAO,wBAAwB,CAAA;CAC3C;AAED,UAAU,iCAAiC;IACzC,MAAM,EAAE,YAAY,CAAA;IACpB,UAAU,EAAE,MAAM,CAAA;IAClB,KAAK,EAAE,kBAAkB,CAAA;IACzB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAC1C,MAAM,EAAE,mBAAmB,CAAA;IAC3B,YAAY,CAAC,EAAE,OAAO,CAAC,yBAAyB,CAAC,CAAA;CAClD;AAUD,wBAAgB,8BAA8B,CAC5C,MAAM,EAAE,MAAM,GACb,MAAM,GAAG,SAAS,CAWpB;AAED,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,SAAS,CAoB5E;AAED,wBAAgB,gCAAgC,CAAC,QAAQ,EAAE,MAAM,GAAG;IAClE,kBAAkB,EAAE,OAAO,CAAA;IAC3B,iBAAiB,EAAE,OAAO,CAAA;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,CAoHA;AAED,wBAAgB,8BAA8B,CAC5C,SAAS,EAAE,MAAM,GAChB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAuBzB;AAED,wBAAsB,mCAAmC,CACvD,QAAQ,EAAE,QAAQ,GACjB,OAAO,CAAC,uBAAuB,CAAC,CAmClC;AAED,KAAK,yBAAyB,GAAG,iBAAiB,CAAA;AAElD,wBAAgB,qCAAqC,CACnD,OAAO,EAAE,yBAAyB,EAClC,MAAM,EAAE,MAAM,EACd,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAET;AAED,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,yBAAyB,EAClC,MAAM,EAAE,MAAM,GACb,OAAO,CAET;AAED,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,yBAAyB,EAClC,eAAe,UAAQ,GACtB;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,gBAAgB,EAAE,OAAO,CAAA;CAAE,CAEjD;AAiED,wBAAgB,0BAA0B,CAAC,EACzC,MAAM,EACN,UAAU,EACV,KAAK,EACL,WAAW,EACX,MAAM,EACN,YAAY,GACb,EAAE,iCAAiC,GAAG,oBAAoB,CA0H1D;AAMD,8DAA8D;AAC9D,eAAO,MAAM,8CAA8C,uEACW,CAAA;AAEtE;;;;;GAKG;AACH,qBAAa,wCAAyC,SAAQ,KAAK;IACjE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;gBAEV,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAKzD;AAED;;;;GAIG;AACH,qBAAa,4BAA6B,SAAQ,KAAK;IACrD,QAAQ,CAAC,MAAM,EAAE,mBAAmB,GAAG,oBAAoB,GAAG,OAAO,CAAA;gBAEzD,MAAM,EAAE,4BAA4B,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,MAAM;CAK3E;AAED;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAA;IACX,uDAAuD;IACvD,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,OAAO,CAAA;IAChB,KAAK,EAAE,kBAAkB,CAAA;IACzB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B;AAED,MAAM,MAAM,mBAAmB,GAC3B;IACE,+DAA+D;IAC/D,MAAM,EAAE,QAAQ,CAAA;IAChB,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,EAAE,uBAAuB,CAAA;IAC/B,UAAU,EAAE,MAAM,CAAA;CACnB,GACD;IACE,+DAA+D;IAC/D,MAAM,EAAE,YAAY,CAAA;IACpB,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,EAAE,OAAO,CAAC,uBAAuB,EAAE;QAAE,MAAM,EAAE,OAAO,CAAA;KAAE,CAAC,CAAA;CAC9D,CAAA;AAEL,MAAM,MAAM,oBAAoB,GAC5B;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAE;AACvD,qEAAqE;GACnE;IAAE,MAAM,EAAE,YAAY,CAAA;CAAE;AAC1B,0EAA0E;GACxE;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAA;AAEtC,MAAM,WAAW,8BAA8B;IAC7C,YAAY,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAA;IAC5C,aAAa,CACX,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE,KAAK,CAAC,GACtC,OAAO,CAAC,mBAAmB,CAAC,CAAA;IAC/B,uBAAuB,CACrB,OAAO,EAAE,mBAAmB,EAC5B,OAAO,CAAC,EAAE;QAAE,eAAe,CAAC,EAAE,OAAO,CAAA;KAAE,GACtC,OAAO,CAAC,oBAAoB,CAAC,CAAA;IAChC,kBAAkB,CAChB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,OAAO,CAAC,8BAA8B,EAAE;QAAE,IAAI,EAAE,SAAS,CAAA;KAAE,CAAC,GACnE,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC3B,aAAa,CACX,QAAQ,EAAE,KAAK,CAAC;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,GACjD,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAA;IAC9B,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CACnD;AAED,UAAU,2CAA2C;IACnD,UAAU,EAAE,iBAAiB,CAAA;IAC7B,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAC1C,MAAM,EAAE,mBAAmB,CAAA;IAC3B,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;IAClB,SAAS,CAAC,EAAE,OAAO,wBAAwB,CAAA;CAC5C;AAyBD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,SAAS,UAAU,EAAE,GAC1B,gBAAgB,CA+ClB;AAWD;;;;;;;;;;;;GAYG;AACH,wBAAgB,oCAAoC,CAAC,EACnD,UAAU,EACV,WAAW,EACX,MAAM,EACN,GAAsB,EACtB,SAAoC,GACrC,EAAE,2CAA2C,GAAG,8BAA8B,CA0K9E;AAED,wBAAsB,iCAAiC,CACrD,QAAQ,EAAE,KAAK,CAAC;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,GACjD,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAoC7B;AAED,wBAAsB,yBAAyB,IAAI,OAAO,CAAC,OAAO,CAAC,CAclE"}

package/dist/types/src/plugin/account-blocks.d.ts

@@ -0,0 +1,102 @@
+/**
+ * Account access blocks (Google "verification required" and "account
+ * ineligible") as plain data, with no host SDK, client or storage import,
+ * so any host composition can share them.
+ *
+ * Two kinds of record carry the same block fields: the pre-store pool
+ * file's `AccountMetadataV3` (fields absent or set) and the repository's
+ * `ProviderMetadata` (fields absent, `null` or set). Readers here accept
+ * both; a `null` means the same as an absent field.
+ *
+ * The two blocks are mutually exclusive: marking one clears the other.
+ * For repository rows the rule is applied by the repository itself, under
+ * the row lock, from an `AccessVerdict`; `accessVerdictFromProbe` builds
+ * that verdict. The `markLegacy*`/`clearLegacy*` helpers below apply the
+ * same rule in place to a pre-store record.
+ */
+import type { AccessVerdict } from '@cortexkit/antigravity-auth-core';
+/** The block fields both record kinds share. */
+export interface AccessBlockFields {
+    enabled?: boolean | null;
+    verificationRequired?: boolean | null;
+    verificationRequiredAt?: number | null;
+    verificationRequiredReason?: string | null;
+    verificationUrl?: string | null;
+    accountIneligible?: boolean | null;
+    accountIneligibleAt?: number | null;
+    accountIneligibleReason?: string | null;
+    eligibilityStateUpdatedAt?: number | null;
+}
+export type AccountAccessBlock = {
+    kind: 'none';
+} | {
+    kind: 'verification-required';
+    reason?: string;
+    verificationUrl?: string;
+    at?: number;
+} | {
+    kind: 'ineligible';
+    reason?: string;
+    at?: number;
+};
+/** The outcome of one access probe against the Antigravity endpoint. */
+export type VerificationProbeResult = {
+    status: 'ok';
+    message: string;
+} | {
+    status: 'ineligible';
+    message: string;
+} | {
+    status: 'verification-required';
+    message: string;
+    verifyUrl?: string;
+} | {
+    status: 'error';
+    message: string;
+};
+/**
+ * The block a record shows. Ineligibility wins when a record written by an
+ * older build carries both flags, because it is the stronger refusal.
+ */
+export declare function accessBlockOf(fields: AccessBlockFields | undefined): AccountAccessBlock;
+export declare function isAccessBlocked(fields: AccessBlockFields | undefined): boolean;
+/**
+ * The repository verdict for a probe result observed at `observedAt`, or
+ * `undefined` when the probe proved nothing about access (`error`). An `ok`
+ * probe clears both blocks; `enableIfBlocked` asks the repository to
+ * re-enable the row only when it was disabled by a block, never a row the
+ * user disabled.
+ */
+export declare function accessVerdictFromProbe(result: VerificationProbeResult, observedAt: number, enableIfBlocked: boolean): AccessVerdict | undefined;
+/** A pre-store record the legacy helpers change in place. */
+export interface LegacyAccessBlockRecord {
+    enabled?: boolean;
+    verificationRequired?: boolean;
+    verificationRequiredAt?: number;
+    verificationRequiredReason?: string;
+    verificationUrl?: string;
+    accountIneligible?: boolean;
+    accountIneligibleAt?: number;
+    accountIneligibleReason?: string;
+    eligibilityStateUpdatedAt?: number;
+}
+/**
+ * Marks a pre-store record as needing verification and disables it,
+ * clearing any ineligibility. Returns whether anything changed.
+ */
+export declare function markLegacyVerificationRequired(account: LegacyAccessBlockRecord, reason: string, verifyUrl: string | undefined, now: number): boolean;
+/**
+ * Marks a pre-store record ineligible and disables it, clearing any
+ * verification requirement. Returns whether anything changed.
+ */
+export declare function markLegacyIneligible(account: LegacyAccessBlockRecord, reason: string, now: number): boolean;
+/**
+ * Clears both blocks on a pre-store record. With `enableIfBlocked` it
+ * re-enables the record only when a block was set, so a record the user
+ * disabled stays disabled.
+ */
+export declare function clearLegacyAccessBlocks(account: LegacyAccessBlockRecord, enableIfBlocked: boolean, now: number): {
+    changed: boolean;
+    wasAccessBlocked: boolean;
+};
+//# sourceMappingURL=account-blocks.d.ts.map

package/dist/types/src/plugin/account-blocks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-blocks.d.ts","sourceRoot":"","sources":["../../../../src/plugin/account-blocks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kCAAkC,CAAA;AAErE,gDAAgD;AAChD,MAAM,WAAW,iBAAiB;IAChC,OAAO,CAAC,EAAE,OAAO,GAAG,IAAI,CAAA;IACxB,oBAAoB,CAAC,EAAE,OAAO,GAAG,IAAI,CAAA;IACrC,sBAAsB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACtC,0BAA0B,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1C,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,iBAAiB,CAAC,EAAE,OAAO,GAAG,IAAI,CAAA;IAClC,mBAAmB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACnC,uBAAuB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACvC,yBAAyB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAC1C;AAED,MAAM,MAAM,kBAAkB,GAC1B;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAChB;IACE,IAAI,EAAE,uBAAuB,CAAA;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,EAAE,CAAC,EAAE,MAAM,CAAA;CACZ,GACD;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAA;CAAE,CAAA;AAExD,wEAAwE;AACxE,MAAM,MAAM,uBAAuB,GAC/B;IAAE,MAAM,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACjC;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACzC;IACE,MAAM,EAAE,uBAAuB,CAAA;IAC/B,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,GACD;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAA;AAMxC;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,iBAAiB,GAAG,SAAS,GACpC,kBAAkB,CAuBpB;AAED,wBAAgB,eAAe,CAC7B,MAAM,EAAE,iBAAiB,GAAG,SAAS,GACpC,OAAO,CAET;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,uBAAuB,EAC/B,UAAU,EAAE,MAAM,EAClB,eAAe,EAAE,OAAO,GACvB,aAAa,GAAG,SAAS,CAmB3B;AAED,6DAA6D;AAC7D,MAAM,WAAW,uBAAuB;IACtC,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,oBAAoB,CAAC,EAAE,OAAO,CAAA;IAC9B,sBAAsB,CAAC,EAAE,MAAM,CAAA;IAC/B,0BAA0B,CAAC,EAAE,MAAM,CAAA;IACnC,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAC3B,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC,yBAAyB,CAAC,EAAE,MAAM,CAAA;CACnC;AAED;;;GAGG;AACH,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,uBAAuB,EAChC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,GAAG,EAAE,MAAM,GACV,OAAO,CA8CT;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,uBAAuB,EAChC,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,GACV,OAAO,CAsBT;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,uBAAuB,EAChC,eAAe,EAAE,OAAO,EACxB,GAAG,EAAE,MAAM,GACV;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,gBAAgB,EAAE,OAAO,CAAA;CAAE,CA2CjD"}

package/dist/types/src/plugin/account-command-oauth.d.ts

@@ -0,0 +1,34 @@
+import type { AntigravityAuthorization, AntigravityTokenExchangeResult } from '../antigravity/oauth.js';
+import type { CommandAccountRow } from './command-data.js';
+type OAuthSuccess = Extract<AntigravityTokenExchangeResult, {
+    type: 'success';
+}>;
+export interface AccountCommandOAuthServiceOptions {
+    authorize: () => Promise<AntigravityAuthorization>;
+    exchange: (code: string, state: string) => Promise<AntigravityTokenExchangeResult>;
+    persist: (result: OAuthSuccess) => Promise<void>;
+    listAccounts: () => Promise<CommandAccountRow[]>;
+    /**
+     * Optional hook invoked AFTER persist completes successfully. The plugin
+     * uses it to refresh the live AccountManager so the new account is
+     * visible to routing immediately, without waiting for an auth reload.
+     * Failures are swallowed — the OAuth flow still reports success and the
+     * next periodic AccountManager reload picks up the new account.
+     */
+    onAfterPersist?: (result: OAuthSuccess) => Promise<void> | void;
+    now?: () => number;
+}
+export interface AccountCommandOAuthService {
+    start(sessionId: string): Promise<{
+        url: string;
+        accounts: CommandAccountRow[];
+    }>;
+    finish(sessionId: string, callbackInput: string, label?: string): Promise<{
+        text: string;
+        accounts: CommandAccountRow[];
+    }>;
+    dispose(): void;
+}
+export declare function createAccountCommandOAuthService(options: AccountCommandOAuthServiceOptions): AccountCommandOAuthService;
+export {};
+//# sourceMappingURL=account-command-oauth.d.ts.map

package/dist/types/src/plugin/account-command-oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-command-oauth.d.ts","sourceRoot":"","sources":["../../../../src/plugin/account-command-oauth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,wBAAwB,EACxB,8BAA8B,EAC/B,MAAM,sBAAsB,CAAA;AAC7B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAGvD,KAAK,YAAY,GAAG,OAAO,CAAC,8BAA8B,EAAE;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,CAAC,CAAA;AAShF,MAAM,WAAW,iCAAiC;IAChD,SAAS,EAAE,MAAM,OAAO,CAAC,wBAAwB,CAAC,CAAA;IAClD,QAAQ,EAAE,CACR,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,KACV,OAAO,CAAC,8BAA8B,CAAC,CAAA;IAC5C,OAAO,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IAChD,YAAY,EAAE,MAAM,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAA;IAChD;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;IAC/D,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,0BAA0B;IACzC,KAAK,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;QAChC,GAAG,EAAE,MAAM,CAAA;QACX,QAAQ,EAAE,iBAAiB,EAAE,CAAA;KAC9B,CAAC,CAAA;IACF,MAAM,CACJ,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EACrB,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC;QACT,IAAI,EAAE,MAAM,CAAA;QACZ,QAAQ,EAAE,iBAAiB,EAAE,CAAA;KAC9B,CAAC,CAAA;IACF,OAAO,IAAI,IAAI,CAAA;CAChB;AAKD,wBAAgB,gCAAgC,CAC9C,OAAO,EAAE,iCAAiC,GACzC,0BAA0B,CAgK5B"}

package/dist/types/src/plugin/accounts.d.ts

@@ -0,0 +1,94 @@
+import { type AccountManagerOptions, type AccountRepository, type AccountRepositoryRead, AccountManager as CoreAccountManager, type ManagedAccount as CoreManagedAccount, type OAuthAuthDetails as CoreOAuthAuthDetails, type ProjectContextResult, type RowRef } from '@cortexkit/antigravity-auth-core';
+import { type CapturedLocalGrant, StaleLocalGrantError } from './shared/local-grant.js';
+import { loadAccounts } from './storage.js';
+import type { OAuthAuthDetails } from './types.js';
+export type { AccountModelFamily as ModelFamily, AccountSessionIdentity, CooldownReason, HeaderStyle, ManagedAccount, RateLimitReason, } from '@cortexkit/antigravity-auth-core';
+export { calculateBackoffMs, computeSoftQuotaCacheTtlMs, parseRateLimitReason, resolveQuotaGroup, } from '@cortexkit/antigravity-auth-core';
+/**
+ * Thrown when the account store cannot serve accounts: a migration or a
+ * multi-row operation is pending, or a store file is unreadable. Routing
+ * must stop here; nothing falls back to the pool file or to an empty pool.
+ */
+export declare class AccountStoreNotReadyError extends Error {
+    readonly read: Exclude<AccountRepositoryRead, {
+        status: 'ready';
+    }>;
+    constructor(read: Exclude<AccountRepositoryRead, {
+        status: 'ready';
+    }>);
+}
+/**
+ * Builds a manager over the account repository from one read. Every account
+ * the manager holds carries the `RowRef` of the row it was read from: the
+ * row id, the credential epoch and the exact recorded identity (an absent
+ * identity matches only an absent one). Every write the manager makes about
+ * the account is fenced on that ref, so a write for a credential the row
+ * has since replaced is refused; positions are never used.
+ * Refreshes go through `refreshAccount`, the repository's per-account
+ * refresh, so different accounts refresh concurrently while one account's
+ * refreshes are serialized.
+ */
+export declare function loadAccountManagerFromRepository(repository: AccountRepository, options?: Partial<Omit<AccountManagerOptions, 'store' | 'storagePath' | 'repository'>>): Promise<CoreAccountManager>;
+/**
+ * Token and project operations for accounts of a repository-backed manager,
+ * for the shared request engine's local source: the refresh token is stored
+ * locally and refreshed here. A vault-backed location never uses these; it
+ * obtains a fresh token and project for every send.
+ */
+export interface LocalAccountCredentials {
+    /** Capture the selected row; resolution may adopt only that row's current credential. */
+    captureGrant(request: {
+        account: CoreManagedAccount;
+        accessToken: string;
+    }): Extract<CapturedLocalGrant, {
+        source: 'store';
+    }>;
+    /**
+     * Refreshes the locally stored refresh token of `account` through the
+     * repository, fenced on the ref the account was loaded with, and returns
+     * its updated credential. A refresh
+     * the store refused, or one where Google answered for another account,
+     * returns `undefined`: no bearer is handed out for it. Failures (Google's
+     * error answers included, see `isInvalidGrant`) are thrown.
+     */
+    refresh(account: CoreManagedAccount): Promise<CoreOAuthAuthDetails | undefined>;
+    /** Resolves the Antigravity project a request is sent under, using the cached project context. */
+    ensureProject(auth: CoreOAuthAuthDetails): Promise<ProjectContextResult>;
+    /** True when a refresh failure is `invalid_grant`: the refresh token is invalid or revoked. */
+    isInvalidGrant(error: unknown): boolean;
+    /**
+     * Check a captured bearer immediately before sending it. `ref` is the
+     * original row ID, credential epoch and authenticated identity captured
+     * with that token, not the account object's potentially changed ref.
+     *
+     * The manager must still hold the enabled selected account at that ref.
+     * One fresh repository read must show the same enabled row, a credential
+     * the native store marks usable, and present Antigravity provider metadata.
+     * Recheck the held account after the read because it may change during it.
+     * A different stored token at the unchanged ref raises
+     * `LocalGrantSupersededError`; other refusals raise `StaleAccountGrantError`.
+     * The held account must also still carry the captured token.
+     *
+     * This is a dispatch snapshot, not a lease or network lock. It never changes
+     * the prepared bearer, and the row can still change after the check returns.
+     */
+    assertGrantCurrent(request: {
+        account: CoreManagedAccount;
+        accessToken: string;
+        ref: RowRef;
+    }): Promise<void>;
+}
+/** The selected account no longer holds the credential a grant was made for. */
+export declare class StaleAccountGrantError extends StaleLocalGrantError {
+    constructor();
+}
+export declare function createLocalAccountCredentials(manager: CoreAccountManager, dependencies: {
+    /** The repository `manager` was loaded from. */
+    repository: Pick<AccountRepository, 'read'>;
+    ensureProject?: (auth: CoreOAuthAuthDetails) => Promise<ProjectContextResult>;
+}): LocalAccountCredentials;
+export declare class AccountManager extends CoreAccountManager {
+    constructor(authFallback?: OAuthAuthDetails, stored?: Awaited<ReturnType<typeof loadAccounts>>, options?: Partial<AccountManagerOptions>);
+    static loadFromDisk(authFallback?: OAuthAuthDetails): Promise<AccountManager>;
+}
+//# sourceMappingURL=accounts.d.ts.map

package/dist/types/src/plugin/accounts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"accounts.d.ts","sourceRoot":"","sources":["../../../../src/plugin/accounts.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC1B,cAAc,IAAI,kBAAkB,EACpC,KAAK,cAAc,IAAI,kBAAkB,EACzC,KAAK,gBAAgB,IAAI,oBAAoB,EAC7C,KAAK,oBAAoB,EACzB,KAAK,MAAM,EAEZ,MAAM,kCAAkC,CAAA;AAIzC,OAAO,EACL,KAAK,kBAAkB,EAEvB,oBAAoB,EACrB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAEL,YAAY,EAGb,MAAM,WAAW,CAAA;AAElB,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAA;AAE/C,YAAY,EACV,kBAAkB,IAAI,WAAW,EACjC,sBAAsB,EACtB,cAAc,EACd,WAAW,EACX,cAAc,EACd,eAAe,GAChB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EACL,kBAAkB,EAClB,0BAA0B,EAC1B,oBAAoB,EACpB,iBAAiB,GAClB,MAAM,kCAAkC,CAAA;AAoCzC;;;;GAIG;AACH,qBAAa,yBAA0B,SAAQ,KAAK;IAClD,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,qBAAqB,EAAE;QAAE,MAAM,EAAE,OAAO,CAAA;KAAE,CAAC,CAAA;gBAEtD,IAAI,EAAE,OAAO,CAAC,qBAAqB,EAAE;QAAE,MAAM,EAAE,OAAO,CAAA;KAAE,CAAC;CAWtE;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,gCAAgC,CACpD,UAAU,EAAE,iBAAiB,EAC7B,OAAO,GAAE,OAAO,CACd,IAAI,CAAC,qBAAqB,EAAE,OAAO,GAAG,aAAa,GAAG,YAAY,CAAC,CAC/D,GACL,OAAO,CAAC,kBAAkB,CAAC,CAU7B;AAED;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACtC,yFAAyF;IACzF,YAAY,CAAC,OAAO,EAAE;QACpB,OAAO,EAAE,kBAAkB,CAAA;QAC3B,WAAW,EAAE,MAAM,CAAA;KACpB,GAAG,OAAO,CAAC,kBAAkB,EAAE;QAAE,MAAM,EAAE,OAAO,CAAA;KAAE,CAAC,CAAA;IACpD;;;;;;;OAOG;IACH,OAAO,CACL,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAAA;IAC5C,kGAAkG;IAClG,aAAa,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAA;IACxE,+FAA+F;IAC/F,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAA;IACvC;;;;;;;;;;;;;;;OAeG;IACH,kBAAkB,CAAC,OAAO,EAAE;QAC1B,OAAO,EAAE,kBAAkB,CAAA;QAC3B,WAAW,EAAE,MAAM,CAAA;QACnB,GAAG,EAAE,MAAM,CAAA;KACZ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAClB;AAED,gFAAgF;AAChF,qBAAa,sBAAuB,SAAQ,oBAAoB;;CAK/D;AAED,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,kBAAkB,EAC3B,YAAY,EAAE;IACZ,gDAAgD;IAChD,UAAU,EAAE,IAAI,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAA;IAC3C,aAAa,CAAC,EAAE,CACd,IAAI,EAAE,oBAAoB,KACvB,OAAO,CAAC,oBAAoB,CAAC,CAAA;CACnC,GACA,uBAAuB,CAiEzB;AAED,qBAAa,cAAe,SAAQ,kBAAkB;gBAElD,YAAY,CAAC,EAAE,gBAAgB,EAC/B,MAAM,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,YAAY,CAAC,CAAC,EACjD,OAAO,GAAE,OAAO,CAAC,qBAAqB,CAAM;WAYjC,YAAY,CACvB,YAAY,CAAC,EAAE,gBAAgB,GAC9B,OAAO,CAAC,cAAc,CAAC;CAG3B"}

package/dist/types/src/plugin/agy-request-metadata.d.ts

@@ -0,0 +1,2 @@
+export * from '@cortexkit/antigravity-auth-core';
+//# sourceMappingURL=agy-request-metadata.d.ts.map

package/dist/types/src/plugin/agy-request-metadata.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agy-request-metadata.d.ts","sourceRoot":"","sources":["../../../../src/plugin/agy-request-metadata.ts"],"names":[],"mappings":"AAAA,cAAc,kCAAkC,CAAA"}

package/dist/types/src/plugin/agy-transport.d.ts

@@ -0,0 +1,2 @@
+export * from '@cortexkit/antigravity-auth-core';
+//# sourceMappingURL=agy-transport.d.ts.map

package/dist/types/src/plugin/agy-transport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agy-transport.d.ts","sourceRoot":"","sources":["../../../../src/plugin/agy-transport.ts"],"names":[],"mappings":"AACA,cAAc,kCAAkC,CAAA"}

package/dist/types/src/plugin/auth-doctor.d.ts

@@ -0,0 +1,30 @@
+import type { AccountStorageV4 } from './storage.js';
+import type { AuthDetails } from './types.js';
+export type AuthDoctorStatus = 'ok' | 'warning' | 'repairable' | 'error';
+export type AuthDoctorFindingCode = 'auth-matches-storage' | 'missing-opencode-auth' | 'non-oauth-opencode-auth' | 'refresh-token-not-in-storage' | 'no-account-storage' | 'no-enabled-accounts' | 'active-index-out-of-range' | 'active-account-disabled' | 'verification-required' | 'account-ineligible';
+export type AuthDoctorRepair = 'restore-opencode-auth' | 'clamp-active-index' | 'select-enabled-account' | 'verify-account';
+export interface AuthDoctorFinding {
+    code: AuthDoctorFindingCode;
+    severity: 'info' | 'warning' | 'error';
+    message: string;
+    repair?: AuthDoctorRepair;
+    accountEmail?: string;
+}
+export interface AuthDoctorReport {
+    status: AuthDoctorStatus;
+    summary: string;
+    findings: AuthDoctorFinding[];
+    runtime?: AuthDoctorRuntimeMetadata;
+}
+export interface AuthDoctorRuntimeMetadata {
+    antigravityVersion: string;
+    antigravityVersionSource: string;
+}
+export interface CreateAuthDoctorReportInput {
+    auth: AuthDetails | undefined | null;
+    storage: AccountStorageV4 | null | undefined;
+    runtime?: AuthDoctorRuntimeMetadata;
+}
+export declare function createAuthDoctorReport(input: CreateAuthDoctorReportInput): AuthDoctorReport;
+export declare function formatAuthDoctorReport(report: AuthDoctorReport): string;
+//# sourceMappingURL=auth-doctor.d.ts.map

package/dist/types/src/plugin/auth-doctor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-doctor.d.ts","sourceRoot":"","sources":["../../../../src/plugin/auth-doctor.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAqB,gBAAgB,EAAE,MAAM,WAAW,CAAA;AACpE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAA;AAE1C,MAAM,MAAM,gBAAgB,GAAG,IAAI,GAAG,SAAS,GAAG,YAAY,GAAG,OAAO,CAAA;AAExE,MAAM,MAAM,qBAAqB,GAC7B,sBAAsB,GACtB,uBAAuB,GACvB,yBAAyB,GACzB,8BAA8B,GAC9B,oBAAoB,GACpB,qBAAqB,GACrB,2BAA2B,GAC3B,yBAAyB,GACzB,uBAAuB,GACvB,oBAAoB,CAAA;AAExB,MAAM,MAAM,gBAAgB,GACxB,uBAAuB,GACvB,oBAAoB,GACpB,wBAAwB,GACxB,gBAAgB,CAAA;AAEpB,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,qBAAqB,CAAA;IAC3B,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAA;IACtC,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,CAAC,EAAE,gBAAgB,CAAA;IACzB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,gBAAgB,CAAA;IACxB,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,iBAAiB,EAAE,CAAA;IAC7B,OAAO,CAAC,EAAE,yBAAyB,CAAA;CACpC;AAED,MAAM,WAAW,yBAAyB;IACxC,kBAAkB,EAAE,MAAM,CAAA;IAC1B,wBAAwB,EAAE,MAAM,CAAA;CACjC;AAED,MAAM,WAAW,2BAA2B;IAC1C,IAAI,EAAE,WAAW,GAAG,SAAS,GAAG,IAAI,CAAA;IACpC,OAAO,EAAE,gBAAgB,GAAG,IAAI,GAAG,SAAS,CAAA;IAC5C,OAAO,CAAC,EAAE,yBAAyB,CAAA;CACpC;AAkCD,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,2BAA2B,GACjC,gBAAgB,CA6HlB;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,gBAAgB,GAAG,MAAM,CAyBvE"}

package/dist/types/src/plugin/auth-drift.d.ts

@@ -0,0 +1,13 @@
+import type { AccountMetadataV3, AccountStorageV4 } from './storage.js';
+import type { AuthDetails, OAuthAuthDetails } from './types.js';
+export type AuthStorageDriftStatus = 'healthy' | 'restorable' | 'drifted' | 'unavailable';
+export type AuthStorageDriftReason = 'auth-matches-storage' | 'missing-opencode-auth' | 'non-oauth-opencode-auth' | 'refresh-token-not-in-storage' | 'no-account-storage' | 'no-enabled-accounts';
+export interface AuthStorageDriftReport {
+    status: AuthStorageDriftStatus;
+    reason: AuthStorageDriftReason;
+    account?: AccountMetadataV3;
+}
+export declare function selectRestorableAccount(storage: AccountStorageV4 | null | undefined): AccountMetadataV3 | undefined;
+export declare function buildAuthFromStoredAccount(account: AccountMetadataV3): OAuthAuthDetails;
+export declare function detectAuthStorageDrift(auth: AuthDetails | undefined | null, storage: AccountStorageV4 | null | undefined): AuthStorageDriftReport;
+//# sourceMappingURL=auth-drift.d.ts.map

package/dist/types/src/plugin/auth-drift.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-drift.d.ts","sourceRoot":"","sources":["../../../../src/plugin/auth-drift.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AACpE,OAAO,KAAK,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAA;AAE5D,MAAM,MAAM,sBAAsB,GAC9B,SAAS,GACT,YAAY,GACZ,SAAS,GACT,aAAa,CAAA;AAEjB,MAAM,MAAM,sBAAsB,GAC9B,sBAAsB,GACtB,uBAAuB,GACvB,yBAAyB,GACzB,8BAA8B,GAC9B,oBAAoB,GACpB,qBAAqB,CAAA;AAEzB,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,sBAAsB,CAAA;IAC9B,MAAM,EAAE,sBAAsB,CAAA;IAC9B,OAAO,CAAC,EAAE,iBAAiB,CAAA;CAC5B;AAMD,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,gBAAgB,GAAG,IAAI,GAAG,SAAS,GAC3C,iBAAiB,GAAG,SAAS,CAW/B;AAED,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,iBAAiB,GACzB,gBAAgB,CAWlB;AAED,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,WAAW,GAAG,SAAS,GAAG,IAAI,EACpC,OAAO,EAAE,gBAAgB,GAAG,IAAI,GAAG,SAAS,GAC3C,sBAAsB,CAiDxB"}