@omnicross/daemon 0.4.2 → 0.4.3

package/dist/index.d.ts

@@ -1,12 +1,12 @@
 import { Logger, OutboundApiServerConfig, ProviderConfigSource, TransformerService, Transformer, ResolvedTransformerChain, ApiServerSettingsStore, PricingStore, AutomaticPricingSource, OutboundPermission, OutboundKeyDb, OutboundKeyDbRow, OutboundKeyPolicy, PricingEngine as PricingEngine$1, OpenAIOperationRegistry } from '@omnicross/core';
 import { SearchRuntime, SearchFrontendModes } from '@omnicross/core/search';
 import { ApiKeyPoolService } from '@omnicross/core/completion/ApiKeyPoolService';
-import { AllowanceSchedulingConfig, AccountProbeConfig, OutboundKeyDb as OutboundKeyDb$1, VoucherDb, KeySpendReader, OutboundApiServer, ImagesServerConfig } from '@omnicross/core/outbound-api';
+import { AllowanceSchedulingConfig, AccountProbeConfig, ImageProviderId, OutboundKeyDb as OutboundKeyDb$1, VoucherDb, KeySpendReader, OutboundApiServer, ImagesServerConfig } from '@omnicross/core/outbound-api';
 import { RouteLeaseManager, ProviderProxy } from '@omnicross/core/provider-proxy';
 import { UsageRecorder, PricingEngine } from '@omnicross/core/usage';
 import { SubscriptionCredentialStore, FetchLike, CodexImageCapabilityEvidenceSource, CodexImageCapabilityEvidenceRequest, CodexImageCapabilityEvidence, CodexImageCapabilityObservation, ImageExecutionScheduler, ImageExecutionAccountKey, ImageExecutionSchedulerRequest, ImageExecutionSchedulerGrant, SubscriptionAccountService, SubscriptionProviderRegistry } from '@omnicross/subscriptions';
 import { AccountAllowanceSnapshot, AllowanceWindow } from '@omnicross/contracts/account-allowance-types';
-import { ClaudeTokenConfig, CodexTokenConfig, GeminiTokenConfig, KimiTokenConfig, GrokTokenConfig, CopilotTokenConfig, AccountTokensConfig, ProxyConfig, SubscriptionAccountSanitized, AccountClientIdentity, SubscriptionAccountEntry } from '@omnicross/contracts/account-tokens-types';
+import { ClaudeTokenConfig, CodexTokenConfig, GeminiTokenConfig, KimiTokenConfig, GrokTokenConfig, CopilotTokenConfig, AntigravityTokenConfig, AccountTokensConfig, ProxyConfig, SubscriptionAccountSanitized, AccountClientIdentity, SubscriptionAccountEntry } from '@omnicross/contracts/account-tokens-types';
 import * as _omnicross_contracts_subscription_types from '@omnicross/contracts/subscription-types';
 import { OpenCodeGoTokenConfig, SubscriptionProviderId } from '@omnicross/contracts/subscription-types';
 import { AccountAllowanceStore } from '@omnicross/core/pipeline/AccountAllowanceStore';
@@ -602,6 +602,32 @@ interface ResolvedAdminConfig {
 }
 /** The default admin port (distinct from the 8765 outbound server). */
 declare const DEFAULT_ADMIN_PORT = 8766;
+/**
+ * Per-provider behavior flags for the antigravity subscription.
+ */
+interface AntigravityProviderConfig {
+    /**
+     * Enable the production→sandbox endpoint failover for retryable antigravity
+     * upstream failures (design D5). DEFAULT OFF — with the switch off a
+     * retryable failure surfaces the original error semantics unchanged.
+     */
+    sandboxFailover?: boolean;
+}
+/**
+ * Per-provider identity config for the OpenCodeGo subscription
+ * (opencodego-egress-identity).
+ */
+interface OpenCodeGoProviderConfig {
+    /**
+     * The `user-agent` every OpenCodeGo egress presents to opencode.ai (relay
+     * traffic AND the background usage poll). An app embedding omnicross sets
+     * its own identity here (e.g. `elftia/1.2.0`); absent ⇒ the product default
+     * `omnicross/<version>`. opencode.ai's announcement asks proxy tools to
+     * identify themselves clearly — a bare relay falls to Node's generic `node`
+     * UA, exactly the shape their traffic monitoring flags. NON-SECRET.
+     */
+    userAgent?: string;
+}
 /** The full daemon config. */
 interface DaemonConfig {
     providers: DaemonProviderConfig[];
@@ -621,6 +647,16 @@ interface DaemonConfig {
      * lifetime per-key spend the outbound key policy seeds from.
      */
     usage?: UsageRetentionConfig;
+    /**
+     * Optional antigravity-subscription behavior flags (sandbox failover et al).
+     * Absent ⇒ every default (failover OFF).
+     */
+    antigravity?: AntigravityProviderConfig;
+    /**
+     * Optional OpenCodeGo identity config (outbound user-agent). Absent ⇒ the
+     * product default `omnicross/<version>` on every opencode.ai egress.
+     */
+    opencodego?: OpenCodeGoProviderConfig;
 }
 /** Apply defaults to a (possibly absent) admin block: enabled, port 8766,
  *  loopback, no token. NOTE: an EXPLICIT `port: 0` is honored as "bind an
@@ -678,7 +714,7 @@ type AtomicFileReplace = (targetPath: string, contents: string) => void;
  */
 
 /** Provider id → owned contract field names. */
-type DaemonProvider = 'claude' | 'codex' | 'gemini' | 'opencodego' | 'kimi' | 'grok' | 'copilot';
+type DaemonProvider = 'claude' | 'codex' | 'gemini' | 'opencodego' | 'kimi' | 'grok' | 'copilot' | 'antigravity';
 interface AccountMetadataPatch {
     label?: string;
     enabled?: boolean;
@@ -807,7 +843,7 @@ type ExternalCliReader = (provider: ExternalCliProvider) => ExternalCliCredentia
  * shapes), keyed by `SubscriptionProviderId` the daemon admin layer validates
  * the wire body to one of these before calling the writer.
  */
-type SubscriptionTokenBlock = ClaudeTokenConfig | CodexTokenConfig | GeminiTokenConfig | OpenCodeGoTokenConfig | KimiTokenConfig | GrokTokenConfig | CopilotTokenConfig;
+type SubscriptionTokenBlock = ClaudeTokenConfig | CodexTokenConfig | GeminiTokenConfig | OpenCodeGoTokenConfig | KimiTokenConfig | GrokTokenConfig | CopilotTokenConfig | AntigravityTokenConfig;
 declare class JsonSubscriptionCredentialStore implements SubscriptionCredentialStore {
     private readonly tokensPath;
     private readonly box;
@@ -934,13 +970,32 @@ declare class JsonSubscriptionCredentialStore implements SubscriptionCredentialS
      * the retry instead of looping on a dead token).
      */
     refreshCopilotToken(): Promise<boolean>;
+    /**
+     * Refresh the Antigravity (Google) OAuth access token. Like gemini, the
+     * Google token endpoint does NOT return a refresh_token on refresh, so this
+     * writes ONLY access+expiresAt (+status/lastRefreshedAt) and DELIBERATELY
+     * preserves the stored `refreshToken` — plus the account's `projectId`
+     * (a handshake product; the post-refresh re-validation is the refresh
+     * scheduler's hook, not this write) and `email`. HONEST `false` when no
+     * refresh_token.
+     */
+    refreshAntigravityToken(): Promise<boolean>;
+    /**
+     * Post-refresh project re-validation hook (antigravity design D8): after a
+     * successful antigravity token refresh, re-run the Code Assist project
+     * handshake and write the (possibly rotated) `projectId` back to the account.
+     * A handshake FAILURE keeps the stored projectId untouched (logged) so the
+     * account keeps serving with the last-known-good project until a later
+     * refresh succeeds. Returns whether the handshake produced a project.
+     */
+    revalidateAntigravityProject(accountId: string): Promise<boolean>;
     /**
      * Refresh a SPECIFIC managed account by id (background scheduler sweep and
      * account-pool resolution). It uses only that account's stored refresh
      * token. Coalesced per `provider:id`; on failure flags ONLY that account
      * `expired`.
      */
-    refreshAccountById(provider: 'claude' | 'codex' | 'gemini' | 'kimi' | 'grok' | 'copilot', id: string): Promise<boolean>;
+    refreshAccountById(provider: 'claude' | 'codex' | 'gemini' | 'kimi' | 'grok' | 'copilot' | 'antigravity', id: string): Promise<boolean>;
     /**
      * Resolve a SPECIFIC account's access token by id (design D6). Mirrors each
      * provider's ACTIVE-getter policy, keyed by id: claude returns the stored token
@@ -1686,6 +1741,59 @@ declare class GeminiAllowanceCollector {
     private unsupportedSnapshot;
 }
 
+/**
+ * AntigravityAllowanceCollector — the antigravity subscription's quota via the
+ * Code Assist internal quotaSummary RPC (antigravity-subscription-provider
+ * design D6).
+ *
+ * Probes `POST ${daily-cloudcode-pa}/v1internal:retrieveUserQuotaSummary` per
+ * antigravity account (Bearer access token + the antigravity/hub UA the
+ * inference path also carries), parsing the rolling 5h + weekly DUAL buckets —
+ * split by counter family (Google / Anthropic / OpenAI) — into per-model-family
+ * allowance windows: `remainingFraction` (0–1) → used percent, `resetTime` →
+ * resetsAt, `disabled` → the window's hard-block flag. The shared
+ * counter-family ←→ model-family map lives in core (`antigravityQuotaFamily`).
+ *
+ * FALLBACK: when the summary RPC fails, `v1internal:fetchAvailableModels`'s
+ * per-model `quotaInfo` is the legacy source — the collect then updates from
+ * it instead. A total failure NEVER clears the existing windows (stale-marking
+ * only), mirroring the sibling collectors.
+ *
+ * Mirrors the sibling collectors' cache contract: 5-minute cache, per-account
+ * in-flight merging, one 401/403→refresh→retry. Unlike gemini (per-model
+ * fractions, display-only), antigravity IS in the allowance scheduling
+ * whitelist — the account-level dual buckets fit the worst-window rule.
+ *
+ * @module @omnicross/daemon/allowance/AntigravityAllowanceCollector
+ */
+
+interface AntigravityAllowanceCredentialReader {
+    getAccessTokenForAccount(providerId: 'antigravity', accountId: string): Promise<string | null>;
+    refreshAccountToken(providerId: 'antigravity', accountId: string): Promise<boolean>;
+}
+type AntigravityAllowanceFetch = (url: string, init: RequestInit, accountId: string) => Promise<Response>;
+interface AntigravityAllowanceCollectOptions {
+    force?: boolean;
+    refreshAheadMs?: number;
+}
+declare class AntigravityAllowanceCollector {
+    private readonly credentials;
+    private readonly store;
+    private readonly fetchImpl;
+    private readonly now;
+    private readonly inFlight;
+    constructor(credentials: AntigravityAllowanceCredentialReader, store?: AccountAllowanceStore, fetchImpl?: AntigravityAllowanceFetch, now?: () => number);
+    collectMany(accounts: readonly SubscriptionAccountEntry<AntigravityTokenConfig>[], options?: AntigravityAllowanceCollectOptions): Promise<AccountAllowanceSnapshot[]>;
+    collect(account: SubscriptionAccountEntry<AntigravityTokenConfig>, options?: AntigravityAllowanceCollectOptions): Promise<AccountAllowanceSnapshot>;
+    private isCacheValid;
+    private fetchAccount;
+    /** One upstream round-trip with the antigravity/hub masquerade UA. */
+    private request;
+    private snapshot;
+    private failureSnapshot;
+    private unsupportedSnapshot;
+}
+
 /**
  * OpenCodeGo usage collector.
  *
@@ -1733,8 +1841,8 @@ declare class OpenCodeGoAllowanceCollector {
  * literals — extending them all would make the overloads conflict.
  */
 interface AccountAllowanceCredentialReader {
-    getAccessTokenForAccount(providerId: 'claude' | 'codex' | 'kimi' | 'opencodego' | 'grok' | 'copilot' | 'gemini', accountId: string): Promise<string | null>;
-    refreshAccountToken(providerId: 'claude' | 'codex' | 'kimi' | 'grok' | 'copilot' | 'gemini', accountId: string): Promise<boolean>;
+    getAccessTokenForAccount(providerId: 'claude' | 'codex' | 'kimi' | 'opencodego' | 'grok' | 'copilot' | 'gemini' | 'antigravity', accountId: string): Promise<string | null>;
+    refreshAccountToken(providerId: 'claude' | 'codex' | 'kimi' | 'grok' | 'copilot' | 'gemini' | 'antigravity', accountId: string): Promise<boolean>;
     getFullConfig(): Promise<AccountTokensConfig>;
 }
 interface AccountAllowanceFilter {
@@ -1756,7 +1864,8 @@ declare class AccountAllowanceService {
     readonly copilotCollector: CopilotAllowanceCollector;
     readonly opencodegoCollector: OpenCodeGoAllowanceCollector;
     readonly geminiCollector: GeminiAllowanceCollector;
-    constructor(credentials: AccountAllowanceCredentialReader, store?: AccountAllowanceStore, collector?: ClaudeAllowanceCollector, codexCollector?: CodexAllowanceCollector, kimiCollector?: KimiAllowanceCollector, opencodegoCollector?: OpenCodeGoAllowanceCollector, grokCollector?: GrokAllowanceCollector, copilotCollector?: CopilotAllowanceCollector, geminiCollector?: GeminiAllowanceCollector, now?: () => number);
+    readonly antigravityCollector: AntigravityAllowanceCollector;
+    constructor(credentials: AccountAllowanceCredentialReader, store?: AccountAllowanceStore, collector?: ClaudeAllowanceCollector, codexCollector?: CodexAllowanceCollector, kimiCollector?: KimiAllowanceCollector, opencodegoCollector?: OpenCodeGoAllowanceCollector, grokCollector?: GrokAllowanceCollector, copilotCollector?: CopilotAllowanceCollector, geminiCollector?: GeminiAllowanceCollector, antigravityCollector?: AntigravityAllowanceCollector, now?: () => number);
     /**
      * Read all/filtered snapshots. Claude's and Codex's five-minute caches are
      * refreshed lazily on read (Codex polls `/backend-api/wham/usage`; the
@@ -1782,6 +1891,8 @@ declare class AccountAllowanceService {
     refreshGrok(accountId?: string): Promise<AccountAllowanceSnapshot[]>;
     /** Force-refresh Gemini usage (Code Assist retrieveUserQuota) for one/all accounts. */
     refreshGemini(accountId?: string): Promise<AccountAllowanceSnapshot[]>;
+    /** Force-refresh Antigravity usage (quotaSummary dual buckets) for one/all accounts. */
+    refreshAntigravity(accountId?: string): Promise<AccountAllowanceSnapshot[]>;
     /**
      * Keep Claude + Codex + Kimi snapshots warm for allowance-aware routing. All
      * collectors preserve their cache + per-account in-flight coalescing; a tick
@@ -2277,14 +2388,22 @@ interface ImageRuntimeManagerStatus {
     readonly draining: readonly ImageRuntimeGenerationStatus[];
 }
 type ImageRuntimeSafeUnavailableReason = ImageCapabilityUnavailableReason | 'disabled' | 'runtime_unavailable';
+
 interface ImageRuntimeCapabilityInspection {
     readonly generationId: string;
     readonly enabled: boolean;
     readonly available: boolean;
-    readonly providerId?: 'codex-subscription';
+    readonly providerId?: ImageProviderId;
     readonly model?: string;
     readonly reason?: ImageRuntimeSafeUnavailableReason;
     readonly capabilities?: ImageCapabilities;
+    /**
+     * Route-table keys whose ROUTED provider's fresh capability intersection
+     * affirms them (multi-provider-image-generation 6.1: /v1/models lists
+     * routed-model × fresh-evidence). Absent on synthetic/legacy generations —
+     * `listAvailableModels` then falls back to the single-model shape.
+     */
+    readonly routedModels?: readonly string[];
 }
 interface ImageRuntimeResourceStatus {
     readonly queue: Readonly<{
@@ -2836,6 +2955,37 @@ declare class IntegrationManager {
     private renderInstalled;
 }
 
+/**
+ * accountsAntigravityOAuth — the daemon admin API's ANTIGRAVITY interactive
+ * OAuth path (`POST /accounts/antigravity/oauth/start` +
+ * `GET /accounts/antigravity/oauth/:sessionId/status`).
+ *
+ * Modeled on the codex loopback flow (`accountsCodexOAuth`): antigravity's
+ * redirect is a FIXED loopback `http://127.0.0.1:51121/oauth-callback`, so the
+ * flow is ASYNC + POLLED — `start` arms the one-shot loopback listener, kicks
+ * the capture→exchange→email→project-handshake→persist chain off ASYNC, and
+ * returns ONLY `{ authUrl, sessionId }` (public — client_id + state). The app
+ * opens `authUrl`; the browser redirects to the loopback; the daemon captures
+ * the `code`, validates `state`, exchanges it, resolves the userinfo email and
+ * the Code Assist project (the antigravity dialect of the shared resolver),
+ * and persists the minted token through the encrypted credential store. The
+ * app POLLS `status` until `done`/`error`.
+ *
+ * SECRET SPINE (same invariant as codex/grok): the minted access/refresh token
+ * NEVER crosses to the client — it lands ONLY in the encrypted store. The
+ * poll `status` body is TOKEN-FREE (`{ state, message? }`). Port 51121 is a
+ * single resource → only ONE antigravity sign-in may be in flight (409).
+ *
+ * REUSES the `@omnicross/subscriptions` antigravity flow + the CLI's
+ * `awaitLoopbackCode` listener (parameterized binding) — it does NOT rebuild
+ * the authorize/exchange/handshake logic.
+ *
+ * @module @omnicross/daemon/admin/accountsAntigravityOAuth
+ */
+
+/** The loopback-listener fn (injected so tests need not bind a real port). */
+type AntigravityLoopbackFn = (state: string, timeoutMs?: number, signal?: AbortSignal) => Promise<string>;
+
 /**
  * cliLaunch — the admin API's "launch a coding CLI in a terminal, pointed at the
  * daemon" surface (dashboard parity with the desktop app's Code CLI tab).
@@ -2994,6 +3144,8 @@ interface AccountAllowanceAdminReader {
     refreshCopilot?(accountId?: string): Promise<AccountAllowanceSnapshot[]>;
     /** Optional: Gemini Code-Assist quota refresh (absent on older daemons). */
     refreshGemini?(accountId?: string): Promise<AccountAllowanceSnapshot[]>;
+    /** Optional: Antigravity quotaSummary refresh (absent on older daemons). */
+    refreshAntigravity?(accountId?: string): Promise<AccountAllowanceSnapshot[]>;
     removeAccountSnapshot?(providerId: SubscriptionProviderId, accountId: string): void;
     removeProviderSnapshots?(providerId: SubscriptionProviderId): void;
     getSchedulingStatus?(): AccountAllowanceSchedulingStatus;
@@ -3153,6 +3305,16 @@ interface AdminApiDeps {
      * polled shape; one sign-in at a time. Wired in `bootstrap.ts`.
      */
     readonly copilotSessions: CodexOAuthSessionStore;
+    /** Antigravity interactive OAuth (loopback 51121) — the async flow store. */
+    readonly antigravitySessions: CodexOAuthSessionStore;
+    /** The one-shot 127.0.0.1:51121 listener (test seam like `codexAwaitLoopback`). */
+    readonly antigravityAwaitLoopback: AntigravityLoopbackFn;
+    /**
+     * Resolve the ACTIVE antigravity account's access token for the dynamic
+     * model-catalog probe (secret used daemon-side only; the route is
+     * secret-free). Optional for older tests; absent → static-only catalog.
+     */
+    readonly resolveAntigravityAccessToken?: () => Promise<string | null>;
     /**
      * Codex loopback listener (app-parity-2 child 5) — defaults to `awaitLoopbackCode`
      * (binds 127.0.0.1:1455) in `bootstrap.ts`; tests inject a mock so no real port
@@ -3648,10 +3810,12 @@ declare class MountedResponsesImageStateStore implements ResponsesImageStateStor
 interface ImageDoctorLocalSnapshot {
     readonly config: Readonly<{
         enabled: boolean;
-        provider: 'codex-subscription';
+        provider: ImageProviderId;
         model: string;
         valid: boolean;
         errorCount: number;
+        /** Distinct providers the routing table names (doctor per-provider rows). */
+        routedProviders: readonly ImageProviderId[];
     }>;
     readonly roots: Readonly<{
         valid: boolean;
@@ -3675,11 +3839,18 @@ interface ImageDoctorLocalSnapshot {
         invalidRows: number;
         imagesAuthorizedRows: number;
     }>;
+    /** The Codex-subscription account backing codex-routed image models. */
     readonly account: Readonly<{
         present: boolean;
         usable: boolean;
         reason: 'ready' | 'missing' | 'unavailable';
     }>;
+    /** The Antigravity-subscription account backing NanoBanana image models. */
+    readonly antigravityAccount: Readonly<{
+        present: boolean;
+        usable: boolean;
+        reason: 'ready' | 'missing' | 'unavailable';
+    }>;
     readonly evidence: Readonly<FileCodexImageCapabilityEvidenceStatus & {
         valid: boolean;
     }>;
@@ -4600,6 +4771,11 @@ interface DaemonPaths {
      * so tests need not bind `127.0.0.1:1455`. Absent → the real `awaitLoopbackCode`.
      */
     codexAwaitLoopback?: CodexLoopbackFn;
+    /**
+     * TEST SEAM (optional): override the antigravity loopback listener so tests
+     * need not bind 127.0.0.1:51121. Absent → the real awaitLoopbackCode.
+     */
+    antigravityAwaitLoopback?: AntigravityLoopbackFn;
     /**
      * TEST SEAM (optional): override the OAuth token-exchange fetch so tests need not
      * hit a real token endpoint. Absent → the global `fetch`.