@cortexkit/opencode-antigravity-auth 2.2.1 → 3.0.0

package/dist/src/plugin/auth-loader.d.ts

@@ -1,18 +1,49 @@
+import { type AccountManager as CoreAccountManager, type EnrollmentAuthority } from '@cortexkit/antigravity-auth-core';
 import { AccountManager } from './accounts';
 import type { AntigravityConfig } from './config';
 import { getLogFilePath, isDebugEnabled } from './debug';
+import type { FetchImpl } from './dependencies';
 import type { PluginLifecycle } from './lifecycle';
-import { createProactiveRefreshQueue } from './refresh-queue';
-import { clearAccounts, loadAccounts } from './storage';
+import { createLocationProactiveRefreshQueue, createProactiveRefreshQueue } from './refresh-queue';
+import { type AccountStoreOpening, clearAccounts, loadAccounts } from './storage';
 import type { GetAuth, LoaderResult, PluginClient, Provider } from './types';
 export interface AuthFetchRuntime {
     fetch: LoaderResult['fetch'];
     dispose(): Promise<void> | void;
 }
+/**
+ * The runtime of this plugin's own accounts. A reload retires the runtime it
+ * replaces instead of disposing it: requests it already admitted keep
+ * running on the account manager they started with, and that manager is
+ * disposed only after they finish.
+ */
+export interface LocalFetchRuntime extends AuthFetchRuntime {
+    /** Refuses new requests; resolves once admitted requests have finished. */
+    retire(): Promise<void>;
+}
+/**
+ * Request routing uses the repository manager for an active account store.
+ * The pool-file manager remains only for the fresh-install compatibility
+ * path; an existing pool cannot serve before explicit offline migration.
+ */
+export type RuntimeAccountManager = AccountManager | CoreAccountManager;
 export type CreateAuthFetch = (input: {
-    accountManager: AccountManager;
+    accountManager: RuntimeAccountManager;
     getAuth: GetAuth;
-}) => AuthFetchRuntime;
+    /**
+     * Where `accountManager`'s accounts come from: the pool file, or the
+     * account store through the repository of the same opening the manager
+     * was loaded from.
+     */
+    source: {
+        kind: 'pool-file';
+    } | {
+        kind: 'store';
+        repository: Extract<AccountStoreOpening, {
+            status: 'ready';
+        }>['repository'];
+    };
+}) => LocalFetchRuntime;
 /**
  * Loader returned by `createAuthLoader`. The function loads the
  * account pool from disk and installs the runtime.
@@ -27,24 +58,57 @@ export type ReloadAccountRuntime = (getAuth: GetAuth) => Promise<void>;
 export interface AuthLoaderHandle {
     load: LoadAndInstallRuntime;
     reload: ReloadAccountRuntime;
+    /**
+     * This plugin's single opening of its account pool's store. OAuth
+     * additions and account commands must use this same opening, so they
+     * write through the very repository request routing reads.
+     */
+    accountStore(): Promise<AccountStoreOpening>;
+    /** Whether that opening leaves the pool file as the source of accounts. */
+    usesPoolFile(opening: AccountStoreOpening): boolean;
+    /**
+     * The explicit first-account step of a genuinely fresh installation: when
+     * the plugin's account pool has neither a pool file nor a store
+     * (`initialization-required`), creates an empty account store and opens
+     * it, so the first login is admitted by the store rather than written to
+     * a new pool file. Any other opening is returned unchanged; nothing is
+     * initialized over an existing pool file or store.
+     */
+    initializeFreshStore(): Promise<AccountStoreOpening>;
 }
 interface AuthLoaderDependencies {
     loadAccounts: typeof loadAccounts;
     clearAccounts: typeof clearAccounts;
     loadAccountManager(auth: Parameters<typeof AccountManager.loadFromDisk>[0]): Promise<AccountManager>;
     createRefreshQueue: typeof createProactiveRefreshQueue;
+    /** The proactive queue of a store-backed manager; see `installRuntime`. */
+    createStoreRefreshQueue: typeof createLocationProactiveRefreshQueue;
+    /** Creates the empty store of a fresh installation. */
+    initializeFreshStore(): Promise<{
+        status: string;
+    }>;
     isDebugEnabled: typeof isDebugEnabled;
     getLogFilePath: typeof getLogFilePath;
+    /**
+     * Opens the account store (`openAccountStore`). An existing unmigrated pool
+     * makes local requests unavailable without loading the pool. Pending work,
+     * rollback, or invalid store files refuse rather than falling back to it.
+     */
+    openAccountStore(): Promise<AccountStoreOpening>;
 }
 interface CreateAuthLoaderOptions {
+    publishSidebar?: () => Promise<void>;
     client: PluginClient;
     providerId: string;
     config: AntigravityConfig;
     lifecycle: PluginLifecycle;
     createFetch: CreateAuthFetch;
+    fetchImpl?: FetchImpl;
+    readAuthority?: () => Promise<EnrollmentAuthority>;
+    createVaultFetch?: () => Promise<AuthFetchRuntime>;
     onGetAuth?(getAuth: GetAuth): void;
     dependencies?: Partial<AuthLoaderDependencies>;
 }
-export declare function createAuthLoader({ client, providerId, config, lifecycle, createFetch, onGetAuth, dependencies, }: CreateAuthLoaderOptions): LoadAndInstallRuntime & AuthLoaderHandle;
+export declare function createAuthLoader({ publishSidebar, client, providerId, config, lifecycle, createFetch, fetchImpl, readAuthority, createVaultFetch, onGetAuth, dependencies, }: CreateAuthLoaderOptions): LoadAndInstallRuntime & AuthLoaderHandle;
 export {};
 //# sourceMappingURL=auth-loader.d.ts.map

package/dist/src/plugin/auth-loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-loader.d.ts","sourceRoot":"","sources":["../../../src/plugin/auth-loader.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAM3C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAA;AACjD,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,SAAS,CAAA;AACxD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAElD,OAAO,EACL,2BAA2B,EAE5B,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAEL,aAAa,EACb,YAAY,EACb,MAAM,WAAW,CAAA;AAClB,OAAO,KAAK,EACV,OAAO,EACP,YAAY,EACZ,YAAY,EACZ,QAAQ,EAET,MAAM,SAAS,CAAA;AAgBhB,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,YAAY,CAAC,OAAO,CAAC,CAAA;IAC5B,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;CAChC;AAED,MAAM,MAAM,eAAe,GAAG,CAAC,KAAK,EAAE;IACpC,cAAc,EAAE,cAAc,CAAA;IAC9B,OAAO,EAAE,OAAO,CAAA;CACjB,KAAK,gBAAgB,CAAA;AAEtB;;;GAGG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAClC,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,QAAQ,KACf,OAAO,CAAC,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;AAEpD;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;AAEtE,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,qBAAqB,CAAA;IAC3B,MAAM,EAAE,oBAAoB,CAAA;CAC7B;AAED,UAAU,sBAAsB;IAC9B,YAAY,EAAE,OAAO,YAAY,CAAA;IACjC,aAAa,EAAE,OAAO,aAAa,CAAA;IACnC,kBAAkB,CAChB,IAAI,EAAE,UAAU,CAAC,OAAO,cAAc,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,GACtD,OAAO,CAAC,cAAc,CAAC,CAAA;IAC1B,kBAAkB,EAAE,OAAO,2BAA2B,CAAA;IACtD,cAAc,EAAE,OAAO,cAAc,CAAA;IACrC,cAAc,EAAE,OAAO,cAAc,CAAA;CACtC;AAED,UAAU,uBAAuB;IAC/B,MAAM,EAAE,YAAY,CAAA;IACpB,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,iBAAiB,CAAA;IACzB,SAAS,EAAE,eAAe,CAAA;IAC1B,WAAW,EAAE,eAAe,CAAA;IAC5B,SAAS,CAAC,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;IAClC,YAAY,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAA;CAC/C;AAED,wBAAgB,gBAAgB,CAAC,EAC/B,MAAM,EACN,UAAU,EACV,MAAM,EACN,SAAS,EACT,WAAW,EACX,SAAS,EACT,YAAY,GACb,EAAE,uBAAuB,GAAG,qBAAqB,GAAG,gBAAgB,CA2OpE"}
+{"version":3,"file":"auth-loader.d.ts","sourceRoot":"","sources":["../../../src/plugin/auth-loader.ts"],"names":[],"mappings":"AACA,OAAO,EACL,KAAK,cAAc,IAAI,kBAAkB,EAEzC,KAAK,mBAAmB,EAKzB,MAAM,kCAAkC,CAAA;AAOzC,OAAO,EACL,cAAc,EAGf,MAAM,YAAY,CAAA;AAMnB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAA;AACjD,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,SAAS,CAAA;AACxD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC/C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAElD,OAAO,EACL,mCAAmC,EACnC,2BAA2B,EAE5B,MAAM,iBAAiB,CAAA;AAExB,OAAO,EAEL,KAAK,mBAAmB,EACxB,aAAa,EAEb,YAAY,EAGb,MAAM,WAAW,CAAA;AAElB,OAAO,KAAK,EACV,OAAO,EACP,YAAY,EACZ,YAAY,EACZ,QAAQ,EAET,MAAM,SAAS,CAAA;AAgBhB,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,YAAY,CAAC,OAAO,CAAC,CAAA;IAC5B,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;CAChC;AAED;;;;;GAKG;AACH,MAAM,WAAW,iBAAkB,SAAQ,gBAAgB;IACzD,2EAA2E;IAC3E,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CACxB;AAED;;;;GAIG;AACH,MAAM,MAAM,qBAAqB,GAAG,cAAc,GAAG,kBAAkB,CAAA;AAEvE,MAAM,MAAM,eAAe,GAAG,CAAC,KAAK,EAAE;IACpC,cAAc,EAAE,qBAAqB,CAAA;IACrC,OAAO,EAAE,OAAO,CAAA;IAChB;;;;OAIG;IACH,MAAM,EACF;QAAE,IAAI,EAAE,WAAW,CAAA;KAAE,GACrB;QACE,IAAI,EAAE,OAAO,CAAA;QACb,UAAU,EAAE,OAAO,CACjB,mBAAmB,EACnB;YAAE,MAAM,EAAE,OAAO,CAAA;SAAE,CACpB,CAAC,YAAY,CAAC,CAAA;KAChB,CAAA;CACN,KAAK,iBAAiB,CAAA;AAEvB;;;GAGG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAClC,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,QAAQ,KACf,OAAO,CAAC,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;AAEpD;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;AAEtE,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,qBAAqB,CAAA;IAC3B,MAAM,EAAE,oBAAoB,CAAA;IAC5B;;;;OAIG;IACH,YAAY,IAAI,OAAO,CAAC,mBAAmB,CAAC,CAAA;IAC5C,2EAA2E;IAC3E,YAAY,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAA;IACnD;;;;;;;OAOG;IACH,oBAAoB,IAAI,OAAO,CAAC,mBAAmB,CAAC,CAAA;CACrD;AAED,UAAU,sBAAsB;IAC9B,YAAY,EAAE,OAAO,YAAY,CAAA;IACjC,aAAa,EAAE,OAAO,aAAa,CAAA;IACnC,kBAAkB,CAChB,IAAI,EAAE,UAAU,CAAC,OAAO,cAAc,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,GACtD,OAAO,CAAC,cAAc,CAAC,CAAA;IAC1B,kBAAkB,EAAE,OAAO,2BAA2B,CAAA;IACtD,2EAA2E;IAC3E,uBAAuB,EAAE,OAAO,mCAAmC,CAAA;IACnE,uDAAuD;IACvD,oBAAoB,IAAI,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACnD,cAAc,EAAE,OAAO,cAAc,CAAA;IACrC,cAAc,EAAE,OAAO,cAAc,CAAA;IACrC;;;;OAIG;IACH,gBAAgB,IAAI,OAAO,CAAC,mBAAmB,CAAC,CAAA;CACjD;AAiDD,UAAU,uBAAuB;IAC/B,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;IACpC,MAAM,EAAE,YAAY,CAAA;IACpB,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,iBAAiB,CAAA;IACzB,SAAS,EAAE,eAAe,CAAA;IAC1B,WAAW,EAAE,eAAe,CAAA;IAC5B,SAAS,CAAC,EAAE,SAAS,CAAA;IACrB,aAAa,CAAC,EAAE,MAAM,OAAO,CAAC,mBAAmB,CAAC,CAAA;IAClD,gBAAgB,CAAC,EAAE,MAAM,OAAO,CAAC,gBAAgB,CAAC,CAAA;IAClD,SAAS,CAAC,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;IAClC,YAAY,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAA;CAC/C;AAED,wBAAgB,gBAAgB,CAAC,EAC/B,cAAc,EACd,MAAM,EACN,UAAU,EACV,MAAM,EACN,SAAS,EACT,WAAW,EACX,SAA0D,EAC1D,aAAa,EACb,gBAAgB,EAChB,SAAS,EACT,YAAY,GACb,EAAE,uBAAuB,GAAG,qBAAqB,GAAG,gBAAgB,CAkgBpE"}

package/dist/src/plugin/auth-loader.js

@@ -1,13 +1,15 @@
 import { createHash } from 'node:crypto';
-import { getHealthTracker } from '@cortexkit/antigravity-auth-core';
+import { createAccountRepositoryFactory, getHealthTracker, loadCommonAuthClaustrum, loadCommonAuthStoreModules, VAULT_ACCOUNT_REMEDY, } from '@cortexkit/antigravity-auth-core';
 import { buildSidebarMachineStateFromAccounts, isAccountCurrent, setSidebarMachineState, toCapturedTier, } from '../sidebar-state';
-import { AccountManager } from './accounts';
+import { AccountManager, createLocalAccountCredentials, loadAccountManagerFromRepository, } from './accounts';
 import { isOAuthAuth } from './auth';
 import { buildAuthFromStoredAccount, detectAuthStorageDrift, } from './auth-drift';
 import { getLogFilePath, isDebugEnabled } from './debug';
 import { createLogger } from './logger';
-import { createProactiveRefreshQueue, } from './refresh-queue';
-import { AccountStorageUnreadableError, clearAccounts, loadAccounts, } from './storage';
+import { createLocationProactiveRefreshQueue, createProactiveRefreshQueue, } from './refresh-queue';
+import { isGenerativeLanguageRequest } from './request';
+import { AccountStorageUnreadableError, clearAccounts, initializeFreshAccountStoreFor, loadAccounts, openAccountStore, UNMIGRATED_ACCOUNT_MESSAGE, } from './storage';
+import { createAntigravityTokenExchange } from './token';
 const log = createLogger('auth-loader');
 /**
  * Opaque identity derived from a refresh token. Mirrors the local
@@ -20,29 +22,113 @@ const log = createLogger('auth-loader');
 function refreshTokenIdentity(refreshToken) {
     return createHash('sha256').update(refreshToken).digest('hex').slice(0, 16);
 }
-export function createAuthLoader({ client, providerId, config, lifecycle, createFetch, onGetAuth, dependencies, }) {
+async function initializeDefaultFreshStore() {
+    return initializeFreshAccountStoreFor(await loadCommonAuthStoreModules());
+}
+async function openDefaultAccountStore() {
+    const modules = await loadCommonAuthStoreModules();
+    return openAccountStore({
+        modules,
+        createRepository: createAccountRepositoryFactory(modules),
+        exchange: createAntigravityTokenExchange(),
+    });
+}
+/**
+ * A fresh installation may still obtain its first account. An existing pool
+ * needs explicit offline migration before local accounts can be used; absence
+ * of a store pointer is not permission to serve or update that pool.
+ */
+function usesPoolFile(opening) {
+    return opening.status === 'initialization-required';
+}
+async function fetchWithoutLocalAccounts(input, init, upstreamFetch) {
+    if (!isGenerativeLanguageRequest(input))
+        return upstreamFetch(input, init);
+    const callerSignal = init?.signal !== undefined
+        ? init.signal
+        : input instanceof Request
+            ? input.signal
+            : undefined;
+    callerSignal?.throwIfAborted();
+    return Response.json({
+        error: {
+            code: 412,
+            status: 'FAILED_PRECONDITION',
+            message: UNMIGRATED_ACCOUNT_MESSAGE,
+        },
+    }, { status: 412 });
+}
+export function createAuthLoader({ publishSidebar, client, providerId, config, lifecycle, createFetch, fetchImpl = (input, init) => globalThis.fetch(input, init), readAuthority, createVaultFetch, onGetAuth, dependencies, }) {
     const deps = {
         loadAccounts: dependencies?.loadAccounts ?? loadAccounts,
         clearAccounts: dependencies?.clearAccounts ?? clearAccounts,
         loadAccountManager: dependencies?.loadAccountManager ??
             ((auth) => AccountManager.loadFromDisk(auth)),
         createRefreshQueue: dependencies?.createRefreshQueue ?? createProactiveRefreshQueue,
+        createStoreRefreshQueue: dependencies?.createStoreRefreshQueue ??
+            createLocationProactiveRefreshQueue,
+        initializeFreshStore: dependencies?.initializeFreshStore ?? initializeDefaultFreshStore,
         isDebugEnabled: dependencies?.isDebugEnabled ?? isDebugEnabled,
         getLogFilePath: dependencies?.getLogFilePath ?? getLogFilePath,
+        openAccountStore: dependencies?.openAccountStore ?? openDefaultAccountStore,
+    };
+    // The account store is opened once per plugin; reloads read the same
+    // repository again, and it is closed with the plugin.
+    let storeOpening = null;
+    const openStore = () => {
+        storeOpening ??= deps.openAccountStore().then((opening) => {
+            if (opening.status === 'ready') {
+                lifecycle.register({
+                    async dispose() {
+                        await opening.repository.dispose();
+                    },
+                });
+            }
+            return opening;
+        });
+        return storeOpening;
+    };
+    const initializeFreshStore = async () => {
+        const opening = await openStore();
+        if (opening.status !== 'initialization-required')
+            return opening;
+        const initialized = await deps.initializeFreshStore();
+        if (initialized.status !== 'completed') {
+            throw new Error('The new account store could not be created yet; try again');
+        }
+        storeOpening = null;
+        return openStore();
+    };
+    let closed = false;
+    const isClosed = () => closed || lifecycle.isClosing();
+    const assertOpen = () => {
+        if (isClosed())
+            throw new Error('The account loader is disposed');
     };
     let fetchRuntime = null;
+    let localUnavailable = false;
+    let vaultFetchRuntime = null;
+    let currentRequestSource;
+    let latestGetAuth;
+    // The reload started by the first local request after vault custody (or
+    // before any local runtime exists). Concurrent requests join it instead of
+    // each installing a runtime of their own.
+    let localRequestReload = null;
     // Reload chain — `installRuntime` swaps the fetch runtime and
-    // (previously) discarded the previous runtime's dispose with `void`,
-    // so two overlapping reloads could interleave teardown. Serialize
+    // overlapping reloads must not interleave the swap. Serialize
     // reloads through a single shared promise so each new install waits
-    // for the previous one to fully settle (including its dispose)
-    // before tearing down the runtime it depends on.
+    // for the previous one to settle before replacing the runtime it
+    // installed.
     let reloadChain = Promise.resolve();
     lifecycle.register({
         async dispose() {
-            const runtime = fetchRuntime;
+            closed = true;
+            await reloadChain;
+            // Every local runtime was handed to the lifecycle, which aborts and
+            // drains it (and every retired one) before disposing their managers.
             fetchRuntime = null;
-            await runtime?.dispose();
+            await (await vaultFetchRuntime?.catch(() => null))?.dispose();
+            vaultFetchRuntime = null;
         },
     }, 'producer');
     // Reload hook: invoked after out-of-band storage mutations (e.g.
@@ -50,57 +136,192 @@ export function createAuthLoader({ client, providerId, config, lifecycle, create
     // newly-persisted account without waiting for a plugin restart. The
     // handle returned below wires this through to the OAuth finish flow.
     let reloadRuntime = async () => { };
-    const installRuntime = async (accountManager, getAuth) => {
+    const installRuntime = async (accountManager, getAuth, source) => {
+        if (isClosed()) {
+            await accountManager.dispose();
+            throw new Error('The account loader is disposed');
+        }
+        currentRequestSource = 'local';
+        localUnavailable = false;
         if (accountManager.getAccountCount() > 0) {
             accountManager.requestSaveToDisk();
         }
+        // Proactive refresh. The pool-file queue refreshes through the host
+        // client and writes the new token back into the pool-file record; for a
+        // store-backed manager that would bypass the store, which accepts a new
+        // token only from the repository's own refresh fenced on the row's
+        // credential. So a store-backed manager gets its own queue whose
+        // refresher is `createLocalAccountCredentials(manager).refresh`: each
+        // due account is refreshed through the repository on that account's
+        // RowRef, and the host client is never used.
         let refreshQueue = null;
+        const queueConfig = {
+            ...(readAuthority && {
+                mayRun: async () => (await readAuthority()) === 'local',
+            }),
+            enabled: config.proactive_token_refresh,
+            bufferSeconds: config.proactive_refresh_buffer_seconds,
+            checkIntervalSeconds: config.proactive_refresh_check_interval_seconds,
+        };
         if (config.proactive_token_refresh &&
             accountManager.getAccountCount() > 0) {
-            refreshQueue = deps.createRefreshQueue(client, providerId, {
-                enabled: config.proactive_token_refresh,
-                bufferSeconds: config.proactive_refresh_buffer_seconds,
-                checkIntervalSeconds: config.proactive_refresh_check_interval_seconds,
+            if (source === 'pool-file' && accountManager instanceof AccountManager) {
+                refreshQueue = deps.createRefreshQueue(client, providerId, queueConfig);
+                refreshQueue.setAccountManager(accountManager);
+            }
+            else if (source === 'store') {
+                const opening = await openStore();
+                if (isClosed()) {
+                    await accountManager.dispose();
+                    throw new Error('The account loader is disposed');
+                }
+                if (opening.status !== 'ready') {
+                    throw new Error('the account store closed while it was in use');
+                }
+                const credentials = createLocalAccountCredentials(accountManager, {
+                    repository: opening.repository,
+                });
+                refreshQueue = deps.createStoreRefreshQueue({
+                    logger: log,
+                    refreshToken: (_auth, account) => credentials.refresh(account),
+                }, queueConfig);
+                refreshQueue.setAccountManager(accountManager);
+            }
+        }
+        // A store-backed manager was loaded from this plugin's single store
+        // opening; its fetch checks every send against that same repository.
+        const opening = source === 'store' ? await openStore() : undefined;
+        if (isClosed() || (opening !== undefined && opening.status !== 'ready')) {
+            await refreshQueue?.dispose();
+            await accountManager.dispose();
+            throw new Error(isClosed()
+                ? 'The account loader is disposed'
+                : 'the account store closed while it was in use');
+        }
+        const nextRuntime = createFetch({
+            accountManager,
+            getAuth,
+            source: opening === undefined
+                ? { kind: 'pool-file' }
+                : { kind: 'store', repository: opening.repository },
+        });
+        // Route new requests to the new runtime FIRST, so the host's captured
+        // fetch (a call-time delegating wrapper below) never reaches a runtime
+        // after it is retired. The lifecycle then retires the previous runtime:
+        // it refuses new requests but finishes the ones it already admitted, and
+        // its account manager is disposed only after they have finished.
+        fetchRuntime = nextRuntime;
+        let published;
+        try {
+            published = await lifecycle.replaceAccountRuntime(accountManager, refreshQueue, {
+                retire: () => nextRuntime.retire(),
+                // The lifecycle disposes a request runtime only while it is itself
+                // disposing; stop admitting requests before their runtime aborts.
+                dispose: async () => {
+                    closed = true;
+                    await nextRuntime.dispose();
+                },
             });
-            refreshQueue.setAccountManager(accountManager);
         }
-        await lifecycle.replaceAccountRuntime(accountManager, refreshQueue);
+        catch (error) {
+            // Nothing owns the new runtime when it was not published; close it
+            // and leave no runtime to route to, rather than an untracked one.
+            if (fetchRuntime === nextRuntime)
+                fetchRuntime = null;
+            await nextRuntime.dispose();
+            await refreshQueue?.dispose();
+            await accountManager.dispose();
+            throw error;
+        }
+        if (!published)
+            throw new Error('The account loader is disposed');
+        assertOpen();
         refreshQueue?.start();
-        // Swap the fetch runtime FIRST so the host's captured fetch
-        // reference (a call-time delegating wrapper below) immediately
-        // routes through the new interceptor, then await the previous
-        // runtime's dispose. The swap-then-dispose order guarantees there
-        // is no fetch gap between the old and new runtimes.
-        const previousRuntime = fetchRuntime;
-        fetchRuntime = createFetch({ accountManager, getAuth });
-        await previousRuntime?.dispose();
         // Push the freshly materialized account pool into the sidebar so the
         // TUI's next poll renders the labels / health / cooldown it needs
         // without waiting for the first fetch to complete.
-        await setSidebarMachineState(buildSidebarMachineStateFromAccounts(accountManager.getAccounts().map((entry) => {
-            const activeByFamily = accountManager.getActiveIndexByFamily();
-            return {
-                index: entry.index,
-                label: entry.label,
-                enabled: entry.enabled,
-                current: isAccountCurrent(entry.index, activeByFamily),
-                coolingDownUntil: entry.coolingDownUntil,
-                healthScore: getHealthTracker().getScore(entry.index),
-                cachedQuota: entry.cachedQuota,
-                // Stamp the sidebar snapshot so the projection can detect a
-                // stale cache that landed on the wrong account (the manager's
-                // `cachedQuotaAccountId` is keyed to whatever account actually
-                // produced the snapshot — the live refresh-token hash is the
-                // expected identity at this slot).
-                cachedQuotaAccountId: entry.cachedQuotaAccountId,
-                currentQuotaAccountId: refreshTokenIdentity(entry.parts.refreshToken),
-                tier: toCapturedTier(entry),
-            };
-        })));
+        if (publishSidebar)
+            await publishSidebar();
+        else
+            await setSidebarMachineState(buildSidebarMachineStateFromAccounts(accountManager.getAccounts().map((entry) => {
+                const activeByFamily = accountManager.getActiveIndexByFamily();
+                return {
+                    index: entry.index,
+                    label: entry.label,
+                    enabled: entry.enabled,
+                    current: isAccountCurrent(entry.index, activeByFamily),
+                    coolingDownUntil: entry.coolingDownUntil,
+                    healthScore: getHealthTracker().getScore(entry.index),
+                    cachedQuota: entry.cachedQuota,
+                    cachedQuotaUpdatedAt: entry.cachedQuotaUpdatedAt,
+                    // Stamp the sidebar snapshot so the projection can detect a
+                    // stale cache that landed on the wrong account (the manager's
+                    // `cachedQuotaAccountId` is keyed to whatever account actually
+                    // produced the snapshot — the live refresh-token hash is the
+                    // expected identity at this slot).
+                    cachedQuotaAccountId: entry.cachedQuotaAccountId,
+                    currentQuotaAccountId: refreshTokenIdentity(entry.parts.refreshToken),
+                    tier: toCapturedTier(entry),
+                };
+            })));
     };
+    async function readLocalHostAuth(getAuth) {
+        const auth = await getAuth();
+        assertOpen();
+        // After disconnect, the activation marker is not a local account.
+        // Refuse before opening or repairing the pool; a real sign-in is required.
+        const claustrum = await loadCommonAuthClaustrum();
+        assertOpen();
+        claustrum.assertHostSlotMatchesMode({
+            mode: 'local',
+            auth,
+            provider: providerId,
+        });
+        return auth;
+    }
     async function runLoader(getAuth, provider) {
+        assertOpen();
         onGetAuth?.(getAuth);
-        let auth = await getAuth();
+        latestGetAuth = getAuth;
+        const authority = (await readAuthority?.()) ?? 'local';
+        assertOpen();
+        if (authority !== 'local')
+            return finishLoad(provider);
+        let auth = await readLocalHostAuth(getAuth);
+        assertOpen();
+        const opening = await openStore();
+        assertOpen();
+        if (opening.status === 'migration-required') {
+            localUnavailable = true;
+            currentRequestSource = 'local';
+            return finishLoad(provider);
+        }
+        if (opening.status === 'ready') {
+            // This plugin's account pool now comes only from the store's
+            // repository; the retired pool file is never read or cleared here.
+            if (!isOAuthAuth(auth) && !readAuthority) {
+                log.warn('The host holds no Antigravity sign-in; the account store is left untouched');
+                return {};
+            }
+            const accountManager = await loadAccountManagerFromRepository(opening.repository);
+            await installRuntime(accountManager, getAuth, 'store');
+            return finishLoad(provider);
+        }
+        if (!usesPoolFile(opening)) {
+            const message = opening.status === 'refused' || opening.status === 'recovery-required'
+                ? opening.message
+                : 'The Antigravity account store cannot be opened';
+            log.error('Refusing to start: the account store cannot serve', {
+                message,
+            });
+            try {
+                await client.tui.showToast({
+                    body: { message, variant: 'error', duration: 30_000 },
+                });
+            }
+            catch { }
+            throw new Error(message);
+        }
         if (!isOAuthAuth(auth)) {
             let storedAccounts;
             try {
@@ -131,6 +352,7 @@ export function createAuthLoader({ client, providerId, config, lifecycle, create
                 }
                 throw error;
             }
+            assertOpen();
             const drift = detectAuthStorageDrift(auth, storedAccounts);
             if (drift.status === 'restorable' && drift.account) {
                 auth = buildAuthFromStoredAccount(drift.account);
@@ -155,6 +377,7 @@ export function createAuthLoader({ client, providerId, config, lifecycle, create
             }
         }
         if (!isOAuthAuth(auth)) {
+            assertOpen();
             try {
                 await deps.clearAccounts();
             }
@@ -162,7 +385,11 @@ export function createAuthLoader({ client, providerId, config, lifecycle, create
             return {};
         }
         const accountManager = await deps.loadAccountManager(auth);
-        await installRuntime(accountManager, getAuth);
+        await installRuntime(accountManager, getAuth, 'pool-file');
+        return finishLoad(provider);
+    }
+    async function finishLoad(provider) {
+        assertOpen();
         if (deps.isDebugEnabled()) {
             const logPath = deps.getLogFilePath();
             if (logPath) {
@@ -174,6 +401,7 @@ export function createAuthLoader({ client, providerId, config, lifecycle, create
                 catch { }
             }
         }
+        assertOpen();
         if (provider.models) {
             for (const model of Object.values(provider.models)) {
                 if (model)
@@ -189,15 +417,86 @@ export function createAuthLoader({ client, providerId, config, lifecycle, create
             // through the OLD interceptor after an OAuth add. The wrapper
             // matches the host's `LoaderResult.fetch` signature exactly
             // (no `this` binding) so behavior is preserved.
-            fetch: (input, init) => fetchRuntime.fetch(input, init),
+            fetch: async (input, init) => {
+                assertOpen();
+                const authority = (await readAuthority?.()) ?? 'local';
+                // Shutdown may have begun while the authority was read; nothing is
+                // built or sent after admission closes, even while disposal drains.
+                assertOpen();
+                if (authority === 'unreadable')
+                    throw new Error(VAULT_ACCOUNT_REMEDY);
+                if (authority === 'vault') {
+                    currentRequestSource = 'vault';
+                    if (!createVaultFetch)
+                        throw new Error(VAULT_ACCOUNT_REMEDY);
+                    vaultFetchRuntime ??= createVaultFetch().catch((error) => {
+                        vaultFetchRuntime = null;
+                        throw error;
+                    });
+                    const vaultRuntime = await vaultFetchRuntime;
+                    assertOpen();
+                    return vaultRuntime.fetch(input, init);
+                }
+                // Check authority first: an approved vault remains usable even when
+                // this location's local pool is waiting for offline migration.
+                if (localUnavailable) {
+                    return fetchWithoutLocalAccounts(input, init, fetchImpl);
+                }
+                if (readAuthority &&
+                    (localRequestReload ||
+                        currentRequestSource !== 'local' ||
+                        !fetchRuntime)) {
+                    if (!latestGetAuth)
+                        throw new Error('The host sign-in reader is unavailable');
+                    // Requests arriving together share one reload, so a later one
+                    // never replaces the runtime an earlier one is already sending on.
+                    if (!localRequestReload) {
+                        const started = reload(latestGetAuth).finally(() => {
+                            if (localRequestReload === started)
+                                localRequestReload = null;
+                        });
+                        localRequestReload = started;
+                    }
+                    await localRequestReload;
+                    assertOpen();
+                    if ((await readAuthority()) !== 'local')
+                        throw new Error(VAULT_ACCOUNT_REMEDY);
+                    assertOpen();
+                }
+                if (localUnavailable)
+                    return fetchWithoutLocalAccounts(input, init, fetchImpl);
+                if (currentRequestSource !== 'local' || !fetchRuntime)
+                    throw new Error('The local account runtime is unavailable');
+                return fetchRuntime.fetch(input, init);
+            },
         };
     }
     reloadRuntime = async (getAuth) => {
-        const auth = await getAuth();
-        if (!isOAuthAuth(auth))
+        assertOpen();
+        const authority = (await readAuthority?.()) ?? 'local';
+        assertOpen();
+        if (authority !== 'local')
+            return;
+        const auth = await readLocalHostAuth(getAuth);
+        assertOpen();
+        if (!isOAuthAuth(auth) && !readAuthority)
+            return;
+        const opening = await openStore();
+        assertOpen();
+        if (opening.status === 'migration-required') {
+            localUnavailable = true;
+            currentRequestSource = 'local';
+            return;
+        }
+        if (opening.status === 'ready') {
+            const nextManager = await loadAccountManagerFromRepository(opening.repository);
+            await installRuntime(nextManager, getAuth, 'store');
+            return;
+        }
+        if (!usesPoolFile(opening) || !isOAuthAuth(auth))
             return;
         const nextManager = await deps.loadAccountManager(auth);
-        await installRuntime(nextManager, getAuth);
+        await installRuntime(nextManager, getAuth, 'pool-file');
     };
     // Return a callable object: `plugin.auth.loader` is invoked with
     // `(getAuth, provider)` (host contract), and `authLoader.reload(...)`
@@ -208,6 +507,7 @@ export function createAuthLoader({ client, providerId, config, lifecycle, create
         return runLoader(getAuth, provider);
     }
     async function reload(getAuth) {
+        assertOpen();
         const next = reloadChain.then(() => reloadRuntime(getAuth));
         reloadChain = next.catch(() => { });
         return next;
@@ -219,6 +519,9 @@ export function createAuthLoader({ client, providerId, config, lifecycle, create
     const authLoader = Object.assign(authLoaderCallable, {
         reload,
         load: authLoaderCallable,
+        accountStore: openStore,
+        usesPoolFile,
+        initializeFreshStore,
     });
     return authLoader;
 }