@wenathlan/devthink 2.0.14 → 2.0.19

package/dist/oauth.d.ts

@@ -1,703 +0,0 @@
-/**
- * @file oauth.ts — the provider oauth family of the merged repository.
- * @description The grand merge consolidation: ONE file owns the ENTIRE
- *              provider authentication context (OAuth clients, PKCE, consent
- *              URL, callback server, token exchange, token refresh, userinfo,
- *              account file management, identity bundles) of the merged
- *              repository. Absorbed verbatim:
- *              (a) the CLI identity bundle of the antigravity engine lineage;
- *              (b) the Gemini CLI OAuth client + shared endpoint/model
- *                  constants of the provider family;
- *              (c) the full-featured OAuth primitives (PKCE, auth URL
- *                  builder, callback server, exchange, refresh, userinfo);
- *              (d) the minimal legacy flow + the v3 account manager +
- *                  project/quota helpers of the provider family;
- *              (e) the oauth orchestrators and helpers (authenticate,
- *                  startOAuthFlow, validation, model lists, header builders,
- *                  platform detection, the legacy default export object).
- *
- *              The family is server and cli surface — the neutral core
- *              barrel (index.ts) never carries it, so the browser bundles
- *              stay free of node imports: node:* builtins first, global
- *              fetch beside them.
-/**
- * @file oauth.ts — the provider oauth family of the merged repository.
- * @description v2.1.14 physical consolidation: ONE file owns the ENTIRE
- *              authentication context (OAuth clients, PKCE, consent URL,
- *              callback server, token exchange, token refresh, userinfo,
- *              account file management, identity bundles). Absorbed verbatim:
- *              (a) Antigravity CLI (`agy`) identity bundle - former antigravity-cli.ts;
- *              (b) Gemini CLI OAuth client + shared endpoint/model constants - former oauth.ts;
- *              (c) full-featured OAuth primitives (PKCE, auth URL builder,
- *                  callback server, exchange, refresh, userinfo) - former oauth.ts;
- *              (d) minimal legacy flow + v3 account manager + project/quota
- *                  helpers - the original auth.ts content;
- *              (e) former oauth.ts orchestrators and helpers (authenticate,
- *                  startOAuthFlow, validation, model lists, header builders,
- *                  platform detection, legacy default export object).
- *
- *              History (v2.1.13 header of the former auth.ts): v5 definitive
- *              full flow with researches 9router omniroute gemini-cli;
- *              20 logics correlated, lowercase, node:* first, dual bypass
- *              definitive, accounts file v3 with addedAt createdAt lastUsed
- *              expiry; mapModelToGroup ported from auth(1).ts (v4); optional
- *              name in userInfo return from auth(2).ts (v3).
- *
- *              v2.1.14 collision policy - three DISTINCT Google OAuth client
- *              identities coexist (different clients, not duplicates):
- *                1. Antigravity CLI client: CLIENT_ID / CLIENT_SECRET (canonical,
- *                   env-overridable via ANTIGRAVITY_CLIENT_ID /
- *                   ANTIGRAVITY_CLIENT_SECRET; aliased by
- *                   ANTIGRAVITY_CLI_CLIENT_ID / ANTIGRAVITY_CLI_CLIENT_SECRET).
- *                2. Gemini CLI client: GEMINI_OAUTH_CLIENT_ID /
- *                   GEMINI_OAUTH_CLIENT_SECRET (+ GEMINI_OAUTH_CLIENT_SECRET_ALTERNATIVE
- *                   and the legacy alias CLIENT_SECRET_ALTERNATIVE) - the former
- *                   oauth.ts CLIENT_ID / CLIENT_SECRET / CLIENT_SECRET_ALTERNATIVE
- *                   values.
- *                3. Antigravity IDE blinded decoy: constants.ts (not this file).
- *              Other collisions resolved the same way (the original auth.ts
- *              meaning wins the bare name): SCOPES (Antigravity scope string) vs
- *              GEMINI_OAUTH_SCOPES (former oauth.ts scope array), ENDPOINTS
- *              (Antigravity base-URL array) vs CLOUDCODE_ENDPOINTS (former
- *              oauth.ts endpoint map), openBrowser (former auth.ts void spawner)
- *              vs openBrowserAsync (former oauth.ts cross-platform WSL-aware
- *              opener). USERINFO_URL was byte-identical in both former files and
- *              is declared once. The default export preserves the legacy oauth.js
- *              object shape with the Gemini CLI values for CJS/ESM interop
- *              consumers.
- *
- *              Self-contained: only node:* builtins + global fetch; no external
- *              dependencies, no project-file imports.
- */
-import * as http from "node:http";
-export declare const CLIENT_ID: string;
-export declare const CLIENT_SECRET: string;
-/**
- * OAuth Client ID of the Antigravity CLI, assembled at runtime from segments
- * (exactly the constant the `agy` binary embeds). Google renders the consent
- * screen as "Google Antigravity" for this client.
- * v2.1.14: byte-identical to the canonical CLIENT_ID above (same value,
- * different segment split) - deduplicated into the single env-overridable
- * definition; this historical name now aliases it.
- */
-export declare const ANTIGRAVITY_CLI_CLIENT_ID: string;
-/**
- * Primary client secret paired with {@link ANTIGRAVITY_CLI_CLIENT_ID}
- * (runtime-assembled). This is the secret that answers the token endpoint —
- * live-verified 2026-08-26.
- * v2.1.14: byte-identical to the canonical CLIENT_SECRET above (same value,
- * different segment split) - deduplicated; this historical name now aliases it.
- */
-export declare const ANTIGRAVITY_CLI_CLIENT_SECRET: string;
-/**
- * Alternative secret variant also embedded in the binary — kept under an
- * alias so no credential variant is lost; not used by default.
- */
-export declare const ANTIGRAVITY_CLI_CLIENT_SECRET_ALTERNATIVE: string;
-/**
- * Scopes the Antigravity CLI requests (byte-for-byte the set the CLI puts in
- * the consent URL — includes the aicode / cclog / experimentsandconfigs
- * grants the Gemini CLI client does not ask for).
- */
-export declare const ANTIGRAVITY_CLI_OAUTH_SCOPES: readonly string[];
-/** Space-joined scope string (consent URL / token endpoint form). */
-export declare const ANTIGRAVITY_CLI_OAUTH_SCOPES_STR: string;
-/**
- * Redirect URI the official CLI uses. NOTE: the CLI shows a code on this
- * remote page that the user must copy/paste back — the plugin does NOT use it.
- * the plugin uses a loopback redirect (accepted by Google for this client,
- * live-verified) which makes the whole flow automatic, no copy/paste.
- */
-export declare const ANTIGRAVITY_CLI_REDIRECT_OFFICIAL: string;
-/**
- * Auth-success page the CLI flow can land on (kept for fidelity of the
- * identity; the loopback flow serves its own local success page).
- */
-export declare const ANTIGRAVITY_CLI_AUTH_SUCCESS_URL: string;
-/** Latest Antigravity CLI release seen on the official update manifest. */
-export declare const ANTIGRAVITY_CLI_VERSION_LATEST: string;
-/**
- * Recent Antigravity CLI versions (public update manifest history + binary
- * telemetry). The pool exists so every account can present a plausible
- * real-world version instead of a single frozen one.
- */
-/** grpc-go version line compiled into the `agy` binary (1.1.21). */
-export declare const ANTIGRAVITY_CLI_GRPC_VERSION: string;
-/** Normalizes node's platform into the CLI's lowercase os names. */
-export declare function antigravityCliOsName(): string;
-/** amd64/arm64 style arch (matches the CLI manifest names). */
-export declare function antigravityCliArchName(): string;
-/**
- * Builds the User-Agent the Antigravity CLI presents.
- * Shape: `antigravity-cli/<version> (<os>; <arch>)`.
- */
-export declare function buildAntigravityCliUserAgent(version?: string): string;
-/**
- * X-Goog-Api-Client value for the Antigravity CLI identity.
- * Shape: `antigravity-cli/<version> grpc-go/<grpc>`.
- */
-export declare function buildAntigravityCliXGoogApiClient(version?: string): string;
-/**
- * Complete request headers for the Antigravity CLI identity.
- * The Antigravity CLI does not send the ideType/pluginType Client-Metadata
- * header the Gemini CLI family uses — its fingerprint is UA + api client.
- */
-export declare function getAntigravityCliHeaders(version?: string): Record<string, string>;
-/** OAuth client identities the plugin can present. */
-export type MaeneOAuthIdentity = "antigravity-cli" | "gemini-cli";
-/**
- * Resolved OAuth client bundle for an identity.
- * Everything the consent URL builder, the token exchange and the refresh
- * call need — no hidden globals.
- */
-export interface OAuthIdentityBundle {
-    identity: MaeneOAuthIdentity;
-    clientId: string;
-    clientSecret: string;
-    clientSecretAlternative: string;
-    scopes: readonly string[];
-    scopesStr: string;
-    /** Antigravity CLI flow is PKCE (S256); Gemini CLI web flow is state-only. */
-    usesPKCE: boolean;
-    userAgent: string;
-    /** Human label of the app Google shows on the consent screen. */
-    appLabel: string;
-}
-/**
- * Resolves the OAuth client bundle for an identity.
- *
- * Default policy ("auto"): NEW logins use the Antigravity CLI client — the
- * Gemini CLI free tier for individuals was retired (UNSUPPORTED_CLIENT,
- * observed live 2026-08) and the Antigravity client is the one the current
- * free tier ("Antigravity") onboards. Stored accounts keep the identity they
- * authenticated with, whatever it was.
- */
-export declare function resolveOAuthIdentity(identity?: MaeneOAuthIdentity | "auto" | (string & {}) | null): OAuthIdentityBundle;
-/**
- * Maps a stored account `type` back to the OAuth identity it must refresh
- * with. Anything that is not explicitly the Gemini CLI client refreshes with
- * the Antigravity CLI client (the default since 2.1.8).
- */
-export declare function identityFromAccountType(accountType?: string | null): MaeneOAuthIdentity;
-export declare const GEMINI_OAUTH_CLIENT_ID: string;
-/**
- * Primary client secret, paired with {@link GEMINI_OAUTH_CLIENT_ID} above.
- * v2.1.16: alias of constants.GEMINI_CLI_OAUTH_CLIENT_SECRET.
- */
-export declare const GEMINI_OAUTH_CLIENT_SECRET: string;
-/**
- * Alternative public client secret found in oauth(2).ts
- * (GEMINI_OAUTH_CLIENT_SECRET there). Preserved under an alias so no
- * credential variant is lost; not used by default.
- * v2.1.14 rename: CLIENT_SECRET_ALTERNATIVE -> GEMINI_OAUTH_CLIENT_SECRET_ALTERNATIVE.
- */
-export declare const GEMINI_OAUTH_CLIENT_SECRET_ALTERNATIVE: string;
-/**
- * Compatibility alias for the bare name used by oauth(2).ts / former oauth.ts:
- * CLIENT_SECRET_ALTERNATIVE survives with its exact original value (the
- * alternative secret). Note: per the v2.1.14 canonical naming,
- * GEMINI_OAUTH_CLIENT_SECRET above points at the PRIMARY gemini secret.
- */
-export declare const CLIENT_SECRET_ALTERNATIVE: string;
-/**
- * Required scopes for Cloud Code + Userinfo + Antigravity.
- * Merged: adds openid, cloudcode and cloudaicompanion (from
- * oauth(2).ts GOOGLE_OAUTH_SCOPES) on top of the base set.
- * v2.1.14 rename: SCOPES -> GEMINI_OAUTH_SCOPES (the bare SCOPES name keeps
- * the Antigravity scope string of the original auth.ts, Section D).
- */
-export declare const GEMINI_OAUTH_SCOPES: readonly ["openid", "https://www.googleapis.com/auth/cloud-platform", "https://www.googleapis.com/auth/userinfo.email", "https://www.googleapis.com/auth/userinfo.profile", "https://www.googleapis.com/auth/cloudcode", "https://www.googleapis.com/auth/cloudaicompanion"];
-/**
- * Space-joined scope string alias (oauth(2).ts name preserved).
- */
-export declare const GOOGLE_OAUTH_SCOPES: string;
-/**
- * OAuth 2.0 Google endpoints.
- * v2.1.16 single-owner fix: alias of constants.OAUTH_AUTH_URL.
- */
-export declare const OAUTH_AUTHORIZE_URL: "https://accounts.google.com/o/oauth2/v2/auth";
-/** Endpoint aliases (oauth(2).ts names preserved). */
-export declare const GOOGLE_AUTH_URL: "https://accounts.google.com/o/oauth2/v2/auth";
-export declare const GOOGLE_TOKEN_URL: "https://oauth2.googleapis.com/token";
-export declare const GOOGLE_USERINFO_URL: "https://www.googleapis.com/oauth2/v2/userinfo";
-/**
- * Cloud Code Assist endpoints (Antigravity bypass).
- */
-/** Alias (oauth(2).ts name preserved). */
-export declare const CLOUDCODE_API_BASE: "https://cloudcode-pa.googleapis.com";
-/**
- * Origin required by some Cloud Code request headers.
- * Ported from oauth(2).ts.
- */
-export declare const CLOUDCODE_ORIGIN = "https://cloud.google.com";
-export declare const SIGN_IN_SUCCESS_URL = "https://developers.google.com/gemini-code-assist/auth_success_gemini";
-export declare const SIGN_IN_FAILURE_URL = "https://developers.google.com/gemini-code-assist/auth_failure_gemini";
-export declare const HTTP_REDIRECT = 301;
-export declare function getAvailablePort(): Promise<number>;
-/**
- * Project fallback when no project is linked in Code Assist.
- */
-/**
- * Available models 2026 - Antigravity + Gemini.
- * Merged: unprefixed claude-opus-4-6-thinking and claude-sonnet-4-6 from
- * oauth(2).ts SUPPORTED_MODELS_2026 are folded in here (all other entries
- * were already covered).
- */
-import { SUPPORTED_MODELS_2026 } from "./models.js";
-import { buildGeminiUserAgent } from "./fingerprint.js";
-import type { SupportedModel2026 } from "./models.js";
-export { SUPPORTED_MODELS_2026 };
-export { SUPPORTED_MODELS_2026 as OAUTH_MODELS_2026 };
-export type { SupportedModel2026 };
-export declare const GEMINI_UA_BASE: {
-    readonly cliVersion: "0.57.0";
-    readonly defaultModel: "gemini-3-pro-preview";
-    readonly googleApiClient: "google-api-nodejs-client/9.15.1";
-    readonly xGoogApiClient: "gl-node/22.19.0";
-    readonly clientMetadata: "ideType=IDE_UNSPECIFIED,platform=PLATFORM_UNSPECIFIED,pluginType=GEMINI";
-};
-export interface PKCEPair {
-    /** Verifier: random 43-128 char string for the proof */
-    verifier: string;
-    /** Challenge: BASE64URL(SHA256(verifier)) */
-    challenge: string;
-    /** Method is always S256 */
-    method: "S256";
-}
-export interface TokenResponse {
-    access_token: string;
-    refresh_token?: string;
-    id_token?: string;
-    token_type: string;
-    expires_in: number;
-    scope?: string;
-    /** Computed locally */
-    expires_at: number;
-}
-export interface UserInfo {
-    id: string;
-    email: string;
-    verified_email: boolean;
-    name: string;
-    given_name?: string;
-    family_name?: string;
-    picture?: string;
-    locale?: string;
-    hd?: string;
-}
-/**
- * Result returned by the local callback server.
- * Ported from oauth(2).ts: captures the granted `scope`.
- */
-export interface OAuthCallbackResult {
-    code: string;
-    state?: string | undefined;
-    scope?: string | undefined;
-}
-/**
- * Complete OAuth flow result (oauth(2).ts shape, used by startOAuthFlow).
- */
-export interface OAuthResult {
-    tokens: TokenResponse;
-    userInfo: UserInfo;
-    state: string;
-}
-export interface OAuthServerResult {
-    server: http.Server;
-    /** Full callback URL (http://127.0.0.1:PORT/oauth-callback) */
-    callbackUrl: string;
-    /** Actually bound port */
-    port: number;
-    /** Promise resolving with the authorization code only */
-    waitForCode: () => Promise<string>;
-    /**
-     * Promise resolving with code + state + captured scope.
-     * Ported from oauth(2).ts.
-     */
-    waitForCallback: () => Promise<OAuthCallbackResult>;
-    /** Shuts the server down */
-    close: () => Promise<void>;
-}
-export interface AuthOptions {
-    /** When true, does not try to open the browser automatically */
-    noBrowser?: boolean;
-    /** Timeout waiting for the callback before manual fallback (ms). Default 30000 */
-    callbackTimeoutMs?: number;
-    /** Custom callback path; default /oauth-callback */
-    callbackPath?: string;
-    /** Log callback - allows integration with the opencode logger */
-    onLog?: (level: "info" | "warn" | "error", msg: string) => void;
-    /** OAuth client identity bundle (see antigravity-cli.ts). When provided the
-     *  flow uses its clientId/clientSecret/scopes/PKCE policy instead of the
-     *  legacy Gemini CLI web-flow defaults. */
-    identity?: {
-        identity: string;
-        clientId: string;
-        clientSecret: string;
-        scopesStr: string;
-        usesPKCE: boolean;
-        userAgent?: string;
-        appLabel?: string;
-    };
-}
-/**
- * Injectable options for the direct startOAuthFlow orchestrator.
- * Ported from oauth(2).ts: every external dependency can be injected for tests.
- */
-export interface StartOAuthFlowOptions {
-    /** Callback path - default /callback */
-    callbackPath?: string;
-    /** Total timeout in ms - default 5 minutes */
-    timeoutMs?: number;
-    /** Scopes - default GOOGLE_OAUTH_SCOPES */
-    scopes?: string;
-    /** ClientId - default GEMINI_OAUTH_CLIENT_ID (former oauth.ts CLIENT_ID) */
-    clientId?: string;
-    /** ClientSecret - default GEMINI_OAUTH_CLIENT_SECRET (former oauth.ts CLIENT_SECRET) */
-    clientSecret?: string;
-    /** Browser opener function - injectable for tests */
-    openBrowserFn?: (url: string) => void;
-}
-/**
- * Encodes Buffer/string to base64url (RFC 7636 - no padding, -_ instead of +/)
- */
-declare function base64urlEncode(input: Buffer | string): string;
-/**
- * Decodes base64url to Buffer
- */
-declare function base64urlDecode(input: string): Buffer;
-/**
- * Detects whether running inside WSL
- */
-export declare function isWSL(): boolean;
-/**
- * Detects an SSH session (no local display)
- */
-export declare function isSSH(): boolean;
-/**
- * Detects whether a graphical display is available
- */
-export declare function hasDisplay(): boolean;
-/**
- * Builds platform-specific User-Agent - Gemini CLI masquerade.
- * Format: GeminiCLI/<version>/<model> (<platform>; <arch>; GitHub) <google-api-client>
- */
-/**
- * Returns the required bypass headers object with all identification headers.
- */
-export declare function getGeminiHeaders(): Record<string, string>;
-/**
- * Generates a PKCE pair (verifier + challenge) per RFC 7636.
- * - verifier: 32 bytes random -> base64url = 43 chars (within 43-128)
- * - challenge: BASE64URL(SHA256(verifier))
- *
- * @returns {PKCEPair} verifier/challenge pair
- * @example
- * const { verifier, challenge } = generatePKCE();
- */
-export declare function generatePKCE(): PKCEPair;
-/**
- * Builds the OAuth 2.0 + PKCE authorization URL.
- *
- * @param pkce - Generated PKCE pair
- * @param redirectUri - Redirect URI (e.g. http://127.0.0.1:PORT/oauth-callback)
- * @param opts - Extra options (custom state, login_hint, etc.)
- * @returns Full URL to redirect the user to
- */
-export declare function buildAuthUrl(pkce: PKCEPair | null, redirectUri: string, opts?: {
-    state?: string;
-    loginHint?: string;
-    prompt?: "consent" | "select_account" | "none";
-    accessType?: "online" | "offline";
-    scopes?: string;
-    clientId?: string;
-}): string;
-/**
- * Tries to open the URL in the default browser - cross-platform.
- * Supports: darwin (open), win32 (start via cmd), linux (xdg-open), WSL (wslview/powershell)
- * v2.1.14 rename: openBrowser -> openBrowserAsync (the bare openBrowser name
- * keeps the former auth.ts void implementation, Section D).
- *
- * @param url - URL to open
- * @returns true if the command was spawned, false if it failed
- */
-export declare function openBrowserAsync(url: string): Promise<boolean>;
-/**
- * Creates a local HTTP server on 127.0.0.1:0 (random port) to receive the OAuth callback.
- *
- * Multi-path support (ported from oauth(2).ts): accepts the configured
- * callbackPath, plus /oauth/callback, plus "/" when the request carries code /
- * error query parameters. A bare "/" GET without OAuth params still serves the
- * healthcheck info text (conflict resolved in favor of both behaviors).
- *
- * Validates state if provided, extracts code and the granted `scope`.
- *
- * @param options - options: callbackPath, timeout, logger
- * @returns OAuthServerResult with server, callbackUrl, waitForCode, waitForCallback, close
- */
-export declare function createOAuthServer(options?: {
-    callbackPath?: string;
-    onLog?: AuthOptions["onLog"];
-    expectedState?: string;
-}): OAuthServerResult;
-/**
- * Async helper version that already waits for the server to be listening and returns full info
- */
-export declare function createOAuthServerAsync(opts?: {
-    callbackPath?: string;
-    onLog?: AuthOptions["onLog"];
-    expectedState?: string;
-}): Promise<OAuthServerResult & {
-    ready: true;
-}>;
-/**
- * Exchanges the authorization code for tokens (access_token + refresh_token).
- * POST https://oauth2.googleapis.com/token
- *
- * Robust error wrapping ported from oauth(2).ts: network failures are wrapped
- * with `cause`, non-JSON bodies are rejected with a status + body snippet, and
- * a missing access_token is an explicit error.
- *
- * @param code - Received authorization code
- * @param codeVerifier - Original PKCE verifier
- * @param redirectUri - Same redirect_uri used in buildAuthUrl
- * @param options - Optional injected credentials (defaults to GEMINI_OAUTH_CLIENT_ID / GEMINI_OAUTH_CLIENT_SECRET)
- * @returns TokenResponse with computed expires_at
- */
-export declare function exchangeCodeForTokens(code: string, codeVerifier: string | null, redirectUri: string, options?: {
-    clientId?: string;
-    clientSecret?: string;
-}): Promise<TokenResponse>;
-/**
- * Renews the access_token using a refresh_token.
- *
- * invalid_grant handling ported from oauth(2).ts: when Google answers with
- * error=invalid_grant an explicit "re-authentication necessary" error is
- * raised so callers can trigger a fresh login instead of retrying blindly.
- *
- * @param refreshToken - Valid refresh token
- * @param options - Optional injected credentials (defaults to GEMINI_OAUTH_CLIENT_ID / GEMINI_OAUTH_CLIENT_SECRET)
- * @returns New TokenResponse (may contain a rotated refresh_token; the previous
- *          one is preserved when Google omits it)
- */
-export declare function refreshAccessToken(refreshToken: string, options?: {
-    clientId?: string;
-    clientSecret?: string;
-}): Promise<TokenResponse>;
-/**
- * Helper ported from oauth(2).ts: refreshes tokens while preserving the old
- * refresh_token when Google omits a new one. Library-first pattern.
- *
- * @param oldTokens - Previously stored TokenResponse containing a refresh_token
- * @returns Refreshed TokenResponse guaranteed to carry a usable refresh_token
- */
-export declare function refreshAndPreserve(oldTokens: TokenResponse): Promise<TokenResponse>;
-/**
- * Checks whether a token is expired or about to expire (60s buffer)
- */
-export declare function isTokenExpired(token: TokenResponse, bufferMs?: number): boolean;
-/**
- * Retrieves information about the authenticated user.
- * GET https://www.googleapis.com/oauth2/v2/userinfo
- *
- * Robust error wrapping ported from oauth(2).ts: network failures wrapped with
- * `cause`; non-JSON bodies rejected with a status + body snippet.
- *
- * @param accessToken - Valid access token
- * @returns Normalized UserInfo
- */
-export declare function getUserInfo(accessToken: string): Promise<UserInfo>;
-/** v2.1.16 single-owner fix: delegation to core.js fetchWithTimeout (was a private re-implementation). */
-export declare const fetchTimeout: (url: string, init: RequestInit, ms?: number) => Promise<Response>;
-/** Minimal token-response shape of the Antigravity-client refresh flow (Section D lineage). */
-export type tokenres = {
-    access_token: string;
-    refresh_token?: string;
-    expires_in?: number;
-    id_token?: string;
-    created_at?: number;
-};
-export declare const refreshToken: (rt: string) => Promise<tokenres>;
-export declare const accountsPath: () => string;
-export type accountEntry = {
-    email: string;
-    refreshToken: string;
-    accessToken?: string;
-    expiry?: number;
-    createdAt?: number;
-    addedAt: number;
-    lastUsed?: number;
-    projectId?: string;
-    managedProjectId?: string;
-    disabled?: boolean;
-    quotaExhaustedUntil?: number;
-    softQuotaUntil?: number;
-    remaining?: number;
-    limit?: number;
-    rateLimitResetTimes?: Record<string, number>;
-};
-export type accountsFile = {
-    version: 3;
-    accounts: accountEntry[];
-    activeIndex: number;
-    activeIndexByFamily: {
-        claude: number;
-        gemini: number;
-        [k: string]: number;
-    };
-};
-export declare class accountManager {
-    private data;
-    private locks;
-    private idx;
-    private sticky;
-    load(): Promise<void>;
-    save(): Promise<void>;
-    list(): accountEntry[];
-    getFile(): accountsFile;
-    add(a: Omit<accountEntry, "addedAt" | "createdAt"> & {
-        addedAt?: number;
-        createdAt?: number;
-    }): Promise<void>;
-    remove(email: string): Promise<void>;
-    enable(email: string, en?: boolean): Promise<void>;
-    getNext(strategy?: "round-robin" | "sticky", softThreshold?: number): accountEntry | null;
-    setRateLimit(email: string, modelKey: string, resetMs: number): void;
-    markExhausted(email: string, ms?: number): void;
-    markSoftQuota(email: string, ms?: number): void;
-    refreshIfNeeded(email: string): Promise<string>;
-    importManager(): Promise<number>;
-}
-export declare const retrieveQuota: (at: string, pid?: "rising-fact-p41fc") => Promise<{
-    remaining: number;
-    limit: number;
-    used: number;
-} | null>;
-/**
- * @section Model Group Classification
- * Ported from auth(1).ts v4: classifies a model identifier into its routing group.
- * "gemini-cli" when the model contains "preview" or starts with a gemini-3.x
- * prefix (3, 3.1, 3.5, 3.6, 3.7); otherwise "antigravity".
- */
-export { mapModelToGroup } from "./models.js";
-/**
- * Full OAuth flow: PKCE + Server + Browser + Exchange + UserInfo.
- * Supports:
- * - WSL/SSH detection -> does not try to open a browser when there is no DISPLAY
- * - --no-browser flag via AuthOptions.noBrowser or env OPENCODE_NO_BROWSER=1 or args
- * - 30s timeout fallback to manual URL/code input
- *
- * @param opts - AuthOptions
- * @returns object with tokens and userinfo
- */
-export declare function authenticate(opts?: AuthOptions & {
-    existingPKCE?: PKCEPair;
-}): Promise<{
-    tokens: TokenResponse;
-    userInfo: UserInfo;
-    pkce: PKCEPair | null;
-    callbackUrl: string;
-}>;
-/**
- * Direct PKCE orchestrator ported from oauth(2).ts and adapted onto the local
- * server infrastructure above (single server implementation, multi-path
- * callback, scope capture, CSRF state validation).
- *
- * Steps:
- * 1. generatePKCE (verifier + S256 challenge)
- * 2. local server 127.0.0.1 on a locked random port
- * 3. auth URL with code_challenge and state
- * 4. browser opening via injectable openBrowserFn (manual fallback: URL logged)
- * 5. waits for callback with total timeout
- * 6. exchanges code for tokens at POST https://oauth2.googleapis.com/token
- * 7. fetches userinfo e-mail
- *
- * @param options - StartOAuthFlowOptions (all injectable for tests)
- * @returns OAuthResult with tokens + userInfo + validated state
- */
-export declare function startOAuthFlow(options?: StartOAuthFlowOptions): Promise<OAuthResult>;
-/**
- * Validates the TokenResponse shape (useful when loading from disk)
- */
-export declare function isValidTokenResponse(obj: any): obj is TokenResponse;
-/**
- * Extracts the code from a callback URL (public helper for manual paste)
- */
-export declare function extractCodeFromUrl(input: string): string | null;
-/**
- * Returns the list of available models (the folded 2026 tuple).
- * Helper for client-side validation before calling fetchAvailableModels.
- */
-export declare function getAllModels(): readonly string[];
-export declare function isAntigravityModel(model: string): boolean;
-/**
- * Default export for CJS/ESM interop. v2.1.14: preserved from the former
- * oauth.ts - every key keeps its legacy oauth.js VALUE (Gemini CLI client),
- * so `default ?? namespace` interop consumers (the cli.ts pattern) keep
- * observing the gemini credentials even though the bare named exports
- * CLIENT_ID / CLIENT_SECRET now carry the Antigravity CLI client. The
- * v2.1.14-renamed symbols are wired back under their legacy keys.
- */
-declare const oauth: {
-    CLIENT_ID: string;
-    CLIENT_SECRET: string;
-    CLIENT_SECRET_ALTERNATIVE: string;
-    GEMINI_OAUTH_CLIENT_ID: string;
-    GEMINI_OAUTH_CLIENT_SECRET: string;
-    SCOPES: readonly ["openid", "https://www.googleapis.com/auth/cloud-platform", "https://www.googleapis.com/auth/userinfo.email", "https://www.googleapis.com/auth/userinfo.profile", "https://www.googleapis.com/auth/cloudcode", "https://www.googleapis.com/auth/cloudaicompanion"];
-    GOOGLE_OAUTH_SCOPES: string;
-    OAUTH_AUTHORIZE_URL: "https://accounts.google.com/o/oauth2/v2/auth";
-    OAUTH_TOKEN_URL: "https://oauth2.googleapis.com/token";
-    USERINFO_URL: "https://www.googleapis.com/oauth2/v2/userinfo";
-    GOOGLE_AUTH_URL: "https://accounts.google.com/o/oauth2/v2/auth";
-    GOOGLE_TOKEN_URL: "https://oauth2.googleapis.com/token";
-    GOOGLE_USERINFO_URL: "https://www.googleapis.com/oauth2/v2/userinfo";
-    CLOUDCODE_BASE: "https://cloudcode-pa.googleapis.com";
-    CLOUDCODE_API_BASE: "https://cloudcode-pa.googleapis.com";
-    CLOUDCODE_ORIGIN: string;
-    ENDPOINTS: {
-        readonly base: "https://cloudcode-pa.googleapis.com";
-        readonly loadCodeAssist: "https://cloudcode-pa.googleapis.com/v1internal:loadCodeAssist";
-        readonly onboardUser: "https://cloudcode-pa.googleapis.com/v1internal:onboardUser";
-        readonly fetchAvailableModels: "https://cloudcode-pa.googleapis.com/v1internal:fetchAvailableModels";
-        readonly generateContent: "https://cloudcode-pa.googleapis.com/v1internal:generateContent";
-        readonly streamGenerateContent: "https://cloudcode-pa.googleapis.com/v1internal:streamGenerateContent";
-        readonly retrieveUserQuotaSummary: "https://cloudcode-pa.googleapis.com/v1internal:retrieveUserQuotaSummary";
-    };
-    PROJECT_FALLBACK: "rising-fact-p41fc";
-    MODELS_2026: readonly ["antigravity-gemini-3-pro", "antigravity-gemini-3.1-pro", "antigravity-gemini-3-flash", "antigravity-claude-sonnet-4-6", "antigravity-claude-opus-4-6-thinking", "gemini-2.5-flash", "gemini-2.5-pro", "gemini-3-flash-preview", "gemini-3-pro-preview", "gemini-3.1-pro-preview", "gemini-3.1-pro-preview-customtools", "claude-opus-4-6-thinking", "claude-sonnet-4-6"];
-    SUPPORTED_MODELS_2026: readonly ["antigravity-gemini-3-pro", "antigravity-gemini-3.1-pro", "antigravity-gemini-3-flash", "antigravity-claude-sonnet-4-6", "antigravity-claude-opus-4-6-thinking", "gemini-2.5-flash", "gemini-2.5-pro", "gemini-3-flash-preview", "gemini-3-pro-preview", "gemini-3.1-pro-preview", "gemini-3.1-pro-preview-customtools", "claude-opus-4-6-thinking", "claude-sonnet-4-6"];
-    GEMINI_UA_BASE: {
-        readonly cliVersion: "0.57.0";
-        readonly defaultModel: "gemini-3-pro-preview";
-        readonly googleApiClient: "google-api-nodejs-client/9.15.1";
-        readonly xGoogApiClient: "gl-node/22.19.0";
-        readonly clientMetadata: "ideType=IDE_UNSPECIFIED,platform=PLATFORM_UNSPECIFIED,pluginType=GEMINI";
-    };
-    ANTIGRAVITY_USER_AGENT: string;
-    generatePKCE: typeof generatePKCE;
-    buildAuthUrl: typeof buildAuthUrl;
-    createOAuthServer: typeof createOAuthServer;
-    createOAuthServerAsync: typeof createOAuthServerAsync;
-    openBrowser: typeof openBrowserAsync;
-    exchangeCodeForTokens: typeof exchangeCodeForTokens;
-    refreshAccessToken: typeof refreshAccessToken;
-    refreshAndPreserve: typeof refreshAndPreserve;
-    startOAuthFlow: typeof startOAuthFlow;
-    getUserInfo: typeof getUserInfo;
-    authenticate: typeof authenticate;
-    isTokenExpired: typeof isTokenExpired;
-    isValidTokenResponse: typeof isValidTokenResponse;
-    extractCodeFromUrl: typeof extractCodeFromUrl;
-    isWSL: typeof isWSL;
-    isSSH: typeof isSSH;
-    hasDisplay: typeof hasDisplay;
-    buildGeminiUserAgent: typeof buildGeminiUserAgent;
-    getGeminiHeaders: typeof getGeminiHeaders;
-    getAllModels: typeof getAllModels;
-    isAntigravityModel: typeof isAntigravityModel;
-    base64urlEncode: typeof base64urlEncode;
-    base64urlDecode: typeof base64urlDecode;
-};
-export default oauth;
-//# sourceMappingURL=oauth.d.ts.map