anypick 1.0.0 → 1.1.1

package/dist/providers/gemini-antigravity-oauth.js

@@ -1,343 +0,0 @@
-import { antigravityStateCredentialExists, assertAntigravityStateSafeToMutate, deleteAntigravityStateOAuthPayload, readAntigravityStateOAuthPayload, writeAntigravityStateOAuthPayload } from "./gemini-antigravity-state.js";
-import { readFile } from "node:fs/promises";
-import { execFile } from "node:child_process";
-import { promisify } from "node:util";
-//#region src/providers/gemini-antigravity-oauth.ts
-/**
-* Antigravity OAuth credential loading + parsing.
-*
-* Antigravity logins are not stored under ~/.gemini; the credential lives in
-* the OS credential store (via the Go library github.com/zalando/go-keyring,
-* service="gemini", account/username="antigravity"), or in a portable file
-* passed explicitly. This module is imported by both the proxy child process
-* (to serve requests) and the main process (to snapshot the credential when
-* adding an account). It has no project dependencies so it stays a leaf.
-*
-* Storage format differs by OS (confirmed from go-keyring source):
-*   macOS   — Keychain generic password, value = "go-keyring-base64:" + base64(JSON)
-*             (base64 only on darwin, to survive the `security` CLI).
-*   Linux   — Secret Service (D-Bus), attributes {service, username}, raw JSON value.
-*   Windows — Credential Manager, target "gemini:antigravity", raw JSON blob.
-* The JSON payload is {token:{access_token,refresh_token,token_type,expiry}}.
-*/
-var execFileAsync = promisify(execFile);
-var KEYRING_SERVICE = "gemini";
-var KEYRING_ACCOUNT = "antigravity";
-var ANTIGRAVITY_OAUTH_CLIENT_ID = "1071006060591-tmhssin2h21lcre235vtolojh4g403ep.apps.googleusercontent.com";
-var ANTIGRAVITY_OAUTH_CLIENT_SECRET = "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";
-/** True on platforms where we know how to read the credential store. */
-function antigravityKeychainSupported() {
-	return process.platform === "darwin" || process.platform === "linux" || process.platform === "win32";
-}
-async function readFromKeychain() {
-	if (process.platform === "darwin") try {
-		const { stdout } = await execFileAsync("/usr/bin/security", [
-			"find-generic-password",
-			"-s",
-			KEYRING_SERVICE,
-			"-a",
-			KEYRING_ACCOUNT,
-			"-w"
-		], {
-			encoding: "utf8",
-			maxBuffer: 1024 * 1024
-		});
-		return stdout;
-	} catch {
-		throw new Error("Cannot read Antigravity OAuth from macOS Keychain (service=gemini, account=antigravity).");
-	}
-	if (process.platform === "linux") try {
-		const { stdout } = await execFileAsync("secret-tool", [
-			"lookup",
-			"service",
-			KEYRING_SERVICE,
-			"username",
-			KEYRING_ACCOUNT
-		], {
-			encoding: "utf8",
-			maxBuffer: 1024 * 1024
-		});
-		if (!stdout.trim()) throw new Error("empty");
-		return stdout;
-	} catch {
-		throw new Error("Cannot read Antigravity OAuth from the Secret Service (service=gemini, username=antigravity). Is secret-tool (libsecret-tools) installed and the login keyring unlocked?");
-	}
-	if (process.platform === "win32") {
-		const script = [
-			"$ErrorActionPreference='Stop';",
-			"$sig=@\"",
-			"[DllImport(\"advapi32.dll\",SetLastError=true,CharSet=CharSet.Unicode)]",
-			"public static extern bool CredRead(string target,int type,int flags,out IntPtr cred);",
-			"[DllImport(\"advapi32.dll\")] public static extern void CredFree(IntPtr cred);",
-			"\"@;",
-			"$t=Add-Type -MemberDefinition $sig -Name Cred -Namespace W -PassThru;",
-			"$p=[IntPtr]::Zero;",
-			`if(-not $t::CredRead('${`${KEYRING_SERVICE}:${KEYRING_ACCOUNT}`}',1,0,[ref]$p)){exit 1};`,
-			"$blobSize=[Runtime.InteropServices.Marshal]::ReadInt32($p,16);",
-			"$blobPtr=[Runtime.InteropServices.Marshal]::ReadIntPtr($p,24);",
-			"$bytes=New-Object byte[] $blobSize;",
-			"[Runtime.InteropServices.Marshal]::Copy($blobPtr,$bytes,0,$blobSize);",
-			"$t::CredFree($p);",
-			"[Console]::Out.Write([Text.Encoding]::Unicode.GetString($bytes));"
-		].join("");
-		try {
-			const { stdout } = await execFileAsync("powershell", [
-				"-NoProfile",
-				"-NonInteractive",
-				"-Command",
-				script
-			], {
-				encoding: "utf8",
-				maxBuffer: 1024 * 1024
-			});
-			if (!stdout.trim()) throw new Error("empty");
-			return stdout;
-		} catch {
-			throw new Error("Cannot read Antigravity OAuth from Windows Credential Manager (target=gemini:antigravity).");
-		}
-	}
-	throw new Error(`Antigravity OAuth auto-discovery is not supported on ${process.platform}; pass a credential file instead.`);
-}
-async function loadAntigravityOAuthCredentials(credentialFile) {
-	if (credentialFile) return parseAntigravityOAuthCredential(await readFile(credentialFile, "utf8"));
-	const payload = await readAntigravityOAuthPayload(credentialFile);
-	return payload ? fromKeyringPayload(payload) : null;
-}
-/**
-* The credential store's own payload, undiminished.
-*
-* `loadAntigravityOAuthCredentials` reduces the token to what the proxy needs;
-* a snapshot that has to be written back must keep the whole thing, or the
-* account restored later is not the account that was saved.
-*/
-async function readAntigravityOAuthPayload(credentialFile) {
-	if (!credentialFile) try {
-		const state = await readAntigravityStateOAuthPayload();
-		if (state) return state;
-	} catch {}
-	const parsed = decodeStoreValue(credentialFile ? await readFile(credentialFile, "utf8") : await readFromKeychain());
-	if (!parsed || typeof parsed !== "object") return null;
-	if ("token" in parsed) {
-		const payload = parsed;
-		return payload.token?.refresh_token ? payload : null;
-	}
-	const flat = parsed;
-	return flat.refresh_token ? { token: {
-		refresh_token: flat.refresh_token,
-		token_type: flat.token_type ?? "Bearer"
-	} } : null;
-}
-/**
-* Materializes an access token before writing back to the OS credential store.
-* Antigravity's desktop client does not refresh a token-less or expired keychain
-* entry during setup, so we do it here. An access token without an expiry must
-* also be refreshed: Antigravity's unified state treats a missing expiry as
-* epoch zero and refuses to use it.
-*/
-async function hydrateAntigravityOAuthPayload(payload, fetchImpl = fetch) {
-	if (payload.token?.access_token) {
-		const expiry = payload.token.expiry;
-		if (expiry ? new Date(expiry).getTime() > Date.now() + 6e4 : false) return payload;
-	}
-	if (!payload.token?.refresh_token) throw new Error("Cannot refresh an Antigravity credential with no refresh token.");
-	const response = await fetchImpl("https://oauth2.googleapis.com/token", {
-		method: "POST",
-		headers: { "content-type": "application/x-www-form-urlencoded" },
-		body: new URLSearchParams({
-			client_id: ANTIGRAVITY_OAUTH_CLIENT_ID,
-			client_secret: ANTIGRAVITY_OAUTH_CLIENT_SECRET,
-			refresh_token: payload.token.refresh_token,
-			grant_type: "refresh_token"
-		}),
-		signal: AbortSignal.timeout(3e4)
-	});
-	if (!response.ok) throw new Error(`Antigravity OAuth refresh failed (${response.status}).`);
-	const result = await response.json();
-	if (!result || typeof result !== "object" || typeof result.access_token !== "string") throw new Error("Antigravity OAuth refresh returned no access token.");
-	const expiresIn = result.expires_in;
-	const expiry = typeof expiresIn === "number" && Number.isFinite(expiresIn) ? new Date(Date.now() + expiresIn * 1e3).toISOString() : payload.token.expiry;
-	return {
-		...payload,
-		token: {
-			...payload.token,
-			access_token: result.access_token,
-			...expiry ? { expiry } : {}
-		}
-	};
-}
-/**
-* Put a snapshotted Antigravity credential back into the OS credential store,
-* so Antigravity itself follows an account switch rather than only AnyPick's
-* proxy — the whole point of switching.
-*
-* Writes with an update flag wherever the platform offers one: updating in
-* place keeps the existing item's access control, so Antigravity reads it back
-* without a new authorization prompt. Creating the item from nothing cannot
-* inherit an ACL that was never granted, and the first read will prompt.
-*/
-async function saveAntigravityOAuthCredential(payload) {
-	if (!payload.token?.refresh_token) throw new Error("Refusing to write an Antigravity credential with no refresh token.");
-	const statePaths = await assertAntigravityStateSafeToMutate({ expectedPayload: payload });
-	const json = JSON.stringify(payload);
-	if (process.platform === "darwin") {
-		const value = `go-keyring-base64:${Buffer.from(json, "utf8").toString("base64")}`;
-		await runWithStdin("/usr/bin/security", ["-i"], `add-generic-password -U -s "${KEYRING_SERVICE}" -a "${KEYRING_ACCOUNT}" -X ${Buffer.from(value, "utf8").toString("hex")}\n`);
-	} else if (process.platform === "linux") await runWithStdin("secret-tool", [
-		"store",
-		"--label=gemini",
-		"service",
-		KEYRING_SERVICE,
-		"username",
-		KEYRING_ACCOUNT
-	], json);
-	else if (process.platform === "win32") await runWithStdin("powershell", [
-		"-NoProfile",
-		"-NonInteractive",
-		"-Command",
-		[
-			"$ErrorActionPreference='Stop';",
-			"$sig=@\"",
-			"[DllImport(\"advapi32.dll\",SetLastError=true,CharSet=CharSet.Unicode)]",
-			"public static extern bool CredWrite(ref CRED cred,int flags);",
-			"[StructLayout(LayoutKind.Sequential,CharSet=CharSet.Unicode)] public struct CRED {",
-			"public int Flags; public int Type; public string TargetName; public string Comment;",
-			"public long LastWritten; public int CredentialBlobSize; public IntPtr CredentialBlob;",
-			"public int Persist; public int AttributeCount; public IntPtr Attributes;",
-			"public string TargetAlias; public string UserName; }",
-			"\"@;",
-			"$t=Add-Type -MemberDefinition $sig -Name CredW -Namespace W -PassThru;",
-			"$json=[Console]::In.ReadToEnd();",
-			"$bytes=[Text.Encoding]::Unicode.GetBytes($json);",
-			"$p=[Runtime.InteropServices.Marshal]::AllocHGlobal($bytes.Length);",
-			"[Runtime.InteropServices.Marshal]::Copy($bytes,0,$p,$bytes.Length);",
-			"$c=New-Object W.CredW+CRED;",
-			"$c.Type=1; $c.Persist=2;",
-			`$c.TargetName='${`${KEYRING_SERVICE}:${KEYRING_ACCOUNT}`}'; $c.UserName='${KEYRING_ACCOUNT}';`,
-			"$c.CredentialBlobSize=$bytes.Length; $c.CredentialBlob=$p;",
-			"if(-not $t::CredWrite([ref]$c,0)){[Runtime.InteropServices.Marshal]::FreeHGlobal($p);exit 1};",
-			"[Runtime.InteropServices.Marshal]::FreeHGlobal($p);"
-		].join("")
-	], json);
-	else throw new Error(`Writing the Antigravity OAuth credential is not supported on ${process.platform}.`);
-	await writeAntigravityStateOAuthPayload(payload, { paths: statePaths });
-}
-/** Feed a secret to a helper over stdin rather than argv. */
-function runWithStdin(command, args, input) {
-	return new Promise((resolve, reject) => {
-		execFile(command, args, { timeout: 1e4 }, (err) => {
-			if (err) {
-				reject(/* @__PURE__ */ new Error(`${command} failed while writing the Antigravity credential.`));
-				return;
-			}
-			resolve();
-		}).stdin?.end(input);
-	});
-}
-/**
-* Is there an Antigravity credential in the OS credential store?
-*
-* This asks only whether the entry exists and never reads its value, which is
-* what keeps it cheap enough for `detectLive()`: on macOS the Keychain access
-* prompt is raised by reading the secret (`security ... -w`), not by listing an
-* item's attributes. Use `loadAntigravityOAuthCredentials` when you need the
-* credential itself and the prompt is acceptable.
-*/
-async function antigravityCredentialExists() {
-	if (await antigravityStateCredentialExists()) return true;
-	try {
-		if (process.platform === "darwin") {
-			await execFileAsync("/usr/bin/security", [
-				"find-generic-password",
-				"-s",
-				KEYRING_SERVICE,
-				"-a",
-				KEYRING_ACCOUNT
-			]);
-			return true;
-		}
-		if (process.platform === "linux") {
-			const { stdout } = await execFileAsync("secret-tool", [
-				"search",
-				"service",
-				KEYRING_SERVICE,
-				"username",
-				KEYRING_ACCOUNT
-			]);
-			return stdout.trim().length > 0;
-		}
-		if (process.platform === "win32") {
-			const { stdout } = await execFileAsync("cmdkey", [`/list:${KEYRING_SERVICE}:${KEYRING_ACCOUNT}`]);
-			return /target:/i.test(stdout);
-		}
-	} catch {
-		return false;
-	}
-	return false;
-}
-/**
-* Remove the Antigravity credential from the OS credential store so Antigravity
-* prompts for a fresh sign-in. Local only — the OAuth grant stays valid upstream.
-*
-* Returns false when there was nothing to delete or the platform is unsupported;
-* a missing entry is the desired end state either way.
-*/
-async function deleteAntigravityOAuthCredential() {
-	const statePaths = await assertAntigravityStateSafeToMutate({ expectedPayload: null });
-	let deleted = false;
-	if (process.platform === "darwin") try {
-		await execFileAsync("/usr/bin/security", [
-			"delete-generic-password",
-			"-s",
-			KEYRING_SERVICE,
-			"-a",
-			KEYRING_ACCOUNT
-		]);
-		deleted = true;
-	} catch {}
-	else if (process.platform === "linux") try {
-		await execFileAsync("secret-tool", [
-			"clear",
-			"service",
-			KEYRING_SERVICE,
-			"username",
-			KEYRING_ACCOUNT
-		]);
-		deleted = true;
-	} catch {}
-	else if (process.platform === "win32") try {
-		await execFileAsync("cmdkey", [`/delete:${KEYRING_SERVICE}:${KEYRING_ACCOUNT}`]);
-		deleted = true;
-	} catch {}
-	const stateChanges = await deleteAntigravityStateOAuthPayload({ paths: statePaths });
-	return deleted || stateChanges > 0;
-}
-/** Normalize a nested {token:{...}} payload down to a flat credential. */
-function fromKeyringPayload(payload) {
-	const token = payload.token;
-	if (!token?.refresh_token) return null;
-	return {
-		refresh_token: token.refresh_token,
-		token_type: token.token_type ?? "Bearer"
-	};
-}
-/** Unwrap the platform's envelope and parse. macOS base64s; the rest are raw. */
-function decodeStoreValue(raw) {
-	let value = raw.trim();
-	if (value.startsWith("go-keyring-base64:")) value = Buffer.from(value.slice(18), "base64").toString("utf8");
-	try {
-		return JSON.parse(value);
-	} catch {
-		throw new Error("Antigravity OAuth credential has an unsupported format.");
-	}
-}
-function parseAntigravityOAuthCredential(raw) {
-	const parsed = decodeStoreValue(raw);
-	if (!parsed || typeof parsed !== "object") return null;
-	if ("token" in parsed) return fromKeyringPayload(parsed);
-	const flat = parsed;
-	return flat.refresh_token || flat.access_token ? flat : null;
-}
-//#endregion
-export { antigravityCredentialExists, antigravityKeychainSupported, deleteAntigravityOAuthCredential, hydrateAntigravityOAuthPayload, loadAntigravityOAuthCredentials, parseAntigravityOAuthCredential, readAntigravityOAuthPayload, saveAntigravityOAuthCredential };
-
-//# sourceMappingURL=gemini-antigravity-oauth.js.map

package/dist/providers/gemini-antigravity-oauth.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"gemini-antigravity-oauth.js","names":[],"sources":["../../src/providers/gemini-antigravity-oauth.ts"],"sourcesContent":["/**\n * Antigravity OAuth credential loading + parsing.\n *\n * Antigravity logins are not stored under ~/.gemini; the credential lives in\n * the OS credential store (via the Go library github.com/zalando/go-keyring,\n * service=\"gemini\", account/username=\"antigravity\"), or in a portable file\n * passed explicitly. This module is imported by both the proxy child process\n * (to serve requests) and the main process (to snapshot the credential when\n * adding an account). It has no project dependencies so it stays a leaf.\n *\n * Storage format differs by OS (confirmed from go-keyring source):\n *   macOS   — Keychain generic password, value = \"go-keyring-base64:\" + base64(JSON)\n *             (base64 only on darwin, to survive the `security` CLI).\n *   Linux   — Secret Service (D-Bus), attributes {service, username}, raw JSON value.\n *   Windows — Credential Manager, target \"gemini:antigravity\", raw JSON blob.\n * The JSON payload is {token:{access_token,refresh_token,token_type,expiry}}.\n */\n\nimport { execFile } from 'node:child_process';\nimport { readFile } from 'node:fs/promises';\nimport { promisify } from 'node:util';\nimport {\n  antigravityStateCredentialExists,\n  assertAntigravityStateSafeToMutate,\n  deleteAntigravityStateOAuthPayload,\n  readAntigravityStateOAuthPayload,\n  writeAntigravityStateOAuthPayload,\n} from './gemini-antigravity-state';\n\nconst execFileAsync = promisify(execFile);\n\nconst KEYRING_SERVICE = 'gemini';\nconst KEYRING_ACCOUNT = 'antigravity';\nconst ANTIGRAVITY_OAUTH_CLIENT_ID =\n  '1071006060591-tmhssin2h21lcre235vtolojh4g403ep.apps.googleusercontent.com';\nconst ANTIGRAVITY_OAUTH_CLIENT_SECRET = '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';\n\nexport interface GeminiOAuthCredentials {\n  access_token?: string;\n  refresh_token?: string;\n  expiry_date?: number;\n  token_type?: string;\n}\n\nexport interface AntigravityKeyringPayload {\n  token?: {\n    access_token?: string;\n    refresh_token?: string;\n    token_type?: string;\n    expiry?: string;\n  };\n}\n\ntype FetchLike = (input: string, init?: RequestInit) => Promise<Response>;\n\n/** True on platforms where we know how to read the credential store. */\nexport function antigravityKeychainSupported(): boolean {\n  return (\n    process.platform === 'darwin' || process.platform === 'linux' || process.platform === 'win32'\n  );\n}\n\nasync function readFromKeychain(): Promise<string> {\n  if (process.platform === 'darwin') {\n    try {\n      const { stdout } = await execFileAsync(\n        '/usr/bin/security',\n        ['find-generic-password', '-s', KEYRING_SERVICE, '-a', KEYRING_ACCOUNT, '-w'],\n        { encoding: 'utf8', maxBuffer: 1024 * 1024 },\n      );\n      return stdout;\n    } catch {\n      throw new Error(\n        'Cannot read Antigravity OAuth from macOS Keychain (service=gemini, account=antigravity).',\n      );\n    }\n  }\n\n  if (process.platform === 'linux') {\n    // libsecret's secret-tool; go-keyring writes attributes {service, username}.\n    try {\n      const { stdout } = await execFileAsync(\n        'secret-tool',\n        ['lookup', 'service', KEYRING_SERVICE, 'username', KEYRING_ACCOUNT],\n        { encoding: 'utf8', maxBuffer: 1024 * 1024 },\n      );\n      if (!stdout.trim()) {\n        throw new Error('empty');\n      }\n      return stdout;\n    } catch {\n      throw new Error(\n        'Cannot read Antigravity OAuth from the Secret Service (service=gemini, username=antigravity). Is secret-tool (libsecret-tools) installed and the login keyring unlocked?',\n      );\n    }\n  }\n\n  if (process.platform === 'win32') {\n    // Windows Credential Manager; go-keyring target is \"service:username\".\n    // CredRead via P/Invoke — cmdkey cannot print the blob. The blob is stored\n    // as UTF-16LE bytes; decode back to a string.\n    const target = `${KEYRING_SERVICE}:${KEYRING_ACCOUNT}`;\n    const script = [\n      \"$ErrorActionPreference='Stop';\",\n      '$sig=@\"',\n      '[DllImport(\"advapi32.dll\",SetLastError=true,CharSet=CharSet.Unicode)]',\n      'public static extern bool CredRead(string target,int type,int flags,out IntPtr cred);',\n      '[DllImport(\"advapi32.dll\")] public static extern void CredFree(IntPtr cred);',\n      '\"@;',\n      '$t=Add-Type -MemberDefinition $sig -Name Cred -Namespace W -PassThru;',\n      '$p=[IntPtr]::Zero;',\n      `if(-not $t::CredRead('${target}',1,0,[ref]$p)){exit 1};`,\n      '$blobSize=[Runtime.InteropServices.Marshal]::ReadInt32($p,16);',\n      '$blobPtr=[Runtime.InteropServices.Marshal]::ReadIntPtr($p,24);',\n      '$bytes=New-Object byte[] $blobSize;',\n      '[Runtime.InteropServices.Marshal]::Copy($blobPtr,$bytes,0,$blobSize);',\n      '$t::CredFree($p);',\n      '[Console]::Out.Write([Text.Encoding]::Unicode.GetString($bytes));',\n    ].join('');\n    try {\n      const { stdout } = await execFileAsync(\n        'powershell',\n        ['-NoProfile', '-NonInteractive', '-Command', script],\n        { encoding: 'utf8', maxBuffer: 1024 * 1024 },\n      );\n      if (!stdout.trim()) {\n        throw new Error('empty');\n      }\n      return stdout;\n    } catch {\n      throw new Error(\n        'Cannot read Antigravity OAuth from Windows Credential Manager (target=gemini:antigravity).',\n      );\n    }\n  }\n\n  throw new Error(\n    `Antigravity OAuth auto-discovery is not supported on ${process.platform}; pass a credential file instead.`,\n  );\n}\n\nexport async function loadAntigravityOAuthCredentials(\n  credentialFile?: string,\n): Promise<GeminiOAuthCredentials | null> {\n  if (credentialFile) {\n    // Portable proxy credentials may deliberately contain only a still-valid\n    // access token. Restore snapshots are stricter because they must carry a\n    // durable refresh token, but the proxy loader remains backward-compatible\n    // with this flat access-token-only shape.\n    return parseAntigravityOAuthCredential(await readFile(credentialFile, 'utf8'));\n  }\n  const payload = await readAntigravityOAuthPayload(credentialFile);\n  return payload ? fromKeyringPayload(payload) : null;\n}\n\n/**\n * The credential store's own payload, undiminished.\n *\n * `loadAntigravityOAuthCredentials` reduces the token to what the proxy needs;\n * a snapshot that has to be written back must keep the whole thing, or the\n * account restored later is not the account that was saved.\n */\nexport async function readAntigravityOAuthPayload(\n  credentialFile?: string,\n): Promise<AntigravityKeyringPayload | null> {\n  if (!credentialFile) {\n    // The unified state is what a running/current Antigravity IDE actually\n    // uses. Prefer it over the keyring mirror, which can lag behind or vanish\n    // while the IDE still has a valid durable login.\n    try {\n      const state = await readAntigravityStateOAuthPayload();\n      if (state) {\n        return state;\n      }\n    } catch {\n      // A different Antigravity generation may have an unfamiliar state\n      // envelope. Fall back to the long-standing go-keyring representation.\n    }\n  }\n  const raw = credentialFile ? await readFile(credentialFile, 'utf8') : await readFromKeychain();\n  const parsed = decodeStoreValue(raw);\n  if (!parsed || typeof parsed !== 'object') {\n    return null;\n  }\n  if ('token' in parsed) {\n    const payload = parsed as AntigravityKeyringPayload;\n    return payload.token?.refresh_token ? payload : null;\n  }\n  // A snapshot written before this shape existed, or a portable file the user\n  // assembled by hand: wrap it so write-back has one code path.\n  const flat = parsed as GeminiOAuthCredentials;\n  return flat.refresh_token\n    ? { token: { refresh_token: flat.refresh_token, token_type: flat.token_type ?? 'Bearer' } }\n    : null;\n}\n\n/**\n * Materializes an access token before writing back to the OS credential store.\n * Antigravity's desktop client does not refresh a token-less or expired keychain\n * entry during setup, so we do it here. An access token without an expiry must\n * also be refreshed: Antigravity's unified state treats a missing expiry as\n * epoch zero and refuses to use it.\n */\nexport async function hydrateAntigravityOAuthPayload(\n  payload: AntigravityKeyringPayload,\n  fetchImpl: FetchLike = fetch,\n): Promise<AntigravityKeyringPayload> {\n  if (payload.token?.access_token) {\n    const expiry = payload.token.expiry;\n    // 60-second margin so the token won't expire mid-request.\n    const stillValid = expiry ? new Date(expiry).getTime() > Date.now() + 60_000 : false;\n    if (stillValid) {\n      return payload;\n    }\n  }\n  if (!payload.token?.refresh_token) {\n    throw new Error('Cannot refresh an Antigravity credential with no refresh token.');\n  }\n\n  const response = await fetchImpl('https://oauth2.googleapis.com/token', {\n    method: 'POST',\n    headers: { 'content-type': 'application/x-www-form-urlencoded' },\n    body: new URLSearchParams({\n      client_id: ANTIGRAVITY_OAUTH_CLIENT_ID,\n      client_secret: ANTIGRAVITY_OAUTH_CLIENT_SECRET,\n      refresh_token: payload.token.refresh_token,\n      grant_type: 'refresh_token',\n    }),\n    signal: AbortSignal.timeout(30_000),\n  });\n  if (!response.ok) {\n    throw new Error(`Antigravity OAuth refresh failed (${response.status}).`);\n  }\n\n  const result: unknown = await response.json();\n  if (\n    !result ||\n    typeof result !== 'object' ||\n    typeof (result as Record<string, unknown>).access_token !== 'string'\n  ) {\n    throw new Error('Antigravity OAuth refresh returned no access token.');\n  }\n  const expiresIn = (result as Record<string, unknown>).expires_in;\n  const expiry =\n    typeof expiresIn === 'number' && Number.isFinite(expiresIn)\n      ? new Date(Date.now() + expiresIn * 1_000).toISOString()\n      : payload.token.expiry;\n  return {\n    ...payload,\n    token: {\n      ...payload.token,\n      access_token: (result as Record<string, unknown>).access_token as string,\n      ...(expiry ? { expiry } : {}),\n    },\n  };\n}\n\n/**\n * Put a snapshotted Antigravity credential back into the OS credential store,\n * so Antigravity itself follows an account switch rather than only AnyPick's\n * proxy — the whole point of switching.\n *\n * Writes with an update flag wherever the platform offers one: updating in\n * place keeps the existing item's access control, so Antigravity reads it back\n * without a new authorization prompt. Creating the item from nothing cannot\n * inherit an ACL that was never granted, and the first read will prompt.\n */\nexport async function saveAntigravityOAuthCredential(\n  payload: AntigravityKeyringPayload,\n): Promise<void> {\n  if (!payload.token?.refresh_token) {\n    throw new Error('Refusing to write an Antigravity credential with no refresh token.');\n  }\n  const statePaths = await assertAntigravityStateSafeToMutate({ expectedPayload: payload });\n  const json = JSON.stringify(payload);\n\n  if (process.platform === 'darwin') {\n    // Batch mode with a hex-encoded value, so the token is never an argv entry\n    // visible to `ps`. Same call shape as the read above, hence the same item.\n    const value = `go-keyring-base64:${Buffer.from(json, 'utf8').toString('base64')}`;\n    const hex = Buffer.from(value, 'utf8').toString('hex');\n    await runWithStdin(\n      '/usr/bin/security',\n      ['-i'],\n      `add-generic-password -U -s \"${KEYRING_SERVICE}\" -a \"${KEYRING_ACCOUNT}\" -X ${hex}\\n`,\n    );\n  } else if (process.platform === 'linux') {\n    await runWithStdin(\n      'secret-tool',\n      ['store', '--label=gemini', 'service', KEYRING_SERVICE, 'username', KEYRING_ACCOUNT],\n      json,\n    );\n  } else if (process.platform === 'win32') {\n    const target = `${KEYRING_SERVICE}:${KEYRING_ACCOUNT}`;\n    const script = [\n      \"$ErrorActionPreference='Stop';\",\n      '$sig=@\"',\n      '[DllImport(\"advapi32.dll\",SetLastError=true,CharSet=CharSet.Unicode)]',\n      'public static extern bool CredWrite(ref CRED cred,int flags);',\n      '[StructLayout(LayoutKind.Sequential,CharSet=CharSet.Unicode)] public struct CRED {',\n      'public int Flags; public int Type; public string TargetName; public string Comment;',\n      'public long LastWritten; public int CredentialBlobSize; public IntPtr CredentialBlob;',\n      'public int Persist; public int AttributeCount; public IntPtr Attributes;',\n      'public string TargetAlias; public string UserName; }',\n      '\"@;',\n      '$t=Add-Type -MemberDefinition $sig -Name CredW -Namespace W -PassThru;',\n      // The blob is read from stdin so the token stays out of the command line.\n      '$json=[Console]::In.ReadToEnd();',\n      '$bytes=[Text.Encoding]::Unicode.GetBytes($json);',\n      '$p=[Runtime.InteropServices.Marshal]::AllocHGlobal($bytes.Length);',\n      '[Runtime.InteropServices.Marshal]::Copy($bytes,0,$p,$bytes.Length);',\n      '$c=New-Object W.CredW+CRED;',\n      '$c.Type=1; $c.Persist=2;',\n      `$c.TargetName='${target}'; $c.UserName='${KEYRING_ACCOUNT}';`,\n      '$c.CredentialBlobSize=$bytes.Length; $c.CredentialBlob=$p;',\n      'if(-not $t::CredWrite([ref]$c,0)){[Runtime.InteropServices.Marshal]::FreeHGlobal($p);exit 1};',\n      '[Runtime.InteropServices.Marshal]::FreeHGlobal($p);',\n    ].join('');\n    await runWithStdin('powershell', ['-NoProfile', '-NonInteractive', '-Command', script], json);\n  } else {\n    throw new Error(\n      `Writing the Antigravity OAuth credential is not supported on ${process.platform}.`,\n    );\n  }\n\n  // Keyring first, then the authoritative IDE state. The preflight above\n  // validates every state envelope and refuses a running owner before either\n  // store changes.\n  await writeAntigravityStateOAuthPayload(payload, { paths: statePaths });\n}\n\n/** Feed a secret to a helper over stdin rather than argv. */\nfunction runWithStdin(command: string, args: string[], input: string): Promise<void> {\n  return new Promise((resolve, reject) => {\n    const child = execFile(command, args, { timeout: 10_000 }, (err) => {\n      if (err) {\n        reject(new Error(`${command} failed while writing the Antigravity credential.`));\n        return;\n      }\n      resolve();\n    });\n    child.stdin?.end(input);\n  });\n}\n\n/**\n * Is there an Antigravity credential in the OS credential store?\n *\n * This asks only whether the entry exists and never reads its value, which is\n * what keeps it cheap enough for `detectLive()`: on macOS the Keychain access\n * prompt is raised by reading the secret (`security ... -w`), not by listing an\n * item's attributes. Use `loadAntigravityOAuthCredentials` when you need the\n * credential itself and the prompt is acceptable.\n */\nexport async function antigravityCredentialExists(): Promise<boolean> {\n  if (await antigravityStateCredentialExists()) {\n    return true;\n  }\n  try {\n    if (process.platform === 'darwin') {\n      await execFileAsync('/usr/bin/security', [\n        'find-generic-password',\n        '-s',\n        KEYRING_SERVICE,\n        '-a',\n        KEYRING_ACCOUNT,\n      ]);\n      return true;\n    }\n    if (process.platform === 'linux') {\n      const { stdout } = await execFileAsync('secret-tool', [\n        'search',\n        'service',\n        KEYRING_SERVICE,\n        'username',\n        KEYRING_ACCOUNT,\n      ]);\n      return stdout.trim().length > 0;\n    }\n    if (process.platform === 'win32') {\n      const { stdout } = await execFileAsync('cmdkey', [\n        `/list:${KEYRING_SERVICE}:${KEYRING_ACCOUNT}`,\n      ]);\n      return /target:/i.test(stdout);\n    }\n  } catch {\n    return false;\n  }\n  return false;\n}\n\n/**\n * Remove the Antigravity credential from the OS credential store so Antigravity\n * prompts for a fresh sign-in. Local only — the OAuth grant stays valid upstream.\n *\n * Returns false when there was nothing to delete or the platform is unsupported;\n * a missing entry is the desired end state either way.\n */\nexport async function deleteAntigravityOAuthCredential(): Promise<boolean> {\n  const statePaths = await assertAntigravityStateSafeToMutate({ expectedPayload: null });\n  let deleted = false;\n  if (process.platform === 'darwin') {\n    try {\n      await execFileAsync('/usr/bin/security', [\n        'delete-generic-password',\n        '-s',\n        KEYRING_SERVICE,\n        '-a',\n        KEYRING_ACCOUNT,\n      ]);\n      deleted = true;\n    } catch {\n      // A missing mirror is fine; the unified state below remains authoritative.\n    }\n  } else if (process.platform === 'linux') {\n    try {\n      await execFileAsync('secret-tool', [\n        'clear',\n        'service',\n        KEYRING_SERVICE,\n        'username',\n        KEYRING_ACCOUNT,\n      ]);\n      deleted = true;\n    } catch {\n      // A missing mirror is fine.\n    }\n  } else if (process.platform === 'win32') {\n    try {\n      await execFileAsync('cmdkey', [`/delete:${KEYRING_SERVICE}:${KEYRING_ACCOUNT}`]);\n      deleted = true;\n    } catch {\n      // A missing mirror is fine.\n    }\n  }\n  const stateChanges = await deleteAntigravityStateOAuthPayload({ paths: statePaths });\n  return deleted || stateChanges > 0;\n}\n\n/** Normalize a nested {token:{...}} payload down to a flat credential. */\nfunction fromKeyringPayload(payload: AntigravityKeyringPayload): GeminiOAuthCredentials | null {\n  const token = payload.token;\n  if (!token?.refresh_token) {\n    return null;\n  }\n  // Deliberately drop access_token: Antigravity may fail to persist its most\n  // recently refreshed access token, so the proxy always refreshes from the\n  // durable refresh_token at start rather than trusting a possibly-stale one.\n  return {\n    refresh_token: token.refresh_token,\n    token_type: token.token_type ?? 'Bearer',\n  };\n}\n\n/** Unwrap the platform's envelope and parse. macOS base64s; the rest are raw. */\nfunction decodeStoreValue(raw: string): unknown {\n  let value = raw.trim();\n  if (value.startsWith('go-keyring-base64:')) {\n    value = Buffer.from(value.slice('go-keyring-base64:'.length), 'base64').toString('utf8');\n  }\n  try {\n    return JSON.parse(value);\n  } catch {\n    throw new Error('Antigravity OAuth credential has an unsupported format.');\n  }\n}\n\nexport function parseAntigravityOAuthCredential(raw: string): GeminiOAuthCredentials | null {\n  const parsed = decodeStoreValue(raw);\n  if (!parsed || typeof parsed !== 'object') {\n    return null;\n  }\n  // Nested go-keyring payload shape.\n  if ('token' in parsed) {\n    return fromKeyringPayload(parsed as AntigravityKeyringPayload);\n  }\n  // Flat credential shape (e.g. a portable file already normalized).\n  const flat = parsed as GeminiOAuthCredentials;\n  return flat.refresh_token || flat.access_token ? flat : null;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AA6BA,IAAM,gBAAgB,UAAU,QAAQ;AAExC,IAAM,kBAAkB;AACxB,IAAM,kBAAkB;AACxB,IAAM,8BACJ;AACF,IAAM,kCAAkC;;AAqBxC,SAAgB,+BAAwC;CACtD,OACE,QAAQ,aAAa,YAAY,QAAQ,aAAa,WAAW,QAAQ,aAAa;AAE1F;AAEA,eAAe,mBAAoC;CACjD,IAAI,QAAQ,aAAa,UACvB,IAAI;EACF,MAAM,EAAE,WAAW,MAAM,cACvB,qBACA;GAAC;GAAyB;GAAM;GAAiB;GAAM;GAAiB;EAAI,GAC5E;GAAE,UAAU;GAAQ,WAAW,OAAO;EAAK,CAC7C;EACA,OAAO;CACT,QAAQ;EACN,MAAM,IAAI,MACR,0FACF;CACF;CAGF,IAAI,QAAQ,aAAa,SAEvB,IAAI;EACF,MAAM,EAAE,WAAW,MAAM,cACvB,eACA;GAAC;GAAU;GAAW;GAAiB;GAAY;EAAe,GAClE;GAAE,UAAU;GAAQ,WAAW,OAAO;EAAK,CAC7C;EACA,IAAI,CAAC,OAAO,KAAK,GACf,MAAM,IAAI,MAAM,OAAO;EAEzB,OAAO;CACT,QAAQ;EACN,MAAM,IAAI,MACR,0KACF;CACF;CAGF,IAAI,QAAQ,aAAa,SAAS;EAKhC,MAAM,SAAS;GACb;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA,yBAAyB,GAVT,gBAAgB,GAAG,kBAUH;GAChC;GACA;GACA;GACA;GACA;GACA;EACF,CAAC,CAAC,KAAK,EAAE;EACT,IAAI;GACF,MAAM,EAAE,WAAW,MAAM,cACvB,cACA;IAAC;IAAc;IAAmB;IAAY;GAAM,GACpD;IAAE,UAAU;IAAQ,WAAW,OAAO;GAAK,CAC7C;GACA,IAAI,CAAC,OAAO,KAAK,GACf,MAAM,IAAI,MAAM,OAAO;GAEzB,OAAO;EACT,QAAQ;GACN,MAAM,IAAI,MACR,4FACF;EACF;CACF;CAEA,MAAM,IAAI,MACR,wDAAwD,QAAQ,SAAS,kCAC3E;AACF;AAEA,eAAsB,gCACpB,gBACwC;CACxC,IAAI,gBAKF,OAAO,gCAAgC,MAAM,SAAS,gBAAgB,MAAM,CAAC;CAE/E,MAAM,UAAU,MAAM,4BAA4B,cAAc;CAChE,OAAO,UAAU,mBAAmB,OAAO,IAAI;AACjD;;;;;;;;AASA,eAAsB,4BACpB,gBAC2C;CAC3C,IAAI,CAAC,gBAIH,IAAI;EACF,MAAM,QAAQ,MAAM,iCAAiC;EACrD,IAAI,OACF,OAAO;CAEX,QAAQ,CAGR;CAGF,MAAM,SAAS,iBADH,iBAAiB,MAAM,SAAS,gBAAgB,MAAM,IAAI,MAAM,iBAAiB,CAC1D;CACnC,IAAI,CAAC,UAAU,OAAO,WAAW,UAC/B,OAAO;CAET,IAAI,WAAW,QAAQ;EACrB,MAAM,UAAU;EAChB,OAAO,QAAQ,OAAO,gBAAgB,UAAU;CAClD;CAGA,MAAM,OAAO;CACb,OAAO,KAAK,gBACR,EAAE,OAAO;EAAE,eAAe,KAAK;EAAe,YAAY,KAAK,cAAc;CAAS,EAAE,IACxF;AACN;;;;;;;;AASA,eAAsB,+BACpB,SACA,YAAuB,OACa;CACpC,IAAI,QAAQ,OAAO,cAAc;EAC/B,MAAM,SAAS,QAAQ,MAAM;EAG7B,IADmB,SAAS,IAAI,KAAK,MAAM,CAAC,CAAC,QAAQ,IAAI,KAAK,IAAI,IAAI,MAAS,OAE7E,OAAO;CAEX;CACA,IAAI,CAAC,QAAQ,OAAO,eAClB,MAAM,IAAI,MAAM,iEAAiE;CAGnF,MAAM,WAAW,MAAM,UAAU,uCAAuC;EACtE,QAAQ;EACR,SAAS,EAAE,gBAAgB,oCAAoC;EAC/D,MAAM,IAAI,gBAAgB;GACxB,WAAW;GACX,eAAe;GACf,eAAe,QAAQ,MAAM;GAC7B,YAAY;EACd,CAAC;EACD,QAAQ,YAAY,QAAQ,GAAM;CACpC,CAAC;CACD,IAAI,CAAC,SAAS,IACZ,MAAM,IAAI,MAAM,qCAAqC,SAAS,OAAO,GAAG;CAG1E,MAAM,SAAkB,MAAM,SAAS,KAAK;CAC5C,IACE,CAAC,UACD,OAAO,WAAW,YAClB,OAAQ,OAAmC,iBAAiB,UAE5D,MAAM,IAAI,MAAM,qDAAqD;CAEvE,MAAM,YAAa,OAAmC;CACtD,MAAM,SACJ,OAAO,cAAc,YAAY,OAAO,SAAS,SAAS,IACtD,IAAI,KAAK,KAAK,IAAI,IAAI,YAAY,GAAK,CAAC,CAAC,YAAY,IACrD,QAAQ,MAAM;CACpB,OAAO;EACL,GAAG;EACH,OAAO;GACL,GAAG,QAAQ;GACX,cAAe,OAAmC;GAClD,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;EAC7B;CACF;AACF;;;;;;;;;;;AAYA,eAAsB,+BACpB,SACe;CACf,IAAI,CAAC,QAAQ,OAAO,eAClB,MAAM,IAAI,MAAM,oEAAoE;CAEtF,MAAM,aAAa,MAAM,mCAAmC,EAAE,iBAAiB,QAAQ,CAAC;CACxF,MAAM,OAAO,KAAK,UAAU,OAAO;CAEnC,IAAI,QAAQ,aAAa,UAAU;EAGjC,MAAM,QAAQ,qBAAqB,OAAO,KAAK,MAAM,MAAM,CAAC,CAAC,SAAS,QAAQ;EAE9E,MAAM,aACJ,qBACA,CAAC,IAAI,GACL,+BAA+B,gBAAgB,QAAQ,gBAAgB,OAJ7D,OAAO,KAAK,OAAO,MAAM,CAAC,CAAC,SAAS,KAIgC,EAAI,GACpF;CACF,OAAO,IAAI,QAAQ,aAAa,SAC9B,MAAM,aACJ,eACA;EAAC;EAAS;EAAkB;EAAW;EAAiB;EAAY;CAAe,GACnF,IACF;MACK,IAAI,QAAQ,aAAa,SA0B9B,MAAM,aAAa,cAAc;EAAC;EAAc;EAAmB;EAxBpD;GACb;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GAEA;GACA;GACA;GACA;GACA;GACA;GACA,kBAAkB,GApBF,gBAAgB,GAAG,kBAoBV,kBAAkB,gBAAgB;GAC3D;GACA;GACA;EACF,CAAC,CAAC,KAAK,EACwE;CAAM,GAAG,IAAI;MAE5F,MAAM,IAAI,MACR,gEAAgE,QAAQ,SAAS,EACnF;CAMF,MAAM,kCAAkC,SAAS,EAAE,OAAO,WAAW,CAAC;AACxE;;AAGA,SAAS,aAAa,SAAiB,MAAgB,OAA8B;CACnF,OAAO,IAAI,SAAS,SAAS,WAAW;EAQtC,SAPuB,SAAS,MAAM,EAAE,SAAS,IAAO,IAAI,QAAQ;GAClE,IAAI,KAAK;IACP,uBAAO,IAAI,MAAM,GAAG,QAAQ,kDAAkD,CAAC;IAC/E;GACF;GACA,QAAQ;EACV,CACA,CAAA,CAAM,OAAO,IAAI,KAAK;CACxB,CAAC;AACH;;;;;;;;;;AAWA,eAAsB,8BAAgD;CACpE,IAAI,MAAM,iCAAiC,GACzC,OAAO;CAET,IAAI;EACF,IAAI,QAAQ,aAAa,UAAU;GACjC,MAAM,cAAc,qBAAqB;IACvC;IACA;IACA;IACA;IACA;GACF,CAAC;GACD,OAAO;EACT;EACA,IAAI,QAAQ,aAAa,SAAS;GAChC,MAAM,EAAE,WAAW,MAAM,cAAc,eAAe;IACpD;IACA;IACA;IACA;IACA;GACF,CAAC;GACD,OAAO,OAAO,KAAK,CAAC,CAAC,SAAS;EAChC;EACA,IAAI,QAAQ,aAAa,SAAS;GAChC,MAAM,EAAE,WAAW,MAAM,cAAc,UAAU,CAC/C,SAAS,gBAAgB,GAAG,iBAC9B,CAAC;GACD,OAAO,WAAW,KAAK,MAAM;EAC/B;CACF,QAAQ;EACN,OAAO;CACT;CACA,OAAO;AACT;;;;;;;;AASA,eAAsB,mCAAqD;CACzE,MAAM,aAAa,MAAM,mCAAmC,EAAE,iBAAiB,KAAK,CAAC;CACrF,IAAI,UAAU;CACd,IAAI,QAAQ,aAAa,UACvB,IAAI;EACF,MAAM,cAAc,qBAAqB;GACvC;GACA;GACA;GACA;GACA;EACF,CAAC;EACD,UAAU;CACZ,QAAQ,CAER;MACK,IAAI,QAAQ,aAAa,SAC9B,IAAI;EACF,MAAM,cAAc,eAAe;GACjC;GACA;GACA;GACA;GACA;EACF,CAAC;EACD,UAAU;CACZ,QAAQ,CAER;MACK,IAAI,QAAQ,aAAa,SAC9B,IAAI;EACF,MAAM,cAAc,UAAU,CAAC,WAAW,gBAAgB,GAAG,iBAAiB,CAAC;EAC/E,UAAU;CACZ,QAAQ,CAER;CAEF,MAAM,eAAe,MAAM,mCAAmC,EAAE,OAAO,WAAW,CAAC;CACnF,OAAO,WAAW,eAAe;AACnC;;AAGA,SAAS,mBAAmB,SAAmE;CAC7F,MAAM,QAAQ,QAAQ;CACtB,IAAI,CAAC,OAAO,eACV,OAAO;CAKT,OAAO;EACL,eAAe,MAAM;EACrB,YAAY,MAAM,cAAc;CAClC;AACF;;AAGA,SAAS,iBAAiB,KAAsB;CAC9C,IAAI,QAAQ,IAAI,KAAK;CACrB,IAAI,MAAM,WAAW,oBAAoB,GACvC,QAAQ,OAAO,KAAK,MAAM,MAAM,EAA2B,GAAG,QAAQ,CAAC,CAAC,SAAS,MAAM;CAEzF,IAAI;EACF,OAAO,KAAK,MAAM,KAAK;CACzB,QAAQ;EACN,MAAM,IAAI,MAAM,yDAAyD;CAC3E;AACF;AAEA,SAAgB,gCAAgC,KAA4C;CAC1F,MAAM,SAAS,iBAAiB,GAAG;CACnC,IAAI,CAAC,UAAU,OAAO,WAAW,UAC/B,OAAO;CAGT,IAAI,WAAW,QACb,OAAO,mBAAmB,MAAmC;CAG/D,MAAM,OAAO;CACb,OAAO,KAAK,iBAAiB,KAAK,eAAe,OAAO;AAC1D"}

package/dist/providers/gemini-antigravity-state.d.ts

@@ -1,35 +0,0 @@
-/**
- * Antigravity's authoritative OAuth state.
- *
- * The IDE mirrors its `uss-oauth` topic into VS Code's global state SQLite
- * database. Updating only the go-keyring item is not enough: a running IDE
- * keeps this topic in memory and later writes its old token back. We therefore
- * update both stores, but only while Antigravity is fully stopped.
- */
-import type { AntigravityKeyringPayload } from './gemini-antigravity-oauth.js';
-export interface AntigravityStateOptions {
-    paths?: readonly string[];
-    home?: string;
-}
-interface AntigravityStateMutationOptions extends AntigravityStateOptions {
-    expectedPayload?: AntigravityKeyringPayload | null;
-    isAppRunning?: () => Promise<boolean>;
-}
-/** Known Antigravity user-data locations, newest product name first. */
-export declare function antigravityStateDatabasePaths(home?: string, platform?: NodeJS.Platform): string[];
-/** Read the OAuth token Antigravity itself will use on its next startup. */
-export declare function readAntigravityStateOAuthPayload(opts?: AntigravityStateOptions): Promise<AntigravityKeyringPayload | null>;
-export declare function antigravityStateCredentialExists(opts?: AntigravityStateOptions): Promise<boolean>;
-export declare function antigravityProcessListHasApplication(stdout: string, platform?: NodeJS.Platform): boolean;
-export declare function antigravityApplicationRunning(): Promise<boolean>;
-/**
- * Refuse an external DB rewrite while the owner can overwrite it from memory.
- * Call before any Keychain mutation so a rejected switch remains mutation-free.
- */
-export declare function assertAntigravityStateSafeToMutate(opts?: AntigravityStateMutationOptions): Promise<string[]>;
-/** Update every installed Antigravity state store and verify the durable token. */
-export declare function writeAntigravityStateOAuthPayload(payload: AntigravityKeyringPayload, opts?: AntigravityStateOptions): Promise<number>;
-/** Remove only the OAuth entry, preserving every unrelated unified-state key. */
-export declare function deleteAntigravityStateOAuthPayload(opts?: AntigravityStateOptions): Promise<number>;
-export {};
-//# sourceMappingURL=gemini-antigravity-state.d.ts.map

package/dist/providers/gemini-antigravity-state.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"gemini-antigravity-state.d.ts","sourceRoot":"","sources":["../../src/providers/gemini-antigravity-state.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AASH,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AAwB5E,MAAM,WAAW,uBAAuB;IACtC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,UAAU,+BAAgC,SAAQ,uBAAuB;IACvE,eAAe,CAAC,EAAE,yBAAyB,GAAG,IAAI,CAAC;IACnD,YAAY,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;CACvC;AAED,wEAAwE;AACxE,wBAAgB,6BAA6B,CAC3C,IAAI,CAAC,EAAE,MAAM,EACb,QAAQ,kBAAmB,GAC1B,MAAM,EAAE,CA8BV;AAyUD,4EAA4E;AAC5E,wBAAsB,gCAAgC,CACpD,IAAI,GAAE,uBAA4B,GACjC,OAAO,CAAC,yBAAyB,GAAG,IAAI,CAAC,CAgB3C;AAED,wBAAsB,gCAAgC,CACpD,IAAI,GAAE,uBAA4B,GACjC,OAAO,CAAC,OAAO,CAAC,CAIlB;AAED,wBAAgB,oCAAoC,CAClD,MAAM,EAAE,MAAM,EACd,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,OAAO,CAqBT;AAED,wBAAsB,6BAA6B,IAAI,OAAO,CAAC,OAAO,CAAC,CAkBtE;AAED;;;GAGG;AACH,wBAAsB,kCAAkC,CACtD,IAAI,GAAE,+BAAoC,GACzC,OAAO,CAAC,MAAM,EAAE,CAAC,CA+BnB;AAED,mFAAmF;AACnF,wBAAsB,iCAAiC,CACrD,OAAO,EAAE,yBAAyB,EAClC,IAAI,GAAE,uBAA4B,GACjC,OAAO,CAAC,MAAM,CAAC,CAmBjB;AAED,iFAAiF;AACjF,wBAAsB,kCAAkC,CACtD,IAAI,GAAE,uBAA4B,GACjC,OAAO,CAAC,MAAM,CAAC,CAoBjB"}