@cortexkit/opencode-antigravity-auth 2.2.1 → 3.0.0

package/dist/types/src/plugin/dependencies.d.ts

@@ -0,0 +1,129 @@
+/**
+ * Composition seam for the opencode Antigravity plugin.
+ *
+ * `createAntigravityPlugin` is the single host-facing factory. Its surface
+ * stayed stable for years (input → PluginResult) so production callers
+ * never needed to think about which fetch, transport, or OAuth primitive
+ * actually runs under the hood. Tests had to either reach for
+ * `mock.module('./agy-transport', …)` or stub `globalThis.fetch` — both
+ * leaks that pull on module-graph seams that should be invisible to the
+ * factory's public surface.
+ *
+ * The contract here is intentionally narrow:
+ *   - Every dependency below has a default that maps to the current
+ *     production function (i.e. no behavior change in production).
+ *   - Tests inject deterministic doubles for fetch / transport / OAuth /
+ *     filesystem roots / clock so the e2e workspace can run without
+ *     hitting the public internet or a real disk root.
+ *   - No dependency below is intended to leak into the public exports of
+ *     `packages/opencode/index.ts`. That barrel stays at "create the
+ *     plugin and give me a PluginResult" — the override shape is a test-
+ *     time contract, not a stable API.
+ *
+ * Anything that already had an inline `dependencies:` injection point on
+ * a sub-factory (auth-loader, oauth-methods) is intentionally NOT re-
+ * surfaced here. Those seams already work; the goal of THIS file is to
+ * catch the seams that did NOT exist yet (fetch, transport, env-resolved
+ * filesystem roots, clock).
+ */
+import { type AgyTransportOptions } from '@cortexkit/antigravity-auth-core';
+import { authorizeAntigravity, exchangeAntigravity } from '../antigravity/oauth.js';
+import type { AntigravityConfig } from './config/index.js';
+import type { GetAuth, PluginClient } from './types.js';
+/**
+ * Transport adapter shape — wraps the existing `fetchWithAgyCliTransport`
+ * export from core so the interceptor never reaches across the package
+ * boundary. Keeping it in this file (rather than re-exporting core)
+ * means we can change the transport signature without rippling through
+ * plugin callers.
+ */
+export type AgyTransport = (url: string, init?: RequestInit, options?: AgyTransportOptions) => Promise<Response>;
+/**
+ * Per-call HTTP shape used for non-Antigravity URLs (e.g. loopback RPC,
+ * local project probes). Tests inject a deterministic stub; production
+ * keeps `globalThis.fetch` so the interceptor transparently benefits from
+ * whatever fetch the host runtime provides.
+ */
+export type FetchImpl = (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;
+export interface FilesystemRoots {
+    /** Root used for project-scoped config (`{root}/.opencode/antigravity.json`). */
+    projectRoot: string;
+    /** Root used for the user-level config (`~/.config/opencode/antigravity.json`). */
+    userConfigRoot: string;
+    /** Root used for the sidebar state file. */
+    sidebarStateRoot: string;
+    /** Root used for the RPC server port file. */
+    rpcRoot: string;
+}
+export interface OAuthOperations {
+    authorize: typeof authorizeAntigravity;
+    exchange: typeof exchangeAntigravity;
+}
+export interface ClockFunctions {
+    now(): number;
+    random(): number;
+    sleep(ms: number, signal?: AbortSignal): Promise<void>;
+}
+/**
+ * Fully resolved dependency bag consumed by every plugin sub-module.
+ *
+ * `resolvePluginDependencies` fills any missing slot with the production
+ * default; `createAntigravityPlugin` calls it once and threads the result
+ * into fetch-interceptor / quota / auth-loader / oauth-methods.
+ */
+export interface PluginDependencies {
+    fetchImpl: FetchImpl;
+    agyTransport: AgyTransport;
+    filesystemRoots: FilesystemRoots;
+    oauth: OAuthOperations;
+    clock: ClockFunctions;
+}
+/**
+ * User-supplied override bag — every field is optional. Production callers
+ * omit it entirely; tests fill only the slots they care about (typically
+ * `fetchImpl`, `agyTransport`, `filesystemRoots`).
+ */
+export interface PluginDependencyOverrides {
+    fetchImpl?: FetchImpl;
+    agyTransport?: AgyTransport;
+    filesystemRoots?: Partial<FilesystemRoots>;
+    oauth?: Partial<OAuthOperations>;
+    clock?: Partial<ClockFunctions>;
+}
+/**
+ * Carry context the sub-factories need (the active client, the resolved
+ * dependencies, plus the read-only config). Passed to the fetch
+ * interceptor, quota manager, auth loader, and oauth methods so each
+ * one sees the same bag without having to resolve defaults twice.
+ */
+export interface ResolvedPluginContext {
+    client: PluginClient;
+    config: AntigravityConfig;
+    providerId: string;
+    directory: string;
+    dependencies: PluginDependencies;
+}
+/**
+ * Default filesystem roots that mirror the loader's production layout.
+ *
+ * Tests override `filesystemRoots` to point at a temp directory — the
+ * plugin will then read/write config + sidebar + port files inside the
+ * test's mkdtemp root, never touching the host's actual HOME or XDG
+ * dirs.
+ */
+export declare function defaultFilesystemRoots(): FilesystemRoots;
+/**
+ * Build the default dependency bag used by production. Each default is
+ * deliberately written so the e2e tests can re-use the same functions
+ * (e.g. `fetchImpl` defaults to `globalThis.fetch` — a test that wants
+ * a stub can replace `globalThis.fetch` and the production bag picks it
+ * up on the next call).
+ */
+export declare function resolvePluginDependencies(overrides?: PluginDependencyOverrides): PluginDependencies;
+/**
+ * Default `getAuth` placeholder used by sub-modules that require one
+ * (auth-loader, fetch-interceptor). The plugin entry builds the live
+ * version once auth has loaded.
+ */
+export declare const placeholderGetAuth: GetAuth;
+//# sourceMappingURL=dependencies.d.ts.map

package/dist/types/src/plugin/dependencies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dependencies.d.ts","sourceRoot":"","sources":["../../../../src/plugin/dependencies.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAKH,OAAO,EACL,KAAK,mBAAmB,EAEzB,MAAM,kCAAkC,CAAA;AAEzC,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAChF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAA;AACjD,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAEpD;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GAAG,CACzB,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE,WAAW,EAClB,OAAO,CAAC,EAAE,mBAAmB,KAC1B,OAAO,CAAC,QAAQ,CAAC,CAAA;AAEtB;;;;;GAKG;AACH,MAAM,MAAM,SAAS,GAAG,CACtB,KAAK,EAAE,WAAW,GAAG,GAAG,EACxB,IAAI,CAAC,EAAE,WAAW,KACf,OAAO,CAAC,QAAQ,CAAC,CAAA;AAEtB,MAAM,WAAW,eAAe;IAC9B,iFAAiF;IACjF,WAAW,EAAE,MAAM,CAAA;IACnB,mFAAmF;IACnF,cAAc,EAAE,MAAM,CAAA;IACtB,4CAA4C;IAC5C,gBAAgB,EAAE,MAAM,CAAA;IACxB,8CAA8C;IAC9C,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,OAAO,oBAAoB,CAAA;IACtC,QAAQ,EAAE,OAAO,mBAAmB,CAAA;CACrC;AAED,MAAM,WAAW,cAAc;IAC7B,GAAG,IAAI,MAAM,CAAA;IACb,MAAM,IAAI,MAAM,CAAA;IAChB,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACvD;AAED;;;;;;GAMG;AACH,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,SAAS,CAAA;IACpB,YAAY,EAAE,YAAY,CAAA;IAC1B,eAAe,EAAE,eAAe,CAAA;IAChC,KAAK,EAAE,eAAe,CAAA;IACtB,KAAK,EAAE,cAAc,CAAA;CACtB;AAED;;;;GAIG;AACH,MAAM,WAAW,yBAAyB;IACxC,SAAS,CAAC,EAAE,SAAS,CAAA;IACrB,YAAY,CAAC,EAAE,YAAY,CAAA;IAC3B,eAAe,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC,CAAA;IAC1C,KAAK,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC,CAAA;IAChC,KAAK,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,CAAA;CAChC;AAED;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,YAAY,CAAA;IACpB,MAAM,EAAE,iBAAiB,CAAA;IACzB,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;IACjB,YAAY,EAAE,kBAAkB,CAAA;CACjC;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,IAAI,eAAe,CAUxD;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CACvC,SAAS,GAAE,yBAA8B,GACxC,kBAAkB,CAyBpB;AAoBD;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,EAAE,OAG/B,CAAA"}

package/dist/types/src/plugin/errors.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Custom error types for opencode-antigravity-auth plugin.
+ *
+ * Ported from LLM-API-Key-Proxy for robust error handling.
+ */
+/**
+ * Error thrown when Antigravity returns an empty response after retry attempts.
+ *
+ * Empty responses can occur when:
+ * - The model has no candidates/choices
+ * - The response body is empty or malformed
+ * - A temporary service issue prevents generation
+ */
+export declare class EmptyResponseError extends Error {
+    readonly provider: string;
+    readonly model: string;
+    readonly attempts: number;
+    constructor(provider: string, model: string, attempts: number, message?: string);
+}
+/**
+ * Error thrown when tool ID matching fails and cannot be recovered.
+ */
+export declare class ToolIdMismatchError extends Error {
+    readonly expectedIds: string[];
+    readonly foundIds: string[];
+    constructor(expectedIds: string[], foundIds: string[], message?: string);
+}
+/**
+ * Thrown when the operator killswitch excludes every available account.
+ *
+ * The killswitch compares each candidate's freshest cached quota
+ * remaining-percent against an account-specific override (or the
+ * global threshold) and excludes accounts below the floor. When all
+ * accounts are excluded, the fetch interceptor throws this error
+ * with redacted summaries so the host can surface a useful message
+ * without exposing any account identifiers or tokens.
+ */
+export declare class AntigravityKillswitchError extends Error {
+    readonly family: string;
+    readonly model: string;
+    readonly thresholdPercent: number;
+    readonly summaries: Array<{
+        accountKey: string;
+        remainingPercent: number | null;
+        thresholdPercent: number;
+    }>;
+    constructor(input: {
+        family: string;
+        model: string;
+        thresholdPercent: number;
+        summaries: AntigravityKillswitchError['summaries'];
+        message?: string;
+    });
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/types/src/plugin/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../../src/plugin/errors.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;;;;;GAOG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;gBAGvB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,MAAM;CAYnB;AAED;;GAEG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,CAAA;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;gBAEf,WAAW,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,OAAO,CAAC,EAAE,MAAM;CASxE;AAED;;;;;;;;;GASG;AACH,qBAAa,0BAA2B,SAAQ,KAAK;IACnD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IACjC,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC;QACxB,UAAU,EAAE,MAAM,CAAA;QAClB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAA;QAC/B,gBAAgB,EAAE,MAAM,CAAA;KACzB,CAAC,CAAA;gBAEU,KAAK,EAAE;QACjB,MAAM,EAAE,MAAM,CAAA;QACd,KAAK,EAAE,MAAM,CAAA;QACb,gBAAgB,EAAE,MAAM,CAAA;QACxB,SAAS,EAAE,0BAA0B,CAAC,WAAW,CAAC,CAAA;QAClD,OAAO,CAAC,EAAE,MAAM,CAAA;KACjB;CAYF"}

package/dist/types/src/plugin/event-handler.d.ts

@@ -0,0 +1,53 @@
+import type { AntigravityConfig } from './config/index.js';
+import type { Logger } from './logger.js';
+import type { PluginClient } from './types.js';
+type EventInput = {
+    event: {
+        type: string;
+        properties?: unknown;
+    };
+};
+type SessionSummary = {
+    durationMinutes: number;
+    totalClaude: number;
+    totalGemini: number;
+    requestsPerHour: number;
+    accountsUsed: number;
+};
+type EventAccountManager = {
+    getSessionSummary(): SessionSummary;
+    deleteSessionState(sessionId: string): void;
+};
+type EventLifecycle = {
+    getAccountManager(): EventAccountManager | null;
+};
+type EventSessionRegistry = {
+    register(sessionId: string, parentSessionId: string | null): void;
+    delete(sessionId: string): void;
+    getParentSessionId(sessionId: string): string | null;
+};
+type EventSessionRecovery = {
+    isRecoverableError(error: unknown): boolean;
+    handleSessionRecovery(info: {
+        id?: string;
+        role: 'assistant';
+        sessionID?: string;
+        error: unknown;
+    }): Promise<boolean>;
+};
+type EventUpdateChecker = {
+    event(input: EventInput): void | Promise<void>;
+};
+export interface CreateEventHandlerOptions {
+    client: PluginClient;
+    config: Pick<AntigravityConfig, 'auto_resume' | 'resume_text' | 'toast_scope'>;
+    directory: string;
+    lifecycle: EventLifecycle;
+    sessionRegistry: EventSessionRegistry;
+    sessionRecovery: EventSessionRecovery | null;
+    updateChecker: EventUpdateChecker;
+    logger: Pick<Logger, 'debug'>;
+}
+export declare function createEventHandler({ client, config, directory, lifecycle, sessionRegistry, sessionRecovery, updateChecker, logger, }: CreateEventHandlerOptions): (input: EventInput) => Promise<void>;
+export {};
+//# sourceMappingURL=event-handler.d.ts.map

package/dist/types/src/plugin/event-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"event-handler.d.ts","sourceRoot":"","sources":["../../../../src/plugin/event-handler.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAA;AACjD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,UAAU,CAAA;AAEtC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAE3C,KAAK,UAAU,GAAG;IAChB,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,OAAO,CAAA;KAAE,CAAA;CAC9C,CAAA;AAED,KAAK,cAAc,GAAG;IACpB,eAAe,EAAE,MAAM,CAAA;IACvB,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,eAAe,EAAE,MAAM,CAAA;IACvB,YAAY,EAAE,MAAM,CAAA;CACrB,CAAA;AAED,KAAK,mBAAmB,GAAG;IACzB,iBAAiB,IAAI,cAAc,CAAA;IACnC,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAC5C,CAAA;AAED,KAAK,cAAc,GAAG;IACpB,iBAAiB,IAAI,mBAAmB,GAAG,IAAI,CAAA;CAChD,CAAA;AAED,KAAK,oBAAoB,GAAG;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAA;IACjE,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAA;CACrD,CAAA;AAED,KAAK,oBAAoB,GAAG;IAC1B,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAA;IAC3C,qBAAqB,CAAC,IAAI,EAAE;QAC1B,EAAE,CAAC,EAAE,MAAM,CAAA;QACX,IAAI,EAAE,WAAW,CAAA;QACjB,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB,KAAK,EAAE,OAAO,CAAA;KACf,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CACrB,CAAA;AAED,KAAK,kBAAkB,GAAG;IACxB,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC/C,CAAA;AAED,MAAM,WAAW,yBAAyB;IACxC,MAAM,EAAE,YAAY,CAAA;IACpB,MAAM,EAAE,IAAI,CAAC,iBAAiB,EAAE,aAAa,GAAG,aAAa,GAAG,aAAa,CAAC,CAAA;IAC9E,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,cAAc,CAAA;IACzB,eAAe,EAAE,oBAAoB,CAAA;IACrC,eAAe,EAAE,oBAAoB,GAAG,IAAI,CAAA;IAC5C,aAAa,EAAE,kBAAkB,CAAA;IACjC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC9B;AAED,wBAAgB,kBAAkB,CAAC,EACjC,MAAM,EACN,MAAM,EACN,SAAS,EACT,SAAS,EACT,eAAe,EACf,eAAe,EACf,aAAa,EACb,MAAM,GACP,EAAE,yBAAyB,IACZ,OAAO,UAAU,KAAG,OAAO,CAAC,IAAI,CAAC,CAqHhD"}

package/dist/types/src/plugin/fetch/retry-state.d.ts

@@ -0,0 +1,61 @@
+import type { HeaderStyle, AccountModelFamily as ModelFamily } from '@cortexkit/antigravity-auth-core';
+export interface AccountFailureResult {
+    failures: number;
+    shouldCooldown: boolean;
+    cooldownMs: number;
+}
+export interface RateLimitBackoffResult {
+    attempt: number;
+    delayMs: number;
+    isDuplicate: boolean;
+}
+/**
+ * Diagnostic snapshot of the four internal maps. Exposed for tests and for
+ * future diagnostics endpoints; callers must not mutate the returned view.
+ */
+export interface RetryStateSizes {
+    rateLimitState: number;
+    accountFailure: number;
+    rateLimitToast: number;
+    emptyResponse: number;
+}
+export interface RetryState {
+    /** Marks the instance as torn down; subsequent mutations are no-ops. */
+    readonly disposed: boolean;
+    /** Returns the rate-limit backoff for the given account + quota key. */
+    getRateLimitBackoff(accountIndex: number, quotaKey: string, serverRetryAfterMs: number | null, maxBackoffMs?: number): RateLimitBackoffResult;
+    /** Resets a single account/quota pair. */
+    resetRateLimitState(accountIndex: number, quotaKey: string): void;
+    /** Resets every quota key for the given account. */
+    resetAllRateLimitStateForAccount(accountIndex: number): void;
+    /** Maps header style + family to a deduplication bucket. */
+    headerStyleToQuotaKey(headerStyle: HeaderStyle, family: ModelFamily): string;
+    /** Records a non-429 failure and returns cooldown state. */
+    trackAccountFailure(accountIndex: number): AccountFailureResult;
+    /** Clears the failure counter for one account. */
+    resetAccountFailureState(accountIndex: number): void;
+    /** Returns true when the rate-limit warning toast may be shown. */
+    shouldShowRateLimitToast(message: string): boolean;
+    /** Marks the "all accounts blocked — soft quota" toast as shown. */
+    markSoftQuotaToastShown(): void;
+    /** Marks the "all accounts blocked — rate limit" toast as shown. */
+    markRateLimitToastShown(): void;
+    /** Reads the soft-quota toast guard flag. */
+    softQuotaToastShown(): boolean;
+    /** Reads the rate-limit toast guard flag. */
+    rateLimitToastShown(): boolean;
+    /** Clears both blocked-toast guards. */
+    resetAllAccountsBlockedToasts(): void;
+    /** Increments the per-session empty-response attempt counter. */
+    recordEmptyResponseAttempt(key: string): number;
+    /** Drops all empty-response attempt counters. */
+    clearEmptyResponseAttempts(): void;
+    /** Resets every map/flag. */
+    clear(): void;
+    /** Drops all state and prevents further mutations. */
+    dispose(): void;
+    /** Diagnostic snapshot of every internal map's current size. */
+    sizes(): RetryStateSizes;
+}
+export declare function createRetryState(): RetryState;
+//# sourceMappingURL=retry-state.d.ts.map

package/dist/types/src/plugin/fetch/retry-state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"retry-state.d.ts","sourceRoot":"","sources":["../../../../../src/plugin/fetch/retry-state.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,WAAW,EACX,kBAAkB,IAAI,WAAW,EAClC,MAAM,kCAAkC,CAAA;AA8BzC,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAA;IAChB,cAAc,EAAE,OAAO,CAAA;IACvB,UAAU,EAAE,MAAM,CAAA;CACnB;AAQD,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,OAAO,CAAA;CACrB;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,cAAc,EAAE,MAAM,CAAA;IACtB,cAAc,EAAE,MAAM,CAAA;IACtB,cAAc,EAAE,MAAM,CAAA;IACtB,aAAa,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,UAAU;IACzB,wEAAwE;IACxE,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;IAC1B,wEAAwE;IACxE,mBAAmB,CACjB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,kBAAkB,EAAE,MAAM,GAAG,IAAI,EACjC,YAAY,CAAC,EAAE,MAAM,GACpB,sBAAsB,CAAA;IACzB,0CAA0C;IAC1C,mBAAmB,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACjE,oDAAoD;IACpD,gCAAgC,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5D,4DAA4D;IAC5D,qBAAqB,CAAC,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,GAAG,MAAM,CAAA;IAC5E,4DAA4D;IAC5D,mBAAmB,CAAC,YAAY,EAAE,MAAM,GAAG,oBAAoB,CAAA;IAC/D,kDAAkD;IAClD,wBAAwB,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IACpD,mEAAmE;IACnE,wBAAwB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAA;IAClD,oEAAoE;IACpE,uBAAuB,IAAI,IAAI,CAAA;IAC/B,oEAAoE;IACpE,uBAAuB,IAAI,IAAI,CAAA;IAC/B,6CAA6C;IAC7C,mBAAmB,IAAI,OAAO,CAAA;IAC9B,6CAA6C;IAC7C,mBAAmB,IAAI,OAAO,CAAA;IAC9B,wCAAwC;IACxC,6BAA6B,IAAI,IAAI,CAAA;IACrC,iEAAiE;IACjE,0BAA0B,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;IAC/C,iDAAiD;IACjD,0BAA0B,IAAI,IAAI,CAAA;IAClC,6BAA6B;IAC7B,KAAK,IAAI,IAAI,CAAA;IACb,sDAAsD;IACtD,OAAO,IAAI,IAAI,CAAA;IACf,gEAAgE;IAChE,KAAK,IAAI,eAAe,CAAA;CACzB;AA2BD,wBAAgB,gBAAgB,IAAI,UAAU,CA6N7C"}

package/dist/types/src/plugin/fetch/warmup.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Per-interceptor warmup attempt + success bookkeeping.
+ *
+ * The plugin used to keep two module-level sets: one for sessions that already
+ * attempted a thinking warmup and another for sessions that succeeded. They
+ * leaked across plugin lifetimes and across concurrent interceptors. This
+ * factory scopes the same sets to a single interceptor; `dispose()` evicts
+ * everything so the next interceptor starts clean.
+ */
+export interface WarmupState {
+    readonly disposed: boolean;
+    /**
+     * Records an attempt for the given session id. Returns false when the
+     * session already succeeded (no further attempts permitted) or when the
+     * retry budget is exhausted.
+     */
+    trackAttempt(sessionId: string): boolean;
+    /** Returns the number of tracked attempts for the session. */
+    getAttemptCount(sessionId: string): number;
+    /** Marks the session as warmed-up; subsequent attempts are rejected. */
+    markSuccess(sessionId: string): void;
+    /** Drops a single session's attempt counter (used on warmup failure). */
+    clearWarmupAttempt(sessionId: string): void;
+    /** Drops every session entry. */
+    clear(): void;
+    /** Marks the instance as torn down; subsequent mutations are no-ops. */
+    dispose(): void;
+}
+export declare function createWarmupState(): WarmupState;
+//# sourceMappingURL=warmup.d.ts.map

package/dist/types/src/plugin/fetch/warmup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"warmup.d.ts","sourceRoot":"","sources":["../../../../../src/plugin/fetch/warmup.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;IAC1B;;;;OAIG;IACH,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAA;IACxC,8DAA8D;IAC9D,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAAA;IAC1C,wEAAwE;IACxE,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACpC,yEAAyE;IACzE,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3C,iCAAiC;IACjC,KAAK,IAAI,IAAI,CAAA;IACb,wEAAwE;IACxE,OAAO,IAAI,IAAI,CAAA;CAChB;AAED,wBAAgB,iBAAiB,IAAI,WAAW,CAiE/C"}

package/dist/types/src/plugin/fetch-interceptor.d.ts

@@ -0,0 +1,114 @@
+import { type AccountRepository } from '@cortexkit/antigravity-auth-core';
+import { type AccountManager } from './accounts.js';
+import type { GetAuth } from './auth.js';
+import type { AntigravityConfig } from './config/index.js';
+import type { AgyTransport, FetchImpl } from './dependencies.js';
+import type { OperatorSettingsController } from './operator-settings.js';
+import type { QuotaManager } from './quota.js';
+import type { AgySessionRegistry } from './session-context.js';
+import { type RequestRoutingEntry } from './shared/request-services.js';
+import { type VaultAccountPool, type VaultRequestSource } from './shared/vault-request-credentials.js';
+import type { PluginClient } from './types.js';
+/**
+ * Inputs the fetch interceptor needs from the plugin bootstrap. Each plugin
+ * instance builds its own interceptor without sharing state with siblings.
+ */
+export interface FetchInterceptorContext {
+    readonly assertAdmission?: () => Promise<void>;
+    readonly client: PluginClient;
+    readonly directory: string;
+    readonly providerId: string;
+    readonly config: AntigravityConfig;
+    readonly accountManager: AccountManager;
+    /**
+     * Where `accountManager`'s accounts come from, as the auth loader opened
+     * them. `pool-file`: the pre-store pool file, whose tokens are refreshed
+     * through the host's OAuth refresh. `store`: the account store, read
+     * through `repository`, the same opening the manager was loaded from;
+     * tokens are refreshed only by the repository on the selected account's
+     * own row reference, and every send is checked against that row.
+     */
+    readonly accountSource: {
+        readonly kind: 'pool-file';
+    } | {
+        readonly kind: 'store';
+        readonly repository: Pick<AccountRepository, 'read'>;
+    };
+    readonly quotaManager: QuotaManager;
+    readonly getAuth: GetAuth;
+    readonly agySessionRegistry: AgySessionRegistry;
+    /**
+     * Live operator settings controller. Optional for backward
+     * compatibility — when present, the interceptor reads routing
+     * overrides and killswitch thresholds per request.
+     */
+    readonly operatorSettings?: OperatorSettingsController;
+    /**
+     * Transport adapter used for Antigravity HTTPS requests. Defaults to
+     * the production `fetchWithAgyCliTransport` when omitted; tests inject
+     * a deterministic stub so the e2e workspace can route calls at a mock
+     * server bound to 127.0.0.1.
+     */
+    readonly agyTransport?: AgyTransport;
+    /**
+     * HTTP primitive used for non-Antigravity URLs. Defaults to
+     * `globalThis.fetch`; tests inject a guarded stub that refuses any
+     * non-loopback target so a regression cannot silently leak a real
+     * network call.
+     */
+    readonly fetchImpl?: FetchImpl;
+    readonly onRouting?: (sessionId: string, entry: RequestRoutingEntry) => void;
+}
+/**
+ * Public surface exposed to the auth-loader plumbing. `fetch` mirrors the
+ * host signature so it can be slotted into `LoaderResult` unchanged.
+ */
+export interface FetchInterceptor {
+    fetch(input: RequestInfo | URL, init?: RequestInit): Promise<Response>;
+    dispose(): void | Promise<void>;
+}
+/**
+ * The interceptor of this plugin's own accounts. The auth loader replaces it
+ * whenever it reloads the account pool, and retires the old one instead of
+ * disposing it, so requests it already admitted keep running.
+ */
+export interface LocalFetchInterceptor extends FetchInterceptor {
+    /**
+     * Refuses later Generative Language requests (they are never passed
+     * upstream) and resolves once every request that entered `fetch` before
+     * retirement, and its response body, has finished. `dispose` still aborts
+     * them.
+     */
+    retire(): Promise<void>;
+}
+/**
+ * OpenCode 1 binding of the shared request engine for accounts this plugin
+ * holds itself (pool file or account store). The retry, rotation and
+ * quota-fallback pipeline lives in `createRequestExecutor`; this wrapper
+ * decides which requests reach it and binds the account manager, its
+ * source's credential operations and OpenCode 1's collaborators.
+ */
+export declare function createFetchInterceptor(context: FetchInterceptorContext): LocalFetchInterceptor;
+/**
+ * Inputs of the OpenCode 1 interceptor for a location whose accounts the
+ * vault holds (custody). There is no account manager, host OAuth record or
+ * quota manager: accounts are the vault's selectable routes and every
+ * credential comes from the vault source.
+ */
+export interface VaultFetchInterceptorContext extends Pick<FetchInterceptorContext, 'client' | 'config' | 'agySessionRegistry' | 'operatorSettings' | 'agyTransport' | 'fetchImpl' | 'onRouting' | 'assertAdmission'> {
+    /** This location's custody source (the vault account source). */
+    readonly source: VaultRequestSource;
+    /** Share selection and cached vault state with this activation's menu and sidebar. */
+    readonly pool?: VaultAccountPool;
+}
+/**
+ * OpenCode 1 binding of the shared request engine for vault-held accounts.
+ * Selection runs on an `AccountSelector` over the vault's selectable routes
+ * (metadata rows, no credential). Every physical send takes a fresh receipt
+ * for the selected route through `createVaultRequestCredentials`: its token
+ * and project serve that one send, and a 401 is reported against it.
+ * Nothing is refreshed locally, cached or copied from the host's own Google
+ * sign-in, which is why no host auth is read here.
+ */
+export declare function createVaultFetchInterceptor(context: VaultFetchInterceptorContext): FetchInterceptor;
+//# sourceMappingURL=fetch-interceptor.d.ts.map

package/dist/types/src/plugin/fetch-interceptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetch-interceptor.d.ts","sourceRoot":"","sources":["../../../../src/plugin/fetch-interceptor.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,iBAAiB,EAEvB,MAAM,kCAAkC,CAAA;AAGzC,OAAO,EACL,KAAK,cAAc,EAIpB,MAAM,YAAY,CAAA;AACnB,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAA;AAErC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAA;AAEjD,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAG7D,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAA;AAErE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAS3C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AAC3D,OAAO,EAIL,KAAK,mBAAmB,EAEzB,MAAM,2BAA2B,CAAA;AAClC,OAAO,EAEL,KAAK,gBAAgB,EAErB,KAAK,kBAAkB,EACxB,MAAM,oCAAoC,CAAA;AAE3C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAY3C;;;GAGG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;IAC9C,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAA;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAA;IAClC,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAA;IACvC;;;;;;;OAOG;IACH,QAAQ,CAAC,aAAa,EAClB;QAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;KAAE,GAC9B;QACE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;QACtB,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAA;KACrD,CAAA;IACL,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAA;IACnC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,kBAAkB,EAAE,kBAAkB,CAAA;IAC/C;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,0BAA0B,CAAA;IACtD;;;;;OAKG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,YAAY,CAAA;IACpC;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAA;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,mBAAmB,KAAK,IAAI,CAAA;CAC7E;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,KAAK,CAAC,KAAK,EAAE,WAAW,GAAG,GAAG,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;IACtE,OAAO,IAAI,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAChC;AAED;;;;GAIG;AACH,MAAM,WAAW,qBAAsB,SAAQ,gBAAgB;IAC7D;;;;;OAKG;IACH,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CACxB;AA6HD;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,uBAAuB,GAC/B,qBAAqB,CAmJvB;AAED;;;;;GAKG;AACH,MAAM,WAAW,4BACf,SAAQ,IAAI,CACV,uBAAuB,EACrB,QAAQ,GACR,QAAQ,GACR,oBAAoB,GACpB,kBAAkB,GAClB,cAAc,GACd,WAAW,GACX,WAAW,GACX,iBAAiB,CACpB;IACD,iEAAiE;IACjE,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAA;IACnC,sFAAsF;IACtF,QAAQ,CAAC,IAAI,CAAC,EAAE,gBAAgB,CAAA;CACjC;AAED;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,4BAA4B,GACpC,gBAAgB,CA+ClB"}

package/dist/types/src/plugin/fetch-routing.d.ts

@@ -0,0 +1,31 @@
+import type { AccountModelFamily as ModelFamily } from '@cortexkit/antigravity-auth-core';
+import type { HeaderStyle } from '../constants.js';
+import type { AntigravityConfig } from './config/index.js';
+import type { LocationDebug } from './debug.js';
+export declare const MAX_TOTAL_CAPACITY_RETRIES = 4;
+export declare const CAPACITY_BACKOFF_TIERS_MS: number[];
+export declare function isCapacityRetryBudgetExhausted(totalCapacityRetries: number): boolean;
+export declare function getCapacityBackoffDelay(consecutiveFailures: number): number;
+export declare function toUrlString(value: RequestInfo): string;
+export declare function toWarmupStreamUrl(value: RequestInfo): string;
+export declare function extractModelFromUrl(urlString: string): string | null;
+/**
+ * Model family for a request URL. The caller's location debug log, when
+ * given, records the decision; this module keeps no debug state of its own.
+ */
+export declare function getModelFamilyFromUrl(urlString: string, debug?: Pick<LocationDebug, 'isDebugEnabled' | 'logModelFamily'>): ModelFamily;
+export declare function resolveQuotaFallbackHeaderStyle(input: {
+    family: ModelFamily;
+    headerStyle: HeaderStyle;
+    alternateStyle: HeaderStyle | null;
+}): HeaderStyle | null;
+export type HeaderRoutingDecision = {
+    cliFirst: boolean;
+    preferredHeaderStyle: HeaderStyle;
+    explicitQuota: boolean;
+    allowQuotaFallback: boolean;
+};
+export declare function resolveHeaderRoutingDecision(urlString: string, family: ModelFamily, config: Partial<AntigravityConfig>): HeaderRoutingDecision;
+export declare function getHeaderStyleFromUrl(urlString: string, family: ModelFamily, cliFirst?: boolean): HeaderStyle;
+export declare function isExplicitQuotaFromUrl(urlString: string): boolean;
+//# sourceMappingURL=fetch-routing.d.ts.map

package/dist/types/src/plugin/fetch-routing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetch-routing.d.ts","sourceRoot":"","sources":["../../../../src/plugin/fetch-routing.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,IAAI,WAAW,EAAE,MAAM,kCAAkC,CAAA;AACzF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAC/C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAA;AACjD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAG5C,eAAO,MAAM,0BAA0B,IAAI,CAAA;AAC3C,eAAO,MAAM,yBAAyB,UAAqC,CAAA;AAE3E,wBAAgB,8BAA8B,CAC5C,oBAAoB,EAAE,MAAM,GAC3B,OAAO,CAET;AAED,wBAAgB,uBAAuB,CAAC,mBAAmB,EAAE,MAAM,GAAG,MAAM,CAM3E;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,CAStD;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,CAe5D;AAED,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAGpE;AAOD;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,MAAM,EACjB,KAAK,CAAC,EAAE,IAAI,CAAC,aAAa,EAAE,gBAAgB,GAAG,gBAAgB,CAAC,GAC/D,WAAW,CAUb;AAED,wBAAgB,+BAA+B,CAAC,KAAK,EAAE;IACrD,MAAM,EAAE,WAAW,CAAA;IACnB,WAAW,EAAE,WAAW,CAAA;IACxB,cAAc,EAAE,WAAW,GAAG,IAAI,CAAA;CACnC,GAAG,WAAW,GAAG,IAAI,CAQrB;AAED,MAAM,MAAM,qBAAqB,GAAG;IAClC,QAAQ,EAAE,OAAO,CAAA;IACjB,oBAAoB,EAAE,WAAW,CAAA;IACjC,aAAa,EAAE,OAAO,CAAA;IACtB,kBAAkB,EAAE,OAAO,CAAA;CAC5B,CAAA;AAED,wBAAgB,4BAA4B,CAC1C,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,WAAW,EACnB,MAAM,EAAE,OAAO,CAAC,iBAAiB,CAAC,GACjC,qBAAqB,CAevB;AAMD,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,WAAW,EACnB,QAAQ,GAAE,OAAe,GACxB,WAAW,CAYb;AAED,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAOjE"}

package/dist/types/src/plugin/fingerprint.d.ts

@@ -0,0 +1,2 @@
+export * from '@cortexkit/antigravity-auth-core';
+//# sourceMappingURL=fingerprint.d.ts.map

package/dist/types/src/plugin/fingerprint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fingerprint.d.ts","sourceRoot":"","sources":["../../../../src/plugin/fingerprint.ts"],"names":[],"mappings":"AACA,cAAc,kCAAkC,CAAA"}