@cortexkit/opencode-antigravity-auth 3.0.5 → 3.0.6

package/dist/types/src/plugin/vault-quota-outcome.d.ts

@@ -0,0 +1,19 @@
+/** Closed diagnostic vocabulary: never copy an error message or remote identifier into a tick record. */
+export type VaultQuotaReason = 'recorded' | 'fresh' | 'lock-busy' | 'lock-lost' | 'authority' | 'no-rows' | 'fetch-failed' | 'deadline' | 'unattributed' | 'binding-stale' | 'version-changed' | 'state-lock' | 'state-invalid' | 'write-uncertain' | 'publish-failed' | 'aborted' | 'admission-refused' | 'roster-unavailable' | 'commit-unchanged';
+export type VaultQuotaStage = 'authority' | 'lock' | 'roster' | 'state' | 'fetch' | 'commit' | 'publish';
+export interface VaultQuotaOutcome {
+    tick: string;
+    reason: VaultQuotaReason;
+    stage: VaultQuotaStage;
+    elapsedMs: number;
+    rows: number;
+    checked: number;
+    notChecked: number;
+    reasons: Partial<Record<VaultQuotaReason, number>>;
+    endpoint?: 'summary' | 'models';
+    status?: number;
+    errorKind?: string;
+}
+export declare function vaultQuotaErrorReason(error: unknown, fallback: VaultQuotaReason): VaultQuotaReason;
+export declare function vaultQuotaErrorKind(error: unknown): string;
+//# sourceMappingURL=vault-quota-outcome.d.ts.map

package/dist/types/src/plugin/vault-quota-outcome.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault-quota-outcome.d.ts","sourceRoot":"","sources":["../../../../src/plugin/vault-quota-outcome.ts"],"names":[],"mappings":"AAAA,yGAAyG;AACzG,MAAM,MAAM,gBAAgB,GACxB,UAAU,GACV,OAAO,GACP,WAAW,GACX,WAAW,GACX,WAAW,GACX,SAAS,GACT,cAAc,GACd,UAAU,GACV,cAAc,GACd,eAAe,GACf,iBAAiB,GACjB,YAAY,GACZ,eAAe,GACf,iBAAiB,GACjB,gBAAgB,GAChB,SAAS,GACT,mBAAmB,GACnB,oBAAoB,GACpB,kBAAkB,CAAA;AAEtB,MAAM,MAAM,eAAe,GACvB,WAAW,GACX,MAAM,GACN,QAAQ,GACR,OAAO,GACP,OAAO,GACP,QAAQ,GACR,SAAS,CAAA;AAEb,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,gBAAgB,CAAA;IACxB,KAAK,EAAE,eAAe,CAAA;IACtB,SAAS,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,MAAM,CAAA;IAClB,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC,CAAA;IAClD,QAAQ,CAAC,EAAE,SAAS,GAAG,QAAQ,CAAA;IAC/B,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,OAAO,EACd,QAAQ,EAAE,gBAAgB,GACzB,gBAAgB,CAmClB;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAU1D"}

package/dist/types/src/setup.d.ts

@@ -0,0 +1,15 @@
+import type { CliDependencies } from './cli.js';
+import { type SetupCallbackContext, type SetupIO, type SetupPlugin } from './common-auth-embedded/setup/index.js';
+import type { AntigravityTokenExchangeSuccess } from './plugin/oauth-login.js';
+/**
+ * Refuse local sign-in if vault access is approved or auth.json holds its vault
+ * marker. Re-read both because they can change while the OAuth browser is open.
+ */
+export declare function assertLocalOpenCodeLogin(legacyPath: string, generation?: SetupCallbackContext['opencodeGeneration']): Promise<void>;
+export declare function assertSetupHostsStopped(): Promise<void>;
+/** Pi stores its local login in auth.json, not OpenCode's account pool. */
+export declare function persistPiSetupLogin(result: AntigravityTokenExchangeSuccess, context: SetupCallbackContext): Promise<void>;
+export declare function createSetupPlugin(deps: CliDependencies, migrateOpenCode: () => Promise<number>, forceLogin?: boolean): Promise<SetupPlugin>;
+/** CLI-only entry: importing setup must never add the vault client to a renderer graph. */
+export declare function runPluginSetup(argv: string[], deps: CliDependencies, migrateOpenCode: () => Promise<number>, io?: SetupIO): Promise<void>;
+//# sourceMappingURL=setup.d.ts.map

package/dist/types/src/setup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup.d.ts","sourceRoot":"","sources":["../../../src/setup.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,UAAU,CAAA;AAC/C,OAAO,EAIL,KAAK,oBAAoB,EAEzB,KAAK,OAAO,EACZ,KAAK,WAAW,EACjB,MAAM,uCAAuC,CAAA;AAC9C,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,yBAAyB,CAAA;AA8C9E;;;GAGG;AACH,wBAAsB,wBAAwB,CAC5C,UAAU,EAAE,MAAM,EAClB,UAAU,CAAC,EAAE,oBAAoB,CAAC,oBAAoB,CAAC,GACtD,OAAO,CAAC,IAAI,CAAC,CAwBf;AAED,wBAAsB,uBAAuB,IAAI,OAAO,CAAC,IAAI,CAAC,CAE7D;AA4CD,2EAA2E;AAC3E,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,+BAA+B,EACvC,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,IAAI,CAAC,CAWf;AAED,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,eAAe,EACrB,eAAe,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,EACtC,UAAU,UAAQ,GACjB,OAAO,CAAC,WAAW,CAAC,CA4RtB;AAED,2FAA2F;AAC3F,wBAAsB,cAAc,CAClC,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,EAAE,eAAe,EACrB,eAAe,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,EACtC,EAAE,GAAE,OAAY,GACf,OAAO,CAAC,IAAI,CAAC,CAOf"}

package/dist/types/src/sidebar-state.d.ts

@@ -81,7 +81,7 @@ export interface SidebarAccountState {
 export interface SidebarRoutingEntry {
     accountId: string;
     modelFamily: 'claude' | 'gemini';
-    headerStyle: 'antigravity' | 'gemini-cli';
+    headerStyle: 'antigravity';
     strategy?: 'sticky' | 'round-robin' | 'hybrid';
     updatedAt: number;
 }

package/dist/types/src/sidebar-state.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sidebar-state.d.ts","sourceRoot":"","sources":["../../../src/sidebar-state.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAeH,eAAO,MAAM,qBAAqB,EAAG,CAAU,CAAA;AAE/C,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,YAAY,CAAA;AAErD,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,QAAQ,GAAG,IAAI,CAAA;IACvB,gBAAgB,EAAE,MAAM,CAAA;IACxB,yEAAyE;IACzE,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED,MAAM,WAAW,iBAAiB;IAChC,wEAAwE;IACxE,gBAAgB,EAAE,MAAM,CAAA;IACxB,yEAAyE;IACzE,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,8DAA8D;IAC9D,OAAO,CAAC,EAAE,uBAAuB,EAAE,CAAA;CACpC;AAED,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,8DAA8D;IAC9D,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,OAAO,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,OAAO,CAAA;IAChB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC,CAAA;IAC1D;;;OAGG;IACH,IAAI,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAA;CAC3D;AAED,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,EAAE,QAAQ,GAAG,QAAQ,CAAA;IAChC,WAAW,EAAE,aAAa,GAAG,YAAY,CAAA;IACzC,QAAQ,CAAC,EAAE,QAAQ,GAAG,aAAa,GAAG,QAAQ,CAAA;IAC9C,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,qBAAqB,CAAA;IACrC,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,mBAAmB,EAAE,CAAA;IAC/B,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAA;IAClD,oBAAoB,EAAE,OAAO,CAAA;IAC7B,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,oFAAoF;AACpF,MAAM,MAAM,cAAc,GAAG,cAAc,CAAA;AAE3C;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,mBAAmB,EAAE,CAAA;IAC/B,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAA;CAC/B;AAED,eAAO,MAAM,qBAAqB,EAAE,cAMnC,CAAA;AAED,eAAO,MAAM,iBAAiB,wCAAwC,CAAA;AAmBtE;;;;GAIG;AACH,qBAAa,+BAAgC,SAAQ,KAAK;IACxD,QAAQ,CAAC,OAAO,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAA;gBAE9C,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM;CAOjD;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,gBAAgB,GACxB,YAAY,GACZ,eAAe,GACf,YAAY,GACZ,cAAc,GACd,aAAa,CAAA;AAEjB,MAAM,WAAW,iBAAiB;IAChC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;CAC1D;AAID;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,iBAAiB,GAAG,IAAI,GAAG,IAAI,CAE1E;AAMD;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,CAK5C;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,GAAE,MAA8B,GACnC,cAAc,CAchB;AA6MD;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,GAAE,MAA8B,GACnC,IAAI,CAGN;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,EACxC,GAAG,EAAE,MAAM,GACV,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAarC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,4BAA4B;IAC3C,qDAAqD;IACrD,KAAK,EAAE,MAAM,CAAA;IACb,kEAAkE;IAClE,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,gEAAgE;IAChE,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,kGAAkG;IAClG,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B,WAAW,CAAC,EAAE;QACZ,MAAM,CAAC,EAAE;YACP,iBAAiB,CAAC,EAAE,MAAM,CAAA;YAC1B,SAAS,CAAC,EAAE,MAAM,CAAA;YAClB,OAAO,CAAC,EAAE,KAAK,CAAC;gBACd,MAAM,EAAE,QAAQ,GAAG,IAAI,CAAA;gBACvB,iBAAiB,EAAE,MAAM,CAAA;gBACzB,SAAS,EAAE,MAAM,CAAA;aAClB,CAAC,CAAA;SACH,CAAA;QACD,YAAY,CAAC,EAAE;YACb,iBAAiB,CAAC,EAAE,MAAM,CAAA;YAC1B,SAAS,CAAC,EAAE,MAAM,CAAA;YAClB,OAAO,CAAC,EAAE,KAAK,CAAC;gBACd,MAAM,EAAE,QAAQ,GAAG,IAAI,CAAA;gBACvB,iBAAiB,EAAE,MAAM,CAAA;gBACzB,SAAS,EAAE,MAAM,CAAA;aAClB,CAAC,CAAA;SACH,CAAA;QAID,CAAC,SAAS,EAAE,MAAM,GACd;YACE,iBAAiB,CAAC,EAAE,MAAM,CAAA;YAC1B,SAAS,CAAC,EAAE,MAAM,CAAA;YAClB,UAAU,CAAC,EAAE,MAAM,CAAA;YACnB,OAAO,CAAC,EAAE,KAAK,CAAC;gBACd,MAAM,EAAE,QAAQ,GAAG,IAAI,CAAA;gBACvB,iBAAiB,EAAE,MAAM,CAAA;gBACzB,SAAS,EAAE,MAAM,CAAA;aAClB,CAAC,CAAA;SACH,GACD,SAAS,CAAA;KACd,CAAA;IACD;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B;;;;;OAKG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B;;;;OAIG;IACH,IAAI,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAA;CAC3D;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE;IACtC,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB,GAAG;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAWlE;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,0BAA0B,CACxC,GAAG,EAAE,4BAA4B,CAAC,aAAa,CAAC,GAC/C,4BAA4B,CAAC,aAAa,CAAC,CA8D7C;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,EAAE;IACN,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,OAAO,CAAC,EAAE,aAAa,CAAC;QACtB,MAAM,EAAE,QAAQ,GAAG,IAAI,CAAA;QACvB,iBAAiB,EAAE,MAAM,CAAA;QACzB,SAAS,EAAE,MAAM,CAAA;KAClB,CAAC,CAAA;CACH,EACD,SAAS,CAAC,EAAE,MAAM,GACjB,iBAAiB,GAAG,SAAS,CA4C/B;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,MAAM,EACb,mBAAmB,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACtD,OAAO,CAIT;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,4BAA4B,GACnC,mBAAmB,CAuDrB;AAED;;;;GAIG;AACH,wBAAgB,oCAAoC,CAClD,QAAQ,EAAE,4BAA4B,EAAE,EACxC,OAAO,GAAE;IACP,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,oBAAoB,CAAC,EAAE,OAAO,CAAA;CAC1B,GACL,mBAAmB,CAQrB;AAED,UAAU,wBAAwB;IAChC,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,0FAA0F;IAC1F,0BAA0B,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAC/C;AAeD;;;;GAIG;AACH,wBAAgB,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC,CAElD;AA2HD;;;;;GAKG;AACH,wBAAsB,0BAA0B,CAC9C,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,mBAAmB,EAC1B,OAAO,GAAE,wBAAwB,GAAG;IAClC,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,wBAAwB,CAAC,EAAE,OAAO,CAAA;CAC9B,GACL,OAAO,CAAC,IAAI,CAAC,CAgBf;AAED;;;GAGG;AACH,wBAAsB,0BAA0B,CAC9C,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,wBAA6B,GACrC,OAAO,CAAC,IAAI,CAAC,CAaf;AAED;;;;GAIG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,mBAAmB,EACzB,OAAO,GAAE,wBAA6B,GACrC,OAAO,CAAC,IAAI,CAAC,CAKf"}
+{"version":3,"file":"sidebar-state.d.ts","sourceRoot":"","sources":["../../../src/sidebar-state.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAeH,eAAO,MAAM,qBAAqB,EAAG,CAAU,CAAA;AAE/C,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,YAAY,CAAA;AAErD,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,QAAQ,GAAG,IAAI,CAAA;IACvB,gBAAgB,EAAE,MAAM,CAAA;IACxB,yEAAyE;IACzE,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED,MAAM,WAAW,iBAAiB;IAChC,wEAAwE;IACxE,gBAAgB,EAAE,MAAM,CAAA;IACxB,yEAAyE;IACzE,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,8DAA8D;IAC9D,OAAO,CAAC,EAAE,uBAAuB,EAAE,CAAA;CACpC;AAED,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,8DAA8D;IAC9D,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,OAAO,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,OAAO,CAAA;IAChB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC,CAAA;IAC1D;;;OAGG;IACH,IAAI,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAA;CAC3D;AAED,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,EAAE,QAAQ,GAAG,QAAQ,CAAA;IAChC,WAAW,EAAE,aAAa,CAAA;IAC1B,QAAQ,CAAC,EAAE,QAAQ,GAAG,aAAa,GAAG,QAAQ,CAAA;IAC9C,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,qBAAqB,CAAA;IACrC,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,mBAAmB,EAAE,CAAA;IAC/B,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAA;IAClD,oBAAoB,EAAE,OAAO,CAAA;IAC7B,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,oFAAoF;AACpF,MAAM,MAAM,cAAc,GAAG,cAAc,CAAA;AAE3C;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,mBAAmB,EAAE,CAAA;IAC/B,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAA;CAC/B;AAED,eAAO,MAAM,qBAAqB,EAAE,cAMnC,CAAA;AAED,eAAO,MAAM,iBAAiB,wCAAwC,CAAA;AAmBtE;;;;GAIG;AACH,qBAAa,+BAAgC,SAAQ,KAAK;IACxD,QAAQ,CAAC,OAAO,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAA;gBAE9C,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM;CAOjD;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,gBAAgB,GACxB,YAAY,GACZ,eAAe,GACf,YAAY,GACZ,cAAc,GACd,aAAa,CAAA;AAEjB,MAAM,WAAW,iBAAiB;IAChC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;CAC1D;AAID;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,iBAAiB,GAAG,IAAI,GAAG,IAAI,CAE1E;AAMD;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,CAK5C;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,GAAE,MAA8B,GACnC,cAAc,CAchB;AAwND;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,GAAE,MAA8B,GACnC,IAAI,CAGN;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,EACxC,GAAG,EAAE,MAAM,GACV,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAarC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,4BAA4B;IAC3C,qDAAqD;IACrD,KAAK,EAAE,MAAM,CAAA;IACb,kEAAkE;IAClE,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,gEAAgE;IAChE,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,kGAAkG;IAClG,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B,WAAW,CAAC,EAAE;QACZ,MAAM,CAAC,EAAE;YACP,iBAAiB,CAAC,EAAE,MAAM,CAAA;YAC1B,SAAS,CAAC,EAAE,MAAM,CAAA;YAClB,OAAO,CAAC,EAAE,KAAK,CAAC;gBACd,MAAM,EAAE,QAAQ,GAAG,IAAI,CAAA;gBACvB,iBAAiB,EAAE,MAAM,CAAA;gBACzB,SAAS,EAAE,MAAM,CAAA;aAClB,CAAC,CAAA;SACH,CAAA;QACD,YAAY,CAAC,EAAE;YACb,iBAAiB,CAAC,EAAE,MAAM,CAAA;YAC1B,SAAS,CAAC,EAAE,MAAM,CAAA;YAClB,OAAO,CAAC,EAAE,KAAK,CAAC;gBACd,MAAM,EAAE,QAAQ,GAAG,IAAI,CAAA;gBACvB,iBAAiB,EAAE,MAAM,CAAA;gBACzB,SAAS,EAAE,MAAM,CAAA;aAClB,CAAC,CAAA;SACH,CAAA;QAID,CAAC,SAAS,EAAE,MAAM,GACd;YACE,iBAAiB,CAAC,EAAE,MAAM,CAAA;YAC1B,SAAS,CAAC,EAAE,MAAM,CAAA;YAClB,UAAU,CAAC,EAAE,MAAM,CAAA;YACnB,OAAO,CAAC,EAAE,KAAK,CAAC;gBACd,MAAM,EAAE,QAAQ,GAAG,IAAI,CAAA;gBACvB,iBAAiB,EAAE,MAAM,CAAA;gBACzB,SAAS,EAAE,MAAM,CAAA;aAClB,CAAC,CAAA;SACH,GACD,SAAS,CAAA;KACd,CAAA;IACD;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B;;;;;OAKG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B;;;;OAIG;IACH,IAAI,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAA;CAC3D;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE;IACtC,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB,GAAG;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAWlE;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,0BAA0B,CACxC,GAAG,EAAE,4BAA4B,CAAC,aAAa,CAAC,GAC/C,4BAA4B,CAAC,aAAa,CAAC,CA8D7C;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,EAAE;IACN,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,OAAO,CAAC,EAAE,aAAa,CAAC;QACtB,MAAM,EAAE,QAAQ,GAAG,IAAI,CAAA;QACvB,iBAAiB,EAAE,MAAM,CAAA;QACzB,SAAS,EAAE,MAAM,CAAA;KAClB,CAAC,CAAA;CACH,EACD,SAAS,CAAC,EAAE,MAAM,GACjB,iBAAiB,GAAG,SAAS,CA4C/B;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,MAAM,EACb,mBAAmB,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACtD,OAAO,CAIT;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,4BAA4B,GACnC,mBAAmB,CAuDrB;AAED;;;;GAIG;AACH,wBAAgB,oCAAoC,CAClD,QAAQ,EAAE,4BAA4B,EAAE,EACxC,OAAO,GAAE;IACP,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,oBAAoB,CAAC,EAAE,OAAO,CAAA;CAC1B,GACL,mBAAmB,CAQrB;AAED,UAAU,wBAAwB;IAChC,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,0FAA0F;IAC1F,0BAA0B,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAC/C;AAeD;;;;GAIG;AACH,wBAAgB,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC,CAElD;AAiID;;;;;GAKG;AACH,wBAAsB,0BAA0B,CAC9C,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,mBAAmB,EAC1B,OAAO,GAAE,wBAAwB,GAAG;IAClC,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,wBAAwB,CAAC,EAAE,OAAO,CAAA;CAC9B,GACL,OAAO,CAAC,IAAI,CAAC,CAgBf;AAED;;;GAGG;AACH,wBAAsB,0BAA0B,CAC9C,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,wBAA6B,GACrC,OAAO,CAAC,IAAI,CAAC,CAaf;AAED;;;;GAIG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,mBAAmB,EACzB,OAAO,GAAE,wBAA6B,GACrC,OAAO,CAAC,IAAI,CAAC,CAKf"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cortexkit/opencode-antigravity-auth",
-  "version": "3.0.5",
+  "version": "3.0.6",
   "description": "Google Antigravity OAuth auth plugin for OpenCode - access Gemini and Claude models using Google credentials",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -70,7 +70,7 @@
   ],
   "scripts": {
     "embed:check": "bun scripts/build-tui.ts --check",
-    "build": "bun run embed:check && bun scripts/build-tui.ts --library && esbuild src/server.ts --bundle --platform=node --format=esm --external:zod --external:@cortexkit/private-files --outfile=dist/server.js --sourcemap --metafile=dist/server.meta.json --log-level=warning && tsc -p tsconfig.ga.emit.json && bun ../../scripts/finalize-declaration-specifiers.ts dist/types .",
+    "build": "bun run embed:check && bun scripts/build-tui.ts --library && esbuild src/server.ts --bundle --platform=node --format=esm --external:zod --external:jsonc-parser --external:@cortexkit/private-files --external:@cortexkit/claustrum-client --external:@cortexkit/subc-client --outfile=dist/server.js --sourcemap --metafile=dist/server.meta.json --log-level=warning && tsc -p tsconfig.ga.emit.json && bun ../../scripts/finalize-declaration-specifiers.ts dist/types .",
     "build:tui": "bun run embed:check && bun scripts/build-tui.ts",
     "build:schema": "bun script/build-schema.ts",
     "smoke:tui": "bun run embed:check && bun scripts/smoke-tui-pack-install.ts",
@@ -117,7 +117,6 @@
     }
   },
   "devDependencies": {
-    "@cortexkit/claustrum-client": "0.9.0",
     "@opencode-ai/sdk": "1.17.13",
     "@opencode/plugin": "2.0.22",
     "@opentui/core-ga": "npm:@opentui/core@0.5.14",
@@ -129,7 +128,9 @@
     "zod-to-json-schema": "^3.25.1"
   },
   "dependencies": {
-    "@cortexkit/antigravity-auth-core": "3.0.5",
+    "@cortexkit/claustrum-client": "0.9.0",
+    "@cortexkit/subc-client": "0.16.1",
+    "@cortexkit/antigravity-auth-core": "3.0.6",
     "@cortexkit/private-files": "0.2.1",
     "jsonc-parser": "^3.3.1",
     "xdg-basedir": "^5.1.0",

package/src/common-auth-embedded/claustrum/consumer.d.ts

@@ -3,8 +3,9 @@ import type { QuotaObservation } from '../quota/index.js';
 import type { RoutingRow } from '../routing/index.js';
 import { type ClaustrumFamily, type ClaustrumScopedAttempt, type ClaustrumScopedClient, type IdentityParser } from './custody.js';
 import { type ClaustrumLogger } from './errors.js';
+import { type InsulaQuotaOptions } from './insula.js';
 import { type AccountMapper, type QuotaReceipt, type VaultRosterFile } from './roster.js';
-export interface ClaustrumConsumerOptions {
+export interface ClaustrumConsumerOptions<Q = QuotaObservation> {
     /**
      * The roster file: one row per vault account (route id, credential id,
      * account identity, state, quota), plus the accounts the user declined. It
@@ -45,6 +46,8 @@ export interface ClaustrumConsumerOptions {
     clearTimeoutImpl?: typeof clearTimeout;
     now?: () => number;
     logger?: ClaustrumLogger;
+    /** Optional background quota source. In-band readings still use recordQuota. */
+    insula?: InsulaQuotaOptions<Q>;
 }
 export interface SendOptions {
     /**
@@ -63,15 +66,34 @@ export interface SendOptions {
  * never are. It never enrolls: a missing token is an error here, and setup
  * is where enrollment happens.
  */
-export declare class ClaustrumConsumer {
+export declare class ClaustrumConsumer<Q = QuotaObservation> {
     #private;
-    constructor(options: ClaustrumConsumerOptions);
+    constructor(options: ClaustrumConsumerOptions<Q>);
     /** The last committed roster this instance saw, without any I/O. */
     snapshot(): VaultRosterFile | undefined;
     /** Rows for `/routing`, from the last committed roster. */
     routingRows(): RoutingRow[];
     refresh(): Promise<VaultRosterFile | undefined>;
     start(): void;
+    /**
+     * Fetch on a background tick, at most once per minute across projects with
+     * the same daemon and enrollment token path. Admission must use the cache
+     * instead, so an optional quota daemon never delays a provider request.
+     */
+    refreshInsulaQuota(): Promise<void>;
+    /**
+     * Cache-only, for unknown-quota admission with a served receipt. Undefined
+     * means poll the provider normally. Only get_scoped's asserted account_id
+     * joins insula; parsed identities and display metadata cannot substitute.
+     * Background polling should use cachedInsulaQuotaForRoute instead.
+     */
+    cachedInsulaQuota(receipt: Pick<ClaustrumScopedAttempt, 'assertedAccountIdentity'>): Promise<Q | undefined>;
+    /**
+     * Background cache lookup without fetching a credential. Re-read the roster
+     * so a peer's account replacement invalidates the old route immediately.
+     * A route without a known provider account cannot join an insula entry.
+     */
+    cachedInsulaQuotaForRoute(routeId: string): Promise<Q | undefined>;
     /**
      * Authorize one physical send on a vault route. The roster file is re-read
      * first, so a decline committed by another process applies before the next
@@ -98,5 +120,13 @@ export declare class ClaustrumConsumer {
      * (see `recordVaultQuota`), so a reading for a replaced account is dropped.
      */
     recordQuota(routeId: string, observation: QuotaObservation, attempt: QuotaReceipt): Promise<boolean>;
+    /**
+     * Store a background observation that belongs to an account rather than to
+     * a served credential (an insula reading from `cachedInsulaQuotaForRoute`).
+     * It lands only while the route is still bound to that known account, so no
+     * credential fetch is needed and a replaced account's reading is dropped.
+     * The in-memory roster is reloaded from the file, without a vault call.
+     */
+    recordAccountQuota(routeId: string, accountIdentity: string, observation: QuotaObservation): Promise<boolean>;
     close(): void;
 }

package/src/common-auth-embedded/claustrum/consumer.js

@@ -1,8 +1,10 @@
 import { createLogger } from '../logger/index.js';
 import { combineAbortSignals } from '../util/any-signal.js';
 import { ClaustrumScopedCustody, decideScopedRetryAfter401, } from './custody.js';
+import { readClaustrumEnrollmentToken } from './enrollment.js';
 import { ClaustrumConsumerError } from './errors.js';
-import { acceptVaultRoute, declineVaultRoute, readVaultRoster, recordVaultQuota, refreshVaultRoster, vaultRoutingRows, } from './roster.js';
+import { acquireInsulaQuotaSource } from './insula.js';
+import { acceptVaultRoute, declineVaultRoute, readVaultRoster, recordVaultAccountQuota, recordVaultQuota, refreshVaultRoster, vaultRoutingRows, } from './roster.js';
 /**
  * One plugin host's view of its vault accounts. It turns vault credentials
  * into rows for `/routing`, authorizes each physical send with the vault, and
@@ -21,6 +23,7 @@ export class ClaustrumConsumer {
     #roster;
     #timer;
     #started = false;
+    #insula;
     constructor(options) {
         this.#options = options;
         this.#logger = options.logger ?? createLogger('claustrum');
@@ -84,6 +87,9 @@ export class ClaustrumConsumer {
                     now: this.#options.now,
                     logger: this.#logger,
                 });
+                if (this.#options.insula && client.insula) {
+                    this.#insula = acquireInsulaQuotaSource(client.insula, this.#options.tokenPath);
+                }
                 return this.#custody;
             })
                 .finally(() => {
@@ -109,6 +115,8 @@ export class ClaustrumConsumer {
                 this.#roster = undefined;
                 this.#custody?.close();
                 this.#custody = undefined;
+                this.#insula?.release();
+                this.#insula = undefined;
                 return undefined;
             }
             const custody = await this.#getCustody();
@@ -145,6 +153,7 @@ export class ClaustrumConsumer {
         const tick = async () => {
             try {
                 await this.refresh();
+                await this.refreshInsulaQuota();
             }
             catch (error) {
                 if (!this.#shutdown.signal.aborted)
@@ -163,6 +172,72 @@ export class ClaustrumConsumer {
         };
         void tick();
     }
+    /**
+     * Fetch on a background tick, at most once per minute across projects with
+     * the same daemon and enrollment token path. Admission must use the cache
+     * instead, so an optional quota daemon never delays a provider request.
+     */
+    async refreshInsulaQuota() {
+        if (!this.#options.insula ||
+            this.#shutdown.signal.aborted ||
+            !(await this.#active()))
+            return;
+        try {
+            await readClaustrumEnrollmentToken(this.#options.tokenPath);
+            await this.#getCustody();
+            await this.#insula?.source.refresh((this.#options.now ?? Date.now)());
+        }
+        catch {
+            // An optional source must never prevent the plugin's own quota poll.
+        }
+    }
+    /**
+     * Cache-only, for unknown-quota admission with a served receipt. Undefined
+     * means poll the provider normally. Only get_scoped's asserted account_id
+     * joins insula; parsed identities and display metadata cannot substitute.
+     * Background polling should use cachedInsulaQuotaForRoute instead.
+     */
+    async cachedInsulaQuota(receipt) {
+        if (!this.#options.insula ||
+            this.#shutdown.signal.aborted ||
+            !(await this.#active()))
+            return undefined;
+        try {
+            await readClaustrumEnrollmentToken(this.#options.tokenPath);
+            return this.#normalizeInsulaQuota(receipt.assertedAccountIdentity);
+        }
+        catch {
+            return undefined;
+        }
+    }
+    /**
+     * Background cache lookup without fetching a credential. Re-read the roster
+     * so a peer's account replacement invalidates the old route immediately.
+     * A route without a known provider account cannot join an insula entry.
+     */
+    async cachedInsulaQuotaForRoute(routeId) {
+        if (!this.#options.insula ||
+            this.#shutdown.signal.aborted ||
+            !(await this.#active()))
+            return undefined;
+        try {
+            await readClaustrumEnrollmentToken(this.#options.tokenPath);
+            const roster = await readVaultRoster(this.#options.rosterPath);
+            const row = roster?.rows.find((entry) => entry.routeId === routeId);
+            return this.#normalizeInsulaQuota(row?.accountIdentity);
+        }
+        catch {
+            return undefined;
+        }
+    }
+    #normalizeInsulaQuota(accountIdentity) {
+        if (!this.#options.insula || !accountIdentity)
+            return undefined;
+        const current = this.#insula?.source.current(this.#options.insula.provider, accountIdentity, (this.#options.now ?? Date.now)());
+        return current
+            ? this.#options.insula.normalize(current.entry, current.context)
+            : undefined;
+    }
     /**
      * Authorize one physical send on a vault route. The roster file is re-read
      * first, so a decline committed by another process applies before the next
@@ -285,6 +360,24 @@ export class ClaustrumConsumer {
             this.#roster = await readVaultRoster(this.#options.rosterPath);
         return kept;
     }
+    /**
+     * Store a background observation that belongs to an account rather than to
+     * a served credential (an insula reading from `cachedInsulaQuotaForRoute`).
+     * It lands only while the route is still bound to that known account, so no
+     * credential fetch is needed and a replaced account's reading is dropped.
+     * The in-memory roster is reloaded from the file, without a vault call.
+     */
+    async recordAccountQuota(routeId, accountIdentity, observation) {
+        this.#assertOpen();
+        const kept = await recordVaultAccountQuota(this.#options.rosterPath, {
+            routeId,
+            accountIdentity,
+            observation,
+        });
+        if (kept)
+            this.#roster = await readVaultRoster(this.#options.rosterPath);
+        return kept;
+    }
     close() {
         if (this.#shutdown.signal.aborted)
             return;
@@ -293,6 +386,8 @@ export class ClaustrumConsumer {
             (this.#options.clearTimeoutImpl ?? clearTimeout)(this.#timer);
         this.#timer = undefined;
         this.#custody?.close();
+        this.#insula?.release();
+        this.#insula = undefined;
         this.#roster = undefined;
     }
 }

package/src/common-auth-embedded/claustrum/custody.d.ts

@@ -1,6 +1,9 @@
 import { type ClaustrumClient, type ClaustrumReporterSource, type EnrollmentTokenFile } from '@cortexkit/claustrum-client';
 import { type ClaustrumLogger } from './errors.js';
-export type ClaustrumScopedClient = Pick<ClaustrumClient, 'listScoped' | 'getScoped' | 'reportAuthFailureScoped' | 'close'>;
+import type { InsulaUsageTransport } from './insula.js';
+export type ClaustrumScopedClient = Pick<ClaustrumClient, 'listScoped' | 'getScoped' | 'reportAuthFailureScoped' | 'close'> & {
+    insula?: InsulaUsageTransport;
+};
 /** The two credential types a plugin's family can hold; routing differs by type. */
 export type VaultCredentialType = 'oauth' | 'api_key';
 /**

package/src/common-auth-embedded/claustrum/enrollment.d.ts

@@ -103,7 +103,12 @@ export interface EnrollmentAncestorOptions {
  */
 export declare function refuseWritableAncestor(parent: string, options?: EnrollmentAncestorOptions): Promise<void>;
 export declare function readClaustrumEnrollmentStatus(paths: ClaustrumEnrollmentPaths, proposedName: string): Promise<ClaustrumEnrollmentStatus>;
-/** Resolve the host's account mode from its enrollment files without writing. */
+/**
+ * Resolve the host's account mode from its enrollment files. It never changes
+ * their contents or the host's mode. On Windows, reading them may create a
+ * missing private state folder and tighten an enrollment file's permissions to
+ * owner-only, as every private-file read there does.
+ */
 export declare function enrollmentAuthority(paths: ClaustrumEnrollmentPaths, proposedName: string): Promise<'vault' | 'local' | 'unreadable'>;
 /**
  * Read fresh bearer material for one scoped operation; never publish it.

package/src/common-auth-embedded/claustrum/enrollment.js

@@ -419,7 +419,12 @@ export async function readClaustrumEnrollmentStatus(paths, proposedName) {
     }
     return statusFromState(state);
 }
-/** Resolve the host's account mode from its enrollment files without writing. */
+/**
+ * Resolve the host's account mode from its enrollment files. It never changes
+ * their contents or the host's mode. On Windows, reading them may create a
+ * missing private state folder and tighten an enrollment file's permissions to
+ * owner-only, as every private-file read there does.
+ */
 export async function enrollmentAuthority(paths, proposedName) {
     let status;
     try {

package/src/common-auth-embedded/claustrum/index.d.ts

@@ -6,8 +6,9 @@ export { type AccountIdentitySource, type ClaustrumFamily, type ClaustrumScopedA
 export { type ClaustrumEnrollmentClient, type ClaustrumEnrollmentConnection, type ClaustrumEnrollmentDisconnectResult, ClaustrumEnrollmentManager, type ClaustrumEnrollmentPaths, type ClaustrumEnrollmentResetResult, type ClaustrumEnrollmentStatus, classifyEnrollmentError, connectClaustrumEnrollmentClient, disconnectClaustrumEnrollment, type EnrollmentDisposition, enrollmentAuthority, enrollmentName, getClaustrumEnrollmentPaths, hostEnrollmentPaths, RETRYABLE_ENROLLMENT_CODES, readClaustrumEnrollmentStatus, readClaustrumEnrollmentToken, resetClaustrumEnrollmentState, TERMINAL_ENROLLMENT_CODES, } from './enrollment.js';
 export { ClaustrumConsumerError, type ClaustrumConsumerFailureKind, type ClaustrumLogger, } from './errors.js';
 export { assertHostSlotMatchesMode, assertNotCustodyPlaceholder, CUSTODY_PLACEHOLDER_PREFIX, classifyHostSlot, custodyPlaceholder, custodyPlaceholderKey, type HostSlotContent, isCustodyPlaceholder, isCustodyPlaceholderValue, } from './host-slot.js';
+export type { InsulaQuotaContext, InsulaQuotaOptions, InsulaUsageEntry, InsulaUsageTransport, InsulaUsageWindow, } from './insula.js';
 export { acceptAccount, type DeclinedAccount, declineAccount, isDeclined, } from './interlock.js';
-export { type AccountMapper, acceptVaultRoute, DEFAULT_ROUTE_PREFIX, declineVaultRoute, type MutateVaultRosterOptions, mutateVaultRoster, type ProjectionOptions, projectVaultRoster, type QuotaReceipt, readVaultRoster, recordVaultQuota, refreshVaultRoster, resolveVaultPrimary, type VaultPrimary, type VaultPrimaryBinding, type VaultPrimaryUnavailableReason, type VaultRosterFile, type VaultRosterLockContext, type VaultRosterRow, vaultRoutingRows, } from './roster.js';
+export { type AccountMapper, acceptVaultRoute, DEFAULT_ROUTE_PREFIX, declineVaultRoute, type MutateVaultRosterOptions, mutateVaultRoster, type ProjectionOptions, projectVaultRoster, type QuotaReceipt, readVaultRoster, recordVaultAccountQuota, recordVaultQuota, refreshVaultRoster, resolveVaultPrimary, type VaultPrimary, type VaultPrimaryBinding, type VaultPrimaryUnavailableReason, type VaultRosterFile, type VaultRosterLockContext, type VaultRosterRow, vaultRoutingRows, } from './roster.js';
 /**
  * Connect the client that lists and fetches this consumer's vault credentials
  * on the request path. `connectionFile` is required: this library

package/src/common-auth-embedded/claustrum/index.js

@@ -4,6 +4,7 @@
 // declined-account interlock and the host-slot guard. Needs the optional
 // peer `@cortexkit/claustrum-client`.
 import { ClaustrumClient, } from '@cortexkit/claustrum-client';
+import { insulaUsageTransport } from './insula.js';
 export { ClaustrumCredentialError, } from '@cortexkit/claustrum-client';
 export { ClaustrumConsumer, } from './consumer.js';
 export { ClaustrumScopedCustody, decideScopedRetryAfter401, isScopedCredentialRotation, SERVING_MARGIN_MS, } from './custody.js';
@@ -11,12 +12,13 @@ export { ClaustrumEnrollmentManager, classifyEnrollmentError, connectClaustrumEn
 export { ClaustrumConsumerError, } from './errors.js';
 export { assertHostSlotMatchesMode, assertNotCustodyPlaceholder, CUSTODY_PLACEHOLDER_PREFIX, classifyHostSlot, custodyPlaceholder, custodyPlaceholderKey, isCustodyPlaceholder, isCustodyPlaceholderValue, } from './host-slot.js';
 export { acceptAccount, declineAccount, isDeclined, } from './interlock.js';
-export { acceptVaultRoute, DEFAULT_ROUTE_PREFIX, declineVaultRoute, mutateVaultRoster, projectVaultRoster, readVaultRoster, recordVaultQuota, refreshVaultRoster, resolveVaultPrimary, vaultRoutingRows, } from './roster.js';
+export { acceptVaultRoute, DEFAULT_ROUTE_PREFIX, declineVaultRoute, mutateVaultRoster, projectVaultRoster, readVaultRoster, recordVaultAccountQuota, recordVaultQuota, refreshVaultRoster, resolveVaultPrimary, vaultRoutingRows, } from './roster.js';
 /**
  * Connect the client that lists and fetches this consumer's vault credentials
  * on the request path. `connectionFile` is required: this library
  * reads no environment, so the plugin resolves the vault's connection file.
  */
-export function connectClaustrumScopedClient(options) {
-    return ClaustrumClient.connect(options);
+export async function connectClaustrumScopedClient(options) {
+    const client = await ClaustrumClient.connect(options);
+    return Object.assign(client, { insula: insulaUsageTransport(options) });
 }

package/src/common-auth-embedded/claustrum/insula.d.ts

@@ -0,0 +1,69 @@
+import type { ClaustrumClientOptions } from '@cortexkit/claustrum-client';
+/** Insula's window fields are open: plugins choose which limits they understand. */
+export interface InsulaUsageWindow {
+    usedPercent: number;
+    rawUsedPercent?: number;
+    resetsAt?: string;
+    windowMinutes?: number;
+    windowKind?: string;
+    [field: string]: unknown;
+}
+export interface InsulaUsageEntry {
+    provider: string;
+    account?: string;
+    fetchedAt?: string;
+    source?: string;
+    stale?: unknown;
+    errorClass?: unknown;
+    usage?: {
+        primary?: InsulaUsageWindow;
+        secondary?: InsulaUsageWindow;
+        tertiary?: InsulaUsageWindow;
+        extraRateWindows?: Array<{
+            id?: string;
+            title?: string;
+            window?: InsulaUsageWindow;
+        }>;
+        [field: string]: unknown;
+    };
+    [field: string]: unknown;
+}
+export interface InsulaQuotaContext {
+    /** Milliseconds since the epoch, parsed from the producer's fetchedAt. */
+    fetchedAt: number;
+    source?: string;
+}
+export interface InsulaQuotaOptions<Q> {
+    provider: 'codex' | 'claude' | 'antigravity';
+    /**
+     * Set every converted window's reading time to context.fetchedAt, not poll
+     * time. Return undefined for entries the plugin cannot use. Antigravity can
+     * receive its own sidebar reading back from insula: accept it only from the
+     * vault or when fetchedAt is newer than the plugin's last reading.
+     */
+    normalize: (entry: InsulaUsageEntry, context: InsulaQuotaContext) => Q | undefined;
+}
+/** Optional transport for custom scoped clients; getUsage must not retry refusals. */
+export interface InsulaUsageTransport {
+    connectionFile: string;
+    getUsage(): Promise<unknown>;
+}
+/** Constructing this transport opens no connection; getUsage opens one per call. */
+export declare function insulaUsageTransport(options: ClaustrumClientOptions & {
+    connectionFile: string;
+}): InsulaUsageTransport;
+export declare class InsulaQuotaSource {
+    #private;
+    private readonly transport;
+    private readonly key;
+    constructor(transport: InsulaUsageTransport, key: string);
+    refresh(now: number): Promise<void>;
+    current(provider: string, accountId: string, now: number): {
+        entry: InsulaUsageEntry;
+        context: InsulaQuotaContext;
+    } | undefined;
+}
+export declare function acquireInsulaQuotaSource(transport: InsulaUsageTransport, tokenPath: string): {
+    source: InsulaQuotaSource;
+    release(): void;
+};

package/src/common-auth-embedded/claustrum/insula.js

@@ -0,0 +1,152 @@
+import { resolve } from 'node:path';
+import { storeIdentity } from '@cortexkit/claustrum-client';
+// A static import: claustrum-client already loads subc-client whenever
+// /claustrum is imported, so loading it lazily saves nothing, and a dynamic
+// import makes bundlers emit a separate chunk that a running host loses when
+// its dist folder is rebuilt underneath it.
+import { SubcClient } from '@cortexkit/subc-client';
+/** Constructing this transport opens no connection; getUsage opens one per call. */
+export function insulaUsageTransport(options) {
+    const identity = options.identity ??
+        storeIdentity(options.projectRoot ?? process.cwd(), options.storagePath ?? process.cwd());
+    return {
+        connectionFile: options.connectionFile,
+        async getUsage() {
+            let client;
+            let expired = false;
+            let timer;
+            const timeout = new Promise((_resolve, reject) => {
+                timer = setTimeout(() => reject(new Error('insula usage timeout')), 3_000);
+                timer.unref?.();
+            });
+            const request = (async () => {
+                client = options.connector
+                    ? await options.connector({
+                        connectionFile: options.connectionFile,
+                        handshakeTimeoutMs: Math.min(options.handshakeTimeoutMs ?? 3_000, 3_000),
+                    })
+                    : await SubcClient.connect({
+                        connectionFile: options.connectionFile,
+                        handshakeTimeoutMs: Math.min(options.handshakeTimeoutMs ?? 3_000, 3_000),
+                    });
+                // A slow connector may resolve after the whole-call deadline. It still
+                // owns a socket, which must not survive or open a route after fallback.
+                if (expired) {
+                    client.close();
+                    throw new Error('insula usage timeout');
+                }
+                // Managed call() retries warming routes. A single routeOpen/request
+                // instead lets the plugin fall back as soon as the daemon refuses.
+                const route = await client.routeOpen({ kind: 'management_surface', module_id: 'insula' }, identity);
+                return await client.request(route, { method: 'usage.get', params: {} });
+            })();
+            try {
+                return await Promise.race([request, timeout]);
+            }
+            finally {
+                expired = true;
+                clearTimeout(timer);
+                client?.close();
+            }
+        },
+    };
+}
+const MINUTE = 60_000;
+const MAX_AGE = 4 * MINUTE;
+const sources = new Map();
+// Keep only the minute budget after the last owner closes, so project churn
+// cannot reset the bound. Expired budgets are pruned on the next tick.
+const attempts = new Map();
+function record(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+export class InsulaQuotaSource {
+    transport;
+    key;
+    #entries = [];
+    #pending;
+    constructor(transport, key) {
+        this.transport = transport;
+        this.key = key;
+    }
+    refresh(now) {
+        if (this.#pending)
+            return this.#pending;
+        for (const [key, time] of attempts) {
+            if (now - time >= MINUTE)
+                attempts.delete(key);
+        }
+        const lastAttempt = attempts.get(this.key);
+        if (lastAttempt !== undefined && now - lastAttempt < MINUTE)
+            return Promise.resolve();
+        // Reserve the minute before I/O, so concurrent projects cannot each poll.
+        attempts.set(this.key, now);
+        this.#pending = (async () => {
+            try {
+                const reply = await this.transport.getUsage();
+                if (!record(reply) ||
+                    !Array.isArray(reply.result) ||
+                    reply.error !== undefined)
+                    throw new Error('unavailable insula usage');
+                // Each response is a snapshot, not a delta. Missing accounts fall back;
+                // neither pending nor the entry count asserts provider completeness.
+                this.#entries = reply.result.filter((entry) => record(entry) && typeof entry.provider === 'string');
+            }
+            catch {
+                // Refusal is absence, even if the previous reading was still young.
+                this.#entries = [];
+            }
+        })().finally(() => {
+            this.#pending = undefined;
+        });
+        return this.#pending;
+    }
+    current(provider, accountId, now) {
+        for (const entry of this.#entries) {
+            if (entry.provider !== provider ||
+                typeof entry.account !== 'string' ||
+                entry.account.trim() !== accountId)
+                continue;
+            if (entry.stale !== undefined ||
+                entry.errorClass !== undefined ||
+                !record(entry.usage))
+                continue;
+            const fetchedAt = typeof entry.fetchedAt === 'string'
+                ? Date.parse(entry.fetchedAt)
+                : Number.NaN;
+            if (!Number.isFinite(fetchedAt) || now - fetchedAt >= MAX_AGE)
+                continue;
+            return {
+                entry,
+                context: {
+                    fetchedAt,
+                    ...(typeof entry.source === 'string' && { source: entry.source }),
+                },
+            };
+        }
+        return undefined;
+    }
+}
+export function acquireInsulaQuotaSource(transport, tokenPath) {
+    const key = JSON.stringify([
+        resolve(transport.connectionFile),
+        resolve(tokenPath),
+    ]);
+    let shared = sources.get(key);
+    if (!shared) {
+        shared = { source: new InsulaQuotaSource(transport, key), refs: 0 };
+        sources.set(key, shared);
+    }
+    shared.refs++;
+    let released = false;
+    return {
+        source: shared.source,
+        release() {
+            if (released)
+                return;
+            released = true;
+            if (--shared.refs === 0)
+                sources.delete(key);
+        },
+    };
+}