@wenathlan/devthink 2.0.13 → 2.0.15

package/dist/oauth.d.ts

@@ -0,0 +1,703 @@
+/**
+ * @file oauth.ts — the provider oauth family of the merged repository.
+ * @description The grand merge consolidation: ONE file owns the ENTIRE
+ *              provider authentication context (OAuth clients, PKCE, consent
+ *              URL, callback server, token exchange, token refresh, userinfo,
+ *              account file management, identity bundles) of the merged
+ *              repository. Absorbed verbatim:
+ *              (a) the CLI identity bundle of the antigravity engine lineage;
+ *              (b) the Gemini CLI OAuth client + shared endpoint/model
+ *                  constants of the provider family;
+ *              (c) the full-featured OAuth primitives (PKCE, auth URL
+ *                  builder, callback server, exchange, refresh, userinfo);
+ *              (d) the minimal legacy flow + the v3 account manager +
+ *                  project/quota helpers of the provider family;
+ *              (e) the oauth orchestrators and helpers (authenticate,
+ *                  startOAuthFlow, validation, model lists, header builders,
+ *                  platform detection, the legacy default export object).
+ *
+ *              The family is server and cli surface — the neutral core
+ *              barrel (index.ts) never carries it, so the browser bundles
+ *              stay free of node imports: node:* builtins first, global
+ *              fetch beside them.
+/**
+ * @file oauth.ts — the provider oauth family of the merged repository.
+ * @description v2.1.14 physical consolidation: ONE file owns the ENTIRE
+ *              authentication context (OAuth clients, PKCE, consent URL,
+ *              callback server, token exchange, token refresh, userinfo,
+ *              account file management, identity bundles). Absorbed verbatim:
+ *              (a) Antigravity CLI (`agy`) identity bundle - former antigravity-cli.ts;
+ *              (b) Gemini CLI OAuth client + shared endpoint/model constants - former oauth.ts;
+ *              (c) full-featured OAuth primitives (PKCE, auth URL builder,
+ *                  callback server, exchange, refresh, userinfo) - former oauth.ts;
+ *              (d) minimal legacy flow + v3 account manager + project/quota
+ *                  helpers - the original auth.ts content;
+ *              (e) former oauth.ts orchestrators and helpers (authenticate,
+ *                  startOAuthFlow, validation, model lists, header builders,
+ *                  platform detection, legacy default export object).
+ *
+ *              History (v2.1.13 header of the former auth.ts): v5 definitive
+ *              full flow with researches 9router omniroute gemini-cli;
+ *              20 logics correlated, lowercase, node:* first, dual bypass
+ *              definitive, accounts file v3 with addedAt createdAt lastUsed
+ *              expiry; mapModelToGroup ported from auth(1).ts (v4); optional
+ *              name in userInfo return from auth(2).ts (v3).
+ *
+ *              v2.1.14 collision policy - three DISTINCT Google OAuth client
+ *              identities coexist (different clients, not duplicates):
+ *                1. Antigravity CLI client: CLIENT_ID / CLIENT_SECRET (canonical,
+ *                   env-overridable via ANTIGRAVITY_CLIENT_ID /
+ *                   ANTIGRAVITY_CLIENT_SECRET; aliased by
+ *                   ANTIGRAVITY_CLI_CLIENT_ID / ANTIGRAVITY_CLI_CLIENT_SECRET).
+ *                2. Gemini CLI client: GEMINI_OAUTH_CLIENT_ID /
+ *                   GEMINI_OAUTH_CLIENT_SECRET (+ GEMINI_OAUTH_CLIENT_SECRET_ALTERNATIVE
+ *                   and the legacy alias CLIENT_SECRET_ALTERNATIVE) - the former
+ *                   oauth.ts CLIENT_ID / CLIENT_SECRET / CLIENT_SECRET_ALTERNATIVE
+ *                   values.
+ *                3. Antigravity IDE blinded decoy: constants.ts (not this file).
+ *              Other collisions resolved the same way (the original auth.ts
+ *              meaning wins the bare name): SCOPES (Antigravity scope string) vs
+ *              GEMINI_OAUTH_SCOPES (former oauth.ts scope array), ENDPOINTS
+ *              (Antigravity base-URL array) vs CLOUDCODE_ENDPOINTS (former
+ *              oauth.ts endpoint map), openBrowser (former auth.ts void spawner)
+ *              vs openBrowserAsync (former oauth.ts cross-platform WSL-aware
+ *              opener). USERINFO_URL was byte-identical in both former files and
+ *              is declared once. The default export preserves the legacy oauth.js
+ *              object shape with the Gemini CLI values for CJS/ESM interop
+ *              consumers.
+ *
+ *              Self-contained: only node:* builtins + global fetch; no external
+ *              dependencies, no project-file imports.
+ */
+import * as http from "node:http";
+export declare const CLIENT_ID: string;
+export declare const CLIENT_SECRET: string;
+/**
+ * OAuth Client ID of the Antigravity CLI, assembled at runtime from segments
+ * (exactly the constant the `agy` binary embeds). Google renders the consent
+ * screen as "Google Antigravity" for this client.
+ * v2.1.14: byte-identical to the canonical CLIENT_ID above (same value,
+ * different segment split) - deduplicated into the single env-overridable
+ * definition; this historical name now aliases it.
+ */
+export declare const ANTIGRAVITY_CLI_CLIENT_ID: string;
+/**
+ * Primary client secret paired with {@link ANTIGRAVITY_CLI_CLIENT_ID}
+ * (runtime-assembled). This is the secret that answers the token endpoint —
+ * live-verified 2026-08-26.
+ * v2.1.14: byte-identical to the canonical CLIENT_SECRET above (same value,
+ * different segment split) - deduplicated; this historical name now aliases it.
+ */
+export declare const ANTIGRAVITY_CLI_CLIENT_SECRET: string;
+/**
+ * Alternative secret variant also embedded in the binary — kept under an
+ * alias so no credential variant is lost; not used by default.
+ */
+export declare const ANTIGRAVITY_CLI_CLIENT_SECRET_ALTERNATIVE: string;
+/**
+ * Scopes the Antigravity CLI requests (byte-for-byte the set the CLI puts in
+ * the consent URL — includes the aicode / cclog / experimentsandconfigs
+ * grants the Gemini CLI client does not ask for).
+ */
+export declare const ANTIGRAVITY_CLI_OAUTH_SCOPES: readonly string[];
+/** Space-joined scope string (consent URL / token endpoint form). */
+export declare const ANTIGRAVITY_CLI_OAUTH_SCOPES_STR: string;
+/**
+ * Redirect URI the official CLI uses. NOTE: the CLI shows a code on this
+ * remote page that the user must copy/paste back — the plugin does NOT use it.
+ * the plugin uses a loopback redirect (accepted by Google for this client,
+ * live-verified) which makes the whole flow automatic, no copy/paste.
+ */
+export declare const ANTIGRAVITY_CLI_REDIRECT_OFFICIAL: string;
+/**
+ * Auth-success page the CLI flow can land on (kept for fidelity of the
+ * identity; the loopback flow serves its own local success page).
+ */
+export declare const ANTIGRAVITY_CLI_AUTH_SUCCESS_URL: string;
+/** Latest Antigravity CLI release seen on the official update manifest. */
+export declare const ANTIGRAVITY_CLI_VERSION_LATEST: string;
+/**
+ * Recent Antigravity CLI versions (public update manifest history + binary
+ * telemetry). The pool exists so every account can present a plausible
+ * real-world version instead of a single frozen one.
+ */
+/** grpc-go version line compiled into the `agy` binary (1.1.21). */
+export declare const ANTIGRAVITY_CLI_GRPC_VERSION: string;
+/** Normalizes node's platform into the CLI's lowercase os names. */
+export declare function antigravityCliOsName(): string;
+/** amd64/arm64 style arch (matches the CLI manifest names). */
+export declare function antigravityCliArchName(): string;
+/**
+ * Builds the User-Agent the Antigravity CLI presents.
+ * Shape: `antigravity-cli/<version> (<os>; <arch>)`.
+ */
+export declare function buildAntigravityCliUserAgent(version?: string): string;
+/**
+ * X-Goog-Api-Client value for the Antigravity CLI identity.
+ * Shape: `antigravity-cli/<version> grpc-go/<grpc>`.
+ */
+export declare function buildAntigravityCliXGoogApiClient(version?: string): string;
+/**
+ * Complete request headers for the Antigravity CLI identity.
+ * The Antigravity CLI does not send the ideType/pluginType Client-Metadata
+ * header the Gemini CLI family uses — its fingerprint is UA + api client.
+ */
+export declare function getAntigravityCliHeaders(version?: string): Record<string, string>;
+/** OAuth client identities the plugin can present. */
+export type MaeneOAuthIdentity = "antigravity-cli" | "gemini-cli";
+/**
+ * Resolved OAuth client bundle for an identity.
+ * Everything the consent URL builder, the token exchange and the refresh
+ * call need — no hidden globals.
+ */
+export interface OAuthIdentityBundle {
+    identity: MaeneOAuthIdentity;
+    clientId: string;
+    clientSecret: string;
+    clientSecretAlternative: string;
+    scopes: readonly string[];
+    scopesStr: string;
+    /** Antigravity CLI flow is PKCE (S256); Gemini CLI web flow is state-only. */
+    usesPKCE: boolean;
+    userAgent: string;
+    /** Human label of the app Google shows on the consent screen. */
+    appLabel: string;
+}
+/**
+ * Resolves the OAuth client bundle for an identity.
+ *
+ * Default policy ("auto"): NEW logins use the Antigravity CLI client — the
+ * Gemini CLI free tier for individuals was retired (UNSUPPORTED_CLIENT,
+ * observed live 2026-08) and the Antigravity client is the one the current
+ * free tier ("Antigravity") onboards. Stored accounts keep the identity they
+ * authenticated with, whatever it was.
+ */
+export declare function resolveOAuthIdentity(identity?: MaeneOAuthIdentity | "auto" | (string & {}) | null): OAuthIdentityBundle;
+/**
+ * Maps a stored account `type` back to the OAuth identity it must refresh
+ * with. Anything that is not explicitly the Gemini CLI client refreshes with
+ * the Antigravity CLI client (the default since 2.1.8).
+ */
+export declare function identityFromAccountType(accountType?: string | null): MaeneOAuthIdentity;
+export declare const GEMINI_OAUTH_CLIENT_ID: string;
+/**
+ * Primary client secret, paired with {@link GEMINI_OAUTH_CLIENT_ID} above.
+ * v2.1.16: alias of constants.GEMINI_CLI_OAUTH_CLIENT_SECRET.
+ */
+export declare const GEMINI_OAUTH_CLIENT_SECRET: string;
+/**
+ * Alternative public client secret found in oauth(2).ts
+ * (GEMINI_OAUTH_CLIENT_SECRET there). Preserved under an alias so no
+ * credential variant is lost; not used by default.
+ * v2.1.14 rename: CLIENT_SECRET_ALTERNATIVE -> GEMINI_OAUTH_CLIENT_SECRET_ALTERNATIVE.
+ */
+export declare const GEMINI_OAUTH_CLIENT_SECRET_ALTERNATIVE: string;
+/**
+ * Compatibility alias for the bare name used by oauth(2).ts / former oauth.ts:
+ * CLIENT_SECRET_ALTERNATIVE survives with its exact original value (the
+ * alternative secret). Note: per the v2.1.14 canonical naming,
+ * GEMINI_OAUTH_CLIENT_SECRET above points at the PRIMARY gemini secret.
+ */
+export declare const CLIENT_SECRET_ALTERNATIVE: string;
+/**
+ * Required scopes for Cloud Code + Userinfo + Antigravity.
+ * Merged: adds openid, cloudcode and cloudaicompanion (from
+ * oauth(2).ts GOOGLE_OAUTH_SCOPES) on top of the base set.
+ * v2.1.14 rename: SCOPES -> GEMINI_OAUTH_SCOPES (the bare SCOPES name keeps
+ * the Antigravity scope string of the original auth.ts, Section D).
+ */
+export declare const GEMINI_OAUTH_SCOPES: readonly ["openid", "https://www.googleapis.com/auth/cloud-platform", "https://www.googleapis.com/auth/userinfo.email", "https://www.googleapis.com/auth/userinfo.profile", "https://www.googleapis.com/auth/cloudcode", "https://www.googleapis.com/auth/cloudaicompanion"];
+/**
+ * Space-joined scope string alias (oauth(2).ts name preserved).
+ */
+export declare const GOOGLE_OAUTH_SCOPES: string;
+/**
+ * OAuth 2.0 Google endpoints.
+ * v2.1.16 single-owner fix: alias of constants.OAUTH_AUTH_URL.
+ */
+export declare const OAUTH_AUTHORIZE_URL: "https://accounts.google.com/o/oauth2/v2/auth";
+/** Endpoint aliases (oauth(2).ts names preserved). */
+export declare const GOOGLE_AUTH_URL: "https://accounts.google.com/o/oauth2/v2/auth";
+export declare const GOOGLE_TOKEN_URL: "https://oauth2.googleapis.com/token";
+export declare const GOOGLE_USERINFO_URL: "https://www.googleapis.com/oauth2/v2/userinfo";
+/**
+ * Cloud Code Assist endpoints (Antigravity bypass).
+ */
+/** Alias (oauth(2).ts name preserved). */
+export declare const CLOUDCODE_API_BASE: "https://cloudcode-pa.googleapis.com";
+/**
+ * Origin required by some Cloud Code request headers.
+ * Ported from oauth(2).ts.
+ */
+export declare const CLOUDCODE_ORIGIN = "https://cloud.google.com";
+export declare const SIGN_IN_SUCCESS_URL = "https://developers.google.com/gemini-code-assist/auth_success_gemini";
+export declare const SIGN_IN_FAILURE_URL = "https://developers.google.com/gemini-code-assist/auth_failure_gemini";
+export declare const HTTP_REDIRECT = 301;
+export declare function getAvailablePort(): Promise<number>;
+/**
+ * Project fallback when no project is linked in Code Assist.
+ */
+/**
+ * Available models 2026 - Antigravity + Gemini.
+ * Merged: unprefixed claude-opus-4-6-thinking and claude-sonnet-4-6 from
+ * oauth(2).ts SUPPORTED_MODELS_2026 are folded in here (all other entries
+ * were already covered).
+ */
+import { SUPPORTED_MODELS_2026 } from "./models.js";
+import { buildGeminiUserAgent } from "./fingerprint.js";
+import type { SupportedModel2026 } from "./models.js";
+export { SUPPORTED_MODELS_2026 };
+export { SUPPORTED_MODELS_2026 as OAUTH_MODELS_2026 };
+export type { SupportedModel2026 };
+export declare const GEMINI_UA_BASE: {
+    readonly cliVersion: "0.57.0";
+    readonly defaultModel: "gemini-3-pro-preview";
+    readonly googleApiClient: "google-api-nodejs-client/9.15.1";
+    readonly xGoogApiClient: "gl-node/22.19.0";
+    readonly clientMetadata: "ideType=IDE_UNSPECIFIED,platform=PLATFORM_UNSPECIFIED,pluginType=GEMINI";
+};
+export interface PKCEPair {
+    /** Verifier: random 43-128 char string for the proof */
+    verifier: string;
+    /** Challenge: BASE64URL(SHA256(verifier)) */
+    challenge: string;
+    /** Method is always S256 */
+    method: "S256";
+}
+export interface TokenResponse {
+    access_token: string;
+    refresh_token?: string;
+    id_token?: string;
+    token_type: string;
+    expires_in: number;
+    scope?: string;
+    /** Computed locally */
+    expires_at: number;
+}
+export interface UserInfo {
+    id: string;
+    email: string;
+    verified_email: boolean;
+    name: string;
+    given_name?: string;
+    family_name?: string;
+    picture?: string;
+    locale?: string;
+    hd?: string;
+}
+/**
+ * Result returned by the local callback server.
+ * Ported from oauth(2).ts: captures the granted `scope`.
+ */
+export interface OAuthCallbackResult {
+    code: string;
+    state?: string | undefined;
+    scope?: string | undefined;
+}
+/**
+ * Complete OAuth flow result (oauth(2).ts shape, used by startOAuthFlow).
+ */
+export interface OAuthResult {
+    tokens: TokenResponse;
+    userInfo: UserInfo;
+    state: string;
+}
+export interface OAuthServerResult {
+    server: http.Server;
+    /** Full callback URL (http://127.0.0.1:PORT/oauth-callback) */
+    callbackUrl: string;
+    /** Actually bound port */
+    port: number;
+    /** Promise resolving with the authorization code only */
+    waitForCode: () => Promise<string>;
+    /**
+     * Promise resolving with code + state + captured scope.
+     * Ported from oauth(2).ts.
+     */
+    waitForCallback: () => Promise<OAuthCallbackResult>;
+    /** Shuts the server down */
+    close: () => Promise<void>;
+}
+export interface AuthOptions {
+    /** When true, does not try to open the browser automatically */
+    noBrowser?: boolean;
+    /** Timeout waiting for the callback before manual fallback (ms). Default 30000 */
+    callbackTimeoutMs?: number;
+    /** Custom callback path; default /oauth-callback */
+    callbackPath?: string;
+    /** Log callback - allows integration with the opencode logger */
+    onLog?: (level: "info" | "warn" | "error", msg: string) => void;
+    /** OAuth client identity bundle (see antigravity-cli.ts). When provided the
+     *  flow uses its clientId/clientSecret/scopes/PKCE policy instead of the
+     *  legacy Gemini CLI web-flow defaults. */
+    identity?: {
+        identity: string;
+        clientId: string;
+        clientSecret: string;
+        scopesStr: string;
+        usesPKCE: boolean;
+        userAgent?: string;
+        appLabel?: string;
+    };
+}
+/**
+ * Injectable options for the direct startOAuthFlow orchestrator.
+ * Ported from oauth(2).ts: every external dependency can be injected for tests.
+ */
+export interface StartOAuthFlowOptions {
+    /** Callback path - default /callback */
+    callbackPath?: string;
+    /** Total timeout in ms - default 5 minutes */
+    timeoutMs?: number;
+    /** Scopes - default GOOGLE_OAUTH_SCOPES */
+    scopes?: string;
+    /** ClientId - default GEMINI_OAUTH_CLIENT_ID (former oauth.ts CLIENT_ID) */
+    clientId?: string;
+    /** ClientSecret - default GEMINI_OAUTH_CLIENT_SECRET (former oauth.ts CLIENT_SECRET) */
+    clientSecret?: string;
+    /** Browser opener function - injectable for tests */
+    openBrowserFn?: (url: string) => void;
+}
+/**
+ * Encodes Buffer/string to base64url (RFC 7636 - no padding, -_ instead of +/)
+ */
+declare function base64urlEncode(input: Buffer | string): string;
+/**
+ * Decodes base64url to Buffer
+ */
+declare function base64urlDecode(input: string): Buffer;
+/**
+ * Detects whether running inside WSL
+ */
+export declare function isWSL(): boolean;
+/**
+ * Detects an SSH session (no local display)
+ */
+export declare function isSSH(): boolean;
+/**
+ * Detects whether a graphical display is available
+ */
+export declare function hasDisplay(): boolean;
+/**
+ * Builds platform-specific User-Agent - Gemini CLI masquerade.
+ * Format: GeminiCLI/<version>/<model> (<platform>; <arch>; GitHub) <google-api-client>
+ */
+/**
+ * Returns the required bypass headers object with all identification headers.
+ */
+export declare function getGeminiHeaders(): Record<string, string>;
+/**
+ * Generates a PKCE pair (verifier + challenge) per RFC 7636.
+ * - verifier: 32 bytes random -> base64url = 43 chars (within 43-128)
+ * - challenge: BASE64URL(SHA256(verifier))
+ *
+ * @returns {PKCEPair} verifier/challenge pair
+ * @example
+ * const { verifier, challenge } = generatePKCE();
+ */
+export declare function generatePKCE(): PKCEPair;
+/**
+ * Builds the OAuth 2.0 + PKCE authorization URL.
+ *
+ * @param pkce - Generated PKCE pair
+ * @param redirectUri - Redirect URI (e.g. http://127.0.0.1:PORT/oauth-callback)
+ * @param opts - Extra options (custom state, login_hint, etc.)
+ * @returns Full URL to redirect the user to
+ */
+export declare function buildAuthUrl(pkce: PKCEPair | null, redirectUri: string, opts?: {
+    state?: string;
+    loginHint?: string;
+    prompt?: "consent" | "select_account" | "none";
+    accessType?: "online" | "offline";
+    scopes?: string;
+    clientId?: string;
+}): string;
+/**
+ * Tries to open the URL in the default browser - cross-platform.
+ * Supports: darwin (open), win32 (start via cmd), linux (xdg-open), WSL (wslview/powershell)
+ * v2.1.14 rename: openBrowser -> openBrowserAsync (the bare openBrowser name
+ * keeps the former auth.ts void implementation, Section D).
+ *
+ * @param url - URL to open
+ * @returns true if the command was spawned, false if it failed
+ */
+export declare function openBrowserAsync(url: string): Promise<boolean>;
+/**
+ * Creates a local HTTP server on 127.0.0.1:0 (random port) to receive the OAuth callback.
+ *
+ * Multi-path support (ported from oauth(2).ts): accepts the configured
+ * callbackPath, plus /oauth/callback, plus "/" when the request carries code /
+ * error query parameters. A bare "/" GET without OAuth params still serves the
+ * healthcheck info text (conflict resolved in favor of both behaviors).
+ *
+ * Validates state if provided, extracts code and the granted `scope`.
+ *
+ * @param options - options: callbackPath, timeout, logger
+ * @returns OAuthServerResult with server, callbackUrl, waitForCode, waitForCallback, close
+ */
+export declare function createOAuthServer(options?: {
+    callbackPath?: string;
+    onLog?: AuthOptions["onLog"];
+    expectedState?: string;
+}): OAuthServerResult;
+/**
+ * Async helper version that already waits for the server to be listening and returns full info
+ */
+export declare function createOAuthServerAsync(opts?: {
+    callbackPath?: string;
+    onLog?: AuthOptions["onLog"];
+    expectedState?: string;
+}): Promise<OAuthServerResult & {
+    ready: true;
+}>;
+/**
+ * Exchanges the authorization code for tokens (access_token + refresh_token).
+ * POST https://oauth2.googleapis.com/token
+ *
+ * Robust error wrapping ported from oauth(2).ts: network failures are wrapped
+ * with `cause`, non-JSON bodies are rejected with a status + body snippet, and
+ * a missing access_token is an explicit error.
+ *
+ * @param code - Received authorization code
+ * @param codeVerifier - Original PKCE verifier
+ * @param redirectUri - Same redirect_uri used in buildAuthUrl
+ * @param options - Optional injected credentials (defaults to GEMINI_OAUTH_CLIENT_ID / GEMINI_OAUTH_CLIENT_SECRET)
+ * @returns TokenResponse with computed expires_at
+ */
+export declare function exchangeCodeForTokens(code: string, codeVerifier: string | null, redirectUri: string, options?: {
+    clientId?: string;
+    clientSecret?: string;
+}): Promise<TokenResponse>;
+/**
+ * Renews the access_token using a refresh_token.
+ *
+ * invalid_grant handling ported from oauth(2).ts: when Google answers with
+ * error=invalid_grant an explicit "re-authentication necessary" error is
+ * raised so callers can trigger a fresh login instead of retrying blindly.
+ *
+ * @param refreshToken - Valid refresh token
+ * @param options - Optional injected credentials (defaults to GEMINI_OAUTH_CLIENT_ID / GEMINI_OAUTH_CLIENT_SECRET)
+ * @returns New TokenResponse (may contain a rotated refresh_token; the previous
+ *          one is preserved when Google omits it)
+ */
+export declare function refreshAccessToken(refreshToken: string, options?: {
+    clientId?: string;
+    clientSecret?: string;
+}): Promise<TokenResponse>;
+/**
+ * Helper ported from oauth(2).ts: refreshes tokens while preserving the old
+ * refresh_token when Google omits a new one. Library-first pattern.
+ *
+ * @param oldTokens - Previously stored TokenResponse containing a refresh_token
+ * @returns Refreshed TokenResponse guaranteed to carry a usable refresh_token
+ */
+export declare function refreshAndPreserve(oldTokens: TokenResponse): Promise<TokenResponse>;
+/**
+ * Checks whether a token is expired or about to expire (60s buffer)
+ */
+export declare function isTokenExpired(token: TokenResponse, bufferMs?: number): boolean;
+/**
+ * Retrieves information about the authenticated user.
+ * GET https://www.googleapis.com/oauth2/v2/userinfo
+ *
+ * Robust error wrapping ported from oauth(2).ts: network failures wrapped with
+ * `cause`; non-JSON bodies rejected with a status + body snippet.
+ *
+ * @param accessToken - Valid access token
+ * @returns Normalized UserInfo
+ */
+export declare function getUserInfo(accessToken: string): Promise<UserInfo>;
+/** v2.1.16 single-owner fix: delegation to core.js fetchWithTimeout (was a private re-implementation). */
+export declare const fetchTimeout: (url: string, init: RequestInit, ms?: number) => Promise<Response>;
+/** Minimal token-response shape of the Antigravity-client refresh flow (Section D lineage). */
+export type tokenres = {
+    access_token: string;
+    refresh_token?: string;
+    expires_in?: number;
+    id_token?: string;
+    created_at?: number;
+};
+export declare const refreshToken: (rt: string) => Promise<tokenres>;
+export declare const accountsPath: () => string;
+export type accountEntry = {
+    email: string;
+    refreshToken: string;
+    accessToken?: string;
+    expiry?: number;
+    createdAt?: number;
+    addedAt: number;
+    lastUsed?: number;
+    projectId?: string;
+    managedProjectId?: string;
+    disabled?: boolean;
+    quotaExhaustedUntil?: number;
+    softQuotaUntil?: number;
+    remaining?: number;
+    limit?: number;
+    rateLimitResetTimes?: Record<string, number>;
+};
+export type accountsFile = {
+    version: 3;
+    accounts: accountEntry[];
+    activeIndex: number;
+    activeIndexByFamily: {
+        claude: number;
+        gemini: number;
+        [k: string]: number;
+    };
+};
+export declare class accountManager {
+    private data;
+    private locks;
+    private idx;
+    private sticky;
+    load(): Promise<void>;
+    save(): Promise<void>;
+    list(): accountEntry[];
+    getFile(): accountsFile;
+    add(a: Omit<accountEntry, "addedAt" | "createdAt"> & {
+        addedAt?: number;
+        createdAt?: number;
+    }): Promise<void>;
+    remove(email: string): Promise<void>;
+    enable(email: string, en?: boolean): Promise<void>;
+    getNext(strategy?: "round-robin" | "sticky", softThreshold?: number): accountEntry | null;
+    setRateLimit(email: string, modelKey: string, resetMs: number): void;
+    markExhausted(email: string, ms?: number): void;
+    markSoftQuota(email: string, ms?: number): void;
+    refreshIfNeeded(email: string): Promise<string>;
+    importManager(): Promise<number>;
+}
+export declare const retrieveQuota: (at: string, pid?: "rising-fact-p41fc") => Promise<{
+    remaining: number;
+    limit: number;
+    used: number;
+} | null>;
+/**
+ * @section Model Group Classification
+ * Ported from auth(1).ts v4: classifies a model identifier into its routing group.
+ * "gemini-cli" when the model contains "preview" or starts with a gemini-3.x
+ * prefix (3, 3.1, 3.5, 3.6, 3.7); otherwise "antigravity".
+ */
+export { mapModelToGroup } from "./models.js";
+/**
+ * Full OAuth flow: PKCE + Server + Browser + Exchange + UserInfo.
+ * Supports:
+ * - WSL/SSH detection -> does not try to open a browser when there is no DISPLAY
+ * - --no-browser flag via AuthOptions.noBrowser or env OPENCODE_NO_BROWSER=1 or args
+ * - 30s timeout fallback to manual URL/code input
+ *
+ * @param opts - AuthOptions
+ * @returns object with tokens and userinfo
+ */
+export declare function authenticate(opts?: AuthOptions & {
+    existingPKCE?: PKCEPair;
+}): Promise<{
+    tokens: TokenResponse;
+    userInfo: UserInfo;
+    pkce: PKCEPair | null;
+    callbackUrl: string;
+}>;
+/**
+ * Direct PKCE orchestrator ported from oauth(2).ts and adapted onto the local
+ * server infrastructure above (single server implementation, multi-path
+ * callback, scope capture, CSRF state validation).
+ *
+ * Steps:
+ * 1. generatePKCE (verifier + S256 challenge)
+ * 2. local server 127.0.0.1 on a locked random port
+ * 3. auth URL with code_challenge and state
+ * 4. browser opening via injectable openBrowserFn (manual fallback: URL logged)
+ * 5. waits for callback with total timeout
+ * 6. exchanges code for tokens at POST https://oauth2.googleapis.com/token
+ * 7. fetches userinfo e-mail
+ *
+ * @param options - StartOAuthFlowOptions (all injectable for tests)
+ * @returns OAuthResult with tokens + userInfo + validated state
+ */
+export declare function startOAuthFlow(options?: StartOAuthFlowOptions): Promise<OAuthResult>;
+/**
+ * Validates the TokenResponse shape (useful when loading from disk)
+ */
+export declare function isValidTokenResponse(obj: any): obj is TokenResponse;
+/**
+ * Extracts the code from a callback URL (public helper for manual paste)
+ */
+export declare function extractCodeFromUrl(input: string): string | null;
+/**
+ * Returns the list of available models (the folded 2026 tuple).
+ * Helper for client-side validation before calling fetchAvailableModels.
+ */
+export declare function getAllModels(): readonly string[];
+export declare function isAntigravityModel(model: string): boolean;
+/**
+ * Default export for CJS/ESM interop. v2.1.14: preserved from the former
+ * oauth.ts - every key keeps its legacy oauth.js VALUE (Gemini CLI client),
+ * so `default ?? namespace` interop consumers (the cli.ts pattern) keep
+ * observing the gemini credentials even though the bare named exports
+ * CLIENT_ID / CLIENT_SECRET now carry the Antigravity CLI client. The
+ * v2.1.14-renamed symbols are wired back under their legacy keys.
+ */
+declare const oauth: {
+    CLIENT_ID: string;
+    CLIENT_SECRET: string;
+    CLIENT_SECRET_ALTERNATIVE: string;
+    GEMINI_OAUTH_CLIENT_ID: string;
+    GEMINI_OAUTH_CLIENT_SECRET: string;
+    SCOPES: readonly ["openid", "https://www.googleapis.com/auth/cloud-platform", "https://www.googleapis.com/auth/userinfo.email", "https://www.googleapis.com/auth/userinfo.profile", "https://www.googleapis.com/auth/cloudcode", "https://www.googleapis.com/auth/cloudaicompanion"];
+    GOOGLE_OAUTH_SCOPES: string;
+    OAUTH_AUTHORIZE_URL: "https://accounts.google.com/o/oauth2/v2/auth";
+    OAUTH_TOKEN_URL: "https://oauth2.googleapis.com/token";
+    USERINFO_URL: "https://www.googleapis.com/oauth2/v2/userinfo";
+    GOOGLE_AUTH_URL: "https://accounts.google.com/o/oauth2/v2/auth";
+    GOOGLE_TOKEN_URL: "https://oauth2.googleapis.com/token";
+    GOOGLE_USERINFO_URL: "https://www.googleapis.com/oauth2/v2/userinfo";
+    CLOUDCODE_BASE: "https://cloudcode-pa.googleapis.com";
+    CLOUDCODE_API_BASE: "https://cloudcode-pa.googleapis.com";
+    CLOUDCODE_ORIGIN: string;
+    ENDPOINTS: {
+        readonly base: "https://cloudcode-pa.googleapis.com";
+        readonly loadCodeAssist: "https://cloudcode-pa.googleapis.com/v1internal:loadCodeAssist";
+        readonly onboardUser: "https://cloudcode-pa.googleapis.com/v1internal:onboardUser";
+        readonly fetchAvailableModels: "https://cloudcode-pa.googleapis.com/v1internal:fetchAvailableModels";
+        readonly generateContent: "https://cloudcode-pa.googleapis.com/v1internal:generateContent";
+        readonly streamGenerateContent: "https://cloudcode-pa.googleapis.com/v1internal:streamGenerateContent";
+        readonly retrieveUserQuotaSummary: "https://cloudcode-pa.googleapis.com/v1internal:retrieveUserQuotaSummary";
+    };
+    PROJECT_FALLBACK: "rising-fact-p41fc";
+    MODELS_2026: readonly ["antigravity-gemini-3-pro", "antigravity-gemini-3.1-pro", "antigravity-gemini-3-flash", "antigravity-claude-sonnet-4-6", "antigravity-claude-opus-4-6-thinking", "gemini-2.5-flash", "gemini-2.5-pro", "gemini-3-flash-preview", "gemini-3-pro-preview", "gemini-3.1-pro-preview", "gemini-3.1-pro-preview-customtools", "claude-opus-4-6-thinking", "claude-sonnet-4-6"];
+    SUPPORTED_MODELS_2026: readonly ["antigravity-gemini-3-pro", "antigravity-gemini-3.1-pro", "antigravity-gemini-3-flash", "antigravity-claude-sonnet-4-6", "antigravity-claude-opus-4-6-thinking", "gemini-2.5-flash", "gemini-2.5-pro", "gemini-3-flash-preview", "gemini-3-pro-preview", "gemini-3.1-pro-preview", "gemini-3.1-pro-preview-customtools", "claude-opus-4-6-thinking", "claude-sonnet-4-6"];
+    GEMINI_UA_BASE: {
+        readonly cliVersion: "0.57.0";
+        readonly defaultModel: "gemini-3-pro-preview";
+        readonly googleApiClient: "google-api-nodejs-client/9.15.1";
+        readonly xGoogApiClient: "gl-node/22.19.0";
+        readonly clientMetadata: "ideType=IDE_UNSPECIFIED,platform=PLATFORM_UNSPECIFIED,pluginType=GEMINI";
+    };
+    ANTIGRAVITY_USER_AGENT: string;
+    generatePKCE: typeof generatePKCE;
+    buildAuthUrl: typeof buildAuthUrl;
+    createOAuthServer: typeof createOAuthServer;
+    createOAuthServerAsync: typeof createOAuthServerAsync;
+    openBrowser: typeof openBrowserAsync;
+    exchangeCodeForTokens: typeof exchangeCodeForTokens;
+    refreshAccessToken: typeof refreshAccessToken;
+    refreshAndPreserve: typeof refreshAndPreserve;
+    startOAuthFlow: typeof startOAuthFlow;
+    getUserInfo: typeof getUserInfo;
+    authenticate: typeof authenticate;
+    isTokenExpired: typeof isTokenExpired;
+    isValidTokenResponse: typeof isValidTokenResponse;
+    extractCodeFromUrl: typeof extractCodeFromUrl;
+    isWSL: typeof isWSL;
+    isSSH: typeof isSSH;
+    hasDisplay: typeof hasDisplay;
+    buildGeminiUserAgent: typeof buildGeminiUserAgent;
+    getGeminiHeaders: typeof getGeminiHeaders;
+    getAllModels: typeof getAllModels;
+    isAntigravityModel: typeof isAntigravityModel;
+    base64urlEncode: typeof base64urlEncode;
+    base64urlDecode: typeof base64urlDecode;
+};
+export default oauth;
+//# sourceMappingURL=oauth.d.ts.map