@cortexkit/opencode-antigravity-auth 3.0.5 → 3.0.6

package/dist/tui-build-map.json

@@ -1,6 +1,6 @@
 {
   "schema": 1,
-  "compiler": "@cortexkit/common-auth/tui-build@0.15.0",
+  "compiler": "@cortexkit/common-auth/tui-build@0.17.2",
   "bun": "1.4.2",
   "raw": {
     "selector": "selector.js",
@@ -18,50 +18,50 @@
       {
         "source": "src/common-auth-embedded/quota/map.js",
         "output": "src/tui-raw/common-auth-embedded/quota/map.js",
-        "bytes": 4271,
-        "sha256": "61fb25c789389e57ff8cceb450f6872c2b6e4961cec3c4650f6af699ab5a27f2",
+        "bytes": 5669,
+        "sha256": "95339af4c80684b4e462f5ba32affeaa5f8b5885db599dc5e8ac1ffd1890d729",
         "transform": "public-raw"
       },
       {
         "source": "src/common-auth-embedded/quota/merge.js",
         "output": "src/tui-raw/common-auth-embedded/quota/merge.js",
-        "bytes": 6513,
-        "sha256": "0293bf0f2e27055306d750ebd2983edf6a22ef2aa449d0696a6757b1f9683919",
+        "bytes": 7439,
+        "sha256": "300c79cee97328c075d0edc399b3fdf67f72614ade64b43b63c1c67ac0768868",
         "transform": "public-raw"
       },
       {
         "source": "src/common-auth-embedded/quota/codec.js",
         "output": "src/tui-raw/common-auth-embedded/quota/codec.js",
-        "bytes": 447,
-        "sha256": "57b9e00cf8e223125e221d7018a5decf2721ea5a0d8970b60d39416b2d4e3415",
+        "bytes": 491,
+        "sha256": "7e5d808de31ef377a0ca9de513999f09cabcb28fac008032f0bdfc32ff8ae13c",
         "transform": "public-raw"
       },
       {
         "source": "src/common-auth-embedded/quota/format.js",
         "output": "src/tui-raw/common-auth-embedded/quota/format.js",
-        "bytes": 5819,
-        "sha256": "d519196801e90952dd4729007f41615a25a2c471db8ef52bf2008ee81a099c6a",
+        "bytes": 7317,
+        "sha256": "be82fbb583247da651565e89d5f42baded960f8cc468acbf8a7492e0e930804b",
         "transform": "public-raw"
       },
       {
         "source": "src/common-auth-embedded/quota/projection.js",
         "output": "src/tui-raw/common-auth-embedded/quota/projection.js",
-        "bytes": 5509,
-        "sha256": "776e68f8d32fdbc8731c9f223a3f92ae3c65d72120010f33b36a4dfa97e6a610",
+        "bytes": 5640,
+        "sha256": "00d71decab6096eb291046a77b1845ba258cb90d5b54f1fc31942a943aa8147d",
         "transform": "public-raw"
       },
       {
         "source": "src/common-auth-embedded/quota/index.js",
         "output": "src/tui-raw/common-auth-embedded/quota/index.js",
-        "bytes": 463,
-        "sha256": "aa92ded7765df475a823917f43d03eeac128737e4333ab334d90864240edff3f",
+        "bytes": 497,
+        "sha256": "aa011324f0429617564cf26b4ba67c31390fc8f7a3547784ca4860059af7422b",
         "transform": "public-raw"
       },
       {
         "source": "src/quota-presentation.ts",
         "output": "src/tui-raw/quota-presentation.js",
-        "bytes": 1754,
-        "sha256": "59eb12aeb0bf5ae092e523599aaa050fd40ab91f6c8da9a96c348a6c0a34c30c",
+        "bytes": 2428,
+        "sha256": "1db4a0acf6381406e220f88a8c89698fa33ca9fda9318fa38b7baed92c8acef6",
         "transform": "public-raw"
       },
       {
@@ -74,8 +74,8 @@
       {
         "source": "src/sidebar-state.ts",
         "output": "src/tui-raw/sidebar-state.js",
-        "bytes": 16312,
-        "sha256": "e2dd0cde9ad577d7214ed688ba6ff27ff76fabbdcd0ee7f65fbc1498c262583d",
+        "bytes": 16741,
+        "sha256": "5c56611518def17861fc7c7c1fb67f705bda32e6be5ef4932d1481db12378359",
         "transform": "public-raw"
       },
       {
@@ -186,8 +186,8 @@
       {
         "source": "src/tui.tsx",
         "output": "src/tui-raw/tui.tsx",
-        "bytes": 38183,
-        "sha256": "546c5a4f13c45f932a336639bceb11c11cff0549eb09a874e8c4f8f0a13e440c",
+        "bytes": 44392,
+        "sha256": "6ce49b90c9c5953aa8bffd7780fb9442981795ac37abd223096d4f0140a1bd78",
         "transform": "public-raw"
       },
       {
@@ -212,50 +212,50 @@
       {
         "source": "src/common-auth-embedded/quota/map.js",
         "output": "src/tui-compiled/common-auth-embedded/quota/map.js",
-        "bytes": 4271,
-        "sha256": "61fb25c789389e57ff8cceb450f6872c2b6e4961cec3c4650f6af699ab5a27f2",
+        "bytes": 5669,
+        "sha256": "95339af4c80684b4e462f5ba32affeaa5f8b5885db599dc5e8ac1ffd1890d729",
         "transform": "public-solid-runtime"
       },
       {
         "source": "src/common-auth-embedded/quota/merge.js",
         "output": "src/tui-compiled/common-auth-embedded/quota/merge.js",
-        "bytes": 6513,
-        "sha256": "0293bf0f2e27055306d750ebd2983edf6a22ef2aa449d0696a6757b1f9683919",
+        "bytes": 7439,
+        "sha256": "300c79cee97328c075d0edc399b3fdf67f72614ade64b43b63c1c67ac0768868",
         "transform": "public-solid-runtime"
       },
       {
         "source": "src/common-auth-embedded/quota/codec.js",
         "output": "src/tui-compiled/common-auth-embedded/quota/codec.js",
-        "bytes": 447,
-        "sha256": "57b9e00cf8e223125e221d7018a5decf2721ea5a0d8970b60d39416b2d4e3415",
+        "bytes": 491,
+        "sha256": "7e5d808de31ef377a0ca9de513999f09cabcb28fac008032f0bdfc32ff8ae13c",
         "transform": "public-solid-runtime"
       },
       {
         "source": "src/common-auth-embedded/quota/format.js",
         "output": "src/tui-compiled/common-auth-embedded/quota/format.js",
-        "bytes": 5819,
-        "sha256": "d519196801e90952dd4729007f41615a25a2c471db8ef52bf2008ee81a099c6a",
+        "bytes": 7317,
+        "sha256": "be82fbb583247da651565e89d5f42baded960f8cc468acbf8a7492e0e930804b",
         "transform": "public-solid-runtime"
       },
       {
         "source": "src/common-auth-embedded/quota/projection.js",
         "output": "src/tui-compiled/common-auth-embedded/quota/projection.js",
-        "bytes": 5509,
-        "sha256": "776e68f8d32fdbc8731c9f223a3f92ae3c65d72120010f33b36a4dfa97e6a610",
+        "bytes": 5640,
+        "sha256": "00d71decab6096eb291046a77b1845ba258cb90d5b54f1fc31942a943aa8147d",
         "transform": "public-solid-runtime"
       },
       {
         "source": "src/common-auth-embedded/quota/index.js",
         "output": "src/tui-compiled/common-auth-embedded/quota/index.js",
-        "bytes": 463,
-        "sha256": "aa92ded7765df475a823917f43d03eeac128737e4333ab334d90864240edff3f",
+        "bytes": 497,
+        "sha256": "aa011324f0429617564cf26b4ba67c31390fc8f7a3547784ca4860059af7422b",
         "transform": "public-solid-runtime"
       },
       {
         "source": "src/quota-presentation.ts",
         "output": "src/tui-compiled/quota-presentation.js",
-        "bytes": 1754,
-        "sha256": "59eb12aeb0bf5ae092e523599aaa050fd40ab91f6c8da9a96c348a6c0a34c30c",
+        "bytes": 2428,
+        "sha256": "1db4a0acf6381406e220f88a8c89698fa33ca9fda9318fa38b7baed92c8acef6",
         "transform": "public-solid-runtime"
       },
       {
@@ -268,8 +268,8 @@
       {
         "source": "src/sidebar-state.ts",
         "output": "src/tui-compiled/sidebar-state.js",
-        "bytes": 16312,
-        "sha256": "e2dd0cde9ad577d7214ed688ba6ff27ff76fabbdcd0ee7f65fbc1498c262583d",
+        "bytes": 16741,
+        "sha256": "5c56611518def17861fc7c7c1fb67f705bda32e6be5ef4932d1481db12378359",
         "transform": "public-solid-runtime"
       },
       {
@@ -380,8 +380,8 @@
       {
         "source": "src/tui.tsx",
         "output": "src/tui-compiled/tui.js",
-        "bytes": 42748,
-        "sha256": "7402c1774b92e3a52271def5a8353a5779795af50a23d92d6fb43a778062abf6",
+        "bytes": 49988,
+        "sha256": "180134f3cbda65fd065075872eb93f6403b28fed88df70a4c3f3ea71fc74877b",
         "transform": "public-solid-runtime"
       },
       {

package/dist/tui-ga-build-map.json

@@ -1,6 +1,6 @@
 {
   "schema": 1,
-  "compiler": "@cortexkit/common-auth/tui-build@0.15.0",
+  "compiler": "@cortexkit/common-auth/tui-build@0.17.2",
   "bun": "1.4.2",
   "raw": {
     "selector": "selector.js",
@@ -11,50 +11,50 @@
       {
         "source": "src/common-auth-embedded/quota/map.js",
         "output": "src/tui-ga-raw/shared/77138df80c7ae006-map.js",
-        "bytes": 4271,
-        "sha256": "61fb25c789389e57ff8cceb450f6872c2b6e4961cec3c4650f6af699ab5a27f2",
+        "bytes": 5669,
+        "sha256": "95339af4c80684b4e462f5ba32affeaa5f8b5885db599dc5e8ac1ffd1890d729",
         "transform": "public-raw"
       },
       {
         "source": "src/common-auth-embedded/quota/merge.js",
         "output": "src/tui-ga-raw/shared/ecc214300932dfb6-merge.js",
-        "bytes": 6530,
-        "sha256": "f3188832c0cd87c6aa9e95643562403af0a9cbada3146c23fb6aa5bf1d6213c1",
+        "bytes": 7456,
+        "sha256": "b8a301cb82e3957a80bb3f5169497fad38e584ddbe4b5e0812df3263dd736a30",
         "transform": "public-raw"
       },
       {
         "source": "src/common-auth-embedded/quota/codec.js",
         "output": "src/tui-ga-raw/shared/ca21dc417b36dc5d-codec.js",
-        "bytes": 481,
-        "sha256": "cee2b513848c321a0a1f1e63f541c780e4e9dfb3707a6d13ad16512a69b30e87",
+        "bytes": 525,
+        "sha256": "74531bd8985168a13f77ffe7693faae3e8cad87a42fb684b60fa01bb9c4dbd30",
         "transform": "public-raw"
       },
       {
         "source": "src/common-auth-embedded/quota/format.js",
         "output": "src/tui-ga-raw/shared/aef2402f8fc342f0-format.js",
-        "bytes": 5836,
-        "sha256": "b271d2ca390d705ce12f299e5c57e26d4c9a9fecc0d036eacc075713653a88c1",
+        "bytes": 7334,
+        "sha256": "390b5d8474db7cfc8f6f61b6c2e8aea1d8dd19e02a1dc66e93956378db2bce9c",
         "transform": "public-raw"
       },
       {
         "source": "src/common-auth-embedded/quota/projection.js",
         "output": "src/tui-ga-raw/shared/1ff34afa7c42d196-projection.js",
-        "bytes": 5526,
-        "sha256": "3a9714f112d5960dd7a9b9f703533e788bf6c204c9d42584a48072a989d70317",
+        "bytes": 5657,
+        "sha256": "5256f704683c441a24fdb5a507600d82c41f6dab90037854efdfd5845f61d23d",
         "transform": "public-raw"
       },
       {
         "source": "src/common-auth-embedded/quota/index.js",
         "output": "src/tui-ga-raw/shared/bf17cbee28e58197-index.js",
-        "bytes": 548,
-        "sha256": "72d2e78a0d7c7155720db25b45605a621d5fc109d9ee51fa34b14f53790b3270",
+        "bytes": 582,
+        "sha256": "8e7bc90dbe700d9117588b07dc2ebc3badfe4191c701e34e57d42537096bf2b2",
         "transform": "public-raw"
       },
       {
         "source": "src/quota-presentation.ts",
         "output": "src/tui-ga-raw/shared/98cc0c186c46c42d-quota-presentation.js",
-        "bytes": 1744,
-        "sha256": "d7654d82635dc30ddf267656981a1d3830300334166a1dd714e3d093b929ebb5",
+        "bytes": 2418,
+        "sha256": "7cca1d2f7993bb2829a8f73c5a92c63607cf7e94777d188b087bcd057dfe90cc",
         "transform": "public-raw"
       },
       {
@@ -81,8 +81,8 @@
       {
         "source": "src/ga/tui/host-ga.tsx",
         "output": "src/tui-ga-raw/host-ga.tsx",
-        "bytes": 56181,
-        "sha256": "b8ba5ddc6727e5251bbc1f8f0e7ffb259a9c7732dbbc7e9bc567282d412c3de7",
+        "bytes": 55361,
+        "sha256": "d633350ddeb7d3ac2c39df0c5e7c8c916022c56185f8f12cff17fd5d12a9e720",
         "transform": "public-raw"
       },
       {
@@ -101,50 +101,50 @@
       {
         "source": "src/common-auth-embedded/quota/map.js",
         "output": "src/tui-ga-compiled/shared/77138df80c7ae006-map.js",
-        "bytes": 4271,
-        "sha256": "61fb25c789389e57ff8cceb450f6872c2b6e4961cec3c4650f6af699ab5a27f2",
+        "bytes": 5669,
+        "sha256": "95339af4c80684b4e462f5ba32affeaa5f8b5885db599dc5e8ac1ffd1890d729",
         "transform": "public-solid-runtime"
       },
       {
         "source": "src/common-auth-embedded/quota/merge.js",
         "output": "src/tui-ga-compiled/shared/ecc214300932dfb6-merge.js",
-        "bytes": 6530,
-        "sha256": "f3188832c0cd87c6aa9e95643562403af0a9cbada3146c23fb6aa5bf1d6213c1",
+        "bytes": 7456,
+        "sha256": "b8a301cb82e3957a80bb3f5169497fad38e584ddbe4b5e0812df3263dd736a30",
         "transform": "public-solid-runtime"
       },
       {
         "source": "src/common-auth-embedded/quota/codec.js",
         "output": "src/tui-ga-compiled/shared/ca21dc417b36dc5d-codec.js",
-        "bytes": 481,
-        "sha256": "cee2b513848c321a0a1f1e63f541c780e4e9dfb3707a6d13ad16512a69b30e87",
+        "bytes": 525,
+        "sha256": "74531bd8985168a13f77ffe7693faae3e8cad87a42fb684b60fa01bb9c4dbd30",
         "transform": "public-solid-runtime"
       },
       {
         "source": "src/common-auth-embedded/quota/format.js",
         "output": "src/tui-ga-compiled/shared/aef2402f8fc342f0-format.js",
-        "bytes": 5836,
-        "sha256": "b271d2ca390d705ce12f299e5c57e26d4c9a9fecc0d036eacc075713653a88c1",
+        "bytes": 7334,
+        "sha256": "390b5d8474db7cfc8f6f61b6c2e8aea1d8dd19e02a1dc66e93956378db2bce9c",
         "transform": "public-solid-runtime"
       },
       {
         "source": "src/common-auth-embedded/quota/projection.js",
         "output": "src/tui-ga-compiled/shared/1ff34afa7c42d196-projection.js",
-        "bytes": 5526,
-        "sha256": "3a9714f112d5960dd7a9b9f703533e788bf6c204c9d42584a48072a989d70317",
+        "bytes": 5657,
+        "sha256": "5256f704683c441a24fdb5a507600d82c41f6dab90037854efdfd5845f61d23d",
         "transform": "public-solid-runtime"
       },
       {
         "source": "src/common-auth-embedded/quota/index.js",
         "output": "src/tui-ga-compiled/shared/bf17cbee28e58197-index.js",
-        "bytes": 548,
-        "sha256": "72d2e78a0d7c7155720db25b45605a621d5fc109d9ee51fa34b14f53790b3270",
+        "bytes": 582,
+        "sha256": "8e7bc90dbe700d9117588b07dc2ebc3badfe4191c701e34e57d42537096bf2b2",
         "transform": "public-solid-runtime"
       },
       {
         "source": "src/quota-presentation.ts",
         "output": "src/tui-ga-compiled/shared/98cc0c186c46c42d-quota-presentation.js",
-        "bytes": 1744,
-        "sha256": "d7654d82635dc30ddf267656981a1d3830300334166a1dd714e3d093b929ebb5",
+        "bytes": 2418,
+        "sha256": "7cca1d2f7993bb2829a8f73c5a92c63607cf7e94777d188b087bcd057dfe90cc",
         "transform": "public-solid-runtime"
       },
       {
@@ -171,8 +171,8 @@
       {
         "source": "src/ga/tui/host-ga.tsx",
         "output": "src/tui-ga-compiled/host-ga.js",
-        "bytes": 47782,
-        "sha256": "4335896b2c25c9d7600d2fe31f3e5f21d357c01b6f835bd2e7db2b76f844282e",
+        "bytes": 46935,
+        "sha256": "3d9e4dda9b48e6849266369e284987017850a86acfd1ddb07c0b0a243a7700c4",
         "transform": "public-solid-runtime"
       },
       {

package/dist/types/src/auth-method-labels.d.ts

@@ -0,0 +1,3 @@
+export declare const OPENCODE2_POOL_AUTH_LABEL = "Google (antigravity-auth pool, browser)";
+export declare const OPENCODE2_VAULT_AUTH_LABEL = "Use approved Antigravity vault";
+//# sourceMappingURL=auth-method-labels.d.ts.map

package/dist/types/src/auth-method-labels.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-method-labels.d.ts","sourceRoot":"","sources":["../../../src/auth-method-labels.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,yBAAyB,4CACK,CAAA;AAC3C,eAAO,MAAM,0BAA0B,mCAAmC,CAAA"}

package/dist/types/src/cli.d.ts

@@ -1,4 +1,5 @@
 import { type AccountMetadataV3, type AccountMigrationOutcome, type AccountQuotaResult, type AccountRow, type AccountStorageV4 } from '@cortexkit/antigravity-auth-core';
+import type { SetupCallbackContext, SetupHost, SetupIO } from './common-auth-embedded/setup/index.js';
 import { type AntigravityTokenExchangeSuccess, type OAuthLoginRequest, performOAuthLogin } from './plugin/oauth-login.js';
 interface WritableOutput {
     write(value: string): unknown;
@@ -9,13 +10,14 @@ export interface CliDependencies {
     prompt(message: string): Promise<string>;
     openBrowser(url: string): Promise<void>;
     isHeadless?(): boolean;
-    performLogin(request: OAuthLoginRequest, openBrowser: (url: string) => Promise<void>): Promise<AntigravityTokenExchangeSuccess>;
+    performLogin(request: OAuthLoginRequest, openBrowser: (url: string) => Promise<void>, host?: SetupHost, context?: SetupCallbackContext): Promise<AntigravityTokenExchangeSuccess>;
     loadAccounts(): Promise<AccountStorageV4 | null>;
     getQuota(accounts: AccountMetadataV3[], options: {
         refresh: boolean;
     }): Promise<AccountQuotaResult[]>;
     /** Offline operations on the account store; see `AccountStoreOperations`. */
     accountStore: AccountStoreOperations;
+    setupIO?: SetupIO;
 }
 /**
  * The offline account-store operations, each bound to the canonical

package/dist/types/src/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../../../src/cli.ts"],"names":[],"mappings":"AAKA,OAAO,EACL,KAAK,iBAAiB,EACtB,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,KAAK,UAAU,EACf,KAAK,gBAAgB,EAQtB,MAAM,kCAAkC,CAAA;AAEzC,OAAO,EACL,KAAK,+BAA+B,EACpC,KAAK,iBAAiB,EACtB,iBAAiB,EAClB,MAAM,sBAAsB,CAAA;AAM7B,UAAU,cAAc;IACtB,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAA;CAC9B;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,cAAc,CAAA;IACtB,MAAM,EAAE,cAAc,CAAA;IACtB,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IACxC,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACvC,UAAU,CAAC,IAAI,OAAO,CAAA;IACtB,YAAY,CACV,OAAO,EAAE,iBAAiB,EAC1B,WAAW,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GAC1C,OAAO,CAAC,+BAA+B,CAAC,CAAA;IAC3C,YAAY,IAAI,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAA;IAChD,QAAQ,CACN,QAAQ,EAAE,iBAAiB,EAAE,EAC7B,OAAO,EAAE;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,GAC5B,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAA;IAChC,6EAA6E;IAC7E,YAAY,EAAE,sBAAsB,CAAA;CACrC;AAED;;;;;GAKG;AACH,MAAM,WAAW,sBAAsB;IACrC,iFAAiF;IACjF,UAAU,IAAI,MAAM,CAAA;IACpB,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAA;IAC7D,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAA;IAC9D,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAA;IAChE,+DAA+D;IAC/D,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAAA;CACnD;AAED;;;;GAIG;AACH,MAAM,MAAM,eAAe,GACvB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,iBAAiB,EAAE,CAAA;CAAE,GAChD;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAClB;IAAE,IAAI,EAAE,eAAe,CAAA;CAAE,GACzB;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAA;AA8M3C,wBAAsB,MAAM,CAC1B,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,EAAE,eAAe,GACpB,OAAO,CAAC,MAAM,CAAC,CA6GjB;AAcD,wBAAgB,4BAA4B,IAAI,eAAe,CAyC9D;AAMD;;;GAGG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,UAAU,GAAG,iBAAiB,CAoC/D;AAqDD;;;;;GAKG;AACH,wBAAgB,mCAAmC,IAAI,sBAAsB,CAuB5E;AASD,OAAO,EAAE,iBAAiB,EAAE,CAAA"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../../../src/cli.ts"],"names":[],"mappings":"AAOA,OAAO,EACL,KAAK,iBAAiB,EACtB,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EAEvB,KAAK,UAAU,EACf,KAAK,gBAAgB,EAQtB,MAAM,kCAAkC,CAAA;AAEzC,OAAO,KAAK,EACV,oBAAoB,EACpB,SAAS,EACT,OAAO,EACR,MAAM,uCAAuC,CAAA;AAC9C,OAAO,EACL,KAAK,+BAA+B,EACpC,KAAK,iBAAiB,EACtB,iBAAiB,EAClB,MAAM,sBAAsB,CAAA;AAiB7B,UAAU,cAAc;IACtB,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAA;CAC9B;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,cAAc,CAAA;IACtB,MAAM,EAAE,cAAc,CAAA;IACtB,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IACxC,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACvC,UAAU,CAAC,IAAI,OAAO,CAAA;IACtB,YAAY,CACV,OAAO,EAAE,iBAAiB,EAC1B,WAAW,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,EAC3C,IAAI,CAAC,EAAE,SAAS,EAChB,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,+BAA+B,CAAC,CAAA;IAC3C,YAAY,IAAI,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAA;IAChD,QAAQ,CACN,QAAQ,EAAE,iBAAiB,EAAE,EAC7B,OAAO,EAAE;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,GAC5B,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAA;IAChC,6EAA6E;IAC7E,YAAY,EAAE,sBAAsB,CAAA;IACpC,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAED;;;;;GAKG;AACH,MAAM,WAAW,sBAAsB;IACrC,iFAAiF;IACjF,UAAU,IAAI,MAAM,CAAA;IACpB,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAA;IAC7D,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAA;IAC9D,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAA;IAChE,+DAA+D;IAC/D,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAAA;CACnD;AAED;;;;GAIG;AACH,MAAM,MAAM,eAAe,GACvB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,iBAAiB,EAAE,CAAA;CAAE,GAChD;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAClB;IAAE,IAAI,EAAE,eAAe,CAAA;CAAE,GACzB;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAA;AAiN3C,wBAAsB,MAAM,CAC1B,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,EAAE,eAAe,GACpB,OAAO,CAAC,MAAM,CAAC,CAsHjB;AAcD,wBAAgB,4BAA4B,IAAI,eAAe,CAiE9D;AAmED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,UAAU,GAAG,iBAAiB,CAoC/D;AAqDD;;;;;GAKG;AACH,wBAAgB,mCAAmC,IAAI,sBAAsB,CAuB5E;AAsBD,OAAO,EAAE,iBAAiB,EAAE,CAAA"}

package/dist/types/src/common-auth-embedded/auth-menu/terminal.d.ts

@@ -0,0 +1,43 @@
+/**
+ * The terminal the menu draws on and reads keys from. The process's own
+ * stdin and stdout satisfy it; tests pass a scripted stand-in, so the full
+ * key-in, frame-out path runs without a real TTY.
+ */
+export interface MenuTerminal {
+    input: MenuInput;
+    output: MenuOutput;
+    /**
+     * Where SIGINT and SIGTERM are heard while a selector holds raw mode, so a
+     * kill restores the terminal. Defaults to nothing: raw mode turns Ctrl-C
+     * into a key the selector already handles.
+     */
+    signals?: MenuSignals;
+}
+export interface MenuInput {
+    /** True only on an interactive terminal; anything else gets a plain list. */
+    readonly isTTY?: boolean;
+    readonly isRaw?: boolean;
+    setRawMode(mode: boolean): unknown;
+    resume(): unknown;
+    pause(): unknown;
+    on(event: 'data', listener: (data: Buffer | string) => void): unknown;
+    removeListener(event: 'data', listener: (data: Buffer | string) => void): unknown;
+}
+export interface MenuOutput {
+    write(text: string): unknown;
+    readonly columns?: number;
+    readonly rows?: number;
+}
+export interface MenuSignals {
+    once(signal: 'SIGINT' | 'SIGTERM', listener: () => void): unknown;
+    removeListener(signal: 'SIGINT' | 'SIGTERM', listener: () => void): unknown;
+}
+/** The current process's terminal, with its signals. */
+export declare function processTerminal(): MenuTerminal;
+/**
+ * Whether keys can be read one at a time. Only the input is checked, as the
+ * plugins' menus always did: output piped to a file still gets the menu.
+ */
+export declare function isInteractive(terminal: MenuTerminal): boolean;
+/** Writes one line of plain output below the menu. */
+export declare function printLine(terminal: MenuTerminal, line?: string): void;

package/dist/types/src/common-auth-embedded/claustrum/consumer.d.ts

@@ -0,0 +1,132 @@
+import type { ClaustrumReporterSource } from '@cortexkit/claustrum-client';
+import type { QuotaObservation } from '../quota/index.js';
+import type { RoutingRow } from '../routing/index.js';
+import { type ClaustrumFamily, type ClaustrumScopedAttempt, type ClaustrumScopedClient, type IdentityParser } from './custody.js';
+import { type ClaustrumLogger } from './errors.js';
+import { type InsulaQuotaOptions } from './insula.js';
+import { type AccountMapper, type QuotaReceipt, type VaultRosterFile } from './roster.js';
+export interface ClaustrumConsumerOptions<Q = QuotaObservation> {
+    /**
+     * The roster file: one row per vault account (route id, credential id,
+     * account identity, state, quota), plus the accounts the user declined. It
+     * never holds a token.
+     */
+    rosterPath: string;
+    /** This host's enrollment token, written by setup. */
+    tokenPath: string;
+    family: ClaustrumFamily;
+    connect: () => Promise<ClaustrumScopedClient>;
+    /**
+     * Whether the plugin currently takes its accounts from the vault (custody
+     * mode) rather than from local logins. Checked before every discovery,
+     * commit and dispatch; false closes the vault connection and refuses sends.
+     */
+    isCustodyActive?: () => boolean | Promise<boolean>;
+    /** Ids of the plugin's local pool rows; no vault route id may equal one. */
+    reservedRouteIds?: () => Iterable<string>;
+    routePrefix?: string;
+    mapAccount?: AccountMapper;
+    parseIdentity?: IdentityParser;
+    /**
+     * Issue a receipt only when the vault's served reply itself names the
+     * credential id and the roster's account identity (see
+     * `ClaustrumScopedCustody`). Set it for providers whose tokens do not reveal
+     * their account; leave it unset to accept a reply that asserts no identity.
+     */
+    requireAssertion?: boolean;
+    /**
+     * Fired once per change of the vault's view cursor, including the first
+     * roster. A poll that sees the same view does not fire, and neither does a
+     * routine token refresh, which never moves the view.
+     */
+    onRoster?: (roster: VaultRosterFile) => void;
+    onError?: (error: unknown) => void;
+    pollIntervalMs?: number;
+    setTimeoutImpl?: typeof setTimeout;
+    clearTimeoutImpl?: typeof clearTimeout;
+    now?: () => number;
+    logger?: ClaustrumLogger;
+    /** Optional background quota source. In-band readings still use recordQuota. */
+    insula?: InsulaQuotaOptions<Q>;
+}
+export interface SendOptions {
+    /**
+     * What kind of request this is (for example `model`, `quota`, `profile`),
+     * recorded in the 401 retry log line so a retry can be traced to its caller.
+     */
+    site: string;
+    signal?: AbortSignal;
+    reporterSource?: ClaustrumReporterSource;
+}
+/**
+ * One plugin host's view of its vault accounts. It turns vault credentials
+ * into rows for `/routing`, authorizes each physical send with the vault, and
+ * reports a 401 against the exact record version that send used. Metadata
+ * (the connection and discovery) is shared and coalesced; credential reads
+ * never are. It never enrolls: a missing token is an error here, and setup
+ * is where enrollment happens.
+ */
+export declare class ClaustrumConsumer<Q = QuotaObservation> {
+    #private;
+    constructor(options: ClaustrumConsumerOptions<Q>);
+    /** The last committed roster this instance saw, without any I/O. */
+    snapshot(): VaultRosterFile | undefined;
+    /** Rows for `/routing`, from the last committed roster. */
+    routingRows(): RoutingRow[];
+    refresh(): Promise<VaultRosterFile | undefined>;
+    start(): void;
+    /**
+     * Fetch on a background tick, at most once per minute across projects with
+     * the same daemon and enrollment token path. Admission must use the cache
+     * instead, so an optional quota daemon never delays a provider request.
+     */
+    refreshInsulaQuota(): Promise<void>;
+    /**
+     * Cache-only, for unknown-quota admission with a served receipt. Undefined
+     * means poll the provider normally. Only get_scoped's asserted account_id
+     * joins insula; parsed identities and display metadata cannot substitute.
+     * Background polling should use cachedInsulaQuotaForRoute instead.
+     */
+    cachedInsulaQuota(receipt: Pick<ClaustrumScopedAttempt, 'assertedAccountIdentity'>): Promise<Q | undefined>;
+    /**
+     * Background cache lookup without fetching a credential. Re-read the roster
+     * so a peer's account replacement invalidates the old route immediately.
+     * A route without a known provider account cannot join an insula entry.
+     */
+    cachedInsulaQuotaForRoute(routeId: string): Promise<Q | undefined>;
+    /**
+     * Authorize one physical send on a vault route. The roster file is re-read
+     * first, so a decline committed by another process applies before the next
+     * poll, and a route whose credential or account changed is refused.
+     */
+    authorize(routeId: string, signal?: AbortSignal): Promise<ClaustrumScopedAttempt>;
+    reportFailure(attempt: ClaustrumScopedAttempt, status: number, source: ClaustrumReporterSource): Promise<void>;
+    /**
+     * Send on a vault route. `dispatch` builds and sends the request with the
+     * receipt's token and may be called twice, so it must be able to rebuild
+     * its body. A 401 is retried once, and only when the vault now serves a new
+     * record version of the same credential and account; the final 401 is
+     * reported against the version that send actually used. Each call to
+     * `dispatch` gets its own receipt.
+     */
+    send(routeId: string, dispatch: (attempt: ClaustrumScopedAttempt, signal?: AbortSignal) => Promise<Response>, options: SendOptions): Promise<Response>;
+    /** Decline a vault account: it stays listed and never routes until accepted. */
+    decline(routeId: string): Promise<void>;
+    accept(routeId: string): Promise<void>;
+    /**
+     * Store a quota or profile observation for a vault route. The receipt the
+     * reading was taken with is required: the observation lands only while the
+     * route still holds the credential and account that receipt was served for
+     * (see `recordVaultQuota`), so a reading for a replaced account is dropped.
+     */
+    recordQuota(routeId: string, observation: QuotaObservation, attempt: QuotaReceipt): Promise<boolean>;
+    /**
+     * Store a background observation that belongs to an account rather than to
+     * a served credential (an insula reading from `cachedInsulaQuotaForRoute`).
+     * It lands only while the route is still bound to that known account, so no
+     * credential fetch is needed and a replaced account's reading is dropped.
+     * The in-memory roster is reloaded from the file, without a vault call.
+     */
+    recordAccountQuota(routeId: string, accountIdentity: string, observation: QuotaObservation): Promise<boolean>;
+    close(): void;
+}